The iPhone Wiki - User contributions [en]

Baseband Device

2011-06-09T11:53:13Z

Redart:

This is the device in the iPhone that manages all the functions which require an antenna. The baseband processor has its own RAM and firmware in NOR flash, separate from the [[ARM]] core resources. The baseband is a resource to the OS. The Wi-Fi and Bluetooth are managed by the main CPU, although the baseband stores their MAC addresses in its NVRAM.

The [[M68ap|iPhone]]'s baseband processor is the [[S-Gold 2]]. The [[N82ap|iPhone 3G]], the [[N88ap|iPhone 3GS]] and the [[K48ap|iPad]] make use of the [[X-Gold 608]] chip for this purpose. The [[N90ap|iPhone 4 (GSM)]] and [[K94ap|iPad 2]] use the [[XMM 6180]], the [[N92ap|iPhone 4 (CDMA)]] uses the [[MDM6600]].

You can check some [[Baseband Commands]].

==[[Seczone]]==
This is the area in the baseband where the lock state is stored.

===Layout===
0x400--NCK token
0xA00--IMEI signature
0xB00--IMEI
0xC00--Locks table

===Encryption===
Many of the sections are encrypted using [[Baseband TEA Keys|TEA]] based off the [[CHIPID]] and [[NORID]]. See [[NCK Brute Force]] for more info.

==Exploits==
* [[SIM hacks]]

===[[S-Gold 2]]===
* [[Fakeblank]]
* [[IPSF]]
* [[Minus 0x400]]
* [[Minus 0x20000 with Back Extend Erase]]

===[[X-Gold 608]]===
* [[JerrySIM]]
* [[AT+stkprof]]
* [[AT+XLOG Vulnerability]]
* [[AT+XEMN Heap Overflow]]
* [[AT+XAPP Vulnerability]]

===[[XMM 6180]]===
* [[AT+XAPP Vulnerability]]

==Theoretical Attacks==
* [[NCK Brute Force]]
* [[Baseband JTAG]]

==Boot Chain==
[[Baseband Bootrom|bootrom]]->[[Baseband Bootloader|bootloader]]->[[Baseband Firmware|firmware]]

[[Category:Baseband]]

Baseband Device

2011-06-09T11:52:55Z

Redart: added ipad2

This is the device in the iPhone that manages all the functions which require an antenna. The baseband processor has its own RAM and firmware in NOR flash, separate from the [[ARM]] core resources. The baseband is a resource to the OS. The Wi-Fi and Bluetooth are managed by the main CPU, although the baseband stores their MAC addresses in its NVRAM.

The [[M68ap|iPhone]]'s baseband processor is the [[S-Gold 2]]. The [[N82ap|iPhone 3G]], the [[N88ap|iPhone 3GS]] and the [[K48ap|iPad]] make use of the [[X-Gold 608]] chip for this purpose. The [[N90ap|iPhone 4 (GSM)]] and [[K94ap|iPad 2]] uses the [[XMM 6180]], the [[N92ap|iPhone 4 (CDMA)]] uses the [[MDM6600]].

You can check some [[Baseband Commands]].

==[[Seczone]]==
This is the area in the baseband where the lock state is stored.

===Layout===
0x400--NCK token
0xA00--IMEI signature
0xB00--IMEI
0xC00--Locks table

===Encryption===
Many of the sections are encrypted using [[Baseband TEA Keys|TEA]] based off the [[CHIPID]] and [[NORID]]. See [[NCK Brute Force]] for more info.

==Exploits==
* [[SIM hacks]]

===[[S-Gold 2]]===
* [[Fakeblank]]
* [[IPSF]]
* [[Minus 0x400]]
* [[Minus 0x20000 with Back Extend Erase]]

===[[X-Gold 608]]===
* [[JerrySIM]]
* [[AT+stkprof]]
* [[AT+XLOG Vulnerability]]
* [[AT+XEMN Heap Overflow]]
* [[AT+XAPP Vulnerability]]

===[[XMM 6180]]===
* [[AT+XAPP Vulnerability]]

==Theoretical Attacks==
* [[NCK Brute Force]]
* [[Baseband JTAG]]

==Boot Chain==
[[Baseband Bootrom|bootrom]]->[[Baseband Bootloader|bootloader]]->[[Baseband Firmware|firmware]]

[[Category:Baseband]]

Firmware

2011-04-19T09:31:10Z

Redart: /* iPhone 4 (GSM model) */

Latest Apple download links can be found [http://www.itunes.com/version here].

==[[Apple TV]]==
===[[K66ap|Apple TV (2nd generation)]]===
'''NOTE:''' The version in parentheses is what the Apple TV reports on TV.
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="70"| Version
!width="120"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.1 (4.0)
| [[Mojave 8M89 (Apple TV 2G)|Mojave 8M89]]
| [http://appldnld.apple.com/AppleTV/061-8940.20100926.Tvtnz/AppleTV2,1_4.1_8M89_Restore.ipsw AppleTV2,1_4.1_8M89_Restore.ipsw]
| <code>68647d6ce163fc20891ca5bcff647c8eecc2b8d9</code>
| Initial shipment.
| {{yes}}
| 253,759,976
|-
| 4.2 (4.1)
| [[jasper 8C150 (Apple TV 2G)|Jasper 8C150]]
| [http://appldnld.apple.com/AppleTV/061-8747.20101122.Vgtr5/AppleTV2,1_4.2_8C150_Restore.ipsw AppleTV2,1_4.2_8C150_Restore.ipsw]
| <code>58f9ab479783dad3dff3834452abc2917aaef2a5</code>
|
| {{no}}
| 279,991,056
|-
| 4.2.1 (4.1.1)
| [[jasper 8C154 (Apple TV 2G)|Jasper 8C154]]
| [http://appldnld.apple.com/AppleTV/061-9978.20101214.gmabr/AppleTV2,1_4.2.1_8C154_Restore.ipsw AppleTV2,1_4.2.1_8C154_Restore.ipsw]
| <code>c2b1adea595afa2b9caf633f0a820d3b66424dbf</code>
|
| {{yes}}
| 280,052,510
|-
| 4.3 (4.2)
| [[Durango 8F191m (Apple TV 2G)|Durango 8F191m]]
| [http://appldnld.apple.com/AppleTV/061-9584.20110308.Cxdew/AppleTV2,1_4.3_8F191m_Restore.ipsw AppleTV2,1_4.3_8F191m_Restore.ipsw]
| <code>71bf070e755753e6dd29e2fc13cff9e248b58bd0</code>
|
| {{no}}
| 332,470,394
|-
| 4.3 (4.2.1)
| [[Durango 8F202 (Apple TV 2G)|Durango 8F202]]
| [http://appldnld.apple.com/AppleTV/041-0574.20110322.Dcfr5/AppleTV2,1_4.3_8F202_Restore.ipsw AppleTV2,1_4.3_8F202_Restore.ipsw]
| <code>41faee6b543ecace1f31558c0a167e86fe784122</code>
|
| {{yes}}
| 334,284,882
|}

1 [[Tethered jailbreak]] only.

==[[iPad]]==
===[[K48ap|iPad]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPad Firmware Versions|Baseband]] (3G only)
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 3.2
| [[Wildcat 7B367 (iPad)|Wildcat 7B367]]
|rowspan="3" | [[6.15.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPad/061-7987.20100403.mjiTr/iPad1,1_3.2_7B367_Restore.ipsw iPad1,1_3.2_7B367_Restore.ipsw]
| <code>172e8297af74b91971a802e6ad137c891f553099</code>
| Initial shipment.
| {{yes}}
| 478,959,325
|-
| 3.2.1
| [[Wildcat 7B405 (iPad)|Wildcat 7B405]]
| [http://appldnld.apple.com/iPad/061-8282.20100713.vgtgh/iPad1,1_3.2.1_7B405_Restore.ipsw iPad1,1_3.2.1_7B405_Restore.ipsw]
| <code>de0a2b64cd335d48fb4abc9ed8700f5dbdf768ca</code>
|
| {{yes}}
| 479,012,625
|-
| 3.2.2
| [[Wildcat 7B500 (iPad)|Wildcat 7B500]]
| [http://appldnld.apple.com/iPad/061-8801.20100811.CvfR5/iPad1,1_3.2.2_7B500_Restore.ipsw iPad1,1_3.2.2_7B500_Restore.ipsw]
| <code>68b613f78581d36eab96aa5a007001dff142baa3</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 479,001,595
|-
| 4.2.1
| [[Jasper 8C148 (iPad)|Jasper 8C148]]
| [[7.10.00]]
| [http://appldnld.apple.com/iPad/061-9857.20101122.VGthy/iPad1,1_4.2.1_8C148_Restore.ipsw iPad1,1_4.2.1_8C148_Restore.ipsw]
| <code>8717b3bedc925b587566442ad375aa65d857e79a</code>
|
| {{yes}}
| 578,084,840
|-
| 4.3
| [[Durango 8F190 (iPad)|Durango 8F190]]
| [[7.11.00]]
| [http://appldnld.apple.com/iPhone4/041-0329.20110311.Cvfre/iPad1,1_4.3_8F190_Restore.ipsw iPad1,1_4.3_8F190_Restore.ipsw]
| <code>fc97d5959a1e29d707586871004ea12e95815237</code>
|
| {{yes|Yes1}}
| 625,814,678
|-
| 4.3.1
| [[Durango 8G4 (iPad)|Durango 8G4]]
|rowspan="2"| [[7.11.01]]
| [http://appldnld.apple.com/iPhone4/041-0550.20110325.Zsw6y/iPad1,1_4.3.1_8G4_Restore.ipsw iPad1,1_4.3.1_8G4_Restore.ipsw]
| <code>6615b368d665630e80da975232567daf87a042b6</code>
|
| {{yes}}
| 621,768,387
|-
| 4.3.2
| [[Durango 8H7 (iPad)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0661.20110414.W9Q8r/iPad1,1_4.3.2_8H7_Restore.ipsw iPad1,1_4.3.2_8H7_Restore.ipsw]
| <code>2c86c5915a8f9e56776deba22dc048c2f42db8b7</code>
|
| {{yes}}
| 622,148,907
|}

1 [[Tethered jailbreak]] only.

===[[iPad 2]]===
====[[K93ap|Wi-Fi model]]====
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.3
| [[Durango 8F191 (iPad 2 Wi-Fi)|Durango 8F191]]
| [http://appldnld.apple.com/iPhone4/041-0368.20110311.SwtHr/iPad2,1_4.3_8F191_Restore.ipsw iPad2,1_4.3_8F191_Restore.ipsw]
| <code>c4db3a44dc0986bc8344f7672cfa0255bea8af14</code>
| Initial shipment.
| {{no}}
| 641,816,049
|-
| 4.3.1
| [[Durango 8G4 (iPad 2 Wi-Fi)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0556.20110325.64rfg/iPad2,1_4.3.1_8G4_Restore.ipsw iPad2,1_4.3.1_8G4_Restore.ipsw]
| <code>becf01c807e4c9f2654e3ffd1b83973f512ae51d</code>
|
| {{no}}
| 636,932,642
|-
| 4.3.2
| [[Durango 8H7 (iPad 2 Wi-Fi)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0663.20110414.U7bTI/iPad2,1_4.3.2_8H7_Restore.ipsw iPad2,1_4.3.2_8H7_Restore.ipsw]
| <code>f3df44893159ec283166a77ee75fe091ac0899b0</code>
|
| {{no}}
| 637,204,516
|}

====[[K94ap|GSM model]]====
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[XMM 6180#Known Firmware Versions|Baseband]]
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.3
| [[Durango 8F191 (iPad 2 GSM)|Durango 8F191]]
|rowspan="3"| [[4.10.01]]
| [http://appldnld.apple.com/iPhone4/041-0369.20110311.Xzsew/iPad2,2_4.3_8F191_Restore.ipsw iPad2,2_4.3_8F191_Restore.ipsw]
| <code>03f4af63f7751e429aef57ae00e675f96b271573</code>
| Initial shipment.
| {{no}}
| 649,374,499
|-
| 4.3.1
| [[Durango 8G4 (iPad 2 GSM)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0557.20110325.Jy76y/iPad2,2_4.3.1_8G4_Restore.ipsw iPad2,2_4.3.1_8G4_Restore.ipsw]
| <code>862dbf2c94dc2f30b02101905a91a45c95c353a7</code>
|
| {{no}}
| 644,359,977
|-
| 4.3.2
| [[Durango 8H7 (iPad 2 GSM)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0664.20110414.39vUS/iPad2,2_4.3.2_8H7_Restore.ipsw iPad2,2_4.3.2_8H7_Restore.ipsw]
| <code>e52bd4bd8eabd48e5cfd02f895292d5644e805be</code>
|
| {{no}}
| 644,615,497
|}

====[[K95ap|CDMA model]]====
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| Baseband
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.3
| [[Durango 8F191 (iPad 2 CDMA)|Durango 8F191]]
|rowspan="3"| [[2.0.4]]
| [http://appldnld.apple.com/iPhone4/041-0334.20110311Plgt5/iPad2,3_4.3_8F191_Restore.ipsw iPad2,3_4.3_8F191_Restore.ipsw]
| <code>435b84104aa3f0ae7883f9d6b1a7a3e96e552dd2</code>
| Initial shipment.
| {{no}}
| 656,018,665
|-
| 4.3.1
| [[Durango 8G4 (iPad 2 CDMA)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0544.20110325.Dew3r/iPad2,3_4.3.1_8G4_Restore.ipsw iPad2,3_4.3.1_8G4_Restore.ipsw]
| <code>1903162ce3ffa9725304eb78275583977d1808cc</code>
|
| {{no}}
| 650,897,625
|-
| 4.3.2
| [[Durango 8H8 (iPad 2 CDMA)|Durango 8H8]]
| [http://appldnld.apple.com/iPhone4/041-0665.20110414.MbwVr/iPad2,3_4.3.2_8H8_Restore.ipsw iPad2,3_4.3.2_8H8_Restore.ipsw]
| <code>aee35de332048941f72bfbbbdf8591a1f306c65d</code>
|
| {{no}}
| 651,222,830
|}

==[[iPhone]]==
===[[M68ap|iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband Firmware]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="91"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{no}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| [[Heavenly 1A543a (iPhone)|Heavenly 1A543a]]
| 03.11.02_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| [[Heavenly 1C25 (iPhone)|Heavenly 1C25]]
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| [[Heavenly 1C28 (iPhone)|Heavenly 1C28]]
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| [[Snowbird 3A109a (iPhone)|Snowbird 3A109a]]
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| [[Oktoberfest 3B48b (iPhone)|Oktoberfest 3B48b]]
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| [[Little Bear 4A93 (iPhone)|Little Bear 4A93]]
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| [[Little Bear 4A102 (iPhone)|Little Bear 4A102]]
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| [[Big Bear 5A347 (iPhone)|Big Bear 5A347]]
|rowspan="11"| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
|rowspan="11" {{yes|[[BootNeuter]]}}
| 228,768,637
|-
| 2.0.1
| [[Big Bear 5B108 (iPhone)|Big Bear 5B108]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| 254,048,068
|-
| 2.0.2
| [[Big Bear 5C1 (iPhone)|Big Bear 5C1]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| 253,589,000
|-
| 2.1
| [[Sugar Bowl 5F136 (iPhone)|Sugar Bowl 5F136]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| 242,171,241
|-
| 2.2
| [[Timberline 5G77 (iPhone)|Timberline 5G77]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| 257,576,980
|-
| 2.2.1
| [[SUTimberline 5H11 (iPhone)|SUTimberline 5H11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| 252,536,460
|-
| 3.1.2
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code>
|
| {{yes}}
| 252,515,888
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone)|SUNorthstarTwo 7E18]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7481.20100202.4orot/iPhone1,1_3.1.3_7E18_Restore.ipsw iPhone1,1_3.1.3_7E18_Restore.ipsw]
| <code>eab23a7f8d2a17cb71046c50fc5f67ec390a3c2b</code>
|
| {{yes}}
| 238,319,275
|}

===[[N82ap|iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="90"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 2.0
| [[Big Bear 5A345 (iPhone 3G)|Big Bear 5A345]]
|rowspan="2" | [[1.45.00]]
| No download available
|
| Initial shipment.
| {{yes}}
|rowspan="5" {{partial|Upgrade to 2.2}}
|
|-
| 2.0
| [[Big Bear 5A347 (iPhone 3G)|Big Bear 5A347]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| 235,957,125
|-
| 2.0.1
| [[Big Bear 5B108 (iPhone 3G)|Big Bear 5B108]]
| [[1.48.02]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| 261,224,227
|-
| 2.0.2
| [[Big Bear 5C1 (iPhone 3G)|Big Bear 5C1]]
| [[2.08.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| 260,761,030
|-
| 2.1
| [[Sugar Bowl 5F136 (iPhone 3G)|Sugar Bowl 5F136]]
| [[2.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| 249,341,655
|-
| 2.2
| [[Timberline 5G77 (iPhone 3G)|Timberline 5G77]]
| [[2.28.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|yellowsn0w]]}}
| 258,342,348
|-
| 2.2.1
| [[SUTimberline 5H11 (iPhone 3G)|SUTimberline 5H11]]
| [[2.30.03]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{partial|Upgrade to 3.0}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
|rowspan="2" | [[4.26.08]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
|rowspan="2" {{yes|[[ultrasn0w]]}}
| 241,229,233
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone 3G)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
|rowspan="2" | [[5.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}
| 253,361,339
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| {{yes}}
| 253,340,786
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3G)|SUNorthstarTwo 7E18]]
| [[5.12.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7468.20100202.pbnrt/iPhone1,2_3.1.3_7E18_Restore.ipsw iPhone1,2_3.1.3_7E18_Restore.ipsw]
| <code>f5950afca546f93e281ba3cdb08bc0cfed7f0896</code>
|
| {{yes}}
| {{yes|[[ultrasn0w]]}}
| 239,139,281
|-
| 4.0
| [[Apex 8A293 (iPhone 3G)|Apex 8A293]]
|rowspan="3" | [[5.13.04]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7436.20100621.58Yt4/iPhone1,2_4.0_8A293_Restore.ipsw iPhone1,2_4.0_8A293_Restore.ipsw]
| <code>ee1eba9281b902d7ff3f24d50f9aebff0df27f92</code>
|
| {{yes}}
|rowspan="3" {{yes|[[ultrasn0w]]}}
| 306,274,631
|-
| 4.0.1
| [[Apex 8A306 (iPhone 3G)|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8616.20100715.phnt4/iPhone1,2_4.0.1_8A306_Restore.ipsw iPhone1,2_4.0.1_8A306_Restore.ipsw]
| <code>940bd2b36c646f6673419eab661ac1f13248e592</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| 320,237,975
|-
| 4.0.2
| [[Apex 8A400 (iPhone 3G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8802.20100811.XcfpR/iPhone1,2_4.0.2_8A400_Restore.ipsw iPhone1,2_4.0.2_8A400_Restore.ipsw]
| <code>ee2bc74719170a7a2440b593b6f300727c930c69</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 320,216,794
|-
| 4.1
| [[Baker 8B117 (iPhone 3G)|Baker 8B117]]
| [[5.14.02]]
| [http://appldnld.apple.com/iPhone4/061-7932.20100908.3fgt5/iPhone1,2_4.1_8B117_Restore.ipsw iPhone1,2_4.1_8B117_Restore.ipsw]
|<code>d87bab469dd1146ab83ddcc23f03b3164d7e09d4</code>
|
| {{Yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 323,137,556
|-
|-
| 4.2.1
| [[Jasper 8C148 (iPhone 3G)|Jasper 8C148]]
| [[5.15.04]]
| [http://appldnld.apple.com/iPhone4/061-9853.20101122.Vfgt5/iPhone1,2_4.2.1_8C148_Restore.ipsw iPhone1,2_4.2.1_8C148_Restore.ipsw]
|<code>d2ed58586e8ca2153f2e2ec585bba8afc5173378</code>
|
| {{Yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 338,579,762
|-
|}

===[[N88ap|iPhone 3GS]]===
Units with the new bootrom began shipping around September 2009.

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3|old bootrom]])
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3.2|new bootrom]])
!width="80"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
|rowspan="2" | [[4.26.08]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
|rowspan="2" {{no|[[SHSH]]s unavailable at release}}
|rowspan="2" {{yes|[[ultrasn0w]]}}
| 312,292,933
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone 3GS)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
|rowspan="2" | [[5.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
|
| {{yes}}
| {{yes|Yes1}}
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}
| 321,011,474
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3GS)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code>
|
| {{yes}}
| {{yes}}
| 321,015,700
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|SUNorthstarTwo 7E18]]
| [[5.12.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7472.20100202.8tugj/iPhone2,1_3.1.3_7E18_Restore.ipsw iPhone2,1_3.1.3_7E18_Restore.ipsw]
| <code>8cb3775e62c6f72059a962bf891b4e145b965052</code>
|
| {{yes}}
| {{yes}}
| {{yes|[[ultrasn0w]]}}
| 305,122,343
|-
| 4.0
| [[Apex 8A293 (iPhone 3GS)|Apex 8A293]]
|rowspan="3" | [[5.13.04]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7437.20100621.5urG8/iPhone2,1_4.0_8A293_Restore.ipsw iPhone2,1_4.0_8A293_Restore.ipsw]
| <code>e065245874c73510ceb8fa4bd9388b60d46eb252</code>
|
| {{yes}}
| {{yes}}
|rowspan="3" {{yes|[[ultrasn0w]]}}
| 396,281,280
|-
| 4.0.1
| [[Apex 8A306 (iPhone 3GS)‎|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8618.20100715.Zapn4/iPhone2,1_4.0.1_8A306_Restore.ipsw iPhone2,1_4.0.1_8A306_Restore.ipsw]
| <code>c2b6fb9a158547ce726baa1bf8f0558a71518fec</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| {{yes}}
| 396,322,891
|-
| 4.0.2
| [[Apex 8A400 (iPhone 3GS)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8805.20100811.Dcr4e/iPhone2,1_4.0.2_8A400_Restore.ipsw iPhone2,1_4.0.2_8A400_Restore.ipsw]
| <code>61d21363ced6e006cc226f9a0a0e9c6ed8e048ab</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| {{yes}}
| 396,310,640
|-
| 4.1
| [[Baker 8B117 (iPhone 3GS)|Baker 8B117]]
| [[5.14.02]]
| [http://appldnld.apple.com/iPhone4/061-7938.20100908.F3rCk/iPhone2,1_4.1_8B117_Restore.ipsw iPhone2,1_4.1_8B117_Restore.ipsw]
|<code>2d1657cd33ae23b8d4e79e41fe758d09d3c52e30</code>
|
| {{yes}}
| {{yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 400,572,133
|-
| 4.2.1
| [[Jasper 8C148a (iPhone 3GS)|Jasper 8C148a]]
| [[5.15.04]]
| [http://appldnld.apple.com/iPhone4/061-9895.20101122.Cdew2/iPhone2,1_4.2.1_8C148a_Restore.ipsw iPhone2,1_4.2.1_8C148a_Restore.ipsw]
| <code>2787bb9fbf18594279d05682e6fd16d2b9612a2a</code>
|
| {{yes}}
| {{yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 420,813,164
|-
| 4.3
| [[Durango 8F190 (iPhone 3GS)|Durango 8F190]]
|rowspan="2"| [[5.16.00]]
| [http://appldnld.apple.com/iPhone4/041-0328.20110311.Lkhy6/iPhone2,1_4.3_8F190_Restore.ipsw iPhone2,1_4.3_8F190_Restore.ipsw]
| <code>d05108c7338f7df7026b2d9a84f632a096bace92</code>
|
| {{yes}}
| {{yes|Yes1}}
|rowspan="2" {{partial|Upgrade baseband to [[6.15.00]]}}
| 443,762,287
|-
| 4.3.1
| [[Durango 8G4 (iPhone 3GS)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0549.20110325.ZxP8u/iPhone2,1_4.3.1_8G4_Restore.ipsw iPhone2,1_4.3.1_8G4_Restore.ipsw]
| <code>6de986f2dbd16a65db122e7c54a70f31812d028a</code>
|
| {{yes}}
| {{yes}}
| 440,276,917
|-
| 4.3.2
| [[Durango 8H7 (iPhone 3GS)|Durango 8H7]]
| [[5.16.02]]
| [http://appldnld.apple.com/iPhone4/041-0660.20110414.Gwed5/iPhone2,1_4.3.2_8H7_Restore.ipsw iPhone2,1_4.3.2_8H7_Restore.ipsw]
| <code>4021a2d82971fc4c637f1fdb6ce7c4dcfb7ac0d7</code>
|
| {{yes}}
| {{yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 440,519,356
|}

1 [[Tethered jailbreak]] only.

===[[N90ap|iPhone 4 (GSM model)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[XMM 6180#Known Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]?
!width="95"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 4.0
| [[Apex 8A293 (iPhone 4)|Apex 8A293]]
|rowspan="3" | [[1.59.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7380.20100621,Vfgb5/iPhone3,1_4.0_8A293_Restore.ipsw iPhone3,1_4.0_8A293_Restore.ipsw]
| <code>171c2a3995fa149f2a369ccd87f82c5c30da3f88</code>
| Initial shipment.
| {{yes}}
|rowspan="3" {{Yes|[[ultrasn0w]]}}
| 607,363,121
|-
| 4.0.1
| [[Apex 8A306 (iPhone 4)|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8619.20100715.4Pnsx/iPhone3,1_4.0.1_8A306_Restore.ipsw iPhone3,1_4.0.1_8A306_Restore.ipsw]
| <code>a9cf20679273b7e502ab384854ba96cc2a54d532</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| 607,380,127
|-
| 4.0.2
| [[Apex 8A400 (iPhone 4)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8807.20100811.3Edre/iPhone3,1_4.0.2_8A400_Restore.ipsw iPhone3,1_4.0.2_8A400_Restore.ipsw]
| <code>19eb071cdb9f1601b106825d0a16b1449c6eef8c</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 607,375,880
|-
| 4.1
| [[Baker 8B117 (iPhone 4)|Baker 8B117]]
| [[2.10.04]]
| [http://appldnld.apple.com/iPhone4/061-7939.20100908.Lcyg3/iPhone3,1_4.1_8B117_Restore.ipsw iPhone3,1_4.1_8B117_Restore.ipsw]
|<code>a3f8a333ca181146b862ca6a59c9a6e7c27eba0b</code>
|
| {{yes}}
| {{No}}
| 618,501,195
|-
| 4.2.1
| [[Jasper 8C148 (iPhone 4)|Jasper 8C148]]
| [[3.10.01]]
| [http://appldnld.apple.com/iPhone4/061-9858.20101122.Er456/iPhone3,1_4.2.1_8C148_Restore.ipsw iPhone3,1_4.2.1_8C148_Restore.ipsw]
|<code>366b28e9c95936bd4b11a84d54fefaf079fd6411</code>
|
| {{yes}}
| {{No}}
| 654,550,096
|-
| 4.3
| [[Durango 8F190 (iPhone 4)|Durango 8F190]]
|rowspan="3"| [[4.10.01]]
| [http://appldnld.apple.com/iPhone4/041-0330.20110311.Cswe3/iPhone3,1_4.3_8F190_Restore.ipsw iPhone3,1_4.3_8F190_Restore.ipsw]
|<code>146cd896abb21680383fe675cbc99fc36d3cce57</code>
|
| {{yes|Yes1}}
|rowspan="3" {{No}}
| 702,264,955
|-
| 4.3.1
| [[Durango 8G4 (iPhone 4)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0551.20110325.Aw2Dr/iPhone3,1_4.3.1_8G4_Restore.ipsw iPhone3,1_4.3.1_8G4_Restore.ipsw]
|<code>6694f69c84d36248d5bb71ba78ddb1f4946260f0</code>
|
| {{yes}}
| 698,304,690
|-
| 4.3.2
| [[Durango 8H7 (iPhone 4)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0662.20110414.byQ84/iPhone3,1_4.3.2_8H7_Restore.ipsw iPhone3,1_4.3.2_8H7_Restore.ipsw]
|<code> 211e556a558ad18921c8b837db65aa20a373db77</code>
|
| {{yes}}
| 698,525,410
|}

1 [[Tethered jailbreak]] only.

===[[N92ap|iPhone 4 (CDMA model)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| Baseband
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]?
!width="95"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 4.2.5
| [[Phoenix 8E128 (iPhone 4 CDMA)|Phoenix 8E128]]
|rowspan="2" | [[1.0.05]]
| No download available
| <code>?</code>
| Initial Shipment
| {{no}}
| rowspan="2" {{no}}
| ?
|-
| 4.2.6
| [[Phoenix 8E200 (iPhone 4 CDMA)|Phoenix 8E200]]
| [http://appldnld.apple.com/iPhone4/041-0177.20110131.Pyvrz/iPhone3,3_4.2.6_8E200_Restore.ipsw iPhone3,3_4.2.6_8E200_Restore.ipsw]
| <code>f32cf46790a473a6c12f9dbd3773bf40fbdf6eee</code>
| Initial Shipment
| {{yes}}
| 683,594,406
|-
| 4.2.7
| [[Phoenix 8E303 (iPhone 4 CDMA)|Phoenix 8E303]]
| [[1.0.06]]
| [http://appldnld.apple.com/iPhone4/041-0614.20110414.B47xa/iPhone3,3_4.2.7_8E303_Restore.ipsw iPhone3,3_4.2.7_8E303_Restore.ipsw]
| <code>724c173be65ffb1ca3ea5da73a331ddf1319884f</code>
|
| {{no}}
| {{no}}
| 684,508,142
|}
1 [[Tethered jailbreak]] only.

==[[iPod touch]]==
===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 1.1
| [[Snowbird 3A100a (iPod touch)|Snowbird 3A100a]]
| No download available
|
| Initial shipment.
| {{no}}
|
|-
| 1.1
| [[Snowbird 3A101a (iPod touch)|Snowbird 3A101a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{no}}
| 157,890,186
|-
| 1.1.1
| [[Snowbird 3A110a (iPod touch)|Snowbird 3A110a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| [[Oktoberfest 3B48b (iPod touch)|Oktoberfest 3B48b]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| [[Little Bear 4A93 (iPod touch)|Little Bear 4A93]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| [[Little Bear 4A102 (iPod touch)|Little Bear 4A102]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| [[Little Bear 4B1 (iPod touch)|Little Bear 4B1]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| [[Big Bear 5A347 (iPod touch)|Big Bear 5A347]]
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| [[Big Bear 5B108 (iPod touch)|Big Bear 5B108]]
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| [[Big Bear 5C1 (iPod touch)|Big Bear 5C1]]
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| [[Sugar Bowl 5F137 (iPod touch)|Sugar Bowl 5F137]]
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| [[Timberline 5G77 (iPod touch)|Timberline 5G77]]
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| [[SUTimberline 5H11 (iPod touch)|SUTimberline 5H11]]
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch)|Northstar 7C145]]
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch)|Northstar 7D11]]
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| {{yes}}
| 249,780,497
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f897990f19d2f093b35e0813d7d77806404fb1f</code>
|
| {{yes}}
| 235,678,189
|}

===[[N72ap|iPod touch (2nd generation)]]===
Units with the new bootrom have model numbers that start with "MC."

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.4|old bootrom]])
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.5.1|new bootrom]])
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138 (iPod touch 2G)|Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes|Yes1}}
|rowspan="4" {{no|Incompatible device/
firmware match}}
| 282,083,944
|-
| 2.2
| [[Timberline 5G77a (iPod touch 2G)|Timberline 5G77a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{no}}
| 291,123,491
|-
| 2.2.1
| [[SUTimberline 5H11a (iPod touch 2G)|SUTimberline 5H11a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.x is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
| Initial shipment for units with the new bootrom.
| {{yes}}
| {{yes|Yes1}}
| 277,753,989
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 2G)|Northstar 7D11]]
| Download Link Prohibited
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code>
|
| {{yes}}
| {{yes}}
| 277,794,671
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f4f5c01eda2f811f73167e7d1f82dbeed82367b</code>
|
| {{yes}}
| {{yes}}
| 263,275,211
|-
| 4.0
| [[Apex 8A293 (iPod touch 2G)|Apex 8A293]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7435.20100621.tr49t/iPod2,1_4.0_8A293_Restore.ipsw iPod2,1_4.0_8A293_Restore.ipsw]
| <code>c026c373bc535496a6f901de2ba37d4a487413bf</code>
|
| {{yes}}
| {{yes}}
| 330,278,777
|-
| 4.0.2
| [[Apex 8A400 (iPod touch 2G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8551.20100811.Xcder/iPod2,1_4.0.2_8A400_Restore.ipsw iPod2,1_4.0.2_8A400_Restore.ipsw]
| <code>06a42297d94461264eb64d7c8640cc5d1c19edeb</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| {{yes|Yes1}}
| 344,248,876
|-
| 4.1
| [[Baker 8B117 (iPod touch 2G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-7937.20100908.ghj4f/iPod2,1_4.1_8B117_Restore.ipsw iPod2,1_4.1_8B117_Restore.ipsw]
|<code>97abde6207660bd876fd476275dd526d0dcf3d19</code>
|
| {{Yes}}
| {{yes}}
| 348,027,174
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 2G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9855.20101122.Lrft6/iPod2,1_4.2.1_8C148_Restore.ipsw iPod2,1_4.2.1_8C148_Restore.ipsw]
|<code>b9efddc7bb4350c237a8d3846af61bbfc8a2f647</code>
|
| {{yes}}
| {{yes}}
|363,553,480
|}

1 [[Tethered jailbreak]] only.

===[[N18ap|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| {{yes|Yes1}}

| 311,702,789
|-
| 3.1.1
| [[Northstar 7C146 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| {{yes|Yes1}}
| 311,690,768
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code>
|
| {{yes}}
| 311,740,034
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|SUNorthstarTwo 7E18]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7473.20100202.4i44t/iPod3,1_3.1.3_7E18_Restore.ipsw iPod3,1_3.1.3_7E18_Restore.ipsw]
| <code>375fd469b18bfc0b74c7cfa5b4d5945197b1d106</code>
|
| {{yes}}
| 295,870,806
|-
| 4.0
| [[Apex 8A293 (iPod touch 3G)|Apex 8A293]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7381.20100621.AzSP9/iPod3,1_4.0_8A293_Restore.ipsw iPod3,1_4.0_8A293_Restore.ipsw]
| <code>36fe02b83f87d6305db572e1644841e3cd64cc7d</code>
|
| {{yes}}
| 384,178,784
|-
| 4.0.2
| [[Apex 8A400 (iPod touch 3G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8554.20100811.Bgt54/iPod3,1_4.0.2_8A400_Restore.ipsw iPod3,1_4.0.2_8A400_Restore.ipsw]
| <code>481b21044130125b117d53207f725b70fb061855</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 384,203,993
|-
| 4.1
| [[Baker 8B117 (iPod touch 3G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-7941.20100908.sV9KE/iPod3,1_4.1_8B117_Restore.ipsw iPod3,1_4.1_8B117_Restore.ipsw]
|<code>3162bad4060b7a58c9942ddb483e5bd9bcc5269f</code>
|
| {{yes}}
| 388,255,189
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 3G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9860.20101122.Xsde3/iPod3,1_4.2.1_8C148_Restore.ipsw iPod3,1_4.2.1_8C148_Restore.ipsw]
|<code>1127a042c535f7cf0be950ff8946862d5fb05b36</code>
|
| {{yes}}
| 408,118,620
|-
| 4.3
| [[Durango 8F190 (iPod touch 3G)|Durango 8F190]]
| [http://appldnld.apple.com/iPhone4/061-8366.20110311.Fr45t/iPod3,1_4.3_8F190_Restore.ipsw iPod3,1_4.3_8F190_Restore.ipsw]
|<code>3df936f2caf0759e6ac7f2339d663f3cad8b95f9</code>
|
| {{yes|Yes1}}
| 433,166,165
|-
| 4.3.1
| [[Durango 8G4 (iPod touch 3G)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0552.20110325.Yt67u/iPod3,1_4.3.1_8G4_Restore.ipsw iPod3,1_4.3.1_8G4_Restore.ipsw]
|<code>6879818321fd18267a15b91afbb1758dddd5dd5e</code>
|
| {{yes}}
| 429,132,326
|-
| 4.3.2
| [[Durango 8H7 (iPod touch 3G)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0667.20110414.95hVL/iPod3,1_4.3.2_8H7_Restore.ipsw iPod3,1_4.3.2_8H7_Restore.ipsw]
|<code>cac5436f85d9b42a5d2e9e495d34bd4ec2e4cf7f</code>
|
| {{yes}}
| 429,339,223
|}

1 [[Tethered jailbreak]] only.

===[[N81ap|iPod touch (4th generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.1
| [[Baker 8B117 (iPod touch 4G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-8490.20100901.hyjtR/iPod4,1_4.1_8B117_Restore.ipsw iPod4,1_4.1_8B117_Restore.ipsw]
| <code>a464492bf6ad25d65b378c85d8b181f973ede38a</code>
| Initial shipment.
| {{yes}}
| 608,360,672
|-
| 4.1
| [[Baker 8B118 (iPod touch 4G)|Baker 8B118]]
| [http://appldnld.apple.com/iPhone4/061-9344.20100922.Urgt43/iPod4,1_4.1_8B118_Restore.ipsw iPod4,1_4.1_8B118_Restore.ipsw]
| <code>331fb1342f5dab8c04cead74384a1e0fc1145952</code>
|
| {{yes}}
| 608,360,927
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 4G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9859.20101122.$erft/iPod4,1_4.2.1_8C148_Restore.ipsw iPod4,1_4.2.1_8C148_Restore.ipsw]
| <code>6a890696126d0cb7f9ccd6b913ecb09cf2029820</code>
|
| {{yes}}
| 638,177,119
|-
| 4.3
| [[Durango 8F190 (iPod touch 4G)|Durango 8F190]]
| [http://appldnld.apple.com/iPhone4/061-9588.20110311.GtP7y/iPod4,1_4.3_8F190_Restore.ipsw iPod4,1_4.3_8F190_Restore.ipsw]
| <code>0a463245f640d3e9a7528b6da0b6ff04b75c96bc</code>
|
| {{yes|Yes1}}
| 684,595,902
|-
| 4.3.1
| [[Durango 8G4 (iPod touch 4G)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0545.20110325.We3Rt/iPod4,1_4.3.1_8G4_Restore.ipsw iPod4,1_4.3.1_8G4_Restore.ipsw]
| <code>4a395e045a722de53e78e7aa7584a5201f455b5c</code>
|
| {{yes}}
| 681,680,434
|-
| 4.3.2
| [[Durango 8H7 (iPod touch 4G)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0666.20110414.3QvM1/iPod4,1_4.3.2_8H7_Restore.ipsw iPod4,1_4.3.2_8H7_Restore.ipsw]
| <code>4ee16cf07e792e1f4369e940ddf0786ac4bb2fd2</code>
|
| {{yes}}
| 681,851,983
|}

1 [[Tethered jailbreak]] only.

==See also==
* [[VFDecrypt]]
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://itunes.com/version Apple Firmware XML]

Firmware

2011-04-19T09:30:14Z

Redart: 4.3.2

Latest Apple download links can be found [http://www.itunes.com/version here].

==[[Apple TV]]==
===[[K66ap|Apple TV (2nd generation)]]===
'''NOTE:''' The version in parentheses is what the Apple TV reports on TV.
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="70"| Version
!width="120"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.1 (4.0)
| [[Mojave 8M89 (Apple TV 2G)|Mojave 8M89]]
| [http://appldnld.apple.com/AppleTV/061-8940.20100926.Tvtnz/AppleTV2,1_4.1_8M89_Restore.ipsw AppleTV2,1_4.1_8M89_Restore.ipsw]
| <code>68647d6ce163fc20891ca5bcff647c8eecc2b8d9</code>
| Initial shipment.
| {{yes}}
| 253,759,976
|-
| 4.2 (4.1)
| [[jasper 8C150 (Apple TV 2G)|Jasper 8C150]]
| [http://appldnld.apple.com/AppleTV/061-8747.20101122.Vgtr5/AppleTV2,1_4.2_8C150_Restore.ipsw AppleTV2,1_4.2_8C150_Restore.ipsw]
| <code>58f9ab479783dad3dff3834452abc2917aaef2a5</code>
|
| {{no}}
| 279,991,056
|-
| 4.2.1 (4.1.1)
| [[jasper 8C154 (Apple TV 2G)|Jasper 8C154]]
| [http://appldnld.apple.com/AppleTV/061-9978.20101214.gmabr/AppleTV2,1_4.2.1_8C154_Restore.ipsw AppleTV2,1_4.2.1_8C154_Restore.ipsw]
| <code>c2b1adea595afa2b9caf633f0a820d3b66424dbf</code>
|
| {{yes}}
| 280,052,510
|-
| 4.3 (4.2)
| [[Durango 8F191m (Apple TV 2G)|Durango 8F191m]]
| [http://appldnld.apple.com/AppleTV/061-9584.20110308.Cxdew/AppleTV2,1_4.3_8F191m_Restore.ipsw AppleTV2,1_4.3_8F191m_Restore.ipsw]
| <code>71bf070e755753e6dd29e2fc13cff9e248b58bd0</code>
|
| {{no}}
| 332,470,394
|-
| 4.3 (4.2.1)
| [[Durango 8F202 (Apple TV 2G)|Durango 8F202]]
| [http://appldnld.apple.com/AppleTV/041-0574.20110322.Dcfr5/AppleTV2,1_4.3_8F202_Restore.ipsw AppleTV2,1_4.3_8F202_Restore.ipsw]
| <code>41faee6b543ecace1f31558c0a167e86fe784122</code>
|
| {{yes}}
| 334,284,882
|}

1 [[Tethered jailbreak]] only.

==[[iPad]]==
===[[K48ap|iPad]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPad Firmware Versions|Baseband]] (3G only)
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 3.2
| [[Wildcat 7B367 (iPad)|Wildcat 7B367]]
|rowspan="3" | [[6.15.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPad/061-7987.20100403.mjiTr/iPad1,1_3.2_7B367_Restore.ipsw iPad1,1_3.2_7B367_Restore.ipsw]
| <code>172e8297af74b91971a802e6ad137c891f553099</code>
| Initial shipment.
| {{yes}}
| 478,959,325
|-
| 3.2.1
| [[Wildcat 7B405 (iPad)|Wildcat 7B405]]
| [http://appldnld.apple.com/iPad/061-8282.20100713.vgtgh/iPad1,1_3.2.1_7B405_Restore.ipsw iPad1,1_3.2.1_7B405_Restore.ipsw]
| <code>de0a2b64cd335d48fb4abc9ed8700f5dbdf768ca</code>
|
| {{yes}}
| 479,012,625
|-
| 3.2.2
| [[Wildcat 7B500 (iPad)|Wildcat 7B500]]
| [http://appldnld.apple.com/iPad/061-8801.20100811.CvfR5/iPad1,1_3.2.2_7B500_Restore.ipsw iPad1,1_3.2.2_7B500_Restore.ipsw]
| <code>68b613f78581d36eab96aa5a007001dff142baa3</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 479,001,595
|-
| 4.2.1
| [[Jasper 8C148 (iPad)|Jasper 8C148]]
| [[7.10.00]]
| [http://appldnld.apple.com/iPad/061-9857.20101122.VGthy/iPad1,1_4.2.1_8C148_Restore.ipsw iPad1,1_4.2.1_8C148_Restore.ipsw]
| <code>8717b3bedc925b587566442ad375aa65d857e79a</code>
|
| {{yes}}
| 578,084,840
|-
| 4.3
| [[Durango 8F190 (iPad)|Durango 8F190]]
| [[7.11.00]]
| [http://appldnld.apple.com/iPhone4/041-0329.20110311.Cvfre/iPad1,1_4.3_8F190_Restore.ipsw iPad1,1_4.3_8F190_Restore.ipsw]
| <code>fc97d5959a1e29d707586871004ea12e95815237</code>
|
| {{yes|Yes1}}
| 625,814,678
|-
| 4.3.1
| [[Durango 8G4 (iPad)|Durango 8G4]]
|rowspan="2"| [[7.11.01]]
| [http://appldnld.apple.com/iPhone4/041-0550.20110325.Zsw6y/iPad1,1_4.3.1_8G4_Restore.ipsw iPad1,1_4.3.1_8G4_Restore.ipsw]
| <code>6615b368d665630e80da975232567daf87a042b6</code>
|
| {{yes}}
| 621,768,387
|-
| 4.3.2
| [[Durango 8H7 (iPad)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0661.20110414.W9Q8r/iPad1,1_4.3.2_8H7_Restore.ipsw iPad1,1_4.3.2_8H7_Restore.ipsw]
| <code>2c86c5915a8f9e56776deba22dc048c2f42db8b7</code>
|
| {{yes}}
| 622,148,907
|}

1 [[Tethered jailbreak]] only.

===[[iPad 2]]===
====[[K93ap|Wi-Fi model]]====
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.3
| [[Durango 8F191 (iPad 2 Wi-Fi)|Durango 8F191]]
| [http://appldnld.apple.com/iPhone4/041-0368.20110311.SwtHr/iPad2,1_4.3_8F191_Restore.ipsw iPad2,1_4.3_8F191_Restore.ipsw]
| <code>c4db3a44dc0986bc8344f7672cfa0255bea8af14</code>
| Initial shipment.
| {{no}}
| 641,816,049
|-
| 4.3.1
| [[Durango 8G4 (iPad 2 Wi-Fi)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0556.20110325.64rfg/iPad2,1_4.3.1_8G4_Restore.ipsw iPad2,1_4.3.1_8G4_Restore.ipsw]
| <code>becf01c807e4c9f2654e3ffd1b83973f512ae51d</code>
|
| {{no}}
| 636,932,642
|-
| 4.3.2
| [[Durango 8H7 (iPad 2 Wi-Fi)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0663.20110414.U7bTI/iPad2,1_4.3.2_8H7_Restore.ipsw iPad2,1_4.3.2_8H7_Restore.ipsw]
| <code>f3df44893159ec283166a77ee75fe091ac0899b0</code>
|
| {{no}}
| 637,204,516
|}

====[[K94ap|GSM model]]====
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[XMM 6180#Known Firmware Versions|Baseband]]
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.3
| [[Durango 8F191 (iPad 2 GSM)|Durango 8F191]]
|rowspan="3"| [[4.10.01]]
| [http://appldnld.apple.com/iPhone4/041-0369.20110311.Xzsew/iPad2,2_4.3_8F191_Restore.ipsw iPad2,2_4.3_8F191_Restore.ipsw]
| <code>03f4af63f7751e429aef57ae00e675f96b271573</code>
| Initial shipment.
| {{no}}
| 649,374,499
|-
| 4.3.1
| [[Durango 8G4 (iPad 2 GSM)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0557.20110325.Jy76y/iPad2,2_4.3.1_8G4_Restore.ipsw iPad2,2_4.3.1_8G4_Restore.ipsw]
| <code>862dbf2c94dc2f30b02101905a91a45c95c353a7</code>
|
| {{no}}
| 644,359,977
|-
| 4.3.2
| [[Durango 8H7 (iPad 2 GSM)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0664.20110414.39vUS/iPad2,2_4.3.2_8H7_Restore.ipsw iPad2,2_4.3.2_8H7_Restore.ipsw]
| <code>e52bd4bd8eabd48e5cfd02f895292d5644e805be</code>
|
| {{no}}
| 644,615,497
|}

====[[K95ap|CDMA model]]====
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| Baseband
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.3
| [[Durango 8F191 (iPad 2 CDMA)|Durango 8F191]]
|rowspan="3"| [[2.0.4]]
| [http://appldnld.apple.com/iPhone4/041-0334.20110311Plgt5/iPad2,3_4.3_8F191_Restore.ipsw iPad2,3_4.3_8F191_Restore.ipsw]
| <code>435b84104aa3f0ae7883f9d6b1a7a3e96e552dd2</code>
| Initial shipment.
| {{no}}
| 656,018,665
|-
| 4.3.1
| [[Durango 8G4 (iPad 2 CDMA)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0544.20110325.Dew3r/iPad2,3_4.3.1_8G4_Restore.ipsw iPad2,3_4.3.1_8G4_Restore.ipsw]
| <code>1903162ce3ffa9725304eb78275583977d1808cc</code>
|
| {{no}}
| 650,897,625
|-
| 4.3.2
| [[Durango 8H8 (iPad 2 CDMA)|Durango 8H8]]
| [http://appldnld.apple.com/iPhone4/041-0665.20110414.MbwVr/iPad2,3_4.3.2_8H8_Restore.ipsw iPad2,3_4.3.2_8H8_Restore.ipsw]
| <code>aee35de332048941f72bfbbbdf8591a1f306c65d</code>
|
| {{no}}
| 651,222,830
|}

==[[iPhone]]==
===[[M68ap|iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband Firmware]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="91"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{no}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| [[Heavenly 1A543a (iPhone)|Heavenly 1A543a]]
| 03.11.02_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| [[Heavenly 1C25 (iPhone)|Heavenly 1C25]]
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| [[Heavenly 1C28 (iPhone)|Heavenly 1C28]]
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| [[Snowbird 3A109a (iPhone)|Snowbird 3A109a]]
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| [[Oktoberfest 3B48b (iPhone)|Oktoberfest 3B48b]]
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| [[Little Bear 4A93 (iPhone)|Little Bear 4A93]]
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| [[Little Bear 4A102 (iPhone)|Little Bear 4A102]]
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| [[Big Bear 5A347 (iPhone)|Big Bear 5A347]]
|rowspan="11"| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
|rowspan="11" {{yes|[[BootNeuter]]}}
| 228,768,637
|-
| 2.0.1
| [[Big Bear 5B108 (iPhone)|Big Bear 5B108]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| 254,048,068
|-
| 2.0.2
| [[Big Bear 5C1 (iPhone)|Big Bear 5C1]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| 253,589,000
|-
| 2.1
| [[Sugar Bowl 5F136 (iPhone)|Sugar Bowl 5F136]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| 242,171,241
|-
| 2.2
| [[Timberline 5G77 (iPhone)|Timberline 5G77]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| 257,576,980
|-
| 2.2.1
| [[SUTimberline 5H11 (iPhone)|SUTimberline 5H11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| 252,536,460
|-
| 3.1.2
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code>
|
| {{yes}}
| 252,515,888
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone)|SUNorthstarTwo 7E18]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7481.20100202.4orot/iPhone1,1_3.1.3_7E18_Restore.ipsw iPhone1,1_3.1.3_7E18_Restore.ipsw]
| <code>eab23a7f8d2a17cb71046c50fc5f67ec390a3c2b</code>
|
| {{yes}}
| 238,319,275
|}

===[[N82ap|iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="90"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 2.0
| [[Big Bear 5A345 (iPhone 3G)|Big Bear 5A345]]
|rowspan="2" | [[1.45.00]]
| No download available
|
| Initial shipment.
| {{yes}}
|rowspan="5" {{partial|Upgrade to 2.2}}
|
|-
| 2.0
| [[Big Bear 5A347 (iPhone 3G)|Big Bear 5A347]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| 235,957,125
|-
| 2.0.1
| [[Big Bear 5B108 (iPhone 3G)|Big Bear 5B108]]
| [[1.48.02]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| 261,224,227
|-
| 2.0.2
| [[Big Bear 5C1 (iPhone 3G)|Big Bear 5C1]]
| [[2.08.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| 260,761,030
|-
| 2.1
| [[Sugar Bowl 5F136 (iPhone 3G)|Sugar Bowl 5F136]]
| [[2.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| 249,341,655
|-
| 2.2
| [[Timberline 5G77 (iPhone 3G)|Timberline 5G77]]
| [[2.28.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|yellowsn0w]]}}
| 258,342,348
|-
| 2.2.1
| [[SUTimberline 5H11 (iPhone 3G)|SUTimberline 5H11]]
| [[2.30.03]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{partial|Upgrade to 3.0}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
|rowspan="2" | [[4.26.08]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
|rowspan="2" {{yes|[[ultrasn0w]]}}
| 241,229,233
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone 3G)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
|rowspan="2" | [[5.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}
| 253,361,339
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| {{yes}}
| 253,340,786
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3G)|SUNorthstarTwo 7E18]]
| [[5.12.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7468.20100202.pbnrt/iPhone1,2_3.1.3_7E18_Restore.ipsw iPhone1,2_3.1.3_7E18_Restore.ipsw]
| <code>f5950afca546f93e281ba3cdb08bc0cfed7f0896</code>
|
| {{yes}}
| {{yes|[[ultrasn0w]]}}
| 239,139,281
|-
| 4.0
| [[Apex 8A293 (iPhone 3G)|Apex 8A293]]
|rowspan="3" | [[5.13.04]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7436.20100621.58Yt4/iPhone1,2_4.0_8A293_Restore.ipsw iPhone1,2_4.0_8A293_Restore.ipsw]
| <code>ee1eba9281b902d7ff3f24d50f9aebff0df27f92</code>
|
| {{yes}}
|rowspan="3" {{yes|[[ultrasn0w]]}}
| 306,274,631
|-
| 4.0.1
| [[Apex 8A306 (iPhone 3G)|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8616.20100715.phnt4/iPhone1,2_4.0.1_8A306_Restore.ipsw iPhone1,2_4.0.1_8A306_Restore.ipsw]
| <code>940bd2b36c646f6673419eab661ac1f13248e592</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| 320,237,975
|-
| 4.0.2
| [[Apex 8A400 (iPhone 3G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8802.20100811.XcfpR/iPhone1,2_4.0.2_8A400_Restore.ipsw iPhone1,2_4.0.2_8A400_Restore.ipsw]
| <code>ee2bc74719170a7a2440b593b6f300727c930c69</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 320,216,794
|-
| 4.1
| [[Baker 8B117 (iPhone 3G)|Baker 8B117]]
| [[5.14.02]]
| [http://appldnld.apple.com/iPhone4/061-7932.20100908.3fgt5/iPhone1,2_4.1_8B117_Restore.ipsw iPhone1,2_4.1_8B117_Restore.ipsw]
|<code>d87bab469dd1146ab83ddcc23f03b3164d7e09d4</code>
|
| {{Yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 323,137,556
|-
|-
| 4.2.1
| [[Jasper 8C148 (iPhone 3G)|Jasper 8C148]]
| [[5.15.04]]
| [http://appldnld.apple.com/iPhone4/061-9853.20101122.Vfgt5/iPhone1,2_4.2.1_8C148_Restore.ipsw iPhone1,2_4.2.1_8C148_Restore.ipsw]
|<code>d2ed58586e8ca2153f2e2ec585bba8afc5173378</code>
|
| {{Yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 338,579,762
|-
|}

===[[N88ap|iPhone 3GS]]===
Units with the new bootrom began shipping around September 2009.

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3|old bootrom]])
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3.2|new bootrom]])
!width="80"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
|rowspan="2" | [[4.26.08]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
|rowspan="2" {{no|[[SHSH]]s unavailable at release}}
|rowspan="2" {{yes|[[ultrasn0w]]}}
| 312,292,933
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone 3GS)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
|rowspan="2" | [[5.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
|
| {{yes}}
| {{yes|Yes1}}
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}
| 321,011,474
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3GS)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code>
|
| {{yes}}
| {{yes}}
| 321,015,700
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|SUNorthstarTwo 7E18]]
| [[5.12.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7472.20100202.8tugj/iPhone2,1_3.1.3_7E18_Restore.ipsw iPhone2,1_3.1.3_7E18_Restore.ipsw]
| <code>8cb3775e62c6f72059a962bf891b4e145b965052</code>
|
| {{yes}}
| {{yes}}
| {{yes|[[ultrasn0w]]}}
| 305,122,343
|-
| 4.0
| [[Apex 8A293 (iPhone 3GS)|Apex 8A293]]
|rowspan="3" | [[5.13.04]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7437.20100621.5urG8/iPhone2,1_4.0_8A293_Restore.ipsw iPhone2,1_4.0_8A293_Restore.ipsw]
| <code>e065245874c73510ceb8fa4bd9388b60d46eb252</code>
|
| {{yes}}
| {{yes}}
|rowspan="3" {{yes|[[ultrasn0w]]}}
| 396,281,280
|-
| 4.0.1
| [[Apex 8A306 (iPhone 3GS)‎|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8618.20100715.Zapn4/iPhone2,1_4.0.1_8A306_Restore.ipsw iPhone2,1_4.0.1_8A306_Restore.ipsw]
| <code>c2b6fb9a158547ce726baa1bf8f0558a71518fec</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| {{yes}}
| 396,322,891
|-
| 4.0.2
| [[Apex 8A400 (iPhone 3GS)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8805.20100811.Dcr4e/iPhone2,1_4.0.2_8A400_Restore.ipsw iPhone2,1_4.0.2_8A400_Restore.ipsw]
| <code>61d21363ced6e006cc226f9a0a0e9c6ed8e048ab</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| {{yes}}
| 396,310,640
|-
| 4.1
| [[Baker 8B117 (iPhone 3GS)|Baker 8B117]]
| [[5.14.02]]
| [http://appldnld.apple.com/iPhone4/061-7938.20100908.F3rCk/iPhone2,1_4.1_8B117_Restore.ipsw iPhone2,1_4.1_8B117_Restore.ipsw]
|<code>2d1657cd33ae23b8d4e79e41fe758d09d3c52e30</code>
|
| {{yes}}
| {{yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 400,572,133
|-
| 4.2.1
| [[Jasper 8C148a (iPhone 3GS)|Jasper 8C148a]]
| [[5.15.04]]
| [http://appldnld.apple.com/iPhone4/061-9895.20101122.Cdew2/iPhone2,1_4.2.1_8C148a_Restore.ipsw iPhone2,1_4.2.1_8C148a_Restore.ipsw]
| <code>2787bb9fbf18594279d05682e6fd16d2b9612a2a</code>
|
| {{yes}}
| {{yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 420,813,164
|-
| 4.3
| [[Durango 8F190 (iPhone 3GS)|Durango 8F190]]
|rowspan="2"| [[5.16.00]]
| [http://appldnld.apple.com/iPhone4/041-0328.20110311.Lkhy6/iPhone2,1_4.3_8F190_Restore.ipsw iPhone2,1_4.3_8F190_Restore.ipsw]
| <code>d05108c7338f7df7026b2d9a84f632a096bace92</code>
|
| {{yes}}
| {{yes|Yes1}}
|rowspan="2" {{partial|Upgrade baseband to [[6.15.00]]}}
| 443,762,287
|-
| 4.3.1
| [[Durango 8G4 (iPhone 3GS)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0549.20110325.ZxP8u/iPhone2,1_4.3.1_8G4_Restore.ipsw iPhone2,1_4.3.1_8G4_Restore.ipsw]
| <code>6de986f2dbd16a65db122e7c54a70f31812d028a</code>
|
| {{yes}}
| {{yes}}
| 440,276,917
|-
| 4.3.2
| [[Durango 8H7 (iPhone 3GS)|Durango 8H7]]
| [[5.16.02]]
| [http://appldnld.apple.com/iPhone4/041-0660.20110414.Gwed5/iPhone2,1_4.3.2_8H7_Restore.ipsw iPhone2,1_4.3.2_8H7_Restore.ipsw]
| <code>4021a2d82971fc4c637f1fdb6ce7c4dcfb7ac0d7</code>
|
| {{yes}}
| {{yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 440,519,356
|}

1 [[Tethered jailbreak]] only.

===[[N90ap|iPhone 4 (GSM model)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[XMM 6180#Known Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]?
!width="95"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 4.0
| [[Apex 8A293 (iPhone 4)|Apex 8A293]]
|rowspan="3" | [[1.59.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7380.20100621,Vfgb5/iPhone3,1_4.0_8A293_Restore.ipsw iPhone3,1_4.0_8A293_Restore.ipsw]
| <code>171c2a3995fa149f2a369ccd87f82c5c30da3f88</code>
| Initial shipment.
| {{yes}}
|rowspan="3" {{Yes|[[ultrasn0w]]}}
| 607,363,121
|-
| 4.0.1
| [[Apex 8A306 (iPhone 4)|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8619.20100715.4Pnsx/iPhone3,1_4.0.1_8A306_Restore.ipsw iPhone3,1_4.0.1_8A306_Restore.ipsw]
| <code>a9cf20679273b7e502ab384854ba96cc2a54d532</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| 607,380,127
|-
| 4.0.2
| [[Apex 8A400 (iPhone 4)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8807.20100811.3Edre/iPhone3,1_4.0.2_8A400_Restore.ipsw iPhone3,1_4.0.2_8A400_Restore.ipsw]
| <code>19eb071cdb9f1601b106825d0a16b1449c6eef8c</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 607,375,880
|-
| 4.1
| [[Baker 8B117 (iPhone 4)|Baker 8B117]]
| [[2.10.04]]
| [http://appldnld.apple.com/iPhone4/061-7939.20100908.Lcyg3/iPhone3,1_4.1_8B117_Restore.ipsw iPhone3,1_4.1_8B117_Restore.ipsw]
|<code>a3f8a333ca181146b862ca6a59c9a6e7c27eba0b</code>
|
| {{yes}}
| {{No}}
| 618,501,195
|-
| 4.2.1
| [[Jasper 8C148 (iPhone 4)|Jasper 8C148]]
| [[3.10.01]]
| [http://appldnld.apple.com/iPhone4/061-9858.20101122.Er456/iPhone3,1_4.2.1_8C148_Restore.ipsw iPhone3,1_4.2.1_8C148_Restore.ipsw]
|<code>366b28e9c95936bd4b11a84d54fefaf079fd6411</code>
|
| {{yes}}
| {{No}}
| 654,550,096
|-
| 4.3
| [[Durango 8F190 (iPhone 4)|Durango 8F190]]
|rowspan="3"| [[4.10.01]]
| [http://appldnld.apple.com/iPhone4/041-0330.20110311.Cswe3/iPhone3,1_4.3_8F190_Restore.ipsw iPhone3,1_4.3_8F190_Restore.ipsw]
|<code>146cd896abb21680383fe675cbc99fc36d3cce57</code>
|
| {{yes|Yes1}}
|rowspan="3" {{No}}
| 702,264,955
|-
| 4.3.1
| [[Durango 8G4 (iPhone 4)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0551.20110325.Aw2Dr/iPhone3,1_4.3.1_8G4_Restore.ipsw iPhone3,1_4.3.1_8G4_Restore.ipsw]
|<code>6694f69c84d36248d5bb71ba78ddb1f4946260f0</code>
|
| {{yes}}
| 698,304,690
|-
| 4.3.2
| [[Durango 8H7 (iPhone 4)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0662.20110414.byQ84/iPhone3,1_4.3.2_8H7_Restore.ipsw iPhone3,1_4.3.2_8H7_Restore.ipsw]
|<code> 211e556a558ad18921c8b837db65aa20a373db77</code>
|
| {{yes|Yes1}}
| 698,525,410
|}

1 [[Tethered jailbreak]] only.

===[[N92ap|iPhone 4 (CDMA model)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| Baseband
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]?
!width="95"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 4.2.5
| [[Phoenix 8E128 (iPhone 4 CDMA)|Phoenix 8E128]]
|rowspan="2" | [[1.0.05]]
| No download available
| <code>?</code>
| Initial Shipment
| {{no}}
| rowspan="2" {{no}}
| ?
|-
| 4.2.6
| [[Phoenix 8E200 (iPhone 4 CDMA)|Phoenix 8E200]]
| [http://appldnld.apple.com/iPhone4/041-0177.20110131.Pyvrz/iPhone3,3_4.2.6_8E200_Restore.ipsw iPhone3,3_4.2.6_8E200_Restore.ipsw]
| <code>f32cf46790a473a6c12f9dbd3773bf40fbdf6eee</code>
| Initial Shipment
| {{yes}}
| 683,594,406
|-
| 4.2.7
| [[Phoenix 8E303 (iPhone 4 CDMA)|Phoenix 8E303]]
| [[1.0.06]]
| [http://appldnld.apple.com/iPhone4/041-0614.20110414.B47xa/iPhone3,3_4.2.7_8E303_Restore.ipsw iPhone3,3_4.2.7_8E303_Restore.ipsw]
| <code>724c173be65ffb1ca3ea5da73a331ddf1319884f</code>
|
| {{no}}
| {{no}}
| 684,508,142
|}
1 [[Tethered jailbreak]] only.

==[[iPod touch]]==
===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 1.1
| [[Snowbird 3A100a (iPod touch)|Snowbird 3A100a]]
| No download available
|
| Initial shipment.
| {{no}}
|
|-
| 1.1
| [[Snowbird 3A101a (iPod touch)|Snowbird 3A101a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{no}}
| 157,890,186
|-
| 1.1.1
| [[Snowbird 3A110a (iPod touch)|Snowbird 3A110a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| [[Oktoberfest 3B48b (iPod touch)|Oktoberfest 3B48b]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| [[Little Bear 4A93 (iPod touch)|Little Bear 4A93]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| [[Little Bear 4A102 (iPod touch)|Little Bear 4A102]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| [[Little Bear 4B1 (iPod touch)|Little Bear 4B1]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| [[Big Bear 5A347 (iPod touch)|Big Bear 5A347]]
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| [[Big Bear 5B108 (iPod touch)|Big Bear 5B108]]
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| [[Big Bear 5C1 (iPod touch)|Big Bear 5C1]]
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| [[Sugar Bowl 5F137 (iPod touch)|Sugar Bowl 5F137]]
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| [[Timberline 5G77 (iPod touch)|Timberline 5G77]]
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| [[SUTimberline 5H11 (iPod touch)|SUTimberline 5H11]]
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch)|Northstar 7C145]]
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch)|Northstar 7D11]]
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| {{yes}}
| 249,780,497
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f897990f19d2f093b35e0813d7d77806404fb1f</code>
|
| {{yes}}
| 235,678,189
|}

===[[N72ap|iPod touch (2nd generation)]]===
Units with the new bootrom have model numbers that start with "MC."

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.4|old bootrom]])
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.5.1|new bootrom]])
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138 (iPod touch 2G)|Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes|Yes1}}
|rowspan="4" {{no|Incompatible device/
firmware match}}
| 282,083,944
|-
| 2.2
| [[Timberline 5G77a (iPod touch 2G)|Timberline 5G77a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{no}}
| 291,123,491
|-
| 2.2.1
| [[SUTimberline 5H11a (iPod touch 2G)|SUTimberline 5H11a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.x is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
| Initial shipment for units with the new bootrom.
| {{yes}}
| {{yes|Yes1}}
| 277,753,989
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 2G)|Northstar 7D11]]
| Download Link Prohibited
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code>
|
| {{yes}}
| {{yes}}
| 277,794,671
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f4f5c01eda2f811f73167e7d1f82dbeed82367b</code>
|
| {{yes}}
| {{yes}}
| 263,275,211
|-
| 4.0
| [[Apex 8A293 (iPod touch 2G)|Apex 8A293]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7435.20100621.tr49t/iPod2,1_4.0_8A293_Restore.ipsw iPod2,1_4.0_8A293_Restore.ipsw]
| <code>c026c373bc535496a6f901de2ba37d4a487413bf</code>
|
| {{yes}}
| {{yes}}
| 330,278,777
|-
| 4.0.2
| [[Apex 8A400 (iPod touch 2G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8551.20100811.Xcder/iPod2,1_4.0.2_8A400_Restore.ipsw iPod2,1_4.0.2_8A400_Restore.ipsw]
| <code>06a42297d94461264eb64d7c8640cc5d1c19edeb</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| {{yes|Yes1}}
| 344,248,876
|-
| 4.1
| [[Baker 8B117 (iPod touch 2G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-7937.20100908.ghj4f/iPod2,1_4.1_8B117_Restore.ipsw iPod2,1_4.1_8B117_Restore.ipsw]
|<code>97abde6207660bd876fd476275dd526d0dcf3d19</code>
|
| {{Yes}}
| {{yes}}
| 348,027,174
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 2G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9855.20101122.Lrft6/iPod2,1_4.2.1_8C148_Restore.ipsw iPod2,1_4.2.1_8C148_Restore.ipsw]
|<code>b9efddc7bb4350c237a8d3846af61bbfc8a2f647</code>
|
| {{yes}}
| {{yes}}
|363,553,480
|}

1 [[Tethered jailbreak]] only.

===[[N18ap|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| {{yes|Yes1}}

| 311,702,789
|-
| 3.1.1
| [[Northstar 7C146 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| {{yes|Yes1}}
| 311,690,768
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code>
|
| {{yes}}
| 311,740,034
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|SUNorthstarTwo 7E18]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7473.20100202.4i44t/iPod3,1_3.1.3_7E18_Restore.ipsw iPod3,1_3.1.3_7E18_Restore.ipsw]
| <code>375fd469b18bfc0b74c7cfa5b4d5945197b1d106</code>
|
| {{yes}}
| 295,870,806
|-
| 4.0
| [[Apex 8A293 (iPod touch 3G)|Apex 8A293]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7381.20100621.AzSP9/iPod3,1_4.0_8A293_Restore.ipsw iPod3,1_4.0_8A293_Restore.ipsw]
| <code>36fe02b83f87d6305db572e1644841e3cd64cc7d</code>
|
| {{yes}}
| 384,178,784
|-
| 4.0.2
| [[Apex 8A400 (iPod touch 3G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8554.20100811.Bgt54/iPod3,1_4.0.2_8A400_Restore.ipsw iPod3,1_4.0.2_8A400_Restore.ipsw]
| <code>481b21044130125b117d53207f725b70fb061855</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 384,203,993
|-
| 4.1
| [[Baker 8B117 (iPod touch 3G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-7941.20100908.sV9KE/iPod3,1_4.1_8B117_Restore.ipsw iPod3,1_4.1_8B117_Restore.ipsw]
|<code>3162bad4060b7a58c9942ddb483e5bd9bcc5269f</code>
|
| {{yes}}
| 388,255,189
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 3G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9860.20101122.Xsde3/iPod3,1_4.2.1_8C148_Restore.ipsw iPod3,1_4.2.1_8C148_Restore.ipsw]
|<code>1127a042c535f7cf0be950ff8946862d5fb05b36</code>
|
| {{yes}}
| 408,118,620
|-
| 4.3
| [[Durango 8F190 (iPod touch 3G)|Durango 8F190]]
| [http://appldnld.apple.com/iPhone4/061-8366.20110311.Fr45t/iPod3,1_4.3_8F190_Restore.ipsw iPod3,1_4.3_8F190_Restore.ipsw]
|<code>3df936f2caf0759e6ac7f2339d663f3cad8b95f9</code>
|
| {{yes|Yes1}}
| 433,166,165
|-
| 4.3.1
| [[Durango 8G4 (iPod touch 3G)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0552.20110325.Yt67u/iPod3,1_4.3.1_8G4_Restore.ipsw iPod3,1_4.3.1_8G4_Restore.ipsw]
|<code>6879818321fd18267a15b91afbb1758dddd5dd5e</code>
|
| {{yes}}
| 429,132,326
|-
| 4.3.2
| [[Durango 8H7 (iPod touch 3G)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0667.20110414.95hVL/iPod3,1_4.3.2_8H7_Restore.ipsw iPod3,1_4.3.2_8H7_Restore.ipsw]
|<code>cac5436f85d9b42a5d2e9e495d34bd4ec2e4cf7f</code>
|
| {{yes}}
| 429,339,223
|}

1 [[Tethered jailbreak]] only.

===[[N81ap|iPod touch (4th generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.1
| [[Baker 8B117 (iPod touch 4G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-8490.20100901.hyjtR/iPod4,1_4.1_8B117_Restore.ipsw iPod4,1_4.1_8B117_Restore.ipsw]
| <code>a464492bf6ad25d65b378c85d8b181f973ede38a</code>
| Initial shipment.
| {{yes}}
| 608,360,672
|-
| 4.1
| [[Baker 8B118 (iPod touch 4G)|Baker 8B118]]
| [http://appldnld.apple.com/iPhone4/061-9344.20100922.Urgt43/iPod4,1_4.1_8B118_Restore.ipsw iPod4,1_4.1_8B118_Restore.ipsw]
| <code>331fb1342f5dab8c04cead74384a1e0fc1145952</code>
|
| {{yes}}
| 608,360,927
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 4G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9859.20101122.$erft/iPod4,1_4.2.1_8C148_Restore.ipsw iPod4,1_4.2.1_8C148_Restore.ipsw]
| <code>6a890696126d0cb7f9ccd6b913ecb09cf2029820</code>
|
| {{yes}}
| 638,177,119
|-
| 4.3
| [[Durango 8F190 (iPod touch 4G)|Durango 8F190]]
| [http://appldnld.apple.com/iPhone4/061-9588.20110311.GtP7y/iPod4,1_4.3_8F190_Restore.ipsw iPod4,1_4.3_8F190_Restore.ipsw]
| <code>0a463245f640d3e9a7528b6da0b6ff04b75c96bc</code>
|
| {{yes|Yes1}}
| 684,595,902
|-
| 4.3.1
| [[Durango 8G4 (iPod touch 4G)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0545.20110325.We3Rt/iPod4,1_4.3.1_8G4_Restore.ipsw iPod4,1_4.3.1_8G4_Restore.ipsw]
| <code>4a395e045a722de53e78e7aa7584a5201f455b5c</code>
|
| {{yes}}
| 681,680,434
|-
| 4.3.2
| [[Durango 8H7 (iPod touch 4G)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0666.20110414.3QvM1/iPod4,1_4.3.2_8H7_Restore.ipsw iPod4,1_4.3.2_8H7_Restore.ipsw]
| <code>4ee16cf07e792e1f4369e940ddf0786ac4bb2fd2</code>
|
| {{yes}}
| 681,851,983
|}

1 [[Tethered jailbreak]] only.

==See also==
* [[VFDecrypt]]
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://itunes.com/version Apple Firmware XML]

Jailbreak (S5L8920+)

2010-11-03T10:07:08Z

Redart: /* ECID */ For new devics SHSHs are still necessary

When the [[N88ap|iPhone 3GS]] was initially released, Apple did not have enough time to fix the [[0x24000 Segment Overflow]] in the [[S5L8920 (Bootrom)|S5L8920]]. However, in order to flash an exploited [[LLB]] and jailbreak the iPhone 3GS, '''one''' of the following needs to be done:
* Find a new [[iBoot]] exploit every time a new firmware is out.
* Find a way to bypass the [[ECID]] checks.
* Use a bootrom exploit that allows unsigned code execution via USB (2 of them were finally found by Geohot and Chronic Dev Team).

This also applies to the iPhone 3GS with [[iBoot-359.3.2|the new bootrom]], [[N18ap|iPod touch 3G]] and later devices, except a bootrom exploit for the normal boot-chain or a library based jailbreak payload (similar to [[Star]]) is needed as well.

==ECID==
Apple added a new tag to the [[IMG3 File Format]] called ECID. The ECID is ''unique'' to each phone, and its signature is being checked. With this method, Apple attempts to block downgrades once newer firmware becomes available, unless you have a dump of your old firmware's unique IMG3 or signed certificate. Therefore, iBoot exploits won't be so useful for tethered jailbreaks, because such exploits will be closed in new firmwares. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html].

The issue was resolved when Geohot released his [[limera1n]] tool exploiting bootrom security hole which allowed him to upload unsigned iBoot. Still the problem remains with newer devices with [[0x24000 Segment Overflow|0x24000]] fixed - tampering with firmware makes such jailbreak tethered unless some other exploit is used.

There are methods to help keep your downgrading ability, though.

* If it was cached prior to 3.1's release, 3GS owners were able save a file which contains the signature of the 3.0 [[iBSS]] containing their [[ECID]], using the [http://purplera1n.com/ purplera1n website]. A tool has not been created to incorporate this file into a fully signed iBSS, however.
* Saurik's servers are actively caching the necessary files. [http://www.saurik.com/id/12#howto Instructions] to use the servers are included.
* The [[SHSH]] associated with an ECID can be also saved by running [[TinyUmbrella]]. [[TinyUmbrella]] allows the user to restore to whatever version is associated with that [[SHSH]] file permanently. This is based on the aforementioned service [[Saurik]] provides remotely from his server(s).

Release of [[PwnageTool]] 4.1.2 makes storing [[SHSH]]s unnecessary for old bootrom iDevices - there is always a way now to flash jailbroken firmware. Newer devices should continue to backup SHSHs - only original Apple-signed kernelcache can be booted untethered.

==Jailbreak tools==
===[[K48ap|iPad]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.2
|style="width:100px;"| 3.2.1
|style="width:100px;"| 3.2.2
|-
| [[Spirit]]
| {{yes}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{yes}}
|-
| [[greenpois0n]]
| {{no}}
| {{no}}
| {{yes}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{yes|4.1}}
|}

===[[N88ap|iPhone 3GS]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="9"| Works with [[firmware]]...
|-
|style="width:90px;"| 3.0
|style="width:90px;"| 3.0.1
|style="width:90px;"| 3.1
|style="width:90px;"| 3.1.2
|style="width:90px;"| 3.1.3
|style="width:90px;"| 4.0
|style="width:90px;"| 4.0.1
|style="width:90px;"| 4.0.2
|style="width:90px;"| 4.1
|-
| [[purplera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.8}}
| {{yes|0.8}}
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
|-
| [[blackra1n]]
| {{no}}
| {{no}}
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Spirit]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{partial|Restore from a custom firmware2}}
| {{yes|3.1.4}}
|colspan="2" {{partial|Restore from a custom firmware2}}
|colspan="2" {{partial|Restore from a custom firmware with unofficial bundle2}}
| {{yes|4.1}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{partial|1.42 or 2.0.21 2}}
| {{partial|1.5.12 or 2.0.21 2}}
| {{partial|1.71 2 or 2.0.21 2}}
|colspan="3" {{partial|2.0.21 2}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
| [[greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|}
1 [[Tethered jailbreak]] on devices with the [[iBoot-359.3.2|new bootrom]]. Requires usage of the [[usb_control_msg(0x21, 2) Exploit]].

2 Only applicable for devices with the [[iBoot-359.3|old bootrom]]. Requires the device to have signature checks disabled (pwned).

===[[N90ap|iPhone 4]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.1
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
| [[greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1}}
|}

===[[N18ap|iPod touch 3G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="6"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.1.1
|style="width:100px;"| 3.1.2
|style="width:100px;"| 3.1.3
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|-
| [[blackra1n]]
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
|-
| [[Spirit]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.0.21}}
| {{partial|2.0.21}}
| {{partial|1.71 or 2.0.21}}
|colspan="2" {{partial|2.0.21}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
| [[greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1}}
|}
1 [[Tethered jailbreak]]. Requires usage of the [[usb_control_msg(0x21, 2) Exploit]].

===[[N81ap |iPod touch 4G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1
|-
| [[limera1n]]
| {{yes}}
|-
| [[greenpois0n]]
| {{yes}}
|-
| [[PwnageTool]]
| {{yes|4.1}}
|}

Timeline

2010-11-02T12:53:12Z

Redart: redsn0w released

==2010==
===October===
*October 31 -- The [[iPhone Dev Team|Dev Team]] releases [[redsn0w]] 0.9.6b2 which jailbreaks iOS 4.1, 4.2 and 3.2.2 on every device available at the time of release (except for iPT 2G MC). It also includes "DFU" button allowing to flash custom ipsw from Windows[http://blog.iphone-dev.org/post/1452044444/redsn0w-limera1n-fun (see blog post)].
*October 20 -- The [[iPhone Dev Team|Dev Team]] releases [[PwnageTool]] 4.1 which jailbreaks iOS 4.1 and 3.2.2 on every device available at the time of release. [http://blog.iphone-dev.org/post/1359246784/20102010-event (see blog post)]
*October 18 -- [[Chronic Dev (team)|Chronic Dev Team]] releases [[greenpois0n]] RC4 which added support for iPod touch 2G (MC and MB) for an untethered jailbreak using [[User:comex|comex]]'s kernel exploit and the [[usb_control_msg(0xA1, 1) Exploit]].
*October 12 -- [[Chronic Dev (team)|Chronic Dev Team]] releases [[greenpois0n]] after switching its exploit from SHAtter to the exploit [[limera1n]] uses. By doing this, SHAtter remains undisclosed, meaning there is a chance that the 5th generation devices are vulnerable. (The exploit [[limera1n]] uses appears to be fixed in the [[iBoot]] revision found in iOS 4.2 beta 2, which means Apple probably knows about the vulnerability and the next [[bootrom]] revision may have it patched.)
*October 10 -- Following the first [[limera1n]] beta release, [[User:geohot|geohot]] released multiple versions, each fixing bugs affecting previous releases. [[Chronic Dev (team)|Chronic Dev Team]] officialy anounces that, in order to keep SHAtter undisclosed and possibly preserve it for 5th generation devices, [[greenpois0n]] would be delayed in order to incorporate this new exploit [[limera1n]] uses.
*October 9 -- In order to push [[Chronic Dev (team)|Chronic Dev Team]] to change the exploit used on [[greenpois0n]], [[User:geohot|geohot]] rushed out a beta version of [[limera1n]].
*October 8 -- [[User:Geohot|Geohot]] comes back to the scene with a new [[bootrom]] exploit believed to work on all devices, as shown on the resurrected [http://www.limera1n.com limera1n web site]. He prompts [[Chronic_Dev_(team)|Chronic Dev Team]] to use his exploit instead of SHAtter, but, since [[greenpois0n]] is already scheduled to October 10, it may be not possible. [[User:Geohot|Geohot]] ETA'd his [[limera1n]] release to October 11, if [[greenpois0n]] can't be changed to use this new exploit. This decision, however, would burn 2 [[bootrom]] exploits: SHAtter itself and the one used by [[limera1n]], which is unpatchable by firmware updates.
*October 6 -- Chronic Dev Team issues expected ETA of [[greenpois0n]] as October 10, featuring the new SHAtter exploit for devices with the [[S5L8930]].

===September===
*September 30 -- [[User:MuscleNerd|MuscleNerd]] of the [[iPhone Dev Team]] posts [http://www.youtube.com/watch?v=adVp-IxcDHI the first video] of an [[K66ap|Apple TV 2G]] jailbroken via SHAtter.
*September 27 -- [[User:MuscleNerd|MuscleNerd]] of the [[iPhone Dev Team]] posts [http://www.youtube.com/watch?v=aoX1Q8ym2J8 the first video] of an [[N81ap|iPod touch 4G]] jailbroken via SHAtter.
*September 20 -- [[User:pod2g|pod2g]] discloses details about the [[usb_control_msg(0xA1, 1) Exploit‎]] here at The iPhone Wiki. It was used in [[redsn0w]] the following day.
*September 9 -- The existence of SHAtter is revealed. Further details were not released, however.
*September 8 -- Apple releases the [[N81ap|iPod touch 4G]], and iOS 4.1, closing the [[AT+XAPP Vulnerability]].
*September 1 -- Apple event. They announced the new [[N81ap|iPod touch 4G]], [[K66ap|Apple TV 2G]], iOS 4.1, and [[iTunes]] 10.

===August===
*August 12 -- [[Saurik]] releases the first version of PDF Patcher, which installs Apple's patch for the FreeType vulnerability (used in conjunction with other exploits by [[Star]]). It works on firmwares as far back as 2.x, and renders iOS 3.2.2 and 4.0.2 useless for jailbreakers. Jailbreaking and installing this patch is currently the only way for users of first generation iPod touches and iPhones to protect themselves against malicious use of the exploit.
*August 11 -- Apple releases iOS 4.0.2 for [[iPhone]]/[[iPod touch]] and iOS 3.2.2 for [[K48ap|iPad]] as a hotfix for [[Star]]'s exploits. [[Ultrasn0w]]'s exploit remains, since there's no [[Baseband Firmware|baseband]] update on those versions.
*August 3 -- Just before midnight in [[User:planetbeing|planetbeing]]'s timezone [[ultrasn0w]] has been released by the [[iPhone Dev Team]] to [[unlock]] the [[N90ap|iPhone 4]].
*August 1 -- [[User:Comex|comex]] releases [[Star]], a [[jailbreak]] for all iDevices with iOS 3.1.2 through 4.0.1.

===July===
*July 30 -- [[N90ap|iPhone 4]] is released in major countries (second wave).
*July 26 -- Jailbreaking is now officially legal in the U.S.A.: [http://www.eff.org/press/archives/2010/07/26 EFF Wins New Legal Protections for Cell Phone Jailbreakers and Unlockers]
*July 15 -- Apple releases iOS 3.2.1 and 4.0.1.

===June===
*June 24 -- [[N90ap|iPhone 4]] is launched.
*June 22 -- [[iPhone Dev Team]] releases [[PwnageTool]] 4.0 and later 4.0.1 for all devices on 4.0 except those with newer bootroms (some [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]] devices, and all [[N18ap|iPod touch 3G]] and newer devices).
*June 21 -- [[iPhone Dev Team]] releases [[redsn0w]] 0.9.5 to jailbreak 4.0 on [[N82ap|iPhone 3G]] and [[N72ap|iPhone touch 2G]] ([[iBoot-240.4|old bootrom]]).
*June 21 -- [[iPhone Dev Team]] releases [[ultrasn0w]] 0.93, an unlock for baseband firmwares [[4.26.08]], [[5.11.07]], [[5.12.01]], and [[5.13.04]].
*June 21 -- Apple releases iOS 4.0
*June 19 -- [[User:Geohot|geohot]] holds a speech at the [[Nuit du hack 2010|Nuit du Hack]]

===May===
*May 3 -- Windows version of [[Spirit]] has been updated to not require Windows 98 compatibility mode to run and fixed a photo deletion issue.
*May 2 -- [[User:Comex|comex]] releases [[Spirit]], an [[untethered jailbreak]] for all iDevices with iOS 3.1.2 through 3.2.

===April===
*April 3 -- Apple releases the [[K48ap|iPad]].

===Feb===
*Feb 12 -- [[User:sherif hashim|sherif_hashim]] discovers [[AT+XAPP Vulnerability]] and passes it to [[User:MuscleNerd|MuscleNerd]], an elite member of the [[iPhone Dev Team]]
*Feb 2 -- Apple releases iOS 3.1.3, closing [[usb_control_msg(0x21, 2) Exploit|usb_control_msg(0x21, 2)]] vulnerability used by [[blackra1n]], [[redsn0w]], et. al.

==2009==
===November===
*November 3 -- [[User:Geohot|geohot]] releases [[blackra1n]] RC3, a software jailbreak for all devices. Includes a new unlock for baseband [[5.11.07]] called [[blacksn0w]] and is also noticeably faster than previous versions.

===October===
*October 11 -- [[User:Geohot|geohot]] releases [[blackra1n]] RC1, a 30 second software jailbreak for all devices, including a [[tethered jailbreak]] for the [[N18ap|iPod touch 3G]], and [[N88ap|iPhone 3GS]] and [[N72ap|iPod touch 2G]] units with newer bootrom revisions.

===September===
* September 24 -- [[User:iH8sn0w|iH8sn0w]] discovers the [[AT+XEMN Heap Overflow|AT+XEMN]] crash independently.
* September 9 -- The [[N18ap|iPod touch 3G]] with [[S5L8922]] processor is released. [[N72ap|iPod touch 2G]] units continue shipping, but with [[iBoot-240.5.1|a new bootrom]]. [[N88ap|iPhone 3GS]] units also begin shipping with [[iBoot-359.3.2|a new bootrom]]. These are no longer vulnerable to the [[0x24000 Segment Overflow]].
* Apple releases iOS 3.1/3.1.1 (7C144/7C145), closing the [[iBoot Environment Variable Overflow]] and [[AT+XLOG Vulnerability|AT+XLOG]] + [[AT+FNS]] Baseband Exploits.

===July===
* July 14 -- [[User:Geohot|geohot]] releases [[purplesn0w]], a software unlock for the [[X-Gold 608]] using [[AT+XLOG Vulnerability|the same exploit as ultrasn0w]], but handled differently. Minutes later, an explanation and source code was posted.
* July 7 -- The [[iPhone Dev Team]] updates [[redsn0w]] and [[ultrasn0w]] to version 0.8, now with [[N88ap|iPhone 3GS]] support. Saurik also updates [[WinterBoard]] to support the [[N88ap|iPhone 3GS]].
* July 3 -- [[User:Geohot|geohot]] releases [[purplera1n]], a software jailbreak for the [[N88ap|iPhone 3GS]].

===June===
* June 28 -- [[User:Geohot|geohot]] posts pictures on his blog of the first fully jailbroken [[N88ap|iPhone 3GS]].
* June 25 -- It's discovered that [[N88ap|iPhone 3GS]] is vulnerable to the [[0x24000 Segment Overflow]].
* June 24 -- The [[iPhone Dev Team]] releases [[ultrasn0w]], an [[unlock]] for [[X-Gold 608]] thanks to [[AT+XLOG Vulnerability|a new exploit]] discovered by [[User:Oranav|Oranav]].
* June 23 -- [[User:Geohot|geohot]] announces he's found a new exploit in [[iBoot]] he calls [[purplera1n]].
* June 19 -- Release of [[N88ap|iPhone 3GS]] to the public and the release of [[PwnageTool]] 3.0 and [[redsn0w]] for jailbreaking devices running iOS 3.0
* June 17 -- Apple releases iOS 3.0.
* June 8 -- Apple announces the [[N88ap|iPhone 3GS]].

===March===
* March 10 -- Information about the [[0x24000 Segment Overflow]] exploit used for the [[N72ap|iPod touch 2G]] [[untethered jailbreak]] is released thanks to the combined work of [[chronic]], [[CPICH]], [[User:Posixninja|posixninja]], [[User:Pod2g|pod2g]], [[ius]], [[planetbeing]], [[User:MuscleNerd|MuscleNerd]], and co. after being leaked and sold by [[NitroKey]]. To prevent users wasting their money on a stolen exploit, the Hybrid DevTeam decided to release it immediately.

===January===
* January 31 -- The [[iPhone Dev Team]] released [[redsn0w Lite]], a [[tethered jailbreak|tethered]] [[N72ap|iPod touch 2G]] [[jailbreak]]. It combines the [[ARM7 Go]] vulnerability with the well-established [[pwnage]] flow for other Apple mobile devices. It was bundled in a way that allowed usage on iOS 2.2.1 by uploading [[iBoot]] from iOS 2.1.1, which is vulnerable to [[ARM7 Go]], to the device while in [[DFU Mode]].
* January 29 -- Apple releases iOS 2.2.1, closing the [[AT+stkprof]] exploit.
* January 25 -- [[0wnboot]] is released to [http://code.google.com/p/chronicdev/ chronicdev google code page], thanks to [[AriX]], [[User:ChronicDev|chronic]], [[CPICH]], [[westbaer]], [[ius]], [[User:Pod2g|pod2g]], the rest of the iPod devel crew on IRC, and to the #iphone-hax lab rats. Within days, [[AriX]] and the [[Chronic Dev (team)|Chronic Dev Team]] got a ramdisk booting for a [[tethered jailbreak]].
* January 17 -- [[User:MuscleNerd|MuscleNerd]] of the [[iPhone Dev Team]] [https://twitter.com/MuscleNerd/status/1127346766 shows a video demo] of the first jailbroken [[N72ap|iPod touch 2G]].
* January 16 -- [[ARM7 Go]] vulnerability disclosed where else but here on The iPhone Wiki, for developers to poke and prod at.
* January 15 -- The [[iPhone Dev Team]] [https://twitter.com/iphone_dev/status/1120595069 tweets the VFDecrypt key] for iOS 2.2 on [[N72ap|iPod touch 2G]], demonstrating for the first time that unsigned code can now be run on that device.
* January 1 -- The [[iPhone Dev Team]] releases [[yellowsn0w]] 0.9 beta for baseband [[2.28.00]].

==2008==

===December===
* December 27 -- [[25C3_presentation_Hacking_the_iPhone|25C3 presentation "Hacking the iPhone"]]
* December 21 -- [[User:MuscleNerd|MuscleNerd]], of the [[iPhone Dev Team]] does a live demo of the 3G unlock, dubbed as [[yellowsn0w]]: http://qik.com/video/729275

===November===
* November 21 -- Apple releases iOS 2.2.

===September===
* September 9 -- Apple releases iOS 2.1. [[N72ap|iPod touch 2G]], which no longer had the [[Pwnage 2.0]] exploit, is revealed.

===August===
* August 18 -- Apple releases 2.0.2 fimware. [[iPhone Dev Team]] releases [http://wikee.iphwn.org/news:pwnage20announcement QuickPwn], a 2.x [[pwnage]]/ramdisk combination exploit that allows jailbreaking without needing to create custom IPSWs.
* August 4 -- Apple releases 2.0.1 fimware

===July===
* July 22 -- [[TA_Mobile]] hardware dumps the 3G baseband (bootloader 5.8 & FW 1.45.00) by desoldering the [[NOR]].
* July 19 -- [[iPhone Dev Team]] releases [[PwnageTool]] 2.0, jailbreaking and unlocking the 2.0 software on the [[M68ap|iPhone 2G]] and jailbreaking iOS 2.0 on the [[N82ap|iPhone 3G]] and [[N45ap|iPod touch]].
* July 15 -- Apple releases iOS 1.1.5, the last of the 1.x firmwares
* July 11 -- [[N82ap|iPhone 3G]] is released. Apple releases iOS 2.0 and MobileMe on the same date, resulting in server issues.

===June===
* June 9 - [[N82ap|iPhone 3G]] is announced at [[WWDC]] '08.

===April===
* April 3 -- [[iPhone Dev Team]] releases [[PwnageTool]] 1.0, making use of the [[pmdx exploit]] (to patch RSA checks out of the [[kernel]], to write unsigned to [[NOR]])

===March===
* March 12 -- [[iPhone Dev Team|Dev team]] releases dual-boot jailbreak method, only to be silently fixed in 2.0.
* March 4 -- [[User:N000b|George Zhu (n000b)]] releases [[iLiberty / iLiberty+]].

===February===
* February 28 -- [[Cydia Application|Cydia]] is released as an open-source alternative to [[Installer.app]], and prepares to take over the jailbreak application scene upon 2.0's release.
* February 26 -- Apple releases iOS 1.1.4.
* February 11 -- [[User:Zibri|Zibri]] leaks the [[Ramdisk Hack]] in [[ZiPhone]], the first all-in-one unlock, activate, jailbreak solution.
* February 8 -- [[User:Geohot|geohot]] releases software unlock for 4.6. Apple states 25% of phones were never activated with AT&T.

===January===
* January 28 -- [[iPhone Dev Team]] releases [[Soft Upgrade]] jailbreak for 1.1.3.
* January 24 -- [[Nate True]] releases a version of [[iBrickr]] that used the [[Soft Upgrade]] method to jailbreak 1.1.3 for [[M68ap|iPhones]].
* January 18 -- [[User:Geohot|Geohot]] and his friends [http://iphonejtag.blogspot.com/2008/01/112-otb-unlocked.html unlocked 1.1.2 OTB 4.6 by test point], the unbeatable version at that time.
* January 18 -- [[iPhone Dev Team]] posts YouTube video of a jailbroken 1.1.3, which was made possible by the dual boot jailbreak from [[bgm]].
* January 15 -- Apple releases iOS 1.1.3, closing the [[Mknod]] exploit. In addition, everything now runs as "mobile" instead of "root."

== 2007 ==
===November===
* November 15 -- [[Baseband Bootloader|Baseband bootloader]] 4.6 is found on new [[M68ap|iPhone]]s, which initially had no [[unlock]].
* November 12 -- Apple releases iOS 1.1.2, closing the [[LibTiff]] and [[Symlinks]] exploits.
* November 2 -- [[JailbreakMe|AppSnapp]] is released, bringing jailbreaking to the mainstream iPhone user.

===October===
* October 23 -- iPhone-Elite Team releases the [[Virginizer]].
* October 14 -- [[User:AriX|AriX]] releases iJailBreak, the first automated [[n45ap|iPod touch]] jailbreak for the Mac.
* October 12 -- [[User:planetbeing|planetbeing]] releases touchFree, the first automated [[N45ap|iPod touch]] jailbreak.
* October 10 -- niacin, [[cmw]], and dre release the LibTiff exploit to jailbreak the [[N45ap|iPod touch]], which is later adapted for use in [[JailbreakMe|AppSnapp]].

===September===
* September 27 -- Apple releases iOS 1.1.1.
* September 11 -- [[iPhone Dev Team]] releases [[iUnlock]], first free software unlock.
* September 10 -- [[IPSF]] releases first paid software unlock.
* September 9 -- Apple announces the [[N45ap|iPod touch]] at a media event.

===August===
* August 23 -- [[User:Geohot|geohot]] and team release [[hardware unlock]] method.
* August 21 -- [[Installer.app]] is released by Nullriver, first GUI apps are distributed.

===July===
* July 23 -- First phones are used with other carriers by means of [[SIM hacks]].
* July 20 -- nightwatch adapts a [[toolchain]] to the iPhone. The first apps are compiled.
* July 9 -- [[iPhone Dev Team]] releases a [[jailbreak]] method. The first use of this is ringtones.
* July 3 -- DVD Jon first cracks [[activation]]. People can use the apps on the phone without a subscription.

===June===
* June 29 -- [[M68ap|iPhone]] is released. World's most hyped consumer product.
* June 26 -- The [[iPhone Dev Team]] was formed.

Jailbreak (S5L8920+)

2010-11-02T12:30:25Z

Redart: /* ECID */ Typo

When the [[N88ap|iPhone 3GS]] was initially released, Apple did not have enough time to fix the [[0x24000 Segment Overflow]] in the [[S5L8920 (Bootrom)|S5L8920]]. However, in order to flash an exploited [[LLB]] and jailbreak the iPhone 3GS, '''one''' of the following needs to be done:
* Find a new [[iBoot]] exploit every time a new firmware is out.
* Find a way to bypass the [[ECID]] checks.
* Use a bootrom exploit that allows unsigned code execution via USB (2 of them were finally found by Geohot and Chronic Dev Team).

This also applies to the iPhone 3GS with [[iBoot-359.3.2|the new bootrom]], [[N18ap|iPod touch 3G]] and later devices, except a bootrom exploit for the normal boot-chain or a library based jailbreak payload (similar to [[Star]]) is needed as well.

==ECID==
Apple added a new tag to the [[IMG3 File Format]] called ECID. The ECID is ''unique'' to each phone, and its signature is being checked. With this method, Apple attempts to block downgrades once newer firmware becomes available, unless you have a dump of your old firmware's unique IMG3 or signed certificate. Therefore, iBoot exploits won't be so useful for tethered jailbreaks, because such exploits will be closed in new firmwares. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html].

The issue was resolved when Geohot released his [[limera1n]] tool exploiting bootrom security hole which allowed him to upload unsigned iBoot. Still the problem remains with newer devices with [[0x24000 Segment Overflow|0x24000]] fixed - tampering with firmware makes such jailbreak tethered unless some other exploit is used.

There are methods to help keep your downgrading ability, though.

* If it was cached prior to 3.1's release, 3GS owners were able save a file which contains the signature of the 3.0 [[iBSS]] containing their [[ECID]], using the [http://purplera1n.com/ purplera1n website]. A tool has not been created to incorporate this file into a fully signed iBSS, however.
* Saurik's servers are actively caching the necessary files. [http://www.saurik.com/id/12#howto Instructions] to use the servers are included.
* The [[SHSH]] associated with an ECID can be also saved by running [[TinyUmbrella]]. [[TinyUmbrella]] allows the user to restore to whatever version is associated with that [[SHSH]] file permanently. This is based on the aforementioned service [[Saurik]] provides remotely from his server(s).

Release of [[PwnageTool]] 4.1.2 makes storing [[SHSH]]s unnecessary for the time being - there is always a way now for all current iDevices to rollback to jailbroken 4.1 firmware.

==Jailbreak tools==
===[[K48ap|iPad]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.2
|style="width:100px;"| 3.2.1
|style="width:100px;"| 3.2.2
|-
| [[Spirit]]
| {{yes}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{yes}}
|-
| [[greenpois0n]]
| {{no}}
| {{no}}
| {{yes}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{yes|4.1}}
|}

===[[N88ap|iPhone 3GS]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="9"| Works with [[firmware]]...
|-
|style="width:90px;"| 3.0
|style="width:90px;"| 3.0.1
|style="width:90px;"| 3.1
|style="width:90px;"| 3.1.2
|style="width:90px;"| 3.1.3
|style="width:90px;"| 4.0
|style="width:90px;"| 4.0.1
|style="width:90px;"| 4.0.2
|style="width:90px;"| 4.1
|-
| [[purplera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.8}}
| {{yes|0.8}}
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
|-
| [[blackra1n]]
| {{no}}
| {{no}}
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Spirit]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{partial|Restore from a custom firmware2}}
| {{yes|3.1.4}}
|colspan="2" {{partial|Restore from a custom firmware2}}
|colspan="2" {{partial|Restore from a custom firmware with unofficial bundle2}}
| {{yes|4.1}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{partial|1.42 or 2.0.21 2}}
| {{partial|1.5.12 or 2.0.21 2}}
| {{partial|1.71 2 or 2.0.21 2}}
|colspan="3" {{partial|2.0.21 2}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
| [[greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|}
1 [[Tethered jailbreak]] on devices with the [[iBoot-359.3.2|new bootrom]]. Requires usage of the [[usb_control_msg(0x21, 2) Exploit]].

2 Only applicable for devices with the [[iBoot-359.3|old bootrom]]. Requires the device to have signature checks disabled (pwned).

===[[N90ap|iPhone 4]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.1
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
| [[greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1}}
|}

===[[N18ap|iPod touch 3G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="6"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.1.1
|style="width:100px;"| 3.1.2
|style="width:100px;"| 3.1.3
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|-
| [[blackra1n]]
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
|-
| [[Spirit]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.0.21}}
| {{partial|2.0.21}}
| {{partial|1.71 or 2.0.21}}
|colspan="2" {{partial|2.0.21}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
| [[greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1}}
|}
1 [[Tethered jailbreak]]. Requires usage of the [[usb_control_msg(0x21, 2) Exploit]].

===[[N81ap |iPod touch 4G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1
|-
| [[limera1n]]
| {{yes}}
|-
| [[greenpois0n]]
| {{yes}}
|-
| [[PwnageTool]]
| {{yes|4.1}}
|}

Jailbreak (S5L8920+)

2010-11-02T11:20:21Z

Redart: Now keeping SHSHs is unnecessary to downgrade

When the [[N88ap|iPhone 3GS]] was initially released, Apple did not have enough time to fix the [[0x24000 Segment Overflow]] in the [[S5L8920 (Bootrom)|S5L8920]]. However, in order to flash an exploited [[LLB]] and jailbreak the iPhone 3GS, '''one''' of the following needs to be done:
* Find a new [[iBoot]] exploit every time a new firmware is out.
* Find a way to bypass the [[ECID]] checks.
* Use a bootrom exploit that allows unsigned code execution via USB (2 of them were finally found by Geohot and Chronic Dev Team).

This also applies to the iPhone 3GS with [[iBoot-359.3.2|the new bootrom]], [[N18ap|iPod touch 3G]] and later devices, except a bootrom exploit for the normal boot-chain or a library based jailbreak payload (similar to [[Star]]) is needed as well.

==ECID==
Apple added a new tag to the [[IMG3 File Format]] called ECID. The ECID is ''unique'' to each phone, and its signature is being checked. With this method, Apple attempts to block downgrades once newer firmware becomes available, unless you have a dump of your old firmware's unique IMG3 or signed certificate. Therefore, iBoot exploits won't be so useful for tethered jailbreaks, because such exploits will be closed in new firmwares. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html].

The issue was resolved when Geohot released his [[limera1n]] tool exploiting bootrom security hole which allowed him to upload unsigend iBoot. Still the problem remains with newer devices with [[0x24000 Segment Overflow|0x24000]] fixed - tampering with firmware makes such jailbreak tethered unless some other exploit is used.

There are methods to help keep your downgrading ability, though.

* If it was cached prior to 3.1's release, 3GS owners were able save a file which contains the signature of the 3.0 [[iBSS]] containing their [[ECID]], using the [http://purplera1n.com/ purplera1n website]. A tool has not been created to incorporate this file into a fully signed iBSS, however.
* Saurik's servers are actively caching the necessary files. [http://www.saurik.com/id/12#howto Instructions] to use the servers are included.
* The [[SHSH]] associated with an ECID can be also saved by running [[TinyUmbrella]]. [[TinyUmbrella]] allows the user to restore to whatever version is associated with that [[SHSH]] file permanently. This is based on the aforementioned service [[Saurik]] provides remotely from his server(s).

Release of [[PwnageTool]] 4.1.2 makes storing [[SHSH]]s unnecessary for the time being - there is always a way now for all current iDevices to rollback to jailbroken 4.1 firmware.

==Jailbreak tools==
===[[K48ap|iPad]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.2
|style="width:100px;"| 3.2.1
|style="width:100px;"| 3.2.2
|-
| [[Spirit]]
| {{yes}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{yes}}
|-
| [[greenpois0n]]
| {{no}}
| {{no}}
| {{yes}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{yes|4.1}}
|}

===[[N88ap|iPhone 3GS]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="9"| Works with [[firmware]]...
|-
|style="width:90px;"| 3.0
|style="width:90px;"| 3.0.1
|style="width:90px;"| 3.1
|style="width:90px;"| 3.1.2
|style="width:90px;"| 3.1.3
|style="width:90px;"| 4.0
|style="width:90px;"| 4.0.1
|style="width:90px;"| 4.0.2
|style="width:90px;"| 4.1
|-
| [[purplera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.8}}
| {{yes|0.8}}
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
|-
| [[blackra1n]]
| {{no}}
| {{no}}
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Spirit]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{partial|Restore from a custom firmware2}}
| {{yes|3.1.4}}
|colspan="2" {{partial|Restore from a custom firmware2}}
|colspan="2" {{partial|Restore from a custom firmware with unofficial bundle2}}
| {{yes|4.1}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{partial|1.42 or 2.0.21 2}}
| {{partial|1.5.12 or 2.0.21 2}}
| {{partial|1.71 2 or 2.0.21 2}}
|colspan="3" {{partial|2.0.21 2}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
| [[greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|}
1 [[Tethered jailbreak]] on devices with the [[iBoot-359.3.2|new bootrom]]. Requires usage of the [[usb_control_msg(0x21, 2) Exploit]].

2 Only applicable for devices with the [[iBoot-359.3|old bootrom]]. Requires the device to have signature checks disabled (pwned).

===[[N90ap|iPhone 4]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.1
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
| [[greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1}}
|}

===[[N18ap|iPod touch 3G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="6"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.1.1
|style="width:100px;"| 3.1.2
|style="width:100px;"| 3.1.3
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|-
| [[blackra1n]]
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
|-
| [[Spirit]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.0.21}}
| {{partial|2.0.21}}
| {{partial|1.71 or 2.0.21}}
|colspan="2" {{partial|2.0.21}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
| [[greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1}}
|}
1 [[Tethered jailbreak]]. Requires usage of the [[usb_control_msg(0x21, 2) Exploit]].

===[[N81ap |iPod touch 4G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1
|-
| [[limera1n]]
| {{yes}}
|-
| [[greenpois0n]]
| {{yes}}
|-
| [[PwnageTool]]
| {{yes|4.1}}
|}

RiPDev

2010-10-29T10:08:14Z

Redart: /* iPref */ Added some info

RiPDev (Russian iPhone Developers) was a popular group of iPhone software developers, created in 2007 by Slava Karpenko aka [https://twitter.com/slavikus @slavikus]. First product of that team was free Russian Keyboard as part of commercial Russian Project for iPhone OS 1.x.x. Later RiPDev made many very useful applications such as 'Hood,' an SBSettings alternative. They made Icy, a popular [[APT]] package installer. As of iOS 4, most of their iOS projects no longer work.

They made an application called InstallerApp that allowed users to install jailbroken apps on a device via the computer. It worked for some time than slowly faded away since not many users wanted to pay for it. It was a very well made application and soon enough RipDev gave up on the project. They have several language packages and most of their software had language options for over 30 languages.

RiPDev was heavily criticised by well-known Russian blogger Eldar Murtazin for illegal enterprise since they never paid any taxes for their revenues.

The team was dismissed in the late 2009, when it became obvious that it had no working business model.

==Icy==
[[Image:IcyIcon.png|75px|right]]
Icy is a lightweight APT package installer that was both themeable and produced in over 30 languages. It works perfectly on 2.x-3.1.2, and it is being updated by many for iOS 4. Icy was a very advanced installer but had its issues. RiPDev tried to reinvent APT and in return lost a lot of popular features and made the repository owners have to do a lot more work then repository owners would have for [[Cydia Application|Cydia]]. [[Saurik]] explained this when Icy was released some time back.

==Hood==
[[Image:Hood1.png|200px|right]]
Hood was an alternative to [[SBSettings]]. The arrow on the bottom of the window, when clicked would bring up a process list were you can kill user processes, a long with a wifi on-off toggle, Bluetooth on-off, Edge on-off and the last button was customizable to either close the current application, or respring.

==InstallerApp==
InstallerApp was said to be the 'iTunes for jailbreakers'. It allowed users to install apps from repositories, download, and install immediatly which was a much better solution then having to decide between [[Cydia Application|Cydia]] and Installer (Predecessor to Icy). Sadly this application took a lot of work to make true, and never really became a hit in the community. The Russian iPhone Developers never released the source to this application since users had to pay for it. The application had many features, One of the main was called "Pusher" which asked you to put your device into DFU mode, then uploaded the RipDev application titled Pusher to your device, and from there would install all of your applications that you downloaded.

==i2Reader Pro==
Apple details it as an innovate, award winning eBook reader. Development of app continued by one of former RiPDev members under Unsanity brand. It is now in the [http://itunes.apple.com/app/i2reader/id322680924?mt=8 App Store] and is still a very successful eBook reader to this day.

==iPref==
[http://itunes.apple.com/app/ipref/id299918217?mt=8 iPref] is a Preference card game that has a great User Interface and defiantly had a lot of work put into it. There was a controversary
on whether game algorithms were stolen from [http://sourceforge.net/projects/openpref/ OpenPref] project without permission of its mantainer.

==Kate==
Kate is a package of unique tools and tweaks for your iDevice. There were individual packages that you could install that could give you more customization options geared towards making your iDevice way more productive and Entertaining. There were business tools, quick contact searches, system font replacements, lockscreen calendar, and a Smart Dialer . Was originally named Caterpillar

==More==
RipDev had made several more amazing projects and several of them have taken on new lives in the App Store such as their famous Pool game. RipDev is no longer making products or supporting the ones they have. RipDev's repo closed around October 1st and the RussianApple repository has their products stored on their repository at [http://repo.russianapple.ru http://repo.russianapple.ru]. Many of these products do not work on iOS4 sadly.

RiPDev

2010-10-29T09:55:29Z

Redart: /* i2Reader Pro */ Added link

RiPDev (Russian iPhone Developers) was a popular group of iPhone software developers, created in 2007 by Slava Karpenko aka [https://twitter.com/slavikus @slavikus]. First product of that team was free Russian Keyboard as part of commercial Russian Project for iPhone OS 1.x.x. Later RiPDev made many very useful applications such as 'Hood,' an SBSettings alternative. They made Icy, a popular [[APT]] package installer. As of iOS 4, most of their iOS projects no longer work.

They made an application called InstallerApp that allowed users to install jailbroken apps on a device via the computer. It worked for some time than slowly faded away since not many users wanted to pay for it. It was a very well made application and soon enough RipDev gave up on the project. They have several language packages and most of their software had language options for over 30 languages.

RiPDev was heavily criticised by well-known Russian blogger Eldar Murtazin for illegal enterprise since they never paid any taxes for their revenues.

The team was dismissed in the late 2009, when it became obvious that it had no working business model.

==Icy==
[[Image:IcyIcon.png|75px|right]]
Icy is a lightweight APT package installer that was both themeable and produced in over 30 languages. It works perfectly on 2.x-3.1.2, and it is being updated by many for iOS 4. Icy was a very advanced installer but had its issues. RiPDev tried to reinvent APT and in return lost a lot of popular features and made the repository owners have to do a lot more work then repository owners would have for [[Cydia Application|Cydia]]. [[Saurik]] explained this when Icy was released some time back.

==Hood==
[[Image:Hood1.png|200px|right]]
Hood was an alternative to [[SBSettings]]. The arrow on the bottom of the window, when clicked would bring up a process list were you can kill user processes, a long with a wifi on-off toggle, Bluetooth on-off, Edge on-off and the last button was customizable to either close the current application, or respring.

==InstallerApp==
InstallerApp was said to be the 'iTunes for jailbreakers'. It allowed users to install apps from repositories, download, and install immediatly which was a much better solution then having to decide between [[Cydia Application|Cydia]] and Installer (Predecessor to Icy). Sadly this application took a lot of work to make true, and never really became a hit in the community. The Russian iPhone Developers never released the source to this application since users had to pay for it. The application had many features, One of the main was called "Pusher" which asked you to put your device into DFU mode, then uploaded the RipDev application titled Pusher to your device, and from there would install all of your applications that you downloaded.

==i2Reader Pro==
Apple details it as an innovate, award winning eBook reader. Development of app continued by one of former RiPDev members under Unsanity brand. It is now in the [http://itunes.apple.com/app/i2reader/id322680924?mt=8 App Store] and is still a very successful eBook reader to this day.

==iPref==
[http://itunes.apple.com/app/ipref/id299918217?mt=8 iPref] is a Preference card game that has a great User Interface and defiantly had a lot of work put into it.

==Kate==
Kate is a package of unique tools and tweaks for your iDevice. There were individual packages that you could install that could give you more customization options geared towards making your iDevice way more productive and Entertaining. There were business tools, quick contact searches, system font replacements, lockscreen calendar, and a Smart Dialer . Was originally named Caterpillar

==More==
RipDev had made several more amazing projects and several of them have taken on new lives in the App Store such as their famous Pool game. RipDev is no longer making products or supporting the ones they have. RipDev's repo closed around October 1st and the RussianApple repository has their products stored on their repository at [http://repo.russianapple.ru http://repo.russianapple.ru]. Many of these products do not work on iOS4 sadly.

RiPDev

2010-10-29T09:54:08Z

Redart: /* iPref */ Added link

RiPDev (Russian iPhone Developers) was a popular group of iPhone software developers, created in 2007 by Slava Karpenko aka [https://twitter.com/slavikus @slavikus]. First product of that team was free Russian Keyboard as part of commercial Russian Project for iPhone OS 1.x.x. Later RiPDev made many very useful applications such as 'Hood,' an SBSettings alternative. They made Icy, a popular [[APT]] package installer. As of iOS 4, most of their iOS projects no longer work.

They made an application called InstallerApp that allowed users to install jailbroken apps on a device via the computer. It worked for some time than slowly faded away since not many users wanted to pay for it. It was a very well made application and soon enough RipDev gave up on the project. They have several language packages and most of their software had language options for over 30 languages.

RiPDev was heavily criticised by well-known Russian blogger Eldar Murtazin for illegal enterprise since they never paid any taxes for their revenues.

The team was dismissed in the late 2009, when it became obvious that it had no working business model.

==Icy==
[[Image:IcyIcon.png|75px|right]]
Icy is a lightweight APT package installer that was both themeable and produced in over 30 languages. It works perfectly on 2.x-3.1.2, and it is being updated by many for iOS 4. Icy was a very advanced installer but had its issues. RiPDev tried to reinvent APT and in return lost a lot of popular features and made the repository owners have to do a lot more work then repository owners would have for [[Cydia Application|Cydia]]. [[Saurik]] explained this when Icy was released some time back.

==Hood==
[[Image:Hood1.png|200px|right]]
Hood was an alternative to [[SBSettings]]. The arrow on the bottom of the window, when clicked would bring up a process list were you can kill user processes, a long with a wifi on-off toggle, Bluetooth on-off, Edge on-off and the last button was customizable to either close the current application, or respring.

==InstallerApp==
InstallerApp was said to be the 'iTunes for jailbreakers'. It allowed users to install apps from repositories, download, and install immediatly which was a much better solution then having to decide between [[Cydia Application|Cydia]] and Installer (Predecessor to Icy). Sadly this application took a lot of work to make true, and never really became a hit in the community. The Russian iPhone Developers never released the source to this application since users had to pay for it. The application had many features, One of the main was called "Pusher" which asked you to put your device into DFU mode, then uploaded the RipDev application titled Pusher to your device, and from there would install all of your applications that you downloaded.

==i2Reader Pro==
Apple details it as an innovate, award winning eBook reader. Development of app continued by one of former RiPDev members under Unsanity brand. It is now in the App Store and is still a very successful eBook reader to this day.

==iPref==
[http://itunes.apple.com/app/ipref/id299918217?mt=8 iPref] is a Preference card game that has a great User Interface and defiantly had a lot of work put into it.

==Kate==
Kate is a package of unique tools and tweaks for your iDevice. There were individual packages that you could install that could give you more customization options geared towards making your iDevice way more productive and Entertaining. There were business tools, quick contact searches, system font replacements, lockscreen calendar, and a Smart Dialer . Was originally named Caterpillar

==More==
RipDev had made several more amazing projects and several of them have taken on new lives in the App Store such as their famous Pool game. RipDev is no longer making products or supporting the ones they have. RipDev's repo closed around October 1st and the RussianApple repository has their products stored on their repository at [http://repo.russianapple.ru http://repo.russianapple.ru]. Many of these products do not work on iOS4 sadly.

RiPDev

2010-10-29T09:51:18Z

Redart: /* i2Reader Pro */ Unsanity=RiPDev

RiPDev (Russian iPhone Developers) was a popular group of iPhone software developers, created in 2007 by Slava Karpenko aka [https://twitter.com/slavikus @slavikus]. First product of that team was free Russian Keyboard as part of commercial Russian Project for iPhone OS 1.x.x. Later RiPDev made many very useful applications such as 'Hood,' an SBSettings alternative. They made Icy, a popular [[APT]] package installer. As of iOS 4, most of their iOS projects no longer work.

They made an application called InstallerApp that allowed users to install jailbroken apps on a device via the computer. It worked for some time than slowly faded away since not many users wanted to pay for it. It was a very well made application and soon enough RipDev gave up on the project. They have several language packages and most of their software had language options for over 30 languages.

RiPDev was heavily criticised by well-known Russian blogger Eldar Murtazin for illegal enterprise since they never paid any taxes for their revenues.

The team was dismissed in the late 2009, when it became obvious that it had no working business model.

==Icy==
[[Image:IcyIcon.png|75px|right]]
Icy is a lightweight APT package installer that was both themeable and produced in over 30 languages. It works perfectly on 2.x-3.1.2, and it is being updated by many for iOS 4. Icy was a very advanced installer but had its issues. RiPDev tried to reinvent APT and in return lost a lot of popular features and made the repository owners have to do a lot more work then repository owners would have for [[Cydia Application|Cydia]]. [[Saurik]] explained this when Icy was released some time back.

==Hood==
[[Image:Hood1.png|200px|right]]
Hood was an alternative to [[SBSettings]]. The arrow on the bottom of the window, when clicked would bring up a process list were you can kill user processes, a long with a wifi on-off toggle, Bluetooth on-off, Edge on-off and the last button was customizable to either close the current application, or respring.

==InstallerApp==
InstallerApp was said to be the 'iTunes for jailbreakers'. It allowed users to install apps from repositories, download, and install immediatly which was a much better solution then having to decide between [[Cydia Application|Cydia]] and Installer (Predecessor to Icy). Sadly this application took a lot of work to make true, and never really became a hit in the community. The Russian iPhone Developers never released the source to this application since users had to pay for it. The application had many features, One of the main was called "Pusher" which asked you to put your device into DFU mode, then uploaded the RipDev application titled Pusher to your device, and from there would install all of your applications that you downloaded.

==i2Reader Pro==
Apple details it as an innovate, award winning eBook reader. Development of app continued by one of former RiPDev members under Unsanity brand. It is now in the App Store and is still a very successful eBook reader to this day.

==iPref==
iPref was a very innovative card game that had a great User Interface and defiantly had a lot of work put into it. Sadly iPref does not work on anything higher than 3.1.3 and it is /not/ in the App Store although several people have offered to continue the project. Most of the people who paid for a copy of iPref can no longer use theirs because the ripdev web site has been shut down making it impossible for the application to authorize the activation code.
==Kate==
Kate is a package of unique tools and tweaks for your iDevice. There were individual packages that you could install that could give you more customization options geared towards making your iDevice way more productive and Entertaining. There were business tools, quick contact searches, system font replacements, lockscreen calendar, and a Smart Dialer . Was originally named Caterpillar

==More==
RipDev had made several more amazing projects and several of them have taken on new lives in the App Store such as their famous Pool game. RipDev is no longer making products or supporting the ones they have. RipDev's repo closed around October 1st and the RussianApple repository has their products stored on their repository at [http://repo.russianapple.ru http://repo.russianapple.ru]. Many of these products do not work on iOS4 sadly.

Talk:Incomplete Codesign Exploit

2010-10-21T07:44:07Z

Redart:

This has to be one of the most puzzling exploits in iOS. Since it was revealed in 3.1.3/3.2, Apple has yet to close it in 4.0, 4.02, or 4.1 or even 4.2 betas.

Somehow, once you stick a dynamic library or other goody with some sort of "incomplete codesign" magic in the right location and add a startup service, iOS will execute it. Perhaps Apple has no way to fix this without breaking other things?
[[User:Iemit737|Iemit737]] 00:23, 10 October 2010 (UTC)

AFAIK IncompleteCodesignExploit is an exploit in WWDR Cert Checking that allows ppl to create fake entitlements. Obviously I'm not sure it works in this way. --[[User:Qwertyoruiop|Qwertyoruiop]] 00:41, 10 October 2010 (UTC)

Should we decribe it or is it better to wait until Apple fixes it? --[[User:Redart|Redart]] 07:44, 21 October 2010 (UTC)

RiPDev

2010-10-19T18:38:13Z

Redart:

RiPDev (Russian iPhone Developers) was a popular group of iPhone software developers, created in 2007 by Slava Karpenko aka [http://twitter.com/#!/slavikus @slavikus]. First product of that team was free Russian Keyboard as part of commercial Russian Project for iPhone OS 1.x.x. Later RipDev made many very useful applications such as 'Hood' which was an [[SBsettings]] alternative. They made Icy, a popular [[APT]] package installer. Most of their iOS Projects no longer work on versions of iOS4 or higher.[[Image:IcyIcon.png|180px|right]]

They made an application called InstallerApp that allowed users to install jailbroken apps on a device via the computer. It worked for some time than slowly faded away since not many users wanted to pay for it. It was a very well made application and soon enough RipDev gave up on the project. They have several language packages and most of their software had language options for over 30 languages.

RiPDev was heavily criticised by well-known Russian blogger Eldar Murtazin for illegal enterprise since they never paid any taxes for their revenues.

The team was dismissed in the late 2009, when it became obvious that it has no working business model.

==Icy==
Icy is a lightweight APT package installer that was both themeable, and was produced in over 30 languages. It works perfectly on 2.x-3.1.2, and it is being updated by many for iOS4. Icy was a very advanced installer but had its issues. RiPDev tried to reinvent APT and in return lost a lot of popular features and made the repository owners have to do a lot more work then repository owners would have for [[Cydia]]. [[Saurik]] explained this when Icy was released some time back.

RiPDev

2010-10-19T18:37:08Z

Redart:

RiPDev (Russian iPhone Developers) was a popular group of iPhone software developers, created in 2007 by Slava Karpenko aka [http://twitter.com/#!/slavikus @slavikus]. First product of that team was free Russian Keyboard as part of commercial Russian Project for iPhone OS 1.x.x. Later RipDev made many very useful applications such as 'Hood' which was an [[SBsettings]] alternative. They made Icy, a popular [[APT]] package installer. Most of their iOS Projects no longer work on versions of iOS4 or higher.[[Image:IcyIcon.png|180px|right]]

They made an application called InstallerApp that allowed users to install jailbroken apps on a device via the computer. It worked for some time than slowly faded away since not many users wanted to pay for it. It was a very well made application and soon enough RipDev gave up on the project. They have several language packages and most of their software had language options for over 30 languages.

RipDev was criticised by well-known Russian blogger Eldar Murtazin for illegal enterprise since they never paid any taxes for their revenues.

The team was closed in the late 2009, when it became obvious that it has no working business model.

==Icy==
Icy is a lightweight APT package installer that was both themeable, and was produced in over 30 languages. It works perfectly on 2.x-3.1.2, and it is being updated by many for iOS4. Icy was a very advanced installer but had its issues. RiPDev tried to reinvent APT and in return lost a lot of popular features and made the repository owners have to do a lot more work then repository owners would have for [[Cydia]]. [[Saurik]] explained this when Icy was released some time back.

RiPDev

2010-10-19T18:35:00Z

Redart: Moved paragraph

RipDev (Russian iPhone Developers) was a popular group of iPhone software developers, created in 2007 by Slava Karpenko aka [http://twitter.com/#!/slavikus @slavikus]. First product of that team was free Russian Keyboard as part of commercial Russian Project for iPhone OS 1.x.x. Later RipDev made many very useful applications such as 'Hood' which was an [[SBsettings]] alternative. They made Icy, a popular [[APT]] package installer. Most of their iOS Projects no longer work on versions of iOS4 or higher.[[Image:IcyIcon.png|180px|right]]

They made an application called InstallerApp that allowed users to install jailbroken apps on a device via the computer. It worked for some time than slowly faded away since not many users wanted to pay for it. It was a very well made application and soon enough RipDev gave up on the project. They have several language packages and most of their software had language options for over 30 languages.

RipDev was criticised by well-known Russian blogger Eldar Murtazin for illegal enterprise since they never paid any taxes for their revenues.

The team was closed in the late 2009, when it became obvious that it has no working business model.

==Icy==
Icy is a lightweight APT package installer that was both themeable, and was produced in over 30 languages. It works perfectly on 2.x-3.1.2, and it is being updated by many for iOS4. Icy was a very advanced installer but had its issues. RiPDev tried to reinvent APT and in return lost a lot of popular features and made the repository owners have to do a lot more work then repository owners would have for [[Cydia]]. [[Saurik]] explained this when Icy was released some time back.

RiPDev

2010-10-19T18:34:11Z

Redart: Some info

RipDev (Russian iPhone Developers) was a popular group of iPhone software developers, created in 2007 by Slava Karpenko aka [http://twitter.com/#!/slavikus @slavikus]. First product of that team was free Russian Keyboard as part of commercial Russian Project for iPhone OS 1.x.x. Later RipDev made many very useful applications such as 'Hood' which was an [[SBsettings]] alternative. They made Icy, a popular [[APT]] package installer. Most of their iOS Projects no longer work on versions of iOS4 or higher.[[Image:IcyIcon.png|180px|right]]

They made an application called InstallerApp that allowed users to install jailbroken apps on a device via the computer. It worked for some time than slowly faded away since not many users wanted to pay for it. It was a very well made application and soon enough RipDev gave up on the project. They have several language packages and most of their software had language options for over 30 languages.

==Icy==
Icy is a lightweight APT package installer that was both themeable, and was produced in over 30 languages. It works perfectly on 2.x-3.1.2, and it is being updated by many for iOS4. Icy was a very advanced installer but had its issues. RiPDev tried to reinvent APT and in return lost a lot of popular features and made the repository owners have to do a lot more work then repository owners would have for [[Cydia]]. [[Saurik]] explained this when Icy was released some time back.

RipDev was criticised by well-known Russian blogger Eldar Murtazin for illegal enterprise since they never paid any taxes for their revenues.

The team was closed in the late 2009, when it became obvious that it has no working business model.

Star

2010-10-13T12:54:57Z

Redart: Some clarification

[[Image:Star.jpg|thumb|Star on an [[N72ap|iPod touch 2G]].]]
Star is a userland [[jailbreak]] from [[User:Comex|comex]] that utilizes two new exploits to jailbreak iOS 3.1.2 through 4.0.1 (except for 3.2.2). Star warns that 3.1.2 and 3.1.3 are known to fail on [[N18ap|iPod touch 3G]], and that performing a fresh restore to 4.0(.1) is recommended. It can be used via [[JailbreakMe]]. With the release of iOS 4.0.2 (and iOS 3.2.2 for [[K48ap|iPad]]s) on 11 August 2010, the vulnerabilities were fixed so that it doesn't work anymore.

==Payloads==
*[[PDF CFF Font Stack Overflow]] The first payload is deployed via a HTTP redirect to a PDF file. The PDF contains a CFF font with a malformed type 2 charstring, which contains commands to repeatedly push and duplicate random numbers onto an "argument stack". This allows arbitrary code execution due to stack overflow in CFF parser inside FreeType 2 library used by iPhone. Then an integer overflow in [[IOSurface Kernel Exploit|IOSurface.framework]] used to get root access and privileges.[http://support.apple.com/kb/HT4291]
*The second payload (wad.bin) contains Cydia and code to install it into filesystem.

==PDF Patch==
Because this jailbreak revealed a new major security hole in iOS, it could also be adopted by rogue developers to create malware to take over your [[iPad]]/[[iPhone]]/[[iPod touch]]. Therefore it is highly recommended to install [https://twitter.com/saurik/status/20958834996 the patch] [[saurik]] released via Cydia in order to keep your device safe.

==Analysys==
First, the process uses the PDF Compact Font Format vulnerability (CVE-2010-1797). To our surprise, it’s a simple stack-based buffer overflow. With this vulnerability, an overly long CFF charString entry ends up with attacker-controlled $pc. Many people think of Return Oriented Programming (ROP) as a rather immature technique to use for complicated jobs. But the jailbreakme shellcode uses ROP to execute more than a total of 150 API calls. This means non-executable memory is not a defense against these kinds of memory corruption attacks. Looks as if the current ROP technique for iPhone exploitation is very mature and stable.

The ROP payload actually abuses an undisclosed kernel vulnerability residing in an IOSurface component from Apple. It seems that the vulnerability allows a normal process to have access to kernel memory with write privileges. After it modifies kernel space data to circumvent security checks, it calls “setuid(0)” to get root access. So, the game is pretty much over at this point. The Safari process at this point has root user privileges, and it can do whatever it wants.

After this exploitation phase, it drops the “installui.dylib” shared library, loads it, and executes the “iui_go” function from the library. This allows some UI text to be displayed on the user’s screen to ask whether to go forward with jailbreaking. Then it downloads the “wad.bin” file from the jailbreakme site and extracts necessary files like “install.dylib” from there, and then executes the “do_install” function from there, which will do the typical jailbreaking process. All these operations are possible because the Safari process has root access acquired using the kernel bug.

The jailbreaking phase involves something like moving some system directories and modifying essential system files like “/etc/fstab”. Also it directly accesses the “/dev/kmem” device to patch kernel flags or code. And finally it installs the “Cydia” installer package and restarts SpringBoard using the “uicache” command.

via[http://www.gadgetsdna.com/iphone-ios-4-0-1-jailbreak-execution-flow-using-pdf-exploit/5456/]

==Links==
*[http://github.com/comex/star Sourcecode for Star]

Star

2010-10-13T12:48:33Z

Redart: /* Payloads */ Added link

IOSurface Kernel Exploit

2010-10-13T12:26:43Z

Redart:

This vulnerability, along with the [[Malformed_CFF_Vulnerability]], was used in [[Star]]/[[JailbreakMe]] 2.0. It is a buffers overflow in the handling of the [http://iphonedevwiki.net/index.php/IOCoreSurfaceRoot kernel-extension for managing pixel buffers] used to get root privileges.

== exploit ==

Selector 19 was Vulnerability to a buffers overflow that allow access to the root filesystem without making the kernel fail signature checks

{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! Selector !! Action !! Input !! Output
|-
| 0 || lookupFromMachPort || - || 1,208 bytes of stuff
|-
| 1 || release || IOSurfaceID ''surfaceID'' || -
|-
| 2 || lock || struct IOSurfaceLockArg || 1,208 bytes of stuff
|-
| 3 || unlock || struct IOSurfaceLockArg || struct IOSurfaceLockSeedArg
|-
| 4 || lockPlane || struct IOSurfaceLockArg || 1,208 bytes of stuff
|-
| 5 || unlockPlane || struct IOSurfaceLockArg || struct IOSurfaceLockSeedArg
|-
| 6 || lookup || void* ''???'' || 1,208 bytes of stuff
|-
| 7 || setYCbCrMatrix || IOSurfaceID ''surfaceID'', uint32_t ''YCbCrMatrix'' || -
|-
| 8 || wrapClientImage || 28 bytes of stuff || 1,208 bytes of stuff
|-
| 9 || wrapClientMemory || void* ''param0'', void* ''param1'' || 1,208 bytes of stuff
|-
| 10 || getYCbCrMatrix || IOSurfaceID ''surfaceID'' || uint32_t ''YCbCrMatrix''
|-
| 11 || setValue || ? || -
|-
| 12 || getValueMethod || ? || ?
|-
| 13 || kIOSurfaceMethodRemoveValue || ? || -
|-
| 14 || bindAccel || IOSurfaceID ''surfaceID'', void* ''unknown0'', void* ''unknown4'' || -
|-
| 15 || bindAccelOnPlane || IOSurfaceID ''surfaceID'', void* ''param1'', void* ''param2'', size_t ''planeIndex'' || -
|-
| 16 || readLimits || - || 20 bytes of stuff.
|-
| 17 || kIOSurfaceMethodIncrementUseCount || IOSurfaceID ''surfaceID'' || -
|-
| 18 || kIOSurfaceMethodDecrementUseCount || IOSurfaceID ''surfaceID'' || -
|-
| 19 || ? || void* ''???'' || void* ''???''
|-
| 20 || setSurfaceNotify || 24 bytes of stuff || -
|-
| 21 || removeSurfaceNotify || 24 bytes of stuff || -
|}

== Credit ==
[[User:Comex|comex]]

Pwnage

2010-10-13T09:22:44Z

Redart: Copied some historical info from various sources...

This exploit is in the [[S5L8900]] bootrom, thus available in the iPhone, iPod Touch and iPhone 3G. The exploit is that the bootrom doesn't signature check [[LLB]].

==Credit==
[[iPhone Dev Team]]

==Exploit==
===[[S5L8900]]===
Pwnage exploits a bad chain of trust in the boot sequence of the S5L8900 device. The boot sequence includes LLB and iBoot modules which are stored in device NOR flash and are typically encrypted (as of 1.1.*). However, they are not signed with RSA signature at that point, because the 8900 container is dropped away before the file is written to NOR flash. Pwnage exploits this vulnerability.

'''Apple's (incorrect) Boot Sequence Security Assumptions'''

First, Apple assumes that if something is in the NOR flash, it had necessarily passed through an RSA signature verification, and is therefore authentic Apple code. This is incorrect, because the only mechanism preventing the writing of unauthorized code to the NOR flash is the kernel. The iPhone/iPod Touch kernel contains an extension designed specifically to write to the NOR flash, called AppleImage2NORAccess. This extension performs an RSA signature verification on any data it tries to write. The verification itself is performed by the Fairplay extension, which is heavily obfuscated, but neutering the check is very simple. After the check is patched out, anything can be written to the NOR flash.

Second, Apple assumes that disabling the encryption keys in “normal” environment will prevent from writing firmware files to the NOR flash. Luckily, we have found a way to run our code in “secure” environment and use AppleImage2NORAccess extension the same way as Apple does it on restore.

'''Pre-2.0'''

The [[NOR]] was set up in a way that when the firmware images were flashed there, the RSA signatures were dropped along with the rest of the firmware container. So although [[iBoot]] signature checked the [[kernel]], [[LLB]] did not signature check [[iBoot]], and the [[VROM]] did not signature check [[LLB]].

Pwnage starts by booting from a memory device (ramdisk) in “secure” environment to prevent the kernel from disabling encryption keys. Also, we add another memory device, pointed at the kernel's address space, to allow live kernel patching. After booting up, we patch out signature check from AppleImage2NorAccess extention and proceed with flashing our custom firmware files (iBoot, LLB, DeviceTree, and pictures). Because the signature check has been patched out, and encryption keys are available, AppleImage2NORAccess happily writes them to the suitable location in NOR flash. After that, the device can be restarted, and will accept any unsigned 8900 file without complaint.

'''iBoot Patch'''

One specific aspect of our attack that is worth examining more closely is the iBoot patch. iBoot is the last and most complicated bootloader on the devices, and is what actually loads up the kernel with device tree. However, Apple made the decision to keep all the PKE (Public Key Encryption) logic out of iBoot, instead putting it in the secure bootloader. Thus, iBoot actually jumps into the secure bootloader when it wants to verify the authenticity of an 8900 file. This makes it hard to directly patch out the RSA signature verification from iBoot, as it actually occurs in the secure bootloader. Simply killing the jump into the secure bootloader is impossible, as it also fills in other information iBoot needs to proceed.

Because of the tight coupling between the secure bootloader and the higher-level bootloaders, Apple gave us a solution: the secure bootloader often needs to call functions in the higher-level bootloaders, but it has the problem of knowing where to jump, as functions move around in different revisions. To get around this, Apple made thunks out of the function calls, and makes the higher-level bootloaders patch the secure bootloader on the fly (in RAM) with the relevant jump addresses. They just copy the secure bootloader into RAM and blindly apply a list of patches to it. We exploited this pre-existing patching mechanism to patch out the RSA signature verification from secure bootloader.

'''2.0+'''

While images are now written to [[NOR]] in a way that one can verify the other, like [[LLB]] verifying [[iBoot]], the [[VROM (S5L8900)|bootrom]] cannot be written to, so it still defaults to just reading [[LLB]] normally, un-signature checked.

Bootrom has a vulnerability in DFU mode when processesing iBoot certificates which are on a DER format. It copies all the certificate information onto the stack, but the signature itself is copied without any sort of bounds checking. So then you have classic stack buffer overflow and then you just make the signature checking function return true.

[[25C3 presentation Hacking the iPhone|More info]].

===[[S5L8720]] and on===
This exploit has been fixed on the [[N72ap|iPod touch 2G]] and all devices released after it. The [[VROM (S5L8720)|bootrom]] sigchecks [[LLB]] before jumping to it now, and if the [[LLB]] is patched, it will default to [[DFU Mode]]. The [[0x24000 Segment Overflow]] exploit was later found in the first revisions of the [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]] [[bootrom]]s, allowing the device to be fully jailbroken. It has since been fixed with new bootrom revisions for these devices. Newer devices were never susceptible to the [[0x24000 Segment Overflow]].

==Implementation==
* [[PwnageTool]]
* [[iPhoneLinux]]

[[Category:Jailbreaks]]
[[Category:Exploits]]
[[Category:VROM]]

25C3 presentation "Hacking the iPhone"

2010-10-13T07:53:18Z

Redart: /* Part 1: Applications Processor (by planetbeing) */ Formatting

{{DISPLAYTITLE:25C3 presentation "Hacking the iPhone"}}
This was a presentation held on the 27 December 2008 at the [http://events.ccc.de/congress/2008/wiki/Main_Page/ 25th Chaos Communication Congress (25C3)] in Berlin. Speakers were [[pytey]], [[User:planetbeing|planetbeing]] and [[User:MuscleNerd|MuscleNerd]].

The presentation explained the inner workings of the iOS architecture, its security, and how it was circumvented. [http://events.ccc.de/congress/2008/Fahrplan/events/2976.en.html Short event description]

During the presentation [[User:MuscleNerd|MuscleNerd]] wanted to show the [http://qik.com/video/729275 video of a live demo of the unlock] with ([[yellowsn0w]]), but skipped it because of the missing time. This video was actually released [[Timeline#December|some days before]].

== Conference Recordings ==
* [http://vimeo.com/2646755?pg=embed&sec=2646755 Conference recording video on Vimeo]
* [http://mirror.netcologne.de/CCC/25C3/video_h264_720x576/25c3-2976-en-hacking_the_iphone.mp4 Conference recording video in H264] or [ftp://ftp.ccc.de/congress/25c3/video_h264_720x576/25c3-2976-en-hacking_the_iphone.mp4 via FTP] or [http://ftp.ccc.de/congress/25c3/video_h264_720x576/25c3-2976-en-hacking_the_iphone.mp4.torrent torrent link]. This version is the best quality available.
* [http://derchris.eu/ccc/25C3/video_h264_iPod/25c3-2976-en-hacking_the_iphone.ipod.m4v Conference recording video in M4V]
* [http://bork.informatik.uni-erlangen.de/pub/ccc/25c3/audio_only/25c3-2976-en-hacking_the_iphone.mp3 Conference recording as MP3 audio]
* [http://ftp.uni-kl.de/25C3/audio_only/25c3-2976-en-hacking_the_iphone.ogg Conference recording as OGG audio]
* [http://events.ccc.de/congress/2008/wiki/Conference_Recordings/index.html Official download page] (look for presentation 2976)
* [http://ftp.ccc.de/congress/25c3/ Official FTP server] (look for presentation 2976)

The presentation slides are currently not available. Maybe one of the presentators can upload them here or post a link.

== Transcript of the presentation ==

[[Image:25C3_A01.png|thumb|left|A01]]
=== Start ===
Good evening everybody. I would like to introduce the [[iPhone Dev Team]] who are here to give a talk on iPhone hacking. So if you join me to give a round full of applause please.

=== Introduction (by [[pytey]]) ===
Good evening ladies and gentlemen. Here’s a little slide show here for you. [[Image:25C3_B01.png|thumb|B01]] This is a slide called hacking the iPhone. I’ll give a little history here about [[iPhone Dev Team|our little crew]]. [[Image:25C3_B02.png|thumb|left|B02]] We formed in [[Timeline#June_4|June 2007]], just before the release of the [[M68ap|original iPhone]]. We’re original hardware hackers and device enthusiasts, based around Apple products and we sort of rather say towards the iPhone as a platform. We exist on [[wikipedia:Internet Relay Chat|IRC]]. This is the first time most of us have met each other. Originally there was a couple of channels on the osx86.hu server. [[Image:25C3_B03.png|thumb|B03]] We’ve got a wide membership: Germany, Belgium, France, Russia, Hungary, USA, Israel. And during those initial few months of the [[M68ap|iPhone first generation]] DHL and FedEx shipped around a lot of US phones to us. [[Image:25C3_B04.png|thumb|left|B04]] We’ve got some statistics here of our little site. We’ve had about 1.7 million visits in the last month. [[Image:25C3_B05.png|thumb|B05]] Fifty, sixty thousand unique visitors per day and various networks around. [[Image:25C3_B06.png|thumb|left|B06]] We’ve got a tool called [[PwnageTool|Pwnage tool]] and another tool called [[QuickPwn]] which is viewed here as the next good project. [[Image:25C3_B07.png|thumb|B07]] It’s a [[wikipedia:Cocoa (API)|Cocoa]] application. It’s got 20,000 lines of code. [[QuickPwn]] has got 15,000 lines of code. There’s also other platforms: Windows and Linux as well. We’ve had 3.6 million [[wikipedia:Sparkle (software)|Sparkle]] updates since we last deleted our logs, which was in the 16th of July. We try to release patches when Apple releases an iPhone update. [[Image:25C3_B08.png|thumb|left|B08]] We try to get patches out 24-48 hours after the release of those updates. And the modular bundle sets for cross-platform use. We use [[[wikipedia:Sparkle (software)|Sparkle]] for updates for the Mac platform, as I mentioned. An interesting lead: There’s a 180 very active users from Apple who update their [[QuickPwn]] and [[PwnageTool|Pwnage tool]] on a regular basis, so I think they like our software, which is pretty cool. Thank you very much Apple. (big applause)

[[Image:25C3_B09.png|thumb|B09]] I’ll just introduce my colleagues here. We’ve got [[User:Bushing|bushing]] on the end. He’s one of the guys. This is [[User:MuscleNerd|MuscleNerd]] (laughter) - I don’t know why. This is [[User:Planetbeing|planetbeing]]. And we’ve got a bunch of other guys here we don’t want to be identified for obvious reasons, but they’re over there wearing Pwn-Apple T-shirts. And they speak Russian. (laughter) Say hi guys! (applause)

So with that further I’ll hand you over to [[User:Planetbeing|planetbeing]] who’s gonna talk a bit about the applications processor side of the iPhone. Thanks.

=== Part 1: Applications Processor (by [[User:Planetbeing|planetbeing]]) ===
[[Image:25C3_C01.png|thumb|left|C01]] So my talk is gonna be about the application’s processor side. That’s the chip that runs the [[iOS|iPhone OS]] in all the racing car games that you all see in the [[App Store]]. [[Image:25C3_C02.png|thumb|C02]] It’s only related to the [[Unlock|baseband unlock]], because the iPhone has two [[ARM]] processors and the [[S-Gold_2|baseband modem]] has one of them and the [[S5L8900|application processor]] has the other one, and they’re only loosely connected. Each has their own security framework. My portion of the talk will be focusing on the [[S5L8900|application processor]]. And you know our goal is to execute custom code on the [[iOS|iPhone OS]]. [[Image:25C3_C03.png|thumb|left|C03]]The purpose of doing so is to launch third-party apps, [[activation]] of the iPhone which allows the [[iOS|iPhone OS]] to recognize unofficial carriers, and it also provides a useful platform for the [[Unlock|SIM unlock]] because then we can use the [[iOS|iPhone OS]] to directly communicate with the [[Baseband_Device|baseband modem]]. So I’m gonna just go over some of the security framework of the [[M68ap|iPhone]], and first of all I’m gonna talk about the basic software architecture of the device. [[Image:25C3_C04.png|thumb|C04]]

As Apple advertised the [[iOS|iPhone OS]] architecture is basically [[wikipedia:Mac OS X|Mac OS X]]. If you look at a disassembly of the [[kernel]], you can see that it’s basically [[wikipedia:XNU|XNU]], which is the kernel for the [[wikipedia:Mac OS X|Mac OS]], it’s basically [[wikipedia:XNU|XNU]] code compiled for [[ARM]]. A lot of the userland architecture is also the same. There is [[wikipedia:Launchd|launchd]], which is the Mac OS version of [[wikipedia:Init|init]] like Linux is [[wikipedia:Init|init]]. It’s a little bit bottomized, there’s no command line switches, but, you know it’s basically the same thing, have launch [[wikipedia:Daemon (computer software)|daemons]] and everything else. System libraries are slightly modified, but they’re pretty much the same as on a typical OS X Mac machine. So instead of the Finder you have [[SpringBoard]] as the shell. One important difference between the Mac version of OS X and the [[iOS|iPhone OS]] is that there’s an additional [[wikipedia:Daemon (computer software)|daemon]] called [[lockdownd]], and it handles communications with the computer. It basically is the gateway between the computer and the iPhone over the USB cable. It [[wikipedia:Multiplexing|multiplexes]] the USB connections and it establishes an [[wikipedia:Transport Layer Security|SSL]] [[wikipedia:Tunneling protocol|tunnel] between a [[wikipedia:Internet socket|socket]] on the computer and on the iPhone. It’s basically like [[wikipedia:inetd|inetd]]. You can have different services that [[lockdownd]] activates. Services like [[MobileSync]], [[MobileBackup]] and a rather important one for our purposes is called [[AFC]], which allows the computer to access a small jailed portion to the file system. So our goal here is to sort of subvert this and to modify the operating system, so that we can run our own code. How do we do this? [[Image:25C3_C05.png|thumb|left|C05]] The [[iOS|iPhone OS]] primarily runs on a [[NAND]] flash disk. To userland it appears as a normal [[wikipedia:Device file#Block devices|block device]]. So if you’re familiar with the Mac OS terminology, it’s under /dev/rdisk0s1 /dev/rdisk0s2. There’s two logical partitions on a [[NAND]] drive. There’s a system partition, which is mounted at root, and there’s a user partition. The system partition is read-only, and these are only logical partitions, and they sit on top of an [[wikipedia:Flash file system|FTL]] which convert the logical partitions which are better suited for traditional disk drives to [[NAND]] flash geometries, which, you know, have peculiar things, like be only able to erase a block at a time.

Here is how the [[iOS|iPhone OS]] is protected. [[Image:25C3_C06.png|thumb|C06]] Third-party applications and everything else that’s modifiable on the [[iOS|iPhone OS]] are installed on the user partition. The system partition is read-only, so in case the iPhone crashes you don’t have to recheck the system partition for file system integrity. Every program, every executable on the iPhone is signature-checked when the system call [[execv]] is executed on that. All executables must be signed by Apple and the signatures and the hashes are stored in the mark-up format as segments and because the signatures are only checked when the program starts you can still use code execution [[Category:Exploits|exploits]] if you have a buffer overflow or a stack overflow, but the limitations of that is that all the applications like MobileSafari or MobileMail and everything else run as a [[mobile user]], so they can’t really alter the operating system. The signature-checks are implemented inside the [[kernel]]. So in order to do our thing, in order to run third-party applications, we have to modify the [[kernel]]. Here is how the [[kernel]] is protected. [[Image:25C3_C07.png|thumb|left|C07]] The [[kernel]] is stored on the system partition, which again is mounted read-only. It’s a big [[wikipedia:Blob (computing)|binary blob]] with the [[kernel]] and all the kernel extensions, KEXTs, which basically provide driver functionality for Mac OS X and they are all concatenated together and compressed with [[wikipedia:Lempel–Ziv–Storer–Szymanski|LZSS]] and encrypted and signed. And you can’t alter this [[kernelcache]], except as [[wikipedia:Superuser|root]]. So even if you got a code execution [[Category:Exploits|exploit]], you still need a privilege escalation exploit as well in order to modify this file. And even if you could do that, the [[kernelcache]] is signed, so if you modify it, your system will stop booting. So, to get around that, we need to look at how the signature for the [[kernel]] is checked. And I’m only just take briefly take you to the [[boot process]] for the iPhone.

[[Image:25C3_C08.png|thumb|C08]] The first piece of code that’s loaded on the iPhone is the [[bootrom]]. It’s Secure-Boot as Apple’s terminology is. I mean it’s kind of a lie as you find out later. So the first thing that it does is it loads from [[NOR]] flash a program called [[LLB]]. The [[NOR]] flash supplements the [[NAND]] flash. It’s just an 8 megabit [[NOR]] flash and it serves as the [[NOR (NVRAM)|NVRAM]] for the OS which concludes [[wikipedia:Kernel panic|kernel panic] logs, [[bootloader]] variables. It also has a file system, or a kind of a rudimentary one; a list of images that contain the bootloaders themselves. So the [[LLB]] is, like the way I put it, is that it’s the [[wikipedia:Master boot record|MBR]] for the [[NOR]], which it does the same thing that the [[wikipedia:Master boot record|MBR]] does on like an x86 machine. It reads the image-less format and it loads the next-stage [[bootloader]] from the image list, signature-checking it first before executing it. [[Image:25C3_C09.png|thumb|left|C09]] The next stage in the [[S5L8900#Boot Chain|boot process]] after [[LLB]] is [[iBoot]], which is loaded from the image list. If you’re familiar at all with the Mac boot process, [[iBoot]] is an analogous to [[wikipedia:Open Firmware|Open Firmware]]. On a Mac machine, instead of the [[kernel]] probing devices and discovering what hardware is there, the [[bootloader]] provides the [[kernel]] with the [[DeviceTree]] which has all this information already included. And [[iBoot]] loads the [[DeviceTree]] from the [[NOR]]. The [[DeviceTree]] - there’s one for each different type of platform, one for the [[M68ap|iPhone]], one for the [[N82ap|iPhone 3G]] and one for the [[N45ap|iPod touch]]. And this [[DeviceTree]] is only partially populated. There’s still some device-specific things, like the serial number that must be added by [[iBoot]]. Also Apple uses different components from different vendors in their manufacturing process. There’ll be like a few different types of LCD panels that they use and a few different types of [[NAND]] chips from different vendors, and some of them have their own initialization sequences. Instead of having the [[kernel]] do that, [[iBoot]] actually does that, which makes the [[kernel]] more flexible. So it populates the [[DeviceTree]] with [[wikipedia:Gamma correction|gamma]] tables, Wi-Fi calibration data, it does all of that. And then finally it loads the [[kernel]] from [[NAND]] and executes it. The thing here is that [[iBoot]] checks signatures on everything. It checks signatures on the [[kernel]], it checks signatures on the [[DeviceTree]], and even the boot logo and graphics that it displays. So we need to get around this in order to do our eventual goal of running unsigned applications on the iPhone. And the whole structure works like this. You have this whole chain that signature-checks the [[kernel]] and then the kernel signature-checks all the userland applications.

[[Image:25C3_C10.png|thumb|C10]] So there’s one slight problem with this scheme. We know that userland applications are signature-checked by the [[kernel]], which is good. And the [[kernel]] is signature-checked by [[iBoot]], so that’s good. [[iBoot]] is signature-checked by the [[LLB]]. OK. But is the [[LLB]] signature-checked by the [[bootrom]]? No! So, that’s a big problem. So all we need to do is just flash our own [[LLB]] and then patch all the signature-checking on all the subsequent stages and then we can run our own code. This is a little bit easier said than done though. The only way we can flash the [[NOR]] is through the [[iPhone Restore Procedure|restore process]] and I’ll explain why in a second after I tell you what it is. [[Image:25C3_C11.png|thumb|left|C11]] Every stage in the [[S5L8900#Boot Chain|boot process]] that I described earlier can abort to either a [[DFU Mode|DFU]] or [[Recovery Mode]], and it’s activated by either keypresses or if the next stage can’t load. [[Recovery Mode]] is basically a USB or serial console. It’s a feature of [[iBoot]]. And [[DFU Mode]] is just a mode where [[iBoot]] can be loaded and you can get into [[Recovery Mode]]. So the [[iPhone Restore Procedure|restore process]] is basically a version of [[iBoot]] is loaded- a newer version, the latest one- is loaded by [[iTunes]] onto existing version of [[iBoot]] or [[DFU Mode]]. And then [[iTunes]] sends the latest [[kernel]] and a [[Restore Ramdisk|Restore ramdisk]] to this [[iBoot]]. And then [[iBoot]] boots the [[kernel]] from the [[Restore Ramdisk|ramdisk]. The [[iPhone Restore Procedure|restore process]] itself is actually conducted by this [[Restore Ramdisk|ramdisk]]/[[kernel]] combination, [[lockdownd]] daemon, called [[restored]]. The [[lockdownd]] thing, as I described, it communicates with [[iTunes]], it downloads of ASR image. I don’t know if you guys know about ASR, but it’s an Apple backup thing. ASR image from iTunes: it also downloads [[NOR]] firmware to be flashed. And the good thing about this process is it’s actually very well designed. It’s pretty much impossible to break the iPhone because of this process. Because you can at any point... break the [[S5L8900|applications processor]] that is. At any point because you can always bootstrap the [[iPhone Restore Procedure|restore process]] like this. [[Image:25C3_C12.png|thumb|C12]] The way that this [[iPhone Restore Procedure|restore process]] is protected is that [[iBoot]] that’s loaded from any stage is signature-checked before being executed. The [[Restore Ramdisk|ramdisk]] and [[kernel]] is also signature-checked by [[iBoot]], and [[restored]] itself signature-checks the [[wikipedia:Apple Software Restore|ASR]] image in a [[NOR]] firmware and it already sits on a signature checked [[Restore Ramdisk|ramdisk]], so itself cannot normally be modified. [[Image:25C3_C13.png|thumb|left|C13]] Also, everything is encrypted with a key that’s derived from a hardware [[wikipedia:Advanced Encryption Standard|AES]] key. This [[wikipedia:Advanced Encryption Standard|AES]] key we can’t read it, but the code on the iPhone can use it. These keys are disabled from any boot that’s not from a signed [[Restore/Update Ramdisks|ramdisk]]. So this means that even if we’re able to find a code execution exploit on a normal boot and have a privilege explanation exploit and communicate with the kernel and tell it to flash the [[NOR]], we still can’t do it, because we’re not in a secure mode. The filesystem itself is encrypted with [[wikipedia:FileVault|FileVault]] and the way that’s done is that [[wikipedia:FileVault|FileVault]] key and also the expected [[wikipedia:Secure Hash Algorithm|SHA]] hash of the filesystem is stored on a encrypted [[Restore/Update Ramdisks|ramdisk]]. And this way everything is encrypted. This makes it difficult for us to do our work, because we can’t read any code and we can’t reverse engineer it. That’s the way that they planned it. [[Image:25C3_C14.png|thumb|C14]] So it still sounds pretty secure. All the modification that this graph shows the modification vectors for every piece of the software that I mentioned. And you see that everything signature-checks everything else pretty much. So, it’s still pretty secure even if the [[bootrom]] doesn’t signature-check [[LLB]], as long as you can’t modify the [[NOR]].

[[Image:25C3_C15.png|thumb|left|C15]] Well, there’s one problem, is that this chain can be broken. And what place we break it is at the [[bootrom]] level or where they can’t patch it or fix it in any way. So it’s a pretty much your standard stack overflow exploit. They’re processing certificates which are on a [[wikipedia:Distinguished Encoding Rules|DER format]]. They copy all the certificate information onto the stack, but the signature itself is copied into this data structure without any sort of bounds checking. So then you have this classic stack buffer overflow and then you just make the signature checking function return true. I was just gonna show you – I probably don’t have enough time to do a very thorough job of this, but basically [[Image:25C3_C16.png|thumb|C16]] this is the function that we want to return true. We want to jump to offset 57EC and make R4=1, because our R4 gets moved into the return value later. CheckCertificateAndGetSecureBootOnes is the function that has the vulnerability. As you can see, in the [[Image:25C3_C17.png|thumb|left|C17]] highlighted areas it makes space on the stack for three certificate structs. So what you wanna do is construct a certificate [[wikipedia:Distinguished Encoding Rules|DER]] that’s structured like this. The thing that’s overflowable is [[MCertSignatureValue]], so you have 0x30 bytes of padding at the end of covered the rest of these and then you can start loading the registers with your own exploit values. So 1 for R4, we don’t really care about the other registers. [[Image:25C3_C18.png|thumb|C18]] And the offset 57EC for the PC – for the program counter. So that’s basically our exploit. What we load from this is what we called [[Pwnage]], which is our complete solution as it were. [[Image:25C3_C19.png|thumb|left|C19]] What we do is we patch every single stage, like where I mentioned all the signature checks, we patch all of those out. And what we do, we patch out in the [[LLB]], [[iBoot]], [[kernel]], the [[restored]] on the [[Restore/Update Ramdisks|ramdisk]], and on the filesystem image, because we patched out the signature checking on [[restored]], we can put our own sort of [[App Store]] for unsigned programs for things that Apple won’t support. And the two most popular ones are [[Cydia]] and [[Installer.app|Installer]]. We use the [[Pwnage 2.0|DFU exploit]] to load a version of [[iBoot]] that doesn’t perform signature checking and then we use the normal [[iPhone Restore Procedure|restore process]] to restore the rest of it; to flash the rest of this onto the iPhone. And what ends up happening is that we can use [[iTunes]] to flash our own custom firmware onto the iPhone. So, yeah. (applause)

[[Image:25C3_C20.png|thumb|C20]] Just briefly I just mentioned stuff that Apple did wrong, to make the job easier for us and probably the biggest reason is that instead of rolling out all this wonderful security mechanisms at once, they did it piece by piece and they sort of made a few mistakes early on in the process. And by doing so they allow us to get access to pieces of code and we’re able to reverse engineer it and we were able to figure out how it all worked and where the vulnerable points are and how to attack it. One of the early mistakes is in 1.0.2. The iPhone actually trusted [[iTunes]] which we can modify easily. At that point we could actually send custom restore commands and [[jailbreak]] the iPhone. Another call was none of the executables were signed at that point, so you could make a simple file system alteration and you’re jailbroken. [[Image:25C3_C21.png|thumb|left|C21]] Another vulnerability in 1.1.1 and 1.1.2 is that everything used to run as [[wikipedia:Superuser|root]]. So if you find a vulnerability within any userland program, then you have root. They also left some interesting things like [[/dev/kmem]] which means that we can poke and peek kernel memory and execute kernel code, so that was kinda bad. [[Image:25C3_C22.png|thumb|C22]] And finally probably the mistake that first allowed [[Pwnage]] was they left the [[boot arguments]] pmd= and vmd= and these [[boot arguments]] can construct a [[Restore/Update Ramdisks|ramdisk]] to boot out of anything. And that basically... not out of anything but out of any contiguous portion of memory. And that allowed us to bootstrap a [[Restore/Update Ramdisks|ramdisk]] pretty easily, because when we upload a [[Restore/Update Ramdisks|ramdisk]], the iPhone has to store in memory somewhere and then signature check and then decide whether it wants it pass on to the kernel based on whether the signature is correct. But even if it fails the signature check, the [[Restore/Update Ramdisks|ramdisk]] is still in memory, so we can use pmd= or vmd= to construct a [[Restore/Update Ramdisks|ramdisk]] out of that portion of memory that it temporarily stores or upload in. And then this basically allowed us to boot from an unsigned [[Restore/Update Ramdisks|ramdisk]] right away. And allow us to flash our first [[bootloader]]s. We learn a lot from this process. We now have added quick control over the iPhone’s hardware to even run Linux on it, so that’s basically where we are. I’ll pass it to [[User:MuscleNerd|Musclenerd]] to describe the [[Baseband Firmware]].

=== Part 2: Baseband (by [[User:MuscleNerd|MuscleNerd]]) ===
(in work by [[User:http|http]], will follow here)

=== End and Q&A ===
(in work by [[User:http|http]], will follow here)

[[Category:Events]]

Redsn0w

2010-09-08T21:28:51Z

Redart: Add version info

[[Image:Redsn0w.png|thumb|redsn0w 0.9.5-b5]]
redsn0w (at version 0.1) was originally a [[QuickPwn]]-like implementation of the [[0x24000 Segment Overflow]] for the [[N72ap|iPod Touch 2G]]. However, due to the theft and exploitation of the name (as QuickPWN) by quickpwn.com, as of firmware 3.0, QuickPwn was discontinued and redsn0w (at the time, version 0.7) was converted into a jailbreaking tool for all current devices as well as providing unlock support the iPhone 2G.

As of version 0.8, the [[N88ap|iPhone 3GS]] can also be jailbroken through redsn0w. It is currently closed-sourced but the executable is being worked into several third-party GUIs as the underlying engine can also be used as a commandline tool.

Version 0.9 beta 3 was released for Windows and OS X, and it allows firmware 3.0 to 3.1.2 to be jailbroken. It includes support for all devices except the iPod touch 3G and supports a tethered jailbreak on late-model iPhone 3GS's and iPod touch 2G's. This latest version supports custom boot and recovery mode logos, as well as verbose-bootup. Final release, version [http://wikee.iphwn.org/howto:rs9 0.9.2] supports jailbreaking of all iDevices with firmware 3.0 or 3.1.2 on Windows and Mac OSX and iPhone 2G/3G, iPT 1G on firmware 3.1.3. Version 0.9.3 adds support of internet tethering IPCC hack on those devices and 0.9.4 allows jailbreaking of early iPod Touch 2G with 3.1.3 firmware.

Version [http://wikee.iphwn.org/howto:rsbeta 0.9.5b5-5] supports jailbreaking the [[N82ap|iPhone 3G]] and [[N72ap|iPod touch 2G]] (non-MC) with iOS 4.0 on Windows and Mac OS X.

== Credit ==
[[iPhone Dev Team]]

== Exploit ==
For [[N45ap|iPod touch]], [[M68ap|iPhone]] and [[N82ap|iPhone 3G]], see:
*[[Pwnage]]
*[[Pwnage 2.0]]

For [[N72ap|iPod touch 2G]], see:
*[[0x24000 Segment Overflow]] - Credit the work on this exploit goes to [[User:Planetbeing|planetbeing]], [[User:MuscleNerd|MuscleNerd]], and [[User:ChronicDev|Chronic Dev]].
*[[ARM7 Go]] - used to upload the oversized [[LLB]] required to take advantage of the 0x24000 Segment Overflow.

For [[N88ap|iPhone 3GS]], see:
*[[0x24000 Segment Overflow]]
*[[iBoot Environment Variable Overflow]] - Exploit has a different implementation from [[User:geohot|geohot]]'s implementation in [[purplera1n]].
*[[usb_control_msg(0x21, 2) Exploit]]

For [[N18ap|iPod touch 3G]]
*[[usb_control_msg(0x21, 2) Exploit]]

Star

2010-09-01T13:07:08Z

Redart:

PwnageTool

2010-07-13T17:02:22Z

Redart: /* Windows */

'''PwnageTool''' is a iPhone [[jailbreak]] tool for Mac OS X that jailbreaks by creating a custom [[IPSW File Format|IPSW]]. You are allowed to change boot logos and add pre-installed packages to the IPSW. After an IPSW is created you can use it to restore to in iTunes.

==Exploits Used==
===Version 2.0===
* [[pwnage 2.0]]
* [[pwnage]]
===Version 1.0===
* [[pwnage]]
* [[Ramdisk Hack]]

== Models Supported ==
{| class="wikitable"
|-
! Model
! Since
|-
| [[M68ap|iPhone 2G]]
| April 3, 2008
|-
| [[N45ap|iPod touch 1G]]
| April 3, 2008
|-
| [[N82ap|iPhone 3G]]
| Jul 19, 2008
|-
| [[N72ap|iPod touch 2G]]
| Oct 2, 2009
|-
| [[N88ap|iPhone 3GS]]
| Oct 2, 2009
|}
Note that the iPod touch 3G is not supported. With the iPod touch 2G and iPhone 3GS you need to be already jailbroken. The [S5L8900] devices you can go into [[DFU]] mode and restore with [[iTunes]] without being jailbroken.

==Versions==

PwnageTool was released April 3, 2008 but largely unused until version 2.0 was released July 19, 2008.
The following versions that are shown here are not beta, alpha, or in development.

===1.x: First release of PwnageTool===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 1.1.4 ====
| style="white-space: nowrap;" | April 3, 2008
| |
* Initial release
* Jailbreaks 1.1.4 firmware
* Supports iPod touch 1G and iPhone 2G.
* Add [[BootNeuter]] in the IPSW to unlock iPhone 2G.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}
=== 2.x: Second major release of Pwnagetool ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0 ====
| style="white-space: nowrap;" | Jul 19, 2008
| |
* Added support of iPhone 3G <references/>[http://www.engadget.com/2008/07/19/iphone-dev-team-unleashes-pwnage-tool-2-0/]<references/>
* Jailbreaks 2.0 Firmware
* Change boot logos
* Adds Cydia by default
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0.1 ====
| style="white-space: nowrap;" | Aug 4, 2008
| |
* Jailbreaks 2.0.1 Firmware
* Works for 2.0 and 2.0.1.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0.2 ====
| style="white-space: nowrap;" | Aug 21, 2008
| |
* Jailbreaks 2.0.2, Firmware <references/>[http://www.iphonehacks.com/2008/08/pwnage-tool-202.html]<references/>
* Works for 2.0, 2.0.1, and 2.0.2.
* Bug fixes - for when it doesn't go to the next page when you click on something.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0.3 ====
| style="white-space: nowrap;" | Aug 25, 2008
| |
* Jailbreaks 2.0.2, Firmware
* Works for 2.0, 2.0.1, and 2.0.2.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.1 ====
| style="white-space: nowrap;" | Sep 13, 2008
| |
* Jailbreaks 2.1 firmware
* Removed backwards compatibility
* Download packages from a Valid cydia source, and add them onto your custom ipsw
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.2 ====
| style="white-space: nowrap;" | Nov 21, 2008
| |
* Jailbreaks 2.2 firmware
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |

==== 2.2.5 ====
| style="white-space: nowrap;" | Jan 30, 2009
| |
* Jailbreaks 2.2.1
* Not updated by iPhone dev team but made official
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}

=== 3.x: Third Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.0 ====
| style="white-space: nowrap;" | Jun 19, 2009
| |
* Jailbreaks 3.0 firmware
* DFU mode instructions included
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.1 ====
| style="white-space: nowrap;" | Sep 15, 2009
| |
* Jailbreaks 3.1 firmware for iPhone 2G and 3G
* Jailbreaks 3.1.1 firmware for iPod touch 1G
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.1.3 ====
| style="white-space: nowrap;" | Oct 2, 2009
| |
* Support for iPhone 3GS with [[iBoot-359.3]] bootrom and iPod touch 2G with [[iBoot-240.4]] bootrom (these devices need to be pwned from 3.0/3.0.1)
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.1.4 ====
| style="white-space: nowrap;" | Oct 13, 2009
| |
* Jailbreaks 3.1.2 firmware for iPhone 2G, 3G, 3GS with [[iBoot-359.3]] bootrom, iPod touch 1G, iPod touch 2G with [[iBoot-240.4]] bootrom
* iPod touch 3G not supported.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |

==== 3.1.5 ====
| style="white-space: nowrap;" | Feb 7, 2010
| |
* Jailbreaks 3.1.3 for devices supported in 3.1.4.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}
=== 4.x: Fourth Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 4.0 ====
| style="white-space: nowrap;" | Jun 22, 2010
| |
* Jailbreaks 4.0 firmware
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 4.01 ====
| style="white-space: nowrap;" | Jun 23, 2010
| |
* Fixes iBooks issue in 4.0
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}

==Creating the Firmware==
PwnageTool takes the IPSW file and patches it, creating a custom version. This enables a lot more features such as pre-installed packages, boot neuter (unlock for iPhone 2nd Generation), custom packages and boot logos. This method is usually less secure than the quick exploits such (redsn0w, quickpwn, purplera1n, blackra1n, etc.).

==Problems==
This method does have negative aspects. The most common errors are the 1600 errors, a group of errors saying that the either the firmware file is corrupt or you didn't put it in the right mode (recovery, DFU Mode). Sometimes the problems could just be a computer problem such as the memory is full or the USB port is broken. The most common computer error is a 1604 error which means that the firmware file is corrupt.

==Windows==
Although PwnageTool is only for Mac OS X, as of October 2009, the [[iH8sn0w|iH8sn0w Team]] has announced that they're going to make a project that will bring Pwnage Tool to Windows. This project is named sn0wbreeze, and has been released.[http://ih8sn0w.com/]

== License ==
PwnageTool is freeware.

[[Category:Hacking Software]]

PwnageTool

2010-07-13T17:00:56Z

Redart:

'''PwnageTool''' is a iPhone [[jailbreak]] tool for Mac OS X that jailbreaks by creating a custom [[IPSW File Format|IPSW]]. You are allowed to change boot logos and add pre-installed packages to the IPSW. After an IPSW is created you can use it to restore to in iTunes.

==Exploits Used==
===Version 2.0===
* [[pwnage 2.0]]
* [[pwnage]]
===Version 1.0===
* [[pwnage]]
* [[Ramdisk Hack]]

== Models Supported ==
{| class="wikitable"
|-
! Model
! Since
|-
| [[M68ap|iPhone 2G]]
| April 3, 2008
|-
| [[N45ap|iPod touch 1G]]
| April 3, 2008
|-
| [[N82ap|iPhone 3G]]
| Jul 19, 2008
|-
| [[N72ap|iPod touch 2G]]
| Oct 2, 2009
|-
| [[N88ap|iPhone 3GS]]
| Oct 2, 2009
|}
Note that the iPod touch 3G is not supported. With the iPod touch 2G and iPhone 3GS you need to be already jailbroken. The [S5L8900] devices you can go into [[DFU]] mode and restore with [[iTunes]] without being jailbroken.

==Versions==

PwnageTool was released April 3, 2008 but largely unused until version 2.0 was released July 19, 2008.
The following versions that are shown here are not beta, alpha, or in development.

===1.x: First release of PwnageTool===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 1.1.4 ====
| style="white-space: nowrap;" | April 3, 2008
| |
* Initial release
* Jailbreaks 1.1.4 firmware
* Supports iPod touch 1G and iPhone 2G.
* Add [[BootNeuter]] in the IPSW to unlock iPhone 2G.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}
=== 2.x: Second major release of Pwnagetool ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0 ====
| style="white-space: nowrap;" | Jul 19, 2008
| |
* Added support of iPhone 3G <references/>[http://www.engadget.com/2008/07/19/iphone-dev-team-unleashes-pwnage-tool-2-0/]<references/>
* Jailbreaks 2.0 Firmware
* Change boot logos
* Adds Cydia by default
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0.1 ====
| style="white-space: nowrap;" | Aug 4, 2008
| |
* Jailbreaks 2.0.1 Firmware
* Works for 2.0 and 2.0.1.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0.2 ====
| style="white-space: nowrap;" | Aug 21, 2008
| |
* Jailbreaks 2.0.2, Firmware <references/>[http://www.iphonehacks.com/2008/08/pwnage-tool-202.html]<references/>
* Works for 2.0, 2.0.1, and 2.0.2.
* Bug fixes - for when it doesn't go to the next page when you click on something.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0.3 ====
| style="white-space: nowrap;" | Aug 25, 2008
| |
* Jailbreaks 2.0.2, Firmware
* Works for 2.0, 2.0.1, and 2.0.2.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.1 ====
| style="white-space: nowrap;" | Sep 13, 2008
| |
* Jailbreaks 2.1 firmware
* Removed backwards compatibility
* Download packages from a Valid cydia source, and add them onto your custom ipsw
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.2 ====
| style="white-space: nowrap;" | Nov 21, 2008
| |
* Jailbreaks 2.2 firmware
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |

==== 2.2.5 ====
| style="white-space: nowrap;" | Jan 30, 2009
| |
* Jailbreaks 2.2.1
* Not updated by iPhone dev team but made official
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}

=== 3.x: Third Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.0 ====
| style="white-space: nowrap;" | Jun 19, 2009
| |
* Jailbreaks 3.0 firmware
* DFU mode instructions included
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.1 ====
| style="white-space: nowrap;" | Sep 15, 2009
| |
* Jailbreaks 3.1 firmware for iPhone 2G and 3G
* Jailbreaks 3.1.1 firmware for iPod touch 1G
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.1.3 ====
| style="white-space: nowrap;" | Oct 2, 2009
| |
* Support for iPhone 3GS with [[iBoot-359.3]] bootrom and iPod touch 2G with [[iBoot-240.4]] bootrom (these devices need to be pwned from 3.0/3.0.1)
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.1.4 ====
| style="white-space: nowrap;" | Oct 13, 2009
| |
* Jailbreaks 3.1.2 firmware for iPhone 2G, 3G, 3GS with [[iBoot-359.3]] bootrom, iPod touch 1G, iPod touch 2G with [[iBoot-240.4]] bootrom
* iPod touch 3G not supported.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |

==== 3.1.5 ====
| style="white-space: nowrap;" | Feb 7, 2010
| |
* Jailbreaks 3.1.3 for devices supported in 3.1.4.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}
=== 4.x: Fourth Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 4.0 ====
| style="white-space: nowrap;" | Jun 22, 2010
| |
* Jailbreaks 4.0 firmware
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 4.01 ====
| style="white-space: nowrap;" | Jun 23, 2010
| |
* Fixes iBooks issue in 4.0
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}

==Creating the Firmware==
PwnageTool takes the IPSW file and patches it, creating a custom version. This enables a lot more features such as pre-installed packages, boot neuter (unlock for iPhone 2nd Generation), custom packages and boot logos. This method is usually less secure than the quick exploits such (redsn0w, quickpwn, purplera1n, blackra1n, etc.).

==Problems==
This method does have negative aspects. The most common errors are the 1600 errors, a group of errors saying that the either the firmware file is corrupt or you didn't put it in the right mode (recovery, DFU Mode). Sometimes the problems could just be a computer problem such as the memory is full or the USB port is broken. The most common computer error is a 1604 error which means that the firmware file is corrupt.

==Windows==
Although PwnageTool is only for Mac OS X, as of October 2009, the [[iH8sn0w|iH8sn0w Team]] has announced that they're going to make a project project that will bring Pwnage Tool to Windows. This project is named sn0wbreeze, and has been released.[http://ih8sn0w.com/]

== License ==
PwnageTool is freeware.

[[Category:Hacking Software]]

PwnageTool

2010-07-13T16:58:17Z

Redart: /* Versions */ Updated info to 4.01

'''PwnageTool''' is a iPhone [[jailbreak]] tool for Mac OS X that jailbreaks by creating a custom [[IPSW File Format|IPSW]]. You are allowed to change boot logos and add pre-installed packages to the IPSW. After an IPSW is created you can use it to restore to in iTunes.

==Exploits Used==
===Version 2.0===
* [[pwnage 2.0]]
* [[pwnage]]
===Version 1.0===
* [[pwnage]]
* [[Ramdisk Hack]]

== Models Supported ==
{| class="wikitable"
|-
! Model
! Since
|-
| [[M68ap|iPhone 2G]]
| April 3, 2008
|-
| [[N45ap|iPod touch 1G]]
| April 3, 2008
|-
| [[N82ap|iPhone 3G]]
| Jul 19, 2008
|-
| [[N72ap|iPod touch 2G]]
| Oct 2, 2009
|-
| [[N88ap|iPhone 3GS]]
| Oct 2, 2009
|}
Note that the iPod touch 3G is not supported. With the iPod touch 2G and iPhone 3GS you need to be already jailbroken. The [S5L8900] devices you can go into [[DFU]] mode and restore with [[iTunes]] without being jailbroken.

==Versions==

PwnageTool was released April 3, 2008 but largely unused until version 2.0 was released July 19, 2008.
The following versions that are shown here are not beta, alpha, or in development.

===1.x: First release of PwnageTool===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 1.1.4 ====
| style="white-space: nowrap;" | April 3, 2008
| |
* Initial release
* Jailbreaks 1.1.4 firmware
* Supports iPod touch 1G and iPhone 2G.
* Add [[BootNeuter]] in the IPSW to unlock iPhone 2G.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}
=== 2.x: Second major release of Pwnagetool ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0 ====
| style="white-space: nowrap;" | Jul 19, 2008
| |
* Added support of iPhone 3G <references/>[http://www.engadget.com/2008/07/19/iphone-dev-team-unleashes-pwnage-tool-2-0/]<references/>
* Jailbreaks 2.0 Firmware
* Change boot logos
* Adds Cydia by default
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0.1 ====
| style="white-space: nowrap;" | Aug 4, 2008
| |
* Jailbreaks 2.0.1 Firmware
* Works for 2.0 and 2.0.1.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0.2 ====
| style="white-space: nowrap;" | Aug 21, 2008
| |
* Jailbreaks 2.0.2, Firmware <references/>[http://www.iphonehacks.com/2008/08/pwnage-tool-202.html]<references/>
* Works for 2.0, 2.0.1, and 2.0.2.
* Bug fixes - for when it doesn't go to the next page when you click on something.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.0.3 ====
| style="white-space: nowrap;" | Aug 25, 2008
| |
* Jailbreaks 2.0.2, Firmware
* Works for 2.0, 2.0.1, and 2.0.2.
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.1 ====
| style="white-space: nowrap;" | Sep 13, 2008
| |
* Jailbreaks 2.1 firmware
* Removed backwards compatibility
* Download packages from a Valid cydia source, and add them onto your custom ipsw
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 2.2 ====
| style="white-space: nowrap;" | Nov 21, 2008
| |
* Jailbreaks 2.2 firmware
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |

==== 2.2.5 ====
| style="white-space: nowrap;" | Jan 30, 2009
| |
* Jailbreaks 2.2.1
* Not updated by iPhone dev team but made official
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}

=== 3.x: Third Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.0 ====
| style="white-space: nowrap;" | Jun 19, 2009
| |
* Jailbreaks 3.0 firmware
* DFU mode instructions included
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.1 ====
| style="white-space: nowrap;" | Sep 15, 2009
| |
* Jailbreaks 3.1 firmware for iPhone 2G and 3G
* Jailbreaks 3.1.1 firmware for iPod touch 1G
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.1.3 ====
| style="white-space: nowrap;" | Oct 2, 2009
| |
* Support for iPhone 3GS with [[iBoot-359.3]] bootrom and iPod touch 2G with [[iBoot-240.4]] bootrom (these devices need to be pwned from 3.0/3.0.1)
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 3.1.4 ====
| style="white-space: nowrap;" | Oct 13, 2009
| |
* Jailbreaks 3.1.2 firmware for iPhone 2G, 3G, 3GS with [[iBoot-359.3]] bootrom, iPod touch 1G, iPod touch 2G with [[iBoot-240.4]] bootrom
* iPod touch 3G not supported.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |

==== 3.1.5 ====
| style="white-space: nowrap;" | Feb 7, 2010
| |
* Jailbreaks 3.1.3 for devices supported in 3.1.4.
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
|}
=== 4.x: Fourth Major Release of PwnageTool ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9;" align="center" |Version
! style="background-color:#E9E9E9;" align="center" |Release date
! style="background-color:#E9E9E9;" align="center" |Features
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 4.0 ====
| style="white-space: nowrap;" | Jun 22, 2010
| |
* Jailbreaks 4.0 firmware
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |
==== 4.01 ====
| style="white-space: nowrap;" | Jun 23, 2010
| |
* Fixes iBooks issue in 4.0
|
|-
! rowspan=1 style="white-space: nowrap;nowrap;" |

==Creating the Firmware==
PwnageTool takes the IPSW file and patches it, creating a custom version. This enables a lot more features such as pre-installed packages, boot neuter (unlock for iPhone 2nd Generation), custom packages and boot logos. This method is usually less secure than the quick exploits such (redsn0w, quickpwn, purplera1n, blackra1n, etc.).

==Problems==
This method does have negative aspects. The most common errors are the 1600 errors, a group of errors saying that the either the firmware file is corrupt or you didn't put it in the right mode (recovery, DFU Mode). Sometimes the problems could just be a computer problem such as the memory is full or the USB port is broken. The most common computer error is a 1604 error which means that the firmware file is corrupt.

==Windows==
Although PwnageTool is only for Mac OS X, as of October 2009, the [[iH8sn0w|iH8sn0w Team]] has announced that they're going to make a project project that will bring Pwnage Tool to Windows. This project is named sn0wbreeze, and has been released.[http://ih8sn0w.com/]

== License ==
PwnageTool is freeware.

[[Category:Hacking Software]]

Timeline

2010-07-13T16:52:49Z

Redart: /* June */ DevTeam activity

==2010==
===June===
*June 24 -- [[N90ap|iPhone 4]] is launched.
*June 22 -- [[iPhone Dev Team]] releases [[PwnageTool]] 4.0 and later 4.0.1 for all devices on 4.0 except iPod Touch 3G.
*June 21 -- [[iPhone Dev Team]] releases [[Redsn0w]] 0.9.5 to jailbreak 4.0 on iPhone 3G and iPhone Touch 2G.
*June 21 -- [[iPhone Dev Team]] releases [[Ultrasn0w]] 0.93, an unlock for baseband firmwares 4.26.08, 5.11.07, 5.12.01 and 5.13.04
*June 21 -- Apple releases 4.0 firmware

===May===
*May 3 -- Windows version of [[Spirit]] has been updated to not require Windows 98 compatibility mode to run and fixed a photo deletion issue.
*May 2 (?) -- [[comex]] releases [[Spirit]], an [[untethered jailbreak]] for all iDevices with firmware 3.1.2 through 3.2. Previously [[blackra1n]] was a tethered jailbreak on newer devices and people that updated to firmware 3.1.3 had no jailbreak at all.

===Feb===
*Feb 12 -- [http://twitter.com/sherif_hashim sherif_hashim] discovers [[AT+XAPP Vulnerability]] and passes it to [[MuscleNerd]] elite member of the [[iPhone Dev Team]]
*Feb 2 -- Apple releases 3.1.3 firmware closing [[usb_control_msg(0x21, 2) Exploit|usb_control_msg(0x21, 2)]] vulnerability used by [[blackra1n]].

==2009==
===November===
*November 3 -- [[Geohot]] releases [[blackra1n]] RC3, a software jailbreak for all devices. Includes a new unlock for the baseband 5.11.07 called [[blacksn0w]] and is also noticeably faster than previous versions.

===October===
*October 11 -- [[Geohot]] releases [[blackra1n]] RC1, a 30 second software jailbreak for all devices, including a tethered jailbreak for the [[iPod touch 3G]].

===September===
* September 24 -- [[ih8sn0w|ih8sn0w]] Discovers the [[AT+XEMN|AT+XEMN]] Vulnerability used in [[blacksn0w|blacksn0w]] independently.
* September 9 -- The [[iPod touch 3G]] w/ [[S5L8922]] processor is released, as well as an "MC Model" [[n72ap|iPod touch 2G]]. Both are no longer vulnerable to [[24kPwn]].
* Firmware 3.1/3.1.1 (7C144/7C145) Released to the Public. Firmware closes [[iBoot Environment Variable Overflow|iBoot Environment Variable Overflow]] and [[AT+XLOG Vulnerability|AT+XLOG]] + [[AT+FNS|AT+FNS]] Baseband Exploits.

===July===
* July 14 -- [[Geohot]] releases [[purplesn0w]], a software unlock for the [[iPhone 3GS]] using [[AT+XLOG Vulnerability|the same exploit as ultrasn0w]], but handled differently. Minutes later, an explanation and source code was posted.
* July 7 -- [[The dev team]] updates [[redsn0w]] and [[ultrasn0w]] to version 0.8, now with [[iPhone 3GS]] support. Saurik also updates Winterboard to support the [[iPhone 3GS]].
* July 3 -- [[Geohot]] releases [[purplera1n]], a software jailbreak for the [[iPhone 3GS]].

===June===
* June 28 -- [[Geohot]] posts pictures on his blog of the first fully jailbroken [[iPhone 3GS]].
* June 25 -- It's discovered that [[iPhone 3GS]] is vulnerable to [[0x24000 Segment Overflow|24kpwn]] exploit.
* June 24 -- [[The dev team]] release [[ultrasn0w]] unlock for [[iPhone 3G]] thanks to [[AT+XLOG Vulnerability|a new exploit]] discovered by [[User:Oranav|Oranav]].
* June 23 -- [[Geohot]] announces he's found a new exploit in [[iBoot]] he calls purplera1n.
* June 19 -- Release of [[iPhone2,1|iPhone 3GS]] to the public and the release of [[PwnageTool|Pwnage Tool 3.0]] and [[RedSn0w|Redsn0w]] for jailbreaking devices running firmware 3.0
* June 17 -- Release of firmware 3.0 to the public.
* June 8 -- Apple announces the [[iPhone2,1|iPhone 3GS]].

===March===
* March 10 -- The [[0x24000 Segment Overflow|untethered jailbreak]] for the [[iPod touch 2G]] is released thanks to the combined work of chronic, CPICH, posixninja, pod2g, ius, planetbeing, [[MuscleNerd]], and co after being leaked and sold by [[NitroKey]]. To prevent users wasting their money on a stolen exploit, the Hybrid DevTeam decided to release it immediately.

===January===
* January 31 -- The [[iPhone Dev Team]] released a [[redsn0w Lite]], a tethered jailbreak for the [[N72ap|iPod touch 2G]]. It combines the [[ARM7 Go]] vulnerability with the well-established pwnage flow for other Apple mobile devices. It was bundled in a way that will allow usage on the 2.2.1 firmware through uploading the [[ARM7 Go]] vulnerable 2.1.1 iBoot to the device while in DFU mode.

* January 25 -- [[0wnboot]] is released to chronicdev google code page, thanks to AriX, chronic, CPICH, westbaer, ius, pod2g, the rest of the iPod devel crew on IRC, and to the #iphone-hax lab rats. Within days, the AriX and the chronic dev team got a ramdisk booting for a tethered jailbreak.

* January 17 -- [[MuscleNerd]] of the [[iPhone Dev Team]] [http://twitter.com/MuscleNerd/status/1127346766 shows a video demo] of the first jailbroken iPod Touch 2G.

* January 16 -- [[ARM7 Go]] hole disclosed where else but here on The iPhone Wiki, for developers to poke and prod at

* January 15 -- The [[iPhone Dev Team]] [http://twitter.com/iphone_dev/status/1120595069 tweets the vfdecrypt key] for the [[iPod touch 2G]] 2.2 firmware, demonstrating for the first time that unsigned code can now be run on that device.

* January 1 -- The [[iPhone Dev Team]] releases [[yellowsn0w]] 0.9 beta for baseband 02.28.00.

==2008==

===December===
* December 21 -- [[MuscleNerd]], of [[the dev team]] does a live demo of the 3G unlock, dubbed as 'yellowsn0w': http://qik.com/video/729275

===August===
* August 18 -- [[The dev team]] releases [http://wikee.iphwn.org/news:pwnage20announcement QuickPwn], a 2.x [[pwnage]]/ramdisk combination exploit that allows jailbreaking without needing to create custom IPSWs.

===July===
* July 22 -- [[TA_Mobile]] hardware dumps the 3G baseband (bootloader 5.8 & FW 1.45.00) by desoldering the [[NOR]].
* July 19 -- [[The dev team]] releases [[PwnageTool]] 2.0, jailbreaking and unlocking the 2.0 software on the iPhone 2G and jailbreaking the 2.0 software on the iPhone 3G.
* July 11 -- [[iPhone 3G]] is released.

===June===
* June 9 - [[iPhone 3G]] is announced at [[WWDC]] '08.

===April===
* April 3 -- Dev team releases [[PwnageTool]] 1.0, making use of the pmdx exploit (to patch RSA checks out of the [[kernel]], to write unsigned to [[NOR]])

===March===
* March 12 -- Dev team releases dual-boot jailbreak method, only to be silently fixed in 2.0.
* March 4 -- [[User:N000b|George Zhu (n000b)]] releases [[ILiberty / ILiberty%2B]].

===February===
* February 28 -- [[Cydia]] is released as an open-source alternative to Installer.app, and prepares to take over the jailbreak application scene upon 2.0's release.
* February 11 -- [[Zibri]] releases [[ZiPhone]], the first all-in-one unlock, activate, jailbreak solution.
* February 8 -- [[User:Geohot|geohot]] releases software unlock for 4.6, Apple states 25% of phones were never activated with AT&T.

===January===
* January 28 -- Dev team releases soft upgrade jailbreak for 1.1.3.
* January 18 -- Geohot and his friends [http://iphonejtag.blogspot.com/2008/01/112-otb-unlocked.html unlocked 1.1.2 OTB 4.6 by test point], the unbeatable version at that time.
* January 18 -- Dev team posts YouTube video of a jailbroken 1.1.3, which was made possible by the dual boot jailbreak from bgm.

== 2007 ==
===November===
* November 15 -- New baseband [[Bootloader 4.6|bootloader (4.6)]] comes out, new iPhones can't be unlocked.
* November 2 -- [[Jailbreakme]] is released, bringing jailbreaking to the mainstream iPhone user.

===October===
* October 23 -- iPhone-Elite Team releases the [[Virginizer]].
* October 14 -- AriX releases iJailBreak, the first automated iPod touch jailbreak for the Mac.
* October 12 -- planetbeing releases touchFree, the first automated iPod touch jailbreak.
* October 10 -- niacin, cmw, and dre release the [[LibTiff]] exploit to jailbreak the iPod touch, which is later adapted for use in [[Jailbreakme]].

===September===
* September 11 -- [[The dev team]] releases [[iUnlock]], first free software unlock.
* September 10 -- [[IPSF]] releases first paid software unlock.
* September 9 -- Apple announces the [[iPod touch]] at a media event.

===August===
* August 23 -- [[User:Geohot|geohot]] and team release [[hardware unlock]] method.
* August 21 -- Installer.app is released by Nullriver, first GUI apps are distributed.

===July===
* July 23 -- First phones are used with other carriers by means of [[SIM hacks]].
* July 20 -- nightwatch adapts a [[toolchain]] to the iPhone. The first apps are compiled.
* July 9 -- [[The dev team]] releases a [[jailbreak]] method. The first use of this is ringtones.
* July 3 -- DVD Jon first cracks [[activation]]. People can use the apps on the phone without a subscription.

===June===
* June 29 -- [[iPhone]] is released. World's most hyped consumer product.

Redsn0w

2010-07-13T16:30:44Z

Redart:

The redsn0w program (at version 0.1) was originally a [[QuickPwn]]-like implementation of the [[0x24000 Segment Overflow]] for the [[N72ap|iPod Touch 2G]]. However, due to the theft and exploitation of the name (as QuickPWN) by quickpwn.com, as of firmware 3.0, QuickPwn was discontinued and redsn0w (at the time, version 0.7) was converted into a jailbreaking tool for all current devices as well as providing unlock support the iPhone 2G.

As of version 0.8, the [[N88ap|iPhone 3GS]] can also be jailbroken through redsn0w. It is currently closed-sourced but the executable is being worked into several third-party GUIs as the underlying engine can also be used as a commandline tool.

Version 0.9 beta 3 was released for Windows and OS X, and it allows firmware 3.0 to 3.1.2 to be jailbroken. It includes support for all devices except the iPod touch 3G and supports a tethered jailbreak on late-model iPhone 3GS's and iPod touch 2G's. This latest version supports custom boot and recovery mode logos, as well as verbose-bootup. Final release, version [http://wikee.iphwn.org/howto:rs9 0.9.2] supports jailbreaking of all iDevices with firmware 3.0 or 3.1.2 on Windows and Mac OSX.

Version [http://wikee.iphwn.org/howto:rsbeta 0.9.5b5-5] supports jailbreaking of iPhone 3G, iPT 2 with firmware 4.0 on Windows and Mac OSX.

== Credit ==
[[iPhone Dev Team]]

== Exploit ==
For [[iPod Touch]], [[iPhone]] and [[iPhone 3G]], see:
*[[Pwnage]]
*[[Pwnage_2.0|Pwnage 2.0]]

For [[N72ap|iPod Touch 2G]], see:
*[[0x24000 Segment Overflow]] - Credit the work on this exploit goes to planetbeing, [[MuscleNerd]], and Chronic Dev.
*[[ARM7_Go]] - used to upload the oversized LLB required to take advantage of [[24kPwn]].

For [[iPhone 3GS]], see:
*[[0x24000 Segment Overflow]]
*[[iBoot Environment Variable Overflow]] - Exploited independently, different implementation than the version that [[User:geohot|geohot]] released, [[purplera1n]].

For [[N18ap|iPod Touch 3g]]
*[[usb_control_msg(0x21, 2) Exploit]]

Timeline

2010-07-13T15:57:25Z

Redart: /* Feb */ Added 2 feb info

==2010==
===June===
*June 24 -- [[N90ap|iPhone 4]] is launched.
*June 21 -- [[iPhone Dev Team]] releases [[Ultrasn0w]] 0.93 , an unlock for baseband firmwares 4.26.08, 5.11.07, 5.12.01 and 5.13.04

===May===
*May 3 -- Windows version of [[Spirit]] has been updated to not require Windows 98 compatibility mode to run and fixed a photo deletion issue.
*May 2 (?) -- [[comex]] releases [[Spirit]], an [[untethered jailbreak]] for all iDevices with firmware 3.1.2 through 3.2. Previously [[blackra1n]] was a tethered jailbreak on newer devices and people that updated to firmware 3.1.3 had no jailbreak at all.

===Feb===
*Feb 12 -- [http://twitter.com/sherif_hashim sherif_hashim] discovers [[AT+XAPP Vulnerability]] and passes it to [[MuscleNerd]] elite member of the [[iPhone Dev Team]]
*Feb 2 -- Apple releases 3.1.3 firmware closing [[usb_control_msg(0x21, 2) Exploit|usb_control_msg(0x21, 2)]] vulnerability used by [[blackra1n]].

==2009==
===November===
*November 3 -- [[Geohot]] releases [[blackra1n]] RC3, a software jailbreak for all devices. Includes a new unlock for the baseband 5.11.07 called [[blacksn0w]] and is also noticeably faster than previous versions.

===October===
*October 11 -- [[Geohot]] releases [[blackra1n]] RC1, a 30 second software jailbreak for all devices, including a tethered jailbreak for the [[iPod touch 3G]].

===September===
* September 24 -- [[ih8sn0w|ih8sn0w]] Discovers the [[AT+XEMN|AT+XEMN]] Vulnerability used in [[blacksn0w|blacksn0w]] independently.
* September 9 -- The [[iPod touch 3G]] w/ [[S5L8922]] processor is released, as well as an "MC Model" [[n72ap|iPod touch 2G]]. Both are no longer vulnerable to [[24kPwn]].
* Firmware 3.1/3.1.1 (7C144/7C145) Released to the Public. Firmware closes [[iBoot Environment Variable Overflow|iBoot Environment Variable Overflow]] and [[AT+XLOG Vulnerability|AT+XLOG]] + [[AT+FNS|AT+FNS]] Baseband Exploits.

===July===
* July 14 -- [[Geohot]] releases [[purplesn0w]], a software unlock for the [[iPhone 3GS]] using [[AT+XLOG Vulnerability|the same exploit as ultrasn0w]], but handled differently. Minutes later, an explanation and source code was posted.
* July 7 -- [[The dev team]] updates [[redsn0w]] and [[ultrasn0w]] to version 0.8, now with [[iPhone 3GS]] support. Saurik also updates Winterboard to support the [[iPhone 3GS]].
* July 3 -- [[Geohot]] releases [[purplera1n]], a software jailbreak for the [[iPhone 3GS]].

===June===
* June 28 -- [[Geohot]] posts pictures on his blog of the first fully jailbroken [[iPhone 3GS]].
* June 25 -- It's discovered that [[iPhone 3GS]] is vulnerable to [[0x24000 Segment Overflow|24kpwn]] exploit.
* June 24 -- [[The dev team]] release [[ultrasn0w]] unlock for [[iPhone 3G]] thanks to [[AT+XLOG Vulnerability|a new exploit]] discovered by [[User:Oranav|Oranav]].
* June 23 -- [[Geohot]] announces he's found a new exploit in [[iBoot]] he calls purplera1n.
* June 19 -- Release of [[iPhone2,1|iPhone 3GS]] to the public and the release of [[PwnageTool|Pwnage Tool 3.0]] and [[RedSn0w|Redsn0w]] for jailbreaking devices running firmware 3.0
* June 17 -- Release of firmware 3.0 to the public.
* June 8 -- Apple announces the [[iPhone2,1|iPhone 3GS]].

===March===
* March 10 -- The [[0x24000 Segment Overflow|untethered jailbreak]] for the [[iPod touch 2G]] is released thanks to the combined work of chronic, CPICH, posixninja, pod2g, ius, planetbeing, [[MuscleNerd]], and co after being leaked and sold by [[NitroKey]]. To prevent users wasting their money on a stolen exploit, the Hybrid DevTeam decided to release it immediately.

===January===
* January 31 -- The [[iPhone Dev Team]] released a [[redsn0w Lite]], a tethered jailbreak for the [[N72ap|iPod touch 2G]]. It combines the [[ARM7 Go]] vulnerability with the well-established pwnage flow for other Apple mobile devices. It was bundled in a way that will allow usage on the 2.2.1 firmware through uploading the [[ARM7 Go]] vulnerable 2.1.1 iBoot to the device while in DFU mode.

* January 25 -- [[0wnboot]] is released to chronicdev google code page, thanks to AriX, chronic, CPICH, westbaer, ius, pod2g, the rest of the iPod devel crew on IRC, and to the #iphone-hax lab rats. Within days, the AriX and the chronic dev team got a ramdisk booting for a tethered jailbreak.

* January 17 -- [[MuscleNerd]] of the [[iPhone Dev Team]] [http://twitter.com/MuscleNerd/status/1127346766 shows a video demo] of the first jailbroken iPod Touch 2G.

* January 16 -- [[ARM7 Go]] hole disclosed where else but here on The iPhone Wiki, for developers to poke and prod at

* January 15 -- The [[iPhone Dev Team]] [http://twitter.com/iphone_dev/status/1120595069 tweets the vfdecrypt key] for the [[iPod touch 2G]] 2.2 firmware, demonstrating for the first time that unsigned code can now be run on that device.

* January 1 -- The [[iPhone Dev Team]] releases [[yellowsn0w]] 0.9 beta for baseband 02.28.00.

==2008==

===December===
* December 21 -- [[MuscleNerd]], of [[the dev team]] does a live demo of the 3G unlock, dubbed as 'yellowsn0w': http://qik.com/video/729275

===August===
* August 18 -- [[The dev team]] releases [http://wikee.iphwn.org/news:pwnage20announcement QuickPwn], a 2.x [[pwnage]]/ramdisk combination exploit that allows jailbreaking without needing to create custom IPSWs.

===July===
* July 22 -- [[TA_Mobile]] hardware dumps the 3G baseband (bootloader 5.8 & FW 1.45.00) by desoldering the [[NOR]].
* July 19 -- [[The dev team]] releases [[PwnageTool]] 2.0, jailbreaking and unlocking the 2.0 software on the iPhone 2G and jailbreaking the 2.0 software on the iPhone 3G.
* July 11 -- [[iPhone 3G]] is released.

===June===
* June 9 - [[iPhone 3G]] is announced at [[WWDC]] '08.

===April===
* April 3 -- Dev team releases [[PwnageTool]] 1.0, making use of the pmdx exploit (to patch RSA checks out of the [[kernel]], to write unsigned to [[NOR]])

===March===
* March 12 -- Dev team releases dual-boot jailbreak method, only to be silently fixed in 2.0.
* March 4 -- [[User:N000b|George Zhu (n000b)]] releases [[ILiberty / ILiberty%2B]].

===February===
* February 28 -- [[Cydia]] is released as an open-source alternative to Installer.app, and prepares to take over the jailbreak application scene upon 2.0's release.
* February 11 -- [[Zibri]] releases [[ZiPhone]], the first all-in-one unlock, activate, jailbreak solution.
* February 8 -- [[User:Geohot|geohot]] releases software unlock for 4.6, Apple states 25% of phones were never activated with AT&T.

===January===
* January 28 -- Dev team releases soft upgrade jailbreak for 1.1.3.
* January 18 -- Geohot and his friends [http://iphonejtag.blogspot.com/2008/01/112-otb-unlocked.html unlocked 1.1.2 OTB 4.6 by test point], the unbeatable version at that time.
* January 18 -- Dev team posts YouTube video of a jailbroken 1.1.3, which was made possible by the dual boot jailbreak from bgm.

== 2007 ==
===November===
* November 15 -- New baseband [[Bootloader 4.6|bootloader (4.6)]] comes out, new iPhones can't be unlocked.
* November 2 -- [[Jailbreakme]] is released, bringing jailbreaking to the mainstream iPhone user.

===October===
* October 23 -- iPhone-Elite Team releases the [[Virginizer]].
* October 14 -- AriX releases iJailBreak, the first automated iPod touch jailbreak for the Mac.
* October 12 -- planetbeing releases touchFree, the first automated iPod touch jailbreak.
* October 10 -- niacin, cmw, and dre release the [[LibTiff]] exploit to jailbreak the iPod touch, which is later adapted for use in [[Jailbreakme]].

===September===
* September 11 -- [[The dev team]] releases [[iUnlock]], first free software unlock.
* September 10 -- [[IPSF]] releases first paid software unlock.
* September 9 -- Apple announces the [[iPod touch]] at a media event.

===August===
* August 23 -- [[User:Geohot|geohot]] and team release [[hardware unlock]] method.
* August 21 -- Installer.app is released by Nullriver, first GUI apps are distributed.

===July===
* July 23 -- First phones are used with other carriers by means of [[SIM hacks]].
* July 20 -- nightwatch adapts a [[toolchain]] to the iPhone. The first apps are compiled.
* July 9 -- [[The dev team]] releases a [[jailbreak]] method. The first use of this is ringtones.
* July 3 -- DVD Jon first cracks [[activation]]. People can use the apps on the phone without a subscription.

===June===
* June 29 -- [[iPhone]] is released. World's most hyped consumer product.

Usb control msg(0x21, 2) Exploit

2010-07-13T15:47:32Z

Redart: Info about 3.1.3 closing exploit

{{DISPLAYTITLE:usb_control_msg(0x21, 2) Exploit}}
This vulnerability exists in versions 3.1, 3.1.1, 3.1.2 (and probably previous) of iBoot on all iDevices, fixed in 3.1.3 firmware. Users of iPhone 3GS (new bootrom), iPT2 (MC) and iPT3 who saved their SHSH for 3.1.2 firmware can use it for tethered jailbreak of firmware 4.0 [http://ih8sn0wforums.com/viewtopic.php?f=56&t=1928]
== Credit (Alphabetical) ==
* '''vulnerability''': pod2g and westbaer, also discovered independently by gray, also discovered independently by [[geohot]]
* '''exploitation''': ius, chronic, pod2g, and posixninja
* '''payload ([[greenpois0n]])''': chronic and posixninja

== Vulnerability ==
'''pod2g''' and '''westbaer''' discovered, via some reversing + fuzzing, you could overwrite the content of 0x0 thanks to Apple not checking the contents of a register they should have, shown in the disassm below. Now, the reason that this is useful is because the MMU maps whatever is running ([[LLB]], [[iBoot]], etc.) to 0x0 so that if an exception vector is triggered, it would jump to the one designed to be used with what is running, versus jumping to what is normally located at 0x0, the [[S5L8920 (Bootrom)|bootrom]].

All you need to do is send the following (assuming you're using libusb 0.1.x)...
usb_control_msg(iDev, 0x21, 2, 0, 0, 0, 0, 1000);
And thanks to our vulnerability, it will do this:
memcpy(0, LOAD_ADDR, 0x2000);

As you can see, we have full control over the first 0x2000 bytes of iBoot.

=== Disassm ===
<pre>
// R5: a pointer to a buffer is here if requesttype==0xA1.
// however, if requesttype==0x21, R5 is undefined.

SRAM:22009ED2 code_1 ; CODE XREF: handle_file_io_control_req+62�j
SRAM:22009ED2 014 36 49 LDR R1, =usb_file_loadaddr
SRAM:22009ED4 014 36 4B LDR R3, =usb_file_offset
SRAM:22009ED6 014 28 68 LDR R0, [R5]
SRAM:22009ED8 014 09 68 LDR R1, [R1]
SRAM:22009EDA 014 1B 68 LDR R3, [R3]
SRAM:22009EDC 014 22 1C ADDS R2, R4, #0
SRAM:22009EDE 014 C9 18 ADDS R1, R1, R3
SRAM:22009EE0 014 07 F0 94 EF BLX memcpy
SRAM:22009EE4 014 00 2E CMP R6, #0
SRAM:22009EE6 014 53 D0 BEQ return
SRAM:22009EE8 014 01 23 MOVS R3, #1
SRAM:22009EEA 014 33 60 STR R3, [R6]
SRAM:22009EEC 014 50 E0 B return
</pre>

== Exploitation ==
So, how do you actually run code with this? Well, '''chronic''' suggested that since the irq vector was in constant use, we try that, so we were able to simply replace the address of the irq vector handler (0x00000038) in the 0x2000 [[iBoot]] chunk that we send with 0x41002000, and then just tack our payload to the end of that chunk. Of course, since we are hijacking the irq exception, you must disable interrupts first. Here is the basic procedure:
* Call enter_critical_task(); disabling interrupts, so that your code can reliably execute.
* Restore 0x38 (irq handler) with the original irq vector address
* '''DO WHAT YOU WANT AT THIS POINT, YOU MAY NOT USE INTERRUPTS'''.
* Call exit_critical_task(); re-enabling interrupts.
* Call the irq handler so that the interrupt request that you hijacked can execute.

=== Roadblocks ===
* If what you send is not 0x2000 bytes, the remainder is filled in with zeroes, which is bad.
* Due to the above rule, you need the first 0x2000 of a decrypted iBoot by the time your payload is done running.
* You must disable interrupts to reliably execute your payload. Due to this, this will rule out the possibility of reading the 0x2000 iBoot chunk needed from NOR, since nor_read(); requires interrupts.

One way to get around the need of sending the 0x2000 [[iBoot]] chunk is to hook the image_load(); function in the LLB which is sitting intact in memory. This was successfully done in [[blackra1n]].

The [[PwnageTool]] method requires an [[IPSW]] to be input in order to create a custom firmware anyway, so the 0x2000 chunk is not an issue. It can just be copied from the [[iBoot]] in the [[IPSW]].

=== Implementation ===
[[blackra1n]]

[[Category:Exploits]]

Firmware

2010-06-18T05:35:35Z

Redart: /* iPhone */ It seems that BB WF for 1.0.0 was incorrect

This is the operating system the iPhone/iPod Touch runs. Latest Apple download links can be found [http://www.itunes.com/version here].

==Comparison of firmware versions==

===[[K48ap|iPad]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="70"| [[Baseband]] (3G only)
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 3.2
| [[Wildcat 7B367 (iPad)|Wildcat 7B367]]
| 06.15.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPad/061-7987.20100403.mjiTr/iPad1,1_3.2_7B367_Restore.ipsw iPad1,1_3.2_7B367_Restore.ipsw]
| <code>172e8297af74b91971a802e6ad137c891f553099</code>
| Initial shipment.
| {{yes}}
| 478,959,325
|}

===[[M68ap|iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Can be [[jailbreak|jailbroken]]?
!width="95"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{yes}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| Heavenly 1A543a
| 03.11.02_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| Heavenly 1C25
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| Heavenly 1C28
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| Snowbird 3A109a
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| Oktoberfest 3B48b
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| Little Bear 4A93
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| Little Bear 4A102
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| Big Bear 5A347
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
| {{yes}}
| 228,768,637
|-
| 2.0.1
| Big Bear 5B108
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| {{yes}}
| 254,048,068
|-
| 2.0.2
| Big Bear 5C1
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| {{yes}}
| 253,589,000
|-
| 2.1
| Sugar Bowl 5F136
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| {{yes}}
| 242,171,241
|-
| 2.2
| Timberline 5G77
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| {{yes}}
| 257,576,980
|-
| 2.2.1
| SUTimberline 5H11
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
|
| {{yes}}
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| {{yes}}
| 252,536,460
|-
| 3.1.2
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code>
|
| {{yes}}
| {{yes}}
| 252,515,888
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone)|SUNorthstarTwo 7E18]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7481.20100202.4orot/iPhone1,1_3.1.3_7E18_Restore.ipsw iPhone1,1_3.1.3_7E18_Restore.ipsw]
| <code>eab23a7f8d2a17cb71046c50fc5f67ec390a3c2b</code>
|
| {{yes}}
| {{yes}}
| 238,319,275
|}

===[[N82ap|iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Can be [[jailbreak|jailbroken]]?
!width="95"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 2.0
| Big Bear 5A345
| 01.45.00
| No download available
|
| Initial shipment.
| {{yes}}
| {{no}}
|
|-
| 2.0
| Big Bear 5A347
| 01.45.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| {{no}}
| 235,957,125
|-
| 2.0.1
| Big Bear 5B108
| 01.48.02
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| {{no}}
| 261,224,227
|-
| 2.0.2
| Big Bear 5C1
| 02.08.01
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| {{no}}
| 260,761,030
|-
| 2.1
| Sugar Bowl 5F136
| 02.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| {{no}}
| 249,341,655
|-
| 2.2
| Timberline 5G77
| 02.28.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|yellowsn0w]]}}
| 258,342,348
|-
| 2.2.1
| SUTimberline 5H11
| 02.30.03
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{no}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|ultrasn0w]]}}
| 241,229,233
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone 3G)|Kirkwood 7A400]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|ultrasn0w]]}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
| {{yes|[[blacksn0w]]}}
| 253,361,339
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3G)|Northstar 7D11]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| {{yes}}
| {{yes|[[blacksn0w]]}}
| 253,340,786
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3G)|SUNorthstarTwo 7E18]]
| 05.12.01
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7468.20100202.pbnrt/iPhone1,2_3.1.3_7E18_Restore.ipsw iPhone1,2_3.1.3_7E18_Restore.ipsw]
| <code>f5950afca546f93e281ba3cdb08bc0cfed7f0896</code>
|
| {{yes}}
| {{no}}
| 239,139,281
|}

===[[N88ap|iPhone 3GS]]===

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Can be [[jailbreak|jailbroken]]?
!width="95"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
| {{yes|[[Ultrasn0w|ultrasn0w]]}}
| 312,292,933
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|ultrasn0w]]}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
|
| {{yes}}
| {{yes|[[blacksn0w]]}}
| 321,011,474
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3GS)|Northstar 7D11]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code>
|
| {{yes}}
| {{yes|[[blacksn0w]]}}
| 321,015,700
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|SUNorthstarTwo 7E18]]
| 05.12.01
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7472.20100202.8tugj/iPhone2,1_3.1.3_7E18_Restore.ipsw iPhone2,1_3.1.3_7E18_Restore.ipsw]
| <code>8cb3775e62c6f72059a962bf891b4e145b965052</code>
|
| {{yes}}
| {{no}}
| 305,122,343
|}

===[[N90ap|iPhone 4]]===

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Can be [[jailbreak|jailbroken]]?
!width="95"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 4.0
| [[Apex 8A293 (iPhone 4)|Apex 8A293]]
| 01.59.00
| not released yet
| ?
| Initial shipment.
| {{no}}
| {{no}}
| ?
|}

===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 1.1.0
| Snowbird 3A100a
| No download available
|
| Initial shipment.
| {{yes}}
|
|-
| 1.1.0
| Snowbird 3A101a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{yes}}
| 157,890,186
|-
| 1.1.1
| Snowbird 3A110a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| Oktoberfest 3B48b
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| Little Bear 4A93
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| Little Bear 4A102
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| Little Bear 4B1
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| Big Bear 5A347
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| Big Bear 5B108
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| Big Bear 5C1
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| Sugar Bowl 5F137
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| Timberline 5G77
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| SUTimberline 5H11
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| Kirkwood 7A341
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| Northstar 7C145
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| Northstar 7D11
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| {{yes}}
| 249,780,497
|-
| 3.1.3
| SUNorthstarTwo 7E18
| Download Link Prohibited
| <code>5f897990f19d2f093b35e0813d7d77806404fb1f</code>
|
| {{yes}}
| 235,678,189
|}

===[[N72ap|iPod touch (2nd generation)]]===

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes}}
| 282,083,944
|-
| 2.2
| Timberline 5G77a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{yes}}
| 291,123,491
|-
| 2.2.1
| SUTimberline 5H11a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.x is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
|
| {{yes}}
| 277,753,989
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 2G)|Northstar 7D11]]
| Download Link Prohibited
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code>
|
| {{yes}}
| 277,794,671
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f4f5c01eda2f811f73167e7d1f82dbeed82367b</code>
|
| {{yes}}
| 263,275,211
|}

===[[N18AP|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| {{yes}}

| 311,702,789
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| {{yes}}
| 311,690,768
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code>
|
| {{yes}}
| 311,740,034
|-
| 3.1.3
| SUNorthstarTwo 7E18
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7473.20100202.4i44t/iPod3,1_3.1.3_7E18_Restore.ipsw iPod3,1_3.1.3_7E18_Restore.ipsw]
| <code>375fd469b18bfc0b74c7cfa5b4d5945197b1d106</code>
|
| {{yes}}
| 295,870,806
|}

==See also==
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://pastebin.ca/1209360 A link of interest...]

Firmware

2010-02-04T13:47:15Z

Redart: /* iPhone 3GS */ Custom 3GS FW 3.1.3 is out

This is the operating system the iPhone/iPod Touch runs. Latest Apple download links can be found [http://www.itunes.com/version here].

==Comparison of firmware versions==

===[[M68ap|iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Can be [[jailbreak|jailbroken]]?
!width="95"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{yes}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| Heavenly 1A543a
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| Heavenly 1C25
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| Heavenly 1C28
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| Snowbird 3A109a
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| Oktoberfest 3B48b
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| Little Bear 4A93
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| Little Bear 4A102
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| Big Bear 5A347
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
| {{yes}}
| 228,768,637
|-
| 2.0.1
| Big Bear 5B108
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| {{yes}}
| 254,048,068
|-
| 2.0.2
| Big Bear 5C1
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| {{yes}}
| 253,589,000
|-
| 2.1
| Sugar Bowl 5F136
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| {{yes}}
| 242,171,241
|-
| 2.2
| Timberline 5G77
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| {{yes}}
| 257,576,980
|-
| 2.2.1
| SUTimberline 5H11
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
|
| {{yes}}
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| {{yes}}
| 252,536,460
|-
| 3.1.2
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code>
|
| {{yes}}
| {{yes}}
| 252,515,888
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone)|SUNorthstarTwo 7E18]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7481.20100202.4orot/iPhone1,1_3.1.3_7E18_Restore.ipsw iPhone1,1_3.1.3_7E18_Restore.ipsw]
| <code>eab23a7f8d2a17cb71046c50fc5f67ec390a3c2b</code>
|
| {{yes}}
| {{yes}}
| 238,319,275
|}

===[[N82ap|iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Can be [[jailbreak|jailbroken]]?
!width="95"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 2.0
| Big Bear 5A345
| 01.45.00
| No download available
|
| Initial shipment.
| {{yes}}
| {{no}}
|
|-
| 2.0
| Big Bear 5A347
| 01.45.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| {{no}}
| 235,957,125
|-
| 2.0.1
| Big Bear 5B108
| 01.48.02
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| {{no}}
| 261,224,227
|-
| 2.0.2
| Big Bear 5C1
| 02.08.01
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| {{no}}
| 260,761,030
|-
| 2.1
| Sugar Bowl 5F136
| 02.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| {{no}}
| 249,341,655
|-
| 2.2
| Timberline 5G77
| 02.28.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|yellowsn0w]]}}
| 258,342,348
|-
| 2.2.1
| SUTimberline 5H11
| 02.30.03
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{no}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|ultrasn0w]]}}
| 241,229,233
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|ultrasn0w]]}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
| {{yes|[[blacksn0w]]}}
| 253,361,339
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3G)|Northstar 7D11]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| {{yes}}
| {{yes|[[blacksn0w]]}}
| 253,340,786
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3G)|SUNorthstarTwo 7E18]]
| 05.12.01
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7468.20100202.pbnrt/iPhone1,2_3.1.3_7E18_Restore.ipsw iPhone1,2_3.1.3_7E18_Restore.ipsw]
| <code>f5950afca546f93e281ba3cdb08bc0cfed7f0896</code>
|
| {{yes}}
| {{no}}
| 239,139,281
|}

===[[N88ap|iPhone 3GS]]===
Due to a new bootrom designed to close the [[0x24000 Segment Overflow]], an iPhone 3GS produced around year 2009 week 40/41 or later is currently limited to a '''tethered jailbreak'''.

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Can be [[jailbreak|jailbroken]]?
!width="95"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
| {{yes|[[Ultrasn0w|ultrasn0w]]}}
| 312,292,933
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|ultrasn0w]]}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
| Installed on phones produced week 37.
| {{yes}}
| {{yes|[[blacksn0w]]}}
| 321,011,474
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3GS)|Northstar 7D11]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code>
|
| {{yes}}
| {{yes|[[blacksn0w]]}}
| 321,015,700
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|SUNorthstarTwo 7E18]]
| 05.12.01
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7472.20100202.8tugj/iPhone2,1_3.1.3_7E18_Restore.ipsw iPhone2,1_3.1.3_7E18_Restore.ipsw]
| <code>8cb3775e62c6f72059a962bf891b4e145b965052</code>
|
| {{no|No, for OTB phones}}
| {{no}}
| 305,122,343
|}

===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 1.1.0
| Snowbird 3A100a
| No download available
|
| Initial shipment.
| {{yes}}
|
|-
| 1.1.0
| Snowbird 3A101a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{yes}}
| 157,890,186
|-
| 1.1.1
| Snowbird 3A110a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| Oktoberfest 3B48b
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| Little Bear 4A93
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| Little Bear 4A102
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| Little Bear 4B1
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| Big Bear 5A347
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| Big Bear 5B108
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| Big Bear 5C1
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| Sugar Bowl 5F137
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| Timberline 5G77
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| SUTimberline 5H11
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| Kirkwood 7A341
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| Northstar 7C145
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| Northstar 7D11
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| {{yes}}
| 249,780,497
|-
| 3.1.3
| SUNorthstarTwo 7E18
| Download Link Prohibited
| <code>5f897990f19d2f093b35e0813d7d77806404fb1f</code>
|
| {{yes}}
| 235,678,189
|}

===[[N72ap|iPod touch (2nd generation)]]===
Due to a new bootrom designed to close the [[0x24000 Segment Overflow]], an iPod touch 2G with a model number beginning with "MC" is currently limited to a tethered jailbreak.

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes}}
| 282,083,944
|-
| 2.2
| Timberline 5G77a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{yes}}
| 291,123,491
|-
| 2.2.1
| SUTimberline 5H11a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
|
| {{yes}}
| 277,753,989
|-
| 3.1.2
| Northstar 7D11
| Download Link Prohibited
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code>
|
| {{yes}}
| 277,794,671
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f4f5c01eda2f811f73167e7d1f82dbeed82367b</code>
|
| {{yes}}
| 263,275,211
|}

===[[N18AP|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| style="background:yellow; color:black;" class="table-yes" | Tethered

| 311,702,789
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| style="background:yellow; color:black;" class="table-yes" | Tethered
| 311,690,768
|-
| 3.1.2
| Northstar 7D11
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code>
|
| style="background:yellow; color:black;" class="table-yes" | Tethered
| 311,740,034
|-
| 3.1.3
| SUNorthstarTwo 7E18
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7473.20100202.4i44t/iPod3,1_3.1.3_7E18_Restore.ipsw iPod3,1_3.1.3_7E18_Restore.ipsw]
| <code>375fd469b18bfc0b74c7cfa5b4d5945197b1d106</code>
|
| {{no}}
| 295,870,806
|}

==See also==
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://pastebin.ca/1209360 A link of interest...]

MobileDevice Library

2009-11-20T19:29:16Z

Redart: /* MobileDevice Header (mobiledevice.h) */ Added version info

MobileDevice Library is used by [[iTunes]] to transfer data between iPhone and computer over the USB connection.

===PC Windows : iTunesMobileDevice.dll===

* Location : Location is stored in '''iTunesMobileDeviceDLL''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Mobile Device Support\Shared''' key. Usually - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\iTunesMobileDevice.dll.

* Supporting CoreFoundation.dll (used for CFStringRef, CFPropertyListRef management) is located in the same dir (when using iTunes prior 9.0).

* For iTunes 9.0 location of CoreFoundation.dll is stored in '''InstallDir''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Application Support''' key, usually C:\Program Files\Common Files\Apple\Apple Application Support\. CoreFoundation.dll from Mobile Device Support\bin should not be used.

===Mac OSX : MobileDevice.framework===

* Location : /System/Library/PrivateFrameworks/MobileDevice.framework
* Export command : "nm /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/MobileDevice"

===MobileDevice Header (mobiledevice.h)===

Reverse engineered C header for MobileDevice Library.

<pre>
/* ----------------------------------------------------------------------------
* MobileDevice.h - interface to MobileDevice.framework
* ------------------------------------------------------------------------- */
#pragma once

#ifndef MOBILEDEVICE_H
#define MOBILEDEVICE_H

#ifdef __cplusplus
extern "C" {
#endif

#ifndef __GCC__
#pragma pack
#define __PACK
#else
#define __PACK __attribute__((__packed__))
#endif

#if defined(WIN32)
#define __DLLIMPORT [DllImport("iTunesMobileDevice.dll")]
using namespace System::Runtime::InteropServices;
#include <CoreFoundation.h>
typedef unsigned int mach_error_t;
#elif defined(__APPLE__)
#define __DLLIMPORT
#include <CoreFoundation/CoreFoundation.h>
#include <mach/error.h>
#endif

/* Error codes */
#define MDERR_APPLE_MOBILE (err_system(0x3a))
#define MDERR_IPHONE (err_sub(0))

/* Apple Mobile (AM*) errors */
#define MDERR_OK ERR_SUCCESS
#define MDERR_SYSCALL (ERR_MOBILE_DEVICE | 0x01)
#define MDERR_OUT_OF_MEMORY (ERR_MOBILE_DEVICE | 0x03)
#define MDERR_QUERY_FAILED (ERR_MOBILE_DEVICE | 0x04)
#define MDERR_INVALID_ARGUMENT (ERR_MOBILE_DEVICE | 0x0b)
#define MDERR_DICT_NOT_LOADED (ERR_MOBILE_DEVICE | 0x25)

/* Apple File Connection (AFC*) errors */
#define MDERR_AFC_OUT_OF_MEMORY 0x03

/* USBMux errors */
#define MDERR_USBMUX_ARG_NULL 0x16
#define MDERR_USBMUX_FAILED 0xffffffff

/* Messages passed to device notification callbacks: passed as part of
* am_device_notification_callback_info. */
#define ADNCI_MSG_CONNECTED 1
#define ADNCI_MSG_DISCONNECTED 2
#define ADNCI_MSG_UNSUBSCRIBED 3

#define AMD_IPHONE_PRODUCT_ID 0x1290
//#define AMD_IPHONE_SERIAL ""

/* Services, found in /System/Library/Lockdown/Services.plist */
#define AMSVC_AFC CFSTR("com.apple.afc")
#define AMSVC_BACKUP CFSTR("com.apple.mobilebackup")
#define AMSVC_CRASH_REPORT_COPY CFSTR("com.apple.crashreportcopy")
#define AMSVC_DEBUG_IMAGE_MOUNT CFSTR("com.apple.mobile.debug_image_mount")
#define AMSVC_NOTIFICATION_PROXY CFSTR("com.apple.mobile.notification_proxy")
#define AMSVC_PURPLE_TEST CFSTR("com.apple.purpletestr")
#define AMSVC_SOFTWARE_UPDATE CFSTR("com.apple.mobile.software_update")
#define AMSVC_SYNC CFSTR("com.apple.mobilesync")
#define AMSVC_SCREENSHOT CFSTR("com.apple.screenshotr")
#define AMSVC_SYSLOG_RELAY CFSTR("com.apple.syslog_relay")
#define AMSVC_SYSTEM_PROFILER CFSTR("com.apple.mobile.system_profiler")

typedef unsigned int afc_error_t;
typedef unsigned int usbmux_error_t;

struct am_recovery_device;

struct am_device_notification_callback_info {
struct am_device *dev; /* 0 device */
unsigned int msg; /* 4 one of ADNCI_MSG_* */
struct am_device_notification* subscription;
} __PACK;

/* The type of the device restore notification callback functions.
* TODO: change to correct type. */
typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *);

/* This is a CoreFoundation object of class AMRecoveryModeDevice. */
struct am_recovery_device {
unsigned char unknown0[8]; /* 0 */
am_restore_device_notification_callback callback; /* 8 */
void *user_info; /* 12 */
unsigned char unknown1[12]; /* 16 */
unsigned int readwrite_pipe; /* 28 */
unsigned char read_pipe; /* 32 */
unsigned char write_ctrl_pipe; /* 33 */
unsigned char read_unknown_pipe; /* 34 */
unsigned char write_file_pipe; /* 35 */
unsigned char write_input_pipe; /* 36 */
} __PACK;

/* A CoreFoundation object of class AMRestoreModeDevice. */
struct am_restore_device {
unsigned char unknown[32];
int port;
} __PACK;

/* The type of the device notification callback function. */
typedef void(*am_device_notification_callback)(struct am_device_notification_callback_info *, int cookie);

/* The type of the _AMDDeviceAttached function.
* TODO: change to correct type. */
typedef void *amd_device_attached_callback;

/* The type of the device restore notification callback functions.
* TODO: change to correct type. */
typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *);

/* Structure that contains internal data used by AMDevice... functions. Never try
* to access its members directly! Use AMDeviceCopyDeviceIdentifier,
* AMDeviceGetConnectionID, AMDeviceRetain, AMDeviceRelease instead. */
struct am_device {
unsigned char unknown0[16]; /* 0 - zero */
unsigned int device_id; /* 16 */
unsigned int product_id; /* 20 - set to AMD_IPHONE_PRODUCT_ID */
char *serial; /* 24 - set to UDID, Unique Device Identifier */
unsigned int unknown1; /* 28 */
unsigned int unknown2; /* 32 - reference counter, increased by AMDeviceRetain, decreased by AMDeviceRelease*/
unsigned int lockdown_conn; /* 36 */
unsigned char unknown3[8]; /* 40 */
#if (__ITUNES_VER > 740)
unsigned int unknown4; /* 48 - used to store CriticalSection Handle*/
#endif
#if (__ITUNES_VER >= 800)
unsigned char unknown5[24]; /* 52 */
#endif
} __PACK;

struct am_device_notification {
unsigned int unknown0; /* 0 */
unsigned int unknown1; /* 4 */
unsigned int unknown2; /* 8 */
am_device_notification_callback callback; /* 12 */
unsigned int cookie; /* 16 */
} __PACK;

struct afc_connection {
unsigned int handle; /* 0 */
unsigned int unknown0; /* 4 */
unsigned char unknown1; /* 8 */
unsigned char padding[3]; /* 9 */
unsigned int unknown2; /* 12 */
unsigned int unknown3; /* 16 */
unsigned int unknown4; /* 20 */
unsigned int fs_block_size; /* 24 */
unsigned int sock_block_size; /* 28: always 0x3c */
unsigned int io_timeout; /* 32: from AFCConnectionOpen, usu. 0 */
void *afc_lock; /* 36 */
unsigned int context; /* 40 */
} __PACK;

struct afc_device_info {
unsigned char unknown[12]; /* 0 */
} __PACK;

struct afc_directory {
unsigned char unknown[0]; /* size unknown */
} __PACK;

struct afc_dictionary {
unsigned char unknown[0]; /* size unknown */
} __PACK;

typedef unsigned long long afc_file_ref;

struct usbmux_listener_1 { /* offset value in iTunes */
unsigned int unknown0; /* 0 1 */
unsigned char *unknown1; /* 4 ptr, maybe device? */
amd_device_attached_callback callback; /* 8 _AMDDeviceAttached */
unsigned int unknown3; /* 12 */
unsigned int unknown4; /* 16 */
unsigned int unknown5; /* 20 */
} __PACK;

struct usbmux_listener_2 {
unsigned char unknown0[4144];
} __PACK;

struct am_bootloader_control_packet {
unsigned char opcode; /* 0 */
unsigned char length; /* 1 */
unsigned char magic[2]; /* 2: 0x34, 0x12 */
unsigned char payload[0]; /* 4 */
} __PACK;

/* ----------------------------------------------------------------------------
* Public routines
* ------------------------------------------------------------------------- */

/* Registers a notification with the current run loop. The callback gets
* copied into the notification struct, as well as being registered with the
* current run loop. Cookie gets copied into cookie in the same.
* (Cookie is a user info parameter that gets passed as an arg to
* the callback) unused0 and unused1 are both 0 when iTunes calls this.
*
* Never try to acces directly or copy contents of dev and subscription fields
* in am_device_notification_callback_info. Treat them as abstract handles.
* When done with connection use AMDeviceRelease to free resources allocated for am_device.
*
* Returns:
* MDERR_OK if successful
* MDERR_SYSCALL if CFRunLoopAddSource() failed
* MDERR_OUT_OF_MEMORY if we ran out of memory
*/
__DLLIMPORT mach_error_t AMDeviceNotificationSubscribe(am_device_notification_callback callback,
unsigned int unused0, unsigned int unused1,
unsigned int cookie,
struct am_device_notification **subscription);

/* Unregisters notifications. Buggy (iTunes 8.2): if you subscribe, unsubscribe and subscribe again, arriving
notifications will contain cookie and subscription from 1st call to subscribe, not the 2nd one. iTunes
calls this function only once on exit.
*/
__DLLIMPORT mach_error_t AMDeviceNotificationUnsubscribe(am_device_notification* subscription);

/* Returns device_id field of am_device structure
*/
__DLLIMPORT unsigned int AMDeviceGetConnectionID(struct am_device *device);

/* Returns serial field of am_device structure
*/
__DLLIMPORT CFStringRef AMDeviceCopyDeviceIdentifier(struct am_device *device);

/* Connects to the iPhone. Pass in the am_device structure that the
* notification callback will give to you.
*
* Returns:
* MDERR_OK if successfully connected
* MDERR_SYSCALL if setsockopt() failed
* MDERR_QUERY_FAILED if the daemon query failed
* MDERR_INVALID_ARGUMENT if USBMuxConnectByPort returned 0xffffffff
*/
__DLLIMPORT mach_error_t AMDeviceConnect(struct am_device *device);

/* Calls PairingRecordPath() on the given device, than tests whether the path
* which that function returns exists. During the initial connect, the path
* returned by that function is '/', and so this returns 1.
*
* Returns:
* 0 if the path did not exist
* 1 if it did
*/
__DLLIMPORT mach_error_t AMDeviceIsPaired(struct am_device *device);
__DLLIMPORT mach_error_t AMDevicePair(struct am_device *device);

/* iTunes calls this function immediately after testing whether the device is
* paired. It creates a pairing file and establishes a Lockdown connection.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the supplied device is null
* MDERR_DICT_NOT_LOADED if the load_dict() call failed
*/
__DLLIMPORT mach_error_t AMDeviceValidatePairing(struct am_device *device);

/* Creates a Lockdown session and adjusts the device structure appropriately
* to indicate that the session has been started. iTunes calls this function
* after validating pairing.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
* MDERR_DICT_NOT_LOADED if the load_dict() call failed
*/
__DLLIMPORT mach_error_t AMDeviceStartSession(struct am_device *device);

/* Reads various device settings. One of domain or cfstring arguments should be NULL.
*
* Possible values for cfstring:
* ActivationState
* ActivationStateAcknowledged
* BasebandBootloaderVersion
* BasebandVersion
* BluetoothAddress
* BuildVersion
* DeviceCertificate
* DeviceClass
* DeviceName
* DevicePublicKey
* FirmwareVersion
* HostAttached
* IntegratedCircuitCardIdentity
* InternationalMobileEquipmentIdentity
* InternationalMobileSubscriberIdentity
* ModelNumber
* PhoneNumber
* ProductType
* ProductVersion
* ProtocolVersion
* RegionInfo
* SBLockdownEverRegisteredKey
* SIMStatus
* SerialNumber
* SomebodySetTimeZone
* TimeIntervalSince1970
* TimeZone
* TimeZoneOffsetFromUTC
* TrustedHostAttached
* UniqueDeviceID
* Uses24HourClock
* WiFiAddress
* iTunesHasConnected
*
* Possible values for domain:
* com.apple.mobile.battery
*/
__DLLIMPORT CFStringRef AMDeviceCopyValue(struct am_device *device, CFStringRef domain, CFStringRef cfstring);

/* Starts a service and returns a socket file descriptor that can be used in order to further
* access the service. You should stop the session and disconnect before using
* the service. iTunes calls this function after starting a session. It starts
* the service and the SSL connection. service_name should be one of the AMSVC_*
* constants.
*
* Returns:
* MDERR_OK if successful
* MDERR_SYSCALL if the setsockopt() call failed
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
*/
__DLLIMPORT mach_error_t AMDeviceStartService(struct am_device *device, CFStringRef
service_name, int *socket_fd);

/* Stops a session. You should do this before accessing services.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
*/
__DLLIMPORT mach_error_t AMDeviceStopSession(struct am_device *device);

/* Decrements reference counter and, if nothing left, releases resources hold
* by connection, invalidates pointer to device
*/
__DLLIMPORT void AMDeviceRelease(struct am_device *device);

/* Increments reference counter
*/
__DLLIMPORT void AMDeviceRetain(struct am_device *device);

/* Opens an Apple File Connection. You must start the appropriate service
* first with AMDeviceStartService(). In iTunes, io_timeout is 0.
*
* Returns:
* MDERR_OK if successful
* MDERR_AFC_OUT_OF_MEMORY if malloc() failed
*/
__DLLIMPORT afc_error_t AFCConnectionOpen(int socket_fd, unsigned int io_timeout,
struct afc_connection **conn);

/* Pass in a pointer to an afc_dictionary structure. It will be filled. You can
* iterate it using AFCKeyValueRead. When done use AFCKeyValueClose. Possible keys:
* FSFreeBytes - free bytes on system device for afc2, user device for afc
* FSBlockSize - filesystem block size
* FSTotalBytes - size of device
* Model - iPhone1,1 etc.

*/
__DLLIMPORT afc_error_t AFCDeviceInfoOpen(struct afc_connection *conn, struct
afc_dictionary **info);

/* Turns debug mode on if the environment variable AFCDEBUG is set to a numeric
* value, or if the file '/AFCDEBUG' is present and contains a value. */
#if defined(__APPLE__)
void AFCPlatformInit();
#endif

/* Opens a directory on the iPhone. Pass in a pointer in dir to be filled in.
* Note that this normally only accesses the iTunes sandbox/partition as the
* root, which is /var/root/Media. Pathnames are specified with '/' delimiters
* as in Unix style. Use UTF-8 to specify non-ASCII symbols in path.
*
* Returns:
* MDERR_OK if successful
*/
__DLLIMPORT afc_error_t AFCDirectoryOpen(struct afc_connection *conn, char *path, struct
afc_directory **dir);

/* Acquires the next entry in a directory previously opened with
* AFCDirectoryOpen(). When dirent is filled with a NULL value, then the end
* of the directory has been reached. '.' and '..' will be returned as the
* first two entries in each directory except the root; you may want to skip
* over them.
*
* Returns:
* MDERR_OK if successful, even if no entries remain
*/
__DLLIMPORT afc_error_t AFCDirectoryRead(struct afc_connection *conn, struct afc_directory *dir,
char **dirent);
__DLLIMPORT afc_error_t AFCDirectoryClose(afc_connection *conn, struct afc_directory *dir);
__DLLIMPORT afc_error_t AFCDirectoryCreate(afc_connection *conn, char *dirname);
__DLLIMPORT afc_error_t AFCRemovePath(afc_connection *conn, char *dirname);
__DLLIMPORT afc_error_t AFCRenamePath(afc_connection *conn, char *oldpath, char *newpath);

#if (__ITUNES_VER >= 800)
/* Creates symbolic or hard link
* linktype - int64: 1 means hard link, 2 - soft (symbolic) link
* target - absolute or relative path to link target
* linkname - absolute path where to create new link
*/
__DLLIMPORT afc_error_t AFCLinkPath(struct afc_connection *conn, long long int linktype, const char *target,
const char *linkname);

#endif
/* Opens file for reading or writing without locking it in any way. afc_file_ref should not be shared between threads -
* opening file in one thread and closing it in another will lead to possible crash.
* path - UTF-8 encoded absolute path to file
* mode 2 = read, mode 3 = write; unknown = 0
* ref - receives file handle
*/
__DLLIMPORT afc_error_t AFCFileRefOpen(struct afc_connection *conn, char *path, unsigned
long long int mode, afc_file_ref *ref);
/* Reads specified amount (len) of bytes from file into buf. Puts actual count of read bytes into len on return
*/
__DLLIMPORT afc_error_t AFCFileRefRead(struct afc_connection *conn, afc_file_ref ref,
void *buf, unsigned int *len);
/* Writes specified amount (len) of bytes from buf into file.
*/
__DLLIMPORT afc_error_t AFCFileRefWrite(struct afc_connection *conn, afc_file_ref ref,
void *buf, unsigned int len);
/* Moves the file pointer to a specified location.
* offset - Number of bytes from origin (int64)
* origin - 0 = from beginning, 1 = from current position, 2 = from end
*/
__DLLIMPORT afc_error_t AFCFileRefSeek(struct afc_connection *conn, afc_file_ref ref,
unsigned long long offset, int origin, int unused);

/* Gets the current position of a file pointer into offset argument.
*/
__DLLIMPORT afc_error_t AFCFileRefTell(struct afc_connection *conn, afc_file_ref ref,
unsigned long long* offset);

__DLLIMPORT afc_error_t AFCFileRefLock(struct afc_connection *conn, afc_file_ref ref);
__DLLIMPORT afc_error_t AFCFileRefUnlock(struct afc_connection *conn, afc_file_ref ref);
__DLLIMPORT afc_error_t AFCFileRefClose(struct afc_connection *conn, afc_file_ref ref);

/* Opens dictionary describing specified file or directory (iTunes below 8.2 allowed using AFCGetFileInfo
to get the same information)
*/
__DLLIMPORT afc_error_t AFCFileInfoOpen(struct afc_connection *conn, char *path, struct
afc_dictionary **info);

/* Reads next entry from dictionary. When last entry is read, function returns NULL in key argument
Possible keys:
"st_size": val - size in bytes
"st_blocks": val - size in blocks
"st_nlink": val - number of hardlinks
"st_ifmt": val - "S_IFDIR" for folders
"S_IFLNK" for symlinks
"LinkTarget": val - path to symlink target
*/
__DLLIMPORT afc_error_t AFCKeyValueRead(struct afc_dictionary *dict, char **key, char **
val);
/* Closes dictionary
*/
__DLLIMPORT afc_error_t AFCKeyValueClose(struct afc_dictionary *dict);

/* Returns the context field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetContext(struct afc_connection *conn);

/* Returns the fs_block_size field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetFSBlockSize(struct afc_connection *conn);

/* Returns the io_timeout field of the given AFC connection. In iTunes this is
* 0. */
__DLLIMPORT unsigned int AFCConnectionGetIOTimeout(struct afc_connection *conn);

/* Returns the sock_block_size field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetSocketBlockSize(struct afc_connection *conn);

/* Closes the given AFC connection. */
__DLLIMPORT afc_error_t AFCConnectionClose(struct afc_connection *conn);

/* Registers for device notifications related to the restore process. unknown0
* is zero when iTunes calls this. In iTunes,
* the callbacks are located at:
* 1: $3ac68e-$3ac6b1, calls $3ac542(unknown1, arg, 0)
* 2: $3ac66a-$3ac68d, calls $3ac542(unknown1, 0, arg)
* 3: $3ac762-$3ac785, calls $3ac6b2(unknown1, arg, 0)
* 4: $3ac73e-$3ac761, calls $3ac6b2(unknown1, 0, arg)
*/
__DLLIMPORT unsigned int AMRestoreRegisterForDeviceNotifications(
am_restore_device_notification_callback dfu_connect_callback,
am_restore_device_notification_callback recovery_connect_callback,
am_restore_device_notification_callback dfu_disconnect_callback,
am_restore_device_notification_callback recovery_disconnect_callback,
unsigned int unknown0,
void *user_info);

/* Causes the restore functions to spit out (unhelpful) progress messages to
* the file specified by the given path. iTunes always calls this right before
* restoring with a path of
* "$HOME/Library/Logs/iPhone Updater Logs/iPhoneUpdater X.log", where X is an
* unused number.
*/
__DLLIMPORT unsigned int AMRestoreEnableFileLogging(char *path);

/* Initializes a new option dictionary to default values. Pass the constant
* kCFAllocatorDefault as the allocator. The option dictionary looks as
* follows:
* {
* NORImageType => 'production',
* AutoBootDelay => 0,
* KernelCacheType => 'Release',
* UpdateBaseband => true,
* DFUFileType => 'RELEASE',
* SystemImageType => 'User',
* CreateFilesystemPartitions => true,
* FlashNOR => true,
* RestoreBootArgs => 'rd=md0 nand-enable-reformat=1 -progress'
* BootImageType => 'User'
* }
*
* Returns:
* the option dictionary if successful
* NULL if out of memory
*/
__DLLIMPORT CFMutableDictionaryRef AMRestoreCreateDefaultOptions(CFAllocatorRef allocator);

/* ----------------------------------------------------------------------------
* Less-documented public routines
* ------------------------------------------------------------------------- */

__DLLIMPORT unsigned int AMRestorePerformRecoveryModeRestore(struct am_recovery_device *
rdev, CFDictionaryRef opts, void *callback, void *user_info);
__DLLIMPORT unsigned int AMRestorePerformRestoreModeRestore(struct am_restore_device *
rdev, CFDictionaryRef opts, void *callback, void *user_info);
__DLLIMPORT struct am_restore_device *AMRestoreModeDeviceCreate(unsigned int unknown0,
unsigned int connection_id, unsigned int unknown1);
__DLLIMPORT unsigned int AMRestoreCreatePathsForBundle(CFStringRef restore_bundle_path,
CFStringRef kernel_cache_type, CFStringRef boot_image_type, unsigned int
unknown0, CFStringRef *firmware_dir_path, CFStringRef *
kernelcache_restore_path, unsigned int unknown1, CFStringRef *
ramdisk_path);
__DLLIMPORT unsigned int AMRestoreModeDeviceReboot(struct am_restore_device *rdev); // Added by JB 30.07.2008
__DLLIMPORT mach_error_t AMDeviceEnterRecovery(struct am_device *device);
__DLLIMPORT mach_error_t AMDeviceDisconnect(struct am_device *device);

/* to use this, start the service "com.apple.mobile.notification_proxy", handle will be the socket to use */
typedef void (*NOTIFY_CALLBACK)(CFSTR notification, USERDATA data);
__DLLIMPORT mach_error_t AMDPostNotification(SOCKET socket, CFStringRef notification, CFStringRef userinfo);
__DLLIMPORT mach_error_t AMDObserveNotification(SOCKET socket, CFSTR notification);
__DLLIMPORT mach_error_t AMDListenForNotifications(SOCKET socket, NOTIFY_CALLBACK cb, USERDATA data);
__DLLIMPORT mach_error_t AMDShutdownNotificationProxy(SOCKET socket);

/*edits by geohot*/
__DLLIMPORT mach_error_t AMDeviceDeactivate(struct am_device *device);
__DLLIMPORT mach_error_t AMDeviceActivate(struct am_device *device, CFDictionaryRef dict);
__DLLIMPORT mach_error_t AMDeviceRemoveValue(struct am_device *device, unsigned int, CFStringRef cfstring);

/* ----------------------------------------------------------------------------
* Semi-private routines
* ------------------------------------------------------------------------- */

/* Pass in a usbmux_listener_1 structure and a usbmux_listener_2 structure
* pointer, which will be filled with the resulting usbmux_listener_2.
*
* Returns:
* MDERR_OK if completed successfully
* MDERR_USBMUX_ARG_NULL if one of the arguments was NULL
* MDERR_USBMUX_FAILED if the listener was not created successfully
*/
__DLLIMPORT usbmux_error_t USBMuxListenerCreate(struct usbmux_listener_1 *esi_fp8, struct
usbmux_listener_2 **eax_fp12);

/* ----------------------------------------------------------------------------
* Less-documented semi-private routines
* ------------------------------------------------------------------------- */
__DLLIMPORT usbmux_error_t USBMuxListenerHandleData(void *);

/* ----------------------------------------------------------------------------
* Private routines - here be dragons
* ------------------------------------------------------------------------- */

/* AMRestorePerformRestoreModeRestore() calls this function with a dictionary
* in order to perform certain special restore operations
* (RESTORED_OPERATION_*). It is thought that this function might enable
* significant access to the phone. */

/*
typedef unsigned int (*t_performOperation)(struct am_restore_device *rdev,
CFDictionaryRef op) __attribute__ ((regparm(2)));
t_performOperation _performOperation = (t_performOperation)0x3c39fa4b;
*/

/* ----------------------------------------------------------------------------
* Less-documented private routines
* ------------------------------------------------------------------------- */

/*
typedef int (*t_socketForPort)(struct am_restore_device *rdev, unsigned int port)
__attribute__ ((regparm(2)));
t_socketForPort _socketForPort = (t_socketForPort)(void *)0x3c39f36c;

typedef void (*t_restored_send_message)(int port, CFDictionaryRef msg);
t_restored_send_message _restored_send_message = (t_restored_send_message)0x3c3a4e40;

typedef CFDictionaryRef (*t_restored_receive_message)(int port);
t_restored_receive_message _restored_receive_message = (t_restored_receive_message)0x3c3a4d40;

typedef unsigned int (*t_sendControlPacket)(struct am_recovery_device *rdev, unsigned
int msg1, unsigned int msg2, unsigned int unknown0, unsigned int *unknown1,
unsigned char *unknown2) __attribute__ ((regparm(3)));
t_sendControlPacket _sendControlPacket = (t_sendControlPacket)0x3c3a3da3;;

typedef unsigned int (*t_sendCommandToDevice)(struct am_recovery_device *rdev,
CFStringRef cmd) __attribute__ ((regparm(2)));
t_sendCommandToDevice _sendCommandToDevice = (t_sendCommandToDevice)0x3c3a3e3b;

typedef unsigned int (*t_AMRUSBInterfaceReadPipe)(unsigned int readwrite_pipe, unsigned
int read_pipe, unsigned char *data, unsigned int *len);
t_AMRUSBInterfaceReadPipe _AMRUSBInterfaceReadPipe = (t_AMRUSBInterfaceReadPipe)0x3c3a27e8;

typedef unsigned int (*t_AMRUSBInterfaceWritePipe)(unsigned int readwrite_pipe, unsigned
int write_pipe, void *data, unsigned int len);
t_AMRUSBInterfaceWritePipe _AMRUSBInterfaceWritePipe = (t_AMRUSBInterfaceWritePipe)0x3c3a27cb;
*/

int performOperation(am_restore_device *rdev, CFMutableDictionaryRef message);
int socketForPort(am_restore_device *rdev, unsigned int portnum);
int sendCommandToDevice(am_recovery_device *rdev, CFStringRef cfs, int block);
int sendFileToDevice(am_recovery_device *rdev, CFStringRef filename);

#ifdef __cplusplus
}
#endif

#endif

/* -*- mode:c; indent-tabs-mode:nil; c-basic-offset:2; tab-width:2; */
</pre>

===AFC Connection===
...

===Locking the Device for Sync===
When iTunes sends a new song to the device, the device shows a "Sync in progress" screen and when complete, the Music app on the device re-reads the iTunesDB file so it picks up the new song.

To get this behaviour, first start the notification service:
<pre>SOCKET socket;
AMDeviceStartService(dev, CFSTR("com.apple.mobile.notification_proxy"), &socket, NULL);</pre>

Now we post a notificaton message to signal that we are going to start a sync:
<pre>AMDPostNotification(socket, CFSTR("com.apple.itunes-mobdev.syncWillStart"), NULL);</pre>

Next we open the itunes lock file:
<pre>afc_file_ref lockref;
AFCFileRefOpen(conn, "/com.apple.itunes.lock_sync", 2, &lockref);</pre>

Now post a notification to say we are going to lock this file, and try and lock it.
If the AFCFileRefLock call fails, pause and repeat.
<pre>AMDPostNotification(socket, CFSTR("com.apple.itunes-mobdev.syncLockRequest"), NULL);
mach_error_t error = AFCFileRefLock(conn, lockref);</pre>

When the file is successfully locked, post another notification, and stop the notification service.
<pre>AMDPostNotification(socket,CFSTR("com.apple.itunes-mobdev.syncDidStart"), NULL);
AMDShutdownNotificationProxy(socket);</pre>

Now the sync can proceed, so copy your files across and make the changes to the iTunesDB.

To release the lock, start the notification system again, unlock and close the lock file, and send a sync finished notification message:

<pre>AFCFileRefUnlock(conn, lockref);
AFCFileRefClose(conn, lockref);
AMDeviceStartService(dev, CFSTR("com.apple.mobile.notification_proxy"), &socket, NULL);
AMDPostNotification(socket, &CFSTR("com.apple.itunes-mobdev.syncDidFinish"), NULL);
AMDShutdownNotificationProxy(socket);</pre>

To handle "Slide to Cancel" and terminate sync when user slides cancel switch, use AMDObserveNotification to subscribe notifications about “com.apple.itunes-client.syncCancelRequest”. Then start listening for notifications (AMDListenForNotifications) until you get “AMDNotificationFaceplant”.
When notification got, you should unlock and close lock file handle (don’t sure if you need to post “syncDidFinish” to proxy, seems it doesn’t matter) and terminate sync gracefully.
The same notification is also got when you unplug your device, so you should always be ready for errors.

NOTE: You may find that starting the notification_proxy service once and once only at the start of your app and using the same socket in calls to AMDPostNotification works better. iTunes opens and closes the notification_proxy regularly, but it appears to be a bit flakey when you open/close it all the time.

===Private Functions===

====How to find address of privates functions in iTunesMobileDevice.dll or MobileDevice.framework ?====
...

===Libraries Implementations===

* [http://gojohnnyboi.com/source/afcinstall.cpp afcinstall (command line, os x file install via afc)]
* [http://code.google.com/p/iphuc/ iPhuc (Command line utility)]
* [http://code.google.com/p/iphucwin32/ iPhuc Win32 (Command line utility)]
* [http://code.google.com/p/manzana/ manzana (.Net Library)]
* [http://code.google.com/p/independence/source/browse/trunk/libPhoneInteraction/ libPhoneInteraction (C Library)]

Talk:Blackra1n

2009-11-04T13:40:12Z

Redart: Where is afc2?

Is there any reason why even RC3 doesn't add afc2 to services.plist? --[[User:Redart|Redart]] 13:40, 4 November 2009 (UTC)

Baseband Bootloader

2009-10-29T07:03:06Z

Redart: /* 6.4 */

The baseband bootloader is the code which runs before the baseband FW, it is responsible for signature checking and updating the baseband. See also [[bootloader]].

==Revisions==
===3.9===
This is the old bootloader from the [[iPhone]]/[[S-Gold 2]]. It is vulnerable to [[Minus 0x400]] and [[IPSF]]

===4.6===
This is the new bootloader from the [[iPhone]]/[[S-Gold 2]]. It is vulnerable to [[Minus 0x20000 with Back Extend Erase]]

===5.8===
This is the bootloader from the [[iPhone 3G]]/[[X-Gold 608]]. It is, in contrast to 3.9 and 4.6, sig checked on startup. There is an exploit where the main fw cert is passed with the loader instead of the loader cert, and it checks the main firmware instead, allowing you to upload unsigned loader code. This has been fixed in 5.9. You can downgrade from 02.30.03 to 02.28.00 using [[pHaseBanDowngrader]] (by pH) in the Bootloader 5.8.

DWD_ICE2_SECURE_BOOTLOADER/Secure_ICE2_Bootloader.5.8.fls.

===5.9===
This is the bootloader of version 2.1 and 2.2 OTB (and some 2.0 OTB) [[iPhone 3G]]/[[X-Gold 608]]. Still has no known exploits and it was released as soon as Apple knew [[iPhone Dev Team]] could downgrade their iPhone 3G baseband from 1.48 to 1.45. Now, all the iPhone 3G has bootloader 5.9 and higher.

DWD_ICE2_SECURE_BOOTLOADER/Secure_ICE2_Bootloader.5.9.fls

===6.2===
This is the latest bootloader of version 2.2.1 OTB in 2008 [[iPhone 3G]]/[[X-Gold 608]]. Still has no known exploits and it was released as soon as Apple knew [[iPhone Dev Team]] could unlock their iPhone 3G baseband version 2.28 by yellowsn0w. Now, all the iPhone 3G 2.2.1 OTB has bootloader 6.2.

DWD_ICE2_SECURE_BOOTLOADER/Secure_ICE2_Bootloader.6.2.fls
===6.4===
This is the latest bootloader of version 2.2.1 OTB in 2009 [[iPhone 3G]]/[[X-Gold 608]]. Still has no known exploits and it was released as soon as Apple released firmware 3.x beta for testing. All iPhone 3GS have bootloader 6.4 and same to iPhone 3G produced in 2009. The baseband firmware of 3.x (BB ver 4.x) now contents the loader of bootloader 6.4.

DWD_ICE2_SECURE_BOOTLOADER/Secure_ICE2_Bootloader.6.4.fls
00.00:00.00:04.24 DRV_ICE2_IFWD_04.24.00 DUALMODE SGOLD3 Apr 7 2009 ÿÿÿÿ

[[Category:Baseband]]

Talk:AT+XEMN Heap Overflow

2009-10-28T16:34:33Z

Redart: New page: Don't you think that public discussion of this vulnerability will allow Apple to fix it in the upcoming update and make all this discussions totaly useless? --~~~~

Don't you think that public discussion of this vulnerability will allow Apple to fix it in the upcoming update and make all this discussions totaly useless? --[[User:Redart|Redart]] 16:34, 28 October 2009 (UTC)

MobileDevice Library

2009-10-18T22:00:00Z

Redart: /* MobileDevice Header (mobiledevice.h) */

MobileDevice Library is used by [[iTunes]] to transfer data between iPhone and computer over the USB connection.

===PC Windows : iTunesMobileDevice.dll===

* Location : Location is stored in '''iTunesMobileDeviceDLL''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Mobile Device Support\Shared''' key. Usually - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\iTunesMobileDevice.dll.

* Supporting CoreFoundation.dll (used for CFStringRef, CFPropertyListRef management) is located in the same dir (when using iTunes prior 9.0).

* For iTunes 9.0 location of CoreFoundation.dll is stored in '''InstallDir''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Application Support''' key, usually C:\Program Files\Common Files\Apple\Apple Application Support\. CoreFoundation.dll from Mobile Device Support\bin should not be used.

===Mac OSX : MobileDevice.framework===

* Location : /System/Library/PrivateFrameworks/MobileDevice.framework
* Export command : "nm /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/MobileDevice"

===MobileDevice Header (mobiledevice.h)===

Reverse engineered C header for MobileDevice Library.

<pre>
/* ----------------------------------------------------------------------------
* MobileDevice.h - interface to MobileDevice.framework
* ------------------------------------------------------------------------- */
#pragma once

#ifndef MOBILEDEVICE_H
#define MOBILEDEVICE_H

#ifdef __cplusplus
extern "C" {
#endif

#ifndef __GCC__
#pragma pack
#define __PACK
#else
#define __PACK __attribute__((__packed__))
#endif

#if defined(WIN32)
#define __DLLIMPORT [DllImport("iTunesMobileDevice.dll")]
using namespace System::Runtime::InteropServices;
#include <CoreFoundation.h>
typedef unsigned int mach_error_t;
#elif defined(__APPLE__)
#define __DLLIMPORT
#include <CoreFoundation/CoreFoundation.h>
#include <mach/error.h>
#endif

/* Error codes */
#define MDERR_APPLE_MOBILE (err_system(0x3a))
#define MDERR_IPHONE (err_sub(0))

/* Apple Mobile (AM*) errors */
#define MDERR_OK ERR_SUCCESS
#define MDERR_SYSCALL (ERR_MOBILE_DEVICE | 0x01)
#define MDERR_OUT_OF_MEMORY (ERR_MOBILE_DEVICE | 0x03)
#define MDERR_QUERY_FAILED (ERR_MOBILE_DEVICE | 0x04)
#define MDERR_INVALID_ARGUMENT (ERR_MOBILE_DEVICE | 0x0b)
#define MDERR_DICT_NOT_LOADED (ERR_MOBILE_DEVICE | 0x25)

/* Apple File Connection (AFC*) errors */
#define MDERR_AFC_OUT_OF_MEMORY 0x03

/* USBMux errors */
#define MDERR_USBMUX_ARG_NULL 0x16
#define MDERR_USBMUX_FAILED 0xffffffff

/* Messages passed to device notification callbacks: passed as part of
* am_device_notification_callback_info. */
#define ADNCI_MSG_CONNECTED 1
#define ADNCI_MSG_DISCONNECTED 2
#define ADNCI_MSG_UNSUBSCRIBED 3

#define AMD_IPHONE_PRODUCT_ID 0x1290
//#define AMD_IPHONE_SERIAL ""

/* Services, found in /System/Library/Lockdown/Services.plist */
#define AMSVC_AFC CFSTR("com.apple.afc")
#define AMSVC_BACKUP CFSTR("com.apple.mobilebackup")
#define AMSVC_CRASH_REPORT_COPY CFSTR("com.apple.crashreportcopy")
#define AMSVC_DEBUG_IMAGE_MOUNT CFSTR("com.apple.mobile.debug_image_mount")
#define AMSVC_NOTIFICATION_PROXY CFSTR("com.apple.mobile.notification_proxy")
#define AMSVC_PURPLE_TEST CFSTR("com.apple.purpletestr")
#define AMSVC_SOFTWARE_UPDATE CFSTR("com.apple.mobile.software_update")
#define AMSVC_SYNC CFSTR("com.apple.mobilesync")
#define AMSVC_SCREENSHOT CFSTR("com.apple.screenshotr")
#define AMSVC_SYSLOG_RELAY CFSTR("com.apple.syslog_relay")
#define AMSVC_SYSTEM_PROFILER CFSTR("com.apple.mobile.system_profiler")

typedef unsigned int afc_error_t;
typedef unsigned int usbmux_error_t;

struct am_recovery_device;

struct am_device_notification_callback_info {
struct am_device *dev; /* 0 device */
unsigned int msg; /* 4 one of ADNCI_MSG_* */
struct am_device_notification* subscription;
} __PACK;

/* The type of the device restore notification callback functions.
* TODO: change to correct type. */
typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *);

/* This is a CoreFoundation object of class AMRecoveryModeDevice. */
struct am_recovery_device {
unsigned char unknown0[8]; /* 0 */
am_restore_device_notification_callback callback; /* 8 */
void *user_info; /* 12 */
unsigned char unknown1[12]; /* 16 */
unsigned int readwrite_pipe; /* 28 */
unsigned char read_pipe; /* 32 */
unsigned char write_ctrl_pipe; /* 33 */
unsigned char read_unknown_pipe; /* 34 */
unsigned char write_file_pipe; /* 35 */
unsigned char write_input_pipe; /* 36 */
} __PACK;

/* A CoreFoundation object of class AMRestoreModeDevice. */
struct am_restore_device {
unsigned char unknown[32];
int port;
} __PACK;

/* The type of the device notification callback function. */
typedef void(*am_device_notification_callback)(struct am_device_notification_callback_info *, int cookie);

/* The type of the _AMDDeviceAttached function.
* TODO: change to correct type. */
typedef void *amd_device_attached_callback;

/* The type of the device restore notification callback functions.
* TODO: change to correct type. */
typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *);

/* Structure that contains internal data used by AMDevice... functions. Never try
* to access its members directly! Use AMDeviceCopyDeviceIdentifier,
* AMDeviceGetConnectionID, AMDeviceRetain, AMDeviceRelease instead. */
struct am_device {
unsigned char unknown0[16]; /* 0 - zero */
unsigned int device_id; /* 16 */
unsigned int product_id; /* 20 - set to AMD_IPHONE_PRODUCT_ID */
char *serial; /* 24 - set to UDID, Unique Device Identifier */
unsigned int unknown1; /* 28 */
unsigned int unknown2; /* 32 - reference counter, increased by AMDeviceRetain, decreased by AMDeviceRelease*/
unsigned int lockdown_conn; /* 36 */
unsigned char unknown3[8]; /* 40 */
#if (__ITUNES_VER > 740)
unsigned int unknown4; /* 48 - used to store CriticalSection Handle*/
#endif
#if (__ITUNES_VER >= 800)
unsigned char unknown5[24]; /* 52 */
#endif
} __PACK;

struct am_device_notification {
unsigned int unknown0; /* 0 */
unsigned int unknown1; /* 4 */
unsigned int unknown2; /* 8 */
am_device_notification_callback callback; /* 12 */
unsigned int cookie; /* 16 */
} __PACK;

struct afc_connection {
unsigned int handle; /* 0 */
unsigned int unknown0; /* 4 */
unsigned char unknown1; /* 8 */
unsigned char padding[3]; /* 9 */
unsigned int unknown2; /* 12 */
unsigned int unknown3; /* 16 */
unsigned int unknown4; /* 20 */
unsigned int fs_block_size; /* 24 */
unsigned int sock_block_size; /* 28: always 0x3c */
unsigned int io_timeout; /* 32: from AFCConnectionOpen, usu. 0 */
void *afc_lock; /* 36 */
unsigned int context; /* 40 */
} __PACK;

struct afc_device_info {
unsigned char unknown[12]; /* 0 */
} __PACK;

struct afc_directory {
unsigned char unknown[0]; /* size unknown */
} __PACK;

struct afc_dictionary {
unsigned char unknown[0]; /* size unknown */
} __PACK;

typedef unsigned long long afc_file_ref;

struct usbmux_listener_1 { /* offset value in iTunes */
unsigned int unknown0; /* 0 1 */
unsigned char *unknown1; /* 4 ptr, maybe device? */
amd_device_attached_callback callback; /* 8 _AMDDeviceAttached */
unsigned int unknown3; /* 12 */
unsigned int unknown4; /* 16 */
unsigned int unknown5; /* 20 */
} __PACK;

struct usbmux_listener_2 {
unsigned char unknown0[4144];
} __PACK;

struct am_bootloader_control_packet {
unsigned char opcode; /* 0 */
unsigned char length; /* 1 */
unsigned char magic[2]; /* 2: 0x34, 0x12 */
unsigned char payload[0]; /* 4 */
} __PACK;

/* ----------------------------------------------------------------------------
* Public routines
* ------------------------------------------------------------------------- */

/* Registers a notification with the current run loop. The callback gets
* copied into the notification struct, as well as being registered with the
* current run loop. Cookie gets copied into cookie in the same.
* (Cookie is a user info parameter that gets passed as an arg to
* the callback) unused0 and unused1 are both 0 when iTunes calls this.
*
* Never try to acces directly or copy contents of dev and subscription fields
* in am_device_notification_callback_info. Treat them as abstract handles.
* When done with connection use AMDeviceRelease to free resources allocated for am_device.
*
* Returns:
* MDERR_OK if successful
* MDERR_SYSCALL if CFRunLoopAddSource() failed
* MDERR_OUT_OF_MEMORY if we ran out of memory
*/
__DLLIMPORT mach_error_t AMDeviceNotificationSubscribe(am_device_notification_callback callback,
unsigned int unused0, unsigned int unused1,
unsigned int cookie,
struct am_device_notification **subscription);

/* Unregisters notifications. Buggy (iTunes 8.2): if you subscribe, unsubscribe and subscribe again, arriving
notifications will contain cookie and subscription from 1st call to subscribe, not the 2nd one. iTunes
calls this function only once on exit.
*/
__DLLIMPORT mach_error_t AMDeviceNotificationUnsubscribe(am_device_notification* subscription);

/* Returns device_id field of am_device structure
*/
__DLLIMPORT unsigned int AMDeviceGetConnectionID(struct am_device *device);

/* Returns serial field of am_device structure
*/
__DLLIMPORT CFStringRef AMDeviceCopyDeviceIdentifier(struct am_device *device);

/* Connects to the iPhone. Pass in the am_device structure that the
* notification callback will give to you.
*
* Returns:
* MDERR_OK if successfully connected
* MDERR_SYSCALL if setsockopt() failed
* MDERR_QUERY_FAILED if the daemon query failed
* MDERR_INVALID_ARGUMENT if USBMuxConnectByPort returned 0xffffffff
*/
__DLLIMPORT mach_error_t AMDeviceConnect(struct am_device *device);

/* Calls PairingRecordPath() on the given device, than tests whether the path
* which that function returns exists. During the initial connect, the path
* returned by that function is '/', and so this returns 1.
*
* Returns:
* 0 if the path did not exist
* 1 if it did
*/
__DLLIMPORT mach_error_t AMDeviceIsPaired(struct am_device *device);
__DLLIMPORT mach_error_t AMDevicePair(struct am_device *device);

/* iTunes calls this function immediately after testing whether the device is
* paired. It creates a pairing file and establishes a Lockdown connection.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the supplied device is null
* MDERR_DICT_NOT_LOADED if the load_dict() call failed
*/
__DLLIMPORT mach_error_t AMDeviceValidatePairing(struct am_device *device);

/* Creates a Lockdown session and adjusts the device structure appropriately
* to indicate that the session has been started. iTunes calls this function
* after validating pairing.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
* MDERR_DICT_NOT_LOADED if the load_dict() call failed
*/
__DLLIMPORT mach_error_t AMDeviceStartSession(struct am_device *device);

/* Reads various device settings. One of domain or cfstring arguments should be NULL.
*
* Possible values for cfstring:
* ActivationState
* ActivationStateAcknowledged
* BasebandBootloaderVersion
* BasebandVersion
* BluetoothAddress
* BuildVersion
* DeviceCertificate
* DeviceClass
* DeviceName
* DevicePublicKey
* FirmwareVersion
* HostAttached
* IntegratedCircuitCardIdentity
* InternationalMobileEquipmentIdentity
* InternationalMobileSubscriberIdentity
* ModelNumber
* PhoneNumber
* ProductType
* ProductVersion
* ProtocolVersion
* RegionInfo
* SBLockdownEverRegisteredKey
* SIMStatus
* SerialNumber
* SomebodySetTimeZone
* TimeIntervalSince1970
* TimeZone
* TimeZoneOffsetFromUTC
* TrustedHostAttached
* UniqueDeviceID
* Uses24HourClock
* WiFiAddress
* iTunesHasConnected
*
* Possible values for domain:
* com.apple.mobile.battery
*/
__DLLIMPORT CFStringRef AMDeviceCopyValue(struct am_device *device, CFStringRef domain, CFStringRef cfstring);

/* Starts a service and returns a socket file descriptor that can be used in order to further
* access the service. You should stop the session and disconnect before using
* the service. iTunes calls this function after starting a session. It starts
* the service and the SSL connection. service_name should be one of the AMSVC_*
* constants.
*
* Returns:
* MDERR_OK if successful
* MDERR_SYSCALL if the setsockopt() call failed
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
*/
__DLLIMPORT mach_error_t AMDeviceStartService(struct am_device *device, CFStringRef
service_name, int *socket_fd);

/* Stops a session. You should do this before accessing services.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
*/
__DLLIMPORT mach_error_t AMDeviceStopSession(struct am_device *device);

/* Decrements reference counter and, if nothing left, releases resources hold
* by connection, invalidates pointer to device
*/
__DLLIMPORT void AMDeviceRelease(struct am_device *device);

/* Increments reference counter
*/
__DLLIMPORT void AMDeviceRetain(struct am_device *device);

/* Opens an Apple File Connection. You must start the appropriate service
* first with AMDeviceStartService(). In iTunes, io_timeout is 0.
*
* Returns:
* MDERR_OK if successful
* MDERR_AFC_OUT_OF_MEMORY if malloc() failed
*/
__DLLIMPORT afc_error_t AFCConnectionOpen(int socket_fd, unsigned int io_timeout,
struct afc_connection **conn);

/* Pass in a pointer to an afc_dictionary structure. It will be filled. You can
* iterate it using AFCKeyValueRead. When done use AFCKeyValueClose. Possible keys:
* FSFreeBytes - free bytes on system device for afc2, user device for afc
* FSBlockSize - filesystem block size
* FSTotalBytes - size of device
* Model - iPhone1,1 etc.

*/
__DLLIMPORT afc_error_t AFCDeviceInfoOpen(struct afc_connection *conn, struct
afc_dictionary **info);

/* Turns debug mode on if the environment variable AFCDEBUG is set to a numeric
* value, or if the file '/AFCDEBUG' is present and contains a value. */
#if defined(__APPLE__)
void AFCPlatformInit();
#endif

/* Opens a directory on the iPhone. Pass in a pointer in dir to be filled in.
* Note that this normally only accesses the iTunes sandbox/partition as the
* root, which is /var/root/Media. Pathnames are specified with '/' delimiters
* as in Unix style. Use UTF-8 to specify non-ASCII symbols in path.
*
* Returns:
* MDERR_OK if successful
*/
__DLLIMPORT afc_error_t AFCDirectoryOpen(struct afc_connection *conn, char *path, struct
afc_directory **dir);

/* Acquires the next entry in a directory previously opened with
* AFCDirectoryOpen(). When dirent is filled with a NULL value, then the end
* of the directory has been reached. '.' and '..' will be returned as the
* first two entries in each directory except the root; you may want to skip
* over them.
*
* Returns:
* MDERR_OK if successful, even if no entries remain
*/
__DLLIMPORT afc_error_t AFCDirectoryRead(struct afc_connection *conn, struct afc_directory *dir,
char **dirent);
__DLLIMPORT afc_error_t AFCDirectoryClose(afc_connection *conn, struct afc_directory *dir);
__DLLIMPORT afc_error_t AFCDirectoryCreate(afc_connection *conn, char *dirname);
__DLLIMPORT afc_error_t AFCRemovePath(afc_connection *conn, char *dirname);
__DLLIMPORT afc_error_t AFCRenamePath(afc_connection *conn, char *oldpath, char *newpath);

/* Creates symbolic or hard link
* linktype - int64: 1 means hard link, 2 - soft (symbolic) link
* target - absolute or relative path to link target
* linkname - absolute path where to create new link
*/
__DLLIMPORT afc_error_t AFCLinkPath(struct afc_connection *conn, long long int linktype, const char *target,
const char *linkname);

/* Opens file for reading or writing without locking it in any way. afc_file_ref should not be shared between threads -
* opening file in one thread and closing it in another will lead to possible crash.
* path - UTF-8 encoded absolute path to file
* mode 2 = read, mode 3 = write; unknown = 0
* ref - receives file handle
*/
__DLLIMPORT afc_error_t AFCFileRefOpen(struct afc_connection *conn, char *path, unsigned
long long int mode, afc_file_ref *ref);
/* Reads specified amount (len) of bytes from file into buf. Puts actual count of read bytes into len on return
*/
__DLLIMPORT afc_error_t AFCFileRefRead(struct afc_connection *conn, afc_file_ref ref,
void *buf, unsigned int *len);
/* Writes specified amount (len) of bytes from buf into file.
*/
__DLLIMPORT afc_error_t AFCFileRefWrite(struct afc_connection *conn, afc_file_ref ref,
void *buf, unsigned int len);
/* Moves the file pointer to a specified location.
* offset - Number of bytes from origin (int64)
* origin - 0 = from beginning, 1 = from current position, 2 = from end
*/
__DLLIMPORT afc_error_t AFCFileRefSeek(struct afc_connection *conn, afc_file_ref ref,
unsigned long long offset, int origin, int unused);

/* Gets the current position of a file pointer into offset argument.
*/
__DLLIMPORT afc_error_t AFCFileRefTell(struct afc_connection *conn, afc_file_ref ref,
unsigned long long* offset);

__DLLIMPORT afc_error_t AFCFileRefLock(struct afc_connection *conn, afc_file_ref ref);
__DLLIMPORT afc_error_t AFCFileRefUnlock(struct afc_connection *conn, afc_file_ref ref);
__DLLIMPORT afc_error_t AFCFileRefClose(struct afc_connection *conn, afc_file_ref ref);

/* Opens dictionary describing specified file or directory (iTunes below 8.2 allowed using AFCGetFileInfo
to get the same information)
*/
__DLLIMPORT afc_error_t AFCFileInfoOpen(struct afc_connection *conn, char *path, struct
afc_dictionary **info);

/* Reads next entry from dictionary. When last entry is read, function returns NULL in key argument
Possible keys:
"st_size": val - size in bytes
"st_blocks": val - size in blocks
"st_nlink": val - number of hardlinks
"st_ifmt": val - "S_IFDIR" for folders
"S_IFLNK" for symlinks
"LinkTarget": val - path to symlink target
*/
__DLLIMPORT afc_error_t AFCKeyValueRead(struct afc_dictionary *dict, char **key, char **
val);
/* Closes dictionary
*/
__DLLIMPORT afc_error_t AFCKeyValueClose(struct afc_dictionary *dict);

/* Returns the context field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetContext(struct afc_connection *conn);

/* Returns the fs_block_size field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetFSBlockSize(struct afc_connection *conn);

/* Returns the io_timeout field of the given AFC connection. In iTunes this is
* 0. */
__DLLIMPORT unsigned int AFCConnectionGetIOTimeout(struct afc_connection *conn);

/* Returns the sock_block_size field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetSocketBlockSize(struct afc_connection *conn);

/* Closes the given AFC connection. */
__DLLIMPORT afc_error_t AFCConnectionClose(struct afc_connection *conn);

/* Registers for device notifications related to the restore process. unknown0
* is zero when iTunes calls this. In iTunes,
* the callbacks are located at:
* 1: $3ac68e-$3ac6b1, calls $3ac542(unknown1, arg, 0)
* 2: $3ac66a-$3ac68d, calls $3ac542(unknown1, 0, arg)
* 3: $3ac762-$3ac785, calls $3ac6b2(unknown1, arg, 0)
* 4: $3ac73e-$3ac761, calls $3ac6b2(unknown1, 0, arg)
*/
__DLLIMPORT unsigned int AMRestoreRegisterForDeviceNotifications(
am_restore_device_notification_callback dfu_connect_callback,
am_restore_device_notification_callback recovery_connect_callback,
am_restore_device_notification_callback dfu_disconnect_callback,
am_restore_device_notification_callback recovery_disconnect_callback,
unsigned int unknown0,
void *user_info);

/* Causes the restore functions to spit out (unhelpful) progress messages to
* the file specified by the given path. iTunes always calls this right before
* restoring with a path of
* "$HOME/Library/Logs/iPhone Updater Logs/iPhoneUpdater X.log", where X is an
* unused number.
*/
__DLLIMPORT unsigned int AMRestoreEnableFileLogging(char *path);

/* Initializes a new option dictionary to default values. Pass the constant
* kCFAllocatorDefault as the allocator. The option dictionary looks as
* follows:
* {
* NORImageType => 'production',
* AutoBootDelay => 0,
* KernelCacheType => 'Release',
* UpdateBaseband => true,
* DFUFileType => 'RELEASE',
* SystemImageType => 'User',
* CreateFilesystemPartitions => true,
* FlashNOR => true,
* RestoreBootArgs => 'rd=md0 nand-enable-reformat=1 -progress'
* BootImageType => 'User'
* }
*
* Returns:
* the option dictionary if successful
* NULL if out of memory
*/
__DLLIMPORT CFMutableDictionaryRef AMRestoreCreateDefaultOptions(CFAllocatorRef allocator);

/* ----------------------------------------------------------------------------
* Less-documented public routines
* ------------------------------------------------------------------------- */

__DLLIMPORT unsigned int AMRestorePerformRecoveryModeRestore(struct am_recovery_device *
rdev, CFDictionaryRef opts, void *callback, void *user_info);
__DLLIMPORT unsigned int AMRestorePerformRestoreModeRestore(struct am_restore_device *
rdev, CFDictionaryRef opts, void *callback, void *user_info);
__DLLIMPORT struct am_restore_device *AMRestoreModeDeviceCreate(unsigned int unknown0,
unsigned int connection_id, unsigned int unknown1);
__DLLIMPORT unsigned int AMRestoreCreatePathsForBundle(CFStringRef restore_bundle_path,
CFStringRef kernel_cache_type, CFStringRef boot_image_type, unsigned int
unknown0, CFStringRef *firmware_dir_path, CFStringRef *
kernelcache_restore_path, unsigned int unknown1, CFStringRef *
ramdisk_path);
__DLLIMPORT unsigned int AMRestoreModeDeviceReboot(struct am_restore_device *rdev); // Added by JB 30.07.2008
__DLLIMPORT mach_error_t AMDeviceEnterRecovery(struct am_device *device);
__DLLIMPORT mach_error_t AMDeviceDisconnect(struct am_device *device);

/* to use this, start the service "com.apple.mobile.notification_proxy", handle will be the socket to use */
typedef void (*NOTIFY_CALLBACK)(CFSTR notification, USERDATA data);
__DLLIMPORT mach_error_t AMDPostNotification(SOCKET socket, CFStringRef notification, CFStringRef userinfo);
__DLLIMPORT mach_error_t AMDObserveNotification(SOCKET socket, CFSTR notification);
__DLLIMPORT mach_error_t AMDListenForNotifications(SOCKET socket, NOTIFY_CALLBACK cb, USERDATA data);
__DLLIMPORT mach_error_t AMDShutdownNotificationProxy(SOCKET socket);

/*edits by geohot*/
__DLLIMPORT mach_error_t AMDeviceDeactivate(struct am_device *device);
__DLLIMPORT mach_error_t AMDeviceActivate(struct am_device *device, CFDictionaryRef dict);
__DLLIMPORT mach_error_t AMDeviceRemoveValue(struct am_device *device, unsigned int, CFStringRef cfstring);

/* ----------------------------------------------------------------------------
* Semi-private routines
* ------------------------------------------------------------------------- */

/* Pass in a usbmux_listener_1 structure and a usbmux_listener_2 structure
* pointer, which will be filled with the resulting usbmux_listener_2.
*
* Returns:
* MDERR_OK if completed successfully
* MDERR_USBMUX_ARG_NULL if one of the arguments was NULL
* MDERR_USBMUX_FAILED if the listener was not created successfully
*/
__DLLIMPORT usbmux_error_t USBMuxListenerCreate(struct usbmux_listener_1 *esi_fp8, struct
usbmux_listener_2 **eax_fp12);

/* ----------------------------------------------------------------------------
* Less-documented semi-private routines
* ------------------------------------------------------------------------- */
__DLLIMPORT usbmux_error_t USBMuxListenerHandleData(void *);

/* ----------------------------------------------------------------------------
* Private routines - here be dragons
* ------------------------------------------------------------------------- */

/* AMRestorePerformRestoreModeRestore() calls this function with a dictionary
* in order to perform certain special restore operations
* (RESTORED_OPERATION_*). It is thought that this function might enable
* significant access to the phone. */

/*
typedef unsigned int (*t_performOperation)(struct am_restore_device *rdev,
CFDictionaryRef op) __attribute__ ((regparm(2)));
t_performOperation _performOperation = (t_performOperation)0x3c39fa4b;
*/

/* ----------------------------------------------------------------------------
* Less-documented private routines
* ------------------------------------------------------------------------- */

/*
typedef int (*t_socketForPort)(struct am_restore_device *rdev, unsigned int port)
__attribute__ ((regparm(2)));
t_socketForPort _socketForPort = (t_socketForPort)(void *)0x3c39f36c;

typedef void (*t_restored_send_message)(int port, CFDictionaryRef msg);
t_restored_send_message _restored_send_message = (t_restored_send_message)0x3c3a4e40;

typedef CFDictionaryRef (*t_restored_receive_message)(int port);
t_restored_receive_message _restored_receive_message = (t_restored_receive_message)0x3c3a4d40;

typedef unsigned int (*t_sendControlPacket)(struct am_recovery_device *rdev, unsigned
int msg1, unsigned int msg2, unsigned int unknown0, unsigned int *unknown1,
unsigned char *unknown2) __attribute__ ((regparm(3)));
t_sendControlPacket _sendControlPacket = (t_sendControlPacket)0x3c3a3da3;;

typedef unsigned int (*t_sendCommandToDevice)(struct am_recovery_device *rdev,
CFStringRef cmd) __attribute__ ((regparm(2)));
t_sendCommandToDevice _sendCommandToDevice = (t_sendCommandToDevice)0x3c3a3e3b;

typedef unsigned int (*t_AMRUSBInterfaceReadPipe)(unsigned int readwrite_pipe, unsigned
int read_pipe, unsigned char *data, unsigned int *len);
t_AMRUSBInterfaceReadPipe _AMRUSBInterfaceReadPipe = (t_AMRUSBInterfaceReadPipe)0x3c3a27e8;

typedef unsigned int (*t_AMRUSBInterfaceWritePipe)(unsigned int readwrite_pipe, unsigned
int write_pipe, void *data, unsigned int len);
t_AMRUSBInterfaceWritePipe _AMRUSBInterfaceWritePipe = (t_AMRUSBInterfaceWritePipe)0x3c3a27cb;
*/

int performOperation(am_restore_device *rdev, CFMutableDictionaryRef message);
int socketForPort(am_restore_device *rdev, unsigned int portnum);
int sendCommandToDevice(am_recovery_device *rdev, CFStringRef cfs, int block);
int sendFileToDevice(am_recovery_device *rdev, CFStringRef filename);

#ifdef __cplusplus
}
#endif

#endif

/* -*- mode:c; indent-tabs-mode:nil; c-basic-offset:2; tab-width:2; */
</pre>

===AFC Connection===
...

===Locking the Device for Sync===
When iTunes sends a new song to the device, the device shows a "Sync in progress" screen and when complete, the Music app on the device re-reads the iTunesDB file so it picks up the new song.

To get this behaviour, first start the notification service:
<pre>SOCKET socket;
AMDeviceStartService(dev, CFSTR("com.apple.mobile.notification_proxy"), &socket, NULL);</pre>

Now we post a notificaton message to signal that we are going to start a sync:
<pre>AMDPostNotification(socket, CFSTR("com.apple.itunes-mobdev.syncWillStart"), NULL);</pre>

Next we open the itunes lock file:
<pre>afc_file_ref lockref;
AFCFileRefOpen(conn, "/com.apple.itunes.lock_sync", 2, &lockref);</pre>

Now post a notification to say we are going to lock this file, and try and lock it.
If the AFCFileRefLock call fails, pause and repeat.
<pre>AMDPostNotification(socket, CFSTR("com.apple.itunes-mobdev.syncLockRequest"), NULL);
mach_error_t error = AFCFileRefLock(conn, lockref);</pre>

When the file is successfully locked, post another notification, and stop the notification service.
<pre>AMDPostNotification(socket,CFSTR("com.apple.itunes-mobdev.syncDidStart"), NULL);
AMDShutdownNotificationProxy(socket);</pre>

Now the sync can proceed, so copy your files across and make the changes to the iTunesDB.

To release the lock, start the notification system again, unlock and close the lock file, and send a sync finished notification message:

<pre>AFCFileRefUnlock(conn, lockref);
AFCFileRefClose(conn, lockref);
AMDeviceStartService(dev, CFSTR("com.apple.mobile.notification_proxy"), &socket, NULL);
AMDPostNotification(socket, &CFSTR("com.apple.itunes-mobdev.syncDidFinish"), NULL);
AMDShutdownNotificationProxy(socket);</pre>

To handle "Slide to Cancel" and terminate sync when user slides cancel switch, use AMDObserveNotification to subscribe notifications about “com.apple.itunes-client.syncCancelRequest”. Then start listening for notifications (AMDListenForNotifications) until you get “AMDNotificationFaceplant”.
When notification got, you should unlock and close lock file handle (don’t sure if you need to post “syncDidFinish” to proxy, seems it doesn’t matter) and terminate sync gracefully.
The same notification is also got when you unplug your device, so you should always be ready for errors.

NOTE: You may find that starting the notification_proxy service once and once only at the start of your app and using the same socket in calls to AMDPostNotification works better. iTunes opens and closes the notification_proxy regularly, but it appears to be a bit flakey when you open/close it all the time.

===Private Functions===

====How to find address of privates functions in iTunesMobileDevice.dll or MobileDevice.framework ?====
...

===Libraries Implementations===

* [http://code.google.com/p/iphuc/ iPhuc (Command line utility)]
* [http://code.google.com/p/iphucwin32/ iPhuc Win32 (Command line utility)]
* [http://code.google.com/p/manzana/ manzana (.Net Library)]
* [http://code.google.com/p/independence/source/browse/trunk/libPhoneInteraction/ libPhoneInteraction (C Library)]

MobileDevice Library

2009-10-18T21:59:14Z

Redart: /* MobileDevice Header (mobiledevice.h) */

MobileDevice Library is used by [[iTunes]] to transfer data between iPhone and computer over the USB connection.

===PC Windows : iTunesMobileDevice.dll===

* Location : Location is stored in '''iTunesMobileDeviceDLL''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Mobile Device Support\Shared''' key. Usually - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\iTunesMobileDevice.dll.

* Supporting CoreFoundation.dll (used for CFStringRef, CFPropertyListRef management) is located in the same dir (when using iTunes prior 9.0).

* For iTunes 9.0 location of CoreFoundation.dll is stored in '''InstallDir''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Application Support''' key, usually C:\Program Files\Common Files\Apple\Apple Application Support\. CoreFoundation.dll from Mobile Device Support\bin should not be used.

===Mac OSX : MobileDevice.framework===

* Location : /System/Library/PrivateFrameworks/MobileDevice.framework
* Export command : "nm /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/MobileDevice"

===MobileDevice Header (mobiledevice.h)===

Reverse engineered C header for MobileDevice Library.

<pre>
/* ----------------------------------------------------------------------------
* MobileDevice.h - interface to MobileDevice.framework
* ------------------------------------------------------------------------- */
#pragma once

#ifndef MOBILEDEVICE_H
#define MOBILEDEVICE_H

#ifdef __cplusplus
extern "C" {
#endif

#ifndef __GCC__
#pragma pack
#define __PACK
#else
#define __PACK __attribute__((__packed__))
#endif

#if defined(WIN32)
#define __DLLIMPORT [DllImport("iTunesMobileDevice.dll")]
using namespace System::Runtime::InteropServices;
#include <CoreFoundation.h>
typedef unsigned int mach_error_t;
#elif defined(__APPLE__)
#define __DLLIMPORT
#include <CoreFoundation/CoreFoundation.h>
#include <mach/error.h>
#endif

/* Error codes */
#define MDERR_APPLE_MOBILE (err_system(0x3a))
#define MDERR_IPHONE (err_sub(0))

/* Apple Mobile (AM*) errors */
#define MDERR_OK ERR_SUCCESS
#define MDERR_SYSCALL (ERR_MOBILE_DEVICE | 0x01)
#define MDERR_OUT_OF_MEMORY (ERR_MOBILE_DEVICE | 0x03)
#define MDERR_QUERY_FAILED (ERR_MOBILE_DEVICE | 0x04)
#define MDERR_INVALID_ARGUMENT (ERR_MOBILE_DEVICE | 0x0b)
#define MDERR_DICT_NOT_LOADED (ERR_MOBILE_DEVICE | 0x25)

/* Apple File Connection (AFC*) errors */
#define MDERR_AFC_OUT_OF_MEMORY 0x03

/* USBMux errors */
#define MDERR_USBMUX_ARG_NULL 0x16
#define MDERR_USBMUX_FAILED 0xffffffff

/* Messages passed to device notification callbacks: passed as part of
* am_device_notification_callback_info. */
#define ADNCI_MSG_CONNECTED 1
#define ADNCI_MSG_DISCONNECTED 2
#define ADNCI_MSG_UNSUBSCRIBED 3

#define AMD_IPHONE_PRODUCT_ID 0x1290
//#define AMD_IPHONE_SERIAL ""

/* Services, found in /System/Library/Lockdown/Services.plist */
#define AMSVC_AFC CFSTR("com.apple.afc")
#define AMSVC_BACKUP CFSTR("com.apple.mobilebackup")
#define AMSVC_CRASH_REPORT_COPY CFSTR("com.apple.crashreportcopy")
#define AMSVC_DEBUG_IMAGE_MOUNT CFSTR("com.apple.mobile.debug_image_mount")
#define AMSVC_NOTIFICATION_PROXY CFSTR("com.apple.mobile.notification_proxy")
#define AMSVC_PURPLE_TEST CFSTR("com.apple.purpletestr")
#define AMSVC_SOFTWARE_UPDATE CFSTR("com.apple.mobile.software_update")
#define AMSVC_SYNC CFSTR("com.apple.mobilesync")
#define AMSVC_SCREENSHOT CFSTR("com.apple.screenshotr")
#define AMSVC_SYSLOG_RELAY CFSTR("com.apple.syslog_relay")
#define AMSVC_SYSTEM_PROFILER CFSTR("com.apple.mobile.system_profiler")

typedef unsigned int afc_error_t;
typedef unsigned int usbmux_error_t;

struct am_recovery_device;

struct am_device_notification_callback_info {
struct am_device *dev; /* 0 device */
unsigned int msg; /* 4 one of ADNCI_MSG_* */
struct am_device_notification* subscription;
} __PACK;

/* The type of the device restore notification callback functions.
* TODO: change to correct type. */
typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *);

/* This is a CoreFoundation object of class AMRecoveryModeDevice. */
struct am_recovery_device {
unsigned char unknown0[8]; /* 0 */
am_restore_device_notification_callback callback; /* 8 */
void *user_info; /* 12 */
unsigned char unknown1[12]; /* 16 */
unsigned int readwrite_pipe; /* 28 */
unsigned char read_pipe; /* 32 */
unsigned char write_ctrl_pipe; /* 33 */
unsigned char read_unknown_pipe; /* 34 */
unsigned char write_file_pipe; /* 35 */
unsigned char write_input_pipe; /* 36 */
} __PACK;

/* A CoreFoundation object of class AMRestoreModeDevice. */
struct am_restore_device {
unsigned char unknown[32];
int port;
} __PACK;

/* The type of the device notification callback function. */
typedef void(*am_device_notification_callback)(struct am_device_notification_callback_info *, int cookie);

/* The type of the _AMDDeviceAttached function.
* TODO: change to correct type. */
typedef void *amd_device_attached_callback;

/* The type of the device restore notification callback functions.
* TODO: change to correct type. */
typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *);

/* Structure that contains internal data used by AMDevice... functions. Never try
* to access its members directly! Use AMDeviceCopyDeviceIdentifier,
* AMDeviceGetConnectionID, AMDeviceRetain, AMDeviceRelease instead. */
struct am_device {
unsigned char unknown0[16]; /* 0 - zero */
unsigned int device_id; /* 16 */
unsigned int product_id; /* 20 - set to AMD_IPHONE_PRODUCT_ID */
char *serial; /* 24 - set to UDID, Unique Device Identifier */
unsigned int unknown1; /* 28 */
unsigned int unknown2; /* 32 - reference counter, increased by AMDeviceRetain, decreased by AMDeviceRelease*/
unsigned int lockdown_conn; /* 36 */
unsigned char unknown3[8]; /* 40 */
#if (__ITUNES_VER > 740)
unsigned int unknown4; /* 48 - used to store CriticalSection Handle*/
#endif
#if (__ITUNES_VER >= 800)
unsigned char unknown5[24]; /* 52 */
#endif
} __PACK;

struct am_device_notification {
unsigned int unknown0; /* 0 */
unsigned int unknown1; /* 4 */
unsigned int unknown2; /* 8 */
am_device_notification_callback callback; /* 12 */
unsigned int cookie; /* 16 */
} __PACK;

struct afc_connection {
unsigned int handle; /* 0 */
unsigned int unknown0; /* 4 */
unsigned char unknown1; /* 8 */
unsigned char padding[3]; /* 9 */
unsigned int unknown2; /* 12 */
unsigned int unknown3; /* 16 */
unsigned int unknown4; /* 20 */
unsigned int fs_block_size; /* 24 */
unsigned int sock_block_size; /* 28: always 0x3c */
unsigned int io_timeout; /* 32: from AFCConnectionOpen, usu. 0 */
void *afc_lock; /* 36 */
unsigned int context; /* 40 */
} __PACK;

struct afc_device_info {
unsigned char unknown[12]; /* 0 */
} __PACK;

struct afc_directory {
unsigned char unknown[0]; /* size unknown */
} __PACK;

struct afc_dictionary {
unsigned char unknown[0]; /* size unknown */
} __PACK;

typedef unsigned long long afc_file_ref;

struct usbmux_listener_1 { /* offset value in iTunes */
unsigned int unknown0; /* 0 1 */
unsigned char *unknown1; /* 4 ptr, maybe device? */
amd_device_attached_callback callback; /* 8 _AMDDeviceAttached */
unsigned int unknown3; /* 12 */
unsigned int unknown4; /* 16 */
unsigned int unknown5; /* 20 */
} __PACK;

struct usbmux_listener_2 {
unsigned char unknown0[4144];
} __PACK;

struct am_bootloader_control_packet {
unsigned char opcode; /* 0 */
unsigned char length; /* 1 */
unsigned char magic[2]; /* 2: 0x34, 0x12 */
unsigned char payload[0]; /* 4 */
} __PACK;

/* ----------------------------------------------------------------------------
* Public routines
* ------------------------------------------------------------------------- */

/* Registers a notification with the current run loop. The callback gets
* copied into the notification struct, as well as being registered with the
* current run loop. Cookie gets copied into cookie in the same.
* (Cookie is a user info parameter that gets passed as an arg to
* the callback) unused0 and unused1 are both 0 when iTunes calls this.
*
* Never try to acces directly or copy contents of dev and subscription fields
* in am_device_notification_callback_info. Treat them as abstract handles.
* When done with connection use AMDeviceRelease to free resources allocated for am_device.
*
* Returns:
* MDERR_OK if successful
* MDERR_SYSCALL if CFRunLoopAddSource() failed
* MDERR_OUT_OF_MEMORY if we ran out of memory
*/
__DLLIMPORT mach_error_t AMDeviceNotificationSubscribe(am_device_notification_callback callback,
unsigned int unused0, unsigned int unused1,
unsigned int cookie,
struct am_device_notification **subscription);

/* Unregisters notifications. Buggy (iTunes 8.2): if you subscribe, unsubscribe and subscribe again, arriving
notifications will contain cookie and subscription from 1st call to subscribe, not the 2nd one. iTunes
calls this function only once on exit.
*/
__DLLIMPORT mach_error_t AMDeviceNotificationUnsubscribe(am_device_notification* subscription);

/* Returns device_id field of am_device structure
*/
__DLLIMPORT unsigned int AMDeviceGetConnectionID(struct am_device *device);

/* Returns serial field of am_device structure
*/
__DLLIMPORT CFStringRef AMDeviceCopyDeviceIdentifier(struct am_device *device);

/* Connects to the iPhone. Pass in the am_device structure that the
* notification callback will give to you.
*
* Returns:
* MDERR_OK if successfully connected
* MDERR_SYSCALL if setsockopt() failed
* MDERR_QUERY_FAILED if the daemon query failed
* MDERR_INVALID_ARGUMENT if USBMuxConnectByPort returned 0xffffffff
*/
__DLLIMPORT mach_error_t AMDeviceConnect(struct am_device *device);

/* Calls PairingRecordPath() on the given device, than tests whether the path
* which that function returns exists. During the initial connect, the path
* returned by that function is '/', and so this returns 1.
*
* Returns:
* 0 if the path did not exist
* 1 if it did
*/
__DLLIMPORT mach_error_t AMDeviceIsPaired(struct am_device *device);
__DLLIMPORT mach_error_t AMDevicePair(struct am_device *device);

/* iTunes calls this function immediately after testing whether the device is
* paired. It creates a pairing file and establishes a Lockdown connection.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the supplied device is null
* MDERR_DICT_NOT_LOADED if the load_dict() call failed
*/
__DLLIMPORT mach_error_t AMDeviceValidatePairing(struct am_device *device);

/* Creates a Lockdown session and adjusts the device structure appropriately
* to indicate that the session has been started. iTunes calls this function
* after validating pairing.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
* MDERR_DICT_NOT_LOADED if the load_dict() call failed
*/
__DLLIMPORT mach_error_t AMDeviceStartSession(struct am_device *device);

/* Reads various device settings. One of domain or cfstring arguments should be NULL.
*
* Possible values for cfstring:
* ActivationState
* ActivationStateAcknowledged
* BasebandBootloaderVersion
* BasebandVersion
* BluetoothAddress
* BuildVersion
* DeviceCertificate
* DeviceClass
* DeviceName
* DevicePublicKey
* FirmwareVersion
* HostAttached
* IntegratedCircuitCardIdentity
* InternationalMobileEquipmentIdentity
* InternationalMobileSubscriberIdentity
* ModelNumber
* PhoneNumber
* ProductType
* ProductVersion
* ProtocolVersion
* RegionInfo
* SBLockdownEverRegisteredKey
* SIMStatus
* SerialNumber
* SomebodySetTimeZone
* TimeIntervalSince1970
* TimeZone
* TimeZoneOffsetFromUTC
* TrustedHostAttached
* UniqueDeviceID
* Uses24HourClock
* WiFiAddress
* iTunesHasConnected
*
* Possible values for domain:
* com.apple.mobile.battery
*/
__DLLIMPORT CFStringRef AMDeviceCopyValue(struct am_device *device, CFStringRef domain, CFStringRef cfstring);

/* Starts a service and returns a socket file descriptor that can be used in order to further
* access the service. You should stop the session and disconnect before using
* the service. iTunes calls this function after starting a session. It starts
* the service and the SSL connection. service_name should be one of the AMSVC_*
* constants.
*
* Returns:
* MDERR_OK if successful
* MDERR_SYSCALL if the setsockopt() call failed
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
*/
__DLLIMPORT mach_error_t AMDeviceStartService(struct am_device *device, CFStringRef
service_name, int *socket_fd);

/* Stops a session. You should do this before accessing services.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
*/
__DLLIMPORT mach_error_t AMDeviceStopSession(struct am_device *device);

/* Decrements reference counter and, if nothing left, releases resources hold
* by connection, invalidates pointer to device
*/
__DLLIMPORT void AMDeviceRelease(struct am_device *device);

/* Increments reference counter
*/
__DLLIMPORT void AMDeviceRetain(struct am_device *device);

/* Opens an Apple File Connection. You must start the appropriate service
* first with AMDeviceStartService(). In iTunes, io_timeout is 0.
*
* Returns:
* MDERR_OK if successful
* MDERR_AFC_OUT_OF_MEMORY if malloc() failed
*/
__DLLIMPORT afc_error_t AFCConnectionOpen(int socket_fd, unsigned int io_timeout,
struct afc_connection **conn);

/* Pass in a pointer to an afc_dictionary structure. It will be filled. You can
* iterate it using AFCKeyValueRead. When done use AFCKeyValueClose. Possible keys:
* FSFreeBytes - free bytes on system device for afc2, user device for afc
* FSBlockSize - filesystem block size
* FSTotalBytes - size of device
* Model - iPhone1,1 etc.

*/
__DLLIMPORT afc_error_t AFCDeviceInfoOpen(struct afc_connection *conn, struct
afc_dictionary **info);

/* Turns debug mode on if the environment variable AFCDEBUG is set to a numeric
* value, or if the file '/AFCDEBUG' is present and contains a value. */
#if defined(__APPLE__)
void AFCPlatformInit();
#endif

/* Opens a directory on the iPhone. Pass in a pointer in dir to be filled in.
* Note that this normally only accesses the iTunes sandbox/partition as the
* root, which is /var/root/Media. Pathnames are specified with '/' delimiters
* as in Unix style. Use UTF-8 to specify non-ASCII symbols in path.
*
* Returns:
* MDERR_OK if successful
*/
__DLLIMPORT afc_error_t AFCDirectoryOpen(struct afc_connection *conn, char *path, struct
afc_directory **dir);

/* Acquires the next entry in a directory previously opened with
* AFCDirectoryOpen(). When dirent is filled with a NULL value, then the end
* of the directory has been reached. '.' and '..' will be returned as the
* first two entries in each directory except the root; you may want to skip
* over them.
*
* Returns:
* MDERR_OK if successful, even if no entries remain
*/
__DLLIMPORT afc_error_t AFCDirectoryRead(struct afc_connection *conn, struct afc_directory *dir,
char **dirent);
__DLLIMPORT afc_error_t AFCDirectoryClose(afc_connection *conn, struct afc_directory *dir);
__DLLIMPORT afc_error_t AFCDirectoryCreate(afc_connection *conn, char *dirname);
__DLLIMPORT afc_error_t AFCRemovePath(afc_connection *conn, char *dirname);
__DLLIMPORT afc_error_t AFCRenamePath(afc_connection *conn, char *oldpath, char *newpath);

/* Creates symbolic or hard link
* linktype - int64: 1 means hard link, 2 - soft (symbolic) link
* target - absolute or relative path to link target
* linkname - absolute path where to create new link
*/
__DLLIMPORT afc_error_t AFCLinkPath(struct afc_connection *conn, long long int linktype, const char *target, const char *linkname);

/* Opens file for reading or writing without locking it in any way. afc_file_ref should not be shared between threads -
* opening file in one thread and closing it in another will lead to possible crash.
* path - UTF-8 encoded absolute path to file
* mode 2 = read, mode 3 = write; unknown = 0
* ref - receives file handle
*/
__DLLIMPORT afc_error_t AFCFileRefOpen(struct afc_connection *conn, char *path, unsigned
long long int mode, afc_file_ref *ref);
/* Reads specified amount (len) of bytes from file into buf. Puts actual count of read bytes into len on return
*/
__DLLIMPORT afc_error_t AFCFileRefRead(struct afc_connection *conn, afc_file_ref ref,
void *buf, unsigned int *len);
/* Writes specified amount (len) of bytes from buf into file.
*/
__DLLIMPORT afc_error_t AFCFileRefWrite(struct afc_connection *conn, afc_file_ref ref,
void *buf, unsigned int len);
/* Moves the file pointer to a specified location.
* offset - Number of bytes from origin (int64)
* origin - 0 = from beginning, 1 = from current position, 2 = from end
*/
__DLLIMPORT afc_error_t AFCFileRefSeek(struct afc_connection *conn, afc_file_ref ref,
unsigned long long offset, int origin, int unused);

/* Gets the current position of a file pointer into offset argument.
*/
__DLLIMPORT afc_error_t AFCFileRefTell(struct afc_connection *conn, afc_file_ref ref,
unsigned long long* offset);

__DLLIMPORT afc_error_t AFCFileRefLock(struct afc_connection *conn, afc_file_ref ref);
__DLLIMPORT afc_error_t AFCFileRefUnlock(struct afc_connection *conn, afc_file_ref ref);
__DLLIMPORT afc_error_t AFCFileRefClose(struct afc_connection *conn, afc_file_ref ref);

/* Opens dictionary describing specified file or directory (iTunes below 8.2 allowed using AFCGetFileInfo
to get the same information)
*/
__DLLIMPORT afc_error_t AFCFileInfoOpen(struct afc_connection *conn, char *path, struct
afc_dictionary **info);

/* Reads next entry from dictionary. When last entry is read, function returns NULL in key argument
Possible keys:
"st_size": val - size in bytes
"st_blocks": val - size in blocks
"st_nlink": val - number of hardlinks
"st_ifmt": val - "S_IFDIR" for folders
"S_IFLNK" for symlinks
"LinkTarget": val - path to symlink target
*/
__DLLIMPORT afc_error_t AFCKeyValueRead(struct afc_dictionary *dict, char **key, char **
val);
/* Closes dictionary
*/
__DLLIMPORT afc_error_t AFCKeyValueClose(struct afc_dictionary *dict);

/* Returns the context field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetContext(struct afc_connection *conn);

/* Returns the fs_block_size field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetFSBlockSize(struct afc_connection *conn);

/* Returns the io_timeout field of the given AFC connection. In iTunes this is
* 0. */
__DLLIMPORT unsigned int AFCConnectionGetIOTimeout(struct afc_connection *conn);

/* Returns the sock_block_size field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetSocketBlockSize(struct afc_connection *conn);

/* Closes the given AFC connection. */
__DLLIMPORT afc_error_t AFCConnectionClose(struct afc_connection *conn);

/* Registers for device notifications related to the restore process. unknown0
* is zero when iTunes calls this. In iTunes,
* the callbacks are located at:
* 1: $3ac68e-$3ac6b1, calls $3ac542(unknown1, arg, 0)
* 2: $3ac66a-$3ac68d, calls $3ac542(unknown1, 0, arg)
* 3: $3ac762-$3ac785, calls $3ac6b2(unknown1, arg, 0)
* 4: $3ac73e-$3ac761, calls $3ac6b2(unknown1, 0, arg)
*/
__DLLIMPORT unsigned int AMRestoreRegisterForDeviceNotifications(
am_restore_device_notification_callback dfu_connect_callback,
am_restore_device_notification_callback recovery_connect_callback,
am_restore_device_notification_callback dfu_disconnect_callback,
am_restore_device_notification_callback recovery_disconnect_callback,
unsigned int unknown0,
void *user_info);

/* Causes the restore functions to spit out (unhelpful) progress messages to
* the file specified by the given path. iTunes always calls this right before
* restoring with a path of
* "$HOME/Library/Logs/iPhone Updater Logs/iPhoneUpdater X.log", where X is an
* unused number.
*/
__DLLIMPORT unsigned int AMRestoreEnableFileLogging(char *path);

/* Initializes a new option dictionary to default values. Pass the constant
* kCFAllocatorDefault as the allocator. The option dictionary looks as
* follows:
* {
* NORImageType => 'production',
* AutoBootDelay => 0,
* KernelCacheType => 'Release',
* UpdateBaseband => true,
* DFUFileType => 'RELEASE',
* SystemImageType => 'User',
* CreateFilesystemPartitions => true,
* FlashNOR => true,
* RestoreBootArgs => 'rd=md0 nand-enable-reformat=1 -progress'
* BootImageType => 'User'
* }
*
* Returns:
* the option dictionary if successful
* NULL if out of memory
*/
__DLLIMPORT CFMutableDictionaryRef AMRestoreCreateDefaultOptions(CFAllocatorRef allocator);

/* ----------------------------------------------------------------------------
* Less-documented public routines
* ------------------------------------------------------------------------- */

__DLLIMPORT unsigned int AMRestorePerformRecoveryModeRestore(struct am_recovery_device *
rdev, CFDictionaryRef opts, void *callback, void *user_info);
__DLLIMPORT unsigned int AMRestorePerformRestoreModeRestore(struct am_restore_device *
rdev, CFDictionaryRef opts, void *callback, void *user_info);
__DLLIMPORT struct am_restore_device *AMRestoreModeDeviceCreate(unsigned int unknown0,
unsigned int connection_id, unsigned int unknown1);
__DLLIMPORT unsigned int AMRestoreCreatePathsForBundle(CFStringRef restore_bundle_path,
CFStringRef kernel_cache_type, CFStringRef boot_image_type, unsigned int
unknown0, CFStringRef *firmware_dir_path, CFStringRef *
kernelcache_restore_path, unsigned int unknown1, CFStringRef *
ramdisk_path);
__DLLIMPORT unsigned int AMRestoreModeDeviceReboot(struct am_restore_device *rdev); // Added by JB 30.07.2008
__DLLIMPORT mach_error_t AMDeviceEnterRecovery(struct am_device *device);
__DLLIMPORT mach_error_t AMDeviceDisconnect(struct am_device *device);

/* to use this, start the service "com.apple.mobile.notification_proxy", handle will be the socket to use */
typedef void (*NOTIFY_CALLBACK)(CFSTR notification, USERDATA data);
__DLLIMPORT mach_error_t AMDPostNotification(SOCKET socket, CFStringRef notification, CFStringRef userinfo);
__DLLIMPORT mach_error_t AMDObserveNotification(SOCKET socket, CFSTR notification);
__DLLIMPORT mach_error_t AMDListenForNotifications(SOCKET socket, NOTIFY_CALLBACK cb, USERDATA data);
__DLLIMPORT mach_error_t AMDShutdownNotificationProxy(SOCKET socket);

/*edits by geohot*/
__DLLIMPORT mach_error_t AMDeviceDeactivate(struct am_device *device);
__DLLIMPORT mach_error_t AMDeviceActivate(struct am_device *device, CFDictionaryRef dict);
__DLLIMPORT mach_error_t AMDeviceRemoveValue(struct am_device *device, unsigned int, CFStringRef cfstring);

/* ----------------------------------------------------------------------------
* Semi-private routines
* ------------------------------------------------------------------------- */

/* Pass in a usbmux_listener_1 structure and a usbmux_listener_2 structure
* pointer, which will be filled with the resulting usbmux_listener_2.
*
* Returns:
* MDERR_OK if completed successfully
* MDERR_USBMUX_ARG_NULL if one of the arguments was NULL
* MDERR_USBMUX_FAILED if the listener was not created successfully
*/
__DLLIMPORT usbmux_error_t USBMuxListenerCreate(struct usbmux_listener_1 *esi_fp8, struct
usbmux_listener_2 **eax_fp12);

/* ----------------------------------------------------------------------------
* Less-documented semi-private routines
* ------------------------------------------------------------------------- */
__DLLIMPORT usbmux_error_t USBMuxListenerHandleData(void *);

/* ----------------------------------------------------------------------------
* Private routines - here be dragons
* ------------------------------------------------------------------------- */

/* AMRestorePerformRestoreModeRestore() calls this function with a dictionary
* in order to perform certain special restore operations
* (RESTORED_OPERATION_*). It is thought that this function might enable
* significant access to the phone. */

/*
typedef unsigned int (*t_performOperation)(struct am_restore_device *rdev,
CFDictionaryRef op) __attribute__ ((regparm(2)));
t_performOperation _performOperation = (t_performOperation)0x3c39fa4b;
*/

/* ----------------------------------------------------------------------------
* Less-documented private routines
* ------------------------------------------------------------------------- */

/*
typedef int (*t_socketForPort)(struct am_restore_device *rdev, unsigned int port)
__attribute__ ((regparm(2)));
t_socketForPort _socketForPort = (t_socketForPort)(void *)0x3c39f36c;

typedef void (*t_restored_send_message)(int port, CFDictionaryRef msg);
t_restored_send_message _restored_send_message = (t_restored_send_message)0x3c3a4e40;

typedef CFDictionaryRef (*t_restored_receive_message)(int port);
t_restored_receive_message _restored_receive_message = (t_restored_receive_message)0x3c3a4d40;

typedef unsigned int (*t_sendControlPacket)(struct am_recovery_device *rdev, unsigned
int msg1, unsigned int msg2, unsigned int unknown0, unsigned int *unknown1,
unsigned char *unknown2) __attribute__ ((regparm(3)));
t_sendControlPacket _sendControlPacket = (t_sendControlPacket)0x3c3a3da3;;

typedef unsigned int (*t_sendCommandToDevice)(struct am_recovery_device *rdev,
CFStringRef cmd) __attribute__ ((regparm(2)));
t_sendCommandToDevice _sendCommandToDevice = (t_sendCommandToDevice)0x3c3a3e3b;

typedef unsigned int (*t_AMRUSBInterfaceReadPipe)(unsigned int readwrite_pipe, unsigned
int read_pipe, unsigned char *data, unsigned int *len);
t_AMRUSBInterfaceReadPipe _AMRUSBInterfaceReadPipe = (t_AMRUSBInterfaceReadPipe)0x3c3a27e8;

typedef unsigned int (*t_AMRUSBInterfaceWritePipe)(unsigned int readwrite_pipe, unsigned
int write_pipe, void *data, unsigned int len);
t_AMRUSBInterfaceWritePipe _AMRUSBInterfaceWritePipe = (t_AMRUSBInterfaceWritePipe)0x3c3a27cb;
*/

int performOperation(am_restore_device *rdev, CFMutableDictionaryRef message);
int socketForPort(am_restore_device *rdev, unsigned int portnum);
int sendCommandToDevice(am_recovery_device *rdev, CFStringRef cfs, int block);
int sendFileToDevice(am_recovery_device *rdev, CFStringRef filename);

#ifdef __cplusplus
}
#endif

#endif

/* -*- mode:c; indent-tabs-mode:nil; c-basic-offset:2; tab-width:2; */
</pre>

===AFC Connection===
...

===Locking the Device for Sync===
When iTunes sends a new song to the device, the device shows a "Sync in progress" screen and when complete, the Music app on the device re-reads the iTunesDB file so it picks up the new song.

To get this behaviour, first start the notification service:
<pre>SOCKET socket;
AMDeviceStartService(dev, CFSTR("com.apple.mobile.notification_proxy"), &socket, NULL);</pre>

Now we post a notificaton message to signal that we are going to start a sync:
<pre>AMDPostNotification(socket, CFSTR("com.apple.itunes-mobdev.syncWillStart"), NULL);</pre>

Next we open the itunes lock file:
<pre>afc_file_ref lockref;
AFCFileRefOpen(conn, "/com.apple.itunes.lock_sync", 2, &lockref);</pre>

Now post a notification to say we are going to lock this file, and try and lock it.
If the AFCFileRefLock call fails, pause and repeat.
<pre>AMDPostNotification(socket, CFSTR("com.apple.itunes-mobdev.syncLockRequest"), NULL);
mach_error_t error = AFCFileRefLock(conn, lockref);</pre>

When the file is successfully locked, post another notification, and stop the notification service.
<pre>AMDPostNotification(socket,CFSTR("com.apple.itunes-mobdev.syncDidStart"), NULL);
AMDShutdownNotificationProxy(socket);</pre>

Now the sync can proceed, so copy your files across and make the changes to the iTunesDB.

To release the lock, start the notification system again, unlock and close the lock file, and send a sync finished notification message:

<pre>AFCFileRefUnlock(conn, lockref);
AFCFileRefClose(conn, lockref);
AMDeviceStartService(dev, CFSTR("com.apple.mobile.notification_proxy"), &socket, NULL);
AMDPostNotification(socket, &CFSTR("com.apple.itunes-mobdev.syncDidFinish"), NULL);
AMDShutdownNotificationProxy(socket);</pre>

To handle "Slide to Cancel" and terminate sync when user slides cancel switch, use AMDObserveNotification to subscribe notifications about “com.apple.itunes-client.syncCancelRequest”. Then start listening for notifications (AMDListenForNotifications) until you get “AMDNotificationFaceplant”.
When notification got, you should unlock and close lock file handle (don’t sure if you need to post “syncDidFinish” to proxy, seems it doesn’t matter) and terminate sync gracefully.
The same notification is also got when you unplug your device, so you should always be ready for errors.

NOTE: You may find that starting the notification_proxy service once and once only at the start of your app and using the same socket in calls to AMDPostNotification works better. iTunes opens and closes the notification_proxy regularly, but it appears to be a bit flakey when you open/close it all the time.

===Private Functions===

====How to find address of privates functions in iTunesMobileDevice.dll or MobileDevice.framework ?====
...

===Libraries Implementations===

* [http://code.google.com/p/iphuc/ iPhuc (Command line utility)]
* [http://code.google.com/p/iphucwin32/ iPhuc Win32 (Command line utility)]
* [http://code.google.com/p/manzana/ manzana (.Net Library)]
* [http://code.google.com/p/independence/source/browse/trunk/libPhoneInteraction/ libPhoneInteraction (C Library)]

MobileDevice Library

2009-10-18T21:57:32Z

Redart: /* MobileDevice Header (mobiledevice.h) */ Typo

MobileDevice Library is used by [[iTunes]] to transfer data between iPhone and computer over the USB connection.

===PC Windows : iTunesMobileDevice.dll===

* Location : Location is stored in '''iTunesMobileDeviceDLL''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Mobile Device Support\Shared''' key. Usually - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\iTunesMobileDevice.dll.

* Supporting CoreFoundation.dll (used for CFStringRef, CFPropertyListRef management) is located in the same dir (when using iTunes prior 9.0).

* For iTunes 9.0 location of CoreFoundation.dll is stored in '''InstallDir''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Application Support''' key, usually C:\Program Files\Common Files\Apple\Apple Application Support\. CoreFoundation.dll from Mobile Device Support\bin should not be used.

===Mac OSX : MobileDevice.framework===

* Location : /System/Library/PrivateFrameworks/MobileDevice.framework
* Export command : "nm /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/MobileDevice"

===MobileDevice Header (mobiledevice.h)===

Reverse engineered C header for MobileDevice Library.

<pre>
/* ----------------------------------------------------------------------------
* MobileDevice.h - interface to MobileDevice.framework
* ------------------------------------------------------------------------- */
#pragma once

#ifndef MOBILEDEVICE_H
#define MOBILEDEVICE_H

#ifdef __cplusplus
extern "C" {
#endif

#ifndef __GCC__
#pragma pack
#define __PACK
#else
#define __PACK __attribute__((__packed__))
#endif

#if defined(WIN32)
#define __DLLIMPORT [DllImport("iTunesMobileDevice.dll")]
using namespace System::Runtime::InteropServices;
#include <CoreFoundation.h>
typedef unsigned int mach_error_t;
#elif defined(__APPLE__)
#define __DLLIMPORT
#include <CoreFoundation/CoreFoundation.h>
#include <mach/error.h>
#endif

/* Error codes */
#define MDERR_APPLE_MOBILE (err_system(0x3a))
#define MDERR_IPHONE (err_sub(0))

/* Apple Mobile (AM*) errors */
#define MDERR_OK ERR_SUCCESS
#define MDERR_SYSCALL (ERR_MOBILE_DEVICE | 0x01)
#define MDERR_OUT_OF_MEMORY (ERR_MOBILE_DEVICE | 0x03)
#define MDERR_QUERY_FAILED (ERR_MOBILE_DEVICE | 0x04)
#define MDERR_INVALID_ARGUMENT (ERR_MOBILE_DEVICE | 0x0b)
#define MDERR_DICT_NOT_LOADED (ERR_MOBILE_DEVICE | 0x25)

/* Apple File Connection (AFC*) errors */
#define MDERR_AFC_OUT_OF_MEMORY 0x03

/* USBMux errors */
#define MDERR_USBMUX_ARG_NULL 0x16
#define MDERR_USBMUX_FAILED 0xffffffff

/* Messages passed to device notification callbacks: passed as part of
* am_device_notification_callback_info. */
#define ADNCI_MSG_CONNECTED 1
#define ADNCI_MSG_DISCONNECTED 2
#define ADNCI_MSG_UNSUBSCRIBED 3

#define AMD_IPHONE_PRODUCT_ID 0x1290
//#define AMD_IPHONE_SERIAL ""

/* Services, found in /System/Library/Lockdown/Services.plist */
#define AMSVC_AFC CFSTR("com.apple.afc")
#define AMSVC_BACKUP CFSTR("com.apple.mobilebackup")
#define AMSVC_CRASH_REPORT_COPY CFSTR("com.apple.crashreportcopy")
#define AMSVC_DEBUG_IMAGE_MOUNT CFSTR("com.apple.mobile.debug_image_mount")
#define AMSVC_NOTIFICATION_PROXY CFSTR("com.apple.mobile.notification_proxy")
#define AMSVC_PURPLE_TEST CFSTR("com.apple.purpletestr")
#define AMSVC_SOFTWARE_UPDATE CFSTR("com.apple.mobile.software_update")
#define AMSVC_SYNC CFSTR("com.apple.mobilesync")
#define AMSVC_SCREENSHOT CFSTR("com.apple.screenshotr")
#define AMSVC_SYSLOG_RELAY CFSTR("com.apple.syslog_relay")
#define AMSVC_SYSTEM_PROFILER CFSTR("com.apple.mobile.system_profiler")

typedef unsigned int afc_error_t;
typedef unsigned int usbmux_error_t;

struct am_recovery_device;

struct am_device_notification_callback_info {
struct am_device *dev; /* 0 device */
unsigned int msg; /* 4 one of ADNCI_MSG_* */
struct am_device_notification* subscription;
} __PACK;

/* The type of the device restore notification callback functions.
* TODO: change to correct type. */
typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *);

/* This is a CoreFoundation object of class AMRecoveryModeDevice. */
struct am_recovery_device {
unsigned char unknown0[8]; /* 0 */
am_restore_device_notification_callback callback; /* 8 */
void *user_info; /* 12 */
unsigned char unknown1[12]; /* 16 */
unsigned int readwrite_pipe; /* 28 */
unsigned char read_pipe; /* 32 */
unsigned char write_ctrl_pipe; /* 33 */
unsigned char read_unknown_pipe; /* 34 */
unsigned char write_file_pipe; /* 35 */
unsigned char write_input_pipe; /* 36 */
} __PACK;

/* A CoreFoundation object of class AMRestoreModeDevice. */
struct am_restore_device {
unsigned char unknown[32];
int port;
} __PACK;

/* The type of the device notification callback function. */
typedef void(*am_device_notification_callback)(struct am_device_notification_callback_info *, int cookie);

/* The type of the _AMDDeviceAttached function.
* TODO: change to correct type. */
typedef void *amd_device_attached_callback;

/* The type of the device restore notification callback functions.
* TODO: change to correct type. */
typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *);

/* Structure that contains internal data used by AMDevice... functions. Never try
* to access its members directly! Use AMDeviceCopyDeviceIdentifier,
* AMDeviceGetConnectionID, AMDeviceRetain, AMDeviceRelease instead. */
struct am_device {
unsigned char unknown0[16]; /* 0 - zero */
unsigned int device_id; /* 16 */
unsigned int product_id; /* 20 - set to AMD_IPHONE_PRODUCT_ID */
char *serial; /* 24 - set to UDID, Unique Device Identifier */
unsigned int unknown1; /* 28 */
unsigned int unknown2; /* 32 - reference counter, increased by AMDeviceRetain, decreased by AMDeviceRelease*/
unsigned int lockdown_conn; /* 36 */
unsigned char unknown3[8]; /* 40 */
#if (__ITUNES_VER > 740)
unsigned int unknown4; /* 48 - used to store CriticalSection Handle*/
#endif
#if (__ITUNES_VER >= 800)
unsigned char unknown5[24]; /* 52 */
#endif
} __PACK;

struct am_device_notification {
unsigned int unknown0; /* 0 */
unsigned int unknown1; /* 4 */
unsigned int unknown2; /* 8 */
am_device_notification_callback callback; /* 12 */
unsigned int cookie; /* 16 */
} __PACK;

struct afc_connection {
unsigned int handle; /* 0 */
unsigned int unknown0; /* 4 */
unsigned char unknown1; /* 8 */
unsigned char padding[3]; /* 9 */
unsigned int unknown2; /* 12 */
unsigned int unknown3; /* 16 */
unsigned int unknown4; /* 20 */
unsigned int fs_block_size; /* 24 */
unsigned int sock_block_size; /* 28: always 0x3c */
unsigned int io_timeout; /* 32: from AFCConnectionOpen, usu. 0 */
void *afc_lock; /* 36 */
unsigned int context; /* 40 */
} __PACK;

struct afc_device_info {
unsigned char unknown[12]; /* 0 */
} __PACK;

struct afc_directory {
unsigned char unknown[0]; /* size unknown */
} __PACK;

struct afc_dictionary {
unsigned char unknown[0]; /* size unknown */
} __PACK;

typedef unsigned long long afc_file_ref;

struct usbmux_listener_1 { /* offset value in iTunes */
unsigned int unknown0; /* 0 1 */
unsigned char *unknown1; /* 4 ptr, maybe device? */
amd_device_attached_callback callback; /* 8 _AMDDeviceAttached */
unsigned int unknown3; /* 12 */
unsigned int unknown4; /* 16 */
unsigned int unknown5; /* 20 */
} __PACK;

struct usbmux_listener_2 {
unsigned char unknown0[4144];
} __PACK;

struct am_bootloader_control_packet {
unsigned char opcode; /* 0 */
unsigned char length; /* 1 */
unsigned char magic[2]; /* 2: 0x34, 0x12 */
unsigned char payload[0]; /* 4 */
} __PACK;

/* ----------------------------------------------------------------------------
* Public routines
* ------------------------------------------------------------------------- */

/* Registers a notification with the current run loop. The callback gets
* copied into the notification struct, as well as being registered with the
* current run loop. Cookie gets copied into cookie in the same.
* (Cookie is a user info parameter that gets passed as an arg to
* the callback) unused0 and unused1 are both 0 when iTunes calls this.
*
* Never try to acces directly or copy contents of dev and subscription fields
* in am_device_notification_callback_info. Treat them as abstract handles.
* When done with connection use AMDeviceRelease to free resources allocated for am_device.
*
* Returns:
* MDERR_OK if successful
* MDERR_SYSCALL if CFRunLoopAddSource() failed
* MDERR_OUT_OF_MEMORY if we ran out of memory
*/
__DLLIMPORT mach_error_t AMDeviceNotificationSubscribe(am_device_notification_callback callback,
unsigned int unused0, unsigned int unused1,
unsigned int cookie,
struct am_device_notification **subscription);

/* Unregisters notifications. Buggy (iTunes 8.2): if you subscribe, unsubscribe and subscribe again, arriving
notifications will contain cookie and subscription from 1st call to subscribe, not the 2nd one. iTunes
calls this function only once on exit.
*/
__DLLIMPORT mach_error_t AMDeviceNotificationUnsubscribe(am_device_notification* subscription);

/* Returns device_id field of am_device structure
*/
__DLLIMPORT unsigned int AMDeviceGetConnectionID(struct am_device *device);

/* Returns serial field of am_device structure
*/
__DLLIMPORT CFStringRef AMDeviceCopyDeviceIdentifier(struct am_device *device);

/* Connects to the iPhone. Pass in the am_device structure that the
* notification callback will give to you.
*
* Returns:
* MDERR_OK if successfully connected
* MDERR_SYSCALL if setsockopt() failed
* MDERR_QUERY_FAILED if the daemon query failed
* MDERR_INVALID_ARGUMENT if USBMuxConnectByPort returned 0xffffffff
*/
__DLLIMPORT mach_error_t AMDeviceConnect(struct am_device *device);

/* Calls PairingRecordPath() on the given device, than tests whether the path
* which that function returns exists. During the initial connect, the path
* returned by that function is '/', and so this returns 1.
*
* Returns:
* 0 if the path did not exist
* 1 if it did
*/
__DLLIMPORT mach_error_t AMDeviceIsPaired(struct am_device *device);
__DLLIMPORT mach_error_t AMDevicePair(struct am_device *device);

/* iTunes calls this function immediately after testing whether the device is
* paired. It creates a pairing file and establishes a Lockdown connection.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the supplied device is null
* MDERR_DICT_NOT_LOADED if the load_dict() call failed
*/
__DLLIMPORT mach_error_t AMDeviceValidatePairing(struct am_device *device);

/* Creates a Lockdown session and adjusts the device structure appropriately
* to indicate that the session has been started. iTunes calls this function
* after validating pairing.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
* MDERR_DICT_NOT_LOADED if the load_dict() call failed
*/
__DLLIMPORT mach_error_t AMDeviceStartSession(struct am_device *device);

/* Reads various device settings. One of domain or cfstring arguments should be NULL.
*
* Possible values for cfstring:
* ActivationState
* ActivationStateAcknowledged
* BasebandBootloaderVersion
* BasebandVersion
* BluetoothAddress
* BuildVersion
* DeviceCertificate
* DeviceClass
* DeviceName
* DevicePublicKey
* FirmwareVersion
* HostAttached
* IntegratedCircuitCardIdentity
* InternationalMobileEquipmentIdentity
* InternationalMobileSubscriberIdentity
* ModelNumber
* PhoneNumber
* ProductType
* ProductVersion
* ProtocolVersion
* RegionInfo
* SBLockdownEverRegisteredKey
* SIMStatus
* SerialNumber
* SomebodySetTimeZone
* TimeIntervalSince1970
* TimeZone
* TimeZoneOffsetFromUTC
* TrustedHostAttached
* UniqueDeviceID
* Uses24HourClock
* WiFiAddress
* iTunesHasConnected
*
* Possible values for domain:
* com.apple.mobile.battery
*/
__DLLIMPORT CFStringRef AMDeviceCopyValue(struct am_device *device, CFStringRef domain, CFStringRef cfstring);

/* Starts a service and returns a socket file descriptor that can be used in order to further
* access the service. You should stop the session and disconnect before using
* the service. iTunes calls this function after starting a session. It starts
* the service and the SSL connection. service_name should be one of the AMSVC_*
* constants.
*
* Returns:
* MDERR_OK if successful
* MDERR_SYSCALL if the setsockopt() call failed
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
*/
__DLLIMPORT mach_error_t AMDeviceStartService(struct am_device *device, CFStringRef
service_name, int *socket_fd);

/* Stops a session. You should do this before accessing services.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
*/
__DLLIMPORT mach_error_t AMDeviceStopSession(struct am_device *device);

/* Decrements reference counter and, if nothing left, releases resources hold
* by connection, invalidates pointer to device
*/
__DLLIMPORT void AMDeviceRelease(struct am_device *device);

/* Increments reference counter
*/
__DLLIMPORT void AMDeviceRetain(struct am_device *device);

/* Opens an Apple File Connection. You must start the appropriate service
* first with AMDeviceStartService(). In iTunes, io_timeout is 0.
*
* Returns:
* MDERR_OK if successful
* MDERR_AFC_OUT_OF_MEMORY if malloc() failed
*/
__DLLIMPORT afc_error_t AFCConnectionOpen(int socket_fd, unsigned int io_timeout,
struct afc_connection **conn);

/* Pass in a pointer to an afc_dictionary structure. It will be filled. You can
* iterate it using AFCKeyValueRead. When done use AFCKeyValueClose. Possible keys:
* FSFreeBytes - free bytes on system device for afc2, user device for afc
* FSBlockSize - filesystem block size
* FSTotalBytes - size of device
* Model - iPhone1,1 etc.

*/
__DLLIMPORT afc_error_t AFCDeviceInfoOpen(struct afc_connection *conn, struct
afc_dictionary **info);

/* Turns debug mode on if the environment variable AFCDEBUG is set to a numeric
* value, or if the file '/AFCDEBUG' is present and contains a value. */
#if defined(__APPLE__)
void AFCPlatformInit();
#endif

/* Opens a directory on the iPhone. Pass in a pointer in dir to be filled in.
* Note that this normally only accesses the iTunes sandbox/partition as the
* root, which is /var/root/Media. Pathnames are specified with '/' delimiters
* as in Unix style. Use UTF-8 to specify non-ASCII symbols in path.
*
* Returns:
* MDERR_OK if successful
*/
__DLLIMPORT afc_error_t AFCDirectoryOpen(struct afc_connection *conn, char *path, struct
afc_directory **dir);

/* Acquires the next entry in a directory previously opened with
* AFCDirectoryOpen(). When dirent is filled with a NULL value, then the end
* of the directory has been reached. '.' and '..' will be returned as the
* first two entries in each directory except the root; you may want to skip
* over them.
*
* Returns:
* MDERR_OK if successful, even if no entries remain
*/
__DLLIMPORT afc_error_t AFCDirectoryRead(struct afc_connection *conn/*unsigned int unused*/, struct afc_directory *dir,
char **dirent);
__DLLIMPORT afc_error_t AFCDirectoryClose(afc_connection *conn, struct afc_directory *dir);
__DLLIMPORT afc_error_t AFCDirectoryCreate(afc_connection *conn, char *dirname);
__DLLIMPORT afc_error_t AFCRemovePath(afc_connection *conn, char *dirname);
__DLLIMPORT afc_error_t AFCRenamePath(afc_connection *conn, char *oldpath, char *newpath);

/* Creates symbolic or hard link
* linktype - int64: 1 means hard link, 2 - soft (symbolic) link
* target - absolute or relative path to link target
* linkname - absolute path where to create new link
*/
__DLLIMPORT afc_error_t AFCLinkPath(afc_connection *conn, long long int linktype, const char *target, const char *linkname);

/* Opens file for reading or writing without locking it in any way. afc_file_ref should not be shared between threads -
* opening file in one thread and closing it in another will lead to possible crash.
* path - UTF-8 encoded absolute path to file
* mode 2 = read, mode 3 = write; unknown = 0
* ref - receives file handle
*/
__DLLIMPORT afc_error_t AFCFileRefOpen(struct afc_connection *conn, char *path, unsigned
long long int mode, afc_file_ref *ref);
/* Reads specified amount (len) of bytes from file into buf. Puts actual count of read bytes into len on return
*/
__DLLIMPORT afc_error_t AFCFileRefRead(struct afc_connection *conn, afc_file_ref ref,
void *buf, unsigned int *len);
/* Writes specified amount (len) of bytes from buf into file.
*/
__DLLIMPORT afc_error_t AFCFileRefWrite(struct afc_connection *conn, afc_file_ref ref,
void *buf, unsigned int len);
/* Moves the file pointer to a specified location.
* offset - Number of bytes from origin (int64)
* origin - 0 = from beginning, 1 = from current position, 2 = from end
*/
__DLLIMPORT afc_error_t AFCFileRefSeek(struct afc_connection *conn, afc_file_ref ref,
unsigned long long offset, int origin, int unused);

/* Gets the current position of a file pointer into offset argument.
*/
__DLLIMPORT afc_error_t AFCFileRefTell(struct afc_connection *conn, afc_file_ref ref,
unsigned long long* offset);

__DLLIMPORT afc_error_t AFCFileRefLock(struct afc_connection *conn, afc_file_ref ref);
__DLLIMPORT afc_error_t AFCFileRefUnlock(struct afc_connection *conn, afc_file_ref ref);
__DLLIMPORT afc_error_t AFCFileRefClose(struct afc_connection *conn, afc_file_ref ref);

/* Opens dictionary describing specified file or directory (iTunes below 8.2 allowed using AFCGetFileInfo
to get the same information)
*/
__DLLIMPORT afc_error_t AFCFileInfoOpen(struct afc_connection *conn, char *path, struct
afc_dictionary **info);

/* Reads next entry from dictionary. When last entry is read, function returns NULL in key argument
Possible keys:
"st_size": val - size in bytes
"st_blocks": val - size in blocks
"st_nlink": val - number of hardlinks
"st_ifmt": val - "S_IFDIR" for folders
"S_IFLNK" for symlinks
"LinkTarget": val - path to symlink target
*/
__DLLIMPORT afc_error_t AFCKeyValueRead(struct afc_dictionary *dict, char **key, char **
val);
/* Closes dictionary
*/
__DLLIMPORT afc_error_t AFCKeyValueClose(struct afc_dictionary *dict);

/* Returns the context field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetContext(struct afc_connection *conn);

/* Returns the fs_block_size field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetFSBlockSize(struct afc_connection *conn);

/* Returns the io_timeout field of the given AFC connection. In iTunes this is
* 0. */
__DLLIMPORT unsigned int AFCConnectionGetIOTimeout(struct afc_connection *conn);

/* Returns the sock_block_size field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetSocketBlockSize(struct afc_connection *conn);

/* Closes the given AFC connection. */
__DLLIMPORT afc_error_t AFCConnectionClose(struct afc_connection *conn);

/* Registers for device notifications related to the restore process. unknown0
* is zero when iTunes calls this. In iTunes,
* the callbacks are located at:
* 1: $3ac68e-$3ac6b1, calls $3ac542(unknown1, arg, 0)
* 2: $3ac66a-$3ac68d, calls $3ac542(unknown1, 0, arg)
* 3: $3ac762-$3ac785, calls $3ac6b2(unknown1, arg, 0)
* 4: $3ac73e-$3ac761, calls $3ac6b2(unknown1, 0, arg)
*/
__DLLIMPORT unsigned int AMRestoreRegisterForDeviceNotifications(
am_restore_device_notification_callback dfu_connect_callback,
am_restore_device_notification_callback recovery_connect_callback,
am_restore_device_notification_callback dfu_disconnect_callback,
am_restore_device_notification_callback recovery_disconnect_callback,
unsigned int unknown0,
void *user_info);

/* Causes the restore functions to spit out (unhelpful) progress messages to
* the file specified by the given path. iTunes always calls this right before
* restoring with a path of
* "$HOME/Library/Logs/iPhone Updater Logs/iPhoneUpdater X.log", where X is an
* unused number.
*/
__DLLIMPORT unsigned int AMRestoreEnableFileLogging(char *path);

/* Initializes a new option dictionary to default values. Pass the constant
* kCFAllocatorDefault as the allocator. The option dictionary looks as
* follows:
* {
* NORImageType => 'production',
* AutoBootDelay => 0,
* KernelCacheType => 'Release',
* UpdateBaseband => true,
* DFUFileType => 'RELEASE',
* SystemImageType => 'User',
* CreateFilesystemPartitions => true,
* FlashNOR => true,
* RestoreBootArgs => 'rd=md0 nand-enable-reformat=1 -progress'
* BootImageType => 'User'
* }
*
* Returns:
* the option dictionary if successful
* NULL if out of memory
*/
__DLLIMPORT CFMutableDictionaryRef AMRestoreCreateDefaultOptions(CFAllocatorRef allocator);

/* ----------------------------------------------------------------------------
* Less-documented public routines
* ------------------------------------------------------------------------- */

__DLLIMPORT unsigned int AMRestorePerformRecoveryModeRestore(struct am_recovery_device *
rdev, CFDictionaryRef opts, void *callback, void *user_info);
__DLLIMPORT unsigned int AMRestorePerformRestoreModeRestore(struct am_restore_device *
rdev, CFDictionaryRef opts, void *callback, void *user_info);
__DLLIMPORT struct am_restore_device *AMRestoreModeDeviceCreate(unsigned int unknown0,
unsigned int connection_id, unsigned int unknown1);
__DLLIMPORT unsigned int AMRestoreCreatePathsForBundle(CFStringRef restore_bundle_path,
CFStringRef kernel_cache_type, CFStringRef boot_image_type, unsigned int
unknown0, CFStringRef *firmware_dir_path, CFStringRef *
kernelcache_restore_path, unsigned int unknown1, CFStringRef *
ramdisk_path);
__DLLIMPORT unsigned int AMRestoreModeDeviceReboot(struct am_restore_device *rdev); // Added by JB 30.07.2008
__DLLIMPORT mach_error_t AMDeviceEnterRecovery(struct am_device *device);
__DLLIMPORT mach_error_t AMDeviceDisconnect(struct am_device *device);

/* to use this, start the service "com.apple.mobile.notification_proxy", handle will be the socket to use */
typedef void (*NOTIFY_CALLBACK)(CFSTR notification, USERDATA data);
__DLLIMPORT mach_error_t AMDPostNotification(SOCKET socket, CFStringRef notification, CFStringRef userinfo);
__DLLIMPORT mach_error_t AMDObserveNotification(SOCKET socket, CFSTR notification);
__DLLIMPORT mach_error_t AMDListenForNotifications(SOCKET socket, NOTIFY_CALLBACK cb, USERDATA data);
__DLLIMPORT mach_error_t AMDShutdownNotificationProxy(SOCKET socket);

/*edits by geohot*/
__DLLIMPORT mach_error_t AMDeviceDeactivate(struct am_device *device);
__DLLIMPORT mach_error_t AMDeviceActivate(struct am_device *device, CFDictionaryRef dict);
__DLLIMPORT mach_error_t AMDeviceRemoveValue(struct am_device *device, unsigned int, CFStringRef cfstring);

/* ----------------------------------------------------------------------------
* Semi-private routines
* ------------------------------------------------------------------------- */

/* Pass in a usbmux_listener_1 structure and a usbmux_listener_2 structure
* pointer, which will be filled with the resulting usbmux_listener_2.
*
* Returns:
* MDERR_OK if completed successfully
* MDERR_USBMUX_ARG_NULL if one of the arguments was NULL
* MDERR_USBMUX_FAILED if the listener was not created successfully
*/
__DLLIMPORT usbmux_error_t USBMuxListenerCreate(struct usbmux_listener_1 *esi_fp8, struct
usbmux_listener_2 **eax_fp12);

/* ----------------------------------------------------------------------------
* Less-documented semi-private routines
* ------------------------------------------------------------------------- */
__DLLIMPORT usbmux_error_t USBMuxListenerHandleData(void *);

/* ----------------------------------------------------------------------------
* Private routines - here be dragons
* ------------------------------------------------------------------------- */

/* AMRestorePerformRestoreModeRestore() calls this function with a dictionary
* in order to perform certain special restore operations
* (RESTORED_OPERATION_*). It is thought that this function might enable
* significant access to the phone. */

/*
typedef unsigned int (*t_performOperation)(struct am_restore_device *rdev,
CFDictionaryRef op) __attribute__ ((regparm(2)));
t_performOperation _performOperation = (t_performOperation)0x3c39fa4b;
*/

/* ----------------------------------------------------------------------------
* Less-documented private routines
* ------------------------------------------------------------------------- */

/*
typedef int (*t_socketForPort)(struct am_restore_device *rdev, unsigned int port)
__attribute__ ((regparm(2)));
t_socketForPort _socketForPort = (t_socketForPort)(void *)0x3c39f36c;

typedef void (*t_restored_send_message)(int port, CFDictionaryRef msg);
t_restored_send_message _restored_send_message = (t_restored_send_message)0x3c3a4e40;

typedef CFDictionaryRef (*t_restored_receive_message)(int port);
t_restored_receive_message _restored_receive_message = (t_restored_receive_message)0x3c3a4d40;

typedef unsigned int (*t_sendControlPacket)(struct am_recovery_device *rdev, unsigned
int msg1, unsigned int msg2, unsigned int unknown0, unsigned int *unknown1,
unsigned char *unknown2) __attribute__ ((regparm(3)));
t_sendControlPacket _sendControlPacket = (t_sendControlPacket)0x3c3a3da3;;

typedef unsigned int (*t_sendCommandToDevice)(struct am_recovery_device *rdev,
CFStringRef cmd) __attribute__ ((regparm(2)));
t_sendCommandToDevice _sendCommandToDevice = (t_sendCommandToDevice)0x3c3a3e3b;

typedef unsigned int (*t_AMRUSBInterfaceReadPipe)(unsigned int readwrite_pipe, unsigned
int read_pipe, unsigned char *data, unsigned int *len);
t_AMRUSBInterfaceReadPipe _AMRUSBInterfaceReadPipe = (t_AMRUSBInterfaceReadPipe)0x3c3a27e8;

typedef unsigned int (*t_AMRUSBInterfaceWritePipe)(unsigned int readwrite_pipe, unsigned
int write_pipe, void *data, unsigned int len);
t_AMRUSBInterfaceWritePipe _AMRUSBInterfaceWritePipe = (t_AMRUSBInterfaceWritePipe)0x3c3a27cb;
*/

int performOperation(am_restore_device *rdev, CFMutableDictionaryRef message);
int socketForPort(am_restore_device *rdev, unsigned int portnum);
int sendCommandToDevice(am_recovery_device *rdev, CFStringRef cfs, int block);
int sendFileToDevice(am_recovery_device *rdev, CFStringRef filename);

#ifdef __cplusplus
}
#endif

#endif

/* -*- mode:c; indent-tabs-mode:nil; c-basic-offset:2; tab-width:2; */
</pre>

===AFC Connection===
...

===Locking the Device for Sync===
When iTunes sends a new song to the device, the device shows a "Sync in progress" screen and when complete, the Music app on the device re-reads the iTunesDB file so it picks up the new song.

To get this behaviour, first start the notification service:
<pre>SOCKET socket;
AMDeviceStartService(dev, CFSTR("com.apple.mobile.notification_proxy"), &socket, NULL);</pre>

Now we post a notificaton message to signal that we are going to start a sync:
<pre>AMDPostNotification(socket, CFSTR("com.apple.itunes-mobdev.syncWillStart"), NULL);</pre>

Next we open the itunes lock file:
<pre>afc_file_ref lockref;
AFCFileRefOpen(conn, "/com.apple.itunes.lock_sync", 2, &lockref);</pre>

Now post a notification to say we are going to lock this file, and try and lock it.
If the AFCFileRefLock call fails, pause and repeat.
<pre>AMDPostNotification(socket, CFSTR("com.apple.itunes-mobdev.syncLockRequest"), NULL);
mach_error_t error = AFCFileRefLock(conn, lockref);</pre>

When the file is successfully locked, post another notification, and stop the notification service.
<pre>AMDPostNotification(socket,CFSTR("com.apple.itunes-mobdev.syncDidStart"), NULL);
AMDShutdownNotificationProxy(socket);</pre>

Now the sync can proceed, so copy your files across and make the changes to the iTunesDB.

To release the lock, start the notification system again, unlock and close the lock file, and send a sync finished notification message:

<pre>AFCFileRefUnlock(conn, lockref);
AFCFileRefClose(conn, lockref);
AMDeviceStartService(dev, CFSTR("com.apple.mobile.notification_proxy"), &socket, NULL);
AMDPostNotification(socket, &CFSTR("com.apple.itunes-mobdev.syncDidFinish"), NULL);
AMDShutdownNotificationProxy(socket);</pre>

To handle "Slide to Cancel" and terminate sync when user slides cancel switch, use AMDObserveNotification to subscribe notifications about “com.apple.itunes-client.syncCancelRequest”. Then start listening for notifications (AMDListenForNotifications) until you get “AMDNotificationFaceplant”.
When notification got, you should unlock and close lock file handle (don’t sure if you need to post “syncDidFinish” to proxy, seems it doesn’t matter) and terminate sync gracefully.
The same notification is also got when you unplug your device, so you should always be ready for errors.

NOTE: You may find that starting the notification_proxy service once and once only at the start of your app and using the same socket in calls to AMDPostNotification works better. iTunes opens and closes the notification_proxy regularly, but it appears to be a bit flakey when you open/close it all the time.

===Private Functions===

====How to find address of privates functions in iTunesMobileDevice.dll or MobileDevice.framework ?====
...

===Libraries Implementations===

* [http://code.google.com/p/iphuc/ iPhuc (Command line utility)]
* [http://code.google.com/p/iphucwin32/ iPhuc Win32 (Command line utility)]
* [http://code.google.com/p/manzana/ manzana (.Net Library)]
* [http://code.google.com/p/independence/source/browse/trunk/libPhoneInteraction/ libPhoneInteraction (C Library)]

MobileDevice Library

2009-10-18T21:56:12Z

Redart: /* MobileDevice Header (mobiledevice.h) */ New export documented (AFCLinkPath)

MobileDevice Library is used by [[iTunes]] to transfer data between iPhone and computer over the USB connection.

===PC Windows : iTunesMobileDevice.dll===

* Location : Location is stored in '''iTunesMobileDeviceDLL''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Mobile Device Support\Shared''' key. Usually - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\iTunesMobileDevice.dll.

* Supporting CoreFoundation.dll (used for CFStringRef, CFPropertyListRef management) is located in the same dir (when using iTunes prior 9.0).

* For iTunes 9.0 location of CoreFoundation.dll is stored in '''InstallDir''' registry value under '''HKLM\SOFTWARE\Apple Inc.\Apple Application Support''' key, usually C:\Program Files\Common Files\Apple\Apple Application Support\. CoreFoundation.dll from Mobile Device Support\bin should not be used.

===Mac OSX : MobileDevice.framework===

* Location : /System/Library/PrivateFrameworks/MobileDevice.framework
* Export command : "nm /System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/MobileDevice"

===MobileDevice Header (mobiledevice.h)===

Reverse engineered C header for MobileDevice Library.

<pre>
/* ----------------------------------------------------------------------------
* MobileDevice.h - interface to MobileDevice.framework
* ------------------------------------------------------------------------- */
#pragma once

#ifndef MOBILEDEVICE_H
#define MOBILEDEVICE_H

#ifdef __cplusplus
extern "C" {
#endif

#ifndef __GCC__
#pragma pack
#define __PACK
#else
#define __PACK __attribute__((__packed__))
#endif

#if defined(WIN32)
#define __DLLIMPORT [DllImport("iTunesMobileDevice.dll")]
using namespace System::Runtime::InteropServices;
#include <CoreFoundation.h>
typedef unsigned int mach_error_t;
#elif defined(__APPLE__)
#define __DLLIMPORT
#include <CoreFoundation/CoreFoundation.h>
#include <mach/error.h>
#endif

/* Error codes */
#define MDERR_APPLE_MOBILE (err_system(0x3a))
#define MDERR_IPHONE (err_sub(0))

/* Apple Mobile (AM*) errors */
#define MDERR_OK ERR_SUCCESS
#define MDERR_SYSCALL (ERR_MOBILE_DEVICE | 0x01)
#define MDERR_OUT_OF_MEMORY (ERR_MOBILE_DEVICE | 0x03)
#define MDERR_QUERY_FAILED (ERR_MOBILE_DEVICE | 0x04)
#define MDERR_INVALID_ARGUMENT (ERR_MOBILE_DEVICE | 0x0b)
#define MDERR_DICT_NOT_LOADED (ERR_MOBILE_DEVICE | 0x25)

/* Apple File Connection (AFC*) errors */
#define MDERR_AFC_OUT_OF_MEMORY 0x03

/* USBMux errors */
#define MDERR_USBMUX_ARG_NULL 0x16
#define MDERR_USBMUX_FAILED 0xffffffff

/* Messages passed to device notification callbacks: passed as part of
* am_device_notification_callback_info. */
#define ADNCI_MSG_CONNECTED 1
#define ADNCI_MSG_DISCONNECTED 2
#define ADNCI_MSG_UNSUBSCRIBED 3

#define AMD_IPHONE_PRODUCT_ID 0x1290
//#define AMD_IPHONE_SERIAL ""

/* Services, found in /System/Library/Lockdown/Services.plist */
#define AMSVC_AFC CFSTR("com.apple.afc")
#define AMSVC_BACKUP CFSTR("com.apple.mobilebackup")
#define AMSVC_CRASH_REPORT_COPY CFSTR("com.apple.crashreportcopy")
#define AMSVC_DEBUG_IMAGE_MOUNT CFSTR("com.apple.mobile.debug_image_mount")
#define AMSVC_NOTIFICATION_PROXY CFSTR("com.apple.mobile.notification_proxy")
#define AMSVC_PURPLE_TEST CFSTR("com.apple.purpletestr")
#define AMSVC_SOFTWARE_UPDATE CFSTR("com.apple.mobile.software_update")
#define AMSVC_SYNC CFSTR("com.apple.mobilesync")
#define AMSVC_SCREENSHOT CFSTR("com.apple.screenshotr")
#define AMSVC_SYSLOG_RELAY CFSTR("com.apple.syslog_relay")
#define AMSVC_SYSTEM_PROFILER CFSTR("com.apple.mobile.system_profiler")

typedef unsigned int afc_error_t;
typedef unsigned int usbmux_error_t;

struct am_recovery_device;

struct am_device_notification_callback_info {
struct am_device *dev; /* 0 device */
unsigned int msg; /* 4 one of ADNCI_MSG_* */
struct am_device_notification* subscription;
} __PACK;

/* The type of the device restore notification callback functions.
* TODO: change to correct type. */
typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *);

/* This is a CoreFoundation object of class AMRecoveryModeDevice. */
struct am_recovery_device {
unsigned char unknown0[8]; /* 0 */
am_restore_device_notification_callback callback; /* 8 */
void *user_info; /* 12 */
unsigned char unknown1[12]; /* 16 */
unsigned int readwrite_pipe; /* 28 */
unsigned char read_pipe; /* 32 */
unsigned char write_ctrl_pipe; /* 33 */
unsigned char read_unknown_pipe; /* 34 */
unsigned char write_file_pipe; /* 35 */
unsigned char write_input_pipe; /* 36 */
} __PACK;

/* A CoreFoundation object of class AMRestoreModeDevice. */
struct am_restore_device {
unsigned char unknown[32];
int port;
} __PACK;

/* The type of the device notification callback function. */
typedef void(*am_device_notification_callback)(struct am_device_notification_callback_info *, int cookie);

/* The type of the _AMDDeviceAttached function.
* TODO: change to correct type. */
typedef void *amd_device_attached_callback;

/* The type of the device restore notification callback functions.
* TODO: change to correct type. */
typedef void (*am_restore_device_notification_callback)(struct am_recovery_device *);

/* Structure that contains internal data used by AMDevice... functions. Never try
* to access its members directly! Use AMDeviceCopyDeviceIdentifier,
* AMDeviceGetConnectionID, AMDeviceRetain, AMDeviceRelease instead. */
struct am_device {
unsigned char unknown0[16]; /* 0 - zero */
unsigned int device_id; /* 16 */
unsigned int product_id; /* 20 - set to AMD_IPHONE_PRODUCT_ID */
char *serial; /* 24 - set to UDID, Unique Device Identifier */
unsigned int unknown1; /* 28 */
unsigned int unknown2; /* 32 - reference counter, increased by AMDeviceRetain, decreased by AMDeviceRelease*/
unsigned int lockdown_conn; /* 36 */
unsigned char unknown3[8]; /* 40 */
#if (__ITUNES_VER > 740)
unsigned int unknown4; /* 48 - used to store CriticalSection Handle*/
#endif
#if (__ITUNES_VER >= 800)
unsigned char unknown5[24]; /* 52 */
#endif
} __PACK;

struct am_device_notification {
unsigned int unknown0; /* 0 */
unsigned int unknown1; /* 4 */
unsigned int unknown2; /* 8 */
am_device_notification_callback callback; /* 12 */
unsigned int cookie; /* 16 */
} __PACK;

struct afc_connection {
unsigned int handle; /* 0 */
unsigned int unknown0; /* 4 */
unsigned char unknown1; /* 8 */
unsigned char padding[3]; /* 9 */
unsigned int unknown2; /* 12 */
unsigned int unknown3; /* 16 */
unsigned int unknown4; /* 20 */
unsigned int fs_block_size; /* 24 */
unsigned int sock_block_size; /* 28: always 0x3c */
unsigned int io_timeout; /* 32: from AFCConnectionOpen, usu. 0 */
void *afc_lock; /* 36 */
unsigned int context; /* 40 */
} __PACK;

struct afc_device_info {
unsigned char unknown[12]; /* 0 */
} __PACK;

struct afc_directory {
unsigned char unknown[0]; /* size unknown */
} __PACK;

struct afc_dictionary {
unsigned char unknown[0]; /* size unknown */
} __PACK;

typedef unsigned long long afc_file_ref;

struct usbmux_listener_1 { /* offset value in iTunes */
unsigned int unknown0; /* 0 1 */
unsigned char *unknown1; /* 4 ptr, maybe device? */
amd_device_attached_callback callback; /* 8 _AMDDeviceAttached */
unsigned int unknown3; /* 12 */
unsigned int unknown4; /* 16 */
unsigned int unknown5; /* 20 */
} __PACK;

struct usbmux_listener_2 {
unsigned char unknown0[4144];
} __PACK;

struct am_bootloader_control_packet {
unsigned char opcode; /* 0 */
unsigned char length; /* 1 */
unsigned char magic[2]; /* 2: 0x34, 0x12 */
unsigned char payload[0]; /* 4 */
} __PACK;

/* ----------------------------------------------------------------------------
* Public routines
* ------------------------------------------------------------------------- */

/* Registers a notification with the current run loop. The callback gets
* copied into the notification struct, as well as being registered with the
* current run loop. Cookie gets copied into cookie in the same.
* (Cookie is a user info parameter that gets passed as an arg to
* the callback) unused0 and unused1 are both 0 when iTunes calls this.
*
* Never try to acces directly or copy contents of dev and subscription fields
* in am_device_notification_callback_info. Treat them as abstract handles.
* When done with connection use AMDeviceRelease to free resources allocated for am_device.
*
* Returns:
* MDERR_OK if successful
* MDERR_SYSCALL if CFRunLoopAddSource() failed
* MDERR_OUT_OF_MEMORY if we ran out of memory
*/
__DLLIMPORT mach_error_t AMDeviceNotificationSubscribe(am_device_notification_callback callback,
unsigned int unused0, unsigned int unused1,
unsigned int cookie,
struct am_device_notification **subscription);

/* Unregisters notifications. Buggy (iTunes 8.2): if you subscribe, unsubscribe and subscribe again, arriving
notifications will contain cookie and subscription from 1st call to subscribe, not the 2nd one. iTunes
calls this function only once on exit.
*/
__DLLIMPORT mach_error_t AMDeviceNotificationUnsubscribe(am_device_notification* subscription);

/* Returns device_id field of am_device structure
*/
__DLLIMPORT unsigned int AMDeviceGetConnectionID(struct am_device *device);

/* Returns serial field of am_device structure
*/
__DLLIMPORT CFStringRef AMDeviceCopyDeviceIdentifier(struct am_device *device);

/* Connects to the iPhone. Pass in the am_device structure that the
* notification callback will give to you.
*
* Returns:
* MDERR_OK if successfully connected
* MDERR_SYSCALL if setsockopt() failed
* MDERR_QUERY_FAILED if the daemon query failed
* MDERR_INVALID_ARGUMENT if USBMuxConnectByPort returned 0xffffffff
*/
__DLLIMPORT mach_error_t AMDeviceConnect(struct am_device *device);

/* Calls PairingRecordPath() on the given device, than tests whether the path
* which that function returns exists. During the initial connect, the path
* returned by that function is '/', and so this returns 1.
*
* Returns:
* 0 if the path did not exist
* 1 if it did
*/
__DLLIMPORT mach_error_t AMDeviceIsPaired(struct am_device *device);
__DLLIMPORT mach_error_t AMDevicePair(struct am_device *device);

/* iTunes calls this function immediately after testing whether the device is
* paired. It creates a pairing file and establishes a Lockdown connection.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the supplied device is null
* MDERR_DICT_NOT_LOADED if the load_dict() call failed
*/
__DLLIMPORT mach_error_t AMDeviceValidatePairing(struct am_device *device);

/* Creates a Lockdown session and adjusts the device structure appropriately
* to indicate that the session has been started. iTunes calls this function
* after validating pairing.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
* MDERR_DICT_NOT_LOADED if the load_dict() call failed
*/
__DLLIMPORT mach_error_t AMDeviceStartSession(struct am_device *device);

/* Reads various device settings. One of domain or cfstring arguments should be NULL.
*
* Possible values for cfstring:
* ActivationState
* ActivationStateAcknowledged
* BasebandBootloaderVersion
* BasebandVersion
* BluetoothAddress
* BuildVersion
* DeviceCertificate
* DeviceClass
* DeviceName
* DevicePublicKey
* FirmwareVersion
* HostAttached
* IntegratedCircuitCardIdentity
* InternationalMobileEquipmentIdentity
* InternationalMobileSubscriberIdentity
* ModelNumber
* PhoneNumber
* ProductType
* ProductVersion
* ProtocolVersion
* RegionInfo
* SBLockdownEverRegisteredKey
* SIMStatus
* SerialNumber
* SomebodySetTimeZone
* TimeIntervalSince1970
* TimeZone
* TimeZoneOffsetFromUTC
* TrustedHostAttached
* UniqueDeviceID
* Uses24HourClock
* WiFiAddress
* iTunesHasConnected
*
* Possible values for domain:
* com.apple.mobile.battery
*/
__DLLIMPORT CFStringRef AMDeviceCopyValue(struct am_device *device, CFStringRef domain, CFStringRef cfstring);

/* Starts a service and returns a socket file descriptor that can be used in order to further
* access the service. You should stop the session and disconnect before using
* the service. iTunes calls this function after starting a session. It starts
* the service and the SSL connection. service_name should be one of the AMSVC_*
* constants.
*
* Returns:
* MDERR_OK if successful
* MDERR_SYSCALL if the setsockopt() call failed
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
*/
__DLLIMPORT mach_error_t AMDeviceStartService(struct am_device *device, CFStringRef
service_name, int *socket_fd);

/* Stops a session. You should do this before accessing services.
*
* Returns:
* MDERR_OK if successful
* MDERR_INVALID_ARGUMENT if the Lockdown conn has not been established
*/
__DLLIMPORT mach_error_t AMDeviceStopSession(struct am_device *device);

/* Decrements reference counter and, if nothing left, releases resources hold
* by connection, invalidates pointer to device
*/
__DLLIMPORT void AMDeviceRelease(struct am_device *device);

/* Increments reference counter
*/
__DLLIMPORT void AMDeviceRetain(struct am_device *device);

/* Opens an Apple File Connection. You must start the appropriate service
* first with AMDeviceStartService(). In iTunes, io_timeout is 0.
*
* Returns:
* MDERR_OK if successful
* MDERR_AFC_OUT_OF_MEMORY if malloc() failed
*/
__DLLIMPORT afc_error_t AFCConnectionOpen(int socket_fd, unsigned int io_timeout,
struct afc_connection **conn);

/* Pass in a pointer to an afc_dictionary structure. It will be filled. You can
* iterate it using AFCKeyValueRead. When done use AFCKeyValueClose. Possible keys:
* FSFreeBytes - free bytes on system device for afc2, user device for afc
* FSBlockSize - filesystem block size
* FSTotalBytes - size of device
* Model - iPhone1,1 etc.

*/
__DLLIMPORT afc_error_t AFCDeviceInfoOpen(struct afc_connection *conn, struct
afc_dictionary **info);

/* Turns debug mode on if the environment variable AFCDEBUG is set to a numeric
* value, or if the file '/AFCDEBUG' is present and contains a value. */
#if defined(__APPLE__)
void AFCPlatformInit();
#endif

/* Opens a directory on the iPhone. Pass in a pointer in dir to be filled in.
* Note that this normally only accesses the iTunes sandbox/partition as the
* root, which is /var/root/Media. Pathnames are specified with '/' delimiters
* as in Unix style. Use UTF-8 to specify non-ASCII symbols in path.
*
* Returns:
* MDERR_OK if successful
*/
__DLLIMPORT afc_error_t AFCDirectoryOpen(struct afc_connection *conn, char *path, struct
afc_directory **dir);

/* Acquires the next entry in a directory previously opened with
* AFCDirectoryOpen(). When dirent is filled with a NULL value, then the end
* of the directory has been reached. '.' and '..' will be returned as the
* first two entries in each directory except the root; you may want to skip
* over them.
*
* Returns:
* MDERR_OK if successful, even if no entries remain
*/
__DLLIMPORT afc_error_t AFCDirectoryRead(struct afc_connection *conn/*unsigned int unused*/, struct afc_directory *dir,
char **dirent);
__DLLIMPORT afc_error_t AFCDirectoryClose(afc_connection *conn, struct afc_directory *dir);
__DLLIMPORT afc_error_t AFCDirectoryCreate(afc_connection *conn, char *dirname);
__DLLIMPORT afc_error_t AFCRemovePath(afc_connection *conn, char *dirname);
__DLLIMPORT afc_error_t AFCRenamePath(afc_connection *conn, char *oldpath, char *newpath);

/* Creates symbolic or hard link
* linktype - int64: 1 means hard link, 2 - soft (symbolic) link
* target - absolute or relative path to link target
* linkname - absolute path where to create new link
*/
__DLLIMPORT afc_error_t AFCLinkPath(AppleFCHandle conn, long long int linktype, const char *target, const char *linkname);

/* Opens file for reading or writing without locking it in any way. afc_file_ref should not be shared between threads -
* opening file in one thread and closing it in another will lead to possible crash.
* path - UTF-8 encoded absolute path to file
* mode 2 = read, mode 3 = write; unknown = 0
* ref - receives file handle
*/
__DLLIMPORT afc_error_t AFCFileRefOpen(struct afc_connection *conn, char *path, unsigned
long long int mode, afc_file_ref *ref);
/* Reads specified amount (len) of bytes from file into buf. Puts actual count of read bytes into len on return
*/
__DLLIMPORT afc_error_t AFCFileRefRead(struct afc_connection *conn, afc_file_ref ref,
void *buf, unsigned int *len);
/* Writes specified amount (len) of bytes from buf into file.
*/
__DLLIMPORT afc_error_t AFCFileRefWrite(struct afc_connection *conn, afc_file_ref ref,
void *buf, unsigned int len);
/* Moves the file pointer to a specified location.
* offset - Number of bytes from origin (int64)
* origin - 0 = from beginning, 1 = from current position, 2 = from end
*/
__DLLIMPORT afc_error_t AFCFileRefSeek(struct afc_connection *conn, afc_file_ref ref,
unsigned long long offset, int origin, int unused);

/* Gets the current position of a file pointer into offset argument.
*/
__DLLIMPORT afc_error_t AFCFileRefTell(struct afc_connection *conn, afc_file_ref ref,
unsigned long long* offset);

__DLLIMPORT afc_error_t AFCFileRefLock(struct afc_connection *conn, afc_file_ref ref);
__DLLIMPORT afc_error_t AFCFileRefUnlock(struct afc_connection *conn, afc_file_ref ref);
__DLLIMPORT afc_error_t AFCFileRefClose(struct afc_connection *conn, afc_file_ref ref);

/* Opens dictionary describing specified file or directory (iTunes below 8.2 allowed using AFCGetFileInfo
to get the same information)
*/
__DLLIMPORT afc_error_t AFCFileInfoOpen(struct afc_connection *conn, char *path, struct
afc_dictionary **info);

/* Reads next entry from dictionary. When last entry is read, function returns NULL in key argument
Possible keys:
"st_size": val - size in bytes
"st_blocks": val - size in blocks
"st_nlink": val - number of hardlinks
"st_ifmt": val - "S_IFDIR" for folders
"S_IFLNK" for symlinks
"LinkTarget": val - path to symlink target
*/
__DLLIMPORT afc_error_t AFCKeyValueRead(struct afc_dictionary *dict, char **key, char **
val);
/* Closes dictionary
*/
__DLLIMPORT afc_error_t AFCKeyValueClose(struct afc_dictionary *dict);

/* Returns the context field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetContext(struct afc_connection *conn);

/* Returns the fs_block_size field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetFSBlockSize(struct afc_connection *conn);

/* Returns the io_timeout field of the given AFC connection. In iTunes this is
* 0. */
__DLLIMPORT unsigned int AFCConnectionGetIOTimeout(struct afc_connection *conn);

/* Returns the sock_block_size field of the given AFC connection. */
__DLLIMPORT unsigned int AFCConnectionGetSocketBlockSize(struct afc_connection *conn);

/* Closes the given AFC connection. */
__DLLIMPORT afc_error_t AFCConnectionClose(struct afc_connection *conn);

/* Registers for device notifications related to the restore process. unknown0
* is zero when iTunes calls this. In iTunes,
* the callbacks are located at:
* 1: $3ac68e-$3ac6b1, calls $3ac542(unknown1, arg, 0)
* 2: $3ac66a-$3ac68d, calls $3ac542(unknown1, 0, arg)
* 3: $3ac762-$3ac785, calls $3ac6b2(unknown1, arg, 0)
* 4: $3ac73e-$3ac761, calls $3ac6b2(unknown1, 0, arg)
*/
__DLLIMPORT unsigned int AMRestoreRegisterForDeviceNotifications(
am_restore_device_notification_callback dfu_connect_callback,
am_restore_device_notification_callback recovery_connect_callback,
am_restore_device_notification_callback dfu_disconnect_callback,
am_restore_device_notification_callback recovery_disconnect_callback,
unsigned int unknown0,
void *user_info);

/* Causes the restore functions to spit out (unhelpful) progress messages to
* the file specified by the given path. iTunes always calls this right before
* restoring with a path of
* "$HOME/Library/Logs/iPhone Updater Logs/iPhoneUpdater X.log", where X is an
* unused number.
*/
__DLLIMPORT unsigned int AMRestoreEnableFileLogging(char *path);

/* Initializes a new option dictionary to default values. Pass the constant
* kCFAllocatorDefault as the allocator. The option dictionary looks as
* follows:
* {
* NORImageType => 'production',
* AutoBootDelay => 0,
* KernelCacheType => 'Release',
* UpdateBaseband => true,
* DFUFileType => 'RELEASE',
* SystemImageType => 'User',
* CreateFilesystemPartitions => true,
* FlashNOR => true,
* RestoreBootArgs => 'rd=md0 nand-enable-reformat=1 -progress'
* BootImageType => 'User'
* }
*
* Returns:
* the option dictionary if successful
* NULL if out of memory
*/
__DLLIMPORT CFMutableDictionaryRef AMRestoreCreateDefaultOptions(CFAllocatorRef allocator);

/* ----------------------------------------------------------------------------
* Less-documented public routines
* ------------------------------------------------------------------------- */

__DLLIMPORT unsigned int AMRestorePerformRecoveryModeRestore(struct am_recovery_device *
rdev, CFDictionaryRef opts, void *callback, void *user_info);
__DLLIMPORT unsigned int AMRestorePerformRestoreModeRestore(struct am_restore_device *
rdev, CFDictionaryRef opts, void *callback, void *user_info);
__DLLIMPORT struct am_restore_device *AMRestoreModeDeviceCreate(unsigned int unknown0,
unsigned int connection_id, unsigned int unknown1);
__DLLIMPORT unsigned int AMRestoreCreatePathsForBundle(CFStringRef restore_bundle_path,
CFStringRef kernel_cache_type, CFStringRef boot_image_type, unsigned int
unknown0, CFStringRef *firmware_dir_path, CFStringRef *
kernelcache_restore_path, unsigned int unknown1, CFStringRef *
ramdisk_path);
__DLLIMPORT unsigned int AMRestoreModeDeviceReboot(struct am_restore_device *rdev); // Added by JB 30.07.2008
__DLLIMPORT mach_error_t AMDeviceEnterRecovery(struct am_device *device);
__DLLIMPORT mach_error_t AMDeviceDisconnect(struct am_device *device);

/* to use this, start the service "com.apple.mobile.notification_proxy", handle will be the socket to use */
typedef void (*NOTIFY_CALLBACK)(CFSTR notification, USERDATA data);
__DLLIMPORT mach_error_t AMDPostNotification(SOCKET socket, CFStringRef notification, CFStringRef userinfo);
__DLLIMPORT mach_error_t AMDObserveNotification(SOCKET socket, CFSTR notification);
__DLLIMPORT mach_error_t AMDListenForNotifications(SOCKET socket, NOTIFY_CALLBACK cb, USERDATA data);
__DLLIMPORT mach_error_t AMDShutdownNotificationProxy(SOCKET socket);

/*edits by geohot*/
__DLLIMPORT mach_error_t AMDeviceDeactivate(struct am_device *device);
__DLLIMPORT mach_error_t AMDeviceActivate(struct am_device *device, CFDictionaryRef dict);
__DLLIMPORT mach_error_t AMDeviceRemoveValue(struct am_device *device, unsigned int, CFStringRef cfstring);

/* ----------------------------------------------------------------------------
* Semi-private routines
* ------------------------------------------------------------------------- */

/* Pass in a usbmux_listener_1 structure and a usbmux_listener_2 structure
* pointer, which will be filled with the resulting usbmux_listener_2.
*
* Returns:
* MDERR_OK if completed successfully
* MDERR_USBMUX_ARG_NULL if one of the arguments was NULL
* MDERR_USBMUX_FAILED if the listener was not created successfully
*/
__DLLIMPORT usbmux_error_t USBMuxListenerCreate(struct usbmux_listener_1 *esi_fp8, struct
usbmux_listener_2 **eax_fp12);

/* ----------------------------------------------------------------------------
* Less-documented semi-private routines
* ------------------------------------------------------------------------- */
__DLLIMPORT usbmux_error_t USBMuxListenerHandleData(void *);

/* ----------------------------------------------------------------------------
* Private routines - here be dragons
* ------------------------------------------------------------------------- */

/* AMRestorePerformRestoreModeRestore() calls this function with a dictionary
* in order to perform certain special restore operations
* (RESTORED_OPERATION_*). It is thought that this function might enable
* significant access to the phone. */

/*
typedef unsigned int (*t_performOperation)(struct am_restore_device *rdev,
CFDictionaryRef op) __attribute__ ((regparm(2)));
t_performOperation _performOperation = (t_performOperation)0x3c39fa4b;
*/

/* ----------------------------------------------------------------------------
* Less-documented private routines
* ------------------------------------------------------------------------- */

/*
typedef int (*t_socketForPort)(struct am_restore_device *rdev, unsigned int port)
__attribute__ ((regparm(2)));
t_socketForPort _socketForPort = (t_socketForPort)(void *)0x3c39f36c;

typedef void (*t_restored_send_message)(int port, CFDictionaryRef msg);
t_restored_send_message _restored_send_message = (t_restored_send_message)0x3c3a4e40;

typedef CFDictionaryRef (*t_restored_receive_message)(int port);
t_restored_receive_message _restored_receive_message = (t_restored_receive_message)0x3c3a4d40;

typedef unsigned int (*t_sendControlPacket)(struct am_recovery_device *rdev, unsigned
int msg1, unsigned int msg2, unsigned int unknown0, unsigned int *unknown1,
unsigned char *unknown2) __attribute__ ((regparm(3)));
t_sendControlPacket _sendControlPacket = (t_sendControlPacket)0x3c3a3da3;;

typedef unsigned int (*t_sendCommandToDevice)(struct am_recovery_device *rdev,
CFStringRef cmd) __attribute__ ((regparm(2)));
t_sendCommandToDevice _sendCommandToDevice = (t_sendCommandToDevice)0x3c3a3e3b;

typedef unsigned int (*t_AMRUSBInterfaceReadPipe)(unsigned int readwrite_pipe, unsigned
int read_pipe, unsigned char *data, unsigned int *len);
t_AMRUSBInterfaceReadPipe _AMRUSBInterfaceReadPipe = (t_AMRUSBInterfaceReadPipe)0x3c3a27e8;

typedef unsigned int (*t_AMRUSBInterfaceWritePipe)(unsigned int readwrite_pipe, unsigned
int write_pipe, void *data, unsigned int len);
t_AMRUSBInterfaceWritePipe _AMRUSBInterfaceWritePipe = (t_AMRUSBInterfaceWritePipe)0x3c3a27cb;
*/

int performOperation(am_restore_device *rdev, CFMutableDictionaryRef message);
int socketForPort(am_restore_device *rdev, unsigned int portnum);
int sendCommandToDevice(am_recovery_device *rdev, CFStringRef cfs, int block);
int sendFileToDevice(am_recovery_device *rdev, CFStringRef filename);

#ifdef __cplusplus
}
#endif

#endif

/* -*- mode:c; indent-tabs-mode:nil; c-basic-offset:2; tab-width:2; */
</pre>

===AFC Connection===
...

===Locking the Device for Sync===
When iTunes sends a new song to the device, the device shows a "Sync in progress" screen and when complete, the Music app on the device re-reads the iTunesDB file so it picks up the new song.

To get this behaviour, first start the notification service:
<pre>SOCKET socket;
AMDeviceStartService(dev, CFSTR("com.apple.mobile.notification_proxy"), &socket, NULL);</pre>

Now we post a notificaton message to signal that we are going to start a sync:
<pre>AMDPostNotification(socket, CFSTR("com.apple.itunes-mobdev.syncWillStart"), NULL);</pre>

Next we open the itunes lock file:
<pre>afc_file_ref lockref;
AFCFileRefOpen(conn, "/com.apple.itunes.lock_sync", 2, &lockref);</pre>

Now post a notification to say we are going to lock this file, and try and lock it.
If the AFCFileRefLock call fails, pause and repeat.
<pre>AMDPostNotification(socket, CFSTR("com.apple.itunes-mobdev.syncLockRequest"), NULL);
mach_error_t error = AFCFileRefLock(conn, lockref);</pre>

When the file is successfully locked, post another notification, and stop the notification service.
<pre>AMDPostNotification(socket,CFSTR("com.apple.itunes-mobdev.syncDidStart"), NULL);
AMDShutdownNotificationProxy(socket);</pre>

Now the sync can proceed, so copy your files across and make the changes to the iTunesDB.

To release the lock, start the notification system again, unlock and close the lock file, and send a sync finished notification message:

<pre>AFCFileRefUnlock(conn, lockref);
AFCFileRefClose(conn, lockref);
AMDeviceStartService(dev, CFSTR("com.apple.mobile.notification_proxy"), &socket, NULL);
AMDPostNotification(socket, &CFSTR("com.apple.itunes-mobdev.syncDidFinish"), NULL);
AMDShutdownNotificationProxy(socket);</pre>

To handle "Slide to Cancel" and terminate sync when user slides cancel switch, use AMDObserveNotification to subscribe notifications about “com.apple.itunes-client.syncCancelRequest”. Then start listening for notifications (AMDListenForNotifications) until you get “AMDNotificationFaceplant”.
When notification got, you should unlock and close lock file handle (don’t sure if you need to post “syncDidFinish” to proxy, seems it doesn’t matter) and terminate sync gracefully.
The same notification is also got when you unplug your device, so you should always be ready for errors.

NOTE: You may find that starting the notification_proxy service once and once only at the start of your app and using the same socket in calls to AMDPostNotification works better. iTunes opens and closes the notification_proxy regularly, but it appears to be a bit flakey when you open/close it all the time.

===Private Functions===

====How to find address of privates functions in iTunesMobileDevice.dll or MobileDevice.framework ?====
...

===Libraries Implementations===

* [http://code.google.com/p/iphuc/ iPhuc (Command line utility)]
* [http://code.google.com/p/iphucwin32/ iPhuc Win32 (Command line utility)]
* [http://code.google.com/p/manzana/ manzana (.Net Library)]
* [http://code.google.com/p/independence/source/browse/trunk/libPhoneInteraction/ libPhoneInteraction (C Library)]

Jailbreak (S5L8920+)

2009-10-13T09:32:41Z

Redart: /* Firmware 3.1.1/3.1.2 for iPod Touch 3G */

Apple did not have the time to fix the [[0x24000 Segment Overflow]] in the [[S5L8920 (Bootrom)|S5L8920]]. However, in order to flash an exploited [[LLB]] and jailbreak the [[N88ap|iPhone 3GS]], '''one''' of the following needs to be done:
* Find a new [[iBoot]] exploit every time a new firmware is out.
* Find a way to bypass the [[ECID]] checks.
* Find another bootrom exploit that allows unsigned code executing via USB ([[Pwnage 2.0]]-like)

This also applies to the [[N18ap|iPod touch 3G]] and later devices, except a bootrom exploit is needed.

==ECID==
Apple added a new tag to the [[IMG3 File Format]] called ECID. The ECID is ''unique'' to each phone, and is being sigchecked. So Apple could block downgrades once newer firmware becomes available, unless you have a dump of your unique old firmware's IMG3 or signed certificate. Therefore, iBoot exploits won't be so useful for tethered jailbreaks, because such exploits will be closed in new firmwares. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html].

The issue with this is that, even with 24kpwn still in bootrom, an [[iBoot]] exploit is still needed to actually flash the exploited [[LLB]]. If Apple uses this ECID stuff to block downgrades, then a new [[iBoot]] exploit will be needed whenever they fix the last, so that [[24kpwn]] can be applied. This is because Apple could choose to not let you upload an older, exploitable [[iBEC]]/iBoot/[[iBSS]] to the device.

There are methods to help keep your downgrading ability, though.

* If it was cached prior to 3.1's release, 3GS owners can save a file which contains the signature of the 3.0 iBSS containing their [[ECID]], using [http://purplera1n.com/|purplera1n.com].
* Saurik's servers are actively caching the necessary files. [http://www.saurik.com/id/12#howto Instructions] to use the servers are included.
* The [[SHSH]] associated with an ECID can be also saved by running [http://thefirmwareumbrella.blogspot.com/ Umbrella]. An included application, TinyTSS, would allow the user to restore to whatever version is associated with that SHSH file permanently. This is based on the aforementioned service Saurik provides remotely from his server(s). The only difference is that Umbrella and TinyTSS are local applications.

==Jailbreak tools==
===Firmware 3.0 for iPhone 3GS===
There are several possible methods to jailbreak which use the same iBoot exploit discovered independently by [[User:Geohot|Geohot]] and the [[iPhone Dev Team]]:

* [[redsn0w]] 0.8 by the iPhone Dev Team (also works with 3.0.1)
* [[PwnageTool]] 3.0.1 by the iPhone Dev Team
* [[purplera1n]] by Geohot.

===Firmware 3.1 for iPhone 3GS===
Firmware 3.1 can be jailbroken using
* [[PwnageTool]] 3.1.3 (Mac only), provided that the device was previously jailbroken on 3.0/3.0.1.
* [[Blackra1n]] by Geohot

===Firmware 3.1.2 for iPhone 3GS===
Firmware 3.1.2 for iPhone 3GS can be jailbroken using
* [[PwnageTool]] 3.1.4 (Mac only).
* [[Blackra1n]] by Geohot

===Firmware 3.1.1/3.1.2 for iPod Touch 3G===
It is currently possible to jailbreak all devices that ship with 3.1 pre-installed or that have updated to 3.1/3.1.1/3.1.2 using [http://www.blackra1n.com geohot's blackra1n].

NOTE: iPod Touch 3g with Model's starting with MB will jailbreak fully. iPod Touch 3g's with Models starting with MC only get a tethered jailbreak using blackra1n due to a fix of 24kpwn that Apple managed to put in the iPod Touch 3g bootrom.

Jailbreak (S5L8920+)

2009-10-13T09:31:22Z

Redart: New Pwnage is out

Northstar 7D11 (iPhone1,2)

2009-10-12T18:46:09Z

Redart: Keys added

== Decryption Keys ==

=== Root Filesystem ===
* '''VFDecrypt''': a8a886d56011d2d98b190d0a498f6fcac719467047639cd601fd53a4a1d93c24e1b2ddc6

=== AppleLogo (applelogo.s5l8900x.img3) ===
* '''Key''': 1fb738d6c091113d7dfdd89864a718d9
* '''IV''': 677b4c711e3cacb72505feae8e1eae5d

=== KernelCache (kernelcache.release.s5l8900x) ===
* '''Key''': dd03b5b52a53d3582b18a0052ef84038
* '''IV''': 25b7f586d184c329d3d05953a6516a36

=== RecoveryMode (recoverymode.s5l8900x.img3) ===
* '''Key''': 6d7d035c04c60ab2776a5e7c729daf0a
* '''IV''': dbf44c3cc2944b87bdecdbdcd8e42b82

=== Restore Ramdisk (018-6136-014.dmg) ===
* '''Key''': 6a4db11073eb748bad1fabafb066fe13
* '''IV''': 0e128e1f69806afc476b73250908d641

=== iBoot (iBoot.m68ap.RELEASE.img3) ===
* '''Key''': a4039d79cd6d41ce2b755ed566902103
* '''IV''': 13e320617bc655211e2b68042d4508f8

Northstar 7D11 (iPhone1,1)

2009-10-12T18:43:35Z

Redart:

== Decryption Keys ==

=== Root Filesystem ===
* '''VFDecrypt''': fe431a1e436e5298d3c871359768aab43189fd5e7375a2ced3405dd8a223879a4d64a28e

=== AppleLogo (applelogo.s5l8900x.img3) ===
* '''Key''': 1fb738d6c091113d7dfdd89864a718d9
* '''IV''': 677b4c711e3cacb72505feae8e1eae5d

=== KernelCache (kernelcache.release.s5l8900x) ===
* '''Key''': dd03b5b52a53d3582b18a0052ef84038
* '''IV''': 25b7f586d184c329d3d05953a6516a36

=== LLB (LLB.m68ap.RELEASE.img3) ===
* '''Key''': 783970ed70d151e65cdd0f52019f026cbc0ece5c604603117d677b6a85ea4d95
* '''IV''': fc4efef9fd245dc038ecb26f25f795c7

=== RecoveryMode (recoverymode.s5l8900x.img3) ===
* '''Key''': 6d7d035c04c60ab2776a5e7c729daf0a
* '''IV''': dbf44c3cc2944b87bdecdbdcd8e42b82

=== Restore Ramdisk (018-6136-014.dmg) ===
* '''Key''': 6a4db11073eb748bad1fabafb066fe13
* '''IV''': 0e128e1f69806afc476b73250908d641

=== iBoot (iBoot.m68ap.RELEASE.img3) ===
* '''Key''': a0ae133d5de080b4341d3eeb8aff63d4
* '''IV''': db240b5ba6163898bbbc055be2276ea0

Firmware

2009-10-12T18:41:33Z

Redart: /* iPhone 3G */ FW Link

This is the iPhone OS system the iPhone runs. Latest Apple download links can be found [http://www.itunes.com/version here].

==Comparison of firmware versions==

===[[iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="295"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{yes}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| Heavenly 1A543a
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| Heavenly 1C25
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| Heavenly 1C28
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| Snowbird 3A109a
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| Oktoberfest 3B48b
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| Little Bear 4A93
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| Little Bear 4A102
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| Big Bear 5A347
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
| {{yes}}
| 228,768,637
|-
| 2.0.1
| Big Bear 5B108
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| {{yes}}
| 254,048,068
|-
| 2.0.2
| Big Bear 5C1
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| {{yes}}
| 253,589,000
|-
| 2.1
| Sugar Bowl 5F136
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| {{yes}}
| 242,171,241
|-
| 2.2
| Timberline 5G77
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| {{yes}}
| 257,576,980
|-
| 2.2.1
| SUTimberline 5H11
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
|
| {{yes}}
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| {{yes}}
| 252,536,460
|-
| 3.1.2
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code>
|
| {{yes}}
| {{yes}}
| 252,515,888
|}

===[[iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="295"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 2.0
| Big Bear 5A345
| 01.45.00
| No download available
|
| Initial iPhone 3G shipment.
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
|
|-
| 2.0
| Big Bear 5A347
| 01.45.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 235,957,125
|-
| 2.0.1
| Big Bear 5B108
| 01.48.02
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 261,224,227
|-
| 2.0.2
| Big Bear 5C1
| 02.08.01
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 260,761,030
|-
| 2.1
| Sugar Bowl 5F136
| 02.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 249,341,655
|-
| 2.2
| Timberline 5G77
| 02.28.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 258,342,348
|-
| 2.2.1
| SUTimberline 5H11
| 02.30.03
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
| {{yes|Yes (with [[ultrasn0w]])}}
| 241,229,233
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
|
| {{yes}}
| {{yes}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
| {{no|No (Though you can stay at 04.26.08)}}
| 253,361,339
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3G)|Northstar 7D11]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| {{yes}}
| {{no}}
| 253,340,786
|}

===[[iPhone2,1|iPhone 3GS]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="295"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
| {{yes}}
| 312,292,933
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
|
| {{yes}}
| {{yes}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
| Installed on phones produced week 37.
| {{yes}}
| {{no|No (Though you can stay at 04.26.08)}}
| 321,011,474
|-
| 3.1.2
| Northstar 7D11
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code>
|
| {{yes}}
| {{no|No (Though you can stay at 04.26.08)}}
| 321,015,700
|}

===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="295"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 1.1.0
| Snowbird 3A100a
| No download available
|
| Initial shipment.
| {{yes}}
|
|-
| 1.1.0
| Snowbird 3A101a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{yes}}
| 157,890,186
|-
| 1.1.1
| Snowbird 3A110a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| Oktoberfest 3B48b
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| Little Bear 4A93
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| Little Bear 4A102
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| Little Bear 4B1
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| Big Bear 5A347
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| Big Bear 5B108
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| Big Bear 5C1
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| Sugar Bowl 5F137
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| Timberline 5G77
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| SUTimberline 5H11
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| [http://tier.pargon.nl/ipod/iPod1,1_3.0_7A341_Restore.ipsw.html Kirkwood 7A341]
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| [http://tier.pargon.nl/ipod/iPod1,1_3.1.1_7C145_Restore.ipsw.html Northstar 7C145]
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| [http://tier.pargon.nl/ipod/iPod1,1_3.1.2_7D11_Restore.ipsw.html Northstar 7D11]
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| {{yes}}
| 249,780,497
|}

===[[N72ap|iPod touch (2nd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="295"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes}}
| 282,083,944
|-
| 2.2
| Timberline 5G77a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{yes}}
| 291,123,491
|-
| 2.2.1
| SUTimberline 5H11a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
|
| {{yes}}
| 277,753,989
|-
| 3.1.2
| Northstar 7D11
| Download Link Prohibited
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code>
|
| {{yes}}
| 277,794,671
|}

===[[N18AP|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="295"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| style="background:yellow; color:black;" class="table-yes" | Tethered jailbreak via [[blackra1n]]

| 311,702,789
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| style="background:yellow; color:black;" class="table-yes" | Yes, but not yet released
| 311,690,768
|-
| 3.1.2
| Northstar 7D11
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code>
|
| style="background:yellow; color:black;" class="table-yes" | Tethered jailbreak via [[blackra1n]]
| 311,740,034
|}

==See also==
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://pastebin.ca/1209360 A link of interest...]

Northstar 7D11 (iPhone1,1)

2009-10-12T18:40:08Z

Redart: More keys

== Decryption Keys ==

=== Root Filesystem ===
* '''VFDecrypt''': fe431a1e436e5298d3c871359768aab43189fd5e7375a2ced3405dd8a223879a4d64a28e

=== AppleLogo (applelogo.s5l8900x.img3) ===
* '''Key''': 1fb738d6c091113d7dfdd89864a718d9
* '''IV''': 677b4c711e3cacb72505feae8e1eae5d

=== KernelCache (kernelcache.release.s5l8900x) ===
* '''Key''': dd03b5b52a53d3582b18a0052ef84038
* '''IV''': 25b7f586d184c329d3d05953a6516a36

=== KernelCache (kernelcache.release.s5l8900x) ===
* '''Key''': dd03b5b52a53d3582b18a0052ef84038
* '''IV''': 25b7f586d184c329d3d05953a6516a36

=== LLB (LLB.m68ap.RELEASE.img3) ===
* '''Key''': 783970ed70d151e65cdd0f52019f026cbc0ece5c604603117d677b6a85ea4d95
* '''IV''': fc4efef9fd245dc038ecb26f25f795c7

=== RecoveryMode (recoverymode.s5l8900x.img3) ===
* '''Key''': 6d7d035c04c60ab2776a5e7c729daf0a
* '''IV''': dbf44c3cc2944b87bdecdbdcd8e42b82

=== Restore Ramdisk (018-6136-014.dmg) ===
* '''Key''': 6a4db11073eb748bad1fabafb066fe13
* '''IV''': 0e128e1f69806afc476b73250908d641

=== iBoot (iBoot.m68ap.RELEASE.img3) ===
* '''Key''': a0ae133d5de080b4341d3eeb8aff63d4
* '''IV''': db240b5ba6163898bbbc055be2276ea0

Firmware

2009-10-11T13:27:53Z

Redart: /* iPod touch (1st generation) */

This is the iPhone OS system the iPhone runs. Latest Apple download links can be found [http://www.itunes.com/version here].

==Comparison of firmware versions==

===[[iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{yes}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| Heavenly 1A543a
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| Heavenly 1C25
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| Heavenly 1C28
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| Snowbird 3A109a
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| Oktoberfest 3B48b
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| Little Bear 4A93
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| Little Bear 4A102
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| Big Bear 5A347
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
| {{yes}}
| 228,768,637
|-
| 2.0.1
| Big Bear 5B108
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| {{yes}}
| 254,048,068
|-
| 2.0.2
| Big Bear 5C1
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| {{yes}}
| 253,589,000
|-
| 2.1
| Sugar Bowl 5F136
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| {{yes}}
| 242,171,241
|-
| 2.2
| Timberline 5G77
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| {{yes}}
| 257,576,980
|-
| 2.2.1
| SUTimberline 5H11
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
|
| {{yes}}
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| {{yes}}
| 252,536,460
|-
| 3.1.2
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code>
|
| {{yes}}
| {{yes}}
| 252,515,888
|}

===[[iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 2.0
| Big Bear 5A345
| 01.45.00
| No download available
|
| Initial iPhone 3G shipment.
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
|
|-
| 2.0
| Big Bear 5A347
| 01.45.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 235,957,125
|-
| 2.0.1
| Big Bear 5B108
| 01.48.02
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 261,224,227
|-
| 2.0.2
| Big Bear 5C1
| 02.08.01
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 260,761,030
|-
| 2.1
| Sugar Bowl 5F136
| 02.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 249,341,655
|-
| 2.2
| Timberline 5G77
| 02.28.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 258,342,348
|-
| 2.2.1
| SUTimberline 5H11
| 02.30.03
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
| {{yes|Yes (with [[ultrasn0w]])}}
| 241,229,233
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
|
| {{yes}}
| {{yes}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
| {{no|No (Though you can stay at 04.26.08)}}
| 253,361,339
|-
| 3.1.2
| Northstar 7D11
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| {{yes}}
| {{no}}
| 253,340,786
|}

===[[iPhone2,1|iPhone 3GS]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
| {{yes|Yes (with [[ultrasn0w]] or [[purplesn0w]])}}
| 312,292,933
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
|
| {{yes}}
| {{yes}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
| Installed on phones produced week 37.
| {{yes}}, if upgraded from jb 3.0/3.0.1
| {{no|No (Though you can stay at 04.26.08)}}
| 321,011,474
|-
| 3.1.2
| Northstar 7D11
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code>
|
| {{yes|Yes (with [[blackra1n]])}}
| {{no|No (Though you can stay at 04.26.08)}}
| 321,015,700
|}

===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 1.1.0
| Snowbird 3A100a
| No download available
|
| Initial shipment.
| {{yes}}
|
|-
| 1.1.0
| Snowbird 3A101a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{yes}}
| 157,890,186
|-
| 1.1.1
| Snowbird 3A110a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| Oktoberfest 3B48b
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| Little Bear 4A93
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| Little Bear 4A102
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| Little Bear 4B1
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| Big Bear 5A347
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| Big Bear 5B108
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| Big Bear 5C1
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| Sugar Bowl 5F137
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| Timberline 5G77
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| SUTimberline 5H11
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| [http://tier.pargon.nl/ipod/iPod1,1_3.0_7A341_Restore.ipsw.html Kirkwood 7A341]
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| [http://tier.pargon.nl/ipod/iPod1,1_3.1.1_7C145_Restore.ipsw.html Northstar 7C145]
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| [http://tier.pargon.nl/ipod/iPod1,1_3.1.2_7D11_Restore.ipsw.html Northstar 7D11]
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| {{yes}}
| 249,780,497
|}

===[[N72ap|iPod touch (2nd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes}}
| 282,083,944
|-
| 2.2
| Timberline 5G77a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{yes}}
| 291,123,491
|-
| 2.2.1
| SUTimberline 5H11a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
|
| {{yes}}, if upgraded from 3.0
| 277,753,989
|-
| 3.1.2
| Northstar 7D11
| Download Link Prohibited
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code>
|
| {{yes}}
| 277,794,671
|}

===[[N18AP|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| style="background:yellow; color:black;" class="table-yes" | Yes, but not yet released
| 311,702,789
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| style="background:yellow; color:black;" class="table-yes" | Yes, but not yet released
| 311,690,768
|-
| 3.1.2
| Northstar 7D11
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code>
|
| {{yes}}, but only tethered one
| 311,740,034
|}

==See also==
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://pastebin.ca/1209360 A link of interest...]

Firmware

2009-10-11T13:26:17Z

Redart: /* iPhone 3GS */

This is the iPhone OS system the iPhone runs. Latest Apple download links can be found [http://www.itunes.com/version here].

==Comparison of firmware versions==

===[[iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{yes}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| Heavenly 1A543a
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| Heavenly 1C25
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| Heavenly 1C28
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| Snowbird 3A109a
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| Oktoberfest 3B48b
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| Little Bear 4A93
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| Little Bear 4A102
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| Big Bear 5A347
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
| {{yes}}
| 228,768,637
|-
| 2.0.1
| Big Bear 5B108
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| {{yes}}
| 254,048,068
|-
| 2.0.2
| Big Bear 5C1
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| {{yes}}
| 253,589,000
|-
| 2.1
| Sugar Bowl 5F136
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| {{yes}}
| 242,171,241
|-
| 2.2
| Timberline 5G77
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| {{yes}}
| 257,576,980
|-
| 2.2.1
| SUTimberline 5H11
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
|
| {{yes}}
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| {{yes}}
| 252,536,460
|-
| 3.1.2
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code>
|
| {{yes}}
| {{yes}}
| 252,515,888
|}

===[[iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 2.0
| Big Bear 5A345
| 01.45.00
| No download available
|
| Initial iPhone 3G shipment.
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
|
|-
| 2.0
| Big Bear 5A347
| 01.45.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 235,957,125
|-
| 2.0.1
| Big Bear 5B108
| 01.48.02
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 261,224,227
|-
| 2.0.2
| Big Bear 5C1
| 02.08.01
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 260,761,030
|-
| 2.1
| Sugar Bowl 5F136
| 02.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 249,341,655
|-
| 2.2
| Timberline 5G77
| 02.28.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 258,342,348
|-
| 2.2.1
| SUTimberline 5H11
| 02.30.03
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
| {{yes|Yes (with [[ultrasn0w]])}}
| 241,229,233
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
|
| {{yes}}
| {{yes}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
| {{no|No (Though you can stay at 04.26.08)}}
| 253,361,339
|-
| 3.1.2
| Northstar 7D11
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| {{yes}}
| {{no}}
| 253,340,786
|}

===[[iPhone2,1|iPhone 3GS]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
| {{yes|Yes (with [[ultrasn0w]] or [[purplesn0w]])}}
| 312,292,933
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
|
| {{yes}}
| {{yes}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
| Installed on phones produced week 37.
| {{yes}}, if upgraded from jb 3.0/3.0.1
| {{no|No (Though you can stay at 04.26.08)}}
| 321,011,474
|-
| 3.1.2
| Northstar 7D11
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code>
|
| {{yes|Yes (with [[blackra1n]])}}
| {{no|No (Though you can stay at 04.26.08)}}
| 321,015,700
|}

===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 1.1.0
| Snowbird 3A100a
| No download available
|
| Initial shipment.
| {{yes}}
|
|-
| 1.1.0
| Snowbird 3A101a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{yes}}
| 157,890,186
|-
| 1.1.1
| Snowbird 3A110a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| Oktoberfest 3B48b
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| Little Bear 4A93
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| Little Bear 4A102
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| Little Bear 4B1
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| Big Bear 5A347
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| Big Bear 5B108
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| Big Bear 5C1
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| Sugar Bowl 5F137
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| Timberline 5G77
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| SUTimberline 5H11
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| [http://tier.pargon.nl/ipod/iPod1,1_3.0_7A341_Restore.ipsw.html Kirkwood 7A341]
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| [http://tier.pargon.nl/ipod/iPod1,1_3.1.1_7C145_Restore.ipsw.html Northstar 7C145]
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| [http://tier.pargon.nl/ipod/iPod1,1_3.1.2_7D11_Restore.ipsw.html Northstar 7D11]
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| {{yes}}
| Yes, but not yet released
| 249,780,497
|}

===[[N72ap|iPod touch (2nd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes}}
| 282,083,944
|-
| 2.2
| Timberline 5G77a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{yes}}
| 291,123,491
|-
| 2.2.1
| SUTimberline 5H11a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
|
| {{yes}}, if upgraded from 3.0
| 277,753,989
|-
| 3.1.2
| Northstar 7D11
| Download Link Prohibited
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code>
|
| {{yes}}
| 277,794,671
|}

===[[N18AP|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| style="background:yellow; color:black;" class="table-yes" | Yes, but not yet released
| 311,702,789
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| style="background:yellow; color:black;" class="table-yes" | Yes, but not yet released
| 311,690,768
|-
| 3.1.2
| Northstar 7D11
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code>
|
| {{yes}}, but only tethered one
| 311,740,034
|}

==See also==
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://pastebin.ca/1209360 A link of interest...]

Firmware

2009-10-11T13:24:50Z

Redart: /* Comparison of firmware versions */ And other too

This is the iPhone OS system the iPhone runs. Latest Apple download links can be found [http://www.itunes.com/version here].

==Comparison of firmware versions==

===[[iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{yes}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| Heavenly 1A543a
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| Heavenly 1C25
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| Heavenly 1C28
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| Snowbird 3A109a
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| Oktoberfest 3B48b
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| Little Bear 4A93
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| Little Bear 4A102
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| Big Bear 5A347
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
| {{yes}}
| 228,768,637
|-
| 2.0.1
| Big Bear 5B108
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| {{yes}}
| 254,048,068
|-
| 2.0.2
| Big Bear 5C1
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| {{yes}}
| 253,589,000
|-
| 2.1
| Sugar Bowl 5F136
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| {{yes}}
| 242,171,241
|-
| 2.2
| Timberline 5G77
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| {{yes}}
| 257,576,980
|-
| 2.2.1
| SUTimberline 5H11
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
|
| {{yes}}
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| {{yes}}
| 252,536,460
|-
| 3.1.2
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]
| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code>
|
| {{yes}}
| {{yes}}
| 252,515,888
|}

===[[iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 2.0
| Big Bear 5A345
| 01.45.00
| No download available
|
| Initial iPhone 3G shipment.
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
|
|-
| 2.0
| Big Bear 5A347
| 01.45.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 235,957,125
|-
| 2.0.1
| Big Bear 5B108
| 01.48.02
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 261,224,227
|-
| 2.0.2
| Big Bear 5C1
| 02.08.01
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 260,761,030
|-
| 2.1
| Sugar Bowl 5F136
| 02.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 249,341,655
|-
| 2.2
| Timberline 5G77
| 02.28.00
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 258,342,348
|-
| 2.2.1
| SUTimberline 5H11
| 02.30.03
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{yes|Yes (Upgrade to 04.26.08)}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
| {{yes|Yes (with [[ultrasn0w]])}}
| 241,229,233
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
|
| {{yes}}
| {{yes}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
| {{no|No (Though you can stay at 04.26.08)}}
| 253,361,339
|-
| 3.1.2
| Northstar 7D11
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| {{yes}}
| {{no}}
| 253,340,786
|}

===[[iPhone2,1|iPhone 3GS]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="100"| Build
!width="65"| [[Baseband]]
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="80"| Can be [[jailbreak|jailbroken]]?
!width="125"| Can be [[unlock|unlocked]] OTB?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
| {{yes|Yes (with [[ultrasn0w]] or [[purplesn0w]])}}
| 312,292,933
|-
| 3.0.1
| Kirkwood 7A400
| 04.26.08
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
|
| {{yes}}
| {{yes}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
| Installed on phones produced week 37.
| {{yes}}
| {{no|No (Though you can stay at 04.26.08)}}
| 321,011,474
|-
| 3.1.2
| Northstar 7D11
| 05.11.07
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code>
|
| {{yes|Yes (with [[blackra1n]])}}
| {{no|No (Though you can stay at 04.26.08)}}
| 321,015,700
|}

===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 1.1.0
| Snowbird 3A100a
| No download available
|
| Initial shipment.
| {{yes}}
|
|-
| 1.1.0
| Snowbird 3A101a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{yes}}
| 157,890,186
|-
| 1.1.1
| Snowbird 3A110a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| Oktoberfest 3B48b
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| Little Bear 4A93
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| Little Bear 4A102
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| Little Bear 4B1
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| Big Bear 5A347
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| Big Bear 5B108
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| Big Bear 5C1
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| Sugar Bowl 5F137
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| Timberline 5G77
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| SUTimberline 5H11
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| [http://tier.pargon.nl/ipod/iPod1,1_3.0_7A341_Restore.ipsw.html Kirkwood 7A341]
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| [http://tier.pargon.nl/ipod/iPod1,1_3.1.1_7C145_Restore.ipsw.html Northstar 7C145]
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| [http://tier.pargon.nl/ipod/iPod1,1_3.1.2_7D11_Restore.ipsw.html Northstar 7D11]
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| {{yes}}
| Yes, but not yet released
| 249,780,497
|}

===[[N72ap|iPod touch (2nd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes}}
| 282,083,944
|-
| 2.2
| Timberline 5G77a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{yes}}
| 291,123,491
|-
| 2.2.1
| SUTimberline 5H11a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
|
| {{yes}}, if upgraded from 3.0
| 277,753,989
|-
| 3.1.2
| Northstar 7D11
| Download Link Prohibited
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code>
|
| {{yes}}
| 277,794,671
|}

===[[N18AP|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="50"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="235"| SHA1 Hash
!width="150"| Comments
!width="208"| Can be [[jailbreak|jailbroken]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| style="background:yellow; color:black;" class="table-yes" | Yes, but not yet released
| 311,702,789
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| style="background:yellow; color:black;" class="table-yes" | Yes, but not yet released
| 311,690,768
|-
| 3.1.2
| Northstar 7D11
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code>
|
| {{yes}}, but only tethered one
| 311,740,034
|}

==See also==
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://pastebin.ca/1209360 A link of interest...]