Skip to content

Conversation

@ninjaprawn
Copy link

Adds a new signature verification bypass for the resources file, allowing booting straight to 'osos'.

  • This works by changing the Img1 format of the resources file from '4' (X509_SIGNED) to '3' (X509_SIGNED_ENCRYPTED). There is some issue when the Img1 verification is done, which allows the resource file to be considered 'verified' when changed. I'm assuming this is due to some return values being mistreated.
  • I'm not sure if this works on iPods outside of n7g 2012, but I'm guessing this issue is in the bootloader so it may not matter.

Fixes the issue described in #4 for n7g.

  • This is done by changing which SCSI command is overwritten by the exploit (from 0x96 to 0x98)
  • I don't have a n6g to test updated offsets for that device
  • Some of the tools have been updated to accomodate this change
  • Ideally, we only modify a branch in the SCSI logic to add a new command, but I feel like the best way to do this is to malloc + memcopy the generated code, but I think that is outside the scope of this project

@LIKVIDATOR1337
Copy link

If you have offsets for n6g, i can test them.

@CUB3D CUB3D self-requested a review July 18, 2025 03:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants