The iPhone Wiki - User contributions [en]

Talk:Genoa 13G34 (iPad3,4)

2019-10-30T02:25:05Z

Gjest: partially faulty set of keys

This set of keys appears to be faulty:
# The root file system is <code>058-48446-034.dmg</code>, not <code>058-48320-034.dmg</code>
# The ramdisk keys do not work
[[User:Gjest|Gjest]] ([[User talk:Gjest|talk]]) 02:22, 30 October 2019 (UTC)

: PS. The kernelcache, iBEC, iBSS and AppleLogo keys do work. [[User:Gjest|Gjest]] ([[User talk:Gjest|talk]]) 02:24, 30 October 2019 (UTC)

Talk:Genoa 13G34 (iPad3,4)

2019-10-30T02:24:07Z

Gjest: Created page with "This set of keys appears to be faulty: # The root file system is <code>058-48446-034.dmg</code>, not <code>058-48320-034.dmg</code> # The ramdisk keys do not work ~~~~"

SDOM

2018-02-08T03:22:52Z

Gjest: 0x01 is kImage3SecurityDomainDarwin

The '''SDOM''' ('''Security DOMain''') tag specifies the device that the firmware is supposed to be ran on. It allows Apple to make sure you are not running another device's firmware files on an incompatible device, probably to prevent using old exploits. It can be found next to the <code>ApSecurityDomain</code> in the BuildManifest.plist of an IPSW. Every device has the value <code>kImage3SecurityDomainDarwin</code> (<code>0x01</code>), <code>kImage3SecurityDomainManufacturer</code> (<code>0x00</code>) is unused in public builds.

{{stub|firmware}}
[[Category:Firmware Tags]]

IBEC

2018-02-08T03:07:11Z

Gjest: new name in iOS 10

{{lowercase}}
'''iBEC''' (short for '''''iB'''oot '''E'''poch '''C'''hange'') is a stripped down version of [[IBoot (Bootloader)|iBoot]] which is uploaded when performing a restore from Fake DFU in [[LLB]]. It was renamed '''iBootStage2''' in iOS 10.

If iBEC is damaged, the device won't get into [[Restore Mode]] and will stay in [[DFU Mode]] or [[Recovery Mode]].

IBSS

2018-02-08T03:07:07Z

Gjest: new name in iOS 10

{{lowercase}}
'''iBSS''' (short for '''''iB'''oot '''S'''ingle '''S'''tage'') is a stripped down version of [[IBoot (Bootloader)|iBoot]], missing things such as interacting with the [[/|filesystem]]. Can be uploaded via [[DFU (Protocol)|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore. It was renamed '''iBootStage1''' in iOS 10.

According to Apple’s source code, ''“dongle products get an iBSS with all of iBoot’s recovery mode accroutements, EXCEPT for filesystem support”''.

== Use of the iBSS ==
The [[iBSS]] bootstraps the [[iBEC]], which prepares and executes the [[Restore Ramdisk]]. in addition, it sends messages to [[iTunes]] on the restore to supervise the restore process. It also integrity checks the images uploaded, and on iOS5+ does the image responsible for [[APTicket]], by uploading the [[nonce]] string to [[iTunes]] then checks for the match of the [[APTicket]] and [[nonce]] and the signatures on [[APTicket]]. On custom firmwares, the [[iBSS]] is patched out of every signature check, but on certain circumstances it still generates [[nonce]]. Check [[APTicket]] for further detail.

On jailbreak softwares like [[redsn0w]] and [[greenpois0n]], the [[iBSS]] bootstraps [[iBEC]] and executes a payload. It is patched out of its signature checks, of course.

== iBSS 5.x ==

iBSS in iOS 5.x is very similar to LLB/DFU, where it has the same protocol. On UART out, it says: "iBSS ready. Asking for DFU...", or something along those lines.

Interesting things I've noted are when certain bits in chip ID are set, it uses a different DFU device identifier (I've personally seen 0x1226/0x1228), and these modes reject any Img3 files sent over USB.

== See also ==
* [[iBSS commands]]

IBoot

2018-02-08T03:04:18Z

Gjest: + comparison table (with modules/options) to make it easier to determine which component one is looking for

{{lowercase}}
'''iBoot''' is the name of Apple’s bootloader. Its components are implemented in both hardware and software, and the term '''iBoot''' may refer to one of the following, which all have '''iBoot-''' in their version strings:
* [[Bootrom]] (SecureROM), the hardware implementation
* Any of the four variants of the software implementation:
:* [[iBEC]] (iBoot Epoch Change; called iBootStage2 in iOS 10 and later)
:* [[iBoot (Bootloader)|iBoot second-stage loader]] (often called simply ''iBoot'')
:* [[iBSS]] (iBoot Single Stage; called iBootStage1 in iOS 10 and later)
:* [[LLB]] (Low Level Bootloader or iBoot first-stage loader)

The software implementations are built from the same source, but with different build parameters, as shown in the comparison table below.

{| class="wikitable"
|-
! rowspan=2 | Product !! colspan=7 | Modules !! rowspan=2 | Text bank !! rowspan=2 | Options
|-
! BOOT !! CONSOLE !! DFU !! DISPLAY !! FILESYSTEM !! FIRMWARE !! RECOVERY
|-
| iBoot || {{yes}} || {{no}} || {{no}} || {{yes}} || {{yes}} || {{no}}*** || {{yes}} || sdram || recovery, boot, filesystem, restore_strap
|-
| iBEC || {{yes}} || {{no}} || {{no}} || {{no}} || {{yes}} || {{no}}*** || {{yes}} || sdram || recovery, boot, filesystem, restore_boot
|-
| iBSS || {{yes}}* || {{no}}** || {{yes}} || {{no}} || {{no}} || {{no}}*** || {{yes}}* || sram || dfu, restore_strap, recovery*, boot*, restore_boot*, console**
|-
| LLB || {{no}} || {{no}}** || {{yes}} || {{no}} || {{no}} || {{yes}} || {{no}} || sram || dfu, restore_strap, console**
|}
<nowiki>*</nowiki> Not included in special development builds 
<nowiki>**</nowiki> Included in special development builds 
<nowiki>***</nowiki> Included through the BOOT module, which consists of the submodules FIRMWARE, NVRAM, RAMDISK and SYSCFG.

{{Disambig}}

IBSS

2018-02-08T02:08:55Z

Gjest: dongle products have iBSS too

{{DISPLAYTITLE:iBSS}}
'''iBSS''' (short for '''''iB'''oot '''S'''ingle '''S'''tage'') is a stripped down version of [[IBoot (Bootloader)|iBoot]], missing things such as interacting with the [[/|filesystem]]. Can be uploaded via [[DFU (Protocol)|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore.

According to Apple’s source code, ''“dongle products get an iBSS with all of iBoot’s recovery mode accroutements, EXCEPT for filesystem support”''.

== Use of the iBSS ==
The [[iBSS]] bootstraps the [[iBEC]], which prepares and executes the [[Restore Ramdisk]]. in addition, it sends messages to [[iTunes]] on the restore to supervise the restore process. It also integrity checks the images uploaded, and on iOS5+ does the image responsible for [[APTicket]], by uploading the [[nonce]] string to [[iTunes]] then checks for the match of the [[APTicket]] and [[nonce]] and the signatures on [[APTicket]]. On custom firmwares, the [[iBSS]] is patched out of every signature check, but on certain circumstances it still generates [[nonce]]. Check [[APTicket]] for further detail.

On jailbreak softwares like [[redsn0w]] and [[greenpois0n]], the [[iBSS]] bootstraps [[iBEC]] and executes a payload. It is patched out of its signature checks, of course.

== iBSS 5.x ==

iBSS in iOS 5.x is very similar to LLB/DFU, where it has the same protocol. On UART out, it says: "iBSS ready. Asking for DFU...", or something along those lines.

Interesting things I've noted are when certain bits in chip ID are set, it uses a different DFU device identifier (I've personally seen 0x1226/0x1228), and these modes reject any Img3 files sent over USB.

== See also ==
* [[iBSS commands]]

IBSS

2018-02-08T02:02:45Z

Gjest: link

{{DISPLAYTITLE:iBSS}}
'''iBSS''' (short for '''''iB'''oot '''S'''ingle '''S'''tage'') is a stripped down version of [[IBoot (Bootloader)|iBoot]], missing things such as interacting with the [[/|filesystem]]. Can be uploaded via [[DFU (Protocol)|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore.

== Use of the iBSS ==
The [[iBSS]] bootstraps the [[iBEC]], which prepares and executes the [[Restore Ramdisk]]. in addition, it sends messages to [[iTunes]] on the restore to supervise the restore process. It also integrity checks the images uploaded, and on iOS5+ does the image responsible for [[APTicket]], by uploading the [[nonce]] string to [[iTunes]] then checks for the match of the [[APTicket]] and [[nonce]] and the signatures on [[APTicket]]. On custom firmwares, the [[iBSS]] is patched out of every signature check, but on certain circumstances it still generates [[nonce]]. Check [[APTicket]] for further detail.

On jailbreak softwares like [[redsn0w]] and [[greenpois0n]], the [[iBSS]] bootstraps [[iBEC]] and executes a payload. It is patched out of its signature checks, of course.

== iBSS 5.x ==

iBSS in iOS 5.x is very similar to LLB/DFU, where it has the same protocol. On UART out, it says: "iBSS ready. Asking for DFU...", or something along those lines.

Interesting things I've noted are when certain bits in chip ID are set, it uses a different DFU device identifier (I've personally seen 0x1226/0x1228), and these modes reject any Img3 files sent over USB.

== See also ==
* [[iBSS commands]]

TYPE

2018-02-08T01:54:47Z

Gjest:

The '''TYPE''' tag is a 32-bit unsigned integer (<code>uint32_t</code>) that when viewed in little-endian format, states the type of firmware image the IMG2/[[IMG3 File Format|IMG3]]/[[IMG4 File Format|IMG4/IM4P]] file is. Is is compared with the second parameter of <code>[[image_load]]</code> (register <code>r1</code><ref>[https://developer.apple.com/library/ios/#documentation/Xcode/Conceptual/iPhoneOSABIReference/Articles/ARMv6FunctionCallingConventions.html Apple on ARM __fastcall]</ref>). If it does not match, <code>image_load</code> will fail and the image will not be loaded. If <code>0</code> is passed in <code>r1</code>, then the check is skipped.

== Types ==
=== IMG2 ===
* [[AppleLogo]]: logo (0x6C6F676F)
* [[BatteryCharging]]: batC (0x62617443)
* [[BatteryLow0]]: batl (0x6261744C)
* [[BatteryLow1]]: batL (0x6261746C)
* [[DeviceTree]]: dtre (0x64747265)
* [[iBoot (Bootloader)|iBoot]]: ibot (0x69626F74)
* [[LLB]]: llbz (0x6C6C627A)
* [[NeedService]]: nsrv (0x6E737276)
* [[RecoveryMode]]: recm (0x7265636D)

=== IMG3+ ===
* Any: ''empty string'' (0x00000000)
* [[AppleLogo]]: logo (0x6C6F676F)
* [[BatteryCharging0]] (charging – bright): chg0 (0x63686730)
* [[BatteryCharging1]] (charging – dim): chg1 (0x63686731)
* [[BatteryFull]]: batF (0x62617446)
* [[BatteryLow0]] (empty): bat0 (0x62617430)
* [[BatteryLow1]] (red, composed onto empty): bat1 (0x62617431)
* Dali: dali
* [[DeviceTree]]: dtre (0x64747265)
* DeviceTree restore: rdtr
* Diagnostics: diag
* Environment variables: ienv
* FDR Trust object for AP: fdrt
* FDR Trust object for SEP: fdrs
* [[GlyphCharging]]: glyC (0x676C7943)
* [[GlyphPlugin]]: glyP (0x676C7950)
* Hypervisor/monitor: hypr
* [[iBEC]]: ibec (0x69626563)
* [[iBoot (Bootloader)|iBoot]]: ibot (0x69626F74)
* [[iBSS]]: ibss (0x69627373)
* [[Kernelcache]]: krnl (0x62736E6C)
* Kernelcache restore: rkrn
* [[LLB]]: illb (0x696C6C62)
* [[NeedService]]: nsrv (0x6E737276)
* OS restore image: rosi
* PE’s RTOS environment: pert
* PE’s Hammer test: hmmr
* [[Ramdisk]]: rdsk (0x7264736B)
* [[RecoveryMode]]: recm (0x7265636D)
* [[SEP-Firmware]] (SEP OS): sepi (0x73657069)
* SEP OS (restore): rsep
* SiVal’s (Silicon Validation<ref>[https://www.linkedin.com/jobs/view/silicon-validation-test-and-triage-engineer-at-apple-543262317 Job listing on LinkedIn]</ref>) CFE loader: cfel
* SiVal’s RBM test: rbmt
* SiVal’s PHLEET test: phlt
* tsys tester

== References ==
<references />

{{stub|firmware}}
[[Category:Firmware Tags]]

TYPE

2018-02-08T01:52:07Z

Gjest: /* IMG3+ */ complete (as of iOS 9.3) TYPE tags list

The '''TYPE''' tag is a 32-bit unsigned integer (<code>uint32_t</code>) that when viewed in little-endian format, states the type of firmware image the IMG2/[[IMG3 File Format|IMG3]]/[[IMG4 File Format|IMG4/IM4P]] file is. Is is compared with the second parameter of <code>[[image_load]]</code> (register <code>r1</code>[1]). If it does not match, <code>image_load</code> will fail and the image will not be loaded. If <code>0</code> is passed in <code>r1</code>, then the check is skipped.

== Types ==
=== IMG2 ===
* [[AppleLogo]]: logo (0x6C6F676F)
* [[BatteryCharging]]: batC (0x62617443)
* [[BatteryLow0]]: batl (0x6261744C)
* [[BatteryLow1]]: batL (0x6261746C)
* [[DeviceTree]]: dtre (0x64747265)
* [[iBoot (Bootloader)|iBoot]]: ibot (0x69626F74)
* [[LLB]]: llbz (0x6C6C627A)
* [[NeedService]]: nsrv (0x6E737276)
* [[RecoveryMode]]: recm (0x7265636D)

=== IMG3+ ===
* Any: ''empty string'' (0x00000000)
* [[AppleLogo]]: logo (0x6C6F676F)
* [[BatteryCharging0]] (charging – bright): chg0 (0x63686730)
* [[BatteryCharging1]] (charging – dim): chg1 (0x63686731)
* [[BatteryFull]]: batF (0x62617446)
* [[BatteryLow0]] (empty): bat0 (0x62617430)
* [[BatteryLow1]] (red, composed onto empty): bat1 (0x62617431)
* Dali: dali
* [[DeviceTree]]: dtre (0x64747265)
* DeviceTree restore: rdtr
* Diagnostics: diag
* Environment variables: ienv
* FDR Trust object for AP: fdrt
* FDR Trust object for SEP: fdrs
* [[GlyphCharging]]: glyC (0x676C7943)
* [[GlyphPlugin]]: glyP (0x676C7950)
* Hypervisor/monitor: hypr
* [[iBEC]]: ibec (0x69626563)
* [[iBoot (Bootloader)|iBoot]]: ibot (0x69626F74)
* [[iBSS]]: ibss (0x69627373)
* [[Kernelcache]]: krnl (0x62736E6C)
* Kernelcache restore: rkrn
* [[LLB]]: illb (0x696C6C62)
* [[NeedService]]: nsrv (0x6E737276)
* OS restore image: rosi
* PE’s RTOS environment: pert
* PE’s Hammer test: hmmr
* [[Ramdisk]]: rdsk (0x7264736B)
* [[RecoveryMode]]: recm (0x7265636D)
* [[SEP-Firmware]] (SEP OS): sepi (0x73657069)
* SEP OS (restore): rsep
* SiVal’s (Silicon Validation<ref>[https://www.linkedin.com/jobs/view/silicon-validation-test-and-triage-engineer-at-apple-543262317 LinkedIn]</ref>) CFE loader: cfel
* SiVal’s RBM test: rbmt
* SiVal’s PHLEET test: phlt
* tsys tester

== References ==
# [https://developer.apple.com/library/ios/#documentation/Xcode/Conceptual/iPhoneOSABIReference/Articles/ARMv6FunctionCallingConventions.html Apple on ARM __fastcall]

{{stub|firmware}}
[[Category:Firmware Tags]]

Image3

2018-02-08T01:37:56Z

Gjest: redir

#REDIRECT [[IMG3 File Format]]

IBoot (Bootloader)

2018-02-08T01:37:04Z

Gjest:

{{lowercase}}
'''iBoot''', also referred to as “iBoot second-stage loader” in the source code, is Apple's stage 2 bootloader for all of the [[iDevice|devices]]. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== Extract and Disassemble ==
To extract the bootloader and disassemble using IDA, follow the following steps:
#obtain the bootloader from the iPSW. This file is in the <code>Firmware/all_flash</code> subdir, e.g. <code>Firmware/all_flash/all_flash.n81ap.production/iBoot.n81ap.RELEASE.img3</code>, where the "n81ap", "k90", etc.. are for the i-Device type
#run xpwntool with the proper key (from elsewhere in this Wiki)
#Make sure the decryption was successful - if it is, you should see:
"iBoot for ...., Copyright 2011, Apple Inc."
if you cat (i.e. type) the file.
<ol><li value="4">remove the img3 header - the good stuff starts at offset 0x40 (i.e. 64) - using dd (skip=1 bs=64) or some other tool</li>
<li>Load in IDA. Set processor to ARM. Rebase program (Edit→Segments→Rebase Program) to 0x5FF00000 (for iBoot in iOS 5). You should see something like:</li></ol>

<pre>
ROM:5FF00000 loc_5FF00000 ; CODE XREF: ROM:5FF00078�j
ROM:5FF00000 B loc_5FF00040 ; Used for Reset - This is where we start
ROM:5FF00004 ; ---------------------------------------------------------------------------
ROM:5FF00004 LDR PC, =sub_5FF16FB4 ; Used for Undef
ROM:5FF00008 ; ---------------------------------------------------------------------------
ROM:5FF00008 LDR PC, =sub_5FF16FEC ; Used for SWI
ROM:5FF0000C ; ---------------------------------------------------------------------------
ROM:5FF0000C LDR PC, =sub_5FF17024 ; Used for Prefabt
ROM:5FF00010 ; ---------------------------------------------------------------------------
ROM:5FF00010 LDR PC, =sub_5FF17060 ; Used for DataAbt
ROM:5FF00014 ; ---------------------------------------------------------------------------
ROM:5FF00014 LDR PC, =loc_5FF17098 ; Used for AddrExc
ROM:5FF00018 ; ---------------------------------------------------------------------------
ROM:5FF00018 LDR PC, =loc_5FF16F24 ; Used for IRQ
ROM:5FF0001C ; ---------------------------------------------------------------------------
ROM:5FF0001C LDR PC, =sub_5FF16F6C ; Probably FIQ, need to verify this
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00020 SVCPL 0xF00040
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00024 off_5FF00024 DCD sub_5FF16FB4 ; DATA XREF: ROM:5FF00004�r
ROM:5FF00028 off_5FF00028 DCD sub_5FF16FEC ; DATA XREF: ROM:5FF00008�r
ROM:5FF0002C off_5FF0002C DCD sub_5FF17024 ; DATA XREF: ROM:5FF0000C�r
ROM:5FF00030 off_5FF00030 DCD sub_5FF17060 ; DATA XREF: ROM:5FF00010�r
ROM:5FF00034 off_5FF00034 DCD loc_5FF17098 ; DATA XREF: ROM:5FF00014�r
ROM:5FF00038 off_5FF00038 DCD loc_5FF16F24 ; DATA XREF: ROM:5FF00018�r
ROM:5FF0003C off_5FF0003C DCD sub_5FF16F6C ; DATA XREF: ROM:5FF0001C�r
ROM:5FF00040 ; ---------------------------------------------------------------------------
ROM:5FF00040
ROM:5FF00040 loc_5FF00040 ; CODE XREF: ROM:loc_5FF00000�j
ROM:5FF00040 ADR R0, loc_5FF00000 <-- The address we rebased to
ROM:5FF00044 LDR R1, =loc_5FF00000
ROM:5FF00048 CMP R0, R1
ROM:5FF0004C CMP R0, R1
ROM:5FF00050 BEQ loc_5FF0007C
...
...
ROM:5FF000E8 loc_5FF000E8 ; CODE XREF: ROM:5FF000F0�j
ROM:5FF000E8 CMP R0, R1
ROM:5FF000EC STRLT R2, [R0],#4
ROM:5FF000F0 BLT loc_5FF000E8
ROM:5FF000F4 LDR R0, =(_ibootStart+1)
ROM:5FF000F8 MOV LR, PC
ROM:5FF000FC BX R0 ; _ibootStart
ROM:5FF00100
ROM:5FF00100 loc_5FF00100 ; CODE XREF: ROM:loc_5FF00100�j
ROM:5FF00100 B loc_5FF00100
</pre>

Where iBootStart (not the official Apple Symbol, of course) can be seen at:

<pre>
ROM:5FF00BA4 _ibootStart ; CODE XREF: ROM:5FF000FC�p
ROM:5FF00BA4 ; DATA XREF: ROM:5FF000F4�o ...
ROM:5FF00BA4 PUSH {R7,LR}
ROM:5FF00BA6 MOV R7, SP
ROM:5FF00BA8 LDR R0, =aIbootStart ; "\niBoot start\n"
ROM:5FF00BAA BL loc_5FF233C4
ROM:5FF00BAE MOVS R0, #0
ROM:5FF00BB0 BL loc_5FF16E54
ROM:5FF00BB4 BL loc_5FF1570C
ROM:5FF00BB8 BL loc_5FF143A8
ROM:5FF00BBC BL unk_5FF15264
ROM:5FF00BC0 LDR R0, =aMain ; "main"
..
</pre>

== Flow of iBoot (1219 - 5.0.x) ==
iBoot is quite a complicated binary, which spawns several ARM tasks to enable the boot process:

- iBootStart (disassembly started above) - starts main (5FF00BCA) - which calls the main function at 5FF00C14
- main: Does the good stuff (loading the kernel, etc)
starts the poweroff task (5FF00EF2) - calls (sub_5FF00FD0+1)
In recovery mode (failed boot):
starts command (5FF00F0A) - calls 5FF15928
starts idleoff (5FF99F2E) - calls 5FF01060

== Versions ==
=== [[audioOS]] ===
[[iBoot-4076.20.8~14]] 11.0.2 (Build 15C25)
[[iBoot-4076.30.40~30]] 11.2 beta (Build 15C4092b)
[[iBoot-4076.30.43~18]] 11.2 beta 2 (Build 15C4097d)
[[iBoot-4076.30.43~137]] 11.2.5 beta (Build 15D5037e)
11.2.5 beta 2 (Build 15D5046b)
[[iBoot-4076.30.43~140]] 11.2.5 beta 3 (Build 15D59)

=== [[Haywire]] ===
[[iBoot-1537.4.18~1]] 6.0 (Build 10A7401)
[[iBoot-1537.9.40~2]] 6.1 beta 1 (Build 10B7095)
[[iBoot-1537.9.46~7]] 6.1 beta 2 (Build 10B7105)
[[iBoot-1537.9.50~1]] 6.1 beta 3 (Build 10B7117)
[[iBoot-1537.9.54~3]] 6.1 beta 4 (Build 10B7127)
[[iBoot-1537.9.55~3]] 6.1 beta 5 (Build 10B7129)
[[iBoot-1940.1.8~9]] 7.0 beta 1 (Build 11A7372p)
[[iBoot-1940.1.35~7]] 7.0 beta 2 (Build 11A7400)
[[iBoot-1940.1.46~12]] 7.0 beta 3 (Build 11A7414)
[[iBoot-1940.1.66~7]] 7.0 beta 4 (Build 11A7435)
[[iBoot-1940.2.1~2]] 7.0 beta 5 (Build 11A7449)
[[iBoot-1940.2.1~4]] 7.0 (Build 11A7451)
[[iBoot-1940.10.51~1]] 7.1 beta 1 (Build 11D7099)
[[iBoot-1940.10.58~28]] 7.1 beta 4 (Build 11D7134)
[[iBoot-1940.10.58~63]] 7.1 beta 5 (Build 11D7144)
[[iBoot-1940.10.58~101]] 7.1 (Build 11D7155)
[[iBoot-2261.1.6~1]] 8.0 beta 1 (Build 12A7265a)
[[iBoot-2261.1.64~18]] 8.0 beta 5 (Build 12A7346a)
[[iBoot-2261.1.66~10]] 8.0 (Build 12A7353a)

=== [[iOS]] ([[Apple TV]] ([[K66AP|2nd]] and [[Apple TV (3rd generation)|3rd]] generation)) ===
[[iBoot-931.44.21~1]] 4.0 4.1 (Build 8M89)
[[iBoot-931.71.16~9]] 4.1 4.2 (Build 8C150)
4.1.1 4.2.1 (Build 8C154)
[[iBoot-1072.33~1]] 4.2 beta 4.3 beta (Build 8F5148b)
[[iBoot-1072.38~2]] 4.2 beta 2 4.3 beta 2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.2 beta 3 4.3 beta 3 (Build 8F5166b)
[[iBoot-1072.59~2]] 4.2 4.3 (Build 8F191m)
4.2.1 4.3 (Build 8F202)
4.2.2 4.3 (Build 8F305)
4.3 4.3 (Build 8F455)
[[iBoot-1219.35.80~1]] 4.4 beta 5.0 beta (Build 9A5220p)
[[iBoot-1219.40.25~4]] 4.4 beta 2 5.0 beta 2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 4.4 beta 3 5.0 beta 3 (Build 9A5259f)
[[iBoot-1219.43.9~3]] 4.4 beta 5 5.0 beta 5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 4.4 beta 6 5.0 beta 6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 4.4 beta 7 5.0 beta 7 (Build 9A5313e)
[[iBoot-1219.43.32~21]] 4.4 5.0 (Build 9A334v)
[[iBoot-1219.43.32~22]] 4.4.1 5.0 (Build 9A335a)
4.4.2 5.0 (Build 9A336a)
[[iBoot-1219.43.32~29]] 4.4.3 5.0.1 (Build 9A405l)
4.4.4 5.0.1 (Build 9A406a)
[[iBoot-1219.62.1~2]] 5.0 beta 2 5.1 beta 2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.0 beta 3 5.1 beta 3 (Build 9B5141a)
[[iBoot-1219.62.15~2]] 5.0 5.1 (Build 9B179b)
[[iBoot-1537.1.60~15]] 5.1 beta 6.0 beta (Build 10A5316k)
[[iBoot-1537.2.11~5]] 5.1 beta 2 6.0 beta 2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 5.1 beta 3 6.0 beta 3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 5.1 beta 4 6.0 beta 4 (Build 10A5376e)
[[iBoot-1537.4.19~1]] 5.1 6.0 (Build 10A406e)
[[iBoot-1537.4.21~3]] 5.1.1 6.0.1 (Build 10A831)
[[iBoot-1537.9.40~3]] 5.2 beta 6.1 beta (Build 10B5095f)
[[iBoot-1537.9.46~8]] 5.2 beta 2 6.1 beta 2 (Build 10B5105c)
5.2 beta 3 6.1 beta 3 (Build 10B5117d)
5.2 beta 4 6.1 beta 4 (Build 10B5126d)
[[iBoot-1537.9.55~4]] 5.2 6.1 (Build 10B144b)
[[iBoot-1537.9.55~11]] 5.2.1 6.1.3 (Build 10B329a)
[[iBoot-1537.9.55~11]] 5.3 6.1.4 (Build 10B809)
[[iBoot-1940.1.8~44]] 5.4 beta 7.0 beta (Build 11A4372q)
[[iBoot-1940.1.35~9]] 5.4 beta 2 7.0 beta 2 (Build 11A4400f)
[[iBoot-1940.1.66~9]] 6.0 beta 3 7.0 beta 4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 6.0 beta 4 7.0 beta 5 (Build 11A4449a)
[[iBoot-1940.1.75~93]] 6.0 7.0.1 (Build 11A470e)
6.0 7.0.2 (Build 11A502)
[[iBoot-1940.3.5~1]] 6.0.1 7.0.3 (Build 11B511d)
6.0.2 7.0.4 (Build 11B554a)
[[iBoot-1940.10.51~3]] 6.1 beta 7.1 beta (Build 11D5099e)
[[iBoot-1940.10.57~8]] 6.1 beta 2 7.1 beta 2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 6.1 beta 3 7.1 beta 3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 6.1 beta 4 7.1 beta 4 (Build 11D5134c)
[[iBoot-1940.10.58~70]] 6.1 beta 5 7.1 beta 5 (Build 11D5145e)
[[iBoot-1940.10.58~115]] 6.1 7.1 (Build 11D167)
[[iBoot-1940.10.58~122]] 6.1.1 7.1.1 (Build 11D201c)
[[iBoot-1940.10.58~132]] 6.2 7.1.2 (Build 11D257c)
6.2.1 7.1.2 (Build 12A365b)
[[iBoot-2261.1.31~21]] 7.0 beta 8.0 beta (Build 12A4297e)
[[iBoot-2261.1.46~31]] 7.0 beta 2 8.0 beta 3 (Build 12A4318c)
[[iBoot-2261.1.57~43]] 7.0 beta 3 8.0 beta 4 (Build 12A4331d)
[[iBoot-2261.1.64~28]] 7.0 beta 4 8.0 beta 5 (Build 12A4345d)
[[iBoot-2261.1.67~8]] 7.0 [[Golden Master|GM]] 8.0 [[Golden Master|GM]] (Build 12A365b)
7.0 8.0 (Build 12A365b)
[[iBoot-2261.3.31~3]] 7.0.1 beta 8.1 beta (Build 12B401)
[[iBoot-2261.3.31~9]] 7.0.1 beta 2 8.1 beta 2 (Build 12B407)
[[iBoot-2261.3.32~2]] 7.0.1 8.1 (Build 12B410a)
[[iBoot-2261.3.33~13]] 7.0.2 beta 8.1.1 beta (Build 12B432)
[[iBoot-2261.3.33~14]] 7.0.2 8.1.1 (Build 12B435)
[[iBoot-2261.3.33~39]] 7.0.3 8.1.3 (Build 12B446)
iBoot-2261.?.??~?? 7.1 beta 8.2 beta 5 (Build 12D5480a)
[[iBoot-2261.5.64~15]] 7.1 8.2 (Build 12D508)
[[iBoot-2261.20.18~14]] 7.1 beta 2 8.3 beta 2 (Build 12F5037c)
[[iBoot-2261.20.20~9]] 7.1 beta 3 8.3 beta 4 (Build 12F61)
[[iBoot-2261.20.20~14]] 7.2 8.3 (Build 12F69)
[[iBoot-2261.30.37~79]] 7.2.1 8.4.1 (Build 12H523)
[[iBoot-2261.30.37~87]] 7.2.2 8.4.2 (Build 12H606)

=== [[iOS]] ([[iPad]], [[iPhone]], [[iPod touch]]) ===
[[iBoot-99]] 1.0 beta (Build 1A420) [Unreleased]
[[iBoot-159]] 1.0 (Build 1A543a)
1.0.1 (Build 1C25)
1.0.2 (Build 1C28)
[[iBoot-204]] 1.1 (Build 3A100 & 3A101)
1.1.1 (Build 3A109a)
[[iBoot-204.0.2]] 1.1.1 (Build 3A110a)
[[iBoot-204.2.9]] 1.1.2 (Build 3B48b)
[[iBoot-204.3.14]] 1.1.3 (Build 4A93)
1.1.4 (Build 4A102)
[[iBoot-204.3.16]] 1.1.5 (Build 4B1)
? 1.2 beta (Build 5A147p)
[[iBoot-294]] 2.0 beta 2 (Build 5A225c)
[[iBoot-304]] 2.0 beta 3 (Build 5A240d)
[[iBoot-311]] 2.0 beta 4 (Build 5A258f)
? 2.0 beta 5 (Build 5A274d)
? 2.0 beta 6 Pre-release (Build 5A292g)
? 2.0 beta 6 Final (Build 5A308)
? 2.0b7 (Build 5A331)
[[iBoot-320.19]] 2.0b8 ([[Golden Master|GM]]) (Build 5A345)
[[iBoot-320.20]] 2.0 (Build 5A347)
2.0.1 (Build 5B108)
2.0.2 (Build 5C1)
? 2.1 beta (Build 5F90)
[[iBoot-385.22]] 2.1 (Build 5F137)
2.1.1 (Build 5F138)
? 2.2 beta (Build 5G29)
[[iBoot-385.49]] 2.2 (Build 5G77 & 5G77a)
2.2.1 (Build 5H11 & 5H11a)
[[iBoot-573.1]] 3.0 beta (Build 7A238j)
[[iBoot-594.2~1]] 3.0 beta 2 (Build 7A259g)
[[iBoot-596.6~3]] 3.0 beta 3 (Build 7A280f)
[[iBoot-596.16~2]] 3.0 beta 4 (Build 7A300g)
[[iBoot-596.20~1]] 3.0 beta 5 (Build 7A312g)
[[iBoot-596.24~1]] 3.0 (Build 7A341)
3.0.1 (Build 7A400)
[[iBoot-636.26~2]] 3.1 beta (Build 7C97d)
[[iBoot-636.35~1]] 3.1 beta 2 (Build 7C106c)
[[iBoot-636.47~1]] 3.1 beta 3 (Build 7C116a)
[[iBoot-636.65|iBoot-636.65~2]] 3.1 (Build 7C144)
[[iBoot-636.66~1]] 3.1.1 (Build 7C145 & 7C146)
[[iBoot-636.66~5]] 3.1.2 (Build 7D11)
[[iBoot-636.66.33~4]] 3.1.3 (Build 7E18)
[[iBoot-817.28|iBoot-817.28~18]] 3.2 (Build 7B367)
[[iBoot-817.29~2]] 3.2.1 (Build 7B405)
3.2.2 (Build 7B500)
[[iBoot-822.2.1]] 4.0 beta (Build 8A2180g) [Unreleased]
[[iBoot-872~12]] 4.0 beta (Build 8A230m)
[[iBoot-889.3~2]] 4.0 beta 2 (Build 8A248c)
[[iBoot-889.12~2]] 4.0 beta 3 (Build 8A260b)
[[iBoot-889.19~1]] 4.0 beta 4 (Build 8A274b)
[[iBoot-889.24~4]] 4.0 [[Golden Master|GM]] (Build 8A293)
4.0 (Build 8A293)
4.0.1 (Build 8A306)
4.0.2 (Build 8A400)
[[iBoot-931.18.1~1]] 4.1 beta (Build 8B5080c)
[[iBoot-931.18.15~2]] 4.1 beta 2 (Build 8B5091b)
[[iBoot-931.18.27~1]] 4.1 (Build 8B117 & 8B118)
[[iBoot-931.67~2]] 4.2 beta (Build 8C5091e)
[[iBoot-931.71.80~1]] 4.2 beta 2 (Build 8C5101c)
[[iBoot-931.71.13~3]] 4.2 beta 3 (Build 8C5115c)
[[iBoot-931.71.16~9]] 4.2 [[Golden Master|GM]] (Build 8C134)
4.2 [[Golden Master|GM]] (Build 8C134b)
4.2.1 [[Golden Master|GM]] (Build 8C148)
4.2.1 (Build 8C148 & 8C148a)
[[iBoot-931.72.14~6]] 4.2.5 (Build 8E128)
4.2.6 (Build 8E200)
4.2.7 (Build 8E303)
4.2.8 (Build 8E401)
[[iBoot-931.72.14~10]] 4.2.9 (Build 8E501)
4.2.10 (Build 8E600)
[[iBoot-1072.33~1]] 4.3 beta (Build 8F5148b)
[[iBoot-1072.38~2]] 4.3 beta 2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.3 beta 3 (Build 8F5166b)
[[iBoot-1072.58~4]] 4.3 [[Golden Master|GM]] (Build 8F190)
4.3 (Build 8F190)
[[iBoot-1072.59~2]] 4.3 (Build 8F191)
4.3.1 (Build 8G4)
[[iBoot-1072.61~2]] 4.3.2 (Build 8H7 & 8H8)
4.3.3 (Build 8J2 & 8J3)
[[iBoot-1072.61~6]] 4.3.4 (Build 8K2)
4.3.5 (Build 8L1)
[[iBoot-1219.35.80~1]] 5.0 beta (Build 9A5220p)
[[iBoot-1219.40.25~4]] 5.0 beta 2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 5.0 beta 3 (Build 9A5259f)
[[iBoot-1219.42.8~1]] 5.0 beta 4 (Build 9A5274d)
[[iBoot-1219.43.9~3]] 5.0 beta 5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 5.0 beta 6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 5.0 beta 7 (Build 9A5313e)
[[iBoot-1219.43.32~15]] 5.0 [[Golden Master|GM]] (Build 9A332) [Unreleased]
5.0 [[Golden Master|GM]] (Build 9A334)
5.0 (Build 9A334)
[[iBoot-1219.43.32~27]] 5.0.1 beta (Build 9A402)
[[iBoot-1219.43.32~29]] 5.0.1 beta 2 (Build 9A404)
5.0.1 (Build 9A405 & 9A406)
[[iBoot-1219.61.19~6]] 5.1 beta (Build 9B5117b)
[[iBoot-1219.62.1~2]] 5.1 beta 2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.1 beta 3 (Build 9B5141a)
[[iBoot-1219.62.15]] 5.1 (Build 9B176)
[[iBoot-1219.62.15~2]] 5.1 (Build 9B179b)
5.1.1 (Build 9B206)
[[iBoot-1537.1.60~15]] 6.0 beta (Build 10A5316k)
[[iBoot-1537.2.11~5]] 6.0 beta 2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 6.0 beta 3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 6.0 beta 4 (Build 10A5376e)
[[iBoot-1537.4.18~2]] 6.0 [[Golden Master|GM]] (Build 10A403)
6.0 (Build 10A403)
[[iBoot-1537.4.19~1]] 6.0 (Build 10A405 & 10A406)
[[iBoot-1537.4.20~1]] 6.0 (Build 10A407)
[[iBoot-1537.4.21~3]] 6.0.1 (Build 10A523 & 10A525)
[[iBoot-1537.4.21~2]] 6.0.1 (Build 10A8426)
6.0.2 (Build 10A8500)
[[iBoot-1537.4.21~3]] 6.0.2 (Build 10A550 & 10A551)
[[iBoot-1537.9.40~3]] 6.1 beta (Build 10B5095f)
[[iBoot-1537.9.46~8]] 6.1 beta 2 (Build 10B5105c)
[[iBoot-1537.9.50~2]] 6.1 beta 3 (Build 10B5117b)
[[iBoot-1537.9.54~4]] 6.1 beta 4 (Build 10B5126b)
[[iBoot-1537.9.55~4]] 6.1 beta 5 (Build 10B141, 10B142, 10B143 & 10B144)
6.1 (Build 10B141, 10B142, 10B143 & 10B144)
6.1.1 beta (Build 10B311)
6.1.1 (Build 10B145)
6.1.2 (Build 10B146 & 10B147)
[[iBoot-1537.9.55~11]] 6.1.3 beta 2 (Build 10B318)
6.1.3 beta 2 (Build 10B318a)
6.1.3 (Build 10B329)
6.1.4 (Build 10B350)
6.1.5 (Build 10B400)
6.1.6 (Build 10B500)
[[iBoot-1940.1.8~44]] 7.0 beta (Build 11A4372q)
[[iBoot-1940.1.35~9]] 7.0 beta 2 (Build 11A4400f)
[[iBoot-1940.1.46.1.1~1]] 7.0 beta 3 (Build 11A4414e)
[[iBoot-1940.1.66~9]] 7.0 beta 4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 7.0 beta 5 (Build 11A4449a)
7.0 beta 6 (Build 11A4449d)
[[iBoot-1940.1.75~20]] 7.0 [[Golden Master|GM]] (Build 11A465)
7.0 (Build 11A465 & 11A466)
[[iBoot-1940.1.75~93]] 7.0.1 (Build 11A470a)
7.0.2 (Build 11A501)
[[iBoot-1940.3.5~1]] 7.0.3 (Build 11B511)
7.0.4 (Build 11B554a)
7.0.5 (Build 11B601)
7.0.6 (Build 11B651)
[[iBoot-1940.10.51~3]] 7.1 beta (Build 11D5099e)
[[iBoot-1940.10.57~8]] 7.1 beta 2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 7.1 beta 3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 7.1 beta 4 (Build 11D5134c)
[[iBoot-1940.10.58~70]] 7.1 beta 5 (Build 11D5145e)
[[iBoot-1940.10.58~115]] 7.1 (Build 11D167 & 11D169)
[[iBoot-1940.10.58~122]] 7.1.1 (Build 11D201)
[[iBoot-1940.10.58~132]] 7.1.2 (Build 11D257)
[[iBoot-2261.1.6.0.1~45]] 8.0 beta (Build 12A4265u)
[[iBoot-2261.1.31~21]] 8.0 beta 2 (Build 12A4297e)
[[iBoot-2261.1.46~31]] 8.0 beta 3 (Build 12A4318c)
[[iBoot-2261.1.57~43]] 8.0 beta 4 (Build 12A4331d)
[[iBoot-2261.1.64~28]] 8.0 beta 5 (Build 12A4345d)
[[iBoot-2261.1.67~8]] 8.0 [[Golden Master|GM]] (Build 12A365)
8.0 (Build 12A365 & 12A366)
[[iBoot-2261.1.68~1]] 8.0.1 (Build 12A402)
8.0.2 (Build 12A405)
[[iBoot-2261.3.31~3]] 8.1 beta (Build 12B401)
[[iBoot-2261.3.31~9]] 8.1 beta 2 (Build 12B407)
[[iBoot-2261.3.32~2]] 8.1 (Build 12B410 & 12B411)
[[iBoot-2261.3.33~13]] 8.1.1 beta (Build 12B432)
[[iBoot-2261.3.33~14]] 8.1.1 (Build 12B435 & 12B436)
8.1.2 (Build 12B440)
[[iBoot-2261.3.33~39]] 8.1.3 (Build 12B446)
[[iBoot-2261.5.34~3]] 8.2 beta (Build 12D436)
[[iBoot-2261.5.41~10]] 8.2 beta 2 (Build 12D445d)
[[iBoot-2261.5.47~1]] 8.2 beta 3 (Build 12D5452a)
[[iBoot-2261.5.54~3]] 8.2 beta 4 (Build 12D5461b)
[[iBoot-2261.5.58~25]] 8.2 beta 5 (Build 12D5480a)
[[iBoot-2261.5.64~15]] 8.2 (Build 12D508)
[[iBoot-2261.20.16~6]] 8.3 beta (Build 12F5027d)
[[iBoot-2261.20.18~14]] 8.3 beta 2 (Build 12F5037c)
[[iBoot-2261.20.19~16]] 8.3 beta 3 (Build 12F5047f)
[[iBoot-2261.20.20~9]] 8.3 beta 4 (Build 12F61)
[[iBoot-2261.20.20~14]] 8.3 (Build 12F69)
[[iBoot-2261.30.33~16]] 8.4 beta (Build 12H4074d)
[[iBoot-2261.30.34~8]] 8.4 beta 2 (Build 12H4086d)
[[iBoot-2261.30.35~21]] 8.4 beta 3 (Build 12H4098c)
[[iBoot-2261.30.37~17]] 8.4 beta 4 (Build 12H4125a)
[[iBoot-2261.30.37~34]] 8.4 (Build 12H143)
[[iBoot-2261.30.37~39]] 8.4.1 beta (Build 12H304)
[[iBoot-2261.30.37~55]] 8.4.1 beta 2 (Build 12H318)
[[iBoot-2261.30.37~58]] 8.4.1 (Build 12H321)
[[iBoot-2817.0.0.1.2~2]] 9.0 beta (Build 13A4254v)
[[iBoot-2817.1.41.1.1~1]] 9.0 beta 2 (Build 13A4280e)
[[iBoot-2817.1.55~10]] 9.0 beta 3 (Build 13A4293g)
[[iBoot-2817.1.73~9]] 9.0 beta 4 (Build 13A4305g)
[[iBoot-2817.1.89~3]] 9.0 beta 5 (Build 13A4325c)
[[iBoot-2817.1.93~1]] 9.0 [[Golden Master|GM]] (Build 13A340)
[[iBoot-2817.1.93~1]] 9.0 (Build 13A340, 13A342, 13A343 & 13A344)
[[iBoot-2817.1.94~1]] 9.0.1 (Build 13A404)
9.0.1 (Build 13A405)
9.0.2 (Build 13A452)
[[iBoot-2817.10.26~8]] 9.1 beta (Build 13B5110e)
[[iBoot-2817.10.29~16]] 9.1 beta 2 (Build 13B5119e)
[[iBoot-2817.10.34~1]] 9.1 beta 3 (Build 13B5130b)
[[iBoot-2817.10.34~7]] 9.1 beta 4 (Build 13B136)
9.1 beta 5 (Build 13B137 & 13B139)
9.1 (Build 13B143)
[[iBoot-2817.10.35~1]] 9.1 (Build 13B144)
[[iBoot-2817.20.21~5]] 9.2 beta (Build 13C5055d)
[[iBoot-2817.20.24~4]] 9.2 beta 2 (Build 13C5060d)
[[iBoot-2817.20.26~3]] 9.2 beta 3 (Build 13C71)
9.2 beta 4 (Build 13C75)
9.2 (Build 13C75)
9.2.1 beta (Build 13D11)
9.2.1 beta 2 (Build 13D14)
9.2.1 (Build 13D15 & 13D20)
[[iBoot-2817.40.91~21]] 9.3 beta (Build 13E5181d)
9.3 beta 1.1 (Build 13E5181f)
[[iBoot-2817.40.97~26]] 9.3 beta 2 (Build 13E5191d)
[[iBoot-2817.40.102~26]] 9.3 beta 3 (Build 13E5200d)
[[iBoot-2817.40.104~56]] 9.3 beta 4 (Build 13E5214d)
[[iBoot-2817.40.106~16]] 9.3 beta 5 (Build 13E5225a)
9.3 beta 6 (Build 13E5231a)
9.3 beta 7 (Build 13E5233a)
9.3 beta 7 (Build 13E5234a)
[[iBoot-2817.40.106~2]] 9.3 (Build 13E233, 13E234, 13E236 & 13E237)
[[iBoot-2817.50.1~16]] 9.3.2 beta (Build 13F51a)
[[iBoot-2817.50.2~2]] 9.3.2 beta 2 (Build 13F61)
9.3.2 beta 3 (Build 13F65)
[[iBoot-2817.50.3~1]] 9.3.2 beta 4 (Build 13F68)
9.3.2 (Build 13F69 & 13F72)
9.3.3 beta (Build 13G12)
[[iBoot-2817.60.1~1]] 9.3.3 beta 2 (Build 13G21)
[[iBoot-2817.60.2~2]] 9.3.3 beta 3 (Build 13G29)
9.3.3 beta 4 (Build 13G33)
9.3.3 beta 5 (Build 13G34)
9.3.3 (Build 13G34)
9.3.4 (Build 13G35)
9.3.5 (Build 13G36)
[[iBoot-3393~52]] 10.0 beta (Build 14A5261v)
[[iBoot-3406.1.46~11]] 10.0 beta 2 (Build 14A5297c)
[[iBoot-3406.1.59~66]] 10.0 beta 3 (Build 14A5309d)
[[iBoot-3406.1.68~82]] 10.0 beta 4 (Build 14A5322e)
[[iBoot-3406.1.77~16]] 10.0 beta 5 (Build 14A5335b)
10.0 beta 6 (Build 14A5341a)
10.0 beta 7 (Build 14A5345a)
10.0 beta 8 (Build 14A5346a)
[[iBoot-3406.1.79~1]] 10.0.1 [[Golden Master|GM]] (Build 14A403)
10.0.1 (Build 14A403)
10.0.2 (Build 14A456)
10.0.3 (Build 14A551)
[[iBoot-3406.20.16~118]] 10.1 beta (Build 14B55c)
[[iBoot-3406.20.16~161]] 10.1 beta 2 (Build 14B67)
10.1 beta 3 (Build 14B71)
10.1 beta 4 (Build 14B72)
10.1 beta 4 (Build 14B72b)
10.1 beta 5 (Build 14B72c)
10.1 (Build 14B72 & 14B72c)
10.1.1 (Build 14B100 & 14B150)
[[iBoot-3406.30.8~10]] 10.2 beta (Build 14C5062e)
[[iBoot-3406.30.8~373]] 10.2 beta 2 (Build 14C5069c)
[[iBoot-3406.30.8~503]] 10.2 beta 3 (Build 14C5077b)
[[iBoot-3406.30.8~497]] 10.2 beta 4 (Build 14C82)
10.2 beta 5 (Build 14C89)
10.2 beta 6 (Build 14C90)
10.2 beta 6 (Build 14C91)
10.2 beta 7 (Build 14C92)
10.2 (Build 14C92)
10.2.1 beta (Build 14D10)
[[iBoot-3406.42.1~1]] 10.2.1 beta 2 (Build 14D15)
[[iBoot-3406.42.5~1]] 10.2.1 beta 3 (Build 14D23)
10.2.1 beta 4 (Build 14D27)
10.2.1 (Build 14D27)
[[iBoot-3406.50.223~16]] 10.3 beta (Build 14E5230e)
[[iBoot-3406.50.229~9]] 10.3 beta 2 (Build 14E5239e)
[[iBoot-3406.50.236~77]] 10.3 beta 3 (Build 14E5249d)
[[iBoot-3406.50.243~9]] 10.3 beta 4 (Build 14E5260b)
[[iBoot-3406.50.244~4]] 10.3 beta 5 (Build 14E5269a)
10.3 beta 6 (Build 14E5273a)
10.3 beta 7 (Build 14E5277a)
[[iBoot-3406.50.244~1]] 10.3 (Build 14E277)
10.3.1 (Build 14E304)
[[iBoot-3406.60.7~9]] 10.3.2 beta (Build 14F5065b)
[[iBoot-3406.60.10~10]] 10.3.2 beta 2 (Build 14F5075a)
[[iBoot-3406.60.10~25]] 10.3.2 beta 3 (Build 14F5080a)
[[iBoot-3406.60.10~40]] 10.3.2 beta 4 (Build 14F5086a)
10.3.2 beta 5 (Build 14F5089a)
[[iBoot-3406.60.10~39]] 10.3.2 (Build 14F89, 14F90 & 14F91)
[[iBoot-3406.60.10~38]] 10.3.2 (Build 14F8089)
[[iBoot-3406.60.10~64]] 10.3.3 beta (Build 14G5028a)
10.3.3 beta 2 (Build 14G5037b)
[[iBoot-3406.60.10~74]] 10.3.3 beta 3 (Build 14G5047a)
10.3.3 beta 4 (Build 14G5053a)
10.3.3 beta 5 (Build 14G5057a)
[[iBoot-3406.60.10~70]] 10.3.3 beta 6 (Build 14G57 & 14G58)
10.3.3 (Build 14G60)
[[iBoot-3974~299]] 11.0 beta (Build 15A5278f)
[[iBoot-4051~60]] 11.0 beta 2 (Build 15A5304i & 15A5304h)
[[iBoot-4076.1.9~24]] 11.0 beta 3 (Build 15A5318g)
[[iBoot-4076.1.22~32]] 11.0 beta 4 (Build 15A5327g)
[[iBoot-4076.1.39~22]] 11.0 beta 5 (Build 15A5341f)
[[iBoot-4076.1.43~178]] 11.0 beta 6 (Build 15A5354b)
[[iBoot-4076.1.44~40]] 11.0 beta 7 (Build 15A5362a)
11.0 beta 8 (Build 15A5368a)
11.0 beta 9 (Build 15A5370a)
[[iBoot-4076.1.44~197]] 11.0 beta 10 (Build 15A5372a)
[[iBoot-4076.1.44~40]] 11.0 [[Golden Master|GM]] (Build 15A372)
11.0 (Build 15A372)
[[iBoot-4076.1.44~197]] 11.0.1 (Build 15A402 & 15A403)
11.0.2 (Build 15A421)
11.0.3 (Build 15A432)
[[iBoot-4076.20.45~8]] 11.1 beta (Build 15B5066f)
[[iBoot-4076.20.47~5]] 11.1 beta 2 (Build 15B5078e)
[[iBoot-4076.20.48~5]] 11.1 beta 3 (Build 15B5086a)
[[iBoot-4076.20.48~1]] 11.1 beta 4 (Build 15B92)
11.1 beta 5 (Build 15B93)
11.1 (Build 15B93 & 15B101)
11.1.1 (Build 15B150)
11.1.2 (Build 15B202)
[[iBoot-4076.30.40~29]] 11.2 beta (Build 15C5092b)
[[iBoot-4076.30.43~19]] 11.2 beta 2 (Build 15C5097d)
[[iBoot-4076.30.43~80]] 11.2 beta 3 (Build 15C5107a)
11.2 beta 4 (Build 15C5110b)
11.2 beta 5 (Build 15C5111a)
[[iBoot-4076.30.43~76]] 11.2 beta 6 (Build 15C114)
11.2 (Build 15C114)
11.2.1 (Build 15C153)
11.2.2 (Build 15C202)
[[iBoot-4076.30.43~137]] 11.2.5 beta (Build 15D5037e)
11.2.5 beta 2 (Build 15D5046b)
11.2.5 beta 3 (Build 15D5049a)
11.2.5 beta 4 (Build 15D5054a)
11.2.5 beta 5 (Build 15D5057a)
11.2.5 beta 6 (Build 15D5059a)
[[iBoot-4076.30.43~140]] 11.2.5 beta 7 (Build 15D60)
11.2.5 (Build 15D60)
[[iBoot-4076.50.114~5]] 11.3 beta (Build 15E5167f)
[[iBoot-4076.50.120.100.1~2]] 11.3 beta 2 (Build 15E5178f)

=== [[tvOS]] ===
[[iBoot-2817.10.22~26]] 9.0 beta (Build 13T5347l)
[[iBoot-2817.10.29~9]] 9.0 beta 2 (Build 13T5365h)
[[iBoot-2817.10.34~5]] 9.0 beta 3 (Build 13T5379f)
[[iBoot-2817.12.1~1]] 9.0 [[Golden Master|GM]] (Build 13T396)
9.0 (Build 13T396)
9.0.1 (Build 13T402)
[[iBoot-2817.20.24~5]] 9.1 beta (Build 13U5061d)
[[iBoot-2817.20.26~2]] 9.1 beta 2 (Build 13U5069b)
[[iBoot-2817.20.26~7]] 9.1 beta 3 (Build 13U5077a)
[[iBoot-2817.20.26~1]] 9.1 (Build 13U85)
[[iBoot-2817.20.26~8]] 9.1.1 beta (Build 13U713)
9.1.1 (Build 13U717)
[[iBoot-2817.40.91~19]] 9.2 beta (Build 13Y5179e)
[[iBoot-2817.40.97~10]] 9.2 beta 2 (Build 13Y5189e)
[[iBoot-2817.40.102~14]] 9.2 beta 3 (Build 13Y5198c)
[[iBoot-2817.40.104~50]] 9.2 beta 4 (Build 13Y5210d)
[[iBoot-2817.40.106~15]] 9.2 beta 5 (Build 13Y5220c)
[[iBoot-2817.40.106~15]] 9.2 beta 6 (Build 13Y5232a)
[[iBoot-2817.40.106~18]] 9.2 (Build 13Y234)
[[iBoot-2817.50.1~20]] 9.2.1 beta (Build 13Y5752a)
[[iBoot-2817.50.2~1]] 9.2.1 beta 2 Pre-release (Build 13Y763b)
9.2.1 beta 2 (Build 13Y763c)
9.2.1 beta 3 (Build 13Y768)
9.2.1 beta 4 (Build 13Y772)
9.2.1 (Build 13Y772)
[[iBoot-2817.50.2~11]] 9.2.2 beta (Build 13Y807)
[[iBoot-2817.60.1~2]] 9.2.2 beta 2 (Build 13Y816)
[[iBoot-2817.60.2~1]] 9.2.2 beta 3 (Build 13Y823)
9.2.2 beta 4 (Build 13Y824)
9.2.2 beta 5 (Build 13Y825)
9.2.2 (Build 13Y825)
[[iBoot-3393~157]] 10.0 beta (Build 14T5253s)
[[iBoot-3406.1.46~9]] 10.0 beta 2 (Build 14T5284d)
[[iBoot-3406.1.59~57]] 10.0 beta 3 (Build 14T5296d)
[[iBoot-3406.1.68~85]] 10.0 beta 4 (Build 14T5308d)
[[iBoot-3406.1.77~19]] 10.0 beta 5 (Build 14T5321a)
10.0 beta 6 (Build 14T5327a)
10.0 beta 7 (Build 14T5327a)
[[iBoot-3406.1.77~13]] 10.0 [[Golden Master|GM]] (Build 14T330)
10.0 (Build 14T330)
[[iBoot-3406.20.16~117]] 10.0.1 beta (Build 14U54)
10.0.1 beta 2 (Build 14U66)
10.0.1 beta 3 (Build 14U69)
10.0.1 beta 4 (Build 14U71)
10.0.1 (Build 14U71 & 14U100)
[[iBoot-3406.30.8~11]] 10.1 beta (Build 14U5565b)
[[iBoot-3406.30.8~374]] 10.1 beta 2 (Build 14U5574b)
[[iBoot-3406.30.8~501]] 10.1 beta 3 (Build 14U5582b)
[[iBoot-3406.30.8~493]] 10.1 beta 4 (Build 14U588)
10.1 beta 5 (Build 14U593)
10.1 (Build 14U593)
10.1.1 beta (Build 14U707)
10.1.1 beta 2 (Build 14U711)
10.1.1 (Build 14U712a)
[[iBoot-3406.50.223~18]] 10.2 beta (Build 14W5222d)
[[iBoot-3406.50.229~12]] 10.2 beta 2 (Build 14W5231d)
[[iBoot-3406.50.236~71]] 10.2 beta 3 (Build 14W5241c)
[[iBoot-3406.53.1~1]] 10.2 beta 4 (Build 14W5252c)
[[iBoot-3406.53.2~2]] 10.2 beta 5 (Build 14W5260a)
10.2 beta 6 (Build 14W5264a)
[[iBoot-3406.53.2~1]] 10.2 (Build 14W265)
[[iBoot-3406.60.7~17]] 10.2.1 beta (Build 14W5563b)
[[iBoot-3406.60.10~11]] 10.2.1 beta 2 (Build 14W5573a)
[[iBoot-3406.60.10~29]] 10.2.1 beta 3 (Build 14W5578b)
[[iBoot-3406.60.10~42]] 10.2.1 beta 4 (Build 14W5583a)
[[iBoot-3406.60.10~35]] 10.2.1 beta 5 (Build 14W585)
10.2.1 (Build 14W585a)
[[iBoot-3406.60.10~55]] 10.2.2 beta (Build 14W5726a)
10.2.2 beta 2 (Build 14W5735a)
10.2.2 beta 3 (Build 14W5745a)
10.2.2 beta 4 (Build 14W5751b)
[[iBoot-3406.60.10~76]] 10.2.2 beta 5 (Build 14W754)
10.2.2 (Build 14W756)
[[iBoot-3974~291]] 11.0 beta (Build 15J5284e & 15J5284g)
[[iBoot-4051~54]] 11.0 beta 2 (Build 15J5310e & 15J5310h)
[[iBoot-4076.1.9~34]] 11.0 beta 3 (Build 15J5324f)
[[iBoot-4076.1.22~28]] 11.0 beta 4 (Build 15J5333f)
[[iBoot-4076.1.39.3.1~1]] 11.0 beta 5 (Build 15J5347f)
[[iBoot-4076.3.1~11]] 11.0 beta 6 (Build 15J5360b)
[[iBoot-4076.3.2~2]] 11.0 beta 7 (Build 15J5369a)
11.0 beta 8 (Build 15J5374a)
11.0 beta 9 (Build 15J5378a)
[[iBoot-4076.3.3~1]] 11.0 beta 10 (Build 15J5380a)
[[iBoot-4076.3.3~2]] 11.0 [[Golden Master|GM]] (Build 15J381)
11.0 (Build 15J381)
[[iBoot-4076.20.45~10]] 11.1 beta (Build 15J5559d)
[[iBoot-4076.20.47~3]] 11.1 beta 2 (Build 15J5571d)
[[iBoot-4076.20.48~4]] 11.1 beta 3 (Build 15J5580a)
11.1 beta 4 (Build 15J5582a)
[[iBoot-4076.20.48~2]] 11.1 (Build 15J582)
[[iBoot-4076.30.40~22]] 11.2 beta (Build 15K5085b)
[[iBoot-4076.30.43~14]] 11.2 beta 2 (Build 15K5090c)
[[iBoot-4076.30.43~81]] 11.2 beta 3 (Build 15K5099a)
11.2 beta 4 (Build 15K102a)
11.2 beta 5 (Build 15K5105a)
[[iBoot-4076.30.43~75]] 11.2 (Build 15K106)
11.2.1 (Build 15K152)
[[iBoot-4076.30.43~138]] 11.2.5 beta (Build 15K5531d)
11.2.5 beta 2 (Build 15K5539b)
11.2.5 beta 3 (Build 15K5544a)
11.2.5 beta 4 (Build 15K5544b)
11.2.5 beta 5 (Build 15K5549a)
11.2.5 beta 6 (Build 15K5552a)
[[iBoot-4076.30.43~143]] 11.2.5 (Build 15K552)
[[iBoot-4076.50.114~7]] 11.3 beta (Build 15L5164e)
[[iBoot-4076.50.119~180]] 11.3 beta 2 (Build 15L5175d)

=== [[watchOS]] ===
[[iBoot-2261.5.64~16]] 1.0 (Build 12S507)
[[iBoot-2261.5.64~49]] 1.0.1 (Build 12S632)
[[iBoot-2817.0.0.2.1~1]] 2.0 beta 2 (Build 13S5255c)
[[iBoot-2817.2.2~2]] 2.0 (Build 13S344)
2.0.1 (Build 13S428)
[[iBoot-2817.20.25~4]] 2.1 (Build 13S661)
[[iBoot-2817.40.91~18]] 2.2 beta (Build 13V5098e)
[[iBoot-2817.40.97~24]] 2.2 beta 2 (Build 13V5108c)
[[iBoot-2817.40.102~24]] 2.2 beta 3 (Build 13V5117c)
[[iBoot-2817.40.104~51]] 2.2 beta 4 (Build 13V5129c)
[[iBoot-2817.40.106~17]] 2.2 beta 5 (Build 13V5141a)
2.2 beta 6 (Build 13V5143a)
[[iBoot-2817.40.106~4]] 2.2 (Build 13V144)
[[iBoot-2817.40.106~32]] 2.2.1 beta (Build 13V413)
2.2.1 beta 2 (Build 13V420)
2.2.1 (Build 13V420)
2.2.2 beta (Build 13V601)
2.2.2 (Build 13V604)
[[iBoot-3393~42]] 3.0 beta (Build 14S5247t)
[[iBoot-3406.1.46~10]] 3.0 beta 2 (Build 14S5278d)
[[iBoot-3406.1.59~63]] 3.0 beta 3 (Build 14S5290d)
[[iBoot-3406.1.68~84]] 3.0 beta 4 (Build 14S5302d)
[[iBoot-3406.1.77~18]] 3.0 beta 5 (Build 14S5315a)
[[iBoot-3406.4.1~2]] 3.0 beta 6 (Build 14S5321a)
[[iBoot-3406.4.3~2]] 3.0 [[Golden Master|GM]] (Build 14S5321a)
3.0 (Build 14S5321a)
[[iBoot-3406.20.16~116]] 3.1 beta (Build 14S452)
3.1 beta 2 (Build 14S464)
3.1 beta 3 (Build 14S471)
3.1 (Build 14S471)
[[iBoot-3406.30.8~13]] 3.1.1 beta (Build 14S5862d)
[[iBoot-3406.30.8~375]] 3.1.1 beta 2 (Build 14S5869b)
[[iBoot-3406.30.8~504]] 3.1.1 beta 3 (Build 14S5875b)
[[iBoot-3406.30.8~502]] 3.1.1 beta 4 (Build 14S879)
3.1.1 beta 5 (Build 14S883)
3.1.1 (Build 14S883)
3.1.3 beta (Build 14S958)
3.1.3 beta 2 (Build 14S959)
3.1.3 (Build 14S960)
[[iBoot-3406.50.223~19]] 3.2 beta (Build 14V5205d)
[[iBoot-3406.50.229~10]] 3.2 beta 2 (Build 14V5214d)
[[iBoot-3406.50.236~76]] 3.2 beta 3 (Build 14V5224d)
[[iBoot-3406.54.1~2]] 3.2 beta 4 (Build 14V5235b)
[[iBoot-3406.54.2~2]] 3.2 beta 5 (Build 14V5243a)
3.2 beta 6 (Build 14V5245a)
[[iBoot-3406.54.2~1]] 3.2 (Build 14V249)
[[iBoot-3406.60.7~16]] 3.2.2 beta (Build 14V5465b)
[[iBoot-3406.60.10~8]] 3.2.2 beta 2 (Build 14V5475a)
[[iBoot-3406.60.10~27]] 3.2.2 beta 3 (Build 14V5480a)
[[iBoot-3406.60.10~44]] 3.2.2 beta 4 (Build 14V5485a)
[[iBoot-3406.60.10~43]] 3.2.2 (Build 14V485)
[[iBoot-3406.60.10~49]] 3.2.3 beta (Build 14V5726a)
3.2.3 beta 2 (Build 14V5734a)
[[iBoot-3406.60.10~49]] 3.2.3 beta 3 (Build 14V5744a)
3.2.3 beta 4 (Build 14V5751a)
[[iBoot-3406.60.10~77]] 3.2.3 (Build 14V753)
[[iBoot-3974~307]] 4.0 beta (Build 15R5281f)
[[iBoot-4051~240]] 4.0 beta 2 (Build 15R5307f)
[[iBoot-4076.1.9~31]] 4.0 beta 3 (Build 15R5321h)
[[iBoot-4076.1.22~43]] 4.0 beta 4 (Build 15R5331g)
[[iBoot-4076.1.39~24]] 4.0 beta 5 (Build 15R5345g)
[[iBoot-4076.1.43~190]] 4.0 beta 6 (Build 15R5357b)
4.0 beta 7 (Build 15R5365a)
4.0 beta 8 (Build 15R5371a)
[[iBoot-4076.1.43~186]] 4.0 [[Golden Master|GM]] (Build 15R372)
4.0 (Build 15R372)
4.0.1 (Build 15R654)
[[iBoot-4076.20.45~11]] 4.1 beta (Build 15R5823c)
[[iBoot-4076.20.47~6]] 4.1 beta 2 (Build 15R5835d)
[[iBoot-4076.20.48~6]] 4.1 beta 3 (Build 15R5843a)
[[iBoot-4076.20.48~3]] 4.1 beta 4 (Build 15R846)
4.1 (Build 15R846)
[[iBoot-4076.30.40~25]] 4.2 beta (Build 15S5085b)
[[iBoot-4076.30.43~16]] 4.2 beta 2 (Build 15S5090c)
4.2 beta 3 (Build 15S5100a)
4.2 beta 4 (Build 15S5102b)
[[iBoot-4076.30.43~2]] 4.2 (Build 15S102)
[[iBoot-4076.30.43~135]] 4.2.2 beta (Build 15S5530d)
4.2.2 beta 2 (Build 15S5534a)
4.2.2 beta 3 (Build 15S5536a)
4.2.2 beta 4 (Build 15S5540a)
[[iBoot-4076.30.43~134]] 4.2.2 beta 5 (Build 15S542)
4.2.2 (Build 15S542)
[[iBoot-4076.50.114~52]] 4.3 beta (Build 15T5165e)
[[iBoot-4076.50.119~179]] 4.3 beta 2 (Build 15T5176c)

== [[Exploits]] ==
On 1st February, 2014, iH8sn0w found a very powerful iBoot exploit that allows any iDevice with an [[S5L8940|A5]] or [[S5L8945|A5X]] chip to be jailbroken, regardless of the iOS version. He used it mainly to grab AES [[Firmware Keys|decryption keys]]. However, according to [https://twitter.com/winocm/status/429704672211763200 this tweet from winocm], the exploit will never go public. Once he cleans it up a bit, the [[Firmware Keys|decryption keys]] will be available [http://www.icj.me/ios/keys here].
He mentioned [https://twitter.com/iH8sn0w/status/429838704077979648 here] that it will work on [[A6]] and [[A7]] chips soon, but it will require some minor modifications.

== Commands used as an exploit vector ==
* '''diags''': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* '''arm7_go''': For firmware 2.1.1, the [[N72AP|iPod touch (2nd generation)]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

== OpeniBoot ==
There is an open source version of iBoot designed so that custom kernels can be run on the iPhone/iPod/iPad. You can check out the source [http://github.com/iDroid-Project/OpeniBoot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.
OpeniBoot currently supports all S5l8900, S5l8720, S5l8920 and S5l8930 devices. More info can be found about OpeniBoot and Linux on these devices on the iDroid-Project [http://idroidproject.org website].

== Remappings ==
// N88 (3GS)
0x4FF00000 => 0x0
0x40000000 => 0xC0000000

== See also ==
* [[iBoot (Enums)]]
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

[[Category:iBoot]]

LLB

2018-02-08T01:35:41Z

Gjest:

The '''LLB''' is the '''L'''ow '''L'''evel '''B'''ootloader, also referred to as “iBoot first-stage loader” in the source code. It runs several setup routines and on firmware versions 2.0 and higher it checks the signature of [[iBoot (Bootloader)|iBoot]] before jumping to it.

Those same setup routines are present in [[iBEC]] and [[iBSS]], which is why they can be launched directly from [[DFU Mode]].

== Disassembly ==
LLB can be disassembled in a similar manner to the one described for iBoot. The base address for LLB 5.1 is 0x84000000 and the disassembly should yield the following:

<pre>
ROM:84000000 loc_84000000 ; CODE XREF: ROM:84000078�j
ROM:84000000 ; DATA XREF: ROM:_reset�o ...
ROM:84000000 B _reset
ROM:84000004 ; ---------------------------------------------------------------------------
ROM:84000004 LDR PC, =_undef
ROM:84000008 ; ---------------------------------------------------------------------------
ROM:84000008 LDR PC, =_swi
ROM:8400000C ; ---------------------------------------------------------------------------
ROM:8400000C LDR PC, =_prefabt
ROM:84000010 ; ---------------------------------------------------------------------------
ROM:84000010 LDR PC, =_dataabt
ROM:84000014 ; ---------------------------------------------------------------------------
ROM:84000014 LDR PC, =_halt
ROM:84000018 ; ---------------------------------------------------------------------------
ROM:84000018 LDR PC, =_irq
ROM:8400001C ; ---------------------------------------------------------------------------
ROM:8400001C LDR PC, =_fiq
ROM:8400001C ; ---------------------------------------------------------------------------
ROM:84000020 DCD _reset
ROM:84000024 off_84000024 DCD _undef ; DATA XREF: ROM:84000004�r
ROM:84000028 off_84000028 DCD _swi ; DATA XREF: ROM:84000008�r
ROM:8400002C off_8400002C DCD _prefabt ; DATA XREF: ROM:8400000C�r
ROM:84000030 off_84000030 DCD _dataabt ; DATA XREF: ROM:84000010�r
ROM:84000034 off_84000034 DCD _halt ; DATA XREF: ROM:84000014�r
ROM:84000038 off_84000038 DCD _irq ; DATA XREF: ROM:84000018�r
ROM:8400003C off_8400003C DCD _fiq ; DATA XREF: ROM:8400001C�r
ROM:84000040 ; ---------------------------------------------------------------------------
ROM:84000040
ROM:84000040 _reset ; CODE XREF: ROM:loc_84000000�j
ROM:84000040 ; DATA XREF: ROM:84000020�o
ROM:84000040 ADR R0, loc_84000000
...
</pre>

LLB and iBoot likely share a common code base, as is evident by similar symbols and strings for the FTL, Image_Load, and others. LLB is specialized, however, to load iBoot, which it does by looking for the Img3 tagged "ibot", as can be seen here:

<pre>
ROM:84000880 _do_boot ; CODE XREF: _LLB_Start+A6�p
ROM:84000880 PUSH {R7,LR}
ROM:84000882 MOVW R0, #'ot'
ROM:84000886 MOV R7, SP
ROM:84000888 MOVT.W R0, #'ib'
ROM:8400088C MOVS R1, #2
ROM:8400088E BL _boot_flash_probably ; First argument is "ibot", second argument is "2"
ROM:84000892 MOV.W R0, #0xFFFFFFFF
ROM:84000896 POP {R7,PC}
</pre>

If iBoot cannot be found, LLB instructs the i-Device to identify itself as Apple Mobile Device (DFU Mode):

<pre>
ROM:84019297 aAppleMobileDev DCB "Apple Mobile Device (DFU Mode)",0
</pre>
==Patched LLB==
Restoring or flashing an LLB patched with [[Pwnage]] or [[0x24000 Segment Overflow]] can lead to these changes:
* [[ECID]] checks on boot-up are cancelled
* A restored firmware is no longer integrity-checked
* RSA Signature Hash blobs ([[SHSH]]) and [[APTicket]] are ignored
* Jailbreak is always untethered for a pwn-able device
* Custom boot logos and recovery logos can be applied

IBSS

2018-02-08T01:34:21Z

Gjest: capitalising Single Stage (source is all lower case)

{{DISPLAYTITLE:iBSS}}
'''iBSS''' (short for '''''iB'''oot '''S'''ingle '''S'''tage'') is a stripped down version of [[IBoot (Bootloader)|iBoot]], missing things such as interacting with the [[/|filesystem]]. Can be uploaded via [[DFU (Protocol)|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore.

==Use of the iBSS==
The [[iBSS]] bootstraps the [[iBEC]], which prepares and executes the [[Restore Ramdisk]]. in addition, it sends messages to [[iTunes]] on the restore to supervise the restore process. It also integrity checks the images uploaded, and on iOS5+ does the image responsible for [[APTicket]], by uploading the [[nonce]] string to [[iTunes]] then checks for the match of the [[APTicket]] and [[nonce]] and the signatures on [[APTicket]]. On custom firmwares, the [[iBSS]] is patched out of every signature check, but on certain circumstances it still generates [[nonce]]. Check [[APTicket]] for further detail.

On jailbreak softwares like [[redsn0w]] and [[greenpois0n]], the [[iBSS]] bootstraps [[iBEC]] and executes a payload. It is patched out of its signature checks, of course.

==iBSS 5.x==

iBSS in iOS 5.x is very similar to LLB/DFU, where it has the same protocol. On UART out, it says: "iBSS ready. Asking for DFU...", or something along those lines.

Interesting things I've noted are when certain bits in chip ID are set, it uses a different DFU device identifier (I've personally seen 0x1226/0x1228), and these modes reject any Img3 files sent over USB.

IBEC

2018-02-08T01:33:48Z

Gjest: iBEC is iBoot Epoch Change

{{DISPLAYTITLE:iBEC}}
'''iBEC''' (short for '''''iB'''oot '''E'''poch '''C'''hange'') is a stripped down version of [[IBoot (Bootloader)|iBoot]] which is uploaded when performing a restore from Fake DFU in [[LLB]].

If iBEC is damaged, the device won't get into [[Restore Mode]] and will stay in [[DFU Mode]] or [[Recovery Mode]].

IBSS

2018-02-08T01:32:56Z

Gjest: abbrev is short for iBoot single stage (src is the leaked iBoot src)

{{DISPLAYTITLE:iBSS}}
'''iBSS''' (short for '''''iB'''oot '''s'''ingle '''s'''tage'') is a stripped down version of [[IBoot (Bootloader)|iBoot]], missing things such as interacting with the [[/|filesystem]]. Can be uploaded via [[DFU (Protocol)|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore.

==Use of the iBSS==
The [[iBSS]] bootstraps the [[iBEC]], which prepares and executes the [[Restore Ramdisk]]. in addition, it sends messages to [[iTunes]] on the restore to supervise the restore process. It also integrity checks the images uploaded, and on iOS5+ does the image responsible for [[APTicket]], by uploading the [[nonce]] string to [[iTunes]] then checks for the match of the [[APTicket]] and [[nonce]] and the signatures on [[APTicket]]. On custom firmwares, the [[iBSS]] is patched out of every signature check, but on certain circumstances it still generates [[nonce]]. Check [[APTicket]] for further detail.

On jailbreak softwares like [[redsn0w]] and [[greenpois0n]], the [[iBSS]] bootstraps [[iBEC]] and executes a payload. It is patched out of its signature checks, of course.

==iBSS 5.x==

iBSS in iOS 5.x is very similar to LLB/DFU, where it has the same protocol. On UART out, it says: "iBSS ready. Asking for DFU...", or something along those lines.

Interesting things I've noted are when certain bits in chip ID are set, it uses a different DFU device identifier (I've personally seen 0x1226/0x1228), and these modes reject any Img3 files sent over USB.

SHSH

2018-01-13T22:07:27Z

Gjest: Reverting my own edit for now. IPSW.me says that all versions are signed for iPhone3G/iPod2G, but I am not able to confirm this with tsschecker (4.1 and 4.2.1 are both signed)

As the [[wikipedia:SHSH blob | '''SHSH''' blob article on Wikipedia]] summarizes it: "SHSH blob is a jargon term for a small piece of data that is part of Apple's digital signature protocol for iOS restores and updates, designed to control the iOS versions that users can install on their iOS devices (iPhones, iPads, iPod touches, and Apple TVs), generally only allowing the newest iOS version to be installable. "

Technically, the SHSH of a firmware image is a 1024-bit (<code>0x80</code> bytes) [[wikipedia:RSA (cryptosystem)|RSA]] signature. This often also refers to backup files with the signature ("SHSH blobs"). This signature is needed to restore a specific iOS version; it is generated by Apple based on hardware keys of the device and the hash of the firmware. Apple only issues signatures for the currently-available iOS version, which disallows installing older iOS versions. But if you have saved signatures for an older iOS version, you may be able to use a [[wikipedia:replay attack|replay attack]] to restore that version. Therefore it is recommended to save the signature for your device as long as Apple issues it.

With the tools mentioned below it is possible to backup the signature. It is not necessary that the device is jailbroken to do the backup. Usually the SHSH signature file is stored on [[Cydia Server|Saurik's server]]. If it is stored there, then you can see in the top of [[Cydia Application|Cydia]] (on jailbroken devices) for which version a backup exists. This moved to [[TSS Center]] which can be located on the main page and then they are shown at the top of that.

Users often misunderstand this system and think that the SHSH firmware version they back up depends on the firmware version they have installed on their device. This is the case for [[iFaith]], but not for TinyUmbrella. iFaith dumps the SHSHs from your device's storage (whatever's installed on your device, e.g. 4.3.3), while TinyUmbrella gets SHSHs from Apple's servers (whatever firmwares Apple is currently signing).

==Using SHSH==
Older devices ([[M68AP|iPhone]] and [[N45AP|iPod touch]]) do not use SHSH signatures, so installation of any firmware on these devices is possible.

iPhone OS 1.x and 2.x do not use SHSH signatures, and can therefore be downgraded to at any time, even on devices that do use SHSH signatures, such as [[N82AP|iPhone 3G]].

Versions above iPhone OS 3.0 require the [[iBEC]], [[iBSS]], and [[LLB]] to be fully signed with an SHSH for the ECID of that device.

However, some devices are vulnerable to untethered [[Bootrom#Bootrom Exploits|bootrom exploits]], such as [[0x24000 Segment Overflow]] or [[alloc8 Exploit|alloc8]]. These devices can be restored to a custom [[IPSW]] in Pwned [[DFU Mode]] for any version that is available to that particular device. Notable devices vulnerable to untethered bootrom exploits are the [[iPhone 3GS]] and [[iPod touch (2nd generation)]]. The [[limera1n Exploit]] is able to provide a [[Tethered Downgrade|tethered downgrade]] for vulnerable devices.

Since various exploits, such as the [[limera1n Exploit]], are fixed in the [[bootrom]] since version [[Bootrom 838.3]] and because iOS versions 5.0 and above includes a [[nonce]] in their SHSH hashes, downgrading newer devices is not as simple. Blobs must be stitched into a custom firmware, and restored to in Pwned [[DFU Mode]].

Blobs can be saved with tools such as [[iFaith]] and [[TinyUmbrella]]. Firmwares can be stitched using [[iFaith]], [[redsn0w]] or [[sn0wbreeze]].

Newer methods such as [[Odysseus]], [[Prometheus]] or [[iDeviceReRestore]] are used now because other tools have become outdated and newer versions of [[iTunes]] prevents restores to custom versions.

==Timeline==
As noted above, the original [[M68AP|iPhone]] and [[N45AP|iPod touch]] didn't use SHSH blobs. iPhone OS 1.x and 2.x didn't use SHSH blobs either.

=== iOS ===
{| class="wikitable"
|-
! Firmware
! For Device(s)
! From
! Until
! Status
|-
| 11.2.2
| rowspan="6" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N102AP|iPod touch (6th generation)]]
| {{date|2018|01|08}}
| -
| {{yes|Open}}
|-
| 11.2.1
| {{date|2017|12|13}}
| -
| {{yes|Open}}
|-
| 11.2
| {{date|2017|12|02}}
| -
| {{yes|Open}}
|-
| 11.1.2
| {{date|2017|11|16}}
| {{date|2017|12|15}}
| {{no|Closed}}
|-
| 11.1.1
| {{date|2017|11|09}}
| {{date|2017|12|15}}
| {{no|Closed}}
|-
| 11.1
| {{date|2017|10|31}}
| {{date|2017|12|05}}
| {{no|Closed}}
|-
| 11.0.3
| rowspan="2" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[N102AP|iPod touch (6th generation)]]
| {{date|2017|10|11}}
| {{date|2017|11|28}}
| {{no|Closed}}
|-
| 11.0.2
| {{date|2017|10|03}}
| {{date|2017|11|16}}
| {{no|Closed}}
|-
| rowspan="2" | 11.0.1
| [[iPhone 8]], [[iPhone 8 Plus]]
| rowspan="2" | {{date|2017|09|26}}
| {{date|2017|12|15}}
| {{no|Closed}}
|-
| rowspan="2" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]
| {{date|2017|11|16}}
| {{no|Closed}}
|-
| 11.0
| {{date|2017|09|19}}
| {{date|2017|10|04}}
| {{no|Closed}}
|-
| rowspan="3" | 10.3.3
| [[iPhone 6s]]
| {{date|2017|10|05}}
| {{date|2017|11|16}}
| {{no|Closed}}
|-
| [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]
| {{date|2017|07|19}}
| {{date|2017|10|04}}
| {{no|Closed}}
|-
| [[iPad (4th generation)]], [[iPhone 5]], [[iPhone 5c]]
| {{date|2017|07|19}}
| -
| {{yes|Open}}
|-
| rowspan="2" | 10.3.2
| [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]]
| {{date|2017|06|05}}
| {{date|2017|08|09}}
| {{no|Closed}}
|-
| rowspan="3" | [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]
| {{date|2017|05|15}}
| {{date|2017|08|09}}
| {{no|Closed}}
|-
| 10.3.1
| {{date|2017|04|03}}
| {{date|2017|06|27}}
| {{no|Closed}}
|-
| 10.3
| {{date|2017|03|27}}
| {{date|2017|04|10}}
| {{no|Closed}}
|-
| 10.2.1
| rowspan="5" | [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]
| {{date|2017|01|23}}
| {{date|2017|04|10}}
| {{no|Closed}}
|-
| 10.2
| {{date|2016|12|12}}
| {{date|2017|01|30}}
| {{no|Closed}}
|-
| 10.1.1 (14B150)
| {{date|2016|11|09}}
| {{date|2016|12|20}}
| {{no|Closed}}
|-
| 10.1.1 (14B100)
| {{date|2016|10|31}}
| {{date|2016|12|20}}
| {{no|Closed}}
|-
| 10.1
| {{date|2016|10|24}}
| {{date|2016|12|20}}
| {{no|Closed}}
|-
| 10.0.3
| [[iPhone 7]], [[iPhone 7 Plus]]
| {{date|2016|10|17}}
| {{date|2016|10|31}}
| {{no|Closed}}
|-
| 10.0.2
| rowspan="2" | [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]
| {{date|2016|09|23}}
| {{date|2016|10|31}}
| {{no|Closed}}
|-
| 10.0.1
| {{date|2016|09|13}}
| {{date|2016|10|18}}
| {{no|Closed}}
|-
| rowspan="2 | 9.3.5
| [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[N102AP|iPod touch (6th generation)]]
| rowspan="2 | {{date|2016|08|25}}
| {{date|2016|10|18}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad mini]], [[N94AP|iPhone 4S]], [[iPod touch (5th generation)]]
| -
| {{yes|Open}}
|-
| 9.3.4
| rowspan="2" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2016|08|04}}
| {{date|2016|09|07}}
| {{no|Closed}}
|-
| 9.3.3
| {{date|2016|07|18}}
| {{date|2016|08|24}}
| {{no|Closed}}
|-
| 9.3.2 (13F72)
| [[iPad Pro (9.7-inch)]]
| {{date|2016|06|02}}
| {{date|2016|08|24}}
| {{no|Closed}}
|-
| rowspan="2" | 9.3.2 (13F69)
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[J128AP|iPad Pro (iPad6,4)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| rowspan="2" | {{date|2016|05|16}}
| {{date|2016|08|24}}
| {{no|Closed}}
|-
| [[J127AP|iPad Pro (iPad6,3)]]
| {{date|2016|05|26}}
| {{no|Closed}}
|-
| 9.3.1
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2016|03|31}}
| {{date|2016|06|10}}
| {{no|Closed}}
|-
| 9.3 (13E237)
| [[K93AP|iPad 2 (iPad2,1)]], [[K95AP|iPad 2 (iPad2,3)]], [[K93AAP|iPad 2 (iPad2,4)]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]
| {{date|2016|03|28}}
| rowspan="2" | {{date|2016|04|22}}
| {{no|Closed}}
|-
| 9.3 (13E236)
| [[K94AP|iPad 2 (iPad2,2)]]
| {{date|2016|03|25}}
| {{no|Closed}}
|-
| 9.3 (13E234)
| [[iPad Pro (9.7-inch)]]
| rowspan="3" | {{date|2016|03|21}}
| rowspan="2" | {{date|2016|04|18}}
| {{no|Closed}}
|-
| rowspan="2" | 9.3 (13E233)
| [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini 3]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[N102AP|iPod touch (6th generation)]]
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]
| {{date|2016|03|24}}
| {{no|Closed}}
|-
| 9.2.1 (13D20)
| [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini 3]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]]
| {{date|2016|02|18}}
| {{date|2016|04|05}}
| {{no|Closed}}
|-
| 9.2.1 (13D15)
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2016|01|19}}
| {{date|2016|04|05}}
| {{no|Closed}}
|-
| rowspan="2" | 9.2
| [[K93AAP|iPad 2 (iPad2,4)]], [[J1AP|iPad (3rd generation) (iPad3,1)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| rowspan="2" | {{date|2015|12|08}}
| {{date|2016|02|05}}
| {{no|Closed}}
|-
| [[K93AP|iPad 2 (iPad2,1)]], [[K94AP|iPad 2 (iPad2,2)]], [[K95AP|iPad 2 (iPad2,3)]], [[J2AP|iPad (3rd generation) (iPad3,2)]], [[J2AAP|iPad (3rd generation) (iPad3,3)]], [[N94AP|iPhone 4S]]
| {{date|2016|02|04}}
| {{no|Closed}}
|-
| 9.1 (13B144)
| [[iPad Pro (12.9-inch)]]
| {{date|2015|11|17}}
| rowspan="2" | {{date|2015|12|21}}
| {{no|Closed}}
|-
| rowspan="2" | 9.1 (13B143)
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| rowspan="2" | {{date|2015|10|21}}
| {{no|Closed}}
|-
| [[iPad Pro]]
| {{date|2015|12|02}}
| {{no|Closed}}
|-
| 9.0.2
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2015|09|30}}
| {{date|2015|10|29}}
| {{no|Closed}}
|-
| rowspan="2" | 9.0.1
| [[iPhone 6s]], [[iPhone 6s Plus]]
| {{date|2015|09|24}}
| rowspan="2" | {{date|2015|10|08}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2015|09|23}}
| {{no|Closed}}
|-
| 9.0
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2015|09|16}}
| rowspan="2" | {{date|2015|09|30}}
| {{no|Closed}}
|-
| 8.4.1
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2015|08|13}}
| {{no|Closed}}
|-
| rowspan="2" | 8.4
| [[N102AP|iPod touch (6th generation)]]
| {{date|2015|07|15}}
| {{date|2015|08|23}}
| {{no|Closed}}
|-
| rowspan="7" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]]
| {{date|2015|06|30}}
| {{date|2015|08|23}}
| {{no|Closed}}
|-
| 8.3
| {{date|2015|04|08}}
| {{date|2015|07|07}}
| {{no|Closed}}
|-
| 8.2
| {{date|2015|03|09}}
| {{date|2015|05|04}}
| {{no|Closed}}
|-
| 8.1.3
| {{date|2015|01|27}}
| {{date|2015|03|23}}
| {{no|Closed}}
|-
| 8.1.2
| {{date|2014|12|09}}
| {{date|2015|02|10}}
| {{no|Closed}}
|-
| 8.1.1
| {{date|2014|11|17}}
| {{date|2014|12|17}}
| {{no|Closed}}
|-
| 8.1
| {{date|2014|10|20}}
| {{date|2014|12|01}}
| {{no|Closed}}
|-
| 8.0.2
| rowspan="3" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]]
| {{date|2014|09|25}}
| {{date|2014|10|20}}
| {{no|Closed}}
|-
| 8.0.1
| {{date|2014|09|24}}
| {{date|2014|09|24}}
| {{no|Closed}}
|-
| 8.0
| {{date|2014|09|17}}
| {{date|2014|10|22}}
| {{no|Closed}}
|-
| rowspan="3" | 7.1.2
| rowspan="2" | [[iPhone 4]]
| {{date|2017|02|13}}
| -
| {{yes|Open}}
|-
| rowspan="2" | {{date|2014|06|30}}
| {{date|2017|02|13}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]
| {{date|2014|09|26}}
| {{no|Closed}}
|-
| 7.1.1
| rowspan="3" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]
| {{date|2014|04|22}}
| {{date|2014|08|12}}
| {{no|Closed}}
|-
| 7.1
| {{date|2014|03|10}}
| {{date|2014|04|30}}
| {{no|Closed}}
|-
| 7.0.6
| {{date|2014|02|21}}
| {{date|2014|03|10}}
| {{no|Closed}}
|-
| 7.0.5
| [[N49AP|iPhone 5c (iPhone5,4)]], [[N53AP|iPhone 5s (iPhone6,2)]]
| {{date|2014|01|29}}
| {{date|2014|02|21}}
| {{no|Closed}}
|-
| 7.0.4
| rowspan="2" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]
| {{date|2013|11|14}}
| {{date|2014|02|21}}
| {{no|Closed}}
|-
| 7.0.3
| {{date|2013|10|22}}
| {{date|2013|11|14}}
| {{no|Closed}}
|-
| rowspan="2" | 7.0.2
| [[P105AP|iPad mini (iPad2,5)]]
| rowspan="2" | {{date|2013|09|26}}
| {{date|2014|02|21}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[P106AP|iPad mini (iPad2,6)]], [[P107AP|iPad mini (iPad2,7)]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]
| {{date|2013|10|29}}
| {{no|Closed}}
|-
| 7.0.1
| [[iPhone 5c]], [[iPhone 5s]]
| {{date|2013|09|18}}
| {{date|2013|10|07}}
| {{no|Closed}}
|-
| 7.0
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPod touch (5th generation)]]
| {{date|2013|09|18}}
| {{date|2013|10|07}}
| {{no|Closed}}
|-
| rowspan="2" | 6.1.6
| rowspan="2" | [[N88AP|iPhone 3GS]], [[N88AP|iPod touch (4th generation)]]
| {{date|2017|02|13}}
| -
| {{yes|Open}}
|-
| {{date|2013|11|24}}
| {{date|2017|02|13}}
| {{no|Closed}}
|-
| 6.1.5
| [[N81AP|iPod touch (4th generation)]]
| {{date|2013|09|24}}
| {{date|2014|02|21}}
| {{no|Closed}}
|-
| 6.1.4
| [[iPhone 5]]
| {{date|2013|05|02}}
| {{date|2013|09|20}}
| {{no|Closed}}
|-
| rowspan="6" | 6.1.3
| [[K93AP|iPad2,1]], [[K94AP|iPad2,2]], [[K95AP|iPad2,3]], [[N94AP|iPhone 4S]]
| {{date|2018|01|10}}
| -
| {{yes|Open}}
|-
| [[N88AP|iPhone 3GS]]
| rowspan="5" | {{date|2013|03|19}}
| {{date|2014|02|21}}
| {{no|Closed}}
|-
| [[N81AP|iPod touch (4th generation)]]
| {{date|2013|11|14}}
| {{no|Closed}}
|-
| [[iPhone 5]]
| {{date|2013|05|02}}
| {{no|Closed}}
|-
| [[P106AP|iPad mini (iPad2,6)]]
| {{date|2013|09|25}}
| {{no|Closed}}
|-
| [[K93AAP|iPad2,4]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[P105AP|iPad mini (iPad2,5)]], [[P107AP|iPad mini (iPad2,7)]], [[iPhone 4]], [[iPod touch (5th generation)]]
| {{date|2013|09|20}}
| {{no|Closed}}
|-
| rowspan="2" | 6.1.2
| [[N78AP|iPod touch (5th generation)]]
| rowspan="2" | {{date|2013|02|19}}
| {{date|2013|03|20}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]] [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]]
| {{date|2013|03|19}}
| {{no|Closed}}
|-
| 6.1.1
| [[N94AP|iPhone 4S]]
| {{date|2013|02|11}}
| {{date|2013|02|19}}
| {{no|Closed}}
|-
| rowspan="2" | 6.1
| [[P106AP|iPad mini (iPad2,6)]], [[N81AP|iPod touch (4th generation)]]
| {{date|2013|01|28}}
| {{date|2013|03|20}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N78AP|iPod touch (5th generation)]]
| {{date|2013|01|28}}
| {{date|2013|02|19}}
| {{no|Closed}}
|-
| rowspan="2" | 6.0.2
| [[P105AP|iPad mini (iPad2,5)]], [[iPhone 5]]
| colspan="2" | {{date|2013|07|26}}
| {{no|Closed}}
|-
| [[iPad mini]], [[iPhone 5]]
| {{date|2012|12|18}}
| {{date|2013|01|28}}
| {{no|Closed}}
|-
| rowspan="4" | 6.0.1
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]
| {{date|2012|11|01}}
| {{date|2013|01|28}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[P101AP|iPad (4th generation) (iPad3,4)]], [[P105AP|iPad mini (iPad2,5)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]
| colspan="2" | {{date|2013|07|26}}
| {{no|Closed}}
|-
| [[iPad mini]]
| {{date|2012|11|01}}
| {{date|2013|01|08}}
| {{no|Closed}}
|-
| [[iPad (4th generation)]], [[iPad mini]]
| {{date|2012|11|09}}
| {{date|2013|01|28}}
| {{no|Closed}}
|-
| rowspan="3" | 6.0
| [[P101AP|iPad (4th generation) (iPad3,4)]], [[P105AP|iPad mini (iPad2,5)]]
| {{date|2012|10|30}}
| {{date|2012|11|01}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[P105AP|iPad mini (iPad2,5)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]
| colspan="2" | {{date|2013|07|26}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]
| {{date|2012|09|19}}
| {{date|2012|11|01}}
| {{no|Closed}}
|-
| 5.1.1 (9B208)
| [[N90AP|iPhone 4 (iPhone3,1)]]
| {{date|2012|05|25}}
| {{date|2012|09|21}}
| {{no|Closed}}
|-
| rowspan="4" | 5.1.1 (9B206)
| rowspan="2" |[[K48AP|iPad]]
| {{date|2017|02|13}}
| -
| {{yes|Open}}
|-
| rowspan="3" | {{date|2012|05|07}}
| {{date|2017|02|13}}
| {{no|Closed}}
|-
| [[N18AP|iPod touch (3rd generation)]]
| -
| {{yes|Open}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N81AP|iPod touch (4th generation)]]
| {{date|2012|09|21}}
| {{no|Closed}}
|-
| 5.1
| [[K48AP|iPad]], [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]
| {{date|2012|03|07}}
| {{date|2012|05|14}}
| {{no|Closed}}
|-
| 5.0.1
| [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]
| {{date|2011|11|09}}
| {{date|2012|02|08}}
| {{no|Closed}}
|-
| rowspan="2" | 5.0
| [[N94AP|iPhone 4S]]
| {{date|2011|10|14}}
| {{date|2011|11|10}}(?)
| {{no|Closed}}
|-
| [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]
| {{date|2011|10|04}}
| {{date|2011|11|10}}(?)
| {{no|Closed}}
|-
| 4.3.5
| rowspan="6" | [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4(iPhone3,1)]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]
| 25 July 2011
| {{date|2011|10|18}}
| {{no|Closed}}
|-
| 4.3.4
| {{date|2011|07|15}}
| {{date|2011|07|27}}
| {{no|Closed}}
|-
| 4.3.3
| {{date|2011|05|04}}
| {{date|2011|07|18}}
| {{no|Closed}}
|-
| 4.3.2
| {{date|2011|04|14}}
| {{date|2011|05|06}}
| {{no|Closed}}
|-
| 4.3.1
| {{date|2011|03|25}}
| {{date|2011|04|19}} (?)
| {{no|Closed}}
|-
| 4.3
| {{date|2011|03|09}}
| {{date|2011|03|27}} (?)
| {{no|Closed}}
|-
| 4.2.10
| rowspan="5" | [[N92AP|iPhone 4 (iPhone3,3)]]
| {{date|2011|07|25}}
| {{date|2011|10|18}}
| {{no|Closed}}
|-
| 4.2.9
| {{date|2011|07|15}}
| {{date|2011|07|27}}
| {{no|Closed}}
|-
| 4.2.8
| {{date|2011|05|04}}
| {{date|2011|07|18}}
| {{no|Closed}}
|-
| 4.2.7
| {{date|2011|04|14}}
| {{date|2011|05|06}}
| {{no|Closed}}
|-
| 4.2.6
| {{date|2011|02|01}}
| {{date|2011|04|19}} (?)
| {{no|Closed}}
|-
| rowspan="2" | 4.2.1
| [[N82AP|iPhone 3G]], [[N72AP|iPod touch (2nd generation)]]
| rowspan="2" | {{date|2010|11|22}}
| -
| {{yes|Open}}
|-
| [[K48AP|iPad]], [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]
| {{date|2011|03|11}}
| {{no|Closed}}
|-
| 4.1 (8B118)
| [[N81AP|iPod touch (4th generation)]]
| {{date|2010|09|21}}
| {{date|2010|12|02}} (?)
| {{no|Closed}}
|-
| rowspan="4" | 4.1 (8B117)
| [[N72AP|iPod touch (2nd generation)]], [[N18AP|iPod touch (3rd generation)]]
| {{date|2010|09|08}}
| rowspan="2" | -
| {{yes|Open}}
|-
| rowspan="2" | [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]]
| {{date|2017|02|13}}
| {{yes|Open}}
|-
| rowspan="2" | {{date|2010|09|08}}
| {{date|2017|02|13}}
| {{no|Closed}}
|-
| [[N90AP|iPhone 4 (iPhone3,1)]], [[N81AP|iPod touch (4th generation)]]
| {{date|2010|12|02}} (?)
| {{no|Closed}}
|-
| rowspan="2" | 4.0.2
| [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]], [[N18AP|iPod touch (3rd generation)]]
| {{date|2010|08|11}}
| {{date|2010|09|09}}
| {{no|Closed}}
|-
| [[N82AP|iPhone 3G]], [[N72AP|iPod touch (2nd generation)]]
| {{date|2010|08|11}}
| {{date|2010|09|18}}
| {{no|Closed}}
|-
| rowspan="2" | 4.0.1
| [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]]
| {{date|2010|07|15}}
| {{date|2010|08|19}}
| {{no|Closed}}
|-
| [[N82AP|iPhone 3G]]
| {{date|2010|07|15}}
| {{date|2010|09|09}}
| {{no|Closed}}
|-
| rowspan="4" | 4.0
| [[N18AP|iPod touch (3rd generation)]]
| {{date|2010|06|21}}
| {{date|2010|08|09}}
| {{no|Closed}}
|-
| [[N72AP|iPod touch (2nd generation)]]
| {{date|2010|06|21}}
| {{date|2010|09|09}}
| {{no|Closed}}
|-
| [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]]
| {{date|2010|06|21}}
| {{date|2010|07|15}}
| {{no|Closed}}
|-
| [[N90AP|iPhone 4 (iPhone3,1)]]
| {{date|2010|06|24}}
| {{date|2010|07|15}}
| {{no|Closed}}
|-
| 3.2.2
| rowspan="3" | [[K48AP|iPad]]
| {{date|2010|08|11}}
| {{date|2010|12|02}} (?)
| {{no|Closed}}
|-
| 3.2.1
| {{date|2010|07|15}}
| {{date|2010|08|19}}
| {{no|Closed}}
|-
| 3.2
| {{date|2010|04|03}}
| {{date|2010|07|15}}
| {{no|Closed}}
|-
| 3.1.3
| [[N88AP|iPhone 3GS]], [[N72AP|iPod touch (2nd generation)]], [[N18AP|iPod touch (3rd generation)]]
| {{date|2010|02|02}}
| {{date|2010|06|21}}
| {{no|Closed}}
|-
| rowspan="2" | 3.1.2
| [[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]]
| {{date|2009|10|08}}
| {{date|2010|02|02}}
| {{no|Closed}}
|-
| [[N72AP|iPod touch (2nd generation)]]
| {{date|2009|10|08}}
| {{date|2010|06|21}}
| {{no|Closed}}
|-
| 3.1.1 (7C146)
| rowspan="2" | [[N18AP|iPod touch (3rd generation)]]
| {{date|2009|09|17}}
| {{date|2009|10|08}} (?)
| {{no|Closed}}
|-
| rowspan="2" | 3.1.1 (7C145)
| {{date|2009|09|09}}
| {{date|2009|10|08}}
| {{no|Closed}}
|-
| [[N72AP|iPod touch (2nd generation)]]
| {{date|2009|09|09}}
| {{date|2010|06|21}}
| {{no|Closed}}
|-
| 3.1
| rowspan="3" | [[N88AP|iPhone 3GS]]
| {{date|2009|09|09}}
| {{date|2009|10|08}}
| {{no|Closed}}
|-
| 3.0.1
| {{date|2009|07|31}}
| rowspan="2" | {{date|2009|09|09}}
| {{no|Closed}}
|-
| 3.0
| {{date|2009|06|19}}
| {{no|Closed}}
|}

=== Apple TV ===
{| class="wikitable"
|-
! Marketing Version
! OS Version
! For Device(s)
! From
! Until
! Status
|-
| rowspan="18" {{n/a}}
| 11.2.1
| rowspan="4" | [[J42dAP|Apple TV (4th generation)]], [[Apple TV 4K]]
| {{date|2017|12|13}}
| -
| rowspan="2" {{yes|Open}}
|-
| 11.2
| {{date|2017|12|02}}
| -
|-
| 11.1
| {{date|2017|10|31}}
| {{date|2017|12|15}}
| {{no|Closed}}
|-
| 11.0
| {{date|2017|09|19}}
| {{date|2017|12|15}}
| {{no|Closed}}
|-
| 10.2.2
| rowspan="14" | [[J42dAP|Apple TV (4th generation)]]
| {{date|2017|07|19}}
| -
| {{yes|Open}}
|-
| 10.2.1
| {{date|2017|05|15}}
| {{date|2017|08|09}}
| {{no|Closed}}
|-
| 10.2
| {{date|2017|03|27}}
| {{date|2017|06|27}}
| {{no|Closed}}
|-
| 10.1.1
| {{date|2017|01|23}}
| {{date|2017|04|10}}
| {{no|Closed}}
|-
| 10.1
| {{date|2016|12|12}}
| {{date|2017|01|30}}
| {{no|Closed}}
|-
| 10.0.1
| {{date|2016|10|24}}
| {{date|2017|01|30}}
| {{no|Closed}}
|-
| 10.0
| {{date|2016|09|13}}
| {{date|2016|10|31}}
| {{no|Closed}}
|-
| 9.2.2
| {{date|2016|07|18}}
| {{date|2016|10|18}}
| {{no|Closed}}
|-
| 9.2.1
| {{date|2016|05|16}}
| {{date|2016|09|23}}
| {{no|Closed}}
|-
| 9.2
| {{date|2016|03|21}}
| {{date|2016|06|10}}
| {{no|Closed}}
|-
| 9.1.1
| {{date|2016|01|25}}
| {{date|2016|04|05}}
| {{no|Closed}}
|-
| 9.1
| {{date|2015|12|08}}
| {{date|2016|02|04}}
| {{no|Closed}}
|-
| 9.0.1
| {{date|2015|11|09}}
| {{date|2015|12|21}}
| {{no|Closed}}
|-
| 9.0
| {{date|2015|10|29}}
| {{date|2015|12|14}}
| {{no|Closed}}
|-
| 7.2.2
| 8.4.2
| rowspan="8" | [[Apple TV (3rd generation)]]
| {{date|2016|12|12}}
| -
| {{yes|Open}}
|-
| 7.2.1
| 8.4.1
| {{date|2016|02|25}}
| {{date|2016|12|20}}
| {{no|Closed}}
|-
| 7.2
| 8.3
| {{date|2015|04|08}}
| {{date|2016|04|07}}
| {{no|Closed}}
|-
| 7.1
| 8.2
| {{date|2015|03|09}}
| {{date|2015|05|04}}
| {{no|Closed}}
|-
| 7.0.3
| 8.1.3
| {{date|2015|01|27}}
| {{date|2015|03|23}}
| {{no|Closed}}
|-
| 7.0.2
| 8.1.1
| {{date|2014|11|17}}
| {{date|2015|04|01}}
| {{no|Closed}}
|-
| 7.0.1
| 8.1
| {{date|2014|10|20}}
| {{date|2014|12|01}}
| {{no|Closed}}
|-
| 7.0
| 8.0
| {{date|2014|09|17}}
| {{date|2014|10|22}}
| {{no|Closed}}
|-
| rowspan="2" | 6.2.1
| rowspan="3" | 7.1.2
| rowspan="2" | [[K66AP|Apple TV (2nd generation)]]
| {{date|2017|02|13}}
| -
| {{yes|Open}}
|-
| {{date|2014|09|17}}
| {{date|2017|02|13}}
| {{no|Closed}}
|-
| 6.2
| rowspan="8" | [[K66AP|Apple TV (2nd generation)]], [[Apple TV (3rd generation)]]
| {{date|2014|06|30}}
| {{date|2014|09|26}}
| {{no|Closed}}
|-
| 6.1.1
| 7.1.1
| {{date|2014|04|22}}
| {{date|2014|07|11}}
| {{no|Closed}}
|-
| 6.1
| 7.1
| {{date|2014|03|10}}
| {{date|2014|04|30}}
| {{no|Closed}}
|-
| rowspan="2" | 6.0.2
| 7.0.6
| {{date|2014|02|21}}
| {{date|2014|03|10}}
| {{no|Closed}}
|-
| 7.0.4
| {{date|2013|11|14}}
| {{date|2014|02|21}}
| {{no|Closed}}
|-
| 6.0.1
| 7.0.3
| {{date|2013|10|24}}
| {{date|2013|11|14}}
| {{no|Closed}}
|-
| rowspan="2" | 6.0
| 7.0.2
| {{date|2013|09|24}}
| {{date|2013|10|29}}
| {{no|Closed}}
|-
| 7.0.1
| {{date|2013|09|20}}
| {{date|2013|09|24}}
| {{no|Closed}}
|-
| rowspan="3" | 5.3
| rowspan="3" | 6.1.4
| [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]
| {{date|2013|06|19}}
| {{date|2013|09|21}}
| {{no|Closed}}
|-
| rowspan="2" | [[K66AP|Apple TV (2nd generation)]], [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]
| {{date|2017|02|13}}
| -
| {{yes|Open}}
|-
| {{date|2013|06|19}}
| {{date|2017|02|13}}
| {{no|Closed}}
|-
| 5.2.1
| 6.1.3
| rowspan="2" | [[K66AP|Apple TV (2nd generation)]], [[Apple TV (3rd generation)]]
| {{date|2013|03|19}}
| {{date|2013|06|20}}
| {{no|Closed}}
|-
| 5.2
| 6.1
| {{date|2013|01|28}}
| {{date|2013|03|20}}
| {{no|Closed}}
|-
| 5.1.1
| 6.0.1
| rowspan="5" | [[K66AP|Apple TV (2nd generation)]], [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]
| {{date|2012|11|26}}
| {{date|2013|03|20}}
| {{no|Closed}}
|-
| 5.1
| 6.0
| {{date|2012|09|24}}
| {{date|2013|03|20}}
| {{no|Closed}}
|-
| 5.0.2
| rowspan="2" | 5.1.1
| {{date|2012|06|05}}
| {{date|2013|03|20}}
| {{no|Closed}}
|-
| 5.0.1
| {{date|2012|05|10}}
| {{date|2012|7}} (day unknown)
| {{no|Closed}}
|-
| 5.0
| 5.1
| {{date|2012|03|07}}
| {{date|2012|05|14}}
| {{no|Closed}}
|-
| 4.4.4
| rowspan="2" | 5.0.1
| rowspan="12" | [[K66AP|Apple TV (2nd generation)]]
| {{date|2011|12|15}}
| {{date|2012|03|08}}
| {{no|Closed}}
|-
| 4.4.3
| {{date|2011|11|17}}
| {{date|2012|01|11}}(?)
| {{no|Closed}}
|-
| 4.4.2
| rowspan="3" | 5.0
| {{date|2011|10|24}}
| {{date|2012|01|11}}(?)
| {{no|Closed}}
|-
| 4.4.1
| {{date|2011|10|17}}
| ?
| {{no|Closed}}
|-
| 4.4
| {{date|2011|10|04}}
| ?
| {{no|Closed}}
|-
| colspan="2" | 4.3
| {{date|2011|03|09}}
| ?
| {{no|Closed}}
|-
| 4.2.2
| rowspan="3" | 4.3
| {{date|2011|05|11}}
| {{date|2011|10|18}} (?)
| {{no|Closed}}
|-
| 4.2.1
| {{date|2011|03|22}}
| {{date|2011|05|28}} (?)
| {{no|Closed}}
|-
| 4.2
| {{date|2011|03|09}}
| {{date|2011|03|22}} (?)
| {{no|Closed}}
|-
| 4.1.1
| 4.2.1
| {{date|2010|12|14}}
| {{date|2011|05|28}} (?)
| {{no|Closed}}
|-
| 4.1
| 4.2
| {{date|2010|11|22}}
| {{date|2010|12|14}}
| {{no|Closed}}
|-
| 4.0
| 4.1
| {{date|2010|09|29}}
| {{date|2010|12|02}} (?)
| {{no|Closed}}
|}

== Protocol ==
To request a SHSH blob from Apple, a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] request can be made. For a full description, see the separate articles [[SHSH Protocol]] and [[Baseband SHSH Protocol]].

== See Also ==
* [[APTicket]]
* [[Redsn0w]]
* [[iFaith]]
* [[TinyUmbrella]]

== External Links ==
* [http://www.saurik.com/id/12 Detailed background info from Saurik]
* [https://github.com/tihmstar/tsschecker tsschecker]
* [https://github.com/Neal/savethemblobs savethemblobs]

[[Category:Firmware Tags]]

SHSH

2018-01-13T21:10:19Z

Gjest: All iOS 4 versions have been re-opened for iPhone 3G and iPod 2G

As the [[wikipedia:SHSH blob | '''SHSH''' blob article on Wikipedia]] summarizes it: "SHSH blob is a jargon term for a small piece of data that is part of Apple's digital signature protocol for iOS restores and updates, designed to control the iOS versions that users can install on their iOS devices (iPhones, iPads, iPod touches, and Apple TVs), generally only allowing the newest iOS version to be installable. "

Technically, the SHSH of a firmware image is a 1024-bit (<code>0x80</code> bytes) [[wikipedia:RSA (cryptosystem)|RSA]] signature. This often also refers to backup files with the signature ("SHSH blobs"). This signature is needed to restore a specific iOS version; it is generated by Apple based on hardware keys of the device and the hash of the firmware. Apple only issues signatures for the currently-available iOS version, which disallows installing older iOS versions. But if you have saved signatures for an older iOS version, you may be able to use a [[wikipedia:replay attack|replay attack]] to restore that version. Therefore it is recommended to save the signature for your device as long as Apple issues it.

With the tools mentioned below it is possible to backup the signature. It is not necessary that the device is jailbroken to do the backup. Usually the SHSH signature file is stored on [[Cydia Server|Saurik's server]]. If it is stored there, then you can see in the top of [[Cydia Application|Cydia]] (on jailbroken devices) for which version a backup exists. This moved to [[TSS Center]] which can be located on the main page and then they are shown at the top of that.

Users often misunderstand this system and think that the SHSH firmware version they back up depends on the firmware version they have installed on their device. This is the case for [[iFaith]], but not for TinyUmbrella. iFaith dumps the SHSHs from your device's storage (whatever's installed on your device, e.g. 4.3.3), while TinyUmbrella gets SHSHs from Apple's servers (whatever firmwares Apple is currently signing).

==Using SHSH==
Older devices ([[M68AP|iPhone]] and [[N45AP|iPod touch]]) do not use SHSH signatures, so installation of any firmware on these devices is possible.

iPhone OS 1.x and 2.x do not use SHSH signatures, and can therefore be downgraded to at any time, even on devices that do use SHSH signatures, such as [[N82AP|iPhone 3G]].

Versions above iPhone OS 3.0 require the [[iBEC]], [[iBSS]], and [[LLB]] to be fully signed with an SHSH for the ECID of that device.

However, some devices are vulnerable to untethered [[Bootrom#Bootrom Exploits|bootrom exploits]], such as [[0x24000 Segment Overflow]] or [[alloc8 Exploit|alloc8]]. These devices can be restored to a custom [[IPSW]] in Pwned [[DFU Mode]] for any version that is available to that particular device. Notable devices vulnerable to untethered bootrom exploits are the [[iPhone 3GS]] and [[iPod touch (2nd generation)]]. The [[limera1n Exploit]] is able to provide a [[Tethered Downgrade|tethered downgrade]] for vulnerable devices.

Since various exploits, such as the [[limera1n Exploit]], are fixed in the [[bootrom]] since version [[Bootrom 838.3]] and because iOS versions 5.0 and above includes a [[nonce]] in their SHSH hashes, downgrading newer devices is not as simple. Blobs must be stitched into a custom firmware, and restored to in Pwned [[DFU Mode]].

Blobs can be saved with tools such as [[iFaith]] and [[TinyUmbrella]]. Firmwares can be stitched using [[iFaith]], [[redsn0w]] or [[sn0wbreeze]].

Newer methods such as [[Odysseus]], [[Prometheus]] or [[iDeviceReRestore]] are used now because other tools have become outdated and newer versions of [[iTunes]] prevents restores to custom versions.

==Timeline==
As noted above, the original [[M68AP|iPhone]] and [[N45AP|iPod touch]] didn't use SHSH blobs. iPhone OS 1.x and 2.x didn't use SHSH blobs either. iPhone 3G and iPod touch (2nd generation) both used SHSH blobs on iOS 4,<ref>http://jaxov.com/2010/07/why-save-iphone-3g-ipod-touch-2g-shsh-blobs/</ref> but following the re-opening on 10 January 2018, all versions (excluding betas) that they ever ran can now be freely installed.

=== iOS ===
{| class="wikitable"
|-
! Firmware
! For Device(s)
! From
! Until
! Status
|-
| 11.2.2
| rowspan="6" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N102AP|iPod touch (6th generation)]]
| {{date|2018|01|08}}
| -
| {{yes|Open}}
|-
| 11.2.1
| {{date|2017|12|13}}
| -
| {{yes|Open}}
|-
| 11.2
| {{date|2017|12|02}}
| -
| {{yes|Open}}
|-
| 11.1.2
| {{date|2017|11|16}}
| {{date|2017|12|15}}
| {{no|Closed}}
|-
| 11.1.1
| {{date|2017|11|09}}
| {{date|2017|12|15}}
| {{no|Closed}}
|-
| 11.1
| {{date|2017|10|31}}
| {{date|2017|12|05}}
| {{no|Closed}}
|-
| 11.0.3
| rowspan="2" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[N102AP|iPod touch (6th generation)]]
| {{date|2017|10|11}}
| {{date|2017|11|28}}
| {{no|Closed}}
|-
| 11.0.2
| {{date|2017|10|03}}
| {{date|2017|11|16}}
| {{no|Closed}}
|-
| rowspan="2" | 11.0.1
| [[iPhone 8]], [[iPhone 8 Plus]]
| rowspan="2" | {{date|2017|09|26}}
| {{date|2017|12|15}}
| {{no|Closed}}
|-
| rowspan="2" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]
| {{date|2017|11|16}}
| {{no|Closed}}
|-
| 11.0
| {{date|2017|09|19}}
| {{date|2017|10|04}}
| {{no|Closed}}
|-
| rowspan="3" | 10.3.3
| [[iPhone 6s]]
| {{date|2017|10|05}}
| {{date|2017|11|16}}
| {{no|Closed}}
|-
| [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]
| {{date|2017|07|19}}
| {{date|2017|10|04}}
| {{no|Closed}}
|-
| [[iPad (4th generation)]], [[iPhone 5]], [[iPhone 5c]]
| {{date|2017|07|19}}
| -
| {{yes|Open}}
|-
| rowspan="2" | 10.3.2
| [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]]
| {{date|2017|06|05}}
| {{date|2017|08|09}}
| {{no|Closed}}
|-
| rowspan="3" | [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]
| {{date|2017|05|15}}
| {{date|2017|08|09}}
| {{no|Closed}}
|-
| 10.3.1
| {{date|2017|04|03}}
| {{date|2017|06|27}}
| {{no|Closed}}
|-
| 10.3
| {{date|2017|03|27}}
| {{date|2017|04|10}}
| {{no|Closed}}
|-
| 10.2.1
| rowspan="5" | [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]
| {{date|2017|01|23}}
| {{date|2017|04|10}}
| {{no|Closed}}
|-
| 10.2
| {{date|2016|12|12}}
| {{date|2017|01|30}}
| {{no|Closed}}
|-
| 10.1.1 (14B150)
| {{date|2016|11|09}}
| {{date|2016|12|20}}
| {{no|Closed}}
|-
| 10.1.1 (14B100)
| {{date|2016|10|31}}
| {{date|2016|12|20}}
| {{no|Closed}}
|-
| 10.1
| {{date|2016|10|24}}
| {{date|2016|12|20}}
| {{no|Closed}}
|-
| 10.0.3
| [[iPhone 7]], [[iPhone 7 Plus]]
| {{date|2016|10|17}}
| {{date|2016|10|31}}
| {{no|Closed}}
|-
| 10.0.2
| rowspan="2" | [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]
| {{date|2016|09|23}}
| {{date|2016|10|31}}
| {{no|Closed}}
|-
| 10.0.1
| {{date|2016|09|13}}
| {{date|2016|10|18}}
| {{no|Closed}}
|-
| rowspan="2 | 9.3.5
| [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[N102AP|iPod touch (6th generation)]]
| rowspan="2 | {{date|2016|08|25}}
| {{date|2016|10|18}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad mini]], [[N94AP|iPhone 4S]], [[iPod touch (5th generation)]]
| -
| {{yes|Open}}
|-
| 9.3.4
| rowspan="2" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2016|08|04}}
| {{date|2016|09|07}}
| {{no|Closed}}
|-
| 9.3.3
| {{date|2016|07|18}}
| {{date|2016|08|24}}
| {{no|Closed}}
|-
| 9.3.2 (13F72)
| [[iPad Pro (9.7-inch)]]
| {{date|2016|06|02}}
| {{date|2016|08|24}}
| {{no|Closed}}
|-
| rowspan="2" | 9.3.2 (13F69)
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[J128AP|iPad Pro (iPad6,4)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| rowspan="2" | {{date|2016|05|16}}
| {{date|2016|08|24}}
| {{no|Closed}}
|-
| [[J127AP|iPad Pro (iPad6,3)]]
| {{date|2016|05|26}}
| {{no|Closed}}
|-
| 9.3.1
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2016|03|31}}
| {{date|2016|06|10}}
| {{no|Closed}}
|-
| 9.3 (13E237)
| [[K93AP|iPad 2 (iPad2,1)]], [[K95AP|iPad 2 (iPad2,3)]], [[K93AAP|iPad 2 (iPad2,4)]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]
| {{date|2016|03|28}}
| rowspan="2" | {{date|2016|04|22}}
| {{no|Closed}}
|-
| 9.3 (13E236)
| [[K94AP|iPad 2 (iPad2,2)]]
| {{date|2016|03|25}}
| {{no|Closed}}
|-
| 9.3 (13E234)
| [[iPad Pro (9.7-inch)]]
| rowspan="3" | {{date|2016|03|21}}
| rowspan="2" | {{date|2016|04|18}}
| {{no|Closed}}
|-
| rowspan="2" | 9.3 (13E233)
| [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini 3]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[N102AP|iPod touch (6th generation)]]
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]
| {{date|2016|03|24}}
| {{no|Closed}}
|-
| 9.2.1 (13D20)
| [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini 3]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]]
| {{date|2016|02|18}}
| {{date|2016|04|05}}
| {{no|Closed}}
|-
| 9.2.1 (13D15)
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2016|01|19}}
| {{date|2016|04|05}}
| {{no|Closed}}
|-
| rowspan="2" | 9.2
| [[K93AAP|iPad 2 (iPad2,4)]], [[J1AP|iPad (3rd generation) (iPad3,1)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| rowspan="2" | {{date|2015|12|08}}
| {{date|2016|02|05}}
| {{no|Closed}}
|-
| [[K93AP|iPad 2 (iPad2,1)]], [[K94AP|iPad 2 (iPad2,2)]], [[K95AP|iPad 2 (iPad2,3)]], [[J2AP|iPad (3rd generation) (iPad3,2)]], [[J2AAP|iPad (3rd generation) (iPad3,3)]], [[N94AP|iPhone 4S]]
| {{date|2016|02|04}}
| {{no|Closed}}
|-
| 9.1 (13B144)
| [[iPad Pro (12.9-inch)]]
| {{date|2015|11|17}}
| rowspan="2" | {{date|2015|12|21}}
| {{no|Closed}}
|-
| rowspan="2" | 9.1 (13B143)
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| rowspan="2" | {{date|2015|10|21}}
| {{no|Closed}}
|-
| [[iPad Pro]]
| {{date|2015|12|02}}
| {{no|Closed}}
|-
| 9.0.2
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2015|09|30}}
| {{date|2015|10|29}}
| {{no|Closed}}
|-
| rowspan="2" | 9.0.1
| [[iPhone 6s]], [[iPhone 6s Plus]]
| {{date|2015|09|24}}
| rowspan="2" | {{date|2015|10|08}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2015|09|23}}
| {{no|Closed}}
|-
| 9.0
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2015|09|16}}
| rowspan="2" | {{date|2015|09|30}}
| {{no|Closed}}
|-
| 8.4.1
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]
| {{date|2015|08|13}}
| {{no|Closed}}
|-
| rowspan="2" | 8.4
| [[N102AP|iPod touch (6th generation)]]
| {{date|2015|07|15}}
| {{date|2015|08|23}}
| {{no|Closed}}
|-
| rowspan="7" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]]
| {{date|2015|06|30}}
| {{date|2015|08|23}}
| {{no|Closed}}
|-
| 8.3
| {{date|2015|04|08}}
| {{date|2015|07|07}}
| {{no|Closed}}
|-
| 8.2
| {{date|2015|03|09}}
| {{date|2015|05|04}}
| {{no|Closed}}
|-
| 8.1.3
| {{date|2015|01|27}}
| {{date|2015|03|23}}
| {{no|Closed}}
|-
| 8.1.2
| {{date|2014|12|09}}
| {{date|2015|02|10}}
| {{no|Closed}}
|-
| 8.1.1
| {{date|2014|11|17}}
| {{date|2014|12|17}}
| {{no|Closed}}
|-
| 8.1
| {{date|2014|10|20}}
| {{date|2014|12|01}}
| {{no|Closed}}
|-
| 8.0.2
| rowspan="3" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]]
| {{date|2014|09|25}}
| {{date|2014|10|20}}
| {{no|Closed}}
|-
| 8.0.1
| {{date|2014|09|24}}
| {{date|2014|09|24}}
| {{no|Closed}}
|-
| 8.0
| {{date|2014|09|17}}
| {{date|2014|10|22}}
| {{no|Closed}}
|-
| rowspan="3" | 7.1.2
| rowspan="2" | [[iPhone 4]]
| {{date|2017|02|13}}
| -
| {{yes|Open}}
|-
| rowspan="2" | {{date|2014|06|30}}
| {{date|2017|02|13}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]
| {{date|2014|09|26}}
| {{no|Closed}}
|-
| 7.1.1
| rowspan="3" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]
| {{date|2014|04|22}}
| {{date|2014|08|12}}
| {{no|Closed}}
|-
| 7.1
| {{date|2014|03|10}}
| {{date|2014|04|30}}
| {{no|Closed}}
|-
| 7.0.6
| {{date|2014|02|21}}
| {{date|2014|03|10}}
| {{no|Closed}}
|-
| 7.0.5
| [[N49AP|iPhone 5c (iPhone5,4)]], [[N53AP|iPhone 5s (iPhone6,2)]]
| {{date|2014|01|29}}
| {{date|2014|02|21}}
| {{no|Closed}}
|-
| 7.0.4
| rowspan="2" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]
| {{date|2013|11|14}}
| {{date|2014|02|21}}
| {{no|Closed}}
|-
| 7.0.3
| {{date|2013|10|22}}
| {{date|2013|11|14}}
| {{no|Closed}}
|-
| rowspan="2" | 7.0.2
| [[P105AP|iPad mini (iPad2,5)]]
| rowspan="2" | {{date|2013|09|26}}
| {{date|2014|02|21}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[P106AP|iPad mini (iPad2,6)]], [[P107AP|iPad mini (iPad2,7)]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]
| {{date|2013|10|29}}
| {{no|Closed}}
|-
| 7.0.1
| [[iPhone 5c]], [[iPhone 5s]]
| {{date|2013|09|18}}
| {{date|2013|10|07}}
| {{no|Closed}}
|-
| 7.0
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPod touch (5th generation)]]
| {{date|2013|09|18}}
| {{date|2013|10|07}}
| {{no|Closed}}
|-
| rowspan="2" | 6.1.6
| rowspan="2" | [[N88AP|iPhone 3GS]], [[N88AP|iPod touch (4th generation)]]
| {{date|2017|02|13}}
| -
| {{yes|Open}}
|-
| {{date|2013|11|24}}
| {{date|2017|02|13}}
| {{no|Closed}}
|-
| 6.1.5
| [[N81AP|iPod touch (4th generation)]]
| {{date|2013|09|24}}
| {{date|2014|02|21}}
| {{no|Closed}}
|-
| 6.1.4
| [[iPhone 5]]
| {{date|2013|05|02}}
| {{date|2013|09|20}}
| {{no|Closed}}
|-
| rowspan="6" | 6.1.3
| [[K93AP|iPad2,1]], [[K94AP|iPad2,2]], [[K95AP|iPad2,3]], [[N94AP|iPhone 4S]]
| {{date|2018|01|10}}
| -
| {{yes|Open}}
|-
| [[N88AP|iPhone 3GS]]
| rowspan="5" | {{date|2013|03|19}}
| {{date|2014|02|21}}
| {{no|Closed}}
|-
| [[N81AP|iPod touch (4th generation)]]
| {{date|2013|11|14}}
| {{no|Closed}}
|-
| [[iPhone 5]]
| {{date|2013|05|02}}
| {{no|Closed}}
|-
| [[P106AP|iPad mini (iPad2,6)]]
| {{date|2013|09|25}}
| {{no|Closed}}
|-
| [[K93AAP|iPad2,4]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[P105AP|iPad mini (iPad2,5)]], [[P107AP|iPad mini (iPad2,7)]], [[iPhone 4]], [[iPod touch (5th generation)]]
| {{date|2013|09|20}}
| {{no|Closed}}
|-
| rowspan="2" | 6.1.2
| [[N78AP|iPod touch (5th generation)]]
| rowspan="2" | {{date|2013|02|19}}
| {{date|2013|03|20}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]] [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]]
| {{date|2013|03|19}}
| {{no|Closed}}
|-
| 6.1.1
| [[N94AP|iPhone 4S]]
| {{date|2013|02|11}}
| {{date|2013|02|19}}
| {{no|Closed}}
|-
| rowspan="2" | 6.1
| [[P106AP|iPad mini (iPad2,6)]], [[N81AP|iPod touch (4th generation)]]
| {{date|2013|01|28}}
| {{date|2013|03|20}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N78AP|iPod touch (5th generation)]]
| {{date|2013|01|28}}
| {{date|2013|02|19}}
| {{no|Closed}}
|-
| rowspan="2" | 6.0.2
| [[P105AP|iPad mini (iPad2,5)]], [[iPhone 5]]
| colspan="2" | {{date|2013|07|26}}
| {{no|Closed}}
|-
| [[iPad mini]], [[iPhone 5]]
| {{date|2012|12|18}}
| {{date|2013|01|28}}
| {{no|Closed}}
|-
| rowspan="4" | 6.0.1
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]
| {{date|2012|11|01}}
| {{date|2013|01|28}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[P101AP|iPad (4th generation) (iPad3,4)]], [[P105AP|iPad mini (iPad2,5)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]
| colspan="2" | {{date|2013|07|26}}
| {{no|Closed}}
|-
| [[iPad mini]]
| {{date|2012|11|01}}
| {{date|2013|01|08}}
| {{no|Closed}}
|-
| [[iPad (4th generation)]], [[iPad mini]]
| {{date|2012|11|09}}
| {{date|2013|01|28}}
| {{no|Closed}}
|-
| rowspan="3" | 6.0
| [[P101AP|iPad (4th generation) (iPad3,4)]], [[P105AP|iPad mini (iPad2,5)]]
| {{date|2012|10|30}}
| {{date|2012|11|01}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[P105AP|iPad mini (iPad2,5)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]
| colspan="2" | {{date|2013|07|26}}
| {{no|Closed}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]
| {{date|2012|09|19}}
| {{date|2012|11|01}}
| {{no|Closed}}
|-
| 5.1.1 (9B208)
| [[N90AP|iPhone 4 (iPhone3,1)]]
| {{date|2012|05|25}}
| {{date|2012|09|21}}
| {{no|Closed}}
|-
| rowspan="4" | 5.1.1 (9B206)
| rowspan="2" |[[K48AP|iPad]]
| {{date|2017|02|13}}
| -
| {{yes|Open}}
|-
| rowspan="3" | {{date|2012|05|07}}
| {{date|2017|02|13}}
| {{no|Closed}}
|-
| [[N18AP|iPod touch (3rd generation)]]
| -
| {{yes|Open}}
|-
| [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N81AP|iPod touch (4th generation)]]
| {{date|2012|09|21}}
| {{no|Closed}}
|-
| 5.1
| [[K48AP|iPad]], [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]
| {{date|2012|03|07}}
| {{date|2012|05|14}}
| {{no|Closed}}
|-
| 5.0.1
| [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]
| {{date|2011|11|09}}
| {{date|2012|02|08}}
| {{no|Closed}}
|-
| rowspan="2" | 5.0
| [[N94AP|iPhone 4S]]
| {{date|2011|10|14}}
| {{date|2011|11|10}}(?)
| {{no|Closed}}
|-
| [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]
| {{date|2011|10|04}}
| {{date|2011|11|10}}(?)
| {{no|Closed}}
|-
| 4.3.5
| rowspan="6" | [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4(iPhone3,1)]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]
| 25 July 2011
| {{date|2011|10|18}}
| {{no|Closed}}
|-
| 4.3.4
| {{date|2011|07|15}}
| {{date|2011|07|27}}
| {{no|Closed}}
|-
| 4.3.3
| {{date|2011|05|04}}
| {{date|2011|07|18}}
| {{no|Closed}}
|-
| 4.3.2
| {{date|2011|04|14}}
| {{date|2011|05|06}}
| {{no|Closed}}
|-
| 4.3.1
| {{date|2011|03|25}}
| {{date|2011|04|19}} (?)
| {{no|Closed}}
|-
| 4.3
| {{date|2011|03|09}}
| {{date|2011|03|27}} (?)
| {{no|Closed}}
|-
| 4.2.10
| rowspan="5" | [[N92AP|iPhone 4 (iPhone3,3)]]
| {{date|2011|07|25}}
| {{date|2011|10|18}}
| {{no|Closed}}
|-
| 4.2.9
| {{date|2011|07|15}}
| {{date|2011|07|27}}
| {{no|Closed}}
|-
| 4.2.8
| {{date|2011|05|04}}
| {{date|2011|07|18}}
| {{no|Closed}}
|-
| 4.2.7
| {{date|2011|04|14}}
| {{date|2011|05|06}}
| {{no|Closed}}
|-
| 4.2.6
| {{date|2011|02|01}}
| {{date|2011|04|19}} (?)
| {{no|Closed}}
|-
| rowspan="2" | 4.2.1
| [[N82AP|iPhone 3G]], [[N72AP|iPod touch (2nd generation)]]
| rowspan="2" | {{date|2010|11|22}}
| -
| {{yes|Open}}
|-
| [[K48AP|iPad]], [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]
| {{date|2011|03|11}}
| {{no|Closed}}
|-
| 4.1 (8B118)
| [[N81AP|iPod touch (4th generation)]]
| {{date|2010|09|21}}
| {{date|2010|12|02}} (?)
| {{no|Closed}}
|-
| rowspan="4" | 4.1 (8B117)
| [[N72AP|iPod touch (2nd generation)]], [[N18AP|iPod touch (3rd generation)]]
| {{date|2010|09|08}}
| rowspan="2" | -
| {{yes|Open}}
|-
| rowspan="2" | [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]]
| {{date|2017|02|13}}
| {{yes|Open}}
|-
| rowspan="2" | {{date|2010|09|08}}
| {{date|2017|02|13}}
| {{no|Closed}}
|-
| [[N90AP|iPhone 4 (iPhone3,1)]], [[N81AP|iPod touch (4th generation)]]
| {{date|2010|12|02}} (?)
| {{no|Closed}}
|-
| rowspan="3" | 4.0.2
| [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]], [[N18AP|iPod touch (3rd generation)]]
| {{date|2010|08|11}}
| {{date|2010|09|09}}
| {{no|Closed}}
|-
| rowspan="2" | [[N82AP|iPhone 3G]], [[N72AP|iPod touch (2nd generation)]]
| {{date|2018|01|10}}
| -
| {{yes|Open}}
|-
| {{date|2010|08|11}}
| {{date|2010|09|18}}
| {{no|Closed}}
|-
| rowspan="3" | 4.0.1
| rowspan="2" | [[N82AP|iPhone 3G]]
| {{date|2018|01|10}}
| -
| {{yes|Open}}
|-
| {{date|2010|07|15}}
| {{date|2010|09|09}}
| {{no|Closed}}
|-
| [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]]
| {{date|2010|07|15}}
| {{date|2010|08|19}}
| {{no|Closed}}
|-
| rowspan="6" | 4.0
| [[N72AP|iPod touch (2nd generation)]], [[N82AP|iPhone 3G]]
| {{date|2018|01|10}}
| -
| {{yes|Open}}
|-
| [[N18AP|iPod touch (3rd generation)]]
| {{date|2010|06|21}}
| {{date|2010|08|09}}
| {{no|Closed}}
|-
| [[N72AP|iPod touch (2nd generation)]]
| {{date|2010|06|21}}
| {{date|2010|09|09}}
| {{no|Closed}}
|-
| [[N82AP|iPhone 3G]]
| {{date|2010|06|21}}
| {{date|2010|07|15}}
| {{no|Closed}}
|-
| [[N88AP|iPhone 3GS]]
| {{date|2010|06|21}}
| {{date|2010|07|15}}
| {{no|Closed}}
|-
| [[N90AP|iPhone 4 (iPhone3,1)]]
| {{date|2010|06|24}}
| {{date|2010|07|15}}
| {{no|Closed}}
|-
| 3.2.2
| rowspan="3" | [[K48AP|iPad]]
| {{date|2010|08|11}}
| {{date|2010|12|02}} (?)
| {{no|Closed}}
|-
| 3.2.1
| {{date|2010|07|15}}
| {{date|2010|08|19}}
| {{no|Closed}}
|-
| 3.2
| {{date|2010|04|03}}
| {{date|2010|07|15}}
| {{no|Closed}}
|-
| 3.1.3
| [[N88AP|iPhone 3GS]], [[N72AP|iPod touch (2nd generation)]], [[N18AP|iPod touch (3rd generation)]]
| {{date|2010|02|02}}
| {{date|2010|06|21}}
| {{no|Closed}}
|-
| rowspan="2" | 3.1.2
| [[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]]
| {{date|2009|10|08}}
| {{date|2010|02|02}}
| {{no|Closed}}
|-
| [[N72AP|iPod touch (2nd generation)]]
| {{date|2009|10|08}}
| {{date|2010|06|21}}
| {{no|Closed}}
|-
| 3.1.1 (7C146)
| rowspan="2" | [[N18AP|iPod touch (3rd generation)]]
| {{date|2009|09|17}}
| {{date|2009|10|08}} (?)
| {{no|Closed}}
|-
| rowspan="2" | 3.1.1 (7C145)
| {{date|2009|09|09}}
| {{date|2009|10|08}}
| {{no|Closed}}
|-
| [[N72AP|iPod touch (2nd generation)]]
| {{date|2009|09|09}}
| {{date|2010|06|21}}
| {{no|Closed}}
|-
| 3.1
| rowspan="3" | [[N88AP|iPhone 3GS]]
| {{date|2009|09|09}}
| {{date|2009|10|08}}
| {{no|Closed}}
|-
| 3.0.1
| {{date|2009|07|31}}
| rowspan="2" | {{date|2009|09|09}}
| {{no|Closed}}
|-
| 3.0
| {{date|2009|06|19}}
| {{no|Closed}}
|}

=== Apple TV ===
{| class="wikitable"
|-
! Marketing Version
! OS Version
! For Device(s)
! From
! Until
! Status
|-
| rowspan="18" {{n/a}}
| 11.2.1
| rowspan="4" | [[J42dAP|Apple TV (4th generation)]], [[Apple TV 4K]]
| {{date|2017|12|13}}
| -
| rowspan="2" {{yes|Open}}
|-
| 11.2
| {{date|2017|12|02}}
| -
|-
| 11.1
| {{date|2017|10|31}}
| {{date|2017|12|15}}
| {{no|Closed}}
|-
| 11.0
| {{date|2017|09|19}}
| {{date|2017|12|15}}
| {{no|Closed}}
|-
| 10.2.2
| rowspan="14" | [[J42dAP|Apple TV (4th generation)]]
| {{date|2017|07|19}}
| -
| {{yes|Open}}
|-
| 10.2.1
| {{date|2017|05|15}}
| {{date|2017|08|09}}
| {{no|Closed}}
|-
| 10.2
| {{date|2017|03|27}}
| {{date|2017|06|27}}
| {{no|Closed}}
|-
| 10.1.1
| {{date|2017|01|23}}
| {{date|2017|04|10}}
| {{no|Closed}}
|-
| 10.1
| {{date|2016|12|12}}
| {{date|2017|01|30}}
| {{no|Closed}}
|-
| 10.0.1
| {{date|2016|10|24}}
| {{date|2017|01|30}}
| {{no|Closed}}
|-
| 10.0
| {{date|2016|09|13}}
| {{date|2016|10|31}}
| {{no|Closed}}
|-
| 9.2.2
| {{date|2016|07|18}}
| {{date|2016|10|18}}
| {{no|Closed}}
|-
| 9.2.1
| {{date|2016|05|16}}
| {{date|2016|09|23}}
| {{no|Closed}}
|-
| 9.2
| {{date|2016|03|21}}
| {{date|2016|06|10}}
| {{no|Closed}}
|-
| 9.1.1
| {{date|2016|01|25}}
| {{date|2016|04|05}}
| {{no|Closed}}
|-
| 9.1
| {{date|2015|12|08}}
| {{date|2016|02|04}}
| {{no|Closed}}
|-
| 9.0.1
| {{date|2015|11|09}}
| {{date|2015|12|21}}
| {{no|Closed}}
|-
| 9.0
| {{date|2015|10|29}}
| {{date|2015|12|14}}
| {{no|Closed}}
|-
| 7.2.2
| 8.4.2
| rowspan="8" | [[Apple TV (3rd generation)]]
| {{date|2016|12|12}}
| -
| {{yes|Open}}
|-
| 7.2.1
| 8.4.1
| {{date|2016|02|25}}
| {{date|2016|12|20}}
| {{no|Closed}}
|-
| 7.2
| 8.3
| {{date|2015|04|08}}
| {{date|2016|04|07}}
| {{no|Closed}}
|-
| 7.1
| 8.2
| {{date|2015|03|09}}
| {{date|2015|05|04}}
| {{no|Closed}}
|-
| 7.0.3
| 8.1.3
| {{date|2015|01|27}}
| {{date|2015|03|23}}
| {{no|Closed}}
|-
| 7.0.2
| 8.1.1
| {{date|2014|11|17}}
| {{date|2015|04|01}}
| {{no|Closed}}
|-
| 7.0.1
| 8.1
| {{date|2014|10|20}}
| {{date|2014|12|01}}
| {{no|Closed}}
|-
| 7.0
| 8.0
| {{date|2014|09|17}}
| {{date|2014|10|22}}
| {{no|Closed}}
|-
| rowspan="2" | 6.2.1
| rowspan="3" | 7.1.2
| rowspan="2" | [[K66AP|Apple TV (2nd generation)]]
| {{date|2017|02|13}}
| -
| {{yes|Open}}
|-
| {{date|2014|09|17}}
| {{date|2017|02|13}}
| {{no|Closed}}
|-
| 6.2
| rowspan="8" | [[K66AP|Apple TV (2nd generation)]], [[Apple TV (3rd generation)]]
| {{date|2014|06|30}}
| {{date|2014|09|26}}
| {{no|Closed}}
|-
| 6.1.1
| 7.1.1
| {{date|2014|04|22}}
| {{date|2014|07|11}}
| {{no|Closed}}
|-
| 6.1
| 7.1
| {{date|2014|03|10}}
| {{date|2014|04|30}}
| {{no|Closed}}
|-
| rowspan="2" | 6.0.2
| 7.0.6
| {{date|2014|02|21}}
| {{date|2014|03|10}}
| {{no|Closed}}
|-
| 7.0.4
| {{date|2013|11|14}}
| {{date|2014|02|21}}
| {{no|Closed}}
|-
| 6.0.1
| 7.0.3
| {{date|2013|10|24}}
| {{date|2013|11|14}}
| {{no|Closed}}
|-
| rowspan="2" | 6.0
| 7.0.2
| {{date|2013|09|24}}
| {{date|2013|10|29}}
| {{no|Closed}}
|-
| 7.0.1
| {{date|2013|09|20}}
| {{date|2013|09|24}}
| {{no|Closed}}
|-
| rowspan="3" | 5.3
| rowspan="3" | 6.1.4
| [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]
| {{date|2013|06|19}}
| {{date|2013|09|21}}
| {{no|Closed}}
|-
| rowspan="2" | [[K66AP|Apple TV (2nd generation)]], [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]
| {{date|2017|02|13}}
| -
| {{yes|Open}}
|-
| {{date|2013|06|19}}
| {{date|2017|02|13}}
| {{no|Closed}}
|-
| 5.2.1
| 6.1.3
| rowspan="2" | [[K66AP|Apple TV (2nd generation)]], [[Apple TV (3rd generation)]]
| {{date|2013|03|19}}
| {{date|2013|06|20}}
| {{no|Closed}}
|-
| 5.2
| 6.1
| {{date|2013|01|28}}
| {{date|2013|03|20}}
| {{no|Closed}}
|-
| 5.1.1
| 6.0.1
| rowspan="5" | [[K66AP|Apple TV (2nd generation)]], [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]
| {{date|2012|11|26}}
| {{date|2013|03|20}}
| {{no|Closed}}
|-
| 5.1
| 6.0
| {{date|2012|09|24}}
| {{date|2013|03|20}}
| {{no|Closed}}
|-
| 5.0.2
| rowspan="2" | 5.1.1
| {{date|2012|06|05}}
| {{date|2013|03|20}}
| {{no|Closed}}
|-
| 5.0.1
| {{date|2012|05|10}}
| {{date|2012|7}} (day unknown)
| {{no|Closed}}
|-
| 5.0
| 5.1
| {{date|2012|03|07}}
| {{date|2012|05|14}}
| {{no|Closed}}
|-
| 4.4.4
| rowspan="2" | 5.0.1
| rowspan="12" | [[K66AP|Apple TV (2nd generation)]]
| {{date|2011|12|15}}
| {{date|2012|03|08}}
| {{no|Closed}}
|-
| 4.4.3
| {{date|2011|11|17}}
| {{date|2012|01|11}}(?)
| {{no|Closed}}
|-
| 4.4.2
| rowspan="3" | 5.0
| {{date|2011|10|24}}
| {{date|2012|01|11}}(?)
| {{no|Closed}}
|-
| 4.4.1
| {{date|2011|10|17}}
| ?
| {{no|Closed}}
|-
| 4.4
| {{date|2011|10|04}}
| ?
| {{no|Closed}}
|-
| colspan="2" | 4.3
| {{date|2011|03|09}}
| ?
| {{no|Closed}}
|-
| 4.2.2
| rowspan="3" | 4.3
| {{date|2011|05|11}}
| {{date|2011|10|18}} (?)
| {{no|Closed}}
|-
| 4.2.1
| {{date|2011|03|22}}
| {{date|2011|05|28}} (?)
| {{no|Closed}}
|-
| 4.2
| {{date|2011|03|09}}
| {{date|2011|03|22}} (?)
| {{no|Closed}}
|-
| 4.1.1
| 4.2.1
| {{date|2010|12|14}}
| {{date|2011|05|28}} (?)
| {{no|Closed}}
|-
| 4.1
| 4.2
| {{date|2010|11|22}}
| {{date|2010|12|14}}
| {{no|Closed}}
|-
| 4.0
| 4.1
| {{date|2010|09|29}}
| {{date|2010|12|02}} (?)
| {{no|Closed}}
|}

== Protocol ==
To request a SHSH blob from Apple, a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] request can be made. For a full description, see the separate articles [[SHSH Protocol]] and [[Baseband SHSH Protocol]].

== See Also ==
* [[APTicket]]
* [[Redsn0w]]
* [[iFaith]]
* [[TinyUmbrella]]

== References ==
<references />

== External Links ==
* [http://www.saurik.com/id/12 Detailed background info from Saurik]
* [https://github.com/tihmstar/tsschecker tsschecker]
* [https://github.com/Neal/savethemblobs savethemblobs]

[[Category:Firmware Tags]]

User talk:JonathanSeals

2018-01-02T06:36:58Z

Gjest: /* Regarding the CoolBooter article */

== Regarding the [[CoolBooter]] article ==
Hi!

In [https://www.theiphonewiki.com/w/index.php?title=CoolBooter&diff=65847&oldid=65846 this edit] you changed ''«'''The secondary OS''' will kernel panic during boot»'' to ''«'''iOS 6 as a secondary OS''' will kernel panic during boot''». IIRC, you told me on Reddit that you don’t have any iPhone 5 test devices, so I wonder: Is iOS 6 the only secondary OS to which you have confirmed that this happens, or is this something that was fixed in a recent update? I have installed various iOS 7.x and 8.x versions as secondary versions using CoolBooterCLI on my i5 running iOS 6, and they have all kernel panicked if the Lightning cable has been attached since I booted the host OS. I must stress that the last time I installed anything was back in October, so later updates could of course have fixed this issue for newer target versions.

[[User:Gjest|Gjest]] ([[User talk:Gjest|talk]]) 03:08, 28 December 2017 (UTC)

I have no clue how proper responses work with this, so sorry for probably not doing this the correct way. I don't currently have an iPhone 5 test device as I am currently loaning mine to a friend. When I did still have it, I confirmed that, at least as of iOS 9.0.2 as a main OS, only iOS 6 will panic upon booting if lightning was attached prior without rebooting. There were some issues with kernel patches in some older versions that caused a panic on boot for some devices (I refactored the patchfinder quite a few times over the updates), however those should now be fixed. I will ask some friends with a 5 to double check this though.

--[[User:JonathanSeals|JonathanSeals]] ([[User talk:JonathanSeals|talk]]) 15:57, 29 December 2017 (UTC)

: I did a fresh restore to iOS 6.1.4 and installed 8.4 through CoolBooterCLI 0.8.4 without using the backup file that I had created before restoring. CoolBooter booted up 8.4 without problems when I rebooted first, but 8.4 kernel panicked when I plugged in the cable for a short second before launching CoolBooter. I don’t know exactly why this happens, but I have discovered that some things seem to “leak” between the two versions installed. Other examples include:
:# I got LTE service running installing 9.0.2->6.0 through CoolBooter, but not after downgrading to 6.1.4 as my primary OS. There was still no LTE when booting 6.1.4->6.0, but I got LTE service in 8.4 when I installed that instead. To my surprise, that persisted, giving me LTE service in my main OS (6.1.4) for the first time since downgrading (some 4-5 months earlier). After restoring to 10.3.3 and then back to 6.1.4, LTE was missing again. After installing 8.4 through CoolBooter the next day, it came back once again. At least one other user on Reddit told me that he got LTE service back this way.
:# When I ran 9.0.2->6.0 and booted back into the primary OS, the screen went black before the it lit up again with the Apple logo, which was what happened when I rebooted 9.0.2 too. Now that I run 6.1.4->8.4, however, a spinning wheel is shown before the screen goes black, which is exactly what happens when I reboot 6.1.4 and ''not'' what happened when I rebooted 8.4 when running that. Whether the spinning wheel is shown ''before'' the device reboots thus appears to depend on the primary OS version, not the secondary version (I know that it’s before, since the same happens when using the <code>halt</code> command to shutdown instead of rebooting).

: I hope you don’t mind if I update the article so that it mentions combinations involving iOS 6 rather than just iOS 6 targets. I would gladly send you boot logs if you tell me where to find them.

: PS. I think I read somewhere that you now have Trevor Schmitt on board as a developer. If you can confirm this, I’ll add his name to the infobox.

: [[User:Gjest|Gjest]] ([[User talk:Gjest|talk]]) 06:36, 2 January 2018 (UTC)

User talk:JonathanSeals

2017-12-28T03:08:38Z

Gjest: Created page with "== Regarding the CoolBooter article == Hi! In [https://www.theiphonewiki.com/w/index.php?title=CoolBooter&diff=65847&oldid=65846 this edit] you changed ''«'''The second..."

CoolBooter

2017-12-27T02:40:20Z

Gjest: CLI version note, usage notes and version change logs ++

{{infobox software
| name = CoolBooter
| title = CoolBooter
| author = [[User:JonathanSeals|Jonathan Seals]]
| developer = [[User:JonathanSeals|Jonathan Seals]]
| discontinued =
| released = {{start date and age|2016|12|25}}
| latest release version = 1.2.4
| latest release date = {{Start date and age|2017|10|25|df=yes}}
| operating system = [[wikipedia:IOS|iOS]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Utilities
| license = [[wikipedia:Freeware|Freeware]]
| website = [https://coolbooter.com CoolBooter]
}}
'''CoolBooter''' is a tool for dual booting jailbroken 32-bit iOS devices with another copy of iOS via winocm's [[ios-kexec-utils]]. It supports hosts running iOS 7.0 or higher and can boot versions ranging from 5.0 to 8.4.1. Hosts on lower versions can install the [[#CoolBooterCLI|CLI version]] instead.

== Usage notes ==

* During setup, the user can choose to jailbreak the secondary operating system and/or activate verbose boot. iOS 8.x will automatically be jailbroken, as there will be issues if it is not.<ref>[https://twitter.com/Thmitt/status/941474872261214208 @Thmitt: there were some issues with 8.x if it wasn’t jailbroken]</ref>

* Hosts running iOS 9.0 or higher experienced issues with data protection, meaning that apps such as YouTube, WhatsApp and Mail would not work on the secondary OS. Experimental protected volume support was added later to work around these issues.

* Like regular installations of iOS, dual booted systems must be activated. [[A6]] devices that have ever been on iOS 10 and then downgraded have failed activation since July, 2017, first randomly, then consistently. To activate the dual booted partition on these devices, activation records can be copied to <code>/var/root/Library/Lockdown</code> from the host OS. Another option is to delete <code>/Applications/Setup.app</code>, also done from the host OS.

* The secondary OS will kernel panic during boot on A6 devices if the Lightning cable is plugged in, or has been since the device was booted into the host OS. To fix the issue, unplug the cable and reboot before launching CoolBooter.

* The secondary OS uses the same lock screen code as the host OS

* CoolBooter uses a [[kloader]] version that depends on [[tfp0]] and version 1.2.4 (APP) / 0.8.4 (CLI) and these versions are thus incompatible with the [[h3lix]] jailbreak for iOS 10.x. The problems can be worked around by replacing the multi_kloader binary with one compiled to use [[hgsp4]] instead of [[tfp0]]. Way Out 1.6.1 already uses the new binary and can be used to boot the secondary OS installed by CoolBooter.

== Version Change Log ==
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| 1.0b1
| 25 December, 2017
| initial release
|-
| 1.0b2
| 25 December, 2017
| fixed a small mistake in the booting process
|-
| 1.0b3
| 26 December, 2017
| 7.x support temporarily dropped due to activation issues
|-
| 1.0b4
| 27 December, 2017
| Solved partitioning issues
|-
| 1.0b5
| 28 December, 2017
| Adds a warning to reboot after installation
|-
| 1.0b6
| 18 April, 2017
| Includes fixes for low capacities as well as many performance improvements
|-
| 1.0b7
| 9 May, 2017
| Adds backup and restore and improves reliability on older firmwares
|-
| 1.0b8
| 4 June, 2017
| Fewer bootloops, maybe no more bootloops?
|-
| 1.0b9
| 5 June, 2017
| Including better iOS 7 support
|-
| 1.0b10
| 14 June, 2017
| iPhone 4s is now fully supported
|-
| 1.0b11
| 20 June, 2017
| Adds a custom data partition size option
|-
| 1.0b12
| 21 July, 2017
| Added S5L8942 device (iPadMini 1, iPod5, iPad2,4) support (thanks to @axi0mX)
|-
| 1.0.1
| 9 August, 2017
| Fixes for the iPad2,4, iPod5,1, as well as bootlogo support (thanks to @nyan_satan)
|-
| 1.0.2
| 27 August, 2017
| Experimental protected volume support for iOS 9+ main OS users
|-
| 1.1
| 11 September, 2017
| iOS 8.0–8.4.1 target OS support
|-
| 1.1.1
| 12 September, 2017
| Bug fixes for iPad mini 1 as well as for iOS 9 main OS users
|-
| 1.2
| 24 September, 2017
| iOS 5.x support, and stability improvements for A5 devices
|-
| 1.2.2
| 29 September, 2017
| iOS 8.x bootlogo support, fixed 5.1 targets for iPhone 4S, fixed issues with devices not continuing past Apple logo (iOS 7 and lower) or booting back into host OS
|-
| 1.2.3
| 3 October, 2017
| Fixes iPhone 4S and iPod Touch 5G iOS 6 support, iPhone 4S iOS 5.1.x support (including baseband), inability to allocate more than 6 GB of space to iOS 5.x
|-
| 1.2.4
| 25 October, 2017
| General performance improvements, automatic detection of iPhone 4S units that cannot run iOS 5
|}

== CoolBooterCLI ==
{{infobox software
| name = CoolBooterCLI
| title = CoolBooterCLI
| author = [[User:JonathanSeals|Jonathan Seals]]
| developer = [[User:JonathanSeals|Jonathan Seals]]
| discontinued =
| released = {{start date and age|2017|03|09}}
| latest release version = 0.8.4
| latest release date = {{Start date and age|2017|10|25|df=yes}}
| operating system = [[wikipedia:IOS|iOS]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Utilities
| license = [[wikipedia:Freeware|Freeware]]
| website = [https://coolbooter.com CoolBooter]
}}
A command line interface version called '''CoolBooterCLI''' is offered as a separate package in Cydia. Originally requiring iOS 6.0 or higher, it now runs on iOS 5.x as well.

Starting CoolBooterCLI from MTerminal using the command <code>coolbootercli -b</code> fails on devices running older iOS versions. This issue can be solved by starting CoolBooterCLI via SSH instead (<code>ssh root@localhost</code>) or by using the Way Out GUI app.

=== Version Change Log ===
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| 0.1.4
| 9 March, 2017
| Initial release, supports hosts on 6.0 and higher, targets 6.0–7.1.2 on same devices as before
|-
| 0.3
| 18 April, 2017
| Adds support for iOS 5 hosts and targets, iPod 4G, iPhone 3GS, iPad 1, low capacity improvements
|-
| 0.6
| 17 June, 2017
| iPhone 4S support, more stability, and a custom data partition size option
|-
| 0.8.2
| 29 September, 2017
| Added support for S5L8942 devices, support for 5.x and 8.x targets, experimental protected volume support for hosts on iOS 9 or later going to iOS 7 or lower (use option --use-dpw), protected volume support for all devices running iOS 8 or lower, bootlogo support for all target versions
|-
| 0.8.3
| 3 October, 2017
| Fixes iPhone 4S and iPod Touch 5G iOS 6 support, iPhone 4S iOS 5.1.x support (including baseband), inability to allocate more than 6 GB of space to iOS 5.x
|-
| 0.8.4
| 25 October, 2017
| General performance improvements, automatic detection of iPhone 4S units that cannot run iOS 5
|}

== External Links ==
* [https://coolbooter.com/ Official website and Cydia repository]
* @[https://twitter.com/coolbooter CoolBooter] on Twitter

== References ==
<references />

Tfp0 patch

2017-12-26T21:36:54Z

Gjest: /* Jailbreaks lacking tfp0 */ link fix

{{DISPLAYTITLE:tfp0 patch}}
In the XNU kernel, <code>task_for_pid</code> is a function that allows a (privileged) process to get the task port of another process on the same host, except the kernel task (process ID 0). A '''tfp0 patch''' (or '''task_for_pid(0) patch''') removes this restriction, allowing any executable running as root to call '''task_for_pid''' for pid '''0''' (hence the name) and then use <code>vm_read</code> and <code>vm_write</code> to modify the kernel VM region. The entitlements ''get-task-allow'' and ''task_for_pid-allow'' are required to make [[AMFI]] happy.

== Example code ==
The following C program calls <code>task_for_pid</code> and returns the error code:

#include <mach/mach.h>

// Compile and fakesign with entitlements (on-device; LLVM+Clang and ldid must be installed):
// cc -o tfp0 tfp0.c && ldid -Stfp0.plist tfp0

int main(void) {
mach_port_t kernel_task = 0;
return task_for_pid(mach_task_self(), 0, &kernel_task);
}

The returned error code, which can be checked using <code>echo $?</code> in bash after running the test program, will be 0 if the call succeeded. If it did not, a positive number, e.g. 5 (KERN_FAILURE), is returned instead (see <code>kern_return.h</code> for possible values). The entitlements plist (named <code>tfp0.plist</code> in this example) for [[ldid]] can look like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<nowiki>http://www.apple.com/DTDs/PropertyList-1.0.dtd</nowiki>">
<plist version="1.0">
<dict>
<key>get-task-allow</key>
<true/>
<key>run-unsigned-code</key>
<true/>
<key>task_for_pid-allow</key>
<true/>
</dict>
</plist>

== tfp0 enabled jailbreaks ==
Jailbreaks known to enable tfp0 include:
* [[Absinthe]] (5.1.1)
* [[evasi0n]] (6.0–6.1.2)
* [[p0sixspwn]] (6.1.3–6.1.6)
* [[evasi0n7]] (7.0–7.0.6)
* [[Pangu]] v0.3 (7.1–7.1.2)
* [[Pangu8]] v0.5 (8.0–8.1)
* [[TaiG]] (8.0–8.4)
* [[Pangu9]] (9.0–9.0.2) on 32-bit
* [[Home Depot]] (9.1–9.3.4) on 32-bit
* [[jbme]] (9.2–9.3.3) on 64-bit
* [[extra_recipe+yaluX]] (10.0–10.1.1) on 64-bit
* [[yalu102]] (10.2) on 64-bit (excluding iPhone 7)

=== Jailbreaks lacking tfp0 ===
The following jailbreaks do ''not'' have tfp0 enabled:
* [[Pangu]] v0.1–0.2 (7.1–7.1.2)
:* Solution: Update to version 0.3 (filename: <code>io.pangu.axe7_0.3_iphoneos-arm.deb</code>)
* [[Pangu8]] v0.1–0.4 (8.0–8.1)
:* Solution: Update to version 0.5 (filename: <code>io.pangu.xuanyuansword8_0.5_iphoneos-arm.deb</code>)
* [[PPJailbreak]] (8.0–8.4)
:* Solution: replace PPJailbreak with TaiG
* [[Pangu9]] (9.0–9.3.3) on 64-bit
:* Solution: use cl0ver by Siguza, or re-jailbreak using jbme (uses the trident exploit chain instead)
* [[yalu + mach_portal]] (10.0–10.1.1) on 64-bit
:* Solution: use extra_recipe+yaluX instead
* [[h3lix]] (10.0–10.3.3) on 32-bit
:* No solution for compiled code, replace <code>task_for_pid(mach_task_self(), 0, &ktask)</code> calls with <code>host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &ktask)</code> if source is available

== See also ==
* [[hgsp4 patch]]

[[Category:Kernel Patches]]

Tfp0 patch

2017-12-26T21:35:19Z

Gjest: /* tfp0 enabled jailbreaks */

{{DISPLAYTITLE:tfp0 patch}}
In the XNU kernel, <code>task_for_pid</code> is a function that allows a (privileged) process to get the task port of another process on the same host, except the kernel task (process ID 0). A '''tfp0 patch''' (or '''task_for_pid(0) patch''') removes this restriction, allowing any executable running as root to call '''task_for_pid''' for pid '''0''' (hence the name) and then use <code>vm_read</code> and <code>vm_write</code> to modify the kernel VM region. The entitlements ''get-task-allow'' and ''task_for_pid-allow'' are required to make [[AMFI]] happy.

== Example code ==
The following C program calls <code>task_for_pid</code> and returns the error code:

#include <mach/mach.h>

// Compile and fakesign with entitlements (on-device; LLVM+Clang and ldid must be installed):
// cc -o tfp0 tfp0.c && ldid -Stfp0.plist tfp0

int main(void) {
mach_port_t kernel_task = 0;
return task_for_pid(mach_task_self(), 0, &kernel_task);
}

The returned error code, which can be checked using <code>echo $?</code> in bash after running the test program, will be 0 if the call succeeded. If it did not, a positive number, e.g. 5 (KERN_FAILURE), is returned instead (see <code>kern_return.h</code> for possible values). The entitlements plist (named <code>tfp0.plist</code> in this example) for [[ldid]] can look like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<nowiki>http://www.apple.com/DTDs/PropertyList-1.0.dtd</nowiki>">
<plist version="1.0">
<dict>
<key>get-task-allow</key>
<true/>
<key>run-unsigned-code</key>
<true/>
<key>task_for_pid-allow</key>
<true/>
</dict>
</plist>

== tfp0 enabled jailbreaks ==
Jailbreaks known to enable tfp0 include:
* [[Absinthe]] (5.1.1)
* [[evasi0n]] (6.0–6.1.2)
* [[p0sixspwn]] (6.1.3–6.1.6)
* [[evasi0n7]] (7.0–7.0.6)
* [[Pangu]] v0.3 (7.1–7.1.2)
* [[Pangu8]] v0.5 (8.0–8.1)
* [[TaiG]] (8.0–8.4)
* [[Pangu9]] (9.0–9.0.2) on 32-bit
* [[Home Depot]] (9.1–9.3.4) on 32-bit
* [[jbme]] (9.2–9.3.3) on 64-bit
* [[extra_recipe+yaluX]] (10.0–10.1.1) on 64-bit
* [[yalu102]] (10.2) on 64-bit (excluding iPhone 7)

=== Jailbreaks lacking tfp0 ===
The following jailbreaks do ''not'' have tfp0 enabled:
* [[Pangu]] v0.1–0.2 (7.1–7.1.2)
:* Solution: Update to version 0.3 (filename: <code>io.pangu.axe7_0.3_iphoneos-arm.deb</code>)
* [[Pangu8]] v0.1–0.4 (8.0–8.1)
:* Solution: Update to version 0.5 (filename: <code>io.pangu.xuanyuansword8_0.5_iphoneos-arm.deb</code>)
* [[PPJailbreak]] (8.0–8.4)
:* Solution: replace PPJailbreak with TaiG
* [[Pangu9]] (9.0–9.3.3) on 64-bit
:* Solution: use cl0ver by Siguza, or re-jailbreak using jbme (uses the trident exploit chain instead)
* [[mach_portal+yalu]] (10.0–10.1.1) on 64-bit
:* Solution: use extra_recipe+yaluX instead
* [[h3lix]] (10.0–10.3.3) on 32-bit
:* No solution for compiled code, replace <code>task_for_pid(mach_task_self(), 0, &ktask)</code> calls with <code>host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &ktask)</code> if source is available

== See also ==
* [[hgsp4 patch]]

[[Category:Kernel Patches]]

Tfp0 patch

2017-12-26T21:33:19Z

Gjest:

{{DISPLAYTITLE:tfp0 patch}}
In the XNU kernel, <code>task_for_pid</code> is a function that allows a (privileged) process to get the task port of another process on the same host, except the kernel task (process ID 0). A '''tfp0 patch''' (or '''task_for_pid(0) patch''') removes this restriction, allowing any executable running as root to call '''task_for_pid''' for pid '''0''' (hence the name) and then use <code>vm_read</code> and <code>vm_write</code> to modify the kernel VM region. The entitlements ''get-task-allow'' and ''task_for_pid-allow'' are required to make [[AMFI]] happy.

== Example code ==
The following C program calls <code>task_for_pid</code> and returns the error code:

#include <mach/mach.h>

// Compile and fakesign with entitlements (on-device; LLVM+Clang and ldid must be installed):
// cc -o tfp0 tfp0.c && ldid -Stfp0.plist tfp0

int main(void) {
mach_port_t kernel_task = 0;
return task_for_pid(mach_task_self(), 0, &kernel_task);
}

The returned error code, which can be checked using <code>echo $?</code> in bash after running the test program, will be 0 if the call succeeded. If it did not, a positive number, e.g. 5 (KERN_FAILURE), is returned instead (see <code>kern_return.h</code> for possible values). The entitlements plist (named <code>tfp0.plist</code> in this example) for [[ldid]] can look like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<nowiki>http://www.apple.com/DTDs/PropertyList-1.0.dtd</nowiki>">
<plist version="1.0">
<dict>
<key>get-task-allow</key>
<true/>
<key>run-unsigned-code</key>
<true/>
<key>task_for_pid-allow</key>
<true/>
</dict>
</plist>

== tfp0 enabled jailbreaks ==
Jailbreaks known to enable tfp0 include:
* [[Absinthe]] (5.1.1)
* [[evasi0n]] (6.0–6.1.2)
* [[p0sixspwn]] (6.1.3–6.1.6)
* [[evasi0n7]] (7.0–7.0.6)
* [[Pangu]] v0.3 (7.1–7.1.2)
* [[Pangu8]] v0.5 (8.0–8.1)
* [[TaiG]] (8.0–8.4)
* [[Pangu9]] (9.0–9.0.2) on 32-bit
* [[Home Depot]] (9.1–9.3.4) on 32-bit
* [[jbme]] (9.2–9.3.3) on 64-bit
* [[extra_recipe+yaluX]] (10.0–10.1.1) on 64-bit
* [[yalu102]] (10.2) on 64-bit (excluding iPhone 7)

The following jailbreaks do ''not'' have tfp0 enabled:
* [[Pangu]] v0.1–0.2 (7.1–7.1.2)
:* Solution: Update to version 0.3 (filename: <code>io.pangu.axe7_0.3_iphoneos-arm.deb</code>)
* [[Pangu8]] v0.1–0.4 (8.0–8.1)
:* Solution: Update to version 0.5 (filename: <code>io.pangu.xuanyuansword8_0.5_iphoneos-arm.deb</code>)
* [[PPJailbreak]] (8.0–8.4)
:* Solution: replace PPJailbreak with TaiG
* [[Pangu9]] (9.0–9.3.3) on 64-bit
:* Solution: use cl0ver by Siguza
* [[h3lix]] (10.0–10.3.3) on 32-bit
:* No solution for compiled code, replace <code>task_for_pid(mach_task_self(), 0, &ktask)</code> calls with <code>host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &ktask)</code> if source is available

== See also ==
* [[hgsp4 patch]]

[[Category:Kernel Patches]]

Hgsp4 patch

2017-12-26T21:21:20Z

Gjest: Created page with "{{DISPLAYTITLE:hgsp4 patch}} A '''hgsp4 patch''' (or '''host_get_special_port(4) patch''') is a kernel patch that enables any executable running as root to access the kernel t..."

{{DISPLAYTITLE:hgsp4 patch}}
A '''hgsp4 patch''' (or '''host_get_special_port(4) patch''') is a kernel patch that enables any executable running as root to access the kernel task by calling '''host_get_special_port''' for host special port '''4''' (hence the name). This host special port is usually unused, and the kernel task port must be “mounted” there by an exploit.<ref>https://bazad.github.io/2017/09/live-kernel-introspection-ios/</ref><ref>https://github.com/iabem97/hermes/blob/master/hermes/disable_protections.c</ref> It is thus recommended that host special port 4 be used solely for the kernel task port.<ref>http://www.newosxbook.com/forum/viewtopic.php?f=8&t=16641</ref>

The hgsp4 route is equivalent to the [[tfp0]] route, and tools that rely on tfp0 can be recompiled to use hgsp4 instead.<ref>[https://twitter.com/panguteam/status/708330906084216833 @PanguTeam: For security researchers, calling host_get_special_port with 4 on jailbroken devices will give u kernel task port just like task_for_pid(0)]</ref> In a tweet, tihmstar confirmed that this applies to [[kloader]] too.<ref>[https://twitter.com/tihmstar/status/945613035489644544 @tihmstar: kloader works fine with h3lix :) Thanks to @nyan_satan for sending me a compiled version which uses hgsp(4)]</ref>

== Example code ==
The following example C program calls <code>host_get_special_port</code> and, on success, returns a positive integer that can be checked using <code>echo $?</code> in bash after running the test program:

#include <mach/mach.h>

int main(void) {
mach_port_t kernel_task = 0;
if (!host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &kernel_task)) return -1;
return kernel_task;
}

-1 is returned on error. 0 is returned if no hgsp4 patch is enabled.

== hgsp4 enabled jailbreaks ==
Jailbreaks known to enable hgsp4 include:
* [[Yalu#yalu_.2B_mach_portal_.2810.1-10.1.1.29|yalu+mach_portal]] (10.0-10.1.1) on 64-bit
* [[h3lix]] (10.0–10.3.3) on 32-bit

== See also ==
* [[tfp0 patch]]

== References ==
<references />

[[Category:Kernel Patches]]

User:Gjest

2017-12-26T00:21:18Z

Gjest:

{{DISPLAYTITLE:gjest}}
I have never liked writing profiles/bios, but here goes:

Welcome to my simple yet complex mind. I like eating and sleeping, I program in various languages and I love the visual style Apple used during the Jobs/Forstall era. I still call Apple’s desktop operating system “Mac OS X”, prefer FreeBSD over Linux, happily spend time on helping people escape the terror of the flat design, refuse to put commas and full stops before a closing quotation mark unless the entire sentence is in quotes, and sometimes have very strong opinions on topics that most people consider insignificant (occasionally I write rants like [https://www.reddit.com/r/jailbreak/comments/6257r5/news_apple_now_lets_users_change_icons_for_apps/dfjux8t/ this], but I never bite – in fact there ''isn’t'' an app for remote biting either, at least not one that supports iOS 6). My username simply means “guest” and is thus often taken. It was not very well thought out, I admit that, but it does not matter since I only use it on Reddit and here. I no longer choose usernames that end in 92, because apparently people stop doing that when reaching their 20s (except on sketchy forums for some reason). I am a very principled person, except when I am not. Actually I usually also consider myself a pragmatic person and an ideologist. Being consistent is perhaps the most important principle.

iPhone wasn’t a thing when I started programming (not outside Jobs’ circles anyway), so I wasted spare time on programming for Windows (Notepad clones and other useless stuff). Thus I am relatively new to the world of advanced iOS, but bloating the user database was not the intention of registering an account here. I hope to contribute with something, especially in the field of downgrading / firmware bundles.

=== Personal projects ===
Below is a list of projects I am working on (and plan to work on). I put them in a table inside a table to save space.

{| class="wikitable mw-collapsible"
! My personal iOS/jailbreak related projects
|-
| style="text-align: left;" |

{| class="wikitable"
|-
! Colour: codes
|   Active
|   Inactive
|}
|-
|
{| class="wikitable"
|-valign="top"
! style="text-align: left;" | Project
! style="text-align: left;" | Description
! style="text-align: left;" | Status
! style="text-align: left;" | Future
|- valign="top"
| style="text-align: left; background: #ccffcc;" | [[ASR]] patcher
| style="text-align: left; background: #ccffcc;" | Compatible with iOS 4 to 10
| style="text-align: left; background: #ccffcc;" | Mostly done; [http://pasted.co/0b6470d7 first beta]
| style="text-align: left; background: #ccffcc;" | Add <code>getopt</code>, fix known memleaks
|- valign="top"
| style="text-align: left; background: #ccffcc;" | [[iBEC]] patcher
| style="text-align: left; background: #ccffcc;" | Automatic iBEC patcher (kernelcache offsets could be entered manually or determined automatically)
| style="text-align: left; background: #ccffcc;" | Working prototype for iOS 6-10 with [https://m.xkcd.com/292/ gotos], must be reorganized
| style="text-align: left; background: #ccffcc;" rowspan="2" | Based upon HaniAG’s [[Tutorial:Odysseus_Bundles|excellent tutorial]]; assembling a full bundle generator remains
|- valign="top"
| style="text-align: left; background: #ffffcc;" | [[iBSS]] patcher
| style="text-align: left; background: #ffffcc;" | Automatic iBSS patching
| style="text-align: left; background: #ffffcc;" | Accidentally made superfluous by the iBEC patcher
|- valign="top"
| style="text-align: left; background: #ffffcc;" | iOS 6 theme for iOS 7 to 10
| style="text-align: left; background: #ffffcc;" | Replacement theme that supports iOS 9.x/10.x and Anemone. Will only use stock icons and carefully reconstructed @3x versions.
| style="text-align: left; background: #ffffcc;" | Settings icons done; on hold until I can dual boot iOS 8.4
| style="text-align: left; background: #ffffcc;" | Finish 3rd party icons and stock icons. @3x will have the lowest priority
|- valign="top"
| style="text-align: left; background: #ccffcc;" | SHSH splitter
| style="text-align: left; background: #ccffcc;" | Scripts that split TinyUmbrella .shsh files, identify versions and submit blobs to Cydia
| style="text-align: left; background: #ccffcc;" | Working, but not yet a worthy replacement for SHSHaker
| style="text-align: left; background: #ccffcc;" | Various tweaks
|- valign="top"
| style="text-align: left; background: #ccffcc;" | Python for iOS
| style="text-align: left; background: #ccffcc;" | Followed some instructions and compiled Python for iOS, v. 2.7.12
| style="text-align: left; background: #ccffcc;" | Available on gjest.yourepo.com; 2.7.13 fat binary ready, but unpublished
| style="text-align: left; background: #ccffcc;" | Make a deb of 2.7.13 and put it up somewhere
|- valign="top"
| style="text-align: left; background: #ccffcc;" | Cydia in Bokmål
| style="text-align: left; background: #ccffcc;" | Bokmål translation for Cydia
| style="text-align: left; background: #ccffcc;" | Available [http://pasted.co/0f8ddb2d here]
| style="text-align: left; background: #ccffcc;" |
|- valign="top"
| style="text-align: left; background: #ccffcc;" | tfp0 tester
| style="text-align: left; background: #ccffcc;" | A tool to test if a so-called tfp0 patch is enabled
| style="text-align: left; background: #ccffcc;" | CLI only, thus not very useful (advanced users probably know already) Has evolved into a more general info app and SHSH blob manager
| style="text-align: left; background: #ccffcc;" | Create a GUI so simple that anybody can use it. Might include some other information to make it more useful.
|- valign="top"
| style="text-align: left; background: #ccffcc;" | Branch calculator
| style="text-align: left; background: #ccffcc;" | A branch (B) instruction calculator for ARMv7 assembly. Saves time when creating patches.
| style="text-align: left; background: #ccffcc;" | A Mac OS X GUI tool (reuses code already written for the ASR patcher)
| style="text-align: left; background: #ccffcc;" | Reverse calculation
|- valign="top"
| style="text-align: left; background: #ffffcc;" | iOS filesystem manager
| style="text-align: left; background: #ffffcc;" | A free file manager for iOS. Filza does not work on iOS 6 :(
| style="text-align: left; background: #ffffcc;" | –
| style="text-align: left; background: #ffffcc;" | –
|- valign="top"
| style="text-align: left; background: #ffffcc;" | Advanced calculator
| style="text-align: left; background: #ffffcc;" | Because the default iOS calculator is useless for programming use. The desktop version also lacks a couple of things.
| style="text-align: left; background: #ffffcc;" | –
| style="text-align: left; background: #ffffcc;" | –
|- valign="top"
| style="text-align: left; background: #ffffcc;" | Character map
| style="text-align: left; background: #ffffcc;" | Something like Charmap on Windows
| style="text-align: left; background: #ffffcc;" | Project created in March 2011, not much progress since then
| style="text-align: left; background: #ffffcc;" | –
|- valign="top"
| style="text-align: left; background: #ffffcc;" | Visualize SHSH brute force
| style="text-align: left; background: #ffffcc;" | Create some kind of visualization that demonstrates how hard it is to brute force SHSH blobs / signing keys
| style="text-align: left; background: #ffffcc;" | –
| style="text-align: left; background: #ffffcc;" | –
|- valign="top"
| style="text-align: left; background: #ccffcc;" | OdysseusOTA2 bundles
| style="text-align: left; background: #ccffcc;" | The missing bundles for OdysseusOTA2
| style="text-align: left; background: #ccffcc;" | [https://files.fm/u/azznnggz Link]
| style="text-align: left; background: #ccffcc;" | I need feedback!
|}
|}

=== Devices ===
I have owned various devices. I put some of them in this table inside a table, with their bullet point list style biographies in collapsed table inside the inner table. Don’t you just love nested tables?

{| class="wikitable mw-collapsible"
! My devices
|-
| style="text-align: left;" |

{| class="wikitable"
|-
! Colour: codes
|   Own
|   Sold
|}
|-
|
{| class="wikitable" style="text-align: left;"
|- valign="top"
! style="text-align: left;" | Device
! style="text-align: left;" | Operating System
! style="text-align: left;" | State
! style="text-align: left;" | Story
|- valign="top"
| style="text-align: left; background: #ccffcc;" | iPhone5,2
| style="text-align: left; background: #ccffcc;" | iOS 6.1.4 (BB 08.02.00)
| style="text-align: left; background: #ccffcc;" | <ul><li style="text-align: left;">Jailbroken<li style="text-align: left;">Dual booted with 8.4</ul>
| style="text-align: left; background: #ccffcc;" | Replaced an old Nokia
{| class="wikitable mw-collapsible mw-collapsed"
! Full story
|-
| <ul>
<li style="text-align: left;">Shipped with iOS 6.0.
<li style="text-align: left;">Saved 6.1.4 blobs before updating to 7.0. Regretted updating every single second since I learned that the SHSH replay method had been obsolete for a couple of years.
<li style="text-align: left;">Still installed every 7.x update in desperate hope for a change towards the better, only to be let down.
<li style="text-align: left;">Had to replace the lock button right before 8.0 came out. The reseller would/could not help me restore to 6.1.4.
<li style="text-align: left;">I upgraded to 8.0, thinking it could not get any worse. It did, the performance was terrible.
<li style="text-align: left;">Jailbroke so that at last I could have the icons replaced.
<li style="text-align: left;">Stayed on 8.1.2 for many months before updating to 8.4, a surprisingly good version to be honest (still ugly though).
<li style="text-align: left;">Another fatal decision was made when I updated to 9.0.2.
<li style="text-align: left;">Being the last 32-bit version to receive a jailbreak while still signed, I had no other option but staying.
<li style="text-align: left;">I did for some 18 months before I left it (good riddance) for iOS 9.2.1 and 10.3.
<li style="text-align: left;">Did not like 10.3, so I went back to 9.2.1 (I was scared to death when restoring to 9.3.2 failed, but apparently I had not entered DFU Mode correctly)
<li style="text-align: left;">Got from 9.2.1 to 9.3.2, played around trying to get back to 9.0.2 because I missed having an untethered jailbreak.
<li style="text-align: left;">It worked, except that I messed up the baseband parameters.
<li style="text-align: left;">Tried 8.4, but the bundle was broken.
<li style="text-align: left;">Got tired and downgraded to 6.1.4. A 3,5 year long nightmare finally came to an end. I am now immortal and invincible
<li style="text-align: left;">Of course I have already been forced to restore twice (once to 9.2.1 and once to 10.3.1, then 9.2.1) because I messed up something, so I’m actually on 6.1.4 for the fourth time.
</ul>
|}
|- valign="top"
| style="text-align: left; background: #ccffcc;" | iPad2,2
| style="text-align: left; background: #ccffcc;" | iOS 6.1.3 (BB 04.12.05)
| style="text-align: left; background: #ccffcc;" | <ul><li style="text-align: left;">Jailbroken<li style="text-align: left;">Can display recipes for delicious cakes</ul>
| style="text-align: left; background: #ccffcc;" | Replaced an iPad1,1
{| class="wikitable mw-collapsible mw-collapsed"
! Full story
|-
| <ul>
<li style="text-align: left;">Shipped with iOS 4.3. Without saving blobs I stayed updated until 6.1.3.
<li style="text-align: left;">I saved blobs and kept it on 6.1.3 until I decided to jailbreak it in March 2016.
<li style="text-align: left;">That failed, so it was in a bootloop for about a year.
<li style="text-align: left;">In April 2017 I had it restored to 9.2.1 (for unknown reasons I luckily saved a couple of 9.x blobs).
<li style="text-align: left;">OTA downgraded to 8.4.1, updated to 9.3.1, and then went back to 9.2.1.
<li style="text-align: left;">When I was done playing, I downgraded to 6.1.3, jailbroke it and restored backed up data.
</ul>
|}
|- valign="top"
| style="text-align: left; background: #ccffcc;" | iPhone7,2
| style="text-align: left; background: #ccffcc;" | iOS 10.3.1 (BB 05.51.00)
| style="text-align: left; background: #ccffcc;" | <ul><li style="text-align: left;">Unjailbroken<li style="text-align: left;">Runs apps that no longer work on iOS 8.4</ul>
| style="text-align: left; background: #ccffcc;" | Secondary device<ul><li style="text-align: left;">Second-hand device<li style="text-align: left;">Restored using the last iPhone5,2 backup I made before downgrading to 6.1.4</ul>
|- valign="top"
| style="text-align: left; background: #ccffcc;" | MacBookPro11,3
| style="text-align: left; background: #ccffcc;" | Mac OS X 10.9.5 Windows 7 SP1
| style="text-align: left; background: #ccffcc;" | Specced to last a decade and shipped right before Yosemite was launched.
| style="text-align: left; background: #ccffcc;" | <ul><li style="text-align: left;">Replaced a MacBookPro8,1<li style="text-align: left;">Updated from 10.9.4 to 10.9.5</ul>(That’s it. Storytime’s over, you can go home now :/)
|- valign="top"
| style="text-align: left; background: #ccffcc;" | FSC Amilo Pa 1510
| style="text-align: left; background: #ccffcc;" | FreeBSD 10.3 <s>Windows 7 SP1</s> <s>Windows Vista SP2</s>
| style="text-align: left; background: #ccffcc;" | For testing
| style="text-align: left; background: #ccffcc;" | <ul>
<li style="text-align: left;">Replaced an Amilo D1840W that overheated
<li style="text-align: left;">HDD wore out after three years. Replaced it with a 32 GB SSD
</ul>
|- valign="top"
| style="text-align: left; background: #ffffcc;" | iPad1,1
| style="text-align: left; background: #ffffcc;" | iOS 5.1.1 (BB 07.11.01)
| style="text-align: left; background: #ffffcc;" | Sold
| style="text-align: left; background: #ffffcc;" | <ul>
<li style="text-align: left;">Went to just about every Apple Store in California in June/July 2010 to get one
<li style="text-align: left;">Originally I wanted the WiFi-only model, but was only able to find the 3G model
<li style="text-align: left;">Sold it when the iPad 2 came out, but consider buying it back since it is unused
</ul>
|- valign="top"
| style="text-align: left; background: #ffffcc;" | MacBookPro8,1
| style="text-align: left; background: #ffffcc;" | Mac OS X 10.6.8 Mac OS X 10.9.5
| style="text-align: left; background: #ffffcc;" | Sold
| style="text-align: left; background: #ffffcc;" | <ul>
<li style="text-align: left;">My first Mac (shipped with Mac OS X 10.6.6), replaced the Amilo
<li style="text-align: left;">Sold it a few months after buying the new one, may buy it back in a few years
</ul>
|}
|}

=== Þe Tale of My Username ===
P.N. ''ᚷᚨᛊᛏᛁᛉ'' --> O.N. ''gestr'' --> E. ''guest'' / N. ''gjest'' --> [https://www.reddit.com/user/gjest/ /u/gjest]

Tfp0 patch

2017-12-26T00:07:54Z

Gjest: tfp0 enabled jailbreaks

{{DISPLAYTITLE:tfp0 patch}}
In the XNU kernel, <code>task_for_pid</code> is a function that allows a (privileged) process to get the task port of another process on the same host, except the kernel task (process ID 0). A '''tfp0 patch''' (or '''task_for_pid(0) patch''') removes this restriction, allowing any executable running as root to call '''task_for_pid''' for pid '''0''' (hence the name) and then use <code>vm_read</code> and <code>vm_write</code> to modify the kernel VM region. The entitlements ''get-task-allow'' and ''task_for_pid-allow'' are required to make [[AMFI]] happy.

== Example code ==
The following C program calls <code>task_for_pid</code> and returns the error code:

#include <mach/mach.h>

// Compile and fakesign with entitlements (on-device; LLVM+Clang and ldid must be installed):
// cc -o tfp0 tfp0.c && ldid -Stfp0.plist tfp0

int main(void) {
mach_port_t kernel_task = 0;
return task_for_pid(mach_task_self(), 0, &kernel_task);
}

The returned error code, which can be checked using <code>echo $?</code> in bash after running the test program, will be 0 if the call succeeded. If it did not, a positive number, e.g. 5 (KERN_FAILURE), is returned instead (see <code>kern_return.h</code> for possible values). The entitlements plist (named <code>tfp0.plist</code> in this example) for [[ldid]] can look like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<nowiki>http://www.apple.com/DTDs/PropertyList-1.0.dtd</nowiki>">
<plist version="1.0">
<dict>
<key>get-task-allow</key>
<true/>
<key>run-unsigned-code</key>
<true/>
<key>task_for_pid-allow</key>
<true/>
</dict>
</plist>

== tfp0 enabled jailbreaks ==
Jailbreaks known to enable tfp0 include:
* Absinthe (5.1.1)
* evasi0n (6.0–6.1.2)
* p0sixspwn (6.1.3–6.1.6)
* evasi0n7 (7.0–7.0.6)
* Pangu v 0.3 (7.1–7.1.2)
* Pangu8 v 0.5 (8.0–8.1)
* TaiG (8.0–8.4)
* Pangu9 (9.0–9.0.2) on 32-bit
* Home Depot (9.1–9.3.4) on 32-bit
* JailbreakMe (9.2–9.3.3) on 64-bit
* Yalu (10.x) on 64-bit

The following jailbreaks do ''not'' have tfp0 enabled:
* Pangu7 v 0.1–0.2 (7.1–7.1.2)
:* Solution: Update to version 0.3 (filename: <code>io.pangu.axe7_0.3_iphoneos-arm.deb</code>)
* Pangu8 v 0.1–0.4 (8.0–8.1)
:* Solution: Update to version 0.5 (filename: <code>io.pangu.xuanyuansword8_0.5_iphoneos-arm.deb</code>)
* PPJailbreak (8.0–8.4)
:* Solution: replace PPJailbreak with TaiG
* Pangu9 (9.0–9.3.3) on 64-bit
:* Solution: use cl0ver by Siguza
* h3lix (10.0–10.3.3) on 32-bit
:* No solution for compiled code, replace <code>task_for_pid(mach_task_self(), 0, &ktask)</code> calls with <code>host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &ktask)</code> if source is available

[[Category:Kernel Patches]]

Beehind

2017-12-25T23:50:25Z

Gjest: inserting a “reference needed” on a sentenced that appears to have been copied from the Odysseus article (it is wrong for the OTA downgrade method)

'''Beehind''' is a tool created by Italian developer [https://twitter.com/Beehindowngrade Andrea Bentivegna], using [https://twitter.com/winocm winocm's] [[kloader]] to downgrade 32-bit iOS devices. It is a Windows-only counterpart to [[Odysseus]] and [[OdysseusOTA]], but it also includes a GUI.

== How it works ==

Beehind uses the same methods as [[OdysseusOTA]] for over-the-air downgrades, where [[kloader]] loads a decrypted image and allows you to bootstrap a [[pwned]] [[iBSS]] which initiates a restore to a custom IPSW. For other downgrades, Beehind uses iFaith's method of downgrading. According to the developer, future versions of Beehind will adopt Odysseus's methods for a more stable downgrade.

=== Notes ===

Beehind only works on some jailbroken 32-bit devices with an untether that has [[tfp0]] enabled. The latest versions of [[TaiG]], [[Pangu9]], [[Pangu8]], [[Pangu]], [[evasi0n7]], and [[evasi0n]] all have tfp0 activated.

For OTA downgrades, the baseband is reflashed. Otherwise the baseband is ''not'' touched.[reference needed] If you go too far up or down with iOS version, it may be that the version of iOS you restored to does not understand the baseband left behind by the prior version of iOS. If that happens, you will not get past activation and you cannot re-jailbreak the device. As a consequence, the device will remain in activation limbo and you'll have to restore to a [https://ipsw.me/signed currently signed version of iOS] before trying again (A6: beware of activation problems when downgrading 10.x to 9.x or lower; restore to 9.x using iDeviceReRestore and saved blobs if possible and the if the device hasn’t seen iOS 10).

=== Compatibility ===

In general, A5 devices released in 2011 can be OTA downgraded to iOS 6.1.3. These are:

* iPad2,1
* iPad2,2
* iPad2,3
* iPhone4,1 (except some models produced after the release of iOS 7 are not compatible)

This excludes these models: the 2012 iPad 2 (iPad2,4), all iPad mini 1 models (iPad2,5, iPad2,6 and iPad2,7) and the 5th gen iPod touch (iPod5,1).

Other downgrades:

* TBA

== Links ==

* [http://geeksnow.it/beehind/ Official download and tutorial] (dead link)

[[Category:Software]]
[[Category:Downgrading]]

Beehind

2017-12-25T23:17:13Z

Gjest: /* Notes */ link

'''Beehind''' is a tool created by [https://twitter.com/Beehindowngrade Andrea Bentivegna] that uses [https://twitter.com/winocm winocm's] [[ios-kexec-utils#kloader|kloader]] to downgrade 32-bit iOS devices. It is similar to [[Odysseus]], but includes a GUI. Currently, the program is Windows-only.

== How it works ==

Beehind uses the same methods as [[Odysseus]] for over-the-air downgrades, where kloader loads a decrypted image and allows you to bootstrap a [[pwned]] [[iBSS]] which initiates a restore to a custom IPSW. For other downgrades, Beehind uses iFaith's method of downgrading. According to the developer, future versions of Beehind will adopt Odysseus's methods for a more stable downgrade.

=== Notes ===

Beehind only works on some jailbroken 32-bit devices with an untether that has [[tfp0]] enabled. The latest versions of [[TaiG]], [[Pangu9]], [[Pangu8]], [[Pangu]], [[evasi0n7]], and [[evasi0n]] all have tfp0 activated. Also, this will *NOT* change your [[Baseband_Device |baseband]]. If you go too far up or down with iOS version, it may be that the version of iOS you restored to does not understand the baseband left behind by the prior version of iOS. If that happens, you will not get past activation and you cannot re-jailbreak the device. As a consequence, the device will remain in activation limbo and you'll have to restore to the [https://ipsw.me/signed currently signed version of iOS].

===Compatibility===

TBA

== Links ==

* [http://geeksnow.it/beehind/ Official download and tutorial]

[[Category:Software]]
[[Category:Downgrading]]

Odysseus

2017-12-25T23:16:43Z

Gjest: /* Compatibility */ link

'''Odysseus''' is a tool by [https://twitter.com/xerub xerub] to downgrade/upgrade/restore specific 32-bit devices to specific firmwares. This method only works if you are jailbroken, have valid SHSH Blobs and a valid APTicket.

== How it works ==

It uses a tool included in [http://winocm.moe winocm's] [https://github.com/ramytuki/ios-kexec-utils ios-kexec-utils] called [[Ios-kexec-utils#kloader|kloader]]. kloader is a CLI that you can run on an iOS device which loads an (decrypted) image. It allows you to bootstrap a pwned iBSS and then initiate a restore using [https://github.com/libimobiledevice/idevicerestore idevicerestore] with a custom IPSW, which allows you to downgrade/upgrade/restore to the firmware of your choice. [https://github.com/xerub/xpwn/tree/master/ipsw-patch/FirmwareBundles There are firmware bundles] that allow you to restore each device to each iOS. If the bundle for the device and iOS you want to get does not exist, the downgrade/upgrade cannot happen. Each bundle is made by grabbing the Keys/IVs from the original firmware. They are posted [[Firmware Keys|here]].

== Compatibility ==

=== Notes ===

This only works on some jailbroken 32-bit devices with an untether that has [[tfp0]] enabled. The latest versions of [[TaiG]], [[Pangu9]], [[Pangu8]], [[Pangu]], [[evasi0n7]], and [[evasi0n]] all have tfp0 activated. Also, this will *NOT* change your [[Baseband_Device |baseband]]. If you go too far up or down with iOS version, it may be that the version of iOS you restored to does not understand the baseband left behind by the prior version of iOS. If that happens, you will not get past activation and you cannot re-jailbreak the device. As a consequence, the device will remain in activation limbo and you'll have to restore to the [https://ipsw.me/signed currently signed version of iOS].

=== Official Bundles ===
==== iPad ====
{| class="wikitable"
|-
! rowspan="2" | iOS
! colspan="13" | Device
|-
| [[K93AP|iPad 2 (iPad2,1)]]
| [[J1AP|iPad (3rd generation) (iPad3,1)]]
| [[J2AAP|iPad (3rd generation) (iPad3,3)]]
|-
| 6.1.2
| {{no}}
| {{yes}}
| {{no}}
|-
| 6.1.3
| {{yes}}
| {{no}}
| {{yes}}
|-
| 7.1.2
| colspan="3" {{yes}}
|}

==== iPhone ====
{| class="wikitable"
|-
! rowspan="2" | iOS
! colspan="8" | Device
|-
| [[N90AP|iPhone 4 (iPhone3,1)]]
| [[N92AP|iPhone 4 (iPhone3,3)]]
| [[N94AP|iPhone 4S (IPhone 4,1)]]
| [[N42AP|iPhone 5 (iPhone5,2)]]
| [[N49AP|iPhone 5c (iPhone5,4)]]
|-
| 6.1.2
| {{yes}}
| colspan="3" {{no}}
| {{n/a}}
|-
| 6.1.3
| {{yes}}
| {{no}}
| {{yes}}
| {{no}}
| {{n/a}}
|-
| 7.0.4
| {{yes}}
| colspan="2" {{no}}
| {{yes}}
| {{no}}
|-
| 7.0.6
| {{yes}}
| colspan="4" {{no}}
|-
| 7.1.2
| colspan="5" {{yes}}
|-
| 8.1.2
| colspan="2" {{n/a}}
| {{no}}
| colspan="2" {{yes}}
|-
| 8.3
| colspan="2" {{n/a}}
| {{no}}
| {{yes}}
| {{no}}
|-
| 9.0
| colspan="3" {{no}}
| {{yes}}
| {{no}}
|-
| 9.0.2
| colspan="3" {{no}}
| {{yes}}
| {{no}}
|}

== Download ==
{| class="wikitable" style="text-align:center;"
! Version
! Download
! SHA-1
|-
| 0.1
| [http://dayt0n.github.io/odysseus/odysseus-0.1.zip dayt0n.com]
| a7ebd3743479a66b7502af947f6967cb4b54b54a
|-
| 0.2
| [http://dayt0n.github.io/odysseus/odysseus-0.2.zip dayt0n.com]
| 812cd80725003f1aed897eebe623b5fb39500510
|-
| 0.3
| [http://dayt0n.github.io/odysseus/odysseus-0.3.zip dayt0n.com]
| 8aedd1af2e3e96b58d7ab5e2f58fbcf76ad08411
|-
| 0.4
| [http://dayt0n.github.io/odysseus/odysseus-0.4.zip dayt0n.com]
| 2f8f368b047f66a96bf2e51ab228cdde2435444a
|-
| 0.99
| [http://dayt0n.github.io/odysseus/odysseus-0.99.zip dayt0n.com]
| fc98665bce96f406eafeb8d4f8745f70a08f62c8
|-
| 0.999
| [http://dayt0n.github.io/odysseus/odysseus-0.999.zip dayt0n.com]
| 23717f90a6b5bf847b996648be4c06046bc590b
|-
|}

== Links ==

* [[OdysseusOTA]], a derivative tool for downgrading certain devices to iOS 6.1.3
* [[OdysseusOTA2]], like OdysseusOTA, but for downgrading to iOS 8.4.1
* [http://dayt0n.com/articles/Odysseus/ Official page]
* [https://github.com/xerub/xpwn GitHub]
* [https://www.reddit.com/r/jailbreak/comments/3r9o4i/release_iphone_4_4s_5_5c_ipad_2_3_bundles_for/ Unofficial bundles]
* [https://www.reddit.com/r/jailbreak/comments/6orfvh/discussion_i_made_iphone_4s_ios_80812_82_83_12f69/ Unofficial bundles]

[[Category:Software]]
[[Category:Downgrading]]

Tfp0

2017-12-25T23:16:06Z

Gjest: Redirected page to Tfp0 patch

#REDIRECT [[tfp0 patch]]

Tfp0 patch

2017-12-25T23:15:45Z

Gjest: Gjest moved page Task for pid0 patch to Tfp0 patch: More common name, easier to find article

Task for pid0 patch

2017-12-25T23:15:45Z

Gjest: Gjest moved page Task for pid0 patch to Tfp0 patch: More common name, easier to find article

#REDIRECT [[Tfp0 patch]]

Tfp0 patch

2017-12-25T23:14:59Z

Gjest: +lede, +example code, “task_for_pid-allow” is needed on iOS 6 (but not “get-task-allow”, will test on higher versions later)

V0rtex

2017-12-25T22:36:08Z

Gjest:

{{DISPLAYTITLE:v0rtex}}
'''v0rtex''' is a software exploitation of an IOSurface vulnerability present from iOS 10.0 through iOS 11.1.2, discovered by white-hat hacker Ian Beer of the Google Zero project. It was written by Siguza and covers all versions of iOS 10, whereas Beer’s own async_wake exploit covers 11.0-11.1.2.

The v0rtex exploit proved to be suitable for jailbreaks, and powers two jailbreak projects: [[Saïgon]] (ARM64), where it replaced the ziVa exploit, and [[h3lix]] (ARMv7s). iOS 10.3.3 is the final version for all A6 devices, and also an OTA signed version for some A7 devices, making both jailbreaks extra relevant.

== See also ==
* [[h3lix]]
* [[Saïgon]]

== External links ==
* [https://siguza.github.io/v0rtex/ v0rtex | IOSurface explot] by Siguza

[[Category:Exploits]]

H3lix

2017-12-25T22:09:04Z

Gjest: /* Development */ link

{{lowercase}}{{Infobox software
| name = h3lix
| title = h3lix
| developer = [https://twitter.com/tihmstar tihmstar] [https://twitter.com/s1guza Siguza]
| released = {{Start date|2017|12|24|df=yes}}
| latest release version = RC 1
| latest release date = {{Start date and age|2017|12|24|df=yes}}
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [https://h3lix.tihmstar.net/ h3lix.tihmstar.net]
}}
'''h3lix''' is a [[semi-untethered jailbreak]] for 32-bit devices running any version of iOS 10, developed by tihmstar and Siguza. h3lix works by sideloading an IPA using [[Cydia Impactor]]. The first release candidate was released on 24 December, 2017. It is one of two jailbreak projects based on the v0rtex exploit, the other being [[Saïgon]] for 64-bit devices.

== History ==

=== Background ===
Since Apple’s transition to 64-bit in 2013, the market share of their 32-bit devices has been steadily shrinking. During the lifespan of iOS 9, the 32-bit share reached a level low enough for jailbreak developers to start dropping 32-bit support altogether. The iOS 10 jailbreaks released in late 2016 and early 2017 continued this trend and left the last supported 32-bit devices, namely the A6 devices, unjailbreakable.

Early 2017 saw renewed interest in the 32-bit deivces, with the release of the [[Home Depot]] jailbreak for iOS 9.1-9.3.4, as well as the iDeviceReRestore tool for restoring to iOS 9 using saved blobs, and the combination of them provided a jailbreak solution for 32-bit devices that had been stuck on iOS 10. Apple silently and effectively killed off iDeviceReRestore as an escape route in July 2017, by exploiting the introduction of a new activation method in iOS 10 to reject activation records coming from A6 devices on iOS 9 and older, if they had ever been activated on iOS 10. By then, the focus of jailbreak developers had already started shifting to the upcoming iOS 11, and it was feared that both iOS 9.3.5 and iOS 10 would remain unjailbreakable on 32-bit. Soon after, however, no less than four jailbreaks were released for 32-bit devices ([[Phœnix]], [[UntetherHomeDepot]], [[etasonJB]] and [[Home Depot]] 1.1 for 8.4.1). At that point all pre-A6 devices were jailbreakable for life, and hopes grew for a final 32-bit jailbreak.

=== Development ===
At least one of the exploits that powered the iOS 10 jailbreaks, mach_portal by [[Ian Beer]] of the Google Zero project, could in theory be ported to 32-bit. Beer used another vulnerability he discovered, CVE-2017-13861, to write the async_exploit for iOS 11, inspiring Siguza to write an exploit that was compatible with 64-bit iOS 10, named [[v0rtex]], on which he published an article in early December of 2017.<ref>[https://siguza.github.io/v0rtex/ v0rtex | IOSurface exploit]</ref> v0rtex quickly replaced Adam Donenfeld’s ziVa exploit in the [[Saïgon]] project, and it was expected that porting it to 32-bit would be feasible. About a week later, tihmstar announced that he and Siguza had in fact done so,<ref>[https://twitter.com/tihmstar/status/940751131709292545 @tihmstar: We just ported v0rtex to 32bit :D @s1guza is going insane lately!]</ref> and as the duo were responsible for the [[Phœnix]] jailbreak a few months earlier, users hoped that this meant that a 32-bit jailbreak was imminent. Screenshots were posted by tihmstar as the development progressed, and the user community was involved with choosing the name and designing the app and logo. Credits were given to @FoxletFox for the graphics and Jacky C for the logo concept.

The first release candidate of h3lix was then published on tihmstar’s website on Christmas Eve, successfully tested with iOS 10.3.3 on the [[N42AP]] (iPhone5,2). Users found it to be compatible with other A6 devices on the same version, while some also reported problems when attempting to use it on older iOS 10 versions.<ref>[https://www.reddit.com/r/jailbreak/comments/7lvufg/release_tihmstar_releases_ios_10x_h3lix_jailbreak/ <nowiki>[Release]</nowiki> Tihmstar releases iOS 10.x H3lix jailbreak for 32bit devices]</ref>

Being the last version offered for the A6 devices, iOS 10 was considered by some users to be slower and less usable than older versions, making downgrading one of the main use cases for this jailbreak. Like some other jailbreaks, h3lix does not enable <code>task_for_pid(0)</code>, but tihmstar announced that it does have the equivalent <code>host_get_special_port(4)</code> instead.<ref>[https://twitter.com/tihmstar/status/945184098808664064 @tihmstar: In case you were wondering: There is no tfp0 in h3lix, however there is hfsp(4). I verified it works by using ios-kern-utils.]</ref> For [[kloader]]-based downgrades to work, kloader must be recompiled using <code>host_get_special_port(4)</code> instead.

=== Version Change Log ===
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| RC 1
| 24 December, 2017
| Initial release
|}

== See also ==
* [[Saïgon]]
* [[v0rtex]]

== References ==
<references />

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Kloader

2017-12-25T22:08:38Z

Gjest: redirect

#REDIRECT [[ios-kexec-utils#kloader]]

Home Depot

2017-12-25T22:07:29Z

Gjest: /* Trident and Trident+kloader */ link

{{Infobox software
| name = Home Depot
| title = Home Depot
| developer = [https://twitter.com/REALKJCMEMBER jk9357]
| released = {{Start date|2017|01|29|df=yes}}
| latest release version = v1.1 beta 1
| latest release date = {{Start date and age|2017|09|24|df=yes}}
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [http://wall.supplies/OLD%20iPhone%20HACKED.html wall.supplies]
}}
'''Home Depot''' is a [[semi-untethered jailbreak]] for 32-bit devices on iOS 9.1 - 9.3.4. It was written by [https://twitter.com/REALKJCMEMBER jk9357]. It works by sideloading an IPA using [[Cydia Impactor]]. The first beta of version 1.1, offered as a separate download, added support for iOS 8.4.1 on [[A5]] devices.

== History ==
=== Background ===
In August 2016 it was discovered that three serious vulnerabilities had been exploited by a spyware named Pegasus. It was revealed that the malware had probably been out in the wild for a significant amount of time, and that it showed signs of having a kernel mapping table with values for versions stretching as far back as iOS 7. Apple released iOS 9.3.5 shortly thereafter, which supposedly patched the vulnerabilities CVE-2016-4655, CVE-2016-4656 and CVE-2016-4657. The incident was thoroughly covered in newspapers all over the world, and users were urged to update. Despite the seriousness of these vulnerabilities and the fact that the Pegasus spyware already exploited them, a jailbreak based on them was not seen. With PanGu for 64-bit only iOS 9.2 to 9.3.3 released just a few weeks earlier, in late July, and iOS 10 being released in September, only those who chose to stay on 9.3.4 and users of 32-bit devices, a small and ever shrinking minority, would have benefited from another iOS 9 jailbreak.

=== Trident and Trident+kloader ===
Hopes of another 32-bit jailbreak faded, as the two last jailbreaks were 64-bit only and the focus shifted to iOS 10. Several users asked if the [[iPhone 4S]] would be the first iPhone not to be jailbreakable on its final firmware. Eventually the Trident project was released, which used two of the Pegasus exploits (CVE-2016-4655 and CVE-2016-4656) to gain root access on iOS 9.3.4 and older. Trident was later paired with [[ios-kexec-utils#kloader|kloader]] to form Trident+kloader, which allowed users to downgrade using [[Odysseus]] and [[OdysseusOTA]]/[[OdysseusOTA2]].

=== The full-fledged jailbreak is released ===
When Home Depot finally was released in January 2017, it was the first 32-bit jailbreak in more than a year. The news were bittersweet for many users, as they discovered that the solution was semi-tethered and that it did not support iOS 9.3.5. On the other hand, it proved that there was still a market for 32-bit jailbreaks. Home Depot became available to more users a couple of months later, when [[iDeviceReRestore]] was released, allowing users who had saved iOS 9 SHSH blobs and APTickets to downgrade.

==== Legacy ====
Since older iOS versions were vulnerable to the same exploits, several attempts were made to get Home Depot working on iOS 8.4.1, a then unjailbreakable version to which most 32-bit devices could OTA downgrade. For a while rumours were flying that the Fried Apple Team would port the 64-only Yalu for 8.4.1 jailbreak to 32-bit and also release a 32-bit compatible iOS 9.3.5 jailbreak. The community saw a renewed interest in porting Home Depot to 8.4.1 during the spring and early summer of 2017, when these rumours had turned out to be false.

Three similar or derivative products were released during the late summer of 2017:

# [[Phœnix]], a semi-tethered jailbreak for 9.3.5 exploiting the fact that Apple had not properly patched the Pegasus exploits

# [[#UntetherHomeDepot|UntetherHomeDepot]] (originally BetterHomeDepot), an untether for Home Depot (iOS 9.1-9.3.4)

# [[EtasonJB]], an iOS 8.4.1 compatible untethered jailbreak released after unsuccessful attempts to get Home Depot working on iOS 8

=== Version Change Log ===
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| "JailBreak" (first beta release)
| ?
| Initial beta release
|-
| "JailBreakMoreDevices" (second beta)
| ?
| More devices supported
|-
| "iPhone53932" (third beta)
| ?
| Fix for iPhone5,3 on iOS 9.3.2
|-
| "iPhone52932" (fourth beta)
| ?
| Fix for iPhone5,2 on iOS 9.3.2
|-
| "Make Mexico Pay For It" (fifth beta)
| ?
| Experimental support for more devices
|-
| Revision 1
| rowspan="6"| 29 Jan 2017
| Initial release
|-
| Revision 2
| Fix for Cydia not appearing
|-
| Revision 3
| Real fix for Cydia not appearing
|-
| Revision 4
| Fix for app crashing
|-
| Revision 5
| Fix for tfp0
|-
| Revision 6
| [[iPad 2]] fix for some iOS versions
|-
| Revision 7
| 30 Jan 2017
| Fix for broken LwVM patch
|-
| Release Candidate 1
| 19 Mar 2017
|
*Added 3 bonus tracks to '''Mixtape Player''': Lay Low, Purple Demo (KJC Edit), KJC Anthem Pt. 4 (Feat. Jailbreakbusters, Qwerty, Tihmstar & rg0rd)
*'''Mixtape Player''' now displays song lyrics
*Seek backwards in '''Mixtape Player''' to hear your favorite part of the track again
*Rearrange tracks in Up Next in '''Mixtape Player'''
*Fixes an issue where the volume slider in '''Mixtape Player''' would not appear on some devices
*Fixes an issue where the Home Depot label would not be aligned properly while in the launch screen
*Saves a jailbreak log, which is available in iTunes File Sharing
*No longer extracts iosbinpack
*No longer installs Droplets wallpaper
*Treats "Enable Jailbreak" as "Prepare For Jailbreak" including re-extracting Cydia when file /.installed_home_depot is not present
*Support for every 32-bit device on iOS 9.1-9.3.4 (Beta, requires internet connection)
*Improved reliability on [[iPod touch (5th generation)]]
|-
| Release Candidate 2
| 22 Mar 2017
| Fix for Cydia not installing
|-
| Release Candidate 3
| 25 Mar 2017
|
*Improved reliability of re-extracting Cydia
*No longer installs Dropbear
*Fixes an issue with LwVM patch which would result in failure on iOS 9.3.1
|-
| 1.1 beta 1
| 24 Sep 2017
|
*Mixtape Player now has three themes: Default, Dark and Texas
*Fixes an issue where the captcha did not appear when attempting to download the mixtape
*Rearrange tracks in Up Next in Mixtape Player
*Improved appearance of Mixtape Player on iPad Pro
*"Install Cydia" now supports iOS 8.4.1 on select devices
*May break "Install Cydia" compatibiliy with iOS versions greater than 8.4.1
|}


== UntetherHomeDepot ==
{{Infobox software
| name = UntetherHomeDepot
| title = UntetherHomeDepot
| developer = [http://www.twitter.com/tihmstar @tihmstar]
| released = {{Start date|2017|08|18|df=yes}}
| latest release version = 1.4.2
| latest release date = {{Start date and age|2017|09|10|df=yes}}
| programming language =
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [http://repo.tihmstar.net/ tihmstar’s repo]
}}
On August 18, an untethered jailbreak (based off of Home Depot) was released on [http://repo.tihmstar.net tihmstar's APT repository]. Originally called BetterHomeDepot, the package was later renamed UntetherHomeDepot with the release of version 1.1.

[https://twitter.com/qwertyoruiopz/status/898676150020390912 Luca Todesco] advised people to not use it, citing its potential to bootloop devices. The exploits used were labeled “not production grade”. An alternative stage1 exploit was later added.

The development was declared to be finished on 10 September, 2017, with the release of Community Offsets by @stek29.

=== Version Change Log ===
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| 1.0.0
| 18 Aug 2017
|
* Initial release
|-
| 1.0.1
| 19 Aug 2017
|
* Added support for iPad3,3 (9.3.2)
|-
| 1.0.2
| 20 Aug 2017
|
* Added support for iPhone4,1 (9.3.2) and iPad2,4 (9.3.3)
|-
| 1.1.0
| 21 Aug 2017
|
* Fixed deepsleep bug
* Package name changed to UntetherHomeDepot (the identifier was changed from <code>net.tihmstar.betterhomedepot</code> to <code>net.tihmstar.untetherhomedepot</code>)
|-
| 1.2
| 25 Aug 2017
|
* Fixed a bug where having a passcode would disable untether
|-
| 1.3
| 2 Sep 2017
|
* Fixed lwvm patch (bug where 9.3.1 rootfs was ro)
|-
| 1.4.0
| rowspan="2" | 3 Sep 2017
| rowspan="2" |
* Added support for 9.2.1
* Refusing to install when stage1 doesn’t work (to prevent bootloops)
* Alternative stage1 exploit
|-
| 1.4.1
|-
| 1.4.2
| 10 Sep 2017
|
* Community Offsets (<code>net.tihmstar.untetherhomedepotoffsets</code>) was released
|-
|}

== External Links ==
* [http://www.wall.supplies/ Home page]
* [http://pastebin.com/a91ywvEW Extra Offsets] (will add more when found)
* [https://www.reddit.com/r/jailbreak/comments/5vpuyf/discussion_list_of_all_iphone_all_ipad_will_be/ A redditor who claims to have found all the offsets]

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Beehind

2017-12-25T22:06:57Z

Gjest: link

'''Beehind''' is a tool created by [https://twitter.com/Beehindowngrade Andrea Bentivegna] that uses [https://twitter.com/winocm winocm's] [[ios-kexec-utils#kloader|kloader]] to downgrade 32-bit iOS devices. It is similar to [[Odysseus]], but includes a GUI. Currently, the program is Windows-only.

== How it works ==

Beehind uses the same methods as [[Odysseus]] for over-the-air downgrades, where kloader loads a decrypted image and allows you to bootstrap a [[pwned]] [[iBSS]] which initiates a restore to a custom IPSW. For other downgrades, Beehind uses iFaith's method of downgrading. According to the developer, future versions of Beehind will adopt Odysseus's methods for a more stable downgrade.

=== Notes ===

Beehind only works on some jailbroken 32-bit devices with an untether that has [[Task_for_pid0_patch | tfp0]] enabled. The latest versions of [[TaiG]], [[Pangu9]], [[Pangu8]], [[Pangu]], [[evasi0n7]], and [[evasi0n]] all have tfp0 activated. Also, this will *NOT* change your [[Baseband_Device |baseband]]. If you go too far up or down with iOS version, it may be that the version of iOS you restored to does not understand the baseband left behind by the prior version of iOS. If that happens, you will not get past activation and you cannot re-jailbreak the device. As a consequence, the device will remain in activation limbo and you'll have to restore to the [https://ipsw.me/signed currently signed version of iOS].

===Compatibility===

TBA

== Links ==

* [http://geeksnow.it/beehind/ Official download and tutorial]

[[Category:Software]]
[[Category:Downgrading]]

Odysseus

2017-12-25T22:06:18Z

Gjest: link

'''Odysseus''' is a tool by [https://twitter.com/xerub xerub] to downgrade/upgrade/restore specific 32-bit devices to specific firmwares. This method only works if you are jailbroken, have valid SHSH Blobs and a valid APTicket.

== How it works ==

It uses a tool included in [http://winocm.moe winocm's] [https://github.com/ramytuki/ios-kexec-utils ios-kexec-utils] called [[Ios-kexec-utils#kloader|kloader]]. kloader is a CLI that you can run on an iOS device which loads an (decrypted) image. It allows you to bootstrap a pwned iBSS and then initiate a restore using [https://github.com/libimobiledevice/idevicerestore idevicerestore] with a custom IPSW, which allows you to downgrade/upgrade/restore to the firmware of your choice. [https://github.com/xerub/xpwn/tree/master/ipsw-patch/FirmwareBundles There are firmware bundles] that allow you to restore each device to each iOS. If the bundle for the device and iOS you want to get does not exist, the downgrade/upgrade cannot happen. Each bundle is made by grabbing the Keys/IVs from the original firmware. They are posted [[Firmware Keys|here]].

== Compatibility ==

=== Notes ===

This only works on some jailbroken 32-bit devices with an untether that has [[Task_for_pid0_patch | tfp0]] enabled. The latest versions of [[TaiG]], [[Pangu9]], [[Pangu8]], [[Pangu]], [[evasi0n7]], and [[evasi0n]] all have tfp0 activated. Also, this will *NOT* change your [[Baseband_Device |baseband]]. If you go too far up or down with iOS version, it may be that the version of iOS you restored to does not understand the baseband left behind by the prior version of iOS. If that happens, you will not get past activation and you cannot re-jailbreak the device. As a consequence, the device will remain in activation limbo and you'll have to restore to the [https://ipsw.me/signed currently signed version of iOS].

=== Official Bundles ===
==== iPad ====
{| class="wikitable"
|-
! rowspan="2" | iOS
! colspan="13" | Device
|-
| [[K93AP|iPad 2 (iPad2,1)]]
| [[J1AP|iPad (3rd generation) (iPad3,1)]]
| [[J2AAP|iPad (3rd generation) (iPad3,3)]]
|-
| 6.1.2
| {{no}}
| {{yes}}
| {{no}}
|-
| 6.1.3
| {{yes}}
| {{no}}
| {{yes}}
|-
| 7.1.2
| colspan="3" {{yes}}
|}

==== iPhone ====
{| class="wikitable"
|-
! rowspan="2" | iOS
! colspan="8" | Device
|-
| [[N90AP|iPhone 4 (iPhone3,1)]]
| [[N92AP|iPhone 4 (iPhone3,3)]]
| [[N94AP|iPhone 4S (IPhone 4,1)]]
| [[N42AP|iPhone 5 (iPhone5,2)]]
| [[N49AP|iPhone 5c (iPhone5,4)]]
|-
| 6.1.2
| {{yes}}
| colspan="3" {{no}}
| {{n/a}}
|-
| 6.1.3
| {{yes}}
| {{no}}
| {{yes}}
| {{no}}
| {{n/a}}
|-
| 7.0.4
| {{yes}}
| colspan="2" {{no}}
| {{yes}}
| {{no}}
|-
| 7.0.6
| {{yes}}
| colspan="4" {{no}}
|-
| 7.1.2
| colspan="5" {{yes}}
|-
| 8.1.2
| colspan="2" {{n/a}}
| {{no}}
| colspan="2" {{yes}}
|-
| 8.3
| colspan="2" {{n/a}}
| {{no}}
| {{yes}}
| {{no}}
|-
| 9.0
| colspan="3" {{no}}
| {{yes}}
| {{no}}
|-
| 9.0.2
| colspan="3" {{no}}
| {{yes}}
| {{no}}
|}

== Download ==
{| class="wikitable" style="text-align:center;"
! Version
! Download
! SHA-1
|-
| 0.1
| [http://dayt0n.github.io/odysseus/odysseus-0.1.zip dayt0n.com]
| a7ebd3743479a66b7502af947f6967cb4b54b54a
|-
| 0.2
| [http://dayt0n.github.io/odysseus/odysseus-0.2.zip dayt0n.com]
| 812cd80725003f1aed897eebe623b5fb39500510
|-
| 0.3
| [http://dayt0n.github.io/odysseus/odysseus-0.3.zip dayt0n.com]
| 8aedd1af2e3e96b58d7ab5e2f58fbcf76ad08411
|-
| 0.4
| [http://dayt0n.github.io/odysseus/odysseus-0.4.zip dayt0n.com]
| 2f8f368b047f66a96bf2e51ab228cdde2435444a
|-
| 0.99
| [http://dayt0n.github.io/odysseus/odysseus-0.99.zip dayt0n.com]
| fc98665bce96f406eafeb8d4f8745f70a08f62c8
|-
| 0.999
| [http://dayt0n.github.io/odysseus/odysseus-0.999.zip dayt0n.com]
| 23717f90a6b5bf847b996648be4c06046bc590b
|-
|}

== Links ==

* [[OdysseusOTA]], a derivative tool for downgrading certain devices to iOS 6.1.3
* [[OdysseusOTA2]], like OdysseusOTA, but for downgrading to iOS 8.4.1
* [http://dayt0n.com/articles/Odysseus/ Official page]
* [https://github.com/xerub/xpwn GitHub]
* [https://www.reddit.com/r/jailbreak/comments/3r9o4i/release_iphone_4_4s_5_5c_ipad_2_3_bundles_for/ Unofficial bundles]
* [https://www.reddit.com/r/jailbreak/comments/6orfvh/discussion_i_made_iphone_4s_ios_80812_82_83_12f69/ Unofficial bundles]

[[Category:Software]]
[[Category:Downgrading]]

Ios-kexec-utils

2017-12-25T21:58:09Z

Gjest: Created page with "{{DISPLAYTITLE:ios-kexec-utils}} '''ios-kexec-utils''' are a set of four iOS command line utilities written by winocm, originally designed to make booting another OS easier. T..."

{{DISPLAYTITLE:ios-kexec-utils}}
'''ios-kexec-utils''' are a set of four iOS command line utilities written by winocm, originally designed to make booting another OS easier. Though described as “probably crap” by winocm herself, they have paved the way for a range of tools for 32-bit devices, including Odysseus (including derivative works such as OdysseusOTA and Beehind) and CoolBooter, as well as futurerestore’s ability to downgrade 32-bit devices. Use cases include dumping onboard SHSH blobs, downgrading to OTA signed firmware, downgrading to unsigned firmware with blobs and dual booting.

== Utilities ==
Of the four utilities, kloader and multi_kloader must be executed on-device to “perform the magic”, while img3maker and ibsspatch just produce files and can be compiled for and run on any platform.

=== img3maker ===
'''img3maker''' is a tool that, offering a variety of options, makes an [[Img3]] file container for a given file. This is needed for the decrypted boot chain.

=== ibsspatch ===
'''ibsspatch''' is a generic [[iBSS]] patcher for iOS 7.

=== kloader ===
'''kloader''' ('''''k'''ernel '''loader''''') is an image loader for the kernel, that loads a custom image into RAM and bootstraps it. It must be executed on the device and requires access to the kernel memory through <code>task_for_pid(0)</code> (tfp0), but can be adapted to use the equivalent <code>host_get_special_port(4)</code> instead. Needless to say, kloader is thus unable to run on unjailbroken firmware.

The three main use cases for kloader are:
# Downgrading: kloader is used to bootstrap a custom iBSS image that has been patched out of all integrity checks. This allows a custom ramdisk with a custom [[ASR]] to be used, which in turn allows a system restore to finish without ASR ruining the process when the signatures don’t match. The ability to use any ramdisk also makes it possible to use OTA blobs instead of regular ERASE/UPDATE blobs. It can also be abused to restore with invalid blobs and thus on purpose render the device unbootable.
# Dual booting: kloader is used to bootstrap custom iBSS and iBEC images that also have been patched to boot the system on partition <code>/dev/disk0s1s3</code> instead of the main system. Additional patches down the bootchain are required.
# Dumping onboard SHSH blobs: kloader is used to bootstrap custom iBSS and iBEC images that have been patched in the same way as when downgrading. [[iRecovery]] is then used to upload xerub’s ibex payload and dump the blobs.

On iOS 6 hosts, kloader will be paused when locking the screen if run directly from MTerminal. There are ways to get around this, for example by using the GUI utility Way Out, or by launching kloader over ssh (OpenSSH must be installed and enabled): <code>ssh root@localhost</code>, then e.g. <code>kloader /iBSS</code>.

=== multi_kloader ===
'''multi_kloader''' extends kloader’s functionality by loading two images into memory instead of one. It is especially useful for dual booting iPods and iPhones, as it can load both iBSS and iBEC directly, without having to use [[iRecovery]] on a computer to bootstrap iBEC after loading iBSS. multi_kloader is used by dual boot utilities CoolBooter and Way Out.

== Further development ==
The last commit was pushed by winocm on 31 March, 2014, ten days after she announced that she would be joining Apple later that year. The project was left compatible with iOS 6 and 7 (the most recent firmware at the time) and was 32-bit only.

axi0mX later updated kloader to support iOS 4 and 5, and also introduced experimental support for 64-bit devices running iOS 7 or 8.

== External links ==
* [https://github.com/ramytuki/ios-kexec-utils ios-kexec-utils] on GitHub

[[Category:Software]]
[[Category:Jailbreaking]]

Saïgon

2017-12-25T17:29:15Z

Gjest: links ++

{{Infobox software
| name = Saïgon
| title = Saïgon
| developer = [https://twitter.com/cheesecakeufo Abraham Masri (@cheesecakeufo)]
| released = {{Start date|2017|10|15|df=yes}}
| latest release version = beta 3
| latest release date = {{Start date and age|2017|12|10|df=yes}}
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [https://iabem97.github.io/saigon_website/ GitHub Page - Saïgon]
}}
'''Saïgon''' is a [[semi-untethered jailbreak]] for certain 64-bit devices, running iOS 10.2.1, developed by cheesecakeufo. Saïgon works by sideloading an IPA using [[Cydia Impactor]]. The first beta was released on 15 October, 2017. It was announced that support for [[iPhone 6s]] on iOS 10.3.1 would come in the future.

Originally based on Adam Donenfeld’s ziVA exploit, Saïgon has been based on Siguza’s [[v0rtex]] exploit since beta 3.

== Version Change Log ==
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| beta 1
| October 15, 2017
|
*Initial release with support for the following devices:
**[[iPhone 6]]
**[[iPhone 6 Plus]] (10.2.1)
**[[iPhone SE]] (10.2.1) (not tested)
**[[iPhone 6s]] (10.2.1) (not tested)
**[[J81AP|iPad Air 2 (Wi-Fi)]] (10.2.1) (not tested)
|-
| beta 2
| October 21, 2017
|
*Fix for camera not working after jailbreaking
*Support for [[iPhone 6s Plus]]/[[iPad mini 4]]/[[iPad Air 2]]
*Minor bug fixes and changes
*Slightly better at escaping sandbox
*Option to reinstall [[Cydia]] by holding 'jailbreak' button then tapping it again
*Display device model and version
|-
| beta 2 revision 1
| October 21, 2017
|
*Disables Cydia stashing
*Add support for [[iPod touch (6th generation)]]
|-
| beta 3
| December 10, 2017
|
*Significantly better success rate using new exploit (v0rtex)
*Support for more devices (not tested)
*Complete re-write of the application
|}

== See also ==
* [[h3lix]], a 32-bit counterpart
* [[v0rtex]]

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

H3lix

2017-12-25T17:26:44Z

Gjest: links

{{lowercase}}{{Infobox software
| name = h3lix
| title = h3lix
| developer = [https://twitter.com/tihmstar tihmstar] [https://twitter.com/s1guza Siguza]
| released = {{Start date|2017|12|24|df=yes}}
| latest release version = RC 1
| latest release date = {{Start date and age|2017|12|24|df=yes}}
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [https://h3lix.tihmstar.net/ h3lix.tihmstar.net]
}}
'''h3lix''' is a [[semi-untethered jailbreak]] for 32-bit devices running any version of iOS 10, developed by tihmstar and Siguza. h3lix works by sideloading an IPA using [[Cydia Impactor]]. The first release candidate was released on 24 December, 2017. It is one of two jailbreak projects based on the v0rtex exploit, the other being [[Saïgon]] for 64-bit devices.

== History ==

=== Background ===
Since Apple’s transition to 64-bit in 2013, the market share of their 32-bit devices has been steadily shrinking. During the lifespan of iOS 9, the 32-bit share reached a level low enough for jailbreak developers to start dropping 32-bit support altogether. The iOS 10 jailbreaks released in late 2016 and early 2017 continued this trend and left the last supported 32-bit devices, namely the A6 devices, unjailbreakable.

Early 2017 saw renewed interest in the 32-bit deivces, with the release of the [[Home Depot]] jailbreak for iOS 9.1-9.3.4, as well as the iDeviceReRestore tool for restoring to iOS 9 using saved blobs, and the combination of them provided a jailbreak solution for 32-bit devices that had been stuck on iOS 10. Apple silently and effectively killed off iDeviceReRestore as an escape route in July 2017, by exploiting the introduction of a new activation method in iOS 10 to reject activation records coming from A6 devices on iOS 9 and older, if they had ever been activated on iOS 10. By then, the focus of jailbreak developers had already started shifting to the upcoming iOS 11, and it was feared that both iOS 9.3.5 and iOS 10 would remain unjailbreakable on 32-bit. Soon after, however, no less than four jailbreaks were released for 32-bit devices ([[Phœnix]], [[UntetherHomeDepot]], [[etasonJB]] and [[Home Depot]] 1.1 for 8.4.1). At that point all pre-A6 devices were jailbreakable for life, and hopes grew for a final 32-bit jailbreak.

=== Development ===
At least one of the exploits that powered the iOS 10 jailbreaks, mach_portal by [[Ian Beer]] of the Google Zero project, could in theory be ported to 32-bit. Beer used another vulnerability he discovered, CVE-2017-13861, to write the async_exploit for iOS 11, inspiring Siguza to write an exploit that was compatible with 64-bit iOS 10, named [[v0rtex]], on which he published an article in early December of 2017.<ref>[https://siguza.github.io/v0rtex/ v0rtex | IOSurface exploit]</ref> v0rtex quickly replaced Adam Donenfeld’s ziVa exploit in the [[Saïgon]] project, and it was expected that porting it to 32-bit would be feasible. About a week later, tihmstar announced that he and Siguza had in fact done so,<ref>[https://twitter.com/tihmstar/status/940751131709292545 @tihmstar: We just ported v0rtex to 32bit :D @s1guza is going insane lately!]</ref> and as the duo were responsible for the [[Phœnix]] jailbreak a few months earlier, users hoped that this meant that a 32-bit jailbreak was imminent. Screenshots were posted by tihmstar as the development progressed, and the user community was involved with choosing the name and designing the app and logo. Credits were given to @FoxletFox for the graphics and Jacky C for the logo concept.

The first release candidate of h3lix was then published on tihmstar’s website on Christmas Eve, successfully tested with iOS 10.3.3 on the [[N42AP]] (iPhone5,2). Users found it to be compatible with other A6 devices on the same version, while some also reported problems when attempting to use it on older iOS 10 versions.<ref>[https://www.reddit.com/r/jailbreak/comments/7lvufg/release_tihmstar_releases_ios_10x_h3lix_jailbreak/ <nowiki>[Release]</nowiki> Tihmstar releases iOS 10.x H3lix jailbreak for 32bit devices]</ref>

Being the last version offered for the A6 devices, iOS 10 was considered by some users to be slower and less usable than older versions, making downgrading one of the main use cases for this jailbreak. Like some other jailbreaks, h3lix does not enable <code>task_for_pid(0)</code>, but tihmstar announced that it does have the equivalent <code>host_get_special_port(4)</code> instead.<ref>[https://twitter.com/tihmstar/status/945184098808664064 @tihmstar: In case you were wondering: There is no tfp0 in h3lix, however there is hfsp(4). I verified it works by using ios-kern-utils.]</ref> For kloader-based downgrades to work, kloader must be recompiled using <code>host_get_special_port(4)</code> instead.

=== Version Change Log ===
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| RC 1
| 24 December, 2017
| Initial release
|}

== See also ==
* [[Saïgon]]
* [[v0rtex]]

== References ==
<references />

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

V0rtex

2017-12-25T17:25:57Z

Gjest: Created page with "{{DISPLAYTITLE:v0rtex}} '''v0rtex''' is a software exploit in IOSurface written by Siguza, based on vulnerabilities discovered by white-hat hacker Ian Beer of the Google Zero..."

{{DISPLAYTITLE:v0rtex}}
'''v0rtex''' is a software exploit in IOSurface written by Siguza, based on vulnerabilities discovered by white-hat hacker Ian Beer of the Google Zero project. It covers all versions of iOS 10, whereas Beer’s own async_wake exploit covers 11.0-11.1.2.

The v0rtex exploit proved to be suitable for jailbreaks, and powers two jailbreak projects: [[Saïgon]] (ARM64), where it replaced the ziVa exploit, and [[h3lix]] (ARMv7s). iOS 10.3.3 is the final version for all A6 devices, and also an OTA signed version for some A7 devices, making both jailbreaks extra relevant.

== See also ==
* [[h3lix]]
* [[Saïgon]]

== External links ==
* [https://siguza.github.io/v0rtex/ v0rtex | IOSurface explot] by Siguza

[[Category:Exploits]]

H3lix

2017-12-25T17:03:35Z

Gjest: background and development

{{lowercase}}{{Infobox software
| name = h3lix
| title = h3lix
| developer = [https://twitter.com/tihmstar tihmstar] [https://twitter.com/s1guza Siguza]
| released = {{Start date|2017|12|24|df=yes}}
| latest release version = RC 1
| latest release date = {{Start date and age|2017|12|24|df=yes}}
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [https://h3lix.tihmstar.net/ h3lix.tihmstar.net]
}}
'''h3lix''' is a [[semi-untethered jailbreak]] for 32-bit devices running any version of iOS 10, developed by tihmstar and Siguza. h3lix works by sideloading an IPA using [[Cydia Impactor]]. The first release candidate was released on 24 December, 2017. It is one of two jailbreak projects based on the v0rtex exploit, the other being [[Saïgon]] for 64-bit devices.

== History ==

=== Background ===
Since Apple’s transition to 64-bit in 2013, the market share of their 32-bit devices has been steadily shrinking. During the lifespan of iOS 9, the 32-bit share reached a level low enough for jailbreak developers to start dropping 32-bit support altogether. The iOS 10 jailbreaks released in late 2016 and early 2017 continued this trend and left the last supported 32-bit devices, namely the A6 devices, unjailbreakable.

Early 2017 saw renewed interest in the 32-bit deivces, with the release of the [[Home Depot]] jailbreak for iOS 9.1-9.3.4, as well as the iDeviceReRestore tool for restoring to iOS 9 using saved blobs, and the combination of them provided a jailbreak solution for 32-bit devices that had been stuck on iOS 10. Apple silently and effectively killed off iDeviceReRestore as an escape route in July 2017, by exploiting the introduction of a new activation method in iOS 10 to reject activation records coming from A6 devices on iOS 9 and older, if they had ever been activated on iOS 10. By then, the focus of jailbreak developers had already started shifting to the upcoming iOS 11, and it was feared that both iOS 9.3.5 and iOS 10 would remain unjailbreakable on 32-bit. Soon after, however, no less than four jailbreaks were released for 32-bit devices ([[Phœnix]], [[UntetherHomeDepot]], [[etasonJB]] and [[Home Depot]] 1.1 for 8.4.1). At that point all pre-A6 devices were jailbreakable for life, and hopes grew for a final 32-bit jailbreak.

=== Development ===
At least one of the exploits that powered the iOS 10 jailbreaks, mach_portal by [[Ian Beer]] of the Google Zero project, could in theory be ported to 32-bit. Beer used another vulnerability he discovered, CVE-2017-13861, to write the async_exploit for iOS 11, inspiring Siguza to write an exploit that was compatible with 64-bit iOS 10, named v0rtex, on which he published an article in early December of 2017.<ref>[https://siguza.github.io/v0rtex/ v0rtex | IOSurface exploit]</ref> v0rtex quickly replaced Adam Donenfeld’s ziVa exploit in the [[Saïgon]] project, and it was expected that porting it to 32-bit would be feasible. About a week later, tihmstar announced that he and Siguza had in fact done so,<ref>[https://twitter.com/tihmstar/status/940751131709292545 @tihmstar: We just ported v0rtex to 32bit :D @s1guza is going insane lately!]</ref> and as the duo were responsible for the [[Phœnix]] jailbreak a few months earlier, users hoped that this meant that a 32-bit jailbreak was imminent. Screenshots were posted by tihmstar as the development progressed, and the user community was involved with choosing the name and designing the app and logo. Credits were given to @FoxletFox for the graphics and Jacky C for the logo concept.

The first release candidate of h3lix was then published on tihmstar’s website on Christmas Eve, successfully tested with iOS 10.3.3 on the [[N42AP]] (iPhone5,2). Users found it to be compatible with other A6 devices on the same version, while some also reported problems when attempting to use it on older iOS 10 versions.<ref>[https://www.reddit.com/r/jailbreak/comments/7lvufg/release_tihmstar_releases_ios_10x_h3lix_jailbreak/ <nowiki>[Release]</nowiki> Tihmstar releases iOS 10.x H3lix jailbreak for 32bit devices]</ref>

Being the last version offered for the A6 devices, iOS 10 was considered by some users to be slower and less usable than older versions, making downgrading one of the main use cases for this jailbreak. Like some other jailbreaks, h3lix does not enable <code>task_for_pid(0)</code>, but tihmstar announced that it does have the equivalent <code>host_get_special_port(4)</code> instead.<ref>[https://twitter.com/tihmstar/status/945184098808664064 @tihmstar: In case you were wondering: There is no tfp0 in h3lix, however there is hfsp(4). I verified it works by using ios-kern-utils.]</ref> For kloader-based downgrades to work, kloader must be recompiled using <code>host_get_special_port(4)</code> instead.

=== Version Change Log ===
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| RC 1
| 24 December, 2017
| Initial release
|}

== References ==
<references />

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

H3lix

2017-12-25T05:05:16Z

Gjest: non-breaking space in “iOS 10”, beta --> rel. cand. ++

PhœnixNonce

2017-10-23T04:09:53Z

Gjest: Created page with "{{Infobox software | name = PhœnixNonce | title = PhœnixNonce | developer = Siguza [http://www.twitte..."

{{Infobox software
| name = PhœnixNonce
| title = PhœnixNonce
| developer = [[User:Siguza|Siguza]] [http://www.twitter.com/tihmstar @tihmstar] [https://twitter.com/REALKJCMEMBER jk9357] Samuel Groß Pupyshev Nikita comex
| released = {{Start date|2017|08|16|df=yes}}
| latest release version = 1.1
| latest release date = {{Start date and age|2017|08|17|df=yes}}
| operating system = iOS
| language = English
| genre = System/Backup/Restoring
| license = MIT
| website = [https://github.com/Siguza/PhoenixNonce/releases Siguza’s GitHub page]
}}
'''PhœnixNonce''' is an open-source combined nonce setter and [[APTicket]] dumper utility for 64-bit versions of iOS 9.3.4 and 9.3.5. It was released on 16 August, 2017 as a pure nonce setter, with the APTicket dumping capability being added with version 1.1, released on the 17th. It is installed by side-loading an IPA using [[Cydia Impactor]], and dumped tickets are retrieved using the app File Sharing functionality in iTunes.

Unlike [[Phœnix]], PhœnixNonce is not a full-fledged jailbreak. All A5 users, as well as A6 users with saved blobs, can restore to iOS 9.3.5, meaning that there was a demand for a 32-bit jailbreak. Of the 64-bit devices, however, none can be restored to iOS 9.3.x, and as the number of users on 9.3.4 and 9.3.5 are ever decreasing, a full jailbreaking solution was not thought to be necessary. Users of 9.3.3 and older are covered by Pangu9, while users of 10.0 and newer are covered by yalu/yaluX and Saigon. The purpose of PhœnixNonce is to allow users who saved blobs for newer firmware to be able to restore using those blobs.

iOS 10.3.3 is no longer signed for most devices, rendering the tool useless for restoring them to iOS 10.x. It can, however, be used to restore to version 11.0 or higher. It might also be possible for users of A7 devices that started on iOS 7.0.x (including, most notably, the iPhone 5S and iPad Air) to restore using 10.2-10.3.3 blobs and a 10.3.3 OTA build manifest, since 10.3.3 is still OTA signed for these devices.

== Version history ==
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| v1
| 16 August, 2017
| Initial release
|-
| v2
| 17 August, 2017
| Option for dumping APTicket added
|}

== See also ==
* [[Phœnix]]

Phœnix

2017-10-23T03:27:56Z

Gjest: links to related articles

{{Infobox software
| name = Phœnix
| title = Phœnix
| developer = [[User:Siguza|Siguza]] [http://www.twitter.com/tihmstar @tihmstar] [https://twitter.com/REALKJCMEMBER jk9357] [https://twitter.com/mbazaliy Max Bazaliy] [[User:qwertyoruiop|Luca Todesco]]
| released = {{Start date|2017|08|07|df=yes}}
| latest release version = v4
| latest release date = {{Start date and age|2017|10|07|df=yes}}
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = https://www.phoenixpwn.com
}}
'''Phœnix''' is a [[semi-untethered jailbreak]] for 32-bit devices, primarily intended for devices running iOS 9.3.5. The exploit was written by [[User:Siguza|Siguza]] and [https://twitter.com/tihmstar tihmstar], with [https://twitter.com/REALKJCMEMBER jk9357] providing extensive contributions, and further assistance from [https://twitter.com/mbazaliy Max Bazaliy] and [[User:qwertyoruiop|Luca Todesco]]. Like its predecessor, [[Home Depot]], Phœnix works by sideloading an IPA using [[Cydia Impactor]]. Released on 7 August, 2017, almost a year after the release of iOS 9.3.5, it brought a long-awaited jailbreaking solution to devices for which iOS 9.3.5 is the only signed version. Phœnix exploits the fact that Apple never properly fixed the vulnerabilities exploited by Home Depot (Pegasus). It is not yet known if it is compatible with iOS 8.4.1, but the IPA can be installed on iOS 8.4.1 and higher.

== Version Change Log ==
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| v1
| rowspan="2" | August 7, 2017
|
*Initial release
|-
| v2
|
*Removes problematic binaries that resulted in multiple scripts breaking. Thanks to angelXwind for pointing this out. :)
*Fixes a problem with LaunchDaemons not starting after re-jailbreaking.
*Fixes a problem in '''Mixtape Player''' where lyrics did not display correctly using Dark Mode.
*Fixes a problem in '''Mixtape Player''' where seeking would result in graphical glitches.
*"Better Not Lack" (track 12) now appears correctly in '''Mixtape Player'''.
*Temporarily disable Dark Mode in Mixtape Player by firmly pressing the app icon and choosing “'''Mixtape Player'''”.
|-
| v3
| August 8, 2017
|
*Fixed custom offsets
|-
| v4
| October 7, 2017
|
*Adds the option to force a complete reinstall by holding down on "Kickstart Jailbreak".
*Fixes two crashes when contacting phoenixpwn.com for offsets if...
**...there is an SSL error.
**...a status code of 200 is returned, but the response body is empty.
|}

== Controversy ==
The release of Phœnix was not uncontroversial and sparked a conflict between the developers and Stefan Esser ([[i0n1c]]), as well as one between jk9357 and tihmstar in particular.

Esser had started a crowdfunding campaign through Kickstarter for an online iOS 9.3.5 jailbreaking course and felt betrayed by tihmstar, accusing him of backstabbing. tihmstar denied receiving help from Esser, and Luca Todesco noted that jk9357 announced a jailbreak before Esser's campaign. While Home Depot contains code written by Stefan Esser used "without his consent" according to its credits, Phœnix features another joke at Esser's expense, as the "Enable jailbreak" button from Home Depot has been renamed "Kickstart jailbreak."

After a misattribution on Phœnix's website, [https://twitter.com/REALKJCMEMBER/status/894390510051360769 jk9357 wrote a complaint on Twitter] regarding his absence from Phœnix's credits. The issue was promptly resolved and the attribution corrected.

The conflict between jk9357 and tihmstar flared up again after the release of [[etasonJB]], with jk9357 criticizing tihmstar in a post written in all-caps on /r/jailbreak, calling him a fraud and insinuating that he had stolen code from Siguza. He followed up by updating Home Depot with 8.4.1 support and by posting [https://twitter.com/REALKJCMEMBER/status/911947826829160448 an infographic] on Twitter with further accusations against tihmstar. Following this and a Reddit post, Siguza explained the situation and shed light on the development of Phœnix, on Discord as well as in a [https://twitter.com/s1guza/status/912210952409542656 series of tweets]. According to him, the initial, non-working version of the kernel exploit was written by him, then ~80 percent of the code was refactored by tihmstar before the two sent the code back and forth several times. Eventually tihmstar increased the stability from 50 to 90 percent. Advice was provided by Max Bazaly and a heap spray was replaced with code provided by Luca Todesco. Siguza also [https://twitter.com/s1guza/status/912223010408603649 took the blame] for the misattribution issue, saying that he wrote the Phœnix website and intended to write something like “jk9357 - UI, App framework and patchfinder”, but that he was interrupted after writing only “UI” and forgot to correct the mistake before publishing the site.

== See also ==
* [[Cydia Impactor]]
* [[Home Depot]]
* [[etasonJB]]
* [[PhœnixNonce]]

== External Links ==
* [http://www.phoenixpwn.com/ Home page]

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Activation

2017-10-16T00:49:11Z

Gjest:

[[Image:foto.jpg|thumb|right|iPhone with 1 signal bar and damaged [[hacktivation]] or it doesn't have an internet connection|100px]]

'''Activation''' is the process by which a new (or newly restored) iPhone or iPod touch can get by the "Emergency Call Screen" ([[List of iPhones|iPhone]]) or "Connect to iTunes" screen (not to be confused with [[Recovery Mode]]; the activation screen has a battery icon in the top right corner to indicate this) to access the SpringBoard.

The code in charge of this resides in [[lockdownd]], which is always running on [[iOS]] and monitors the activation status of the device. Lockdownd patches (which requires a [[jailbreak]] whereby a patched kernel can be booted by [[iBoot (Bootloader)|iBoot]] without dynamic libraries dynamically patching in RAM) activate your phone and remove the need to activate legitimately through [[iTunes]] with an official carrier (this process is also called "[[hacktivation]]"), however the iPhone cannot be used to communicate unless an [[unlock]] is found for the [[baseband]]. Lockdownd patches are only used on the [[List of iPhones|iPhone]] as the [[List of iPod touches|iPod touch]] has never been denied activation regardless of firmware, country etc.

Activation is handled by https://albert.apple.com/deviceservices/deviceActivation

[[iTunes]] generates an [[Activation Token]] and sends it to Apple's activation server. Once the [[Activation Token]] is validated, the server will generate a [[WildcardTicket]] and signs it with Apple's private key. [[iTunes]] then calls AMDeviceActivate with the [[WildcardTicket]]; The device gets the [[WildcardTicket]] and checks if the signature matches. If it does, it get pasts the emergency call screen and allowing the use of the iPhone. All devices actually go through this process. The activation process is outlined in detail in US patent no. [http://www.freepatentsonline.com/20090061934.pdf 2009/0061934].

Although the [[List of iPod touches|iPod touch]] can be "activated" without an internet connection, some services such as YouTube and Push Notifications will fail to work due to not having a valid authentication token ([http://support.apple.com/kb/TS3305 iPad and iPod touch: Unable to use YouTube or Push notifications]) so connecting to iTunes will activate the [[List of iPod touches|iPod touch]] fully.

The [[List of iPhones|iPhone]] needs a cellular data connection for the first time, after the activation in [[iTunes]]. You can make calls if an alert says "iPhone is activated". If you don't have a cellular data connection (3G, EDGE, GPRS) you won't be able to make calls and you have only 1 bar of reception. If you only have 1 bar and no carrier at the status bar, it isn't activated correctly.

[[SAM]] (Subscriber Artificial Module) can simulate official activation for hacktivated devices.

== See Also ==
* [[Activation Token]]

== External Links ==
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]
* [http://www.freepatentsonline.com/20090061934.pdf Apple Patent]

{{stub|firmware}}

[[Category:Baseband]]

Home Depot

2017-10-10T06:35:57Z

Gjest: rewriting lede to reflect the fact that 8.4.1 support is under development and currently restricted to A5 devices

{{Infobox software
| name = Home Depot
| title = Home Depot
| developer = [https://twitter.com/REALKJCMEMBER jk9357]
| released = {{Start date|2017|01|29|df=yes}}
| latest release version = v1.1 beta 1
| latest release date = {{Start date and age|2017|09|24|df=yes}}
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [http://wall.supplies/OLD%20iPhone%20HACKED.html wall.supplies]
}}
'''Home Depot''' is a [[semi-untethered jailbreak]] for 32-bit devices on iOS 9.1 - 9.3.4. It was written by [https://twitter.com/REALKJCMEMBER jk9357]. It works by sideloading an IPA using [[Cydia Impactor]]. The first beta of version 1.1, offered as a separate download, added support for iOS 8.4.1 on [[A5]] devices.

== History ==
=== Background ===
In August 2016 it was discovered that three serious vulnerabilities had been exploited by a spyware named Pegasus. It was revealed that the malware had probably been out in the wild for a significant amount of time, and that it showed signs of having a kernel mapping table with values for versions stretching as far back as iOS 7. Apple released iOS 9.3.5 shortly thereafter, which supposedly patched the vulnerabilities CVE-2016-4655, CVE-2016-4656 and CVE-2016-4657. The incident was thoroughly covered in newspapers all over the world, and users were urged to update. Despite the seriousness of these vulnerabilities and the fact that the Pegasus spyware already exploited them, a jailbreak based on them was not seen. With PanGu for 64-bit only iOS 9.2 to 9.3.3 released just a few weeks earlier, in late July, and iOS 10 being released in September, only those who chose to stay on 9.3.4 and users of 32-bit devices, a small and ever shrinking minority, would have benefited from another iOS 9 jailbreak.

=== Trident and Trident+kloader ===
Hopes of another 32-bit jailbreak faded, as the two last jailbreaks were 64-bit only and the focus shifted to iOS 10. Several users asked if the [[iPhone 4S]] would be the first iPhone not to be jailbreakable on its final firmware. Eventually the Trident project was released, which used two of the Pegasus exploits (CVE-2016-4655 and CVE-2016-4656) to gain root access on iOS 9.3.4 and older. Trident was later paired with kloader to form Trident+kloader, which allowed users to downgrade using [[Odysseus]] and [[OdysseusOTA]]/[[OdysseusOTA2]].

=== The full-fledged jailbreak is released ===
When Home Depot finally was released in January 2017, it was the first 32-bit jailbreak in more than a year. The news were bittersweet for many users, as they discovered that the solution was semi-tethered and that it did not support iOS 9.3.5. On the other hand, it proved that there was still a market for 32-bit jailbreaks. Home Depot became available to more users a couple of months later, when [[iDeviceReRestore]] was released, allowing users who had saved iOS 9 SHSH blobs and APTickets to downgrade.

==== Legacy ====
Since older iOS versions were vulnerable to the same exploits, several attempts were made to get Home Depot working on iOS 8.4.1, a then unjailbreakable version to which most 32-bit devices could OTA downgrade. For a while rumours were flying that the Fried Apple Team would port the 64-only Yalu for 8.4.1 jailbreak to 32-bit and also release a 32-bit compatible iOS 9.3.5 jailbreak. The community saw a renewed interest in porting Home Depot to 8.4.1 during the spring and early summer of 2017, when these rumours had turned out to be false.

Three similar or derivative products were released during the late summer of 2017:

# [[Phœnix]], a semi-tethered jailbreak for 9.3.5 exploiting the fact that Apple had not properly patched the Pegasus exploits

# [[#UntetherHomeDepot|UntetherHomeDepot]] (originally BetterHomeDepot), an untether for Home Depot (iOS 9.1-9.3.4)

# [[EtasonJB]], an iOS 8.4.1 compatible untethered jailbreak released after unsuccessful attempts to get Home Depot working on iOS 8

=== Version Change Log ===
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| "JailBreak" (first beta release)
| ?
| Initial beta release
|-
| "JailBreakMoreDevices" (second beta)
| ?
| More devices supported
|-
| "iPhone53932" (third beta)
| ?
| Fix for iPhone5,3 on iOS 9.3.2
|-
| "iPhone52932" (fourth beta)
| ?
| Fix for iPhone5,2 on iOS 9.3.2
|-
| "Make Mexico Pay For It" (fifth beta)
| ?
| Experimental support for more devices
|-
| Revision 1
| rowspan="6"| 29 Jan 2017
| Initial release
|-
| Revision 2
| Fix for Cydia not appearing
|-
| Revision 3
| Real fix for Cydia not appearing
|-
| Revision 4
| Fix for app crashing
|-
| Revision 5
| Fix for tfp0
|-
| Revision 6
| [[iPad 2]] fix for some iOS versions
|-
| Revision 7
| 30 Jan 2017
| Fix for broken LwVM patch
|-
| Release Candidate 1
| 19 Mar 2017
|
*Added 3 bonus tracks to '''Mixtape Player''': Lay Low, Purple Demo (KJC Edit), KJC Anthem Pt. 4 (Feat. Jailbreakbusters, Qwerty, Tihmstar & rg0rd)
*'''Mixtape Player''' now displays song lyrics
*Seek backwards in '''Mixtape Player''' to hear your favorite part of the track again
*Rearrange tracks in Up Next in '''Mixtape Player'''
*Fixes an issue where the volume slider in '''Mixtape Player''' would not appear on some devices
*Fixes an issue where the Home Depot label would not be aligned properly while in the launch screen
*Saves a jailbreak log, which is available in iTunes File Sharing
*No longer extracts iosbinpack
*No longer installs Droplets wallpaper
*Treats "Enable Jailbreak" as "Prepare For Jailbreak" including re-extracting Cydia when file /.installed_home_depot is not present
*Support for every 32-bit device on iOS 9.1-9.3.4 (Beta, requires internet connection)
*Improved reliability on [[iPod touch (5th generation)]]
|-
| Release Candidate 2
| 22 Mar 2017
| Fix for Cydia not installing
|-
| Release Candidate 3
| 25 Mar 2017
|
*Improved reliability of re-extracting Cydia
*No longer installs Dropbear
*Fixes an issue with LwVM patch which would result in failure on iOS 9.3.1
|-
| 1.1 beta 1
| 24 Sep 2017
|
*Mixtape Player now has three themes: Default, Dark and Texas
*Fixes an issue where the captcha did not appear when attempting to download the mixtape
*Rearrange tracks in Up Next in Mixtape Player
*Improved appearance of Mixtape Player on iPad Pro
*"Install Cydia" now supports iOS 8.4.1 on select devices
*May break "Install Cydia" compatibiliy with iOS versions greater than 8.4.1
|}


== UntetherHomeDepot ==
{{Infobox software
| name = UntetherHomeDepot
| title = UntetherHomeDepot
| developer = [http://www.twitter.com/tihmstar @tihmstar]
| released = {{Start date|2017|08|18|df=yes}}
| latest release version = 1.4.2
| latest release date = {{Start date and age|2017|09|10|df=yes}}
| programming language =
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [http://repo.tihmstar.net/ tihmstar’s repo]
}}
On August 18, an untethered jailbreak (based off of Home Depot) was released on [http://repo.tihmstar.net tihmstar's APT repository]. Originally called BetterHomeDepot, the package was later renamed UntetherHomeDepot with the release of version 1.1.

[https://twitter.com/qwertyoruiopz/status/898676150020390912 Luca Todesco] advised people to not use it, citing its potential to bootloop devices. The exploits used were labeled “not production grade”. An alternative stage1 exploit was later added.

The development was declared to be finished on 10 September, 2017, with the release of Community Offsets by @stek29.

=== Version Change Log ===
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| 1.0.0
| 18 Aug 2017
|
* Initial release
|-
| 1.0.1
| 19 Aug 2017
|
* Added support for iPad3,3 (9.3.2)
|-
| 1.0.2
| 20 Aug 2017
|
* Added support for iPhone4,1 (9.3.2) and iPad2,4 (9.3.3)
|-
| 1.1.0
| 21 Aug 2017
|
* Fixed deepsleep bug
* Package name changed to UntetherHomeDepot (the identifier was changed from <code>net.tihmstar.betterhomedepot</code> to <code>net.tihmstar.untetherhomedepot</code>)
|-
| 1.2
| 25 Aug 2017
|
* Fixed a bug where having a passcode would disable untether
|-
| 1.3
| 2 Sep 2017
|
* Fixed lwvm patch (bug where 9.3.1 rootfs was ro)
|-
| 1.4.0
| rowspan="2" | 3 Sep 2017
| rowspan="2" |
* Added support for 9.2.1
* Refusing to install when stage1 doesn’t work (to prevent bootloops)
* Alternative stage1 exploit
|-
| 1.4.1
|-
| 1.4.2
| 10 Sep 2017
|
* Community Offsets (<code>net.tihmstar.untetherhomedepotoffsets</code>) was released
|-
|}

== External Links ==
* [http://www.wall.supplies/ Home page]
* [http://pastebin.com/a91ywvEW Extra Offsets] (will add more when found)
* [https://www.reddit.com/r/jailbreak/comments/5vpuyf/discussion_list_of_all_iphone_all_ipad_will_be/ A redditor who claims to have found all the offsets]

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]