Evasi0n

Last updated
evasi0n
Developer(s) Evad3rs (pod2g, MuscleNerd, planetbeing, pimskeks)
Stable release
1.5.3
Operating system Microsoft Windows, macOS and Linux
Website evasi0n.com/iOS6 (archived)
evasi0n7
Developer(s) Evad3rs (pod2g, MuscleNerd, planetbeing, pimskeks)
Stable release
1.0.8
Operating system Microsoft Windows, and macOS
Website evasi0n.com (archived)

evasi0n is a jailbreak program for iOS 6.0-6.1.2, released on 4 February 2013, made by the evad3rs team. An updated version for iOS 7.0-7.0.6, evasi0n7, was released on 22 December 2013. More than seven million copies of evasi0n were downloaded in the first four days after release. [1] It is known for a portable code base and minimal use of arbitrary code execution.

Contents

History

Four of the six exploits used were patched by Apple on 18 March 2013 with the release of iOS 6.1.3. On 22 December 2013, the evad3rs released a new version of evasi0n that supports iOS 7.x, known as evasi0n7. One major exploit used by this jailbreak was patched by Apple with the 4th beta of iOS 7.1 and two more with beta 5. The final release of iOS 7.1 fixed all the exploits used by evasi0n7. [2] [3] [4]

Technology

The evasi0n jailbreak first remounts the root file system as read-write and then achieves persistence by editing the /etc/launchd.conf file, which launchd consults. Evasi0n then applies patches in the kernel, bypassing address space layout randomization by triggering a data fault and reconstructing the kernel slide by reading the faulting instruction from the appropriate ARM exception vector. [5] It produces an "untethered" jailbreak, which means that the jailbreak continues to work even after rebooting the phone.

PCMag reported that evasi0n checks whether it is running on a Chinese-language computer, and, if so, installs Taiji, a Chinese app market, rather than Cydia. [6]

See also

Related Research Articles

Darwin is the core Unix-like operating system of macOS, iOS, watchOS, tvOS, iPadOS, audioOS, visionOS, and bridgeOS. It previously existed as an independent open-source operating system, first released by Apple Inc. in 2000. It is composed of code derived from NeXTSTEP, FreeBSD, other BSD operating systems, Mach, and other free software projects' code, as well as code developed by Apple.

<span class="mw-page-title-main">Privilege escalation</span> Gaining control of computer privileges beyond what is normally granted

Privilege escalation is the act of exploiting a bug, a design flaw, or a configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. The result is that an application or user with more privileges than intended by the application developer or system administrator can perform unauthorized actions.

iOS Mobile operating system by Apple

iOS is a mobile operating system developed by Apple exclusively for its smartphones. It was unveiled in January 2007 for the first-generation iPhone, launched in June 2007.

SpringBoard is the standard application that manages the iPhone's home screen. Other tasks include starting WindowServer, launching and bootstrapping applications, and setting some of the device's settings on startup.

iOS jailbreaking is the use of a privilege escalation exploit to remove software restrictions imposed by Apple on devices running iOS and iOS-based operating systems. It is typically done through a series of kernel patches. A jailbroken device typically permits root access within the operating system and provides the right to install software unavailable through the App Store. Different devices and versions are exploited with a variety of tools. Apple views jailbreaking as a violation of the end-user license agreement and strongly cautions device owners not to try to achieve root access through the exploitation of vulnerabilities.

<span class="mw-page-title-main">Cydia</span> iOS package manager

Cydia is a graphical user interface of APT for iOS. It enables a user to find and install software not authorized by Apple on jailbroken iPhones, iPads and iPod Touch devices. It also refers to the digital distribution platform for software on iOS accessed through Cydia software. Most of the software packages available through Cydia are free of charge, although some require purchasing.

<span class="mw-page-title-main">Installer.app</span> Freeware software installer for the iPhone

Installer.app was a freeware software installer for the iPhone created by Nullriver and later maintained by RipDev, first released in summer 2007 and maintained until summer 2009. Installer allowed users to install third-party applications into the iPhone's Applications directory where native applications are kept. Users could install applications from a variety of sources provided by software developers or directly onto the iPhone without requiring a computer. Users could browse lists of applications inside Installer to find ones they wanted to install. In June 2009, RipDev dropped support for Installer in favor of developing a different package manager and installer named Icy.

blackra1n is a program that jailbreaks versions 3.1, 3.1.1 and 3.1.2 of Apple's operating system for the iPhone and the iPod Touch, known as iOS.

Rooting is the process by which users of Android devices can attain privileged control over various subsystems of the device, usually smartphones and tablets. Because Android is based on a modified version of the Linux kernel, rooting an Android device gives similar access to administrative (superuser) permissions as on Linux or any other Unix-like operating system such as FreeBSD or macOS.

<span class="mw-page-title-main">Jay Freeman</span> American computer scientist

Jay Ryan Freeman is an American businessman and software engineer. He is known for creating the Cydia software application and related software for jailbroken iOS—a modified version of Apple's iOS that allows for the installation and customization of software outside of the regulation imposed by the App Store system.

In computing, a SHSH blob is a digital signature that Apple generates and uses to control the iOS versions that users can install on their iOS devices generally only allowing the newest iOS version to be installable. Apple's public name for this process is System Software Authorization. The term “SHSH blob” is unofficial and based on abbreviations for signed hash and binary large object. An alternative term, ECID SHSH, refers to the device's ECID, a unique identification number embedded in its hardware)

<span class="mw-page-title-main">JailbreakMe</span> Series of iOS jailbreaks

JailbreakMe is a series of jailbreaks for Apple's iOS mobile operating system that took advantage of flaws in the Safari browser on the device, providing an immediate one-step jailbreak, unlike more common jailbreaks, such as Blackra1n and redsn0w, that require plugging the device into a computer and running the jailbreaking software from the desktop. JailbreakMe included Cydia, a package management interface that serves as an alternative to the App Store. Although it does not support modern devices, it can still be used and the site is up.

greenpois0n is a name shared by a series of iOS jailbreaking tools developed by Chronic Dev Team that use exploits to remove software restrictions on iPhones, iPads, iPod Touches, and Apple TVs. Greenpois0n's initial release in October 2010 jailbroke iOS 4.1, and its second version in February 2011 jailbroke iOS 4.2.1 as well as iOS 4.2.6 on CDMA iPhones. The second generation of the tool, greenpois0n Absinthe, was developed with iPhone Dev Team members and jailbroke iOS 5.0.1 in January 2012, and a second version jailbroke iOS 5.1.1 in May 2012.

<span class="mw-page-title-main">Hacking of consumer electronics</span>

The hacking of consumer electronics is a common practice that users perform to customize and modify their devices beyond what is typically possible. This activity has a long history, dating from the days of early computer, programming, and electronics hobbyists.

David Wang is a mobile phone hacker.

The Pangu Team, is a Chinese programming team in the iOS community that developed the Pangu jailbreaking tools. These are tools that assist users in bypassing device restrictions and enabling root access to the iOS operating system. This permits the user to install applications and customizations typically unavailable through the official iOS App Store.

PP Jailbreak, also commonly known as PP, PP25 App or PP25 Jailbreak, is a term describing a free Chinese app containing tools capable of jailbreaking iOS 8 devices, except for Apple TV. Eligible products include: iPod Touch, iPhone and iPad. This app was developed by a Chinese iOS hacking community known as PP Assistant. It was first released on January 19, 2015

The iOS mobile operating system developed by Apple has had a wide range of bugs and security issues discovered throughout its lifespan, including security exploits discovered in most versions of the operating system related to the practice of jailbreaking, bypassing the user's lock screen, issues relating to battery drain, crash bugs encountered when sending photos or certain Unicode characters via text messages sent through the Messages application, and general bugs and security issues later fixed in newer versions of the operating system.

The Linux kernel can run on a variety of devices made by Apple, including devices where the unlocking of the bootloader is not possible with an official procedure, such as iPhones and iPads.

<span class="mw-page-title-main">Early iPhone systems-on-chip</span> Chips used for the first iPhones

iPhone and iPod Touch models released between 2007 and 2009 used system on a chip (SoC) circuits designed by Samsung and manufactured to Apple's specifications. Two such SoCs were used: the Samsung S5L8900, used in the first-generation iPhone, the iPhone 3G, and the first-generation iPod Touch, and the Samsung S5L8920, used in the iPhone 3GS and the third-generation iPod Touch. Both chips belong to Samsung's S5L family of SoCs.

References

  1. "Evasi0n 'jailbreaks' 7M iOS devices, update already available for iOS 6.1.1". AppleInsider. 12 February 2013. Retrieved 13 February 2013.
  2. "iH8sn0w on Twitter: "So the code sign bug that evasi0n7 uses still exists in 7.1b4. Kernel exploit looks patched though :P"". Twitter.com. 2014-01-21. Retrieved 2015-01-28.
  3. "iH8sn0w on Twitter: "Apple fixed the chown vuln that appeared in iOS 7 and used by evasi0n7 by checking to see if its a symlink again :P"". Twitter.com. 2014-02-04. Retrieved 2015-01-28.
  4. "iH8sn0w on Twitter: "evasi0n7's afc sandbox escape is patched in 7.1b5 too."". Twitter.com. 2014-02-04. Retrieved 2015-01-28.
  5. Greenberg, Andy. "Inside Evasi0n, The Most Elaborate Jailbreak To Ever Hack Your iPhone". Forbes . Retrieved 23 December 2013.
  6. "The Real Code In iOS 7 Jailbreak's Evasi0n". PCMag. Retrieved 2023-03-28.