The iPhone Wiki - User contributions [en]

TYPE

2020-08-22T08:07:15Z

B1n4r1b01:

The '''TYPE''' tag is a 32-bit unsigned integer (<code>uint32_t</code>) that, when viewed in little-endian format, states the type of firmware image the IMG2/[[IMG3 File Format|IMG3]]/[[IMG4 File Format|IMG4/IM4P]] file is. This value is passed to <code>load_selected_image</code> and then <code>[[Image load|image_load]]</code> early in the [[BootROM|SecureROM]] boot process, where a non-NULL pointer check is performed.

== Types ==
=== IMG2 ===
{|class="wikitable"
! Name
! Type
|-
| [[AppleLogo]]
| logo
|-
| [[BatteryCharging]]
| batC
|-
| [[BatteryLow0]]
| batl
|-
| [[BatteryLow1]]
| batL
|-
| [[DeviceTree]]
| dtre
|-
| [[iBoot (Bootloader)|iBoot]]
| ibot
|-
| [[LLB]]
| llbz
|-
| [[NeedService]]
| nsrv
|-
| [[RecoveryMode]]
| recm
|-
|}

=== IMG3+ ===
{|class="wikitable"
! Name
! Type
! Notes
|-
| Any
| <code>0x00</code>
| Represents ''any'' image type
|-
| ACIBT
| acib
| ACI Bluetooth
|-
| ACIWIFI
| aciw
| ACI WiFi
|-
| Alamo
| almo
|-
| ANE Firmware
| anef
|-
| AOP
| aopf
|-
| [[AppleLogo]]
| logo
|-
| Audio Codec Firmware
| acfw
|-
| AVE Firmware
| avef
|-
| [[BatteryCharging0]]
| chg0
| Charging indicator (bright)
|-
| [[BatteryCharging1]]
| chg1
| Charging Indicator (dim)
|-
| [[BatteryFull]]
| batF
|-
| [[BatteryLow0]]
| bat0
| Empty battery
|-
| [[BatteryLow1]]
| bat1
| Red composed onto empty battery
|-
| CFELoader
| cfel
| Silicon Validation <ref>[https://www.linkedin.com/jobs/view/silicon-validation-test-and-triage-engineer-at-apple-543262317 Job listing on LinkedIn]</ref> CFE loader
|-
| [[Dali]]
| dali
|-
| [[DeviceTree]]
| dtre
|-
| Diags
| diag
|-
| EngineeringTrustCache
| dtrs
|-
| Environment Variables
| ienv
|-
| FDR Trust Object for AP
| fdrt
|-
| FDR Trust Object for SEP
| fdrs
|-
| [[GlyphCharging]]
| glyC
|-
| [[GlyphPlugin]]
| glyP
|-
| GPU Firmware
| gfxf
|-
| Homer
| homr
|-
| Hypervisor
| hypr
|-
| [[iBEC]]
| ibec
|-
| [[iBoot (Bootloader)|iBoot]]
| ibot
|-
| iBootTest
| itst
|-
| [[iBSS]]
| ibss
|-
| Input Device
| ipdf
|-
| iSpoof(?)
| ispf
|-
| [[Kernelcache|KernelCache]]
| krnl
|-
| LeapHaptics
| lphp
|-
| [[LLB]]
| illb
|-
| LoadableTrustCache
| ltrs
|-
| LowPowerWallet0
| lpw0
|-
| LowPowerWallet1
| lpw1
|-
| LowPowerWallet2
| lpw2
|-
| Mac EFI
| mefi
|-
| [[Maggie Firmware]]
| magg
|-
| Multitouch Firmware
| mtfw
|-
| [[NeedService]]
| nsrv
|-
| OSRamdisk
| osrd
|-
| PEHammer
| hmmr
| [[PE]] Hammer test
|-
| PersonalizedDMG
| pdmg
|-
| PERTOS
| pert
| [[PE]] [https://en.wikipedia.org/wiki/Real-time_operating_system RTOS] environment
|-
| PHLEET
| phlt
| Silicon Validation PHLEET test
|-
| PMP
| pmpf
|-
| [[Restore Ramdisk|RestoreRamDisk]]
| rdsk
|-
| RBM
| rbmt
| Silicon Validation RBM test
|-
| [[RecoveryMode]]
| recm
|-
| RestoreDeviceTree
| rdtr
|-
| RestoreKernelCache
| rkrn
|-
| RestoreLogo
| rlgo
|-
| RestoreOS
| rosi
|-
| RestoreSEP
| rsep
| rsep is also present in [[sepboot]]
|-
| RestoreTrustCache
| rtsc
|-
| RTP
| rtpf
|-
| SCE
| scef
|-
| [[Secure Enclave Processor|SEP]]
| sepi
|-
| SmartIOFirmware
| siof
|-
| StaticTrustCache
| trst
|-
| System Locker
| lckr
|-
| TSYS Tester
| tsys
|-
| WCHFirmwareUpdater
| wchf
|-
| Wireless Charging
| wchf
|-
| Boot Chime
| aubt
|-
| Accessibility Chime
| auac
|-
| Attach Chime
| aupr
|-
| Aux Kernel Cache
| auxk
|-
| Base System Trust Cache
| bstc
|-
| x86 Base System Trust Cache
| xbtc
|-
| Base System Volume Root Hash
| csys
|-
| System Volume Root Hash
| isys
|-
| x86 System Volume Root hash
| xsys
|-
| System Volume Canonical Metadata
| msys
| Compressed gzip file
|-
| x86 System Volume Canonical Metadata
| xsys
| Compressed gzip file
|-
| Unknowns
| ibdt, ansf (ANS (Storage Controller) Firmware?), rans, ciof, dcpf, tmuf, rpmp, lpol, rtmu, rcio, rdcp, nsrv
|-
|}

== References ==
<references />

{{stub|firmware}}
[[Category:Firmware Tags]]

Firmware/iPad/12.x/64-bit Touch ID

2019-04-27T05:04:41Z

B1n4r1b01: IPSW download link was wrong

== [[{{{Device}}}]] ==

{| class="wikitable"
|-
! Version
! Build
! Keys
! Baseband
! Release Date
! Download URL
! SHA1 Hash
! File Size
! Release Notes
|-
| 12.0
| 16A366
| {{#switch: {{{Device}}}
| iPad Air 2 = [[Peace 16A366 (iPad5,3)|iPad5,3]] [[Peace 16A366 (iPad5,4)|iPad5,4]]
| iPad mini 3 = [[Peace 16A366 (iPad4,7)|iPad4,7]] [[Peace 16A366 (iPad4,8)|iPad4,8]] [[Peace 16A366 (iPad4,9)|iPad4,9]]
| iPad mini 4 = [[Peace 16A366 (iPad5,1)|iPad5,1]] [[Peace 16A366 (iPad5,2)|iPad5,2]]
| #default = {{n/a}}
}}
| rowspan=" {{#switch: {{{Device}}}
| iPad (5th generation)
| iPad Air 2
| iPad mini 4 = 2" {{!}} [[7.10.00]]
| iPad mini 3 = 3" {{!}} [[10.10.00]]
| #default = 2" {{!}} ???
}}
| {{date|2018|09|17}}
| [http://updates-http.cdn-apple.com/2018FallFCS/fullrestores/091-63139/11A3DDE8-AC8E-11E8-BBBB-EAD81D048BD9/iPad_64bit_TouchID_12.0_16A366_Restore.ipsw iPad_64bit_TouchID_12.0_16A366_Restore.ipsw]
| <code>157f67a10333c3434d15fa56675cd12777f32cc3</code>
| 2,982,067,310
| [http://updates-http.cdn-apple.com/2018/ios/041-03381-20180917-F0261CD4-A1A3-11E8-9C02-DC65A8E628A4/iPadiTunesUpdateReadMe.ipd iPadiTunesUpdateReadMe.ipd]
|-
| 12.0.1
| 16A404
| {{#switch: {{{Device}}}
| iPad Air 2 = [[Peace 16A404 (iPad5,3)|iPad5,3]] [[Peace 16A404 (iPad5,4)|iPad5,4]]
| iPad mini 3 = [[Peace 16A404 (iPad4,7)|iPad4,7]] [[Peace 16A404 (iPad4,8)|iPad4,8]] [[Peace 16A404 (iPad4,9)|iPad4,9]]
| iPad mini 4 = [[Peace 16A404 (iPad5,1)|iPad5,1]] [[Peace 16A404 (iPad5,2)|iPad5,2]]
| #default = {{n/a}}
}}
| {{date|2018|10|08}}
| [http://updates-http.cdn-apple.com/2018FallFCS/fullrestores/041-09127/3499B672-C5EA-11E8-9ADF-FBD1650D5FA9/iPad_64bit_TouchID_12.0.1_16A404_Restore.ipsw iPad_64bit_TouchID_12.0.1_16A404_Restore.ipsw]
| <code>58b1c50d147a27c51035169539edf046e16680e2</code>
| 2,985,322,495
| [http://updates-http.cdn-apple.com/2018/ios/041-10189-20181002-8ACD31AA-B88D-11E8-9314-772827DBE7A5/iPadiTunesUpdateReadMe.ipd iPadiTunesUpdateReadMe.ipd]
|-
| 12.1
| 16B92
| {{#switch: {{{Device}}}
| iPad Air 2 = [[PeaceB 16B92 (iPad5,3)|iPad5,3]] [[PeaceB 16B92 (iPad5,4)|iPad5,4]]
| iPad mini 3 = [[PeaceB 16B92 (iPad4,7)|iPad4,7]] [[PeaceB 16B92 (iPad4,8)|iPad4,8]] [[PeaceB 16B92 (iPad4,9)|iPad4,9]]
| iPad mini 4 = [[PeaceB 16B92 (iPad5,1)|iPad5,1]] [[PeaceB 16B92 (iPad5,2)|iPad5,2]]
| #default = {{n/a}}
}}
{{#switch: {{{Device}}}
| iPad (5th generation)
| iPad Air 2
| iPad mini 4 = {{!}} [[7.21.00]]
| iPad mini 3 =
| #default = {{!}} ???
}}
| {{date|2018|10|30}}
| [http://updates-http.cdn-apple.com/2018FallFCS/fullrestores/091-91204/9644F6F6-D4BE-11E8-B2A8-BE034DD5AD4E/iPad_64bit_TouchID_12.1_16B92_Restore.ipsw iPad_64bit_TouchID_12.1_16B92_Restore.ipsw]
| <code>c5418bad6baf9e555dca77d822c7e1002cd9a8ff</code>
| 2,984,692,367
| [http://updates-http.cdn-apple.com/2018/ios/041-17986-20181030-C94D8AA6-D89F-11E8-9E49-AAA0F34A5CAA/iPadiTunesUpdateReadMe.ipd iPadiTunesUpdateReadMe.ipd]
|-
| 12.1.1
| 16C50
| {{#switch: {{{Device}}}
| iPad Air 2 = [[PeaceC 16C50 (iPad5,3)|iPad5,3]] [[PeaceC 16C50 (iPad5,4)|iPad5,4]]
| iPad mini 3 = [[PeaceC 16C50 (iPad4,7)|iPad4,7]] [[PeaceC 16C50 (iPad4,8)|iPad4,8]] [[PeaceC 16C50 (iPad4,9)|iPad4,9]]
| iPad mini 4 = [[PeaceC 16C50 (iPad5,1)|iPad5,1]] [[PeaceC 16C50 (iPad5,2)|iPad5,2]]
| #default = {{n/a}}
}}
| rowspan="3" | {{#switch: {{{Device}}}
| iPad (5th generation)
| iPad Air 2
| iPad mini 4 = [[7.32.00]]
| iPad mini 3 = [[10.31.00]]
| #default = ???
}}
| {{date|2018|12|05}}
| [http://updates-http.cdn-apple.com/2018FallFCS/fullrestores/041-05405/58649D82-E9F9-11E8-85B7-B10B1FCDB2CE/iPad_64bit_TouchID_12.1.1_16C50_Restore.ipsw iPad_64bit_TouchID_12.1.1_16C50_Restore.ipsw]
| <code>3e8128a478e2845db476152b489830300db4dc1d</code>
| 2,990,664,092
| [http://updates-http.cdn-apple.com/2018/ios/041-25767-20181205-1F5DDE04-F4CB-11E8-AF51-2207828CC72D/iPadiTunesUpdateReadMe.ipd iPadiTunesUpdateReadMe.ipd]
|-
| 12.1.3
| 16D39
| {{#switch: {{{Device}}}
| iPad Air 2 = [[PeaceD 16D39 (iPad5,3)|iPad5,3]] [[PeaceD 16D39 (iPad5,4)|iPad5,4]]
| iPad mini 3 = [[PeaceD 16D39 (iPad4,7)|iPad4,7]] [[PeaceD 16D39 (iPad4,8)|iPad4,8]] [[PeaceD 16D39 (iPad4,9)|iPad4,9]]
| iPad mini 4 = [[PeaceD 16D39 (iPad5,1)|iPad5,1]] [[PeaceD 16D39 (iPad5,2)|iPad5,2]]
| #default = {{n/a}}
}}
| {{date|2019|01|22}}
| [http://updates-http.cdn-apple.com/2019WinterFCS/fullrestores/041-17398/7C6FE1F8-15ED-11E9-BE92-9155B489F907/iPad_64bit_TouchID_12.1.3_16D39_Restore.ipsw iPad_64bit_TouchID_12.1.3_16D39_Restore.ipsw]
| <code>07133baf3be1e29494e689b21446ca67efd95707</code>
| 2,991,411,428
| [http://updates-http.cdn-apple.com/2019/ios/041-30598-20190122-095EAC78-F98A-11E8-83B9-8E98AD838929/iPadiTunesUpdateReadMe.ipd iPadiTunesUpdateReadMe.ipd]
|-
| 12.1.4
| 16D57
| {{#switch: {{{Device}}}
| iPad Air 2 = [[PeaceD 16D57 (iPad5,3)|iPad5,3]] [[PeaceD 16D57 (iPad5,4)|iPad5,4]]
| iPad mini 3 = [[PeaceD 16D57 (iPad4,7)|iPad4,7]] [[PeaceD 16D57 (iPad4,8)|iPad4,8]] [[PeaceD 16D57 (iPad4,9)|iPad4,9]]
| iPad mini 4 = [[PeaceD 16D57 (iPad5,1)|iPad5,1]] [[PeaceD 16D57 (iPad5,2)|iPad5,2]]
| #default = {{n/a}}
}}
| {{date|2019|02|07}}
| [http://updates-http.cdn-apple.com/2019WinterFCS/fullrestores/041-38835/32087FB0-292C-11E9-9DA4-3E11412B0A59/iPad_64bit_TouchID_12.1.4_16D57_Restore.ipsw iPad_64bit_TouchID_12.1.4_16D57_Restore.ipsw]
| <code>3d4cc8879f373192711fb4b0d79da4cdff540ad1</code>
| 2,994,344,735
| [http://updates-http.cdn-apple.com/2019/ios/041-37805-20190206-E56BF25B-9CE7-4A3D-8B12-C527F764C9D2/iPadiTunesUpdateReadMe.ipd iPadiTunesUpdateReadMe.ipd]
|-
| 12.2
| 16E227
| {{#switch: {{{Device}}}
| iPad Air 2 = [[PeaceE 16E227 (iPad5,3)|iPad5,3]] [[PeaceE 16E227 (iPad5,4)|iPad5,4]]
| iPad mini 3 = [[PeaceE 16E227 (iPad4,7)|iPad4,7]] [[PeaceE 16E227 (iPad4,8)|iPad4,8]] [[PeaceE 16E227 (iPad4,9)|iPad4,9]]
| iPad mini 4 = [[PeaceE 16E227 (iPad5,1)|iPad5,1]] [[PeaceE 16E227 (iPad5,2)|iPad5,2]]
| #default = {{n/a}}
}}
| {{#switch: {{{Device}}}
| iPad (5th generation)
| iPad Air 2
| iPad mini 4 = [[7.55.01]]
| iPad mini 3 = [[10.56.00]]
| #default = ???
}}
| {{date|2019|03|25}}
| [http://updates-http.cdn-apple.com/2019SpringFCS/fullrestores/041-06926/ECCD1E08-499F-11E9-B708-DE4576CE070F/iPad_64bit_TouchID_12.2_16E227_Restore.ipsw iPad_64bit_TouchID_12.2_16E227_Restore.ipsw]
| <code>c266e4627c2ae5686b0f98b4026bd111509d99ee</code>
| 2,913,749,575
| [http://updates-http.cdn-apple.com/2019/ios/041-47155-20190325-0B0D8525-9834-4745-9CA3-DCE45B582A57/iPadiTunesUpdateReadMe.ipd iPadiTunesUpdateReadMe.ipd]
|}

[[Category:Firmware]]

TYPE

2019-02-15T12:33:15Z

B1n4r1b01: oof

The '''TYPE''' tag is a 32-bit unsigned integer (<code>uint32_t</code>) that when viewed in little-endian format, states the type of firmware image the IMG2/[[IMG3 File Format|IMG3]]/[[IMG4 File Format|IMG4/IM4P]] file is. Is is compared with the second parameter of <code>[[image_load]]</code> (register <code>r1</code><ref>[https://developer.apple.com/library/ios/#documentation/Xcode/Conceptual/iPhoneOSABIReference/Articles/ARMv6FunctionCallingConventions.html Apple on ARM __fastcall]</ref>). If it does not match, <code>image_load</code> will fail and the image will not be loaded. If <code>0</code> is passed in <code>r1</code>, then the check is skipped.

== Types ==
=== IMG2 ===
* [[AppleLogo]]: logo (0x6C6F676F)
* [[BatteryCharging]]: batC (0x62617443)
* [[BatteryLow0]]: batl (0x6261744C)
* [[BatteryLow1]]: batL (0x6261746C)
* [[DeviceTree]]: dtre (0x64747265)
* [[iBoot (Bootloader)|iBoot]]: ibot (0x69626F74)
* [[LLB]]: llbz (0x6C6C627A)
* [[NeedService]]: nsrv (0x6E737276)
* [[RecoveryMode]]: recm (0x7265636D)

=== IMG3+ ===
* Any: ''empty string'' (0x00000000)
* [[AppleLogo]]: logo (0x6C6F676F)
* [[BatteryCharging0]] (charging – bright): chg0 (0x63686730)
* [[BatteryCharging1]] (charging – dim): chg1 (0x63686731)
* [[BatteryFull]]: batF (0x62617446)
* [[BatteryLow0]] (empty): bat0 (0x62617430)
* [[BatteryLow1]] (red, composed onto empty): bat1 (0x62617431)
* Dali: dali
* [[DeviceTree]]: dtre (0x64747265)
* DeviceTree restore: rdtr
* Diagnostics: diag
* Environment variables: ienv
* FDR Trust object for AP: fdrt
* FDR Trust object for SEP: fdrs
* [[GlyphCharging]]: glyC (0x676C7943)
* [[GlyphPlugin]]: glyP (0x676C7950)
* Hypervisor/monitor: hypr
* [[iBEC]]: ibec (0x69626563)
* [[iBoot (Bootloader)|iBoot]]: ibot (0x69626F74)
* [[iBSS]]: ibss (0x69627373)
* [[Kernelcache]]: krnl (0x62736E6C)
* Kernelcache restore: rkrn
* [[LLB]]: illb (0x696C6C62)
* [[NeedService]]: nsrv (0x6E737276)
* Restore Logo: rlgo
* OS restore image: rosi
* PE’s RTOS environment : pert
* PE’s Hammer test: hmmr
* Homer : homr
* Maggie Firmware : magg
* Alamo : almo
* Audio Codec Firmware : acfw
* Multitouch Firmware : mtfw
* GPU Firmware : gfxf
* Wireless Power(?) : wchf
* SmartIOFirmware : siof
* ANE Firmware : anef
* Static Trust Cache : trst
* Restore Trust Cache : rtsc
* EngineeringTrustcache: dtrs
* LoadableTrustCache: ltrs
* Low Power Wallet 0 : lpw0
* Low Power Wallet 1 : lpw1
* Low Power Wallet 2 : lpw2
* [[Ramdisk]]: rdsk (0x7264736B)
* [[RecoveryMode]]: recm (0x7265636D)
* [[SEP-Firmware]] (SEP OS): sepi (0x73657069)
* Restore SEP OS (the same tag is also present in sepboot): rsep
* AOP Firmware : aopf
* AVE : avef
* Input Device : ipdf
* Mac EFI : mefi
* PMP : pmpf
* System Locker : lckr
* ACIWIFI : aciw
* ACIBT : acib
* LeapHaptics : lphp
* OSRamdisk : osrd
* WCHFirmwareUpdater : wchf
* iBootTest : itst
* SCE : scef
* RTP : rtpf
* PersonalizedDMG : pdmg
* SiVal’s (Silicon Validation<ref>[https://www.linkedin.com/jobs/view/silicon-validation-test-and-triage-engineer-at-apple-543262317 Job listing on LinkedIn]</ref>) CFE loader: cfel
* SiVal’s RBM test: rbmt
* SiVal’s PHLEET test: phlt
* tsys tester
* ispf

== References ==
<references />

{{stub|firmware}}
[[Category:Firmware Tags]]

TYPE

2019-02-01T07:13:59Z

B1n4r1b01:

The '''TYPE''' tag is a 32-bit unsigned integer (<code>uint32_t</code>) that when viewed in little-endian format, states the type of firmware image the IMG2/[[IMG3 File Format|IMG3]]/[[IMG4 File Format|IMG4/IM4P]] file is. Is is compared with the second parameter of <code>[[image_load]]</code> (register <code>r1</code><ref>[https://developer.apple.com/library/ios/#documentation/Xcode/Conceptual/iPhoneOSABIReference/Articles/ARMv6FunctionCallingConventions.html Apple on ARM __fastcall]</ref>). If it does not match, <code>image_load</code> will fail and the image will not be loaded. If <code>0</code> is passed in <code>r1</code>, then the check is skipped.

== Types ==
=== IMG2 ===
* [[AppleLogo]]: logo (0x6C6F676F)
* [[BatteryCharging]]: batC (0x62617443)
* [[BatteryLow0]]: batl (0x6261744C)
* [[BatteryLow1]]: batL (0x6261746C)
* [[DeviceTree]]: dtre (0x64747265)
* [[iBoot (Bootloader)|iBoot]]: ibot (0x69626F74)
* [[LLB]]: llbz (0x6C6C627A)
* [[NeedService]]: nsrv (0x6E737276)
* [[RecoveryMode]]: recm (0x7265636D)

=== IMG3+ ===
* Any: ''empty string'' (0x00000000)
* [[AppleLogo]]: logo (0x6C6F676F)
* [[BatteryCharging0]] (charging – bright): chg0 (0x63686730)
* [[BatteryCharging1]] (charging – dim): chg1 (0x63686731)
* [[BatteryFull]]: batF (0x62617446)
* [[BatteryLow0]] (empty): bat0 (0x62617430)
* [[BatteryLow1]] (red, composed onto empty): bat1 (0x62617431)
* Dali: dali
* [[DeviceTree]]: dtre (0x64747265)
* DeviceTree restore: rdtr
* Diagnostics: diag
* Environment variables: ienv
* FDR Trust object for AP: fdrt
* FDR Trust object for SEP: fdrs
* [[GlyphCharging]]: glyC (0x676C7943)
* [[GlyphPlugin]]: glyP (0x676C7950)
* Hypervisor/monitor: hypr
* [[iBEC]]: ibec (0x69626563)
* [[iBoot (Bootloader)|iBoot]]: ibot (0x69626F74)
* [[iBSS]]: ibss (0x69627373)
* [[Kernelcache]]: krnl (0x62736E6C)
* Kernelcache restore: rkrn
* [[LLB]]: illb (0x696C6C62)
* [[NeedService]]: nsrv (0x6E737276)
* Restore Logo: rlgo
* OS restore image: rosi
* PE’s RTOS environment : pert
* PE’s Hammer test: hmmr
* Homer : homr
* Maggie Firmware : magg
* Alamo : almo
* Audio Codec Firmware : acfw
* Multitouch Firmware : mtfw
* GPU Firmware : gfxf
* Wireless Power(?) : wchf
* SmartIOFirmware : siof
* ANE Firmware : anef
* Static Trust Cache : trst
* Restore Trust Cache : rtsc
* Low Power mode : lpw0
* [[Ramdisk]]: rdsk (0x7264736B)
* [[RecoveryMode]]: recm (0x7265636D)
* [[SEP-Firmware]] (SEP OS): sepi (0x73657069)
* Restore SEP OS (the same tag is also present in sepboot): rsep
* AOP Firmware : aopf
* AVE : avef
* Input Device : ipdf
* EFI : mefi
* SiVal’s (Silicon Validation<ref>[https://www.linkedin.com/jobs/view/silicon-validation-test-and-triage-engineer-at-apple-543262317 Job listing on LinkedIn]</ref>) CFE loader: cfel
* SiVal’s RBM test: rbmt
* SiVal’s PHLEET test: phlt
* tsys tester
* ispf

== References ==
<references />

{{stub|firmware}}
[[Category:Firmware Tags]]

IMG3 File Format

2018-10-19T14:42:48Z

B1n4r1b01: img3 is ded but still...

The '''IMG3''' file format was introduced with [[iOS|iPhone OS]] 2.0b4 to replace the broken [[S5L File Formats|IMG2 format]]. This format is used on all devices with an [[S5L8955|A6X]] or older; [[S5L8960|A7]] and newer devices use [[IM4P File Format|IM4P]] and [[IMG4 File Format|IMG4]] files.

==Encryption==
Apple got smarter this time, requiring the Hardware AES engine to be run per file. Decrypt the [[KBAG]] tag data with the [[GID Key]] to get the key and IV, and use those to decrypt the [[DATA]] section of the firmware file.

In the current method, iBoot will always use the first 16 bytes of the [[KBAG]] as the IV, then the remaining 16 (aes-128, used with [[S5L8900]] and [[S5L8720]]), 24 (aes-192), or 32 (aes-256, used with [[S5L8920]]) bytes for the key.

== Contents ==
All numbers are stored in [[wikipedia:Endianness#Little-endian|little endian]] byte order; this includes the magic ''numbers'' (<code>magic</code> and <code>ident</code>).
typedef struct img3File {
uint32_t magic; // ASCII_LE("Img3")
uint32_t fullSize; // full size of fw image
uint32_t sizeNoPack; // size of fw image without header
uint32_t sigCheckArea;// although that is just my name for it, this is the
// size of the start of the data section (the code) up to
// the start of the RSA signature (SHSH section)
uint32_t ident; // identifier of image, used when bootrom is parsing images
// list to find LLB (illb), LLB parsing it to find iBoot (ibot),
// etc.
img3Tag tags[]; // continues until end of file
};

typedef struct img3Tag {
uint32_t magic; // [[#Tags|see below]]
uint32_t totalLength; // length of tag including "magic" and these two length values
uint32_t dataLength; // length of tag data
uint8_t data[dataLength];
uint8_t pad[totalLength - dataLength - 12]; // Typically padded to 4 byte multiple
};

== Tags ==
Due to being written in little-endian byte order, these tags are actually backwards when written to the file (e.g. <code>VERS</code> is stored as <code>S R E V</code>).
[[VERS]]: [[iBoot]] version of the image
[[SEPO]]: Security Epoch
[[SDOM]]: Security Domain
[[PROD]]: Production Mode
[[CHIP]]: Chip to be used with. example: <code>0x8900</code> for [[S5L8900]].
[[BORD]]: Board to be used with
[[KBAG]]: Contains the IV and key required to decrypt; encrypted with the [[GID Key]]
[[SHSH]]: RSA encrypted SHA1 hash of the file
[[CERT]]: Certificate
[[ECID]]: Exclusive Chip ID unique to every device
[[TYPE]]: Type of image, should contain the same string as the header's <code>ident</code>
[[DATA]]: Real content of the file
[[Nonce|NONC]]: [[Nonce]] used when file was signed.
[[CEPO]]: Chip epoch
[[OVRD]]:
[[RAND]]:
[[SALT]]:

==Signature Check==
Decryption is done using the modulus at cert + 0xA15
0xC to [[SHSH]] is SHAed

[[Category:File Formats]]

TYPE

2018-10-06T14:45:38Z

B1n4r1b01: added some...

The '''TYPE''' tag is a 32-bit unsigned integer (<code>uint32_t</code>) that when viewed in little-endian format, states the type of firmware image the IMG2/[[IMG3 File Format|IMG3]]/[[IMG4 File Format|IMG4/IM4P]] file is. Is is compared with the second parameter of <code>[[image_load]]</code> (register <code>r1</code><ref>[https://developer.apple.com/library/ios/#documentation/Xcode/Conceptual/iPhoneOSABIReference/Articles/ARMv6FunctionCallingConventions.html Apple on ARM __fastcall]</ref>). If it does not match, <code>image_load</code> will fail and the image will not be loaded. If <code>0</code> is passed in <code>r1</code>, then the check is skipped.

== Types ==
=== IMG2 ===
* [[AppleLogo]]: logo (0x6C6F676F)
* [[BatteryCharging]]: batC (0x62617443)
* [[BatteryLow0]]: batl (0x6261744C)
* [[BatteryLow1]]: batL (0x6261746C)
* [[DeviceTree]]: dtre (0x64747265)
* [[iBoot (Bootloader)|iBoot]]: ibot (0x69626F74)
* [[LLB]]: llbz (0x6C6C627A)
* [[NeedService]]: nsrv (0x6E737276)
* [[RecoveryMode]]: recm (0x7265636D)

=== IMG3+ ===
* Any: ''empty string'' (0x00000000)
* [[AppleLogo]]: logo (0x6C6F676F)
* [[BatteryCharging0]] (charging – bright): chg0 (0x63686730)
* [[BatteryCharging1]] (charging – dim): chg1 (0x63686731)
* [[BatteryFull]]: batF (0x62617446)
* [[BatteryLow0]] (empty): bat0 (0x62617430)
* [[BatteryLow1]] (red, composed onto empty): bat1 (0x62617431)
* Dali: dali
* [[DeviceTree]]: dtre (0x64747265)
* DeviceTree restore: rdtr
* Diagnostics: diag
* Environment variables: ienv
* FDR Trust object for AP: fdrt
* FDR Trust object for SEP: fdrs
* [[GlyphCharging]]: glyC (0x676C7943)
* [[GlyphPlugin]]: glyP (0x676C7950)
* Hypervisor/monitor: hypr
* [[iBEC]]: ibec (0x69626563)
* [[iBoot (Bootloader)|iBoot]]: ibot (0x69626F74)
* [[iBSS]]: ibss (0x69627373)
* [[Kernelcache]]: krnl (0x62736E6C)
* Kernelcache restore: rkrn
* [[LLB]]: illb (0x696C6C62)
* [[NeedService]]: nsrv (0x6E737276)
* Restore Logo: rlgo
* OS restore image: rosi
* PE’s RTOS environment : pert
* PE’s Hammer test: hmmr
* Homer : homr
* Maggie Firmware : magg
* Alamo : almo
* Audio Codec Firmware : acfw
* Multitouch Firmware : mtfw
* GPU Firmware : gfxf
* Wireless Power(?) : wchf
* SmartIOFirmware : siof
* ANE Firmware : anef
* Static Trust Cache : trst
* Restore Trust Cache : rtsc
* Low Power mode : lpw0
* [[Ramdisk]]: rdsk (0x7264736B)
* [[RecoveryMode]]: recm (0x7265636D)
* [[SEP-Firmware]] (SEP OS): sepi (0x73657069)
* SEP OS (restore): rsep
* SiVal’s (Silicon Validation<ref>[https://www.linkedin.com/jobs/view/silicon-validation-test-and-triage-engineer-at-apple-543262317 Job listing on LinkedIn]</ref>) CFE loader: cfel
* SiVal’s RBM test: rbmt
* SiVal’s PHLEET test: phlt
* tsys tester
* ispf

== References ==
<references />

{{stub|firmware}}
[[Category:Firmware Tags]]

User:B1n4r1b01

2018-08-30T05:17:45Z

B1n4r1b01: Created page with "Hi, that username means binaryboy (most people can't figure it out). [http://www.twitter.com/b1n4r1b01 Twitter]"

Hi, that username means binaryboy (most people can't figure it out). [http://www.twitter.com/b1n4r1b01 Twitter]

Talk:Diags (iBoot command)

2018-08-27T03:54:10Z

B1n4r1b01:

== bootable image3 ==

can we add note for img3 diags image? seperat page? thnx ) --[[User:S961773527|S961773527]] ([[User talk:S961773527|talk]]) 06:32, 7 June 2015 (UTC)
:Do you mean the internal Diags img3 image, or something else? --[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 02:17, 8 June 2015 (UTC)
:I have written an article about the bootable img3 @https://b1n4r1b01.github.io/diags.html