|
楼主 |
发表于 2007-10-12 18:49
|
显示全部楼层
http://forums.macrumors.com/showthread.php?p=4308881
& I n4 K! j3 _7 \3 L* S E3 z7 k, y; I/ G! Y- s
Ipod Touch Full JailBreak guide for WINDOWS
0 @' |: l+ R( m* l3 G- H1 d6 M4 { THIS IS FOR WINDOWS!
. p5 W% i: y4 m* F9 rHey all, I take NO CREDIT for this guide, i followed it on the #itouch irc channel from the amazing PlanetBeing! : C8 h \$ n ?# ]1 [0 E7 Y* w
; K7 }6 ~* ^# D: J% x0 Y' xEnjoy!
' j4 r9 R, Q6 }
6 s6 H( g: B7 e2 u--
0 f( \, E& A4 x% U t+ q' C, \7 M5 H9 K" ^& w* k# o6 |: c7 g
RESTORE IPOD FIRST then download iphuc http://rapidshare.com/files/61742428/iphuc.zip P( @) H5 @6 I1 o! |
-------------------
5 K; J9 @2 _7 p/ J$ h& Z9 z* z3 R1. Load http://jailbreak.toc2rta.com on iPod. T( l% p9 |5 F0 F
( R0 A, _. a, w( a8 u e2. Exit iTunes, and kill ituneshelper.exe process6 |7 i1 h7 Z& s4 i4 o9 e
% f3 A" I5 _: _6 {& r+ v% v$ g
3. Extract iPhuc to directory on computer8 ^) P9 ^! l' ^! W
# K2 q% N& U& Y; c6 f3 V
4. Copy iTunesMobileDevice.dll from C:\Program Files\Common Files\Apple\Mobile Device Support\bin to the same folder as iPhuc.exe
4 H1 D# ~. p) H+ r$ e l
+ Q% Q% N! f4 S V0 j5 b7 T5 G2 _5. Copy readline5.dll from2 D2 F H9 [& ~) [
( F$ p# `+ ?( c! b% L
http://gnuwin32.sourceforge.net/down...ne-bin-zip.php to the same folder as iPhuc.exe+ r! ~) C8 n6 t* h( e! A
$ q0 d8 K" w! E8 J& D9 N6. Run iPhuc.exe/ M8 E, \6 [2 g& u
5 P" A! }& d8 S- n& X; G7. Plug in your iPod: Z* c' @% |# p$ S
1 T$ V' G# U; b- t! @4 ~" }; D L% R
8. In iPhuc type "getfile /dev/rdisk0s1 rdisk0s1 314572800", this will take a while as it's a 300mb file
9 s: U5 ~6 u% O8 v# d* f4 d$ M: ?
9. Make a backup copy of rdisk0s1 that you just downloaded.
. ^8 D P9 o: x3 N9 i. u. D; {0 C0 D8 V& `2 A3 f
10. You now need to do some hex editing. The tool I use for doing this is HxD (http://www.mh-nexus.de/hxd/). Open rdisk0s1 with your hex editor. [, a5 t: @ \/ \% \* G) I" Y1 j {9 g
" a0 e: A" x8 i) l$ ^
11. Search for the ASCII string "noexec" in the file.
& w- b ~7 H3 B0 k+ O+ W# k l
, {) J+ t$ M* h8 u& W. R1 a# fThe second hit should look like the /etc/fstab file: /dev/disk0s1 / hfs ro 0 1
7 u5 G* L3 M; L: O- E: `0 g: z2 @# N. w* ^0 u
/dev/disk0s2 /private/var hfs rw,noexec 0 2% Q/ C; u( w/ z( p" x" U# V
6 C% S: N- J" f/ aOnly, of course, hex editors will just display newlines as a '.'
! e8 j" }! [) f( Q! H* ]( g! F
: U- D; O/ ~% x9 A0 Ycharacter or similar. This series of characters are often found at s" l8 B3 B! f) I
# H* r! ~& \, H# M9 m+ E3 T/ e* e# _0xF8F9000-0xF8F9045. They will have the following character codes:
6 ]- N o- t3 \8 N
; j* V. j8 \. F# G- x2F 64 65 76 2F 64 69 73 6B 30 73 31 20 2F 20 68 66 73 20 72 6F 20 30 20
) S& I0 t5 w8 D' e" [, [; M4 |. w$ H7 s( A5 s4 J4 q
31 0A 2F 64 65 76 2F 64 69 73 6B 30 73 32 20 2F 70 72 69 76 61 74 65 2F" ~# Q! I' u. M6 U$ a! d" s9 s
& M& @, U8 v8 M4 v$ I) E
76 61 72 20 68 66 73 20 72 77 2C 6E 6F 65 78 65 63 20 30 20 32 0A+ t. s$ j5 V0 {6 N& t/ p+ L
( l% W! s% S" k' d' i- d1 B(In "find" make sure it's set to find hex values)
$ o/ u0 Q/ \* |' J
4 O' W2 [3 f# F' q( `0 H) b; w12. Change these to /dev/disk0s1 / hfs rw 0 1 /dev/disk0s2 /private/var
/ e0 ?7 Y* _% i* d" w0 D+ _$ A( m& L
hfs rw 0 2
& ]7 d X; U0 e0 k5 x- Y: X7 p! q! s; a- B2 I, p
With newlines padding the end of the string so it ends up being exactly the same size as the old /etc/fstab. The new series of characters ought to be:
1 F) v h( ^, Q* i
! \* z$ D$ l1 O: o/ w# \. V7 J2F 64 65 76 2F 64 69 73 6B 30 73 31 20 2F 20 68 66 73 20 72 77 20 30 205 N8 B: N# ^: c$ t6 R
' Z; B; h# Q2 F8 H# y% {5 h _5 b' {
31 0A 2F 64 65 76 2F 64 69 73 6B 30 73 32 20 2F 70 72 69 76 61 74 65 2F
) y7 Q" q2 w! d8 j4 }8 s
. }! e! C# P, L/ y76 61 72 20 68 66 73 20 72 77 20 30 20 32 0A 0A 0A 0A 0A 0A 0A 0A
' C4 x! R6 i* d- Y# [4 x
) ^+ d2 e- T0 b' N6 w13. Save your changes. I'm assuming that you're replacing the old rdisk0s1 file on your hard drive with this modified version. As a final safety check, make sure the file sizes of your modified version and your backup versions are exactly the same, down to the last byte.
; v/ s O$ q, [* t/ R+ _
) C" K. f; A# n6 J' i; G. ]14. Upload the modified rdisk0s1 image to your iPod. In iPhuc, type# s8 R3 X3 R. {
, v4 Q7 A& }. U O6 k9 U"putfile rdisk0s1 /dev/rdisk0s1".8 A% C8 c' T1 o! s* C
: R) g* v$ Z/ m15. Exit iPhuc and reboot your iPod
- e0 L2 F5 r1 u5 I; {3 W/ f5 A* b! _. X0 w S
16. Open iPhuc again so it connects to your freshly rebooted iPod. As a
" y% O; q8 e& B; L B! A) z* w, ]+ |9 _, {% n
check, type "getfile /etc/fstab". This will download fstab to iPhuc's
# R' m$ z1 a% Z+ e( l# o1 f
- E0 H, j/ B' ~* k" |directory. Open it up with your favorite text editor and confirm that
% |. V5 }6 g- n. u( w' t
; i0 P8 _; _+ @% b6 F9 zthe changes we have made are still there. If they are, congratulations.+ `) x3 g4 N* U5 l. b
+ g7 f9 d7 Y: m% K3 K" s
You have a jailbroken iPod. Sort of.: a# r( R V, N1 ~" C# U
# \ u B0 M N7 B8 T
17. We now need to install ssh and associated tools. This is all now old! B0 s- y/ Z2 A' |3 H
% L( }+ W$ {% B
territory, but unfortunately, everything is either "one-click" or
% z9 b7 P ?( D* p
2 o, H- y; o- I8 tdesigned for Macs. Thus we need to do some sweating here. Download9 } H7 s5 d2 T+ A# o4 A
5 ^+ r2 S0 t7 G( a" D9 Fhttp://iphone.natetrue.com/dropbearkey.exe. You will also need
]" ~, C4 v: x( a L) r
! S7 Z i, }, Rcygwin1.dll from
2 }6 V2 q1 _( f! F$ M2 z! h3 w' @+ y$ j3 N- v+ |8 @
http://www.dll-files.com/dllindex/dl....shtml?cygwin1.
+ j6 g. V- k& k" v" D/ K% y6 h" C- G1 n& ^
18. Open CMD and do:
0 I% ]- b0 A5 G4 K6 I! p6 U' C& u! ~2 \+ h
dropbearkey -t rsa -f dropbear_rsa_host_key
9 `( k" e' Q+ o9 Rdropbearkey -t dss -f dropbear_dss_host_key8 b4 r# V/ g! L. B1 a* g
- C- q" S4 A$ f4 E2 J
You should now have two files in that directory, dropbear_rsa_host_key2 Z& [2 r1 J) `1 q1 T
9 q" o1 L+ Q( v: Land dropbear_dss_host_key. Copy or move these into your iPhuc directory.9 U/ G) v ?! F9 O. v
& T3 \3 G9 q9 Z: ], d19. Download and extract http://iphone.natetrue.com/BSD_Base-2.0.tar.gz9 l; @7 D+ w1 ?
- O9 [+ F1 E) R$ ~/ S3 e: i
into your iPhuc directory.
. B6 D( R5 d# O; A3 x
% B7 I/ Q( M/ z' c( G: ~, U. X9 ~20. Download and extract
: Z4 f1 L; X+ b( [( C9 B& }+ E6 V$ z4 S6 d- ?; [1 E( N8 }2 c+ H
http://www.abigato.com/iphone-ssh-kit-vr1.tar.bz2 into your iPhuc
! m5 _2 X: d- {& S8 E) L9 C) J
directory. Make sure dropbear, fd6, au.asn.ucc.matt.dropbear.plist,
) Z; B' I+ p" ?% J6 N
1 t9 {- k5 `1 x7 B. N- d( W3 hglob6, goto, osh and sh6 are in the same directory as iPhuc.exe. Move
% j7 O( I# x8 h
/ Z2 {( m3 a6 C! pthem there if you have to.& V" T7 O5 ?& c9 a$ v
3 X; a) [. @1 X5 ^6 g) o
21. Open up iPhuc and type in "mkdir /etc/dropbear",
% @! l/ d Y! |6 V" H: ?
/ H A e. }2 u j0 b1 o. j22. "cd /etc/dropbear".
4 T/ @% W$ a' V2 j0 Q1 F: \) A$ \# q5 u9 W" m
---* `& i* x- P/ {) N' q( X
DIRECTORIES ARE% o2 | g; o* g! e# d8 ]
/etc/dropbear/dropbear_rsa_host_key,# l- G6 C4 h K" Z1 H/ {
) K- |; h7 B9 g' m& d
/etc/dropbear/dropbear_dss_host_key, /bin/chmod, /bin/sh and
! [9 O' k/ u" {4 v8 V9 u o) F3 Z; I" |
/usr/bin/dropbear
: |) h3 g& }3 o2 T& b# v) W---9 L$ N6 g; L" Q" j& f/ I; N
V' Z# H$ W# \- L+ `+ t23. "putfile dropbear_rsa_host_key"
6 D$ m# f! T+ C, v) ]% u- [( o8 t2 x; |
24. "putfile dropbear_dss_host_key"
) n2 A5 c. M: ?" w8 n
) f: w% ?7 Z4 o25. "cd /bin"0 j- O8 P) _' T5 ?$ Q
( B7 ^) Q$ q/ g& ?' K
26. "putfile chmod"3 f; v: p) M( ^2 R
' P( L2 e5 U+ Y( _' K7 N4 b
27. Rename sh6 in your iPhuc directory to sh, then "putfile sh" in9 }' L! M$ X" [4 i6 k, e
, l- J$ N& U2 r% ]( FiPhuc.3 m9 @( p( I: h6 L) r
4 F# `8 D& `0 W$ j( D
28. "cd /usr/bin"# ]" y$ ^+ v& o: Y8 N% Z3 R
0 E- D% B; M9 r6 `* ^29. "putfile dropbear", |: m: d) j$ ]+ c( d) X: O
! g" Q9 Y, |; ]% N30. Make sure /etc/dropbear/dropbear_rsa_host_key,+ y& l# Y$ G- o% X* w& V7 A
- C( R6 {9 G9 \; }/etc/dropbear/dropbear_dss_host_key, /bin/chmod, /bin/sh and
6 O6 l* f' f" x4 L+ J A! w9 S9 i- c" c7 p7 {7 W* Y/ q
/usr/bin/dropbear now exist on your iPod with iPhuc.
& @# o; X$ b& O9 G8 V: S. v% a% p6 K) S
31. "cd /usr/sbin"( U' }: H2 [( R. H
' m, I0 f6 x8 q& ]/ z5 Y32. "getfile update"
% b% n1 U! z" J: z/ K# t) v0 |3 {
* W+ `/ R, _" z4 u( k33. In Windows Explorer, rename "update", which you just downloaded, to6 u0 s4 d9 b+ G. b, }$ x; U6 ]# i4 S
5 o0 `4 M! T$ p! c, R/ c' h
"update.orig".
4 [6 S! S2 w( B/ e' [! v/ m. O
3 K# Q) u# C# E- J* H) k# {34. Rename "chmod" in the iPhuc folder to "update".
3 _' o& j; y" _4 a3 w. P, I2 m3 y
# K( W, U' E7 A# v35. In iPhuc, "putfile update", so you're replacing /usr/sbin/update6 X' u% n3 m0 D6 Y4 ?5 q9 w, R
8 U2 m' q* O7 u8 ?) A& [4 Wwith chmod. U1 s% X2 o2 ]' E8 x; G% R" y" D
# B! s3 j; r/ c# `7 `' @' S36. "cd /System/Library/LaunchDaemons/"; Z& _: t) C: Y" K$ s, H
5 x( E4 }' b# E' G* c
37. "getfile com.apple.update.plist"
, W4 d' V* k! V' j5 Z; r% `- J a
6 ?3 L0 v/ ?# ~) @3 S! E" }) J0 n38. Open com.apple.update.plist in a text editor
5 I; p c n% F8 U- ^1 b" Z0 ~" `& B& K8 C0 D, H
Right after it says <string>/usr/sbin/update</string> add:
7 E9 S+ [/ f4 L; @ s$ t2 I3 A$ x4 M; [; g
* o9 x! b- a. Z' K; A<string>555</string>& L( j; `6 p7 O+ Y7 {
<string>/bin/chmod</string>9 D. O* ~% j$ R
<string>/bin/sh</string>
8 G# Z7 k8 C* V' L- P<string>/usr/bin/dropbear</string>
1 F8 O6 p7 [0 N3 D, M
4 \4 F& M1 [% Q1 y& X7 e" O1 H" H39. Save the file. Upload the modified version with "putfile
8 R/ G* {9 e/ D* y0 D' E9 |9 s# H% x0 b; ]9 y2 @; i& I
com.apple.update.plist"
- E) Q* R: [1 t# _7 }7 Y+ I$ c
+ E- `: G; U8 ` l" A# ~$ A$ q40. Also, "putfile au.asn.ucc.matt.dropbear.plist"% w% n; d3 C4 c( g
$ G! X# s3 b# f2 f3 w
41. Reboot the iPod twice. The first reboot should set the required, h, x7 }7 J; u/ S# U( l) u$ j
6 {& ^6 d R+ ypermissions. The second should start the ssh server (since proper. S1 }# M1 d' |/ S4 V+ V8 B
0 @- H7 p9 R) N) Q& `4 q* bpermissions are now set). And close iPhuc.
* ^; c: E, \3 {7 b% ^
8 g5 p6 W+ w! e4 S- r42. Theoretically, SSH should be working now. Find out the IP of your
7 P/ n; z$ j, ]( C- V E" O! E/ E- q
iPod in the iPod's wireless settings.1 Z9 E% S5 R9 |$ d% a1 s1 v/ o: e& q
- P8 ]" @- Z0 G' |2 i7 x% k
43. Try to ssh to it with Putty) s7 j3 W- e: W. f1 H. P! g
0 l0 h3 U& ], F(http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html).7 \/ X# |2 `2 o# A1 `
: @2 ]" F4 G6 [3 jUsername root, password alpine.. f3 y, D. D2 N! ?
7 ?; }$ p' E. Z8 W+ s1 f
---
4 j' P4 ]7 c) ?( ~1 oSo, okay, now we need to get sftp running, do some clean-up and then I4 C/ y; l( A) z0 T& X
7 N; C+ V3 r8 s ~think we can install Installer.app and be good.2 c" G9 }( @7 y) V# h
7 p7 W! b. p H) m* W& NDownload WinSCP (http://winscp.net/download/winscp404setup.exe)* e+ N. y4 p" S' c9 \2 Q+ D, b
---
( |. Y) ?2 j/ m3 Y! u5 J7 r
+ B6 |: j$ Y5 o. g) ?0 V) M44. Download http://apps.iphonexe.com/24940.zip. You will need0 R# L* z- K3 N7 o3 @. x; \) f
. F9 Y9 r/ X. M/ l/libexec/sftp-server, /usr/bin/scp and /usr/lib/libarmfp.dylib from that
! y: l; @0 N. ^
4 u) X. ~9 o4 N, ^archive. Extract them all to your iPhuc folder.: u+ q. t$ t7 `* k: o$ A
6 d( `9 I* f q+ m$ i) E2 E
45. Using iPhuc's putfile capability, put sftp-server in /usr/libexec/,; p: Q3 g9 F& Y3 J+ p3 [0 @- h! m
X( R* P3 v J* S7 |: A* wput scp in /usr/bin/, and put libarmfp.dylib in /usr/lib/.
& }" I* ?! I. C+ O& u" H
- [: |3 M' V; g+ i# k' X* g$ Q; e46. Remember that BSD_Base folder you extracted? We need to raid it for% x0 t% w K+ F
0 P: s$ f& `0 M# H( W0 B: ^
some commands. You will need /bin/ls, /bin/mv, /bin/pwd, and /bin/csh.
" p" K$ T1 ]* V/ H8 H" o' |, @" u; C2 @+ I+ S4 b6 A! `
Copy those to your iPhuc directory.
$ n$ V, B7 E# A" l3 f; z, Y; X
: @2 E$ J( H2 m+ g: r47. In iPhuc:) L, j4 B$ U/ Q
5 G, w4 h, i. W/ k9 f2 l: xcd /bin) E. E5 Z: ]2 F% u
putfile ls }* D; A0 e) i
putfile mv7 C0 I5 D- a; J# z: J
putfile pwd
4 D; ^+ f$ j. s# V( c$ Sputfile csh @' r2 y" a$ _* \# [
3 O8 k1 j# H0 p) d, ?6 l, d
48. SSH into your iPod. What we now need to do is chmod them all
4 _/ j8 ?5 H- E3 I5 N4 E) K+ a) m9 r# q
executable.
; v% C% @+ H3 d# r; b) K+ ^5 w/ ?% b. b- B' O
49. In SSH, "/bin/chmod 555 /bin/ls"
* R: K- C2 ]& U7 g! b* |1 y. {50. "/bin/chmod 555 /bin/mv"7 d8 g8 r! v; b# I: Q" J2 d
51. "/bin/chmod 555 /bin/pwd"
1 l- l( g$ U \52. "/bin/chmod 555 /bin/csh"( U" H$ L6 V& m U* \- e4 `9 V6 W" ?3 S9 v
53. "/bin/chmod 555 /usr/bin/scp"
a" e# u9 x8 K& K54. "/bin/chmod 555 /usr/libexec/sftp-server"
% F' Y" i) N& b- R; H
* @, d- a' W9 MTheoretically, sftp should work now, yes.
2 B$ N# E2 s7 {9 o& T
1 m3 h' s3 X; r% L4 h55. Also upload glob6 to "/bin" with iPhuc and in SSH, "/bin/chmod 555# y) N, V, P. E ], t. E$ b
8 Y9 A- ^3 D& x: o/ A5 P/bin/glob6".
8 ]( K( V: ~" r9 R; ~7 O! G
( I4 @: m2 u. k56. Type "/bin/csh" to test out this shell (in SSH). This has advantages
7 e3 ~# [. O6 d! s" A% M' n9 f4 [ s/ e/ }# C9 B7 W9 a
of not requiring you to type in the full path of every executable in the/ X* ]0 o7 h# }+ x# @
6 Q8 F, X/ i3 y) Nfuture.; g) Y& t0 G2 Z6 A, Y# m
4 [3 n/ U! r- @9 `
57. In SSH "cd /var/root".
! P( x' D8 ^- b6 b4 K
; ` V1 n, K% N4 V; g7 B* S58. Type ls. You should have a Library, Mediaold, and Media directory.8 t' L5 y9 s) e& `
/ D a; i% z. T4 P. u! m; G F1 C59. "mv Media Media_sym"; S1 {# O( b* w( N
/ ?. f- Z1 x% c- k2 r! F* n
60. "mv Mediaold Media"5 N: h& ^* h) P+ V+ B
. l6 O: A& G# g1 |. ~" y61. Reboot your iPod and check your iPod in iTunes.- W4 `& f( q! j# N I
" c9 A$ w! M$ h2 w
---3 g; c" H8 S ?4 r. g+ G
On to installing AppTap- z s! P9 b/ T
---! N# C. V/ H/ ~3 K; A
4 V+ B0 n' f$ [ L# `( }
62. Download and install 7-zip (http://www.7-zip.org/). We need it to
- A* S. {- S- k1 {; o% a
, W G9 b9 v' Rcrack open the dumb Installer.app Nullsoft installer.
7 h8 R9 u+ h4 N; b
" I8 a7 `5 l" K4 B& E; ]63. Download the Windows installer for Installer.app at
1 v; Z2 X! l; M! q0 o( X/ s) ^; j, d2 |, N0 b# d$ a
http://www.nullriver.com/~adam/AppTappInstaller.exe0 f+ i9 p* t9 ]+ `
0 P- r$ I( Z0 n* k" g7 g64. Use 7-zip to open AppTappInstaller.exe and extract the Installer.app
1 d3 n) V# g B: {& }5 B, b
* D8 L) p7 |' gfolder from it.
6 O# U7 V$ h' n. W/ ]6 H; Z2 z) w0 |, _6 k8 {/ O! `
65. Use SFTP to upload Installer.App into /Applications on your iPod. U: p S% }- I' {2 u
3 D/ H9 X% i F
66. In SSH, type "/bin/chmod -Rf +x /Applications/"" N8 _- s7 I9 f4 R
8 k5 }, K/ G( I$ @67. Slide to unlock your iPod then in SSH type
) U9 G/ u; c' ], `& e9 d4 w) P* {* C" Z6 \6 N* U
/Applications/Installer.app/Installer and hit return to launch. s. u7 g2 ]+ o; g ?
; l. J; N, u5 E* r6 a" r- z) UInstaller.- F b. f( M' `0 Q. n! j: P9 a; |
# W. `3 k u, r6 z: |68. After AppTapp opens, press control+c in SSH to close it
' C5 d1 i, `, b( [
6 |; ^' K1 H. S" v; e69. Open Safari on the iPod and navigate to& C% F/ @# w3 C: y$ I3 T
( J+ \" E% b( L
http://conceitedsoftware.com/iphone/beta. Please make sure while you're9 C& }7 \* J& f' P' k
/ O7 p9 l5 q/ o2 }. ?8 d/ I, gdoing this that the hacked TIFF image isn't loaded again. So if starts
* M6 M" i& |# k7 s/ r7 q6 N- u; A4 ^4 r4 P
loading, hit the X.$ w8 V5 G- t2 c* u
`. G3 Y+ s: n1 d. C2 H+ t
70. Tap yes to add it to Installer
& X1 K# X% L3 l- @) ~
; i/ z' q- c# ^% K n71. Back in ssh, type "/Applications/Installer.app/Installer" and hit! }- v2 V( N2 i, Z& ~- P
7 q: a4 ]+ @, [* w5 ereturn to launch Installer again.3 H. g1 w/ p2 w/ q2 k( n) Q
3 D- M, {8 H$ E3 X1 O72. Install the Community Sources package.( f9 x9 q7 m1 v" n% `
7 @" O7 b2 ] c9 t7 V73. Install Trip1PogoStick located under the "System" category to
. Y" P4 k5 J" o! V% R+ a' D9 f2 R. v
enable scrolling and applications.- c. X+ U$ K+ X6 m9 _( u9 j
2 X4 O% ~/ @* _! L
74. Restart the iPod. You should be done. 1 X/ V3 M5 m+ _/ \4 f3 R$ S2 @6 Y
9 b$ ?; G+ r9 h8 W
* ]/ K. O7 @1 G- t+ `9 {
|
|