The iPhone Wiki - User contributions [en]

PurpleRestore

2015-06-26T02:11:20Z

Rzhikharevich: A question sign looks odd, we need something in this entry.

{{internal software}}
{{Infobox software
| name = PurpleRestore
| title = PurpleRestore
| logo = [[File:PurpleRestore logo.png]]
| screenshot = [[File:PurpleRestore15GC54.png|300px]]
| caption = PurpleRestore 5.0.1 (14GC54)
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release version = 5.0.1 (14GC54) (latest ''known'' version)
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size =
| language = [[wikipedia:English language|English]]
| status =
| genre = Firmware flasher
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}
{{float toc|left}}
'''PurpleRestore''' is a tool made by Apple and is used for flashing [[iDevice]]s. It provides far more customization than [[iTunes]], and it is usually used to flash internal firmware to [[Prototypes|prototypes]]. PurpleRestore 5.0.1 (build 14GC54) is the latest known version which is capable of detecting devices running/flashing the latest restore bundles (Betas/Stock/NonUI/etc.). Little is currently known about which versions it "supports" for restoring as such. PurpleRestore is installed by [[RestoreTools.pkg]]. A CLI version of PurpleRestore exists too.

This tool can (and is meant to) handle multiple restores. When performing restores PurpleRestore color coordinates the device in the table and when the device is about to receive the AppleLogo it will turn the background color of the screen to the color assigned to the device.
Like [[iTunes]], [[PurpleRestore]] communicates with iDevices using a [[usbmux]] connection.

== Restore Bundles==
Unlike iTunes, PurpleRestore doesn't use [[IPSW File Format|IPSW]] files to restore devices. It uses "Restore Bundles" which can be obtained from a server specific to a version of iOS, such as <code>afp://fieldgoal.apple.com/RestoreImages/</code> and <code>afp://endzone.apple.com/OldRestoreImages/</code> (among many others) . Unfortunately, the <code>afp</code> protocol can only be accessed through Apple's internal VPN which means that the tool is essentially useless, because it can only install currently signed iOS.

However, you can create your own bundles by extracting an IPSW into a folder, this only applies to firmwares that are being signed; or if you have SHSH blobs saved for an A4 device (and below) then you can either stitch or use [[TinyUmbrella]] to assist in a downgrade without the need for iTunes, you will need to put your device into Pwned DFU still. This will not give you any internal debugging abilities nor jailbreak your device.

== Restore Components ==
Restore Components has several options:
* '''Restore Bundle''': Specify the bundle to use in restoring
* '''Firmware Directory''': Specify the folder where the [[LLB]], [[iBoot (Bootloader)|iBoot]], etc. [[IMG3 File Format|IMG3]] files are located.
* '''Ramdisk Image''': Specify a [[ramdisk]] to be used (i.e. [[Restore Ramdisk|restore]] or [[Update Ramdisk|update]] ramdisk)
* '''DFU''': Specify what tools to upload based on a selection of "Debug", "Development", or "Release". A specific file can also be selected.

== Restore Operations ==
[[File:IPhoneDuringPurpleRestore.jpeg|250px|thumb|right|iPhone 5 undergoing a PurpleRestore]]
Restore Operations contains the most options to configure. These may also be the most useful ones.

* '''Hardware Readiness'''
** '''Minimum Battery Charge (mV)''': This value controls the minimum charge level at which the restore will be allowed to continue. Below this threshold, we either wait to charge (if we're charging) or fail (if we're not charging). If this option is not specified, a default value is used (currently 3.8 V). Setting this option to 0 bypasses all battery level checks.
** '''Wait for Minimum Charge''': If the current voltage is below the minimum level, then the default behavior is to let the device charge and then continue. This option overrides that behavior when false.
** '''Wait for Storage Device''': Controls whether the restore waits for the storage device /dev/disk0 to be available before the restore is initiated.
** '''Allow Untethered Restore''': Permit the restore to run untethered (not connected to a host). The result of specifying this option when the restore needs data from the host (for instance, when flashing NOR) is undefined (but probably bad). If this option is specified and the device remains tethered, things should proceed as usual.
* '''Storage Media'''
** '''Use LwVM''': Controls whether the device is formatted for LwVM (if supported).
** '''Repartition''': Controls whether a new partition map is created on the device.
** '''System Partition Size (MiB)''': Specifies the size (in mebibytes) that is desired for the system partition. Because the partition size can only be changed when creating a new partition map, this option is only relevant when used in conjunction with repartition. A size of 0 indicates that the restore library should choose a suitable size for you, based on the specific restore bundle and image being used if possible.
** '''Content Protection Type''': Controls the type of data protection used on the device.
** '''Low-Level Erase''': Do a low level erase (wipe with null or random data) of the entire storage device prior to restoring.
* '''Restore System Partition'''
** '''System Image''': Determines which type of system image to restore, or which file to use for the system image.
** '''Kernel Cache Type''': This option controls the kernel cache that gets installed on the device.
* '''Baseband'''
** '''Update Baseband''': Controls whether the [[baseband]] and baseband bootloader are updated as part of the restore.
** '''Force Update''': The baseband update is skipped when the existing firmware matches the available firmware. In some cases, it is desirable to force the firmware update to occur, regardless of what is currently on there. This option, when set to true, forces the update to be attempted.

== Restore OS ==
Restore OS options allow you to specify the following:
* '''Restore Boot-Args''': Boot-Args used when the Restore OS is loaded. By default those arguments are used: "debug=0x14e serial=3 rd=md0 nand-enable-reformat=1 -progress"
* '''Firmware Type:''' Specify the firmware which should be flashed when restoring. This can either be "Debug", "Factory FA", "Factory SA", "Firmware Development" or "Production".
* '''Boot Image Type:''' Can be "Internal", "User or Internal", "User" or "Update".
* '''Boot Kernel Cache:''' Specify whether the "Production" or "Development" kernel cache should be used.

== Personalization Settings ==
As with iTunes, PurpleRestore can personalize builds for iOS devices (since recent Bootroms expect a valid APTicket). The tooltip for the "Personalized Restore" checkbox reads "Your ticket to the Orwellian cloud." This may suggest that Apple developed TSS in part to control access to internal build variants (i.e. prevent leaks of "interesting" builds of iOS), in addition to preventing production users from downgrading.
* '''Variants''': "A predefined combination of restore pieces." The options are: "Customer Install", "Internal Debug", "Internal Development", "Internal Install", "Internal Qualification", and "Vendor install."
* '''AppleConnect''': Used to authenticate all restores for personalization. Interestingly, AppleConnect will allow members of the iOS Developer Program (including non-employees) to install public builds of iOS (latest current and beta). It's likely AppleConnect is also used to authenticate signing of internal builds using the public TSS server, should the device be on the whitelist.

== Restore Settings ==
[[File:PurpleRestoreOptions.png |250px|thumb|right|PurpleRestore configuration screen]]
By default, PurpleRestore comes with two pre-made restore settings. "Erase Install" and "Update Install". Those restore settings are [[PList File Format|plist]] files that define the options PurpleRestore will use when restoring a device.
* '''Erase Install''': Repartition the media and erase all data before restoring. Includes all internal development tools and updates flash and the baseband by default.
* '''Update Install''': Includes all internal development tools and updates flash and the baseband by default.
{{clear}}

== Problems ==
There are some problems with the leaked versions, because they almost always aren't the latest version.

[[File:IBECStuck.png|250px|thumb|right|Stuck on Executing iBEC]]
One problem (common) is getting stuck at "Executing iBEC to bootstrap update". This is likely a signing error, the device may have rejected the iBEC image.

Another problem, when trying from DFU mode, the tool will send the DFU image, then the device will disconnect, reconnect, and repeat the process indefinitely.

== See Also ==
* [[iTunes]]
* [https://www.youtube.com/watch?v=jaZ2JPUv-AU Video of process]
* [https://www.youtube.com/watch?v=IGC2lrYhQjw How-to create restore bundles from a public ipsw]
* [https://www.youtube.com/watch?v=DwipCKbWIlw PurpleRestore restore process]

[[Category:Software]]

LwVM

2015-06-12T14:26:01Z

Rzhikharevich: Same fixes.

'''LwVM''' (Lightweight Volume Manager) - partition table, which is used by iOS since 5.0.

'''com.apple.driver.LightweightVolumeManager''' kext wraps the block device (<code>/dev/disk0</code>) where the actual LwVM partition table is stored and publishes <code>/dev/disk0s1</code> with emulated [[Wikipedia:GUID Partition Table|GPT]] which can be edited from user-land using conventional [[Wikipedia:GUID Partition Table|GPT]] editing tools (e.g. [http://sourceforge.net/projects/gptfdisk/ gptfdisk]) [https://code.google.com/p/iphone-dataprotection/wiki/LightweightVolumeManager]. All edits are trapped by the kext and before shutting down (after the volumes are unmounted) it writes the corresponding changes to LwVM partition table on <code>/dev/disk0</code> (implemented in <code>LightweightVolumeManager::_gptLazyRepartition()</code> function from the LwVM kext). After next boot new devices (e.g. <code>/dev/rdisk0s1s3</code>) are published by the kext. This mechanism is used during [[OTA Updates]] to create third partition where the update ramdisk is copied to and booted into by setting nvram <code>boot-command</code> to <code>upgrade</code> [https://twitter.com/iH8sn0w/status/580016602512539648] and probably also <code>boot-partition</code> to <code>2</code> (partitions are indexed from 0, so third partition).

The update partition is set up by <code>com.apple.MobileSoftwareUpdate.CleanupPreparePathService</code> (XPC service accompanying [[softwareupdated]]). It shrinks HFS of the second (data) partition using <code>fsctl</code> as illustrated in [https://github.com/danzatt/hfs_resize hfs_resize]. It then edits [[Wikipedia:GUID Partition Table|GPT]] on <code>/dev/rdisk0s1s3</code> to reflect the size of shrunk HFS and creates new entry for the update partition in the freed space and creates new HFS on it. To create file-system manually you can use e.g.: <code>newfs_hfs -s -b 8192 -J 8192k -v Data2 /dev/rdisk0s1s4</code>.

== Structure ==
<pre>
typedef struct _LwVMPartitionRecord {
uint64_t type[2]; //Should be equal to LwVMPartitionTypeHFS (see below) on an unmodified device.
uint64_t guid[2]; //Random.
uint64_t begin; //Partitions begin in bytes.
uint64_t end; //End.
uint64_t attribute; // 0 == unencrypted; 0x1000000000000 == encrypted
uint16_t partitionName[0x24]; // UTF-16 encoded
} __attribute__ ((packed)) LwVMPartitionRecord;

typedef struct _LwVM {
uint64_t type[2]; //Should be LwVMType or LwVMType_noCRC.
uint64_t guid[2]; //Random.
uint64_t mediaSize; //Size in bytes.
uint32_t numPartitions; //Number of partitions.
uint32_t crc32;
uint8_t unkn[464]; //Some unknown bytes, usually nulls.
LwVMPartitionRecord partitions[12];
uint16_t chunks[1024]; // chunks[0] should be 0xF000
} __attribute__ ((packed)) LwVM;

static const char LwVMType[] = { 0x6A, 0x90, 0x88, 0xCF, 0x8A, 0xFD, 0x63, 0x0A, 0xE3, 0x51, 0xE2, 0x48, 0x87, 0xE0, 0xB9, 0x8B };

static const char LwVMType_noCRC[] = { 0xB1, 0x89, 0xA5, 0x19, 0x4F, 0x59, 0x4B, 0x1D, 0xAD, 0x44, 0x1E, 0x12, 0x7A, 0xAF, 0x45, 0x39 };

static const char LwVMPartitionTypeHFS[] = { 0x48, 0x46, 0x53, 0x00, 0x00, 0x00, 0x11, 0xAA, 0xAA, 0x11, 0x00, 0x30, 0x65, 0x43, 0xEC, 0xAC };
</pre>

== LightweightVolumeManager IOService ==
Running 'ioreg | grep "Lightweight"' shows, that there's an IOService with such name. [[User:rzhikharevich|I]] tried fuzzing IOConnectCallStructMethod selectors (very bad idea). The first call which returned KERN_SUCCESS was done with selector 1. Next, I tried this code:
<pre>
<...>
kern_ret = IOConnectCallStructMethod(lwvm_conn, 1, NULL, 0, &info_sz, &o_sz);
if (kern_ret == KERN_SUCCESS)
{
printf("OK.\n");
void *info = malloc(info_sz);
IOConnectCallStructMethod(lwvm_conn, 1, NULL, 0, info, &info_sz);
<...>
</pre>
All disk read operations started resulting with errors. Then my device rebooted and entered a boot loop. The code possibly messed the partition table up.

== Tools ==
[http://www.github.com/rzhikharevich/lwvmedit lwvmedit]

== External links ==
[https://code.google.com/p/iphone-dataprotection/wiki/LightweightVolumeManager iPhone dataprotection wiki]

LwVM

2015-06-12T14:24:09Z

Rzhikharevich: Minor fix: GTP -> GPT

'''LwVM''' (Lightweight Volume Manager) - partition table, which is used by iOS since 5.0.

'''com.apple.driver.LightweightVolumeManager''' kext wraps the block device (<code>/dev/disk0</code>) where the actual LwVM partition table is stored and publishes <code>/dev/disk0s1</code> with emulated [[Wikipedia:GUID Partition Table|GPT]] which can be edited from user-land using conventional [[Wikipedia:GUID Partition Table|GTP]] editing tools (e.g. [http://sourceforge.net/projects/gptfdisk/ gptfdisk]) [https://code.google.com/p/iphone-dataprotection/wiki/LightweightVolumeManager]. All edits are trapped by the kext and before shutting down (after the volumes are unmounted) it writes the corresponding changes to LwVM partition table on <code>/dev/disk0</code> (implemented in <code>LightweightVolumeManager::_gptLazyRepartition()</code> function from the LwVM kext). After next boot new devices (e.g. <code>/dev/rdisk0s1s3</code>) are published by the kext. This mechanism is used during [[OTA Updates]] to create third partition where the update ramdisk is copied to and booted into by setting nvram <code>boot-command</code> to <code>upgrade</code> [https://twitter.com/iH8sn0w/status/580016602512539648] and probably also <code>boot-partition</code> to <code>2</code> (partitions are indexed from 0, so third partition).

The update partition is set up by <code>com.apple.MobileSoftwareUpdate.CleanupPreparePathService</code> (XPC service accompanying [[softwareupdated]]). It shrinks HFS of the second (data) partition using <code>fsctl</code> as illustrated in [https://github.com/danzatt/hfs_resize hfs_resize]. It then edits [[Wikipedia:GUID Partition Table|GTP]] on <code>/dev/rdisk0s1s3</code> to reflect the size of shrunk HFS and creates new entry for the update partition in the freed space and creates new HFS on it. To create file-system manually you can use e.g.: <code>newfs_hfs -s -b 8192 -J 8192k -v Data2 /dev/rdisk0s1s4</code>.

== Structure ==
<pre>
typedef struct _LwVMPartitionRecord {
uint64_t type[2]; //Should be equal to LwVMPartitionTypeHFS (see below) on an unmodified device.
uint64_t guid[2]; //Random.
uint64_t begin; //Partitions begin in bytes.
uint64_t end; //End.
uint64_t attribute; // 0 == unencrypted; 0x1000000000000 == encrypted
uint16_t partitionName[0x24]; // UTF-16 encoded
} __attribute__ ((packed)) LwVMPartitionRecord;

typedef struct _LwVM {
uint64_t type[2]; //Should be LwVMType or LwVMType_noCRC.
uint64_t guid[2]; //Random.
uint64_t mediaSize; //Size in bytes.
uint32_t numPartitions; //Number of partitions.
uint32_t crc32;
uint8_t unkn[464]; //Some unknown bytes, usually nulls.
LwVMPartitionRecord partitions[12];
uint16_t chunks[1024]; // chunks[0] should be 0xF000
} __attribute__ ((packed)) LwVM;

static const char LwVMType[] = { 0x6A, 0x90, 0x88, 0xCF, 0x8A, 0xFD, 0x63, 0x0A, 0xE3, 0x51, 0xE2, 0x48, 0x87, 0xE0, 0xB9, 0x8B };

static const char LwVMType_noCRC[] = { 0xB1, 0x89, 0xA5, 0x19, 0x4F, 0x59, 0x4B, 0x1D, 0xAD, 0x44, 0x1E, 0x12, 0x7A, 0xAF, 0x45, 0x39 };

static const char LwVMPartitionTypeHFS[] = { 0x48, 0x46, 0x53, 0x00, 0x00, 0x00, 0x11, 0xAA, 0xAA, 0x11, 0x00, 0x30, 0x65, 0x43, 0xEC, 0xAC };
</pre>

== LightweightVolumeManager IOService ==
Running 'ioreg | grep "Lightweight"' shows, that there's an IOService with such name. [[User:rzhikharevich|I]] tried fuzzing IOConnectCallStructMethod selectors (very bad idea). The first call which returned KERN_SUCCESS was done with selector 1. Next, I tried this code:
<pre>
<...>
kern_ret = IOConnectCallStructMethod(lwvm_conn, 1, NULL, 0, &info_sz, &o_sz);
if (kern_ret == KERN_SUCCESS)
{
printf("OK.\n");
void *info = malloc(info_sz);
IOConnectCallStructMethod(lwvm_conn, 1, NULL, 0, info, &info_sz);
<...>
</pre>
All disk read operations started resulting with errors. Then my device rebooted and entered a boot loop. The code possibly messed the partition table up.

== Tools ==
[http://www.github.com/rzhikharevich/lwvmedit lwvmedit]

== External links ==
[https://code.google.com/p/iphone-dataprotection/wiki/LightweightVolumeManager iPhone dataprotection wiki]

User:Rzhikharevich

2015-06-02T17:02:19Z

Rzhikharevich: I don't want to always update the information everywhere, just linking my blog.

Just an iPhone user and programmer. More [https://rzhikharevich.github.io here].

PS. Not a native english-speaker.

User:Dankzegriefer

2015-05-23T13:33:05Z

Rzhikharevich: Proper markup.

Hello!
I am a guy who likes most mobile devices

== Devices ==

*HTC HD2 (Dualboot between Android 2.3 and CM7)
*SAMSUNG Galaxy S3 (CM11)
*iPhone 3G (Bricked, Power button broken, can't enter DFU, never boots, may try to fix button)
*iPhone 2G (Water in screen, trying to get someone to pump it out)
*iPhone 4 (Lost, Unjailbroken)
*iPod Touch 4 (iOS 6.1.6, Jailbroken with P0sixspwn)
*iPad (Brother dropped on pavement, screen fatally cracked)

S5L8930

2015-05-20T15:49:27Z

Rzhikharevich:

[[Image:A4.jpg|right]]
A [[wikipedia:system on a chip|system on a chip]] ("SoC") developed by Apple's in-house chip design department. Publicly, Apple refers to this chip as the '''A4'''. Internally, this processor is also based on the S5L8920X family, which can also be seen through the reuse of several MMIO devices and MMIO device registers (i.e: chipid). This is the last SoC revision on mobile devices manufactured for Apple that has a publicly known exploitable [[bootrom]] vulnerability.

== Used in ==
* [[K66ap|Apple TV 2G]]
* [[K48ap|iPad]]
* [[iPhone 4]]
* [[n81ap|iPod touch 4G]]

== [[BootROM]] Exploits ==
* [[Limera1n Exploit|limera1n]]
* [[SHA-1 Image Segment Overflow|SHAtter]]

== Boot Chain ==
[[Bootrom 574.4|Bootrom]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[Firmware|System Software]]

== Specifications ==
* '''CPU''': ARM Cortex-A8
* '''GPU''': PowerVR SGX 535
* '''A/V Playback''': PowerVR VXD
* '''RAM''': 256 MB ([[K66ap|Apple TV 2G]], [[K48ap|iPad]], and [[N81ap|iPod touch 4G]]) or 512 MB ([[iPhone 4]])

[[Category:Application Processors]]
Aside from the [[iPhone 4]]'s additional RAM and an overall higher clock speed, these are the same specifications as the [[S5L8920]] and [[S5L8922]].

== See also ==
* [[Bootrom 574.4]]

== Links ==
* http://www.apple.com/ipad/specs/
* http://www.brightsideofnews.com/news/2010/1/27/apple-a4-soc-unveiled---its-an-arm-cpu-and-the-gpu!.aspx

BootROM

2015-05-20T15:49:20Z

Rzhikharevich: Redirected page to Bootrom

#REDIRECT [[Bootrom]]

/private/var/mobile/Library/Safari

2015-05-20T15:46:32Z

Rzhikharevich: Title fix.

== Children ==
=== Files ===
* {{ipfw|Bookmarks.db}}
* {{ipfw|Bookmarks.db-shm}}
* {{ipfw|Bookmarks.db-wal}}
* {{ipfw|com.apple.Bookmarks.lock}}
* {{ipfw|SearchEngines.plist}}

== Parents ==
{{parent|private|var|mobile|Library}}

Xcode

2015-05-20T15:24:07Z

Rzhikharevich: Grammar.

{{Infobox software
| name = Xcode
| title = Xcode
| logo = [[File:Xcode.png|118px]]
| screenshot =
| caption =
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release version = 6.3.2 (6D2105)
| latest release date = {{Start date and age|2015|5|18|df=yes}}
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size = ~2.57 GB [APP]
| language = [[wikipedia:English language|English]]
| status =
| genre =
| license = [[wikipedia:Proprietary software|Closed source]]
| website = [http://developer.apple.com developer.apple.com]
}}
'''Xcode''' is an OS X application made by Apple, available on the Mac App Store for free. It is used to create OS X and [[iOS]] apps. It includes one or more SDKs to be able to test created applications on a built-in simulator.

{{stub|software}}

User:Rzhikharevich

2015-04-27T18:52:59Z

Rzhikharevich: /* Projects */

Just an iPhone user and programmer, a [http://uncyclopedia.wikia.com/wiki/Grammar_Nazi grammar nazi] (with russian language). 13 years old, started being interested in computer science at the age of 11.
PS. Not a native english-speaker.

== Projects ==
Here's the list of my iOS-related projects:
*[https://github.com/rzhikharevich/lwvmedit lwvmedit] - first useful (?) tool for iOS, it can read and edit LwVM tables.
*iolwvm - an IOKit version of lwvmedit. I am working on reversing, how userspace communicates with the kernel to modify the partitions.
*libipwn - a library for interfacing with iDevices in DFU mode. Not public yet.
Other projects:
*eXtremeStep software project. Working on a kernel, I don't think, I'll ever finish that.

== Knowledge ==
I know a lot about the iOS (at least relatively). I am also an experienced Unix/Linux user.

Programming languages:
*C/C++
*Python
*x86 assembly.
Web design skills:
*HTML5
*CSS3
*Javascript.

== Links ==
*[http://rzhikharevich.github.io My blog], under construction.
*[http://github.com/rzhikharevich Github account]
*[http://twitter.com/rzhikharevich Twitter]

== iDevices ==
*White iPad 3, 64GB, iOS 8.3.
*iPhone 4, 16GB, iOS 7.1.2, jailbroken.
*The original iPhone (2G), Debian ARM via OpeniBoot
*Black iPhone 5, 32GB, iOS 8.3 (primary).
*Apple TV 3rd gen.

== Operating systems ==
In current use:
*OS X Yosemite.
*Gentoo (hardened, x86_64, nomultilib) with Openbox and LXPanel.
*iOS.
Used:
*Windows XP/7/8/10
*Different Linux distributions (Gentoo is my favorite)

User:Rzhikharevich

2015-04-27T10:19:06Z

Rzhikharevich: /* Operating systems */ It's back!

Just an iPhone user and programmer, a [http://uncyclopedia.wikia.com/wiki/Grammar_Nazi grammar nazi] (with russian language). 13 years old, started being interested in computer science at the age of 11.
PS. Not a native english-speaker.

== Projects ==
Here's the list of my iOS-related projects:
*[https://github.com/rzhikharevich/lwvmedit lwvmedit] - first useful (?) tool for iOS, it can read and edit LwVM tables.
*iolwvm - an IOKit version of lwvmedit. I am working on reversing, how userspace communicates with the kernel to modify the partitions.
*libipwn - a library for interfacing with iDevices in DFU mode. Not public yet.
Other projects:
*[http://github.com/rzhikharevich/NyanOS NyanOS] & [http://github.com/rzhikharevich/XNC XNC programming language].

== Knowledge ==
I know a lot about the iOS (at least relatively). I am also an experienced Unix/Linux user.

Programming languages:
*C/C++
*Python
*x86 assembly.
Web design skills:
*HTML5
*CSS3
*Javascript.

== Links ==
*[http://rzhikharevich.github.io My blog], under construction.
*[http://github.com/rzhikharevich Github account]
*[http://twitter.com/rzhikharevich Twitter]

== iDevices ==
*White iPad 3, 64GB, iOS 8.3.
*iPhone 4, 16GB, iOS 7.1.2, jailbroken.
*The original iPhone (2G), Debian ARM via OpeniBoot
*Black iPhone 5, 32GB, iOS 8.3 (primary).
*Apple TV 3rd gen.

== Operating systems ==
In current use:
*OS X Yosemite.
*Gentoo (hardened, x86_64, nomultilib) with Openbox and LXPanel.
*iOS.
Used:
*Windows XP/7/8/10
*Different Linux distributions (Gentoo is my favorite)

Talk:Watch OS

2015-04-24T07:21:51Z

Rzhikharevich:

Any news about Apple Watch hacking? I don't have one, but I'm interested, if its interfaces are stripped down like in Apple TV. --[[User:Rzhikharevich|Rzhikharevich]] ([[User talk:Rzhikharevich|talk]]) 07:19, 24 April 2015 (UTC), edited: --[[User:Rzhikharevich|Rzhikharevich]] ([[User talk:Rzhikharevich|talk]]) 07:21, 24 April 2015 (UTC)

Talk:Watch OS

2015-04-24T07:19:40Z

Rzhikharevich: Created page with "Any news about Apple Watch hacking? --~~~~"

Any news about Apple Watch hacking? --[[User:Rzhikharevich|Rzhikharevich]] ([[User talk:Rzhikharevich|talk]]) 07:19, 24 April 2015 (UTC)

File:PairWatch.jpg

2015-04-22T16:48:24Z

Rzhikharevich: Rzhikharevich uploaded a new version of "File:PairWatch.jpg"

User:Rzhikharevich

2015-04-14T08:26:38Z

Rzhikharevich: /* iDevices */

Just an iPhone user and programmer, a [http://uncyclopedia.wikia.com/wiki/Grammar_Nazi grammar nazi] (with russian language). 13 years old, started being interested in computer science at the age of 11.
PS. Not a native english-speaker.

== Projects ==
Here's the list of my iOS-related projects:
*[https://github.com/rzhikharevich/lwvmedit lwvmedit] - first useful (?) tool for iOS, it can read and edit LwVM tables.
*iolwvm - an IOKit version of lwvmedit. I am working on reversing, how userspace communicates with the kernel to modify the partitions.
*libipwn - a library for interfacing with iDevices in DFU mode. Not public yet.
Other projects:
*[http://github.com/rzhikharevich/NyanOS NyanOS] & [http://github.com/rzhikharevich/XNC XNC programming language].

== Knowledge ==
I know a lot about the iOS (at least relatively). I am also an experienced Unix/Linux user.

Programming languages:
*C/C++
*Python
*x86 assembly.
Web design skills:
*HTML5
*CSS3
*Javascript.

== Links ==
*[http://rzhikharevich.github.io My blog], under construction.
*[http://github.com/rzhikharevich Github account]
*[http://twitter.com/rzhikharevich Twitter]

== iDevices ==
*White iPad 3, 64GB, iOS 8.3.
*iPhone 4, 16GB, iOS 7.1.2, jailbroken.
*The original iPhone (2G), Debian ARM via OpeniBoot
*Black iPhone 5, 32GB, iOS 8.3 (primary).
*Apple TV 3rd gen.

== Operating systems ==
In current use:
*OS X Yosemite.
*iOS.
Used:
*Windows XP/7/8/10
*Different Linux distributions (Gentoo is my favorite)

PurpleRestore

2015-04-13T06:34:42Z

Rzhikharevich: That section is pointless.

{{internal software}}
{{Infobox software
| name = PurpleRestore
| title = PurpleRestore
| logo = [[File:PurpleRestore logo.png]]
| screenshot = [[File:PurpleRestore12A365.png|300px]]
| caption = PurpleRestore 4.0.0 (12A365)
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release version = 4.0.0 (12A365) (latest ''known'' version)
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size =
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}
{{float toc|left}}
'''PurpleRestore''' is a tool made by Apple and is used for flashing [[iDevice]]s. It provides far more customization than [[iTunes]], and it is usually used to flash internal firmware to [[Prototypes|prototypes]]. PurpleRestore 4.0.0 (build 12A365) is the latest known version which is capable of detecting devices running/flashing the latest restore bundles (Betas/Stock/NonUI/etc.). Little is currently known about which versions it "supports" for restoring as such. PurpleRestore is installed by [[RestoreTools.pkg]]. A CLI version of PurpleRestore exists too.

This tool can (and is meant to) handle multiple restores. When performing restores PurpleRestore color coordinates the device in the table and when the device is about to receive the AppleLogo it will turn the background color of the screen to the color assigned to the device.
Like [[iTunes]], [[PurpleRestore]] communicates with iDevices using a [[usbmux]] connection.

== Restore Bundles==
Unlike iTunes, PurpleRestore doesn't use [[IPSW File Format|IPSW]] files to restore devices. It uses "Restore Bundles" which can be obtained from a server specific to a version of iOS, such as <code>afp://fieldgoal.apple.com/RestoreImages/</code> and <code>afp://endzone.apple.com/OldRestoreImages/</code> (among many others) . Unfortunately, the <code>afp</code> protocol can only be accessed through Apple's internal VPN which means that the tool is essentially useless, because it can only install currently signed iOS.

However, you can create your own bundles by extracting an IPSW into a folder, this only applies to firmwares that are being signed; or if you have SHSH blobs saved for an A4 device (and below) then you can either stitch or use [[TinyUmbrella]] to assist in a downgrade without the need for iTunes, you will need to put your device into Pwned DFU still. This will not give you any internal debugging abilities nor jailbreak your device.

== Restore Components ==
Restore Components has several options:
* '''Restore Bundle''': Specify the bundle to use in restoring
* '''Firmware Directory''': Specify the folder where the [[LLB]], [[iBoot (Bootloader)|iBoot]], etc. [[IMG3 File Format|IMG3]] files are located.
* '''Ramdisk Image''': Specify a [[ramdisk]] to be used (i.e. [[Restore Ramdisk|restore]] or [[Update Ramdisk|update]] ramdisk)
* '''DFU''': Specify what tools to upload based on a selection of "Debug", "Development", or "Release". A specific file can also be selected.

== Restore Operations ==
[[File:IPhoneDuringPurpleRestore.jpeg|250px|thumb|right|iPhone 5 undergoing a PurpleRestore]]
Restore Operations contains the most options to configure. These may also be the most useful ones.

* '''Hardware Readiness'''
** '''Minimum Battery Charge (mV)''': This value controls the minimum charge level at which the restore will be allowed to continue. Below this threshold, we either wait to charge (if we're charging) or fail (if we're not charging). If this option is not specified, a default value is used (currently 3.8 V). Setting this option to 0 bypasses all battery level checks.
** '''Wait for Minimum Charge''': If the current voltage is below the minimum level, then the default behavior is to let the device charge and then continue. This option overrides that behavior when false.
** '''Wait for Storage Device''': Controls whether the restore waits for the storage device /dev/disk0 to be available before the restore is initiated.
** '''Allow Untethered Restore''': Permit the restore to run untethered (not connected to a host). The result of specifying this option when the restore needs data from the host (for instance, when flashing NOR) is undefined (but probably bad). If this option is specified and the device remains tethered, things should proceed as usual.
* '''Storage Media'''
** '''Use LwVM''': Controls whether the device is formatted for LwVM (if supported).
** '''Repartition''': Controls whether a new partition map is created on the device.
** '''System Partition Size (MiB)''': Specifies the size (in mebibytes) that is desired for the system partition. Because the partition size can only be changed when creating a new partition map, this option is only relevant when used in conjunction with repartition. A size of 0 indicates that the restore library should choose a suitable size for you, based on the specific restore bundle and image being used if possible.
** '''Content Protection Type''': Controls the type of data protection used on the device.
** '''Low-Level Erase''': Do a low level erase (wipe with null or random data) of the entire storage device prior to restoring.
* '''Restore System Partition'''
** '''System Image''': Determines which type of system image to restore, or which file to use for the system image.
** '''Kernel Cache Type''': This option controls the kernel cache that gets installed on the device.
* '''Baseband'''
** '''Update Baseband''': Controls whether the [[baseband]] and baseband bootloader are updated as part of the restore.
** '''Force Update''': The baseband update is skipped when the existing firmware matches the available firmware. In some cases, it is desirable to force the firmware update to occur, regardless of what is currently on there. This option, when set to true, forces the update to be attempted.

== Restore OS ==
Restore OS options allow you to specify the following:
* '''Restore Boot-Args''': Boot-Args used when the Restore OS is loaded. By default those arguments are used: "debug=0x14e serial=3 rd=md0 nand-enable-reformat=1 -progress"
* '''Firmware Type:''' Specify the firmware which should be flashed when restoring. This can either be "Debug", "Factory FA", "Factory SA", "Firmware Development" or "Production".
* '''Boot Image Type:''' Can be "Internal", "User or Internal", "User" or "Update".
* '''Boot Kernel Cache:''' Specify whether the "Production" or "Development" kernel cache should be used.

== Personalization Settings ==
As with iTunes, PurpleRestore can personalize builds for iOS devices (since recent Bootroms expect a valid APTicket). The tooltip for the "Personalized Restore" checkbox reads "Your ticket to the Orwellian cloud." This may suggest that Apple developed TSS in part to control access to internal build variants (i.e. prevent leaks of "interesting" builds of iOS), in addition to preventing production users from downgrading.
* '''Variants''': "A predefined combination of restore pieces." The options are: "Customer Install", "Internal Debug", "Internal Development", "Internal Install", "Internal Qualification", and "Vendor install."
* '''AppleConnect''': Used to authenticate all restores for personalization. Interestingly, AppleConnect will allow members of the iOS Developer Program (including non-employees) to install public builds of iOS (latest current and beta). It's likely AppleConnect is also used to authenticate signing of internal builds using the public TSS server, should the device be on the whitelist.

== Restore Settings ==
[[File:PurpleRestoreOptions.png |250px|thumb|right|PurpleRestore configuration screen]]
By default, PurpleRestore comes with two pre-made restore settings. "Erase Install" and "Update Install". Those restore settings are [[PList File Format|plist]] files that define the options PurpleRestore will use when restoring a device.
* '''Erase Install''': Repartition the media and erase all data before restoring. Includes all internal development tools and updates flash and the baseband by default.
* '''Update Install''': Includes all internal development tools and updates flash and the baseband by default.
{{clear}}

== Problems ==
There are some problems with the leaked versions, because they almost always aren't the latest version.

[[File:IBECStuck.png|250px|thumb|right|Stuck on Executing iBEC]]
One problem (common) is getting stuck at "Executing iBEC to bootstrap update". This is likely a signing error, the device may have rejected the iBEC image.

Another problem, when trying from DFU mode, the tool will send the DFU image, then the device will disconnect, reconnect, and repeat the process indefinitely.

== See Also ==
* [[iTunes]]
* [https://www.youtube.com/watch?v=jaZ2JPUv-AU Video of process]
* [https://www.youtube.com/watch?v=IGC2lrYhQjw How-to create restore bundles from a public ipsw]
* [https://www.youtube.com/watch?v=DwipCKbWIlw PurpleRestore restore process]

[[Category:Software]]

PurpleRestore

2015-04-13T01:27:55Z

Rzhikharevich: /* Problems */ Fixed double "is".

{{internal software}}
{{Infobox software
| name = PurpleRestore
| title = PurpleRestore
| logo = [[File:PurpleRestore logo.png]]
| screenshot = [[File:PurpleRestore12A365.png|300px]]
| caption = PurpleRestore 4.0.0 (12A365)
| collapsible =
| author = Apple Inc.
| developer = Apple Inc.
| released =
| discontinued =
| latest release version = 4.0.0 (12A365) (latest ''known'' version)
| latest release date =
| latest preview version =
| latest preview date =
| programming language =
| operating system = [[wikipedia:OS X|OS X]]
| platform =
| size =
| language = [[wikipedia:English language|English]]
| status =
| genre = ?
| license = [[wikipedia:Proprietary software|Closed source]]
| website =
}}
{{float toc|left}}
'''PurpleRestore''' is a tool made by Apple and is used for flashing [[iDevice]]s. It provides far more customization than [[iTunes]], and it is usually used to flash internal firmware to [[Prototypes|prototypes]]. PurpleRestore 4.0.0 (build 12A365) is the latest known version which is capable of detecting devices running/flashing the latest restore bundles (Betas/Stock/NonUI/etc.). Little is currently known about which versions it "supports" for restoring as such. PurpleRestore is installed by [[RestoreTools.pkg]]. A CLI version of PurpleRestore exists too.

This tool can (and is meant to) handle multiple restores. When performing restores PurpleRestore color coordinates the device in the table and when the device is about to receive the AppleLogo it will turn the background color of the screen to the color assigned to the device.
Like [[iTunes]], [[PurpleRestore]] communicates with iDevices using a [[usbmux]] connection.

== Restore Bundles==
Unlike iTunes, PurpleRestore doesn't use [[IPSW File Format|IPSW]] files to restore devices. It uses "Restore Bundles" which can be obtained from a server specific to a version of iOS, such as <code>afp://fieldgoal.apple.com/RestoreImages/</code> and <code>afp://endzone.apple.com/OldRestoreImages/</code> (among many others) . Unfortunately, the <code>afp</code> protocol can only be accessed through Apple's internal VPN which means that the tool is essentially useless, because it can only install currently signed iOS.

However, you can create your own bundles by extracting an IPSW into a folder, this only applies to firmwares that are being signed; or if you have SHSH blobs saved for an A4 device (and below) then you can either stitch or use [[TinyUmbrella]] to assist in a downgrade without the need for iTunes, you will need to put your device into Pwned DFU still. This will not give you any internal debugging abilities nor jailbreak your device.

== Restore Components ==
Restore Components has several options:
* '''Restore Bundle''': Specify the bundle to use in restoring
* '''Firmware Directory''': Specify the folder where the [[LLB]], [[iBoot (Bootloader)|iBoot]], etc. [[IMG3 File Format|IMG3]] files are located.
* '''Ramdisk Image''': Specify a [[ramdisk]] to be used (i.e. [[Restore Ramdisk|restore]] or [[Update Ramdisk|update]] ramdisk)
* '''DFU''': Specify what tools to upload based on a selection of "Debug", "Development", or "Release". A specific file can also be selected.

== Restore Operations ==
[[File:IPhoneDuringPurpleRestore.jpeg|250px|thumb|right|iPhone 5 undergoing a PurpleRestore]]
Restore Operations contains the most options to configure. These may also be the most useful ones.

* '''Hardware Readiness'''
** '''Minimum Battery Charge (mV)''': This value controls the minimum charge level at which the restore will be allowed to continue. Below this threshold, we either wait to charge (if we're charging) or fail (if we're not charging). If this option is not specified, a default value is used (currently 3.8 V). Setting this option to 0 bypasses all battery level checks.
** '''Wait for Minimum Charge''': If the current voltage is below the minimum level, then the default behavior is to let the device charge and then continue. This option overrides that behavior when false.
** '''Wait for Storage Device''': Controls whether the restore waits for the storage device /dev/disk0 to be available before the restore is initiated.
** '''Allow Untethered Restore''': Permit the restore to run untethered (not connected to a host). The result of specifying this option when the restore needs data from the host (for instance, when flashing NOR) is undefined (but probably bad). If this option is specified and the device remains tethered, things should proceed as usual.
* '''Storage Media'''
** '''Use LwVM''': Controls whether the device is formatted for LwVM (if supported).
** '''Repartition''': Controls whether a new partition map is created on the device.
** '''System Partition Size (MiB)''': Specifies the size (in mebibytes) that is desired for the system partition. Because the partition size can only be changed when creating a new partition map, this option is only relevant when used in conjunction with repartition. A size of 0 indicates that the restore library should choose a suitable size for you, based on the specific restore bundle and image being used if possible.
** '''Content Protection Type''': Controls the type of data protection used on the device.
** '''Low-Level Erase''': Do a low level erase (wipe with null or random data) of the entire storage device prior to restoring.
* '''Restore System Partition'''
** '''System Image''': Determines which type of system image to restore, or which file to use for the system image.
** '''Kernel Cache Type''': This option controls the kernel cache that gets installed on the device.
* '''Baseband'''
** '''Update Baseband''': Controls whether the [[baseband]] and baseband bootloader are updated as part of the restore.
** '''Force Update''': The baseband update is skipped when the existing firmware matches the available firmware. In some cases, it is desirable to force the firmware update to occur, regardless of what is currently on there. This option, when set to true, forces the update to be attempted.

== Restore OS ==
Restore OS options allow you to specify the following:
* '''Restore Boot-Args''': Boot-Args used when the Restore OS is loaded. By default those arguments are used: "debug=0x14e serial=3 rd=md0 nand-enable-reformat=1 -progress"
* '''Firmware Type:''' Specify the firmware which should be flashed when restoring. This can either be "Debug", "Factory FA", "Factory SA", "Firmware Development" or "Production".
* '''Boot Image Type:''' Can be "Internal", "User or Internal", "User" or "Update".
* '''Boot Kernel Cache:''' Specify whether the "Production" or "Development" kernel cache should be used.

== Personalization Settings ==
As with iTunes, PurpleRestore can personalize builds for iOS devices (since recent Bootroms expect a valid APTicket). The tooltip for the "Personalized Restore" checkbox reads "Your ticket to the Orwellian cloud." This may suggest that Apple developed TSS in part to control access to internal build variants (i.e. prevent leaks of "interesting" builds of iOS), in addition to preventing production users from downgrading.
* '''Variants''': "A predefined combination of restore pieces." The options are: "Customer Install", "Internal Debug", "Internal Development", "Internal Install", "Internal Qualification", and "Vendor install."
* '''AppleConnect''': Used to authenticate all restores for personalization. Interestingly, AppleConnect will allow members of the iOS Developer Program (including non-employees) to install public builds of iOS (latest current and beta). It's likely AppleConnect is also used to authenticate signing of internal builds using the public TSS server, should the device be on the whitelist.

== Restore Settings ==
[[File:PurpleRestoreOptions.png |250px|thumb|right|PurpleRestore configuration screen]]
By default, PurpleRestore comes with two pre-made restore settings. "Erase Install" and "Update Install". Those restore settings are [[PList File Format|plist]] files that define the options PurpleRestore will use when restoring a device.
* '''Erase Install''': Repartition the media and erase all data before restoring. Includes all internal development tools and updates flash and the baseband by default.
* '''Update Install''': Includes all internal development tools and updates flash and the baseband by default.
{{clear}}

== Reverse Engineering ==
This specific code is from [[iTunes]] for OS X. It detects if PurpleRestore is running so that it does not interfere with any operations that PurpleRestore is performing.

Off Virt Adr Instruction Disassembly Comment

+354 003d7808 c70424bc01d700 mov [esp], 0x00d701bc ; CFSTR("com.apple.PurpleRestore")
+361 003d780f e80c65c3ff call 0x10000dd20 ; is specified bundle running
+366 003d7814 84c0 test al, al
+368 003d7816 7409 jz short 0x003d7821 ; if so, PurpleRestore is running
+370 003d7818 c704246c8ba400 mov [esp], 0x00a48b6c ; so ignore device,
+377 003d781f ebd3 jmp short 0x003d77f4 ; and jump back above loop for next device
+379 003d7821 8d5de0 lea ebx, [ebp + 0xe0]
+382 003d7824 895c2404 mov [esp + 4], ebx

== Problems ==
There are some problems with the leaked versions, because they almost always aren't the latest version.

[[File:IBECStuck.png|250px|thumb|right|Stuck on Executing iBEC]]
One problem (common) is getting stuck at "Executing iBEC to bootstrap update". This is likely a signing error, the device may have rejected the iBEC image.

Another problem, when trying from DFU mode, the tool will send the DFU image, then the device will disconnect, reconnect, and repeat the process indefinitely.

== See Also ==
* [[iTunes]]
* [https://www.youtube.com/watch?v=jaZ2JPUv-AU Video of process]
* [https://www.youtube.com/watch?v=IGC2lrYhQjw How-to create restore bundles from a public ipsw]
* [https://www.youtube.com/watch?v=DwipCKbWIlw PurpleRestore restore process]

[[Category:Software]]

Kernel

2015-04-11T00:40:03Z

Rzhikharevich:

The '''kernel''' of [[iOS]] is the [[wikipedia:XNU|XNU]] kernel. To learn about what "kernel" means in general, see [https://en.wikipedia.org/wiki/Kernel_(operating_system) the Wikipedia article].

Pre-2.0, it was vulnerable to the [[Ramdisk Hack]] and may still be, but iBoot doesn't allow boot-args to be passed anymore. It is mapped to memory at 0x80000000, forcing a 2/2GB address separation, similar to Windows 32-bit model. On older iOS versions the separation was 3/1 (mapping the kernel at 0xC0000000), closer to the Linux model.

Note, that this is NOT like 32-bit OS X, wherein the kernel resides in its own address space, but more like OS X 64-bit, wherein [[wikipedia:Control_Register#CR3|CR3]] is shared (albeit an address space larger by several orders of magnitude). See the appropriate [[#64-bit|section]].

== [[ASLR]] ==
{{main|Kernel ASLR}}
As of [[iOS]] 6, the kernel is subject to ASLR, much akin to Mountain Lion (OS X 10.8). This make exploitation harder as the location of kernel code cannot be known.

On production and development devices, the kernel is always stored as a statically linked [[kernelcache|cache]] stored at [[/System/Library/Caches/com.apple.kernelcaches/kernelcache]] that is decompressed and run on startup.

== Stack ==
The kernel maintains thread specific stacks by calling kernel_memory_allocate, this allocates stacks in the specified kalloc zone. The bootstrap thread has its own specific static kernel stack, which is specified by _intstack. IRQ and FIQ handlers will also have their own execution stack which is specified by _irqstack.

== Boot-Args ==
Like its OS X counterpart, iOS's XNU accepts command line arguments (though the actual passing of arguments is done by iBoot, which as of late refuses to do so). Arguments may be directed at the kernel proper, or any one of the many KExts (discussed below). The arguments of the kernel are largely the same as those of OS X.

Kexts use boot-args as well, as can be seen when disassembly by calls to PE_parse_boot_argn (usually exported, _PE_parse_boot_argn 8027A8EC on the iOS 6.1.3 kernel, discovered by [[User:Haifisch|Haifisch]]). Finding references (using IDA) reveals hundreds places in the code wherein arguments are parsed in modules, pertaining to Flash, HDMI, and [[AppleMobileFileIntegrity|AMFI]].

Here's a list of boot-args extracted with the [https://github.com/pod2g/ios_stuff/tree/master/idc-ios-boot-args IDA script] by [[User:MuscleNerd|MuscleNerd]]:

-disable_aslr (From the xnu source code)
_nand-part-poison
_panicd_corename
_panicd_ip
_router_ip
acc_debug
aesdev
als_enable_debug
amfi
amfi_allow_any_signature
amfi_get_out_of_my_way
amfi_unrestrict_task_for_pid
AppleEmbeddedUSBArbitrator-debug
AppleS5L8930XUSBArbitrator-debug
AppleUSBPhy-debug
arm7m-enable-jtag
-b
backlight-level
backlight-logging
baseband-spi-sclk-period
bcom.chip.driveStrength_mA
bcom.chip.watermark
bcom.clock.sd-rate
bcom.devif.fn2-block-size
bcom.devif.rx-retries
bcom.devif.transaction-log
bcom.devif.tx-retries
bcom.feature.flags
bcom.ps.inactivity.timeout
bcom.wte.thread-priority
boot-uuid
brightness
burnin-size
cameraclocks
charger-debug
cpus
cs_debug
cs_enforcement_disable
darkwake
dart
dcc
debug
disable-usb-iap
dp_async_event_fail_hard
dp_audio_driver_level
dp_audio_driver_mask
dp_audio_interface_level
dp_audio_interface_mask
dp_controller_level
dp_controller_mask
dp_device_level
dp_device_mask
dp_display_interface_level
dp_display_interface_mask
dp_interface_level
dp_interface_mask
dp_log_level
dp_max_channel_count_lpcm
dp_max_sample_rate_lpcm
dp_max_sample_size_lpcm
dp_min_channel_count_lpcm
dp_min_sample_rate_lpcm
dp_min_sample_size_lpcm
dp_service_level
dp_service_mask
dpsm
dvb
dvc
dvd
effaceable-enable-full-scan
effaceable-enable-wipe
enable-acsleep
fairshare_minblockedtime
fill
fixedpriority_quantum
fix-parity
force-usb-host
force-usb-power
hdmi_max_channel_count_lpcm
hdmi_max_sample_rate_lpcm
hdmi_max_sample_size_lpcm
hdmi_min_channel_count_lpcm
hdmi_min_sample_rate_lpcm
hdmi_min_sample_size_lpcm
hdmi_protection_type
hp-detect-invert
hp-pop-workaround
hp-switch-force-config
hp-switch-ramp
hsic
i2c-logsize
i2c-verbose
ifa_debug
ifnet_debug
initmcl
io
iopfmi-timeout
iotrace
jpeg-log
jtag
kdp_crashdump_pkt_size
kdp_ip_addr
kdp_match_mac
kdp_match_name
keepsyms
kextlog
link_recovery_enabled
mbuf_debug
mbuf_pool
mcache_flags
mleak_sample_factor
mseg
msgbuf
mt-bytes
mt-strings
mtxspin
nand-boot-malloc
nand-check-vs
nand-commands
nand-disable-driver
nand-dump-vs-table
nand-enable-adm
nand-enable-reformat
nand-enable-yaftl
nand-erase
nand-erase-install
nand-fbbt-publish
nand-force-restore
nand-idle-timeout-ms
nand-ignore-ptab
nand-index-cache-size
nand-latency-us
nand-max-pages
nand-neuralize
nand-nvram-debug
nand-ppn-debug
nand-ppn-vs-debug
nand-qual
nand-queue-entries
nand-read-blocks-max
nand-read-dccycle-clks
nand-read-hold-clks
nand-readonly
nand-read-setup-clks
nand-reorder-defer-max
nand-reorder-defer-size-trigger
nand-reorder-read-promote-max
nand-reset-burnin
nand-save-rma-data
nand-set-rma
nand-sftl-cache-drain
nand-sleep-debug-panic
nand-slow-timings
nand-wearlevel-timeout-ms
nand-whiten-metadata
nand-wipe
nand-write-blocks-max
nand-write-hold-clks
nand-write-setup-clks
nbuf
ncl
net.inet6.ip6.scopedroute
net_affinity
net_rtref
network-type
-no64exec
-novfscache
panicd_port
pcp
pctb
pdmvr
pio-error
pmu-chargetrap
pmu-debug
ppn-clean
-progress
prox_enable_debug
pthtest
rd
remote_nmi
rootdev
-s
sdio.clock.base-rate
sdio.clock.sd-rate
sdio.debug.abort-init
sdio.debug.init-delay
sdio.log.flags
sdio.log.level
sdio.transfer.max-pio-blocks
sdio.transfer.max-pio-size
sdio.transfer.mode
serial
sgx_panic_on_recovery
shadev
slto_us
socket_debug
torchcltm0
usb
usb_dev_nmi
usb_dev_reset
-vnode_cache_defeat
wdt
wfi
wlan.ap.channel
wlan.debug.abort-init
wlan.debug.generate-mac
wlan.log.flags
wlan.log.level
wlan.log.timestamp
wlan.netmanager.stats-timer-interval
wlan.panic.factory
wqsize
WTE
-x

== Versions ==
In the beginning iOS had consistently maintained a fairly higher kernel version than the corresponding version of OS X, but over time iOS and OS X "moved nearer" together. Now at the time of writing, OS X Yosemite's XNU is 2782, whereas iOS 8 is 2783. This is not surprising, considering that iOS introduced novel features (such as [[Kernel ASLR]], the default freezer, and various security hardening features) which are first incorporated in it, and later made it to OS X. It seems that Apple is planning to gradually unite iOS and OS X kernels over time and with iOS 8 and OS X Yosemite the at least the version numbers are nearer to each other then ever before. The following demonstrates the OS versions at present (via terminal '''uname -a''' command):

OS X Yosemite 10.10.3:

Darwin Kernel Version 14.3.0: Mon Mar 23 11:59:05 PDT 2015; root:xnu-2782.20.48~5/RELEASE_X86_64

iOS 8.3:

Darwin Kernel Version 14.0.0: Sun Mar 29 19:44:04 PDT 2015; root:xnu-2784.20.34~2/RELEASE_ARM_[[S5L8950]]X

Note: The RELEASE_ARM_xxxxxxxx file obviously differs on device / CPU and the time varies by a few minutes per device.

=== Version List ===
The compilation date for each version will vary slightly between processors. This is due to the fact that compilations are sequential.
{| class="wikitable"
|-
! Version
! Build
! Comment
|-
| [[Alpine 1A420 (iPhone)|1A420]]
| Darwin Kernel Version 4.4.2-Purple-19: Thu Mar 8 01:43:04 PST 2007; root:xnu-933.0.14~46/RELEASE_ARM_[[S5L8900]]XRB
| from prototype - not sure if version is 100% correct.
|-
| 1.0
| Darwin Kernel Version 9.0.0d1: Tue May 22 21:15:54 PDT 2007; root:xnu-933.0.178/RELEASE_ARM_[[S5L8900]]XRB
| rowspan="3" | Not sure if version is 100% correct.
|-
| 1.0.1
| class="rborderplz" rowspan="2" | Darwin Kernel Version 9.0.0d1: Fri Jun 22 00:38:56 PDT 2007; root:xnu-933.1.178~1/RELEASE_ARM_[[S5L8900]]XRB
|-
| class="rborderplz" | 1.0.2
|-
| 1.1.1
| Darwin Kernel Version 9.0.0d1: Wed Sep 19 00:08:42 PDT 2007; root:xnu-933.0.203~21/RELEASE_ARM_[[S5L8900]]XRB
| First kernel that was [[8900_File_Format#8900|8900]] encrypted - not sure if version is 100% correct.
|-
| 1.1.2
| Darwin Kernel Version 9.0.0d1: Wed Oct 10 00:07:49 PDT 2007; root:xnu-933.0.204~7/RELEASE_ARM_[[S5L8900]]XRB
| Not sure if version is 100% correct.
|-
| 1.1.3
| rowspan="3" | Darwin Kernel Version 9.0.0d1: Wed Dec 12 00:16:00 PST 2007; root:xnu-933.0.211~2/RELEASE_ARM_[[S5L8900]]XRB
|
|-
| 1.1.4
|
|-
| 1.1.5
| iPod touch only
|-
| 2.0
| rowspan="3" | Darwin Kernel Version 9.3.1: Sun Jun 15 21:37:01 PDT 2008; root:xnu-1228.6.76~45/RELEASE_ARM_[[S5L8900]]X
|
|-
| 2.0.1
|
|-
| 2.0.2
|
|-
| 2.1
| rowspan="2" | Darwin Kernel Version 9.4.1: Sun Aug 10 21:25:25 PDT 2008; root:xnu-1228.7.27~12/RELEASE_ARM_[[S5L8720]]X
|
|-
| 2.1.1
|
|-
| 2.2
| Darwin Kernel Version 9.4.1: Sat Nov 1 19:13:13 PDT 2008; root:xnu-1228.7.36~2/RELEASE_ARM_[[S5L8720]]X
|
|-
| 2.2.1
| Darwin Kernel Version 9.4.1: Mon Dec 8 21:02:57 PST 2008; root:xnu-1228.7.37~4/RELEASE_ARM_[[S5L8720]]X
|
|-
| 3.0
| rowspan="2" | Darwin Kernel Version 10.0.0d3: Wed May 13 22:16:49 PDT 2009; root:xnu-1357.2.89~4/RELEASE_ARM_[[S5L8920]]X
|
|-
| 3.0.1
|
|-
| 3.1
| Darwin Kernel Version 10.0.0d3: Fri Aug 14 13:23:32 PDT 2009; root:xnu-1357.5.30~2/RELEASE_ARM_[[S5L8920]]X
|
|-
| 3.1.2
| Darwin Kernel Version 10.0.0d3: Fri Sep 25 23:35:35 PDT 2009; root:xnu-1357.5.30~3/RELEASE_ARM_[[S5L8920]]X
|
|-
| 3.1.3
| Darwin Kernel Version 10.0.0d3: Fri Dec 18 01:34:28 PST 2009; root:xnu-1357.5.30~6/RELEASE_ARM_[[S5L8920]]X
|
|-
| 3.2
| Darwin Kernel Version 10.3.1: Mon Mar 15 23:15:33 PDT 2010; root:xnu-1504.2.27~18/RELEASE_ARM_[[S5L8930]]X
| rowspan="3" | iPad Only
|-
| 3.2.1
| class="rborderplz" | Darwin Kernel Version 10.3.1: Fri May 28 16:46:17 PDT 2010; root:xnu-1504.2.50~4/RELEASE_ARM_[[S5L8930]]X
|-
| 3.2.2
| class="rborderplz" | Darwin Kernel Version 10.3.1: Wed Aug 4 19:08:04 PDT 2010; root:xnu-1504.2.60~1/RELEASE_ARM_[[S5L8930]]X
|-
| 4.0
| rowspan="2" | Darwin Kernel Version 10.3.1: Wed May 26 22:28:33 PDT 2010; root:xnu-1504.50.73~2/RELEASE_ARM_[[S5L8930]]X
|
|-
| 4.0.1
|
|-
| 4.0.2
| Darwin Kernel Version 10.3.1: Wed Aug 4 18:46:06 PDT 2010; root:xnu-1504.50.80~1/RELEASE_ARM_[[S5L8930]]X
|
|-
| 4.1
| Darwin Kernel Version 10.3.1: Wed Aug 4 22:35:51 PDT 2010; root:xnu-1504.55.33~10/RELEASE_ARM_[[S5L8930]]X
|
|-
| 4.2.1
| Darwin Kernel Version 10.4.0: Wed Oct 20 20:14:45 PDT 2010; root:xnu-1504.58.28~3/RELEASE_ARM_[[S5L8930]]X
|
|-
| 4.3
| rowspan="2" | Darwin Kernel Version 11.0.0: Thu Feb 10 21:46:56 PST 2011; root:xnu-1735.46~2/RELEASE_ARM_[[S5L8930]]X
|
|-
| 4.3.1
|
|-
| 4.3.2
| rowspan="2" | Darwin Kernel Version 11.0.0: Wed Mar 30 18:51:10 PDT 2011; root:xnu-1735.46~10/RELEASE_ARM_[[S5L8930]]X
|
|-
| 4.3.3
|
|-
| 4.3.4
| rowspan="2" | Darwin Kernel Version 11.0.0: Sat Jul 9 00:59:43 PDT 2011; root:xnu-1735.47~1/RELEASE_ARM_[[S5L8930]]X
|
|-
| 4.3.5
|
|-
| 5.0b5
| Darwin Kernel Version 11.0.0: Tue Aug 2 22:31:30 PDT 2011; root:xnu-1878.4.80~1/RELEASE_ARM_[[S5L8930]]X
|
|-
| 5.0
| Darwin Kernel Version 11.0.0: Thu Sep 15 23:34:43 PDT 2011; root:xnu-1878.4.43~2/RELEASE_ARM_[[S5L8940]]X
|
|-
| 5.0.1b
| Darwin Kernel Version 11.0.0: Wed Oct 19 19:05:07 PDT 2011; root:xnu-1878.4.45~1/RELEASE_ARM_[[S5L8930]]X
|
|-
| 5.0.1b2
| rowspan="2" | Darwin Kernel Version 11.0.0: Tue Nov 1 20:34:16 PDT 2011; root:xnu-1878.4.46~1/RELEASE_ARM_[[S5L8940]]X
|
|-
| 5.0.1
|
|-
| 5.1b
| Darwin Kernel Version 11.0.0: Sun Nov 13 19:10:13 PST 2011; root:xnu-1878.10.61~7/RELEASE_ARM_[[S5L8930]]X
|
|-
| 5.1b2
| Darwin Kernel Version 11.0.0: Sun Dec 4 18:57:33 PST 2011; root:xnu-1878.10.68~2/RELEASE_ARM_[[S5L8930]]X
|
|-
| 5.1b3
| Darwin Kernel Version 11.0.0: Mon Jan 2 18:46:01 PST 2012; root:xnu-1878.10.74~3/RELEASE_ARM_[[S5L8930]]X
|
|-
| 5.1
| Darwin Kernel Version 11.0.0: Wed Feb 1 23:18:07 PST 2012; root:xnu-1878.11.8~1/RELEASE_ARM_[[S5L8945]]X
|
|-
| 5.1.1
| Darwin Kernel Version 11.0.0: Sun Apr 8 21:51:26 PDT 2012; root:xnu-1878.11.10~1/RELEASE_ARM_[[S5L8930]]X
|
|-
| 6.0b
| Darwin Kernel Version 13.0.0: Wed May 30 19:23:03 PDT 2012; root:xnu-2107.1.78~18/RELEASE_ARM_[[S5L8930]]X
|
|-
| 6.0b2
| Darwin Kernel Version 13.0.0: Sun Jun 17 19:47:47 PDT 2012; root:xnu-2107.1.61~3/RELEASE_ARM_[[S5L8930]]X
|
|-
| 6.0b3
| Darwin Kernel Version 13.0.0: Sun Jul 8 20:15:17 PDT 2012; root:xnu-2107.2.9~3/RELEASE_ARM_[[S5L8930]]X
|
|-
| 6.0b4
| Darwin Kernel Version 13.0.0: Sun Jul 29 20:15:28 PDT 2012; root:xnu-2107.2.26~4/RELEASE_ARM_[[S5L8930]]X
|
|-
| 6.0
| Darwin Kernel Version 13.0.0: Sun Aug 19 00:31:06 PDT 2012; root:xnu-2107.2.33~4/RELEASE_ARM_[[S5L8950]]X
|
|-
| 6.0.1
| rowspan="2" | Darwin Kernel Version 13.0.0: Wed Oct 10 23:32:19 PDT 2012; root:xnu-2107.2.34~2/RELEASE_ARM_[[S5L8950]]X
|
|-
| 6.0.2
| iPhone 5 only.
|-
| 6.1b
| Darwin Kernel Version 13.0.0: Sun Oct 21 19:28:43 PDT 2012; root:xnu-2107.7.51~17/RELEASE_ARM_[[S5L8930]]X
|
|-
| 6.1b2
| Darwin Kernel Version 13.0.0: Sun Nov 4 19:02:54 PST 2012; root:xnu-2107.7.53~2/RELEASE_ARM_[[S5L8930]]X
|
|-
| 6.1b3
| Darwin Kernel Version 13.0.0: Mon Nov 26 21:17:13 PST 2012; root:xnu-2107.7.53~27/RELEASE_ARM_[[S5L8930]]X
|
|-
| 6.1b4
| Darwin Kernel Version 13.0.0: Sun Dec 9 19:22:45 PST 2012; root:xnu-2107.7.55~6/RELEASE_ARM_[[S5L8930]]X
|
|-
| 6.1b5
| rowspan="5" | Darwin Kernel Version 13.0.0: Sun Dec 16 20:01:39 PST 2012; root:xnu-2107.7.55~11/RELEASE_ARM_[[S5L8950]]X
|
|-
| 6.1
|
|-
| 6.1.1b
|
|-
| 6.1.1
| iPhone 4S only
|-
| 6.1.2
|
|-
| 6.1.3b2
| rowspan="5" | Darwin Kernel Version 13.0.0: Wed Feb 13 21:35:42 PST 2013; root:xnu-2107.7.55.2.2~1/RELEASE_ARM_[[S5L8920]]X
|
|-
| 6.1.3
|
|-
| 6.1.4
| iPhone 5 only.
|-
| 6.1.5
| iPod touch 4 only.
|-
| 6.1.6
| iPod touch 4 and iPhone 3GS only.
|-
| 7.0b
| Darwin Kernel Version 14.0.0: Wed May 29 23:53:59 PDT 2013; root:xnu-2423.1.1.1.2~1/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.0b2
| Darwin Kernel Version 14.0.0: Mon Jun 17 00:51:51 PDT 2013; root:xnu-2423.1.28~7/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.0b3
| Darwin Kernel Version 14.0.0: Mon Jul 1 04:25:28 PDT 2013; root:xnu-2423.1.40~11/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.0b4
| Darwin Kernel Version 14.0.0: Mon Jul 22 02:12:11 PDT 2013; root:xnu-2423.1.55~8/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.0b5
| rowspan="2" | Darwin Kernel Version 14.0.0: Sun Aug 4 22:40:14 PDT 2013; root:xnu-2423.1.70~6/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.0b6
|
|-
| 7.0[[Golden Master|GM]]
| rowspan="2" | Darwin Kernel Version 14.0.0: Tue Aug 13 21:39:05 PDT 2013; root:xnu-2423.1.73~3/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.0
|
|-
| 7.0.1
| rowspan="2" | Darwin Kernel Version 14.0.0: Mon Sep 9 20:56:02 PDT 2013; root:xnu-2423.1.74~2/RELEASE_ARM64_[[S5L8960]]X
| [[iPhone 5c]] and [[iPhone 5s|5s]] only
|-
| 7.0.2
|
|-
| 7.0.3
| rowspan="4" | Darwin Kernel Version 14.0.0: Fri Sep 27 23:08:32 PDT 2013; root:xnu-2423.3.12~1/RELEASE_ARM64_[[S5L8960]]X
|
|-
| 7.0.4
|
|-
| 7.0.5
| iPhone 5c (iPhone5,4) and iPhone 5s (iPhone6,2) only.
|-
| 7.0.6
|
|-
| 7.1b
| Darwin Kernel Version 14.0.0: Mon Nov 11 04:18:01 PST 2013; root:xnu-2423.10.33~9/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.1b2
| Darwin Kernel Version 14.0.0: Tue Dec 10 21:25:34 PST 2013; root:xnu-2423.10.38.1.1~1/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.1b3
| Darwin Kernel Version 14.0.0: Thu Jan 2 01:55:45 PST 2014; root:xnu-2423.10.45~5/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.1b4
| Darwin Kernel Version 14.0.0: Mon Jan 13 03:33:00 PST 2014; root:xnu-2423.10.49.0.1~3/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.1b5
| Darwin Kernel Version 14.0.0: Mon Jan 27 23:55:13 PST 2014; root:xnu-2423.10.58~2/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.1
| Darwin Kernel Version 14.0.0: Fri Feb 21 19:41:10 PST 2014; root:xnu-2423.10.67~1/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.1.1
| Darwin Kernel Version 14.0.0: Fri Mar 28 21:22:10 PDT 2014; root:xnu-2423.10.70~1/RELEASE_ARM_[[S5L8930]]X
|
|-
| 7.1.2
| Darwin Kernel Version 14.0.0: Thu May 15 23:17:54 PDT 2014; root:xnu-2423.10.71~1/RELEASE_ARM64_[[S5L8960]]X
|
|-
| 8.0b
| Darwin Kernel Version 14.0.0: Mon May 26 22:09:06 PDT 2014; root:xnu-2729.0.0.0.9~2/RELEASE_ARM_[[S5L8942]]X
|
|-
| 8.0b2
| Darwin Kernel Version 14.0.0: Sat Jun 14 16:36:40 PDT 2014; root:xnu-2775.0.0.1.1~3/RELEASE_ARM64_[[S5L8960]]X
|
|-
| 8.0b3
| Darwin Kernel Version 14.0.0: Wed Jul 2 18:51:34 PDT 2014; root:xnu-2783.1.21~19/RELEASE_ARM_[[S5L8950]]X
|
|-
| 8.0b4
| Darwin Kernel Version 14.0.0: Wed Jul 16 21:55:26 PDT 2014; root:xnu-2783.1.40.0.3~2/RELEASE_ARM_[[S5L8950]]X
|
|-
| 8.0b5
| Darwin Kernel Version 14.0.0: Wed Jul 30 23:04:17 PDT 2014; root:xnu-2783.1.62~20/RELEASE_ARM_[[S5L8950]]X
|
|-
| 8.0[[Golden Master|GM]]
| rowspan="2" | Darwin Kernel Version 14.0.0: Tue Aug 19 15:09:47 PDT 2014; root:xnu-2783.1.72~8/RELEASE_ARM64_[[S5L8960]]X
|
|-
| 8.0
|
|-
| 8.0.1
| rowspan="2" | Darwin Kernel Version 14.0.0: Thu Sep 18 21:52:21 PDT 2014; root:xnu-2783.1.72~23/RELEASE_ARM_[[S5L8950]]X
|
|-
| 8.0.2
|
|-
| 8.1b
| Darwin Kernel Version 14.0.0: Sat Sep 27 18:49:49 PDT 2014; root:xnu-2783.3.12~18/RELEASE_ARM_[[S5L8950]]X
|
|-
| 8.1b2
| Darwin Kernel Version 14.0.0: Fri Oct 3 21:52:09 PDT 2014; root:xnu-2783.3.13~2/RELEASE_ARM_[[S5L8950]]X
|
|-
| 8.1
| Darwin Kernel Version 14.0.0: Fri Oct 7 00:04:37 PDT 2014; root:xnu-2783.3.13~4/RELEASE_ARM_[[S5L8950]]X
|
|-
| 8.1.1b
| Darwin Kernel Version 14.0.0: Sun Nov 2 20:21:29 PDT 2014; root:xnu-2783.3.21~1/RELEASE_ARM_[[S5L8950]]X
|
|-
| 8.1.1
| rowspan="2" | Darwin Kernel Version 14.0.0: Mon Nov 3 22:54:30 PDT 2014; root:xnu-2783.3.22~1/RELEASE_ARM_[[S5L8950]]X
|
|-
| 8.1.2
|
|-
| 8.1.3
| Darwin Kernel Version 14.0.0: Mon Jan 2 21:29:20 PST 2015; root:xnu-2783.3.26~3/RELEASE_ARM_[[S5L8950]]X
|
|-
| 8.2b3
| Darwin Kernel Version 14.0.0: Sun Dec 14 20:59:15 PST 2014; root:xnu-2783.5.29.0.1~1/RELEASE_ARM_[[S5L8940]]X
|
|-
| 8.2b4
| Darwin Kernel Version 14.0.0: Tue Jan 6 21:02:10 PST 2015; root:xnu-2783.5.32~9/RELEASE_ARM_[[S5L8940]]X
|
|-
| 8.2b5
| Darwin Kernel Version 14.0.0: Mon Jan 26 22:16:17 PST 2015; root:xnu-2783.5.37~11/RELEASE_ARM_[[S5L8940]]X
|
|-
| 8.2
| Darwin Kernel Version 14.0.0: Mon Feb 9 22:07:57 PST 2015; root:xnu-2783.5.38~5/RELEASE_ARM_[[S5L8950]]X
|
|-
| 8.3b3
| Darwin Kernel Version 14.0.0: Mon Mar 4 20:55:58 PST 2015; root:xnu-2784.20.25~26/RELEASE_ARM_[[S5L8960]]X
|
|-
| 8.3b4
| Darwin Kernel Version 14.0.0: Thu Mar 19 00:16:36 PST 2015; root:xnu-2784.20.31~1/RELEASE_ARM_[[S5L8960]]X
|
|-
| 8.3
| Darwin Kernel Version 14.0.0: Sun Mar 29 19:44:04 PDT 2015; root:xnu-2784.20.34~2/RELEASE_ARM_[[S5L8950]]X
|
|}

== Source Code ==
As XNU is based off of the [[wikipedia:Berkeley Software Distribution|BSD kernel]], it is [http://opensource.apple.com/source/xnu open source]. The source is under a [http://opensource.apple.com/license/bsd/ 3-clause BSD License] for the original BSD portions with the portions added by Apple under the [http://opensource.apple.com/license/apsl/ Apple Public Source License]. The [[#Versions|versions contained in iOS]] are not available, instead only versions used in ''OS X'' are available. This does not appear to be legal as per §2.3 in the APSL:
2.3 Distribution of Executable Versions. In addition, if You Externally Deploy Covered
Code (Original Code and/or Modifications) in object code, executable form only, '''You must'''
'''include a prominent notice''', in the code itself as well as in related documentation, '''stating'''
'''that Source Code of the Covered Code is available''' under the terms of this License '''with'''
'''information on how and where to obtain such Source Code'''.
with ''Source Code'' defined in §1.8:
1.8 "Source Code" means the human readable form of a program or other work that is
suitable for making modifications to it, including all modules it contains, plus any
associated interface definition files, scripts used to control compilation and installation
of an executable (object code).

It is worth noting that Apple does ''not'' list XNU as being an open source component of [[iOS]]. This can be seen by viewing [http://opensource.apple.com/ opensource.apple.com] and selecting ''any'' iOS version. As far as can be told, ''none'' of the versions of XNU are available in source version.

There are many other open souce components that iOS uses that are ''not'' listed, such as:
* [http://opensource.apple.com/source/CF/ CF] ([https://developer.apple.com/library/mac/#documentation/CoreFoundation/Reference/CoreFoundation_Collection/_index.html CoreFoundation] - Cocoa)
* [http://opensource.apple.com/source/SQLite/ SQLite] ([http://www.sqlite.org/ SQLite] - database utility)
* [http://opensource.apple.com/source/TimeZoneData/ TimeZoneData] ([[wikipedia:tz database|tz database]] - [[/usr/share/zoneinfo]])
* [http://opensource.apple.com/source/curl/ curl](?) ([http://curl.haxx.se/ libcurl] - various HTTP operations)
* [http://opensource.apple.com/source/hfs/ hfs] (hfs - [[wikipedia:Hierarchical File System|HFS]] driver)
* [http://opensource.apple.com/source/launchd/ launchd] ([[launchd]] - launch daemon)
* [http://opensource.apple.com/source/libxml2/ libxml2](?) ([http://www.xmlsoft.org/ libxml2] - parser for [[wikipedia:XML|XML]] [[PList File Format|plist]]s)
* [http://opensource.apple.com/source/xnu/ xnu] (XNU - Kernel)
* [http://opensource.apple.com/source/zip/ zip] (zip - extraction of various files)
It does ''not'' appear that Apple assumes what you see in the ''OS X'' pages are also on ''iOS'' as [http://opensource.apple.com/source/JavaScriptCore/ JavaScriptCore], [http://opensource.apple.com/source/WebCore/ WebCore], among others are listed on both [http://opensource.apple.com/release/mac-os-x-108/ OS X] (10.8) and [http://opensource.apple.com/release/ios-60/ iOS] (6.0), albeit different versions.

It is also worth noting that [http://opensource.apple.com/source/gdb/ gdb] ([[wikipedia:GNU Compiler Collection|GCC]] debugger) and [http://opensource.apple.com/source/ld64/ ld64] are listed as components in [http://opensource.apple.com/release/ios-60/ iOS 6.0]. Why there are present is a mystery as they are not present on unaltered devices, but only through [[Cydia.app|Cydia]] or [[Xcode]]'s <code>DeveloperImage.dmg</code>.

== Kernel Extensions ==
iOS, sadly, does ''not'' have [[Kernel Extension|kext]]s floating around the [[/|file system]], but they are indeed present. The [[kernelcache]] can be unpacked to show the kernel proper, along with the kexts (all packed in the __PRELINK_TEXT section) and their [[PList File Format|plist]]s (in the __PRELINK_INFO section).

The Cydia supplied [[kextstat]] does not work on [[iOS]]. Sadly, the reason is that kextstat relies on <code>kmod_get_info(...)</code>, which is a deprecated (and recently removed) API in recent iOS and OS X versions. With that said, the [[Kernel Extension|kext]]s ''do'' exist. The alternative, [[kextstat#jkextstat|jkextstat]], ''does'' work on recent iOS versions. jkextstat can cause some confusion as it uses the executable name <code>kextstat</code>, similar to how calling <code>g++</code> just launches <code>gcc</code> but with parameters to treat all <code>.c</code> files as C++ files.

The following is the output from [[kextstat#jkextstat|jkextstat]] on an [[n81ap|iPod touch 4G]] running [[iOS]] 6(?):

Podicum:~ root# ./kextstat
0 __kernel__
1 kpi.bsd
2 kpi.dsep
3 kpi.iokit
4 kpi.libkern
5 kpi.mach
6 kpi.private
7 kpi.unsupported
8 driver.AppleARMPlatform <1 3 4 5 6 7>
9 iokit.IOStorageFamily <1 3 4 5 6 7>
10 driver.DiskImages <1 3 4 5 6 7 9>
11 driver.FairPlayIOKit <1 3 4 5 6 7>
12 driver.IOSlaveProcessor <3 4>
13 driver.IOP_s5l8930x_firmware <3 4 12>
14 iokit.AppleProfileFamily <1 3 4 5 6 7>
15 iokit.IOCryptoAcceleratorFamily <1 3 4 5 7>
16 driver.AppleMobileFileIntegrity <1 2 3 4 5 6 7 15>
17 iokit.IONetworkingFamily <1 3 4 5 6 7>
18 iokit.IOUserEthernet <1 3 4 5 6 16 17>
19 platform.AppleKernelStorage <3 4 7>
20 iokit.IOSurface <1 3 4 5 6 7 8>
21 iokit.IOStreamFamily <3 4 5>
22 iokit.IOAudio2Family <1 3 4 5 21>
23 driver.AppleAC3Passthrough <1 3 4 5 7 8 11 21 22>
24 iokit.EncryptedBlockStorage <1 3 4 5 9 15>
25 iokit.IOFlashStorage <1 3 4 5 7 9 24>
26 driver.AppleEffaceableStorage <1 3 4 5 7 8 25>
27 driver.AppleKeyStore <1 3 4 5 6 7 15 16 26>
28 kext.AppleMatch <1 4>
29 security.sandbox <1 2 3 4 5 6 7 16 28>
30 driver.AppleS5L8930X <1 3 4 5 7 8>
31 iokit.IOHIDFamily <1 3 4 5 6 7 16>
32 driver.AppleM68Buttons <1 3 4 5 7 8 31>
33 iokit.IOUSBDeviceFamily <1 3 4 5>
34 iokit.IOSerialFamily <1 3 4 5 6 7>
35 driver.AppleOnboardSerial <1 3 4 5 7 34>
36 iokit.IOAccessoryManager <3 4 5 7 8 33 34 35>
37 driver.AppleProfileTimestampAction <1 3 4 5 14>
38 driver.AppleProfileThreadInfoAction <1 3 4 6 14>
39 driver.AppleProfileKEventAction <1 3 4 14>
40 driver.AppleProfileRegisterStateAction <1 3 4 14>
41 driver.AppleProfileCallstackAction <1 3 4 5 6 14>
42 driver.AppleProfileReadCounterAction <3 4 6 14>
43 driver.AppleARMPL192VIC <3 4 5 7 8>
44 driver.AppleCDMA <1 3 4 5 7 8 15>
45 driver.IODARTFamily <3 4 5>
46 driver.AppleS5L8930XDART <1 3 4 5 7 8 45>
47 iokit.IOSDIOFamily <1 3 4 5 7>
48 driver.AppleIOPSDIO <1 3 4 5 7 8 12 47>
49 driver.AppleIOPFMI <1 3 4 5 7 8 12 25>
50 driver.AppleSamsungSPI <1 3 4 5 7 8>
51 driver.AppleSamsungSerial <1 3 4 5 7 8 34 35>
52 driver.AppleSamsungPKE <3 4 5 7 8 15>
53 driver.AppleS5L8920X <1 3 4 5 7 8>
54 driver.AppleSamsungI2S <1 3 4 5 7 8>
55 driver.AppleEmbeddedUSB <1 3 4 5 7 8>
56 driver.AppleS5L8930XUSBPhy <1 3 4 5 7 8 55>
57 iokit.IOUSBFamily <1 3 4 5 7>
58 driver.AppleUSBEHCI <1 3 4 5 7 57>
59 driver.AppleUSBComposite <1 3 4 57>
60 driver.AppleEmbeddedUSBHost <1 3 4 5 7 55 57 59>
61 driver.AppleUSBOHCI <1 3 4 5 57>
62 driver.AppleUSBOHCIARM <3 4 5 8 55 57 60 61>
63 driver.AppleUSBHub <1 3 4 5 57>
64 driver.AppleUSBEHCIARM <3 4 5 8 55 57 58 60 63>
65 driver.AppleS5L8930XUSB <1 3 4 5 7 8 55 57 58 60 61 62 64>
66 driver.AppleARM7M <3 4 8 12>
67 driver.EmbeddedIOP <3 4 5 12>
68 driver.AppleVXD375 <1 3 4 5 7 8 11>
69 driver.AppleD1815PMU <1 3 4 5 7 8 31>
70 iokit.AppleARMIISAudio <1 3 4 5 7 22>
71 driver.AppleEmbeddedAudio <1 3 4 5 7 8 22 31 70>
72 driver.AppleCS42L59Audio <3 4 5 8 22 31 70 71>
73 driver.AppleEmbeddedAccelerometer <3 4 5 7 8 31>
74 driver.AppleEmbeddedGyro <1 3 4 5 7 8 31>
75 driver.AppleEmbeddedLightSensor <3 4 5 7 8 31>
76 iokit.IOAcceleratorFamily <1 3 4 5 7 8>
77 IMGSGX535 <1 3 4 5 7 8 76>
78 driver.H2H264VideoEncoderDriver <1 3 4 5 7 8>
79 driver.AppleJPEGDriver <1 3 4 5 7 8>
80 driver.AppleH3CameraInterface <1 3 4 5 7 8>
81 driver.AppleM2ScalerCSCDriver <1 3 4 5 7 8 45>
82 iokit.IOMobileGraphicsFamily <1 3 4 5 7 8>
83 driver.AppleDisplayPipe <1 3 4 5 7 8 82>
84 driver.AppleCLCD <1 3 4 5 7 8 82 83>
85 driver.AppleSamsungMIPIDSI <1 3 4 5 7 8>
86 driver.ApplePinotLCD <1 3 4 5 7 8>
87 driver.AppleSamsungSWI <1 3 4 5 7 8>
88 iokit.IODisplayPortFamily <1 3 4 5 6 7 22>
89 driver.AppleRGBOUT <1 3 4 5 7 8 82 83 88>
90 driver.AppleTVOut <1 3 4 5 7 8>
91 driver.AppleAMC_r2 <1 3 4 5 7 8 11 21 22>
92 driver.AppleSamsungDPTX <3 4 5 7 8 88>
93 driver.AppleSynopsysOTGDevice <1 3 4 5 7 8 33 55>
94 driver.AppleNANDFTL <1 3 4 5 7 9 25>
95 driver.AppleNANDLegacyFTL <1 3 4 5 9 25 94>
96 AppleFSCompression.AppleFSCompressionTypeZlib <1 2 3 4 6>
97 IOTextEncryptionFamily <1 3 4 5 7 11>
98 driver.AppleBSDKextStarter <3 4>
99 nke.ppp <1 3 4 5 6 7>
100 nke.l2tp <1 3 4 5 6 7 99>
101 nke.pptp <1 3 4 5 6 7 99>
102 iokit.IO80211Family <1 3 4 5 6 7 17>
103 driver.AppleBCMWLANCore <1 3 4 5 6 7 8 17 102>
104 driver.AppleBCMWLANBusInterfaceSDIO <1 3 4 5 6 7 8 47 103>
105 driver.AppleDiagnosticDataAccessReadOnly <1 3 4 5 7 8 94>
106 driver.LightweightVolumeManager <1 3 4 5 9 15 24 26>
107 driver.IOFlashNVRAM <1 3 4 5 6 7 25>
108 driver.AppleNANDFirmware <1 3 4 5 25>
109 driver.AppleImage3NORAccess <1 3 4 5 7 8 15 108>
110 driver.AppleBluetooth <1 3 4 5 7 8>
111 driver.AppleMultitouchSPI <1 3 4 5 7 8>
112 driver.AppleUSBMike <1 3 4 5 8 22 33>
113 driver.AppleUSBDeviceMux <1 3 4 5 6 7 33>
114 driver.AppleUSBEthernetDevice <1 3 4 5 6 8 17 33>

For a specific extension, e.g. SandBox, the full information (including the handy load address) is also accessible:

<code>root# ./jkextstat -b sandbox -x</code>:
<plist>
<dict>
<key>CFBundleIdentifier</key>
<string>com.apple.security.sandbox</string>
<key>CFBundleVersion</key>
<string>154.7</string>
<key>OSBundleCPUSubtype</key>
<integer>9</integer>
<key>OSBundleCPUType</key>
<integer>12</integer>
<key>OSBundleDependencies</key>
<array>
<integer>6</integer>
<integer>7</integer>
<integer>5</integer>
<integer>3</integer>
<integer>28</integer>
<integer>1</integer>
<integer>4</integer>
<integer>16</integer>
<integer>2</integer>
</array>
<key>OSBundleExecutablePath</key>
<string>/System/Library/Extensions/Sandbox.kext/Sandbox</string>
<key>OSBundleIsInterface</key>
<false/>
<key>OSBundleLoadAddress</key>
<integer>2153734144</integer>
<key>OSBundleLoadSize</key>
<integer>36864</integer>
<key>OSBundleLoadTag</key>
<integer>29</integer>
<key>OSBundleMachOHeaders</key>
<data>
zvrt/gwAAAAJAAAACwAAAAMAAAAgAgAAAQAAAAEAAAAEAQAAX19URVhUAAAAAAAAAAAA
AABgX4AAgAAAAAAAAACAAAAHAAAABwAAAAMAAAAAAAAAX190ZXh0AAAAAAAAAAAAAF9f
VEVYVAAAAAAAAAAAAADMbV+AKGEAAMwNAAACAAAAAAAAAAAAAAAABwCAAAAAAAAAAABf
X2NzdHJpbmcAAAAAAAAAX19URVhUAAAAAAAAAAAAAPTOX4DLDQAA9G4AAAAAAAAAAAAA
AAAAAAIAAAAAAAAAAAAAAF9fY29uc3QAAAAAAAAAAABfX1RFWFQAAAAAAAAAAAAAwNxf
gDEDAADAfAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAQBAABfX0RBVEEAAAAA
AAAAAAAAAOBfgAAQAAAAgAAAABAAAAcAAAAHAAAAAwAAAAAAAABfX2RhdGEAAAAAAAAA
AAAAX19EQVRBAAAAAAAAAAAAAADgX4C0BgAAAIAAAAQAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAF9fYnNzAAAAAAAAAAAAAABfX0RBVEEAAAAAAAAAAAAAwOZfgHgAAAAAAAAABAAA
AAAAAAAAAAAAAQAAAAAAAAAAAAAAX19jb21tb24AAAAAAAAAAF9fREFUQQAAAAAAAAAA
AAA451+AGAAAAAAAAAACAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAbAAAAGAAAABasg7Y2
TzkVrtqsgOViBQ0=
</data>
<key>OSBundlePath</key>
<string>/System/Library/Extensions/Sandbox.kext</string>
<key>OSBundlePrelinked</key>
<true/>
<key>OSBundleRetainCount</key>
<integer>0</integer>
<key>OSBundleStarted</key>
<true/>
<key>OSBundleUUID</key>
<data>
FqyDtjZPORWu2qyA5WIFDQ==
</data>
<key>OSBundleWiredSize</key>
<integer>36864</integer>
<key>OSKernelResource</key>
<false/>
</dict>
</plist>

It's also worth mentioning that, in the above listing, the OSBundleMachOHeaders (base-64 encoded binary headers) leak kernel addresses in iOS 6.0, defeating [[Kernel ASLR]]. This has been quickly fixed in iOS 6.0.1, effectively locking down iOS for the foreseeable future, thanks to security researcher [[mdowd]].

==[[User:Winocm|Winocm's]] custom kernel==
[[User:Winocm|Winocm]] uses a custom kernel which the version can be found below.
Darwin Kernel Version 13.0.0: Fri Nov 22 18:19:54 CST 2013; root:xnu-2050.48.13~7/DEVELOPMENT_ARM_[[S5L8930]]X

== See Also ==
* [[Kernel Syscalls]]
* [[Kernel Sysctls]]
* [[Kernel Task]]
* [[Kernel Symbols]]
* [[kdebug]]
* [[kernelcache]]
* [[Tutorial:Booting XNU on A4 Devices]]

== External Links ==
* [http://opensource.apple.com/source/xnu XNU Source] (up to latest **OS X** version)
* [[i0n1c]] on [https://media.blackhat.com/bh-us-11/Esser/BH_US_11_Esser_Exploiting_The_iOS_Kernel_Slides.pdf exploiting the kernel]
* [[User:Haifisch|Haifisch]] on [http://dylanlaws.com/Kernel101 Decrypting the iOS kernel for disassembly]
* [http://newosxbook.com/src.jl?tree=listings&file=18-1-JKextstat.c jkextstat.c]
* [http://www.amazon.com/gp/product/1118057651 OSX/iOS internals book]

Apple Watch (1st generation)

2015-03-31T11:33:26Z

Rzhikharevich: /* Specifications */ New info from MacRumors.

[[File:Watch.jpg|right|thumb|Apple Watch]]

This is the Apple Watch introduced by Tim Cook at Apple's 'Wish we could say more.' event on the 9th September 2014.

== Application Processor ==
This device uses the new Apple S1 processor, The processor is an ARMv7k architecture (32-bit). Internally, the watch is referred to as n27aap (Watch1,1) or n28aap (Watch1,2).

== Specifications ==
* RAM: [http://appleinsider.com/articles/14/09/22/rumor-apple-watch-to-feature-512mb-of-ram-4gb-of-storage 512MB]
* [http://www.chipworks.com/en/technical-competitive-analysis/resources/blog/broadcom-wins-wifi-in-apple-watch/ BCM4334 Wi-Fi chip from Broadcom]
* NAND size: [http://www.macrumors.com/2015/03/10/apple-watch-storage-photos-music/ 8 GiB. 2 GBs are for songs. 75 MB for photos].
* Display: Retina.
* Screen: Sapphire crystal (Apple Watch/Apple Watch Edition)/Strengthened Ion-X glass (Apple Watch Sport)
* Compatibility: iOS 8.2 running on: [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[n61ap|iPhone 6]], [[n56ap|iPhone 6 Plus]]

== Operating System ==
The watch runs a slimmed down version of iOS 8.x. The user interface is managed by "Carousel" (instead of Springboard). Most frameworks are replaced with "Nano" equivalents.

== Versions ==
* Apple Watch
* Apple Watch Sport
* Apple Watch Edition (the body is made from gold)

== Third-party applications ==
Apple confirmed, that Watch will support third-party applications. The device will have an API called WatchKit.

[[File:Watch_apps.jpg|thumb|Some Watch icons]]
[[File:PairWatch.jpg|thumb]]

Currently announced third-party apps:
*Facebook
*Twitter (A07)
*City Mapper (E10)
*BMW
*HoneyWell (B07)
*Lutron (C07)
*Nike+
*American Airlines (B06)
*Starwood Hotels (C02)
*Major League Baseball (C10)
*PInterest (D07)
*Yahoo (D06)
*Comedy Central (A04)

== Links ==
*http://www.apple.com/watch/

Apple Watch (1st generation)

2015-03-30T04:36:42Z

Rzhikharevich: /* Third-party applications */

[[File:Watch.jpg|right|thumb|Apple Watch]]

== Summary ==
This is the Apple Watch introduced by Tim Cook at Apple's 'Wish we could say more.' event on the 9th September 2014.

== Application Processor ==
This device uses the new Apple S1 processor, currently nothing is known about it.

== Specifications ==
* RAM: [http://appleinsider.com/articles/14/09/22/rumor-apple-watch-to-feature-512mb-of-ram-4gb-of-storage 512MB]
* [http://www.chipworks.com/en/technical-competitive-analysis/resources/blog/broadcom-wins-wifi-in-apple-watch/ BCM4334 Wi-Fi chip from Broadcom]
* NAND size: 4GB/8GB. It's also possible, that more will be available.
* Display: Retina.
* Screen: Sapphire crystal (Apple Watch/Apple Watch Edition)/Strengthened Ion-X glass (Apple Watch Sport)
* Compatibility: iOS 8.2 running on: iPhone 5, iPhone 5C, iPhone 5S, iPhone 6, iPhone 6 Plus

== Versions ==
* Apple Watch
* Apple Watch Sport
* Apple Watch Edition (the body is made from gold)

== Third-party applications ==
Apple confirmed, that Watch will support third-party applications. The device will have an API called WatchKit.

[[File:Watch_apps.jpg|right|thumb|Some Watch icons]]
[[File:PairWatch.jpg|right|thumb]]

Currently announced third-party apps:
*Facebook
*Twitter (A07)
*City Mapper (E10)
*BMW
*HoneyWell (B07)
*Lutron (C07)
*Nike+
*American Airlines (B06)
*Starwood Hotels (C02)
*Major League Baseball (C10)
*PInterest (D07)
*Yahoo (D06)
*Comedy Central (A04)

== Links ==
*http://www.apple.com/watch/

File:PairWatch.jpg

2015-03-30T04:35:17Z

Rzhikharevich:

IBoot (Bootloader)

2015-03-30T04:29:08Z

Rzhikharevich: /* Revisions */

{{lowercase}}
'''iBoot''' is Apple's stage 2 bootloader for all of the [[iDevice|devices]]. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== [[Bootrom]] ==
The bootrom also goes by the name "iBoot." The list of bootroms can be found on [[Bootrom|their own page]].

== Extract and Disassemble ==
To extract the bootloader and disassemble using IDA, follow the following steps:
#obtain the bootloader from the iPSW. This file is in the <code>Firmware/all_flash</code> subdir, e.g. <code>Firmware/all_flash/all_flash.n81ap.production/iBoot.n81ap.RELEASE.img3</code>, where the "n81ap", "k90", etc.. are for the i-Device type
#run xpwntool with the proper key (from elsewhere in this Wiki)
#Make sure the decryption was successful - if it is, you should see:
"iBoot for ...., Copyright 2011, Apple Inc."
if you cat (i.e. type) the file.
<ol><li value="4">remove the img3 header - the good stuff starts at offset 0x40 (i.e. 64) - using dd (skip=1 bs=64) or some other tool</li>
<li>Load in IDA. Set processor to ARM. Rebase program (Edit→Segments→Rebase Program) to 0x5FF00000 (for iBoot in iOS 5). You should see something like:</li></ol>

<pre>
ROM:5FF00000 loc_5FF00000 ; CODE XREF: ROM:5FF00078�j
ROM:5FF00000 B loc_5FF00040 ; Used for Reset - This is where we start
ROM:5FF00004 ; ---------------------------------------------------------------------------
ROM:5FF00004 LDR PC, =sub_5FF16FB4 ; Used for Undef
ROM:5FF00008 ; ---------------------------------------------------------------------------
ROM:5FF00008 LDR PC, =sub_5FF16FEC ; Used for SWI
ROM:5FF0000C ; ---------------------------------------------------------------------------
ROM:5FF0000C LDR PC, =sub_5FF17024 ; Used for Prefabt
ROM:5FF00010 ; ---------------------------------------------------------------------------
ROM:5FF00010 LDR PC, =sub_5FF17060 ; Used for DataAbt
ROM:5FF00014 ; ---------------------------------------------------------------------------
ROM:5FF00014 LDR PC, =loc_5FF17098 ; Used for AddrExc
ROM:5FF00018 ; ---------------------------------------------------------------------------
ROM:5FF00018 LDR PC, =loc_5FF16F24 ; Used for IRQ
ROM:5FF0001C ; ---------------------------------------------------------------------------
ROM:5FF0001C LDR PC, =sub_5FF16F6C ; Probably FIQ, need to verify this
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00020 SVCPL 0xF00040
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00024 off_5FF00024 DCD sub_5FF16FB4 ; DATA XREF: ROM:5FF00004�r
ROM:5FF00028 off_5FF00028 DCD sub_5FF16FEC ; DATA XREF: ROM:5FF00008�r
ROM:5FF0002C off_5FF0002C DCD sub_5FF17024 ; DATA XREF: ROM:5FF0000C�r
ROM:5FF00030 off_5FF00030 DCD sub_5FF17060 ; DATA XREF: ROM:5FF00010�r
ROM:5FF00034 off_5FF00034 DCD loc_5FF17098 ; DATA XREF: ROM:5FF00014�r
ROM:5FF00038 off_5FF00038 DCD loc_5FF16F24 ; DATA XREF: ROM:5FF00018�r
ROM:5FF0003C off_5FF0003C DCD sub_5FF16F6C ; DATA XREF: ROM:5FF0001C�r
ROM:5FF00040 ; ---------------------------------------------------------------------------
ROM:5FF00040
ROM:5FF00040 loc_5FF00040 ; CODE XREF: ROM:loc_5FF00000�j
ROM:5FF00040 ADR R0, loc_5FF00000 <-- The address we rebased to
ROM:5FF00044 LDR R1, =loc_5FF00000
ROM:5FF00048 CMP R0, R1
ROM:5FF0004C CMP R0, R1
ROM:5FF00050 BEQ loc_5FF0007C
...
...
ROM:5FF000E8 loc_5FF000E8 ; CODE XREF: ROM:5FF000F0�j
ROM:5FF000E8 CMP R0, R1
ROM:5FF000EC STRLT R2, [R0],#4
ROM:5FF000F0 BLT loc_5FF000E8
ROM:5FF000F4 LDR R0, =(_ibootStart+1)
ROM:5FF000F8 MOV LR, PC
ROM:5FF000FC BX R0 ; _ibootStart
ROM:5FF00100
ROM:5FF00100 loc_5FF00100 ; CODE XREF: ROM:loc_5FF00100�j
ROM:5FF00100 B loc_5FF00100
</pre>

Where iBootStart (not the official Apple Symbol, of course) can be seen at:

<pre>
ROM:5FF00BA4 _ibootStart ; CODE XREF: ROM:5FF000FC�p
ROM:5FF00BA4 ; DATA XREF: ROM:5FF000F4�o ...
ROM:5FF00BA4 PUSH {R7,LR}
ROM:5FF00BA6 MOV R7, SP
ROM:5FF00BA8 LDR R0, =aIbootStart ; "\niBoot start\n"
ROM:5FF00BAA BL loc_5FF233C4
ROM:5FF00BAE MOVS R0, #0
ROM:5FF00BB0 BL loc_5FF16E54
ROM:5FF00BB4 BL loc_5FF1570C
ROM:5FF00BB8 BL loc_5FF143A8
ROM:5FF00BBC BL unk_5FF15264
ROM:5FF00BC0 LDR R0, =aMain ; "main"
..
</pre>

== Flow of iBoot (1219 - 5.0.x) ==
iBoot is quite a complicated binary, which spawns several ARM tasks to enable the boot process:

- iBootStart (disassembly started above) - starts main (5FF00BCA) - which calls the main function at 5FF00C14
- main: Does the good stuff (loading the kernel, etc)
starts the poweroff task (5FF00EF2) - calls (sub_5FF00FD0+1)
In recovery mode (failed boot):
starts command (5FF00F0A) - calls 5FF15928
starts idleoff (5FF99F2E) - calls 5FF01060

== Revisions ==
[[iBoot-99]] 1.0b (Build 1A420) [Unreleased]
[[iBoot-159]] 1.0 (Build 1A543a)
1.0.1 (Build 1C25)
1.0.2 (Build 1C28)
[[iBoot-204]] 1.1 (Build 3A100)
1.1 (Build 3A101)
1.1.1 (Build 3A109a)
[[iBoot-204.0.2]] 1.1.1 (Build 3A110a)
[[iBoot-204.2.9]] 1.1.2 (Build 3B48b)
[[iBoot-204.3.14]] 1.1.3 (Build 4A93)
1.1.4 (Build 4A102)
[[iBoot-204.3.16]] 1.1.5 (Build 4B1)
? 1.2b (Build 5A147p)
? 2.0b2 (Build 5A225c)
? 2.0b3 (Build 5A240d)
? 2.0b4 (Build 5A258f)
? 2.0b5 (Build 5A274d)
? 2.0b6P (Build 5A292g)
? 2.0b6F (Build 5A308)
? 2.0b7 (Build 5A331)
? 2.0b8[[Golden Master|GM]] (Build 5A345)
[[iBoot-320.20]] 2.0 (Build 5A347)
2.0.1 (Build 5B108)
2.0.2 (Build 5C1)
? 2.1b (Build 5F90)
[[iBoot-385.22]] 2.1 (Build 5F137)
2.1.1 (Build 5F138)
? 2.2b (Build 5G29)
[[iBoot-385.49]] 2.2 (Build 5G77)
2.2 (Build 5G77a)
2.2.1 (Build 5H11)
2.2.1 (Build 5H11a)
? 3.0b (Build 7A238j)
[[iBoot-594.2~1]] 3.0b2 (Build 7A259g)
[[iBoot-596.6~3]] 3.0b3 (Build 7A280f)
[[iBoot-596.16~2]] 3.0b4 (Build 7A300g)
[[iBoot-596.20~1]] 3.0b5 (Build 7A312g)
[[iBoot-596.24~1]] 3.0 (Build 7A341)
3.0.1 (Build 7A400)
[[iBoot-636.26~2]] 3.1b (Build 7C97d)
iBoot-636.??~? 3.1b2 (Build 7C106c)
[[iBoot-636.47~1]] 3.1b3 (Build 7C116a)
[[iBoot-636.65~2]] 3.1 (Build 7C144)
[[iBoot-636.66~1]] 3.1.1 (Build 7C145)
3.1.1 (Build 7C146)
[[iBoot-636.66~5]] 3.1.2 (Build 7D11)
[[iBoot-636.66.33~4]] 3.1.3 (Build 7E18)
[[iBoot-817.28~18]] 3.2 (Build 7B367)
[[iBoot-817.29~2]] 3.2.1 (Build 7B405)
3.2.2 (Build 7B500)
[[iBoot-822.2.1]] development build for [[n90ap]] dated 2009.
[[iBoot-872~12]] 4.0b (Build 8A230m)
[[iBoot-889.3~2]] 4.0b2 (Build 8A248c)
[[iBoot-889.12~2]] 4.0b3 (Build 8A260b)
[[iBoot-889.19~1]] 4.0b4 (Build 8A274b)
[[iBoot-889.24~4]] 4.0[[Golden Master|GM]] (Build 8A293)
4.0 (Build 8A293)
4.0.1 (Build 8A306)
4.0.2 (Build 8A400)
[[iBoot-931.18.1~1]] 4.1b (Build 8B5080c)
[[iBoot-931.18.15~2]] 4.1b2 (Build 8B5091b)
[[iBoot-931.18.27~1]] 4.1 (Build 8B117)
4.1 (Build 8B118)
[[iBoot-931.67~2]] 4.2b (Build 8C5091e)
[[iBoot-931.71.80~1]] 4.2b2 (Build 8C5101c)
[[iBoot-931.71.13~3]] 4.2b3 (Build 8C5115c)
[[iBoot-931.71.16~9]] 4.2[[Golden Master|GM]] (Build 8C134)
4.2[[Golden Master|GM]] (Build 8C134b)
4.2.1[[Golden Master|GM]] (Build 8C148)
4.2.1 (Build 8C148)
4.2.1 (Build 8C148a)
[[iBoot-931.72.14~6]] 4.2.5 (Build 8E128)
4.2.6 (Build 8E200)
4.2.7 (Build 8E303)
4.2.8 (Build 8E401)
[[iBoot-931.72.14~10]] 4.2.9 (Build 8E501)
4.2.10 (Build 8E600)
[[iBoot-1072.33~1]] 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.3b3 (Build 8F5166b)
[[iBoot-1072.58~4]] 4.3[[Golden Master|GM]] (Build 8F190)
4.3 (Build 8F190)
[[iBoot-1072.59~2]] 4.3 (Build 8F191)
4.3.1 (Build 8G4)
[[iBoot-1072.61~2]] 4.3.2 (Build 8H7)
4.3.2 (Build 8H8)
4.3.3 (Build 8J2)
4.3.3 (Build 8J3)
[[iBoot-1072.61~6]] 4.3.4 (Build 8K2)
4.3.5 (Build 8L1)
[[iBoot-1219.35.80~1]] 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 5.0b3 (Build 9A5259f)
[[iBoot-1219.42.8~1]] 5.0b4 (Build 9A5274d)
[[iBoot-1219.43.9~3]] 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~15]] 5.0[[Golden Master|GM]] (Build 9A332) [Unreleased]
5.0[[Golden Master|GM]] (Build 9A334)
5.0 (Build 9A334)
[[iBoot-1219.43.32~27]] 5.0.1b1 (Build 9A402)
[[iBoot-1219.43.32~29]] 5.0.1b2 (Build 9A404)
5.0.1 (Build 9A405)
5.0.1 (Build 9A406)
[[iBoot-1219.61.19~6]] 5.1b (Build 9B5117b)
[[iBoot-1219.62.1~2]] 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15]] 5.1 (Build 9B176)
[[iBoot-1219.62.15~2]] 5.1 (Build 9B179b)
5.1.1 (Build 9B206)
[[iBoot-1537.1.60~15]] 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.18~2]] 6.0[[Golden Master|GM]] (Build 10A403)
6.0 (Build 10A403)
[[iBoot-1537.4.19~1]] 6.0 (Build 10A405)
6.0 (Build 10A406)
[[iBoot-1537.4.20~1]] 6.0 (Build 10A407)
[[iBoot-1537.4.21~3]] 6.0.1 (Build 10A523)
6.0.1 (Build 10A525)
[[iBoot-1537.4.21~2]] 6.0.1 (Build 10A8426)
6.0.2 (Build 10A8500)
[[iBoot-1537.4.21~3]] 6.0.2 (Build 10A550)
6.0.2 (Build 10A551)
[[iBoot-1537.9.40~3]] 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 6.1b2 (Build 10B5105c)
6.1b3 (Build 10B5117b)
6.1b4 (Build 10B5126b)
[[iBoot-1537.9.55~4]] 6.1b5 (Build 10B141)
6.1b5 (Build 10B142)
6.1b5 (Build 10B143)
6.1b5 (Build 10B144)
6.1 (Build 10B141)
6.1 (Build 10B142)
6.1 (Build 10B143)
6.1 (Build 10B144)
6.1.1b (Build 10B311)
6.1.1 (Build 10B145)
6.1.2 (Build 10B146)
6.1.2 (Build 10B147)
[[iBoot-1537.9.55~11]] 6.1.3b2 (Build 10B318)
6.1.3b2 (Build 10B318a)
6.1.3 (Build 10B329)
6.1.4 (Build 10B350)
6.1.5 (Build 10B400)
6.1.6 (Build 10B500)
[[iBoot-1940.1.8~44]] 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.46.1.1~1]] 7.0b3 (Build 11A4414e)
[[iBoot-1940.1.66~9]] 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 7.0b5 (Build 11A4449a)
7.0b6 (Build 11A4449d)
[[iBoot-1940.1.75~20]] 7.0[[Golden Master|GM]] (Build 11A465)
7.0 (Build 11A465)
[[iBoot-1940.1.75~93]] 7.0.1 (Build 11A470a)
7.0.2 (Build 11A501)
[[iBoot-1940.3.5~1]] 7.0.3 (Build 11B511)
7.0.4 (Build 11B554a)
7.0.5 (Build 11B601)
7.0.6 (Build 11B651)
[[iBoot-1940.10.51~3]] 7.1b (Build 11D5099e)
[[iBoot-1940.10.57~8]] 7.1b2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 7.1b3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 7.1b4 (Build 11D5134c)
[[iBoot-1940.10.58~70]] 7.1b5 (Build 11D5145e)
[[iBoot-1940.10.58~115]] 7.1 (Build 11D167)
7.1 (Build 11D169)
[[iBoot-1940.10.58~122]] 7.1.1 (Build 11D201)
[[iBoot-1940.10.58~132]] 7.1.2 (Build 11D257)
[[iBoot-2261.1.6.0.1~45]] 8.0b (Build 12A4265u)
[[iBoot-2261.1.31~21]] 8.0b2 (Build 12A4297e)
[[iBoot-2261.1.46~31]] 8.0b3 (Build 12A4318c)
[[iBoot-2261.1.57~43]] 8.0b4 (Build 12A4331d)
[[iBoot-2261.1.64~28]] 8.0b5 (Build 12A4345d)
[[iBoot-2261.1.67~8]] 8.0[[Golden Master|GM]] (Build 12A365)
8.0 (Build 12A365)
8.0 (Build 12A366)
[[iBoot-2261.1.68~1]] 8.0.1 (Build 12A402)
8.0.2 (Build 12A405)
[[iBoot-2261.3.31~3]] 8.1b (Build 12B401)
[[iBoot-2261.3.31~9]] 8.1b2 (Build 12B407)
[[iBoot-2261.3.32~2]] 8.1 (Build 12B410)
8.1 (Build 12B411)
[[iBoot-2261.3.33~13]] 8.1.1b (Build 12B432)
[[iBoot-2261.3.33~14]] 8.1.1 (Build 12B435)
8.1.1 (Build 12B436)
8.1.2 (Build 12B440)
[[iBoot-2261.3.33~39]] 8.1.3 (Build 12B446)
[[iBoot-2261.5.34~3]] 8.2b (Build 12D436)
[[iBoot-2261.5.41~10]] 8.2b2 (Build 12D445d)
[[iBoot-2261.5.47~1]] 8.2b3 (Build 12D5452a)
[[iBoot-2261.5.54~3]] 8.2b4 (Build 12D5461b)
[[iBoot-2261.5.58~25]] 8.2b5 (Build 12D5480a)
[[iBoot-2261.5.64~15]] 8.2 (Build 12D508)
iBoot-2261.??.??~?? 8.3b (Build 12F5027d)
iBoot-2261.??.??~?? 8.3b2 (Build 12F5037c)
[[iBoot-2261.20.19~16]] 8.3b3 (Build 12F5047f)
[[iBoot-2261.20.20~9]] 8.3b4 (Build 12F5061)

=== [[Apple TV]] ===
[[iBoot-931.44.21~1]] 4.0 4.1 (Build 8M89)
[[iBoot-931.71.16~9]] 4.1 4.2 (Build 8C150)
4.1.1 4.2.1 (Build 8C154)
[[iBoot-1072.33~1]] 4.2b 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.2b2 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.2b3 4.3b3 (Build 8F5166b)
[[iBoot-1072.59~2]] 4.2 4.3 (Build 8F191m)
4.2.1 4.3 (Build 8F202)
4.2.2 4.3 (Build 8F305)
4.3 4.3 (Build 8F455)
[[iBoot-1219.35.80~1]] 4.4b 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 4.4b2 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 4.4b3 5.0b3 (Build 9A5259f)
[[iBoot-1219.43.9~3]] 4.4b5 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 4.4b6 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 4.4b7 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~21]] 4.4 5.0 (Build 9A334v)
[[iBoot-1219.43.32~22]] 4.4.1 5.0 (Build 9A335a)
4.4.2 5.0 (Build 9A336a)
[[iBoot-1219.43.32~29]] 4.4.3 5.0.1 (Build 9A405l)
4.4.4 5.0.1 (Build 9A406a)
[[iBoot-1219.62.1~2]] 5.0b2 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.0b3 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15~2]] 5.0 5.1 (Build 9B179b)
[[iBoot-1537.1.60~15]] 5.1b 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 5.1b2 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 5.1b3 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 5.1b4 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.19~1]] 5.1 6.0 (Build 10A406e)
[[iBoot-1537.4.21~3]] 5.1.1 6.0.1 (Build 10A831)
[[iBoot-1537.9.40~3]] 5.2b 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 5.2b2 6.1b2 (Build 10B5105c)
5.2b3 6.1b3 (Build 10B5117d)
5.2b4 6.1b4 (Build 10B5126d)
[[iBoot-1537.9.55~4]] 5.2 6.1 (Build 10B144b)
[[iBoot-1537.9.55~11]] 5.2.1 6.1.3 (Build 10B329a)
[[iBoot-1537.9.55~11]] 5.3 6.1.4 (Build 10B809)
[[iBoot-1940.1.8~44]] 5.4b 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 5.4b2 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.66~9]] 6.0b3 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 6.0b4 7.0b5 (Build 11A4449a)
[[iBoot-1940.1.75~93]] 6.0 7.0.1 (Build 11A470e)
6.0 7.0.2 (Build 11A502)
[[iBoot-1940.3.5~1]] 6.0.1 7.0.3 (Build 11B511d)
6.0.2 7.0.4 (Build 11B554a)
[[iBoot-1940.10.51~3]] 6.1b 7.1b (Build 11D5099e)
[[iBoot-1940.10.57~8]] 6.1b2 7.1b2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 6.1b3 7.1b3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 6.1b4 7.1b4 (Build 11D5134c)
[[iBoot-1940.10.58~70]] 6.1b5 7.1b5 (Build 11D5145e)
[[iBoot-1940.10.58~115]] 6.1 7.1 (Build 11D167)
[[iBoot-1940.10.58~122]] 6.1.1 7.1.1 (Build 11D201c)
[[iBoot-1940.10.58~132]] 6.2 7.1.2 (Build 11D257c)
6.2.1 7.1.2 (Build 12A365b)
[[iBoot-2261.1.31~21]] 7.0b 8.0b (Build 12A4297e)
[[iBoot-2261.1.46~31]] 7.0b2 8.0b3 (Build 12A4318c)
[[iBoot-2261.1.57~43]] 7.0b3 8.0b4 (Build 12A4331d)
[[iBoot-2261.1.64~28]] 7.0b4 8.0b5 (Build 12A4345d)
[[iBoot-2261.1.67~8]] 7.0[[Golden Master|GM]] 8.0[[Golden Master|GM]] (Build 12A365b)
7.0 8.0 (Build 12A365b)
[[iBoot-2261.3.31~3]] 7.0.1b 8.1b (Build 12B401)
[[iBoot-2261.3.31~9]] 7.0.1b2 8.1b2 (Build 12B407)
[[iBoot-2261.3.32~2]] 7.0.1 8.1 (Build 12B410a)
[[iBoot-2261.3.33~13]] 7.0.2b 8.1.1b (Build 12B432)
[[iBoot-2261.3.33~14]] 7.0.2 8.1.1 (Build 12B435)
[[iBoot-2261.3.33~39]] 7.0.3 8.1.3 (Build 12B446)
iBoot-2261.?.??~?? 7.1b 8.2b5 (Build 12D5480a)
[[iBoot-2261.5.64~15]] 7.1 8.2 (Build 12D508)
iBoot-2261.?.??~?? 7.1b2 8.3b2 (Build 12F5037c)
[[iBoot-2261.20.20~9]] 7.1b3 8.3b4 (Build 12F5061)

=== [[Haywire]] ===
[[iBoot-1537.9.55~3]] 1.0.0 (Build 10B7129)

== [[Exploits]] ==
On 1st February, 2014, iH8sn0w found a very powerful iBoot exploit that allows any iDevice with an [[S5L8940|A5]] or [[S5L8945|A5X]] chip to be jailbroken, regardless of the iOS version. He used it mainly to grab AES [[Firmware Keys|decryption keys]]. However, according to [https://twitter.com/winocm/status/429704672211763200 this tweet from winocm], the exploit will never go public. Once he cleans it up a bit, the [[Firmware Keys|decryption keys]] will be available [http://www.icj.me/ios/keys here].
He mentioned [https://twitter.com/iH8sn0w/status/429838704077979648 here] that it will work on [[A6]] and [[A7]] chips soon, but it will require some minor modifications.

== Commands used as an exploit vector ==
* '''diags''': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* '''arm7_go''': For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

== OpeniBoot ==
There is an open source version of iBoot designed so that custom kernels can be run on the iPhone/iPod/iPad. You can check out the source [http://github.com/iDroid-Project/OpeniBoot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.
OpeniBoot currently supports all S5l8900, S5l8720, S5l8920 and S5l8930 devices. More info can be found about OpeniBoot and Linux on these devices on the iDroid-Project [http://idroidproject.org website].

== Remappings ==
// n88 (3GS)
0x4FF00000 => 0x0
0x40000000 => 0xC0000000

== See also ==
* [[iBoot (Enums)]]
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

[[Category:iBoot]]

NOR (SysCfg)

2015-03-29T12:55:48Z

Rzhikharevich:

'''SysCfg''' is a section of the S5L [[NOR]] (or [[NAND]]) that stores vital information such as your device's model number and serial number.

==Importance==
Although it is very important to have this, as [[iBoot]] needs to populate the [[DeviceTree]] with this information, it appears that some people have been able to overwrite their [[NOR]] with garbage and somehow got this data back after a restore. In the case of the [[N72ap|iPod touch 2G]], this section of [[NOR]] seems to be read-only by default.

This varies by device - on other devices, if you alter SysCfg, the device may be [[bricked]].

I0n1c

2015-03-29T03:32:23Z

Rzhikharevich: /* Presentations */ A new one.

{{lowercase}}
'''i0n1c''', whose real name is Stefan Esser, is a German security researcher. He developed [[Antid0te]], an [[wikipedia:Address space layout randomization|ASLR]] for jailbroken [[iPhone]]s in fall 2010, but never released it, because [[iOS]] since 4.3 includes an implementation of ASLR. He developed an untethering exploit for iOS 4.3. He gave a version of the exploit that worked on iOS 4.3.1 to the [[iPhone Dev Team]] which updated [[redsn0w]] and [[PwnageTool]] to use it and released the new tools on 4 April 2011. [[sn0wbreeze]] was also updated to include his untether. As the vulnerability went unpatched in iOS 4.3.2 and 4.3.3, he updated his code later to support those firmwares. An iOS 4.3-compatible version was never released. His exploit was used in [[Pangu]] jailbreak.

===Presentations===
*[http://www.slideshare.net/i0n1c/syscan-2015-esserios678securityastudyinfail iOS 678 Security - A Study in Fail]
*[http://www.slideshare.net/i0n1c/ruxcon-2014-stefan-esser-ios8-containers-sandboxes-and-entitlements Ruxcon 2014 - iOS8 Containers, Sandboxes and Entitlements]
*[http://conference.hitb.org/hitbsecconf2011kul/materials/D2T1%20-%20Stefan%20Esser%20-%20iPhone%20Exploitation%20-%20One%20ROPe%20to%20Bind%20Them%20All.pdf HITB 2011 Malaysia: iPhone Exploitation - One ROPe to bind them all?]
*[http://antid0te.com/CSW2012_StefanEsser_iOS5_An_Exploitation_Nightmare_FINAL.pdf CanSecWest 2012: iOS5, an Exploitation Nightmare (PDF)]
*[https://media.blackhat.com/bh-us-11/Esser/BH_US_11_Esser_Exploiting_The_iOS_Kernel_Slides.pdf BlackHat US 2011: Exploiting the iOS Kernel (PDF)]

===Links===
*[https://twitter.com/i0n1c i0n1c on Twitter]
*[http://www.suspekt.org Homepage]
*[https://github.com/stefanesser GitHub]
[[Category:Hackers]]
[[Category:Security Researcher]]

IBoot (Bootloader)

2015-03-29T01:42:43Z

Rzhikharevich: /* Revisions */ Not sure, if this should be placed here.

{{lowercase}}
'''iBoot''' is Apple's stage 2 bootloader for all of the [[iDevice|devices]]. It runs what is known as [[Recovery Mode]]. It has an interactive interface which can be used over USB or serial.

== [[Bootrom]] ==
The bootrom also goes by the name "iBoot." The list of bootroms can be found on [[Bootrom|their own page]].

== Extract and Disassemble ==
To extract the bootloader and disassemble using IDA, follow the following steps:
#obtain the bootloader from the iPSW. This file is in the <code>Firmware/all_flash</code> subdir, e.g. <code>Firmware/all_flash/all_flash.n81ap.production/iBoot.n81ap.RELEASE.img3</code>, where the "n81ap", "k90", etc.. are for the i-Device type
#run xpwntool with the proper key (from elsewhere in this Wiki)
#Make sure the decryption was successful - if it is, you should see:
"iBoot for ...., Copyright 2011, Apple Inc."
if you cat (i.e. type) the file.
<ol><li value="4">remove the img3 header - the good stuff starts at offset 0x40 (i.e. 64) - using dd (skip=1 bs=64) or some other tool</li>
<li>Load in IDA. Set processor to ARM. Rebase program (Edit→Segments→Rebase Program) to 0x5FF00000 (for iBoot in iOS 5). You should see something like:</li></ol>

<pre>
ROM:5FF00000 loc_5FF00000 ; CODE XREF: ROM:5FF00078�j
ROM:5FF00000 B loc_5FF00040 ; Used for Reset - This is where we start
ROM:5FF00004 ; ---------------------------------------------------------------------------
ROM:5FF00004 LDR PC, =sub_5FF16FB4 ; Used for Undef
ROM:5FF00008 ; ---------------------------------------------------------------------------
ROM:5FF00008 LDR PC, =sub_5FF16FEC ; Used for SWI
ROM:5FF0000C ; ---------------------------------------------------------------------------
ROM:5FF0000C LDR PC, =sub_5FF17024 ; Used for Prefabt
ROM:5FF00010 ; ---------------------------------------------------------------------------
ROM:5FF00010 LDR PC, =sub_5FF17060 ; Used for DataAbt
ROM:5FF00014 ; ---------------------------------------------------------------------------
ROM:5FF00014 LDR PC, =loc_5FF17098 ; Used for AddrExc
ROM:5FF00018 ; ---------------------------------------------------------------------------
ROM:5FF00018 LDR PC, =loc_5FF16F24 ; Used for IRQ
ROM:5FF0001C ; ---------------------------------------------------------------------------
ROM:5FF0001C LDR PC, =sub_5FF16F6C ; Probably FIQ, need to verify this
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00020 SVCPL 0xF00040
ROM:5FF00020 ; ---------------------------------------------------------------------------
ROM:5FF00024 off_5FF00024 DCD sub_5FF16FB4 ; DATA XREF: ROM:5FF00004�r
ROM:5FF00028 off_5FF00028 DCD sub_5FF16FEC ; DATA XREF: ROM:5FF00008�r
ROM:5FF0002C off_5FF0002C DCD sub_5FF17024 ; DATA XREF: ROM:5FF0000C�r
ROM:5FF00030 off_5FF00030 DCD sub_5FF17060 ; DATA XREF: ROM:5FF00010�r
ROM:5FF00034 off_5FF00034 DCD loc_5FF17098 ; DATA XREF: ROM:5FF00014�r
ROM:5FF00038 off_5FF00038 DCD loc_5FF16F24 ; DATA XREF: ROM:5FF00018�r
ROM:5FF0003C off_5FF0003C DCD sub_5FF16F6C ; DATA XREF: ROM:5FF0001C�r
ROM:5FF00040 ; ---------------------------------------------------------------------------
ROM:5FF00040
ROM:5FF00040 loc_5FF00040 ; CODE XREF: ROM:loc_5FF00000�j
ROM:5FF00040 ADR R0, loc_5FF00000 <-- The address we rebased to
ROM:5FF00044 LDR R1, =loc_5FF00000
ROM:5FF00048 CMP R0, R1
ROM:5FF0004C CMP R0, R1
ROM:5FF00050 BEQ loc_5FF0007C
...
...
ROM:5FF000E8 loc_5FF000E8 ; CODE XREF: ROM:5FF000F0�j
ROM:5FF000E8 CMP R0, R1
ROM:5FF000EC STRLT R2, [R0],#4
ROM:5FF000F0 BLT loc_5FF000E8
ROM:5FF000F4 LDR R0, =(_ibootStart+1)
ROM:5FF000F8 MOV LR, PC
ROM:5FF000FC BX R0 ; _ibootStart
ROM:5FF00100
ROM:5FF00100 loc_5FF00100 ; CODE XREF: ROM:loc_5FF00100�j
ROM:5FF00100 B loc_5FF00100
</pre>

Where iBootStart (not the official Apple Symbol, of course) can be seen at:

<pre>
ROM:5FF00BA4 _ibootStart ; CODE XREF: ROM:5FF000FC�p
ROM:5FF00BA4 ; DATA XREF: ROM:5FF000F4�o ...
ROM:5FF00BA4 PUSH {R7,LR}
ROM:5FF00BA6 MOV R7, SP
ROM:5FF00BA8 LDR R0, =aIbootStart ; "\niBoot start\n"
ROM:5FF00BAA BL loc_5FF233C4
ROM:5FF00BAE MOVS R0, #0
ROM:5FF00BB0 BL loc_5FF16E54
ROM:5FF00BB4 BL loc_5FF1570C
ROM:5FF00BB8 BL loc_5FF143A8
ROM:5FF00BBC BL unk_5FF15264
ROM:5FF00BC0 LDR R0, =aMain ; "main"
..
</pre>

== Flow of iBoot (1219 - 5.0.x) ==
iBoot is quite a complicated binary, which spawns several ARM tasks to enable the boot process:

- iBootStart (disassembly started above) - starts main (5FF00BCA) - which calls the main function at 5FF00C14
- main: Does the good stuff (loading the kernel, etc)
starts the poweroff task (5FF00EF2) - calls (sub_5FF00FD0+1)
In recovery mode (failed boot):
starts command (5FF00F0A) - calls 5FF15928
starts idleoff (5FF99F2E) - calls 5FF01060

== Revisions ==
[[iBoot-99]] 1.0b (Build 1A420) [Unreleased]
[[iBoot-159]] 1.0 (Build 1A543a)
1.0.1 (Build 1C25)
1.0.2 (Build 1C28)
[[iBoot-204]] 1.1 (Build 3A100)
1.1 (Build 3A101)
1.1.1 (Build 3A109a)
[[iBoot-204.0.2]] 1.1.1 (Build 3A110a)
[[iBoot-204.2.9]] 1.1.2 (Build 3B48b)
[[iBoot-204.3.14]] 1.1.3 (Build 4A93)
1.1.4 (Build 4A102)
[[iBoot-204.3.16]] 1.1.5 (Build 4B1)
? 1.2b (Build 5A147p)
? 2.0b2 (Build 5A225c)
? 2.0b3 (Build 5A240d)
? 2.0b4 (Build 5A258f)
? 2.0b5 (Build 5A274d)
? 2.0b6P (Build 5A292g)
? 2.0b6F (Build 5A308)
? 2.0b7 (Build 5A331)
? 2.0b8[[Golden Master|GM]] (Build 5A345)
[[iBoot-320.20]] 2.0 (Build 5A347)
2.0.1 (Build 5B108)
2.0.2 (Build 5C1)
? 2.1b (Build 5F90)
[[iBoot-385.22]] 2.1 (Build 5F137)
2.1.1 (Build 5F138)
? 2.2b (Build 5G29)
[[iBoot-385.49]] 2.2 (Build 5G77)
2.2 (Build 5G77a)
2.2.1 (Build 5H11)
2.2.1 (Build 5H11a)
? 3.0b (Build 7A238j)
[[iBoot-594.2~1]] 3.0b2 (Build 7A259g)
[[iBoot-596.6~3]] 3.0b3 (Build 7A280f)
[[iBoot-596.16~2]] 3.0b4 (Build 7A300g)
[[iBoot-596.20~1]] 3.0b5 (Build 7A312g)
[[iBoot-596.24~1]] 3.0 (Build 7A341)
3.0.1 (Build 7A400)
[[iBoot-636.26~2]] 3.1b (Build 7C97d)
iBoot-636.??~? 3.1b2 (Build 7C106c)
[[iBoot-636.47~1]] 3.1b3 (Build 7C116a)
[[iBoot-636.65~2]] 3.1 (Build 7C144)
[[iBoot-636.66~1]] 3.1.1 (Build 7C145)
3.1.1 (Build 7C146)
[[iBoot-636.66~5]] 3.1.2 (Build 7D11)
[[iBoot-636.66.33~4]] 3.1.3 (Build 7E18)
[[iBoot-817.28~18]] 3.2 (Build 7B367)
[[iBoot-817.29~2]] 3.2.1 (Build 7B405)
3.2.2 (Build 7B500)
[[iBoot-822.2.1]] development build for n90ap dated 2009.
[[iBoot-872~12]] 4.0b (Build 8A230m)
[[iBoot-889.3~2]] 4.0b2 (Build 8A248c)
[[iBoot-889.12~2]] 4.0b3 (Build 8A260b)
[[iBoot-889.19~1]] 4.0b4 (Build 8A274b)
[[iBoot-889.24~4]] 4.0[[Golden Master|GM]] (Build 8A293)
4.0 (Build 8A293)
4.0.1 (Build 8A306)
4.0.2 (Build 8A400)
[[iBoot-931.18.1~1]] 4.1b (Build 8B5080c)
[[iBoot-931.18.15~2]] 4.1b2 (Build 8B5091b)
[[iBoot-931.18.27~1]] 4.1 (Build 8B117)
4.1 (Build 8B118)
[[iBoot-931.67~2]] 4.2b (Build 8C5091e)
[[iBoot-931.71.80~1]] 4.2b2 (Build 8C5101c)
[[iBoot-931.71.13~3]] 4.2b3 (Build 8C5115c)
[[iBoot-931.71.16~9]] 4.2[[Golden Master|GM]] (Build 8C134)
4.2[[Golden Master|GM]] (Build 8C134b)
4.2.1[[Golden Master|GM]] (Build 8C148)
4.2.1 (Build 8C148)
4.2.1 (Build 8C148a)
[[iBoot-931.72.14~6]] 4.2.5 (Build 8E128)
4.2.6 (Build 8E200)
4.2.7 (Build 8E303)
4.2.8 (Build 8E401)
[[iBoot-931.72.14~10]] 4.2.9 (Build 8E501)
4.2.10 (Build 8E600)
[[iBoot-1072.33~1]] 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.3b3 (Build 8F5166b)
[[iBoot-1072.58~4]] 4.3[[Golden Master|GM]] (Build 8F190)
4.3 (Build 8F190)
[[iBoot-1072.59~2]] 4.3 (Build 8F191)
4.3.1 (Build 8G4)
[[iBoot-1072.61~2]] 4.3.2 (Build 8H7)
4.3.2 (Build 8H8)
4.3.3 (Build 8J2)
4.3.3 (Build 8J3)
[[iBoot-1072.61~6]] 4.3.4 (Build 8K2)
4.3.5 (Build 8L1)
[[iBoot-1219.35.80~1]] 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 5.0b3 (Build 9A5259f)
[[iBoot-1219.42.8~1]] 5.0b4 (Build 9A5274d)
[[iBoot-1219.43.9~3]] 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~15]] 5.0[[Golden Master|GM]] (Build 9A332) [Unreleased]
5.0[[Golden Master|GM]] (Build 9A334)
5.0 (Build 9A334)
[[iBoot-1219.43.32~27]] 5.0.1b1 (Build 9A402)
[[iBoot-1219.43.32~29]] 5.0.1b2 (Build 9A404)
5.0.1 (Build 9A405)
5.0.1 (Build 9A406)
[[iBoot-1219.61.19~6]] 5.1b (Build 9B5117b)
[[iBoot-1219.62.1~2]] 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15]] 5.1 (Build 9B176)
[[iBoot-1219.62.15~2]] 5.1 (Build 9B179b)
5.1.1 (Build 9B206)
[[iBoot-1537.1.60~15]] 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.18~2]] 6.0[[Golden Master|GM]] (Build 10A403)
6.0 (Build 10A403)
[[iBoot-1537.4.19~1]] 6.0 (Build 10A405)
6.0 (Build 10A406)
[[iBoot-1537.4.20~1]] 6.0 (Build 10A407)
[[iBoot-1537.4.21~3]] 6.0.1 (Build 10A523)
6.0.1 (Build 10A525)
[[iBoot-1537.4.21~2]] 6.0.1 (Build 10A8426)
6.0.2 (Build 10A8500)
[[iBoot-1537.4.21~3]] 6.0.2 (Build 10A550)
6.0.2 (Build 10A551)
[[iBoot-1537.9.40~3]] 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 6.1b2 (Build 10B5105c)
6.1b3 (Build 10B5117b)
6.1b4 (Build 10B5126b)
[[iBoot-1537.9.55~4]] 6.1b5 (Build 10B141)
6.1b5 (Build 10B142)
6.1b5 (Build 10B143)
6.1b5 (Build 10B144)
6.1 (Build 10B141)
6.1 (Build 10B142)
6.1 (Build 10B143)
6.1 (Build 10B144)
6.1.1b (Build 10B311)
6.1.1 (Build 10B145)
6.1.2 (Build 10B146)
6.1.2 (Build 10B147)
[[iBoot-1537.9.55~11]] 6.1.3b2 (Build 10B318)
6.1.3b2 (Build 10B318a)
6.1.3 (Build 10B329)
6.1.4 (Build 10B350)
6.1.5 (Build 10B400)
6.1.6 (Build 10B500)
[[iBoot-1940.1.8~44]] 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.46.1.1~1]] 7.0b3 (Build 11A4414e)
[[iBoot-1940.1.66~9]] 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 7.0b5 (Build 11A4449a)
7.0b6 (Build 11A4449d)
[[iBoot-1940.1.75~20]] 7.0[[Golden Master|GM]] (Build 11A465)
7.0 (Build 11A465)
[[iBoot-1940.1.75~93]] 7.0.1 (Build 11A470a)
7.0.2 (Build 11A501)
[[iBoot-1940.3.5~1]] 7.0.3 (Build 11B511)
7.0.4 (Build 11B554a)
7.0.5 (Build 11B601)
7.0.6 (Build 11B651)
[[iBoot-1940.10.51~3]] 7.1b (Build 11D5099e)
[[iBoot-1940.10.57~8]] 7.1b2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 7.1b3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 7.1b4 (Build 11D5134c)
[[iBoot-1940.10.58~70]] 7.1b5 (Build 11D5145e)
[[iBoot-1940.10.58~115]] 7.1 (Build 11D167)
7.1 (Build 11D169)
[[iBoot-1940.10.58~122]] 7.1.1 (Build 11D201)
[[iBoot-1940.10.58~132]] 7.1.2 (Build 11D257)
[[iBoot-2261.1.6.0.1~45]] 8.0b (Build 12A4265u)
[[iBoot-2261.1.31~21]] 8.0b2 (Build 12A4297e)
[[iBoot-2261.1.46~31]] 8.0b3 (Build 12A4318c)
[[iBoot-2261.1.57~43]] 8.0b4 (Build 12A4331d)
[[iBoot-2261.1.64~28]] 8.0b5 (Build 12A4345d)
[[iBoot-2261.1.67~8]] 8.0[[Golden Master|GM]] (Build 12A365)
8.0 (Build 12A365)
8.0 (Build 12A366)
[[iBoot-2261.1.68~1]] 8.0.1 (Build 12A402)
8.0.2 (Build 12A405)
[[iBoot-2261.3.31~3]] 8.1b (Build 12B401)
[[iBoot-2261.3.31~9]] 8.1b2 (Build 12B407)
[[iBoot-2261.3.32~2]] 8.1 (Build 12B410)
8.1 (Build 12B411)
[[iBoot-2261.3.33~13]] 8.1.1b (Build 12B432)
[[iBoot-2261.3.33~14]] 8.1.1 (Build 12B435)
8.1.1 (Build 12B436)
8.1.2 (Build 12B440)
[[iBoot-2261.3.33~39]] 8.1.3 (Build 12B446)
[[iBoot-2261.5.34~3]] 8.2b (Build 12D436)
[[iBoot-2261.5.41~10]] 8.2b2 (Build 12D445d)
[[iBoot-2261.5.47~1]] 8.2b3 (Build 12D5452a)
[[iBoot-2261.5.54~3]] 8.2b4 (Build 12D5461b)
[[iBoot-2261.5.58~25]] 8.2b5 (Build 12D5480a)
[[iBoot-2261.5.64~15]] 8.2 (Build 12D508)
iBoot-2261.??.??~?? 8.3b (Build 12F5027d)
iBoot-2261.??.??~?? 8.3b2 (Build 12F5037c)
[[iBoot-2261.20.19~16]] 8.3b3 (Build 12F5047f)
[[iBoot-2261.20.20~9]] 8.3b4 (Build 12F5061)

=== [[Apple TV]] ===
[[iBoot-931.44.21~1]] 4.0 4.1 (Build 8M89)
[[iBoot-931.71.16~9]] 4.1 4.2 (Build 8C150)
4.1.1 4.2.1 (Build 8C154)
[[iBoot-1072.33~1]] 4.2b 4.3b (Build 8F5148b)
[[iBoot-1072.38~2]] 4.2b2 4.3b2 (Build 8F5153d)
[[iBoot-1072.49~2]] 4.2b3 4.3b3 (Build 8F5166b)
[[iBoot-1072.59~2]] 4.2 4.3 (Build 8F191m)
4.2.1 4.3 (Build 8F202)
4.2.2 4.3 (Build 8F305)
4.3 4.3 (Build 8F455)
[[iBoot-1219.35.80~1]] 4.4b 5.0b (Build 9A5220p)
[[iBoot-1219.40.25~4]] 4.4b2 5.0b2 (Build 9A5248d)
[[iBoot-1219.41.11~1]] 4.4b3 5.0b3 (Build 9A5259f)
[[iBoot-1219.43.9~3]] 4.4b5 5.0b5 (Build 9A5288d)
[[iBoot-1219.43.18~3]] 4.4b6 5.0b6 (Build 9A5302b)
[[iBoot-1219.43.27~1]] 4.4b7 5.0b7 (Build 9A5313e)
[[iBoot-1219.43.32~21]] 4.4 5.0 (Build 9A334v)
[[iBoot-1219.43.32~22]] 4.4.1 5.0 (Build 9A335a)
4.4.2 5.0 (Build 9A336a)
[[iBoot-1219.43.32~29]] 4.4.3 5.0.1 (Build 9A405l)
4.4.4 5.0.1 (Build 9A406a)
[[iBoot-1219.62.1~2]] 5.0b2 5.1b2 (Build 9B5127c)
[[iBoot-1219.62.8~5]] 5.0b3 5.1b3 (Build 9B5141a)
[[iBoot-1219.62.15~2]] 5.0 5.1 (Build 9B179b)
[[iBoot-1537.1.60~15]] 5.1b 6.0b (Build 10A5316k)
[[iBoot-1537.2.11~5]] 5.1b2 6.0b2 (Build 10A5338d)
[[iBoot-1537.2.81~1]] 5.1b3 6.0b3 (Build 10A5355d)
[[iBoot-1537.2.41~2]] 5.1b4 6.0b4 (Build 10A5376e)
[[iBoot-1537.4.19~1]] 5.1 6.0 (Build 10A406e)
[[iBoot-1537.4.21~3]] 5.1.1 6.0.1 (Build 10A831)
[[iBoot-1537.9.40~3]] 5.2b 6.1b (Build 10B5095f)
[[iBoot-1537.9.46~8]] 5.2b2 6.1b2 (Build 10B5105c)
5.2b3 6.1b3 (Build 10B5117d)
5.2b4 6.1b4 (Build 10B5126d)
[[iBoot-1537.9.55~4]] 5.2 6.1 (Build 10B144b)
[[iBoot-1537.9.55~11]] 5.2.1 6.1.3 (Build 10B329a)
[[iBoot-1537.9.55~11]] 5.3 6.1.4 (Build 10B809)
[[iBoot-1940.1.8~44]] 5.4b 7.0b (Build 11A4372q)
[[iBoot-1940.1.35~9]] 5.4b2 7.0b2 (Build 11A4400f)
[[iBoot-1940.1.66~9]] 6.0b3 7.0b4 (Build 11A4435d)
[[iBoot-1940.1.75~3]] 6.0b4 7.0b5 (Build 11A4449a)
[[iBoot-1940.1.75~93]] 6.0 7.0.1 (Build 11A470e)
6.0 7.0.2 (Build 11A502)
[[iBoot-1940.3.5~1]] 6.0.1 7.0.3 (Build 11B511d)
6.0.2 7.0.4 (Build 11B554a)
[[iBoot-1940.10.51~3]] 6.1b 7.1b (Build 11D5099e)
[[iBoot-1940.10.57~8]] 6.1b2 7.1b2 (Build 11D5115d)
[[iBoot-1940.10.58~11]] 6.1b3 7.1b3 (Build 11D5127c)
[[iBoot-1940.10.58~32]] 6.1b4 7.1b4 (Build 11D5134c)
[[iBoot-1940.10.58~70]] 6.1b5 7.1b5 (Build 11D5145e)
[[iBoot-1940.10.58~115]] 6.1 7.1 (Build 11D167)
[[iBoot-1940.10.58~122]] 6.1.1 7.1.1 (Build 11D201c)
[[iBoot-1940.10.58~132]] 6.2 7.1.2 (Build 11D257c)
6.2.1 7.1.2 (Build 12A365b)
[[iBoot-2261.1.31~21]] 7.0b 8.0b (Build 12A4297e)
[[iBoot-2261.1.46~31]] 7.0b2 8.0b3 (Build 12A4318c)
[[iBoot-2261.1.57~43]] 7.0b3 8.0b4 (Build 12A4331d)
[[iBoot-2261.1.64~28]] 7.0b4 8.0b5 (Build 12A4345d)
[[iBoot-2261.1.67~8]] 7.0[[Golden Master|GM]] 8.0[[Golden Master|GM]] (Build 12A365b)
7.0 8.0 (Build 12A365b)
[[iBoot-2261.3.31~3]] 7.0.1b 8.1b (Build 12B401)
[[iBoot-2261.3.31~9]] 7.0.1b2 8.1b2 (Build 12B407)
[[iBoot-2261.3.32~2]] 7.0.1 8.1 (Build 12B410a)
[[iBoot-2261.3.33~13]] 7.0.2b 8.1.1b (Build 12B432)
[[iBoot-2261.3.33~14]] 7.0.2 8.1.1 (Build 12B435)
[[iBoot-2261.3.33~39]] 7.0.3 8.1.3 (Build 12B446)
iBoot-2261.?.??~?? 7.1b 8.2b5 (Build 12D5480a)
[[iBoot-2261.5.64~15]] 7.1 8.2 (Build 12D508)
iBoot-2261.?.??~?? 7.1b2 8.3b2 (Build 12F5037c)
[[iBoot-2261.20.20~9]] 7.1b3 8.3b4 (Build 12F5061)

=== [[Haywire]] ===
[[iBoot-1537.9.55~3]] 1.0.0 (Build 10B7129)

== [[Exploits]] ==
On 1st February, 2014, iH8sn0w found a very powerful iBoot exploit that allows any iDevice with an [[S5L8940|A5]] or [[S5L8945|A5X]] chip to be jailbroken, regardless of the iOS version. He used it mainly to grab AES [[Firmware Keys|decryption keys]]. However, according to [https://twitter.com/winocm/status/429704672211763200 this tweet from winocm], the exploit will never go public. Once he cleans it up a bit, the [[Firmware Keys|decryption keys]] will be available [http://www.icj.me/ios/keys here].
He mentioned [https://twitter.com/iH8sn0w/status/429838704077979648 here] that it will work on [[A6]] and [[A7]] chips soon, but it will require some minor modifications.

== Commands used as an exploit vector ==
* '''diags''': Until 2.0 beta 6, the [[diags]] command would jump to code at the address provided to it. For example, if you sent "diags 0x9000000", it would directly jump to the code at 0x9000000. There is now a check that only allows engineering devices to utilize this backdoor.
* '''arm7_go''': For firmware 2.1.1, the [[N72ap|iPod touch 2G]] iBoot contains the [[ARM7 Go]] command, which could be used to run a payload on the ARM7 in the device.

== OpeniBoot ==
There is an open source version of iBoot designed so that custom kernels can be run on the iPhone/iPod/iPad. You can check out the source [http://github.com/iDroid-Project/OpeniBoot here]. It is VERY useful if you are ever reversing iBoot and do not feel like finding out what certain hardware registers are yourself.
OpeniBoot currently supports all S5l8900, S5l8720, S5l8920 and S5l8930 devices. More info can be found about OpeniBoot and Linux on these devices on the iDroid-Project [http://idroidproject.org website].

== Remappings ==
// n88 (3GS)
0x4FF00000 => 0x0
0x40000000 => 0xC0000000

== See also ==
* [[iBoot (Enums)]]
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]

[[Category:iBoot]]

Brick

2015-03-29T00:21:48Z

Rzhikharevich: /* Intentionally modifying key parts of iOS: changing NVRAM variables to invalid values */ Apple iOS and Cisco IOS are entirely different things (notice the 'i').

A '''bricked''' device is a device that does not work. The direct metaphorical meaning is that the device is permanently damaged (making it as useless as a brick), but people use the term "bricked" for non-working conditions which range from easy to fix (such as a failed update) to impossible to fix (such as damaged baseband memory). A phone may be called "bricked" if it will not boot, will not respond to input, will not make calls, etc.

== Difficulty of bricking an iOS device ==

Using a jailbreaking tool cannot put a device into an unusable state on its own - if something goes wrong while jailbreaking, putting the device into [[DFU Mode]] will allow you to restore it via iTunes. Installing software via Cydia also cannot cause an unrecoverable state (unless very specifically designed to do so by a malicious person, which has not been seen "in the wild"). Other than that specific exception, if something goes wrong, DFU mode will still work.

== Types of "bricking" that can be easily fixed (not really "bricking") ==

=== Installing stock iOS on a device with a preserved baseband ===

Early unlock solutions could result in unusable (but recoverable) phones after installing an iOS update if you didn't take special steps. For people who used [[redsn0w]] to install the iPad baseband ([[06.15.00]]) on a compatible iPhone 3G or iPhone 3GS so that they could use [[ultrasn0w]] to carrier unlock it, upgrading or restoring iOS using "stock" (normal) IPSWs would make the phone unusable - until you made and restored a "custom" IPSW without a baseband update ([http://www.jailbreakqa.com/faq#32532 instructions]), and then reinstalled the iPad baseband using redsn0w. Avoiding doing a stock upgrade/restore (upgrading or restoring iOS using a "custom" IPSW) avoided this problem.

=== Intentionally modifying key parts of iOS: changing NVRAM variables to invalid values ===

In February 2015, [http://dayt0n.github.io/articles/dclr-override/ researchers released information] about how to change an [[NOR (NVRAM)|nvram]] variable called <code>DClr_override</code>. If this is changed to an invalid value for the device (valid values are not the same on all devices), and the device is rebooted, the device will not be able to boot. This can be fixed by restoring to iOS 8.3 beta 4 or later.

== Types of bricking that may be hard to fix ==

=== Changing MAC address to invalid address ===

If you change your device's MAC address to something invalid (for example if you're attempting to change your [[UDID]]), your internet won't work again until you fix the MAC address (using MobileTerminal or similar). This persists even if you restore -- so you can make this really really hard to fix if you restore and there's no jailbreak available, if the available jailbreaks don't include afc2 and other workarounds aren't working, etc. [http://www.jailbreakqa.com/questions/277646/stuck-after-mac-address-change-can-i-revive-it Here's a JailbreakQA thread about this] and [http://www.jailbreakqa.com/questions/211048/how-to-install-afc2add-without-using-wi-fi-in-a-jailbroken-ipad-3-with-704 another one].

=== Intentionally modifying key parts of iOS: other ways ===

If you purposefully erase / zero out your [[NOR]], then you will have trouble doing a DFU restore because important information from the [[NOR (SysCfg)|SysCfg]] section will not be available.

[http://www.reddit.com/r/jailbreak/comments/1m3jo6/how_much_torture_kernel_user_based_etc_would_it/cc5g8nj See winocm's explanation of several related ways to brick a device]:

<blockquote>
* Erase SysCfg/replace it with 0xFFs.
* Destroy the 'SrNm' tag in the SysCfg, it won't activate then.
* Set all clock gates enabled and set PLL frequencies to mad numbers, THIS WILL DAMAGE THE HARDWARE.
* Run constant NAND stress tests to wear out NAND pages.
* Set the 'display-timing' nvram variable to some other garbage. iPod touch 2G/3G does weird things with that.

If you know how the hardware works, this can be done from an iBoot/kernel level.
</blockquote>

=== Making the wrong modifications to the baseband ===

One way to irreversibly brick a device in software is to flash an invalid [[Baseband Bootloader|baseband bootloader]], provided it has a baseband. Most other bad flash scenarios are recoverable some way or another.

Another way to brick the baseband is by installing baseband [[06.15.00]] on an incompatible device. [[redsn0w]] has an option to install this baseband on the [[N82ap|iPhone 3G]] or [[N88ap|iPhone 3GS]] in order to get a baseband version that is unlockable with [[ultrasn0w]]. This is a nice way to get an unlock, because the [[K48ap|iPad]], the [[N82ap|iPhone 3G]] and the [[N88ap|iPhone 3GS]] all share the same [[Baseband Device]], but the [[K48ap|iPad]] has a newer version number in its baseband. That way people can actually downgrade by installing a higher version (there are no [[APTicket]] checks in these devices). This has known side-effects, like losing [[GPS]] functionality (this baseband comes from an iPad which has no GPS or differently implemented).

It was possible to brick an [[N88ap|iPhone 3GS]] with this method. In fall 2011 Apple replaced the [[NOR]] flash. It is not clear if this was done intentionally to prevent this method. The previous type of baseband was 36my1ee and they changed it to 36my1eh, 36my1eg. (There was no switch to Toshiba baseband devices.) These new [[NOR]] flash chips seem to work with the newer baseband versions in the [[N88ap|iPhone 3GS]], but are not supported with the old [[06.15.00]] baseband. Therefore installing this version will brick your device if you have a new [[NOR]] flash, as you (currently) cannot go back and install anything else. To check before installation, check the version number, as it reveals the production year/week in the digits 3...5. Week 34/2011 appears safe, 35 seems iffy, 36 seems iffy, 37 is not safe. Or open the device and check the chip type.

Talk:Touch ID

2015-03-27T19:34:13Z

Rzhikharevich: Created page with "Err, isn't there a non-private framework? There's a lot of apps using Touch ID now. Also, is it true that replacing Touch ID on iPhone 6 will make the whole device bricked? --..."

Err, isn't there a non-private framework? There's a lot of apps using Touch ID now. Also, is it true that replacing Touch ID on iPhone 6 will make the whole device bricked? --[[User:Rzhikharevich|Rzhikharevich]] ([[User talk:Rzhikharevich|talk]]) 19:34, 27 March 2015 (UTC)

NAND

2015-03-27T12:19:04Z

Rzhikharevich: /* Jailbreaking */

[[File:8GBflash.jpg|thumb|right|An 8GiB Samsung <code>KMCMN0000M-B998</code> (serial <code>FEA962P2</code>) NAND chip]]
'''NAND''', so called because of its use of [[wikipedia:NAND gate|not AND gates]], is a type of [[wikipedia:Flash memory|non-volatile memory chip]] that is used in all [[iDevice]]s. This chip is where all the ''storage'' (not memory) of the device is located. In the case of [[iOS]], the chips can range anywhere from 4 GiB to 128 GiB.

== Partitions ==
{{see also|/private/etc/fstab}}
In the case of [[iOS]], it is split into two [[/private/etc/fstab|partitions]], a root partition ranging from 256(?) MiB to ~2 GiB, and a user partition occupying the rest. The root partition is located first on the chip and is mounted to the [[/|root of the filesystem]] (<code>/</code>). The user partition is located after the root partition on the chip and is mounted to [[/private/var]].
=== Size of Partitions ===
The size of the root partition has varied throughout [[iOS]]'s history, while the user partition just fills the rest of the space of the NAND chip. Here is a comparison of the size of the root partition compared to iOS version:
* 256 MiB: ?
* 512 MiB: ? - 4.0
* 1024 MiB: 4.0 - present
* ~2 GiB: ?.? on newer devices.

== Jailbreaking ==
{{main|Jailbreak}}
Jailbreaking, in it's simplest form, involves modifying [[/private/etc/fstab]] before being parsed by the [[kernelcache|kernel]] to mount the [[/|root partition]] as read-write (<code>rw</code>), as opposed to read-only (<code>ro</code>). The only use of a so called "bare-bones" jailbreak is a proof-of-concept. A semi known example (the only publicly disclosed) of a "bare-bones" jailbreak is the [[k66ap|Apple TV 2G]] from [[Mojave 8M89 (Apple TV 2G)|4.0]] (4.1) to [[Jasper 8C150 (Apple TV 2G)|4.1]] (4.2). Not all jailbreak payloads modify [[/private/etc/fstab]], some of them remount the [[/|root partition]] manually.

== Data Layout ==
As NAND chips are not hard drives, their "sector" sizes are different than that of a typical hard drive. In fact, they aren't even called sectors, but instead called a "page".

The difference between a page and a sector is that a ''modern'' hard drive sector contains either 512 or 4096 bytes of data with anywhere from roughly 30 to 250 bytes of [[wikipedia:Error detection and correction|error correction code]] (ECC) data, while a page contains 8192 bytes of data and ''no'' ECC. ECC is most likely not used as flash memory uses transistors, which are more reliable than magnetism to store data. It has, however, been [http://www.micron.com/~/media/Documents/Products/Software%20Article/SWNL_implementing_ecc.pdf proposed to implement ECC in flash memory] as the smaller [[wikipedia:Semiconductor device fabrication|fabrication process]] has shrunk to the width of about [[wikipedia:22 nanometer|150]] helium atoms (<code>.14 nm</code>, or <code>22 nm</code> total).

The next level up from a page is a block which is a collection of 128 pages. A block can be compared to a 4K sector hard drive that emulates 512 byte sectors. Each page contains 56 bytes of padding followed by 8136 bytes of data to form a total of 8192 (<code>213</code>) bytes. The purpose of the padding is currently unknown. It is unlikely to be for filesystem specific data as it is present on the bootloader blocks also.

The layout of an 8 GiB chip containing [[iOS]] has been documented by [[CPICH]]. He [https://twitter.com/cpich3g/status/15966288660660224 notes] that an [[iPhone 4]] is documented, but it could easily be adapted to any other device or [[firmware]]. He uploaded the document to [http://freepdfhosting.com/29256fdff9.pdf FreePDFHosting], but it was later removed after 30 days as per their policy. [[User:MuscleNerd|MuscleNerd]] rasterized the document's pages and uploaded the images here:
<gallery>
File:N1.png|Page 1
File:N2.png|Page 2
File:N3.png|Page 3
File:N4.png|Page 4
File:N5.png|Page 5
</gallery>

== See Also ==
* [[/private/etc/fstab]]
* [[Jailbreak]]

== External Links ==
* [http://freepdfhosting.com/29256fdff9.pdf NAND Layout of iPhone 4] (dead link) documented by [[CPICH]]
* [http://esec-lab.sogeti.com/ SOGETI ESEC-Labs] on the [http://esec-lab.sogeti.com/dotclear/public/publications/11-hitbamsterdam-iphonedataprotection.pdf encryption of iOS devices]

NAND

2015-03-27T12:12:20Z

Rzhikharevich: /* Partitions */ Someone should edit this page and add certain values.

[[File:8GBflash.jpg|thumb|right|An 8GiB Samsung <code>KMCMN0000M-B998</code> (serial <code>FEA962P2</code>) NAND chip]]
'''NAND''', so called because of its use of [[wikipedia:NAND gate|not AND gates]], is a type of [[wikipedia:Flash memory|non-volatile memory chip]] that is used in all [[iDevice]]s. This chip is where all the ''storage'' (not memory) of the device is located. In the case of [[iOS]], the chips can range anywhere from 4 GiB to 128 GiB.

== Partitions ==
{{see also|/private/etc/fstab}}
In the case of [[iOS]], it is split into two [[/private/etc/fstab|partitions]], a root partition ranging from 256(?) MiB to ~2 GiB, and a user partition occupying the rest. The root partition is located first on the chip and is mounted to the [[/|root of the filesystem]] (<code>/</code>). The user partition is located after the root partition on the chip and is mounted to [[/private/var]].
=== Size of Partitions ===
The size of the root partition has varied throughout [[iOS]]'s history, while the user partition just fills the rest of the space of the NAND chip. Here is a comparison of the size of the root partition compared to iOS version:
* 256 MiB: ?
* 512 MiB: ? - 4.0
* 1024 MiB: 4.0 - present
* ~2 GiB: ?.? on newer devices.

== Jailbreaking ==
{{main|Jailbreak}}
Jailbreaking, in it's simplest form, involves modifying [[/private/etc/fstab]] before being parsed by the [[kernelcache|kernel]] to mount the [[/|root partition]] as read-write (<code>rw</code>), as opposed to read-only (<code>ro</code>). The only use of a so called "bare-bones" jailbreak is a proof-of-concept. A semi known example (the only publicly disclosed) of a "bare-bones" jailbreak is the [[k66ap|Apple TV 2G]] from [[Mojave 8M89 (Apple TV 2G)|4.0]] (4.1) to [[Jasper 8C150 (Apple TV 2G)|4.1]] (4.2).

== Data Layout ==
As NAND chips are not hard drives, their "sector" sizes are different than that of a typical hard drive. In fact, they aren't even called sectors, but instead called a "page".

The difference between a page and a sector is that a ''modern'' hard drive sector contains either 512 or 4096 bytes of data with anywhere from roughly 30 to 250 bytes of [[wikipedia:Error detection and correction|error correction code]] (ECC) data, while a page contains 8192 bytes of data and ''no'' ECC. ECC is most likely not used as flash memory uses transistors, which are more reliable than magnetism to store data. It has, however, been [http://www.micron.com/~/media/Documents/Products/Software%20Article/SWNL_implementing_ecc.pdf proposed to implement ECC in flash memory] as the smaller [[wikipedia:Semiconductor device fabrication|fabrication process]] has shrunk to the width of about [[wikipedia:22 nanometer|150]] helium atoms (<code>.14 nm</code>, or <code>22 nm</code> total).

The next level up from a page is a block which is a collection of 128 pages. A block can be compared to a 4K sector hard drive that emulates 512 byte sectors. Each page contains 56 bytes of padding followed by 8136 bytes of data to form a total of 8192 (<code>213</code>) bytes. The purpose of the padding is currently unknown. It is unlikely to be for filesystem specific data as it is present on the bootloader blocks also.

The layout of an 8 GiB chip containing [[iOS]] has been documented by [[CPICH]]. He [https://twitter.com/cpich3g/status/15966288660660224 notes] that an [[iPhone 4]] is documented, but it could easily be adapted to any other device or [[firmware]]. He uploaded the document to [http://freepdfhosting.com/29256fdff9.pdf FreePDFHosting], but it was later removed after 30 days as per their policy. [[User:MuscleNerd|MuscleNerd]] rasterized the document's pages and uploaded the images here:
<gallery>
File:N1.png|Page 1
File:N2.png|Page 2
File:N3.png|Page 3
File:N4.png|Page 4
File:N5.png|Page 5
</gallery>

== See Also ==
* [[/private/etc/fstab]]
* [[Jailbreak]]

== External Links ==
* [http://freepdfhosting.com/29256fdff9.pdf NAND Layout of iPhone 4] (dead link) documented by [[CPICH]]
* [http://esec-lab.sogeti.com/ SOGETI ESEC-Labs] on the [http://esec-lab.sogeti.com/dotclear/public/publications/11-hitbamsterdam-iphonedataprotection.pdf encryption of iOS devices]

User:Semaphore

2015-03-26T13:32:32Z

Rzhikharevich: Grammar.

Semaphore (on Twitter named notcom) has written the famous [[TinyUmbrella]] tool to backup the [[SHSH]] certificates to be able to downgrade firmware.

He is a member of the [[Chronic Dev (team)|Chronic Dev Team]].

== Links ==
* [http://www.twitter.com/notcom semaphore on Twitter]
* [http://thefirmwareumbrella.blogspot.com/ His blog related to the TinyUmbrella tool]
* [https://github.com/semaphore GitHub]
[[Category:Hackers]]

Talk:S5L8900

2015-03-26T09:01:19Z

Rzhikharevich:

I am not sure if there's actually any X Server running on an iDroid system. Modern Android versions use SurfaceFlinger instead of X, but I couldn't find out in which Android release it was introduced. What about the iDroid? --[[User:Rzhikharevich|Rzhikharevich]] ([[User talk:Rzhikharevich|talk]]) 09:01, 26 March 2015 (UTC)

Talk:S5L8900

2015-03-26T09:01:04Z

Rzhikharevich:

/private/var/mobile/Library/Safari/SearchEngines.plist

2015-03-23T23:26:15Z

Rzhikharevich:

This file is very usable, when Safari doesn't support your favorite search engine. Just edit it, if you need.

== Parents ==
{{parent|private/var/mobile/Library/Safari}}

[[Category:Filesystem]]

/private/var/mobile/Library/Safari/SearchEngines.plist

2015-03-23T23:25:56Z

Rzhikharevich: Created page with "This file is very usable, when Safai doesn't support your favorite search engine. Just edit it, if you need. == Parents == {{parent|private/var/mobile/Library/Safari}} Cat..."

This file is very usable, when Safai doesn't support your favorite search engine. Just edit it, if you need.

== Parents ==
{{parent|private/var/mobile/Library/Safari}}

[[Category:Filesystem]]

/private/var/mobile/Library/Safari

2015-03-23T23:23:09Z

Rzhikharevich:

This folder stores Safari data.

== Files ==
* {{ipfw|Bookmarks.db}}
* {{ipfw|Bookmarks.db-shm}}
* {{ipfw|Bookmarks.db-wal}}
* {{ipfw|com.apple.Bookmarks.lock}}
* {{ipfw|SearchEngines.plist}}

== Parents ==
{{parent|private/var/mobile/Library}}

[[Category:Filesystem]]

/private/var/mobile/Library/Safari

2015-03-23T23:21:57Z

Rzhikharevich: Created page with "This folder stores Safari data. == Files == * {{ipfw|Bookmarks.db}} * {{ipfw|Bookmarks.db-shm}} * {{ipfw|Bookmarks.db-wal}} * {{ipfw|com.apple.Bookmarks.lock}} * {{ipfw|Searc..."

/

2015-03-23T23:16:20Z

Rzhikharevich: /* External Links */ Added a link to a document by Apple. Explains non-FHS directories.

__NOTOC__
This is the root directory for [[iOS]]. The firmware listing of these folders follow very closely to the [[wikipedia:Filesystem Hierarchy Standard|Filesystem Hierarchy Standard]] for [[wikipedia:Unix|Unix]] and [[wikipedia:Unix-like|Unix-like]] [[wikipedia:Operating system|operating systems]].

== Children ==
=== Folders ===
* {{ipfw|AppleInternal}} ([[Apple Internal Apps|Apple Internal apps]] and [[Prototype Firmware|prototypes]])
* {{ipfw|Applications}}
* {{ipfw|bin}}
* {{ipfw|boot}}
* {{ipfw|cores}}
* {{ipfw|dev}}
* {{ipfw|Developer}}
* {{ipfw|private/etc|etc}} ([[wikipedia:Symbolic link|symlink]] to <code>/private/etc</code>)
* {{ipfw|Library}}
* {{ipfw|lib}}
* {{ipfw|mnt}}
* {{ipfw|private}}
* {{ipfw|sbin}}
* {{ipfw|System}}
* {{ipfw|private/var/tmp|tmp}} (symlink to <code>/private/var/tmp</code>)
* {{ipfw|private/var/mobile|User}} (symlink to <code>/private/var/mobile</code> ({{ipfw|private/var/root|/private/var/root}} on [[iOS|iPhone OS]] 1.1.2 and below)
* {{ipfw|usr}}
* {{ipfw|private/var|var}} (symlink to <code>/private/var</code>)
=== Files ===
* {{ipfw|.file}}

== External Links ==
* [http://refspecs.linuxfoundation.org/FHS_2.3/fhs-2.3.html Filesystem Hierachy Standard 2.3]
* [https://developer.apple.com/library/mac/documentation/FileManagement/Conceptual/FileSystemProgrammingGuide/FileSystemOverview/FileSystemOverview.html File Sysyem Basics (Apple)]
[[Category:Filesystem]]

/usr/local/bin

2015-03-23T23:07:48Z

Rzhikharevich: /* Parents */

The FHS defines the /usr/local as the “tertiary hierarchy for local data installed by the system administrator.” The /usr/local/bin directory contains programs.

== Children ==
=== Folders ===
(none)

=== Files ===
* {{ipfw|ioflashstoragetool}}
TODO: this list is not complete.

== Parents ==
{{parent|usr/local}}

[[Category:Filesystem]]

/private/var/mobile/Library

2015-03-23T23:06:14Z

Rzhikharevich: Created page with "An explanation by Apple: "There are multiple Library directories on the system, each one associated with a different domain or specific user. Apps should use the Library direc..."

An explanation by Apple: "There are multiple Library directories on the system, each one associated with a different domain or specific user. Apps should use the Library directory to store app-specific (or system-specific) resources."

== Children ==
=== Folders ===
* {{ipfw|Safari}}

=== Files ===
* {{ipfw|ConfigurationProfilesAppAccessibilityParameters.plist}}

== Parents ==
{{parent|private|var/mobile}}

[[Category:Filesystem]]

/usr/local

2015-03-23T23:05:13Z

Rzhikharevich: /* Parents */

The FHS defines the /usr/local as the “tertiary hierarchy for local data installed by the system administrator.” On iOS this folder is typically found on ramdisks.

== Children ==
=== Folders ===
* {{ipfw|bin}}
TODO: this list is not complete.

=== Files ===
(none)

== Parents ==
{{parent|usr}}

[[Category:Filesystem]]

User:Rzhikharevich

2015-03-23T18:31:20Z

Rzhikharevich: /* iDevices */ Sorry for many edits in a row.

Just an iPhone user and programmer, a [http://uncyclopedia.wikia.com/wiki/Grammar_Nazi grammar nazi] (with russian language). 13 years old, started being interested in computer science at the age of 11.
PS. Not a native english-speaker.

== Projects ==
Here's the list of my iOS-related projects:
*[https://github.com/rzhikharevich/lwvmedit lwvmedit] - first useful (?) tool for iOS, it can read and edit LwVM tables.
*iolwvm - an IOKit version of lwvmedit. I am working on reversing, how userspace communicates with the kernel to modify the partitions.
*libipwn - a library for interfacing with iDevices in DFU mode. Not public yet.
Other projects:
*[http://github.com/rzhikharevich/NyanOS NyanOS] & [http://github.com/rzhikharevich/XNC XNC programming language].

== Knowledge ==
I know a lot about the iOS (at least relatively). I am also an experienced Unix/Linux user.

Programming languages:
*C/C++
*Python
*x86 assembly.
Web design skills:
*HTML5
*CSS3
*Javascript.

== Links ==
*[http://rzhikharevich.github.io My blog], under construction.
*[http://github.com/rzhikharevich Github account]
*[http://twitter.com/rzhikharevich Twitter]

== iDevices ==
*White iPad 3, 64GB, iOS 8.1, jailbroken.
*iPhone 4, 16GB, iOS 7.1.2, jailbroken.
*The original iPhone (2G), Debian ARM via OpeniBoot
*Black iPhone 5, 32GB, iOS 8.2 (primary).
*Apple TV 3rd gen.

== Operating systems ==
In current use:
*OS X Yosemite.
*iOS.
Used:
*Windows XP/7/8/10
*Different Linux distributions (Gentoo is my favorite)

User:Rzhikharevich

2015-03-23T18:30:10Z

Rzhikharevich: /* Projects */

Just an iPhone user and programmer, a [http://uncyclopedia.wikia.com/wiki/Grammar_Nazi grammar nazi] (with russian language). 13 years old, started being interested in computer science at the age of 11.
PS. Not a native english-speaker.

== Projects ==
Here's the list of my iOS-related projects:
*[https://github.com/rzhikharevich/lwvmedit lwvmedit] - first useful (?) tool for iOS, it can read and edit LwVM tables.
*iolwvm - an IOKit version of lwvmedit. I am working on reversing, how userspace communicates with the kernel to modify the partitions.
*libipwn - a library for interfacing with iDevices in DFU mode. Not public yet.
Other projects:
*[http://github.com/rzhikharevich/NyanOS NyanOS] & [http://github.com/rzhikharevich/XNC XNC programming language].

== Knowledge ==
I know a lot about the iOS (at least relatively). I am also an experienced Unix/Linux user.

Programming languages:
*C/C++
*Python
*x86 assembly.
Web design skills:
*HTML5
*CSS3
*Javascript.

== Links ==
*[http://rzhikharevich.github.io My blog], under construction.
*[http://github.com/rzhikharevich Github account]
*[http://twitter.com/rzhikharevich Twitter]

== iDevices ==
*White iPad 3, 64GB, iOS 7.1.2, jailbroken.
*iPhone 4, 16GB, iOS 7.1.2, jailbroken.
*The original iPhone (2G), Debian ARM via OpeniBoot
*Black iPhone 5, 32GB, iOS 8.0.2 (primary).
*Apple TV 3rd gen.

== Operating systems ==
In current use:
*OS X Yosemite.
*iOS.
Used:
*Windows XP/7/8/10
*Different Linux distributions (Gentoo is my favorite)

S5L8930

2015-03-23T18:27:42Z

Rzhikharevich: /* Bootrom Exploits */ It's referenced as an exploit, not a tool.

[[Image:A4.jpg|right]]
A [[wikipedia:system on a chip|system on a chip]] ("SoC") developed by Apple's in-house chip design department. Publicly, Apple refers to this chip as the '''A4'''. Internally, this processor is also based on the S5L8920X family, which can also be seen through the reuse of several MMIO devices and MMIO device registers (i.e: chipid). This is the last SoC revision on mobile devices manufactured for Apple that has a publicly known exploitable [[bootrom]] vulnerability.

== Used in ==
* [[K66ap|Apple TV 2G]]
* [[K48ap|iPad]]
* [[iPhone 4]]
* [[n81ap|iPod touch 4G]]

== [[Bootrom]] Exploits ==
* [[limera1n exploit|limera1n]]
* [[SHA-1 Image Segment Overflow|SHAtter]]

== Boot Chain ==
[[Bootrom 574.4|Bootrom]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[Firmware|System Software]]

== Specifications ==
* '''CPU''': ARM Cortex-A8
* '''GPU''': PowerVR SGX 535
* '''A/V Playback''': PowerVR VXD
* '''RAM''': 256 MB ([[K66ap|Apple TV 2G]], [[K48ap|iPad]], and [[N81ap|iPod touch 4G]]) or 512 MB ([[iPhone 4]])

[[Category:Application Processors]]
Aside from the [[iPhone 4]]'s additional RAM and an overall higher clock speed, these are the same specifications as the [[S5L8920]] and [[S5L8922]].

== See also ==
* [[Bootrom 574.4]]

== Links ==
* http://www.apple.com/ipad/specs/
* http://www.brightsideofnews.com/news/2010/1/27/apple-a4-soc-unveiled---its-an-arm-cpu-and-the-gpu!.aspx

Talk:OpenSharedCacheFile

2015-03-23T17:16:06Z

Rzhikharevich:

Does this allow root access? Also, could we add that it was patched in 6.1.3/6.1.4 (possibly 6.1.6, I'll test that)? --[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 02:13, 23 March 2015 (UTC)
:[http://www.cvedetails.com/cve/CVE-2013-3950/ CVE Details] stands, that the last vulnerable version is 6.1.3. I don't think, that this vulnerability can cause any privilege escalations. --[[User:Rzhikharevich|Rzhikharevich]] ([[User talk:Rzhikharevich|talk]]) 17:16, 23 March 2015 (UTC)

Talk:OpenSharedCacheFile

2015-03-23T17:14:25Z

Rzhikharevich:

Does this allow root access? Also, could we add that it was patched in 6.1.3/6.1.4 (possibly 6.1.6, I'll test that)? --[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 02:13, 23 March 2015 (UTC)
:[[http://www.cvedetails.com/cve/CVE-2013-3950/|This resource]] stands, that the last vulnerable version is 6.1.3. I don't think, that this vulnerability can cause any privilege escalations.

/usr/local/bin

2015-03-23T17:01:59Z

Rzhikharevich: Oops!

/usr/local/bin/ioflashstoragetool

2015-03-23T16:57:01Z

Rzhikharevich: Typo fix.

This tool seems be present in restore ramdisks for formatting NAND flash.

== Usage ==
<pre>
ioflashstoragetool: Low-level NAND flash utility

Options:
--verbose Be talkative about what the tool is doing.
--noisy Be extremely noisy while doing things.
--quiet Don't show progress output.

Multi-bank addressing:
p<page> Addresses all banks, starting at bank 0, page <page>.
b<block> Addresses all banks, starting at bank 0, block <block>.
In these modes, page/block counts are per-bank and all operations start
at bank zero. <page>/<block> may be decimal or hex preceeded by 0x.

Single-bank addressing:
<bank>p<page> Addresses bank <bank>, starting at page <page>.
<bank>b<block> Addresses bank <bank>, starting at block <block>.
In these modes, page/block counts are for the selected bank only.
<bank> is decimal, <page>/<block> may be decimal or hex preceeded by 0x.

Commands:
format <partition table type>
Writes partition table to pages 0 and 1 of block 0 of all devices.
The <partition table type> may be one of: s5l8720x s5l8920x
--force Performs format even if an AND signature is
detected.
</pre>

== NAND info example output ==
<pre>
NAND Configuration
Vendor: Hynix
Lithography: 26nm
Capacity: 64GB
Firmware Version: 020076P......... (30 32 30 30 37 36 50 00 00 00 00 00 00 00 00 00)
ManufacturerID: 0x4201220182ad
Num of CEs: 4
PPN Device: Yes
PPN Version: 1.0.6
PPN Toggle: No
4 CEs of 4 CAUs of 2048 blocks of 256 pages of 8192 bytes data, 32 bytes spare
2040 superblocks
4096 pages/superblock -> 8192 vbas/superblock
</pre>

/usr/local/bin/ioflashstoragetool

2015-03-23T16:56:29Z

Rzhikharevich: Created page with "This tool seems be present in restore ramdisk for formatting NAND flash. == Usage == <pre> ioflashstoragetool: Low-level NAND flash utility Options: ..."

This tool seems be present in restore ramdisk for formatting NAND flash.

== Usage ==
<pre>
ioflashstoragetool: Low-level NAND flash utility

Options:
--verbose Be talkative about what the tool is doing.
--noisy Be extremely noisy while doing things.
--quiet Don't show progress output.

Multi-bank addressing:
p<page> Addresses all banks, starting at bank 0, page <page>.
b<block> Addresses all banks, starting at bank 0, block <block>.
In these modes, page/block counts are per-bank and all operations start
at bank zero. <page>/<block> may be decimal or hex preceeded by 0x.

Single-bank addressing:
<bank>p<page> Addresses bank <bank>, starting at page <page>.
<bank>b<block> Addresses bank <bank>, starting at block <block>.
In these modes, page/block counts are for the selected bank only.
<bank> is decimal, <page>/<block> may be decimal or hex preceeded by 0x.

Commands:
format <partition table type>
Writes partition table to pages 0 and 1 of block 0 of all devices.
The <partition table type> may be one of: s5l8720x s5l8920x
--force Performs format even if an AND signature is
detected.
</pre>

== NAND info example output ==
<pre>
NAND Configuration
Vendor: Hynix
Lithography: 26nm
Capacity: 64GB
Firmware Version: 020076P......... (30 32 30 30 37 36 50 00 00 00 00 00 00 00 00 00)
ManufacturerID: 0x4201220182ad
Num of CEs: 4
PPN Device: Yes
PPN Version: 1.0.6
PPN Toggle: No
4 CEs of 4 CAUs of 2048 blocks of 256 pages of 8192 bytes data, 32 bytes spare
2040 superblocks
4096 pages/superblock -> 8192 vbas/superblock
</pre>

/usr/local/bin

2015-03-23T16:48:15Z

Rzhikharevich: Created page with "The FHS defines the /usr/local as the “tertiary hierarchy for local data installed by the system administrator.” The /usr/local/bin directory contains programs. == Childr..."

The FHS defines the /usr/local as the “tertiary hierarchy for local data installed by the system administrator.” The /usr/local/bin directory contains programs.

== Children ==
=== Folders ===
* {{ipfw|ioflashstoragetool}}
TODO: this list is not complete.

=== Files ===
(none)

== Parents ==
{{parent}}

[[Category:Filesystem]]

/usr/local

2015-03-23T16:45:55Z

Rzhikharevich: Created page with "The FHS defines the /usr/local as the “tertiary hierarchy for local data installed by the system administrator.” On iOS this folder is typically found on ramdisks. == Chi..."