操控更多,进入iPhone操作系统的Shell后台的方式已经被分析出来

寂夜清风

iPhone采用了专门的操作系统.然后用SHELL呈现给用户一个漂亮的界面.如果能够进入到这个SHELL后面的话.可以对系统进行更多了解..
6 M+ d# [* J" d7 X- Z
, A" l, ?6 R3 W6 ]( D- @& m目前这种方法已经被人分析出来了:
8 {& R; O! J, P$ J1 |由于iPhone采用了与iPod一样的底部数据线脚定义,所以可用串行控制的方式来进入SHELL的里面.
$ v% T1 q  d6 d& ^在线脚的第21脚和第11脚之间接上一只6.8K的电阻,然后在recovery模式下输入以下指令
7 r; s% b2 Q& J6 |' {setenv debug-uarts 1
saveenv
2 J0 L. ^6 B7 i9 y8 greboot
# i* a- N) w5 Y
机器会自动重启.然后就进入指令状态了.
- N- W" v+ g2 L  X
, r2 `5 X$ S# w! r

                                iPhone SERIAL HACKED, FULL INTERACTIVE SHELL                                                           Your friends at #iPhone made a major breakthrough this morning.
& v% @5 I+ N" u) B; ?& Awe got a serial console working, here is how the serial has the same pinouts as iPod serial use a 6.8kish resistor from pin 21 to gnd tie pin 11-sergnd to the real ground use iphone interface to send the following commands in recovery mode:
setenv debug-uarts 1
saveenv
7 C2 ]8 p' M, Y. V7 @reboot
1 f2 j, S1 {7 m' q5 K3 E' t, N  B
that should work

- [( P6 `( y; }IT GIVES YOU A FULL INTERACTIVE SHELL
I REPEAT, A FULL INTERACTIVE SHELL
! P  |$ X) ~2 u$ x2 ]
% V% V) @2 ^, g0 {. e% B: bThe command list is: http://iphone.fiveforty.net/geohot/cmdlist.txt
% x- W+ E( f4 X7 G
$ W- C5 a  Y- A) m% d+ dYou need a level convertor, like the max 232 to make this work

DIGG: http://digg.com/apple/iPhone_serial_...l_shell_access

: B0 Q* F  q: J+ m9 p# s* H~geohot
2 v8 T, Z2 \' ^# V& h                                                                                                                                                                                                                                        Last edited by geohot : 07-06-2007 at 10:40 PM.                                                   

http://www.hackint0sh.org/forum/showthread.php?p=7989#post7989

寂夜清风

现在你可以用指令来控制很多东西罗..

command list:
        help           this list
        script         run script at specific address
        go             jump directly to address
        bootx          boot a kernel cache at specified address
        diags          boot into diagnostics (if present)
0 @2 j  T% P% O" M  S9 p        tsys           boot into tsys (if present)
) B7 z+ ^* f) ~* ?6 Z2 Z        bdev           block device commands
        image          flash image inspection
        fs             file system commands
        fsboot         try to boot kernel at /kernelcache
        devicetree     create a device tree from the specified address
  w1 d8 z& ~! i        ramdisk        create a ramdisk from the specified address
4 l- d  \6 Z, z2 r. ?0 U1 n        tftp           tftp via ethernet to/from device
        eload          tftp via ethernet from hardcoded install server
        halt           halt the system (good for JTAG)
        reboot         reboot the device
        poweroff       power off the device
        md             memory display - 32bit
        mdh            memory display - 16bit
        mdb            memory display - 8bit
        mw             memory write - 32bit
; J8 {: ?' P0 ~        mwh            memory write - 16bit
- o: K9 o! z* C# O        mwb            memory write - 8bit
0 L$ Z* ?! U. }+ d        mws            memory write - string
. F( d5 i9 A8 i! N. l        crc            POSIX 1003.2 checksum of memory
- [3 W5 B4 D9 E7 u4 s        task           examine system tasks
" ]) F# v+ h) Z3 s. l        printenv       print one or all environment variables
- ]1 M$ C& N3 q        setenv         set an environment variable
        clearenv       clear all environment variables
        saveenv        save current environment to flash
        run            use contents of environment var as script
! N/ ^: ]# O3 T: K7 Y' b7 k* C        bgcolor        set the display background color
        setpicture     set the image on the display
        iic            iic read/write
. ~; `& F9 k. S0 V) a        radio          Manipulate the radio board.
! F. Y' J  W9 y2 R$ K8 `$ y        setbusclock    Set bus clock to the given frequency in Hz.
        setcorevoltage Set core voltage to the given voltage in mV.
        syscfg         flash SysCfg inspection
1 g( O% o; |4 q( U        charge         Manage the charger chip.
        powernvram     Access Power NVRAM.
        usb            run a USB command
& H3 l; Q- Q5 n2 Z5 F: K3 L$ }        nand           nand flash routines
        chunk          chunk a file
$ Y# h- p, y6 A* c
) [0 m5 e1 p3 t6 F9 B/ j+ C7/6/2007

http://iphone.fiveforty.net/geohot/cmdlist.txt

寂夜清风

收藏一下..这个肯定会有需要的时候罗

2 b& d3 r5 U% P- ]6 F

Apple iPod dock interface pinout

connector wiring scheme

used in 3rd and later generation iPods for charging,connecting to a PC via USB or Firewire, to a stereo via line-out, to aserial device (controlled via the Apple Accessory Protocol). Thisconnector exists in all Apple iPod MP3 player (iPod 1G, 2G, 3G, 4G, 5G,Nano)

3 \( n$ c! C% `3 [, u- a+ C9 U9 o
/ n% d: X+ a3 ]! A( h' l

30pin线脚图  at the player ( white side up) ! }9 i8 H, F3 s) A; T 4 a& h+ R2 [% L0 {6 a6 @% x Pin Signal Description 1 GND Ground (-), internaly connected with Pin 2 on iPod motherboard 2 GND Audio & Video ground (-), internaly connected with Pin 2 on iPod motherboard 3 Right Line Out - R (+) (Audio output, right channel) 4 Left Line Out - L(+) (Audio output, left channel) 5 Right In Line In - R (+) 6 Left In Line In - L (+) 8 Video Out Composite video output (only when slideshow active on iPod Photo) 9 S-Video Chrominance output for iPod Color, Photo  only 10 S-Video Luminance output for iPod Color, Photo only 11 GND Serial GND 12 Tx ipod sending line, Serial TxD 13 Rx ipod receiving line, Serial RxD 15 GND Ground (-), internaly connected with pin 16 on iPod motherboard 16 GND USB GND (-), internaly connected with pin 15 on iPod motherboard 18 3.3V 3.3V Power (+) Stepped up to provide +5 VDC to USB on iPod Camera Connector.   If iPod is put to sleep while Camera Connector is present, +5 VDC at this pin slowly drains back to 0 VDC. 19,20 +12V Firewire Power 12 VDC (+) 21 Accessory Indicator/Serial enable Different resistances indicate accessory type:          1kOhm - iPod docking station, beeps when connected % E7 q. M( L6 `4 J/ |         10kOhm - Takes some iPods into photo import mode          500kOhm - related to serial communication / used to enable serial communications                Used in Dension Ice Link Plus car interface 1MOhm - Belkin auto adaptor, iPod shuts down automatically when powerdisconnected Connecting pin 21 to ground with a 1MOhm resistor doesstop the ipod when power (i.e. Firewire-12V) is cut. Looks to be thatwhen this pin is grounded it closes a switch so that on loss of powerthe Ipod shuts off. Dock has the same Resister. 22 TPA (-) FireWire Data TPA (-) 23 5 VDC (+) USB Power 5 VDC (+) 24 TPA (+) FireWire Data TPA (+) 25 Data (-) USB Data (-) 26 TPB (-) FireWire Data TPB (-) 27 Data (+) USB Data (+) Pins 25 and 27 may be used in different manner.  To force       the iPod 5G to charge in any case, when 'USB Power 5 VDC' (pin 23)       is fed, 25 must be connected to 5V through a 10kOhm resistor, and 27 must be connected to        the Ground (for example: pin 1) with a 10kOhm resistor. 28 TPB (+) FireWire Data TPB (+) 29,30 GND FireWire Ground (-) Back side of dock connector; 3 F! J1 t; q9 y7 a, s* y8 Y 2 4 6 8 10 12 14 16 18 20 22 24 26 28 30 * P- k  K6 |2 ~& O 1 3 5 7 9 11 13 15 17 19 21 23 25 27 29Pins 1,2 connected on motherboard. Pins 15,16 connected on motherboard. 3 \1 `! C4 _( I7 U( Y& x& g, zPins 19,20 connected on motherboard. 7 [* u7 j( ]5 W% UPins 29,30 connected on motherboard. If you disassemble the original apple-ipod-dock-connector-cable andlook at the connector itself, on the back side, where it is soldered,you can see the number 1 and 30 (e.g. pin 1 and 30). In thisdescription NUMBERING is INVERSED: pin 1 is pin 30 and pin 30 is pin 2,so, don't look at numbers on connector. The remote control, iTalk and other serial devices use AppleAccessory Protocol for communication with iPOD. This protocol wasintroduced with the 3rd generation iPods, and is also compatible withthe 4th generation iPods and mini iPods. The connections uses astandard 8N1 (one startbit 8 data bits 1 Stopbit) serial protocol,19200 baud (higher rates up to 57600 also possible, but speed fasterthan 38400 may cause problems with large amounts of data), delay of 12microseconds inserted between end of the stopbit and the beginning ofthe next startbit (also working without this delay). ; [" u6 M8 D8 T) j. r9 [Electrical: high +3,3V low 0V 7 F  `9 y5 z3 T2 i6 Ddefault line state: high. Codes used for communication with peripherals are here This device may be connected to the firewire computer port by straight cable (TPB+/-, TPA +/- shoulde be twisted pairs in cable)   L' a" Q; k0 y: w9 a7 q( T* ?) I

http://pinouts.ru/Devices/ipod_pinout.shtml

wenwang

ni bi a