Not so long ago, mapping WiFi required a laptop, GPS, a big antenna and Kismet/NetStumbler. Today’s smartphones have replaced even this task. For those of us running a GPS and WiFi equipped Windows Mobile phone, WiFiFoFum is an excellent and simple solution, as well as a great companion for installing an AP. Start up WiFiFoFum, put your phone on the dash and let it collect the locations of the APs you find while driving around. You can then save the file in several formats: XML, txt, Wi-scan, POI Database, MemoryMap, Netstumbler, and even as a KML File for Google Earth/Google Maps. We have also found it to be a really handy tool for setting up WiFi in a large area, to help find the best home for the router which provides the best coverage. WiFiFoFum is also available for the iPhone via the App Store.

In middle of all the adding features that should have been available day-one, Apple announced something really interesting for the hardware hacking community. The new iPhone 3.0 OS will support application communication over bluetooth or through the dock connector using standard or custom protocols. From Engadget’s coverage:

10:19AM “They talk over the dock, and wirelessly over Bluetooth. Things like playing and pausing music, getting artwork — or you can build your own custom protocols.”
10:19AM “Now here’s a class that we think will be really interesting — medical devices.” Scott’s showing off a blood pressure reader that interfaces with the iPhone — wild.
10:18AM “Here’s an example — an FM transmitter. With 3.0, the dev can build a custom app that pairs up with it, and automatically finds the right station and tunes it in.”
10:18AM “With 3.0, we’re going to enable accessory developers to build custom apps that talk directly to that hardware.”

No solid connection specification has been published yet. We’re excited about the prospect of developing our own accessory hardware, but we wonder what sort of hoops you’ll have to jump through. Apple doesn’t have the best track record when it comes to approvals. Just this week they denied MSA Remote client App Store entry; it’s a multitouch client that uses the standard TUIO protocol. Prepare for similar roadblocks in the future.

[via adafruit]

As promised, the iphone-dev team has released yellowsn0w. You can install/uninstall via Cydia. It works fine with the latest firmware too. This sentence is filler.

As promised in their yellowsnow demo, [pytey], [MuscleNerd], and [planetbeing] from the iphone-dev team presented at 25C3 on their work Hacking the iPhone. The team originally formed in 2007 and this is the most comprehensive presentation on how the iPhone was compromised to date. You can find the full talk embedded above.

They opened with a few stats about how popular their software is. Our favorite by far is that at least 180 people with Apple corporate IPs update their phones using the dev-team’s software on a regular basis. From there the talk was split into two sections: jailbreaking the S5L application processor and unlocking the S-Gold baseband processor.

The phone relies on a chain of trust to guarantee that only Apple’s code is being run on it. All of userland is signature checked by the kernel. The kernel is checked when loaded by iboot. The iboot image is checked when loaded by LLB. LLB is loaded from the NOR by the lowest piece of code, the bootrom. That’s where things fall apart; the bootrom does not check the signature of the LLB. To take advantage of this, the team found what they describe as a classic stack buffer overflow in DFU mode. DFU is Device Firmware Upgrade mode, a state that the phone can be forced into after the bootrom loads. Their exploit forces the certificate check to return ‘true’. They are then able to patch all of the subsequent signature checks out of the phone’s system.

The baseband processor proved to be much more difficult simply because it doesn’t have any sort of recovery mode; bricking a phone was always a possibility. The S-Gold is a complete system-on-chip and has a unique ID on each phone. The NOR also has a unique ID on each phone. These two IDs are used to sign the secpack, which in turn enforces the SIM carrier lock. These unique IDs are why you can’t just take an officially unlocked phone and copy the secpack off of it to unlock another phone. Everything else is identical: the firmware, the baseband, the bootroom are all the same. On the second generation iPhone, the bootrom checks the bootloader. The bootloader then verifies the bootrom before checking and then loading the firmware. The firmware enforces the carrier lock. The team decided that it wasn’t worth attempting to break the chain of trust. The SIM unlock code they developed is divided into two sections. The first part is the actual software unlock. They patch the firmware while it’s running in RAM. Their patch modifies the firmware’s decision tree about whether to enforce the carrier lock. The second half is the exploit that allows them to inject the code. The team knows that Apple can and probably will patch the exploit hole, but their RAM patching code will always work, so it’s just a matter of finding another hole to apply it through. In order to do a permanent unlock solution (like on the first generation iPhone), they’d need to analyze the actual bootrom code.

The team mentioned several things Apple did that actually helped them in their efforts. Security was gradually rolled out, so they were able to look at things that would eventually be hidden. The firmware was initially unencrypted. Earlier versions trusted iTunes, something they could easily modify. All userland apps originally ran as root meaning any application exploit gave root level access.

The iphone-dev team has truly put in a tremendous amount of effort and we look forward to the yellowsn0w release on New Year’s Eve.

Hackers are continuing to outpace Apple with feature additions. The team at iMobileCinema has created a flash plugin for the Mobile Safari browser. It’s a beta release and still a bit buggy. This app is only available to people who have jailbroken their iPhones. You just need to add d.imobilecinema.com to your sources in Cydia to get the package to appear. While it can crash from time to time, it’s certainly better than no support at all.

[via Gizmodo]

[Stephen Myers] has been toying around with some beta ioBridge hardware. He decided to build a remote control dog treat dispenser. ioBridge‘s hardware is built specifically to make web enabling projects easy. The main controller board has four I/O channels that speak to addon modules. It has an ethernet port on the main board and an easy to configure website.

[Stephen] used a servo addon board for his project. The dispenser is built from a scrap CD spindle attached to a servo. He can issue commands from his iPhone, which shows live video of the kennel. He’ll be building several other automation projects based on this system.

[via TUAW]

Embedded above is a demo video of an iPhone running a Linux 2.6 kernel. The iphone-dev team has created a new bootloader called OpeniBoot. The bootloader lets you boot into a Linux console, which you can talk to over a USB serial device. They’ve got busybox working, but there is no touchscreen support yet. The instructions are not that difficult and include how to back up your settings. It works on first and second gen iPhones and first gen iPod Touch. This is a very early port, but the future is wide open… Android iPhone?

Tellart turned an iPhone into a duiPhone with its latest Sketchtools kit. Combine a 3G iPhone, an ordinary store-bought breathalyzer, and the NADA Mobile, which consists of a communication board, sensors, and actuators, and get a useful iPhone application. Blow into the mouthpiece, and the iPhone will inform you if you can safely drive, or if you should call a cab.

We’d like to find out more about the NADA Mobile, since it looks like it could be the start of a lot of fun projects. It’s the latest of Tellart’s Sketchtools line, which can only be accessed if you work with Tellart as a consultant, or if you work with them to organize a workshop for your organization.

[via Digg]

The iphone-dev team has officially stated “all that remains is implementation“. They’ve developed all the pieces they need to perform a software unlock for the iPhone 3G, now it’s just a matter of putting them together in user friendly fashion. They’ve managed to run unsigned code on the baseband, developed custom AT tools, and are now showing injection of a background task. They will combine all of these techniques to override the carrier lock baseband code. As usual, they warn against performing any official firmware updates to the phone.

Google recently updated their Google Mobile App with a couple new features. Voice Search automatically starts listening when you raise the phone to your ear. Just say what you’re looking for, and it will poll Google and return the results. The app leverages Google’s voice recognition engine, which they’ve been training with Goog-411. [Andy Baio] has been experimenting with audio transcription and was curious what the new app was doing behind the scenes. He started by sniffing the packets as they traversed his network. Unfortunately, the size of the data packets transmitted is so small that he’s almost certain he’s missing something. He’d appreciate any help in this endeavor. Part of the problem might be Google getting special treatment and using undocumented iPhone SDK features.

We spotted an interesting app in Gizmodo’s iPhone roundup for the week. iNap is designed for commuters that don’t want to miss their train stop. Just pick any location you can find on Google Maps, set the distance for the alert radius and the alarm tone, and it’s ready. It’s a great app and only costs $1.

The app actually reminds us of the first time we heard about Bug Labs. The modular gadget building system was described to us as a way to build unconventional consumer electronics. They specifically talked about one person that built an alarm clock with GPS because he kept falling the asleep on the train. Thanks to convergence we’re seeing a lot of devices expand from their initial intentions, whether it’s an iPhone GPS alarm clock or an N95 being used auto upload your bike ride to Flickr.

[chris] sent in his own round up of his personal projects.

[Chris Coleman] let me know about hacktherazr. They’ve got some decent guides on customizing just about everything on the things.

[Ben Heck] got sick of emails, so he’s offering to build one more xbox 360 laptop, if you give him a pile of money.

Staring sunday, I’ll be ripping the hell out of my new house (and re-doing most of the upstairs). Do me a favor and keep the tips line brimming over.

[David] has some interesting ideas involving wireless AP antennas and wireless keyboards. How about a cantenna…