KBAG

2020-03-16T20:26:21Z

Fox8091: Fix spelling & make consistant

Apple's [[IMG3 File Format|IMG3]] and [[IMG4 File Format|IMG4]] security scheme uses a data format called a '''KBAG'''. At the bottom of a firmware file, you will see something that will, on the ASCII side of your hex editor, say "GABK", which, as ARM is [[wikipedia:little-endian|little-endian]] based, is "KBAG" flipped. Look on the hex side and you will see the KBAG according to this format:

== How it works ==
It boils down to using the [[GID Key]] to decrypt <code>encIV</code> and <code>encKey</code>, then using that key and IV to decrypt the DATA section of the file (the code itself).

Because of the circumstances with the [[IMG3 File Format]], the kernel never needs to even touch the [[GID Key]] anymore, as its job is to just flash the image to the [[NOR]] as is, with container and all.

In order to decrypt the KBAG for img3, you need to remove them using this command: <code>dd if=IMG3_FILE bs=1 skip=4741424B count=0x70</code> or for img4, <code>dd if=IMG4FILE bs=44 skip=1 | openssl enc -aes-256-cbc -d -nopad -iv IV -K KEY > OUTPUTFILE</code>

To grab the KBAG for img3 files, you'd run <code>xpwntool /path/to/img3/ /dev/null</code>.

This is different with img4 files. For these, you can use [https://github.com/xerub/img4lib img4lib] and run the following command: <code>img4 -i /path/to/image.im4p -b</code>.

==KBAG Format==
===KBAG128===
typedef struct Unparsed_KBAG_AES128 {
uint32_t magic; // string with bytes flipped ("KBAG" in little endian)
uint32_t fullSize; // size of KBAG from beyond that point to the end of it
uint32_t tagDataSize; // size of KBAG without this 0xC header
uint32_t cryptState; // 1 if the key and IV in the KBAG are encrypted with the [[GID Key]]
// 2 is used with a second KBAG for the [[S5L8920]], use is unknown.
uint32_t aesType; // 0x80 = aes128 / 0xc0 = aes192 / 0x100 = aes256
uint8_t encIV[16]; // IV for the firmware file, encrypted with the [[GID Key]]
uint8_t encKey[16]; // Key for the firmware file, encrypted with the [[GID Key]]
} UnparsedKbagAes128_t;

===KBAG192===
typedef struct Unparsed_KBAG_AES192 {
uint32_t magic; // string with bytes flipped ("KBAG" in little endian)
uint32_t fullSize; // size of KBAG from beyond that point to the end of it
uint32_t tagDataSize; // size of KBAG without this 0xC header
uint32_t cryptState; // 1 if the key and IV in the KBAG are encrypted with the [[GID Key]]
// 2 is used with a second KBAG for the [[S5L8920]], use is unknown.
uint32_t aesType; // 0x80 = aes128 / 0xc0 = aes192 / 0x100 = aes256
uint8_t encIV[16]; // IV for the firmware file, encrypted with the [[GID Key]]
uint8_t encKey[24]; // Key for the firmware file, encrypted with the [[GID Key]]
} UnparsedKbagAes192_t;

===KBAG256===
typedef struct Unparsed_KBAG_256 {
uint32_t magic; // string with bytes flipped ("KBAG" in little endian)
uint32_t fullSize; // size of KBAG from beyond that point to the end of it
uint32_t tagDataSize; // size of KBAG without this 0xC header
uint32_t cryptState; // 1 if the key and IV in the KBAG are encrypted with the [[GID Key]]
// 2 is used with a second KBAG for the [[S5L8920]], use is unknown.
uint32_t aesType; // 0x80 = aes128 / 0xc0 = aes192 / 0x100 = aes256
uint8_t encIV[16]; // IV for the firmware file, encrypted with the [[GID Key]]
uint8_t encKey[32]; // Key for the firmware file, encrypted with the [[GID Key]]
} UnparsedKbagAes256_t;

[[Category:Firmware Tags]]

YukonB 17B111 (iPhone8,4)

2020-02-19T04:06:22Z

Fox8091: Add partial 13.2.3 keys

{{keys
| Version = 13.2.3
| Build = 17B111
| Device = iPhone8,4
| Codename = YukonB
| DownloadURL = http://updates-http.cdn-apple.com/2019FallFCS/fullrestores/061-49534/9B7159D2-0698-11EA-8279-C2B9E97E1FF8/iPhone_4.0_64bit_13.2.3_17B111_Restore.ipsw

| Model = N69AP
| Model2 = N69uAP

| RootFS = 048-90764-106
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-90336-111
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-90011-111
| RestoreRamdiskIV = Not Encrypted

| AOP = aopfw-s8000aop.im4p
| AOPIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n69uap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n69.RELEASE.im4p
| iBECIV = Unknown
| iBECKey = Unknown

| iBEC2 = iBEC.n69u.RELEASE.im4p
| iBEC2IV = e0d9a06cad043f8b505736ce8bec87c3
| iBEC2Key = bc5c628b24b43d40d965a77a344caacce75822ee4091051660dbc15e7466d064

| iBoot = iBoot.n69.RELEASE.im4p
| iBootIV = Unknown
| iBootKey = Unknown

| iBoot2 = iBoot.n69u.RELEASE.im4p
| iBoot2IV = da902ec9c927978c7e76e5fa353d8bd6
| iBoot2Key = c92739cf3b09d9147cd709e0a31333141af0ffc70a9b46610209f19d34e893f6

| iBSS = iBSS.n69.RELEASE.im4p
| iBSSIV = Unknown
| iBSSKey = Unknown

| iBSS2 = iBSS.n69u.RELEASE.im4p
| iBSS2IV = cca4f18dc5705ee3a0b7e34f088bc2b2
| iBSS2Key = 88d47fc121bdcd647667b731c985f4896bef8051673ca4f03a5c5857763d0d57

| Kernelcache = kernelcache.release.iphone8b
| KernelcacheIV = Not Encrypted

| LLB = LLB.n69.RELEASE.im4p
| LLBIV = Unknown
| LLBKey = Unknown

| LLB2 = LLB.n69u.RELEASE.im4p
| LLB2IV = 2ff9bee41a12b216135bb7cc01d984ce
| LLB2Key = 42930cdd0c7827180d08d2af5637d4e45bcf82e7caa1f10ab0e9fdf6999095db

| RecoveryMode = recoverymode@1136~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n69.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = Unknown

| SEPFirmware2 = sep-firmware.n69u.RELEASE.im4p
| SEPFirmware2IV = Unknown
| SEPFirmware2Key = Unknown
| SEPFirmware2KBAG = ec0b36b06561a0c66923523ae282f579dbee4f795dfa116f978483eccd7bc509952836d52a149ad51e405a6b818e2e8c

}}

The iPhone Wiki - User contributions [en]

KBAG

YukonB 17B111 (iPhone8,4)