Secure ROM extraction on iPhone 6S(ramtin-amin.fr) |
Secure ROM extraction on iPhone 6S(ramtin-amin.fr) |
If the author is reading: how did you develop that multi-layer board? Do you have a PCB fab that can print a board in, say, one or two days time? And how did you assemble that PCIe inject board, given those ultra small SMD parts? Did you order a fully-built PCB or did you do all this by hand?
Small Batch Assembly (haven't used them yet) should be able to put it together for you if you'd rather not DIY. If you'd like to, though, Osh Stencils, tweezers, some solder paste and a rework station (or a heat gun if you're feeling brave) and you can do a lot at home.
The DDR3 routing, the BGA chip, everything on this board 'screams' very hard work, probably not by a single person ( i have to admin I checked the FPGA/board part only )
I'm not certain about routing the DDR3 traces, but DIY soldering on a BGA chip isn't the absolute worst thing in the world, and VHDL/Verilog aren't that bad, especially when using the Xilinx tooling. A lot of that code is written for you (and you usually don't have to purchase IP cores... usually)
In fact I wouldn't be surprised if this particular task, extracting the boot ROM, was already done long ago by a few groups but not publicised --- Apple's bounties may seem enticing, but these people know it's the end if they tell Apple; they'd rather keep it secret and use those "holes" to keep investigating and sell their results to repair shops, which may ultimately yield far greater profit.
I agree with the former especially because of the latter half, I'm quite sure I could never do this today, but, I'm also quite sure I could learn to do this if I wanted to (and was willing to accept all the soldering burns I inevitably inflict on myself every time I try to solder something)
Most programmers today are not electronics saavy, even electricity saavy. But it's not Quantum Mechanics.
It looks like they did succeed in dumping the full contents of the boot ROM. They don't appear to have done anything with that dump (yet).
Also I'm not sure that it's possible to do factory reset and stay on old version. But as long as you don't do that and don't press "upgrade", you'll be fine.
archive.is link for anyone else having this issue: http://archive.is/bA9Ak
But iPhone repair technicians and others are very blase about just using hot air guns and a ton of flux to solder all kinds of BGA chips, and they generally seem to work just fine.
Now DDR3 and USB3 routing is very annoying, but you generally just copy the reference design of the FPGA manufacturer and possibly adjust for your board layup.
Not to talk down Ramtin's achievements (I think his work is awesome), but hardware hacking is significantly easier these days when you can buy a JTAG dongle + software for less then $10 and order a high quality PCB with another $10-20.
Switching to Google's DNS might fix your problem. If it doesn't, it's probably Shaw's routes.
Thanks for the archive link!
Those first few steps to get good with the tools are the hardest. Everything else past that is getting better with better - and potentially more expensive - tools.