Hacker News Reader

Sandcastle is using the checkm8[0] unpatchable bootrom exploit to allow running unsigned secureROM arbitrary code with help from alloc8[1]. They then load a modified pongoOS[2] to get device tree and load their modified AOSP[3] from what I can tell.

[0] https://github.com/axi0mX/ipwndfu [1] https://github.com/axi0mX/alloc8 [2] https://github.com/checkra1n/pongoOS [3] https://github.com/corellium/projectsandcastle

What does alloc8 (for iPhone 3GS) have to do with this? Also, what are their modifications to pongoOS and why do they need them?

Hello,

Upstream pongoOS is used for this AFAIK, without further changes needed.

However, the FDT from Apple device tree generator is currently basic and not really ready for anything other than FB + display, so a custom device tree is provided in the Sandcastle distribution.

Not replace, rather, you boot Linux over USB. That is why they describe the ephemeral device use case.

Yes, because of an unpatchable boot rom exploit.

Yes, it replaces iOS using a jailbreak.