Here is a more detailed analysis: http://blog.accuvantlabs.com/blog/bthomas/evasi0n-jailbreaks...

The lazy binding is really interesting. There is lots of interesting stuff in the kernel, dyld, and libSystem. I would encourage you to have a look! You can do interesting things like run code before libSystem_init[1]

[0]:

https://github.com/Apple-FOSS-Mirror/dyld/tree/master/src

https://github.com/Apple-FOSS-Mirror/Libsystem/blob/master/i...

https://github.com/Apple-FOSS-Mirror/xnu/blob/master/bsd/ker...

[1]: https://gist.github.com/jevinskie/4615901

Nice analysis. According to twitter, there's something more to it, though, there still seems to be some sort of kernel memory corruption exploit:

https://twitter.com/kernelpool/status/298714209187921921

/var/mobile/Media/Recordings is a folder that you can upload files to from a PC. I would bet that some stage of the jailbreak copies those files to their proper place in the filesystem (places that the PC uploading interface doesn't have permissions to write).

There's a few more hints here: http://www.reddit.com/r/jailbreak/comments/17vp13/evasi0n_ma...