Databases
StackOverflow2013
Postsdbo
POiPhone 4 Unlocking. NCK-Bruteforce Research
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POiPhone 4 Unlocking. NCK-Bruteforce Research
    primarykey
    data
    text
    <p>Every iPhone has a NORID (8 bytes) &amp; CHIPID (12 bytes) unique to each phone. </p> <ul> <li>Where is this stored? NOR? seczone? Can it be dumped?</li> </ul> <p>An iPhone requires a NCK to unlock. From what I understand the NCK is 15 characters.</p> <ul> <li>Is it numeric, alpha or alphanumeric?</li> </ul> <p>The security token for check if the NCK is valid is stored encrypted at +0x400 in the seczone.</p> <ul> <li>Is this correct?</li> </ul> <p>Based on what I've read from dogbert's blog, the security token is created using a method similar to the following pseudo code:</p> <pre><code>deviceKey = SHA1_hash(norID+chipID) nckKey = custom_hash(norID, chipID, SHA1_hash(NCK), deviceKey) rawSignature = generateSignature(SHA1_hash(norID+chipID), SHA1_hash(chipID)) Signature = RSA_encrypt(rawSignature, RSAkey) security token = TEA_encrypt_cbc(Signature, nckKey) </code></pre> <ul> <li>Is the pseudocode correct? If it is then what is the custom hash that is being used? What is being used to generate the rawSignature? What is the RSAKey that is being used? Is it a public key that can be found in the phone?</li> </ul> <p>If the above pseudocode is CORRECT. Then we would have to bruteforce all 15 character combinations to find the correct NCK key right? Because, even though we are able to recover the NORID and CHIPID, we will not be able to use that information to shorten the amount of characters which we need to find.</p> <ul> <li>Correct?</li> </ul> <p>New generations of iPhone OS contains a wildcardticket that is generated during activation process. </p> <ul> <li>but this should be no problem generating once we have the NCK right? Correct?</li> </ul>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USRichard Slater
    1. USd123
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POiPhone 4 Unlocking. NCK-Bruteforce Research
      1. USCorbin
      1. VTFavorite
    2. VO
      singulars
      1. POiPhone 4 Unlocking. NCK-Bruteforce Research
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POiPhone 4 Unlocking. NCK-Bruteforce Research
      1. This table or related slice is empty.
      1. VTUpMod
    1. COI got bumped from the Apple-Stack Exchange, saying that this is a programming related question. So I guess I'll ask it here
      singulars
      1. POiPhone 4 Unlocking. NCK-Bruteforce Research
      1. USd123
    2. CO[The iPhone dev team](http://blog.iphone-dev.org/) was working on this NCK cracking thing, you should search their blog also to see if they published anything that might help you. Also [according](http://api.twitter.com/#!/MuscleNerd/statuses/45811752289579008) to one of their members, the NCK is just 40 bits.
      singulars
      1. POiPhone 4 Unlocking. NCK-Bruteforce Research
      1. USNasreddine
    3. COHi, Yes I know they were working on it. But no further details, I'm looking for more technical details such as what algorithms are used, what has been done, how did they come to figure 40bits. I have tried to twitter them but no response yet. The thing is that, if the above algorithm I read about is correct, then having the NORID and CHIPID is not going to help, and still have to bruteforce all 15 characters
      singulars
      1. POiPhone 4 Unlocking. NCK-Bruteforce Research
      1. USd123
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload