The iPhone Wiki - User contributions [en]

TigrisSeed 15A5354b (iPhone9,4)

2017-08-21T21:35:31Z

P0sidonius: format need

iPhone_7Plus_11.0_15A5354b iBoot.d11.RELEASE.im4p
-iv c363d27845ef775ba1f8536922ef73f2
-k 1a50d0749ec61206a205535cb4255262f17b7a28cf93aade47537cf000723ab8

Bootrom

2017-03-29T05:02:53Z

P0sidonius: Больше исправления

The '''bootrom''' (called "SecureROM" by Apple) is the first significant code that runs on an iDevice. The bootrom is read-only. Finding exploits in the bootrom level is a big achievement since Apple won't be able to fix it without a hardware revision.

== Old & New bootrom ==
Certain models, including the [[N72AP|iPod touch (2nd generation)]] and [[N88AP|iPhone 3GS]], have different bootrom versions. These are most commonly referred to with the terms "old bootrom" and "new bootrom." These "new bootrom" devices were released after [[Timeline#September|9 September 2009]] and have the [[0x24000 Segment Overflow]] fixed. While the new bootrom revisions have an exploit, the exploit needs the assistance of a firmware-based exploit to achieve an [[untethered jailbreak]].

You might also be looking for [[iBoot (Bootloader)|Apple's stage 2 bootloader]], which also uses the "iBoot" name.

Usually also looking at the CPRV (Chip Revision) tag will also tell you whether the device is new unit or not also.

==Finding bootrom version==
===From the model number ([[N72AP|iPod touch (2nd generation)]])===
If the second character of your Model Number is "B" (e.g.- '''FB533''', '''MB533''', or '''PB533'''), your iPod has the old bootrom. If the second character is "C" ('''FC086''', '''MC086''' or '''PC086'''), your iPod has the new bootrom.

===From the serial number ([[N88AP|iPhone 3GS]])===
The third digit of the serial number identifies the year of manufacture (9=2009, 0=2010, 1=2011, 2=2012), while the fourth and the fifth indicate the week. There is a gray area between week 40 of 2009 (??940??????) and week 45 of 2009 (??945??????) where some devices have new bootrom whilst others have old bootrom. . Any iPhone made after Week 45 of 2009 (??945?????? and higher or ??0???????? serials) has the new bootrom.

===From the DFU Device descriptors (all devices except S5L8900)===
====Windows====
# Connect Device & Enter [[DFU Mode]]
# Open Device Manager, find USB controller, subitem Apple Mobile Device USB Driver
# Right-Click & click Properties
# Go to Details tab & select Device Instance Path in the dropdown box
# The end of the info string will show the bootrom version

====Mac OS X====
# Connect Device & Enter [[DFU Mode]]
# Go to System Profiler, and under the Hardware category, go to USB, and click on Apple Mobile Device (DFU Mode)
# The end of the Serial Number string will show the bootrom version in brackets (ie: [iBoot-574.4])

====Linux====
# Make sure your distribution has '''usbutils''' installed. (most distributions have it by default)
# Connect Device & Enter [[DFU Mode]]
# In terminal, run '''sudo lsusb -v'''
# Find the line that says '''iSerial''' and your bootrom version will be at the end of the line.

== Dumping the bootrom ==
You can use [[Bootrom Dumper Utility]] by [[User:pod2g|pod2g]] to dump the bootrom on devices that are vulnerable to the [[Limera1n Exploit]].

== Bootrom Exploits ==
* [[pwnage|Pwnage 1.0 (Ramdisk + AppleImage2NORAccess)]] up to Rev.2
* [[Pwnage 2.0|Pwnage 2.0 (DFU + Malformed Certificate)]] up to Rev.2
* [[0x24000 Segment Overflow]] up to 240.4/359.3
* [[usb_control_msg(0xA1, 1) Exploit]] (also called "steaks4uce" exploit) only for 240.4 and 240.5.1
* [[Limera1n Exploit]] up to 574.4
* [[SHA-1 Image Segment Overflow|SHAtter]] up to 574.4

== Revisions ==
* [[Bootrom Rev.2]] in [[S5L8900]]
* [[Bootrom 240.4]] in [[S5L8720]] (old version only)
* [[Bootrom 359.3]] in [[S5L8920]] (old version only)
* [[Bootrom 240.5.1]] in [[S5L8720]] (new version only)
* [[Bootrom 359.3.2]] in [[S5L8920]] (new version only)
* [[Bootrom 359.5]] in [[S5L8922]]
* [[Bootrom 574.4]] in [[S5L8930]]
* [[Bootrom 838.3]] in [[S5L8940]]
* [[rom]] in [[S5L8942]]
* [[Bootrom 1062.2]] in [[S5L8945]]
* [[Bootrom 1458.2]] in [[S5L8947]]
* [[Bootrom 1145.3]] in [[S5L8950]]
* [[Bootrom 1145.3.3]] in [[S5L8955]]
* [[Bootrom 1704.10]] in [[S5L8960]] and [[S5L8965]]
* [[Bootrom 1992.0.0.1.19]] in [[T7000]]
* [[Bootrom 1991.0.0.2.16‎]] in [[T7001]]
* unknown [[S7002]]
* [[Bootrom 2234.0.0.3.3]] in [[S8000]]
* [[Bootrom 2234.0.0.2.22]] in [[S8003]]
* [[Bootrom 1413.8]] in [[S5L8747]]

===[[S5L8900]], used in the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]]===
see also [[VROM (S5L8900)]]
* [[Bootrom Rev.2]]

===[[S5L8720]], used in the [[N72AP|iPod touch (2nd generation)]]===
* [[Bootrom 240.4]] "old bootrom"
* [[Bootrom 240.5.1]] "new bootrom"

===[[S5L8920]], used in the [[N88AP|iPhone 3GS]]===
* [[Bootrom 359.3]] "old bootrom"
* [[Bootrom 359.3.2]] "new bootrom"

===[[S5L8747]], used in the [[Haywire]]===
* [[Bootrom 1413.8]]

===[[S5L8922]], used in the [[N18AP|iPod touch (3rd generation)]]===
* [[Bootrom 359.5]]

===[[S5L8930]], used in the [[K48AP|iPad]], [[N90AP|iPhone 4]], [[K66AP|Apple TV (2nd generation)]], and [[N81AP|iPod touch (4th generation)]]===
* [[Bootrom 574.4]]

===[[S5L8940]], used in the [[iPad 2]] and [[N94AP|iPhone 4S]]===
* [[Bootrom 838.3]]

===[[S5L8942]], used in the [[K93AAP|iPad 2 (iPad2,4)]], [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]], [[iPod touch (5th generation)]], and [[iPad mini]] ===
* [[rom]]


===[[S5L8945]], used in the [[iPad (3rd generation)]]===
* [[Bootrom 1062.2]]

===[[S5L8947]], used in the [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]===
* [[Bootrom 1458.2]]

===[[S5L8950]], used in the [[iPhone 5]] and [[iPhone 5c]] ===
* [[Bootrom 1145.3]]

===[[S5L8955]], used in the [[iPad (4th generation)]]===
* [[Bootrom 1145.3.3]]

===[[S5L8960]]/[[S5L8965]], used in the [[iPhone 5s]], [[iPad Air]], [[iPad mini 2]], and [[iPad mini 3]]===
* [[Bootrom 1704.10]]

===[[T7000]], used in the [[J42dAP|Apple TV (4th generation)]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], and [[N102AP|iPod touch (6th generation)]]===
* [[Bootrom 1992.0.0.1.19]]

===[[T7001]], used in the [[iPad Air 2]]===
* [[Bootrom 1991.0.0.2.16]]

===[[S7002]], used in the [[Apple Watch (1st generation)]]===
* unknown

===[[S8000]], used in the [[iPad (5th generation)]], [[N71AP|iPhone 6s]], [[N66AP|iPhone 6s Plus]] and [[N69uAP|iPhone SE]]===
* [[Bootrom 2234.0.0.3.3]]

===[[S8001]], used in the [[iPad Pro]]===
* [[Bootrom 2481.0.0.2.1]]

===[[S8003]], used in the [[N71mAP|iPhone 6s]], [[N66mAP|iPhone 6s Plus]] and [[N69AP|iPhone SE]]===
* [[Bootrom 2234.0.0.2.22]]

===[[T8002]], used in the [[Apple Watch Series 1]] and [[Apple Watch Series 2]]===
* [[Bootrom 2651.0.0.1.31]]

===[[T8010]], used in the [[iPhone 7]] and [[iPhone 7 Plus]]===
* [[Bootrom 2696.0.0.1.33]]

== References ==
* [http://conference.hitb.org/hitbsecconf2013kul/materials/D2T1%20-%20Joshua%20'p0sixninja'%20Hill%20-%20SHAttered%20Dreams.pdf p0sixninja's presentation SHAttered Dreams - Adventures in BootROM Land]

[[Category:Bootrom]]

Bootrom

2017-03-29T05:01:07Z

P0sidonius: фиксировать

The '''bootrom''' (called "SecureROM" by Apple) is the first significant code that runs on an iDevice. The bootrom is read-only. Finding exploits in the bootrom level is a big achievement since Apple won't be able to fix it without a hardware revision.

== Old & New bootrom ==
Certain models, including the [[N72AP|iPod touch (2nd generation)]] and [[N88AP|iPhone 3GS]], have different bootrom versions. These are most commonly referred to with the terms "old bootrom" and "new bootrom." These "new bootrom" devices were released after [[Timeline#September|9 September 2009]] and have the [[0x24000 Segment Overflow]] fixed. While the new bootrom revisions have an exploit, the exploit needs the assistance of a firmware-based exploit to achieve an [[untethered jailbreak]].

You might also be looking for [[iBoot (Bootloader)|Apple's stage 2 bootloader]], which also uses the "iBoot" name.

Usually also looking at the CPRV (Chip Revision) tag will also tell you whether the device is new unit or not also.

==Finding bootrom version==
===From the model number ([[N72AP|iPod touch (2nd generation)]])===
If the second character of your Model Number is "B" (e.g.- '''FB533''', '''MB533''', or '''PB533'''), your iPod has the old bootrom. If the second character is "C" ('''FC086''', '''MC086''' or '''PC086'''), your iPod has the new bootrom.

===From the serial number ([[N88AP|iPhone 3GS]])===
The third digit of the serial number identifies the year of manufacture (9=2009, 0=2010, 1=2011, 2=2012), while the fourth and the fifth indicate the week. There is a gray area between week 40 of 2009 (??940??????) and week 45 of 2009 (??945??????) where some devices have new bootrom whilst others have old bootrom. . Any iPhone made after Week 45 of 2009 (??945?????? and higher or ??0???????? serials) has the new bootrom.

===From the DFU Device descriptors (all devices except S5L8900)===
====Windows====
# Connect Device & Enter [[DFU Mode]]
# Open Device Manager, find USB controller, subitem Apple Mobile Device USB Driver
# Right-Click & click Properties
# Go to Details tab & select Device Instance Path in the dropdown box
# The end of the info string will show the bootrom version

====Mac OS X====
# Connect Device & Enter [[DFU Mode]]
# Go to System Profiler, and under the Hardware category, go to USB, and click on Apple Mobile Device (DFU Mode)
# The end of the Serial Number string will show the bootrom version in brackets (ie: [iBoot-574.4])

====Linux====
# Make sure your distribution has '''usbutils''' installed. (most distributions have it by default)
# Connect Device & Enter [[DFU Mode]]
# In terminal, run '''sudo lsusb -v'''
# Find the line that says '''iSerial''' and your bootrom version will be at the end of the line.

== Dumping the bootrom ==
You can use [[Bootrom Dumper Utility]] by [[User:pod2g|pod2g]] to dump the bootrom on devices that are vulnerable to the [[Limera1n Exploit]].

== Bootrom Exploits ==
* [[pwnage|Pwnage 1.0 (Ramdisk + AppleImage2NORAccess)]] up to Rev.2
* [[Pwnage 2.0|Pwnage 2.0 (DFU + Malformed Certificate)]] up to Rev.2
* [[0x24000 Segment Overflow]] up to 240.4/359.3
* [[usb_control_msg(0xA1, 1) Exploit]] (also called "steaks4uce" exploit) only for 240.4 and 240.5.1
* [[Limera1n Exploit]] up to 574.4
* [[SHA-1 Image Segment Overflow|SHAtter]] up to 574.4

== Revisions ==
* [[Bootrom Rev.2]] in [[S5L8900]]
* [[Bootrom 240.4]] in [[S5L8720]] (old version only)
* [[Bootrom 359.3]] in [[S5L8920]] (old version only)
* [[Bootrom 240.5.1]] in [[S5L8720]] (new version only)
* [[Bootrom 359.3.2]] in [[S5L8920]] (new version only)
* [[Bootrom 359.5]] in [[S5L8922]]
* [[Bootrom 574.4]] in [[S5L8930]]
* [[Bootrom 838.3]] in [[S5L8940]]
* [[Bootrom 878.3]] in [[S5L8942]]
* [[Bootrom 1062.2]] in [[S5L8945]]
* [[Bootrom 1458.2]] in [[S5L8947]]
* [[Bootrom 1145.3]] in [[S5L8950]]
* [[Bootrom 1145.3.3]] in [[S5L8955]]
* [[Bootrom 1704.10]] in [[S5L8960]] and [[S5L8965]]
* [[Bootrom 1992.0.0.1.19]] in [[T7000]]
* [[Bootrom 1991.0.0.2.16‎]] in [[T7001]]
* unknown [[S7002]]
* [[Bootrom 2234.0.0.3.3]] in [[S8000]]
* [[Bootrom 2234.0.0.2.22]] in [[S8003]]
* [[Bootrom 1413.8]] in [[S5L8747]]

===[[S5L8900]], used in the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]]===
see also [[VROM (S5L8900)]]
* [[Bootrom Rev.2]]

===[[S5L8720]], used in the [[N72AP|iPod touch (2nd generation)]]===
* [[Bootrom 240.4]] "old bootrom"
* [[Bootrom 240.5.1]] "new bootrom"

===[[S5L8920]], used in the [[N88AP|iPhone 3GS]]===
* [[Bootrom 359.3]] "old bootrom"
* [[Bootrom 359.3.2]] "new bootrom"

===[[S5L8747]], used in the [[Haywire]]===
* [[Bootrom 1413.8]]

===[[S5L8922]], used in the [[N18AP|iPod touch (3rd generation)]]===
* [[Bootrom 359.5]]

===[[S5L8930]], used in the [[K48AP|iPad]], [[N90AP|iPhone 4]], [[K66AP|Apple TV (2nd generation)]], and [[N81AP|iPod touch (4th generation)]]===
* [[Bootrom 574.4]]

===[[S5L8940]], used in the [[iPad 2]] and [[N94AP|iPhone 4S]]===
* [[Bootrom 838.3]]

===[[S5L8942]], used in the [[K93AAP|iPad 2 (iPad2,4)]], [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]], [[iPod touch (5th generation)]], and [[iPad mini]] ===
* [[rom 878.3]]


===[[S5L8945]], used in the [[iPad (3rd generation)]]===
* [[Bootrom 1062.2]]

===[[S5L8947]], used in the [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]===
* [[Bootrom 1458.2]]

===[[S5L8950]], used in the [[iPhone 5]] and [[iPhone 5c]] ===
* [[Bootrom 1145.3]]

===[[S5L8955]], used in the [[iPad (4th generation)]]===
* [[Bootrom 1145.3.3]]

===[[S5L8960]]/[[S5L8965]], used in the [[iPhone 5s]], [[iPad Air]], [[iPad mini 2]], and [[iPad mini 3]]===
* [[Bootrom 1704.10]]

===[[T7000]], used in the [[J42dAP|Apple TV (4th generation)]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], and [[N102AP|iPod touch (6th generation)]]===
* [[Bootrom 1992.0.0.1.19]]

===[[T7001]], used in the [[iPad Air 2]]===
* [[Bootrom 1991.0.0.2.16]]

===[[S7002]], used in the [[Apple Watch (1st generation)]]===
* unknown

===[[S8000]], used in the [[iPad (5th generation)]], [[N71AP|iPhone 6s]], [[N66AP|iPhone 6s Plus]] and [[N69uAP|iPhone SE]]===
* [[Bootrom 2234.0.0.3.3]]

===[[S8001]], used in the [[iPad Pro]]===
* [[Bootrom 2481.0.0.2.1]]

===[[S8003]], used in the [[N71mAP|iPhone 6s]], [[N66mAP|iPhone 6s Plus]] and [[N69AP|iPhone SE]]===
* [[Bootrom 2234.0.0.2.22]]

===[[T8002]], used in the [[Apple Watch Series 1]] and [[Apple Watch Series 2]]===
* [[Bootrom 2651.0.0.1.31]]

===[[T8010]], used in the [[iPhone 7]] and [[iPhone 7 Plus]]===
* [[Bootrom 2696.0.0.1.33]]

== References ==
* [http://conference.hitb.org/hitbsecconf2013kul/materials/D2T1%20-%20Joshua%20'p0sixninja'%20Hill%20-%20SHAttered%20Dreams.pdf p0sixninja's presentation SHAttered Dreams - Adventures in BootROM Land]

[[Category:Bootrom]]

Bootrom

2017-02-08T05:17:44Z

P0sidonius:

The '''bootrom''' (called "SecureROM" by Apple) is the first significant code that runs on an iDevice. The bootrom is read-only. Finding exploits in the bootrom level is a big achievement since Apple won't be able to fix it without a hardware revision.

== Old & New bootrom ==
Certain models, including the [[N72AP|iPod touch 2G]] and [[N88AP|iPhone 3GS]], have different bootrom versions. These are most commonly referred to with the terms "old bootrom" and "new bootrom." These "new bootrom" devices were released after [[Timeline#September|9 September 2009]] and have the [[0x24000 Segment Overflow]] fixed. While the new bootrom revisions have an exploit, the exploit needs the assistance of a firmware-based exploit to achieve an [[untethered jailbreak]].

You might also be looking for [[iBoot (Bootloader)|Apple's stage 2 bootloader]], which also uses the "iBoot" name.

Usually also looking at the CPRV (Chip Revision) tag will also tell you whether the device is new unit or not also.

==Finding bootrom version==
===From the model number ([[N72AP|iPod touch 2G]])===
If the second character of your Model Number is "B" (e.g.- '''FB533''', '''MB533''', or '''PB533'''), your iPod has the old bootrom. If the second character is "C" ('''FC086''', '''MC086''' or '''PC086'''), your iPod has the new bootrom.

===From the serial number ([[N88AP|iPhone 3GS]])===
The third digit of the serial number identifies the year of manufacture (9=2009, 0=2010, 1=2011, 2=2012), while the fourth and the fifth indicate the week. There is a gray area between week 40 of 2009 (??940??????) and week 45 of 2009 (??945??????) where some devices have new bootrom whilst others have old bootrom. . Any iPhone made after Week 45 of 2009 (??945?????? and higher or ??0???????? serials) has the new bootrom.

===From the DFU Device descriptors (all devices except S5L8900)===
====Windows====
# Connect Device & Enter [[DFU Mode]]
# Open Device Manager, find USB controller, subitem Apple Mobile Device USB Driver
# Right-Click & click Properties
# Go to Details tab & select Device Instance Path in the dropdown box
# The end of the info string will show the bootrom version

====Mac OS X====
# Connect Device & Enter [[DFU Mode]]
# Go to System Profiler, and under the Hardware category, go to USB, and click on Apple Mobile Device (DFU Mode)
# The end of the Serial Number string will show the bootrom version in brackets (ie: [iBoot-574.4])

====Linux====
# Make sure your distribution has '''usbutils''' installed. (most distributions have it by default)
# Connect Device & Enter [[DFU Mode]]
# In terminal, run '''sudo lsusb -v'''
# Find the line that says '''iSerial''' and your bootrom version will be at the end of the line.

== Dumping the bootrom ==
You can use [[Bootrom Dumper Utility]] by [[User:pod2g|pod2g]] to dump the bootrom on devices that are vulnerable to the [[Limera1n Exploit]].

== Bootrom Exploits ==
* [[pwnage|Pwnage 1.0 (Ramdisk + AppleImage2NORAccess)]] up to Rev.2
* [[Pwnage 2.0|Pwnage 2.0 (DFU + Malformed Certificate)]] up to Rev.2
* [[0x24000 Segment Overflow]] up to 240.4/359.3
* [[usb_control_msg(0xA1, 1) Exploit]] (also called "steaks4uce" exploit) only for 240.4 and 240.5.1
* [[Limera1n Exploit]] up to 574.4
* [[SHA-1 Image Segment Overflow|SHAtter]] up to 574.4

== Revisions ==
* [[Bootrom Rev.2]] in [[S5L8900]]
* [[Bootrom 240.4]] in [[S5L8720]] (old version only)
* [[Bootrom 359.3]] in [[S5L8920]] (old version only)
* [[Bootrom 240.5.1]] in [[S5L8720]] (new version only)
* [[Bootrom 359.3.2]] in [[S5L8920]] (new version only)
* [[Bootrom 359.5]] in [[S5L8922]]
* [[Bootrom 574.4]] in [[S5L8930]]
* [[Bootrom 838.3]] in [[S5L8940]]
* [[Bootrom 878.3]] in [[S5L8942]]
* [[Bootrom 1062.2]] in [[S5L8945]]
* [[Bootrom 1458.2]] in [[S5L8947]]
* [[Bootrom 1145.3]] in [[S5L8950]]
* [[Bootrom 1145.3.3]] in [[S5L8955]]
* [[Bootrom 1704.10]] in [[S5L8960]] and [[S5L8965]]
* [[Bootrom 1992.0.0.1.19]] in [[T7000]]
* [[Bootrom 1991.0.0.2.16‎]] in [[T7001]]
* unknown [[S7002]]
* [[Bootrom 2234.0.0.3.3]] in [[S8000]]
* [[Bootrom 2234.0.0.2.22]] in [[S8003]]

===[[S5L8900]], used in the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]]===
see also [[VROM (S5L8900)]]
* [[Bootrom Rev.2]]

===[[S5L8720]], used in the [[N72AP|iPod touch 2G]]===
* [[Bootrom 240.4]] "old bootrom"
* [[Bootrom 240.5.1]] "new bootrom"

===[[S5L8920]], used in the [[N88AP|iPhone 3GS]]===
* [[Bootrom 359.3]] "old bootrom"
* [[Bootrom 359.3.2]] "new bootrom"

===[[S5L8922]], used in the [[N18AP|iPod touch 3G]]===
* [[Bootrom 359.5]]

===[[S5L8930]], used in the [[K48AP|iPad]], [[N90AP|iPhone 4]], [[K66AP|Apple TV 2G]], and [[N81AP|iPod touch 4G]]===
* [[Bootrom 574.4]]

===[[S5L8940]], used in the [[iPad 2]] and [[N94AP|iPhone 4S]]===
* [[Bootrom 838.3]]

===[[S5L8942]], used in the [[K93AAP|iPad 2 (iPad2,4)]], [[J33AP|Apple TV 3G (AppleTV3,1)]], [[iPod touch 5G]], and [[iPad mini]] ===
* [[Bootrom 878.3]]


===[[S5L8945]], used in the [[iPad 3]]===
* [[Bootrom 1062.2]]

===[[S5L8947]], used in the [[J33IAP|Apple TV 3G (AppleTV3,2)]]===
* [[Bootrom 1458.2]]

===[[S5L8950]], used in the [[iPhone 5]] and [[iPhone 5c]] ===
* [[Bootrom 1145.3]]

===[[S5L8955]], used in the [[iPad 4]]===
* [[Bootrom 1145.3.3]]

===[[S5L8960]]/[[S5L8965]], used in the [[iPhone 5s]], [[iPad Air]], [[iPad mini 2]], and [[iPad mini 3]]===
* [[Bootrom 1704.10]]

===[[T7000]], used in the [[J42dAP|Apple TV 4G]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], and [[N102AP|iPod touch 6G]]===
* [[Bootrom 1992.0.0.1.19]]

===[[T7001]], used in the [[iPad Air 2]]===
* [[Bootrom 1991.0.0.2.16]]

===[[S7002]], used in the [[Apple Watch]]===
* unknown

===[[S8000]], used in the [[N71AP|iPhone 6s]], [[N66AP|iPhone 6s Plus]] and [[N69uAP|iPhone SE]]===
* [[Bootrom 2234.0.0.3.3]]

===[[S8001]], used in the [[iPad Pro]]===
* [[Bootrom 2481.0.0.2.1]]

===[[S8003]], used in the [[N71mAP|iPhone 6s]], [[N66mAP|iPhone 6s Plus]] and [[N69AP|iPhone SE]]===
* [[Bootrom 2234.0.0.2.22]]

===[[T8002]], used in the [[Apple Watch Series 1]] and [[Apple Watch Series 2]]===
* [[Bootrom 2651.0.0.1.31]]

===[[T8010]], used in the [[iPhone 7]] and [[iPhone 7 Plus]]===
* [[Bootrom 2696.0.0.1.33]]

== References ==
* [http://conference.hitb.org/hitbsecconf2013kul/materials/D2T1%20-%20Joshua%20'p0sixninja'%20Hill%20-%20SHAttered%20Dreams.pdf p0sixninja's presentation SHAttered Dreams - Adventures in BootROM Land]

[[Category:Bootrom]]

Talk:DCSD Cable

2016-08-23T03:55:05Z

P0sidonius: /* RE: Creating a new page rather than using the other page */ new section

== RE: Creating a new page rather than using the other page ==

I created this new page to separate the DCSD software from the hardware. hope this was OK. Please reformat as needed, a table would be nice. --[[User:P0sidonius|P0sidonius]] ([[User talk:P0sidonius|talk]]) 03:55, 23 August 2016 (UTC)

DCSD Cable

2016-08-23T03:53:20Z

P0sidonius: Created new page for DCSD hardware

The DCSD Alex cable is used in factories to communicate over serial to run tests and write to the SysCfg (for serial definitions, etc) during production. These cables are produced by Shenzhen Alex connector Co. Ltd. in China, I believe this is why they can be found on obscure markets for sale, if not just taken from a trashcan from factories.

== Factory DCSD "Alex" Lightning Serial Cable ==
[[File:DCSD_Front_annotated.jpg|400px|right|Annotated photo of the main DCSD PCB]]

'''Top of the board;'''

U1 / U2 - Micrel 2026A Dual-Channel Power Distribution Switch
:'''Datasheet;''' http://www.xilinx.com/products/boards/ml510/datasheets/mic2076-2bm.pdf

X1 - MKC 24Mhz Oscillator
:Notes;
::I'm not 100% sure about the value of the chip, but this should be correct

U3 - FTDI FT232RQ UART IC
:'''Usage;'''
::Handles stoplight LED controls
:'''Datasheet;''' http://www.ftdichip.com/Support/Documents/DataSheets/ICs/DS_FT232R.pdf

U4 - Micrel MIC5219
:'''Description;''' 500mA-Peak Output LDO Regulator
:'''Datasheet;''' http://datasheet.datasheetarchive.com/originals/library/Datasheets-EDS7/DSAEDA000124178.pdf

U5 - FTDI FT232RQ UART IC
:'''Usage;'''
::Handles serial mux interface from iPhone
:'''Datasheet;''' http://www.ftdichip.com/Support/Documents/DataSheets/ICs/DS_FT232R.pdf

U6 - SMSC USB2514 4-port USB hub
:'''Datasheet;''' http://www.mouser.com/catalog/specsheets/2514.pdf
:'''Notes;'''
::The use of this deprecates the previous "Y" style cable, which used two separate USB cables for serial and iPhone data communication
::Three ports are used;
:::iPhone Data USB
:::U4 FTDI IC
:::U5 FTDI IC

U7 - Microchip 24AA04/24LC04B
:'''Description;''' I2C Serial EEPROM(TSSOP Package)
:'''Datasheet;''' http://ww1.microchip.com/downloads/en/DeviceDoc/21708G.pdf

D1 / D6 / D5 - Torex XC6215
:'''Description;''' A Low Power Consumption Voltage Regulator with ON/OFF Switch
:'''Datasheet;''' http://www.s-manuals.com/pdf/datasheet/x/c/xc6215_series_torex.pdf
:'''Notes;'''
::D6 is tied to TX and an input voltage of 3.3v on the UART J5 pads, this may be a protection in case the host shorts?

'''Back of the board;'''

J11 / J10 / J9 / J12
:I believe these are used to flash the U7 EEPROM with USB IDs for use by the SMSC USB Hub, I have yet to dump the contents of the EEPROM to find out for sure.

'''Other notes;'''
:The lightning connector has a specific Accessory ID flashed to it for enabling serial via the Tristar chip.
:This PCB is quite easy to replicate, but without the proper Accessory ID you will need to mimic the protocol similar to how key2fr did in his [http://ramtin-amin.fr/#tristar research].
:In theory, you can use the Tristar for JTAG through a similar board, but JTAG gets enabled by the device during boot due to production fusing status.

File:DCSD Front annotated.jpg

2016-08-23T03:48:05Z

P0sidonius: Annotated photo of DCSD Serial Cable PCB

Annotated photo of DCSD Serial Cable PCB

User:P0sidonius

2016-08-20T00:26:15Z

P0sidonius: Added my userpage

i am p0sidonius

interests;

hardware research and exploitation

proprietary tools reversing

----

contact @ p0sidonius0xff@gmail.com