Giulio Zompetti on Twitter: "10/ (and final) if you are looking for refurbished probes for an accessible price feel free to DM me #checkm8… "

Country	Code	For customers of
United States	40404	(any)
Canada	21212	(any)
United Kingdom	86444	Vodafone, Orange, 3, O2
Brazil	40404	Nextel, TIM
Haiti	40404	Digicel, Voila
Ireland	51210	Vodafone, O2
India	53000	Bharti Airtel, Videocon, Reliance
Indonesia	89887	AXIS, 3, Telkomsel, Indosat, XL Axiata
Italy	4880804	Wind
3424486444	Vodafone
» See SMS short codes for other countries

Giulio Zompetti‏ @1nsane_dev 28 Sep 2019

@axi0mX’s #checkm8 is out and let’s you debug your device (up to A11). But how is this done? Here is a little thread on dumping the bootrom (SecureROM) on demoted devices with Apple’s official tools. 1/ connect the cable using the correct lighting orientation and launch astrispic.twitter.com/00FSJHJVup

10 replies 123 retweets 425 likes

Show this thread

Giulio Zompetti‏ @1nsane_dev 28 Sep 2019

2/ select the CPU you want to work on (in this case, we’ll select CPU0) and halt it. As result, astris will provide the output containing the selected CPU’s registers with their content. We can now use the debugger to copy the content from the memory regionpic.twitter.com/bb4khh8HNQ

1 reply 6 retweets 59 likes

Show this thread

Giulio Zompetti‏ @1nsane_dev 28 Sep 2019

3/ use the command ‘save’ followed by the destination filename on the host, the address of the SecureROM and the size of the desired region to be copied (512kb are enough)pic.twitter.com/xacWvEj8cm

2 replies 5 retweets 54 likes

Show this thread

Giulio Zompetti‏ @1nsane_dev 28 Sep 2019

4/ you should now have your file saved into the destination you entered in the command. Note, in case you didn’t specify a path along with the filename, astris will save the file into your currently working directory. Find it and open it (HEX) and you should see it as follows:pic.twitter.com/WmklDl4Ynk

1 reply 4 retweets 62 likes

Show this thread

Giulio Zompetti‏ @1nsane_dev 28 Sep 2019

Giulio Zompetti Retweeted ForestCorgi

5/ You can easily find Probes and software on Twitter. As a reference, you can check this post for Apple’s official softwares (which work only with their own probes). Otherwise check bonobo as an alternative.https://twitter.com/forestcorgi/status/1177819785322795008?s=21 …

Giulio Zompetti added,

This Tweet from @ForestCorgi has been withheld in response to a report from the copyright holder. Learn more

1 reply 4 retweets 43 likes

Show this thread

Giulio Zompetti‏ @1nsane_dev 28 Sep 2019

Giulio Zompetti Retweeted Giulio Zompetti

6/ Debugger like Kong and Kanzi (as well as SNR, with some little patching on an astris daemon) can work absolutely good for any supported lightning device. I recommend to install Tigris Tools (15A) from the previous link if you have one of these.https://twitter.com/1nsane_dev/status/1116658070283784193?s=21 …

Giulio Zompetti added,

Giulio Zompetti @1nsane_dev

The technology behind #Apple Probes is really interesting. Serial Wire Debuggers: #KanziSWD #KongSWD #GorillaSWD #AppleInternal #Development pic.twitter.com/QrIISFgWNN

2 replies 6 retweets 49 likes

Show this thread

Giulio Zompetti‏ @1nsane_dev 28 Sep 2019

Giulio Zompetti Retweeted john

7/ You can find useful informations about this technology in this thread below. For what my little experience makes possible, feel free to ask any detail and I’ll do my best to help you out.https://twitter.com/nyan_satan/status/1090989650280398849?s=21 …

Giulio Zompetti added,

john @nyan_satan

I was planning to keep this knowledge private, but damn it. This is a thread about Apple SWD cables, some things they can do and how to use them pic.twitter.com/nhZO6JPC9T

Show this thread

1 reply 5 retweets 44 likes

Show this thread

Giulio Zompetti‏ @1nsane_dev 28 Sep 2019

8/ I used a development device to dump the SecureROM as an example of astris usage, note that the probe is not required to achieve this with the exploit publicly released, as you can use a normal lightning cable.

1 reply 2 retweets 32 likes

Show this thread

Giulio Zompetti‏ @1nsane_dev 28 Sep 2019

9/ here is an example of astris view before and after demotion. #checkm8 enabled successfully the debugging and the devices now expose AP to JTAGpic.twitter.com/mbbw8k5qtX