You might want to weigh your own confidence against the authority of the person making claims you disagree with before launching into an attack.

I don't really understand your objection to a), and I think Marcan's claims about b) are justified but deserve a bit of clarification. It's not so simple; as Michael Steil discusses, the efforts (piracy vs homebrew) often leverage each others' work. The only reason you can "run homebrew [on the Wii] without modifying the DVD drive to accept pirated discs" is that ... we were able to bootstrap our efforts by using modified disc images, which requires modifying the DVD drive to accept burned discs. The first unsigned code execution we demonstrated used a patched Lego Star Wars disc with code injected into it. Later, we used the same technique to inject debugging code into a copy of Zelda, and then used that to facilitate making a save-game exploit that ultimately did not require hardware modification.

It might have been possible to reach that end goal in some different way, but it would have been much more difficult.

... except for the part where you can fire up iTunes on your new computer, sign into your account without activating, and click "Deauthorize All Computers" and then activate your new computer(s).

The people who create the jailbreaking tools (or find the exploits, at least) do it for the challenge of it.

The people who use them are generally people who thought the "locked-down" out-of-the-box experience was worth the money they paid, and who find it fun to push it a bit further with a jailbreak.

"The jailbreaker who despises the restrictions imposed by the manufacturer" is a straw man. I'm sure you can find a counterexample (or at least, someone trying to be contrary) if you try hard enough, but in general, "jailbreakers" come in all of these categories but one:

• Those who find exploits and hacks for fun of it
• Those who want "a little bit more" out of a device they otherwise already enjoy
• Those who want to install pirated apps
• Those who hate Apple yet still spend their hard-earned money on a device, only to apply a hack that will only work for sum indeterminate amount of time

Yeah, 1A543a is a really really old version of the software (over 2 years old -- it's what the first iPhone launched with). If that's representative of what most of the transactions look like, they're probably bogus.

You're just looking in the wrong places. There are two 128-bit constants stored in the System Management Controller chip (alongside fan speeds and temperature info) in the keys "OSK0" and "OSK1"; the first time someone accidentally dumped these seems to have been in this forum post. The scheme is documented a bit further in a couple of artictles: "TPM DRM" In Mac OS X: A Myth That Won't Die and Darwin/x86: Mac OS X Binary Protection. I'll leave it to you to manually decode the keys into ASCII, but will point out that they are normally retrieved from the hardware by a kext called "Dont Steal Mac OS X.kext". The reason your "special bootloader" works on vanilla hardware is that it replaces that kext with a version that contains the keys hardcoded into it; it will never install on any machine without replacing or patching that kext, EFI or not. (All of the bootloaders that can use unmodified installation media patch or inject this kext before passing control to the loaded XNU kernel.)

If you've gotten to the point where you're patching that kext, there's not much else that can be done to stop you, which is why they gave the kext its name and included the following plain-text string in the binary:

Your karma check for today:
There once was was a user that whined
his existing OS was so blind,
he'd do better to pirate
an OS that ran great
but found his hardware declined.
Please don't steal Mac OS!
Really, that's way uncool.
(C) Apple Computer, Inc.

This is not true, at least not in the case of the iPhone (which has an Infineon baseband processor connected to a Samsung "Applications Processor" by "LITERALLY a serial port") or the Palm Pre (Qualcomm baseband, TI OMAP AP).

Qualcomm's product info page for the MSM7201 processor used in the HTC Hero says that it includes "Integrated ARM11 applications processor and ARM9 modem, QDSP4000 and QDSP5000 high-performance digital signal processors (DSP)". It would seem likely that the ARM9 core (in combination with one or both of the DSPs) does all of the modem work; I see no reason to suspect that the ARM11 ever "steals cycles from cpu #1".

There's no well-defined line of what software is expressive (and eligible for copyright) and what software is merely functional. I would argue that this software is merely functional -- there's not all that much code, and there are only a few ways you can write code that performs the same function. It's largely mechanical.

On the other hand, the Nintendo logo is actually contained in the ROM, as part of the protection mechanism. This was probably done as a "copyright/trademark trick" -- the logo is certainly expressive (and eligible for copyright), so in order to make a clone cartridge, you would have to copy this logo.

Unfortunately for Nintendo, Sega tried this trick in court and lost a couple of years later. That court case actually established the precedent I'm alluding to above... a few choice quotes from the decision:

[...]

This legal issue was later revisited in a slightly different form (with mixed results) in Lexmark V. Static Control Components -- however, in that case, there was a lot more code involved than the boot ROM we're talking about here, so much more room for claims of expressive code.

This is also an interesting development because Costis achieved the same goal as the decapping of the original GameBoy CPU, but with vastly cheaper equipment (< $100) and probably in less time (< 1 week).

Glitching is a neat technology; it's most famously used by "card unloopers" for smartcard hacking, and is also used by modern Wii modchips. Travis Goodspeed gave a neat presentation at DefCon 2009 about glitching, and has released some open-source hardware which will eventually support glitching target microcontrollers. Given the right software, that board alone would probably have been enough to perform this hack.

Even at that, they shouldn't be. After subtracting out costs, Apple's estimated profit per song is more like 10 cents.