The iPhone Wiki - User contributions [en]

Firmware Keys

2014-02-07T10:06:26Z

R3pwn: /* History */

__NOTOC__
'''Firmware Keys''' are keys which decrypt the [[:/|root filesystem]] of certain ([[Beta Firmware|beta]]) [[firmware]]s. Apple uses a to ensure the safety of their files. Over time Apple has changed the way to encrypt firmware files, thus the way to decrypt files as well as the way to get the keys has also.

== History ==
With the release of the iPhone came the [[S5L File Formats#IMG2|IMG2]] file format. They were used on all known [[iOS|iPhone OS]] [[#1.x|1.x]] firmwares. For the 1.1.x series, they were encrypted with the [[AES Keys#Key 0x837|0x837 key]]. The discovery of the 0x837 key led to the ability to decrypt ''any'' 1.x firmware.

Following IMG2 came the [[IMG3 File Format|IMG3]] file format. They were introduced with iPhone OS [[#1.x.2F2.x|2.0b4]], and have been in use ever since. In order to maintain their integrity, they contain multiple layers of encryption, all based around a [[wikipedia:Public-key cryptography|public/private key]] encryption method. Apple took encryption seriously with IMG3 by utilizing [[wikipedia:Advanced Encryption Standard|AES]] (based on the [[wikipedia:Rijndael key schedule|Rinjndael key schedule]]). In order to complicate things, they contain the [[VFDecrypt]] key, albeit encrypted, as part of the [[KBAG]] structure in the [[ramdisk]]s.

The ramdisk keys can ''only'' be retrieved with the processor specific [[GID Key]]. The GID key is currently unretrievable and can only be utilized through the built-in [[AES Keys|AES engine]]. To complicate things ''even more'', the engine is only accessible through a special [[bootrom]] or [[iBoot]] exploit ([[jailbreak]]s typically expose it with [[:/dev/aes_0]]). This makes usage of the key nearly impossible.

However, once you have access to the AES engine, the entire system falls apart. You are able to upload an encrypted ramdisk and grab the decryption keys for it. Once you manage to decrypt the ramdisk, you can run it through [[GenPass]] to decrypt the Firmware key.

Beginning with iOS 6.0b1, Apple tweaked their disk images so they no longer work with VFDecrypt. VFDecrypt will report that the filesystem is decrypted, but you will be unable to mount it. The current workaround is to use [[dmg]] from [[Xpwn]] to decrypt them. What has changed to break VFDecrypt is currently unknown. Decryption will take slightly longer due to dmg writing its progress to the terminal, but the difference is negligible.

To find the keys, you can either use the the methods on [[AES Keys]] or the easier option, for OS X, [[keylimepie]].

== Decrypting ==
{{main|Decrypting Firmwares}}

== Notes ==
{| class="wikitable" style="float: right;"
|-
! Application Processor
! [[iDevice]]
|-
| [[S5L8900]]
| [[m68ap|iPhone 2G]] [[n82ap|iPhone 3G]] [[n45ap|iPod touch 1G]]
|-
| [[S5L8720]]
| [[n72ap|iPod touch 2G]]
|-
| [[S5L8920]]
| [[n88ap|iPhone 3GS]]
|-
| [[S5L8922]]
| [[n18ap|iPod touch 3G]]
|-
| [[S5L8930]] (A4)
| [[k48ap|iPad 1G]] [[iPhone 4]] [[n81ap|iPod touch 4G]] [[k66ap|Apple TV 2G]]
|-
| [[S5L8940]] (A5)
| [[iPad 2]] [[n94ap|iPhone 4S]]
|-
| [[S5L8942]] (A5 Rev A)
| [[k93aap|iPad 2 (Wi‑Fi) [Rev A]<nowiki/>]] [[j33ap|Apple TV 3G]] [[iPod touch 5G]] [[iPad mini 1G]]
|-
| [[S5L8945]] (A5X)
| [[iPad 3]]
|-
| [[S5L8947]] (A5 Rev B)
| [[j33iap|Apple TV 3G (Rev A)]]
|-
| [[S5L8950]] (A6)
| [[iPhone 5]] [[iPhone 5c]]
|-
| [[S5L8955]] (A6X)
| [[iPad 4]]
|-
| [[S5L8960]] (A7)
| [[iPhone 5s]], [[iPad mini 2G]]
|-
| [[S5L8965]] (A7 Rev A)
| [[iPad Air]]
|}

Certain files share the same key and IV per [[Application Processor|application processor]] (per build) provided the devices have the same pixel resolution:
* [[Update Ramdisk]]
* [[Restore Ramdisk]]
* [[AppleLogo]]
* [[BatteryCharging0]]
* [[BatteryCharging1]]
* [[BatteryFull]]
* [[BatteryLow0]]
* [[BatteryLow1]]
* [[GlyphCharging]]
* [[GlyphPlugin]]
* [[Kernelcache]]
* [[NeedService]]
* [[RecoveryMode]]
* [[WTF]]

The table on the right lists the application processors and their corresponding devices. This list is also accessable from the [[Main Page|main page]].

You can use [[img3decrypt]] or [[xpwntool]] to decrypt these files as described in [[Decrypting Firmwares]]. Once done, mount or extract using the tool of your choice.

When posting a key page, please use the [[Template:Keys|key template]].

The firmware version number for the [[Apple TV]] builds are the ones that the Apple TV reports (also known as the "marketing version").

All dates are relative to [[wikipedia:Coordinated Universal Time|UTC]].

You cannot get A5+ keys until a bootrom exploit is found. If the ramdisk is not encrypted, you may then get the RootFS key ONLY.

== Firmware Versions ==
{{see also|Prototypes}}
This is a full and comprehensive list of all firmwares Apple Inc. has made available to the public in some way, be it the [[Apple Developer|dev center]] or [[iTunes]].
=== Final ===
{{main|Firmware}}
==== 1.x ====
{| class="wikitable"
|-
! rowspan="2" | Date
! rowspan="2" | Build
! [[iPhone]]
! [[iPod touch]]
|-
! [[m68ap|2G]]
! [[n45ap|1G]]
|-
| 29 Jun 2007
! style="text-align:left;" | 1A543a
| class="rborderplz" | [[Heavenly 1A543a (iPhone)|1.0]]
| rowspan="3" {{n/a}}
|-
| 31 Jul 2007
! style="text-align:left;" | 1C25
| class="rborderplz" | [[SUHeavenlyJuly 1C25 (iPhone)|1.0.1]]
|-
| 21 Aug 2007
! style="text-align:left;" | 1C28
| class="rborderplz" | [[SUHeavenlyJuly 1C28 (iPhone)|1.0.2]]
|-
| rowspan="2" | 14 Sep 2007
! style="text-align:left;" | 3A100a
| rowspan="2" {{n/a}}
| [[Snowbird 3A100a (iPod touch)|1.1]]
|-
! style="text-align:left;" | 3A101a
| [[Snowbird 3A101a (iPod touch)|1.1]]
|-
| rowspan="2" | 27 Sep 2007
! style="text-align:left;" | 3A109a
| [[Snowbird 3A109a (iPhone)|1.1.1]]
| {{n/a}}
|-
! style="text-align:left;" | 3A110a
| {{n/a}}
| [[Snowbird 3A110a (iPod touch)|1.1.1]]
|-
| 12 Nov 2007
! style="text-align:left;" | 3B48b
| [[Oktoberfest 3B48b (iPhone)|1.1.2]]
| [[Oktoberfest 3B48b (iPod touch)|1.1.2]]
|-
| 15 Jan 2008
! style="text-align:left;" | 4A93
| [[Little Bear 4A93 (iPhone)|1.1.3]]
| [[Little Bear 4A93 (iPod touch)|1.1.3]]
|-
| 26 Feb 2008
! style="text-align:left;" | 4A102
| [[Little Bear 4A102 (iPhone)|1.1.4]]
| [[Little Bear 4A102 (iPod touch)|1.1.4]]
|-
| 14 Jul 2008
! style="text-align:left;" | 4B1
| {{n/a}}
| [[Little Bear 4B1 (iPod touch)|1.1.5]]
|}

==== 2.x ====
{| class="wikitable"
|-
! rowspan="2" | Date
! rowspan="2" | Build
! colspan="2" | [[iPhone]]
! colspan="2" | [[iPod touch]]
|-
! [[m68ap|2G]]
! [[n82ap|3G]]
! [[n45ap|1G]]
! [[n72ap|2G]]
|-
| rowspan="2" | 11 Jul 2008
! style="text-align:left;" | 5A345
| {{n/a}}
| [[Big Bear 5A345 (iPhone 3G)|2.0]]
| {{n/a}}
| rowspan="6" {{n/a}}
|-
! style="text-align:left;" | 5A347
| [[Big Bear 5A347 (iPhone)|2.0]]
| [[Big Bear 5A347 (iPhone 3G)|2.0]]
| class="rborderplz" | [[Big Bear 5A347 (iPod touch)|2.0]]
|-
| 4 Aug 2008
! style="text-align:left;" | 5B108
| [[Big Bear 5B108 (iPhone)|2.0.1]]
| [[Big Bear 5B108 (iPhone 3G)|2.0.1]]
| class="rborderplz" | [[Big Bear 5B108 (iPod touch)|2.0.1]]
|-
| 18 Aug 2008
! style="text-align:left;" | 5C1
| [[Big Bear 5C1 (iPhone)|2.0.2]]
| [[Big Bear 5C1 (iPhone 3G)|2.0.2]]
| class="rborderplz" | [[Big Bear 5C1 (iPod touch)|2.0.2]]
|-
| 12 Sep 2008
! style="text-align:left;" | 5F136
| [[Sugar Bowl 5F136 (iPhone)|2.1]]
| [[Sugar Bowl 5F136 (iPhone 3G)|2.1]]
| {{n/a|class=rborderplz}}
|-
| rowspan="2" | 9 Sep 2008
! style="text-align:left;" | 5F137
| colspan="2" {{n/a}}
| class="rborderplz" | [[Sugar Bowl 5F137 (iPod touch)|2.1]]
|-
! style="text-align:left;" | 5F138
| colspan="3" {{n/a}}
| [[Sugar Bowl 5F138 (iPod touch 2G)|2.1.1]]
|-
| rowspan="2" | 21 Nov 2008
! style="text-align:left;" | 5G77
| [[Timberline 5G77 (iPhone)|2.2]]
| [[Timberline 5G77 (iPhone 3G)|2.2]]
| [[Timberline 5G77 (iPod touch)|2.2]]
| {{n/a}}
|-
! style="text-align:left;" | 5G77a
| colspan="3" {{n/a}}
| [[Timberline 5G77a (iPod touch 2G)|2.2]]
|-
| rowspan="2" | 27 Jan 2009
! style="text-align:left;" | 5H11
| [[SUTimberline 5H11 (iPhone)|2.2.1]]
| [[SUTimberline 5H11 (iPhone 3G)|2.2.1]]
| [[SUTimberline 5H11 (iPod touch)|2.2.1]]
| {{n/a}}
|-
! style="text-align:left;" | 5H11a
| colspan="3" {{n/a}}
| [[SUTimberline 5H11a (iPod touch 2G)|2.2.1]]
|}

==== 3.x ====
{| class="wikitable"
|-
! rowspan="2" | Date
! rowspan="2" | Build
! [[iPad]]
! colspan="3" | [[iPhone]]
! colspan="3" | [[iPod touch]]
|-
! [[k48ap|1G]]
! [[m68ap|2G]]
! [[n82ap|3G]]
! [[n88ap|3GS]]
! [[n45ap|1G]]
! [[n72ap|2G]]
! [[n18ap|3G]]
|-
| 17 Jun 2009
! style="text-align:left;" | 7A341
| rowspan="3" {{n/a}}
| [[Kirkwood 7A341 (iPhone)|3.0]]
| [[Kirkwood 7A341 (iPhone 3G)|3.0]]
| [[Kirkwood 7A341 (iPhone 3GS)|3.0]]
| [[Kirkwood 7A341 (iPod touch)|3.0]]
| [[Kirkwood 7A341 (iPod touch 2G)|3.0]]
| {{n/a}}
|-
| 31 Jul 2009
! style="text-align:left;" | 7A400
| [[Kirkwood 7A400 (iPhone)|3.0.1]]
| [[Kirkwood 7A400 (iPhone 3G)|3.0.1]]
| [[Kirkwood 7A400 (iPhone 3GS)|3.0.1]]
| colspan="3" rowspan="2" {{n/a}}
|-
| rowspan="2" | 9 Sep 2009
! style="text-align:left;" | 7C144
| [[Northstar 7C144 (iPhone)|3.1]]
| [[Northstar 7C144 (iPhone 3G)|3.1]]
| class="rborderplz" | [[Northstar 7C144 (iPhone 3GS)|3.1]]
|-
! style="text-align:left;" | 7C145
| colspan="4" {{n/a}}
| [[Northstar 7C145 (iPod touch)|3.1.1]]
| [[Northstar 7C145 (iPod touch 2G)|3.1.1]]
| [[Northstar 7C145 (iPod touch 3G)|3.1.1]]
|-
| 17 Sep 2009
! style="text-align:left;" | 7C146
| colspan="6" {{n/a}}
| [[Northstar 7C146 (iPod touch 3G)|3.1.1]]
|-
| 8 Oct 2009
! style="text-align:left;" | 7D11
| rowspan="2" {{n/a}}
| [[Northstar 7D11 (iPhone)|3.1.2]]
| [[Northstar 7D11 (iPhone 3G)|3.1.2]]
| [[Northstar 7D11 (iPhone 3GS)|3.1.2]]
| [[Northstar 7D11 (iPod touch)|3.1.2]]
| [[Northstar 7D11 (iPod touch 2G)|3.1.2]]
| [[Northstar 7D11 (iPod touch 3G)|3.1.2]]
|-
| 2 Feb 2010
! style="text-align:left;" | 7E18
| [[SUNorthstarTwo 7E18 (iPhone)|3.1.3]]
| [[SUNorthstarTwo 7E18 (iPhone 3G)|3.1.3]]
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|3.1.3]]
| [[SUNorthstarTwo 7E18 (iPod touch)|3.1.3]]
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|3.1.3]]
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|3.1.3]]
|-
| 3 Apr 2010
! style="text-align:left;" | 7B367
| [[Wildcat 7B367 (iPad)|3.2]]
| colspan="6" rowspan="3" {{n/a|class=brradiusplz}}
|-
| 15 Jul 2010
! style="text-align:left;" | 7B405
| class="rborderplz" | [[Wildcat 7B405 (iPad)|3.2.1]]
|-
| 11 Aug 2010
! style="text-align:left;" | 7B500
| class="noradiusplz rborderplz" | [[Wildcat 7B500 (iPad)|3.2.2]]
|}

==== 4.x ====
{| class="wikitable"
|-
! rowspan="3" | Date
! rowspan="3" | Build
! [[Apple TV]]
! colspan="4" | [[iPad]]
! colspan="4" | [[iPhone]]
! colspan="3" | [[iPod touch]]
|-
! rowspan="2" | [[k66ap|2G]]
! rowspan="2" | [[k48ap|1G]]
! colspan="3" | [[iPad 2|2]]
! rowspan="2" | [[n82ap|3G]]
! rowspan="2" | [[n88ap|3GS]]
! colspan="2" | [[iPhone 4|4]]
! rowspan="2" | [[n72ap|2G]]
! rowspan="2" | [[n18ap|3G]]
! rowspan="2" | [[n81ap|4G]]
|-
! [[k93ap|Wi‑Fi]]
! [[k94ap|GSM]]
! [[k95ap|CDMA]]
! [[n90ap|GSM]]
! class="rborderplz" | [[n92ap|CDMA]]
|-
| 1 Sep 2010
! style="text-align:left;" | 8M89
| [[Mojave 8M89 (Apple TV 2G)|4.1]]
| colspan="11" {{n/a}}
|-
| 21 Jun 2010
! style="text-align:left;" | 8A293
| rowspan="4" colspan="5" {{n/a}}
| [[Apex 8A293 (iPhone 3G)|4.0]]
| [[Apex 8A293 (iPhone 3GS)|4.0]]
| [[Apex 8A293 (iPhone 4 GSM)|4.0]]
| {{n/a}}
| [[Apex 8A293 (iPod touch 2G)|4.0]]
| [[Apex 8A293 (iPod touch 3G)|4.0]]
| {{n/a}}
|-
| 15 Jul 2010
! style="text-align:left;" | 8A306
| [[Apex 8A306 (iPhone 3G)|4.0.1]]
| [[Apex 8A306 (iPhone 3GS)|4.0.1]]
| [[Apex 8A306 (iPhone 4 GSM)|4.0.1]]
| colspan="4" {{n/a}}
|-
| 11 Aug 2010
! style="text-align:left;" | 8A400
| [[Apex 8A400 (iPhone 3G)|4.0.2]]
| [[Apex 8A400 (iPhone 3GS)|4.0.2]]
| [[Apex 8A400 (iPhone 4 GSM)|4.0.2]]
| rowspan="2" {{n/a}}
| [[Apex 8A400 (iPod touch 2G)|4.0.2]]
| [[Apex 8A400 (iPod touch 3G)|4.0.2]]
| {{n/a}}
|-
| 8 Sep 2010
! style="text-align:left;" | 8B117
| [[Baker 8B117 (iPhone 3G)|4.1]]
| [[Baker 8B117 (iPhone 3GS)|4.1]]
| [[Baker 8B117 (iPhone 4 GSM)|4.1]]
| [[Baker 8B117 (iPod touch 2G)|4.1]]
| [[Baker 8B117 (iPod touch 3G)|4.1]]
| [[Baker 8B117 (iPod touch 4G)|4.1]]
|-
| 21 Sep 2010
! style="text-align:left;" | 8B118
| colspan="11" {{n/a}}
| [[Baker 8B118 (iPod touch 4G)|4.1]]
|-
| rowspan="2" | 22 Nov 2010
! style="text-align:left;" | 8C148
| {{n/a}}
| [[Jasper 8C148 (iPad)|4.2.1]]
| colspan="3" {{n/a}}
| [[Jasper 8C148 (iPhone 3G)|4.2.1]]
| {{n/a}}
| [[Jasper 8C148 (iPhone 4 GSM)|4.2.1]]
| {{n/a}}
| [[Jasper 8C148 (iPod touch 2G)|4.2.1]]
| [[Jasper 8C148 (iPod touch 3G)|4.2.1]]
| [[Jasper 8C148 (iPod touch 4G)|4.2.1]]
|-
! style="text-align:left;" | 8C148a
| colspan="6" {{n/a}}
| [[Jasper 8C148a (iPhone 3GS)|4.2.1]]
| colspan="5" {{n/a}}
|-
| 22 Nov 2010
! style="text-align:left;" | 8C150
| [[Jasper 8C150 (Apple TV 2G)|4.2]]
| rowspan="2" colspan="11" {{n/a}}
|-
| 14 Dec 2010
! style="text-align:left;" | 8C154
| class="rborderplz" | [[Jasper 8C154 (Apple TV 2G)|4.2.1]]
|-
| 7 Feb 2011
! style="text-align:left;" | 8E128
| colspan="8" rowspan="6" {{n/a}}
| [[Phoenix 8E128 (iPhone 4 CDMA)|4.2.5]]
| colspan="3" rowspan="6" {{n/a}}
|-
| 10 Feb 2011
! style="text-align:left;" | 8E200
| class="rborderplz" | [[Phoenix 8E200 (iPhone 4 CDMA)|4.2.6]]
|-
| 14 Apr 2011
! style="text-align:left;" | 8E303
| class="rborderplz" | [[Phoenix 8E303 (iPhone 4 CDMA)|4.2.7]]
|-
| 4 May 2011
! style="text-align:left;" | 8E401
| class="rborderplz" | [[Phoenix 8E401 (iPhone 4 CDMA)|4.2.8]]
|-
| 15 Jul 2011
! style="text-align:left;" | 8E501
| class="rborderplz" | [[Phoenix 8E501 (iPhone 4 CDMA)|4.2.9]]
|-
| 25 Jul 2011
! style="text-align:left;" | 8E600
| class="rborderplz" | [[Phoenix 8E600 (iPhone 4 CDMA)|4.2.10]]
|-
| rowspan="2" | 9 Mar 2011
! style="text-align:left;" | 8F190
| {{n/a}}
| [[Durango 8F190 (iPad)|4.3]]
| colspan="4" {{n/a}}
| [[Durango 8F190 (iPhone 3GS)|4.3]]
| [[Durango 8F190 (iPhone 4 GSM)|4.3]]
| colspan="2" {{n/a}}
| [[Durango 8F190 (iPod touch 3G)|4.3]]
| [[Durango 8F190 (iPod touch 4G)|4.3]]
|-
! style="text-align:left;" | 8F191
| colspan="2" {{n/a}}
| [[Durango 8F191 (iPad 2 Wi-Fi)|4.3]]
| [[Durango 8F191 (iPad 2 GSM)|4.3]]
| [[Durango 8F191 (iPad 2 CDMA)|4.3]]
| colspan="7" {{n/a}}
|-
| 11 Mar 2011
! style="text-align:left;" | 8F191m
| [[Durango 8F191m (Apple TV 2G)|4.3]]
| rowspan="4" colspan="11" {{n/a}}
|-
| 22 Mar 2011
! style="text-align:left;" | 8F202
| class="rborderplz" | [[DurangoTide 8F202 (Apple TV 2G)|4.3]]
|-
| 10 May 2011
! style="text-align:left;" | 8F305
| class="rborderplz" | [[DurangoTide 8F305 (Apple TV 2G)|4.3]]
|-
| 1 Aug 2011
! style="text-align:left;" | 8F455
| class="rborderplz" | [[DurangoTideCuba 8F455 (Apple TV 2G)|4.3]]
|-
| 25 Mar 2011
! style="text-align:left;" | 8G4
| rowspan="2" {{n/a}}
| [[Durango 8G4 (iPad)|4.3.1]]
| [[Durango 8G4 (iPad 2 Wi-Fi)|4.3.1]]
| [[Durango 8G4 (iPad 2 GSM)|4.3.1]]
| [[Durango 8G4 (iPad 2 CDMA)|4.3.1]]
| {{n/a}}
| [[Durango 8G4 (iPhone 3GS)|4.3.1]]
| [[Durango 8G4 (iPhone 4 GSM)|4.3.1]]
| colspan="2" rowspan="2" {{n/a}}
| [[Durango 8G4 (iPod touch 3G)|4.3.1]]
| [[Durango 8G4 (iPod touch 4G)|4.3.1]]
|-
| rowspan="2" | 14 Apr 2011
! style="text-align:left;" | 8H7
| [[Durango 8H7 (iPad)|4.3.2]]
| [[Durango 8H7 (iPad 2 Wi-Fi)|4.3.2]]
| [[Durango 8H7 (iPad 2 GSM)|4.3.2]]
| colspan="2" {{n/a}}
| [[Durango 8H7 (iPhone 3GS)|4.3.2]]
| [[Durango 8H7 (iPhone 4 GSM)|4.3.2]]
| [[Durango 8H7 (iPod touch 3G)|4.3.2]]
| [[Durango 8H7 (iPod touch 4G)|4.3.2]]
|-
! style="text-align:left;" | 8H8
| colspan="4" {{n/a}}
| [[Durango 8H8 (iPad 2 CDMA)|4.3.2]]
| colspan="7" {{n/a}}
|-
| rowspan="2" | 4 May 2011
! style="text-align:left;" | 8J2
| colspan="2" {{n/a}}
| [[Durango 8J2 (iPad 2 Wi-Fi)|4.3.3]]
| [[Durango 8J2 (iPad 2 GSM)|4.3.3]]
| [[Durango 8J2 (iPad 2 CDMA)|4.3.3]]
| {{n/a}}
| [[Durango 8J2 (iPhone 3GS)|4.3.3]]
| [[Durango 8J2 (iPhone 4 GSM)|4.3.3]]
| colspan="2" {{n/a}}
| [[Durango 8J2 (iPod touch 3G)|4.3.3]]
| [[Durango 8J2 (iPod touch 4G)|4.3.3]]
|-
! style="text-align:left;" | 8J3
| rowspan="3" {{n/a}}
| [[Durango 8J3 (iPad)|4.3.3]]
| colspan="10" {{n/a}}
|-
| 15 Jul 2011
! style="text-align:left;" | 8K2
| [[Durango 8K2 (iPad)|4.3.4]]
| [[Durango 8K2 (iPad 2 Wi-Fi)|4.3.4]]
| [[Durango 8K2 (iPad 2 GSM)|4.3.4]]
| [[Durango 8K2 (iPad 2 CDMA)|4.3.4]]
| rowspan="2" {{n/a}}
| [[Durango 8K2 (iPhone 3GS)|4.3.4]]
| [[Durango 8K2 (iPhone 4 GSM)|4.3.4]]
| colspan="2" rowspan="2" {{n/a}}
| [[Durango 8K2 (iPod touch 3G)|4.3.4]]
| [[Durango 8K2 (iPod touch 4G)|4.3.4]]
|-
| 25 Jul 2011
! style="text-align:left;" | 8L1
| [[Durango 8L1 (iPad)|4.3.5]]
| [[Durango 8L1 (iPad 2 Wi-Fi)|4.3.5]]
| [[Durango 8L1 (iPad 2 GSM)|4.3.5]]
| [[Durango 8L1 (iPad 2 CDMA)|4.3.5]]
| [[Durango 8L1 (iPhone 3GS)|4.3.5]]
| [[Durango 8L1 (iPhone 4 GSM)|4.3.5]]
| [[Durango 8L1 (iPod touch 3G)|4.3.5]]
| [[Durango 8L1 (iPod touch 4G)|4.3.5]]
|}

==== 5.x ====
{| class="wikitable"
|-
! rowspan="3" | Date
! rowspan="3" | Build
! colspan="2" | [[Apple TV]]
! colspan="8" | [[iPad]]
! colspan="4" | [[iPhone]]
! colspan="2" | [[iPod touch]]
|-
! rowspan="2" | [[k66ap|2G]]
! rowspan="2" | [[j33ap|3G]]
! rowspan="2" | [[k48ap|1G]]
! colspan="4" | [[iPad 2|2]]
! colspan="3" | [[iPad 3|3]]
! rowspan="2" | [[n88ap|3GS]]
! colspan="2" | [[iPhone 4|4]]
! rowspan="2" | [[n94ap|4S]]
! rowspan="2" | [[n18ap|3G]]
! rowspan="2" | [[n81ap|4G]]
|-
! [[k93ap|Wi‑Fi]]
! [[k94ap|GSM]]
! [[k95ap|CDMA]]
! [[k93aap|Wi‑Fi (A)]]
! [[j1ap|Wi-Fi]]
! [[j2ap|CDMA]]
! [[j2aap|Global]]
! [[n90ap|GSM]]
! class="rborderplz" | [[n92ap|CDMA]]
|-
| rowspan="2" | 12 Oct 2011
! style="text-align:left;" | 9A334
| colspan="2" {{n/a}}
| [[Telluride 9A334 (iPad)|5.0]]
| [[Telluride 9A334 (iPad 2 Wi-Fi)|5.0]]
| [[Telluride 9A334 (iPad 2 GSM)|5.0]]
| [[Telluride 9A334 (iPad 2 CDMA)|5.0]]
| colspan="4" {{n/a}}
| [[Telluride 9A334 (iPhone 3GS)|5.0]]
| [[Telluride 9A334 (iPhone 4 GSM)|5.0]]
| [[Telluride 9A334 (iPhone 4 CDMA)|5.0]]
| [[Telluride 9A334 (iPhone 4S)|5.0]]
| [[Telluride 9A334 (iPod touch 3G)|5.0]]
| [[Telluride 9A334 (iPod touch 4G)|5.0]]
|-
! style="text-align:left;" | 9A334v
| [[Telluride 9A334v (Apple TV 2G)|4.4]]
| rowspan="3" colspan="15" {{n/a}}
|-
| 18 Oct 2011
! style="text-align:left;" | 9A335a
| class="rborderplz" | [[Telluride 9A335a (Apple TV 2G)|4.4.1]]
|-
| 2 Nov 2011
! style="text-align:left;" | 9A336a
| class="rborderplz" | [[Telluride 9A336a (Apple TV 2G)|4.4.2]]
|-
| 10 Nov 2011
! style="text-align:left;" | 9A405
| colspan="2" {{n/a}}
| [[Telluride 9A405 (iPad)|5.0.1]]
| [[Telluride 9A405 (iPad 2 Wi-Fi)|5.0.1]]
| [[Telluride 9A405 (iPad 2 GSM)|5.0.1]]
| [[Telluride 9A405 (iPad 2 CDMA)|5.0.1]]
| colspan="4" {{n/a}}
| [[Telluride 9A405 (iPhone 3GS)|5.0.1]]
| [[Telluride 9A405 (iPhone 4 GSM)|5.0.1]]
| [[Telluride 9A405 (iPhone 4 CDMA)|5.0.1]]
| [[Telluride 9A405 (iPhone 4S)|5.0.1]]
| [[Telluride_9A405 (iPod touch 3G)|5.0.1]]
| [[Telluride_9A405 (iPod touch 4G)|5.0.1]]
|-
| 17 Nov 2011
! style="text-align:left;" | 9A405l
| [[Telluride 9A405l (Apple TV 2G)|4.4.3]]
| colspan="15" {{n/a}}
|-
| rowspan="2" | 15 Dec 2011
! style="text-align:left;" | 9A406
| colspan="13" {{n/a}}
| [[Telluride 9A406 (iPhone 4S)|5.0.1]]
| colspan="2" {{n/a}}
|-
! style="text-align:left;" | 9A406a
| [[Telluride 9A406a (Apple TV 2G)|4.4.4]]
| colspan="15" {{n/a}}
|-
| rowspan="3" | 7 Mar 2012
! style="text-align:left;" | 9B176
| colspan="2" {{n/a}}
| [[Hoodoo 9B176 (iPad)|5.1]]
| [[Hoodoo 9B176 (iPad 2 Wi-Fi)|5.1]]
| [[Hoodoo 9B176 (iPad 2 GSM)|5.1]]
| [[Hoodoo 9B176 (iPad 2 CDMA)|5.1]]
| [[Hoodoo 9B176 (iPad 2 Wi-Fi Rev A)|5.1]]
| [[Hoodoo 9B176 (iPad 3 Wi-Fi)|5.1]]
| [[Hoodoo 9B176 (iPad 3 CDMA)|5.1]]
| [[Hoodoo 9B176 (iPad 3 Global)|5.1]]
| [[Hoodoo 9B176 (iPhone 3GS)|5.1]]
| [[Hoodoo 9B176 (iPhone 4 GSM)|5.1]]
| [[Hoodoo 9B176 (iPhone 4 CDMA)|5.1]]
| {{n/a}}
| [[Hoodoo 9B176 (iPod touch 3G)|5.1]]
| [[Hoodoo 9B176 (iPod touch 4G)|5.1]]
|-
! style="text-align:left;" | 9B179
| colspan="13" {{n/a}}
| [[Hoodoo 9B179 (iPhone 4S)|5.1]]
| colspan="2" {{n/a}}
|-
! style="text-align:left;" | 9B179b
| [[Hoodoo 9B179b (Apple TV 2G)|5.0]]
| [[Hoodoo 9B179b (Apple TV 3G)|5.0]]
| colspan="14" {{n/a}}
|-
| rowspan="2" | 10 May 2012
! style="text-align:left;" | 9B206
| colspan="2" {{n/a}}
| [[Hoodoo 9B206 (iPad)|5.1.1]]
| [[Hoodoo 9B206 (iPad 2 Wi-Fi)|5.1.1]]
| [[Hoodoo 9B206 (iPad 2 GSM)|5.1.1]]
| [[Hoodoo 9B206 (iPad 2 CDMA)|5.1.1]]
| [[Hoodoo 9B206 (iPad 2 Wi-Fi Rev A)|5.1.1]]
| [[Hoodoo 9B206 (iPad 3 Wi-Fi)|5.1.1]]
| [[Hoodoo 9B206 (iPad 3 CDMA)|5.1.1]]
| [[Hoodoo 9B206 (iPad 3 Global)|5.1.1]]
| [[Hoodoo 9B206 (iPhone 3GS)|5.1.1]]
| [[Hoodoo 9B206 (iPhone 4 GSM)|5.1.1]]
| [[Hoodoo 9B206 (iPhone 4 CDMA)|5.1.1]]
| [[Hoodoo 9B206 (iPhone 4S)|5.1.1]]
| [[Hoodoo_9B206 (iPod touch 3G)|5.1.1]]
| [[Hoodoo 9B206 (iPod touch 4G)|5.1.1]]
|-
! style="text-align:left;" | 9B206f
| [[Hoodoo 9B206f (Apple TV 2G)|5.0.1]]
| [[Hoodoo 9B206f (Apple TV 3G)|5.0.1]]
| colspan="14" {{n/a}}
|-
| 25 May 2012
! style="text-align:left;" | 9B208
| colspan="11" {{n/a}}
| [[Hoodoo 9B208 (iPhone 4 GSM)|5.1.1]]
| colspan="4" {{n/a}}
|-
| 5 Jun 2012
! style="text-align:left;" | 9B830
| [[HoodooTide 9B830 (Apple TV 2G)|5.0.2]]
| [[HoodooTide 9B830 (Apple TV 3G)|5.0.2]]
| colspan="14" {{n/a}}
|}

==== 6.x ====
{| class="wikitable"
|-
! rowspan="3" | Date
! rowspan="3" | Build
! colspan="3" | [[Apple TV]]
! colspan="10" | [[iPad]]
! colspan="3" | [[iPad mini]]
! colspan="7" | [[iPhone]]
! colspan="2" | [[iPod touch]]
|-
! rowspan="2" | [[k66ap|2G]]
! colspan="2" | [[Apple TV 3G|3G]]
! colspan="4" | [[iPad 2|2]]
! colspan="3" | [[iPad 3|3]]
! colspan="3" | [[iPad 4|4]]
! colspan="3" | [[iPad mini 1G|1G]]
! rowspan="2" | [[n88ap|3GS]]
! colspan="3" | [[iPhone 4|4]]
! rowspan="2" | [[n94ap|4S]]
! colspan="2" | [[iPhone 5|5]]
! rowspan="2" | [[n81ap|4G]]
! rowspan="2" | [[iPod touch 5G|5G]]
|-
! [[j33ap|Orig]]
! [[j33iap|Rev A]]
! [[k93ap|Wi‑Fi]]
! [[k94ap|GSM]]
! [[k95ap|CDMA]]
! [[k93aap|Wi‑Fi (A)]]
! [[j1ap|Wi‑Fi]]
! [[j2ap|CDMA]]
! [[j2aap|Global]]
! [[p101ap|Wi‑Fi]]
! [[p102ap|GSM]]
! [[p103ap|Global]]
! [[p105ap|Wi‑Fi]]
! [[p106ap|GSM]]
! [[p107ap|Global]]
! [[n90ap|GSM]]
! [[n90bap|GSM (A)]]
! [[n92ap|CDMA]]
! [[n41ap|GSM]]
! class="rborderplz" | [[n42ap|Global]]
|-
| rowspan="3" | 19 Sep 2012
! style="text-align:left;" | 10A403
| colspan="3" {{n/a}}
| [[Sundance 10A403 (iPad 2 Wi-Fi)|6.0]]
| [[Sundance 10A403 (iPad 2 GSM)|6.0]]
| [[Sundance 10A403 (iPad 2 CDMA)|6.0]]
| [[Sundance 10A403 (iPad 2 Wi-Fi Rev A)|6.0]]
| [[Sundance 10A403 (iPad 3 Wi-Fi)|6.0]]
| [[Sundance 10A403 (iPad 3 CDMA)|6.0]]
| [[Sundance 10A403 (iPad 3 Global)|6.0]]
| colspan="6" {{n/a}}
| [[Sundance 10A403 (iPhone 3GS)|6.0]]
| [[Sundance 10A403 (iPhone 4 GSM)|6.0]]
| [[Sundance 10A403 (iPhone 4 GSM Rev A)|6.0]]
| [[Sundance 10A403 (iPhone 4 CDMA)|6.0]]
| [[Sundance 10A403 (iPhone 4S)|6.0]]
| colspan="2" {{n/a}}
| [[Sundance 10A403 (iPod touch 4G)|6.0]]
| {{n/a}}
|-
! style="text-align:left;" | 10A405
| colspan="21" {{n/a}}
| [[Sundance 10A405 (iPhone 5 GSM)|6.0]]
| [[Sundance 10A405 (iPhone 5 Global)|6.0]]
| colspan="2" {{n/a}}
|-
! style="text-align:left;" rowspan="2" | 10A406
| colspan="24" {{n/a}}
| [[Sundance 10A406 (iPod touch 5G)|6.0]]
|-
| 30 Oct 2012
| colspan="13" {{n/a}}
| [[Sundance 10A406 (iPad mini 1G Wi-Fi)|6.0]]
| colspan="11" {{n/a}}
|-
| 24 Sep 2012
! style="text-align:left;" | 10A406e
| [[Sundance 10A406e (Apple TV 2G)|5.1]]
| [[Sundance 10A406e (Apple TV 3G)|5.1]]
| colspan="23" {{n/a}}
|-
| 30 Oct 2012
! style="text-align:left;" | 10A407
| colspan="10" {{n/a}}
| [[Sundance 10A407 (iPad 4 Wi-Fi)|6.0]]
| colspan="14" {{n/a}}
|-
| rowspan="2" | 1 Nov 2012
! style="text-align:left;" | 10A523
| colspan="3" {{n/a}}
| [[Sundance 10A523 (iPad 2 Wi-Fi)|6.0.1]]
| [[Sundance 10A523 (iPad 2 GSM)|6.0.1]]
| [[Sundance 10A523 (iPad 2 CDMA)|6.0.1]]
| [[Sundance 10A523 (iPad 2 Wi-Fi Rev A)|6.0.1]]
| [[Sundance 10A523 (iPad 3 Wi-Fi)|6.0.1]]
| [[Sundance 10A523 (iPad 3 GSM)|6.0.1]]
| [[Sundance 10A523 (iPad 3 CDMA)|6.0.1]]
| [[Sundance 10A523 (iPad 4 Wi-Fi)|6.0.1]]
| colspan="2" {{n/a}}
| [[Sundance 10A523 (iPad mini 1G Wi-Fi)|6.0.1]]
| colspan="2" {{n/a}}
| [[Sundance 10A523 (iPhone 3GS)|6.0.1]]
| [[Sundance 10A523 (iPhone 4 GSM)|6.0.1]]
| [[Sundance 10A523 (iPhone 4 GSM Rev A)|6.0.1]]
| [[Sundance 10A523 (iPhone 4 CDMA)|6.0.1]]
| [[Sundance 10A523 (iPhone 4S)|6.0.1]]
| colspan="2" {{n/a}}
| [[Sundance 10A523 (iPod touch 4G)|6.0.1]]
| [[Sundance 10A523 (iPod touch 5G)|6.0.1]]
|-
! style="text-align:left;" | 10A525
| colspan="21" {{n/a}}
| [[Sundance 10A525 (iPhone 5 GSM)|6.0.1]]
| [[Sundance 10A525 (iPhone 5 Global)|6.0.1]]
| colspan="2" {{n/a}}
|-
| 9 Nov 2012
! style="text-align:left;" | 10A8426
| colspan="11" {{n/a}}
| [[SundanceTaos 10A8426 (iPad 4 GSM)|6.0.1]]
| [[SundanceTaos 10A8426 (iPad 4 Global)|6.0.1]]
| {{n/a}}
| [[SundanceTaos 10A8426 (iPad mini 1G GSM)|6.0.1]]
| [[SundanceTaos 10A8426 (iPad mini 1G Global)|6.0.1]]
| colspan="9" {{n/a}}
|-
| 26 Nov 2012
! style="text-align:left;" | 10A831
| [[SundanceTide 10A831 (Apple TV 2G)|5.1.1]]
| [[SundanceTide 10A831 (Apple TV 3G)|5.1.1]]
| [[SundanceTide 10A831 (Apple TV 3G Rev A)|5.1.1]]
| colspan="22" {{n/a}}
|-
| rowspan="3" | 19 Dec 2012
! style="text-align:left;" | 10A550
| colspan="13" {{n/a}}
| [[Sundance 10A550 (iPad mini 1G Wi-Fi)|6.0.2]]
| colspan="11" {{n/a}}
|-
! style="text-align:left;" | 10A551
| colspan="21" {{n/a}}
| [[Sundance 10A551 (iPhone 5 GSM)|6.0.2]]
| [[Sundance 10A551 (iPhone 5 Global)|6.0.2]]
| colspan="2" {{n/a}}
|-
! style="text-align:left;" | 10A8550
| colspan="14" {{n/a}}
| [[SundanceTaos 10A8500 (iPad mini 1G GSM)|6.0.2]]
| [[SundanceTaos 10A8500 (iPad mini 1G Global)|6.0.2]]
| colspan="9" {{n/a}}
|-
| rowspan="5" | 28 Jan 2013
! style="text-align:left;" | 10B141
| colspan="3" {{n/a}}
| [[Brighton 10B141 (iPad 2 Wi-Fi)|6.1]]
| [[Brighton 10B141 (iPad 2 GSM)|6.1]]
| [[Brighton 10B141 (iPad 2 CDMA)|6.1]]
| [[Brighton 10B141 (iPad 2 Wi-Fi Rev A)|6.1]]
| [[Brighton 10B141 (iPad 3 Wi-Fi)|6.1]]
| [[Brighton 10B141 (iPad 3 CDMA)|6.1]]
| [[Brighton 10B141 (iPad 3 Global)|6.1]]
| [[Brighton 10B141 (iPad 4 Wi-Fi)|6.1]]
| [[Brighton 10B141 (iPad 4 GSM)|6.1]]
| [[Brighton 10B141 (iPad 4 Global)|6.1]]
| [[Brighton 10B141 (iPad mini 1G Wi-Fi)|6.1]]
| [[Brighton 10B141 (iPad mini 1G GSM)|6.1]]
| [[Brighton 10B141 (iPad mini 1G Global)|6.1]]
| [[Brighton 10B141 (iPhone 3GS)|6.1]]
| colspan="2" {{n/a}}
| [[Brighton 10B141 (iPhone 4 CDMA)|6.1]]
| colspan="4" {{n/a}}
| [[Brighton 10B141 (iPod touch 5G)|6.1]]
|-
! style="text-align:left;" | 10B142
| colspan="20" {{n/a}}
| [[Brighton 10B142 (iPhone 4S)|6.1]]
| colspan="7" {{n/a}}
|-
! style="text-align:left;" | 10B143
| colspan="21" {{n/a}}
| [[Brighton 10B143 (iPhone 5 GSM)|6.1]]
| [[Brighton 10B143 (iPhone 5 Global)|6.1]]
| colspan="2" {{n/a}}
|-
! style="text-align:left;" | 10B144
| colspan="17" {{n/a}}
| [[Brighton 10B144 (iPhone 4 GSM)|6.1]]
| [[Brighton 10B144 (iPhone 4 GSM Rev A)|6.1]]
| colspan="4" {{n/a}}
| [[Brighton 10B144 (iPod touch 4G)|6.1]]
| colspan="1" {{n/a}}
|-
! style="text-align:left;" | 10B144b
| [[Brighton 10B144b (Apple TV 2G)|5.2]]
| [[Brighton 10B144b (Apple TV 3G)|5.2]]
| [[Brighton 10B144b (Apple TV 3G Rev A)|5.2]]
| colspan="22" {{n/a}}
|-
| 11 Feb 2013
! style="text-align:left;" | 10B145
| colspan="20" {{n/a}}
| [[Brighton 10B145 (iPhone 4S)|6.1.1]]
| colspan="4" {{n/a}}
|-
| rowspan="2" | 19 Feb 2013
! style="text-align:left;" | 10B146
| colspan="3" {{n/a}}
| [[Brighton 10B146 (iPad 2 Wi-Fi)|6.1.2]]
| [[Brighton 10B146 (iPad 2 GSM)|6.1.2]]
| [[Brighton 10B146 (iPad 2 CDMA)|6.1.2]]
| [[Brighton 10B146 (iPad 2 Wi-Fi Rev A)|6.1.2]]
| [[Brighton 10B146 (iPad 3 Wi-Fi)|6.1.2]]
| [[Brighton 10B146 (iPad 3 CDMA)|6.1.2]]
| [[Brighton 10B146 (iPad 3 Global)|6.1.2]]
| [[Brighton 10B146 (iPad 4 Wi-Fi)|6.1.2]]
| colspan="2" {{n/a}}
| [[Brighton 10B146 (iPad mini 1G Wi-Fi)|6.1.2]]
| colspan="2" {{n/a}}
| [[Brighton 10B146 (iPhone 3GS)|6.1.2]]
| [[Brighton 10B146 (iPhone 4 GSM)|6.1.2]]
| [[Brighton 10B146 (iPhone 4 GSM Rev A)|6.1.2]]
| [[Brighton 10B146 (iPhone 4 CDMA)|6.1.2]]
| [[Brighton 10B146 (iPhone 4S)|6.1.2]]
| [[Brighton 10B146 (iPhone 5 GSM)|6.1.2]]
| [[Brighton 10B146 (iPhone 5 Global)|6.1.2]]
| [[Brighton 10B146 (iPod touch 4G)|6.1.2]]
| [[Brighton 10B146 (iPod touch 5G)|6.1.2]]
|-
! style="text-align:left;" | 10B147
| colspan="11" {{n/a}}
| [[Brighton 10B147 (iPad 4 GSM)|6.1.2]]
| [[Brighton 10B147 (iPad 4 Global)|6.1.2]]
| colspan="1" {{n/a}}
| [[Brighton 10B147 (iPad 4 GSM)|6.1.2]]
| [[Brighton 10B147 (iPad 4 Global)|6.1.2]]
| colspan="9" {{n/a}}
|-
| rowspan="2" | 19 Mar 2013
! style="text-align:left;" | 10B329
| colspan="3" {{n/a}}
| [[BrightonMaps 10B329 (iPad 2 Wi-Fi)|6.1.3]]
| [[BrightonMaps 10B329 (iPad 2 GSM)|6.1.3]]
| [[BrightonMaps 10B329 (iPad 2 CDMA)|6.1.3]]
| [[BrightonMaps 10B329 (iPad 2 Wi-Fi Rev A)|6.1.3]]
| [[BrightonMaps 10B329 (iPad 3 Wi-Fi)|6.1.3]]
| [[BrightonMaps 10B329 (iPad 3 GSM)|6.1.3]]
| [[BrightonMaps 10B329 (iPad 3 CDMA)|6.1.3]]
| [[BrightonMaps 10B329 (iPad 4 Wi-Fi)|6.1.3]]
| [[BrightonMaps 10B329 (iPad 4 CDMA)|6.1.3]]
| [[BrightonMaps 10B329 (iPad 4 Global)|6.1.3]]
| [[BrightonMaps 10B329 (iPad mini 1G Wi-Fi)|6.1.3]]
| [[BrightonMaps 10B329 (iPad mini 1G GSM)|6.1.3]]
| [[BrightonMaps 10B329 (iPad mini 1G Global)|6.1.3]]
| [[BrightonMaps 10B329 (iPhone 3GS)|6.1.3]]
| [[BrightonMaps 10B329 (iPhone 4 GSM)|6.1.3]]
| [[BrightonMaps 10B329 (iPhone 4 GSM Rev A)|6.1.3]]
| [[BrightonMaps 10B329 (iPhone 4 CDMA)|6.1.3]]
| [[BrightonMaps 10B329 (iPhone 4S)|6.1.3]]
| [[BrightonMaps 10B329 (iPhone 5 GSM)|6.1.3]]
| [[BrightonMaps 10B329 (iPhone 5 Global)|6.1.3]]
| [[BrightonMaps 10B329 (iPod touch 4G)|6.1.3]]
| [[BrightonMaps 10B329 (iPod touch 5G)|6.1.3]]
|-
! style="text-align:left;" | 10B329a
| [[BrightonMaps 10B329a (Apple TV 2G)|5.2.1]]
| [[BrightonMaps 10B329a (Apple TV 3G)|5.2.1]]
| [[BrightonMaps 10B329a (Apple TV 3G Rev A)|5.2.1]]
| colspan="22" {{n/a}}
|-
| 2 May 2013
! style="text-align:left;" | 10B350
| colspan="21" {{n/a}}
| [[BrightonMaps 10B350 (iPhone 5 GSM)|6.1.4]]
| [[BrightonMaps 10B350 (iPhone 5 Global)|6.1.4]]
| colspan="2" {{n/a}}
|-
| 19 Jun 2013
! style="text-align:left;" | 10B809
| [[BrightonTide 10B809 (Apple TV 2G)|5.3]]
| [[BrightonTide 10B809 (Apple TV 3G)|5.3]]
| [[BrightonTide 10B809 (Apple TV 3G Rev A)|5.3]]
| colspan="22" {{n/a}}
|-
| 14 Nov 2013
! style="text-align:left;" | 10B400
| colspan="23" {{n/a}}
| [[BrightonMaps 10B400 (iPod touch 4G)|6.1.5]]
| {{n/a}}
|}

==== 7.x ====
{| class="wikitable"
|-
! rowspan="3" | Date
! rowspan="3" | Build
! colspan="3" | [[Apple TV]]
! colspan="12" | [[iPad]]
! colspan="5" | [[iPad mini]]
! colspan="10" | [[iPhone]]
! colspan="1" | [[iPod touch]]
|-
! rowspan="2" | [[k66ap|2G]]
! colspan="2" | [[Apple TV 3G|3G]]
! colspan="4" | [[iPad 2|2]]
! colspan="3" | [[iPad 3|3]]
! colspan="3" | [[iPad 4|4]]
! colspan="2" | [[iPad Air|Air]]
! colspan="3" | [[iPad mini 1G|1G]]
! colspan="2" | [[iPad mini 2G|2G]]
! colspan="3" | [[iPhone 4|4]]
! rowspan="2" | [[n94ap|4S]]
! colspan="2" | [[iPhone 5|5]]
! colspan="2" | [[iPhone 5c|5c]]
! colspan="2" | [[iPhone 5s|5s]]
! rowspan="2" | [[iPod touch 5G|5G]]
|-
! [[j33ap|Orig]]
! [[j33iap|Rev A]]
! [[k93ap|Wi‑Fi]]
! [[k94ap|GSM]]
! [[k95ap|CDMA]]
! [[k93aap|Wi‑Fi (A)]]
! [[j1ap|Wi‑Fi]]
! [[j2ap|CDMA]]
! [[j2aap|Global]]
! [[p101ap|Wi‑Fi]]
! [[p102ap|GSM]]
! [[p103ap|Global]]
! [[j71ap|Wi‑Fi]]
! [[j72ap|Cellular]]
! [[p105ap|Wi‑Fi]]
! [[p106ap|GSM]]
! [[p107ap|Global]]
! [[j85ap|Wi‑Fi]]
! [[j86ap|Cellular]]
! [[n90ap|GSM]]
! [[n90bap|GSM (A)]]
! [[n92ap|CDMA]]
! [[n41ap|GSM]]
! [[n42ap|Global]]
! [[n48ap|GSM]]
! [[n49ap|Global]]
! [[n51ap|GSM]]
! class="rborderplz" | [[n53ap|Global]]
|-
| rowspan="3" | 18 Sep 2013
! style="text-align:left;" | 11A465
| colspan="3" {{n/a}}
| [[Innsbruck 11A465 (iPad 2 Wi-Fi)|7.0]]
| [[Innsbruck 11A465 (iPad 2 GSM)|7.0]]
| [[Innsbruck 11A465 (iPad 2 CDMA)|7.0]]
| [[Innsbruck 11A465 (iPad 2 Wi-Fi Rev A)|7.0]]
| [[Innsbruck 11A465 (iPad 3 Wi-Fi)|7.0]]
| [[Innsbruck 11A465 (iPad 3 CDMA)|7.0]]
| [[Innsbruck 11A465 (iPad 3 Global)|7.0]]
| [[Innsbruck 11A465 (iPad 4 Wi-Fi)|7.0]]
| [[Innsbruck 11A465 (iPad 4 GSM)|7.0]]
| [[Innsbruck 11A465 (iPad 4 Global)|7.0]]
| colspan="2" {{n/a}}
| [[Innsbruck 11A465 (iPad mini 1G Wi-Fi)|7.0]]
| [[Innsbruck 11A465 (iPad mini 1G GSM)|7.0]]
| [[Innsbruck 11A465 (iPad mini 1G Global)|7.0]]
| colspan="2" {{n/a}}
| [[Innsbruck 11A465 (iPhone 4 GSM)|7.0]]
| [[Innsbruck 11A465 (iPhone 4 GSM Rev A)|7.0]]
| [[Innsbruck 11A465 (iPhone 4 CDMA)|7.0]]
| [[Innsbruck 11A465 (iPhone 4S)|7.0]]
| [[Innsbruck 11A465 (iPhone 5 GSM)|7.0]]
| [[Innsbruck 11A465 (iPhone 5 Global)|7.0]]
| colspan="4" {{n/a}}
| [[Innsbruck 11A465 (iPod touch 5G)|7.0]]
|-
! style="text-align:left;" | 11A466
| rowspan="2" colspan="26" {{n/a}}
| [[Innsbruck 11A466 (iPhone 5c GSM)|7.0]]
| [[Innsbruck 11A466 (iPhone 5c Global)|7.0]]
| [[Innsbruck 11A466 (iPhone 5s GSM)|7.0]]
| [[Innsbruck 11A466 (iPhone 5s Global)|7.0]]
| rowspan="2" {{n/a}}
|-
! style="text-align:left;" | 11A470a
| [[Innsbruck 11A470a (iPhone 5c GSM)|7.0.1]]
| [[Innsbruck 11A470a (iPhone 5c Global)|7.0.1]]
| [[Innsbruck 11A470a (iPhone 5s GSM)|7.0.1]]
| class="rborderplz" | [[Innsbruck 11A470a (iPhone 5s Global)|7.0.1]]
|-
| 20 Sep 2013
! style="text-align:left;" | 11A470e
| [[Innsbruck 11A470e (Apple TV 2G)|6.0]]
| [[Innsbruck 11A470e (Apple TV 3G)|6.0]]
| [[Innsbruck 11A470e (Apple TV 3G Rev A)|6.0]]
| colspan="28" {{n/a}}
|-
| 26 Sep 2013
! style="text-align:left;" | 11A501
| colspan="3" {{n/a}}
| [[Innsbruck 11A501 (iPad 2 Wi-Fi)|7.0.2]]
| [[Innsbruck 11A501 (iPad 2 GSM)|7.0.2]]
| [[Innsbruck 11A501 (iPad 2 CDMA)|7.0.2]]
| [[Innsbruck 11A501 (iPad 2 Wi-Fi Rev A)|7.0.2]]
| [[Innsbruck 11A501 (iPad 3 Wi-Fi)|7.0.2]]
| [[Innsbruck 11A501 (iPad 3 CDMA)|7.0.2]]
| [[Innsbruck 11A501 (iPad 3 Global)|7.0.2]]
| [[Innsbruck 11A501 (iPad 4 Wi-Fi)|7.0.2]]
| [[Innsbruck 11A501 (iPad 4 GSM)|7.0.2]]
| [[Innsbruck 11A501 (iPad 4 Global)|7.0.2]]
| colspan="2" {{n/a}}
| [[Innsbruck 11A501 (iPad mini 1G Wi-Fi)|7.0.2]]
| [[Innsbruck 11A501 (iPad mini 1G GSM)|7.0.2]]
| [[Innsbruck 11A501 (iPad mini 1G Global)|7.0.2]]
| colspan="2" {{n/a}}
| [[Innsbruck 11A501 (iPhone 4 GSM)|7.0.2]]
| [[Innsbruck 11A501 (iPhone 4 GSM Rev A)|7.0.2]]
| [[Innsbruck 11A501 (iPhone 4 CDMA)|7.0.2]]
| [[Innsbruck 11A501 (iPhone 4S)|7.0.2]]
| [[Innsbruck 11A501 (iPhone 5 GSM)|7.0.2]]
| [[Innsbruck 11A501 (iPhone 5 Global)|7.0.2]]
| [[Innsbruck 11A501 (iPhone 5c GSM)|7.0.2]]
| [[Innsbruck 11A501 (iPhone 5c Global)|7.0.2]]
| [[Innsbruck 11A501 (iPhone 5s GSM)|7.0.2]]
| [[Innsbruck 11A501 (iPhone 5s Global)|7.0.2]]
| [[Innsbruck 11A501 (iPod touch 5G)|7.0.2]]
|-
| 23 Sep 2013
! style="text-align:left;" | 11A502
| [[Innsbruck 11A502 (Apple TV 2G)|6.0]]
| [[Innsbruck 11A502 (Apple TV 3G)|6.0]]
| [[Innsbruck 11A502 (Apple TV 3G Rev A)|6.0]]
| colspan="28" {{n/a}}
|-
| 22 Oct 2013
! style="text-align:left;" | 11B511
| colspan="3" {{n/a}}
| [[InnsbruckTaos 11B511 (iPad 2 Wi-Fi)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad 2 GSM)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad 2 CDMA)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad 2 Wi-Fi Rev A)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad 3 Wi-Fi)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad 3 CDMA)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad 3 Global)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad 4 Wi-Fi)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad 4 GSM)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad 4 Global)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad mini 1G Wi-Fi)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad mini 1G GSM)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad mini 1G Global)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad Air Wi-Fi)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad Air Cellular)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad mini Retina Wi-Fi)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPad mini Retina Cellular)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPhone 4 GSM)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPhone 4 GSM Rev A)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPhone 4 CDMA)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPhone 4S)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPhone 5 GSM)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPhone 5 Global)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPhone 5c GSM)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPhone 5c Global)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPhone 5s GSM)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPhone 5s Global)|7.0.3]]
| [[InnsbruckTaos 11B511 (iPod touch 5G)|7.0.3]]
|-
| 24 Oct 2013
! style="text-align:left;" | 11B511d
| [[Innsbruck 11B511d (Apple TV 2G)|6.0.1]]
| [[Innsbruck 11B511d (Apple TV 3G)|6.0.1]]
| [[Innsbruck 11B511d (Apple TV 3G Rev A)|6.0.1]]
| colspan="28" {{n/a}}
|-
| 14 Oct 2013
! style="text-align:left;" | 11B554a
| [[Innsbruck 11B554a (Apple TV 2G)|6.0.2]]
| [[Innsbruck 11B554a (Apple TV 3G)|6.0.2]]
| [[Innsbruck 11B554a (Apple TV 3G Rev A)|6.0.2]]
| [[InnsbruckTaos 11B554a (iPad 2 Wi-Fi)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad 2 GSM)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad 2 CDMA)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad 2 Wi-Fi Rev A)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad 3 Wi-Fi)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad 3 CDMA)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad 3 Global)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad 4 Wi-Fi)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad 4 GSM)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad 4 Global)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad mini 1G Wi-Fi)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad mini 1G GSM)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad mini 1G Global)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad Air Wi-Fi)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad Air Cellular)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad mini Retina Wi-Fi)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPad mini Retina Cellular)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPhone 4 GSM)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPhone 4 GSM Rev A)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPhone 4 CDMA)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPhone 4S)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPhone 5 GSM)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPhone 5 Global)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPhone 5c GSM)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPhone 5c Global)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPhone 5s GSM)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPhone 5s Global)|7.0.4]]
| [[InnsbruckTaos 11B554a (iPod touch 5G)|7.0.4]]
|-
| 29 Jan 2014
! style="text-align:left;" | 11B601
| colspan="27" {{n/a}}
| [[InnsbruckTaos 11B601 (iPhone 5c Global)|7.0.5]]
| {{n/a}}
| [[InnsbruckTaos 11B601 (iPhone 5s Global)|7.0.5]]
| {{n/a}}
|}

=== Beta ===
{{main|Beta Firmware}}
==== 1.x/2.x ====
{| class="wikitable"
|-
! rowspan="2" | Date
! rowspan="2" | Build
! colspan="2" | [[iPhone]]
! [[iPod touch]]
|-
! [[m68ap|2G]]
! [[n82ap|3G]]
! [[n45ap|1G]]
|-
| 6 Mar 2008
! style="text-align:left;" | 5A147p
| [[Big Bear 5A147p (iPhone)|1.2b]]
| rowspan="13" {{n/a}}
| [[Big Bear 5A147p (iPod touch)|1.2b]]
|-
| 27 Mar 2008
! style="text-align:left;" | 5A225c
| [[Big Bear 5A225c (iPhone)|2.0b2]]
| [[Big Bear 5A225c (iPod touch)|2.0b2]]
|-
| 8 Apr 2008
! style="text-align:left;" | 5A240d
| [[Big Bear 5A240d (iPhone)|2.0b3]]
| [[Big Bear 5A240d (iPod touch)|2.0b3]]
|-
| 23 Apr 2008
! style="text-align:left;" | 5A258f
| [[Big Bear 5A258f (iPhone)|2.0b4]]
| [[Big Bear 5A258f (iPod touch)|2.0b4]]
|-
| 6 May 2008
! style="text-align:left;" | 5A274d
| [[Big Bear 5A274d (iPhone)|2.0b5]]
| [[Big Bear 5A274d (iPod touch)|2.0b5]]
|-
| 28 May 2008
! style="text-align:left;" | 5A292g
| [[Big Bear 5A292g (iPhone)|2.0b6P]]
| [[Big Bear 5A292g (iPod touch)|2.0b6P]]
|-
| 29 May 2008
! style="text-align:left;" | 5A308
| [[Big Bear 5A308 (iPhone)|2.0b6F]]
| [[Big Bear 5A308 (iPod touch)|2.0b6F]]
|-
| 9 Jun 2008
! style="text-align:left;" | 5A331
| [[Big Bear 5A331 (iPhone)|2.0b7]]
| [[Big Bear 5A331 (iPod touch)|2.0b7]]
|-
| 26 Jun 2008
! style="text-align:left;" | 5A345
| [[Big Bear 5A345 (iPhone)|2.0GM]]
| [[Big Bear 5A345 (iPod touch)|2.0GM]]
|-
| 24 Jul 2008
! style="text-align:left;" | 5F90
| [[Sugar Bowl 5F90 (iPhone)|2.1b]]
| [[Sugar Bowl 5F90 (iPod touch)|2.1b]]
|-
| 30 Jul 2008
! style="text-align:left;" | ?
| 2.1b2
| 2.1b2
|-
| 8 Aug 2008
! style="text-align:left;" | ?
| 2.1b3
| 2.1b3
|-
| 16 Aug 2008
! style="text-align:left;" | ?
| 2.1b4
| 2.1b4
|-
| 25 Sep 2008
! style="text-align:left;" | 5G29
| [[Timberline 5G29 (iPhone)|2.2b]]
| [[Timberline 5G29 (iPhone 3G)|2.2b]]
| [[Timberline 5G29 (iPod touch)|2.2b]]
|-
| 20 Oct 2008
! style="text-align:left;" | 5G53
| [[Timberline 5G53 (iPhone)|2.2b2]]
| [[Timberline 5G53 (iPhone 3G)|2.2b2]]
| [[Timberline 5G53 (iPod touch)|2.2b2]]
|}

==== 3.x ====
{| class="wikitable"
|-
! rowspan="2" | Date
! rowspan="2" | Build
! colspan="3" | [[iPhone]]
! colspan="2" | [[iPod touch]]
|-
! [[m68ap|2G]]
! [[n82ap|3G]]
! [[n88ap|3GS]]
! [[n45ap|1G]]
! [[n72ap|2G]]
|-
| 17 Mar 2009
! style="text-align:left;" | 7A238j
| [[KirkVail 7A238j (iPhone)|3.0b]]
| [[KirkVail 7A238j (iPhone 3G)|3.0b]]
| rowspan="6" {{n/a}}
| [[KirkVail 7A238j (iPod touch)|3.0b]]
| [[KirkVail 7A238j (iPod touch 2G)|3.0b]]
|-
| 31 Mar 2009
! style="text-align:left;" | 7A259g
| [[KirkVail 7A259g (iPhone)|3.0b2]]
| [[KirkVail 7A259g (iPhone 3G)|3.0b2]]
| [[KirkVail 7A259g (iPod touch)|3.0b2]]
| [[KirkVail 7A259g (iPod touch 2G)|3.0b2]]
|-
| 14 Apr 2009
! style="text-align:left;" | 7A280f
| [[KirkVail 7A280f (iPhone)|3.0b3]]
| [[KirkVail 7A280f (iPhone 3G)|3.0b3]]
| [[KirkVail 7A280f (iPod touch)|3.0b3]]
| [[KirkVail 7A280f (iPod touch 2G)|3.0b3]]
|-
| 28 Apr 2009
! style="text-align:left;" | 7A300g
| [[KirkVail 7A300g (iPhone)|3.0b4]]
| [[KirkVail 7A300g (iPhone 3G)|3.0b4]]
| [[KirkVail 7A300g (iPod touch)|3.0b4]]
| [[KirkVail 7A300g (iPod touch 2G)|3.0b4]]
|-
| 6 May 2009
! style="text-align:left;" | 7A312g
| [[KirkVail 7A312g (iPhone)|3.0b5]]
| [[KirkVail 7A312g (iPhone 3G)|3.0b5]]
| [[KirkVail 7A312g (iPod touch)|3.0b5]]
| [[KirkVail 7A312g (iPod touch 2G)|3.0b5]]
|-
| 8 Jun 2009
! style="text-align:left;" | 7A341
| [[Kirkwood 7A341 (iPhone)|3.0GM]]
| [[Kirkwood 7A341 (iPhone 3G)|3.0GM]]
| [[Kirkwood 7A341 (iPod touch)|3.0GM]]
| [[Kirkwood 7A341 (iPod touch 2G)|3.0GM]]
|-
| 30 Jun 2009
! style="text-align:left;" | 7C97d
| [[NorthVail 7C97d (iPhone)|3.1b]]
| [[NorthVail 7C97d (iPhone 3G)|3.1b]]
| [[NorthVail 7C97d (iPhone 3GS)|3.1b]]
| [[NorthVail 7C97d (iPod touch)|3.1b]]
| [[NorthVail 7C97d (iPod touch 2G)|3.1b]]
|-
| 14 Jul 2009
! style="text-align:left;" | 7C106c
| [[NorthVail 7C106c (iPhone)|3.1b2]]
| [[NorthVail 7C106c (iPhone 3G)|3.1b2]]
| [[NorthVail 7C106c (iPhone 3GS)|3.1b2]]
| [[NorthVail 7C106c (iPod touch)|3.1b2]]
| [[NorthVail 7C106c (iPod touch 2G)|3.1b2]]
|-
| 27 Jul 2009
! style="text-align:left;" | 7C116a
| [[NorthVail 7C116a (iPhone)|3.1b3]]
| [[NorthVail 7C116a (iPhone 3G)|3.1b3]]
| [[NorthVail 7C116a (iPhone 3GS)|3.1b3]]
| [[NorthVail 7C116a (iPod touch)|3.1b3]]
| [[NorthVail 7C116a (iPod touch 2G)|3.1b3]]
|}

==== 4.x ====
{| class="wikitable"
|-
! rowspan="3" | Date
! rowspan="3" | Build
! [[Apple TV]]
! [[iPad]]
! colspan="3" | [[iPhone]]
! colspan="3" | [[iPod touch]]
|-
! rowspan="2" | [[k66ap|2G]]
! rowspan="2" | [[k48ap|1G]]
! rowspan="2" | [[n82ap|3G]]
! rowspan="2" | [[n88ap|3GS]]
! [[iPhone 4|4]]
! rowspan="2" | [[n72ap|2G]]
! rowspan="2" | [[n18ap|3G]]
! rowspan="2" | [[n81ap|4G]]
|-
! class="rborderplz" | [[n90ap|GSM]]
|-
| 8 Apr 2010
! style="text-align:left;" | 8A230m
| colspan="2" rowspan="9" {{n/a}}
| [[ApexVail 8A230m (iPhone 3G)|4.0b]]
| [[ApexVail 8A230m (iPhone 3GS)|4.0b]]
| rowspan="5" {{n/a}}
| [[ApexVail 8A230m (iPod touch 2G)|4.0b]]
| [[ApexVail 8A230m (iPod touch 3G)|4.0b]]
| rowspan="9" {{n/a}}
|-
| 20 Apr 2010
! style="text-align:left;" | 8A248c
| [[ApexVail 8A248c (iPhone 3G)|4.0b2]]
| [[ApexVail 8A248c (iPhone 3GS)|4.0b2]]
| [[ApexVail 8A248c (iPod touch 2G)|4.0b2]]
| class="rborderplz" | [[ApexVail 8A248c (iPod touch 3G)|4.0b2]]
|-
| 4 May 2010
! style="text-align:left;" | 8A260b
| [[ApexVail 8A260b (iPhone 3G)|4.0b3]]
| [[ApexVail 8A260b (iPhone 3GS)|4.0b3]]
| [[ApexVail 8A260b (iPod touch 2G)|4.0b3]]
| class="rborderplz" | [[ApexVail 8A260b (iPod touch 3G)|4.0b3]]
|-
| 18 May 2010
! style="text-align:left;" | 8A274b
| [[ApexVail 8A274b (iPhone 3G)|4.0b4]]
| [[ApexVail 8A274b (iPhone 3GS)|4.0b4]]
| [[ApexVail 8A274b (iPod touch 2G)|4.0b4]]
| class="rborderplz" | [[ApexVail 8A274b (iPod touch 3G)|4.0b4]]
|-
| 7 Jun 2010
! style="text-align:left;" | 8A293
| [[Apex 8A293 (iPhone 3G)|4.0GM]]
| [[Apex 8A293 (iPhone 3GS)|4.0GM]]
| [[Apex 8A293 (iPod touch 2G)|4.0GM]]
| class="rborderplz" | [[Apex 8A293 (iPod touch 3G)|4.0GM]]
|-
| 14 Jul 2010
! style="text-align:left;" | 8B5080c
| [[BakerVail 8B5080c (iPhone 3G)|4.1b]]
| [[BakerVail 8B5080c (iPhone 3GS)|4.1b]]
| [[BakerVail 8B5080c (iPhone 4 GSM)|4.1b]]
| [[BakerVail 8B5080c (iPod touch 2G)|4.1b]]
| class="rborderplz" | [[BakerVail 8B5080c (iPod touch 3G)|4.1b]]
|-
| 27 Jul 2010
! style="text-align:left;" | 8B5091b
| [[BakerVail 8B5091b (iPhone 3G)|4.1b2]]
| [[BakerVail 8B5091b (iPhone 3GS)|4.1b2]]
| [[BakerVail 8B5091b (iPhone 4 GSM)|4.1b2]]
| [[BakerVail 8B5091b (iPod touch 2G)|4.1b2]]
| class="rborderplz" | [[BakerVail 8B5091b (iPod touch 3G)|4.1b2]]
|-
| 3 Aug 2010
! style="text-align:left;" | 8B5097d
| [[BakerVail 8B5097d (iPhone 3G)|4.1b3]]
| [[BakerVail 8B5097d (iPhone 3GS)|4.1b3]]
| [[BakerVail 8B5097d (iPhone 4 GSM)|4.1b3]]
| [[BakerVail 8B5097d (iPod touch 2G)|4.1b3]]
| class="rborderplz" | [[BakerVail 8B5097d (iPod touch 3G)|4.1b3]]
|-
| 1 Sep 2010
! style="text-align:left;" | 8B117
| [[Baker 8B117 (iPhone 3G)|4.1GM]]
| [[Baker 8B117 (iPhone 3GS)|4.1GM]]
| [[Baker 8B117 (iPhone 4 GSM)|4.1GM]]
| [[Baker 8B117 (iPod touch 2G)|4.1GM]]
| class="rborderplz" | [[Baker 8B117 (iPod touch 3G)|4.1GM]]
|-
| 15 Sep 2010
! style="text-align:left;" | 8C5091e
| rowspan="7" {{n/a}}
| [[JasperVail 8C5091e (iPad)|4.2b]]
| [[JasperVail 8C5091e (iPhone 3G)|4.2b]]
| [[JasperVail 8C5091e (iPhone 3GS)|4.2b]]
| [[JasperVail 8C5091e (iPhone 4 GSM)|4.2b]]
| [[JasperVail 8C5091e (iPod touch 2G)|4.2b]]
| [[JasperVail 8C5091e (iPod touch 3G)|4.2b]]
| [[JasperVail 8C5091e (iPod touch 4G)|4.2b]]
|-
| 28 Sep 2010
! style="text-align:left;" | 8C5101c
| [[JasperVail 8C5101c (iPad)|4.2b2]]
| [[JasperVail 8C5101c (iPhone 3G)|4.2b2]]
| [[JasperVail 8C5101c (iPhone 3GS)|4.2b2]]
| [[JasperVail 8C5101c (iPhone 4 GSM)|4.2b2]]
| [[JasperVail 8C5101c (iPod touch 2G)|4.2b2]]
| [[JasperVail 8C5101c (iPod touch 3G)|4.2b2]]
| [[JasperVail 8C5101c (iPod touch 4G)|4.2b2]]
|-
| 12 Oct 2010
! style="text-align:left;" | 8C5115c
| [[JasperVail 8C5115c (iPad)|4.2b3]]
| [[JasperVail 8C5115c (iPhone 3G)|4.2b3]]
| [[JasperVail 8C5115c (iPhone 3GS)|4.2b3]]
| [[JasperVail 8C5115c (iPhone 4 GSM)|4.2b3]]
| [[JasperVail 8C5115c (iPod touch 2G)|4.2b3]]
| [[JasperVail 8C5115c (iPod touch 3G)|4.2b3]]
| [[JasperVail 8C5115c (iPod touch 4G)|4.2b3]]
|-
| 1 Nov 2010
! style="text-align:left;" | 8C134
| [[Jasper 8C134 (iPad)|4.2GM]]
| [[Jasper 8C134 (iPhone 3G)|4.2GM]]
| [[Jasper 8C134 (iPhone 3GS)|4.2GM]]
| [[Jasper 8C134 (iPhone 4 GSM)|4.2GM]]
| [[Jasper 8C134 (iPod touch 2G)|4.2GM]]
| [[Jasper 8C134 (iPod touch 3G)|4.2GM]]
| [[Jasper 8C134 (iPod touch 4G)|4.2GM]]
|-
| 18 Nov 2010
! style="text-align:left;" | 8C134b
| [[Jasper 8C134b (iPad)|4.2GM2]]
| colspan="6" {{n/a}}
|-
| 18 Nov 2010
! style="text-align:left;" | 8C148
| [[Jasper 8C148 (iPad)|4.2.1GM]]
| [[Jasper 8C148 (iPhone 3G)|4.2.1GM]]
| [[Jasper 8C148 (iPhone 3GS)|4.2.1GM]]
| [[Jasper 8C148 (iPhone 4 GSM)|4.2.1GM]]
| [[Jasper 8C148 (iPod touch 2G)|4.2.1GM]]
| [[Jasper 8C148 (iPod touch 3G)|4.2.1GM]]
| [[Jasper 8C148 (iPod touch 4G)|4.2.1GM]]
|-
| 12 Jan 2011
! style="text-align:left;" | 8F5148b
| [[DurangoVail 8F5148b (iPad)|4.3b]]
| {{n/a}}
| [[DurangoVail 8F5148b (iPhone 3GS)|4.3b]]
| [[DurangoVail 8F5148b (iPhone 4 GSM)|4.3b]]
| {{n/a}}
| [[DurangoVail 8F5148b (iPod touch 3G)|4.3b]]
| [[DurangoVail 8F5148b (iPod touch 4G)|4.3b]]
|-
| 12 Jan 2011
! style="text-align:left;" | 8F5148c
| [[DurangoVail 8F5148c (Apple TV 2G)|4.2b]]
| colspan="7" {{n/a}}
|-
| 19 Jan 2011
! style="text-align:left;" | 8F5153d
| [[DurangoVail 8F5153d (Apple TV 2G)|4.2b2]]
| [[DurangoVail 8F5153d (iPad)|4.3b2]]
| rowspan="3" {{n/a}}
| [[DurangoVail 8F5153d (iPhone 3GS)|4.3b2]]
| [[DurangoVail 8F5153d (iPhone 4 GSM)|4.3b2]]
| rowspan="3" {{n/a}}
| [[DurangoVail 8F5153d (iPod touch 3G)|4.3b2]]
| [[DurangoVail 8F5153d (iPod touch 4G)|4.3b2]]
|-
| 1 Feb 2011
! style="text-align:left;" | 8F5166b
| [[DurangoVail 8F5166b (Apple TV 2G)|4.2b3]]
| [[DurangoVail 8F5166b (iPad)|4.3b3]]
| [[DurangoVail 8F5166b (iPhone 3GS)|4.3b3]]
| [[DurangoVail 8F5166b (iPhone 4 GSM)|4.3b3]]
| [[DurangoVail 8F5166b (iPod touch 3G)|4.3b3]]
| [[DurangoVail 8F5166b (iPod touch 4G)|4.3b3]]
|-
| 3 Mar 2011
! style="text-align:left;" | 8F190
| {{n/a}}
| [[Durango 8F190 (iPad)|4.3GM]]
| [[Durango 8F190 (iPhone 3GS)|4.3GM]]
| [[Durango 8F190 (iPhone 4 GSM)|4.3GM]]
| [[Durango 8F190 (iPod touch 3G)|4.3GM]]
| [[Durango 8F190 (iPod touch 4G)|4.3GM]]
|}

==== 5.x ====
{| class="wikitable"
|-
! rowspan="3" | Date
! rowspan="3" | Build
! [[Apple TV]]
! colspan="4" | [[iPad]]
! colspan="4" | [[iPhone]]
! colspan="2" | [[iPod touch]]
|-
! rowspan="2" | [[k66ap|2G]]
! rowspan="2" | [[k48ap|1G]]
! colspan="3" | [[iPad 2|2]]
! rowspan="2" | [[n88ap|3GS]]
! colspan="2" | [[iPhone 4|4]]
! rowspan="2" | [[n94ap|4S]]
! rowspan="2" | [[n18ap|3G]]
! rowspan="2" | [[n81ap|4G]]
|-
! [[k93ap|Wi‑Fi]]
! [[k94ap|GSM]]
! [[k95ap|CDMA]]
! [[n90ap|GSM]]
! class="rborderplz" | [[n92ap|CDMA]]
|-
| 7 Jun 2011
! style="text-align:left;" | 9A5220p
| [[TellurideVail 9A5220p (Apple TV 2G)|4.4b]]
| [[TellurideVail 9A5220p (iPad)|5.0b]]
| [[TellurideVail 9A5220p (iPad 2 Wi-Fi)|5.0b]]
| [[TellurideVail 9A5220p (iPad 2 GSM)|5.0b]]
| [[TellurideVail 9A5220p (iPad 2 CDMA)|5.0b]]
| [[TellurideVail 9A5220p (iPhone 3GS)|5.0b]]
| [[TellurideVail 9A5220p (iPhone 4 GSM)|5.0b]]
| [[TellurideVail 9A5220p (iPhone 4 CDMA)|5.0b]]
| rowspan="8" {{n/a}}
| [[TellurideVail 9A5220p (iPod touch 3G)|5.0b]]
| [[TellurideVail 9A5220p (iPod touch 4G)|5.0b]]
|-
| 24 Jun 2011
! style="text-align:left;" | 9A5248d
| [[TellurideVail 9A5248d (Apple TV 2G)|4.4b2]]
| [[TellurideVail 9A5248d (iPad)|5.0b2]]
| [[TellurideVail 9A5248d (iPad 2 Wi-Fi)|5.0b2]]
| [[TellurideVail 9A5248d (iPad 2 GSM)|5.0b2]]
| [[TellurideVail 9A5248d (iPad 2 CDMA)|5.0b2]]
| [[TellurideVail 9A5248d (iPhone 3GS)|5.0b2]]
| [[TellurideVail 9A5248d (iPhone 4 GSM)|5.0b2]]
| [[TellurideVail 9A5248d (iPhone 4 CDMA)|5.0b2]]
| [[TellurideVail 9A5248d (iPod touch 3G)|5.0b2]]
| [[TellurideVail 9A5248d (iPod touch 4G)|5.0b2]]
|-
| 11 Jul 2011
! style="text-align:left;" | 9A5259f
| [[TellurideVail 9A5259f (Apple TV 2G)|4.4b3]]
| [[TellurideVail 9A5259f (iPad)|5.0b3]]
| [[TellurideVail 9A5259f (iPad 2 Wi-Fi)|5.0b3]]
| [[TellurideVail 9A5259f (iPad 2 GSM)|5.0b3]]
| [[TellurideVail 9A5259f (iPad 2 CDMA)|5.0b3]]
| [[TellurideVail 9A5259f (iPhone 3GS)|5.0b3]]
| [[TellurideVail 9A5259f (iPhone 4 GSM)|5.0b3]]
| [[TellurideVail 9A5259f (iPhone 4 CDMA)|5.0b3]]
| [[TellurideVail 9A5259f (iPod touch 3G)|5.0b3]]
| [[TellurideVail 9A5259f (iPod touch 4G)|5.0b3]]
|-
| 22 Jul 2011
! style="text-align:left;" | 9A5274d
| {{n/a}}
| [[TellurideVail 9A5274d (iPad)|5.0b4]]
| [[TellurideVail 9A5274d (iPad 2 Wi-Fi)|5.0b4]]
| [[TellurideVail 9A5274d (iPad 2 GSM)|5.0b4]]
| [[TellurideVail 9A5274d (iPad 2 CDMA)|5.0b4]]
| [[TellurideVail 9A5274d (iPhone 3GS)|5.0b4]]
| [[TellurideVail 9A5274d (iPhone 4 GSM)|5.0b4]]
| [[TellurideVail 9A5274d (iPhone 4 CDMA)|5.0b4]]
| [[TellurideVail 9A5274d (iPod touch 3G)|5.0b4]]
| [[TellurideVail 9A5274d (iPod touch 4G)|5.0b4]]
|-
| 6 Aug 2011
! style="text-align:left;" | 9A5288d
| [[TellurideVail 9A5288d (Apple TV 2G)|4.4b4]]
| [[TellurideVail 9A5288d (iPad)|5.0b5]]
| [[TellurideVail 9A5288d (iPad 2 Wi-Fi)|5.0b5]]
| [[TellurideVail 9A5288d (iPad 2 GSM)|5.0b5]]
| [[TellurideVail 9A5288d (iPad 2 CDMA)|5.0b5]]
| [[TellurideVail 9A5288d (iPhone 3GS)|5.0b5]]
| [[TellurideVail 9A5288d (iPhone 4 GSM)|5.0b5]]
| [[TellurideVail 9A5288d (iPhone 4 CDMA)|5.0b5]]
| [[TellurideVail 9A5288d (iPod touch 3G)|5.0b5]]
| [[TellurideVail 9A5288d (iPod touch 4G)|5.0b5]]
|-
| 19 Aug 2011
! style="text-align:left;" | 9A5302b
| [[TellurideVail 9A5302b (Apple TV 2G)|4.4b5]]
| [[TellurideVail 9A5302b (iPad)|5.0b6]]
| [[TellurideVail 9A5302b (iPad 2 Wi-Fi)|5.0b6]]
| [[TellurideVail 9A5302b (iPad 2 GSM)|5.0b6]]
| [[TellurideVail 9A5302b (iPad 2 CDMA)|5.0b6]]
| [[TellurideVail 9A5302b (iPhone 3GS)|5.0b6]]
| [[TellurideVail 9A5302b (iPhone 4 GSM)|5.0b6]]
| [[TellurideVail 9A5302b (iPhone 4 CDMA)|5.0b6]]
| [[TellurideVail 9A5302b (iPod touch 3G)|5.0b6]]
| [[TellurideVail 9A5302b (iPod touch 4G)|5.0b6]]
|-
| 31 Aug 2011
! style="text-align:left;" | 9A5313e
| [[TellurideVail 9A5313e (Apple TV 2G)|4.4b6]]
| [[TellurideVail 9A5313e (iPad)|5.0b7]]
| [[TellurideVail 9A5313e (iPad 2 Wi-Fi)|5.0b7]]
| [[TellurideVail 9A5313e (iPad 2 GSM)|5.0b7]]
| [[TellurideVail 9A5313e (iPad 2 CDMA)|5.0b7]]
| [[TellurideVail 9A5313e (iPhone 3GS)|5.0b7]]
| [[TellurideVail 9A5313e (iPhone 4 GSM)|5.0b7]]
| [[TellurideVail 9A5313e (iPhone 4 CDMA)|5.0b7]]
| [[TellurideVail 9A5313e (iPod touch 3G)|5.0b7]]
| [[TellurideVail 9A5313e (iPod touch 4G)|5.0b7]]
|-
| 4 Oct 2011
! style="text-align:left;" | 9A334
| rowspan="4" {{n/a}}
| [[Telluride 9A334 (iPad)|5.0GM]]
| [[Telluride 9A334 (iPad 2 Wi-Fi)|5.0GM]]
| [[Telluride 9A334 (iPad 2 GSM)|5.0GM]]
| [[Telluride 9A334 (iPad 2 CDMA)|5.0GM]]
| [[Telluride 9A334 (iPhone 3GS)|5.0GM]]
| [[Telluride 9A334 (iPhone 4 GSM)|5.0GM]]
| [[Telluride 9A334 (iPhone 4 CDMA)|5.0GM]]
| [[Telluride 9A334 (iPod touch 3G)|5.0GM]]
| [[Telluride 9A334 (iPod touch 4G)|5.0GM]]
|-
| 2 Nov 2011
! style="text-align:left;" | 9A402
| [[Telluride 9A402 (iPad)|5.0.1b]]
| [[Telluride 9A402 (iPad 2 Wi-Fi)|5.0.1b]]
| [[Telluride 9A402 (iPad 2 GSM)|5.0.1b]]
| [[Telluride 9A402 (iPad 2 CDMA)|5.0.1b]]
| [[Telluride 9A402 (iPhone 3GS)|5.0.1b]]
| [[Telluride 9A402 (iPhone 4 GSM)|5.0.1b]]
| [[Telluride 9A402 (iPhone 4 CDMA)|5.0.1b]]
| [[Telluride 9A402 (iPhone 4S)|5.0.1b]]
| [[Telluride 9A402 (iPod touch 3G)|5.0.1b]]
| [[Telluride 9A402 (iPod touch 4G)|5.0.1b]]
|-
| 4 Nov 2011
! style="text-align:left;" | 9A404
| [[Telluride 9A404 (iPad)|5.0.1b2]]
| [[Telluride 9A404 (iPad 2 Wi-Fi)|5.0.1b2]]
| [[Telluride 9A404 (iPad 2 GSM)|5.0.1b2]]
| [[Telluride 9A404 (iPad 2 CDMA)|5.0.1b2]]
| [[Telluride 9A404 (iPhone 3GS)|5.0.1b2]]
| [[Telluride 9A404 (iPhone 4 GSM)|5.0.1b2]]
| [[Telluride 9A404 (iPhone 4 CDMA)|5.0.1b2]]
| [[Telluride 9A404 (iPhone 4S)|5.0.1b2]]
| [[Telluride 9A404 (iPod touch 3G)|5.0.1b2]]
| [[Telluride 9A404 (iPod touch 4G)|5.0.1b2]]
|-
| 28 Nov 2011
! style="text-align:left;" | 9B5117b
| [[HoodooVail 9B5117b (iPad)|5.1b]]
| [[HoodooVail 9B5117b (iPad 2 Wi-Fi)|5.1b]]
| [[HoodooVail 9B5117b (iPad 2 GSM)|5.1b]]
| [[HoodooVail 9B5117b (iPad 2 CDMA)|5.1b]]
| [[HoodooVail 9B5117b (iPhone 3GS)|5.1b]]
| [[HoodooVail 9B5117b (iPhone 4 GSM)|5.1b]]
| [[HoodooVail 9B5117b (iPhone 4 CDMA)|5.1b]]
| [[HoodooVail 9B5117b (iPhone 4S)|5.1b]]
| [[HoodooVail 9B5117b (iPod touch 3G)|5.1b]]
| [[HoodooVail 9B5117b (iPod touch 4G)|5.1b]]
|-
| 12 Dec 2011
! style="text-align:left;" | 9B5127c
| [[HoodooVail 9B5127c (Apple TV 2G)|5.0b]]
| [[HoodooVail 9B5127c (iPad)|5.1b2]]
| [[HoodooVail 9B5127c (iPad 2 Wi-Fi)|5.1b2]]
| [[HoodooVail 9B5127c (iPad 2 GSM)|5.1b2]]
| [[HoodooVail 9B5127c (iPad 2 CDMA)|5.1b2]]
| [[HoodooVail 9B5127c (iPhone 3GS)|5.1b2]]
| [[HoodooVail 9B5127c (iPhone 4 GSM)|5.1b2]]
| [[HoodooVail 9B5127c (iPhone 4 CDMA)|5.1b2]]
| [[HoodooVail 9B5127c (iPhone 4S)|5.1b2]]
| [[HoodooVail 9B5127c (iPod touch 3G)|5.1b2]]
| [[HoodooVail 9B5127c (iPod touch 4G)|5.1b2]]
|-
| 9 Jan 2012
! style="text-align:left;" | 9B5141a
| [[HoodooVail 9B5141a (Apple TV 2G)|5.0b2]]
| [[HoodooVail 9B5141a (iPad)|5.1b3]]
| [[HoodooVail 9B5141a (iPad 2 Wi-Fi)|5.1b3]]
| [[HoodooVail 9B5141a (iPad 2 GSM)|5.1b3]]
| [[HoodooVail 9B5141a (iPad 2 CDMA)|5.1b3]]
| [[HoodooVail 9B5141a (iPhone 3GS)|5.1b3]]
| [[HoodooVail 9B5141a (iPhone 4 GSM)|5.1b3]]
| [[HoodooVail 9B5141a (iPhone 4 CDMA)|5.1b3]]
| [[HoodooVail 9B5141a (iPhone 4S)|5.1b3]]
| [[HoodooVail 9B5141a (iPod touch 3G)|5.1b3]]
| [[HoodooVail 9B5141a (iPod touch 4G)|5.1b3]]
|}

==== 6.x ====
{| class="wikitable"
|-
! rowspan="3" | Date
! rowspan="3" | Build
! colspan="2" | [[Apple TV]]
! colspan="10" | [[iPad]]
! colspan="3" | [[iPad mini]]
! colspan="7" | [[iPhone]]
! colspan="2" | [[iPod touch]]
|-
! rowspan="2" | [[k66ap|2G]]
! rowspan="2" | [[j33ap|3G]]
! colspan="4" | [[iPad 2|2]]
! colspan="3" | [[iPad 3|3]]
! colspan="3" | [[iPad 4|4]]
! colspan="3" | [[iPad mini 1G|1G]]
! rowspan="2" | [[n88ap|3GS]]
! colspan="3" | [[iPhone 4|4]]
! rowspan="2" | [[n94ap|4S]]
! colspan="2" | [[iPhone 5|5]]
! rowspan="2" | [[n81ap|4G]]
! rowspan="2" | [[iPod touch 5G|5G]]
|-
! [[k93ap|Wi‑Fi]]
! [[k94ap|GSM]]
! [[k95ap|CDMA]]
! [[k93aap|Wi‑Fi (A)]]
! [[j1ap|Wi‑Fi]]
! [[j2ap|CDMA]]
! [[j2aap|Global]]
! [[p101ap|Wi‑Fi]]
! [[p102ap|GSM]]
! [[p103ap|Global]]
! [[p105ap|Wi‑Fi]]
! [[p106ap|GSM]]
! [[p107ap|Global]]
! [[n90ap|GSM]]
! [[n90bap|GSM (A)]]
! [[n92ap|CDMA]]
! [[n41ap|GSM]]
! class="rborderplz" | [[n42ap|Global]]
|-
| 11 Jun 2012
! style="text-align:left;" | 10A5316k
| [[SundanceVail 10A5316k (Apple TV 2G)|5.1b]]
| [[SundanceVail 10A5316k (Apple TV 3G)|5.1b]]
| [[SundanceVail 10A5316k (iPad 2 Wi-Fi)|6.0b]]
| [[SundanceVail 10A5316k (iPad 2 GSM)|6.0b]]
| [[SundanceVail 10A5316k (iPad 2 CDMA)|6.0b]]
| [[SundanceVail 10A5316k (iPad 2 Wi-Fi Rev A)|6.0b]]
| [[SundanceVail 10A5316k (iPad 3 Wi-Fi)|6.0b]]
| [[SundanceVail 10A5316k (iPad 3 CDMA)|6.0b]]
| [[SundanceVail 10A5316k (iPad 3 Global)|6.0b]]
| colspan="6" rowspan="5" {{n/a}}
| [[SundanceVail 10A5316k (iPhone 3GS)|6.0b]]
| [[SundanceVail 10A5316k (iPhone 4 GSM)|6.0b]]
| rowspan="8" {{n/a}}
| [[SundanceVail 10A5316k (iPhone 4 CDMA)|6.0b]]
| [[SundanceVail 10A5316k (iPhone 4S)|6.0b]]
| colspan="2" rowspan="5" {{n/a}}
| [[SundanceVail 10A5316k (iPod touch 4G)|6.0b]]
| rowspan="5" {{n/a}}
|-
| 25 Jun 2012
! style="text-align:left;" | 10A5338d
| [[SundanceVail 10A5338d (Apple TV 2G)|5.1b2]]
| [[SundanceVail 10A5338d (Apple TV 3G)|5.1b2]]
| [[SundanceVail 10A5338d (iPad 2 Wi-Fi)|6.0b2]]
| [[SundanceVail 10A5338d (iPad 2 GSM)|6.0b2]]
| [[SundanceVail 10A5338d (iPad 2 CDMA)|6.0b2]]
| [[SundanceVail 10A5338d (iPad 2 Wi-Fi Rev A)|6.0b2]]
| [[SundanceVail 10A5338d (iPad 3 Wi-Fi)|6.0b2]]
| [[SundanceVail 10A5338d (iPad 3 CDMA)|6.0b2]]
| [[SundanceVail 10A5338d (iPad 3 Global)|6.0b2]]
| [[SundanceVail 10A5338d (iPhone 3GS)|6.0b2]]
| [[SundanceVail 10A5338d (iPhone 4 GSM)|6.0b2]]
| [[SundanceVail 10A5338d (iPhone 4 CDMA)|6.0b2]]
| [[SundanceVail 10A5338d (iPhone 4S)|6.0b2]]
| class="rborderplz" | [[SundanceVail 10A5338d (iPod touch 4G)|6.0b2]]
|-
| 16 Jul 2012
! style="text-align:left;" | 10A5355d
| [[SundanceVail 10A5355d (Apple TV 2G)|5.1b3]]
| [[SundanceVail 10A5355d (Apple TV 3G)|5.1b3]]
| [[SundanceVail 10A5355d (iPad 2 Wi-Fi)|6.0b3]]
| [[SundanceVail 10A5355d (iPad 2 GSM)|6.0b3]]
| [[SundanceVail 10A5355d (iPad 2 CDMA)|6.0b3]]
| [[SundanceVail 10A5355d (iPad 2 Wi-Fi Rev A)|6.0b3]]
| [[SundanceVail 10A5355d (iPad 3 Wi-Fi)|6.0b3]]
| [[SundanceVail 10A5355d (iPad 3 CDMA)|6.0b3]]
| [[SundanceVail 10A5355d (iPad 3 Global)|6.0b3]]
| [[SundanceVail 10A5355d (iPhone 3GS)|6.0b3]]
| [[SundanceVail 10A5355d (iPhone 4 GSM)|6.0b3]]
| [[SundanceVail 10A5355d (iPhone 4 CDMA)|6.0b3]]
| [[SundanceVail 10A5355d (iPhone 4S)|6.0b3]]
| class="rborderplz" | [[SundanceVail 10A5355d (iPod touch 4G)|6.0b3]]
|-
| 6 Aug 2012
! style="text-align:left;" | 10A5376e
| [[SundanceVail 10A5376e (Apple TV 2G)|5.1b4]]
| [[SundanceVail 10A5376e (Apple TV 3G)|5.1b4]]
| [[SundanceVail 10A5376e (iPad 2 Wi-Fi)|6.0b4]]
| [[SundanceVail 10A5376e (iPad 2 GSM)|6.0b4]]
| [[SundanceVail 10A5376e (iPad 2 CDMA)|6.0b4]]
| [[SundanceVail 10A5376e (iPad 2 Wi-Fi Rev A)|6.0b4]]
| [[SundanceVail 10A5376e (iPad 3 Wi-Fi)|6.0b4]]
| [[SundanceVail 10A5376e (iPad 3 CDMA)|6.0b4]]
| [[SundanceVail 10A5376e (iPad 3 Global)|6.0b4]]
| [[SundanceVail 10A5376e (iPhone 3GS)|6.0b4]]
| [[SundanceVail 10A5376e (iPhone 4 GSM)|6.0b4]]
| [[SundanceVail 10A5376e (iPhone 4 CDMA)|6.0b4]]
| [[SundanceVail 10A5376e (iPhone 4S)|6.0b4]]
| class="rborderplz" | [[SundanceVail 10A5376e (iPod touch 4G)|6.0b4]]
|-
| 12 Sep 2012
! style="text-align:left;" | 10A403
| colspan="2" rowspan="2" {{n/a}}
| [[Sundance 10A403 (iPad 2 Wi-Fi)|6.0GM]]
| [[Sundance 10A403 (iPad 2 GSM)|6.0GM]]
| [[Sundance 10A403 (iPad 2 CDMA)|6.0GM]]
| [[Sundance 10A403 (iPad 2 Wi-Fi Rev A)|6.0GM]]
| [[Sundance 10A403 (iPad 3 Wi-Fi)|6.0GM]]
| [[Sundance 10A403 (iPad 3 CDMA)|6.0GM]]
| [[Sundance 10A403 (iPad 3 Global)|6.0GM]]
| [[Sundance 10A403 (iPhone 3GS)|6.0GM]]
| [[Sundance 10A403 (iPhone 4 GSM)|6.0GM]]
| [[Sundance 10A403 (iPhone 4 CDMA)|6.0GM]]
| [[Sundance 10A403 (iPhone 4S)|6.0GM]]
| class="rborderplz" | [[Sundance 10A403 (iPod touch 4G)|6.0GM]]
|-
| 1 Nov 2012
! style="text-align:left;" | 10B5095f
| [[BrightonVail 10B5095f (iPad 2 Wi-Fi)|6.1b]]
| [[BrightonVail 10B5095f (iPad 2 GSM)|6.1b]]
| [[BrightonVail 10B5095f (iPad 2 CDMA)|6.1b]]
| [[BrightonVail 10B5095f (iPad 2 Wi-Fi Rev A)|6.1b]]
| [[BrightonVail 10B5095f (iPad 3 Wi-Fi)|6.1b]]
| [[BrightonVail 10B5095f (iPad 3 CDMA)|6.1b]]
| [[BrightonVail 10B5095f (iPad 3 Global)|6.1b]]
| [[BrightonVail 10B5095f (iPad 4 Wi-Fi)|6.1b]]
| rowspan="2" colspan="2" {{n/a}}
| [[BrightonVail 10B5095f (iPad mini 1G Wi-Fi)|6.1b]]
| rowspan="2" colspan="2" {{n/a}}
| [[BrightonVail 10B5095f (iPhone 3GS)|6.1b]]
| [[BrightonVail 10B5095f (iPhone 4 GSM)|6.1b]]
| [[BrightonVail 10B5095f (iPhone 4 CDMA)|6.1b]]
| [[BrightonVail 10B5095f (iPhone 4S)|6.1b]]
| [[BrightonVail 10B5095f (iPhone 5 GSM)|6.1b]]
| [[BrightonVail 10B5095f (iPhone 5 Global)|6.1b]]
| [[BrightonVail 10B5095f (iPod touch 4G)|6.1b]]
| [[BrightonVail 10B5095f (iPod touch 5G)|6.1b]]
|-
| 12 Nov 2012
! style="text-align:left;" | 10B5105c
| [[BrightonVail 10B5105c (Apple TV 2G)|5.2b]]
| [[BrightonVail 10B5105c (Apple TV 3G)|5.2b]]
| [[BrightonVail 10B5105c (iPad 2 Wi-Fi)|6.1b2]]
| [[BrightonVail 10B5105c (iPad 2 GSM)|6.1b2]]
| [[BrightonVail 10B5105c (iPad 2 CDMA)|6.1b2]]
| [[BrightonVail 10B5105c (iPad 2 Wi-Fi Rev A)|6.1b2]]
| [[BrightonVail 10B5105c (iPad 3 Wi-Fi)|6.1b2]]
| [[BrightonVail 10B5105c (iPad 3 CDMA)|6.1b2]]
| [[BrightonVail 10B5105c (iPad 3 Global)|6.1b2]]
| [[BrightonVail 10B5105c (iPad 4 Wi-Fi)|6.1b2]]
| [[BrightonVail 10B5105c (iPad mini 1G Wi-Fi)|6.1b2]]
| [[BrightonVail 10B5105c (iPhone 3GS)|6.1b2]]
| [[BrightonVail 10B5105c (iPhone 4 GSM)|6.1b2]]
| [[BrightonVail 10B5105c (iPhone 4 CDMA)|6.1b2]]
| [[BrightonVail 10B5105c (iPhone 4S)|6.1b2]]
| [[BrightonVail 10B5105c (iPhone 5 GSM)|6.1b2]]
| [[BrightonVail 10B5105c (iPhone 5 Global)|6.1b2]]
| [[BrightonVail 10B5105c (iPod touch 4G)|6.1b2]]
| [[BrightonVail 10B5105c (iPod touch 5G)|6.1b2]]
|-
| 3 Dec 2012
! style="text-align:left;" | 10B5117b
| [[BrightonVail 10B5117b (Apple TV 2G)|5.2b2]]
| [[BrightonVail 10B5117b (Apple TV 3G)|5.2b2]]
| [[BrightonVail 10B5117b (iPad 2 Wi-Fi)|6.1b3]]
| [[BrightonVail 10B5117b (iPad 2 GSM)|6.1b3]]
| [[BrightonVail 10B5117b (iPad 2 CDMA)|6.1b3]]
| [[BrightonVail 10B5117b (iPad 2 Wi-Fi Rev A)|6.1b3]]
| [[BrightonVail 10B5117b (iPad 3 Wi-Fi)|6.1b3]]
| [[BrightonVail 10B5117b (iPad 3 CDMA)|6.1b3]]
| [[BrightonVail 10B5117b (iPad 3 Global)|6.1b3]]
| [[BrightonVail 10B5117b (iPad 4 Wi-Fi)|6.1b3]]
| [[BrightonVail 10B5117b (iPad 4 GSM)|6.1b3]]
| [[BrightonVail 10B5117b (iPad 4 Global)|6.1b3]]
| [[BrightonVail 10B5117b (iPad mini 1G Wi-Fi)|6.1b3]]
| [[BrightonVail 10B5117b (iPad mini 1G GSM)|6.1b3]]
| [[BrightonVail 10B5117b (iPad mini 1G Global)|6.1b3]]
| [[BrightonVail 10B5117b (iPhone 3GS)|6.1b3]]
| [[BrightonVail 10B5117b (iPhone 4 GSM)|6.1b3]]
| [[BrightonVail 10B5117b (iPhone 4 CDMA)|6.1b3]]
| [[BrightonVail 10B5117b (iPhone 4S)|6.1b3]]
| [[BrightonVail 10B5117b (iPhone 5 GSM)|6.1b3]]
| [[BrightonVail 10B5117b (iPhone 5 Global)|6.1b3]]
| [[BrightonVail 10B5117b (iPod touch 4G)|6.1b3]]
| [[BrightonVail 10B5117b (iPod touch 5G)|6.1b3]]
|-
| 17 Dec 2012
! style="text-align:left;" | 10B5126b
| [[BrightonVail 10B5126b (Apple TV 2G)|5.2b3]]
| [[BrightonVail 10B5126b (Apple TV 3G)|5.2b3]]
| [[BrightonVail 10B5126b (iPad 2 Wi-Fi)|6.1b4]]
| [[BrightonVail 10B5126b (iPad 2 GSM)|6.1b4]]
| [[BrightonVail 10B5126b (iPad 2 CDMA)|6.1b4]]
| [[BrightonVail 10B5126b (iPad 2 Wi-Fi Rev A)|6.1b4]]
| [[BrightonVail 10B5126b (iPad 3 Wi-Fi)|6.1b4]]
| [[BrightonVail 10B5126b (iPad 3 CDMA)|6.1b4]]
| [[BrightonVail 10B5126b (iPad 3 Global)|6.1b4]]
| [[BrightonVail 10B5126b (iPad 4 Wi-Fi)|6.1b4]]
| [[BrightonVail 10B5126b (iPad 4 GSM)|6.1b4]]
| [[BrightonVail 10B5126b (iPad 4 Global)|6.1b4]]
| [[BrightonVail 10B5126b (iPad mini 1G Wi-Fi)|6.1b4]]
| [[BrightonVail 10B5126b (iPad mini 1G GSM)|6.1b4]]
| [[BrightonVail 10B5126b (iPad mini 1G Global)|6.1b4]]
| [[BrightonVail 10B5126b (iPhone 3GS)|6.1b4]]
| [[BrightonVail 10B5126b (iPhone 4 GSM)|6.1b4]]
| [[BrightonVail 10B5126b (iPhone 4 GSM Rev A)|6.1b4]]
| [[BrightonVail 10B5126b (iPhone 4 CDMA)|6.1b4]]
| [[BrightonVail 10B5126b (iPhone 4S)|6.1b4]]
| [[BrightonVail 10B5126b (iPhone 5 GSM)|6.1b4]]
| [[BrightonVail 10B5126b (iPhone 5 Global)|6.1b4]]
| [[BrightonVail 10B5126b (iPod touch 4G)|6.1b4]]
| [[BrightonVail 10B5126b (iPod touch 5G)|6.1b4]]
|-
| rowspan="4" | 26 Jan 2013
! style="text-align:left;" | 10B141
| colspan="2" {{n/a}}
| [[Brighton 10B141 (iPad 2 Wi-Fi)|6.1b5]]
| [[Brighton 10B141 (iPad 2 GSM)|6.1b5]]
| [[Brighton 10B141 (iPad 2 CDMA)|6.1b5]]
| [[Brighton 10B141 (iPad 2 Wi-Fi Rev A)|6.1b5]]
| [[Brighton 10B141 (iPad 3 Wi-Fi)|6.1b5]]
| [[Brighton 10B141 (iPad 3 CDMA)|6.1b5]]
| [[Brighton 10B141 (iPad 3 Global)|6.1b5]]
| [[Brighton 10B141 (iPad 4 Wi-Fi)|6.1b5]]
| [[Brighton 10B141 (iPad 4 GSM)|6.1b5]]
| [[Brighton 10B141 (iPad 4 Global)|6.1b5]]
| [[Brighton 10B141 (iPad mini 1G Wi-Fi)|6.1b5]]
| [[Brighton 10B141 (iPad mini 1G GSM)|6.1b5]]
| [[Brighton 10B141 (iPad mini 1G Global)|6.1b5]]
| [[Brighton 10B141 (iPhone 3GS)|6.1b5]]
| colspan="2" {{n/a}}
| [[Brighton 10B141 (iPhone 4 CDMA)|6.1b5]]
| colspan="4" {{n/a}}
| [[Brighton 10B141 (iPod touch 5G)|6.1b5]]
|-
! style="text-align:left;" | 10B142
| colspan="19" {{n/a}}
| [[Brighton 10B142 (iPhone 4S)|6.1b5]]
| colspan="7" {{n/a}}
|-
! style="text-align:left;" | 10B143
| colspan="20" {{n/a}}
| [[Brighton 10B143 (iPhone 5 GSM)|6.1b5]]
| [[Brighton 10B143 (iPhone 5 Global)|6.1b5]]
| colspan="2" {{n/a}}
|-
! style="text-align:left;" | 10B144
| colspan="16" {{n/a}}
| [[Brighton 10B144 (iPhone 4 GSM)|6.1b5]]
| [[Brighton 10B144 (iPhone 4 GSM Rev A)|6.1b5]]
| colspan="4" {{n/a}}
| [[Brighton 10B144 (iPod touch 4G)|6.1b5]]
| colspan="1" {{n/a}}
|-
| rowspan="1" | 6 Feb 2013
! style="text-align:left;" | 10B311
| colspan="2" {{n/a}}
| [[BrightonMaps 10B311 (iPad 2 Wi-Fi)|6.1.1b]]
| [[BrightonMaps 10B311 (iPad 2 GSM)|6.1.1b]]
| [[BrightonMaps 10B311 (iPad 2 CDMA)|6.1.1b]]
| [[BrightonMaps 10B311 (iPad 2 Wi-Fi Rev A)|6.1.1b]]
| [[BrightonMaps 10B311 (iPad 3 Wi-Fi)|6.1.1b]]
| [[BrightonMaps 10B311 (iPad 3 CDMA)|6.1.1b]]
| [[BrightonMaps 10B311 (iPad 3 Global)|6.1.1b]]
| [[BrightonMaps 10B311 (iPad 4 Wi-Fi)|6.1.1b]]
| [[BrightonMaps 10B311 (iPad 4 GSM)|6.1.1b]]
| [[BrightonMaps 10B311 (iPad 4 Global)|6.1.1b]]
| [[BrightonMaps 10B311 (iPad mini 1G Wi-Fi)|6.1.1b]]
| [[BrightonMaps 10B311 (iPad mini 1G GSM)|6.1.1b]]
| [[BrightonMaps 10B311 (iPad mini 1G Global)|6.1.1b]]
| [[BrightonMaps 10B311 (iPhone 3GS)|6.1.1b]]
| [[BrightonMaps 10B311 (iPhone 4 GSM)|6.1.1b]]
| [[BrightonMaps 10B311 (iPhone 4 GSM Rev A)|6.1.1b]]
| [[BrightonMaps 10B311 (iPhone 4 CDMA)|6.1.1b]]
| [[BrightonMaps 10B311 (iPhone 4S)|6.1.1b]]
| [[BrightonMaps 10B311 (iPhone 5 GSM)|6.1.1b]]
| [[BrightonMaps 10B311 (iPhone 5 Global)|6.1.1b]]
| [[BrightonMaps 10B311 (iPod touch 4G)|6.1.1b]]
| [[BrightonMaps 10B311 (iPod touch 5G)|6.1.1b]]
|-
| rowspan="2" | 21 Feb 2013
! style="text-align:left;" | 10B318
| colspan="15" {{n/a}}
| [[BrightonMaps 10B318 (iPhone 3GS)|6.1.3b2]]
| [[BrightonMaps 10B318 (iPhone 4 GSM)|6.1.3b2]]
| [[BrightonMaps 10B318 (iPhone 4 GSM Rev A)|6.1.3b2]]
| [[BrightonMaps 10B318 (iPhone 4 CDMA)|6.1.3b2]]
| [[BrightonMaps 10B318 (iPhone 4S)|6.1.3b2]]
| [[BrightonMaps 10B318 (iPhone 5 GSM)|6.1.3b2]]
| [[BrightonMaps 10B318 (iPhone 5 Global)|6.1.3b2]]
| [[BrightonMaps 10B318 (iPod touch 4G)|6.1.3b2]]
| [[BrightonMaps 10B318 (iPod touch 5G)|6.1.3b2]]
|-
! style="text-align:left;" | 10B318a
| colspan="2" {{n/a}}
| [[BrightonMaps 10B318a (iPad 2 Wi-Fi)|6.1.3b2]]
| [[BrightonMaps 10B318a (iPad 2 GSM)|6.1.3b2]]
| [[BrightonMaps 10B318a (iPad 2 CDMA)|6.1.3b2]]
| [[BrightonMaps 10B318a (iPad 2 Wi-Fi Rev A)|6.1.3b2]]
| [[BrightonMaps 10B318a (iPad 3 Wi-Fi)|6.1.3b2]]
| [[BrightonMaps 10B318a (iPad 3 CDMA)|6.1.3b2]]
| [[BrightonMaps 10B318a (iPad 3 Global)|6.1.3b2]]
| [[BrightonMaps 10B318a (iPad 4 Wi-Fi)|6.1.3b2]]
| [[BrightonMaps 10B318a (iPad 4 GSM)|6.1.3b2]]
| [[BrightonMaps 10B318a (iPad 4 Global)|6.1.3b2]]
| [[BrightonMaps 10B318a (iPad mini 1G Wi-Fi)|6.1.3b2]]
| [[BrightonMaps 10B318a (iPad mini 1G GSM)|6.1.3b2]]
| [[BrightonMaps 10B318a (iPad mini 1G Global)|6.1.3b2]]
| colspan="9" {{n/a}}
|}

==== 7.x ====
{| class="wikitable"
|-
! rowspan="3" | Date
! rowspan="3" | Build
! colspan="3" | [[Apple TV]]
! colspan="12" | [[iPad]]
! colspan="5" | [[iPad mini]]
! colspan="10" | [[iPhone]]
! colspan="1" | [[iPod touch]]
|-
! rowspan="2" | [[k66ap|2G]]
! colspan="2" | [[Apple TV 3G|3G]]
! colspan="4" | [[iPad 2|2]]
! colspan="3" | [[iPad 3|3]]
! colspan="3" | [[iPad 4|4]]
! colspan="2" | [[iPad Air|Air]]
! colspan="3" | [[iPad mini 1G|1G]]
! colspan="2" | [[iPad mini 2G|2G]]
! colspan="3" | [[iPhone 4|4]]
! rowspan="2" | [[n94ap|4S]]
! colspan="2" | [[iPhone 5|5]]
! colspan="2" | [[iPhone 5c|5c]]
! colspan="2" | [[iPhone 5s|5s]]
! rowspan="2" | [[iPod touch 5G|5G]]
|-
! [[j33ap|Orig]]
! [[j33iap|Rev A]]
! [[k93ap|Wi‑Fi]]
! [[k94ap|GSM]]
! [[k95ap|CDMA]]
! [[k93aap|Wi‑Fi (A)]]
! [[j1ap|Wi‑Fi]]
! [[j2ap|CDMA]]
! [[j2aap|Global]]
! [[p101ap|Wi‑Fi]]
! [[p102ap|GSM]]
! [[p103ap|Global]]
! [[j71ap|Wi‑Fi]]
! [[j72ap|Cellular]]
! [[p105ap|Wi‑Fi]]
! [[p106ap|GSM]]
! [[p107ap|Global]]
! [[j85ap|Wi‑Fi]]
! [[j86ap|Cellular]]
! [[n90ap|GSM]]
! [[n90bap|GSM (A)]]
! [[n92ap|CDMA]]
! [[n41ap|GSM]]
! [[n42ap|Global]]
! [[n48ap|GSM]]
! [[n49ap|Global]]
! [[n51ap|GSM]]
! class="rborderplz" | [[n53ap|Global]]
|-
| 10 Jun 2013
! style="text-align:left;" | 11A4372q
| [[InnsbruckVailPrime 11A4372q (Apple TV 2G)|5.4b]]
| [[InnsbruckVailPrime 11A4372q (Apple TV 3G)|5.4b]]
| [[InnsbruckVailPrime 11A4372q (Apple TV 3G Rev A)|5.4b]]
| colspan="17" {{n/a}}
| [[InnsbruckVailPrime 11A4372q (iPhone 4 GSM)|7.0b]]
| [[InnsbruckVailPrime 11A4372q (iPhone 4 GSM Rev A)|7.0b]]
| [[InnsbruckVailPrime 11A4372q (iPhone 4 CDMA)|7.0b]]
| [[InnsbruckVailPrime 11A4372q (iPhone 4S)|7.0b]]
| [[InnsbruckVailPrime 11A4372q (iPhone 5 GSM)|7.0b]]
| [[InnsbruckVailPrime 11A4372q (iPhone 5 Global)|7.0b]]
| rowspan="7" colspan="4" {{n/a}}
| [[InnsbruckVailPrime 11A4372q (iPod touch 5G)|7.0b]]
|-
| 24 Jun 2013
! style="text-align:left;" | 11A4400f
| [[InnsbruckVailPrime 11A4400f (Apple TV 2G)|5.4b2]]
| [[InnsbruckVailPrime 11A4400f (Apple TV 3G)|5.4b2]]
| [[InnsbruckVailPrime 11A4400f (Apple TV 3G Rev A)|5.4b2]]
| [[InnsbruckVailPrime 11A4400f (iPad 2 Wi-Fi)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPad 2 GSM)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPad 2 CDMA)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPad 2 Wi-Fi Rev A)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPad 3 Wi-Fi)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPad 3 CDMA)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPad 3 Global)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPad 4 Wi-Fi)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPad 4 GSM)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPad 4 Global)|7.0b2]]
| rowspan="6" colspan="2" {{n/a}}
| [[InnsbruckVailPrime 11A4400f (iPad mini 1G Wi-Fi)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPad mini 1G GSM)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPad mini 1G Global)|7.0b2]]
| rowspan="6" colspan="2" {{n/a}}
| [[InnsbruckVailPrime 11A4400f (iPhone 4 GSM)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPhone 4 GSM Rev A)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPhone 4 CDMA)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPhone 4S)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPhone 5 GSM)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPhone 5 Global)|7.0b2]]
| [[InnsbruckVailPrime 11A4400f (iPod touch 5G)|7.0b2]]
|-
| 8 Jul 2013
! style="text-align:left;" | 11A4414e
| colspan="3" {{n/a}}
| [[InnsbruckVailPrime 11A4414e (iPad 2 Wi-Fi)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPad 2 GSM)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPad 2 CDMA)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPad 2 Wi-Fi Rev A)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPad 3 Wi-Fi)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPad 3 CDMA)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPad 3 Global)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPad 4 Wi-Fi)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPad 4 GSM)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPad 4 Global)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPad mini 1G Wi-Fi)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPad mini 1G GSM)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPad mini 1G Global)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPhone 4 GSM)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPhone 4 GSM Rev A)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPhone 4 CDMA)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPhone 4S)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPhone 5 GSM)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPhone 5 Global)|7.0b3]]
| [[InnsbruckVailPrime 11A4414e (iPod touch 5G)|7.0b3]]
|-
| 29 Jul 2013
! style="text-align:left;" | 11A4435d
| [[InnsbruckVailPrime 11A4435d (Apple TV 2G)|6.0b3]]
| [[InnsbruckVailPrime 11A4435d (Apple TV 3G)|6.0b3]]
| [[InnsbruckVailPrime 11A4435d (Apple TV 3G Rev A)|6.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad 2 Wi-Fi)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad 2 GSM)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad 2 CDMA)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad 2 Wi-Fi Rev A)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad 3 Wi-Fi)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad 3 CDMA)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad 3 Global)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad 4 Wi-Fi)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad 4 GSM)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad 4 Global)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad mini 1G Wi-Fi)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad mini 1G GSM)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPad mini 1G Global)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPhone 4 GSM)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPhone 4 GSM Rev A)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPhone 4 CDMA)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPhone 4S)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPhone 5 GSM)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPhone 5 Global)|7.0b4]]
| [[InnsbruckVailPrime 11A4435d (iPod touch 5G)|7.0b4]]
|-
| 6 Aug 2013
! style="text-align:left;" | 11A4449a
| [[InnsbruckVailPrime 11A4449a (Apple TV 2G)|6.0b4]]
| [[InnsbruckVailPrime 11A4449a (Apple TV 3G)|6.0b4]]
| [[InnsbruckVailPrime 11A4449a (Apple TV 3G Rev A)|6.0b4]]
| [[InnsbruckVailPrime 11A4449a (iPad 2 Wi-Fi)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPad 2 GSM)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPad 2 CDMA)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPad 2 Wi-Fi Rev A)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPad 3 Wi-Fi)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPad 3 CDMA)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPad 3 Global)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPad 4 Wi-Fi)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPad 4 GSM)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPad 4 Global)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPad mini 1G Wi-Fi)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPad mini 1G GSM)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPad mini 1G Global)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPhone 4 GSM)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPhone 4 GSM Rev A)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPhone 4 CDMA)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPhone 4S)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPhone 5 GSM)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPhone 5 Global)|7.0b5]]
| [[InnsbruckVailPrime 11A4449a (iPod touch 5G)|7.0b5]]
|-
| 15 Aug 2013
! style="text-align:left;" | 11A4449d
| rowspan="2" colspan="3" {{n/a}}
| [[InnsbruckVailPrime 11A4449d (iPad 2 Wi-Fi)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPad 2 GSM)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPad 2 CDMA)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPad 2 Wi-Fi Rev A)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPad 3 Wi-Fi)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPad 3 CDMA)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPad 3 Global)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPad 4 Wi-Fi)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPad 4 GSM)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPad 4 Global)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPad mini 1G Wi-Fi)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPad mini 1G GSM)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPad mini 1G Global)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPhone 4 GSM)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPhone 4 GSM Rev A)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPhone 4 CDMA)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPhone 4S)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPhone 5 GSM)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPhone 5 Global)|7.0b6]]
| [[InnsbruckVailPrime 11A4449d (iPod touch 5G)|7.0b6]]
|-
| 10 Sep 2013
! style="text-align:left;" | 11A465
| [[Innsbruck 11A465 (iPad 2 Wi-Fi)|7.0GM]]
| [[Innsbruck 11A465 (iPad 2 GSM)|7.0GM]]
| [[Innsbruck 11A465 (iPad 2 CDMA)|7.0GM]]
| [[Innsbruck 11A465 (iPad 2 Wi-Fi Rev A)|7.0GM]]
| [[Innsbruck 11A465 (iPad 3 Wi-Fi)|7.0GM]]
| [[Innsbruck 11A465 (iPad 3 CDMA)|7.0GM]]
| [[Innsbruck 11A465 (iPad 3 Global)|7.0GM]]
| [[Innsbruck 11A465 (iPad 4 Wi-Fi)|7.0GM]]
| [[Innsbruck 11A465 (iPad 4 GSM)|7.0GM]]
| [[Innsbruck 11A465 (iPad 4 Global)|7.0GM]]
| [[Innsbruck 11A465 (iPad mini 1G Wi-Fi)|7.0GM]]
| [[Innsbruck 11A465 (iPad mini 1G GSM)|7.0GM]]
| [[Innsbruck 11A465 (iPad mini 1G Global)|7.0GM]]
| [[Innsbruck 11A465 (iPhone 4 GSM)|7.0GM]]
| [[Innsbruck 11A465 (iPhone 4 GSM Rev A)|7.0GM]]
| [[Innsbruck 11A465 (iPhone 4 CDMA)|7.0GM]]
| [[Innsbruck 11A465 (iPhone 4S)|7.0GM]]
| [[Innsbruck 11A465 (iPhone 5 GSM)|7.0GM]]
| [[Innsbruck 11A465 (iPhone 5 Global)|7.0GM]]
| [[Innsbruck 11A465 (iPod touch 5G)|7.0GM]]
|-
| 18 Nov 2013
! style="text-align:left;" |11D5099e
| [[SochiVail 11D5099e (Apple TV 2G)|6.1b]]
| [[SochiVail 11D5099e (Apple TV 3G)| 6.1b]]
| [[SochiVail 11D5099e (Apple TV 3G Rev A)| 6.1b]]
| [[SochiVail 11D5099e (iPad 2 Wi-Fi)|7.1b]]
| [[SochiVail 11D5099e (iPad 2 GSM)|7.1b]]
| [[SochiVail 11D5099e (iPad 2 CDMA)|7.1b]]
| [[SochiVail 11D5099e (iPad 2 Wi-Fi Rev A)|7.1b]]
| [[SochiVail 11D5099e (iPad 3 Wi-Fi)|7.1b]]
| [[SochiVail 11D5099e (iPad 3 CDMA)|7.1b]]
| [[SochiVail 11D5099e (iPad 3 Global)|7.1b]]
| [[SochiVail 11D5099e (iPad 4 Wi-Fi)|7.1b]]
| [[SochiVail 11D5099e (iPad 4 GSM)|7.1b]]
| [[SochiVail 11D5099e (iPad 4 Global)|7.1b]]
| [[SochiVail 11D5099e (iPad Air Wi-Fi)|7.1b]]
| [[SochiVail 11D5099e (iPad Air Cellular)|7.1b]]
| [[SochiVail 11D5099e (iPad mini 1G Wi-Fi)|7.1b]]
| [[SochiVail 11D5099e (iPad mini 1G GSM)|7.1b]]
| [[SochiVail 11D5099e (iPad mini 1G Global)|7.1b]]
| [[SochiVail 11D5099e (iPad mini 2G Wi-Fi)|7.1b]]
| [[SochiVail 11D5099e (iPad mini 2G Cellular)|7.1b]]
| [[SochiVail 11D5099e (iPhone 4 GSM)|7.1b]]
| [[SochiVail 11D5099e (iPhone 4 GSM Rev A)|7.1b]]
| [[SochiVail 11D5099e (iPhone 4 CDMA)|7.1b]]
| [[SochiVail 11D5099e (iPhone 4S)|7.1b]]
| [[SochiVail 11D5099e (iPhone 5 GSM)|7.1b]]
| [[SochiVail 11D5099e (iPhone 5 Global)|7.1b]]
| [[SochiVail 11D5099e (iPhone 5c GSM)|7.1b]]
| [[SochiVail 11D5099e (iPhone 5c Global)|7.1b]]
| [[SochiVail 11D5099e (iPhone 5s GSM)|7.1b]]
| [[SochiVail 11D5099e (iPhone 5s Global)|7.1b]]
| [[Innsbruck 11D5099e (iPod touch 5G)|7.1b]]
|-
| 14 Dec 2013
! style="text-align:left;" | 11D5115d
| [[SochiVail 11D5115d (Apple TV 2G)|6.1b2]]
| [[SochiVail 11D5115d (Apple TV 3G)| 6.1b2]]
| [[SochiVail 11D5115d (Apple TV 3G Rev A)| 6.1b2]]
| [[SochiVail 11D5115d (iPad 2 Wi-Fi)|7.1b2]]
| [[SochiVail 11D5115d (iPad 2 GSM)|7.1b2]]
| [[SochiVail 11D5115d (iPad 2 CDMA)|7.1b2]]
| [[SochiVail 11D5115d (iPad 2 Wi-Fi Rev A)|7.1b2]]
| [[SochiVail 11D5115d (iPad 3 Wi-Fi)|7.1b2]]
| [[SochiVail 11D5115d (iPad 3 CDMA)|7.1b2]]
| [[SochiVail 11D5115d (iPad 3 Global)|7.1b2]]
| [[SochiVail 11D5115d (iPad 4 Wi-Fi)|7.1b2]]
| [[SochiVail 11D5115d (iPad 4 GSM)|7.1b2]]
| [[SochiVail 11D5115d (iPad 4 Global)|7.1b2]]
| [[SochiVail 11D5115d (iPad Air Wi-Fi)|7.1b2]]
| [[SochiVail 11D5115d (iPad Air Cellular)|7.1b2]]
| [[SochiVail 11D5115d (iPad mini 1G Wi-Fi)|7.1b2]]
| [[SochiVail 11D5115d (iPad mini 1G GSM)|7.1b2]]
| [[SochiVail 11D5115d (iPad mini 1G Global)|7.1b2]]
| [[SochiVail 11D5115d (iPad mini 2G Wi-Fi)|7.1b2]]
| [[SochiVail 11D5115d (iPad mini 2G Cellular)|7.1b2]]
| [[SochiVail 11D5115d (iPhone 4 GSM)|7.1b2]]
| [[SochiVail 11D5115d (iPhone 4 GSM Rev A)|7.1b2]]
| [[SochiVail 11D5115d (iPhone 4 CDMA)|7.1b2]]
| [[SochiVail 11D5115d (iPhone 4S)|7.1b2]]
| [[SochiVail 11D5115d (iPhone 5 GSM)|7.1b2]]
| [[SochiVail 11D5115d (iPhone 5 Global)|7.1b2]]
| [[SochiVail 11D5115d (iPhone 5c GSM)|7.1b2]]
| [[SochiVail 11D5115d (iPhone 5c Global)|7.1b2]]
| [[SochiVail 11D5115d (iPhone 5s GSM)|7.1b2]]
| [[SochiVail 11D5115d (iPhone 5s Global)|7.1b2]]
| [[Innsbruck 11D5115d (iPod touch 5G)|7.1b2]]
|-
| 7 Jan 2014
! style="text-align:left;" | 11D5127c
| [[SochiVail 11D5127c (Apple TV 2G)|6.1b3]]
| [[SochiVail 11D5127c (Apple TV 3G)|6.1b3]]
| [[SochiVail 11D5127c (Apple TV 3G Rev A)|6.1b3]]
| [[SochiVail 11D5127c (iPad 2 Wi-Fi)|7.1b3]]
| [[SochiVail 11D5127c (iPad 2 GSM)|7.1b3]]
| [[SochiVail 11D5127c (iPad 2 CDMA)|7.1b3]]
| [[SochiVail 11D5127c (iPad 2 Wi-Fi Rev A)|7.1b3]]
| [[SochiVail 11D5127c (iPad 3 Wi-Fi)|7.1b3]]
| [[SochiVail 11D5127c (iPad 3 CDMA)|7.1b3]]
| [[SochiVail 11D5127c (iPad 3 Global)|7.1b3]]
| [[SochiVail 11D5127c (iPad 4 Wi-Fi)|7.1b3]]
| [[SochiVail 11D5127c (iPad 4 GSM)|7.1b3]]
| [[SochiVail 11D5127c (iPad 4 Global)|7.1b3]]
| [[SochiVail 11D5127c (iPad Air Wi-Fi)|7.1b3]]
| [[SochiVail 11D5127c (iPad Air Cellular)|7.1b3]]
| [[SochiVail 11D5127c (iPad mini 1G Wi-Fi)|7.1b3]]
| [[SochiVail 11D5127c (iPad mini 1G GSM)|7.1b3]]
| [[SochiVail 11D5127c (iPad mini 1G Global)|7.1b3]]
| [[SochiVail 11D5127c (iPad mini 2G Wi-Fi)|7.1b3]]
| [[SochiVail 11D5127c (iPad mini 2G Cellular)|7.1b3]]
| [[SochiVail 11D5127c (iPhone 4 GSM)|7.1b3]]
| [[SochiVail 11D5127c (iPhone 4 GSM Rev A)|7.1b3]]
| [[SochiVail 11D5127c (iPhone 4 CDMA)|7.1b3]]
| [[SochiVail 11D5127c (iPhone 4S)|7.1b3]]
| [[SochiVail 11D5127c (iPhone 5 GSM)|7.1b3]]
| [[SochiVail 11D5127c (iPhone 5 Global)|7.1b3]]
| [[SochiVail 11D5127c (iPhone 5c GSM)|7.1b3]]
| [[SochiVail 11D5127c (iPhone 5c Global)|7.1b3]]
| [[SochiVail 11D5127c (iPhone 5s GSM)|7.1b3]]
| [[SochiVail 11D5127c (iPhone 5s Global)|7.1b3]]
| [[Innsbruck 11D5127c (iPod touch 5G)|7.1b3]]
|-
| 20 Jan 2014
! style="text-align:left;" | 11D5134c
| [[SochiVail 11D5134c (AppleTV2,1)|6.1b4]]
| [[SochiVail 11D5134c (AppleTV3,1)|6.1b4]]
| [[SochiVail 11D5134c (AppleTV3,2)|6.1b4]]
| [[SochiVail 11D5134c (iPad2,1)|7.1b4]]
| [[SochiVail 11D5134c (iPad2,2)|7.1b4]]
| [[SochiVail 11D5134c (iPad2,3)|7.1b4]]
| [[SochiVail 11D5134c (iPad2,4)|7.1b4]]
| [[SochiVail 11D5134c (iPad3,1)|7.1b4]]
| [[SochiVail 11D5134c (iPad3,2)|7.1b4]]
| [[SochiVail 11D5134c (iPad3,3)|7.1b4]]
| [[SochiVail 11D5134c (iPad3,4)|7.1b4]]
| [[SochiVail 11D5134c (iPad3,5)|7.1b4]]
| [[SochiVail 11D5134c (iPad3,6)|7.1b4]]
| [[SochiVail 11D5134c (iPad4,1)|7.1b4]]
| [[SochiVail 11D5134c (iPad4,2)|7.1b4]]
| [[SochiVail 11D5134c (iPad2,5)|7.1b4]]
| [[SochiVail 11D5134c (iPad2,6)|7.1b4]]
| [[SochiVail 11D5134c (iPad2,7)|7.1b4]]
| [[SochiVail 11D5134c (iPad4,4)|7.1b4]]
| [[SochiVail 11D5134c (iPad4,5)|7.1b4]]
| [[SochiVail 11D5134c (iPhone3,1)|7.1b4]]
| [[SochiVail 11D5134c (iPhone3,2)|7.1b4]]
| [[SochiVail 11D5134c (iPhone3,3)|7.1b4]]
| [[SochiVail 11D5134c (iPhone4,1)|7.1b4]]
| [[SochiVail 11D5134c (iPhone5,1)|7.1b4]]
| [[SochiVail 11D5134c (iPhone5,2)|7.1b4]]
| [[SochiVail 11D5134c (iPhone5,3)|7.1b4]]
| [[SochiVail 11D5134c (iPhone5,4)|7.1b4]]
| [[SochiVail 11D5134c (iPhone6,1)|7.1b4]]
| [[SochiVail 11D5134c (iPhone6,2)|7.1b4]]
| [[Innsbruck 11D5134c (iPod5,1)|7.1b4]]
|-
| 4 Feb 2014
! style="text-align:left;" | 11D5145e
| [[SochiVail 11D5145e (AppleTV2,1)|6.1b5]]
| [[SochiVail 11D5145e (AppleTV3,1)|6.1b5]]
| [[SochiVail 11D5145e (AppleTV3,2)|6.1b5]]
| [[SochiVail 11D5145e (iPad2,1)|7.1b5]]
| [[SochiVail 11D5145e (iPad2,2)|7.1b5]]
| [[SochiVail 11D5145e (iPad2,3)|7.1b5]]
| [[SochiVail 11D5145e (iPad2,4)|7.1b5]]
| [[SochiVail 11D5145e (iPad3,1)|7.1b5]]
| [[SochiVail 11D5145e (iPad3,2)|7.1b5]]
| [[SochiVail 11D5145e (iPad3,3)|7.1b5]]
| [[SochiVail 11D5145e (iPad3,4)|7.1b5]]
| [[SochiVail 11D5145e (iPad3,5)|7.1b5]]
| [[SochiVail 11D5145e (iPad3,6)|7.1b5]]
| [[SochiVail 11D5145e (iPad4,1)|7.1b5]]
| [[SochiVail 11D5145e (iPad4,2)|7.1b5]]
| [[SochiVail 11D5145e (iPad2,5)|7.1b5]]
| [[SochiVail 11D5145e (iPad2,6)|7.1b5]]
| [[SochiVail 11D5145e (iPad2,7)|7.1b5]]
| [[SochiVail 11D5145e (iPad4,4)|7.1b5]]
| [[SochiVail 11D5145e (iPad4,5)|7.1b5]]
| [[SochiVail 11D5145e (iPhone3,1)|7.1b5]]
| [[SochiVail 11D5145e (iPhone3,2)|7.1b5]]
| [[SochiVail 11D5145e (iPhone3,3)|7.1b5]]
| [[SochiVail 11D5145e (iPhone4,1)|7.1b5]]
| [[SochiVail 11D5145e (iPhone5,1)|7.1b5]]
| [[SochiVail 11D5145e (iPhone5,2)|7.1b5]]
| [[SochiVail 11D5145e (iPhone5,3)|7.1b5]]
| [[SochiVail 11D5145e (iPhone5,4)|7.1b5]]
| [[SochiVail 11D5145e (iPhone6,1)|7.1b5]]
| [[SochiVail 11D5145e (iPhone6,2)|7.1b5]]
| [[Innsbruck 11D5145e (iPod5,1)|7.1b5]]
|}
[[Category:Decryption]]

IBoot (Bootloader)

2014-02-03T13:03:52Z

R3pwn: /* Exploits */

{{lowercase}}
'''iBoot''' is Apple's stage 2 bootloader for all of the [[iDevice|devices]]. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== [[Bootrom]] ==
The bootrom also goes by the name "iBoot." The list of bootroms can be found on [[Bootrom|their own page]].

== Extract and Disassemble ==
To extract the bootloader and disassemble using IDA, follow the following steps:
#obtain the bootloader from the iPSW. This file is in the <code>Firmware/all_flash</code> subdir, e.g. <code>Firmware/all_flash/all_flash.n81ap.production/iBoot.n81ap.RELEASE.img3</code>, where the "n81ap", "k90", etc.. are for the i-Device type
#run xpwntool with the proper key (from elsewhere in this Wiki)
#Make sure the decryption was successful - if it is, you should see:
"iBoot for ...., Copyright 2011, Apple Inc."
if you cat (i.e. type) the file.
<ol><li value="4">remove the img3 header - the good stuff starts at offset 0x40 (i.e. 64) - using dd (skip=1 bs=64) or some other tool</li>
<li>Load in IDA. Set processor to ARM. Rebase program (Edit→Segments→Rebase Program) to 0x5FF00000 (for iBoot in iOS 5). You should see something like:</li></ol>

<pre>
ROM:5FF00000 loc_5FF00000 ; CODE XREF: ROM:5FF00078�j
ROM:5FF00000 B loc_5FF00040 ; Used for Reset - This is where we start
ROM:5FF00004 ; ---------------------------------------------------------------------------
ROM:5FF00004 LDR PC, =sub_5FF16FB4 ; Used for Undef
ROM:5FF00008 ; ---------------------------------------------------------------------------
ROM:5FF00008 LDR PC, =sub_5FF16FEC ; Used for SWI
ROM:5FF0000C ; ---------------------------------------------------------------------------
ROM:5FF0000C LDR PC, =sub_5FF17024 ; Used for Prefabt
ROM:5FF00010 ; ---------------------------------------------------------------------------
ROM:5FF00010 LDR PC, =sub_5FF17060 ; Used for DataAbt
ROM:5FF00014 ; ---------------------------------------------------------------------------
ROM:5FF00014 LDR PC, =loc_5FF17098 ; Used for AddrExc
ROM:5FF00018 ; ---------------------------------------------------------------------------
ROM:5FF00018 LDR PC, =loc_5FF16F24 ; Used for IRQ
ROM:5FF0001C ; ---------------------------------------------------------------------------
ROM:5FF0001C LDR PC, =sub_5FF16F6C ; Probably FIQ, need to verify this
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00020 SVCPL 0xF00040
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00024 off_5FF00024 DCD sub_5FF16FB4 ; DATA XREF: ROM:5FF00004�r
ROM:5FF00028 off_5FF00028 DCD sub_5FF16FEC ; DATA XREF: ROM:5FF00008�r
ROM:5FF0002C off_5FF0002C DCD sub_5FF17024 ; DATA XREF: ROM:5FF0000C�r
ROM:5FF00030 off_5FF00030 DCD sub_5FF17060 ; DATA XREF: ROM:5FF00010�r
ROM:5FF00034 off_5FF00034 DCD loc_5FF17098 ; DATA XREF: ROM:5FF00014�r
ROM:5FF00038 off_5FF00038 DCD loc_5FF16F24 ; DATA XREF: ROM:5FF00018�r
ROM:5FF0003C off_5FF0003C DCD sub_5FF16F6C ; DATA XREF: ROM:5FF0001C�r
ROM:5FF00040 ; ---------------------------------------------------------------------------
ROM:5FF00040
ROM:5FF00040 loc_5FF00040 ; CODE XREF: ROM:loc_5FF00000�j
ROM:5FF00040 ADR R0, loc_5FF00000 <-- The address we rebased to
ROM:5FF00044 LDR R1, =loc_5FF00000
ROM:5FF00048 CMP R0, R1
ROM:5FF0004C CMP R0, R1
ROM:5FF00050 BEQ loc_5FF0007C
...
...
ROM:5FF000E8 loc_5FF000E8 ; CODE XREF: ROM:5FF000F0�j
ROM:5FF000E8 CMP R0, R1
ROM:5FF000EC STRLT R2, [R0],#4
ROM:5FF000F0 BLT loc_5FF000E8
ROM:5FF000F4 LDR R0, =(_ibootStart+1)
ROM:5FF000F8 MOV LR, PC
ROM:5FF000FC BX R0 ; _ibootStart
ROM:5FF00100
ROM:5FF00100 loc_5FF00100 ; CODE XREF: ROM:loc_5FF00100�j
ROM:5FF00100 B loc_5FF00100
</pre>

Where iBootStart (not the official Apple Symbol, of course) can be seen at:

<pre>
ROM:5FF00BA4 _ibootStart ; CODE XREF: ROM:5FF000FC�p
ROM:5FF00BA4 ; DATA XREF: ROM:5FF000F4�o ...
ROM:5FF00BA4 PUSH {R7,LR}
ROM:5FF00BA6 MOV R7, SP
ROM:5FF00BA8 LDR R0, =aIbootStart ; "\niBoot start\n"
ROM:5FF00BAA BL loc_5FF233C4
ROM:5FF00BAE MOVS R0, #0
ROM:5FF00BB0 BL loc_5FF16E54
ROM:5FF00BB4 BL loc_5FF1570C
ROM:5FF00BB8 BL loc_5FF143A8
ROM:5FF00BBC BL unk_5FF15264
ROM:5FF00BC0 LDR R0, =aMain ; "main"
..
</pre>

== Flow of iBoot (1219 - 5.0.x) ==
iBoot is quite a complicated binary, which spawns several ARM tasks to enable the boot process:

- iBootStart (disassembly started above) - starts main (5FF00BCA) - which calls the main function at 5FF00C14
- main: Does the good stuff (loading the kernel, etc)
starts the poweroff task (5FF00EF2) - calls (sub_5FF00FD0+1)
In recovery mode (failed boot):
starts command (5FF00F0A) - calls 5FF15928
starts idleoff (5FF99F2E) - calls 5FF01060

== Revisions ==
[[iBoot-99]] 1.0b (Build 1A420) [Unreleased]
[[iBoot-159]] 1.0 (Build 1A543a)
1.0.1 (Build 1C25)
1.0.2 (Build 1C28)
[[iBoot-204]] 1.1 (Build 3A100)
1.1 (Build 3A101)
1.1.1 (Build 3A109a)
[[iBoot-204.0.2]] 1.1.1 (Build 3A110a)
[[iBoot-204.2.9]] 1.1.2 (Build 3B48b)
[[iBoot-204.3.14]] 1.1.3 (Build 4A93)
1.1.4 (Build 4A102)
[[iBoot-204.3.16]] 1.1.5 (Build 4B1)
? 1.2b (Build 5A147p)
? 2.0b2 (Build 5A225c)
? 2.0b3 (Build 5A240d)
? 2.0b4 (Build 5A258f)
? 2.0b5 (Build 5A274d)
? 2.0b6P (Build 5A292g)
? 2.0b6F (Build 5A308)
? 2.0b7 (Build 5A331)
? 2.0b8[[Golden Master|GM]] (Build 5A345)
[[iBoot-320.20]] 2.0 (Build 5A347)
2.0.1 (Build 5B108)
2.0.2 (Build 5C1)
? 2.1b (Build 5F90)
[[iBoot-385.22]] 2.1 (Build 5F137)
2.1.1 (Build 5F138)
? 2.2b (Build 5G29)
[[iBoot-385.49]] 2.2 (Build 5G77)
2.2 (Build 5G77a)
2.2.1 (Build 5H11)
2.2.1 (Build 5H11a)
? 3.0b (Build 7A238j)
[[iBoot-594.2~1]] 3.0b2 (Build 7A259g)
[[iBoot-596.6~3]] 3.0b3 (Build 7A280f)
[[iBoot-596.16~2]] 3.0b4 (Build 7A300g)
[[iBoot-596.20~1]] 3.0b5 (Build 7A312g)
[[iBoot-596.24~1]] 3.0 (Build 7A341)
3.0.1 (Build 7A400)
[[iBoot-636.26~2]] 3.1b (Build 7C97d)
iBoot-636.??~? 3.1b2 (Build 7C106c)
[[iBoot-636.47~1]] 3.1b3 (Build 7C116a)
[[iBoot-636.65~2]] 3.1 (Build 7C144)
[[iBoot-636.66~1]] 3.1.1 (Build 7C145)
3.1.1 (Build 7C146)
[[iBoot-636.66~5]] 3.1.2 (Build 7D11)
[[iBoot-636.66.33~4]] 3.1.3 (Build 7E18)
[[iBoot-817.28~18]] 3.2 (Build 7B367)
[[iBoot-817.29~2]] 3.2.1 (Build 7B405)
3.2.2 (Build 7B500)
[[iBoot-872~12]] 4.0b (Build 8A230m)
[[iBoot-889.3~2]] 4.0b2 (Build 8A248c)
[[iBoot-889.12~2]] 4.0b3 (Build 8A260b)
[[iBoot-889.19~1]] 4.0b4 (Build 8A274b)
[[iBoot-889.24~4]] 4.0[[Golden Master|GM]] (Build 8A293)
4.0 (Build 8A293)
4.0.1 (Build 8A306)
4.0.2 (Build 8A400)
[[iBoot-931.18.1~1]] 4.1b (Build 8B5080c)
[[iBoot-931.18.15~2]] 4.1b2 (Build 8B5091b)
[[iBoot-931.18.27~1]] 4.1 (Build 8B117)
4.1 (Build 8B118)
[[iBoot-931.67~2]] 4.2b (Build 8C5091e)
[[iBoot-931.71.80~1]] 4.2b2 (Build 8C5101c)
[[iBoot-931.71.13~3]] 4.2b3 (Build 8C5115c)
[[iBoot-931.71.16~9]] 4.2[[Golden Master|GM]] (Build 8C134)
4.2[[Golden Master|GM]] (Build 8C134b)
4.2.1[[Golden Master|GM]] (Build 8C148)
4.2.1 (Build 8C148)
4.2.1 (Build 8C148a)
[[iBoot-931.72.14~6]] 4.2.5 (Build 8E128)
4.2.6 (Build 8E200)
4.2.7 (Build 8E303)
4.2.8 (Build 8E401)
[[iBoot-931.72.14~10]] 4.2.9 (Build 8E501)
4.2.10 (Build 8E600)
[[iBoot-1072.33~1]] 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.3b3 (Build 8F5166b)
[[iBoot-1072.58~4]] 4.3[[Golden Master|GM]] (Build 8F190)
4.3 (Build 8F190)
[[iBoot-1072.59~2]] 4.3 (Build 8F191)
4.3.1 (Build 8G4)
[[iBoot-1072.61~2]] 4.3.2 (Build 8H7)
4.3.2 (Build 8H8)
4.3.3 (Build 8J2)
4.3.3 (Build 8J3)
[[iBoot-1072.61~6]] 4.3.4 (Build 8K2)
4.3.5 (Build 8L1)
[[iBoot-1219.35.80~1]] 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 5.0b3 (Build 9A5259f)
[[iBoot-1219.42.8~1]] 5.0b4 (Build 9A5274d)
[[iBoot-1219.43.9~3]] 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~15]] 5.0[[Golden Master|GM]] (Build 9A332) [Unreleased]
5.0[[Golden Master|GM]] (Build 9A334)
5.0 (Build 9A334)
[[iBoot-1219.43.32~27]] 5.0.1b1 (Build 9A402)
[[iBoot-1219.43.32~29]] 5.0.1b2 (Build 9A404)
5.0.1 (Build 9A405)
5.0.1 (Build 9A406)
[[iBoot-1219.61.19~6]] 5.1b (Build 9B5117b)
[[iBoot-1219.62.1~2]] 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15]] 5.1 (Build 9B176)
[[iBoot-1219.62.15~2]] 5.1 (Build 9B179b)
5.1.1 (Build 9B206)
[[iBoot-1537.1.60~15]] 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.18~2]] 6.0[[Golden Master|GM]] (Build 10A403)
6.0 (Build 10A403)
[[iBoot-1537.4.19~1]] 6.0 (Build 10A405)
6.0 (Build 10A406)
[[iBoot-1537.4.20~1]] 6.0 (Build 10A407)
[[iBoot-1537.4.21~3]] 6.0.1 (Build 10A523)
6.0.1 (Build 10A525)
[[iBoot-1537.4.21~2]] 6.0.1 (Build 10A8426)
6.0.2 (Build 10A8500)
[[iBoot-1537.4.21~3]] 6.0.2 (Build 10A550)
6.0.2 (Build 10A551)
[[iBoot-1537.9.40~3]] 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 6.1b2 (Build 10B5105c)
6.1b3 (Build 10B5117b)
6.1b4 (Build 10B5126b)
[[iBoot-1537.9.55~4]] 6.1b5 (Build 10B141)
6.1b5 (Build 10B142)
6.1b5 (Build 10B143)
6.1b5 (Build 10B144)
6.1 (Build 10B141)
6.1 (Build 10B142)
6.1 (Build 10B143)
6.1 (Build 10B144)
6.1.1b (Build 10B311)
6.1.1 (Build 10B145)
6.1.2 (Build 10B146)
6.1.2 (Build 10B147)
[[iBoot-1537.9.55~11]] 6.1.3b2 (Build 10B318)
6.1.3b2 (Build 10B318a)
6.1.3 (Build 10B329)
6.1.4 (Build 10B350)
6.1.5 (Build 10B400)
[[iBoot-1940.1.8~44]] 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.46.1.1~1]] 7.0b3 (Build 11A4414e)
[[iBoot-1940.1.66~9]] 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 7.0b5 (Build 11A4449a)
7.0b6 (Build 11A4449d)
[[iBoot-1940.1.75~20]] 7.0[[Golden Master|GM]] (Build 11A465)
7.0 (Build 11A465)
[[iBoot-1940.1.75~93]] 7.0.1 (Build 11A470a)
7.0.2 (Build 11A501)
[[iBoot-1940.3.5~1]] 7.0.3 (Build 11B511)
7.0.4 (Build 11B554a)
7.0.5 (Build 11B601)
[[iBoot-1940.10.51~3]] 7.1b (Build 11D5099e)
[[iBoot-1940.10.57~8]] 7.1b2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 7.1b3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 7.1b4 (Build 11D5134c)

=== [[Apple TV]] ===
[[iBoot-931.44.21~1]] 4.0 4.1 (Build 8M89)
[[iBoot-931.71.16~9]] 4.1 4.2 (Build 8C150)
4.1.1 4.2.1 (Build 8C154)
[[iBoot-1072.33~1]] 4.2b 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.2b2 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.2b3 4.3b3 (Build 8F5166b)
[[iBoot-1072.59~2]] 4.2 4.3 (Build 8F191m)
4.2.1 4.3 (Build 8F202)
4.2.2 4.3 (Build 8F305)
4.3 4.3 (Build 8F455)
[[iBoot-1219.35.80~1]] 4.4b 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 4.4b2 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 4.4b3 5.0b3 (Build 9A5259f)
[[iBoot-1219.43.9~3]] 4.4b5 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 4.4b6 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 4.4b7 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~21]] 4.4 5.0 (Build 9A334v)
[[iBoot-1219.43.32~22]] 4.4.1 5.0 (Build 9A335a)
4.4.2 5.0 (Build 9A336a)
[[iBoot-1219.43.32~29]] 4.4.3 5.0.1 (Build 9A405l)
4.4.4 5.0.1 (Build 9A406a)
[[iBoot-1219.62.1~2]] 5.0b2 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.0b3 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15~2]] 5.0 5.1 (Build 9B179b)
[[iBoot-1537.1.60~15]] 5.1b 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 5.1b2 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 5.1b3 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 5.1b4 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.19~1]] 5.1 6.0 (Build 10A406e)
[[iBoot-1537.4.21~3]] 5.1.1 6.0.1 (Build 10A831)
[[iBoot-1537.9.40~3]] 5.2b 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 5.2b2 6.1b2 (Build 10B5105c)
5.2b3 6.1b3 (Build 10B5117d)
5.2b4 6.1b4 (Build 10B5126d)
[[iBoot-1537.9.55~4]] 5.2 6.1 (Build 10B144b)
[[iBoot-1537.9.55~11]] 5.2.1 6.1.3 (Build 10B329a)
[[iBoot-1537.9.55~11]] 5.3 6.1.4 (Build 10B809)
[[iBoot-1940.1.8~44]] 5.4b 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 5.4b2 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.66~9]] 6.0b3 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 6.0b4 7.0b5 (Build 11A4449a)
[[iBoot-1940.1.75~93]] 6.0 7.0.1 (Build 11A470e)
6.0 7.0.2 (Build 11A502)
[[iBoot-1940.3.5~1]] 6.0.1 7.0.3 (Build 11B511d)
6.0.2 7.0.4 (Build 11B554a)
[[1940.10.51~3]] 6.1b 7.1b (Build 11D5099e)
[[iBoot-1940.10.57~8]] 6.1b2 7.1b2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 6.1b3 7.1b3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 6.1b4 7.1b4 (Build 11D5134c)

=== [[Haywire]] ===
[[iBoot-1537.9.55~3]] 1.0.0 (Build 10B7129)

== [[Exploits]] ==
On February 1st, 2014, iH8sn0w found a very powerful iBoot exploit that allows any iDevice with an [[S5L8940|A5]] or [[S5L8945|A5X]] chip to be jailbroken, regardless of the iOS version. He used it mainly to grab AES [[Firmware Keys|decryption keys]]. However, according to [https://twitter.com/winocm/status/429704672211763200 this tweet from winocm], the exploit will never go public. Once he cleans it up a bit, the [[Firmware Keys|decryption keys]] will be available [http://www.icj.me/ios/keys here].
He mentioned [https://twitter.com/iH8sn0w/status/429838704077979648 here] that it will work on [[A6]] and [[A7]] chips soon, but it will require some minor modifications.

== Commands used as an exploit vector ==
* '''diags''': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* '''arm7_go''': For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

== OpeniBoot ==
There is an open source version of iBoot designed so that custom kernels can be run on the iPhone/iPod/iPad. You can check out the source [http://github.com/iDroid-Project/OpeniBoot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.
OpeniBoot currently supports all S5l8900, S5l8720, S5l8920 and S5l8930 devices. More info can be found about OpeniBoot and Linux on these devices on the iDroid-Project [http://idroidproject.org website].

== Remappings ==
// n88 (3GS)
0x4FF00000 => 0x0
0x40000000 => 0xC0000000

== See also ==
* [[iBoot (Enums)]]
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

[[Category:iBoot]]

IBoot (Bootloader)

2014-02-02T17:31:20Z

R3pwn: /* Exploits */

{{lowercase}}
'''iBoot''' is Apple's stage 2 bootloader for all of the [[iDevice|devices]]. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== [[Bootrom]] ==
The bootrom also goes by the name "iBoot." The list of bootroms can be found on [[Bootrom|their own page]].

== Extract and Disassemble ==
To extract the bootloader and disassemble using IDA, follow the following steps:
#obtain the bootloader from the iPSW. This file is in the <code>Firmware/all_flash</code> subdir, e.g. <code>Firmware/all_flash/all_flash.n81ap.production/iBoot.n81ap.RELEASE.img3</code>, where the "n81ap", "k90", etc.. are for the i-Device type
#run xpwntool with the proper key (from elsewhere in this Wiki)
#Make sure the decryption was successful - if it is, you should see:
"iBoot for ...., Copyright 2011, Apple Inc."
if you cat (i.e. type) the file.
<ol><li value="4">remove the img3 header - the good stuff starts at offset 0x40 (i.e. 64) - using dd (skip=1 bs=64) or some other tool</li>
<li>Load in IDA. Set processor to ARM. Rebase program (Edit→Segments→Rebase Program) to 0x5FF00000 (for iBoot in iOS 5). You should see something like:</li></ol>

<pre>
ROM:5FF00000 loc_5FF00000 ; CODE XREF: ROM:5FF00078�j
ROM:5FF00000 B loc_5FF00040 ; Used for Reset - This is where we start
ROM:5FF00004 ; ---------------------------------------------------------------------------
ROM:5FF00004 LDR PC, =sub_5FF16FB4 ; Used for Undef
ROM:5FF00008 ; ---------------------------------------------------------------------------
ROM:5FF00008 LDR PC, =sub_5FF16FEC ; Used for SWI
ROM:5FF0000C ; ---------------------------------------------------------------------------
ROM:5FF0000C LDR PC, =sub_5FF17024 ; Used for Prefabt
ROM:5FF00010 ; ---------------------------------------------------------------------------
ROM:5FF00010 LDR PC, =sub_5FF17060 ; Used for DataAbt
ROM:5FF00014 ; ---------------------------------------------------------------------------
ROM:5FF00014 LDR PC, =loc_5FF17098 ; Used for AddrExc
ROM:5FF00018 ; ---------------------------------------------------------------------------
ROM:5FF00018 LDR PC, =loc_5FF16F24 ; Used for IRQ
ROM:5FF0001C ; ---------------------------------------------------------------------------
ROM:5FF0001C LDR PC, =sub_5FF16F6C ; Probably FIQ, need to verify this
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00020 SVCPL 0xF00040
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00024 off_5FF00024 DCD sub_5FF16FB4 ; DATA XREF: ROM:5FF00004�r
ROM:5FF00028 off_5FF00028 DCD sub_5FF16FEC ; DATA XREF: ROM:5FF00008�r
ROM:5FF0002C off_5FF0002C DCD sub_5FF17024 ; DATA XREF: ROM:5FF0000C�r
ROM:5FF00030 off_5FF00030 DCD sub_5FF17060 ; DATA XREF: ROM:5FF00010�r
ROM:5FF00034 off_5FF00034 DCD loc_5FF17098 ; DATA XREF: ROM:5FF00014�r
ROM:5FF00038 off_5FF00038 DCD loc_5FF16F24 ; DATA XREF: ROM:5FF00018�r
ROM:5FF0003C off_5FF0003C DCD sub_5FF16F6C ; DATA XREF: ROM:5FF0001C�r
ROM:5FF00040 ; ---------------------------------------------------------------------------
ROM:5FF00040
ROM:5FF00040 loc_5FF00040 ; CODE XREF: ROM:loc_5FF00000�j
ROM:5FF00040 ADR R0, loc_5FF00000 <-- The address we rebased to
ROM:5FF00044 LDR R1, =loc_5FF00000
ROM:5FF00048 CMP R0, R1
ROM:5FF0004C CMP R0, R1
ROM:5FF00050 BEQ loc_5FF0007C
...
...
ROM:5FF000E8 loc_5FF000E8 ; CODE XREF: ROM:5FF000F0�j
ROM:5FF000E8 CMP R0, R1
ROM:5FF000EC STRLT R2, [R0],#4
ROM:5FF000F0 BLT loc_5FF000E8
ROM:5FF000F4 LDR R0, =(_ibootStart+1)
ROM:5FF000F8 MOV LR, PC
ROM:5FF000FC BX R0 ; _ibootStart
ROM:5FF00100
ROM:5FF00100 loc_5FF00100 ; CODE XREF: ROM:loc_5FF00100�j
ROM:5FF00100 B loc_5FF00100
</pre>

Where iBootStart (not the official Apple Symbol, of course) can be seen at:

<pre>
ROM:5FF00BA4 _ibootStart ; CODE XREF: ROM:5FF000FC�p
ROM:5FF00BA4 ; DATA XREF: ROM:5FF000F4�o ...
ROM:5FF00BA4 PUSH {R7,LR}
ROM:5FF00BA6 MOV R7, SP
ROM:5FF00BA8 LDR R0, =aIbootStart ; "\niBoot start\n"
ROM:5FF00BAA BL loc_5FF233C4
ROM:5FF00BAE MOVS R0, #0
ROM:5FF00BB0 BL loc_5FF16E54
ROM:5FF00BB4 BL loc_5FF1570C
ROM:5FF00BB8 BL loc_5FF143A8
ROM:5FF00BBC BL unk_5FF15264
ROM:5FF00BC0 LDR R0, =aMain ; "main"
..
</pre>

== Flow of iBoot (1219 - 5.0.x) ==
iBoot is quite a complicated binary, which spawns several ARM tasks to enable the boot process:

- iBootStart (disassembly started above) - starts main (5FF00BCA) - which calls the main function at 5FF00C14
- main: Does the good stuff (loading the kernel, etc)
starts the poweroff task (5FF00EF2) - calls (sub_5FF00FD0+1)
In recovery mode (failed boot):
starts command (5FF00F0A) - calls 5FF15928
starts idleoff (5FF99F2E) - calls 5FF01060

== Revisions ==
[[iBoot-99]] 1.0b (Build 1A420) [Unreleased]
[[iBoot-159]] 1.0 (Build 1A543a)
1.0.1 (Build 1C25)
1.0.2 (Build 1C28)
[[iBoot-204]] 1.1 (Build 3A100)
1.1 (Build 3A101)
1.1.1 (Build 3A109a)
[[iBoot-204.0.2]] 1.1.1 (Build 3A110a)
[[iBoot-204.2.9]] 1.1.2 (Build 3B48b)
[[iBoot-204.3.14]] 1.1.3 (Build 4A93)
1.1.4 (Build 4A102)
[[iBoot-204.3.16]] 1.1.5 (Build 4B1)
? 1.2b (Build 5A147p)
? 2.0b2 (Build 5A225c)
? 2.0b3 (Build 5A240d)
? 2.0b4 (Build 5A258f)
? 2.0b5 (Build 5A274d)
? 2.0b6P (Build 5A292g)
? 2.0b6F (Build 5A308)
? 2.0b7 (Build 5A331)
? 2.0b8[[Golden Master|GM]] (Build 5A345)
[[iBoot-320.20]] 2.0 (Build 5A347)
2.0.1 (Build 5B108)
2.0.2 (Build 5C1)
? 2.1b (Build 5F90)
[[iBoot-385.22]] 2.1 (Build 5F137)
2.1.1 (Build 5F138)
? 2.2b (Build 5G29)
[[iBoot-385.49]] 2.2 (Build 5G77)
2.2 (Build 5G77a)
2.2.1 (Build 5H11)
2.2.1 (Build 5H11a)
? 3.0b (Build 7A238j)
[[iBoot-594.2~1]] 3.0b2 (Build 7A259g)
[[iBoot-596.6~3]] 3.0b3 (Build 7A280f)
[[iBoot-596.16~2]] 3.0b4 (Build 7A300g)
[[iBoot-596.20~1]] 3.0b5 (Build 7A312g)
[[iBoot-596.24~1]] 3.0 (Build 7A341)
3.0.1 (Build 7A400)
[[iBoot-636.26~2]] 3.1b (Build 7C97d)
iBoot-636.??~? 3.1b2 (Build 7C106c)
[[iBoot-636.47~1]] 3.1b3 (Build 7C116a)
[[iBoot-636.65~2]] 3.1 (Build 7C144)
[[iBoot-636.66~1]] 3.1.1 (Build 7C145)
3.1.1 (Build 7C146)
[[iBoot-636.66~5]] 3.1.2 (Build 7D11)
[[iBoot-636.66.33~4]] 3.1.3 (Build 7E18)
[[iBoot-817.28~18]] 3.2 (Build 7B367)
[[iBoot-817.29~2]] 3.2.1 (Build 7B405)
3.2.2 (Build 7B500)
[[iBoot-872~12]] 4.0b (Build 8A230m)
[[iBoot-889.3~2]] 4.0b2 (Build 8A248c)
[[iBoot-889.12~2]] 4.0b3 (Build 8A260b)
[[iBoot-889.19~1]] 4.0b4 (Build 8A274b)
[[iBoot-889.24~4]] 4.0[[Golden Master|GM]] (Build 8A293)
4.0 (Build 8A293)
4.0.1 (Build 8A306)
4.0.2 (Build 8A400)
[[iBoot-931.18.1~1]] 4.1b (Build 8B5080c)
[[iBoot-931.18.15~2]] 4.1b2 (Build 8B5091b)
[[iBoot-931.18.27~1]] 4.1 (Build 8B117)
4.1 (Build 8B118)
[[iBoot-931.67~2]] 4.2b (Build 8C5091e)
[[iBoot-931.71.80~1]] 4.2b2 (Build 8C5101c)
[[iBoot-931.71.13~3]] 4.2b3 (Build 8C5115c)
[[iBoot-931.71.16~9]] 4.2[[Golden Master|GM]] (Build 8C134)
4.2[[Golden Master|GM]] (Build 8C134b)
4.2.1[[Golden Master|GM]] (Build 8C148)
4.2.1 (Build 8C148)
4.2.1 (Build 8C148a)
[[iBoot-931.72.14~6]] 4.2.5 (Build 8E128)
4.2.6 (Build 8E200)
4.2.7 (Build 8E303)
4.2.8 (Build 8E401)
[[iBoot-931.72.14~10]] 4.2.9 (Build 8E501)
4.2.10 (Build 8E600)
[[iBoot-1072.33~1]] 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.3b3 (Build 8F5166b)
[[iBoot-1072.58~4]] 4.3[[Golden Master|GM]] (Build 8F190)
4.3 (Build 8F190)
[[iBoot-1072.59~2]] 4.3 (Build 8F191)
4.3.1 (Build 8G4)
[[iBoot-1072.61~2]] 4.3.2 (Build 8H7)
4.3.2 (Build 8H8)
4.3.3 (Build 8J2)
4.3.3 (Build 8J3)
[[iBoot-1072.61~6]] 4.3.4 (Build 8K2)
4.3.5 (Build 8L1)
[[iBoot-1219.35.80~1]] 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 5.0b3 (Build 9A5259f)
[[iBoot-1219.42.8~1]] 5.0b4 (Build 9A5274d)
[[iBoot-1219.43.9~3]] 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~15]] 5.0[[Golden Master|GM]] (Build 9A332) [Unreleased]
5.0[[Golden Master|GM]] (Build 9A334)
5.0 (Build 9A334)
[[iBoot-1219.43.32~27]] 5.0.1b1 (Build 9A402)
[[iBoot-1219.43.32~29]] 5.0.1b2 (Build 9A404)
5.0.1 (Build 9A405)
5.0.1 (Build 9A406)
[[iBoot-1219.61.19~6]] 5.1b (Build 9B5117b)
[[iBoot-1219.62.1~2]] 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15]] 5.1 (Build 9B176)
[[iBoot-1219.62.15~2]] 5.1 (Build 9B179b)
5.1.1 (Build 9B206)
[[iBoot-1537.1.60~15]] 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.18~2]] 6.0[[Golden Master|GM]] (Build 10A403)
6.0 (Build 10A403)
[[iBoot-1537.4.19~1]] 6.0 (Build 10A405)
6.0 (Build 10A406)
[[iBoot-1537.4.20~1]] 6.0 (Build 10A407)
[[iBoot-1537.4.21~3]] 6.0.1 (Build 10A523)
6.0.1 (Build 10A525)
[[iBoot-1537.4.21~2]] 6.0.1 (Build 10A8426)
6.0.2 (Build 10A8500)
[[iBoot-1537.4.21~3]] 6.0.2 (Build 10A550)
6.0.2 (Build 10A551)
[[iBoot-1537.9.40~3]] 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 6.1b2 (Build 10B5105c)
6.1b3 (Build 10B5117b)
6.1b4 (Build 10B5126b)
[[iBoot-1537.9.55~4]] 6.1b5 (Build 10B141)
6.1b5 (Build 10B142)
6.1b5 (Build 10B143)
6.1b5 (Build 10B144)
6.1 (Build 10B141)
6.1 (Build 10B142)
6.1 (Build 10B143)
6.1 (Build 10B144)
6.1.1b (Build 10B311)
6.1.1 (Build 10B145)
6.1.2 (Build 10B146)
6.1.2 (Build 10B147)
[[iBoot-1537.9.55~11]] 6.1.3b2 (Build 10B318)
6.1.3b2 (Build 10B318a)
6.1.3 (Build 10B329)
6.1.4 (Build 10B350)
6.1.5 (Build 10B400)
[[iBoot-1940.1.8~44]] 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.46.1.1~1]] 7.0b3 (Build 11A4414e)
[[iBoot-1940.1.66~9]] 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 7.0b5 (Build 11A4449a)
7.0b6 (Build 11A4449d)
[[iBoot-1940.1.75~20]] 7.0[[Golden Master|GM]] (Build 11A465)
7.0 (Build 11A465)
[[iBoot-1940.1.75~93]] 7.0.1 (Build 11A470a)
7.0.2 (Build 11A501)
[[iBoot-1940.3.5~1]] 7.0.3 (Build 11B511)
7.0.4 (Build 11B554a)
7.0.5 (Build 11B601)
[[iBoot-1940.10.51~3]] 7.1b (Build 11D5099e)
[[iBoot-1940.10.57~8]] 7.1b2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 7.1b3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 7.1b4 (Build 11D5134c)

=== [[Apple TV]] ===
[[iBoot-931.44.21~1]] 4.0 4.1 (Build 8M89)
[[iBoot-931.71.16~9]] 4.1 4.2 (Build 8C150)
4.1.1 4.2.1 (Build 8C154)
[[iBoot-1072.33~1]] 4.2b 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.2b2 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.2b3 4.3b3 (Build 8F5166b)
[[iBoot-1072.59~2]] 4.2 4.3 (Build 8F191m)
4.2.1 4.3 (Build 8F202)
4.2.2 4.3 (Build 8F305)
4.3 4.3 (Build 8F455)
[[iBoot-1219.35.80~1]] 4.4b 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 4.4b2 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 4.4b3 5.0b3 (Build 9A5259f)
[[iBoot-1219.43.9~3]] 4.4b5 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 4.4b6 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 4.4b7 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~21]] 4.4 5.0 (Build 9A334v)
[[iBoot-1219.43.32~22]] 4.4.1 5.0 (Build 9A335a)
4.4.2 5.0 (Build 9A336a)
[[iBoot-1219.43.32~29]] 4.4.3 5.0.1 (Build 9A405l)
4.4.4 5.0.1 (Build 9A406a)
[[iBoot-1219.62.1~2]] 5.0b2 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.0b3 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15~2]] 5.0 5.1 (Build 9B179b)
[[iBoot-1537.1.60~15]] 5.1b 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 5.1b2 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 5.1b3 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 5.1b4 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.19~1]] 5.1 6.0 (Build 10A406e)
[[iBoot-1537.4.21~3]] 5.1.1 6.0.1 (Build 10A831)
[[iBoot-1537.9.40~3]] 5.2b 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 5.2b2 6.1b2 (Build 10B5105c)
5.2b3 6.1b3 (Build 10B5117d)
5.2b4 6.1b4 (Build 10B5126d)
[[iBoot-1537.9.55~4]] 5.2 6.1 (Build 10B144b)
[[iBoot-1537.9.55~11]] 5.2.1 6.1.3 (Build 10B329a)
[[iBoot-1537.9.55~11]] 5.3 6.1.4 (Build 10B809)
[[iBoot-1940.1.8~44]] 5.4b 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 5.4b2 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.66~9]] 6.0b3 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 6.0b4 7.0b5 (Build 11A4449a)
[[iBoot-1940.1.75~93]] 6.0 7.0.1 (Build 11A470e)
6.0 7.0.2 (Build 11A502)
[[iBoot-1940.3.5~1]] 6.0.1 7.0.3 (Build 11B511d)
6.0.2 7.0.4 (Build 11B554a)
[[1940.10.51~3]] 6.1b 7.1b (Build 11D5099e)
[[iBoot-1940.10.57~8]] 6.1b2 7.1b2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 6.1b3 7.1b3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 6.1b4 7.1b4 (Build 11D5134c)

=== [[Haywire]] ===
[[iBoot-1537.9.55~3]] 1.0.0 (Build 10B7129)

== [[Exploits]] ==
On 1st February, 2014, iH8sn0w found a very powerful iBoot exploit that allows any iDevice with an [[S5L8940|A5]] or [[S5L8945|A5X]] chip to be jailbroken, regardless of the iOS version. He used it mainly to grab AES [[Firmware Keys|decryption keys]]. However, according to [https://twitter.com/winocm/status/429704672211763200 this tweet from winocm], the exploit will never go public. One he cleans it up a bit, the [[Firmware Keys|decryption keys]] will be available [http://www.icj.me/ios/keys here].
He mentioned [https://twitter.com/iH8sn0w/status/429838704077979648 here] that it will work on [[A6]] and [[A7]] chips soon, but it will require some minor modifications.

== Commands used as an exploit vector ==
* '''diags''': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* '''arm7_go''': For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

== OpeniBoot ==
There is an open source version of iBoot designed so that custom kernels can be run on the iPhone/iPod/iPad. You can check out the source [http://github.com/iDroid-Project/OpeniBoot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.
OpeniBoot currently supports all S5l8900, S5l8720, S5l8920 and S5l8930 devices. More info can be found about OpeniBoot and Linux on these devices on the iDroid-Project [http://idroidproject.org website].

== Remappings ==
// n88 (3GS)
0x4FF00000 => 0x0
0x40000000 => 0xC0000000

== See also ==
* [[iBoot (Enums)]]
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

[[Category:iBoot]]

IBoot (Bootloader)

2014-02-02T17:29:33Z

R3pwn: /* Exploits */

{{lowercase}}
'''iBoot''' is Apple's stage 2 bootloader for all of the [[iDevice|devices]]. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== [[Bootrom]] ==
The bootrom also goes by the name "iBoot." The list of bootroms can be found on [[Bootrom|their own page]].

== Extract and Disassemble ==
To extract the bootloader and disassemble using IDA, follow the following steps:
#obtain the bootloader from the iPSW. This file is in the <code>Firmware/all_flash</code> subdir, e.g. <code>Firmware/all_flash/all_flash.n81ap.production/iBoot.n81ap.RELEASE.img3</code>, where the "n81ap", "k90", etc.. are for the i-Device type
#run xpwntool with the proper key (from elsewhere in this Wiki)
#Make sure the decryption was successful - if it is, you should see:
"iBoot for ...., Copyright 2011, Apple Inc."
if you cat (i.e. type) the file.
<ol><li value="4">remove the img3 header - the good stuff starts at offset 0x40 (i.e. 64) - using dd (skip=1 bs=64) or some other tool</li>
<li>Load in IDA. Set processor to ARM. Rebase program (Edit→Segments→Rebase Program) to 0x5FF00000 (for iBoot in iOS 5). You should see something like:</li></ol>

<pre>
ROM:5FF00000 loc_5FF00000 ; CODE XREF: ROM:5FF00078�j
ROM:5FF00000 B loc_5FF00040 ; Used for Reset - This is where we start
ROM:5FF00004 ; ---------------------------------------------------------------------------
ROM:5FF00004 LDR PC, =sub_5FF16FB4 ; Used for Undef
ROM:5FF00008 ; ---------------------------------------------------------------------------
ROM:5FF00008 LDR PC, =sub_5FF16FEC ; Used for SWI
ROM:5FF0000C ; ---------------------------------------------------------------------------
ROM:5FF0000C LDR PC, =sub_5FF17024 ; Used for Prefabt
ROM:5FF00010 ; ---------------------------------------------------------------------------
ROM:5FF00010 LDR PC, =sub_5FF17060 ; Used for DataAbt
ROM:5FF00014 ; ---------------------------------------------------------------------------
ROM:5FF00014 LDR PC, =loc_5FF17098 ; Used for AddrExc
ROM:5FF00018 ; ---------------------------------------------------------------------------
ROM:5FF00018 LDR PC, =loc_5FF16F24 ; Used for IRQ
ROM:5FF0001C ; ---------------------------------------------------------------------------
ROM:5FF0001C LDR PC, =sub_5FF16F6C ; Probably FIQ, need to verify this
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00020 SVCPL 0xF00040
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00024 off_5FF00024 DCD sub_5FF16FB4 ; DATA XREF: ROM:5FF00004�r
ROM:5FF00028 off_5FF00028 DCD sub_5FF16FEC ; DATA XREF: ROM:5FF00008�r
ROM:5FF0002C off_5FF0002C DCD sub_5FF17024 ; DATA XREF: ROM:5FF0000C�r
ROM:5FF00030 off_5FF00030 DCD sub_5FF17060 ; DATA XREF: ROM:5FF00010�r
ROM:5FF00034 off_5FF00034 DCD loc_5FF17098 ; DATA XREF: ROM:5FF00014�r
ROM:5FF00038 off_5FF00038 DCD loc_5FF16F24 ; DATA XREF: ROM:5FF00018�r
ROM:5FF0003C off_5FF0003C DCD sub_5FF16F6C ; DATA XREF: ROM:5FF0001C�r
ROM:5FF00040 ; ---------------------------------------------------------------------------
ROM:5FF00040
ROM:5FF00040 loc_5FF00040 ; CODE XREF: ROM:loc_5FF00000�j
ROM:5FF00040 ADR R0, loc_5FF00000 <-- The address we rebased to
ROM:5FF00044 LDR R1, =loc_5FF00000
ROM:5FF00048 CMP R0, R1
ROM:5FF0004C CMP R0, R1
ROM:5FF00050 BEQ loc_5FF0007C
...
...
ROM:5FF000E8 loc_5FF000E8 ; CODE XREF: ROM:5FF000F0�j
ROM:5FF000E8 CMP R0, R1
ROM:5FF000EC STRLT R2, [R0],#4
ROM:5FF000F0 BLT loc_5FF000E8
ROM:5FF000F4 LDR R0, =(_ibootStart+1)
ROM:5FF000F8 MOV LR, PC
ROM:5FF000FC BX R0 ; _ibootStart
ROM:5FF00100
ROM:5FF00100 loc_5FF00100 ; CODE XREF: ROM:loc_5FF00100�j
ROM:5FF00100 B loc_5FF00100
</pre>

Where iBootStart (not the official Apple Symbol, of course) can be seen at:

<pre>
ROM:5FF00BA4 _ibootStart ; CODE XREF: ROM:5FF000FC�p
ROM:5FF00BA4 ; DATA XREF: ROM:5FF000F4�o ...
ROM:5FF00BA4 PUSH {R7,LR}
ROM:5FF00BA6 MOV R7, SP
ROM:5FF00BA8 LDR R0, =aIbootStart ; "\niBoot start\n"
ROM:5FF00BAA BL loc_5FF233C4
ROM:5FF00BAE MOVS R0, #0
ROM:5FF00BB0 BL loc_5FF16E54
ROM:5FF00BB4 BL loc_5FF1570C
ROM:5FF00BB8 BL loc_5FF143A8
ROM:5FF00BBC BL unk_5FF15264
ROM:5FF00BC0 LDR R0, =aMain ; "main"
..
</pre>

== Flow of iBoot (1219 - 5.0.x) ==
iBoot is quite a complicated binary, which spawns several ARM tasks to enable the boot process:

- iBootStart (disassembly started above) - starts main (5FF00BCA) - which calls the main function at 5FF00C14
- main: Does the good stuff (loading the kernel, etc)
starts the poweroff task (5FF00EF2) - calls (sub_5FF00FD0+1)
In recovery mode (failed boot):
starts command (5FF00F0A) - calls 5FF15928
starts idleoff (5FF99F2E) - calls 5FF01060

== Revisions ==
[[iBoot-99]] 1.0b (Build 1A420) [Unreleased]
[[iBoot-159]] 1.0 (Build 1A543a)
1.0.1 (Build 1C25)
1.0.2 (Build 1C28)
[[iBoot-204]] 1.1 (Build 3A100)
1.1 (Build 3A101)
1.1.1 (Build 3A109a)
[[iBoot-204.0.2]] 1.1.1 (Build 3A110a)
[[iBoot-204.2.9]] 1.1.2 (Build 3B48b)
[[iBoot-204.3.14]] 1.1.3 (Build 4A93)
1.1.4 (Build 4A102)
[[iBoot-204.3.16]] 1.1.5 (Build 4B1)
? 1.2b (Build 5A147p)
? 2.0b2 (Build 5A225c)
? 2.0b3 (Build 5A240d)
? 2.0b4 (Build 5A258f)
? 2.0b5 (Build 5A274d)
? 2.0b6P (Build 5A292g)
? 2.0b6F (Build 5A308)
? 2.0b7 (Build 5A331)
? 2.0b8[[Golden Master|GM]] (Build 5A345)
[[iBoot-320.20]] 2.0 (Build 5A347)
2.0.1 (Build 5B108)
2.0.2 (Build 5C1)
? 2.1b (Build 5F90)
[[iBoot-385.22]] 2.1 (Build 5F137)
2.1.1 (Build 5F138)
? 2.2b (Build 5G29)
[[iBoot-385.49]] 2.2 (Build 5G77)
2.2 (Build 5G77a)
2.2.1 (Build 5H11)
2.2.1 (Build 5H11a)
? 3.0b (Build 7A238j)
[[iBoot-594.2~1]] 3.0b2 (Build 7A259g)
[[iBoot-596.6~3]] 3.0b3 (Build 7A280f)
[[iBoot-596.16~2]] 3.0b4 (Build 7A300g)
[[iBoot-596.20~1]] 3.0b5 (Build 7A312g)
[[iBoot-596.24~1]] 3.0 (Build 7A341)
3.0.1 (Build 7A400)
[[iBoot-636.26~2]] 3.1b (Build 7C97d)
iBoot-636.??~? 3.1b2 (Build 7C106c)
[[iBoot-636.47~1]] 3.1b3 (Build 7C116a)
[[iBoot-636.65~2]] 3.1 (Build 7C144)
[[iBoot-636.66~1]] 3.1.1 (Build 7C145)
3.1.1 (Build 7C146)
[[iBoot-636.66~5]] 3.1.2 (Build 7D11)
[[iBoot-636.66.33~4]] 3.1.3 (Build 7E18)
[[iBoot-817.28~18]] 3.2 (Build 7B367)
[[iBoot-817.29~2]] 3.2.1 (Build 7B405)
3.2.2 (Build 7B500)
[[iBoot-872~12]] 4.0b (Build 8A230m)
[[iBoot-889.3~2]] 4.0b2 (Build 8A248c)
[[iBoot-889.12~2]] 4.0b3 (Build 8A260b)
[[iBoot-889.19~1]] 4.0b4 (Build 8A274b)
[[iBoot-889.24~4]] 4.0[[Golden Master|GM]] (Build 8A293)
4.0 (Build 8A293)
4.0.1 (Build 8A306)
4.0.2 (Build 8A400)
[[iBoot-931.18.1~1]] 4.1b (Build 8B5080c)
[[iBoot-931.18.15~2]] 4.1b2 (Build 8B5091b)
[[iBoot-931.18.27~1]] 4.1 (Build 8B117)
4.1 (Build 8B118)
[[iBoot-931.67~2]] 4.2b (Build 8C5091e)
[[iBoot-931.71.80~1]] 4.2b2 (Build 8C5101c)
[[iBoot-931.71.13~3]] 4.2b3 (Build 8C5115c)
[[iBoot-931.71.16~9]] 4.2[[Golden Master|GM]] (Build 8C134)
4.2[[Golden Master|GM]] (Build 8C134b)
4.2.1[[Golden Master|GM]] (Build 8C148)
4.2.1 (Build 8C148)
4.2.1 (Build 8C148a)
[[iBoot-931.72.14~6]] 4.2.5 (Build 8E128)
4.2.6 (Build 8E200)
4.2.7 (Build 8E303)
4.2.8 (Build 8E401)
[[iBoot-931.72.14~10]] 4.2.9 (Build 8E501)
4.2.10 (Build 8E600)
[[iBoot-1072.33~1]] 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.3b3 (Build 8F5166b)
[[iBoot-1072.58~4]] 4.3[[Golden Master|GM]] (Build 8F190)
4.3 (Build 8F190)
[[iBoot-1072.59~2]] 4.3 (Build 8F191)
4.3.1 (Build 8G4)
[[iBoot-1072.61~2]] 4.3.2 (Build 8H7)
4.3.2 (Build 8H8)
4.3.3 (Build 8J2)
4.3.3 (Build 8J3)
[[iBoot-1072.61~6]] 4.3.4 (Build 8K2)
4.3.5 (Build 8L1)
[[iBoot-1219.35.80~1]] 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 5.0b3 (Build 9A5259f)
[[iBoot-1219.42.8~1]] 5.0b4 (Build 9A5274d)
[[iBoot-1219.43.9~3]] 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~15]] 5.0[[Golden Master|GM]] (Build 9A332) [Unreleased]
5.0[[Golden Master|GM]] (Build 9A334)
5.0 (Build 9A334)
[[iBoot-1219.43.32~27]] 5.0.1b1 (Build 9A402)
[[iBoot-1219.43.32~29]] 5.0.1b2 (Build 9A404)
5.0.1 (Build 9A405)
5.0.1 (Build 9A406)
[[iBoot-1219.61.19~6]] 5.1b (Build 9B5117b)
[[iBoot-1219.62.1~2]] 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15]] 5.1 (Build 9B176)
[[iBoot-1219.62.15~2]] 5.1 (Build 9B179b)
5.1.1 (Build 9B206)
[[iBoot-1537.1.60~15]] 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.18~2]] 6.0[[Golden Master|GM]] (Build 10A403)
6.0 (Build 10A403)
[[iBoot-1537.4.19~1]] 6.0 (Build 10A405)
6.0 (Build 10A406)
[[iBoot-1537.4.20~1]] 6.0 (Build 10A407)
[[iBoot-1537.4.21~3]] 6.0.1 (Build 10A523)
6.0.1 (Build 10A525)
[[iBoot-1537.4.21~2]] 6.0.1 (Build 10A8426)
6.0.2 (Build 10A8500)
[[iBoot-1537.4.21~3]] 6.0.2 (Build 10A550)
6.0.2 (Build 10A551)
[[iBoot-1537.9.40~3]] 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 6.1b2 (Build 10B5105c)
6.1b3 (Build 10B5117b)
6.1b4 (Build 10B5126b)
[[iBoot-1537.9.55~4]] 6.1b5 (Build 10B141)
6.1b5 (Build 10B142)
6.1b5 (Build 10B143)
6.1b5 (Build 10B144)
6.1 (Build 10B141)
6.1 (Build 10B142)
6.1 (Build 10B143)
6.1 (Build 10B144)
6.1.1b (Build 10B311)
6.1.1 (Build 10B145)
6.1.2 (Build 10B146)
6.1.2 (Build 10B147)
[[iBoot-1537.9.55~11]] 6.1.3b2 (Build 10B318)
6.1.3b2 (Build 10B318a)
6.1.3 (Build 10B329)
6.1.4 (Build 10B350)
6.1.5 (Build 10B400)
[[iBoot-1940.1.8~44]] 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.46.1.1~1]] 7.0b3 (Build 11A4414e)
[[iBoot-1940.1.66~9]] 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 7.0b5 (Build 11A4449a)
7.0b6 (Build 11A4449d)
[[iBoot-1940.1.75~20]] 7.0[[Golden Master|GM]] (Build 11A465)
7.0 (Build 11A465)
[[iBoot-1940.1.75~93]] 7.0.1 (Build 11A470a)
7.0.2 (Build 11A501)
[[iBoot-1940.3.5~1]] 7.0.3 (Build 11B511)
7.0.4 (Build 11B554a)
7.0.5 (Build 11B601)
[[iBoot-1940.10.51~3]] 7.1b (Build 11D5099e)
[[iBoot-1940.10.57~8]] 7.1b2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 7.1b3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 7.1b4 (Build 11D5134c)

=== [[Apple TV]] ===
[[iBoot-931.44.21~1]] 4.0 4.1 (Build 8M89)
[[iBoot-931.71.16~9]] 4.1 4.2 (Build 8C150)
4.1.1 4.2.1 (Build 8C154)
[[iBoot-1072.33~1]] 4.2b 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.2b2 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.2b3 4.3b3 (Build 8F5166b)
[[iBoot-1072.59~2]] 4.2 4.3 (Build 8F191m)
4.2.1 4.3 (Build 8F202)
4.2.2 4.3 (Build 8F305)
4.3 4.3 (Build 8F455)
[[iBoot-1219.35.80~1]] 4.4b 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 4.4b2 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 4.4b3 5.0b3 (Build 9A5259f)
[[iBoot-1219.43.9~3]] 4.4b5 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 4.4b6 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 4.4b7 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~21]] 4.4 5.0 (Build 9A334v)
[[iBoot-1219.43.32~22]] 4.4.1 5.0 (Build 9A335a)
4.4.2 5.0 (Build 9A336a)
[[iBoot-1219.43.32~29]] 4.4.3 5.0.1 (Build 9A405l)
4.4.4 5.0.1 (Build 9A406a)
[[iBoot-1219.62.1~2]] 5.0b2 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.0b3 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15~2]] 5.0 5.1 (Build 9B179b)
[[iBoot-1537.1.60~15]] 5.1b 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 5.1b2 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 5.1b3 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 5.1b4 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.19~1]] 5.1 6.0 (Build 10A406e)
[[iBoot-1537.4.21~3]] 5.1.1 6.0.1 (Build 10A831)
[[iBoot-1537.9.40~3]] 5.2b 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 5.2b2 6.1b2 (Build 10B5105c)
5.2b3 6.1b3 (Build 10B5117d)
5.2b4 6.1b4 (Build 10B5126d)
[[iBoot-1537.9.55~4]] 5.2 6.1 (Build 10B144b)
[[iBoot-1537.9.55~11]] 5.2.1 6.1.3 (Build 10B329a)
[[iBoot-1537.9.55~11]] 5.3 6.1.4 (Build 10B809)
[[iBoot-1940.1.8~44]] 5.4b 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 5.4b2 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.66~9]] 6.0b3 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 6.0b4 7.0b5 (Build 11A4449a)
[[iBoot-1940.1.75~93]] 6.0 7.0.1 (Build 11A470e)
6.0 7.0.2 (Build 11A502)
[[iBoot-1940.3.5~1]] 6.0.1 7.0.3 (Build 11B511d)
6.0.2 7.0.4 (Build 11B554a)
[[1940.10.51~3]] 6.1b 7.1b (Build 11D5099e)
[[iBoot-1940.10.57~8]] 6.1b2 7.1b2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 6.1b3 7.1b3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 6.1b4 7.1b4 (Build 11D5134c)

=== [[Haywire]] ===
[[iBoot-1537.9.55~3]] 1.0.0 (Build 10B7129)

== [[Exploits]] ==
On 1st February, 2014, iH8sn0w found a very powerful iBoot exploit that allows any iDevice with an [[S5L8940|A5]] or [[S5L8945|A5X]] chip to be jailbroken, regardless of the iOS version. He used it mainly to grab AES [[Firmware Keys|decryption keys]]. However, according to [https://twitter.com/winocm/status/429704672211763200 this tweet from winocm], the exploit will never go public. One he cleans it up a bit, the [[Firmware Keys|decryption keys]] will be available [http://www.icj.me/ios/keys here].
He mentioned [https://twitter.com/iH8sn0w/status/429838704077979648 here] that it will work on A6 and A7 chips soon, but it will require some minor modifications.

== Commands used as an exploit vector ==
* '''diags''': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* '''arm7_go''': For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

== OpeniBoot ==
There is an open source version of iBoot designed so that custom kernels can be run on the iPhone/iPod/iPad. You can check out the source [http://github.com/iDroid-Project/OpeniBoot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.
OpeniBoot currently supports all S5l8900, S5l8720, S5l8920 and S5l8930 devices. More info can be found about OpeniBoot and Linux on these devices on the iDroid-Project [http://idroidproject.org website].

== Remappings ==
// n88 (3GS)
0x4FF00000 => 0x0
0x40000000 => 0xC0000000

== See also ==
* [[iBoot (Enums)]]
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

[[Category:iBoot]]

IBoot (Bootloader)

2014-02-02T03:59:25Z

R3pwn:

{{lowercase}}
'''iBoot''' is Apple's stage 2 bootloader for all of the [[iDevice|devices]]. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== [[Bootrom]] ==
The bootrom also goes by the name "iBoot." The list of bootroms can be found on [[Bootrom|their own page]].

== Extract and Disassemble ==
To extract the bootloader and disassemble using IDA, follow the following steps:
#obtain the bootloader from the iPSW. This file is in the <code>Firmware/all_flash</code> subdir, e.g. <code>Firmware/all_flash/all_flash.n81ap.production/iBoot.n81ap.RELEASE.img3</code>, where the "n81ap", "k90", etc.. are for the i-Device type
#run xpwntool with the proper key (from elsewhere in this Wiki)
#Make sure the decryption was successful - if it is, you should see:
"iBoot for ...., Copyright 2011, Apple Inc."
if you cat (i.e. type) the file.
<ol><li value="4">remove the img3 header - the good stuff starts at offset 0x40 (i.e. 64) - using dd (skip=1 bs=64) or some other tool</li>
<li>Load in IDA. Set processor to ARM. Rebase program (Edit→Segments→Rebase Program) to 0x5FF00000 (for iBoot in iOS 5). You should see something like:</li></ol>

<pre>
ROM:5FF00000 loc_5FF00000 ; CODE XREF: ROM:5FF00078�j
ROM:5FF00000 B loc_5FF00040 ; Used for Reset - This is where we start
ROM:5FF00004 ; ---------------------------------------------------------------------------
ROM:5FF00004 LDR PC, =sub_5FF16FB4 ; Used for Undef
ROM:5FF00008 ; ---------------------------------------------------------------------------
ROM:5FF00008 LDR PC, =sub_5FF16FEC ; Used for SWI
ROM:5FF0000C ; ---------------------------------------------------------------------------
ROM:5FF0000C LDR PC, =sub_5FF17024 ; Used for Prefabt
ROM:5FF00010 ; ---------------------------------------------------------------------------
ROM:5FF00010 LDR PC, =sub_5FF17060 ; Used for DataAbt
ROM:5FF00014 ; ---------------------------------------------------------------------------
ROM:5FF00014 LDR PC, =loc_5FF17098 ; Used for AddrExc
ROM:5FF00018 ; ---------------------------------------------------------------------------
ROM:5FF00018 LDR PC, =loc_5FF16F24 ; Used for IRQ
ROM:5FF0001C ; ---------------------------------------------------------------------------
ROM:5FF0001C LDR PC, =sub_5FF16F6C ; Probably FIQ, need to verify this
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00020 SVCPL 0xF00040
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00024 off_5FF00024 DCD sub_5FF16FB4 ; DATA XREF: ROM:5FF00004�r
ROM:5FF00028 off_5FF00028 DCD sub_5FF16FEC ; DATA XREF: ROM:5FF00008�r
ROM:5FF0002C off_5FF0002C DCD sub_5FF17024 ; DATA XREF: ROM:5FF0000C�r
ROM:5FF00030 off_5FF00030 DCD sub_5FF17060 ; DATA XREF: ROM:5FF00010�r
ROM:5FF00034 off_5FF00034 DCD loc_5FF17098 ; DATA XREF: ROM:5FF00014�r
ROM:5FF00038 off_5FF00038 DCD loc_5FF16F24 ; DATA XREF: ROM:5FF00018�r
ROM:5FF0003C off_5FF0003C DCD sub_5FF16F6C ; DATA XREF: ROM:5FF0001C�r
ROM:5FF00040 ; ---------------------------------------------------------------------------
ROM:5FF00040
ROM:5FF00040 loc_5FF00040 ; CODE XREF: ROM:loc_5FF00000�j
ROM:5FF00040 ADR R0, loc_5FF00000 <-- The address we rebased to
ROM:5FF00044 LDR R1, =loc_5FF00000
ROM:5FF00048 CMP R0, R1
ROM:5FF0004C CMP R0, R1
ROM:5FF00050 BEQ loc_5FF0007C
...
...
ROM:5FF000E8 loc_5FF000E8 ; CODE XREF: ROM:5FF000F0�j
ROM:5FF000E8 CMP R0, R1
ROM:5FF000EC STRLT R2, [R0],#4
ROM:5FF000F0 BLT loc_5FF000E8
ROM:5FF000F4 LDR R0, =(_ibootStart+1)
ROM:5FF000F8 MOV LR, PC
ROM:5FF000FC BX R0 ; _ibootStart
ROM:5FF00100
ROM:5FF00100 loc_5FF00100 ; CODE XREF: ROM:loc_5FF00100�j
ROM:5FF00100 B loc_5FF00100
</pre>

Where iBootStart (not the official Apple Symbol, of course) can be seen at:

<pre>
ROM:5FF00BA4 _ibootStart ; CODE XREF: ROM:5FF000FC�p
ROM:5FF00BA4 ; DATA XREF: ROM:5FF000F4�o ...
ROM:5FF00BA4 PUSH {R7,LR}
ROM:5FF00BA6 MOV R7, SP
ROM:5FF00BA8 LDR R0, =aIbootStart ; "\niBoot start\n"
ROM:5FF00BAA BL loc_5FF233C4
ROM:5FF00BAE MOVS R0, #0
ROM:5FF00BB0 BL loc_5FF16E54
ROM:5FF00BB4 BL loc_5FF1570C
ROM:5FF00BB8 BL loc_5FF143A8
ROM:5FF00BBC BL unk_5FF15264
ROM:5FF00BC0 LDR R0, =aMain ; "main"
..
</pre>

== Flow of iBoot (1219 - 5.0.x) ==
iBoot is quite a complicated binary, which spawns several ARM tasks to enable the boot process:

- iBootStart (disassembly started above) - starts main (5FF00BCA) - which calls the main function at 5FF00C14
- main: Does the good stuff (loading the kernel, etc)
starts the poweroff task (5FF00EF2) - calls (sub_5FF00FD0+1)
In recovery mode (failed boot):
starts command (5FF00F0A) - calls 5FF15928
starts idleoff (5FF99F2E) - calls 5FF01060

== Revisions ==
[[iBoot-99]] 1.0b (Build 1A420) [Unreleased]
[[iBoot-159]] 1.0 (Build 1A543a)
1.0.1 (Build 1C25)
1.0.2 (Build 1C28)
[[iBoot-204]] 1.1 (Build 3A100)
1.1 (Build 3A101)
1.1.1 (Build 3A109a)
[[iBoot-204.0.2]] 1.1.1 (Build 3A110a)
[[iBoot-204.2.9]] 1.1.2 (Build 3B48b)
[[iBoot-204.3.14]] 1.1.3 (Build 4A93)
1.1.4 (Build 4A102)
[[iBoot-204.3.16]] 1.1.5 (Build 4B1)
? 1.2b (Build 5A147p)
? 2.0b2 (Build 5A225c)
? 2.0b3 (Build 5A240d)
? 2.0b4 (Build 5A258f)
? 2.0b5 (Build 5A274d)
? 2.0b6P (Build 5A292g)
? 2.0b6F (Build 5A308)
? 2.0b7 (Build 5A331)
? 2.0b8[[Golden Master|GM]] (Build 5A345)
[[iBoot-320.20]] 2.0 (Build 5A347)
2.0.1 (Build 5B108)
2.0.2 (Build 5C1)
? 2.1b (Build 5F90)
[[iBoot-385.22]] 2.1 (Build 5F137)
2.1.1 (Build 5F138)
? 2.2b (Build 5G29)
[[iBoot-385.49]] 2.2 (Build 5G77)
2.2 (Build 5G77a)
2.2.1 (Build 5H11)
2.2.1 (Build 5H11a)
? 3.0b (Build 7A238j)
[[iBoot-594.2~1]] 3.0b2 (Build 7A259g)
[[iBoot-596.6~3]] 3.0b3 (Build 7A280f)
[[iBoot-596.16~2]] 3.0b4 (Build 7A300g)
[[iBoot-596.20~1]] 3.0b5 (Build 7A312g)
[[iBoot-596.24~1]] 3.0 (Build 7A341)
3.0.1 (Build 7A400)
[[iBoot-636.26~2]] 3.1b (Build 7C97d)
iBoot-636.??~? 3.1b2 (Build 7C106c)
[[iBoot-636.47~1]] 3.1b3 (Build 7C116a)
[[iBoot-636.65~2]] 3.1 (Build 7C144)
[[iBoot-636.66~1]] 3.1.1 (Build 7C145)
3.1.1 (Build 7C146)
[[iBoot-636.66~5]] 3.1.2 (Build 7D11)
[[iBoot-636.66.33~4]] 3.1.3 (Build 7E18)
[[iBoot-817.28~18]] 3.2 (Build 7B367)
[[iBoot-817.29~2]] 3.2.1 (Build 7B405)
3.2.2 (Build 7B500)
[[iBoot-872~12]] 4.0b (Build 8A230m)
[[iBoot-889.3~2]] 4.0b2 (Build 8A248c)
[[iBoot-889.12~2]] 4.0b3 (Build 8A260b)
[[iBoot-889.19~1]] 4.0b4 (Build 8A274b)
[[iBoot-889.24~4]] 4.0[[Golden Master|GM]] (Build 8A293)
4.0 (Build 8A293)
4.0.1 (Build 8A306)
4.0.2 (Build 8A400)
[[iBoot-931.18.1~1]] 4.1b (Build 8B5080c)
[[iBoot-931.18.15~2]] 4.1b2 (Build 8B5091b)
[[iBoot-931.18.27~1]] 4.1 (Build 8B117)
4.1 (Build 8B118)
[[iBoot-931.67~2]] 4.2b (Build 8C5091e)
[[iBoot-931.71.80~1]] 4.2b2 (Build 8C5101c)
[[iBoot-931.71.13~3]] 4.2b3 (Build 8C5115c)
[[iBoot-931.71.16~9]] 4.2[[Golden Master|GM]] (Build 8C134)
4.2[[Golden Master|GM]] (Build 8C134b)
4.2.1[[Golden Master|GM]] (Build 8C148)
4.2.1 (Build 8C148)
4.2.1 (Build 8C148a)
[[iBoot-931.72.14~6]] 4.2.5 (Build 8E128)
4.2.6 (Build 8E200)
4.2.7 (Build 8E303)
4.2.8 (Build 8E401)
[[iBoot-931.72.14~10]] 4.2.9 (Build 8E501)
4.2.10 (Build 8E600)
[[iBoot-1072.33~1]] 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.3b3 (Build 8F5166b)
[[iBoot-1072.58~4]] 4.3[[Golden Master|GM]] (Build 8F190)
4.3 (Build 8F190)
[[iBoot-1072.59~2]] 4.3 (Build 8F191)
4.3.1 (Build 8G4)
[[iBoot-1072.61~2]] 4.3.2 (Build 8H7)
4.3.2 (Build 8H8)
4.3.3 (Build 8J2)
4.3.3 (Build 8J3)
[[iBoot-1072.61~6]] 4.3.4 (Build 8K2)
4.3.5 (Build 8L1)
[[iBoot-1219.35.80~1]] 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 5.0b3 (Build 9A5259f)
[[iBoot-1219.42.8~1]] 5.0b4 (Build 9A5274d)
[[iBoot-1219.43.9~3]] 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~15]] 5.0[[Golden Master|GM]] (Build 9A332) [Unreleased]
5.0[[Golden Master|GM]] (Build 9A334)
5.0 (Build 9A334)
[[iBoot-1219.43.32~27]] 5.0.1b1 (Build 9A402)
[[iBoot-1219.43.32~29]] 5.0.1b2 (Build 9A404)
5.0.1 (Build 9A405)
5.0.1 (Build 9A406)
[[iBoot-1219.61.19~6]] 5.1b (Build 9B5117b)
[[iBoot-1219.62.1~2]] 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15]] 5.1 (Build 9B176)
[[iBoot-1219.62.15~2]] 5.1 (Build 9B179b)
5.1.1 (Build 9B206)
[[iBoot-1537.1.60~15]] 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.18~2]] 6.0[[Golden Master|GM]] (Build 10A403)
6.0 (Build 10A403)
[[iBoot-1537.4.19~1]] 6.0 (Build 10A405)
6.0 (Build 10A406)
[[iBoot-1537.4.20~1]] 6.0 (Build 10A407)
[[iBoot-1537.4.21~3]] 6.0.1 (Build 10A523)
6.0.1 (Build 10A525)
[[iBoot-1537.4.21~2]] 6.0.1 (Build 10A8426)
6.0.2 (Build 10A8500)
[[iBoot-1537.4.21~3]] 6.0.2 (Build 10A550)
6.0.2 (Build 10A551)
[[iBoot-1537.9.40~3]] 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 6.1b2 (Build 10B5105c)
6.1b3 (Build 10B5117b)
6.1b4 (Build 10B5126b)
[[iBoot-1537.9.55~4]] 6.1b5 (Build 10B141)
6.1b5 (Build 10B142)
6.1b5 (Build 10B143)
6.1b5 (Build 10B144)
6.1 (Build 10B141)
6.1 (Build 10B142)
6.1 (Build 10B143)
6.1 (Build 10B144)
6.1.1b (Build 10B311)
6.1.1 (Build 10B145)
6.1.2 (Build 10B146)
6.1.2 (Build 10B147)
[[iBoot-1537.9.55~11]] 6.1.3b2 (Build 10B318)
6.1.3b2 (Build 10B318a)
6.1.3 (Build 10B329)
6.1.4 (Build 10B350)
6.1.5 (Build 10B400)
[[iBoot-1940.1.8~44]] 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.46.1.1~1]] 7.0b3 (Build 11A4414e)
[[iBoot-1940.1.66~9]] 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 7.0b5 (Build 11A4449a)
7.0b6 (Build 11A4449d)
[[iBoot-1940.1.75~20]] 7.0[[Golden Master|GM]] (Build 11A465)
7.0 (Build 11A465)
[[iBoot-1940.1.75~93]] 7.0.1 (Build 11A470a)
7.0.2 (Build 11A501)
[[iBoot-1940.3.5~1]] 7.0.3 (Build 11B511)
7.0.4 (Build 11B554a)
7.0.5 (Build 11B601)
[[iBoot-1940.10.51~3]] 7.1b (Build 11D5099e)
[[iBoot-1940.10.57~8]] 7.1b2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 7.1b3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 7.1b4 (Build 11D5134c)

=== [[Apple TV]] ===
[[iBoot-931.44.21~1]] 4.0 4.1 (Build 8M89)
[[iBoot-931.71.16~9]] 4.1 4.2 (Build 8C150)
4.1.1 4.2.1 (Build 8C154)
[[iBoot-1072.33~1]] 4.2b 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.2b2 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.2b3 4.3b3 (Build 8F5166b)
[[iBoot-1072.59~2]] 4.2 4.3 (Build 8F191m)
4.2.1 4.3 (Build 8F202)
4.2.2 4.3 (Build 8F305)
4.3 4.3 (Build 8F455)
[[iBoot-1219.35.80~1]] 4.4b 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 4.4b2 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 4.4b3 5.0b3 (Build 9A5259f)
[[iBoot-1219.43.9~3]] 4.4b5 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 4.4b6 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 4.4b7 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~21]] 4.4 5.0 (Build 9A334v)
[[iBoot-1219.43.32~22]] 4.4.1 5.0 (Build 9A335a)
4.4.2 5.0 (Build 9A336a)
[[iBoot-1219.43.32~29]] 4.4.3 5.0.1 (Build 9A405l)
4.4.4 5.0.1 (Build 9A406a)
[[iBoot-1219.62.1~2]] 5.0b2 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.0b3 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15~2]] 5.0 5.1 (Build 9B179b)
[[iBoot-1537.1.60~15]] 5.1b 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 5.1b2 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 5.1b3 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 5.1b4 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.19~1]] 5.1 6.0 (Build 10A406e)
[[iBoot-1537.4.21~3]] 5.1.1 6.0.1 (Build 10A831)
[[iBoot-1537.9.40~3]] 5.2b 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 5.2b2 6.1b2 (Build 10B5105c)
5.2b3 6.1b3 (Build 10B5117d)
5.2b4 6.1b4 (Build 10B5126d)
[[iBoot-1537.9.55~4]] 5.2 6.1 (Build 10B144b)
[[iBoot-1537.9.55~11]] 5.2.1 6.1.3 (Build 10B329a)
[[iBoot-1537.9.55~11]] 5.3 6.1.4 (Build 10B809)
[[iBoot-1940.1.8~44]] 5.4b 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 5.4b2 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.66~9]] 6.0b3 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 6.0b4 7.0b5 (Build 11A4449a)
[[iBoot-1940.1.75~93]] 6.0 7.0.1 (Build 11A470e)
6.0 7.0.2 (Build 11A502)
[[iBoot-1940.3.5~1]] 6.0.1 7.0.3 (Build 11B511d)
6.0.2 7.0.4 (Build 11B554a)
[[1940.10.51~3]] 6.1b 7.1b (Build 11D5099e)
[[iBoot-1940.10.57~8]] 6.1b2 7.1b2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 6.1b3 7.1b3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 6.1b4 7.1b4 (Build 11D5134c)

=== [[Haywire]] ===
[[iBoot-1537.9.55~3]] 1.0.0 (Build 10B7129)

== [[Exploits]] ==
On February 1st, 2013, iH8sn0w found a very powerful iBoot exploit that allows any iDevice with an A5 or A5X chip to be jailbroken, regardless of iOS version. He used it mainly to grab AES decrypt keys.

== Commands used as an exploit vector ==
* '''diags''': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* '''arm7_go''': For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

== OpeniBoot ==
There is an open source version of iBoot designed so that custom kernels can be run on the iPhone/iPod/iPad. You can check out the source [http://github.com/iDroid-Project/OpeniBoot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.
OpeniBoot currently supports all S5l8900, S5l8720, S5l8920 and S5l8930 devices. More info can be found about OpeniBoot and Linux on these devices on the iDroid-Project [http://idroidproject.org website].

== Remappings ==
// n88 (3GS)
0x4FF00000 => 0x0
0x40000000 => 0xC0000000

== See also ==
* [[iBoot (Enums)]]
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

[[Category:iBoot]]

/private/var/stash

2013-10-22T11:13:45Z

R3pwn:

Cydia creates this folder (which is on the user partition) and it moves here [[/Applications]], [[/Library]] and [[/Library/Themes]] on its first run to free up space on the system partition, leaving symlinks from the original path. This allows you to install tweaks and 3rd-party applications without the risk of filling up your [[/|root partition]].

== Children ==
=== Files ===
(None)
=== Folders ===
* [[/Applications|Applications.XXXXXX]]
* [[/Library|Library.XXXXXX]]
* [[/Library/Themes|Themes.XXXXXX]]

== Parents ==
{{parent|private|var}}

[[Category:Filesystem]]

Talk:Su

2013-10-22T03:01:50Z

R3pwn:

== More 'su' info ==
When documenting commands, please note that most are standard UNIX commands. Also, most (if not all) have a "man" page. [http://linux.die.net/man/1/su 'su' man page] --[[User:Haifisch|Haifisch]] ([[User talk:Haifisch|talk]]) 01:09, 17 October 2013 (UTC)
:So, do we even need this? --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 01:27, 17 October 2013 (UTC)
::I don't think so. --[[User:Jaggions|Jaggions]] ([[User talk:Jaggions|talk]]) 13:56, 17 October 2013 (UTC)
:I added your link to the page and added some other useful info. I hope that this was the improvement you were looking for! :D --[[User:R3pwn|R3pwn]] ([[User talk:R3pwn|talk]]) 20:54, 21 October 2013 (EST)

Su

2013-10-22T02:58:12Z

R3pwn: /* Introduction */

== Introduction ==
Su is a command used for quickly switching between the [[root]] and [[mobile]] accounts on an iOS device. The [[root]] account gives you access to the entire filesystem and allows you to modify any file you wish. As this could be potentially dangerous, Apple has locked you out of the [[root]] account. To gain access to it, you must go through a process known as [[jailbreaking]]. You can find a list of all arguments and the proper syntax for 'su' at [http://linux.die.net/man/1/su this link], but if you don't want to do that much reading, a basic highlight of the command is shown below.

== Usage ==
<pre>
su {user} {-c "command"}
</pre>

Using the syntax above, if I were logged in as [[root]] and were to type 'su mobile -c "hi there"', the output would be the user [[mobile]] executing the command "echo hi there", which would just appear as the words "hi there" on the terminal screen. If "su" is launched by root, it does not ask for a password, but if it is launched by mobile, the terminal output is "Password:" and you need to put in the root password (by default it is "alpine" without the quotes).

== Parents ==
[[:/|(Root)]]/[[/bin|bin]]

[[Category:Filesystem]]

Su

2013-10-22T02:57:33Z

R3pwn:

== Introduction ==
Su is a command used for quickly switching between the [[root]] and [[mobile]] accounts on an iOS device. The [[root]] account gives you access to the entire filesystem and allows you to modify any file you wish. As this could be potentially dangerous, Apple has locked you out of the [[root]] account. You gain access to it, you must go through a process known as [[jailbreaking]]. You can find a list of all arguments and the proper syntax for 'su' at [http://linux.die.net/man/1/su this link], but if you don't want to do that much reading, a basic highlight of the command is shown below.

== Usage ==
<pre>
su {user} {-c "command"}
</pre>

Using the syntax above, if I were logged in as [[root]] and were to type 'su mobile -c "hi there"', the output would be the user [[mobile]] executing the command "echo hi there", which would just appear as the words "hi there" on the terminal screen. If "su" is launched by root, it does not ask for a password, but if it is launched by mobile, the terminal output is "Password:" and you need to put in the root password (by default it is "alpine" without the quotes).

== Parents ==
[[:/|(Root)]]/[[/bin|bin]]

[[Category:Filesystem]]

Talk:/System/Library/Lockdown

2013-10-21T21:16:05Z

R3pwn: Created page with "I do not see how this page is useless. It contains the Services.plist file that is responsible for afc2, which allows iFunbox and other software to access the root directory. ..."

I do not see how this page is useless. It contains the Services.plist file that is responsible for afc2, which allows iFunbox and other software to access the root directory. --[[User:R3pwn|R3pwn]] ([[User talk:R3pwn|talk]]) 17:09, 21 October 2013 (EST)

Talk:Launchctl

2013-10-21T21:07:59Z

R3pwn: /* No man page */

Same as [[Talk:Su]] --[[User:Jaggions|Jaggions]] ([[User talk:Jaggions|talk]]) 14:11, 17 October 2013 (UTC)

== No man page ==

As launchctl is exclusive to iOS and OSX, it does not have a manpage. --[[User:R3pwn|R3pwn]] ([[User talk:R3pwn|talk]]) 17:00, 21 October 2013 (EST)

Talk:Launchctl

2013-10-21T21:06:23Z

R3pwn: /* No man page */ new section

Same as [[Talk:Su]] --[[User:Jaggions|Jaggions]] ([[User talk:Jaggions|talk]]) 14:11, 17 October 2013 (UTC)

== No man page ==

As launchctl is exclusive to iOS and OSX, it does not have a manpage.

Talk:Launchctl

2013-10-21T21:05:32Z

R3pwn: Undo revision 36677 by R3pwn (talk)

Same as [[Talk:Su]] --[[User:Jaggions|Jaggions]] ([[User talk:Jaggions|talk]]) 14:11, 17 October 2013 (UTC)

Talk:Launchctl

2013-10-21T21:04:46Z

R3pwn:

Same as [[Talk:Su]] --[[User:Jaggions|Jaggions]] ([[User talk:Jaggions|talk]]) 14:11, 17 October 2013 (UTC)
As [[launchctl]] is exclusive to iOS and OSX, it does not have a man page. --[[User:R3pwn|R3pwn]]([[User talk:R3pwn|talk]]) 16:58, 21 October 2013 (EST)

/System/Library/Lockdown/Services.plist

2013-10-21T15:10:07Z

R3pwn: /* Parents */

== Summary ==
Specifies which services should be launched by [[lockdownd]], with which arguments and as what user.
Notable examples are [[AFC|AFC and AFC2]].

== File Contents ==
Files contents on a jailbroken 2nd Generation iPod Touch running iOS 4.2.1:

<pre>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.BTAutoPairing</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.BTAutoPairing</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/BTAutoPairingBridge</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.PortableStorage</key>
<dict>
<key>Label</key>
<string>com.apple.PortableStorage</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/psagent</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.afc</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.afc</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/afcd</string>
<string>--lockdown</string>
<string>-d</string>
<string>/var/mobile/Media</string>
<string>-u</string>
<string>mobile</string>
</array>
</dict>
<key>com.apple.afc2</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.afc2</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/afcd</string>
<string>--lockdown</string>
<string>-d</string>
<string>/</string>
</array>
</dict>
<key>com.apple.crashreportcopy</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.crashreportcopy</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/CrashReportCopyAgent</string>
<string>--lockdown</string>
<string>--oneshot</string>
</array>
</dict>
<key>com.apple.crashreportcopymobile</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.crashreportcopymobile</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/afcd</string>
<string>--lockdown</string>
<string>-d</string>
<string>/var/mobile/Library/Logs/CrashReporter</string>
<string>-u</string>
<string>mobile</string>
</array>
</dict>
<key>com.apple.crashreportmover</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.crashreportmover</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/crash_mover</string>
<string>--lockdown</string>
</array>
</dict>
<key>com.apple.misagent</key>
<dict>
<key>Label</key>
<string>com.apple.misagent</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/misagent</string>
</array>
</dict>
<key>com.apple.mobile.MCInstall</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.MCInstall</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mc_mobile_tunnel</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.mobile.MDMService</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.MDMService</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/MDMService</string>
</array>
</dict>
<key>com.apple.mobile.debug_image_mount</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.debug_image_mount</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/debug_image_mount</string>
</array>
</dict>
<key>com.apple.mobile.diagnostics_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.diagnostics_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_diagnostics_relay</string>
</array>
</dict>
<key>com.apple.mobile.factory_proxy</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.factory_proxy</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_factory_proxy</string>
</array>
</dict>
<key>com.apple.mobile.file_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.file_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_file_relay</string>
</array>
</dict>
<key>com.apple.mobile.house_arrest</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>InstanceLimit</key>
<integer>5</integer>
<key>Label</key>
<string>com.apple.mobile.house_arrest</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_house_arrest</string>
</array>
</dict>
<key>com.apple.mobile.installation_proxy</key>
<dict>
<key>Label</key>
<string>com.apple.mobile.installation_proxy</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_installation_proxy</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.mobile.integrity_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.integrity_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_integrity_relay</string>
</array>
</dict>
<key>com.apple.mobile.mobile_image_mounter</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.mobile_image_mounter</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_storage_proxy</string>
</array>
</dict>
<key>com.apple.mobile.notification_proxy</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.notification_proxy</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/notification_proxy</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.mobile.software_update</key>
<dict>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.mobile.software_update</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/software_update</string>
</array>
</dict>
<key>com.apple.mobile.system_profiler</key>
<dict>
<key>Label</key>
<string>com.apple.mobile.system_profiler</string>
<key>ProgramArguments</key>
<array>
<string>/usr/sbin/system_profiler</string>
</array>
</dict>
<key>com.apple.mobilebackup</key>
<dict>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.mobilebackup</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/BackupAgent</string>
<string>--lockdown</string>
</array>
</dict>
<key>com.apple.mobilebackup2</key>
<dict>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.mobilebackup2</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/BackupAgent2</string>
<string>--lockdown</string>
</array>
</dict>
<key>com.apple.mobilesync</key>
<dict>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.mobilesync</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/SyncAgent</string>
<string>--lockdown</string>
<string>--oneshot</string>
<string>-v</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.purpletestr</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.purpletestr</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/PurpleTestr</string>
<string>--lockdown</string>
<string>--oneshot</string>
</array>
</dict>
<key>com.apple.springboardservices</key>
<dict>
<key>Label</key>
<string>com.apple.springboardservicesrelay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/springboardservicesrelay</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.syslog_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.syslog_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/syslog_relay</string>
<string>--lockdown</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
</dict>
</plist>
</pre>

== Notes ==

The "com.apple.afc2" array is added during the jailbreak process.

== Parents ==
[[/|(Root)]]/[[/System|System]]/[[/System/Library|Library]]/[[/System/Library/Lockdown|Lockdown]]

[[Category:Filesystem]]

/private/var/stash

2013-10-21T11:10:00Z

R3pwn:

== Summary ==
Cydia creates this folder (which is on the user partition) and it moves there [[/Applications]], [[/Library]] and [[/Library/Themes.XXXXXX]] to free up space on the system partition, leaving symlinks to the original path. This allow to install tweaks and 3rd party applications.

== Children ==
=== Files ===
(None)
=== Folders ===
* [[/Applications]]
* [[/Library]]
* [[/Library/Themes.XXXXXX]]

==Parents ==
[[:/|(Root)]]/[[/private|private]]/[[/private/var|var]]

[[Category:Filesystem]]

Launchctl

2013-10-20T17:31:11Z

R3pwn: /* Notes */

== Location ==

The launchctl binary file is located in /bin.

== Usage ==

If you type "launchctl help", you get a list of available commands. This is the output of "launchctl help" when done on an iPod Touch 2nd Generation running iOS 4.2.1:
<pre>
usage: launchctl <subcommand>
load Load configuration files and/or directories
unload Unload configuration files and/or directories
start Start specified job
stop Stop specified job
submit Submit a job from the command line
remove Remove specified job
bootstrap Bootstrap launchd
list List jobs and information about jobs
setenv Set an environmental variable in launchd
unsetenv Unset an environmental variable in launchd
getenv Get an environmental variable from launchd
export Export shell settings from launchd
debug Set the WaitForDebugger flag for the target job to true.
limit View and adjust launchd resource limits
stdout Redirect launchd's standard out to the given path
stderr Redirect launchd's standard error to the given path
shutdown Prepare for system shutdown
singleuser Switch to single-user mode
getrusage Get resource usage statistics from launchd
log Adjust the logging level or mask of launchd
umask Change launchd's umask
bsexec Execute a process within a different Mach bootstrap subset
bslist List Mach bootstrap services and optional servers
bstree Show the entire Mach bootstrap tree. Requires root privileges.
managerpid Print the PID of the launchd managing this Mach bootstrap.
manageruid Print the UID of the launchd managing this Mach bootstrap.
managername Print the name of this Mach bootstrap.
exit Exit the interactive invocation of launchctl
quit Quit the interactive invocation of launchctl
help This help output
</pre>

== Notes ==
This command does not need to be run as root. Mobile will do fine. Also, this command should not differ much on your device from that of my test-device. If it does, please let me know and I will update this page accordingly.

Before iOS 6.1.3, this command used the arguements located in /etc/launchd.conf and executed them on startup. This is how [[evasi0n]] achieved an untethered jailbreak. Please see [[launchd.conf untether]] for more information.

== Parents ==
[[:/|(Root)]]/[[/bin|bin]]

[[Category:Filesystem]]

Launchctl

2013-10-20T17:29:23Z

R3pwn: /* Notes */

== Location ==

The launchctl binary file is located in /bin.

== Usage ==

If you type "launchctl help", you get a list of available commands. This is the output of "launchctl help" when done on an iPod Touch 2nd Generation running iOS 4.2.1:
<pre>
usage: launchctl <subcommand>
load Load configuration files and/or directories
unload Unload configuration files and/or directories
start Start specified job
stop Stop specified job
submit Submit a job from the command line
remove Remove specified job
bootstrap Bootstrap launchd
list List jobs and information about jobs
setenv Set an environmental variable in launchd
unsetenv Unset an environmental variable in launchd
getenv Get an environmental variable from launchd
export Export shell settings from launchd
debug Set the WaitForDebugger flag for the target job to true.
limit View and adjust launchd resource limits
stdout Redirect launchd's standard out to the given path
stderr Redirect launchd's standard error to the given path
shutdown Prepare for system shutdown
singleuser Switch to single-user mode
getrusage Get resource usage statistics from launchd
log Adjust the logging level or mask of launchd
umask Change launchd's umask
bsexec Execute a process within a different Mach bootstrap subset
bslist List Mach bootstrap services and optional servers
bstree Show the entire Mach bootstrap tree. Requires root privileges.
managerpid Print the PID of the launchd managing this Mach bootstrap.
manageruid Print the UID of the launchd managing this Mach bootstrap.
managername Print the name of this Mach bootstrap.
exit Exit the interactive invocation of launchctl
quit Quit the interactive invocation of launchctl
help This help output
</pre>

== Notes ==
This command does not need to be run as root. Mobile will do fine. Also, this command should not differ much on your device from that of my test-device. If it does, please let me know and I will update this page accordingly.

Before iOS 6.1.3, this command used the arguements located in /etc/[[launchd.conf]] and executed them on startup. This is how [[evasi0n]] achieved an untethered jailbreak.

== Parents ==
[[:/|(Root)]]/[[/bin|bin]]

[[Category:Filesystem]]

Launchctl

2013-10-20T17:27:25Z

R3pwn: /* Notes */

== Location ==

The launchctl binary file is located in /bin.

== Usage ==

If you type "launchctl help", you get a list of available commands. This is the output of "launchctl help" when done on an iPod Touch 2nd Generation running iOS 4.2.1:
<pre>
usage: launchctl <subcommand>
load Load configuration files and/or directories
unload Unload configuration files and/or directories
start Start specified job
stop Stop specified job
submit Submit a job from the command line
remove Remove specified job
bootstrap Bootstrap launchd
list List jobs and information about jobs
setenv Set an environmental variable in launchd
unsetenv Unset an environmental variable in launchd
getenv Get an environmental variable from launchd
export Export shell settings from launchd
debug Set the WaitForDebugger flag for the target job to true.
limit View and adjust launchd resource limits
stdout Redirect launchd's standard out to the given path
stderr Redirect launchd's standard error to the given path
shutdown Prepare for system shutdown
singleuser Switch to single-user mode
getrusage Get resource usage statistics from launchd
log Adjust the logging level or mask of launchd
umask Change launchd's umask
bsexec Execute a process within a different Mach bootstrap subset
bslist List Mach bootstrap services and optional servers
bstree Show the entire Mach bootstrap tree. Requires root privileges.
managerpid Print the PID of the launchd managing this Mach bootstrap.
manageruid Print the UID of the launchd managing this Mach bootstrap.
managername Print the name of this Mach bootstrap.
exit Exit the interactive invocation of launchctl
quit Quit the interactive invocation of launchctl
help This help output
</pre>

== Notes ==
This command does not need to be run as root. Mobile will do fine. Also, this command should not differ much on your device from that of my test-device. If it does, please let me know and I will update this page accordingly.

== Parents ==
[[:/|(Root)]]/[[/bin|bin]]

[[Category:Filesystem]]

/bin

2013-10-20T17:26:15Z

R3pwn:

Folder that contains GNU Coreutils. The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU operating system. These are the core utilities which are expected to exist on every operating system.

== Children ==
=== Folders ===

There are no folders that exist inside of /bin.

=== Files ===

* bash
* bunzip2
* bzcat
* bzip2
* bzip2recover
* cat
* chgrp
* chmod
* chown
* cp
* date
* dd
* df
* dir
* echo
* egrep
* false
* fgrep
* grep
* gunzip
* gzexe
* gzip
* kill
* [[launchctl]]
* ln
* ls
* mkdir
* mknod
* mktemp
* mv
* pwd
* [[readlink]]
* rm
* rmdir
* se
* sh
* sleep
* stty
* [[su]]
* sync
* tar
* touch
* true
* uname
* uncompress
* vdir
* zcat
* zcmp
* zdiff
* zegrep
* zfgrep
* zforce
* zgrep
* zless
* zmore
* znew

== Parents ==
[[:/|(Root)]]

[[Category:Filesystem]]

User:R3pwn

2013-10-17T01:13:50Z

R3pwn: Created page with "== Bio == r3pwn's actual name is Greg Willard. He was born January 7th, 1999 and periodically switches interests between android development, iOS exploitation, and World of Wa..."

== Bio ==
r3pwn's actual name is Greg Willard. He was born January 7th, 1999 and periodically switches interests between android development, iOS exploitation, and World of Warcraft

== Contact ==
r3pwn can be contacted on Twitter @r3pwn or via email/iMessage at r3pwn@icloud.com

/bin

2013-10-17T01:08:17Z

R3pwn: /* Files */

Folder that contains GNU Coreutils. The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU operating system. These are the core utilities which are expected to exist on every operating system.

== Children ==
=== Folders ===

There are no folders that exist inside of /bin.

=== Files ===

[[bash]]

[[bunzip2]]

[[bzcat]]

[[bzip2]]

[[bzip2recover]]

[[cat]]

[[chgrp]]

[[chmod]]

[[chown]]

[[cp]]

[[date]]

[[dd]]

[[df]]

[[dir]]

[[echo]]

[[egrep]]

[[false]]

[[fgrep]]

[[grep]]

[[gunzip]]

[[gzexe]]

[[gzip]]

[[kill]]

[[launchctl]]

[[ln]]

[[ls]]

[[mkdir]]

[[mknod]]

[[mktemp]]

[[mv]]

[[pwd]]

[[readlink]]

[[rm]]

[[rmdir]]

[[se]]

[[sh]]

[[sleep]]

[[stty]]

[[su]]

[[sync]]

[[tar]]

[[touch]]

[[true]]

[[uname]]

[[uncompress]]

[[vdir]]

[[zcat]]

[[zcmp]]

[[zdiff]]

[[zegrep]]

[[zfgrep]]

[[zforce]]

[[zgrep]]

[[zless]]

[[zmore]]

[[znew]]

== Parents ==
[[:/|(Root)]]

[[Category:Filesystem]]

/bin

2013-10-17T01:07:43Z

R3pwn: /* Files */

Folder that contains GNU Coreutils. The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU operating system. These are the core utilities which are expected to exist on every operating system.

== Children ==
=== Folders ===

There are no folders that exist inside of /bin.

=== Files ===

[[bash]]

[[bunzip2]]

[[bzcat]]

[[bzip2]]

[[bzip2recover]]

[[cat]]

[[chgrp]]

[[chmod]]

[[chown]]

[[cp]]

[[date]]

[[dd]]

[[df]]

[[dir]]

[[echo]]

[[egrep]]

[[false]]

[[fgrep]]

[[grep]]

[[gunzip]]

[[gzexe]]

[[gzip]]

[[kill]]

[[launchctl]]

[[ln]]

[[ls]]

[[mkdir]]

[[mknod]]

[[mktemp]]

[[mv]]

[[pwd]]

[[readlink]]

[[rm]]

[[rmdir]]

[[se]]

[[sh]]

[[sleep]]

[[stty]]

[[su]]

[[sync]]

[[tar]]

[[touch]]

[[true]]

[[uname]]

[[uncompress]]

[[vdir]]

[[zcat]]

[[zcmp]]

[[zdiff]]

[[zegrep]]

[[zfgrep]]

[[zforce]]

[[zgrep]]

[[zless]]

[[zmore]]

znew

== Parents ==
[[:/|(Root)]]

[[Category:Filesystem]]

Su

2013-10-17T01:03:01Z

R3pwn: Created page with "== Usage == There is no official usage of "su", but below you can find a list of available arguements below. <pre> su {user} {-c "command"} </pre> == Notes == Using the synt..."

== Usage ==
There is no official usage of "su", but below you can find a list of available arguements below.
<pre>
su {user} {-c "command"}
</pre>

== Notes ==
Using the syntax above, if I were logged in as [[root]] and were to type 'su mobile -c "hi there"', the output would be the user [[mobile]] executing the command "echo hi there", which would just appear as the words "hi there" on the terminal screen. If "su" is launched by root, it does not ask for a password, but if it is launched by mobile, the terminal output is "Password:" and you need to put in the root password (by default it is "alpine" without the quotes).

== Parents ==
[[:/|(Root)]]/[[/bin|bin]]

[[Category:Filesystem]]

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

2013-10-17T00:22:00Z

R3pwn:

This is a file located in /System/Library/LaunchDaemons that loads SpringBoard at boot and tells it to re-launch itself when killed (This is how re-springs are possible).

== File Contents ==
The contents of this file on an iPod Touch 2 running iOS 4.2.1 is as follows:
<pre>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>EmbeddedPrivilegeDispensation</key>
<true/>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.apple.SpringBoard</string>
<key>MachServices</key>
<dict>
<key>PurpleSystemEventPort</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.CARenderServer</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.SBUserNotification</key>
<true/>
<key>com.apple.UIKit.statusbarserver</key>
<true/>
<key>com.apple.iohideventsystem</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.smsserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.UIKit.migserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.alerts</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.appstatechanged</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.backgroundappservices</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processassertionservices</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processinvalidation</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.remotenotifications</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.services</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.watchdogserver</key>
<true/>
</dict>
<key>ProgramArguments</key>
<array>
<string>/System/Library/CoreServices/SpringBoard.app/SpringBoard</string>
</array>
<key>ThrottleInterval</key>
<integer>5</integer>
<key>UserName</key>
<string>mobile</string>
</dict>
</plist>
</pre>

The contents in this file shouldn't change too much based on devices/iOS versions, but may vary slightly.

== Important Notes ==
Whatever you do, stay away from this file. Messing with its contents will bring nothing but trouble. If you are feeling adventurous and tell SpringBoard to run as "root" instead of "mobile", your device will turn on, but you will be unable to open any apps. They will open their "loading.png" then immediately crash, probably because the sandbox doesn't want to run as root.

== Parents ==
[[:/|(Root)]]/[[/System|System]]/[[/System/Library|Library]]/[[/System/Library/LaunchDaemons|LaunchDaemons]]

[[Category:Filesystem]]

/bin

2013-10-17T00:09:28Z

R3pwn: /* Files */

Folder that contains GNU Coreutils. The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU operating system. These are the core utilities which are expected to exist on every operating system.

== Children ==
=== Folders ===

There are no folders that exist inside of /bin.

=== Files ===

bash

bunzip2

bzcat

bzip2

bzip2recover

cat

chgrp

chmod

chown

cp

date

dd

df

dir

echo

egrep

false

fgrep

grep

gunzip

gzexe

gzip

kill

[[launchctl|launchctl]]

ln

ls

mkdir

mknod

mktemp

mv

pwd

[[readlink|readlink]]

rm

rmdir

se

sh

sleep

stty

su

sync

tar

touch

true

uname

uncompress

vdir

zcat

zcmp

zdiff

zegrep

zfgrep

zforce

zgrep

zless

zmore

znew

== Parents ==
[[:/|(Root)]]

[[Category:Filesystem]]

/bin

2013-10-17T00:09:08Z

R3pwn: /* Files */

Folder that contains GNU Coreutils. The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU operating system. These are the core utilities which are expected to exist on every operating system.

== Children ==
=== Folders ===

There are no folders that exist inside of /bin.

=== Files ===

bash

bunzip2

bzcat

bzip2

bzip2recover

cat

chgrp

chmod

chown

cp
date

dd

df

dir

echo

egrep

false

fgrep

grep

gunzip

gzexe

gzip

kill

[[launchctl|launchctl]]

ln

ls

mkdir

mknod

mktemp

mv

pwd

[[readlink|readlink]]

rm

rmdir

se

sh

sleep

stty

su

sync

tar

touch

true

uname

uncompress

vdir

zcat

zcmp

zdiff

zegrep

zfgrep

zforce

zgrep

zless

zmore

znew

== Parents ==
[[:/|(Root)]]

[[Category:Filesystem]]

/bin

2013-10-17T00:08:38Z

R3pwn: /* Files */

Folder that contains GNU Coreutils. The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU operating system. These are the core utilities which are expected to exist on every operating system.

== Children ==
=== Folders ===

There are no folders that exist inside of /bin.

=== Files ===

bash

bunzip2

bzcat

bzip2

bzip2recover

cat

chgrp

chmod

chown

cp

date

dd

df

dir

echo

egrep

false

fgrep

grep

gunzip

gzexe

gzip

kill

[[launchctl|launchctl]]

ln

ls

mkdir

mknod

mktemp

mv

pwd

[[readlink|readlink]]

rm

rmdir

se

sh

sleep

stty

su

sync

tar

touch

true

uname

uncompress

vdir

zcat

zcmp

zdiff

zegrep

zfgrep

zforce

zgrep

zless

zmore

znew

== Parents ==
[[:/|(Root)]]

[[Category:Filesystem]]

/private/var/stash

2013-10-17T00:05:33Z

R3pwn: /* Folders */

== Why does this folder exist? ==
Cydia creates this folder to increase the amount of files allowed on the system partition. Since this file is on the user data partition, items are symlinked to certain subfolders inside this folder so you can put many more files on the system partition.

== Children ==
=== Files ===
No files are under this folder.
=== Folders ===
Applications (Where the system applications are stored)

Library (Contains system ringtones/wallpapers)

Themes.XXXXXX (Contains WinterBoard themes)

Certain other items from [[Cydia.app|Cydia]] that are made by Saurik store their files here as well.

/private/var/stash

2013-10-17T00:05:06Z

R3pwn: Created page with "== Why does this folder exist? == Cydia creates this folder to increase the amount of files allowed on the system partition. Since this file is on the user data partition, ite..."

== Why does this folder exist? ==
Cydia creates this folder to increase the amount of files allowed on the system partition. Since this file is on the user data partition, items are symlinked to certain subfolders inside this folder so you can put many more files on the system partition.

== Children ==
=== Files ===
No files are under this folder.
=== Folders ===
Applications (Where the system applications are stored)
Library (Contains system ringtones/wallpapers)
Themes.XXXXXX (Contains WinterBoard themes)

Certain other items from [[Cydia.app|Cydia]] that are made by Saurik store their files here as well.

/private/var

2013-10-16T23:54:33Z

R3pwn: /* Folders */

{{lowercase}}
This folder is the mount point for <code>/dev/disk0s2</code>, which is the [[iDevice|device]]'s user/data partition. This deviates from the [[wikipedia:Filesystem Hierarchy Standard|Filesystem Hierarchy Standard]] which places this at <code>/var</code>, however, a sym-link is placed at <code>/var</code> that redirects to here, so it is at least somewhat complient.

It is the larger of the two partitions, and stores all App Store applications, iTunes media, settings, photos, etc.

Before [[iOS|iPhone OS]] 1.1.3 (1.1.2 and below) all of this data was stored in [[:/private/var/root]]. However, for security reasons, in 1.1.3 Apple made most applications run under the user mobile, and moved all of the data to [[:/private/var/mobile]].

== Children ==
=== Folders ===
* audit (unused; [[iOS]] 6.0+?)
* [[/private/var/backups|backups]] (unused)
* cache (used by <code>[[wikipedia:Advanced Packaging Tool|apt-get]]</code> and <code>[[wikipedia:GNU Find Utilities|GNU Find Utilities]]</code>)
* [[/private/var/db|db]]
* ea (unused; [[iOS]] 6.0+?)
* [[/private/var/empty|empty]]
* [[/private/var/folders|folders]] (unused)
* keybags ([[iOS]] 4.0+)
* Keychains
* [[/private/var/lib|lib]]
* [[/private/var/local|local]]
* [[/private/var/lock|lock]]
* log
* [[/private/var/logs|logs]] (which contains [[/private/var/logs/AppleSupport]])
* Managed Preferences
* [[/private/var/mobile|mobile]] (home folder for mobile user)
* [[/private/var/MobileDevice|MobileDevice]]
* MobileSoftwareUpdate (used for [[OTA Updates]]; [[iOS]] 5.0+)
* msgs
* [[/private/var/preferences|preferences]]
* [[/private/var/root|root]] (home folder for root user)
* [[/private/var/run|run]] (used by lockdownd)
* spool(unused)
* [[/private/var/stash|stash]] (created by [[Cydia.app|Cydia]])
* [[/private/var/tmp|tmp]] (/dev/disk0s3)
* vm (unused as [[iOS]] doesn't support swap files or hibernation)
* wireless ([[iOS]] 4.0+)

=== Files ===
* [[/private/var/log/kernel.log|kernel.log]]

== Parents ==
{{parent|private}}

[[Category:Filesystem]]

/bin

2013-10-16T23:45:28Z

R3pwn:

Folder that contains GNU Coreutils. The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU operating system. These are the core utilities which are expected to exist on every operating system.

== Children ==
=== Folders ===

There are no folders that exist inside of /bin.

=== Files ===

bash
bunzip2
bzcat
bzip2
bzip2recover
cat
chgrp
chmod
chown
cp
date
dd
df
dir
echo
egrep
false
fgrep
grep
gunzip
gzexe
gzip
kill
[[launchctl|launchctl]]
ln
ls
mkdir
mknod
mktemp
mv
pwd
[[readlink|readlink]]
rm
rmdir
se
sh
sleep
stty
su
sync
tar
touch
true
uname
uncompress
vdir
zcat
zcmp
zdiff
zegrep
zfgrep
zforce
zgrep
zless
zmore
znew

== Parents ==
[[:/|(Root)]]

[[Category:Filesystem]]

Readlink

2013-10-16T23:43:07Z

R3pwn: This is some information about the readlink binary.

== Location ==
The binary for readlink is located in /bin.

== Usage ==
The usage text as it appears in iOS 4.2.1:
<pre>
Usage: readlink [OPTION]... FILE
Print value of a symbolic link or canonical file name

-f, --canonicalize canonicalize by following every symlink in
every component of the given name recursively;
all but the last component must exist
-e, --canonicalize-existing canonicalize by following every symlink in
every component of the given name recursively,
all components must exist
-m, --canonicalize-missing canonicalize by following every symlink in
every component of the given name recursively,
without requirements on components existence
-n, --no-newline do not output the trailing newline
-q, --quiet,
-s, --silent suppress most error messages
-v, --verbose report error messages
--help display this help and exit
--version output version information and exit

Report readlink bugs to bug-coreutils@gnu.org
GNU coreutils home page: <http://www.gnu.org/software/coreutils/>
General help using GNU software: <http://www.gnu.org/gethelp/>
Report readlink translation bugs to <http://translationproject.org/team/>
For complete documentation, run: info coreutils 'readlink invocation'
</pre>

== Notes ==
This command does not need to be run as root. Mobile will do fine.

== Parents ==
[[:/|(Root)]]/[[/bin|bin]]

[[Category:Filesystem]]

/bin

2013-10-16T23:31:12Z

R3pwn: /* Folders */

Folder that contains GNU Coreutils. The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU operating system. These are the core utilities which are expected to exist on every operating system.

== Children ==
=== Folders ===

There are no folders that exist inside of /bin.

=== Files ===

bash
bunzip2
bzcat
bzip2
bzip2recover
cat
chgrp
chmod
chown
cp
date
dd
df
dir
echo
egrep
false
fgrep
grep
gunzip
gzexe
gzip
kill
[[launchctl|launchctl]]
ln
ls
mkdir
mknod
mktemp
mv
pwd
readlink
rm
rmdir
se
sh
sleep
stty
su
sync
tar
touch
true
uname
uncompress
vdir
zcat
zcmp
zdiff
zegrep
zfgrep
zforce
zgrep
zless
zmore
znew

== Parents ==
[[:/|(Root)]]

[[Category:Filesystem]]

/bin

2013-10-16T23:27:48Z

R3pwn: /* Parents */

Folder that contains GNU Coreutils. The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU operating system. These are the core utilities which are expected to exist on every operating system.

== Children ==
=== Folders ===
=== Files ===

bash
bunzip2
bzcat
bzip2
bzip2recover
cat
chgrp
chmod
chown
cp
date
dd
df
dir
echo
egrep
false
fgrep
grep
gunzip
gzexe
gzip
kill
[[launchctl|launchctl]]
ln
ls
mkdir
mknod
mktemp
mv
pwd
readlink
rm
rmdir
se
sh
sleep
stty
su
sync
tar
touch
true
uname
uncompress
vdir
zcat
zcmp
zdiff
zegrep
zfgrep
zforce
zgrep
zless
zmore
znew

== Parents ==
[[:/|(Root)]]

[[Category:Filesystem]]

/bin

2013-10-16T23:26:47Z

R3pwn: /* Files */

Folder that contains GNU Coreutils. The GNU Core Utilities are the basic file, shell and text manipulation utilities of the GNU operating system. These are the core utilities which are expected to exist on every operating system.

== Children ==
=== Folders ===
=== Files ===

bash
bunzip2
bzcat
bzip2
bzip2recover
cat
chgrp
chmod
chown
cp
date
dd
df
dir
echo
egrep
false
fgrep
grep
gunzip
gzexe
gzip
kill
[[launchctl|launchctl]]
ln
ls
mkdir
mknod
mktemp
mv
pwd
readlink
rm
rmdir
se
sh
sleep
stty
su
sync
tar
touch
true
uname
uncompress
vdir
zcat
zcmp
zdiff
zegrep
zfgrep
zforce
zgrep
zless
zmore
znew

== Parents ==
*[[/]]

[[Category:Filesystem]]

Launchctl

2013-10-16T23:25:37Z

R3pwn:

== Location ==

The launchctl binary file is located in /bin.

== Usage ==

If you type "launchctl help", you get a list of available commands. This is the output of "launchctl help" when done on an iPod Touch 2nd Generation running iOS 4.2.1:
<pre>
usage: launchctl <subcommand>
load Load configuration files and/or directories
unload Unload configuration files and/or directories
start Start specified job
stop Stop specified job
submit Submit a job from the command line
remove Remove specified job
bootstrap Bootstrap launchd
list List jobs and information about jobs
setenv Set an environmental variable in launchd
unsetenv Unset an environmental variable in launchd
getenv Get an environmental variable from launchd
export Export shell settings from launchd
debug Set the WaitForDebugger flag for the target job to true.
limit View and adjust launchd resource limits
stdout Redirect launchd's standard out to the given path
stderr Redirect launchd's standard error to the given path
shutdown Prepare for system shutdown
singleuser Switch to single-user mode
getrusage Get resource usage statistics from launchd
log Adjust the logging level or mask of launchd
umask Change launchd's umask
bsexec Execute a process within a different Mach bootstrap subset
bslist List Mach bootstrap services and optional servers
bstree Show the entire Mach bootstrap tree. Requires root privileges.
managerpid Print the PID of the launchd managing this Mach bootstrap.
manageruid Print the UID of the launchd managing this Mach bootstrap.
managername Print the name of this Mach bootstrap.
exit Exit the interactive invocation of launchctl
quit Quit the interactive invocation of launchctl
help This help output
</pre>

== Notes ==
This command does not need to be run as root. Mobile will do fine. Also, this command should not differ much from that of my test-device. If it does, please let me know and I will update this page accordingly.

== Parents ==
[[:/|(Root)]]/[[/bin|bin]]

[[Category:Filesystem]]

Launchctl

2013-10-16T23:22:49Z

R3pwn: /* Usage */

== Location ==

The launchctl binary file is located in /bin.

== Usage ==

If you type "launchctl help", you get a list of available commands. This is the output of "launchctl help" when done on an iPod Touch 2nd Generation running iOS 4.2.1:
<pre>
usage: launchctl <subcommand>
load Load configuration files and/or directories
unload Unload configuration files and/or directories
start Start specified job
stop Stop specified job
submit Submit a job from the command line
remove Remove specified job
bootstrap Bootstrap launchd
list List jobs and information about jobs
setenv Set an environmental variable in launchd
unsetenv Unset an environmental variable in launchd
getenv Get an environmental variable from launchd
export Export shell settings from launchd
debug Set the WaitForDebugger flag for the target job to true.
limit View and adjust launchd resource limits
stdout Redirect launchd's standard out to the given path
stderr Redirect launchd's standard error to the given path
shutdown Prepare for system shutdown
singleuser Switch to single-user mode
getrusage Get resource usage statistics from launchd
log Adjust the logging level or mask of launchd
umask Change launchd's umask
bsexec Execute a process within a different Mach bootstrap subset
bslist List Mach bootstrap services and optional servers
bstree Show the entire Mach bootstrap tree. Requires root privileges.
managerpid Print the PID of the launchd managing this Mach bootstrap.
manageruid Print the UID of the launchd managing this Mach bootstrap.
managername Print the name of this Mach bootstrap.
exit Exit the interactive invocation of launchctl
quit Quit the interactive invocation of launchctl
help This help output
</pre>

== Notes ==
This command does not need to be run as root. Mobile will do fine. Also, this command should not differ much from that of my test-device. If it does, please let me know and I will update this page accordingly.

Launchctl

2013-10-16T23:21:36Z

R3pwn: Created page with "== Location == The launchctl binary file is located in /bin. == Usage == If you type "launchctl help", you get a list of available commands. This is the output of "launchc..."

== Location ==

The launchctl binary file is located in /bin.

== Usage ==

If you type "launchctl help", you get a list of available commands. This is the output of "launchctl help" when done on a n iPod Touch 2nd Generation running iOS 4.2.1:
<pre>
usage: launchctl <subcommand>
load Load configuration files and/or directories
unload Unload configuration files and/or directories
start Start specified job
stop Stop specified job
submit Submit a job from the command line
remove Remove specified job
bootstrap Bootstrap launchd
list List jobs and information about jobs
setenv Set an environmental variable in launchd
unsetenv Unset an environmental variable in launchd
getenv Get an environmental variable from launchd
export Export shell settings from launchd
debug Set the WaitForDebugger flag for the target job to true.
limit View and adjust launchd resource limits
stdout Redirect launchd's standard out to the given path
stderr Redirect launchd's standard error to the given path
shutdown Prepare for system shutdown
singleuser Switch to single-user mode
getrusage Get resource usage statistics from launchd
log Adjust the logging level or mask of launchd
umask Change launchd's umask
bsexec Execute a process within a different Mach bootstrap subset
bslist List Mach bootstrap services and optional servers
bstree Show the entire Mach bootstrap tree. Requires root privileges.
managerpid Print the PID of the launchd managing this Mach bootstrap.
manageruid Print the UID of the launchd managing this Mach bootstrap.
managername Print the name of this Mach bootstrap.
exit Exit the interactive invocation of launchctl
quit Quit the interactive invocation of launchctl
help This help output
</pre>

== Notes ==
This command does not need to be run as root. Mobile will do fine. Also, this command should not differ much from that of my test-device. If it does, please let me know and I will update this page accordingly.

/System/Library/Lockdown/Services.plist

2013-10-16T22:59:08Z

R3pwn: /* File Contents */

== Summary ==
Specifies which services should be launched by [[lockdownd]], with which arguments and as what user.
Notable examples are [[AFC|AFC and AFC2]].

== File Contents ==
This files contents on a jailbroken iPod Touch 2nd Generation running iOS 4.2.1:

<pre>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.BTAutoPairing</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.BTAutoPairing</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/BTAutoPairingBridge</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.PortableStorage</key>
<dict>
<key>Label</key>
<string>com.apple.PortableStorage</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/psagent</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.afc</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.afc</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/afcd</string>
<string>--lockdown</string>
<string>-d</string>
<string>/var/mobile/Media</string>
<string>-u</string>
<string>mobile</string>
</array>
</dict>
<key>com.apple.afc2</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.afc2</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/afcd</string>
<string>--lockdown</string>
<string>-d</string>
<string>/</string>
</array>
</dict>
<key>com.apple.crashreportcopy</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.crashreportcopy</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/CrashReportCopyAgent</string>
<string>--lockdown</string>
<string>--oneshot</string>
</array>
</dict>
<key>com.apple.crashreportcopymobile</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.crashreportcopymobile</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/afcd</string>
<string>--lockdown</string>
<string>-d</string>
<string>/var/mobile/Library/Logs/CrashReporter</string>
<string>-u</string>
<string>mobile</string>
</array>
</dict>
<key>com.apple.crashreportmover</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.crashreportmover</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/crash_mover</string>
<string>--lockdown</string>
</array>
</dict>
<key>com.apple.misagent</key>
<dict>
<key>Label</key>
<string>com.apple.misagent</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/misagent</string>
</array>
</dict>
<key>com.apple.mobile.MCInstall</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.MCInstall</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mc_mobile_tunnel</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.mobile.MDMService</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.MDMService</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/MDMService</string>
</array>
</dict>
<key>com.apple.mobile.debug_image_mount</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.debug_image_mount</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/debug_image_mount</string>
</array>
</dict>
<key>com.apple.mobile.diagnostics_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.diagnostics_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_diagnostics_relay</string>
</array>
</dict>
<key>com.apple.mobile.factory_proxy</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.factory_proxy</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_factory_proxy</string>
</array>
</dict>
<key>com.apple.mobile.file_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.file_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_file_relay</string>
</array>
</dict>
<key>com.apple.mobile.house_arrest</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>InstanceLimit</key>
<integer>5</integer>
<key>Label</key>
<string>com.apple.mobile.house_arrest</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_house_arrest</string>
</array>
</dict>
<key>com.apple.mobile.installation_proxy</key>
<dict>
<key>Label</key>
<string>com.apple.mobile.installation_proxy</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_installation_proxy</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.mobile.integrity_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.integrity_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_integrity_relay</string>
</array>
</dict>
<key>com.apple.mobile.mobile_image_mounter</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.mobile_image_mounter</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_storage_proxy</string>
</array>
</dict>
<key>com.apple.mobile.notification_proxy</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.notification_proxy</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/notification_proxy</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.mobile.software_update</key>
<dict>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.mobile.software_update</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/software_update</string>
</array>
</dict>
<key>com.apple.mobile.system_profiler</key>
<dict>
<key>Label</key>
<string>com.apple.mobile.system_profiler</string>
<key>ProgramArguments</key>
<array>
<string>/usr/sbin/system_profiler</string>
</array>
</dict>
<key>com.apple.mobilebackup</key>
<dict>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.mobilebackup</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/BackupAgent</string>
<string>--lockdown</string>
</array>
</dict>
<key>com.apple.mobilebackup2</key>
<dict>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.mobilebackup2</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/BackupAgent2</string>
<string>--lockdown</string>
</array>
</dict>
<key>com.apple.mobilesync</key>
<dict>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.mobilesync</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/SyncAgent</string>
<string>--lockdown</string>
<string>--oneshot</string>
<string>-v</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.purpletestr</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.purpletestr</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/PurpleTestr</string>
<string>--lockdown</string>
<string>--oneshot</string>
</array>
</dict>
<key>com.apple.springboardservices</key>
<dict>
<key>Label</key>
<string>com.apple.springboardservicesrelay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/springboardservicesrelay</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.syslog_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.syslog_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/syslog_relay</string>
<string>--lockdown</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
</dict>
</plist>
</pre>

Please note that this file's contents may or may not vary from your device's contents, I just felt that it was necessary to include my devices model and iOS version for reference purposes.

Please also note that the entry entitled "com.apple.afc2" will not exist on a non-jailbroken device. That part is added during the jailbreak process.

== Parents ==
[[/|Root]]/[[/System|System]]/[[/System/Library|Library]]/[[/System/Library/Lockdown|Lockdown]]

[[Category:Filesystem]]

/System/Library/Lockdown/Services.plist

2013-10-16T22:55:08Z

R3pwn: /* File Contents */

== Summary ==
Specifies which services should be launched by [[lockdownd]], with which arguments and as what user.
Notable examples are [[AFC|AFC and AFC2]].

== File Contents ==
This files contents on an iPod Touch 2nd Generation running iOS 4.2.1:

<pre>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.BTAutoPairing</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.BTAutoPairing</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/BTAutoPairingBridge</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.PortableStorage</key>
<dict>
<key>Label</key>
<string>com.apple.PortableStorage</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/psagent</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.afc</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.afc</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/afcd</string>
<string>--lockdown</string>
<string>-d</string>
<string>/var/mobile/Media</string>
<string>-u</string>
<string>mobile</string>
</array>
</dict>
<key>com.apple.afc2</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.afc2</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/afcd</string>
<string>--lockdown</string>
<string>-d</string>
<string>/</string>
</array>
</dict>
<key>com.apple.crashreportcopy</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.crashreportcopy</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/CrashReportCopyAgent</string>
<string>--lockdown</string>
<string>--oneshot</string>
</array>
</dict>
<key>com.apple.crashreportcopymobile</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.crashreportcopymobile</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/afcd</string>
<string>--lockdown</string>
<string>-d</string>
<string>/var/mobile/Library/Logs/CrashReporter</string>
<string>-u</string>
<string>mobile</string>
</array>
</dict>
<key>com.apple.crashreportmover</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.crashreportmover</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/crash_mover</string>
<string>--lockdown</string>
</array>
</dict>
<key>com.apple.misagent</key>
<dict>
<key>Label</key>
<string>com.apple.misagent</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/misagent</string>
</array>
</dict>
<key>com.apple.mobile.MCInstall</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.MCInstall</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mc_mobile_tunnel</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.mobile.MDMService</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.MDMService</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/MDMService</string>
</array>
</dict>
<key>com.apple.mobile.debug_image_mount</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.debug_image_mount</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/debug_image_mount</string>
</array>
</dict>
<key>com.apple.mobile.diagnostics_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.diagnostics_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_diagnostics_relay</string>
</array>
</dict>
<key>com.apple.mobile.factory_proxy</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.factory_proxy</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_factory_proxy</string>
</array>
</dict>
<key>com.apple.mobile.file_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.file_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_file_relay</string>
</array>
</dict>
<key>com.apple.mobile.house_arrest</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>InstanceLimit</key>
<integer>5</integer>
<key>Label</key>
<string>com.apple.mobile.house_arrest</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_house_arrest</string>
</array>
</dict>
<key>com.apple.mobile.installation_proxy</key>
<dict>
<key>Label</key>
<string>com.apple.mobile.installation_proxy</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_installation_proxy</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.mobile.integrity_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.integrity_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_integrity_relay</string>
</array>
</dict>
<key>com.apple.mobile.mobile_image_mounter</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.mobile_image_mounter</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/mobile_storage_proxy</string>
</array>
</dict>
<key>com.apple.mobile.notification_proxy</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.mobile.notification_proxy</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/notification_proxy</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.mobile.software_update</key>
<dict>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.mobile.software_update</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/software_update</string>
</array>
</dict>
<key>com.apple.mobile.system_profiler</key>
<dict>
<key>Label</key>
<string>com.apple.mobile.system_profiler</string>
<key>ProgramArguments</key>
<array>
<string>/usr/sbin/system_profiler</string>
</array>
</dict>
<key>com.apple.mobilebackup</key>
<dict>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.mobilebackup</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/BackupAgent</string>
<string>--lockdown</string>
</array>
</dict>
<key>com.apple.mobilebackup2</key>
<dict>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.mobilebackup2</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/BackupAgent2</string>
<string>--lockdown</string>
</array>
</dict>
<key>com.apple.mobilesync</key>
<dict>
<key>InstanceLimit</key>
<integer>1</integer>
<key>Label</key>
<string>com.apple.mobilesync</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/SyncAgent</string>
<string>--lockdown</string>
<string>--oneshot</string>
<string>-v</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.purpletestr</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.purpletestr</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/PurpleTestr</string>
<string>--lockdown</string>
<string>--oneshot</string>
</array>
</dict>
<key>com.apple.springboardservices</key>
<dict>
<key>Label</key>
<string>com.apple.springboardservicesrelay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/springboardservicesrelay</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
<key>com.apple.syslog_relay</key>
<dict>
<key>AllowUnactivatedService</key>
<true/>
<key>Label</key>
<string>com.apple.syslog_relay</string>
<key>ProgramArguments</key>
<array>
<string>/usr/libexec/syslog_relay</string>
<string>--lockdown</string>
</array>
<key>UserName</key>
<string>mobile</string>
</dict>
</dict>
</plist>
</pre>

Please note that this file's contents may or may not vary from your device's contents, I just felt that it was necessary to include my devices model and iOS version for reference purposes.

== Parents ==
[[/|Root]]/[[/System|System]]/[[/System/Library|Library]]/[[/System/Library/Lockdown|Lockdown]]

[[Category:Filesystem]]

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

2013-10-16T22:31:49Z

R3pwn:

This is a file located in /System/Library/LaunchDaemons that loads SpringBoard at boot and tells it to re-launch itself when killed (This is how re-springs are possible).
The contents of this file on an iPod Touch 2 running iOS 4.2.1 is as follows:

== File Contents ==
<pre>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>EmbeddedPrivilegeDispensation</key>
<true/>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.apple.SpringBoard</string>
<key>MachServices</key>
<dict>
<key>PurpleSystemEventPort</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.CARenderServer</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.SBUserNotification</key>
<true/>
<key>com.apple.UIKit.statusbarserver</key>
<true/>
<key>com.apple.iohideventsystem</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.smsserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.UIKit.migserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.alerts</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.appstatechanged</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.backgroundappservices</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processassertionservices</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processinvalidation</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.remotenotifications</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.services</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.watchdogserver</key>
<true/>
</dict>
<key>ProgramArguments</key>
<array>
<string>/System/Library/CoreServices/SpringBoard.app/SpringBoard</string>
</array>
<key>ThrottleInterval</key>
<integer>5</integer>
<key>UserName</key>
<string>mobile</string>
</dict>
</plist>
</pre>

The contents in this file shouldn't change too much based on devices/iOS versions, but may vary slightly.

== Important Notes ==
Whatever you do, stay away from this file. Messing with its contents will bring nothing but trouble. If you are feeling adventurous and tell SpringBoard to run as "root" instead of "mobile", your device will turn on, but you will be unable to open any apps. They will open their "loading.png" then immediately crash, probably because the sandbox doesn't want to run as root.

== Parents ==
[[:/|(Root)]]/[[/System|System]]/[[/System/Library|Library]]/[[/System/Library/LaunchDaemons|LaunchDaemons]]

[[Category:Filesystem]]

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

2013-10-16T21:41:15Z

R3pwn:

This is a file located in /System/Library/LaunchDaemons that loads SpringBoard at boot and tells it to re-launch itself when killed (This is how re-springs are possible).
The contents of this file on an iPod Touch 2 running iOS 4.2.1 is as follows:

== File Contents ==
<pre>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>EmbeddedPrivilegeDispensation</key>
<true/>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.apple.SpringBoard</string>
<key>MachServices</key>
<dict>
<key>PurpleSystemEventPort</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.CARenderServer</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.SBUserNotification</key>
<true/>
<key>com.apple.UIKit.statusbarserver</key>
<true/>
<key>com.apple.iohideventsystem</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.smsserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.UIKit.migserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.alerts</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.appstatechanged</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.backgroundappservices</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processassertionservices</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processinvalidation</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.remotenotifications</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.services</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.watchdogserver</key>
<true/>
</dict>
<key>ProgramArguments</key>
<array>
<string>/System/Library/CoreServices/SpringBoard.app/SpringBoard</string>
</array>
<key>ThrottleInterval</key>
<integer>5</integer>
<key>UserName</key>
<string>mobile</string>
</dict>
</plist>
</pre>

The contents in this file shouldn't change too much based on devices/iOS versions, but may vary slightly.

== Important Notes ==
Whatever you do, stay away from this file. Messing with its contents bring nothing but trouble. If you are feeling adventurous and tell SpringBoard to run as "root" instead of "mobile", your device will turn on, but you will be unable to open any apps. They will open their "loading.png" then immediately crash, probably because the sandbox doesn't want to run as root.

== Parents ==
[[:/|(Root)]]/[[/System|System]]/[[/System/Library|Library]]/[[/System/Library/LaunchDaemons|LaunchDaemons]]

[[Category:Filesystem]]

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

2013-10-16T21:35:45Z

R3pwn:

This is a file located in /System/Library/LaunchDaemons that loads SpringBoard at boot and tells it to re-launch itself when killed (This is how re-springs are possible).
The contents of this file on an iPod Touch 2 running iOS 4.2.1 is as follows:

== File Contents ==
<pre>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>EmbeddedPrivilegeDispensation</key>
<true/>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.apple.SpringBoard</string>
<key>MachServices</key>
<dict>
<key>PurpleSystemEventPort</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.CARenderServer</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.SBUserNotification</key>
<true/>
<key>com.apple.UIKit.statusbarserver</key>
<true/>
<key>com.apple.iohideventsystem</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.smsserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.UIKit.migserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.alerts</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.appstatechanged</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.backgroundappservices</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processassertionservices</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processinvalidation</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.remotenotifications</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.services</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.watchdogserver</key>
<true/>
</dict>
<key>ProgramArguments</key>
<array>
<string>/System/Library/CoreServices/SpringBoard.app/SpringBoard</string>
</array>
<key>ThrottleInterval</key>
<integer>5</integer>
<key>UserName</key>
<string>mobile</string>
</dict>
</plist>
</pre>

The contents in this file shouldn't change too much based on devices/iOS versions, but may vary slightly.

== Important Notes ==
Whatever you do, stay away from this file. Messing with its contents bring nothing but trouble. If you are feeling adventurous and tell SpringBoard to run as "root" instead of "mobile", your device will turn on, but you will be unable to open any apps. They will open their "loading.png" then immediately crash, probably because the sandbox doesn't want to run as root.

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

2013-10-16T21:25:35Z

R3pwn:

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

This is a file located in /System/Library/LaunchDaemons that loads SpringBoard at boot and tells it to re-launch itself when killed (This is how re-springs are possible).
The contents of this file on an iPod Touch 2 running iOS 4.2.1 is as follows:

== File Contents ==
<pre>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>EmbeddedPrivilegeDispensation</key>
<true/>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.apple.SpringBoard</string>
<key>MachServices</key>
<dict>
<key>PurpleSystemEventPort</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.CARenderServer</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.SBUserNotification</key>
<true/>
<key>com.apple.UIKit.statusbarserver</key>
<true/>
<key>com.apple.iohideventsystem</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.smsserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.UIKit.migserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.alerts</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.appstatechanged</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.backgroundappservices</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processassertionservices</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processinvalidation</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.remotenotifications</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.services</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.watchdogserver</key>
<true/>
</dict>
<key>ProgramArguments</key>
<array>
<string>/System/Library/CoreServices/SpringBoard.app/SpringBoard</string>
</array>
<key>ThrottleInterval</key>
<integer>5</integer>
<key>UserName</key>
<string>mobile</string>
</dict>
</plist>
</pre>

The contents in this file shouldn't change too much based on devices/iOS versions, but may vary slightly.

== Important Notes ==
Whatever you do, stay away from this file. Messing with its contents bring nothing but trouble. If you are feeling adventurous and tell SpringBoard to run as "root" instead of "mobile", your device will turn on, but you will be unable to open any apps. They will open their "loading.png" then immediately crash, probably because the sandbox doesn't want to run as root.

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

2013-10-16T21:20:00Z

R3pwn:

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

This is a file located in /System/Library/LaunchDaemons that loads SpringBoard at boot and tells it to re-launch itself when killed (This is how re-springs are possible).
The contents of this file on an iPod Touch 2 running iOS 4.2.1 is as follows (The contents in this file shouldn't change too much based on devices/iOS versions, but may vary slightly):

== File Contents ==
<pre>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>EmbeddedPrivilegeDispensation</key>
<true/>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.apple.SpringBoard</string>
<key>MachServices</key>
<dict>
<key>PurpleSystemEventPort</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.CARenderServer</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.SBUserNotification</key>
<true/>
<key>com.apple.UIKit.statusbarserver</key>
<true/>
<key>com.apple.iohideventsystem</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.smsserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.UIKit.migserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.alerts</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.appstatechanged</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.backgroundappservices</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processassertionservices</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processinvalidation</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.remotenotifications</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.services</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.watchdogserver</key>
<true/>
</dict>
<key>ProgramArguments</key>
<array>
<string>/System/Library/CoreServices/SpringBoard.app/SpringBoard</string>
</array>
<key>ThrottleInterval</key>
<integer>5</integer>
<key>UserName</key>
<string>mobile</string>
</dict>
</plist>
</pre>

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

2013-10-16T21:15:00Z

R3pwn:

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

This is a file located in /System/Library/LaunchDaemons that loads SpringBoard at boot and tells it to re-launch itself when killed (This is how re-springs are possible).
The contents of this file on an iPod Touch 2 running iOS 4.2.1 is as follows (The contents in this file shouldn't change too much based on devices/iOS versions, but may vary slightly):

== File Contents ==
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>EmbeddedPrivilegeDispensation</key>
<true/>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.apple.SpringBoard</string>
<key>MachServices</key>
<dict>
<key>PurpleSystemEventPort</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.CARenderServer</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.SBUserNotification</key>
<true/>
<key>com.apple.UIKit.statusbarserver</key>
<true/>
<key>com.apple.iohideventsystem</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.smsserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.UIKit.migserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.alerts</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.appstatechanged</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.backgroundappservices</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processassertionservices</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processinvalidation</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.remotenotifications</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.services</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.watchdogserver</key>
<true/>
</dict>
<key>ProgramArguments</key>
<array>
<string>/System/Library/CoreServices/SpringBoard.app/SpringBoard</string>
</array>
<key>ThrottleInterval</key>
<integer>5</integer>
<key>UserName</key>
<string>mobile</string>
</dict>
</plist>

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

2013-10-16T21:08:10Z

R3pwn: Explanation of com.apple.SpringBoard.plist

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

This is a file located in /System/Library/LaunchDaemons that loads SpringBoard at boot and tells it to re-launch itself when killed (This is how re-springs are possible).
The contents of this file on an iPod Touch 2 running iOS 4.2.1 is as follows (The contents in this file shouldn't change too much based on devices/iOS versions, but may vary slightly):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>EmbeddedPrivilegeDispensation</key>
<true/>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.apple.SpringBoard</string>
<key>MachServices</key>
<dict>
<key>PurpleSystemEventPort</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.CARenderServer</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.SBUserNotification</key>
<true/>
<key>com.apple.UIKit.statusbarserver</key>
<true/>
<key>com.apple.iohideventsystem</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.smsserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.UIKit.migserver</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.alerts</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.appstatechanged</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.backgroundappservices</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processassertionservices</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.processinvalidation</key>
<dict>
<key>HideUntilCheckIn</key>
<true/>
</dict>
<key>com.apple.springboard.remotenotifications</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.services</key>
<dict>
<key>ResetAtClose</key>
<true/>
</dict>
<key>com.apple.springboard.watchdogserver</key>
<true/>
</dict>
<key>ProgramArguments</key>
<array>
<string>/System/Library/CoreServices/SpringBoard.app/SpringBoard</string>
</array>
<key>ThrottleInterval</key>
<integer>5</integer>
<key>UserName</key>
<string>mobile</string>
</dict>
</plist>

IBoot (Bootloader)

2013-10-16T20:52:09Z

R3pwn: /* OpeniBoot */

{{lowercase}}
'''iBoot''' is Apple's stage 2 bootloader for all of the [[iDevice|devices]]. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== [[Bootrom]] ==
The bootrom also goes by the name "iBoot." The list of bootroms can be found on [[Bootrom|their own page]].

== Extract and Disassemble ==
To extract the bootloader and disassemble using IDA, follow the following steps:
#obtain the bootloader from the iPSW. This file is in the <code>Firmware/all_flash</code> subdir, e.g. <code>Firmware/all_flash/all_flash.n81ap.production/iBoot.n81ap.RELEASE.img3</code>, where the "n81ap", "k90", etc.. are for the i-Device type
#run xpwntool with the proper key (from elsewhere in this Wiki)
#Make sure the decryption was successful - if it is, you should see:
"iBoot for ...., Copyright 2011, Apple Inc."
if you cat (i.e. type) the file.
<ol><li value="4">remove the img3 header - the good stuff starts at offset 0x40 (i.e. 64) - using dd (skip=1 bs=64) or some other tool</li>
<li>Load in IDA. Set processor to ARM. Rebase program (Edit→Segments→Rebase Program) to 0x5FF00000 (for iBoot in iOS 5). You should see something like:</li></ol>

<pre>
ROM:5FF00000 loc_5FF00000 ; CODE XREF: ROM:5FF00078�j
ROM:5FF00000 B loc_5FF00040 ; Used for Reset - This is where we start
ROM:5FF00004 ; ---------------------------------------------------------------------------
ROM:5FF00004 LDR PC, =sub_5FF16FB4 ; Used for Undef
ROM:5FF00008 ; ---------------------------------------------------------------------------
ROM:5FF00008 LDR PC, =sub_5FF16FEC ; Used for SWI
ROM:5FF0000C ; ---------------------------------------------------------------------------
ROM:5FF0000C LDR PC, =sub_5FF17024 ; Used for Prefabt
ROM:5FF00010 ; ---------------------------------------------------------------------------
ROM:5FF00010 LDR PC, =sub_5FF17060 ; Used for DataAbt
ROM:5FF00014 ; ---------------------------------------------------------------------------
ROM:5FF00014 LDR PC, =loc_5FF17098 ; Used for AddrExc
ROM:5FF00018 ; ---------------------------------------------------------------------------
ROM:5FF00018 LDR PC, =loc_5FF16F24 ; Used for IRQ
ROM:5FF0001C ; ---------------------------------------------------------------------------
ROM:5FF0001C LDR PC, =sub_5FF16F6C ; Probably FIQ, need to verify this
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00020 SVCPL 0xF00040
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00024 off_5FF00024 DCD sub_5FF16FB4 ; DATA XREF: ROM:5FF00004�r
ROM:5FF00028 off_5FF00028 DCD sub_5FF16FEC ; DATA XREF: ROM:5FF00008�r
ROM:5FF0002C off_5FF0002C DCD sub_5FF17024 ; DATA XREF: ROM:5FF0000C�r
ROM:5FF00030 off_5FF00030 DCD sub_5FF17060 ; DATA XREF: ROM:5FF00010�r
ROM:5FF00034 off_5FF00034 DCD loc_5FF17098 ; DATA XREF: ROM:5FF00014�r
ROM:5FF00038 off_5FF00038 DCD loc_5FF16F24 ; DATA XREF: ROM:5FF00018�r
ROM:5FF0003C off_5FF0003C DCD sub_5FF16F6C ; DATA XREF: ROM:5FF0001C�r
ROM:5FF00040 ; ---------------------------------------------------------------------------
ROM:5FF00040
ROM:5FF00040 loc_5FF00040 ; CODE XREF: ROM:loc_5FF00000�j
ROM:5FF00040 ADR R0, loc_5FF00000 <-- The address we rebased to
ROM:5FF00044 LDR R1, =loc_5FF00000
ROM:5FF00048 CMP R0, R1
ROM:5FF0004C CMP R0, R1
ROM:5FF00050 BEQ loc_5FF0007C
...
...
ROM:5FF000E8 loc_5FF000E8 ; CODE XREF: ROM:5FF000F0�j
ROM:5FF000E8 CMP R0, R1
ROM:5FF000EC STRLT R2, [R0],#4
ROM:5FF000F0 BLT loc_5FF000E8
ROM:5FF000F4 LDR R0, =(_ibootStart+1)
ROM:5FF000F8 MOV LR, PC
ROM:5FF000FC BX R0 ; _ibootStart
ROM:5FF00100
ROM:5FF00100 loc_5FF00100 ; CODE XREF: ROM:loc_5FF00100�j
ROM:5FF00100 B loc_5FF00100
</pre>

Where iBootStart (not the official Apple Symbol, of course) can be seen at:

<pre>
ROM:5FF00BA4 _ibootStart ; CODE XREF: ROM:5FF000FC�p
ROM:5FF00BA4 ; DATA XREF: ROM:5FF000F4�o ...
ROM:5FF00BA4 PUSH {R7,LR}
ROM:5FF00BA6 MOV R7, SP
ROM:5FF00BA8 LDR R0, =aIbootStart ; "\niBoot start\n"
ROM:5FF00BAA BL loc_5FF233C4
ROM:5FF00BAE MOVS R0, #0
ROM:5FF00BB0 BL loc_5FF16E54
ROM:5FF00BB4 BL loc_5FF1570C
ROM:5FF00BB8 BL loc_5FF143A8
ROM:5FF00BBC BL unk_5FF15264
ROM:5FF00BC0 LDR R0, =aMain ; "main"
..
</pre>

== Flow of iBoot (1219 - 5.0.x) ==
iBoot is quite a complicated binary, which spawns several ARM tasks to enable the boot process:

- iBootStart (disassembly started above) - starts main (5FF00BCA) - which calls the main function at 5FF00C14
- main: Does the good stuff (loading the kernel, etc)
starts the poweroff task (5FF00EF2) - calls (sub_5FF00FD0+1)
In recovery mode (failed boot):
starts command (5FF00F0A) - calls 5FF15928
starts idleoff (5FF99F2E) - calls 5FF01060

== Revisions ==
[[iBoot-99]] 1.0b (Build 1A420) [Unreleased]
[[iBoot-159]] 1.0 (Build 1A543a)
1.0.1 (Build 1C25)
1.0.2 (Build 1C28)
[[iBoot-204]] 1.1 (Build 3A100)
1.1 (Build 3A101)
1.1.1 (Build 3A109a)
[[iBoot-204.0.2]] 1.1.1 (Build 3A110a)
[[iBoot-204.2.9]] 1.1.2 (Build 3B48b)
[[iBoot-204.3.14]] 1.1.3 (Build 4A93)
1.1.4 (Build 4A102)
[[iBoot-204.3.16]] 1.1.5 (Build 4B1)
? 1.2b (Build 5A147p)
? 2.0b2 (Build 5A225c)
? 2.0b3 (Build 5A240d)
? 2.0b4 (Build 5A258f)
? 2.0b5 (Build 5A274d)
? 2.0b6P (Build 5A292g)
? 2.0b6F (Build 5A308)
? 2.0b7 (Build 5A331)
? 2.0b8[[Golden Master|GM]] (Build 5A345)
[[iBoot-320.20]] 2.0 (Build 5A347)
2.0.1 (Build 5B108)
2.0.2 (Build 5C1)
? 2.1b (Build 5F90)
[[iBoot-385.22]] 2.1 (Build 5F137)
2.1.1 (Build 5F138)
? 2.2b (Build 5G29)
[[iBoot-385.49]] 2.2 (Build 5G77)
2.2 (Build 5G77a)
2.2.1 (Build 5H11)
2.2.1 (Build 5H11a)
? 3.0b (Build 7A238j)
[[iBoot-594.2~1]] 3.0b2 (Build 7A259g)
[[iBoot-596.6~3]] 3.0b3 (Build 7A280f)
[[iBoot-596.16~2]] 3.0b4 (Build 7A300g)
[[iBoot-596.20~1]] 3.0b5 (Build 7A312g)
[[iBoot-596.24~1]] 3.0 (Build 7A341)
3.0.1 (Build 7A400)
[[iBoot-636.26~2]] 3.1b (Build 7C97d)
iBoot-636.??~? 3.1b2 (Build 7C106c)
[[iBoot-636.47~1]] 3.1b3 (Build 7C116a)
[[iBoot-636.65~2]] 3.1 (Build 7C144)
[[iBoot-636.66~1]] 3.1.1 (Build 7C145)
3.1.1 (Build 7C146)
[[iBoot-636.66~5]] 3.1.2 (Build 7D11)
[[iBoot-636.66.33~4]] 3.1.3 (Build 7E18)
[[iBoot-817.28~18]] 3.2 (Build 7B367)
[[iBoot-817.29~2]] 3.2.1 (Build 7B405)
3.2.2 (Build 7B500)
[[iBoot-872~12]] 4.0b (Build 8A230m)
[[iBoot-889.3~2]] 4.0b2 (Build 8A248c)
[[iBoot-889.12~2]] 4.0b3 (Build 8A260b)
[[iBoot-889.19~1]] 4.0b4 (Build 8A274b)
[[iBoot-889.24~4]] 4.0[[Golden Master|GM]] (Build 8A293)
4.0 (Build 8A293)
4.0.1 (Build 8A306)
4.0.2 (Build 8A400)
[[iBoot-931.18.1~1]] 4.1b (Build 8B5080c)
[[iBoot-931.18.15~2]] 4.1b2 (Build 8B5091b)
[[iBoot-931.18.27~1]] 4.1 (Build 8B117)
4.1 (Build 8B118)
[[iBoot-931.67~2]] 4.2b (Build 8C5091e)
[[iBoot-931.71.80~1]] 4.2b2 (Build 8C5101c)
[[iBoot-931.71.13~3]] 4.2b3 (Build 8C5115c)
[[iBoot-931.71.16~9]] 4.2[[Golden Master|GM]] (Build 8C134)
4.2[[Golden Master|GM]] (Build 8C134b)
4.2.1[[Golden Master|GM]] (Build 8C148)
4.2.1 (Build 8C148)
4.2.1 (Build 8C148a)
[[iBoot-931.72.14~6]] 4.2.5 (Build 8E128)
4.2.6 (Build 8E200)
4.2.7 (Build 8E303)
4.2.8 (Build 8E401)
[[iBoot-931.72.14~10]] 4.2.9 (Build 8E501)
4.2.10 (Build 8E600)
[[iBoot-1072.33~1]] 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.3b3 (Build 8F5166b)
[[iBoot-1072.58~4]] 4.3[[Golden Master|GM]] (Build 8F190)
4.3 (Build 8F190)
[[iBoot-1072.59~2]] 4.3 (Build 8F191)
4.3.1 (Build 8G4)
[[iBoot-1072.61~2]] 4.3.2 (Build 8H7)
4.3.2 (Build 8H8)
4.3.3 (Build 8J2)
4.3.3 (Build 8J3)
[[iBoot-1072.61~6]] 4.3.4 (Build 8K2)
4.3.5 (Build 8L1)
[[iBoot-1219.35.80~1]] 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 5.0b3 (Build 9A5259f)
[[iBoot-1219.42.8~1]] 5.0b4 (Build 9A5274d)
[[iBoot-1219.43.9~3]] 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~15]] 5.0[[Golden Master|GM]] (Build 9A332) [Unreleased]
5.0[[Golden Master|GM]] (Build 9A334)
5.0 (Build 9A334)
[[iBoot-1219.43.32~27]] 5.0.1b1 (Build 9A402)
[[iBoot-1219.43.32~29]] 5.0.1b2 (Build 9A404)
5.0.1 (Build 9A405)
5.0.1 (Build 9A406)
[[iBoot-1219.61.19~6]] 5.1b (Build 9B5117b)
[[iBoot-1219.62.1~2]] 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15]] 5.1 (Build 9B176)
[[iBoot-1219.62.15~2]] 5.1 (Build 9B179b)
5.1.1 (Build 9B206)
[[iBoot-1537.1.60~15]] 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.18~2]] 6.0[[Golden Master|GM]] (Build 10A403)
6.0 (Build 10A403)
[[iBoot-1537.4.19~1]] 6.0 (Build 10A405)
6.0 (Build 10A406)
[[iBoot-1537.4.20~1]] 6.0 (Build 10A407)
[[iBoot-1537.4.21~3]] 6.0.1 (Build 10A523)
6.0.1 (Build 10A525)
[[iBoot-1537.4.21~2]] 6.0.1 (Build 10A8426)
6.0.2 (Build 10A8500)
[[iBoot-1537.4.21~3]] 6.0.2 (Build 10A550)
6.0.2 (Build 10A551)
[[iBoot-1537.9.40~3]] 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 6.1b2 (Build 10B5105c)
6.1b3 (Build 10B5117b)
6.1b4 (Build 10B5126b)
[[iBoot-1537.9.55~4]] 6.1b5 (Build 10B141)
6.1b5 (Build 10B142)
6.1b5 (Build 10B143)
6.1b5 (Build 10B144)
6.1 (Build 10B141)
6.1 (Build 10B142)
6.1 (Build 10B143)
6.1 (Build 10B144)
6.1.1b (Build 10B311)
6.1.1 (Build 10B145)
6.1.2 (Build 10B146)
6.1.2 (Build 10B147)
[[iBoot-1537.9.55~11]] 6.1.3b2 (Build 10B318)
6.1.3b2 (Build 10B318a)
6.1.3 (Build 10B329)
6.1.4 (Build 10B350)
[[iBoot-1940.1.8~44]] 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.46.1.1~1]] 7.0b3 (Build 11A4414e)
[[iBoot-1940.1.66~9]] 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 7.0b5 (Build 11A4449a)
7.0b6 (Build 11A4449d)
[[iBoot-1940.1.75~20]] 7.0[[Golden Master|GM]] (Build 11A465)
7.0 (Build 11A465)
[[iBoot-1940.1.75~93]] 7.0.1 (Build 11A470a)
7.0.2 (Build 11A501)

=== [[Apple TV]] ===
[[iBoot-931.44.21~1]] 4.0 4.1 (Build 8M89)
[[iBoot-931.71.16~9]] 4.1 4.2 (Build 8C150)
4.1.1 4.2.1 (Build 8C154)
[[iBoot-1072.33~1]] 4.2b 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.2b2 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.2b3 4.3b3 (Build 8F5166b)
[[iBoot-1072.59~2]] 4.2 4.3 (Build 8F191m)
4.2.1 4.3 (Build 8F202)
4.2.2 4.3 (Build 8F305)
4.3 4.3 (Build 8F455)
[[iBoot-1219.35.80~1]] 4.4b 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 4.4b2 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 4.4b3 5.0b3 (Build 9A5259f)
[[iBoot-1219.43.9~3]] 4.4b5 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 4.4b6 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 4.4b7 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~21]] 4.4 5.0 (Build 9A334v)
[[iBoot-1219.43.32~22]] 4.4.1 5.0 (Build 9A335a)
4.4.2 5.0 (Build 9A336a)
[[iBoot-1219.43.32~29]] 4.4.3 5.0.1 (Build 9A405l)
4.4.4 5.0.1 (Build 9A406a)
[[iBoot-1219.62.1~2]] 5.0b2 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.0b3 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15~2]] 5.0 5.1 (Build 9B179b)
[[iBoot-1537.1.60~15]] 5.1b 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 5.1b2 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 5.1b3 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 5.1b4 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.19~1]] 5.1 6.0 (Build 10A406e)
[[iBoot-1537.4.21~3]] 5.1.1 6.0.1 (Build 10A831)
[[iBoot-1537.9.40~3]] 5.2b 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 5.2b2 6.1b2 (Build 10B5105c)
5.2b3 6.1b3 (Build 10B5117d)
5.2b4 6.1b4 (Build 10B5126d)
[[iBoot-1537.9.55~4]] 5.2 6.1 (Build 10B144b)
[[iBoot-1537.9.55~11]] 5.2.1 6.1.3 (Build 10B329a)
[[iBoot-1537.9.55~11]] 5.3 6.1.4 (Build 10B809)
[[iBoot-1940.1.8~44]] 5.4b 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 5.4b2 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.66~9]] 6.0b3 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 6.0b4 7.0b5 (Build 11A4449a)
[[iBoot-1940.1.75~93]] 6.0 7.0.1 (Build 11A470e)
6.0 7.0.2 (Build 11A502)

=== [[Haywire]] ===
[[iBoot-1537.9.55~3]] 1.0.0 (Build 10B7129)

== Commands used as an exploit vector ==
* '''diags''': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* '''arm7_go''': For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

== OpeniBoot ==
There is an open source version of iBoot designed so that custom kernels can be run on the iPhone/iPod/iPad. You can check out the source [http://github.com/iDroid-Project/OpeniBoot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.
OpeniBoot currently supports all S5l8900, S5l8720, S5l8920 and S5l8930 devices. More info can be found about OpeniBoot and Linux on these devices on the iDroid-Project [http://idroidproject.org website].

== Remappings ==
// n88 (3GS)
0x4FF00000 => 0x0
0x40000000 => 0xC0000000

== See also ==
* [[iBoot (Enums)]]
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

[[Category:iBoot]]

IBoot (Bootloader)

2013-10-16T20:43:19Z

R3pwn: /* OpeniBoot */

{{lowercase}}
'''iBoot''' is Apple's stage 2 bootloader for all of the [[iDevice|devices]]. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== [[Bootrom]] ==
The bootrom also goes by the name "iBoot." The list of bootroms can be found on [[Bootrom|their own page]].

== Extract and Disassemble ==
To extract the bootloader and disassemble using IDA, follow the following steps:
#obtain the bootloader from the iPSW. This file is in the <code>Firmware/all_flash</code> subdir, e.g. <code>Firmware/all_flash/all_flash.n81ap.production/iBoot.n81ap.RELEASE.img3</code>, where the "n81ap", "k90", etc.. are for the i-Device type
#run xpwntool with the proper key (from elsewhere in this Wiki)
#Make sure the decryption was successful - if it is, you should see:
"iBoot for ...., Copyright 2011, Apple Inc."
if you cat (i.e. type) the file.
<ol><li value="4">remove the img3 header - the good stuff starts at offset 0x40 (i.e. 64) - using dd (skip=1 bs=64) or some other tool</li>
<li>Load in IDA. Set processor to ARM. Rebase program (Edit→Segments→Rebase Program) to 0x5FF00000 (for iBoot in iOS 5). You should see something like:</li></ol>

<pre>
ROM:5FF00000 loc_5FF00000 ; CODE XREF: ROM:5FF00078�j
ROM:5FF00000 B loc_5FF00040 ; Used for Reset - This is where we start
ROM:5FF00004 ; ---------------------------------------------------------------------------
ROM:5FF00004 LDR PC, =sub_5FF16FB4 ; Used for Undef
ROM:5FF00008 ; ---------------------------------------------------------------------------
ROM:5FF00008 LDR PC, =sub_5FF16FEC ; Used for SWI
ROM:5FF0000C ; ---------------------------------------------------------------------------
ROM:5FF0000C LDR PC, =sub_5FF17024 ; Used for Prefabt
ROM:5FF00010 ; ---------------------------------------------------------------------------
ROM:5FF00010 LDR PC, =sub_5FF17060 ; Used for DataAbt
ROM:5FF00014 ; ---------------------------------------------------------------------------
ROM:5FF00014 LDR PC, =loc_5FF17098 ; Used for AddrExc
ROM:5FF00018 ; ---------------------------------------------------------------------------
ROM:5FF00018 LDR PC, =loc_5FF16F24 ; Used for IRQ
ROM:5FF0001C ; ---------------------------------------------------------------------------
ROM:5FF0001C LDR PC, =sub_5FF16F6C ; Probably FIQ, need to verify this
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00020 SVCPL 0xF00040
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00024 off_5FF00024 DCD sub_5FF16FB4 ; DATA XREF: ROM:5FF00004�r
ROM:5FF00028 off_5FF00028 DCD sub_5FF16FEC ; DATA XREF: ROM:5FF00008�r
ROM:5FF0002C off_5FF0002C DCD sub_5FF17024 ; DATA XREF: ROM:5FF0000C�r
ROM:5FF00030 off_5FF00030 DCD sub_5FF17060 ; DATA XREF: ROM:5FF00010�r
ROM:5FF00034 off_5FF00034 DCD loc_5FF17098 ; DATA XREF: ROM:5FF00014�r
ROM:5FF00038 off_5FF00038 DCD loc_5FF16F24 ; DATA XREF: ROM:5FF00018�r
ROM:5FF0003C off_5FF0003C DCD sub_5FF16F6C ; DATA XREF: ROM:5FF0001C�r
ROM:5FF00040 ; ---------------------------------------------------------------------------
ROM:5FF00040
ROM:5FF00040 loc_5FF00040 ; CODE XREF: ROM:loc_5FF00000�j
ROM:5FF00040 ADR R0, loc_5FF00000 <-- The address we rebased to
ROM:5FF00044 LDR R1, =loc_5FF00000
ROM:5FF00048 CMP R0, R1
ROM:5FF0004C CMP R0, R1
ROM:5FF00050 BEQ loc_5FF0007C
...
...
ROM:5FF000E8 loc_5FF000E8 ; CODE XREF: ROM:5FF000F0�j
ROM:5FF000E8 CMP R0, R1
ROM:5FF000EC STRLT R2, [R0],#4
ROM:5FF000F0 BLT loc_5FF000E8
ROM:5FF000F4 LDR R0, =(_ibootStart+1)
ROM:5FF000F8 MOV LR, PC
ROM:5FF000FC BX R0 ; _ibootStart
ROM:5FF00100
ROM:5FF00100 loc_5FF00100 ; CODE XREF: ROM:loc_5FF00100�j
ROM:5FF00100 B loc_5FF00100
</pre>

Where iBootStart (not the official Apple Symbol, of course) can be seen at:

<pre>
ROM:5FF00BA4 _ibootStart ; CODE XREF: ROM:5FF000FC�p
ROM:5FF00BA4 ; DATA XREF: ROM:5FF000F4�o ...
ROM:5FF00BA4 PUSH {R7,LR}
ROM:5FF00BA6 MOV R7, SP
ROM:5FF00BA8 LDR R0, =aIbootStart ; "\niBoot start\n"
ROM:5FF00BAA BL loc_5FF233C4
ROM:5FF00BAE MOVS R0, #0
ROM:5FF00BB0 BL loc_5FF16E54
ROM:5FF00BB4 BL loc_5FF1570C
ROM:5FF00BB8 BL loc_5FF143A8
ROM:5FF00BBC BL unk_5FF15264
ROM:5FF00BC0 LDR R0, =aMain ; "main"
..
</pre>

== Flow of iBoot (1219 - 5.0.x) ==
iBoot is quite a complicated binary, which spawns several ARM tasks to enable the boot process:

- iBootStart (disassembly started above) - starts main (5FF00BCA) - which calls the main function at 5FF00C14
- main: Does the good stuff (loading the kernel, etc)
starts the poweroff task (5FF00EF2) - calls (sub_5FF00FD0+1)
In recovery mode (failed boot):
starts command (5FF00F0A) - calls 5FF15928
starts idleoff (5FF99F2E) - calls 5FF01060

== Revisions ==
[[iBoot-99]] 1.0b (Build 1A420) [Unreleased]
[[iBoot-159]] 1.0 (Build 1A543a)
1.0.1 (Build 1C25)
1.0.2 (Build 1C28)
[[iBoot-204]] 1.1 (Build 3A100)
1.1 (Build 3A101)
1.1.1 (Build 3A109a)
[[iBoot-204.0.2]] 1.1.1 (Build 3A110a)
[[iBoot-204.2.9]] 1.1.2 (Build 3B48b)
[[iBoot-204.3.14]] 1.1.3 (Build 4A93)
1.1.4 (Build 4A102)
[[iBoot-204.3.16]] 1.1.5 (Build 4B1)
? 1.2b (Build 5A147p)
? 2.0b2 (Build 5A225c)
? 2.0b3 (Build 5A240d)
? 2.0b4 (Build 5A258f)
? 2.0b5 (Build 5A274d)
? 2.0b6P (Build 5A292g)
? 2.0b6F (Build 5A308)
? 2.0b7 (Build 5A331)
? 2.0b8[[Golden Master|GM]] (Build 5A345)
[[iBoot-320.20]] 2.0 (Build 5A347)
2.0.1 (Build 5B108)
2.0.2 (Build 5C1)
? 2.1b (Build 5F90)
[[iBoot-385.22]] 2.1 (Build 5F137)
2.1.1 (Build 5F138)
? 2.2b (Build 5G29)
[[iBoot-385.49]] 2.2 (Build 5G77)
2.2 (Build 5G77a)
2.2.1 (Build 5H11)
2.2.1 (Build 5H11a)
? 3.0b (Build 7A238j)
[[iBoot-594.2~1]] 3.0b2 (Build 7A259g)
[[iBoot-596.6~3]] 3.0b3 (Build 7A280f)
[[iBoot-596.16~2]] 3.0b4 (Build 7A300g)
[[iBoot-596.20~1]] 3.0b5 (Build 7A312g)
[[iBoot-596.24~1]] 3.0 (Build 7A341)
3.0.1 (Build 7A400)
[[iBoot-636.26~2]] 3.1b (Build 7C97d)
iBoot-636.??~? 3.1b2 (Build 7C106c)
[[iBoot-636.47~1]] 3.1b3 (Build 7C116a)
[[iBoot-636.65~2]] 3.1 (Build 7C144)
[[iBoot-636.66~1]] 3.1.1 (Build 7C145)
3.1.1 (Build 7C146)
[[iBoot-636.66~5]] 3.1.2 (Build 7D11)
[[iBoot-636.66.33~4]] 3.1.3 (Build 7E18)
[[iBoot-817.28~18]] 3.2 (Build 7B367)
[[iBoot-817.29~2]] 3.2.1 (Build 7B405)
3.2.2 (Build 7B500)
[[iBoot-872~12]] 4.0b (Build 8A230m)
[[iBoot-889.3~2]] 4.0b2 (Build 8A248c)
[[iBoot-889.12~2]] 4.0b3 (Build 8A260b)
[[iBoot-889.19~1]] 4.0b4 (Build 8A274b)
[[iBoot-889.24~4]] 4.0[[Golden Master|GM]] (Build 8A293)
4.0 (Build 8A293)
4.0.1 (Build 8A306)
4.0.2 (Build 8A400)
[[iBoot-931.18.1~1]] 4.1b (Build 8B5080c)
[[iBoot-931.18.15~2]] 4.1b2 (Build 8B5091b)
[[iBoot-931.18.27~1]] 4.1 (Build 8B117)
4.1 (Build 8B118)
[[iBoot-931.67~2]] 4.2b (Build 8C5091e)
[[iBoot-931.71.80~1]] 4.2b2 (Build 8C5101c)
[[iBoot-931.71.13~3]] 4.2b3 (Build 8C5115c)
[[iBoot-931.71.16~9]] 4.2[[Golden Master|GM]] (Build 8C134)
4.2[[Golden Master|GM]] (Build 8C134b)
4.2.1[[Golden Master|GM]] (Build 8C148)
4.2.1 (Build 8C148)
4.2.1 (Build 8C148a)
[[iBoot-931.72.14~6]] 4.2.5 (Build 8E128)
4.2.6 (Build 8E200)
4.2.7 (Build 8E303)
4.2.8 (Build 8E401)
[[iBoot-931.72.14~10]] 4.2.9 (Build 8E501)
4.2.10 (Build 8E600)
[[iBoot-1072.33~1]] 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.3b3 (Build 8F5166b)
[[iBoot-1072.58~4]] 4.3[[Golden Master|GM]] (Build 8F190)
4.3 (Build 8F190)
[[iBoot-1072.59~2]] 4.3 (Build 8F191)
4.3.1 (Build 8G4)
[[iBoot-1072.61~2]] 4.3.2 (Build 8H7)
4.3.2 (Build 8H8)
4.3.3 (Build 8J2)
4.3.3 (Build 8J3)
[[iBoot-1072.61~6]] 4.3.4 (Build 8K2)
4.3.5 (Build 8L1)
[[iBoot-1219.35.80~1]] 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 5.0b3 (Build 9A5259f)
[[iBoot-1219.42.8~1]] 5.0b4 (Build 9A5274d)
[[iBoot-1219.43.9~3]] 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~15]] 5.0[[Golden Master|GM]] (Build 9A332) [Unreleased]
5.0[[Golden Master|GM]] (Build 9A334)
5.0 (Build 9A334)
[[iBoot-1219.43.32~27]] 5.0.1b1 (Build 9A402)
[[iBoot-1219.43.32~29]] 5.0.1b2 (Build 9A404)
5.0.1 (Build 9A405)
5.0.1 (Build 9A406)
[[iBoot-1219.61.19~6]] 5.1b (Build 9B5117b)
[[iBoot-1219.62.1~2]] 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15]] 5.1 (Build 9B176)
[[iBoot-1219.62.15~2]] 5.1 (Build 9B179b)
5.1.1 (Build 9B206)
[[iBoot-1537.1.60~15]] 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.18~2]] 6.0[[Golden Master|GM]] (Build 10A403)
6.0 (Build 10A403)
[[iBoot-1537.4.19~1]] 6.0 (Build 10A405)
6.0 (Build 10A406)
[[iBoot-1537.4.20~1]] 6.0 (Build 10A407)
[[iBoot-1537.4.21~3]] 6.0.1 (Build 10A523)
6.0.1 (Build 10A525)
[[iBoot-1537.4.21~2]] 6.0.1 (Build 10A8426)
6.0.2 (Build 10A8500)
[[iBoot-1537.4.21~3]] 6.0.2 (Build 10A550)
6.0.2 (Build 10A551)
[[iBoot-1537.9.40~3]] 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 6.1b2 (Build 10B5105c)
6.1b3 (Build 10B5117b)
6.1b4 (Build 10B5126b)
[[iBoot-1537.9.55~4]] 6.1b5 (Build 10B141)
6.1b5 (Build 10B142)
6.1b5 (Build 10B143)
6.1b5 (Build 10B144)
6.1 (Build 10B141)
6.1 (Build 10B142)
6.1 (Build 10B143)
6.1 (Build 10B144)
6.1.1b (Build 10B311)
6.1.1 (Build 10B145)
6.1.2 (Build 10B146)
6.1.2 (Build 10B147)
[[iBoot-1537.9.55~11]] 6.1.3b2 (Build 10B318)
6.1.3b2 (Build 10B318a)
6.1.3 (Build 10B329)
6.1.4 (Build 10B350)
[[iBoot-1940.1.8~44]] 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.46.1.1~1]] 7.0b3 (Build 11A4414e)
[[iBoot-1940.1.66~9]] 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 7.0b5 (Build 11A4449a)
7.0b6 (Build 11A4449d)
[[iBoot-1940.1.75~20]] 7.0[[Golden Master|GM]] (Build 11A465)
7.0 (Build 11A465)
[[iBoot-1940.1.75~93]] 7.0.1 (Build 11A470a)
7.0.2 (Build 11A501)

=== [[Apple TV]] ===
[[iBoot-931.44.21~1]] 4.0 4.1 (Build 8M89)
[[iBoot-931.71.16~9]] 4.1 4.2 (Build 8C150)
4.1.1 4.2.1 (Build 8C154)
[[iBoot-1072.33~1]] 4.2b 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.2b2 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.2b3 4.3b3 (Build 8F5166b)
[[iBoot-1072.59~2]] 4.2 4.3 (Build 8F191m)
4.2.1 4.3 (Build 8F202)
4.2.2 4.3 (Build 8F305)
4.3 4.3 (Build 8F455)
[[iBoot-1219.35.80~1]] 4.4b 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 4.4b2 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 4.4b3 5.0b3 (Build 9A5259f)
[[iBoot-1219.43.9~3]] 4.4b5 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 4.4b6 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 4.4b7 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~21]] 4.4 5.0 (Build 9A334v)
[[iBoot-1219.43.32~22]] 4.4.1 5.0 (Build 9A335a)
4.4.2 5.0 (Build 9A336a)
[[iBoot-1219.43.32~29]] 4.4.3 5.0.1 (Build 9A405l)
4.4.4 5.0.1 (Build 9A406a)
[[iBoot-1219.62.1~2]] 5.0b2 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.0b3 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15~2]] 5.0 5.1 (Build 9B179b)
[[iBoot-1537.1.60~15]] 5.1b 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 5.1b2 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 5.1b3 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 5.1b4 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.19~1]] 5.1 6.0 (Build 10A406e)
[[iBoot-1537.4.21~3]] 5.1.1 6.0.1 (Build 10A831)
[[iBoot-1537.9.40~3]] 5.2b 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 5.2b2 6.1b2 (Build 10B5105c)
5.2b3 6.1b3 (Build 10B5117d)
5.2b4 6.1b4 (Build 10B5126d)
[[iBoot-1537.9.55~4]] 5.2 6.1 (Build 10B144b)
[[iBoot-1537.9.55~11]] 5.2.1 6.1.3 (Build 10B329a)
[[iBoot-1537.9.55~11]] 5.3 6.1.4 (Build 10B809)
[[iBoot-1940.1.8~44]] 5.4b 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 5.4b2 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.66~9]] 6.0b3 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 6.0b4 7.0b5 (Build 11A4449a)
[[iBoot-1940.1.75~93]] 6.0 7.0.1 (Build 11A470e)
6.0 7.0.2 (Build 11A502)

=== [[Haywire]] ===
[[iBoot-1537.9.55~3]] 1.0.0 (Build 10B7129)

== Commands used as an exploit vector ==
* '''diags''': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* '''arm7_go''': For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

== OpeniBoot ==
There is an open source version of iBoot designed so that custom kernels can be run on the iPhone/iPod/iPad. You can check out the source [http://github.com/iDroid-Project/OpeniBoot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.
OpeniBoot currently supports all S5l8900, S5l8720, S5l8920 and S5l8930 devices (There are also very early ports for all A4 devices). More info can be found about OpeniBoot and Linux on these devices on the iDroid-Project [http://idroidproject.org website].

== Remappings ==
// n88 (3GS)
0x4FF00000 => 0x0
0x40000000 => 0xC0000000

== See also ==
* [[iBoot (Enums)]]
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

[[Category:iBoot]]