Till today, I use the "unhackable" iPod Nano 7g. I collected a ton of information what would be needed to hack it, but unfortunately, I did not have the time.
In case you are interested in getting functional / non-functional devices to experiment, reach out on https://pilabor.com (I'm from Germany).
My plan was to desolder the 16GB flash chip (it's LGA60) and try to reprogram it with a device like this:
Old iPhones (I think the 5s has the same LGA60 Nand) can be reprogrammed with a JC Pro 1000S Programmer, but they don't have a setting for iPods AFAIK. So maybe with a lot of effort it would be possible to use it to reprogram a Nand Chip having an Apple Serial No.
lemonjesus (https://github.com/lemonjesus/iPodBluetooth) created a bootloader Hack for the iPod Nano 3g enabling him to use a bluetooth device. He also made a youtube video about it.
But I never got into it too far. I just found out that milling out the backplate of an iPod Nano 7g can fit an iPod Mini 600mah battery and make it "replaceable" without opening the device again - so as long as the Nand does not die, I'll keep using my iPods :-)
The next device I'm planning to buy is the HiBy M300. It's way bigger but runs Android 13 and is a real DAP.
CUB3D recently got code execution on n6g/n7g via a freetype 1day (comex's star vuln/exploit, after using another bug which allowed disabling resource partition checks).
This is great news, thank you for pointing this out. I'll transfer that knowledge to the rockbox community, if they don't know. Maybe someone is willing / has time to do the work.
Comments
Great work, thank you.
Till today, I use the "unhackable" iPod Nano 7g. I collected a ton of information what would be needed to hack it, but unfortunately, I did not have the time.
In case you are interested in getting functional / non-functional devices to experiment, reach out on https://pilabor.com (I'm from Germany).
My plan was to desolder the 16GB flash chip (it's LGA60) and try to reprogram it with a device like this:
https://de.aliexpress.com/i/32951067630.html
Maybe soldering it back on the iPod with this in between to debug / reprogram faster:
https://de.aliexpress.com/item/32844952323.html
Old iPhones (I think the 5s has the same LGA60 Nand) can be reprogrammed with a JC Pro 1000S Programmer, but they don't have a setting for iPods AFAIK. So maybe with a lot of effort it would be possible to use it to reprogram a Nand Chip having an Apple Serial No.
There also was a project called Nand-AID (https://www.timeextension.com/news/2023/04/modder-is-resurre...) providing a microSD-Card replacement for dead nands on the Wii U consoles. Sounded interesting to try on the iPod Nano 7G :-)
lemonjesus (https://github.com/lemonjesus/iPodBluetooth) created a bootloader Hack for the iPod Nano 3g enabling him to use a bluetooth device. He also made a youtube video about it.
But I never got into it too far. I just found out that milling out the backplate of an iPod Nano 7g can fit an iPod Mini 600mah battery and make it "replaceable" without opening the device again - so as long as the Nand does not die, I'll keep using my iPods :-)
The next device I'm planning to buy is the HiBy M300. It's way bigger but runs Android 13 and is a real DAP.
CUB3D recently got code execution on n6g/n7g via a freetype 1day (comex's star vuln/exploit, after using another bug which allowed disabling resource partition checks).
https://github.com/CUB3D/ipod_sun
This is great news, thank you for pointing this out. I'll transfer that knowledge to the rockbox community, if they don't know. Maybe someone is willing / has time to do the work.
I unfortunately can't (2 kids, 2 jobs...).