Showing posts with label iphone. Show all posts
Showing posts with label iphone. Show all posts

Jul 9, 2010

Omnia vs iPhone 2

Comparison between Omnia and IPHONE

Back design:

Particularly, this section will probably have the reviews and comments about the different looks of them. People then see what other people saw these beautiful more beautiful than the other with her ... hehe ... but each has their very own beauty and is part of his more favored by Omnia Omnia 2 2 design with a shiny black cross smoothly from start to finish brings elegance, elegant and somewhat mysterious. Thing is that it also has special keys Cubic highly toxic, crystal-clear, sparkling like diamonds expensive) Nice ... Now the iPhone is not redesigning the incondite Exciting, for such period. Four sides of the line is just cause for his simple feeling a bit boring

image

Weight Omnia 2 seems slim and lightweight than tiny compared with the iPhone but also not significant.

image

Hand after the second handset has a slick black. The top of the head with the iPhone is SIM slot, 3.5mm headphone jack and power button also OMNIA 2 jack is connected MicroUSB and 3.5 mm Jack AIO to connect the handsfree (Hand-free), headset (Speaker ) and the port TV out always  great.

image

The angle of the iPhone looks more square than the Omnia 2. iPhone is more light-metal border. Can see the size of two phone not much difference.

image

The configuration

Especially this part can be clearly seen remarkable improvements in the technology of the Omnia 2 vs version iPhone.

Net realized when it is turn on the display. With two wide-screen Omnia 3.7 inch big screen than a 3.5-inch iPhone display, the Omnia also on PDA 2 is applied first AMOLED technology with extremely high resolution WVGA 800 x 480 pixels instead iPhone remains the TFT technology with traditional resolution less than 480 x 320 pixel HVGA. This shows very clearly the difference ADDRESS, ADDRESS AMOLED shows the sharp, bright TFT and more.

image

This is the 2chiec screen lock, how to unlock a different part 1chut. iPhone is a scroll sideways also with Omnia 2 it is press and hold ...

To demonstrate more clearly the advantages of AMOLED display bright, I'll change the background with blue green leaves with the other iPhone.

image

Omnia Screen 2 brilliant, bright, cheerful colors than the iPhone 3G next. And there is a difference in two sample screen of this phone, it was touch ... iPhone with tradition still maintained ADDRESS trc generation (2G) that monitors the capacitance sensor. Using the charge of the body to function. But with Omnia 2 by the characteristics of Windows Mobile operating system should use resistive touch. The reason is to screen resistive touch higher precision (with the smallest resolution, so you can seen as drawing with a stylus) compared with the capacitance sensor. Omnia 2 technology uses Advanced-R touch will feel very smooth stroke ...

Next, the processing speed of the machine, with a speed of nearly every one on top of the mobile handset market, is in his second Omnia 1CPU up to 800 Mhz CPU of the iPhone through a considerable distance is 600 MHz ( iPhone 3GS) and 412 MHz (iPhone 3G). These are the chipsets produced by Samsung. But to implement these tasks on a smooth as it can not not mention the composition of RAM. iPhone 3G , the number of RAM may seem modest in the third brought ADDRESS product comparison, that figure only 128 MB less than a half compared with the "rookie" is 3GS iPhone and Omnia 2-256 MB. Perhaps the most powerful war is the war on storage. Storage needs of ng `Consumers increasingly, not just a store like advance mp3 songs here, now in the entertainment world has always had many attractions: the film, the latest clips high-definition HD-resolution pictures nhg large, Mp3 songs ADDRESS low compression ratio ... with all that storage space required on a larger. So to solve that need to be like the iPhone has been upgraded from 8 / 16 GB 3G version of 3GS 16/32GB for the subject but where "bad side" way. Omnia 2 2phien version is released 8 GB and 16 GB with iPhone 3G, but something special that can not Exciting line iPhone that is able to upgrade via memory card slots. That's quite a disadvantage ... Omnia 2 MicroSD card slot, supports up to 32 GB card. What's great is not it! Spoiled or copy the music, the cult movie you like without worrying about the lack of capacity home again!

In connection

Most advanced phones on the market today have support for both generation GSM 2G and 3G. Omnia and the iPhone 2 is also not out of the edrive. Phones with two parallel each other at all but a scattered band of small differences in Omnia 2 is a further support system with speed HSUPA 5.76 Mbps HSDPA system rather than just the iPhone.

Strengths in connection Omnia 2 also shows the ability to connect at Wi-Fi by using more technology ADDRESS DLNA. 2mau day holding their phones for comparison, I tried the same risk for intellectual 1vi Omnia and iPhone 2 connect to wifi in the know about 20m, immediately Omnia second advantage to win immediately successful connection, Now the iPhone 3G to the "crucified" than to try to start the 2nd new Network Address but the "burden off the middle road"that happened while two remained Address Omnia connection. Ko also started the second such Omnia ADDRESS waves from a cafe near the 40 meters that way, the iPhone has insufficient

Sound Quality

The following are the survey results

image

Address Omnia appreciated than the volume, could be called very good compared to the average level of the iPhone 3G. Not so with the support of technology and SRS DNSe made Omnia 2 player capable of excellent with simulated surround sound, stereo sound to bring order smoother, vibrant and lively as is 1rap singing in luxury.

Interface, operating system and features:

It is difficult to compare the two operating systems are Microsoft Windows Mobile on the Omnia 2 and Mac OS iPhone, the party any more. Each operating system there are points

Highlights of our strengths. iPhone OS featured graphical interface also strong with both Windows Mobile has a treasure of applications in both office and entertainment ... Here we see the same interface and properties they do:

image

This is after unlocking the interface, the main interface. Address Omnia 2 remained the capital of their brilliant. Also Omnia 2 Exciting the custom in access applications by using the TouchWiz UI 2.0 and 3D Media Gate also iPhone icons is just that simple.

Here are pictures of the Media Gate 3D with volume up nice salary eyes of the iPhone does not Omnia 2

image

Next is the message interface of the iPhone vs Omnia 2, with a QWERTY keyboard for typing but Omnia 2 special characters easy

image

image

Phone screen with touch keys to, obviously ...

image

Along with basic features such as entertainment features like music ...

image

Omnia 2 can control the player as an easier way to adjust the volume, re-configured to use SRS or DNSe technology. iPhone photo album that may be larger. Try out horizontally machine

image

Both models are two lines of entertainment features all the power. Graphical interface vivid 3D.

Camera

With a resolution of 5.0 megapixels , auto focus (AF), dual flash (Flash LED Dual) and not least the special digital camera true, it is more functional identification smile. So true is that iPhone is not competition in these bouts. We only have the camera 2.0 megapixels for the 2G and 3.2 megapixels for the 3Gs and only version 3Gs adds a new AF. These are the shooting modes of the Omnia 2

image

And here are photos taken at the same level 1goc shows the difference between the iPhone and Omnia 2. Address resize images down to size ..

image image

Address 2 saw pictures on the difference between the two phones capable of shooting. 2 for both auto mode, the image of the iPhone for a wide variety of colors moisture Omnia g 2 also shows the ADDRESS honest than the color of the object ADDRESS photographs, pictures also depth than the iPhone. It was felt initially as a small image resize Address to the quality of sharpness is similar. But to see the difference we need to zoom in Here are two photos on the zoom up

image

The more you zoom to more clearly see the difference in picture quality, iPhone photos started to "break", ADDRESS particles that noise, no depth, color began to have "issues". Address Omnia 2 still send its high image remains smooth, noise and the phenomenon has not been "broken" lines on the edges of the frame's still express ADDRESS.

Filming the second Omnia likely filming with a resolution of 720 x 480 pixels at 30 fps also iPhone 3GS only VGA resolution 640 x 480 pixels at a speed well 30khung fps, iPhone 3G is often not has this interesting feature.

With the support of 3G features make calls Video Call (talk with images) made to fully exploit 2 fitted Omnia kemvoi a front VGA camera can not understand the reason that the iPhone has lost the right to benefit of consumers so as no front camera

image

Share your ideas and thoughts.

You may like the following post
Samsung Corby Wallpapers
Samsung Corby Wallpapers 1
Samsung Corby S3653 wallpapers
Samsung Corby S3653 Wallpapers -1
3 in 1 free Samsung Corby Wallpapers
Secret Code for Samsung Corby
Free Samsung Corby Games
Beautiful free samsung corby wallpapers
Firmwares for Samsung star S5230 and S5233
Some Samsung secret codes
How to install theme for samsung U700
Unlock a Samsung, F400, U600, U700, j700.d900, D900I, E720 ...
Flash guide Samsung G600
JAVA installation instructions on the phone Samsung
All new 240 x 320 Samsung Touch Screen Game
Free Samsung Star games 240 x 320 - Touch Screen
Free Fullscreen Games for Samsung Star Touch Screen mobile
Creating *. jad file to install applications on the phone Samsung
Free Applications for Samsung Corby Mobiles
SWF wallpaper clock work for Samsung jet, Corby, star ...
Touch Screen Games For Samsung F480 (fully tested)
Samsung Corby S3650 Firmware Update Guide [Avoid sudden power failure]
Samsung I9000 S Galaxy - First Impressions
Hot! Samsung New Wave
How to create a basic theme for Samsung Corby
New Free Samsung Corby Wallpapers 3 in 1
Samsung 4G hands on Epic ( Galaxy Pro S ) - A " super food " 4G
Samsung Corby Games 240x400 & 240x320 Touch Screen
[ Hot ] Update Samsung Star Game for the horizontal

Omnia vs iPhone 2

Comparison between Omnia and IPHONE

Back design:

Particularly, this section will probably have the reviews and comments about the different looks of them. People then see what other people saw these beautiful more beautiful than the other with her ... hehe ... but each has their very own beauty and is part of his more favored by Omnia Omnia 2 2 design with a shiny black cross smoothly from start to finish brings elegance, elegant and somewhat mysterious. Thing is that it also has special keys Cubic highly toxic, crystal-clear, sparkling like diamonds expensive) Nice ... Now the iPhone is not redesigning the incondite Exciting, for such period. Four sides of the line is just cause for his simple feeling a bit boring

image

Weight Omnia 2 seems slim and lightweight than tiny compared with the iPhone but also not significant.

image

Hand after the second handset has a slick black. The top of the head with the iPhone is SIM slot, 3.5mm headphone jack and power button also OMNIA 2 jack is connected MicroUSB and 3.5 mm Jack AIO to connect the handsfree (Hand-free), headset (Speaker ) and the port TV out always  great.

image

The angle of the iPhone looks more square than the Omnia 2. iPhone is more light-metal border. Can see the size of two phone not much difference.

image

The configuration

Especially this part can be clearly seen remarkable improvements in the technology of the Omnia 2 vs version iPhone.

Net realized when it is turn on the display. With two wide-screen Omnia 3.7 inch big screen than a 3.5-inch iPhone display, the Omnia also on PDA 2 is applied first AMOLED technology with extremely high resolution WVGA 800 x 480 pixels instead iPhone remains the TFT technology with traditional resolution less than 480 x 320 pixel HVGA. This shows very clearly the difference ADDRESS, ADDRESS AMOLED shows the sharp, bright TFT and more.

image

This is the 2chiec screen lock, how to unlock a different part 1chut. iPhone is a scroll sideways also with Omnia 2 it is press and hold ...

To demonstrate more clearly the advantages of AMOLED display bright, I'll change the background with blue green leaves with the other iPhone.

image

Omnia Screen 2 brilliant, bright, cheerful colors than the iPhone 3G next. And there is a difference in two sample screen of this phone, it was touch ... iPhone with tradition still maintained ADDRESS trc generation (2G) that monitors the capacitance sensor. Using the charge of the body to function. But with Omnia 2 by the characteristics of Windows Mobile operating system should use resistive touch. The reason is to screen resistive touch higher precision (with the smallest resolution, so you can seen as drawing with a stylus) compared with the capacitance sensor. Omnia 2 technology uses Advanced-R touch will feel very smooth stroke ...

Next, the processing speed of the machine, with a speed of nearly every one on top of the mobile handset market, is in his second Omnia 1CPU up to 800 Mhz CPU of the iPhone through a considerable distance is 600 MHz ( iPhone 3GS) and 412 MHz (iPhone 3G). These are the chipsets produced by Samsung. But to implement these tasks on a smooth as it can not not mention the composition of RAM. iPhone 3G , the number of RAM may seem modest in the third brought ADDRESS product comparison, that figure only 128 MB less than a half compared with the "rookie" is 3GS iPhone and Omnia 2-256 MB. Perhaps the most powerful war is the war on storage. Storage needs of ng `Consumers increasingly, not just a store like advance mp3 songs here, now in the entertainment world has always had many attractions: the film, the latest clips high-definition HD-resolution pictures nhg large, Mp3 songs ADDRESS low compression ratio ... with all that storage space required on a larger. So to solve that need to be like the iPhone has been upgraded from 8 / 16 GB 3G version of 3GS 16/32GB for the subject but where "bad side" way. Omnia 2 2phien version is released 8 GB and 16 GB with iPhone 3G, but something special that can not Exciting line iPhone that is able to upgrade via memory card slots. That's quite a disadvantage ... Omnia 2 MicroSD card slot, supports up to 32 GB card. What's great is not it! Spoiled or copy the music, the cult movie you like without worrying about the lack of capacity home again!

In connection

Most advanced phones on the market today have support for both generation GSM 2G and 3G. Omnia and the iPhone 2 is also not out of the edrive. Phones with two parallel each other at all but a scattered band of small differences in Omnia 2 is a further support system with speed HSUPA 5.76 Mbps HSDPA system rather than just the iPhone.

Strengths in connection Omnia 2 also shows the ability to connect at Wi-Fi by using more technology ADDRESS DLNA. 2mau day holding their phones for comparison, I tried the same risk for intellectual 1vi Omnia and iPhone 2 connect to wifi in the know about 20m, immediately Omnia second advantage to win immediately successful connection, Now the iPhone 3G to the "crucified" than to try to start the 2nd new Network Address but the "burden off the middle road"that happened while two remained Address Omnia connection. Ko also started the second such Omnia ADDRESS waves from a cafe near the 40 meters that way, the iPhone has insufficient

Sound Quality

The following are the survey results

image

Address Omnia appreciated than the volume, could be called very good compared to the average level of the iPhone 3G. Not so with the support of technology and SRS DNSe made Omnia 2 player capable of excellent with simulated surround sound, stereo sound to bring order smoother, vibrant and lively as is 1rap singing in luxury.

Interface, operating system and features:

It is difficult to compare the two operating systems are Microsoft Windows Mobile on the Omnia 2 and Mac OS iPhone, the party any more. Each operating system there are points

Highlights of our strengths. iPhone OS featured graphical interface also strong with both Windows Mobile has a treasure of applications in both office and entertainment ... Here we see the same interface and properties they do:

image

This is after unlocking the interface, the main interface. Address Omnia 2 remained the capital of their brilliant. Also Omnia 2 Exciting the custom in access applications by using the TouchWiz UI 2.0 and 3D Media Gate also iPhone icons is just that simple.

Here are pictures of the Media Gate 3D with volume up nice salary eyes of the iPhone does not Omnia 2

image

Next is the message interface of the iPhone vs Omnia 2, with a QWERTY keyboard for typing but Omnia 2 special characters easy

image

image

Phone screen with touch keys to, obviously ...

image

Along with basic features such as entertainment features like music ...

image

Omnia 2 can control the player as an easier way to adjust the volume, re-configured to use SRS or DNSe technology. iPhone photo album that may be larger. Try out horizontally machine

image

Both models are two lines of entertainment features all the power. Graphical interface vivid 3D.

Camera

With a resolution of 5.0 megapixels , auto focus (AF), dual flash (Flash LED Dual) and not least the special digital camera true, it is more functional identification smile. So true is that iPhone is not competition in these bouts. We only have the camera 2.0 megapixels for the 2G and 3.2 megapixels for the 3Gs and only version 3Gs adds a new AF. These are the shooting modes of the Omnia 2

image

And here are photos taken at the same level 1goc shows the difference between the iPhone and Omnia 2. Address resize images down to size ..

image image

Address 2 saw pictures on the difference between the two phones capable of shooting. 2 for both auto mode, the image of the iPhone for a wide variety of colors moisture Omnia g 2 also shows the ADDRESS honest than the color of the object ADDRESS photographs, pictures also depth than the iPhone. It was felt initially as a small image resize Address to the quality of sharpness is similar. But to see the difference we need to zoom in Here are two photos on the zoom up

image

The more you zoom to more clearly see the difference in picture quality, iPhone photos started to "break", ADDRESS particles that noise, no depth, color began to have "issues". Address Omnia 2 still send its high image remains smooth, noise and the phenomenon has not been "broken" lines on the edges of the frame's still express ADDRESS.

Filming the second Omnia likely filming with a resolution of 720 x 480 pixels at 30 fps also iPhone 3GS only VGA resolution 640 x 480 pixels at a speed well 30khung fps, iPhone 3G is often not has this interesting feature.

With the support of 3G features make calls Video Call (talk with images) made to fully exploit 2 fitted Omnia kemvoi a front VGA camera can not understand the reason that the iPhone has lost the right to benefit of consumers so as no front camera

image

Share your ideas and thoughts.

You may like the following post
Samsung Corby Wallpapers
Samsung Corby Wallpapers 1
Samsung Corby S3653 wallpapers
Samsung Corby S3653 Wallpapers -1
3 in 1 free Samsung Corby Wallpapers
Secret Code for Samsung Corby
Free Samsung Corby Games
Beautiful free samsung corby wallpapers
Firmwares for Samsung star S5230 and S5233
Some Samsung secret codes
How to install theme for samsung U700
Unlock a Samsung, F400, U600, U700, j700.d900, D900I, E720 ...
Flash guide Samsung G600
JAVA installation instructions on the phone Samsung
All new 240 x 320 Samsung Touch Screen Game
Free Samsung Star games 240 x 320 - Touch Screen
Free Fullscreen Games for Samsung Star Touch Screen mobile
Creating *. jad file to install applications on the phone Samsung
Free Applications for Samsung Corby Mobiles
SWF wallpaper clock work for Samsung jet, Corby, star ...
Touch Screen Games For Samsung F480 (fully tested)
Samsung Corby S3650 Firmware Update Guide [Avoid sudden power failure]
Samsung I9000 S Galaxy - First Impressions
Hot! Samsung New Wave
How to create a basic theme for Samsung Corby
New Free Samsung Corby Wallpapers 3 in 1
Samsung 4G hands on Epic ( Galaxy Pro S ) - A " super food " 4G
Samsung Corby Games 240x400 & 240x320 Touch Screen
[ Hot ] Update Samsung Star Game for the horizontal

Nov 21, 2009

Inside Apple iPhone

image

iPhone Processor

  • Application Processor (Differs in iPhone, iPhone 3G and 3GS)
  • Baseband Processor (Modem – Again differs with versions)
  • Both of these processor belongs to ARM category

image

Application Processor

1st Generation iPhone

  • Makes use of Samsung S5L8900 processor
  • It holds a clock speed of 620MHz (downclocked to 412MHz)

2nd Generation iPhone (3G)

  • Makes use of Samsung S5L8900 processor
  • It has a clock speed of 835MHz (downclocked to 412MHz)

3rd Generation iPhone (3GS)

  • Makes use of Samsung S5L8920 processor
  • It has a clock speed of 835MHz (downclocked to 600MHz) ARM1176JZF + 100MHz PowerVR SGX 530 graphics core + VPU

Application Processor – Functions

  • Inter communication over UART and i25 channels
  • Separate security measures for each system
  • Execute Mac iPhone OS with integrated security and validation
  • Interacts with baseband processor over secured channels
  • Controls various IC’s like Power management IC, Audio codec, camera sensors, display module, touch modules etc

Baseband Processor – Functions

  • Controls all communication system on the phone
  • Controls WIFI, bluetooth and GSM system
  • Runs its own nucleus encrypted firmware on it thus ensuring the security over communications
  • Effectively communicates with Application processor directly over secured channels
  • 1st generation and 2nd generation iphone uses Infineon S-Gold 2 baseband processor
  • 3rd generation uses Infineon X-Gold 608 baseband processor

iPhone’s Basic Design

iPhone OS architecture is largely OS X

  • Kernel is XNU
  • Basically XNU code compiled for ARM
  • Kernel cannot be modified or re-ported
  • Encrypted using IMG3 container

Spring Board

  • This is the shell
  • User can interact with iphone through springboard
  • Controlled by core libraries

Lockdownd service

  • Handles communication with the computer
  • Services like syncing and AFC
  • Activates iPhone through itunes
  • SSL tunnel between sockets on the computer and the iPhone
  • Lockdownd is more of a daemon

Security Design of an iPhone

Two important Storage Chip  - [NAND Flash disk , NOR device]

  • iPhone OS runs on a NAND flash disk
  • Appears as normal block device to user land
  • Uses Samsung’s “Whimory” FTL
  • OS runs on a read – only System partition (/) and Writable user partition (/Private/Var)
  • Only logical distinctions on top of FTL
  • FTL is the Flash Translation Layer
  • NOR device is completely protected and cannot be written without apple’s signature
  • Signatures are checked in the kernel

Third party applications and installed onto user partition

All executables must be signed by apple

  • Signatures and hashes stored in segments in the Mach –O format
  • Signatures are only checked on startup

Applications runs as the “Mobile” user

  • A “Mobile” user cannot alter the file system

Code signing

  • Signatures are checked in the kernel
  • Must alter kernel in order to run the unsigned applications
  • Signatures are only checked during the startup
  • To modify the system partition “Root” access is needed

Kernel Capabilities and Boot Validations

  • Kernel is stored on the System partition, with all kexts concatenated on Mach –O form
  • Kernel cannot be altered even though user gets access to modify the files on the system partition
  • System partition is a large binary block
  • Kernel is stored on the System partition, with all kexts concatenated on Mach –O form
  • Kernel cannot be altered even though user gets access to modify the files on the system partition
  • System partition is a large binary block

iBoot and other Boot functions

iBoot is analogous to an OpenFirmware boot

  • Loads device tree from NOR
  • Populates the device tree
  • Allows different components to be loaded from different vendors
  • Loads kernel from NAND FTL and executes it

iBoot checks the signature on everything

  • Kernel, device tree, drivers, ram disk, system disk, logos etc
  • Initially iBoot checks the signature of the kernel, then it starts verifying the signature of rest of the OS
  • Device tree differs from iphone, iphone 2G and iphone 3GS

What caused an iPhone to be hacked?

BOOT SEQUENCE OR SIGNATURE CHECKS IN IPHONE (1ST GEN)

  • All user land applications are signature checked by kernel
  • Kernel is signature checked by iBoot
  • iBoot is signature checked by Low Level Bootloader
  • LLB is NOT signature checked by Bootrom, which eventually cause an iPhone to be hacked
  • One has to find an easy way to flash our own Bootloader onto NOR
  • However iPhone 3G and iPhone 3GS has the Low Level Bootloader signature checked by the bootrom

Protections on iPhone File system

All data is encrypted by keys derived from a hardware AES key

  • Keys cannot be read
  • Cannot skip the signature checks without keys

File system is encrypted with “FileVault”

  • FileVault key is stored in Ramdisk, which is encrypted with the hardware key
  • Expected SHA1 hash for the filesystem is also stored on the encrypted and signed ramdisk, thus preventing its alteration
  • Unsigned ramdisk cannot be executed or will not be recognized as SHA1 hash is different

Signature checks Flowchart

image

  • iPhone is secured with various signatures as long as this chain isn’t broken

image

Baseband Hardware/Architecture

  • 1st Generation and iPhone 3G uses X-Gold 2 Infineon Chipset
  • iPhone 3GS uses S-Gold Infineon chipset
  • Boot Process is entirely separate from S5L (Application processor)
  • Connected to Application processor via UART, some GPIOs, I2S, and some DMA
  • Controls all radio peripherals
  • Unique X-Gold and NOR chip IDs
  • iPhone 3G and 3GS holds a GPS module
  • Nucleus OS is the firmware on the Baseband
  • (U)SIM support, speech and data via I2S
  • Bootloader and bootrom is present like the application processor
  • First few sectors in NOR is the boot loader
  • Specific header with two entry points (Normal and service mode)
  • This also includes a special modes called as Trusted Device Mode which is a complicated one
  • Bootloader NOR Sectors in 1st Gen phones are “Locked down” in NOR via GPIO pin
  • Baseband firmware is RSA checked

Baseband Firmware Updates Process

Produces signed secpack (Basically security packets)

  • Secpack defines which NOR addresses are allowed to be written or erased
  • Holds the RSA signature of the main firmware
  • Secpack is signed by apple and holds many other signatures

Later it sends firmware and EEPROM parameter blocks

EEP and FLS are the firmware files produced by Apple in order to flash the baseband

Baseband - Chain Of Trust

  • Tables describing which MNC/MCC iphone is locked to and conditions of the lock based on the IMEI which Is signed with RSA key
  • RSA encrypted S-Gold and NOR dependant token stored TEA-Encrypted with SIM unlock code
  • Need to enter SIM unlock code (NCK) in order to unlock the baseband to open it to all carriers
  • Tables holds the details whether the phone is locked or not
  • While verifying the firmware if the signature is bad, Bootloader displays Spinning Wheel of Death forever

Security initiatives in iPhone versions

  • iPhone 1st generation’s bootloader was not signature checked by bootrom and hence it was easily hackable
  • iPhone 3G and 3GS had its bootloader signature checked by the bootrom and its merely impossible to run an unsigned code in the bootloader
  • Additionally iPhone 3GS had a firmware downgrade proof system, in which firmware’s signature was validated by Apple’s server and thus ensuring that only latest firmware is used to flash the iPhone 3GS
  • Firmware integrity check is done by iTunes for a 3GS via Apple server

Inside Apple iPhone

image

iPhone Processor

  • Application Processor (Differs in iPhone, iPhone 3G and 3GS)
  • Baseband Processor (Modem – Again differs with versions)
  • Both of these processor belongs to ARM category

image

Application Processor

1st Generation iPhone

  • Makes use of Samsung S5L8900 processor
  • It holds a clock speed of 620MHz (downclocked to 412MHz)

2nd Generation iPhone (3G)

  • Makes use of Samsung S5L8900 processor
  • It has a clock speed of 835MHz (downclocked to 412MHz)

3rd Generation iPhone (3GS)

  • Makes use of Samsung S5L8920 processor
  • It has a clock speed of 835MHz (downclocked to 600MHz) ARM1176JZF + 100MHz PowerVR SGX 530 graphics core + VPU

Application Processor – Functions

  • Inter communication over UART and i25 channels
  • Separate security measures for each system
  • Execute Mac iPhone OS with integrated security and validation
  • Interacts with baseband processor over secured channels
  • Controls various IC’s like Power management IC, Audio codec, camera sensors, display module, touch modules etc

Baseband Processor – Functions

  • Controls all communication system on the phone
  • Controls WIFI, bluetooth and GSM system
  • Runs its own nucleus encrypted firmware on it thus ensuring the security over communications
  • Effectively communicates with Application processor directly over secured channels
  • 1st generation and 2nd generation iphone uses Infineon S-Gold 2 baseband processor
  • 3rd generation uses Infineon X-Gold 608 baseband processor

iPhone’s Basic Design

iPhone OS architecture is largely OS X

  • Kernel is XNU
  • Basically XNU code compiled for ARM
  • Kernel cannot be modified or re-ported
  • Encrypted using IMG3 container

Spring Board

  • This is the shell
  • User can interact with iphone through springboard
  • Controlled by core libraries

Lockdownd service

  • Handles communication with the computer
  • Services like syncing and AFC
  • Activates iPhone through itunes
  • SSL tunnel between sockets on the computer and the iPhone
  • Lockdownd is more of a daemon

Security Design of an iPhone

Two important Storage Chip  - [NAND Flash disk , NOR device]

  • iPhone OS runs on a NAND flash disk
  • Appears as normal block device to user land
  • Uses Samsung’s “Whimory” FTL
  • OS runs on a read – only System partition (/) and Writable user partition (/Private/Var)
  • Only logical distinctions on top of FTL
  • FTL is the Flash Translation Layer
  • NOR device is completely protected and cannot be written without apple’s signature
  • Signatures are checked in the kernel

Third party applications and installed onto user partition

All executables must be signed by apple

  • Signatures and hashes stored in segments in the Mach –O format
  • Signatures are only checked on startup

Applications runs as the “Mobile” user

  • A “Mobile” user cannot alter the file system

Code signing

  • Signatures are checked in the kernel
  • Must alter kernel in order to run the unsigned applications
  • Signatures are only checked during the startup
  • To modify the system partition “Root” access is needed

Kernel Capabilities and Boot Validations

  • Kernel is stored on the System partition, with all kexts concatenated on Mach –O form
  • Kernel cannot be altered even though user gets access to modify the files on the system partition
  • System partition is a large binary block
  • Kernel is stored on the System partition, with all kexts concatenated on Mach –O form
  • Kernel cannot be altered even though user gets access to modify the files on the system partition
  • System partition is a large binary block

iBoot and other Boot functions

iBoot is analogous to an OpenFirmware boot

  • Loads device tree from NOR
  • Populates the device tree
  • Allows different components to be loaded from different vendors
  • Loads kernel from NAND FTL and executes it

iBoot checks the signature on everything

  • Kernel, device tree, drivers, ram disk, system disk, logos etc
  • Initially iBoot checks the signature of the kernel, then it starts verifying the signature of rest of the OS
  • Device tree differs from iphone, iphone 2G and iphone 3GS

What caused an iPhone to be hacked?

BOOT SEQUENCE OR SIGNATURE CHECKS IN IPHONE (1ST GEN)

  • All user land applications are signature checked by kernel
  • Kernel is signature checked by iBoot
  • iBoot is signature checked by Low Level Bootloader
  • LLB is NOT signature checked by Bootrom, which eventually cause an iPhone to be hacked
  • One has to find an easy way to flash our own Bootloader onto NOR
  • However iPhone 3G and iPhone 3GS has the Low Level Bootloader signature checked by the bootrom

Protections on iPhone File system

All data is encrypted by keys derived from a hardware AES key

  • Keys cannot be read
  • Cannot skip the signature checks without keys

File system is encrypted with “FileVault”

  • FileVault key is stored in Ramdisk, which is encrypted with the hardware key
  • Expected SHA1 hash for the filesystem is also stored on the encrypted and signed ramdisk, thus preventing its alteration
  • Unsigned ramdisk cannot be executed or will not be recognized as SHA1 hash is different

Signature checks Flowchart

image

  • iPhone is secured with various signatures as long as this chain isn’t broken

image

Baseband Hardware/Architecture

  • 1st Generation and iPhone 3G uses X-Gold 2 Infineon Chipset
  • iPhone 3GS uses S-Gold Infineon chipset
  • Boot Process is entirely separate from S5L (Application processor)
  • Connected to Application processor via UART, some GPIOs, I2S, and some DMA
  • Controls all radio peripherals
  • Unique X-Gold and NOR chip IDs
  • iPhone 3G and 3GS holds a GPS module
  • Nucleus OS is the firmware on the Baseband
  • (U)SIM support, speech and data via I2S
  • Bootloader and bootrom is present like the application processor
  • First few sectors in NOR is the boot loader
  • Specific header with two entry points (Normal and service mode)
  • This also includes a special modes called as Trusted Device Mode which is a complicated one
  • Bootloader NOR Sectors in 1st Gen phones are “Locked down” in NOR via GPIO pin
  • Baseband firmware is RSA checked

Baseband Firmware Updates Process

Produces signed secpack (Basically security packets)

  • Secpack defines which NOR addresses are allowed to be written or erased
  • Holds the RSA signature of the main firmware
  • Secpack is signed by apple and holds many other signatures

Later it sends firmware and EEPROM parameter blocks

EEP and FLS are the firmware files produced by Apple in order to flash the baseband

Baseband - Chain Of Trust

  • Tables describing which MNC/MCC iphone is locked to and conditions of the lock based on the IMEI which Is signed with RSA key
  • RSA encrypted S-Gold and NOR dependant token stored TEA-Encrypted with SIM unlock code
  • Need to enter SIM unlock code (NCK) in order to unlock the baseband to open it to all carriers
  • Tables holds the details whether the phone is locked or not
  • While verifying the firmware if the signature is bad, Bootloader displays Spinning Wheel of Death forever

Security initiatives in iPhone versions

  • iPhone 1st generation’s bootloader was not signature checked by bootrom and hence it was easily hackable
  • iPhone 3G and 3GS had its bootloader signature checked by the bootrom and its merely impossible to run an unsigned code in the bootloader
  • Additionally iPhone 3GS had a firmware downgrade proof system, in which firmware’s signature was validated by Apple’s server and thus ensuring that only latest firmware is used to flash the iPhone 3GS
  • Firmware integrity check is done by iTunes for a 3GS via Apple server

Text Widget

Copyright © Vinay's Blog | Powered by Blogger

Design by | Blogger Theme by