The iPhone Wiki - User contributions [en]

Talk:Jasper 8C148 (iPod3,1)

2010-11-23T02:16:43Z

Cool name: New page: Please follow the template for keys --~~~~

Please follow the [[Template:Keys|template]] for keys --[[User:Cool name|Cool name]] 02:16, 23 November 2010 (UTC)

Jasper 8C148 (iPod4,1)

2010-11-22T22:35:45Z

Cool name:

== Decryption Keys ==
=== Root Filesystem (038-0017-002.dmg) ===
*'''[[VFDecrypt]] Key''': 982437b30d334c744c94b9a73ab70e0fc6ed94c181b2a8b0fde6ee03f2546cc9b2c5b01c

=== Update Ramdisk (038-0024-002.dmg) ===
* '''IV''': 509e699fcfbc5317fa5eb3e79fc5a932
* '''Key''': 9cee1bb0bf019db324eb266f426b80fbcfba614464932c6b416ed039fbde73dd

=== Restore Ramdisk (038-0032-002.dmg) ===
* '''IV''': 9b20ae16bebf4cf1b9101374c3ab0095
* '''Key''': 06849aead2e9a6ca8a82c3929bad5c2368942e3681a3d5751720d2aacf0694c0

=== AppleLogo ===
* '''IV''': 0dcee7d1b9982793558d588d84c44af0
* '''Key''': 91866d7b929b971c72fa6e90530a5b2a361bed9486f2cb884b632f61253ed204

=== BatteryCharging0 ===
* '''IV''': bf594f1948cfe699ed81978da918c9a2
* '''Key''': 6059d6622dc37946e52d2fe87d64541b2142362a9f33576647d0e4210bd98d1b

=== BatteryCharging1 ===
* '''IV''': 55fbd7a9c6b27af1edc3d79a1e4a7a5e
* '''Key''': e4b8dd16397ce416a6309b594034c8e024c245dcff046014331d71e307047939

=== BatteryFull ===
* '''IV''': 6ea98a78db9deca4cc1d37ab2b01bf72
* '''Key''': 311b3abb89083cd245b2c00bb9207b3fa721435b4f53836a97c38cfde4b20268

=== BatteryLow0 ===
* '''IV''': 411cf59c075aed7412eac6cb209b635f
* '''Key''': 809a6d52d5ed34d6d35397c1bce23190a09e353418394b33e60b5257de1ee117

=== BatteryLow1 ===
* '''IV''': 76d3f38f8badef93c8a243f4e96e739e
* '''Key''': fdacba0a29f3b650cd135864ee95cb088cb905342912de93fd5a7bf288c99d75

=== DeviceTree ===
* '''IV''': 1ff05cfa06699abc1acd8579b28a8c5f
* '''Key''': 3bd7550c4625dc4aeec8fe9d772ae60cd6ddf84b4c3444a941f8b776f357c4de

=== GlyphCharging ===
* '''IV''': 604dfca9640b9f800a3b478adbe63aa0
* '''Key''': 3fa0ae7d2411725bfbffff4e06adcf24373d641703a0cd24d2fa34c64544f90a

=== GlyphPlugin ===
* '''IV''': 746787d5ea62187e084c2d0c1f9399cc
* '''Key''': edc4ee23eff28d4b021e23d986972558bc9d108b7332abff1600e0e01eac23bf

=== [[iBEC]] ===
* '''IV''': c211845c6c32017cb04301569bb9ea33
* '''Key''': d281e5726adb36490b68a81be462d569ebb916b477691b4dd7ed9781258b5779

=== [[IBoot (Bootloader)|iBoot]] ===
* '''IV''': 2a8c14d7cc8a2838d14fa0eeb1156e64
* '''Key''': e26ed45c22f54c258d755c79e129ce04bb35b76154714cd7c0f3661f6d1d1120

=== [[iBSS]] ===
* '''IV''': 5a01a1e31d2ae895690cd279dbd5e3c0
* '''Key''': 6d26c20f472d9ed5ab6219e632e35b4c582c1c402104aa39d75471171c88d473

=== [[Kernelcache]] ===
* '''IV''': a6833ce70afdbf37162dca25de6c0c99
* '''Key''': 44ba15a1ab554017c5a67826ddcdcaffb24f8e96edb3f2ecaf8f5416faba2cc3

=== [[LLB]] ===
* '''IV''': 8e6732e84b11e8d4fa4b97b158edca25
* '''Key''': ed4d19566a418b85db4b2c1c1acf06dee1ba065cbb9a4a322c300011b6eb7c3a

=== RecoveryMode ===
* '''IV''': 9a59ae16a84808e8d7546269e36a21c0
* '''Key''': ff278adcb52647785fd58ad689739fdcdace7acd08d932b4c32d54ea2c2032d8

Jasper 8C148 (iPod4,1)

2010-11-22T22:34:46Z

Cool name: Fixed the formatting, and added the keys for the correct kernel for the device (n81)

== Decryption Keys ==
=== Root Filesystem (038-0017-002.dmg) ===
*'''[[VFDecrypt]] Key''': 982437b30d334c744c94b9a73ab70e0fc6ed94c181b2a8b0fde6ee03f2546cc9b2c5b01c

=== Update Ramdisk (038-0024-002.dmg) ===
* '''IV''': 509e699fcfbc5317fa5eb3e79fc5a932
* '''Key''': 9cee1bb0bf019db324eb266f426b80fbcfba614464932c6b416ed039fbde73dd

=== Restore Ramdisk (XXX-XXXX-XXX.dmg) ===
* '''IV''': 9b20ae16bebf4cf1b9101374c3ab0095
* '''Key''': 06849aead2e9a6ca8a82c3929bad5c2368942e3681a3d5751720d2aacf0694c0

=== AppleLogo ===
* '''IV''': 0dcee7d1b9982793558d588d84c44af0
* '''Key''': 91866d7b929b971c72fa6e90530a5b2a361bed9486f2cb884b632f61253ed204

=== BatteryCharging0 ===
* '''IV''': bf594f1948cfe699ed81978da918c9a2
* '''Key''': 6059d6622dc37946e52d2fe87d64541b2142362a9f33576647d0e4210bd98d1b

=== BatteryCharging1 ===
* '''IV''': 55fbd7a9c6b27af1edc3d79a1e4a7a5e
* '''Key''': e4b8dd16397ce416a6309b594034c8e024c245dcff046014331d71e307047939

=== BatteryFull ===
* '''IV''': 6ea98a78db9deca4cc1d37ab2b01bf72
* '''Key''': 311b3abb89083cd245b2c00bb9207b3fa721435b4f53836a97c38cfde4b20268

=== BatteryLow0 ===
* '''IV''': 411cf59c075aed7412eac6cb209b635f
* '''Key''': 809a6d52d5ed34d6d35397c1bce23190a09e353418394b33e60b5257de1ee117

=== BatteryLow1 ===
* '''IV''': 76d3f38f8badef93c8a243f4e96e739e
* '''Key''': fdacba0a29f3b650cd135864ee95cb088cb905342912de93fd5a7bf288c99d75

=== DeviceTree ===
* '''IV''': 1ff05cfa06699abc1acd8579b28a8c5f
* '''Key''': 3bd7550c4625dc4aeec8fe9d772ae60cd6ddf84b4c3444a941f8b776f357c4de

=== GlyphCharging ===
* '''IV''': 604dfca9640b9f800a3b478adbe63aa0
* '''Key''': 3fa0ae7d2411725bfbffff4e06adcf24373d641703a0cd24d2fa34c64544f90a

=== GlyphPlugin ===
* '''IV''': 746787d5ea62187e084c2d0c1f9399cc
* '''Key''': edc4ee23eff28d4b021e23d986972558bc9d108b7332abff1600e0e01eac23bf

=== [[iBEC]] ===
* '''IV''': c211845c6c32017cb04301569bb9ea33
* '''Key''': d281e5726adb36490b68a81be462d569ebb916b477691b4dd7ed9781258b5779

=== [[IBoot (Bootloader)|iBoot]] ===
* '''IV''': 2a8c14d7cc8a2838d14fa0eeb1156e64
* '''Key''': e26ed45c22f54c258d755c79e129ce04bb35b76154714cd7c0f3661f6d1d1120

=== [[iBSS]] ===
* '''IV''': 5a01a1e31d2ae895690cd279dbd5e3c0
* '''Key''': 6d26c20f472d9ed5ab6219e632e35b4c582c1c402104aa39d75471171c88d473

=== [[Kernelcache]] ===
* '''IV''': a6833ce70afdbf37162dca25de6c0c99
* '''Key''': 44ba15a1ab554017c5a67826ddcdcaffb24f8e96edb3f2ecaf8f5416faba2cc3

=== [[LLB]] ===
* '''IV''': 8e6732e84b11e8d4fa4b97b158edca25
* '''Key''': ed4d19566a418b85db4b2c1c1acf06dee1ba065cbb9a4a322c300011b6eb7c3a

=== RecoveryMode ===
* '''IV''': 9a59ae16a84808e8d7546269e36a21c0
* '''Key''': ff278adcb52647785fd58ad689739fdcdace7acd08d932b4c32d54ea2c2032d8

Talk:AES Keys

2010-11-11T19:32:07Z

Cool name:

==Greenpois0n Method==
After GP does its magic and the device boots into the patched iBSS, I cannot get the command to decrypt the KBAG to work. In iRecovery, 'go aes dec [long KBAG string]' gives no output. Commands like bgcolor, reboot, etc. work, but I cannot get any feedback from the device to give me the decrypted KBAG. Has anyone gotten this to work? --[[User:Cool name|Cool name]] 16:01, 11 November 2010 (UTC)
:you need a [[payload]] or run -s flag on [[IBSS]] --[[User:Liamchat|liamchat]] 16:29, 11 November 2010 (UTC)
::I'm pretty sure the payload is already initialized by running GP, because when opening the iRecovery console with 'sudo ./irecovery -s' it spits out stuff about Greenpois0n initializing, aes_crypto_cmd being patched, etc, and it is an iBSS. My trouble is getting the device to respond to the go aes dec command, I think it may be a problem with iRecovery but not sure --[[User:Cool name|Cool name]] 17:03, 11 November 2010 (UTC)
:::well what copy of [[IRecovery]] do you have i know that the one from [[User:GreySyntax]] works also try an [[IRecovery]] script like --[[User:Liamchat|liamchat]] 17:43, 11 November 2010 (UTC)
go aes dec AACACFB9258D7DFBF7D46F21BD9BF27C7E67C673594B7DEE4FF8FE1F08040B1F
go aes dec FF47F3DA0949016984CDED28E286C45CB14B1962B328F82589608C5A5D0A4050
go aes dec 73FFC67694FC821AB9C21CB3CC9A64792D14320F917F469B4935110284990778
go aes dec 3DD9554AB61398A3B6323FA71730A4243837777651DFB8AD212B81ECF194C653
go aes dec 3D2B301E5A7069D52DA258C4B0A2209FA9BA4CEDB120688FC51D3BF1EDEDE5BC
go aes dec E996535613828554253DC21B4875C4BB371FF21699C2D2AF8C02E1137EB1951F
go aes dec 3D538743E45B5B6B6C190B2BBACA705372A3147CC9A60C6856EE2B9B1E60FD85
go aes dec 5FCF5DA27AC995B0B10D76C42ADD5F0BB9268FA88A045EDCCDBC946A73A7CFDC
go aes dec 68D3DE8EA8CC1707D08C983E745EA6A25E40FD532A5BD3BF7760BD540BE257DC
go aes dec 1AE9223C4B8AEBD5F0A30C910212EC8171E3BFC2EF7BF802A39C9C5F45939B2C
go aes dec 87CE52FFEB8E4FB685BA7FA37CBAC0004C9C0B0274FB8A7C1E06D85796063DF0
go aes dec BDB129D92704104423940EC40913FABD30E676CD800E523273DA4E38065B0E13
go aes dec 55D6DE657EB16C5563551C4DA26EE12197783C7100A92695D2B74802F10155C1
go aes dec BA6A3959FBC43D3BCF2708640D5E7B4E5C2306C7ED8A34F7ABC3F49EE6D0BDD4
go aes dec B6689C5BA40B644470C51C35257B984F97F9BE8A3E620086A5A726D7A2C1B7B1
go aes dec 874AD4B93947DAA4D14DDACD3F948F2EFAA207BF6E6FDE3C9D6248E72186894B
go aes dec 9C51D82560C30D976F374F5CB7CC2A7E286FF0067169EA393A8285AC74129D05
/exit note: these are the [[KBAG]]'s of [[Northstar 7D11 (iPod touch 2G)]]
::::--[[User:Liamchat|liamchat]] 18:25, 11 November 2010 (UTC)
:::::Thank you, GreySyntax's version of iRecovery did the trick :) --[[User:Cool name|Cool name]] 19:32, 11 November 2010 (UTC)

Talk:AES Keys

2010-11-11T17:03:38Z

Cool name:

Talk:AES Keys

2010-11-11T16:01:48Z

Cool name: New page: ==Greenpois0n Method== After GP does its magic and the device boots into the patched iBSS, I cannot get the command to decrypt the KBAG to work. In iRecovery, 'go aes dec [long KBAG strin...

Baker 8B117 (iPod4,1)

2010-09-26T21:23:27Z

Cool name: /* Decryption Keys */

Baker 8B117 is iOS 4.1.

== Decryption Keys ==
=== Root Filesystem (018-7062-093.dmg) ===
*'''[[VFDecrypt Keys|VFDecrypt]] Key''': e7de54b25167afc66e381ade1d5e25c6392757497cfd92826a3111772731ba0b70742b90

=== [[Update Ramdisk]] (018-7074-092.dmg) ===
* '''IV''': 4445214ed192b6ccfe6953c6ae80c55e
* '''Key''': 7f50d391295747a06d03cdb2ae536fa089a368e473a470148f44750712c58105

=== [[Restore Ramdisk]] (018-7082-092.dmg) ===
* '''IV''': 103ae8786d55bebdea996a56706641c9
* '''Key''': a80b3c27041f09d4554bbf4af59dd5bcea38bd4fe2faf82d8d6f62853ec6b337

=== AppleLogo ===
* '''IV''': e01950e29b6dab9990555041916ecabf
* '''Key''': 3f1c88e1297b29db7dccee73aaf66076f04abd17180ecad87d2fd993fbd97800

=== BatteryCharging0 ===
* '''IV''': 8fc19d578743ce25e5cafd7a6af6bfc4
* '''Key''': 96415f515e21b485cd7c2ca8d2daffd747f629ceb00ddbb260d0fb6d3be27085

=== BatteryCharging1 ===
* '''IV''': 58c85d4a6db5d714c3ac73f406ef5db3
* '''Key''': 1b6ae72875b6bb0d060027ab711009472ce238b8de5d18132f54ab61791a8dfb

=== BatteryFull ===
* '''IV''': 0913cdec90342840d372ad027c8abdec
* '''Key''': 46466217bb4f87f6f5f70af0021b5c41301dcc3e19d0f5d8fcb352ce2c2d90f3

=== BatteryLow0 ===
* '''IV''': c9739f169b2cdcd0780fe1f292ea79be
* '''Key''': f3d0007e984aa9201a6a87cb4d76835717255e6b6caaade4039d3f8899231b74

=== BatteryLow1 ===
* '''IV''': bbc56f1b02a1d8e415bb44ec79e1e138
* '''Key''': 976ca0a3f2d1aaaede1db3ba986a000f4db6b355c7636479b62c3f22c3462442

=== DeviceTree ===
* '''IV''': 130d84ea95928a861e4137a7443a226f
* '''Key''': e038c11f657d2a84953ab7b0f1bdcc6c2676d8fa58740c07a25914e3817ee918

=== GlyphCharging ===
* '''IV''': 2157ba97f0e6fe664919a1a6b9a3de22
* '''Key''': cafa39e18b56b6135d01618aeb156bf221d936b9f9cb9179a6c86bf976af8ebe

=== GlyphPlugin ===
* '''IV''': b51a5ad694ff975c17f9124ed7fc5f69
* '''Key''': 84ea87beb4bb8d0b77ca391008a4cd4877fd2cb0107e3c6b78a5341a858550d1

=== [[iBEC]] ===
* '''IV''': 3b7db12125cfd030aa8bfba1fac81078
* '''Key''': 106a8f42a14e653a0ffd5c0781a7ec794cb98493839c5428e2a14d07865dd442

=== [[iBoot]] ===
* '''IV''': e86ec8668ca7e9d3d6e77f4a6493cff5
* '''Key''': 6d4db59b6aa0188e0f7e89ad51923da18d19d684d90c26606218b76ee661ba55

=== [[iBSS]] ===
* '''IV''': c58929f652c1c086f70f941f3bb31058
* '''Key''': 358e67475d675410517ccbfcbbc38fa4c56d0e892b627460851a1fa5e9b430ab

=== [[Kernelcache]] ===
* '''IV''': 69d8e834a775e8959266815dbd54f10d
* '''Key''': a939e1600aea7c03f35e4189f1280971e4779c084aef5be09d111184daa23d34

=== [[LLB]] ===
* '''IV''': 5df7acef70694d6c4cd18fec2210d4e2
* '''Key''': 70dccf3f103695034902c10dd35ddb5c6999bde0e4d719938d1f0e51d518a3e9

=== RecoveryMode ===
* '''IV''': 23ce20be1832a2b628357b2a4637f4ba
* '''Key''': ba4e5862c1bfe3986acf384898f6c2be3c0a96c7619c886219b268ad86b36e05

Talk:SHSH Protocol

2010-08-16T04:08:49Z

Cool name: Request?

== Naming ==
Or should I better have named this '''TSS Protocol''' instead? -- [[User:Http|http]] 21:23, 15 August 2010 (UTC)

I think the current title is easier to tell it relates to shsh. I can't recall what tss stands for, and I think it would also be easier to find. [[User:Iemit737|Iemit737]] 21:36, 15 August 2010 (UTC)

== Implementation ==

How can I implement this on a Linux-based system? I have the request, but the 'telnet' and 'POST' commands don't work. --[[User:Dra1nerdrake|dra1nerdrake]] 22:40, 15 August 2010 (UTC)

Telnet should work. Just enter
telnet gs.apple.com 80
Then you get a HTTP connection. Then send the request and terminate with two CR/LF and you get the response. You can try with any other web page first, that should work the same way:
telnet www.google.com 80
Then:
GET / HTTP/1.0

And didn't [[User:Semaphore|semaphore]] release a unix version with some source code of [[TinyUmbrella]]? -- [[User:Http|http]] 23:49, 15 August 2010 (UTC)

== Request? ==
I'm still not understanding the telnet part of this. I can connect fine, but what exactly is the request that I have to send in order to get back a plist file with the SHSH blobs? --[[User:Cool name|Cool name]] 04:08, 16 August 2010 (UTC)

BakerVail 8B5080c (iPhone1,2)

2010-07-30T16:37:13Z

Cool name: /* Decryption Keys */

==Decryption Keys==
=== Root Filesystem (018-8218-003.dmg)===
* '''VFDecrypt''': 980269f302a65bf50a9f800b46da74a2e83a498c69244a618827e1ebddbfc334c3da2ea3

===Update Ramdisk (018-8155-003.dmg)===
* '''IV''': ac3baa36576ebb3b6d47af41562f9fa4
* '''Key''': 97fe89fd2ad21e67aff938008e47b026

===Restore Ramdisk (018-8163-003.dmg)===
* '''IV''': ef524b803d498940b73b3056d2b3d0f8
* '''Key''': 1a9a7cd8eccfaa988b205b3152a2e148

===applelogo===
* '''IV''': 7f7ffed3aa4d05220dc0fd18a480501f
* '''Key''': 367bcbae2563a8b5b74e5b5c7257e94e

===DeviceTree===
* '''IV''': cc6a3e1a076c36d19cf20d75edabb8f4
* '''Key''': e360c3c2ba0c9830ea31fac3117a9687

===iBEC===
* '''IV''':
* '''Key''':

===iBoot===
* '''IV''': 2864c913d710b850799c6fcc82c1a67b
* '''Key''': dfbaa41fd325a0c629ac40eaf6bb5c8e

===iBSS===
* '''IV''':
* '''Key''':

===kernelcache===
* '''IV''': a30dbbce36aa230b1cce689f43e6fafe
* '''Key''': fc08287a1ce308d08fde15fca43730ff

===LLB===
* '''IV''':
* '''Key''':

===recoverymode===
* '''IV''':
* '''Key''':

Talk:SUNorthstarTwo 7E18 (iPhone2,1)

2010-07-29T15:02:41Z

Cool name:

this keys are wrong!!!
Restore Ramdisk (018-6495-022.dmg)
* IV: 50a5d7418e3091a2c1d878495a6dbc6a
* Key: 217c7c38387264f2a2fef7a661d1bbeb705e7c90581c5b73055fe44f5bbc0498
{{unsigned|L0g0|01:03, July 27, 2010}}

I can confirm that these keys are in fact correct..
<pre>$ xpwntool 018-6495-022.dmg restore.dmg -iv 50a5d7418e3091a2c1d878495a6dbc6a -k 217c7c38387264f2a2fef7a661d1bbeb705e7c90581c5b73055fe44f5bbc0498
/home/ubuntu/code/posixninja/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 657029ec782d39a538418c0305cf98a7b8a7f38fcfa602e4dad677de90ee4bf91f3a81918aeded7b8bf1388f511aaf4f</pre>
This command produces a valid ramdisk
--[[User:Cool name|Cool name]] 00:43, 28 July 2010 (UTC)

==Youtube Video about decryption error==
MMM... Look at this... here it show there errors I'm telling you..
http://www.youtube.com/watch?v=7ivTu0003rI
[http://www.youtube.com/watch?v=7ivTu0003rI]
--[[User:L0g0|L0g0]] 08:41, 29 July 2010 (UTC)
:It seems like you are using an ancient version of xpwntool, this could be the issue. Look here for a newer version and try it out: http://www.posixninja.org/downloads.html --[[User:Cool name|Cool name]] 15:02, 29 July 2010 (UTC)

Talk:SUNorthstarTwo 7E18 (iPhone2,1)

2010-07-28T00:43:43Z

Cool name:

Payload

2010-07-19T14:36:35Z

Cool name: Undo revision 7218 by Mary (Talk)

Unsigned code that is used to patch iBoot, iBEC, iBSS, or LLB.

Payloads require little to no modification to work on a iDevice twice. The payload itself needs an injection vector (different one every time). For example the yellowsn0w payload was recycled into 3.0 when ultrasn0w came out, it just needed a new vector.

Talk:Northstar 7D11 (iPhone1,1)

2009-10-13T00:34:37Z

Cool name: /* AES Key Usage? */ new section

==Decryption of Kernelcache==
Has anyone had any success decrypting the kernelcache of any of the 3.1.2 or 3.1 firmwares? Using the newest build of xpwntool, I still get thrown an error. Seems it may have to do with the compression of the kernelcache...
<pre>~/iPhone1,1_3.1.2_7D11_Restore$ xpwntool kernelcache.release.s5l8900x kernel.bin -iv 25B7F586D184C329D3D05953A6516A36 -k DD03B5B52A53D3582B18A0052EF84038
/home/admin/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:613: 9de439b226a7982d45bb64afc9c4f9b1cf955bdcf0f4675e95be7784b3169a4a
/home/admin/xpwn/ipsw-patch/lzssfile.c:createAbstractFileFromComp:112: mismatch: 4073636 7933935 7933952 ba 8a
error: cannot open infile
</pre>
--[[User:Cool name|Cool name]] 14:28, 10 October 2009 (UTC)

until 7a341, the last block of the DATA section was not encrypted, since 7c144, it -is- encrypted, this may cause problems in xpwntool.
i wrote my own tools for extracting img3 files, see [http://www.xs4all.nl/~itsme/projects/iphone/ipsw.html this page] these don't have problems extracting recent updater files
[[User:Itsme|Itsme]] 21:01, 10 October 2009 (UTC)

ahh very nice, thank you Itsme. I succeeded in using decodeimg3.pl along with lzssdec to decrypt and unpack the kernel. however, say i have patched the kernel to my liking and want to re-pack and re-encrypt it, do you have any idea how to do this? thanks.
--[[User:Cool name|Cool name]] 00:48, 11 October 2009 (UTC)

in the latest xpwntool you can add the -decrypt flag to only decrypt and not decompress the lzss part. and from there you can probably modify the lzss header to match up with what xpwntool expects. in that example the header claims there's 7933935 bytes of data once decrypted, but the lzss_decompress function is returning with 7933952 byte of data.
--[[User:Posixninja|posixninja]] 17:15, 11 October 2009 (UTC)

alright, i've looked into this, and while i can just decrypt the file and see where the lzss portion starts (where it says complzss), i cannot figure out where the header claims there's 7933935 bytes of data once decrypted/uncompressed. i've googled the lzss header and tried looking in a hex editor, but nothing stands out as the value. do you know where it is exactly?
--[[User:Cool name|Cool name]] 00:46, 12 October 2009 (UTC)

decrypt:
<pre>decodeimg3 kernelcache.release.s5l8900x -iv 25B7F586D184C329D3D05953A6516A36 -k DD03B5B52A53D3582B18A0052EF84038 -o kernel.lzss</pre>

looking at the header of kernel.lzss ( the values are stored in network byte order )
<pre>
00000000: "complzss"
00000008: 20 e1 90 63 - adler32
0000000c: 00 79 10 00 - uncompressed size = 0x791000 = 7933952
00000010: 00 3e 28 a4 - compressed size = 0x3e28a4 = 4074020-0x180
</pre>

decompress:
<pre>lzssdec -o 0x180 <kernel.lzss > kernel.img</pre>

[[User:Itsme|Itsme]] 09:42, 12 October 2009 (UTC)

guess I got it backwards. the header claims 7933952(0x791000(00 79 10 00)) bytes but it gets 7933935 bytes. the value to change should be located at offset 0x4C in a decrypted (but uncommpressed img3)
btw... itsme, where did you come from? you seem to be very intelligent with this stuff, but i've never seen you before
--[[User:Posixninja|posixninja]] 13:14, 12 October 2009 (UTC)

i think you get 0x790fef bytes ( just a bit less than the round nr of 0x791000) bytes because xpwntool incorrectly assumes that the last 16 bytes of the DATA section are not encrypted, giving the lzss decompressor incorrect data for the last bytes.

the last 4 byts of the kernel.lzss stream are decompressed as follows:
<pre>
DATA: 7ea3 ba8a -> copy 3+3 bytes from a7e then 10+3 bytes from 8ba : total 19 bytes
decrypted:c9ff dbff -> copy 15+3 bytes from fc9 then 15+3 bytes from fdb : total 36 bytes
</pre>
-> when using the last 4 bytes from DATA, you end up short 36-19 bytes = 17 bytes, which is exactly 0x791000-0x790fef

... previously i was busy writing tools for windows ce devices ( http://www.xs4all.nl/~itsme/projects/xda and http://www.xda-developers.com )

[[User:Itsme|Itsme]] 14:23, 12 October 2009 (UTC)

== AES Key Usage? ==

alright, so now i have a new problem. i'm trying to patch the kernel for aes key usage, using the byte sequences chronic has posted on several of the pages for 3.0. i've found these byte sequences, and patched them with the values he has said. this seems to allow planetbeing's crypto util. from xpwn to work, except for that it spits back incorrect keys. anyone have any idea on this problem?
--[[User:Cool name|Cool name]] 00:34, 13 October 2009 (UTC)

Talk:Northstar 7D11 (iPhone1,1)

2009-10-12T00:46:45Z

Cool name:

Talk:Northstar 7D11 (iPhone1,1)

2009-10-11T00:48:44Z

Cool name: /* Decryption of Kernelcache */

Talk:Northstar 7D11 (iPhone1,1)

2009-10-10T14:28:54Z

Cool name: Decryption of Kernelcache

Talk:Kirkwood 7A341 (iPhone2,1)

2009-08-02T14:28:38Z

Cool name: /* Developer patches */

Every time I try and vfdecrypt the 3GS file system, it always works but the resulted dmg is unmountable. Any help? Thanks!!
:If you're on Windows, I find that there is an extra step required to open the image. After decrypting the image with vfdecrypt, run the decrypted image through XPwn's dmg utility. I use "dmg extract decrypted.dmg out.dmg". The resulting disk image should be readable by most Windows programs. If you're on a Mac, I don't know what would help. I believe OS X ignores the junk that's left after decrypting the image, so it's most likely user fault. The key is correct though, as I've been able to decrypt the image. --[[User:James|James]] 18:01, 25 June 2009 (UTC)
:Or ignore vfdecrypt completely, just run ''dmg extract encrypted.dmg decrypted.hfs -k key''. [[User:Blackbox|Blackbox]]

== iBoot decryption ==

Is it just me, or does iBoot appear to decrypt incorrectly using the keys given? --[[User:Cool name|Cool name]] 20:15, 25 June 2009 (UTC)
:It appears to decrypt incorrectly for me too using xpwntool. Every other image decrypts correctly using it, so I assume it's a bad key. --[[User:James|James]] 21:16, 25 June 2009 (UTC)
::Alright thanks, just wanted to make sure it wasn't my error, cause I decrypted all the other files fine too. Looks like geohot will have to run those keys through again. --[[User:Cool name|Cool name]] 00:48, 26 June 2009 (UTC)

== Developer patches ==

Can anyone assist me in getting access to the AES engine using UID/GID keys? I successfully patched the kernel (i.e. /dev/kmem is available) but running the aes utility from xpwn still fails with kIOReturnNotPrivileged. I'm on 3.0.1 (using 3.0 kernel) and I have also downgraded the IOKit.framework as this seems to have changed with 3.0.1. Is this a 3.0.1 issue or have I missed something? --[[User:CleanAir|CleanAir]] 09:49, 2 August 2009 (UTC)
:Look at [[Kirkwood_7A341_(iPhone_3G)]] for iPhone 2G, 3G, and iPod touches, or [[Kirkwood_7A341_(iPhone_3GS)]] for iPhone 3GS. Chronic has provided kernel patches that allow AES GID/UID key usage. --[[User:Cool name|Cool name]] 14:28, 2 August 2009 (UTC)

Firmware

2009-07-31T20:51:11Z

Cool name:

This is the iPhone OS system the iPhone runs. Latest Apple download links can be found [http://www.itunes.com/version here].

==Comparison of firmware versions==

===[[iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]]?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| 6e798e906c6590a7521ef89b731569be6d05b3aa
| Prototype seen on [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{yes}}
| ?
| 109,813,128
|-
| 1.0.0
| Heavenly 1A543a
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| fb8bb3ee2e9a997affbb97868599f2995c78209c
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| Heavenly 1C25
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| a00b85a7a55d62a94be5fbf5effbc42fd63f3097
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| Heavenly 1C28
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| 7f5c0ff1f84a0202b75a55c3fcb362e415334d1e
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| Snowbird 3A109a
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| Oktoberfest 3B48a
| 04.02.13_G
| No download available
|
| Initial Euro shipment.
| {{yes}}
| {{yes}}
|
|-
| 1.1.2
| Oktoberfest 3B48b
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| 797c02e7d660940e8d9a16cc7229ccf3f67dd8b1
|
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| Little Bear 4A93
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| b3dec7580bd00dc4faf28449d9618ef40aeacc96
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| Little Bear 4A102
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| 000811bac096011b50ebf6ec1ec2285b62fda4cb
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| Big Bear 5A347
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| 9c510a3cfce789fa5f92a8f763c231bac82ff6d4
|
| {{yes}}
| {{yes}}
| 228,768,637
|-
| 2.0.1
| Big Bear 5B108
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| 61de6a2bd6ceddc9ecabad1671b91a59b3824bc4
|
| {{yes}}
| {{yes}}
| 254,048,068
|-
| 2.0.2
| Big Bear 5C1
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| b84b57bea919bdc720287ec908c1378e7d7b5e1b
|
| {{yes}}
| {{yes}}
| 253,589,000
|-
| 2.1
| Sugar Bowl 5F136
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| 353b7745767b85932e14e262e69463620939bdf7
|
| {{yes}}
| {{yes}}
| 242,171,241
|-
| 2.2
| Timberline 5G77
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| cbfc6ff886ce89868a55547b9fb980dbf92e6418
|
| {{yes}}
| {{yes}}
| 257,576,980
|-
| 2.2.1
| SUTimberline 5H11
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| 43b95ebe1e51f8d30eae916053396595c08440d3
|
| {{yes}}
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| 2afd3f8ede17390737f508473ed205506a0bd23f
|
| {{yes}}
| {{yes}}
| 240,394,111
|-
| 3.0.1
| 7A400
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| 34c391fbbc7b31b159372766de39ce5c9cc26ebb
|
| {{yes|Yes (no tools available yet)}}
| {{yes|Yes (no tools available yet)}}
| 240,439,502
|}

===[[iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]]?
!width="70"| File Size
|-
| 2.0
| Big Bear 5A345
| 01.45.00
| No download available
|
| Initial iPhone 3G shipment.
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
|
|-
| 2.0
| Big Bear 5A347
| 01.45.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| af9506ca0034e462674f9f59c5406f159eaf9fc1
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 235,957,125
|-
| 2.0.1
| Big Bear 5B108
| 01.48.02
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| e81c7ac7e334a3e9d81b3b47894bfaa1ec495482
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 261,224,227
|-
| 2.0.2
| Big Bear 5C1
| 02.08.01
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| bef7fef954293046420fbcf947379839178a195b
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 260,761,030
|-
| 2.1
| Sugar Bowl 5F136
| 02.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| c6957dcbf2a95ccfd6dce374a727b1b7700a9043
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 249,341,655
|-
| 2.2
| Timberline 5G77
| 02.28.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| f67f8b2b842428bf89456cda0c2d5cf954d111a4
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 258,342,348
|-
| 2.2.1
| SUTimberline 5H11
| 02.30.03
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| 94f1fb43de12bff0f168ce690b7e794cc6220ae3
|
| {{yes}}
| {{yes|Yes (with [[ultrasn0w]])}}
| 241,229,233
|-
| 3.0.1
| 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| a148ff39fa4dea499e7a9dd007b63e90c4f56666
|
| {{yes|Yes (no tools available yet)}}
| {{yes|Yes (no tools available yet)}}
| 241,274,617
|}

===[[iPhone2,1|iPhone 3GS]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]]?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| d8534408c8679c830fd0c4e36ef9762c11ef73df
| Initial shipment.
| {{yes}}
| {{yes|Yes (with [[ultrasn0w]] or [[purplesn0w]])}}
| 312,292,933
|-
| 3.0.1
| 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| 30006575af931e3da0521febace005152cdb8853
|
| {{yes|Yes (no tools available yet)}}
| {{yes|Yes (no tools available yet)}}
| 312,330,244
|}

===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 1.1.0
| Snowbird 3A100a
| No download available
|
| Initial shipment.
| {{yes}}
|
|-
| 1.1.0
| Snowbird 3A101a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| 9b0d83c7f8b4328174a3f31e0e93f60e591ae143
|
| {{yes}}
| 157,890,186
|-
| 1.1.1
| Snowbird 3A110a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| 84bbc6ea8bf29745195bc9926c1874f7c2a36f32
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| Oktoberfest 3B48b
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| 108d8ffe9ea75e61cd5e57170ad388b7fa00d923
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| Little Bear 4A93
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| 8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| Little Bear 4A102
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| c148d1eb1c979bb6434175411d4a372103a4fdd2
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| Little Bear 4B1
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| 1b818911316e4248ee01d3ec67f9d39afc3db240
|
| {{yes}}
| 173,519,637
|-
| 2.0
| Big Bear 5A347
| Download Link Prohibited
| ae82798e85f9953b0f4798bad36187cb020c9d22
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| Big Bear 5B108
| Download Link Prohibited
| a81b6e7af4b85ef436d047f9da57c0f694d8964a
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| Big Bear 5C1
| Download Link Prohibited
| c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2
|
| {{yes}}
| 258,201,218
|-
| 2.1
| Sugar Bowl 5F137
| Download Link Prohibited
| fc7f6d0972927df502ffca47438ca75dcccffaf3
|
| {{yes}}
| 251,155,156
|-
| 2.2
| Timberline 5G77
| Download Link Prohibited
| 081a7de363230fb38d0ce092cbbe42f2a50c8a5f
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| SUTimberline 5H11
| Download Link Prohibited
| fc69be9e421bc0630567184506ab771f6b7ef68b
|
| {{yes}}
| 260,166,688
|-
| 3.0
| Kirkwood 7A341
| Download Link Prohibited
| dff2bd14931225908a360fb8e60a336f17d2dd6d
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|}

===[[N72ap|iPod touch (2nd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl - 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| c3c700be49ad227d1152188e7c1e46b8958fd1e4
|
| {{yes|Yes}}
| 282,083,944
|-
| 2.2
| Timberline - 5G77a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| 34a0a489605f34d6cc6c9954edcaaf9a050deedc
|
| {{yes|Yes}}
| 291,123,491
|-
| 2.2.1
| SUTimberline - 5H11a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| 9af5625ea34acdd8abeb6fce71a72651d0c815d5
|
| {{yes|Yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| 0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42
| 3.0+ is a paid upgrade series
| {{yes|Yes}}
| 270,315,364
|}

==See also==
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://pastebin.ca/1209360 A link of interest...]

Talk:Jailbreak

2009-07-27T01:33:53Z

Cool name: Redsn0w (normal version) using arm7_go?

Actually, I believe redsn0w (normal version) still loads a 2.1.1 iBoot & uses the arm7_go exploit to bootstrap the ramdisk that flashes the NOR, including an LLB with the 24kpwn exploit. Can someone confirm this? --[[User:Cool name|Cool name]] 01:33, 27 July 2009 (UTC)

Talk:NorthVail 7C106c (iPhone1,2)

2009-07-18T14:51:41Z

Cool name: New page: @Redart again, how did you get the vfdecrypt key? If you got it from someone else, would you mind asking them how they got it? Thanks --~~~~

@Redart again, how did you get the vfdecrypt key? If you got it from someone else, would you mind asking them how they got it? Thanks --[[User:Cool name|Cool name]] 14:51, 18 July 2009 (UTC)

ITunes

2009-07-16T21:52:09Z

Cool name:

iTunes is Apple's music and video management software. It also serves as a desktop client for the iTunes Store and handles iPod/iPhone synchronization.

It consists of 3 major components: iTunes itself, QuickTime and Apple Mobile Device Support (AMDS).
QuickTime is used for audio/video playback and encoding, while AMDS is the component responsible for synchronizing with iPhone/iPod Touch.

== Mac OS X versions ==

== Windows versions (32-bit) ==

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
!iTunes version
!QuickTime version
!AMDS version
!Download URL
!SHA-1 hash
!File size
!Comments
|-
|8.0.0.35
|7.55.90.70
|2.1.0.25
|[http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iTunes8/061-4746.20080909.Detnz/iTunes8Setup.exe iTunes8Setup.exe]
|5d4ff8ffbe9feeaed67deb317797c1d71a03c359
|67,822,888
|The first public release of 8.0. Introduced many new features, including Genius playlists.
|-
|8.0.0.35
|7.55.90.70
|2.1.0.25
|[http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iTunes8/061-5525.20080911.bnj78/iTunes8Setup.exe iTunes8Setup.exe]
|09bd8dd0b055f1b63205d5c9c9a00e4d42e38a3e
|67,110,184
|This version was released only 2 days after the official 8.0 release, supposedly to fix blue screen errors. Also removed custom icons for iPhones and iPods.
|-
|8.0.1.11
|7.55.90.70
|2.1.1.13
|[http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iTunes8/061-5555.20081002.5Kij7/iTunes801Setup.exe iTunes801Setup.exe]
|7342c1aa7c458db14c67e8635ee475adcc1d38be
|67,167,528
|
|-
|8.0.2.20
|7.55.90.70
|
|[http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iTunes8/061-5812.20081120.3mv63/iTunesSetup.exe iTunesSetup.exe]
|96113274f450dfe2893805353663b2436161b15a
|68,756,776
|
|-
|8.0.2.20
|7.6
|
|[http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iTunes8/061-5856.20090121.fvgtr/iTunesSetup.exe iTunesSetup.exe]
|50c0e31eda9ab0a5902d2242ba2fd74ef5be7c99
|69,076,264
|
|-
|8.1.0.51
|7.6
|
|[http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iTunes8/061-6166.20090311.znt32/iTunesSetup.exe iTunesSetup.exe]
|562bcc78760c4055f84d53730089a62dfa9c3fcf
|73,336,104
|Version 8.1 was notable for significant performance improvements on Windows
|-
|8.1.0.52
|7.6
|
|[http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iTunes8/061-6190.20090313.Cf9iK/iTunesSetup.exe iTunesSetup.exe]
|00bd8842cf0f2026cc4590ef434f6846eeca7fa4
|73,332,008
|
|-
|8.1.1.10
|7.6
|
|[http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iTunes8/061-6172.20090406.Xdcfr/iTunesSetup.exe iTunesSetup.exe]
|cad92e6882b5fb49d710d342f315d7d6293e2b0a
|74,302,760
|
|-
|8.2.0.23
|7.62.14.0
|2.5.0.31
|[http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iTunes8/061-6184.20090601.Bhyit/iTunesSetup.exe iTunesSetup.exe]
|16f5b1e787b36aece842ea5ae80bfc6bf2b32b19
|77,690,152
|The first public version to support iPhone OS 3.0
|-
|8.2.0.23
|7.62.14.0
|2.5.1.3
|[http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iTunes8/061-6664.20090608.dfrtg/iTunesSetup.exe iTunesSetup.exe]
|b1fbcba068c32c25d8987b81ce60cc660b90ccd8
|77,690,152
|
|-
|8.2.1.6
|7.62.14.0
|2.5.2.2
|[http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iTunes8/061-6717.20090715.XsE4R/iTunesSetup.exe iTunesSetup.exe]
|797da9711caf87d114e2a5b88523fa825753b530
|77,976,864
|Disables syncing with Palm Pre. Does not put signed iBSS/iBEC in temp folder on 3GS restores.
|}

S5L8720

2009-07-16T21:26:10Z

Cool name:

This is the Application Processor used on the [[n72ap|iPod Touch 2G]].

==Exploits==
===[[iBoot]] / [[Kernel]] Level===
* [[ARM7 Go]] - Firmware v2.1.1
* [[iBoot Environment Variable Overflow]] - Firmware v3.1b1 and below (Note: [[iBoot]] on the S5l8720 can be downgraded allowing the exploit to be used on future firmwares, but ''only if'' a backup of the device-specific Apple-signed 3.0 iBSS with unique [[ECID]] was made.)

===[[VROM (S5L8720)|Bootrom]]===
* [[0x24000 Segment Overflow]]

==Boot Chain==
[[VROM (S5L8720)|VROM]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[System|System Software]]

It is definitely worthy to note that the [[Pwnage]] exploit is fixed because the images are now flashed to the [[NOR]] in their encrypted [[IMG3]] containers, and the [[S5L8720 Bootrom|bootrom]] can properly sigcheck [[LLB]]. That being said, unsigned images can still be run using the [[0x24000 Segment Overflow]].

==See Also==
* [[S5L8720 (Hardware)]]
* [[S5L File Formats]]

PMB8878

2009-07-16T01:23:49Z

Cool name: /* Known Firmware Versions */

This is the baseband processor used in the [[iPhone 3G]] and the [[iPhone 3GS]]. It is upgraded with [[BBUpdaterExtreme]]. It is also known as the PMB8878.

==Datasheet==
Anyone got one? Infineon provides [http://www.infineon.com/dgdl/X-GOLD608_XMM6080.pdf?location=Products.Mobile_Phone_Baseband_ICs.WCDMA___HSDPA.X-GOLD__608_-_PMB_8878.PRODUCT_TYPE_DOCUMENTS.X-GOLD608_XMM6080.pdf&folderId=db3a304312fcb1bc0113000c158f0004&fileId=db3a30431936bc4b011957c66fee3850 this], which isn't really useful.

==Secpack 2.0==
This is the security region in the files sent to the [[X-Gold 608]]. This is the first 0xCF8 is new fls and eep files.

===Layout===
0x634--Memory Map
0x714--Descriptor
0xCD4--Post secpack pointer to name
0xCEC--Data length

==Endpack==
The fls and eep files also have a footer tacked onto the end containing the loader and signature.

==Memory Map==
FLASH 0x20000000 0x1000000
CODE 0x20000000 0x40000 0b0010(bootstrapper)
CODE 0x20040000 0xDC0000 0b0100(main firmware)
FFS 0x20A00000 0x100000 0b1100(empty)
DYNFFS 0x20A00000 0x100000 0b1100(empty)
FFS 0x20B00000 0x40000 0b1011(empty)
DYN_EEP 0x20E40000 0x80000 0b0110
SECPACK 0x20EC0000 0x40000
SECZONE 0x20F80000 0x40000
STATIC_EEP 0x20FC0000 0x40000 0b0111
RAM 0x40000000 0x800000

==MMU relocation table==
===Bootloader===
[[Image:Bltbl.png]]

===Firmware===
[[Image:Bbmmu.png]]

==Complete memory dump==
[http://depositfiles.com/files/i5119hpzm 0x00000000-0x0001FFFF]

[http://depositfiles.com/files/mxslfu4dp 0x20000000-0x20FFFFFF]

[http://depositfiles.com/files/6wiet73wn 0x40000000-0x407FFFFF]

[http://depositfiles.com/files/fioppsphe 0xFFFF0000-0xFFFFFFFF]

== Known Firmware Versions ==
[[1.43.00]] 2.0 (Build 5A331 - Internal Beta)
[[1.45.00]] 2.0 (Build 5A347 - Gold Master)
[[1.48.02]] 2.0.1 (Build 5B108)
[[2.04.03]] 2.1 (Build 5F90)
[[2.08.01]] 2.0.2 (Build 5C1)
[[2.11.07]] 2.1 (Build 5F136)
[[2.28.00]] 2.2 (Build 5G77)
[[2.30.03]] 2.2.1 (Build 5H11)
[[4.20.01]] 3.0 beta 1 (Build 7A238j)
[[4.22.01]] 3.0 beta 2 (Build 7A259g)
[[4.24.02]] 3.0 beta 3 (Build 7A280f)
[[4.26.08]] 3.0 (Build 7A341 - Gold Master)
[[5.08.01]] 3.1 beta 1 (Build 7C97d)
[[5.10.01]] 3.1 beta 1 (Build 7C106c)

==Accessing [[Interactive Mode]]==
Interactive mode isn't accessed by sending characters to the baseband. Instead a GPIO pin is raised with a kernel call to preupdate reset.
result = IOConnectCallScalarMethod(conn, 0, 0, 0, 0, 0); //reset
result = IOConnectCallScalarMethod(conn, 1, 0, 0, 0, 0); //power set
result = IOConnectCallScalarMethod(conn, 2, 0, 0, 0, 0); //configuring mux
result = IOConnectCallScalarMethod(conn, 7, 0, 0, 0, 0); //powercycle
result = IOConnectCallScalarMethod(conn, 8, 0, 0, 0, 0); //preupdate reset

[[Category:Baseband]]

PMB8878

2009-07-01T21:06:53Z

Cool name: /* Known Firmware Versions */

This is the baseband processor used in the iPhone 3G. It is upgraded with [[BBUpdaterExtreme]]. It is also known as the PMB8878.

==Datasheet==
Anyone got one? Infineon provides [http://www.infineon.com/dgdl/X-GOLD608_XMM6080.pdf?location=Products.Mobile_Phone_Baseband_ICs.WCDMA___HSDPA.X-GOLD__608_-_PMB_8878.PRODUCT_TYPE_DOCUMENTS.X-GOLD608_XMM6080.pdf&folderId=db3a304312fcb1bc0113000c158f0004&fileId=db3a30431936bc4b011957c66fee3850 this], which isn't really useful.

==Secpack 2.0==
This is the security region in the files sent to the [[X-Gold 608]]. This is the first 0xCF8 is new fls and eep files.

===Layout===
0x634--Memory Map
0x714--Descriptor
0xCD4--Post secpack pointer to name
0xCEC--Data length

==Endpack==
The fls and eep files also have a footer tacked onto the end containing the loader and signature.

==Memory Map==
FLASH 0x20000000 0x1000000
CODE 0x20000000 0x40000 0b0010(bootstrapper)
CODE 0x20040000 0xDC0000 0b0100(main firmware)
FFS 0x20A00000 0x100000 0b1100(empty)
DYNFFS 0x20A00000 0x100000 0b1100(empty)
FFS 0x20B00000 0x40000 0b1011(empty)
DYN_EEP 0x20E40000 0x80000 0b0110
SECPACK 0x20EC0000 0x40000
SECZONE 0x20F80000 0x40000
STATIC_EEP 0x20FC0000 0x40000 0b0111
RAM 0x40000000 0x800000

==MMU relocation table==
===Bootloader===
[[Image:Bltbl.png]]

===Firmware===
[[Image:Bbmmu.png]]

==Complete memory dump==
[http://depositfiles.com/files/i5119hpzm 0x00000000-0x0001FFFF]

[http://depositfiles.com/files/mxslfu4dp 0x20000000-0x20FFFFFF]

[http://depositfiles.com/files/6wiet73wn 0x40000000-0x407FFFFF]

[http://depositfiles.com/files/fioppsphe 0xFFFF0000-0xFFFFFFFF]

== Known Firmware Versions ==
[[1.43.00]] 2.0 (Build 5A331 - Internal Beta)
[[1.45.00]] 2.0 (Build 5A347 - Gold Master)
[[1.48.02]] 2.0.1 (Build 5B108)
[[2.04.03]] 2.1 (Build 5F90)
[[2.08.01]] 2.0.2 (Build 5C1)
[[2.11.07]] 2.1 (Build 5F136)
[[2.28.00]] 2.2 (Build 5G77)
[[2.30.03]] 2.2.1 (Build 5H11)
[[4.20.01]] 3.0 beta 1 (Build 7A238j)
[[4.22.01]] 3.0 beta 2 (Build 7A259g)
[[4.24.02]] 3.0 beta 3 (Build 7A280f)
[[4.26.08]] 3.0 (Build 7A341 - Gold Master)
[[5.08.01]] 3.1 beta 1 (Build 7C97d)

==Accessing [[Interactive Mode]]==
Interactive mode isn't accessed by sending characters to the baseband. Instead a GPIO pin is raised with a kernel call to preupdate reset.
result = IOConnectCallScalarMethod(conn, 0, 0, 0, 0, 0); //reset
result = IOConnectCallScalarMethod(conn, 1, 0, 0, 0, 0); //power set
result = IOConnectCallScalarMethod(conn, 2, 0, 0, 0, 0); //configuring mux
result = IOConnectCallScalarMethod(conn, 7, 0, 0, 0, 0); //powercycle
result = IOConnectCallScalarMethod(conn, 8, 0, 0, 0, 0); //preupdate reset

[[Category:Baseband]]

Talk:Decrypting Firmwares

2009-07-01T20:28:06Z

Cool name:

== Extract ramdisk DMG without Snow Leopard ==

Is there a way to extract a decrypted ramdisk DMG without Snow Leopard?

For instance, the FLS file of the baseband update shows zero size when extracted with Leopard or with HFSExlporer.

--[[User:Oranav|Oranav]] 17:33, 1 July 2009 (UTC)

:I was wondering the same exact thing, and so far I have found no answers :/ I've tried mounting the ramdisk on a pwned 3.0 device, but I can't seem to get the image to mount successfully. Anyone know how to do this or any other method?--[[User:Cool name|Cool name]] 18:24, 1 July 2009 (UTC)

I have some rather hacky xpwn patches to allow you to extract most files in the compressed ramdisk. I can release those if you'll are desperate. The only catch is they only extract files >64k, and don't allow you you add in compressed files --[[User:Posixninja|posixninja]] 19:07, 1 July 2009 (UTC)

:Posixninja, I think we would very much appreciate you sharing these xpwn patches with us :)--[[User:Cool name|Cool name]] 19:22, 1 July 2009 (UTC)

ok, I uploaded it to my drop [http://drop.io/posixninja]. these are just the related files, most of the work in these was done by the wonderful planetbeing, not me. also I haven't tested it on windows at all yet, so there could be some issues. --[[User:Posixninja|posixninja]] 19:36, 1 July 2009 (UTC)

:Great, thank you :) I've gotten it to work, however, is there a way to make it work with genpass? Genpass fails when running on a compressed ramdisk, so I don't know if this tool could help with that problem...--[[User:Cool name|Cool name]] 20:10, 1 July 2009 (UTC)

::genpass fail isn't because of the compressed ramdisk, there's anther issue that I haven't fixed yet in genpass. i'll try to get that fixed asap, it's been on my todo list for awhile now --[[User:Posixninja|posixninja]] 20:26, 1 July 2009 (UTC)

:::ah ok, sounds good. That new genpass will be very useful :) --[[User:Cool name|Cool name]] 20:28, 1 July 2009 (UTC)

Talk:Decrypting Firmwares

2009-07-01T20:10:32Z

Cool name:

Talk:Decrypting Firmwares

2009-07-01T20:10:12Z

Cool name: Work with genpass?

Talk:Decrypting Firmwares

2009-07-01T19:22:07Z

Cool name:

Talk:Decrypting Firmwares

2009-07-01T18:25:35Z

Cool name:

Talk:Decrypting Firmwares

2009-07-01T18:24:48Z

Cool name:

Kirkwood 7A341 (iPhone2,1)

2009-06-28T02:04:56Z

Cool name:

== Decryption Keys ==

=== Root Filesystem ===
* '''VFDecrypt''': 7d779fed28961506ca9443de210224f211790192b2a2308b8bc0e7d4a2ca61a68e26200e

=== LLB ===
* '''Key''': 783970ed70d151e65cdd0f52019f026cbc0ece5c604603117d677b6a85ea4d95
* '''IV''': fc4efef9fd245dc038ecb26f25f795c7

=== iBoot ===
* '''Key''': c160ff26cf0cdb1c0b5d821e4102cab8a3e62687f39ab8c456907694e3c4834e
* '''IV''': 948a3d82419c9d4dde404cb4a788da70

=== DeviceTree ===
* '''Key''': 14370497f039b5caf3583cfa89cfd626147df4c37c63ab3a3fc110765d3d0585
* '''IV''': c6f3b155a71d2a61d14f78f6230bb20e

=== Kernel ===
* '''Key''': f49e50a630397ed72592f5c9874b33ca1e0e5a499d2a6a0f2746c8e7f1dbf470
* '''IV ''': cd41286890df601bfcd87f8a09b009c8

=== Logo ===
* '''Key''': d4598b90b842817d34f4eb2e741bfb965d73986ac0c1ec99f9d73c67fef787e3
* '''IV''': 02a124ab2522762fdb0e2dceebd69c4e

=== Recovery Logo ===
* '''Key''': da2324a7f8341c26b550a674a0d8566a9ebc9eda9c22cf37b1fc7d702ee6aab5
* '''IV''': 2e314503ca4f2bd03ac17c8b8eecf072

=== iBEC ===
* '''Key''': 711ffd7e4cc4ea56150749e085d065f6efe83bc40c506eb17648c3e68ac4ed6c
* '''IV''': 414cd466c85886181881880d66b9535a

=== iBSS ===
* '''Key''': ebc56070f923799c06fc696fe5b8335517eb2fc13d1e8fcdb16be784db6b4a36
* '''IV''': d7815d19a90b84677fc757aa4abf9343

=== Update Ramdisk - 018-5304-002.dmg ===
* '''Key''': 8ffbef98cc28b4aa14d18783faa6a8c95c94b1a4536fbfb7485f0d54cdec358b
* '''IV''': d9b8d8f798cd50ba72d434b271d2f181

=== Restore Ramdisk - 018-5306-002.dmg ===
* '''Key''': 44514633ce2aead62bcfa8836cda4a3c7bde483f8b1e9f19d22f9d8fdf753e02
* '''IV''': e345e23bb266fcc2ba23a2e0be77a3bf

Talk:Kirkwood 7A341 (iPhone2,1)

2009-06-26T00:48:28Z

Cool name:

Talk:Kirkwood 7A341 (iPhone2,1)

2009-06-25T20:15:09Z

Cool name: /* iBoot decryption */ new section

Talk:Jailbreak (S5L8920+)

2009-06-24T20:07:01Z

Cool name:

This kind of information should not be here until the release of the iPhone2,1.

Why not prepare early? It is too late for apple to fix anything at this point, not to mention they already know about the segment overflow. None of the information here reveals anyting to apple at all [[User:ChronicDev|ChronicDev]] 10:43, 20 May 2009 (UTC)

I agree with Chronic there is no reason to not begin and edit as we get the new devices in our hands

3G S will have the 3.0 firmware OOB, which ships with iBoot-6xx, so probably the segment overflow exploit is gone... --[[User:Pjakuszew|Pjakuszew]] 13:33, 13 June 2009 (UTC)

3.0 fw is iBoot-59x.xx, but anyway, the exploit is in bootrom, that is why it's likely to stay (hopefully) [[User:ChronicDev|ChronicDev]] 19:15, 13 June 2009 (UTC)

Oh, I overlooked that the exploit is in bootrom. :P Is bootrom updateable in any way? I know it's not writable in retail devices, but it can be easily updated by Apple before shipping the final device? --[[User:Pjakuszew|Pjakuszew]] 21:44, 14 June 2009 (UTC)

Anyone know if this is the case? [[User:Rekoil|Rekoil]] 10:23, 20 June 2009 (UTC)

== Decrypt Ramdisk ==

Does anyone know how to go about decrypting the ramdisk found inside the iPhone2,1 IPSW using the keys geohot posted on his blog? I have tried using xpwntool, OpenSSL, etc. but nothing seems to work...--[[User:Cool name|Cool name]] 20:07, 24 June 2009 (UTC)

Talk:Jailbreak (S5L8920+)

2009-06-24T20:06:24Z

Cool name: /* Decrypt Ramdisk */ new section

Jailbreak (S5L8920+)

2009-06-23T15:28:11Z

Cool name:

Because of the date the [[0x24000 Segment Overflow]] was leaked by [[NitroKey]], Apple had the time to fix the bug in the [[S5L8920 (Bootrom)|iPhone 3G[s] Bootrom]]. Therefore, the following needs to be done:
* '''Find a new iBoot exploit''' - This will allow us to decrypt the platform iBoot and other firmware files in it's IPSW, as well as dump the bootrom to examine.
* '''Find a new bootrom exploit''' - After we have the bootrom dumped, we must look for a way to make SecureROM run our patched [[LLB]].

==ECID==
Apple added a new tag to the img3 format called ECID. The ECID is ''unique'' to each phone, and is being sigchecked. So no downgrades unless you have a dump of your unique old firmware's img3. Therefore, iBoot exploits won't be so useful for tethered JBs, because such exploits will be closed in new FWs. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html]

==Geohot's iBoot Exploit==
Geohot has a new iBoot exploit in 7A341 FW. [http://iphonejtag.blogspot.com/2009/06/no-sn0w-in-summer.html]

Main Page

2009-06-10T01:56:07Z

Cool name:

<center>[[Image:Iptwiki.jpg‎]]</center>

{{:Main Page/Welcome}}
<table border=1 width=100%><tr>
<td bgcolor=orange width=25%><center><b>[[Jailbreak iPhone2,1|Break Chain of Trust (S5L89xx)]]</b></center></td>
<td bgcolor=orange width=25%><center><b>[[Unlock 2.0|Break Chain of Trust (X-Gold 608)]]</b></center></td>
</tr>
<tr>
<td colspan=4>
<center>[[Disclaimer]]</center>
</td>
</tr>
</table><BR>
==Software==
* [[Filesystem]]
* [[Firmware]]
* [[Keys]]
* [[Protocols]]
* [[System Log]]

==Hardware==
=== iPhone ===
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[iPhone2,1|iPhone 3G S (???)]]

=== iPod touch ===
* [[n45ap|iPod touch (n45ap)]]
* [[n72ap|iPod touch 2nd Generation (n72ap)]]

==App Processor ([[Jailbreak]])==
The [[iPhone]], [[iPod touch]], and [[iPhone 3G]] makes use of the [[S5L8900]] platform as application processor, while the [[iPod touch 2G]] uses the [[S5L8720]]. Here is where the [[Jailbreak|jailbreak]] applies.

==Baseband ([[Unlock]])==
The [[Baseband Device]] is where the [[unlock]] applies.

==Application Development==
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

==Application Copy Protection==
* [[Copy Protection Overview]]
* [[Application Structure and Signatures]]
* [[Mach-O Loading Process]]
* [[Bugging Debuggers]]

==Definitions==
* [[Jailbreak]]
* [[Activation]]
* [[Unlock]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[DFU]]
* [[iBoot]]
* [[iBEC]]
* [[iBSS]]
* [[NORID]]
* [[CHIPID]]

==Other==
* [[Bluetooth]]
* [[Glossary]]
* [[Tutorials]]
* [[Useful Links]]

Talk:GenPass

2009-04-16T01:12:49Z

Cool name:

== Compilation notes ==

=== Windows ===
If anyone is trying to compile this using MinGW on Windows, you'll run into some linking problems with libcrypto.
After searching around for awhile, I found that the problem can be solved by adding -lgdi32 to your linker flags.

I just needed the -lgdi32 What crap that a crypto lib linked to a graphics library

I don't know, it's screwy. I think a lot of OpenSSL is actually hacky on Windows (after reading the posts with corrections for this problem, it seems like their talking about some kind of pre-alpha program that barely works on anything besides Linux).
Also, I see that compiling works with just gdi, so I removed it from my initial suggestion.
Must have had ws2_32 first or something..

=== Mac compiling ===

Must have a recent copy of openssl installed. if you don't do this.

* download and extract openssl [http://www.openssl.org/source/openssl-0.9.8h.tar.gz]
* run './config' and then 'make' to build the lib.
* copy genpass.c into the openssl directory
* compile with 'gcc genpass.c libcrypto.a -o genpass -I./include/'

plz correct me if I'm wrong, as I'm no mac expert --[[User:Posixninja|posixninja]] 21:52, 6 April 2009 (UTC)

=== Linux compiling ===
What do you expect? Works fine with just -lcrypto.

== How to use? ==

Well, I tried to get the key for beta 2 for the 3g, I never could.
I asked on #iPhone and they told me that
Platform is s5l8***x (s5l8900x) for the iPhones and ipt1g.
Ramdisk is the path to a MOUNTED (decrypted) ramdisk file (not mount path). They didn't know wether it was the restore or update or both ramdisk.
Main is the path to the big dmg file (the rootfs > 100 mb).
Well this didn't work : I got different keys.
Please correct what is wrong in the above. dranfi

:It shouldn't matter which ramdisk you use, however, you cannot use GenPass to extract correct keys from anything >b2 without decompressing the ramdisk first. Apparently, this is a Snow Leopard only feature for now. You could also (in theory) compile GenPass on your device and use iPhone OS' tools to mount the ramdisk (since they must know how to understand them), although I haven't gotten around to try this yet.

::The compression is affecting beta 3 at this point or beta 1 and 2?
::And, since I have snow leopard beta, how do you decompres it under snow leopard? And is this a new feature of snow leopard (in a recent build or from the begening, just that at the moment I have a slow connection making it hard to upgrade snow leopard)?

:::This compression affects betas 2 & 3, but not beta 1. And unfortunately I do not know how to decompress it under any system :( --[[User:Cool name|Cool name]] 01:12, 16 April 2009 (UTC)

Talk:GenPass

2009-04-16T01:12:20Z

Cool name:

== Compilation notes ==

=== Windows ===
If anyone is trying to compile this using MinGW on Windows, you'll run into some linking problems with libcrypto.
After searching around for awhile, I found that the problem can be solved by adding -lgdi32 to your linker flags.

I just needed the -lgdi32 What crap that a crypto lib linked to a graphics library

I don't know, it's screwy. I think a lot of OpenSSL is actually hacky on Windows (after reading the posts with corrections for this problem, it seems like their talking about some kind of pre-alpha program that barely works on anything besides Linux).
Also, I see that compiling works with just gdi, so I removed it from my initial suggestion.
Must have had ws2_32 first or something..

=== Mac compiling ===

Must have a recent copy of openssl installed. if you don't do this.

* download and extract openssl [http://www.openssl.org/source/openssl-0.9.8h.tar.gz]
* run './config' and then 'make' to build the lib.
* copy genpass.c into the openssl directory
* compile with 'gcc genpass.c libcrypto.a -o genpass -I./include/'

plz correct me if I'm wrong, as I'm no mac expert --[[User:Posixninja|posixninja]] 21:52, 6 April 2009 (UTC)

=== Linux compiling ===
What do you expect? Works fine with just -lcrypto.

== How to use? ==

Well, I tried to get the key for beta 2 for the 3g, I never could.
I asked on #iPhone and they told me that
Platform is s5l8***x (s5l8900x) for the iPhones and ipt1g.
Ramdisk is the path to a MOUNTED (decrypted) ramdisk file (not mount path). They didn't know wether it was the restore or update or both ramdisk.
Main is the path to the big dmg file (the rootfs > 100 mb).
Well this didn't work : I got different keys.
Please correct what is wrong in the above. dranfi

:It shouldn't matter which ramdisk you use, however, you cannot use GenPass to extract correct keys from anything >b2 without decompressing the ramdisk first. Apparently, this is a Snow Leopard only feature for now. You could also (in theory) compile GenPass on your device and use iPhone OS' tools to mount the ramdisk (since they must know how to understand them), although I haven't gotten around to try this yet.

::The compression is affecting beta 3 at this point or beta 1 and 2?
And, since I have snow leopard beta, how do you decompres it under snow leopard? And is this a new feature of snow leopard (in a recent build or from the begening, just that at the moment I have a slow connection making it hard to upgrade snow leopard)?

:::This compression affects betas 2 & 3, but not beta 1. And unfortunately I do not know how to decompress it under any system :( --[[User:Cool name|Cool name]] 01:12, 16 April 2009 (UTC)

Talk:Research: Pwnage Patches

2009-04-14T02:39:52Z

Cool name:

== Kernel and ramdisk patches ==
Anyone care to share what is patched?

== yup ==

'''ramdisk''':

'''asr''' - patch out rootfs SHA1 check

'''restored_external''' - patch wiping routine

'''kernel''':

haven't looked into this, but there are four patches, at least some of them are for codesign and apparently one of them has to do with virtual memory mapping.

== Thanks ==
Do you know how the new codesign is added yet?
I notice you think they didn't use ldid.
It seems that the second patches to asr and restored are codesign (from what I can tell when 2.1 and 2.2 files are compared), but I don't see any in the kernel, they're all simple.

== patches ==

patches to asr and restored are the patches i listed above, and patches for the hashes so that they will run. when i say in the kernel codesign is patch, then it wil patch out the need for code to be signed, but apparently it was determined that the sha1 hash check was too annoying to patched as it would always be changing, so they just rehashed asr and restored, not codesign, just rehashed.

== hashes ==

What are you taking the hash of?
For example, I extracted asr from a stock 018-4378-1.dmg from 2.2 and compared it to one from a custom disk image; diffing them shows two patches; the first I assume to be the SHA1 check (at 0x12F16).
The second at 0x27C7A confuses me though, because I think this must be the hash (I'm new to this stuff, so forgive me if I'm just missing something incredibly obvious).
If I take the hash of the stock asr (9146c06d34b4fa9fc3cb3c7490851fabb875e3c8) and compare it to the hash within the file, it doesn't match (6350E8890FD7217152F72B3EA3285B6D7E617020).
The hash of the custom asr doesn't match the internal hash either, and the same goes for restored.

== isha / ldid ==

it is rehashed with isha or ldid -s, i don't really know the nitty gritty of that stuff.

== 2G DeviceTree ==

It seems that this was never patched until redsn0w QuickPwn.
What exactly is the patch made--[[User:Cool name|Cool name]] 02:24, 14 April 2009 (UTC)--[[User:Cool name|Cool name]] 02:24, 14 April 2009 (UTC) to allow LogoMe to work?
I tried old patches (function-disable_keys -> xxxxxxxx-disable_keys, secure-root-prefix doesn't exist at all), but they don't seem to work.

:disable keys and secure root patches should have worked, afaik, are u sure u decrypted it correctly? [[User:ChronicDev|ChronicDev]] 23:44, 13 April 2009 (UTC)

::I believe I did, all names are visible. I notice at 0x0 - 0x10, there seems to be secure-root-prefix, but it is garbled (*junk*oot-prefix), I don't know what this is about..
::I patched function-disable_keys at 0x3534, though.--[[User:James|James]] 00:10, 14 April 2009 (UTC)

:::you somehow used the wrong IV probably, double check that [[User:ChronicDev|ChronicDev]] 02:00, 14 April 2009 (UTC)

::::I used the IV from ChronicDev GoogleCode, is it correct? I actually don't have a 2G so I cannot verify it. --[[User:James|James]] 02:03, 14 April 2009 (UTC)

:::::Err, James. How do you know the DeviceTree patches are not working if you do not have a 2G to get the keys from?--[[User:Cool name|Cool name]] 02:24, 14 April 2009 (UTC)

::::::I've had other people test them for me. I always thought it was fishy that there was what was seemingly garbage at the beginning of the file, but went with it anyways and made the patch I could. The resulting image would never work, so I knew there must be either another patch or I did it wrong. --[[User:James|James]] 02:29, 14 April 2009 (UTC)

:::::::Ahh ok. You should have someone independently verify the keys of that DeviceTree, because as chronic said that IV is most likely incorrect.--[[User:Cool name|Cool name]] 02:39, 14 April 2009 (UTC)

Talk:Research: Pwnage Patches

2009-04-14T02:24:18Z

Cool name:

Talk:Obtaining IMG3 Keys

2009-04-10T01:16:46Z

Cool name: James' fix

Hey, thats my "exploit" ;-) Dev used openiboot.

Much easier, just use iran to download the modified iBoot directly, no reason to pwn with it. I was originally strapping this with the diags exploit.

And thanks for writing this up.

~geohot

I adapted this method from your write-up earlier, because CPICH and Chronic were wanting to decrypt IMG3 keys, and the openiboot method has quite a bit of setup overhead, and requires modifying my C source, and I thought helping them fill out the missing pieces for your method would be simpler. I just slightly modified your assembly to do stack/register cleanup (and combined that mw into protected memory) and had them put a direct BX from a random iBoot function, since explaining how to patch the permissions bits is more conceptually difficult, and I wasn't sure how easy it would be to make "go" behave the way we want it to (I didn't have access to IDA when I was helping them). I asked them to write it up after they got it to work. Hope that's okay. :)

I've since made something easier: http://www.iphone-dev.org/planetbeing/crypto.tar.gz

--[[User:Planetbeing|Planetbeing]] 03:20, 7 August 2008 (UTC)

== iBoot ==

Why do you need a modified iBoot? Doesn't Pwnage Tool/xpwn/winpwn already patch/modify iBoot?

== no ==

yeah. their iboot is simply patched so the pwned ipsw wil work. there is soooooo much more you can do to the iboot :)

== iBoot ==

Ok, but does the iBoot need to be patched more than Pwnage already does for the userland AES KBAG decryption to work (using the program linked to by planetbeing?)

== no...no... ==

this is...different. not like that at all. just trust planetbeing :)

== Got it ==

Ok, thanks Chronic...and good idea, I will trust planetbeing.

== of course ==

pb is very talented and prolific dev team member, what's not to trust? :)

== 2.0.2 ==

Is there any way to use planetbeing's utility on 2.0.2?
It seems like something about the kernel has changed, since Pwnage doesn't decrypt it before patching.
Is it as simple as patching it in a hex editor or modifying crypto binary? --[[User:James|James]] 06:34, 1 September 2008 (UTC)

== uh..==
planetbeing's thing works fine in 2.0.2. just edit the script so it doesnt require a key and IV. if you dont know how to do that, no offense, but maybe its a sign you should not be doing this, only because it can majorly screw up your iPhone and require a DFU restore if you mess up.

== re:uh... ==
That's exactly why I asked, because I don't know exactly what I'm doing.
I edited the script but didn't want to boot with the resulting kernel, fearing that it'd cause problems.
I use my iPod anyways so I don't lose any information, even if I do have to restore.
Thanks for the answer though. :)

== np ==

no prob

good luck

== chronics modified script for 2.0.2 crypto ==

#!/bin/bash
XPWNTOOL=./xpwntool
PATCHKERNEL=./patch-kernel-crypto
KERNEL=/System/Library/Caches/com.apple.kernelcaches/kernelcache.s5l8900x

${XPWNTOOL} ${KERNEL} /tmp/a
${PATCHKERNEL} /tmp/a
${XPWNTOOL} /tmp/a /tmp/b -t ${KERNEL}
rm /tmp/a
cp ${KERNEL} /kernel.backup
cp /tmp/b ${KERNEL}
rm /tmp/b

there u go :)

James: what did you to fix this problem?

Talk:Ramdisk

2009-04-06T02:03:07Z

Cool name:

==Compression in 3.x==
I'm sure you guys are getting to posting it (well, maybe not, because you may want to keep something secret), but how would one go about decompressing a decrypted ramdisk?
I tried using a decrypted b2 ramdisk with genpass just to realize that it was still compressed, so I kept getting incorrect keys.

:snow leopard
:[[User:ChronicDev|ChronicDev]] 02:01, 6 April 2009 (UTC)
::snow leopard is the only way? :(
::--[[User:Cool name|Cool name]] 02:03, 6 April 2009 (UTC)

PMB8878

2009-04-03T19:53:20Z

Cool name: /* Known Firmware Versions */

This is the baseband processor used in the iPhone 3G. It is upgraded with [[BBUpdaterExtreme]]. It is also known as the [[PMB8878]]

==Datasheet==
Anyone got one? Infineon provides [http://www.infineon.com/dgdl/X-GOLD608_XMM6080.pdf?location=Products.Mobile_Phone_Baseband_ICs.WCDMA___HSDPA.X-GOLD__608_-_PMB_8878.PRODUCT_TYPE_DOCUMENTS.X-GOLD608_XMM6080.pdf&folderId=db3a304312fcb1bc0113000c158f0004&fileId=db3a30431936bc4b011957c66fee3850 this], which isn't really useful.

==Secpack 2.0==
This is the security region in the files sent to the [[X-Gold 608]]. This is the first 0xCF8 is new fls and eep files.

===Layout===
0x634--Memory Map
0x714--Descriptor
0xCD4--Post secpack pointer to name
0xCEC--Data length

==Endpack==
The fls and eep files also have a footer tacked onto the end containing the loader and signature.

==Memory Map==
FLASH 0x20000000 0x1000000
CODE 0x20000000 0x40000 0b0010(bootstrapper)
CODE 0x20040000 0xDC0000 0b0100(main firmware)
FFS 0x20A00000 0x100000 0b1100(empty)
DYNFFS 0x20A00000 0x100000 0b1100(empty)
FFS 0x20B00000 0x40000 0b1011(empty)
DYN_EEP 0x20E40000 0x80000 0b0110
SECPACK 0x20EC0000 0x40000
SECZONE 0x20F80000 0x40000
STATIC_EEP 0x20FC0000 0x40000 0b0111
RAM 0x40000000 0x800000

==MMU relocation table==
===Bootloader===
[[Image:Bltbl.png]]

===Firmware===
[[Image:Bbmmu.png]]

==Complete memory dump==
[http://depositfiles.com/files/i5119hpzm 0x00000000-0x0001FFFF]

[http://depositfiles.com/files/mxslfu4dp 0x20000000-0x20FFFFFF]

[http://depositfiles.com/files/6wiet73wn 0x40000000-0x407FFFFF]

[http://depositfiles.com/files/fioppsphe 0xFFFF0000-0xFFFFFFFF]

== Known Firmware Versions ==
[[1.43.00]] 2.0 (Build 5A331 - Internal Beta)
[[1.45.00]] 2.0 (Build 5A347 - Gold Master)
[[1.48.02]] 2.0.1 (Build 5B108)
[[2.04.03]] 2.1 (Build 5F90)
[[2.08.01]] 2.0.2 (Build 5C1)
[[2.11.07]] 2.1 (Build 5F136)
[[2.28.00]] 2.2 (Build 5G77)
[[2.30.03]] 2.2.1 (Build 5H11)
[[4.20.01]] 3.0 beta 1 (Build 7A238j)
[[4.22.01]] 3.0 beta 2 (Build 7A259g)

==Accessing Interactive Mode==
Interactive mode isn't accessed by sending characters to the baseband. Instead a GPIO pin is raised with a kernel call to preupdate reset.
result = IOConnectCallScalarMethod(conn, 0, 0, 0, 0, 0); //reset
result = IOConnectCallScalarMethod(conn, 1, 0, 0, 0, 0); //power set
result = IOConnectCallScalarMethod(conn, 2, 0, 0, 0, 0); //configuring mux
result = IOConnectCallScalarMethod(conn, 7, 0, 0, 0, 0); //powercycle
result = IOConnectCallScalarMethod(conn, 8, 0, 0, 0, 0); //preupdate reset

Talk:0x24000 Segment Overflow

2009-03-14T02:47:54Z

Cool name: /* Patch for iTunes restore */

I have questions.
What is the LR?
How do we write to the NOR?

LR is the link register. it usually contains a pointer to where the current routine is to return to.
NOR is written by putting the device into dfu mode and writing to the nor0 block device using a tools like iRecovery
--[[User:Posixninja|posixninja]] 17:58, 12 March 2009 (UTC)

I rewrote the article as one geared more toward the technical/security community than hobbyists trying to manually perform the patch. My hope is that it will be more useful in this form for the linux4nano community, who are trying to jailbreak the iPod Nano 4G, which apparently uses the same SoC. --[[User:Planetbeing|Planetbeing]] 07:46, 13 March 2009 (UTC)

Nice work guys. Did you use a debugger of some sort? this would be difficult without a debugger. Here's how I understand it, so we overwrite pointers pointing to where and what data is written. By writing to the stack, we can overwrite the subroutine's return address(LR). The subroutine will now return to the payload. Is this correct?--[[User:Paul0|paulzero]] 11:23, 13 March 2009 (UTC)

'''Answer to Paul0 :'''
Hi Paul0. No debugger at all. Only hundreds of tests to find the LR in the stack :) [thx to posixninja for the tests, planetbeing for the analysis of the tests]. --[[User:Pod2g|Pod2g]]

== Patch for iTunes restore ==

When planetbeing says "However, MuscleNerd discovered that this could be bypassed by including the padding in another tag, such as CERT" in order to allow a restore with iTunes, is this patch included in http://iphwn.org/24kpwn.zip? In other words, if I made a virgin ipt2g, made a 2.2.1 IPSW with the bundles that are out there, and then applied the LLB patch would I be able to successfully restore the IPSW using iTunes?

Answer: Sort of... From a virgin device, you'd have to do two separate set of "Restores". The first will be made from a normal iBoot environment with all signature checking enabled. You will be able to restore the pwned bootloaders (LLB, iBoot) onto the NOR. The second will be made from the pwned iBoot environment, installing the pwned kernel, Cydia, and other filesystem modifications. This is because initially the ramdisk and kernel of the Restore environment has to be loaded from the non-pwned environment, because that very ramdisk and kernel set will be writing the pwned NOR. Since the ramdisk and kernel are both signature checked, the asr binary on the ramdisk cannot be altered to patch out signature checking on the root filesystem image. Therefore, any root filesystem changes will have to be made on the second round. --[[User:Planetbeing|Planetbeing]] 02:22, 14 March 2009 (UTC)

Planetbeing: Thanks for the explanation, I think I understand it now. If I am correct, this exploit also hinges on the fact that the kernel does not sigcheck the stuff it writes to NOR, so it is just blindly writing images to NOR. --[[User:Cool name|Cool name]] 02:47, 14 March 2009 (UTC)

Talk:0x24000 Segment Overflow

2009-03-13T20:18:52Z

Cool name: /* Patch for iTunes restore */ new section

Talk:BurnIn

2009-03-12T19:27:00Z

Cool name: /* Buy one on eBay! */

Where did these pictures come from? ~geohot

Chronic found these pictures from a guy at hackint0sh who sent in his 3G for repair. -wEsTbAeR--

geohot, the only flaw with your ramdisk hypothosis is that someone got their iphone back with that on it. plus, could all the needed frameworks for a GUI application fit on a ramdisk?
[[User:ChronicDev|ChronicDev]]

Chronic, maybe on a 32MB Zibri ZramdiskZ. :P
Actually this is a really bad-ass GUI, so it should fit in these 32MB or something.

-wEsTbAeR--

== nah ==

even this. you need new frameworks that dont come on a vanilla ramdisk

== geohot ==

Actually, I wonder what this does to the baseband. Something has to set up each baseband from the factory, and that something contains the private keys!!!

Only the baseband private keys, not the IPSW private keys. But who cares about the IPSW ones.

== well ==

don't get your hopes up. according to a friend, even builds that are seeded directly to people that work for carriers don't even get this, so this is for people way way way way WAY high up. If only that guy on hackintosh took the iPhone home, the devteam could have helped him pwn and extract the BurnIn application :( I doubt a phone like this will ever be seen in the wild again.

In other words, the likelyhood of us getting this is as likely as us getting the key that Apple uses to sign their ipsws, unless there is another factory slip up.

geohot, as a side note since I am already kind of talking to you :P, would you mind sharing the 114 iboot patches you used to get AES access? thanks to your post, I know how to do it, but I have been trying and I am just not skilled enough to find the correct patches :( I posted them last week, check the page about it ~geohot

== Data recovery? ==

It's a stretch, I know, but what about data recovery? If some (all?) devices have this firmware initially, then it is replaced, could some data still be recovered from the device? Or is it zeroed out before it leaves? I guess the real question is, does an OOTB device have data still on-disk other than actual inodes? --[[User:Haldo|Haldo]] 23:22, 5 August 2008 (UTC)

It would surprise me if the phones had anything on disk. I still believe it is a ramdisk. Although, lets assume I'm wrong. A dump is very easy to do, and if we do it at the iBoot level, I believe we can recover the out of band data too. ~geohot

== 100% ==

its an application dude. talk to me on IRC about it for more info. trust me.

and i saw the page, but I get permission denied errors if i use just what is there unfortunately :(

== Any more? ==

Ah, very nice to see those iPod Touch pictures... I remember them being posted to hackint0sh a while back. Beyond the 3G and iPod Touch, has *anyone* else ever had this happen? While it's rare, it seems to not be impossible.

== does drag to unlock actually unlock ==

well does it? this would be a miracle :) i'll see if i can get someone to lend me a brand new device and maybe we can look to to see if it's there assuming apple doesnt zero out everyone iphone

== Can I try it? ==

I really want to try this out on my iPhone 3G with jailbroken 2.2.1 firmware. Is it possible? Please send me an email: [mailto:drumthrasher109@gmail.com]

--[[User:Drumthrasher109|Drumthrasher109]] 13:27, 10 March 2009 (UTC)

== Buy one on eBay! ==

I know we're not the richest group of folks here, but one (or two) iPhone proto units is selling on eBay. It appears to be running burn-in from early 2007.

Seller of that protos has posted the filesystem dump of that proto at MacRumors, so it's not necessary to spend the cash on this. --[[User:Pjakuszew|Pjakuszew]] 08:00, 12 March 2009 (UTC)

Link to the MacRumors post?

S5L8720 (VROM)

2009-02-05T02:57:13Z

Cool name:

The [[N72ap|iPod touch 2G]] bootrom runs on [[iBoot]] v240.4, which is from somewhere after 1.1.4 and after 2.0 beta 4. It maps itself to 0x0, and stores any global variables (Permissions flags, min / max addrs, image / bdev list, USB power on state, etc.) at 0x22000000.

==Notes==
===Firmware Parsing===
* It seems to only support AES-128 KBAGs, versus current iBoots which also support AES-192 and AES-256 KBAGs. Interestingly, it seems to make space for up to an AES-256 [[KBAG]] (0x30; 0x10 for IV, 0x20 for key) when creating a buffer for it, but the code itself does a check and will error if it is not AES-128.

Main Page

2009-01-31T21:04:59Z

Cool name:

<center>[[Image:Iptwiki.jpg‎]]</center>
<table border=1 width=100%><tr>
<td bgcolor=#64ff64 width=33%><center><b>[http://www.theiphonewiki.com/wiki/index.php?title=Category:Jailbreaks Jailbreak (S5L8900x)]</b></center></td>
<td bgcolor=yellow width=33%><center><b>[[ARM7_Go|Jailbreak (S5L8720x)]] (TODO - Find method to make untethered)</b></center></td>
<td bgcolor=#ff6464 width=33%><center><b>[[Unlock 2.0|Unlock 02.30.03 or break the chain of trust of the X-Gold]]</b></center></td>
</tr>
<tr>
<td colspan=3>
<center>[[Disclaimer]]</center>
</td>
</tr>
</table><BR>

{| cellspacing="3" width="100%"
|- valign="top"
|width="20%" class="MainPageBG" style="border: 1px #999999; color: #000; background-color: rgb(255,255,255)"|
<div style="padding: .3em .7em .7em"> <BR> <BR> __TOC__ </div>
|width="80%" class="MainPageBG" style="border: 1px #c6c9ff; color: #000; background-color: #f0f0ff"|
<div style="padding: .3em .7em .7em"> {{Welcome}} </div>
|}
==Software==
* [[Filesystem]]
* [[Device Nodes]]
* [[System Log]]
* [[IPhoneLinux|Linux on iPhone]]

==Hardware==
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[n45ap|iPod touch (n45ap)]]
* [[n72ap|iPod touch 2nd Generation (n72ap)]]

==App Processor (Jailbreak)==
The iPhone makes use of the [[S5L8900]] platform as application processor. Here is where the [[Jailbreak|jailbreak]] applies.

==Baseband (Unlock)==

The [[Baseband Device]] is where the [[unlock]] applies.

==File formats==
* [[8900 File Format]]
* [[IMG2 File Format]]
* [[IMG3 File Format]]
* [[secpack]]
* [[secpack 2.0]]
* [[seczone]]

==Protocols==
* [[Recovery Mode 0x1280]]
* [[Recovery Mode 0x1281]]
* [[DFU 0x1222]]
* [[WTF 0x1227]]
* [[Normal Mode 0x1290]]
* [[Restore Mode]]
* [[Baseband Bootrom Protocol]]
* [[Interactive Mode|Baseband Bootloader Protocol]]

==Keys==
* [[AES Keys]]
* [[Apple Certificate]]
* [[Baseband RSA Keys]]
* [[Baseband TEA Keys]]
* [[IMG3 Keys / IVs]]
* [[NCK]]
* [[VFDecrypt Keys|Root Filesystem DMG Keys]]

==Application Development==
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

==Tutorials==
See [[Tutorials|here]].

==Useful Links==
See [[Useful Links|here]].

==Definitions==
* [[Jailbreak]]
* [[Activation]]
* [[Unlock]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[DFU]]
* [[iBoot]]
* [[iBEC]]
* [[iBSS]]
* [[NORID]]
* [[CHIPID]]

==Other Useful Hacks==
* [[Bluetooth]]

Talk:IPhone Dev Team

2008-12-26T15:01:32Z

Cool name: /* Sam */ new section

I know about the rest of them, but does anyone have any idea why kroo was kicked out? My guess is that he leaked the DFU/iBoot exploit to geohot..

== Sam ==

chronic seems to think that sam is no longer on the devteam, however on hackint0sh his tag still says 'iPhone Dev Team' and in this post (http://hackint0sh.org/forum/showthread.php?t=61327) he speaks as one of the devteam.

Can anyone provide anymore insight on Sam..is he still on the devteam or not?