Usb control msg(0x21, 2) Exploit

2009-10-09T08:33:53Z

EViscegaS:

{{DISPLAYTITLE:usb_control_msg(0x21, 2) Exploit}}
== Credit (Alphabetical) ==
* '''vulnerability''': pod2g and westbaer, also discovered independently by gray, also discovered independently by [[geohot]]
* '''exploitation''': ius, chronic, pod2g, and posixninja
* '''payload ([[greenpois0n]])''': chronic and posixninja

== Vulnerability ==
'''pod2g''' and '''westbaer''' discovered, via some reversing + fuzzing, you could overwrite the content of 0x0 thanks to Apple not checking the contents of a register they should have, shown in the disassm below. Now, the reason that this is useful is because the MMU maps whatever is running ([[LLB]], [[iBoot]], etc.) to 0x0 so that if an exception vector is triggered, it would jump to the one designed to be used with what is running, versus jumping to what is normally located at 0x0, the [[S5L8920 (Bootrom)|bootrom]].

All you need to do is send the following (assuming you're using libusb 0.1.x)...
usb_control_msg(iDev, 0x21, 2, 0, 0, 0, 0, 1000);
And thanks to our vulnerability, it will do this:
memcpy(0, LOAD_ADDR, 0x2000);

As you can see, we have full control over the first 0x2000 bytes of iBoot.

=== Disassm ===
<pre>
// R5: a pointer to a buffer is here if requesttype==0xA1.
// however, if requesttype==0x21, R5 is undefined.

SRAM:22009ED2 code_1 ; CODE XREF: handle_file_io_control_req+62�j
SRAM:22009ED2 014 36 49 LDR R1, =usb_file_loadaddr
SRAM:22009ED4 014 36 4B LDR R3, =usb_file_offset
SRAM:22009ED6 014 28 68 LDR R0, [R5]
SRAM:22009ED8 014 09 68 LDR R1, [R1]
SRAM:22009EDA 014 1B 68 LDR R3, [R3]
SRAM:22009EDC 014 22 1C ADDS R2, R4, #0
SRAM:22009EDE 014 C9 18 ADDS R1, R1, R3
SRAM:22009EE0 014 07 F0 94 EF BLX memcpy
SRAM:22009EE4 014 00 2E CMP R6, #0
SRAM:22009EE6 014 53 D0 BEQ return
SRAM:22009EE8 014 01 23 MOVS R3, #1
SRAM:22009EEA 014 33 60 STR R3, [R6]
SRAM:22009EEC 014 50 E0 B return
</pre>

== Exploitation ==
So, how do you actually run code with this? Well, '''chronic''' suggested that since the irq vector was in constant use, we try that, so we were able to simply replace the address of the irq vector handler in the 0x2000 [[iBoot]] chunk that we send with 0x41002000, and then just tack our payload to the end of that chunk. Of course, since we are hijacking the irq exception, you must disable interrupts first. Here is the basic procedure:
* Call enter_critical_task(); disabling interrupts, so that your code can reliably execute.
* Restore 0x38 with the original irq vector address
* '''DO WHAT YOU WANT AT THIS POINT, YOU MAY NOT USE INTERRUPTS'''.
* Call exit_critical_task(); re-enabling interrupts.
* Call the irq handler so that the interrupt request that you hijacked can execute.

=== Roadblocks ===
* If what you send is not 0x2000 bytes, the remainder is filled in with zeroes, which is bad.
* Due to the above rule, you need the first 0x2000 of a decrypted iBoot by the time your payload is done running.
* You must disable interrupts to reliably execute your payload. Due to this, this will rule out the possibility of reading the 0x2000 iBoot chunk needed from NOR, since nor_read(); requires interrupts.

The [[PwnageTool]] method requires an [[IPSW]] to be input in order to create a custom firmware anyway, so the 0x2000 chunk is not an issue. It can just be copied from the [[iBoot]] in the [[IPSW]].

[[Category:Exploits]]

Firmware

2009-10-08T20:46:39Z

EViscegaS: /* iPod touch (1st generation) */

This is the iPhone OS system the iPhone runs. Latest Apple download links can be found [http://www.itunes.com/version here].

==Comparison of firmware versions==

===[[iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{yes}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| Heavenly 1A543a
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| Heavenly 1C25
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| Heavenly 1C28
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| Snowbird 3A109a
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| Oktoberfest 3B48b
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| Little Bear 4A93
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| Little Bear 4A102
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| Big Bear 5A347
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
| {{yes}}
| 228,768,637
|-
| 2.0.1
| Big Bear 5B108
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| {{yes}}
| 254,048,068
|-
| 2.0.2
| Big Bear 5C1
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| {{yes}}
| 253,589,000
|-
| 2.1
| Sugar Bowl 5F136
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| {{yes}}
| 242,171,241
|-
| 2.2
| Timberline 5G77
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| {{yes}}
| 257,576,980
|-
| 2.2.1
| SUTimberline 5H11
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
|
| {{yes}}
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| {{yes}}
| 252,536,460
|-
| 3.1.2
| 7D11
| ??
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>??</code>
|
| style="background:yellow; color:black;" class="table-yes" | Probably, not yet released
| {{yes}}
| 252,515,888
|}

===[[iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 2.0
| Big Bear 5A345
| 01.45.00
| No download available
|
| Initial iPhone 3G shipment.
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
|
|-
| 2.0
| Big Bear 5A347
| 01.45.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 235,957,125
|-
| 2.0.1
| Big Bear 5B108
| 01.48.02
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 261,224,227
|-
| 2.0.2
| Big Bear 5C1
| 02.08.01
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 260,761,030
|-
| 2.1
| Sugar Bowl 5F136
| 02.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 249,341,655
|-
| 2.2
| Timberline 5G77
| 02.28.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 258,342,348
|-
| 2.2.1
| SUTimberline 5H11
| 02.30.03
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
| {{yes|Yes (with [[ultrasn0w]])}}
| 241,229,233
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
|
| {{yes}}
| {{yes}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
| {{no|No (Though you can stay at 04.26.08)}}
| 253,361,339
|-
| 3.1.2
| 7D11
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| style="background:yellow; color:black;" class="table-yes" | Probably, not yet released
| {{no}}
| 253,340,786
|}

===[[iPhone2,1|iPhone 3GS]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
| {{yes|Yes (with [[ultrasn0w]] or [[purplesn0w]])}}
| 312,292,933
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
|
| {{yes}}
| {{yes}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
| Installed on phones produced week 37.
| style="background:yellow; color:black;" class="table-yes" | Only if previously jailbroken on 3.0/3.0.1
| {{no|No (Though you can stay at 04.26.08)}}
| 321,011,474
|-
| 3.1.2
| 7D11
| ??
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>??</code>
|
| {{no}}
| {{no}}
| 321,015,700
|}

===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 1.1.0
| Snowbird 3A100a
| No download available
|
| Initial shipment.
| {{yes}}
|
|-
| 1.1.0
| Snowbird 3A101a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{yes}}
| 157,890,186
|-
| 1.1.1
| Snowbird 3A110a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| Oktoberfest 3B48b
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| Little Bear 4A93
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| Little Bear 4A102
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| Little Bear 4B1
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| Big Bear 5A347
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| Big Bear 5B108
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| Big Bear 5C1
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| Sugar Bowl 5F137
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| Timberline 5G77
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| SUTimberline 5H11
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| Kirkwood 7A341
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| Northstar 7C145
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| 7D11
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| style="background:yellow; color:black;" class="table-yes" | Probably, not yet released
| 249,780,497
|}

===[[N72ap|iPod touch (2nd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes}}
| 282,083,944
|-
| 2.2
| Timberline 5G77a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{yes}}
| 291,123,491
|-
| 2.2.1
| SUTimberline 5H11a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| Northstar 7C145
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
|
| style="background:yellow; color:black;" class="table-yes" | Only if previously jailbroken on 3.0
| 277,753,989
|-
| 3.1.2
| 7D11
| Download Link Prohibited
| <code>??</code>
|
| {{no}}
| 277,794,671
|}

===[[N18AP|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| style="background:yellow; color:black;" class="table-yes" | Probably, not yet released
| 311,702,789
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| style="background:yellow; color:black;" class="table-yes" | Probably, not yet released
| 311,690,768
|-
| 3.1.2
| 7D11
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>??</code>
|
| {{no}}
| 311,740,034
|}

==See also==
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://pastebin.ca/1209360 A link of interest...]

The iPhone Wiki - User contributions [en]

Usb control msg(0x21, 2) Exploit

Firmware