Getting JTAG on the iPhone 15

  Рет қаралды 331,232

stacksmashing

stacksmashing

8 ай бұрын

In this video we explore how to get access to the JTAG interface on the new iPhone 15!
Special thanks to aunali1 & h0m3us3r, the Asahi Linux Project and Marc Zyngier!
Sign-up to the hextree.io waiting list here: hextree.io/
Links:
- Twitter: / ghidraninja
- Patreon: / stacksmashing
- Modified Chip Scrutinizer Firmware: github.com/stacksmashing/cs-s...
- macvdmtool patched for the iPhone 15: github.com/stacksmashing/macv...
- My DEF CON talk on Tamarin Cable: • DEF CON 30 - stacksmas...
- The secrets of Apple Lightning: • The secrets of Apple L...
- Central Scrutinizer Hardware: git.kernel.org/pub/scm/linux/...
- Central Scrutinizer on Tindie (does not work with iPhone 15 without modifications): www.tindie.com/products/aaafn...

Пікірлер: 278
@muditbatra1681
@muditbatra1681 8 ай бұрын
Working in a semiconductor company myself, it’s really nice to see how much effort you put in this with literally 0 official documentation available with you. Please do a follow up as well on your progress.
@bassyey
@bassyey 8 ай бұрын
@@shueibdahir Pay is better in software lol. I left embedded field myself.
@janossydnepthalipao4277
@janossydnepthalipao4277 8 ай бұрын
I mean, I was about to say the same to him.
@shueibdahir
@shueibdahir 8 ай бұрын
@@bassyey How about hardware? Like sysadmin or some sort of it engineer? Do they pay aswell as software?
@farawayskies
@farawayskies 8 ай бұрын
@@bassyey Did the same. Worked in embedded a couple years and switched to software. Didn't do it for the money, although I did immediately get a six figure salary.
@farawayskies
@farawayskies 8 ай бұрын
@@shueibdahir I'd argue sysadmin does not pay nearly as well as software on average. I think you'd need to be a senior sysadmin to make what an entry level software engr can make.
@SomeDork353
@SomeDork353 8 ай бұрын
It's not even been 2 weeks, give poor Tim Cook a break lmao. Very cool work!
@djispro4272
@djispro4272 8 ай бұрын
Ah yes, Tim Cook is poor!
@Adolf1Extra
@Adolf1Extra 8 ай бұрын
Mr Tim Apple is merely an expendable pawn partaking in techno-feudalism to please his anti-capitalist shareholder lords.
@JPS13Laptop
@JPS13Laptop 8 ай бұрын
@@djispro4272 It's a figure of speech...
@Corei14
@Corei14 8 ай бұрын
*Tim Apple
@HyperVectra
@HyperVectra 8 ай бұрын
@@Corei14 lol you beat me too it!
@r.g.thesecond
@r.g.thesecond 8 ай бұрын
Amazing! Kudos to Asahi project as well for their dedication. Have a happy and productive hacking time!
@realcartoongirl
@realcartoongirl 8 ай бұрын
can you speak regular people language
@blackhorseteck8381
@blackhorseteck8381 8 ай бұрын
Man, you brought me back memories of JTAG on the PS2 and X360, cool video though!
@aettic
@aettic 8 ай бұрын
Interesting stuff. It's always so cool to me to see folks who have specialized knowledge in the areas where hardware and software meet. Even just reading those notes from the documentation (From the Texas team, if I understood correctly?) about the 206 maybe being SWD is so cool to see: Playing around with hardware and probing it for signs of how it might work. Very cool.
@crusher70
@crusher70 8 ай бұрын
Fascinating work, well done getting this far. Can’t wait to see how far you can go. Good luck
@stacksmashing
@stacksmashing 8 ай бұрын
Thank you! :)
@crusher70
@crusher70 8 ай бұрын
@@stacksmashingI feel a visit to DigiKey is imminent 😂
@majdps995
@majdps995 8 ай бұрын
Very well put video, straight to the point and no music. +1 sub.
@saschakaupp
@saschakaupp 8 ай бұрын
Now I want a new iPhone, just to be able to use JTAG via USB-C. No clue what to do with it, though.
@fffUUUUUU
@fffUUUUUU 8 ай бұрын
But maaaam!😢 It's for the homework!
@alfaxgo
@alfaxgo 8 ай бұрын
It's for getting some of the Android features without having to wait for Apple to announce the same features as great improvements on iPhone 17.
@Tonysopranoyafinook
@Tonysopranoyafinook 8 ай бұрын
Run linux, windows, android… dual boot or overclock.
@a17waysJackinn
@a17waysJackinn 8 ай бұрын
idk im noob too no idea what hes talking, but "jailbreak" control hardware and overclocking chips or smth I GUESS..
@charon7320
@charon7320 8 ай бұрын
u are doing amazing work with so little documentation, literally a tech detective.
@csbluechip
@csbluechip 8 ай бұрын
There seems to be virtually zero courses on hardware hacking and reversing. I really hope your hextree project changes this :)
@stacksmashing
@stacksmashing 8 ай бұрын
We hope so too! :)
@prakharmishra3000
@prakharmishra3000 8 ай бұрын
its actually pretty diverse depending on what you want to hack, so its difficult to make a generalised tutorial for hardware hacking and most people just learn it themselves
@jameshatton4405
@jameshatton4405 8 ай бұрын
Yes I agree. I think that's the highlight of this video actually, not the iPhone 15 hacking itself (which is still awesome)
@phr3ui559
@phr3ui559 8 ай бұрын
yes
@mattmurphy7030
@mattmurphy7030 8 ай бұрын
There are entire university degrees dedicated to embedded engineering lol
@CyReVolt
@CyReVolt 8 ай бұрын
Well done! 🥳 It's so cool to see the community succeed together. Also I know that today is a holiday. I expect a breakthrough later tonight. :D Cheers ausm Pott! :)
@duckydude20
@duckydude20 8 ай бұрын
so facinated by you guys. its my dream to do something like this someday. but i lack so much in everything...
@pikniknyok9203
@pikniknyok9203 8 ай бұрын
omg i never think usb c so complex like this 😮 thanks mate for the video
@StormBurnX
@StormBurnX 8 ай бұрын
Excellent work. I was curious how long it would be, since the Macbooks and iPads are M1/etc rather than A-series chips. Quite interesting all the same!
@TheTarrMan
@TheTarrMan 8 ай бұрын
Awesome work you guys are doing.
@bekircandal3528
@bekircandal3528 8 ай бұрын
dude that was awesome. cant wait for another videos!
@Eaton.
@Eaton. 8 ай бұрын
i barely understand this stuff but im forever interested and grateful for the work you put in discovering these things.
@f.d.9326
@f.d.9326 8 ай бұрын
Insane stuff man! I wonder how one can know so much!
@vassoharalambous5982
@vassoharalambous5982 8 ай бұрын
This is brilliant work!! Bravoo
@deez6005
@deez6005 8 ай бұрын
I love your channel. Keep up the good work
@rickoneill4343
@rickoneill4343 8 ай бұрын
Just joined the channel. Can't wait to see what you have been up to!
@nicknorthcutt7680
@nicknorthcutt7680 4 ай бұрын
Wow you are seriously talented, very interesting man!
@thomasandrews9355
@thomasandrews9355 8 ай бұрын
LOL lot of comments which seem to have the "oh iphone owned" vibe... great work as Always
@NeverGiveUpYo
@NeverGiveUpYo 8 ай бұрын
Yes! What a video! Thanks for this!!
@imawesome580
@imawesome580 8 ай бұрын
I jtaged my xbox off youtube tuttorials so this is extremely interesting and I hope you get the Jtag!
@justHeisen
@justHeisen 8 ай бұрын
I am very interested in these kinds of videos.
@user-lo4er8wy9l
@user-lo4er8wy9l 8 ай бұрын
fantastic work.
@hyperkiko
@hyperkiko 8 ай бұрын
FINALLY, a new video!!!!
@prateekSpace
@prateekSpace 8 ай бұрын
very in-depth video! get new subscriber 🎉
@Unbaguettable
@Unbaguettable 8 ай бұрын
I understood absolutely nothing but looked interesting, cool video
@randallbro6749
@randallbro6749 8 ай бұрын
Nice didn't think it was possible
@RazgrizDuTTA
@RazgrizDuTTA 8 ай бұрын
Hardware hacking is so fun! I have never done things that complex but even small hacks are fun!
@MediaCollection
@MediaCollection 8 ай бұрын
Love the zappa reference👌🏼
@stacksmashing
@stacksmashing 8 ай бұрын
Which Zappa reference? 😅 you are the second person mentioning it
@MediaCollection
@MediaCollection 8 ай бұрын
@@stacksmashing “The Central Scrutinizer”
@stacksmashing
@stacksmashing 8 ай бұрын
Ahhhhh thank you
@jsandppr
@jsandppr 8 ай бұрын
Love the Zappa reference!
@stacksmashing
@stacksmashing 8 ай бұрын
Which one? 😅
@lucasimark7992
@lucasimark7992 8 ай бұрын
Oh wow, that was nice!
@betogamer08
@betogamer08 8 ай бұрын
Good work!
@v1x4z
@v1x4z 8 ай бұрын
Pretty neat stuff!
@BAAAM101
@BAAAM101 8 ай бұрын
Amazing work. I’d like to see if youre able to jtag the new iPad with usb c. It offers more features with the usb port than the iPhone so you just might get a different result
@xenozelda0102
@xenozelda0102 8 ай бұрын
Awesome man!
@WhoaMykey
@WhoaMykey 8 ай бұрын
Tim Cook is filthy rich and needs no breaks! This needs to happen for research and repair purposes! To the people! Bless you for your hard work! I thank you 🙏
@vxrlorxnxrreal
@vxrlorxnxrreal 8 ай бұрын
sehr interessantes video!
@hanspeter24
@hanspeter24 8 ай бұрын
stacksmashing the best!!!
@piholino
@piholino 8 ай бұрын
I have no idea what the hell you are doing but it was interesting to watch.
@johnnykernel4557
@johnnykernel4557 8 ай бұрын
Amazing work done!
@ArthurKhazbs
@ArthurKhazbs 8 ай бұрын
Good luck exploring the possibilities hidden inside the fruits of this corporation!
@iamfinky
@iamfinky 8 ай бұрын
Very exciting! I'd be interested to know what is possible with JTAG.
@csbluechip
@csbluechip 8 ай бұрын
JTAG generally: You get direct control of the CPU, so your imagination is the limit... Specifically here: Who knows how open/crippled it is yet ;)
@dhruvgulati1667
@dhruvgulati1667 8 ай бұрын
Hey could you please explain more about debugging and exploiting.
@ACiDFiRE
@ACiDFiRE 8 ай бұрын
Cool keep grinding lad
@kwiky5643
@kwiky5643 8 ай бұрын
Great stuff
@Magnom365
@Magnom365 8 ай бұрын
You are quick!
@jarredallen
@jarredallen 8 ай бұрын
its not uncommon ( for my line of work) to see a jtag locked physically. maybe this is the case right here. some pull up resistor to some pads might be needed.
@stacksmashing
@stacksmashing 8 ай бұрын
Ah in this case it's a bit more complicated - you can read up on the demotion of the iPhone X using checkm8 :)
@ishdemon_
@ishdemon_ 8 ай бұрын
man's voice evolved around 6:48 lmao
@kritikusi-666
@kritikusi-666 8 ай бұрын
this is awesome.
@ErtugrulOzdemir-mf1gl
@ErtugrulOzdemir-mf1gl 8 ай бұрын
really cool!
@XCTDEV
@XCTDEV 8 ай бұрын
Already knew it! but may brick after flash Jtag
@filipenicoli_
@filipenicoli_ 8 ай бұрын
Amazing!
@shortgrowinchannel101
@shortgrowinchannel101 8 ай бұрын
My dream iphone😊
@atinder2006
@atinder2006 8 ай бұрын
When they added usb c and controller embedded into cpu i had feeling they are already worried about security.
@Marvinzock34
@Marvinzock34 8 ай бұрын
YOOOO NEW VIDEO
@limebulls
@limebulls 8 ай бұрын
What do you recommend for beginners to start learning electronics?
@nilsmertens6253
@nilsmertens6253 8 ай бұрын
Nice, keep going
@2.7petabytes
@2.7petabytes 8 ай бұрын
Zappa would be proud 😂
@jameshatton4405
@jameshatton4405 8 ай бұрын
This is so awesome. I would really like to be able to use hardware hacking as a business? So if you can get JTAG to iPhone 15, does that mean that the boot loader can be reverse engineered and the iPhone could essentially run non-apple or customised firmware?
@sol_xz
@sol_xz 8 ай бұрын
imagine this on ipad with windows for arm
@overPowerPenguin
@overPowerPenguin 8 ай бұрын
​​@@sol_xzthis is not how it works. You need Windows drivers and a lot of patches to make everything run, even if you can load an custom EFI boot. It's insane amount of work and don't worth it, because, in the end, it's cheaper and faster to buy an Windows tablet that probably supports also Linux.
@gamerstar8311
@gamerstar8311 8 ай бұрын
Cool stuff
@HoZyVN
@HoZyVN 8 ай бұрын
Amazing
@dcfix35
@dcfix35 8 ай бұрын
Excellent ✅✅
@JonMasters
@JonMasters 8 ай бұрын
Excellent
@jameshatton4405
@jameshatton4405 8 ай бұрын
I see you've done this with the iPhone 15, but I'm curious if JTAG can be found a similar way on Samsung Galaxy devices and if one could possibly access the KNOX e-fuse data store on a galaxy device? So essentially if the Knox bit has been tripped; that section in the boot loader can be reversed? This is currently the only thing stopping me from going to GraphineOS and being able to support encryption and have as much support with the boot loader security as say a supported Pixel device?
@trevorgray3681
@trevorgray3681 8 ай бұрын
I don't remember much about it and doubt it's relevant anymore, but I remember being able to not trip knox on my s6 edge. I'm sure whatever exploit was there has been fixed though.
@jameshatton4405
@jameshatton4405 8 ай бұрын
@@trevorgray3681 I would like to reverse the boot loader and how it trips the Knox because it's an implementation that's still in practice today? I've built ROMs and custom firmware for Android and have bucket loads of tools for just about any kind i of hacking and reversing software known? I've also got experiencing dumping binaries by direct chip reading and FlashROM using raspberry Pi SPI interface + voltage changer and read from diagnostic ports on MacBooks etc. Then Hex hacking the dumped binary and then writing my own stuff back on it to unblock a forgotten password? I can find out the voltages etc but if I could possibly talk between his created device and using USB-C then I can certainly attempt to play around? Have a little snoop & sniff and see what's up yo? See it could mean I could possibly make any Samsung a private phone like the Google Pixel with GrapheneOS. I can already rebuild and change the GrapheneOS to work on my Samsung or any Samsung even if the firmware doesn't support it? I know what partitions to write to, I can build a custom recovery. I can impart binaries etc etc and get what ever I need working? It's the being able to support encryption from recovery that is the most important? So it's worth sniffing even if not for Knox? It's just more enticing to offer should anyone be interested in using their Samsung as a private phone without needing to purchase a Pixel to so? In Australia Pixels are for fanatics and people who purchased it outright with money and not on a plan? That's a very very tiny slice of the Australian market unfortunately? Sorry but I figured I may as well spew my thoughts all over the KZfaq comments cause I'm Autistic as fuck and have narcolepsy and you've got me on a medication is working don't know where to stop moment? So sucks to you if you've read this far 😛
@eyesoffloraandfauna8728
@eyesoffloraandfauna8728 8 ай бұрын
Make videos for best sideload method
@jerromerro9405
@jerromerro9405 8 ай бұрын
Good to know that you didnt finish the work , i have to know that checkm8 didnt work on the “newer“ iphones But i thought for the Usb-c “problem“ on the TamarinCable FW where only changing the cables and changing some code .. ok Its Not so easy But on iPhone 15 swd is Open i think thats a good Start ..
@timboffff
@timboffff 8 ай бұрын
amazing work
@robertclarkguitar
@robertclarkguitar 8 ай бұрын
Nice. ❤😮
@ivoxii
@ivoxii 8 ай бұрын
The way you say macbook is the same as the "city people" episode in south park 😂😂😂
@stacksmashing
@stacksmashing 8 ай бұрын
Bahahaha 🤣
@cleardd
@cleardd 8 ай бұрын
Very cool
@SneakyCaleb
@SneakyCaleb 8 ай бұрын
What does this allow you to do ? I only know the word jtag from the 360 days.
@Freedom-of-Thought
@Freedom-of-Thought 8 ай бұрын
Can you teach how to jailbreak iOS 17? Thank you
@H8RSAPPRECIATE
@H8RSAPPRECIATE 8 ай бұрын
I know you said it’s not a exploit but I realized once they switched to USB C I assumed it might make it easier for someone to find a exploit that way and since you can connect to more devices than with a lightning cable ( not saying I know anything or claiming to be a expert)
@alvarotorijano
@alvarotorijano 7 ай бұрын
Upload more videos!!!
@Phrew
@Phrew 8 ай бұрын
Seen this video before it was cool. ;)
@RafaelScarpa
@RafaelScarpa 8 ай бұрын
Huh... Interesting.
@quintravyouskyng
@quintravyouskyng 8 ай бұрын
6min ago 242 views for me.
@jerromerro9405
@jerromerro9405 7 ай бұрын
I have a Short question , i Hope for an answer . The iPhone15 has 5g Right? Can i use this for sniffing 5g packets like osmocombb for gsm??
@mattsold1267
@mattsold1267 8 ай бұрын
What do you need to study to learn all this stuff? The automotive field is heavy on this type technology and I want to get be able to heavily study these systems but there isn’t enough info online?? Some pls respond
@elbert5208
@elbert5208 8 ай бұрын
It's a secretive field
@NewGroup78
@NewGroup78 8 ай бұрын
How and where do we learn hardware hacking and all these things?? please tell me.
@kdtoystore7341
@kdtoystore7341 8 ай бұрын
I love how he says “Central Scrutinizer” 😅
@stacksmashing
@stacksmashing 8 ай бұрын
Am I mispronouncing it? :D
@AngelaTheSephira
@AngelaTheSephira 2 ай бұрын
@@stacksmashing No, you're doing it right. (At least, to an American who's heard a hell of a lot of accents and pronunciations.) No clue what he's on about.
@NieuNotNew
@NieuNotNew 8 ай бұрын
thats huge, the central scrutinizer. that pcbs purpose is to enforce all the laws that havent been passed yet
@bloodaid
@bloodaid 8 ай бұрын
Is it possible to send data from an app to the JTAG with this?
@jtw-r
@jtw-r 8 ай бұрын
I heard initial rumours (months before apple confirmed the USB C port), that they were going to REMOVE the charging port entirely. I rolled my eyes at that - am I correct in assuming some physical port is always required for JTAG or whatever diagnostics apple uses? For device security, it seems like you’d always want that to be a physical connection-right?
@stacksmashing
@stacksmashing 8 ай бұрын
I think on some of the newer Apple Watches they use some very high-frequency communication instead of contacts - so potentially they can get rid of it. But it would kill low-latency audio, high-speed storage etc
@saschakaupp
@saschakaupp 8 ай бұрын
I think at least the pro models will have USB-C for a long time, as they can now record video to external SSDs.
@ameliabuns4058
@ameliabuns4058 8 ай бұрын
It's certainly possible but it'd suck. Plus they could have contact pins on the phone I guess? But I highly doubt it'll happen on the pro models
@saschakaupp
@saschakaupp 8 ай бұрын
@@ameliabuns4058 As long as the contact pins are inside a USB-C socket, I'm happy. :)
@phr3ui559
@phr3ui559 8 ай бұрын
@@stacksmashing oh
@KpFriendly
@KpFriendly 8 ай бұрын
It’s so simple I’m completely able to follow this with 5 years of experience Jk This stuff seems really complicated but interesting, as someone getting into cyber security, you definitely got me more interested in the hardware side of it all, I learned alot from this video!
@b_1337
@b_1337 8 ай бұрын
You’re awesome
@randykitchleburger2780
@randykitchleburger2780 8 ай бұрын
Sweet
@ajmalaboobacker5110
@ajmalaboobacker5110 8 ай бұрын
Is he tree available for sign up?
@aacc8466
@aacc8466 8 ай бұрын
is this a way to retrieve a lost password/iCloud ? asking for a friend
@Malibuthe6th
@Malibuthe6th 8 ай бұрын
Topic aside the presentation is good but I had to turn on subtitles
@stacksmashing
@stacksmashing 8 ай бұрын
Thank you - was the voice not clear enough for you? Too fast? Happy to learn what I can improve!
@Malibuthe6th
@Malibuthe6th 8 ай бұрын
@@stacksmashing Too fast, slow down by ~10%.
@SlavGee
@SlavGee 8 ай бұрын
Cool!
@lauaall
@lauaall 7 ай бұрын
insane
@YHK_YT
@YHK_YT 8 ай бұрын
You have to put the lightning port back
@hydro5168
@hydro5168 8 ай бұрын
will this let me get a mod menu for Black Ops 2?
@kipchickensout
@kipchickensout 8 ай бұрын
Will 0xT have a free trial?
@jerm_
@jerm_ 8 ай бұрын
so whats possible with JTAG? is it similar to jailbreak?
@zackaria
@zackaria 8 ай бұрын
This is really intresting to see. Do you think you can do TMSC For JTAG?
@stacksmashing
@stacksmashing 8 ай бұрын
SWD doesn't need TMSC - or what do you mean?
@zackaria
@zackaria 8 ай бұрын
@@stacksmashing I thought the reduced JTAG wire uses a wire for TMSC?
@stacksmashing
@stacksmashing 8 ай бұрын
@@zackariaNah, just clock and IO :)
@zackaria
@zackaria 8 ай бұрын
@@stacksmashing Oh alright
@zackaria
@zackaria 8 ай бұрын
@@stacksmashing Dang it i just realized that too
@gabriledyt
@gabriledyt 8 ай бұрын
Maybe a new full jailbreak after this?
Which one of them is cooler?😎 @potapova_blog
00:45
Filaretiki
Рет қаралды 3,3 МЛН
A pack of chips with a surprise 🤣😍❤️ #demariki
00:14
Demariki
Рет қаралды 33 МЛН
Backstage 🤫 tutorial #elsarca #tiktok
00:13
Elsa Arca
Рет қаралды 37 МЛН
Apple Log on iPhone is Not a Gimmick
10:07
ZY Cheng
Рет қаралды 480 М.
37C3 -  Apple's iPhone 15: Under the C
36:26
media.ccc.de
Рет қаралды 41 М.
SHODAN Explained! (It's Scary Easy to do) | Let's Hack
7:58
Let's Hack
Рет қаралды 8 М.
Apple's iOS 18 Leaks iPhone 16!
10:49
The Apple Circle
Рет қаралды 164 М.
Can an AI drive Mario Kart 64?
8:11
stacksmashing
Рет қаралды 87 М.
How the Apple AirTags were hacked
8:38
stacksmashing
Рет қаралды 1,6 МЛН
Apple M3, M3 Pro & M3 Max - Chip Analysis
20:13
High Yield
Рет қаралды 329 М.
Extracting Firmware from Embedded Devices (SPI NOR Flash) ⚡
18:41
Flashback Team
Рет қаралды 540 М.
What Nobody Tells You About the iPhone 15 Pro Max
11:50
kwoknation
Рет қаралды 249 М.
researchers find unfixable bug in apple computers
8:32
Low Level Learning
Рет қаралды 699 М.
Apple watch hidden camera
0:34
_vector_
Рет қаралды 61 МЛН
TOP-18 ФИШЕК iOS 18
17:09
Wylsacom
Рет қаралды 666 М.
APPLE совершила РЕВОЛЮЦИЮ!
0:39
ÉЖИ АКСЁНОВ
Рет қаралды 599 М.
i like you subscriber ♥️♥️ #trending #iphone #apple #iphonefold
0:14
5 НЕЛЕГАЛЬНЫХ гаджетов, за которые вас посадят
0:59
Кибер Андерсон
Рет қаралды 1,5 МЛН