Okay I am attempting to Push a Modded IOS over to my device. It is an older Device Running IOS 9.3.5. I have by passed All other Security Measures, however When the Kernal checks the File Signature it, the Kernal automatically revereses the Modded IOS files. I still have the original IOS Files that are untampered with.
What I am trying to do is to Copy the File Signature from that is applied to the files in the image file of the Main IOS File. How would I go About Duplicating, or capturing the Signature from the orignal. If i can do that, I can wrap the modded file with it and the kernal Will Accept the Files. Any Ideas of how to do that?
Are there any programs that can do this automatically, by reading the Files Signature and applying it to the modded file?
Edit: after doing some more searching i found the IOS Signatures For this IOS update. I found the files in C:\3uTools\Others\ss_ios93.zip This file Contained an image file, and a sig file. Stay tuned, as i am going to copy the sig file to the desktop and attempt to use signTool to wrap the modded files. Another update to Come Soon.
Another Edit: Okay, so this actually worked. I will give a brief description of how to trick an IOS device to Installing an modded Update.
- windows os, with linux Virtual box. (Oracle VirtualBox is free) 2.A untammpered version of Update
- fiddler 4
- md5Checksum app 9.3uTools
start by changing Folder Options (windows 7-10 Uncheck Hide File Extensions, windows 7 and below check Show File Extensions)
create Folder and Copy the IOS Update into the folder. DO NOT USE the Untampered otherwise you will have to download again.
change the extension of the file you wish to tamper from ipsw to zip. Extract into folder
now open IDecrypt and decrypt the root File System using the key found at iphonewiki. then Extract using 7z, extract to folder.
Once you changed what you would like. We start the Capturing of Server Response, and Apple Signature. Open fiddler 4, and 3uTools, Connect device in dfu mode.
In 3uTools, click the proFlash, import the unTampered Update. Flash it. During the Process, 3uTools, will recieve and store the apple signature and you have now captured the server Response From 3uTools telling the Application what the md5 checksum of the update file should be, and then when pushing the disk image files it recieves the Apple Signature File. In Fiddler find where 3uTools Contacted the 3userver, search through them until you the one that in the textView show an lot of numbers which is the ECID then at the bottom you will see the md5 code the value between this is the md5 hash that it should be. export to notepad, and save.
now that 3uTools has Finished, Go into the 3uTools Files, look inside the Others folder once there. now there should be a zip file. For IOS Update 9.3.5 the name of this zip will be ss_ios93.zip. Extract this file into a folder inside will be a .sig file and another image. That .sig File is the Most important File there is. It will be used to sign the Modded files.
now load linux, and use the kernel to sign the Any Files, you Modded. Make sure that in the metadata that the last modification matches the pervious version. Without both the Update will Fail.
now transfer files back to windows. Use 7z to add to archive, use the image key for the root file system as the password for aes-256. So you Repack, and encrypt at the same time. Once done change the .zip or .7z TO .dmg
Place your new dmg file into your extracted Folder. Now you will need to calculate the crc32 value. This value will be inside the build manifest. And change the old crc32 to the new crc32 value. Then pass then Sign the build manifest change the last modified date back to the original date. Replace old Manifest File. Repeat if you want to change more than that one dmg file.
Once all of your Modding is Complete, ReZip the File. Then Change the .zip to ipsw, and run md5 Checksum.
In the server response you captured earlier, replace old md5 checksum with your own md5 checksum.
In Fiddler 4, click auto Response, Click on the request for md5 checksum from the 3uTools Application, to the 3uTools servers. this should autoFill the first part of the then respond with your text File. This will make 3uTools think it was a response from the 3uTools servers and pass first validation.
after that 3uTools Passes the Files over to the device. This is where you find out if you did everthing right. If one thing is left unsigned, the wrong crc32 the kernel will Fail the image and revert back to previous version. Making sure you sign everyting the crc32 values are in the build manifest. IF YOU DELETE A FILE FROM THE IMAGE YOU MUST CHANGE THE DEVICE TREE SO THE KERNEL DOES NOT LOOK FOR A FILE THAT ISNT THERE, THUS FAILING THE WRITTING SEQENCE OF THE IMAGE.
I know this process works with IOS Update 9.3.5 however, USE AT YOUR OWN RISK FOR ANY OTHER VERSION. This Process will not Remove Icloud lock, or Activation Lock. For that you must either install nand to usb and Decrypt then Reformat, or replace the Nand
This was merly a project to prove to my brother that Apple Security Can be Broken.