Cracking the iPhone (5 article series)
The last part of my iPhone-related blog entries was posted last night. The
first article discusses the architecture and provides some useful
shellcode for already-modified phones.
http://blog.metasploit.com/2007/09/root-shell-in-my-pocket-and-maybe-yours.html
The second article discusses the libtiff exploit and includes a link to a
modified version of the weasel debugger.
http://blog.metasploit.com/2007/10/cracking-iphone-part-1.html
The third article steps through the entire libtiff exploit development
process, using an updated version of the debugger.
http://blog.metasploit.com/2007/10/cracking-iphone-part-2.html
The fourth article describes a different approach to exploiting the
libtiff vulnerability that is much more reliable across a wider range of
applications.
http://blog.metasploit.com/2007/10/cracking-iphone-part-21.html
The fifth and final article walks through the process of developing a
payload capable of writing arbitratry executables to disk and executing
them. The final article closes with a stand-alone shell that can be used
to gain remote, interactive access to unmodified iPhones, and
demonstrates how to use this shell to apply the third-party libtiff
patch.
http://blog.metasploit.com/2007/10/cracking-iphone-part-3.html
-HD