Here’s how the evasi0n jailbreak works, as told by one of its authors

Have you ever thought about how the latest evasi0n jailbreak actually works and what it took the evad3rds team members to overcome the hardened defenses of Apple’s latest devices? One of the team members, David Wang, a.k.a. @planetbeing, who was one of the two people who were personally responsible for finding the exploit in Apple’s code, sat down for an interview with fellow tech journalists and explained the whole process.

The evasi0n jailbreak was launched only 2 days ago. More than 1.7 million iOS devices were jailbroken in the first 24 hours, according to Cydia’s download stats. What’s more – the half of that number was reached in mere six hours of the release of the jailbreak tool.

Of course, the simplicity of the jailbreak solution is tempting to many, and it’s easy to forget how much work actually went into creating this seamless hack tool. With every new iOS release and every new iOS device, Apple’s code quality and system protection only gets better. So these guys have overcome an enormous challenge.

And here’s how evasi0n operates, as told by one of its creators:

evasi0n begins by running libimobiledevice, a program that substitutes for iTunes to communicate with iOS devices via the same protocol as Apple’s program. Using that tool, Evasi0n exploits a bug in iOS’s mobile backup system to gain access to certain settings that it normally shouldn’t be able to access, namely a file that indicates the device’s time zone.

The jailbreak program then inserts a “symbolic link” in that time zone file, a shortcut from one place in an operating system to another. In this case the link leads to a certain “socket,” a restricted communications channel between different programs that Wang describes as a kind of “red telephone to Moscow.”

Evasi0n alters the socket that allows programs to communicate with a program called Launch Daemon, abbreviated launchd, a master process that loads first whenever an iOS device boots up and can launch applications that require “root” privileges, a step beyond the control of the OS than users are granted by default. That means that whenever an iPhone or iPad’s mobile backup runs, it automatically grants all programs access to the time zone file and, thanks to the symbolic link trick, access to launchd.

iOS has another safeguard that would normally prevent any rogue application from gaining access to launchd: Code-signing. That restriction requires that all code run on a device is approved with an unforgeable signature from Apple. So Evasi0n launches a new app that appears to have no code at all–signed or unsigned. But when a user is prompted and taps the app’s icon, it uses a Unix trick called a “shebang” that can summon up code from another, signed application. In this case, it summons up launchd–which it can only access thanks to the socket change it made earlier–and uses it to run a “remount” command that changes the memory settings of the read-only root file system to make it writable.

Now that the root file system is writable, evasi0n changes a file called launchd.conf that alters the configuration of launchd so that the changes evasi0n makes to it are repeated every time it runs. That’s what will make the jailbreak “persistent”: The user won’t need to re-run the program over a USB cable every time the device boots.

Even after all those contortions, a device isn’t jailbroken until its restrictions are removed at the “kernel” layer–the deepest part of the operating system that performs the code-signing checks to prevent running unapproved apps using a process called the Apple Mobile File Integrity Daemon (AMFID). So evasi0n uses launchd to load a library of functions into AMFID every time a program launches that somehow swaps out the function that checks for a code signature for one that always returns an “approved” answer.

iOS has yet another safeguard to prevent hackers from altering memory in the operating system kernel: Address Space Layout Randomization, or ASLR. That defensive trick moves the location of device’s code in its flash memory a certain, random distance every time it boots up to stymie anyone who would write over a particular part of the code. But evasi0n uses a memory allocation trick to locate one spot in memory that’s harder to hide in ARM-chip-based devices, known as the ARM exception vector. That part of the kernel handles application crashes, reporting on where in memory they happened. So evasi0n simulates a crash and checks the ARM exception vector to see where the crash occurred, providing just enough information to map out the rest of the kernel in the device’s memory.

Once it’s beaten ASLR, the jailbreak uses one final bug in iOS’s USB interface that passes an address in the kernel’s memory to a program and “naively expects the user to pass it back unmolested,” according to Wang. That allows evasi0n to write to any part of the kernel it wants. The first place it writes is to the part of the kernel that restricts changes to its code–the hacker equivalent of wishing for more wishes.

Another, more detailed and more technical rundown of what happens when you jailbreak your iOS device, can be found here. What these guys did looks like an amazing feat and we hope their solution will stick around for a while before Apple strikes back.

Source | Via