ipod_sun icon indicating copy to clipboard operation
ipod_sun copied to clipboard

What is required for the port on Nano 7(not refresh)

Open platinumstufff opened this issue 1 year ago • 12 comments

platinumstufff avatar Aug 31 '24 19:08 platinumstufff

There aren't a lot of differences between the og n7g and the refresh, the only real difference is the different firmware versions. The only reason I didn't add it is I don't have an og to test on and you would need both (To use the decryption payload with a n7g refresh to decrypt the og's firmware). I could try adding it without testing if someone else could test it.

All that would be needed is:

  • Add the download links and model to the cli
  • Decrypt the firmware
  • Unpack and RE the firmware to find the offset of the SCSI handlers and create an exploit config for it

CUB3D avatar Sep 15 '24 02:09 CUB3D

Thank you for your answer. If you port it to og nano 7 I can test it. I really want to decrypt firmware.

platinumstufff avatar Sep 16 '24 04:09 platinumstufff

Also is it possible to make a tool just to replace rsrs partition and do a disk swap trick?

platinumstufff avatar Sep 16 '24 17:09 platinumstufff

I've pushed up experimental support for the nano7 2012 here: https://github.com/CUB3D/ipod_sun/tree/nano7_2012 I can confirm that the final 1.0.4 firmware from the old nano can be decrypted by a new one and it looks almost identical so I'm relatively confident this should work.

I'm probably not going to add support for pure rsrc swapping myself, the un/packing code is brittle from what I remember and would probably need a bit of work to make usable (plus I'm more interested in fully replacing the ipod software than patching it). But if someone adds support for it I've got no problem with merging it.

CUB3D avatar Sep 27 '24 00:09 CUB3D

Thank you. I will test it soon

platinumstufff avatar Sep 27 '24 07:09 platinumstufff

std::fs::write(&format!("./tmp-{:?}.bin", name.iter().rev().map(|s| *s as char).collect::<String>()), section_data).unwrap(); what this line do? it fails on windows. Previos versions of ipod sun works perfectly.

platinumstufff avatar Sep 27 '24 16:09 platinumstufff

Then i comented it and it seems to replace the font

platinumstufff avatar Sep 27 '24 16:09 platinumstufff

std::fs::write(&format!("./tmp-{:?}.bin", name.iter().rev().map(|s| *s as char).collect::<String>()), section_data).unwrap(); what this line do? it fails on windows. Previos versions of ipod sun works perfectly.

Oops, that's not supposed to be there, I've pushed up a commit to remove it.

Then i comented it and it seems to replace the font

Did you try installing it? If it boots fine then the firmware patching works, maybe try the bootrom dumping steps to prove the actual exploit worked as well

CUB3D avatar Sep 29 '24 02:09 CUB3D

Did you try installing it?

Yes, I installed it and found a changed font. I not sure that ipod_sun scripts gonna work on Windows.

platinumstufff avatar Sep 29 '24 15:09 platinumstufff

thread 'main' panicked at src/main.rs:47:48: called Result::unwrap()on anErrvalue: Os { code: 2, kind: NotFound, message: "No such file or directory" } stack backtrace: 0: rust_begin_unwind at /build/rustc-ntAYxy/rustc-1.75.0+dfsg0ubuntu1/library/std/src/panicking.rs:645:5 1: core::panicking::panic_fmt at /build/rustc-ntAYxy/rustc-1.75.0+dfsg0ubuntu1/library/core/src/panicking.rs:72:14 2: core::result::unwrap_failed at /build/rustc-ntAYxy/rustc-1.75.0+dfsg0ubuntu1/library/core/src/result.rs:1653:5 3: scsi_dumper::main note: Some details are omitted, run withRUST_BACKTRACE=full for a verbose backtrace. 00:00:00 1 / 128 [## ] 1% ETA 00:00:07 it doesnt work. also is /dev/sdc is ipod drive in sudo sg_raw -o /dev/null -r 512 -vvv /dev/sdc c6 96 04 00 00 00 00 ?

platinumstufff avatar Sep 29 '24 16:09 platinumstufff

I had some issues with GitHub and my issue disappeared.

platinumstufff avatar Oct 08 '24 14:10 platinumstufff

?

platinumstufff avatar Oct 22 '24 21:10 platinumstufff