Powdersn0w

The bootrom listens for USB control requests (e.g., SET_CONFIGURATION , GET_DESCRIPTOR ). A specific sequence of requests triggers a in the USB stack.

: It supports creating and restoring custom firmware that can include jailbreak options , verbose boot, and "hacktivation" (activating a phone without a valid SIM card). powdersn0w

| Device | Chip | Bootrom version | |----------------|-----------|----------------| | iPhone 3GS | S5L8920 | 0x24000 (vulnerable) | | iPhone 4 | S5L8930 | 0x21000 (vulnerable) | | iPad 1 | S5L8930 | 0x21000 (vulnerable) | The bootrom listens for USB control requests (e

By sending len = 0x800 with crafted data, the attacker overwrites function pointers in the heap, hijacking execution. powdersn0w