Hacker News Reader

Comment by behnamoh | Hacker News Reader

Does this also work on 4s?

Unfortunately, the SecureROM vulnerability that gala exploits was patched in the ROMs shipped with the 4s. Therefore, gala won't work out-of-the-box with the 4s.

However, a newer boot ROM exploit, checkm8, has become well-known in the intervening years. The A5 (that the 4s ships) is vulnerable to checkm8, which means that it'd certainly be possible to add support for this exploit chain to a project like gala!

I've been waiting for years for a project/tool to come along that allows me access to an old iPhone 4s (S5L8940) I have that is locked with an unknown PIN. I really just want the photos on it for nostalgia reasons.

The closest I found at the time was ipwdnfu, but it doesn't support the 4s [1].

I had assumed that this meant that checkm8 (which ipwdnfu uses/includes) didn't support the 4s either. Is that not the case?

[1] https://github.com/axi0mX/ipwndfu/issues/175

The same exploit is present in the 8940, but the path to get there is slightly different and incompatible with normal PC host USB controllers due to the need to avoid ever sending a zero length packet. There are plenty of ports using low level host hardware, for example https://github.com/a1exdandy/checkm8-a5 .

I think Sliver does what you want (PIN bypass) end to end for this device.

> a jailbreak for iOS 4

presumably not, the 4s launched with iOS 5

I'd also like to know if it works on the 4S.

Reply on news.ycombinator.com