/dev/random

Hey guys! I know this is a bit late, but I would like wish all of my remaining readers a happy holiday season. I know I’ve been a bit busy lately, but I’m going to try to keep this site updated again.

So let me give you a run down of just what has been going on. My last post (before the iPhone how-to) was February 20th of last year. A lot has happened since then. My absence initially started with a teacher at school drafting me into the Future Business Leaders of America (FBLA). I was to compete in the Networking Concepts category. It was a 100 question multiple choice test on various networking topics. I took 1st place at both regional and state levels, so I qualified for the trip to compete at the FBLA-PBL nationals in Chicago last summer. I went. I had no chance, being more into coding than networking, but I guess I’m not half bad at it. :) From the people I talked to that competed against me, every single one of them had some form of networking certification.

While I was in Chicago, I snuck off from the group and took a taxi to the Apple store on Michigan Avenue a.k.a. the Magnificent Mile. I got there right as the store opened, so I walked in and bought my iPhone in under 5 minutes. (The big wtf here is that the Cingular store had a line around the block…) Once purchased, I had a 3-4 mile hike back to the hotel. It was pretty fun. :)

So the rest of my summer break after I got back from Chicago was spent on IRC trying to hack the iPhone. Yep, I knew most of the hackers and even was one of the first to start a serial dock for the thing, I just suck at soldering. I didn’t get to do much before I had to do summer assignments for school. It was fun while it lasted though. I got to meet many cool people, including Captain Crunch.

Now, we’re getting to the exciting stuff. A few weeks after school started I got offered a job at a startup in Silicon Valley doing PHP coding. The startup is called Qubescape. We’ll have a sweet product out shortly, that’s all I’m going to say. It’s been awesome so far. I work with some really good people.

That brings us up to what’s going on currently. Currently, I have very little time thanks to school. AP US History and AP Physics B are keeping me slammed with work. My AP US History teacher has an insane passing record and intends to keep it that way — which I’m cool with because I enjoy the class. On the other hand, my AP Physics teacher just can’t teach. He’s a good guy, he understands it, but he *cannot* explain it; so, I’m left to figuring it out on my own.

Time is going to get even more rare as I am involved in FBLA once again this year. I will be the first from my school to compete in the Internet Application Programming category. It looks incredibly easy. The project requires a website to track class averages and GPA with simple user authentication and a presentation explaining areas of your code the judges are interested in.

Anyone else that read this blog heard of FBLA? It’s nationwide, but many people don’t seem to know about it.

Permalink | Comments(2)  |   Del.icio.us  |   Digg  |   Slashdot

After hanging around the osx86 crew last night on IRC, I found out that they had finally cracked the activation service and made a proof of concept tool that would activate the iPhone with a plist file. The developers refused to release the actual tokens that needed to be embedded inside the plist file for activation though, for good reason, as they are DVD Jon’s.

Now, they did tell me one thing. The keys are embedded in the .NET binary in JLJ’s iPhone activation server. So I began working and this led to where I’m at now, a how-to. This post will not provide the tokens, nor will I provide them until JLJ says I can. This article will walk you through the process of obtaining them so you can activate your iPhone on a mac though, as suggested by the developers of the tool.zip we will be using.
As of now, you can just download the newly released iPhoneActivatorTool to activate your phone. This is a newer version of tool.zip that includes the plist file required.

Step 1:
Download the following files:

• JLJ’s PhoneActSrv - Mirror
• tool.zip - mirror
• My iPhone Decrypt App
• Lutz Roeder’s Reflector .NET disassembler

Step 2:
This step is where you’ll actually prepare the data you need to get. You will need windows with .NET framework 2.0+. JLJ’s PhoneActSrv’s binary has the keys stored within it, encrypted using AES. In order to get the keys, we need to disassemble the binary. To do this, you need to open up Reflector and go to File->Open then locate and open the PhoneActSrv.exe file.

Once it’s loaded, you will see the entry in the tree view. Right click on PhoneActSrv and click Export. Make sure you save this somewhere that you will remember, you will spend a lot of time looking at the disassembly. You also need access to it over the mac.

Step 3:
Now, open the directory you saved the disassembly files to. You should see the following files:

• a.cs
• b.cs
• AssemblyInfo.cs
• d.cs
• DotfuscatorAttribute.cs
• e.cs
• e.resources
• f.resources
• Global.cs
• PhoneActSrv.csproj

If you see these files, you did step 2 correct. If not, go back and do it again. This is where you may need some coding experience, as I can’t just hand these keys out. I provide you with enough hints that I feel you can find the keys. Unzip my iPhone Decrypt application and open up iphone_decrypt.c and read the comments. For each variable needed, I provide you with a hint on how to find it. All the values needed are located in the d.cs file.

Once you find them, plug the values into their appropriate arrays in iphone_decrypt.c. Once you have what you think are the values, open up a terminal, go to the directory iphone_decrypt.c is located in and run the following in console.

$ ./build.sh
$ chmod +x iphone_decrypt
$ ./iphone_decrypt

If all goes well, you should see something like the following on the terminal:

kalashnikov:~/Desktop/iPhone-RE/AES decrypt cody$ ./build.sh
kalashnikov:~/Desktop/iPhone-RE/AES decrypt cody$ ./iphone_decrypt
Welcome to the iPhone JLJ key decryptor. Find the data in his app and set the variables in the code to this one.
Setting AES key...done
---1076
Attempting to decrypt the key...done
Key is <?xml version="1.0" encoding="UTF-8" standalone="no"?>
<Document xmlns="http://www.apple.com/itms/" disableHistory="true" disableNavigation="true">
&nbsp;
<Protocol>
    <plist version="1.0">
        <dict>
	
          <key>iphone-activation</key>
          <dict>
            <key>unbrick</key>
            <true/>
            <key>activation-record</key>
            <dict>
              <key>AccountToken</key><data>*snip*</data>
              <key>AccountTokenSignature</key><data>*snip*/data>
            </dict>
          </dict>
	
        </dict>
    </plist>
</Protocol>
&nbsp;
</Document>??V?n9???lsQ?
Freeing up memory...done

If you do, move onto step 4, if not, keep trying.

Step 4:
Unzip tool.zip and open up the blank.plist file in something like textmate. It’s just an XML file. blank.plist contains the following:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>ActivationRecord</key>
	<dict>
		<key>AccountToken</key>
		<data>
		</data>
		<key>AccountTokenCertificate</key>
		<data>
		</data>
		<key>AccountTokenSignature</key>
		<data>
		</data>
		<key>DeviceCertificate</key>
		<data>
		</data>
		<key>FairPlayKeyData</key>
		<data>
		</data>
	</dict>
	<key>Request</key>
	<string>Activate</string>
	
</dict>
</plist>

Copy the AccountToken and AccountTokenCertificate lines and their data lines from the console output of iphone_decrypt. Paste them into the plist file so that it looks like the following:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>ActivationRecord</key>
	<dict>
		<key>AccountToken</key><data>*snip*</data>
	              <key>AccountTokenSignature</key><data>*snip*</data>
	</dict>
	<key>Request</key>
	<string>Activate</string>
	
</dict>
</plist>

Save this file as activate.plist in the same directory as blank.plist

Step 5:
Activate your iPhone by running the following command in the terminal after changing to the directory that blank.plist is located in.

$ ./tool --activate activate.plist

You should see the following output on the console:

kalashnikov:~/Desktop/tool Folder cody$ ./tool –activate test.plist
iPhoneActivatorTool 1.0
2007-07-04 15:10:43.887 tool[10443] Found iPhone Device: 1
2007-07-04 15:10:43.887 tool[10443] Connecting…
2007-07-04 15:10:43.892 tool[10443] Checking Pairing…
2007-07-04 15:10:43.905 tool[10443] Starting device session…
2007-07-04 15:10:43.990 tool[10443] ActivationState: Unactivated
2007-07-04 15:10:43.990 tool[10443] Deactivating your iPhone…
2007-07-04 15:10:44.002 tool[10443] New ActivationState: Unactivated
2007-07-04 15:10:44.003 tool[10443] Activating your iPhone…
2007-07-04 15:10:44.163 tool[10443] New ActivationState: MismatchedICCID
2007-07-04 15:10:44.163 tool[10443] Your iPhone was successfully activated.

You will probably see a popup about your iPhone having an incorrect SIM card. Just slide the unlock slider at the bottom to the right and you should be ready to go.

Permalink | Comments(26)  |   Del.icio.us  |   Digg  |   Slashdot