Jailbreak IOS 10.0.1 device via mach_portal without unlocking the iDevice

Question

Is there a way to jailbreak an iPhone 6 running iOS 10.0.1 via mach_portal (a basic root shell exploit which can be found here) while the device is locked, maybe some runtime code injection exploit etc. , or is the whole NAND encrypted while the device is locked?

Answer 1

Is there a way to jailbreak an iPhone 6 running iOS 10.0.1 via mach_portal (a basic root shell exploit which can be found here) while the device is locked?

No. The mach_portal exploit requires you to install and run an application on the device, which requires the device to be unlocked.

Additionally, the mach_portal exploit is not a jailbreak. It could potentially be one component of a jailbreak, but it would need to be combined with a number of other important components (e.g, kernel patches to disable code signature checks and sandboxing) to allow it to be used as one.

… or is the whole NAND encrypted while the device is locked?

It's complicated. All storage on iOS devices is encrypted. However, some of this data is encrypted using only a key that's embedded into the processor (the device UID), making it accessible at all times; other data is encrypted using a key that is wrapped using the device's passcode, making it only available when the device is unlocked.

Some details on this system are available in Apple's iOS Security Guide. But the TL;DR is that most of the important data is inaccessible until the device is unlocked.

Answer 2

From an interesting article about iOS security:

1. Since the iPhone 3GS, all iOS devices have used a hardware-based AES full-disk encryption that prevents storage from being moved from one device to another, and facilitates a fast wipe of the disk.
2. Since iOS 4 (iPhone 4), additional protections have been available using the Data Protection API (DPAPI).
3. The DPAPI allows files to be flagged such that they are always encrypted when the device is locked, or encrypted after reboot (but not encrypted after the user enters their passcode once).
4. Once a user locks a device with a passcode, the class keys for “complete” encryption are wiped from memory, and so that data is unreadable, even when booting from a trusted external image.
5. Once a user reboots a device, the “complete until first authentication” keys are lost from memory, and any files under that
6. DPAPI protection level will be unreadable even when booted from an external image. Under iOS 8, many built-in applications received the “complete until first authentication” protection.