The iPhone Wiki - User contributions [en]

Checkra1n

2021-05-10T11:33:44Z

Sbingner: Update some developers to point to their respective wiki pages

{{lowercase}}
{{Infobox software
| name = checkra1n
| title = checkra1n
| author = [[User:qwertyoruiop|qwertyoruiop]]
| developer = [[User:qwertyoruiop|qwertyoruiop]], argp, [[User:axi0mX|axi0mX]], danyl931, [[User:Jaywalker|jaywalker]], [[User:Kirb|kirb]], littlelailo, nitoTV, [[User:Nullpixel|nullpixel]], pimskeks, [[User:Sbingner|sbingner]], [[User:Siguza|Siguza]], [[T2]] work by [[t8012 checkm8]]
| logo = [[File:checkra1n-logo.png|85px]]
| language = [[wikipedia:English|English]]
| status = Active
| released = {{Start date|2019|11|10|df=yes}}
| latest release version = 0.12.2 beta
| latest release date = {{Start date and age|2020|12|31|df=yes}}
| operating system = [[wikipedia:macOS|macOS]], [[wikipedia:Linux|Linux]]
| type = Jailbreaking
| website = [http://checkra.in/ checkra.in]
}}
'''checkra1n''' is a [[semi-tethered jailbreak]], developed primarily by [[User:qwertyoruiop|Luca Todesco (qwertyoruiop)]]. It's based on the [[checkm8 Exploit|checkm8]] bootrom exploit released by [[User:axi0mX|axi0mX]]. checkra1n supports iOS 12.0 and newer, iPadOS 13.1 and newer, and tvOS 12.0 and newer. Experimental support was added in 0.9.9 for the [[T2]] processor. Partial support for [[HomePod]] was added in 0.12.1 beta.

[[File:checkra1n.png]]

==Release History==
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| 0.9 beta
| rowspan = "2" | {{date|2019|11|10}}
|
* Initial release
|-
| 0.9.1 beta
|
* An issue where the loader app would crash when installing Cydia on iPads
* A crash when the macOS language was set to anything other than English
* An issue where iPad Minis would not work with the GUI
* An issue with the scp binary not working as expected
|-
| 0.9.2 beta
| {{date|2019|11|11}}
|
* Fixed an issue where the Apple Watch would not receive notifications while jailbroken
* Improve reliability of entering DFU mode
* Fixed an issue where checkra1n could not be used on macOS 10.10
|-
| 0.9.3 beta
| rowspan = "2" | {{date|2019|11|13}}
|
* Fixes an issue where biometrics did not work for some users
* Fixes an issue where the touch screen became unresponsive for some users
* Fixes an issue where the loader app may not have appeared on the homescreen
* Fixes an issue where the iPad Smart Keyboard did not work
* Fixes an issue where the fast charging functionality did not work on some devices
* Fixes an issue where the taptic engine did not work on some devices
* Fixes an issue where battery settings did not load for some users
* Detect a case where the user may have an OTA update downloaded, which caused issues for some users
|-
|0.9.3.2 beta
|
* Fixes an issue where biometrics did not work for some users
* Fixes an issue where the touch screen became unresponsive for some users
* Fixes an issue where the loader app may not have appeared on the homescreen
* Fixes an issue where the iPad Smart Keyboard did not work
* Fixes an issue where the fast charging functionality did not work on some devices
* Fixes an issue where the taptic engine did not work on some devices
* Detect a case where the user may have an OTA update downloaded, which caused issues for some users
|-
| 0.9.5 beta
| {{date|2019|11|15}}
|
'''Bug Fixes:'''
* Fixes an issue where the user may be signed out of their Apple ID
* Fixes an issue that caused MobileSubstrate initialization to be delayed
* Detect a case where the user may have an OTA update downloaded, which caused issues for some users
The following issues are caused by incorrect DFU mode entry, please make sure to follow the instructions in the UI:
* An issue where the taptic engine did not work on some devices
* An issue where biometrics did not work for some users
* An issue where the touch screen became unresponsive for some users
'''Other Changes:'''
* This update includes a new fast DFU sequence. Entering DFU mode should now be safer and more reliable.
* The loading mechanism for substrate has improved in this update, which improves the stability of the device.
|-
| 0.9.6 beta
| {{date|2019|12|01}}
|
'''Bug Fixes:'''
* Fixes support for the iPad 6th Generation
* Fixes an issue where A7 devices would report an error code on success
* Fixes an issue where jailbreak app icons would show up on the boot after using loader’s “Restore System” functionality
* Makes the loader app more resilient to errors occurring after a long uptime
* Fixes an issue where Loader and Cydia would fail with a no internet connection message on Chinese iPhones
* Fixes an issue where the the iPad Pro Smart Keyboard would disconnect
* Fixes an issue where fast charging did not work
'''Other Changes:'''
* Add support for jailbreaking Apple TVs from within the same app
* Added support for the iPad 5th Generation, iPad Air 2nd Generation the iPad Pro 1st Generation
* Added support for iOS 13.2.3
* Re-engineered the command line interface from the ground up
* Drastically improved loader’s speed
* Restructured loaderd and friends into separate launch daemons to survive userland reboot and removed insult from daemon name
* Export kernel base and other useful things for developers (see [https://github.com/sbingner/jbctl jbctl] for details)
|-
| 0.9.7 beta
| {{date|2019|12|14}}
|
'''Bug Fixes:'''
* Fixes an issue which prevented the GUI from detecting changes in device modes
* Fixes an issue that caused the GUI to hang when jailbreaking some iPad models
'''Other Changes:'''
* Add initial Apple TV 4K support
* Purge OTA updates on boot
* Add support for iOS 13.3
* Remove libimobiledevice as a dependency
* Properly handle situations where there’s no internet connection available while bootstrapping tvOS
* Add a Control Center shortcut for the tvOS loader app
'''Known Issues:'''
* The Apple TV 4K will produce a -20 error, even on a successful jailbreak
|-
| 0.9.8 beta
| {{date|2020|02|05}}
|
'''Bug Fixes:'''
* This release squashes so many bugs we couldn’t keep track of them. Sorry bugs…
'''Other Changes:'''
*Support for Linux has arrived! See below for more information.
*Introduces webra1n (see below!).
*Low-level patching is now handled by our all-new pongoOS, engineered from the ground up for flexibility. More news on this front soon!
*Adds a whole new CLI, built around ncurses, which now supports FastDFU.
*Adds a new --version flag to the CLI for debugging purposes.
*Adds a new option in the GUI and CLI which allows for custom boot-args to be set.
*Adds an option to skip version checking for new iOS and iPadOS versions which haven’t yet been officially tested.
*Added support for iOS and iPadOS 13.3.1.
*The checkra1n app no longer requires internet to open.
'''Known Issues:'''
*The Apple TV 4K will produce a -20 error, even on a successful jailbreak
|-
| 0.9.8.1 beta
| {{date|2020|03|04}}
|
'''Other Changes:'''
*Support Project Sandcastle
'''Known Issues:'''
*The Apple TV 4K will produce a -20 error, even on a successful jailbreak
|-
| 0.9.8.2 beta
| {{date|2020|03|08}}
|
'''Other Changes:'''
*Bumping maximum device tree size to 256KiB for Project Sandcastle.
*Fix architecture mismatch for devhelper builds.
'''Known Issues:'''
*The Apple TV 4K will produce a -20 error, even on a successful jailbreak
|-
| 0.10.2 beta
| {{date|2020|05|26}}
|
'''Bug Fixes:'''
*Fixes support for A7 devices
*Fixes an issue in 12.4 which caused the device to panic and reboot on attempted shutdown
*Fixes an issue that caused the keychain to lose new passwords
*Fixes an issue which caused the GUI/ncurses to crash when used more than once
*Fixes an issue where a userspace reboot won’t restart dropbear
'''Other Changes:'''
*Added 13.4 and 13.4.1 support
*Introducing kernel patch finder v2 - rewritten from the ground up for sanic speed
*You can now quit from the webra1n interface
|-
| 0.11.0 beta
| {{date|2020|09|22}}
|
'''Highlighted changes:'''
*Official support for iOS 12.0 - 13.7
*Official support for iOS/tvOS 14.0 (A8(X)-A9(X) running iOS and iPadOS; all tvOS devices are supported)
*Official support for Apple TV 4K breakout boards (Standard and Advanced)
'''Bug Fixes:'''
*Fix an issue with userland kernel patch finder that prevented checkra1n flags from being saved as well as exporting kernel information used by developers to tfp0, *affecting devices running iOS 13.6 and up.
*App can now be launched from DMG on macOS
*Demotion is now working on Linux
*Fixes the -20 error for Apple TV 4K by enabling USB on v1.x standard breakouts
'''Other Changes:'''
*Partial bridgeOS support (CLI only, see ‘Known issues’)
*PongoOS was switched to Darwin ABI
*Improved kernel patch finder patchsets
*Improved boot strategy/hooking
*NVRAM unlock patch (for root)
*dyld patch
*Removes Mach-o platform restrictions (iOS binaries can now run on tvOS/bridgeOS and vice versa)
*Significantly reduces checkra1n build size
*Removed macOS bug reporter
|-
| 0.12.0 beta
| {{date|2020|11|08}}
|
'''Highlighted changes:'''
*Official support for iOS 14.1 and 14.2
*Official support for A10/A10X devices on iOS 14.x
*Limited support for A11 devices on iOS 14.x (Options > Skip A11 BPR check)
*A “Quick Mode” option that makes the GUI/TUI run on a timer and require no button clicks
'''Bug Fixes:'''
*Fixes a widespread issue that could cause crashes or hangs at various stages of booting across all devices and iOS versions
*Fixes a kernel patch that made many kexts think the device was in restore mode
*Fixes an issue where the tvOS loader would crash on tvOS 13.x
*Fixes a GUI/TUI issue that would cause failure with A7 devices
*Fixes a GUI/TUI issue where failure to jailbreak could cause memory corruption
*Fixes an issue where the T2 overlay was not being sent in the Linux version
*Ships a vastly updated PongoOS, including:
**Working USB on all SoCs
**A hardware AES driver for all SoCs, providing access to GID keys and more
**Booting with -p works once again
'''Other Changes:'''
*Users who used a modified checkra1n build will get a warning popup
|-
| 0.12.1 beta
| {{date|2020|11|20}}
|
'''Highlighted changes:'''
*Adds an on-device alert to indicate checkra1n’s Safe Mode is active
*Adds support for iBridge SSH from the same host
*Partial support for the original HomePod (CLI only, tested to work with audioOS 13 and 14)
'''Bug Fixes:'''
*Fixes an issue that would often cause Safe Mode to be entered on iOS 14.2 regardless of whether the user requested it or not
*Safe Mode no longer loads 3rd-party LaunchDaemons
*NVRAM is now unlocked on iOS 14.2 as well
*Fixes an issue where jailbreaking an AppleTV fail on fresh tvOS installations
*The bundled dd binary now has the entitlement required to access block devices
*Fixes multiple memory leaks in early-boot binaries
*Changes some GUI internals that should reduce the chance of exploit failure and GUI hiccups
|-
| 0.12.2 beta
| {{date|2020|12|31}}
|
'''Highlighted changes:'''
*Enables USB on AppleTV 4k during normal system operation
'''Bug Fixes:'''
*Fixes A10 and A10X devices crashing when trying to jailbreak on iOS 14.3 or higher
*Fixes an issue where some LaunchDaemons were loaded on platforms where they should not have been
|}

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Redsn0w

2020-07-17T23:40:14Z

Sbingner: Fix typo :|

{{lowercase}}
{{float toc|left}}
[[File:Redsn0w.png|thumb|redsn0w on OS X]]
'''redsn0w''' is an [[iDevice]] [[jailbreak]]ing tool for OS X and Windows. Originally called [[QuickPwn]], but due to exploitation of the name by <code>www.quickpwn.com</code>, version 0.7 was renamed to redsn0w and added [[unlock]]ing of supported [[iDevice|devices]].

Version 0.8 added support for jailbreaking the [[N88AP|iPhone 3GS]].

Version 0.9b3 was released for Windows and Mac OS X, and it allows iOS 3.0 through 3.1.2 to be jailbroken. It includes support for all devices except the [[N18AP|iPod touch (3rd generation)]], and supports a [[tethered jailbreak]] on [[N88AP|iPhone 3GS]] units and [[N72AP|iPod touch (2nd generation)]] units with new bootroms. In addition, this version supports custom boot and recovery mode logos, as well as verbose mode on bootup.

Version [http://wikee.iphwn.org/howto:rs9 0.9.2] supports jailbreaking of all iDevices (at the time) with iOS 3.0 through 3.1.2 on Windows and Mac OS X, as well as 3.1.3 on [[S5L8900]] devices. Version 0.9.3 adds support of internet tethering IPCC hack on those devices and 0.9.4 allows jailbreaking of early [[N72AP|iPod touch (2nd generation)]] with iOS 3.1.3.

Version [http://wikee.iphwn.org/howto:rsbeta 0.9.5b5-5] supports jailbreaking the [[N82AP|iPhone 3G]] and [[N72AP|iPod touch (2nd generation)]] ([[Bootrom 240.4|old bootrom]]) with iOS 4.0 on Windows and Mac OS X.

Version [http://blog.iphone-dev.org/post/1718400992 0.9.6b6] supports jailbreaking iOS 3.2.2, 4.1, and 4.2.1 for every device that supports those versions (except Apple TV (2nd generation)), on Windows and Mac OS X.

Version [http://blog.iphone-dev.org/post/14857834236 0.9.10b1] adds support for iOS 4.2.6 through 5.0.1 (though iOS 4.2.9, 4.2.10, 4.3.4, 4.3.5, and 5.0 are tethered on devices invulnerable to the [[0x24000 Segment Overflow]]). This build of redsn0w is not capable of jailbreaking [[S5L8940]] or newer devices.
{{clear}}

== Credit ==
[[iPhone Dev Team]]

== Versions ==
===Initial releases===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! Lite
| Unknown
| {{yes}}
| {{yes}}
|
* Tethered jailbreak for [[N72AP|iPod touch (2nd generation)]] on iOS 2.1.1 with [[ARM7 Go]]
|-
! 0.3
| Unknown
| {{yes}}
| {{yes}}
|
* Untethered jailbreak for the [[N72AP|iPod touch (2nd generation)]] on iOS 2.2.1 with [[ARM7 Go]] and [[0x24000 Segment Overflow]]
|}
===0.7.x series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.7
| Unknown
| {{yes}}
| {{yes}}
| style="white-space: nowrap;" |
* Untethered jailbreak for all devices but [[N88AP|iPhone 3GS]]
|-
! 0.7.1
| Unknown
| {{yes}}
| {{yes}}
| Bug fixes for versions 0.7
|-
! 0.7.2
| Unknown
| {{yes}}
| {{yes}}
| Bug fixes for versions 0.7
|}

===0.8.x series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.8
| {{date|2009|07|07}}
| {{yes}}
| {{yes}}
|
* Performs an [[untethered jailbreak]] on iOS 3.0/3.0.1 (when pointed at 3.0) for all devices supported by those firmware.
|-
|}

===0.9.0-0.9.4 releases===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.2
| Unknown
| {{yes}}
| {{yes}}
|
* Supports 3.0-3.1.2 on all iPhones and iPod touches ([[tethered jailbreak|tethered]] for newer devices with [[0x24000 Segment Overflow]] patched.)
|-
! 0.9.3
| Unknown
| {{yes}}
| {{yes}}
|
* Contains the IPCC hack to enable tethering on the iPhone 3G and 3GS.
|-
! 0.9.4
| Unknown
| {{yes}}
| {{yes}}
|
* Supports jailbreaking iOS 3.1.3 on [[M68AP|iPhone]], [[N82AP|iPhone 3G]], [[N45AP|iPod touch]], [[N72AP|iPod touch (2nd generation)]] ([[Bootrom 240.4|old bootrom]])
|-
|}

===0.9.5 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.5b3
| 21 Jun 2010
| {{yes}}
| {{no}}
|
* Supports jailbreaking iOS 4.0 on [[N82AP|iPhone 3G]] and [[N72AP|iPod touch (2nd generation)]] ([[Bootrom 240.4|old bootrom]])
|-
! 0.9.5b4
| Unknown
| {{yes}}
| {{no}}
|
* Resolved a problem with iBooks.
|-
! 0.9.5b5
| Unknown
| {{yes}}
| {{no}}
|
* Supposed to fix any APN or MMS issues that users were seeing.
|-
|}

===0.9.6 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.6b1
| {{date|2010|09|21}}
| {{yes}}
| {{yes}}
|
* Supports jailbreaking iOS 4.0-4.1 on [[N82AP|iPhone 3G]] and [[N72AP|iPod touch (2nd generation)]] ([[tethered jailbreak|tethered]] on [[Bootrom 240.5.1|new bootrom]])
|-
! 0.9.6b2
| {{date|2010|10|31}}
| {{yes}}
| {{yes}}
|
* Supports jailbreaking iOS 3.2.2 and 4.0-4.1 on every device that supports those firmwares (except [[N72AP|iPod touch (2nd generation)]] with [[Bootrom 240.5.1|new bootrom]]) .
** The [[N82AP|iPhone 3G]], [[N72AP|iPod touch (2nd generation)]] ([[Bootrom 240.4|old bootrom]]), and [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]) can also have custom boot logos.
* The Windows version also includes a function that permits users to restore to a custom [[IPSW File Format|IPSW]], akin to [[PwnageTool]]'s DFU button.
|-
! 0.9.6b3
| {{date|2010|11|21}}
| {{yes}}
| {{yes}}
|
* Supports the installation of custom bundles
|-
! 0.9.6b4
| {{date|2010|11|23}}
| {{yes}}
| {{yes}}
|
* Jailbreaks iOS 4.1-4.2.1 on all compatible devices.
** [[Tethered jailbreak]] on devices that are not vulnerable to [[Pwnage 2.0]] or [[0x24000 Segment Overflow]].
|-
! 0.9.6b5
| {{date|2010|11|28}}
| {{yes}}
| {{yes}}
|
* Can update the baseband on the [[X-Gold 608]] to [[06.15.00]], allowing the reuse of the [[AT+XAPP Vulnerability]]
|-
! 0.9.6b6
| {{date|2010|12|01}}
| {{yes}}
| {{yes}}
|
* Allows you to "deactivate" a hacktivated phone, so sbingner's [http://www.bingner.com/SAM.html Subscriber Artificial Module] (SAM) can trick your iPhone and [[iTunes]] into creating legitimate activation tickets.
|-
! 0.9.6 release candidate 7
| {{date|2011|01|02}}
| {{yes}}
| {{yes}}
|
* Introduced command-line arguments to bypass some screens.
** -b <filename> to specify your own boot logo PNG
** -i <filename> to specify your reference IPSW
** -j to ask redsn0w to “Just boot now tethered for now”
** -o for [[N88AP|iPhone 3GS]] and [[N72AP|iPod touch (2nd generation)]] units vulnerable to [[0x24000 Segment Overflow]].
|-
! 0.9.6 release candidate 8
| {{date|2011|01|05}}
| {{yes}}
| {{yes}}
|
* Informs users if a boot logo PNG is invalid, and why.
* Introduced the "-a" command-line argument to eliminate clicking.
|-
! 0.9.6 release candidate 9
| {{date|2011|04|03}}
| {{yes}}
| {{yes}}
|
* Adds support for jailbreaking iOS 4.3.1 on all compatible devices except the [[iPad 2]] and [[K66AP|Apple TV (2nd generation)]].
* New command line parameters k and d [http://twitpic.com/4gg8n1]:
** -k --kernelcache=<str> use specified kernelcache (advanced)
** -d --devicetree=<str> use specified devicetree (advanced)
|-
! 0.9.6 release candidate 10
| {{date|2011|04|07}}
| {{yes}}
| {{yes}}
|
* Added boot animations
* Removed misleading Settings
|-
! 0.9.6 release candidate 11
| {{date|2011|04|07}}
| {{yes}}
| {{yes}}
|
* Makes the boot animation a bit more robust
|-
! 0.9.6 release candidate 12
| {{date|2011|04|08}}
| {{yes}}
| {{yes}}
|
* Fix any lingering issues with the boot animation
|-
! 0.9.6 release candidate 13
| {{date|2011|04|19}}
| {{yes}}
| {{yes}}
|
* Adds support for jailbreaking iOS 4.3.2 on all compatible devices except the [[iPad 2]].
** A bug existed that prevented the [[N90AP|iPhone 4 (iPhone3,1)]] from being jailbroken on iOS 4.3.2.
|-
! 0.9.6 release candidate 14
| {{date|2011|04|19}}
| {{yes}}
| {{yes}}
|
* Fixes an issue that prevented the [[N90AP|iPhone 4 (iPhone3,1)]] from being jailbroken.
|-
! 0.9.6 release candidate 15
| {{date|2011|05|06}}
| {{yes}}
| {{yes}}
|
* Adds support for jailbreaking iOS 4.3.3 on all compatible devices except the [[iPad 2]].
|-
! 0.9.6 release candidate 16
| {{date|2011|05|16}}
| {{yes}}
| {{yes}}
|
* Fixes the [[N88AP|iPhone 3GS]]/[[N90AP|iPhone 4 (iPhone3,1)]] side switch vibration issue found in jailbroken installations of iOS 4.3.3.
|-
! 0.9.6 release candidate 17
| {{date|2011|05|20}}
| {{yes}}
| {{yes}}
|
* Adds advanced command line options for kernel hackers.
|-
! 0.9.6 release candidate 18
| {{date|2011|06|14}}
| {{yes}}
| {{yes}}
|
* Adds support for jailbreaking iOS 4.2.8 on the [[N92AP|iPhone 4 (iPhone3,3)]].
|-
! 0.9.6 release candidate 19
| {{date|2011|07|12}}
| {{yes}}
| {{yes}}
|
* When a custom bundle is applied, most of the normal jailbreak steps (like stashing and untethering) are skipped.
|}

===0.9.7 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.7b1
| {{date|2010|12|26}}
| {{yes}}
| {{no}}
|
* Jailbreaks iOS 4.1-4.2.1 on all compatible devices.
** Able to achieve an [[untethered jailbreak]] on 4.2.1, provided the user has 4.2b3 [[SHSH]]s and the 4.2b3 [[IPSW File Format|IPSW]].
*** This version of "Jailbreak Monte" has quite a number of bugs, particularly app switcher crashes and disabled [[Bluetooth]].
|-
! 0.9.7b2
| {{date|2010|12|26}}
| {{yes}}
| {{no}}
|
* Fixes crashing bugs on GUI apps.
|-
! 0.9.7b3
| {{date|2010|12|27}}
| {{yes}}
| {{no}}
|
* Fixes crashing bugs completely.
|-
! 0.9.7b4
| {{date|2010|12|31}}
| {{yes}}
| {{no}}
|
* ubsmuxd integrated.
|-
! 0.9.7b5
| {{date|2011|01|08}}
| {{yes}}
| {{no}}
|
* Issues related to [[Bluetooth]] and the sandbox are resolved.
|-
! 0.9.7b6
| {{date|2011|01|10}}
| {{yes}}
| {{no}}
|
* fixes Skype
|}

===0.9.8 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.8b1
| {{date|2011|06|10}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b and 5.0b2 (when pointed at the beta IPSW) on all compatible devices except the [[iPad 2]].
|-
! 0.9.8b2
| {{date|2011|07|11}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, and 5.0b3 on all compatible device except the [[iPad 2]].
* Fixes the iOS 5.0b3 sandbox issues present in the previous version.
|-
! 0.9.8b3
| {{date|2011|07|16}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 4.3.4 and iOS 5.0b, 5.0b2, and 5.0b3.
|-
! 0.9.8b4
| {{date|2011|07|23}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, 5.0b3, and 5.0b4.
|-
! 0.9.8b5
| {{date|2011|08|09}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, 5.0b3, 5.0b4 and 5.0b5.
|-
! 0.9.8b6
| {{date|2011|08|23}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, 5.0b3, 5.0b4, 5.0b5, and 5.0b6.
|-
! 0.9.8b7
| {{date|2011|08|31}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] of iOS 5.0b, 5.0b2, 5.0b3, 5.0b4, 5.0b5 and 5.0b6.
* Performs a [[tethered jailbreak]] of iOS 4.3.5 and 4.2.10 without pointing at an older IPSW.
* Performs a [[tethered jailbreak]] of iOS 5.0b6 on a new, silently changed (by Apple) [[K48AP|iPad]] IPSW.
* Fixes a bug in the 4.2.10 jailbreak on the [[N92AP|iPhone 4 (iPhone3,3)]] [[tethered jailbreak]].
|-
! 0.9.8b7b
| {{date|2011|09|02}}
| {{yes}}
| {{yes}}
|
* Performs a [[tethered jailbreak]] for [[iOS]] 4.3.4, 4.3.5, 4.2.9, 4.2.10 on all supported devices except the [[N88AP|iPhone 3GS]] (old bootrom) and the [[iPad 2]]
* Performs an [[untethered jailbreak]] on [[iOS]] 4.1-4.3.3 on all supported devices except the [[iPad 2]]
* Performs a [[tethered jailbreak]] on [[iOS]] 5.0b - 5.0b7 on all supported devices except the [[N88AP|iPhone 3GS]] (old bootrom) and [[iPad 2]]
* Performs an [[untethered jailbreak]] on [[N88AP|Phone 3GS]] (old bootrom) on [[iOS]] 4.1-4.3.5 and 5.0b7
* Fixed lingering issues with the [[N92AP|iPhone 4 (iPhone3,3)]] 4.2.10 [[tethered jailbreak]]
|-
! 0.9.8b7c
| {{date|2011|09|06}}
| {{yes}}
| {{yes}}
|
* Same as 0.9.8b7b on all devices but [[N88AP|iPhone 3GS]] with [[06.15.00]] baseband
* Fixes [[iTunes Errors#Error 1015|error 1015]] when restoring to stock 4.3.5 on [[N88AP|iPhone 3GS]] with [[06.15.00]] baseband.
|}

===0.9.9 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
!0.9.9b1
|{{date|2011|09|19}}
| {{yes}}
| {{yes}}
|
*Complete rewrite.
*No longer requires IPSWs when jailbreaking public builds. When jailbreaking beta/Golden master firmwares, need to specify IPSW once, then auto-recognizes it.
*Redsn0w now fetches SHSH from device, querys Cydia about saved blobs, stitches IPSWs with SHSH blobs (not for iPhones) and able to submit SHSH to cydia
*Includes Terminal shell commands into the GUI.
|-
!0.9.9b2
|{{date|2011|10|04}}
| {{yes}}
| {{yes}}
|
*Fixes Verizon iPhone 4 firmware detection
*Fixes 'Fix Recovery'
*Fixes for Stitching
*Fixes for blob processing
|-
!0.9.9b3
|{{date|2011|10|05}}
| {{yes}}
| {{yes}}
|
*Auto-detects the iOS 5.0 GM firmware now.
*Allows a jailbreak (albeit still tethered apart from [[N88AP|iPhone 3GS]] [[Bootrom 359.3|old bootrom]]) on iOS5 GM
|-
!0.9.9b3a
|{{date|2011|10|05}}
| {{no}}
| {{yes}}
|
*Fixes a Windows-only caching bug
*Allows Windows users to rename the redsn0w exe to anything containing 'boot' to jump straight to the tethered boot stage on load (thus adding one-click tethered boot to Windows redsn0w)
*0.9.9b3 still works fine for Mac users except they don't have the new 'boot' rename feature that this version has
|-
!0.9.9b4
|{{date|2011|10|12}}
| {{yes}}
| {{yes}}
|
*Now auto-recognizes iOS 5 and no longer requires IPSW submission on iOS 5 jailbreak
|-
!0.9.9b5
|{{date|2011|10|13}}
| {{yes}}
| {{no}}
|
*Custom IPSW feature (from PwnageTool) for Baseband preservation.

|-
!0.9.9b6
|{{date|2011|12|18}}
| {{yes}}
| {{yes}}
|
*Fixes location services issues for iPhone 3GS with [[06.15.00]] baseband

|-
!0.9.9b7
|{{date|2011|10|21}}
| {{yes}}
| {{yes}}
|
*You can now choose whether you want redsn0w or Cydia to Stash Applications (can shorten redsn0w session by 60%)
|-
!0.9.9b8
|{{date|2011|11|03}}
| {{yes}}
| {{yes}}
|
*Jailbreaks iOS 5.0.1b (9A402) tethered on devices vulnerable to [[limera1n exploit]].
**Untethered on [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]).
|-
!0.9.9b9
|{{date|2011|12|19}}
| {{yes}}
| {{yes}}
|
* Jailbreaks iOS 5.0.1 tethered on devices vulnerable to [[limera1n exploit]].
** Untethered on [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]).
* iBooks fix.
* Allows custom IPSW creation for [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]) without SHSH blobs.
* Supports the 8 GB [[iPhone 4]].
* Allows stitched IPSW creation for iOS 5.x.
* Allows stitched IPSW creation for [[K94AP|iPad 2 (iPad2,2)]]s running iOS 4.3.x.
* Built-in version check.
|-
!0.9.9b9b
|{{date|2011|12|19}}
| {{yes}}
| {{yes}}
|
* Enables the “Custom” button in Windows to allow baseband preservation.
* Warns against flashing baseband [[06.15.00]] on newer iPhone 3GS devices (2011 week 35) more explicitly.
|-
!0.9.9b9c
|{{date|2011|12|19}}
| {{no}}
| {{yes}}
|
* Special build for Windows users encountering issues with the update check.
|-
!0.9.9b9d
|{{date|2011|12|20}}
| {{yes}}
| {{yes}}
|
* Addresses a problem with the [[untethered jailbreak]] on [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]) devices.
|}

===0.9.10 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.10b
| {{date|2011|12|27}}
| {{yes}}
| {{yes}}
|
* The jailbreak for iOS 5.0.1 is now untethered.
|-
! 0.9.10b2
| {{date|2011|12|27}}
| {{yes}}
| {{yes}}
|
* Fixes an issue with launchctl that the untether caused.
|-
! 0.9.10b3
| {{date|2011|12|28}}
| {{yes}}
| {{yes}}
|
* Fixes a problem where re-running redsn0w over an existing jailbreak would cause [[Mobile Substrate]]-based apps to stop running until Mobile Substrate was installed again.
|-
! 0.9.10b3 novcheck
| {{date|2011|12|29}}
| {{no}}
| {{yes}}
|
* ?
|-
! 0.9.10b4
| {{date|2012|01|15}}
| {{yes}}
| {{yes}}
|
* Includes a fix for [[iBooks]] on iOS 5.0.1.
* Addresses an issue where the launchctl fix didn't work sometimes.
|-
! 0.9.10b5
| {{date|2012|01|29}}
| {{yes}}
| {{yes}}
|
* Circumvents jailbreak detection in [[iBooks]] that caused ~10% of images to display properly.
|-
! 0.9.10b5b
| {{date|2012|02|01}}
| {{yes}}
| {{yes}}
|
* Fixes an issue with custom ramdisks on the [[N82AP|iPhone 3G]] and [[N72AP|iPod touch (2nd generation)]].
|-
! 0.9.10b5c
| {{date|2012|02|12}}
| {{yes}}
| {{yes}}
|
* Prevents redsn0w from crashing due to increasing ramdisk sizes.
|-
! 0.9.10b6
| {{date|2012|03|07}}
| {{yes}}
| {{yes}}
|
* Jailbreaks iOS 5.1 tethered on devices vulnerable to [[limera1n Exploit]].
** Untethered on [[N88AP|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]).
* Automatically detects MC model [[N72AP|iPod touch (2nd generation)]] with [[User:pod2g|pod2g]]'s steaks4uce exploit.
|-
! 0.9.10b6b
| {{date|2012|03|11}}
| {{yes}}
| {{no}}
|
* Fixes small issues for Mac OS X v10.5.8 and earlier.
|-
! 0.9.10b7
| {{date|2012|04|20}}
| {{yes}}
| {{yes}}
|
* Implements the Corona A5 jailbreak for iPhone 4S and iPad 2 devices still at 5.0.1
* Can also re-install that jailbreak for those who accidentally uninstalled the untether
* When stitching an IPSW, it can now grab your blobs directly from Cydia.
* Now shows a lot more info about your device, for instance, whether your iPhone 3G has the vulnerable baseband bootloader, or whether your iPhone 3GS has the old exploitable bootrom
|-
! 0.9.10b8
| {{date|2012|04|23}}
| {{yes}}
| {{yes}}
|
* Can backup those priceless activation tickets many are grabbing today
* Adds ability to backup arbitrary directories or files from your device into a ZIP file on your Mac or PC
|-
! 0.9.10b8b
| {{date|2012|04|23}}
| {{yes}}
| {{yes}}
|
* Makes the ZIP files compatible with the native Windows Explorer.
|}

===0.9.11 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.11b1
| {{date|2012|05|11}}
| {{yes}}
| {{yes}}
|
* Newer devices ([[iPad 2]], [[iPad (3rd generation)]], and [[N94AP|iPhone 4S]]) are able downgrade as well. In a radical departure from previous versions of [[redsn0w]], it now directly supports restoring [[IPSW File Format|IPSW]]s to your device.
|-
! 0.9.11b2
| {{date|2012|05|12}}
| {{yes}}
| {{yes}}
|
* Adds support for downgrading to [[Telluride 9A406 (iPhone4,1)|iOS 5.0.1 build 9A406]] for the [[N94AP|iPhone 4S]].
|-
! 0.9.11b3
| {{date|2012|05|14}}
| {{yes}}
| {{yes}}
|
* This release should fix the "Restore failed" messages people were sometimes getting.
* Behaves better with nearby devices that have Wi-Fi syncing enabled.
|-
! 0.9.11b4
| {{date|2012|05|14}}
| {{yes}}
| {{yes}}
|
* Completes the tethered jailbreak support for iOS 5.1.1 on A4 devices and earlier, including proper "Stitching" and "Custom" creation of NO_BB [[IPSW File Format|IPSW]]s
|}

===0.9.12 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.12b
| {{date|2012|06|04}}
| {{yes}}
| {{yes}}
|
* Adds [[Rocky Racoon]] for all devices on iOS 5.1.1.
** On A4 devices and earlier, users can choose between the backup restore method (like [[Absinthe]]) or using a ramdisk-based jailbreak (how redsn0w usually works).
|-
! 0.9.12b2
| {{date|2012|06|08}}
| {{yes}}
| {{yes}}
|
* Users on iOS 5.1.1 are now explicitly asked if they wish to use the backup/restore method or the DFU ramdisk method for jailbreaking.
* Fixes iBooks problems on the iPhone 3GS (old bootrom).
* Provides more helpful error messages.
|}

===0.9.13 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.13 developer-only 1
| {{date|2012|06|13}}
| {{yes}}
| {{yes}}
|
* Jailbreaks [[iOS]] 6.0b.
|-
! 0.9.13 developer-only 2
| {{date|2012|06|15}}
| {{yes}}
| {{yes}}
|
* Fix the various SSH problems and crashes with apps that some have been seeing.
|-
! 0.9.13 developer-only 3
| {{date|2012|07|16}}
| {{yes}}
| {{yes}}
|
* Covers 6.0b3 release and also adds explicit support for 6.0b2.
|-
! 0.9.13 developer-only 4
| {{date|2012|09|13}}
| {{yes}}
| {{yes}}
|
* ???
|}

===0.9.14 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.14b1
| {{date|2012|06|18}}
| {{yes}}
| {{yes}}
|
* Add a baseband downgrade option in redsn0w for those who are using the iPad’s [[06.15.00]] baseband on the iPhone 3G or iPhone 3GS.
|-
! 0.9.14b2
| {{date|2012|07|04}}
| {{yes}}
| {{yes}}
|
* Improves the iPad baseband downgrade and should cover anyone who couldn’t downgrade with 0.9.14b1. Also simplified the process and added logging to help diagnose any remaining stubborn iPhones.
|}

===0.9.15 series===
{| class="wikitable"
! Version
! Release date
! OS X-compatible?
! Windows-compatible?
! Changes
|-
! 0.9.15b1
| {{date|2012|10|14}}
| {{yes}}
| {{yes}}
|
* Tethered jailbreak for iOS 6.0 on the [[K66AP|Apple TV (2nd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], and [[N81AP|iPod touch (4th generation)]].
** Untethered for iPhone 3GS devices with the [[iBoot-359.3|old bootrom]].
* Allows devices with the A5 or newer to restore to iOS 5.x, as long as they have iOS 4.x or 5.x installed.
|-
! 0.9.15b2
| {{date|2012|10|15}}
| {{yes}}
| {{yes}}
|
* After restoring an [[N88AP|iPhone 3GS]], redsn0w keeps track of its bootrom version while it's still open.
* Fixes support for upgrading to/downgrading baseband [[06.15.00]].
|-
! 0.9.15b3
| {{date|2012|11|01}}
| {{yes}}
| {{yes}}
|
* Save iPad (4th generation) and iPad Mini SHSH blobs.
* Fixes of error 14 when stitching blobs and error 2601 for windows users when restoring.
|}

== Exploits used ==
For [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]]:
*[[Pwnage]]
*[[Pwnage 2.0]]

For [[N72AP|iPod touch (2nd generation)]]:
*[[0x24000 Segment Overflow]]
*[[ARM7 Go]] - used to upload the oversized [[LLB]] required to utilize the 0x24000 Segment Overflow.
*[[usb_control_msg(0xA1, 1) Exploit]] - used (in redsn0w 0.9.6b) to upload the oversized [[LLB]] to utilize the 0x24000 Segment Overflow, as well as a [[tethered jailbreak]] on units with the [[Bootrom 240.5.1|new bootrom]].

For [[N88AP|iPhone 3GS]]:
*[[0x24000 Segment Overflow]]
*[[iBoot Environment Variable Overflow]] - Exploit has a different implementation from [[User:geohot|geohot]]'s implementation in [[purplera1n]].
*[[usb_control_msg(0x21, 2) Exploit]]
*[[limera1n]] exploit

For [[N18AP|iPod touch (3rd generation)]]:
*[[usb_control_msg(0x21, 2) Exploit]]
*[[limera1n]] exploit

For [[iPhone 4]], [[N81AP|iPod touch (4th generation)]], [[K48AP|iPad]] and [[K66AP|Apple TV (2nd generation)]]:
*[[limera1n]] exploit

For [[K48AP|iPad]], [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch (3rd generation)]] and [[N81AP|iPod touch (4th generation)]]:
* [[Corona]]
* [[Racoon String Format Overflow Exploit]]
* [[ HFS Heap Overflow]]
* [[BackupAgent]]

== External Links ==
*[https://sites.google.com/a/iphone-dev.com/files/home/ Official redsn0w download links]
* [http://web.archive.org/web/20120112055850/http://thepiratebay.org/user/iphonedev Official iPhone Dev Team torrents]
*[http://blog.iphone-dev.org/tagged/redsn0w iPhone Dev Team blog with redsn0w information]
*[http://blog.iphone-dev.org/redsn0w-iOS5 redsn0w beta infos (outdated)]

[[Category:Hacking Software]]
[[Category:Jailbreaking]]
[[Category:Jailbreaks]]

Electra

2018-08-30T07:51:14Z

Sbingner: Release Jaywalker from nitoTV's basement

{{Infobox software
| name = Electra
| title = Electra
| developer = [https://twitter.com/coolstarorg CoolStar]
| released = {{Start date|2018|01|13|df=yes}}
| latest release version = 1.0.4 (11.0-11.1.2) 1.0.5 (11.2-11.3.1)
| latest release date = {{Start date and age|2018|03|09|df=yes}} (iOS 11.0-11.1.2) {{Start date and age|2018|07|13|df=yes}} (iOS 11.2-11.3.1)
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [https://coolstar.org/electra1112/ Electra (11.0-11.1.2)] [https://coolstar.org/electra/ Electra (11.2-11.3.1)]
}}
'''Electra''' is a [[semi-untethered jailbreak]] for all devices running 11.0 - 11.3.1. There are two versions of Electra - one supporting iOS 11.0 - 11.1.2, and the other supporting iOS and tvOS 11.2 - 11.3.1.

== Electra for iOS 11.0 - 11.1.2 ==
The first beta for iOS 11.0 - 11.1.2 was released on January 13, 2018. Several betas were released. The betas did not include support for [[Cydia]], however the developer, CoolStar later seeded six release candidate versions to developers with working Cydia support. Electra1112 was then officially released on February 26, 2018.

{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| Beta 1
| 13 January, 2018
| Initial release
|-
| Beta 2
| 13 January, 2018
|
*Fix Anemone not recognising themes
*Fix black screen when jailbreaking with tweaks enabled
|-
| Beta 3
| 13 January, 2018
|
*Unlock all NVRAM variables (including setting boot-nonce) [thanks stek29]
*Add support for binaries with SHA1 hashes (so existing dylibs work fine, but executables will need the entitlement) [thanks stek29]
*Clean up some garbage files that were present from previous build (yay macOS resource forks and .DS_Store)
*Hopefully fix the app icon not displaying on iPhones
*Significantly speed up the rejailbreak process
|-
| Beta 3-2
| 14 January, 2018
|
*Don't unlock NVRAM variables due to the patch crashing some devices.
|-
| Beta 3-3
| 14 January, 2018
|
*Fix the NVRAM patching crashing due to the memory page being unmapped (thanks Siguza)
|-
| Beta 4
| 14 January, 2018
|
*Disable NVRAM patching as it still appears to be unstable
*Make amfid patch more reliable so that more dylibs can be run properly
*Add a "shim" so existing substrate tweaks can use libsubstitute without modifications
|-
| Beta 4-2
| 14 January, 2018
|
*Fix a symlink that would prevent some substrate extensions from working with libsubstitute
|-
| Beta 5
| 14 January, 2018
|
*Fix an issue in the substrate shim where substitute could crash if tweaks tried hooking nonexistent selectors
*Fix an issue with the dylib loader dragging UIKit (and all its tweaks) into every single daemon
*Make jailbreakd more robust with input struct size check enforcement
|-
| Beta 6
| 16 January, 2018
|
*Add a working launchctl for loading launch daemons (thanks nullpixel)
*Load dropbear as a launch daemon & fix zombie process issue (thanks nullpixel)
*Set kernel task as host special port #4 (thanks stek29)
|-
| Beta 6-2
| 17 January, 2018
|
*Fix kernel memory leak in entitlement injector
|-
| Beta 6-3
| 18 January, 2018
|
*Use host special port #4 to get tfp0 in jailbreakd (thanks n_triangle_dev)
*Add jailbreakd as a launchd service so it gets restarted if it dies (thanks n_triangle_dev)
|-
| Beta 6-4
| 20 January, 2018
|
*Don't make jailbreakd rely on pidlistuptrs bug (thanks stek29)
*log dylib load errors in SBInject (thanks stek29)
*Clean up launchd payloads (thanks stek29)
*Load dylibs alphabetically from SBInject (thanks c0ldra1n)
*Check for jailbreakd start before reloading backboardd
*Make rejailbreaking significantly faster
|-
| Beta 7
| 23 January, 2018
|
*amfid now gets re-patched if it ever gets killed (stek29 and coolstar)
*clean up amfid patch (stek29)
*Add 3d touch shortcut for jailbreaking (ca13ra1)
|-
| Beta 8
| 26 January, 2018
|
*Sandbox mitigations are now in place so /Library, /private/var/mobile/Library/Preferences and /bootstrap are now accessible to all processes! (stek29, coolstar)
*Workaround sandbox mitigations not taking place on apps' first launch (coolstar)
*Improve reliability of amfid patch so it doesn't hang on malformed requests (e.g. SysSecInfo)
*'''Known Bug:''' Apps will take longer to launch the first time they're launched after rejailbreaking due to a workaround for another bug w/ unsandboxing not working on first launch
|-
| Beta 8-2
| 26 January, 2018
|
*Fixes issues with WebKit (Safari/Chrome), receiving calls, and downloading App Store apps by not working around the sandbox issue in those processes
*'''Known Bug:''' Apps will take longer to launch the first time they're launched after rejailbreaking due to a workaround for another bug w/ unsandboxing not working on first launch
|-
| Beta 9
| 27 January, 2018
|
*Sandbox is now working on the first launch for apps and daemons (thanks stek29)
*Remove 0.5 second delay when launching apps or daemons that was present since beta 1 (coolstar)
*Check if a new beta is available when electra is launched
*Double-launch workaround has been removed since it's no longer needed, fixing all bugs introduced on beta 8
*Remove AnemoneFonts.dylib as it was causing problems
*'''Important Note:''' If you are upgrading from beta 8-2 or lower to any beta 9 or higher, you will need to reinstall all tweaks and themes
|-
| Beta 10
| 01 February, 2018
|
*Fix certain codesigned binaries not working with our amfi payload (coolstar)
*Add darwintools, debiantools (not dpkg), shell-cmds, system-cmds and uikittools
*Re-sign most of the bootstrap as SHA1 to prepare for them to be pushed to a repo
*Code cleanup (stek29 and nullpixel)
*Fix update checker erroneously saying there's an update in airplane mode
|-
| Beta 11
| 09 February, 2018
|
*Add libjailbreak so command line tools, apps, etc. can talk to jailbreakd if needed (n_triangle_dev)
*Use XPC instead of UDP from libjailbreak and xpcproxy (n_triangle_dev)
*Use TCP instead of UDP from launchd (coolstar)
|-
| Beta 11-2
| 10 February, 2018
|
*Significantly improve the reliability of jailbreakd so it can handle a large amount of process launches at once (coolstar)
*Make jailbreakd print directly to stderr rather than NSLog (coolstar)
*Fix a race condition in beta 11 that would cause jailbreakd to sometimes inject too early, and thus fail to inject (coolstar)
|-
| Beta 11-3
| 12 February, 2018
|
*Fix a race condition on jailbreakd's launch to improve success rate of jailbreak
|-
| 1.0
| 26 February, 2018
|
*Initial Release
|-
| 1.0.1
| 26 February, 2018
|
*Fix some false positives where Electra would think topanga was installed when only liberiOS was
|-
| 1.0.2
| 27 February, 2018
|
*Fix false positives where Electra would think topanga was installed when only liberiOS was
*Prevent loading pacakges from saurik's repo (since Cydia can't be patched to remove it)
*Fix APT 0.7 Strict (lib) on devices that may have already updated to the broken copy from saurik's repo
|-
| 1.0.3
| 4 March, 2018
|
*Revert change to XPC in xpcproxy in beta 11
*Fix intermittent freezing issues that would affect certain devices on beta 10 -> 1.0.2
|-
| 1.0.4
| 9 March, 2018
|
*Remove all XPC code that could possibly have been problematic ever since beta 11
*Replace TCP, UDP and XPC with MIG (thanks Psychotea from the [[Meridian]] team)
*Recommended to also update Tweak Injector to 1.0.4 from our repo to get safe mode in system daemons as well
|}

== Electra for iOS/tvOS 11.2 - 11.3.1 ==

With Electra's update to support devices running any iOS between 11.2 to 11.3.1 (including betas), delays came in place due to Apple's APFS snapshot mitigation of remounting the root filesystem as read/write that was introduced in iOS 11.3. There are many parts of a jailbreak that need read/write to do certain things within the filesystem, and because of Apple's mitigation, a APFS remount workaround was needed to complete the jailbreak. Chinese security researcher [https://twitter.com/SparkZheng Min Zheng] had already found and created his own bypass to remount the root filesystem, which many other developers then tried implementing in their own way. During this time, [https://twitter.com/Morpheus______ Jonathan Levin], creator of the [[LiberTV]] jailbreak for the AppleTV was announcing his plans for updating LiberTV with an APFS remount which the Electra Team could use. Meanwhile, CoolStar had already found a 0day in APFS which would allow the filesystem to be remounted as r/w, but wanted to save it for future use in iOS 12. As this news was absorbed by the community, many people were angry that CoolStar wanted to delay the update for Electra by saving the 0day. However, CoolStar had found yet another 0day and decided to end the waiting on Levin's remount and use one of his APFS 0days instead. Electra1131 was then released a little while later on July 6, 2018.

Support for tvOS 11.2-11.3 was released in a separate IPA on July 12, 2018. Nicknamed "electraTV", this was released in conjunction with nitoTV, who has also released jailbreaks like [[backr00m]], and Jaywalker.

{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| 1.0
| 6 July, 2018
|
* Initial Release
|-
| 1.0.1
| 7 July, 2018
|
* Fix app icon not showing up for certain users
* Fix nonce Generator not being set certain times
|-
| 1.0.2
| 8 July, 2018
|
* Use different bundle identifier for mptcp version
* Increment bundle id properly
* Hopefully fix success rate regression with multipath 1.0.1
|-
| 1.0.3
| 9 July, 2018
|
*Add support for 11.4 beta 1 - 11.4 beta 3 (multipath only tested on these firmwares)
|-
| 1.0.4
| 12 July, 2018
|
*Initial release for tvOS (huge thanks to nitoTV and Jaywalker!)
|-
| 1.0.5
| 13 July, 2018
|
*tvOS Only - Fix bugs with 1.0.4 causing long and unreliable jailbreak process
|}

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Wildcat 7B500 (iPad1,1)

2012-01-16T07:06:59Z

Sbingner: NeedService?

{{keys
| version = 3.2.2
| build = 7B500
| device = ipad11
| codename = Wildcat
| baseband = 06.15.00
| downloadurl = http://appldnld.apple.com/iPad/061-8801.20100811.CvfR5/iPad1,1_3.2.2_7B500_Restore.ipsw

| rootfsdmg = 018-8370-001
| rootfskey = 18ae1e76e7bcf6478321f42888606ca2d998cffab1ee8c7ca6b15d57b1a7254f8a608823

| updatedmg = 018-8374-001
| updateiv = 3f6f0bdb71a33c801a9b67a616e9cfe3
| updatekey = 3188be37002aef49c9f54d91da23857f89045118c2bb1e6f1db906c98dbb5230

| restoredmg = 018-8375-001
| restoreiv = 309d4fc146b47f43e8bc27133d7ce6bc
| restorekey = f45eaec8b6c17af7c6071635a313572b1b0208bc445cfb6c1d60b6bf377e6653

| AppleLogoIV = 743a4d54b0da0b23662885bd6a8a9ce1
| AppleLogoKey = aae7b027f6d797b0a95459a13b1c0d9749f2279a5de4356239ddf34ede15fd39

| BatteryCharging0IV = ca2515a2fbfcfab8ce7a47b6cba1b876
| BatteryCharging0Key = 1312baba3b441ff21c1ab71bedb812747613b59aa09d04e323de52ab0f61129b

| BatteryCharging1IV = 7503542226c2798c39f703505820aa60
| BatteryCharging1Key = f0b999bf581a0dee8863a53ec78b5dc6e5f4f3b22ac1351581507884922d7eb8

| BatteryFullIV = fce6ea7541baca8b3003791d2efc155c
| BatteryFullKey = 1077d59ceeae77e6ec6b380fcecd0e6922a24c50c61116af9a7ac183779da042

| BatteryLow0IV = db114d8b404363aa0a093ef96eb8b2ae
| BatteryLow0Key = b6ea4e0377f87f3b0f5cc53ce8557560b33af64d0cf5a02fbf1e58cde0b72d80

| BatteryLow1IV = 5c82e6ac3d35183cf1a0c78523c35f6e
| BatteryLow1Key = 72a8537c4f1858ea7969190ddb297b48a7ccbe63bf929c4826e437b60f3f0ebc

| DeviceTreeIV = 3f48a3e3a7bc563824a488fbd1f51639
| DeviceTreeKey = 21395bd5848bea1df6a18b62de234b4bb3b9ce67b7fd6a4e6a968780e805a1a3

| GlyphChargingIV = 70f5515133cab74d5852956d4e26d8b1
| GlyphChargingKey = 850a70fe9fb050c934424ae8c39293d239d89bef523246993cddc40c8cfd3a63

| GlyphPluginIV = 51ad1b46301e2bcd9ddfe6b4a775a29a
| GlyphPluginKey = bd23381af4381f8bbb4ec816361b1f072e5be37542ca53d6afdb8b0e9c5d726c

| iBECIV = 7cc0fcf856d754d163efafa7ab751ef1
| iBECKey = 11d18ab20469d399c1bfc0a30159499024eb393b5fe4fecdf6b049e119071fed

| iBootIV = 1fde75187fea653b42170b71c9b4844e
| iBootKey = 8eb56b03a0e081dd175d3d076c5b07eca73847d27c93186783059728a1a1831d

| iBSSIV = 3a0ad7cf0f172bc3736af2099a4a89b4
| iBSSKey = 0dcdc5bdc0d991020222c0e7b7d11305466f0ef831964c5fc9325f05e32b1a09

| KernelcacheIV = f89438cd21803ce315d98c032c4e6c27
| KernelcacheKey = f8a5166b935ab9593872065cc25ea2b3824ddc3799a83b47e55d1d046d0522ac

| LLBIV = a00118ed3a126fe16781a080f2b1d6bd
| LLBKey = 910fd0fd2bb43ad4aad2496a835c2c90f62aa6fda61419b087187f19c25b5959

| NeedServiceIV = 6e134d4b09d6334970ac901be8beb0e2
| NeedServiceKey = 3dbf02aa01f65e772f8254efe03afdb674550b6f8482a5e57d34a37825132ac5

| RecoveryModeIV = 9d88f32f9cbda46d323d85add8292bec
| RecoveryModeKey = dfc2bb2afdcb7b9ab1cd67da8de051fb4f32b851d42444eDfe8bbedf5c36a2b3
}}

Talk:Firmware Keys

2011-11-12T02:17:06Z

Sbingner: /* Major Resorting Request */

== 2.0 beta 8 key? ==
Would anyone, by any chance, have the key for 2.0 build 5A345? For some reason, it's missing on this page. -[[User:Dialexio|Dialexio]] 16:13, 17 August 2008 (UTC)

== VFDecrypt error ==
When I try with the command I get a warning message.It shows that cygcrypto-0.9.8.dll was not found.I've searched this file but it seems I can't find it.Thanks for helping me in advance. {{unsigned|Delstam|14:30, August 1, 2009 (UTC)}}
:This DLL is part of Cygwin. You can get it here: [http://www.mirrorservice.org/sites/sourceware.org/pub/cygwin/release/openssl/openssl-0.9.8k-1.tar.bz2/usr/bin/cygcrypto-0.9.8.dll?extract=true] --[[User:Blackbox|Blackbox]] 14:45, 1 August 2009 (UTC)
::Thanks {{unsigned|Delstam|14:58, August 1, 2009 (UTC)}}
:::Hey, I need this file too, but the link seems to now be broken. I just got it from [http://www.mediafire.com/?wznnyt5izmu here] instead. Just thought I'd make a note in case anyone else needs it. [[User:MaybachMan|MaybachMan]] 13:17, 17 August 2010 (UTC)
:::: ...Cygwin1.dll can also be gotten [http://www.dll-files.com/pop.php?dll=cygwin1 here.] {{unsigned|MaybachMan|13:27, August 17, 2010 (UTC)}}
:::::I'm working on getting my fork of VFDecrypt running on Windows. Soon as I get it compiled, I'll post the download link to a /native/ Windows binary. --[[User:Dra1nerdrake|dra1nerdrake]] 17:35, 17 August 2010 (UTC)

==VFDecrypt for Mac link==
The link in the article is broken, does anyone have a working one? [[User:MaybachMan|MaybachMan]] 11:39, 19 August 2010 (UTC)
:Use mine from github and build it with 'make linux'. It (should) work. If it does, please post back here so I can update the program. If it doesn't, post back here with the error and I'll try to debug it. --[[User:Dra1nerdrake|dra1nerdrake]] 21:13, 19 August 2010 (UTC)
''vfdecrypt.c:42:22: error: byteswap.h: No such file or directory''
''make: *** [linux] Error 1''
:--[[User:MaybachMan|MaybachMan]] 10:44, 20 August 2010 (UTC)
::You can get a version that will compile on Mac OS X at [https://github.com/coryleach/VFDecrypt GitHub].

==iKeys==
I was wondering if anyone had any info on "iKeys". It's mentioned [http://pastie.org/1161868 here] at the bottom. I'd Imagine it's like GenPass but just wondering. Any info is appreciated. --[[User:OMEGA_RAZER|OMEGA_RAZER]]

== Remove Request ==
As someone mentioned on the [[Talk:VFDecrypt_Keys:_3.x_BETA#STOP|Firmware 3.x Beta talk page]], I want to request that the whole section "Firmware" on this page here gets removed and all mentioned pages deleted as well. The information there (the VFDecrypt keys) should go into their appropriate firmware page. Or do we still need all VFDecrypt keys (only) together also? If yes, then at least it should be cleaned up and these pages should mention that these are duplicates for the sake of grouping. --[[User:Http|http]] 10:17, 23 October 2010 (UTC)
: I think we should just protect the pages [[VFDecrypt Keys:_1.x]], [[VFDecrypt Keys: 2.x]], [[VFDecrypt Keys: 3.x]], and [[VFDecrypt Keys: 3.x BETA]]. And if someone discovers a key for those Firmwares we should add it to the talk page for an admin to add. --[[User:Balloonhead66|Balloonhead66]] 15:03, 23 October 2010 (UTC)
:These pages are really chaotic. For the 1.x and 2.x pages, it is unknown if they are for the iPhone or iPod touch (or for both). We can just assume something, or try. The 3.x pages contain not only vfdecrypt keys, but some ramdisk keys as well. And some have beta mixed within, others not. I assume that all keys are on their respective firmware page already. If not, then we should create the missing pages and link them to the [[Firmware]] or [[Beta Firmware]] page. I'll start with that some time if I find the time - feel free to help. But then, if all keys are available on their firmware page, why would we still need these pages? I still request to delete them. We could add a cross table on this page with firmware vs. device and in each cell a link, so that we easily find the page with the keys. I think I'll add this table right away. Then there's no need for these pages anymore. Please discuss here if you agree to remove them afterwards. -- [[User:Http|http]] 20:14, 29 October 2010 (UTC)
:I don't think we should delete the key pages until the table shows all blue links so that way we don't trash any keys on accident. --[[User:Balloonhead66|Balloonhead66]] 15:33, 30 October 2010 (UTC)
::After making sure we have all keys on their firmware pages, I went ahead and copied the text to this page and deleted the 4.x (final) page. The others will follow, after checking them also. -- [[User:Http|http]] 21:25, 6 November 2010 (UTC)
:::Ok, now the other pages are also removed and all keys there are on its own page as discussed. Sorry for spamming the Recent changes list. I copied mostly the existing pages, but some of them were not following the standard, so this means the new pages also don't follow the standard. This means more cleanup is necessary. Also I removed the KBAGs as discussed somewhere else where I saw them. I added the Pesudo-GID on three pages (S5L8900 for 3.0 Build 7A341). I have no idea what this is for, so feel free to remove it again if you think this is not necessary. For the 1.x pages Dialexio wrote that the VFDecrypt keys are for both iPhone and iPod touch, so I copied them to both pages. I hope this is correct. For the 2.x pages there was also not mentioned for what device the keys were, so I copied them to the iPhone, or, where it was clear from the version number, only to iPod touch. For versions lower than 2.1 I copied them to both, but since 2.1 only the ramdisk keys were copied to both pages (as S5L8900 applies to iPhone, iPod touch and iPhone 3G). I hope this is all correct. (I'm not very experienced with handling these keys yet.) Because I didn't look into each ipsw, I don't know what files are in there, so I didn't create all necessary sections. This means more cleanup is necessary. Also all keys should be in lower case. I didn't change them, I just copied them over, hopefully without any copy/paste errors. There is much more work left, but I hope I didn't mess it up, but helped to improve the overall structure. Ok, now you can reply and shoot on me. -- [[User:Http|http]] 00:25, 31 December 2010 (UTC)

== Download Table ==
Does everyone like my table in the download section? --[[User:Balloonhead66|Balloonhead66]] 18:09, 23 October 2010 (UTC)
:The x86 version of VFDecrypt also works on x64, should note that. --[[User:JacobVengeance|JakeAnthraX]] 01:04, 27 October 2010 (UTC)

== Exploit? ==
am i to understand that a low level exploit is needed to get the vfdecrypt key???
--[[User:Shengis14|Shengis14]] 18:50, 8 October 2010 (UTC)
:No, that's not completely true. :P One has to manage to get the key/iv for an update/restore ramdisk, and then use [[Genpass]] to get a VFDecrypt key. --[[User:Dra1nerdrake|dra1nerdrake]] 21:27, 8 October 2010 (UTC)
And how would someone like myself go about getting the Key/IV for an update/restore ramdisk --[[User:Shengis14|Shengis14]] 22:13, 8 October 2010 (UTC)
:You would need at least an iBoot exploit and a payload to upload that is able to access the AES engine of the device. --[[User:OMEGA RAZER|OMEGA RAZER]] 22:16, 8 October 2010 (UTC)
::It's just one of the reasons I'm confused is how is there a sudden jump in the number of vfdecrypt keys for the iPod touch 3G on like 4.0-1??
:::There isnt a exploit that is iBoot or lower for that device. Any thoughts ? --[[User:Shengis14|Shengis14]] 22:50, 8 October 2010 (UTC)

== New page? ==
I think we should make a new page detailing how to utilise [[User:Gojohnnyboi|Gojohnnyboi]]'s AES payload to get the keys including screenies on opening up an img3 in a hex editor and getting the [[KBAG]] etc. Then the keys won't be left to the main devs and [[User:iH8sn0w|iH8sn0w]] to post. Then all these beta FWs can be decrypted faster and more keys can be posted. I myself would definitely be interested in getting the KBAG etc. and if anybody could create such a page then I would definitely be interested in posting keys myself. Once created the page shouldn't need too much housekeeping either since the process won't change until IMG4 comes along which I will dread :P Who's up to it?? [[User:Windows Helpdesk|blackthund3r]] 11:43, 20 October 2010 (UTC)

== Page split request ==
I think we should split this page into two. The first half deals more with the VFDecrypt program, not the keys as the title would suggest. Perhaps we can move the info related to the program to [[VFDecrypt (program)]], and make [[VFDecrypt]] a disambiguation page. --[[User:Dialexio|Dialexio]] 00:17, 7 November 2010 (UTC)
:I like that, but think it should just be [[VFDecrypt]] for the program and dont make a disambiguation page, [[:Category:VFDecrypt]] is like a disambiguation page already... Also making the current page info on the keys would be more like it as that is what the page waws orrigionally... --[[User:Balloonhead66|Balloonhead66]] 00:25, 7 November 2010 (UTC)
:Yes, VFDecrypt should be about the program or a disambiguation page and here only infos about the keys. All this stuff about the other programs don't really belong here either. That could go to the disambiguation page or small under a "see also" section. Don't forget all the links like <nowiki>[[VFDecrypt Keys|VFDecrypt]]</nowiki> have to get fixed. -- [[User:Http|http]] 00:56, 7 November 2010 (UTC)
::So, it's settled. I'll get to moving all of the info related to the actual program to the page [[VFDecrypt]]. --[[User:Dialexio|Dialexio]] 21:25, 10 November 2010 (UTC)

== Comments from deleted page VFDecrypt Keys: 4.x BETA ==
i'm trying to genpass a s5l8720x key, but seems to be invalid --[[User:Qwertyoruiop|Qwertyoruiop]] 00:19, 11 April 2010 (UTC)
:GenPass for 3.x isn't working on 4.0 rootfs. --[[User:Cichacz|Cichacz]] 10:40, 11 April 2010 (UTC)
::thx --[[User:Qwertyoruiop|Qwertyoruiop]] 10:57, 11 April 2010 (UTC)
:We can only try asking [[User:MuscleNerd|MuscleNerd]] to post the new one script :) --[[User:Cichacz|Cichacz]] 11:05, 11 April 2010 (UTC)
:ih8sn0w has some scripts too, maybe try asking him --[[User:Pjakuszew|pjakuszew]] 13:34, 11 April 2010 (UTC)
:is there a manual way to aquire those keys? after looking at genpass source it looks like openssl could be involved. couldnt hurt to ask someone for their script though --[[User:Jimmy.M|Jimmy.M]]
::reversing asr could be a solution. --[[User:Qwertyoruiop|Qwertyoruiop]] 15:37, 11 April 2010 (UTC)
::I think it's better to keep the scripts non-public. If there was a public script for getting the vfdecrypt keys, Apple developers could move the keys again and we will have to find yet another method for getting the vfdecryptk's. --[[User:Pjakuszew|pjakuszew]] 15:41, 11 April 2010 (UTC)

== Comments from deleted page VFDecrypt Keys: 3.x (BETA) ==
What's about ramdisk decrypt keys for beta 1? {{unsigned|Cartman|15:22, April 15, 2009}}
:There were no ramdisk decrypt keys for beta 1, beta 1 ''firmware'' files were not encrypted, only wrapped in an IMG3 container with no encryption.--[[User:Cool name|Cool name]] 15:39, 15 April 2009 (UTC)

== James ==
James, would you mind explaining this last edit for me? I don't see any problem with leaving the iPod touch & iPhone 3G keys both on the page....{{unsigned|Cool name|01:02, April 17, 2009}}
:Those are the ramdisk keys and they're exactly the same. They have always been the same and I was waiting for someone to post another model and confirm that. The only model that will have different keys will be the iPod 2G, which I should really edit in. --[[User:James|James]] 01:51, 17 April 2009 (UTC)
::Ahh, my bad with that. I didn't realize they were the same keys :P Feel free to edit the page however you want --[[User:Cool name|Cool name]] 02:08, 17 April 2009 (UTC)

== Octothorpe ==
Why cleanup the ramdisk keys? They are split into bytes on the 2.x page also, so changing them just makes formatting inconsistent. I can why the rest of the changes were needed though. --[[User:James|James]] 03:55, 18 April 2009 (UTC)
:I like them not separated, I only did that at first because I was lazy. {{unsigned|Geohot|05:46, April 18, 2009}}
::Well, it's all corrected now on the 2.x page. If anyone has a problem, feel free to revert. --[[User:James|James]] 09:40, 18 April 2009 (UTC)
:@Octothorpe: thanks for moving this page, I thought about doing it earlier, i'm just a lazy bastard --[[User:Posixninja|posixninja]] 02:23, 18 June 2009 (UTC)
:@OmegaRazor: about VFDecrypt Keys: 3.x, not VFDecrypt Keys: 3.x BETA, chronic has a better idea about orginizing the key/iv for each firmware, see [[Kirkwood_7A341_(iPhone_3G)]] so this page will probably be deleted in the future. also you didn't really explain how the kbag key was used, or mentions GIDecrypt --[[User:Posixninja|posixninja]] 14:57, 18 June 2009 (UTC)
:all these keys are over at [[Kirkwood 7A341 (iPhone 3G)]] and [[Kirkwood 7A341 (iPod touch 2G)]] {{unsigned|posixninja|15:51, June 21, 2009}}
::Whould you please post vfdecrypt keys for 3.1 beta firmware? --[[User:Redart|Redart]]
:::Here they are:
:::2G: dd832e7ce186077bf0b4c5934c1b38b6d55c01c1f04e1ffde721792b1fe06e68e1125f29
:::3G: f526d42d44dcf61dadf5a0b4be7eb18dafd66c88ec6d91e3ac2f08d3179b63ce64108530
:::Not sure where is the proper place to put them.... --[[User:Redart|Redart]]
::::How did you get these anyways? I didn't even look into it until today, and you certainly didn't use any of our tools as they're all broke as of 3.1. I'm just curious, i've noticed a couple people posting fsroot keys while genpass has been broke for awhile, is there another group out there making their own private tools or something? --[[User:Posixninja|posixninja]] 18:50, 10 July 2009 (UTC)
:::::The man who got them said that he used GenPass. I assume that he is the one who made custom quickPwns for 3.0 betas from Russia. --[[User:Redart|Redart]]
::::::This vfdecrypt key for iPod Touch 2G 3.1 Beta Software doesn't work for me.I'm trying it on iPod2,1_3.1_7C97d Software Please post another vfdecrypt key.Thanks. {{unsigned|Delstam|08:04, August 3, 2009}}

== 3GS 3.1.3 ==
And the key for 3gs 3.1.3 firmware? --[[User:L0g0|L0g0]] 01:26, 26 July 2010 (UTC)
:You mean [[SUNorthstarTwo 7E18 (iPhone 3GS)|these]]? --[[User:Dialexio|Dialexio]] 01:54, 26 July 2010 (UTC)

== STOP ==
The article says to stop adding/editing pages like this one, add the keys to a firmware version and add a link to the firmware page. Fine. But on the Firmware page we dont list the beta firmwares. Should we create a beta firmware page to link to all the beta firmware key pages? --[[User:Http|http]] 22:36, 22 October 2010 (UTC)
:yes [[User:ih8sn0w]] know's how to get the key's and now i realise that that is what makes him a hacker ( not evan the real hacker's look after the wiki ) --[[User:Liamchat|liamchat]] 23:07, 22 October 2010 (UTC)

== Table merge ==
Any one but me think about merging the two tables? I will do it. --[[User:Balloonhead66|Balloonhead66]] 14:26, 17 July 2011 (MDT)
:I intentionally kept them separate when creating them, as it was a wish not to include betas in the real list. Looking back, I think it was still a good idea, so let's leave it like this. Merging them would mean we should also merge the two firmware pages and I think nobody wants that. --[[User:Http|http]] 18:07, 17 July 2011 (MDT)

== Split up the table? ==
Updating the tables on this page is rather unwieldy, so I'd like to split the tables up by firmware version. (i.e.- 1.x, 2.x, 3.x…) Is this fine with everyone? --[[User:Dialexio|Dialexio]] 15:07, 26 July 2011 (MDT)
:Agreed. This way we can remove the columns of the devices that did not exist at the time of the firmware release (like [[iPad 2]] columns in the 2.x table) and also those devices that are no longer supported on the given firmware versions (like ipt1g column in 4.x table). But maybe add a comment of what is missing to each table. --[[User:Http|http]] 03:33, 27 July 2011 (MDT)
:agreed as the table is getting waaaaaay to wide for small displays. So like for 1.x, we could have only 2 columns: ipt1g and iph2g --[[User:Balloonhead66|Balloonhead66]] 09:48, 30 July 2011 (MDT)
:Wow! That looks way nicer! Now we just need to do the betas --[[User:Balloonhead66|Balloonhead66]] 16:10, 1 August 2011 (MDT)

== [http://theiphonewiki.com/wiki/index.php?title=VFDecrypt_Keys&curid=87&diff=21727&oldid=21725 http's edit] ==
Where did 3140 come from? Was it a typo? --[[User:Balloonhead66|Balloonhead66]] 18:01, 13 October 2011 (MDT)
:That's what the ATV displays. I didn't look at the ipsw yet. -- [[User:Http|http]] 18:03, 13 October 2011 (MDT)
::Well, there may be two firmwares, the original 4.4 9A334v and not 3140... but that doesn't seem like apple to break a standard like build codes... --[[User:Balloonhead66|Balloonhead66]] 18:05, 13 October 2011 (MDT)
:::No, not two firmwares, just the display. -- [[User:Http|http]] 11:49, 18 October 2011 (MDT)
:The display shows this (in About menu):
Apple TV-Software 4.4 (3140)
Apple TV-Software 4.4.2 (3160)
:As this is obviously not a build number, any idea what this is? --[[User:Http|http]] 16:30, 24 October 2011 (MDT)
::I will assume that 4.4.1 would be (3150)... @[[User:http|http]], I would assume that the reason you couldn't update was that Apple had briefly pulled it... --[[User:Balloonhead66|Balloonhead66]] 17:12, 24 October 2011 (MDT)
:::Well, shortly after 4.4.2 came out, I clicked on update. After the update the version shown was still 4.0 (3140). But a few minutes later, a push update came through and asked me to update again. After that was through, the above mentioned 4.4.2 (3160) was shown. Quite strange. --[[User:Http|http]] 06:13, 25 October 2011 (MDT)
::::Fail in build? --[[User:Balloonhead66|Balloonhead66]] 14:04, 26 October 2011 (MDT)

== Major Resorting Request ==
I would like to change the sorting etc. on this page. Right now we have ATV versions that belong to 5.x under the 4.x section, because we put them under the displayed version section. So I would suggest to change these tables to sort by build number. Rows that have different build numbers should get split up to two rows. So far so good. But two questions remain: 1. Where do we see the iOS version number? Just in front of the build number? And what about the ATV iOS numbers on the screen, do we show those as well and where? 2. If we have the build number in the first column already, then what do we write as the link? Just an "X" or what? Anybody disagrees with the resorting in general? -- [[User:Http|http]] 11:49, 18 October 2011 (MDT)
:see discussion here: [[:The_iPhone_Wiki:Community_portal#Apple_TV_2G_versions_.28Part_34.29]] --[[User:Http|http]] 06:00, 25 October 2011 (MDT)
:: Frankly spoken this page looks messy and I suggest an overhaul. What are the tables here used for anyway? The VFDecrypt Keys for every [[firmware]] can be reached easily from the firmware page via the Link in the Build column. Maybe the colum should be renamed to Build/VFDecrypt Keys. Then the issue about the aTV firmeware numbers would also be taken care of as these columns are also already available (for 'real' and reported). This page here could then explain how the VFDecrypt keys can be generated.--[[User:M2m|M2m]] 06:30, 25 October 2011 (MDT)
:::An overhaul was done a while back by [[User:dialexio|dialexio]] to seperate it by major versions. But this page does seem like a duplicate of [[firmware]] and I kind of agree that we should just change this to list the ways to get the keys. But a lot of tech blogs on decrypting the firmwares link to this page... Maybe the above info stays the same, but the tables are replaced with:
<nowiki>== Firmware Versions ==</nowiki>
<nowiki>{{main|Firmware|Beta Firmware}}</nowiki>
:::Any other thoughts? --[[User:Balloonhead66|Balloonhead66]] 14:04, 26 October 2011 (MDT)
::::Well just like I said I would remove all tables here and just refer to the Firmware Page for the Keys themselves. In case really necessary add an extra column as shown below.
::::{| class="wikitable"
|-
! width="120" | VFDecrypt Key
|-
| {{yes}}
|}
::::Otherwise I also see lots of double maintenance.. --[[User:M2m|M2m]] 04:35, 29 October 2011 (MDT)
:::::I love your edit. But yes, I think we should resort to removing the tables from this page and adding the column "VFDecrypt Key" to [[Firmware]] and [[Beta Firmware]] as the Apple TV does get confusing. --[[User:Balloonhead66|Balloonhead66]] 18:53, 29 October 2011 (MDT)
:::This is awful, there used to be a nice table you could look at and know which keys are available by firmware based on if the page is created or not... or at least what the links are to each one. Now you have to scroll through a giant list sorted by PRODUCT instead of by firmware to figure out which keys are available. What was wrong with having a little redundancy for the sake of usability? --[[User:Sbingner|Sbingner]] 19:17, 11 November 2011 (MST)

== 2.0 beta 1 ==
After 1.2 beta 1, the version was renamed to 2.0. The question now is if the next beta was 2.0 beta 1 or beta 2. According to [http://www.wikipedia.org/w/index.php?title=IOS_version_history#Unreleased_versions wiki] it was beta 1, but I don't believe that, as there was no evidence in ''this'' wiki. Does anybody know more? --[[User:Http|http]] 10:44, 24 October 2011 (MDT)
:Discussing this on Twitter resulted in the fact that just the iOS version name changed after beta 1 (or was wrong on beta 1), but the beta numbers were continuously. So I removed the non-existent 2.0b1 from the list. -- [[User:Http|http]] 15:43, 24 October 2011 (MDT)
:I edited wikipedia to 2.0b2, I doubt anyone will challange that... If they do, I will referance them to this wiki --[[User:Balloonhead66|Balloonhead66]] 14:11, 24 October 2011 (MDT)

Telluride 9A334 (iPhone2,1)

2011-10-14T23:33:01Z

Sbingner: Created page with "==Decryption Keys== === Root Filesystem (018-7873-736.dmg) === * '''VFDecrypt Key''': 0827b7d632abf92f397471cd7f77c037817e56d0ab1bade692b29f311f0fbcdfd6fc3bef === [[Restore ..."

==Decryption Keys==
=== Root Filesystem (018-7873-736.dmg) ===
* '''[[VFDecrypt]] Key''': 0827b7d632abf92f397471cd7f77c037817e56d0ab1bade692b29f311f0fbcdfd6fc3bef

=== [[Restore Ramdisk]] (018-7919-343.dmg) ===
* '''IV''': 57da5d3b645d4accee13806b7f46a3b3
* '''Key''': 38231b8e8c4348a375288884ae230a52ceaf9b8fd05f57d6812d6b9d9c5357cb

=== AppleLogo (applelogo.s5l8920x.img3) ===
* '''IV''': 8f275b1aaaea81617c07a423f18d602f
* '''Key''': f7f2209e7d3e7161729921bfc5fb89e1da45cf2a7b2d5fddfe83ac1e6f3ec310

=== BatteryCharging0 (batterycharging0.s5l8920x.img3) ===
* '''IV''': dac936b85646134c2b4aa9b9a4c873d8
* '''Key''': f7dc00139d098fa02abcc4e7b199c5559b938a3b9fb77887a8dd53eccb48481f

=== BatteryCharging1 (batterycharging1.s5l8920x.img3) ===
* '''IV''': a8931c37c94ce38652edcf101794f098
* '''Key''': f88b16a0c0bf3650e532394eda6e3f3f1514572bfa1f73f69739c1c7807ecc33

=== BatteryFull (batteryfull.s5l8920x.img3) ===
* '''IV''': dbdff5e330c9bb0e1f4390cc3affc4b1
* '''Key''': 98aa9df3c1c92006fd1eedf19281465c2406508bfee32de02a2bf77ed343b511

=== BatteryLow0 (batterylow0.s5l8920x.img3) ===
* '''IV''': 3b9b8dcf7be6f07e8f6505e434505102
* '''Key''': d49bff924d62d208299a96e39045ad26e6b5c16d0384ed2be4a95edeb7d4ffc0

=== BatteryLow1 (batterylow1.s5l8920x.img3) ===
* '''IV''': eba5db76c201a573550ed5afd3f54be8
* '''Key''': 5970832eb63d0363fa80338c31c08b64f718fa47db6b088e3597669fecb5317f

=== DeviceTree (DeviceTree.n88ap.img3) ===
* '''IV''': dc29ca136a4f1a22dbe7ed3937a585d1
* '''Key''': 6bc9976c544ee8f87b139d918a5008735863710e9c71fff3bb24ce24c501ea2c

=== GlyphCharging (glyphcharging.s5l8920x.img3) ===
* '''IV''': 9249c1ea243c0585b7d8d3bd8e2bf985
* '''Key''': 1067332d2556acd47a37964f983c5a8e4ec9942dc85cf07b5c331e0f662191f4

=== GlyphPlugin (glyphplugin.s5l8920x.img3) ===
* '''IV''': 8a8b96f092013e01ea1c90038cd07cb4
* '''Key''': 8dde594a981401624e986d71908b72f362e1d62bf01aa327816c2ff9cc2fc252

=== [[iBEC]] (iBEC.n88ap.RELEASE.dfu) ===
* '''IV''': f47e04e542b16fa7bbed2e6a86e5afa1
* '''Key''': b1144d68c5c2097b5c1a164a044f1a0a03dd4067b9dd073659218fb981d63bd5

=== [[IBoot (Bootloader)|iBoot]] (iBoot.n88ap.RELEASE.img3) ===
* '''IV''': 251ff89ce1be3b20a5e9c3abd0b08d71
* '''Key''': b42f5c7359373d66c29823e0036ea87c7576a33755545b3a589f698eb9f3df41

=== [[iBSS]] (iBSS.n88ap.RELEASE.dfu) ===
* '''IV''': 463c1df37709847d44be3e945e6212a1
* '''Key''': 2b04e967fe3409f3529f2c9c2de8e00d208be0262c751a37ca85616968ca9997

=== kernelcache (kernelcache.release.n88) ===
* '''IV''': 8768faa05f7b43c358c436eae2b76449
* '''Key''': 95c1d11921228b0ff2969d54d566617ce00cb722758067c647327a222ed6c346

=== [[LLB]] (LLB.n88ap.RELEASE.img3) ===
* '''IV''': fb89fae993a4b4f3272eb0dde81be546
* '''Key''': d7a7597549797fda3a3f4fa5883524531dc95215d7d92dedc1bfcba31ca0980c

=== [[Recovery Mode]] (recoverymode.s5l8920x.img3) ===
* '''IV''': acfbd43bdda0a9fc57f4e7165b0e5cb0
* '''Key''': 312fbbc20e7bbb7a40671748a47c07c98ee50a984e10a0594225d879a236c236

Durango 8L1 (iPhone2,1)

2011-07-28T09:09:30Z

Sbingner: oops.

== Decryption Keys ==
=== Root Filesystem (038-2287-002.dmg) ===
* '''[[VFDecrypt]] Key''': 8b04eb7e4c4c3bea36693fee2369d48c667083ae79ddea8c02f5ce9da30a74cb20707328

=== AppleLogo (applelogo.s5l8920x.img3) ===
* '''IV''': cc46cbf7f5883358e28fd396b0b23289
* '''Key''': 8b08058009f817d1cbd2915cf0977c44364ab3ecb05f29f135f4196754b311c2

=== BatteryCharging0 (batterycharging0.s5l8920x.img3) ===
* '''IV''': a27f0a7d6c9fb551fd40f93072065b53
* '''Key''': 3b88607d553475f0e1db61352e5c666a8ebfab9609da9d83c0fbce05158fd198

=== BatteryCharging1 (batterycharging1.s5l8920x.img3) ===
* '''IV''': 9cbb472e8c96b5ca8896f788ee224654
* '''Key''': e8c613e32c6681105f9e78983a2f4a46f9839ede7c5883b9ee67b46dc8ee17d7

=== BatteryFull (batteryfull.s5l8920x.img3) ===
* '''IV''': 7579e55e604b8184a0c1d9021791d25c
* '''Key''': eecc76668a525281247ed999746153e0d419bf9b1d9603b3c456ab4ec760681b

=== BatteryLow0 (batterylow0.s5l8920x.img3) ===
* '''IV''': f11a12f9ecf2fa13865e3120f8a58800
* '''Key''': cd4754b526747ac4833706a6836766d0f0438e684ea26b8469d1aad60f402108

=== BatteryLow1 (batterylow1.s5l8920x.img3) ===
* '''IV''': 3b13cead54edf5ebd68c3be80f0fedce
* '''Key''': ee426909212f7aa57fea5d5942ddf51997e18308af1baffd6fd86b11e8f1225f

=== DeviceTree (DeviceTree.n88ap.img3) ===
* '''IV''': 4312d896a5dc92b382e7ec0e377eafb3
* '''Key''': deb9a15d51db86b7da30f4049185538550f6ed7f81b6bb5131d212e925d99385

=== GlyphCharging (glyphcharging.s5l8920x.img3) ===
* '''IV''': 1acc40230b2bd92116800c94cee69f7e
* '''Key''': 260b13035382d3b51549a3fc8ef66a767f2538e294834755e32d4d773b16b9a5

=== GlyphPlugin (glyphplugin.s5l8920x.img3) ===
* '''IV''': 114a5a0608c407959603deefc42e7190
* '''Key''': 4fc3296045fd803ca6bbd85149a9af88be60bea1c705b45de1ea8b5e7ffc6bf5

=== [[iBEC]] (iBEC.n88ap.RELEASE.dfu) ===
* '''IV''': 0cba084b36c2c8b5edd236d322e74a2b
* '''Key''': 9527786a251a4cfe31dab6a875047be6d4b29ed8c7f4b366e546c711878375f4

=== [[IBoot (Bootloader)|iBoot]] (iBoot.n88ap.RELEASE.img3) ===
* '''IV''': e65e4baead0c2a7aecbadf0cdf2279f0
* '''Key''': d0e1d5bca49bd49864a2fe40c9bf0d8b19b6a6038633d02f35a07adce84ad268

=== [[iBSS]] (iBSS.n88ap.RELEASE.dfu) ===
* '''IV''': 397d887af465a48c481d31af5f744c0c
* '''Key''': 668a8416cbc95531ce47c165b384315baee8c8e2b992345fb1ea448469dfc8e5

=== kernelcache (kernelcache.release.n88) ===
* '''IV''': db5746b1411c34d78f1276e5416769c3
* '''Key''': d95751186440a71ad6d98ddc9f2c1f2d25ade877c4ac37d84b518e6abd6e6805

=== [[LLB]] (LLB.n88ap.RELEASE.img3) ===
* '''IV''': 74677f567d2a2224840e55bbd30da3fe
* '''Key''': 0d8ea4f0b10111472570cd0fb058a71ad131f4cf5b44d8f8a75eaed1f30fc5c2

=== [[Recovery Mode]] (recoverymode.s5l8920x.img3) ===
* '''IV''': 850f45023dfdc3da317c5664039a3b5b
* '''Key''': a409f60a829e679930528bf494113dc13b3a80a778ea7ec775705ebd578710f9

Durango 8L1 (iPhone2,1)

2011-07-28T09:06:43Z

Sbingner: Created page with "== Decryption Keys == === Root Filesystem (038-2191-001.dmg) === * '''VFDecrypt Key''': fb9480e2b80a26cd75d923d7918539edb19caed5a72dfe7a78734cd2a82597869b9ceaf5 === [[iBEC]..."

== Decryption Keys ==
=== Root Filesystem (038-2191-001.dmg) ===
* '''[[VFDecrypt]] Key''': fb9480e2b80a26cd75d923d7918539edb19caed5a72dfe7a78734cd2a82597869b9ceaf5

=== [[iBEC]] (iBEC.n88ap.RELEASE.dfu) ===
* '''IV''': 0cba084b36c2c8b5edd236d322e74a2b
* '''Key''': 9527786a251a4cfe31dab6a875047be6d4b29ed8c7f4b366e546c711878375f4

=== [[IBoot (Bootloader)|iBoot]] (iBoot.n88ap.RELEASE.img3) ===
* '''IV''': e65e4baead0c2a7aecbadf0cdf2279f0
* '''Key''': d0e1d5bca49bd49864a2fe40c9bf0d8b19b6a6038633d02f35a07adce84ad268

=== [[iBSS]] (iBSS.n88ap.RELEASE.dfu) ===
* '''IV''': 397d887af465a48c481d31af5f744c0c
* '''Key''': 668a8416cbc95531ce47c165b384315baee8c8e2b992345fb1ea448469dfc8e5

=== kernelcache (kernelcache.release.n88) ===
* '''IV''': 8dd25ddbf1c21c33d8e179bfe03b6795
* '''Key''': 325e2bf87114f28cc2c9d6f14edddcd1361084200e613c51138137deb3d99954

=== [[LLB]] (LLB.n88ap.RELEASE.img3) ===
* '''IV''': 74677f567d2a2224840e55bbd30da3fe
* '''Key''': 0d8ea4f0b10111472570cd0fb058a71ad131f4cf5b44d8f8a75eaed1f30fc5c2

TellurideVail 9A5220p (iPhone2,1)

2011-06-08T09:48:07Z

Sbingner: New page: == Decryption Keys == === Root Filesystem (038-1664-026.dmg) === * '''VFDecrypt Key''': b0f31d60ec84f1e3430c7f7753055bdd70d394b4fe5bb378af23d5a833584570538bb33b === [[Restore Ramdisk...

== Decryption Keys ==
=== Root Filesystem (038-1664-026.dmg) ===
* '''[[VFDecrypt]] Key''': b0f31d60ec84f1e3430c7f7753055bdd70d394b4fe5bb378af23d5a833584570538bb33b

=== [[Restore Ramdisk]] (038-1676-015.dmg) ===
* '''IV''': 27350333d853774dc663b7a0cedc3207
* '''Key''': c9e190e3eb2426939eb39c1e3b99178033bb366d94bee097995090526d77a083

=== AppleLogo (applelogo.s5l8920x.img3) ===
* '''IV''': 0e5715599f1be765024ad6178654ee14
* '''Key''': fcb5092512e9ed72ffb95ec0e0b6c42af534e1415508df90e57dd9c7ce93c90a

=== BatteryCharging0 (batterycharging0.s5l8920x.img3) ===
* '''IV''': f88150d5dbbc484d19856acafd00670a
* '''Key''': 5ab14e771fae1d613196fa2702bc329a727fc6005be9fcabbc1d5a999db34588

=== BatteryCharging1 (batterycharging1.s5l8920x.img3) ===
* '''IV''': 2b9dd8c18dd254c75551840a93521af4
* '''Key''': 1d1d8fd34ff32a4ed9d0c5fe9960225c399c5f27e9a6e9d375ac0a5ae9b4c56b

=== BatteryFull (batteryfull.s5l8920x.img3) ===
* '''IV''': 88d4b26b4d8d25c36958eff3c6cd8eb7
* '''Key''': 4feadd152ae7f8250badf5cda814d4ee704dcecf0564f10c37553db5d30f1480

=== BatteryLow0 (batterylow0.s5l8920x.img3) ===
* '''IV''': 1a08dc77e02e433660398ecb38cef486
* '''Key''': 76e6e4d25acb51ae4f265604dc7fcad578a289aeee1d373dba0c365fe999057c

=== BatteryLow1 (batterylow1.s5l8920x.img3) ===
* '''IV''': 633978021a2956d48bcfc2d9e2e2b28b
* '''Key''': 217194700be5e6bfe765b058b49169770d2f3cd538e6812ff0416b4a95ac6336

=== DeviceTree (DeviceTree.n88ap.img3) ===
* '''IV''': b9771583c65fabdcd214966687861db4
* '''Key''': 2f4058c7712b625add7aa5c6e6c4103ccfd9b307249a292432ee58d3724424e0

=== GlyphCharging (glyphcharging.s5l8920x.img3) ===
* '''IV''': 3fc9ddb2885ae19c7a95b3c023655734
* '''Key''': 629fdfbf35d04a0bddaeaf5fcfe05bc1aa3bd096957aeb5c9f4365088423d783

=== GlyphPlugin (glyphplugin.s5l8920x.img3) ===
* '''IV''': c56645ddb7ba7fb17d2ef79bf409b483
* '''Key''': e2e708c902212710bbda18da80f6da557dd40ce75466731bce55b3a49ac6865e

=== [[iBEC]] (iBEC.n88ap.RELEASE.dfu) ===
* '''IV''': 25c467dd11ea3ea1598c8cc83de01cca
* '''Key''': 088261d2fe3f2a270274089e5458242cccccb65705806ec00e26b13a1ce7d543

=== [[IBoot (Bootloader)|iBoot]] (iBoot.n88ap.RELEASE.img3) ===
* '''IV''': 043dbad3e29eaa0ae5bdad880e07f34a
* '''Key''': e0e70f8f5a27c0777dd28f9a74a33e002324e2dc568282ba5bd64bbadc2c5be3

=== [[iBSS]] (iBSS.n88ap.RELEASE.dfu) ===
* '''IV''': eafccee26188b0f7f8badfc178dcd17f
* '''Key''': 184893256b095b485cc3daff6ab905822c7fe20439368afbb0626e8a90113db6

=== kernelcache (kernelcache.release.n88) ===
* '''IV''': 673f098c31659c4b5ed4c0774d60ab59
* '''Key''': f97c0cbc642d783972eaf9f4a996423563c53cb8c92f110ec0e09c74a1ebda5b

=== [[LLB]] (LLB.n88ap.RELEASE.img3) ===
* '''IV''': cfee75784c812a79724566e85e9be5b2
* '''Key''': daee0e331eda6567638abddab165fffaa920162f92a94d16618aa66fa9030552

=== [[Recovery Mode]] (recoverymode.s5l8920x.img3) ===
* '''IV''': 175256aa19b8cb90adde651aadae2d45
* '''Key''': 292ae21c46ae0d9937706655809d11e5d4855a0a2a16f2d1f1acf11ba8a60bd1

TellurideVail 9A5220p (iPhone3,1)

2011-06-08T03:08:56Z

Sbingner:

== Decryption Keys ==
=== Root Filesystem (038-1668-029.dmg) ===
*'''[[VFDecrypt]] Key''': ddd6f84e0450d2ea0cfb16d652a6dcc50d9a4e5be2225f9f4e1e22a7dd6cf686a34fb257

=== Restore Ramdisk (038-1678-023.dmg) ===
* '''IV''': 7d5195f9216c7327b15cea6c0abb5637
* '''Key''': d6a218cc74805143d960fdbde7a16bbea497d4aad753af85b7cd7c887c987692

=== [[AppleLogo]] ===
* '''IV''': 68c29af8152a1b6b2ad3fabd6bf1a489
* '''Key''': d0711e3242511cc92010f504cebca395fab360d5e9e36f6ad5803352c9255aef

=== BatteryCharging0 ===
* '''IV''': e832dd048edbe0e753cc3a2223a13684
* '''Key''': 9c02b43b998f82aa4c606f65352eccd99744f1e9f45ebeafaee3fdbfd4483484

=== BatteryCharging1 ===
* '''IV''': c629b17fab2cdf03adfc5d6f6083929c
* '''Key''': a841a550eada143fe38556c4e3a25f0bd2cba82f0eae0b8d3b0dbf7c45743681

=== BatteryFull ===
* '''IV''': fa8b41489e50208051ce74113ab13f3a
* '''Key''': 88d80aff291a65a89521408547486e901d316dd21cdb51c86f232ebe15e833b3

=== BatteryLow0 ===
* '''IV''': 91288928f7bcf1b8b07955ea54d232b1
* '''Key''': 71a7422322ffb9a0b1663544a5ad01a9474ff5d7eb3a6cd5cb838f49487950e4

=== BatteryLow1 ===
* '''IV''': f965ef044e6c52dd65786e25e5b900ce
* '''Key''': 1942127e1fadfc5f9e1c41e39ea24b2a9ab62dccd3664f7fe9c4476562d5fb88

=== DeviceTree ===
* '''IV''': ab7004e84c1d5f0aa26a9adca977c00f
* '''Key''': b0fda07cf058c0918a5635ad300a2bd261da410bbea09939422f73949df40fe8

=== [[GlyphCharging]] ===
* '''IV''': b170ac8843ab79c1c6356ced51c37209
* '''Key''': 307da87c353784c93aaded962a237fd1ea16ff9e892f1c143d35fd0e54a36bb6

=== [[GlyphPlugin]] ===
* '''IV''': 45dd141b93fcb80398da5926d730568b
* '''Key''': 76f4c776f054ec59a75cb4a82d0ebabba7a5e38b5b177525f81413b6c34e4d73

=== [[iBEC]] ===
* '''IV''': f11a57c495a339d4049fd2a1e14c0392
* '''Key''': b16db2e0da7192dcfd63a9c9c5fcde6e89b991b6634fb015970f722fe997799a

=== [[iBoot (Bootloader)|iBoot]] ===
* '''IV''': ac14fbd78080b731c5325e1a84ccae13
* '''Key''': b31e223546b0994d8c6747d0658381f5fb3fe75975522a079d9b161cbe607815

=== [[iBSS]] ===
* '''IV''': 21f4cd2eea91ecf074996c26f925ff10
* '''Key''': 6b06b0d3952b864e6faf78a8b95bafa3d36e0d12e35688cd0a2c9b1b56c3e808

=== [[Kernelcache]] ===
* '''IV''': ff061e077b8289590cf7c2703c6c61aa
* '''Key''': df5df93c2cb3f7c6ab35c82d942bd8b54f4186cbfe73ada01ab6107b2918f99b

=== [[LLB]] ===
* '''IV''': 61232f50b1f6ac02e1bdb7169c2cdef7
* '''Key''': 0c3b1a48055eb434a279e09afcdc824d6d4272bc22e0c257412e5a5ae828080d

=== [[RecoveryMode]] ===
* '''IV''': a5ffcd9f9211189e02838c0d25210c3d
* '''Key''':5dc4204a414ff0105b7325bfb15f55a2f71bd52c484ece40e1396f88d5abf222

Talk:DurangoVail 8F5166b (iPhone2,1)

2011-02-03T06:55:09Z

Sbingner: New page: BatteryFull (batteryfull.s5l8920x.img3) keys still don't work right in my imagetool for some reason. I went ahead posted them anyway since last time somebody else added anyway. --~~~~

BatteryFull (batteryfull.s5l8920x.img3) keys still don't work right in my imagetool for some reason. I went ahead posted them anyway since last time somebody else added anyway. --[[User:Sbingner|Sbingner]] 06:55, 3 February 2011 (UTC)

DurangoVail 8F5166b (iPhone2,1)

2011-02-03T06:51:25Z

Sbingner: New page: == Decryption Keys == === Root Filesystem (038-0642-002.dmg) === *'''VFDecrypt Key''': 35180cdade1149fcbc061d6cafea436155b5d75540960d68ebbed56e8d0da862b8a2707d === Update Ramdisk ...

== Decryption Keys ==
=== Root Filesystem (038-0642-002.dmg) ===
*'''[[VFDecrypt]] Key''': 35180cdade1149fcbc061d6cafea436155b5d75540960d68ebbed56e8d0da862b8a2707d

=== [[Update Ramdisk]] (038-0625-002.dmg) ===
* '''IV''': 52a9fe6b0e86f426546d85fc307bd093
* '''Key''': 6b7e6d29b051dd67da113d7aa2ee8b47aa24d2845455d30af433f08779bdd797

=== [[Restore Ramdisk]] (038-0630-002.dmg) ===
* '''IV''': 93d7e04c1ce4c8d61d558545990353d9
* '''Key''': 32dc6aa1fde0f90ae9e5d55c0f521146c85526d654c8530e42e76d7a115f3f34

=== AppleLogo (applelogo.s5l8920x.img3) ===
* '''IV''': 4df927154160ead1b83e19b742fe4812
* '''Key''': d4bb0fb6861d97ebad763f8934a9a7d7099f70e09b08f75949f694e326e2a736

=== BatteryCharging0 (batterycharging0.s5l8920x.img3) ===
* '''IV''': 0d35cca684a071c65e8b5149b4983f9b
* '''Key''': 37defe98fa54430fe4a3d4660a85cd514e11a88d6828f80b04ea7505e3ffaa67

=== BatteryCharging1 (batterycharging1.s5l8920x.img3) ===
* '''IV''': 0bd33dd3d7c82e08f591a27dd368051a
* '''Key''': d423e053a69e490639e52958533600216de393cd7d7d19b36dfeaa5445e685d9

=== BatteryFull (batteryfull.s5l8920x.img3) ===
* '''IV''': 27155a126f4536fc21830b5e0145d2b8
* '''Key''': a9d1b6321d91b36f67414235c4eae0f159265563bf92d67f1e8fce77bd139522

=== BatteryLow0 (batterylow0.s5l8920x.img3) ===
* '''IV''': a0cc59a102dbcd05a66709ddcdcb9eab
* '''Key''': 307c11a300f8036f62d4834beef9e720aabac911f61f9d9edb27a87cc35d53a5

=== BatteryLow1 (batterylow1.s5l8920x.img3) ===
* '''IV''': f4aef91d1569b683c689511f5821a5b5
* '''Key''': 3354fe4f5dbf9892ae1eae3f75869284f37f0e4f392de72fee4d86a12c894072

=== DeviceTree (DeviceTree.n88ap.img3) ===
* '''IV''': 40c4e2107e80f6455dcc8caf7122b0ba
* '''Key''': 696083e44eaca87cf8e51812999243ebb1560e6b7e0fd6cc8e5d8f37b9966ca2

=== GlyphCharging (glyphcharging.s5l8920x.img3) ===
* '''IV''': 3b53d2c61c40db40f49eda8c9503d640
* '''Key''': 1403771fcda6e0304b308e3904e78bd05c3bbb1afbd67ebf709a401822768d74

=== GlyphPlugin (glyphplugin.s5l8920x.img3) ===
* '''IV''': f57ba29f18d689a0fffe408f8886c6da
* '''Key''': f84adad22214d7e8b3a67554e3283ab731cd99ba2d0e6d178cc1f080b396d14d

=== [[iBEC]] (iBEC.n88ap.RELEASE.dfu) ===
* '''IV''': cb6687f03ca2f8e39c6476168a0f295f
* '''Key''': 9ded2fbfb2c95927487fa99db3f25fb8dff00a6f2e4d63a65056c3d970b48ac8

=== [[IBoot (Bootloader)|iBoot]] (iBoot.n88ap.RELEASE.img3) ===
* '''IV''': 861b839b03a6739c1ba1bac86bdc5a19
* '''Key''': a4bed3211204d558fde4d34ce33a5de09616bf313116d5b953bd47bdc5c74332

=== [[iBSS]] (iBSS.n88ap.RELEASE.dfu) ===
* '''IV''': bc212e244151a86e61f5019c16036981
* '''Key''': 1480f3617f7096b40444cd76278de98514b8298797401a4fb84a3908f5f5b9e4

=== kernelcache (kernelcache.release.n88) ===
* '''IV''': c5809f229cde524a892ae400fb3793df
* '''Key''': 0c0d5153ed6d16456a6cfe2198d4e11fb1486d82ce2779743041c58b19cdf05a

=== [[LLB]] (LLB.n88ap.RELEASE.img3) ===
* '''IV''': 4924518c70931c9df7fa4d8aecf47f10
* '''Key''': 05ae7c1a8401b82d047aafc8f77ae9bc9259dffa43a99f8c1499499a11578390

=== [[Recovery Mode]] (recoverymode.s5l8920x.img3) ===
* '''IV''': daedab57c01366e7f2f11ddf76dbae7c
* '''Key''': ebc57ab85ffb2921ac9b95311c4d530776b43f23dcd2743c0e256945ce8ced69

Talk:DurangoVail 8F5148b (iPhone3,1)

2011-01-14T06:45:15Z

Sbingner: /* Template question */

== Template question ==
Template... why would we want to REMOVE useful information such as the filename that told you I put in the wrong kernelcache keys, and the KBAG data? why not just fix the template? --[[User:Sbingner|Sbingner]] 01:53, 14 January 2011 (UTC)
:The proper kernelcache can be determined by looking at the name of [[iBEC]]/[[iBoot]]/[[iBSS]] from the [[IPSW]] (e.g.- '''[[iBoot]].n81ap.RELEASE.img3'''). A while back, it was decided a while back that the inclusion of KBAGs wasn't necessary. (It can be grabbed by anyone easily with <code>xpwntool /path/to/file.img3 /dev/null</code>.) --[[User:Dialexio|Dialexio]] 02:32, 14 January 2011 (UTC)
::The point was not related to how to find the right one, the point was that it seems useful to include an actual filename especially for use in automated parsing etc... and it showed right off that I did make a mistake on including the wrong one. --[[User:Sbingner|Sbingner]] 06:45, 14 January 2011 (UTC)

DurangoVail 8F5148b (iPad1,1)

2011-01-14T02:00:50Z

Sbingner: proper kernelcache

== Decryption Keys ==
=== Root Filesystem (038-0435-002.dmg) ===
* '''[[VFDecrypt]] Key''': 7620a160832d8ed43aee376179d28eccf51d50ac38caccd5990db6f10849aa39e3fdc942

=== [[Update Ramdisk]] (038-0402-002.dmg) ===
* '''IV''': 394fe1c81e0019a333801eeb425de5cf
* '''Key''': 2470bd829d27c6ad0f7c69d6f50dc5d59d913bc6c9cf7d8bac1c89f0854786bc

=== [[Restore Ramdisk]] (038-0408-002.dmg) ===
* '''IV''': fe41a6392984738f32aca55a0352995d
* '''Key''': 2a8e07268f713840e0e0b32413ee10dde933d630948b5107d7dcb66cff612d04

=== AppleLogo ===
* '''IV''': 4f8022112673d4875c32b050198cb945
* '''Key''': 0159008eeeeca0cee87cb80def3df9d1a87c0e67536e86c49c7a8e5307b0c3e5

=== BatteryCharging0 ===
* '''IV''': 262b8ffc3c7ea14d0839df1dfc3b05e3
* '''Key''': de28e91de5700c04a0285d5e600071781f669e6b2f8b80474f452c05372a5f1d

=== BatteryCharging1 ===
* '''IV''': be07c62978ea1679051dbda9684b6dc0
* '''Key''': 30a0651f475ee5ecfb462d2d14b3551bb95011a2f311ed69a1f2dc29a6c00225

=== BatteryLow0 ===
* '''IV''': e8707fc37f506cdb5f39af46f53e1602
* '''Key''': d23285f6bb26b417fac2fb313cabf836ce4000b4827251e689eabc9100248f3a

=== BatteryLow1 ===
* '''IV''': d7e0a5f2d09c9faca57f1857171941a5
* '''Key''': cb6ddd774d8de039ed97a215411fa537d285dd49b4728fbf70b6b80d767b5f48

=== DeviceTree ===
* '''IV''': 61e23d3f401db153db316c2dc74b3023
* '''Key''': c3c8b404f87a6d702976d52cd622aa6bd5bc59d65119df5e716c1d9f1182e585

=== GlyphCharging ===
* '''IV''': 7ee1f50315f96f81e1bb9d79a026da6e
* '''Key''': a63f8ee4e0f1866366a0eec428eef40591b2598ca5e604bd92809106a05d2124

=== GlyphPlugin ===
* '''IV''': 496e1704c998eec03e0ff51425e83662
* '''Key''': 39aad1cfc86c43dbb4e1099bbb8a0325b072481de5a311f8ff135b0df92e3084

=== [[iBEC]] ===
* '''IV''': d8144d23e61b72c791ea665daeacb2e8
* '''Key''': 2a8be2832f95b7173423cbd67686ec4e0bdeb0ee1db669b6a82b05a43d76f0ff

=== [[IBoot (Bootloader)|iBoot]] ===
* '''IV''': 6569032be7b6bc71e264696a6d862108
* '''Key''': 5e3b655dda6e92e1500fb1761d19bc4409cba5e2a1166a70266dfba4c6a13460

=== [[iBSS]] ===
* '''IV''': c37807797069a32b0a67cb43f8c52def
* '''Key''': d4cffe812550982ae1a37b042857b50a1e00a661958e2c71616a1255115eb9c2

=== [[Kernelcache]] ===
* '''IV''': a12564113761a179a08eaa4906a6df61
* '''Key''': bb370862e0879d4c8ea324c83a0bdb6abc447dde43c07f1783b07b0d27086def

=== [[LLB]] ===
* '''IV''': bd7ac9ff1fd0777fb4baeb6464c2cec2
* '''Key''': 839b7848eb96eb91c1ac8d0f3e45b72d5c711ff529fa107e29ff99d57fa7312f

=== [[Recovery Mode]] ===
* '''IV''': d7759a381a06975ff4087b97a73dc38a
* '''Key''': 849aabd88a2dc909a4c3118a94c5e257db1439f045ba06b7e4a6911dbd6a562b

Talk:DurangoVail 8F5148b (iPhone3,1)

2011-01-14T01:53:16Z

Sbingner: New page: RE: Template... why would we want to REMOVE useful information such as the filename that told you I put in the wrong kernelcache keys, and the KBAG data? why not just fix the template? --...

RE: Template... why would we want to REMOVE useful information such as the filename that told you I put in the wrong kernelcache keys, and the KBAG data? why not just fix the template? --[[User:Sbingner|Sbingner]] 01:53, 14 January 2011 (UTC)

DurangoVail 8F5148b (iPhone3,1)

2011-01-14T01:52:01Z

Sbingner: You want the right kernelcache? picky picky

== Decryption Keys ==
=== Root Filesystem (038-0437-003.dmg) ===
*'''[[VFDecrypt]] Key''': d457db4790e7126428ed4fb053f84f25e89f8135129d0ff81b0d6b580cde1bc5d794e5af

=== [[Update Ramdisk]] (038-0402-002.dmg) ===
* '''IV''': 394fe1c81e0019a333801eeb425de5cf
* '''Key''': 2470bd829d27c6ad0f7c69d6f50dc5d59d913bc6c9cf7d8bac1c89f0854786bc

=== [[Restore Ramdisk]] (038-0408-002.dmg) ===
* '''IV''': fe41a6392984738f32aca55a0352995d
* '''Key''': 2a8e07268f713840e0e0b32413ee10dde933d630948b5107d7dcb66cff612d04

=== AppleLogo ===
* '''IV''': 4ffe0f61382b72de5d59caf386a100d9
* '''Key''': 33ea000f7238f46f6098e72936da2120b802fe52a444cdc380a26940e76be906

=== BatteryCharging0 ===
* '''IV''': 2144d0edb65e04591b88bc45a606018f
* '''Key''': b1f581f25540fae52221891d28ce39c6cb39b050dda34bbcc5cc7fd02afcfb23

=== BatteryCharging1 ===
* '''IV''': 6caf61b577abba2e5c120c476f160d67
* '''Key''': cb888fd39eeed5bc4bdd3a8314912cf7a08b4dbdd66165380804bad38bfa6e93

=== BatteryFull ===
* '''IV''': c21f5f6879ca47c578c32baf25018072
* '''Key''': 2604bfcbf99ba65b6f54e86b155c3060138b51e0fccd17907690d5506f81ad8d

=== BatteryLow0 ===
* '''IV''': 81d668a4601d4ac2368b580d8c542a93
* '''Key''': 779677998eb3f0985d88519d5c402e0c81d41ab17976124da1cc6509961b1859

=== BatteryLow1 ===
* '''IV''': bd831d7f660694de8a8baec15695207a
* '''Key''': dfae5279a7b5ad1be377874088b75c2c913696c8ba4c4ddb11b40cef20f6d6fe

=== DeviceTree ===
* '''IV''': fb806971be00151d6cd294b4b88d22c4
* '''Key''': 32f0414688bc943a3a49b4ef3c8c19cff115ae77cc3aba2d3340cd0a177cb6cf

=== GlyphCharging ===
* '''IV''': 5d1d628dddc3415680b828f29d9ff6a9
* '''Key''': 1b140e0262cd4f3e5517c5fce5291e7d497095edbf7acd81f3066db75b13bc97

=== GlyphPlugin ===
* '''IV''': f717cff855e057020e080837283be0bf
* '''Key''': 066cb756433644479a381a3f90f25776d3acfe912a21214ca641f12fd324e4b9

=== [[iBEC]] ===
* '''IV''': 2c69d74317e2ade05e368dd70ca23f5d
* '''Key''': 16c478490b555fa67db4441d03b3616a6d71a6d055785d09abfae6c9e3e9339d

=== [[iBoot (Bootloader)|iBoot]] ===
* '''IV''': 88abaa8e21ede6a97fd547ea5edc02e7
* '''Key''': 4d87a79f4520074b27b344eea11da2a0d62bcbffa45fa35b4884bf68a4993e37

=== [[iBSS]] ===
* '''IV''': 09a87275ed5f49757d6fd9cfdeb16a9e
* '''Key''': 9119845f4534b1f351ed1bcc05e5bc5e93b459ca2cd9be7cf3c34d4d076872c0

=== [[Kernelcache]] ===
* '''IV''': 45d0d42a633acc373f23b096b36c6cd6
* '''Key''': f136ce574cd97de56eff685a9e9db56fc8c829518e72fb5de5e4515d52daf7af

=== [[LLB]] ===
* '''IV''': 4b7a331704632d6e601df130e09c0e7b
* '''Key''': 456861c0c597dfd57fd8c3cb17cf104f4e2f48a3fd6b7729416a6a10b351b467

=== RecoveryMode ===
* '''IV''': 23ba400f925e9cbab395edf40b605fae
* '''Key''': 7ad21b53138c53cec727c43aed0837d76953b9b496f7913cd3c9724198a8b9ea

DurangoVail 8F5148b (iPad1,1)

2011-01-13T04:03:30Z

Sbingner: iPad keys

=== Root Filesystem (038-0435-002.dmg) ===
* '''[[VFDecrypt]] Key''': 7620a160832d8ed43aee376179d28eccf51d50ac38caccd5990db6f10849aa39e3fdc942

=== [[Update Ramdisk]] (038-0402-002.dmg) ===
* '''IV''': 394fe1c81e0019a333801eeb425de5cf
* '''Key''': 2470bd829d27c6ad0f7c69d6f50dc5d59d913bc6c9cf7d8bac1c89f0854786bc
* '''[[KBAG]]''': 1BD9A4D4CF71C7A5A270CABA4C99258B925C230675A7D02274B6BEB3BE3119A8A2F981969ECAC2121D846C48DD0D68BA

=== [[Restore Ramdisk]] (038-0408-002.dmg) ===
* '''IV''': fe41a6392984738f32aca55a0352995d
* '''Key''': 2a8e07268f713840e0e0b32413ee10dde933d630948b5107d7dcb66cff612d04
* '''[[KBAG]]''': 7CE19E8083660112005D478A9D1C3F26E12CDCEB67AF4F0F5B4B341A8D6B9D9EC7D1E33296C2BDEE6B1BE21037307F2A

=== AppleLogo (applelogo.s5l8930x.img3) ===
* '''IV''': 4f8022112673d4875c32b050198cb945
* '''Key''': 0159008eeeeca0cee87cb80def3df9d1a87c0e67536e86c49c7a8e5307b0c3e5
* '''[[KBAG]]''': 08C2BCC21A137983F8F3C629794CFC35D989C8B0BC54926B34695B8E818B9C5441B45A9C295317A140E6B09E36808464

=== BatteryCharging0 (batterycharging0.s5l8930x.img3) ===
* '''IV''': 262b8ffc3c7ea14d0839df1dfc3b05e3
* '''Key''': de28e91de5700c04a0285d5e600071781f669e6b2f8b80474f452c05372a5f1d
* '''[[KBAG]]''': C67D5AE9AFE3BE2F34C63324AF1D84E08EC1154EE2CB4659731D4D32F56F6424FCE0EE5CFD866DBA9CEDB9B060AA7EDE

=== BatteryCharging1 (batterycharging1.s5l8930x.img3) ===
* '''IV''': be07c62978ea1679051dbda9684b6dc0
* '''Key''': 30a0651f475ee5ecfb462d2d14b3551bb95011a2f311ed69a1f2dc29a6c00225
* '''[[KBAG]]''': 3B2AA85F9C67744621FB71A996A65C972C390B179377D7232D68FF956377688D7FC48E46D874F3F2A7E7CC6D2E987642

=== BatteryLow0 (batterylow0.s5l8930x.img3) ===
* '''IV''': e8707fc37f506cdb5f39af46f53e1602
* '''Key''': d23285f6bb26b417fac2fb313cabf836ce4000b4827251e689eabc9100248f3a
* '''[[KBAG]]''': EC4613A2A07209E2CE74EBCDF51BC0845F141F002666631C1A97892CBD0D1F5B43DB208E76B4467E0F5F59E179FBC545

=== BatteryLow1 (batterylow1.s5l8930x.img3) ===
* '''IV''': d7e0a5f2d09c9faca57f1857171941a5
* '''Key''': cb6ddd774d8de039ed97a215411fa537d285dd49b4728fbf70b6b80d767b5f48
* '''[[KBAG]]''': C90206143F71392D1B080C361110BEF019BAF06847C0CAAF3C47D0E1F02ABEAAD516D3E131474A901EE5246435140391

=== DeviceTree (DeviceTree.k48ap.img3) ===
* '''IV''': 61e23d3f401db153db316c2dc74b3023
* '''Key''': c3c8b404f87a6d702976d52cd622aa6bd5bc59d65119df5e716c1d9f1182e585
* '''[[KBAG]]''': 708A20705C2CFEE2BCD5F4B90BF07D9A6A1FC19416AA36D9C1D811FC1AF16FAE2995EDC14101CF3A22236FEA0F09C189

=== GlyphCharging (glyphcharging.s5l8930x.img3) ===
* '''IV''': 7ee1f50315f96f81e1bb9d79a026da6e
* '''Key''': a63f8ee4e0f1866366a0eec428eef40591b2598ca5e604bd92809106a05d2124
* '''[[KBAG]]''': 1CC02922FD1AA1FCD1A4BCD0272B500C574703CFF5EF8A4E1F3462703A74CA6F1E379F9D612E1A21193B70D717F75C74

=== GlyphPlugin (glyphplugin.s5l8930x.img3) ===
* '''IV''': 496e1704c998eec03e0ff51425e83662
* '''Key''': 39aad1cfc86c43dbb4e1099bbb8a0325b072481de5a311f8ff135b0df92e3084
* '''[[KBAG]]''': 0AC4A32904CCCC43C64454F44D264A904A2AAAE0F83353BDA06A9E6B5F4ADA6C9647CA15DA15ED0ACB6895136DA302BC

=== [[iBEC]] (iBEC.k48ap.RELEASE.dfu) ===
* '''IV''': d8144d23e61b72c791ea665daeacb2e8
* '''Key''': 2a8be2832f95b7173423cbd67686ec4e0bdeb0ee1db669b6a82b05a43d76f0ff
* '''[[KBAG]]''': F28ACD74EAE9DD015988A787091072A442310CFE69A9A2AAC263A56841FB5BD9D1A395AE3663AFD1F517873156DFAF4C

=== [[IBoot (Bootloader)|iBoot]] (iBoot.k48ap.RELEASE.img3) ===
* '''IV''': 6569032be7b6bc71e264696a6d862108
* '''Key''': 5e3b655dda6e92e1500fb1761d19bc4409cba5e2a1166a70266dfba4c6a13460
* '''[[KBAG]]''': 98ED320BCDFA183BD4B1452916372CA4B797ABF813C99DA93A4DA482B1E48252D577235101F6F149FC812EB6AA1D687A

=== [[iBSS]] (iBSS.k48ap.RELEASE.dfu) ===
* '''IV''': c37807797069a32b0a67cb43f8c52def
* '''Key''': d4cffe812550982ae1a37b042857b50a1e00a661958e2c71616a1255115eb9c2
* '''[[KBAG]]''': 8E54ED6944D15E83DE7D6EBDE6FD4E77C4762EAE0303DE4CFB86CBE665D27DF9290216B29723219471ADD3D31083ABB3

=== [[Kernelcache]] (kernelcache.release.n81) ===
* '''IV''': e93941d3a03ef41bd2979aab1ed85ddf
* '''Key''': b7621fb4c6c766722c3018c3b7b7d387827e2369fa43811bcb9e22e9599aa8f4
* '''[[KBAG]]''': 32A318CB3A9AE0AB52FFA9B46824D219A34B65E422F0553EC711272A87032AC435BD5288E6BED07B327508EA4EF3E094

=== [[LLB]] (LLB.k48ap.RELEASE.img3) ===
* '''IV''': bd7ac9ff1fd0777fb4baeb6464c2cec2
* '''Key''': 839b7848eb96eb91c1ac8d0f3e45b72d5c711ff529fa107e29ff99d57fa7312f
* '''[[KBAG]]''': 8F40ED4D9610C05653CC48C9D5A08CD1C05D758E4CB3A43FD24D8A8FA0CBE797E5D9BC27F972634F193721BF18C36038

=== [[Recovery_Mode]] (recoverymode-768x1024.s5l8930x.img3) ===
* '''IV''': d7759a381a06975ff4087b97a73dc38a
* '''Key''': 849aabd88a2dc909a4c3118a94c5e257db1439f045ba06b7e4a6911dbd6a562b
* '''[[KBAG]]''': 11DDE9DCB929845605B1B0A50AC6BE24FB1501772E2F03904F6AF29F3320FDDB64965A11717017CC773ACFB114128C44

DurangoVail 8F5148b (iPhone3,1)

2011-01-13T04:02:51Z

Sbingner: i4 Keys

=== Root Filesystem (038-0437-003.dmg) ===
* '''[[VFDecrypt]] Key''': d457db4790e7126428ed4fb053f84f25e89f8135129d0ff81b0d6b580cde1bc5d794e5af

=== [[Update Ramdisk]] (038-0402-002.dmg) ===
* '''IV''': 394fe1c81e0019a333801eeb425de5cf
* '''Key''': 2470bd829d27c6ad0f7c69d6f50dc5d59d913bc6c9cf7d8bac1c89f0854786bc
* '''[[KBAG]]''': 1BD9A4D4CF71C7A5A270CABA4C99258B925C230675A7D02274B6BEB3BE3119A8A2F981969ECAC2121D846C48DD0D68BA

=== [[Restore Ramdisk]] (038-0408-002.dmg) ===
* '''IV''': fe41a6392984738f32aca55a0352995d
* '''Key''': 2a8e07268f713840e0e0b32413ee10dde933d630948b5107d7dcb66cff612d04
* '''[[KBAG]]''': 7CE19E8083660112005D478A9D1C3F26E12CDCEB67AF4F0F5B4B341A8D6B9D9EC7D1E33296C2BDEE6B1BE21037307F2A

=== AppleLogo (applelogo-640x960.s5l8930x.img3) ===
* '''IV''': 4ffe0f61382b72de5d59caf386a100d9
* '''Key''': 33ea000f7238f46f6098e72936da2120b802fe52a444cdc380a26940e76be906
* '''[[KBAG]]''': DECEAFEB8D38C236903F87A319EE880FD99ACE633BAC06EC87754E64EAF15BDDCE1A957543CA1C479055577CDD7E78DC

=== BatteryCharging0 (batterycharging0-640x960.s5l8930x.img3) ===
* '''IV''': 2144d0edb65e04591b88bc45a606018f
* '''Key''': b1f581f25540fae52221891d28ce39c6cb39b050dda34bbcc5cc7fd02afcfb23
* '''[[KBAG]]''': 21309B58F15B274223FF2399E3E725B6358D3B9A38C3F6B43137088BFB9C3032F845593640EE51F8BCD639B07AB2CFCB

=== BatteryCharging1 (batterycharging1-640x960.s5l8930x.img3) ===
* '''IV''': 6caf61b577abba2e5c120c476f160d67
* '''Key''': cb888fd39eeed5bc4bdd3a8314912cf7a08b4dbdd66165380804bad38bfa6e93
* '''[[KBAG]]''': 082661F923BC2F5F6EF19CAAD4DE570C8CA1705B0D2D29B8058C5869CC91AB6A61F11DF01BECA79CD9E1677B2C5A9404

=== BatteryLow0 (batterylow0-640x960.s5l8930x.img3) ===
* '''IV''': 81d668a4601d4ac2368b580d8c542a93
* '''Key''': 779677998eb3f0985d88519d5c402e0c81d41ab17976124da1cc6509961b1859
* '''[[KBAG]]''': 1134BBA12375D25830BB09BAD87619FE7E2E1738E6519A9C7D101A00CB12D0F6168AE295EE38BC5337E0BA85413B02A8

=== BatteryLow1 (batterylow1-640x960.s5l8930x.img3) ===
* '''IV''': bd831d7f660694de8a8baec15695207a
* '''Key''': dfae5279a7b5ad1be377874088b75c2c913696c8ba4c4ddb11b40cef20f6d6fe
* '''[[KBAG]]''': EACA4BEC81CF2B4BB5B43EF0A70889FA150A0DBE9819F838E90A8C9197C7FC87098AA1D4F2D0D0D1E3D0BC00086FF0B6

=== DeviceTree (DeviceTree.n90ap.img3) ===
* '''IV''': fb806971be00151d6cd294b4b88d22c4
* '''Key''': 32f0414688bc943a3a49b4ef3c8c19cff115ae77cc3aba2d3340cd0a177cb6cf
* '''[[KBAG]]''': 1D09794FAFDDB7B0CA52D63BE035CB143611DFF3C1F798E9DEE3222CC8D8F2B8C14809FD7FA4070BB2387806517EFFA1

=== GlyphCharging (glyphcharging-640x960.s5l8930x.img3) ===
* '''IV''': 5d1d628dddc3415680b828f29d9ff6a9
* '''Key''': 1b140e0262cd4f3e5517c5fce5291e7d497095edbf7acd81f3066db75b13bc97
* '''[[KBAG]]''': 806D1135E28A6035E9101BE2DF7B75EF6BFD14DF9CCB7AFAE7004260012C3B08B8E73A165D0D566A48326FE718A77AF6

=== GlyphPlugin (glyphplugin-640x960.s5l8930x.img3) ===
* '''IV''': f717cff855e057020e080837283be0bf
* '''Key''': 066cb756433644479a381a3f90f25776d3acfe912a21214ca641f12fd324e4b9
* '''[[KBAG]]''': 8889F9B7B02BECA3373E98A5FD65386272D52F462CC1590973DE07B4D8B10F40140532BD8C77CDA276CE6D24C767F306

=== [[iBEC]] (iBEC.n90ap.RELEASE.dfu) ===
* '''IV''': 2c69d74317e2ade05e368dd70ca23f5d
* '''Key''': 16c478490b555fa67db4441d03b3616a6d71a6d055785d09abfae6c9e3e9339d
* '''[[KBAG]]''': A484D4567E6D650D57EC1D41D8DF9670CE8620CE08B0093AB67E2EE201E9F74AFF1F011661B71714CCACC78F07B50096

=== [[IBoot (Bootloader)|iBoot]] (iBoot.n90ap.RELEASE.img3) ===
* '''IV''': 88abaa8e21ede6a97fd547ea5edc02e7
* '''Key''': 4d87a79f4520074b27b344eea11da2a0d62bcbffa45fa35b4884bf68a4993e37
* '''[[KBAG]]''': 2E0180EDF1EE47B8AA5D62EB388A5F49777C59F303ED313842C3A69DAF4584E6ADC20AE5E079FDD3894ACA8E53021E5E

=== [[iBSS]] (iBSS.n90ap.RELEASE.dfu) ===
* '''IV''': 09a87275ed5f49757d6fd9cfdeb16a9e
* '''Key''': 9119845f4534b1f351ed1bcc05e5bc5e93b459ca2cd9be7cf3c34d4d076872c0
* '''[[KBAG]]''': F2419951FF9F1AAEF6D9FDBF081CD0F2B5FA0C9A574EB23EE0DB9192925AB8736B82B8B551223644DA298B13511D9152

=== [[Kernelcache]] (kernelcache.release.n81) ===
* '''IV''': e93941d3a03ef41bd2979aab1ed85ddf
* '''Key''': b7621fb4c6c766722c3018c3b7b7d387827e2369fa43811bcb9e22e9599aa8f4
* '''[[KBAG]]''': 32A318CB3A9AE0AB52FFA9B46824D219A34B65E422F0553EC711272A87032AC435BD5288E6BED07B327508EA4EF3E094

=== [[LLB]] (LLB.n90ap.RELEASE.img3) ===
* '''IV''': 4b7a331704632d6e601df130e09c0e7b
* '''Key''': 456861c0c597dfd57fd8c3cb17cf104f4e2f48a3fd6b7729416a6a10b351b467
* '''[[KBAG]]''': 1A703ABCCE63575120EE3C5CEFB32A28BA3D3A978BAC4E4B6B0B9B1E357E04F4E04F2CE76BBC4257533E5E5C91D58511

=== [[Recovery_Mode]] (recoverymode-640x960.s5l8930x.img3) ===
* '''IV''': 23ba400f925e9cbab395edf40b605fae
* '''Key''': 7ad21b53138c53cec727c43aed0837d76953b9b496f7913cd3c9724198a8b9ea
* '''[[KBAG]]''': 951602B10A382F984ACA0F445D4E6A6867D53CB63696174C6AB14867CCE5614463499059C98892F6D04868A2443103EE

DurangoVail 8F5148b (iPhone2,1)

2011-01-13T03:56:37Z

Sbingner: Keys...

=== Root Filesystem (038-0434-002.dmg) ===
* '''[[VFDecrypt]] Key''': 15130edaeb5897edf079f89e4224f435edf3986b9f72bd3079509ab623adcb0a600200ed

=== [[Update Ramdisk]] (038-0401-002.dmg) ===
* '''IV''': f852db76ee4f12a50bec92bf0b843ee4
* '''Key''': bbe5a2c75769d27f1d40f3656bb24ab01ebb384c9836c462241ca1fcf11d6f05
* '''[[KBAG]]''': C881B4B2AAF16EA2092857F3F55850103159BED71207D64C16BCE48FB0F32F216A97B4F1A942C2BA462833FA5DF4F18F

=== [[Restore Ramdisk]] (038-0406-002.dmg) ===
* '''IV''': 9aacd07c7fc593cdd61013a638519ec9
* '''Key''': 86324169c09e4ae00a319575d00a0700627138f61ec7351f91c154ca442043c6
* '''[[KBAG]]''': 9FA10408F6C2F7CBA3472CCBDD1107B1C5FDEE8D5E455F301A73BBC41DFF8702853E423A5732A3AABCD7CA0ED3940417

=== AppleLogo (applelogo.s5l8920x.img3) ===
* '''IV''': e9380bc064643fbd7731888f70c92c0b
* '''Key''': b5a211976dcdf193e7de4313d4ceb6aa3d713bf4fc285ef7702a6ae3b55f4479
* '''[[KBAG]]''': E6252634B6FD61A6FE862A6B6EBE59132813AEF79B53FC4DF09BD2F57156CA3C9E6D935B2ABEFBF9B2D1C0EF2E2D29A2

=== BatteryCharging0 (batterycharging0.s5l8920x.img3) ===
* '''IV''': ad13590a04e0f486e334cd218c36ad07
* '''Key''': daabe43736cd17d7c30d047858d63678ca5b12e155d891e379e5ccea0f87f17f
* '''[[KBAG]]''': 5D04CB0B266D8FB7BB00C6C97315F938B3524EA26B6E06362BCDFED6356312E33CF916DE146D5C2CACB5EB9F87723E34

=== BatteryCharging1 (batterycharging1.s5l8920x.img3) ===
* '''IV''': 0e48c7ba8aae2bbd0f14ca3e694b4520
* '''Key''': 57e02aed54d226a0e537c580be9f5b6af88f7e528c976233a7bfb94b5a779c06
* '''[[KBAG]]''': 531F3ADDB668B9869D1B6722DB0381FDB62BF4CBBE0C688608AAD01FAF21FC7FD78F92958440DE673C53C1E81616542C

=== BatteryLow0 (batterylow0.s5l8920x.img3) ===
* '''IV''': 26c3d3518173591f20c2d2e21e8a9171
* '''Key''': 2641a80a185ae2f76ad18baaec0d27a06d8572bfd4290e1f8f2b0fbdc1f0ffaa
* '''[[KBAG]]''': 51C7652911D70DFFF7DBF7C04B41B6BB135696840902A5C12C2F55DD03F2A24CD8C55AD98BC5250AF03DB4AFB5CBD552

=== BatteryLow1 (batterylow1.s5l8920x.img3) ===
* '''IV''': 6ae802130b84e466107f48f143ce4af9
* '''Key''': f007bd7d8f6d8afd0cc0bed7be2253dd5f837ed9715dd6d3afd116fb74142516
* '''[[KBAG]]''': 66C451CA180C65DBD4A1D3B4BB7CB42D9FC1F7B154F3B2B65E137074D6BE6E5CE0F93F36BBFADE05277455CDAADAAF71

=== DeviceTree (DeviceTree.n88ap.img3) ===
* '''IV''': 956623513f49604920c93fab4e376236
* '''Key''': 429f0c32da12f3887f94d6c11d3ea0a3ef5b47c0324bd79e1f9b9adbb765b36e
* '''[[KBAG]]''': 43D6900CCFC26BBCCF252B72F09C788C1506C2A867428876F02C8D83BDE71D83C3F6190D37E5DEAEC52BD5F36689D6EB

=== GlyphCharging (glyphcharging.s5l8920x.img3) ===
* '''IV''': 26343696a102f548a62a6c149afe4a8d
* '''Key''': b85d62648a7265a2c0ce5462a6f70190420267ee0a3004400cbb826444b2bb53
* '''[[KBAG]]''': 28141BE10DB78C7C8576906C0CF01D005DCCCE6D306F2B48319441793D05B5215F1385D8BAA46CC82859705C0D5DF774

=== GlyphPlugin (glyphplugin.s5l8920x.img3) ===
* '''IV''': f26954bf921d55a241f809218d4d395f
* '''Key''': 3a7435c33b36b072ceda4c91c05d79fdd56ac9df0406877d7506731a94d7b32e
* '''[[KBAG]]''': A6A1D4750F2EB4E4DBF2AEABD5DCFC969F70E7B0ACCDCBC70EBBF602A5195676BE51567634E884792C6A82381AA0E855

=== [[iBEC]] (iBEC.n88ap.RELEASE.dfu) ===
* '''IV''': f8de84407b63676316ffea3bdd71e3a8
* '''Key''': 9d4428df42e203c0dc60805b7f27319a120531d8a70ded9df6f3e6703783853b
* '''[[KBAG]]''': 19A24206A50CBFAA75EE618EB9526EC9ECDB35140FA62E720CBD6DDD8CF6C2A0DCA9475E4E289ACF872F0754B41FE6DC

=== [[IBoot (Bootloader)|iBoot]] (iBoot.n88ap.RELEASE.img3) ===
* '''IV''': cfb5bd63e4e64574fd16db33ca1055d5
* '''Key''': a6bfb721455eef0fcfd79d16b63670c645e7d1d204feb5cee91e85c297ad108f
* '''[[KBAG]]''': A6B6C22797954F66B872197B1EF6285248E9F059727231F2C9C642322587350BE0712818B861786B8FBC9803466F8012

=== [[iBSS]] (iBSS.n88ap.RELEASE.dfu) ===
* '''IV''': 099f776fbf84ff7ec5c4ea0c901ddad9
* '''Key''': 32134bcfa60cdcc16c8a84c34c4d1c573e50c42d5cbabc0b6973babfe19e2480
* '''[[KBAG]]''': 44B342D37C9C551E0E76ACFF20322AB7EA966113BDAC69973EE57F99CE5AB7FE0A35B62BAEF88920754F0FA753F77BC4

=== [[Kernelcache]] (kernelcache.release.n88) ===
* '''IV''': 7ce5aee757332f347777a9c86f016197
* '''Key''': 9cf5bb9efe5c45bd767520ad9bf64b3ad38a406f040a009fa86ad2909006cccc
* '''[[KBAG]]''': A53DF8C97E42640003293A1A5AF182CE758783F7435C3C9B7534C4FC8BF63BD394B41F9133A942123BD051BC9C231482

=== [[LLB]] (LLB.n88ap.RELEASE.img3) ===
* '''IV''': eb39a152b972c82b6561c4a33b812182
* '''Key''': 7f3ce176fcfa97a36fb7350fcee0e2693af5b066945827f33fd1a360bbdb105e
* '''[[KBAG]]''': AA838C6C404CA83C8E3BF309DD3B5D95CC6B132E384BAFA20031A049C649441231AF2059B0885C0DBE4592ABAA8F1756

=== [[Recovery_Mode]] (recoverymode.s5l8920x.img3) ===
* '''IV''': c69bbaf3444e202572bc9cfd7d81721f
* '''Key''': 15f1f89a865ee23a5f7ed0493bfffd70a68597a687806befd87ebf18b3eb7536
* '''[[KBAG]]''': 88780F3553AEA046DDBCBB529A2F32F74E70BA7A9DECCF34882DC8E94484000D1A9FF9D565FF14DD2BCD7509EE2444E1

Kirkwood 7A341 (iPhone1,1)

2010-11-19T09:25:54Z

Sbingner: Don't suppose the extra 0s were really needed right?

== Decryption Keys ==
=== Root Filesystem (018-5301-002.dmg) ===
* '''[[VFDecrypt]] Key''': 25CCE378DE209D8FB6EC45ECBE7525695272B81FE38BBAD76E979AC3921C3614ED162C87

=== [[Update Ramdisk]] (018-5303-002.dmg) ===
* '''IV''': 0dc67d4f50ac62ee142b99baa569d0f4
* '''Key''': 5a0f82979f336baa58ed37926bd89dfe
* '''[[KBAG]]''': C03798F3DC6B95B0AEB719D800FF8F90BE6BFDDA7CD46F2C1E1C93FA66736226

=== [[Restore Ramdisk]] (018-5305-002.dmg) ===
* '''IV''': caca33f1aca029320d60873a4deed68d
* '''Key''': 9962589aabb4d5ec56b7a867ab5b11b0
* '''[[KBAG]]''': D8A2F3225AA9BB46D53B0DA4B27A5353C5AC9F6368B4D785810BC917152C57D0

Kirkwood 7A341 (iPhone1,1)

2010-11-19T09:23:50Z

Sbingner: Standardize format

== Decryption Keys ==

=== Root Filesystem (018-5301-002.dmg) ===
* '''[[VFDecrypt]] Key''': 25CCE378DE209D8FB6EC45ECBE7525695272B81FE38BBAD76E979AC3921C3614ED162C87

=== [[Update Ramdisk]] (018-5303-002.dmg) ===
* '''IV''': 0dc67d4f50ac62ee142b99baa569d0f4
* '''Key''': 5a0f82979f336baa58ed37926bd89dfe
* '''[[KBAG]]''': C03798F3DC6B95B0AEB719D800FF8F90BE6BFDDA7CD46F2C1E1C93FA6673622600000000000000000000000000000000

=== [[Restore Ramdisk]] (018-5305-002.dmg) ===
* '''IV''': caca33f1aca029320d60873a4deed68d
* '''Key''': 9962589aabb4d5ec56b7a867ab5b11b0
* '''[[KBAG]]''': D8A2F3225AA9BB46D53B0DA4B27A5353C5AC9F6368B4D785810BC917152C57D000000000000000000000000000000000

Wildcat 7B405 (iPad1,1)

2010-11-13T08:22:59Z

Sbingner: Why didn't you put in the vfdecrypt key?

==Decryption Keys==
===Root Filesystem (018-7825-011.dmg)===
* '''[[VFDecrypt]] Key''': c3d15c6dc3b289db4d90b59199c485486043bb534c14d21993e35f68f2c6c1804a9125a8

===[[Update Ramdisk]] (018-7822-011.dmg)===
* '''IV''': ac20e399c6e3e491b68028ccdd51b458
* '''Key''': a4a2396bc7329f7f5a905c6725253f3ffad2da650f9b6c827021bbd9335757b3

===[[Restore Ramdisk]] (018-7823-011.dmg)===
* '''IV''': 3ed149b2f67690e5376880fc0323fbe2
* '''Key''': aa616f53beff0bd86dfb7aa53954614395fc13e31be97fb16e0f886f0d6cdcfc

===AppleLogo===
* '''IV''': 743a4d54b0da0b23662885bd6a8a9ce1
* '''Key''': aae7b027f6d797b0a95459a13b1c0d9749f2279a5de4356239ddf34ede15fd39

===BatteryCharging0===
* '''IV''': ca2515a2fbfcfab8ce7a47b6cba1b876
* '''Key''': 1312baba3b441ff21c1ab71bedb812747613b59aa09d04e323de52ab0f61129b

===BatteryCharging1===
* '''IV''': 7503542226c2798c39f703505820aa60
* '''Key''': f0b999bf581a0dee8863a53ec78b5dc6e5f4f3b22ac1351581507884922d7eb8

===BatteryFull===
* '''IV''': fce6ea7541baca8b3003791d2efc155c
* '''Key''': 1077d59ceeae77e6ec6b380fcecd0e6922a24c50c61116af9a7ac183779da042

===BatteryLow0===
* '''IV''': db114d8b404363aa0a093ef96eb8b2ae
* '''Key''': b6ea4e0377f87f3b0f5cc53ce8557560b33af64d0cf5a02fbf1e58cde0b72d80

===BatteryLow1===
* '''IV''': 5c82e6ac3d35183cf1a0c78523c35f6e
* '''Key''': 72a8537c4f1858ea7969190ddb297b48a7ccbe63bf929c4826e437b60f3f0ebc

===DeviceTree===
* '''IV''': 3f48a3e3a7bc563824a488fbd1f51639
* '''Key''': 21395bd5848bea1df6a18b62de234b4bb3b9ce67b7fd6a4e6a968780e805a1a3

===GlyphCharging===
* '''IV''': 70f5515133cab74d5852956d4e26d8b1
* '''Key''': 850a70fe9fb050c934424ae8c39293d239d89bef523246993cddc40c8cfd3a63

===GlyphPlugin===
* '''IV''': 51ad1b46301e2bcd9ddfe6b4a775a29a
* '''Key''': bd23381af4381f8bbb4ec816361b1f072e5be37542ca53d6afdb8b0e9c5d726c

===[[iBEC]]===
* '''IV''': 7cc0fcf856d754d163efafa7ab751ef1
* '''Key''': 11d18ab20469d399c1bfc0a30159499024eb393b5fe4fecdf6b049e119071fed

===[[iBoot (Bootloader)|iBoot]]===
* '''IV''': 1fde75187fea653b42170b71c9b4844e
* '''Key''': 8eb56b03a0e081dd175d3d076c5b07eca73847d27c93186783059728a1a1831d

===[[iBSS]]===
* '''IV''': 3a0ad7cf0f172bc3736af2099a4a89b4
* '''Key''': 0dcdc5bdc0d991020222c0e7b7d11305466f0ef831964c5fc9325f05e32b1a09

===[[Kernelcache]]===
* '''IV''': 9e86cf4fe0422c1ccffe7679c5bed7d3
* '''Key''': 0453c9edf37057aed0469ba0dea629e8b7f02dd58879ceb0092782767a805d2f

===[[LLB]]===
* '''IV''': a00118ed3a126fe16781a080f2b1d6bd
* '''Key''': 910fd0fd2bb43ad4aad2496a835c2c90f62aa6fda61419b087187f19c25b5959

===NeedService===
* '''IV''': 6e134d4b09d6334970ac901be8beb0e2
* '''Key''': 3dbf02aa01f65e772f8254efe03afdb674550b6f8482a5e57d34a37825132ac5

===RecoveryMode===
* '''IV''': 9d88f32f9cbda46d323d85add8292bec
* '''Key''': dfc2bb2afdcb7b9ab1cd67da8de051fb4f32b851d42444edfe8bbedf5c36a2b3

Firmware Keys

2010-11-13T03:13:20Z

Sbingner: /* Beta */ Add 8C134b

== Gaps ==
As you will notice, there may be a gap or two, or a key for a current build that is not there. Please feel free to add them, but please be sure that it is only the key for a User or Developer build, as if you gave the key for another type of build that might or may not be out there '''people could get in trouble, and we do not want that'''. Thanks for contributing!

== Notes ==
The root filesystem is by far the largest (300+ MB in the case of iOS 4), for which there is one key per device model, with no IV. Use [[VFDecrypt]] to decrypt this. You can mount/this once it has been decrypted using your program of choice. (For example, 7-zip on Windows.)

The Update and Restore ramdisks share the same IV and key per type of Application Processor (current choices are [[S5L8900]] in the [[N82ap|iPhone 3G]], [[S5L8720]] in the [[N72ap|iPod touch 2G]], [[S5L8920]] in the [[N88ap|iPhone 3GS]], and [[S5L8922]] in the [[N18ap|iPod touch 3G]]). Use [http://code.google.com/p/img3decrypt/ img3decrypt] or [http://github.com/planetbeing/xpwn/tree/master xpwntool] to decrypt these. Likewise, once this is decrypted, you can mount this as well, using the tool of your choice.

You may find [[Ramdisk Decryption]] to be helpful.

For those wanting to decrypt their own keys, you must use [[GenPass]] to get the keys for 4.x.

==Firmware versions==
===Table of Links to Keys===
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
|
! 1.x
! 2.x
! 3.x
! 4.x
|-
! Beta
|
| rowspan="2"| [[VFDecrypt Keys: 2.x|Keys]]
|[[VFDecrypt Keys: 3.x BETA|Keys]]
|[[VFDecrypt Keys: 4.x BETA|Keys]]
|-
|-
! Final
|[[VFDecrypt Keys: 1.x|Keys]]
|[[VFDecrypt Keys: 3.x|Keys]]
|
|}

===Final===
'''Main Article: ''[[Firmware]]'''''

{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
|
! [[M68ap|iPhone]]
! [[N82ap|iPhone 3G]]
! [[N88ap|iPhone 3GS]]
! [[N90ap|iPhone 4]]
! [[N45ap|iPod touch]]
! [[N72ap|iPod touch 2G]]
! [[N18ap|iPod touch 3G]]
! [[N81ap|iPod touch 4G]]
! [[K48ap|iPad]]
! [[K66ap|Apple TV 2G]]
|-
! style="text-align:left;" | 1.0
| [[Alpine 1A420 (iPhone)|1A420]]
| rowspan="10" | Unavailable
| rowspan="17" | Unavailable
| rowspan="26" | Unavailable
| rowspan="4" | Unavailable
| rowspan="14" | Unavailable
| rowspan="20" | Unavailable
| rowspan="29" | Unavailable
| rowspan="23" | Unavailable
| rowspan="29" | Unavailable
|-
! style="text-align:left;" | 1.0.0
| [[Heavenly 1A543a (iPhone)|1A543a]]
|-
! style="text-align:left;" | 1.0.1
| [[Heavenly 1C25 (iPhone)|1C25]]
|-
! style="text-align:left;" | 1.0.2
| [[Heavenly 1C28 (iPhone)|1C28]]
|-
! style="text-align:left;" | 1.1
| Unavailable
| [[Snowbird 3A100a (iPod touch)|3A100a]]+[[Snowbird 3A101a (iPod touch)|3A101a]]
|-
! style="text-align:left;" | 1.1.1
| [[Snowbird 3A109a (iPhone)|3A110a]]
| [[Snowbird 3A110a (iPod touch)|3A110a]]
|-
! style="text-align:left;" | 1.1.2
| [[Oktoberfest 3B48b (iPhone)|3B48b]]
| [[Oktoberfest 3B48b (iPod touch)|3B48b]]
|-
! style="text-align:left;" | 1.1.3
| [[Little Bear 4A93 (iPhone)|4A93]]
| [[Little Bear 4A93 (iPod touch)|4A93]]
|-
! style="text-align:left;" | 1.1.4
| [[Little Bear 4A102 (iPhone)|4A102]]
| [[Little Bear 4A102 (iPod touch)|4A102]]
|-
! style="text-align:left;" | 1.1.5
| Unavailable
| [[Little Bear 4B1 (iPod touch)|4B1]]
|-
! style="text-align:left;" | 2.0
| [[Big Bear 5A347 (iPhone)|5A347]]
| [[Big Bear 5A345 (iPhone 3G)|5A345]]+[[Big Bear 5A347 (iPhone 3G)|5A347]]
| [[Big Bear 5A347 (iPod touch)|5A347]]
|-
! style="text-align:left;" | 2.0.1
| [[Big Bear 5B108 (iPhone)|5B108]]
| [[Big Bear 5B108 (iPhone 3G)|5B108]]
| [[Big Bear 5B108 (iPod touch)|5B108]]
|-
! style="text-align:left;" | 2.0.2
| [[Big Bear 5C1 (iPhone)|5C1]]
| [[Big Bear 5C1 (iPhone 3G)|5C1]]
| [[Big Bear 5C1 (iPod touch)|5C1]]
|-
! style="text-align:left;" | 2.1
| [[Sugar Bowl 5F136 (iPhone)|5F136]]
| [[Sugar Bowl 5F136 (iPhone 3G)|5F136]]
| [[Sugar Bowl 5F137 (iPod touch)|5F137]]
|-
! style="text-align:left;" | 2.1.1
| colspan="2" | Unavailable
| Unavailable
| [[Sugar Bowl 5F138 (iPod touch 2G)|5F138]]
|-
! style="text-align:left;" | 2.2
| [[Timberline 5G77 (iPhone)|5G77]]
| [[Timberline 5G77 (iPhone 3G)|5G77]]
| [[Timberline 5G77 (iPod touch)|5G77]]
| [[Timberline 5G77a (iPod touch 2G)|5G77a]]
|-
! style="text-align:left;" | 2.2.1
| [[SUTimberline 5H11 (iPhone)|5H11]]
| [[SUTimberline 5H11 (iPhone 3G)|5H11]]
| [[SUTimberline 5H11 (iPod touch)|5H11]]
| [[SUTimberline 5H11a (iPod touch 2G)|5H11a]]
|-
! style="text-align:left;" | 3.0
| [[Kirkwood 7A341 (iPhone)|7A341]]
| [[Kirkwood 7A341 (iPhone 3G)|7A341]]
| [[Kirkwood 7A341 (iPhone 3GS)|7A341]]
| [[Kirkwood 7A341 (iPod touch)|7A341]]
| [[Kirkwood 7A341 (iPod touch 2G)|7A341]]
|-
! style="text-align:left;" | 3.0.1
| [[Kirkwood 7A400 (iPhone)|7A400]]
| [[Kirkwood 7A400 (iPhone 3G)|7A400]]
| [[Kirkwood 7A400 (iPhone 3GS)|7A400]]
| colspan="2" rowspan="2"| Unavailable
|-
! style="text-align:left;" | 3.1
| [[Northstar 7C144 (iPhone)|7C144]]
| [[Northstar 7C144 (iPhone 3G)|7C144]]
| [[Northstar 7C144 (iPhone 3GS)|7C144]]
|-
! style="text-align:left;" | 3.1.1
| colspan="3" | Unavailable
| [[Northstar 7C145 (iPod touch)|7C145]]
| [[Northstar 7C145 (iPod touch 2G)|7C145]]
| [[Northstar 7C145 (iPod touch 3G)|7C145]]+[[Northstar 7C146 (iPod touch 3G)|7C146]]
|-
! style="text-align:left;" | 3.1.2
| [[Northstar 7D11 (iPhone)|7D11]]
| [[Northstar 7D11 (iPhone 3G)|7D11]]
| [[Northstar 7D11 (iPhone 3GS)|7D11]]
| [[Northstar 7D11 (iPod touch)|7D11]]
| [[Northstar 7D11 (iPod touch 2G)|7D11]]
| [[Northstar 7D11 (iPod touch 3G)|7D11]]
|-
! style="text-align:left;" | 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone)|7E18]]
| [[SUNorthstarTwo 7E18 (iPhone 3G)|7E18]]
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|7E18]]
| [[SUNorthstarTwo 7E18 (iPod touch)|7E18]]
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|7E18]]
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|7E18]]
|-
! style="text-align:left;" | 3.2
| rowspan="7" | Unavailable
| colspan="2" rowspan="3" | Unavailable
| rowspan="7" | Unavailable
| colspan="2" rowspan="3" | Unavailable
| [[Wildcat 7B367 (iPad)|7B367]]
|-
! style="text-align:left;" | 3.2.1
| [[Wildcat 7B405 (iPad)|7B405]]
|-
! style="text-align:left;" | 3.2.2
| [[Wildcat 7B500 (iPad)|7B500]]
|-
! style="text-align:left;" | 4.0
| [[Apex 8A293 (iPhone 3G)|8A293]]
| [[Apex 8A293 (iPhone 3GS)|8A293]]
| [[Apex 8A293 (iPhone 4)|8A293]]
| [[Apex 8A293 (iPod touch 2G)|8A293]]
| [[Apex 8A293 (iPod touch 3G)|8A293]]
| rowspan="4" | Unavailable
|-
! style="text-align:left;" | 4.0.1
| [[Apex 8A306 (iPhone 3G)|8A306]]
| [[Apex 8A306 (iPhone 3GS)|8A306]]
| [[Apex 8A306 (iPhone 4)|8A306]]
| colspan="2" | Unavailable
|-
! style="text-align:left;" | 4.0.2
| [[Apex 8A400 (iPhone 3G)|8A400]]
| [[Apex 8A400 (iPhone 3GS)|8A400]]
| [[Apex 8A400 (iPhone 4)|8A400]]
| [[Apex 8A400 (iPod touch 2G)|8A400]]
| [[Apex 8A400 (iPod touch 3G)|8A400]]
|-
! style="text-align:left;" | 4.1
| [[Baker 8B117 (iPhone 3G)|8B117]]
| [[Baker 8B117 (iPhone 3GS)|8B117]]
| [[Baker 8B117 (iPhone 4)|8B117]]
| [[Baker 8B117 (iPod touch 2G)|8B117]]
| [[Baker 8B117 (iPod touch 3G)|8B117]]
| [[Baker 8B117 (iPod touch 4G)|8B117]]+[[Baker 8B118 (iPod touch 4G)|8B118]]
| [[Mojave 8M89 (Apple TV 2G)|8M89]]
|-
|}

===Beta===
'''Main Article: ''[[Beta Firmware]]'''''

{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
|-
|
! [[M68ap|iPhone]]
! [[N82ap|iPhone 3G]]
! [[N88ap|iPhone 3GS]]
! [[N90ap|iPhone 4]]
! [[N45ap|iPod touch]]
! [[N72ap|iPod touch 2G]]
! [[N18ap|iPod touch 3G]]
! [[N81ap|iPod touch 4G]]
! [[K48ap|iPad]]
! [[K66ap|Apple TV 2G]]
|-
! style="text-align:left;" | 1.2b1
| [[Big Bear 5A147p (iPhone)|5A147p]]
| rowspan="8" | Unavailable
| rowspan="13" | Unavailable
| rowspan="20" | Unavailable
| [[Big Bear 5A147p (iPod touch)|5A147p]]
| rowspan="8" | Unavailable
| rowspan="15" | Unavailable
| colspan="2" rowspan="21" | Unavailable
| rowspan="23" | Unavailable
|-
! style="text-align:left;" | 2.0b2
| [[Big Bear 5A225c (iPhone)|5A225c]]
| [[Big Bear 5A225c (iPod touch)|5A225c]]
|-
! style="text-align:left;" | 2.0b3
| [[Big Bear 5A240d (iPhone)|5A240d]]
| [[Big Bear 5A240d (iPod touch)|5A240d]]
|-
! style="text-align:left;" | 2.0b4
| [[Big Bear 5A258f (iPhone)|5A258f]]
| [[Big Bear 5A258f (iPod touch)|5A258f]]
|-
! style="text-align:left;" | 2.0b5
| [[Big Bear 5A274d (iPhone)|5A274d]]
| [[Big Bear 5A274d (iPod touch)|5A274d]]
|-
! style="text-align:left;" | 2.0b6P
| [[Big Bear 5A292g (iPhone)|5A292g]]
| [[Big Bear 5A292g (iPod touch)|5A292g]]
|-
! style="text-align:left;" | 2.0b6F
| [[Big Bear 5A308 (iPhone)|5A308]]
| [[Big Bear 5A308 (iPod touch)|5A308]]
|-
! style="text-align:left;" | 2.0b7
| [[Big Bear 5A331 (iPhone)|5A331]]
| [[Big Bear 5A331 (iPod touch)|5A331]]
|-
! style="text-align:left;" | 3.0b1
| [[Kirkwood 7A238j (iPhone)|7A238j]]
| [[Kirkwood 7A238j (iPhone 3G)|7A238j]]
| [[Kirkwood 7A238j (iPod touch)|7A238j]]
| [[Kirkwood 7A238j (iPod touch 2G)|7A238j]]
|-
! style="text-align:left;" | 3.0b2
| [[Kirkwood 7A259g (iPhone)|7A259g]]
| [[Kirkwood 7A259g (iPhone 3G)|7A259g]]
| [[Kirkwood 7A259g (iPod touch)|7A259g]]
| [[Kirkwood 7A259g (iPod touch 2G)|7A259g]]
|-
! style="text-align:left;" | 3.0b3
| [[Kirkwood 7A280f (iPhone)|7A280f]]
| [[Kirkwood 7A280f (iPhone 3G)|7A280f]]
| [[Kirkwood 7A280f (iPod touch)|7A280f]]
| [[Kirkwood 7A280f (iPod touch 2G)|7A280f]]
|-
! style="text-align:left;" | 3.0b4
| [[Kirkwood 7A300g (iPhone)|7A300g]]
| [[Kirkwood 7A300g (iPhone 3G)|7A300g]]
| [[Kirkwood 7A300g (iPod touch)|7A300g]]
| [[Kirkwood 7A300g (iPod touch 2G)|7A300g]]
|-
! style="text-align:left;" | 3.0b5
| [[Kirkwood 7A312g (iPhone)|7A312g]]
| [[Kirkwood 7A312g (iPhone 3G)|7A312g]]
| [[Kirkwood 7A312g (iPod touch)|7A312g]]
| [[Kirkwood 7A312g (iPod touch 2G)|7A312g]]
|-
! style="text-align:left;" | 3.1b1
| [[NorthVail 7C97d (iPhone)|7C97d]]
| [[NorthVail 7C97d (iPhone 3G)|7C97d]]
| [[NorthVail 7C97d (iPhone 3GS)|7C97d]]
| [[NorthVail 7C97d (iPod touch)|7C97d]]
| [[NorthVail 7C97d (iPod touch 2G)|7C97d]]
|-
! style="text-align:left;" | 3.1b2
| [[NorthVail 7C106c (iPhone)|7C106c]]
| [[NorthVail 7C106c (iPhone 3G)|7C106c]]
| [[NorthVail 7C106c (iPhone 3GS)|7C106c]]
| [[NorthVail 7C106c (iPod touch)|7C106c]]
| [[NorthVail 7C106c (iPod touch 2G)|7C106c]]
|-
! style="text-align:left;" | 4.0b1
| rowspan="9" | Unavailable
| [[ApexVail 8A230m (iPhone 3G)|8A230m]]
| [[ApexVail 8A230m (iPhone 3GS)|8A230m]]
| rowspan="9" | Unavailable
| [[ApexVail 8A230m (iPod touch 2G)|8A230m]]
| [[ApexVail 8A230m (iPod touch 3G)|8A230m]]
|-
! style="text-align:left;" | 4.0b2
| [[ApexVail 8A248c (iPhone 3G)|8A248c]]
| [[ApexVail 8A248c (iPhone 3GS)|8A248c]]
| [[ApexVail 8A248c (iPod touch 2G)|8A248c]]
| [[ApexVail 8A248c (iPod touch 3G)|8A248c]]
|-
! style="text-align:left;" | 4.0b3
| [[ApexVail 8A260b (iPhone 3G)|8A260b]]
| [[ApexVail 8A260b (iPhone 3GS)|8A260b]]
| [[ApexVail 8A260b (iPod touch 2G)|8A260b]]
| [[ApexVail 8A260b (iPod touch 3G)|8A260b]]
|-
! style="text-align:left;" | 4.0b4
| [[ApexVail 8A274b (iPhone 3G)|8A274b]]
| [[ApexVail 8A274b (iPhone 3GS)|8A274b]]
| [[ApexVail 8A274b (iPod touch 2G)|8A274b]]
| [[ApexVail 8A274b (iPod touch 3G)|8A274b]]
|-
! style="text-align:left;" | 4.0GM
| [[ApexVail 8A293 (iPhone 3G)|8A293]]
| [[ApexVail 8A293 (iPhone 3GS)|8A293]]
| [[ApexVail 8A293 (iPod touch 2G)|8A293]]
| [[ApexVail 8A293 (iPod touch 3G)|8A293]]
|-
! style="text-align:left;" | 4.1b1
| [[BakerVail 8B5080c (iPhone 3G)|8B5080c]]
| [[BakerVail 8B5080c (iPhone 3GS)|8B5080c]]
| [[BakerVail 8B5080c (iPhone 4)|8B5080c]]
| [[BakerVail 8B5080 (iPod touch 2G)|8B5080 (?)]]
| [[BakerVail 8B5080 (iPod touch 3G)|8B5080 (?)]]
|-
! style="text-align:left;" | 4.2b3
| [[JasperVail 8C5115c (iPhone 3G)|8C5115c]]
| [[JasperVail 8C5115c (iPhone 3GS)|8C5115c]]
| [[JasperVail 8C5115c (iPhone 4)|8C5115c]]
| [[JasperVail 8C5115c (iPod touch 2G)|8C5115c]]
| [[JasperVail 8C5115c (iPod touch 3G)|8C5115c]]
| [[JasperVail 8C5115c (iPod touch 4G)|8C5115c]]
| [[JasperVail 8C5115c (iPad)|8C5115c]]
|-
! style="text-align:left;" | 4.2GM
| [[JasperVail 8C134 (iPhone 3G)|8C134]]
| [[JasperVail 8C134 (iPhone 3GS)|8C134]]
| [[JasperVail 8C134 (iPhone 4)|8C134]]
| [[JasperVail 8C134 (iPod touch 2G)|8C134]]
| [[JasperVail 8C134 (iPod touch 3G)|8C134]]
| [[JasperVail 8C134 (iPod touch 4G)|8C134]]
| [[JasperVail 8C134 (iPad)|8C134]]
|-
! style="text-align:left;" | 4.2GM v2
| rowspan="1" | Unavailable
| rowspan="1" | Unavailable
| rowspan="1" | Unavailable
| rowspan="1" | Unavailable
| rowspan="1" | Unavailable
| rowspan="1" | Unavailable
| [[JasperVail 8C134b (iPad)|8C134b]]
|-
|}

[[Category:VFDecrypt]]

Jasper 8C134b (iPad1,1)

2010-11-13T03:05:42Z

Sbingner: feel free to format it your way... but hey - keys.

This is iOS 4.2 GM v2 for [[K48ap|iPad]].
==Keys==
===RootFS===
*Filename: 018-9933-001.dmg
*[[VFDecrypt]]: 8df8ebc5a47e60baa66dc66f8b4cdbcbe2f8591c67a287c122a66d45f0152d49838b1392

===Other/Unformatted===
<pre>
iPad1,1_4.2_8C134b_Restore.ipsw :: 018-9899-005.dmg :: -iv 51aa4923caebae78ee01c0f1bf1c5e94 -k 423abc716a2936b27507d7517e630bbd20763731edd17174c759588f8e4cf2ad
iPad1,1_4.2_8C134b_Restore.ipsw :: 018-9900-005.dmg :: -iv 782aeaf86c926fd3e17af0c6f7e04728 -k f233379f1c8b595b1b2cdf79a6e8c7467cebba80457733b0049c2489725690ee
iPad1,1_4.2_8C134b_Restore.ipsw :: DeviceTree.k48ap.img3 :: -iv 3c08f9cc37c776247f3d329a745635a4 -k 011cdb85511a8b5bf233d748e43f032502786a649e698604713132a67a96c214
iPad1,1_4.2_8C134b_Restore.ipsw :: LLB.k48ap.RELEASE.img3 :: -iv a4e10301bb038b5fc6a66792ef1e2892 -k 1f675ad80b3f5c8a509fe47a1730a94cd5f4f38cc5571924e9ab694129e9021d
iPad1,1_4.2_8C134b_Restore.ipsw :: applelogo.s5l8930x.img3 :: -iv d108bbfc6e3e4d6d3c9fec1d19fe1769 -k 3359842bed66e5f2b942f60ac30667a36a86f049b8cb33bd101c1caf5cb422e8
iPad1,1_4.2_8C134b_Restore.ipsw :: batterycharging0.s5l8930x.img3 :: -iv 52bdca92e1e24cdf3017377726a48ce7 -k 529ce7b5621568657fe66c3d5124947528f684edefcc3cc800054c91f78c18eb
iPad1,1_4.2_8C134b_Restore.ipsw :: batterycharging1.s5l8930x.img3 :: -iv 2739e3e8297be8030f11538170b69ff2 -k 831697c2f43d8b8e570f293d87fcd2693885851b07a953754caf3a1eb6465961
iPad1,1_4.2_8C134b_Restore.ipsw :: batteryfull.s5l8930x.img3 :: -iv a4a9809547412fc0e7b67e4d2a451325 -k 0f1cd6526c4e82413695cf4740752b515ddb37c97f0f379cb465a85028773b89
iPad1,1_4.2_8C134b_Restore.ipsw :: batterylow0.s5l8930x.img3 :: -iv 3f76fc42175ad76091069eadee14aa6d -k 1fda5c1b458a120b6938349e77017c9e0761464ce0d92d407f9336d6d660de8f
iPad1,1_4.2_8C134b_Restore.ipsw :: batterylow1.s5l8930x.img3 :: -iv 7a60bd06f3c9aabf608dfda2779796ac -k 53062d36fb3e5abe9c56d7900a4963979f3d78873f958fc0149f56c1955f404b
iPad1,1_4.2_8C134b_Restore.ipsw :: glyphcharging.s5l8930x.img3 :: -iv 79c49644291fb3463fba5300b27b8a82 -k f2f8a2c1f259aee33ddbb0edd52065edfefff2826d91d0fe00c7fb10ac36f32e
iPad1,1_4.2_8C134b_Restore.ipsw :: glyphplugin.s5l8930x.img3 :: -iv c5a595594ff4a1b719d4aaf5d4543c26 -k e6a26d36c0c4698761c77faa0229468e2a08f1ec2739ef3d467ae02046ed228b
iPad1,1_4.2_8C134b_Restore.ipsw :: iBEC.k48ap.RELEASE.dfu :: -iv 9c7917260ca97dec3ecd32e75567cc77 -k 8f76f35e9cce90a13f1efb56d9e12152c41bacf797a0c3b662050bca00b434e5
iPad1,1_4.2_8C134b_Restore.ipsw :: iBSS.k48ap.RELEASE.dfu :: -iv 873ca0583dbfd0b40d42bd86bca09a07 -k 619a29ff91bf924bd1edf8efe48d280f5ec85865dd55dfe5f8989a1077f71a0e
iPad1,1_4.2_8C134b_Restore.ipsw :: iBoot.k48ap.RELEASE.img3 :: -iv 6ae99830ab64997ad7426d3342ba3bec -k 74476c5215f0b1e4204bf2f748b2adc660a7139e9b57a129ac4cfd3ae86476e8
iPad1,1_4.2_8C134b_Restore.ipsw :: kernelcache.release.k48 :: -iv 4fb28574ab4e691bb6756f695e416f4d -k c6eabf5c35c5ea765020802aed88688701396b12b1d6a2792fdfea2aaef1adb1
iPad1,1_4.2_8C134b_Restore.ipsw :: kernelcache.release.n81 :: -iv c3aa182e8d7a75fa61d3809372a725e8 -k 630fa1f654b32f8d75cb4c79c3aba3abbe6983755b574ad9db2687156a9ea108
iPad1,1_4.2_8C134b_Restore.ipsw :: kernelcache.release.n90 :: -iv a164586ce471559c11fe6707c0d48430 -k 7cbe7898f5118b62ae77d90a902835d9273e87d8736d64ac0befb0cc883423a0
iPad1,1_4.2_8C134b_Restore.ipsw :: recoverymode-768x1024.s5l8930x.img3 :: -iv 0b3af425ffa427e79a994297e8e216b5 -k be98b31bde94a4896c8dce2b252a6c2c26391221f2bdbe173c9d54ad0b2118f5
</pre>

==Credits==
*Grabbed with greenpois0n
*Special thanks to [[User:Posixninja|posixninja]]

Northstar 7C144 (iPhone1,2)

2010-11-07T13:04:35Z

Sbingner: /* Root Filesystem (018-5343-086.dmg) */ Thx wrong key...

== Decryption Keys ==
=== Root Filesystem (018-5343-086.dmg) ===
*'''[[VFDecrypt Keys|VFDecrypt]] Key''': 5bfa05ddbeb19ad7d2af3d7012adba6d82002d9d7e7b3771d11702728d15d8f8d52f3573

=== [[Update Ramdisk]] (018-5348-086.dmg) ===
* '''KBAG''': 157e44732af31d5308443aa9ea293969623d2464c971b34d0711ff5a72b46937
* '''IV''': 71f6eb862e503153d7cfaca2bd035077
* '''Key''': 8ab278e2094fcdfe05e6c29c778595e0

=== [[Restore Ramdisk]] (018-5351-086.dmg) ===
* '''KBAG''': e605d43effc61eb5b4ba9644c75563a68f728aaa7598369ef072450b91f1ac6a
* '''IV''': 73b1c28fc8fbfc6860cfb5f65962a71c
* '''Key''': 081091184b13fb72ffd91d19dce9b199

===Apple Logo===
* '''KBAG''': 995474f38e9865cc0960679e8a13fb4b4474085e409656dab7d2682e6348e8ec
* '''IV''': 1b8a5224f45aa94cfc02a8ceba55d6d8
* '''Key''': d2dad0c5dc935afddd628a2c2c243c4f

===Batterycharging0===
* '''KBAG''': 8ae59c40849dba0636e7bdbf0f886181632dd265a0ca7e5114b03f22841d7951
* '''IV''': 9dc5cb4730b7ff858336144f34fb130c
* '''Key''': 1f15304209b7fc8c36651e86a1adb1cf

===Batterycharging1===
* '''KBAG''': 02ec808f9739b01f01c98dcc53e759475cf858f9f3f2d1c8611a8e51fb433145
* '''IV''': 5a0973cc7b5229220a3bb897bdfc463a
* '''Key''': 91872731b7ffb34e34300f5785711d7b

===Batteryfull===
* '''KBAG''': da6219092decf4e9f110dcbc93e59ec6748c2b356a087bf0a979372b5fccefac
* '''IV''': 06bf68bef1bf08c803760992f06d82df
* '''Key''': 9962b39f775d6941109d0ca06f22cbe5

===Batterylow0===
* '''KBAG''': 97d026553f19638d8af53d654612f540f9fa453709b97a4f3512e4c599202676
* '''IV''': fe5b6ad072835ba24d4a513768882355
* '''Key''': c1bcd4b18161303135f386a5b3f5b645

===Batterylow1===
* '''KBAG''': 9c1263e059296115a2bf5aa5525e1b00458e6f683e08d751505e639f8c11220a
* '''IV''': e812b8e53545874e8727dcc39e01e2fa
* '''Key''': 79fcf4f159a5fbfef5baaaa347926720

===Devicetree===
* '''KBAG''': 8ac012f82211113201786ea64568fc3dfa46ca8243c16e6b10a54ffd01306f7c
* '''IV''': 91b33e5282e0d9594f08171ebb85f97d
* '''Key''': e15089b323cd453898498d0e3918bb8f

===Glyphcharging===
* '''KBAG''': 53a4294e16755038c263e29616e1cf7d6851d4e8ce2e5f7df5ef31e4ee403d8c
* '''IV''': 63a79f76df4d1abc8d07d3a01cc47b5a
* '''Key''': cc53f9fc36f1a3efc02b490fdba035e1

===Glyphplugin===
* '''KBAG''': 24bd0bc9271762f1725459715458dffb098e2bdb47895989b7acd0a69a2c517f
* '''IV''': d28b9cb54a828d5259dc588f19cf3302
* '''Key''': 83e6c7256fc5444b592ccbe67d1a950a

===[[iBEC]]===
* '''IV''':
* '''Key''':

===[[iBoot]]===
* '''KBAG''': 0231864878d2acfc3d8015960179f59080172ee32b8fb281067c7ab3daf64f03
* '''IV''': a5ee452933ada902193420e3956b7559
* '''Key''': 1ebc381cd5ad04343ca0b08e9beab8ac

===[[iBSS]]===
* '''IV''':
* '''Key''':

=== [[Kernelcache]] ===
* '''KBAG''': 4da3b94bd72799af3be8f6ecca5e7509138338b450834e9d09733fcf4bb21c80
* '''IV''': 612726fff1a589a3a8906dd6b1129e86
* '''Key''': 258303b6d261e6476de63bc9f185b9f0

===[[LLB]]===
* '''KBAG''': 36490292039301910b68051c0993344b02689a4252d13021046b03f071fc8442
* '''IV''': 7f9e042b76342a74ea2387bc9e3015de
* '''Key''': a86cd3e64f8f2d675747dee67e6146c3

===NeedsService===
* '''KBAG''': dc38bb2ccc430dd66763317af4e3c030c17be3c1188ced145e90154c4e8de444
* '''IV''': da6863bd5a4236e1f487e5a53136fb72
* '''Key''': da443d5458ace1d3be8f1f5aa16733eb

===RecoveryMode===
* '''KBAG''': 7da36d0fca27e6bad696e65603d69eccbc1f461e4e272c2a7ead749793ba7920
* '''IV''': 0f7415895cfe5aea623503ce9db49e07
* '''Key''': 2648aeb9ab66fe6f2c0fbfd571d1ebc0

Activation Token

2010-10-24T03:11:41Z

Sbingner: /* Layout ActivationInfo */

[[iTunes]] gets a couple things from the phone: the [[DeviceID]], the [[CHIPID]], the [[wikipedia:IMEI|IMEI]], the [[Wikipedia:ICCID|ICCID]], the [[Wikipedia:IMSI|IMSI]], the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. If the phone number can be matched to the ICCID and IMSI and if the rest of the data is correct, the server appends the [[WildcardTicket]] to the token, signs the token with Apple's private key and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token.

==Layout Activation Token==

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ActivationInfoComplete</key>
<true/>
<key>ActivationInfoXML</key>
<data>
(base64-encoded activation info here)
</data>
<key>FairPlayCertChain</key>
<data>
(base64-encoded cert in DER format)
</data>
<key>FairPlaySignature</key>
<data>
(base64-encoded signature (SHA1+RSA) of ActivationInfoXML)
</data>
</dict>

==Layout ActivationInfo==
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ActivationRandomness</key>
<string>(GUID)</string>
<key>ActivationRequiresActivationTicket</key>
<true/>
<key>ActivationState</key>
<string>Unactivated</string>
<key>BasebandMasterKeyHash</key>
<string>(TEA key)</string>
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key>
<string>(TEA key)string>
<key>BuildVersion</key>
<string>8A306</string>
<key>DeviceCertRequest</key>
<data>
(base64 encoded cert)
</data>
<key>DeviceClass</key>
<string>(String ENUM "iPhone", "iPod", "iPod touch", "iPad")</string>
<key>IntegratedCircuitCardIdentity</key>
<string>(ICCID as base-10 string)</string>
<key>InternationalMobileEquipmentIdentity</key>
<string>(IMEI as base-10 string)</string>
<key>InternationalMobileSubscriberIdentity</key>
<string>(IMSI as base-10 string)</string>
<key>ModelNumber</key>
<string>MC135</string>
<key>PhoneNumber</key>
<string>(String like "+1 (555) 555-5555")</string>
<key>ProductType</key>
<string>iPhone2,1</string>
<key>ProductVersion</key>
<string>4.0.1</string>
<string>SIMGID1</string>
<data>
(base64-encoded binary GID1)
</data>
<string>SIMGID2</string>
<data>
(base64-encoded binary GID2)
</data>
<key>SIMStatus</key>
<string>(ENUM kCTSIMSupportSIMStatusReady kCTSIMSupportSIMStatusNotReady kCTSIMSupportSIMStatusOperatorLocked)</string>
<key>SerialNumber</key>
<string>...</string>
<key>SupportsPostponement</key>
<true/>
<key>UniqueChipID</key>
<integer>...</integer>
<key>UniqueDeviceID</key>
<string>(hex UUID)</string>
</dict>
</plist>

==Resources==
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]

[[Category:Baseband]]

Activation Token

2010-10-24T03:07:56Z

Sbingner: /* Layout Activation Token */

[[iTunes]] gets a couple things from the phone: the [[DeviceID]], the [[CHIPID]], the [[wikipedia:IMEI|IMEI]], the [[Wikipedia:ICCID|ICCID]], the [[Wikipedia:IMSI|IMSI]], the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. If the phone number can be matched to the ICCID and IMSI and if the rest of the data is correct, the server appends the [[WildcardTicket]] to the token, signs the token with Apple's private key and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token.

==Layout Activation Token==

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ActivationInfoComplete</key>
<true/>
<key>ActivationInfoXML</key>
<data>
(base64-encoded activation info here)
</data>
<key>FairPlayCertChain</key>
<data>
(base64-encoded cert in DER format)
</data>
<key>FairPlaySignature</key>
<data>
(base64-encoded signature (SHA1+RSA) of ActivationInfoXML)
</data>
</dict>

==Layout ActivationInfo==
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ActivationRandomness</key>
<string>...</string>
<key>ActivationRequiresActivationTicket</key>
<true/>
<key>ActivationState</key>
<string>Unactivated</string>
<key>BasebandMasterKeyHash</key>
<string>(TEA key)</string>
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key>
<string>(TEA key)string>
<key>BuildVersion</key>
<string>8A306</string>
<key>DeviceCertRequest</key>
<data>
(base64 encoded cert)
</data>
<key>DeviceClass</key>
<string>iPhone</string>
<key>IntegratedCircuitCardIdentity</key>
<string>...</string>
<key>InternationalMobileEquipmentIdentity</key>
<string>...</string>
<key>InternationalMobileSubscriberIdentity</key>
<string>...</string>
<key>ModelNumber</key>
<string>MC135</string>
<key>PhoneNumber</key>
<string>...</string>
<key>ProductType</key>
<string>iPhone2,1</string>
<key>ProductVersion</key>
<string>4.0.1</string>
<string>SIMGID1</string>
<data>
...
</data>
<string>SIMGID2</string>
<data>
...
</data>
<key>SIMStatus</key>
<string>kCTSIMSupportSIMStatusReady</string>
<key>SerialNumber</key>
<string>...</string>
<key>SupportsPostponement</key>
<true/>
<key>UniqueChipID</key>
<integer>...</integer>
<key>UniqueDeviceID</key>
<string>...</string>
</dict>
</plist>

==Resources==
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]

[[Category:Baseband]]

PwnStrap

2010-10-23T18:27:09Z

Sbingner: oops

[http://www.bingner.com/pwnstrap.html Link to original info and some binaries]

This is the procedure to use greenpois0n to bootstrap the loading of a new limera1n exploit-based pwnagetool image via windows or other irecovery and a supported device:
# irecovery -c
# setenv boot-args 2
# setenv auto-boot false
# saveenv
# run greenpois0n - it will stop on a white screen.
# extract iBSS from your custom pwnagetool image
# irecovery -f iBSS
# irecovery -c
# setenv boot-args 0
# saveenv
# go image decrypt 0x41000000
# go jump 0x41000040
# restore your CFW from itunes

You will need one of the new binaries posted above if you have an AppleTV2

PwnStrap

2010-10-23T18:25:55Z

Sbingner: I'll update this - too tried to do it right tonight/this morning

[http://www.bingner.com/pwnstrap.html Link to original info and some binaries]

This is the procedure to use greenpois0n to bootstrap the same thing with other irecovery and a supported device:
# irecovery -c
# setenv boot-args 2
# setenv auto-boot false
# saveenv
# run greenpois0n - it will stop on a white screen.
# extract iBSS from your custom pwnagetool image
# irecovery -f iBSS
# irecovery -c
# setenv boot-args 0
# saveenv
# go image decrypt 0x41000000
# go jump 0x41000040
# restore your CFW from itunes