cmw.me

Well for all those who were interested in how we did it. Here is the source code for our exploit ( see below). I won't go into to much detail since metasploit already did.
This will work on iTouch/iPhone firmware 1.0.2 and 1.1.1.

http://www.toc2rta.com/files/itiff_exploit.cpp

If you have any questions or comments please feel free to email me chrisw (at) toc2rta.com

So its offical we have released the tiff exploit code. You can navigate in safari to http://jailbreak.toc2rta.com on your Itouch or Iphone 1.1.1. It will crash your Safari but then you will be able to browse the file system with full read/write access. This is only for people who understand what they are doing. You will need IPHUC and some knowledge of how to put/get files.

TUTORIAL FOR WINDOWS

Ok so i got given a usdtv by a friend. I managed with the help of codeman to desolder the SPI flash and i'm currently in the process of dumping it.

I also managed to decrypt and mount the jffs2 image that was part of the USD_TV_update file thats been floating around the net.

After the usd_tv.bin file has been decrypted and extract there is 4 parts.
PART 1 = jffs2 image
PART 2 = kernel
PART 3 = md5 of kernel
PART 4 = some tarball with custom scripts.

Ok, I'm back up and running. Expect lots of new and interesting things.

Where to start! I have been searching for a cheap device that i could use for a cluster. I came across the msntv 2 at CompUSA one day about 2 months ago. Ever since then I have been buying them on eBay for around $0.99 cents. Don't believe me?

I have recently managed to trace the jtag points on the Sidekick 2 which has allowed me to load uCLinux.
A friend made a quick video to show you how i did it.

Update - As promised to certain sidekick developers. Here is the jtag points in detail Jtag Points

Building jtag rig for Sidekick 2

Enjoy...

Toc2rta was responsible for the first confirmed exploit of libtiff (which is also the first buffer overflow for the PSP)

The first version of the exploit used a modified .png, which had to be set as the wallpaper, together with a modified .tiff containg the exploit code. An updated version of the .tiff was modified to load a file (h.bin) from the root of the memory stick which contained compiled MIPS assembler code.