Errata

In the listing of launchd.c in example 2-5, the definition of the cp function is omitted, which results in failure when trying to build the example. The definition of the cp function can be found later in the book, in Chapter 5, in example 5-1 (spyd.c), at pp.133-134.

I had this confirmed with the author, and just wanted to make sure that the page gets updated for the benefit of other readers.

Hi,

Just managed to deploy the launchd example to the iPhone and when I did that, the phone goes into a loop, literally bricks the phone, text goes up the screen like mad and the screen went white just now. I am hoping this is not going to brick my phone.

Here is how the screen looks like now:

http://dl.dropbox.com/u/32143863/Photo%20on%2002-05-2012%20at%2023.36.jpg

I cannot even turn the phone off right now. I'll wait till the battery dies and then restart it. This needs to be looked at immediately.

The code example provided online for launchd.c at http://examples.oreilly.com/0636920023234/ch03/ does not correspond to the code given in the text in Example 3-4 (launchd.c).

Two major issues exist in various parts of the code:

a. The disk paths are not the same e.g. in the book the most recent paths are used ("dev/disk0s1s1") while in the code examples older/incorrect paths are used ("dev/disk0s1").

b. The custom operations section in the example code is not the same with the code given in the text. Several cp and chmod operations are missing, e.g. cp("/files/sh", "/mnt/bin/sh"). Also, in the code online, unlink is called on payload.

Please, make sure that the two versions match and add some comments regarding disk paths in older versions of iOS.

The example code that JZ recommends you input doesn't work without some changes to the rest of the code.

I was getting the error below:

Traceback (most recent call last):
File "python_scripts/emf_undelete.py", line 24, in <module>
do_emf_carving(volume, carveokdir, carvenokdir)
File "/iPhone/iphone-dataprotection/python_scripts/hfs/journal.py", line 146, in do_emf_carving
if isDecryptedCorrectly(data):
TypeError: isDecryptedCorrectly() takes exactly 2 arguments (1 given)

The function: "def isDecryptedCorrectly(data, filekey):" is parsed 2 parameters data and filekey, but when called is only parsed "data" in original code from

Searching the file for "if isDecryptedCorrectly(data):" and replacing with "if isDecryptedCorrectly(data, filekey):" worked for me.

I also had to declare the following at the top of the file journal.py

import commands
import os

After that all worked ok.

When I attempt to cross-compile the SSLTheft payload with the commands shown, I get the following error (running OS X 10.6.8):
injection.m: In function ?initialize?:
injection.m:43: warning: passing argument 3 of ?class_addMethod? from incompatible pointer type
injection.m:49: warning: passing argument 3 of ?class_addMethod? from incompatible pointer type


The POSTTheft payload presents me with a similar error.

I found additional information about the error here:
http://gcc.gnu.org/wiki/FAQ
http://c-faq.com/ansi/constmismatch.html

The code sample compares the result of lstat() with non zero, but lstat() returns zero on success.

if (lstat("/Applications", &s) != 0) {
}

Should be:

if (lstat("/Applications", &s) == 0) {
}