The iPhone Wiki - User contributions [en]

IMG4 File Format

2021-09-28T13:44:44Z

Kritanta: very very minor clarification

The '''IMG4 file format''' is a replacement for the [[IMG3 File Format|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer). It's also used across the entire [[List of Apple Watches| Apple Watch series]], in both the armv7k and arm64_32 processors. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#IMG4_Payload|'''im4p''' files]]), signatures of those files (<code>ApImg4Ticket</code>) and likely some info used in the [[Restore_Process|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is [[/usr/standalone/firmware/sep-firmware.img4]]. Extracting a PersonalizedBundle from /tmp during a restore will also yield complete IMG4 files. The embeddedOS images in the macOS filesystem for the 2016 MacBook Pros also have complete IMG4 files.

== Structure ==
Contrary to the [[IMG3 File Format|IMG3 file format]] where a custom binary format was used, IMG4 files (and their payloads) are [[wikipedia:X.690#DER encoding|DER]] encoded [[wikipedia:Abstract Syntax Notation One|ASN.1]] objects. The reason for Apple's choice of ASN.1/DER encoding over their own [[PList File Format|Property List]] (PList) file format is currently unknown.

<pre>
sequence [
0: string "IMG4"
1: payload - IMG4 Payload, IM4P
2: [0] (constructed) [
manifest - IMG4 Manifest, IM4M
]
]
</pre>

==IMG4 Payload==
Payload contains the actual content of the file. IMG4 format allows to store payload in a separate file with '''im4p''' extension. '''im4p''' files are used more often than complete IMG4 files. Payload is structured as follows:
<pre>
sequence [
0: string "IM4P"
1: string type - ibot, rdsk, sepi, ...
2: string description - 'iBoot-1940.1.75'
3: octetstring - the encrypted/raw data
4: octetstring - containing DER encoded KBAG values (optional)
sequence [
sequence [
0: int: 01
1: octetstring: iv
2: octetstring: key
]
sequence [
0: int: 02
1: octetstring: iv
2: octetstring: key
]
]
]
</pre>

==IMG4 Manifest==
A.k.a. IM4M. Contains signature for one or multiple IMG4 payloads. Manifests are designed in a way that they can be stored separately from an IMG4 file or be a part of one. An example of an IMG4 manifest is ApImg4Ticket. Each IMG4 manifest is made of tags structured as follows (content = DER encoded object):
<pre>
[type] (private) [ - DER tag's class is the type of the tag (4 bytes) encoded as a big-endian integer
sequence [
string type - type of the tag, 4 bytes
content - content of the tag
]
]
</pre>
Manifest structure (tag <type> = tag of type 'type'):
<pre>
sequence [
0: string "IM4M"
1: integer version - currently 0
2: set [
tag MANB [ - manifest body
set [
tag MANP [ - manifest properties
set [
tag <manifest property> [
content
]
... - tags, describing other properties
]
]
tag <type> [ - ibot, illb, sepi, krnl, NvMR, bbcl...
set [
tag <tag property> [
content
]
...
]
]
... - tags for other images
]
]
]
3: octet string signature
4: sequence [ - containing certificate chain (arbitrary number of certificates)
certificates
]
</pre>

== External Links ==
* [https://twitter.com/i0n1c/status/501299082603020288 i0n1c's tweet]
* [https://www.itu.int/rec/T-REC-X.690/en X.690 - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)]

[[Category:File Formats]]

Jupiter 19R346 (Watch3,3)

2021-09-27T07:41:10Z

Kritanta: Correct Version

{{keys
| Version = 8.0
| Build = 19R346
| Device = Watch3,3
| DownloadURL = https://updates.cdn-apple.com/2021FallFCS/patches/071-98937/684ABDB5-1313-4D99-BF01-4A2EB0E898E8/com_apple_MobileAsset_SoftwareUpdate/4741791957991bc67a9545823be94bac7c2a4f57.zip

| RootFS = 018-80242-001
| RootFSKey = Not Encrypted

| UpdateRamdisk = 018-80166-001
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 018-79907-001
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-m8paop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@115~watch.im4p
| AppleLogoIV = Not Encrypted

| DeviceTree = DeviceTree.n111bap.im4p
| DeviceTreeIV = Not Encrypted

| iBEC = iBEC.n121s.RELEASE.im4p
| iBECIV = c62ae28cc716ad5d2e09c560ea781903
| iBECKey = ee21bdf2a152f7b6a92182eccb285e0476c4732c0ab3a6e9c7d89fce2cd740d5

| iBoot = iBoot.n121s.RELEASE.im4p
| iBootIV = 0b54307cb4bb4624291e13c5bfa4fa85
| iBootKey = 9b13c581254b1ae9e942168e243a9fd8c68a217418b90c8a30ced1856a079689

| iBSS = iBSS.n121s.RELEASE.im4p
| iBSSIV = 3d112e97932003e8dda99ea526731a15
| iBSSKey = 78c19949d380a68f96545e4be308b09f2f15a1efaf8cd1a40de3507ce8e58d07

| Kernelcache = kernelcache.release.watch3
| KernelcacheIV = Not Encrypted

| LLB = LLB.n121s.RELEASE.im4p
| LLBIV = 7397ae2e40cc41e6ad8f5e1ff5a47306
| LLBKey = 6a265ece9b252cf4bf162c6b302abe1b00b0b378735e9ba9ae1eb8e3ece83508

| SEPFirmware = sep-firmware.n111b.RELEASE.im4p
| SEPFirmwareIV = unknown
| SEPFirmwareKey = unknown
}}

Jupiter 19R346 (Watch3,2)

2021-09-27T07:40:55Z

Kritanta: Correct Version

{{keys
| Version = 8.0
| Build = 19R346
| Device = Watch3,2
| DownloadURL = https://updates.cdn-apple.com/2021FallFCS/patches/071-98789/3CE558B5-AC4A-4E2A-975E-862C352AD15A/com_apple_MobileAsset_SoftwareUpdate/69b3c233bcb1c40bc3253fd90326a4cf1ca82c7f.zip

| RootFS = 018-80242-001
| RootFSKey = Not Encrypted

| UpdateRamdisk = 018-80166-001
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 018-79907-001
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-m8paop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@115~watch.im4p
| AppleLogoIV = Not Encrypted

| DeviceTree = DeviceTree.n111bap.im4p
| DeviceTreeIV = Not Encrypted

| iBEC = iBEC.n111b.RELEASE.im4p
| iBECIV = 38391e71591257af211feed3e0880d40
| iBECKey = 9e77397b86cdf01546208ed031ed25909361adb420cb5c421f54d3d7f7144698

| iBoot = iBoot.n111b.RELEASE.im4p
| iBootIV = 956612f518307cf16edc6c73be520e37
| iBootKey = 07642450b5c0d44538dba15c44c5bcaa2a852b02a3c56632acf70d21c6a94adf

| iBSS = iBSS.n111b.RELEASE.im4p
| iBSSIV = 7659aa8e43496d80a1c01f5832a04f9e
| iBSSKey = c37fa54da867ca027048c2c53cbb36ea8d589a5009af02e42f5d94a69872d112

| Kernelcache = kernelcache.release.watch3
| KernelcacheIV = Not Encrypted

| LLB = LLB.n111b.RELEASE.im4p
| LLBIV = e70c6c55c68db47798bc6bdf93815c3c
| LLBKey = db2777b0b334beb1caa5829f16d1b758d4641d1656a940d123ebe93820c6c3b0

| SEPFirmware = sep-firmware.n111b.RELEASE.im4p
| SEPFirmwareIV = unknown
| SEPFirmwareKey = unknown
}}

Jupiter 19R346 (Watch3,1)

2021-09-27T07:40:38Z

Kritanta: Correct Version

{{keys
| Version = 8.0
| Build = 19R346
| Device = Watch3,1
| DownloadURL = https://updates.cdn-apple.com/2021FallFCS/patches/071-98573/83EF5833-1A95-4212-B0D1-F4BF12533C48/com_apple_MobileAsset_SoftwareUpdate/1d1da8fa4999793e0872fd2ba4730cc2e67204d7.zip

| RootFS = 018-80242-001
| RootFSKey = Not Encrypted

| UpdateRamdisk = 018-80166-001
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 018-79907-001
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-m8paop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@115~watch.im4p
| AppleLogoIV = Not Encrypted

| DeviceTree = DeviceTree.n111sap.im4p
| DeviceTreeIV = Not Encrypted

| iBEC = iBEC.n111s.RELEASE.im4p
| iBECIV = 12f8550c8c535d1e8442cc4529a34f25
| iBECKey = 467055783c85fcc9b0cd9662c5b855dd78aa6d19696088867eeab9f9ba6c4596

| iBoot = iBoot.n111s.RELEASE.im4p
| iBootIV = bdc1ab9ead5f54a257ecf93fe9edca34
| iBootKey = 6c6fda377ef54d606673e304ca1826a717a27950ecbbce6518bf4b76b8548351

| iBSS = iBSS.n111s.RELEASE.im4p
| iBSSIV = 46f042b89b3537e2d7472dc404628239
| iBSSKey = 36af5add5f4f0d33bbe20187e6aef86e97e432404a68a6a0d5b561d6279f504b

| Kernelcache = kernelcache.release.watch3
| KernelcacheIV = Not Encrypted

| LLB = LLB.n111s.RELEASE.im4p
| LLBIV = 2b77069433cee5ec926ee8d29f184d37
| LLBKey = c9947f42f802354a0dbee38025188682c776a4703a0ae31972ef1c0425f6998c

| SEPFirmware = sep-firmware.n111s.RELEASE.im4p
| SEPFirmwareIV = unknown
| SEPFirmwareKey = unknown
}}

Jupiter 19R346 (Watch3,4)

2021-09-27T07:40:10Z

Kritanta: 19R346 Watch3,4 keys

{{keys
| Version = 8.0
| Build = 19R346
| Device = Watch3,4
| DownloadURL = https://updates.cdn-apple.com/2021FallFCS/patches/071-99114/D34D0772-1CC7-4C6E-989B-DF41CD8A5F89/com_apple_MobileAsset_SoftwareUpdate/4c20602760665b53234d6f24fbd2a24a96986c19.zip

| RootFS = 018-80242-001
| RootFSKey = Not Encrypted

| UpdateRamdisk = 018-80166-001
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 018-79907-001
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-m8paop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@115~watch.im4p
| AppleLogoIV = Not Encrypted

| DeviceTree = DeviceTree.n111bap.im4p
| DeviceTreeIV = Not Encrypted

| iBEC = iBEC.n121b.RELEASE.im4p
| iBECIV = fc54d4cc14320dbfca7c5d779daa9b18
| iBECKey = c38bc3db9167705de1c443745542ec221d24ef7d238827e154e71b77c7dab3b8

| iBoot = iBoot.n121b.RELEASE.im4p
| iBootIV = d5d5140ce2a2de7e8cfe96eb0291e444
| iBootKey = 8dc8463cd371e9fe200887fb3a0344a7647c12017a9223e4c134ceb3c297d7ef

| iBSS = iBSS.n121b.RELEASE.im4p
| iBSSIV = 6795a4191540c06599786727a97a9622
| iBSSKey = 77c807aba9b4b9828362fd48e71ca0ad5a493c95fea17de91ca3c6a1f0b88f87

| Kernelcache = kernelcache.release.watch3
| KernelcacheIV = Not Encrypted

| LLB = LLB.n121b.RELEASE.im4p
| LLBIV = 84a30143f07f70d54408741fe7ff32c5
| LLBKey = 58d199bc1fa4e165cfba8531d1f326456758cd4339dc87b15f0ce752ab5fff0f

| SEPFirmware = sep-firmware.n111b.RELEASE.im4p
| SEPFirmwareIV = unknown
| SEPFirmwareKey = unknown
}}

Jupiter 19R346 (Watch3,3)

2021-09-27T07:36:20Z

Kritanta: 19R346 Watch3,3 keys

{{keys
| Version = 15.0
| Build = 19R346
| Device = Watch3,3
| DownloadURL = https://updates.cdn-apple.com/2021FallFCS/patches/071-98937/684ABDB5-1313-4D99-BF01-4A2EB0E898E8/com_apple_MobileAsset_SoftwareUpdate/4741791957991bc67a9545823be94bac7c2a4f57.zip

| RootFS = 018-80242-001
| RootFSKey = Not Encrypted

| UpdateRamdisk = 018-80166-001
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 018-79907-001
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-m8paop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@115~watch.im4p
| AppleLogoIV = Not Encrypted

| DeviceTree = DeviceTree.n111bap.im4p
| DeviceTreeIV = Not Encrypted

| iBEC = iBEC.n121s.RELEASE.im4p
| iBECIV = c62ae28cc716ad5d2e09c560ea781903
| iBECKey = ee21bdf2a152f7b6a92182eccb285e0476c4732c0ab3a6e9c7d89fce2cd740d5

| iBoot = iBoot.n121s.RELEASE.im4p
| iBootIV = 0b54307cb4bb4624291e13c5bfa4fa85
| iBootKey = 9b13c581254b1ae9e942168e243a9fd8c68a217418b90c8a30ced1856a079689

| iBSS = iBSS.n121s.RELEASE.im4p
| iBSSIV = 3d112e97932003e8dda99ea526731a15
| iBSSKey = 78c19949d380a68f96545e4be308b09f2f15a1efaf8cd1a40de3507ce8e58d07

| Kernelcache = kernelcache.release.watch3
| KernelcacheIV = Not Encrypted

| LLB = LLB.n121s.RELEASE.im4p
| LLBIV = 7397ae2e40cc41e6ad8f5e1ff5a47306
| LLBKey = 6a265ece9b252cf4bf162c6b302abe1b00b0b378735e9ba9ae1eb8e3ece83508

| SEPFirmware = sep-firmware.n111b.RELEASE.im4p
| SEPFirmwareIV = unknown
| SEPFirmwareKey = unknown
}}

Jupiter 19R346 (Watch3,2)

2021-09-27T07:32:49Z

Kritanta: 19R346 Watch3,2 keys

{{keys
| Version = 15.0
| Build = 19R346
| Device = Watch3,2
| DownloadURL = https://updates.cdn-apple.com/2021FallFCS/patches/071-98789/3CE558B5-AC4A-4E2A-975E-862C352AD15A/com_apple_MobileAsset_SoftwareUpdate/69b3c233bcb1c40bc3253fd90326a4cf1ca82c7f.zip

| RootFS = 018-80242-001
| RootFSKey = Not Encrypted

| UpdateRamdisk = 018-80166-001
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 018-79907-001
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-m8paop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@115~watch.im4p
| AppleLogoIV = Not Encrypted

| DeviceTree = DeviceTree.n111bap.im4p
| DeviceTreeIV = Not Encrypted

| iBEC = iBEC.n111b.RELEASE.im4p
| iBECIV = 38391e71591257af211feed3e0880d40
| iBECKey = 9e77397b86cdf01546208ed031ed25909361adb420cb5c421f54d3d7f7144698

| iBoot = iBoot.n111b.RELEASE.im4p
| iBootIV = 956612f518307cf16edc6c73be520e37
| iBootKey = 07642450b5c0d44538dba15c44c5bcaa2a852b02a3c56632acf70d21c6a94adf

| iBSS = iBSS.n111b.RELEASE.im4p
| iBSSIV = 7659aa8e43496d80a1c01f5832a04f9e
| iBSSKey = c37fa54da867ca027048c2c53cbb36ea8d589a5009af02e42f5d94a69872d112

| Kernelcache = kernelcache.release.watch3
| KernelcacheIV = Not Encrypted

| LLB = LLB.n111b.RELEASE.im4p
| LLBIV = e70c6c55c68db47798bc6bdf93815c3c
| LLBKey = db2777b0b334beb1caa5829f16d1b758d4641d1656a940d123ebe93820c6c3b0

| SEPFirmware = sep-firmware.n111b.RELEASE.im4p
| SEPFirmwareIV = unknown
| SEPFirmwareKey = unknown
}}

Jupiter 19R346 (Watch3,1)

2021-09-27T07:28:34Z

Kritanta: 19R346 Watch3,1 keys

{{keys
| Version = 15.0
| Build = 19R346
| Device = Watch3,1
| DownloadURL = https://updates.cdn-apple.com/2021FallFCS/patches/071-98573/83EF5833-1A95-4212-B0D1-F4BF12533C48/com_apple_MobileAsset_SoftwareUpdate/1d1da8fa4999793e0872fd2ba4730cc2e67204d7.zip

| RootFS = 018-80242-001
| RootFSKey = Not Encrypted

| UpdateRamdisk = 018-80166-001
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 018-79907-001
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-m8paop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@115~watch.im4p
| AppleLogoIV = Not Encrypted

| DeviceTree = DeviceTree.n111sap.im4p
| DeviceTreeIV = Not Encrypted

| iBEC = iBEC.n111s.RELEASE.im4p
| iBECIV = 12f8550c8c535d1e8442cc4529a34f25
| iBECKey = 467055783c85fcc9b0cd9662c5b855dd78aa6d19696088867eeab9f9ba6c4596

| iBoot = iBoot.n111s.RELEASE.im4p
| iBootIV = bdc1ab9ead5f54a257ecf93fe9edca34
| iBootKey = 6c6fda377ef54d606673e304ca1826a717a27950ecbbce6518bf4b76b8548351

| iBSS = iBSS.n111s.RELEASE.im4p
| iBSSIV = 46f042b89b3537e2d7472dc404628239
| iBSSKey = 36af5add5f4f0d33bbe20187e6aef86e97e432404a68a6a0d5b561d6279f504b

| Kernelcache = kernelcache.release.watch3
| KernelcacheIV = Not Encrypted

| LLB = LLB.n111s.RELEASE.im4p
| LLBIV = 2b77069433cee5ec926ee8d29f184d37
| LLBKey = c9947f42f802354a0dbee38025188682c776a4703a0ae31972ef1c0425f6998c

| SEPFirmware = sep-firmware.n111s.RELEASE.im4p
| SEPFirmwareIV = unknown
| SEPFirmwareKey = unknown
}}

SkySeed 19A5261w (iPhone10,6)

2021-06-09T21:03:44Z

Kritanta: some filenames may be inaccurate, link/sep key missing

{{keys
| Version = 15.0 beta
| Build = 19A5261w
| Device = iPhone10,6
| Codename = SkySeed
| Baseband = 9.00.00
| DownloadURL =

| RootFS = 018-22620-059
| RootFSKey = Not Encrypted

| UpdateRamdisk = 018-22236-084
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 018-22746-084
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8015aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| AVE = AppleAVE2FW_H9.im4p
| AVEIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d22ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1334~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D10.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d22.RELEASE.im4p
| iBECIV = d1c7eab58666c4562c28144cc343b2d6
| iBECKey = b99ddfba9d5538a3eb1d1ff108cb77f89fdd977a4e293487e60674a5d746c557

| iBoot = iBoot.d22.RELEASE.im4p
| iBootIV = bf5f5766e0db01b646b2735586d71c0b
| iBootKey = 454caddd7ea429e2234aa53f2e86b310fb4bc92e7fc6113c4583d598b1f93f04

| iBSS = iBSS.d22.RELEASE.im4p
| iBSSIV = 867ba05c6c198acf3be27d17cc5d337b
| iBSSKey = a6e78208361c7dd1344cae81ea56415545552a953ef9041f672afd5172a7afc1

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1334~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d22.RELEASE.im4p
| LLBIV = 17989d13ecccc0b5eb49fb05b5248b7ddb7fb1a44ef1389c5d284d56e9df094d
| LLBKey = 11a97cbb2bc6bdffe549bcc66269ac41

| RecoveryMode = recoverymode@1334~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d22.RELEASE.im4p
| SEPFirmwareIV =
| SEPFirmwareKey =
}}

Talk:Malware for iOS

2021-04-30T23:47:56Z

Kritanta: Created page with "worth splitting up malware for jailbroken and non-jailbroken iOS? extremely different categories IMO. ~~~~"

worth splitting up malware for jailbroken and non-jailbroken iOS? extremely different categories IMO. [[User:Kritanta|Kritanta]] ([[User talk:Kritanta|talk]]) 23:47, 30 April 2021 (UTC)

Malware for iOS

2021-04-30T23:47:15Z

Kritanta: /* Tools found in the wild that target the public */ i've nicknamed it 'ilius' because i'm uncreative. i'm working on a fully writeup currently, but this is ongoing. does this deserve an entry?

This is a list of known malware (including spyware, adware, trojans, viruses, worms, and similar tools) that have targeted iOS, including jailbroken iOS. The dates are approximate dates when people discovered, publicized, or started discussing the tool.

The goal of this list is to aid better understanding of the risks of using iOS and jailbroken iOS - it's helpful to have as much accurate information as you can. If you're concerned about avoiding malware on your jailbroken device, check out [https://www.reddit.com/r/jailbreak/wiki/howtoresearch this guide to making informed guesses about whether packages are reasonable to install].

Some context:
* Some of these tools targeted old iOS versions and do not work on current iOS versions.
* Some of these are harmful and some are merely annoying.
* Many of these require the device to be jailbroken, and some work on non-jailbroken devices (including via [[misuse of enterprise and developer certificates]]).
* Cydia is an open platform - it includes a specific set of default repositories, and it also allows users to type in any third-party repository that they want to use (much like a web browser that allows you to visit any website). Anyone can run a third-party repository and distribute any software they choose to distribute.
* Some of these tools are built to target specific people instead of the general public.
* Especially for malware that targets a specific person and requires the device to be jailbroken (such as commercial spyware tools used by governments and [http://www.forbes.com/sites/sarahjeong/2014/10/28/surveillance-begins-at-home/ people spying on family members]), it's important to consider that ''the vulnerabilities in iOS that allow it to be exploited with a jailbreak'' are part of what allows that malware to exist - the process may include finding a way to secretly jailbreak the target's device if it's not jailbroken already.

For an earlier list of known malware, see [https://blog.fortinet.com/2014/06/09/ios-malware-does-exist "iOS Malware Does Exist"] (June 2014).

Related research: [https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/wang_tielei "On the Feasibility of Large-Scale Infections of iOS Devices"] (August 2014).

== Tools found in the wild that target the public ==

=== iKee and Duh (November 2009) ===

The [[Ikee-virus]] (also called Eeki) is a worm transmitted between jailbroken devices that have OpenSSH installed and haven't changed the default root password. It changes the lockscreen background to a photo of Rick Astley.

Two weeks later, the similar [https://nakedsecurity.sophos.com/2009/11/23/lightning-strikes-iphone-malware-malicious/ Duh worm] spread, which was "much more serious than the original Ikee worm because it is not limited to infecting iPhone users in Australia, and communicates with an internet Control & Command centre, downloading new instructions - effectively turning your iPhone into part of a botnet."

=== "Find and Call" (July 2012) ===

Find and Call was an app on the App Store that automatically uploaded users' contact lists to the company's server, then spammed those contacts with a link to the app ("from" that user). This undisclosed, unwanted behavior makes the software fit the definition of a trojan. Articles: [https://securelist.com/blog/incidents/33544/find-and-call-leak-and-spam-57/ Kaspersky SecureList], [http://arstechnica.com/apple/2012/07/find-and-call-app-becomes-first-trojan-to-appear-on-ios-app-store/ Ars Technica], [https://nakedsecurity.sophos.com/2012/07/06/find-call-ios-android-malware/ Sophos NakedSecurity]. It is also called FindCall.

=== Packages by Nobitazzz (August 2012 and September 2013) ===

A tweak developer who went by various names (Felix, FelixCat, isoftjsc, Martin Pham, Nitram88, Nobitazzz, Nobita.ZZZ, Sara_Nobita, sara_nobita_zzz, tuyentq2009, vietSARA) included adware in his tweaks. These were many free packages along with some paid packages sold via the Cydia Store, mostly distributed by default repositories (until the problem was discovered). The adware ran ads in the background of iOS, displaying off-screen so that the user wouldn't notice them, with the revenue from those ads going to this tweak developer. This was [http://modmyi.com/forums/cydia-support/810633-new-adware-malware-found-cydia.html first reported in August 2012 on the ModMyi forum] and [http://ryanhileman.info/posts/webgl analyzed in September 2013] ([https://www.reddit.com/r/jailbreak/comments/1n5702/anatomy_of_a_jailbreak_trojan/ discussion on Reddit]).

Packages by this developer included: Animated ICS LockScreen & HomeScreen, BetterChrome, Chrome Download Enabler, ChromeMe, Enable Copy text in Facebook app, Enable WebGL, Facebook Photo Library integration, FacebookThis, Handwriting recognition, Insta9gag, InstaFacebook for NotificationCenter, Instagram Image saver, InstaSocial for Notification Center, InstaTwitter for NotificationCenter, iOS 6 Photos Menu, Make Gmail as default, Notification Lunar Calendar, Olympic 2012 Medal for Notification Center, PhotoFilters, Sara, Sara Dictation Keyboard, VoiceTweet.

=== AdThief/Spad (March and August 2014) ===

AdThief (also called Spad) is malware targeting jailbroken iOS devices, which "tweaks a developer ID that’s intended to tell ad developers when their ads are either viewed or clicked and in turn, generate revenue. In the malware’s case, infected devices funnel those small payments away from the developers to the hacker", as [https://threatpost.com/adthief-ios-malware-affecting-75k-jailbroken-devices/107907 explained by Kaspersky Threatpost]. Security researchers estimated it had infected 75,000 devices.

=== Unflod (April 2014) ===

[[Unflod]] is a malicious piece of software targeting jailbroken iOS devices, which attempts to capture the user's Apple ID and password by using MobileSubstrate to hook into the SSLWrite function of Security.framework and then listening to data passed to it. Once the Apple ID and password are captured, it is sent to a Chinese IP address. It was inadvertently discovered by a Reddit user on April 17th, 2014. Also called "Unflod Baby Panda" and "SSLCreds".

=== AppBuyer (September 2014) ===

AppBuyer, as discussed in [http://researchcenter.paloaltonetworks.com/2014/09/appbuyer-new-ios-malware-steals-apple-id-password-buy-apps/ this article by Palo Alto Networks], is malware that “will connect to C&C server, download and execute malicious executable files, hook network APIs to steal user’s Apple ID and password and upload to the attacker’s server, and simulate Apple’s proprietary protocols to buy apps from the official App Store by victim’s identity.” It targets jailbroken devices.

=== WireLurker and Masque Attack (November 2014) ===

As discussed at [[Misuse of enterprise and developer certificates]]: [http://researchcenter.paloaltonetworks.com/2014/11/wirelurker-new-era-os-x-ios-malware/ according to Palo Alto Networks], WireLurker is "a family of malware targeting both Mac OS and iOS systems for the past six months...It is the first in-the-wild malware to install third-party applications on non-jailbroken iOS devices through enterprise provisioning."

Masque Attacks are a related technique, also [https://www.fireeye.com/blog/threat-research/2014/11/masque-attack-all-your-ios-apps-belong-to-us.html discussed by Palo Alto Networks]: "an iOS app installed using enterprise/ad-hoc provisioning could replace another genuine app installed through the App Store, as long as both apps used the same bundle identifier."

=== Xsser mRAT (December 2014) ===

Xsser mRAT is a piece of malware that targets jailbroken devices. [https://blogs.akamai.com/2014/12/ios-and-android-os-targeted-by-man-in-the-middle-attacks.html As described by Akamai]: "The app is installed via a rogue repository on Cydia, the most popular third-party application store for jailbroken iPhones. Once the malicious bundle has been installed and executed, it gains persistence - preventing the user from deleting it. The mRAT then makes server-side checks and proceeds to steal data from the user's device and executes remote commands as directed by its command-and-control (C2) server."

=== Lock Saver Free (July 2015) ===

Lock Saver Free is a free tweak, originally distributed on a default repository (removed from the repository after discovery of the problem), that installs an extra tweak that hooks into ad banners to insert its own ad identifier, presumably in order to give ad revenue to the author of the tweak instead of to the author of the website/app where the ad was found. [https://www.reddit.com/r/jailbreak/comments/3eis8g/news_lock_saver_free_contains_a_trojan_that/ Discussion on Reddit].

=== KeyRaider (August 2015) ===

KeyRaider, as discussed in [http://researchcenter.paloaltonetworks.com/2015/08/keyraider-ios-malware-steals-over-225000-apple-accounts-to-create-free-app-utopia/ this article by Palo Alto Networks], is a piece of malware for jailbroken devices that "steals Apple account usernames, passwords and device GUID by intercepting iTunes traffic on the device." These security researchers said it has over 225,000 stolen accounts in its database.

=== XcodeGhost (September 2015) ===

XcodeGhost is a form of malware that was found in some unofficial redistributions of Xcode targeted at Chinese developers (who often download redistributed copies because official Apple download speeds are slow in China). XcodeGhost infects apps compiled with those versions of Xcode, which included at least 39 apps published in the iOS App Store. Palo Alto Networks published a series of posts about it: [http://researchcenter.paloaltonetworks.com/2015/09/novel-malware-xcodeghost-modifies-xcode-infects-apple-ios-apps-and-hits-app-store/ original post explaining it], [http://researchcenter.paloaltonetworks.com/2015/09/malware-xcodeghost-infects-39-ios-apps-including-wechat-affecting-hundreds-of-millions-of-users/ a list of additional infected apps on the App Store], [http://researchcenter.paloaltonetworks.com/2015/09/update-xcodeghost-attacker-can-phish-passwords-and-open-urls-though-infected-apps/ more about its capabilities]. It adds code that can upload device and app information to a central server, create fake iCloud password signin prompts, and read and write from the copy-and-paste clipboard.

=== YiSpecter (October 2015) ===

YiSpecter, [http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ also discussed by Palo Alto Networks], is malware that uses private APIs to perform malicious actions on both non-jailbroken and jailbroken iOS. It gets installed in the form of apps signed with [[Misuse of enterprise and developer certificates|enterprise certificates]]. Palo Alto Networks says "On infected iOS devices, YiSpecter can download, install and launch arbitrary iOS apps, replace existing apps with those it downloads, hijack other apps’ execution to display advertisements, change Safari’s default search engine, bookmarks and opened pages, and upload device information to the C2 server."

=== Muda (October 2015) ===

Muda (also called AdLord), [https://twitter.com/claud_xiao/status/653606471876263936 discussed by Claud Xiao], is a form of adware for jailbroken devices. It has been in the wild at least since October 2013. He writes "It spreads via third party Cydia sources in China, and only affects jailbroken iOS devices. Its main behaviors include to display advertisements over other apps or in notification bar, and to ask user downloading iOS apps it promoted. "

=== Youmi Ad SDK (October 2015) ===

This advertising SDK, mostly used by Chinese App Store developers, [https://sourcedna.com/blog/20151018/ios-apps-using-private-apis.html was discovered by SourceDNA] to be abusing private APIs in order to collect more personal information than is allowed by Apple security and privacy guidelines, including the list of apps installed on a device, serial numbers of a device and internal components, and user's Apple ID email address. Youmi exploited a weakness in App Store review process and evaded detection by obfuscating private API calls using simple string manipulation. 256 apps with estimated 1 million downloads were found to be affected, including the official Chinese McDonald's app.

=== AceDeceiver (March 2016) ===

AceDeceiver, [https://researchcenter.paloaltonetworks.com/2016/03/acedeceiver-first-ios-trojan-exploiting-apple-drm-design-flaws-to-infect-any-ios-device/ reported by Claud Xiao of Palo Alto Networks], is malware for non-jailbroken iOS devices. It gets on non-jailbroken devices through a desktop application that exploits design flaws in Apple’s DRM mechanism to install a malicious iOS app from the App Store. It can install the malicious app even after the app is removed from the App Store, and it doesn't require [[Misuse of enterprise and developer certificates|misusing an enterprise certificate]].

=== Safari JavaScript pop-up scareware (March 2017) ===

[https://blog.lookout.com/blog/2017/03/27/mobile-safari-scareware/ Lookout reported] that scammers had "abused the handling of pop-up dialogs in Mobile Safari in such a way that it would lock out a victim from using the browser. The attack would block use of the Safari browser on iOS until the victim pays the attacker money in the form of an iTunes Gift Card. During the lockout, the attackers displayed threatening messaging in an attempt to scare and coerce victims into paying. However, a knowledgeable user could restore functionality of Mobile Safari by clearing the browser’s cache via the the iOS Settings — the attack doesn’t actually encrypt any data and hold it ransom."

iOS 10.3 changed the handling of JavaScript pop-ups to prevent this problem, making pop-ups "per-tab rather than taking over the entire app".

=== mainrepo RAT ===

Certain packages on the jailbreak API repository named "mainrepo" contain a remote access trojan. info: https://twitter.com/esetresearch/status/1374889630399619080. This malware is still being used and distributed in the wild at time of writing (4-30-2021).

== Tools used by governments (and similar) to target individuals ==

=== FinSpy Mobile (August 2012) ===

FinFisher is a suite of commercial surveillance tools sold to governments, which have been used to target activists and other people. The suite [https://citizenlab.org/2012/08/the-smartphone-who-loved-me-finfisher-goes-mobile/ includes spyware tools for many mobile operating systems, including iOS].

=== DROPOUTJEEP (December 2013) ===

In December 2013, a conference presentation included information about a NSA tool called DROPOUTJEEP: [http://www.forbes.com/sites/erikkain/2013/12/30/the-nsa-reportedly-has-total-access-to-your-iphone/ "a software implant for the Apple iPhone that utilizes modular mission applications to provide specific SIGINT functionality. This functionality includes the ability to remotely push/pull files from the device. SMS retrieval, contact list retrieval, voicemail, geolocation, hot mic, camera capture, cell tower location, etc. Command, control and data exfiltration can occur over SMS messaging or a GPRS data connection. All communications with the implant will be covert and encrypted.”] The information was from an internal NSA software catalog from 2008. The presenter speculated that Apple had helped build this tool, and [http://techcrunch.com/2013/12/31/apple-says-it-has-never-worked-with-nsa-to-create-iphone-backdoors-is-unaware-of-alleged-dropoutjeep-snooping-program/ Apple said it "has never worked with the NSA to create a backdoor in any of our products"].

=== Hacking Team tools (June 2014 and July 2015) ===

[[Hacking Team]] is a company that "sells offensive intrusion and surveillance capabilities to governments and law enforcement agencies", including iOS spyware tools. The iOS spyware tools appear designed for targeting/attacking specific people, not for broad surveillance of the public. Their main tool (Remote Control System) requires a jailbroken device, and they were researching options for non-jailbroken devices.

=== Inception (December 2014) ===

Inception is an "attack framework" from an unknown source that targets individuals to steal information, using phishing emails and other techniques along with malware for iOS and other mobile operating systems, described in [https://www.bluecoat.com/security-blog/2014-12-09/blue-coat-exposes-%E2%80%9C-inception-framework%E2%80%9D-very-sophisticated-layered-malware this post by security researchers who identified it]. According to [http://images.machspeed.bluecoat.com/Web/BlueCoat/%7B7f2dda62-f240-48dc-b05e-5cc620747b73%7D_bcs_wp_The_Inception_Framework_Cloud-Hosted_APT_EN_1d.pdf the whitepaper from those security researchers], a target may receive a phishing email with a link that says it's a WhatsApp update, and if clicked on jailbroken iOS, it triggers "the download of a Debian installer package, WhatsAppUpdate.deb, also 1.2Mb in size. This application impersonates a Cydia installer, and can only be installed on a jailbroken phone" (page 23). It's unclear what they mean by "impersonates a Cydia installer", but a .deb file is the standard format for software packages installable via Cydia. The iOS malware collects the device's [[ICCID]], address book, phone number, MAC address, and other information.

Another group of security researchers also identified this attack framework [http://www.cso.com.au/article/562325/sophisticated-malware-targets-execs-pcs-android-blackberry-ios-devices/ and called it Cloud Atlas].

More articles: [http://appleinsider.com/articles/14/12/11/massive-sophisticated-inception---cloud-atlas-malware-infects-windows-and-android-but-cant-exploit-apples-ios-without-jailbreak Apple Insider], [http://www.forbes.com/sites/thomasbrewster/2014/12/10/iphone-android-attacks-on-diplomats/ Forbes]. There is a sample download [http://contagiominidump.blogspot.de/2014/12/cloud-atlas-inception-ios.html available via this blog].

=== XAgent (February 2015) ===

XAgent is a surveillance tool targeting specific people (such as people in governments, the military, and journalists) that can affect both non-jailbroken and jailbroken devices, as described in [http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/ this article by Trend Micro]. Also [http://www.pcworld.com/article/2880152/new-spyware-targets-ios-devices-steals-pictures-and-data.html covered by PCWorld].

=== Pegasus (August 2016) ===

Pegasus is a spyware product for iOS built by NSO Group, sold to governments, which has been used for attacks against political dissidents. It uses a chain of exploits nicknamed Trident to silently jailbreak the target device, and then it installs malware. Lookout Security described it in [https://blog.lookout.com/blog/2016/08/25/trident-pegasus/ a post] and [https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf a technical analysis]. Citizen Lab wrote [https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ a post about its use].

In June 2017, [https://www.nytimes.com/2017/06/19/world/americas/mexico-spyware-anticrime.html?_r=0 the New York Times reported] that the Mexican government used Pegasus to target human rights lawyers, journalists and anti-corruption activists.

=== Cellebrite (February 2017) ===

As reported by [https://motherboard.vice.com/en_us/article/hacker-dumps-ios-cracking-tools-allegedly-stolen-from-cellebrite Motherboard in February 2017], Cellebrite is "an Israeli firm which specializes in extracting data from mobile phones for law enforcement agencies". According to leaked information, "much of the iOS-related code is very similar to that used in the jailbreaking scene", such as [[limera1n]] and [[QuickPwn]], with additions: "some of the code in the dump was designed to brute force PIN numbers". The leaked files are [https://www.reddit.com/r/jailbreak/comments/5rtffh/newsfirm_that_helped_fbi_break_into_san/ddan91v/ available online].

=== CIA "Vault 7" materials (March 2017) ===

On March 7, 2017, WikiLeaks [https://www.nytimes.com/2017/03/07/world/europe/wikileaks-cia-hacking.html released a collection of CIA documents called Vault 7], dated from 2013 to 2016, that include information about CIA hacking tools for iOS devices. The materials include [https://wikileaks.org/ciav7p1/cms/space_2359301.html documentation for CIA iOS exploitation research] and [https://wikileaks.org/ciav7p1/cms/page_13205587.html a list of iOS exploits they have].

== Tools developed as part of research ==

=== iSAM (June 2011) ===

iSAM is a malware tool [http://link.springer.com/chapter/10.1007%2F978-3-642-21424-0_2 developed by security researchers] as a proof of concept. It affects both jailbroken and not-yet-jailbroken devices: it scans for jailbroken devices that have SSH running and the default root password, and it also includes a malicious version of the [[Star]] exploit (JailbreakMe 2.0) so it can jailbreak a device that isn't jailbroken yet.

=== Instastock (November 2011) ===

Charlie Miller, a security researcher, [http://www.forbes.com/sites/andygreenberg/2011/11/07/iphone-security-bug-lets-innocent-looking-apps-go-bad/ submitted an app to the App Store called Instastock] to demonstrate "a flaw in Apple’s restrictions on code signing on iOS devices". The app was initially accepted and then pulled from the store.

=== Mactans (July 2013) ===

At the Black Hat 2013 conference, security researchers presented a tool called Mactans, a small device that looks like a charger but [http://www.zdnet.com/article/researchers-reveal-how-to-hack-an-iphone-in-60-seconds/ can insert malware if you plug an iOS device into it]. The iOS device does not have to be jailbroken.

=== Jekyll (August 2013) ===

At the USENIX Security Symposium in 2013, security researchers described a method for getting a malicious app approved for the App Store, [http://www.theguardian.com/technology/appsblog/2013/aug/19/ios-malware-apple-iphone-ipad-jekyll "created with remotely-exploitable vulnerabilities built in, masked by legitimate features to evade detection during the App Store approval process, but ready to be triggered once the app was installed on an iOS device."] They successfully got an app approved for the App Store with this method (which [http://arstechnica.com/security/2013/08/seemingly-benign-jekyll-app-passes-apple-review-then-becomes-evil/ "was only active for a few minutes following its launch in March, and during that time it wasn't installed by anyone not involved in the experiment"]).

=== XARA attacks (June 2015) ===

Security researchers found methods for "cross-app resource access" (XARA) attacks on OS X and iOS, and they submitted malicious proof-of-concept apps to the Mac and iOS App Store. Apple approved the apps, and the researchers immediately removed them from the stores. These XARA attacks were ways of bypassing the sandboxes that are supposed to prevent an app from accessing files that don't belong to that app, [https://drive.google.com/file/d/0BxxXk1d3yyuZOFlsdkNMSGswSGs/view described by the security researchers in a paper]. [http://arstechnica.com/security/2015/06/serious-os-x-and-ios-flaws-let-hackers-steal-keychain-1password-contents/ Ars Technica article].

=== NeonEggShell (August 2015) ===

[http://neoneggplants.com/projects/neoneggshell/ NeonEggShell] is a command shell creation tool for iOS and OS X. The author says "This project is a proof of concept way to demon strate how easy it is to take over a whole device with a piece of code no bigger than a twitter post." The project includes tools for making payloads for jailbroken iOS, with features such as keylogging and location tracking. By default, the tool includes a "prompt that asks for permission before allowing any connection to the remote server."

== Tools for sale to the public to target individuals ==

=== 1mole ===

[http://www.bosspy.com/user/iphoneos.aspx 1mole] is a spying tool available to the public via their own repository, authored by Bosspy. It describes itself [http://www.bosspy.com/user/default.aspx on its website] as "For Parents" ("Have your children going home after school? Consult their GPS position to be sure."), "For individuals" ("You think about your lost or stolen mobile phone."), and "For Employers" ("Install the software on your business phones and locate them in real time"). Its feature list includes "Track GPS locations" and "Capture the lock sreen passcode" for free, and "Record text messages", "Log Calls details", "Website monitoring", and "Keylogger" as paid services.

=== Copy9 ===

[http://cydia.saurik.com/package/com.goldenspy.copy9/ Copy9] is a spying tool available to the public via the ModMyi repository (a default repository), authored by Copy9. It describes itself as "will be installed on target iDevice to find out a thief, cheating spouses, monitor chidren/employees or simply backup data from your devices to our cloud server. This is the best spyware on the world in spying field." [http://copy9.com/ Copy9 website].

=== Copy10 ===

[http://cydia.saurik.com/package/com.copy10.copy10/ Copy10] is a similar but separate spying tool available to the public via the ModMyi repository (a default repository), authored by IntelMobi/goldenspy. Their description includes "Are you having trust issues in your relationship? Sign that your kid's personality has changed and their behaviors, does your teenager hang out with friends you're concerned about? What if you believe one of your employees is a spy or is stealing company's technology, intellectual property or trade secrets?" [https://www.intelmobi.com/ IntelMobi website].

=== FlexiSPY ===

[http://www.flexispy.com/en/iphone-tracker-spy-on-iphone.htm FlexiSPY] is a spying tool available to the public presumably via their own repository (this isn't specified on their website, but it's specified that you need the device to be jailbroken), authored by Flexispy, Ltd. Their website says "If you have a committed relationship with your partner or are responsible for a child or employee YOU HAVE A RIGHT TO KNOW To protect your relationship, spy on their iPhone."

=== iKeyGuard Key Logger ===

[http://cydia.saurik.com/package/com.ikeyguard.ikg/ iKeyGuard Key Logger] is a keylogging tool available to the public via the BigBoss repository (a default repository), authored by iKeyGuard. Its description includes "Warning: Logging other people without their permission might be illegal in your country! Make sure you abide by your local law."

=== iKeyMonitor keylogger ===

[http://cydia.saurik.com/package/com.aw.mobile.ikm/ iKeyMonitor keylogger] is a keylogging tool available to the public via the BigBoss repository (a default repository), authored by Awosoft Technology. [http://ikeymonitor.com/ Its website] includes "How to monitor your children's cell phone to discover the truth and protect them from potential dangers? Now with iKeyMonitor you can uncover the truth by secretly monitoring mobile phones and tablets such as iPhone/iPad/iPod and Android device."

=== InnovaSPY ===

[http://cydia.saurik.com/package/com.innovaspy.innovaspy/ InnovaSPY] is a spying tool available to the public via the ModMyi repository (a default repository), authored by Innovaspy. Its description says "Perfect iPhone spy app" and lists reasons to use it as "Protect your child from cyber predators" and "Find out THE TRUE from cheating spouse?" Related package: [http://cydia.saurik.com/package/com.innovaspy.innovamonitor/ InnovaMonitor], a monitoring app for use with the spy tool. [http://innovaspy.com/ InnovaSPY website].

=== Mobile Spy ===

[http://www.mobile-spy.com/iphone-v7.html Mobile Spy] is a spying tool available to the public via their own repository, authored by Retina-X Studios. [http://www.mobile-spy.com/ Their website] says "View your Child or Employee's Smartphone and Tablet Usage. Monitor text messages, GPS locations, call details, photos and social media activity. View the screen and location LIVE!"

=== MobiStealth ===

[http://www.mobistealth.com/iphone-spy MobiStealth] is a spying tool available to the public for both [http://www.mobistealth.com/iphone-spy jailbroken iOS] (presumably installed via their own repository) and [http://www.mobistealth.com/ios-non-jailbreak non-jailbroken iOS] ("All that you require is the Apple ID and password of the iPhone or iPad that you want to monitor to get remote access to"). Their website includes "Are your employees misusing company owned phones? Are your kids getting more possessed and do not want to share anything with you? Stop wondering and thinking all day long, Mobistealth iPhone spy app is exactly what you need."

=== mSpy ===

[http://cydia.saurik.com/package/com.mtechnology.mspy.trial/ mSpy] is a spying tool available to the public via the BigBoss repository (a default repository), authored by Mtechnology. Its description of itself: "mSpy is the best tracking and spy application that allows users to keep a check on the cell phone activities of their kids other family members or employees in order to avoid any unwanted behavior or for safety purposes."

The mSpy website [http://www.mspy.com/compatibility.html indicates that they also have a version for non-jailbroken devices].

In May 2015, [http://krebsonsecurity.com/2015/05/mspy-denies-breach-even-as-customers-confirm-it/ mSpy had a customer data breach].

=== OwnSpy ===

[http://cydia.saurik.com/package/com.ownspy.daemon/ OwnSpy] is a spying tool available to the public via the ModMyi repository (a default repository), authored by Antonio Calatrava. It describes itself as "Spy your own iPhone or iPad", with call recording, location tracking, and other features. It has a warning that says "Installing OwnSpy on a device that does not belong to you is a criminal offense and may be prosecuted. Mobile Innovations will help authorities if required." [http://en.ownspy.com/P000001-install-on-ios OwnSpy website].

=== Spy App ===

[http://cydia.saurik.com/package/com.spyapp.daemon/ Spy App] is a spying tool available to the public via the ModMyi repository (a default repository), authored by dmarinov. Its description includes "Remotely spy SMS, Emails, Call Logs, GPS Location, Key presses (Keylogger)" and other features. It says it is "absolutely invisible and undetectable."

=== SpyKey ===

[http://cydia.saurik.com/package/com.kobisnir.spykey/ SpyKey] is a keylogging tool available to the public via the BigBoss repository (a default repository), authored by Kobi Snir. Its description includes "a simple app that let you monitor your PC Keyboard activity in real time, Simply connect your iphone to your compute using your Wifi or 3G connection and start monitoring." The [http://www.ioslinks.com/spykey/ SpyKey website] includes "Great use for parental control purposes, protect your kids from chating with strangers!", "Discover usernames & passwords", and "Spy unfaithfull husband or wife."

=== StealthGenie ===

StealthGenie was a spying tool available to the public [http://blog.flexispy.com/remove-stealthgenie-iphone-android/ via their own repository]. It also supported other mobile operating systems. In November 2014, the person who advertised and sold this product was [http://www.justice.gov/opa/pr/man-pleads-guilty-selling-stealthgenie-spyware-app-and-ordered-pay-500000-fine charged with a federal crime and fined $500,000]. The charge was "sale of an interception device and advertisement of a known interception device", a wiretapping crime. [http://www.forbes.com/sites/kashmirhill/2014/09/30/stealthgenie-ugly-marketing-of-spyware/ A Forbes article] says "according to the FBI, Akbar and his team developed an internal business plan that revealed that — duh — the primary target audience for the app was people who thought their partners were cheating." The Forbes article points out [[#Mobile Spy]], [[#mSpy]], [[#FlexiSPY]], and [[#MobiStealth]] as similar products.

=== Trapsms ===

Trapsms was an early spying tool available to the public, [http://blog.fortinet.com/post/detecting-spyware-for-iphones described in this post by a security researcher in July 2009]. She says: "The spyware installs on any jailbroken iPhone. In Cydia (an iPhone front-end to help installing third-party applications), you first add the URL of the spyware's repository and then install the two spyware packages."

[[Category:Malware research]]

Talk:Up to Speed

2021-04-13T03:43:45Z

Kritanta: Speed has reached approximately 4 km/h

This page is full of dead links, likely should be gone through and updated - [[User:Kritanta|Kritanta]] ([[User talk:Kritanta|talk]]) 03:43, 13 April 2021 (UTC)

Bootrom 2651.0.0.3.3

2020-08-08T01:59:29Z

Kritanta: formatting

This is the [[bootrom]] version found in the [[Apple Watch Series 3]]. It is vulnerable to [[Checkm8_Exploit|Checkm8]].

== Segmentation/Loading ==

All of these segments are arbitrary and nonexistient, and only serve the purpose of helping you navigate the db more easily.

The SecureROM image segmentation is based on iBoot.sys mapping.

Dump from device:
* 0x0-0x1FFFF
* 0x48100000-0x48200000
* 0x48650000-0x48651000
* 0x48800000-0x48820000
* 0x49100000-0x49120000

Load each into decompiler

Segments:
* __text: 0x00000000 - 0x105CC
* __TEXT_hidden: 0x000105CC - 0x00010600
* __cstring: 0x00010600 - 0x000106E2
* __const: 0x000106E2 - 0x000149DE
* __zerofill: 0x000149DE - 0x0001FFFF

* RAM: 0x48100000-0x48200000
* MEM: 0x48650000-0x48651000
* SRAM: 0x48800000-0x48820000
* SMEM: 0x49100000-0x49120000

== Types ==

Some type info is available here, and can be loaded into IDA via "Load -> C Header":

https://github.com/KritantaDev/iBootLoader/blob/master/iBootStrap/iBoot.h

== Symbols ==

<pre>
#
# Symbols found by _kritanta
# For: iBoot-2651.0.0.3.3 ROMRELEASE for t8004si
# Report any mistakes here: https://github.com/KritantaDev/timestop/blob/master/Symbols/ROM/t8004
#
# This file is in python format for ease of loading
#
# You can probably use this to bindiff symbols to most other roms
#

symbols = {
0x00000000: 'start',
0x00000040: 'reset',
0x0000005C: 'relocate_loop',
0x00000078: 'relocate_data',
0x000000A0: 'relocate_data_loop',
0x000000B0: 'stack_setup',
0x00000188: 'bss_loop',
0x00000194: 'bss_done',
0x000001A0: 'spin',
0x00000200: 'aSecureromForT8004siCopyright20072014AppleInc',
0x00000240: 'aRomrelease',
0x00000280: 'aIboot26510033_0',
0x00000300: 'Description',
0x00000304: 'ReleaseCategory',
0x00000308: 'iBootVersion',
0x0000030C: 'main',
0x00000310: 'Start',
0x0000031C: 'sram_start',
0x00000328: 'argv',
0x00000334: 'heap_base',
0x00000338: '_arm_read_cpsr',
0x00000350: '_arm_read_ifsr',
0x00000358: '_arm_read_dfsr',
0x00000360: '_arm_write_l2_aux_cr',
0x0000036C: '_arm_read_ifar',
0x00000374: '_arm_read_extended_feature_regs',
0x000003CC: '_arm_read_memory_model_feature_regs',
0x000003E8: '_arm_read_instruction_set_attribute_regs',
0x00000410: '_arm_read_cr',
0x00000418: '_arm_write_cr',
0x00000424: '_arm_read_aux_cr',
0x0000042C: '_arm_write_aux_cr',
0x00000438: '_arm_write_dar',
0x00000444: '_arm_write_ttb',
0x00000450: '_arm_write_ttbcr',
0x0000045C: '_arm_read_dfar',
0x00000464: '_arm_read_main_id',
0x0000046C: '_arm_read_cache_id',
0x00000474: '_arm_read_cache_level_id',
0x00000484: '_arm_write_user_rw_tid',
0x00000490: '_arm_read_fpexc',
0x000004A0: '_arm_read_fpscr',
0x000004F4: '_arm_read_cache_size_selection',
0x000004FC: '_arm_write_user_ro_tid',
0x00000508: '_arm_read_pmreg',
0x000005CC: '_arm_write_pmreg',
0x00000690: '_arm_read_cache_size_id',
0x00000698: '_arm_write_sup_tid',
0x000006A4: '_arm_read_l2_aux_cr',
0x000006AC: '_arm_write_perip_port_remap',
0x000006B8: '_arm_read_user_rw_tid',
0x000006C0: '_arm_write_dprot_region_8',
0x000006CC: '_arm_read_user_ro_tid',
0x000006D4: '_arm_write_data_prot_register',
0x000006E0: '_arm_flush_tlbs',
0x000006F4: 'nullsub_4',
0x00000798: '_arm_write_ins_prot_register',
0x000007A4: '_arm_write_cacheable_registers',
0x000007B4: '_arm_write_bufferable_register',
0x000007F0: '_arch_restore_ints',
0x0000080C: '_arm_enable_fiqs',
0x0000081C: '_arm_disable_fiqs',
0x0000082C: '_arm_read_sup_tid',
0x00000834: '_arm_write_vbar',
0x0000083C: '_arm_flush_branch_predictor',
0x0000084C: '_arm_memory_barrier',
0x00000854: '_arch_halt',
0x00000860: '_arch_spin',
0x00000868: '_main',
0x000014B0: '_timer_get_ticks',
0x000014B4: '_aic_get_ticks',
0x000014CC: '_aic_spin',
0x000014E8: '_timer_ticks_to_usecs',
0x000014F8: '_timer_usecs_to_ticks',
0x00001508: '_timer_get_entropy',
0x00001AD0: '_usbphy_enable_pullup',
0x00001C88: 'jpt_1C84',
0x00001ED4: '__src',
0x000026C8: 'synopsys_otg_controller_init',
0x00002840: '_synopsys_otg_get_connection_speed',
0x00002A78: '_synopsys_otg_is_endpoint_stalled',
0x00003444: '_synopsys_otg_go_on_bus',
0x000037B0: '_synopsys_otg_start_ep0_out',
0x00003B34: 'verify_img4_whatever',
0x00004514: 'aNrpdxekeyekeorpeceseorpdtsgdlodsmodscicedicegcnbbesccescnrpcorpc',
0x000046B4: 'platform_cache_operation',
0x0000475C: 'j_j__arm_memory_barrier',
0x00004784: 'j__chipid_get_minimum_epoch',
0x00004788: 'platform_get_usb_product_id',
0x000047A0: 'platform_get_usb_product_string',
0x000047A8: 'platform_get_usb_serial_number_string',
0x00004888: 'platform_get_usb_more_other_string',
0x000050E4: 'platform_init_setup_clocks',
0x00005100: 'platform_init_hwpins',
0x0000527C: 'platform_init_internal_mem',
0x00005288: 'platform_quiesce_hardware',
0x000052A0: 'platform_bootprep',
0x00005308: 'chipid_clear_production_mode',
0x00005374: '_platform_init_setup_clocks',
0x00005390: 'platform_get_boot_device',
0x000053AA: 'jpt_53A6',
0x000053E4: 'def_53A6',
0x000053EC: 'platform_enable_boot_interface',
0x000054CC: 'platform_set_dfu_status',
0x000054D8: 'platform_get_force_dfu',
0x000054EC: 'platform_get_request_dfu1',
0x00005504: 'platform_get_request_dfu2',
0x00005864: 'platform_get_boot_trampoline',
0x00005888: '__dst',
0x00005894: '_chipid_get_production_mode',
0x000058D4: '_chipid_get_security_domain',
0x000058E4: '_chipid_get_board_id',
0x000058F4: '_chipid_get_minimum_epoch',
0x000059A8: '_charger_has_external',
0x000059AC: 'chipid_set_fuse_lock',
0x00005F3C: 'jpt_5F38',
0x00005F46: 'def_5F38',
0x00005FD8: 'halt',
0x00005FE4: 'nullsub_1',
0x00005FE8: '_platform_power_spin',
0x00005FEC: 'platform_watchdog_tickle',
0x0000601C: '_prepare_and_jump',
0x00006188: '_callout_dequeue',
0x0000624C: '_debug_init',
0x00006264: 'nullsub_3',
0x00006268: '__panic',
0x00006350: 'doublePanicIn',
0x00006354: 'panicMacro',
0x000063A0: 'usb_controller_start',
0x000063FC: 'platform_get_usb_cable_connected',
0x0000648C: '_enter_critical_section',
0x000064C8: '_exit_critical_section',
0x0000681C: '_task_get_current_task',
0x00006890: 'list_delete',
0x000068C8: 'task_yield',
0x0000698C: 'insert_run_q_tail',
0x000069B0: 'task_start',
0x000069D4: 'task_exit',
0x00006A10: 'wait_queue_wake_all',
0x00006B24: 'wait_queue_wake_one',
0x00006B54: '_list_remove_head',
0x00006B6C: 'event_init',
0x00006B7C: 'event_signal',
0x00006CE0: '_deep_idle_timeout',
0x00006CEC: '_system_time',
0x00006CFC: '_time_has_elapsed',
0x00006D34: '_spin',
0x00006D74: 'security_init',
0x00006EB8: '_security_set_production_override',
0x0000701C: '_arm_clean_dcache_line',
0x000070A4: '_arm_clean_invalidate_dcache_line',
0x000070B0: '_arm_clean_invalidate_dcache',
0x00007108: '_arm_clean_dcache',
0x00007160: '_arm_invalidate_dcache',
0x00007230: '_arm_invalidate_icache',
0x00007258: '_arm_drain_write_buffer',
0x000072C8: '_arm_mmu_map_section_range',
0x00007320: 'jpt_731C',
0x0000738C: 'def_731C',
0x000073E0: '_arm_mmu_init',
0x0000742C: '_arm_fp_init',
0x0000745C: 'arch_cpu_init',
0x000074B8: '_arch_cpu_quiesce',
0x000074E0: '_clocks_init',
0x00007510: '_arch_get_entropy',
0x00007540: 'arm_irq',
0x000075E8: 'arm_fiq',
0x00007690: 'arm_undefined',
0x000076C8: 'arm_syscall',
0x00007700: 'arm_prefetch_abort',
0x0000773C: 'arm_data_abort',
0x00007774: '___arm_reserved',
0x00007AF4: '_usb_init_with_controller',
0x00007B3C: '_usb_init',
0x00007B4C: '_usb_quiesce',
0x00007B74: '_usb_free',
0x00007B88: '_usb_controller_register',
0x00007BA8: '__b',
0x00007BAC: 'usb_controller_init',
0x00007BD0: '_usb_controller_stop',
0x00007BF4: '_usb_controller_deactivate_endpoint',
0x00007C18: 'usb_controller_stop',
0x00007C3C: 'usb_controller_set_address',
0x00007C60: 'usb_controller_get_connection_speed',
0x00007C84: 'usb_controller_do_endpoint_io',
0x00007CA8: 'usb_controller_stall_endpoint',
0x00007CCC: 'usb_controller_reset_endpoint_data_toggle',
0x00007CF0: 'usb_controller_do_test_mode',
0x00007D14: 'usb_controller_abort_endpoint',
0x00007D38: 'usb_controller_deactivate_endpoint',
0x00007D5C: 'usb_core_init',
0x00007DE8: 'usb_alloc_string_descriptor',
0x00007E34: 'usb_create_string_descriptor',
0x00007E68: 'usb_core_start',
0x00008104: 'usb_core_register_interface',
0x0000811C: 'usb_core_handle_usb_control_receive',
0x000081D6: 'jpt_81D2',
0x000082D6: 'jpt_82D2',
0x0000844C: 'def_81D2',
0x000084C8: 'usb_core_event_handler',
0x00008584: 'usb_core_complete_endpoint_io',
0x000085A0: 'usb_core_do_transfer',
0x00008618: 'usb_core_deactivate_endpoint',
0x0000862C: 'usb_core_stop',
0x0000863C: '_usb_core_free',
0x000086AC: 'handle_test_mode_request',
0x000086B8: '_getDFUImage',
0x000086E8: '_usb_dfu_init',
0x0000877C: 'handle_interface_request',
0x000088C8: 'data_received',
0x00008958: 'handle_bus_reset',
0x00008970: '_usb_dfu_exit',
0x00008A00: 'image_load',
0x00009320: '_siphash_aligned',
0x00009454: 'def_945E',
0x00009462: 'jpt_945E',
0x00009690: '_required_size',
0x000096DC: '_verify_block_checksum',
0x00009734: '_heap_free',
0x000098A4: '_calculate_block_checksum',
0x000098BC: '_heap_memalign',
0x00009A80: '_alloc_ep0_device_io_request',
0x00009AB0: '_heap_panic',
0x00009AC0: '_verify_block_padding',
0x00009B10: '_free_list_add',
0x00009C5C: 'heap_verify',
0x00009E18: 'j__heap_free',
0x0000A016: 'jpt_A012',
0x0000A044: 'def_A012',
0x0000A098: 'jpt_A094',
0x0000A618: '_vsnprintf',
0x0000A784: '_longlong_to_hexstring',
0x0000A7BC: 'kAsciiHexChars',
0x0000A7C4: '___vsnprintf_chk',
0x0000A7FC: '_puts',
0x0000A824: '_putchar',
0x0000A840: '___strlcat_chk',
0x0000A85C: '___stack_chk_fail',
0x0000A884: '_memcpy',
0x0000ABB0: '_memset',
0x0000ABC8: '_bzero',
0x0000ACC0: '_strlen',
0x0000AD28: '_amc_phy_run_dll_update',
0x0000AD74: '_strlcat',
0x0000ADD0: '_strlcpy',
0x0000B068: '_DERParseBitString',
0x0000B08C: '_DERParseBoolean',
0x0000B0B0: '_DERParseInteger',
0x0000B0F4: '_DERParseInteger64',
0x0000B160: '_DERDecodeSeqInit',
0x0000B1B8: '_DERDecodeSeqContentInit',
0x0000B1C8: '_DERDecodeSeqNext',
0x0000B210: '_DERParseSequence',
0x0000B270: '_DERParseSequenceContent',
0x0000B398: '_Img4DecodeParseLengthFromBuffer',
0x0000B3C4: '_random_get_bytes',
0x0000B3E4: '_mib_get_u32',
0x0000B410: '_random_get_bytes_internal',
0x0000B500: '_random_get_bytes_noheap',
0x0000B530: '_chipid_get_current_production_mode',
0x0000B534: '_platform_get_raw_production_mode',
0x0000B538: '_platform_get_security_domain',
0x0000B554: 'j__chipid_get_minimum_epoch_0',
0x0000B558: '_platform_get_chip_id',
0x0000B560: '_platform_get_ecid_image_personalization_required',
0x0000B564: '_platform_get_entropy',
0x0000B568: '_platform_get_usb_vendor_id',
0x0000B570: '_power_needs_precharge',
0x0000B574: '_platform_halt',
0x0000B578: '_platform_deep_idle',
0x0000B57C: '_platform_get_usb_manufacturer_string',
0x0000B584: '_platform_get_usb_device_version',
0x0000B588: '_platform_get_fuse_modes',
0x0000B5A4: '_DERImg4DecodeFindInSequence',
0x0000B5E8: '_DERImg4DecodeContentFindItemWithTag',
0x0000B614: '_DERImg4DecodeTagCompare',
0x0000B650: '_DERImg4Decode',
0x0000B77C: '_DERImg4DecodeUnsignedManifest',
0x0000B900: '_Img4DecodeInitUnsignedManifest',
0x0000BB90: '_Img4DecodeGetBooleanFromSection',
0x0000BBE0: '_Img4DecodeGetPropertyFromSection',
0x0000BCA0: '_Img4DecodeGetPropertyBoolean',
0x0000BD20: '_Img4DecodeEvaluateCertificateProperties',
0x0000BEDC: '_Img4DecodeEvaluateDictionaryProperties',
0x0001053C: '_arch_get_entropy$shim',
0x00010548: 'j__arm_clean_invalidate_dcache',
0x00010554: '_arm_clean_invalidate_dcache_line_2',
0x00010560: 'j__arm_clean_dcache',
0x00010578: '_platform_get_chip_revision',
0x00010584: '_arm_flush_tlbs$shim',
0x00010590: '_arm_write_cp_access_cr$shim',
0x000105A8: 'j__arm_enable_fiqs',
0x000105B4: '_strlen$shim',
0x000105C0: '_arch_halt$shim',
0x00010600: 'aNor0',
0x00010605: 'nil',
0x00010606: 'aUsb',
0x0001060A: 'aImg4',
0x0001060F: 'aIm4p',
0x00010614: 'aAppleMobileDeviceDfuMode',
0x00010633: 'aCpid04xCprv02xCpfm02xScep02xBdid02xEcid016llxI',
0x0001067C: 'aSrtgS',
0x00010687: 'aNonc',
0x0001068E: 'a02x',
0x00010693: 'aSnon',
0x0001069A: 'aDoublePanicIn',
0x000106AE: 'aPanic',
0x000106BA: 'aIdleTask',
0x000106C4: 'aNull',
0x000106CB: 'aPtr',
0x000106D1: 'a0x',
0x000106D8: 'aAppleInc',
0x00012074: 'a0123456789abcdef',
0x488001E0: 'current_task',
0x48800388: 'aBootstrap_0',
0x4880039C: 'a2kst',
0x488003C2: 'usb_core_device_descriptor',
0x488004A6: 'a0k10',
0x488004AE: 'aU',
0x488004B3: 'aAppleSecureBootRootCaG21',
0x488004DC: 'aAppleInc10',
0x488004F1: 'aUs0',
0x488004F7: 'a141219201310z',
0x48800506: 'a341214201310z0k10',
0x48800520: 'aAppleSecureBootRootCaG21_0',
0x48800549: 'aAppleInc10_0',
0x4880055E: 'aUs0_0',
0x48800563: 'a0',
0x4880056A: 'aH',
0x48802AE8: 'aCpid8004Cprv10Cpfm03Scep01Bdid1eEcid0015243e0e100026',
0x48802B67: 'aNonc38876290c433a5c8c1f7cf74d0bcef20cec156411cbf654cd5cf957ee6',
0x48802F30: 'aKatskatskatskatskatskatskatskatskatskatskatskatskatskatskatskats_0',
0x48805F1F: 'aHex',
0x48805F28: 'aQx',
0x48805F2C: 'aKats',
0x488060F0: 'aIdleTask_1',
0x48806104: 'a2kst_1',
0x48806171: 'usb_inited',
0x48806174: 'controller_functions',
0x488061AC: 'usb_configuration_string_desc_index',
0x488061C0: 'ep0_tx_buffer',
0x488062D0: 'nonce_string_desc',
0x488062D8: 'registered_interfaces_count',
0x48806330: 'usb_dfu_inited',
0x48807BA1: 'ebolink',
0x48810240: 'aApppplleeMmoobbiilleeDdeevviicceeDdffuuMmooddee',
0x48810448: 'aUsb_0',
0x488104C0: 'aKatskatskatskatskatskatskatskatskatskatskatskatskatskatskatskats',
0x48811500: 'aCmemcmem',
0x48811645: 'aPwndCheckm8' }
</pre>

[[Category:Bootrom]]

Bootrom 2651.0.0.3.3

2020-08-08T01:58:12Z

Kritanta: Segmentation info, Type info

This is the [[bootrom]] version found in the [[Apple Watch Series 3]]. It is vulnerable to [[Checkm8_Exploit|Checkm8]].

== Segmentation/Loading ==

All of these segments are arbitrary and nonexistient, and only serve the purpose of helping you navigate the db more easily.

The SecureROM image segmentation is based on iBoot.sys mapping.

Dump from device:
0x0-0x1FFFF
0x48100000-0x48200000
0x48650000-0x48651000
0x48800000-0x48820000
0x49100000-0x49120000

Load each into decompiler

Segments:
__text: 0x00000000 - 0x105CC
__TEXT_hidden: 0x000105CC - 0x00010600
__cstring: 0x00010600 - 0x000106E2
__const: 0x000106E2 - 0x000149DE
__zerofill: 0x000149DE - 0x0001FFFF

RAM: 0x48100000-0x48200000
MEM: 0x48650000-0x48651000
SRAM: 0x48800000-0x48820000
SMEM: 0x49100000-0x49120000

== Types ==

Some type info is available here, and can be loaded into IDA via "Load -> C Header":

https://github.com/KritantaDev/iBootLoader/blob/master/iBootStrap/iBoot.h

== Symbols ==

<pre>
#
# Symbols found by _kritanta
# For: iBoot-2651.0.0.3.3 ROMRELEASE for t8004si
# Report any mistakes here: https://github.com/KritantaDev/timestop/blob/master/Symbols/ROM/t8004
#
# This file is in python format for ease of loading
#
# You can probably use this to bindiff symbols to most other roms
#

symbols = {
0x00000000: 'start',
0x00000040: 'reset',
0x0000005C: 'relocate_loop',
0x00000078: 'relocate_data',
0x000000A0: 'relocate_data_loop',
0x000000B0: 'stack_setup',
0x00000188: 'bss_loop',
0x00000194: 'bss_done',
0x000001A0: 'spin',
0x00000200: 'aSecureromForT8004siCopyright20072014AppleInc',
0x00000240: 'aRomrelease',
0x00000280: 'aIboot26510033_0',
0x00000300: 'Description',
0x00000304: 'ReleaseCategory',
0x00000308: 'iBootVersion',
0x0000030C: 'main',
0x00000310: 'Start',
0x0000031C: 'sram_start',
0x00000328: 'argv',
0x00000334: 'heap_base',
0x00000338: '_arm_read_cpsr',
0x00000350: '_arm_read_ifsr',
0x00000358: '_arm_read_dfsr',
0x00000360: '_arm_write_l2_aux_cr',
0x0000036C: '_arm_read_ifar',
0x00000374: '_arm_read_extended_feature_regs',
0x000003CC: '_arm_read_memory_model_feature_regs',
0x000003E8: '_arm_read_instruction_set_attribute_regs',
0x00000410: '_arm_read_cr',
0x00000418: '_arm_write_cr',
0x00000424: '_arm_read_aux_cr',
0x0000042C: '_arm_write_aux_cr',
0x00000438: '_arm_write_dar',
0x00000444: '_arm_write_ttb',
0x00000450: '_arm_write_ttbcr',
0x0000045C: '_arm_read_dfar',
0x00000464: '_arm_read_main_id',
0x0000046C: '_arm_read_cache_id',
0x00000474: '_arm_read_cache_level_id',
0x00000484: '_arm_write_user_rw_tid',
0x00000490: '_arm_read_fpexc',
0x000004A0: '_arm_read_fpscr',
0x000004F4: '_arm_read_cache_size_selection',
0x000004FC: '_arm_write_user_ro_tid',
0x00000508: '_arm_read_pmreg',
0x000005CC: '_arm_write_pmreg',
0x00000690: '_arm_read_cache_size_id',
0x00000698: '_arm_write_sup_tid',
0x000006A4: '_arm_read_l2_aux_cr',
0x000006AC: '_arm_write_perip_port_remap',
0x000006B8: '_arm_read_user_rw_tid',
0x000006C0: '_arm_write_dprot_region_8',
0x000006CC: '_arm_read_user_ro_tid',
0x000006D4: '_arm_write_data_prot_register',
0x000006E0: '_arm_flush_tlbs',
0x000006F4: 'nullsub_4',
0x00000798: '_arm_write_ins_prot_register',
0x000007A4: '_arm_write_cacheable_registers',
0x000007B4: '_arm_write_bufferable_register',
0x000007F0: '_arch_restore_ints',
0x0000080C: '_arm_enable_fiqs',
0x0000081C: '_arm_disable_fiqs',
0x0000082C: '_arm_read_sup_tid',
0x00000834: '_arm_write_vbar',
0x0000083C: '_arm_flush_branch_predictor',
0x0000084C: '_arm_memory_barrier',
0x00000854: '_arch_halt',
0x00000860: '_arch_spin',
0x00000868: '_main',
0x000014B0: '_timer_get_ticks',
0x000014B4: '_aic_get_ticks',
0x000014CC: '_aic_spin',
0x000014E8: '_timer_ticks_to_usecs',
0x000014F8: '_timer_usecs_to_ticks',
0x00001508: '_timer_get_entropy',
0x00001AD0: '_usbphy_enable_pullup',
0x00001C88: 'jpt_1C84',
0x00001ED4: '__src',
0x000026C8: 'synopsys_otg_controller_init',
0x00002840: '_synopsys_otg_get_connection_speed',
0x00002A78: '_synopsys_otg_is_endpoint_stalled',
0x00003444: '_synopsys_otg_go_on_bus',
0x000037B0: '_synopsys_otg_start_ep0_out',
0x00003B34: 'verify_img4_whatever',
0x00004514: 'aNrpdxekeyekeorpeceseorpdtsgdlodsmodscicedicegcnbbesccescnrpcorpc',
0x000046B4: 'platform_cache_operation',
0x0000475C: 'j_j__arm_memory_barrier',
0x00004784: 'j__chipid_get_minimum_epoch',
0x00004788: 'platform_get_usb_product_id',
0x000047A0: 'platform_get_usb_product_string',
0x000047A8: 'platform_get_usb_serial_number_string',
0x00004888: 'platform_get_usb_more_other_string',
0x000050E4: 'platform_init_setup_clocks',
0x00005100: 'platform_init_hwpins',
0x0000527C: 'platform_init_internal_mem',
0x00005288: 'platform_quiesce_hardware',
0x000052A0: 'platform_bootprep',
0x00005308: 'chipid_clear_production_mode',
0x00005374: '_platform_init_setup_clocks',
0x00005390: 'platform_get_boot_device',
0x000053AA: 'jpt_53A6',
0x000053E4: 'def_53A6',
0x000053EC: 'platform_enable_boot_interface',
0x000054CC: 'platform_set_dfu_status',
0x000054D8: 'platform_get_force_dfu',
0x000054EC: 'platform_get_request_dfu1',
0x00005504: 'platform_get_request_dfu2',
0x00005864: 'platform_get_boot_trampoline',
0x00005888: '__dst',
0x00005894: '_chipid_get_production_mode',
0x000058D4: '_chipid_get_security_domain',
0x000058E4: '_chipid_get_board_id',
0x000058F4: '_chipid_get_minimum_epoch',
0x000059A8: '_charger_has_external',
0x000059AC: 'chipid_set_fuse_lock',
0x00005F3C: 'jpt_5F38',
0x00005F46: 'def_5F38',
0x00005FD8: 'halt',
0x00005FE4: 'nullsub_1',
0x00005FE8: '_platform_power_spin',
0x00005FEC: 'platform_watchdog_tickle',
0x0000601C: '_prepare_and_jump',
0x00006188: '_callout_dequeue',
0x0000624C: '_debug_init',
0x00006264: 'nullsub_3',
0x00006268: '__panic',
0x00006350: 'doublePanicIn',
0x00006354: 'panicMacro',
0x000063A0: 'usb_controller_start',
0x000063FC: 'platform_get_usb_cable_connected',
0x0000648C: '_enter_critical_section',
0x000064C8: '_exit_critical_section',
0x0000681C: '_task_get_current_task',
0x00006890: 'list_delete',
0x000068C8: 'task_yield',
0x0000698C: 'insert_run_q_tail',
0x000069B0: 'task_start',
0x000069D4: 'task_exit',
0x00006A10: 'wait_queue_wake_all',
0x00006B24: 'wait_queue_wake_one',
0x00006B54: '_list_remove_head',
0x00006B6C: 'event_init',
0x00006B7C: 'event_signal',
0x00006CE0: '_deep_idle_timeout',
0x00006CEC: '_system_time',
0x00006CFC: '_time_has_elapsed',
0x00006D34: '_spin',
0x00006D74: 'security_init',
0x00006EB8: '_security_set_production_override',
0x0000701C: '_arm_clean_dcache_line',
0x000070A4: '_arm_clean_invalidate_dcache_line',
0x000070B0: '_arm_clean_invalidate_dcache',
0x00007108: '_arm_clean_dcache',
0x00007160: '_arm_invalidate_dcache',
0x00007230: '_arm_invalidate_icache',
0x00007258: '_arm_drain_write_buffer',
0x000072C8: '_arm_mmu_map_section_range',
0x00007320: 'jpt_731C',
0x0000738C: 'def_731C',
0x000073E0: '_arm_mmu_init',
0x0000742C: '_arm_fp_init',
0x0000745C: 'arch_cpu_init',
0x000074B8: '_arch_cpu_quiesce',
0x000074E0: '_clocks_init',
0x00007510: '_arch_get_entropy',
0x00007540: 'arm_irq',
0x000075E8: 'arm_fiq',
0x00007690: 'arm_undefined',
0x000076C8: 'arm_syscall',
0x00007700: 'arm_prefetch_abort',
0x0000773C: 'arm_data_abort',
0x00007774: '___arm_reserved',
0x00007AF4: '_usb_init_with_controller',
0x00007B3C: '_usb_init',
0x00007B4C: '_usb_quiesce',
0x00007B74: '_usb_free',
0x00007B88: '_usb_controller_register',
0x00007BA8: '__b',
0x00007BAC: 'usb_controller_init',
0x00007BD0: '_usb_controller_stop',
0x00007BF4: '_usb_controller_deactivate_endpoint',
0x00007C18: 'usb_controller_stop',
0x00007C3C: 'usb_controller_set_address',
0x00007C60: 'usb_controller_get_connection_speed',
0x00007C84: 'usb_controller_do_endpoint_io',
0x00007CA8: 'usb_controller_stall_endpoint',
0x00007CCC: 'usb_controller_reset_endpoint_data_toggle',
0x00007CF0: 'usb_controller_do_test_mode',
0x00007D14: 'usb_controller_abort_endpoint',
0x00007D38: 'usb_controller_deactivate_endpoint',
0x00007D5C: 'usb_core_init',
0x00007DE8: 'usb_alloc_string_descriptor',
0x00007E34: 'usb_create_string_descriptor',
0x00007E68: 'usb_core_start',
0x00008104: 'usb_core_register_interface',
0x0000811C: 'usb_core_handle_usb_control_receive',
0x000081D6: 'jpt_81D2',
0x000082D6: 'jpt_82D2',
0x0000844C: 'def_81D2',
0x000084C8: 'usb_core_event_handler',
0x00008584: 'usb_core_complete_endpoint_io',
0x000085A0: 'usb_core_do_transfer',
0x00008618: 'usb_core_deactivate_endpoint',
0x0000862C: 'usb_core_stop',
0x0000863C: '_usb_core_free',
0x000086AC: 'handle_test_mode_request',
0x000086B8: '_getDFUImage',
0x000086E8: '_usb_dfu_init',
0x0000877C: 'handle_interface_request',
0x000088C8: 'data_received',
0x00008958: 'handle_bus_reset',
0x00008970: '_usb_dfu_exit',
0x00008A00: 'image_load',
0x00009320: '_siphash_aligned',
0x00009454: 'def_945E',
0x00009462: 'jpt_945E',
0x00009690: '_required_size',
0x000096DC: '_verify_block_checksum',
0x00009734: '_heap_free',
0x000098A4: '_calculate_block_checksum',
0x000098BC: '_heap_memalign',
0x00009A80: '_alloc_ep0_device_io_request',
0x00009AB0: '_heap_panic',
0x00009AC0: '_verify_block_padding',
0x00009B10: '_free_list_add',
0x00009C5C: 'heap_verify',
0x00009E18: 'j__heap_free',
0x0000A016: 'jpt_A012',
0x0000A044: 'def_A012',
0x0000A098: 'jpt_A094',
0x0000A618: '_vsnprintf',
0x0000A784: '_longlong_to_hexstring',
0x0000A7BC: 'kAsciiHexChars',
0x0000A7C4: '___vsnprintf_chk',
0x0000A7FC: '_puts',
0x0000A824: '_putchar',
0x0000A840: '___strlcat_chk',
0x0000A85C: '___stack_chk_fail',
0x0000A884: '_memcpy',
0x0000ABB0: '_memset',
0x0000ABC8: '_bzero',
0x0000ACC0: '_strlen',
0x0000AD28: '_amc_phy_run_dll_update',
0x0000AD74: '_strlcat',
0x0000ADD0: '_strlcpy',
0x0000B068: '_DERParseBitString',
0x0000B08C: '_DERParseBoolean',
0x0000B0B0: '_DERParseInteger',
0x0000B0F4: '_DERParseInteger64',
0x0000B160: '_DERDecodeSeqInit',
0x0000B1B8: '_DERDecodeSeqContentInit',
0x0000B1C8: '_DERDecodeSeqNext',
0x0000B210: '_DERParseSequence',
0x0000B270: '_DERParseSequenceContent',
0x0000B398: '_Img4DecodeParseLengthFromBuffer',
0x0000B3C4: '_random_get_bytes',
0x0000B3E4: '_mib_get_u32',
0x0000B410: '_random_get_bytes_internal',
0x0000B500: '_random_get_bytes_noheap',
0x0000B530: '_chipid_get_current_production_mode',
0x0000B534: '_platform_get_raw_production_mode',
0x0000B538: '_platform_get_security_domain',
0x0000B554: 'j__chipid_get_minimum_epoch_0',
0x0000B558: '_platform_get_chip_id',
0x0000B560: '_platform_get_ecid_image_personalization_required',
0x0000B564: '_platform_get_entropy',
0x0000B568: '_platform_get_usb_vendor_id',
0x0000B570: '_power_needs_precharge',
0x0000B574: '_platform_halt',
0x0000B578: '_platform_deep_idle',
0x0000B57C: '_platform_get_usb_manufacturer_string',
0x0000B584: '_platform_get_usb_device_version',
0x0000B588: '_platform_get_fuse_modes',
0x0000B5A4: '_DERImg4DecodeFindInSequence',
0x0000B5E8: '_DERImg4DecodeContentFindItemWithTag',
0x0000B614: '_DERImg4DecodeTagCompare',
0x0000B650: '_DERImg4Decode',
0x0000B77C: '_DERImg4DecodeUnsignedManifest',
0x0000B900: '_Img4DecodeInitUnsignedManifest',
0x0000BB90: '_Img4DecodeGetBooleanFromSection',
0x0000BBE0: '_Img4DecodeGetPropertyFromSection',
0x0000BCA0: '_Img4DecodeGetPropertyBoolean',
0x0000BD20: '_Img4DecodeEvaluateCertificateProperties',
0x0000BEDC: '_Img4DecodeEvaluateDictionaryProperties',
0x0001053C: '_arch_get_entropy$shim',
0x00010548: 'j__arm_clean_invalidate_dcache',
0x00010554: '_arm_clean_invalidate_dcache_line_2',
0x00010560: 'j__arm_clean_dcache',
0x00010578: '_platform_get_chip_revision',
0x00010584: '_arm_flush_tlbs$shim',
0x00010590: '_arm_write_cp_access_cr$shim',
0x000105A8: 'j__arm_enable_fiqs',
0x000105B4: '_strlen$shim',
0x000105C0: '_arch_halt$shim',
0x00010600: 'aNor0',
0x00010605: 'nil',
0x00010606: 'aUsb',
0x0001060A: 'aImg4',
0x0001060F: 'aIm4p',
0x00010614: 'aAppleMobileDeviceDfuMode',
0x00010633: 'aCpid04xCprv02xCpfm02xScep02xBdid02xEcid016llxI',
0x0001067C: 'aSrtgS',
0x00010687: 'aNonc',
0x0001068E: 'a02x',
0x00010693: 'aSnon',
0x0001069A: 'aDoublePanicIn',
0x000106AE: 'aPanic',
0x000106BA: 'aIdleTask',
0x000106C4: 'aNull',
0x000106CB: 'aPtr',
0x000106D1: 'a0x',
0x000106D8: 'aAppleInc',
0x00012074: 'a0123456789abcdef',
0x488001E0: 'current_task',
0x48800388: 'aBootstrap_0',
0x4880039C: 'a2kst',
0x488003C2: 'usb_core_device_descriptor',
0x488004A6: 'a0k10',
0x488004AE: 'aU',
0x488004B3: 'aAppleSecureBootRootCaG21',
0x488004DC: 'aAppleInc10',
0x488004F1: 'aUs0',
0x488004F7: 'a141219201310z',
0x48800506: 'a341214201310z0k10',
0x48800520: 'aAppleSecureBootRootCaG21_0',
0x48800549: 'aAppleInc10_0',
0x4880055E: 'aUs0_0',
0x48800563: 'a0',
0x4880056A: 'aH',
0x48802AE8: 'aCpid8004Cprv10Cpfm03Scep01Bdid1eEcid0015243e0e100026',
0x48802B67: 'aNonc38876290c433a5c8c1f7cf74d0bcef20cec156411cbf654cd5cf957ee6',
0x48802F30: 'aKatskatskatskatskatskatskatskatskatskatskatskatskatskatskatskats_0',
0x48805F1F: 'aHex',
0x48805F28: 'aQx',
0x48805F2C: 'aKats',
0x488060F0: 'aIdleTask_1',
0x48806104: 'a2kst_1',
0x48806171: 'usb_inited',
0x48806174: 'controller_functions',
0x488061AC: 'usb_configuration_string_desc_index',
0x488061C0: 'ep0_tx_buffer',
0x488062D0: 'nonce_string_desc',
0x488062D8: 'registered_interfaces_count',
0x48806330: 'usb_dfu_inited',
0x48807BA1: 'ebolink',
0x48810240: 'aApppplleeMmoobbiilleeDdeevviicceeDdffuuMmooddee',
0x48810448: 'aUsb_0',
0x488104C0: 'aKatskatskatskatskatskatskatskatskatskatskatskatskatskatskatskats',
0x48811500: 'aCmemcmem',
0x48811645: 'aPwndCheckm8' }
</pre>

[[Category:Bootrom]]

Bootrom 2651.0.0.3.3

2020-08-08T01:45:42Z

Kritanta: Today's /* Symbols */

This is the [[bootrom]] version found in the [[Apple Watch Series 3]]. It is vulnerable to [[Checkm8_Exploit|Checkm8]].

== Symbols ==

<pre>
#
# Symbols found by _kritanta
# For: iBoot-2651.0.0.3.3 ROMRELEASE for t8004si
# Report any mistakes here: https://github.com/KritantaDev/timestop/blob/master/Symbols/ROM/t8004
#
# This file is in python format for ease of loading
#
# You can probably use this to bindiff symbols to most other roms
#

symbols = {
0x00000000: 'start',
0x00000040: 'reset',
0x0000005C: 'relocate_loop',
0x00000078: 'relocate_data',
0x000000A0: 'relocate_data_loop',
0x000000B0: 'stack_setup',
0x00000188: 'bss_loop',
0x00000194: 'bss_done',
0x000001A0: 'spin',
0x00000200: 'aSecureromForT8004siCopyright20072014AppleInc',
0x00000240: 'aRomrelease',
0x00000280: 'aIboot26510033_0',
0x00000300: 'Description',
0x00000304: 'ReleaseCategory',
0x00000308: 'iBootVersion',
0x0000030C: 'main',
0x00000310: 'Start',
0x0000031C: 'sram_start',
0x00000328: 'argv',
0x00000334: 'heap_base',
0x00000338: '_arm_read_cpsr',
0x00000350: '_arm_read_ifsr',
0x00000358: '_arm_read_dfsr',
0x00000360: '_arm_write_l2_aux_cr',
0x0000036C: '_arm_read_ifar',
0x00000374: '_arm_read_extended_feature_regs',
0x000003CC: '_arm_read_memory_model_feature_regs',
0x000003E8: '_arm_read_instruction_set_attribute_regs',
0x00000410: '_arm_read_cr',
0x00000418: '_arm_write_cr',
0x00000424: '_arm_read_aux_cr',
0x0000042C: '_arm_write_aux_cr',
0x00000438: '_arm_write_dar',
0x00000444: '_arm_write_ttb',
0x00000450: '_arm_write_ttbcr',
0x0000045C: '_arm_read_dfar',
0x00000464: '_arm_read_main_id',
0x0000046C: '_arm_read_cache_id',
0x00000474: '_arm_read_cache_level_id',
0x00000484: '_arm_write_user_rw_tid',
0x00000490: '_arm_read_fpexc',
0x000004A0: '_arm_read_fpscr',
0x000004F4: '_arm_read_cache_size_selection',
0x000004FC: '_arm_write_user_ro_tid',
0x00000508: '_arm_read_pmreg',
0x000005CC: '_arm_write_pmreg',
0x00000690: '_arm_read_cache_size_id',
0x00000698: '_arm_write_sup_tid',
0x000006A4: '_arm_read_l2_aux_cr',
0x000006AC: '_arm_write_perip_port_remap',
0x000006B8: '_arm_read_user_rw_tid',
0x000006C0: '_arm_write_dprot_region_8',
0x000006CC: '_arm_read_user_ro_tid',
0x000006D4: '_arm_write_data_prot_register',
0x000006E0: '_arm_flush_tlbs',
0x000006F4: 'nullsub_4',
0x00000798: '_arm_write_ins_prot_register',
0x000007A4: '_arm_write_cacheable_registers',
0x000007B4: '_arm_write_bufferable_register',
0x000007F0: '_arch_restore_ints',
0x0000080C: '_arm_enable_fiqs',
0x0000081C: '_arm_disable_fiqs',
0x0000082C: '_arm_read_sup_tid',
0x00000834: '_arm_write_vbar',
0x0000083C: '_arm_flush_branch_predictor',
0x0000084C: '_arm_memory_barrier',
0x00000854: '_arch_halt',
0x00000860: '_arch_spin',
0x00000868: '_main',
0x000014B0: '_timer_get_ticks',
0x000014B4: '_aic_get_ticks',
0x000014CC: '_aic_spin',
0x000014E8: '_timer_ticks_to_usecs',
0x000014F8: '_timer_usecs_to_ticks',
0x00001508: '_timer_get_entropy',
0x00001AD0: '_usbphy_enable_pullup',
0x00001C88: 'jpt_1C84',
0x00001ED4: '__src',
0x000026C8: 'synopsys_otg_controller_init',
0x00002840: '_synopsys_otg_get_connection_speed',
0x00002A78: '_synopsys_otg_is_endpoint_stalled',
0x00003444: '_synopsys_otg_go_on_bus',
0x000037B0: '_synopsys_otg_start_ep0_out',
0x00003B34: 'verify_img4_whatever',
0x00004514: 'aNrpdxekeyekeorpeceseorpdtsgdlodsmodscicedicegcnbbesccescnrpcorpc',
0x000046B4: 'platform_cache_operation',
0x0000475C: 'j_j__arm_memory_barrier',
0x00004784: 'j__chipid_get_minimum_epoch',
0x00004788: 'platform_get_usb_product_id',
0x000047A0: 'platform_get_usb_product_string',
0x000047A8: 'platform_get_usb_serial_number_string',
0x00004888: 'platform_get_usb_more_other_string',
0x000050E4: 'platform_init_setup_clocks',
0x00005100: 'platform_init_hwpins',
0x0000527C: 'platform_init_internal_mem',
0x00005288: 'platform_quiesce_hardware',
0x000052A0: 'platform_bootprep',
0x00005308: 'chipid_clear_production_mode',
0x00005374: '_platform_init_setup_clocks',
0x00005390: 'platform_get_boot_device',
0x000053AA: 'jpt_53A6',
0x000053E4: 'def_53A6',
0x000053EC: 'platform_enable_boot_interface',
0x000054CC: 'platform_set_dfu_status',
0x000054D8: 'platform_get_force_dfu',
0x000054EC: 'platform_get_request_dfu1',
0x00005504: 'platform_get_request_dfu2',
0x00005864: 'platform_get_boot_trampoline',
0x00005888: '__dst',
0x00005894: '_chipid_get_production_mode',
0x000058D4: '_chipid_get_security_domain',
0x000058E4: '_chipid_get_board_id',
0x000058F4: '_chipid_get_minimum_epoch',
0x000059A8: '_charger_has_external',
0x000059AC: 'chipid_set_fuse_lock',
0x00005F3C: 'jpt_5F38',
0x00005F46: 'def_5F38',
0x00005FD8: 'halt',
0x00005FE4: 'nullsub_1',
0x00005FE8: '_platform_power_spin',
0x00005FEC: 'platform_watchdog_tickle',
0x0000601C: '_prepare_and_jump',
0x00006188: '_callout_dequeue',
0x0000624C: '_debug_init',
0x00006264: 'nullsub_3',
0x00006268: '__panic',
0x00006350: 'doublePanicIn',
0x00006354: 'panicMacro',
0x000063A0: 'usb_controller_start',
0x000063FC: 'platform_get_usb_cable_connected',
0x0000648C: '_enter_critical_section',
0x000064C8: '_exit_critical_section',
0x0000681C: '_task_get_current_task',
0x00006890: 'list_delete',
0x000068C8: 'task_yield',
0x0000698C: 'insert_run_q_tail',
0x000069B0: 'task_start',
0x000069D4: 'task_exit',
0x00006A10: 'wait_queue_wake_all',
0x00006B24: 'wait_queue_wake_one',
0x00006B54: '_list_remove_head',
0x00006B6C: 'event_init',
0x00006B7C: 'event_signal',
0x00006CE0: '_deep_idle_timeout',
0x00006CEC: '_system_time',
0x00006CFC: '_time_has_elapsed',
0x00006D34: '_spin',
0x00006D74: 'security_init',
0x00006EB8: '_security_set_production_override',
0x0000701C: '_arm_clean_dcache_line',
0x000070A4: '_arm_clean_invalidate_dcache_line',
0x000070B0: '_arm_clean_invalidate_dcache',
0x00007108: '_arm_clean_dcache',
0x00007160: '_arm_invalidate_dcache',
0x00007230: '_arm_invalidate_icache',
0x00007258: '_arm_drain_write_buffer',
0x000072C8: '_arm_mmu_map_section_range',
0x00007320: 'jpt_731C',
0x0000738C: 'def_731C',
0x000073E0: '_arm_mmu_init',
0x0000742C: '_arm_fp_init',
0x0000745C: 'arch_cpu_init',
0x000074B8: '_arch_cpu_quiesce',
0x000074E0: '_clocks_init',
0x00007510: '_arch_get_entropy',
0x00007540: 'arm_irq',
0x000075E8: 'arm_fiq',
0x00007690: 'arm_undefined',
0x000076C8: 'arm_syscall',
0x00007700: 'arm_prefetch_abort',
0x0000773C: 'arm_data_abort',
0x00007774: '___arm_reserved',
0x00007AF4: '_usb_init_with_controller',
0x00007B3C: '_usb_init',
0x00007B4C: '_usb_quiesce',
0x00007B74: '_usb_free',
0x00007B88: '_usb_controller_register',
0x00007BA8: '__b',
0x00007BAC: 'usb_controller_init',
0x00007BD0: '_usb_controller_stop',
0x00007BF4: '_usb_controller_deactivate_endpoint',
0x00007C18: 'usb_controller_stop',
0x00007C3C: 'usb_controller_set_address',
0x00007C60: 'usb_controller_get_connection_speed',
0x00007C84: 'usb_controller_do_endpoint_io',
0x00007CA8: 'usb_controller_stall_endpoint',
0x00007CCC: 'usb_controller_reset_endpoint_data_toggle',
0x00007CF0: 'usb_controller_do_test_mode',
0x00007D14: 'usb_controller_abort_endpoint',
0x00007D38: 'usb_controller_deactivate_endpoint',
0x00007D5C: 'usb_core_init',
0x00007DE8: 'usb_alloc_string_descriptor',
0x00007E34: 'usb_create_string_descriptor',
0x00007E68: 'usb_core_start',
0x00008104: 'usb_core_register_interface',
0x0000811C: 'usb_core_handle_usb_control_receive',
0x000081D6: 'jpt_81D2',
0x000082D6: 'jpt_82D2',
0x0000844C: 'def_81D2',
0x000084C8: 'usb_core_event_handler',
0x00008584: 'usb_core_complete_endpoint_io',
0x000085A0: 'usb_core_do_transfer',
0x00008618: 'usb_core_deactivate_endpoint',
0x0000862C: 'usb_core_stop',
0x0000863C: '_usb_core_free',
0x000086AC: 'handle_test_mode_request',
0x000086B8: '_getDFUImage',
0x000086E8: '_usb_dfu_init',
0x0000877C: 'handle_interface_request',
0x000088C8: 'data_received',
0x00008958: 'handle_bus_reset',
0x00008970: '_usb_dfu_exit',
0x00008A00: 'image_load',
0x00009320: '_siphash_aligned',
0x00009454: 'def_945E',
0x00009462: 'jpt_945E',
0x00009690: '_required_size',
0x000096DC: '_verify_block_checksum',
0x00009734: '_heap_free',
0x000098A4: '_calculate_block_checksum',
0x000098BC: '_heap_memalign',
0x00009A80: '_alloc_ep0_device_io_request',
0x00009AB0: '_heap_panic',
0x00009AC0: '_verify_block_padding',
0x00009B10: '_free_list_add',
0x00009C5C: 'heap_verify',
0x00009E18: 'j__heap_free',
0x0000A016: 'jpt_A012',
0x0000A044: 'def_A012',
0x0000A098: 'jpt_A094',
0x0000A618: '_vsnprintf',
0x0000A784: '_longlong_to_hexstring',
0x0000A7BC: 'kAsciiHexChars',
0x0000A7C4: '___vsnprintf_chk',
0x0000A7FC: '_puts',
0x0000A824: '_putchar',
0x0000A840: '___strlcat_chk',
0x0000A85C: '___stack_chk_fail',
0x0000A884: '_memcpy',
0x0000ABB0: '_memset',
0x0000ABC8: '_bzero',
0x0000ACC0: '_strlen',
0x0000AD28: '_amc_phy_run_dll_update',
0x0000AD74: '_strlcat',
0x0000ADD0: '_strlcpy',
0x0000B068: '_DERParseBitString',
0x0000B08C: '_DERParseBoolean',
0x0000B0B0: '_DERParseInteger',
0x0000B0F4: '_DERParseInteger64',
0x0000B160: '_DERDecodeSeqInit',
0x0000B1B8: '_DERDecodeSeqContentInit',
0x0000B1C8: '_DERDecodeSeqNext',
0x0000B210: '_DERParseSequence',
0x0000B270: '_DERParseSequenceContent',
0x0000B398: '_Img4DecodeParseLengthFromBuffer',
0x0000B3C4: '_random_get_bytes',
0x0000B3E4: '_mib_get_u32',
0x0000B410: '_random_get_bytes_internal',
0x0000B500: '_random_get_bytes_noheap',
0x0000B530: '_chipid_get_current_production_mode',
0x0000B534: '_platform_get_raw_production_mode',
0x0000B538: '_platform_get_security_domain',
0x0000B554: 'j__chipid_get_minimum_epoch_0',
0x0000B558: '_platform_get_chip_id',
0x0000B560: '_platform_get_ecid_image_personalization_required',
0x0000B564: '_platform_get_entropy',
0x0000B568: '_platform_get_usb_vendor_id',
0x0000B570: '_power_needs_precharge',
0x0000B574: '_platform_halt',
0x0000B578: '_platform_deep_idle',
0x0000B57C: '_platform_get_usb_manufacturer_string',
0x0000B584: '_platform_get_usb_device_version',
0x0000B588: '_platform_get_fuse_modes',
0x0000B5A4: '_DERImg4DecodeFindInSequence',
0x0000B5E8: '_DERImg4DecodeContentFindItemWithTag',
0x0000B614: '_DERImg4DecodeTagCompare',
0x0000B650: '_DERImg4Decode',
0x0000B77C: '_DERImg4DecodeUnsignedManifest',
0x0000B900: '_Img4DecodeInitUnsignedManifest',
0x0000BB90: '_Img4DecodeGetBooleanFromSection',
0x0000BBE0: '_Img4DecodeGetPropertyFromSection',
0x0000BCA0: '_Img4DecodeGetPropertyBoolean',
0x0000BD20: '_Img4DecodeEvaluateCertificateProperties',
0x0000BEDC: '_Img4DecodeEvaluateDictionaryProperties',
0x0001053C: '_arch_get_entropy$shim',
0x00010548: 'j__arm_clean_invalidate_dcache',
0x00010554: '_arm_clean_invalidate_dcache_line_2',
0x00010560: 'j__arm_clean_dcache',
0x00010578: '_platform_get_chip_revision',
0x00010584: '_arm_flush_tlbs$shim',
0x00010590: '_arm_write_cp_access_cr$shim',
0x000105A8: 'j__arm_enable_fiqs',
0x000105B4: '_strlen$shim',
0x000105C0: '_arch_halt$shim',
0x00010600: 'aNor0',
0x00010605: 'nil',
0x00010606: 'aUsb',
0x0001060A: 'aImg4',
0x0001060F: 'aIm4p',
0x00010614: 'aAppleMobileDeviceDfuMode',
0x00010633: 'aCpid04xCprv02xCpfm02xScep02xBdid02xEcid016llxI',
0x0001067C: 'aSrtgS',
0x00010687: 'aNonc',
0x0001068E: 'a02x',
0x00010693: 'aSnon',
0x0001069A: 'aDoublePanicIn',
0x000106AE: 'aPanic',
0x000106BA: 'aIdleTask',
0x000106C4: 'aNull',
0x000106CB: 'aPtr',
0x000106D1: 'a0x',
0x000106D8: 'aAppleInc',
0x00012074: 'a0123456789abcdef',
0x488001E0: 'current_task',
0x48800388: 'aBootstrap_0',
0x4880039C: 'a2kst',
0x488003C2: 'usb_core_device_descriptor',
0x488004A6: 'a0k10',
0x488004AE: 'aU',
0x488004B3: 'aAppleSecureBootRootCaG21',
0x488004DC: 'aAppleInc10',
0x488004F1: 'aUs0',
0x488004F7: 'a141219201310z',
0x48800506: 'a341214201310z0k10',
0x48800520: 'aAppleSecureBootRootCaG21_0',
0x48800549: 'aAppleInc10_0',
0x4880055E: 'aUs0_0',
0x48800563: 'a0',
0x4880056A: 'aH',
0x48802AE8: 'aCpid8004Cprv10Cpfm03Scep01Bdid1eEcid0015243e0e100026',
0x48802B67: 'aNonc38876290c433a5c8c1f7cf74d0bcef20cec156411cbf654cd5cf957ee6',
0x48802F30: 'aKatskatskatskatskatskatskatskatskatskatskatskatskatskatskatskats_0',
0x48805F1F: 'aHex',
0x48805F28: 'aQx',
0x48805F2C: 'aKats',
0x488060F0: 'aIdleTask_1',
0x48806104: 'a2kst_1',
0x48806171: 'usb_inited',
0x48806174: 'controller_functions',
0x488061AC: 'usb_configuration_string_desc_index',
0x488061C0: 'ep0_tx_buffer',
0x488062D0: 'nonce_string_desc',
0x488062D8: 'registered_interfaces_count',
0x48806330: 'usb_dfu_inited',
0x48807BA1: 'ebolink',
0x48810240: 'aApppplleeMmoobbiilleeDdeevviicceeDdffuuMmooddee',
0x48810448: 'aUsb_0',
0x488104C0: 'aKatskatskatskatskatskatskatskatskatskatskatskatskatskatskatskats',
0x48811500: 'aCmemcmem',
0x48811645: 'aPwndCheckm8' }
</pre>

[[Category:Bootrom]]

InternalUI Builds

2020-08-07T20:24:32Z

Kritanta: /* iPhone 12 */

{{internal software|firmware}}
This is a list of known Internal UI builds. Unlike [[Factory Firmware]], these builds have UI, like normal iOS builds.

== What Internal UI builds Are==
Internal UI builds are iOS, watchOS, iPadOS and tvOS builds that have features that aren't in normal builds.
These builds are for internal use within Apple and may be found on [[Prototypes]]. Internal UI builds often have experimental features and internal apps. You can learn more about internal apps [[Apple Internal Apps|here]].

== What is Desense?==
Desense is a slimmed down version of Internal UI. These builds have less apps installed. These builds are also less valuable because of the lack of apps. Desense builds have around 2 full pages of internal apps while regular internal ui builds often have 3 or more pages of internal apps.

== Screenshots from Internal UI builds ==
<gallery>
File: Brick_device_reupload.png| The brick device button on [[Innsbruck 11A465 (Internal UI build)|Innsbruck 11A465]]

File: InternalUI1.png|Homescreen
</gallery>

This is the list of known Internal UI builds.

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 3.0
| [[Kirkwood 7A187a| 7A187a]]
| Krikwood?
| ?
| From [https://twitter.com/1nsane_dev @1nsane_Dev] On twitter
|}
== [[N90AP|iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 4.0
| [[Apex 8A216|8A216]]
| Apex?
| ?
| -
|-
| 4.1
| [[Baker 8B117 (Internal build)|8B117]]
| Baker?
| 01.59.00
| From [https://micgadget.com/11604/exclusive-64gb-iphone-4-hands-on-video/ MicGadget].
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 5.0
| [[TellurideNanshan 9A2306f| 9A2306f]]
| TellurideNanshan
| Trek-1.0.00
| Originally found on [https://twitter.com/yrh04e/status/1153343446846976000?s=21 Twitter].
|-
| 5.0
| [[Telluride 9A334 (Internal build)|9A334]]
| Telluride?
| ?
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 6.0
| [[Sundance 10A405(InternalUI build)|10A405]]
| Sundance?
| ?
| Referenced by [[Sundance 10A525 (Internal Build)|Sundance 10A525]]
|-
| 6.0.1
| [[Sundance 10A525 (Internal Build)|10A525]]
| Sundance?
| ?
| -
|-
| 7.0
| [[Innsbruck 11A465 (Internal UI build)|11A465]]
| Innsbruck?
| ?
| From [https://mobile.twitter.com/URedditor @URedditor] On Twitter
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 10.0
| [[Whitetail 14A149|14A149]]
| Whitetail
| ?
| -
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 13.0
| [[Yukon 17A508|17A508]]
| Yukon
| 4.03.01
| From [https://twitter.com/CollectorApple @CollectorApple] On twitter
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 13.0
| [[Yukon 17A508|17A508]]
| Yukon
| 4.03.01
| From [https://twitter.com/CollectorApple CollectorApple] On twitter
|}

== [[iPhone XS Max]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 13.0
| [[Yukon 17A3457I|17A3457I]]
| Yukon?
| ?
| From [https://twitter.com/BenGeskin @BenGeskin] on twitter.
|}

== [[iPhone 12]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 14.0
| [[Azul 18A188|18A188]]
| Azul
| 1.05.14
| From [https://twitter.com/choco_bit @choco_bit] On twitter
|}

== [[K48AP|iPad 1]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 5.0
| [[Telluride 9A269|9A269]]
| Telluride?
| ?
| From [https://twitter.com/DongleBookPro @DongleBookPro] On twitter
|}

== [[J96AP|iPad Mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.3
| [[Stowe 12E61520g|12E61520g]]
| Stowe?
| ?
| From [https://twitter.com/Jin_Store @JinStore] On twitter
|}

IBUS

2020-08-07T17:02:51Z

Kritanta:

The "iBUS" adapter is a smaller "dongle" that takes advantage of the diagnostics port hidden behind a small plate in the slot where the band for your watch would normally slide into.

These adapters are sold by "MFC" and appear to be clones of Apple's own proprietary hardware; When plugged into a Mac via lightning-to-USB, the Apple Watch appears in Finder in the same way that other apple devices do when plugged in. It is also recognized by [[libimobiledevice]], Xcode, and Apple's Console.app, although no logs are displayed in the latter.

Not much information about these adapters has been released, by MFC or otherwise.

Adapters for the S4 and S5 have been announced as "upcoming"

== Usage for Research ==
While the adapters are marketed for their ability to "restore" devices, the signed firmware required to do so is not readily available. However, the adapter does allow exploitation of the S1, S2, and S3 Watches using [[checkm8]]

=== "Pwning" the watch and dumping the bootrom ===

==== Entering DFU ====
Once you've connected your apple watch via a standard USB Lightning cable and the iBUS adapter:

# Hold the crown and power button down
# Immediately after the screen goes black, count to 3
# After 3 seconds, release the power button, but continue to hold the crown.

Finder should now show an "Apple Watch" in DFU mode, and will allow you to install signed firmware if you have any.

==== Exploiting with ipwndfu ====
Reliability of checkm8 on the watch can vary.

After cloning [https://github.com/axi0mX/ipwndfu], `cd` into the directory and run `./ipwndfu -p`

If the exploit fails, you may need to run it again. It can take anywhere from one to several hundred attempts.

From here, you can run `./ipwndfu --dump-rom` to dump the [[SecureRom]]. More information is available in the ipwndfu readme and on [[ipwndfu]].

Do note the `--boot` flag currently only works for the iPhone X.

You can use `./ipwndfu --hex-dump=0x0,0x10000000000` to crash out of DFU and force a reboot.

== Tips for usage ==
* As the metal rod that ships with the adapter often fits loosely, consider using rubber bands to firmly press the adapter into the port.
** A hairband is exceptional at this, and perfectly fits into the top of the watch.

{{DISPLAYTITLE:iBUS}}

NonUI builds

2020-08-07T16:52:36Z

Kritanta: /* iPhone 12 Pro Plus? */

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|130px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|130px|left|"Skankwerk" logo on 6.x and below]]
[[File:iphxr_skankwerk.jpeg|thumb|130px|right|Prototype showing newer Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|130px|left|Prototype showing older Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="4" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| 1.1.3
| [[Alpine 4A102a|4A102a]]
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| rowspan="2" | Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 5.0
| [[HoodooYabuli 9A2264r|9A2264r]]
| TellurideNanshan
| ?
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 1.0.10
| -
|-
| rowspan="2" | 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|-
| [[SundanceNanshan 10B63290m|10B63290m]]
| SundanceNanshan?
| ?
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| rowspan="2" | Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3”| 7.0
| [[InnsbruckTianshan 11A63840h|11A63840h]]
| InnsbruckTianshan
| ?
| From [https://mobile.twitter.com/mcg29_/status/1228064075189542922 @mcg29] on Twitter
|-
| [[Innsbruck 11A93840f|11A93840f]]
| InnsbruckAni?
| ?
| -
|-
| [[InnsbruckAni 11A93840l|11A93840l]]
| InnsbruckAni
| ?
| -
|-
| rowspan="2" | 7.1
| [[Sochi 11D31620l|11D31620l]]
| Sochi
| ?
| -
|-
| [[Sochi 11D31620u|11D31620u]]
| SochiYabuli
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 6.0
| [[Sundance 10A101|10A101]]
| Sundance?
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on twitter
|-
| rowspan="4" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| rowspan="2" | InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| ?
| -
|-
| [[InnsbruckNanshan 11A24581k|11A24581k]]
| InnsbruckNanshan?
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on twitter.
|-
| [[Innsbruck 11A93840f|11A93840f]]
| rowspan= “1” | InnsbruckAni?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
| 11.0
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="6" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| rowspan="2" | Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| rowspan="4" | OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93650z|12A93650z]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| 1.00.05
| -
|-
| 8.3
| [[Stowe 12F69|12F69]]
| Stowe?
| ?
| Seen on this Forum [https://www.ifixit.com/Answers/View/556870/What+soft+wear+is+on+this+iPhone+6]
|-
| rowspan="2" | 9.0
| [[MonarchSajo 13A83261u|13A83261u]]
| rowspan="2" | MonarchSajo
| ?
| From [https://twitter.com/CollectorApple @CollectorApple] on Twitter.
|-
| [[Monarch 13A83262c|13A83262c]]
| ?
| From [https://twitter.com/ThermalDOE @ThermalDOE] on Twitter.
|-
| 11.3
| [[Emet 15E61570m|15E61570m]]
| Emet?
| ?
| From [https://twitter.com/mcg29_ @mcg29] on Twitter
|}

== [[iPhone 6 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 8.0
| [[OkemoAni 12A22121a |12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A23410x|12A23410x]]
| Okemo?
| ?
| from [https://mobile.twitter.com/DongleBookPro @DongleBookPro] on Twitter
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="6" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[MonarchAni 13A93051r|13A93051r]]
| MonarchAni?
| ?
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| rowspan="3" | Monarch?
| ?
| -
|-
| [[Monarch 13A93420i|13A93420i]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[Monarch 13A93420m|13A93420m]]
| 1.00.05
| -
|-
| 10.0
| [[Whitetail 14A83432m|14A83432m]]
| Whitetail?
| ?
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter.
|}

== [[iPhone 6s Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchNanshan 13A23161b|13A23161b]]
| MonarchNanshan
| ?
| -
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| rowspan="3" | Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| rowspan="2" | WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| ?
| -
|-
| 10.0.1
| [[BigShot 14Z1062|14Z1062]]
| BigShot
| ?
| -
|}

== [[iPhone 7 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 10.0
| [[WhitetailAni 14A22161a|14A22161a]]
| rowspan="2" | WhitetailAni?
| ?
| -
|-
| [[WhitetailAni 14A22181a|14A22181a]]
| ?
| -
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|-
| [[TigrisAni 15A93720p|15A93720p]]
| TigrisAni?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[D21AP|iPhone 8 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A93260r|15A93260r]]
| rowspan="2" | TigrisAni?
| ?
| From [https://mobile.twitter.com/1nsane_dev @1nsane_dev] on twitter
|-
| [[TigrisAni 15A93261f|15A93621f]]
| ?
| from [https://mobile.twitter.com/1nsane_dev @1nsane_dev ] on twitter
|}

== [[D22AP|iPhone X]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A783601x|15A783601x]]
| rowspan="2" | TigrisAni
| ?
| -
|-
| [[TigrisAni 15A783601y|15A783601y]]
| ?
| -
|}

== [[N841AP|iPhone XR]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 12.0
| [[Peace 16A13580z|16A13580z]]
| rowspan="3" | Peace
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev on twitter]
|-
| [[Peace 16A13581a|16A13581a]]
| ?
| From [https://twitter.com/ThermalDOE @ThermalDOE on twitter]
|-
| [[Peace 16A73281c|16A73281c]]
| ?
| -
|}

== [[D321AP|iPhone XS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 12.0
| [[PeaceAni 16A93020u|16A93020u]]
| PeaceAni
| ?
| -
|-
|}

== [[D331pAP|iPhone XS Max]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 12.0
| [[Peace 16A23250u|16A23250u]]
| rowspan="2" | Peace?
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev on twitter].
|-
| [[Peace 16A22481b|16A22481b]]
| ?
| From [https://twitter.com/YRH04E @YRH04E on twitter]
|-
|}

== [[D53AP|iPhone 12 Pro Plus?]] ==
{| class="wikitable"
|-
! Verison
! Build
! Codename
! Baseband
! Comments
|-
| 14.0
| [[Azul 18A311|18A311]]
| Azul
| ?
| From [https://twitter.com/BenGeskin @BenGeskin] On twitter
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| rowspan="2" | Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango
| ?
| -
|-
|}

== [[IPad_(5th_generation)|iPad (5th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2"|10.3
| [[Erie 14E61810k|14E61810k]]
| rowspan="2"|Erie?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[Erie 14E62210l|14E62210l]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| 10.3.2
| [[Franklin 14F60900i|14F60900i]]
| Franklin?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|}

== [[IPad_(6th_generation)|iPad (6th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.3
| [[Emet 15E61570m|15E61570m]]
| Emet?
| ?
| This iPad is the only device that started with 11.3, so it is safe to assume it is this device. From [https://twitter.com/mcg29_ @mcg29] on Twitter
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| rowspan="3" | SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| ?
| -
|-
|}

== [[J86AP|iPad Mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|-
| 10.3
| [[Erie 14E62210l|14E62210l]]
| Erie?
| ?
| -
|-
| 11.0
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
| 9.0.2
| [[MonarchTianshan 13A64520d|13A64520d]]
| MonarchTianshan
| 4.02.00
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
|}

== [[J210AP|iPad Mini (5th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 12.2
| [[PeaceEYabuli 16E31120n|16E31120n]]
| PeaceEYabuli?
| ?
| From [https://mobile.twitter.com/laobaitd?lang=en @Laobaitd on Twitter]
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[InnsbruckTaosYabuli 11B34210y|11B34210y]]
| InnsbruckTaosYabuli
| ?
| This is for the [[j72AP|iPad4,2]] model.
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[J82AP|iPad Air 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.1
| [[OkemoTaos 12B33610i| 12B33610i]]
| OkemoTaos?
| ?
| From journaldulapin.com [https://www.journaldulapin.com/2017/11/21/ebay-ipad/].
|}

== [[J217AP|iPad Air 3]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 12.2
| [[PeaceEYabuli 16E31120m|16E31120m]]
| PeaceEYabuli
| ?
| -
|}

== [[J98AP|iPad Pro (unreleased)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 9.0
| [[Monarch 13A165|13A165]]
| Monarch
| 2.15.00 (debug)
| This comes as a Restore Bundle, and is for J98/99AP
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| rowspan="2" | Inferno?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| -
|}

== [[N102AP|iPod touch (6th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Comments
|-
| 8.3
| [[CopperJade 12H1150f|12H1150f]]
| rowspan="2" | CopperJade
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter.
|-
| 8.4
| [[CopperJade 12H10570d|12H10570d]]
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter.
|}

[[Category:Firmware]] [[Category:Internal Firmware]]

Bootrom 2651.0.0.3.3

2020-08-07T16:49:26Z

Kritanta: /* Symbols */

This is the [[bootrom]] version found in the [[Apple Watch Series 3]]. It is vulnerable to [[Checkm8_Exploit|Checkm8]].

== Symbols ==

<pre>
#
# Symbols found by _kritanta
# For: iBoot-2651.0.0.3.3 ROMRELEASE for t8004si
# Report any mistakes here: https://github.com/KritantaDev/timestop/blob/master/Symbols/ROM/t8004
#
# This file is in python format for ease of loading
#
# You can probably use this to bindiff symbols to most other roms
#

symbols = {
0x00000000: 'start',
0x00000040: 'reset',
0x0000005C: 'relocate_loop',
0x00000078: 'relocate_data',
0x000000A0: 'relocate_data_loop',
0x000000B0: 'stack_setup',
0x00000188: 'bss_loop',
0x00000194: 'bss_done',
0x000001A0: 'spin',
0x00000200: 'aSecureromForT8004siCopyright20072014AppleInc',
0x00000240: 'aRomrelease',
0x00000280: 'aIboot26510033_0',
0x00000300: 'Description',
0x00000304: 'ReleaseCategory',
0x00000308: 'iBootVersion',
0x0000030C: 'main',
0x00000310: 'Start',
0x0000031C: 'sram_start',
0x00000328: 'argv',
0x00000334: 'heap_base',
0x00000338: '_arm_read_cpsr',
0x00000350: '_arm_read_ifsr',
0x00000358: '_arm_read_dfsr',
0x00000360: '_arm_write_l2_aux_cr',
0x0000036C: '_arm_read_ifar',
0x00000374: '_arm_read_extended_feature_regs',
0x000003CC: '_arm_read_memory_model_feature_regs',
0x000003E8: '_arm_read_instruction_set_attribute_regs',
0x00000410: '_arm_read_cr',
0x00000418: '_arm_write_cr',
0x00000424: '_arm_read_aux_cr',
0x0000042C: '_arm_write_aux_cr',
0x00000438: '_arm_write_dar',
0x00000444: '_arm_write_ttb',
0x00000450: '_arm_write_ttbcr',
0x0000045C: '_arm_read_dfar',
0x00000464: '_arm_read_main_id',
0x0000046C: '_arm_read_cache_id',
0x00000474: '_arm_read_cache_level_id',
0x00000484: '_arm_write_user_rw_tid',
0x00000490: '_arm_read_fpexc',
0x000004A0: '_arm_read_fpscr',
0x000004F4: '_arm_read_cache_size_selection',
0x000004FC: '_arm_write_user_ro_tid',
0x00000508: '_arm_read_pmreg',
0x000005CC: '_arm_write_pmreg',
0x00000690: '_arm_read_cache_size_id',
0x00000698: '_arm_write_sup_tid',
0x000006A4: '_arm_read_l2_aux_cr',
0x000006AC: '_arm_write_perip_port_remap',
0x000006B8: '_arm_read_user_rw_tid',
0x000006C0: '_arm_write_dprot_region_8',
0x000006CC: '_arm_read_user_ro_tid',
0x000006D4: '_arm_write_data_prot_register',
0x000006E0: '_arm_flush_tlbs',
0x000006F4: 'nullsub_4',
0x00000798: '_arm_write_ins_prot_register',
0x000007A4: '_arm_write_cacheable_registers',
0x000007B4: '_arm_write_bufferable_register',
0x000007F0: '_arch_restore_ints',
0x0000080C: '_arm_enable_fiqs',
0x0000081C: '_arm_disable_fiqs',
0x0000082C: '_arm_read_sup_tid',
0x00000834: '_arm_write_vbar',
0x0000083C: '_arm_flush_branch_predictor',
0x0000084C: '_arm_memory_barrier',
0x00000854: '_arch_halt',
0x00000860: '_arch_spin',
0x00000868: '_main',
0x000014B0: '_timer_get_ticks',
0x000014B4: '_aic_get_ticks',
0x000014CC: '_aic_spin',
0x000014E8: '_timer_ticks_to_usecs',
0x000014F8: '_timer_usecs_to_ticks',
0x00001508: '_timer_get_entropy',
0x00001AD0: '_usbphy_enable_pullup',
0x00001C88: 'jpt_1C84',
0x00001ED4: '__src',
0x00002840: '_synopsys_otg_get_connection_speed',
0x00002A78: '_synopsys_otg_is_endpoint_stalled',
0x00003444: '_synopsys_otg_go_on_bus',
0x000037B0: '_synopsys_otg_start_ep0_out',
0x00003B34: 'verify_img4_whatever',
0x00004514: 'aNrpdxekeyekeorpeceseorpdtsgdlodsmodscicedicegcnbbesccescnrpcorpc',
0x000046B4: 'platform_cache_operation',
0x0000475C: 'j_j__arm_memory_barrier',
0x00004784: 'j__chipid_get_minimum_epoch',
0x000050E4: 'platform_init_setup_clocks',
0x00005100: 'platform_init_hwpins',
0x0000527C: 'platform_init_internal_mem',
0x00005288: 'platform_quiesce_hardware',
0x000052A0: 'platform_bootprep',
0x00005308: 'chipid_clear_production_mode',
0x00005374: '_platform_init_setup_clocks',
0x00005390: 'platform_get_boot_device',
0x000053AA: 'jpt_53A6',
0x000053E4: 'def_53A6',
0x000053EC: 'platform_enable_boot_interface',
0x000054CC: 'platform_set_dfu_status',
0x000054D8: 'platform_get_force_dfu',
0x000054EC: 'platform_get_request_dfu1',
0x00005504: 'platform_get_request_dfu2',
0x00005864: 'platform_get_boot_trampoline',
0x00005888: '__dst',
0x00005894: '_chipid_get_production_mode',
0x000058D4: '_chipid_get_security_domain',
0x000058E4: '_chipid_get_board_id',
0x000058F4: '_chipid_get_minimum_epoch',
0x000059A8: '_charger_has_external',
0x000059AC: 'chipid_set_fuse_lock',
0x00005F3C: 'jpt_5F38',
0x00005F46: 'def_5F38',
0x00005FD8: 'halt',
0x00005FE4: 'nullsub_1',
0x00005FE8: '_platform_power_spin',
0x00005FEC: 'platform_watchdog_tickle',
0x0000601C: '_prepare_and_jump',
0x00006188: '_callout_dequeue',
0x0000624C: '_debug_init',
0x00006264: 'nullsub_3',
0x00006268: '__panic',
0x00006350: 'doublePanicIn',
0x00006354: 'panicMacro',
0x000063FC: 'platform_get_usb_cable_connected',
0x0000648C: '_enter_critical_section',
0x000064C8: '_exit_critical_section',
0x0000681C: '_task_get_current_task',
0x00006890: 'list_delete',
0x000068C8: 'task_yield',
0x0000698C: 'insert_run_q_tail',
0x000069B0: 'task_start',
0x000069D4: 'task_exit',
0x00006A10: 'wait_queue_wake_all',
0x00006B24: 'wait_queue_wake_one',
0x00006B54: '_list_remove_head',
0x00006CE0: '_deep_idle_timeout',
0x00006CEC: '_system_time',
0x00006CFC: '_time_has_elapsed',
0x00006D34: '_spin',
0x00006D74: 'security_init',
0x00006EB8: '_security_set_production_override',
0x0000701C: '_arm_clean_dcache_line',
0x000070A4: '_arm_clean_invalidate_dcache_line',
0x000070B0: '_arm_clean_invalidate_dcache',
0x00007108: '_arm_clean_dcache',
0x00007160: '_arm_invalidate_dcache',
0x00007230: '_arm_invalidate_icache',
0x00007258: '_arm_drain_write_buffer',
0x000072C8: '_arm_mmu_map_section_range',
0x00007320: 'jpt_731C',
0x0000738C: 'def_731C',
0x000073E0: '_arm_mmu_init',
0x0000742C: '_arm_fp_init',
0x0000745C: 'arch_cpu_init',
0x000074B8: '_arch_cpu_quiesce',
0x000074E0: '_clocks_init',
0x00007510: '_arch_get_entropy',
0x00007540: 'arm_irq',
0x000075E8: 'arm_fiq',
0x00007690: 'arm_undefined',
0x000076C8: 'arm_syscall',
0x00007700: 'arm_prefetch_abort',
0x0000773C: 'arm_data_abort',
0x00007774: '___arm_reserved',
0x00007AF4: '_usb_init_with_controller',
0x00007B3C: '_usb_init',
0x00007B4C: '_usb_quiesce',
0x00007B74: '_usb_free',
0x00007B88: '_usb_controller_register',
0x00007BA8: '__b',
0x00007BD0: '_usb_controller_stop',
0x00007BF4: '_usb_controller_deactivate_endpoint',
0x00007C60: '_stdout_outfunc',
0x00007E34: 'usb_create_string_descriptor',
0x000081D6: 'jpt_81D2',
0x000082D6: 'jpt_82D2',
0x0000844C: 'def_81D2',
0x0000863C: '_usb_core_free',
0x000086B8: '_getDFUImage',
0x000086E8: '_usb_dfu_init',
0x00008970: '_usb_dfu_exit',
0x00008A00: 'image_load',
0x00009320: '_siphash_aligned',
0x00009454: 'def_945E',
0x00009462: 'jpt_945E',
0x00009690: '_required_size',
0x000096DC: '_verify_block_checksum',
0x00009734: '_heap_free',
0x000098A4: '_calculate_block_checksum',
0x000098BC: '_heap_memalign',
0x00009A80: '_alloc_ep0_device_io_request',
0x00009AB0: '_heap_panic',
0x00009AC0: '_verify_block_padding',
0x00009B10: '_free_list_add',
0x00009C5C: 'heap_verify',
0x00009E18: 'j__heap_free',
0x0000A016: 'jpt_A012',
0x0000A044: 'def_A012',
0x0000A098: 'jpt_A094',
0x0000A618: '_vsnprintf',
0x0000A784: '_longlong_to_hexstring',
0x0000A7BC: 'kAsciiHexChars',
0x0000A7C4: '___vsnprintf_chk',
0x0000A7FC: '_puts',
0x0000A824: '_putchar',
0x0000A840: '___strlcat_chk',
0x0000A85C: '___stack_chk_fail',
0x0000A884: '_memcpy',
0x0000ABB0: '_memset',
0x0000ABC8: '_bzero',
0x0000ACC0: '_strlen',
0x0000AD28: '_amc_phy_run_dll_update',
0x0000AD74: '_strlcat',
0x0000ADD0: '_strlcpy',
0x0000B068: '_DERParseBitString',
0x0000B08C: '_DERParseBoolean',
0x0000B0B0: '_DERParseInteger',
0x0000B0F4: '_DERParseInteger64',
0x0000B160: '_DERDecodeSeqInit',
0x0000B1B8: '_DERDecodeSeqContentInit',
0x0000B1C8: '_DERDecodeSeqNext',
0x0000B210: '_DERParseSequence',
0x0000B270: '_DERParseSequenceContent',
0x0000B398: '_Img4DecodeParseLengthFromBuffer',
0x0000B3C4: '_random_get_bytes',
0x0000B3E4: '_mib_get_u32',
0x0000B410: '_random_get_bytes_internal',
0x0000B500: '_random_get_bytes_noheap',
0x0000B530: '_chipid_get_current_production_mode',
0x0000B534: '_platform_get_raw_production_mode',
0x0000B538: '_platform_get_security_domain',
0x0000B554: 'j__chipid_get_minimum_epoch_0',
0x0000B558: '_platform_get_chip_id',
0x0000B560: '_platform_get_ecid_image_personalization_required',
0x0000B564: '_platform_get_entropy',
0x0000B568: '_platform_get_usb_vendor_id',
0x0000B570: '_power_needs_precharge',
0x0000B574: '_platform_halt',
0x0000B578: '_platform_deep_idle',
0x0000B57C: '_platform_get_usb_manufacturer_string',
0x0000B584: '_platform_get_usb_device_version',
0x0000B588: '_platform_get_fuse_modes',
0x0000B5A4: '_DERImg4DecodeFindInSequence',
0x0000B5E8: '_DERImg4DecodeContentFindItemWithTag',
0x0000B614: '_DERImg4DecodeTagCompare',
0x0000B650: '_DERImg4Decode',
0x0000B77C: '_DERImg4DecodeUnsignedManifest',
0x0000B900: '_Img4DecodeInitUnsignedManifest',
0x0000BB90: '_Img4DecodeGetBooleanFromSection',
0x0000BBE0: '_Img4DecodeGetPropertyFromSection',
0x0000BCA0: '_Img4DecodeGetPropertyBoolean',
0x0000BD20: '_Img4DecodeEvaluateCertificateProperties',
0x0000BEDC: '_Img4DecodeEvaluateDictionaryProperties',
0x0001053C: '_arch_get_entropy$shim',
0x00010548: 'j__arm_clean_invalidate_dcache',
0x00010554: '_arm_clean_invalidate_dcache_line_2',
0x00010560: 'j__arm_clean_dcache',
0x00010578: '_platform_get_chip_revision',
0x00010584: '_arm_flush_tlbs$shim',
0x00010590: '_arm_write_cp_access_cr$shim',
0x000105A8: 'j__arm_enable_fiqs',
0x000105B4: '_strlen$shim',
0x000105C0: '_arch_halt$shim',
0x00010600: 'aNor0',
0x00010605: 'nil',
0x00010606: 'aUsb',
0x0001060A: 'aImg4',
0x0001060F: 'aIm4p',
0x00010614: 'aAppleMobileDeviceDfuMode',
0x00010633: 'aCpid04xCprv02xCpfm02xScep02xBdid02xEcid016llxI',
0x0001067C: 'aSrtgS',
0x00010687: 'aNonc',
0x0001068E: 'a02x',
0x00010693: 'aSnon',
0x0001069A: 'aDoublePanicIn',
0x000106AB: 'doubleNewline',
0x000106AE: 'newlinePanic',
0x000106B7: 'colon',
0x000106BA: 'aIdleTask',
0x000106C4: 'aNull',
0x000106CB: 'aPtr',
0x000106D1: 'a0x',
0x000106D8: 'aAppleInc',
0x00012064: 'a0123456789abcdef',
0x00012074: 'a0123456789abcdef_0',
0x488001E0: 'current_task',
0x48800388: 'aBootstrap_0',
0x4880039C: 'a2kst',
0x488004A6: 'a0k10',
0x488004AE: 'aU',
0x488004B3: 'aAppleSecureBootRootCaG21',
0x488004DC: 'aAppleInc10',
0x488004F1: 'aUs0',
0x488004F7: 'a141219201310z',
0x48800506: 'a341214201310z0k10',
0x48800520: 'aAppleSecureBootRootCaG21_0',
0x48800549: 'aAppleInc10_0',
0x4880055E: 'aUs0_0',
0x48800563: 'a0',
0x4880056A: 'aH',
0x48802AE8: 'aCpid8004Cprv10Cpfm03Scep01Bdid1eEcid0015243e0e100026',
0x48802B67: 'aNonc38876290c433a5c8c1f7cf74d0bcef20cec156411cbf654cd5cf957ee6',
0x48802F30: 'aKatskatskatskatskatskatskatskatskatskatskatskatskatskatskatskats_0',
0x48805F1F: 'aHex',
0x48805F28: 'aQx',
0x48805F2C: 'aKats',
0x488060F0: 'aIdleTask_1',
0x48806104: 'a2kst_1',
0x48807BA1: 'ebolink',
0x48810240: 'aApppplleeMmoobbiilleeDdeevviicceeDdffuuMmooddee',
0x48810448: 'aUsb_0',
0x488104C0: 'aKatskatskatskatskatskatskatskatskatskatskatskatskatskatskatskats',
0x48811500: 'aCmemcmem' }
</pre>

[[Category:Bootrom]]

Bootrom 2651.0.0.3.3

2020-08-07T16:49:16Z

Kritanta: more /* Symbols */

This is the [[bootrom]] version found in the [[Apple Watch Series 3]]. It is vulnerable to [[Checkm8_Exploit|Checkm8]].

== Symbols ==

<pre>
#
# Symbols found by _kritanta
# For: iBoot-2651.0.0.3.3 ROMRELEASE for t8004si
# Report any mistakes here: https://github.com/KritantaDev/timestop/blob/master/Symbols/ROM/t8004
#
# This file is in python format for ease of loading
#
# You can probably use this to bindiff symbols to most other roms
#

symbols = { 0x00000000: 'start',
0x00000040: 'reset',
0x0000005C: 'relocate_loop',
0x00000078: 'relocate_data',
0x000000A0: 'relocate_data_loop',
0x000000B0: 'stack_setup',
0x00000188: 'bss_loop',
0x00000194: 'bss_done',
0x000001A0: 'spin',
0x00000200: 'aSecureromForT8004siCopyright20072014AppleInc',
0x00000240: 'aRomrelease',
0x00000280: 'aIboot26510033_0',
0x00000300: 'Description',
0x00000304: 'ReleaseCategory',
0x00000308: 'iBootVersion',
0x0000030C: 'main',
0x00000310: 'Start',
0x0000031C: 'sram_start',
0x00000328: 'argv',
0x00000334: 'heap_base',
0x00000338: '_arm_read_cpsr',
0x00000350: '_arm_read_ifsr',
0x00000358: '_arm_read_dfsr',
0x00000360: '_arm_write_l2_aux_cr',
0x0000036C: '_arm_read_ifar',
0x00000374: '_arm_read_extended_feature_regs',
0x000003CC: '_arm_read_memory_model_feature_regs',
0x000003E8: '_arm_read_instruction_set_attribute_regs',
0x00000410: '_arm_read_cr',
0x00000418: '_arm_write_cr',
0x00000424: '_arm_read_aux_cr',
0x0000042C: '_arm_write_aux_cr',
0x00000438: '_arm_write_dar',
0x00000444: '_arm_write_ttb',
0x00000450: '_arm_write_ttbcr',
0x0000045C: '_arm_read_dfar',
0x00000464: '_arm_read_main_id',
0x0000046C: '_arm_read_cache_id',
0x00000474: '_arm_read_cache_level_id',
0x00000484: '_arm_write_user_rw_tid',
0x00000490: '_arm_read_fpexc',
0x000004A0: '_arm_read_fpscr',
0x000004F4: '_arm_read_cache_size_selection',
0x000004FC: '_arm_write_user_ro_tid',
0x00000508: '_arm_read_pmreg',
0x000005CC: '_arm_write_pmreg',
0x00000690: '_arm_read_cache_size_id',
0x00000698: '_arm_write_sup_tid',
0x000006A4: '_arm_read_l2_aux_cr',
0x000006AC: '_arm_write_perip_port_remap',
0x000006B8: '_arm_read_user_rw_tid',
0x000006C0: '_arm_write_dprot_region_8',
0x000006CC: '_arm_read_user_ro_tid',
0x000006D4: '_arm_write_data_prot_register',
0x000006E0: '_arm_flush_tlbs',
0x000006F4: 'nullsub_4',
0x00000798: '_arm_write_ins_prot_register',
0x000007A4: '_arm_write_cacheable_registers',
0x000007B4: '_arm_write_bufferable_register',
0x000007F0: '_arch_restore_ints',
0x0000080C: '_arm_enable_fiqs',
0x0000081C: '_arm_disable_fiqs',
0x0000082C: '_arm_read_sup_tid',
0x00000834: '_arm_write_vbar',
0x0000083C: '_arm_flush_branch_predictor',
0x0000084C: '_arm_memory_barrier',
0x00000854: '_arch_halt',
0x00000860: '_arch_spin',
0x00000868: '_main',
0x000014B0: '_timer_get_ticks',
0x000014B4: '_aic_get_ticks',
0x000014CC: '_aic_spin',
0x000014E8: '_timer_ticks_to_usecs',
0x000014F8: '_timer_usecs_to_ticks',
0x00001508: '_timer_get_entropy',
0x00001AD0: '_usbphy_enable_pullup',
0x00001C88: 'jpt_1C84',
0x00001ED4: '__src',
0x00002840: '_synopsys_otg_get_connection_speed',
0x00002A78: '_synopsys_otg_is_endpoint_stalled',
0x00003444: '_synopsys_otg_go_on_bus',
0x000037B0: '_synopsys_otg_start_ep0_out',
0x00003B34: 'verify_img4_whatever',
0x00004514: 'aNrpdxekeyekeorpeceseorpdtsgdlodsmodscicedicegcnbbesccescnrpcorpc',
0x000046B4: 'platform_cache_operation',
0x0000475C: 'j_j__arm_memory_barrier',
0x00004784: 'j__chipid_get_minimum_epoch',
0x000050E4: 'platform_init_setup_clocks',
0x00005100: 'platform_init_hwpins',
0x0000527C: 'platform_init_internal_mem',
0x00005288: 'platform_quiesce_hardware',
0x000052A0: 'platform_bootprep',
0x00005308: 'chipid_clear_production_mode',
0x00005374: '_platform_init_setup_clocks',
0x00005390: 'platform_get_boot_device',
0x000053AA: 'jpt_53A6',
0x000053E4: 'def_53A6',
0x000053EC: 'platform_enable_boot_interface',
0x000054CC: 'platform_set_dfu_status',
0x000054D8: 'platform_get_force_dfu',
0x000054EC: 'platform_get_request_dfu1',
0x00005504: 'platform_get_request_dfu2',
0x00005864: 'platform_get_boot_trampoline',
0x00005888: '__dst',
0x00005894: '_chipid_get_production_mode',
0x000058D4: '_chipid_get_security_domain',
0x000058E4: '_chipid_get_board_id',
0x000058F4: '_chipid_get_minimum_epoch',
0x000059A8: '_charger_has_external',
0x000059AC: 'chipid_set_fuse_lock',
0x00005F3C: 'jpt_5F38',
0x00005F46: 'def_5F38',
0x00005FD8: 'halt',
0x00005FE4: 'nullsub_1',
0x00005FE8: '_platform_power_spin',
0x00005FEC: 'platform_watchdog_tickle',
0x0000601C: '_prepare_and_jump',
0x00006188: '_callout_dequeue',
0x0000624C: '_debug_init',
0x00006264: 'nullsub_3',
0x00006268: '__panic',
0x00006350: 'doublePanicIn',
0x00006354: 'panicMacro',
0x000063FC: 'platform_get_usb_cable_connected',
0x0000648C: '_enter_critical_section',
0x000064C8: '_exit_critical_section',
0x0000681C: '_task_get_current_task',
0x00006890: 'list_delete',
0x000068C8: 'task_yield',
0x0000698C: 'insert_run_q_tail',
0x000069B0: 'task_start',
0x000069D4: 'task_exit',
0x00006A10: 'wait_queue_wake_all',
0x00006B24: 'wait_queue_wake_one',
0x00006B54: '_list_remove_head',
0x00006CE0: '_deep_idle_timeout',
0x00006CEC: '_system_time',
0x00006CFC: '_time_has_elapsed',
0x00006D34: '_spin',
0x00006D74: 'security_init',
0x00006EB8: '_security_set_production_override',
0x0000701C: '_arm_clean_dcache_line',
0x000070A4: '_arm_clean_invalidate_dcache_line',
0x000070B0: '_arm_clean_invalidate_dcache',
0x00007108: '_arm_clean_dcache',
0x00007160: '_arm_invalidate_dcache',
0x00007230: '_arm_invalidate_icache',
0x00007258: '_arm_drain_write_buffer',
0x000072C8: '_arm_mmu_map_section_range',
0x00007320: 'jpt_731C',
0x0000738C: 'def_731C',
0x000073E0: '_arm_mmu_init',
0x0000742C: '_arm_fp_init',
0x0000745C: 'arch_cpu_init',
0x000074B8: '_arch_cpu_quiesce',
0x000074E0: '_clocks_init',
0x00007510: '_arch_get_entropy',
0x00007540: 'arm_irq',
0x000075E8: 'arm_fiq',
0x00007690: 'arm_undefined',
0x000076C8: 'arm_syscall',
0x00007700: 'arm_prefetch_abort',
0x0000773C: 'arm_data_abort',
0x00007774: '___arm_reserved',
0x00007AF4: '_usb_init_with_controller',
0x00007B3C: '_usb_init',
0x00007B4C: '_usb_quiesce',
0x00007B74: '_usb_free',
0x00007B88: '_usb_controller_register',
0x00007BA8: '__b',
0x00007BD0: '_usb_controller_stop',
0x00007BF4: '_usb_controller_deactivate_endpoint',
0x00007C60: '_stdout_outfunc',
0x00007E34: 'usb_create_string_descriptor',
0x000081D6: 'jpt_81D2',
0x000082D6: 'jpt_82D2',
0x0000844C: 'def_81D2',
0x0000863C: '_usb_core_free',
0x000086B8: '_getDFUImage',
0x000086E8: '_usb_dfu_init',
0x00008970: '_usb_dfu_exit',
0x00008A00: 'image_load',
0x00009320: '_siphash_aligned',
0x00009454: 'def_945E',
0x00009462: 'jpt_945E',
0x00009690: '_required_size',
0x000096DC: '_verify_block_checksum',
0x00009734: '_heap_free',
0x000098A4: '_calculate_block_checksum',
0x000098BC: '_heap_memalign',
0x00009A80: '_alloc_ep0_device_io_request',
0x00009AB0: '_heap_panic',
0x00009AC0: '_verify_block_padding',
0x00009B10: '_free_list_add',
0x00009C5C: 'heap_verify',
0x00009E18: 'j__heap_free',
0x0000A016: 'jpt_A012',
0x0000A044: 'def_A012',
0x0000A098: 'jpt_A094',
0x0000A618: '_vsnprintf',
0x0000A784: '_longlong_to_hexstring',
0x0000A7BC: 'kAsciiHexChars',
0x0000A7C4: '___vsnprintf_chk',
0x0000A7FC: '_puts',
0x0000A824: '_putchar',
0x0000A840: '___strlcat_chk',
0x0000A85C: '___stack_chk_fail',
0x0000A884: '_memcpy',
0x0000ABB0: '_memset',
0x0000ABC8: '_bzero',
0x0000ACC0: '_strlen',
0x0000AD28: '_amc_phy_run_dll_update',
0x0000AD74: '_strlcat',
0x0000ADD0: '_strlcpy',
0x0000B068: '_DERParseBitString',
0x0000B08C: '_DERParseBoolean',
0x0000B0B0: '_DERParseInteger',
0x0000B0F4: '_DERParseInteger64',
0x0000B160: '_DERDecodeSeqInit',
0x0000B1B8: '_DERDecodeSeqContentInit',
0x0000B1C8: '_DERDecodeSeqNext',
0x0000B210: '_DERParseSequence',
0x0000B270: '_DERParseSequenceContent',
0x0000B398: '_Img4DecodeParseLengthFromBuffer',
0x0000B3C4: '_random_get_bytes',
0x0000B3E4: '_mib_get_u32',
0x0000B410: '_random_get_bytes_internal',
0x0000B500: '_random_get_bytes_noheap',
0x0000B530: '_chipid_get_current_production_mode',
0x0000B534: '_platform_get_raw_production_mode',
0x0000B538: '_platform_get_security_domain',
0x0000B554: 'j__chipid_get_minimum_epoch_0',
0x0000B558: '_platform_get_chip_id',
0x0000B560: '_platform_get_ecid_image_personalization_required',
0x0000B564: '_platform_get_entropy',
0x0000B568: '_platform_get_usb_vendor_id',
0x0000B570: '_power_needs_precharge',
0x0000B574: '_platform_halt',
0x0000B578: '_platform_deep_idle',
0x0000B57C: '_platform_get_usb_manufacturer_string',
0x0000B584: '_platform_get_usb_device_version',
0x0000B588: '_platform_get_fuse_modes',
0x0000B5A4: '_DERImg4DecodeFindInSequence',
0x0000B5E8: '_DERImg4DecodeContentFindItemWithTag',
0x0000B614: '_DERImg4DecodeTagCompare',
0x0000B650: '_DERImg4Decode',
0x0000B77C: '_DERImg4DecodeUnsignedManifest',
0x0000B900: '_Img4DecodeInitUnsignedManifest',
0x0000BB90: '_Img4DecodeGetBooleanFromSection',
0x0000BBE0: '_Img4DecodeGetPropertyFromSection',
0x0000BCA0: '_Img4DecodeGetPropertyBoolean',
0x0000BD20: '_Img4DecodeEvaluateCertificateProperties',
0x0000BEDC: '_Img4DecodeEvaluateDictionaryProperties',
0x0001053C: '_arch_get_entropy$shim',
0x00010548: 'j__arm_clean_invalidate_dcache',
0x00010554: '_arm_clean_invalidate_dcache_line_2',
0x00010560: 'j__arm_clean_dcache',
0x00010578: '_platform_get_chip_revision',
0x00010584: '_arm_flush_tlbs$shim',
0x00010590: '_arm_write_cp_access_cr$shim',
0x000105A8: 'j__arm_enable_fiqs',
0x000105B4: '_strlen$shim',
0x000105C0: '_arch_halt$shim',
0x00010600: 'aNor0',
0x00010605: 'nil',
0x00010606: 'aUsb',
0x0001060A: 'aImg4',
0x0001060F: 'aIm4p',
0x00010614: 'aAppleMobileDeviceDfuMode',
0x00010633: 'aCpid04xCprv02xCpfm02xScep02xBdid02xEcid016llxI',
0x0001067C: 'aSrtgS',
0x00010687: 'aNonc',
0x0001068E: 'a02x',
0x00010693: 'aSnon',
0x0001069A: 'aDoublePanicIn',
0x000106AB: 'doubleNewline',
0x000106AE: 'newlinePanic',
0x000106B7: 'colon',
0x000106BA: 'aIdleTask',
0x000106C4: 'aNull',
0x000106CB: 'aPtr',
0x000106D1: 'a0x',
0x000106D8: 'aAppleInc',
0x00012064: 'a0123456789abcdef',
0x00012074: 'a0123456789abcdef_0',
0x488001E0: 'current_task',
0x48800388: 'aBootstrap_0',
0x4880039C: 'a2kst',
0x488004A6: 'a0k10',
0x488004AE: 'aU',
0x488004B3: 'aAppleSecureBootRootCaG21',
0x488004DC: 'aAppleInc10',
0x488004F1: 'aUs0',
0x488004F7: 'a141219201310z',
0x48800506: 'a341214201310z0k10',
0x48800520: 'aAppleSecureBootRootCaG21_0',
0x48800549: 'aAppleInc10_0',
0x4880055E: 'aUs0_0',
0x48800563: 'a0',
0x4880056A: 'aH',
0x48802AE8: 'aCpid8004Cprv10Cpfm03Scep01Bdid1eEcid0015243e0e100026',
0x48802B67: 'aNonc38876290c433a5c8c1f7cf74d0bcef20cec156411cbf654cd5cf957ee6',
0x48802F30: 'aKatskatskatskatskatskatskatskatskatskatskatskatskatskatskatskats_0',
0x48805F1F: 'aHex',
0x48805F28: 'aQx',
0x48805F2C: 'aKats',
0x488060F0: 'aIdleTask_1',
0x48806104: 'a2kst_1',
0x48807BA1: 'ebolink',
0x48810240: 'aApppplleeMmoobbiilleeDdeevviicceeDdffuuMmooddee',
0x48810448: 'aUsb_0',
0x488104C0: 'aKatskatskatskatskatskatskatskatskatskatskatskatskatskatskatskats',
0x48811500: 'aCmemcmem' }
</pre>

[[Category:Bootrom]]

Bootrom 2651.0.0.3.3

2020-08-07T16:44:36Z

Kritanta:

DFU Mode

2020-07-25T18:49:52Z

Kritanta: /* Entering DFU Mode */ Watch

'''DFU''' or '''Device Firmware Upgrade''' mode allows all devices to be restored from any state. It is essentially a mode where the BootROM can accept iBSS. DFU is part of the [[Bootrom|SecureROM]] which is burned into the hardware, so it cannot be removed. On A7+ devices, it generates an ApNonce and recognizes APTickets as well, so even in DFU, it can accept an APTicket.

== Entering DFU Mode ==
NOTE: If you are using a USB-C cable to enter DFU mode, it might not work. If this happens, you need to use the normal USB cable. You can use a normal USB cable and a USB to USB-C adaptor.
=== Apple TV ===
# Plug the device into your computer using a Micro-USB cable.
# Force the device to reboot by holding down the "Menu" and "Down" buttons simultaneously for 6-7 seconds.
# Press "Menu" and "Play" simultaneously right after reboot, until a message pops up in [[iTunes]], saying that it has detected an Apple TV in Recovery Mode.

=== A9 and older devices (iPad other than the ones listed below, iPhone 6s and below, iPhone SE and iPod touch 6 and below) ===
# Connect the device to a computer using a USB cable.
# Hold down both the Home button and Lock button.
# After 8 seconds, release the Lock button while continuing to hold down the Home button.
#* If the Apple logo appears, the Lock button was held down for too long.
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.

=== A10 devices (iPhone 7 and iPhone 7 Plus, iPad 2018, iPod touch 7) ===
# Connect the device to a computer using a USB cable.
# Hold down both the Side button and Volume Down button.
# After 8 seconds, release the Side button while continuing to hold down the Volume Down button.
#* If the Apple logo appears, the Side button was held down for too long.
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.

=== A11 and newer devices (iPhone 8 and above, iPad Pro 2018, iPad Air 2019, iPad Mini 2019) ===
# Connect the device to a computer using a USB cable.
# Quick-press the Volume Up button
# Quick-press the Volume Down button
# Hold down the Side button until the screen goes black, then hold down both the Side button and Volume Down button.
# After 5 seconds, release the Side button while continuing to hold down the Volume Down button.
#* If the Apple logo appears, the Side button was held down for too long.
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.

=== Apple Watch ===

# Connect to computer via [[iBUS]] adapter and lightning cable
# Hold crown and power button (bottom right)
# Wait for the screen to go black
# After 3 seconds of black, let go of the power button but continue to hold the crown
# After about 5 seconds your watch will be in DFU mode

=== GPIO Pins ===
If you have access to the SoC, you can either perform the above methods for your device by utilizing the <code>GPIO_REQUEST_DFU1</code> and <code>GPIO_REQUEST_DFU2</code> GPIO pins (previously <code>HOLD_KEY</code> and <code>MENU_KEY</code> and corresponding to Power and Home/Vol-, respectively) or by setting your board's <code>GPIO_FORCE_DFU</code> pin to 1 at SecureROM startup (unless you are using an [[iFPGA]], where Force DFU mode is the default).

The corresponding GPIO pins for each SoC varies, and the most important ones (including the DFU pins) are listed on the [[GPIO]] page.

== Exiting DFU Mode ==
To exit DFU Mode, simply force restart your device.

* For Apple TV, hold down the "Menu" and "Down" buttons on your remote until the Apple TV reboots.
* For iPad, iPhone 6s and below, iPhone SE and iPod touch, hold the Home button and the Lock button until the device reboots.
* For iPhone 7 and iPhone 7 Plus, hold down the Side button and Volume Down button until the device reboots.
* For iPhone 8, iPhone 8 Plus, and iPhone X, quick-press the Volume Up button, then quick-press the Volume Down button, then hold down the Side button until the device reboots.

==Enter True Hardware DFU Mode Automatically==
The EnterDFU function in the [[MobileDevice Library]] does not enter the true DFU Mode in the hardware. It's possible to enter the true DFU Mode without doing it manually, but it cannot be exited unless a restore is performed, as it creates a [[DFU Loop]]. This doesn't work with [[S5L8900]] devices.

===Steps===
# Make a copy of a fresh IPSW file.
# Open the IPSW as a zip folder and browse to /firmware/all_flash/all_flash.xxxxx.production/
# Extract LLB.*****.RELEASE.img3/im4p and open it in a hex editor.
# Change some random bit or bits, it doesn't matter which or what you write.
# Add the edited file back to the zip, rename zip to ipsw and restore it to your device using iTunes.
# The restore will error out and your device will be in DFU Mode.

===Alternative Method===
If the previous method does not work for you, try this one.
# Do steps 1 and 2 from above.
# Delete LLB.*****.RELEASE.img3.
# Copy applelogo.********.img3 to temporary directory.
# Rename the copy of applelogo.********.img3/im4p to LLB.*****.RELEASE.img3/im4p. (If you forget the name of the LLB file, you can find it again in the file named manifest.)
# Copy the renamed applelogo file back to the all_flash.xxxxx.production directory.
# Rename the zip.
# Restore the file using iTunes. (If every thing goes well, you should receive an error 31 from iTunes.)

==DFU Mode Output to the computer==
<pre>iProduct: "Apple Mobile Device (DFU Mode)"</pre> <pre>iSerialNumber: "CPID:XXXX CPRV:15 CPFM:03 SCEP:03 BDID:00 ECID:XXXXXXXXXXXXXXXX SRTG:[iBoot-XXX.X.X]"</pre>

==Revisions==
===[[S5L8900]] (0x1222)===
This is the device ID in the [[N45AP|iPod touch]], the [[M68AP|iPhone]], and the [[N82AP|iPhone 3G]]. For more information about the protocol, see [[DFU 0x1222]].

===[[S5L8720 Bootrom|S5L8720]], [[S5L8920]], and [[WTF|WTF mode post-2.0]] (0x1227)===
This is the device ID in the [[N72AP|iPod touch (2nd generation)]], the [[N88AP|iPhone 3GS]], the [[N90AP|iPhone 4]], subsequent 32 bit devices, all 64 bit devices, and [[WTF|WTF mode]]. For more information on the protocol, see [[DFU 0x1227]].

[[Category:Bootrom]]

Grace 17R575 (Watch3,2)

2020-07-24T22:44:32Z

Kritanta: 6.0.0 3,2 keys

{{keys
| Version = 6.0.0
| Build = 17R575
| Device = Watch3,2
| Codename = GraceE
| Baseband = Unknown

| RootFS = 048-64136-310
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-63982-330
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-63605-329
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-m8paop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@132~watch.im4p
| AppleLogoIV = Not Encrypted

| Dali = dali-ui.n111b.release.im4p
| DaliIV = Not Encrypted

| DeviceTree = DeviceTree.n111bap.im4p
| DeviceTreeIV = Not Encrypted

| iBEC = iBEC.n111b.RELEASE.im4p
| iBECIV = 4ce11e6aba8b60e1c76a13069099cf0
| iBECKey = 9e4db55bb991d119f73e8b10c85e893b2b5ec9fc3f37596183db6ff29fa547b9

| iBoot = iBoot.n111b.RELEASE.im4p
| iBootIV = 376533c641c27ff1bc065126462d9776
| iBootKey = e476348733ad6c2ac58d36318aa5068cc45b0f61c3ea0be5b628a1c19e94c829

| iBSS = iBSS.n111b.RELEASE.im4p
| iBSSIV = 47c0a8558789bcff8cd6da7dd411418
| iBSSKey = 97fe52b091d0f37868743dd36defabb62b124d73e836c1ebbee1c4200daf86ba

| Kernelcache = kernelcache.release.watch3
| KernelcacheIV = Not Encrypted

| LLB = LLB.n111b.RELEASE.im4p
| LLBIV = 72ac58bf81ddf9e5825c76b18a78d60
| LLBKey = 639646deb78b90df70b9b27a5c60405b251c3e943181c017a131b7e35796d691

| RecoveryMode = recoverymode@132~watch.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n111b.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = Unknown
}}

Fugu

2020-07-15T07:15:26Z

Kritanta: Fugu Stub.

'''Fugu''' is an open-sourced, [[semi-tethered jailbreak]], developed by Linus Henze, based on [[checkm8 Exploit|checkm8]]. It currently only supports the t8010 and t8011 SOCs.

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Talk:Kernel Patches

2020-07-15T03:20:11Z

Kritanta: a TODO: update and a question for maintainers of this wiki

TODO (mostly for me, later): Explain how we find patches in modern iOS. [[User:Kritanta|Kritanta]] ([[User talk:Kritanta|talk]]) 03:20, 15 July 2020 (UTC)

Also: I don't think this page needs that list of kernel offsets; maintaining something like that is unreasonable. Would the removal of them be ok? [[User:Kritanta|Kritanta]] ([[User talk:Kritanta|talk]]) 03:20, 15 July 2020 (UTC)

User talk:DanTheMann15

2020-07-12T21:07:32Z

Kritanta: /* Topics */

[[User:DanTheMann15|DanTheMann15]]'s inquiry page on The iPhone Wiki

if you have any questions or concerns about any edit that i made, you can open a topic here in this talk page to discuss it or [[Special:EmailUser/DanTheMann15|send me an email]].

Note though that topics that are over 6 months without any reply will be [[User:DanTheMann15/ArchivedTopics|archived]] in order to keep this page clean.

==Topics==

I'm not sure if this is the right place but, thanks for the corrections, and feel free to smack me over the head / yell if I screw something up regarding guidelines/formatting. Still getting the hang of "wiki-speak" :) [[User:Kritanta|Kritanta]] ([[User talk:Kritanta|talk]]) 21:07, 12 July 2020 (UTC)

User:Kritanta

2020-07-12T21:00:13Z

Kritanta: Created page with "Local idiot. Typically contained within the bounds of https://iphonedevwiki.net/ , but sometimes I end up here."

Local idiot. Typically contained within the bounds of https://iphonedevwiki.net/ , but sometimes I end up here.

IBUS

2020-07-12T11:09:22Z

Kritanta: Create iBUS page with what little information exists about these adapters

The "iBUS" adapter is a smaller "dongle" that takes advantage of the diagnostics port hidden behind a small plate in the slot where the band for your watch would normally slide into.

These adapters are sold by "MFC" and appear to be clones of Apple's own proprietary hardware; When plugged into a Mac via lightning-to-USB, the Apple Watch appears in Finder in the same way that other apple devices do when plugged in. It is also recognized by [[libimobiledevice]], Xcode, and Apple's Console.app, although no logs are displayed in the latter.

Not much information about these adapters has been released, by MFC or otherwise.

== Usage for Research ==
While the adapters are marketed for their ability to "restore" devices, the signed firmware required to do so is not readily available. However, the adapter does allow exploitation of the S1, S2, and S3 Watches using [[checkm8]]

=== "Pwning" the watch and dumping the bootrom ===

==== Entering DFU ====
Once you've connected your apple watch via a standard USB Lightning cable and the iBUS adapter:

# Hold the crown and power button down
# Immediately after the screen goes black, count to 3
# After 3 seconds, release the power button, but continue to hold the crown.

Finder should now show an "Apple Watch" in DFU mode, and will allow you to install signed firmware if you have any.

==== Exploiting with ipwndfu ====
Reliability of checkm8 on the watch can vary.

After cloning [https://github.com/axi0mX/ipwndfu], `cd` into the directory and run `./ipwndfu -p`

If the exploit fails, you may need to run it again. It can take anywhere from one to several hundred attempts.

From here, you can run `./ipwndfu --dump-rom` to dump the [[SecureRom]]. More information is available in the ipwndfu readme and on [[ipwndfu]].

Do note the `--boot` flag currently only works for the iPhone X.

You can use `./ipwndfu --hex-dump=0x0,0x10000000000` to crash out of DFU and force a reboot.

== Tips for usage ==
* As the metal rod that ships with the adapter often fits loosely, consider using rubber bands to firmly press the adapter into the port.
** A hairband is exceptional at this, and perfectly fits into the top of the watch.

{{DISPLAYTITLE:iBUS}}

Apple Watch Series 3

2020-07-12T08:50:32Z

Kritanta: /* Exploitation */ Add a bit of information about how one can use checkm8 on an Apple Watch S3.

[[File:Apple Watch Series 3.png|right|200px|thumb|Apple Watch Series 3]]

The '''Apple Watch Series 3''' was first introduced at Apple's "Let's meet at our place" [[keynote]] on {{date|2017|09|12|abbr=false}}.

Internally, the Apple Watch Series 3 is referred to as [[N111sAP]] (Watch3,1 - 38mm Cellular), [[N111bAP]] (Watch3,2 - 42mm Cellular), [[N121sAP]] (Watch3,3 - 38mm), and [[N121bAP]] (Watch3,4 - 42mm).

== Application Processor ==
The Apple Watch Series 3 makes use of the [[T8004]] (S3) Processor.
It also contains a GPS module, and on cellular models an [[MDM9635|LTE]] chip.

== Exploitation ==
The [[t8004]] Processor found inside the S3 watch is vulnerable to checkm8. By connecting it to macOS via an [[iBUS]] adapter, the watch can be kicked into "pwned DFU mode" via [[ipwndfu]].

A public jailbreak using this vulnerability on watchOS has not yet been developed, and no tools outside of ipwndfu itself support Apple Watch firmware, yet.

== Specifications ==
* Display: Retina OLED
* Screen: Ion-X glass or sapphire crystal
* Compatibility (GPS): [[iOS]] 11 or later running on an [[iPhone 5s]] or newer
* Compatibility (GPS+LTE): [[iOS]] 11 or later running on an [[iPhone 6]] or newer

== Links ==
* [https://www.apple.com/apple-watch-series-3/ https://www.apple.com/apple-watch-series-3]

[[Category:Devices‏]]

T8004

2020-07-12T08:32:41Z

Kritanta: /* Bootrom Exploits */ god bless axi0mX (add checkm8)

'''T8004''' refers to the CPU inside of the third generation of Apple's [[wikipedia:System in package|SiP]]s: the S3. The '''S3''' is currently used in the [[Apple Watch Series 3]].
==Bootrom Exploits==
* [[Checkm8 Exploit|checkm8]]

{{stub|hardware}}
[[Category:Application Processors]]

IBoot (Bootloader)

2020-07-08T12:58:32Z

Kritanta: /* watchOS */ Add 6.1 iBoot version

{{lowercase}}
'''iBoot''', also referred to as “iBoot second-stage loader” in the source code, is Apple's stage 2 bootloader for all of the [[iDevice|devices]]. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== Extract and Disassemble ==
To extract the bootloader and disassemble using IDA, follow the following steps:
#obtain the bootloader from the iPSW. This file is in the <code>Firmware/all_flash</code> subdir, e.g. <code>Firmware/all_flash/all_flash.n81ap.production/iBoot.n81ap.RELEASE.img3</code>, where the "n81ap", "k90", etc.. are for the i-Device type
#run xpwntool with the proper key (from elsewhere in this Wiki)
#Make sure the decryption was successful - if it is, you should see:
"iBoot for ...., Copyright 2011, Apple Inc."
if you cat (i.e. type) the file.
<ol><li value="4">remove the img3 header - the good stuff starts at offset 0x40 (i.e. 64) - using dd (skip=1 bs=64) or some other tool</li>
<li>Load in IDA. Set processor to ARM. Rebase program (Edit→Segments→Rebase Program) to 0x5FF00000 (for iBoot in iOS 5). You should see something like:</li></ol>

<pre>
ROM:5FF00000 loc_5FF00000 ; CODE XREF: ROM:5FF00078�j
ROM:5FF00000 B loc_5FF00040 ; Used for Reset - This is where we start
ROM:5FF00004 ; ---------------------------------------------------------------------------
ROM:5FF00004 LDR PC, =sub_5FF16FB4 ; Used for Undef
ROM:5FF00008 ; ---------------------------------------------------------------------------
ROM:5FF00008 LDR PC, =sub_5FF16FEC ; Used for SWI
ROM:5FF0000C ; ---------------------------------------------------------------------------
ROM:5FF0000C LDR PC, =sub_5FF17024 ; Used for Prefabt
ROM:5FF00010 ; ---------------------------------------------------------------------------
ROM:5FF00010 LDR PC, =sub_5FF17060 ; Used for DataAbt
ROM:5FF00014 ; ---------------------------------------------------------------------------
ROM:5FF00014 LDR PC, =loc_5FF17098 ; Used for AddrExc
ROM:5FF00018 ; ---------------------------------------------------------------------------
ROM:5FF00018 LDR PC, =loc_5FF16F24 ; Used for IRQ
ROM:5FF0001C ; ---------------------------------------------------------------------------
ROM:5FF0001C LDR PC, =sub_5FF16F6C ; Probably FIQ, need to verify this
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00020 SVCPL 0xF00040
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00024 off_5FF00024 DCD sub_5FF16FB4 ; DATA XREF: ROM:5FF00004�r
ROM:5FF00028 off_5FF00028 DCD sub_5FF16FEC ; DATA XREF: ROM:5FF00008�r
ROM:5FF0002C off_5FF0002C DCD sub_5FF17024 ; DATA XREF: ROM:5FF0000C�r
ROM:5FF00030 off_5FF00030 DCD sub_5FF17060 ; DATA XREF: ROM:5FF00010�r
ROM:5FF00034 off_5FF00034 DCD loc_5FF17098 ; DATA XREF: ROM:5FF00014�r
ROM:5FF00038 off_5FF00038 DCD loc_5FF16F24 ; DATA XREF: ROM:5FF00018�r
ROM:5FF0003C off_5FF0003C DCD sub_5FF16F6C ; DATA XREF: ROM:5FF0001C�r
ROM:5FF00040 ; ---------------------------------------------------------------------------
ROM:5FF00040
ROM:5FF00040 loc_5FF00040 ; CODE XREF: ROM:loc_5FF00000�j
ROM:5FF00040 ADR R0, loc_5FF00000 <-- The address we rebased to
ROM:5FF00044 LDR R1, =loc_5FF00000
ROM:5FF00048 CMP R0, R1
ROM:5FF0004C CMP R0, R1
ROM:5FF00050 BEQ loc_5FF0007C
...
...
ROM:5FF000E8 loc_5FF000E8 ; CODE XREF: ROM:5FF000F0�j
ROM:5FF000E8 CMP R0, R1
ROM:5FF000EC STRLT R2, [R0],#4
ROM:5FF000F0 BLT loc_5FF000E8
ROM:5FF000F4 LDR R0, =(_ibootStart+1)
ROM:5FF000F8 MOV LR, PC
ROM:5FF000FC BX R0 ; _ibootStart
ROM:5FF00100
ROM:5FF00100 loc_5FF00100 ; CODE XREF: ROM:loc_5FF00100�j
ROM:5FF00100 B loc_5FF00100
</pre>

Where iBootStart (not the official Apple Symbol, of course) can be seen at:

<pre>
ROM:5FF00BA4 _ibootStart ; CODE XREF: ROM:5FF000FC�p
ROM:5FF00BA4 ; DATA XREF: ROM:5FF000F4�o ...
ROM:5FF00BA4 PUSH {R7,LR}
ROM:5FF00BA6 MOV R7, SP
ROM:5FF00BA8 LDR R0, =aIbootStart ; "\niBoot start\n"
ROM:5FF00BAA BL loc_5FF233C4
ROM:5FF00BAE MOVS R0, #0
ROM:5FF00BB0 BL loc_5FF16E54
ROM:5FF00BB4 BL loc_5FF1570C
ROM:5FF00BB8 BL loc_5FF143A8
ROM:5FF00BBC BL unk_5FF15264
ROM:5FF00BC0 LDR R0, =aMain ; "main"
..
</pre>

== Flow of iBoot (1219 - 5.0.x) ==
iBoot is quite a complicated binary, which spawns several ARM tasks to enable the boot process:

- iBootStart (disassembly started above) - starts main (5FF00BCA) - which calls the main function at 5FF00C14
- main: Does the good stuff (loading the kernel, etc)
starts the poweroff task (5FF00EF2) - calls (sub_5FF00FD0+1)
In recovery mode (failed boot):
starts command (5FF00F0A) - calls 5FF15928
starts idleoff (5FF99F2E) - calls 5FF01060

== Versions ==
=== [[audioOS]] ===
[[iBoot-4076.20.8~14]] 11.0.2 (Build 15C25)
[[iBoot-4076.30.40~30]] 11.2 beta (Build 15C4092b)
[[iBoot-4076.30.43~18]] 11.2 beta 2 (Build 15C4097d)
[[iBoot-4076.30.43~137]] 11.2.5 beta (Build 15D5037e)
11.2.5 beta 2 (Build 15D5046b)
[[iBoot-4076.30.43~140]] 11.2.5 beta 3 (Build 15D59)
[[iBoot-4076.50.126~85]] 11.3 (Build 15E217)
[[iBoot-4076.60.11~7]] 11.4 (Build 15F80)
[[iBoot-4076.70.15~19]] 11.4.1 (Build 15G77)
[[iBoot-4513.200.297~1]] 12.0 (Build 16A366)
[[iBoot-4513.220.100~1]] 12.1 (Build 16B92)
[[iBoot-4513.230.10~5]] 12.1.1 (Build 16C50)
[[iBoot-4513.230.10~63]] 12.1.3 (Build 16D39)
[[iBoot-4513.250.288~5]] 12.2 (Build 16E227)
[[iBoot-4513.260.81~7]] 12.3 (Build 16F156)
[[iBoot-5540.40.51~223]] 13.2 (Build 17B84)
13.2.1 (Build 17B90)
[[iBoot-5540.60.11~30]] 13.3 (Build 17C54)
[[iBoot-5540.80.2~139]] 13.3.1 (Build 17D50)
[[iBoot-5540.100.194~112]] 13.4 (Build 17L256)
[[iBoot-5540.120.17~6]] 13.4.5 (Build 17L562)
13.4.6 (Build 17L570)
[[iBoot-6603.0.0.110.6~12]] 14.0 beta (Build 18J5313t)
[[iBoot-6631.0.0.0.1~30]] 14.0 beta 2 (Build 18J5331g)

=== [[bridgeOS]] ===
[[iBoot-4076.47.12~1]] 2.0.1 (Build 15P2542)
[[iBoot-4076.60.11~20]] 2.3.1 (Build 15P5064)
[[iBoot-4076.75.2~1]] 2.3.2 (Build 15P6059)
[[iBoot-4076.75.2~2]] 2.4.1 (Build 15P6613)
[[iBoot-4513.200.293~99]] 3.0 (Build 16P375)
[[iBoot-4513.230.5~132]] 3.2 (Build 16P2542)
[[iBoot-4513.250.287~83]] 3.4 (Build 16P4507)
[[iBoot-4513.260.80~56]] 3.5 (Build 16P5125 and 16P5200)
[[iBoot-4513.270.14~30]] 3.6 (Build 16P6568)
[[iBoot-5540.11.1~11]] 4.0 (Build 17P572)
[[iBoot-5540.40.51~220]] 4.1 (Build 17P1081)
[[iBoot-5540.60.11~84]] 4.2 (Build 17P2551)
[[iBoot-5540.80.2~166]] 4.2 (Build 17P3050)
[[iBoot-5540.80.2~185]] 4.3 (Build 17P3561)
[[iBoot-5540.105.2~25]] 4.4 (Build 17P4263)
[[iBoot-5540.105.2~39]] 4.4 (Build 17P4281)
[[iBoot-5540.125.4~4]] 4.5 (Build 17P5290)
4.5 (Build 17P5300)
[[iBoot-5540.125.4~9]] 4.5 (Build 17P5580)

=== [[Haywire]] ===
[[iBoot-1537.4.18~1]] 6.0 (Build 10A7401)
[[iBoot-1537.9.40~2]] 6.1 beta 1 (Build 10B7095)
[[iBoot-1537.9.46~7]] 6.1 beta 2 (Build 10B7105)
[[iBoot-1537.9.50~1]] 6.1 beta 3 (Build 10B7117)
[[iBoot-1537.9.54~3]] 6.1 beta 4 (Build 10B7127)
[[iBoot-1537.9.55~3]] 6.1 beta 5 (Build 10B7129)
[[iBoot-1940.1.8~9]] 7.0 beta 1 (Build 11A7372p)
[[iBoot-1940.1.35~7]] 7.0 beta 2 (Build 11A7400)
[[iBoot-1940.1.46~12]] 7.0 beta 3 (Build 11A7414)
[[iBoot-1940.1.66~7]] 7.0 beta 4 (Build 11A7435)
[[iBoot-1940.2.1~2]] 7.0 beta 5 (Build 11A7449)
[[iBoot-1940.2.1~4]] 7.0 (Build 11A7451)
[[iBoot-1940.10.51~1]] 7.1 beta 1 (Build 11D7099)
[[iBoot-1940.10.58~28]] 7.1 beta 4 (Build 11D7134)
[[iBoot-1940.10.58~63]] 7.1 beta 5 (Build 11D7144)
[[iBoot-1940.10.58~101]] 7.1 (Build 11D7155)
[[iBoot-2261.1.6~1]] 8.0 beta 1 (Build 12A7265a)
[[iBoot-2261.1.64~18]] 8.0 beta 5 (Build 12A7346a)
[[iBoot-2261.1.66~10]] 8.0 (Build 12A7353a)

=== [[iOS]] ([[Apple TV]] ([[K66AP|2nd]] and [[Apple TV (3rd generation)|3rd]] generation)) ===
[[iBoot-931.44.21~1]] 4.0 4.1 (Build 8M89)
[[iBoot-931.71.16~9]] 4.1 4.2 (Build 8C150)
4.1.1 4.2.1 (Build 8C154)
[[iBoot-1072.33~1]] 4.2 beta 4.3 beta (Build 8F5148b)
[[iBoot-1072.38~2]] 4.2 beta 2 4.3 beta 2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.2 beta 3 4.3 beta 3 (Build 8F5166b)
[[iBoot-1072.59~2]] 4.2 4.3 (Build 8F191m)
4.2.1 4.3 (Build 8F202)
4.2.2 4.3 (Build 8F305)
4.3 4.3 (Build 8F455)
[[iBoot-1219.35.80~1]] 4.4 beta 5.0 beta (Build 9A5220p)
[[iBoot-1219.40.25~4]] 4.4 beta 2 5.0 beta 2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 4.4 beta 3 5.0 beta 3 (Build 9A5259f)
[[iBoot-1219.43.9~3]] 4.4 beta 5 5.0 beta 5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 4.4 beta 6 5.0 beta 6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 4.4 beta 7 5.0 beta 7 (Build 9A5313e)
[[iBoot-1219.43.32~21]] 4.4 5.0 (Build 9A334v)
[[iBoot-1219.43.32~22]] 4.4.1 5.0 (Build 9A335a)
4.4.2 5.0 (Build 9A336a)
[[iBoot-1219.43.32~29]] 4.4.3 5.0.1 (Build 9A405l)
4.4.4 5.0.1 (Build 9A406a)
[[iBoot-1219.62.1~2]] 5.0 beta 2 5.1 beta 2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.0 beta 3 5.1 beta 3 (Build 9B5141a)
[[iBoot-1219.62.15~2]] 5.0 5.1 (Build 9B179b)
[[iBoot-1537.1.60~15]] 5.1 beta 6.0 beta (Build 10A5316k)
[[iBoot-1537.2.11~5]] 5.1 beta 2 6.0 beta 2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 5.1 beta 3 6.0 beta 3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 5.1 beta 4 6.0 beta 4 (Build 10A5376e)
[[iBoot-1537.4.19~1]] 5.1 6.0 (Build 10A406e)
[[iBoot-1537.4.21~3]] 5.1.1 6.0.1 (Build 10A831)
[[iBoot-1537.9.40~3]] 5.2 beta 6.1 beta (Build 10B5095f)
[[iBoot-1537.9.46~8]] 5.2 beta 2 6.1 beta 2 (Build 10B5105c)
5.2 beta 3 6.1 beta 3 (Build 10B5117d)
5.2 beta 4 6.1 beta 4 (Build 10B5126d)
[[iBoot-1537.9.55~4]] 5.2 6.1 (Build 10B144b)
[[iBoot-1537.9.55~11]] 5.2.1 6.1.3 (Build 10B329a)
[[iBoot-1537.9.55~11]] 5.3 6.1.4 (Build 10B809)
[[iBoot-1940.1.8~44]] 5.4 beta 7.0 beta (Build 11A4372q)
[[iBoot-1940.1.35~9]] 5.4 beta 2 7.0 beta 2 (Build 11A4400f)
[[iBoot-1940.1.66~9]] 6.0 beta 3 7.0 beta 4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 6.0 beta 4 7.0 beta 5 (Build 11A4449a)
[[iBoot-1940.1.75~93]] 6.0 7.0.1 (Build 11A470e)
6.0 7.0.2 (Build 11A502)
[[iBoot-1940.3.5~1]] 6.0.1 7.0.3 (Build 11B511d)
6.0.2 7.0.4 (Build 11B554a)
[[iBoot-1940.10.51~3]] 6.1 beta 7.1 beta (Build 11D5099e)
[[iBoot-1940.10.57~8]] 6.1 beta 2 7.1 beta 2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 6.1 beta 3 7.1 beta 3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 6.1 beta 4 7.1 beta 4 (Build 11D5134c)
[[iBoot-1940.10.58~70]] 6.1 beta 5 7.1 beta 5 (Build 11D5145e)
[[iBoot-1940.10.58~115]] 6.1 7.1 (Build 11D167)
[[iBoot-1940.10.58~122]] 6.1.1 7.1.1 (Build 11D201c)
[[iBoot-1940.10.58~132]] 6.2 7.1.2 (Build 11D257c)
6.2.1 7.1.2 (Build 12A365b)
[[iBoot-2261.1.31~21]] 7.0 beta 8.0 beta (Build 12A4297e)
[[iBoot-2261.1.46~31]] 7.0 beta 2 8.0 beta 3 (Build 12A4318c)
[[iBoot-2261.1.57~43]] 7.0 beta 3 8.0 beta 4 (Build 12A4331d)
[[iBoot-2261.1.64~28]] 7.0 beta 4 8.0 beta 5 (Build 12A4345d)
[[iBoot-2261.1.67~8]] 7.0 [[Golden Master|GM]] 8.0 [[Golden Master|GM]] (Build 12A365b)
7.0 8.0 (Build 12A365b)
[[iBoot-2261.3.31~3]] 7.0.1 beta 8.1 beta (Build 12B401)
[[iBoot-2261.3.31~9]] 7.0.1 beta 2 8.1 beta 2 (Build 12B407)
[[iBoot-2261.3.32~2]] 7.0.1 8.1 (Build 12B410a)
[[iBoot-2261.3.33~13]] 7.0.2 beta 8.1.1 beta (Build 12B432)
[[iBoot-2261.3.33~14]] 7.0.2 8.1.1 (Build 12B435)
[[iBoot-2261.3.33~39]] 7.0.3 8.1.3 (Build 12B446)
iBoot-2261.?.??~?? 7.1 beta 8.2 beta 5 (Build 12D5480a)
[[iBoot-2261.5.64~15]] 7.1 8.2 (Build 12D508)
[[iBoot-2261.20.18~14]] 7.1 beta 2 8.3 beta 2 (Build 12F5037c)
[[iBoot-2261.20.20~9]] 7.1 beta 3 8.3 beta 4 (Build 12F61)
[[iBoot-2261.20.20~14]] 7.2 8.3 (Build 12F69)
[[iBoot-2261.30.37~79]] 7.2.1 8.4.1 (Build 12H523)
[[iBoot-2261.30.37~87]] 7.2.2 8.4.2 (Build 12H606)
[[iBoot-2261.30.37~111]] 7.3 beta 8.4.2 (Build 12H825)
[[iBoot-2261.30.37~112]] 7.3 beta 2 8.4.2 (Build 12H833)
7.3 beta 3 8.4.2 (Build 12H836)
[[iBoot-2261.30.37~114]] 7.3 beta 4 8.4.2 (Build 12H841)
[[iBoot-2261.30.37~115]] 7.3 8.4.2 (Build 12H847)
[[iBoot-2261.30.37~118]] 7.3.1 8.4.2 (Build 12H864)
[[iBoot-2261.30.37~122]] 7.4 8.4.3 (Build 12H876)

=== [[iOS]] ([[iPad]], [[iPhone]], [[iPod touch]]) ===
[[iBoot-99]] 1.0 beta (Build 1A420) [Unreleased]
[[iBoot-159]] 1.0 (Build 1A543a)
1.0.1 (Build 1C25)
1.0.2 (Build 1C28)
[[iBoot-204]] 1.1 (Build 3A100 & 3A101)
1.1.1 (Build 3A109a)
[[iBoot-204.0.2]] 1.1.1 (Build 3A110a)
[[iBoot-204.2.9]] 1.1.2 (Build 3B48b)
[[iBoot-204.3.14]] 1.1.3 (Build 4A93)
1.1.4 (Build 4A102)
[[iBoot-204.3.16]] 1.1.5 (Build 4B1)
? 1.2 beta (Build 5A147p)
[[iBoot-294]] 2.0 beta 2 (Build 5A225c)
[[iBoot-304]] 2.0 beta 3 (Build 5A240d)
[[iBoot-311]] 2.0 beta 4 (Build 5A258f)
? 2.0 beta 5 (Build 5A274d)
? 2.0 beta 6 Pre-release (Build 5A292g)
? 2.0 beta 6 Final (Build 5A308)
? 2.0b7 (Build 5A331)
[[iBoot-320.19]] 2.0b8 ([[Golden Master|GM]]) (Build 5A345)
[[iBoot-320.20]] 2.0 (Build 5A347)
2.0.1 (Build 5B108)
2.0.2 (Build 5C1)
? 2.1 beta (Build 5F90)
[[iBoot-385.22]] 2.1 (Build 5F137)
2.1.1 (Build 5F138)
? 2.2 beta (Build 5G29)
[[iBoot-385.49]] 2.2 (Build 5G77 & 5G77a)
2.2.1 (Build 5H11 & 5H11a)
[[iBoot-573.1]] 3.0 beta (Build 7A238j)
[[iBoot-594.2~1]] 3.0 beta 2 (Build 7A259g)
[[iBoot-596.6~3]] 3.0 beta 3 (Build 7A280f)
[[iBoot-596.16~2]] 3.0 beta 4 (Build 7A300g)
[[iBoot-596.20~1]] 3.0 beta 5 (Build 7A312g)
[[iBoot-596.24~1]] 3.0 (Build 7A341)
3.0.1 (Build 7A400)
[[iBoot-636.26~2]] 3.1 beta (Build 7C97d)
[[iBoot-636.35~1]] 3.1 beta 2 (Build 7C106c)
[[iBoot-636.47~1]] 3.1 beta 3 (Build 7C116a)
[[iBoot-636.65|iBoot-636.65~2]] 3.1 (Build 7C144)
[[iBoot-636.66~1]] 3.1.1 (Build 7C145 & 7C146)
[[iBoot-636.66~5]] 3.1.2 (Build 7D11)
[[iBoot-636.66.33~4]] 3.1.3 (Build 7E18)
[[iBoot-817.28|iBoot-817.28~18]] 3.2 (Build 7B367)
[[iBoot-817.29~2]] 3.2.1 (Build 7B405)
3.2.2 (Build 7B500)
[[iBoot-822.2.1]] 4.0 beta (Build 8A2180g) [Unreleased]
[[iBoot-872~12]] 4.0 beta (Build 8A230m)
[[iBoot-889.3~2]] 4.0 beta 2 (Build 8A248c)
[[iBoot-889.12~2]] 4.0 beta 3 (Build 8A260b)
[[iBoot-889.19~1]] 4.0 beta 4 (Build 8A274b)
[[iBoot-889.24~4]] 4.0 [[Golden Master|GM]] (Build 8A293)
4.0 (Build 8A293)
4.0.1 (Build 8A306)
4.0.2 (Build 8A400)
[[iBoot-931.18.1~1]] 4.1 beta (Build 8B5080c)
[[iBoot-931.18.15~2]] 4.1 beta 2 (Build 8B5091b)
[[iBoot-931.18.27~1]] 4.1 (Build 8B117 & 8B118)
[[iBoot-931.67~2]] 4.2 beta (Build 8C5091e)
[[iBoot-931.71.80~1]] 4.2 beta 2 (Build 8C5101c)
[[iBoot-931.71.13~3]] 4.2 beta 3 (Build 8C5115c)
[[iBoot-931.71.16~9]] 4.2 [[Golden Master|GM]] (Build 8C134)
4.2 [[Golden Master|GM]] (Build 8C134b)
4.2.1 [[Golden Master|GM]] (Build 8C148)
4.2.1 (Build 8C148 & 8C148a)
[[iBoot-931.72.14~6]] 4.2.5 (Build 8E128)
4.2.6 (Build 8E200)
4.2.7 (Build 8E303)
4.2.8 (Build 8E401)
[[iBoot-931.72.14~10]] 4.2.9 (Build 8E501)
4.2.10 (Build 8E600)
[[iBoot-1072.33~1]] 4.3 beta (Build 8F5148b)
[[iBoot-1072.38~2]] 4.3 beta 2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.3 beta 3 (Build 8F5166b)
[[iBoot-1072.58~4]] 4.3 [[Golden Master|GM]] (Build 8F190)
4.3 (Build 8F190)
[[iBoot-1072.59~2]] 4.3 (Build 8F191)
4.3.1 (Build 8G4)
[[iBoot-1072.61~2]] 4.3.2 (Build 8H7 & 8H8)
4.3.3 (Build 8J2 & 8J3)
[[iBoot-1072.61~6]] 4.3.4 (Build 8K2)
4.3.5 (Build 8L1)
[[iBoot-1219.35.80~1]] 5.0 beta (Build 9A5220p)
[[iBoot-1219.40.25~4]] 5.0 beta 2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 5.0 beta 3 (Build 9A5259f)
[[iBoot-1219.42.8~1]] 5.0 beta 4 (Build 9A5274d)
[[iBoot-1219.43.9~3]] 5.0 beta 5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 5.0 beta 6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 5.0 beta 7 (Build 9A5313e)
[[iBoot-1219.43.32~15]] 5.0 [[Golden Master|GM]] (Build 9A332) [Unreleased]
5.0 [[Golden Master|GM]] (Build 9A334)
5.0 (Build 9A334)
[[iBoot-1219.43.32~27]] 5.0.1 beta (Build 9A402)
[[iBoot-1219.43.32~29]] 5.0.1 beta 2 (Build 9A404)
5.0.1 (Build 9A405 & 9A406)
[[iBoot-1219.61.19~6]] 5.1 beta (Build 9B5117b)
[[iBoot-1219.62.1~2]] 5.1 beta 2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.1 beta 3 (Build 9B5141a)
[[iBoot-1219.62.15]] 5.1 (Build 9B176)
[[iBoot-1219.62.15~2]] 5.1 (Build 9B179b)
5.1.1 (Build 9B206)
[[iBoot-1537.1.60~15]] 6.0 beta (Build 10A5316k)
[[iBoot-1537.2.11~5]] 6.0 beta 2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 6.0 beta 3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 6.0 beta 4 (Build 10A5376e)
[[iBoot-1537.4.18~2]] 6.0 [[Golden Master|GM]] (Build 10A403)
6.0 (Build 10A403)
[[iBoot-1537.4.19~1]] 6.0 (Build 10A405 & 10A406)
[[iBoot-1537.4.20~1]] 6.0 (Build 10A407)
[[iBoot-1537.4.21~3]] 6.0.1 (Build 10A523 & 10A525)
[[iBoot-1537.4.21~2]] 6.0.1 (Build 10A8426)
6.0.2 (Build 10A8500)
[[iBoot-1537.4.21~3]] 6.0.2 (Build 10A550 & 10A551)
[[iBoot-1537.9.40~3]] 6.1 beta (Build 10B5095f)
[[iBoot-1537.9.46~8]] 6.1 beta 2 (Build 10B5105c)
[[iBoot-1537.9.50~2]] 6.1 beta 3 (Build 10B5117b)
[[iBoot-1537.9.54~4]] 6.1 beta 4 (Build 10B5126b)
[[iBoot-1537.9.55~4]] 6.1 beta 5 (Build 10B141, 10B142, 10B143 & 10B144)
6.1 (Build 10B141, 10B142, 10B143 & 10B144)
6.1.1 beta (Build 10B311)
6.1.1 (Build 10B145)
6.1.2 (Build 10B146 & 10B147)
[[iBoot-1537.9.55~11]] 6.1.3 beta 2 (Build 10B318)
6.1.3 beta 2 (Build 10B318a)
6.1.3 (Build 10B329)
6.1.4 (Build 10B350)
6.1.5 (Build 10B400)
6.1.6 (Build 10B500)
[[iBoot-1940.1.8~44]] 7.0 beta (Build 11A4372q)
[[iBoot-1940.1.35~9]] 7.0 beta 2 (Build 11A4400f)
[[iBoot-1940.1.46.1.1~1]] 7.0 beta 3 (Build 11A4414e)
[[iBoot-1940.1.66~9]] 7.0 beta 4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 7.0 beta 5 (Build 11A4449a)
7.0 beta 6 (Build 11A4449d)
[[iBoot-1940.1.75~20]] 7.0 [[Golden Master|GM]] (Build 11A465)
7.0 (Build 11A465 & 11A466)
[[iBoot-1940.1.75~93]] 7.0.1 (Build 11A470a)
7.0.2 (Build 11A501)
[[iBoot-1940.3.5~1]] 7.0.3 (Build 11B511)
7.0.4 (Build 11B554a)
7.0.5 (Build 11B601)
7.0.6 (Build 11B651)
[[iBoot-1940.10.51~3]] 7.1 beta (Build 11D5099e)
[[iBoot-1940.10.57~8]] 7.1 beta 2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 7.1 beta 3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 7.1 beta 4 (Build 11D5134c)
[[iBoot-1940.10.58~70]] 7.1 beta 5 (Build 11D5145e)
[[iBoot-1940.10.58~115]] 7.1 (Build 11D167 & 11D169)
[[iBoot-1940.10.58~122]] 7.1.1 (Build 11D201)
[[iBoot-1940.10.58~132]] 7.1.2 (Build 11D257)
[[iBoot-2261.1.6.0.1~45]] 8.0 beta (Build 12A4265u)
[[iBoot-2261.1.31~21]] 8.0 beta 2 (Build 12A4297e)
[[iBoot-2261.1.46~31]] 8.0 beta 3 (Build 12A4318c)
[[iBoot-2261.1.57~43]] 8.0 beta 4 (Build 12A4331d)
[[iBoot-2261.1.64~28]] 8.0 beta 5 (Build 12A4345d)
[[iBoot-2261.1.67~8]] 8.0 [[Golden Master|GM]] (Build 12A365)
8.0 (Build 12A365 & 12A366)
[[iBoot-2261.1.68~1]] 8.0.1 (Build 12A402)
8.0.2 (Build 12A405)
[[iBoot-2261.3.31~3]] 8.1 beta (Build 12B401)
[[iBoot-2261.3.31~9]] 8.1 beta 2 (Build 12B407)
[[iBoot-2261.3.32~2]] 8.1 (Build 12B410 & 12B411)
[[iBoot-2261.3.33~13]] 8.1.1 beta (Build 12B432)
[[iBoot-2261.3.33~14]] 8.1.1 (Build 12B435 & 12B436)
8.1.2 (Build 12B440)
[[iBoot-2261.3.33~39]] 8.1.3 (Build 12B446)
[[iBoot-2261.5.34~3]] 8.2 beta (Build 12D436)
[[iBoot-2261.5.41~10]] 8.2 beta 2 (Build 12D445d)
[[iBoot-2261.5.47~1]] 8.2 beta 3 (Build 12D5452a)
[[iBoot-2261.5.54~3]] 8.2 beta 4 (Build 12D5461b)
[[iBoot-2261.5.58~25]] 8.2 beta 5 (Build 12D5480a)
[[iBoot-2261.5.64~15]] 8.2 (Build 12D508)
[[iBoot-2261.20.16~6]] 8.3 beta (Build 12F5027d)
[[iBoot-2261.20.18~14]] 8.3 beta 2 (Build 12F5037c)
[[iBoot-2261.20.19~16]] 8.3 beta 3 (Build 12F5047f)
[[iBoot-2261.20.20~9]] 8.3 beta 4 (Build 12F61)
[[iBoot-2261.20.20~14]] 8.3 (Build 12F69)
[[iBoot-2261.30.33~16]] 8.4 beta (Build 12H4074d)
[[iBoot-2261.30.34~8]] 8.4 beta 2 (Build 12H4086d)
[[iBoot-2261.30.35~21]] 8.4 beta 3 (Build 12H4098c)
[[iBoot-2261.30.37~17]] 8.4 beta 4 (Build 12H4125a)
[[iBoot-2261.30.37~34]] 8.4 (Build 12H143)
[[iBoot-2261.30.37~39]] 8.4.1 beta (Build 12H304)
[[iBoot-2261.30.37~55]] 8.4.1 beta 2 (Build 12H318)
[[iBoot-2261.30.37~58]] 8.4.1 (Build 12H321)
[[iBoot-2817.0.0.1.2~2]] 9.0 beta (Build 13A4254v)
[[iBoot-2817.1.41.1.1~1]] 9.0 beta 2 (Build 13A4280e)
[[iBoot-2817.1.55~10]] 9.0 beta 3 (Build 13A4293g)
[[iBoot-2817.1.73~9]] 9.0 beta 4 (Build 13A4305g)
[[iBoot-2817.1.89~3]] 9.0 beta 5 (Build 13A4325c)
[[iBoot-2817.1.93~1]] 9.0 [[Golden Master|GM]] (Build 13A340)
[[iBoot-2817.1.93~1]] 9.0 (Build 13A340, 13A342, 13A343 & 13A344)
[[iBoot-2817.1.94~1]] 9.0.1 (Build 13A404)
9.0.1 (Build 13A405)
9.0.2 (Build 13A452)
[[iBoot-2817.10.26~8]] 9.1 beta (Build 13B5110e)
[[iBoot-2817.10.29~16]] 9.1 beta 2 (Build 13B5119e)
[[iBoot-2817.10.34~1]] 9.1 beta 3 (Build 13B5130b)
[[iBoot-2817.10.34~7]] 9.1 beta 4 (Build 13B136)
9.1 beta 5 (Build 13B137 & 13B139)
9.1 (Build 13B143)
[[iBoot-2817.10.35~1]] 9.1 (Build 13B144)
[[iBoot-2817.20.21~5]] 9.2 beta (Build 13C5055d)
[[iBoot-2817.20.24~4]] 9.2 beta 2 (Build 13C5060d)
[[iBoot-2817.20.26~3]] 9.2 beta 3 (Build 13C71)
9.2 beta 4 (Build 13C75)
9.2 (Build 13C75)
9.2.1 beta (Build 13D11)
9.2.1 beta 2 (Build 13D14)
9.2.1 (Build 13D15 & 13D20)
[[iBoot-2817.40.91~21]] 9.3 beta (Build 13E5181d)
9.3 beta 1.1 (Build 13E5181f)
[[iBoot-2817.40.97~26]] 9.3 beta 2 (Build 13E5191d)
[[iBoot-2817.40.102~26]] 9.3 beta 3 (Build 13E5200d)
[[iBoot-2817.40.104~56]] 9.3 beta 4 (Build 13E5214d)
[[iBoot-2817.40.106~16]] 9.3 beta 5 (Build 13E5225a)
9.3 beta 6 (Build 13E5231a)
9.3 beta 7 (Build 13E5233a)
9.3 beta 7 (Build 13E5234a)
[[iBoot-2817.40.106~2]] 9.3 (Build 13E233, 13E234, 13E236 & 13E237)
[[iBoot-2817.50.1~16]] 9.3.2 beta (Build 13F51a)
[[iBoot-2817.50.2~2]] 9.3.2 beta 2 (Build 13F61)
9.3.2 beta 3 (Build 13F65)
[[iBoot-2817.50.3~1]] 9.3.2 beta 4 (Build 13F68)
9.3.2 (Build 13F69 & 13F72)
9.3.3 beta (Build 13G12)
[[iBoot-2817.60.1~1]] 9.3.3 beta 2 (Build 13G21)
[[iBoot-2817.60.2~2]] 9.3.3 beta 3 (Build 13G29)
9.3.3 beta 4 (Build 13G33)
9.3.3 beta 5 (Build 13G34)
9.3.3 (Build 13G34)
9.3.4 (Build 13G35)
9.3.5 (Build 13G36)
[[iBoot-3393~52]] 10.0 beta (Build 14A5261v)
[[iBoot-3406.1.46~11]] 10.0 beta 2 (Build 14A5297c)
[[iBoot-3406.1.59~66]] 10.0 beta 3 (Build 14A5309d)
[[iBoot-3406.1.68~82]] 10.0 beta 4 (Build 14A5322e)
[[iBoot-3406.1.77~16]] 10.0 beta 5 (Build 14A5335b)
10.0 beta 6 (Build 14A5341a)
10.0 beta 7 (Build 14A5345a)
10.0 beta 8 (Build 14A5346a)
[[iBoot-3406.1.79~1]] 10.0.1 [[Golden Master|GM]] (Build 14A403)
10.0.1 (Build 14A403)
10.0.2 (Build 14A456)
10.0.3 (Build 14A551)
[[iBoot-3406.20.16~118]] 10.1 beta (Build 14B55c)
[[iBoot-3406.20.16~161]] 10.1 beta 2 (Build 14B67)
10.1 beta 3 (Build 14B71)
10.1 beta 4 (Build 14B72)
10.1 beta 4 (Build 14B72b)
10.1 beta 5 (Build 14B72c)
10.1 (Build 14B72 & 14B72c)
10.1.1 (Build 14B100 & 14B150)
[[iBoot-3406.30.8~10]] 10.2 beta (Build 14C5062e)
[[iBoot-3406.30.8~373]] 10.2 beta 2 (Build 14C5069c)
[[iBoot-3406.30.8~503]] 10.2 beta 3 (Build 14C5077b)
[[iBoot-3406.30.8~497]] 10.2 beta 4 (Build 14C82)
10.2 beta 5 (Build 14C89)
10.2 beta 6 (Build 14C90)
10.2 beta 6 (Build 14C91)
10.2 beta 7 (Build 14C92)
10.2 (Build 14C92)
10.2.1 beta (Build 14D10)
[[iBoot-3406.42.1~1]] 10.2.1 beta 2 (Build 14D15)
[[iBoot-3406.42.5~1]] 10.2.1 beta 3 (Build 14D23)
10.2.1 beta 4 (Build 14D27)
10.2.1 (Build 14D27)
[[iBoot-3406.50.223~16]] 10.3 beta (Build 14E5230e)
[[iBoot-3406.50.229~9]] 10.3 beta 2 (Build 14E5239e)
[[iBoot-3406.50.236~77]] 10.3 beta 3 (Build 14E5249d)
[[iBoot-3406.50.243~9]] 10.3 beta 4 (Build 14E5260b)
[[iBoot-3406.50.244~4]] 10.3 beta 5 (Build 14E5269a)
10.3 beta 6 (Build 14E5273a)
10.3 beta 7 (Build 14E5277a)
[[iBoot-3406.50.244~1]] 10.3 (Build 14E277)
10.3.1 (Build 14E304)
[[iBoot-3406.60.7~9]] 10.3.2 beta (Build 14F5065b)
[[iBoot-3406.60.10~10]] 10.3.2 beta 2 (Build 14F5075a)
[[iBoot-3406.60.10~25]] 10.3.2 beta 3 (Build 14F5080a)
[[iBoot-3406.60.10~40]] 10.3.2 beta 4 (Build 14F5086a)
10.3.2 beta 5 (Build 14F5089a)
[[iBoot-3406.60.10~39]] 10.3.2 (Build 14F89, 14F90 & 14F91)
[[iBoot-3406.60.10~38]] 10.3.2 (Build 14F8089)
[[iBoot-3406.60.10~64]] 10.3.3 beta (Build 14G5028a)
10.3.3 beta 2 (Build 14G5037b)
[[iBoot-3406.60.10~74]] 10.3.3 beta 3 (Build 14G5047a)
10.3.3 beta 4 (Build 14G5053a)
10.3.3 beta 5 (Build 14G5057a)
[[iBoot-3406.60.10~70]] 10.3.3 beta 6 (Build 14G57 & 14G58)
10.3.3 (Build 14G60)
[[iBoot-3974~299]] 11.0 beta (Build 15A5278f)
[[iBoot-4051~60]] 11.0 beta 2 (Build 15A5304i & 15A5304h)
[[iBoot-4076.1.9~24]] 11.0 beta 3 (Build 15A5318g)
[[iBoot-4076.1.22~32]] 11.0 beta 4 (Build 15A5327g)
[[iBoot-4076.1.39~22]] 11.0 beta 5 (Build 15A5341f)
[[iBoot-4076.1.43~178]] 11.0 beta 6 (Build 15A5354b)
[[iBoot-4076.1.44~40]] 11.0 beta 7 (Build 15A5362a)
11.0 beta 8 (Build 15A5368a)
11.0 beta 9 (Build 15A5370a)
[[iBoot-4076.1.44~197]] 11.0 beta 10 (Build 15A5372a)
[[iBoot-4076.1.44~40]] 11.0 [[Golden Master|GM]] (Build 15A372)
11.0 (Build 15A372)
[[iBoot-4076.1.44~197]] 11.0.1 (Build 15A402 & 15A403)
11.0.2 (Build 15A421)
11.0.3 (Build 15A432)
[[iBoot-4076.20.45~8]] 11.1 beta (Build 15B5066f)
[[iBoot-4076.20.47~5]] 11.1 beta 2 (Build 15B5078e)
[[iBoot-4076.20.48~5]] 11.1 beta 3 (Build 15B5086a)
[[iBoot-4076.20.48~1]] 11.1 beta 4 (Build 15B92)
11.1 beta 5 (Build 15B93)
11.1 (Build 15B93 & 15B101)
11.1.1 (Build 15B150)
11.1.2 (Build 15B202)
[[iBoot-4076.30.40~29]] 11.2 beta (Build 15C5092b)
[[iBoot-4076.30.43~19]] 11.2 beta 2 (Build 15C5097d)
[[iBoot-4076.30.43~80]] 11.2 beta 3 (Build 15C5107a)
11.2 beta 4 (Build 15C5110b)
11.2 beta 5 (Build 15C5111a)
[[iBoot-4076.30.43~76]] 11.2 beta 6 (Build 15C114)
11.2 (Build 15C114)
11.2.1 (Build 15C153)
11.2.2 (Build 15C202)
[[iBoot-4076.30.43~137]] 11.2.5 beta (Build 15D5037e)
11.2.5 beta 2 (Build 15D5046b)
11.2.5 beta 3 (Build 15D5049a)
11.2.5 beta 4 (Build 15D5054a)
11.2.5 beta 5 (Build 15D5057a)
11.2.5 beta 6 (Build 15D5059a)
[[iBoot-4076.30.43~140]] 11.2.5 beta 7 (Build 15D60)
11.2.5 (Build 15D60)
11.2.6 (Build 15D100)
[[iBoot-4076.50.114~5]] 11.3 beta (Build 15E5167f)
[[iBoot-4076.50.120.100.1~2]] 11.3 beta 2 (Build 15E5178f)
[[iBoot-4076.50.123~69]] 11.3 beta 3 (Build 15E5189f)
[[iBoot-4076.50.126~20]] 11.3 beta 4 (Build 15E5201e)
[[iBoot-4076.50.126~63]] 11.3 beta 5 (Build 15E5211a)
[[iBoot-4076.50.126~80]] 11.3 beta 6 (Build 15E5216a)
[[iBoot-4076.50.126~85]] 11.3 (Build 15E216 & 15E218)
11.3.1 (Build 15E302)
[[iBoot-4076.60.7~268]] 11.4 beta (Build 15F5037c)
[[iBoot-4076.60.7~410]] 11.4 beta 2 (Build 15F5049c)
[[iBoot-4076.60.8.0.1~4]] 11.4 beta 3 (Build 15F5061d)
[[iBoot-4076.60.8.0.2~1]] 11.4 beta 3 (Build 15F5061e)
[[iBoot-4076.60.11~9]] 11.4 beta 4 (Build 15F5071a)
11.4 beta 5 (Build 15F5077a)
11.4 beta 6 (Build 15F5079a)
[[iBoot-4076.60.11~7]] 11.4 (Build 15F79)
[[iBoot-4076.70.9~78]] 11.4.1 beta (Build 15G5054c)
[[iBoot-4076.70.14~17]] 11.4.1 beta 2 (Build 15G5063b)
[[iBoot-4076.70.15~35]] 11.4.1 beta 3 (Build 15G5072a)
11.4.1 beta 4 (Build 15G5074a)
11.4.1 beta 5 (Build 15G5077a)
[[iBoot-4076.70.15~19]] 11.4.1 (Build 15G77)
[[iBoot-4513.200.159.10.1~21]] 12.0 beta (Build 16A5288q)
[[iBoot-4513.200.209~14]] 12.0 beta 2 (Build 16A5308e)
[[iBoot-4513.200.230.0.1~10]] 12.0 beta 3 (Build 16A5318d)
[[iBoot-4513.200.250~13]] 12.0 beta 4 (Build 16A5327f)
[[iBoot-4513.200.278~74]] 12.0 beta 5 (Build 16A5339e)
[[iBoot-4513.200.287.0.2~15]] 12.0 beta 6 (Build 16A5345f)
[[iBoot-4513.200.294~3]] 12.0 beta 7 (Build 16A5354b)
[[iBoot-4513.200.295~3]] 12.0 beta 8 (Build 16A5357b)
[[iBoot-4513.200.297~3]] 12.0 beta 9 (Build 16A5362a)
12.0 beta 10 (Build 16A5364a)
12.0 beta 11 (Build 16A5365b)
12.0 beta 12 (Build 16A5366a)
[[iBoot-4513.200.297~1]] 12.0 [[Golden Master|GM]] (Build 16A366)
12.0 (Build 16A366)
12.0.1 (Build 16A404 & 16A405)
[[iBoot-4513.220.83~22]] 12.1 beta (Build 16B5059d)
[[iBoot-4513.220.91~16]] 12.1 beta 2 (Build 16B5068i)
[[iBoot-4513.220.97~21]] 12.1 beta 3 (Build 16B5077c)
[[iBoot-4513.220.99~8]] 12.1 beta 4 (Build 16B5084a)
[[iBoot-4513.220.100~3]] 12.1 beta 5 (Build 16B5089b)
[[iBoot-4513.220.100~1]] 12.1 (Build 16B92, 16B93)
[[iBoot-4513.220.101~1]] 12.1 (Build 16B94)
[[iBoot-4513.230.5~88]] 12.1.1 beta (Build 16C5036c)
[[iBoot-4513.230.7~9]] 12.1.1 beta 2 (Build 16C5043b)
[[iBoot-4513.230.10~6]] 12.1.1 beta 3 (Build 16C5050a)
[[iBoot-4513.230.10~5]] 12.1.1 (Build 16C50)
[[iBoot-4513.230.10~43]] 12.1.2 beta (Build 16D5024a)
[[iBoot-4513.230.10~5]] 12.1.2 (Build 16C101 & 16C104)
[[iBoot-4513.230.10~60]] 12.1.3 beta 2 (Build 16D5032a)
12.1.3 beta 3 (Build 16D5037a)
12.1.3 beta 4 (Build 16D5039a)
[[iBoot-4513.230.10~63]] 12.1.3 (Build 16D39 & 16D40)
12.1.4 (Build 16D57)
[[iBoot-4513.250.271~158]] 12.2 beta (Build 16E5181f)
[[iBoot-4513.250.278~94]] 12.2 beta 2 (Build 16E5191d)
[[iBoot-4513.250.284~8]] 12.2 beta 3 (Build 16E5201e)
[[iBoot-4513.250.287~11]] 12.2 beta 4 (Build 16E5212f)
[[iBoot-4513.250.288~22]] 12.2 beta 5 (Build 16E5223a)
12.2 beta 6 (Build 16E5227a)
[[iBoot-4513.250.288~5]] 12.2 (Build 16E227)
[[iBoot-4513.260.69.100.1~1]] 12.3 beta (Build 16F5117h)
[[iBoot-4513.260.78~8]] 12.3 beta 2 (Build 16F5129d)
[[iBoot-4513.260.80~30]] 12.3 beta 3 (Build 16F5139e)
[[iBoot-4513.260.81~11]] 12.3 beta 4 (Build 16F5148a)
12.3 beta 5 (Build 16F5155a)
12.3 beta 6 (Build 16F5156a)
[[iBoot-4513.260.81~7]] 12.3 (Build 16F156)
12.3.1 (Build 16F203)
12.3.2 (Build 16F250)
[[iBoot-4513.260.81~15]] 12.3.1 (Build 16F8202)
[[iBoot-4513.270.8~24]] 12.4 beta (Build 16G5027g)
12.4 beta 2 (Build 16G5027i)
[[iBoot-4513.270.11~19]] 12.4 beta 3 (Build 16G5038d)
[[iBoot-4513.270.12~39]] 12.4 beta 4 (Build 16G5046d)
[[iBoot-4513.270.14~22]] 12.4 beta 5 (Build 16G5056d)
12.4 beta 6 (Build 16G5069a)
12.4 beta 7 (Build 16G5077a)
[[iBoot-4513.270.14~26]] 12.4 (Build 16G77)
12.4.1 (Build 16G102)
12.4.2 (Build 16G114)
12.4.3 (Build 16G130)
12.4.4 (Build 16G140)
12.4.5 (Build 16G161)
12.4.6 (Build 16G183)
12.4.7 (Build 16G192)
[[iBoot-5540.0.15.0.2~258]] 13.0 beta (Build 17A5492t)
[[iBoot-5540.0.49.0.1~183]] 13.0 beta 2 (Build 17A5508m)
[[iBoot-5540.0.76~14]] 13.0 beta 3 (Build 17A5522f & 17A5522g)
[[iBoot-5540.0.87.142.1~2]] 13.0 beta 4 (Build 17A5534f)
[[iBoot-5540.0.117~24]] 13.0 beta 5 (Build 17A5547d)
[[iBoot-5540.0.117.2~16]] 13.0 beta 6 (Build 17A5556d)
[[iBoot-5540.0.117.3~6]] 13.0 beta 7 (Build 17A5565b)
[[iBoot-5540.0.117.3~26]] 13.0 beta 8 (Build 17A5572a)
[[iBoot-5540.0.117.3~18]] 13.0 [[Golden Master|GM]] (Build 17A577)
13.0 (Build 17A577)
[[iBoot-5540.0.126~56]] 13.1 beta (Build 17A5821e)
[[iBoot-5540.0.129~21]] 13.1 beta 2 (Build 17A5831c)
[[iBoot-5540.0.129~115]] 13.1 beta 3 (Build 17A5837a)
[[iBoot-5540.0.129~199]] 13.1 beta 4 (Build 17A5844a & 17A5844b)
[[iBoot-5540.0.129~161]] 13.1 (Build 17A844)
13.1.1 (Build 17A854)
13.1.2 (Build 17A860 & 17A861)
[[iBoot-5540.0.129~250]] 13.1.3 (Build 17A878)
[[iBoot-5540.40.50~31]] 13.2 beta (Build 17B5059g)
[[iBoot-5540.40.51~47]] 13.2 beta 2 (Build 17B5068e)
[[iBoot-5540.40.51~190]] 13.2 beta 3 (Build 17B5077a)
[[iBoot-5540.40.51~224]] 13.2 beta 4 (Build 17B5084a)
[[iBoot-5540.40.51~223]] 13.2 (Build 17B84)
13.2.2 (Build 17B102)
13.2.3 (Build 17B111)
13.3 (Build 17C54)
[[iBoot-5540.60.6~89]] 13.3 beta (Build 17C5032d)
[[iBoot-5540.60.11~45]] 13.3 beta 2 (Build 17C5038a)
[[iBoot-5540.60.11~127]] 13.3 beta 3 (Build 17C5046a)
13.3 beta 4 (Build 17C5053a)
[[iBoot-5540.60.11~30]] 13.3 (Build 17C54)
[[iBoot-5540.80.1~87]] 13.3.1 beta (Build 17D5026c)
[[iBoot-5540.80.2~141]] 13.3.1 beta 2 (Build 17D5044a)
13.3.1 beta 3 (Build 17D5050a)
[[iBoot-5540.80.2~139]] 13.3.1 (Build 17D50)
[[iBoot-5540.100.177.0.1~95]] 13.4 beta (Build 17E5223h)
[[iBoot-5540.100.190~100]] 13.4 beta 2 (Build 17E5233g)
[[iBoot-5540.100.194~24]] 13.4 beta 3 (Build 17E5241d)
[[iBoot-5540.102.2~27]] 13.4 beta 4 (Build 17E5249a)
[[iBoot-5540.102.4~4]] 13.4 beta 5 (Build 17E5255a)
[[iBoot-5540.102.4~2]] 13.4 beta 6 (Build 17E255)
13.4 (Build 17E255)
13.4.1 (Build 17E262)
[[iBoot-5540.120.9~34]] 13.4.5 beta (Build 17F5034c)
[[iBoot-5540.120.14~45]] 13.4.5 beta 2 (Build 17F5044d)
[[iBoot-5540.120.15.0.1~34]] 13.5 beta 3 (Build 17F5054h)
[[iBoot-5540.120.17~56]] 13.5 beta 4 (Build 17F5065a)
[[iBoot-5540.120.17~20]] 13.5 [[Golden Master|GM]] (Build 17F75)
13.5 (Build 17F75)
13.5.1 (Build 17F80)
[[iBoot-5540.140.5~29]] 13.5.5 beta (Build 17G5035d)
[[iBoot-5540.140.7~39]] 13.6 beta 2 (Build 17G5045c)
[[iBoot-5540.140.12~15]] 13.6 beta 3 (Build 17G5059c)
[[iBoot-6603.0.0.110.6~14]] 14.0 beta (Build 18A5301v)
[[iBoot-6631.0.0.0.1~157]] 14.0 beta 2 (Build 18A5319i)

=== [[tvOS]] ===
[[iBoot-2817.10.22~26]] 9.0 beta (Build 13T5347l)
[[iBoot-2817.10.29~9]] 9.0 beta 2 (Build 13T5365h)
[[iBoot-2817.10.34~5]] 9.0 beta 3 (Build 13T5379f)
[[iBoot-2817.12.1~1]] 9.0 [[Golden Master|GM]] (Build 13T396)
9.0 (Build 13T396)
9.0.1 (Build 13T402)
[[iBoot-2817.20.24~5]] 9.1 beta (Build 13U5061d)
[[iBoot-2817.20.26~2]] 9.1 beta 2 (Build 13U5069b)
[[iBoot-2817.20.26~7]] 9.1 beta 3 (Build 13U5077a)
[[iBoot-2817.20.26~1]] 9.1 (Build 13U85)
[[iBoot-2817.20.26~8]] 9.1.1 beta (Build 13U713)
9.1.1 (Build 13U717)
[[iBoot-2817.40.91~19]] 9.2 beta (Build 13Y5179e)
[[iBoot-2817.40.97~10]] 9.2 beta 2 (Build 13Y5189e)
[[iBoot-2817.40.102~14]] 9.2 beta 3 (Build 13Y5198c)
[[iBoot-2817.40.104~50]] 9.2 beta 4 (Build 13Y5210d)
[[iBoot-2817.40.106~15]] 9.2 beta 5 (Build 13Y5220c)
[[iBoot-2817.40.106~15]] 9.2 beta 6 (Build 13Y5232a)
[[iBoot-2817.40.106~18]] 9.2 (Build 13Y234)
[[iBoot-2817.50.1~20]] 9.2.1 beta (Build 13Y5752a)
[[iBoot-2817.50.2~1]] 9.2.1 beta 2 Pre-release (Build 13Y763b)
9.2.1 beta 2 (Build 13Y763c)
9.2.1 beta 3 (Build 13Y768)
9.2.1 beta 4 (Build 13Y772)
9.2.1 (Build 13Y772)
[[iBoot-2817.50.2~11]] 9.2.2 beta (Build 13Y807)
[[iBoot-2817.60.1~2]] 9.2.2 beta 2 (Build 13Y816)
[[iBoot-2817.60.2~1]] 9.2.2 beta 3 (Build 13Y823)
9.2.2 beta 4 (Build 13Y824)
9.2.2 beta 5 (Build 13Y825)
9.2.2 (Build 13Y825)
[[iBoot-3393~157]] 10.0 beta (Build 14T5253s)
[[iBoot-3406.1.46~9]] 10.0 beta 2 (Build 14T5284d)
[[iBoot-3406.1.59~57]] 10.0 beta 3 (Build 14T5296d)
[[iBoot-3406.1.68~85]] 10.0 beta 4 (Build 14T5308d)
[[iBoot-3406.1.77~19]] 10.0 beta 5 (Build 14T5321a)
10.0 beta 6 (Build 14T5327a)
10.0 beta 7 (Build 14T5327a)
[[iBoot-3406.1.77~13]] 10.0 [[Golden Master|GM]] (Build 14T330)
10.0 (Build 14T330)
[[iBoot-3406.20.16~117]] 10.0.1 beta (Build 14U54)
10.0.1 beta 2 (Build 14U66)
10.0.1 beta 3 (Build 14U69)
10.0.1 beta 4 (Build 14U71)
10.0.1 (Build 14U71 & 14U100)
[[iBoot-3406.30.8~11]] 10.1 beta (Build 14U5565b)
[[iBoot-3406.30.8~374]] 10.1 beta 2 (Build 14U5574b)
[[iBoot-3406.30.8~501]] 10.1 beta 3 (Build 14U5582b)
[[iBoot-3406.30.8~493]] 10.1 beta 4 (Build 14U588)
10.1 beta 5 (Build 14U593)
10.1 (Build 14U593)
10.1.1 beta (Build 14U707)
10.1.1 beta 2 (Build 14U711)
10.1.1 (Build 14U712a)
[[iBoot-3406.50.223~18]] 10.2 beta (Build 14W5222d)
[[iBoot-3406.50.229~12]] 10.2 beta 2 (Build 14W5231d)
[[iBoot-3406.50.236~71]] 10.2 beta 3 (Build 14W5241c)
[[iBoot-3406.53.1~1]] 10.2 beta 4 (Build 14W5252c)
[[iBoot-3406.53.2~2]] 10.2 beta 5 (Build 14W5260a)
10.2 beta 6 (Build 14W5264a)
[[iBoot-3406.53.2~1]] 10.2 (Build 14W265)
[[iBoot-3406.60.7~17]] 10.2.1 beta (Build 14W5563b)
[[iBoot-3406.60.10~11]] 10.2.1 beta 2 (Build 14W5573a)
[[iBoot-3406.60.10~29]] 10.2.1 beta 3 (Build 14W5578b)
[[iBoot-3406.60.10~42]] 10.2.1 beta 4 (Build 14W5583a)
[[iBoot-3406.60.10~35]] 10.2.1 beta 5 (Build 14W585)
10.2.1 (Build 14W585a)
[[iBoot-3406.60.10~55]] 10.2.2 beta (Build 14W5726a)
10.2.2 beta 2 (Build 14W5735a)
10.2.2 beta 3 (Build 14W5745a)
10.2.2 beta 4 (Build 14W5751b)
[[iBoot-3406.60.10~76]] 10.2.2 beta 5 (Build 14W754)
10.2.2 (Build 14W756)
[[iBoot-3974~291]] 11.0 beta (Build 15J5284e & 15J5284g)
[[iBoot-4051~54]] 11.0 beta 2 (Build 15J5310e & 15J5310h)
[[iBoot-4076.1.9~34]] 11.0 beta 3 (Build 15J5324f)
[[iBoot-4076.1.22~28]] 11.0 beta 4 (Build 15J5333f)
[[iBoot-4076.1.39.3.1~1]] 11.0 beta 5 (Build 15J5347f)
[[iBoot-4076.3.1~11]] 11.0 beta 6 (Build 15J5360b)
[[iBoot-4076.3.2~2]] 11.0 beta 7 (Build 15J5369a)
11.0 beta 8 (Build 15J5374a)
11.0 beta 9 (Build 15J5378a)
[[iBoot-4076.3.3~1]] 11.0 beta 10 (Build 15J5380a)
[[iBoot-4076.3.3~2]] 11.0 [[Golden Master|GM]] (Build 15J381)
11.0 (Build 15J381)
[[iBoot-4076.20.45~10]] 11.1 beta (Build 15J5559d)
[[iBoot-4076.20.47~3]] 11.1 beta 2 (Build 15J5571d)
[[iBoot-4076.20.48~4]] 11.1 beta 3 (Build 15J5580a)
11.1 beta 4 (Build 15J5582a)
[[iBoot-4076.20.48~2]] 11.1 (Build 15J582)
[[iBoot-4076.30.40~22]] 11.2 beta (Build 15K5085b)
[[iBoot-4076.30.43~14]] 11.2 beta 2 (Build 15K5090c)
[[iBoot-4076.30.43~81]] 11.2 beta 3 (Build 15K5099a)
11.2 beta 4 (Build 15K102a)
11.2 beta 5 (Build 15K5105a)
[[iBoot-4076.30.43~75]] 11.2 (Build 15K106)
11.2.1 (Build 15K152)
[[iBoot-4076.30.43~138]] 11.2.5 beta (Build 15K5531d)
11.2.5 beta 2 (Build 15K5539b)
11.2.5 beta 3 (Build 15K5544a)
11.2.5 beta 4 (Build 15K5544b)
11.2.5 beta 5 (Build 15K5549a)
11.2.5 beta 6 (Build 15K5552a)
[[iBoot-4076.30.43~143]] 11.2.5 (Build 15K552)
11.2.6 (Build 15K600)
[[iBoot-4076.50.114~7]] 11.3 beta (Build 15L5164e)
[[iBoot-4076.50.119~180]] 11.3 beta 2 (Build 15L5175d)
[[iBoot-4076.50.123~78]] 11.3 beta 3 (Build 15L5186e)
[[iBoot-4076.50.126~19]] 11.3 beta 4 (Build 15L5198d)
[[iBoot-4076.50.126~62]] 11.3 beta 5 (Build 15L5208a)
11.3 beta 6 (Build 15L5211b)
11.3 (Build 15L211)
[[iBoot-4076.60.7~269]] 11.4 beta (Build 15L5536c)
[[iBoot-4076.60.7~398]] 11.4 beta 2 (Build 15L5546a)
[[iBoot-4076.60.8.0.1~7]] 11.4 beta 3 (Build 15L5560b)
[[iBoot-4076.60.11~12]] 11.4 beta 4 (Build 15L5570a)
11.4 beta 5 (Build 15L5576a)
[[iBoot-4076.60.11~5]] 11.4 (Build 15L577)
[[iBoot-4076.70.9~75]] 11.4.1 beta (Build 15M5054b)
[[iBoot-4076.70.14~16]] 11.4.1 beta 2 (Build 15M5063a)
[[iBoot-4076.70.15~37]] 11.4.1 beta 3 (Build 15M5071b)
11.4.1 beta 4 (Build 15M5072a)
[[iBoot-4076.70.15~16]] 11.4.1 (Build 15M77)
[[iBoot-4513.200.159.10.1~10]] 12.0 beta (Build 16J5283n)
[[iBoot-4513.200.209~13]] 12.0 beta 2 (Build 16J5303e)
[[iBoot-4513.200.230.0.1~8]] 12.0 beta 3 (Build 16J5313d)
[[iBoot-4513.200.245.0.2~86]] 12.0 beta 4 (Build 16J5322d)
[[iBoot-4513.200.278~10]] 12.0 beta 5 (Build 16J5334e)
[[iBoot-4513.200.287.0.2~16]] 12.0 beta 6 (Build 16J5340e)
12.0 beta 7 (Build 16J5349a)
[[iBoot-4513.200.293~39]] 12.0 beta 8 (Build 16J5355a)
12.0 beta 9 (Build 16J5360a)
12.0 beta 10 (Build 16J5364a)
[[iBoot-4513.200.293~4]] 12.0 [[Golden Master|GM]] (Build 16J364)
12.0 (Build 16J364)
12.0.1 (Build 16J380)
[[iBoot-4513.220.83~21]] 12.1 beta (Build 16J5575c)
[[iBoot-4513.220.91~17]] 12.1 beta 2 (Build 16J5584c)
[[iBoot-4513.220.97~19]] 12.1 beta 3 (Build 16J5593c)
[[iBoot-4513.220.97~67]] 12.1 beta 4 (Build 16J5600a)
12.1 beta 5 (Build 16J5602a)
[[iBoot-4513.220.97~55]] 12.1 (Build 16J602)
[[iBoot-4513.230.5~86]] 12.1.1 beta (Build 16K5035b)
[[iBoot-4513.230.5~128]] 12.1.1 beta 2 (Build 16K5041a)
12.1.1 beta 3 (Build 16K5044a)
12.1.1 beta 4 (Build 16K5045a)
[[iBoot-4513.230.5~127]] 12.1.1 (Build 16K45)
[[iBoot-4513.230.10~42]] 12.1.2 beta (Build 16K5524a)
[[iBoot-4513.230.10~59]] 12.1.2 beta 2 (Build 16K5532a)
12.1.2 beta 3 (Build 16K5534a)
[[iBoot-4513.230.10~62]] 12.1.2 (Build 16K534)
[[iBoot-4513.250.271~115]] 12.2 beta (Build 16L5181f)
[[iBoot-4513.250.278~86]] 12.2 beta 2 (Build 16L5191d)
[[iBoot-4513.250.284~10]] 12.2 beta 3 (Build 16L5201d)
[[iBoot-4513.250.287~9]] 12.2 beta 4 (Build 16L5212e)
[[iBoot-4513.250.287~102]] 12.2 beta 5 (Build 16L5221a)
12.2 beta 6 (Build 16L5226a)
[[iBoot-4513.250.287~169]] 12.2 (Build 16L226)
12.2.1 (Build 16L250)
[[iBoot-4513.260.69~69]] 12.3 beta (Build 16M5117f)
[[iBoot-4513.260.78~7]] 12.3 beta 2 (Build 16M5129d)
[[iBoot-4513.260.80~32]] 12.3 beta 3 (Build 16M5139a)
12.3 beta 4 (Build 16M5146a)
12.3 beta 5 (Build 16M5151a)
[[iBoot-4513.260.80~58]] 12.3 (Build 16M153)
[[iBoot-4513.270.8~23]] 12.4 beta (Build 16M5526d)
[[iBoot-4513.270.10~27]] 12.4 beta 2 (Build 16M5537c)
[[iBoot-4513.270.12~37]] 12.4 beta 3 (Build 16M5545c)
[[iBoot-4513.270.14~24]] 12.4 (Build 16M568)
12.4.1 (Build 16M600)
[[iBoot-5540.0.15.113.2~1]] 13.0 beta (Build 17J5485s)
[[iBoot-5540.0.45~289]] 13.0 beta 2 (Build 17J5501l)
[[iBoot-5540.0.76~20]] 13.0 beta 3 (Build 17J5515e)
[[iBoot-5540.0.87~27]] 13.0 beta 4 (Build 17J5526e)
[[iBoot-5540.0.117~19]] 13.0 beta 5 (Build 17J5540d)
[[iBoot-5540.0.121~9]] 13.0 beta 6 (Build 17J5549c)
[[iBoot-5540.0.125~39]] 13.0 beta 7 (Build 17J5557a)
[[iBoot-5540.0.126~55]] 13.0 beta 8 (Build 17J5564c)
[[iBoot-5540.0.129~5]] 13.0 beta 9 (Build 17J5573a)
[[iBoot-5540.0.129~92]] 13.0 beta 10 (Build 17J5579a)
13.0 beta 11/[[Golden Master|GM]] (Build 17J5584a)
[[iBoot-5540.0.129~1]] 13.0 (Build 17J586)
[[iBoot-5540.40.50~29]] 13.2 beta (Build 17K5059d)
[[iBoot-5540.40.51~46]] 13.2 beta 2 (Build 17K5068b)
[[iBoot-5540.40.51~172]] 13.2 beta 3 (Build 17K5078a)
13.2 beta 4 (Build 17K5082a)
[[iBoot-5540.40.51~135]] 13.2 (Build 17K82)
[[iBoot-5540.60.6~88]] 13.3 beta (Build 17K5433c)
[[iBoot-5540.60.11~38]] 13.3 beta 2 (Build 17K5440a)
[[iBoot-5540.60.11~126]] 13.3 beta 3 (Build 17K5445a)
13.3 beta 4 (Build 17C5053a)
[[iBoot-5540.60.11~25]] 13.3 (Build 17K449)
[[iBoot-5540.80.1~80]] 13.3.1 beta (Build 17K5775c)
[[iBoot-5540.80.2~140]] 13.3.1 beta 2 (Build 17K5792a)
13.3.1 beta 3 (Build 17K5795a)
[[iBoot-5540.80.2~138]] 13.3.1 (Build 17K795)
[[iBoot-5540.100.177.0.1~94]] 13.4 beta (Build 17L5225g)
[[iBoot-5540.100.190~15]] 13.4 beta 2 (Build 17L5235e)
[[iBoot-5540.100.194~44]] 13.4 beta 3 (Build 17L5245b)
13.4 beta 4 (Build 17L5251a)
13.4 beta 5 (Build 17L5255a)
[[iBoot-5540.100.194~112]] 13.4 beta 11 (Build 17L256)
13.4 (Build 17L256)
[[iBoot-5540.120.9~16]] 13.4.5 beta (Build 17L5533c)
[[iBoot-5540.120.14~21]] 13.4.5 beta 2 (Build 17L5543d)
[[iBoot-5540.120.15.0.1~32]] 13.4.5 beta 3 (Build 17L5553c)
[[iBoot-5540.120.17~55]] 13.4.5 beta 4 (Build 17L5560a)
[[iBoot-5540.120.17~6]] 13.4.5 [[Golden Master|GM]] (Build 17L562)
13.4.5 (Build 17L562)
13.4.6 (Build 17L570)
[[iBoot-5540.140.5~31]] 13.4.8 beta (Build 17M5535f)
[[iBoot-5540.140.7~32]] 13.4.8 beta 2 (Build 17M5545a)
[[iBoot-5540.140.12~13]] 13.4.8 beta 3 (Build 17M5558b)
[[iBoot-6603.0.0.110.6~12]] 14.0 beta (Build 18J5313t)
[[iBoot-6631.0.0.0.1~30]] 14.0 beta 2 (Build 18J5331g)

=== [[watchOS]] ===
[[iBoot-2261.5.64~16]] 1.0 (Build 12S507)
[[iBoot-2261.5.64~49]] 1.0.1 (Build 12S632)
[[iBoot-2817.0.0.2.1~1]] 2.0 beta 2 (Build 13S5255c)
[[iBoot-2817.2.2~2]] 2.0 (Build 13S344)
2.0.1 (Build 13S428)
[[iBoot-2817.20.25~4]] 2.1 (Build 13S661)
[[iBoot-2817.40.91~18]] 2.2 beta (Build 13V5098e)
[[iBoot-2817.40.97~24]] 2.2 beta 2 (Build 13V5108c)
[[iBoot-2817.40.102~24]] 2.2 beta 3 (Build 13V5117c)
[[iBoot-2817.40.104~51]] 2.2 beta 4 (Build 13V5129c)
[[iBoot-2817.40.106~17]] 2.2 beta 5 (Build 13V5141a)
2.2 beta 6 (Build 13V5143a)
[[iBoot-2817.40.106~4]] 2.2 (Build 13V144)
[[iBoot-2817.40.106~32]] 2.2.1 beta (Build 13V413)
2.2.1 beta 2 (Build 13V420)
2.2.1 (Build 13V420)
2.2.2 beta (Build 13V601)
2.2.2 (Build 13V604)
[[iBoot-3393~42]] 3.0 beta (Build 14S5247t)
[[iBoot-3406.1.46~10]] 3.0 beta 2 (Build 14S5278d)
[[iBoot-3406.1.59~63]] 3.0 beta 3 (Build 14S5290d)
[[iBoot-3406.1.68~84]] 3.0 beta 4 (Build 14S5302d)
[[iBoot-3406.1.77~18]] 3.0 beta 5 (Build 14S5315a)
[[iBoot-3406.4.1~2]] 3.0 beta 6 (Build 14S5321a)
[[iBoot-3406.4.3~2]] 3.0 [[Golden Master|GM]] (Build 14S5321a)
3.0 (Build 14S5321a)
[[iBoot-3406.20.16~116]] 3.1 beta (Build 14S452)
3.1 beta 2 (Build 14S464)
3.1 beta 3 (Build 14S471)
3.1 (Build 14S471)
[[iBoot-3406.30.8~13]] 3.1.1 beta (Build 14S5862d)
[[iBoot-3406.30.8~375]] 3.1.1 beta 2 (Build 14S5869b)
[[iBoot-3406.30.8~504]] 3.1.1 beta 3 (Build 14S5875b)
[[iBoot-3406.30.8~502]] 3.1.1 beta 4 (Build 14S879)
3.1.1 beta 5 (Build 14S883)
3.1.1 (Build 14S883)
3.1.3 beta (Build 14S958)
3.1.3 beta 2 (Build 14S959)
3.1.3 (Build 14S960)
[[iBoot-3406.50.223~19]] 3.2 beta (Build 14V5205d)
[[iBoot-3406.50.229~10]] 3.2 beta 2 (Build 14V5214d)
[[iBoot-3406.50.236~76]] 3.2 beta 3 (Build 14V5224d)
[[iBoot-3406.54.1~2]] 3.2 beta 4 (Build 14V5235b)
[[iBoot-3406.54.2~2]] 3.2 beta 5 (Build 14V5243a)
3.2 beta 6 (Build 14V5245a)
[[iBoot-3406.54.2~1]] 3.2 (Build 14V249)
[[iBoot-3406.60.7~16]] 3.2.2 beta (Build 14V5465b)
[[iBoot-3406.60.10~8]] 3.2.2 beta 2 (Build 14V5475a)
[[iBoot-3406.60.10~27]] 3.2.2 beta 3 (Build 14V5480a)
[[iBoot-3406.60.10~44]] 3.2.2 beta 4 (Build 14V5485a)
[[iBoot-3406.60.10~43]] 3.2.2 (Build 14V485)
[[iBoot-3406.60.10~49]] 3.2.3 beta (Build 14V5726a)
3.2.3 beta 2 (Build 14V5734a)
[[iBoot-3406.60.10~49]] 3.2.3 beta 3 (Build 14V5744a)
3.2.3 beta 4 (Build 14V5751a)
[[iBoot-3406.60.10~77]] 3.2.3 (Build 14V753)
[[iBoot-3974~307]] 4.0 beta (Build 15R5281f)
[[iBoot-4051~240]] 4.0 beta 2 (Build 15R5307f)
[[iBoot-4076.1.9~31]] 4.0 beta 3 (Build 15R5321h)
[[iBoot-4076.1.22~43]] 4.0 beta 4 (Build 15R5331g)
[[iBoot-4076.1.39~24]] 4.0 beta 5 (Build 15R5345g)
[[iBoot-4076.1.43~190]] 4.0 beta 6 (Build 15R5357b)
4.0 beta 7 (Build 15R5365a)
4.0 beta 8 (Build 15R5371a)
[[iBoot-4076.1.43~186]] 4.0 [[Golden Master|GM]] (Build 15R372)
4.0 (Build 15R372)
4.0.1 (Build 15R654)
[[iBoot-4076.20.45~11]] 4.1 beta (Build 15R5823c)
[[iBoot-4076.20.47~6]] 4.1 beta 2 (Build 15R5835d)
[[iBoot-4076.20.48~6]] 4.1 beta 3 (Build 15R5843a)
[[iBoot-4076.20.48~3]] 4.1 beta 4 (Build 15R846)
4.1 (Build 15R846)
[[iBoot-4076.30.40~25]] 4.2 beta (Build 15S5085b)
[[iBoot-4076.30.43~16]] 4.2 beta 2 (Build 15S5090c)
4.2 beta 3 (Build 15S5100a)
4.2 beta 4 (Build 15S5102b)
[[iBoot-4076.30.43~2]] 4.2 (Build 15S102)
[[iBoot-4076.30.43~135]] 4.2.2 beta (Build 15S5530d)
4.2.2 beta 2 (Build 15S5534a)
4.2.2 beta 3 (Build 15S5536a)
4.2.2 beta 4 (Build 15S5540a)
[[iBoot-4076.30.43~134]] 4.2.2 beta 5 (Build 15S542)
4.2.2 (Build 15S542)
4.2.3 (Build 15S600b)
[[iBoot-4076.50.114~52]] 4.3 beta (Build 15T5165e)
[[iBoot-4076.50.119~179]] 4.3 beta 2 (Build 15T5176c)
[[iBoot-4076.50.123~76]] 4.3 beta 3 (Build 15T5187e)
[[iBoot-4076.50.126~21]] 4.3 beta 4 (Build 15T5199f)
[[iBoot-4076.50.126~65]] 4.3 beta 5 (Build 15T5209a)
4.3 beta 6 (Build 15T5212a)
[[iBoot-4076.50.126~86]] 4.3 (Build 15T212)
[[iBoot-4076.60.7~267]] 4.3.1 beta (Build 15T5535b)
[[iBoot-4076.60.7~399]] 4.3.1 beta 2 (Build 15T5545b)
[[iBoot-4076.60.8.0.1~5]] 4.3.1 beta 3 (Build 15T5555c)
[[iBoot-4076.60.11~11]] 4.3.1 beta 4 (Build 15T5565a)
4.3.1 beta 5 (Build 15T5567a)
[[iBoot-4076.60.11~6]] 4.3.1 (Build 15T567)
[[iBoot-4076.70.9~76]] 4.3.2 beta (Build 15U5053b)
[[iBoot-4076.70.14~15]] 4.3.2 beta 2 (Build 15U5062a)
[[iBoot-4076.70.15~36]] 4.3.2 beta 3 (Build 15U5069a)
[[iBoot-4076.70.15~18]] 4.3.2 (Build 15U70)
[[iBoot-4513.200.159.10.1~17]] 5.0 beta (Build 16R5283q & 16R5283r)
[[iBoot-4513.200.209.24.1~1]] 5.0 beta 2 (Build 16R5303d)
[[iBoot-4513.200.230.0.1~17]] 5.0 beta 3 (Build 16R5313d)
[[iBoot-4513.200.250~12]] 5.0 beta 4 (Build 16R5322d)
[[iBoot-4513.200.278~15]] 5.0 beta 5 (Build 16R5334f)
[[iBoot-4513.200.287.0.2~12]] 5.0 beta 6 (Build 16R5340g)
[[iBoot-4513.204.2~3]] 5.0 beta 7 (Build 16R5349a)
[[iBoot-4513.204.6~3]] 5.0 beta 8 (Build 16R5357a)
5.0 beta 9 (Build 16R5360a)
5.0 beta 10 (Build 16R5363a)
[[iBoot-4513.204.6~1]] 5.0 [[Golden Master|GM]] (Build 16R364)
5.0 (Build 16R364)
[[iBoot-4513.204.6~24]] 5.0.1 (Build 16R381 & 16R382)
[[iBoot-4513.220.83~11]] 5.1 beta (Build 16R5559d)
[[iBoot-4513.220.91~15]] 5.1 beta 2 (Build 16R5568d)
[[iBoot-4513.220.97~17]] 5.1 beta 3 (Build 16R5577c)
[[iBoot-4513.224.2~2]] 5.1 beta 4 (Build 16R5584a)
5.1 beta 5 (Build 16R5589c)
[[iBoot-4513.224.2~1]] 5.1 (Build 16R591)
5.1.1 (Build 16R600)
[[iBoot-4513.230.5~130]] 5.1.2 beta (Build 16S5042a)
[[iBoot-4513.230.5~146]] 5.1.2 beta 2 (Build 16S5046a)
[[iBoot-4513.230.5~145]] 5.1.2 (Build 16S46)
[[iBoot-4513.230.5~151]] 5.1.3 beta (Build 16S5523a)
[[iBoot-4513.244.1~2]] 5.1.3 beta 2 (Build 16S5531a)
[[iBoot-4513.244.3~3]] 5.1.3 beta 3 (Build 16S5535a)
[[iBoot-4513.244.3~2]] 5.1.3 (Build 16S535)
[[iBoot-4513.250.271~201]] 5.2 beta (Build 16T5181f)
[[iBoot-4513.250.279~35]] 5.2 beta 2 (Build 16T5191d)
[[iBoot-4513.250.284~77]] 5.2 beta 3 (Build 16T5201c)
[[iBoot-4513.250.287~7]] 5.2 beta 4 (Build 16T5212e)
[[iBoot-4513.250.287~138]] 5.2 beta 5 (Build 16T5222a)
5.2 beta 6 (Build 16T5225a)
[[iBoot-4513.250.287~137]] 5.2 (Build 16T225)
[[iBoot-4513.250.287~171]] 5.2.1 beta (Build 16U5079d)
[[iBoot-4513.250.287~204]] 5.2.1 beta 2 (Build 16U5091b)
[[iBoot-4513.250.287~231]] 5.2.1 beta 3 (Build 16U5101c)
[[iBoot-4513.250.287~267]] 5.2.1 beta 4 (Build 16U5110a)
5.2.1 beta 5 (Build 16U5113a)
[[iBoot-4513.250.287~238]] 5.2.1 (Build 16U113)
[[iBoot-4513.250.287~271]] 5.3 beta (Build 16U5526f)
[[iBoot-4513.250.287~278]] 5.3 beta 2 (Build 16U5537b)
[[iBoot-4513.250.287~285]] 5.3 beta 3 (Build 16U5545c)
[[iBoot-4513.250.287~288]] 5.3 (Build 16U569)
5.3.1 (Build 16U600)
5.3.2 (Build 16U611)
5.3.3 (Build 16U620)
5.3.4 (Build 16U627)
5.3.5 (Build 16U652)
5.3.6 (Build 16U662)
5.3.7 (Build 16U674)
[[iBoot-5540.0.15.0.2~255]] 6.0 beta (Build 17R5491t)
[[iBoot-5540.0.49.0.1~180]] 6.0 beta 2 (Build 17R5507l)
[[iBoot-5540.0.76~16]] 6.0 beta 3 (Build 17R5521e)
[[iBoot-5540.0.87~24]] 6.0 beta 4 (Build 17R5532f)
[[iBoot-5540.0.117~20]] 6.0 beta 5 (Build 17R5546f)
[[iBoot-5540.0.117.2~23]] 6.0 beta 6 (Build 17R5556d)
[[iBoot-5540.0.117.2~74]] 6.0 beta 7 (Build 17R5566a)
6.0 beta 8 (Build 17R5571a)
6.0 beta 9 (Build 17R5575a)
[[iBoot-5540.0.117.2~117]] 6.0 [[Golden Master|GM]] (Build 17R575)
6.0 (Build 17R575)
6.0.1 (Build 17R604 & 17R605)
[[iBoot-5540.40.47~35]] 6.1 beta (Build 17S5054e)
[[iBoot-5540.40.50~30]] 6.1 beta 2 (Build 17S5059e)
[[iBoot-5540.40.51~57]] 6.1 beta 3 (Build 17S5068e)
[[iBoot-5540.40.51~169]] 6.1 beta 4 (Build 17S5076a)
[[iBoot-5540.44.1~2]] 6.1 beta 5 (Build 17S5083a)
[[iBoot-5540.60.6]] 6.1 (Build 17S84)
[[iBoot-5540.60.6~87]] 6.1.1 beta (Build 17S5433b)
iBoot-????.??.?~?? 6.1.1 beta 2 (Build 17S5439a)
iBoot-????.??.?~?? 6.1.1 beta 3 (Build 17S5446a)
iBoot-????.??.?~?? 6.1.1 beta 4 (Build 17S5449b)
iBoot-????.??.?~?? 6.1.1 (Build 17S449)
iBoot-????.??.?~?? 6.1.2 beta (Build 17S5775c)
iBoot-????.??.?~?? 6.1.2 beta 2 (Build 17S5792a)
iBoot-????.??.?~?? 6.1.2 beta 3 (Build 17S5796a)
iBoot-????.??.?~?? 6.1.2 (Build 17S796)
[[iBoot-5540.60.11~??]] 6.1.3 (Build 17S811)
iBoot-????.??.?~?? 6.2 beta (Build 17T5224g)
iBoot-????.??.?~?? 6.2 beta 2 (Build 17T5234f)
iBoot-????.??.?~?? 6.2 beta 3 (Build 17T5244c)
iBoot-????.??.?~?? 6.2 beta 4 (Build 17T5244c)
iBoot-????.??.?~?? 6.2 beta 5 (Build 17T5254a)
[[iBoot-5540.100.194~??]] 6.2 beta 6 (Build 17T529)
6.2 (Build 17T529)
6.2.1 (Build 17T530)
6.2.5 beta (Build 17T5580e)
6.2.5 beta 2 (Build 17T5590d)
[[iBoot-5540.100.194~355]] 6.2.5 beta 3 (Build 17T5600c)
[[iBoot-5540.100.194~428]] 6.2.5 beta 4 (Build 17T5607a)
[[iBoot-5540.100.194~396]] 6.2.5 beta 5 (Build 17T608)
6.2.5 (Build 17T608)
6.2.6 (Build 17T620)
[[iBoot-5540.100.194~452]] 6.2.8 beta (Build 17U5535e)
6.2.8 beta 2 (Build 17U5545c)
[[iBoot-5540.144.2~3]] 6.2.8 beta 3 (Build 17U5559d)
[[iBoot-6603.0.0.110.6~17]] 7.0 beta (Build 18R5310a)
[[iBoot-6631.0.0.0.1~32]] 7.0 beta 2 (Build 18R5327h)

== [[Exploits]] ==
On 1st February, 2014, iH8sn0w found a very powerful iBoot exploit that allows any iDevice with an [[S5L8940|A5]] or [[S5L8945|A5X]] chip to be jailbroken, regardless of the iOS version. He used it mainly to grab AES [[Firmware Keys|decryption keys]]. However, according to [https://twitter.com/winocm/status/429704672211763200 this tweet from winocm], the exploit will never go public. Once he cleans it up a bit, the [[Firmware Keys|decryption keys]] will be available [http://www.icj.me/ios/keys here].
He mentioned [https://twitter.com/iH8sn0w/status/429838704077979648 here] that it will work on [[A6]] and [[A7]] chips soon, but it will require some minor modifications.

== Commands used as an exploit vector ==
* '''diags''': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* '''arm7_go''': For firmware 2.1.1, the [[N72AP|iPod touch (2nd generation)]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

== OpeniBoot ==
There is an open source version of iBoot designed so that custom kernels can be run on the iPhone/iPod/iPad. You can check out the source [http://github.com/iDroid-Project/OpeniBoot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.
OpeniBoot currently supports all S5l8900, S5l8720, S5l8920 and S5l8930 devices. More info can be found about OpeniBoot and Linux on these devices on the iDroid-Project [http://idroidproject.org website].

== Remappings ==
// N88 (3GS)
0x4FF00000 => 0x0
0x40000000 => 0xC0000000

== See also ==
* [[iBoot (Enums)]]
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

[[Category:iBoot]]