WInd3x, the iPod Bootrom exploit 10 years too late(q3k.org)
q3k.org
WInd3x, the iPod Bootrom exploit 10 years too late
https://q3k.org/wInd3x.html
39 comments
Fantastic! I was involved in the freemyipod project back when the 4G was still a current product. In fact, the freemyipod.org wiki ran from a server I kept downstairs in my parent's home. My favorite memory was when we all built robots to brute force a return address (https://freemyipod.org/wiki/Nanotron_3000). Glad to see the project is still alive!
I totally remember that Notes exploit! And when Nano 3g showed corrupted scrollbar
I just bought a cheap mp3 player. If I'd known about rockbox, I'd probably bought something on their HW list.
As the mp3 player I got has user-hating firmware, I really wonder what's wrong with the HW vendors. Rockbox does better on less powered HW. If some cheapo chinese clone would just stick it on some half decent hardware, they'd kill their whole market segment.
All of this points to companies not loving money as much as they love playing power games with end user control. For some reason, they will rather write their own software and lock down everything, than just use good free existing software.
As the mp3 player I got has user-hating firmware, I really wonder what's wrong with the HW vendors. Rockbox does better on less powered HW. If some cheapo chinese clone would just stick it on some half decent hardware, they'd kill their whole market segment.
All of this points to companies not loving money as much as they love playing power games with end user control. For some reason, they will rather write their own software and lock down everything, than just use good free existing software.
There are basically no mp3s still made supported by rockbox. I tried the same. What one did you buy? I bought the Agptek A02 and nhere are only breadcrumbs when it comes to finding it's official SDK.
I got this:
https://www.bol.com/be/nl/p/transnect-hifi-audio-mp3-speler-...
I wanted something that allows my young son in the car to listen to the same 30 songs('kapitein winokio') over and over without driving my wife and me bonkers. As he gets sick when looking too long at a screen in a car, we wanted the minimum number of features outside playing music. Even so, a screen good enough to select the album was required, and it must be cheap enough that I don't care too much if it gets damaged or lost
It claims to support video playback and ebook reading, but both features seem basically useless on the tiny screen, which is great for my use case. Unfortunately, it doesn't believe in alphabetic order when showing a list of files, uses left/right for scrolling up/down, uses 'menu' as OK button and mostly but not always ignores the OK button. Playlists seems too brain damaged to be of any use, so we ignore the mp3 menu and use the file browser as mp3 player. The usb micro connector dropped off the usb cable within 10 minutes of plugging it in, but I drown in replacements so who cares. The player itself and the headphone are actually sturdier than I expected. The firmware identifies itself as v1.1 but has no device or vendor information.
So basically, same rock bottom quality as all other cheap players. We got the price and quality we expected and can't complain, but 15 minutes with the source code and turning the keyboard 90 degrees would solve oh so much tiny frictions.
As I own it for a bit more than a day, there might be some hidden bonuses or traps I haven't seen. Don't ask me if this is a positive or negative review.
https://www.bol.com/be/nl/p/transnect-hifi-audio-mp3-speler-...
I wanted something that allows my young son in the car to listen to the same 30 songs('kapitein winokio') over and over without driving my wife and me bonkers. As he gets sick when looking too long at a screen in a car, we wanted the minimum number of features outside playing music. Even so, a screen good enough to select the album was required, and it must be cheap enough that I don't care too much if it gets damaged or lost
It claims to support video playback and ebook reading, but both features seem basically useless on the tiny screen, which is great for my use case. Unfortunately, it doesn't believe in alphabetic order when showing a list of files, uses left/right for scrolling up/down, uses 'menu' as OK button and mostly but not always ignores the OK button. Playlists seems too brain damaged to be of any use, so we ignore the mp3 menu and use the file browser as mp3 player. The usb micro connector dropped off the usb cable within 10 minutes of plugging it in, but I drown in replacements so who cares. The player itself and the headphone are actually sturdier than I expected. The firmware identifies itself as v1.1 but has no device or vendor information.
So basically, same rock bottom quality as all other cheap players. We got the price and quality we expected and can't complain, but 15 minutes with the source code and turning the keyboard 90 degrees would solve oh so much tiny frictions.
As I own it for a bit more than a day, there might be some hidden bonuses or traps I haven't seen. Don't ask me if this is a positive or negative review.
If you can live with iTunes, you really can't beat iPods. I've got a classic that's still rock solid and gets regular use at home and in the car. I did have to swap out the battery last year though.
I bought a Shanling Q1 years ago and hated the stock firmware so much I never used the device. A while back someone added support for it to Rockbox, and it's finally usable.
It kinda amazes me that this device, which sold 10's of millions of units, never had an exploit found till now.
Somehow Apple just crushed the hacking and modding community for their hardware.
Somehow Apple just crushed the hacking and modding community for their hardware.
I remember jailbreaking my 4th Gen U2 version nearly 2 decades ago. I think it was the first time I even herd of the term "jailbreaking". Previous to that it was "Modding" or "Mod Chipping" or "Chipping" for game consoles, but those did require a steady had to solder a chip on the console.
I also remember photo friends buying them just to break out the 1.8 inch drives to use for cameras because it was cheaper to rip a 20gb drive out an iPod than buy them from a supplier.
Lol, I also remember iTunes on Windows being decent, then at some point absolutely wrecking my music folder.
https://en.wikipedia.org/wiki/IPod_Classic#U2_Special_Editio...
I also remember photo friends buying them just to break out the 1.8 inch drives to use for cameras because it was cheaper to rip a 20gb drive out an iPod than buy them from a supplier.
Lol, I also remember iTunes on Windows being decent, then at some point absolutely wrecking my music folder.
https://en.wikipedia.org/wiki/IPod_Classic#U2_Special_Editio...
I think iPhone OS exploits were specifically named jailbreak because it allowed sandbox escape into a root shell on a Unix, by association with BSD jail. On iPod it was just modding/custom ROM flashing.
My guess is that iOS jailbreaking killed the iPod scene. Keep in mind that right when the 5th gen Nano came out, it was competing against the iPhone 3GS.
This seems likely. Early iPhones and iPod Touches were much more attractive targets for jailbreaking, given their more generalized nature, better hardware, and more capable native OS — the range of possibilities was far more great.
It's also not practical to upgrade the storage in flash-based iPods, which reduces the utility of something like Rockbox. The stock OS is perfectly serviceable for the size of library one would be carrying around on a Nano.
It's also not practical to upgrade the storage in flash-based iPods, which reduces the utility of something like Rockbox. The stock OS is perfectly serviceable for the size of library one would be carrying around on a Nano.
But it only plays MP3 and AAC, not for example OGG, FLAC, or tracker music formats.
Sure, but the size/quality difference between AAC and OGG isn’t huge enough for most to want to use OGG instead, tracker music formats are niche, and anybody who wants FLAC probably wants one of the hard drive based iPods so they have the amount of space required to store even a small lossless library.
True. However, rockbox let you play doom on ipod nano 1st gen. :)
The lookalike clones probably sold several times more, as they had more features (FM radio, voice recorder, video playback, expandable storage, generic USB mass storage with no software required, even video recording on some later models) at a fraction of the cost. Most of those were based on a Z80 + DSP SoC running at 24MHz.
Most of them however have terrible firmware.
When last one of my Clip Zip died I couldn't find a RockBox compatible replacement that wasn't either too expensive or too old, so I bought first an AgpTek something (identical to the newer A02, but mine had no Bluetooth) which at least was useable, but died after 3 years: one morning it crashed just after boot and any attempt to reset and revive it failed.
Then I bought a "Jolike" (0) player off Ebay at a really good price, which turned out to be half disappointing: construction is surprisingly robust and it sounds really clean, but the firmware predictably is a disaster: they clearly aimed at cramming features in there to show more bullet points in advertising, but did never properly develop and test them, which happens very often in cheap chinese products. A RockBox port would turn it into a great product.
(0) https://www.jolike.com.cn/productinfo/534495.html
(0) https://www.jolike.com.cn/productinfo/534495.html
Sansa Clip Zip/Plus + rockbox were trully exceptional for their time. I'm not sure if we'll ever see an open device of such all around quality seeing how things are going these days.
I still have my Sansa clip flashed with rockbox lying around. It was a great device at the time. Maybe I should look where it is, now that I accidentally bought one of those idiotic no audio jack phones.
It's more that nobody cared. By the time this device came out, smartphones were already taking over.
> What have we learned?
> Don't put a C implementation of a USB stack in your BootROM, lol.
Meanwhile
Intel: put the entire network stack into intelMe and enable it by default.
> Don't put a C implementation of a USB stack in your BootROM, lol.
Meanwhile
Intel: put the entire network stack into intelMe and enable it by default.
You mean put an entire MINIX system into ME. It’s not just the network stack.
Intel just decided the decoder unit actually needed to be a full embedded OS and system. As for the net stack, sometimes the decoder gets confused with esoteric x86 instructions and needs to contact the internet for help.
All logically explainable ;)
All logically explainable ;)
Submit it for a bug bounty - https://security.apple.com/bounty/
lol
>Useless Old Device
A supercomputer in your pocket, by old enough standards.
It is good that these can find a new life other than becoming landfill.
What's sad is that it needs to be done by third parties through hacking; legislation should be in place so that the vendor has to facilitate the reuse of old such devices.
A supercomputer in your pocket, by old enough standards.
It is good that these can find a new life other than becoming landfill.
What's sad is that it needs to be done by third parties through hacking; legislation should be in place so that the vendor has to facilitate the reuse of old such devices.
Might be worth submitting to the Rockbox project. Their iPod support seems to lack these newer devices
There is not nearly enough for a functioning N5G Rockbox port. We're still missing a ton of peripheral drivers, power saving, and a flash translation layer implementation. Not to mention there's currently no untethered code execution exploit for the N5G.
The N3G/N4G have an old WIP code dump from years ago, and that's in a much better shape to pick up and try to get upstreamed into Rockbox :).
The N3G/N4G have an old WIP code dump from years ago, and that's in a much better shape to pick up and try to get upstreamed into Rockbox :).
iPod. Brings back memories of Mad TV making a parody of the iPod ad. It was for something called the "iPad".
This was at least three years before Apple announced iPad.
https://www.youtube.com/watch?v=FTzhXMbOWHE
This was at least three years before Apple announced iPad.
https://www.youtube.com/watch?v=FTzhXMbOWHE
The 7th gen iPod Nano is basically the idea form factor for an everyday mp3 player, and it sucks that the stack not just being “upload music files onto a usb drive” means the device is susceptible to just not work anymore one day.
One of my “never going to do but will often think about” projects is to try and build an open design music player that doesn’t try to be a universal computational device but is at least not extra wonky like all the random ones you find on Amazon nowadays.
One of my “never going to do but will often think about” projects is to try and build an open design music player that doesn’t try to be a universal computational device but is at least not extra wonky like all the random ones you find on Amazon nowadays.
The iPod nano 7th generation uses the same file structure as other iPods, but appears to use a database checksum that hasn't been reverse engineered yet. Given that the 7th generation nano has Bluetooth, I hope it's a more attractive target for exploits and reverse engineering. I agree that it's a lovely form factor!
oh, I totally had the impression it was its own beast just from the UI being what it is. Maybe time for me to dig into this
I'd be 100% down to help, if you do -- my 7th gen iPod Nano is the best MP3 player I've ever owned, the Bluetooth compatibility alone made it fantastic, and I'd love to get some new lease on life with it (or even just tinker with it. Being able to not be dependent on iTunes alone would be awesome)
Great work, it will be interesting to see where this goes.
the classic 'usb stack in my boot rom' :^) nice
Nice