Uploaded January 2013 | Updated September 2026, 1 day ago
A special thanks to LXShadow, who worked very hard to find these hidden stuff and make codes.
"An extra hub can be found in the disc. It's the E3 Hub, used to showcase the game when it was presented at E3 2001" ( crashmania.net ). The most interesting thing in this E3 Hub are warp pads. As you can see in this video, each pad has a preview picture of its associated level and theses pictures doesn't represent levels of the actual game.
This Hub was probably the one in the Late Beta version of the game.
More Informations : crashmania.net/?menu=woc&page=mysteries-2
Warp Pad 1 - It seems to be a picture of an old prototype version of Crash and Burn level
More informations : crashmania.net/?menu=woc&page=mysteries-4-2
Warp Pad 2 - Tornado Alley with a nice weather.
More Informations : crashmania.net/?menu=woc&page=mysteries-2
Warp Pad 3 - Looks like the original Wizards and Lizards Level.
Warp Pad 4 - Cortex statue, in an unseen place ?
See it there : crashmania.net/?menu=woc&page=mysteries-5
Warp Pad 5 - It seems to be an early beta version of Ice Station Bandicoot, which was like a normal (on-foot) Crash Bandicoot level.
Read more on Crash Mania : crashmania.net/?menu=woc&page=mysteries-1
In this Hub, warp pads are not linked to levels, they are transparent and Crash fall when he walk on them. You have now only one thing to do, push the reset button of your Ps2.
A special thanks to LXShadow, who worked very hard to find these hidden stuff and make codes.
"An extra hub can be found in the disc. It's the E3 Hub, used to showcase the game when it was presented at E3 2001" ( crashmania.net ). The most interesting thing in this E3 Hub are warp pads. As you can see in this video, each pad has a preview picture of its associated level and theses pictures doesn't represent levels of the actual game.
This Hub was probably the one in the Late Beta version of the game.
More Informations : crashmania.net/?menu=woc&page=mysteries-2
Warp Pad 1 - It seems to be a picture of an old prototype version of Crash and Burn level
More informations : crashmania.net/?menu=woc&page=mysteries-4-2
Warp Pad 2 - Tornado Alley with a nice weather.
More Informations : crashmania.net/?menu=woc&page=mysteries-2
Warp Pad 3 - Looks like the original Wizards and Lizards Level.
Warp Pad 4 - Cortex statue, in an unseen place ?
See it there : crashmania.net/?menu=woc&page=mysteries-5
Warp Pad 5 - It seems to be an early beta version of Ice Station Bandicoot, which was like a normal (on-foot) Crash Bandicoot level.
Read more on Crash Mania : crashmania.net/?menu=woc&page=mysteries-1
In this Hub, warp pads are not linked to levels, they are transparent and Crash fall when he walk on them. You have now only one thing to do, push the reset button of your Ps2.
![De Rebus Antiquis - iPad 4 (P102AP) iOS 7.x iBoot Exploit [Demo]](https://i.ytimg.com/vi/d6b_G1gxu-Q/mqdefault.jpg "De Rebus Antiquis - iPad 4 (P102AP) iOS 7.x iBoot Exploit [Demo]
This is a demo of a complete De Rebus Antiquis iBoot exploit setup running on iPad 4 (P102AP). Once iBoot re-runs after the exploitation, it mounts a secondary HFS+ volume that contains a new bootloader image and executes it. In this demo, I simply used the same iBoot as the signed one, except running unsigned with custom patches and verbose boot enabled.
Im currently working on a complete write-up about De Rebus Antiquis iBoot exploit. Once it will be released, you should get most of the necessary knowledge to implement what you see in this video. See my personal blog here, https://www.pmbonneau.com/ for more details.
Many thanks to @dora2ios (Twitter) for help with some issues I had while debugging.")
![HFS+ Heap Buffer Overflow - iPad 2 (K94AP) iOS 5.x iBoot Exploit [Demo]](https://i.ytimg.com/vi/dJbakxWSy18/mqdefault.jpg "HFS+ Heap Buffer Overflow - iPad 2 (K94AP) iOS 5.x iBoot Exploit [Demo]
This is a post-exploitation demo of an HFS+ heap buffer overflow in iOS 5.x iBoot, running on iPad 2nd (K94AP). One particular use case of an iBoot exploit such as this one is the ability to downgrade or upgrade the device to any iOS version as long as it can run on it. This iPad 2nd is downgraded to iOS 5.x using previously saved SHSH blobs, so when powered-on, the signed iOS 5.x iBoot is executed. An HFS+ volume is specifically crafted to trigger an heap buffer overflow when iBoot attempts to mount it. Then, we get control over the PC register and eventually execute a custom payload which jumps to a completely new patched iBoot image. From there, additional unsigned bootchain images are executed and so, to fully boot iOS. In this video, iPad start up with the iOS 5.0.1 signed bootchain, exploit is triggered, then jumps to an iOS 7.1.2 bootchain.
See the complete write-up I did about this iBoot exploit on my personal blog here, https://www.pmbonneau.com/ios5-iboot-hfs-hbo/
This video was originally posted on X (Twitter) here, https://x.com/ShadowLee19/status/1074533504610918400?s=20")
