Uploaded December 2015 | Updated September 2026, 44 minutes ago
IMPORTANT!!! Please note that this video is for educational purpose only. By watching this video, you agree that I'm not responsible of what might happen with the use of informations provided.
WARNING : This video involves hacking on Low-Level parts of iOS. Unlike userland, those parts contains lot of critical informations about the device's hardware, which could be corrupted and lead to a hard brick if something goes wrong by following instructions provided in this video.
From a jailbroken iOS 7.1.2 kernel on which TaskforPid() is patched, Winocm's Kloader can be executed to bootstrap the beginning of another iOS bootchain instance (in this video, it's an iOS 6.1.3 one). The ARM image usually used with kloader is iBSS, from the DFU Bootchain. Most Kloader bootstraps use DFU Bootchain's images even if it is also possible to use Flashed Bootchain ones, which are usually more complete (like flashed iBoot can interact with File System, while iBEC can't). DFU one usually involve more loading in memory than Flashed Bootchain, which is more File System friendly. Once Kloader did it's magic and loaded iBSS, we have to send to it iBEC ARM image, the second stage of the DFU Bootchain. The LCD screen of the iOS device light up when iBEC is launched. Now the most interesting part begins. We have to send to iBEC each boot components in a specific order. First, send and execute the DeviceTree. Second, send and load a Ramdisk (seems to make no sense because we want to boot the File System, but there is something tricky here). Third, send the iOS Kernel and launch it using "bootx".
If you do those steps using original decrypted and patched files, without patching boot-args, this will load the restore Ramdisk. If you don't specify a Ramdisk in steps above, this will load the File System, but without taking in consideration boot-args (no verbose boot). If you open the decrypted iBEC file using a Hex editor, you will notice that boot-args are set like that : rd=md0 nand-enable-reformat=1 -progress. Those are boot-args used when booting a Ramdisk. If we change this boot-args string to : "-v", iBEC will load the File System by default, because we removed "rd=md0" which sets the RootDevice to "MemoryDevice0", which is the Ramdisk. It's also possible to change the default root device by adding "rd=[Root Device]" in iBEC's boot-args string.
Limera1n BootROM exploit is superior than Kloader. It acts directly from DFU mode, so an installed Operating System is not required. In the second part of this video, I simply use RedSn0w jailbreak utility to inject Limera1n over the DFU Mode. The root device is set to the iOS 5.1.1 filesystem in iBEC's boot-args. Then, RedSn0w will automatically send and execute each bootloaders in their respective order.
IMPORTANT!!! Please note that this video is for educational purpose only. By watching this video, you agree that I'm not responsible of what might happen with the use of informations provided.
WARNING : This video involves hacking on Low-Level parts of iOS. Unlike userland, those parts contains lot of critical informations about the device's hardware, which could be corrupted and lead to a hard brick if something goes wrong by following instructions provided in this video.
From a jailbroken iOS 7.1.2 kernel on which TaskforPid() is patched, Winocm's Kloader can be executed to bootstrap the beginning of another iOS bootchain instance (in this video, it's an iOS 6.1.3 one). The ARM image usually used with kloader is iBSS, from the DFU Bootchain. Most Kloader bootstraps use DFU Bootchain's images even if it is also possible to use Flashed Bootchain ones, which are usually more complete (like flashed iBoot can interact with File System, while iBEC can't). DFU one usually involve more loading in memory than Flashed Bootchain, which is more File System friendly. Once Kloader did it's magic and loaded iBSS, we have to send to it iBEC ARM image, the second stage of the DFU Bootchain. The LCD screen of the iOS device light up when iBEC is launched. Now the most interesting part begins. We have to send to iBEC each boot components in a specific order. First, send and execute the DeviceTree. Second, send and load a Ramdisk (seems to make no sense because we want to boot the File System, but there is something tricky here). Third, send the iOS Kernel and launch it using "bootx".
If you do those steps using original decrypted and patched files, without patching boot-args, this will load the restore Ramdisk. If you don't specify a Ramdisk in steps above, this will load the File System, but without taking in consideration boot-args (no verbose boot). If you open the decrypted iBEC file using a Hex editor, you will notice that boot-args are set like that : rd=md0 nand-enable-reformat=1 -progress. Those are boot-args used when booting a Ramdisk. If we change this boot-args string to : "-v", iBEC will load the File System by default, because we removed "rd=md0" which sets the RootDevice to "MemoryDevice0", which is the Ramdisk. It's also possible to change the default root device by adding "rd=[Root Device]" in iBEC's boot-args string.
Limera1n BootROM exploit is superior than Kloader. It acts directly from DFU mode, so an installed Operating System is not required. In the second part of this video, I simply use RedSn0w jailbreak utility to inject Limera1n over the DFU Mode. The root device is set to the iOS 5.1.1 filesystem in iBEC's boot-args. Then, RedSn0w will automatically send and execute each bootloaders in their respective order.
![Crash Team Racing - Hot Air Skyway OST [Prototype & Release Mix]](https://i.ytimg.com/vi/y1oiQLOJnN8/mqdefault.jpg "Crash Team Racing - Hot Air Skyway OST [Prototype & Release Mix]
Note : The fist soundtrack you hear in this video, 00:10 - 03:12 is the final product. Other soundtracks are different versions of Hot Air Skyway, including original console prototype version and extracted RAW MIDI.
After ten years on this channel, here is a new Crash Bandicoot related video!
Hot Air Skyway from CTR, along with Rock it & Pack Attack from Crash Bandicoot 2 and Knight Time from Crash Bandicoot : The Wrath of Cortex are ones of my favorites soundtracks from the serie. Hot Air Skyway being my first favorite Crash Bandicoot sountrack I fell in love with mostly 20 years ago when I played CTR for the first time.
Recently, I found out that theres an extended version of Hot Air Skyway, called Pre-console that has been released by composer Josh Mancell. It includes an additional 28 seconds segment that consists mostly of the fist loop plus an instrument called the Cortexs Trumpet. Pre-Console music consists of music before instruments get stripped down, in this case, for the Playstation 1. CTR pre-console music sound great, but I always prefered original console music.
More recently, I joined the CTR-Tools (software used in this video) official Discord server and someone there told me that the original full length Hot Air Skyway is still here in one of some leaked CTR prototype builds. Okay, so I decided to take a look at this prototype build and I found out that the prototype Hot Air Skyway console version doesnt sounds like the release build console one. Some improvements have been made in the release version, especially in the first loop (compare 03:29 with 05:02). Also, the ripped version quality I found on The Cutting Room Floor is quite lower than what we can find in other video game music websites for the release version.
So, nothing really complicated for this video, we are trying to assemble the cut part of the prototype version while keeping the improvements made to the release one.
List of Hot Air Skyway versions you will hear in this video :
[ 00:10 - 03:12 ] Prototype & Release Mix
[ 03:12 - 04:44 ] Prototype
[ 04:45 - 05:50 ] Release
[ 05:50 - 07:22 ] Prototype, MIDI
[ 07:23 - 07:34 ] Cortexs Trumpet, cut part.")
