[iPhone SDK] Problems running built apps on pwned 2.0 Beta

This crosses turf between pwn and SDK and there are various comments in various places but no clear home. Perhaps this can become a general hook for initial problems in this area.

Being one of Apples dispossessed ("don't call us, we'll call you"), I need a way to run official SDK built apps on the iPhone. There are reports in various places that this works but very terse comment.

The following instructions attributed to cosmoLV

"1. Restore to 1.1.4
2. PWNED - see PWNED Help
3. Restore custom 1.1.4 with iTunes
4. PWNED -> Make Custom 2.0
5. restore custom 2.0 with iTunes"

Its unclear to me why step 3. is required since step 5. would seem to blow it away - but anyway.

If I follow these instructions, and then build an app for the release device using the current (recent) official SDK and sshed the built .app directory across to the /Applications of the pwned 2.0 (1.2) phone and then restart, the apps appear in the Springboard. In an unpwned 2.0 (1.2) they do not even appear.

When I try and start the apps they do start but shutdown again within a second. This is time enough to see that they are executing e.g. they are painting their UI components which suggests that the apps contain some valid code.

The apps being used are clean built copies of the Apple SDK examples and all that will build have been tested with the similar result.

For example, the Accellerometer Graph application starts up and displays three graphs but immediately shuts down again.

The only thing that I could see that looked odd on the device was that my uploaded applications did not have group execute set, unlike the preexisting ones. However the problem is the same with it set either way.

I used the default pwn options (although I have tried tht whole sequence a few times including other options)

I am running on a [early march] iPhone 16G.

So, does it work for you? What are we doing that is different? Is the need to restore a pwned 1.1.4 just a myth? and if not what lasting effect does it have after the pwned 1.2 pas been installed

Have you tried using Xcode to upload the application instead of sshing it? There's an option in the organizer window on the bottom of the first tab.

The plot thickens.

I cannot find the option you speak of nor can I see any tabs (in the sense of a tabbed pane) in the organizer window but guessing that this is the first choice list button, then I can see no upload option there.

But following a lead from elsewhere which said
In project settings set "code signing identity" to "Device - iPhone OS 2.0"
I thought that perhaps this option only appears if there is a code signing identity set.

"Device - iPhone OS 2.0" looks an odd value for "code signing identity" but I can confirm that with it there (or for that matter with "XYZZY" there) the system behaves differently.

Now if I try to build the code (NOT build and go, just build) I get an error

codesign error: unsupporter architecture "armv6", Please upgrade to MacOS 10.5.2 or later.

OK, so I'm running at 10.5.1 (and there are some problems upgrading to 10.5.2) BUT

If code signing identity is blank but the Base SDK set to "Device - iPhone OS 2.0" then the system is happy to build the app and not sign it and further more that code [starts to] execute on the pwned 2.0 iphone.

So is the problem that the applications MUST be signed although it doesn't matter what with, and mine are being killed because they aren't signed at all - and someone has built the x3.1 code signer to require armv6, possibly for no good reason apart from it being Friday.

Or is it because there is something in the iPhone that really does require v6 code and that xcode 3.1 relies on the presense of a signature, rather than selection of the Base SDK to "Device - iPhone OS 2.0", to tell it which compiler to use.

Assuming that the Apple sandbox can kill applications that it doesn't like, after they start, which I understood to be the case but don't remember where from, then my money is on the former.

I wonder if there anything else that I can use to sign the application in a compatible manner, albeit with a random signature.

OK, I think that I now have a clear set of rules.

You can deliver the application to the Device by ssh or by xcode's upload facility or by using the Build and Go option directly -

BUT

The application must be "sandboxized" [Ugh - from the messages output - not my word]

The Build option will sandboxize an application if and only if the "code signing identity" attribute in the project settings is not empty, and of course empty is the default.

Sandboxizing includes signing but may include other packaging things.

A sandboxized application will run on pwned 2.0 Beta device so you can sign with any string in "code signing identity" BUT

An unsandboxized application will be killed shortly after startup, but long enough after to perform quite a bit of UI initialisation.

Presumably this is NOT a serious security feature since a malicious application can perform quite a bit of damage in the available fraction of a second. Perhaps it is intended as more of a marketing control feature, but if this is intended as real security for the user against a rouge application then it must be fixed so that there is no window of opportunity for damage before UI initialisation or else it simply provides a false sense of security. Apple Please Note!

Are you sure it is actually running code?

Because iPhone apps let you put a default.png image in the bundle that is displayed while the app begins initializing - maybe this is all you are seeing?

Quote:

---

Originally Posted by sleeepy

OK, I think that I now have a clear set of rules.

You can deliver the application to the Device by ssh or by xcode's upload facility or by using the Build and Go option directly -

BUT

The application must be "sandboxized" [Ugh - from the messages output - not my word]

The Build option will sandboxize an application if and only if the "code signing identity" attribute in the project settings is not empty, and of course empty is the default.

Sandboxizing includes signing but may include other packaging things.

A sandboxized application will run on pwned 2.0 Beta device so you can sign with any string in "code signing identity" BUT

An unsandboxized application will be killed shortly after startup, but long enough after to perform quite a bit of UI initialisation.

Presumably this is NOT a serious security feature since a malicious application can perform quite a bit of damage in the available fraction of a second. Perhaps it is intended as more of a marketing control feature, but if this is intended as real security for the user against a rouge application then it must be fixed so that there is no window of opportunity for damage before UI initialisation or else it simply provides a false sense of security. Apple Please Note!

---

I just use the xcoder to deploy applications with empty code signing information, it works fine, build and go or click in SpringBoard.

Quote:

---

Originally Posted by cazlar

Are you sure it is actually running code?

Because iPhone apps let you put a default.png image in the bundle that is displayed while the app begins initializing - maybe this is all you are seeing?

---

H'm. I Think you're right.

Strange working convention. You write software to create a GUI and then create an image to display the same information. I woz conned. The software was indeed not running at all.

I have the same problem! I have gone through the same pwnage-process you mentioned above, twice (just to make sure).

and ...

1. The Organizer in Xcode accepts my iPhone.

2. I can compile all the Apple example projects.

3. I can use the Build & Go to build and deploy the app directly to my iPhone (through USB cable).

4. The app starts up, but then freezes (or more correctly: it just shows me the png screenshot).

5. BUT - strangely - there is ONE app that DO run and work fine, and that is the "WhichWayIsUp" example!

sleeepy, DID you or did you NOT solve this problem? I don't really understand where to SIGN the application, or what that means? If this is the solution to the problem, please give me a clue on how to proceed ...

(I'm using an 'old' iPhone bought in September.)

Re: DEFALULT.PNG
The image that shows up (Default.png) when you start the app is there for a good reason.
It gives you feedback the moment you open the app and makes you feel that the iPhone is very responsive.
In fact it takes a while to start any app and you can clearly see that if you are paying attention. For example the calculator app which only starts the moment the screen turns on (goes blue).
Also, it is possible to create the Default.png at runtime, in case you want to make the user feel like the app never closed. You just have to generate the image when the app suspends or terminates. There is a function that does just that.

Now it works! I just updated to 5A240d (which became possible today with the new pwnage tool 1.1)!

A wild guess is that the problem was I updated the latest version of the SDK this week but was running the older 2.0 beta.

This is great!