The iPhone Wiki - User contributions [en]

Firmware Keys

2012-06-12T05:41:02Z

Cody: /* 5.x */ added in dates for releases

'''VFDecrypt Keys''' are the keys which can decrypt the files that come with the [[firmware]]. Apple uses a public-private key encryption to ensure the safety of their files. Over time Apple has changed the way to encrypt firmware files, thus the way to decrypt files as well as the way to get the VFDecrypt Keys has also.

[[S5L File Formats#IMG2|IMG2]] was the file format used prior to iOS 2.0. For iOS 1.1.x, IMG2 files were encrypted with Key 0x837.

[[IMG3 File Format|IMG3]] encrypted files contain encrypted versions of the VFDecrypt Keys as part of the [[KBAG]] (key bag). These can be decrypted with the [[GID-key]]. For jailbroken iDevices the VFDecrypt keys can be retrieved with the devices [[AES Keys|hardware AES engine]]. The VFDecrypt key for the root filesystem image of an iDevice (~500 MB to 800MB in the case of iOS 5) requires either a decrypted [[Restore Ramdisk]] or [[Update Ramdisk]]. Once you have a decrypted Restore or Update Ramdisk, [[GenPass]] can be used to gather the keys for the root filesystem.
For the root filesystem there is one key per device model, with no IV. You can mount this once it has been decrypted using your program of choice. (For example, 7-zip on Windows (after extracting the DMG on Windows, extract the biggest file with [[Wikipedia:7-Zip|7-Zip]])

== Notes ==
The Update Ramdisk and Restore Ramdisks share the same IV and key per type of Application Processor. The current models are:

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! width="200" | Application Processor
! width="200" | iDevice
|-
| [[S5L8900]]
| [[M68ap|iPhone]], [[N82ap|iPhone 3G]], [[N45ap|iPod touch]]
|-
| [[S5L8720]]
| [[M68ap|iPhone]], [[N72ap|iPod touch 2G]]
|-
| [[S5L8920]]
| [[N88ap|iPhone 3GS]]
|-
| [[S5L8922]]
| [[N18ap|iPod touch 3G]]
|-
| [[S5L8930]] (A4)
| [[K48ap|iPad]], [[iPhone 4]], [[N81ap|iPod touch 4G]], [[K66ap|Apple TV 2G]]
|-
| [[S5L8940]] (A5)
| [[iPad 2]], [[N94ap|iPhone 4S]]
|-
| [[S5L8942]] (revised A5)
| [[k93aap|iPad 2 Wi-Fi R2]], [[J33ap|Apple TV 3G]]
|-
| [[S5L8945]] (A5X)
| [[iPad 3]]
|}

You can use [[img3decrypt]][http://code.google.com/p/img3decrypt/] or [[xpwntool]][http://github.com/planetbeing/xpwn/tree/master] to decrypt these as described in [[Ramdisk Decryption]]. Once done, mount or extract using the tool of your choice.

When posting a key page, please use the [[Template:Keys|key template]] ('''IN THE CORRECT ORDER''') and do '''NOT''' [[Wikipedia:WP:SUBST|substitute]] it.

For the VFDecrypt Keys of each firmware please check the builds listed at the appropiate firmware version page.

== Firmware versions ==
=== Final ===
{{main|Firmware}}
==== 1.x ====
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
! Date
! Build
! [[m68ap|iPhone]]
! [[n45ap|iPod touch 1G]]
|-
| ?
! style="text-align:left;" | 1A420
| [[Alpine 1A420 (iPhone)|1.0]]
| rowspan="4" | Unavailable
|-
| ?
! style="text-align:left;" | 1A543a
| [[Heavenly 1A543a (iPhone)|1.0.0]]
|-
| ?
! style="text-align:left;" | 1C25
| [[Heavenly 1C25 (iPhone)|1.0.1]]
|-
| ?
! style="text-align:left;" | 1C28
| [[Heavenly 1C28 (iPhone)|1.0.2]]
|-
| ?
! style="text-align:left;" | 3A100a
| rowspan="2" | Unavailable
| [[Snowbird 3A100a (iPod touch)|1.1]]
|-
| ?
! style="text-align:left;" | 3A101a
| [[Snowbird 3A101a (iPod touch)|1.1]]
|-
| ?
! style="text-align:left;" | 3A109a
| [[Snowbird 3A109a (iPhone)|1.1.1]]
| Unavailable
|-
| ?
! style="text-align:left;" | 3A110a
| Unavailable
| [[Snowbird 3A110a (iPod touch)|1.1.1]]
|-
| ?
! style="text-align:left;" | 3B48b
| [[Oktoberfest 3B48b (iPhone)|1.1.2]]
| [[Oktoberfest 3B48b (iPod touch)|1.1.2]]
|-
| ?
! style="text-align:left;" | 4A93
| [[Little Bear 4A93 (iPhone)|1.1.3]]
| [[Little Bear 4A93 (iPod touch)|1.1.3]]
|-
| ?
! style="text-align:left;" | 4A102
| [[Little Bear 4A102 (iPhone)|1.1.4]]
| [[Little Bear 4A102 (iPod touch)|1.1.4]]
|-
| ?
! style="text-align:left;" | 4B1
| Unavailable
| [[Little Bear 4B1 (iPod touch)|1.1.5]]
|}
==== 2.x ====
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
! Date
! Build
! [[m68ap|iPhone]]
! [[n82ap|iPhone 3G]]
! [[n45ap|iPod touch 1G]]
! [[n72ap|iPod touch 2G]]
|-
| ?
! style="text-align:left;" | 5A345
| Unavailable
| [[Big Bear 5A345 (iPhone 3G)|2.0]]
| Unavailable
| rowspan="6" | Unavailable
|-
| ?
! style="text-align:left;" | 5A347
| [[Big Bear 5A347 (iPhone)|2.0]]
| [[Big Bear 5A347 (iPhone 3G)|2.0]]
| [[Big Bear 5A347 (iPod touch)|2.0]]
|-
| ?
! style="text-align:left;" | 5B108
| [[Big Bear 5B108 (iPhone)|2.0.1]]
| [[Big Bear 5B108 (iPhone 3G)|2.0.1]]
| [[Big Bear 5B108 (iPod touch)|2.0.1]]
|-
| ?
! style="text-align:left;" | 5C1
| [[Big Bear 5C1 (iPhone)|2.0.2]]
| [[Big Bear 5C1 (iPhone 3G)|2.0.2]]
| [[Big Bear 5C1 (iPod touch)|2.0.2]]
|-
| ?
! style="text-align:left;" | 5F136
| [[Sugar Bowl 5F136 (iPhone)|2.1]]
| [[Sugar Bowl 5F136 (iPhone 3G)|2.1]]
| Unavailable
|-
| ?
! style="text-align:left;" | 5F137
| rowspan="2" colspan="2" | Unavailable
| [[Sugar Bowl 5F137 (iPod touch)|2.1]]
|-
| ?
! style="text-align:left;" | 5F138
| Unavailable
| [[Sugar Bowl 5F138 (iPod touch 2G)|2.1.1]]
|-
| ?
! style="text-align:left;" | 5G77
| [[Timberline 5G77 (iPhone)|2.2]]
| [[Timberline 5G77 (iPhone 3G)|2.2]]
| [[Timberline 5G77 (iPod touch)|2.2]]
| Unavailable
|-
| ?
! style="text-align:left;" | 5G77a
| colspan="3" | Unavailable
| [[Timberline 5G77a (iPod touch 2G)|2.2]]
|-
| ?
! style="text-align:left;" | 5H11
| [[SUTimberline 5H11 (iPhone)|2.2.1]]
| [[SUTimberline 5H11 (iPhone 3G)|2.2.1]]
| [[SUTimberline 5H11 (iPod touch)|2.2.1]]
| Unavailable
|-
| ?
! style="text-align:left;" | 5H11a
| colspan="3" | Unavailable
| [[SUTimberline 5H11a (iPod touch 2G)|2.2.1]]
|}
==== 3.x ====
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
! Date
! Build
! [[k48ap|iPad]]
! [[m68ap|iPhone]]
! [[n82ap|iPhone 3G]]
! [[n88ap|iPhone 3GS]]
! [[n45ap|iPod touch 1G]]
! [[n72ap|iPod touch 2G]]
! [[n18ap|iPod touch 3G]]
|-
| ?
! style="text-align:left;" | 7A341
| rowspan="7" | Unavailable
| [[Kirkwood 7A341 (iPhone)|3.0]]
| [[Kirkwood 7A341 (iPhone 3G)|3.0]]
| [[Kirkwood 7A341 (iPhone 3GS)|3.0]]
| [[Kirkwood 7A341 (iPod touch)|3.0]]
| [[Kirkwood 7A341 (iPod touch 2G)|3.0]]
| Unavailable
|-
| ?
! style="text-align:left;" | 7A400
| [[Kirkwood 7A400 (iPhone)|3.0.1]]
| [[Kirkwood 7A400 (iPhone 3G)|3.0.1]]
| [[Kirkwood 7A400 (iPhone 3GS)|3.0.1]]
| colspan="3" rowspan="2" | Unavailable
|-
| ?
! style="text-align:left;" | 7C144
| [[Northstar 7C144 (iPhone)|3.1]]
| [[Northstar 7C144 (iPhone 3G)|3.1]]
| [[Northstar 7C144 (iPhone 3GS)|3.1]]
|-
| ?
! style="text-align:left;" | 7C145
| rowspan="2" colspan="3" | Unavailable
| [[Northstar 7C145 (iPod touch)|3.1.1]]
| [[Northstar 7C145 (iPod touch 2G)|3.1.1]]
| [[Northstar 7C145 (iPod touch 3G)|3.1.1]]
|-
| ?
! style="text-align:left;" | 7C146
| colspan="2" | Unavailable
| [[Northstar 7C146 (iPod touch 3G)|3.1.1]]
|-
| ?
! style="text-align:left;" | 7D11
| [[Northstar 7D11 (iPhone)|3.1.2]]
| [[Northstar 7D11 (iPhone 3G)|3.1.2]]
| [[Northstar 7D11 (iPhone 3GS)|3.1.2]]
| [[Northstar 7D11 (iPod touch)|3.1.2]]
| [[Northstar 7D11 (iPod touch 2G)|3.1.2]]
| [[Northstar 7D11 (iPod touch 3G)|3.1.2]]
|-
| ?
! style="text-align:left;" | 7E18
| [[SUNorthstarTwo 7E18 (iPhone)|3.1.3]]
| [[SUNorthstarTwo 7E18 (iPhone 3G)|3.1.3]]
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|3.1.3]]
| [[SUNorthstarTwo 7E18 (iPod touch)|3.1.3]]
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|3.1.3]]
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|3.1.3]]
|-
| ?
! style="text-align:left;" | 7B367
| [[Wildcat 7B367 (iPad)|3.2]]
| colspan="6" rowspan="3" | Unavailable
|-
| ?
! style="text-align:left;" | 7B405
| [[Wildcat 7B405 (iPad)|3.2.1]]
|-
| ?
! style="text-align:left;" | 7B500
| [[Wildcat 7B500 (iPad)|3.2.2]]
|}
==== 4.x ====
Please note that for the Apple TV the firmware listed in this table is the one that your Apple TV reports. See also [[Apple TV Firmware Versions]].
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
! Date (YYYY/MM/DD)
! Build
! [[k66ap|Apple TV 2G]]
! [[k48ap|iPad]]
! [[k93ap|iPad 2 (Wi-Fi)]]
! [[k94ap|iPad 2 (GSM)]]
! [[k95ap|iPad 2 (CDMA)]]
! [[n82ap|iPhone 3G]]
! [[n88ap|iPhone 3GS]]
! [[n90ap|iPhone 4 (GSM)]]
! [[n92ap|iPhone 4 (CDMA)]]
! [[n72ap|iPod touch 2G]]
! [[n18ap|iPod touch 3G]]
! [[n81ap|iPod touch 4G]]
|-
| 2010/09/01
! style="text-align:left;" | 8M89
| [[Mojave 8M89 (Apple TV 2G)|4.0]]
| colspan="11" | Unavailable
|-
| ?
! style="text-align:left;" | 8A293
| rowspan="7" | Unavailable
| rowspan="4" colspan="4" | Unavailable
| [[Apex 8A293 (iPhone 3G)|4.0]]
| [[Apex 8A293 (iPhone 3GS)|4.0]]
| [[Apex 8A293 (iPhone 4)|4.0]]
| Unavailable
| [[Apex 8A293 (iPod touch 2G)|4.0]]
| [[Apex 8A293 (iPod touch 3G)|4.0]]
| Unavailable
|-
| ?
! style="text-align:left;" | 8A306
| [[Apex 8A306 (iPhone 3G)|4.0.1]]
| [[Apex 8A306 (iPhone 3GS)|4.0.1]]
| [[Apex 8A306 (iPhone 4)|4.0.1]]
| colspan="4" | Unavailable
|-
| ?
! style="text-align:left;" | 8A400
| [[Apex 8A400 (iPhone 3G)|4.0.2]]
| [[Apex 8A400 (iPhone 3GS)|4.0.2]]
| [[Apex 8A400 (iPhone 4)|4.0.2]]
| rowspan="2" | Unavailable
| [[Apex 8A400 (iPod touch 2G)|4.0.2]]
| [[Apex 8A400 (iPod touch 3G)|4.0.2]]
| Unavailable
|-
| ?
! style="text-align:left;" | 8B117
| [[Baker 8B117 (iPhone 3G)|4.1]]
| [[Baker 8B117 (iPhone 3GS)|4.1]]
| [[Baker 8B117 (iPhone 4)|4.1]]
| [[Baker 8B117 (iPod touch 2G)|4.1]]
| [[Baker 8B117 (iPod touch 3G)|4.1]]
| [[Baker 8B117 (iPod touch 4G)|4.1]]
|-
| ?
! style="text-align:left;" | 8B118
| colspan="9" | Unavailable
| [[Baker 8B118 (iPod touch 4G)|4.1]]
| Unavailable
|-
| ?
! style="text-align:left;" | 8C148
| [[Jasper 8C148 (iPad)|4.2.1]]
| colspan="3" | Unavailable
| [[Jasper 8C148 (iPhone 3G)|4.2.1]]
| Unavailable
| [[Jasper 8C148 (iPhone 4)|4.2.1]]
| Unavailable
| [[Jasper 8C148 (iPod touch 2G)|4.2.1]]
| [[Jasper 8C148 (iPod touch 3G)|4.2.1]]
| [[Jasper 8C148 (iPod touch 4G)|4.2.1]]
|-
| ?
! style="text-align:left;" | 8C148a
| colspan="5" | Unavailable
| [[Jasper 8C148a (iPhone 3GS)|4.2.1]]
| colspan="5" | Unavailable
|-
| 2010/11/22
! style="text-align:left;" | 8C150
| [[Jasper 8C150 (Apple TV 2G)|4.1]]
| rowspan="2" colspan="11" | Unavailable
|-
| 2010/12/14
! style="text-align:left;" | 8C154
| [[Jasper 8C154 (Apple TV 2G)|4.1.1]]
|-
| ?
! style="text-align:left;" | 8E128
| colspan="8" rowspan="6" | Unavailable
| [[Phoenix 8E128 (iPhone 4 CDMA)|4.2.5]]
| colspan="3" rowspan="6" | Unavailable
|-
| ?
! style="text-align:left;" | 8E200
| [[Phoenix 8E200 (iPhone 4 CDMA)|4.2.6]]
|-
| ?
! style="text-align:left;" | 8E303
| [[Phoenix 8E303 (iPhone 4 CDMA)|4.2.7]]
|-
| ?
! style="text-align:left;" | 8E401
| [[Phoenix 8E401 (iPhone 4 CDMA)|4.2.8]]
|-
| ?
! style="text-align:left;" | 8E501
| [[Phoenix 8E501 (iPhone 4 CDMA)|4.2.9]]
|-
| ?
! style="text-align:left;" | 8E600
| [[Phoenix 8E600 (iPhone 4 CDMA)|4.2.10]]
|-
| ?
! style="text-align:left;" | 8F190
| rowspan="2" | Unavailable
| [[Durango 8F190 (iPad)|4.3]]
| colspan="3" | Unavailable
| rowspan="14" | Unavailable
| [[Durango 8F190 (iPhone 3GS)|4.3]]
| [[Durango 8F190 (iPhone 4)|4.3]]
| colspan="2" rowspan="14" | Unavailable
| [[Durango 8F190 (iPod touch 3G)|4.3]]
| [[Durango 8F190 (iPod touch 4G)|4.3]]
|-
| ?
! style="text-align:left;" | 8F191
| Unavailable
| [[Durango 8F191 (iPad 2 Wi-Fi)|4.3]]
| [[Durango 8F191 (iPad 2 GSM)|4.3]]
| [[Durango 8F191 (iPad 2 CDMA)|4.3]]
| rowspan="5" colspan="2" | Unavailable
| rowspan="5" colspan="2" | Unavailable
|-
| 2011/03/11
! style="text-align:left;" | 8F191m
| [[Durango 8F191m (Apple TV 2G)|4.2]]
| rowspan="4" colspan="4" | Unavailable
|-
| 2011/03/22
! style="text-align:left;" | 8F202
| [[Durango 8F202 (Apple TV 2G)|4.2.1]]
|-
| 2011/03/11
! style="text-align:left;" | 8F305
| [[Durango 8F305 (Apple TV 2G)|4.2.2]]
|-
| 2011/08/01
! style="text-align:left;" | 8F455
| [[DurangoTideCuba 8F455 (Apple TV 2G)|4.3]]
|-
| ?
! style="text-align:left;" | 8G4
| rowspan="7" | Unavailable
| [[Durango 8G4 (iPad)|4.3.1]]
| [[Durango 8G4 (iPad 2 Wi-Fi)|4.3.1]]
| [[Durango 8G4 (iPad 2 GSM)|4.3.1]]
| [[Durango 8G4 (iPad 2 CDMA)|4.3.1]]
| [[Durango 8G4 (iPhone 3GS)|4.3.1]]
| [[Durango 8G4 (iPhone 4)|4.3.1]]
| [[Durango 8G4 (iPod touch 3G)|4.3.1]]
| [[Durango 8G4 (iPod touch 4G)|4.3.1]]
|-
| ?
! style="text-align:left;" | 8H7
| [[Durango 8H7 (iPad)|4.3.2]]
| [[Durango 8H7 (iPad 2 Wi-Fi)|4.3.2]]
| [[Durango 8H7 (iPad 2 GSM)|4.3.2]]
| Unavailable
| [[Durango 8H7 (iPhone 3GS)|4.3.2]]
| [[Durango 8H7 (iPhone 4)|4.3.2]]
| [[Durango 8H7 (iPod touch 3G)|4.3.2]]
| [[Durango 8H7 (iPod touch 4G)|4.3.2]]
|-
| ?
! style="text-align:left;" | 8H8
| colspan="3" | Unavailable
| [[Durango 8H8 (iPad 2 CDMA)|4.3.2]]
| colspan="2" | Unavailable
| colspan="2" | Unavailable
|-
| ?
! style="text-align:left;" | 8J2
| Unavailable
| [[Durango 8J2 (iPad 2 Wi-Fi)|4.3.3]]
| [[Durango 8J2 (iPad 2 GSM)|4.3.3]]
| [[Durango 8J2 (iPad 2 CDMA)|4.3.3]]
| [[Durango 8J2 (iPhone 3GS)|4.3.3]]
| [[Durango 8J2 (iPhone 4)|4.3.3]]
| [[Durango 8J2 (iPod touch 3G)|4.3.3]]
| [[Durango 8J2 (iPod touch 4G)|4.3.3]]
|-
| ?
! style="text-align:left;" | 8J3
| [[Durango 8J3 (iPad)|4.3.3]]
| colspan="3" | Unavailable
| colspan="2" | Unavailable
| colspan="2" | Unavailable
|-
| ?
! style="text-align:left;" | 8K2
| [[Durango 8K2 (iPad)|4.3.4]]
| [[Durango 8K2 (iPad 2 Wi-Fi)|4.3.4]]
| [[Durango 8K2 (iPad 2 GSM)|4.3.4]]
| [[Durango 8K2 (iPad 2 CDMA)|4.3.4]]
| [[Durango 8K2 (iPhone 3GS)|4.3.4]]
| [[Durango 8K2 (iPhone 4)|4.3.4]]
| [[Durango 8K2 (iPod touch 3G)|4.3.4]]
| [[Durango 8K2 (iPod touch 4G)|4.3.4]]
|-
| ?
! style="text-align:left;" | 8L1
| [[Durango 8L1 (iPad)|4.3.5]]
| [[Durango 8L1 (iPad 2 Wi-Fi)|4.3.5]]
| [[Durango 8L1 (iPad 2 GSM)|4.3.5]]
| [[Durango 8L1 (iPad 2 CDMA)|4.3.5]]
| [[Durango 8L1 (iPhone 3GS)|4.3.5]]
| [[Durango 8L1 (iPhone 4)|4.3.5]]
| [[Durango 8L1 (iPod touch 3G)|4.3.5]]
| [[Durango 8L1 (iPod touch 4G)|4.3.5]]
|}

==== 5.x ====
Please note that for the Apple TV the firmware listed in this table is the one that your Apple TV reports. See also [[Apple TV Firmware Versions]].
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
! Date (YYYY/MM/DD)
! Build
! [[k66ap|Apple TV 2G]]
! [[j33ap|Apple TV 3G]]
! [[k48ap|iPad]]
! [[k93ap|iPad 2 (Wi-Fi)]]
! [[k94ap|iPad 2 (GSM)]]
! [[k95ap|iPad 2 (CDMA)]]
! [[k93aap|iPad 2 R2]]
! [[j1ap|iPad 3 (Wi-Fi)]]
! [[j2ap|iPad 3 (CDMA)]]
! [[j2aap|iPad 3 (Global)]]
! [[n88ap|iPhone 3GS]]
! [[n90ap|iPhone 4 (GSM)]]
! [[n92ap|iPhone 4 (CDMA)]]
! [[n94ap|iPhone 4S]]
! [[n18ap|iPod touch 3G]]
! [[n81ap|iPod touch 4G]]
|-
| 2011/10/12
! style="text-align:left;" | 9A334
| colspan="2" | Unavailable
| [[Telluride 9A334 (iPad)|5.0]]
| [[Telluride 9A334 (iPad 2 Wi-Fi)|5.0]]
| [[Telluride 9A334 (iPad 2 GSM)|5.0]]
| [[Telluride 9A334 (iPad 2 CDMA)|5.0]]
| colspan="4" | Unavailable
| [[Telluride 9A334 (iPhone 3GS)|5.0]]
| [[Telluride 9A334 (iPhone 4)|5.0]]
| [[Telluride 9A334 (iPhone 4 CDMA)|5.0]]
| [[Telluride 9A334 (iPhone 4S)|5.0]]
| [[Telluride 9A334 (iPod touch 3G)|5.0]]
| [[Telluride 9A334 (iPod touch 4G)|5.0]]
|-
| 2011/10/12
! style="text-align:left;" | 9A334v
| [[Telluride 9A334v (Apple TV 2G)|4.4]]
| rowspan="3" colspan="15" | Unavailable
|-
| 2011/10/18
! style="text-align:left;" | 9A335a
| [[Telluride 9A335a (Apple TV 2G)|4.4.1]]
|-
| 2011/11/02
! style="text-align:left;" | 9A336a
| [[Telluride 9A336a (Apple TV 2G)|4.4.2]]
|-
| 2011/11/10
! style="text-align:left;" | 9A405
| colspan="2" | Unavailable
| [[Telluride 9A405 (iPad)|5.0.1]]
| [[Telluride 9A405 (iPad 2 Wi-Fi)|5.0.1]]
| [[Telluride 9A405 (iPad 2 GSM)|5.0.1]]
| [[Telluride 9A405 (iPad 2 CDMA)|5.0.1]]
| colspan="4" | Unavailable
| [[Telluride 9A405 (iPhone 3GS)|5.0.1]]
| [[Telluride 9A405 (iPhone 4)|5.0.1]]
| [[Telluride 9A405 (iPhone 4 CDMA)|5.0.1]]
| [[Telluride 9A405 (iPhone 4S)|5.0.1]]
| [[Telluride_9A405 (iPod touch 3G)|5.0.1]]
| [[Telluride_9A405 (iPod touch 4G)|5.0.1]]
|-
| 2011/11/17
! style="text-align:left;" | 9A405l
| [[Telluride 9A405l (Apple TV 2G)|4.4.3]]
| colspan="15" | Unavailable
|-
| 2011/12/15
! style="text-align:left;" | 9A406
| colspan="13" | Unavailable
| [[Telluride 9A406 (iPhone 4S)|5.0.1]]
| colspan="2" | Unavailable
|-
| 2011/12/15
! style="text-align:left;" | 9A406a
| [[Telluride 9A406a (Apple TV 2G)|4.4.4]]
| colspan="15" | Unavailable
|-
| 2012/03/07
! style="text-align:left;" | 9B176
| colspan="2" | Unavailable
| [[Hoodoo 9B176 (iPad)|5.1]]
| [[Hoodoo 9B176 (iPad 2 Wi-Fi)|5.1]]
| [[Hoodoo 9B176 (iPad 2 GSM)|5.1]]
| [[Hoodoo 9B176 (iPad 2 CDMA)|5.1]]
| [[Hoodoo 9B176 (iPad 2 R2)|5.1]]
| [[Hoodoo 9B176 (iPad 3 Wi-Fi)|5.1]]
| [[Hoodoo 9B176 (iPad 3 CDMA)|5.1]]
| [[Hoodoo 9B176 (iPad 3 Global)|5.1]]
| [[Hoodoo 9B176 (iPhone 3GS)|5.1]]
| [[Hoodoo 9B176 (iPhone 4)|5.1]]
| [[Hoodoo 9B176 (iPhone 4 CDMA)|5.1]]
| Unavailable
| [[Hoodoo 9B176 (iPod touch 3G)|5.1]]
| [[Hoodoo 9B176 (iPod touch 4G)|5.1]]
|-
| 2012/03/07
! style="text-align:left;" | 9B179
| colspan="13" | Unavailable
| [[Hoodoo 9B179 (iPhone 4S)|5.1]]
| colspan="2" | Unavailable
|-
| 2012/03/07
! style="text-align:left;" | 9B179b
| [[Hoodoo 9B179b (Apple TV 2G)|5.0]]
| [[Hoodoo 9B179b (Apple TV 3G)|5.0]]
| colspan="14" | Unavailable
|-
| 2012/05/10
! style="text-align:left;" | 9B206
| colspan="2" | Unavailable
| [[Hoodoo 9B206 (iPad)|5.1.1]]
| [[Hoodoo 9B206 (iPad 2 Wi-Fi)|5.1.1]]
| [[Hoodoo 9B206 (iPad 2 GSM)|5.1.1]]
| [[Hoodoo 9B206 (iPad 2 CDMA)|5.1.1]]
| [[Hoodoo 9B206 (iPad 2 R2)|5.1.1]]
| [[Hoodoo 9B206 (iPad 3 Wi-Fi)|5.1.1]]
| [[Hoodoo 9B206 (iPad 3 CDMA)|5.1.1]]
| [[Hoodoo 9B206 (iPad 3 Global)|5.1.1]]
| [[Hoodoo 9B206 (iPhone 3GS)|5.1.1]]
| [[Hoodoo 9B206 (iPhone 4)|5.1.1]]
| [[Hoodoo 9B206 (iPhone 4 CDMA)|5.1.1]]
| [[Hoodoo 9B206 (iPhone 4S)|5.1.1]]
| [[Hoodoo_9B206 (iPod touch 3G)|5.1.1]]
| [[Hoodoo 9B206 (iPod touch 4G)|5.1.1]]
|-
| 2012/05/10
! style="text-align:left;" | 9B206f
| [[Hoodoo 9B206f (Apple TV 2G)|5.0.1]]
| [[Hoodoo 9B206f (Apple TV 3G)|5.0.1]]
| colspan="14" | Unavailable
|-
| 2012/05/25
! style="text-align:left;" | 9B208
| colspan="11" | Unavailable
| [[Hoodoo 9B208 (iPhone 4)|5.1.1]]
| colspan="4" | Unavailable
|-
| 2012/06/05
! style="text-align:left;" | 9B830
| [[HoodooTide 9B830 (Apple TV 2G)|5.0.2]]
| [[HoodooTide 9B830 (Apple TV 3G)|5.0.2]]
| colspan="14" | Unavailable
|}

=== Beta ===
{{main|Beta Firmware}}
==== 1.x/2.x ====
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
! Date
! Build
! [[m68ap|iPhone]]
! [[n82ap|iPhone 3G]]
! [[n45ap|iPod touch]]
|-
| ?
! style="text-align:left;" | 5A147p
| [[Big Bear 5A147p (iPhone)|1.2b1]]
| rowspan="10" | Unavailable
| [[Big Bear 5A147p (iPod touch)|1.2b1]]
|-
| ?
! style="text-align:left;" | 5A225c
| [[Big Bear 5A225c (iPhone)|2.0b2]]
| [[Big Bear 5A225c (iPod touch)|2.0b2]]
|-
| ?
! style="text-align:left;" | 5A240d
| [[Big Bear 5A240d (iPhone)|2.0b3]]
| [[Big Bear 5A240d (iPod touch)|2.0b3]]
|-
| ?
! style="text-align:left;" | 5A258f
| [[Big Bear 5A258f (iPhone)|2.0b4]]
| [[Big Bear 5A258f (iPod touch)|2.0b4]]
|-
| ?
! style="text-align:left;" | 5A274d
| [[Big Bear 5A274d (iPhone)|2.0b5]]
| [[Big Bear 5A274d (iPod touch)|2.0b5]]
|-
| ?
! style="text-align:left;" | 5A292g
| [[Big Bear 5A292g (iPhone)|2.0b6P]]
| [[Big Bear 5A292g (iPod touch)|2.0b6P]]
|-
| ?
! style="text-align:left;" | 5A308
| [[Big Bear 5A308 (iPhone)|2.0b6F]]
| [[Big Bear 5A308 (iPod touch)|2.0b6F]]
|-
| ?
! style="text-align:left;" | 5A331
| [[Big Bear 5A331 (iPhone)|2.0b7]]
| [[Big Bear 5A331 (iPod touch)|2.0b7]]
|-
| ?
! style="text-align:left;" | 5A345
| [[Big Bear 5A345 (iPhone)|2.0b8GM]]
| [[Big Bear 5A345 (iPod touch)|2.0b8GM]]
|-
| ?
! style="text-align:left;" | 5F90
| [[Sugar Bowl 5F90 (iPhone)|2.1b1]]
| [[Sugar Bowl 5F90 (iPod touch)|2.1b1]]
|-
| ?
! style="text-align:left;" | 5G26
| [[Sugar Bowl 5G26 (iPhone)|2.2b1]]
| [[Sugar Bowl 5G26 (iPhone 3G)|2.2b1]]
| [[Sugar Bowl 5G26 (iPod touch)|2.2b1]]
|}
==== 3.x ====
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
! Date
! Build
! [[m68ap|iPhone]]
! [[n82ap|iPhone 3G]]
! [[n88ap|iPhone 3GS]]
! [[n45ap|iPod touch]]
! [[n72ap|iPod touch 2G]]
|-
| ?
! style="text-align:left;" | 7A238j
| [[Kirkwood 7A238j (iPhone)|3.0b1]]
| [[Kirkwood 7A238j (iPhone 3G)|3.0b1]]
| rowspan="5" | Unavailable
| [[Kirkwood 7A238j (iPod touch)|3.0b1]]
| [[Kirkwood 7A238j (iPod touch 2G)|3.0b1]]
|-
| ?
! style="text-align:left;" | 7A259g
| [[Kirkwood 7A259g (iPhone)|3.0b2]]
| [[Kirkwood 7A259g (iPhone 3G)|3.0b2]]
| [[Kirkwood 7A259g (iPod touch)|3.0b2]]
| [[Kirkwood 7A259g (iPod touch 2G)|3.0b2]]
|-
| ?
! style="text-align:left;" | 7A280f
| [[Kirkwood 7A280f (iPhone)|3.0b3]]
| [[Kirkwood 7A280f (iPhone 3G)|3.0b3]]
| [[Kirkwood 7A280f (iPod touch)|3.0b3]]
| [[Kirkwood 7A280f (iPod touch 2G)|3.0b3]]
|-
| ?
! style="text-align:left;" | 7A300g
| [[Kirkwood 7A300g (iPhone)|3.0b4]]
| [[Kirkwood 7A300g (iPhone 3G)|3.0b4]]
| [[Kirkwood 7A300g (iPod touch)|3.0b4]]
| [[Kirkwood 7A300g (iPod touch 2G)|3.0b4]]
|-
| ?
! style="text-align:left;" | 7A312g
| [[Kirkwood 7A312g (iPhone)|3.0b5]]
| [[Kirkwood 7A312g (iPhone 3G)|3.0b5]]
| [[Kirkwood 7A312g (iPod touch)|3.0b5]]
| [[Kirkwood 7A312g (iPod touch 2G)|3.0b5]]
|-
| ?
! style="text-align:left;" | 7C97d
| [[NorthVail 7C97d (iPhone)|3.1b1]]
| [[NorthVail 7C97d (iPhone 3G)|3.1b1]]
| [[NorthVail 7C97d (iPhone 3GS)|3.1b1]]
| [[NorthVail 7C97d (iPod touch)|3.1b1]]
| [[NorthVail 7C97d (iPod touch 2G)|3.1b1]]
|-
| ?
! style="text-align:left;" | 7C106c
| [[NorthVail 7C106c (iPhone)|3.1b2]]
| [[NorthVail 7C106c (iPhone 3G)|3.1b2]]
| [[NorthVail 7C106c (iPhone 3GS)|3.1b2]]
| [[NorthVail 7C106c (iPod touch)|3.1b2]]
| [[NorthVail 7C106c (iPod touch 2G)|3.1b2]]
|-
| ?
! style="text-align:left;" | 7C116a
| [[NorthVail 7C116a (iPhone)|3.1b3]]
| [[NorthVail 7C116a (iPhone 3G)|3.1b3]]
| [[NorthVail 7C116a (iPhone 3GS)|3.1b3]]
| [[NorthVail 7C116a (iPod touch)|3.1b3]]
| [[NorthVail 7C116a (iPod touch 2G)|3.1b3]]
|}
==== 4.x ====
Please note that for the Apple TV the firmware listed in this table is the one that your Apple TV reports. See also [[Apple TV Firmware Versions]].
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
! Date (YYYY/MM/DD)
! Build
! [[k66ap|Apple TV 2G]]
! [[k48ap|iPad]]
! [[n82ap|iPhone 3G]]
! [[n88ap|iPhone 3GS]]
! [[n90ap|iPhone 4 (GSM)]]
! [[n72ap|iPod touch 2G]]
! [[n18ap|iPod touch 3G]]
! [[n81ap|iPod touch 4G]]
|-
| ?
! style="text-align:left;" | 8A230m
| colspan="2" rowspan="7" | Unavailable
| [[ApexVail 8A230m (iPhone 3G)|4.0b1]]
| [[ApexVail 8A230m (iPhone 3GS)|4.0b1]]
| rowspan="6" | Unavailable
| [[ApexVail 8A230m (iPod touch 2G)|4.0b1]]
| [[ApexVail 8A230m (iPod touch 3G)|4.0b1]]
| rowspan="8" | Unavailable
|-
| ?
! style="text-align:left;" | 8A248c
| [[ApexVail 8A248c (iPhone 3G)|4.0b2]]
| [[ApexVail 8A248c (iPhone 3GS)|4.0b2]]
| [[ApexVail 8A248c (iPod touch 2G)|4.0b2]]
| [[ApexVail 8A248c (iPod touch 3G)|4.0b2]]
|-
| ?
! style="text-align:left;" | 8A260b
| [[ApexVail 8A260b (iPhone 3G)|4.0b3]]
| [[ApexVail 8A260b (iPhone 3GS)|4.0b3]]
| [[ApexVail 8A260b (iPod touch 2G)|4.0b3]]
| [[ApexVail 8A260b (iPod touch 3G)|4.0b3]]
|-
| ?
! style="text-align:left;" | 8A274b
| [[ApexVail 8A274b (iPhone 3G)|4.0b4]]
| [[ApexVail 8A274b (iPhone 3GS)|4.0b4]]
| [[ApexVail 8A274b (iPod touch 2G)|4.0b4]]
| [[ApexVail 8A274b (iPod touch 3G)|4.0b4]]
|-
| ?
! style="text-align:left;" | 8A293
| [[Apex 8A293 (iPhone 3G)|4.0GM]]
| [[Apex 8A293 (iPhone 3GS)|4.0GM]]
| [[Apex 8A293 (iPod touch 2G)|4.0GM]]
| [[Apex 8A293 (iPod touch 3G)|4.0GM]]
|-
| ?
! style="text-align:left;" | 8B5080
| colspan="2" | Unavailable
| [[BakerVail 8B5080 (iPod touch 2G)|4.1b1]]
| [[BakerVail 8B5080 (iPod touch 3G)|4.1b1]]
|-
| ?
! style="text-align:left;" | 8B5080c
| [[BakerVail 8B5080c (iPhone 3G)|4.1b1]]
| [[BakerVail 8B5080c (iPhone 3GS)|4.1b1]]
| [[BakerVail 8B5080c (iPhone 4)|4.1b1]]
| rowspan="2" colspan="2" | Unavailable
|-
| ?
! style="text-align:left;" | 8B5091b
| [[BakerVail 8B5091b (iPhone 3G)|4.1b2]]
| [[BakerVail 8B5091b (iPhone 3GS)|4.1b2]]
| [[BakerVail 8B5091b (iPhone 4)|4.1b2]]
| [[BakerVail 8B5091b (iPod touch 2G)|4.1b2]]
| [[BakerVail 8B5091b (iPod touch 3G)|4.1b2]]
|-
| ?
! style="text-align:left;" | 8C5091e
| rowspan="6" | Unavailable
| [[JasperVail 8C5091e (iPad)|4.2b1]]
| [[JasperVail 8C5091e (iPhone 3G)|4.2b1]]
| [[JasperVail 8C5091e (iPhone 3GS)|4.2b1]]
| [[JasperVail 8C5091e (iPhone 4)|4.2b1]]
| [[JasperVail 8C5091e (iPod touch 2G)|4.2b1]]
| [[JasperVail 8C5091e (iPod touch 3G)|4.2b1]]
| [[JasperVail 8C5091e (iPod touch 4G)|4.2b1]]
|-
| ?
! style="text-align:left;" | 8C5101c
| [[JasperVail 8C5101c (iPad)|4.2b2]]
| [[JasperVail 8C5101c (iPhone 3G)|4.2b2]]
| [[JasperVail 8C5101c (iPhone 3GS)|4.2b2]]
| [[JasperVail 8C5101c (iPhone 4)|4.2b2]]
| [[JasperVail 8C5101c (iPod touch 2G)|4.2b2]]
| [[JasperVail 8C5101c (iPod touch 3G)|4.2b2]]
| [[JasperVail 8C5101c (iPod touch 4G)|4.2b2]]
|-
| ?
! style="text-align:left;" | 8C5115c
| [[JasperVail 8C5115c (iPad)|4.2b3]]
| [[JasperVail 8C5115c (iPhone 3G)|4.2b3]]
| [[JasperVail 8C5115c (iPhone 3GS)|4.2b3]]
| [[JasperVail 8C5115c (iPhone 4)|4.2b3]]
| [[JasperVail 8C5115c (iPod touch 2G)|4.2b3]]
| [[JasperVail 8C5115c (iPod touch 3G)|4.2b3]]
| [[JasperVail 8C5115c (iPod touch 4G)|4.2b3]]
|-
| ?
! style="text-align:left;" | 8C134
| [[JasperVail 8C134 (iPad)|4.2GM]]
| [[JasperVail 8C134 (iPhone 3G)|4.2GM]]
| [[JasperVail 8C134 (iPhone 3GS)|4.2GM]]
| [[JasperVail 8C134 (iPhone 4)|4.2GM]]
| [[JasperVail 8C134 (iPod touch 2G)|4.2GM]]
| [[JasperVail 8C134 (iPod touch 3G)|4.2GM]]
| [[JasperVail 8C134 (iPod touch 4G)|4.2GM]]
|-
| ?
! style="text-align:left;" | 8C134b
| [[JasperVail 8C134b (iPad)|4.2GM]]
| colspan="6" | Unavailable
|-
| ?
! style="text-align:left;" | 8C148
| [[JasperVail 8C148 (iPad)|4.2.1GM]]
| [[JasperVail 8C148 (iPhone 3G)|4.2.1GM]]
| [[JasperVail 8C148 (iPhone 3GS)|4.2.1GM]]
| [[JasperVail 8C148 (iPhone 4)|4.2.1GM]]
| [[JasperVail 8C148 (iPod touch 2G)|4.2.1GM]]
| [[JasperVail 8C148 (iPod touch 3G)|4.2.1GM]]
| [[JasperVail 8C148 (iPod touch 4G)|4.2.1GM]]
|-
| ?
! style="text-align:left;" | 8F5148b
| Unavailable
| [[DurangoVail 8F5148b (iPad)|4.3b1]]
| rowspan="5" | Unavailable
| [[DurangoVail 8F5148b (iPhone 3GS)|4.3b1]]
| [[DurangoVail 8F5148b (iPhone 4)|4.3b1]]
| rowspan="5" | Unavailable
| [[DurangoVail 8F5148b (iPod touch 3G)|4.3b1]]
| [[DurangoVail 8F5148b (iPod touch 4G)|4.3b1]]
|-
| 2011/01/12
! style="text-align:left;" | 8F5148c
| [[DurangoVail 8F5148c (Apple TV 2G)|4.2b1]]
| Unavailable
| Unavailable
| Unavailable
| Unavailable
| Unavailable
|-
| 2011/01/19
! style="text-align:left;" | 8F5153d
| [[DurangoVail 8F5153d (Apple TV 2G)|4.2b2]]
| [[DurangoVail 8F5153d (iPad)|4.3b2]]
| [[DurangoVail 8F5153d (iPhone 3GS)|4.3b2]]
| [[DurangoVail 8F5153d (iPhone 4)|4.3b2]]
| [[DurangoVail 8F5153d (iPod touch 3G)|4.3b2]]
| [[DurangoVail 8F5153d (iPod touch 4G)|4.3b2]]
|-
| 2011/02/01
! style="text-align:left;" | 8F5166b
| [[DurangoVail 8F5166b (Apple TV 2G)|4.2b3]]
| [[DurangoVail 8F5166b (iPad)|4.3b3]]
| [[DurangoVail 8F5166b (iPhone 3GS)|4.3b3]]
| [[DurangoVail 8F5166b (iPhone 4)|4.3b3]]
| [[DurangoVail 8F5166b (iPod touch 3G)|4.3b3]]
| [[DurangoVail 8F5166b (iPod touch 4G)|4.3b3]]
|-
| 2011/03/03
! style="text-align:left;" | 8F190
| Unavailable
| [[Durango 8F190 (iPad)|4.3GM]]
| [[Durango 8F190 (iPhone 3GS)|4.3GM]]
| [[Durango 8F190 (iPhone 4)|4.3GM]]
| [[Durango 8F190 (iPod touch 3G)|4.3GM]]
| [[Durango 8F190 (iPod touch 4G)|4.3GM]]
|}

==== 5.x ====
Please note that for the Apple TV the firmware listed in this table is the one that your Apple TV reports. See also [[Apple TV Firmware Versions]].
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
! Date (YYYY/MM/DD)
! Build
! [[k66ap|Apple TV 2G]]
! [[j33ap|Apple TV 3G]]
! [[k48ap|iPad]]
! [[k93ap|iPad 2 (Wi-Fi)]]
! [[k94ap|iPad 2 (GSM)]]
! [[k95ap|iPad 2 (CDMA)]]
! [[n88ap|iPhone 3GS]]
! [[n90ap|iPhone 4 (GSM)]]
! [[n92ap|iPhone 4 (CDMA)]]
! [[n18ap|iPod touch 3G]]
! [[n81ap|iPod touch 4G]]
|-
| 2011/06/07
! style="text-align:left;" | 9A5220p
| [[TellurideVail 9A5220p (Apple TV 2G)|4.4b1]]
| rowspan="10" | Unavailable
| [[TellurideVail 9A5220p (iPad)|5.0b1]]
| [[TellurideVail 9A5220p (iPad 2 Wi-Fi)|5.0b1]]
| [[TellurideVail 9A5220p (iPad 2 GSM)|5.0b1]]
| [[TellurideVail 9A5220p (iPad 2 CDMA)|5.0b1]]
| [[TellurideVail 9A5220p (iPhone 3GS)|5.0b1]]
| [[TellurideVail 9A5220p (iPhone 4)|5.0b1]]
| [[TellurideVail 9A5220p (iPhone 4 CDMA)|5.0b1]]
| [[TellurideVail 9A5220p (iPod touch 3G)|5.0b1]]
| [[TellurideVail 9A5220p (iPod touch 4G)|5.0b1]]
|-
| 2011/06/24
! style="text-align:left;" | 9A5248d
| [[TellurideVail 9A5248d (Apple TV 2G)|4.4b2]]
| [[TellurideVail 9A5248d (iPad)|5.0b2]]
| [[TellurideVail 9A5248d (iPad 2 Wi-Fi)|5.0b2]]
| [[TellurideVail 9A5248d (iPad 2 GSM)|5.0b2]]
| [[TellurideVail 9A5248d (iPad 2 CDMA)|5.0b2]]
| [[TellurideVail 9A5248d (iPhone 3GS)|5.0b2]]
| [[TellurideVail 9A5248d (iPhone 4)|5.0b2]]
| [[TellurideVail 9A5248d (iPhone 4 CDMA)|5.0b2]]
| [[TellurideVail 9A5248d (iPod touch 3G)|5.0b2]]
| [[TellurideVail 9A5248d (iPod touch 4G)|5.0b2]]
|-
| 2011/07/12
! style="text-align:left;" | 9A5259f
| [[TellurideVail 9A5259f (Apple TV 2G)|4.4b3]]
| [[TellurideVail 9A5259f (iPad)|5.0b3]]
| [[TellurideVail 9A5259f (iPad 2 Wi-Fi)|5.0b3]]
| [[TellurideVail 9A5259f (iPad 2 GSM)|5.0b3]]
| [[TellurideVail 9A5259f (iPad 2 CDMA)|5.0b3]]
| [[TellurideVail 9A5259f (iPhone 3GS)|5.0b3]]
| [[TellurideVail 9A5259f (iPhone 4)|5.0b3]]
| [[TellurideVail 9A5259f (iPhone 4 CDMA)|5.0b3]]
| [[TellurideVail 9A5259f (iPod touch 3G)|5.0b3]]
| [[TellurideVail 9A5259f (iPod touch 4G)|5.0b3]]
|-
| 2011/07/22
! style="text-align:left;" | 9A5274d
| Unavailable
| [[TellurideVail 9A5274d (iPad)|5.0b4]]
| [[TellurideVail 9A5274d (iPad 2 Wi-Fi)|5.0b4]]
| [[TellurideVail 9A5274d (iPad 2 GSM)|5.0b4]]
| [[TellurideVail 9A5274d (iPad 2 CDMA)|5.0b4]]
| [[TellurideVail 9A5274d (iPhone 3GS)|5.0b4]]
| [[TellurideVail 9A5274d (iPhone 4)|5.0b4]]
| [[TellurideVail 9A5274d (iPhone 4 CDMA)|5.0b4]]
| [[TellurideVail 9A5274d (iPod touch 3G)|5.0b4]]
| [[TellurideVail 9A5274d (iPod touch 4G)|5.0b4]]
|-
| 2011/08/06
! style="text-align:left;" | 9A5288d
| [[TellurideVail 9A5288d (Apple TV 2G)|4.4b5]]
| [[TellurideVail 9A5288d (iPad)|5.0b5]]
| [[TellurideVail 9A5288d (iPad 2 Wi-Fi)|5.0b5]]
| [[TellurideVail 9A5288d (iPad 2 GSM)|5.0b5]]
| [[TellurideVail 9A5288d (iPad 2 CDMA)|5.0b5]]
| [[TellurideVail 9A5288d (iPhone 3GS)|5.0b5]]
| [[TellurideVail 9A5288d (iPhone 4)|5.0b5]]
| [[TellurideVail 9A5288d (iPhone 4 CDMA)|5.0b5]]
| [[TellurideVail 9A5288d (iPod touch 3G)|5.0b5]]
| [[TellurideVail 9A5288d (iPod touch 4G)|5.0b5]]
|-
| 2011/08/19
! style="text-align:left;" | 9A5302b
| [[TellurideVail 9A5302b (Apple TV 2G)|4.4b6]]
| [[TellurideVail 9A5302b (iPad)|5.0b6]]
| [[TellurideVail 9A5302b (iPad 2 Wi-Fi)|5.0b6]]
| [[TellurideVail 9A5302b (iPad 2 GSM)|5.0b6]]
| [[TellurideVail 9A5302b (iPad 2 CDMA)|5.0b6]]
| [[TellurideVail 9A5302b (iPhone 3GS)|5.0b6]]
| [[TellurideVail 9A5302b (iPhone 4)|5.0b6]]
| [[TellurideVail 9A5302b (iPhone 4 CDMA)|5.0b6]]
| [[TellurideVail 9A5302b (iPod touch 3G)|5.0b6]]
| [[TellurideVail 9A5302b (iPod touch 4G)|5.0b6]]
|-
| 2011/08/31
! style="text-align:left;" | 9A5313e
| [[TellurideVail 9A5313e (Apple TV 2G)|4.4b7]]
| [[TellurideVail 9A5313e (iPad)|5.0b7]]
| [[TellurideVail 9A5313e (iPad 2 Wi-Fi)|5.0b7]]
| [[TellurideVail 9A5313e (iPad 2 GSM)|5.0b7]]
| [[TellurideVail 9A5313e (iPad 2 CDMA)|5.0b7]]
| [[TellurideVail 9A5313e (iPhone 3GS)|5.0b7]]
| [[TellurideVail 9A5313e (iPhone 4)|5.0b7]]
| [[TellurideVail 9A5313e (iPhone 4 CDMA)|5.0b7]]
| [[TellurideVail 9A5313e (iPod touch 3G)|5.0b7]]
| [[TellurideVail 9A5313e (iPod touch 4G)|5.0b7]]
|-
| 2011/10/04
! style="text-align:left;" | 9A334
| Unavailable
| [[Telluride 9A334 (iPad)|5.0GM]]
| [[Telluride 9A334 (iPad 2 Wi-Fi)|5.0GM]]
| [[Telluride 9A334 (iPad 2 GSM)|5.0GM]]
| [[Telluride 9A334 (iPad 2 CDMA)|5.0GM]]
| [[Telluride 9A334 (iPhone 3GS)|5.0GM]]
| [[Telluride 9A334 (iPhone 4)|5.0GM]]
| [[Telluride 9A334 (iPhone 4 CDMA)|5.0GM]]
| [[Telluride 9A334 (iPod touch 3G)|5.0GM]]
| [[Telluride 9A334 (iPod touch 4G)|5.0GM]]
|-
| 2011/12/12
! style="text-align:left;" | 9B5127c
| [[HoodooVail 9B5127c (Apple TV 2G)|5.0b1]]
| rowspan="2" colspan="9" | Unavailable
|-
| 2011/12/12
! style="text-align:left;" | 9B5141a
| [[HoodooVail 9B5141a (Apple TV 2G)|5.0b2]]
|}

==== 6.x ====
Please note that for the Apple TV the firmware listed in this table is the one that your Apple TV reports. See also [[Apple TV Firmware Versions]].
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
! Date (YYYY/MM/DD)
! Build
! [[k66ap|Apple TV 2G]]
! [[j33ap|Apple TV 3G]]
! [[k93ap|iPad 2 (Wi-Fi)]]
! [[k94ap|iPad 2 (GSM)]]
! [[k95ap|iPad 2 (CDMA)]]
! [[k93aap|iPad 2 R2]]
! [[j1ap|iPad 3 (Wi-Fi)]]
! [[j2ap|iPad 3 (CDMA)]]
! [[j2aap|iPad 3 (Global)]]
! [[n88ap|iPhone 3GS]]
! [[n90ap|iPhone 4 (GSM)]]
! [[n92ap|iPhone 4 (CDMA)]]
! [[n94ap|iPhone 4S]]
! [[n81ap|iPod touch 4G]]
|-
| 2012/06/11
! style="text-align:left;" | 10A5316k
| [[SundanceVail 10A5316k (Apple TV 2G)|6.0b1]]
| [[SundanceVail 10A5316k (Apple TV 3G)|6.0b1]]
| [[SundanceVail 10A5316k (iPad 2 Wi-Fi)|6.0b1]]
| [[SundanceVail 10A5316k (iPad 2 GSM)|6.0b1]]
| [[SundanceVail 10A5316k (iPad 2 CDMA)|6.0b1]]
| [[SundanceVail 10A5316k (iPad 2 Wi-Fi R2)|6.0b1]]
| [[SundanceVail 10A5316k (iPad 3 Wi-Fi)|6.0b1]]
| [[SundanceVail 10A5316k (iPad 3 CDMA)|6.0b1]]
| [[SundanceVail 10A5316k (iPad 3 Global)|6.0b1]]
| [[SundanceVail 10A5316k (iPhone 3GS)|6.0b1]]
| [[SundanceVail 10A5316k (iPhone 4)|6.0b1]]
| [[SundanceVail 10A5316k (iPhone 4 CDMA)|6.0b1]]
| [[SundanceVail 10A5316k (iPhone 4S)|6.0b1]]
| [[SundanceVail 10A5316k (iPod touch 4G)|6.0b1]]
|}

[[Category:VFDecrypt]]

N94AP

2011-11-20T12:07:14Z

Cody:

[[Image:IPhone4S black.jpg|right|thumb|iPhone 4S]]
This is the iPhone 4S introduced by Tim Cook at Apple's 'Let's talk iPhone' event on October 4th 2011. It is very similar to [[n92ap|the iPhone 4 (CDMA)]]. It contains a faster GOBI GSM/CDMA chip, a SIM slot, and a similar (but redesigned) antenna.

== [[S5L8940|Application Processor]] ==
It uses the [[S5L8940|Apple A5]] CPU found in the iPad2 as well.

== [[Baseband Device]] ==
[[MDM6610|Qualcomm MDM6610]]

== Location ==
The iPhone 4S has hardware support for both GPS and GLONASS signals for location determination included with the [[MDM6610|Qualcomm MDM6610]]. Apple's online advertising material for the 4S mentions GLONASS support, but as of October 20, 2011, no further details about this support have been publicly revealed.

== Specifications ==
*'''Color''': Black, White
*'''Size''': 115.2 mm (4.5 inches) (h), 58.6 mm (2.31 inches) (w), 9.3 mm (0.37 inches) (d)
*'''Weight''': 140 g (4.9 oz)
*'''Battery''': Standby up to 200 hours, talk time up to 7 hours on 3G
*'''Rear camera''': 8MP with Autofocus and manual focus (''Tap to focus''), supporting HD 1080p video recording @ 30FPS
*'''Front camera''': VGA photos and video @ 30 FPS, supporting [[FaceTime]] Video Calls
*'''[[Siri]]''': Voice Control Feature (still beta)
*'''RAM''': 512MB

/Applications/Compass.app

2011-11-20T11:33:16Z

Cody:

The compass is present in all iPhones since the [[iPhone 3GS|3GS]] and all iPad models. A 'magnetometer' (the formal term for a digital compass) is a scientific instrument used to measure the strength and/or direction of the magnetic field in the vicinity of the instrument. The compass found in the iPhone 3GS is the AKM Semiconductor AKM8973, whereas the iPhone 4 and iPad use the AKM Semiconductor AKM8975. [http://www.asahi-kasei.co.jp/ake/en/technology/angle.html]

Unsolved problems

2009-09-10T07:39:52Z

Cody:

Use your imagination; what do you want?

==Exploits Needed==
* [[Unlock 2.0|3G iPhone Baseband]] - Partly done ([[ultrasn0w]] uses [[AT+XLOG Vulnerability]] which is available in all versions until 04.26.08)
* [[Baseband Bootrom|iPhone 3G Baseband Bootrom]] (breaking the chain of trust)
* <del>[[S5L8720|iPod Touch 2G S5L Bootrom]] (breaking the chain of trust)</del> - Done ([[0x24000 Segment Overflow]])
* [[S5L8920 (Bootrom)|iPhone 3GS Bootrom]] (breaking the chain of trust or finding a way to write LLB without using an iBoot exploit)

==Work to be done==
*[[iPhoneLinux|Port Linux to the iPhone]] [http://www.iphonelinux.org/]
**[[Port (Google's mobile os) to the iPhone]] [http://code.google.com/android/ Android Link]
*[[Increased Bluetooth Profile Support]]
*IP over iTunes
*Getting NMEA output from the GPS
*IPFW kernel extension

== Investigation ==
*[[Research: Pwnage Patches]]<br>
*[[Research: Re-allowing unsigned ramdisks and boot-args with the 2.* iBoot]]
*[[2.0 and 1.1.4 dual boot]]

0x24000 Segment Overflow

2009-09-10T07:34:07Z

Cody: /* Note */ removed section about it being sold, as it is not

Also known by its codename, 24kPwn, this was the first exploit in the [[S5L8720]] that allowed us to bypass the bootrom signature checks on [[LLB]] and create what is known as an [[untethered jailbreak]].

==Credit==
A "hybrid" dev team, in alphabetical order: '''chronic''', '''CPICH''', '''ius''', '''MuscleNerd''', '''planetbeing''', '''pod2g''', '''posixninja''', et al. (anyone wishing to be unnamed)

==Background==

Upon boot-up, the [[S5L8720]] and [[S5L8920]] SoC have a MIU configuration which maps the [[VROM (S5L8720)|Secure ROM]] to 0x0, providing the newly turned on device with an ARM exception vector and the first code to execute. This MIU configuration also maps a small amount of SRAM to 0x22000000 for the [[S5L8720]], and 0x84000000 for the [[S5L8920]]. Statically allocated variables, heap, and stack must use the SRAM, as "[[VROM (S5L8720)|Secure ROM]]" is unwritable. A region of memory starting from (SRAM Start)+24000 is used for this purpose. The region of memory from the start of SRAM to (SRAM Start)+0x24000 is used as a buffer for loading the [[LLB|next stage bootloader]] code. The [[LLB]] code is stored in [[NOR]], along with code for all other bootloader stages, as well as art resources (boot logos) and the [[DeviceTree|OpenFirmware device tree]] to provide to the XNU [[kernel]]. The first portion (first 0x160 bytes) of memory at (SRAM Start)+0x24000 is used for initialized statically allocated variables. Shortly after boot, values for that region are initialized from [[VROM (S5L8720)|Secure ROM]].

==Vulnerability==

The code that reads the [[LLB]] img3 from [[NOR]] into memory does not check the size of the [[LLB]] image being loaded, instead taking the size directly from the non-signature checked portion of its img3 header on the [[NOR]] (see ROM offset 0x2178). Any image greater than 0x24000 bytes in length will begin overwriting the portion of memory used to store Secure ROM statically allocated variables. Immediately vulnerable data includes USB data structures for [[DFU]] mode, a pointer to the bdev list structure, task list structures for the Secure ROM's scheduler, as well as the addresses of the hardware SHA1 registers. All of the above are potential avenues for exploitation. The method described below uses the SHA1 register addresses.

This vulnerability was discovered independently by '''pod2g''' and '''MuscleNerd'''.

== Exploit==

The goal of the exploit is to gain arbitrary code execution capability.

The exploit, as proposed by '''planetbeing''', uses the overflow to overwrite one of the addresses of the SHA1 registers. The particular register is the only one that directly copies data to be hashed into the hardware (or into an arbitrary memory location, once the destination address has been overwritten). Code execution is achieved by writing data into the stack, specifically by overwriting the LR of the function performing the write to the "SHA1 register" so that instead of returning to the main SHA1 routine, it returns to a chosen location in memory that contains the payload code. The location chosen is within the range of memory that is filled with the [[LLB]] img3, so that the payload code can be placed within the [[LLB]] img3.

The challenge is determining what to put in as the SHA1 register location so that the right portion of stack can be overwritten with the payload LR. This can be challenging without having access to any sort of exception dump (crash register dumps in the bootrom had been disabled by Apple). '''planetbeing''' performed a static analysis of a very detailed IDB produced by '''chronic''' and '''CPICH''' and determined the theoretical call stack for both of the invocations of the SHA1 hardware within the bootrom code [http://pastie.org/414981].

In-situ verification of the LR location was performed by '''posixninja'''. '''CPICH''' discovered a way to alter the img3 DER so that the second invocation of the SHA1 hardware was not performed without affecting the first, allowing better confirmation that this step was performed properly.

The final SHA1 register address was chosen so that the first dword of the DATA tag of the [[LLB]] img3 would replace sub_5E54's LR. This is because this is the first dword of the img3 that can be altered without substantially changing the img3's structure (and possibly disrupting earlier parsing code). The LR replacement must be done the first time the exploit is triggered (by the invocation of sub_5E54), or else the bootrom would crash. Since sub_5E54 takes 0x40 bytes of data at a time, the replacement LR thus must be within the first 0x40 bytes of data to be hashed. Data to be hashed starts at 0xC bytes from the start of the img3, and the first dword of the DATA tag is 0x20 bytes from the start of the img3. Thus, the SHA1 register address chosen should be 0x20 - 0xC = 0x14 bytes before sub_5E54's LR. So, it must be 0x2202FE24. Note that the exploit will also trash up to 0x2202FE24 + 0x40 = 0x2202FE64. So a sizeable portion of doComputeSHA1's stack will be trashed as well.

The final exploit img3 was verified by '''posixninja''' under '''planetbeing''''s instructions to allow arbitrary code execution. It was a regular Img3 with padding up to 0x24000 bytes. The next 0x100 bytes were taken from the original initialization values for 0x22024000. However, 0x240FC, the offset of the SHA1 register address, was altered to 0x2202FE24. The first dword of the DATA tag (offset 0x20) was altered to 0x22023000. Payload code was placed at offset 0x23000.

==Payload==

The goal of the payload is to allow an unsigned [[LLB]] to be loaded.

There are several ways that can be used, including directly calling the JumpToMemory function which is designed to prepare the SoC and invoke the [[LLB]] code. However, it's designed to be used on decrypted, unpacked code, and the [[LLB]] code currently resides in an encrypted from within the img3's DATA tag. The simplest solution is thus to use the bootrom's own machinery to decrypt and execute the code.

The final payload evolved out of a discussion between '''pod2g''' and '''planetbeing''', based on an IDB documented by '''pod2g''', '''chronic''', '''CPICH''', et al. The lowest impact solution is to apply the pwnage patch to the rsaCheck subroutine of the bootrom, and returning from the payload from computing the SHA1 without crashing the bootrom. However, in this case, since bootrom text is unwritable, this was not a viable solution.

The next lowest impact solution is to return from the entire parseFirmwareFooter function with a successful value, instead of the failure value it would normally return if signature checks fail. This would skip any remaining code in that subroutine. This solution did not work in-situ. Failures checking the epoch tags prevented the firmware from being executed. The cause of this was not investigated.

The final payload was to return past the verification of epoch and other tags in the [[LLB]] img3 to a spot right before the DATA tag was loaded from memory and decrypted. R5 was set to 0 to ensure decryption would not be skipped. The original value for the first DATA dword (before we had to overwrite it with the exploit LR) is written back to 0x22000020 by the payload, and the original SHA1 register value was written back to 0x2202FE24 to ensure the payload only activates once.

==Deployment==

Although the exploitive [[LLB]] can be manually written to [[NOR]] by bootstrapping from a tethered jailbreak, the easiest way is to use the Apple restore process itself. Apple's Restore process will write arbitrary img3s onto the [[NOR]], even if they fail signature checks. However, the "total size" value of the img3 is fixed up by the kernel before it is written to [[NOR]]. This would negate the exploit. However, '''MuscleNerd''' discovered that this could be bypassed by including the padding in another tag, such as CERT. Then, the written exploit [[LLB]] would have the "correct", exploitive total size.

==Timing Impact==
This exploit would have allowed the [[pwnage]] of the next generation iPhone without the discovery of an additional code execution vulnerability (required to write the exploit [[LLB]]), provided that the bug still existed in the next generation's bootrom. Even though it was too late to patch the bootrom, it was not too late for Apple to repair the restore process in the stock IPSW, removing the method used to get the exploitive [[LLB]] onto the device. Before, Apple would have no reason to fix this, since writing arbitrary data to [[NOR]] does not negate their chain of trust. However, now that a way has been found, they were able to prioritize a fix for this oversight thus making the permanent [[pwnage]] of future devices significantly more difficult.

Thanks to irresponsible handling of the exploit by a third-party company known as [[NitroKey]] who were interested in making financial gain from the work of others, this eventuality became a near-certainty and pretty much erased the possibility of a day-of-release jailbreak for the [[iPhone 3GS]] and the third-generation iPod touch. In addition, to counteract the exploit, with the early exposure of the exploit, Apple were able to add the [[ECID]] tag to the [[IMG3 File Format|IMG3 format]] in the iPhone 3GS. The early leak of the exploit allowed Apple to understand that an iBoot exploit would be necessary to flash the required oversized LLB and through doing so, Apple have prevented this exploit from allowing the iPhone 3GS to be permanently jailbroken through this exploit unless new iBoot hacks can be found in every firmware release. May NitroKey burn in hell for all eternity.

==3GS Implementation==

The exploit remains the same in spirit.

The call tree and stacks analysis is very similar although a few bytes here and there changed it slightly. It was again done manually but afterward, and out of fun, an IDA Python Script was written to automate the process. The new static analysis can be seen here [http://pastie.org/551212], and the IDA Python Script for it there [http://github.com/iZsh/IDA-Python-Scripts/].

The main differences are:

* the SRAM is at 0x84000000 instead of 0x22000000
* the Original value of the first DATA dword is written back to 0x84000040 (which was overwritten by the LR address)
* the SHA1 register original value is written back to 0x840241CC
* '''The decrypt flag is not held in R5 anymore''', but in a local variable of the function "my_process_module" (sub_2564). An extra static analysis tells us this variable is held at 0x84033F30, thus that's where you have to store your 0x0 value before returning to this function.

[[Category:Exploits]]