What does jailbreak do to the iPhone technically?

views:

742

answers:

+16 Q:

What does jailbreak do to the iPhone technically?

Hello all:

I am an iPhone developer, and would like to get to know more about the internals of the OS and device. I know HOW to jailbreak, but I want to know specifically what it does to the system. I've been looking for info about it, but can't find anything solid. If anyone knows or can point me to resources, I'd greatly appreciate it.

Thanks! Thomas

Edit (6/29/10): I'm still following the subject and added a couple new answers with some VERY interesting info. If you're curious about it, check those out as well.

+2 A:

Actually it should allow the operating system to run unsigned applications.

All the iphone applications have a certificate that is issued by Apple that certifies the integrity of application.. any modification to the original application would violate this certificate making it impossible to run: the OS refuses itself to launch it. This applies also to unsigned applications..

when you jailbreak the iphone you basically bypass these checks allowing it to run whatever you want. This is a two-sided blade: it's very restrictive (Apple style) but forbids the execution of malicious software, since it won't get signed.

The official reason of doing it this way is to avoid things as:

using forbidden/untested capabilities of the SDK (like hidden APIs)
controlling what will run on iphones
be sure about having applications without gargantuous bugs
be sure about having applications that don't clutter the iphone itself (memory leaks, uncontrolled CPU at 100% and so on)

Also the refuse of multitasking has these reasons, they needed a lot of time to develop a fake multi-tasking (that will be the one shipped with OS4) that is a sort of managed one: forget about having real background processes.

A side note: as a iphone developer you should have noted that you have to generate a certificate with your apple identity to allow testing of your apps on your device, that's part of this tale..

Jack 2010-04-19 15:58:21

Who's to say malicious software couldn't get a legit cert? I suppose that if the software's malice was latent until a certain date in the long/medium-term future, and if it was sufficiently obfuscated... But I imagine that Apple would require the source code before they approve/sign anything. And then there's the possibility of a legit app that later downloads a malicious plugin/component... I don't know if i(Pad|Phone|Pod) apps are allowed to do this though...

FrustratedWithFormsDesigner 2010-04-19 16:02:26

I don't know how their testings work. They want the bundled app before allowing you to publish it. Probably they use some heuristics (antivirus style) to check about common maliciousness.

Jack 2010-04-19 16:05:25

@Frustrated - there is no source code involved in the approval process. Apple only get's the binary to be published, and runs whatever analysis they do on that alone.

calmh 2010-04-19 16:13:00

The fact that there are now something like 150,000 approved apps with zero exploits versus a dozen or so exploits for jailbroken phones, argues that the system works in that regard. The certs also prevent the use of plugins because the system will refuse to run code that does not match the cert (much to my annoyance.)

TechZen 2010-04-19 17:07:11

This because average user doesn't need exploited features..

Jack 2010-04-19 17:34:06

Thanks for the breakdown Jack! But I still would like to know how people actually go about finding and exploiting these features. I looked at the Open Application Development book, but that didn't really explain much. I'm looking for something that tells me exactly what the Pwnage tool or Purplera1n or any of the other jailbreak apps actually DO.

Thomas 2010-04-26 01:06:06

+2 A:

iPhone Open Application Development, by Jonathan Zdziarski, has a brief discussion of how various jailbreaking methods get into the system.

TechZen 2010-04-19 17:17:00

Sweet! Thanks. I'll check this book out.

Thomas 2010-04-20 18:06:48

Actually, this doesn't really go into detail about the jailbreak method. It's mainly details how people developed before the iPhone SDK was released. Not as helpful as I thought, but thanks anyway!

Thomas 2010-04-26 00:34:30

+3 A:

Hey There,

Your best shot would actually be to look at the website of the guys who are hacking the iphone. This is what they released about their first jailbreak of the iphone.
If you go to the root of the wiki, there's a lot more information available.

Now, Mind you, this information is not specifically written for easy consumption. However, there is a lot of information there, and if you need more details or help you can always ask on their irc channel (which is also linked from the root of the wiki).

TumbleCow 2010-05-03 19:43:15

YES! This is what I'm looking for. Thanks!!

Thomas 2010-05-05 02:29:32

+2 A:

Found another post about the same thing here if anybody wants to follow both.

Thomas 2010-05-10 21:40:10

+1 A:

This one is really interesting as well.

Thomas 2010-06-12 16:22:35

+3 A:

This is the definitive answer I've been looking for!!!!!! From Saurik's page. The Wikipedia Jailbreak article is helpful too.

Explanation of the Different Types of Jailbreaks
Saurik Interview: History of iPhone OS Jailbreaking
Redsn0w vs other methods
The PDF exploit explained
The iPhone Wiki

Thomas 2010-06-29 17:07:44

ansaurus

tags:

views:

answers:

What does jailbreak do to the iPhone technically?

related questions