The iPhone Wiki - User contributions [en]

Decrypting Firmwares

2009-09-29T19:44:39Z

Padraig:

==1.0.x==
If you want to decrypt 1.0.x iPhone ramdisk you must remove some trash from the beginning of them. You can do this in Terminal.app (on Mac OS X you can find them in /Applications/Utilities/).

Unzip firmware image (change extension .ipsw to .zip and double click on archive) and find restore ramdisk. In Terminal.app enter simple command:

''dd if=restore_ramdisk.dmg of=restore_ramdisk.stripped.dmg bs=512 skip=4 count=37464 conv=sync''

Where '''restore_ramdisk.dmg''' is image of restore ramdisk (for example 1.0 iPhone firmware restore ramdisk is 694-5259-38.dmg), and '''restore_ramdisk.stripped.dmg''' is 'decrypted' image, that you can mount and explore from Finder.

Note: If after mounting stripped ramdisk you see errors, ignore them.

==1.1.x==
To decrypt the 1.1.x ramdisk, strip the first 0x800 bytes. I'm not proficient in dd, but the above command could be modified for this, or it could be done in a hex editor. Once that's complete, run this command:

''openssl enc -d -in ramdisk.dmg -out de.dmg -aes-128-cbc -K 188458A6D15034DFE386F23B61D43774 -iv 0''

This uses the iPhone's 0x837 key which was first leaked by Zibri and had its purpose revealed on Geohot's blog.

==2.x+==
The ramdisk on both 2.x and 3.x firmwares is a simple [[IMG3_File_Format|img3 file]], that you can decrypt using [http://code.google.com/p/img3decrypt/ img3decrypt] or [http://github.com/planetbeing/xpwn/tree/master xpwntool]. You must download one of these utilities. For easier access, put them in '''/usr/local/bin'''

If you're using img3decrypt use this:
''img3decrypt e restore_ramdisk.dmg restore_ramdisk_decrypted.dmg Ramdisk_IV Ramdisk_Key''

Use this if you're using xpwntool on a mac:
''xpwntool restore_ramdisk.dmg restore_ramdisk_decrypted.dmg -k Ramdisk_Key -iv Ramdisk_IV''

or on Windows:
"xpwntool.exe restore_ramdisk.dmg restore_ramdisk_decrypted.dmg -k Ramdisk_Key -iv Ramdisk_IV"

Where '''restore_ramdisk.dmg''' is image of restore ramdisk (for example 3.0 beta 1 iPhone GSM firmware restore ramdisk is 018-4793-1.dmg), and '''restore_ramdisk_decrypted.dmg''' is decrypted image, that you can mount and explore from Finder. Ramdisk_IV and Ramdisk_Key is a decrypted keys that you can find in [[VFDecrypt_Keys:_3.x|vfdecrypt page]] or in Info.plist from PwnageTool FirmwareBundles folder (when Dev Team include support for this firmware).

Because of the new HFS Compression used in Snow Leopard and 3.0 DMGs, you may see zero-sized files in the DMG if you don't use Snow Leopard. In order to extract those, check [[Talk:Ramdisk Decryption]].

Firmware Keys

2009-09-29T19:40:12Z

Padraig:

== Introduction ==
These keys are for use with the 'vfdecrypt' tool to decrypt the main filesystem DMG found in every iPhone/iPhone 3G/iPod touch .ipsw file. Every key will work on the main filesystem DMG for that build, regardless if it is for the iPhone or iPod touch unless specified. The DMG that you are after is the bigger one, in the case of current builds of 2.0, it can sometimes be 200+ MB!

== VFDecrypt Usage ==
./vfdecrypt -i <dmg> -o decrypted_fs.dmg -k <key> or vfdecrypt.exe -i <dmg> -o decrypted_fs.dmg -k <key>

== Gaps ==
As you will notice, there may be a gap or two, or a key for a current build that is not there. Please feel free to add them, but please be sure that it is only the key for a User or Developer build, as if you gave the key for another type of build that might or may not be out there '''people could get in trouble, and we do not want that'''. Thanks for contributing!

== Downloads ==

* http://rgov.org/files/vfdecrypt-mac.zip (Mac OS X Universal)
* http://iphoneelite.googlecode.com/files/vfdecrypt.zip (Windows)

* Source Credit: http://lorenzo.yellowspace.net/corrupt-sparseimage.html

== Firmwares ==
* [[VFDecrypt Keys: 1.x|1.x]]
* [[VFDecrypt Keys: 2.x|2.x]]
* [[VFDecrypt Keys: 3.x BETA|3.x Beta]]
* [[VFDecrypt Keys: 3.x|3.x]]

== See also ==
* [[System]] - a page with links to download the firmware images

[[Category:VFDecrypt]]

Firmware Keys

2009-09-29T19:39:28Z

Padraig:

== Introduction ==
These keys are for use with the 'vfdecrypt' tool to decrypt the main filesystem DMG found in every iPhone/iPhone 3G/iPod touch .ipsw file. Every key will work on the main filesystem DMG for that build, regardless if it is for the iPhone or iPod touch unless specified. The DMG that you are after is the bigger one, in the case of current builds of 2.0, it can sometimes be 200+ MB!

== VFDecrypt Usage ==
./vfdecrypt -i <dmg> -o decrypted_fs.dmg -k <key>

or

vfdecrypt.exe -i <dmg> -o decrypted_fs.dmg -k <key>

== Gaps ==
As you will notice, there may be a gap or two, or a key for a current build that is not there. Please feel free to add them, but please be sure that it is only the key for a User or Developer build, as if you gave the key for another type of build that might or may not be out there '''people could get in trouble, and we do not want that'''. Thanks for contributing!

== Downloads ==

* http://rgov.org/files/vfdecrypt-mac.zip (Mac OS X Universal)
* http://iphoneelite.googlecode.com/files/vfdecrypt.zip (Windows)

* Source Credit: http://lorenzo.yellowspace.net/corrupt-sparseimage.html

== Firmwares ==
* [[VFDecrypt Keys: 1.x|1.x]]
* [[VFDecrypt Keys: 2.x|2.x]]
* [[VFDecrypt Keys: 3.x BETA|3.x Beta]]
* [[VFDecrypt Keys: 3.x|3.x]]

== See also ==
* [[System]] - a page with links to download the firmware images

[[Category:VFDecrypt]]

Firmware Keys

2009-09-29T19:39:07Z

Padraig:

== Introduction ==
These keys are for use with the 'vfdecrypt' tool to decrypt the main filesystem DMG found in every iPhone/iPhone 3G/iPod touch .ipsw file. Every key will work on the main filesystem DMG for that build, regardless if it is for the iPhone or iPod touch unless specified. The DMG that you are after is the bigger one, in the case of current builds of 2.0, it can sometimes be 200+ MB!

== VFDecrypt Usage ==
./vfdecrypt -i <dmg> -o decrypted_fs.dmg -k <key>
or
vfdecrypt.exe -i <dmg> -o decrypted_fs.dmg -k <key>

== Gaps ==
As you will notice, there may be a gap or two, or a key for a current build that is not there. Please feel free to add them, but please be sure that it is only the key for a User or Developer build, as if you gave the key for another type of build that might or may not be out there '''people could get in trouble, and we do not want that'''. Thanks for contributing!

== Downloads ==

* http://rgov.org/files/vfdecrypt-mac.zip (Mac OS X Universal)
* http://iphoneelite.googlecode.com/files/vfdecrypt.zip (Windows)

* Source Credit: http://lorenzo.yellowspace.net/corrupt-sparseimage.html

== Firmwares ==
* [[VFDecrypt Keys: 1.x|1.x]]
* [[VFDecrypt Keys: 2.x|2.x]]
* [[VFDecrypt Keys: 3.x BETA|3.x Beta]]
* [[VFDecrypt Keys: 3.x|3.x]]

== See also ==
* [[System]] - a page with links to download the firmware images

[[Category:VFDecrypt]]

Greenpois0n (jailbreak)

2009-09-27T10:40:44Z

Padraig:

The tool that will soon be released for jailbreaking 3.1 on all devices. Even the iPod touch 3G.

It uses a previously unreleased exploit that is yet to be announced.

Here is a video made by Chronic of him proving that the exploit does in fact work on the iPod touch 3G: http://qik.ly/f4M8.

N18AP

2009-09-15T15:07:43Z

Padraig:

{{DISPLAYTITLE:iPod touch 3G}}
This is the 3rd Generation [[N45ap|iPod Touch]]. It was announced on September 9th, 2009. It makes a small improvement over the [[N72ap|previous generation]]; adding a faster processor, doubling the ram, increasing storage capacity, etc.

==Application Processor==
It makes use of the [[S5L8922]] application processor. No other known device uses this processor; however, the iPhone 3GS uses the similar [[S5L8920]].

==Wifi Chip==
[[BCM4329]] Wifi B/G/N, Bluetooth, FM Transmit/Receive

==Specifications==