The iPhone Wiki - User contributions [en]

NonUI builds

2022-09-03T20:07:23Z

3xpl0itz: The phone in this photo is not a prototype. It's a production 3GS with HoodooYabuli installed.

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''NonUI builds''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production devices during manufacturing. These "factory firmwares" are based on production iOS firmware, but are adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|130px|right|"Skankwerk" logo on 7.x and up|link=Special:FilePath/Newsblogo.png]]
[[File:oldswblogo.png|thumb|130px|left|"Skankwerk" logo on 6.x and below|link=Special:FilePath/Oldswblogo.png]]
[[File:IPhone13promaxskankwerk.png|thumb|130px|right|A production iPhone 13 Pro Max displaying the Skankwerk firmware icon, recreated using an extracted graphic.|link=Special:FilePath/IPhone13promaxskankwerk.png]]
[[File:oldswblogodevice.jpg|thumb|130px|left|Production iPhone 3GS showing older Skankwerk logo during boot|link=Special:FilePath/Oldswblogodevice.jpg]]
The name "NonUI" (Non-User Interface) refers to how a majority of applications in these builds are accessible via command line interace. The applications which do use a graphical user interface can be launched through [[SwitchBoard.app|SwitchBoard]], a minimal version of [[SpringBoard]]. Unlike production iOS firmwares, factory firmwares have the following differences:
* DEVELOPMENT fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factory[fa/sa]\</code>.
* FACTORY fused SEP firmware in <code>\Firmware\all_flash\all_flash.[board codename].factory[fa/sa]\</code>
* DEVELOPMENT fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Factory firmwares are distributed via internal "restore bundles", which can only be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same directory structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem), but can also include other files specific to internal development builds of iOS.
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
= iPhones =
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="4" | Alpine
| 03.06.01_G<sup>[https://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally posted to [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 MacRumors]
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| 1.1.3
| [[Alpine 4A102a|4A102a]]
| 04.04.05_G
| -
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 4.0
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| ApexNanshan
| -
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 3.0
| [[Kirkwood 7A2168d|7A2168d]]
| Kirkwood?
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter
|-
| 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| rowspan="2" | 4.0
| [[Apex 8A133|8A133]]
| Apex
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
|-
| 5.1
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[N90AP|iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| rowspan="2" | Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|}

== [[N92AP|iPhone 4 (CDMA)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 4.2
| [[Phoenix 8E5074b|8E5074b]]
| Phoenix?
| ?
| Found on an FCC test report [https://fccid.io/BCG-E2422A/Test-Report/Part-22-24-Test-Report-1402455]
|-
| 6.0
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| SundanceTaosTianshan
| ?
| -
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 5.0
| [[HoodooYabuli 9A2264r|9A2264r]]
| TellurideNanshan
| ?
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 1.0.10
| -
|-
| rowspan="2" | 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|-
| [[SundanceNanshan 10B63290m|10B63290m]]
| Brighton?
| ?
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" |6.0
| [[SundanceNanshan 10A23110j|10A23110j]]
| SundanceNanshan?
| ?
|
|-
| [[Sundance 10A23110z|10A23110z]]
| SundanceNanshan
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| SundanceNanshan?
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|}

== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3”| 7.0
| [[InnsbruckTianshan 11A63840h|11A63840h]]
| InnsbruckTianshan
| ?
| From [https://twitter.com/mcg29_ @mcg29_] on Twitter [https://twitter.com/mcg29_/status/1228064075189542922]
|-
| [[Innsbruck 11A93840f|11A93840f]]
| InnsbruckAni?
| ?
| -
|-
| [[InnsbruckAni 11A93840l|11A93840l]]
| InnsbruckAni
| ?
| -
|-
| rowspan="2" | 7.1
| [[Sochi 11D31620l|11D31620l]]
| SochiYabuli
| ?
| -
|-
| [[Sochi 11D31620u|11D31620u]]
| SochiYabuli
| ?
| -
|}

==[[iPhone 5s]]==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 6.0
| [[Sundance 10A101|10A101]]
| Sundance?
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter
|-
| rowspan="6" |7.0
| [[Innsbruck 11A22051f|11A22051f]]
| Innsbruck?
| ?
| From [https://twitter.com/DongleBookPro @DongleBookPro] on Twitter
|-
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| rowspan="4" | InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| ?
| -
|-
| [[InnsbruckNanshan 11A24581k|11A24581k]]
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter
|-
| [[InnsbruckNanshan 11A360|11A360]]
| 7.02-16
| Found on an FCC test report [https://fccid.io/BCG-E2642A/Test-Report/13U14987-1-A1453-A1533-FCC-2G-3G-Cellular-Report-Final-NoPhotos-2066968]
|-
| [[Innsbruck 11A93840f|11A93840f]]
| InnsbruckAni?
| ?
| Originally posted to [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ MacRumors]
|-
| 11.0
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="8" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A310|12A310]]
| rowspan="2" |Okemo
| 0.26.01
| Found on an FCC test report [https://fccid.io/BCG-E2816A/Test-Report/A1586-FCC-2G-3G-Report-only-1-2373402]
|-
| [[Okemo 12A93311h|12A93311h]]
| 1.00.01
| -
|-
| [[OkemoAni 12A93650j|12A93650j]]
| rowspan="5" | OkemoAni
| 1.00.05
| From [https://twitter.com/TipzRickyCheung @TipzRickyCheung] on Twitter
|-
|-
| [[OkemoAni 12A93650o|12A93650o]]
| 1.00.05
| -
|-
| [[OkemoAni 12A93650z|12A93650z]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter
|-
| [[OkemoAni 12A93651a|12A93651a]]
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| 1.00.05
| -
|-
| 8.3
| [[Stowe 12F69|12F69]]
| Stowe?
| ?
| Seen on iFixit's forum [https://www.ifixit.com/Answers/View/556870/What+soft+wear+is+on+this+iPhone+6]
|-
| rowspan="2" | 9.0
| [[MonarchSajo 13A83261u|13A83261u]]
| rowspan="2" | MonarchSajo
| ?
| From [https://twitter.com/CollectorApple @CollectorApple] on Twitter
|-
| [[Monarch 13A83262c|13A83262c]]
| ?
| From [https://twitter.com/ThermalDOE @ThermalDOE] on Twitter
|-
| 11.3
| [[Emet 15E61570m|15E61570m]]
| Emet?
| ?
| From [https://twitter.com/mcg29_ @mcg29_] on Twitter
|}

== [[iPhone 6 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 8.0
| [[OkemoAni 12A22121a |12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A23410x|12A23410x]]
| Okemo?
| ?
| from [https://twitter.com/DongleBookPro @DongleBookPro] on Twitter
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="6" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[MonarchAni 13A93051r|13A93051r]]
| MonarchAni?
| ?
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| rowspan="3" | Monarch?
| ?
| -
|-
| [[Monarch 13A93420i|13A93420i]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter
|-
| [[Monarch 13A93420m|13A93420m]]
| 1.00.05
| -
|-
| 10.0
| [[Whitetail 14A83432m|14A83432m]]
| Whitetail?
| ?
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter
|-
| 11.0
| [[TigrisNanshan 15A23061c|15A23061c]]
| TigrisNanshan
| ?
| From [https://twitter.com/mcg29_ @mcg29_] on Twitter
|}

== [[iPhone 6s Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchNanshan 13A23161b|13A23161b]]
| MonarchNanshan
| ?
| -
|}

== [[iPhone SE (1st generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 9.3
| [[Eagle 13E180|13E180]]
| Eagle?
| 4.70.10
| Found on an FCC test report [https://fccid.io/BCG-E2945A/Test-Report/2G3G-Report-2898900]
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| rowspan="3" | Whitetail?
| 0.16.01-3
| Found on an FCC test report [https://fccid.io/BCG-E3088A/Test-Report/UL-RPT-RP11265293JD07R-V2-0-FCC-LTE-5-3087333]
|-
| [[Whitetail 14A22881a|14A22881a]]
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| rowspan="2" | WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| ?
| -
|}

== [[iPhone 7 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 10.0
| [[WhitetailAni 14A22161a|14A22161a]]
| rowspan="2" | WhitetailAni?
| ?
| -
|-
| [[WhitetailAni 14A22181a|14A22181a]]
| ?
| -
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| rowspan="3"|TigrisAni
| 00.34.09
| -
|-
| [[TigrisAni 15A93720p|15A93720p]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[TigrisAni 15A93720r|15A93720r]]
| ?
| -
|}

== [[D21AP|iPhone 8 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A93260r|15A93260r]]
| rowspan="2" | Tigris
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter
|-
| [[TigrisAni 15A93261f|15A93621f]]
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev ] on Twitter
|}

== [[D22AP|iPhone X]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A783601x|15A783601x]]
| rowspan="2" | TigrisAni
| ?
| -
|-
| [[TigrisAni 15A783601y|15A783601y]]
| ?
| -
|}

== [[N841AP|iPhone XR]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 12.0
| [[Peace 16A13580x|16A13580x]]
| rowspan="4" | Peace
| ?
| From [https://www.ebay.com/itm/Apple-iPhone-Xr-PROTOTYPE-PVT-SwitchBoard-Development-Unit/224244802117 this eBay listing]
|-
| [[Peace 16A13580z|16A13580z]]
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter
|-
| [[Peace 16A13581a|16A13581a]]
| ?
| From [https://twitter.com/ThermalDOE @ThermalDOE] on Twitter
|-
| [[Peace 16A73281c|16A73281c]]
| ?
| -
|}

== [[D321AP|iPhone XS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 12.0
| [[PeaceAni 16A93020u|16A93020u]]
| PeaceAni
| ?
| -
|}

== [[D331pAP|iPhone XS Max]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 12.0
| [[Peace 16A23250u|16A23250u]]
| rowspan="2" | Peace?
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter.
|-
| [[Peace 16A22481b|16A22481b]]
| ?
| From [https://twitter.com/YRH04E @YRH04E] on Twitter
|}

== [[D52gAP|iPhone 12 Mini]] ==
{| class="wikitable"
|-
! Verison
! Build
! Codename
! Baseband
! Comments
|-
| 14.1
| [[AzulHWYabuli 18A33771c|18A33771c]]
| AzulHWYabuli?
| ?
| From [https://twitter.com/RealOrangera1n @RealOrangera1n] on Twitter
|}

== [[D53pAP|iPhone 12 Pro]] ==
{| class="wikitable"
|-
! Verison
! Build
! Codename
! Baseband
! Comments
|-
| 14.1
| [[AzulNanshan 18A23581a|18A23581a]]
| AzulNanshan?
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter
|}

== [[D54pAP|iPhone 12 Pro Max]] ==
{| class="wikitable"
|-
! Verison
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 14.0
| [[Azul 18A23121e | 18A23121e]]
| rowspan="3" | Azul?
| ?
| Found on an FCC test report [https://fccid.io/BCG-E3549A/Test-Report/13131738-E21V2-UWB-with-parent-Report-Part-1-4946415]
|-
| [[Azul 18A311|18A311]]
| ?
| From [https://twitter.com/BenGeskin @BenGeskin] on Twitter
|-
| [[Azul 18A23120o|18A23120o]]
| ?
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter
|}

= iPads =
== [[K48AP|iPad (1st generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| rowspan="2" | Wildcat
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
| 5.1
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYaubli
| ?
| -
|}

== [[K93AP|iPad (2nd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| rowspan="2" | Durango
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| ?
| -
|}

== [[J2AP|iPad (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 5.1
| [[Hoodoo 9B87|9B87]]
| Hoodoo?
| ?
| Found on an FCC test report [https://fccid.io/BCGA1430/Test-Report/UNII-Test-Report-1632819]
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| ?
| -
|}

== [[iPad (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 6.0
| [[Sundance 10A33901a|10A33901a]]
| Sundance?
| ?
| -
|-
| 7.0
| [[InnsbruckTianshan 11A63840h|11A63840h]]
| InnsbruckTianshan
| ?
| Horizontal mode only.
|}

==[[iPad (5th generation)]]==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2"|10.3
| [[ErieTianshan 14E61810k|14E61810k]]
| rowspan="2"|ErieTianshan?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter
|-
| [[ErieTianshan 14E62210l|14E62210l]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter
|-
| rowspan="2"|10.3.2
| [[FranklinTianshan 14F60900i|14F60900i]]
| rowspan="2"|FranklinTianshan
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter
|-
| [[Franklin 14F60900l|14F60900l]]
| ?
| From [https://twitter.com/mcg29_ @mcg29_] on Twitter
|}

== [[IPad_(6th_generation)|iPad (6th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2"|11.3
| [[Emet 15E61570l|15E61570l]]
| rowspan="2"|Emet
| ?
| Found on an FCC test report [https://fccid.io/BCGA1954/Test-Report/LTE-Test-Report-1-3766405]
|-
| [[Emet 15E61570m|15E61570m]]
| ?
| From [https://twitter.com/mcg29_ @mcg29_] on Twitter
|}

== [[P106AP|iPad mini (1st generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 6.0
| [[SundanceTaosTianshan 10A378|10A378]]
| Sundance?
| ?
| Found on an FCC test report [https://fccid.io/BCGA1455/Test-Report/Bluetooth-Test-Report-1808379#pf8]
|-
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| rowspan="3" | SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| ?
| -
|}

== [[J86AP|iPad mini (2nd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|-
| 10.3
| [[Erie 14E62210l|14E62210l]]
| Erie?
| ?
| -
|-
| 11.0
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[J86mAP|iPad mini (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.3
| [[Emet 15E61570m|15E61570m]]
| Emet?
| ?
| From [https://twitter.com/mcg29_ @mcg29_] on Twitter
|}

== [[J96AP|iPad mini (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2"|8.4
| [[Donner 12H33|12H33]]
| rowspan="2"|Donner?
| ?
| Found on an FCC test report [https://fccid.io/BCGA1538/Test-Report/14U19186-E1B-FCC-IC-Bluetooth-Report-2731517]
|-
| [[Donner 12H60160o|12H60160o]]
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
| 9.0.2
| [[MonarchTianshan 13A64520d|13A64520d]]
| MonarchTianshan
| 4.02.00
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
|}

== [[J210AP|iPad mini (5th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2"|12.2
| [[PeaceEYabuli 16E31120n|16E31120n]]
| rowspan="2"|PeaceEYabuli?
| ?
| From [https://twitter.com/laobaitd @laobaiTD] on Twitter
|-
| [[PeaceEYabuli 16E31520i|16E31520i]]
| ?
| Found on an FCC test report [https://fccid.io/BCGA2124/Test-Report/Bluetooth-LE-Test-Report-4198397]
|}

== [[J71AP|iPad Air (1st generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[InnsbruckTaosYabuli 11B34210y|11B34210y]]
| InnsbruckTaosYabuli
| ?
| This is for the [[J72AP|iPad4,2]] model.
|-
| 7.0.x
| [[Innsbruck 11B34640l|11B34640l]]
| InnsbruckTaosYabuli?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620c|11D31620c]]
| Sochi?
| ?
| From [https://www.ebay.com/itm/265204658884#vi__app-cvip-panel this eBay listing]
|}

== [[J82AP|iPad Air (2nd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2"|8.1
| [[OkemoTaos 12B331|12B331]]
| rowspan="2"|OkemoTaos?
| ?
| Found on an FCC test report [https://fccid.io/BCGA1567/Test-Report/BLE-Report-2387920.html#pf6]
|-
| [[OkemoTaos 12B33610i|12B33610i]]
| ?
| From journaldulapin.com [https://www.journaldulapin.com/2017/11/21/ebay-ipad/].
|}

== [[J217AP|iPad Air (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2"|12.2
| [[PeaceEYabuli 16E31120m|16E31120m]]
| rowspan="2"|PeaceEYabuli
| ?
| -
|-
| [[PeaceEYabuli 16E31520i|16E31520i]]
| ?
| Found on an FCC test report [https://fccid.io/BCGA2153/Test-Report/LTE-Test-Report-1-4202786]
|}

== [[J98AP|iPad Pro (unreleased)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 9.0
| [[Monarch 13A165|13A165]]
| Monarch
| 2.15.00 (debug)
| For [[J98AP|J98]]/[[J99AP|99AP]]
|}

== [[J127AP|iPad Pro (9.7-inch) (1st generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 9.3
| [[Eagle 13E31820k|13E31820k]]
| Eagle?
| ?
| Found on an FCC test report [https://fccid.io/BCGA1673/Test-Report/BLE-Repport-2927533]
|}

== [[J98aAP|iPad Pro (12.9-inch) (1st generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 9.1
| [[Boulder 13B72|13B72]]
| Boulder?
| ?
| Found on an FCC test report [https://fccid.io/BCGA1584/Test-Report/DTS-Report-1-2777998]
|}

== [[J121AP|iPad Pro (12.9-inch) (2nd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2"|10.3
| [[Erie 14E232|14E232]]
| rowspan="2"|Erie?
| ?
| Found on an FCC test report [https://fccid.io/BCGA1671/Test-Report/16U23816-E1V1-FCC-IC-BLE-Report-3326478]
|-
| [[Erie 14E32020u|14E32020u]]
| ?
| Found on an FCC test report [https://fccid.io/BCGA1671/Test-Report/16U23816-E10V2-FCC-LTE-Carrier-Aggregation-Report-3325909]
|}

== [[J208AP|iPad Pro (10.5-inch)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 10.3
| [[Erie 14E22020w|14E22020w]]
| Erie?
| ?
| Found on an FCC test report [https://fccid.io/BCGA1709/Test-Report/16U23818-E14V4-FCC-LTE-Carrier-Aggregation-Report-3336517]
|}

== [[J522AP|iPad Pro 12.9 (5th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 14.5
| [[AzulE 18E20700y|18E20700y]]
| AzulE?
| ?
| Found on a FCC test report [https://fccid.io/BCGA2461/Test-Report/Part-96-Test-Report-5192513]
|}

=iPods=
== [[N45AP|iPod touch (1st generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Comments
|-
| 1.1
| [[Snowbird 3A53|3A53]]
| Snowbird
| Found on an FCC test report [https://fccid.io/BCGA1213/Test-Report/Test-Report-838928]
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| rowspan="2" | Inferno?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| -
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Comments
|-
| 4.1
| [[Baker 8B1016c|8B1016c]]
| Baker
| From [https://www.ebay.com/itm/Prototype-Apple-iPod-Touch-4th-Generation/154095204610 this ebay listing] by hap plain
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| -
|}

== [[N78AP|iPod touch (5th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Comments
|-
| 6.0
| [[Sundance 10A351|10A351]]
| Sundance?
| Found on an FCC test report [https://fccid.io/BCG-A1421/Test-Report/Test-Report-WLAN-DTS-1772820]
|}

== [[N102AP|iPod touch (6th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Comments
|-
| 8.3
| [[CopperJade 12H1150f|12H1150f]]
| rowspan="2" | CopperJade
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter.
|-
| 8.4
| [[CopperJade 12H10570d|12H10570d]]
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter.
|-
| 9.3
| [[Castlerock 13C75|13C75]]
| Castlerock
|
|}

[[Category:Firmware]] [[Category:Internal Firmware]]

PeaceG 16G102 (iPhone6,1)

2019-10-05T04:16:28Z

3xpl0itz:

{{keys
| Version = 12.4.1
| Build = 16G102
| Device = iPhone6,1
| Codename = PeaceG
| Baseband = 10.80.02
| DownloadURL = http://updates-http.cdn-apple.com/2019SummerFCS/fullrestores/061-05267/A4464F60-C4E7-11E9-A022-17610AD8B7A1/iPhone_4.0_64bit_12.4.1_16G102_Restore.ipsw

| RootFS = 048-77707-095
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-78047-096
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-76167-096
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n51ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.iphone6.RELEASE.im4p
| iBECIV = 88eddf6ff383b328cbb4091e52b50c57
| iBECKey = a30fa45f2b93f78d1dd2822e4d5799e3e086ef78de66e1167c47dfc6addea6fd

| iBoot = iBoot.iphone6.RELEASE.im4p
| iBootIV = d84111a7f239711ad450e4aa17666439
| iBootKey = e17082c229fbe2ae2112dfc2cefa213dcba4482eb94e9788dd7b50f29b454899

| iBSS = iBSS.iphone6.RELEASE.im4p
| iBSSIV = 4ed57ed25ff841c34449b450e25c47ce
| iBSSKey = 2568a80eeebc2e9954d5215af9f700c4231d84c1faf8599759fbec021721fe34

| Kernelcache = kernelcache.release.iphone6
| KernelcacheIV = Not Encrypted

| LLB = LLB.iphone6.RELEASE.im4p
| LLBIV = a1c1749d7adf0046d0c727cb24c01467
| LLBKey = a792bedd2d74dd438c1601f93b1e9fdc54349a7923db841235a4062448f59920

| RecoveryMode = recoverymode@1136~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n51.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = Unknown
}}

PeaceG 16G102 (iPhone6,1)

2019-10-05T04:06:00Z

3xpl0itz: PeaceG 16G102 (12.4.1) Keys for iPhone6,1

{{keys
| Version = 12.4.1
| Build = 16G102
| Device = iPhone6,1
| Codename = PeaceG
| Baseband = 10.80.02
| DownloadURL = http://updates-http.cdn-apple.com/2019SummerFCS/fullrestores/061-05267/A4464F60-C4E7-11E9-A022-17610AD8B7A1/iPhone_4.0_64bit_12.4.1_16G102_Restore.ipsw

| RootFS = 048-77707-095
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-78047-96
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-76167-096
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n51ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.iphone6.RELEASE.im4p
| iBECIV = 88eddf6ff383b328cbb4091e52b50c57
| iBECKey = a30fa45f2b93f78d1dd2822e4d5799e3e086ef78de66e1167c47dfc6addea6fd

| iBoot = iBoot.iphone6.RELEASE.im4p
| iBootIV = d84111a7f239711ad450e4aa17666439
| iBootKey = e17082c229fbe2ae2112dfc2cefa213dcba4482eb94e9788dd7b50f29b454899

| iBSS = iBSS.iphone6.RELEASE.im4p
| iBSSIV = 4ed57ed25ff841c34449b450e25c47ce
| iBSSKey = 2568a80eeebc2e9954d5215af9f700c4231d84c1faf8599759fbec021721fe34

| Kernelcache = kernelcache.release.iphone6
| KernelcacheIV = Not Encrypted

| LLB = LLB.iphone6.RELEASE.im4p
| LLBIV = a1c1749d7adf0046d0c727cb24c01467
| LLBKey = a792bedd2d74dd438c1601f93b1e9fdc54349a7923db841235a4062448f59920

| RecoveryMode = recoverymode@1136~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n51.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = Unknown
}}

PeaceG 16G114 (iPhone6,1)

2019-10-05T02:41:07Z

3xpl0itz: PeaceG 16G114 (12.4.2) Keys for iPhone6,1

{{keys
| Version = 12.4.2
| Build = 16G114
| Device = iPhone6,1
| Codename = PeaceG
| Baseband = 10.80.02
| DownloadURL = http://updates-http.cdn-apple.com/2019SummerFCS/fullrestores/061-21348/FD35E13C-DC8C-11E9-8BDD-268C66A83945/iPhone_4.0_64bit_12.4.2_16G114_Restore.ipsw

| RootFS = 048-77707-100
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-78047-101
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-76167-101
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n51ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.iphone6.RELEASE.im4p
| iBECIV = 88eddf6ff383b328cbb4091e52b50c57
| iBECKey = a30fa45f2b93f78d1dd2822e4d5799e3e086ef78de66e1167c47dfc6addea6fd

| iBoot = iBoot.iphone6.RELEASE.im4p
| iBootIV = d84111a7f239711ad450e4aa17666439
| iBootKey = e17082c229fbe2ae2112dfc2cefa213dcba4482eb94e9788dd7b50f29b454899

| iBSS = iBSS.iphone6.RELEASE.im4p
| iBSSIV = 4ed57ed25ff841c34449b450e25c47ce
| iBSSKey = 2568a80eeebc2e9954d5215af9f700c4231d84c1faf8599759fbec021721fe34

| Kernelcache = kernelcache.release.iphone6
| KernelcacheIV = Not Encrypted

| LLB = LLB.iphone6.RELEASE.im4p
| LLBIV = a1c1749d7adf0046d0c727cb24c01467
| LLBKey = a792bedd2d74dd438c1601f93b1e9fdc54349a7923db841235a4062448f59920

| RecoveryMode = recoverymode@1136~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n51.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = Unknown
}}

T8027

2018-09-17T20:24:34Z

3xpl0itz: T8027 (See TigrisAni 15A783601y)

The '''T8027''' is a currently unreleased processor, first found in [[TigrisAni 15A783601y]]. This page may be changed if it is released in a later iDevice.

==Bootrom Exploits==
There are no known exploits.

{{stub|hardware}}
[[Category:Application Processors]]

NonUI builds

2018-09-14T20:42:12Z

3xpl0itz: Minor revisions, formatting (making it pretty)

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|130px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|130px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|130px|right|Prototype showing newer Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|130px|left|Prototype showing older Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="3" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| rowspan="2" | 1.1.3
| [[Alpine 4A102a|4A102a]]
| Alpine
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| Apex?
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 1.0.10
| -
|-
| 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| Sochi?
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| InnsbruckNanshan
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| Okemo?
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| OkemoAni
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| OkemoAni
| 1.00.05
| -
|-
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| Monarch?
| 1.00.05
| -
|-
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| Whitetail?
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| WhitetailAni
| ?
| -
|-
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
| Version
| Build
| Codename
| Baseband
| Comments
|-
| 11.0
| [[TigrisAni 15A783601y|15A783601y]]
| TigrisAni?
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| Wildcat?
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango?
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| SundanceTaosTianshan
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| Inferno?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| ?
| -
|}

[[Category:Firmware]]

NonUI builds

2018-09-13T20:39:13Z

3xpl0itz: DEVELOPMENT dyld shared cache, minor revisions

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|125px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|125px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|125px|right|Prototype showing Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|125px|left|Prototype showing Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="3" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| rowspan="2" | 1.1.3
| [[Alpine 4A102a|4A102a]]
| Alpine
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| Apex?
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 1.0.10
| -
|-
| 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| Sochi?
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| InnsbruckNanshan
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| Okemo?
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| OkemoAni
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| OkemoAni
| 1.00.05
| -
|-
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| Monarch?
| 1.00.05
| -
|-
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| Whitetail?
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| WhitetailAni
| ?
| -
|-
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
| Version
| Build
| Codename
| Baseband
| Comments
|-
| 11.0
| [[TigrisAni 15A783601y|15A783601y]]
| TigrisAni?
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| Wildcat?
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango?
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| SundanceTaosTianshan
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| Inferno?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| ?
| -
|}

[[Category:Firmware]]

NonUI builds

2018-09-13T20:32:02Z

3xpl0itz: Baseband in a nonUI bundle is almost always DEBUG, slight revisions

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|125px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|125px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|125px|right|Prototype showing Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|125px|left|Prototype showing Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols, and with individual kexts in <code>/System/Library/Extensions</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="3" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| rowspan="2" | 1.1.3
| [[Alpine 4A102a|4A102a]]
| Alpine
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| Apex?
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 1.0.10
| -
|-
| 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| Sochi?
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| InnsbruckNanshan
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| Okemo?
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| OkemoAni
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| OkemoAni
| 1.00.05
| -
|-
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| Monarch?
| 1.00.05
| -
|-
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| Whitetail?
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| WhitetailAni
| ?
| -
|-
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
| Version
| Build
| Codename
| Baseband
| Comments
|-
| 11.0
| [[TigrisAni 15A783601y|15A783601y]]
| TigrisAni?
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| Wildcat?
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango?
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| SundanceTaosTianshan
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| Inferno?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| ?
| -
|}

[[Category:Firmware]]

NonUI builds

2018-09-13T20:24:17Z

3xpl0itz: Removed unneeded "DEBUG"

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|125px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|125px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|125px|right|Prototype showing Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|125px|left|Prototype showing Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in \Firmware\dfu\ and \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols, and with individual kexts in /System/Library/Extensions
* Skankwerk (gear) logo image file in \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* /AppleInternal folder, which the hierarchy inside get priority over hierarchy in /.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* /usr and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some Private Frameworks in /System/Library/PrivateFrameworks for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="3" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| rowspan="2" | 1.1.3
| [[Alpine 4A102a|4A102a]]
| Alpine
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| Apex?
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 1.0.10
| -
|-
| 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| Sochi?
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| InnsbruckNanshan
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| Okemo?
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| OkemoAni
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| OkemoAni
| 1.00.05
| -
|-
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| Monarch?
| 1.00.05
| -
|-
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| Whitetail?
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| WhitetailAni
| ?
| -
|-
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
| Version
| Build
| Codename
| Baseband
| Comments
|-
| 11.0
| [[TigrisAni 15A783601y|15A783601y]]
| TigrisAni?
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| Wildcat?
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango?
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| SundanceTaosTianshan
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| Inferno?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| ?
| -
|}

[[Category:Firmware]]

NonUI builds

2018-09-13T20:22:59Z

3xpl0itz: Removed unneeded "DEBUG"

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|125px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|125px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|125px|right|Prototype showing Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|125px|left|Prototype showing Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in \Firmware\dfu\ and \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols, and with individual kexts in /System/Library/Extensions
* Skankwerk (gear) logo image file in \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* /AppleInternal folder, which the hierarchy inside get priority over hierarchy in /.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* /usr and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some Private Frameworks in /System/Library/PrivateFrameworks for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="3" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| rowspan="2" | 1.1.3
| [[Alpine 4A102a|4A102a]]
| Alpine
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| Apex?
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 1.0.10
| -
|-
| 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| Sochi?
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| InnsbruckNanshan
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| Okemo?
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| OkemoAni
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| OkemoAni
| 1.00.05
| -
|-
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| Monarch?
| 1.00.05
| -
|-
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| Whitetail?
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| WhitetailAni
| ?
| -
|-
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09-DEBUG
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
| Version
| Build
| Codename
| Baseband
| Comments
|-
| 11.0
| [[TigrisAni 15A783601y|15A783601y]]
| TigrisAni?
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| Wildcat?
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango?
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| SundanceTaosTianshan
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| Inferno?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| ?
| -
|}

[[Category:Firmware]]

TigrisAni 15A783601y

2018-09-13T19:16:22Z

3xpl0itz: Minor revisions

{{internal software|firmware}}
[[File:IphX_15A783601y.jpg|thumb|right|500px|iPhone X prototype running 15A783601y]]
== Background ==
This firmware is an internal NonUI build of iOS 11.0. While a seemingly earlier version of [[TigrisAni 15A93261h]], this firmware is one of the first to be seen running on an [[iPhone X]] prototype. It is also not too well optimized for the phone's new screen, notch, and rounded corners, with parts of the screen being cut off towards the edges.

This build does not contain kernels (mach files) for the [[t8020]] processor, however kernel extensions for [[t8020]] and [[t8027]] are present. This build also contains diags (diagnostics) images for the iPhone X.

== Applications ==
Upon booting into [[SwitchBoard.app]], the following apps are visible:
*[[AltoMobile]]
*[[ExtendedOQC]]
*[[GrapeCal]]
*[[GrapeCal_Lite]]
*[[NonUIConsoleViewer]]
*[[OrbCal]]
*[[Reliability]]
*[[Sequencer]]
*[[Spelunx]]
*[[Stencil]]
*[[USBHost]]
*[[WiPASmini]]

ITunes Errors/Below 100

2018-09-11T20:49:28Z

3xpl0itz: ASR Stuff v2

=== Error 1 ===

* You are attempting to downgrade an iPhone from iOS 5 to iOS 4.x. To resolve, use either custom firmware created by [[PwnageTool]]/[[sn0wbreeze]] or use [[User:semaphore|notcom]]'s [[FixRecovery]] utility available on [http://thefirmwareumbrella.blogspot.com his site].
* On an [[iPhone 4]] downgrading from iOS 5, use the option in [[TinyUmbrella]] to allow a baseband "upgrade" to bypass the error and go back to basband [[4.10.1]].
* Unable to downgrade. Try changing the USB port (the back one of chassis is better) and restart computer.
* The installed version of [[iTunes]] may also be too old. Update iTunes.
* You are trying to downgrade an [[iPhone 4]] to an earlier version of iOS 5, using redsn0w. To resolve, stitch your blobs to a "No_BB" ipsw of the firmware you are trying to downgrade to.

=== Error 2 ===
* ASR does not exist on ramdisk or is corrupt/not signed.
* [[sn0wbreeze]] 1.6 Custom Firmware has a [[ASR]] patch problem. Use [[sn0wbreeze]] 1.7+ or [[PwnageTool]]. Device isn't bootable.

=== Error 6 ===
* Not enter the downgrading mode, change USB port (the back one of chassis is better) and restart computer.
* Unable to resize partition due to full storage problem at final stage of updating firmware. The error may be bypassed (restart and do exit recovery) but you probably need to re-update it one more time.

=== Error 9 ===
* Due to asr being patched, the SHA signature is automatically changed and after being resigned the kernel will refuse to use it. Therefore proper kernel patches are required. If necessary kernel patches are not applied, it will fail to load asr and error 9 would occur during restore.
* Rebooting your Mac or PC may resolve this issue.

=== Error 10 ===
[[LLB]] is missing from the [[IPSW File Format|IPSW]]. The device cannot be booted up. The trick to skip the baseband update no longer works.

=== Error 11 ===
* Removed [[Baseband|BB]]<nowiki />FW file in the firmware folder of an unzipped [[IPSW File Format|IPSW]]. Can also be used to prevent a baseband update. The device is bootable, if you set the auto-boot to true or use TinyUmbrella and use "Kick Device out of Recovery".
* You are trying to update to a custom firmware from [[PwnageTool]] 4.1+. You always have to go into DFU mode and restore from there.
* Occurs when attempting to restore a signed custom firmware on the iPhone 4 using iTunes 11.1 or newer. Downgrade to an earlier iTunes to fix.
* Installed version of [[iTunes]] is too old to recognize your device, update [[iTunes]] and try again.

=== Error 13 ===
* Occurs when you want to install an iOS 4.1 beta firmware with [[iTunes]] for Windows (actively blocked by Apple; beta users are developers and therefore must have a Mac).
* USB problem. Check the USB connection and try other direct ports or maybe the USB cable is an older one. Device isn't bootable.
* The installed version of [[iTunes]] may also be too old. For firmwares 4.0 and higher you need iTunes 9.2 or higher. Update iTunes.

=== Error 14 ===
* Custom firmware update fail ([[PwnageTool]] until 4.0.1). You have to restore the device with a custom firmware. Update to a custom firmware isn't working. Device isn't bootable. <sup>2</sup>
* USB Problem. Check the USB connection and try other direct ports or maybe the USB cable is an older one. Device isn't bootable.
* You're trying to 'update' to a [[Beta Firmware|beta firmware]] instead of performing a restore. Device is still bootable if you kick it out of recovery mode.
* Rebooting your Mac or PC may resolve this issue.
* Root file-system partition size was set too small in the ramdisk's options plist, or the root filesystem size somehow exceeds the storage capacity of the device ("not enough space in /dev/disk0s1 to restore" according to ASR)
* Root file-system dmg is corrupted or ASR has not been correctly patched. Re-download your IPSW or correctly patch ASR (see [https://www.theiphonewiki.com/wiki/Making_PwnageTool_Bundles#ASR|Making PwnageTool Bundles - ASR]).

=== Error 17 ===
* Device failed to display the applelogo img3 which results in this error.
* One or more of the nand0/nor0 flash images were missing from the IPSW.

=== Error 18 ===
This occurs when the media library on the device is corrupt and cannot be modified or updated.

Updating to the latest version of iTunes and then restoring should resolve this issue

=== Error 20 ===
Reportedly happens during failed downgrade attempts (iPhone OS 2.0 to 1.1.1, iOS 5 beta to 4.3.3).

Some have seen success afterwards by doing the downgrade from DFU mode instead of the normal Recovery mode.

=== Error 21 ===
* Custom firmware restore fail ([[PwnageTool]] since 4.1). You have to put your device into the DFU mode and not into recovery mode. Device won't boot correctly an stuck at the Apple logo after the error. Press and hold power and home button until it reboots.
* Error when using Sauriks server for a restore with iOS 5.x in the recovery mode at least on a A5 device.
* This error can also happen when you try to restore an iPod with hardware dfu. Use iREB r5 to solve this.
* You are trying to update to a beta firmware without UDID activation.

=== Error 23 ===
Cannot restore or update due to hardware problems.
* In software you have to set default web browser.
* In hardware, it's a communication problem. Check all connections, also try to change battery.
* Faulty [[baseband]] flash or processor
* Happens frequently after water damage. Remove and clean motherboard.

=== Error 26 ===
* Values or variables in the options property list within the ramdisk are incorrect.
* False version of the [[NOR]] flash firmware. Use the correct [[sn0wbreeze]] version.

=== Error 27 ===
* Trying to flash iOS 5 from an [[N88AP|iPhone 3GS]] on a 3G Phone. Modify the restore.plist so it would flash and also exchanged RestoreRamDisk and kernelcache.
* Failed attempt of upgrading an [[iPod touch (5th generation)]] from an older iOS to iOS 9.0 beta. Can be resolved by restoring to the latest public version and trying the upgrade again.

=== Error 28 ===
* Hardware error. Return your device to Apple if possible. The problem is a bad dock connector on the iPhone. Must change the connector.
* If you have tried almost everything, reset the logic board (leave uncharged for five days or remove battery for half an hour), then pwn and restore. If this doesn't work, the memory of your device is damaged.
* Hardware is incompatible with iOS Version. Typically seen with iPhone 4 GSM models trying to be restore to iOS 4.0. Can also be seen when trying to restore any geekgrade iOS 4 IPSW on an 8GB [[N90AP|iPhone 4 (iPhone3,1)]].
* Device has counterfeit display that is incompatible with a certain iOS versions (Typically iOS 5.X)

=== Error 29 ===
See [http://discussions.apple.com/ Apple's discussion thread] number [http://discussions.apple.com/thread.jspa?threadID=2329795 2329795] about this problem. You might need to change the battery.

=== Error 31 ===
{{main|DFU Loop}}

=== Error 34 ===
Hard disk is run out of space when trying to download. Clear space and then continue downloading.

=== Error 37 ===
* [[N72AP|iPod touch (2nd generation)]] [[LLB]] patched with the [[0x24000 Segment Overflow]] was used on an [[N88AP|iPhone 3GS]] custom firmware. Known on damaged bundles from unofficial [[PwnageTool]] distributions or bundles.
* [[sn0wbreeze]] 2.0.1 bug, which was fixed in 2.0.2.
* Recent [[sn0wbreeze]] can cause this issue. Deselect all custom boot logos, recreate [[IPSW File Format|IPSW]]. If received on an [[N88AP|iPhone 3GS]], select "new boot-rom" and deselect all custom [[AppleLogo|boot logos]], then recreate the [[IPSW File Format|IPSW]].
* Attempting restore with an IPSW that was stiched with blobs not for your device (Usually a good thing if restoreing with a geekgrade beta IPSW or with your own creation). To boot, simply open redsn0w. Do fix recovery and tether boot after. Do not lock or device's LCD will fail.

=== Error 40 ===
* Hacktivation bug in [[sn0wbreeze]] 2.0.1, which was fixed in sn0wbreeze 2.0.2.
* NAND chip is dead (confirm with ASR output from restore log).

=== Error 45 ===
* Same with Error 6, in terms of resizing partition issue. But this may occur at the very beginning of restore process.

=== Error 48 ===
* Dead/Malfunctioning baseband chip during restore/update, try again and if it doesn't work, a hardware fix will be necessary.

=== Error 53 ===
* Happens on devices with damaged Touch ID, cause is most likely water damage. DFU restoring to iOS 9.2.1 (13D20) or later will let the device boot but Touch ID will fail to work. Bring the device to Apple if possible.
* Can be an error with [[iTunes]]. In this case, change your DNS to 8.8.8.8 and try again.

=== Error 56 ===
* Most likely a dead/glitched Touch ID sensor. If seen on iPad's, try restoring the latest firmware in DFU mode. If error still occurs, bring your device to Apple. On iPhones, take out the SIM card and try restoring in DFU mode. If still occurring, bring your device to apple.
[[Category:Errors]]

ITunes Errors/Below 100

2018-09-11T20:35:52Z

3xpl0itz: ASR

=== Error 1 ===

* You are attempting to downgrade an iPhone from iOS 5 to iOS 4.x. To resolve, use either custom firmware created by [[PwnageTool]]/[[sn0wbreeze]] or use [[User:semaphore|notcom]]'s [[FixRecovery]] utility available on [http://thefirmwareumbrella.blogspot.com his site].
* On an [[iPhone 4]] downgrading from iOS 5, use the option in [[TinyUmbrella]] to allow a baseband "upgrade" to bypass the error and go back to basband [[4.10.1]].
* Unable to downgrade. Try changing the USB port (the back one of chassis is better) and restart computer.
* The installed version of [[iTunes]] may also be too old. Update iTunes.
* You are trying to downgrade an [[iPhone 4]] to an earlier version of iOS 5, using redsn0w. To resolve, stitch your blobs to a "No_BB" ipsw of the firmware you are trying to downgrade to.

=== Error 2 ===
* ASR does not exist on ramdisk or is corrupt/not signed.
* [[sn0wbreeze]] 1.6 Custom Firmware has a [[ASR]] patch problem. Use [[sn0wbreeze]] 1.7+ or [[PwnageTool]]. Device isn't bootable.

=== Error 6 ===
* Not enter the downgrading mode, change USB port (the back one of chassis is better) and restart computer.
* Unable to resize partition due to full storage problem at final stage of updating firmware. The error may be bypassed (restart and do exit recovery) but you probably need to re-update it one more time.

=== Error 9 ===
* Due to asr being patched, the SHA signature is automatically changed and after being resigned the kernel will refuse to use it. Therefore proper kernel patches are required. If necessary kernel patches are not applied, it will fail to load asr and error 9 would occur during restore.
* Rebooting your Mac or PC may resolve this issue.

=== Error 10 ===
[[LLB]] is missing from the [[IPSW File Format|IPSW]]. The device cannot be booted up. The trick to skip the baseband update no longer works.

=== Error 11 ===
* Removed [[Baseband|BB]]<nowiki />FW file in the firmware folder of an unzipped [[IPSW File Format|IPSW]]. Can also be used to prevent a baseband update. The device is bootable, if you set the auto-boot to true or use TinyUmbrella and use "Kick Device out of Recovery".
* You are trying to update to a custom firmware from [[PwnageTool]] 4.1+. You always have to go into DFU mode and restore from there.
* Occurs when attempting to restore a signed custom firmware on the iPhone 4 using iTunes 11.1 or newer. Downgrade to an earlier iTunes to fix.
* Installed version of [[iTunes]] is too old to recognize your device, update [[iTunes]] and try again.

=== Error 13 ===
* Occurs when you want to install an iOS 4.1 beta firmware with [[iTunes]] for Windows (actively blocked by Apple; beta users are developers and therefore must have a Mac).
* USB problem. Check the USB connection and try other direct ports or maybe the USB cable is an older one. Device isn't bootable.
* The installed version of [[iTunes]] may also be too old. For firmwares 4.0 and higher you need iTunes 9.2 or higher. Update iTunes.

=== Error 14 ===
* Custom firmware update fail ([[PwnageTool]] until 4.0.1). You have to restore the device with a custom firmware. Update to a custom firmware isn't working. Device isn't bootable. <sup>2</sup>
* USB Problem. Check the USB connection and try other direct ports or maybe the USB cable is an older one. Device isn't bootable.
* You're trying to 'update' to a [[Beta Firmware|beta firmware]] instead of performing a restore. Device is still bootable if you kick it out of recovery mode.
* Rebooting your Mac or PC may resolve this issue.
* Root file-system partition size was set too small in the ramdisk's options plist, or the root filesystem size somehow exceeds the storage capacity of the device ("not enough space in /dev/disk0s1 to restore" according to ASR)

=== Error 17 ===
* Device failed to display the applelogo img3 which results in this error.
* One or more of the nand0/nor0 flash images were missing from the IPSW.

=== Error 18 ===
This occurs when the media library on the device is corrupt and cannot be modified or updated.

Updating to the latest version of iTunes and then restoring should resolve this issue

=== Error 20 ===
Reportedly happens during failed downgrade attempts (iPhone OS 2.0 to 1.1.1, iOS 5 beta to 4.3.3).

Some have seen success afterwards by doing the downgrade from DFU mode instead of the normal Recovery mode.

=== Error 21 ===
* Custom firmware restore fail ([[PwnageTool]] since 4.1). You have to put your device into the DFU mode and not into recovery mode. Device won't boot correctly an stuck at the Apple logo after the error. Press and hold power and home button until it reboots.
* Error when using Sauriks server for a restore with iOS 5.x in the recovery mode at least on a A5 device.
* This error can also happen when you try to restore an iPod with hardware dfu. Use iREB r5 to solve this.
* You are trying to update to a beta firmware without UDID activation.

=== Error 23 ===
Cannot restore or update due to hardware problems.
* In software you have to set default web browser.
* In hardware, it's a communication problem. Check all connections, also try to change battery.
* Faulty [[baseband]] flash or processor
* Happens frequently after water damage. Remove and clean motherboard.

=== Error 26 ===
* Values or variables in the options property list within the ramdisk are incorrect.
* False version of the [[NOR]] flash firmware. Use the correct [[sn0wbreeze]] version.

=== Error 27 ===
* Trying to flash iOS 5 from an [[N88AP|iPhone 3GS]] on a 3G Phone. Modify the restore.plist so it would flash and also exchanged RestoreRamDisk and kernelcache.
* Failed attempt of upgrading an [[iPod touch (5th generation)]] from an older iOS to iOS 9.0 beta. Can be resolved by restoring to the latest public version and trying the upgrade again.

=== Error 28 ===
* Hardware error. Return your device to Apple if possible. The problem is a bad dock connector on the iPhone. Must change the connector.
* If you have tried almost everything, reset the logic board (leave uncharged for five days or remove battery for half an hour), then pwn and restore. If this doesn't work, the memory of your device is damaged.
* Hardware is incompatible with iOS Version. Typically seen with iPhone 4 GSM models trying to be restore to iOS 4.0. Can also be seen when trying to restore any geekgrade iOS 4 IPSW on an 8GB [[N90AP|iPhone 4 (iPhone3,1)]].
* Device has counterfeit display that is incompatible with a certain iOS versions (Typically iOS 5.X)

=== Error 29 ===
See [http://discussions.apple.com/ Apple's discussion thread] number [http://discussions.apple.com/thread.jspa?threadID=2329795 2329795] about this problem. You might need to change the battery.

=== Error 31 ===
{{main|DFU Loop}}

=== Error 34 ===
Hard disk is run out of space when trying to download. Clear space and then continue downloading.

=== Error 37 ===
* [[N72AP|iPod touch (2nd generation)]] [[LLB]] patched with the [[0x24000 Segment Overflow]] was used on an [[N88AP|iPhone 3GS]] custom firmware. Known on damaged bundles from unofficial [[PwnageTool]] distributions or bundles.
* [[sn0wbreeze]] 2.0.1 bug, which was fixed in 2.0.2.
* Recent [[sn0wbreeze]] can cause this issue. Deselect all custom boot logos, recreate [[IPSW File Format|IPSW]]. If received on an [[N88AP|iPhone 3GS]], select "new boot-rom" and deselect all custom [[AppleLogo|boot logos]], then recreate the [[IPSW File Format|IPSW]].
* Attempting restore with an IPSW that was stiched with blobs not for your device (Usually a good thing if restoreing with a geekgrade beta IPSW or with your own creation). To boot, simply open redsn0w. Do fix recovery and tether boot after. Do not lock or device's LCD will fail.

=== Error 40 ===
* Hacktivation bug in [[sn0wbreeze]] 2.0.1, which was fixed in sn0wbreeze 2.0.2.
* NAND chip is dead (confirm with ASR output from restore log).

=== Error 45 ===
* Same with Error 6, in terms of resizing partition issue. But this may occur at the very beginning of restore process.

=== Error 48 ===
* Dead/Malfunctioning baseband chip during restore/update, try again and if it doesn't work, a hardware fix will be necessary.

=== Error 53 ===
* Happens on devices with damaged Touch ID, cause is most likely water damage. DFU restoring to iOS 9.2.1 (13D20) or later will let the device boot but Touch ID will fail to work. Bring the device to Apple if possible.
* Can be an error with [[iTunes]]. In this case, change your DNS to 8.8.8.8 and try again.

=== Error 56 ===
* Most likely a dead/glitched Touch ID sensor. If seen on iPad's, try restoring the latest firmware in DFU mode. If error still occurs, bring your device to Apple. On iPhones, take out the SIM card and try restoring in DFU mode. If still occurring, bring your device to apple.
[[Category:Errors]]

NonUI builds

2018-08-30T14:52:16Z

3xpl0itz:

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|125px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|125px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|125px|right|Prototype showing Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|125px|left|Prototype showing Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in \Firmware\dfu\ and \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols, and with individual kexts in /System/Library/Extensions
* Skankwerk (gear) logo image file in \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* /AppleInternal folder, which the hierarchy inside get priority over hierarchy in /.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* /usr and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some Private Frameworks in /System/Library/PrivateFrameworks for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="3" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| rowspan="2" | 1.1.3
| [[Alpine 4A102a|4A102a]]
| Alpine
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| Apex?
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 1.0.10
| -
|-
| 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| Sochi?
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| InnsbruckNanshan
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| Okemo?
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| OkemoAni
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| OkemoAni
| 1.00.05
| -
|-
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08_DEBUG
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| Monarch?
| 1.00.05
| -
|-
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| Whitetail?
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| WhitetailAni
| ?
| -
|-
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09-DEBUG
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
| Version
| Build
| Codename
| Baseband
| Comments
|-
| 11.0
| [[TigrisAni 15A783601y|15A783601y]]
| TigrisAni?
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| Wildcat?
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango?
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| SundanceTaosTianshan
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| Inferno?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| ?
| -
|}

[[Category:Firmware]]

NonUI builds

2018-08-30T14:50:26Z

3xpl0itz:

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|125px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|125px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|125px|right|Prototype showing Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|125px|left|Prototype showing Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in \Firmware\dfu\ and \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols, and with individual kexts in /System/Library/Extensions
* Skankwerk (gear) logo image file in \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* /AppleInternal folder, which the hierarchy inside get priority over hierarchy in /.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* /usr and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed - as dropbear, can be connected to over the usb protocol
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some Private Frameworks in /System/Library/PrivateFrameworks for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="3" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| rowspan="2" | 1.1.3
| [[Alpine 4A102a|4A102a]]
| Alpine
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| Apex?
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 1.0.10
| -
|-
| 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| Sochi?
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| InnsbruckNanshan
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| Okemo?
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| OkemoAni
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| OkemoAni
| 1.00.05
| -
|-
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08_DEBUG
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| Monarch?
| 1.00.05
| -
|-
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| Whitetail?
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| WhitetailAni
| ?
| -
|-
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09-DEBUG
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
| Version
| Build
| Codename
| Baseband
| Comments
|-
| 11.0
| [[TigrisAni 15A783601y|15A783601y]]
| TigrisAni?
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| Wildcat?
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango?
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| SundanceTaosTianshan
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| Inferno?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| ?
| -
|}

[[Category:Firmware]]

NonUI builds

2018-08-30T14:45:57Z

3xpl0itz: Minor revisions, added a bit of info, references

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|125px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|125px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|125px|right|Prototype showing Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|125px|left|Prototype showing Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allow launching a GUI of some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in \Firmware\dfu\ and \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols, and with individual kexts in /System/Library/Extensions
* Skankwerk (gear) logo image file in \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* /AppleInternal folder, which the hierarchy inside get priority over hierarchy in /.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* /usr and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed - as dropbear, can be connected to over the usb protocol
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable AMFI
* It has some Private Frameworks in /System/Library/PrivateFrameworks for internal GUI apps and command line utilities.
* Most internal applications require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="3" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| rowspan="2" | 1.1.3
| [[Alpine 4A102a|4A102a]]
| Alpine
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| Apex?
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 1.0.10
| -
|-
| 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| Sochi?
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| InnsbruckNanshan
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| Okemo?
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| OkemoAni
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| OkemoAni
| 1.00.05
| -
|-
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08_DEBUG
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| Monarch?
| 1.00.05
| -
|-
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| Whitetail?
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| WhitetailAni
| ?
| -
|-
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09-DEBUG
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
| Version
| Build
| Codename
| Baseband
| Comments
|-
| 11.0
| [[TigrisAni 15A783601y|15A783601y]]
| TigrisAni?
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| Wildcat?
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango?
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| SundanceTaosTianshan
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| Inferno?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| ?
| -
|}

[[Category:Firmware]]

PurpleRestore

2018-08-25T03:56:43Z

3xpl0itz: Removed any false/misleading information, formatting, added a bit more info, organization

{{internal software}}
{{Infobox software
| name = PurpleRestore
| title = PurpleRestore
| logo = [[File:PurpleRestore3_logo.png|150px]]
| screenshot = [[File:PurpleRestore3.png|300px]]
| caption = PurpleRestore 3.0 (313.1.5.1.1)(14A83432a)
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release version = 3.0 (313.1.5.1.1) (14A83432a)<br /><small>(latest ''known'' version)</small>
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:macOS|macOS]]
| platform =
| size =
| language = [[wikipedia:English language|English]]
| status =
| genre = Firmware flasher
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}
{{float toc|left}}
'''PurpleRestore''' is a tool made by Apple and is used for flashing [[iDevice]]s. It provides far more customization than [[iTunes]], and is known to be used to flash internal firmware to [[prototypes]]. Little is currently known about which versions it "supports" for restoring as such. PurpleRestore is installed by [[RestoreTools.pkg]] or Home Diagnostics. A CLI version of PurpleRestore is included (mobile_restore).

This tool can (and is meant to) handle multiple restores. When performing restores, PurpleRestore color coordinates the device in the table and when the device is about to receive the AppleLogo it will turn the background color of the screen to the color assigned to the device. Like [[iTunes]], PurpleRestore communicates with devices using a [[usbmux]] connection.

== PurpleRestore 3 ==
PurpleRestore 3 is the latest known version of PurpleRestore. It was initially leaked on Twitter in October 2016. The update sports a redesigned user interface and icon, support for IPSW files, and revealed the existence of an internal PurpleRestore wiki, which most likely requires access to Apple's internal VPN. The boot screen on the device doesn't turn purple when restoring with the tool without a debug UART cable, unlike previous versions of the tool. PurpleRestore 3 also has full macOS Sierra support, which was broken in most of the previous builds.

The updated utility also allows you to flash a custom boot logo. This likely requires authorization with TSS to personalize the IMG3/IMG4 before flashing the image to the device.

== Restore Bundles ==
PurpleRestore uses "Restore Bundles" which can be obtained from a server specific to versions of iOS, such as <code>afp://fieldgoal.apple.com/RestoreImages/</code> and <code>afp://endzone.apple.com/OldRestoreImages/</code> (among many others) . Unfortunately, these <code>afp</code> servers can only be accessed through Apple's internal VPN. PurpleRestore is essentially useless to the general public, because it can only install currently signed iOS versions without having Apple VPN access.

You can create your own bundles by extracting an IPSW into a folder, and restore them if they are being signed; or if you have SHSH blobs saved for an A4 device (and below) then you can either stitch or use [[TinyUmbrella]] to assist in a downgrade without the need for iTunes; you will still need to put your device into pwned DFU Mode. This will not give you any internal debugging abilities nor jailbreak your device.

As of PurpleRestore 3, an IPSW may be used in place of a restore bundle.

== Restore Components ==
Restore Components has several options:
* '''Restore Bundle''': Specify the bundle to use in restoring
* '''Firmware Directory''': Specify the folder where the [[LLB]], [[iBoot (Bootloader)|iBoot]], etc. [[IMG3 File Format|IMG3]]/[[IMG4 File Format|IMG4]] files are located.
* '''Ramdisk Image''': Specify a [[ramdisk]] to be used (i.e. [[Restore Ramdisk|restore]] or [[Update Ramdisk|update]] ramdisk)
* '''DFU''': Specify what tools to upload based on a selection of "Debug", "Development", or "Release". A specific file can also be selected.

== Restore Operations ==
[[File:IPhoneDuringPurpleRestore.jpeg|250px|thumb|right|iPhone 5 undergoing a PurpleRestore]]
Restore Operations contains the most options to configure. These may also be the most useful ones.

* '''Hardware Readiness'''
** '''Minimum Battery Charge (mV)''': This value controls the minimum charge level at which the restore will be allowed to continue. Below this threshold, we either wait to charge (if we're charging) or fail (if we're not charging). If this option is not specified, a default value is used (currently 3.8 V). Setting this option to 0 bypasses all battery level checks.
** '''Wait for Minimum Charge''': If the current voltage is below the minimum level, then the default behavior is to let the device charge and then continue. This option overrides that behavior when false.
** '''Wait for Storage Device''': Controls whether the restore waits for the storage device /dev/disk0 to be available before the restore is initiated.
** '''Allow Untethered Restore''': Permit the restore to run untethered (not connected to a host). The result of specifying this option when the restore needs data from the host (for instance, when flashing NOR) is undefined (but probably bad). If this option is specified and the device remains tethered, things should proceed as usual.
* '''Storage Media'''
** '''Use LwVM''': Controls whether the device is formatted for LwVM (if supported).
** '''Repartition''': Controls whether a new partition map is created on the device.
** '''System Partition Size (MiB)''': Specifies the size (in mebibytes) that is desired for the system partition. Because the partition size can only be changed when creating a new partition map, this option is only relevant when used in conjunction with repartition. A size of 0 indicates that the restore library should choose a suitable size for you, based on the specific restore bundle and image being used if possible.
** '''Content Protection Type''': Controls the type of data protection used on the device.
** '''Low-Level Erase''': Do a low level erase (wipe with null or random data) of the entire storage device prior to restoring.
* '''Restore System Partition'''
** '''System Image''': Determines which type of system image to restore, or which file to use for the system image.
** '''Kernel Cache Type''': This option controls the kernel cache that gets installed on the device.
* '''Baseband'''
** '''Update Baseband''': Controls whether the [[baseband]] and baseband bootloader are updated as part of the restore.
** '''Force Update''': The baseband update is skipped when the existing firmware matches the available firmware. In some cases, it is desirable to force the firmware update to occur, regardless of what is currently on there. This option, when set to true, forces the update to be attempted.

== Restore OS ==
Restore OS options allow you to specify the following:
* '''Restore Boot-Args''': Boot-Args used when the Restore OS is loaded. By default those arguments are used: "debug=0x14e serial=3 rd=md0 nand-enable-reformat=1 -progress"
* '''Firmware Type:''' Specify the firmware which should be flashed when restoring. This can either be "Debug", "Factory FA", "Factory SA", "Firmware Development" or "Production".
* '''Boot Image Type:''' Can be "Internal", "User or Internal", "User" or "Update".
* '''Boot Kernel Cache:''' Specify whether the "Production" or "Development" kernel cache should be used.

== Personalization Settings ==
As with iTunes, PurpleRestore can personalize builds for iOS devices (since recent Bootroms expect a valid APTicket). The tooltip for the "Personalized Restore" checkbox reads "Your ticket to the Orwellian cloud." This may suggest that Apple developed TSS in part to control access to internal build variants (i.e. prevent leaks of "interesting" builds of iOS), in addition to preventing production users from downgrading.
* '''Variants''': "A predefined combination of restore pieces." The options are: "Customer Install", "Internal Debug", "Internal Development", "Internal Install", "Internal Qualification", and "Vendor install."
* '''AppleConnect''': Used to authenticate all restores for personalization. Interestingly, AppleConnect will allow members of the iOS Developer Program (including non-employees) to install public builds of iOS (latest current and beta). It's likely AppleConnect is also used to authenticate signing of internal builds using the public TSS server, should the device be on the whitelist.

== Restore Settings ==
[[File:PurpleRestoreOptions.png|250px|thumb|right|PurpleRestore configuration screen]]
By default, PurpleRestore comes with two pre-made restore settings. "Erase Install" and "Update Install". Those restore settings are [[wikipedia:property list|property list]]s that define the options PurpleRestore will use when restoring a device.
* '''Erase Install''': Repartition the media and erase all data before restoring. Includes all internal development tools and updates flash and the baseband by default.
* '''Update Install''': Includes all internal development tools and updates flash and the baseband by default.
{{clear}}

== Problems ==
There are some problems with the leaked versions, because they may not support current devices or iOS versions.

=== PurpleRestore ===

[[File:IBECStuck.png|250px|thumb|right|Stuck on Executing iBEC]]
One problem on older versions of PurpleRestore (common) is getting stuck at "Executing iBEC to bootstrap update". This is likely a signing error; the device may have rejected the iBEC image due to an invalid or missing APTicket, trying to use AppleConnect, the TSS server is no longer accepting signatures for the version you are installing, or the nonce has been mismatched.

Another problem can be encountered when a device is in [[DFU Mode]]; the tool will send the DFU image, and the iDevice will repeatedly disconnect and reconnect.

If you check "Allow baseband roll-backs", disable "Allow AppleConnect", and uncheck using of LwVM under Editor, selecting Personalized IPSW will cause PurpleRestore to freeze on "Waiting for device" and creates another session with "IDLE" status. If you then try to select that new session and try the same settings, it starts the restore process and successfully restore the IPSW to device.

Versions older than PurpleRestore 3 do not support A7+ devices, due to many changes in newer architectures, BootROM, etc.

=== PurpleRestore 3 ===

PurpleRestore 3 also is supposed to have icons for each device plugged in, but some devices (including iPhones) don't have icons; they are replaced with a grey question mark.

Older versions of PurpleRestore 3 can not usually restore newer software such as iOS 11 and up natively. However, this can be resolved by replacing <code>MobileDevice.framework</code> in <code>PurpleRestore 3.app</code> with the latest one (which you can grab from <code>/System/Library/PrivateFrameworks/MobileDevice.framework</code>.

== See Also ==
* [[iTunes]]
* [https://www.youtube.com/watch?v=jaZ2JPUv-AU Video of process]

[[Category:Software]]

Cydia Impactor

2018-08-12T18:19:25Z

3xpl0itz: Updated version

{{Infobox software
| name = Cydia Impactor
| title = Cydia Impactor
| author = [[User:saurik|Jay Freeman (saurik)]]
| developer = [[User:saurik|Jay Freeman (saurik)]]
| discontinued =
| latest release version = 0.9.45
| latest release date = {{Start date and age|2018|08|12}}
| operating system = [[wikipedia:Microsoft Windows|Windows]] / [[wikipedia:OS X|OS X]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Sideloading
| license = [[wikipedia:Freeware|Freeware]]
| website = [http://cydiaimpactor.com Cydia Impactor]
}}
'''Cydia Impactor''' is a multifunction tool available for Windows, Mac, and Linux, created by [[User:saurik|Jay Freeman (saurik)]], used to install IPA files on iOS and APK files on Android. It is able to exploit the series of Android "Master Key" vulnerabilities.

Apps installed with Cydia Impactor are signed for seven days using a free developer account associated with any Apple ID, or one year if the user has a paid developer account.

Cydia Impactor has been used to accomplish [[semi-untethered jailbreak]]s on iOS devices in recent years - specifically, it is used to sideload the IPAs that are then used to jailbreak, such as [[Pangu9|Pangu9 for iOS 9.2-9.3.3]], [[Home Depot]], [[yalu]], [[PPJailbreak|PPJailbreak for iOS 10]] and [[LiberTV]].

==A note about Cydia Eraser==
Cydia Eraser, a tool similar to [[SemiRestore]] that can be used to wipe the device and preserve the iOS version, was previously called Cydia Impactor. However, [[saurik]] chose to change the name to Cydia Eraser to prevent confusion.

==See also==
*[[Semi-untethered jailbreak]]

[[Category:Sideloading]]
[[Category:Jailbreaking]]

Seputil

2018-08-03T23:46:00Z

3xpl0itz: Revised wording, added info, removed unnecessary/unclear info

{{lowercase}}
{{internal software}}
{{Infobox software
| name = seputil
| title =
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:iOS|iOS]] command line
| platform =
| size = 59,184 bytes [APP]
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}

'''seputil''' is an Apple Internal application (arm64). It is used to communicate with the [[Secure Enclave]] and its processor - the SEP. The utility [[ramrod]] also uses seputil to update the firmware of the SEP. seputil itself is contained in HXXXRamDisk.dmg, located in <code>/usr/standalone/update/ramdisk/</code> (the name of the ramdisk varies depending on the firmware.) Once mounted, the seputil executable is found in <code>/usr/libexec/</code>. The first 0x1b (27) bytes are stripped to make the dmg readable.

seputil has the following commands:

<pre>
seputil: seputil [--wait] --load <file>
seputil: seputil '<SEP console command>'
seputil: seputil <command>
seputil:
seputil: Valid <command> words:
seputil: --ping Send a PING operation to the SEP OS
seputil: --load Load <file> as the SEP runtime firmware
seputil: --restore Load <file> as the SEP runtime firmware in restore mode
seputil: --restore+art Load <file> as the SEP runtime firmware in restore mode with ART
seputil: --wait Pause for kernel driver to load before failing
seputil: --preflight Pre-flight load/restore firmware against ART to pre-check for boot failures
seputil: --log Dump the mailbox message log
seputil: --rom status Get the ROM status
seputil: --rom tz0 Send a ROM TZ0 command
seputil: --rom nop Send a ROM NOP command
seputil: --rom nonce Send a ROM nonce request
seputil: --new-nonce Request new SEP/OS nonce
seputil: --kill-nonce Request invalidate SEP/OS nonce
seputil: --art get Dump current ART from Memory
seputil: --art set Persist the supplied ART to storage
seputil: --art clear Clear the persisted ART
seputil: --art ctrtest Counter self-test (DESTRUCTIVE - WILL BRICK DEVICE)
seputil: --sleep Sleep the SEP NOW!
seputil: --nap Nap the SEP NOW!
seputil: --pingflood Ping SEP endlessly
seputil: --clkgate Enable SEP clock gating
seputil: --get <obj> Read obj and write to stdout
seputil: --put <obj> Read stdin and write to obj
seputil: --boot-check <file> Check whether a firmware might be bootable WRT the current ART
seputil: --dump-fw <file> Dump measurements of firmware file
seputil: Bare words on the commandline are sent to the SEP as a console command
</pre>

==Examples==
<pre>
./seputil --pingflood
SEP ping #1000
SEP ping #2000
SEP ping #3000
SEP ping #4000

./seputil --load sep-firmware.img4
seputil: load fw returned 0xe00002d5
seputil: load failed

./seputil --new-nonce
Nonce (20 bytes): 0x67fc18385630dc6429726677d196c81466f47b5e

./seputil --art get
raw ART: 305e0201003037020218340414519c0248f04d316a3d71e03978b4126fbfb2b15c0400041467fc18385630dc6429726677d196c81466f47b5e3103c00100042027b6dadbab356612997af0203cefeae51fe90cd985ee7cdd6211c766b8cc7a60
Successfully parsed ART:
counter: 6196
manifest hash (20 bytes): 519c0248f04d316a3d71e03978b4126fbfb2b15c
sleep hash is absent
restore nonce (20 bytes): 67fc18385630dc6429726677d196c81466f47b5e

./seputil --log
Kernel message log has 128 entries
289344381444: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289344385176: 0x0000000000000000 TX interrupt
289344391044: 0x0000000000000000 TX interrupt
289344408988: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289344409016: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289344413132: 0x0000000000000000 RX interrupt
289344413304: 0x0000000000010000 RX message ept 0, tag 0, opcode 1, param 0, data 0
289344413904: 0x0000000000000000 RX interrupt
289344413944: 0x0000000000010000 RX message ept 0, tag 0, opcode 1, param 0, data 0
289344414176: 0x0018000000dd1007 TX message ept 7, tag 10, opcode dd, param 0, data 180000
289344443356: 0x0000000000000000 RX interrupt
289344443428: 0x0068000000dd9007 RX message ept 7, tag 90, opcode dd, param 0, data 680000
289346822748: 0x0000000000130000 TX message ept 0, tag 0, opcode 13, param 0, data 0
289346829480: 0x0000000000000000 RX interrupt
289346829560: 0x0000000000110000 RX message ept 0, tag 0, opcode 11, param 0, data 0
289346830136: 0x0000000000120000 TX message ept 0, tag 0, opcode 12, param 0, data 0
289406511168: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289406511204: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289406538900: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289406538936: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289406543628: 0x0000000000000000 TX interrupt
289406549916: 0x0000000000000000 TX interrupt
289406566580: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289406566612: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289406571220: 0x0000000000000000 RX interrupt
289406571476: 0x0000000000010000 RX message ept 0, tag 0, opcode 1, param 0, data 0
289406571908: 0x0000000000000000 RX interrupt
289406571952: 0x0000000000010000 RX message ept 0, tag 0, opcode 1, param 0, data 0
289406572320: 0x0018000000de1007 TX message ept 7, tag 10, opcode de, param 0, data 180000
289406605068: 0x0000000000000000 RX interrupt
289406605152: 0x0068000000de9007 RX message ept 7, tag 90, opcode de, param 0, data 680000
289407383260: 0x003c000000df0907 TX message ept 7, tag 9, opcode df, param 0, data 3c0000
289407396284: 0x0000000000000000 RX interrupt
289407396380: 0x002c000000df8907 RX message ept 7, tag 89, opcode df, param 0, data 2c0000
289407403656: 0x003c000000e00907 TX message ept 7, tag 9, opcode e0, param 0, data 3c0000
289407411688: 0x0000000000000000 RX interrupt
289407411736: 0x002c000000e08907 RX message ept 7, tag 89, opcode e0, param 0, data 2c0000
289407414732: 0x003c000000e10907 TX message ept 7, tag 9, opcode e1, param 0, data 3c0000
289407422472: 0x0000000000000000 RX interrupt
289407422524: 0x002c000000e18907 RX message ept 7, tag 89, opcode e1, param 0, data 2c0000
289408986276: 0x0000000000130000 TX message ept 0, tag 0, opcode 13, param 0, data 0
289408991756: 0x0000000000000000 RX interrupt
289408991824: 0x0000000000110000 RX message ept 0, tag 0, opcode 11, param 0, data 0
289408992472: 0x0000000000120000 TX message ept 0, tag 0, opcode 12, param 0, data 0
289459393276: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289459393348: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289459423004: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289459423048: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289459452628: 0x0000000000000000 TX interrupt
289459453612: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289459453664: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289459466460: 0x0000000000000000 TX interrupt
289459469548: 0x0000000000000000 RX interrupt
289459470000: 0x0000000000010000 RX message ept 0, tag 0, opcode 1, param 0, data 0
289459470632: 0x0000000000010000 RX message ept 0, tag 0, opcode 1, param 0, data 0
289459471304: 0x0018000000e21007 TX message ept 7, tag 10, opcode e2, param 0, data 180000
289459524572: 0x0000000000000000 RX interrupt
289459524728: 0x0068000000e29007 RX message ept 7, tag 90, opcode e2, param 0, data 680000
289459532644: 0x004c000000e30f07 TX message ept 7, tag f, opcode e3, param 0, data 4c0000
289459552888: 0x0000000000000000 RX interrupt
289459553044: 0x002c000000e38f07 RX message ept 7, tag 8f, opcode e3, param 0, data 2c0000
289459646732: 0x0018000000e41007 TX message ept 7, tag 10, opcode e4, param 0, data 180000
289459681116: 0x0000000000000000 RX interrupt
289459681272: 0x0068000000e49007 RX message ept 7, tag 90, opcode e4, param 0, data 680000
289461898836: 0x0000000000130000 TX message ept 0, tag 0, opcode 13, param 0, data 0
289461906796: 0x0000000000000000 RX interrupt
289461906968: 0x0000000000110000 RX message ept 0, tag 0, opcode 11, param 0, data 0
289461908400: 0x0000000000120000 TX message ept 0, tag 0, opcode 12, param 0, data 0
289526725980: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289526726016: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289526757512: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289526757552: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289526774468: 0x0000000000000000 TX interrupt
289526782688: 0x0000000000000000 TX interrupt
289526786468: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289526786540: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289526795320: 0x0000000000000000 RX interrupt
289526795828: 0x0000000000010000 RX message ept 0, tag 0, opcode 1, param 0, data 0
289526796304: 0x0000000000010000 RX message ept 0, tag 0, opcode 1, param 0, data 0
289526796984: 0x0018000000e51007 TX message ept 7, tag 10, opcode e5, param 0, data 180000
289526847216: 0x0000000000000000 RX interrupt
289526847348: 0x0068000000e59007 RX message ept 7, tag 90, opcode e5, param 0, data 680000
289529224460: 0x0000000000130000 TX message ept 0, tag 0, opcode 13, param 0, data 0
289529235316: 0x0000000000000000 RX interrupt
289529235488: 0x0000000000110000 RX message ept 0, tag 0, opcode 11, param 0, data 0
289529236920: 0x0000000000120000 TX message ept 0, tag 0, opcode 12, param 0, data 0
289584681764: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289584681836: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289584710576: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289584710608: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289584730996: 0x0000000000000000 TX interrupt
289584738992: 0x0000000000000000 TX interrupt
289584739572: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289584739612: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289584748648: 0x0000000000000000 RX interrupt
289584748984: 0x0000000000010000 RX message ept 0, tag 0, opcode 1, param 0, data 0
289584749300: 0x0000000000010000 RX message ept 0, tag 0, opcode 1, param 0, data 0
289584749332: 0x0018000000e61007 TX message ept 7, tag 10, opcode e6, param 0, data 180000
289584790484: 0x0000000000000000 RX interrupt
289584790568: 0x0068000000e69007 RX message ept 7, tag 90, opcode e6, param 0, data 680000
289587176748: 0x0000000000130000 TX message ept 0, tag 0, opcode 13, param 0, data 0
289587185760: 0x0000000000000000 RX interrupt
289587185916: 0x0000000000110000 RX message ept 0, tag 0, opcode 11, param 0, data 0
289587186840: 0x0000000000120000 TX message ept 0, tag 0, opcode 12, param 0, data 0
288741485000: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
288741485084: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
288741514772: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
288741514812: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
288741533984: 0x0000000000000000 TX interrupt
288741541992: 0x0000000000000000 TX interrupt
288741543608: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
288741543680: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
288741552216: 0x0000000000000000 RX interrupt
288741552884: 0x0000000000010000 RX message ept 0, tag 0, opcode 1, param 0, data 0
288741553388: 0x0000000000010000 RX message ept 0, tag 0, opcode 1, param 0, data 0
288741553672: 0x0018000000db1007 TX message ept 7, tag 10, opcode db, param 0, data 180000
288741591912: 0x0000000000000000 RX interrupt
288741592040: 0x0068000000db9007 RX message ept 7, tag 90, opcode db, param 0, data 680000
288741599128: 0x004c000000dc0f07 TX message ept 7, tag f, opcode dc, param 0, data 4c0000
288741620732: 0x0000000000000000 RX interrupt
288741620900: 0x002c000000dc8f07 RX message ept 7, tag 8f, opcode dc, param 0, data 2c0000
288742902624: 0x0000000000130000 TX message ept 0, tag 0, opcode 13, param 0, data 0
288742912320: 0x0000000000000000 RX interrupt
288742912496: 0x0000000000110000 RX message ept 0, tag 0, opcode 11, param 0, data 0
288742913700: 0x0000000000120000 TX message ept 0, tag 0, opcode 12, param 0, data 0
289344354176: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289344354216: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0
289344381416: 0x0000000000000000 TX message ept 0, tag 0, opcode 0, param 0, data 0

./seputil --boot-check sep-firmware.img4
preflight: manifest hash matches sepi
bootCheck: SEP may boot with ART

./seputil --dump-fw sep-firmware.img4
manifest digest (20 bytes): 519c0248f04d316a3d71e03978b4126fbfb2b15c
sepi digest (20 bytes): a22813c5ceaeada5b7eeaa55808f3019814e8b8e
sepi nonce (20 bytes): e5074bd1befefc685c6b5ec6797ffc851366f76f
rsep digest (20 bytes): cb9f4c6520889e2582414c5969fb0abc3b0d8277
rsep nonce (20 bytes): e5074bd1befefc685c6b5ec6797ffc851366f76f
</pre>

== jtool dissect ==

<pre>
./jtool -l /Volumes/ramdisk/usr/libexec/seputil
LC 00: LC_SEGMENT_64 Mem: 0x000000000-0x100000000 __PAGEZERO
LC 01: LC_SEGMENT_64 Mem: 0x100000000-0x100008000 __TEXT
0x0000000100000ce8-0x00000001000055e0 __TEXT.__text
0x00000001000055e0-0x00000001000058ec __TEXT.__stubs
0x00000001000058ec-0x0000000100005c10 __TEXT.__stub_helper
0x0000000100005c10-0x0000000100006e5d __TEXT.__cstring
0x0000000100006e60-0x0000000100007fac __TEXT.__const
0x0000000100007fac-0x0000000100007ff4 __TEXT.__unwind_info
LC 02: LC_SEGMENT_64 Mem: 0x100008000-0x10000c000 __DATA
0x0000000100008000-0x0000000100008050 __DATA.__got
0x0000000100008050-0x0000000100008258 __DATA.__la_symbol_ptr
0x0000000100008258-0x00000001000086e8 __DATA.__const
0x00000001000086e8-0x0000000100008990 __DATA.__data
0x0000000100008990-0x00000001000089b0 __DATA.__bss
LC 03: LC_SEGMENT_64 Mem: 0x10000c000-0x100010000 __LINKEDIT
LC 04: LC_DYLD_INFO_ONLY
LC 05: LC_SYMTAB Symbol table is at offset 0xd9c8, with 77 entries
LC 06: LC_DYSYMTAB
LC 07: LC_LOAD_DYLINKER /usr/lib/dyld
LC 08: LC_UUID UUID: 5C06A94F-63A7-3150-95B6-65567C70A3C8
LC 09: LC_VERSION_MIN_IPHONEOS Minimum iOS version: 7.0.0
LC 10: LC_SOURCE_VERSION Source Version: 69.1.1.0.0
LC 11: LC_MAIN Entry Point: 0x1448 (Mem: 100001448)
LC 12: LC_LOAD_DYLIB /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation
LC 13: LC_LOAD_DYLIB /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
LC 14: LC_LOAD_DYLIB /usr/lib/libSystem.B.dylib
LC 15: LC_FUNCTION_STARTS Offset: 55592, Size: 120
LC 16: LC_DATA_IN_CODE Offset: 55712, Size: 0
LC 17: LC_DYLIB_CODE_SIGN_DRS Offset: 55712, Size: 40
LC 18: LC_CODE_SIGNATURE Offset: 58704, Size: 480
</pre>

==ART Object==

Example 1:
<pre>
./seputil --art get
raw ART: 305e0201003037020218340414519c0248f04d316a3d71e03978b4126fbfb2b15c0400041467fc18385630dc6429726677d196c81466f47b5e3103c00100042027b6dadbab356612997af0203cefeae51fe90cd985ee7cdd6211c766b8cc7a60
Successfully parsed ART:
counter: 6196
manifest hash (20 bytes): 519c0248f04d316a3d71e03978b4126fbfb2b15c
sleep hash is absent
restore nonce (20 bytes): 67fc18385630dc6429726677d196c81466f47b5e
</pre>

raw ART is also a [http://en.wikipedia.org/wiki/Abstract_Syntax_Notation_One#Example_encoded_in_DER DER encoded ASN.1 object]:

<pre>
30 — type tag indicating SEQUENCE
5e — length in octets of value that follows (92)
02 — type tag indicating INTEGER
01 — length in octets of value that follows
00 — value (0)
30 — type tag indicating SEQUENCE
37 — length in octets of value that follows (55)
02 — type tag indicating INTEGER
02 — length in octets of value that follows
1834 — value (6196) (of counter)
04 — type tag indicating STRING
14 — length in octets of value that follows (20)
519c0248f04d316a3d71e03978b4126fbfb2b15c — value (of manifest hash)
04 — type tag indicating STRING
00 — length in octets of value that follows (0); empty, so no value to follow (sleep hash is absent)
04 — type tag indicating STRING
14 — length in octets of value that follows (20)
67fc18385630dc6429726677d196c81466f47b5e — value (of restore nonce: snon)
31 — type tag indicating SET (of subcounters)
03 — length in octets of value that follows (3)
c00100 — value (priv element [0]=0)
04 — type tag indicating STRING
20 — length in octets of value that follows (32)
27b6dadbab356612997af0203cefeae51fe90cd985ee7cdd6211c766b8cc7a60 — value (SHA-256 HMAC of the previous SEQUENCE)
</pre>

Example 2:
<pre>
./seputil --art get
raw ART: 3072020100304b0202186c0414519c0248f04d316a3d71e03978b4126fbfb2b15c04147f75cb9012128cf71eb8fcd6b13e56a02a7324db041467fc18385630dc6429726677d196c81466f47b5e3103c0010004209ce3646167631d0df8d4db28973db8d5a27f85d345ad6ec220aeb1e22f39f31f
Successfully parsed ART:
counter: 6252
manifest hash (20 bytes): 519c0248f04d316a3d71e03978b4126fbfb2b15c
sleep hash (20 bytes): 7f75cb9012128cf71eb8fcd6b13e56a02a7324db
restore nonce (20 bytes): 67fc18385630dc6429726677d196c81466f47b5e
</pre>

Decode (used the decoder [http://lapo.it/asn1js/ here]):

<pre>
SEQUENCE (3 elem)
INTEGER 0
SEQUENCE (5 elem)
INTEGER 6252
OCTET STRING (20 byte) 519C0248F04D316A3D71E03978B4126FBFB2B15C
OCTET STRING (20 byte) 7F75CB9012128CF71EB8FCD6B13E56A02A7324DB
OCTET STRING (20 byte) 67FC18385630DC6429726677D196C81466F47B5E
SET (1 elem)
Private 0 (1 byte) 00
OCTET STRING (32 byte) 9CE3646167631D0DF8D4DB28973DB8D5A27F85D345AD6EC220AEB1E22F39F31F
</pre>

Example 3:
<pre>
./seputil --art clear
ART cleared from storage

./seputil --art get
seputil: Get ART command error: 0xe00002bc
</pre>

User:3xpl0itz

2018-07-21T23:50:06Z

3xpl0itz:

Just a random guy on the internet, nothing to see here...

*[https://www.reddit.com/user/TheSwag777/ Reddit]
*[https://twitter.com/_3xpl0itz Twitter]

=== iOS devices ===
{| class="wikitable"
|-
! Device
! Variant
! Color
! Storage
! Firmware
! Jailbroken?
! Notes
|-
| [[N81AP|iPod touch (4th generation)]]
| [[N81AP|iPod4,1]]
| White
| 8GB
| 6.1.6
| {{yes}}
| My first iDevice. Now used for PWNing
|-
| [[iPhone 3G]]
| [[N82AP|iPhone1,2]]
| Black
| 16GB
| 3.1.3
| {{yes}}
| Pretty much useless, occasionally used for PWNing
|-
| [[iPhone 3GS]]
| [[N88AP|iPhone2,1]]
| Black
| 16GB
| 5.1
| {{yes}}
| SwitchBoard ([[HoodooYabuli 9B3176n]])
|-
| [[iPhone 4]]
| [[N92AP|iPhone3,3]]
| Black
| 16GB
| 7.1.2
| {{yes}}
| Testing device, usually used for PWNing
|-
| [[iPhone 4S]]
| [[N94AP|iPhone4,1]]
| Black
| 16GB
| 6.1.3
| {{yes}}
| Kloader victim
|-
| [[iPhone 4S]]
| [[N94AP|iPhone4,1]]
| Black
| 16GB
| 9.3.5
| {{no}}
| Dead baseband :(
|-
| [[iPhone 5]]
| [[N41AP|iPhone5,1]]
| Space Grey
| 16GB
| 8.4
| {{yes}}
| Testing device/kloader victim
|-
| [[iPhone 5c]]
| [[N48AP|iPhone5,3]]
| White
| 16GB
| 10.3.3
| {{yes}}
| Testing device/kloader victim
|-
| [[iPhone 5s]]
| [[N51AP|iPhone6,1]]
| White
| 16GB
| 10.3.3
| {{yes}}
| Testing device
|-
| [[iPhone 5s]]
| [[N51AP|iPhone6,1]]
| White
| ??GB
| 11.1
| {{no}}
| iCloud Locked :(
|-
| [[iPhone X]]
| [[D221AP|iPhone10,6]]
| Black
| 256GB
| 11.3.1
| {{yes}}
| Main device
|-
| [[iPad Pro (9.7-inch)]]
| [[J127AP|iPad6,3]]
| Gold
| 128GB
| 11.3.1
| {{yes}}
| Main device
|-
|}

Into Apple Internal stuff, mainly firmwares and prototype devices. Jailbreaking and beta software are also things that I mess around with.

You can usually find me lurking in the Factory Firmware section of this wiki (or anything else Apple Internal related).

BurnIn

2018-07-21T23:47:43Z

3xpl0itz:

{{internal software}}
[[Image:Burnin2.jpg|thumb|left|"Drag To Unlock" screen. Text is "Drag To Unlock" and "Shut Down"|150px]]
[[Image:Burnin1.jpg|thumb|After "Drag To Unlock" screen, when you "Drag To Unlock", you get this screen. In order, "Start BurnIn", "Reset Test Environment", and "Quit"|150px]]
[[Image:BurninUI1.jpg|thumb|left|BurnIn running tests after pressing the "Start BurnIn" button.|150px]]
[[Image:BurninUI2.jpg|thumb|right|BurnIn when all tests are finished and device has passed each one successfully.|150px]]
[[Image:BurninUI3.jpg|thumb|left|BurnIn when all tests are finished and device has failed one or more tests.|150px]]
'''BurnIn''' is an internal diagnostics tool used used by Apple. It is used to verify whether all device hardware components are in proper working order. It is found in nearly all internal NonUI firmwares, and is launched via SwitchBoard.app. The BurnIn application is located within <code>AppleInternal/Applications/SwitchBoard/BurnIn.app</code>, and its icon is that of a flame.

Upon launch, the application will display either two or three buttons.

* The first button labeled "Start BurnIn" runs selected BurnIn tests. It's worth noting that on firmwares after 8A133 BurnIn automatically runs [[Inferno (utility)]], disabling any ways of interacting with the device until tests are completed. On [[Apex 8A133]], however, BurnIn instead launches its rarely-seen user interface, which is rather basic.

Its user interface features a spinner whilst the tests are being performed, as well as a timer that measures how long BurnIn tests have been running. Upon completion the user will be greeted with either a green screen, meaning the test was completed successfully, or a red screen indicating failures, which are also numbered. In both cases the user is instructed to collect logs. This UI is not found in later firmwares.

* The second button labeled "Reset Test Environment" cancels any tests currently in progress. It cannot, however, close Inferno if it's currently running.

* The third button labeled "Settings" is enabled on certain versions of BurnIn/certain NonUI firmwares, whereas it does not show up in others. If accessible, this button allows the user to select which tests BurnIn is to perform.

== Processes ==

At boot, the <code>/AppleInternal/Applications/SwitchBoard/BurnIn.app/BurnIn</code> executable will run. It checks <code>/AppleInternal/Diags/purpleskank/config.plist</code> for configuration information, such as version (v3.0 in this case), where to store the logs (<code>/Library/Logs/BurnIn/</code> in this case), what level to set the backlight to, and also, some kind of cleanup script is defined (<code>/AppleInternal/Diags/Utilities/burnin_cleanup.sh</code>). What it actually does is still not known though. Two log files are also left by it, by doing whatever is done. They are <code>/Library/Logs/BurnIn/burning_log.xml</code> and <code>/Library/Logs/BurnIn/burnin_log.txt</code>.

On older iPhone prototypes, BurnIn is launched by [[SkankPhone]], a SpringBoard replacement. It starts <code>/AppleInternal/Diags/purpleskank/factoryharness</code>, which loads the configuration from config.plist file in the same directory. factoryharness loads the index.plist file from location specified in config.plist (default is <code>/AppleInternal/Diags/purpleskank/tables/index.plist</code>) and begins to execute the tests specified in index.plist. When tests are successful, logs from burnin process are saved to <code>/AppleInternal/Diags/Logs/</code> (or to other directory that can be set in config.plist). In case of failure, a failures.plist file is created in Logs directory. If Burnin process has not been completed, file state.plist is parsed by factoryharness and it continues the burnin process. If burnin process has failed, SkankPhone shows a FAILURE screen and displays the contents of burnin_log.txt. To get rid of that screen, the user must select the Reset Test Environment option in SkankPhone, which executes <code>/AppleInternal/Diags/Utilities/burnin_cleanup.sh</code>.

== External Links ==
* '''Definition''': http://en.wikipedia.org/wiki/Burn-in
* '''Another Video Demonstration (iPhone - iOS 1.1.3 - BurnIn v1.4.9)''': http://www.youtube.com/watch?v=oPpTROJ48aQ

[[Category:Apple Internal Apps]]
[[Category:Software]]

BurnIn

2018-07-21T23:43:55Z

3xpl0itz: Added pictures of BurnIn running tests/passing/failing (Thanks Unknownz21 for providing them), as well as minor revisions and formatting fixes.

{{internal software}}
[[Image:Burnin2.jpg|thumb|left|"Drag To Unlock" screen. Text is "Drag To Unlock" and "Shut Down"|150px]]
[[Image:Burnin1.jpg|thumb|After "Drag To Unlock" screen, when you "Drag To Unlock", you get this screen. In order, "Start BurnIn", "Reset Test Environment", and "Quit"|150px]]
[[Image:BurninUI1.jpg|thumb|left|BurnIn running tests after pressing the "Start BurnIn" button.|150px]]
[[Image:BurninUI2.jpg|thumb|right|BurnIn when all tests are finished and device has passed each one successfully.|150px]]
[[Image:BurninUI3.jpg|thumb|left|BurnIn when all tests are finished and device has failed one or more tests.|150px]]
'''BurnIn''' is an internal diagnostics tool used used by Apple. It is used to verify whether all device hardware components are in proper working order. It is found in nearly all internal NonUI firmwares, and is launched via SwitchBoard.app. The BurnIn application is located within <code>AppleInternal/Applications/SwitchBoard/BurnIn.app</code>, and its icon is that of a flame.

Upon launch, the application will display either two or three buttons.

* The first button labeled "Start BurnIn" runs selected BurnIn tests. It's worth noting that on firmwares after 8A133 BurnIn automatically runs [[Inferno (utility)]], disabling any ways of interacting with the device until tests are completed. On [[Apex 8A133]], however, BurnIn instead launches its rarely-seen user interface, which is rather basic.

Its user interface features a spinner whilst the tests are being performed, as well as a timer that measures how long BurnIn tests have been running. Upon completion the user will be greeted with either a green screen, meaning the test was completed successfully, or a red screen indicating failures, which are also numbered. In both cases the user is instructed to collect logs. This UI is not found in later firmwares.

* The second button labeled "Reset Test Environment" cancels any tests currently in progress. It cannot, however, close Inferno if it's currently running.

* The third button labeled "Settings" is enabled on certain versions of BurnIn/certain NonUI firmwares, whereas it does not show up in others. If accessible, this button allows the user to select which tests BurnIn is to perform.

== Processes ==

At boot, the <code>/AppleInternal/Applications/SwitchBoard/BurnIn.app/BurnIn</code> executable will run. It checks <code>/AppleInternal/Diags/purpleskank/config.plist</code> for configuration information, such as version (v3.0 in this case), where to store the logs (/Library/Logs/BurnIn/ in this case), what level to set the backlight to, and also, some kind of cleanup script is defined (<code>/AppleInternal/Diags/Utilities/burnin_cleanup.sh</code>). What it actually does is still not known though. Two log files are also left by it, by doing whatever is done. They are <code>/Library/Logs/BurnIn/burning_log.xml</code> and <code>/Library/Logs/BurnIn/burnin_log.txt</code>.

On older iPhone prototypes, BurnIn is launched by [[SkankPhone]], a SpringBoard replacement. It starts <code>/AppleInternal/Diags/purpleskank/factoryharness</code>, which loads the configuration from config.plist file in the same directory. factoryharness loads the index.plist file from location specified in config.plist (default is <code>/AppleInternal/Diags/purpleskank/tables/index.plist</code>) and begins to execute the tests specified in index.plist. When tests are successful, logs from burnin process are saved to <code>/AppleInternal/Diags/Logs/</code> (or to other directory that can be set in config.plist). In case of failure, a failures.plist file is created in Logs directory. If Burnin process has not been completed, file state.plist is parsed by factoryharness and it continues the burnin process. If burnin process has failed, SkankPhone shows a FAILURE screen and displays the contents of burnin_log.txt. To get rid of that screen, the user must select the Reset Test Environment option in SkankPhone, which executes <code>/AppleInternal/Diags/Utilities/burnin_cleanup.sh</code>.

== External Links ==
* '''Definition''': http://en.wikipedia.org/wiki/Burn-in
* '''Another Video Demonstration (iPhone - iOS 1.1.3 - BurnIn v1.4.9)''': http://www.youtube.com/watch?v=oPpTROJ48aQ

[[Category:Apple Internal Apps]]
[[Category:Software]]

File:BurninUI3.jpg

2018-07-21T23:38:03Z

3xpl0itz: BurnIn when one or more tests have failed.

BurnIn when one or more tests have failed.

File:BurninUI2.jpg

2018-07-21T23:37:42Z

3xpl0itz: BurnIn when all tests pass successfully.

BurnIn when all tests pass successfully.

File:BurninUI1.jpg

2018-07-21T23:36:37Z

3xpl0itz: BurnIn running tests.

BurnIn running tests.

Backr00m

2018-07-08T20:51:39Z

3xpl0itz:

{{lowercase}}{{Infobox software
| name = backr00m
| title = backr00m
| developer = [https://twitter.com/nitoTV nitoTV]
| released = {{Start date and age|2018|07|08|df=yes}}
| latest release version = 1.1
| latest release date = {{Start date and age|2018|07|08|df=yes}}
| language = [[wikipedia:English|English]]
| status = Current
| genre = Jailbreaking
| license = [[wikipedia:Freeware|Freeware]]
| website = [https://nito.tv/ nito.tv]
}}
'''backr00m''' is a [[semi-untethered jailbreak]] released for [[tvOS]] 10.2.2-11.1. It supports both the [[Apple TV (4th generation)]] and [[Apple TV 4K]].

It supersedes [[greeng0blin]] by using more reliable exploits.

{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| 1.0
| 8 July, 2018
|
* Initial Release
|-
| 1.1
| 8 July, 2018
|
* Fix installing on 11.0
* Fix nitoTV crashing
|}

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Electra

2018-07-08T20:50:33Z

3xpl0itz: Grammar/Wording

{{Infobox software
| name = Electra
| title = Electra
| developer = [https://twitter.com/coolstarorg CoolStar]
| released = {{Start date|2018|01|13|df=yes}}
| latest release version = 1.0.4<small> (iOS 11.0-11.1.2)</small><br />1.0.2<small> (iOS 11.2-11.3.1)</small>
| latest release date = {{Start date and age|2018|03|09|df=yes}}<small> (iOS 11.0-11.1.2)</small><br />{{Start date and age|2018|07|08|df=yes}}<small> (iOS 11.2-11.3.1)</small>
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [https://coolstar.org/electra1112/ Electra (11.0-11.1.2)]<br>[https://coolstar.org/electra/ Electra (11.2-11.3.1)]
}}

== Electra for iOS 11.0 - 11.1.2 ==

'''Electra''' is a [[semi-untethered jailbreak]] for all devices running iOS 11.0 - 11.3.1. The first beta was released on January 13, 2018. Several betas were released. The betas did not include support for [[Cydia]], however the developer, CoolStar later seeded six release candidate versions to developers with working Cydia support. Electra1112 was then officially released on February 26, 2018.

{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| Beta 1
| 13 January, 2018
| Initial release
|-
| Beta 2
| 13 January, 2018
|
*Fix Anemone not recognising themes
*Fix black screen when jailbreaking with tweaks enabled
|-
| Beta 3
| 13 January, 2018
|
*Unlock all NVRAM variables (including setting boot-nonce) [thanks stek29]
*Add support for binaries with SHA1 hashes (so existing dylibs work fine, but executables will need the entitlement) [thanks stek29]
*Clean up some garbage files that were present from previous build (yay macOS resource forks and .DS_Store)
*Hopefully fix the app icon not displaying on iPhones
*Significantly speed up the rejailbreak process
|-
| Beta 3-2
| 14 January, 2018
|
*Don't unlock NVRAM variables due to the patch crashing some devices.
|-
| Beta 3-3
| 14 January, 2018
|
*Fix the NVRAM patching crashing due to the memory page being unmapped (thanks Siguza)
|-
| Beta 4
| 14 January, 2018
|
*Disable NVRAM patching as it still appears to be unstable
*Make amfid patch more reliable so that more dylibs can be run properly
*Add a "shim" so existing substrate tweaks can use libsubstitute without modifications
|-
| Beta 4-2
| 14 January, 2018
|
*Fix a symlink that would prevent some substrate extensions from working with libsubstitute
|-
| Beta 5
| 14 January, 2018
|
*Fix an issue in the substrate shim where substitute could crash if tweaks tried hooking nonexistent selectors
*Fix an issue with the dylib loader dragging UIKit (and all its tweaks) into every single daemon
*Make jailbreakd more robust with input struct size check enforcement
|-
| Beta 6
| 16 January, 2018
|
*Add a working launchctl for loading launch daemons (thanks nullpixel)
*Load dropbear as a launch daemon & fix zombie process issue (thanks nullpixel)
*Set kernel task as host special port #4 (thanks stek29)
|-
| Beta 6-2
| 17 January, 2018
|
*Fix kernel memory leak in entitlement injector
|-
| Beta 6-3
| 18 January, 2018
|
*Use host special port #4 to get tfp0 in jailbreakd (thanks n_triangle_dev)
*Add jailbreakd as a launchd service so it gets restarted if it dies (thanks n_triangle_dev)
|-
| Beta 6-4
| 20 January, 2018
|
*Don't make jailbreakd rely on pidlistuptrs bug (thanks stek29)
*log dylib load errors in SBInject (thanks stek29)
*Clean up launchd payloads (thanks stek29)
*Load dylibs alphabetically from SBInject (thanks c0ldra1n)
*Check for jailbreakd start before reloading backboardd
*Make rejailbreaking significantly faster
|-
| Beta 7
| 23 January, 2018
|
*amfid now gets re-patched if it ever gets killed (stek29 and coolstar)
*clean up amfid patch (stek29)
*Add 3d touch shortcut for jailbreaking (ca13ra1)
|-
| Beta 8
| 26 January, 2018
|
*Sandbox mitigations are now in place so /Library, /private/var/mobile/Library/Preferences and /bootstrap are now accessible to all processes! (stek29, coolstar)
*Workaround sandbox mitigations not taking place on apps' first launch (coolstar)
*Improve reliability of amfid patch so it doesn't hang on malformed requests (e.g. SysSecInfo)
*'''Known Bug:''' Apps will take longer to launch the first time they're launched after rejailbreaking due to a workaround for another bug w/ unsandboxing not working on first launch
|-
| Beta 8-2
| 26 January, 2018
|
*Fixes issues with WebKit (Safari/Chrome), receiving calls, and downloading App Store apps by not working around the sandbox issue in those processes
*'''Known Bug:''' Apps will take longer to launch the first time they're launched after rejailbreaking due to a workaround for another bug w/ unsandboxing not working on first launch
|-
| Beta 9
| 27 January, 2018
|
*Sandbox is now working on the first launch for apps and daemons (thanks stek29)
*Remove 0.5 second delay when launching apps or daemons that was present since beta 1 (coolstar)
*Check if a new beta is available when electra is launched
*Double-launch workaround has been removed since it's no longer needed, fixing all bugs introduced on beta 8
*Remove AnemoneFonts.dylib as it was causing problems
*'''Important Note:''' If you are upgrading from beta 8-2 or lower to any beta 9 or higher, you will need to reinstall all tweaks and themes
|-
| Beta 10
| 01 February, 2018
|
*Fix certain codesigned binaries not working with our amfi payload (coolstar)
*Add darwintools, debiantools (not dpkg), shell-cmds, system-cmds and uikittools
*Re-sign most of the bootstrap as SHA1 to prepare for them to be pushed to a repo
*Code cleanup (stek29 and nullpixel)
*Fix update checker erroneously saying there's an update in airplane mode
|-
| Beta 11
| 09 February, 2018
|
*Add libjailbreak so command line tools, apps, etc. can talk to jailbreakd if needed (n_triangle_dev)
*Use XPC instead of UDP from libjailbreak and xpcproxy (n_triangle_dev)
*Use TCP instead of UDP from launchd (coolstar)
|-
| Beta 11-2
| 10 February, 2018
|
*Significantly improve the reliability of jailbreakd so it can handle a large amount of process launches at once (coolstar)
*Make jailbreakd print directly to stderr rather than NSLog (coolstar)
*Fix a race condition in beta 11 that would cause jailbreakd to sometimes inject too early, and thus fail to inject (coolstar)
|-
| Beta 11-3
| 12 February, 2018
|
*Fix a race condition on jailbreakd's launch to improve success rate of jailbreak
|-
| 1.0
| 26 February, 2018
|
*Initial Release
|-
| 1.0.1
| 26 February, 2018
|
*Fix some false positives where Electra would think topanga was installed when only liberiOS was
|-
| 1.0.2
| 27 February, 2018
|
*Fix false positives where Electra would think topanga was installed when only liberiOS was
*Prevent loading pacakges from saurik's repo (since Cydia can't be patched to remove it)
*Fix APT 0.7 Strict (lib) on devices that may have already updated to the broken copy from saurik's repo
|-
| 1.0.3
| 4 March, 2018
|
*Revert change to XPC in xpcproxy in beta 11
*Fix intermittent freezing issues that would affect certain devices on beta 10 -> 1.0.2
|-
| 1.0.4
| 9 March, 2018
|
*Remove all XPC code that could possibly have been problematic ever since beta 11
*Replace TCP, UDP and XPC with MIG (thanks Psychotea from the [[Meridian]] team)
*Recommended to also update Tweak Injector to 1.0.4 from our repo to get safe mode in system daemons as well
|}

== Electra for iOS 11.2 - 11.3.1 ==

With Electra's update to support devices running any iOS between 11.2 to 11.3.1 (including betas), delays came in place due to Apple's APFS snapshot mitigation of remounting the root filesystem as read/write that was introduced in iOS 11.3. There are many parts of a jailbreak that need read/write to do certain things within the filesystem, and because of Apple's mitigation, a APFS remount workaround was needed to complete the jailbreak. Chinese security researcher [https://twitter.com/SparkZheng Min Zheng] had already found and created his own bypass to remount the root filesystem, which many other developers then tried implementing in their own way. During this time, [https://twitter.com/Morpheus______ Jonathan Levin], creator of the [[LiberTV]] jailbreak for the AppleTV was announcing his plans for updating LiberTV with an APFS remount which the Electra Team could use. Meanwhile, CoolStar had already found a 0day in APFS which would allow the filesystem to be remounted as r/w, but wanted to save it for future use in iOS 12. As this news was absorbed by the community, many people were angry that CoolStar wanted to delay the update for Electra by saving the 0day. However, CoolStar had found yet another 0day and decided to end the waiting on Levin's remount and use one of his APFS 0days instead. Electra1131 was then released a little while later on July 6, 2018.

{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| 1.0
| 6 July, 2018
|
* Initial Release
|-
| 1.0.1
| 7 July, 2018
|
* Fix app icon not showing up for certain users
* Fix nonce Generator not being set certain times
|-
| 1.0.2
| 8 July, 2018
|
* Use different bundle identifier for mptcp version
* Increment bundle id properly
* Hopefully fix success rate regression with multipath 1.0.1
|}

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

User:3xpl0itz

2018-06-04T21:35:11Z

3xpl0itz:

Just a random guy on the internet, nothing to see here...

*[https://www.reddit.com/user/TheSwag777/ Reddit]
*[https://twitter.com/_3xpl0itz Twitter]

=== iOS devices ===
{| class="wikitable"
|-
! Device
! Variant
! Color
! Storage
! Firmware
! Jailbroken?
! Notes
|-
| [[N81AP|iPod touch (4th generation)]]
| [[N81AP|iPod4,1]]
| White
| 8GB
| 6.1.6
| {{yes}}
| My first iDevice. Now used for PWNing
|-
| [[iPhone 3G]]
| [[N82AP|iPhone1,2]]
| Black
| 16GB
| 3.1.3
| {{yes}}
| Pretty much useless, occasionally used for PWNing
|-
| [[iPhone 3GS]]
| [[N88AP|iPhone2,1]]
| Black
| 16GB
| 5.1
| {{yes}}
| SwitchBoard ([[HoodooYabuli 9B3176n]])
|-
| [[iPhone 4]]
| [[N92AP|iPhone3,3]]
| Black
| 16GB
| 7.1.2
| {{yes}}
| Testing device, usually used for PWNing
|-
| [[iPhone 4S]]
| [[N94AP|iPhone4,1]]
| Black
| 16GB
| 6.1.3
| {{yes}}
| Kloader victim
|-
| [[iPhone 4S]]
| [[N94AP|iPhone4,1]]
| Black
| 16GB
| 9.3.5
| {{no}}
| Dead baseband :(
|-
| [[iPhone 5]]
| [[N41AP|iPhone5,1]]
| Space Grey
| 16GB
| 8.4
| {{yes}}
| Testing device/kloader victim
|-
| [[iPhone 5c]]
| [[N48AP|iPhone5,3]]
| White
| 16GB
| 10.3.3
| {{yes}}
| Testing device/kloader victim
|-
| [[iPhone 5s]]
| [[N51AP|iPhone6,1]]
| White
| 16GB
| 11.3.1
| {{no}}
| Testing device
|-
| [[iPhone 5s]]
| [[N51AP|iPhone6,1]]
| White
| ??GB
| 11.1
| {{no}}
| iCloud Locked :(
|-
| [[iPhone X]]
| [[D221AP|iPhone10,6]]
| Black
| 256GB
| 11.3.1
| {{no}}
| Main device
|-
| [[iPad Pro (9.7-inch)]]
| [[J127AP|iPad6,3]]
| Gold
| 128GB
| 11.3.1
| {{no}}
| Main device
|-
|}

Into Apple Internal stuff, mainly firmwares and prototype devices. Jailbreaking and beta software are also things that I mess around with.

You can usually find me lurking in the Factory Firmware section of this wiki (or anything else Apple Internal related).

User:3xpl0itz

2018-06-04T21:34:21Z

3xpl0itz: 11.3.1, new device

Just a random guy on the internet, nothing to see here...

*[https://www.reddit.com/user/TheSwag777/ Reddit]
*[https://twitter.com/_3xpl0itz Twitter]

=== iOS devices ===
{| class="wikitable"
|-
! Device
! Variant
! Color
! Storage
! Firmware
! Jailbroken?
! Notes
|-
| [[N81AP|iPod touch (4th generation)]]
| [[N81AP|iPod4,1]]
| White
| 8GB
| 6.1.6
| {{yes}}
| My first iDevice. Now used for PWNing
|-
| [[iPhone 3G]]
| [[N82AP|iPhone1,2]]
| Black
| 16GB
| 3.1.3
| {{yes}}
| Pretty much useless, occasionally used for PWNing
|-
| [[iPhone 3GS]]
| [[N88AP|iPhone2,1]]
| Black
| 16GB
| 5.1
| {{yes}}
| SwitchBoard ([[HoodooYabuli 9B3176n]])
|-
| [[iPhone 4]]
| [[N92AP|iPhone3,3]]
| Black
| 16GB
| 7.1.2
| {{yes}}
| Testing device, usually used for PWNing
|-
| [[iPhone 4S]]
| [[N94AP|iPhone4,1]]
| Black
| 16GB
| 6.1.3
| {{yes}}
| Kloader victim
|-
| [[iPhone 4S]]
| [[N94AP|iPhone4,1]]
| Black
| 16GB
| 9.3.5
| {{no}}
| Dead baseband :(
|-
| [[iPhone 5]]
| [[N41AP|iPhone5,1]]
| Space Grey
| 16GB
| 8.4
| {{yes}}
| Testing device/kloader victim
|-
| [[iPhone 5c]]
| [[N48AP|iPhone5,3]]
| White
| 16GB
| 10.3.3
| {{yes}}
| Testing device/kloader victim
|-
| [[iPhone 5s]]
| [[N51AP|iPhone6,1]]
| White
| 16GB
| 11.3.1
| {{no}}
| Testing device
|-
| [[iPhone 5s]]
| [[N51AP|iPhone6,1]]
| White
| ??GB
| 11.1
| {{no}}
| iCloud Locked :(
|-
| [[iPhone X]]
| [[D221AP|iPhone10,6]]
| Black
| 256GB
| 11.3.1
| {{no}}
| Main device
|-
| [[iPad Pro (9.7-inch)]]
| [[J127AP|iPad6,3]]
| Gold
| 128GB
| 11.3.1
| {{yes}}
| Main device
|-
|}

Into Apple Internal stuff, mainly firmwares and prototype devices. Jailbreaking and beta software are also things that I mess around with.

You can usually find me lurking in the Factory Firmware section of this wiki (or anything else Apple Internal related).

User:3xpl0itz

2018-05-29T20:08:50Z

3xpl0itz: :(

Just a random guy on the internet, nothing to see here...

*[https://www.reddit.com/user/TheSwag777/ Reddit]
*[https://twitter.com/_3xpl0itz Twitter]

=== iOS devices ===
{| class="wikitable"
|-
! Device
! Variant
! Color
! Storage
! Firmware
! Jailbroken?
! Notes
|-
| [[N81AP|iPod touch (4th generation)]]
| [[N81AP|iPod4,1]]
| White
| 8GB
| 6.1.6
| {{yes}}
| My first iDevice. Now used for PWNing
|-
| [[iPhone 3G]]
| [[N82AP|iPhone1,2]]
| Black
| 16GB
| 3.1.3
| {{yes}}
| Pretty much useless, occasionally used for PWNing
|-
| [[iPhone 3GS]]
| [[N88AP|iPhone2,1]]
| Black
| 16GB
| 5.1
| {{yes}}
| SwitchBoard ([[HoodooYabuli 9B3176n]])
|-
| [[iPhone 4]]
| [[N92AP|iPhone3,3]]
| Black
| 16GB
| 7.1.2
| {{yes}}
| Testing device, usually used for PWNing
|-
| [[iPhone 4S]]
| [[N94AP|iPhone4,1]]
| Black
| 16GB
| 6.1.3
| {{yes}}
| Kloader victim
|-
| [[iPhone 4S]]
| [[N94AP|iPhone4,1]]
| Black
| 16GB
| 9.3.5
| {{no}}
| Dead baseband :(
|-
| [[iPhone 5c]]
| [[N48AP|iPhone5,3]]
| White
| 16GB
| 10.3.3
| {{yes}}
| Testing device/kloader victim
|-
| [[iPhone 5s]]
| [[N51AP|iPhone6,1]]
| White
| 16GB
| 11.2.6
| {{no}}
| "Demo" device
|-
| [[iPhone 5s]]
| [[N51AP|iPhone6,1]]
| White
| ??GB
| 11.1
| {{no}}
| iCloud Locked :(
|-
| [[iPhone X]]
| [[D221AP|iPhone10,6]]
| Black
| 256GB
| 11.3
| {{no}}
| Main device
|-
| [[iPad Pro (9.7-inch)]]
| [[J127AP|iPad6,3]]
| Gold
| 128GB
| 11.1.2
| {{yes}}
| Main device
|-
|}

Into Apple Internal stuff, mainly firmwares and prototype devices. Jailbreaking and beta software are also things that I mess around with.

You can usually find me lurking in the Factory Firmware section of this wiki (or anything else Apple Internal related).

DCSD Cable

2018-05-23T22:24:08Z

3xpl0itz: Making it pretty

[[File:DCSD_Front_annotated.jpg|right|thumb|Annotated photo of the main DCSD PCB]]

The '''DCSD Alex cable''' is used in factories to communicate over serial to run tests and write to the SysCfg (for serial definitions, etc) during production. These cables are produced by Shenzhen Alex Connector Co. Ltd. in China. They can be purchased from obscure markets. There are two known types of DCSD cable. An older one, with lights and only one USB female USB connector, and a newer model, which lacks lights, and has two female USB connectors.

== PCB ==
=== Top of the board ===
{| class="wikitable" |
! Label
! Chip
! Datasheet
! Notes
|-
| D1
| rowspan="3" | Low Power Consumption Voltage Regulator with ON/OFF Switch
| rowspan="3" | http://www.s-manuals.com/pdf/datasheet/x/c/xc6215_series_torex.pdf
|
|-
| D5
|
|-
| D6
| Tied to TX and an input voltage of 3.3V on the UART J5 pads, this may be a protection in case the host shorts?
|-
| U1
| rowspan="2" | Micrel 2026A Dual-Channel Power Distribution Switch
| rowspan="2" | https://web.archive.org/web/20141010122122/http://www.xilinx.com/products/boards/ml510/datasheets/mic2076-2bm.pdf
|
|-
| U2
|
|-
| U3
| FTDI FT232RQ UART IC
| http://www.ftdichip.com/Support/Documents/DataSheets/ICs/DS_FT232R.pdf
| Handles stoplight LED controls
|-
| U4
| Micrel MIC5219
| http://datasheet.datasheetarchive.com/originals/library/Datasheets-EDS7/DSAEDA000124178.pdf
| 500mA Peak Output LDO Regulator
|-
| U5
| FTDI FT232RQ UART IC
| http://www.ftdichip.com/Support/Documents/DataSheets/ICs/DS_FT232R.pdf
| Handles serial mux interface from iPhone
|-
| U6
| SMSC USB2514 4-port USB hub
| http://www.mouser.com/catalog/specsheets/2514.pdf
|
* The use of this deprecates the previous "Y" style cable, which used two separate USB cables for serial and iPhone data communication
* Three ports are used:
*# iPhone Data USB
*# U4 FTDI IC
*# U5 FTDI IC
|-
| U7
| Microchip 24AA04/24LC04B
| http://ww1.microchip.com/downloads/en/DeviceDoc/21708G.pdf
| I2C Serial EEPROM (TSSOP Package)
|-
| X1
| MKC 24 MHz Oscillator
| {{n/a}}
| I'm not 100% sure about the value of the chip, but this should be correct
|}

=== Back of the board ===
{| class="wikitable" |
! Label
! Notes
|-
| J9
| rowspan="4" | I believe these are used to flash the U7 EEPROM with USB IDs for use by the SMSC USB Hub, I have yet to dump the contents of the EEPROM to find out for sure.
|-
| J10
|-
| J11
|-
| J12
|}

=== Other notes ===
* The [[Lightning Connector]] has a specific Accessory ID flashed to it for enabling serial via the Tristar chip.
* This PCB is quite easy to replicate, but without the proper Accessory ID you will need to mimic the protocol similar to how key2fr did in his [http://ramtin-amin.fr/#tristar research].
* In theory, you can use the Tristar for JTAG through a similar board, but JTAG gets disabled by the device during boot due to production fusing status.

== Uses ==

=== Verbose Boot ===
One use of the cable was to view verbose boot. You could access this by setting [[Debug-uarts_(iBoot_variable)|debug uarts]] in [[iRecovery]] or nvram, however, since iOS 9, this output has been obfuscated.

=== Shell over serial ===
Using [http://twitter.com/qwertyoruiopz qwertyoruiopz's] [https://twitter.com/qwertyoruiopz/status/711455055401099264 serialsh], it is possible to get shell over serial. This is useful, because it does not require any additional daemons other than those shipped with iOS. An example use case for this would be protecting against bootloops.

=== Debugging the kernel ===
Using the DCSD cable, it is possible to attach GDB to the iOS kernel, and pause it's running.

Flytrap

2018-05-03T14:16:35Z

3xpl0itz: Minor revisions

'''Flytrap''' is an internal tool for bug tracking that is compatible with UI builds of iOS on the iPhone and iPad. It is not externally available, but it does work on regular iOS versions. It has a MacOS Companion app called '''FlytrapX'''. It is unknown whether it is related to [[Radar]].

<gallery>
File:flytrap1.PNG | The Bugs section.
File:flytrap2.PNG | The form for submitting a bug.
File:flytrap3.PNG | Pane for filing a Quick Bug.
File:flytrap4.PNG | Log information shown in Flytrap.
</gallery>

NonUI builds

2018-04-17T14:33:50Z

3xpl0itz: Minor revisions

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging. {{clear}}
[[File:newsblogo.png|thumb|125px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|125px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|125px|right|Prototype showing Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|125px|left|Prototype showing Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allow launching a GUI of some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT Fused bootloaders in \Firmware\dfu\ and \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* DEVELOPMENT Fused kernel cache with more symbols, and with individual kexts in /System/Library/Extensions
* Skankwerk (gear) logo image file in \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* /AppleInternal folder, which the hierarchy inside get priority over hierarchy in /.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* /usr and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed - as dropbear
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable AMFI
* It has some Private Frameworks in /System/Library/PrivateFrameworks for internal GUI apps and command line utilities.
* Most internal applications require the use of SkankKit to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". Those are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmwares "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].

== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="3" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| rowspan="2" | 1.1.3
| [[Alpine 4A102a|4A102a]]
| Alpine
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| Apex?
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 1.0.10
| -
|-
| 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| Sochi?
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| InnsbruckNanshan
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| Okemo?
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| OkemoAni
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| OkemoAni
| 1.00.05
| -
|-
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93051l|13A93051l]]
| Monarch?
| 0.37.08
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| Monarch?
| 1.00.05
| -
|-
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| Whitetail?
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| WhitetailAni
| ?
| -
|-
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| ?
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
| Version
| Build
| Codename
| Baseband
| Comments
|-
| 11.0
| [[TigrisAni 15A783601y|15A783601y]]
| TigrisAni?
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| Wildcat?
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango?
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| SundanceTaosTianshan
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| Inferno?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| ?
| -
|}

[[Category:Firmware]]

InnsbruckAni 11A93840f

2018-04-17T14:29:42Z

3xpl0itz: Removed hidden apps (we don't know for sure)

{{internal software|firmware}}
== Background ==
Originally found on [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors], this firmware was first discovered on an [[iPhone 5s]] prototype. It seems that this firmware is based off of an internal version of iOS 7.0.
[[File:5s11a93840f.jpg|right|thumb|iPhone 5s prototype running 11A93840f]]
== Applications ==
Unlike previous NonUI 7.0 firmwares such as [[InnsbruckNanshan 11A24581c]], this firmware does not have [[MesaCal]] to test the Touch ID sensor. The reason why it is hidden or removed is currently unknown. It does, however, have [[Operator]] instead, along with a few others on [[SwitchBoard.app]]:
*[[dtxCaliente]]
*[[GrapeCal]]
*[[Operator]]
*[[Reliability]]
*[[QRCode]]
*[[WiPASmini]]
*[[ThermalDOE]]

Okemo 12A22121a

2018-04-17T14:28:00Z

3xpl0itz: Removed hidden apps (we don't know for sure)

{{internal software|firmware}}
== Background ==
This is one of the earliest known SwitchBoard builds based off of an internal version of iOS 8.0. This firmware was originally discovered on an [[N56AP|iPhone 6 Plus]]. Unlike later firmwares, a redesigned Operator and Reliability are both visible and launchable.
[[File:iphone6plus12A22121a.jpg|thumb|right|iPhone 6 Plus running 12A22121a]]
== Applications ==
Oddly enough, there seem to be two different versions of Reliability present on this firmware; the previous, more skeuomorphic design, and the newer one. It is unknown as to why both versions are present on the same firmware. Operator also seems to have a redesign as well. Both of these applications are hidden in later NonUI firmwares based off of 8.0.

Upon booting into [[SwitchBoard.app]], you’ll find that this build has the same apps as later 8.0 based firmwares, with a couple extras:
*[[AltoMobile]]
*[[dtxCaliente]]
*[[GrapeCal]]
*[[MesaCal]]
*[[NonUIConsoleViewer]]
*[[Operator]]
*[[QRCode]]
*[[Sequencer]]
*[[Spelunx]]
*[[USBHost]]
*[[WiPASmini]]
*[[ThermalDOE]]
*[[Reliability]]
*[[Reliability]] (Redesigned)

Monarch 13A22120w

2018-04-17T14:27:18Z

3xpl0itz: Removed hidden apps (we don't know for sure)

{{internal software|firmware}}
== Background ==
The following is one of the earliest known NonUI builds that is based off of an internal version of iOS 9.0. Originally found on an [[iPhone 6s Plus]] prototype, this firmware features two versions of [[Reliability]] along with other SwitchBoard applications.
[[File:6s13a22120w.png|thumb|right|iPhone 6s+ Prototype running 13A22120w]]
== Applications ==
Upon booting into [[SwitchBoard.app]], the user will be able to choose from a number of applications:
*[[AltoMobile]]
*[[dtxCaliente]]
*[[GrapeCal]]
*[[MesaCal]]
*[[NonUIConsoleViewer]]
*[[Operator]]
*[[QRCode]]
*[[Reliability]]
*[[Reliability]] (there are two)
*[[Sequencer]]
*[[Spelunx]]
*[[USBHost]]
*[[WiPASmini]]
*[[ThermalDOE]]

Whitetail 14A92340t

2018-04-17T02:08:25Z

3xpl0itz: Removed hidden apps (we don’t know for sure)

{{internal software|firmware}}
== Background ==
The following NonUI build is based off of an internal version of iOS 10.0. Due to the apps it has and its build number, it looks like this is simply an earlier version of [[WhitetailAni 14A93012r]].
[[File:iphone714a92340t.jpg|thumb|right|iPhone 7 running 14A92340t]]
== Applications ==
After booting up, [[SwitchBoard.app]] is shown, allowing you to open various applications.
They consist of:
*[[AltoMobile]]
*[[DropTest]]
*[[GrapeCal]]
*[[MesaCal]]
*[[NonUIConsoleViewer]]
*[[Reliability]]
*[[QRCode]]
*[[Sequencer]]
*[[Spelunx]]
*[[USBHost]]
*[[WiPASmini]]
*[[Reliability]]

Apple Internal Apps

2018-04-15T07:07:17Z

3xpl0itz: Added more apps

These are apps that are used for testing. These vary from internal testing apps for the next iPhone to Apple Store Employee apps.
In general, these apps are launchable from [[SpringBoard]], but some are not, such as when there is no Springboard. In that case, look at the non-gui testing apps at [[SwitchBoard: /usr/local/bin]].

== Internal diagnostic apps known from beta firmwares and prototypes ==
* [[Ad Tester]]
* [[APSTester]]
* [[AProxMeter]]
* [[AirPlayTester]]
* [[AirPrint Utility]]
* [[AppleNetworkDiagnostics]]
* [[BattleJack]]
* [[BonFire]]
* [[CompareDrawImage]]
* [[CompareTableView-Compatibility]]
* [[CompareTableView-Modal]]
* [[CompareTableView-PageSheet]]
* [[CompareTableView]]
* [[CooLtool]]
* [[CoreMotionToolbox]]
* [[Developer app]]
* [[DuetViewer]]
* [[E911Tester]]
* [[EABasic]]
* [[EAITracker]]
* [[EAPerf]]
* [[FieldScout]]
* [[FigCam]]
* [[FigCamAV]]
* [[FillRateTester]]
* [[Firebolt]]
* [[Flytrap]]
* [[GameStore]]
* [[GKRoster]]
* [[GKTalk]]
* [[GKTank]]
* [[GKTankHD]]
* [[GLReplayer]]
* [[GameKitTester]]
* [[GeoFence]]
* [[GeoFencer]]
* [[GSSTestApp]]
* [[HESTest]]
* [[IAPViewer]]
* [[iDTracer]]
* [[Inferno (utility)|Inferno]]
* [[IORegViewer]]
* [[Key Recorder]]
* [[KeyboardTester]]
* [[Link Keys]]
* [[MALogger]]
* [[MAZER]]
* [[MIDINetSetup]]
* [[MTLocTester]]
* [[MULe]]
* [[Magneto]]
* [[MesaUtility]]
* [[MesaDemo]]
* [[MemoryMuncher]]
* [[MoviePlayerTester]]
* [[MobileOracle]]
* [[MobileRadar]]
* [[MoPED]]
* [[NetGauge]]
* [[NotificationGenerator]]
* [[Notifications]]
* [[Null]]
* [[Onword]]
* [[PrintFont]]
* [[PrintPhoto]]
* [[PrintStressTest]]
* [[PSTest]]
* [[PurpleConsole]]
* [[QRCode]]
* [[Radar]]
* [[RemoteUITest]]
* [[SWU Tester]]
* [[Sally]]
* [[SalesCall]]
* [[ScreenShotr]]
* [[Screening Tool]]
* [[Scouting]]
* [[Scrapple]]
* [[SearchPerfTest]]
* [[SecurityTests]]
* [[SiriDataCollector]]
* [[SimpleApp]]
* [[SpinningiPhoneApp]]
* [[SportsSpeaker]]
* [[TPSReports]]
* [[TVOutTester]]
* [[Texterciser HD]]
* [[Texterciser]]
* [[TouchFighter]]
* [[TouchFighter 2]]
* [[TwitterTesterInternal]]
* [[Typology]]
* [[VIOSimple]]
* [[WiFi Survey]]
* [[WiForReal]]
* [[ZoomPan]]
* [[iTester]]
* [[jcam]]

== SwitchBoard Apps ==
* [[AltoMobile]]
* [[ATCommand]]
* [[BatterySet]]
* [[BillBoard]]
* [[BurnIn]]
* [[CameraFA]]
* [[CoexBlender]]
* [[DionysusTesterUI]]
* [[DropTest]]
* [[dtxCaliente]]
* [[FactoryStencil]]
* [[FactoryWalkingBeam]]
* [[GrapeCal]]
* [[GrapeCal_Lite]]
* [[LCDMura]]
* [[LCMFlicker]]
* [[LcdUTest]]
* [[MesaCal]]
* [[Ness]]
* [[Ninten]]
* [[NonUIConsoleViewer]]
* [[NonUIQRCode]]
* [[Operator]]
* [[OrbCal]]
* [[Pippi]]
* [[Pyro]]
* [[Reliability]]
* [[Rumble]]
* [[Sequencer]]
* [[Sightglass]]
* [[SkankBarcodeDisplay]]
* [[SkankPhone]]
* [[Soundwave]]
* [[Spelunx]]
* [[SwitchBoard.app]] - launches other apps, similiar to [[SpringBoard]]
* [[ThermalDOE]]
* [[USBHost]]
* [[WifiRoot]]
* [[WiPASmini]]
* [[XInternalApps]]

== Command Line Tools ==
* [[SwitchBoard: /usr/local/bin]]
* [[BasebandStressTests]]

== Preference bundles ==
* [[ABLE]]
* [[ABMInternalSettings]]
* [[AirPlayInternalSettings]]
* [[AirTrafficInternalSettings]]
* [[ApplePTPdInternalSettings]]
* [[AssistantInternalSettings]]
* [[Battery Saver]]
* [[BTInternal]]
* [[Carrier Settings]]
* [[ConferenceInternalSettings]]
* [[CoreAudioInternalSettings]]
* [[CoreMediaInternalSettings]]
* [[Cypress Settings]]
* [[DAInternalSettings]]
* [[DuetPanel]]
* [[FreezeInternalSettings]]
* [[GameKitInternalSettings]]
* [[Internal Settings]]
* [[MadridInternalSettings]]
* [[Mesa Settings]]
* [[MesaInternalSettings]]
* [[MobileBackupInternalSettings]]
* [[MobileSafariInternalSettings]]
* [[MobileSlideShowInternalSettings]]
* [[MobileSoftwareUpdateInternalSettings]]
* [[NFInternalSettings]]
* [[NikeInternalSettings]]
* [[PrintKitInternalSettings]]
* [[PurpleBuddyInternalSettings]]
* [[ScoutingSettings]]
* [[ThermalMonitorInternalSettings]]
* [[ViceroyTraceInternalSettings]]
* [[VoiceMemosInternalSettings]]
* [[WiFiInternalSettings]]
* [[WRMSettings]]
* [[iAdInternalSettings]]
* [[iPodInternalSettings]]
* [[iPodOutInternalSettings]]
* [[iTunesStoreInternalSettings]]

== Location bundles ==
* [[FenceTester]]
* [[LocationMonitor]]
* [[CoreAutomationDevice]]
* [[WirelessStressLocation]]

== Carrier Settings ==
* [[CoreAudioCarrierSettings]]
* [[WRMSettingsForCarriers]]

== Apps known to be used by Apple Employees ==
[[File:Apple Internal Apps.png|thumb|some internal Apple apps]]
* [[AppleConnect (Application)|AppleConnect]]
* [[Chatterbox]]
* [[Concierge]]
* [[Conference App]]
* [[Daily Download]]
* [[Apple Employee Directory|Directory]] - Apple's employee directory
* [[EasyPay]]
* [[Espresso]]
* [[Enroll iPad]]
* [[Installer (Internal App)|Installer]]
* [[iOS Diagnostics (Internal App)|iOS Diagnostics]]
* [[iRepair]]
* [[MobileGenius]]
* [[Pickup]]
* [[RNNmobile]]
* [[Radar]]
* [[Re-Enroll]]
* [[RetailMe]]
* [[Red Zone Mobile|RZM]]
* [[Receipts]]
* [[Runner]]
* [[Switchboard (App Store)|Switchboard]] - functions as an internal App Store for Apple employees
* [[Scout]]
* [[Self Service]]
* [[SSP]]
* [[Smart Sign]]
* [[Touch ID.app|Touch ID]]
* [[UniBox]]

== Miscellaneous ==
* [[image3maker (Internal Tool)|image3maker]]

[[Category:Apple Internal Apps]]

Apple Internal Apps

2018-04-15T06:28:35Z

3xpl0itz:

These are apps that are used for testing. These vary from internal testing apps for the next iPhone to Apple Store Employee apps.
In general, these apps are launchable from [[SpringBoard]], but some are not, such as when there is no Springboard. In that case, look at the non-gui testing apps at [[SwitchBoard: /usr/local/bin]].

== Internal diagnostic apps known from beta firmwares and prototypes ==
* [[Ad Tester]]
* [[APSTester]]
* [[AProxMeter]]
* [[AirPlayTester]]
* [[AirPrint Utility]]
* [[AppleNetworkDiagnostics]]
* [[BattleJack]]
* [[BonFire]]
* [[CompareDrawImage]]
* [[CompareTableView-Compatibility]]
* [[CompareTableView-Modal]]
* [[CompareTableView-PageSheet]]
* [[CompareTableView]]
* [[CooLtool]]
* [[CoreMotionToolbox]]
* [[Developer app]]
* [[DuetViewer]]
* [[E911Tester]]
* [[EABasic]]
* [[EAITracker]]
* [[EAPerf]]
* [[FieldScout]]
* [[FigCam]]
* [[FigCamAV]]
* [[FillRateTester]]
* [[Firebolt]]
* [[Flytrap]]
* [[GameStore]]
* [[GKRoster]]
* [[GKTalk]]
* [[GKTank]]
* [[GKTankHD]]
* [[GLReplayer]]
* [[GameKitTester]]
* [[GeoFence]]
* [[GeoFencer]]
* [[GSSTestApp]]
* [[HESTest]]
* [[IAPViewer]]
* [[iDTracer]]
* [[Inferno (utility)|Inferno]]
* [[IORegViewer]]
* [[Key Recorder]]
* [[KeyboardTester]]
* [[Link Keys]]
* [[MALogger]]
* [[MAZER]]
* [[MIDINetSetup]]
* [[MTLocTester]]
* [[MULe]]
* [[Magneto]]
* [[MesaUtility]]
* [[MesaDemo]]
* [[MemoryMuncher]]
* [[MoviePlayerTester]]
* [[MobileOracle]]
* [[MobileRadar]]
* [[MoPED]]
* [[NetGauge]]
* [[NotificationGenerator]]
* [[Notifications]]
* [[Null]]
* [[Onword]]
* [[PrintFont]]
* [[PrintPhoto]]
* [[PrintStressTest]]
* [[PSTest]]
* [[PurpleConsole]]
* [[QRCode]]
* [[Radar]]
* [[RemoteUITest]]
* [[SWU Tester]]
* [[Sally]]
* [[SalesCall]]
* [[ScreenShotr]]
* [[Screening Tool]]
* [[Scouting]]
* [[Scrapple]]
* [[SearchPerfTest]]
* [[SecurityTests]]
* [[SiriDataCollector]]
* [[SimpleApp]]
* [[SpinningiPhoneApp]]
* [[SportsSpeaker]]
* [[TPSReports]]
* [[TVOutTester]]
* [[Texterciser HD]]
* [[Texterciser]]
* [[TouchFighter]]
* [[TouchFighter 2]]
* [[TwitterTesterInternal]]
* [[Typology]]
* [[VIOSimple]]
* [[WiFi Survey]]
* [[WiForReal]]
* [[ZoomPan]]
* [[iTester]]
* [[jcam]]

== SwitchBoard Apps ==
* [[AltoMobile]]
* [[ATCommand]]
* [[BatterySet]]
* [[BillBoard]]
* [[BurnIn]]
* [[CameraFA]]
* [[CoexBlender]]
* [[DionysusTesterUI]]
* [[dtxCaliente]]
* [[FactoryStencil]]
* [[GrapeCal]]
* [[GrapeCal_Lite]]
* [[LCDMura]]
* [[LCMFlicker]]
* [[LcdUTest]]
* [[MesaCal]]
* [[Ness]]
* [[Ninten]]
* [[NonUIConsoleViewer]]
* [[NonUIQRCode]]
* [[Operator]]
* [[OrbCal]]
* [[Pippi]]
* [[Pyro]]
* [[Reliability]]
* [[Rumble]]
* [[Sequencer]]
* [[Sightglass]]
* [[SkankBarcodeDisplay]]
* [[SkankPhone]]
* [[Soundwave]]
* [[Spelunx]]
* [[SwitchBoard.app]] - launches other apps, similiar to [[SpringBoard]]
* [[ThermalDOE]]
* [[USBHost]]
* [[WifiRoot]]
* [[WiPASmini]]
* [[XInternalApps]]

== Command Line Tools ==
* [[SwitchBoard: /usr/local/bin]]
* [[BasebandStressTests]]

== Preference bundles ==
* [[ABLE]]
* [[ABMInternalSettings]]
* [[AirPlayInternalSettings]]
* [[AirTrafficInternalSettings]]
* [[ApplePTPdInternalSettings]]
* [[AssistantInternalSettings]]
* [[Battery Saver]]
* [[BTInternal]]
* [[Carrier Settings]]
* [[ConferenceInternalSettings]]
* [[CoreAudioInternalSettings]]
* [[CoreMediaInternalSettings]]
* [[Cypress Settings]]
* [[DAInternalSettings]]
* [[DuetPanel]]
* [[FreezeInternalSettings]]
* [[GameKitInternalSettings]]
* [[Internal Settings]]
* [[MadridInternalSettings]]
* [[Mesa Settings]]
* [[MesaInternalSettings]]
* [[MobileBackupInternalSettings]]
* [[MobileSafariInternalSettings]]
* [[MobileSlideShowInternalSettings]]
* [[MobileSoftwareUpdateInternalSettings]]
* [[NFInternalSettings]]
* [[NikeInternalSettings]]
* [[PrintKitInternalSettings]]
* [[PurpleBuddyInternalSettings]]
* [[ScoutingSettings]]
* [[ThermalMonitorInternalSettings]]
* [[ViceroyTraceInternalSettings]]
* [[VoiceMemosInternalSettings]]
* [[WiFiInternalSettings]]
* [[WRMSettings]]
* [[iAdInternalSettings]]
* [[iPodInternalSettings]]
* [[iPodOutInternalSettings]]
* [[iTunesStoreInternalSettings]]

== Location bundles ==
* [[FenceTester]]
* [[LocationMonitor]]
* [[CoreAutomationDevice]]
* [[WirelessStressLocation]]

== Carrier Settings ==
* [[CoreAudioCarrierSettings]]
* [[WRMSettingsForCarriers]]

== Apps known to be used by Apple Employees ==
[[File:Apple Internal Apps.png|thumb|some internal Apple apps]]
* [[AppleConnect (Application)|AppleConnect]]
* [[Chatterbox]]
* [[Concierge]]
* [[Conference App]]
* [[Daily Download]]
* [[Apple Employee Directory|Directory]] - Apple's employee directory
* [[EasyPay]]
* [[Espresso]]
* [[Enroll iPad]]
* [[Installer (Internal App)|Installer]]
* [[iOS Diagnostics (Internal App)|iOS Diagnostics]]
* [[iRepair]]
* [[MobileGenius]]
* [[Pickup]]
* [[RNNmobile]]
* [[Radar]]
* [[Re-Enroll]]
* [[RetailMe]]
* [[Red Zone Mobile|RZM]]
* [[Receipts]]
* [[Runner]]
* [[Switchboard (App Store)|Switchboard]] - functions as an internal App Store for Apple employees
* [[Scout]]
* [[Self Service]]
* [[SSP]]
* [[Smart Sign]]
* [[Touch ID.app|Touch ID]]
* [[UniBox]]

== Miscellaneous ==
* [[image3maker (Internal Tool)|image3maker]]

[[Category:Apple Internal Apps]]

Apple Internal Apps

2018-04-15T00:49:57Z

3xpl0itz: /* SwitchBoard Apps */

These are apps that are used for testing. These vary from internal testing apps for the next iPhone to Apple Store Employee apps.
In general, these apps are launchable from [[SpringBoard]], but some are not, such as when there is no Springboard. In that case, look at the non-gui testing apps at [[SwitchBoard: /usr/local/bin]].

== Internal diagnostic apps known from beta firmwares and prototypes ==
* [[Ad Tester]]
* [[APSTester]]
* [[AProxMeter]]
* [[AirPlayTester]]
* [[AirPrint Utility]]
* [[AppleNetworkDiagnostics]]
* [[BattleJack]]
* [[BonFire]]
* [[CompareDrawImage]]
* [[CompareTableView-Compatibility]]
* [[CompareTableView-Modal]]
* [[CompareTableView-PageSheet]]
* [[CompareTableView]]
* [[CooLtool]]
* [[CoreMotionToolbox]]
* [[Developer app]]
* [[DuetViewer]]
* [[E911Tester]]
* [[EABasic]]
* [[EAITracker]]
* [[EAPerf]]
* [[FieldScout]]
* [[FigCam]]
* [[FigCamAV]]
* [[FillRateTester]]
* [[Firebolt]]
* [[Flytrap]]
* [[GameStore]]
* [[GKRoster]]
* [[GKTalk]]
* [[GKTank]]
* [[GKTankHD]]
* [[GLReplayer]]
* [[GameKitTester]]
* [[GeoFence]]
* [[GeoFencer]]
* [[GSSTestApp]]
* [[HESTest]]
* [[IAPViewer]]
* [[iDTracer]]
* [[Inferno (utility)|Inferno]]
* [[IORegViewer]]
* [[Key Recorder]]
* [[KeyboardTester]]
* [[Link Keys]]
* [[MALogger]]
* [[MAZER]]
* [[MIDINetSetup]]
* [[MTLocTester]]
* [[MULe]]
* [[Magneto]]
* [[MesaUtility]]
* [[MesaDemo]]
* [[MemoryMuncher]]
* [[MoviePlayerTester]]
* [[MobileOracle]]
* [[MobileRadar]]
* [[MoPED]]
* [[NetGauge]]
* [[NotificationGenerator]]
* [[Notifications]]
* [[Null]]
* [[Onword]]
* [[PrintFont]]
* [[PrintPhoto]]
* [[PrintStressTest]]
* [[PSTest]]
* [[PurpleConsole]]
* [[QRCode]]
* [[Radar]]
* [[RemoteUITest]]
* [[SWU Tester]]
* [[Sally]]
* [[SalesCall]]
* [[ScreenShotr]]
* [[Screening Tool]]
* [[Scouting]]
* [[Scrapple]]
* [[SearchPerfTest]]
* [[SecurityTests]]
* [[SiriDataCollector]]
* [[SimpleApp]]
* [[SpinningiPhoneApp]]
* [[SportsSpeaker]]
* [[TPSReports]]
* [[TVOutTester]]
* [[Texterciser HD]]
* [[Texterciser]]
* [[TouchFighter]]
* [[TouchFighter 2]]
* [[TwitterTesterInternal]]
* [[Typology]]
* [[VIOSimple]]
* [[WiFi Survey]]
* [[WiForReal]]
* [[ZoomPan]]
* [[iTester]]
* [[jcam]]

== SwitchBoard Apps ==
* [[AltoMobile]]
* [[ATCommand]]
* [[BatterySet]]
* [[BurnIn]]
* [[BillBoard]]
* [[CameraFA]]
* [[CoexBlender]]
* [[DionysusTesterUI]]
* [[dtxCaliente]]
* [[FactoryStencil]]
* [[GrapeCal]]
* [[GrapeCal_Lite]]
* [[LCDMura]]
* [[LCMFlicker]]
* [[LcdUTest]]
* [[MesaCal]]
* [[Ness]]
* [[Ninten]]
* [[NonUIConsoleViewer]]
* [[NonUIQRCode]]
* [[Operator]]
* [[OrbCal]]
* [[Pippi]]
* [[Pyro]]
* [[Reliability]]
* [[Rumble]]
* [[Sequencer]]
* [[Sightglass]]
* [[SkankBarcodeDisplay]]
* [[SkankPhone]]
* [[Soundwave]]
* [[Spelunx]]
* [[SwitchBoard.app]] - launches other apps, similiar to [[SpringBoard]]
* [[ThermalDOE]]
* [[USBHost]]
* [[WifiRoot]]
* [[WiPASmini]]
* [[XInternalApps]]

== Command Line Tools ==
* [[SwitchBoard: /usr/local/bin]]
* [[BasebandStressTests]]

== Preference bundles ==
* [[ABLE]]
* [[ABMInternalSettings]]
* [[AirPlayInternalSettings]]
* [[AirTrafficInternalSettings]]
* [[ApplePTPdInternalSettings]]
* [[AssistantInternalSettings]]
* [[Battery Saver]]
* [[BTInternal]]
* [[Carrier Settings]]
* [[ConferenceInternalSettings]]
* [[CoreAudioInternalSettings]]
* [[CoreMediaInternalSettings]]
* [[Cypress Settings]]
* [[DAInternalSettings]]
* [[DuetPanel]]
* [[FreezeInternalSettings]]
* [[GameKitInternalSettings]]
* [[Internal Settings]]
* [[MadridInternalSettings]]
* [[Mesa Settings]]
* [[MesaInternalSettings]]
* [[MobileBackupInternalSettings]]
* [[MobileSafariInternalSettings]]
* [[MobileSlideShowInternalSettings]]
* [[MobileSoftwareUpdateInternalSettings]]
* [[NFInternalSettings]]
* [[NikeInternalSettings]]
* [[PrintKitInternalSettings]]
* [[PurpleBuddyInternalSettings]]
* [[ScoutingSettings]]
* [[ThermalMonitorInternalSettings]]
* [[ViceroyTraceInternalSettings]]
* [[VoiceMemosInternalSettings]]
* [[WiFiInternalSettings]]
* [[WRMSettings]]
* [[iAdInternalSettings]]
* [[iPodInternalSettings]]
* [[iPodOutInternalSettings]]
* [[iTunesStoreInternalSettings]]

== Location bundles ==
* [[FenceTester]]
* [[LocationMonitor]]
* [[CoreAutomationDevice]]
* [[WirelessStressLocation]]

== Carrier Settings ==
* [[CoreAudioCarrierSettings]]
* [[WRMSettingsForCarriers]]

== Apps known to be used by Apple Employees ==
[[File:Apple Internal Apps.png|thumb|some internal Apple apps]]
* [[AppleConnect (Application)|AppleConnect]]
* [[Chatterbox]]
* [[Concierge]]
* [[Conference App]]
* [[Daily Download]]
* [[Apple Employee Directory|Directory]] - Apple's employee directory
* [[EasyPay]]
* [[Espresso]]
* [[Enroll iPad]]
* [[Installer (Internal App)|Installer]]
* [[iOS Diagnostics (Internal App)|iOS Diagnostics]]
* [[iRepair]]
* [[MobileGenius]]
* [[Pickup]]
* [[RNNmobile]]
* [[Radar]]
* [[Re-Enroll]]
* [[RetailMe]]
* [[Red Zone Mobile|RZM]]
* [[Receipts]]
* [[Runner]]
* [[Switchboard (App Store)|Switchboard]] - functions as an internal App Store for Apple employees
* [[Scout]]
* [[Self Service]]
* [[SSP]]
* [[Smart Sign]]
* [[Touch ID.app|Touch ID]]
* [[UniBox]]

== Miscellaneous ==
* [[image3maker (Internal Tool)|image3maker]]

[[Category:Apple Internal Apps]]

Apple Internal Apps

2018-04-14T23:26:35Z

3xpl0itz: Added some more apps, alphabetical order

These are apps that are used for testing. These vary from internal testing apps for the next iPhone to Apple Store Employee apps.
In general, these apps are launchable from [[SpringBoard]], but some are not, such as when there is no Springboard. In that case, look at the non-gui testing apps at [[SwitchBoard: /usr/local/bin]].

== Internal diagnostic apps known from beta firmwares and prototypes ==
* [[Ad Tester]]
* [[APSTester]]
* [[AProxMeter]]
* [[AirPlayTester]]
* [[AirPrint Utility]]
* [[AppleNetworkDiagnostics]]
* [[BattleJack]]
* [[BonFire]]
* [[CompareDrawImage]]
* [[CompareTableView-Compatibility]]
* [[CompareTableView-Modal]]
* [[CompareTableView-PageSheet]]
* [[CompareTableView]]
* [[CooLtool]]
* [[CoreMotionToolbox]]
* [[Developer app]]
* [[DuetViewer]]
* [[E911Tester]]
* [[EABasic]]
* [[EAITracker]]
* [[EAPerf]]
* [[FieldScout]]
* [[FigCam]]
* [[FigCamAV]]
* [[FillRateTester]]
* [[Firebolt]]
* [[Flytrap]]
* [[GameStore]]
* [[GKRoster]]
* [[GKTalk]]
* [[GKTank]]
* [[GKTankHD]]
* [[GLReplayer]]
* [[GameKitTester]]
* [[GeoFence]]
* [[GeoFencer]]
* [[GSSTestApp]]
* [[HESTest]]
* [[IAPViewer]]
* [[iDTracer]]
* [[Inferno (utility)|Inferno]]
* [[IORegViewer]]
* [[Key Recorder]]
* [[KeyboardTester]]
* [[Link Keys]]
* [[MALogger]]
* [[MAZER]]
* [[MIDINetSetup]]
* [[MTLocTester]]
* [[MULe]]
* [[Magneto]]
* [[MesaUtility]]
* [[MesaDemo]]
* [[MemoryMuncher]]
* [[MoviePlayerTester]]
* [[MobileOracle]]
* [[MobileRadar]]
* [[MoPED]]
* [[NetGauge]]
* [[NotificationGenerator]]
* [[Notifications]]
* [[Null]]
* [[Onword]]
* [[PrintFont]]
* [[PrintPhoto]]
* [[PrintStressTest]]
* [[PSTest]]
* [[PurpleConsole]]
* [[QRCode]]
* [[Radar]]
* [[RemoteUITest]]
* [[SWU Tester]]
* [[Sally]]
* [[SalesCall]]
* [[ScreenShotr]]
* [[Screening Tool]]
* [[Scouting]]
* [[Scrapple]]
* [[SearchPerfTest]]
* [[SecurityTests]]
* [[SiriDataCollector]]
* [[SimpleApp]]
* [[SpinningiPhoneApp]]
* [[SportsSpeaker]]
* [[TPSReports]]
* [[TVOutTester]]
* [[Texterciser HD]]
* [[Texterciser]]
* [[TouchFighter]]
* [[TouchFighter 2]]
* [[TwitterTesterInternal]]
* [[Typology]]
* [[VIOSimple]]
* [[WiFi Survey]]
* [[WiForReal]]
* [[ZoomPan]]
* [[iTester]]
* [[jcam]]

== SwitchBoard Apps ==
* [[AltoMobile]]
* [[ATCommand]]
* [[BatterySet]]
* [[BurnIn]]
* [[BillBoard]]
* [[CameraFA]]
* [[CoexBlender]]
* [[DionysusTesterUI]]
* [[dtxCaliente]]
* [[FactoryStencil]]
* [[GrapeCal]]
* [[GrapeCal_Lite]]
* [[XInternalApps]]
* [[LCDMura]]
* [[LCMFlicker]]
* [[LcdUTest]]
* [[MesaCal]]
* [[Ness]]
* [[Ninten]]
* [[NonUIConsoleViewer]]
* [[NonUIQRCode]]
* [[Operator]]
* [[OrbCal]]
* [[Pippi]]
* [[Pyro]]
* [[Reliability]]
* [[Rumble]]
* [[Sequencer]]
* [[Sightglass]]
* [[SkankBarcodeDisplay]]
* [[SkankPhone]]
* [[Soundwave]]
* [[Spelunx]]
* [[SwitchBoard.app]] - launches other apps, similiar to [[SpringBoard]]
* [[ThermalDOE]]
* [[USBHost]]
* [[WifiRoot]]
* [[WiPASmini]]

== Command Line Tools ==
* [[SwitchBoard: /usr/local/bin]]
* [[BasebandStressTests]]

== Preference bundles ==
* [[ABLE]]
* [[ABMInternalSettings]]
* [[AirPlayInternalSettings]]
* [[AirTrafficInternalSettings]]
* [[ApplePTPdInternalSettings]]
* [[AssistantInternalSettings]]
* [[Battery Saver]]
* [[BTInternal]]
* [[Carrier Settings]]
* [[ConferenceInternalSettings]]
* [[CoreAudioInternalSettings]]
* [[CoreMediaInternalSettings]]
* [[Cypress Settings]]
* [[DAInternalSettings]]
* [[DuetPanel]]
* [[FreezeInternalSettings]]
* [[GameKitInternalSettings]]
* [[Internal Settings]]
* [[MadridInternalSettings]]
* [[Mesa Settings]]
* [[MesaInternalSettings]]
* [[MobileBackupInternalSettings]]
* [[MobileSafariInternalSettings]]
* [[MobileSlideShowInternalSettings]]
* [[MobileSoftwareUpdateInternalSettings]]
* [[NFInternalSettings]]
* [[NikeInternalSettings]]
* [[PrintKitInternalSettings]]
* [[PurpleBuddyInternalSettings]]
* [[ScoutingSettings]]
* [[ThermalMonitorInternalSettings]]
* [[ViceroyTraceInternalSettings]]
* [[VoiceMemosInternalSettings]]
* [[WiFiInternalSettings]]
* [[WRMSettings]]
* [[iAdInternalSettings]]
* [[iPodInternalSettings]]
* [[iPodOutInternalSettings]]
* [[iTunesStoreInternalSettings]]

== Location bundles ==
* [[FenceTester]]
* [[LocationMonitor]]
* [[CoreAutomationDevice]]
* [[WirelessStressLocation]]

== Carrier Settings ==
* [[CoreAudioCarrierSettings]]
* [[WRMSettingsForCarriers]]

== Apps known to be used by Apple Employees ==
[[File:Apple Internal Apps.png|thumb|some internal Apple apps]]
* [[AppleConnect (Application)|AppleConnect]]
* [[Chatterbox]]
* [[Concierge]]
* [[Conference App]]
* [[Daily Download]]
* [[Apple Employee Directory|Directory]] - Apple's employee directory
* [[EasyPay]]
* [[Espresso]]
* [[Enroll iPad]]
* [[Installer (Internal App)|Installer]]
* [[iOS Diagnostics (Internal App)|iOS Diagnostics]]
* [[iRepair]]
* [[MobileGenius]]
* [[Pickup]]
* [[RNNmobile]]
* [[Radar]]
* [[Re-Enroll]]
* [[RetailMe]]
* [[Red Zone Mobile|RZM]]
* [[Receipts]]
* [[Runner]]
* [[Switchboard (App Store)|Switchboard]] - functions as an internal App Store for Apple employees
* [[Scout]]
* [[Self Service]]
* [[SSP]]
* [[Smart Sign]]
* [[Touch ID.app|Touch ID]]
* [[UniBox]]

== Miscellaneous ==
* [[image3maker (Internal Tool)|image3maker]]

[[Category:Apple Internal Apps]]

ScreenShotr

2018-04-14T23:17:58Z

3xpl0itz: wording

{{internal software}}
ScreenShotr is an internal macOS application used for taking screenshots of prototype devices running internal firmwares. The screenshots are taken at the device's resolution. It also appears to be able to take screenshots of devices which have been ran through Xcode and have the Developer preference bundle. One of its interesting features is the ability take screenshots wirelessly, most likely using a similar method to Xcode 9's wireless debugging feature.

== Gallery ==
<gallery>
File:ScreenShotr2.png|ScreenShotr before taking a screenshot.
File:ScreenShotr1.png|ScreenShotr screenshot of an iPhone SE running iOS 11.0 with developer tools installed.
</gallery>

ScreenShotr

2018-04-14T23:15:39Z

3xpl0itz:

{{internal software}}
ScreenShotr is an internal macOS application used for taking screenshots of prototype devices running internal nonUI firmwares. The screenshots are taken at the device's resolution. It also appears to be able to take screenshots of devices which have been ran through Xcode and have the Developer preference bundle. It also can take screenshots wirelessly, probably using a similar method to Xcode 9's wireless debugging feature.

== Gallery ==
<gallery>
File:ScreenShotr2.png|ScreenShotr before taking a screenshot.
File:ScreenShotr1.png|ScreenShotr screenshot of an iPhone SE running iOS 11.0 with developer tools installed.
</gallery>

ScreenShotr

2018-04-14T23:15:27Z

3xpl0itz: Tidy up grammar/naming

{{internal software}}
ScreenShotr is an internal MacOS application used for taking screenshots of prototype devices running internal nonUI firmwares. The screenshots are taken at the device's resolution. It also appears to be able to take screenshots of devices which have been ran through Xcode and have the Developer preference bundle. It also can take screenshots wirelessly, probably using a similar method to Xcode 9's wireless debugging feature.

== Gallery ==
<gallery>
File:ScreenShotr2.png|ScreenShotr before taking a screenshot.
File:ScreenShotr1.png|ScreenShotr screenshot of an iPhone SE running iOS 11.0 with developer tools installed.
</gallery>

Timeline

2018-04-13T05:14:34Z

3xpl0itz: this isnt really timeline worthy...

{{float toc|right}}
{{see also|The iPhone Wiki:Current events}}
== 2018 ==
=== April ===
* 2 April -- iOS 11.4 beta, tvOS 11.4 beta and watchOS 4.3.1 beta released.

=== March ===
* 29 March -- audioOS 11.3, iOS 11.3, tvOS 11.3 and watchOS 4.3 released.
* 28 March -- iOS 11.3 for [[iPad (6th generation)]] released.
* 27 March -- [[iPad (6th generation)]] released.
* 20 March -- tvOS 11.3 beta 6 released.
* 16 March -- iOS 11.3 beta 6 and watchOS 4.3 beta 6 released.
* 12 March -- iOS 11.3 beta 5, tvOS 11.3 beta 5 and watchOS 4.3 beta 5 released.
* 6 March -- watchOS 4.3 beta 4 released.
* 5 March -- iOS 11.3 beta 4 and tvOS 11.3 beta 4 released.

=== February ===
* 26 February -- [[Electra]] 1.0 and 1.0.1 released to the public.
* 21 February -- watchOS 4.3 beta 3 released.
* 20 February -- iOS 11.3 beta 3 and tvOS 11.3 beta 3 released.
* 19 February -- iOS 11.2.6, tvOS 11.2.6 and watchOS 4.2.3 released.
* 7 February -- watchOS 4.3 beta 2 released.
* 6 February -- iOS 11.3 beta 2, and tvOS 11.3 beta 2 released.

=== January ===
* 25 January -- watchOS 4.3 beta released.
* 24 January -- iOS 11.3 beta and tvOS 11.3 beta released.
* 23 January -- iOS 11.2.5, tvOS 11.2.5, watchOS 4.2.2 and audioOS 11.2.5 beta 3 released.
* 19 January -- iOS 11.2.5 beta 7 and watchOS 4.2.2 beta 5 released.
* 17 January -- iOS 11.2.5 beta 6 and tvOS 11.2.5 beta 6 released.
* 12 January -- tvOS 11.2.5 beta 5 and [[Electra]] JB toolkit released.
* 11 January -- iOS 11.2.5 beta 5 released.
* 9 January -- iOS 11.2.5 beta 4, watchOS 4.2.2 beta 4 and tvOS 11.2.5 beta 4 released.
* 8 January -- iOS 11.2.2 released.
* 3 January -- iOS 11.2.5 beta 3, watchOS 4.2.2 beta 3 and tvOS 11.2.5 beta 3 released.

== 2017 ==
=== December ===
* 24 December -- [[h3lix]] beta 1 released to jailbreak 32-bit devices running iOS 10.x.
* 19 December -- iOS 11.2.5 beta 2, watchOS 4.2.2 beta 2, audioOS 11.2.5 beta 2 and tvOS 11.2.5 beta 2 released.
* 13 December -- iOS 11.2.1 and tvOS 11.2.1 released. iOS 11.2.5 beta, watchOS 4.2.2 beta, tvOS 11.2.5 beta, and audioOS 11.2.5 beta also released.
* 5 December -- watchOS 4.2 released.
* 4 December -- tvOS 11.2 released.
* 2 December -- iOS 11.2 released.
* 1 December -- iOS 11.2 beta 6 released.

=== November ===
* 28 November -- iOS 11.2 beta 5 and tvOS 11.2 beta 5 released.
* 17 November -- iOS 11.2 beta 4, tvOS 11.2 beta 4 and watchOS 11.2 beta 4 released.
* 16 November -- iOS 11.1.2 released.
* 13 November -- iOS 11.2 beta 3, tvOS 11.3 beta 3 and watchOS 4.2 beta 3 released.
* 9 November -- iOS 11.1.1 released.
* 6 November -- iOS 11.2 beta 2, tvOS 11.2 beta 2, watchOS 4.2 beta 2 and [[audioOS]] 11.2 beta 2 released.
* 3 November -- iPhone X released. iOS 11.2 beta 2 for [[iPhone X]] released.

=== October ===
* 31 October -- iOS 11.1, tvOS 11.1 and watchOS 4.1 released.
* 30 October -- iOS 11.2 beta, tvOS 11.2 beta, watchOS 4.2 beta and [[audioOS]] 11.2 beta released.
* 23 October -- iOS 11.1 beta 5 and tvOS 11.1 beta 4 released.
* 20 October -- iOS 11.1 beta 4 and watchOS 4.1 beta 4 released.
* 16 October -- iOS 11.1 beta 3, tvOS 11.1 beta 3 and watchOS 4.1 beta 3 released.
* 15 October -- [[Saïgon]] jailbreak released in beta.
* 11 October -- iOS 11.0.3 released.
* 9 October -- iOS 11.1 beta 2, tvOS 11.1 beta 2 and watchOS 4.1 beta 2 released.
* 4 October -- watchOS 4.0.1 released.
* 3 October -- iOS 11.0.2 released.

=== September ===
* 27 September -- iOS 11.1 beta, tvOS 11.1 beta and watchOS 4.1 beta released.
* 26 September -- iOS 11.0.1 released.
* 22 September -- [[Apple Watch Series 3]], [[Apple TV 4K]], [[iPhone 8]], and [[iPhone 8 Plus]] released.
* 19 September -- iOS 11.0, tvOS 11.0 and watchOS 4.0 released. [[EtasonJB]] released for iOS 8.4.1.
* 12 September -- iOS 11.0 [[Golden Master|GM]], tvOS 11.0 [[Golden Master|GM]] and watchOS 4.0 [[Golden Master|GM]] released. [[Apple Watch Series 3]], [[Apple TV 4K]], [[iPhone 8]], [[iPhone 8 Plus]] and [[iPhone X]] announced.
* 6 September -- iOS 11.0 beta 10 released.
* 5 September -- tvOS 11.0 beta 10 released.

=== August ===
* 31 August -- iOS 11.0 beta 9 and tvOS 11.0 beta 9 released.
* 28 August -- iOS 11.0 beta 8, tvOS 11.0 beta 8 and watchOS 4.0 beta 8 released.
* 21 August -- iOS 11.0 beta 7, tvOS 11.0 beta 7 and watchOS 4.0 beta 7 released.
* 14 August -- iOS 11.0 beta 6, tvOS 11.0 beta 6 and watchOS 4.0 beta 6 released.
* 7 August -- iOS 11.0 beta 5, tvOS 11.0 beta 5 and watchOS 4.0 beta 5 released.

=== July ===
* 24 July -- iOS 11.0 beta 4, tvOS 11.0 beta 4 and watchOS 4.0 beta 4 released.
* 19 July -- iOS 10.3.3, tvOS 10.2.2 and watchOS 3.2.3 released.
* 13 July -- watchOS 4.0 beta 3 released.
* 10 July -- iOS 11.0 beta 3 and tvOS 11.0 beta 3 released.
* 6 July -- tvOS 10.2.2 beta 5 released.
* 5 July -- iOS 10.3.3 beta 6 released.

=== June ===
* 28 June -- iOS 10.3.3 beta 5 released.
* 26 June -- iOS 11.0 beta 2 (build 15A5304j), tvOS 11.0 beta 2 (build 15J5310h) and watchOS 3.2.3 beta 4 released.
* 22 June -- iOS 10.3.3 beta 4 and tvOS 10.2.2 beta 4 released.
* 21 June -- iOS 11.0 beta 2, tvOS 11.0 beta 2 and watchOS 4.0 beta 2 released.
* 13 June -- iOS 10.3.3 beta 3, tvOS 10.2.2 beta 3 and watchOS 3.2.3 beta 3 released.
* 7 June -- tvOS 11.0 beta (build 15J5284g) released.
* 5 June -- iOS 11.0 beta, tvOS 11.0 beta (build 15J5284e), watchOS 4.0 beta and iOS 10.3.2 for [[iPad Pro (12.9-inch, 2nd generation)]] and [[iPad Pro (10.5-inch)]] released.

=== May ===
* 30 May -- iOS 10.3.3 beta 2, tvOS 10.2.2 beta 2 and watchOS 3.2.3 beta 2 released.
* 16 May -- iOS 10.3.3 beta, tvOS 10.2.2 beta and watchOS 3.2.3 beta released.
* 15 May -- iOS 10.3.2, tvOS 10.2.1 and watchOS 3.2.2 released.
* 4 May -- tvOS 10.2.1 beta 5 released.

=== April ===
* 27 April -- iOS 10.3.2 beta 5 released.
* 24 April -- iOS 10.3.2 beta 4, watchOS 3.2.2 beta 4 and tvOS 10.2.1 beta 4 released.
* 17 April -- iOS 10.3.2 beta 3, watchOS 3.2.2 beta 3 and tvOS 10.2.1 beta 2 released.
* 11 April -- [[alloc8 Exploit]] released for all revisions of the [[iPhone 3GS]], along with [[ipwndfu]] as a tool to utilise this exploit.
* 10 April -- iOS 10.3.2 beta 2, watchOS 3.2.2 beta 2 and tvOS 10.2.1 beta 2 released.
* 3 April -- iOS 10.3.1 released.

=== March ===
* 28 March -- iOS 10.3.2 beta, watchOS 3.2.2 beta and tvOS 10.2.1 beta released.
* 27 March -- iOS 10.3, watchOS 3.2 and tvOS 10.2 released.
* 24 March -- [[iPad (5th generation)]], 32GB/128GB [[iPhone SE]] and PRODUCT(RED) [[iPhone 7]] available for purchase.
* 21 March -- [[iPad (5th generation)]] and iPhone 7 (PRODUCT)RED Special Edition announced.
* 20 March -- watchOS 3.2 beta 7 released.
* 16 March -- iOS 10.3 beta 7 released.
* 14 March -- tvOS 10.2 beta 6 and watchOS 3.2 beta 6 released.
* 13 March -- iOS 10.3 beta 6 released.
* 8 March -- iOS 10.3 beta 5, tvOS 10.2 beta 5 and watchOS 3.2 beta 5 released.

=== February ===
* 28 February -- tvOS 10.2 beta 4 released.
* 27 February -- iOS 10.3 beta 4 and watchOS 3.2 beta 4 released.
* 20 February -- iOS 10.3 beta 3, tvOS 10.2 beta 3 and watchOS 3.2 beta 3 released.
* 6 February -- iOS 10.3 beta 2, tvOS 10.2 beta 2 and watchOS 3.2 beta 2 released.

=== January ===
* 30 January -- watchOS 3.2 beta released.
* 24 January -- iOS 10.3 beta and tvOS 10.2 beta released.
* 23 January -- iOS 10.2.1, watchOS 3.1.3 and tvOS 10.1.1 released.
* 12 January -- iOS 10.2.1 beta 4 released.
* 9 January -- iOS 10.2.1 beta 3, watchOS 3.1.3 beta 2 and tvOS 10.1.1 beta 2 released.

== 2016 ==
=== December ===
* 21 December -- watchOS 3.1.3 beta released.
* 20 December -- iOS 10.2.1 beta 2 released.
* 14 December -- iOS 10.2.1 beta and tvOS 10.1.1 beta released.
* 13 December -- watchOS 3.1.1 retracted after reports of [[Apple Watch Series 2]] units bring bricked.
* 12 December -- iOS 10.2, tvOS 10.1, watchOS 3.1.1 and Apple TV iOS 7.2.2 released.
* 7 December -- iOS 10.2 beta 7 released. [[User:qwertyoruiop|qwertyoruiop]] releases [https://jbme.qwertyoruiop.com/ jbme] to re-enable the [[Pangu9]] jailbreak for iOS 9.3.3, as an alternative to the IPA.
* 6 December -- tvOS 10.1 beta 5 released.
* 5 December -- iOS 10.2 beta 6 and watchOS 3.1.1 beta 5 released.
* 2 December -- iOS 10.2 beta 5 released.

=== November ===
* 30 November -- tvOS 10.1 beta 4 released.
* 28 November -- iOS 10.2 beta 4 and watchOS 3.1.1 beta 4 released.
* 15 November -- watchOS 3.1.1 beta 3 released.
* 14 November -- iOS 10.2 beta 3, tvOS 10.1 beta 3 and 10.0.1 released.
* 9 November -- iOS 10.1.1 (14B150) released via IPSW's only.
* 7 November -- iOS 10.2 beta 2, tvOS 10.1 beta 2 and watchOS 3.1.1 beta 2 released.

=== October ===
* 31 October -- iOS 10.1.1, 10.2 beta, tvOS 10.1 beta and watchOS 3.1.1 beta released.
* 24 October -- iOS 10.1, tvOS 10.0.1 and watchOS 3.1 released.
* 20 October -- tvOS 10.0.1 beta 4 released.
* 19 October -- iOS 10.1 beta 5 for [[iPhone 7]] and [[iPhone 7 Plus]] released.
* 17 October -- iOS 10.0.3 for [[iPhone 7]] and [[iPhone 7 Plus]] and iOS 10.1 beta 4 released.
* 12 October -- watchOS 3.1 beta 3 released.
* 10 October -- iOS 10.1 beta 3 and tvOS 10.0.1 beta 3 released.
* 4 October -- iOS 10.1 beta 2, tvOS 10.0.1 beta 2 and watchOS 3.1 beta 2 released.

=== September ===
* 23 September -- iOS 10.0.2 released.
* 21 September -- iOS 10.1 beta, tvOS 10.0.1 beta and watchOS 3.1 beta released.
* 13 September -- iOS 10.0.1, tvOS 10.0 and watchOS 3.0 released.
* 7 September -- iOS 10.0.1 [[Golden Master|GM]], tvOS 10.0 [[Golden Master|GM]] and watchOS 3.0 [[Golden Master|GM]] released. [[Apple Watch Series 1]], [[Apple Watch Series 2]], [[iPhone 7]], [[iPhone 7 Plus]] and [[AirPods]] announced.

=== August ===
* 26 August -- iOS 10.0 beta 8 and tvOS 10.0 beta 7 released.
* 25 August -- iOS 9.3.5 released.
* 19 August -- iOS 10.0 beta 7 released.
* 15 August -- iOS 10.0 beta 6, tvOS 10.0 beta 6 and watchOS 3.0 beta 6 released.
* 9 August -- iOS 10.0 beta 5, tvOS 10.0 beta 5 and watchOS 3.0 beta 5 released.
* 4 August -- iOS 9.3.4 released.
* 1 August -- iOS 10.0 beta 4, tvOS 10.0 beta 4 and watchOS 3.0 beta 4 released.

=== July ===
* 29 July -- [[Pangu9]] for iOS 9.2-9.3.3 English version released.
* 24 July -- [[Pangu9]] for iOS 9.2-9.3.3 released.
* 18 July -- iOS 10.0 beta 3, tvOS 10.0 beta 3 and watchOS 3.0 beta 3, iOS 9.3.3, watchOS 2.2.2 and tvOS 9.2.2 released.
* 6 July -- iOS 9.3.3 beta 5 and tvOS 9.2.2 beta 5 released.
* 5 July -- iOS 10.0 beta 2, tvOS 10.0 beta 2 and watchOS 3.0 beta 2 released.

=== June ===
* 29 June -- iOS 9.3.3 beta 4 and tvOS 9.2.2 beta 4 released.
* 21 June -- iOS 9.3.3 beta 3 and tvOS 9.2.2 beta 3 released.
* 13 June -- iOS 10.0 beta, tvOS 10.0 beta and watchOS 3.0 beta released.
* 6 June -- iOS 9.3.3 beta 2, tvOS 9.2.2 beta 2 and watchOS 2.2.2 beta released.
* 2 June -- iOS 9.3.2 (13F72) is released for the [[iPad Pro (9.7-inch)]].

=== May ===
* 23 May -- iOS 9.3.3 beta and tvOS 9.2.2 beta released.
* 19 May -- iOS 9.3.2 is retracted for the [[iPad Pro (9.7-inch)]] due to a bug that may prevent usage, but continues to be [[SHSH|signed]].
* 16 May -- iOS 9.3.2, tvOS 9.2.1 and watchOS 2.2.1 released.
* 3 May -- iOS 9.3.2 beta 4 and tvOS 9.2.1 beta 4 released.

=== April ===
* 27 April -- tvOS 9.2.1 beta 3 released.
* 26 April -- iOS 9.3.2 beta 3 released.
* 21 April -- tvOS 9.2.1 beta 2 re-released.
* 20 April -- iOS 9.3.2 beta 2 and watchOS 2.2.1 beta 2 released. tvOS 9.2.1 beta 2 was also made available, but it was quickly retracted due to a mishap with publishing.
* 6 April -- iOS 9.3.2 beta, watchOS 2.2.1 beta and tvOS 9.2.1 beta released.

=== March ===
* 31 March -- iOS 9.3.1 released.
* 28 March -- iOS 9.3 (13E237) released for iPad 2 ([[K93AP|iPad2,1]], [[K95AP|iPad2,3]], and [[K93AAP|iPad2,4]]), [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]].
* 25 March -- iOS 9.3 (13E236) released for [[K94AP|iPad 2 (iPad2,2)]].
* 23 March -- Pangu released [[J42dAP|Apple TV (4th generation)]] [[tvOS]] 9.0 - 9.0.1 jailbreak (v1.0.0).
* 21 March -- iOS 9.3, tvOS 9.2 and watchOS 2.2 released to the public. [[iPad Pro (9.7-inch)]] and [[iPhone SE]] announced
* 16 March -- Pangu9 1.3.1 (Windows)/1.1.1 (Mac) released to make untether of iOS 9.1 more stable.
* 14 March -- iOS 9.3 beta 7 released.
* 11 March -- Pangu9 1.3.0 (Windows)/1.1.0 (Mac) released to jailbreak 64-bit devices on iOS 9.1.
* 10 March -- tvOS 9.2 beta 6 released.
* 7 March -- iOS 9.3 beta 6 and watchOS 2.2 beta 6 released.
* 1 March -- iOS 9.3 beta 5, tvOS 9.2 beta 5 and watchOS 2.2 beta 5 released.

=== February ===
* 25 February -- [[Apple TV (3rd generation)]] software 7.2.1 released.
* 22 February -- iOS 9.3 beta 4, tvOS 9.2 beta 4 and watchOS 2.2 beta 4 released.
* 18 February -- iOS 9.2.1 (13D20) for [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPad mini 3]], [[iPad mini 4]], [[iPad Air 2]], and [[iPad Pro (12.9-inch)]] released.
* 8 February -- tvOS 9.2 beta 3, watchOS 2.2 beta 3 and iOS 9.3 beta 3 released.

=== January ===
* 25 January -- tvOS 9.1.1, 9.2 beta 2, watchOS 2.2 beta 2 and iOS 9.3 beta 2 released.
* 19 January -- iOS 9.2.1 released.
* 14 January -- iOS 9.3 beta 1.1 released.
* 11 January -- iOS 9.3, tvOS 9.1.1, tvOS 9.2 beta, and watchOS 2.2 beta released.
* 4 January -- iOS 9.2.1 beta 2 released.

== 2015 ==
=== December ===
* 25 December -- TaiG 2.4.5 released.
* 16 December -- iOS 9.2.1 beta seeded to developers.
* 8 December -- iOS 9.2, tvOS 9.1 and watchOS 2.1 released.

=== November ===
* 30 November -- TaiG 2.4.4 released (no longer beta).
* 20 November -- TaiG 2.4.4 beta released.
* 18 November -- iOS 9.2 beta 4 and tvOS 9.1 beta 3 released.
* 17 November -- iOS 9.1 (13B144) for iPad Pro (12.9-inch) released.
* 11 November -- [[iPad Pro (12.9-inch)]] released.
* 10 November -- iOS 9.2 beta 3 and tvOS 9.1 beta 2 released
* 9 November -- tvOS 9.0.1 released.
* 3 November -- iOS 9.2 beta 2 and tvOS 9.1 beta released.

=== October ===
* 29 October -- iOS 9.2 public beta and tvOS 9.0 released.
* 28 October -- [[Pangu9]] 1.0.0 for Mac released.
* 27 October -- [[Pangu9]] 1.2.0 and iOS 9.2 beta released.
* 22 October -- [[Seas0nPass]] 0.9.7 beta released to jailbreak [[K66AP|Apple TV (2nd generation)]] running 6.2.1 tethered.
* 21 October -- [[Pangu9]] 1.1.0, iOS 9.1, tvOS 9.0GM, watchOS 2.0.1 and iTunes 12.3.1 released.
* 15 October -- [[Pangu9]] 1.0.1 released.
* 14 October -- [[Pangu9]] 1.0.0 released to jailbreak iOS 9.0, 9.0.1 and 9.0.2.
* 12 October -- iOS 9.1 beta 5 released.
* 6 October -- iOS 9.1 beta 4 and tvOS 9.0 beta 3 released.

=== September ===
* 30 September -- iOS 9.0.2 and 9.1 beta 3 released.
* 24 September -- iOS 9.0.1 released for iPhone 6s and iPhone 6s Plus.
* 23 September -- iOS 9.0.1 (excluding iPhone 6s and iPhone 6s Plus) , 9.1 beta 2 and tvOS 9.0 beta 2 released.
* 21 September -- watchOS 2.0 released to the public.
* 16 September -- iOS 9.0 released to the public.
* 9 September -- iOS 9.0 [[Golden Master|GM]], watchOS 2.0 [[Golden Master|GM]] and iOS 9.1 beta released to developers. [[iPhone 6s]], [[iPhone 6s Plus]], [[iPad Pro (12.9-inch)]], [[iPad mini 4]] and [[J42dAP|Apple TV (4th generation)]] announced.

=== August ===
* 13 August -- iOS 8.4.1 and iTunes 12.2.2 released.
* 6 August -- iOS 9.0 beta 5 and watchOS 2.0 beta 5 released.
* 4 August -- TaiG 1.1.0 for Mac released.
* 2 August -- TaiG 1.0.0 for Mac released.

=== July ===
* 30 July -- iOS 8.4.1 beta 2 released.
* 21 July -- iOS 9.0 beta 4 and watchOS 2.0 beta 4 released.
* 20 July -- [[TaiG]] 2.4.3 released, no longer a beta.
* 16 July -- [[TaiG]] 2.4.3 beta released, optimises jailbreak process.
* 15 July -- [[N102AP|iPod touch (6th generation)]] released.
* 14 July -- iOS 8.4.1 beta released.
* 13 July -- [[TaiG]] 2.4.2 Beta released, fixes 30% and 40% issues as well as bundling Cydia 1.1.23. [[PPJailbreak]] 2.0.0 released to jailbreak iOS 8.1.3 - 8.4 on Mac.
* 11 July -- [[TaiG]] 2.4.1 released.
* 10 July -- [[TaiG]] 2.4.1 Beta released, fixes 60% issue.
* 7 July -- [[TaiG]] 2.3.1 released.
* 6 July -- [[TaiG]] 2.3.1 Beta released, includes Cydia 1.1.20.
* 3 July -- [[TaiG]] 2.3.0 released, which removes the setruid-patch
* 2 July -- [[TaiG]] 2.2.1 released to address a security vulnarability allowing all apps to get root easily.

=== June ===
* 30 June -- iOS 8.4 released. [[TaiG]] 2.2.0 released to jailbreak iOS 8.4.
* 23 June -- [[TaiG]] 2.0.0 released to jailbreak iOS 8.1.3, 8.2 and 8.3.
* 8 June -- Apple announces iOS 9, watchOS 2.0, and a release date of June 30 for iOS 8.4 at [[WWDC]] 2015.

=== May ===
* 15 May -- [[User:geohot|geohot]] [[The iPhone Wiki:Changing Ownership|transfers]] ownership of The iPhone Wiki to [[User:saurik|saurik]].

=== April ===
* 23 April -- iOS 8.2 (build 12S506) released for Apple Watch.
* 8 April -- iOS 8.3 and Apple TV 7.2 released.

=== March ===
* 9 March -- iOS 8.2 released.

=== February ===
* 23 February -- [[TaiG]] updated to version 1.3 to support iOS 8.2 beta and beta 2.
* 12 February -- [[TaiG]] updated to version 1.2.1 to support iTunes 12.1.

=== January ===
* 27 January -- iOS 8.1.3 and 7.0.3 (8.1.3) for Apple TV released.
* 18 January -- [[PPJailbreak]] released to jailbreak iOS 8.0 - 8.1.2 on a Mac.

== 2014 ==
=== December ===
* 9 December -- iOS 8.1.2 released.

=== November ===
* 29 November -- [[TaiG]] released to jailbreak iOS 8.0 - 8.1.1 on all devices except Apple TV.
* 18 November -- iOS 8.1.1 and Apple TV 7.0.2 released.

=== October ===
* 22 October -- [[Pangu8]] for iOS 8.x released.
* 20 October -- iOS 8.1 released.
* 16 October -- [[iPad Air 2]] and [[iPad mini 3]] announced.

=== September ===
* 25 September -- iOS 8.0.2 released.
* 24 September -- iOS 8.0.1 released. Critical bugs affecting Touch ID and cellular service was quickly discovered[http://support.apple.com/kb/HT6487] and the update was retracted.
* 19 September -- Initial release of [[N61AP|iPhone 6]] and [[N56AP|iPhone 6 Plus]].
* 17 September -- iOS 8.0 is released to the public, as well as 6.2.1 for the [[K66AP|Apple TV (2nd generation)]].
* 9 September -- Apple announces the [[Apple Watch (1st generation)]], [[N61AP|iPhone 6]], and [[N56AP|iPhone 6 Plus]].

=== June ===
* 30 June -- iOS 7.1.2 and Apple TV 6.2 released to fix iBeacon connectivity, mail attachments not being encrypted and a bug with data transfers from third party accessories.
* 29 June -- [[Pangu]] 1.1.0 released with lots of improvements.
* 23 June -- [[Pangu]] released to jailbreak iOS 7.1.x untethered.
* 1 June -- [[p0sixspwn]] updated to version 1.0.8 to support iOS 6.1.6 and fix iTunes 11.1+ crashes.

=== April ===
* 22 April -- [[iOS]] 7.1.1 and Apple TV 6.1.1 released with bug fixes, including [[Touch ID]] fixes.

=== March ===
* 27 March -- [[evasi0n7]] updated to 1.0.8 to support iOS 7.0 (11A466) that shipped with some 5s and 5c iPhones
* 10 March -- [[iOS]] 7.1, Apple TV iOS 6.1, [[J73AP|iPad Air (iPad4,3)]] and [[J87AP|iPad mini 2 (iPad4,6)]] released.
* 1 March -- [[evasi0n7]] updated to 1.0.7 to fix problem where bundled repository package information could not be refreshed/updated by Cydia and updated bundled Cydia package lists.

=== February ===
* 26 February -- [[iTunes]] updated to 11.1.5 to fix crashing and improve iBooks compatibility on OS X.
* 22 February -- [[evasi0n7]] updated to version 1.0.6 to support iOS 7.0.6.
* 21 February -- [[iOS]] 7.0.6 and iOS 6.1.6 released to address faulty SSL validation.
* 5 February -- [[evasi0n7]] updated to version 1.0.5 to support iOS 7.0.5.

=== January ===
* 29 January -- [[iOS]] 7.0.5 released for [[N49AP|iPhone 5c (iPhone5,4)]] and [[N53AP|iPhone 5s (iPhone6,2)]], fixing network provisioning.
* 22 January -- [[iTunes]] 11.1.4 released, adding Wish List and language improvements.
* 12 January -- [[evad3rs]] releases [[evasi0n7]] 1.0.4 to fix important untether security bugs.
* 11 January -- [[evad3rs]] releases [[evasi0n7]] 1.0.3 to fix [[iPad mini 2]] bootloop issues, support iOS 7.1 beta 3 and include [[Cydia]] 1.1.9.

== 2013 ==
=== December ===
* 31 December -- [[evad3rs]] releases [[evasi0n7]] 1.0.2 to fix [[iPad 2]] bootloop issues.
* 30 December -- [[User:Ih8sn0w|iH8sn0w]], [https://twitter.com/SquiffyPwn SquiffyPwn], and [[User:winocm|winocm]] release [[p0sixspwn]], an [[untethered jailbreak]] for iOS 6.1.3 through 6.1.5, for Mac OS X.
* 24 December -- [[evad3rs]] releases [[evasi0n7]] 1.0.1 to completely remove Chinese piracy store.
* 22 December -- [[evad3rs]] releases [[evasi0n7]], an [[untethered jailbreak]] for iOS 7.0 through 7.0.4.

=== November ===
* 14 November -- [[iOS]] 7.0.4, 6.1.5 for iPod touch (4th generation) to fix [[FaceTime]] bugs and [[List of Apple TVs|Apple TV]] 6.0.2 released.
* 1 November -- [[iPad Air]] released.

=== October ===
* 24 October -- Apple TV firmware updated to 6.0.1.
* 22 October -- [[iOS]] 7.0.3 released to fix various bugs including a passcode bug. [[iPad Air]] and [[iPad mini 2]] announced.

=== September ===
* 26 September -- [[iOS]] 7.0.2 released to address Lock screen issues.
* 23 September -- Apple releases a patched version of the Apple TV 6.0 update.
* 20 September -- Initial release of [[iPhone 5c]] and [[iPhone 5s]]. iOS 7.0.1 is also made available for these devices. A 6.0 update for the Apple TV was also released, but is pulled due to problems.[http://www.macrumors.com/2013/09/22/apple-pulls-apple-tv-6-0-update-following-reports-of-bricking/]
* 18 September -- [[iOS]] 7.0 released for the [[iPad 2]] and newer, [[iPad mini]], [[iPhone 4]] and newer, [[iPod touch (4th generation)]].
* 10 September -- Apple announces the [[iPhone 5c]] and [[iPhone 5s]].

=== June ===
* 25 June -- [[iFaith]] 1.5.9 released.
* 19 June -- Apple TV firmware 5.3 released.
* 10 June -- Apple unveils a completely-revamped [[iOS]] 7 at [[WWDC]].

=== May ===
* 30 May -- Apple quietly unveils a 16 GB version of the [[N78aAP|iPod touch (5th generation)]] that omits the rear camera, replacing the [[N81AP|iPod touch (4th generation)]].
* 2 May -- [[iOS]] 6.1.4 released for [[iPhone 5]].

=== April ===
* 13 April -- [[iFaith]] updated to version 1.5.8.
* 11 April -- [[Sn0wbreeze]] updated to version 2.9.14.
* 10 April -- [[iFaith]] updated to version 1.5.7.

=== March ===
* 10 March -- [[iFaith]] updated to version 1.5.6.
* 19 March -- Apple releases [[iOS]] 6.1.3 to patch multiple security-related bugs and improve Maps for Japanese users.
* 12 March -- [[evad3rs]] updated [[evasi0n]] to 1.5.3.
* 11 March -- [[evad3rs]] updated [[evasi0n]] to 1.5.2.
* 10 March -- [[iFaith]] updated to version 1.5.5.
* 5 March -- [[evad3rs]] updated [[evasi0n]] to 1.5.1.

=== February ===
* 23 February -- [[iFaith]] updated to version 1.5.4.
* 23 February -- [[evad3rs]] updated [[evasi0n]] to 1.5. [[iFaith]] updated to version 1.5.3.
* 19 February -- Apple releases [[iOS]] 6.1.2 as a hotfix to address Exchange issues. [[Evasi0n]] was updated to support iOS 6.1.2 later the same day.
* 13 February -- [[Seas0nPass]] updated to support [[iOS]] 5.2 for the [[K66AP|Apple TV (2nd generation)]] [[untethered jailbreak]].
* 11 February -- Apple releases [[iOS]] 6.1.1 for the [[N94AP|iPhone 4S]] as a hotfix to address connectivity issues. [[evasi0n]] was updated to support [[iOS]] 6.1.1 later the same day.
* 4 February -- The [[evad3rs]] release [[evasi0n]] to [[jailbreak]] [[iOS]] 6.x.

=== January ===
* 28 January -- Apple releases [[iOS]] 6.1.

== 2012 ==
=== December ===
* 18 December -- Apple releases [[iOS]] 6.0.2 containing bug fixes for the [[iPhone 5]] and [[iPad mini]].

=== November ===
* 30 November -- Apple releases [[iTunes]] 11.
* 12 November -- [[sn0wbreeze]] is updated to version 2.9.7.
* 2 November -- Inital release of [[iPad (4th generation)]] and [[iPad mini]] in first set of countries.
* 1 November -- Apple releases [[iOS]] 6.0.1.

=== October ===
* 23 October -- Apple announces new [[iPad (4th generation)]] and [[iPad mini]].
* 14 October -- The [[iPhone Dev Team]] releases [[redsn0w]] 0.9.15b1, which lets A5(X) users with the appropriate [[SHSH]] blobs remain on, or update to, [[iOS]] 5.x.

=== September ===
* 21 September -- Initial release of [[iPhone 5]] in first set of countries.
* 19 September -- Apple releases [[iOS]] 6.
* 12 September -- Apple announces new [[iPhone 5]] and release date of iOS 6.

=== June ===
* 18 June -- [[iPhone Dev Team]] releases a new version of [[redsn0w]] (0.9.14b1), adding the capability to downgrade iPhone [[N82AP|3G]]/[[N88AP|3GS]] [[Baseband]] from the [[06.15.00]] iPad baseband to the latest unlockable iPhone baseband ([[05.13.04]]). This allows 3G/3GS users that had upgraded to the iPad baseband, thus losing the GPS function and the ability to restore to stock firmware, to get back to an iPhone baseband, making their devices behave as intended again, as well as being unlockable by [[ultrasn0w]].
* 14 June -- [[iPhone Dev Team]] releases a developer version of [[redsn0w]] (0.9.13dev1), which jailbreaks [[limera1n]] susceptible devices running [[iOS]] 6.0 beta. This version doesn't hacktivate nor install [[Cydia]], as it hasn't been ported to [[iOS]] 6 just yet. This jailbreak, however, installs afc2 and SSH, enabling developers to fix and prepare their apps to the next [[iOS]] version.
* 11 June -- Apple announces [[iOS]] 6 at [[WWDC]] 2012, and seeds the first beta to developers.

=== May ===
* 25 May -- The [[Chronic Dev (team)|Chronic Dev Team]] releases [[Absinthe]] 2.0, providing an [[untethered jailbreak]] for all devices except the [[Apple TV]]s and [[K93AAP|iPad 2 (iPad2,4)]]. ([[Seas0nPass]] was also updated to include [[Absinthe]]'s [[untethered jailbreak|untether]] for the [[K66AP|Apple TV (2nd generation)]].)
* 7 May -- Apple releases [[iOS]] 5.1.1.

=== March ===
* 7 March -- Apple releases [[iOS]] 5.1 and announces new devices: [[iPad (3rd generation)]], [[J33AP|Apple TV (3rd generation)]], and the [[K93AAP|iPad 2 (iPad2,4)]].

=== January ===
* 20 January -- [[Absinthe]] was released to [[jailbreak]] and [[untethered jailbreak|untether]] the [[A5]] devices running [[iOS]] 5.0 and 5.0.1.
* 18 January -- Apple announces [[iBooks.app|iBooks version 2.0]].

== 2011 ==
=== December ===
* 30 December -- [[User:pod2g|pod2g]]'s [[untethered jailbreak|untether]] for [[iOS]] 4.4.4 makes its way into a new version of [[Seas0nPass]] for [[K66AP|Apple TV (2nd generation)]] owners.
* 27 December -- [[User:pod2g|pod2g]]'s [[untethered jailbreak|untether]] for [[iOS]] 5.0.1 is released in new versions of [[PwnageTool]] and [[redsn0w]], and as a Cydia package called [[Corona]] (by the [[Chronic Dev (team)|Chronic Dev Team]]) for devices already jailbroken on 5.0.1.
* 15 December -- Apple releases [[iOS]] 4.4.4 for the [[K66AP|Apple TV (2nd generation)]], as well as a minor update (5.0.1 build 9A406) for the [[N94AP|iPhone 4S]] to address SIM card issues.
* 4 December -- [[iFaith]] 1.4 is released, which can circumvent the [[APTicket]] [[nonce]] on devices vulnerable to [[limera1n]]'s exploit.

=== November ===
* 10 November -- [[iOS]] 5.0.1 is released in an attempt to fix battery-related issues. It's the first non-beta available as an [[OTA Updates|OTA update]].

=== October ===
* 14 October -- The [[N94AP|iPhone 4S]] is officially released, although some preorders were delivered early.
* 12 October -- [[iOS]] 5.0 is released. The [[N94AP|iPhone 4S]] IPSW came with [[04.11.08]] due to a goof on Apple's side.
* 5 October -- Steve Jobs passes away.
* 4 October -- Apple announces the new [[N94AP|iPhone 4S]].

=== September ===
* 19 September -- [[redsn0w]] 0.9.9 beta 1 is released, introducing a new UI and many features (like submitting [[SHSH]]s to the [[Cydia Server]].
* 17 September -- [[MyGreatFest]], first iCommunity and jailbreak centered convention was held.

=== July ===
* 15 July -- Apple releases [[iOS]] 4.2.9 and 4.3.4, patching all jailbreaking-related vulnerabilities (aside from those in the [[bootrom]]).
* 6 July -- [[User:Comex|comex]] releases [[Saffron]], the first public [[jailbreak]] for the [[iPad 2]].
* 2 July -- A beta version of the upcoming [[jailbreak]] from [[User:comex|comex]] for the [[iPad 2]], making use of a PDF exploit, was leaked. A hotfix by Apple is expected very soon.

=== June ===
* 1 June -- [[User:ih8sn0w|iH8sn0w]] releases [[iFaith]] to dump [[SHSH]] blobs from a device.

=== May ===
* 6 May -- [[PwnageTool]], [[redsn0w]], and [[sn0wbreeze]] are updated for [[iOS]] 4.3.3 support (and in the case of sn0wbreeze, [[iOS]] 4.2.8 support as well).
* 3 May -- Apple releases [[iOS]] 4.2.8 and 4.3.3 to address the location-tracking controversy. Once more, current [[untethered jailbreak|untethering]] vulnerabilities remained unpatched.

=== April ===
* 24 April -- [[PwnageTool]], [[redsn0w]], and [[sn0wbreeze]] are updated for [[iOS]] 4.3.2 support (and in the case of sn0wbreeze, [[iOS]] 4.2.7 support as well).
* 14 April -- Apple releases [[iOS]] 4.2.7 and 4.3.2 to fix security issues and connection issues for [[K95AP|iPad 2 (iPad2,3)]], but leaves [[untethered jailbreak|untethering]] vulnerabilities unpatched.
* 3 April -- All major jailbreak tools ([[redsn0w]], [[PwnageTool]], [[sn0wbreeze]]) get updated to includes [[i0n1c]]'s [[untethered jailbreak|untether]] code to jailbreak devices compatible with iOS 4.3.1 except the [[iPad 2]].

=== March ===
* 25 March -- Apple releases iOS 4.3.1, properly blocking [[User:comex|comex]]'s [[IOSurface Kernel Exploit|exploit]].
* 13 March -- [[User:Comex|comex]] shows a remotely jailbroken [[K95AP|iPad 2 (iPad2,3)]].
* 11 March -- Release of the [[iPad 2]] in the USA. The exploits for [[limera1n]] ([[User:Geohot|geohot]]), [[SHA-1 Image Segment Overflow|SHAtter]] ([[User:posixninja|p0sixninja]]), and [[comex]]'s [[kernel]] exploit were closed by Apple.
* 9 March -- Apple releases [[iOS]] 4.3, fixing the [[HFS Legacy Volume Name Stack Buffer Overflow]] vulnerability.

=== February ===
* 15 February -- New version of both [[PwnageTool]] and [[sn0wbreeze]] were released to support 4.2.1 and untethered using the [[feedface]] exploit.
* 7 February -- The [[Chronic Dev (team)|Chronic Dev Team]] release a version of [[greenpois0n (jailbreak)|greenpois0n]] to jailbreak the [[N92AP|iPhone 4 (iPhone3,3)]], using the [[HFS Legacy Volume Name Stack Buffer Overflow]].
* 3 February -- [[User:Jaywalker|Jaywalker]] of the [[Chronic Dev (team)|Chronic Dev Team]] posts [https://www.youtube.com/watch?v=T3NYPVT13xw a video] of custom boot using a soon to be released version of [[Greenpois0n (jailbreak)|greenpois0n]].

=== January ===
* 12 January -- Apple discontinues [[iOS]] support for [[N82AP|iPhone 3G]] and [[N72AP|iPod touch (2nd generation)]] since today's beta release of [[iOS]] 4.3. Also first time a beta [[iOS]] for [[K66AP|Apple TV (2nd generation)]] is released.
* 11 January -- Verizon announces [[N92AP|iPhone 4 (iPhone3,3)]].

== 2010 ==
=== November ===
* 28 November -- [[ultrasn0w]] 1.2 is released by the [[iPhone Dev Team]] to unlock [[N82AP|iPhone 3G]] and [[N88AP|iPhone 3GS]] on baseband 6.15.00
* 22 November -- Apple releases [[iOS]] 4.2.1 (respectively 4.2 for [[K66AP|Apple TV (2nd generation)]])

=== October ===
* 31 October -- The [[iPhone Dev Team|Dev Team]] releases [[redsn0w]] 0.9.6b2 which jailbreaks [[iOS]] 4.1, 4.2 and 3.2.2 on every device available at the time of release (except for iPod touch (2nd generation) MC). It also includes "DFU" button allowing to flash custom [[IPSW]] from Windows [http://blog.iphone-dev.org/post/1452044444/redsn0w-limera1n-fun (see blog post)].
* 20 October -- The [[iPhone Dev Team|Dev Team]] releases [[PwnageTool]] 4.1 which jailbreaks [[iOS]] 4.1 and 3.2.2 on every device available at the time of release. [http://blog.iphone-dev.org/post/1359246784/20102010-event (see blog post)]
* 18 October -- [[Chronic Dev (team)|Chronic Dev Team]] releases [[Greenpois0n (jailbreak)|greenpois0n]] RC4 which added support for iPod touch (2nd generation) (MC and MB) for an untethered jailbreak using [[User:comex|comex]]'s kernel exploit and the [[usb_control_msg(0xA1, 1) Exploit]].
* 12 October -- [[Chronic Dev (team)|Chronic Dev Team]] releases [[Greenpois0n (jailbreak)|greenpois0n]] after switching its exploit from [[SHA-1 Image Segment Overflow|SHAtter]] to [[limera1n]], in the hope that [[SHA-1 Image Segment Overflow|SHAtter]] remains for 5th generation devices. (The exploit [[limera1n]] uses was fixed in the [[iBoot (Bootloader)|iBoot]] revision found in [[iOS]] 4.2 beta 2, which means Apple knows about the vulnerability and the next [[bootrom]] revision may have it patched.)
* 10 October -- Following the first [[limera1n]] beta release, [[User:geohot|geohot]] released multiple versions, each fixing bugs affecting previous releases. [[Chronic Dev (team)|Chronic Dev Team]] officialy anounces that, in order to keep [[SHA-1 Image Segment Overflow|SHAtter]] undisclosed and possibly preserve it for 5th generation devices, [[Greenpois0n (jailbreak)|greenpois0n]] would be delayed in order to incorporate this new exploit [[limera1n]] uses.
* 9 October -- In order to push [[Chronic Dev (team)|Chronic Dev Team]] to change the exploit used on [[Greenpois0n (jailbreak)|greenpois0n]], [[User:geohot|geohot]] rushed out a beta version of [[limera1n]].
* 8 October -- [[User:Geohot|Geohot]] comes back to the scene with a new [[bootrom]] exploit believed to work on all devices, as shown on the resurrected [http://www.limera1n.com limera1n web site]. He prompts [[Chronic_Dev_(team)|Chronic Dev Team]] to use his exploit instead of [[SHA-1 Image Segment Overflow|SHAtter]], but, since [[Greenpois0n (jailbreak)|greenpois0n]] is already scheduled to October 10, it may be not possible. [[User:Geohot|Geohot]] ETA'd his [[limera1n]] release to October 11, if [[Greenpois0n (jailbreak)|greenpois0n]] can't be changed to use this new exploit. This decision, however, would burn 2 [[bootrom]] exploits: [[SHA-1 Image Segment Overflow|SHAtter]] itself and the one used by [[limera1n]], which is unpatchable by firmware updates.
* 6 October -- Chronic Dev Team issues expected ETA of [[Greenpois0n (jailbreak)|greenpois0n]] as October 10, featuring the new [[SHA-1 Image Segment Overflow|SHAtter]] exploit for devices with the [[S5L8930]].

=== September ===
* 30 September -- [[User:MuscleNerd|MuscleNerd]] of the [[iPhone Dev Team]] posts [http://www.youtube.com/watch?v=adVp-IxcDHI the first video] of an [[K66AP|Apple TV (2nd generation)]] jailbroken via [[SHA-1 Image Segment Overflow|SHAtter]].
* 27 September -- [[User:MuscleNerd|MuscleNerd]] of the [[iPhone Dev Team]] posts [http://www.youtube.com/watch?v=aoX1Q8ym2J8 the first video] of an [[N81AP|iPod touch (4th generation)]] jailbroken via [[SHA-1 Image Segment Overflow|SHAtter]].
* 20 September -- [[User:pod2g|pod2g]] discloses details about the [[usb_control_msg(0xA1, 1) Exploit‎]] here at The iPhone Wiki. It was used in [[redsn0w]] the following day.
* 9 September -- The existence of [[SHA-1 Image Segment Overflow|SHAtter]] is revealed. Further details were not released, however.
* 8 September -- Apple releases the [[N81AP|iPod touch (4th generation)]], and iOS 4.1, closing the [[AT+XAPP Vulnerability]].
* 1 September -- Apple event. They announced the new [[N81AP|iPod touch (4th generation)]], [[K66AP|Apple TV (2nd generation)]], iOS 4.1, and [[iTunes]] 10.

=== August ===
* 12 August -- [[Saurik]] releases the first version of PDF Patcher, which installs Apple's patch for the FreeType vulnerability (used in conjunction with other exploits by [[Star]]). It works on firmwares as far back as 2.x, and renders [[iOS]] 3.2.2 and 4.0.2 useless for jailbreakers. Jailbreaking and installing this patch is currently the only way for users of first generation iPod touches and iPhones to protect themselves against malicious use of the exploit.
* 11 August -- Apple releases [[iOS]] 4.0.2 for [[List of iPhones|iPhone]]/[[List of iPod touches|iPod touch]] and [[iOS|iPhone OS]] 3.2.2 for [[K48AP|iPad]] as a hotfix for [[Star]]'s exploits. [[Ultrasn0w]]'s exploit remains, since there's no [[Baseband Firmware|baseband]] update on those versions.
* 3 August -- Just before midnight in [[User:planetbeing|planetbeing]]'s timezone [[ultrasn0w]] has been released by the [[iPhone Dev Team]] to [[unlock]] the [[N90AP|iPhone 4]].
* 1 August -- [[User:Comex|comex]] releases [[Star]], a [[jailbreak]] for all iDevices with [[iOS|iPhone OS]] 3.1.2 through [[iOS]] 4.0.1.

=== July ===
* 30 July -- [[N90AP|iPhone 4]] is released in major countries (second wave).
* 26 July -- Jailbreaking is now officially legal in the U.S.A.: [http://www.eff.org/press/archives/2010/07/26 EFF Wins New Legal Protections for Cell Phone Jailbreakers and Unlockers]
* 15 July -- Apple releases [[iOS|iPhone OS]] 3.2.1 and [[iOS]] 4.0.1.

=== June ===
* 24 June -- [[N90AP|iPhone 4]] is launched.
* 22 June -- [[iPhone Dev Team]] releases [[PwnageTool]] 4.0 and later 4.0.1 for all devices on 4.0 except those with newer [[bootrom]]s (some [[N72AP|iPod touch (2nd generation)]] and [[N88AP|iPhone 3GS]] devices, and all [[N18AP|iPod touch (3rd generation)]] and newer devices).
* 21 June -- [[iPhone Dev Team]] releases [[redsn0w]] 0.9.5 to [[jailbreak]] 4.0 on [[N82AP|iPhone 3G]] and [[N72AP|iPhone touch (2nd generation)]] ([[Bootrom 240.4|old bootrom]]), [[iPhone Dev Team]] releases [[ultrasn0w]] 0.93, an unlock for baseband firmwares [[04.26.08]], [[05.11.07]], [[05.12.01]], and [[05.13.04]] and Apple releases [[iOS]] 4.0
* 19 June -- [[User:Geohot|geohot]] holds a speech at the [[Nuit du hack 2010|Nuit du Hack]]

=== May ===
* 3 May -- Windows version of [[Spirit]] has been updated to not require Windows 98 compatibility mode to run and fixed a photo deletion issue.
* 2 May -- [[User:Comex|comex]] releases [[Spirit]], an [[untethered jailbreak]] for all iDevices with [[iOS|iPhone OS]] 3.1.2 through 3.2.

=== April ===
* 3 April -- Apple releases the [[K48AP|iPad]].

=== February ===
* 12 February -- [[User:sherif hashim|sherif_hashim]] discovers [[AT+XAPP Vulnerability]] and passes it to [[User:MuscleNerd|MuscleNerd]], an elite member of the [[iPhone Dev Team]]
* 2 February -- Apple releases [[iOS|iPhone OS]] 3.1.3, closing [[usb_control_msg(0x21, 2) Exploit|usb_control_msg(0x21, 2)]] vulnerability used by [[blackra1n]], [[redsn0w]], et. al.

== 2009 ==
=== November ===
* 3 November -- [[User:Geohot|geohot]] releases [[blackra1n]] RC3, a software jailbreak for all devices. Includes a new unlock for baseband [[05.11.07]] called [[blacksn0w]] and is also noticeably faster than previous versions.

=== October ===
* 11 October -- [[User:Geohot|geohot]] releases [[blackra1n]] RC1, a 30 second software jailbreak for all devices, including a [[tethered jailbreak]] for the [[N18AP|iPod touch (3rd generation)]], and [[N88AP|iPhone 3GS]] and [[N72AP|iPod touch (2nd generation)]] units with newer bootrom revisions.

=== September ===
* 24 September -- [[User:iH8sn0w|iH8sn0w]] discovers the [[AT+XEMN Heap Overflow|AT+XEMN]] crash independently.
* 9 September -- The [[N18AP|iPod touch (3rd generation)]] with [[S5L8922]] processor is released. [[N72AP|iPod touch (2nd generation)]] and [[N88AP|iPhone 3GS]] units continue shipping, but with a new bootrom ([[Bootrom 240.5.1|240.5.1]] and [[Bootrom 359.3.2|359.3.2]] respectively) that is no longer vulnerable to the [[0x24000 Segment Overflow]].
* 9 September -- Apple releases [[iOS|iPhone OS]] 3.1 (7C144) for iPhones and 3.1.1 (7C145) for iPod touches, closing the [[iBoot Environment Variable Overflow]] and [[AT+XLOG Vulnerability|AT+XLOG]] + [[AT+FNS]] Baseband Exploits.

=== July ===
* 14 July -- [[User:Geohot|geohot]] releases [[purplesn0w]], a software unlock for the [[X-Gold 608]] using [[AT+XLOG Vulnerability|the same exploit as ultrasn0w]], but handled differently. Minutes later, an explanation and source code was posted.
* 7 July -- The [[iPhone Dev Team]] updates [[redsn0w]] and [[ultrasn0w]] to version 0.8, now with [[N88AP|iPhone 3GS]] support. Saurik also updates [[WinterBoard]] to support the [[N88AP|iPhone 3GS]].
* 3 July -- [[User:Geohot|geohot]] releases [[purplera1n]], a software [[jailbreak]] for the [[N88AP|iPhone 3GS]].

=== June ===
* 28 June -- [[User:Geohot|geohot]] posts pictures on his blog of the first fully jailbroken [[N88AP|iPhone 3GS]].
* 25 June -- It's discovered that [[N88AP|iPhone 3GS]] is vulnerable to the [[0x24000 Segment Overflow]].
* 24 June -- The [[iPhone Dev Team]] releases [[ultrasn0w]], an [[unlock]] for [[X-Gold 608]] thanks to [[AT+XLOG Vulnerability|a new exploit]] discovered by [[User:Oranav|Oranav]].
* 23 June -- [[User:Geohot|geohot]] announces he's found a new exploit in [[iBoot (Bootloader)|iBoot]] he calls [[purplera1n]].
* 19 June -- Release of [[N88AP|iPhone 3GS]] to the public and the release of [[PwnageTool]] 3.0 and [[redsn0w]] for jailbreaking devices running [[iOS|iPhone OS]] 3.0
* 17 June -- Apple releases [[iOS|iPhone OS]] 3.0.
* 8 June -- Apple announces the [[N88AP|iPhone 3GS]].

=== March ===
* 10 March -- Information about the [[0x24000 Segment Overflow]] exploit used for the [[N72AP|iPod touch (2nd generation)]] [[untethered jailbreak]] is released thanks to the combined work of [[chronic]], [[CPICH]], [[User:Posixninja|posixninja]], [[User:Pod2g|pod2g]], [[ius]], [[planetbeing]], [[User:MuscleNerd|MuscleNerd]], and co. after being leaked and sold by [[NitroKey]]. To prevent users wasting their money on a stolen exploit, the Hybrid DevTeam decided to release it immediately.

=== January ===
* 31 January -- The [[iPhone Dev Team]] released [[redsn0w Lite]], a [[tethered jailbreak|tethered]] [[N72AP|iPod touch (2nd generation)]] [[jailbreak]]. It combines the [[ARM7 Go]] vulnerability with the well-established [[pwnage]] flow for other Apple mobile devices. It was bundled in a way that allowed usage on [[iOS|iPhone OS]] 2.2.1 by uploading [[iBoot (Bootloader)|iBoot]] from [[iOS|iPhone OS]] 2.1.1, which is vulnerable to [[ARM7 Go]], to the device while in [[DFU Mode]].
* 29 January -- Apple releases [[iOS|iPhone OS]] 2.2.1, closing the [[AT+stkprof]] exploit.
* 25 January -- [[0wnboot]] is released to [http://code.google.com/p/chronicdev/ chronicdev google code page], thanks to [[AriX]], [[User:ChronicDev|chronic]], [[CPICH]], [[westbaer]], [[ius]], [[User:Pod2g|pod2g]], the rest of the iPod devel crew on IRC, and to the #iphone-hax lab rats. Within days, [[AriX]] and the [[Chronic Dev (team)|Chronic Dev Team]] got a ramdisk booting for a [[tethered jailbreak]].
* 17 January -- [[User:MuscleNerd|MuscleNerd]] of the [[iPhone Dev Team]] [https://twitter.com/MuscleNerd/status/1127346766 shows a video demo] of the first jailbroken [[N72AP|iPod touch (2nd generation)]].
* 16 January -- [[ARM7 Go]] vulnerability disclosed where else but here on The iPhone Wiki, for developers to poke and prod at.
* 15 January -- The [[iPhone Dev Team]] [https://twitter.com/iphone_dev/status/1120595069 tweets the VFDecrypt key] for [[iOS|iPhone OS]] 2.2 on [[N72AP|iPod touch (2nd generation)]], demonstrating for the first time that unsigned code can now be run on that device.
* 1 January -- The [[iPhone Dev Team]] releases [[yellowsn0w]] 0.9 beta for baseband [[02.28.00]].

== 2008 ==
=== December ===
* 27 December -- [[25C3 presentation "Hacking the iPhone"]]
* 21 December -- [[User:MuscleNerd|MuscleNerd]], of the [[iPhone Dev Team]] does a live demo of the 3G unlock, dubbed as [[yellowsn0w]]: http://qik.com/video/729275

=== November ===
* 21 November -- Apple releases [[iOS|iPhone OS]] 2.2.

=== September ===
* 9 September -- Apple releases [[iOS|iPhone OS]] 2.1. [[N72AP|iPod touch (2nd generation)]], which no longer had the [[Pwnage 2.0]] exploit, is revealed.

=== August ===
* 18 August -- Apple releases [[iOS|iPhone OS]] 2.0.2. [[iPhone Dev Team]] releases [http://wikee.iphwn.org/news:pwnage20announcement QuickPwn], a 2.x [[pwnage]]/ramdisk combination exploit that allows jailbreaking without needing to create custom IPSWs.
* 4 August -- Apple releases [[iOS|iPhone OS]] 2.0.1.

=== July ===
* 22 July -- [[TA_Mobile]] hardware dumps the 3G baseband (bootloader 5.8 & FW 1.45.00) by desoldering the [[NOR]].
* 19 July -- [[iPhone Dev Team]] releases [[PwnageTool]] 2.0, jailbreaking and unlocking the 2.0 software on the [[M68AP|iPhone]] and jailbreaking [[iOS|iPhone OS]] 2.0 on the [[N82AP|iPhone 3G]] and [[N45AP|iPod touch]].
* 15 July -- Apple releases [[iOS|iPhone OS]] 1.1.5 for the [[N45AP|iPod touch]].
* 11 July -- [[N82AP|iPhone 3G]] is released. Apple also releases [[iOS|iPhone OS]] 2.0 and MobileMe on the same date, resulting in server issues.

=== June ===
* 9 June - [[N82AP|iPhone 3G]] is announced at [[WWDC]] '08.

=== April ===
* 3 April -- [[iPhone Dev Team]] releases [[PwnageTool]] 1.0, making use of the [[pmdx exploit]] (to patch RSA checks out of the [[kernel]], to write unsigned to [[NOR]])

=== March ===
* 12 March -- [[iPhone Dev Team]] releases dual-boot jailbreak method, only to be silently fixed in 2.0.
* 4 March -- [[User:n0b|George Zhu (n000b)]] releases [[iLiberty+|iLiberty / iLiberty+]].

=== February ===
* 28 February -- [[Cydia Application|Cydia]] is released as an open-source alternative to [[Installer.app]], and prepares to take over the jailbreak application scene upon 2.0's release.
* 26 February -- Apple releases [[iOS|iPhone OS]] 1.1.4.
* 11 February -- [[User:Zibri|Zibri]] leaks the [[Ramdisk Hack]] in [[ZiPhone]], the first all-in-one unlock, activate, jailbreak solution.
* 8 February -- [[User:Geohot|geohot]] releases software unlock for 4.6. Apple states 25% of phones were never activated with AT&T.

=== January ===
* 28 January -- [[iPhone Dev Team]] releases [[Soft Upgrade]] jailbreak for 1.1.3.
* 24 January -- [[Nate True]] releases a version of [[iBrickr]] that used the [[Soft Upgrade]] method to jailbreak 1.1.3.
* 18 January -- [[User:Geohot|Geohot]] and his friends [http://iphonejtag.blogspot.com/2008/01/112-otb-unlocked.html unlocked 1.1.2 OTB 4.6 by test point], the unbeatable version at that time.
* 18 January -- [[iPhone Dev Team]] posts YouTube video of a jailbroken 1.1.3, which was made possible by the dual boot jailbreak from [[bgm]].
* 15 January -- Apple releases [[iOS|iPhone OS]] 1.1.3, closing the [[mknod]] exploit. In addition, everything now runs as "mobile" instead of "root."

== 2007 ==
=== November ===
* 15 November -- [[Baseband Bootloader|Baseband bootloader]] 4.6 is found on new [[M68AP|iPhone]] devices, which initially had no [[unlock]].
* 12 November -- Apple releases [[iOS|iPhone OS]] 1.1.2, closing the [[LibTiff]] and [[Symlinks]] exploits.
* 2 November -- [[JailbreakMe|AppSnapp]] is released, bringing jailbreaking to the mainstream iPhone user.

=== October ===
* 23 October -- iPhone-Elite Team releases the [[Virginizer]].
* 14 October -- [[User:AriX|AriX]] releases iJailBreak, the first automated [[N45AP|iPod touch]] jailbreak for the Mac.
* 12 October -- [[User:planetbeing|planetbeing]] releases [[touchFree]], the first automated [[N45AP|iPod touch]] [[jailbreak]].
* 10 October -- [[cmw]] (aka Niacin) and Dre release the LibTiff exploit to jailbreak the [[N45AP|iPod touch]], which is later adapted for use in [[JailbreakMe|AppSnapp]].

=== September ===
* 27 September -- Apple releases [[iOS|iPhone OS]] 1.1.1.
* 11 September -- [[iPhone Dev Team]] releases [[iUnlock]], first free software unlock.
* 10 September -- [[IPSF]] releases first paid software unlock.
* 9 September -- Apple announces the [[N45AP|iPod touch]] at a media event.

=== August ===
* 23 August -- [[User:Geohot|geohot]] and team release [[hardware unlock]] method.
* 21 August -- [[Installer.app]] is released by Nullriver, first GUI apps are distributed.

=== July ===
* 23 July -- First phones are used with other carriers by means of [[SIM hacks]].
* 20 July -- nightwatch adapts a [[toolchain]] to the iPhone. The first apps are compiled.
* 9 July -- [[iPhone Dev Team]] releases a [[jailbreak]] method. The first use of this is ringtones.
* 3 July -- DVD Jon first cracks [[activation]]. People can use the apps on the phone without a subscription.

=== June ===
* 29 June -- [[M68AP|iPhone]] is released. World's most hyped consumer product.
* 26 June -- The [[iPhone Dev Team]] was formed.

=== January ===
* 9 January -- [[M68AP|iPhone]] is announced on stage by Steve Jobs.

TigrisAni 15A783601y

2018-04-07T05:25:44Z

3xpl0itz: TigrisAni 15A783601y

{{internal software|firmware}}
[[File:IphX_15A783601y.jpg|thumb|right|500px|iPhone X prototype running 15A783601y]]
== Background ==
This firmware is an internal NonUI build of iOS 11.0. While a seemingly earlier version of [[TigrisAni 15A93261h]], this firmware is one of the first to be seen running on an [[iPhone X]] prototype. It is also not too well optimized for the phone's new screen, notch, and rounded corners, with parts of the screen being cut off towards the edges.

== Applications ==
Upon booting into [[SwitchBoard.app]], the following apps are visible:
*[[AltoMobile]]
*[[ExtendedOQC]]
*[[GrapeCal]]
*[[GrapeCal_Lite]]
*[[NonUIConsoleViewer]]
*[[OrbCal]]
*[[Reliability]]
*[[Sequencer]]
*[[Spelunx]]
*[[Stencil]]
*[[USBHost]]
*[[WiPASmini]]

File:IphX 15A783601y.jpg

2018-04-07T05:24:00Z

3xpl0itz:

TigrisAni 15A93261h

2018-04-07T05:22:16Z

3xpl0itz: Alphabetical order

{{internal software|firmware}}
== Background ==
This firmware is an internal NonUI version of iOS 11.0. It has been seen on various iPhone 8 prototype units. Similarly to other recent builds, this one has a rather large filesize - a dump of its filesystem is around 9.1 GB.

Interestingly, this build contains kernels for Apple A7 to A11 processors, including differfent processor varieties. This has previously not been the case since iOS version 7.0. It also appears to support an unreleased processor type known as t8020. Based on previous NonUI firmwares having support for as of then unreleased processors - it's safe to assume that this processor is most likely the Apple A12 or A11X.
[[File:Iph8_15A93261h.jpg|thumb|right|iPhone 8 prototype running 15A93261h]]

== Notable Changes ==

This build is known to have various differences compared to previous builds, which will be listed here.

* '''[[T500AP]] and [[T501AP]]''' - Wi-Fi drivers for these unknown board identifiers can be found in <code>/AppleInternal/Diags/WifiFirmware/</code> alongside the iPhone 8 ([[D20AP]]) and iPhone 8 Plus ([[D21AP]]).

* '''mach.kasan''' - apart from the usual mach.development.{Processor Name / Identifier} files found within NonUI builds - this build contains a new type of file - known as mach.kasan. It is currently unknown what the purpose of this new filetype is, since it has not been encountered in previous firmwares.

* '''Tailspin / Ariadne''' - A readme file located within /AppleInternal/tailspin references a previously unheard of application known as Ariadne, as well as "tailspin" files. The readme states that "tailspin holds onto 20-30 seconds of historical spindump and Ariadne data, from before the sysdiagnose invocation." The Ariadne application appears to be used for the visualization of these tailspin files.

* '''Firmware references''' - In the same readme - two iOS firmwares are referenced - Tigris 15A221 (an apparent version of iOS 11.0) and [[Lobo 17A202]]. Judging by the build number of the latter firmware compared to the standard build number scheme - it seems that this is a future version of iOS that has yet to be released, being newer than iOS 11.

* '''Test scripts''' - Located in AppleInternal/CoreOS/AppleSEP/unit_tests/hilo, these test scripts seem to communicate with the [[Secure Enclave]]. The scripts are written to only work on [[D22AP]], the [[iPhone X]], meaning that they may be used to test various sensors in the [[TrueDepth]] sensor housing. They contain multiple references to a display module with the codename '''[[Hilo]]'''.

== Applications ==
This firmware contains many applications launchable from [[SwitchBoard.app]], however roughly half of them are hidden by default:
* [[AltoMobile]]
* [[CoexBlender]] (hidden)
* [[ExtendedOQC]]
* [[FactoryStencil]]
* [[GrapeCal]]
* [[GrapeCal_Lite]]
* [[LCDMura]] (hidden)
* [[LcdUTest]] (hidden)
* [[MesaCal]]
* [[Ness]] (hidden)
* [[NonUIQRCode]] (hidden)
* [[NonUIConsoleViewer]]
* [[Operator]] (hidden)
* [[OrbCal]]
* [[Pippi]] (hidden)
* [[Reliability]]
* [[Reliability]] (again) (hidden)
* [[Sequencer]]
* [[Spelunx]]
* [[ThermalDOE]] (hidden)
* [[USBHost]]
* [[WiPASmini]]

Sochi 11D31620l

2018-04-07T05:05:35Z

3xpl0itz: added warning

{{internal software|firmware}}
[[File:iphone5c11d31620l.jpg|thumb|right|[[iPhone 5c]] prototype running 11D31620l]]
== Background ==
The following NonUI firmware is based off of an internal version of iOS 7.1. It was originally found on an [[iPhone 5c]] prototype.
== Applications ==
Upon booting, [[SwitchBoard.app]] lets you choose from the following applications:
*[[dtxCaliente]]
*[[GrapeCal]]
*[[NonUIConsoleViewer]]
*[[Operator]]
*[[QRCode]]
*[[Reliability]]
*[[ThermalDOE]]
*[[WiPASmini]]

NonUI builds

2018-04-04T14:15:12Z

3xpl0itz:

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging. {{clear}}
[[File:newsblogo.png|thumb|125px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|125px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|125px|right|Prototype showing Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|125px|left|Prototype showing Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allow launching a GUI of some of those applications. Unlike production iOS firmwares, factory ones have the following differences :
* DEVELOPMENT Fused bootloaders in \Firmware\dfu\ and \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* DEVELOPMENT Fused kernel cache with more symbols, and with individual kexts in /System/Library/Extensions
* Skankwerk (gear) logo image file in \Firmware\all_flash\all_flash.[board codename].factoryfa\.
* /AppleInternal folder, which the hierarchy inside get priority over hierarchy in /.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* /usr and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed - as dropbear
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable AMFI
* It has some Private Frameworks in /System/Library/PrivateFrameworks for internal GUI apps and command line utilities.
* Most internal applications require the use of SkankKit to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed both IPSWs and "restore bundles". Those are unzipped IPSW files which can be restored on devices using an internal restore software such as [[PurpleRestore]]. Release and factory firmwares "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].

== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="3" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| rowspan="2" | 1.1.3
| [[Alpine 4A102a|4A102a]]
| Alpine
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| Apex?
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 1.0.10
| -
|-
| 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| Sochi?
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| InnsbruckNanshan
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| Okemo?
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| OkemoAni
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| OkemoAni
| 1.00.05
| -
|-
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93051l|13A93051l]]
| Monarch?
| 0.37.08
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| Monarch?
| 1.00.05
| -
|-
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| Whitetail?
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| WhitetailAni
| ?
| -
|-
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| ?
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
| Version
| Build
| Codename
| Baseband
| Comments
|-
| 11.0
| [[TigrisAni 15A783601y|15A783601y]]
| TigrisAni?
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| Wildcat?
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango?
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| SundanceTaosTianshan
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| Inferno?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| ?
| -
|}

[[Category:Firmware]]