SHSH

2011-08-16T03:40:29Z

Danniez: /* Protocol */

0x80 byte RSA signature of a firmware image.

This often also refers to the backup file with the signature. This signature is needed to restore a specific firmware version. The signature is being created by Apple and is being generated based on some hardware keys of the device and the hash of the firmware. Using a [[wikipedia:replay attack|replay attack]], with the saved signature old firmware can be restored, although Apple doesn't issue the signatures anymore and therefore disallows installing older firmware. Therefore it is recommended to save the signature for your device as long as Apple issues it.

To downgrade the firmware, simply change your hosts file to map any request to an Apple server to point to [[Saurik]]'s server instead, if your certificate is there. If you have the file yourself, run [[TinyUmbrella]] on your local machine.

Not all devices have this check built in. Older devices allow installation of any correctly signed firmware, so no backup of the certificate is necessary. Devices that need Apple signatures are: [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4]], [[N18ap|iPod touch 3G]], [[K48ap|iPad]], [[iPad 2]], [[n81ap|iPod touch 4G]], [[K66ap|Apple TV 2G]] and all newer devices. The [[N88ap|iPhone 3G]] and [[N72ap|iPod touch 2G]] bootroms do not require these SHSHs; however, newer versions of iOS require them (unless the chain of trust is broken and custom firmwares are installed). To restore to arbitrary versions of iOS 4.0, the SHSH is also needed for the [[N72ap|iPod touch 2G]] and [[N82ap|iPhone 3G]]. Not only does [[DFU Mode]] require the [[iBSS]]/[[iBEC]] files to be signed with an SHSH that includes the device's [[ECID]], but the normal boot-chain requires the [[LLB]] to be fully signed with an [[ECID]]+SHSH, so a downgrade [[IPSW File Format|IPSW]] is not possible without a bootrom exploit of normal boot-chain (e.g. [[0x24000 Segment Overflow]]). See also the [http://blog.iphone-dev.org/post/833937433 Dev Team Blog post] about this.

With the tools mentioned below it is possible to backup the signature. It is not necessary that the device is jailbroken to do the backup. Usually the SHSH signature file is stored on [[Cydia Server|Saurik's server]]. If it is stored there, then you can see in the top of [[Cydia Application|Cydia]] (on jailbroken devices) for which version a backup exists.

Users usually make the mistake that (even if they understand all this) they think the SHSH firmware version they back up depends on the firmware version they have installed on their device. This is the case for [[iFaith]], but not for TinyUmbrella. iFaith dumps the SHSHs from your device's storage (whatever's installed on your device, e.g. 4.3.3), while TinyUmbrella gets SHSHs from Apple's servers (whatever firmwares Apple is currently signing).

==Timeline==
{| class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! width="50" | iOS
! width="480" | for Device(s)
! width="130" | From
! width="130" | Until
! width="130" | Status
|-
| <= 3.0
| [[N72ap|iPod touch 2G]]
| Unused
| Unused
| {{partial|Unused}}
|-
| <= 3.1.3
| [[M68ap|iPhone 2G]], [[N82ap|iPhone 3G]], [[N45ap|iPod touch 1G]]
| Unused
| Unused
| {{partial|Unused}}
|-
| 3.0
| [[N88ap|iPhone 3GS]]
| 19 June 2009
| 9 September 2009
| {{no|Closed}}
|-
| 3.0.1
| [[N88ap|iPhone 3GS]]
| 31 July 2009
| 9 September 2009
| {{no|Closed}}
|-
| 3.1
| [[N88ap|iPhone 3GS]]
| 9 September 2009
| 8 October 2009
| {{no|Closed}}
|-
| 3.1.1
| [[N72ap|iPod touch 2G]]
| 9 September 2009
| 21 June 2010
| {{no|Closed}}
|-
| 3.1.1
| [[N18ap|iPod touch 3G]]
| 9 September 2009
| 8 October 2009
| {{no|Closed}}
|-
| 3.1.2
| [[N72ap|iPod touch 2G]]
| 8 October 2009
| 21 June 2010
| {{no|Closed}}
|-
| 3.1.2
| [[N88ap|iPhone 3GS]], [[N18ap|iPod touch 3G]]
| 8 October 2009
| 2 February 2010
| {{no|Closed}}
|-
| 3.1.3
| [[N72ap|iPod touch 2G]]
| 2 February 2010
| 21 June 2010
| {{no|Closed}}
|-
| 3.1.3
| [[N88ap|iPhone 3GS]], [[N18ap|iPod touch 3G]]
| 2 February 2010
| 21 June 2010
| {{no|Closed}}
|-
| 3.2
| [[K48ap|iPad]]
| 3 April 2010
| 15 July 2010
| {{no|Closed}}
|-
| 3.2.1
| [[K48ap|iPad]]
| 15 July 2010
| 19 August 2010
| {{no|Closed}}
|-
| 3.2.2
| [[K48ap|iPad]]
| 11 August 2010
| 2 December 2010 (?)
| {{no|Closed}}
|-
| 4.0
| [[N72ap|iPod touch 2G]]
| 21 June 2010
| 9 September 2010
| {{no|Closed}}
|-
| 4.0
| [[N18ap|iPod touch 3G]]
| 21 June 2010
| 19 August 2010
| {{no|Closed}}
|-
| 4.0
| [[N82ap|iPhone 3G]], [[N88ap|iPhone 3GS]]
| 21 June 2010
| 15 July 2010
| {{no|Closed}}
|-
| 4.0
| [[N90ap|iPhone 4]]
| 24 June 2010
| 15 July 2010
| {{no|Closed}}
|-
| 4.0.1
| [[N82ap|iPhone 3G]]
| 15 July 2010
| 9 September 2010
| {{no|Closed}}
|-
| 4.0.1
| [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4]]
| 15 July 2010
| 19 August 2010
| {{no|Closed}}
|-
| 4.0.2
| [[N82ap|iPhone 3G]], [[N72ap|iPod touch 2G]]
| 11 August 2010
| 18 September 2010
| {{no|Closed}}
|-
| 4.0.2
| [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4]], [[N18ap|iPod touch 3G]]
| 11 August 2010
| 9 September 2010
| {{no|Closed}}
|-
| 4.1
| [[N82ap|iPhone 3G]], [[N72ap|iPod touch 2G]]
| 8 September 2010
| -
| {{yes|Open}}
|-
| 4.1
| [[N88ap|iPhone 3GS]], [[N18ap|iPod touch 3G]]
| 8 September 2010
| -
| {{yes|Open}}
|-
| 4.1
| [[N90ap|iPhone 4]], [[N81ap|iPod touch 4G]]
| 8 September 2010
| 2 December 2010 (?)
| {{no|Closed}}
|-
| {{nowrap|4.1 (4.0)}}
| [[K66ap|Apple TV 2G]]
| 29 September 2010
| 2 December 2010 (?)
| {{no|Closed}}
|-
| {{nowrap|4.2 (4.1)}}
| [[K66ap|Apple TV 2G]]
| 22 November 2010
| 14 December 2010
| {{no|Closed}}
|-
| 4.2.1
| [[K48ap|iPad]], [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 22 November 2010
| 11 March 2011
| {{No|Closed}}
|-
| 4.2.1
| [[N82ap|iPhone 3G]], [[N72ap|iPod touch 2G]]
| 22 November 2010
| -
| {{yes|Open}}
|-
| {{nowrap|4.2.1 (4.1.1)}}
| [[K66ap|Apple TV 2G]]
| 14 December 2010
| 28 May 2011 (?)
| {{No|Closed}}
|-
| 4.2.5
| [[N92ap|iPhone 4 CDMA]]
| 11 January 2011
| closed before product release
| {{No|Closed}}
|-
| 4.2.6
| [[N92ap|iPhone 4 CDMA]]
| 1 February 2011
| 19 April 2011 (?)
| {{No|Closed}}
|-
| 4.2.7
| [[N92ap|iPhone 4 CDMA]]
| 14 April 2011
| 6 May 2011
| {{No|Closed}}
|-
| 4.2.8
| [[N92ap|iPhone 4 CDMA]]
| 4 May 2011
| 18 July 2011
| {{no|Closed}}
|-
| 4.2.9
| [[N92ap|iPhone 4 CDMA]]
| 15 July 2011
| 27 July 2011
| {{no|Closed}}
|-
| 4.2.10
| [[N92ap|iPhone 4 CDMA]]
| 25 July 2011
| -
| {{yes|Open}}
|-
| 4.3
| [[K48ap|iPad]], [[iPad 2]], [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 9 March 2011
| 27 March 2011 (?)
| {{No|Closed}}
|-
| {{nowrap|4.3 (4.2)}}
| [[K66ap|Apple TV 2G]]
| 9 March 2011
| 22 March 2011 (?)
| {{No|Closed}}
|-
| {{nowrap|4.3 (4.2.1)}}
| [[K66ap|Apple TV 2G]]
| 22 March 2011
| 28 May 2011 (?)
| {{No|Closed}}
|-
| {{nowrap|4.3 (4.2.2)}}
| [[K66ap|Apple TV 2G]]
| 11 May 2011
| -
| {{yes|Open}}
|-
| {{nowrap|4.3 (4.3)}}
| [[K66ap|Apple TV 2G]]
| 1 August 2011
| -
| {{yes|Open}}
|-
| 4.3.1
| [[K48ap|iPad]], [[iPad 2]], [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 25 March 2011
| 19 April 2011 (?)
| {{No|Closed}}
|-
| 4.3.2
| [[K48ap|iPad]], [[iPad 2]], [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 14 April 2011
| 6 May 2011
| {{No|Closed}}
|-
| 4.3.3
| [[K48ap|iPad]], [[iPad 2]], [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 4 May 2011
| 18 July 2011
| {{no|Closed}}
|-
| 4.3.4
| [[K48ap|iPad]], [[iPad 2]], [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 15 July 2011
| 27 July 2011
| {{no|Closed}}
|-
| 4.3.5
| [[K48ap|iPad]], [[iPad 2]], [[N88ap|iPhone 3GS]], [[N90ap|iPhone 4]], [[N18ap|iPod touch 3G]], [[N81ap|iPod touch 4G]]
| 25 July 2011
| -
| {{yes|Open}}
|}

==Protocol==
To request a SHSH blob from Apple, a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] request can be made. For a full description, please see the separate article [[SHSH Protocol]] and [[Baseband SHSH Protocol]].

==Links and Tools==
* [[TinyUmbrella]] (Java needed)
* [http://www.saurik.com/id/12 Detailed background info from Saurik]

[[Category:Firmware Tags]]

Main Page

2010-06-08T03:28:15Z

Danniez:

<center>[[Image:Iptwiki.png]]</center>

{{:Main Page/Welcome}}
<table border="1" width="100%" style="background-color:orange;"><tr>
<td style="background-color:orange; text-align:center; width:25%;"><b>[[Jailbreak iPhone2,1 / iPod3,1|Find bootrom exploit allowing unsigned code exec via USB (S5L8920+)]]</b></td>
<td style="background-color:orange; text-align:center; width:25%;"><b>[[Unlock 2.0|Break Chain of Trust (X-Gold 608)]]</b></td>
</tr>
</table><br />

{{col-begin}}
{{col-2}}
{{HeadingA|Software}}
* [[/|Filesystem]]
* [[Firmware]]
* [[Keys]]
** [[AES Keys]]
** [[Apple Certificate]]
** [[Baseband RSA Keys|RSA Keys]]
** [[Baseband TEA Keys|TEA Keys]]
** [[NCK]]
* [[Protocols]]
** [[Normal Mode]]
** [[Recovery Mode (Protocols)|Recovery Mode]]
** [[Restore Mode]]
** [[DFU (Protocol)|DFU]]
** [[Baseband Bootrom Protocol]]
** [[Interactive Mode|Baseband Bootloader Protocol]]
* [[System Log|System Log (syslog)]]
{{col-2}}
{{HeadingB|Hardware}}
====iPhone====
* [[m68ap|iPhone (m68ap)]]
* [[n82ap|iPhone 3G (n82ap)]]
* [[N88ap|iPhone 3GS (n88ap)]]
* [[N??ap|iPhone 4 (n??ap)]]

====iPod Touch====
* [[n45ap|iPod touch (n45ap)]]
* [[n72ap|iPod touch 2nd Generation (n72ap)]]
* [[N18ap|iPod touch 3rd Generation (n18ap)]]

====iPad====
* [[K48ap|iPad (k48ap)]]

====Processors====
* [[S5L8900]] ([[iPhone]], [[iPod Touch]], [[iPhone 3G]])
* [[S5L8720]] ([[iPod touch 2G]])
* [[S5L8920]] ([[N88AP|iPhone 3GS]])
* [[S5L8922]] ([[N18ap|iPod Touch 3G]])
* [[S5L8930]] ([[k48ap|iPad]])
* [[Baseband Device]]

====Other====
* [[Bluetooth]]
{{col-end}}

{{col-begin}}
{{col-2}}
{{HeadingA|Development}}
====Application Development====
* [[Toolchain]] (Includes tutorials)
* [[Toolchain 2.0]] (Includes tutorials)
* [[Frameworks]]
* [[MobileDevice Library]]
* [[Apple Certification Process]]
* [[Bypassing iPhone Code Signatures]]
* [[Distribution Methods]]

====Application Copy Protection====
* [[Copy Protection Overview]]
* [[Application Structure and Signatures]]
* [[Mach-O Loading Process]]
* [[Bugging Debuggers]]
* [[Defeating Cracks]]
{{col-2}}
{{HeadingB|Help}}
====Guides====
* [[Tutorials]]
* [[Useful Links]]

====Definitions====
* [[Glossary]]
* [[Jailbreak]]
* [[Activation]]
* [[Unlock]]
* [[Baseband Device|Baseband]]
* [[Baseband Bootloader|Bootloader]]
* [[DFU]]
* [[ECID]]
* [[iBoot]]
* [[iBEC]]
* [[iBSS]]
* [[SHSH]]
* [[NORID]]
* [[CHIPID]]
{{col-end}}

<table border="1" width="100%" style="background-color:orange;">
<tr>
<td colspan="4" style="background-color:orange; text-align:center;">
<center>[[Disclaimer]]</center>
</td>
</tr>
</table>

__NOTOC____NOEDITSECTION__

The iPhone Wiki - User contributions [en]

SHSH

Main Page