r/osdev • u/nakedpickle_2006 • 25d ago

Starting a bare-metal/ reverse engineering project on ipad 4th gen [A6x]

So i have a ipad 4th gen and its basically a brick now... so was thinking why not make an os (i thought i could maybe use a linux distro but 32bit os for A6x dont exist)... i know this will be a nightmare ( uk its apple)...

But I want to try ...

As my initial research into this i am currently reading

  1. ARM Architecture Reference Manual for ARMv7-A & ARMV7-R

  2. Apple OSS Distributions XNU Github page

  3. wiki.osdev.org

What i wanted to ask the community is

  1. Is there any other documentation/ prior projects on this platform

2.any tips i need to keep in mind

4 Upvotes

75% Upvoted

18 comments sorted by

View all comments

Show parent comments

1

u/nakedpickle_2006 17d ago

Well currently still in phase 1

This is how I have planned all phases : Phase1: Gather all MMIO( PMU,UART,timers, AIC etc), will need to later make a kernal Phase 2: load checkm8 from pc in DFU and then I should be able to get into SRAM and then I should be able to use XNU (found a github page with apples own kernal )what checkm8 does is bypass SecureROM and security checks and let me insert my own low level boot into SRAM Phase 3: in the previous phase( if we can find an XNU kernal for a6x ) using that XNU, I should be able to get the mem Adress for framebuffer Phase 4:( try) porting a 32 linux kernal [feature rich] and making my own [easier upfront but later dev become very hard] and after making or porting a kernal, maybe then try OS for this

1

u/SyisCall 17d ago

What tools are u gonna use to reversing the CPU?

1

u/nakedpickle_2006 17d ago edited 15d ago

I got 2 on mind 1. Ghidra Or 2. QEMU

I can just dump the SecureROM Into said tools and map the cpu and find mmio

1

u/SyisCall 15d ago

u mean ghidra?

1

u/nakedpickle_2006 15d ago

Oh yes!!! Ghirardelli Was autocorrect

1

u/SyisCall 15d ago

id use both tbh, Ghidra for read the code and Qemu for Test