SpringBoard 1.1.2 Scrolling Patch

UPDATE: I’ve written a new patch for SpringBoard, which supports both scrolling as well as customized carrier logo, you may add unlimited number of carriers. Click HERE for details.

The SpringBoard 1.1.2 has changed alot, the patch is far more complicated than I thought. Since I had checked the 1.1.1’s patch before, and there were only 3 bytes being patched, based on that, I thought it would be very easy to patch 1.1.2 the similar way, but I was definitely wrong.

The 1.1.2 is so different, that it’s impossible to patch it the same way as in 1.1.1. The patch shown below is very complex, actually a whole routine has been injected into the SpringBoard.

UPDATE: it’s not code injection, it’s just hard-coded patch. The method relayoutIcon was re-written and put into the header at offset 0×5100 because it’s longer than the original method.

UPDATE: after reversing 1.0.2, 1.1.1, and 1.1.2’s patches, I have finally realized it’s completely copied from the 1.1.1’s method :) the method being copied is named ‘relayoutIcons’.

The following is the patched SpringBoard for you lazy bones :)

1.1.2 SpringBoard with Scrolling Patch

Or this one which has both scrolling and custom carrier logo patches:

1.1.2 SpringBoard with Scrolling and Carrier Logo Patches

As a reference, here’s the original: Original 1.1.2 SpringBoard

If you want to apply the patches by yourself, read on.

The initial patch is difficult to apply manually, so a patcher is made to make life easier (Thanks Arnaldo for his kind offer):

Patcher for 1.1.2 SpringBoard (Add Scrolling Feature)

Copy it to your iPhone, set correct permission (755) and execute. It’ll locate and patch the SpringBoard automatically, it takes less than a second to finish. When it’s done, you’ve got a patched version of SpringBoard.

The above patcher requires libarmfp.dylib (which usually has been installed automatically when you do jailbreaking), so make sure you have it settled in /usr/lib.

The patched bytes are shown below (you may also generate the same result by comparing the SpringBoard before and after patch).

Search for differences

1. G:\iPhone Stuffs\SpringBoard\112\112_SpringBoard_original\SpringBoard: 787,136 bytes
2. G:\iPhone Stuffs\SpringBoard\112\112_SpringBoard_patched\SpringBoard: 787,136 bytes
Offsets: hexadec.

4200:    00    F0
4201:    00    40
4202:    00    2D
4203:    00    E9
4204:    00    0C
4205:    00    70
4206:    00    8D
4207:    00    E2
4208:    00    5C
4209:    00    11
420A:    00    9F
420B:    00    E5
420D:    00    0D
420E:    00    2D
420F:    00    E9
4210:    00    10
4211:    00    D0
4212:    00    4D
4213:    00    E2
4214:    00    54
4215:    00    21
4216:    00    9F
4217:    00    E5
4219:    00    80
421A:    00    A0
421B:    00    E1
421D:    00    20
421E:    00    92
421F:    00    E5
4220:    00    04
4222:    00    90
4223:    00    E5
4225:    00    10
4226:    00    91
4227:    00    E5
4228:    00    7D
4229:    00    4C
422A:    00    02
422B:    00    EB
422C:    00    40
422D:    00    11
422E:    00    9F
422F:    00    E5
4230:    00    04
4232:    00    98
4233:    00    E5
4235:    00    60
4236:    00    A0
4237:    00    E3
4239:    00    10
423A:    00    91
423B:    00    E5
423C:    00    78
423D:    00    4C
423E:    00    02
423F:    00    EB
4240:    00    30
4241:    00    01
4242:    00    9F
4243:    00    E5
4244:    00    30
4245:    00    11
4246:    00    9F
4247:    00    E5
4248:    00    06
4249:    00    50
424A:    00    A0
424B:    00    E1
424E:    00    90
424F:    00    E5
4251:    00    10
4252:    00    91
4253:    00    E5
4254:    00    72
4255:    00    4C
4256:    00    02
4257:    00    EB
4258:    00    20
4259:    00    11
425A:    00    9F
425B:    00    E5
425C:    00    06
425D:    00    40
425E:    00    A0
425F:    00    E1
4261:    00    10
4262:    00    91
4263:    00    E5
4264:    00    6E
4265:    00    4C
4266:    00    02
4267:    00    EB
4268:    00    14
4269:    00    11
426A:    00    9F
426B:    00    E5
426C:    00    04
426E:    00    88
426F:    00    E5
4270:    00    08
4272:    00    A0
4273:    00    E1
4275:    00    10
4276:    00    91
4277:    00    E5
4278:    00    69
4279:    00    4C
427A:    00    02
427B:    00    EB
427C:    00    04
427D:    00    31
427E:    00    9F
427F:    00    E5
4281:    00    10
4282:    00    93
4283:    00    E5
4284:    00    0C
4286:    00    8D
4287:    00    E5
4288:    00    08
428A:    00    A0
428B:    00    E1
428C:    00    64
428D:    00    4C
428E:    00    02
428F:    00    EB
4290:    00    F4
4291:    00    10
4292:    00    9F
4293:    00    E5
4295:    00    10
4296:    00    91
4297:    00    E5
4299:    00    B0
429A:    00    A0
429B:    00    E1
429C:    00    08
429E:    00    98
429F:    00    E5
42A0:    00    5F
42A1:    00    4C
42A2:    00    02
42A3:    00    EB
42A4:    00    E4
42A5:    00    10
42A6:    00    9F
42A7:    00    E5
42A9:    00    10
42AA:    00    91
42AB:    00    E5
42AC:    00    08
42AE:    00    8D
42AF:    00    E5
42B0:    00    5B
42B1:    00    4C
42B2:    00    02
42B3:    00    EB
42B5:    00    A0
42B6:    00    A0
42B7:    00    E1
42B8:    00    1D
42BB:    00    EA
42BC:    00    03
42BE:    00    56
42BF:    00    E3
42C0:    00    0B
42C3:    00    DA
42C4:    00    0C
42C5:    00    30
42C6:    00    9D
42C7:    00    E5
42C8:    00    01
42C9:    00    50
42CA:    00    85
42CB:    00    E2
42CC:    00    05
42CE:    00    53
42CF:    00    E1
42D1:    00    60
42D2:    00    A0
42D3:    00    C3
42D4:    00    06
42D7:    00    CA
42D8:    00    A8
42D9:    00    30
42DA:    00    9F
42DB:    00    E5
42DC:    00    08
42DE:    00    A0
42DF:    00    E1
42E1:    00    60
42E2:    00    A0
42E3:    00    E3
42E5:    00    10
42E6:    00    93
42E7:    00    E5
42E8:    00    4D
42E9:    00    4C
42EA:    00    02
42EB:    00    EB
42EC:    00    06
42ED:    00    50
42EE:    00    A0
42EF:    00    E1
42F1:    00    B0
42F2:    00    A0
42F3:    00    E1
42F4:    00    98
42F5:    00    30
42F6:    00    9F
42F7:    00    E5
42F8:    00    04
42F9:    00    20
42FA:    00    A0
42FB:    00    E1
42FC:    00    08
42FE:    00    9D
42FF:    00    E5
4301:    00    10
4302:    00    93
4303:    00    E5
4304:    00    46
4305:    00    4C
4306:    00    02
4307:    00    EB
4308:    00    88
4309:    00    30
430A:    00    9F
430B:    00    E5
430C:    00    01
430D:    00    40
430E:    00    84
430F:    00    E2
4311:    00    10
4312:    00    93
4313:    00    E5
4315:    00    30
4316:    00    A0
4317:    00    E3
4318:    00    04
4319:    00    30
431A:    00    8D
431B:    00    E5
431C:    00    06
431D:    00    30
431E:    00    A0
431F:    00    E1
4321:    00    50
4322:    00    8D
4323:    00    E5
4324:    00    01
4325:    00    60
4326:    00    86
4327:    00    E2
4329:    00    20
432A:    00    A0
432B:    00    E1
432C:    00    0B
432E:    00    A0
432F:    00    E1
4330:    00    3B
4331:    00    4C
4332:    00    02
4333:    00    EB
4334:    00    0A
4336:    00    54
4337:    00    E1
4338:    00    DF
4339:    00    FF
433A:    00    FF
433B:    00    BA
433C:    00    58
433D:    00    10
433E:    00    9F
433F:    00    E5
4340:    00    08
4342:    00    A0
4343:    00    E1
4345:    00    10
4346:    00    91
4347:    00    E5
4348:    00    35
4349:    00    4C
434A:    00    02
434B:    00    EB
434C:    00    4C
434D:    00    10
434E:    00    9F
434F:    00    E5
4350:    00    08
4352:    00    A0
4353:    00    E1
4355:    00    20
4356:    00    A0
4357:    00    E3
4359:    00    10
435A:    00    91
435B:    00    E5
435C:    00    30
435D:    00    4C
435E:    00    02
435F:    00    EB
4360:    00    18
4361:    00    D0
4362:    00    47
4363:    00    E2
4365:    00    0D
4366:    00    BD
4367:    00    E8
4368:    00    F0
4369:    00    80
436A:    00    BD
436B:    00    E8
436C:    00    F8
436D:    00    2A
436E:    00    0A
4370:    00    74
4371:    00    28
4372:    00    0A
4374:    00    84
4375:    00    23
4376:    00    0A
4378:    00    A0
4379:    00    41
437A:    00    0A
437C:    00    78
437D:    00    23
437E:    00    0A
4380:    00    7C
4381:    00    23
4382:    00    0A
4384:    00    94
4385:    00    36
4386:    00    0A
4388:    00    20
4389:    00    40
438A:    00    0A
438C:    00    24
438D:    00    40
438E:    00    0A
4390:    00    90
4391:    00    24
4392:    00    0A
4394:    00    C0
4395:    00    25
4396:    00    0A
4398:    00    28
4399:    00    40
439A:    00    0A
439C:    00    2C
439D:    00    40
439E:    00    0A
43A0:    00    84
43A1:    00    29
43A2:    00    0A
7C0F0:    F0    04
7C0F1:    40    F0
7C0F2:    2D    1F
7C0F3:    E9    E5
7C0F4:    0C    00
7C0F5:    70    52
7C0F6:    8D    00
7C0F7:    E2    00
7D964:    09    00
7D965:    01    00
7D967:    0A    00

366 difference(s) found.

9 Comments

  1. Josh
    Posted December 11, 2007 at 5:35 pm | Permalink

    Will using this patched SpringBoard effect SummerBoard in any way?

  2. Posted December 11, 2007 at 6:50 pm | Permalink

    I didn’t run SummerBoard on 1.1.2 so I have no idea whether it affects SummerBoard or not. But I recalled that I tried running SummerBoard on 1.1.1 with a patched SpringBoard, which worked.

  3. Josh
    Posted December 11, 2007 at 8:35 pm | Permalink

    I got brave and tried it using SummerBoard. Works great, thanks.

  4. fayer
    Posted January 29, 2008 at 3:17 pm | Permalink

    i uploaded it into /private/var/root/ . chmod 755 it and execute it. It gives me
    “1390: ABORT: Unable to register “PurpleSystemEventPort” port, 1103 unknown error code
    zsh: abort ./SpringBoard”

    any ideas?

  5. Posted February 3, 2008 at 2:51 pm | Permalink

    fayer,

    You can’t execute it directly (there has already been an instance running), you need to replace the original one (in /System/Library/CoreServices/SpringBoard.app/) with the patched one and reboot.

  6. Skif
    Posted February 18, 2008 at 1:59 am | Permalink

    Hi, can you add it to some repository to install it from Installer? I haven’t got WinSCP and iPhoneBrowser etc doesn’t work. I saw that you updated ZiPhone with afc2 support but it can only work on MacOS. Mb if it’s not so hard you can do latest ZiPhone with afc2 support for Win. Then it could be done on iPhoneBrowser etc. Anyway thx for SB Scrolling patch i think many people has that problem.

  7. Marcelo
    Posted February 29, 2008 at 8:24 pm | Permalink

    my iphone is 1.1.2 OTB activated, jailbreak and liberated with Ziphone Method ans It’s still as 1.1.2.
    I’ve havving problems with Installer Icon disapared and Springboard not scrolling. I’ve several forums, and I didn’t find something that could correct this problem of not scrolling.
    Finally i’ve found your blog and I’ve been trying this solution both. Noone worked. I’ve verified that libarmfp.dylib were there, and I’ve replace it with yours (second patch).
    I’ve rebooted in both, but nothing happened.
    Any suggestion? Thank you very much for your effort and colaboration.

  8. Posted February 29, 2008 at 8:36 pm | Permalink

    @Marcelo, it was said if you let iTunes restore your settings after the update, you’ll likely have some weird issues. To be sure everything’s working, make sure you do a full restore before jailbreak/activation, and then let iTunes create a new phone settings backup for you.

  9. Marcelo
    Posted February 29, 2008 at 8:50 pm | Permalink

    George,
    thanks for your work. Finally I could. The problem was I was applying the Spring board file in a wrong directory.
    Thanks again

Post a Comment

Your email is never published nor shared. Required fields are marked *

*
*