cross-posted from: https://infosec.pub/post/54044619
Ok, so this is hilarious. A few years ago I forget the PIN to my iPad mini 1 and basically everything else about it. When I dredged the device out of its bin, I knew pretty much nothing about it! Like the PIN, iOS version, or even if it had any photos on it. (Well, apparently, I changed the PIN to 123456 to be smart)
Instead of just trying a basic PIN like this, I tried the PINs that I thought it was. Then I tried following some Reddit posts from AsyJAIZ in order to get the device into pwnDFU mode and then creating a ram disk manually... which was misguided. In hindsight, the post from AsyJAIZ just sucks. A lot of what they tell you to do could have been simplified far more than it was.
I waited a few years to pick this up again, and then a week-long journey that required an Arduino Uno R3, USB Host Shield, a fork of checkm8, hacktiv8, the Google Code iphone-dataprotection repository plus some code from AsyJAIZ (and myself), tuanemss/32bit-Bruteforce-Passcode, and developing on MacOSX Yosemite 10.10 with the iOS 8.1 SDK. I decided to eventually just ignore AsyJAIZ's written instructions and instead look into their GitHub repository and apply those patches (which were actually helpful) to a different repository (by dinosec on GitHub), compile it using some SDKs, and then replace files used by tuanemss' shell scripts which then bake a final Ramdisk for me! All I really did was write some C code to try PINs in a different order.
I unlocked the device and it went into iCloud activation lock (which I had to bypass with hacktiv8), then I transferred the three (3) photos off the device. In the end there wasn't much reward for having done all this, besides a few pictures of my dog.
Anyway, it's been an insane journey and I hate myself now. If anything I actually have a good reason now to hate anything Apple makes (at least it pisses off law enforcement). The last apple device I will ever own is my 4 year old SE.
