from Realtime Operating systems to unlocking iPhones in less than 30 slides

transcript

Nucleus OSfrom real-time operating systems to unlocking iPhones

in less than 30 slides

HdM Stuttgart Media UniversityComputer Science and Media

2010 - Kai Aras

Tuesday, December 14, 2010

Nucleus OSFacts

• Real-time operating system

• developed by Mentor Graphics

• written in C

• Closed Source

• Eclipse based SDK starting at $2995 USD

• Supported Platforms: ARM / MIPS / Freescale / PowerPC

Requires tasks to be executed within a given timeframe

Neglects throughput

Guarantees either Hard- or Soft real-time performance

Soft Hard

Task failes after deadline

May cause critical system-failure

Lateness is tolerated

May cause adaption of service quality

Designs

Event driven Time sharing

task switch only occurs on events of higher priority

task switch occurs on regular clock interrupt

Architecture

Kernel

Connectivity

Storage

Security

Application Platform

Inflexion UI Multimedia

Window System

GUI Designer

Hardware accelleration

Framework

support for many codecs

Hardware accelleration

Real world examples

Handheld DevicesTI n-Spire series - graphic calculators

Signal ProcessingBLU-800 Digital Signal Processors

Cellphones/Multimedia DevicesiPhone/iPod/iPad - S-Gold2/X-Gold 608

iOS Hardware ArchitectureApplication Processor

Baseband Processor

iOSUser interactionApplications...

NucleusOSRadio communication

iOS Hardware Architecture

Application Processor Baseband Processor

display

power managment

camera

I2SGPIODMA

controls sim/net-lock !

Boot sequence

NORROM

signature check

seczone

protected area contains:

encrypted lock-state

Firmware(Nucleus OS)

BootloaderBootrom

Unlocking

Bootrom Bootloader

NORROM

signature check

seczone

protected area contains:

encrypted lock-state

1. truly unlock by altering lock-state in seczone

seczone

Firmware(Nucleus OS)

2. unlock on-the-fly by constantly overriding netlock

checks in firmware

Unlocking

1. truly unlock by altering lock-state in seczone

hasn‘t been done yet due the tha lack of bootrom exploits

Unlocking2. unlock on-the-fly

by constantly overriding netlock checks in firmware

Application Processor

Baseband Processor

Nucleus OS seczone

unlockd

exploit code execution vulnerabilities to override

netlock „on-the-fly“

run deamon process on application processor

* (requires jailbreak)

Questions ?slides and additional info on jailbreaking iOS

available at http://blog.010dev.com

from Realtime Operating systems to unlocking iPhones in less than 30 slides

Technology