February 6th, 2009 by ahoogWhile performing forensic testing on an 3G iPhone using the techniques outlined by Jonathan Zdziarski in his book “iPhone Forensics“, I discovered the xpwn tool (by planetbeing) pre-compiled for OS X was not up to date (missing many of the firmware bundles which contain the encryption key and initialization vectors to uncompress the RAM disk .dmg images). I switched over to the Linux workstation however the Linux pre-compiled binaries of xpwn complained about my version of GLIBC with the following error:
/home/ahoog/src/XPwn-0.5.5-Linux.broke/xpwntool: /lib32/libc.so.6: version `GLIBC_2.4′ not found (required by /home/ahoog/src/XPwn-0.5.5-Linux.broke/xpwntool)
So I figured I would just build from source. Planetbeing was nice enough to write up build directions however for my Debian Etch, I had to do a few different things to get it to compile and work. Below are the steps I took to make everything work, adapted from Planetbeing’s direction:
- apt-get install build-essential
- apt-get install libz-dev libusb-dev libssl-dev libbz2-dev libpng12-dev (changes from planetbeing’s BUILD doc listed below)
- libssl-dev instead of libcrypt-dev
- libbz2-dev instead of libbz2-dev3
- added libpng12-dev
- Install git-core and associated files to download the source (GitHub kept failing with a 404 when trying to download from the website link)
- apt-get install git-core git-arch git-cvs git-svn git-email git-daemon-run gitk gitweb cogito git-doc rsync curl
- git clone git://github.com/planetbeing/xpwn.git
- install cmake (per BUILD)
- wget http://www.cmake.org/files/v2.6/cmake-2.6.2.tar.gz
- tar zxvf cmake-2.6.2.tar.gz
- cd cmake-2.6.2
- ./configure
- make
- sudo make install
- Create and cd to build folder
- cmake ~/xpwn
- make
- make package
- executables and files located in ~/build/_CPack_Packages/Linux/TBZ2/XPwn-0.5.5-Linux
Hope this helps Debian/iPhone folks out.
Andrew
Jonathan provides the firmware bundles for the encryption keys on his website. http://www.zdziarski.com/iphone-forensics/Windows_Utilities/
My question to you is this: What libraries did you install to get xpwn to work on the mac? I’ve run into nothing but BUS errors. I’m very curious what I’m doing wrong. Anyway, if nothing, I hope this post was helpful for the firmware info.
Correction to my post earlier, You can go here for a listing of info – http://www.zdziarski.com/iphone-forensics/
Christopher,
I don’t recall having to install any libraries on the Mac to get xpwn to run. But, since it was out of date and I did not check Zdziarski’s website first, I went ahead and simply compiled it on Linux. Since the xpwn page was updated on 1/9/09, the version now available is also different than the one I tested. I’ll try to check the new app on my Mac soon and let you know. If you decide to compile on the Mac and want to write up the directions, please let me know. Thanks.
-Andrew