@chronic 1/ there’s no such bootloader as BSS, there’s iBSS (iBoot Single Stage) instead
2/ LLB cannot enter recovery mode, it enters DFU-like mode
3/ boot-command upgrade makes it boot new iBEC, not iBSS
4/ SecureROM versions do NOT match iBoot version at the time of device release
2/ LLB cannot enter recovery mode, it enters DFU-like mode
3/ boot-command upgrade makes it boot new iBEC, not iBSS
4/ SecureROM versions do NOT match iBoot version at the time of device release
@chronic 5/ there’s console on production iBoot too, although very limited
6/ there’re more iBoot flags than he shows
7/ demotion to 01 is enough to get JTAG (I’d even say SWD). Demotion of Security status isn’t even possible according to @s1guza
6/ there’re more iBoot flags than he shows
7/ demotion to 01 is enough to get JTAG (I’d even say SWD). Demotion of Security status isn’t even possible according to @s1guza
https://twitter.com/s1guza/status/1178297251996864512?s=21
@chronic @s1guza 8/8 limera1n isn’t the only bootrom exploit of the past times. There also were Pwnage 1/2, steaks4uce, 24kpwn, SHAtter and alloc8
That was just brief view, by the way
That was just brief view, by the way
• • •
Missing some Tweet in this thread? You can try to
force a refresh
