KBAG

2009-05-20T03:37:51Z

Him121213:

==Explanation==
In Apple's new IMG3 security scheme, they have used something called a KBAG. At the bottom of a firmware file, you will see something that will, on the ASCII side of your hex editor, see "GABK", which is "KBAG" flipped. Look on the hex side and you will the KBAG according to this format:

==KBAG Format==
===KBAG128===
<pre>
typedef struct Unparsed_KBAG_128 {
char[4] magic; // string with bits flipped = "KBAG" (magic = 0x4741424B)
int tagFullSize; // size of KBAG from beyond that point to the end of it
int tagDataSize; // size of just the tag info, not this 0xC "header"
int IV_Key_Crypt_state; // 1 if the key and IV in the KBAG are encrypted with the GID key, 0 if not.
int AES_Type; // 0x80 = aes128 / 0xc0 = aes192 / 0x100 = aes256
char[16] Enc_IV; // IV for the firmware file, encrypted with the gid key
char[16] Enc_Key; // Key for the firmware file, encrypted with the gid key.
} Unparsed_KBAG_AES128;
</pre>

===KBAG192===
<pre>
typedef struct Unparsed_KBAG_AES192 {
char[4] magic; // string with bits flipped = "KBAG" (magic = 0x4741424B)
int fullSize; // size of KBAG from beyond that point to the end of it
int unk1; // 8 less than fullSize. not sure what it is exactly.
int IV_Key_Crypt_state; // 1 if the key and IV in the KBAG are encrypted with the GID key, 0 if not.
int AES_Type; // 0x80 = aes128 / 0xc0 = aes192 / 0x100 = aes256
char[16] Enc_IV; // IV for the firmware file, encrypted with the gid key
char[24] Enc_Key; // Key for the firmware file, encrypted with the gid key.
} Unparsed_KBAG_AES192;
</pre>

===KBAG256===
<pre>
typedef struct Unparsed_KBAG_256 {
char[4] magic; // string with bits flipped = "KBAG" (magic = 0x4741424B)
int fullSize; // size of KBAG from beyond that point to the end of it
int unk1; // 8 less than fullSize. not sure what it is exactly.
int IV_Key_Crypt_state; // 1 if the key and IV in the KBAG are encrypted with the GID key, 0 if not.
int AES_Type; // 0x80 = aes-128, 0xc0 = aes-192, 0x100 = aes256
char[16] Enc_IV; // IV for the firmware file, encrypted with the gid key
char[32] Enc_Key; // Key for the firmware file, encrypted with the gid key.
} Unparsed_KBAG_AES256;
</pre>

==How it works==
Basically, it just boils down to using the iPhone / iPod group id key to decrypt Enc_IV and Enc_Key, then using that key and IV to decrypt the DATA section of the file (the code itself).

As an interesting side note, because of the circumstances with the [[IMG3]] format, the Kernel never needs to even touch the gid key anymore, as it's job is to just flash the image to the [[NOR]] as is, with container and all.

The iPhone Wiki - User contributions [en]

KBAG