https://www.theiphonewiki.com/w/api.php?action=feedcontributions&feedformat=atom&user=LeobruhThe iPhone Wiki - User contributions [en]2026-05-08T15:48:33ZUser contributionsMediaWiki 1.31.14https://www.theiphonewiki.com/w/index.php?title=JailbreakMe&diff=17174JailbreakMe2011-04-02T17:29:30Z<p>Leobruh: </p>
<hr />
<div>JailbreakMe is a site that has been used multiple times to jailbreak iDevices. It is currently online with the [[Star]] Jailbreak by [[User:Comex|comex]].<br />
<br />
==First Incarnation (AppSnapp)==<br />
Initially, [http://www.conceitedsoftware.com/ Conceited Software] utilized the [[LibTiff]] exploit with jailbreakme.com, which also went by the name "AppSnapp," to jailbreak iOS 1.1.1. Upon the release of iOS 2.0 and the debut of the App Store, Conceited Software closed JailbreakMe, when it remained dormant for a while.<br />
<br />
==Second Incarnation (Star)==<br />
[[User:Comex|comex]] has since repurposed the domain for [[Star]], his userland [[jailbreak]] for iOS 3.1.2 through 4.3 (comex stated that the bug used for the untethered jailbreak was there until 4.3 and was patched at 4.3.1 in order to prevent the jailbreak of the iPad 2)<br />
==External Link==<br />
[http://jailbreakme.com/ JailbreakME.com]<br />
<br />
{{stub|jailbreaking}}</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:WildcardTicket&diff=16935Talk:WildcardTicket2011-03-20T17:41:05Z<p>Leobruh: </p>
<hr />
<div>Theoretically, can't we just edit the .plist? and make it into the factory unlocked IMSI Mask? -- {{unsigned|Leobruh|5:32, 19 August 2010 (UTC)}}<br />
<br />
:The activation plist is signed, so to do this you require a jailbreak anyway. --[[User:Lilstevie|Lilstevie]] 09:45, 20 August 2010 (UTC)- lilstevie<br />
<br />
i realize that. but wouldnt this result in a permanent unlock? [[User:Leobruh|Leobruh]] 07:37, 19 August 2010 (UTC)!<br />
<br />
I'm guessing the ticket is handled by the baseband, which requires an exploit to get unsigned code running in the first place? [[User:Iemit737|Iemit737]] 07:41, 19 August 2010 (UTC)<br />
<br />
The wildcard ticket is also signed - simple edits break the signature and the ticket gets rejected then. rtfm cryptography 101. [[User:dogbert|dogbert]] 16:02, 19 August 2010 (UTC)<br />
<br />
kay but unsigned code already runs when the phone is jailbroken and has access to the filesystem. wouldnt editing the .plist be okay since the sig checks arent needed. again this is all theoretical. im jw [[User:Leobruh|Leobruh]] 18:33, 19 August 2010 (UTC)!<br />
<br />
The baseband processor checks the signature, not the application processor. [[User:dogbert|dogbert]] 18:36, 19 August 2010 (UTC)<br />
<br />
ahh got ya! but would my theory work though through an exploit such as AT+XAPP? instead of a payload it just changes the .plist? [[User:Leobruh|Leobruh]] 00:15, 20 August 2010 (UTC)!<br />
<br />
:you would still require the valid NCK for it to process the unlock in that method, the current way the payloads work for exploits in the baseband processor are adequate --[[User:Lilstevie|Lilstevie]] 09:44, 20 August 2010 (UTC)<br />
<br />
:i thought NKC was only for the iPhone 2G? 0.o [[User:Leobruh|Leobruh]] 14:47, 21 August 2010 (UTC)!<br />
::NCK or Network Code Key is on any cellular device that gets locked to a carrier --[[User:Lilstevie|Lilstevie]] 14:52, 19 September 2010 (UTC)<br />
<br />
Is there are ability to decode WildcardTicket received from Apple to see NCK or lockstate table?<br />
What about unlocked by request to carrier iPhones? Is it some differences in WildcardTicket? --[[User:Requilence|Requilence]] 13:17, 20 March 2011 (UTC)<br />
<br />
:Decrypting is possible since the key is known. Changing the ticket is, however, not possible since it breaks the signatures. For carrier unlocked phones, Apple sends a new WildcardTicket without a lock table during sync.--[[User:Dogbert|Dogbert]] 16:43, 20 March 2011 (UTC)<br />
<br />
::Tell me this, if the signature is broken, what happens to the phone? DFU, Recovery...? [[User:Leobruh|Leobruh]] 17:41, 20 March 2011 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User_talk:Planetbeing&diff=16581User talk:Planetbeing2011-03-02T22:51:46Z<p>Leobruh: </p>
<hr />
<div>Does anyone know what has happened to planetbeing? he has seem to have dropped off the rador for a while now. --[[User:Dopeyrat|Dopeyrat]] 11:50, 2 March 2011 (UTC)<br />
:Planetbeing likes to go into hiding between mid-August to May. He surfaces to the iPhone Community around June to early-August. [[User:Leobruh|Leobruh]]!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:AT%2BXAPP_Vulnerability&diff=16439Talk:AT+XAPP Vulnerability2011-02-24T23:20:46Z<p>Leobruh: </p>
<hr />
<div>I try to find the xapp command in the disassembly. Is it right that it is in the stack.fls file? I cant find a "xapp" string ... Can someone help me? ~chrisude<br />
<br />
In a more general sense I'd like to know the same. As to not being able to find the xapp string, which baseband are you looking at? I can verify that the 05.11.07 baseband does have xapp (at offset 62F5AF, 63B217, 37E4D5 (and xapp_get at 513D18, cmd_xapp.app at 632619). Which you're suppose to look at exactly I'd like to know also.<br />
So if someone could please give a small intro as to how to find the AT+ commands (main) routine, please fill out. Thanks in advance! ~toomuchjames<br />
<br />
Anyone?<br />
<br />
Okay so like this can't be real can it? I know it's not relavant to this exploit but I just wanna know.<br />
http://pastie.org/pastes/1568212 [[User:Leobruh|Leobruh]] 23:20, 24 February 2011 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:XMM6180&diff=16010Talk:XMM61802011-02-10T20:43:11Z<p>Leobruh: /* Flash Possibility */</p>
<hr />
<div>== Flash Possibility ==<br />
Okay, so hypothetically speaking, if I flashed my baseband to [[1.59.00]] from [[3.10.01]] while my phone is on 4.2.1 (ONLY 4.2.1 [[SHSH]] IS AVAILABLE), it would enter the boot loop because the baseband doesnt meet the requirements for [[iOS]] 4.2.1. I am willing to try and flash my baseband in an attempt to downgrade and use [[ultrasn0w]]. And if the downgrade was to work and I restored it to a pwned 4.2.1 fw where the baseband update would be neglected, would the boot loop occur? [[User:Leobruh|Leobruh]] 01:20, 10 February 2011 (UTC)!<br />
:You can't flash baseband [[1.59.00]]; Apple's not signing it anymore. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 02:47, 10 February 2011 (UTC)<br />
:Well look at [http://tysiphonehelp.com/forum/showthread.php?7908-Manually-flash-iphone-to-05.11.07-baseband this]. I don't know whether or not this could be done to the [[n90ap|iPhone 4]] but it proves that a manual flash can be used so long as you have the proper firmware ipsw available. I mean if this is possible for the [[n90ap|iPhone 4]], then I will do it without a doubt. [[User:Leobruh|Leobruh]] 04:05, 10 February 2011 (UTC)!<br />
::Um, that is for the iPhone 3G/3GS basebands. That probably wont work on the [[n90ap|iPhone 4]]. For those devices, Apple didn't sign the baseband, so a manual flash was possible (going up version #'s). Downgrading required one to have the 5.8 bootloader iPhone 3G. Sorry to burst your bubble, but you are mistaken. --[[User:Gamer765|Gamer765]] 04:28, 10 February 2011 (UTC)<br />
:::Word I got you bro, haha I wish it would be easier I have had an i4 for almost 2 months with the carrier lock. I will keep waiting sooner or later it will come out. [[User:Leobruh|Leobruh]] 20:43, 10 February 2011 (UTC)!<br />
<br />
== Device for iPhone 4 ==<br />
Are we sure this is the baseband? The infineon spec-sheet says "HSDPA/HSUPA capabilities of 7.2Mbps/2.9Mbps". At the keynote Steve mentioned 5.8Mbps HSUPA. --[[User:Iemit737|Iemit737]] 19:26, 21 June 2010 (UTC)<br />
:Running "string" on the new baseband files shows "XGold 618" multiple times. --[[User:Miketress|Miketress]] 19:35, 21 June 2010 (UTC)<br />
::Ok, awesome. Thanks for finding this so quickly! [[User:Iemit737|Iemit737]] 19:50, 21 June 2010 (UTC)<br />
:::Very unlikely it's the 618 after looking at the spec sheet.<br />
In case anyone is interested, [http://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a39470bb00555 X-Gold 616 spec sheet], [https://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a3948dc76055b X-Gold 618 spec sheet]. --[[User:D235j|D235j]] 21:43, 22 June 2010 (UTC)<br />
::::Actually, it's the XMM 6180. ebl.fls says so. --[[User:Oranav|oranav]] 21:56, 22 June 2010 (UTC)<br />
<br />
== Downgrade ==<br />
Anybody knows more about the bb downgrade signatures? Or how to backup them like the shsh certs? Or how to use the replay attack here? Actually this is more related to baseband firmware and not to this iPhone 4 hardware. [[User:http|http]]<br />
:The baseband is signed with an [[AT+XNONCE]] which is a random string generated on every bootup. Therefore, it is not possible to cache the SHSH signatures with a replay attack. I think this info either belongs on this page because it is specific to its baseband or in a special section on [[Baseband Firmware]]. [[User:Iemit737|Iemit737]] 18:18, 16 July 2010 (UTC)<br />
::Ah, that's what [[User:MuscleNerd|MuscleNerd]] meant with [http://twitter.com/MuscleNerd/status/18667056119 "stricter signed"]. I also found [http://iphwn.org/nonce.txt this example]. And someone suggested to change iTunes to always send the same string. That would work, but BB wouldn't accept the response. My only idea would be to let BB generate (or store) the same string on every boot (I don't know how though). But even then we would have to backup the signatures at the time they were available. -- [[User:Http|http]] 23:11, 16 July 2010 (UTC)<br />
:::So how does TinyUmbrella give baseband protection ? ---Whiteshinyapple<br />
::::It manages to error out the signature for the baseband, that's why you get the 1004 error, not sure exactly how it's done but I'd assume that's how. ---OMEGA_RAZER<br />
:::::I think there's not much to do. When hosts is pointing to Cydia, you also won't get baseband downgraded, even if it would work when pointing to real Apple server. Same should apply for upgrade. Maybe local TSS server from TinyUmbrella just handles error returns better, so that firmware up/downgrade doesn't fail - maybe it just returns an invalid certificate for the baseband, but returns 'ok'. --[[User:Http|http]] 11:08, 9 September 2010 (UTC)</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:XMM6180&diff=15993Talk:XMM61802011-02-10T04:05:44Z<p>Leobruh: /* Flash Possibility */</p>
<hr />
<div>== Flash Possibility ==<br />
Okay, so hypothetically speaking, if I flashed my baseband to 1.59.00 from 3.10.01 while my phone is on 4.2.1 (ONLY 4.2.1 SHSH IS AVAILABLE), it would enter the boot loop because the baseband doesnt meet the requirements for iOS 4.2.1. I am willing to try and flash my baseband in an attempt to downgrade and use ultrasn0w. And if the downgrade was to work and I restored it to a pwned 4.2.1 fw where the baseband update would be neglected, would the boot loop occur? [[User:Leobruh|Leobruh]] 01:20, 10 February 2011 (UTC)!<br />
:You can't flash baseband 1.59.00; Apple's not signing it anymore. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 02:47, 10 February 2011 (UTC)<br />
<br />
Well look at this, http://tysiphonehelp.com/forum/showthread.php?7908-Manually-flash-iphone-to-05.11.07-baseband . I don't know whether or not this could be done to the iPhone 4 but it proves that a manual flash can be used so long as you have the proper firmware ipsw available. I mean if this is possible for the iPhone 4, then I will do it without a doubt. [[User:Leobruh|Leobruh]] 04:05, 10 February 2011 (UTC)!<br />
<br />
== Device for iPhone 4 ==<br />
<br />
Are we sure this is the baseband? <br />
<br />
The infineon spec-sheet says "HSDPA/HSUPA capabilities of 7.2Mbps/2.9Mbps".<br />
<br />
At the keynote Steve mentioned 5.8Mbps HSUPA.<br />
[[User:Iemit737|Iemit737]] 19:26, 21 June 2010 (UTC)<br />
<br />
Running "string" on the new baseband files shows "XGold 618" multiple times.<br />
--[[User:Miketress|Miketress]] 19:35, 21 June 2010 (UTC)<br />
<br />
Ok, awesome. Thanks for finding this so quickly! [[User:Iemit737|Iemit737]] 19:50, 21 June 2010 (UTC)<br />
<br />
<br />
Very unlikely it's the 618 after looking at the spec sheet.<br />
In case anyone is interested, [http://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a39470bb00555 | X-Gold 616 spec sheet], [https://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a3948dc76055b | X-Gold 618 spec sheet].<br />
[[User:D235j|D235j]] 21:43, 22 June 2010 (UTC)<br />
<br />
Actually, it's the XMM 6180. ebl.fls says so. --[[User:Oranav|oranav]] 21:56, 22 June 2010 (UTC)<br />
<br />
== Downgrade ==<br />
<br />
Anybody knows more about the bb downgrade signatures? Or how to backup them like the shsh certs? Or how to use the replay attack here? Actually this is more related to baseband firmware and not to this iPhone 4 hardware. [[User:http|http]]<br />
<br />
The baseband is signed with an [[AT+XNONCE]] which is a random string generated on every bootup. Therefore, it is not possible to cache the SHSH signatures with a replay attack. I think this info either belongs on this page because it is specific to its baseband or in a special section on [[Baseband Firmware]]. [[User:Iemit737|Iemit737]] 18:18, 16 July 2010 (UTC)<br />
<br />
Ah, that's what [[User:MuscleNerd|MuscleNerd]] meant with [http://twitter.com/MuscleNerd/status/18667056119 "stricter signed"]. I also found [http://iphwn.org/nonce.txt this example]. And someone suggested to change iTunes to always send the same string. That would work, but BB wouldn't accept the response. My only idea would be to let BB generate (or store) the same string on every boot (I don't know how though). But even then we would have to backup the signatures at the time they were available. -- [[User:Http|http]] 23:11, 16 July 2010 (UTC)<br />
<br />
So how does TinyUmbrella give baseband protection ? ---Whiteshinyapple<br />
<br />
It manages to error out the signature for the baseband, that's why you get the 1004 error, not sure exactly how it's done but I'd assume that's how. ---OMEGA_RAZER<br />
<br />
I think there's not much to do. When hosts is pointing to Cydia, you also won't get baseband downgraded, even if it would work when pointing to real Apple server. Same should apply for upgrade. Maybe local TSS server from TinyUmbrella just handles error returns better, so that firmware up/downgrade doesn't fail - maybe it just returns an invalid certificate for the baseband, but returns 'ok'. -- [[User:Http|http]] 11:08, 9 September 2010 (UTC)</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:XMM6180&diff=15991Talk:XMM61802011-02-10T01:20:52Z<p>Leobruh: /* Flash Possibility */</p>
<hr />
<div>== Flash Possibility ==<br />
Okay, so hypothetically speaking, if I flashed my baseband to 1.59.00 from 3.10.01 while my phone is on 4.2.1 (ONLY 4.2.1 SHSH IS AVAILABLE), it would enter the boot loop because the baseband doesnt meet the requirements for iOS 4.2.1. I am willing to try and flash my baseband in an attempt to downgrade and use ultrasn0w. And if the downgrade was to work and I restored it to a pwned 4.2.1 fw where the baseband update would be neglected, would the boot loop occur? [[User:Leobruh|Leobruh]] 01:20, 10 February 2011 (UTC)!<br />
<br />
== Device for iPhone 4 ==<br />
<br />
Are we sure this is the baseband? <br />
<br />
The infineon spec-sheet says "HSDPA/HSUPA capabilities of 7.2Mbps/2.9Mbps".<br />
<br />
At the keynote Steve mentioned 5.8Mbps HSUPA.<br />
[[User:Iemit737|Iemit737]] 19:26, 21 June 2010 (UTC)<br />
<br />
Running "string" on the new baseband files shows "XGold 618" multiple times.<br />
--[[User:Miketress|Miketress]] 19:35, 21 June 2010 (UTC)<br />
<br />
Ok, awesome. Thanks for finding this so quickly! [[User:Iemit737|Iemit737]] 19:50, 21 June 2010 (UTC)<br />
<br />
<br />
Very unlikely it's the 618 after looking at the spec sheet.<br />
In case anyone is interested, [http://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a39470bb00555 | X-Gold 616 spec sheet], [https://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a3948dc76055b | X-Gold 618 spec sheet].<br />
[[User:D235j|D235j]] 21:43, 22 June 2010 (UTC)<br />
<br />
Actually, it's the XMM 6180. ebl.fls says so. --[[User:Oranav|oranav]] 21:56, 22 June 2010 (UTC)<br />
<br />
== Downgrade ==<br />
<br />
Anybody knows more about the bb downgrade signatures? Or how to backup them like the shsh certs? Or how to use the replay attack here? Actually this is more related to baseband firmware and not to this iPhone 4 hardware. [[User:http|http]]<br />
<br />
The baseband is signed with an [[AT+XNONCE]] which is a random string generated on every bootup. Therefore, it is not possible to cache the SHSH signatures with a replay attack. I think this info either belongs on this page because it is specific to its baseband or in a special section on [[Baseband Firmware]]. [[User:Iemit737|Iemit737]] 18:18, 16 July 2010 (UTC)<br />
<br />
Ah, that's what [[User:MuscleNerd|MuscleNerd]] meant with [http://twitter.com/MuscleNerd/status/18667056119 "stricter signed"]. I also found [http://iphwn.org/nonce.txt this example]. And someone suggested to change iTunes to always send the same string. That would work, but BB wouldn't accept the response. My only idea would be to let BB generate (or store) the same string on every boot (I don't know how though). But even then we would have to backup the signatures at the time they were available. -- [[User:Http|http]] 23:11, 16 July 2010 (UTC)<br />
<br />
So how does TinyUmbrella give baseband protection ? ---Whiteshinyapple<br />
<br />
It manages to error out the signature for the baseband, that's why you get the 1004 error, not sure exactly how it's done but I'd assume that's how. ---OMEGA_RAZER<br />
<br />
I think there's not much to do. When hosts is pointing to Cydia, you also won't get baseband downgraded, even if it would work when pointing to real Apple server. Same should apply for upgrade. Maybe local TSS server from TinyUmbrella just handles error returns better, so that firmware up/downgrade doesn't fail - maybe it just returns an invalid certificate for the baseband, but returns 'ok'. -- [[User:Http|http]] 11:08, 9 September 2010 (UTC)</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:XMM6180&diff=15990Talk:XMM61802011-02-10T01:20:30Z<p>Leobruh: </p>
<hr />
<div>== Flash Possibility ==<br />
Okay, so hypothetically speaking, if I flashed my baseband to 1.59.00 from 3.10.01 while my phone is on 4.2.1 (ONLT 4.2.1 SHSH IS AVAILABLE), it would enter the boot loop because the baseband doesnt meet the requirements for iOS 4.2.1. I am willing to try and flash my baseband in an attempt to downgrade and use ultrasn0w. And if the downgrade was to work and I restored it to a pwned 4.2.1 fw where the baseband update would be neglected, would the boot loop occur? [[User:Leobruh|Leobruh]] 01:20, 10 February 2011 (UTC)!<br />
<br />
== Device for iPhone 4 ==<br />
<br />
Are we sure this is the baseband? <br />
<br />
The infineon spec-sheet says "HSDPA/HSUPA capabilities of 7.2Mbps/2.9Mbps".<br />
<br />
At the keynote Steve mentioned 5.8Mbps HSUPA.<br />
[[User:Iemit737|Iemit737]] 19:26, 21 June 2010 (UTC)<br />
<br />
Running "string" on the new baseband files shows "XGold 618" multiple times.<br />
--[[User:Miketress|Miketress]] 19:35, 21 June 2010 (UTC)<br />
<br />
Ok, awesome. Thanks for finding this so quickly! [[User:Iemit737|Iemit737]] 19:50, 21 June 2010 (UTC)<br />
<br />
<br />
Very unlikely it's the 618 after looking at the spec sheet.<br />
In case anyone is interested, [http://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a39470bb00555 | X-Gold 616 spec sheet], [https://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a3948dc76055b | X-Gold 618 spec sheet].<br />
[[User:D235j|D235j]] 21:43, 22 June 2010 (UTC)<br />
<br />
Actually, it's the XMM 6180. ebl.fls says so. --[[User:Oranav|oranav]] 21:56, 22 June 2010 (UTC)<br />
<br />
== Downgrade ==<br />
<br />
Anybody knows more about the bb downgrade signatures? Or how to backup them like the shsh certs? Or how to use the replay attack here? Actually this is more related to baseband firmware and not to this iPhone 4 hardware. [[User:http|http]]<br />
<br />
The baseband is signed with an [[AT+XNONCE]] which is a random string generated on every bootup. Therefore, it is not possible to cache the SHSH signatures with a replay attack. I think this info either belongs on this page because it is specific to its baseband or in a special section on [[Baseband Firmware]]. [[User:Iemit737|Iemit737]] 18:18, 16 July 2010 (UTC)<br />
<br />
Ah, that's what [[User:MuscleNerd|MuscleNerd]] meant with [http://twitter.com/MuscleNerd/status/18667056119 "stricter signed"]. I also found [http://iphwn.org/nonce.txt this example]. And someone suggested to change iTunes to always send the same string. That would work, but BB wouldn't accept the response. My only idea would be to let BB generate (or store) the same string on every boot (I don't know how though). But even then we would have to backup the signatures at the time they were available. -- [[User:Http|http]] 23:11, 16 July 2010 (UTC)<br />
<br />
So how does TinyUmbrella give baseband protection ? ---Whiteshinyapple<br />
<br />
It manages to error out the signature for the baseband, that's why you get the 1004 error, not sure exactly how it's done but I'd assume that's how. ---OMEGA_RAZER<br />
<br />
I think there's not much to do. When hosts is pointing to Cydia, you also won't get baseband downgraded, even if it would work when pointing to real Apple server. Same should apply for upgrade. Maybe local TSS server from TinyUmbrella just handles error returns better, so that firmware up/downgrade doesn't fail - maybe it just returns an invalid certificate for the baseband, but returns 'ok'. -- [[User:Http|http]] 11:08, 9 September 2010 (UTC)</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Greenpois0n_(jailbreak)&diff=15812Greenpois0n (jailbreak)2011-02-04T03:40:17Z<p>Leobruh: /* Supported Devices */</p>
<hr />
<div>{{lowercase}}<br />
[[Image:gp.png|180px|right|greenpois0n]]<br />
{{other|jailbreak|toolkit|greenpois0n (toolkit)}}<br />
The downloads for greenpois0n can be found on http://www.greenpois0n.com/. It is available for Windows, Mac, and Linux.<br />
<br />
== History ==<br />
Greenpois0n was originally written using two exploits: SHAtter (a [[bootrom]] [[exploit]]) as well as a userland [[kernel]] [[exploit]] provided by [[User:Comex|Comex]] to make the jailbreak [[untethered jailbreak|untethered]]. A release date of 10/10/10 10:10:10 AM (GMT) was announced, as well as the list of supported devices. Due to the nature of SHAtter, only iDevices using the [[S5L8930|A4 Processor]] were supported.<br />
[[user:geohot|geohot]] later released another jailbreak ([[limera1n]] using a different [[bootrom]] [[exploit]]) on 9 October 2010, which led to a delay in greenpois0n's release (to implement geohot's exploit, not SHAtter).<br />
Posixninja and the rest of the Chronic-dev team released Greenpois0n RC5 on 2/3/2011 which jailbreaks 4.2.1 with an untether for newer devices. Whereabouts of the new userland exploit to untether the jailbreak are unknown. <br />
<br />
== Controversy ==<br />
There was much controversy surrounding the sudden release of [[limera1n]] and the motives behind it. The main reasons for the [[limera1n]] release were:<br />
<br />
#Use an exploit that Apple already knew about (newer [[iBoot]]s shows the exploit patched) <br />
#Supports more iDevices than SHAtter<br />
#Hopefully save the SHAtter [[bootrom]] [[exploit]] for future iDevices<br />
<br />
The reason for this is [[bootrom]] [[exploit]]s are not patchable with software updates. It requires new hardware to fix the security hole. Since the [[limera1n]] hole was already discovered and patched by Apple, it benefits the community if SHAtter is saved in hopes of using it with new hardware, like the 5th generation iPhone/iPod touch and the iPad 2G.<br />
<br />
== Supported Devices ==<br />
greenpois0n requires the device to be on either iOS 3.2.2 ([[K48ap|iPad 1G]]) or iOS 4.1 (all other devices). Of the devices that support these firmware revisions, the only one ''not'' supported is the [[N82ap|iPhone 3G]]. As of RC5, Greenpois0n, has the ability to jailbreak all newer devices on iOS 4.2.1. According to posixninja, the userland exploit in RC5 was partched in 4.3 which led to its early release to the masses.<br />
<br />
== Output ==<br />
[[N90ap|iPhone 4]] with [[Greenpois0n (toolkit)|greenpois0n]] output (via [[iRecovery]]):<br />
Attempting to initialize greenpois0n<br />
Initializing commands<br />
Searching for cmd_ramdisk<br />
Found cmd_ramdisk string at 0x8401c7ac<br />
Found cmd_ramdisk reference at 0x84000d64<br />
Found cmd_ramdisk function at 0x84000cd1<br />
Initializing patches<br />
Initializing memory<br />
Initializing aes<br />
Searching for aes_crypto_cmd<br />
Found aes_crypto_cmd string at 0x84021a8c<br />
Found aes_crypto_cmd reference at 0x84017bb8<br />
Found aes_crypto_cmd fnction at 0x84017b51<br />
Initializing bdev<br />
Initializing image<br />
Initializing nvram<br />
Initializing kernel<br />
Greenpois0n initialized<br />
<br />
[[Category:Hacking Software]]<br />
[[Category:greenpois0n|jailbreak]]</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Greenpois0n_(jailbreak)&diff=15811Greenpois0n (jailbreak)2011-02-04T03:39:17Z<p>Leobruh: /* Supported Devices */</p>
<hr />
<div>{{lowercase}}<br />
[[Image:gp.png|180px|right|greenpois0n]]<br />
{{other|jailbreak|toolkit|greenpois0n (toolkit)}}<br />
The downloads for greenpois0n can be found on http://www.greenpois0n.com/. It is available for Windows, Mac, and Linux.<br />
<br />
== History ==<br />
Greenpois0n was originally written using two exploits: SHAtter (a [[bootrom]] [[exploit]]) as well as a userland [[kernel]] [[exploit]] provided by [[User:Comex|Comex]] to make the jailbreak [[untethered jailbreak|untethered]]. A release date of 10/10/10 10:10:10 AM (GMT) was announced, as well as the list of supported devices. Due to the nature of SHAtter, only iDevices using the [[S5L8930|A4 Processor]] were supported.<br />
[[user:geohot|geohot]] later released another jailbreak ([[limera1n]] using a different [[bootrom]] [[exploit]]) on 9 October 2010, which led to a delay in greenpois0n's release (to implement geohot's exploit, not SHAtter).<br />
Posixninja and the rest of the Chronic-dev team released Greenpois0n RC5 on 2/3/2011 which jailbreaks 4.2.1 with an untether for newer devices. Whereabouts of the new userland exploit to untether the jailbreak are unknown. <br />
<br />
== Controversy ==<br />
There was much controversy surrounding the sudden release of [[limera1n]] and the motives behind it. The main reasons for the [[limera1n]] release were:<br />
<br />
#Use an exploit that Apple already knew about (newer [[iBoot]]s shows the exploit patched) <br />
#Supports more iDevices than SHAtter<br />
#Hopefully save the SHAtter [[bootrom]] [[exploit]] for future iDevices<br />
<br />
The reason for this is [[bootrom]] [[exploit]]s are not patchable with software updates. It requires new hardware to fix the security hole. Since the [[limera1n]] hole was already discovered and patched by Apple, it benefits the community if SHAtter is saved in hopes of using it with new hardware, like the 5th generation iPhone/iPod touch and the iPad 2G.<br />
<br />
== Supported Devices ==<br />
greenpois0n requires the device to be on either iOS 3.2.2 ([[K48ap|iPad 1G]]) or iOS 4.1 (all other devices). Of the devices that support these firmware revisions, the only one ''not'' supported is the [[N82ap|iPhone 3G]]. As of RC5, Greenpois0n, has the ability to jailbreak all newer devices on iOS 4.2.1.<br />
<br />
== Output ==<br />
[[N90ap|iPhone 4]] with [[Greenpois0n (toolkit)|greenpois0n]] output (via [[iRecovery]]):<br />
Attempting to initialize greenpois0n<br />
Initializing commands<br />
Searching for cmd_ramdisk<br />
Found cmd_ramdisk string at 0x8401c7ac<br />
Found cmd_ramdisk reference at 0x84000d64<br />
Found cmd_ramdisk function at 0x84000cd1<br />
Initializing patches<br />
Initializing memory<br />
Initializing aes<br />
Searching for aes_crypto_cmd<br />
Found aes_crypto_cmd string at 0x84021a8c<br />
Found aes_crypto_cmd reference at 0x84017bb8<br />
Found aes_crypto_cmd fnction at 0x84017b51<br />
Initializing bdev<br />
Initializing image<br />
Initializing nvram<br />
Initializing kernel<br />
Greenpois0n initialized<br />
<br />
[[Category:Hacking Software]]<br />
[[Category:greenpois0n|jailbreak]]</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Greenpois0n_(jailbreak)&diff=15810Greenpois0n (jailbreak)2011-02-04T03:37:45Z<p>Leobruh: RC5</p>
<hr />
<div>{{lowercase}}<br />
[[Image:gp.png|180px|right|greenpois0n]]<br />
{{other|jailbreak|toolkit|greenpois0n (toolkit)}}<br />
The downloads for greenpois0n can be found on http://www.greenpois0n.com/. It is available for Windows, Mac, and Linux.<br />
<br />
== History ==<br />
Greenpois0n was originally written using two exploits: SHAtter (a [[bootrom]] [[exploit]]) as well as a userland [[kernel]] [[exploit]] provided by [[User:Comex|Comex]] to make the jailbreak [[untethered jailbreak|untethered]]. A release date of 10/10/10 10:10:10 AM (GMT) was announced, as well as the list of supported devices. Due to the nature of SHAtter, only iDevices using the [[S5L8930|A4 Processor]] were supported.<br />
[[user:geohot|geohot]] later released another jailbreak ([[limera1n]] using a different [[bootrom]] [[exploit]]) on 9 October 2010, which led to a delay in greenpois0n's release (to implement geohot's exploit, not SHAtter).<br />
Posixninja and the rest of the Chronic-dev team released Greenpois0n RC5 on 2/3/2011 which jailbreaks 4.2.1 with an untether for newer devices. Whereabouts of the new userland exploit to untether the jailbreak are unknown. <br />
<br />
== Controversy ==<br />
There was much controversy surrounding the sudden release of [[limera1n]] and the motives behind it. The main reasons for the [[limera1n]] release were:<br />
<br />
#Use an exploit that Apple already knew about (newer [[iBoot]]s shows the exploit patched) <br />
#Supports more iDevices than SHAtter<br />
#Hopefully save the SHAtter [[bootrom]] [[exploit]] for future iDevices<br />
<br />
The reason for this is [[bootrom]] [[exploit]]s are not patchable with software updates. It requires new hardware to fix the security hole. Since the [[limera1n]] hole was already discovered and patched by Apple, it benefits the community if SHAtter is saved in hopes of using it with new hardware, like the 5th generation iPhone/iPod touch and the iPad 2G.<br />
<br />
== Supported Devices ==<br />
greenpois0n requires the device to be on either iOS 3.2.2 ([[K48ap|iPad 1G]]) or iOS 4.1 (all other devices). Of the devices that support these firmware revisions, the only one ''not'' supported is the [[N82ap|iPhone 3G]].<br />
<br />
== Output ==<br />
[[N90ap|iPhone 4]] with [[Greenpois0n (toolkit)|greenpois0n]] output (via [[iRecovery]]):<br />
Attempting to initialize greenpois0n<br />
Initializing commands<br />
Searching for cmd_ramdisk<br />
Found cmd_ramdisk string at 0x8401c7ac<br />
Found cmd_ramdisk reference at 0x84000d64<br />
Found cmd_ramdisk function at 0x84000cd1<br />
Initializing patches<br />
Initializing memory<br />
Initializing aes<br />
Searching for aes_crypto_cmd<br />
Found aes_crypto_cmd string at 0x84021a8c<br />
Found aes_crypto_cmd reference at 0x84017bb8<br />
Found aes_crypto_cmd fnction at 0x84017b51<br />
Initializing bdev<br />
Initializing image<br />
Initializing nvram<br />
Initializing kernel<br />
Greenpois0n initialized<br />
<br />
[[Category:Hacking Software]]<br />
[[Category:greenpois0n|jailbreak]]</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Limera1n&diff=15512Limera1n2011-01-29T19:01:19Z<p>Leobruh: this was annooooooooying me.</p>
<hr />
<div>{{DISPLAYTITLE:limera1n}}<br />
[[Image:Ra1ndrop.png|right]]<br />
This is [[User:Geohot|geohot's]] latest [[jailbreak]] utility. It uses an undisclosed bootrom exploit and [[User:Comex|comex]]'s Packet Filter Kernel Exploit to achieve an [[untethered jailbreak]] on newer devices. The following devices are technically supported:<br />
<br />
* [[N88ap|iPhone 3GS]]<br />
* [[N90ap|iPhone 4]]<br />
* [[N18ap|iPod touch 3G]]<br />
* [[N81ap|iPod touch 4G]]<br />
* [[K48ap|iPad]]<br />
* [[K66ap|AppleTV 2G]] (creates a bare-bones jailbreak by mounting '/' as read/write in /etc/fstab)<br />
<br />
Limera1n has been demonstrated multiple times by [[User:Geohot|geohot]], using blog posts on his now private blog. [[User:Geohot|Geohot]] [http://1.bp.blogspot.com/_NJ4JFBfr1tY/TDgkAsTQEmI/AAAAAAAAAcw/ZNHDxMNNL4Y/s1600/iphone4.png showed off a high-res picture of Cydia on an iPhone 4]. He [http://www.youtube.com/watch?v=__TR86PLiHw displayed an iPod touch 3G with an untethered jailbreak] that met MuscleNerd's requirements for a good video. In addition, he took a [http://4.bp.blogspot.com/_NJ4JFBfr1tY/S7_OvGMqJMI/AAAAAAAAAcE/R5WLrCizGw0/s1600/ipad_jb.jpg picture of Cydia and blackra1n icons on his iPad's SpringBoard].<br />
<br />
'''Release Date:''' October 9, 2010<br />
<br />
'''Supported OS's:''' Mac OS X, Windows<br />
<br />
'''Supported Operations:''' Hacktivation, jailbreaking<br />
<br />
<br />
==Release text==<br />
<center>limera1n, 6 months in the making<br /><br />
iPhone 3GS, iPod Touch 3G, iPad, iPhone 4, iPod Touch 4G<br /><br />
4.0-4.1 and beyond+++<br /><br />
limera1n is unpatchable<br /><br />
untethered thanks to jailbreakme star '''comex'''<br /><br />
brought to you by '''geohot'''<br /><br />
hacktivates<br /><br />
Mac coming in 7 years<br /><br />
donations keep support alive<br /><br />
zero pictures of my face</center><br />
<br />
==Credit==<br />
* '''[[User:Geohot|geohot]]''' - The program itself, and the bootrom exploit.<br />
* '''[[User:Comex|comex]]''' - The userland exploit that allows limera1n to run [[untethered jailbreak|untethered]].<br />
<br />
==Changelog==<br />
{| class="wikitable" style="border-collapse:collapse;" border="1"<br />
|-<br />
|<center>'''Version'''</center><br />
|<center>'''Release time'''</center><br />
|<center>'''MD5 Hash'''</center><br />
|<center>'''Change comment'''</center><br />
|-<br />
|BETA 1<br />
|9 Oct 2010 XX:XX GMT<br />
|2f2b09a6ed5c5613d5361d8a9d0696b6<br />
|First release.<br />
|-<br />
|BETA 2<br />
|10 Oct 2010 XX:XX GMT<br />
|a70dccb3dfc0e505687424184dc3d1ce<br />
|Fixed kernel patching magic. Rerun BETA2+ over BETA1.<br />
|-<br />
|BETA 3<br />
|10 Oct 2010 XX:XX GMT<br />
|81730090f7de1576268ee8c2407c3d35<br />
|Fixed an issue with [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]])<br />
|-<br />
|BETA 4<br />
|10 Oct 2010 XX:XX GMT<br />
|d901c4b3a544983f095b0d03eb94e4db<br />
|Uninstall fixed, respring fixed<br />
|-<br />
|RC1<br />
|11 Oct 2010 XX:XX GMT<br />
|0622d99ffe4c25f75c720a689853845f<br />
|out of beta! afc2, reliability improvements, no reboot for cydia, 2kb smaller<br />
|-<br />
|RC1b<br />
|11 Oct 2010 XX:XX GMT<br />
|fc6f7d696a57c3baede49bdff8a7f43f<br />
|addresses an install issue, mainly with iPads<br />
|-<br />
|Final<br />
|11 Oct 2010 23:XX GMT<br />
|fc6f7d696a57c3baede49bdff8a7f43f<br />
|(same as RC1b)<br />
|}<br />
<br />
==Technical Information==<br />
=== Basics ===<br />
* Limera1n has nothing to do with SHAtter at all.<br />
* Limera1n uses a bootrom exploit to achieve the [[tethered jailbreak]] and unsigned code execution.<br />
* Limera1n uses a userland exploit to make it untethered, which was developed by [[User:Comex|comex]].<br />
* Limera1n uses a hacktivation dylib to perform hacktivation.<br />
<br />
=== Exploits ===<br />
Limera1n reuses the usb_control_msg(0x21,2) but exploits a different vulnerability.<br />
<br />
=== Process ===<br />
The jailbreak appears to execute something like the following (in no particular order):<br />
* In recovery1,<br />
"setenv debug-uarts 1<br />
setenv auto-boot false<br />
saveenv"<br />
* In [[DFU Mode]], it uploads a [[payload]].<br />
* In recovery2, it uploads another [[payload]] and its [[ramdisk]].<br />
"setenv auto-boot true<br />
reset<br />
geohot done"<br />
<br />
=== Interesting Messages ===<br />
"geohot black is the new purple"<br />
<br />
"blackra1n start: %d current IRQ mask is %8.8X<br />
usb irq disabled...shhh<br />
fxns found @ %8.8X %8.8X<br />
found iBoot @ %8.8X<br />
i'm back from IRQland...<br />
3g detected, kicking nor<br />
nor kicked<br />
memcpy done<br />
iBoot restored!!!<br />
found command table @ %8.8X<br />
cmd_geohot added<br />
time to pray...%8.8X"<br />
<br />
"2.2X send command(%d): %s<br />
send exploit!!!<br />
sent data to copy: %X<br />
sent shellcode: %X has real length %X<br />
never freed: %X<br />
sent fake data to timeout: %X<br />
sent exploit to heap overflow: %X<br />
sending file with length: 0x%X Mingw runtime failure:<br />
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.<br />
Unknown pseudo relocation bit size %d."<br />
<br />
==Controversy==<br />
The release of this jailbreak was specifically designed to pressure [[Chronic Dev (team)]] into not releasing SHAtter, but to instead implement the limera1n exploit into [[greenpois0n]]; after releasing limera1n, releasing SHAtter would uselessly disclose another bootrom exploit to Apple.<br />
<br />
[[User:Geohot|Geohot]]'s rationale is that Apple already discovered, through internal testing, the limera1n exploit, making it very likely that it will be fixed in the next bootrom revision. Because [[iBoot]] code is present both in the bootrom and firmware, and because firmware is refreshed much more often that bootrom code, any fix in this code branch would appear first in firmware. [[User:Geohot|Geohot]] observed his limera1n exploit was closed in firmware and concluded that it would almost certainly be fixed in the next bootrom revision, whereas SHAtter still has a chance of remaining useful for an indefinite amount of time.<br />
<br />
Limera1n's [[Untethered jailbreak|untethered]] userland exploit for iOS 4.0 and 4.1 was obtained by [[User:Geohot|geohot]] under questionable circumstances from [[User:Comex|comex]]. [[User:Comex|Comex]] did end up fixing the kernel patching code by beta2, so as to not break users' devices.<br />
<br />
== Hacktivation ==<br />
Limera1n will copy hacktivation.dylib to /usr/lib and change entries to com.apple.mobile.lockdown.plist, whether it has been activated using iTunes or not. This, while helpful to many, can also be harmful to legitimate activators. For a guide on how to remove this hacktivation on iTunes activated devices, see the link below.<br />
<br />
==External Links==<br />
* [http://loadingchanges.com/wp-content/uploads/2010/10/limetime.jpg Picture of limera1n in action]<br />
* [http://limera1n.com/ Official domain] <br />
* [http://theiphonewiki.com/limera1n The iPhone Wiki Mirror]<br />
* [http://www.mediafire.com/?5sovoo41rbcdspw Limera1n RC Beta2 Dump on Mediafire provided by iH8sn0w.]<br />
* [http://www.pastie.org/1210054 Veence's explanation for release]<br />
* [http://www.cmdshft.ipwn.me/blog/?p=555 Hacktivation removal guide.]<br />
<br />
[[Category:Hacking Software]]</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User:Pod2g&diff=15490User:Pod2g2011-01-29T17:53:54Z<p>Leobruh: </p>
<hr />
<div>pod2g is an iPhone hacker who has discovered several [[bootrom]] exploits, including the [[0x24000 Segment Overflow]] and the [[usb_control_msg(0xA1, 1) Exploit]]. He was formerly part of the [[Chronic Dev (team)|Chronic Dev Team]], but left for personal reasons.<br />
<br />
He was the first to [https://twitter.com/pod2g/status/23932796062 tweet the IMG3 keys] for [[iBSS]] for iOS 4.0.1 on the [[N90ap|iPhone 4]], as proof of unsigned code running on the device.<br />
<br />
As of 1/29/2011, pod2g, has revealed to have two untether exploits. News of release have not been revealed.<br />
<br />
[https://twitter.com/pod2g pod2g on Twitter]<br />
<br />
[[Category:Hackers]]</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User:Pod2g&diff=15489User:Pod2g2011-01-29T17:51:59Z<p>Leobruh: </p>
<hr />
<div>pod2g is an iPhone hacker who has discovered several [[bootrom]] exploits, including the [[0x24000 Segment Overflow]] and the [[usb_control_msg(0xA1, 1) Exploit]]. He was formerly part of the [[Chronic Dev (team)|Chronic Dev Team]], but left for personal reasons.<br />
<br />
He was the first to [https://twitter.com/pod2g/status/23932796062 tweet the IMG3 keys] for [[iBSS]] for iOS 4.0.1 on the [[N90ap|iPhone 4]], as proof of unsigned code running on the device.<br />
<br />
As of 1/29/2011, pod2g, has revealed to have two untether exploits. News of release have not been released.<br />
<br />
[https://twitter.com/pod2g pod2g on Twitter]<br />
<br />
[[Category:Hackers]]</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=05.16.00&diff=1517305.16.002011-01-20T05:03:24Z<p>Leobruh: New page: A new iPhone 3GS baseband in iOS 4.2b1. There's no public unlock for it.</p>
<hr />
<div>A new iPhone 3GS baseband in iOS 4.2b1. There's no public unlock for it.</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=04.09.00&diff=1517204.09.002011-01-20T05:02:47Z<p>Leobruh: New page: A new iPhone 4 baseband in iOS 4.3b2. There's no public unlock for it.</p>
<hr />
<div>A new iPhone 4 baseband in iOS 4.3b2. There's no public unlock for it.</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=04.08.00&diff=1517104.08.002011-01-20T05:02:06Z<p>Leobruh: </p>
<hr />
<div>A new iPhone 4 baseband in iOS 4.3b1. There's no public unlock for it.</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=04.08.00&diff=1517004.08.002011-01-20T05:01:45Z<p>Leobruh: New page: A new iPhone 4 baseband in iOS 4.3b2. There's no public unlock for it.</p>
<hr />
<div>A new iPhone 4 baseband in iOS 4.3b2. There's no public unlock for it.</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Firmware&diff=14180Firmware2010-12-14T22:18:00Z<p>Leobruh: /* iPod touch (2nd generation) */</p>
<hr />
<div>Latest Apple download links can be found [http://www.itunes.com/version here].<br />
<br />
==Comparison of firmware versions==<br />
<br />
===[[K66ap|Apple TV (2nd generation)]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="120"| Build<br />
!width="40"| [[IBoot (Bootloader)|iBoot]]<br />
!width="200"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="150"| Comments<br />
!width="100"| Publicly available virgin [[jailbreak]]?<br />
!width="70"| File Size<br />
|-<br />
| 4.1<br />
| [[Mojave 8M89 (Apple TV 2G)|Mojave 8M89]]<br />
| [[IBoot-931.44.21|931.44.21]]<br />
| [http://appldnld.apple.com/AppleTV/061-8940.20100926.Tvtnz/AppleTV2,1_4.1_8M89_Restore.ipsw AppleTV2,1_4.1_8M89_Restore.ipsw]<br />
| <code>68647d6ce163fc20891ca5bcff647c8eecc2b8d9</code><br />
| Initial shipment.<br />
| {{yes}}<br />
| 253,759,976<br />
|-<br />
| 4.2<br />
| [[jasper 8C150 (Apple TV 2G)|Jasper 8C150]]<br />
|<br />
| [http://appldnld.apple.com/AppleTV/061-8747.20101122.Vgtr5/AppleTV2,1_4.2_8C150_Restore.ipsw AppleTV2,1_4.2_8C150_Restore.ipsw]<br />
| <code>58f9ab479783dad3dff3834452abc2917aaef2a5</code><br />
|<br />
| {{no}}<br />
| 279,991,056<br />
|-<br />
| 4.2.1<br />
| [[jasper 8C154 (Apple TV 2G)|Jasper 8C154]]<br />
|<br />
| [http://appldnld.apple.com/AppleTV/061-9978.20101214.gmabr/AppleTV2,1_4.2.1_8C154_Restore.ipsw AppleTV2,1_4.2.1_8C154_Restore.ipsw]<br />
| <code>c2b1adea595afa2b9caf633f0a820d3b66424dbf</code><br />
|<br />
| {{no}}<br />
| 280,052,510<br />
|}<br />
<br />
===[[K48ap|iPad]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="120"| Build<br />
!width="70"| [[X-Gold 608#Known iPad Firmware Versions|Baseband]] (3G only)<br />
!width="200"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="150"| Comments<br />
!width="100"| Publicly available virgin [[jailbreak]]?<br />
!width="70"| File Size<br />
|-<br />
| 3.2<br />
| [[Wildcat 7B367 (iPad)|Wildcat 7B367]]<br />
|rowspan="3" | [[6.15.00]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPad/061-7987.20100403.mjiTr/iPad1,1_3.2_7B367_Restore.ipsw iPad1,1_3.2_7B367_Restore.ipsw]<br />
| <code>172e8297af74b91971a802e6ad137c891f553099</code><br />
| Initial shipment.<br />
| {{yes}}<br />
| 478,959,325<br />
|-<br />
| 3.2.1<br />
| [[Wildcat 7B405 (iPad)|Wildcat 7B405]]<br />
| [http://appldnld.apple.com/iPad/061-8282.20100713.vgtgh/iPad1,1_3.2.1_7B405_Restore.ipsw iPad1,1_3.2.1_7B405_Restore.ipsw]<br />
| <code>de0a2b64cd335d48fb4abc9ed8700f5dbdf768ca</code><br />
| <br />
| {{yes}}<br />
| 479,012,625<br />
|-<br />
| 3.2.2<br />
| [[Wildcat 7B500 (iPad)|Wildcat 7B500]]<br />
| [http://appldnld.apple.com/iPad/061-8801.20100811.CvfR5/iPad1,1_3.2.2_7B500_Restore.ipsw iPad1,1_3.2.2_7B500_Restore.ipsw]<br />
| <code>68b613f78581d36eab96aa5a007001dff142baa3</code><br />
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.<br />
| {{yes}}<br />
| 479,001,595<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPad)|Jasper 8C148]]<br />
| [[7.10.00]]<br />
| [http://appldnld.apple.com/iPad/061-9857.20101122.VGthy/iPad1,1_4.2.1_8C148_Restore.ipsw iPad1,1_4.2.1_8C148_Restore.ipsw]<br />
| <code>8717b3bedc925b587566442ad375aa65d857e79a</code><br />
| <br />
| {{yes|Yes<sup>1</sup>}}<br />
| 578,084,840<br />
|}<br />
<br />
<sup>1</sup> [[Tethered jailbreak]] only.<br />
<br />
===[[M68ap|iPhone]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="120"| Build<br />
!width="70"| [[Baseband Firmware]]<br />
!width="210"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="140"| Comments<br />
!width="99"| Publicly available virgin [[jailbreak]]?<br />
!width="91"| Publicly available virgin [[unlock]]?<br />
!width="70"| File Size<br />
|-<br />
| 1.0<br />
| [[Alpine 1A420]]<br />
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]<br />
| iphoneproto.zip<br />
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code><br />
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]<br />
| {{no}}<br />
| {{no}}<br />
| 109,813,128<br />
|-<br />
| 1.0.0<br />
| Heavenly 1A543a<br />
| 03.11.02_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]<br />
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code><br />
| Initial US shipment.<br />
| {{yes}}<br />
| {{yes}}<br />
| 95,604,348<br />
|-<br />
| 1.0.1<br />
| Heavenly 1C25<br />
| 03.12.06_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]<br />
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| 95,627,958<br />
|-<br />
| 1.0.2<br />
| Heavenly 1C28<br />
| 03.14.08_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]<br />
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| 95,627,324<br />
|-<br />
| 1.1.1<br />
| Snowbird 3A109a<br />
| 04.01.13_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]<br />
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| 159,668,150<br />
|-<br />
| 1.1.2<br />
| Oktoberfest 3B48b<br />
| 04.02.13_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]<br />
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code><br />
| Initial Euro shipment.<br />
| {{yes}}<br />
| {{yes}}<br />
| 167,927,501<br />
|-<br />
| 1.1.3<br />
| Little Bear 4A93<br />
| 04.03.13_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]<br />
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| 169,950,551<br />
|-<br />
| 1.1.4<br />
| Little Bear 4A102<br />
| 04.04.05_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]<br />
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| 169,946,442<br />
|-<br />
| 2.0<br />
| [[Big Bear 5A347 (iPhone)|Big Bear 5A347]]<br />
|rowspan="11"| 04.05.04_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]<br />
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code><br />
| <br />
| {{yes}}<br />
|rowspan="11" {{yes|[[BootNeuter]]}}<br />
| 228,768,637<br />
|-<br />
| 2.0.1<br />
| [[Big Bear 5B108 (iPhone)|Big Bear 5B108]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]<br />
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code><br />
| <br />
| {{yes}}<br />
| 254,048,068<br />
|-<br />
| 2.0.2<br />
| [[Big Bear 5C1 (iPhone)|Big Bear 5C1]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]<br />
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code><br />
| <br />
| {{yes}}<br />
| 253,589,000<br />
|-<br />
| 2.1<br />
| [[Sugar Bowl 5F136 (iPhone)|Sugar Bowl 5F136]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]<br />
| <code>353b7745767b85932e14e262e69463620939bdf7</code><br />
| <br />
| {{yes}}<br />
| 242,171,241<br />
|-<br />
| 2.2<br />
| [[Timberline 5G77 (iPhone)|Timberline 5G77]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]<br />
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code><br />
| <br />
| {{yes}}<br />
| 257,576,980<br />
|-<br />
| 2.2.1<br />
| [[SUTimberline 5H11 (iPhone)|SUTimberline 5H11]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]<br />
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code><br />
| <br />
| {{yes}}<br />
| 257,593,705<br />
|-<br />
| 3.0<br />
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]<br />
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code><br />
| <br />
| {{yes}}<br />
| 240,394,111<br />
|-<br />
| 3.0.1<br />
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]<br />
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code><br />
| Hotfix for an SMS exploit.<br />
| {{yes}}<br />
| 240,439,502<br />
|-<br />
| 3.1<br />
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]<br />
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code><br />
|<br />
| {{yes}}<br />
| 252,536,460<br />
|-<br />
| 3.1.2<br />
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]<br />
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code><br />
|<br />
| {{yes}}<br />
| 252,515,888<br />
|-<br />
| 3.1.3<br />
| [[SUNorthstarTwo 7E18 (iPhone)|SUNorthstarTwo 7E18]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7481.20100202.4orot/iPhone1,1_3.1.3_7E18_Restore.ipsw iPhone1,1_3.1.3_7E18_Restore.ipsw]<br />
| <code>eab23a7f8d2a17cb71046c50fc5f67ec390a3c2b</code><br />
|<br />
| {{yes}}<br />
| 238,319,275<br />
|}<br />
<br />
===[[N82ap|iPhone 3G]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="120"| Build<br />
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]<br />
!width="210"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="140"| Comments<br />
!width="99"| Publicly available virgin [[jailbreak]]?<br />
!width="90"| Publicly available virgin [[unlock]]?<br />
!width="70"| File Size<br />
|-<br />
| 2.0<br />
| [[Big Bear 5A345 (iPhone 3G)|Big Bear 5A345]]<br />
|rowspan="2" | [[1.45.00]]<br />
| No download available<br />
|<br />
| Initial shipment.<br />
| {{yes}}<br />
|rowspan="5" {{partial|Upgrade to 2.2}}<br />
| <br />
|-<br />
| 2.0<br />
| [[Big Bear 5A347 (iPhone 3G)|Big Bear 5A347]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]<br />
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code><br />
| <br />
| {{yes}}<br />
| 235,957,125<br />
|-<br />
| 2.0.1<br />
| [[Big Bear 5B108 (iPhone 3G)|Big Bear 5B108]]<br />
| [[1.48.02]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]<br />
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code><br />
| <br />
| {{yes}}<br />
| 261,224,227<br />
|-<br />
| 2.0.2<br />
| [[Big Bear 5C1 (iPhone 3G)|Big Bear 5C1]]<br />
| [[2.08.01]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]<br />
| <code>bef7fef954293046420fbcf947379839178a195b</code><br />
| <br />
| {{yes}}<br />
| 260,761,030<br />
|-<br />
| 2.1<br />
| [[Sugar Bowl 5F136 (iPhone 3G)|Sugar Bowl 5F136]]<br />
| [[2.11.07]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]<br />
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code><br />
| <br />
| {{yes}}<br />
| 249,341,655<br />
|-<br />
| 2.2<br />
| [[Timberline 5G77 (iPhone 3G)|Timberline 5G77]]<br />
| [[2.28.00]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]<br />
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code><br />
| <br />
| {{yes}}<br />
| {{yes|[[Ultrasn0w|yellowsn0w]]}}<br />
| 258,342,348<br />
|-<br />
| 2.2.1<br />
| [[SUTimberline 5H11 (iPhone 3G)|SUTimberline 5H11]]<br />
| [[2.30.03]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]<br />
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code><br />
| <br />
| {{yes}}<br />
| {{partial|Upgrade to 3.0}}<br />
| 258,359,073<br />
|-<br />
| 3.0<br />
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]<br />
|rowspan="2" | [[4.26.08]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]<br />
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code><br />
| <br />
| {{yes}}<br />
|rowspan="2" {{yes|[[ultrasn0w]]}}<br />
| 241,229,233<br />
|-<br />
| 3.0.1<br />
| [[Kirkwood 7A400 (iPhone 3G)|Kirkwood 7A400]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]<br />
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code><br />
| Hotfix for an SMS exploit.<br />
| {{yes}}<br />
| 241,274,617<br />
|-<br />
| 3.1<br />
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]<br />
|rowspan="2" | [[5.11.07]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]<br />
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code><br />
| <br />
| {{yes}}<br />
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}<br />
| 253,361,339<br />
|-<br />
| 3.1.2<br />
| [[Northstar 7D11 (iPhone 3G)|Northstar 7D11]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]<br />
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code><br />
|<br />
| {{yes}}<br />
| 253,340,786<br />
|-<br />
| 3.1.3<br />
| [[SUNorthstarTwo 7E18 (iPhone 3G)|SUNorthstarTwo 7E18]]<br />
| [[5.12.01]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7468.20100202.pbnrt/iPhone1,2_3.1.3_7E18_Restore.ipsw iPhone1,2_3.1.3_7E18_Restore.ipsw]<br />
| <code>f5950afca546f93e281ba3cdb08bc0cfed7f0896</code><br />
|<br />
| {{yes}}<br />
| {{yes|[[ultrasn0w]]}}<br />
| 239,139,281<br />
|-<br />
| 4.0<br />
| [[Apex 8A293 (iPhone 3G)|Apex 8A293]]<br />
|rowspan="3" | [[5.13.04]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7436.20100621.58Yt4/iPhone1,2_4.0_8A293_Restore.ipsw iPhone1,2_4.0_8A293_Restore.ipsw]<br />
| <code>ee1eba9281b902d7ff3f24d50f9aebff0df27f92</code><br />
|<br />
| {{yes}}<br />
|rowspan="3" {{yes|[[ultrasn0w]]}}<br />
| 306,274,631<br />
|-<br />
| 4.0.1<br />
| [[Apex 8A306 (iPhone 3G)|Apex 8A306]]<br />
| [http://appldnld.apple.com/iPhone4/061-8616.20100715.phnt4/iPhone1,2_4.0.1_8A306_Restore.ipsw iPhone1,2_4.0.1_8A306_Restore.ipsw]<br />
| <code>940bd2b36c646f6673419eab661ac1f13248e592</code><br />
| New formula to calculate bars. Otherwise, it's the same as 4.0.<br />
| {{yes}}<br />
| 320,237,975<br />
|-<br />
| 4.0.2<br />
| [[Apex 8A400 (iPhone 3G)|Apex 8A400]]<br />
| [http://appldnld.apple.com/iPhone4/061-8802.20100811.XcfpR/iPhone1,2_4.0.2_8A400_Restore.ipsw iPhone1,2_4.0.2_8A400_Restore.ipsw]<br />
| <code>ee2bc74719170a7a2440b593b6f300727c930c69</code><br />
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.<br />
| {{yes}}<br />
| 320,216,794<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPhone 3G)|Baker 8B117]]<br />
| [[5.14.02]]<br />
| [http://appldnld.apple.com/iPhone4/061-7932.20100908.3fgt5/iPhone1,2_4.1_8B117_Restore.ipsw iPhone1,2_4.1_8B117_Restore.ipsw]<br />
|<code>d87bab469dd1146ab83ddcc23f03b3164d7e09d4</code><br />
| <br />
| {{Yes}}<br />
| {{partial|Upgrade baseband to [[6.15.00]]}}<br />
| 323,137,556<br />
|-<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPhone 3G)|Jasper 8C148]]<br />
| [[5.15.04]]<br />
| [http://appldnld.apple.com/iPhone4/061-9853.20101122.Vfgt5/iPhone1,2_4.2.1_8C148_Restore.ipsw iPhone1,2_4.2.1_8C148_Restore.ipsw]<br />
|<code>d2ed58586e8ca2153f2e2ec585bba8afc5173378</code><br />
| <br />
| {{Yes}}<br />
| {{partial|Upgrade baseband to [[6.15.00]]}}<br />
| 338,579,762<br />
|-<br />
|}<br />
<br />
===[[N88ap|iPhone 3GS]]===<br />
Units with the new bootrom began shipping around September 2009.<br />
<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="120"| Build<br />
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]<br />
!width="210"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="140"| Comments<br />
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3|old bootrom]])<br />
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3.2|new bootrom]])<br />
!width="80"| Publicly available virgin [[unlock]]?<br />
!width="70"| File Size<br />
|-<br />
| 3.0<br />
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]<br />
|rowspan="2" | [[4.26.08]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw] <br />
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code><br />
| Initial shipment.<br />
| {{yes}}<br />
|rowspan="2" {{no|[[SHSH]]s unavailable at release}}<br />
|rowspan="2" {{yes|[[ultrasn0w]]}}<br />
| 312,292,933<br />
|-<br />
| 3.0.1<br />
| [[Kirkwood 7A400 (iPhone_3GS)|Kirkwood 7A400]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]<br />
| <code>30006575af931e3da0521febace005152cdb8853</code><br />
| Hotfix for an SMS exploit.<br />
| {{yes}}<br />
| 312,330,244<br />
|-<br />
| 3.1b<br />
| [[Sierra 7C108b]]<br />
| Unknown<br />
| Not available to public<br />
| Unknown<br />
| Used for testing.<br />
| {{no}}<br />
| {{no}}<br />
| {{no}}<br />
|<br />
|-<br />
| 3.1<br />
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]<br />
|rowspan="2" | [[5.11.07]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]<br />
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code><br />
| <br />
| {{yes}}<br />
| {{yes|Yes<sup>1</sup>}}<br />
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}<br />
| 321,011,474<br />
|-<br />
| 3.1.2<br />
| [[Northstar 7D11 (iPhone 3GS)|Northstar 7D11]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]<br />
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code><br />
|<br />
| {{yes}}<br />
| {{yes}}<br />
| 321,015,700<br />
|-<br />
| 3.1.3<br />
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|SUNorthstarTwo 7E18]]<br />
| [[5.12.01]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7472.20100202.8tugj/iPhone2,1_3.1.3_7E18_Restore.ipsw iPhone2,1_3.1.3_7E18_Restore.ipsw]<br />
| <code>8cb3775e62c6f72059a962bf891b4e145b965052</code><br />
|<br />
| {{yes}}<br />
| {{yes}}<br />
| {{yes|[[ultrasn0w]]}}<br />
| 305,122,343<br />
|-<br />
| 4.0<br />
| [[Apex 8A293 (iPhone 3GS)|Apex 8A293]]<br />
|rowspan="3" | [[5.13.04]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7437.20100621.5urG8/iPhone2,1_4.0_8A293_Restore.ipsw iPhone2,1_4.0_8A293_Restore.ipsw]<br />
| <code>e065245874c73510ceb8fa4bd9388b60d46eb252</code><br />
|<br />
| {{yes}}<br />
| {{yes}}<br />
|rowspan="3" {{yes|[[ultrasn0w]]}}<br />
| 396,281,280<br />
|-<br />
| 4.0.1<br />
| [[Apex 8A306 (iPhone 3GS)‎|Apex 8A306]]<br />
| [http://appldnld.apple.com/iPhone4/061-8618.20100715.Zapn4/iPhone2,1_4.0.1_8A306_Restore.ipsw iPhone2,1_4.0.1_8A306_Restore.ipsw]<br />
| <code>c2b6fb9a158547ce726baa1bf8f0558a71518fec</code><br />
| New formula to calculate bars. Otherwise, it's the same as 4.0.<br />
| {{yes}}<br />
| {{yes}}<br />
| 396,322,891<br />
|-<br />
| 4.0.2<br />
| [[Apex 8A400 (iPhone 3GS)|Apex 8A400]]<br />
| [http://appldnld.apple.com/iPhone4/061-8805.20100811.Dcr4e/iPhone2,1_4.0.2_8A400_Restore.ipsw iPhone2,1_4.0.2_8A400_Restore.ipsw]<br />
| <code>61d21363ced6e006cc226f9a0a0e9c6ed8e048ab</code><br />
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.<br />
| {{yes}}<br />
| {{yes}}<br />
| 396,310,640<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPhone 3GS)|Baker 8B117]]<br />
| [[5.14.02]]<br />
| [http://appldnld.apple.com/iPhone4/061-7938.20100908.F3rCk/iPhone2,1_4.1_8B117_Restore.ipsw iPhone2,1_4.1_8B117_Restore.ipsw]<br />
|<code>2d1657cd33ae23b8d4e79e41fe758d09d3c52e30</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| {{partial|Upgrade baseband to [[6.15.00]]}}<br />
| 400,572,133<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148a (iPhone 3GS)|Jasper 8C148a]]<br />
| [[5.15.04]]<br />
| [http://appldnld.apple.com/iPhone4/061-9895.20101122.Cdew2/iPhone2,1_4.2.1_8C148a_Restore.ipsw iPhone2,1_4.2.1_8C148a_Restore.ipsw]<br />
| <code>2787bb9fbf18594279d05682e6fd16d2b9612a2a</code><br />
| <br />
| {{yes}}<br />
| {{yes|Yes<sup>1</sup>}}<br />
| {{partial|Upgrade baseband to [[6.15.00]]}}<br />
| 420,813,164<br />
|}<br />
<sup>1</sup> [[Tethered jailbreak]] only.<br />
<br />
===[[N90ap|iPhone 4]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="120"| Build<br />
!width="70"| [[XMM 6180#Known Firmware Versions|Baseband]]<br />
!width="40"| [[IBoot (Bootloader)|iBoot]]<br />
!width="210"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="140"| Comments<br />
!width="95"| Publicly available virgin [[jailbreak]]?<br />
!width="95"| Publicly available virgin [[unlock]]?<br />
!width="70"| File Size<br />
|-<br />
| Inf1<br />
| [[Inferno 8A2062a]]<br />
| Unknown<br />
| ?<br />
| Not available to public<br />
| Unknown<br />
| Used for testing.<br />
| {{no}}<br />
| {{no}}<br />
| Unknown<br />
|-<br />
| 4.0<br />
| [[Apex 8A293 (iPhone 4)|Apex 8A293]]<br />
|rowspan="3" | [[1.59.00]]<br />
| ?<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7380.20100621,Vfgb5/iPhone3,1_4.0_8A293_Restore.ipsw iPhone3,1_4.0_8A293_Restore.ipsw]<br />
| <code>171c2a3995fa149f2a369ccd87f82c5c30da3f88</code><br />
| Initial shipment.<br />
| {{yes}}<br />
|rowspan="3" {{Yes|[[ultrasn0w]]}}<br />
| 607,363,121<br />
|-<br />
| 4.0.1<br />
| [[Apex 8A306 (iPhone 4)|Apex 8A306]]<br />
| ?<br />
| [http://appldnld.apple.com/iPhone4/061-8619.20100715.4Pnsx/iPhone3,1_4.0.1_8A306_Restore.ipsw iPhone3,1_4.0.1_8A306_Restore.ipsw]<br />
| <code>a9cf20679273b7e502ab384854ba96cc2a54d532</code><br />
| New formula to calculate bars. Otherwise, it's the same as 4.0.<br />
| {{yes}}<br />
| 607,380,127<br />
|-<br />
| 4.0.2<br />
| [[Apex 8A400 (iPhone 4)|Apex 8A400]]<br />
| ?<br />
| [http://appldnld.apple.com/iPhone4/061-8807.20100811.3Edre/iPhone3,1_4.0.2_8A400_Restore.ipsw iPhone3,1_4.0.2_8A400_Restore.ipsw]<br />
| <code>19eb071cdb9f1601b106825d0a16b1449c6eef8c</code><br />
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.<br />
| {{yes}}<br />
| 607,375,880<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPhone 4)|Baker 8B117]]<br />
| [[2.10.04]]<br />
| [[IBoot-931.18.27|931.18.27]]<br />
| [http://appldnld.apple.com/iPhone4/061-7939.20100908.Lcyg3/iPhone3,1_4.1_8B117_Restore.ipsw iPhone3,1_4.1_8B117_Restore.ipsw]<br />
|<code>a3f8a333ca181146b862ca6a59c9a6e7c27eba0b</code><br />
|<br />
| {{yes}}<br />
| {{No}}<br />
| 618,501,195<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPhone 4)|Jasper 8C148]]<br />
| [[3.10.01]]<br />
| <br />
| [http://appldnld.apple.com/iPhone4/061-9858.20101122.Er456/iPhone3,1_4.2.1_8C148_Restore.ipsw iPhone3,1_4.2.1_8C148_Restore.ipsw]<br />
|<code>366b28e9c95936bd4b11a84d54fefaf079fd6411</code><br />
|<br />
| {{yes|Yes<sup>1</sup>}}<br />
| {{No}}<br />
| 654,550,096<br />
|}<br />
<sup>1</sup> [[Tethered jailbreak]] only.<br />
<br />
===[[N45ap|iPod touch (1st generation)]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="168"| Build<br />
!width="200"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="150"| Comments<br />
!width="100"| Publicly available virgin [[jailbreak]]?<br />
!width="70"| File Size<br />
|-<br />
| 1.1<br />
| Snowbird 3A100a<br />
| No download available<br />
|<br />
| Initial shipment.<br />
| {{no}}<br />
|<br />
|-<br />
| 1.1<br />
| Snowbird 3A101a<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]<br />
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code><br />
|<br />
| {{no}}<br />
| 157,890,186<br />
|-<br />
| 1.1.1<br />
| Snowbird 3A110a<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]<br />
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code><br />
|<br />
| {{yes}}<br />
| 157,906,686<br />
|-<br />
| 1.1.2<br />
| Oktoberfest 3B48b<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]<br />
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code><br />
|<br />
| {{yes}}<br />
| 165,567,897<br />
|-<br />
| 1.1.3<br />
| Little Bear 4A93<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]<br />
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code><br />
|<br />
| {{yes}}<br />
| 173,511,411<br />
|-<br />
| 1.1.4<br />
| Little Bear 4A102<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]<br />
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code><br />
| <br />
| {{yes}}<br />
| 173,519,589<br />
|-<br />
| 1.1.5<br />
| Little Bear 4B1<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]<br />
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code><br />
|<br />
| {{yes}}<br />
| 173,519,637<br />
|-<br />
| 2.0<br />
| [[Big Bear 5A347 (iPod touch 1G)|Big Bear 5A347]]<br />
| Download Link Prohibited<br />
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code><br />
| 2.0+ is a paid upgrade series<br />
| {{yes}}<br />
| 233,409,573<br />
|-<br />
| 2.0.1<br />
| [[Big Bear 5B108 (iPod touch 1G)|Big Bear 5B108]]<br />
| Download Link Prohibited<br />
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code><br />
| <br />
| {{yes}}<br />
| 258,660,321<br />
|-<br />
| 2.0.2<br />
| [[Big Bear 5C1 (iPod touch 1G)|Big Bear 5C1]]<br />
| Download Link Prohibited<br />
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code><br />
| <br />
| {{yes}}<br />
| 258,201,218<br />
|-<br />
| 2.1<br />
| [[Sugar Bowl 5F137 (iPod touch 1G)|Sugar Bowl 5F137]]<br />
| Download Link Prohibited<br />
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code><br />
| <br />
| {{yes}}<br />
| 251,155,156<br />
|-<br />
| 2.2<br />
| [[Timberline 5G77 (iPod touch 1G)|Timberline 5G77]]<br />
| Download Link Prohibited<br />
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code><br />
| <br />
| {{yes}}<br />
| 260,186,851<br />
|-<br />
| 2.2.1<br />
| [[SUTimberline 5H11 (iPod touch 1G)|SUTimberline 5H11]]<br />
| Download Link Prohibited<br />
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code><br />
| <br />
| {{yes}}<br />
| 260,166,688<br />
|-<br />
| 3.0<br />
| [[Kirkwood 7A341 (iPod touch 1G)|Kirkwood 7A341]]<br />
| Download Link Prohibited<br />
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code><br />
| 3.0+ is a paid upgrade series<br />
| {{yes}}<br />
| 242,458,552<br />
|-<br />
| 3.1.1<br />
| [[Northstar 7C145 (iPod touch 1G)|Northstar 7C145]]<br />
| Download Link Prohibited<br />
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code><br />
| <br />
| {{yes}}<br />
| 249,755,862<br />
|-<br />
| 3.1.2<br />
| [[Northstar 7D11 (iPod touch 1G)|Northstar 7D11]]<br />
| Download Link Prohibited<br />
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code><br />
| <br />
| {{yes}} <br />
| 249,780,497<br />
|-<br />
| 3.1.3<br />
| [[SUNorthstarTwo 7E18 (iPod touch 1G)|SUNorthstarTwo 7E18]]<br />
| Download Link Prohibited<br />
| <code>5f897990f19d2f093b35e0813d7d77806404fb1f</code><br />
|<br />
| {{yes}}<br />
| 235,678,189<br />
|}<br />
<br />
===[[N72ap|iPod touch (2nd generation)]]===<br />
Units with the new bootrom have model numbers that start with "MC."<br />
<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="168"| Build<br />
!width="200"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="150"| Comments<br />
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.4|old bootrom]])<br />
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.5.1|new bootrom]])<br />
!width="70"| File Size<br />
|-<br />
| 2.1.1<br />
| [[Sugar Bowl 5F138 (iPod touch 2G)|Sugar Bowl 5F138]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]<br />
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code><br />
| Initial shipment.<br />
| {{yes|Yes<sup>1</sup>}}<br />
|rowspan="4" {{no|Incompatible device/<br />
firmware match}}<br />
| 282,083,944<br />
|-<br />
| 2.2<br />
| [[Timberline 5G77a (iPod touch 2G)|Timberline 5G77a]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]<br />
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code><br />
|<br />
| {{no}}<br />
| 291,123,491<br />
|-<br />
| 2.2.1<br />
| [[SUTimberline 5H11a (iPod touch 2G)|SUTimberline 5H11a]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]<br />
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code><br />
|<br />
| {{yes}}<br />
| 291,140,244<br />
|-<br />
| 3.0<br />
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]<br />
| Download Link Prohibited<br />
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code><br />
| 3.x is a paid upgrade series<br />
| {{yes}}<br />
| 270,315,364<br />
|-<br />
| 3.1.1<br />
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]<br />
| Download Link Prohibited<br />
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code><br />
| Initial shipment for units with the new bootrom.<br />
| {{yes}}<br />
| {{yes|Yes<sup>1</sup>}}<br />
| 277,753,989<br />
|-<br />
| 3.1.2<br />
| [[Northstar 7D11 (iPod touch 2G)|Northstar 7D11]]<br />
| Download Link Prohibited<br />
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| 277,794,671<br />
|-<br />
| 3.1.3<br />
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|SUNorthstarTwo 7E18]]<br />
| Download Link Prohibited<br />
| <code>5f4f5c01eda2f811f73167e7d1f82dbeed82367b</code><br />
|<br />
| {{yes}}<br />
| {{yes}}<br />
| 263,275,211<br />
|-<br />
| 4.0<br />
| [[Apex 8A293 (iPod touch 2G)|Apex 8A293]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7435.20100621.tr49t/iPod2,1_4.0_8A293_Restore.ipsw iPod2,1_4.0_8A293_Restore.ipsw]<br />
| <code>c026c373bc535496a6f901de2ba37d4a487413bf</code><br />
|<br />
| {{yes}}<br />
| {{yes}}<br />
| 330,278,777<br />
|-<br />
| 4.0.2<br />
| [[Apex 8A400 (iPod touch 2G)|Apex 8A400]]<br />
| [http://appldnld.apple.com/iPhone4/061-8551.20100811.Xcder/iPod2,1_4.0.2_8A400_Restore.ipsw iPod2,1_4.0.2_8A400_Restore.ipsw]<br />
| <code>06a42297d94461264eb64d7c8640cc5d1c19edeb</code><br />
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.<br />
| {{yes}}<br />
| {{yes|Yes<sup>1</sup>}}<br />
| 344,248,876<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPod touch 2G)|Baker 8B117]]<br />
| [http://appldnld.apple.com/iPhone4/061-7937.20100908.ghj4f/iPod2,1_4.1_8B117_Restore.ipsw iPod2,1_4.1_8B117_Restore.ipsw]<br />
|<code>97abde6207660bd876fd476275dd526d0dcf3d19</code><br />
| <br />
| {{Yes}}<br />
| {{yes}}<br />
| 348,027,174<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPod touch 2G)|Jasper 8C148]]<br />
| [http://appldnld.apple.com/iPhone4/061-9855.20101122.Lrft6/iPod2,1_4.2.1_8C148_Restore.ipsw iPod2,1_4.2.1_8C148_Restore.ipsw]<br />
|<code>b9efddc7bb4350c237a8d3846af61bbfc8a2f647</code><br />
|<br />
| {{yes}}<br />
| {{yes|Yes<sup>1</sup>}}<br />
|363,553,480<br />
|}<br />
<sup>1</sup> [[Tethered jailbreak]] only.<br />
<br />
===[[N18ap|iPod touch (3rd generation)]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="168"| Build<br />
!width="200"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="150"| Comments<br />
!width="99"| Publicly available virgin [[jailbreak]]?<br />
!width="70"| File Size<br />
|-<br />
| 3.1.1<br />
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]<br />
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code><br />
| Initial shipment.<br />
| {{yes|Yes<sup>1</sup>}}<br />
<br />
| 311,702,789<br />
|-<br />
| 3.1.1<br />
| [[Northstar 7C146 (iPod touch 3G)|Northstar 7C146]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]<br />
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code><br />
| <br />
| {{yes|Yes<sup>1</sup>}}<br />
| 311,690,768<br />
|-<br />
| 3.1.2<br />
| [[Northstar 7D11 (iPod touch 3G)|Northstar 7D11]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]<br />
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code><br />
| <br />
| {{yes}}<br />
| 311,740,034<br />
|-<br />
| 3.1.3<br />
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|SUNorthstarTwo 7E18]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7473.20100202.4i44t/iPod3,1_3.1.3_7E18_Restore.ipsw iPod3,1_3.1.3_7E18_Restore.ipsw]<br />
| <code>375fd469b18bfc0b74c7cfa5b4d5945197b1d106</code><br />
|<br />
| {{yes}}<br />
| 295,870,806<br />
|-<br />
| 4.0<br />
| [[Apex 8A293 (iPod touch 3G)|Apex 8A293]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7381.20100621.AzSP9/iPod3,1_4.0_8A293_Restore.ipsw iPod3,1_4.0_8A293_Restore.ipsw]<br />
| <code>36fe02b83f87d6305db572e1644841e3cd64cc7d</code><br />
|<br />
| {{yes}}<br />
| 384,178,784<br />
|-<br />
| 4.0.2<br />
| [[Apex 8A400 (iPod touch 3G)|Apex 8A400]]<br />
| [http://appldnld.apple.com/iPhone4/061-8554.20100811.Bgt54/iPod3,1_4.0.2_8A400_Restore.ipsw iPod3,1_4.0.2_8A400_Restore.ipsw]<br />
| <code>481b21044130125b117d53207f725b70fb061855</code><br />
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.<br />
| {{yes}}<br />
| 384,203,993<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPod touch 3G)|Baker 8B117]]<br />
| [http://appldnld.apple.com/iPhone4/061-7941.20100908.sV9KE/iPod3,1_4.1_8B117_Restore.ipsw iPod3,1_4.1_8B117_Restore.ipsw]<br />
|<code>3162bad4060b7a58c9942ddb483e5bd9bcc5269f</code><br />
| <br />
| {{yes}}<br />
| 388,255,189<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPod touch 3G)|Jasper 8C148]]<br />
| [http://appldnld.apple.com/iPhone4/061-9860.20101122.Xsde3/iPod3,1_4.2.1_8C148_Restore.ipsw iPod3,1_4.2.1_8C148_Restore.ipsw]<br />
|<code>1127a042c535f7cf0be950ff8946862d5fb05b36</code><br />
| <br />
| {{yes|Yes<sup>1</sup>}}<br />
| 408,118,620<br />
|}<br />
<br />
<sup>1</sup> [[Tethered jailbreak]] only.<br />
<br />
===[[N81ap|iPod touch (4th generation)]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="168"| Build<br />
!width="200"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="150"| Comments<br />
!width="99"| Publicly available virgin [[jailbreak]]?<br />
!width="70"| File Size<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPod touch 4G)|Baker 8B117]]<br />
| [http://appldnld.apple.com/iPhone4/061-8490.20100901.hyjtR/iPod4,1_4.1_8B117_Restore.ipsw iPod4,1_4.1_8B117_Restore.ipsw]<br />
| <code>a464492bf6ad25d65b378c85d8b181f973ede38a</code><br />
| Initial shipment.<br />
| {{yes}}<br />
| 608,360,672<br />
|-<br />
| 4.1<br />
| [[Baker 8B118 (iPod touch 4G)|Baker 8B118]]<br />
| [http://appldnld.apple.com/iPhone4/061-9344.20100922.Urgt43/iPod4,1_4.1_8B118_Restore.ipsw iPod4,1_4.1_8B118_Restore.ipsw]<br />
| <code>331fb1342f5dab8c04cead74384a1e0fc1145952</code><br />
| <br />
| {{yes}}<br />
| 608,360,927<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPod touch 4G)|Jasper 8C148]]<br />
| [http://appldnld.apple.com/iPhone4/061-9859.20101122.$erft/iPod4,1_4.2.1_8C148_Restore.ipsw iPod4,1_4.2.1_8C148_Restore.ipsw]<br />
| <code>6a890696126d0cb7f9ccd6b913ecb09cf2029820</code><br />
| <br />
| {{yes|Yes<sup>1</sup>}}<br />
|638,177,119<br />
|}<br />
<br />
<sup>1</sup> [[Tethered jailbreak]] only.<br />
<br />
==See also==<br />
* [[VFDecrypt]]<br />
* [[VFDecrypt Keys]]<br />
<br />
==Resources==<br />
*[http://www.trejan.com/projects/ipod/ Firmware List]<br />
*[http://itunes.com/version Apple Firmware XML]</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Firmware&diff=14179Firmware2010-12-14T22:17:00Z<p>Leobruh: /* iPod touch (2nd generation) */ latest redsn0w tether jbs ipod touch 2g with new bootrom</p>
<hr />
<div>Latest Apple download links can be found [http://www.itunes.com/version here].<br />
<br />
==Comparison of firmware versions==<br />
<br />
===[[K66ap|Apple TV (2nd generation)]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="120"| Build<br />
!width="40"| [[IBoot (Bootloader)|iBoot]]<br />
!width="200"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="150"| Comments<br />
!width="100"| Publicly available virgin [[jailbreak]]?<br />
!width="70"| File Size<br />
|-<br />
| 4.1<br />
| [[Mojave 8M89 (Apple TV 2G)|Mojave 8M89]]<br />
| [[IBoot-931.44.21|931.44.21]]<br />
| [http://appldnld.apple.com/AppleTV/061-8940.20100926.Tvtnz/AppleTV2,1_4.1_8M89_Restore.ipsw AppleTV2,1_4.1_8M89_Restore.ipsw]<br />
| <code>68647d6ce163fc20891ca5bcff647c8eecc2b8d9</code><br />
| Initial shipment.<br />
| {{yes}}<br />
| 253,759,976<br />
|-<br />
| 4.2<br />
| [[jasper 8C150 (Apple TV 2G)|Jasper 8C150]]<br />
|<br />
| [http://appldnld.apple.com/AppleTV/061-8747.20101122.Vgtr5/AppleTV2,1_4.2_8C150_Restore.ipsw AppleTV2,1_4.2_8C150_Restore.ipsw]<br />
| <code>58f9ab479783dad3dff3834452abc2917aaef2a5</code><br />
|<br />
| {{no}}<br />
| 279,991,056<br />
|-<br />
| 4.2.1<br />
| [[jasper 8C154 (Apple TV 2G)|Jasper 8C154]]<br />
|<br />
| [http://appldnld.apple.com/AppleTV/061-9978.20101214.gmabr/AppleTV2,1_4.2.1_8C154_Restore.ipsw AppleTV2,1_4.2.1_8C154_Restore.ipsw]<br />
| <code>c2b1adea595afa2b9caf633f0a820d3b66424dbf</code><br />
|<br />
| {{no}}<br />
| 280,052,510<br />
|}<br />
<br />
===[[K48ap|iPad]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="120"| Build<br />
!width="70"| [[X-Gold 608#Known iPad Firmware Versions|Baseband]] (3G only)<br />
!width="200"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="150"| Comments<br />
!width="100"| Publicly available virgin [[jailbreak]]?<br />
!width="70"| File Size<br />
|-<br />
| 3.2<br />
| [[Wildcat 7B367 (iPad)|Wildcat 7B367]]<br />
|rowspan="3" | [[6.15.00]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPad/061-7987.20100403.mjiTr/iPad1,1_3.2_7B367_Restore.ipsw iPad1,1_3.2_7B367_Restore.ipsw]<br />
| <code>172e8297af74b91971a802e6ad137c891f553099</code><br />
| Initial shipment.<br />
| {{yes}}<br />
| 478,959,325<br />
|-<br />
| 3.2.1<br />
| [[Wildcat 7B405 (iPad)|Wildcat 7B405]]<br />
| [http://appldnld.apple.com/iPad/061-8282.20100713.vgtgh/iPad1,1_3.2.1_7B405_Restore.ipsw iPad1,1_3.2.1_7B405_Restore.ipsw]<br />
| <code>de0a2b64cd335d48fb4abc9ed8700f5dbdf768ca</code><br />
| <br />
| {{yes}}<br />
| 479,012,625<br />
|-<br />
| 3.2.2<br />
| [[Wildcat 7B500 (iPad)|Wildcat 7B500]]<br />
| [http://appldnld.apple.com/iPad/061-8801.20100811.CvfR5/iPad1,1_3.2.2_7B500_Restore.ipsw iPad1,1_3.2.2_7B500_Restore.ipsw]<br />
| <code>68b613f78581d36eab96aa5a007001dff142baa3</code><br />
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.<br />
| {{yes}}<br />
| 479,001,595<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPad)|Jasper 8C148]]<br />
| [[7.10.00]]<br />
| [http://appldnld.apple.com/iPad/061-9857.20101122.VGthy/iPad1,1_4.2.1_8C148_Restore.ipsw iPad1,1_4.2.1_8C148_Restore.ipsw]<br />
| <code>8717b3bedc925b587566442ad375aa65d857e79a</code><br />
| <br />
| {{yes|Yes<sup>1</sup>}}<br />
| 578,084,840<br />
|}<br />
<br />
<sup>1</sup> [[Tethered jailbreak]] only.<br />
<br />
===[[M68ap|iPhone]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="120"| Build<br />
!width="70"| [[Baseband Firmware]]<br />
!width="210"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="140"| Comments<br />
!width="99"| Publicly available virgin [[jailbreak]]?<br />
!width="91"| Publicly available virgin [[unlock]]?<br />
!width="70"| File Size<br />
|-<br />
| 1.0<br />
| [[Alpine 1A420]]<br />
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]<br />
| iphoneproto.zip<br />
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code><br />
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]<br />
| {{no}}<br />
| {{no}}<br />
| 109,813,128<br />
|-<br />
| 1.0.0<br />
| Heavenly 1A543a<br />
| 03.11.02_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]<br />
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code><br />
| Initial US shipment.<br />
| {{yes}}<br />
| {{yes}}<br />
| 95,604,348<br />
|-<br />
| 1.0.1<br />
| Heavenly 1C25<br />
| 03.12.06_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]<br />
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| 95,627,958<br />
|-<br />
| 1.0.2<br />
| Heavenly 1C28<br />
| 03.14.08_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]<br />
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| 95,627,324<br />
|-<br />
| 1.1.1<br />
| Snowbird 3A109a<br />
| 04.01.13_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]<br />
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| 159,668,150<br />
|-<br />
| 1.1.2<br />
| Oktoberfest 3B48b<br />
| 04.02.13_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]<br />
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code><br />
| Initial Euro shipment.<br />
| {{yes}}<br />
| {{yes}}<br />
| 167,927,501<br />
|-<br />
| 1.1.3<br />
| Little Bear 4A93<br />
| 04.03.13_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]<br />
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| 169,950,551<br />
|-<br />
| 1.1.4<br />
| Little Bear 4A102<br />
| 04.04.05_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]<br />
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| 169,946,442<br />
|-<br />
| 2.0<br />
| [[Big Bear 5A347 (iPhone)|Big Bear 5A347]]<br />
|rowspan="11"| 04.05.04_G<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]<br />
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code><br />
| <br />
| {{yes}}<br />
|rowspan="11" {{yes|[[BootNeuter]]}}<br />
| 228,768,637<br />
|-<br />
| 2.0.1<br />
| [[Big Bear 5B108 (iPhone)|Big Bear 5B108]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]<br />
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code><br />
| <br />
| {{yes}}<br />
| 254,048,068<br />
|-<br />
| 2.0.2<br />
| [[Big Bear 5C1 (iPhone)|Big Bear 5C1]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]<br />
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code><br />
| <br />
| {{yes}}<br />
| 253,589,000<br />
|-<br />
| 2.1<br />
| [[Sugar Bowl 5F136 (iPhone)|Sugar Bowl 5F136]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]<br />
| <code>353b7745767b85932e14e262e69463620939bdf7</code><br />
| <br />
| {{yes}}<br />
| 242,171,241<br />
|-<br />
| 2.2<br />
| [[Timberline 5G77 (iPhone)|Timberline 5G77]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]<br />
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code><br />
| <br />
| {{yes}}<br />
| 257,576,980<br />
|-<br />
| 2.2.1<br />
| [[SUTimberline 5H11 (iPhone)|SUTimberline 5H11]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]<br />
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code><br />
| <br />
| {{yes}}<br />
| 257,593,705<br />
|-<br />
| 3.0<br />
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]<br />
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code><br />
| <br />
| {{yes}}<br />
| 240,394,111<br />
|-<br />
| 3.0.1<br />
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]<br />
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code><br />
| Hotfix for an SMS exploit.<br />
| {{yes}}<br />
| 240,439,502<br />
|-<br />
| 3.1<br />
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]<br />
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code><br />
|<br />
| {{yes}}<br />
| 252,536,460<br />
|-<br />
| 3.1.2<br />
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]<br />
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code><br />
|<br />
| {{yes}}<br />
| 252,515,888<br />
|-<br />
| 3.1.3<br />
| [[SUNorthstarTwo 7E18 (iPhone)|SUNorthstarTwo 7E18]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7481.20100202.4orot/iPhone1,1_3.1.3_7E18_Restore.ipsw iPhone1,1_3.1.3_7E18_Restore.ipsw]<br />
| <code>eab23a7f8d2a17cb71046c50fc5f67ec390a3c2b</code><br />
|<br />
| {{yes}}<br />
| 238,319,275<br />
|}<br />
<br />
===[[N82ap|iPhone 3G]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="120"| Build<br />
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]<br />
!width="210"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="140"| Comments<br />
!width="99"| Publicly available virgin [[jailbreak]]?<br />
!width="90"| Publicly available virgin [[unlock]]?<br />
!width="70"| File Size<br />
|-<br />
| 2.0<br />
| [[Big Bear 5A345 (iPhone 3G)|Big Bear 5A345]]<br />
|rowspan="2" | [[1.45.00]]<br />
| No download available<br />
|<br />
| Initial shipment.<br />
| {{yes}}<br />
|rowspan="5" {{partial|Upgrade to 2.2}}<br />
| <br />
|-<br />
| 2.0<br />
| [[Big Bear 5A347 (iPhone 3G)|Big Bear 5A347]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]<br />
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code><br />
| <br />
| {{yes}}<br />
| 235,957,125<br />
|-<br />
| 2.0.1<br />
| [[Big Bear 5B108 (iPhone 3G)|Big Bear 5B108]]<br />
| [[1.48.02]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]<br />
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code><br />
| <br />
| {{yes}}<br />
| 261,224,227<br />
|-<br />
| 2.0.2<br />
| [[Big Bear 5C1 (iPhone 3G)|Big Bear 5C1]]<br />
| [[2.08.01]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]<br />
| <code>bef7fef954293046420fbcf947379839178a195b</code><br />
| <br />
| {{yes}}<br />
| 260,761,030<br />
|-<br />
| 2.1<br />
| [[Sugar Bowl 5F136 (iPhone 3G)|Sugar Bowl 5F136]]<br />
| [[2.11.07]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]<br />
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code><br />
| <br />
| {{yes}}<br />
| 249,341,655<br />
|-<br />
| 2.2<br />
| [[Timberline 5G77 (iPhone 3G)|Timberline 5G77]]<br />
| [[2.28.00]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]<br />
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code><br />
| <br />
| {{yes}}<br />
| {{yes|[[Ultrasn0w|yellowsn0w]]}}<br />
| 258,342,348<br />
|-<br />
| 2.2.1<br />
| [[SUTimberline 5H11 (iPhone 3G)|SUTimberline 5H11]]<br />
| [[2.30.03]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]<br />
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code><br />
| <br />
| {{yes}}<br />
| {{partial|Upgrade to 3.0}}<br />
| 258,359,073<br />
|-<br />
| 3.0<br />
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]<br />
|rowspan="2" | [[4.26.08]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]<br />
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code><br />
| <br />
| {{yes}}<br />
|rowspan="2" {{yes|[[ultrasn0w]]}}<br />
| 241,229,233<br />
|-<br />
| 3.0.1<br />
| [[Kirkwood 7A400 (iPhone 3G)|Kirkwood 7A400]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]<br />
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code><br />
| Hotfix for an SMS exploit.<br />
| {{yes}}<br />
| 241,274,617<br />
|-<br />
| 3.1<br />
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]<br />
|rowspan="2" | [[5.11.07]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]<br />
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code><br />
| <br />
| {{yes}}<br />
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}<br />
| 253,361,339<br />
|-<br />
| 3.1.2<br />
| [[Northstar 7D11 (iPhone 3G)|Northstar 7D11]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]<br />
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code><br />
|<br />
| {{yes}}<br />
| 253,340,786<br />
|-<br />
| 3.1.3<br />
| [[SUNorthstarTwo 7E18 (iPhone 3G)|SUNorthstarTwo 7E18]]<br />
| [[5.12.01]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7468.20100202.pbnrt/iPhone1,2_3.1.3_7E18_Restore.ipsw iPhone1,2_3.1.3_7E18_Restore.ipsw]<br />
| <code>f5950afca546f93e281ba3cdb08bc0cfed7f0896</code><br />
|<br />
| {{yes}}<br />
| {{yes|[[ultrasn0w]]}}<br />
| 239,139,281<br />
|-<br />
| 4.0<br />
| [[Apex 8A293 (iPhone 3G)|Apex 8A293]]<br />
|rowspan="3" | [[5.13.04]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7436.20100621.58Yt4/iPhone1,2_4.0_8A293_Restore.ipsw iPhone1,2_4.0_8A293_Restore.ipsw]<br />
| <code>ee1eba9281b902d7ff3f24d50f9aebff0df27f92</code><br />
|<br />
| {{yes}}<br />
|rowspan="3" {{yes|[[ultrasn0w]]}}<br />
| 306,274,631<br />
|-<br />
| 4.0.1<br />
| [[Apex 8A306 (iPhone 3G)|Apex 8A306]]<br />
| [http://appldnld.apple.com/iPhone4/061-8616.20100715.phnt4/iPhone1,2_4.0.1_8A306_Restore.ipsw iPhone1,2_4.0.1_8A306_Restore.ipsw]<br />
| <code>940bd2b36c646f6673419eab661ac1f13248e592</code><br />
| New formula to calculate bars. Otherwise, it's the same as 4.0.<br />
| {{yes}}<br />
| 320,237,975<br />
|-<br />
| 4.0.2<br />
| [[Apex 8A400 (iPhone 3G)|Apex 8A400]]<br />
| [http://appldnld.apple.com/iPhone4/061-8802.20100811.XcfpR/iPhone1,2_4.0.2_8A400_Restore.ipsw iPhone1,2_4.0.2_8A400_Restore.ipsw]<br />
| <code>ee2bc74719170a7a2440b593b6f300727c930c69</code><br />
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.<br />
| {{yes}}<br />
| 320,216,794<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPhone 3G)|Baker 8B117]]<br />
| [[5.14.02]]<br />
| [http://appldnld.apple.com/iPhone4/061-7932.20100908.3fgt5/iPhone1,2_4.1_8B117_Restore.ipsw iPhone1,2_4.1_8B117_Restore.ipsw]<br />
|<code>d87bab469dd1146ab83ddcc23f03b3164d7e09d4</code><br />
| <br />
| {{Yes}}<br />
| {{partial|Upgrade baseband to [[6.15.00]]}}<br />
| 323,137,556<br />
|-<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPhone 3G)|Jasper 8C148]]<br />
| [[5.15.04]]<br />
| [http://appldnld.apple.com/iPhone4/061-9853.20101122.Vfgt5/iPhone1,2_4.2.1_8C148_Restore.ipsw iPhone1,2_4.2.1_8C148_Restore.ipsw]<br />
|<code>d2ed58586e8ca2153f2e2ec585bba8afc5173378</code><br />
| <br />
| {{Yes}}<br />
| {{partial|Upgrade baseband to [[6.15.00]]}}<br />
| 338,579,762<br />
|-<br />
|}<br />
<br />
===[[N88ap|iPhone 3GS]]===<br />
Units with the new bootrom began shipping around September 2009.<br />
<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="120"| Build<br />
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]<br />
!width="210"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="140"| Comments<br />
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3|old bootrom]])<br />
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3.2|new bootrom]])<br />
!width="80"| Publicly available virgin [[unlock]]?<br />
!width="70"| File Size<br />
|-<br />
| 3.0<br />
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]<br />
|rowspan="2" | [[4.26.08]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw] <br />
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code><br />
| Initial shipment.<br />
| {{yes}}<br />
|rowspan="2" {{no|[[SHSH]]s unavailable at release}}<br />
|rowspan="2" {{yes|[[ultrasn0w]]}}<br />
| 312,292,933<br />
|-<br />
| 3.0.1<br />
| [[Kirkwood 7A400 (iPhone_3GS)|Kirkwood 7A400]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]<br />
| <code>30006575af931e3da0521febace005152cdb8853</code><br />
| Hotfix for an SMS exploit.<br />
| {{yes}}<br />
| 312,330,244<br />
|-<br />
| 3.1b<br />
| [[Sierra 7C108b]]<br />
| Unknown<br />
| Not available to public<br />
| Unknown<br />
| Used for testing.<br />
| {{no}}<br />
| {{no}}<br />
| {{no}}<br />
|<br />
|-<br />
| 3.1<br />
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]<br />
|rowspan="2" | [[5.11.07]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]<br />
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code><br />
| <br />
| {{yes}}<br />
| {{yes|Yes<sup>1</sup>}}<br />
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}<br />
| 321,011,474<br />
|-<br />
| 3.1.2<br />
| [[Northstar 7D11 (iPhone 3GS)|Northstar 7D11]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]<br />
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code><br />
|<br />
| {{yes}}<br />
| {{yes}}<br />
| 321,015,700<br />
|-<br />
| 3.1.3<br />
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|SUNorthstarTwo 7E18]]<br />
| [[5.12.01]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7472.20100202.8tugj/iPhone2,1_3.1.3_7E18_Restore.ipsw iPhone2,1_3.1.3_7E18_Restore.ipsw]<br />
| <code>8cb3775e62c6f72059a962bf891b4e145b965052</code><br />
|<br />
| {{yes}}<br />
| {{yes}}<br />
| {{yes|[[ultrasn0w]]}}<br />
| 305,122,343<br />
|-<br />
| 4.0<br />
| [[Apex 8A293 (iPhone 3GS)|Apex 8A293]]<br />
|rowspan="3" | [[5.13.04]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7437.20100621.5urG8/iPhone2,1_4.0_8A293_Restore.ipsw iPhone2,1_4.0_8A293_Restore.ipsw]<br />
| <code>e065245874c73510ceb8fa4bd9388b60d46eb252</code><br />
|<br />
| {{yes}}<br />
| {{yes}}<br />
|rowspan="3" {{yes|[[ultrasn0w]]}}<br />
| 396,281,280<br />
|-<br />
| 4.0.1<br />
| [[Apex 8A306 (iPhone 3GS)‎|Apex 8A306]]<br />
| [http://appldnld.apple.com/iPhone4/061-8618.20100715.Zapn4/iPhone2,1_4.0.1_8A306_Restore.ipsw iPhone2,1_4.0.1_8A306_Restore.ipsw]<br />
| <code>c2b6fb9a158547ce726baa1bf8f0558a71518fec</code><br />
| New formula to calculate bars. Otherwise, it's the same as 4.0.<br />
| {{yes}}<br />
| {{yes}}<br />
| 396,322,891<br />
|-<br />
| 4.0.2<br />
| [[Apex 8A400 (iPhone 3GS)|Apex 8A400]]<br />
| [http://appldnld.apple.com/iPhone4/061-8805.20100811.Dcr4e/iPhone2,1_4.0.2_8A400_Restore.ipsw iPhone2,1_4.0.2_8A400_Restore.ipsw]<br />
| <code>61d21363ced6e006cc226f9a0a0e9c6ed8e048ab</code><br />
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.<br />
| {{yes}}<br />
| {{yes}}<br />
| 396,310,640<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPhone 3GS)|Baker 8B117]]<br />
| [[5.14.02]]<br />
| [http://appldnld.apple.com/iPhone4/061-7938.20100908.F3rCk/iPhone2,1_4.1_8B117_Restore.ipsw iPhone2,1_4.1_8B117_Restore.ipsw]<br />
|<code>2d1657cd33ae23b8d4e79e41fe758d09d3c52e30</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| {{partial|Upgrade baseband to [[6.15.00]]}}<br />
| 400,572,133<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148a (iPhone 3GS)|Jasper 8C148a]]<br />
| [[5.15.04]]<br />
| [http://appldnld.apple.com/iPhone4/061-9895.20101122.Cdew2/iPhone2,1_4.2.1_8C148a_Restore.ipsw iPhone2,1_4.2.1_8C148a_Restore.ipsw]<br />
| <code>2787bb9fbf18594279d05682e6fd16d2b9612a2a</code><br />
| <br />
| {{yes}}<br />
| {{yes|Yes<sup>1</sup>}}<br />
| {{partial|Upgrade baseband to [[6.15.00]]}}<br />
| 420,813,164<br />
|}<br />
<sup>1</sup> [[Tethered jailbreak]] only.<br />
<br />
===[[N90ap|iPhone 4]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="120"| Build<br />
!width="70"| [[XMM 6180#Known Firmware Versions|Baseband]]<br />
!width="40"| [[IBoot (Bootloader)|iBoot]]<br />
!width="210"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="140"| Comments<br />
!width="95"| Publicly available virgin [[jailbreak]]?<br />
!width="95"| Publicly available virgin [[unlock]]?<br />
!width="70"| File Size<br />
|-<br />
| Inf1<br />
| [[Inferno 8A2062a]]<br />
| Unknown<br />
| ?<br />
| Not available to public<br />
| Unknown<br />
| Used for testing.<br />
| {{no}}<br />
| {{no}}<br />
| Unknown<br />
|-<br />
| 4.0<br />
| [[Apex 8A293 (iPhone 4)|Apex 8A293]]<br />
|rowspan="3" | [[1.59.00]]<br />
| ?<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7380.20100621,Vfgb5/iPhone3,1_4.0_8A293_Restore.ipsw iPhone3,1_4.0_8A293_Restore.ipsw]<br />
| <code>171c2a3995fa149f2a369ccd87f82c5c30da3f88</code><br />
| Initial shipment.<br />
| {{yes}}<br />
|rowspan="3" {{Yes|[[ultrasn0w]]}}<br />
| 607,363,121<br />
|-<br />
| 4.0.1<br />
| [[Apex 8A306 (iPhone 4)|Apex 8A306]]<br />
| ?<br />
| [http://appldnld.apple.com/iPhone4/061-8619.20100715.4Pnsx/iPhone3,1_4.0.1_8A306_Restore.ipsw iPhone3,1_4.0.1_8A306_Restore.ipsw]<br />
| <code>a9cf20679273b7e502ab384854ba96cc2a54d532</code><br />
| New formula to calculate bars. Otherwise, it's the same as 4.0.<br />
| {{yes}}<br />
| 607,380,127<br />
|-<br />
| 4.0.2<br />
| [[Apex 8A400 (iPhone 4)|Apex 8A400]]<br />
| ?<br />
| [http://appldnld.apple.com/iPhone4/061-8807.20100811.3Edre/iPhone3,1_4.0.2_8A400_Restore.ipsw iPhone3,1_4.0.2_8A400_Restore.ipsw]<br />
| <code>19eb071cdb9f1601b106825d0a16b1449c6eef8c</code><br />
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.<br />
| {{yes}}<br />
| 607,375,880<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPhone 4)|Baker 8B117]]<br />
| [[2.10.04]]<br />
| [[IBoot-931.18.27|931.18.27]]<br />
| [http://appldnld.apple.com/iPhone4/061-7939.20100908.Lcyg3/iPhone3,1_4.1_8B117_Restore.ipsw iPhone3,1_4.1_8B117_Restore.ipsw]<br />
|<code>a3f8a333ca181146b862ca6a59c9a6e7c27eba0b</code><br />
|<br />
| {{yes}}<br />
| {{No}}<br />
| 618,501,195<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPhone 4)|Jasper 8C148]]<br />
| [[3.10.01]]<br />
| <br />
| [http://appldnld.apple.com/iPhone4/061-9858.20101122.Er456/iPhone3,1_4.2.1_8C148_Restore.ipsw iPhone3,1_4.2.1_8C148_Restore.ipsw]<br />
|<code>366b28e9c95936bd4b11a84d54fefaf079fd6411</code><br />
|<br />
| {{yes|Yes<sup>1</sup>}}<br />
| {{No}}<br />
| 654,550,096<br />
|}<br />
<sup>1</sup> [[Tethered jailbreak]] only.<br />
<br />
===[[N45ap|iPod touch (1st generation)]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="168"| Build<br />
!width="200"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="150"| Comments<br />
!width="100"| Publicly available virgin [[jailbreak]]?<br />
!width="70"| File Size<br />
|-<br />
| 1.1<br />
| Snowbird 3A100a<br />
| No download available<br />
|<br />
| Initial shipment.<br />
| {{no}}<br />
|<br />
|-<br />
| 1.1<br />
| Snowbird 3A101a<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]<br />
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code><br />
|<br />
| {{no}}<br />
| 157,890,186<br />
|-<br />
| 1.1.1<br />
| Snowbird 3A110a<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]<br />
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code><br />
|<br />
| {{yes}}<br />
| 157,906,686<br />
|-<br />
| 1.1.2<br />
| Oktoberfest 3B48b<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]<br />
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code><br />
|<br />
| {{yes}}<br />
| 165,567,897<br />
|-<br />
| 1.1.3<br />
| Little Bear 4A93<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]<br />
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code><br />
|<br />
| {{yes}}<br />
| 173,511,411<br />
|-<br />
| 1.1.4<br />
| Little Bear 4A102<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]<br />
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code><br />
| <br />
| {{yes}}<br />
| 173,519,589<br />
|-<br />
| 1.1.5<br />
| Little Bear 4B1<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]<br />
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code><br />
|<br />
| {{yes}}<br />
| 173,519,637<br />
|-<br />
| 2.0<br />
| [[Big Bear 5A347 (iPod touch 1G)|Big Bear 5A347]]<br />
| Download Link Prohibited<br />
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code><br />
| 2.0+ is a paid upgrade series<br />
| {{yes}}<br />
| 233,409,573<br />
|-<br />
| 2.0.1<br />
| [[Big Bear 5B108 (iPod touch 1G)|Big Bear 5B108]]<br />
| Download Link Prohibited<br />
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code><br />
| <br />
| {{yes}}<br />
| 258,660,321<br />
|-<br />
| 2.0.2<br />
| [[Big Bear 5C1 (iPod touch 1G)|Big Bear 5C1]]<br />
| Download Link Prohibited<br />
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code><br />
| <br />
| {{yes}}<br />
| 258,201,218<br />
|-<br />
| 2.1<br />
| [[Sugar Bowl 5F137 (iPod touch 1G)|Sugar Bowl 5F137]]<br />
| Download Link Prohibited<br />
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code><br />
| <br />
| {{yes}}<br />
| 251,155,156<br />
|-<br />
| 2.2<br />
| [[Timberline 5G77 (iPod touch 1G)|Timberline 5G77]]<br />
| Download Link Prohibited<br />
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code><br />
| <br />
| {{yes}}<br />
| 260,186,851<br />
|-<br />
| 2.2.1<br />
| [[SUTimberline 5H11 (iPod touch 1G)|SUTimberline 5H11]]<br />
| Download Link Prohibited<br />
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code><br />
| <br />
| {{yes}}<br />
| 260,166,688<br />
|-<br />
| 3.0<br />
| [[Kirkwood 7A341 (iPod touch 1G)|Kirkwood 7A341]]<br />
| Download Link Prohibited<br />
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code><br />
| 3.0+ is a paid upgrade series<br />
| {{yes}}<br />
| 242,458,552<br />
|-<br />
| 3.1.1<br />
| [[Northstar 7C145 (iPod touch 1G)|Northstar 7C145]]<br />
| Download Link Prohibited<br />
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code><br />
| <br />
| {{yes}}<br />
| 249,755,862<br />
|-<br />
| 3.1.2<br />
| [[Northstar 7D11 (iPod touch 1G)|Northstar 7D11]]<br />
| Download Link Prohibited<br />
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code><br />
| <br />
| {{yes}} <br />
| 249,780,497<br />
|-<br />
| 3.1.3<br />
| [[SUNorthstarTwo 7E18 (iPod touch 1G)|SUNorthstarTwo 7E18]]<br />
| Download Link Prohibited<br />
| <code>5f897990f19d2f093b35e0813d7d77806404fb1f</code><br />
|<br />
| {{yes}}<br />
| 235,678,189<br />
|}<br />
<br />
===[[N72ap|iPod touch (2nd generation)]]===<br />
Units with the new bootrom have model numbers that start with "MC."<br />
<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="168"| Build<br />
!width="200"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="150"| Comments<br />
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.4|old bootrom]])<br />
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.5.1|new bootrom]])<br />
!width="70"| File Size<br />
|-<br />
| 2.1.1<br />
| [[Sugar Bowl 5F138 (iPod touch 2G)|Sugar Bowl 5F138]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]<br />
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code><br />
| Initial shipment.<br />
| {{yes|Yes<sup>1</sup>}}<br />
|rowspan="4" {{no|Incompatible device/<br />
firmware match}}<br />
| 282,083,944<br />
|-<br />
| 2.2<br />
| [[Timberline 5G77a (iPod touch 2G)|Timberline 5G77a]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]<br />
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code><br />
|<br />
| {{no}}<br />
| 291,123,491<br />
|-<br />
| 2.2.1<br />
| [[SUTimberline 5H11a (iPod touch 2G)|SUTimberline 5H11a]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]<br />
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code><br />
|<br />
| {{yes}}<br />
| 291,140,244<br />
|-<br />
| 3.0<br />
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]<br />
| Download Link Prohibited<br />
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code><br />
| 3.x is a paid upgrade series<br />
| {{yes}}<br />
| 270,315,364<br />
|-<br />
| 3.1.1<br />
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]<br />
| Download Link Prohibited<br />
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code><br />
| Initial shipment for units with the new bootrom.<br />
| {{yes}}<br />
| {{yes|Yes<sup>1</sup>}}<br />
| 277,753,989<br />
|-<br />
| 3.1.2<br />
| [[Northstar 7D11 (iPod touch 2G)|Northstar 7D11]]<br />
| Download Link Prohibited<br />
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code><br />
| <br />
| {{yes}}<br />
| {{yes}}<br />
| 277,794,671<br />
|-<br />
| 3.1.3<br />
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|SUNorthstarTwo 7E18]]<br />
| Download Link Prohibited<br />
| <code>5f4f5c01eda2f811f73167e7d1f82dbeed82367b</code><br />
|<br />
| {{yes}}<br />
| {{yes}}<br />
| 263,275,211<br />
|-<br />
| 4.0<br />
| [[Apex 8A293 (iPod touch 2G)|Apex 8A293]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7435.20100621.tr49t/iPod2,1_4.0_8A293_Restore.ipsw iPod2,1_4.0_8A293_Restore.ipsw]<br />
| <code>c026c373bc535496a6f901de2ba37d4a487413bf</code><br />
|<br />
| {{yes}}<br />
| {{yes}}<br />
| 330,278,777<br />
|-<br />
| 4.0.2<br />
| [[Apex 8A400 (iPod touch 2G)|Apex 8A400]]<br />
| [http://appldnld.apple.com/iPhone4/061-8551.20100811.Xcder/iPod2,1_4.0.2_8A400_Restore.ipsw iPod2,1_4.0.2_8A400_Restore.ipsw]<br />
| <code>06a42297d94461264eb64d7c8640cc5d1c19edeb</code><br />
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.<br />
| {{yes}}<br />
| {{yes|Yes<sup>1</sup>}}<br />
| 344,248,876<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPod touch 2G)|Baker 8B117]]<br />
| [http://appldnld.apple.com/iPhone4/061-7937.20100908.ghj4f/iPod2,1_4.1_8B117_Restore.ipsw iPod2,1_4.1_8B117_Restore.ipsw]<br />
|<code>97abde6207660bd876fd476275dd526d0dcf3d19</code><br />
| <br />
| {{Yes}}<br />
| {{yes}}<br />
| 348,027,174<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPod touch 2G)|Jasper 8C148]]<br />
| [http://appldnld.apple.com/iPhone4/061-9855.20101122.Lrft6/iPod2,1_4.2.1_8C148_Restore.ipsw iPod2,1_4.2.1_8C148_Restore.ipsw]<br />
|<code>b9efddc7bb4350c237a8d3846af61bbfc8a2f647</code><br />
|<br />
| {{yes}}<br />
| {{yes^1}}<br />
|363,553,480<br />
|}<br />
<sup>1</sup> [[Tethered jailbreak]] only.<br />
<br />
===[[N18ap|iPod touch (3rd generation)]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="168"| Build<br />
!width="200"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="150"| Comments<br />
!width="99"| Publicly available virgin [[jailbreak]]?<br />
!width="70"| File Size<br />
|-<br />
| 3.1.1<br />
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]<br />
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code><br />
| Initial shipment.<br />
| {{yes|Yes<sup>1</sup>}}<br />
<br />
| 311,702,789<br />
|-<br />
| 3.1.1<br />
| [[Northstar 7C146 (iPod touch 3G)|Northstar 7C146]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]<br />
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code><br />
| <br />
| {{yes|Yes<sup>1</sup>}}<br />
| 311,690,768<br />
|-<br />
| 3.1.2<br />
| [[Northstar 7D11 (iPod touch 3G)|Northstar 7D11]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]<br />
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code><br />
| <br />
| {{yes}}<br />
| 311,740,034<br />
|-<br />
| 3.1.3<br />
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|SUNorthstarTwo 7E18]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7473.20100202.4i44t/iPod3,1_3.1.3_7E18_Restore.ipsw iPod3,1_3.1.3_7E18_Restore.ipsw]<br />
| <code>375fd469b18bfc0b74c7cfa5b4d5945197b1d106</code><br />
|<br />
| {{yes}}<br />
| 295,870,806<br />
|-<br />
| 4.0<br />
| [[Apex 8A293 (iPod touch 3G)|Apex 8A293]]<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7381.20100621.AzSP9/iPod3,1_4.0_8A293_Restore.ipsw iPod3,1_4.0_8A293_Restore.ipsw]<br />
| <code>36fe02b83f87d6305db572e1644841e3cd64cc7d</code><br />
|<br />
| {{yes}}<br />
| 384,178,784<br />
|-<br />
| 4.0.2<br />
| [[Apex 8A400 (iPod touch 3G)|Apex 8A400]]<br />
| [http://appldnld.apple.com/iPhone4/061-8554.20100811.Bgt54/iPod3,1_4.0.2_8A400_Restore.ipsw iPod3,1_4.0.2_8A400_Restore.ipsw]<br />
| <code>481b21044130125b117d53207f725b70fb061855</code><br />
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.<br />
| {{yes}}<br />
| 384,203,993<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPod touch 3G)|Baker 8B117]]<br />
| [http://appldnld.apple.com/iPhone4/061-7941.20100908.sV9KE/iPod3,1_4.1_8B117_Restore.ipsw iPod3,1_4.1_8B117_Restore.ipsw]<br />
|<code>3162bad4060b7a58c9942ddb483e5bd9bcc5269f</code><br />
| <br />
| {{yes}}<br />
| 388,255,189<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPod touch 3G)|Jasper 8C148]]<br />
| [http://appldnld.apple.com/iPhone4/061-9860.20101122.Xsde3/iPod3,1_4.2.1_8C148_Restore.ipsw iPod3,1_4.2.1_8C148_Restore.ipsw]<br />
|<code>1127a042c535f7cf0be950ff8946862d5fb05b36</code><br />
| <br />
| {{yes|Yes<sup>1</sup>}}<br />
| 408,118,620<br />
|}<br />
<br />
<sup>1</sup> [[Tethered jailbreak]] only.<br />
<br />
===[[N81ap|iPod touch (4th generation)]]===<br />
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
!width="40"| Version<br />
!width="168"| Build<br />
!width="200"| IPSW Download URL<br />
!width="220"| SHA1 Hash<br />
!width="150"| Comments<br />
!width="99"| Publicly available virgin [[jailbreak]]?<br />
!width="70"| File Size<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPod touch 4G)|Baker 8B117]]<br />
| [http://appldnld.apple.com/iPhone4/061-8490.20100901.hyjtR/iPod4,1_4.1_8B117_Restore.ipsw iPod4,1_4.1_8B117_Restore.ipsw]<br />
| <code>a464492bf6ad25d65b378c85d8b181f973ede38a</code><br />
| Initial shipment.<br />
| {{yes}}<br />
| 608,360,672<br />
|-<br />
| 4.1<br />
| [[Baker 8B118 (iPod touch 4G)|Baker 8B118]]<br />
| [http://appldnld.apple.com/iPhone4/061-9344.20100922.Urgt43/iPod4,1_4.1_8B118_Restore.ipsw iPod4,1_4.1_8B118_Restore.ipsw]<br />
| <code>331fb1342f5dab8c04cead74384a1e0fc1145952</code><br />
| <br />
| {{yes}}<br />
| 608,360,927<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPod touch 4G)|Jasper 8C148]]<br />
| [http://appldnld.apple.com/iPhone4/061-9859.20101122.$erft/iPod4,1_4.2.1_8C148_Restore.ipsw iPod4,1_4.2.1_8C148_Restore.ipsw]<br />
| <code>6a890696126d0cb7f9ccd6b913ecb09cf2029820</code><br />
| <br />
| {{yes|Yes<sup>1</sup>}}<br />
|638,177,119<br />
|}<br />
<br />
<sup>1</sup> [[Tethered jailbreak]] only.<br />
<br />
==See also==<br />
* [[VFDecrypt]]<br />
* [[VFDecrypt Keys]]<br />
<br />
==Resources==<br />
*[http://www.trejan.com/projects/ipod/ Firmware List]<br />
*[http://itunes.com/version Apple Firmware XML]</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:06.15.00&diff=13850Talk:06.15.002010-11-30T18:00:36Z<p>Leobruh: /* Install check */</p>
<hr />
<div>This has to be the best AppleFail yet, being able to use this on 3G/3GS... [[User:Iemit737|Iemit737]] 01:56, 29 November 2010 (UTC)<br />
<br />
== Install check ==<br />
<br />
Why can this be installed on iPhone? I thought as of iOS4.2.1 there's a check for the bb version that must match the firmware. If a wrong (in this case higher) bb version is installed, then iOS doesn't boot. Or why does it boot now? And why can an old baseband be installed at all? Because the version number is higher and before iPhone 4 there was no certificate check? --[[User:Http|http]] 00:16, 30 November 2010 (UTC)<br />
:The sig check for the baseband only determines if the baseband firmware is lower than what it should correspond to the iOS firmware then it prevents a successful boot sequence. However since the 3G/3GS use the X-Gold 608 chip it can be flashed to a higher Modem Firmware. By doing so it uses the chips own programming to be exploited using the recycled AT+XAPP injection vector. This however could easily be patched. Now that I answered your question maybe you can help me with this one. Since the iPad has no lock in the baseband why is Ultrasn0w even needed? [[User:Leobruh|Leobruh]] 03:57, 30 November 2010 (UTC)!<br />
::The unlock status doesn't reside in the baseband firmware; it's in the [[seczone]]. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 04:24, 30 November 2010 (UTC)<br />
<br />
::So the baseband version check does not check for correct firmware version; it checks for "lower than correct" version. #epicfail --[[User:Http|http]] 08:57, 30 November 2010 (UTC)<br />
<br />
::@Dialexio, so you still have to patch running memory with Ultrasn0w for the on-the-fly ram unlock?<br />
@http, fail in it's biggest form. who knows how long we can use AT+XAPP. [[User:Leobruh|Leobruh]] 11:15, 30 November 2010 (UTC)!<br />
<br />
Someone needs to write a baseband downgrader with this to allow normal restores again. And what really needs to be done is a bootloader downgrader, 5.8 FTW [[User:Geohot|geohot]] 16:41, 30 November 2010 (UTC)<br />
:in the [[25C3_presentation_Hacking_the_iPhone]] [[User:MuscleNerd|MuscleNerd]] did say that the [[N82ap|iphone 3]]g has [[fakeblank]] but it uses a hash to verify the [[Baseband_Bootloader|bootloader]] and [[Fuzzyband_Downgrader]] does a good [[Baseband_Firmware]] downgrade --[[User:Liamchat|liamchat]] 17:08, 30 November 2010 (UTC)<br />
<br />
@geohot, would the 5.8BL downgrade work on the 3GS because it uses X-Gold 5.8? but doesnt the bootloader get checked everytime by the baseband and vice-versa? another exploit like the one for the 3.6/4.9 for the 2G would be needed correct? [[User:Leobruh|Leobruh]] 17:59, 30 November 2010 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:06.15.00&diff=13849Talk:06.15.002010-11-30T17:59:47Z<p>Leobruh: /* Install check */</p>
<hr />
<div>This has to be the best AppleFail yet, being able to use this on 3G/3GS... [[User:Iemit737|Iemit737]] 01:56, 29 November 2010 (UTC)<br />
<br />
== Install check ==<br />
<br />
Why can this be installed on iPhone? I thought as of iOS4.2.1 there's a check for the bb version that must match the firmware. If a wrong (in this case higher) bb version is installed, then iOS doesn't boot. Or why does it boot now? And why can an old baseband be installed at all? Because the version number is higher and before iPhone 4 there was no certificate check? --[[User:Http|http]] 00:16, 30 November 2010 (UTC)<br />
:The sig check for the baseband only determines if the baseband firmware is lower than what it should correspond to the iOS firmware then it prevents a successful boot sequence. However since the 3G/3GS use the X-Gold 608 chip it can be flashed to a higher Modem Firmware. By doing so it uses the chips own programming to be exploited using the recycled AT+XAPP injection vector. This however could easily be patched. Now that I answered your question maybe you can help me with this one. Since the iPad has no lock in the baseband why is Ultrasn0w even needed? [[User:Leobruh|Leobruh]] 03:57, 30 November 2010 (UTC)!<br />
::The unlock status doesn't reside in the baseband firmware; it's in the [[seczone]]. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 04:24, 30 November 2010 (UTC)<br />
<br />
::So the baseband version check does not check for correct firmware version; it checks for "lower than correct" version. #epicfail --[[User:Http|http]] 08:57, 30 November 2010 (UTC)<br />
<br />
::@Dialexio, so you still have to patch running memory with Ultrasn0w for the on-the-fly ram unlock?<br />
@http, fail in it's biggest form. who knows how long we can use AT+XAPP. [[User:Leobruh|Leobruh]] 11:15, 30 November 2010 (UTC)!<br />
<br />
Someone needs to write a baseband downgrader with this to allow normal restores again. And what really needs to be done is a bootloader downgrader, 5.8 FTW [[User:Geohot|geohot]] 16:41, 30 November 2010 (UTC)<br />
:in the [[25C3_presentation_Hacking_the_iPhone]] [[User:MuscleNerd|MuscleNerd]] did say that the [[N82ap|iphone 3]]g has [[fakeblank]] but it uses a hash to verify the [[Baseband_Bootloader|bootloader]] and [[Fuzzyband_Downgrader]] does a good [[Baseband_Firmware]] downgrade --[[User:Liamchat|liamchat]] 17:08, 30 November 2010 (UTC)<br />
<br />
@geohot, would the 5.8BL downgrade work on the 3GS because it uses X-Gold 5.8? but doesnt the bootloader get checked everytime by the baseband and vice-versa? another exploit like the one for the 3.8/4.9 for the 2G would be needed correct? [[User:Leobruh|Leobruh]] 17:59, 30 November 2010 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:06.15.00&diff=13834Talk:06.15.002010-11-30T11:15:59Z<p>Leobruh: </p>
<hr />
<div>This has to be the best AppleFail yet, being able to use this on 3G/3GS... [[User:Iemit737|Iemit737]] 01:56, 29 November 2010 (UTC)<br />
<br />
== Install check ==<br />
<br />
Why can this be installed on iPhone? I thought as of iOS4.2.1 there's a check for the bb version that must match the firmware. If a wrong (in this case higher) bb version is installed, then iOS doesn't boot. Or why does it boot now? And why can an old baseband be installed at all? Because the version number is higher and before iPhone 4 there was no certificate check? --[[User:Http|http]] 00:16, 30 November 2010 (UTC)<br />
:The sig check for the baseband only determines if the baseband firmware is lower than what it should correspond to the iOS firmware then it prevents a successful boot sequence. However since the 3G/3GS use the X-Gold 608 chip it can be flashed to a higher Modem Firmware. By doing so it uses the chips own programming to be exploited using the recycled AT+XAPP injection vector. This however could easily be patched. Now that I answered your question maybe you can help me with this one. Since the iPad has no lock in the baseband why is Ultrasn0w even needed? [[User:Leobruh|Leobruh]] 03:57, 30 November 2010 (UTC)!<br />
::The unlock status doesn't reside in the baseband firmware; it's in the [[seczone]]. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 04:24, 30 November 2010 (UTC)<br />
<br />
::So the baseband version check does not check for correct firmware version; it checks for "lower than correct" version. #epicfail --[[User:Http|http]] 08:57, 30 November 2010 (UTC)<br />
<br />
::@Dialexio, so you still have to patch running memory with Ultrasn0w for the on-the-fly ram unlock?<br />
@http, fail in it's biggest form. who knows how long we can use AT+XAPP. [[User:Leobruh|Leobruh]] 11:15, 30 November 2010 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:06.15.00&diff=13823Talk:06.15.002010-11-30T03:57:25Z<p>Leobruh: </p>
<hr />
<div>This has to be the best AppleFail yet, being able to use this on 3G/3GS... [[User:Iemit737|Iemit737]] 01:56, 29 November 2010 (UTC)<br />
<br />
== Install check ==<br />
<br />
Why can this be installed on iPhone? I thought as of iOS4.2.1 there's a check for the bb version that must match the firmware. If a wrong (in this case higher) bb version is installed, then iOS doesn't boot. Or why does it boot now? And why can an old baseband be installed at all? Because the version number is higher and before iPhone 4 there was no certificate check? --[[User:Http|http]] 00:16, 30 November 2010 (UTC)<br />
<br />
The sig check for the baseband only determines if the baseband firmware is lower than what it should correspond to the iOS firmware then it prevents a successful boot sequence. However since the 3G/3GS use the X-Gold 608 chip it can be flashed to a higher Modem Firmware. By doing so it uses the chips own programming to be exploited using the recycled AT+XAPP injection vector. This however could easily be patched. Now that I answered your question maybe you can help me with this one. Since the iPad has no lock in the baseband why is Ultrasn0w even needed? [[User:Leobruh|Leobruh]] 03:57, 30 November 2010 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User_talk:Ifish&diff=13062User talk:Ifish2010-11-18T10:51:20Z<p>Leobruh: New page: lacrosse pwns diving. diving is pretty chill though. Our lives are bro.</p>
<hr />
<div>lacrosse pwns diving. diving is pretty chill though. Our lives are bro.</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=F0recast&diff=12589F0recast2010-11-08T19:38:54Z<p>Leobruh: /* iPhone */ refurbished was spelled wrong</p>
<hr />
<div>{{DISPLAYTITLE:f0recast}}<br />
== What is f0recast? ==<br />
An application created by [[User:ih8sn0w|iH8sn0w]]. He created a simple application that uses Manzana to tap into [[MobileDevice Library]] inside of: C:\Program Files\Common Files\Apple\Mobile Device Support\bin\iTunesMobileDevice.dll<br />
<br />
'''It grabs these functions when an iDevice is connected:'''<br />
* Serial #<br />
* [[Baseband Firmware|Baseband]]<br />
* Bootloader Version<br />
* Model<br />
* ProductType<br />
<br />
== How does it determine if its [[unlock]]able? ==<br />
When f0recast grabs the [[Baseband Firmware|baseband]] version, it checks the version against a built-in database to determine whether it is [[unlock]]able or not.<br />
<br />
== How does it determine if it's restricted to a [[tethered jailbreak]]? ==<br />
===[[iPhone]]===<br />
* When the iPhone is inserted, it first checks to see the Product type. If any device but an [[N88ap|iPhone 3GS]] is connected, it is immediately determined to be untethered. It checks the 3rd, 4th & 5th digit of the Serial #. <br />
* If the 3 digits are below 940, it is determined to be untethered. If it is above, then it tells the owner that it could be tethered. <br />
*(f0recast cannot fully tell you whether it is a [[tethered jailbreak]] because tons of refurbished models still contain the [[iBoot-359.3|old bootrom]].<br />
* The only way of determining if it's limited to a [[tethered jailbreak]] is entering [[DFU Mode]] to check the [[bootrom]] version. If it contains (.2) at the end (e.g [[iBoot-359.3.2]] = Tethered). f0recast doesn't implement this is because LibUSB is required to check this.<br />
* The reason LibUSB is not a smart decision is because it would cause an issue with 64-bit editions of Windows. Therefore, it can only tell you if it is [[untethered]] or if it may be tethered.<br />
<br />
===[[iPod touch]]===<br />
* When the iPod touch is connected, f0recast only focuses on the model. If it sees that the model is either MA/MB/PB, then it will be untethered. If it is anything above, such as: MC/PC, then it will be tethered.<br />
<br />
== License ==<br />
f0recast is freeware.<br />
<br />
== Resources ==<br />
[http://ih8sn0w.com/index.php/products/view/f0recast.snow Download f0recast]<br />
<br />
[http://www.github.com/sn0wra1n/F0retell-Reb0rn Open-Source Alternative to f0recast]</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:Limera1n&diff=10777Talk:Limera1n2010-10-19T20:20:13Z<p>Leobruh: /* He did it */</p>
<hr />
<div>== Drop size on image == <br />
Has anyone else noticed that on the picture, the lime raindrop us bigger than the rest of them? Could be nothing but could also mean that [[User:Geohot|geohot]] has worked out [[SHAtter]] and use it on the three A4 devices that are there and just used the photos app for the [[N88ap|3GS]].<br />
Also (if it's real) why is [[User:Geohot|Geohots]] exploit not used and keep [[SHAtter]] for when there are more A4 devices around? --[[User:Shengis14|Shengis14]] 07:16, 9 October 2010 (UTC)<br />
:I did see that and assume it's just the same image everywhere, but on retina display it's just smaller due to higher resolution. --[[User:Http|http]] 09:00, 9 October 2010 (UTC)<br />
::I also saw that and would ask you to look at the image again. iPod Touch 4g and iPhone 4, both retina, have smaller... This could be because [[geohot]] has a problem with the program as he didn't create a @2x.png image... I believe this is a true jailbreK. [[User:Balloonhead66|Balloonhead66]] 13:57, 9 October 2010 (UTC)<br />
:::In the dump, I found the lime drop and it is a 320x480 image. Therfore, when you jailbreak a retina device with a 320x480 it shrinks the image because there is no lime@2x.png file...<br />
<br />
== Misc. ==<br />
I think some more info may be needed. What is some background on it? I thought Limera1n was a fake from the 3.x days? --[[User:OMEGA RAZER|OMEGA RAZER]] 22:09, 8 October 2010 (UTC<br />
:It was never fake see [http://theiphonewiki.com/limera1n http://theiphonewiki.com/limera1n] (a cached copy). --[[User:GreySyntax|GreySyntax]] 22:45, 8 October 2010 (UTC)<br />
::Thanks for the clarification. Not sure where I heard that. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:09, 8 October 2010 (UTC)<br />
Geohot made the web page when 3.1.3 come out but he said it used a bootrom exploit for untetherdness that he was saving for the iPhone 4 --[[User:Liamchat|liamchat]] 22:53, 8 October 2010 (UTC)<br />
Anything else we should mention? :P --[[User:Dra1nerdrake|dra1nerdrake]] 23:14, 8 October 2010 (UTC)<br />
:Why the insane secrecy of it? I'm not deep in the scene but this is the first I'm hearing more than the name lol. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:18, 8 October 2010 (UTC)<br />
<br />
== Release ==<br />
<br />
I thought geohot had no plans to release it... [[User:Balloonhead66|Balloonhead66]] 23:22, 8 October 2010 (UTC)<br />
:Correct. Read the controversy section of this page. It should answer as to why the sudden change in heart. ~Drake<br />
<br />
== SIGN YOUR COMMENTS ON THE TALK PAGE ==<br />
Please press the button on top of the exit box or type <nowiki>~~~~</nowiki> manually. This will give you the basic signature. It's also acceptable to just identify yourself. Just make sure we know who you are. ;P ~Drake<br />
<br />
== Latest edit to [[Limera1n]] ==<br />
<br />
How does it look like a tethered? -- Balloonhead66|23:34, October 8, 2010 (UTC)<br />
:They're all plugged in with USB cables. --[[User:OMEGA RAZER|OMEGA RAZER]] 23:35, 8 October 2010 (UTC)<br />
::They could just be charging and he is in the photos app -- Balloonhead66|23:41, October 8, 2010 (UTC)<br />
:::I think it's because they need to be plugged in for the ramdisk to be uploaded (hence the logo). --[[User:Palz|Palz]] 21:15, 12 October 2010 (UTC)<br />
<br />
== Who is John Galt? ==<br />
<br />
Look at the HTML source of the page. Is this comment new? [[User:Angelo|Angelo]] 23:42, 8 October 2010 (UTC)<br />
:Yep. I've looked at the source of this page before and after this update. The John Galt is probably meant to throw us off. Geohot does that. :P But, yes, it's new. ~Drake<br />
::Where did you see that? [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)<br />
:::Type in Firefox URL bar: view-source:http://limera1n.com/ [[User:Angelo|Angelo]] 23:47, 8 October 2010 (UTC)<br />
::::Or google chrome for that matter :D . Anyway, I thought you meant the source of this page or the [[Limera1n]] page, not the website... *stupid* Thanks for explaining that! [[User:Balloonhead66|Balloonhead66]] 23:50, 8 October 2010 (UTC)<br />
:::::[http://en.wikipedia.org/wiki/John_Galt Who is John Galt] Kind of funny actually when you read it and what's going on right now --[[User:alpineflip|alpineflip]]<br />
:::::: yes I see why "learns that all of the stories have an element of truth to them." maybe it will ra1n again but not today --[[User:Liamchat|liamchat]] 00:35, 9 October 2010 (UTC)<br />
<br />
== Explanation ==<br />
<br />
So, I'm sure most, if not all, of you are confused. This Limera1n is nothing more than a plot by geohot to get the chronic dev team to incorporate the exploit used in limera1n into greenpois0n. This is not plausible because the exploit in limera1n is a bootrom level exploit, which can be used to make a jailbreak (albeit [[tethered]]) on its own. To make greenpois0n untethered, chronic dev has used a tweak by comex (in userland) to patch the kernel. The exploit in Limera1n can be used at a later date to make another untethered jailbreak, but it's better to leave the lower level exploits until later, after all, either way, it produces the same affect. To implement the limera1n exploit into greenpois0n, they'd have to rewrite the entire jailbreak, which would offset the release. This should clear up confusion. ~Drake<br />
<br />
I reckon it was the iphone dev teams fault if they just had to release spirit after the iphone 4 was released there would be no drama because the ipod touch 4 would hav been jailbroken via star. --[[User:Robinhood|robinhood]] <br />
<br />
I think Geohot told someone about his exploit and apple attempted to patch it in a4 bootrom [http://mobile.twitter.com/musclenerd/status/26801617164] --[[User:Liamchat|liamchat]] 01:54, 9 October 2010 (UTC)<br />
<br />
===UPDATE:===<br />
A [http://twitter.com/#!/p0sixninja/status/26799962302 recent tweet] from iPhone hacker p0sixninja has just confirmed that the date WILL NOT be changed. If they can implement geohot's exploit before 10/10, they will use that. If they can't they won't. --[[User:Dra1nerdrake|dra1nerdrake]] 00:53, 9 October 2010 (UTC)<br />
: This has nothing to-do with Limera1n. -- [[User:Shorty|Shorty]] 01:06, 9 October 2010 (UTC)<br />
::It does. If they can integrate it into GP then there's not going to be a Limera1n. If they can't in time then there will be two jailbreaks released... --[[User:OMEGA RAZER|OMEGA RAZER]] 01:11, 9 October 2010 (UTC)<br />
::: This is a grand waste of a bootrom exploit though. ~Drake<br />
:::: Geohot will not waste the exploit's used in limera1n but greenpois0n is using a bootrom exploit to inject a userland exploit that is odd --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)<br />
:::::Yes it does limera1n will use an untetherd bootrom and iboot exploit but Why does Geohot not want us to use comex's kernel patch just for 4.1 then when 4.2 is out we can use shatter to reuse the iboot exploit --[[User:Liamchat|liamchat]] 01:20, 9 October 2010 (UTC)<br />
::::::@[[User:Dra1nerdrake|dra1nerdrake]] - Sorry if I didn't make myself more clear, I was basically on about the first part, not the last bit. -- [[User:Shorty|Shorty]] 01:25, 9 October 2010 (UTC)<br />
the exploit used by [[limera1n]] is a [[24kPwn]] like [[bootrom]] exploit and a [[IBoot]] exploit ( read the second to last paragraph [http://posixninja.blogspot.com/2010/06/latest-progress-and-new-updates.html] ) --[[User:Liamchat|liamchat]] 12:55, 9 October 2010 (UTC)<br />
<br />
== Image Taken Down ==<br />
<br />
I'm just speculating here. With all this controversy, I am on the edge of believing... Also, the image was taken down from the site... It gives you a bitly link that takes you back to the bitty link... --[[User:Balloonhead66|Balloonhead66]] 14:20, 9 October 2010 (UTC)<br />
<br />
:It is now very real [[greenpois0n]] will be cancelled (said by [[MuscleNerd]] [http://twitter.com/MuscleNerd/status/26860163077 Twitter Status]) and [[Limera1n]] will be used to jailbreak on 4.1 but [[wikipedia:Apple Inc.|Apple]] knows about both exploit's but [[Geohot]]'s has already being patched (patched in 4.2 beta 2 iboot [http://twitter.com/MuscleNerd/status/26860634891]) --[[User:Liamchat|liamchat]] 19:21, 9 October 2010 (UTC)<br />
<br />
::The exploit has not been patched though, but because of the code similarities geohot can tell his exploit will be patched anyway by iPad2,1 so he wants it to be used instead of wasted, greenpois0n and SHAtter should be kept as they will affect a larger crowd of iOS devices (assuming apple continue to use the A4 chip. --[[User:Shengis14|Shengis14]] 19:36, 9 October 2010 (UTC)<br />
<br />
:::[[Geohot]]'s exploit will be used in [[greenpois0n]] if it can be utilised in time. Otherwise both exploits will be burned. In relation to the image being taken down, it was proving to be too popular, so imageshack moved it. --[[User:Mushroom|Mushroom]] 19:47, 9 October 2010 (UTC)<br />
<br />
::::I dont think so we said a lot about [[SHAtter]] (if apple patch one of the three BSS+Heap+Stack the exploit wont work) so it may be to late to protect [[SHAtter]] but [[Geohot]]'s exploit was fixed in [[iBoot]] so [[wikipedia:Apple Inc.|Apple]] knows 100% what his exploit is --[[User:Liamchat|liamchat]] 20:06, 9 October 2010 (UTC)<br />
<br />
== He did it==<br />
It's in the wild. Thoughts? ~Drake<br />
:It's just BETA2 though... --[[User:Balloonhead66|Balloonhead66]] 22:28, 9 October 2010 (UTC)<br />
::Has anyone being able to grab information about the exploit we need to delete shatter and name the new dfu exploit --[[User:Liamchat|liamchat]] 23:22, 9 October 2010 (UTC)<br />
:::BETA2 naming means nothing. We need to delete SHAtter? Wtf? And also this exploit will either be named by Geohot or by it's technical name (like Environment Variable Overflow). [[User:Iemit737|Iemit737]] 00:03, 10 October 2010 (UTC)<br />
::::I'd like to disassemble this and see what's in that exe of his. Anyone take a gander into this magical land of software yet? The payload's bound to be in there somewhere. ~Drake<br />
:::::A dump has been released by ih8sn0w, see links. So much for the protection he put on it. It uses the ramdisk from purplera1n ( lulz). You'll need IDA Pro... [[User:Pwnd-v1|Pwnd-v1]] 13:12, 10 October 2010 (UTC)<br />
::::::Blackra1n uses purpled1sk too :/ All it is is an exploit like arm7_go in DFU that pwns iBoot (temporarily) and applies a userland jailbreak from a ramdisk. --[[User:Palz|Palz]] 22:16, 15 October 2010 (UTC)<br />
the exploit ( it is a heap overflow ) is used to create a command called geohot ( in the [[NOR_%28NVRAM%29]] same as in [[Purplera1n]] ) maybe purpled1sk is the best for the job [[iBoot]] cannot be changed it will remove [[SHSH]] preventing the device from booting --[[User:Liamchat|liamchat]] 22:32, 15 October 2010 (UTC)<br />
:do u hear urself talk? the bootrom exploit in limera1n is not a heap overflow. -__- the heap overflow is the userland exploit used to achieve an untethered status.[[User:Leobruh|Leobruh]] 20:20, 19 October 2010 (UTC)!<br />
<br />
== Pwnage ==<br />
<br />
Does limera1n flash the NOR? I never managed to install a custom firmware after using limera1n.--[[User talk:Ryccardo|Ryccardo]], 11 October 2010 (UTC)<br />
:Sign your posts, please. And, limera1n leaves your NOR untouched. All it does is patch the kernel (which is on your NAND). Theoretically, one might be able to restore to a custom firmware by jumping to a pwned iBSS or iBEC through the limera1n exploit and using that to trick the device into accepting the firmware, but I'm probably mistaken. --[[User:Dra1nerdrake|dra1nerdrake]] 19:28, 11 October 2010 (UTC)<br />
:It leaves the NOR un-touched otherwise the signature checks would fail during boot. Hence the kernel exploit from [[User:comex|comex]] is used to patch the kernel at runtime. --[[User:GreySyntax|GreySyntax]] 19:49, 11 October 2010 (UTC)<br />
::Thanks, [[http://twitter.com/iH8sn0w/statuses/27065535774 iH8Sn0w confirms.]] Sorry for the signature, I always forget to use that button. --[[User:Ryccardo|Ryccardo]] 20:43, 11 October 2010 (UTC)<br />
<br />
== Support ==<br />
<br />
I propose that appleTV should be removed from the supported list until further notice as while the exploit interacts with the bootrom, the ramdisk never executes to jailbreak the OS and leaves you in recovery mode (yet to establish if it is in a pwned state or not) --[[User:Lilstevie|Lilstevie]] 07:29, 12 October 2010 (UTC)<br />
<br />
== Why no ipt2g support? ==<br />
<br />
I have an ipt2g mc model. I currently have no 4.1 jailbreak, since sn0wbreeze is messed up and redsn0w hangs. Why doesn't this exploit work with the new bootrom touches? Have we been forgotten? --[[User:Palz|Palz]] 21:13, 12 October 2010 (UTC)<br />
<br />
:It works for the ipt2g new bootrom, but geohot didn't take his time to remake anything so that it would work with our device. greenpois0n will support our devices, just takes a little while to write up everything needed. --[[User:JacobVengeance|JakeAnthraX]] 05:24, 13 October 2010 (UTC)<br />
<br />
== hacktivation.dylib ==<br />
<br />
I added info about it and how to remove it for people who activate with iTunes. Hope no one minds. --[[User:Cmdshft|cmdshft]] 04:31, 13 October 2010 (UTC)<br />
:I have my 3GS officially activated and had no problems at all with this dylib or anything else related to activation so far... I'm officially unlocked too... Should I still remove the dylib even if I had no problems?? --[[User:Luxiel|Luxiel]] 17:02, 19 October 2010 (UTC)<br />
<br />
== Pwn4life ==<br />
<br />
Is this a pwned4life? If it is, can a restore remove it? --[[User:Balloonhead66|Balloonhead66]] 02:10, 15 October 2010 (UTC)<br />
:A DFU Mode restore will return you to a fresh and all Apple state --[[User:OMEGA RAZER|OMEGA RAZER]] 04:20, 15 October 2010 (UTC)<br />
<br />
:Pwned4life isn't like permanent jailbreak on the device, just means there is an exploit that will always be there to allow jailbreaks. A restore will get rid of it simple. --[[User:JacobVengeance|JakeAnthraX]] 19:37, 19 October 2010 (UTC)</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:Usb_control_msg(0x21,_2)_Exploit&diff=10725Talk:Usb control msg(0x21, 2) Exploit2010-10-18T20:05:43Z<p>Leobruh: </p>
<hr />
<div>This exploit isn't used in greepois0n, is it? --malontop<br />
<br />
nope. this exploit was used back in the 3.1.x days for a tethered jailbreak. SHAtter wont be revealed for awhile. but it is a usb exploit. [[User:Leobruh|Leobruh]] 20:05, 18 October 2010 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User:Leobruh&diff=9971User:Leobruh2010-10-06T17:52:59Z<p>Leobruh: Replacing page with 'Active wiki member with an iPhone 3GS 16gb.'</p>
<hr />
<div>Active wiki member with an iPhone 3GS 16gb.</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User:Leobruh&diff=9729User:Leobruh2010-09-29T23:12:05Z<p>Leobruh: </p>
<hr />
<div>===My iDevice Timeline===<br />
<br />
iPhone 2G #1. (RIP from opening to swap battery. FAIL.)<br />
<br />
iPhone 2G #2. (Sold on Craigslist to buy iPhone 3G #1. WIN.)<br />
<br />
iPhone 3G #1. (Dropped on concrete and flew off a car top after initial cracked screen fix. FAIL.)<br />
<br />
iPhone 2G #3. (Fell off a jetski. Revived 2 weeks later after laying in a bag of rice. Gave to my little brother. WIN/FAIL.)<br />
<br />
iPhone 3G #2. (Bought a 16gb motherboard for more memory. Pulled the phone apart, sneezed, ripped all the bands of the LCD, Digitizer, and Speaker. FAIL.Then I sold the remaining parts on Craigslist for $50.)<br />
<br />
iPhone 3GS #1. (Sold the 8gb model to buy a 16gb.)<br />
<br />
iPhone 3G #3. (Sold.)<br />
<br />
iPod Touch 2G #1. (Sold.)<br />
<br />
iPhone 3G #4. (Sold.)<br />
<br />
iPod Touch 3G #1. (Gifted to one of my cousins.)<br />
<br />
iPhone 2G #4. (Gifted to one of my other cousins.)<br />
<br />
==Current iDevices==<br />
<br />
iPhone 3GS #2. (Needed a 16gb model.)</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=S5L8900&diff=9402S5L89002010-09-23T02:25:14Z<p>Leobruh: not really hacking more like editing a wiki page. bunch of losers.</p>
<hr />
<div><br />
== Exploits ==<br />
=== [[iBoot]] ===<br />
'''Note''': [[iBoot]] on the S5L8720 can be downgraded, allowing any of these exploits to be used on future firmwares<br />
* [[Restore Mode]] - Works up to [[iOS]] 1.0.2<br />
* [[Ramdisk Hack]] - Works up to [[iOS]] 2.0 beta 3<br />
* [[diags]] - Works up to [[iOS]] 2.0 beta 5<br />
* [[ARM7 Go]] - Works on [[iOS]] 2.1.1<br />
* [[iBoot Environment Variable Overflow]] - Works up to [[iOS]] 3.1 beta 3<br />
* [[usb_control_msg(0x21, 2) Exploit]] - Works up to [[iOS]] 3.1.2<br />
<br />
<br />
=== [[Kernel]] ===<br />
* [[BPF STX Kernel Write Exploit]] - Works up to [[iOS]] 3.1.3<br />
* [[IOSurface Kernel Exploit]] - Works up to [[iOS]] 4.0.1<br />
<br />
=== [[Userland]] ===<br />
* [[Symlinks]] - Works up to [[iOS]] 1.1.1<br />
* [[LibTiff]] - Works up to [[iOS]] 1.1.1<br />
* [[Mknod]] - Works up to [[iOS]] 1.1.2<br />
* [[Dual Boot Exploit]] - Works up to [[iOS]] 2.0 beta 3<br />
* [[MobileBackup Copy Exploit]] - Works up to [[iOS]] 3.1.3<br />
* [[PDF CFF Font Stack Overflow]] - Works up to [[iOS]] 4.0.1<br />
<br />
===Boot Chain===<br />
[[VROM]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[System|System Software]]<br />
<br />
<br />
==== Boot Chain ====<br />
[[VROM]]->[[DFU]]</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User:Leobruh&diff=9178User:Leobruh2010-09-12T03:43:42Z<p>Leobruh: </p>
<hr />
<div>===My iDevice Timeline===<br />
<br />
iPhone 2G #1. (RIP from opening to swap battery. FAIL.)<br />
<br />
iPhone 2G #2. (Sold on Craigslist to buy iPhone 3G #1. WIN.)<br />
<br />
iPhone 3G #1. (Dropped on concrete and flew off a car top after initial cracked screen fix. FAIL.)<br />
<br />
iPhone 2G #3. (Fell off a jetski. Revived 2 weeks later after laying in a bag of rice. Gave to my little brother. WIN/FAIL.)<br />
<br />
iPhone 3G #2. (Bought a 16gb motherboard for more memory. Pulled the phone apart, sneezed, ripped all the bands of the LCD, Digitizer, and Speaker. FAIL.Then I sold the remaining parts on Craigslist for $50.)<br />
<br />
iPhone 3GS #1. (Sold the 8gb model to buy a 16gb.)<br />
<br />
iPhone 3G #3. (Sold.)<br />
<br />
iPod Touch 2G #1. (Sold.)<br />
<br />
iPhone 3G #4. (Sold.)<br />
<br />
==Current iDevices==<br />
<br />
iPhone 3GS #2. (Needed a 16gb model.)<br />
<br />
iPod Touch 3G #1. (My iPod dock's bitch.)</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User:Leobruh&diff=9018User:Leobruh2010-09-06T01:30:05Z<p>Leobruh: </p>
<hr />
<div>===My iDevice Timeline===<br />
<br />
iPhone 2G #1. (RIP from opening to swap battery. FAIL.)<br />
<br />
iPhone 2G #2. (Sold on Craigslist to buy iPhone 3G #1. WIN.)<br />
<br />
iPhone 3G #1. (Dropped on concrete and flew off a car top after initial cracked screen fix. FAIL.)<br />
<br />
iPhone 2G #3. (Fell off a jetski. Revived 2 weeks later after laying in a bag of rice. Gave to my little brother. WIN/FAIL.)<br />
<br />
iPhone 3G #2. (Bought a 16gb motherboard for more memory. Pulled the phone apart, sneezed, ripped all the bands of the LCD, Digitizer, and Speaker. FAIL.Then I sold the remaining parts on Craigslist for $50.)<br />
<br />
iPhone 3GS #1. (Sold the 8gb model to buy a 16gb.)<br />
<br />
iPhone 3G #3. (Sold.)<br />
<br />
iPod Touch 2G #1. (Sold.)<br />
<br />
==Current iDevices==<br />
<br />
iPhone 3GS #2. (Needed a 16gb model.)<br />
<br />
iPhone 3G #4. (Needed a 16gb model.)<br />
<br />
iPod Touch 3G #1. (My iPod dock's bitch.)</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User:Leobruh&diff=9017User:Leobruh2010-09-06T01:28:24Z<p>Leobruh: </p>
<hr />
<div>===My iPhone Timeline===<br />
<br />
iPhone 2G #1. (RIP from opening to swap battery. FAIL.)<br />
<br />
iPhone 2G #2. (Sold on Craigslist to buy iPhone 3G #1. WIN.)<br />
<br />
iPhone 3G #1. (Dropped on concrete and flew off a car top after initial cracked screen fix. FAIL.)<br />
<br />
iPhone 2G #3. (Fell off a jetski. Revived 2 weeks later after laying in a bag of rice. Gave to my little brother. WIN/FAIL.)<br />
<br />
iPhone 3G #2. (Bought a 16gb motherboard for more memory. Pulled the phone apart, sneezed, ripped all the bands of the LCD, Digitizer, and Speaker. FAIL.Then I sold the remaining parts on Craigslist for $50.)<br />
<br />
iPhone 3GS #1. (Sold the 8gb model to buy a 16gb.)<br />
<br />
iPhone 3G #3. (Sold.)<br />
<br />
iPod Touch 2G #1. (Sold.)<br />
<br />
==Current iDevices==<br />
<br />
iPhone 3GS #2. (Needed a 16gb model.)<br />
<br />
iPhone 3G #4. (Needed a 16gb model.)</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User_talk:Leobruh&diff=8873User talk:Leobruh2010-09-02T02:28:15Z<p>Leobruh: </p>
<hr />
<div>==Recent Vandalism==<br />
Hi there Leobruh! I couldn't help but notice that your page was vandalized... Sorry for letting that slip under the radar. However, in retaliation, you vandalized Gamer765's page and talk page. Please don't fight fire with fire... You could always notify a sysop (me, [[User:Http|Http]], et. al.) if we inadvertently neglect such actions. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 01:57, 2 September 2010 (UTC)<br />
<br />
thank you sir.[[User:Leobruh|Leobruh]] 02:28, 2 September 2010 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User:Leobruh&diff=8849User:Leobruh2010-09-02T00:41:31Z<p>Leobruh: </p>
<hr />
<div>===My iPhone Timeline===<br />
<br />
iPhone 2G #1. (RIP from opening to swap battery. FAIL.)<br />
<br />
iPhone 2G #2. (Sold on Craigslist to buy iPhone 3G #1. WIN.)<br />
<br />
iPhone 3G #1. (Dropped on concrete and flew off a car top after initial cracked screen fix. FAIL.)<br />
<br />
iPhone 2G #3. (Fell off a jetski. Revived 2 weeks later after laying in a bag of rice. Gave to my little brother. WIN/FAIL.)<br />
<br />
iPhone 3G #2. (Bought a 16gb motherboard for more memory. Pulled the phone apart, sneezed, ripped all the bands of the LCD, Digitizer, and Speaker. FAIL.Then I sold the remaining parts on Craigslist for $50.)<br />
<br />
<br />
==Current iDevices==<br />
<br />
iPhone 3GS #1. (Currently using and praying for the best.)<br />
<br />
iPhone 3G #3. (Works 100%)<br />
<br />
iPod Touch 2G #1. (Works 100%)</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User:Leobruh&diff=8836User:Leobruh2010-09-01T19:06:23Z<p>Leobruh: </p>
<hr />
<div>===My iPhone Timeline===<br />
<br />
iPhone 2G #1. (RIP from opening to swap battery. FAIL.)<br />
<br />
iPhone 2G #2. (Sold on Craigslist to buy iPhone 3G #1. WIN.)<br />
<br />
iPhone 3G #1. (Dropped on concrete and flew off a car top after initial cracked screen fix. FAIL.)<br />
<br />
iPhone 2G #3. (Fell off a jetski. Revived 2 weeks later after laying in a bag of rice. Gave to my little brother. WIN/FAIL.)<br />
<br />
iPhone 3G #2. (Bought a 16gb motherboard for more memory. Pulled the phone apart, sneezed, ripped all the bands of the LCD, Digitizer, and Speaker. FAIL.Then I sold the remaining parts on Craigslist for $50.)<br />
<br />
==Current iDevices==<br />
<br />
iPhone 3GS #1. (Currently using and praying for the best.)<br />
<br />
iPhone 3G #3. (Works 100%)<br />
<br />
iPod Touch 2G #1. (Works 100%)<br />
<br />
I get silly I suppose :P</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User_talk:Dialexio&diff=8739User talk:Dialexio2010-08-25T17:10:42Z<p>Leobruh: /* Q */</p>
<hr />
<div>==Baseband Help==<br />
hey i need help {{unsigned|Leobruh|03:35, March 29, 2010 (UTC)}}<br />
<br />
with...? {{unsigned|Gojohnnyboi|04:00, March 29, 2010 (UTC)}}<br />
<br />
im trying to learn how to find baseband exploits but i need some PC friendly tools to find those baseband exploits [[User:Leobruh|Leobruh]]!<br />
:I can't help you there, sorry. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 15:06, 24 June 2010 (UTC)<br />
<br />
==Rant deletion==<br />
alright i agree with what u did. [[User:Leobruh|Leobruh]] 04:39, 3 July 2010 (UTC)!<br />
<br />
==Thanks==<br />
Thanks for curating this wiki by wikifying paragraphs and adding tons of relevant, accurate, and grammatically correct info. :) [[User:Iemit737|Iemit737]] 01:00, 14 July 2010 (UTC)<br />
:Thanks! You've done a pretty amazing job also. :D --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 02:50, 14 July 2010 (UTC)<br />
<br />
==Presentation links==<br />
Thanks for adding those HQ torrent links, probably better than my FLV anyway ;) [[User:MaybachMan|MaybachMan]] 22:06, 14 July 2010 (UTC)<br />
<br />
... And once again for the Bluetooth additions. I'll shut up now ;) [[User:MaybachMan|MaybachMan]] 22:14, 14 July 2010 (UTC)<br />
<br />
==Beta Firmwares==<br />
should we start a beta firmwares page that contains a table with release dates, baseband versions, and iboot versions but without links? It might be interesting for reference purposes, and a good way to link to the decryption keys. [[User:Iemit737|Iemit737]] 03:53, 20 July 2010 (UTC)<br />
:I suppose this could be done (at [[Firmware/Beta]]?). I don't think hashes should be provided, though. A hash will probably only serve to help idiots pirate, verify, and install a beta firmware. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 04:57, 20 July 2010 (UTC)<br />
<br />
==Sysop Status==<br />
You are now a sysop. --[[User:Geohot|geohot]] 15:32, 21 July 2010 (UTC)<br />
:Thanks geohot! I'll be sure to do the best I can. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 21:48, 21 July 2010 (UTC)<br />
<br />
<br />
==Q==<br />
idc if the link is there or not<br />
u can C&P my paragraph to keep people informed [[User:Leobruh|Leobruh]] 05:37, 25 August 2010 (UTC)!<br />
:What do you mean with Q, idc, C&P? Ah, and yes, I agree that he deleted the advertisement page you made. It doesn't really belong into this wiki and the page had no content except the link to your blog. -- [[User:Http|http]] 10:34, 25 August 2010 (UTC)<br />
::C&P is copy and paste :P if i just copy my post will that be okay? [[User:Leobruh|Leobruh]] 17:10, 25 August 2010 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User_talk:Dialexio&diff=8722User talk:Dialexio2010-08-25T05:37:31Z<p>Leobruh: </p>
<hr />
<div>==Baseband Help==<br />
hey i need help {{unsigned|Leobruh|03:35, March 29, 2010 (UTC)}}<br />
<br />
with...? {{unsigned|Gojohnnyboi|04:00, March 29, 2010 (UTC)}}<br />
<br />
im trying to learn how to find baseband exploits but i need some PC friendly tools to find those baseband exploits [[User:Leobruh|Leobruh]]!<br />
:I can't help you there, sorry. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 15:06, 24 June 2010 (UTC)<br />
<br />
==Rant deletion==<br />
alright i agree with what u did. [[User:Leobruh|Leobruh]] 04:39, 3 July 2010 (UTC)!<br />
<br />
==Thanks==<br />
Thanks for curating this wiki by wikifying paragraphs and adding tons of relevant, accurate, and grammatically correct info. :) [[User:Iemit737|Iemit737]] 01:00, 14 July 2010 (UTC)<br />
:Thanks! You've done a pretty amazing job also. :D --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 02:50, 14 July 2010 (UTC)<br />
<br />
==Presentation links==<br />
Thanks for adding those HQ torrent links, probably better than my FLV anyway ;) [[User:MaybachMan|MaybachMan]] 22:06, 14 July 2010 (UTC)<br />
<br />
... And once again for the Bluetooth additions. I'll shut up now ;) [[User:MaybachMan|MaybachMan]] 22:14, 14 July 2010 (UTC)<br />
<br />
==Beta Firmwares==<br />
should we start a beta firmwares page that contains a table with release dates, baseband versions, and iboot versions but without links? It might be interesting for reference purposes, and a good way to link to the decryption keys. [[User:Iemit737|Iemit737]] 03:53, 20 July 2010 (UTC)<br />
:I suppose this could be done (at [[Firmware/Beta]]?). I don't think hashes should be provided, though. A hash will probably only serve to help idiots pirate, verify, and install a beta firmware. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 04:57, 20 July 2010 (UTC)<br />
<br />
==Sysop Status==<br />
You are now a sysop. --[[User:Geohot|geohot]] 15:32, 21 July 2010 (UTC)<br />
:Thanks geohot! I'll be sure to do the best I can. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 21:48, 21 July 2010 (UTC)<br />
<br />
<br />
==Q==<br />
idc if the link is there or not<br />
u can C&P my paragraph to keep people informed [[User:Leobruh|Leobruh]] 05:37, 25 August 2010 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:Hacktivation&diff=8642Talk:Hacktivation2010-08-23T04:22:54Z<p>Leobruh: </p>
<hr />
<div>You should write "Hacktivation" instead of "Hackitivation". ;) -- hypn0zis<br />
<br />
fixed lol this page was in due need. [[User:Leobruh|Leobruh]] 04:22, 23 August 2010 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Hacktivation&diff=8638Hacktivation2010-08-23T03:28:40Z<p>Leobruh: /* Methods */</p>
<hr />
<div>Hackitivation is the process of circumventing the standard Apple activation process with iTunes. As of now you can hackitivate an iPhone in a variety of ways. The most common use for hackitivation is for users of an unlock. At times some iPhones users hackitivate to use the phone as an iPod Touch with a camera.<br />
<br />
==Methods==<br />
1. By using a valid AT&T sim card and connecting to iTunes. (This method will work on any iPhone. Although its not true hackitivation it can be a type of method for users without ATT.<br />
<br />
2. Using redsn0w and not selecting any of the options. (This will work on any iPhone compatible with the redsn0w version)<br />
<br />
3. If on 3.1.x you can run blackra1n. (If you have a new bootrom 3GS it will be tethered.)<br />
<br />
4. Restore using sn0wbreeze. (Like redsn0w this will work on any iPhone compatible with the sn0wbreeze version)<br />
<br />
5. By using a phonebook sim card and connecting to iTunes and syncing the phone. (Note you must sync your phone for the activation token to be signed. If you put the phonebook sim card in and take it out of the phone without syncing to iTunes, thene it will go to the "Connect to iTunes/Emergency Call" screen.<br />
<br />
<br />
[Note that the userland jailbreak Spirit will not hackitivate because it relies on MobileSubstrate for the jailbreak. Also note that Star will never be able to hackitivate because for someone to even use it you have to have Safari access.]<br />
<br />
---Leobruh</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Hacktivation&diff=8637Hacktivation2010-08-23T03:26:10Z<p>Leobruh: /* Methods */</p>
<hr />
<div>Hackitivation is the process of circumventing the standard Apple activation process with iTunes. As of now you can hackitivate an iPhone in a variety of ways. The most common use for hackitivation is for users of an unlock. At times some iPhones users hackitivate to use the phone as an iPod Touch with a camera.<br />
<br />
==Methods==<br />
1. By using a valid AT&T sim card and connecting to iTunes. (This method will work on any iPhone. Although its not true hackitivation it can be a type of method for users without ATT.<br />
<br />
2. Using redsn0w and not selecting any of the options. (This will work on any iPhone compatible with the redsn0w version)<br />
<br />
3. If on 3.1.x you can run blackra1n. (If you have a new bootrom 3GS it will be tethered.)<br />
<br />
4. Restore using sn0wbreeze. (Like redsn0w this will work on any iPhone compatible with the sn0wbreeze version)<br />
<br />
5. By using a phonebook sim card and connecting to iTunes and syncing the phone. (Note you must sync your phone for the activation token to be signed. If you put the phonebook sim card in and take it out your phone will go to the "Connect to iTunes/Emergency Call" screen.<br />
<br />
<br />
[Note that the userland jailbreak Spirit will not hackitivate because it relies on MobileSubstrate for the jailbreak. Also note that Star will never be able to hackitivate because for someone to even use it you have to have Safari access.]<br />
<br />
---Leobruh</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Hacktivation&diff=8636Hacktivation2010-08-23T03:21:26Z<p>Leobruh: </p>
<hr />
<div>Hackitivation is the process of circumventing the standard Apple activation process with iTunes. As of now you can hackitivate an iPhone in a variety of ways. The most common use for hackitivation is for users of an unlock. At times some iPhones users hackitivate to use the phone as an iPod Touch with a camera.<br />
<br />
==Methods==<br />
1. By using a valid AT&T sim card and connecting to iTunes. (This method will work on any iPhone. Although its not true hackitivation it can be a type of method for users without ATT.<br />
<br />
2. Using redsn0w and not selecting any of the options. (This will work on any iPhone compatible with the redsn0w version)<br />
<br />
3. If on 3.1.x you can run blackra1n.<br />
<br />
4. Restore using sn0wbreeze.(Like redsn0w this will work on any iPhone compatible with the sn0wbreeze version)<br />
<br />
5. By using a phonebook sim card and connecting to iTunes and syncing the phone.<br />
<br />
[Note that the userland jailbreak Spirit will not hackitivate because it relies on MobileSubstrate for the jailbreak. Also note that Star will never be able to hackitivate because for someone to even use it you have to have Safari access.]<br />
<br />
---Leobruh</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Hacktivation&diff=8635Hacktivation2010-08-23T03:19:12Z<p>Leobruh: /* Methods */</p>
<hr />
<div>Hackitivation is the process of circumventing the standard Apple activation process with iTunes. As of now you can hackitivate an iPhone in a variety of ways.<br />
<br />
==Methods==<br />
1. By using a valid AT&T sim card and connecting to iTunes. (This method will work on any iPhone. Although its not true hackitivation it can be a type of method for users without ATT.<br />
<br />
2. Using redsn0w and not selecting any of the options. (This will work on any iPhone compatible with the redsn0w version)<br />
<br />
3. If on 3.1.x you can run blackra1n.<br />
<br />
4. Restore using sn0wbreeze.(Like redsn0w this will work on any iPhone compatible with the sn0wbreeze version)<br />
<br />
5. By using a phonebook sim card and connecting to iTunes and syncing the phone.<br />
<br />
[Note that the userland jailbreak Spirit will not hackitivate because it relies on MobileSubstrate for the jailbreak. Also note that Star will never be able to hackitivate because for someone to even use it you have to have Safari access.]<br />
<br />
---Leobruh</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Hacktivation&diff=8634Hacktivation2010-08-23T03:15:47Z<p>Leobruh: /* Methods */</p>
<hr />
<div>Hackitivation is the process of circumventing the standard Apple activation process with iTunes. As of now you can hackitivate an iPhone in a variety of ways.<br />
<br />
==Methods==<br />
1. By using a valid AT&T sim card and connecting to iTunes. (This method will work on any iPhone)<br />
<br />
2. Using redsn0w and not selecting any of the options. (This will work on any iPhone compatible with the redsn0w version)<br />
<br />
3. If on 3.1.x you can run blackra1n.<br />
<br />
4. Restore using sn0wbreeze.(Like redsn0w this will work on any iPhone compatible with the sn0wbreeze version)<br />
<br />
5. By using a phonebook sim card and connecting to iTunes and syncing the phone.<br />
<br />
[Note that the userland jailbreak Spirit will not hackitivate because it relies on MobileSubstrate for the jailbreak. Also note that Star will never be able to hackitivate because for someone to even use it you have to have Safari access.]<br />
<br />
---Leobruh</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Hacktivation&diff=8633Hacktivation2010-08-23T03:15:29Z<p>Leobruh: started a new page</p>
<hr />
<div>Hackitivation is the process of circumventing the standard Apple activation process with iTunes. As of now you can hackitivate an iPhone in a variety of ways.<br />
<br />
==Methods==<br />
1. By using a valid AT&T sim card and connecting to iTunes. (This method will work on any iPhone)<br />
2. Using redsn0w and not selecting any of the options. (This will work on any iPhone compatible with the redsn0w version)<br />
3. If on 3.1.x you can run blackra1n.<br />
4. Restore using sn0wbreeze.(Like redsn0w this will work on any iPhone compatible with the sn0wbreeze version)<br />
5. By using a phonebook sim card and connecting to iTunes and syncing the phone.<br />
<br />
[Note that the userland jailbreak Spirit will not hackitivate because it relies on MobileSubstrate for the jailbreak. Also note that Star will never be able to hackitivate because for someone to even use it you have to have Safari access.]<br />
<br />
---Leobruh</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:WildcardTicket&diff=8552Talk:WildcardTicket2010-08-21T14:47:54Z<p>Leobruh: </p>
<hr />
<div>Theoretically, can't we just edit the .plist? and make it into the factory unlocked IMSI Mask? -- {{unsigned|Leobruh|5:32, 19 August 2010 (UTC)}}<br />
<br />
:The activation plist is signed, so to do this you require a jailbreak anyway. --[[User:Lilstevie|Lilstevie]] 09:45, 20 August 2010 (UTC)- lilstevie<br />
<br />
i realize that. but wouldnt this result in a permanent unlock? [[User:Leobruh|Leobruh]] 07:37, 19 August 2010 (UTC)!<br />
<br />
I'm guessing the ticket is handled by the baseband, which requires an exploit to get unsigned code running in the first place? [[User:Iemit737|Iemit737]] 07:41, 19 August 2010 (UTC)<br />
<br />
The wildcard ticket is also signed - simple edits break the signature and the ticket gets rejected then. rtfm cryptography 101. [[User:dogbert|dogbert]] 16:02, 19 August 2010 (UTC)<br />
<br />
kay but unsigned code already runs when the phone is jailbroken and has access to the filesystem. wouldnt editing the .plist be okay since the sig checks arent needed. again this is all theoretical. im jw [[User:Leobruh|Leobruh]] 18:33, 19 August 2010 (UTC)!<br />
<br />
The baseband processor checks the signature, not the application processor. [[User:dogbert|dogbert]] 18:36, 19 August 2010 (UTC)<br />
<br />
ahh got ya! but would my theory work though through an exploit such as AT+XAPP? instead of a payload it just changes the .plist? [[User:Leobruh|Leobruh]] 00:15, 20 August 2010 (UTC)!<br />
<br />
:you would still require the valid NCK for it to process the unlock in that method, the current way the payloads work for exploits in the baseband processor are adequate --[[User:Lilstevie|Lilstevie]] 09:44, 20 August 2010 (UTC)<br />
<br />
:i thought NKC was only for the iPhone 2G? 0.o [[User:Leobruh|Leobruh]] 14:47, 21 August 2010 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:WildcardTicket&diff=8518Talk:WildcardTicket2010-08-20T00:15:26Z<p>Leobruh: </p>
<hr />
<div>Theoretically, can't we just edit the .plist? and make it into the factory unlocked IMSI Mask? -- {{unsigned|Leobruh|5:32, 19 August 2010 (UTC)}}<br />
:The activation plist is signed, so to do this you require a jailbreak anyway. - lilstevie<br />
<br />
i realize that. but wouldnt this result in a permanent unlock? [[User:Leobruh|Leobruh]] 07:37, 19 August 2010 (UTC)!<br />
<br />
I'm guessing the ticket is handled by the baseband, which requires an exploit to get unsigned code running in the first place? [[User:Iemit737|Iemit737]] 07:41, 19 August 2010 (UTC)<br />
<br />
The wildcard ticket is also signed - simple edits break the signature and the ticket gets rejected then. rtfm cryptography 101. [[User:dogbert|dogbert]] 16:02, 19 August 2010 (UTC)<br />
<br />
kay but unsigned code already runs when the phone is jailbroken and has access to the filesystem. wouldnt editing the .plist be okay since the sig checks arent needed. again this is all theoretical. im jw [[User:Leobruh|Leobruh]] 18:33, 19 August 2010 (UTC)!<br />
<br />
The baseband processor checks the signature, not the application processor. [[User:dogbert|dogbert]] 18:36, 19 August 2010 (UTC)<br />
<br />
ahh got ya! but would my theory work though through an exploit such as AT+XAPP? instead of a payload it just changes the .plist? [[User:Leobruh|Leobruh]] 00:15, 20 August 2010 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=Talk:WildcardTicket&diff=8500Talk:WildcardTicket2010-08-19T18:33:13Z<p>Leobruh: </p>
<hr />
<div>Theoretically, can't we just edit the .plist? and make it into the factory unlocked IMSI Mask? -- {{unsigned|Leobruh|5:32, 19 August 2010 (UTC)}}<br />
:The activation plist is signed, so to do this you require a jailbreak anyway. - lilstevie<br />
<br />
i realize that. but wouldnt this result in a permanent unlock? [[User:Leobruh|Leobruh]] 07:37, 19 August 2010 (UTC)!<br />
<br />
I'm guessing the ticket is handled by the baseband, which requires an exploit to get unsigned code running in the first place? [[User:Iemit737|Iemit737]] 07:41, 19 August 2010 (UTC)<br />
<br />
The wildcard ticket is also signed - simple edits break the signature and the ticket gets rejected then. rtfm cryptography 101. [[User:dogbert|dogbert]] 16:02, 19 August 2010 (UTC)<br />
<br />
kay but unsigned code already runs when the phone is jailbroken and has access to the filesystem. wouldnt editing the .plist be okay since the sig checks arent needed. again this is all theoretical. im jw [[User:Leobruh|Leobruh]] 18:33, 19 August 2010 (UTC)!</div>Leobruhhttps://www.theiphonewiki.com/w/index.php?title=User:Leobruh&diff=8479User:Leobruh2010-08-19T07:52:33Z<p>Leobruh: </p>
<hr />
<div>===My iPhone Timeline===<br />
<br />
iPhone 2G #1. (RIP from opening to swap battery. FAIL.)<br />
<br />
iPhone 2G #2. (Sold on Craigslist to buy iPhone 3G #1. WIN.)<br />
<br />
iPhone 3G #1. (Dropped on concrete and flew off a car top after initial cracked screen fix. FAIL.)<br />
<br />
iPhone 2G #3. (Fell off a jetski. Revived 2 weeks later after laying in a bag of rice. Gave to my little brother. WIN/FAIL.)<br />
<br />
iPhone 3G #2. (Bought a 16gb motherboard for more memory. Pulled the phone apart, sneezed, ripped all the bands of the LCD, Digitizer, and Speaker. FAIL.Then I sold the remaining parts on Craigslist for $50.)<br />
<br />
iPhone 3GS #1. (Currently using and praying for the best.)<br />
<br />
<br />
<br />
I get silly I suppose :P</div>Leobruh