I was attempting to brute force an iPhone 4 passcode for data recovery. The phone was in poor condition and had undergone modifications: the home button had been replaced as well as the back cover, maybe more. I could not reliably get the phone into recovery mode, possibly the result of a faulty home button, so i used libimobiledevice’s ideviceenterrecovery command.
It worked wonderfully. Maybe too wonderfully. I eventually achieved DFU mode (the home button was probably the culprit in making this normally simple process quite difficult), executed my exploit, and obtained the passcode and data. My goal was to unlock the phone and pass it off to another investigator. But, when I rebooted the phone after DFU mode I found it was in recovery again!
I tried a variety of things, from trying to rest with FirmwareUmbrella (formerly TinyUmbrella) to disassembling the phone and disconnecting the battery, but nothing worked. Then a colleague (thanks, Perry) suggested iRecovery.
libirecovery is a cross-platform library which implements communication to iBoot/iBSS found on Apple’s iOS devices via USB. A command-line utility is also provided.
— libirecovery
libirecovery can be compiled in Linux. I found I had to install the libreadline-dev package in my Ubuntu install, but you may find you have to do more depending on the packages you already have installed. Building requires you to execute the autogen.sh followed by make and then make install. I had to also run ldconfig to register the library since this was not done automatically.
The command line utility is the irecovery tool. It is used as follows:
iRecovery - iDevice Recovery Utility
Usage: irecovery [args]
-i <ecid> Target specific device by its hexadecimal ECID
-v Start irecovery in verbose mode.
-c <cmd> Send command to client.
-f <file> Send file to client.
-k [payload] Send usb exploit to client.
-h Show this help.
-r Reset client.
-s Start interactive shell.
-e <script> Executes recovery shell script.
On first blush, it might seem that the solution to my problem was the command irecovery -r to reset the device. But that is not so. Instead, I needed to enter the shell, change and environment variable, and reboot.
$ sudo irecovery -s > setenv auto-boot true > saveenv > reboot
|
Important
|
Running the command as root was required or the program failed with a segmentation fault. |
The device rebooted into the normal operating system and I was able to unlock it with the passcode I had recovered. If you find yourself in a recovery loop, I hope this post will help you, uh, recover from it!
You have no idea the headache you saved me from. Thank you my friend.
ReplyDelete