{"id":875,"date":"2007-11-03T08:30:00","date_gmt":"2007-11-02T23:30:00","guid":{"rendered":"http:\/\/amegan.com\/blogwp\/?p=875"},"modified":"2010-04-09T09:36:11","modified_gmt":"2010-04-09T17:36:11","slug":"003940","status":"publish","type":"post","link":"https:\/\/amegan.com\/blog\/mtarchives\/003940.html","title":{"rendered":"iPhone\/iPod touch \u306e jailbreak (TIFF exploit) \u89e3\u8aac"},"content":{"rendered":"

\u3061\u3087\u3063\u3068\u524d\u3001iPhone\/iPod touch \u306eTIFF\u8106\u5f31\u6027\u3092\u7a81\u304f\u305f\u3081\u306e\u753b\u50cf\u3092\u751f\u6210\u3059\u308b\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u304c\u516c\u958b\u3055\u308c\u305f\u3002
\n\u3069\u3093\u306a\u3082\u3093\u3060\u308d\u3046\u3068\u3061\u3087\u3063\u3068\u898b\u3066\u307f\u305f\u3089\u610f\u5916\u306b\u30b7\u30f3\u30d7\u30eb\u3067\u3073\u3063\u304f\u308a\u3002<\/p>\n

http:\/\/www.toc2rta.com\/?q=node\/30<\/a>
\nhttp:\/\/www.toc2rta.com\/files\/itiff_exploit.cpp<\/a><\/p>\n

\u8208\u5473\u304c\u6e67\u3044\u305f\u306e\u3067\u5468\u8fba\u306e\u60c5\u5831\u3082\u542b\u3081\u5c11\u3057\u8abf\u3079\u3066\u307f\u305f\u3089\u3001\u30cf\u30c3\u30ab\u30fc\u305f\u3061\u306e\u82e6\u52b4\u3082\u77e5\u308b\u3053\u3068\u304c\u3067\u304d\u3066\u3068\u3063\u3066\u3082\u9762\u767d\u304b\u3063\u305f\u3002
\n\u305b\u3063\u304b\u304f\u3060\u3063\u305f\u306e\u3067\u307e\u3068\u3081\u3066\u307f\u305f\u3044\u3068\u601d\u3046\u3002<\/p>\n

\u304b\u306a\u308a\u9577\u304f\u3066\u3001\u6280\u8853\u7684\u306a\u8a71\u306b\u306a\u3063\u3066\u3057\u307e\u3063\u305f\u3002 \u9000\u5c48\u304b\u3082\u3057\u308c\u306a\u3044\u3051\u3069\u3088\u304b\u3063\u305f\u3089\u304a\u4ed8\u304d\u5408\u3044\u304f\u3060\u3055\u3044\u3002<\/p>\n

<\/p>\n

iPhone\/iPod touch \u306e jailbreak \u3068\u306f<\/h3>\n

\u307e\u305a\u6700\u521d\u306b iPhone\/iPod touch \u306e jailbreak \u306e\u4e00\u822c\u7684\u306a\u8a71\u3002 iPhone\/iPod touch \u306f\u3042\u306e\u5c0f\u3055\u306a\u30c7\u30d0\u30a4\u30b9\u306e\u4e2d\u306b\u30b9\u30b1\u30fc\u30eb\u30c0\u30a6\u30f3\u3057\u305f Mac OS X\u3001\u6b63\u3057\u304f\u306f Mac \u3058\u3083\u306a\u3044\u306e\u3067 “OS X” \u304c\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3055\u308c\u52d5\u4f5c\u3057\u3066\u3044\u308b\u3002 \u591a\u6a5f\u80fd\u306a OS X \u3060\u304c\u3001Apple \u306f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u91cd\u8996\u3057\u4eca\u306e\u3068\u3053\u308d\u30e6\u30fc\u30b6\u304c\u597d\u304d\u306a\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u306a\u3044\u3088\u3046\u306b\u3057\u3066\u3044\u308b\u3002(2008\u5e74 2\u6708\u306b\u516c\u5f0f\u306aSDK (\u958b\u767a\u30c4\u30fc\u30eb) \u304c\u516c\u958b\u3055\u308c\u308b\u3053\u3068\u304c\u5148\u65e5\u767a\u8868\u306b\u306a\u3063\u305f)<\/p>\n

\u305d\u3093\u306a Apple \u306e\u5bfe\u5fdc\u304c\u6c17\u306b\u5165\u3089\u306a\u3044\u4e00\u90e8\u306e\u30e6\u30fc\u30b6\u304c\u3001iPhone\/iPod touch \u3092\u52dd\u624b\u306b\u8abf\u3079\u307e\u304f\u308a\u3001\u3068\u3046\u3068\u3046\u597d\u304d\u306a\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u65b9\u6cd5\u3092\u767a\u898b\u3002 Apple \u306b\u81ea\u7531\u3092\u596a\u308f\u308c\u305f iPhone\/iPod touch \u3092\u89e3\u653e\u3059\u308b\u3068\u3044\u3046\u610f\u5473\u304b\u3089\u3001\u3053\u306e\u65b9\u6cd5\u306f jailbreak (\u8131\u7344) \u3068\u547c\u3070\u308c\u308b\u3088\u3046\u306b\u306a\u3063\u305f\u3002<\/p>\n

\u5f53\u521d\u306e jailbreak \u306f iPhone \u306e\u30ea\u30b9\u30c8\u30a2\u7528\u306e\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u306e\u6697\u53f7\u3092\u7834\u308a\u3001\u30d5\u30a1\u30a4\u30eb\u3092\u66f8\u304d\u63db\u3048\u305f\u3042\u3068\u306b\u30c7\u30d0\u30a4\u30b9\u306b\u30ea\u30b9\u30c8\u30a2\u3059\u308b\u3068\u3044\u3046\u65b9\u6cd5\u304c\u4f7f\u308f\u308c\u3066\u3044\u305f\u304c\u3001iPod touch \u3067\u306f\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u306e\u6697\u53f7\u304c\u5909\u308f\u3063\u305f\u305f\u3081\u3001\u5c11\u306a\u304f\u3068\u3082\u518d\u3073\u6697\u53f7\u3092\u7834\u308b\u307e\u3067\u306e\u9593\u306f jailbreak \u306f\u96e3\u3057\u3044\u3068\u3055\u308c\u3066\u3044\u305f\u3002<\/p>\n

iPhone\/iPod touch \u306e TIFF \u8106\u5f31\u6027<\/h3>\n

\u305d\u3093\u306a\u4e2d\u3001iPod touch \u3084 iPhone \u304c\u4f7f\u7528\u3057\u3066\u3044\u308b\u753b\u50cf\u8868\u793a\u7528\u306e\u30e9\u30a4\u30d6\u30e9\u30ea libtiff \u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u304c\u53e4\u304f\u3001\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u30d0\u30b0\u304c\u6b8b\u3063\u3066\u3044\u308b\u3053\u3068\u304c\u767a\u898b\u3055\u308c\u305f\u3002 \u3053\u306e\u30d0\u30c3\u30d5\u30a1\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027\u306fPSP (\u30d7\u30ec\u30b9\u30c6\u30dd\u30fc\u30bf\u30d6\u30eb) \u3092\u30cf\u30c3\u30af\u3059\u308b\u3068\u304d\u306b\u3082\u4f7f\u308f\u308c\u3066\u3044\u3066\u3001iPhone\/iPod touch \u3067\u3082\u540c\u3058\u3088\u3046\u306b\u3067\u304d\u308b\u3093\u3058\u3083\u306a\u3044\u304b\u3068\u8a00\u308f\u308c\u308b\u3088\u3046\u306b\u306a\u3063\u305f\u3002<\/p>\n

\u305d\u3053\u3067\u3044\u308d\u3044\u308d\u8abf\u3079\u3066\u3067\u304d\u3042\u304c\u3063\u305f\u306e\u304c\u4eca\u56de\u306e jailbreak \u306e\u65b9\u6cd5\u3002
\n(jailbreak \u306e\u624b\u9806\u306b\u95a2\u3057\u3066\u306f\u3053\u3053\u3067\u306f\u89e6\u308c\u306a\u3044\u306e\u3067 Google \u3055\u3093\u306b\u3067\u3082\u805e\u3044\u3066\u307f\u3066)<\/p>\n

\u307e\u305a\u306fTIFF\u30d5\u30a9\u30fc\u30de\u30c3\u30c8\u306e\u6982\u8981\u3068\u3001\u8106\u5f31\u6027\u306e\u8aac\u660e\u3092\u3002<\/p>\n

TIFF \u30d5\u30a9\u30fc\u30de\u30c3\u30c8\u306f\u30d5\u30a1\u30a4\u30eb\u30d8\u30c3\u30c0\u306e\u3042\u3068\u306b\u753b\u50cf\u306e\u5e45\u3084\u9ad8\u3055\u306a\u3069\u306e\u60c5\u5831\u3092\u683c\u7d0d\u3057\u305fIFD (Image File Directory) \u3068\u547c\u3070\u308c\u308b\u30a8\u30f3\u30c8\u30ea\u304c\u4e26\u3073\u3001\u305d\u3053\u3067\u753b\u50cf\u306e\u5e45\u3084\u9ad8\u3055\u3068\u3044\u3063\u305f\u60c5\u5831\u304c\u683c\u7d0d\u3055\u308c\u308b\u3002IFD\u306e\u305d\u308c\u305e\u308c\u306e\u30a8\u30f3\u30c8\u30ea\u306f12\u30d0\u30a4\u30c8\u56fa\u5b9a\u3067\u3001\u3053\u3093\u306a\u69cb\u9020\u306b\u306a\u3063\u3066\u3044\u308b\u3002<\/p>\n

0 +----------------------------+\r\n  |      IFD \u30bf\u30b0(2 byte)       |\r\n2 +----------------------------+\r\n  |  \u30d5\u30a3\u30fc\u30eb\u30c9\u30bf\u30a4\u30d7 (2 byte)      |\r\n4 +----------------------------+\r\n  |  \u5024 or \u30c7\u30fc\u30bf\u30b5\u30a4\u30ba (4 byte)  |\r\n8 +----------------------------+\r\n  |     \u30aa\u30d5\u30bb\u30c3\u30c8\u5024 (4 byte)     |\r\n11+----------------------------+<\/pre>\n
8\u30d0\u30a4\u30c8\u304b\u308911\u30d0\u30a4\u30c8\u76ee\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u5024\u306f\u30014\u30d0\u30a4\u30c8\u3067\u53ce\u307e\u3089\u306a\u3044\u3088\u3046\u306a\u30c7\u30fc\u30bf\u3092\u51e6\u7406\u3059\u308b\u3068\u304d\u306b\u4f7f\u308f\u308c\u3001\u30c7\u30fc\u30bf\u306e\u30d5\u30a1\u30a4\u30eb\u5148\u982d\u304b\u3089\u306e\u30a2\u30c9\u30ec\u30b9(\u30aa\u30d5\u30bb\u30c3\u30c8)\u3092\u793a\u3057\u3066\u3044\u308b\u3002(\u3053\u306e\u3068\u304d\u30014-7\u30d0\u30a4\u30c8\u76ee\u306b\u30c7\u30fc\u30bf\u30b5\u30a4\u30ba\u304c\u683c\u7d0d\u3055\u308c\u3066\u3044\u308b\u3002) <\/p>\n
\u30c7\u30fc\u30bf\u304c\u76f4\u63a5IFD\u30a8\u30f3\u30c8\u30ea\u5185\u306b\u683c\u7d0d\u3055\u308c\u3066\u3044\u308b\u304b\u3001\u30aa\u30d5\u30bb\u30c3\u30c8\u5148\u306b\u683c\u7d0d\u3055\u308c\u3066\u3044\u308b\u304b\u306fIFD\u30bf\u30b0\u3067\u793a\u3055\u308c\u308b\u60c5\u5831\u306e\u7a2e\u985e\u306b\u3088\u3063\u3066\u6c7a\u307e\u308b\u3002<\/p>\n
\u77ed\u3044\u3051\u3069 jailbreak \u306b\u95a2\u3057\u3066\u5fc5\u8981\u306a\u60c5\u5831\u306f\u3053\u308c\u3050\u3089\u3044\u304b\u306a\u3002<\/p>\n
\u3082\u3046\u5c11\u3057\u8a73\u3057\u304f\u77e5\u308a\u305f\u3044\u4eba\u306f\u30b3\u30c1\u30e9\u306e\u30da\u30fc\u30b8<\/a> (IFD \u304c\u5168\u90e8 IDF \u3068\u66f8\u304b\u308c\u3066\u308b\u3051\u3069…) \u3084 Adobe \u306e\u30b5\u30a4\u30c8\u306b\u3042\u308b\u4ed5\u69d8\u66f8\u306ePDF<\/a> \u3067\u3082\u898b\u3066\u6b32\u3057\u3044\u3002<\/p>\n
\u8106\u5f31\u6027\u60c5\u5831\u306e\u30da\u30fc\u30b8<\/a> \u306b\u3088\u308b\u3068\u3001\u539f\u56e0\u306f libtiff \u5185\u306e tif_dirread.c \u3068\u3044\u3046\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u306e\u4e2d\u306e TIFFFetchShortPair \u306b\u3042\u308b\u3068\u306e\u3053\u3068\u3002<\/p>\n
tif_dirread.c \u306e\u30b3\u30fc\u30c9\u306f\u3053\u3093\u306a\u611f\u3058\u3002 dirread \u306a\u3093\u3066\u66f8\u304f\u3068\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u30a2\u30af\u30bb\u30b9\u306e\u3088\u3046\u306b\u601d\u3048\u308b\u304c\u3001\u3053\u306edir \u306f IFD (Image File Directory) \u306edir (directory) \u306e\u3053\u3068\u3002 \u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u4e2d\u3067\u306f dir \u69cb\u9020\u4f53\u306e\u4e2d\u306b\u4e0a\u306b\u66f8\u3044\u305f IFD \u306e\u60c5\u5831\u304c dir->tdir_tag, dir->tdir_type, dir->tdir_count, dir->tdir_offset \u3068\u3057\u3066\u5165\u3063\u3066\u3044\u308b\u3002<\/p>\n
static int\r\nTIFFFetchShortPair(TIFF* tif, TIFFDirEntry* dir)\r\n{\r\n  switch (dir->tdir_type) {\r\n    case TIFF_BYTE:\r\n    case TIFF_SBYTE:\r\n    {\r\n      uint8 v[4];\r\n      return TIFFFetchByteArray(tif, dir, v)\r\n      && TIFFSetField(tif, dir->tdir_tag, v[0], v[1]);\r\n    }\r\n    case TIFF_SHORT:\r\n    case TIFF_SSHORT:\r\n    {\r\n      uint16 v[2];\r\n      return TIFFFetchShortArray(tif, dir, v)\r\n         && TIFFSetField(tif, dir->tdir_tag, v[0], v[1]);\r\n    }\r\n    default:\r\n      return 0;\r\n    }\r\n}<\/pre>\n
\u3053\u306e TIFFFetchShortPair \u306e\u30b3\u30fc\u30c9\u3060\u3051\u3067\u306f\u60aa\u3055\u306f\u308f\u304b\u3089\u306a\u3044\u306e\u3060\u304c\u3001case \u306e\u4e2d\u3067\u5b9a\u7fa9\u3055\u308c\u3066\u3044\u308b\u5909\u6570 v \u304c\u554f\u984c\u3002  <\/p>\n
\u5909\u6570 v \u306f4\u30d0\u30a4\u30c8\u5206\u306e\u914d\u5217 (1\u30d0\u30a4\u30c8*4 \u304b 2\u30d0\u30a4\u30c8*2) \u3068\u3057\u3066\u5ba3\u8a00\u3055\u308c\u3066\u3044\u308b\u304c\u3001TIFFFetchShortPair \u4e2d\u3067\u3055\u3089\u306b\u547c\u3073\u3060\u3057\u3066\u3044\u308b TIFFFetchByteArray\/TIFFFetchShortArray\u00a0\u306f dir->tdir_count \u304c2\u30d0\u30a4\u30c8\u304b4\u30d0\u30a4\u30c8\u4ee5\u4e0a\u3067\u3042\u308c\u3070\u3001\u305d\u306e\u30b5\u30a4\u30ba\u5206dir->tdir_offset\u4f4d\u7f6e\u306b\u3042\u308bTIFF\u753b\u50cf\u306e\u5185\u5bb9\u3092 v \u306b\u30b3\u30d4\u30fc\u3059\u308b\u3088\u3046\u306a\u30ed\u30b8\u30c3\u30af\u306b\u306a\u3063\u3066\u3044\u308b\u3002\u3057\u304b\u3057\u3001\u30b5\u30a4\u30ba\u306e\u30c1\u30a7\u30c3\u30af\u304c\u306a\u3044\u306e\u3067\u30b5\u30a4\u30ba\u3092\u66f8\u304d\u304b\u3048\u3066\u3057\u307e\u3048\u3070\u4f55\u30d0\u30a4\u30c8\u3067\u3082\u30b3\u30d4\u30fc\u3067\u304d\u3066\u3057\u307e\u3046\u3002<\/p>\n
\u5909\u6570 v \u306f\u30aa\u30fc\u30c8\u5909\u6570\u306a\u306e\u3067\u30b9\u30bf\u30c3\u30af\u306b\u683c\u7d0d\u3055\u308c\u3066\u3044\u308b\u3002 \u305d\u306e\u305f\u3081\u3001v \u306b4\u30d0\u30a4\u30c8\u4ee5\u4e0a\u306e\u30c7\u30fc\u30bf\u3092\u30b3\u30d4\u30fc\u3057\u305f\u5834\u5408\u3001\u30b9\u30bf\u30c3\u30af\u306e\u4e2d\u8eab\u3092\u7834\u58ca\u3057\u3066\u3057\u307e\u3046\u3053\u3068\u306b\u306a\u308b\u3002<\/p>\n
\u30b9\u30bf\u30c3\u30af\u306b\u306f\u30aa\u30fc\u30c8\u5909\u6570\u3060\u3051\u3067\u306a\u304f\u3001\u95a2\u6570\u306e\u5f15\u6570\u3084\u623b\u308a\u5148\u306a\u3069\u3082\u683c\u7d0d\u3055\u308c\u3066\u3044\u308b\u306e\u3067\u3001\u30b9\u30bf\u30c3\u30af\u3092\u66f8\u304d\u63db\u3048\u3089\u308c\u308b\u3068\u3044\u3046\u3053\u3068\u306f\u3053\u3046\u3044\u3063\u305f\u30d7\u30ed\u30b0\u30e9\u30e0\u306e\u5236\u5fa1\u3082\u30b3\u30f3\u30c8\u30fc\u30eb\u3067\u304d\u3066\u3057\u307e\u3046\u3002 \u3053\u308c\u304c\u30d0\u30c3\u30d5\u30a1\u30fc\u30aa\u30fc\u30d0\u30d5\u30ed\u30fc\u306b\u3088\u308b\u8106\u5f31\u6027\u3002<\/p>\n
\u7279\u306b\u3053\u306eTIFF\u753b\u50cf\u3092\u4f7f\u3063\u3066\u30b7\u30b9\u30c6\u30e0\u306b\u6f5c\u5165\u3059\u308b\u65b9\u6cd5\u3084\u30b3\u30fc\u30c9\u306f TIFF exploit (\u30c6\u30a3\u30d5 \u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c3\u30c8, TIFF\u3092\u4f7f\u3063\u305f\u629c\u3051\u9053) \u3068\u547c\u3070\u308c\u3066\u3044\u308b\u3002<\/p>\n
\u3082\u3046\u5c11\u3057\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u8ffd\u3063\u3066\u307f\u308b\u3068\u00a0TIFFFetchShortPair \u95a2\u6570\u304c\u547c\u3070\u308c\u308b\u306e\u306f tif_dirread.c \u5185\u306e\u3053\u306e\u90e8\u5206<\/p>\n
\r\n     case TIFFTAG_DOTRANGE:\r\n         (void) TIFFFetchShortPair(tif, dp);\r\n<\/pre>\n
DOTRANGE \u3068\u3044\u3046 IFD\u30bf\u30b0\u3092\u51e6\u7406\u3059\u308b\u3068\u304d\u3002<\/p>\n
\u3068\u3044\u3046\u3053\u3068\u3067\u3001TIFF \u30d5\u30a1\u30a4\u30eb\u306e DOTRANGE \u306e IFD \u30a8\u30f3\u30c8\u30ea\u306e\u30c7\u30fc\u30bf\u30b5\u30a4\u30ba 4-7 \u30d0\u30a4\u30c8\u76ee\u306b\u7d30\u5de5\u3092\u3057\u3066\u3001\u30b3\u30fc\u30c9\u3092\u9001\u308a\u3053\u3081\u3070 TIFF exploit \u304c\u5b8c\u6210\u3059\u308b\u3002<\/p>\n
TIFF exploit \u306e\u305f\u3081\u306e\u30b3\u30fc\u30c9\u3092\u8003\u3048\u308b<\/h3>\n
\u3058\u3083\u3042\u3001\u3069\u3093\u306a\u30c7\u30fc\u30bf(\u30b3\u30fc\u30c9)\u3092\u3053\u3053\u306b\u5165\u308c\u308c\u3070\u3044\u3044\u306e\u304b\u3002<\/p>\n
\u4e00\u756a\u7c21\u5358\u306a\u306e\u306f\u30b9\u30bf\u30c3\u30af\u306b\u5b9f\u884c\u3055\u305b\u305f\u3044\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u6d41\u3057\u3053\u3093\u3067\u304a\u304d\u3001RET\u547d\u4ee4\u306a\u3069\u3067\u623b\u308b\u30a2\u30c9\u30ec\u30b9\u3092\u305d\u306e\u30a2\u30c9\u30ec\u30b9\u306b\u304a\u304d\u304b\u3048\u3066\u3057\u307e\u3046\u3068\u3044\u3046\u65b9\u6cd5\u3002<\/p>\n
\u3057\u304b\u3057\u3001iPhone\/iPod touch \u304c\u63a1\u7528\u3057\u3066\u3044\u308b ARM \u30d7\u30ed\u30bb\u30c3\u30b5\u306f\u8106\u5f31\u6027\u5bfe\u7b56\u306e\u4e00\u74b0\u3068\u3057\u3066\u30b9\u30bf\u30c3\u30af\u9818\u57df\u304b\u3089\u306e\u30d7\u30ed\u30b0\u30e9\u30e0\u5b9f\u884c\u3092\u8a31\u3057\u3066\u3044\u306a\u3044(= PC (\u30d7\u30ed\u30b0\u30e9\u30e0\u30ab\u30a6\u30f3\u30bf)\u306b\u30b9\u30bf\u30c3\u30af\u30a8\u30ea\u30a2\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u6307\u5b9a\u3067\u304d\u306a\u3044) \u306e\u3067\u3053\u306e\u65b9\u6cd5\u304c\u4f7f\u3048\u306a\u3044\u3002<\/p>\n
\u305d\u3053\u3067\u3001\u3053\u306e exploit \u3067\u306f\u30ec\u30b8\u30b9\u30bf\u306e\u5024\u3092\u8abf\u6574\u3057\u3001\u3059\u3067\u306b\u3042\u308b\u95a2\u6570\u3084\u547d\u4ee4\u306e\u30a2\u30c9\u30ec\u30b9\u306b\u30b8\u30e3\u30f3\u30d7\u3057\u3066\u5b9f\u884c\u3057\u3066\u3082\u3089\u3046\u3068\u3044\u3046\u65b9\u6cd5\u3092\u4f7f\u3063\u305f\u3002 \u3053\u308c\u306f\u89e3\u8aad\u3055\u308c\u3066\u3044\u308b\u53e4\u3044\u30d0\u30fc\u30b8\u30e7\u30f3\u306e iPhone\/iPod touch \u306e\u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\u3092\u9006\u30a2\u30bb\u30f3\u30d6\u30eb\u3059\u308c\u3070\u3042\u308b\u7a0b\u5ea6\u306f\u308f\u304b\u308b\u3002 \u3067\u304d\u308b\u3053\u3068\u306f\u5236\u9650\u3055\u308c\u308b\u3051\u3069\u3001\u3042\u308b\u7a0b\u5ea6\u306e\u3053\u3068\u306f\u3053\u306e\u65b9\u6cd5\u3067\u5b9f\u73fe\u3067\u304d\u305d\u3046\u3060\u3002<\/p>\n
\u98db\u3073\u305f\u3044\u30a2\u30c9\u30ec\u30b9\u306b\u30b8\u30e3\u30f3\u30d7\u3059\u308b\u65b9\u6cd5\u306f\u30b9\u30bf\u30c3\u30af\u306e\u72b6\u614b\u3092\u628a\u63e1\u3057\u3001RET\u30a2\u30c9\u30ec\u30b9\u3092\u8abf\u6574\u3059\u308b\u306e\u304c\u6c4e\u7528\u7684\u306a\u65b9\u6cd5\u3068\u3057\u3066\u8003\u3048\u3089\u308c\u308b\u304c\u3001\u4eca\u56de\u306f\u30c0\u30df\u30fc\u306e TIFF \u30a4\u30e1\u30fc\u30b8\u3092 iPhone\/iPod touch \u306b\u8aad\u307f\u3053\u307e\u305b\u3066\u307f\u305f\u3089\u3001\u52d8\u9055\u3044\u3057\u305f\u30d7\u30ed\u30b0\u30e9\u30e0\u304c\u753b\u50cf\u4e2d\u306e\u3042\u308b\u30aa\u30d5\u30bb\u30c3\u30c8\u306e\u30c7\u30fc\u30bf\u3092PC(\u30d7\u30ed\u30b0\u30e9\u30e0\u30ab\u30a6\u30f3\u30bf)\u306b\u66f8\u304d\u3053\u3080\u3053\u3068\u304c\u308f\u304b\u3063\u305f\u305f\u3081\u3001\u305d\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u306b\u30b8\u30e3\u30f3\u30d7\u3057\u305f\u3044\u30a2\u30c9\u30ec\u30b9\u3092\u66f8\u304f\u3053\u3068\u306b\u3057\u305f\u3089\u3057\u3044\u3002<\/p>\n
\u305d\u3057\u3066\u3001\u30e9\u30c3\u30ad\u30fc\u306a\u3053\u3068\u306bARM\u30d7\u30ed\u30bb\u30c3\u30b5\u306f\u30d7\u30ed\u30b0\u30e9\u30e0\u304b\u3089PC\u3092\u30bb\u30c3\u30c8\u3059\u308b\u547d\u4ee4\u304c\u7528\u610f\u3055\u308c\u3066\u3044\u305f\u3002<\/p>\n
\r\nNode ldmia_r4_r0(version == 0 ? 0x310b668c : 0x3125368c); \/\/ ldmia r4!, {r0, r1, r2, r3, r5, r6, r12, sp, lr, pc}\r\nNode ldmia_sp_r4(0x3000adfc);                             \/\/ ldmia sp!, {r4, r7, pc}\r\nNode ldmia_sp_r0(0x300df800);                             \/\/ ldmia sp!, {r0, r1, r2, r3, pc}<\/pre>\n
exploit \u30d7\u30ed\u30b0\u30e9\u30e0\u5185\u306e ldmia  \u3068\u3044\u3046\u547d\u4ee4\u304c\u30bd\u30ec\u3067\u3001sp(\u30b9\u30bf\u30c3\u30af\u30dd\u30a4\u30f3\u30bf)\u304c\u6307\u3057\u3066\u3044\u308b\u30a2\u30c9\u30ec\u30b9\u306e\u5185\u5bb9\u3092\u9806\u306b\u30ec\u30b8\u30b9\u30bf\u306b\u30bb\u30c3\u30c8\u3057\u3066\u3044\u304f\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u308b\u3002<\/p>\n
\u5148\u307b\u3069\u66f8\u3044\u305fARM\u30d7\u30ed\u30bb\u30c3\u30b5\u306e\u8106\u5f31\u6027\u5bfe\u7b56\u306e\u305f\u3081\u3001\u3053\u306e\u547d\u4ee4\u3092\u76f4\u63a5\u30b9\u30bf\u30c3\u30af\u306b\u66f8\u3044\u3066\u547c\u3073\u3060\u3059\u3053\u3068\u306f\u3067\u304d\u306a\u3044\u306e\u3067\u3001\u540c\u3058\u547d\u4ee4\u3092\u547c\u3073\u3060\u3057\u3066\u3044\u308b\u30b3\u30fc\u30c9\u3092\u898b\u3064\u3051\u3001\u305d\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u6307\u5b9a\u3059\u308b\u3088\u3046\u306b\u3059\u308b (0x310b668c \u306a\u3069\u306e\u6570\u5b57\u304c\u30bd\u30ec)\u3002  \u3053\u308c\u3092\u99c6\u4f7f\u3059\u308c\u3070\u3042\u308b\u7a0b\u5ea6\u306e\u95a2\u6570\u547c\u3073\u3060\u3057\u3092 exploit \u30b3\u30fc\u30c9\u306e\u4e2d\u3067\u6307\u5b9a\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u3002<\/p>\n
\u3055\u3066\u3001iPhone\/iPod touch \u306e\u30c7\u30fc\u30bf\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u306e\u306f\u3001\u666e\u6bb5 iTunes \u3068\u306e\u9593\u3067\u884c\u308f\u308c\u308b\u901a\u4fe1\u65b9\u6cd5\u3092\u30a8\u30df\u30e5\u30ec\u30fc\u30c8\u3059\u308b\u3088\u3046\u306a\u5f62\u3067\u884c\u308f\u308c\u308b\u3002 \u3053\u306e\u901a\u4fe1\u306f iPhone\/iPod touch \u4e0a\u3067\u8d70\u3063\u3066\u3044\u308b afc \u30b5\u30fc\u30d3\u30b9\u3092\u4ecb\u3057\u3066\u884c\u308f\u308c\u308b\u304c\u3001\u901a\u5e38\u3053\u306e\u30b5\u30fc\u30d3\u30b9\u3092\u4ecb\u3057\u3066\u30a2\u30af\u30bb\u30b9\u3067\u304d\u308b\u306e\u306f\u97f3\u697d\u30c7\u30fc\u30bf\u306a\u3069\u306e\u5165\u3063\u305f \/var\/root\/Media \u3068\u3044\u3046\u9818\u57df\u4ee5\u964d\u306b\u9650\u5b9a\u3055\u308c\u3066\u3044\u308b\u3002<\/p>\n
\u3068\u3044\u3046\u3053\u3068\u306f\u3001 \/var\/root\/Media \u3092 \/ \u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u306b\u898b\u305b\u304b\u3051\u308b\u3088\u3046\u306b\u3059\u308b\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u30b3\u30fc\u30c9\u3092 TIFF \u306e\u4e2d\u306b\u57cb\u3081\u3053\u3093\u3067\u3057\u307e\u3048\u3070\u305d\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u8aad\u307f\u66f8\u304d\u3067\u304d\u308b\u306f\u305a\u3002<\/p>\n
    \n
  1. \u3053\u308c\u307e\u3067\u306e\/var\/root\/Media \u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092 \/var\/root\/Oldmedia \u306b\u30ea\u30cd\u30fc\u30e0<\/li>\n
  2. \/ \u306e\u30b7\u30f3\u30dc\u30ea\u30c3\u30af\u30ea\u30f3\u30af\u3068\u3057\u3066 \/var\/root\/Media\u00a0\u3092\u4f5c\u6210<\/li>\n
  3. \/ \u3092 read\/write \u30e2\u30fc\u30c9\u3067\u518d\u30de\u30a6\u30f3\u30c8 (\u30aa\u30ec\u7684\u306b\u306f\u3044\u3089\u306a\u3044\u6c17\u3082\u3059\u308b\u3093\u3060\u3051\u3069…)<\/li>\n<\/ol>\n
    \u5b9f\u969b\u306b\u305d\u308c\u3092\u3084\u3063\u3066\u3044\u308b\u306e\u304c\u4ee5\u4e0b\u306e\u30b3\u30fc\u30c9\u3002<\/p>\n
    \r\nbuild_tif(base, ldmia_r4_r0);            \/\/ set stack base and initial jump\r\nstack.Add(Node(0, Node::PTR));           \/\/ r0 = \"\/var\/root\/Media\"\r\nstack.Add(Node(1, Node::PTR));           \/\/ r1 = \"\/var\/root\/Oldmedia\"\r\nstack.Add(Node(20, Node::BYTES));        \/\/ r2,r3,r5,r6,r12\r\nstack.Add(Node(12, Node::STACK));        \/\/ sp    -> offset 12\r\nstack.Add(ldmia_sp_r4);                  \/\/ lr = load r4,r7,pc from sp\r\nstack.Add(rename);                       \/\/ pc = rename(r0, r1)\r\nstack.Add(Node(12, Node::STACK));        \/\/ r4 = sp -> offset 12\r\nstack.Add(Node(4, Node::BYTES));         \/\/ r7 = unused\r\nstack.Add(ldmia_r4_r0);                  \/\/ pc = load r0...lr from r4\r\nstack.Add(Node(2, Node::PTR));           \/\/ r0 = \"\/\"\r\nstack.Add(Node(0, Node::PTR));           \/\/ r1 = \"\/var\/root\/Media\"\r\nstack.Add(Node(20, Node::BYTES));        \/\/ r2,r3,r5,r6,r12\r\nstack.Add(Node(12, Node::STACK));        \/\/ sp -> offset 12\r\nstack.Add(ldmia_sp_r0);                  \/\/ lr = load from r0..pc from sp\r\nstack.Add(symlink);                      \/\/ pc = symlink(r0, r1)\r\nstack.Add(Node(3, Node::PTR));           \/\/ r0 = \"hfs\"\r\nstack.Add(Node(2, Node::PTR));           \/\/ r1 = \"\/\"\r\nstack.Add(Node(0x00050000, Node::VAL));  \/\/ r2 = MNT_RELOAD | MNT_UPDATE\r\nstack.Add(Node(8, Node::STACK));         \/\/ r3 = **data\r\nstack.Add(mount);                        \/\/ pc = mount(r0, r1, r2, r3)\r\nstack.Add(Node(4, Node::PTR));           \/\/ data = \"\/dev\/disk0s1\"<\/pre>\n
    \u89e3\u8aac\u3059\u308b\u3068\u3053\u3093\u306a\u611f\u3058<\/p>\n
      \n
    1. \u307e\u305a ldmia_r4_r0 \u3092\u547c\u3073\u3060\u3057\u3001\u73fe\u5728\u306eSP(\u30b9\u30bf\u30c3\u30af\u30dd\u30a4\u30f3\u30bf)\u4ee5\u964d\u306e\u30c7\u30fc\u30bf\u304c\u30ec\u30b8\u30b9\u30bf\u306b\u30b3\u30d4\u30fc\u3055\u308c\u308b\u3002<\/li>\n
    2. \u6700\u5f8c\u306b PC (\u30d7\u30ed\u30b0\u30e9\u30e0\u30ab\u30a6\u30f3\u30bf) \u304c rename \u95a2\u6570\u306e\u30a2\u30c9\u30ec\u30b9\u306b\u7f6e\u304d\u304b\u308f\u308a\u3001\u623b\u308a\u5148\u3068\u306a\u308b\u30a2\u30c9\u30ec\u30b9\u3068\u3057\u3066 ldmia_sp_r4 \u304c lr \u306b\u30bb\u30c3\u30c8\u3055\u308c\u3066 rename \u95a2\u6570\u304c\u5b9f\u884c<\/li>\n
    3. rename \u95a2\u6570\u304c\u7d42\u4e86\u3059\u308b\u3068\u3001ldmia_sp_r4 \u304c\u547c\u3070\u308c\u30b9\u30bf\u30c3\u30af\u30dd\u30a4\u30f3\u30bf\u306e\u30a2\u30c9\u30ec\u30b9\u4f4d\u7f6e\u306e\u8abf\u6574\u3092\u884c\u3044\u3001ldmia_r4_r0 \u547d\u4ee4\u3092\u547c\u3076<\/li>\n
    4. \u518d\u3073\u30b9\u30bf\u30c3\u30af\u306e\u5185\u5bb9\u304c\u30ec\u30b8\u30b9\u30bf\u306b\u30b3\u30d4\u30fc\u3055\u308c PC \u304c symlink \u306b\u5909\u308f\u308a symlink \u304c\u5b9f\u884c\u3002 \u623b\u308a\u30a2\u30c9\u30ec\u30b9\u306f ldmia_sp_r0 (\u4eca\u5ea6\u306f\u30b9\u30bf\u30c3\u30af\u30dd\u30a4\u30f3\u30bf\u306e\u8abf\u6574\u306f\u3044\u3089\u306a\u3044\u3063\u307d\u3044\u3002 \u3053\u306e\u30d8\u30f3\u306f\u8a66\u884c\u932f\u8aa4\u306e\u7d50\u679c\u3060\u3068\u601d\u308f\u308c\u308b)<\/li>\n
    5. symlink \u7d42\u4e86\u5f8c ldmia_sp_r0 \u304c\u30b9\u30bf\u30c3\u30af\u306e\u5185\u5bb9\u3092\u30ec\u30b8\u30b9\u30bf\u306b\u30b3\u30d4\u30fc\u3057\u3066 mount \u547d\u4ee4\u304c\u5b9f\u884c\u3055\u308c\u308b<\/li>\n
    6. \u30d7\u30ed\u30b0\u30e9\u30e0\u30ab\u30a6\u30f3\u30bf\u304c\u304a\u304b\u3057\u306a\u3068\u3053\u308d\u3092\u6307\u3057 Safari \u304c\u30af\u30e9\u30c3\u30b7\u30e5\u3059\u308b\u3002\u5fc5\u8981\u306a\u51e6\u7406\u306f\u7d42\u308f\u3063\u3066\u3044\u308b\u306e\u3067\u30af\u30e9\u30c3\u30b7\u30e5\u3057\u3066\u3082\u5f71\u97ff\u306f\u306a\u3044\u3002<\/li>\n<\/ol>\n
      \u3053\u308c\u3067\u3001\u30b9\u30bf\u30c3\u30af\u3092\u30a4\u30b8\u308b\u3060\u3051\u3067\u3084\u308a\u305f\u3044\u3053\u3068\u304c\u3067\u304d\u3066\u3057\u307e\u3046\u3002  \u95a2\u6570\u3092\u547c\u3073\u3060\u3057\u305f\u3042\u3068\u306b\u30b8\u30e3\u30f3\u30d7\u3059\u308b lr \u30ec\u30b8\u30b9\u30bf\u3068 ldmia \u547d\u4ee4\u3092\u99c6\u4f7f\u3057\u3066\u95a2\u6570\u3092\u6b21\u3005\u30b8\u30e3\u30f3\u30d7\u3055\u305b\u3066\u308b\u3068\u3053\u308d\u306f\u3042\u308b\u610f\u5473\u82b8\u8853\u7684\u3002<\/p>\n
      \u30b3\u30fc\u30c9\u306e\u52d5\u304d\u3092\u898b\u308b\u3068\u3001TIFF \u753b\u50cf\u3092\u898b\u305f\u3042\u3068\u30c7\u30a3\u30b9\u30af\u9818\u57df\u304c 300MB \u3050\u3089\u3044\u306b\u6e1b\u3063\u3066\u3057\u307e\u3046\u306e\u306f
       
      \n\/var\/root\/Media \u304cOS\u306e\u30b7\u30b9\u30c6\u30e0\u9818\u57df\u306b\u7f6e\u304d\u63db\u308f\u3063\u3066\u3044\u305f\u304b\u3089\u3060\u3068\u308f\u304b\u308b\u3002 jailbreak<\/b> \u306f\u9ed2\u9b54\u8853\u3058\u3083\u306a\u304b\u3063\u305f\u3002<\/p>\n
      \u3053\u306e\u4f5c\u696d\u306e\u3042\u3068\u306f iPhone\/iPod touch \u3068\u901a\u4fe1\u3059\u308b iPHUC(iPHoneUtilityClient) \u3068\u3044\u3046\u30c4\u30fc\u30eb\u3092\u4f7f\u3063\u3066\u30eb\u30fc\u30c8\u30d1\u30fc\u30c6\u30a3\u30b7\u30e7\u30f3\u3092\u5438\u3044\u3060\u3057\u3001fstab \u3092\u66f8\u63db\u3048\u3066\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u3092\u8aad\u307f\u66f8\u304d\u53ef\u80fd\u306a\u5f62\u306b\u3057\u3001afc \u30b5\u30fc\u30d0\u3092 \/ \u304b\u3089\u30a2\u30af\u30bb\u30b9\u3067\u304d\u308b\u3088\u3046\u306b\u5909\u66f4\u3057\u305f\u3042\u3068\u306b\u3001\u5143\u306b\u623b\u305b\u3070\u597d\u304d\u306a\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u305f\u308a\u3001\u597d\u304d\u306a\u30d5\u30a1\u30a4\u30eb\u3092\u66f8\u304d\u304b\u3048\u305f\u308a\u3067\u304d\u308b\u3002 <\/p>\n
      \u3053\u308c\u304c \u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2 1.1.1 \u306e iPod touch \u3067 jailbreak \u3059\u308b\u3068\u304d\u306b\u3084\u3063\u3066\u3044\u308b\u3053\u3068\u3060\u3063\u305f\u3002<\/p>\n
      \u3053\u308c\u3092\u66f8\u3044\u3066\u3044\u308b\u9014\u4e2d\u306b\u3001 Safari \u3067\u7d30\u5de5\u3055\u308c\u305f TIFF \u753b\u50cf\u3092\u898b\u308b\u3060\u3051\u3067\u5b8c\u4e86\u3059\u308b\u3068\u3044\u3046 Jailbreak \u306e\u65b9\u6cd5\u304c\u51fa\u305f\u304c\u304a\u305d\u3089\u304f\u3001TIFF\u30a4\u30e1\u30fc\u30b8\u306e\u4e2d\u306b\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u305f\u30b3\u30fc\u30c9\u3092\u57cb\u3081\u3053\u307f\u3001RET\u5148\u3092\u8abf\u6574\u3057\u3001memcpy \u3068\u3044\u3063\u305f\u95a2\u6570\u3092\u4f7f\u3063\u3066\u30d2\u30fc\u30d7\u9818\u57df\u306b\u66f8\u304d\u3053\u307f\u3001\u305d\u3053\u3067\u51e6\u7406\u3092\u5b9f\u884c\u3059\u308b\u3068\u3044\u3046\u611f\u3058\u3067\u5b9f\u73fe\u3055\u308c\u3066\u3044\u308b\u3068\u601d\u308f\u308c\u308b\u3002<\/p>\n
      \u3044\u3084\u30fc\u9762\u767d\u3044\u306a\u3041\u3002 \u3051\u3069\u3001\u3053\u308c\u3092\u81ea\u5206\u3067\u898b\u3064\u3051\u3089\u308c\u308b\u3068\u306f\u3068\u3066\u3082\u601d\u3048\u306a\u3044\u3002  \u30cf\u30c3\u30ab\u30fc\u305f\u3061\u306e\u57f7\u5ff5\u6050\u308b\u3079\u3057\u3002<\/p>\n
      \u53c2\u8003:<\/p>\n