In most cases jailbreaking modern iOS devices is a trivial process except devices that were updated to the latest iOS version. In my specific case I had my old iPhone 5 with iOS 8.2 available for experiments, but, unfortunately, it wasn’t possible to update this device to anything but iOS 10.2.x. Jailbreak for iOS 10.2.x on iPhone 5 wasn’t available as of January 2017, so I decided to move on with already installed iOS 8.2 and try to jailbreak two-year-old OS with TaiG tool.

First of all, it should be noted that success of whole process depends on right combination of installed iTunes (Apple Mobile Device Support package on Windows) and jailbreak tool version, which, in turn, supports your iOS version. To be honest, I don’t feel myself comfortable running applications created by Chinese hackers on my work machine, that’s why I completed all steps below on my old HP XW6600 with installed Windows 7 on it. I didn’t consider virtual machine usage due to reported issues of TaiG Jailbreak Tool running on VM.

There are two jailbreak options available for iOS 8.x series from TaiG and Pangu, but only TaiG supports iOS 8.2 and available in both Windows and OS X versions. Last version of TaiG Jailbreak Tool for iOS 8.x is v2.4.5, but alas, it doesn’t work with iOS 8.2, installed on my iPhone 5. I’ve tried to run it with different iTunes versions, but had no luck. So I decided to rollback to v2.4.3 in conjunction with iTunes v12.1.2.27. Looking ahead I can say that this combination was successful and I was able to jailbreak my iPhone 5 with it.

TaiG Jailbreak Tool prevents you from running previous versions of application by checking the version of launched application with the last one available on TaiG homepage. This check is obligatory and blocking. Also it won’t allow you to run the tool when TaiG Update Check service is unavailable what happens sometimes.

1/4

TaiG Jailbreak Tool V2.4.3 requires you to install the latest v2.4.5 on launch

Turning off internet connection does not help to bypass update check

So what can we undertake here? There are a lot of tools that allow us to view what requests are sent from our computer and what responses it receives. They are called packet sniffers or analyzers. Even the simplest one will cover our needs as we need to determine only URL of the Update Check request.

HTTPNetworkSniffer is a simple packet sniffer tool that captures all HTTP requests/responses, and that information is enough for us in this specific case. Alternatively, you can use monstrous Wireshark, that can capture everything, but let’s keep things simple.

With help of HTTPNetworkSniffer we can figure out that TaiG Jailbreak Tool sends request to i_get_taig_pc_config.php with data GET parameter, probably, the current version signature:

http://f_bb.taig.com/Interface/i_get_taig_pc_config.php?data=sU40nFL43ykkDN0HS445RDwWUi%43RPgyKpSJ21HdsDDCRyNarODu%2FHGXEE5Wxf%2FJPYlzztfTSYkw940%0D%0AdcsVU20AXAF0WQD92%2Ff9yI324FCMGEvE%3D

Now, when we know this detail, we can emulate work of Update Check logic on our local server and point TaiG Jailbreak Tool to it.

But first we need to get successful Update Check request response structure. To get it we can run the latest TaiG Jailbreak Tool v2.4.5 and capture Update Check request URL with HTTPNetworkSniffer. Putting this URL into any browser will reveal JSON response structure that application gets in case of successfully passed check:

[{
  "VERSION": "",
  "TIME": 600,
  "RESULT": 0
}, {
  "status": 1
}]

That’s all we need to emulate Update Check service. We can skip data GET parameter analysis as our Update Check service will respond with success for all application versions.

Let’s use simple web server Mongoose to host plain text file as i_get_taig_pc_config.php. Re-create next folder structure and put successful JSON response, mentioned above, into i_get_taig_pc_config.php.

|_____c:
|  |_____wwww
|  |  |_____Interface
|  |  |  |_____i_get_taig_pc_config.php

Run Mongoose with following command-line arguments:

c:\ > mongoose.exe -document_root C:\www -listening_port 80 -cgi_pattern ""

Final step - append Windows hosts file (C:\Windows\System32\drivers\etc\hosts) with new line to point TaiG Jailbreak Tool to our masqueraded service instead of genuine one:

127.0.0.1		f_bb.taig.com

Now we are ready to launch any version of TaiG Jailbreak Tool or reload already launched application by pressing Try Again button.

1/4

You can select preferred options and proceed to jailbreak

This step could take about 15 minutes. If it stucks longer, try to attach your iPhone into another USB port.

After approximately 15 minutes and several iPhone reboots you will get access to unrestricted iOS environment perfect for debugging and reverse engineering.

Similar steps could be used to overcome updates checks in most applications. In fact, described approach could be classified as spoofing attack, which aims to masquerade one person or service (endpoint) as another by falsifying data, thereby gaining an illegitimate advantage (successfully passed update check).

Speaking of APIs for updates check and beyond, use of secure HTTP instead of plain together with SSL pinning can make this type of attack more difficult or indeed impossible.

Despite such architecture, you still can add dynamic features like comments or search by using third-party services (e.g. Disqus, Google Custom Search). I really like the idea of ramping up functionality on top of a simple but flexible base, instead of cutting off complex universal engines.

Here’s shortened list of commands, settings, plugins, Liquid tags and filters which I frequently use while working with Jekyll.

Setting Up and Running

# Install Jekyll and Bundler through RubyGems
$ gem install jekyll bundler

# To be able to run Jelyll without prefixing it with bundle exec ensure that you do not
# have different versions of the same gems installed simultaneously on your machine
$ sudo gem update
$ sudo gem cleanup

# Create new Jekyll blog with default theme (minima)
$ jekyll new blog-directory
	
# After adding new dependencies to Gemfile and _config.yml execute `bundle`
# to download them
$ bundle
# or check updates availability for dependencies and install them
$ bundle update

# Run server. All changes will be automatically applied, except changes in _config.yml 
# (server restart is required to pick them up).
$ jekyll s

# Process and render draft posts
$ jekyll s -D

# Publish posts or collection documents with a future date
$ jekyll s --future

# Run production environment (with Google Analytics and Disqus turned on)
$ JEKYLL_ENV=production jekyll serve
# you can specify server host (to be able to test from other devices in same network) 
$ JEKYLL_ENV=production jekyll s -H 192.168.1.47

# Just build production html to _site directory (output path could be changed with -d argument)
$ JEKYLL_ENV=production jekyll build

# You can use multiple configuration files to override Jekyll options (e.g. use `_dev.yml` to 
# disable HTML compression while running development environment)
$ jekyll s --config _config.yml,_dev.yml

# And finally, of course, you can print help for Jekyll
$ jekyll —help
# or review help for specific subcommand
$ jekyll build —help

Configuration Settings

Most of the Jekyll command-line arguments can be specified in configuration YAML file. By default Jekyll loads _config.yml, but you can specify one or more custom configuration files with --config command-line argument.

You can create two separate configuration files for development and production. For instance, if you use octopress-minify-html plugin, it’s a good idea to skip HTML compression while building or running server for development purposes. To achieve it you can create separate _dev.yml file with the following setting:

env: dev

and run your serve or build command with --config argument:

$ jekyll s --config _config.yml,_dev.yml

Settings from _dev.yml will override corresponding values from _config.yml.

All settings from your configuration are available through your posts and pages via site object. Also, you can add any custom settings to your configuration file, which will be available through site object too. Third-party plugins often use this ability to configure itself.

YAML Front Matter

In the YAML Front Matter section you can set predefined variables or create custom ones for using them in Liquid tags within further down code and also in all included files and layouts that the current page or post depends on.

There are few predefined global variables: layout, permalink, published. Posts predefined variables: date, category, categories, tags.

---
layout: post
title:  "New Testshare Post with Comments"
date:   2017-02-04 11:17:29 +0200
permalink: welcome/
share: false
comments: false
sitemap: true
image:
  facebook: img/facebook.png
  twitter: img/twitter.png
---

To use these values in Liquid tags you should refer page or post objects:

...
<head>
  <title>{{ page.title }}</title>
</head>
...

You can set default values for your YAML Front Matter variables in _config.yml to avoid repeating of the same lines in all post files:

defaults:
  - scope:
      path: "" # all files within the project
    values:
      image: 
        facebook: /assets/images/max-fb.png
        twitter: /assets/images/max-twitter.png
        width: 200
        height: 200
      share: true

Liquid Tags and Filters

Variables

{% assign integer = 10 %}
{% assign condition = false %}
{% assign string = "Hello World!!!" %}

Control Flow

{% if condition %}
  ...
{% elsif second_condition %}
  ...
{% else %}
  ...
{% endif %}

Iterations

{% for slide in site.data.about-slides %}
  <img src="{{ "/img/" | append: slide.image | relative_url }}">
{% endfor %}

Includes

The include tag allows you to include content from another file stored in the _includes folder. You can pass parameters to included piece of code from a parent file.

<!-- post.html -->
...
{% include slideshow.html slides=site.data.about-slides max-width=500 %}
...

<!-- slideshow.html -->
...
{% for slide in include.slides %}
  <img src="{{ slide.image }}" style="max-width: {{ include.max-width }}px;">
{% endfor %}
...

URL Filters

{{ "/assets/style.css" | absolute_url }}
Output: http://127.0.0.1:4000/jekyll/assets/style.css

{{ "/assets/style.css" | relative_url }}
Output: /jekyll/assets/style.css

{{ "Email info@liquid.com" | cgi_escape }}
Output: Email+info%40liquid.com

Markdown Extra Image with Caption

By default Jekyll uses kramdown as a Markdown processor, which is enhanced with features that are found in other Markdown implementations like Maruku, PHP Markdown Extra and Pandoc. For instance, it supports attribute list definitions with the help of which you can add attributes to block and span-level elements.

Let’s say you have following styles:

.center {
  text-align: center;
}

.thumbnail {
  border: 1px solid $grey-color-light;
  border-radius: 4px;
  padding: 4px;
  margin: 5px 0px;
}

.caption {
  display: block;
  font-style: normal;
  font-size: $small-font-size;
  color: $grey-color;
  line-height: 1.4;
  margin: auto;
}

You can use them to insert image with caption using next Markdown Extra text:

![Surprised ALF]({{ "/assets/images/surprised-alf.gif" | relative_url }} "Oops!"){:.thumbnail}
*I guess we'll have to order in*{:.caption}
{:.center}

I guess we’ll have to order in

Note that you mustn’t have an empty line between the image and the caption. Also, attribute lists should immediately follow their blocks or elements.

Jekyll Plugins

• jekyll-feed - generates an Atom feed of your posts
• jekyll-sitemap - generates a sitemaps.org compliant sitemap for your Jekyll site
• jekyll-paginate - enables pagination for your blog
• jekyll-seo-tag - adds metadata tags for search engines and social networks to better index and display your site’s content
• octopress-minify-html - minifies Jekyll’s HTML output by removing whitespace junk with HtmlPress

Useful Links

• Jekyll Directory Structure
• Liquid Documentation
• kramdown Syntax
• SEO in Jekyll
• Mobile-Friendly Test

1/4

Everyday Max - software engineer - designs and develops iOS and macOS applications in Swift and Objective-C

On weekends - UAV designer and pilot - draws, builds, tests unmanned aerial vehicles (drones)

During vacation, you can see me riding my bicycle somewhere in distant places like the Indian Himalayas

Or closing ski season in May. I prefer backcountry skiing in remote serene sites like Gulmarg with lots of steep and deep.

And sometimes, I even train to pilot a real Yak-52. Who didn't dream of being an astronaut or at least an aircraft pilot?

But first things first. My IT journey started in 1999, when I was 10, from an ancient IBM 386 with 2MB of RAM and fake¹ green Turbo button, DOS and QuickBASIC IDE. A few years later, I was lucky enough to get subscribed to Xakep magazine (‘Hacker‘ in russian spelling), which positioned itself as a “computer hooligans journal“. Kris Kaspersky’s articles, together with wasm.ru, left a lasting impression on me. I still remember the feeling I experienced when my custom-modified Phoenix BIOS started successfully for the first time after two previous motherboards’ incapacitation. Those were really exciting and carefree times, which have defined my future place in IT.

In 2006, I entered the National Bohdan Khmelnytsky University of Cherkasy, Ukraine, at the Faculty of Information Technologies and Biomedical Cybernetics. During my second year of studying, I got my first part-time job as a Flash/AS Developer. Four years later, I received a bachelor’s degree in Computer Software Engineering.

In early 2009, I went through Hackintosh hell on my cheap Intel Celeron without SSE3, which proved my sense of purpose and allowed me to develop and release my first iPhone OS Application in the fall of 2009. Since then, I have completely moved to native iOS development and become inseparable from the Apple ecosystem. It has captivated me with its attention to detail, environment predictability, consistency, and ability to reach millions of App Store users.

Since 2010, I have participated in numerous mobile projects as an iOS engineer, mobile team lead, and architect. My web and networking background allows me to be a key contributor in complex client-server architectures that require offline-first experience, local and remote database synchronization, and variable conflict resolution mechanisms. I led several long-term mobile projects (3+ years) with a significant user base.

I spend my free time doing different sports and learning something new. I like to go backcountry skiing in winter and prefer MTB, trekking, and running during the warm part of the year. In 2016, I ran my first half marathon and plan to do the full distance next year. Over the past ten years, I have visited about 20 countries. Two years ago, I started experimenting with unmanned aerial vehicles (drones).

Why am I telling you all this stuff? I believe that magic happens at the crossroads of disciplines. That is why I am continuously looking for opportunities that will involve not only my professional skills but also some of my personal interests. I am still in search.

So now you have a better picture of me, and if you want to contact me, email modnovolyk at Gmail or use the links in the top-right corner of this page.