Diags (iBoot command)

This was an exploit in pre 2.0 versions of iBoot

Credit
The dev team

Exploit
The diags function can be passed a parameter. It jumps to that parameter, but not before trashing the I/O table. You can run unsigned code using this, but there's no guarantee about the state of the that processor

In 2.0 iBoots, they check the permission register.