The iPhone Wiki - User contributions [en]

Talk:Apple Internal Apps

2011-05-02T04:23:55Z

JoshH100:

I have written some of the AppleInternal stuff articles like, year ago, but now I have doubts if this should be on the iPhone Wiki. Feels too risky. --[[User:Pjakuszew|rustymercury]] 15:49, 27 April 2011 (UTC)

Hmm, well I do not know. All I can say I do not leak internal information (should be on wikileaks then :-P ) but just adding the information scattered on the internet.--[[User:M2m|M2m]] 15:53, 27 April 2011 (UTC)

Maybe let sysops decide, then. --[[User:Pjakuszew|rustymercury]] 15:56, 27 April 2011 (UTC)

Talking about them is fine. As usual, no posting copyrighted material or links to places that may host these apps. Also, if the knowledge of these apps was acquired illegally(like by robbing an Apple store), don't post it. From what I understand the apps are left on phones by accident, in which case they are fair game. --[[User:Geohot|geohot]] 20:45, 27 April 2011 (UTC)

I think its somehow a grey area. While posting (links to) copyrighted material is clearly an issue, posting information about it is somehow discussable. Example the Gizmodo iPhone4 Prototype got to Gizmodo to some unclear incidents. Some may say it was stolen..... so would talk about information got from Gizmodo then forbidden here ? Do we know how the US T-Mobile 3G iPhone4 Proto got to BGR ? Or are we sure about the whereabouts of the things we get from the Vietnamese Website ? I would think talking is OK when there is not clearly breach of copyright is involved. A (blurry) photo of an app Icon should be OK. If you would know more information then it should be Ok'ed to as long as no copyrighted material is posted. -- {{unsigned|M2m|14:47, 28 April 2011 (UTC)}}

If it's once on the Internet, it isn't secret anymore, so you cannot leak "secret" information this way. I don't know these strange US laws, but I don't see any morally bad thing here. I wouldn't even consider '''any''' type of link here as bad, but as laws and other people think different, I'm enforcing this rule here also. Clearly forbidden is to host copyrighted code here. On the other side: One thing where we should be more careful is copying pictures from other sites into here. Official product pics '''might''' be ok, but not other stuff. I'm not sure about the BGR images. I would still ask them for permission to reproduce them here. I'm sure we get it if we add a link to them or cite where they come from. --[[User:Http|http]] 19:06, 28 April 2011 (UTC)

Linking is technically 'encouraging' copyright infringement...now I wouldn't extend this to things like the official ipsws, but if someone was hosting a custom ipsw I would say don't link to it. I would say an official product image is fair use, or a cropped version of the BGR image to show an app icon, but both should be attributed, not only from a copyright standpoint, but from a completeness of documentation standpoint as well. Oh, and talking about information is never ever a bad thing, unless it violates some contract you have. --[[User:Geohot|geohot]] 09:55, 29 April 2011 (UTC)

Would linking to the internal Apps when hosted in the official Apple Appstore be OK ? I mean like posting http://itunes.apple.com/us/app/idXXXXX ?--[[User:M2m|M2m]] 14:48, 29 April 2011 (UTC)
:If so, I have the download links for SwitchBoard, Directory, Chatterbox, UniBox, Concierge, MobileGenius. --[[User:Fallensn0w|Fallensn0w]] 21:30, 1 May 2011 (UTC)
:: You can find them if you [http://www.google.de/search?hl=de&q=%22Apple+Internal%22+%EF%A3%BF+Chatterbox&aq=f&aqi=&aql=&oq= Google] them :)--[[User:M2m|M2m]] 01:12, 2 May 2011 (UTC)
::: Anyone actually managed to download these? ;-) I've tried to no avail on both my iPhone, MacBook and iPad 2... from home however. Can they be purchased and downloaded via an Apple Store for example? Heh. --[[User:Beau|Beau]] 02:57, 2 May 2011 (UTC)

I've been able to download all of them, but unless you have a apple ID that has access to appleconnect there useless.

N81AP

2011-04-03T02:28:12Z

JoshH100: /* Specifications */

[[Image:iPod touch 4G.png|thumb|right|iPod touch 4G]]
This is the 4th generation [[iPod touch]]. It was announced on September 1st, 2010.

==Application Processor==
It makes use of the [[S5L8930]] application processor.

==Wireless==
The iPod touch 4G uses the [[BCM4329]] for Wi-Fi (802.11 b/g/n) and Bluetooth 2.1.

==New Hardware==
*Front VGA camera for [[FaceTime]]
*Rear 0.93 megapixel camera
*Built-in microphone
*Gyroscope
*Retina Display
*[[S5L8930|A4 processor]]

== Specifications ==
'''Size''': 110.0 mm (4.4 inches) (h), 58.9 mm (2.3 inches) (w), 7.2 mm (0.28 inches) (d) 
'''Weight''': 101 g (3.6 oz) 
'''RAM''': 256MB DRAM 
'''Battery''': 40 hours of audio, 7 of video 
'''Rear camera''': 0.7MP photos, supporting HD video recording @ 30FPS 
'''Front camera''': VGA photos and video @ 30 FPS, supporting [[FaceTime]] video calls

N81AP

2011-04-03T02:27:49Z

JoshH100: /* Specifications */

[[Image:iPod touch 4G.png|thumb|right|iPod touch 4G]]
This is the 4th generation [[iPod touch]]. It was announced on September 1st, 2010.

==Application Processor==
It makes use of the [[S5L8930]] application processor.

==Wireless==
The iPod touch 4G uses the [[BCM4329]] for Wi-Fi (802.11 b/g/n) and Bluetooth 2.1.

==New Hardware==
*Front VGA camera for [[FaceTime]]
*Rear 0.93 megapixel camera
*Built-in microphone
*Gyroscope
*Retina Display
*[[S5L8930|A4 processor]]

== Specifications ==
'''Size''': 110.0 mm (4.4 inches) (h), 58.9 mm (2.3 inches) (w), 7.2 mm (0.28 inches) (d) 
'''Weight''': 101 g (3.6 oz) 
'''RAM''': 256MB DRAM 
'''Battery''': 40 hours of audio, 7 of video 
'''Rear camera''': 0.7MP Photos, supporting HD video recording @ 30FPS 
'''Front camera''': VGA photos and video @ 30 FPS, supporting [[FaceTime]] video calls

Talk:N81AP

2011-04-03T02:26:43Z

JoshH100:

For the sake of simplicity, I am going to assume this is the new iPod touch. We can move it later if The product code is different. [[User:Iemit737|Iemit737]] 00:35, 2 September 2010 (UTC)

I changed it to a .93MP camera because thats what it is even though iOS resizes photos to 4:3.

Talk:N81AP

2011-04-03T02:25:58Z

JoshH100:

For the sake of simplicity, I am going to assume this is the new iPod touch. We can move it later if The product code is different. [[User:Iemit737|Iemit737]] 00:35, 2 September 2010 (UTC)

Talk:N81AP

2011-04-03T02:25:24Z

JoshH100:

For the sake of simplicity, I am going to assume this is the new iPod touch. We can move it later if The product code is different. [[User:Iemit737|Iemit737]] 00:35, 2 September 2010 (UTC)
I changed it to a .93 MP camera because thats what it is, iOS just resizes the photos to 4:3 which makes it the res. of a .7 MP camera.

N81AP

2011-04-03T02:23:49Z

JoshH100: /* New Hardware */

[[Image:iPod touch 4G.png|thumb|right|iPod touch 4G]]
This is the 4th generation [[iPod touch]]. It was announced on September 1st, 2010.

==Application Processor==
It makes use of the [[S5L8930]] application processor.

==Wireless==
The iPod touch 4G uses the [[BCM4329]] for Wi-Fi (802.11 b/g/n) and Bluetooth 2.1.

==New Hardware==
*Front VGA camera for [[FaceTime]]
*Rear 0.93 megapixel camera
*Built-in microphone
*Gyroscope
*Retina Display
*[[S5L8930|A4 processor]]

== Specifications ==
'''Size''': 110.0 mm (4.4 inches) (h), 58.9 mm (2.3 inches) (w), 7.2 mm (0.28 inches) (d) 
'''Weight''': 101 g (3.6 oz) 
'''RAM''': 256MB DRAM 
'''Battery''': 40 hours of audio, 7 of video 
'''Rear camera''': 0.7MP, supporting HD video recording @ 30FPS 
'''Front camera''': VGA photos and video @ 30 FPS, supporting [[FaceTime]] video calls

Bootrom

2011-01-08T22:06:40Z

JoshH100: /* From the iBoot version (iPhone 3G S) */

==Introduction / old+new==
The bootrom (called "SecureROM" by Apple) is the first significant code that runs on an iDevice. The bootrom is read-only. Finding exploits in the bootrom level is a big achievement since Apple won't be able to fix it without a hardware revision.

Certain models, including the [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]], have different bootrom versions. These are most commonly referred to with the terms "old bootrom" and "new bootrom." These "new bootrom" devices were released after [[Timeline#September|9 September 2009]] and have the [[0x24000 Segment Overflow]] fixed. While the new bootrom revisions have an exploit, the exploit needs the assistance of a firmware-based exploit to achieve an [[untethered jailbreak]].

You might also be looking for [[iBoot (Bootloader)|Apple's stage 2 bootloader]], which also uses the "iBoot" name.

==Finding bootrom version==
===From the model number ([[n48ap|iPod Touch 2G]])===
If the second character of your Model Number is "B" (as in "MB533" or "PB533"), your iPod has the old bootrom. If the second character is "C" (as in "MC086" or "PC086"), your iPod has the new bootrom.

===From the serial number ([[n88ap|iPhone 3GS]])===
The third digit of the serial number identifies the year of manufacture (9=2009, 0=2010), while the fourth and the fifth indicate the week. The first "new bootrom" devices are from week 40 of 2009 (??940?????? or higher serials). Any iPhone made after Week 45 of 2009 (??945?????? and higher or ??0???????? serials) has the new bootrom.

===From the iBoot version ([[n88ap|iPhone 3GS]])===
If a '''.2''' (eg. 636.66.2) is behind the [[iBoot (Bootloader)|iBoot Version]] then it contains the Newer iPhone 3GS Bootrom.

===From the DFU Device descriptors (All devices)===
====Windows====
# Connect Device & Enter [[DFU Mode]]
# Open Device Manager, find USB controller, subitem Apple Mobile Device USB Driver
# Right-Click & click Properties
# Go to Details tab & select Device Instance Path in the dropdown box
# The end of the info string will show the bootrom version

====Mac OS X====
# Connect Device & Enter [[DFU Mode]]
# Go to System Profiler, and under the Hardware category, go to USB, and click on Apple Mobile Device (DFU Mode)
# The end of the info string will show the bootrom version

====Linux====
# Install gnome-device-manager and start it
# Connect Device & Enter [[DFU Mode]]
# Search in the left tree-view for USB Device and look at Summary -> Model until it says Apple Mobile Device (DFU Mode)
# If it does go to Properties (next to Summary) and search for usb_device.serial
# The end of the String will show you the bootrom version

== Revisions ==
===[[S5L8720]], used in the [[N72ap|iPod touch 2G]]===
* [[iBoot-240.4]] "old bootrom"
* [[iBoot-240.5.1]] "new bootrom"

===[[S5L8920]], used in the [[N88ap|iPhone 3GS]]===
* [[iBoot-359.3]] "old bootrom"
* [[iBoot-359.3.2]] "new bootrom"

===[[S5L8922]], used in the [[N18ap|iPod touch 3G]]===
* [[iBoot-359.5]]

===[[S5L8930]], used in the [[K48ap|iPad]], [[N90ap|iPhone 4]], [[K66ap|Apple TV 2G]] and [[N81ap|iPod touch 4G]]===
* [[iBoot-574.4]]

Bootrom

2011-01-08T22:06:22Z

JoshH100: /* From the serial number (iPhone 3G S) */

==Introduction / old+new==
The bootrom (called "SecureROM" by Apple) is the first significant code that runs on an iDevice. The bootrom is read-only. Finding exploits in the bootrom level is a big achievement since Apple won't be able to fix it without a hardware revision.

Certain models, including the [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]], have different bootrom versions. These are most commonly referred to with the terms "old bootrom" and "new bootrom." These "new bootrom" devices were released after [[Timeline#September|9 September 2009]] and have the [[0x24000 Segment Overflow]] fixed. While the new bootrom revisions have an exploit, the exploit needs the assistance of a firmware-based exploit to achieve an [[untethered jailbreak]].

You might also be looking for [[iBoot (Bootloader)|Apple's stage 2 bootloader]], which also uses the "iBoot" name.

==Finding bootrom version==
===From the model number ([[n48ap|iPod Touch 2G]])===
If the second character of your Model Number is "B" (as in "MB533" or "PB533"), your iPod has the old bootrom. If the second character is "C" (as in "MC086" or "PC086"), your iPod has the new bootrom.

===From the serial number ([[n88ap|iPhone 3GS]])===
The third digit of the serial number identifies the year of manufacture (9=2009, 0=2010), while the fourth and the fifth indicate the week. The first "new bootrom" devices are from week 40 of 2009 (??940?????? or higher serials). Any iPhone made after Week 45 of 2009 (??945?????? and higher or ??0???????? serials) has the new bootrom.

===From the iBoot version ([[n88ap|iPhone 3G S]])===
If a '''.2''' (eg. 636.66.2) is behind the [[iBoot (Bootloader)|iBoot Version]] then it contains the Newer iPhone 3GS Bootrom.

===From the DFU Device descriptors (All devices)===
====Windows====
# Connect Device & Enter [[DFU Mode]]
# Open Device Manager, find USB controller, subitem Apple Mobile Device USB Driver
# Right-Click & click Properties
# Go to Details tab & select Device Instance Path in the dropdown box
# The end of the info string will show the bootrom version

====Mac OS X====
# Connect Device & Enter [[DFU Mode]]
# Go to System Profiler, and under the Hardware category, go to USB, and click on Apple Mobile Device (DFU Mode)
# The end of the info string will show the bootrom version

====Linux====
# Install gnome-device-manager and start it
# Connect Device & Enter [[DFU Mode]]
# Search in the left tree-view for USB Device and look at Summary -> Model until it says Apple Mobile Device (DFU Mode)
# If it does go to Properties (next to Summary) and search for usb_device.serial
# The end of the String will show you the bootrom version

== Revisions ==
===[[S5L8720]], used in the [[N72ap|iPod touch 2G]]===
* [[iBoot-240.4]] "old bootrom"
* [[iBoot-240.5.1]] "new bootrom"

===[[S5L8920]], used in the [[N88ap|iPhone 3GS]]===
* [[iBoot-359.3]] "old bootrom"
* [[iBoot-359.3.2]] "new bootrom"

===[[S5L8922]], used in the [[N18ap|iPod touch 3G]]===
* [[iBoot-359.5]]

===[[S5L8930]], used in the [[K48ap|iPad]], [[N90ap|iPhone 4]], [[K66ap|Apple TV 2G]] and [[N81ap|iPod touch 4G]]===
* [[iBoot-574.4]]

Bootrom

2011-01-08T22:05:13Z

JoshH100: /* Introduction / old+new */

==Introduction / old+new==
The bootrom (called "SecureROM" by Apple) is the first significant code that runs on an iDevice. The bootrom is read-only. Finding exploits in the bootrom level is a big achievement since Apple won't be able to fix it without a hardware revision.

Certain models, including the [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]], have different bootrom versions. These are most commonly referred to with the terms "old bootrom" and "new bootrom." These "new bootrom" devices were released after [[Timeline#September|9 September 2009]] and have the [[0x24000 Segment Overflow]] fixed. While the new bootrom revisions have an exploit, the exploit needs the assistance of a firmware-based exploit to achieve an [[untethered jailbreak]].

You might also be looking for [[iBoot (Bootloader)|Apple's stage 2 bootloader]], which also uses the "iBoot" name.

==Finding bootrom version==
===From the model number ([[n48ap|iPod Touch 2G]])===
If the second character of your Model Number is "B" (as in "MB533" or "PB533"), your iPod has the old bootrom. If the second character is "C" (as in "MC086" or "PC086"), your iPod has the new bootrom.

===From the serial number ([[n88ap|iPhone 3G S]])===
The third digit of the serial number identifies the year of manufacture (9=2009, 0=2010), while the fourth and the fifth indicate the week. The first "new bootrom" devices are from week 40 of 2009 (??940?????? or higher serials). Any iPhone made after Week 45 of 2009 (??945?????? and higher or ??0???????? serials) has the new bootrom.

===From the iBoot version ([[n88ap|iPhone 3G S]])===
If a '''.2''' (eg. 636.66.2) is behind the [[iBoot (Bootloader)|iBoot Version]] then it contains the Newer iPhone 3GS Bootrom.

===From the DFU Device descriptors (All devices)===
====Windows====
# Connect Device & Enter [[DFU Mode]]
# Open Device Manager, find USB controller, subitem Apple Mobile Device USB Driver
# Right-Click & click Properties
# Go to Details tab & select Device Instance Path in the dropdown box
# The end of the info string will show the bootrom version

====Mac OS X====
# Connect Device & Enter [[DFU Mode]]
# Go to System Profiler, and under the Hardware category, go to USB, and click on Apple Mobile Device (DFU Mode)
# The end of the info string will show the bootrom version

====Linux====
# Install gnome-device-manager and start it
# Connect Device & Enter [[DFU Mode]]
# Search in the left tree-view for USB Device and look at Summary -> Model until it says Apple Mobile Device (DFU Mode)
# If it does go to Properties (next to Summary) and search for usb_device.serial
# The end of the String will show you the bootrom version

== Revisions ==
===[[S5L8720]], used in the [[N72ap|iPod touch 2G]]===
* [[iBoot-240.4]] "old bootrom"
* [[iBoot-240.5.1]] "new bootrom"

===[[S5L8920]], used in the [[N88ap|iPhone 3GS]]===
* [[iBoot-359.3]] "old bootrom"
* [[iBoot-359.3.2]] "new bootrom"

===[[S5L8922]], used in the [[N18ap|iPod touch 3G]]===
* [[iBoot-359.5]]

===[[S5L8930]], used in the [[K48ap|iPad]], [[N90ap|iPhone 4]], [[K66ap|Apple TV 2G]] and [[N81ap|iPod touch 4G]]===
* [[iBoot-574.4]]

S5L8930

2011-01-08T15:17:21Z

JoshH100: /* Exploits */

An SoC developed by Apple in-house chip design department. It is currently used in [[k48ap|iPad]], [[N90ap|iPhone 4]], [[K66ap|Apple TV 2G]], and [[N81ap|iPod touch 4G]]. Publicly, Apple refers to this chip as the '''A4'''.

== Exploits ==

=== [[S5L8930 (Bootrom)|Bootrom]] ===
* [[User:Geohot|Geohot]] used a bootrom exploit in [[limera1n]] that does not have publicly released technical details.
* SHAtter

=== [[iBoot]] ===
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

=== [[Kernel]] ===
* [[BPF STX Kernel Write Exploit]] - Works up to [[iOS]] 3.2
* [[IOSurface Kernel Exploit]] - Works up to [[iOS]] 3.2.1 (and iOS 4.0 and 4.0.1)

=== [[Userland]] ===
* [[MobileBackup Copy Exploit]] - Works up to [[iOS]] 3.2
* [[Malformed CFF Vulnerability]] - Works up to [[iOS]] 3.2.1 (and iOS 4.0 and 4.0.1)

== Boot Chain ==
[[S5L8930 (Bootrom)|Bootrom]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[Firmware|System Software]]

== Specifications ==
* '''CPU''': ARM Cortex-A8
* '''GPU''': PowerVR SGX 535
* '''A/V Playback''': PowerVR VXD
* '''RAM''': 256 MB ([[K66ap|Apple TV 2G]], [[K48ap|iPad]], and [[N81ap|iPod touch 4G]]) or 512 MB ([[N90ap|iPhone 4]])

Aside from the [[N90ap|iPhone 4]]'s additional RAM and an overall higher clock speed, these are the same specifications as the [[S5L8920]] and [[S5L8922]].

== See also ==
* [[S5L8930 (Bootrom)]]

== Links ==
* http://www.apple.com/ipad/specs/
* http://www.brightsideofnews.com/news/2010/1/27/apple-a4-soc-unveiled---its-an-arm-cpu-and-the-gpu!.aspx

Restore Mode

2011-01-08T00:14:25Z

JoshH100:

[[Image:Small_iphone_restore.JPG|thumb|150px|iPhone during iTunes restore.]]
This is the mode the Apple ramdisk enters to restore the iPhone.

There are 7 steps:
# Preparing the iDevice for the restore.
# Check the restore with Apple.
# Preparing the firmware for the restore.
# Preparing the iDevice for the restore.
# Restoring the software.
# Checking the software.
# Restoring the firmware.

The software is the biggest DMG file in the [[IPSW]] and contains all files for the root parition. The firmware is the smaller DMG (update or restore) and contains the files for the [[iBoot]], [[iBSS]], [[iBEC]] etc. and on an [[iPhone]] or [[iPad]] WiFi + 3G it'll also include the baseband.

== Exploits ==
The original jailbreaks were done by booting the phone into restore mode and copying an [[/etc/fstab]] and afcd plist from the user partition. This was done by using the cp iBoot command, a command which had access to the whole filesystem.

== Implementations ==
*[[MobileDevice Library|itunesmobiledevice.dll]]
*[http://lpahome.com/geohot/gshell.rar gshell]

[[Category:Jailbreaks]]
[[Category:Protocols (S5L)]]

Bootrom 240.5.1

2010-10-16T02:32:07Z

JoshH100:

Second revision of the [[S5L8720]] bootrom. Found on [[N72ap|iPod touch 2G]] devices sold after September 9, 2009. Units with this bootrom can be differentiated from those with the [[IBoot-240.4|first bootrom]] by their model number; the new ones' model number begins with "MC."

'''It is not vulnerable to the [[0x24000 Segment Overflow]] exploit'''.

'''It is vulnerable to the [[usb_control_msg(0xA1, 1) Exploit]]'''.