Let's Bypass the iPhone Passcode without Restoring

Let's Bypass the iPhone Passcode without Restoring

---

Ok, So I have stumbled on a few 3GS's in the past months since the release that are stuck on disabled screens. All options have been exhausted except for a full restore, which inadvertently would put the 3GS on 3.1 making it a locked phone, no good! There has been talk by Nervegas (Jonathan Zdziarski) that he has developed something for use by police to bypass the passcode on the 3GS and other models by simply uploading a custom hybrid of purplera1n and redsn0w. However, he will not release it to the pubic. I am sure with the heads we have out here at MMi we too could develop such a tool which in turn would benefit a lot of us. Below is the information I have gathered so far including the videos he has posted as well. Lets see what we can all do together! Andrew Hoog, Chief Investigative Officer at Via Forensics, has put together an iPhone Forensics Whitepaper summarizing the available forensic techniques for recovering data from the iPhone. Depending on what kind of information you want to get, there are a number of different techniques you can use. Download the iPhone Forensics Whitepaper here:http://www.megaupload.com/?d=3GB0AILF July 24, 2009: The Simplicity Of Bypassing iPhone 3G[s] Passcode and Encryption Bypassing Passcode and Backup Encryption: These YouTube videos, courtesy of security researcher Jonathan Zdziarski, demonsrate just how easy it is to bypass the passcode and backup encryption in an iPhone 3G[s] within only a couple of minutes' time. A second video shows how easily tools can pull an unencrypted raw disk image from the device. The seriousness of the iPhone 3G[s]' vulnerabilities may make enterprises and government agencies think twice before allowing these devices to contain confidential data. Apple has been alerted to and aware of these vulnerabilities for many years, across all three models of iPhone, but has failed to address them. Jonathan adds: The 3G[s] has penetrated the government/military markets as well as top fortune-100s, possibly under the misleading marketing term "hardware encryption", which many have taken at face value. Serious vulnerabilities such as these threaten to put our country's national security at risk. Unfortunately, the only way Apple seems to listen is through addressing such problems publicly, as all previous attempts to talk with them have failed. I sincerely hope they fix these issues before a breach occurs.. Quote: Many of you use such iPhone function, as “Protection by password”. But very few people knows, that this protection is easy enough to bypass. Famous Jonathan Zdziarski, has published today a way how to bypass this protection: 1. Prepare custom Apple iPhone RAM disk. Internet has tons of FAQs how to make it (for example with help of iLiberty+). Mount your RAM disk /dev/rdisk0s2 and delete file /mnt/mobile/Library/Preferences/com.apple.springboard.plist. This is a config which tells Springboard “passcode: on”. 2. Using any utility get your iPhone into “Recovery Mode” and after that upload RAM disk using something like this: (iPHUC Recovery) #: filecopytophone Bypass_Passcode.bin (iPHUC Recovery) #: cmd setenvboot-argsrd=md0-x-spmd0=0×9340000.0xA00000 (iPHUC Recovery) #: cmd saveenv (iPHUC Recovery) #: cmd bootx 3. Then reboot your iPhone and that’s it: protection by the password are not present anymore. Here is the information from the class he offers teaching his method: Quote: Advanced iPhone Forensics L-1 Recovering Evidence, Personal Data, and Corporate Assets The iPhone has become America's #1 mobile device, and is increasingly being used in business, personal activities, and also crime. The iPhone stores an enormous amount of information useful to corporate security professionals and law enforcement agents. Enterprises must adequately manage sensitive data which may put their company at risk. Law enforcement agencies and freelance forensic examiners must process the iPhone for evidence linking its owner to crimes. Host a course for your department and provide these crucial skills to your personnel. Jonathan Zdziarski, original iPhone hacker and author of many iPhone books including iPhone Forensics and iPhone SDK Application Development, will lead your organization's security professionals through the delicate process of recovering and processing evidence stored on the iPhone. This full two-day course will guide you, hands on, through forensic recovery and electronic discovery of an iPhone, iPhone 3G, and iPhone 3G[s] and cover iPhone firmware up to and including the new v3.1. Attendees will receive a 170pp white paper containing Zdziarski's latest methods, the tools they can use in the field, and a certificate of completion to certify their skillset. All of the tools and demo content used in the classroom will also be provided so attendees can learn and follow hands-on. Have Jonathan train your personnel hands-on to learn: What kind of evidence is stored on an iPhone, and what can be recovered through desktop trace Raw disk recovery of a v1.x, v2.x, and v3.x iPhone user disk partition, preserving and recovering the entire raw user disk. Recovery over USB cable or Wi-Fi. Making commercial tools, such as Encase, recognize an iPhone disk image Bypassing passcode protection and device encryption to gain access to the device's user interface for compatibility with third-party triage tools, or for time-sensitive cases where preservation of life is priority. Interrupting the iPhone 3G's "secure wipe" process Recovering deleted voicemail, images, email, and other personal data using data carving techniques Recovering geotagged metadata from camera photos (GPS coordinates taken at the time the photo was taken) Electronic discovery of Google map lookups, WiFi connect records, keyboard typing cache, and other sensitive data stored on the live file system Extracting contact information and other data from the iPhone's database Collecting desktop trace and establishing trusted relationships to owners' desktops Different recovery strategies based on case needs Using the tools and know-how provided in this course, you'll work hands-on to recover stored and deleted information from the iPhone including: Keyboard caches containing usernames, passwords, search terms, and historical fragments of typed communication. Screenshots preserved from the last state of an application, taken whenever the home button is pressed, or when 3D zoom effects are used. Deleted images from the suspect's photo library, camera roll, and browsing cache. Deleted address book entries, contacts, calendar events, and other personal data. Exhaustive call history, beyond that displayed. Reconstructing record fragments from corrupt databases Map tile images from the iPhone's Google Maps application, lookups and longitude/latitude coordinates of previous map searches, and coordinates of the last GPS fix. Browser cache and deleted browser objects, which identify the web sites a user has visited. Cached and deleted email messages, SMS messages, and other communication with corresponding time stamps. Deleted voicemail recordings stored on the device. Pairing records establishing trusted relationships between the device and one or more desktop computers. Sources: http://gizmodo.com/5046050/hacker-to...september-11th http://www.wired.com/gadgetlab/2009/...ne-encryption/

Recover iPhone 3GS from Apple Logo or Recovery Mode loop

Sometimes iPhone stucked at boot process and showed only an Apple logo (boot logo), some time it stucked on recovery mode loop i.e. iPhone starts in recovery mode after every restart. Here is a little tutorial on how to Recover iPhone 3GS from Apple Logo or Recovery Mode loop with the help of iRecovery. Thanks to Westbaer and Posixninja who made this awesome utility. iRecovery is a libusb-based command line utility for Mac OS X and Linux (perhaps Windows too). It is able to talk to the iBoot/iBSS in Apple’s iPhone/iPod touch via USB.

Run “ printenv “ comand in iRecovery and check your auto boot is set as false or true. For normal boot auto-boot should be set as true. If the auto-boot is flagged false then you have to set it as true. The following screenshot is from a iPhone 3GS which was stucked on Apple Logo, you can clearly see the auto-boot is set as false.

Here are the instructions below for changing your iPhone auto-boot from false to true with iRecovery for Windows and Mac OS X. Make sure while using iRecovery  your phone is on recovery mode, if it isn’t then put your phone in recovery mode using the following procedure.

• Turn the device completely off and disconnect it from cable/dock.
• Hold down the home button.
• While holding down the home button connect to a computer with a cable (easiest) or dock.
• Keep holding down the home button until you see a connect-to-iTunes screen You are now in recovery mode.

_____________________________________________________________________________________

Instruction’s For Mac OS X :

1) Download iRecovery package for Mac OSX and Unzip iRecovery folder to desktop.

2) Open terminal and perform cd ~/desktop

3) Now change the permission of both files to 777 by following commands.

chmod 777 libusb-0.1.4.dylib

chmod 777 iRecovery

4) Now launch Showallfiles you downloaded earlier, and Navigate usr > lib and copy the file libusb-0.1.4.dylib into that folder.

5) Drag-and-drop the iRecovery file into the Terminal so that you get a shortcut to it.

6) Append ‘-s’ to the end and press enter.

7) Execute the following commands

        setenv auto-boot true

            saveenvs

      fsboot

If the phone is still on boot loop then once again, just run through the procedure again. When my phone was stucked on Apple mode, I repeated the procedure 3 times and on third attempt my phone restored to usable condition. So don’t panic if you don’t succeed in first attempt. If the attempts fails then try again and this time replace “fsboot” with “reboot”

_____________________________________________________________________________________

Instruction’s For Windows :

1) Download irecovery for Windows and unzip to Desktop. Install libusb from the downloaded pack for Windows users only Mac users can skip this step. If you are on Windows Vista then follow the steps given below to install Libusb-Win32.

• Right click on this file. Select Properties | Compatibility Click the “Run this program in compatibility mode” box and select  “Windows XP (Service Pack2)” from the drop down list.
• Right click again and select “Run as “Administrator”. Follow the installation instructions. Running the test program list the usb devices plugged into my computer – but not my new device.

2) Start iRecovery in Terminal / Console with iRecovery -s

3) Execute the following commands:

setenv auto-boot true

                saveenv

                fsboot

If the phone is still on boot loop then once again, just run through the procedure again. When my phone was stucked on Apple mode, I repeated the procedure 3 times and on third attempt my phone restored to usable condition. So don’t panic if you don’t succeed in first attempt. If all attempts fails then try again and this time replace “fsboot” with “reboot”

Source: ihackintosh