The iPhone Wiki - User contributions [en]

Leftover Strings

2014-01-13T08:37:44Z

Iemit737: MobileGestalt

Apple likes to leave various strings throughout its binaries and libraries in [[iOS]]. You can find them by running <code>strings <binary name></code> on OS X. Some of the more interesting/entertaining ones are posted here.

==BackupAgent==
Dealing with a 5.0-5.2 inner manifest. Mistakes were made, but we're going to do our best to recover
Refusing to backup with a 5.0-5.2 inner manifest. You're going to have to throw this out and do it over again, buddy.
*** REFUSING TO BACKUP USING OLD BACKUP SERVICE. INSTALL THE IPHONE SDK 4.0. ***
The safe harbor data for %@ has overstayed its welcome (%@). Mothballing it
We were handed an encrypted backup but we don't have a password. Throwing out this manifest and creating a fresh, unencrypted one
Backup request received from a new backup protocol version. Let's do the versioning dance. Our version: %@
Talking to an old version. Jumping straight to the action and sending files
Ok, that was fun. Really beginning the backup.
Could not flock the restore running file at %@. This restore may be a bit bumpy...
Looks like this is a magic restore. We'll be keeping all your settings intact for this one...
Thanks for the Memories
%s is being feisty. Sending it a SIGKILL
%s decided it didn't want to play well with others and refused to exit. We're going to continue with the backup/restore anyway and hope for the best.
No help is available for BackupAgent at this time. You probably don't need to pass any arguments anyway.
Could not get the mobile user's passwd struct. We'll try %@ just in case, but things will probably go downhill from here.

==[[Kernelcache]]==
===2.1.1===
They like to say "WTF?" in here. The context doesn't exactly suggest they're referring to [[WTF]].
<pre>
[%u.%09u] : %s:%s(): Chip Failure, Smacking WiFi chip! (count = %lu / %lu)
%s: WTF? Timer handler expired and there is no pending command
%s::%s(): super failed to init!
%s::%s(): WTF? The beacon list is NULL
%s::%s(): WTF? Got a BRCM packet but an OUI/SUBTYPE mismatch
%s::%s(): WTF?? Got an event packet!!!
%s::%s(): ACK, there are outstanding commands to process!!!
%s::%s(): WTF, the command wasn't sent, nothing is safe now!
%s::%s(): WTF, there is no pending command
%s::%s(): WTF, the pending command hasn't been sent
%s::%s(): ACK, no free commands left!!!!
AppleMRVL868x: super failed to init!
%s::%s(): Command (%s) Timeout! - invoking hand of god
AppleMRVL868x: WTF? Our Provider isn't an IOSDIOIoCardDevice?
</pre>

===3.0===
<pre>
AppleUSBEthernetDevice::%s: super failed
</pre>

===IOP Firmware===
<pre>
console is dead, Jim
</pre>

==Keybagd==
===4.1===
Can't load the keybag. tears in rain... Time to die
Oh No! Kernel doesn't like this keybag:0x%08x. System is probably lost.
Huh? can't load the bag. That makes no sense
Doh! Can't rename %s to %s: %s
Gah! Can't remove %s: %s
Out of Memory!!! Dying!...so...cold....

==[[installd]]==
===4.3.5===
Out of Memory!!! Dying!...so...cold....
Weird. Can't determine my device class
Weird- can't find identifier for removal
Uh, prisoner %s got away!?
walk_the_green_mile

==[[lockdownd]]==
===4.0===
<pre>
Really!? Can't determine the device name!? Really!?
Invalid ack! Ack. Ack. Ack.
fetch_me_brains
OkilyDokily
Wakey Wakey Buddy!
HOWDY
Suck it, McBain.
Not waking buddy because wireless sync is not allowed right now
Here's to the crazy ones.
Up shit creek. No paddle.
I am ignoring your unlock code. There is nothing you can do about it.
That being said, I am setting the activation state to Unlocked.
Setting the activation state to MismatchedIMEI. Dude, where's your baseband?
Setting the activation state to MismatchedICCID. Put that other SIM back in.
Setting the activation state to MissingSIM. Put that SIM back in, dude.
Setting the activation state to FactoryActivated. Helloq OQC.
Setting the activation state to SoftActivation. Hello AppleCare.
This is some kinda fpga: %s
DisableHactivation
Disabling activation short-circuit because DisableHactivation is set
</pre>

===4.1===
<pre>
Our buddy went away
Our buddy is here!
Might wake my buddy
</pre>

===4.3.3===
<pre>
Timezone shenanigans
dirtied by changing %s
FPGA workaround enabled, no fairplay bringup
iPhone3,2
iPhone4,1
Short circuiting activation state to Activated.
Hmmm, we're missing the post URL but continuing.
Turned airplane mode off since we're unactivated
But allowing simless activation
This host ID is lame
The activation record did not contain the necessary key data thingy
HEY!!!!! %s attempting to get [%s]:[%s]- Use MobileOracle instead of lockdown please!
Gah! Can't create mutable copy
Weird. Missing the pair record.
Must be within a session to enter recovery mode via WiFi
Could not determine whether or not we support WiFi syncing!
Very bad.
</pre>

===4.3.5===
<pre>
Could not create mutable dictionary! We are dead!
Could not allocate key list. We are dead.
Could not create mutable copy! We are dead!
</pre>

===5.0===
<pre>
set_time_since_bowie
copy_time_since_bowie
kIOMessageSystemHasPoweredOn (%s): Now witness the firepower of this fully ARMED and OPERATIONAL battle station!
Mayday
Bzzz
</pre>

==libMobileGestalt==
===7.0===
<pre>
diagnostic data isn't chicken, it's beef
</pre>

==Mobile_obliterator [http://code.google.com/p/chronicdev/wiki/MobileObliterator]==
<pre>
"buffy_summers", "Could not kill the daemons: %d"
begin_fakery
end_fakery
And you will know my name is the Lord when I lay my vengeance upon thee.
</pre>
===4.3.3===
<pre>

lol, wut: %s
Could not find Revocable Storage! Reverting to stupid wipe.
The USB device controller could not be found. It's cool.
Erasing all Image3 firmware images, Firmware is gone?!
</pre>

User talk:5urd

2013-09-10T23:26:15Z

Iemit737: Mediawiki.

{{Talk Archive|2011|2012}}

== iBook ==
Hey I'm taking on another project, I'm writing a iBook on the internals of jailbreaking. I was wondering if you might be interested on editing/giving ideas/or correcting information. You seem very educated in jailbreaking. --[[User:Haifisch|Haifisch]] 00:23, 29 January 2012 (MST)
: I don't want to be arrogant, but I think I could help you more ;) --[[User:Rud0lf77|rud0lf77]] 06:43, 29 January 2012 (MST)
:Ya I can help --[[User:5urd|5urd]] 16:39, 29 January 2012 (MST)
::I have a proof of the book [http://www.ra1n.net/hah/1.ibooks here] --[[User:Dylan Laws|Dylan Laws]] 16:50, 29 January 2012 (MST)

== Minor keypage edits ==
You just made a ton of minor edits of the key pages (firmware pages) editing just empty lines or spaces (even invisible in diff). I understand that you do this for your own purpose so that one of your tools can lookup keys. But I would rather suggest to fix your parser instead of useless editing of these pages. Thank you. -- [[User:Http|http]] 00:51, 1 February 2012 (MST)
:Sorry about this. I should have spaced it out a it wider than a few days. --[[User:5urd|5urd]] 16:15, 1 February 2012 (MST)
::Or just leave it? --[[User:Http|http]] 17:30, 1 February 2012 (MST)
:::Or, yeah... --[[User:5urd|5urd]] 20:53, 1 February 2012 (MST)

== Beta firmware kernelcache keys ==
I noticed you added keys for the iPhone3,1 and 3,3 for SundanceVail 10A5316k. However, the list is incomplete, you are missing the kernelcache keys. In the future, could you please make sure all the keys are there before you submit the page? Thank you, [[User:Acfrazier|Austen Frazier]] 19:22, 13 June 2012 (MDT)
:That was not me, but I see how you thought that. [[User:INeal11|iNeal11]] added them, I just went through and lowercased them to follow the standard format ([{{FULLURL:SundanceVail 10A5316k (iPhone 4)|action=history}} iPhone3,1], [{{FULLURL:SundanceVail 10A5316k (iPhone 4 CDMA)|action=history}} iPhone3,3]) --[[User:5urd|5urd]] 19:38, 13 June 2012 (MDT)

== PurpleRestore Discussion Page ==
But.. why did you delete [{{FULLURL:User talk:Martepato|diff=0&oldid=28641}} my last edit]?? --[[User:Jaggions|Jaggions]] 11:19, 18 December 2012 (MST)
:It was encouraging illegal file share. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 05:23, 24 December 2012 (UTC)

== Administrator ==
Want to be one? You pretty much fill the role of one already. --[[User:Geohot|geohot]] ([[User talk:Geohot|talk]]) 19:57, 23 December 2012 (UTC)
:Ooh! Yes! Please! --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 20:34, 23 December 2012 (UTC)
::Done, keep up the good work. --[[User:Geohot|geohot]] ([[User talk:Geohot|talk]]) 20:40, 23 December 2012 (UTC)
:::*claps* Congrats! --[[User:Haifisch|Haifisch]] ([[User talk:Haifisch|talk]]) 00:04, 24 December 2012 (UTC)

== Page deletion. ==
Is it possible for me to delete a page if it is not used etc or is it an admin only feature? --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 19:12, 24 December 2012 (UTC)
:It's an admin only feature. If you feel a page should be deleted, add the [[Template:delete|delete template]] to the top of it. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 19:13, 24 December 2012 (UTC)
::Ok thanks. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 19:17, 24 December 2012 (UTC)

== Betas ==
There is definitely beta for 6.1 2-4 [[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]])16:29, December 25, 2012 (MST)}}
:Do you have any evidence other than the OTA updates? --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 00:10, 26 December 2012 (UTC)
::There is a beta 4. --[[User:Haifisch|Haifisch]] ([[User talk:Haifisch|talk]]) 00:16, 26 December 2012 (UTC)
:::Well, no duh. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 02:17, 26 December 2012 (UTC)
::::Im confused ._. --[[User:Haifisch|Haifisch]] ([[User talk:Haifisch|talk]]) 02:40, 26 December 2012 (UTC)
:::::No but OTA is enough evidence. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 11:16, 26 December 2012 (UTC)

== PurpleTools ==
I have managed to find screenshots of the PurpleTools (PurpleRestore, etc.) on the internet. If you're interested in adding them to the Wiki, I can send them to you. --[[User:Srb21103|Srb21103]] ([[User talk:Srb21103|talk]]) 19:27, 2 January 2013 (MST)
:Sure! --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 02:31, 3 January 2013 (UTC)
:Hi, I saw you uploaded a [[:File:PurpleRestore.jpg|PurpleRestore]] image. Two questions:
:* It has a watermark from @TechSight in it. Did you obtain the permission to add it to the wiki? Or do you think this falls under the US-only "fair-use" usage?
:* Why is it a jpg and not a png? I mean it's a screenshot and pngs are smaller and have full quality.
:--[[User:Http|http]] ([[User talk:Http|talk]]) 01:28, 4 January 2013 (UTC)
::I would think it falls under fair use. Fair use say something along the lines of its legal if it is used for educational purposes. Also, they are not mine, they are Srb21103's. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 01:46, 4 January 2013 (UTC)
:::I can get you screenshots of it, using my devices (I dont care what info on them leaks) --[[User:Haifisch|Haifisch]] ([[User talk:Haifisch|talk]]) 02:14, 4 January 2013 (UTC)
::::Thanks --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 18:30, 22 January 2013 (UTC)

== Evad3rs ==
Why did you delete this page? --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 01:19, 26 January 2013 (UTC)
: Due to no reply and/or reason for deletion, I will make it again. If you have an issues with the page please say them on the talk page first. This is like [[Dream Team]] so should stay. [[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]])11:48, 26 January 2013 (UTC)}}
:: How fast do you expect a reply? It's still the same day! --[[User:Http|http]] ([[User talk:Http|talk]]) 12:04, 26 January 2013 (UTC)
::: Well he was on since I made this so should have seen it. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 12:05, 26 January 2013 (UTC)

== Last edit. ==
Why did you revert? The rest of the page has rowspan with no complaints. Please discuss first. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 20:15, 24 March 2013 (UTC)
:I agree with his undo. Rowspans over different tools are confusing. --[[User:Http|http]] ([[User talk:Http|talk]]) 20:58, 24 March 2013 (UTC)
:: Ah ok. I will do this layout for the others too then. --[[User:IAdam1n|iAdam1n]] ([[User talk:IAdam1n|talk]]) 22:14, 24 March 2013 (UTC)

== A6 file deletion ==
You deleted the File:A6.jpg with comment "Copyright violation". Can you give details? The author explicitely allowed redistribution etc. under Creative Commons license or something like that. Anything wrong with that? We have several other images with same license still here. --[[User:Http|http]] ([[User talk:Http|talk]]) 05:58, 25 April 2013 (UTC)
:My apologies. It was not a copyright violation. It was marked for deletion for being unused. If you want to add it back, feel free to. I was half awake, and I guess I accidentally clicked "Copyright violation". --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 14:37, 25 April 2013 (UTC)

== Mediawiki markup ==
No, I don't know Mediawiki. I contribute words / content and someone else who understands Mediawiki markup better than I do can fix them. Sorry
--[[User:Iemit737|Iemit737]] ([[User talk:Iemit737|talk]]) 23:26, 10 September 2013 (UTC)

Touch ID

2013-09-10T21:26:38Z

Iemit737: *slice not segment...

The [[iPhone 5s]] comes equipped with '''Touch ID''', a fingerprint scanner. Currently, there is no official developer API for it, because it is intended for unlocking the device and purchasing items on [[iTunes Store]] only.

However there is a private API for it; its dylib file is in [[Xcode]] 5 in the path
<pre>Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS7.0.sdk/System/Library/PrivateFrameworks/BiometricKit.framework/BiometricKit</pre>

Since it contains a 64-bit ARM slice only, the common disassembly tools cannot process the file (beyond basic header and data segment analysis).

==Inferred Information==
Based on a string dump, here is what is implied.
<ul>
<li>The codename for it was "mesa" </li>
<li>It communicates over XPC to a binary that handles access to it </li>
<li>There's a kernel extension to interface with it </li>
<li>The kernel extension communicates to the secure keystore to set and verify fingerprints </li>
<li>The fingerprint scanner calibrates itself and has upgradable firmware </li>
<li>The fingerprint scanner uses normal image formats (i.e. UIImage) before setting and verifying fingerprints </li>
<li>There's biometric lockout as well as passcode lockout </li>
<li> The A7 chip contains a secure element marketed as the Secure Enclave. The string dump refers to SEP, the Secure Element Protocol. This chip is most likely one sourced from NXP. It contains physical security to ensure that the only operations of the chip involve setting new fingerprints and verifying fingerprints against the ones stored in it (i.e. challenge-response). This way, the fingerprint data cannot be extracted from it. </li>
</ul>

== String Dump ==
Below there is a full string dump of the framework, which can hint at its functionalities.
<pre>
initWithMachServiceName:options:
connectWithReplyBlock:
registerDelegate:withReplyBlock:
suspendWork:withReplyBlock:
enroll:withAuthToken:withReplyBlock:
match:withReplyBlock:
match:withOptions:withReplyBlock:
matchIdentities:withReplyBlock:
cancelWithReplyBlock:
updateIdentity:withReplyBlock:
removeIdentity:withReplyBlock:
getIdentityFromUUID:withReplyBlock:
identities:withReplyBlock:
resetEngineWithReplyBlock:
registerDSID:withAuthToken:withReplyBlock:
registerStoreToken:withReplyBlock:
getCountersignedStoreTokenWithReplyBlock:
getMaxIdentityCount:withReplyBlock:
enrollContinueWithReplyBlock:
pullAlignmentDataWithReplyBlock:
pullMatchTopologyDataWithReplyBlock:
getNodeTopologyForIdentity:withReplyBlock:
preventAutonomousMatchingMode:withReplyBlock:
getProvisioningStateWithReplyBlock:
getCalBlobVersionWithReplyBlock:
getSensorCalibrationStatusWithReplyBlock:
getCalibrationDataStateWithReplyBlock:
setDebugImages:withReplyBlock:
pullCaptureBufferWithReplyBlock:
pullDebugImageData:withReplyBlock:
provisionSensorWithReplyBlock:
unpairSensorWithReplyBlock:
lockSensorWithReplyBlock:
getSerialisedTemplateForIdentity:withReplyBlock:
interfaceWithProtocol:
setRemoteObjectInterface:
remoteObjectInterface
setWithObject:
setClasses:forSelector:argumentIndex:ofReply:
setWithObjects:
enrollResult:
matchResult:
statusMessage:
homeButtonPressed
setExportedInterface:
setExportedObject:
setInterruptionHandler:
resume
invalidate
remoteObjectProxyWithErrorHandler:
code
respondsToSelector:
connect
registerDelegate:
suspendWork:
enroll:withAuthToken:
match:
match:withOptions:
matchIdentities:
cancel
updateIdentity:
removeIdentity:
getIdentityFromUUID:
identities:
getMaxIdentityCount:
resetEngine
enrollContinue
pullAlignmentData
pullMatchTopologyData
getNodeTopologyForIdentity:
preventAutonomousMatchingMode:
getProvisioningState
registerDSID:withAuthToken:
registerStoreToken:
getCountersignedStoreToken:
getCalBlobVersion
getSensorCalibrationStatus
getCalibrationDataState
pullCaptureBuffer
pullDebugImageData:imageWidth:imageHeight:
provisionSensor
unpairSensor
lockSensor
setDebugImages:
getSerialisedTemplateForIdentity:
delegate
setDelegate:
interruptionHandler
_connection
_delegate
_interruptionHandler
setTopology:
setDetails:
topology
details
_topology
_details
initEnrollmentValues
message
messageDetails
objectForKeyedSubscript:
currentPrimaryComponentID
integerValue
doubleValue
statistics
enroll:
enrollResult:componentSet:
enrollProgress:
_fingerOn
_enrolling
_badImagePerFingerDown
_enrollmentStarTime
_touchesPerEnroll
_badImagesPerEnroll
_rejectedImagesPerEnroll
_primaryClusterAdditions
_primaryClusterFailedAdditions
_otherClustersAdditions
_joinEvents
_area
_primaryClusterArea
numberWithBool:
preferencesGetStringValue:
preferencesGetBOOLValue:
enableLogger:toPath:
manager
defaultCenter
appDidEnterBackground:
addObserver:selector:name:object:
appWillEnterForeground:
bundleForClass:
imageNamed:inBundle:
updateEnableLogger
dataWithBytes:length:
startEnrollLog
data
logRemoveIdentity:
bytes
imageFromRawImageData:
imageFromBitmapData:inRect:
pullDebugImageData:target:
getRadarAtachmentsForLastEnrollment
getRadarAtachmentsForLastMatch
length
stringWithString:
getModulationRatio
stringForProvisioningState:
getSensorPatchVersion
stringWithFormat:
getLogsForProcess:
sharedConnection
isFingerprintUnlockAllowed
setGracePeriod:passcode:completionBlock:
finishEnrollLogWithStatus:withIdentity:withTemplate:
matchResult:withDetails:
createMatchInfo:withTopology:withMatchImage:
logMatchResult:withTopology:withImage:withCaptureBuffer:withTemplate:
getBytes:length:
logEnrollMessage:withTopology:withImage:withCaptureBuffer:
logStatus:
enrollProgressMessage:
logRejectedImage:
size
drawInRect:
drawInRect:blendMode:alpha:
CGImage
scale
imageOrientation
imageWithCGImage:scale:orientation:
imageWithImage:inRect:
identityImage:
imageWithImage:withNode:withRect:alpha:
compositeTopologyImage:
imageTopology:forGroup:
imageFauxprint:withTheta:withLamda:
greenColor
imageWithImage:withTintColor:
dataWithData:
imageWithCGImage:
preferencesSetBOOLValue:forKey:
pullDebugImage:
getLoggerAttachmentsForRadar:
stringFromSensorConfiguration
matchIdentity:
topologyImage:
imageWithImage:withMaskImage:
inUse
setInUse:
enrollProgressConfigRenderMode
setEnrollProgressConfigRenderMode:
enrollProgressConfigRenderViewSize
setEnrollProgressConfigRenderViewSize:
renderMode
setRenderMode:
opacity
setOpacity:
_xpcClient
_enrollingMode
_matchingMode
_statistics
_scanbedImage
_fauxprintImage
_nodeRect
_images
_compSet
_rejectTouchCount
_rejectTouch
_showDebugImages
_enableLogger
_enrollImageSet
_isInternalInstall
_inUse
_enrollProgressConfigRenderMode
_renderMode
_opacity
_enrollProgressConfigRenderViewSize
setUuid:
decodeBytesForKey:returnedLength:
initWithUUIDBytes:
decodeIntForKey:
decodeObjectOfClass:forKey:
copy
getUUIDBytes:
encodeBytes:length:forKey:
encodeInt:forKey:
encodeObject:forKey:
biometricKitIdentity
supportsSecureCoding
encodeWithCoder:
initWithCoder:
uuid
type
setType:
attribute
setAttribute:
entity
setEntity:
name
setName:
stringByReplacingOccurrencesOfString:withString:
initWithCapacity:
setLength:
mutableBytes
defaultManager
createDirectoryAtPath:withIntermediateDirectories:attributes:error:
removeItemAtPath:error:
UUIDString
setMessageDetails:
setCaptureImage:
setRenderedImage:
progress
setProgress:
setCurrentPrimaryComponentID:
captureImage
renderedImage
setMessage:
_message
_progress
_currentPrimaryComponentID
_captureImage
_renderedImage
_messageDetails
setX:
setY:
angle
setAngle:
_angle
setTransformationCoordinates:
componentID
setComponentID:
transformationCoordinates
_componentID
_transformationCoordinates
pathComponents
com.apple.biometrickitd
T@"<BiometricKitDelegate>",N,V_delegate
interruptionHandler
T@?,C,N,V_interruptionHandler
topology
T@"NSDictionary",&,N,V_details
com.apple.fingerprint.enroll.attempts
com.apple.fingerprint.enroll.passes
com.apple.fingerprint.enroll.touchesPerEnroll
com.apple.fingerprint.enroll.badImagesPerEnroll
com.apple.fingerprint.enroll.rejectedImagesPerEnroll
com.apple.fingerprint.enroll.primaryClusterAdditions
com.apple.fingerprint.enroll.primaryClusterFailedAdditions
com.apple.fingerprint.enroll.otherClustersAdditions
com.apple.fingerprint.enroll.joinEvents
com.apple.fingerprint.enroll.clusterCount
com.apple.fingerprint.enroll.nodeCount
com.apple.fingerprint.enroll.primaryClusterNodeCount
com.apple.fingerprint.enroll.area
com.apple.fingerprint.enroll.primaryClusterArea
com.apple.fingerprint.enroll.passTime
com.apple.fingerprint.enroll.fails
com.apple.fingerprint.enroll.failTime
com.apple.ManagedConfiguration.profileListChanged
com.apple.biometrickitd.debugLogEnabled
com.apple.biometrickitd.debugLogPath
debugLogEnabled
debugLogPath
BKOptionSuppressHapticFeedback
BKOptionFilterOutHomeButtonEvents
BKOptionMatchForUnlock
InternalBuild
scanbed
synthetic
Uninitialized
Not Provisioned
Unprovisioned
Provisioned
Provisioned Locked
Unpaired
Unknown
biosensor,mesa
modulation-ratio
AppleBiometricSensor
patch-version
Mesa configuration:
Provisioning Status: %@
Calibrated:
- Version:
- Signed:
Modulation ratio:
Kernel:
Thick kernel
Thin kernel
Sensor Patch Version:
Steps to Reproduce:
inUse
TB,V_inUse
enrollProgressConfigRenderMode
Ti,N,V_enrollProgressConfigRenderMode
enrollProgressConfigRenderViewSize
T{CGSize=dd},N,V_enrollProgressConfigRenderViewSize
renderMode
Ti,N,V_renderMode
opacity
Tf,N,V_opacity
Notification callback.
BiometricKitErrorDomain
BKIdentityUUID
BKIdentityType
BKIdentityAttribute
BKIdentityEntityNumber
BKIdentityName
/var/mobile/BiometricKit/biometrickitd
BKEPDReason
BKEPDNewNodeID
BKEPDNewComponentID
BKEPDNewNodeCoordinates
BKEPDRemovedNodeID
BKEPDRemovedComponentID
BKEPDExtendedComponentID
BKEPDResultComponentID
BKEPDMergedInComponents
BKEPDRedundantNode
BKTDLargestCompArea
BKTDLargestCompNodes
BKTDTotalArea
BKTDTotalNodes
BKTemplateUpdated
Td,N,V_x
Td,N,V_y
angle
Td,N,V_angle
componentID
Tq,N,V_componentID
transformationCoordinates
T@"BiometricKitEnrollProgressCoordinates",&,N,V_transformationCoordinates
Remove identity: %@
Log package:%@
biometrickitd
%@.tar.gz
cd %@ && tar -cjf %@ %@
Time: % 8.3f
PASS
FAIL
Closing log with result %@
Template identity:
UUID : %@
Type : %i
Attrib: %i
Entity: %i
Error: Unable to get identity
Serialised template: %@
%@_%04d.bin
Status message: %@
Progress %i
Count of enrollments: %i
BiometricKitErrorTaskCancelled
BiometricKitErrorIdentityInvalid
BiometricKitErrorIdentityNotAllowed
BiometricKitErrorIdentityErrorInvalidData
BiometricKitErrorIdentityErrorUnknown
BiometricKitStatusFingerOn
BiometricKitStatusFingerOff
BiometricKitStatusEnrollmentComplete
BiometricKitStatusEnrollmentCancelled
BiometricKitStatusEnrollmentFailed
BiometricKitStatusEnrollmentTimeout
BiometricKitStatusUnknownError
BiometricKitStatusImageRejected
BiometricKitStatusNoCalibration
BiometricKitImageForProcessing
BiometricKitStatusTemplateListUpdated
BiometricKitStatusRequestFingerOff
BiometricKitStatusAutoMatchingStarted
BiometricKitStatusAutoMatchingStopped
BiometricKitStatusCaptureRestart
BiometricKitStatusScanTooShort
BiometricKitStatusAutoMatchingStartByHomeButton
BiometricKitStatusMatchingCancelled
BiometricKitStatusFingerOnBeforeFirstPasscodeUnlock
BiometricKitStatusFingerOnInPasscodeLockout
BiometricKitStatusFingerOnInBioLockout
BiometricKitStatusFingerOnTokenExpired
BiometricKitStatusESDRecovery
BiometricKitStatusImageRejectedUnknown
BiometricKitStatusImageRejectedBadBlocks
BiometricKitStatusImageRejectedChFPN
BiometricKitStatusImageRejectedCaFPN
BiometricKitStatusSensorOperationModeIdle
BiometricKitStatusSensorOperationModeCapture
BiometricKitStatusSensorOperationModePause
Other unknown status %i
Image #%i was rejected
Sensor patch version: %ld
Sensor patch version: unknown
Calibration Data: %@
Capture buffer: %@
Matcher: image refused
Matcher: image %s node %u
added as
replaced
Coordinates: %s[%i, %i, %i]
inverse of
Parent: %i
Processed image: %@
Enroll debug log, version 7
static const node_placement_t table_%02i =
%@{%i,%i,%i,%i,%i,%i,{
%@{%i,%i,%i,%i,%i}
%@},%i,%i,%i,%i,%i,0x%04x};
bin8
bin16
binXX
calibdata.bin
calibration-blob
Image #%i%s
was sent to matcher
Match result
Match details:
Matching score: %i
Match S2S count: %i
Matching node: %i
Updated node: %i
Not available
No match (artificial)
No match
Image #%i
Warning: the log is not complete, previous part of the log was deleted.
Starting enrollment
Starting matching
No known identities with enroll log are available.
Known identities with enroll log available:
%@ : %@
Match debug log, version 7
messages.log
OS version: %@ (%@)
Mesa: %@
Process name:%@
PrimaryUsagePage
PrimaryUsage
com.apple.iokit.hid.displayStatus
com.apple.mobile.keybagd.lock_status
AppleMesaSEPDriver
IOGeneralInterest
ScanningState
ScanningStateIdle
ScanningStateShortScanning
ScanningStateLongScanning
Unknown scanning state %i
Event: %@
HomeButtonPress
ExtendedDeviceLockState
MobileKeyBagDeviceIsUnlocked
MobileKeyBagDeviceIsLocked
MobileKeyBagDeviceIsLocking
MobileKeyBagDisabled
MobileKeyBagDeviceUnlockInProgress
MobileKeyBagDeviceInGracePeriod
MobileKeyBagDeviceInAssertDelay
MobileKeyBagDeviceInBioUnlock
Unknown lock state %i
DisplayOn
DisplayOff
/SourceCache/Mesa/Mesa-152/AppleBiometricServices/BiometricKit/BiometricKitDebugLog.m
/var/mobile/Library/Logs/CrashReporter/BiometricKit
v24@0:8@"BiometricKitIdentity"16
@"NSXPCConnection"
@"<BiometricKitDelegate>"
@"BiometricKitXPCClient"
@"BiometricKitStatistics"
@"UIImage"
[25{CGRect="origin"{CGPoint="x"d"y"d}"size"{CGSize="width"d"height"d}}]
[25@"UIImage"]
{?="count"i"capa"i"items"^^{?}"unusedImageCount"i"componentCount"i"componentCapa"i"bestComponentIndex"i"bestMapiComponentIndex"i"components"^^{?}"mapiNodeAddedIndex"s"mapiNodeRemovedIndex"s"updateCount"i"structureIsInconsistent"B}
{?="nodes"[25{?="imageData"@"NSData""width"I"height"I}]}
BiometricKitXpcProtocol
BiometricKitDelegateXpcProtocol
BiometricKitXPCClient
BiometricKitTemplateInfo
BiometricKitStatistics
BiometricKit
BiometricKitDelegate
BiometricKitIdentity
NSSecureCoding
NSCoding
BiometricKitMatchInfo
BiometricKitEnrollProgressInfo
BiometricKitEnrollProgressCoordinates
BiometricKitEnrollProgressMergedComponent
BiometricKitDebugLog
</pre>

{{stub|hardware}}

Touch ID

2013-09-10T20:47:43Z

Iemit737: Being specific because Hopper can still open it as a raw binary.

The [[iPhone 5s]] comes equipped with '''Touch ID''', a fingerprint scanner. Currently, there is no official developer API for it, because it is intended for unlocking the device and purchasing items on [[iTunes Store]] only.

However there is a private API for it; its dylib file is in [[Xcode]] 5 in the path
<pre>Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS7.0.sdk/System/Library/PrivateFrameworks/BiometricKit.framework/BiometricKit</pre>

Since it contains a 64-bit ARM segment only, the common disassembly tools cannot process the file (beyond basic header and data segment analysis).

==Inferred Information==
Based on a string dump, here is what is implied.
<ul>
<li>The codename for it was "mesa" </li>
<li>It communicates over XPC to a binary that handles access to it </li>
<li>There's a kernel extension to interface with it </li>
<li>The kernel extension communicates to the secure keystore to set and verify fingerprints </li>
<li>The fingerprint scanner calibrates itself and has upgradable firmware </li>
<li>The fingerprint scanner uses normal image formats (i.e. UIImage) before setting and verifying fingerprints </li>
<li>There's biometric lockout as well as passcode lockout </li>
<li> The A7 chip contains a secure element marketed as the Secure Enclave. The string dump refers to SEP, the Secure Element Protocol. This chip is most likely one sourced from NXP. It contains physical security to ensure that the only operations of the chip involve setting new fingerprints and verifying fingerprints against the ones stored in it (i.e. challenge-response). This way, the fingerprint data cannot be extracted from it. </li>
</ul>

== String Dump ==
Below there is a full string dump of the framework, which can hint at its functionalities.
<pre>
initWithMachServiceName:options:
connectWithReplyBlock:
registerDelegate:withReplyBlock:
suspendWork:withReplyBlock:
enroll:withAuthToken:withReplyBlock:
match:withReplyBlock:
match:withOptions:withReplyBlock:
matchIdentities:withReplyBlock:
cancelWithReplyBlock:
updateIdentity:withReplyBlock:
removeIdentity:withReplyBlock:
getIdentityFromUUID:withReplyBlock:
identities:withReplyBlock:
resetEngineWithReplyBlock:
registerDSID:withAuthToken:withReplyBlock:
registerStoreToken:withReplyBlock:
getCountersignedStoreTokenWithReplyBlock:
getMaxIdentityCount:withReplyBlock:
enrollContinueWithReplyBlock:
pullAlignmentDataWithReplyBlock:
pullMatchTopologyDataWithReplyBlock:
getNodeTopologyForIdentity:withReplyBlock:
preventAutonomousMatchingMode:withReplyBlock:
getProvisioningStateWithReplyBlock:
getCalBlobVersionWithReplyBlock:
getSensorCalibrationStatusWithReplyBlock:
getCalibrationDataStateWithReplyBlock:
setDebugImages:withReplyBlock:
pullCaptureBufferWithReplyBlock:
pullDebugImageData:withReplyBlock:
provisionSensorWithReplyBlock:
unpairSensorWithReplyBlock:
lockSensorWithReplyBlock:
getSerialisedTemplateForIdentity:withReplyBlock:
interfaceWithProtocol:
setRemoteObjectInterface:
remoteObjectInterface
setWithObject:
setClasses:forSelector:argumentIndex:ofReply:
setWithObjects:
enrollResult:
matchResult:
statusMessage:
homeButtonPressed
setExportedInterface:
setExportedObject:
setInterruptionHandler:
resume
invalidate
remoteObjectProxyWithErrorHandler:
code
respondsToSelector:
connect
registerDelegate:
suspendWork:
enroll:withAuthToken:
match:
match:withOptions:
matchIdentities:
cancel
updateIdentity:
removeIdentity:
getIdentityFromUUID:
identities:
getMaxIdentityCount:
resetEngine
enrollContinue
pullAlignmentData
pullMatchTopologyData
getNodeTopologyForIdentity:
preventAutonomousMatchingMode:
getProvisioningState
registerDSID:withAuthToken:
registerStoreToken:
getCountersignedStoreToken:
getCalBlobVersion
getSensorCalibrationStatus
getCalibrationDataState
pullCaptureBuffer
pullDebugImageData:imageWidth:imageHeight:
provisionSensor
unpairSensor
lockSensor
setDebugImages:
getSerialisedTemplateForIdentity:
delegate
setDelegate:
interruptionHandler
_connection
_delegate
_interruptionHandler
setTopology:
setDetails:
topology
details
_topology
_details
initEnrollmentValues
message
messageDetails
objectForKeyedSubscript:
currentPrimaryComponentID
integerValue
doubleValue
statistics
enroll:
enrollResult:componentSet:
enrollProgress:
_fingerOn
_enrolling
_badImagePerFingerDown
_enrollmentStarTime
_touchesPerEnroll
_badImagesPerEnroll
_rejectedImagesPerEnroll
_primaryClusterAdditions
_primaryClusterFailedAdditions
_otherClustersAdditions
_joinEvents
_area
_primaryClusterArea
numberWithBool:
preferencesGetStringValue:
preferencesGetBOOLValue:
enableLogger:toPath:
manager
defaultCenter
appDidEnterBackground:
addObserver:selector:name:object:
appWillEnterForeground:
bundleForClass:
imageNamed:inBundle:
updateEnableLogger
dataWithBytes:length:
startEnrollLog
data
logRemoveIdentity:
bytes
imageFromRawImageData:
imageFromBitmapData:inRect:
pullDebugImageData:target:
getRadarAtachmentsForLastEnrollment
getRadarAtachmentsForLastMatch
length
stringWithString:
getModulationRatio
stringForProvisioningState:
getSensorPatchVersion
stringWithFormat:
getLogsForProcess:
sharedConnection
isFingerprintUnlockAllowed
setGracePeriod:passcode:completionBlock:
finishEnrollLogWithStatus:withIdentity:withTemplate:
matchResult:withDetails:
createMatchInfo:withTopology:withMatchImage:
logMatchResult:withTopology:withImage:withCaptureBuffer:withTemplate:
getBytes:length:
logEnrollMessage:withTopology:withImage:withCaptureBuffer:
logStatus:
enrollProgressMessage:
logRejectedImage:
size
drawInRect:
drawInRect:blendMode:alpha:
CGImage
scale
imageOrientation
imageWithCGImage:scale:orientation:
imageWithImage:inRect:
identityImage:
imageWithImage:withNode:withRect:alpha:
compositeTopologyImage:
imageTopology:forGroup:
imageFauxprint:withTheta:withLamda:
greenColor
imageWithImage:withTintColor:
dataWithData:
imageWithCGImage:
preferencesSetBOOLValue:forKey:
pullDebugImage:
getLoggerAttachmentsForRadar:
stringFromSensorConfiguration
matchIdentity:
topologyImage:
imageWithImage:withMaskImage:
inUse
setInUse:
enrollProgressConfigRenderMode
setEnrollProgressConfigRenderMode:
enrollProgressConfigRenderViewSize
setEnrollProgressConfigRenderViewSize:
renderMode
setRenderMode:
opacity
setOpacity:
_xpcClient
_enrollingMode
_matchingMode
_statistics
_scanbedImage
_fauxprintImage
_nodeRect
_images
_compSet
_rejectTouchCount
_rejectTouch
_showDebugImages
_enableLogger
_enrollImageSet
_isInternalInstall
_inUse
_enrollProgressConfigRenderMode
_renderMode
_opacity
_enrollProgressConfigRenderViewSize
setUuid:
decodeBytesForKey:returnedLength:
initWithUUIDBytes:
decodeIntForKey:
decodeObjectOfClass:forKey:
copy
getUUIDBytes:
encodeBytes:length:forKey:
encodeInt:forKey:
encodeObject:forKey:
biometricKitIdentity
supportsSecureCoding
encodeWithCoder:
initWithCoder:
uuid
type
setType:
attribute
setAttribute:
entity
setEntity:
name
setName:
stringByReplacingOccurrencesOfString:withString:
initWithCapacity:
setLength:
mutableBytes
defaultManager
createDirectoryAtPath:withIntermediateDirectories:attributes:error:
removeItemAtPath:error:
UUIDString
setMessageDetails:
setCaptureImage:
setRenderedImage:
progress
setProgress:
setCurrentPrimaryComponentID:
captureImage
renderedImage
setMessage:
_message
_progress
_currentPrimaryComponentID
_captureImage
_renderedImage
_messageDetails
setX:
setY:
angle
setAngle:
_angle
setTransformationCoordinates:
componentID
setComponentID:
transformationCoordinates
_componentID
_transformationCoordinates
pathComponents
com.apple.biometrickitd
T@"<BiometricKitDelegate>",N,V_delegate
interruptionHandler
T@?,C,N,V_interruptionHandler
topology
T@"NSDictionary",&,N,V_details
com.apple.fingerprint.enroll.attempts
com.apple.fingerprint.enroll.passes
com.apple.fingerprint.enroll.touchesPerEnroll
com.apple.fingerprint.enroll.badImagesPerEnroll
com.apple.fingerprint.enroll.rejectedImagesPerEnroll
com.apple.fingerprint.enroll.primaryClusterAdditions
com.apple.fingerprint.enroll.primaryClusterFailedAdditions
com.apple.fingerprint.enroll.otherClustersAdditions
com.apple.fingerprint.enroll.joinEvents
com.apple.fingerprint.enroll.clusterCount
com.apple.fingerprint.enroll.nodeCount
com.apple.fingerprint.enroll.primaryClusterNodeCount
com.apple.fingerprint.enroll.area
com.apple.fingerprint.enroll.primaryClusterArea
com.apple.fingerprint.enroll.passTime
com.apple.fingerprint.enroll.fails
com.apple.fingerprint.enroll.failTime
com.apple.ManagedConfiguration.profileListChanged
com.apple.biometrickitd.debugLogEnabled
com.apple.biometrickitd.debugLogPath
debugLogEnabled
debugLogPath
BKOptionSuppressHapticFeedback
BKOptionFilterOutHomeButtonEvents
BKOptionMatchForUnlock
InternalBuild
scanbed
synthetic
Uninitialized
Not Provisioned
Unprovisioned
Provisioned
Provisioned Locked
Unpaired
Unknown
biosensor,mesa
modulation-ratio
AppleBiometricSensor
patch-version
Mesa configuration:
Provisioning Status: %@
Calibrated:
- Version:
- Signed:
Modulation ratio:
Kernel:
Thick kernel
Thin kernel
Sensor Patch Version:
Steps to Reproduce:
inUse
TB,V_inUse
enrollProgressConfigRenderMode
Ti,N,V_enrollProgressConfigRenderMode
enrollProgressConfigRenderViewSize
T{CGSize=dd},N,V_enrollProgressConfigRenderViewSize
renderMode
Ti,N,V_renderMode
opacity
Tf,N,V_opacity
Notification callback.
BiometricKitErrorDomain
BKIdentityUUID
BKIdentityType
BKIdentityAttribute
BKIdentityEntityNumber
BKIdentityName
/var/mobile/BiometricKit/biometrickitd
BKEPDReason
BKEPDNewNodeID
BKEPDNewComponentID
BKEPDNewNodeCoordinates
BKEPDRemovedNodeID
BKEPDRemovedComponentID
BKEPDExtendedComponentID
BKEPDResultComponentID
BKEPDMergedInComponents
BKEPDRedundantNode
BKTDLargestCompArea
BKTDLargestCompNodes
BKTDTotalArea
BKTDTotalNodes
BKTemplateUpdated
Td,N,V_x
Td,N,V_y
angle
Td,N,V_angle
componentID
Tq,N,V_componentID
transformationCoordinates
T@"BiometricKitEnrollProgressCoordinates",&,N,V_transformationCoordinates
Remove identity: %@
Log package:%@
biometrickitd
%@.tar.gz
cd %@ && tar -cjf %@ %@
Time: % 8.3f
PASS
FAIL
Closing log with result %@
Template identity:
UUID : %@
Type : %i
Attrib: %i
Entity: %i
Error: Unable to get identity
Serialised template: %@
%@_%04d.bin
Status message: %@
Progress %i
Count of enrollments: %i
BiometricKitErrorTaskCancelled
BiometricKitErrorIdentityInvalid
BiometricKitErrorIdentityNotAllowed
BiometricKitErrorIdentityErrorInvalidData
BiometricKitErrorIdentityErrorUnknown
BiometricKitStatusFingerOn
BiometricKitStatusFingerOff
BiometricKitStatusEnrollmentComplete
BiometricKitStatusEnrollmentCancelled
BiometricKitStatusEnrollmentFailed
BiometricKitStatusEnrollmentTimeout
BiometricKitStatusUnknownError
BiometricKitStatusImageRejected
BiometricKitStatusNoCalibration
BiometricKitImageForProcessing
BiometricKitStatusTemplateListUpdated
BiometricKitStatusRequestFingerOff
BiometricKitStatusAutoMatchingStarted
BiometricKitStatusAutoMatchingStopped
BiometricKitStatusCaptureRestart
BiometricKitStatusScanTooShort
BiometricKitStatusAutoMatchingStartByHomeButton
BiometricKitStatusMatchingCancelled
BiometricKitStatusFingerOnBeforeFirstPasscodeUnlock
BiometricKitStatusFingerOnInPasscodeLockout
BiometricKitStatusFingerOnInBioLockout
BiometricKitStatusFingerOnTokenExpired
BiometricKitStatusESDRecovery
BiometricKitStatusImageRejectedUnknown
BiometricKitStatusImageRejectedBadBlocks
BiometricKitStatusImageRejectedChFPN
BiometricKitStatusImageRejectedCaFPN
BiometricKitStatusSensorOperationModeIdle
BiometricKitStatusSensorOperationModeCapture
BiometricKitStatusSensorOperationModePause
Other unknown status %i
Image #%i was rejected
Sensor patch version: %ld
Sensor patch version: unknown
Calibration Data: %@
Capture buffer: %@
Matcher: image refused
Matcher: image %s node %u
added as
replaced
Coordinates: %s[%i, %i, %i]
inverse of
Parent: %i
Processed image: %@
Enroll debug log, version 7
static const node_placement_t table_%02i =
%@{%i,%i,%i,%i,%i,%i,{
%@{%i,%i,%i,%i,%i}
%@},%i,%i,%i,%i,%i,0x%04x};
bin8
bin16
binXX
calibdata.bin
calibration-blob
Image #%i%s
was sent to matcher
Match result
Match details:
Matching score: %i
Match S2S count: %i
Matching node: %i
Updated node: %i
Not available
No match (artificial)
No match
Image #%i
Warning: the log is not complete, previous part of the log was deleted.
Starting enrollment
Starting matching
No known identities with enroll log are available.
Known identities with enroll log available:
%@ : %@
Match debug log, version 7
messages.log
OS version: %@ (%@)
Mesa: %@
Process name:%@
PrimaryUsagePage
PrimaryUsage
com.apple.iokit.hid.displayStatus
com.apple.mobile.keybagd.lock_status
AppleMesaSEPDriver
IOGeneralInterest
ScanningState
ScanningStateIdle
ScanningStateShortScanning
ScanningStateLongScanning
Unknown scanning state %i
Event: %@
HomeButtonPress
ExtendedDeviceLockState
MobileKeyBagDeviceIsUnlocked
MobileKeyBagDeviceIsLocked
MobileKeyBagDeviceIsLocking
MobileKeyBagDisabled
MobileKeyBagDeviceUnlockInProgress
MobileKeyBagDeviceInGracePeriod
MobileKeyBagDeviceInAssertDelay
MobileKeyBagDeviceInBioUnlock
Unknown lock state %i
DisplayOn
DisplayOff
/SourceCache/Mesa/Mesa-152/AppleBiometricServices/BiometricKit/BiometricKitDebugLog.m
/var/mobile/Library/Logs/CrashReporter/BiometricKit
v24@0:8@"BiometricKitIdentity"16
@"NSXPCConnection"
@"<BiometricKitDelegate>"
@"BiometricKitXPCClient"
@"BiometricKitStatistics"
@"UIImage"
[25{CGRect="origin"{CGPoint="x"d"y"d}"size"{CGSize="width"d"height"d}}]
[25@"UIImage"]
{?="count"i"capa"i"items"^^{?}"unusedImageCount"i"componentCount"i"componentCapa"i"bestComponentIndex"i"bestMapiComponentIndex"i"components"^^{?}"mapiNodeAddedIndex"s"mapiNodeRemovedIndex"s"updateCount"i"structureIsInconsistent"B}
{?="nodes"[25{?="imageData"@"NSData""width"I"height"I}]}
BiometricKitXpcProtocol
BiometricKitDelegateXpcProtocol
BiometricKitXPCClient
BiometricKitTemplateInfo
BiometricKitStatistics
BiometricKit
BiometricKitDelegate
BiometricKitIdentity
NSSecureCoding
NSCoding
BiometricKitMatchInfo
BiometricKitEnrollProgressInfo
BiometricKitEnrollProgressCoordinates
BiometricKitEnrollProgressMergedComponent
BiometricKitDebugLog
</pre>

{{stub|hardware}}

Touch ID

2013-09-10T20:45:49Z

Iemit737: Detailing the "Secure Enclave" with suspected technology derived from String Dump and a source who worked with NXP & fingerprint hardware.

The [[iPhone 5s]] comes equipped with '''Touch ID''', a fingerprint scanner. Currently, there is no official developer API for it, because it is intended for unlocking the device and purchasing items on [[iTunes Store]] only.

However there is a private API for it; its dylib file is in [[Xcode]] 5 in the path
<pre>Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS7.0.sdk/System/Library/PrivateFrameworks/BiometricKit.framework/BiometricKit</pre>

Since it contains a 64-bit ARM segment only, the common disassembly tools cannot process the file.

==Inferred Information==
Based on a string dump, here is what is implied.
<ul>
<li>The codename for it was "mesa" </li>
<li>It communicates over XPC to a binary that handles access to it </li>
<li>There's a kernel extension to interface with it </li>
<li>The kernel extension communicates to the secure keystore to set and verify fingerprints </li>
<li>The fingerprint scanner calibrates itself and has upgradable firmware </li>
<li>The fingerprint scanner uses normal image formats (i.e. UIImage) before setting and verifying fingerprints </li>
<li>There's biometric lockout as well as passcode lockout </li>
<li> The A7 chip contains a secure element marketed as the Secure Enclave. The string dump refers to SEP, the Secure Element Protocol. This chip is most likely one sourced from NXP. It contains physical security to ensure that the only operations of the chip involve setting new fingerprints and verifying fingerprints against the ones stored in it (i.e. challenge-response). This way, the fingerprint data cannot be extracted from it. </li>
</ul>

== String Dump ==
Below there is a full string dump of the framework, which can hint at its functionalities.
<pre>
initWithMachServiceName:options:
connectWithReplyBlock:
registerDelegate:withReplyBlock:
suspendWork:withReplyBlock:
enroll:withAuthToken:withReplyBlock:
match:withReplyBlock:
match:withOptions:withReplyBlock:
matchIdentities:withReplyBlock:
cancelWithReplyBlock:
updateIdentity:withReplyBlock:
removeIdentity:withReplyBlock:
getIdentityFromUUID:withReplyBlock:
identities:withReplyBlock:
resetEngineWithReplyBlock:
registerDSID:withAuthToken:withReplyBlock:
registerStoreToken:withReplyBlock:
getCountersignedStoreTokenWithReplyBlock:
getMaxIdentityCount:withReplyBlock:
enrollContinueWithReplyBlock:
pullAlignmentDataWithReplyBlock:
pullMatchTopologyDataWithReplyBlock:
getNodeTopologyForIdentity:withReplyBlock:
preventAutonomousMatchingMode:withReplyBlock:
getProvisioningStateWithReplyBlock:
getCalBlobVersionWithReplyBlock:
getSensorCalibrationStatusWithReplyBlock:
getCalibrationDataStateWithReplyBlock:
setDebugImages:withReplyBlock:
pullCaptureBufferWithReplyBlock:
pullDebugImageData:withReplyBlock:
provisionSensorWithReplyBlock:
unpairSensorWithReplyBlock:
lockSensorWithReplyBlock:
getSerialisedTemplateForIdentity:withReplyBlock:
interfaceWithProtocol:
setRemoteObjectInterface:
remoteObjectInterface
setWithObject:
setClasses:forSelector:argumentIndex:ofReply:
setWithObjects:
enrollResult:
matchResult:
statusMessage:
homeButtonPressed
setExportedInterface:
setExportedObject:
setInterruptionHandler:
resume
invalidate
remoteObjectProxyWithErrorHandler:
code
respondsToSelector:
connect
registerDelegate:
suspendWork:
enroll:withAuthToken:
match:
match:withOptions:
matchIdentities:
cancel
updateIdentity:
removeIdentity:
getIdentityFromUUID:
identities:
getMaxIdentityCount:
resetEngine
enrollContinue
pullAlignmentData
pullMatchTopologyData
getNodeTopologyForIdentity:
preventAutonomousMatchingMode:
getProvisioningState
registerDSID:withAuthToken:
registerStoreToken:
getCountersignedStoreToken:
getCalBlobVersion
getSensorCalibrationStatus
getCalibrationDataState
pullCaptureBuffer
pullDebugImageData:imageWidth:imageHeight:
provisionSensor
unpairSensor
lockSensor
setDebugImages:
getSerialisedTemplateForIdentity:
delegate
setDelegate:
interruptionHandler
_connection
_delegate
_interruptionHandler
setTopology:
setDetails:
topology
details
_topology
_details
initEnrollmentValues
message
messageDetails
objectForKeyedSubscript:
currentPrimaryComponentID
integerValue
doubleValue
statistics
enroll:
enrollResult:componentSet:
enrollProgress:
_fingerOn
_enrolling
_badImagePerFingerDown
_enrollmentStarTime
_touchesPerEnroll
_badImagesPerEnroll
_rejectedImagesPerEnroll
_primaryClusterAdditions
_primaryClusterFailedAdditions
_otherClustersAdditions
_joinEvents
_area
_primaryClusterArea
numberWithBool:
preferencesGetStringValue:
preferencesGetBOOLValue:
enableLogger:toPath:
manager
defaultCenter
appDidEnterBackground:
addObserver:selector:name:object:
appWillEnterForeground:
bundleForClass:
imageNamed:inBundle:
updateEnableLogger
dataWithBytes:length:
startEnrollLog
data
logRemoveIdentity:
bytes
imageFromRawImageData:
imageFromBitmapData:inRect:
pullDebugImageData:target:
getRadarAtachmentsForLastEnrollment
getRadarAtachmentsForLastMatch
length
stringWithString:
getModulationRatio
stringForProvisioningState:
getSensorPatchVersion
stringWithFormat:
getLogsForProcess:
sharedConnection
isFingerprintUnlockAllowed
setGracePeriod:passcode:completionBlock:
finishEnrollLogWithStatus:withIdentity:withTemplate:
matchResult:withDetails:
createMatchInfo:withTopology:withMatchImage:
logMatchResult:withTopology:withImage:withCaptureBuffer:withTemplate:
getBytes:length:
logEnrollMessage:withTopology:withImage:withCaptureBuffer:
logStatus:
enrollProgressMessage:
logRejectedImage:
size
drawInRect:
drawInRect:blendMode:alpha:
CGImage
scale
imageOrientation
imageWithCGImage:scale:orientation:
imageWithImage:inRect:
identityImage:
imageWithImage:withNode:withRect:alpha:
compositeTopologyImage:
imageTopology:forGroup:
imageFauxprint:withTheta:withLamda:
greenColor
imageWithImage:withTintColor:
dataWithData:
imageWithCGImage:
preferencesSetBOOLValue:forKey:
pullDebugImage:
getLoggerAttachmentsForRadar:
stringFromSensorConfiguration
matchIdentity:
topologyImage:
imageWithImage:withMaskImage:
inUse
setInUse:
enrollProgressConfigRenderMode
setEnrollProgressConfigRenderMode:
enrollProgressConfigRenderViewSize
setEnrollProgressConfigRenderViewSize:
renderMode
setRenderMode:
opacity
setOpacity:
_xpcClient
_enrollingMode
_matchingMode
_statistics
_scanbedImage
_fauxprintImage
_nodeRect
_images
_compSet
_rejectTouchCount
_rejectTouch
_showDebugImages
_enableLogger
_enrollImageSet
_isInternalInstall
_inUse
_enrollProgressConfigRenderMode
_renderMode
_opacity
_enrollProgressConfigRenderViewSize
setUuid:
decodeBytesForKey:returnedLength:
initWithUUIDBytes:
decodeIntForKey:
decodeObjectOfClass:forKey:
copy
getUUIDBytes:
encodeBytes:length:forKey:
encodeInt:forKey:
encodeObject:forKey:
biometricKitIdentity
supportsSecureCoding
encodeWithCoder:
initWithCoder:
uuid
type
setType:
attribute
setAttribute:
entity
setEntity:
name
setName:
stringByReplacingOccurrencesOfString:withString:
initWithCapacity:
setLength:
mutableBytes
defaultManager
createDirectoryAtPath:withIntermediateDirectories:attributes:error:
removeItemAtPath:error:
UUIDString
setMessageDetails:
setCaptureImage:
setRenderedImage:
progress
setProgress:
setCurrentPrimaryComponentID:
captureImage
renderedImage
setMessage:
_message
_progress
_currentPrimaryComponentID
_captureImage
_renderedImage
_messageDetails
setX:
setY:
angle
setAngle:
_angle
setTransformationCoordinates:
componentID
setComponentID:
transformationCoordinates
_componentID
_transformationCoordinates
pathComponents
com.apple.biometrickitd
T@"<BiometricKitDelegate>",N,V_delegate
interruptionHandler
T@?,C,N,V_interruptionHandler
topology
T@"NSDictionary",&,N,V_details
com.apple.fingerprint.enroll.attempts
com.apple.fingerprint.enroll.passes
com.apple.fingerprint.enroll.touchesPerEnroll
com.apple.fingerprint.enroll.badImagesPerEnroll
com.apple.fingerprint.enroll.rejectedImagesPerEnroll
com.apple.fingerprint.enroll.primaryClusterAdditions
com.apple.fingerprint.enroll.primaryClusterFailedAdditions
com.apple.fingerprint.enroll.otherClustersAdditions
com.apple.fingerprint.enroll.joinEvents
com.apple.fingerprint.enroll.clusterCount
com.apple.fingerprint.enroll.nodeCount
com.apple.fingerprint.enroll.primaryClusterNodeCount
com.apple.fingerprint.enroll.area
com.apple.fingerprint.enroll.primaryClusterArea
com.apple.fingerprint.enroll.passTime
com.apple.fingerprint.enroll.fails
com.apple.fingerprint.enroll.failTime
com.apple.ManagedConfiguration.profileListChanged
com.apple.biometrickitd.debugLogEnabled
com.apple.biometrickitd.debugLogPath
debugLogEnabled
debugLogPath
BKOptionSuppressHapticFeedback
BKOptionFilterOutHomeButtonEvents
BKOptionMatchForUnlock
InternalBuild
scanbed
synthetic
Uninitialized
Not Provisioned
Unprovisioned
Provisioned
Provisioned Locked
Unpaired
Unknown
biosensor,mesa
modulation-ratio
AppleBiometricSensor
patch-version
Mesa configuration:
Provisioning Status: %@
Calibrated:
- Version:
- Signed:
Modulation ratio:
Kernel:
Thick kernel
Thin kernel
Sensor Patch Version:
Steps to Reproduce:
inUse
TB,V_inUse
enrollProgressConfigRenderMode
Ti,N,V_enrollProgressConfigRenderMode
enrollProgressConfigRenderViewSize
T{CGSize=dd},N,V_enrollProgressConfigRenderViewSize
renderMode
Ti,N,V_renderMode
opacity
Tf,N,V_opacity
Notification callback.
BiometricKitErrorDomain
BKIdentityUUID
BKIdentityType
BKIdentityAttribute
BKIdentityEntityNumber
BKIdentityName
/var/mobile/BiometricKit/biometrickitd
BKEPDReason
BKEPDNewNodeID
BKEPDNewComponentID
BKEPDNewNodeCoordinates
BKEPDRemovedNodeID
BKEPDRemovedComponentID
BKEPDExtendedComponentID
BKEPDResultComponentID
BKEPDMergedInComponents
BKEPDRedundantNode
BKTDLargestCompArea
BKTDLargestCompNodes
BKTDTotalArea
BKTDTotalNodes
BKTemplateUpdated
Td,N,V_x
Td,N,V_y
angle
Td,N,V_angle
componentID
Tq,N,V_componentID
transformationCoordinates
T@"BiometricKitEnrollProgressCoordinates",&,N,V_transformationCoordinates
Remove identity: %@
Log package:%@
biometrickitd
%@.tar.gz
cd %@ && tar -cjf %@ %@
Time: % 8.3f
PASS
FAIL
Closing log with result %@
Template identity:
UUID : %@
Type : %i
Attrib: %i
Entity: %i
Error: Unable to get identity
Serialised template: %@
%@_%04d.bin
Status message: %@
Progress %i
Count of enrollments: %i
BiometricKitErrorTaskCancelled
BiometricKitErrorIdentityInvalid
BiometricKitErrorIdentityNotAllowed
BiometricKitErrorIdentityErrorInvalidData
BiometricKitErrorIdentityErrorUnknown
BiometricKitStatusFingerOn
BiometricKitStatusFingerOff
BiometricKitStatusEnrollmentComplete
BiometricKitStatusEnrollmentCancelled
BiometricKitStatusEnrollmentFailed
BiometricKitStatusEnrollmentTimeout
BiometricKitStatusUnknownError
BiometricKitStatusImageRejected
BiometricKitStatusNoCalibration
BiometricKitImageForProcessing
BiometricKitStatusTemplateListUpdated
BiometricKitStatusRequestFingerOff
BiometricKitStatusAutoMatchingStarted
BiometricKitStatusAutoMatchingStopped
BiometricKitStatusCaptureRestart
BiometricKitStatusScanTooShort
BiometricKitStatusAutoMatchingStartByHomeButton
BiometricKitStatusMatchingCancelled
BiometricKitStatusFingerOnBeforeFirstPasscodeUnlock
BiometricKitStatusFingerOnInPasscodeLockout
BiometricKitStatusFingerOnInBioLockout
BiometricKitStatusFingerOnTokenExpired
BiometricKitStatusESDRecovery
BiometricKitStatusImageRejectedUnknown
BiometricKitStatusImageRejectedBadBlocks
BiometricKitStatusImageRejectedChFPN
BiometricKitStatusImageRejectedCaFPN
BiometricKitStatusSensorOperationModeIdle
BiometricKitStatusSensorOperationModeCapture
BiometricKitStatusSensorOperationModePause
Other unknown status %i
Image #%i was rejected
Sensor patch version: %ld
Sensor patch version: unknown
Calibration Data: %@
Capture buffer: %@
Matcher: image refused
Matcher: image %s node %u
added as
replaced
Coordinates: %s[%i, %i, %i]
inverse of
Parent: %i
Processed image: %@
Enroll debug log, version 7
static const node_placement_t table_%02i =
%@{%i,%i,%i,%i,%i,%i,{
%@{%i,%i,%i,%i,%i}
%@},%i,%i,%i,%i,%i,0x%04x};
bin8
bin16
binXX
calibdata.bin
calibration-blob
Image #%i%s
was sent to matcher
Match result
Match details:
Matching score: %i
Match S2S count: %i
Matching node: %i
Updated node: %i
Not available
No match (artificial)
No match
Image #%i
Warning: the log is not complete, previous part of the log was deleted.
Starting enrollment
Starting matching
No known identities with enroll log are available.
Known identities with enroll log available:
%@ : %@
Match debug log, version 7
messages.log
OS version: %@ (%@)
Mesa: %@
Process name:%@
PrimaryUsagePage
PrimaryUsage
com.apple.iokit.hid.displayStatus
com.apple.mobile.keybagd.lock_status
AppleMesaSEPDriver
IOGeneralInterest
ScanningState
ScanningStateIdle
ScanningStateShortScanning
ScanningStateLongScanning
Unknown scanning state %i
Event: %@
HomeButtonPress
ExtendedDeviceLockState
MobileKeyBagDeviceIsUnlocked
MobileKeyBagDeviceIsLocked
MobileKeyBagDeviceIsLocking
MobileKeyBagDisabled
MobileKeyBagDeviceUnlockInProgress
MobileKeyBagDeviceInGracePeriod
MobileKeyBagDeviceInAssertDelay
MobileKeyBagDeviceInBioUnlock
Unknown lock state %i
DisplayOn
DisplayOff
/SourceCache/Mesa/Mesa-152/AppleBiometricServices/BiometricKit/BiometricKitDebugLog.m
/var/mobile/Library/Logs/CrashReporter/BiometricKit
v24@0:8@"BiometricKitIdentity"16
@"NSXPCConnection"
@"<BiometricKitDelegate>"
@"BiometricKitXPCClient"
@"BiometricKitStatistics"
@"UIImage"
[25{CGRect="origin"{CGPoint="x"d"y"d}"size"{CGSize="width"d"height"d}}]
[25@"UIImage"]
{?="count"i"capa"i"items"^^{?}"unusedImageCount"i"componentCount"i"componentCapa"i"bestComponentIndex"i"bestMapiComponentIndex"i"components"^^{?}"mapiNodeAddedIndex"s"mapiNodeRemovedIndex"s"updateCount"i"structureIsInconsistent"B}
{?="nodes"[25{?="imageData"@"NSData""width"I"height"I}]}
BiometricKitXpcProtocol
BiometricKitDelegateXpcProtocol
BiometricKitXPCClient
BiometricKitTemplateInfo
BiometricKitStatistics
BiometricKit
BiometricKitDelegate
BiometricKitIdentity
NSSecureCoding
NSCoding
BiometricKitMatchInfo
BiometricKitEnrollProgressInfo
BiometricKitEnrollProgressCoordinates
BiometricKitEnrollProgressMergedComponent
BiometricKitDebugLog
</pre>

{{stub|hardware}}

Touch ID

2013-09-10T20:31:25Z

Iemit737: /* Inferred Information */ typos

The iPhone 5S comes equipped with a fingerprint scanner. There is not an official developer API for it.

However there is a private API for it. The dylib file for it is here:
/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS7.0.sdk/System/Library/PrivateFrameworks/BiometricKit.framework/BiometricKit

It contains only a 64-bit Arm segment, and so the common disassembly tools cannot process the instructions well.

==Inferred Information==
Based on the string dump, here is what is implied.
<ul>
<li>The codename for it was "mesa" </li>
<li>It communicates over XPC to a binary that handles access to it </li>
<li>There's a kernel extension to interface with it </li>
<li>The kernel extension communicates to the secure keystore to set and verify fingerprints </li>
<li>The fingerprint scanner calibrates itself and has upgradable firmware </li>
<li>The fingerprint scanner uses normal image formats (i.e. UIImage) before setting and verifying fingerprints </li>
<li>There's biometric lockout as well as passcode lockout </li>
</ul>

== String Dump ==
Here is the long string dump of the contents of the BiometricKit library. These strings hint at the functionality of the framework.
<pre>
initWithMachServiceName:options:
connectWithReplyBlock:
registerDelegate:withReplyBlock:
suspendWork:withReplyBlock:
enroll:withAuthToken:withReplyBlock:
match:withReplyBlock:
match:withOptions:withReplyBlock:
matchIdentities:withReplyBlock:
cancelWithReplyBlock:
updateIdentity:withReplyBlock:
removeIdentity:withReplyBlock:
getIdentityFromUUID:withReplyBlock:
identities:withReplyBlock:
resetEngineWithReplyBlock:
registerDSID:withAuthToken:withReplyBlock:
registerStoreToken:withReplyBlock:
getCountersignedStoreTokenWithReplyBlock:
getMaxIdentityCount:withReplyBlock:
enrollContinueWithReplyBlock:
pullAlignmentDataWithReplyBlock:
pullMatchTopologyDataWithReplyBlock:
getNodeTopologyForIdentity:withReplyBlock:
preventAutonomousMatchingMode:withReplyBlock:
getProvisioningStateWithReplyBlock:
getCalBlobVersionWithReplyBlock:
getSensorCalibrationStatusWithReplyBlock:
getCalibrationDataStateWithReplyBlock:
setDebugImages:withReplyBlock:
pullCaptureBufferWithReplyBlock:
pullDebugImageData:withReplyBlock:
provisionSensorWithReplyBlock:
unpairSensorWithReplyBlock:
lockSensorWithReplyBlock:
getSerialisedTemplateForIdentity:withReplyBlock:
interfaceWithProtocol:
setRemoteObjectInterface:
remoteObjectInterface
setWithObject:
setClasses:forSelector:argumentIndex:ofReply:
setWithObjects:
enrollResult:
matchResult:
statusMessage:
homeButtonPressed
setExportedInterface:
setExportedObject:
setInterruptionHandler:
resume
invalidate
remoteObjectProxyWithErrorHandler:
code
respondsToSelector:
connect
registerDelegate:
suspendWork:
enroll:withAuthToken:
match:
match:withOptions:
matchIdentities:
cancel
updateIdentity:
removeIdentity:
getIdentityFromUUID:
identities:
getMaxIdentityCount:
resetEngine
enrollContinue
pullAlignmentData
pullMatchTopologyData
getNodeTopologyForIdentity:
preventAutonomousMatchingMode:
getProvisioningState
registerDSID:withAuthToken:
registerStoreToken:
getCountersignedStoreToken:
getCalBlobVersion
getSensorCalibrationStatus
getCalibrationDataState
pullCaptureBuffer
pullDebugImageData:imageWidth:imageHeight:
provisionSensor
unpairSensor
lockSensor
setDebugImages:
getSerialisedTemplateForIdentity:
delegate
setDelegate:
interruptionHandler
_connection
_delegate
_interruptionHandler
setTopology:
setDetails:
topology
details
_topology
_details
initEnrollmentValues
message
messageDetails
objectForKeyedSubscript:
currentPrimaryComponentID
integerValue
doubleValue
statistics
enroll:
enrollResult:componentSet:
enrollProgress:
_fingerOn
_enrolling
_badImagePerFingerDown
_enrollmentStarTime
_touchesPerEnroll
_badImagesPerEnroll
_rejectedImagesPerEnroll
_primaryClusterAdditions
_primaryClusterFailedAdditions
_otherClustersAdditions
_joinEvents
_area
_primaryClusterArea
numberWithBool:
preferencesGetStringValue:
preferencesGetBOOLValue:
enableLogger:toPath:
manager
defaultCenter
appDidEnterBackground:
addObserver:selector:name:object:
appWillEnterForeground:
bundleForClass:
imageNamed:inBundle:
updateEnableLogger
dataWithBytes:length:
startEnrollLog
data
logRemoveIdentity:
bytes
imageFromRawImageData:
imageFromBitmapData:inRect:
pullDebugImageData:target:
getRadarAtachmentsForLastEnrollment
getRadarAtachmentsForLastMatch
length
stringWithString:
getModulationRatio
stringForProvisioningState:
getSensorPatchVersion
stringWithFormat:
getLogsForProcess:
sharedConnection
isFingerprintUnlockAllowed
setGracePeriod:passcode:completionBlock:
finishEnrollLogWithStatus:withIdentity:withTemplate:
matchResult:withDetails:
createMatchInfo:withTopology:withMatchImage:
logMatchResult:withTopology:withImage:withCaptureBuffer:withTemplate:
getBytes:length:
logEnrollMessage:withTopology:withImage:withCaptureBuffer:
logStatus:
enrollProgressMessage:
logRejectedImage:
size
drawInRect:
drawInRect:blendMode:alpha:
CGImage
scale
imageOrientation
imageWithCGImage:scale:orientation:
imageWithImage:inRect:
identityImage:
imageWithImage:withNode:withRect:alpha:
compositeTopologyImage:
imageTopology:forGroup:
imageFauxprint:withTheta:withLamda:
greenColor
imageWithImage:withTintColor:
dataWithData:
imageWithCGImage:
preferencesSetBOOLValue:forKey:
pullDebugImage:
getLoggerAttachmentsForRadar:
stringFromSensorConfiguration
matchIdentity:
topologyImage:
imageWithImage:withMaskImage:
inUse
setInUse:
enrollProgressConfigRenderMode
setEnrollProgressConfigRenderMode:
enrollProgressConfigRenderViewSize
setEnrollProgressConfigRenderViewSize:
renderMode
setRenderMode:
opacity
setOpacity:
_xpcClient
_enrollingMode
_matchingMode
_statistics
_scanbedImage
_fauxprintImage
_nodeRect
_images
_compSet
_rejectTouchCount
_rejectTouch
_showDebugImages
_enableLogger
_enrollImageSet
_isInternalInstall
_inUse
_enrollProgressConfigRenderMode
_renderMode
_opacity
_enrollProgressConfigRenderViewSize
setUuid:
decodeBytesForKey:returnedLength:
initWithUUIDBytes:
decodeIntForKey:
decodeObjectOfClass:forKey:
copy
getUUIDBytes:
encodeBytes:length:forKey:
encodeInt:forKey:
encodeObject:forKey:
biometricKitIdentity
supportsSecureCoding
encodeWithCoder:
initWithCoder:
uuid
type
setType:
attribute
setAttribute:
entity
setEntity:
name
setName:
stringByReplacingOccurrencesOfString:withString:
initWithCapacity:
setLength:
mutableBytes
defaultManager
createDirectoryAtPath:withIntermediateDirectories:attributes:error:
removeItemAtPath:error:
UUIDString
setMessageDetails:
setCaptureImage:
setRenderedImage:
progress
setProgress:
setCurrentPrimaryComponentID:
captureImage
renderedImage
setMessage:
_message
_progress
_currentPrimaryComponentID
_captureImage
_renderedImage
_messageDetails
setX:
setY:
angle
setAngle:
_angle
setTransformationCoordinates:
componentID
setComponentID:
transformationCoordinates
_componentID
_transformationCoordinates
pathComponents
com.apple.biometrickitd
T@"<BiometricKitDelegate>",N,V_delegate
interruptionHandler
T@?,C,N,V_interruptionHandler
topology
T@"NSDictionary",&,N,V_details
com.apple.fingerprint.enroll.attempts
com.apple.fingerprint.enroll.passes
com.apple.fingerprint.enroll.touchesPerEnroll
com.apple.fingerprint.enroll.badImagesPerEnroll
com.apple.fingerprint.enroll.rejectedImagesPerEnroll
com.apple.fingerprint.enroll.primaryClusterAdditions
com.apple.fingerprint.enroll.primaryClusterFailedAdditions
com.apple.fingerprint.enroll.otherClustersAdditions
com.apple.fingerprint.enroll.joinEvents
com.apple.fingerprint.enroll.clusterCount
com.apple.fingerprint.enroll.nodeCount
com.apple.fingerprint.enroll.primaryClusterNodeCount
com.apple.fingerprint.enroll.area
com.apple.fingerprint.enroll.primaryClusterArea
com.apple.fingerprint.enroll.passTime
com.apple.fingerprint.enroll.fails
com.apple.fingerprint.enroll.failTime
com.apple.ManagedConfiguration.profileListChanged
com.apple.biometrickitd.debugLogEnabled
com.apple.biometrickitd.debugLogPath
debugLogEnabled
debugLogPath
BKOptionSuppressHapticFeedback
BKOptionFilterOutHomeButtonEvents
BKOptionMatchForUnlock
InternalBuild
scanbed
synthetic
Uninitialized
Not Provisioned
Unprovisioned
Provisioned
Provisioned Locked
Unpaired
Unknown
biosensor,mesa
modulation-ratio
AppleBiometricSensor
patch-version
Mesa configuration:
Provisioning Status: %@
Calibrated:
- Version:
- Signed:
Modulation ratio:
Kernel:
Thick kernel
Thin kernel
Sensor Patch Version:
Steps to Reproduce:
inUse
TB,V_inUse
enrollProgressConfigRenderMode
Ti,N,V_enrollProgressConfigRenderMode
enrollProgressConfigRenderViewSize
T{CGSize=dd},N,V_enrollProgressConfigRenderViewSize
renderMode
Ti,N,V_renderMode
opacity
Tf,N,V_opacity
Notification callback.
BiometricKitErrorDomain
BKIdentityUUID
BKIdentityType
BKIdentityAttribute
BKIdentityEntityNumber
BKIdentityName
/var/mobile/BiometricKit/biometrickitd
BKEPDReason
BKEPDNewNodeID
BKEPDNewComponentID
BKEPDNewNodeCoordinates
BKEPDRemovedNodeID
BKEPDRemovedComponentID
BKEPDExtendedComponentID
BKEPDResultComponentID
BKEPDMergedInComponents
BKEPDRedundantNode
BKTDLargestCompArea
BKTDLargestCompNodes
BKTDTotalArea
BKTDTotalNodes
BKTemplateUpdated
Td,N,V_x
Td,N,V_y
angle
Td,N,V_angle
componentID
Tq,N,V_componentID
transformationCoordinates
T@"BiometricKitEnrollProgressCoordinates",&,N,V_transformationCoordinates
Remove identity: %@
Log package:%@
biometrickitd
%@.tar.gz
cd %@ && tar -cjf %@ %@
Time: % 8.3f
PASS
FAIL
Closing log with result %@
Template identity:
UUID : %@
Type : %i
Attrib: %i
Entity: %i
Error: Unable to get identity
Serialised template: %@
%@_%04d.bin
Status message: %@
Progress %i
Count of enrollments: %i
BiometricKitErrorTaskCancelled
BiometricKitErrorIdentityInvalid
BiometricKitErrorIdentityNotAllowed
BiometricKitErrorIdentityErrorInvalidData
BiometricKitErrorIdentityErrorUnknown
BiometricKitStatusFingerOn
BiometricKitStatusFingerOff
BiometricKitStatusEnrollmentComplete
BiometricKitStatusEnrollmentCancelled
BiometricKitStatusEnrollmentFailed
BiometricKitStatusEnrollmentTimeout
BiometricKitStatusUnknownError
BiometricKitStatusImageRejected
BiometricKitStatusNoCalibration
BiometricKitImageForProcessing
BiometricKitStatusTemplateListUpdated
BiometricKitStatusRequestFingerOff
BiometricKitStatusAutoMatchingStarted
BiometricKitStatusAutoMatchingStopped
BiometricKitStatusCaptureRestart
BiometricKitStatusScanTooShort
BiometricKitStatusAutoMatchingStartByHomeButton
BiometricKitStatusMatchingCancelled
BiometricKitStatusFingerOnBeforeFirstPasscodeUnlock
BiometricKitStatusFingerOnInPasscodeLockout
BiometricKitStatusFingerOnInBioLockout
BiometricKitStatusFingerOnTokenExpired
BiometricKitStatusESDRecovery
BiometricKitStatusImageRejectedUnknown
BiometricKitStatusImageRejectedBadBlocks
BiometricKitStatusImageRejectedChFPN
BiometricKitStatusImageRejectedCaFPN
BiometricKitStatusSensorOperationModeIdle
BiometricKitStatusSensorOperationModeCapture
BiometricKitStatusSensorOperationModePause
Other unknown status %i
Image #%i was rejected
Sensor patch version: %ld
Sensor patch version: unknown
Calibration Data: %@
Capture buffer: %@
Matcher: image refused
Matcher: image %s node %u
added as
replaced
Coordinates: %s[%i, %i, %i]
inverse of
Parent: %i
Processed image: %@
Enroll debug log, version 7
static const node_placement_t table_%02i =
%@{%i,%i,%i,%i,%i,%i,{
%@{%i,%i,%i,%i,%i}
%@},%i,%i,%i,%i,%i,0x%04x};
bin8
bin16
binXX
calibdata.bin
calibration-blob
Image #%i%s
was sent to matcher
Match result
Match details:
Matching score: %i
Match S2S count: %i
Matching node: %i
Updated node: %i
Not available
No match (artificial)
No match
Image #%i
Warning: the log is not complete, previous part of the log was deleted.
Starting enrollment
Starting matching
No known identities with enroll log are available.
Known identities with enroll log available:
%@ : %@
Match debug log, version 7
messages.log
OS version: %@ (%@)
Mesa: %@
Process name:%@
PrimaryUsagePage
PrimaryUsage
com.apple.iokit.hid.displayStatus
com.apple.mobile.keybagd.lock_status
AppleMesaSEPDriver
IOGeneralInterest
ScanningState
ScanningStateIdle
ScanningStateShortScanning
ScanningStateLongScanning
Unknown scanning state %i
Event: %@
HomeButtonPress
ExtendedDeviceLockState
MobileKeyBagDeviceIsUnlocked
MobileKeyBagDeviceIsLocked
MobileKeyBagDeviceIsLocking
MobileKeyBagDisabled
MobileKeyBagDeviceUnlockInProgress
MobileKeyBagDeviceInGracePeriod
MobileKeyBagDeviceInAssertDelay
MobileKeyBagDeviceInBioUnlock
Unknown lock state %i
DisplayOn
DisplayOff
/SourceCache/Mesa/Mesa-152/AppleBiometricServices/BiometricKit/BiometricKitDebugLog.m
/var/mobile/Library/Logs/CrashReporter/BiometricKit
v24@0:8@"BiometricKitIdentity"16
@"NSXPCConnection"
@"<BiometricKitDelegate>"
@"BiometricKitXPCClient"
@"BiometricKitStatistics"
@"UIImage"
[25{CGRect="origin"{CGPoint="x"d"y"d}"size"{CGSize="width"d"height"d}}]
[25@"UIImage"]
{?="count"i"capa"i"items"^^{?}"unusedImageCount"i"componentCount"i"componentCapa"i"bestComponentIndex"i"bestMapiComponentIndex"i"components"^^{?}"mapiNodeAddedIndex"s"mapiNodeRemovedIndex"s"updateCount"i"structureIsInconsistent"B}
{?="nodes"[25{?="imageData"@"NSData""width"I"height"I}]}
BiometricKitXpcProtocol
BiometricKitDelegateXpcProtocol
BiometricKitXPCClient
BiometricKitTemplateInfo
BiometricKitStatistics
BiometricKit
BiometricKitDelegate
BiometricKitIdentity
NSSecureCoding
NSCoding
BiometricKitMatchInfo
BiometricKitEnrollProgressInfo
BiometricKitEnrollProgressCoordinates
BiometricKitEnrollProgressMergedComponent
BiometricKitDebugLog

</pre>

Touch ID

2013-09-10T20:30:35Z

Iemit737: /* Inferred Information */ Switch to unordered list. Oops

The iPhone 5S comes equipped with a fingerprint scanner. There is not an official developer API for it.

However there is a private API for it. The dylib file for it is here:
/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS7.0.sdk/System/Library/PrivateFrameworks/BiometricKit.framework/BiometricKit

It contains only a 64-bit Arm segment, and so the common disassembly tools cannot process the instructions well.

==Inferred Information==
Based on the string dump, here is what is implied.
<ul>
<li>The codename for it was "mesa" </li>
<li>It communicates over XPC to a binary that handles access to it </li>
<li>There's a kernel extension to interface with it </li>
<li>The kernel extension communicates to the secure keystore to set and verify fingerprints </li>
<li>The fingerprint scanner calibrates itself and has upgradable firmware </li>
<li>The fingerprint scanner works involves normal image formats (i.e. UIImage) before settings and verifying fingerprints </li>
<li>There's biometric lockout as well as passcode lockout </li>
</ul>

== String Dump ==
Here is the long string dump of the contents of the BiometricKit library. These strings hint at the functionality of the framework.
<pre>
initWithMachServiceName:options:
connectWithReplyBlock:
registerDelegate:withReplyBlock:
suspendWork:withReplyBlock:
enroll:withAuthToken:withReplyBlock:
match:withReplyBlock:
match:withOptions:withReplyBlock:
matchIdentities:withReplyBlock:
cancelWithReplyBlock:
updateIdentity:withReplyBlock:
removeIdentity:withReplyBlock:
getIdentityFromUUID:withReplyBlock:
identities:withReplyBlock:
resetEngineWithReplyBlock:
registerDSID:withAuthToken:withReplyBlock:
registerStoreToken:withReplyBlock:
getCountersignedStoreTokenWithReplyBlock:
getMaxIdentityCount:withReplyBlock:
enrollContinueWithReplyBlock:
pullAlignmentDataWithReplyBlock:
pullMatchTopologyDataWithReplyBlock:
getNodeTopologyForIdentity:withReplyBlock:
preventAutonomousMatchingMode:withReplyBlock:
getProvisioningStateWithReplyBlock:
getCalBlobVersionWithReplyBlock:
getSensorCalibrationStatusWithReplyBlock:
getCalibrationDataStateWithReplyBlock:
setDebugImages:withReplyBlock:
pullCaptureBufferWithReplyBlock:
pullDebugImageData:withReplyBlock:
provisionSensorWithReplyBlock:
unpairSensorWithReplyBlock:
lockSensorWithReplyBlock:
getSerialisedTemplateForIdentity:withReplyBlock:
interfaceWithProtocol:
setRemoteObjectInterface:
remoteObjectInterface
setWithObject:
setClasses:forSelector:argumentIndex:ofReply:
setWithObjects:
enrollResult:
matchResult:
statusMessage:
homeButtonPressed
setExportedInterface:
setExportedObject:
setInterruptionHandler:
resume
invalidate
remoteObjectProxyWithErrorHandler:
code
respondsToSelector:
connect
registerDelegate:
suspendWork:
enroll:withAuthToken:
match:
match:withOptions:
matchIdentities:
cancel
updateIdentity:
removeIdentity:
getIdentityFromUUID:
identities:
getMaxIdentityCount:
resetEngine
enrollContinue
pullAlignmentData
pullMatchTopologyData
getNodeTopologyForIdentity:
preventAutonomousMatchingMode:
getProvisioningState
registerDSID:withAuthToken:
registerStoreToken:
getCountersignedStoreToken:
getCalBlobVersion
getSensorCalibrationStatus
getCalibrationDataState
pullCaptureBuffer
pullDebugImageData:imageWidth:imageHeight:
provisionSensor
unpairSensor
lockSensor
setDebugImages:
getSerialisedTemplateForIdentity:
delegate
setDelegate:
interruptionHandler
_connection
_delegate
_interruptionHandler
setTopology:
setDetails:
topology
details
_topology
_details
initEnrollmentValues
message
messageDetails
objectForKeyedSubscript:
currentPrimaryComponentID
integerValue
doubleValue
statistics
enroll:
enrollResult:componentSet:
enrollProgress:
_fingerOn
_enrolling
_badImagePerFingerDown
_enrollmentStarTime
_touchesPerEnroll
_badImagesPerEnroll
_rejectedImagesPerEnroll
_primaryClusterAdditions
_primaryClusterFailedAdditions
_otherClustersAdditions
_joinEvents
_area
_primaryClusterArea
numberWithBool:
preferencesGetStringValue:
preferencesGetBOOLValue:
enableLogger:toPath:
manager
defaultCenter
appDidEnterBackground:
addObserver:selector:name:object:
appWillEnterForeground:
bundleForClass:
imageNamed:inBundle:
updateEnableLogger
dataWithBytes:length:
startEnrollLog
data
logRemoveIdentity:
bytes
imageFromRawImageData:
imageFromBitmapData:inRect:
pullDebugImageData:target:
getRadarAtachmentsForLastEnrollment
getRadarAtachmentsForLastMatch
length
stringWithString:
getModulationRatio
stringForProvisioningState:
getSensorPatchVersion
stringWithFormat:
getLogsForProcess:
sharedConnection
isFingerprintUnlockAllowed
setGracePeriod:passcode:completionBlock:
finishEnrollLogWithStatus:withIdentity:withTemplate:
matchResult:withDetails:
createMatchInfo:withTopology:withMatchImage:
logMatchResult:withTopology:withImage:withCaptureBuffer:withTemplate:
getBytes:length:
logEnrollMessage:withTopology:withImage:withCaptureBuffer:
logStatus:
enrollProgressMessage:
logRejectedImage:
size
drawInRect:
drawInRect:blendMode:alpha:
CGImage
scale
imageOrientation
imageWithCGImage:scale:orientation:
imageWithImage:inRect:
identityImage:
imageWithImage:withNode:withRect:alpha:
compositeTopologyImage:
imageTopology:forGroup:
imageFauxprint:withTheta:withLamda:
greenColor
imageWithImage:withTintColor:
dataWithData:
imageWithCGImage:
preferencesSetBOOLValue:forKey:
pullDebugImage:
getLoggerAttachmentsForRadar:
stringFromSensorConfiguration
matchIdentity:
topologyImage:
imageWithImage:withMaskImage:
inUse
setInUse:
enrollProgressConfigRenderMode
setEnrollProgressConfigRenderMode:
enrollProgressConfigRenderViewSize
setEnrollProgressConfigRenderViewSize:
renderMode
setRenderMode:
opacity
setOpacity:
_xpcClient
_enrollingMode
_matchingMode
_statistics
_scanbedImage
_fauxprintImage
_nodeRect
_images
_compSet
_rejectTouchCount
_rejectTouch
_showDebugImages
_enableLogger
_enrollImageSet
_isInternalInstall
_inUse
_enrollProgressConfigRenderMode
_renderMode
_opacity
_enrollProgressConfigRenderViewSize
setUuid:
decodeBytesForKey:returnedLength:
initWithUUIDBytes:
decodeIntForKey:
decodeObjectOfClass:forKey:
copy
getUUIDBytes:
encodeBytes:length:forKey:
encodeInt:forKey:
encodeObject:forKey:
biometricKitIdentity
supportsSecureCoding
encodeWithCoder:
initWithCoder:
uuid
type
setType:
attribute
setAttribute:
entity
setEntity:
name
setName:
stringByReplacingOccurrencesOfString:withString:
initWithCapacity:
setLength:
mutableBytes
defaultManager
createDirectoryAtPath:withIntermediateDirectories:attributes:error:
removeItemAtPath:error:
UUIDString
setMessageDetails:
setCaptureImage:
setRenderedImage:
progress
setProgress:
setCurrentPrimaryComponentID:
captureImage
renderedImage
setMessage:
_message
_progress
_currentPrimaryComponentID
_captureImage
_renderedImage
_messageDetails
setX:
setY:
angle
setAngle:
_angle
setTransformationCoordinates:
componentID
setComponentID:
transformationCoordinates
_componentID
_transformationCoordinates
pathComponents
com.apple.biometrickitd
T@"<BiometricKitDelegate>",N,V_delegate
interruptionHandler
T@?,C,N,V_interruptionHandler
topology
T@"NSDictionary",&,N,V_details
com.apple.fingerprint.enroll.attempts
com.apple.fingerprint.enroll.passes
com.apple.fingerprint.enroll.touchesPerEnroll
com.apple.fingerprint.enroll.badImagesPerEnroll
com.apple.fingerprint.enroll.rejectedImagesPerEnroll
com.apple.fingerprint.enroll.primaryClusterAdditions
com.apple.fingerprint.enroll.primaryClusterFailedAdditions
com.apple.fingerprint.enroll.otherClustersAdditions
com.apple.fingerprint.enroll.joinEvents
com.apple.fingerprint.enroll.clusterCount
com.apple.fingerprint.enroll.nodeCount
com.apple.fingerprint.enroll.primaryClusterNodeCount
com.apple.fingerprint.enroll.area
com.apple.fingerprint.enroll.primaryClusterArea
com.apple.fingerprint.enroll.passTime
com.apple.fingerprint.enroll.fails
com.apple.fingerprint.enroll.failTime
com.apple.ManagedConfiguration.profileListChanged
com.apple.biometrickitd.debugLogEnabled
com.apple.biometrickitd.debugLogPath
debugLogEnabled
debugLogPath
BKOptionSuppressHapticFeedback
BKOptionFilterOutHomeButtonEvents
BKOptionMatchForUnlock
InternalBuild
scanbed
synthetic
Uninitialized
Not Provisioned
Unprovisioned
Provisioned
Provisioned Locked
Unpaired
Unknown
biosensor,mesa
modulation-ratio
AppleBiometricSensor
patch-version
Mesa configuration:
Provisioning Status: %@
Calibrated:
- Version:
- Signed:
Modulation ratio:
Kernel:
Thick kernel
Thin kernel
Sensor Patch Version:
Steps to Reproduce:
inUse
TB,V_inUse
enrollProgressConfigRenderMode
Ti,N,V_enrollProgressConfigRenderMode
enrollProgressConfigRenderViewSize
T{CGSize=dd},N,V_enrollProgressConfigRenderViewSize
renderMode
Ti,N,V_renderMode
opacity
Tf,N,V_opacity
Notification callback.
BiometricKitErrorDomain
BKIdentityUUID
BKIdentityType
BKIdentityAttribute
BKIdentityEntityNumber
BKIdentityName
/var/mobile/BiometricKit/biometrickitd
BKEPDReason
BKEPDNewNodeID
BKEPDNewComponentID
BKEPDNewNodeCoordinates
BKEPDRemovedNodeID
BKEPDRemovedComponentID
BKEPDExtendedComponentID
BKEPDResultComponentID
BKEPDMergedInComponents
BKEPDRedundantNode
BKTDLargestCompArea
BKTDLargestCompNodes
BKTDTotalArea
BKTDTotalNodes
BKTemplateUpdated
Td,N,V_x
Td,N,V_y
angle
Td,N,V_angle
componentID
Tq,N,V_componentID
transformationCoordinates
T@"BiometricKitEnrollProgressCoordinates",&,N,V_transformationCoordinates
Remove identity: %@
Log package:%@
biometrickitd
%@.tar.gz
cd %@ && tar -cjf %@ %@
Time: % 8.3f
PASS
FAIL
Closing log with result %@
Template identity:
UUID : %@
Type : %i
Attrib: %i
Entity: %i
Error: Unable to get identity
Serialised template: %@
%@_%04d.bin
Status message: %@
Progress %i
Count of enrollments: %i
BiometricKitErrorTaskCancelled
BiometricKitErrorIdentityInvalid
BiometricKitErrorIdentityNotAllowed
BiometricKitErrorIdentityErrorInvalidData
BiometricKitErrorIdentityErrorUnknown
BiometricKitStatusFingerOn
BiometricKitStatusFingerOff
BiometricKitStatusEnrollmentComplete
BiometricKitStatusEnrollmentCancelled
BiometricKitStatusEnrollmentFailed
BiometricKitStatusEnrollmentTimeout
BiometricKitStatusUnknownError
BiometricKitStatusImageRejected
BiometricKitStatusNoCalibration
BiometricKitImageForProcessing
BiometricKitStatusTemplateListUpdated
BiometricKitStatusRequestFingerOff
BiometricKitStatusAutoMatchingStarted
BiometricKitStatusAutoMatchingStopped
BiometricKitStatusCaptureRestart
BiometricKitStatusScanTooShort
BiometricKitStatusAutoMatchingStartByHomeButton
BiometricKitStatusMatchingCancelled
BiometricKitStatusFingerOnBeforeFirstPasscodeUnlock
BiometricKitStatusFingerOnInPasscodeLockout
BiometricKitStatusFingerOnInBioLockout
BiometricKitStatusFingerOnTokenExpired
BiometricKitStatusESDRecovery
BiometricKitStatusImageRejectedUnknown
BiometricKitStatusImageRejectedBadBlocks
BiometricKitStatusImageRejectedChFPN
BiometricKitStatusImageRejectedCaFPN
BiometricKitStatusSensorOperationModeIdle
BiometricKitStatusSensorOperationModeCapture
BiometricKitStatusSensorOperationModePause
Other unknown status %i
Image #%i was rejected
Sensor patch version: %ld
Sensor patch version: unknown
Calibration Data: %@
Capture buffer: %@
Matcher: image refused
Matcher: image %s node %u
added as
replaced
Coordinates: %s[%i, %i, %i]
inverse of
Parent: %i
Processed image: %@
Enroll debug log, version 7
static const node_placement_t table_%02i =
%@{%i,%i,%i,%i,%i,%i,{
%@{%i,%i,%i,%i,%i}
%@},%i,%i,%i,%i,%i,0x%04x};
bin8
bin16
binXX
calibdata.bin
calibration-blob
Image #%i%s
was sent to matcher
Match result
Match details:
Matching score: %i
Match S2S count: %i
Matching node: %i
Updated node: %i
Not available
No match (artificial)
No match
Image #%i
Warning: the log is not complete, previous part of the log was deleted.
Starting enrollment
Starting matching
No known identities with enroll log are available.
Known identities with enroll log available:
%@ : %@
Match debug log, version 7
messages.log
OS version: %@ (%@)
Mesa: %@
Process name:%@
PrimaryUsagePage
PrimaryUsage
com.apple.iokit.hid.displayStatus
com.apple.mobile.keybagd.lock_status
AppleMesaSEPDriver
IOGeneralInterest
ScanningState
ScanningStateIdle
ScanningStateShortScanning
ScanningStateLongScanning
Unknown scanning state %i
Event: %@
HomeButtonPress
ExtendedDeviceLockState
MobileKeyBagDeviceIsUnlocked
MobileKeyBagDeviceIsLocked
MobileKeyBagDeviceIsLocking
MobileKeyBagDisabled
MobileKeyBagDeviceUnlockInProgress
MobileKeyBagDeviceInGracePeriod
MobileKeyBagDeviceInAssertDelay
MobileKeyBagDeviceInBioUnlock
Unknown lock state %i
DisplayOn
DisplayOff
/SourceCache/Mesa/Mesa-152/AppleBiometricServices/BiometricKit/BiometricKitDebugLog.m
/var/mobile/Library/Logs/CrashReporter/BiometricKit
v24@0:8@"BiometricKitIdentity"16
@"NSXPCConnection"
@"<BiometricKitDelegate>"
@"BiometricKitXPCClient"
@"BiometricKitStatistics"
@"UIImage"
[25{CGRect="origin"{CGPoint="x"d"y"d}"size"{CGSize="width"d"height"d}}]
[25@"UIImage"]
{?="count"i"capa"i"items"^^{?}"unusedImageCount"i"componentCount"i"componentCapa"i"bestComponentIndex"i"bestMapiComponentIndex"i"components"^^{?}"mapiNodeAddedIndex"s"mapiNodeRemovedIndex"s"updateCount"i"structureIsInconsistent"B}
{?="nodes"[25{?="imageData"@"NSData""width"I"height"I}]}
BiometricKitXpcProtocol
BiometricKitDelegateXpcProtocol
BiometricKitXPCClient
BiometricKitTemplateInfo
BiometricKitStatistics
BiometricKit
BiometricKitDelegate
BiometricKitIdentity
NSSecureCoding
NSCoding
BiometricKitMatchInfo
BiometricKitEnrollProgressInfo
BiometricKitEnrollProgressCoordinates
BiometricKitEnrollProgressMergedComponent
BiometricKitDebugLog

</pre>

Touch ID

2013-09-10T20:30:16Z

Iemit737: Inferred info - basic analysis

The iPhone 5S comes equipped with a fingerprint scanner. There is not an official developer API for it.

However there is a private API for it. The dylib file for it is here:
/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS7.0.sdk/System/Library/PrivateFrameworks/BiometricKit.framework/BiometricKit

It contains only a 64-bit Arm segment, and so the common disassembly tools cannot process the instructions well.

==Inferred Information==
Based on the string dump, here is what is implied.
<ol>
<li>The codename for it was "mesa" </li>
<li>It communicates over XPC to a binary that handles access to it </li>
<li>There's a kernel extension to interface with it </li>
<li>The kernel extension communicates to the secure keystore to set and verify fingerprints </li>
<li>The fingerprint scanner calibrates itself and has upgradable firmware </li>
<li>The fingerprint scanner works involves normal image formats (i.e. UIImage) before settings and verifying fingerprints </li>
<li>There's biometric lockout as well as passcode lockout </li>
</ol>

== String Dump ==
Here is the long string dump of the contents of the BiometricKit library. These strings hint at the functionality of the framework.
<pre>
initWithMachServiceName:options:
connectWithReplyBlock:
registerDelegate:withReplyBlock:
suspendWork:withReplyBlock:
enroll:withAuthToken:withReplyBlock:
match:withReplyBlock:
match:withOptions:withReplyBlock:
matchIdentities:withReplyBlock:
cancelWithReplyBlock:
updateIdentity:withReplyBlock:
removeIdentity:withReplyBlock:
getIdentityFromUUID:withReplyBlock:
identities:withReplyBlock:
resetEngineWithReplyBlock:
registerDSID:withAuthToken:withReplyBlock:
registerStoreToken:withReplyBlock:
getCountersignedStoreTokenWithReplyBlock:
getMaxIdentityCount:withReplyBlock:
enrollContinueWithReplyBlock:
pullAlignmentDataWithReplyBlock:
pullMatchTopologyDataWithReplyBlock:
getNodeTopologyForIdentity:withReplyBlock:
preventAutonomousMatchingMode:withReplyBlock:
getProvisioningStateWithReplyBlock:
getCalBlobVersionWithReplyBlock:
getSensorCalibrationStatusWithReplyBlock:
getCalibrationDataStateWithReplyBlock:
setDebugImages:withReplyBlock:
pullCaptureBufferWithReplyBlock:
pullDebugImageData:withReplyBlock:
provisionSensorWithReplyBlock:
unpairSensorWithReplyBlock:
lockSensorWithReplyBlock:
getSerialisedTemplateForIdentity:withReplyBlock:
interfaceWithProtocol:
setRemoteObjectInterface:
remoteObjectInterface
setWithObject:
setClasses:forSelector:argumentIndex:ofReply:
setWithObjects:
enrollResult:
matchResult:
statusMessage:
homeButtonPressed
setExportedInterface:
setExportedObject:
setInterruptionHandler:
resume
invalidate
remoteObjectProxyWithErrorHandler:
code
respondsToSelector:
connect
registerDelegate:
suspendWork:
enroll:withAuthToken:
match:
match:withOptions:
matchIdentities:
cancel
updateIdentity:
removeIdentity:
getIdentityFromUUID:
identities:
getMaxIdentityCount:
resetEngine
enrollContinue
pullAlignmentData
pullMatchTopologyData
getNodeTopologyForIdentity:
preventAutonomousMatchingMode:
getProvisioningState
registerDSID:withAuthToken:
registerStoreToken:
getCountersignedStoreToken:
getCalBlobVersion
getSensorCalibrationStatus
getCalibrationDataState
pullCaptureBuffer
pullDebugImageData:imageWidth:imageHeight:
provisionSensor
unpairSensor
lockSensor
setDebugImages:
getSerialisedTemplateForIdentity:
delegate
setDelegate:
interruptionHandler
_connection
_delegate
_interruptionHandler
setTopology:
setDetails:
topology
details
_topology
_details
initEnrollmentValues
message
messageDetails
objectForKeyedSubscript:
currentPrimaryComponentID
integerValue
doubleValue
statistics
enroll:
enrollResult:componentSet:
enrollProgress:
_fingerOn
_enrolling
_badImagePerFingerDown
_enrollmentStarTime
_touchesPerEnroll
_badImagesPerEnroll
_rejectedImagesPerEnroll
_primaryClusterAdditions
_primaryClusterFailedAdditions
_otherClustersAdditions
_joinEvents
_area
_primaryClusterArea
numberWithBool:
preferencesGetStringValue:
preferencesGetBOOLValue:
enableLogger:toPath:
manager
defaultCenter
appDidEnterBackground:
addObserver:selector:name:object:
appWillEnterForeground:
bundleForClass:
imageNamed:inBundle:
updateEnableLogger
dataWithBytes:length:
startEnrollLog
data
logRemoveIdentity:
bytes
imageFromRawImageData:
imageFromBitmapData:inRect:
pullDebugImageData:target:
getRadarAtachmentsForLastEnrollment
getRadarAtachmentsForLastMatch
length
stringWithString:
getModulationRatio
stringForProvisioningState:
getSensorPatchVersion
stringWithFormat:
getLogsForProcess:
sharedConnection
isFingerprintUnlockAllowed
setGracePeriod:passcode:completionBlock:
finishEnrollLogWithStatus:withIdentity:withTemplate:
matchResult:withDetails:
createMatchInfo:withTopology:withMatchImage:
logMatchResult:withTopology:withImage:withCaptureBuffer:withTemplate:
getBytes:length:
logEnrollMessage:withTopology:withImage:withCaptureBuffer:
logStatus:
enrollProgressMessage:
logRejectedImage:
size
drawInRect:
drawInRect:blendMode:alpha:
CGImage
scale
imageOrientation
imageWithCGImage:scale:orientation:
imageWithImage:inRect:
identityImage:
imageWithImage:withNode:withRect:alpha:
compositeTopologyImage:
imageTopology:forGroup:
imageFauxprint:withTheta:withLamda:
greenColor
imageWithImage:withTintColor:
dataWithData:
imageWithCGImage:
preferencesSetBOOLValue:forKey:
pullDebugImage:
getLoggerAttachmentsForRadar:
stringFromSensorConfiguration
matchIdentity:
topologyImage:
imageWithImage:withMaskImage:
inUse
setInUse:
enrollProgressConfigRenderMode
setEnrollProgressConfigRenderMode:
enrollProgressConfigRenderViewSize
setEnrollProgressConfigRenderViewSize:
renderMode
setRenderMode:
opacity
setOpacity:
_xpcClient
_enrollingMode
_matchingMode
_statistics
_scanbedImage
_fauxprintImage
_nodeRect
_images
_compSet
_rejectTouchCount
_rejectTouch
_showDebugImages
_enableLogger
_enrollImageSet
_isInternalInstall
_inUse
_enrollProgressConfigRenderMode
_renderMode
_opacity
_enrollProgressConfigRenderViewSize
setUuid:
decodeBytesForKey:returnedLength:
initWithUUIDBytes:
decodeIntForKey:
decodeObjectOfClass:forKey:
copy
getUUIDBytes:
encodeBytes:length:forKey:
encodeInt:forKey:
encodeObject:forKey:
biometricKitIdentity
supportsSecureCoding
encodeWithCoder:
initWithCoder:
uuid
type
setType:
attribute
setAttribute:
entity
setEntity:
name
setName:
stringByReplacingOccurrencesOfString:withString:
initWithCapacity:
setLength:
mutableBytes
defaultManager
createDirectoryAtPath:withIntermediateDirectories:attributes:error:
removeItemAtPath:error:
UUIDString
setMessageDetails:
setCaptureImage:
setRenderedImage:
progress
setProgress:
setCurrentPrimaryComponentID:
captureImage
renderedImage
setMessage:
_message
_progress
_currentPrimaryComponentID
_captureImage
_renderedImage
_messageDetails
setX:
setY:
angle
setAngle:
_angle
setTransformationCoordinates:
componentID
setComponentID:
transformationCoordinates
_componentID
_transformationCoordinates
pathComponents
com.apple.biometrickitd
T@"<BiometricKitDelegate>",N,V_delegate
interruptionHandler
T@?,C,N,V_interruptionHandler
topology
T@"NSDictionary",&,N,V_details
com.apple.fingerprint.enroll.attempts
com.apple.fingerprint.enroll.passes
com.apple.fingerprint.enroll.touchesPerEnroll
com.apple.fingerprint.enroll.badImagesPerEnroll
com.apple.fingerprint.enroll.rejectedImagesPerEnroll
com.apple.fingerprint.enroll.primaryClusterAdditions
com.apple.fingerprint.enroll.primaryClusterFailedAdditions
com.apple.fingerprint.enroll.otherClustersAdditions
com.apple.fingerprint.enroll.joinEvents
com.apple.fingerprint.enroll.clusterCount
com.apple.fingerprint.enroll.nodeCount
com.apple.fingerprint.enroll.primaryClusterNodeCount
com.apple.fingerprint.enroll.area
com.apple.fingerprint.enroll.primaryClusterArea
com.apple.fingerprint.enroll.passTime
com.apple.fingerprint.enroll.fails
com.apple.fingerprint.enroll.failTime
com.apple.ManagedConfiguration.profileListChanged
com.apple.biometrickitd.debugLogEnabled
com.apple.biometrickitd.debugLogPath
debugLogEnabled
debugLogPath
BKOptionSuppressHapticFeedback
BKOptionFilterOutHomeButtonEvents
BKOptionMatchForUnlock
InternalBuild
scanbed
synthetic
Uninitialized
Not Provisioned
Unprovisioned
Provisioned
Provisioned Locked
Unpaired
Unknown
biosensor,mesa
modulation-ratio
AppleBiometricSensor
patch-version
Mesa configuration:
Provisioning Status: %@
Calibrated:
- Version:
- Signed:
Modulation ratio:
Kernel:
Thick kernel
Thin kernel
Sensor Patch Version:
Steps to Reproduce:
inUse
TB,V_inUse
enrollProgressConfigRenderMode
Ti,N,V_enrollProgressConfigRenderMode
enrollProgressConfigRenderViewSize
T{CGSize=dd},N,V_enrollProgressConfigRenderViewSize
renderMode
Ti,N,V_renderMode
opacity
Tf,N,V_opacity
Notification callback.
BiometricKitErrorDomain
BKIdentityUUID
BKIdentityType
BKIdentityAttribute
BKIdentityEntityNumber
BKIdentityName
/var/mobile/BiometricKit/biometrickitd
BKEPDReason
BKEPDNewNodeID
BKEPDNewComponentID
BKEPDNewNodeCoordinates
BKEPDRemovedNodeID
BKEPDRemovedComponentID
BKEPDExtendedComponentID
BKEPDResultComponentID
BKEPDMergedInComponents
BKEPDRedundantNode
BKTDLargestCompArea
BKTDLargestCompNodes
BKTDTotalArea
BKTDTotalNodes
BKTemplateUpdated
Td,N,V_x
Td,N,V_y
angle
Td,N,V_angle
componentID
Tq,N,V_componentID
transformationCoordinates
T@"BiometricKitEnrollProgressCoordinates",&,N,V_transformationCoordinates
Remove identity: %@
Log package:%@
biometrickitd
%@.tar.gz
cd %@ && tar -cjf %@ %@
Time: % 8.3f
PASS
FAIL
Closing log with result %@
Template identity:
UUID : %@
Type : %i
Attrib: %i
Entity: %i
Error: Unable to get identity
Serialised template: %@
%@_%04d.bin
Status message: %@
Progress %i
Count of enrollments: %i
BiometricKitErrorTaskCancelled
BiometricKitErrorIdentityInvalid
BiometricKitErrorIdentityNotAllowed
BiometricKitErrorIdentityErrorInvalidData
BiometricKitErrorIdentityErrorUnknown
BiometricKitStatusFingerOn
BiometricKitStatusFingerOff
BiometricKitStatusEnrollmentComplete
BiometricKitStatusEnrollmentCancelled
BiometricKitStatusEnrollmentFailed
BiometricKitStatusEnrollmentTimeout
BiometricKitStatusUnknownError
BiometricKitStatusImageRejected
BiometricKitStatusNoCalibration
BiometricKitImageForProcessing
BiometricKitStatusTemplateListUpdated
BiometricKitStatusRequestFingerOff
BiometricKitStatusAutoMatchingStarted
BiometricKitStatusAutoMatchingStopped
BiometricKitStatusCaptureRestart
BiometricKitStatusScanTooShort
BiometricKitStatusAutoMatchingStartByHomeButton
BiometricKitStatusMatchingCancelled
BiometricKitStatusFingerOnBeforeFirstPasscodeUnlock
BiometricKitStatusFingerOnInPasscodeLockout
BiometricKitStatusFingerOnInBioLockout
BiometricKitStatusFingerOnTokenExpired
BiometricKitStatusESDRecovery
BiometricKitStatusImageRejectedUnknown
BiometricKitStatusImageRejectedBadBlocks
BiometricKitStatusImageRejectedChFPN
BiometricKitStatusImageRejectedCaFPN
BiometricKitStatusSensorOperationModeIdle
BiometricKitStatusSensorOperationModeCapture
BiometricKitStatusSensorOperationModePause
Other unknown status %i
Image #%i was rejected
Sensor patch version: %ld
Sensor patch version: unknown
Calibration Data: %@
Capture buffer: %@
Matcher: image refused
Matcher: image %s node %u
added as
replaced
Coordinates: %s[%i, %i, %i]
inverse of
Parent: %i
Processed image: %@
Enroll debug log, version 7
static const node_placement_t table_%02i =
%@{%i,%i,%i,%i,%i,%i,{
%@{%i,%i,%i,%i,%i}
%@},%i,%i,%i,%i,%i,0x%04x};
bin8
bin16
binXX
calibdata.bin
calibration-blob
Image #%i%s
was sent to matcher
Match result
Match details:
Matching score: %i
Match S2S count: %i
Matching node: %i
Updated node: %i
Not available
No match (artificial)
No match
Image #%i
Warning: the log is not complete, previous part of the log was deleted.
Starting enrollment
Starting matching
No known identities with enroll log are available.
Known identities with enroll log available:
%@ : %@
Match debug log, version 7
messages.log
OS version: %@ (%@)
Mesa: %@
Process name:%@
PrimaryUsagePage
PrimaryUsage
com.apple.iokit.hid.displayStatus
com.apple.mobile.keybagd.lock_status
AppleMesaSEPDriver
IOGeneralInterest
ScanningState
ScanningStateIdle
ScanningStateShortScanning
ScanningStateLongScanning
Unknown scanning state %i
Event: %@
HomeButtonPress
ExtendedDeviceLockState
MobileKeyBagDeviceIsUnlocked
MobileKeyBagDeviceIsLocked
MobileKeyBagDeviceIsLocking
MobileKeyBagDisabled
MobileKeyBagDeviceUnlockInProgress
MobileKeyBagDeviceInGracePeriod
MobileKeyBagDeviceInAssertDelay
MobileKeyBagDeviceInBioUnlock
Unknown lock state %i
DisplayOn
DisplayOff
/SourceCache/Mesa/Mesa-152/AppleBiometricServices/BiometricKit/BiometricKitDebugLog.m
/var/mobile/Library/Logs/CrashReporter/BiometricKit
v24@0:8@"BiometricKitIdentity"16
@"NSXPCConnection"
@"<BiometricKitDelegate>"
@"BiometricKitXPCClient"
@"BiometricKitStatistics"
@"UIImage"
[25{CGRect="origin"{CGPoint="x"d"y"d}"size"{CGSize="width"d"height"d}}]
[25@"UIImage"]
{?="count"i"capa"i"items"^^{?}"unusedImageCount"i"componentCount"i"componentCapa"i"bestComponentIndex"i"bestMapiComponentIndex"i"components"^^{?}"mapiNodeAddedIndex"s"mapiNodeRemovedIndex"s"updateCount"i"structureIsInconsistent"B}
{?="nodes"[25{?="imageData"@"NSData""width"I"height"I}]}
BiometricKitXpcProtocol
BiometricKitDelegateXpcProtocol
BiometricKitXPCClient
BiometricKitTemplateInfo
BiometricKitStatistics
BiometricKit
BiometricKitDelegate
BiometricKitIdentity
NSSecureCoding
NSCoding
BiometricKitMatchInfo
BiometricKitEnrollProgressInfo
BiometricKitEnrollProgressCoordinates
BiometricKitEnrollProgressMergedComponent
BiometricKitDebugLog

</pre>

Touch ID

2013-09-10T20:14:28Z

Iemit737: New page re: Half-baked disassembly. Original research by Andrew Aude

The iPhone 5S comes equipped with a fingerprint scanner. There is not an official developer API for it.

However there is a private API for it. The dylib file for it is here:
/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS7.0.sdk/System/Library/PrivateFrameworks/BiometricKit.framework/BiometricKit

It contains only a 64-bit Arm segment, and so the common disassembly tools cannot process the instructions well.

== String Dump ==
Here is a long string dump of the contents of the BiometricKit library. These strings hint at the functionality of the framework.
<pre>
initWithMachServiceName:options:
connectWithReplyBlock:
registerDelegate:withReplyBlock:
suspendWork:withReplyBlock:
enroll:withAuthToken:withReplyBlock:
match:withReplyBlock:
match:withOptions:withReplyBlock:
matchIdentities:withReplyBlock:
cancelWithReplyBlock:
updateIdentity:withReplyBlock:
removeIdentity:withReplyBlock:
getIdentityFromUUID:withReplyBlock:
identities:withReplyBlock:
resetEngineWithReplyBlock:
registerDSID:withAuthToken:withReplyBlock:
registerStoreToken:withReplyBlock:
getCountersignedStoreTokenWithReplyBlock:
getMaxIdentityCount:withReplyBlock:
enrollContinueWithReplyBlock:
pullAlignmentDataWithReplyBlock:
pullMatchTopologyDataWithReplyBlock:
getNodeTopologyForIdentity:withReplyBlock:
preventAutonomousMatchingMode:withReplyBlock:
getProvisioningStateWithReplyBlock:
getCalBlobVersionWithReplyBlock:
getSensorCalibrationStatusWithReplyBlock:
getCalibrationDataStateWithReplyBlock:
setDebugImages:withReplyBlock:
pullCaptureBufferWithReplyBlock:
pullDebugImageData:withReplyBlock:
provisionSensorWithReplyBlock:
unpairSensorWithReplyBlock:
lockSensorWithReplyBlock:
getSerialisedTemplateForIdentity:withReplyBlock:
interfaceWithProtocol:
setRemoteObjectInterface:
remoteObjectInterface
setWithObject:
setClasses:forSelector:argumentIndex:ofReply:
setWithObjects:
enrollResult:
matchResult:
statusMessage:
homeButtonPressed
setExportedInterface:
setExportedObject:
setInterruptionHandler:
resume
invalidate
remoteObjectProxyWithErrorHandler:
code
respondsToSelector:
connect
registerDelegate:
suspendWork:
enroll:withAuthToken:
match:
match:withOptions:
matchIdentities:
cancel
updateIdentity:
removeIdentity:
getIdentityFromUUID:
identities:
getMaxIdentityCount:
resetEngine
enrollContinue
pullAlignmentData
pullMatchTopologyData
getNodeTopologyForIdentity:
preventAutonomousMatchingMode:
getProvisioningState
registerDSID:withAuthToken:
registerStoreToken:
getCountersignedStoreToken:
getCalBlobVersion
getSensorCalibrationStatus
getCalibrationDataState
pullCaptureBuffer
pullDebugImageData:imageWidth:imageHeight:
provisionSensor
unpairSensor
lockSensor
setDebugImages:
getSerialisedTemplateForIdentity:
delegate
setDelegate:
interruptionHandler
_connection
_delegate
_interruptionHandler
setTopology:
setDetails:
topology
details
_topology
_details
initEnrollmentValues
message
messageDetails
objectForKeyedSubscript:
currentPrimaryComponentID
integerValue
doubleValue
statistics
enroll:
enrollResult:componentSet:
enrollProgress:
_fingerOn
_enrolling
_badImagePerFingerDown
_enrollmentStarTime
_touchesPerEnroll
_badImagesPerEnroll
_rejectedImagesPerEnroll
_primaryClusterAdditions
_primaryClusterFailedAdditions
_otherClustersAdditions
_joinEvents
_area
_primaryClusterArea
numberWithBool:
preferencesGetStringValue:
preferencesGetBOOLValue:
enableLogger:toPath:
manager
defaultCenter
appDidEnterBackground:
addObserver:selector:name:object:
appWillEnterForeground:
bundleForClass:
imageNamed:inBundle:
updateEnableLogger
dataWithBytes:length:
startEnrollLog
data
logRemoveIdentity:
bytes
imageFromRawImageData:
imageFromBitmapData:inRect:
pullDebugImageData:target:
getRadarAtachmentsForLastEnrollment
getRadarAtachmentsForLastMatch
length
stringWithString:
getModulationRatio
stringForProvisioningState:
getSensorPatchVersion
stringWithFormat:
getLogsForProcess:
sharedConnection
isFingerprintUnlockAllowed
setGracePeriod:passcode:completionBlock:
finishEnrollLogWithStatus:withIdentity:withTemplate:
matchResult:withDetails:
createMatchInfo:withTopology:withMatchImage:
logMatchResult:withTopology:withImage:withCaptureBuffer:withTemplate:
getBytes:length:
logEnrollMessage:withTopology:withImage:withCaptureBuffer:
logStatus:
enrollProgressMessage:
logRejectedImage:
size
drawInRect:
drawInRect:blendMode:alpha:
CGImage
scale
imageOrientation
imageWithCGImage:scale:orientation:
imageWithImage:inRect:
identityImage:
imageWithImage:withNode:withRect:alpha:
compositeTopologyImage:
imageTopology:forGroup:
imageFauxprint:withTheta:withLamda:
greenColor
imageWithImage:withTintColor:
dataWithData:
imageWithCGImage:
preferencesSetBOOLValue:forKey:
pullDebugImage:
getLoggerAttachmentsForRadar:
stringFromSensorConfiguration
matchIdentity:
topologyImage:
imageWithImage:withMaskImage:
inUse
setInUse:
enrollProgressConfigRenderMode
setEnrollProgressConfigRenderMode:
enrollProgressConfigRenderViewSize
setEnrollProgressConfigRenderViewSize:
renderMode
setRenderMode:
opacity
setOpacity:
_xpcClient
_enrollingMode
_matchingMode
_statistics
_scanbedImage
_fauxprintImage
_nodeRect
_images
_compSet
_rejectTouchCount
_rejectTouch
_showDebugImages
_enableLogger
_enrollImageSet
_isInternalInstall
_inUse
_enrollProgressConfigRenderMode
_renderMode
_opacity
_enrollProgressConfigRenderViewSize
setUuid:
decodeBytesForKey:returnedLength:
initWithUUIDBytes:
decodeIntForKey:
decodeObjectOfClass:forKey:
copy
getUUIDBytes:
encodeBytes:length:forKey:
encodeInt:forKey:
encodeObject:forKey:
biometricKitIdentity
supportsSecureCoding
encodeWithCoder:
initWithCoder:
uuid
type
setType:
attribute
setAttribute:
entity
setEntity:
name
setName:
stringByReplacingOccurrencesOfString:withString:
initWithCapacity:
setLength:
mutableBytes
defaultManager
createDirectoryAtPath:withIntermediateDirectories:attributes:error:
removeItemAtPath:error:
UUIDString
setMessageDetails:
setCaptureImage:
setRenderedImage:
progress
setProgress:
setCurrentPrimaryComponentID:
captureImage
renderedImage
setMessage:
_message
_progress
_currentPrimaryComponentID
_captureImage
_renderedImage
_messageDetails
setX:
setY:
angle
setAngle:
_angle
setTransformationCoordinates:
componentID
setComponentID:
transformationCoordinates
_componentID
_transformationCoordinates
pathComponents
com.apple.biometrickitd
T@"<BiometricKitDelegate>",N,V_delegate
interruptionHandler
T@?,C,N,V_interruptionHandler
topology
T@"NSDictionary",&,N,V_details
com.apple.fingerprint.enroll.attempts
com.apple.fingerprint.enroll.passes
com.apple.fingerprint.enroll.touchesPerEnroll
com.apple.fingerprint.enroll.badImagesPerEnroll
com.apple.fingerprint.enroll.rejectedImagesPerEnroll
com.apple.fingerprint.enroll.primaryClusterAdditions
com.apple.fingerprint.enroll.primaryClusterFailedAdditions
com.apple.fingerprint.enroll.otherClustersAdditions
com.apple.fingerprint.enroll.joinEvents
com.apple.fingerprint.enroll.clusterCount
com.apple.fingerprint.enroll.nodeCount
com.apple.fingerprint.enroll.primaryClusterNodeCount
com.apple.fingerprint.enroll.area
com.apple.fingerprint.enroll.primaryClusterArea
com.apple.fingerprint.enroll.passTime
com.apple.fingerprint.enroll.fails
com.apple.fingerprint.enroll.failTime
com.apple.ManagedConfiguration.profileListChanged
com.apple.biometrickitd.debugLogEnabled
com.apple.biometrickitd.debugLogPath
debugLogEnabled
debugLogPath
BKOptionSuppressHapticFeedback
BKOptionFilterOutHomeButtonEvents
BKOptionMatchForUnlock
InternalBuild
scanbed
synthetic
Uninitialized
Not Provisioned
Unprovisioned
Provisioned
Provisioned Locked
Unpaired
Unknown
biosensor,mesa
modulation-ratio
AppleBiometricSensor
patch-version
Mesa configuration:
Provisioning Status: %@
Calibrated:
- Version:
- Signed:
Modulation ratio:
Kernel:
Thick kernel
Thin kernel
Sensor Patch Version:
Steps to Reproduce:
inUse
TB,V_inUse
enrollProgressConfigRenderMode
Ti,N,V_enrollProgressConfigRenderMode
enrollProgressConfigRenderViewSize
T{CGSize=dd},N,V_enrollProgressConfigRenderViewSize
renderMode
Ti,N,V_renderMode
opacity
Tf,N,V_opacity
Notification callback.
BiometricKitErrorDomain
BKIdentityUUID
BKIdentityType
BKIdentityAttribute
BKIdentityEntityNumber
BKIdentityName
/var/mobile/BiometricKit/biometrickitd
BKEPDReason
BKEPDNewNodeID
BKEPDNewComponentID
BKEPDNewNodeCoordinates
BKEPDRemovedNodeID
BKEPDRemovedComponentID
BKEPDExtendedComponentID
BKEPDResultComponentID
BKEPDMergedInComponents
BKEPDRedundantNode
BKTDLargestCompArea
BKTDLargestCompNodes
BKTDTotalArea
BKTDTotalNodes
BKTemplateUpdated
Td,N,V_x
Td,N,V_y
angle
Td,N,V_angle
componentID
Tq,N,V_componentID
transformationCoordinates
T@"BiometricKitEnrollProgressCoordinates",&,N,V_transformationCoordinates
Remove identity: %@
Log package:%@
biometrickitd
%@.tar.gz
cd %@ && tar -cjf %@ %@
Time: % 8.3f
PASS
FAIL
Closing log with result %@
Template identity:
UUID : %@
Type : %i
Attrib: %i
Entity: %i
Error: Unable to get identity
Serialised template: %@
%@_%04d.bin
Status message: %@
Progress %i
Count of enrollments: %i
BiometricKitErrorTaskCancelled
BiometricKitErrorIdentityInvalid
BiometricKitErrorIdentityNotAllowed
BiometricKitErrorIdentityErrorInvalidData
BiometricKitErrorIdentityErrorUnknown
BiometricKitStatusFingerOn
BiometricKitStatusFingerOff
BiometricKitStatusEnrollmentComplete
BiometricKitStatusEnrollmentCancelled
BiometricKitStatusEnrollmentFailed
BiometricKitStatusEnrollmentTimeout
BiometricKitStatusUnknownError
BiometricKitStatusImageRejected
BiometricKitStatusNoCalibration
BiometricKitImageForProcessing
BiometricKitStatusTemplateListUpdated
BiometricKitStatusRequestFingerOff
BiometricKitStatusAutoMatchingStarted
BiometricKitStatusAutoMatchingStopped
BiometricKitStatusCaptureRestart
BiometricKitStatusScanTooShort
BiometricKitStatusAutoMatchingStartByHomeButton
BiometricKitStatusMatchingCancelled
BiometricKitStatusFingerOnBeforeFirstPasscodeUnlock
BiometricKitStatusFingerOnInPasscodeLockout
BiometricKitStatusFingerOnInBioLockout
BiometricKitStatusFingerOnTokenExpired
BiometricKitStatusESDRecovery
BiometricKitStatusImageRejectedUnknown
BiometricKitStatusImageRejectedBadBlocks
BiometricKitStatusImageRejectedChFPN
BiometricKitStatusImageRejectedCaFPN
BiometricKitStatusSensorOperationModeIdle
BiometricKitStatusSensorOperationModeCapture
BiometricKitStatusSensorOperationModePause
Other unknown status %i
Image #%i was rejected
Sensor patch version: %ld
Sensor patch version: unknown
Calibration Data: %@
Capture buffer: %@
Matcher: image refused
Matcher: image %s node %u
added as
replaced
Coordinates: %s[%i, %i, %i]
inverse of
Parent: %i
Processed image: %@
Enroll debug log, version 7
static const node_placement_t table_%02i =
%@{%i,%i,%i,%i,%i,%i,{
%@{%i,%i,%i,%i,%i}
%@},%i,%i,%i,%i,%i,0x%04x};
bin8
bin16
binXX
calibdata.bin
calibration-blob
Image #%i%s
was sent to matcher
Match result
Match details:
Matching score: %i
Match S2S count: %i
Matching node: %i
Updated node: %i
Not available
No match (artificial)
No match
Image #%i
Warning: the log is not complete, previous part of the log was deleted.
Starting enrollment
Starting matching
No known identities with enroll log are available.
Known identities with enroll log available:
%@ : %@
Match debug log, version 7
messages.log
OS version: %@ (%@)
Mesa: %@
Process name:%@
PrimaryUsagePage
PrimaryUsage
com.apple.iokit.hid.displayStatus
com.apple.mobile.keybagd.lock_status
AppleMesaSEPDriver
IOGeneralInterest
ScanningState
ScanningStateIdle
ScanningStateShortScanning
ScanningStateLongScanning
Unknown scanning state %i
Event: %@
HomeButtonPress
ExtendedDeviceLockState
MobileKeyBagDeviceIsUnlocked
MobileKeyBagDeviceIsLocked
MobileKeyBagDeviceIsLocking
MobileKeyBagDisabled
MobileKeyBagDeviceUnlockInProgress
MobileKeyBagDeviceInGracePeriod
MobileKeyBagDeviceInAssertDelay
MobileKeyBagDeviceInBioUnlock
Unknown lock state %i
DisplayOn
DisplayOff
/SourceCache/Mesa/Mesa-152/AppleBiometricServices/BiometricKit/BiometricKitDebugLog.m
/var/mobile/Library/Logs/CrashReporter/BiometricKit
v24@0:8@"BiometricKitIdentity"16
@"NSXPCConnection"
@"<BiometricKitDelegate>"
@"BiometricKitXPCClient"
@"BiometricKitStatistics"
@"UIImage"
[25{CGRect="origin"{CGPoint="x"d"y"d}"size"{CGSize="width"d"height"d}}]
[25@"UIImage"]
{?="count"i"capa"i"items"^^{?}"unusedImageCount"i"componentCount"i"componentCapa"i"bestComponentIndex"i"bestMapiComponentIndex"i"components"^^{?}"mapiNodeAddedIndex"s"mapiNodeRemovedIndex"s"updateCount"i"structureIsInconsistent"B}
{?="nodes"[25{?="imageData"@"NSData""width"I"height"I}]}
BiometricKitXpcProtocol
BiometricKitDelegateXpcProtocol
BiometricKitXPCClient
BiometricKitTemplateInfo
BiometricKitStatistics
BiometricKit
BiometricKitDelegate
BiometricKitIdentity
NSSecureCoding
NSCoding
BiometricKitMatchInfo
BiometricKitEnrollProgressInfo
BiometricKitEnrollProgressCoordinates
BiometricKitEnrollProgressMergedComponent
BiometricKitDebugLog

</pre>

Image3maker (Internal Tool)

2013-08-25T22:17:24Z

Iemit737: clarify

{{Infobox software
| name = Image3maker
| title =
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size = 77,760 bytes [APP]
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}

Image3maker is an Apple internal tool used to create [[img3]] firmware files. It's implemented in mostly C with its symbols stripped. There is an open source version by the same name, [[Image3maker]].

From the disassembly, it appears that the Key and IV are generated via /dev/random.
The GID key is loaded in from a plist at /usr/local/standalone/firmware/platform_keys.plist in order to encrypt the KEY/IV fields within the [[KBAG]] (referred to as "Keybag").

== Usage ==
The usage information from running the binary.
<pre>
Usage: image3maker [options]

image3maker: Modes:
image3maker: --create Create a new image3 file
image3maker: --update Update an existing image3 file
image3maker: --hashForSigning Generate and print the SHA-1 hash of the signable area
image3maker: --signWithData Sign with supplied data
image3maker: --finalizeWithoutSignature Finalize image3 file for use with authorized installation
image3maker: --printEpoch Print the numeric value of the epoch specified by --epoch
image3maker: --print Print the value of the tag specified by --tag
image3maker:
image3maker: General options:
image3maker: --unsign Removes signature information, allowing operations on images
image3maker: that have previously been signed.
image3maker:
image3maker: Arguments for --create and --update:
image3maker: --imagefile <file> Image3 format file
image3maker: In --create mode this file is created or truncated
image3maker: --type <type> Hex or 4-byte ASCII type tag
image3maker: This is required for --create mode, not permitted in --update mode
image3maker: --version <version> Set version string
image3maker: --epoch <security epoch> Explicit epoch or chip name to pick system default
image3maker: default for 's5l8747x' is 16
image3maker: default for 's5l8920x' is 4
image3maker: default for 's5l8922x' is 2
image3maker: default for 's5l8930x' is 2
image3maker: default for 's5l8940x' is 17
image3maker: default for 's5l8942x' is 16
image3maker: default for 's5l8945x' is 16
image3maker: default for 's5l8947x' is 16
image3maker: default for 's5l8950x' is 16
image3maker: default for 's5l8955x' is 16
image3maker: --hardwareEpoch <hardware epoch> Set the hardware epoch
image3maker: Should only be used for Image3 objects embedded in certs.
image3maker: --domain {manufacturer|darwin|rtxc}
image3maker: --data <data file> Add payload data from <data file>
image3maker: --personalize Personalize the image for local storage
image3maker: --production Marks the image as a production image
image3maker: --development Marks the image as a development image
image3maker: --override <override> Set the override value.
image3maker: Should only be used for Image3 objects embedded in certs.
image3maker: --chipType <chip ID>
image3maker: --boardID <board ID>
image3maker: --uniqueID <unique chip ID>
image3maker: --padWithRandomBytes Adds random pad data
image3maker:
image3maker: Arguments for --hashForSigning:
image3maker: --partialHashReservationSize <size> Requests a partial (unfinalized) hash rather than a normal hash.
image3maker: The partial hash is computed assuming that an additional size bytes
image3maker: will be added to the final signed portion of the image.
image3maker:
image3maker: Arguments for --signWithData:
image3maker: --expectHash <hash value> Require that the image hash to <hash value>
image3maker: --signWithSignature <signaturefile> Sign the image using the supplied signature file
image3maker: --signWithCertChain <chainfile> Place the supplied cert chain file into the signed image
image3maker:
image3maker: Arguments for --finalizeWithoutSignature:
image3maker: --expectHash <hash value> Require that the image hash to <hash value>
image3maker:
image3maker: Arguments for --print:
image3maker: --tag <tag name> Tag to be printed, either a 4 character string or a hexadecimal
image3maker: number prefixed with 0x
image3maker: --skip <n> Requests the nth occurrence of the specified tag. Defaults to 0.</pre>

Image3maker (Internal Tool)

2013-08-25T18:30:41Z

Iemit737: typo

{{Infobox software
| name = Image3maker
| title =
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size = 77,760 bytes [APP]
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}

Image3maker is an Apple internal tool used to create [[img3]] firmware files. It's implemented in mostly C with its symbols stripped. There is an open source version by the same name, [[Image3maker]].

From the disassembly, it appears that the Key and IV are generated via /dev/random.
The GID key is loaded in from a plist at /usr/local/standalone/firmware/platform_keys.plist in order to encrypt the [[KBAG]] (referred to as "Keybag").

== Usage ==
The usage information from running the binary.
<pre>
Usage: image3maker [options]

image3maker: Modes:
image3maker: --create Create a new image3 file
image3maker: --update Update an existing image3 file
image3maker: --hashForSigning Generate and print the SHA-1 hash of the signable area
image3maker: --signWithData Sign with supplied data
image3maker: --finalizeWithoutSignature Finalize image3 file for use with authorized installation
image3maker: --printEpoch Print the numeric value of the epoch specified by --epoch
image3maker: --print Print the value of the tag specified by --tag
image3maker:
image3maker: General options:
image3maker: --unsign Removes signature information, allowing operations on images
image3maker: that have previously been signed.
image3maker:
image3maker: Arguments for --create and --update:
image3maker: --imagefile <file> Image3 format file
image3maker: In --create mode this file is created or truncated
image3maker: --type <type> Hex or 4-byte ASCII type tag
image3maker: This is required for --create mode, not permitted in --update mode
image3maker: --version <version> Set version string
image3maker: --epoch <security epoch> Explicit epoch or chip name to pick system default
image3maker: default for 's5l8747x' is 16
image3maker: default for 's5l8920x' is 4
image3maker: default for 's5l8922x' is 2
image3maker: default for 's5l8930x' is 2
image3maker: default for 's5l8940x' is 17
image3maker: default for 's5l8942x' is 16
image3maker: default for 's5l8945x' is 16
image3maker: default for 's5l8947x' is 16
image3maker: default for 's5l8950x' is 16
image3maker: default for 's5l8955x' is 16
image3maker: --hardwareEpoch <hardware epoch> Set the hardware epoch
image3maker: Should only be used for Image3 objects embedded in certs.
image3maker: --domain {manufacturer|darwin|rtxc}
image3maker: --data <data file> Add payload data from <data file>
image3maker: --personalize Personalize the image for local storage
image3maker: --production Marks the image as a production image
image3maker: --development Marks the image as a development image
image3maker: --override <override> Set the override value.
image3maker: Should only be used for Image3 objects embedded in certs.
image3maker: --chipType <chip ID>
image3maker: --boardID <board ID>
image3maker: --uniqueID <unique chip ID>
image3maker: --padWithRandomBytes Adds random pad data
image3maker:
image3maker: Arguments for --hashForSigning:
image3maker: --partialHashReservationSize <size> Requests a partial (unfinalized) hash rather than a normal hash.
image3maker: The partial hash is computed assuming that an additional size bytes
image3maker: will be added to the final signed portion of the image.
image3maker:
image3maker: Arguments for --signWithData:
image3maker: --expectHash <hash value> Require that the image hash to <hash value>
image3maker: --signWithSignature <signaturefile> Sign the image using the supplied signature file
image3maker: --signWithCertChain <chainfile> Place the supplied cert chain file into the signed image
image3maker:
image3maker: Arguments for --finalizeWithoutSignature:
image3maker: --expectHash <hash value> Require that the image hash to <hash value>
image3maker:
image3maker: Arguments for --print:
image3maker: --tag <tag name> Tag to be printed, either a 4 character string or a hexadecimal
image3maker: number prefixed with 0x
image3maker: --skip <n> Requests the nth occurrence of the specified tag. Defaults to 0.</pre>

Image3maker (Internal Tool)

2013-08-25T18:25:33Z

Iemit737: Create new page

{{Infobox software
| name = Image3maker
| title =
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size = 77,760 bytes [APP]
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}

Image3maker is an Apple internal tool used to create [[img3]] firmware files. It's implemented in mostly C with its symbols stripped. There is an open source version by the same name, [[Image3maker]].

From the disassembly, it appears that the Key and IV are generated via /dev/random.
The GID key is loaded in from a plist at /usr/local/standalone/firmware/platform_keys.plist in order to encrypt the KGAG (referred to as "Keybag").

== Usage ==
The usage information from running the binary.
<pre>
Usage: image3maker [options]

image3maker: Modes:
image3maker: --create Create a new image3 file
image3maker: --update Update an existing image3 file
image3maker: --hashForSigning Generate and print the SHA-1 hash of the signable area
image3maker: --signWithData Sign with supplied data
image3maker: --finalizeWithoutSignature Finalize image3 file for use with authorized installation
image3maker: --printEpoch Print the numeric value of the epoch specified by --epoch
image3maker: --print Print the value of the tag specified by --tag
image3maker:
image3maker: General options:
image3maker: --unsign Removes signature information, allowing operations on images
image3maker: that have previously been signed.
image3maker:
image3maker: Arguments for --create and --update:
image3maker: --imagefile <file> Image3 format file
image3maker: In --create mode this file is created or truncated
image3maker: --type <type> Hex or 4-byte ASCII type tag
image3maker: This is required for --create mode, not permitted in --update mode
image3maker: --version <version> Set version string
image3maker: --epoch <security epoch> Explicit epoch or chip name to pick system default
image3maker: default for 's5l8747x' is 16
image3maker: default for 's5l8920x' is 4
image3maker: default for 's5l8922x' is 2
image3maker: default for 's5l8930x' is 2
image3maker: default for 's5l8940x' is 17
image3maker: default for 's5l8942x' is 16
image3maker: default for 's5l8945x' is 16
image3maker: default for 's5l8947x' is 16
image3maker: default for 's5l8950x' is 16
image3maker: default for 's5l8955x' is 16
image3maker: --hardwareEpoch <hardware epoch> Set the hardware epoch
image3maker: Should only be used for Image3 objects embedded in certs.
image3maker: --domain {manufacturer|darwin|rtxc}
image3maker: --data <data file> Add payload data from <data file>
image3maker: --personalize Personalize the image for local storage
image3maker: --production Marks the image as a production image
image3maker: --development Marks the image as a development image
image3maker: --override <override> Set the override value.
image3maker: Should only be used for Image3 objects embedded in certs.
image3maker: --chipType <chip ID>
image3maker: --boardID <board ID>
image3maker: --uniqueID <unique chip ID>
image3maker: --padWithRandomBytes Adds random pad data
image3maker:
image3maker: Arguments for --hashForSigning:
image3maker: --partialHashReservationSize <size> Requests a partial (unfinalized) hash rather than a normal hash.
image3maker: The partial hash is computed assuming that an additional size bytes
image3maker: will be added to the final signed portion of the image.
image3maker:
image3maker: Arguments for --signWithData:
image3maker: --expectHash <hash value> Require that the image hash to <hash value>
image3maker: --signWithSignature <signaturefile> Sign the image using the supplied signature file
image3maker: --signWithCertChain <chainfile> Place the supplied cert chain file into the signed image
image3maker:
image3maker: Arguments for --finalizeWithoutSignature:
image3maker: --expectHash <hash value> Require that the image hash to <hash value>
image3maker:
image3maker: Arguments for --print:
image3maker: --tag <tag name> Tag to be printed, either a 4 character string or a hexadecimal
image3maker: number prefixed with 0x
image3maker: --skip <n> Requests the nth occurrence of the specified tag. Defaults to 0.</pre>

PurpleRestore

2013-07-20T16:48:19Z

Iemit737:

{{Infobox software
| name = PurpleRestore
| title =
| logo = [[File:PurpleRestore logo.png]]
| screenshot = [[File:PurpleRestore11A437.png|300px]]
| caption = PurpleRestore 106.00 (11A437)
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release version = 106.00 (latest ''known'' version)
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size = 4,096,348 bytes [APP] (106.00)
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}
{{float toc|left}}
'''PurpleRestore''' is a tool made by Apple and is used for flashing [[iDevices]]. Barely anything is known about it except that it provides far more customization than [[iTunes]]. PurpleRestore-106.00 (build 11A437) is the latest known version which is capable of detecting devices running the latest iOS 7 beta. Little is currently known about which versions it "supports" for restoring as such.

Like [[iTunes]], [[PurpleRestore]] communicates with iDevices using a [[usbmux]] connection.

== Restore Bundles==
Unlike iTunes, PurpleRestore doesn't use [[IPSW File Format|IPSW]] files to restore devices. It uses "Restore Bundles" which can be obtained from a server specific to a version of iOS, such as <code>afp://fieldgoal.apple.com/RestoreImages/</code> and <code>afp://endzone.apple.com/OldRestoreImages/</code> (among many others) . Unfortunately, the <code>afp</code> protocol can only be accessed through Apple's internal VPN.

However, you can create your own bundles by extracting an IPSW into a folder. The downside is that you don't get access to any internal/debugging stuff since it is a public firmware.

== Restore Components ==
Restore Components has several options:
* '''Restore Bundle''': Specify the bundle to use in restoring
* '''Firmware Directory''': Specify the folder where the [[LLB]], [[iBoot]], etc. [[IMG3 File Format|IMG3]] files are located.
* '''Ramdisk Image''': Specify a [[ramdisk]] to be used (i.e. [[Restore Ramdisk|restore]] or [[Update Ramdisk|update]] ramdisk)
* '''DFU''': Specify what tools to upload based on a selection of "Debug", "Development", or "Release". A specific file can also be selected.

== Restore Operations ==
Restore Operations contains the most options to configure. These may also be the most useful ones.

* '''Hardware Readiness'''
** '''Minimum Battery Charge (mV)''': This value controls the minimum charge level at which the restore will be allowed to continue. Below this threshold, we either wait to charge (if we're charging) or fail (if we're not charging). If this option is not specified, a default value is used (currently 3.8V). Setting this option to 0 bypasses all battery level checks.
** '''Wait for Minimum Charge''': If the current voltage is below the minimum level, then the default behavior is to let the device charge and then continue. This option overrides that behavior when false.
** '''Wait for Storage Device''': Controls whether the restore waits for the storage device /dev/disk0 to be available before the restore is initiated.
** '''Allow Untethered Restore''': Permit the restore to run untethered (not connected to a host). The result of specifying this option when the restore needs data from the host (for instance, when flashing NOR) is undefined (but probably bad). If this option is specified and the device remains tethered, things should proceed as usual.
* '''Storage Media'''
** '''Use LwVM''': Controls whether the device is formatted for LwVM (if supported).
** '''Repartition''': Controls whether a new partition map is created on the device.
** '''System Partition Size (MiB)''': Specifies the size (in mebibytes) that is desired for the system partition. Because the partition size can only be changed when creating a new partition map, this option is only relevant when used in conjunction with repartition. A size of 0 indicates that the restore library should choose a suitable size for you, based on the specific restore bundle and image being used if possible.
** '''Content Protection Type''': Controls the type of data protection used on the device.
** '''Low-Level Erase''': Do a low level erase (wipe with null or random data) of the entire storage device prior to restoring.
* '''Restore System Partition'''
** '''System Image''': Determines which type of system image to restore, or which file to use for the system image.
** '''Kernel Cache Type''': This option controls the kernel cache that gets installed on the device.
* '''Baseband'''
** '''Update Baseband''': Controls whether the [[baseband]] and baseband bootloader are updated as part of the restore.
** '''Force Update''': The baseband update is skipped when the existing firmware matches the available firmware. In some cases, it is desirable to force the firmware update to occur, regardless of what is currently on there. This option, when set to true, forces the update to be attempted.
[[File:IPhoneDuringPurpleRestore.jpeg |250px|thumb|right|iPhone 5 undergoing a PurpleRestore]]

== Restore OS ==
Restore OS options allow you to specify the following:
* '''Restore Boot-Args''': Boot-Args used when the Restore OS is loaded. By default those arguments are used: "debug=0x14e serial=3 rd=md0 nand-enable-reformat=1 -progress"
* '''Firmware Type:''' Specify the firmware which should be flashed when restoring. This can either be "Debug", "Factory FA", "Factory SA", "Firmware Development" or "Production".
* '''Boot Image Type:''' Can be "Internal", "User or Internal", "User" or "Update".
* '''Boot Kernel Cache:''' Specify whether the "Production" or "Development" kernel cache should be used.

==Personalization Settings==
As with iTunes, PurpleRestore can personalize builds for iOS devices (since recent Bootroms expect a valid APTicket). The tooltip for the "Personalized Restore" checkbox reads "Your ticket to the Orwellian cloud." This may suggest that Apple developed TSS in part to control access to internal build variants (i.e. prevent leaks of "interesting" builds of iOS), in addition to preventing production users from downgrading.
* '''Variants''': "A predefined combination of restore pieces." The options are: "Customer Install", "Internal Debug", "Internal Development", "Internal Install", "Internal Qualification", and "Vendor install."
* '''AppleConnect''': Used to authenticate all restores for personalization. Interestingly, AppleConnect will allow members of the iOS Developer Program (including non-employees) to install public builds of iOS (latest current and beta). It's likely AppleConnect is also used to authenticate signing of internal builds using the public TSS server, should the device be on the whitelist.

== Restore Settings ==
By default, PurpleRestore comes with two pre-made restore settings. "Erase Install" and "Update Install". Those restore settings are [[PLIST File Format|plist]] files that define the options PurpleRestore will use when restoring a device.
* '''Erase Install''': Repartition the media and erase all data before restoring. Includes all internal development tools and updates flash and the baseband by default.
* '''Update Install''': Includes all internal development tools and updates flash and the baseband by default.

[[File:PurpleRestoreOptions.png |250px|thumb|right|PurpleRestore configuration screen]]

== Reverse Engineering ==
This specific code is from [[iTunes]] for OS X. It detects if PurpleRestore is running so that it does not interfere with any operations that PurpleRestore is performing.

Off Virt Adr Instruction AT&T Syntax Intel Syntax Comment

+354 003d7808 c70424bc01d700 movl $0x00d701bc, (%esp) mov [esp], 0x00d701bc ; CFSTR("com.apple.PurpleRestore")
+361 003d780f e80c65c3ff calll 0x10000dd20 call 0x10000dd20 ; is specified bundle running
+366 003d7814 84c0 testb %al,%al test al, al
+368 003d7816 7409 jz 0x003d7821 jz short 0x003d7821 ; if so, PurpleRestore is running
+370 003d7818 c704246c8ba400 movl $0x00a48b6c, (%esp) mov [esp], 0x00a48b6c ; so ignore device,
+377 003d781f ebd3 jmp 0x003d77f4 jmp short 0x003d77f4 ; and jump back above loop for next device
+379 003d7821 8d5de0 leal 0xe0(%ebp), %ebx lea ebx, [ebp + 0xe0]
+382 003d7824 895c2404 movl %ebx, 0x04(%esp) mov [esp + 4], ebx

== See Also ==
* [[iTunes]]

[[Category:Software]]

File:IPhoneDuringPurpleRestore.jpeg

2013-07-20T16:46:31Z

Iemit737: This is an iPhone 5 being PurpleRestored to production 6.1.4. The first stage of PurpleRestore sets bgcolor through iBoot to purple.

This is an iPhone 5 being PurpleRestored to production 6.1.4. The first stage of PurpleRestore sets bgcolor through iBoot to purple.

DCSD

2013-07-20T15:46:49Z

Iemit737: Explaining what DCSD is

DCSD in an Apple internal Mac application. When properly configured, the application serves as a diagnostic platform for Foxconn workers. The tool allows multiple devices to connect at once. The tool can boot devices into Inferno with a custom ramdisk that is personalized to the device. Inferno runs stress tests on the device and the results are stored in the DIAGS block. DCSD reports results to a centralized server using a library called libinstantpudding.dylib. All production iPhones are to be run through DCSD for quality assurance. The DCSD app is also capable of installing demo bundles (via mobile backup restoration) for use in retail stores.

Note: Leaked versions don't contain libinstantpudding.dylib nor the necessary signed plist files, so the application forces the user quit.

[[File:DCSD.png| right|400px|DCSD]]
{{stub|software}}
[[Category: Apple Internal Apps]]

File:DCSD.png

2013-07-20T15:42:48Z

Iemit737: Screenshot of DCSD tool

Screenshot of DCSD tool

PurpleSNIFF

2013-07-20T14:59:10Z

Iemit737: /* Auth List */ clarity

{{Infobox software
| name = PurpleSNIFF
| title =
| logo = [[File:PurpleSNIFF logo.png | 300px]]
| caption = PurpleSNIFF 2.0 (76)
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release version =
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size = 3,969,269 bytes [APP] (76)
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}
{{float toc|left}}
'''PurpleSNIFF''' is a tool made by Apple to read identification and diagnostic information from the device. The tool is used by Apple engineers as well as factory workers at Foxconn/Pegasus. It's included in the RestoreTools.pkg.

Like [[iTunes]], [[PurpleSNIFF]] communicates with iDevices using a [[usbmux]] connection.

==Device Information==
PurpleSNIFF displays the value of all keys accessible by liblockdown and mobilegestaltd.
Data is broken into categories:
* '''SNIFF''': Report date and host machine configuration
* '''Battery''': Battery charge state
* '''Debug''': Lockdown and CLTM (thermal) extended logging.
* '''Developer''': "Development" if has installed XCode developer diskimage.
* '''Device Mode''': "OS Mode", "Recovery", "DFU", and possibly other internal modes.
* '''Diagnostic Data''': Includes device test data from different factory stations, including their timestamps. There are over 300 testing stations devices can be tested on. Each device will usually pass through about 6 testing stations before shipping. The diagnostic platform is called iPCB.
* '''Disk Usage''': Stats for both System and Data partitions
* '''General''': Activation info, baseband identifiers and state, current carrier bundle, device certificate, public key, name, device color, ECID, MAC addresses, UDID, Serial Number, Hardware Model, [[Fusing Status]], platform, architecture, IMEI/IMSI/ICCID, NVRAM data, OS Build/Version, passcode lock-state, proximity sensor calibration, region code, [[Security Fusing]] (production or development), SIM card status, presence of Springboard/lockdown, and many more.
* '''Internal''': isInternal and isCarrierBuild, isUIBuild, raw hex dump of SysCfg and DIAGS blocks.
* '''Localization''': Language
* '''Mobile iTunes''': Fairplay related parameters (e.g. certificate)
* '''Restore From Backup''': If it has been restored from a backup
* '''Setup Assistant''': YES/NO listing of which screens have been presented.
* '''Software Behavior''': A bitmask that is decoded into the following boolean properties: China Brick, Google Mail, No VOIP, No Wi Fi, NTSC, Shutter Click, Valid, and Volume Limit.
* '''Sync''': Device support for clearing data and encrypted backups, as well as mail accounts connected.
* '''Sync Backup''': iCloud sync information.
* '''SysCfg''': Device hardware information such as sensor calibration data, device color, NAND size, and serial numbers. This block is read-write for AppleInternal tool that must run on the device, so that Apple can refurbish devices and give them a new serial number.
* '''Wireless''': Bonjour service name, Wifi support, Wifi-sync support.

[[File:PurpleSniffSS.png|350px|thumb|right| General Section of PurpleSNIFF with sensitive identifiers redacted.]]

==White List==
"Request White List Authorization" composes a new email to whitelist-request@group.apple.com. This address is only reachable from within Apple VPN, and does not accept outside senders. This feature allows a factory worker or Apple engineer to request that the device be SIM-unlocked for use on certain carriers.

TO: whitelist-request@group.apple.com
SUBJECT: White-list Request

Please whitelist the following device

device: n41ap-prodfuse
imei: 00...[redacted]...0

carriers:
justification:

==Auth List==
"Request Personalized Install Authorization" composes a new email to authlist-request@group.apple.com. As with White List, this email address is only reachable from within Apple VPN. This feature allows a factory worker or Apple engineer to request special firmware personalization for their device. This is useful because Apple could order prototypes of unreleased iPhones but refuse to sign any firmware for them. This way, if the devices are lost/leaked into the wild for some reason, the device is bricked. When prototype phones arrive safely/securely to Cupertino, engineers can have them activated for firmware personalization through this mechanism. It is not known the requests are to permit firmware signing on the public or internal (VPN-only) TSS server.

TO: authlist-request@group.apple.com
SUBJECT: Authorization List Request

Please authorize the following device

device: n41ap-prodfuse
ecid: 0[redacted]0
bbsn: 0x0[redacted]0

audience:
restore tool:
justification:

==Extras==
The other main tabs of the application reveal the live Syslog and the IORegistry hierarchy.
Menu options include commands to enable extra logging, reboot devices (with optional prompt), obliterate and reset them, read diagnostic data from GasGauge, WIFI, and NAND, query MobileGestalt directly, enter and exit recovery, and "Lookup Device" in PDCA. It can also pull logs off of the device, as well as content in var/mobile/library . The log archive can be huge because it includes data like the SMS database and all MMS attachments).

[[Category:Software]]

PurpleSNIFF

2013-07-20T14:57:29Z

Iemit737: /* Device Information */

{{Infobox software
| name = PurpleSNIFF
| title =
| logo = [[File:PurpleSNIFF logo.png | 300px]]
| caption = PurpleSNIFF 2.0 (76)
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release version =
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size = 3,969,269 bytes [APP] (76)
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}
{{float toc|left}}
'''PurpleSNIFF''' is a tool made by Apple to read identification and diagnostic information from the device. The tool is used by Apple engineers as well as factory workers at Foxconn/Pegasus. It's included in the RestoreTools.pkg.

Like [[iTunes]], [[PurpleSNIFF]] communicates with iDevices using a [[usbmux]] connection.

==Device Information==
PurpleSNIFF displays the value of all keys accessible by liblockdown and mobilegestaltd.
Data is broken into categories:
* '''SNIFF''': Report date and host machine configuration
* '''Battery''': Battery charge state
* '''Debug''': Lockdown and CLTM (thermal) extended logging.
* '''Developer''': "Development" if has installed XCode developer diskimage.
* '''Device Mode''': "OS Mode", "Recovery", "DFU", and possibly other internal modes.
* '''Diagnostic Data''': Includes device test data from different factory stations, including their timestamps. There are over 300 testing stations devices can be tested on. Each device will usually pass through about 6 testing stations before shipping. The diagnostic platform is called iPCB.
* '''Disk Usage''': Stats for both System and Data partitions
* '''General''': Activation info, baseband identifiers and state, current carrier bundle, device certificate, public key, name, device color, ECID, MAC addresses, UDID, Serial Number, Hardware Model, [[Fusing Status]], platform, architecture, IMEI/IMSI/ICCID, NVRAM data, OS Build/Version, passcode lock-state, proximity sensor calibration, region code, [[Security Fusing]] (production or development), SIM card status, presence of Springboard/lockdown, and many more.
* '''Internal''': isInternal and isCarrierBuild, isUIBuild, raw hex dump of SysCfg and DIAGS blocks.
* '''Localization''': Language
* '''Mobile iTunes''': Fairplay related parameters (e.g. certificate)
* '''Restore From Backup''': If it has been restored from a backup
* '''Setup Assistant''': YES/NO listing of which screens have been presented.
* '''Software Behavior''': A bitmask that is decoded into the following boolean properties: China Brick, Google Mail, No VOIP, No Wi Fi, NTSC, Shutter Click, Valid, and Volume Limit.
* '''Sync''': Device support for clearing data and encrypted backups, as well as mail accounts connected.
* '''Sync Backup''': iCloud sync information.
* '''SysCfg''': Device hardware information such as sensor calibration data, device color, NAND size, and serial numbers. This block is read-write for AppleInternal tool that must run on the device, so that Apple can refurbish devices and give them a new serial number.
* '''Wireless''': Bonjour service name, Wifi support, Wifi-sync support.

[[File:PurpleSniffSS.png|350px|thumb|right| General Section of PurpleSNIFF with sensitive identifiers redacted.]]

==White List==
"Request White List Authorization" composes a new email to whitelist-request@group.apple.com. This address is only reachable from within Apple VPN, and does not accept outside senders. This feature allows a factory worker or Apple engineer to request that the device be SIM-unlocked for use on certain carriers.

TO: whitelist-request@group.apple.com
SUBJECT: White-list Request

Please whitelist the following device

device: n41ap-prodfuse
imei: 00...[redacted]...0

carriers:
justification:

==Auth List==
"Request Personalized Install Authorization" composes a new email to authlist-request@group.apple.com. As with White List, this email address is only reachable from within Apple VPN. This feature allows a factory worker or Apple engineer to request special firmware personalization for their device. This is useful because Apple could order prototypes of unreleased iPhones but refuse to sign any firmware for them. This way, if the devices are lost/leaked into the wild for some reason, the device is bricked. When prototype phones arrive safely/securely to Cupertino, engineers can have them activated for firmware personalization through this mechanism. It is not known if approved requests permit firmware signing on the public or internal (VPN-only) TSS server.

TO: authlist-request@group.apple.com
SUBJECT: Authorization List Request

Please authorize the following device

device: n41ap-prodfuse
ecid: 0[redacted]0
bbsn: 0x0[redacted]0

audience:
restore tool:
justification:

==Extras==
The other main tabs of the application reveal the live Syslog and the IORegistry hierarchy.
Menu options include commands to enable extra logging, reboot devices (with optional prompt), obliterate and reset them, read diagnostic data from GasGauge, WIFI, and NAND, query MobileGestalt directly, enter and exit recovery, and "Lookup Device" in PDCA. It can also pull logs off of the device, as well as content in var/mobile/library . The log archive can be huge because it includes data like the SMS database and all MMS attachments).

[[Category:Software]]

PurpleSNIFF

2013-07-20T14:55:32Z

Iemit737: Initial page creation

{{Infobox software
| name = PurpleSNIFF
| title =
| logo = [[File:PurpleSNIFF logo.png | 300px]]
| caption = PurpleSNIFF 2.0 (76)
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release version =
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size = 3,969,269 bytes [APP] (76)
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}
{{float toc|left}}
'''PurpleSNIFF''' is a tool made by Apple to read identification and diagnostic information from the device. The tool is used by Apple engineers as well as factory workers at Foxconn/Pegasus. It's included in the RestoreTools.pkg.

Like [[iTunes]], [[PurpleSNIFF]] communicates with iDevices using a [[usbmux]] connection.

==Device Information==
PurpleSNIFF displays the value of all keys accessible by liblockdown and mobilegestaltd.
Data is broken into categories:
* '''SNIFF''': Report date and host machine configuration
* '''Battery''': Battery charge state
* '''Debug''': Lockdown and CLTM (thermal) extended logging.
* '''Developer''': "Development" if has installed XCode developer diskimage.
* '''Device Mode''': "OS Mode", "Recovery", "DFU", and possibly other internal modes.
* '''Diagnostic Data''': Includes device test data from different factory stations, including their timestamps. There are over 300 testing stations devices can be tested on. Each device will usually pass through about 6 testing stations before shipping. The diagnostic platform is called iPCB.
* '''Disk Usage''': Stats for both System and Data partitions
* '''General''': Activation info, baseband identifiers and state, current carrier bundle, device certificate, public key, name, color, ECID, MAC addresses, UDID, Serial Number, Hardware Model, [Fusing Status], platform, architecture, IMEI/IMSI/ICCID, NVRAM data, OS Build/Version, passcode lock-state, proximity sensor calibration, region code, [Security Fusing] (production or development), SIM card status, presence of Springboard/lockdown, and many more.
* '''Internal''': isInternal and isCarrierBuild, UI Build (bool), raw hex dump of SysCfg and DIAGS blocks.
* '''Localization''': Language
* '''Mobile iTunes''': Fairplay related parameters (e.g. certificate)
* '''Restore From Backup''': If it has been restored from a backup
* '''Setup Assistant''': YES/NO listing of which screens have been presented.
* '''Software Behavior''': A bitmask that is decoded into the following boolean properties: China Brick, Google Mail, No VOIP, No Wi Fi, NTSC, Shutter Click, Valid, and Volume Limit.
* '''Sync''': Device support for clearing data and encrypted backups, as well as mail accounts connected.
* '''Sync Backup''': iCloud sync information.
* '''SysCfg''': Device hardware information such as sensor calibration data, device color, NAND size, and serial numbers. This block is read-write for AppleInternal tool that must run on the device, so that Apple can refurbish devices and give them a new serial number.
* '''Wireless''': Bonjour service name, Wifi support, Wifi-sync support.

[[File:PurpleSniffSS.png|350px|thumb|right| General Section of PurpleSNIFF with sensitive bits redacted.]]

==White List==
"Request White List Authorization" composes a new email to whitelist-request@group.apple.com. This address is only reachable from within Apple VPN, and does not accept outside senders. This feature allows a factory worker or Apple engineer to request that the device be SIM-unlocked for use on certain carriers.

TO: whitelist-request@group.apple.com
SUBJECT: White-list Request

Please whitelist the following device

device: n41ap-prodfuse
imei: 00...[redacted]...0

carriers:
justification:

==Auth List==
"Request Personalized Install Authorization" composes a new email to authlist-request@group.apple.com. As with White List, this email address is only reachable from within Apple VPN. This feature allows a factory worker or Apple engineer to request special firmware personalization for their device. This is useful because Apple could order prototypes of unreleased iPhones but refuse to sign any firmware for them. This way, if the devices are lost/leaked into the wild for some reason, the device is bricked. When prototype phones arrive safely/securely to Cupertino, engineers can have them activated for firmware personalization through this mechanism. It is not known if approved requests permit firmware signing on the public or internal (VPN-only) TSS server.

TO: authlist-request@group.apple.com
SUBJECT: Authorization List Request

Please authorize the following device

device: n41ap-prodfuse
ecid: 0[redacted]0
bbsn: 0x0[redacted]0

audience:
restore tool:
justification:

==Extras==
The other main tabs of the application reveal the live Syslog and the IORegistry hierarchy.
Menu options include commands to enable extra logging, reboot devices (with optional prompt), obliterate and reset them, read diagnostic data from GasGauge, WIFI, and NAND, query MobileGestalt directly, enter and exit recovery, and "Lookup Device" in PDCA. It can also pull logs off of the device, as well as content in var/mobile/library . The log archive can be huge because it includes data like the SMS database and all MMS attachments).

[[Category:Software]]

File:PurpleSniffSS.png

2013-07-20T14:02:24Z

Iemit737: Screenshot of PurpleSNIFF

Screenshot of PurpleSNIFF

File:PurpleSNIFF logo.png

2013-07-20T13:58:49Z

Iemit737: About page

About page

PurpleRestore

2013-07-20T13:27:48Z

Iemit737:

{{Infobox software
| name = PurpleRestore
| title =
| logo = [[File:PurpleRestore logo.png]]
| screenshot = [[File:PurpleRestore11A437.png|300px]]
| caption = PurpleRestore 106.00 (11A437)
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release version = 106.00 (latest ''known'' version)
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size = 4,096,348 bytes [APP] (106.00)
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}
{{float toc|left}}
'''PurpleRestore''' is a tool made by Apple and is used for flashing [[iDevices]]. Barely anything is known about it except that it provides far more customization than [[iTunes]]. PurpleRestore-106.00 (build 11A437) is the latest known version which is capable of detecting devices running the latest iOS 7 beta. Little is currently known about which versions it "supports" for restoring as such.

Like [[iTunes]], [[PurpleRestore]] communicates with iDevices using a [[usbmux]] connection.

== Restore Bundles==
Unlike iTunes, PurpleRestore doesn't use [[IPSW File Format|IPSW]] files to restore devices. It uses "Restore Bundles" which can be obtained from a server specific to a version of iOS, such as <code>afp://fieldgoal.apple.com/RestoreImages/</code> and <code>afp://endzone.apple.com/OldRestoreImages/</code> (among many others) . Unfortunately, the <code>afp</code> protocol can only be accessed through Apple's internal VPN.

However, you can create your own bundles by extracting an IPSW into a folder. The downside is that you don't get access to any internal/debugging stuff since it is a public firmware.

== Restore Components ==
Restore Components has several options:
* '''Restore Bundle''': Specify the bundle to use in restoring
* '''Firmware Directory''': Specify the folder where the [[LLB]], [[iBoot]], etc. [[IMG3 File Format|IMG3]] files are located.
* '''Ramdisk Image''': Specify a [[ramdisk]] to be used (i.e. [[Restore Ramdisk|restore]] or [[Update Ramdisk|update]] ramdisk)
* '''DFU''': Specify what tools to upload based on a selection of "Debug", "Development", or "Release". A specific file can also be selected.

== Restore Operations ==
Restore Operations contains the most options to configure. These may also be the most useful ones.

* '''Hardware Readiness'''
** '''Minimum Battery Charge (mV)''': This value controls the minimum charge level at which the restore will be allowed to continue. Below this threshold, we either wait to charge (if we're charging) or fail (if we're not charging). If this option is not specified, a default value is used (currently 3.8V). Setting this option to 0 bypasses all battery level checks.
** '''Wait for Minimum Charge''': If the current voltage is below the minimum level, then the default behavior is to let the device charge and then continue. This option overrides that behavior when false.
** '''Wait for Storage Device''': Controls whether the restore waits for the storage device /dev/disk0 to be available before the restore is initiated.
** '''Allow Untethered Restore''': Permit the restore to run untethered (not connected to a host). The result of specifying this option when the restore needs data from the host (for instance, when flashing NOR) is undefined (but probably bad). If this option is specified and the device remains tethered, things should proceed as usual.
* '''Storage Media'''
** '''Use LwVM''': Controls whether the device is formatted for LwVM (if supported).
** '''Repartition''': Controls whether a new partition map is created on the device.
** '''System Partition Size (MiB)''': Specifies the size (in mebibytes) that is desired for the system partition. Because the partition size can only be changed when creating a new partition map, this option is only relevant when used in conjunction with repartition. A size of 0 indicates that the restore library should choose a suitable size for you, based on the specific restore bundle and image being used if possible.
** '''Content Protection Type''': Controls the type of data protection used on the device.
** '''Low-Level Erase''': Do a low level erase (wipe with null or random data) of the entire storage device prior to restoring.
* '''Restore System Partition'''
** '''System Image''': Determines which type of system image to restore, or which file to use for the system image.
** '''Kernel Cache Type''': This option controls the kernel cache that gets installed on the device.
* '''Baseband'''
** '''Update Baseband''': Controls whether the [[baseband]] and baseband bootloader are updated as part of the restore.
** '''Force Update''': The baseband update is skipped when the existing firmware matches the available firmware. In some cases, it is desirable to force the firmware update to occur, regardless of what is currently on there. This option, when set to true, forces the update to be attempted.

== Restore OS ==
Restore OS options allow you to specify the following:
* '''Restore Boot-Args''': Boot-Args used when the Restore OS is loaded. By default those arguments are used: "debug=0x14e serial=3 rd=md0 nand-enable-reformat=1 -progress"
* '''Firmware Type:''' Specify the firmware which should be flashed when restoring. This can either be "Debug", "Factory FA", "Factory SA", "Firmware Development" or "Production".
* '''Boot Image Type:''' Can be "Internal", "User or Internal", "User" or "Update".
* '''Boot Kernel Cache:''' Specify whether the "Production" or "Development" kernel cache should be used.

==Personalization Settings==
As with iTunes, PurpleRestore can personalize builds for iOS devices (since recent Bootroms expect a valid APTicket). The tooltip for the "Personalized Restore" checkbox reads "Your ticket to the Orwellian cloud." This may suggest that Apple developed TSS in part to control access to internal build variants (i.e. prevent leaks of "interesting" builds of iOS), in addition to preventing production users from downgrading.
* '''Variants''': "A predefined combination of restore pieces." The options are: "Customer Install", "Internal Debug", "Internal Development", "Internal Install", "Internal Qualification", and "Vendor install."
* '''AppleConnect''': Used to authenticate all restores for personalization. Interestingly, AppleConnect will allow members of the iOS Developer Program (including non-employees) to install public builds of iOS (latest current and beta). It's likely AppleConnect is also used to authenticate signing of internal builds using the public TSS server, should the device be on the whitelist.

== Restore Settings ==
By default, PurpleRestore comes with two pre-made restore settings. "Erase Install" and "Update Install". Those restore settings are [[PLIST File Format|plist]] files that define the options PurpleRestore will use when restoring a device.
* '''Erase Install''': Repartition the media and erase all data before restoring. Includes all internal development tools and updates flash and the baseband by default.
* '''Update Install''': Includes all internal development tools and updates flash and the baseband by default.

[[File:PurpleRestoreOptions.png |250px|thumb|right|PurpleRestore configuration screen]]

== Reverse Engineering ==
This specific code is from [[iTunes]] for OS X. It detects if PurpleRestore is running so that it does not interfere with any operations that PurpleRestore is performing.

Off Virt Adr Instruction AT&T Syntax Intel Syntax Comment

+354 003d7808 c70424bc01d700 movl $0x00d701bc, (%esp) mov [esp], 0x00d701bc ; CFSTR("com.apple.PurpleRestore")
+361 003d780f e80c65c3ff calll 0x10000dd20 call 0x10000dd20 ; is specified bundle running
+366 003d7814 84c0 testb %al,%al test al, al
+368 003d7816 7409 jz 0x003d7821 jz short 0x003d7821 ; if so, PurpleRestore is running
+370 003d7818 c704246c8ba400 movl $0x00a48b6c, (%esp) mov [esp], 0x00a48b6c ; so ignore device,
+377 003d781f ebd3 jmp 0x003d77f4 jmp short 0x003d77f4 ; and jump back above loop for next device
+379 003d7821 8d5de0 leal 0xe0(%ebp), %ebx lea ebx, [ebp + 0xe0]
+382 003d7824 895c2404 movl %ebx, 0x04(%esp) mov [esp + 4], ebx

== See Also ==
* [[iTunes]]

[[Category:Software]]

PurpleRestore

2013-07-20T13:09:02Z

Iemit737: /* Restore Settings */ Added screenshot

{{Infobox software
| name = PurpleRestore
| title =
| logo = [[File:PurpleRestore logo.png]]
| screenshot = [[File:PurpleRestore11A437.png|300px]]
| caption = PurpleRestore 106.00 (11A437)
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release version = 106.00 (latest ''known'' version)
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size = 4,096,348 bytes [APP] (106.00)
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}
{{float toc|left}}
'''PurpleRestore''' is a tool made by Apple and is used for flashing [[iDevices]]. Barely anything is known about it except that it provides far more customization than [[iTunes]]. PurpleRestore-106.00 (build 11A437) is the latest known version which is capable of detecting devices running the latest iOS 7 beta. Little is currently known about which versions it "supports" for restoring as such.

Like [[iTunes]], [[PurpleRestore]] communicates with iDevices using a [[usbmux]] connection.

== Restore Bundles==
Unlike iTunes, PurpleRestore doesn't use [[IPSW File Format|IPSW]] files to restore devices. It uses "Restore Bundles" which can be obtained from a server specific to a version of iOS, such as <code>afp://fieldgoal.apple.com/RestoreImages/</code> and <code>afp://endzone.apple.com/OldRestoreImages/</code> (among many others) . Unfortunately, the <code>afp</code> protocol can only be accessed through Apple's internal VPN.

However, you can create your own bundles by extracting an IPSW into a folder. The downside is that you don't get access to any internal/debugging stuff since it is a public firmware.

== Restore Components ==
Restore Components has several options:
* '''Restore Bundle''': Specify the bundle to use in restoring
* '''Firmware Directory''': Specify the folder where the [[LLB]], [[iBoot]], etc. [[IMG3 File Format|IMG3]] files are located.
* '''Ramdisk Image''': Specify a [[ramdisk]] to be used (i.e. [[Restore Ramdisk|restore]] or [[Update Ramdisk|update]] ramdisk)
* '''DFU''': Specify what tools to upload based on a selection of "Debug", "Development", or "Release". A specific file can also be selected.

== Restore Operations ==
Restore Operations contains the most options to configure. These may also be the most useful ones.

* '''Hardware Readiness'''
** '''Minimum Battery Charge (mV)''': This value controls the minimum charge level at which the restore will be allowed to continue. Below this threshold, we either wait to charge (if we're charging) or fail (if we're not charging). If this option is not specified, a default value is used (currently 3.8V). Setting this option to 0 bypasses all battery level checks.
** '''Wait for Minimum Charge''': If the current voltage is below the minimum level, then the default behavior is to let the device charge and then continue. This option overrides that behavior when false.
** '''Wait for Storage Device''': Controls whether the restore waits for the storage device /dev/disk0 to be available before the restore is initiated.
** '''Allow Untethered Restore''': Permit the restore to run untethered (not connected to a host). The result of specifying this option when the restore needs data from the host (for instance, when flashing NOR) is undefined (but probably bad). If this option is specified and the device remains tethered, things should proceed as usual.
* '''Storage Media'''
** '''Use LwVM''': Controls whether the device is formatted for LwVM (if supported).
** '''Repartition''': Controls whether a new partition map is created on the device.
** '''System Partition Size (MiB)''': Specifies the size (in mebibytes) that is desired for the system partition. Because the partition size can only be changed when creating a new partition map, this option is only relevant when used in conjunction with repartition. A size of 0 indicates that the restore library should choose a suitable size for you, based on the specific restore bundle and image being used if possible.
** '''Content Protection Type''': Controls the type of data protection used on the device.
** '''Low-Level Erase''': Do a low level erase (wipe with null or random data) of the entire storage device prior to restoring.
* '''Restore System Partition'''
** '''System Image''': Determines which type of system image to restore, or which file to use for the system image.
** '''Kernel Cache Type''': This option controls the kernel cache that gets installed on the device.
* '''Baseband'''
** '''Update Baseband''': Controls whether the [[baseband]] and baseband bootloader are updated as part of the restore.
** '''Force Update''': The baseband update is skipped when the existing firmware matches the available firmware. In some cases, it is desirable to force the firmware update to occur, regardless of what is currently on there. This option, when set to true, forces the update to be attempted.

== Restore OS ==
Restore OS options allow you to specify the following:
* '''Restore Boot-Args''': Boot-Args used when the Restore OS is loaded. By default those arguments are used: "debug=0x14e serial=3 rd=md0 nand-enable-reformat=1 -progress"
* '''Firmware Type:''' Specify the firmware which should be flashed when restoring. This can either be "Debug", "Factory FA", "Factory SA", "Firmware Development" or "Production".
* '''Boot Image Type:''' Can be "Internal", "User or Internal", "User" or "Update".
* '''Boot Kernel Cache:''' Specify whether the "Production" or "Development" kernel cache should be used.

== Restore Settings ==
By default, PurpleRestore comes with two pre-made restore settings. "Erase Install" and "Update Install". Those restore settings are [[PLIST File Format|plist]] files that define the options PurpleRestore will use when restoring a device.
* '''Erase Install''': Repartition the media and erase all data before restoring. Includes all internal development tools and updates flash and the baseband by default.
* '''Update Install''': Includes all internal development tools and updates flash and the baseband by default.

[[File:PurpleRestoreOptions.png |300px|thumb|right|PurpleRestore configuration screen]]

== Reverse Engineering ==
This specific code is from [[iTunes]] for OS X. It detects if PurpleRestore is running so that it does not interfere with any operations that PurpleRestore is performing.

Off Virt Adr Instruction AT&T Syntax Intel Syntax Comment

+354 003d7808 c70424bc01d700 movl $0x00d701bc, (%esp) mov [esp], 0x00d701bc ; CFSTR("com.apple.PurpleRestore")
+361 003d780f e80c65c3ff calll 0x10000dd20 call 0x10000dd20 ; is specified bundle running
+366 003d7814 84c0 testb %al,%al test al, al
+368 003d7816 7409 jz 0x003d7821 jz short 0x003d7821 ; if so, PurpleRestore is running
+370 003d7818 c704246c8ba400 movl $0x00a48b6c, (%esp) mov [esp], 0x00a48b6c ; so ignore device,
+377 003d781f ebd3 jmp 0x003d77f4 jmp short 0x003d77f4 ; and jump back above loop for next device
+379 003d7821 8d5de0 leal 0xe0(%ebp), %ebx lea ebx, [ebp + 0xe0]
+382 003d7824 895c2404 movl %ebx, 0x04(%esp) mov [esp + 4], ebx

== See Also ==
* [[iTunes]]

[[Category:Software]]

PurpleRestore

2013-07-20T13:07:22Z

Iemit737: /* Restore Bundles */ - there are MANY places restore images sit

{{Infobox software
| name = PurpleRestore
| title =
| logo = [[File:PurpleRestore logo.png]]
| screenshot = [[File:PurpleRestore11A437.png|300px]]
| caption = PurpleRestore 106.00 (11A437)
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release version = 106.00 (latest ''known'' version)
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size = 4,096,348 bytes [APP] (106.00)
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}
{{float toc|left}}
'''PurpleRestore''' is a tool made by Apple and is used for flashing [[iDevices]]. Barely anything is known about it except that it provides far more customization than [[iTunes]]. PurpleRestore-106.00 (build 11A437) is the latest known version which is capable of detecting devices running the latest iOS 7 beta. Little is currently known about which versions it "supports" for restoring as such.

Like [[iTunes]], [[PurpleRestore]] communicates with iDevices using a [[usbmux]] connection.

== Restore Bundles==
Unlike iTunes, PurpleRestore doesn't use [[IPSW File Format|IPSW]] files to restore devices. It uses "Restore Bundles" which can be obtained from a server specific to a version of iOS, such as <code>afp://fieldgoal.apple.com/RestoreImages/</code> and <code>afp://endzone.apple.com/OldRestoreImages/</code> (among many others) . Unfortunately, the <code>afp</code> protocol can only be accessed through Apple's internal VPN.

However, you can create your own bundles by extracting an IPSW into a folder. The downside is that you don't get access to any internal/debugging stuff since it is a public firmware.

== Restore Components ==
Restore Components has several options:
* '''Restore Bundle''': Specify the bundle to use in restoring
* '''Firmware Directory''': Specify the folder where the [[LLB]], [[iBoot]], etc. [[IMG3 File Format|IMG3]] files are located.
* '''Ramdisk Image''': Specify a [[ramdisk]] to be used (i.e. [[Restore Ramdisk|restore]] or [[Update Ramdisk|update]] ramdisk)
* '''DFU''': Specify what tools to upload based on a selection of "Debug", "Development", or "Release". A specific file can also be selected.

== Restore Operations ==
Restore Operations contains the most options to configure. These may also be the most useful ones.

* '''Hardware Readiness'''
** '''Minimum Battery Charge (mV)''': This value controls the minimum charge level at which the restore will be allowed to continue. Below this threshold, we either wait to charge (if we're charging) or fail (if we're not charging). If this option is not specified, a default value is used (currently 3.8V). Setting this option to 0 bypasses all battery level checks.
** '''Wait for Minimum Charge''': If the current voltage is below the minimum level, then the default behavior is to let the device charge and then continue. This option overrides that behavior when false.
** '''Wait for Storage Device''': Controls whether the restore waits for the storage device /dev/disk0 to be available before the restore is initiated.
** '''Allow Untethered Restore''': Permit the restore to run untethered (not connected to a host). The result of specifying this option when the restore needs data from the host (for instance, when flashing NOR) is undefined (but probably bad). If this option is specified and the device remains tethered, things should proceed as usual.
* '''Storage Media'''
** '''Use LwVM''': Controls whether the device is formatted for LwVM (if supported).
** '''Repartition''': Controls whether a new partition map is created on the device.
** '''System Partition Size (MiB)''': Specifies the size (in mebibytes) that is desired for the system partition. Because the partition size can only be changed when creating a new partition map, this option is only relevant when used in conjunction with repartition. A size of 0 indicates that the restore library should choose a suitable size for you, based on the specific restore bundle and image being used if possible.
** '''Content Protection Type''': Controls the type of data protection used on the device.
** '''Low-Level Erase''': Do a low level erase (wipe with null or random data) of the entire storage device prior to restoring.
* '''Restore System Partition'''
** '''System Image''': Determines which type of system image to restore, or which file to use for the system image.
** '''Kernel Cache Type''': This option controls the kernel cache that gets installed on the device.
* '''Baseband'''
** '''Update Baseband''': Controls whether the [[baseband]] and baseband bootloader are updated as part of the restore.
** '''Force Update''': The baseband update is skipped when the existing firmware matches the available firmware. In some cases, it is desirable to force the firmware update to occur, regardless of what is currently on there. This option, when set to true, forces the update to be attempted.

== Restore OS ==
Restore OS options allow you to specify the following:
* '''Restore Boot-Args''': Boot-Args used when the Restore OS is loaded. By default those arguments are used: "debug=0x14e serial=3 rd=md0 nand-enable-reformat=1 -progress"
* '''Firmware Type:''' Specify the firmware which should be flashed when restoring. This can either be "Debug", "Factory FA", "Factory SA", "Firmware Development" or "Production".
* '''Boot Image Type:''' Can be "Internal", "User or Internal", "User" or "Update".
* '''Boot Kernel Cache:''' Specify whether the "Production" or "Development" kernel cache should be used.

== Restore Settings ==
By default, PurpleRestore comes with two pre-made restore settings. "Erase Install" and "Update Install". Those restore settings are [[PLIST File Format|plist]] files that define the options PurpleRestore will use when restoring a device.
* '''Erase Install''': Repartition the media and erase all data before restoring. Includes all internal development tools and updates flash and the baseband by default.
* '''Update Install''': Includes all internal development tools and updates flash and the baseband by default.

== Reverse Engineering ==
This specific code is from [[iTunes]] for OS X. It detects if PurpleRestore is running so that it does not interfere with any operations that PurpleRestore is performing.

Off Virt Adr Instruction AT&T Syntax Intel Syntax Comment

+354 003d7808 c70424bc01d700 movl $0x00d701bc, (%esp) mov [esp], 0x00d701bc ; CFSTR("com.apple.PurpleRestore")
+361 003d780f e80c65c3ff calll 0x10000dd20 call 0x10000dd20 ; is specified bundle running
+366 003d7814 84c0 testb %al,%al test al, al
+368 003d7816 7409 jz 0x003d7821 jz short 0x003d7821 ; if so, PurpleRestore is running
+370 003d7818 c704246c8ba400 movl $0x00a48b6c, (%esp) mov [esp], 0x00a48b6c ; so ignore device,
+377 003d781f ebd3 jmp 0x003d77f4 jmp short 0x003d77f4 ; and jump back above loop for next device
+379 003d7821 8d5de0 leal 0xe0(%ebp), %ebx lea ebx, [ebp + 0xe0]
+382 003d7824 895c2404 movl %ebx, 0x04(%esp) mov [esp + 4], ebx

== See Also ==
* [[iTunes]]

[[Category:Software]]

File:PurpleRestoreOptions.png

2013-07-20T13:06:14Z

Iemit737: Listing of the more interesting PurpleRestoreOptions.

Listing of the more interesting PurpleRestoreOptions.

Tatsu Signing Server

2013-07-20T12:53:48Z

Iemit737: Updates to make TSS more informative

The '''Tatsu Signing Server''' ('''TSS''') is a service provided by Apple. Apple provides a list of available services at [http://gs.apple.com/TSS/ gs.apple.com].
There is an Apple internal equivalent, known as Spidercab, running at [http://tatsu-tss-internal.apple.com:80 tatsu-tss-internal.apple.com] which is accessible only within Apple's VPN. Spidercab is used to sign internal/debug builds of iOS, including old versions that are no longer signed on production.

== References ==
* [[TinyUmbrella]]

== External Links ==
* [http://gs.apple.com/TSS/ List of available services]

{{stub|Apple Inc.}}

Tatsu Signing Server

2013-07-20T12:50:15Z

Iemit737: internal tatsu link

The '''Tatsu Signing Server''' ('''TSS''') is a service provided by Apple. Apple provides a list of available services at [http://gs.apple.com/TSS/ gs.apple.com].
There is an Apple internal equivalent, known as Spidercab. The url for this is [http://tatsu-tss-internal.apple.com:80] and is accessible only within Apple's VPN.

== References ==
* [[TinyUmbrella]]

== External Links ==
* [http://gs.apple.com/TSS/ List of available services]

{{stub|Apple Inc.}}

Absinthe

2012-01-21T06:18:41Z

Iemit737: /* Exploit */ ran factcheck.org on my own writing

Absinthe is the [[S5L8940]] userland jailbreak tool for [[N94ap|iPhone 4S]] and [[iPad 2]] on iOS 5.0 (iPhone 4S only), 5.0.1 (9A405) and [[Telluride 9A406 (iPhone 4S)|iOS 5.0.1 build 9A406]] on iPhone 4S. This tool was released on January 20, 2012, and is available in three incarnations:
*A GUI tool with the same name, released by the [[Chronic Dev (team)|Chronic Dev Team]]
*A command-line version by the [[iPhone Dev Team]], in case troubleshooting is required
*A future integration with [[redsn0w]]

==Installation==
The jailbreak packs [[Corona]] for the [[S5L8940]] and the rest of the firmware patches in a regular [[iTunes]] backup and then restores this backup on to the device, which injects the required files. It is then completed by opening a web clip added to the [[SpringBoard|home screen]] by Absinthe that uses an exploit in [[/Applications/MobileSafari.app|Safari]] to install [[Cydia]]. If this doesn't work, for example, because the [[greenpois0n]] website is down due to the number of people attempting to jailbreak, an alternative is to enable a specially crafted VPN connection in the [[/Applications/Preferences.app|Settings]] app.

==Exploit==
{{main|Corona}}

This jailbreak uses the [[Racoon String Format Overflow Exploit]] and [[HFS Heap Overflow]] from [[Corona]] for untether.
The exact exploit to jailbreak the two devices is not known yet, but it is assumed that the web clip loads a page that requires an IPsec VPN connection, which causes the [http://ipsec-tools.sourceforge.net racoon] daemon to start and run the jailbreak payload.

However, some poking reveals some unique means of injection. At some point in the jailbreak process, BackupAgent is intentionally crashed to produce a crash log. The jailbreak payload reads this crash log in order to obtain the memory address of libcopyfile.dylib to continue with the exploit.

[[Category:Hacking Software]]
[[Category:Jailbreaks]]

Absinthe

2012-01-21T06:16:10Z

Iemit737: /* Exploit */ I read the console logs. and was very entertained.

Absinthe is the [[S5L8940]] userland jailbreak tool for [[N94ap|iPhone 4S]] and [[iPad 2]] on iOS 5.0 (iPhone 4S only), 5.0.1 (9A405) and [[Telluride 9A406 (iPhone 4S)|iOS 5.0.1 build 9A406]] on iPhone 4S. This tool was released on January 20, 2012, and is available in three incarnations:
*A GUI tool with the same name, released by the [[Chronic Dev (team)|Chronic Dev Team]]
*A command-line version by the [[iPhone Dev Team]], in case troubleshooting is required
*A future integration with [[redsn0w]]

==Installation==
The jailbreak packs [[Corona]] for the [[S5L8940]] and the rest of the firmware patches in a regular [[iTunes]] backup and then restores this backup on to the device, which injects the required files. It is then completed by opening a web clip added to the [[SpringBoard|home screen]] by Absinthe that uses an exploit in [[/Applications/MobileSafari.app|Safari]] to install [[Cydia]]. If this doesn't work, for example, because the [[greenpois0n]] website is down due to the number of people attempting to jailbreak, an alternative is to enable a specially crafted VPN connection in the [[/Applications/Preferences.app|Settings]] app.

==Exploit==
{{main|Corona}}

This jailbreak uses the [[Racoon String Format Overflow Exploit]] and [[HFS Heap Overflow]] from [[Corona]] for untether.
The exact exploit to jailbreak the two devices is not known yet, but it is assumed that the web clip loads a page that requires an IPsec VPN connection, which causes the [http://ipsec-tools.sourceforge.net racoon] daemon to start and run the jailbreak payload.

However, some poking reveals some unique means of injection. At some point in the jailbreak process, libmobilecopy.dylib and/or MobileBackup are intentionally crashed to produce a crash log. The jailbreak payload reads this crash log in order to obtain memory addresses to continue with the exploit.

[[Category:Hacking Software]]
[[Category:Jailbreaks]]

/Applications/Compass.app

2011-11-22T05:48:30Z

Iemit737: This is not a children's encyclopedia. No need to define magnetometer. And why mess with the style of 3GS, just for fun?

iOS refers to the compass internally as the '''[[wikipedia:magnetometer|magnetometer]]'''. It exists in all iPhones since the [[n88ap|3GS]] and all iPad models. The compass found in the iPhone 3GS is the AKM Semiconductor AKM8973, whereas the iPhone 4 and iPad use the AKM Semiconductor AKM8975. [http://www.asahi-kasei.co.jp/ake/en/technology/angle.html]

Smart Sign

2011-10-09T18:47:44Z

Iemit737: /* Technical Investigation */ duplicate word

== Summary ==
[[Image:SmartSign01.jpg|thumb|Smart Sign icon]]
'''Smart Sign''' is a special app that shows product specs and is installed on the "Smart Sign" iPads inside Apple Stores. This app can’t be exited with the home button. There is a gesture to quit apps on "Smart Sign" [[iPad]]s which is shared on a need to know basis among employees. The gesture does not return you to the home screen but returns you to [[AppleConnect]].

== Technical Investigation==
The app itself is not what disables the home button; it is system-wide and enforced by SpringBoard. The key SBStoreDemoAppLock in com.apple.springboard.plist enables this functionality.
A disassembly of Springboard.app/Springboard reveals that there is no special gesture built in to Springboard to emulate the home button outside of multitasking gestures (if they are enabled on an iPad that was connected to Xcode). However, the app may have a gesture recognizer that performs an "exit(0)" call to quit the app.

Apple sets the key in com.apple.springboard.plist by using a mobile configuration profile installed on the device. The profile is set to prohibit removal of itself.

== External Links ==
* [http://www.cultofmac.com/how-the-smart-sign-ipad-displays-at-your-local-apple-store-actually-work/106160 Cult Of Mac]: How the Smart Sign iPads at Your Local Apple Store Actually Work
* [http://www.idownloadblog.com/2011/07/26/look-apple-smart-sign/ iDownloadBlog]: An Exclusive Look Inside Apple’s Smart Sign

{{stub|Software}}
[[Category:Apple Internal Apps]]

Smart Sign

2011-10-09T18:47:02Z

Iemit737: Separated from the english from the technical

== Summary ==
[[Image:SmartSign01.jpg|thumb|Smart Sign icon]]
'''Smart Sign''' is a special app that shows product specs and is installed on the "Smart Sign" iPads inside Apple Stores. This app can’t be exited with the home button. There is a gesture to quit apps on "Smart Sign" [[iPad]]s which is shared on a need to know basis among employees. The gesture does not return you to the home screen but returns you to [[AppleConnect]].

== Technical Investigation==
The app itself is not what disables the home button; it is system-wide and enforced by SpringBoard. The key SBStoreDemoAppLock in com.apple.springboard.plist enables this functionality.
A disassembly of Springboard.app/Springboard reveals that there is no special gesture built in to Springboard to emulate the home button outside of multitasking gestures (if they are enabled on an iPad that was connected to Xcode). However, the app may have a gesture recognizer that performs an "exit(0)" call to quit the app.

Apple changes sets the key in com.apple.springboard.plist by using a mobile configuration profile installed on the device. The profile is set to prohibit removal of itself.

== External Links ==
* [http://www.cultofmac.com/how-the-smart-sign-ipad-displays-at-your-local-apple-store-actually-work/106160 Cult Of Mac]: How the Smart Sign iPads at Your Local Apple Store Actually Work
* [http://www.idownloadblog.com/2011/07/26/look-apple-smart-sign/ iDownloadBlog]: An Exclusive Look Inside Apple’s Smart Sign

{{stub|Software}}
[[Category:Apple Internal Apps]]

Smart Sign

2011-10-09T18:41:57Z

Iemit737: My findings :)

== Summary ==
[[Image:SmartSign01.jpg|thumb|Smart Sign icon]]
'''Smart Sign''' is a special app that shows product specs and is installed on the "Smart Sign" iPads inside Apple Stores. This app can’t be exited with the home button. There is a gesture to quit apps on "Smart Sign" [[iPad]]s which is shared on a need to know basis among employees. The gesture does not return you to the home screen but returns you to [[AppleConnect]].
The app itself is not what disables the home button; it is system-wide and enforced by SpringBoard. The key SBStoreDemoAppLock in com.apple.springboard.plist enables this functionality. A disassembly of Springboard.app/Springboard reveals that there is no gesture support built in to Springboard to emulate the home button. However, the Smart Sign app may have a gesture recognizer that performs an "exit(0)" call to quit the app.
== External Links ==
* [http://www.cultofmac.com/how-the-smart-sign-ipad-displays-at-your-local-apple-store-actually-work/106160 Cult Of Mac]: How the Smart Sign iPads at Your Local Apple Store Actually Work
* [http://www.idownloadblog.com/2011/07/26/look-apple-smart-sign/ iDownloadBlog]: An Exclusive Look Inside Apple’s Smart Sign

{{stub|Software}}
[[Category:Apple Internal Apps]]

Smart Sign

2011-10-08T19:50:49Z

Iemit737: Went snooping in the apple store.

Leftover Strings

2011-08-24T03:58:54Z

Iemit737: /* lockdownd */ :).. Notice some of the things like Wifi Sync & iphone3,2/iphone4,1 mentioned within. And wifi recovery mode

Apple likes to leave various strings throughout its binaries and libraries in [[iOS]]. You can find them by running <code>strings <binary name></code> on OS X. Some of the more interesting/entertaining ones are posted here.

==[[Kernelcache]]==
===2.1.1===
They like to say "WTF?" in here. The context doesn't exactly suggest they're referring to [[WTF]].
<pre>
[%u.%09u] : %s:%s(): Chip Failure, Smacking WiFi chip! (count = %lu / %lu)
%s: WTF? Timer handler expired and there is no pending command
%s::%s(): super failed to init!
%s::%s(): WTF? The beacon list is NULL
%s::%s(): WTF? Got a BRCM packet but an OUI/SUBTYPE mismatch
%s::%s(): WTF?? Got an event packet!!!
%s::%s(): ACK, there are outstanding commands to process!!!
%s::%s(): WTF, the command wasn't sent, nothing is safe now!
%s::%s(): WTF, there is no pending command
%s::%s(): WTF, the pending command hasn't been sent
%s::%s(): ACK, no free commands left!!!!
AppleMRVL868x: super failed to init!
%s::%s(): Command (%s) Timeout! - invoking hand of god
AppleMRVL868x: WTF? Our Provider isn't an IOSDIOIoCardDevice?
super failed to start provider
</pre>

===3.0===
<pre>
AppleUSBEthernetDevice::%s: super failed
</pre>

===?===
<pre>
console is dead, Jim
</pre>

==[[lockdownd]]==
===4.0===
<pre>
Really!? Can't determine the device name!? Really!?
Invalid ack! Ack. Ack. Ack.
fetch_me_brains
OkilyDokily
Wakey Wakey Buddy!
HOWDY
Suck it, McBain.
Not waking buddy because wireless sync is not allowed right now
Here's to the crazy ones.
Up shit creek. No paddle.
I am ignoring your unlock code. There is nothing you can do about it.
That being said, I am setting the activation state to Unlocked.
Setting the activation state to MismatchedIMEI. Dude, where's your baseband?
Setting the activation state to MismatchedICCID. Put that other SIM back in.
Setting the activation state to MissingSIM. Put that SIM back in, dude.
Setting the activation state to FactoryActivated. Helloq OQC.
Setting the activation state to SoftActivation. Hello AppleCare.
This is some kinda fpga: %s
DisableHactivation
Disabling activation short-circuit because DisableHactivation is set
</pre>

===4.1===
<pre>
Our buddy went away
Our buddy is here!
Might wake my buddy
</pre>

===4.3.3===
<pre>
Timezone shenanigans
dirtied by changing %s
FPGA workaround enabled, no fairplay bringup
iPhone3,2
iPhone4,1
Short circuiting activation state to Activated.
Hmmm, we're missing the post URL but continuing.
Turned airplane mode off since we're unactivated
But allowing simless activation
This host ID is lame
The activation record did not contain the necessary key data thingy
HEY!!!!! %s attempting to get [%s]:[%s]- Use MobileOracle instead of lockdown please!
Gah! Can't create mutable copy
Weird. Missing the pair record.
Must be within a session to enter recovery mode via WiFi
Could not determine whether or not we support WiFi syncing!
Very bad.
</pre>

==Keybagd==
===4.1===
<pre>
Can't load the keybag. tears in rain... Time to die
Oh No! Kernel doesn't like this keybag:0x%08x. System is probably lost.
Huh? can't load the bag. That makes no sense
Doh! Can't rename %s to %s: %s
Gah! Can't remove %s: %s
Out of Memory!!! Dying!...so...cold....
</pre>

==Mobile_obliterator [http://code.google.com/p/chronicdev/wiki/MobileObliterator]==
<pre>
"buffy_summers", "Could not kill the daemons: %d"
begin_fakery
end_fakery
And you will know my name is the Lord when I lay my vengeance upon thee.
</pre>
===4.3.3===
<pre>

lol, wut: %s
Could not find Revocable Storage! Reverting to stupid wipe.
The USB device controller could not be found. It's cool.
Erasing all Image3 firmware images, Firmware is gone?!
</pre>

==BackupAgent==
<pre>
Dealing with a 5.0-5.2 inner manifest. Mistakes were made, but we're going to do our best to recover
Refusing to backup with a 5.0-5.2 inner manifest. You're going to have to throw this out and do it over again, buddy.
*** REFUSING TO BACKUP USING OLD BACKUP SERVICE. INSTALL THE IPHONE SDK 4.0. ***
The safe harbor data for %@ has overstayed its welcome (%@). Mothballing it
We were handed an encrypted backup but we don't have a password. Throwing out this manifest and creating a fresh, unencrypted one
Backup request received from a new backup protocol version. Let's do the versioning dance. Our version: %@
Talking to an old version. Jumping straight to the action and sending files
Ok, that was fun. Really beginning the backup.
Could not flock the restore running file at %@. This restore may be a bit bumpy...
Looks like this is a magic restore. We'll be keeping all your settings intact for this one...
Thanks for the Memories
%s is being feisty. Sending it a SIGKILL
%s decided it didn't want to play well with others and refused to exit. We're going to continue with the backup/restore anyway and hope for the best.
No help is available for BackupAgent at this time. You probably don't need to pass any arguments anyway.
Could not get the mobile user's passwd struct. We'll try %@ just in case, but things will probably go downhill from here.
</pre>

Leftover Strings

2011-08-24T03:15:40Z

Iemit737: /* Mobile_obliterator [http://code.google.com/p/chronicdev/wiki/MobileObliterator] */

Apple likes to leave various strings throughout its binaries and libraries in [[iOS]]. You can find them by running <code>strings <binary name></code> on OS X. Some of the more interesting/entertaining ones are posted here.

==[[Kernelcache]]==
===2.1.1===
They like to say "WTF?" in here. The context doesn't exactly suggest they're referring to [[WTF]].
<pre>
[%u.%09u] : %s:%s(): Chip Failure, Smacking WiFi chip! (count = %lu / %lu)
%s: WTF? Timer handler expired and there is no pending command
%s::%s(): super failed to init!
%s::%s(): WTF? The beacon list is NULL
%s::%s(): WTF? Got a BRCM packet but an OUI/SUBTYPE mismatch
%s::%s(): WTF?? Got an event packet!!!
%s::%s(): ACK, there are outstanding commands to process!!!
%s::%s(): WTF, the command wasn't sent, nothing is safe now!
%s::%s(): WTF, there is no pending command
%s::%s(): WTF, the pending command hasn't been sent
%s::%s(): ACK, no free commands left!!!!
AppleMRVL868x: super failed to init!
%s::%s(): Command (%s) Timeout! - invoking hand of god
AppleMRVL868x: WTF? Our Provider isn't an IOSDIOIoCardDevice?
super failed to start provider
</pre>

===3.0===
<pre>
AppleUSBEthernetDevice::%s: super failed
</pre>

===?===
<pre>
console is dead, Jim
</pre>

==[[lockdownd]]==
===4.0===
<pre>
Really!? Can't determine the device name!? Really!?
Invalid ack! Ack. Ack. Ack.
fetch_me_brains
OkilyDokily
Wakey Wakey Buddy!
HOWDY
Suck it, McBain.
Not waking buddy because wireless sync is not allowed right now
Here's to the crazy ones.
Up shit creek. No paddle.
I am ignoring your unlock code. There is nothing you can do about it.
That being said, I am setting the activation state to Unlocked.
Setting the activation state to MismatchedIMEI. Dude, where's your baseband?
Setting the activation state to MismatchedICCID. Put that other SIM back in.
Setting the activation state to MissingSIM. Put that SIM back in, dude.
Setting the activation state to FactoryActivated. Helloq OQC.
Setting the activation state to SoftActivation. Hello AppleCare.
This is some kinda fpga: %s
DisableHactivation
Disabling activation short-circuit because DisableHactivation is set
</pre>

===4.1===
<pre>
Our buddy went away
Our buddy is here!
Might wake my buddy
</pre>

==Keybagd==
===4.1===
<pre>
Can't load the keybag. tears in rain... Time to die
Oh No! Kernel doesn't like this keybag:0x%08x. System is probably lost.
Huh? can't load the bag. That makes no sense
Doh! Can't rename %s to %s: %s
Gah! Can't remove %s: %s
Out of Memory!!! Dying!...so...cold....
</pre>

==Mobile_obliterator [http://code.google.com/p/chronicdev/wiki/MobileObliterator]==
<pre>
"buffy_summers", "Could not kill the daemons: %d"
begin_fakery
end_fakery
And you will know my name is the Lord when I lay my vengeance upon thee.
</pre>
===4.3.3===
<pre>

lol, wut: %s
Could not find Revocable Storage! Reverting to stupid wipe.
The USB device controller could not be found. It's cool.
Erasing all Image3 firmware images, Firmware is gone?!
</pre>

==BackupAgent==
<pre>
Dealing with a 5.0-5.2 inner manifest. Mistakes were made, but we're going to do our best to recover
Refusing to backup with a 5.0-5.2 inner manifest. You're going to have to throw this out and do it over again, buddy.
*** REFUSING TO BACKUP USING OLD BACKUP SERVICE. INSTALL THE IPHONE SDK 4.0. ***
The safe harbor data for %@ has overstayed its welcome (%@). Mothballing it
We were handed an encrypted backup but we don't have a password. Throwing out this manifest and creating a fresh, unencrypted one
Backup request received from a new backup protocol version. Let's do the versioning dance. Our version: %@
Talking to an old version. Jumping straight to the action and sending files
Ok, that was fun. Really beginning the backup.
Could not flock the restore running file at %@. This restore may be a bit bumpy...
Looks like this is a magic restore. We'll be keeping all your settings intact for this one...
Thanks for the Memories
%s is being feisty. Sending it a SIGKILL
%s decided it didn't want to play well with others and refused to exit. We're going to continue with the backup/restore anyway and hope for the best.
No help is available for BackupAgent at this time. You probably don't need to pass any arguments anyway.
Could not get the mobile user's passwd struct. We'll try %@ just in case, but things will probably go downhill from here.
</pre>

S5L8930

2011-06-13T23:35:10Z

Iemit737: Undo revision 18529 by Whiteshinyapple (Talk), no it's the same

An SoC developed by Apple in-house chip design department. It is currently used in [[k48ap|iPad]], [[N90ap|iPhone 4 GSM model]], [[K66ap|Apple TV 2G]], [[N81ap|iPod touch 4G]], and the [[N92ap|iPhone 4 CDMA model]]. Publicly, Apple refers to this chip as the '''A4'''.

== Exploits ==

=== [[S5L8930 (Bootrom)|Bootrom]] ===
* [[User:Geohot|Geohot]] used a bootrom exploit in [[limera1n]] that does not have publicly released technical details.
* SHAtter

=== [[iBoot]] ===
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

=== [[Kernel]] ===
* [[BPF STX Kernel Write Exploit]] - Works up to [[iOS]] 3.2
* [[IOSurface Kernel Exploit]] - Works up to [[iOS]] 4.0.1 (excluding iOS 3.2.2)
* [[Packet Filter Kernel Exploit]] - Works up to [[iOS]] 4.1
* [[HFS Legacy Volume Name Stack Buffer Overflow]] - Works up to [[iOS]] 4.2.8
* [[ndrv_setspec() Integer Overflow]] - Works up to [[iOS]] 4.3.3

=== [[Userland]] ===
* [[MobileBackup Copy Exploit]] - Works up to [[iOS]] 3.2
* [[Malformed CFF Vulnerability]] - Works up to [[iOS]] 4.0.1 (excluding iOS 3.2.2)

== Boot Chain ==
[[S5L8930 (Bootrom)|Bootrom]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[Firmware|System Software]]

== Specifications ==
* '''CPU''': ARM Cortex-A8
* '''GPU''': PowerVR SGX 535
* '''A/V Playback''': PowerVR VXD
* '''RAM''': 256 MB ([[K66ap|Apple TV 2G]], [[K48ap|iPad]], and [[N81ap|iPod touch 4G]]) or 512 MB ([[N90ap|iPhone 4]])

Aside from the [[N90ap|iPhone 4]]'s additional RAM and an overall higher clock speed, these are the same specifications as the [[S5L8920]] and [[S5L8922]].

== See also ==
* [[S5L8930 (Bootrom)]]

== Links ==
* http://www.apple.com/ipad/specs/
* http://www.brightsideofnews.com/news/2010/1/27/apple-a4-soc-unveiled---its-an-arm-cpu-and-the-gpu!.aspx

User talk:M2m

2011-05-02T02:51:22Z

Iemit737: New page: I <3 how you've posted these wonderful links --~~~~

I <3 how you've posted these wonderful links --[[User:Iemit737|Iemit737]] 02:51, 2 May 2011 (UTC)

Models

2011-04-17T16:07:58Z

Iemit737: S5l8900 bootroms do not use an iBoot nomenclature.

The firmware [[iOS]] runs on various different models of devices. This page is used to give an overview of the different model numbers. For the region please see [[Model Regions]].

NOTE: The first letter may vary between "F," "M," or "P." "F" is used for refurbished units. "M" is used for typical retail units. "P" is used for personalized (engraved) units.

{| border="1" class="wikitable" style="text-align:center;width:auto;table-layout:fixed;border-collapse:collapse;"
! Device Type
! Generation
! Bootrom
! Cellular Radio
! Type
! [[IPSW File Format|IPSW]] Prefix
! Color
! Memory
! Model
|-
! rowspan="19" | [[iPhone]]
| rowspan="3" | iPhone 2G
| rowspan="3" | N/A
| rowspan="3" | {{wp|GSM}}
| rowspan="3" | [[m68ap]]
| rowspan="3" | iPhone1,1
| rowspan="3" | metal
| 4 GB
| MA501
|-
| 8 GB
| MA712
|-
| 16 GB
| MB384
|-
| rowspan="3" | iPhone 3G
| rowspan="3" | N/A
| rowspan="3" | {{wp|GSM}}
| rowspan="3" | [[n82ap]]
| rowspan="3" | iPhone1,2
| rowspan="2" | black
| 8 GB
| MB046, MB489, MB702
|-
| 16 GB
| MB048, MB496, MB704
|-
| white
| 16 GB
| MB499, MB500, MB705
|-
| rowspan="9" | iPhone 3GS
| rowspan="4" | [[iBoot-359.3]]
| rowspan="4" | {{wp|GSM}}
| rowspan="9" | [[n88ap]]
| rowspan="9" | iPhone2,1
| rowspan="2" | black
| 16 GB
| MB715
|-
| 32 GB
| MB717
|-
| rowspan="2" | white
| 16 GB
| MB716
|-
| 32 GB
| MB718
|-
| rowspan="5" | [[iBoot-359.3.2]]
| rowspan="5" | {{wp|GSM}}
| rowspan="3" | black
| 8 GB
| MC555
|-
| 16 GB
| MC131, MC135
|-
| 32 GB
| MC133, MC137
|-
| rowspan="2" | white
| 16 GB
| MC132, MC136
|-
| 32 GB
| MC134, MC138
|-
| rowspan="4" | iPhone 4
| rowspan="2" | [[iBoot-574.4]]
| rowspan="2" | {{wp|GSM}}
| rowspan="2" | [[n90ap]]
| rowspan="2" | iPhone3,1
| rowspan="2" | black
| 16 GB
| MC318, MC603, MC608
|-
| 32 GB
| MC319, MC605, MC610
|-
| rowspan="2" | [[iBoot-574.4]]
| rowspan="2" | {{wp|Code division multiple access|CDMA}}
| rowspan="2" | [[n92ap]]
| rowspan="2" | iPhone3,3
| rowspan="2" | black
| 16 GB
| MC676
|-
| 32 GB
| MC678
|-
! rowspan="12" | [[iPod touch]]
| rowspan="3" | iPod touch 1G
| rowspan="3" | N/A
| rowspan="3" | N/A
| rowspan="3" | [[n45ap]]
| rowspan="3" | iPod1,1
| rowspan="3" | metal
| 8 GB
| MA623
|-
| 16 GB
| MA627
|-
| 32 GB
| MB376
|-
| rowspan="4" | iPod touch 2G
| rowspan="3" | [[iBoot-240.4]]
| rowspan="3" | N/A
| rowspan="4" | [[n72ap]]
| rowspan="4" | iPod2,1
| rowspan="3" | metal
| 8 GB
| MB528
|-
| 16 GB
| MB531
|-
| 32 GB
| MB533
|-
| [[iBoot-240.5.1]]
| N/A
| metal
| 8 GB
| MC086
|-
| rowspan="2" | iPod touch 3G
| rowspan="2" | [[iBoot-359.5]]
| rowspan="2" | N/A
| rowspan="2" | [[n18ap]]
| rowspan="2" | iPod3,1
| rowspan="2" | metal
| 32 GB
| MC008
|-
| 64 GB
| MC011
|-
| rowspan="3" | iPod touch 4G
| rowspan="3" | [[iBoot-574.4]]
| rowspan="3" | N/A
| rowspan="3" | [[n81ap]]
| rowspan="3" | iPod4,1
| rowspan="3" | metal
| 8 GB
| MC540
|-
| 32 GB
| MC544
|-
| 64 GB
| MC547
|-
! rowspan="24" | [[iPad]]
| rowspan="6" | iPad
| rowspan="6" | [[iBoot-574.4]]
| rowspan="3" | N/A
| rowspan="6" | [[k48ap]]
| rowspan="6" | iPad1,1
| rowspan="3" | black
| 16 GB
| MB292
|-
| 32 GB
| MB293
|-
| 64 GB
| MB294
|-
| rowspan="3" | {{wp|GSM}}
| rowspan="3" | black
| 16 GB
| MC349
|-
| 32 GB
| MC496
|-
| 64 GB
| MC497
|-
| rowspan="18" | [[iPad 2]]
| rowspan="18" | [[iBoot-838.3]]
| rowspan="6" | N/A
| rowspan="6" | [[k93ap]]
| rowspan="6" | iPad2,1
| rowspan="3" | black
| 16 GB
| MC769
|-
| 32 GB
| MC980
|-
| 64 GB
| MC916
|-
| rowspan="3" | white
| 16 GB
| MC979
|-
| 32 GB
| MC980
|-
| 64 GB
| MC981
|-
| rowspan="6" | {{wp|GSM}}
| rowspan="6" | [[k94ap]]
| rowspan="6" | iPad2,2
| rowspan="3" | black
| 16 GB
| MC773
|-
| 32 GB
| MC774
|-
| 64 GB
| MC775
|-
| rowspan="3" | white
| 16 GB
| MC982
|-
| 32 GB
| MC983
|-
| 64 GB
| MC984
|-
| rowspan="6" | {{wp|Code division multiple access|CDMA}}
| rowspan="6" | [[k95ap]]
| rowspan="6" | iPad2,3
| rowspan="3" | black
| 16 GB
| MC755
|-
| 32 GB
| MC763
|-
| 64 GB
| MC764
|-
| rowspan="3" | white
| 16GB
| MC985
|-
| 32 GB
| MC986
|-
| 64 GB
| MC987
|-
! [[Apple TV]]
| Apple TV 2G
| [[iBoot-574.4]]
| N/A
| [[k66ap]]
| AppleTV2,1
| black
| 8 GB
| MC572
|}

Unknown: MB719 (probably a 3GS model)

Talk:Copy Protection Overview

2011-04-08T02:22:31Z

Iemit737:

Excellent job, I think this is an important topic that can be well addressed on this wiki. Copy protection contains controversial subject matter; the way I see it, as long as the information here remains academic, this is very much in the spirit of theiphonewiki. --[[User:Geohot|geohot]] 03:49, 11 May 2009 (UTC)

O_o Just opened this page accidentally (don't own an iPhone), and was very sad about that its author writes about '''protecting DRM''' and, probably, doesn't think that soft must be free and that copyright is bad and DRM of course is bad too. Apple fans such Apple fans. But the page is of some interest, yeah. --[[User:VitaliyFilippov|VitaliyFilippov]] 21:58, 7 April 2011 (UTC)
:It's not a case of being an Apple fanboy. Fact is, there's no valid reason to circumvent the DRM on iOS apps. (The only reason I can think of would be for piracy, which we're opposed to.) The App Store DRM is very flexible; you can install apps that you've purchased on every device you own. --[[User:Dialexio|Dialexio]] 23:12, 7 April 2011 (UTC)

One reason I can think of is to un-DRM free (and always free) apps built for 3.1.x. So that way far into the future (or a year, at technology's pace...) you will be able to pick from and run a ton of the apps built for the original iPhone. Probably not legally OK, but no financial loss so legal arguments are null. Kind of. --[[User:Iemit737|Iemit737]] 02:22, 8 April 2011 (UTC)

The iPhone Wiki:Spam

2011-04-06T03:48:45Z

Iemit737:

How do we combat this recent spamming of this wiki? I suggest a possible invite system or similar? --[[User:Srts|Srts]] 02:24, 9 November 2009 (UTC)
:I have already blocked account signup, they must have had this account for a while. --[[User:Geohot|geohot]] 02:29, 9 November 2009 (UTC)
::Well if they don't stop, we can't have account creation disabled forever, defeats the purpose of the wiki. People like him are sad. Great work to all the sysops et all. keeping disruption to a minimal :D --[[User:Srts|Srts]] 02:34, 9 November 2009 (UTC)
:::Yea thanks a lot guys for putting up with this. We'll give a bit of time, and if they continue, we'll figure something out. This kid keep trying to reset my password for hosting and the wiki. Too bad he doesn't have a life. --[[User:Geohot|geohot]] 03:10, 9 November 2009 (UTC)
:::An invite system might not be a bad idea actually [[User:ChronicDev|Will Strafach]] 03:16, 9 November 2009 (UTC)
::::feel free to post their IP addresses, lol --[[User:Posixninja|posixninja]] 04:08, 9 November 2009 (UTC)
::::Well, if you need an extra admin to block them (and delete spam pages), I volunteer. --[[User:Dranfi|Dranfi]]
:::::Congrats, you're an admin --[[User:Geohot|geohot]] 13:22, 9 November 2009 (UTC)

----

How many different IPs are we dealing with? Is it within a specific range? For the time being, it may be possible to blacklist an entire subnet if they are all coming from the same place. But if a botnet is doing this, may be more difficult. Is it possible for MediaWiki to require admin approval of an edit prior to it being commited? Not well versed with MediaWiki administration, just thossing out some ideas. --[[User:Tsuehpsyde|tsuehpsyde]] 17:29, 9 November 2009 (UTC)
:It is not within a specific range. On my wiki, people post almost the exact same stuff as IP's and I get from 64.*.*.* al the way to 96.*.*.* I think it is a botnet --[[User:Balloonhead66|Balloonhead66]] 23:13, 16 March 2011 (UTC)
:We could figure out where they come rom and do the same to them. Secondly, we could create a filter that unless your part of a specific group you cannot do more than this many edits in this amount of time. We could try making a period where the admins have to approve the users. Lastly, we could make it so that in the first 12 hours of a user account that user could not edit pages so it would give time for the sysops to ban the users. [[User:Revolution|Revolution]] 00:02, 10 November 2009 (UTC)
::That might not be a good idea as we could get ou butts sued. --[[User:Balloonhead66|Balloonhead66]]
:::Why don't we just do this apple-style and have a group of moderators approve of every comment, page edit or revision? I would love to be a part of such group.
::::The extension for mediawiki [[mediawikiwiki:Extension:FlaggedRevs|FlaggedRevs]] is 1.14 and above. This wiki is running 1.12 :( --[[User:Balloonhead66|Balloonhead66]] 23:13, 16 March 2011 (UTC)

----

If the ones you refer to as 'they' are the [http://code.google.com/p/pois0nhack pois0nhack] group then 'they' don't really seem to pose much of a threat in my opinion. I agree that for the time being we could impose some kind of 12/24 hr posting limitation (maybe no more than +-300 char changes?), but no more than that since this is, after all, a public wiki. Sorry if I'm intruding on some kind of admin/mod meeting, just figured I should have my say. --[[User:Rekoil|adriaaan]] 00:27, 10 November 2009 (UTC)
:I am in favor of a 12hr limit for new users, but since it's a public wiki, during this time, contributions would have to be approved by sysops. --Untagged
::Personally I think it would be good to have it so that all edits by new users a thrown into a moderation pool, then once a good amount of worthwhile contributions, that user can be "whitelisted".
::Maybe we could extend the Twitter-Service to display more information (i.e. "Main Page (-2,439) http://u.nu/5x2t3 " instead of "Main Page - http://u.nu/5x2t3"). That could allow fast detection (and reversal) of vandalism attempts because large edits by "unknown" would be easy to spot. May also add the username and/or the commit message, but then we'd have to check for anything Twitter might interpret or block. --[[User:CleanAir|CleanAir]] 13:58, 12 November 2009 (UTC)

----

Can we add a Captchure to the logon process? I don't think all these recent spam pages are done manually. --[[User:Http|http]] 06:29, 15 March 2011 (UTC)
:Good idea [[User:Http|http]], add a Captcha to the logon process and the sign up process for some time --[[User:Whiteshinyapple|Whiteshinyapple]] 09:53, 16 March 2011 (UTC).
:Uhm better idea [[User:Http|http]], add a Captcha when making new pages. Having to fill in a captcha at every login seems to be a pain in the ass :/ the only thing the spam is doing is making new pages, (at least as far as i see.) --[[User:IMaximusX|IMaximusX]]
::What I meant was for the registration process (new user), not for every login. Only [[User:Geohot|geohot]] could implement that. --[[User:Http|http]] 17:37, 16 March 2011 (UTC)
::[http://recaptcha.net Recaptcha] might work. I requires 1.8+, but only works on the sign in, edits with a new external link (anon only), and passwork cracking. --[[User:Balloonhead66|Balloonhead66]] 23:13, 16 March 2011 (UTC)
::[[User:http|http]] im pretty sure they already have accounts, :p --[[User:IMaximusX|IMaximusX]]

Does this wiki currently take advantage of IP banning capability or would that just be subverted anyways? --[[User:Iemit737|Iemit737]] 03:48, 6 April 2011 (UTC)

S5L8920

2011-03-14T02:11:18Z

Iemit737: /* Bootrom */

This is the processor used in the [[iPhone 3GS]].

S5L8920 using [http://www.arm.com/products/CPUs/archi-thumb2.html THUMB-2] instruction set as well as ARM and THUMB ones. Binaries included in iOS are compiled for only [[Armv7]] and are not compatible with older CPUs.

== Exploits ==
=== [[iBoot]] ===
* [[iBoot Environment Variable Overflow]] - Works up to [[iOS]] 3.1 beta 3
* [[usb_control_msg(0x21, 2) Exploit]] - Works up to [[iOS]] 3.1.2

=== [[S5L8920 (Bootrom)|Bootrom]] ===
* [[0x24000 Segment Overflow]] - only in [[iBoot-359.3]]
* [[Limera1n Exploit]]

=== [[Kernel]] ===
* [[BPF STX Kernel Write Exploit]] - Works up to [[iOS]] 3.1.3
* [[IOSurface Kernel Exploit]] - Works up to [[iOS]] 4.0.1
* [[Packet Filter Kernel Exploit]] - Works up to [[iOS]] 4.1
* [[HFS Legacy Volume Name Stack Buffer Overflow]] - Works up to [[iOS]] 4.2.1

=== [[Userland]] ===
* [[MobileBackup Copy Exploit]] - Works up to [[iOS]] 3.1.3
* [[Malformed CFF Vulnerability]] - Works up to [[iOS]] 4.0.1

== Boot Chain ==
[[S5L8920 (Bootrom)|Bootrom]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[Firmware|System Software]]

== See also ==
* [[S5L8920 (Bootrom)]]
* [[S5L8920 (Hardware)]]
* [[S5L8920 (Hardware - Quick Notes)]]

==External Links==
* [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0344j/DDI0344J_cortex_a8_r3p2_trm.pdf Technical Reference Manual: Cortex A8]

Talk:IPad 2 State of Jailbreak

2011-03-14T02:07:05Z

Iemit737:

Is there really a need for an independent page? Why not use current events page like we have in the past? --[[User:JacobVengeance|JakeAnthraX]] 22:22, 13 March 2011 (UTC)

Seems like the jailbreak gods have already accomplished both of these tasks. Time to delete this page. :). --[[User:Iemit737|Iemit737]] 02:07, 14 March 2011 (UTC)

IBoot (Bootloader)

2011-03-13T01:42:47Z

Iemit737: /* Revisions */ ipad 2 iBoot

{{DISPLAYTITLE:iBoot (Bootloader)}}
This is Apple's stage 2 bootloader for all of the iDevices. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

==[[Bootrom]]==
The bootrom also goes by the name "iBoot." The list of bootroms can be found on [[Bootrom|their own page]].

== Revisions ==
* [[iBoot-99]] (1A420 a.k.a. Prototype)
* [[iBoot-159]] (1.0.x)
* [[iBoot-204]] (1.1 and 1.1.1 Build 3A109a)
* [[iBoot-204.0.2]] (1.1.1 Build 3A110a)
* [[iBoot-204.2.9]] (1.1.2)
* [[iBoot-204.3.14]] (1.1.3 and 1.1.4)
* [[iBoot-204.3.16]] (1.1.5)
* [[iBoot-320.20]] (2.0.x)
* [[iBoot-385.22]] (2.1 and 2.1.1)
* [[iBoot-385.49]] (2.2 and 2.2.1)
* [[iBoot-596.24]] (3.0 and 3.0.1)
* [[iBoot-636.65]] (3.1)
* [[iBoot-636.66]] (3.1.1 and 3.1.2)
* [[iBoot-636.66.33]] (3.1.3)
* [[iBoot-817.28]] (3.2)
* [[iBoot-817.29]] (3.2.1 and 3.2.2)
* [[iBoot-872]] (4.0 Beta 1)
* [[iBoot-889.3]] (4.0 Beta 2)
* [[iBoot-889.12]] (4.0 Beta 3)
* [[iBoot-889.19]] (4.0 Beta 4)
* [[iBoot-889.24]] (4.0.x)
* [[iBoot-931.18.1]] (4.1 Beta 1)
* [[iBoot-931.18.27]] (4.1 Builds 8B117 and 8B118)
* [[iBoot-931.44.21]] (4.1 Build 8M89)
* [[iBoot-931.67]] (4.2 Beta 1)
* [[iBoot-931.71.13]] (4.2 Beta 3)
* [[iBoot-931.71.16]] (4.2 GM and 4.2.1 Builds 8C148, 8C148a, and 8C154)
* [[iBoot-931.72.14]] (4.2.5 and 4.2.6)
* [[iBoot-1072.33~1]] (4.3 Beta 1)
* [[iBoot-1072.49]] (4.3 Beta 3)
* [[iBoot-1072.59]] (4.3 Build 8F191)

==Commands used as an exploit vector==
* '''diags''': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* '''arm7_go''': For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

==OpeniBoot==
There is an open source version of iBoot being made so that Linux on the iPhone will work. You can check out the source [http://github.com/planetbeing/iphonelinux/tree/master/openiboot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.

==Remappings==
// n88 (3GS)
0x4FF00000 => 0x0
0x40000000 => 0xC0000000

== See also ==
* [[iBoot (Enums)]]

Talk:SHSH

2011-02-15T00:46:19Z

Iemit737: /* 3.1.x for iPod touch 2G */

== iDevices affected ==

Just to make sure (I don't have these devices): The [[N82ap|iPhone 3G]] (even the newer MC model) and the [[N72ap|iPod Touch 2nd generation]] (also newer models) don't have shsh checks. (I'm not talking about the new "soft" check.) Can someone confirm this? I always thought these mentioned newer devices also have this certificate check in the [[Bootrom]] built-in. But as someone removed my listed 3G (with a question mark), I assume no [[N82ap|3G]] has this check. What is actually the difference between the old and the new [[Bootrom]] then? Maybe someone can explain how this certificate check works exactly and which software part is doing it. Thanks. -- [[User:Http|http]] 11:25, 20 July 2010 (UTC)
:There's definitely no SHSH checking in the [[N82ap|iPhone 3G]] bootrom. If I'm not mistaken, its bootrom can't even read IMG3 files.

:I'm pretty sure the iPod touch 2G bootrom ''does'' check SHSHs, but only the one supplied in the IPSW; its restore process doesn't require getting a new SHSH from Apple's server. --[[User:Dialexio|Dialexio]] 20:08, 20 July 2010 (UTC)

== Firmware 3.1(.1) ==

What's the difference between 3.1 and 3.1.1? Were both released at the same time? Or is 3.1 just a "short form" for 3.1.1? If yes, we should always write the full name. -- [[User:Http|http]] 21:58, 20 July 2010 (UTC)
:3.1 was released for iPhones, while 3.1.1 was released for iPod touches. Other than that (and the build numbers), they're basically the same thing. --[[User:Dialexio|Dialexio]] 23:25, 20 July 2010 (UTC)

== Apple still signing 4.0.1 -- conspiracy? ==

It seems very un-apple for them to continue signing this firmware. Does anyone have any technical reasons/guesses as to why they are doing this?

I think it's sort of a truce -- in fear of yet another security problem being exploited and requiring a 4.0.3, and possibly de-incentivize the search for exploits. Possibly even more far fetched is an experiment to see if there is a boost in sales of people trying to get jailbreakable devices. Anyone have ideas? [[User:Iemit737|Iemit737]] 17:50, 15 August 2010 (UTC)

:My guess is that because many users upgrade without thinking or saving shsh try to jailbreak at some point in time. Because very many users did a jailbreak by this simple page, Apple would create lots of unsatisfied users. After Antennagate having more unsatisfied users, or those returning their device just to try again wouldn't be good for Apple. Also, I think 4.1 will be released soon (less than a month probably), so they can close signing then. -- [[User:Http|http]] 18:56, 15 August 2010 (UTC)

Good point -- lots of first time jail breakers and possible device returns and otherwise angry people. It still seems very unorthodox for them, being the evil iEmpire and all. I can't wait to see what exploits will be uncovered in 4.1. [[User:Iemit737|Iemit737]] 20:43, 15 August 2010 (UTC)

:It seems like Apple continues signing for the previously-issued firmware if the update is of a hotfix nature. (Remember that 3.0.1 was a hotfix for an SMS character vulnerability, and Apple continued signing for both 3.0 and 3.0.1 until 3.1 came along.) The only reason I can think of is they probably rushed the fix out of the door without testing thoroughly, so perhaps their attitude is "we tested this but not rigorously, so feel free to downgrade if it botches something up?" --[[User:Dialexio|Dialexio]] 21:13, 15 August 2010 (UTC)

==4.1 - Apple signing now?==
I believe they are signing the 4.1 GM seed and it does not have expirations or UDID restrictions, and works with windows iTunes, no? Which means if the final ipsw is the same, they will have been signing it since September 1. Albeit the GM is still considered apple confidential... But at the same time they are surely signing some kind of 4.1 for foxconn to put on touch 4G's... [[User:Iemit737|Iemit737]] 19:39, 4 September 2010 (UTC)

:Yes, they are probably signing 4.1 already, but we cannot confirm that, as we don't have any ipt4 yet and d/l of 4.1 is not possible for any other device yet. That's why I've put the product release date as start date. Regarding GM and final: even if the code is the same, it's probably a different ipsw and therefore a different shsh required. I don't know how beta signing works in detail. -- [[User:Http|http]] 22:06, 4 September 2010 (UTC)

::They're signing 4.1 GM. Just make sure to backup your SHSHs. --[[User:desertsn0w|desertsn0w]] 22:48, 4 September 2010 (UTC)

== Soft-SHSH checks ==

Since iTunes 9.2 (I think) SHSH are checked for iPhones 3G also, but only through iTunes, not by the phone's [[bootrom]]. iTunes 9.2 (I think) was the version that was introduced together with iOS 4.0. But I have a report that iOS 3.1.3 can be installed with iTunes 10. I don't know what his hosts file looks like, but he cannot have SHSH backup on Cydia, because those were issued only since iOS 4.0 (correct?). Does this mean that iTunes checks SHSH only if firmware is >= 4.0? If yes, this would mean that you could downgrade a 3G to any pre-4.0 firmware without using redsn0w. -- [[User:Http|http]] 18:40, 19 October 2010 (UTC)
:These were introduced at the same time as [[iOS] 4.0. I believe they kernel checks they are present and valid. If i'm correct this may mean system's like [[PwnageTool]] can patch out the checks. --[[User:GreySyntax|GreySyntax]] 19:13, 19 October 2010 (UTC)
::So the new SHSH checks are done by the kernel since iOS 4.0! I always thought it was done by iTunes. Reading the blog of the [[iPhone Dev Team]] again seems to confirm that. Aha. -- [[User:Http|http]] 19:44, 19 October 2010 (UTC)

== iOS 4.2 SHSH for Apple TV ==
As I see iOS 4.2 for Apple TV is still signed. I could save the SHSH of my new Apple TV 2G and I can restore it without any SHSH blobs from Saurik or TinyUmbrella to iOS 4.2. {{unsigned|Christoph|9:05, January 7, 2011}}
:Puzzling, maybe they are still signed, but Apple doesn't require them for restore... --[[User:Balloonhead66|Balloonhead66]] 23:18, 7 January 2011 (UTC)

== 3.1.x for iPod touch 2G ==

I need someone with an [[n72ap|iPod touch 2G]] ([[iBoot-240.4|old bootrom]]) to verify this... I believe Apple actually introduced soft SHSH checks with iOS 3.1.1 for the iPod touch 2G. Further evidence includes my inability to restore to iOS 3.1.1 and 3.1.2 (unless I use SHSHs that I apparently saved, or a custom IPSW), and iTunes says it will verify the restore with Apple. I know that Apple was still signing iOS 3.1.1 and 3.1.2 when they released iOS 3.1.3, though. Is anyone able to back up my info? '''Do not respond with "No, Apple introduced the SHSH check with 4.0" unless you have tested this yourself.''' --[[User:Dialexio|Dialexio]] 01:55, 14 February 2011 (UTC)

: I had thought there was something weird going on with this. I was guessing that iTunes phone'd home to Apple to see if the firmware was acceptable/current/safe before restoring it [provided the IPSW has the right tags to indicate it is a production firmware]. I think, but it is probably wrong, that when you point the your hosts file to Saurik he mimicks the response that the firmware is acceptable but does not actually give hashes for it. On the other hand I'm probably totally wrong because I remember tinyumbrella let you save hashes for 3.1.x. [[User:Iemit737|Iemit737]] 00:46, 15 February 2011 (UTC)

NOR

2011-02-14T00:01:39Z

Iemit737: being ultra picky technical. :)

NOR typically refers to the NOR flash chip the application processor boots from. The baseband also uses a NOR flash.

==How to Access==
This can be accessed using a patched iBoot or a kernel hack. It can possibly be dumped using /dev/kmem

==Memory Map==
hope I did this right heh

<table border=1 width=100%>
<tr>
<td width=50%><center>Offset</center></td>
<td width=50%><center>Description</center></td>
</tr>
<tr>
<td width=50%><center>0x0</center></td>
<td width=50%><center>Configuration Data 
'''0x0''': "2GMI" fourcc 
'''0x4''': Block Size (0x40) 
'''0x8''': Images Section Location Offset 
'''0xC''': Images Section Location (In blocks) 
'''0x10''': Images Section Length 
'''0x30''': Checksum of this config data </center></td>
</tr>
<tr>
<td width=50%><center>0x4000</center></td>
<td width=50%><center>[[NOR (SysCfg)|SysCfg]] Section</center></td>
</tr>
<tr>
<td width=50%><center>0x8000</center></td>
<td width=50%><center>[[NOR (Firmware Images)|Images]] Section</center></td>
</tr>
<tr>
<td width=50%><center>0xFC000</center></td>
<td width=50%><center>[[NOR (NVRAM)|NVRAM]] Section</center></td>
</tr>
<tr>
<td width=50%><center>0xFE000</center></td>
<td width=50%><center>[[NOR (NVRAM)|NVRAM]] Section (copy)</center></td>
</tr>
</table>

==Hardware==
* [[M68ap|iPhone]] -- some CFI compliant parallel nor
* [[N82ap|iPhone 3G]] -- 1MB SPI NOR flash
* [[N18ap|iPod touch 3G]] and beyond -- The NOR is replaced with a dedicated partition of NAND

Jailbreak (S5L8920+)

2011-02-13T05:04:30Z

Iemit737: /* Apple TV 2G */

When the [[N88ap|iPhone 3GS]] was initially released, Apple did not have enough time to fix the [[0x24000 Segment Overflow]] in the [[S5L8920 (Bootrom)|S5L8920]]. However, in order to flash an exploited [[LLB]] and jailbreak the iPhone 3GS, '''one''' of the following needs to be done:
* Find a new [[iBoot]] exploit every time a new firmware is out.
* Find a way to bypass the [[ECID]] checks.
* Use a bootrom exploit that allows unsigned code execution via USB (2 of them were finally found by Geohot and Chronic Dev Team).

This also applies to the iPhone 3GS with [[iBoot-359.3.2|the new bootrom]], [[N18ap|iPod touch 3G]] and later devices, except a bootrom exploit for the normal boot-chain or a library based jailbreak payload (similar to [[Star]]) is needed as well.

==ECID==
Apple added a new tag to the [[IMG3 File Format]] called ECID. The ECID is ''unique'' to each phone, and its signature is being checked. With this method, Apple attempts to block downgrades once newer firmware becomes available, unless you have a dump of your old firmware's unique IMG3 or signed certificate. Therefore, iBoot exploits won't be so useful for tethered jailbreaks, because such exploits will be closed in new firmwares. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html].

The issue with this is that, even with the [[0x24000 Segment Overflow]] still in bootrom, an [[iBoot]] exploit was still needed to actually flash the exploited [[LLB]]. Apple uses this ECID stuff to block downgrading iBoot to a vulnerable version. It was resolved when Geohot released his [[limera1n]] tool, which used a bootrom exploit to upload an unsigned iBoot. Still the problem remains with newer devices with [[0x24000 Segment Overflow|0x24000]] fixed - tampering with firmware makes such jailbreak tethered unless some other exploit is used.

There are methods to help keep your downgrading ability, though.

* If it was cached prior to 3.1's release, 3GS owners were able save a file which contains the signature of the 3.0 [[iBSS]] containing their [[ECID]], using the [http://purplera1n.com/ purplera1n website]. A tool has not been created to incorporate this file into a fully signed iBSS, however.
* Saurik's servers are actively caching the necessary files. [http://www.saurik.com/id/12#howto Instructions] to use the servers are included.
* The [[SHSH]] associated with an ECID can be also saved by running [[TinyUmbrella]]. [[TinyUmbrella]] allows the user to restore to whatever version is associated with that [[SHSH]] file permanently. This is based on the aforementioned service [[Saurik]] provides remotely from [[Cydia Server|his server(s)]].

==Jailbreak tools ==
===[[K66ap |Apple TV 2G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2
|style="width:100px;"| 4.2.1
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{partial|no package management GUI}}
| {{no}}
| {{yes}}
|-
| [[PwnageTool]]
| {{partial|no package management GUI}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
|-
| [[Seas0nPass]]
| {{no}}
| {{no}}
| {{yes|Yes1}}
|}
1 [[Tethered jailbreak]].

===[[K48ap|iPad]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.2
|style="width:100px;"| 3.2.1
|style="width:100px;"| 3.2.2
|style="width:150px;"| 4.2.1
|-
| [[Spirit]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{yes|RC4 and earlier}}
| {{yes|RC5}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
| {{yes|0.9.6rc81 or 0.9.7b61 2}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{yes|4.1-4.1.3}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

===[[N88ap|iPhone 3GS]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="10"| Works with [[firmware]]...
|-
|style="width:90px;"| 3.0
|style="width:90px;"| 3.0.1
|style="width:90px;"| 3.1
|style="width:90px;"| 3.1.2
|style="width:90px;"| 3.1.3
|style="width:90px;"| 4.0
|style="width:90px;"| 4.0.1
|style="width:90px;"| 4.0.2
|style="width:90px;"| 4.1
|style="width:90px;"| 4.2.1
|-
| [[purplera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.8}}
| {{yes|0.8}}
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
| {{yes|0.9.6rc81}}
|-
| [[blackra1n]]
| {{no}}
| {{no}}
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Spirit]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{partial|Restore from a custom firmware2}}
| {{yes|3.1.42}}
|colspan="2" {{partial|Restore from a custom firmware2}}
|colspan="2" {{partial|Restore from a custom firmware with unofficial firmware bundle2}}
| {{yes|4.1-4.1.3}}
| {{yes|4.1.31 3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{partial|1.42 or 2.0.21 2}}
| {{partial|1.5.12 or 2.0.21 2}}
| {{partial|1.71 2 or 2.0.21 2}}
|colspan="2" {{partial|2.0.21 2}}
| {{yes|2.1}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4 and earlier}}
| {{yes|RC5}}
|}
1 [[Tethered jailbreak]] on devices with the [[iBoot-359.3.2|new bootrom]].

2 Only applicable for devices with the [[iBoot-359.3|old bootrom]]. Requires the device to have signature checks disabled (pwned).

3 Requires an unofficial firmware bundle.

===[[N90ap|iPhone 4]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="5"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.1
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4 and earlier}}
| {{yes|RC5}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
| {{yes|0.9.6rc81 or 0.9.7b61 2}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1-4.1.3}}
| {{partial|With unofficial firmware bundle1}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

===[[N18ap|iPod touch 3G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="7"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.1.1
|style="width:100px;"| 3.1.2
|style="width:100px;"| 3.1.3
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|-
| [[blackra1n]]
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
| {{yes|0.9.6rc81}}
|-
| [[Spirit]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.0.21}}
| {{partial|2.0.21}}
| {{partial|1.71 or 2.0.21}}
| {{partial|2.0.21}}
| {{yes|2.1}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4 and earlier}}
| {{yes|RC5}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1-4.1.3}}
| {{partial|With unofficial firmware bundle1}}
|}
1 [[Tethered jailbreak]].

===[[N81ap |iPod touch 4G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (both builds)
|style="width:100px;"| 4.2.1
|-
| [[redsn0w]]
| {{yes|0.9.4b2}}
| {{yes|0.9.6rc81 or 0.9.7b61 2}}
|-
| [[limera1n]]
| {{yes}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{yes|RC4 and earlier}}
| {{yes|RC5}}
|-
| [[PwnageTool]]
| {{yes|4.1-4.1.3}}
| {{partial|With unofficial firmware bundle1}}
|-
| [[sn0wbreeze]]
| {{yes|2.1}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

Firmware

2011-02-13T05:03:08Z

Iemit737: Greenpois0n RC6

Latest Apple download links can be found [http://www.itunes.com/version here].

==[[Apple TV]]==
===[[K66ap|Apple TV (2nd generation)]]===
'''NOTE:''' The version in parentheses is what the Apple TV reports on TV.
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="70"| Version
!width="120"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.1 (4.0)
| [[Mojave 8M89 (Apple TV 2G)|Mojave 8M89]]
| [http://appldnld.apple.com/AppleTV/061-8940.20100926.Tvtnz/AppleTV2,1_4.1_8M89_Restore.ipsw AppleTV2,1_4.1_8M89_Restore.ipsw]
| <code>68647d6ce163fc20891ca5bcff647c8eecc2b8d9</code>
| Initial shipment.
| {{yes}}
| 253,759,976
|-
| 4.2 (4.1)
| [[jasper 8C150 (Apple TV 2G)|Jasper 8C150]]
| [http://appldnld.apple.com/AppleTV/061-8747.20101122.Vgtr5/AppleTV2,1_4.2_8C150_Restore.ipsw AppleTV2,1_4.2_8C150_Restore.ipsw]
| <code>58f9ab479783dad3dff3834452abc2917aaef2a5</code>
|
| {{no}}
| 279,991,056
|-
| 4.2.1 (4.1.1)
| [[jasper 8C154 (Apple TV 2G)|Jasper 8C154]]
| [http://appldnld.apple.com/AppleTV/061-9978.20101214.gmabr/AppleTV2,1_4.2.1_8C154_Restore.ipsw AppleTV2,1_4.2.1_8C154_Restore.ipsw]
| <code>c2b1adea595afa2b9caf633f0a820d3b66424dbf</code>
|
| {{yes}}
| 280,052,510
|}

1 [[Tethered jailbreak]] only.

==[[iPad]]==
===[[K48ap|iPad (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPad Firmware Versions|Baseband]] (3G only)
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 3.2
| [[Wildcat 7B367 (iPad)|Wildcat 7B367]]
|rowspan="3" | [[6.15.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPad/061-7987.20100403.mjiTr/iPad1,1_3.2_7B367_Restore.ipsw iPad1,1_3.2_7B367_Restore.ipsw]
| <code>172e8297af74b91971a802e6ad137c891f553099</code>
| Initial shipment.
| {{yes}}
| 478,959,325
|-
| 3.2.1
| [[Wildcat 7B405 (iPad)|Wildcat 7B405]]
| [http://appldnld.apple.com/iPad/061-8282.20100713.vgtgh/iPad1,1_3.2.1_7B405_Restore.ipsw iPad1,1_3.2.1_7B405_Restore.ipsw]
| <code>de0a2b64cd335d48fb4abc9ed8700f5dbdf768ca</code>
|
| {{yes}}
| 479,012,625
|-
| 3.2.2
| [[Wildcat 7B500 (iPad)|Wildcat 7B500]]
| [http://appldnld.apple.com/iPad/061-8801.20100811.CvfR5/iPad1,1_3.2.2_7B500_Restore.ipsw iPad1,1_3.2.2_7B500_Restore.ipsw]
| <code>68b613f78581d36eab96aa5a007001dff142baa3</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 479,001,595
|-
| 4.2.1
| [[Jasper 8C148 (iPad)|Jasper 8C148]]
| [[7.10.00]]
| [http://appldnld.apple.com/iPad/061-9857.20101122.VGthy/iPad1,1_4.2.1_8C148_Restore.ipsw iPad1,1_4.2.1_8C148_Restore.ipsw]
| <code>8717b3bedc925b587566442ad375aa65d857e79a</code>
|
| {{yes}}
| 578,084,840
|}

1 [[Tethered jailbreak]] only.

==[[iPhone]]==
===[[M68ap|iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband Firmware]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="91"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{no}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| Heavenly 1A543a
| 03.11.02_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| Heavenly 1C25
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| Heavenly 1C28
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| Snowbird 3A109a
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| Oktoberfest 3B48b
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| Little Bear 4A93
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| Little Bear 4A102
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| [[Big Bear 5A347 (iPhone)|Big Bear 5A347]]
|rowspan="11"| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
|rowspan="11" {{yes|[[BootNeuter]]}}
| 228,768,637
|-
| 2.0.1
| [[Big Bear 5B108 (iPhone)|Big Bear 5B108]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| 254,048,068
|-
| 2.0.2
| [[Big Bear 5C1 (iPhone)|Big Bear 5C1]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| 253,589,000
|-
| 2.1
| [[Sugar Bowl 5F136 (iPhone)|Sugar Bowl 5F136]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| 242,171,241
|-
| 2.2
| [[Timberline 5G77 (iPhone)|Timberline 5G77]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| 257,576,980
|-
| 2.2.1
| [[SUTimberline 5H11 (iPhone)|SUTimberline 5H11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| 252,536,460
|-
| 3.1.2
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code>
|
| {{yes}}
| 252,515,888
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone)|SUNorthstarTwo 7E18]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7481.20100202.4orot/iPhone1,1_3.1.3_7E18_Restore.ipsw iPhone1,1_3.1.3_7E18_Restore.ipsw]
| <code>eab23a7f8d2a17cb71046c50fc5f67ec390a3c2b</code>
|
| {{yes}}
| 238,319,275
|}

===[[N82ap|iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="90"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 2.0
| [[Big Bear 5A345 (iPhone 3G)|Big Bear 5A345]]
|rowspan="2" | [[1.45.00]]
| No download available
|
| Initial shipment.
| {{yes}}
|rowspan="5" {{partial|Upgrade to 2.2}}
|
|-
| 2.0
| [[Big Bear 5A347 (iPhone 3G)|Big Bear 5A347]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| 235,957,125
|-
| 2.0.1
| [[Big Bear 5B108 (iPhone 3G)|Big Bear 5B108]]
| [[1.48.02]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| 261,224,227
|-
| 2.0.2
| [[Big Bear 5C1 (iPhone 3G)|Big Bear 5C1]]
| [[2.08.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| 260,761,030
|-
| 2.1
| [[Sugar Bowl 5F136 (iPhone 3G)|Sugar Bowl 5F136]]
| [[2.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| 249,341,655
|-
| 2.2
| [[Timberline 5G77 (iPhone 3G)|Timberline 5G77]]
| [[2.28.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|yellowsn0w]]}}
| 258,342,348
|-
| 2.2.1
| [[SUTimberline 5H11 (iPhone 3G)|SUTimberline 5H11]]
| [[2.30.03]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{partial|Upgrade to 3.0}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
|rowspan="2" | [[4.26.08]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
|rowspan="2" {{yes|[[ultrasn0w]]}}
| 241,229,233
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone 3G)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
|rowspan="2" | [[5.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}
| 253,361,339
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| {{yes}}
| 253,340,786
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3G)|SUNorthstarTwo 7E18]]
| [[5.12.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7468.20100202.pbnrt/iPhone1,2_3.1.3_7E18_Restore.ipsw iPhone1,2_3.1.3_7E18_Restore.ipsw]
| <code>f5950afca546f93e281ba3cdb08bc0cfed7f0896</code>
|
| {{yes}}
| {{yes|[[ultrasn0w]]}}
| 239,139,281
|-
| 4.0
| [[Apex 8A293 (iPhone 3G)|Apex 8A293]]
|rowspan="3" | [[5.13.04]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7436.20100621.58Yt4/iPhone1,2_4.0_8A293_Restore.ipsw iPhone1,2_4.0_8A293_Restore.ipsw]
| <code>ee1eba9281b902d7ff3f24d50f9aebff0df27f92</code>
|
| {{yes}}
|rowspan="3" {{yes|[[ultrasn0w]]}}
| 306,274,631
|-
| 4.0.1
| [[Apex 8A306 (iPhone 3G)|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8616.20100715.phnt4/iPhone1,2_4.0.1_8A306_Restore.ipsw iPhone1,2_4.0.1_8A306_Restore.ipsw]
| <code>940bd2b36c646f6673419eab661ac1f13248e592</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| 320,237,975
|-
| 4.0.2
| [[Apex 8A400 (iPhone 3G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8802.20100811.XcfpR/iPhone1,2_4.0.2_8A400_Restore.ipsw iPhone1,2_4.0.2_8A400_Restore.ipsw]
| <code>ee2bc74719170a7a2440b593b6f300727c930c69</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 320,216,794
|-
| 4.1
| [[Baker 8B117 (iPhone 3G)|Baker 8B117]]
| [[5.14.02]]
| [http://appldnld.apple.com/iPhone4/061-7932.20100908.3fgt5/iPhone1,2_4.1_8B117_Restore.ipsw iPhone1,2_4.1_8B117_Restore.ipsw]
|<code>d87bab469dd1146ab83ddcc23f03b3164d7e09d4</code>
|
| {{Yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 323,137,556
|-
|-
| 4.2.1
| [[Jasper 8C148 (iPhone 3G)|Jasper 8C148]]
| [[5.15.04]]
| [http://appldnld.apple.com/iPhone4/061-9853.20101122.Vfgt5/iPhone1,2_4.2.1_8C148_Restore.ipsw iPhone1,2_4.2.1_8C148_Restore.ipsw]
|<code>d2ed58586e8ca2153f2e2ec585bba8afc5173378</code>
|
| {{Yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 338,579,762
|-
|}

===[[N88ap|iPhone 3GS]]===
Units with the new bootrom began shipping around September 2009.

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3|old bootrom]])
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3.2|new bootrom]])
!width="80"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
|rowspan="2" | [[4.26.08]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
|rowspan="2" {{no|[[SHSH]]s unavailable at release}}
|rowspan="2" {{yes|[[ultrasn0w]]}}
| 312,292,933
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone_3GS)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
|rowspan="2" | [[5.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
|
| {{yes}}
| {{yes|Yes1}}
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}
| 321,011,474
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3GS)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code>
|
| {{yes}}
| {{yes}}
| 321,015,700
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|SUNorthstarTwo 7E18]]
| [[5.12.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7472.20100202.8tugj/iPhone2,1_3.1.3_7E18_Restore.ipsw iPhone2,1_3.1.3_7E18_Restore.ipsw]
| <code>8cb3775e62c6f72059a962bf891b4e145b965052</code>
|
| {{yes}}
| {{yes}}
| {{yes|[[ultrasn0w]]}}
| 305,122,343
|-
| 4.0
| [[Apex 8A293 (iPhone 3GS)|Apex 8A293]]
|rowspan="3" | [[5.13.04]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7437.20100621.5urG8/iPhone2,1_4.0_8A293_Restore.ipsw iPhone2,1_4.0_8A293_Restore.ipsw]
| <code>e065245874c73510ceb8fa4bd9388b60d46eb252</code>
|
| {{yes}}
| {{yes}}
|rowspan="3" {{yes|[[ultrasn0w]]}}
| 396,281,280
|-
| 4.0.1
| [[Apex 8A306 (iPhone 3GS)‎|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8618.20100715.Zapn4/iPhone2,1_4.0.1_8A306_Restore.ipsw iPhone2,1_4.0.1_8A306_Restore.ipsw]
| <code>c2b6fb9a158547ce726baa1bf8f0558a71518fec</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| {{yes}}
| 396,322,891
|-
| 4.0.2
| [[Apex 8A400 (iPhone 3GS)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8805.20100811.Dcr4e/iPhone2,1_4.0.2_8A400_Restore.ipsw iPhone2,1_4.0.2_8A400_Restore.ipsw]
| <code>61d21363ced6e006cc226f9a0a0e9c6ed8e048ab</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| {{yes}}
| 396,310,640
|-
| 4.1
| [[Baker 8B117 (iPhone 3GS)|Baker 8B117]]
| [[5.14.02]]
| [http://appldnld.apple.com/iPhone4/061-7938.20100908.F3rCk/iPhone2,1_4.1_8B117_Restore.ipsw iPhone2,1_4.1_8B117_Restore.ipsw]
|<code>2d1657cd33ae23b8d4e79e41fe758d09d3c52e30</code>
|
| {{yes}}
| {{yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 400,572,133
|-
| 4.2.1
| [[Jasper 8C148a (iPhone 3GS)|Jasper 8C148a]]
| [[5.15.04]]
| [http://appldnld.apple.com/iPhone4/061-9895.20101122.Cdew2/iPhone2,1_4.2.1_8C148a_Restore.ipsw iPhone2,1_4.2.1_8C148a_Restore.ipsw]
| <code>2787bb9fbf18594279d05682e6fd16d2b9612a2a</code>
|
| {{yes}}
| {{yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 420,813,164
|}

1 [[Tethered jailbreak]] only.

===[[N90ap|iPhone 4 (GSM model)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[XMM 6180#Known Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]?
!width="95"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 4.0
| [[Apex 8A293 (iPhone 4)|Apex 8A293]]
|rowspan="3" | [[1.59.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7380.20100621,Vfgb5/iPhone3,1_4.0_8A293_Restore.ipsw iPhone3,1_4.0_8A293_Restore.ipsw]
| <code>171c2a3995fa149f2a369ccd87f82c5c30da3f88</code>
| Initial shipment.
| {{yes}}
|rowspan="3" {{Yes|[[ultrasn0w]]}}
| 607,363,121
|-
| 4.0.1
| [[Apex 8A306 (iPhone 4)|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8619.20100715.4Pnsx/iPhone3,1_4.0.1_8A306_Restore.ipsw iPhone3,1_4.0.1_8A306_Restore.ipsw]
| <code>a9cf20679273b7e502ab384854ba96cc2a54d532</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| 607,380,127
|-
| 4.0.2
| [[Apex 8A400 (iPhone 4)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8807.20100811.3Edre/iPhone3,1_4.0.2_8A400_Restore.ipsw iPhone3,1_4.0.2_8A400_Restore.ipsw]
| <code>19eb071cdb9f1601b106825d0a16b1449c6eef8c</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 607,375,880
|-
| 4.1
| [[Baker 8B117 (iPhone 4)|Baker 8B117]]
| [[2.10.04]]
| [http://appldnld.apple.com/iPhone4/061-7939.20100908.Lcyg3/iPhone3,1_4.1_8B117_Restore.ipsw iPhone3,1_4.1_8B117_Restore.ipsw]
|<code>a3f8a333ca181146b862ca6a59c9a6e7c27eba0b</code>
|
| {{yes}}
| {{No}}
| 618,501,195
|-
| 4.2.1
| [[Jasper 8C148 (iPhone 4)|Jasper 8C148]]
| [[3.10.01]]
| [http://appldnld.apple.com/iPhone4/061-9858.20101122.Er456/iPhone3,1_4.2.1_8C148_Restore.ipsw iPhone3,1_4.2.1_8C148_Restore.ipsw]
|<code>366b28e9c95936bd4b11a84d54fefaf079fd6411</code>
|
| {{yes}}
| {{No}}
| 654,550,096
|}

1 [[Tethered jailbreak]] only.

===[[N92ap|iPhone 4 (CDMA model)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| Baseband
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]?
!width="95"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 4.2.6
| [[Phoenix 8E200 (iPhone 4 CDMA)|Phoenix 8E200]]
| [[1.51.00]]
| [http://appldnld.apple.com/iPhone4/041-0177.20110131.Pyvrz/iPhone3,3_4.2.6_8E200_Restore.ipsw iPhone3,3_4.2.6_8E200_Restore.ipsw]
| <code>f32cf46790a473a6c12f9dbd3773bf40fbdf6eee</code>
| Initial Shipment
| {{yes}}
| {{no}}
| 683,594,406
|}

1 [[Tethered jailbreak]] only.

==[[iPod touch]]==
===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 1.1
| Snowbird 3A100a
| No download available
|
| Initial shipment.
| {{no}}
|
|-
| 1.1
| Snowbird 3A101a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{no}}
| 157,890,186
|-
| 1.1.1
| Snowbird 3A110a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| Oktoberfest 3B48b
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| Little Bear 4A93
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| Little Bear 4A102
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| Little Bear 4B1
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| [[Big Bear 5A347 (iPod touch)|Big Bear 5A347]]
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| [[Big Bear 5B108 (iPod touch)|Big Bear 5B108]]
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| [[Big Bear 5C1 (iPod touch)|Big Bear 5C1]]
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| [[Sugar Bowl 5F137 (iPod touch)|Sugar Bowl 5F137]]
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| [[Timberline 5G77 (iPod touch)|Timberline 5G77]]
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| [[SUTimberline 5H11 (iPod touch)|SUTimberline 5H11]]
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch)|Northstar 7C145]]
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch)|Northstar 7D11]]
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| {{yes}}
| 249,780,497
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f897990f19d2f093b35e0813d7d77806404fb1f</code>
|
| {{yes}}
| 235,678,189
|}

===[[N72ap|iPod touch (2nd generation)]]===
Units with the new bootrom have model numbers that start with "MC."

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.4|old bootrom]])
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.5.1|new bootrom]])
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138 (iPod touch 2G)|Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes|Yes1}}
|rowspan="4" {{no|Incompatible device/
firmware match}}
| 282,083,944
|-
| 2.2
| [[Timberline 5G77a (iPod touch 2G)|Timberline 5G77a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{no}}
| 291,123,491
|-
| 2.2.1
| [[SUTimberline 5H11a (iPod touch 2G)|SUTimberline 5H11a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.x is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
| Initial shipment for units with the new bootrom.
| {{yes}}
| {{yes|Yes1}}
| 277,753,989
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 2G)|Northstar 7D11]]
| Download Link Prohibited
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code>
|
| {{yes}}
| {{yes}}
| 277,794,671
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f4f5c01eda2f811f73167e7d1f82dbeed82367b</code>
|
| {{yes}}
| {{yes}}
| 263,275,211
|-
| 4.0
| [[Apex 8A293 (iPod touch 2G)|Apex 8A293]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7435.20100621.tr49t/iPod2,1_4.0_8A293_Restore.ipsw iPod2,1_4.0_8A293_Restore.ipsw]
| <code>c026c373bc535496a6f901de2ba37d4a487413bf</code>
|
| {{yes}}
| {{yes}}
| 330,278,777
|-
| 4.0.2
| [[Apex 8A400 (iPod touch 2G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8551.20100811.Xcder/iPod2,1_4.0.2_8A400_Restore.ipsw iPod2,1_4.0.2_8A400_Restore.ipsw]
| <code>06a42297d94461264eb64d7c8640cc5d1c19edeb</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| {{yes|Yes1}}
| 344,248,876
|-
| 4.1
| [[Baker 8B117 (iPod touch 2G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-7937.20100908.ghj4f/iPod2,1_4.1_8B117_Restore.ipsw iPod2,1_4.1_8B117_Restore.ipsw]
|<code>97abde6207660bd876fd476275dd526d0dcf3d19</code>
|
| {{Yes}}
| {{yes}}
| 348,027,174
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 2G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9855.20101122.Lrft6/iPod2,1_4.2.1_8C148_Restore.ipsw iPod2,1_4.2.1_8C148_Restore.ipsw]
|<code>b9efddc7bb4350c237a8d3846af61bbfc8a2f647</code>
|
| {{yes}}
| {{yes}}
|363,553,480
|}

1 [[Tethered jailbreak]] only.

===[[N18ap|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| {{yes|Yes1}}

| 311,702,789
|-
| 3.1.1
| [[Northstar 7C146 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| {{yes|Yes1}}
| 311,690,768
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code>
|
| {{yes}}
| 311,740,034
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|SUNorthstarTwo 7E18]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7473.20100202.4i44t/iPod3,1_3.1.3_7E18_Restore.ipsw iPod3,1_3.1.3_7E18_Restore.ipsw]
| <code>375fd469b18bfc0b74c7cfa5b4d5945197b1d106</code>
|
| {{yes}}
| 295,870,806
|-
| 4.0
| [[Apex 8A293 (iPod touch 3G)|Apex 8A293]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7381.20100621.AzSP9/iPod3,1_4.0_8A293_Restore.ipsw iPod3,1_4.0_8A293_Restore.ipsw]
| <code>36fe02b83f87d6305db572e1644841e3cd64cc7d</code>
|
| {{yes}}
| 384,178,784
|-
| 4.0.2
| [[Apex 8A400 (iPod touch 3G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8554.20100811.Bgt54/iPod3,1_4.0.2_8A400_Restore.ipsw iPod3,1_4.0.2_8A400_Restore.ipsw]
| <code>481b21044130125b117d53207f725b70fb061855</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 384,203,993
|-
| 4.1
| [[Baker 8B117 (iPod touch 3G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-7941.20100908.sV9KE/iPod3,1_4.1_8B117_Restore.ipsw iPod3,1_4.1_8B117_Restore.ipsw]
|<code>3162bad4060b7a58c9942ddb483e5bd9bcc5269f</code>
|
| {{yes}}
| 388,255,189
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 3G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9860.20101122.Xsde3/iPod3,1_4.2.1_8C148_Restore.ipsw iPod3,1_4.2.1_8C148_Restore.ipsw]
|<code>1127a042c535f7cf0be950ff8946862d5fb05b36</code>
|
| {{yes}}
| 408,118,620
|}

1 [[Tethered jailbreak]] only.

===[[N81ap|iPod touch (4th generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.1
| [[Baker 8B117 (iPod touch 4G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-8490.20100901.hyjtR/iPod4,1_4.1_8B117_Restore.ipsw iPod4,1_4.1_8B117_Restore.ipsw]
| <code>a464492bf6ad25d65b378c85d8b181f973ede38a</code>
| Initial shipment.
| {{yes}}
| 608,360,672
|-
| 4.1
| [[Baker 8B118 (iPod touch 4G)|Baker 8B118]]
| [http://appldnld.apple.com/iPhone4/061-9344.20100922.Urgt43/iPod4,1_4.1_8B118_Restore.ipsw iPod4,1_4.1_8B118_Restore.ipsw]
| <code>331fb1342f5dab8c04cead74384a1e0fc1145952</code>
|
| {{yes}}
| 608,360,927
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 4G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9859.20101122.$erft/iPod4,1_4.2.1_8C148_Restore.ipsw iPod4,1_4.2.1_8C148_Restore.ipsw]
| <code>6a890696126d0cb7f9ccd6b913ecb09cf2029820</code>
|
| {{yes|Yes}}
|638,177,119
|}

1 [[Tethered jailbreak]] only.

==See also==
* [[VFDecrypt]]
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://itunes.com/version Apple Firmware XML]

Talk:N90AP

2011-02-12T03:07:52Z

Iemit737:

Anyone yet have more info on the White iPhone 4? As we have included this on the main page for the N90ap, but AFAIK you can't yet get a (''legal'') version. {{unsigned|DanClarkePro|14:33, 23 November 2010 (UTC)}}

:Hey, my White iPhone 4 is insulted that you called it illegal... --[[User:Iemit737|Iemit737]] 03:07, 12 February 2011 (UTC)

Why dont we put "iPhone 4" as page title instead of "N90AP"? Begginers would find more easily with iPhone 4.
: We don't do this and never have done this. This wiki started out as a technical place, and thus it will use technical names for articles. iPhone 4 already redirects here. --[[User:Iemit737|Iemit737]] 03:07, 12 February 2011 (UTC)

Talk:HFS Legacy Volume Name Stack Buffer Overflow

2011-02-04T21:27:43Z

Iemit737: /* Name */

==Name==
I know pod2g coined this name, but this vulnerability's name is ridiculously long. I'd like to shorten it to "HFS Volume Name Stack Overflow," provided people are OK with the name change. --[[User:Dialexio|Dialexio]] 19:11, 4 February 2011 (UTC)
: I'm kind of playing devil's advocate here but the extreme length is kind of cool to show the intricacy and specificity of the exploit at hand -- and it's nice to preserve the original wording of things... But I suppose it's up to you. --[[User:Iemit737|Iemit737]] 21:27, 4 February 2011 (UTC)