The iPhone Wiki - User contributions [en]

DFU Mode

2020-07-28T01:47:50Z

Vanished user 20210509: Updated GPIO information, DFU output

'''DFU''' or '''Device Firmware Upgrade''' mode allows all devices to be restored from any state. It is essentially a mode where the BootROM can accept iBSS. DFU is part of the [[Bootrom|SecureROM]] which is burned into the hardware, so it cannot be removed. On A7+ devices, it generates an ApNonce and recognizes APTickets as well, so even in DFU, it can accept an APTicket.

== Entering DFU Mode ==
NOTE: If you are using a USB-C cable to enter DFU mode, it might not work. If this happens, you need to use the normal USB cable. You can use a normal USB cable and a USB to USB-C adapter.

=== Apple TV ===
# Plug the device into your computer using a Micro-USB cable.
# Force the device to reboot by holding down the "Menu" and "Down" buttons simultaneously for 6-7 seconds.
# Press "Menu" and "Play" simultaneously right after reboot, until a message pops up in [[iTunes]], saying that it has detected an Apple TV in Recovery Mode.

=== A9 and older devices (iPad other than the ones listed below, iPhone 6s and below, iPhone SE and iPod touch 6 and below) ===
# Connect the device to a computer using a USB cable.
# Hold down both the Home button and Lock button.
# After 8 seconds, release the Lock button while continuing to hold down the Home button.
#* If the Apple logo appears, the Lock button was held down for too long.
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.

=== A10 devices (iPhone 7 and iPhone 7 Plus, iPad 2018, iPod touch 7) ===
# Connect the device to a computer using a USB cable.
# Hold down both the Side button and Volume Down button.
# After 8 seconds, release the Side button while continuing to hold down the Volume Down button.
#* If the Apple logo appears, the Side button was held down for too long.
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.

=== A11 and newer devices (iPhone 8 and above, iPad Pro 2018, iPad Air 2019, iPad Mini 2019) ===
# Connect the device to a computer using a USB cable.
# Quick-press the Volume Up button
# Quick-press the Volume Down button
# Hold down the Side button until the screen goes black, then hold down both the Side button and Volume Down button.
# After 5 seconds, release the Side button while continuing to hold down the Volume Down button.
#* If the Apple logo appears, the Side button was held down for too long.
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.

=== Apple Watch ===

# Connect to computer via [[iBUS]] adapter and lightning cable
# Hold crown and power button (bottom right)
# Wait for the screen to go black
# After 3 seconds of black, let go of the power button but continue to hold the crown
# After about 5 seconds your watch will be in DFU mode

=== GPIO Pins ===
If you have hardware access to the SoC, you can either perform the above methods for your device by utilizing the <code>GPIO_REQUEST_DFU1</code> and <code>GPIO_REQUEST_DFU2</code> GPIO pins (previously <code>HOLD_KEY</code> and <code>MENU_KEY</code>) corresponding to Power and Home/Vol-, respectively, or by pulling your board's <code>GPIO_FORCE_DFU</code> pin high at SecureROM startup (unless you are using an [[iFPGA]], where Force DFU mode is the default).

The physical GPIO pins for each SoC varies.

== Exiting DFU Mode ==
To exit DFU Mode, simply force restart your device.

* For Apple TV, hold down the "Menu" and "Down" buttons on your remote until the Apple TV reboots.
* For iPad, iPhone 6s and below, iPhone SE and iPod touch, hold the Home button and the Lock button until the device reboots.
* For iPhone 7 and iPhone 7 Plus, hold down the Side button and Volume Down button until the device reboots.
* For iPhone 8, iPhone 8 Plus, and iPhone X, quick-press the Volume Up button, then quick-press the Volume Down button, then hold down the Side button until the device reboots.

==Enter True Hardware DFU Mode Automatically==
The EnterDFU function in the [[MobileDevice Library]] does not enter the true DFU Mode in the hardware. It's possible to enter the true DFU Mode without doing it manually, but it cannot be exited unless a restore is performed, as it creates a [[DFU Loop]]. This doesn't work with [[S5L8900]] devices.

===Steps===
# Make a copy of a fresh IPSW file.
# Open the IPSW as a zip folder and browse to /firmware/all_flash/all_flash.xxxxx.production/
# Extract LLB.*****.RELEASE.img3/im4p and open it in a hex editor.
# Change some random bit or bits, it doesn't matter which or what you write.
# Add the edited file back to the zip, rename zip to ipsw and restore it to your device using iTunes.
# The restore will error out and your device will be in DFU Mode.

===Alternative Method===
If the previous method does not work for you, try this one.
# Do steps 1 and 2 from above.
# Delete LLB.*****.RELEASE.img3.
# Copy applelogo.********.img3 to temporary directory.
# Rename the copy of applelogo.********.img3/im4p to LLB.*****.RELEASE.img3/im4p. (If you forget the name of the LLB file, you can find it again in the file named manifest.)
# Copy the renamed applelogo file back to the all_flash.xxxxx.production directory.
# Rename the zip.
# Restore the file using iTunes. (If every thing goes well, you should receive an error 31 from iTunes.)

==DFU Mode Output to the computer==
<pre>iProduct: "Apple Mobile Device (DFU Mode)"</pre> <pre>iSerialNumber: "CPID:XXXX CPRV:XX CPFM:0X SCEP:XX BDID:XX ECID:XXXXXXXXXXXXXXXX SRTG:[iBoot-XXXX.X.X]"</pre>

==Revisions==
===[[S5L8900]] (0x1222)===
This is the device ID in the [[N45AP|iPod touch]], the [[M68AP|iPhone]], and the [[N82AP|iPhone 3G]]. For more information about the protocol, see [[DFU 0x1222]].

===[[S5L8720 Bootrom|S5L8720]], [[S5L8920]], and [[WTF|WTF mode post-2.0]] (0x1227)===
This is the device ID in the [[N72AP|iPod touch (2nd generation)]], the [[N88AP|iPhone 3GS]], the [[N90AP|iPhone 4]], subsequent 32 bit devices, all 64 bit devices, and [[WTF|WTF mode]]. For more information on the protocol, see [[DFU 0x1227]].

[[Category:Bootrom]]

Boot-args (iBoot variable)

2020-06-09T21:15:34Z

Vanished user 20210509: rd/rootdev confusion; I don't backlight-level is a boot-arg, only an env variable

These are boot arguments that the iOS [[kernel]] accepts. These can be booted with a patched [[iBoot]]; untethered [[BootROM]] jailbreaks such as [[redsn0w]] and [[checkra1n]] do this when you set custom boot-args.

= Known Boot Arguments =
{| class="wikitable"
|-
! boot-arg
! Values
! Description
! Notes
|-
| debug=#
| <code>0x09</code>: Kernel debugging
| Set kernel debug options
|
|-
| nand-enable-reformat=#
| <code>0</code>, <code>1</code>
| Set whether or not to reformat [[NAND]] when restoring
| Used when [[Restore Process|restoring]]
|-
| pmd=#.#
| Start/end address of ramdisk
| Specify a [[Ramdisk|ramdisk]] in memory to boot from
| Used in the [[Ramdisk Hack]]
|-
| -progress
| {{n/a}}
| Enable progress bar when restoring
| Used when [[Restore Process|restoring]]
|-
| rd=?
| <code>'md#'</code>
| Specify the root device to boot from
| Used when [[Restore Process|restoring]]; same as <code>rootdev</code>
|-
| rootdev=?
| <code>'md#'</code>
| Specify the root device to boot from
| Same as <code>rd</code>
|-
| serial=#
| <code>3</code>: Debug output over serial
| Set serial debug options
| Same as <code>[[Debug-uarts (iBoot variable)|debug-uarts]]</code>
|-
| -v
| {{n/a}}
| Enable verbose booting
|
|-
|}

= See Also =
* [[Talk:Restore Mode]]

BORD

2020-06-09T21:15:10Z

Vanished user 20210509:

The '''Board ID''' of a device (also known as '''BORD''', '''BDID''', or '''ApBoardId''') is a value (usually represented as <code>uint8_t</code>) that represents multiple characteristics of the logic board. In a BuildManifest, this value is found in the <code>ApBoardId</code> tag. The characteristics represented by a given Board ID may be specific to the SoC.

== Devices ==
* [[List of AirPods|AirPods]]
** [[AirPods (1st generation)]]: N/A
** [[AirPods (2nd generation)]]: 0x12
* [[List of Apple TVs|Apple TV]]
** [[K66AP|Apple TV (2nd generation)]]: 0x10
** [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]: 0x08
** [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]: 0x00
** [[J42dAP|Apple TV (4th generation)]]: 0x34
** [[J105aAP|Apple TV 4K]]: 0x02
* [[Apple Watch (1st generation)]]
** [[N27aAP|Watch1,1]]: 0x02
** [[N28aAP|Watch1,2]]: 0x04
* [[Apple Watch Series 1]]
** [[N27dAP|Watch2,6]]: 0x02
** [[N28dAP|Watch2,7]]: 0x04
* [[Apple Watch Series 2]]
** [[N74AP|Watch2,3]]: 0x0C
** [[N75AP|Watch2,4]]: 0x0E
* [[Apple Watch Series 3]]
** [[N111sAP|Watch3,1]]: 0x1C
** [[N111bAP|Watch3,2]]: 0x1E
** [[N121sAP|Watch3,3]]: 0x18
** [[N121bAP|Watch3,4]]: 0x1A
* [[Apple Watch Series 4]]
** [[N131sAP|Watch4,1]]: 0x08
** [[N131bAP|Watch4,2]]: 0x0A
** [[N141sAP|Watch4,3]]: 0x0C
** [[N141bAP|Watch4,4]]: 0x0E
* [[Apple Watch Series 5]]
** [[N144sAP|Watch5,1]]: 0x10
** [[N144bAP|Watch5,2]]: 0x12
** [[N146sAP|Watch5,3]]: 0x14
** [[N146bAP|Watch5,4]]: 0x16
* [[HomePod]]
** [[B238aAP|AudioAccessory1,1]]: 0x38
** [[B238AP|AudioAccessory1,2]]: 0x1A
* [[List of iPads|iPad]]
** [[K48AP|iPad]]: 0x02
** [[iPad 2]]
*** [[K93AP|iPad2,1]]: 0x04
*** [[K94AP|iPad2,2]]: 0x06
*** [[K95AP|iPad2,3]]: 0x02
*** [[K93AAP|iPad2,4]]: 0x06
** [[iPad (3rd generation)]]
*** [[J1AP|iPad3,1]]: 0x00
*** [[J2AP|iPad3,2]]: 0x02
*** [[J2AAP|iPad3,3]]: 0x04
** [[iPad (4th generation)]]
*** [[P101AP|iPad3,4]]: 0x00
*** [[P102AP|iPad3,5]]: 0x02
*** [[P103AP|iPad3,6]]: 0x04
** [[iPad Air]]
*** [[J71AP|iPad4,1]]: 0x10
*** [[J72AP|iPad4,2]]: 0x12
*** [[J73AP|iPad4,3]]: 0x14
** [[iPad Air 2]]
*** [[J81AP|iPad5,3]]: 0x06
*** [[J82AP|iPad5,4]]: 0x02
** [[iPad Pro (12.9-inch)]]
*** [[J98aAP|iPad6,7]]: 0x10
*** [[J99aAP|iPad6,8]]: 0x12
** [[iPad Pro (9.7-inch)]]
*** [[J127AP|iPad6,3]]: 0x08
*** [[J128AP|iPad6,4]]: 0x0A
** [[iPad (5th generation)]]
*** [[iPad6,11]]: 0x10
*** [[iPad6,12]]: 0x12
** [[iPad Pro (12.9-inch) (2nd generation)]]
*** [[J120AP|iPad7,1]]: 0x0C
*** [[J121AP|iPad7,2]]: 0x0E
** [[iPad Pro (10.5-inch)]]
*** [[J207AP|iPad7,3]]: 0x04
*** [[J208AP|iPad7,4]]: 0x06
** [[iPad (6th generation)]]
*** [[J71bAP|iPad7,5]]: 0x18
*** [[J72bAP|iPad7,6]]: 0x1A
** [[iPad (7th generation)]]
*** [[J171AP|iPad7,11]]: 0x1C
*** [[J172AP|iPad7,12]]: 0x1E
** [[iPad Pro (11-inch)]]
*** [[J317AP|iPad8,1]]: 0x0C
*** [[J317xAP|iPad8,2]]: 0x1C
*** [[J318AP|iPad8,3]]: 0x0E
*** [[J318xAP|iPad8,4]]: 0x1E
** [[iPad Pro (12.9-inch) (3rd generation)]]
*** [[J320AP|iPad8,5]]: 0x08
*** [[J320xAP|iPad8,6]]: 0x18
*** [[J321AP|iPad8,7]]: 0x0A
*** [[J321xAP|iPad8,8]]: 0x1A
** [[iPad Pro (11-inch) (2nd generation)]]
*** [[J417AP|iPad8,9]]: 0x3C
*** [[J418AP|iPad8,10]]: 0x3E
** [[iPad Pro (12.9-inch) (4th generation)]]
*** [[J420AP|iPad8,11]]: 0x38
*** [[J421AP|iPad8,12]]: 0x3A
** [[iPad Air (3rd generation)]]
*** [[J217AP|iPad11,3]]: 0x1C
*** [[J218AP|iPad11,4]]: 0x1E
* [[List of iPad minis|iPad mini]]
** [[iPad mini]]
*** [[P105AP|iPad2,5]]: 0x0A
*** [[P106AP|iPad2,6]]: 0x0C
*** [[P107AP|iPad2,7]]: 0x0E
** [[iPad mini 2]]
*** [[J85AP|iPad4,4]]: 0x0A
*** [[J86AP|iPad4,5]]: 0x0C
*** [[J87AP|iPad4,6]]: 0x0E
** [[iPad mini 3]]
*** [[J85mAP|iPad4,7]]: 0x32
*** [[J86mAP|iPad4,8]]: 0x34
*** [[J87mAP|iPad4,9]]: 0x36
** [[iPad mini 4]]
*** [[J96AP|iPad5,1]]: 0x08
*** [[J97AP|iPad5,2]]: 0x0A
** [[iPad mini (5th generation)]]
*** [[J210AP|iPad11,1]]: 0x14
*** [[J211AP|iPad11,2]]: 0x16
* [[List of iPhones|iPhone]]
** [[M68AP|iPhone]]: 0x00
** [[N82AP|iPhone 3G]]: 0x04
** [[N88AP|iPhone 3GS]]: 0x00
** [[iPhone 4]]
*** [[N90AP|iPhone3,1]]: 0x00
*** [[N90BAP|iPhone3,2]]: 0x04
*** [[N92AP|iPhone3,3]]: 0x06
** [[N94AP|iPhone 4S]]: 0x08
** [[iPhone 5]]
*** [[N41AP|iPhone5,1]]: 0x00
*** [[N42AP|iPhone5,2]]: 0x02
** [[iPhone 5c]]
*** [[N48AP|iPhone5,3]]: 0x0A or 0x0B
*** [[N49AP|iPhone5,4]]: 0x0E
** [[iPhone 5s]]
*** [[N51AP|iPhone6,1]]: 0x00
*** [[N53AP|iPhone6,2]]: 0x02
** [[N61AP|iPhone 6]]: 0x06
** [[N56AP|iPhone 6 Plus]]: 0x04
** [[iPhone 6s]]: 0x04
** [[iPhone 6s Plus]]: 0x06
** [[iPhone SE (1st generation)]]: 0x02
** [[iPhone 7]]
*** [[D10AP|iPhone9,1]]: 0x08
*** [[D101AP|iPhone9,3]]: 0x0c
** [[iPhone 7 Plus]]
*** [[D11AP|iPhone9,2]]: 0x0a
*** [[D111AP|iPhone9,4]]: 0x0e
** [[iPhone 8]]
*** [[iPhone10,1]]: 0x02
*** [[iPhone10,4]]: 0x0A
** [[iPhone 8 Plus]]
*** [[iPhone10,2]]: 0x04
*** [[iPhone10,5]]: 0x0C
** [[iPhone X]]
*** [[D22AP|iPhone10,3]]: 0x06
*** [[D221AP|iPhone10,6]]: 0x0E
** [[N841AP|iPhone XR]]: 0x0C
** [[D321AP|iPhone XS]]: 0x0E
** [[iPhone XS Max]]
*** [[iPhone11,4]]: 0x0A
*** [[iPhone11,6]]: 0x1A
** [[N104AP|iPhone 11]]: 0x04
** [[D421AP|iPhone 11 Pro]]: 0x06
** [[D421AP|iPhone 11 Pro Max]]: 0x02
** [[D79AP|iPhone SE (2nd generation)]]: 0x10
* [[List of iPod touches|iPod touch]]
** [[N45AP|iPod touch]]: 0x02
** [[N72AP|iPod touch (2nd generation)]]: 0x00
** [[N18AP|iPod touch (3rd generation)]]: 0x02
** [[N81AP|iPod touch (4th generation)]]: 0x08
** [[iPod touch (5th generation)]]: 0x00
** [[N102AP|iPod touch (6th generation)]]: 0x10
** [[N112AP|iPod touch (7th generation)]]: 0x16

[[Category:Firmware Tags]]

Boot-args (iBoot variable)

2020-06-09T20:19:29Z

Vanished user 20210509: Reformatted into a table

These are boot arguments that the iOS [[kernel]] accepts. These can be booted with a patched [[iBoot]]; untethered [[BootROM]] jailbreaks such as [[redsn0w]] and [[checkra1n]] do this when you set custom boot-args.

= Known Boot Arguments =
{| class="wikitable"
|-
! boot-arg
! Values
! Description
! Notes
|-
| backlight-level=#
| <code>1</code>-<code>128</code>
| Set LCD backlight level
|
|-
| debug=#
| <code>0x09</code>: Kernel debugging
| Set kernel debug options
|
|-
| nand-enable-reformat=#
| <code>0</code>, <code>1</code>
| Set whether or not to reformat [[NAND]] when restoring
| Used when [[Restore Process|restoring]]
|-
| pmd=#.#
| Start/end address of ramdisk
| Specify a [[Ramdisk|ramdisk]] in memory to boot from
| Used in the [[Ramdisk Hack]]
|-
| -progress
| {{n/a}}
| Enable progress bar when restoring
| Used when [[Restore Process|restoring]]
|-
| rd=?
| <code>'md#'</code>
| Specify a [[Ramdisk|ramdisk]] to boot from
| Used when [[Restore Process|restoring]]
|-
| serial=#
| <code>3</code>: Debug output over serial
| Set serial debug options
| Same as <code>[[Debug-uarts (iBoot variable)|debug-uarts]]</code>
|-
| -v
| {{n/a}}
| Enable verbose booting
|
|-
|}

= See Also =
* [[Talk:Restore Mode]]

SDOM

2020-04-21T23:39:51Z

Vanished user 20210509: RXTC Security Domain

The '''SDOM''' ('''Security DOMain''') tag specifies the device that the firmware is supposed to be ran on. It allows Apple to make sure you are not running another device's firmware files on an incompatible device, probably to prevent using old exploits. It can be found next to the <code>ApSecurityDomain</code> in the BuildManifest.plist of an [[IPSW]]. Every production device has the value <code>kImage3SecurityDomainDarwin</code> (<code>0x01</code>). <code>kImage3SecurityDomainManufacturer</code> (<code>0x00</code>) and <code>kImage3SecurityDomainRtxc</code> (<code>0x03</code>) are unused in public builds.

{{stub|firmware}}
[[Category:Firmware Tags]]

Baseband Firmware

2020-04-20T23:32:32Z

Vanished user 20210509: MBN files into a table; reorganizing

The main instruction set of the [[Baseband Device|baseband]]. You can get these files from <code>/usr/local/standalone/firmware</code> on the corresponding firmware's [[Restore Ramdisk|restore ramdisk]] or from an [[IPSW File Format|IPSW]] under <code>/Firmware</code>.

The baseband version that comes with each iPhone firmware is listed on the [[firmware]] page and also on the [[X-Gold 608#Known_Firmware_Versions|X-Gold 608]] article for the [[N82AP|iPhone 3G]]/[[N88AP|iPhone 3GS]].

Baseband firmware files have been codenamed [[Trek-3.4.03|Trek]], ICE, and MAV.

== File Structure ==
The <code>.bbfw</code> file format is a ZIP archive containing <code>Info.plist</code>, <code>Options.plist</code>, and multiple firmware files. In the past, these were EEP and FLS files, the external EEPROM and firmware, respectively. In modern iOS versions, these are <code>.mbn</code> files.

For example, the [[N90AP|iPhone 4]] has a single baseband firmware file. The 4.0 baseband firmware filename is <code>ICE3_01.59.00_BOOT_02.06.Release.bbfw</code> and contains contains four baseband firmware files.

=== Known MBN Files ===
{|class="wikitable"
! Filename
! Purpose
|-
| acdb.mbn
|-
| apps.mbn
|-
| bbcfg.mbn
|-
| dsp3.mbn
|-
| mba.mbn
|-
| qdsp6sw.mbn
|-
| restoresbl1.mbn
|-
| rpm.mbn
|-
| sbl1.mbn
|-
| tz.mbn
|-
| wdt.mbn
|-
|}

=== Info.plist ===

The main identifying document for a given Baseband firmware is its <code>Info.plist</code>. This [[PList File Format|PList]] contains the Build, ChipID, RestoreSBLVersion, SBLVersion, and Baseband Version of the firmware.

==Other Links==
[http://www.deloware.com/iphone/doku.php?id=bbupdater bbupdater]

[[Category:Baseband]]

TYPE

2020-04-20T23:00:53Z

Vanished user 20210509:

The '''TYPE''' tag is a 32-bit unsigned integer (<code>uint32_t</code>) that, when viewed in little-endian format, states the type of firmware image the IMG2/[[IMG3 File Format|IMG3]]/[[IMG4 File Format|IMG4/IM4P]] file is. This value is passed to <code>load_selected_image</code> and then <code>[[Image load|image_load]]</code> early in the [[BootROM|SecureROM]] boot process, where a non-NULL pointer check is performed.

== Types ==
=== IMG2 ===
{|class="wikitable"
! Name
! Type
|-
| [[AppleLogo]]
| logo
|-
| [[BatteryCharging]]
| batC
|-
| [[BatteryLow0]]
| batl
|-
| [[BatteryLow1]]
| batL
|-
| [[DeviceTree]]
| dtre
|-
| [[iBoot (Bootloader)|iBoot]]
| ibot
|-
| [[LLB]]
| llbz
|-
| [[NeedService]]
| nsrv
|-
| [[RecoveryMode]]
| recm
|-
|}

=== IMG3+ ===
{|class="wikitable"
! Name
! Type
! Notes
|-
| Any
| <code>0x00</code>
| Represents ''any'' image type
|-
| ACIBT
| acib
| ACI Bluetooth
|-
| ACIWIFI
| aciw
| ACI WiFi
|-
| Alamo
| almo
|-
| ANE Firmware
| anef
|-
| AOP
| aopf
|-
| [[AppleLogo]]
| logo
|-
| Audio Codec Firmware
| acfw
|-
| AVE Firmware
| avef
|-
| [[BatteryCharging0]]
| chg0
| Charging indicator (bright)
|-
| [[BatteryCharging1]]
| chg1
| Charging Indicator (dim)
|-
| [[BatteryFull]]
| batF
|-
| [[BatteryLow0]]
| bat0
| Empty battery
|-
| [[BatteryLow1]]
| bat1
| Red composed onto empty battery
|-
| CFELoader
| cfel
| Silicon Validation <ref>[https://www.linkedin.com/jobs/view/silicon-validation-test-and-triage-engineer-at-apple-543262317 Job listing on LinkedIn]</ref> CFE loader
|-
| [[Dali]]
| dali
|-
| [[DeviceTree]]
| dtre
|-
| Diags
| diag
|-
| EngineeringTrustCache
| dtrs
|-
| Environment Variables
| ienv
|-
| FDR Trust Object for AP
| fdrt
|-
| FDR Trust Object for SEP
| fdrs
|-
| [[GlyphCharging]]
| glyC
|-
| [[GlyphPlugin]]
| glyP
|-
| GPU Firmware
| gfxf
|-
| Homer
| homr
|-
| Hypervisor
| hypr
|-
| [[iBEC]]
| ibec
|-
| [[iBoot (Bootloader)|iBoot]]
| ibot
|-
| iBootTest
| itst
|-
| [[iBSS]]
| ibss
|-
| Input Device
| ipdf
|-
| iSpoof(?)
| ispf
|-
| [[Kernelcache|KernelCache]]
| krnl
|-
| LeapHaptics
| lphp
|-
| [[LLB]]
| illb
|-
| LoadableTrustCache
| ltrs
|-
| LowPowerWallet0
| lpw0
|-
| LowPowerWallet1
| lpw1
|-
| LowPowerWallet2
| lpw2
|-
| Mac EFI
| mefi
|-
| [[Maggie Firmware]]
| magg
|-
| Multitouch Firmware
| mtfw
|-
| [[NeedService]]
| nsrv
|-
| OSRamdisk
| osrd
|-
| PEHammer
| hmmr
| [[PE]] Hammer test
|-
| PersonalizedDMG
| pdmg
|-
| PERTOS
| pert
| [[PE]] [https://en.wikipedia.org/wiki/Real-time_operating_system RTOS] environment
|-
| PHLEET
| phlt
| Silicon Validation PHLEET test
|-
| PMP
| pmpf
|-
| [[Restore Ramdisk|RestoreRamDisk]]
| rdsk
|-
| RBM
| rbmt
| Silicon Validation RBM test
|-
| [[RecoveryMode]]
| recm
|-
| RestoreDeviceTree
| rdtr
|-
| RestoreKernelCache
| rkrn
|-
| RestoreLogo
| rlgo
|-
| RestoreOS
| rosi
|-
| RestoreSEP
| rsep
| rsep is also present in [[sepboot]]
|-
| RestoreTrustCache
| rtsc
|-
| RTP
| rtpf
|-
| SCE
| scef
|-
| [[Secure Enclave Processor|SEP]]
| sepi
|-
| SmartIOFirmware
| siof
|-
| StaticTrustCache
| trst
|-
| System Locker
| lckr
|-
| TSYS Tester
| tsys
|-
| WCHFirmwareUpdater
| wchf
|-
| Wireless Charging
| wchf
|-
|}

== References ==
<references />

{{stub|firmware}}
[[Category:Firmware Tags]]

TYPE

2020-04-20T21:59:24Z

Vanished user 20210509: Reorganized into tables, updated information

The '''TYPE''' tag is a 32-bit unsigned integer (<code>uint32_t</code>) that, when viewed in little-endian format, states the type of firmware image the IMG2/[[IMG3 File Format|IMG3]]/[[IMG4 File Format|IMG4/IM4P]] file is. This type is passed to <code>load_selected_image</code> and then <code>[[Image load|image_load]]</code> early in the [[BootROM|SecureROM]] boot process, where a non-NULL pointer check is performed.

== Types ==
=== IMG2 ===
{|class="wikitable"
! Name
! Type
|-
| [[AppleLogo]]
| logo
|-
| [[BatteryCharging]]
| batC
|-
| [[BatteryLow0]]
| batl
|-
| [[BatteryLow1]]
| batL
|-
| [[DeviceTree]]
| dtre
|-
| [[iBoot (Bootloader)|iBoot]]
| ibot
|-
| [[LLB]]
| llbz
|-
| [[NeedService]]
| nsrv
|-
| [[RecoveryMode]]
| recm
|-
|}

=== IMG3+ ===
{|class="wikitable"
! Name
! Type
! Notes
|-
| Any
| <code>0x00</code>
| Represents ''any'' image type
|-
| ACIBT
| acib
| ACI Bluetooth
|-
| ACIWIFI
| aciw
| ACI WiFi
|-
| Alamo
| almo
|-
| ANE Firmware
| anef
|-
| AOP
| aopf
|-
| [[AppleLogo]]
| logo
|-
| Audio Codec Firmware
| acfw
|-
| AVE Firmware
| avef
|-
| [[BatteryCharging0]]
| chg0
| Charging indicator (bright)
|-
| [[BatteryCharging1]]
| chg1
| Charging Indicator (dim)
|-
| [[BatteryFull]]
| batF
|-
| [[BatteryLow0]]
| bat0
| Empty battery
|-
| [[BatteryLow1]]
| bat1
| Red composed onto empty battery
|-
| CFELoader
| cfel
| Silicon Validation <ref>[https://www.linkedin.com/jobs/view/silicon-validation-test-and-triage-engineer-at-apple-543262317 Job listing on LinkedIn]</ref> CFE loader
|-
| [[Dali]]
| dali
|-
| [[DeviceTree]]
| dtre
|-
| Diags
| diag
|-
| EngineeringTrustCache
| dtrs
|-
| Environment Variables
| ienv
|-
| FDR Trust Object for AP
| fdrt
|-
| FDR Trust Object for SEP
| fdrs
|-
| [[GlyphCharging]]
| glyC
|-
| [[GlyphPlugin]]
| glyP
|-
| GPU Firmware
| gfxf
|-
| Homer
| homr
|-
| Hypervisor
| hypr
|-
| [[iBEC]]
| ibec
|-
| [[iBoot (Bootloader)|iBoot]]
| ibot
|-
| iBootTest
| itst
|-
| [[iBSS]]
| ibss
|-
| Input Device
| ipdf
|-
| iSpoof(?)
| ispf
|-
| [[Kernelcache|KernelCache]]
| krnl
|-
| LeapHaptics
| lphp
|-
| [[LLB]]
| illb
|-
| LoadableTrustCache
| ltrs
|-
| LowPowerWallet0
| lpw0
|-
| LowPowerWallet1
| lpw1
|-
| LowPowerWallet2
| lpw2
|-
| Mac EFI
| mefi
|-
| [[Maggie Firmware]]
| magg
|-
| Multitouch Firmware
| mtfw
|-
| [[NeedService]]
| nsrv
|-
| OSRamdisk
| osrd
|-
| PEHammer
| hmmr
| [[PE]] Hammer test
|-
| PersonalizedDMG
| pdmg
|-
| PERTOS
| pert
| [[PE]] [https://en.wikipedia.org/wiki/Real-time_operating_system RTOS] environment
|-
| PHLEET
| phlt
| Silicon Validation PHLEET test
|-
| PMP
| pmpf
|-
| [[Restore Ramdisk|RestoreRamDisk]]
| rdsk
|-
| RBM
| rbmt
| Silicon Validation RBM test
|-
| [[RecoveryMode]]
| recm
|-
| RestoreDeviceTree
| rdtr
|-
| RestoreKernelCache
| rkrn
|-
| RestoreLogo
| rlgo
|-
| RestoreOS
| rosi
|-
| RestoreSEP
| rsep
| rsep is also present in [[sepboot]]
|-
| RestoreTrustCache
| rtsc
|-
| RTP
| rtpf
|-
| SCE
| scef
|-
| [[Secure Enclave Processor|SEP]]
| sepi
|-
| SmartIOFirmware
| siof
|-
| StaticTrustCache
| trst
|-
| System Locker
| lckr
|-
| TSYS Tester
| tsys
|-
| WCHFirmwareUpdater
| wchf
|-
| Wireless Charging
| wchf
|-
|}

== References ==
<references />

{{stub|firmware}}
[[Category:Firmware Tags]]

SHSH Protocol

2020-04-20T03:40:41Z

Vanished user 20210509: Revised HTTP headers... will revise again soon

Here is a description of the protocol that is used when [[iTunes]] requests the [[SHSH]] certificate from Apple. For details about what this is used for, please see the main article [[SHSH]].

This is a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] ([[wikipedia:POST (HTTP)|POST]]) request and answer. You can retry this via a [[wikipedia:Telnet|Telnet]] session or similar. The destination host is [http://gs.apple.com/TSS/controller?action=2 gs.apple.com] and runs on the common [[wikipedia:TCP and UDP port|port]] 80. The data is plaintext and not encoded in any way. For details about the [[wikipedia:Hypertext Transfer Protocol|HTTP]] protocol itself, please see [http://www.w3.org/Protocols/HTTP/1.1/rfc2616.pdf RFC2616].

== Communication ==

Reliable communication to the TSS server is best achieved with the following HTTP header configuration:

* <code>Proxy-Connection: Keep-Alive</code>
* <code>Pragma: no-cache</code>
* <code>Content-Type: text/xml; charset="utf-8"</code>

The following [https://curl.haxx.se/ curl] command demonstrates a command-line request to the server:

curl -i -s -m 1.0 -X POST -A "InetURL/1.0" -H "Proxy-Connection: Keep=Alive" -H "Pragma: no-cache" -H "Content-Type: text/xml; charset=\"utf-8\"" -d @/location/to/TSSRequest.xml gs.apple.com/TSS/controller?action=2

===Action types===
Attached to the http://gs.apple.com/TSS/controller URL is commonly <code>?action=2</code>, which can be discovered when performing an iTunes restore and observing packets sent with a packet sniffer such as [https://www.wireshark.org Wireshark]. However, values other than 2 may produce different server responses, of which all known value/response pairs have been listed below.

* <code>?action=0</code>: Performs a "Tatsu Signing Server HealthCheck", returning an HTML body of "Server not ready". This may be a general ping protocol for ensuring the TSS service is online.
* <code>?action=2</code>: Common SHSH protocol. See [[#Status responses]] for all known server responses.
* <code>?action=3</code>: Functionally the same as <code>?action=2</code>.
* <code>?action=5</code>: Generates <code>respCode</code> and <code>respMsg</code>. This response syntax differs slightly from the SHSH protocol. The name "cpsn" is referenced.

All unlisted action types appear to respond without HTML content, only status.

===Sending data (request)===
The request is actually a single XML-encoded property list. It contains a dictionary which describes the target iOS version, restore behavior, etc. Some of the required information can be taken from the BuildManifest.plist. BuildManifest contains some info about the firmware version and "BuildIdentities" dictionary. Inside it you can find two (or more?) build identities. Each of them contains the information which depends on every type of restore ("Erase" or "Update"). Some information is device-dependent (ECID, nonce) and is received from the device.

Request property list should have these properties:

* '''@APTicket:''' Optional boolean value. If true, the server adds an [[APTicket]] to the request.
* '''@BBTicket:''' Optional boolean value. The same for the [[BBTicket]].
* '''@UDID:''' Optional string value. Just request UDID (ex. D9C1F33D-62E0-4D25-8068-F5F46FE80057).
* '''@HostPlatformInfo:''' Optional string value. "mac" for OS X client, "windows" for Windows client (can be everything you want).
* '''@Locality:''' Optional string value. Language used for the error response (ex. "en_US").
* '''@VersionInfo:''' Optional string value. The version of 'libauthinstall' used (ex. "libauthinstall-391.0.0.1.3"). You can pass any string here.
* '''ApBoardID:''' Integer value. [[BORD |Board ID]] of the target device. You can take this value from build manifest.
* '''ApChipID:''' Integer value. [[CHIP|Chip ID]] of the target device. You can take this value from build manifest.
* '''ApECID:''' Integer value. [[ECID]] of the target device.
* '''ApNonce:''' Data value. The [[nonce]] generated by your device.
* '''ApProductionMode:''' Boolean value. Always true (unless your SOC is PROD 0 - Apple only).
* '''ApSecurityDomain:''' Integer value. The use is unknown. You can take this value from build manifest.
* '''UniqueBuildID:''' Optional data value. This is a unique identifier for every build (different even for "Erase" and "Update" types of restore). You can take this value from build manifest.

The SHSH request also contains information about files from the [[IPSW]] (or restore bundle for [[PurpleRestore]]). They can be obtained from the 'build identity' you've chosen in the previous step. Each 'build identity' contains a "Manifest" dictionary. It's entries look like
<key>BatteryCharging0</key>
<dict>
<key>Digest</key>
<nowiki><data>...</data></nowiki>
<key>Info</key>
<dict>...</dict>
<key>Trusted<key/>
<true/>
<dict/>
They are just copied to the SHSH request, but the "Info" dictionary is removed.
Example of a SHSH request (... values are identical, *** values are different per device):
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>@[[APTicket]]</key>
<true />
<key>@[[BBTicket]]</key>
<true />
<key>@HostPlatformInfo</key>
<string>mac</string>
<key>@Locality</key>
<string>en_US</string>
<key>@UUID</key>
<string>D9C1F33D-62E0-4D25-8068-F5F46FE80057</string>
<key>@VersionInfo</key>
<string>libauthinstall-391.0.0.1.3</string>
<key>[[BORD |ApBoardID]]</key>
<integer>10</integer>
<key>[[CHIP |ApChipID]]</key>
<integer>35152</integer>
<key>[[ECID |ApECID]]</key>
<integer>***</integer>
<key>[[Nonce |ApNonce]]</key>
<nowiki><data>***</data> </nowiki>
<key>ApProductionMode</key>
<true />
<key>ApSecurityDomain</key>
<integer>1</integer>
<key>UniqueBuildID</key>
<data> fqzW0B++Zdrs+PRwohkwU6prjbk=</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<nowiki><data> uH5QQax5YmIrgcuEHwOhAB//yc8=</data> </nowiki>
<key>Trusted</key>
<true />
</dict>
<key>BatteryCharging0</key>
<dict>
... See AppleLogo dictionary.
</dict>
<key>BatteryCharging1</key>
<dict>
...
</dict>
<key>BatteryFull</key>
<dict>
...
</dict>
<key>BatteryLow0</key>
<dict>
...
</dict>
<key>BatteryLow1</key>
<dict>
...
</dict>
<key>BatteryPlugin</key>
<dict>
...
</dict>
<key>DeviceTree</key>
<dict>
...
</dict>
<key>KernelCache</key>
<dict>
...
</dict>
<key>LLB</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhRAgC22ZPWJB9J1Nh3H+0XeyRTU72ObA==</data> </nowiki>
...
</dict>
<key>RecoveryMode</key>
<dict>
...
</dict>
<key>RestoreDeviceTree</key>
<dict>
...
</dict>
<key>RestoreKernelCache</key>
<dict>
...
</dict>
<key>RestoreLogo</key>
<dict>
...
</dict>
<key>RestoreRamDisk</key>
<dict>
...
</dict>
<key>[[iBEC]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
...
</dict>
<key>[[iBSS]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhBAQCRc2PuoresMjW7zNLePMPmX7zaHg==</data> </nowiki>
...
</dict>
<key>[[iBoot]]</key>
<dict>
...
</dict>
</dict>
</plist>

===Receiving data (answer)===
The response is a simple HTTP POST response, containing 3 values: STATUS, MESSAGE (a description string) and REQUEST_STRING (only if the request was successful). STATUS contains numeric status, MESSAGE contains an error message on error and "SUCCESS" string on success and REQUEST_STRING contains response property list encoded as XML.

===Status responses===
*'''STATUS=0&MESSAGE=SUCCESS'''
** The request was sent successfully, and a response was returned.'''
*'''STATUS=8&MESSAGE=An internal error occurred.'''
** A key contained an unknown name.
*'''STATUS=69&MESSAGE=This device isn't eligible for the requested build.'''
*'''STATUS=83&MESSAGE=An internal error occurred.'''
** A key was assigned an invalid value type.
*'''STATUS=92&MESSAGE=An internal error occurred.'''
** The request contained more than 65536 bytes.
*'''STATUS=93&MESSAGE=An internal error occurred.'''
** The request contained less than 10 bytes.
*'''STATUS=94&MESSAGE=This device isn't eligible for the requested build.'''
** The specified build is either unsigned or nonexistent.
*'''STATUS=98&MESSAGE=An internal error occurred.'''
** The XML/PList identification tag is missing or the start of the tag is malformed.
*'''STATUS=100&MESSAGE=An internal error occurred.'''
** A general XML error was found: the XML/PList version is nonexistent or not "1.0", the end of the XML/PList identification tag is malformed, an unknown or empty tag was found, the root <code><plist></code> tag is missing, no keys were found, a value tag contained an invalid type, an unescaped ampersand character was found, two consecutive dash characters were found in a comment, or a tag was found without its counterpart.
*'''STATUS=103&MESSAGE=An internal error occurred.'''
** Multiple '@' characters were found at the beginning of a key name.
*'''STATUS=128&MESSAGE=An internal error occurred.'''
*'''STATUS=131&MESSAGE=An internal error occurred.'''
** ''TBD: Something to do with <code>@APTicket</code>?''
*'''STATUS=132&MESSAGE=An internal error occurred.'''
*'''STATUS=133&MESSAGE=An internal error occurred.'''
** The <code>BbGoldCertId</code> key is missing in a Baseband install.
*'''STATUS=511&MESSAGE=No data in the request'''
*'''STATUS=551&MESSAGE=Error occured while importing config packet with cpsn: '''
*'''STATUS=5000&MESSAGE=Invalid Option!'''

===Notes===
* Interestingly, if all you're interested in is the ServerVersion (and a SUCCESS response), sending any one valid Ap-prefixed key will do, like so:
<?xml version="1.0"?>
<plist>
<dict>
<key>ApSecurityDomain</key>
<integer>1</integer>
</dict>
</plist>

* In regards to fuzzing and malformed data, the server (as of 2.1.0, at least) seems to have no bounds checking for the ApNonce, or even checking to see if the ApNonce exists. Because the APTicket changes even when specifying an invalid-sized nonce, it is assumed nonces too short are padded while nonces too large are ignored past the 16th character.

* Most textual characters between tags are ignored. For example, inserting non-bracket text (excluding XML special characters, such as '&') after a <code><dict></code> and before the following <code><key></code> will have no effect.

* A version string in the XML/Plist identification tag is '''required''', or a <code>STATUS=100</code> internal error message will result. Any encoding string provided is ignored and defaulted to (presumably) "UTF-8".

* The DOCTYPE tag is completely ignored. As such, specifying any non-PList DTD has no effect.

===Other parameters / open questions===
Some parameters could have other values. Not all details are known.
*ApSecurityDomain: Meaning? (Related to [[SDOM]] tag)
*Trusted: What is this for?
*Full description of the above values for UniqueBuildID, Digest, PartialDigest and BuildString.

==PartialDigest==
The PartialDigest is structured like so:

typedef struct PartialDigest {
uint32_t transformSize; // Always 0x40.
uint32_t img3DataSize; // data size of the img3.
uint8_t hash[SHA1HashSize]; // Result of SHA1ResultPartial from the stripped img3.
};

The img3 is first stripped of it's code signature (if present) and then passed through SHA1Update. SHA1ResultPartial is then performed. It is purposely not the final resulting SHA1. The reason for this being, when TSS processes the PartialDigest, it performs one more SHA1Update on the hash to include the [[ECID]] before doing SHA1Final and creating the SHSH blob.

Code for SHA1ResultPartial:
int SHA1ResultPartial(SHA1Context* ctx, unsigned char* buf) {
// Do we have valid buffer and context pointers?
if(ctx && buf) {
// Is the Context in good shape?
if(!ctx->Corrupted && !ctx->Computed && !ctx->Message_Block_Index) {
for(int i = 0; i < SHA1HashSize; i++) {
buf[i] = ctx->Intermediate_Hash[i >> 2] >> 8 * (3 - (i & 0x3));
}
return 0;
}
}
return 1;
}
Code for tss_strip_img3_signature:
int tss_strip_img3_signature(img3Header* img3, int* len) {
// Do we have a non-null ptr?
if(!img3) {
return 10004;
}
// Does the buffer start with the img3 magic?
if(img3->magic != IMG3_MAGIC) {
printf("tss_strip_img3_signature: bad magic 0x%08x expecting 0x%08x\n", img3->magic, IMG3_MAGIC);
return 10004;
}
// Sanity checks
if(img3->shshOffset > img3->dataSize) {
printf("tss_strip_img3_signature: signed length %u too large for buffer length %u\n", img3->shshOffset, img3->dataSize);
return 10004;
}
// Trim the image by adjusting the header.
if(img3->shshOffset) {
*len += img3->shshOffset - img3->dataSize;
img3->dataSize = img3->shshOffset;
img3->fullSize = *len;
}
return 0;
}

==Digest==
Digest is the SHA1 of the stripped img3. They are used instead of PartialDigests for the APTicket since the ticket is already personalized for the ECID and all other tags.

[[Category:Firmware Tags]]

Baseband Firmware

2020-04-18T21:05:12Z

Vanished user 20210509: More information on .bbfw

The main instruction set of the [[Baseband Device|baseband]]. You can get these files from <code>/usr/local/standalone/firmware</code> on the corresponding firmware's ramdisk or from an [[IPSW]] under <code>/Firmware</code>.

The baseband version that comes with each iPhone firmware is listed on the [[firmware]] page and also on the [[X-Gold 608#Known_Firmware_Versions|X-Gold 608]] article for the [[N82AP|iPhone 3G]]/[[N88AP|iPhone 3GS]].

== File Structure ==
The <code>.bbfw</code> file format is a ZIP archive containing <code>Info.plist</code>, <code>Options.plist</code>, and multiple firmware files. In the past, these were EEP and FLS files, the external EEPROM and firmware, respectively. In modern iOS versions, these are <code>.mbn</code> files. As of [[iOS]] version 4.2.1, the baseband version is now checked by iOS.

Some possible <code>.mbn</code> files include:
* acdb.mbn
* apps.mbn
* bbcfg.mbn
* mba.mbn
* qdsp6sw.mbn
* restoresbl1.mbn
* rpm.mbn
* sbl1.mbn
* tz.mbn

For example, the [[N90AP|iPhone 4]] has a single baseband firmware file. The 4.0 baseband firmware filename is <code>ICE3_01.59.00_BOOT_02.06.Release.bbfw</code> and contains contains four baseband firmware files.

<code>.bbfw</code> files have been codenamed [[Trek-3.4.03|Trek]], ICE, and Mav.

== Info.plist ==

The main identifying document for a given Baseband firmware is its <code>Info.plist</code>. This [[PList File Format|PList]] contains the Build, ChipID, RestoreSBLVersion, SBLVersion, and Baseband Version of the firmware.

==Other Links==
[http://www.deloware.com/iphone/doku.php?id=bbupdater bbupdater]

[[Category:Baseband]]

Secure Element

2020-04-18T20:43:13Z

Vanished user 20210509: Information about firmware packages

The '''Secure Element''' (or SE) is the NFC/ApplePay chip. This chip is codenamed '''Stockholm'''. Firmware packages for the chip are codenamed '''Icefall''' and use the <code>.sefw</code> file extension. Internally, the firmware packages seem to be divided into sections marked with the [https://en.wikipedia.org/wiki/Magic_number_(programming) magics] <code>SLALOM_PACKAGE</code>, <code>CRS_PACKAGE</code>, and <code>FTA_PACKAGE</code>.

Apple's description of ApplePay and the Secure element: https://support.apple.com/en-us/HT203027

{{stub|hardware}}

SEPO

2020-04-18T20:01:52Z

Vanished user 20210509: Reformatted into a table...

The '''SEPO''' ('''Security EPOch''') tag specifies the minimum Security Epoch required for the device to run the provided image. This allows Apple to prevent devices from running previously vulnerable loaders. An example of this is when Apple increased the SEPO on iPod touch (2nd generation) MC models in addition to patching [[0x24000 Segment Overflow]] to prevent the use of the [[ARM7_Go]] vulnerability from the 2.1.1 loaders.

== [[Application Processor|Processors]] ==
{| class="wikitable"
! [[CHIP|SoC]]
! Security Epoch
|-
| [[S5L8900]]
| 0x04
|-
| [[S5L8920]]
| 0x01 (later 0x02, then 0x04)
|-
| [[S5L8922]]
| 0x02
|-
| [[S5L8930]]
| 0x02
|-
| [[S5L8940]]
| 0x11
|-
| [[S5L8942]]
| 0x10
|-
| [[S5L8945]]
| 0x10
|-
| [[S5L8947]]
| 0x10
|-
| [[S5L8950]]
| 0x10
|-
| [[S5L8955]]
| 0x10
|-
| [[S5L8960]]
| ?
|-
| [[S5L8965]]
| ?
|-
| [[T7000]]
| ?
|-
| [[T7001]]
| ?
|-
| [[S7002]]
| ?
|-
| [[S8000]]
| ?
|-
| [[S8001]]
| ?
|-
| [[S8003]]
| ?
|-
| [[T8002]]
| ?
|-
| [[T8004]]
| ?
|-
| [[T8010]]
| 0x01
|-
| [[T8011]]
| ?
|-
| [[T8015]]
| ?
|-
| [[T8020]]
| ?
|-
| [[T8027]]
| ?
|-
| [[T8030]]
| ?
|}

{{stub|firmware}}
[[Category:Firmware Tags]]

BORD

2020-04-18T19:43:32Z

Vanished user 20210509: Added BDID characteristics. I would additionally change the long bulleted list to a wikitable, but I accidentally refreshed my page a few minutes ago while doing so, so I've lost all my motivation to that for the moment

The '''Board ID''' of a device (also known as '''BORD''', '''BDID''', or '''ApBoardId''') is a 6-bit value (although usually represented as <code>uint8_t</code>) that represents multiple characteristics of the logic board. In a BuildManifest, this value is found in the <code>ApBoardId</code> tag.

== Board ID Characteristics ==
The following table charts each of a Board ID's 6 bits to known board characteristics.

{| class="wikitable"
!
! Bit 5
! Bit 4
! Bit 3
! Bit 2
! Bit 1
! Bit 0
|-
! Meaning
| ?
| ?
| ?
| '''Eureka/Karoo'''
| '''Form Factor'''
| '''Production Type'''
|-
! Values
| ?
| ?
| ?
|
* <code>0</code>: Eureka
* <code>1</code>: Karoo
|
* <code>0</code>: Form Factor 'A'
* <code>1</code>: Form Factor 'B'
|
* <code>0</code>: Production (MLB)
* <code>1</code>: Development (DEV)
|}

== Devices ==
* [[List of AirPods|AirPods]]
** [[AirPods (1st generation)]]: N/A
** [[AirPods (2nd generation)]]: 0x12
* [[List of Apple TVs|Apple TV]]
** [[K66AP|Apple TV (2nd generation)]]: 0x10
** [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]: 0x08
** [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]: 0x00
** [[J42dAP|Apple TV (4th generation)]]: 0x34
** [[J105aAP|Apple TV 4K]]: 0x02
* [[Apple Watch (1st generation)]]
** [[N27aAP|Watch1,1]]: 0x02
** [[N28aAP|Watch1,2]]: 0x04
* [[Apple Watch Series 1]]
** [[N27dAP|Watch2,6]]: 0x02
** [[N28dAP|Watch2,7]]: 0x04
* [[Apple Watch Series 2]]
** [[N74AP|Watch2,3]]: 0x0C
** [[N75AP|Watch2,4]]: 0x0E
* [[Apple Watch Series 3]]
** [[N111sAP|Watch3,1]]: 0x1C
** [[N111bAP|Watch3,2]]: 0x1E
** [[N121sAP|Watch3,3]]: 0x18
** [[N121bAP|Watch3,4]]: 0x1A
* [[Apple Watch Series 4]]
** [[N131sAP|Watch4,1]]: 0x08
** [[N131bAP|Watch4,2]]: 0x0A
** [[N141sAP|Watch4,3]]: 0x0C
** [[N141bAP|Watch4,4]]: 0x0E
* [[Apple Watch Series 5]]
** [[N144sAP|Watch5,1]]: 0x10
** [[N144bAP|Watch5,2]]: 0x12
** [[N146sAP|Watch5,3]]: 0x14
** [[N146bAP|Watch5,4]]: 0x16
* [[HomePod]]
** [[B238aAP|AudioAccessory1,1]]: 0x38
** [[B238AP|AudioAccessory1,2]]: 0x1A
* [[List of iPads|iPad]]
** [[K48AP|iPad]]: 0x02
** [[iPad 2]]
*** [[K93AP|iPad2,1]]: 0x04
*** [[K94AP|iPad2,2]]: 0x06
*** [[K95AP|iPad2,3]]: 0x02
*** [[K93AAP|iPad2,4]]: 0x06
** [[iPad (3rd generation)]]
*** [[J1AP|iPad3,1]]: 0x00
*** [[J2AP|iPad3,2]]: 0x02
*** [[J2AAP|iPad3,3]]: 0x04
** [[iPad (4th generation)]]
*** [[P101AP|iPad3,4]]: 0x00
*** [[P102AP|iPad3,5]]: 0x02
*** [[P103AP|iPad3,6]]: 0x04
** [[iPad Air]]
*** [[J71AP|iPad4,1]]: 0x10
*** [[J72AP|iPad4,2]]: 0x12
*** [[J73AP|iPad4,3]]: 0x14
** [[iPad Air 2]]
*** [[J81AP|iPad5,3]]: 0x06
*** [[J82AP|iPad5,4]]: 0x02
** [[iPad Pro (12.9-inch)]]
*** [[J98aAP|iPad6,7]]: 0x10
*** [[J99aAP|iPad6,8]]: 0x12
** [[iPad Pro (9.7-inch)]]
*** [[J127AP|iPad6,3]]: 0x08
*** [[J128AP|iPad6,4]]: 0x0A
** [[iPad (5th generation)]]
*** [[iPad6,11]]: 0x10
*** [[iPad6,12]]: 0x12
** [[iPad Pro (12.9-inch) (2nd generation)]]
*** [[J120AP|iPad7,1]]: 0x0C
*** [[J121AP|iPad7,2]]: 0x0E
** [[iPad Pro (10.5-inch)]]
*** [[J207AP|iPad7,3]]: 0x04
*** [[J208AP|iPad7,4]]: 0x06
** [[iPad (6th generation)]]
*** [[J71bAP|iPad7,5]]: 0x18
*** [[J72bAP|iPad7,6]]: 0x1A
** [[iPad (7th generation)]]
*** [[J171AP|iPad7,11]]: 0x1C
*** [[J172AP|iPad7,12]]: 0x1E
** [[iPad Pro (11-inch)]]
*** [[J317AP|iPad8,1]]: 0x0C
*** [[J317xAP|iPad8,2]]: 0x1C
*** [[J318AP|iPad8,3]]: 0x0E
*** [[J318xAP|iPad8,4]]: 0x1E
** [[iPad Pro (12.9-inch) (3rd generation)]]
*** [[J320AP|iPad8,5]]: 0x08
*** [[J320xAP|iPad8,6]]: 0x18
*** [[J321AP|iPad8,7]]: 0x0A
*** [[J321xAP|iPad8,8]]: 0x1A
** [[iPad Pro (11-inch) (2nd generation)]]
*** [[J417AP|iPad8,9]]: 0x3C
*** [[J418AP|iPad8,10]]: 0x3E
** [[iPad Pro (12.9-inch) (4th generation)]]
*** [[J420AP|iPad8,11]]: 0x38
*** [[J421AP|iPad8,12]]: 0x3A
** [[iPad Air (3rd generation)]]
*** [[J217AP|iPad11,3]]: 0x1C
*** [[J218AP|iPad11,4]]: 0x1E
* [[List of iPad minis|iPad mini]]
** [[iPad mini]]
*** [[P105AP|iPad2,5]]: 0x0A
*** [[P106AP|iPad2,6]]: 0x0C
*** [[P107AP|iPad2,7]]: 0x0E
** [[iPad mini 2]]
*** [[J85AP|iPad4,4]]: 0x0A
*** [[J86AP|iPad4,5]]: 0x0C
*** [[J87AP|iPad4,6]]: 0x0E
** [[iPad mini 3]]
*** [[J85mAP|iPad4,7]]: 0x32
*** [[J86mAP|iPad4,8]]: 0x34
*** [[J87mAP|iPad4,9]]: 0x36
** [[iPad mini 4]]
*** [[J96AP|iPad5,1]]: 0x0A
*** [[J97AP|iPad5,2]]: 0x08
** [[iPad mini (5th generation)]]
*** [[J210AP|iPad11,1]]: 0x14
*** [[J211AP|iPad11,2]]: 0x16
* [[List of iPhones|iPhone]]
** [[M68AP|iPhone]]: 0x00
** [[N82AP|iPhone 3G]]: 0x04
** [[N88AP|iPhone 3GS]]: 0x00
** [[iPhone 4]]
*** [[N90AP|iPhone3,1]]: 0x00
*** [[N90BAP|iPhone3,2]]: 0x04
*** [[N92AP|iPhone3,3]]: 0x06
** [[N94AP|iPhone 4S]]: 0x08
** [[iPhone 5]]
*** [[N41AP|iPhone5,1]]: 0x02
*** [[N42AP|iPhone5,2]]: 0x00
** [[iPhone 5c]]
*** [[N48AP|iPhone5,3]]: 0x0A or 0x0B
*** [[N49AP|iPhone5,4]]: 0x0E
** [[iPhone 5s]]
*** [[N51AP|iPhone6,1]]: 0x00
*** [[N53AP|iPhone6,2]]: 0x02
** [[N61AP|iPhone 6]]: 0x06
** [[N56AP|iPhone 6 Plus]]: 0x04
** [[iPhone 6s]]: 0x04
** [[iPhone 6s Plus]]: 0x06
** [[iPhone SE]]: 0x02
** [[iPhone 7]]
*** [[D10AP|iPhone9,1]]: 0x08
*** [[D101AP|iPhone9,3]]: 0x0c
** [[iPhone 7 Plus]]
*** [[D11AP|iPhone9,2]]: 0x0a
*** [[D111AP|iPhone9,4]]: 0x0e
** [[iPhone 8]]
*** [[iPhone10,1]]: 0x02
*** [[iPhone10,4]]: 0x0A
** [[iPhone 8 Plus]]
*** [[iPhone10,2]]: 0x04
*** [[iPhone10,5]]: 0x0C
** [[iPhone X]]
*** [[D22AP|iPhone10,3]]: 0x06
*** [[D221AP|iPhone10,6]]: 0x0E
** [[N841AP|iPhone XR]]: 0x0C
** [[D321AP|iPhone XS]]: 0x0E
** [[iPhone XS Max]]
*** [[iPhone11,4]]: 0x0A
*** [[iPhone11,6]]: 0x1A
** [[N104AP|iPhone 11]]: 0x04
** [[D421AP|iPhone 11 Pro]]: 0x06
** [[D421AP|iPhone 11 Pro Max]]: 0x02
** [[D79AP|iPhone SE (2nd generation)]]: 0x10
* [[List of iPod touches|iPod touch]]
** [[N45AP|iPod touch]]: 0x02
** [[N72AP|iPod touch (2nd generation)]]: 0x00
** [[N18AP|iPod touch (3rd generation)]]: 0x02
** [[N81AP|iPod touch (4th generation)]]: 0x08
** [[iPod touch (5th generation)]]: 0x00
** [[N102AP|iPod touch (6th generation)]]: 0x10
** [[N112AP|iPod touch (7th generation)]]: 0x16

[[Category:Firmware Tags]]

DFU Mode

2020-04-18T18:35:47Z

Vanished user 20210509: GPIO pin information; creating GPIO soon...

'''DFU''' or '''Device Firmware Upgrade''' mode allows all devices to be restored from any state. It is essentially a mode where the BootROM can accept iBSS. DFU is part of the [[Bootrom|SecureROM]] which is burned into the hardware, so it cannot be removed. On A7+ devices, it generates an ApNonce and recognizes APTickets as well, so even in DFU, it can accept an APTicket.

== Entering DFU Mode ==
NOTE: If you are using a USB-C cable to enter DFU mode, it might not work. If this happens, you need to use the normal USB cable. You can use a normal USB cable and a USB to USB-C adaptor.
=== Apple TV ===
# Plug the device into your computer using a Micro-USB cable.
# Force the device to reboot by holding down the "Menu" and "Down" buttons simultaneously for 6-7 seconds.
# Press "Menu" and "Play" simultaneously right after reboot, until a message pops up in [[iTunes]], saying that it has detected an Apple TV in Recovery Mode.

=== A9 and older devices (iPad other than the ones listed below, iPhone 6s and below, iPhone SE and iPod touch 6 and below) ===
# Connect the device to a computer using a USB cable.
# Hold down both the Home button and Lock button.
# After 8 seconds, release the Lock button while continuing to hold down the Home button.
#* If the Apple logo appears, the Lock button was held down for too long.
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.

=== A10 devices (iPhone 7 and iPhone 7 Plus, iPad 2018, iPod touch 7) ===
# Connect the device to a computer using a USB cable.
# Hold down both the Side button and Volume Down button.
# After 8 seconds, release the Side button while continuing to hold down the Volume Down button.
#* If the Apple logo appears, the Side button was held down for too long.
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.

=== A11 and newer devices (iPhone 8 and above, iPad Pro 2018, iPad Air 2019, iPad Mini 2019) ===
# Connect the device to a computer using a USB cable.
# Quick-press the Volume Up button
# Quick-press the Volume Down button
# Hold down the Side button until the screen goes black, then hold down both the Side button and Volume Down button.
# After 5 seconds, release the Side button while continuing to hold down the Volume Down button.
#* If the Apple logo appears, the Side button was held down for too long.
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.

=== GPIO Pins ===
If you have access to the SoC, you can either perform the above methods for your device by utilizing the <code>GPIO_REQUEST_DFU1</code> and <code>GPIO_REQUEST_DFU2</code> GPIO pins (previously <code>HOLD_KEY</code> and <code>MENU_KEY</code> and corresponding to Power and Home/Vol-, respectively) or by setting your board's <code>GPIO_FORCE_DFU</code> pin to 1 at SecureROM startup (unless you are using an [[iFPGA]], where Force DFU mode is the default).

The corresponding GPIO pins for each SoC varies, and the most important ones (including the DFU pins) are listed on the [[GPIO]] page.

== Exiting DFU Mode ==
To exit DFU Mode, simply force restart your device.

* For Apple TV, hold down the "Menu" and "Down" buttons on your remote until the Apple TV reboots.
* For iPad, iPhone 6s and below, iPhone SE and iPod touch, hold the Home button and the Lock button until the device reboots.
* For iPhone 7 and iPhone 7 Plus, hold down the Side button and Volume Down button until the device reboots.
* For iPhone 8, iPhone 8 Plus, and iPhone X, quick-press the Volume Up button, then quick-press the Volume Down button, then hold down the Side button until the device reboots.

==Enter True Hardware DFU Mode Automatically==
The EnterDFU function in the [[MobileDevice Library]] does not enter the true DFU Mode in the hardware. It's possible to enter the true DFU Mode without doing it manually, but it cannot be exited unless a restore is performed, as it creates a [[DFU Loop]]. This doesn't work with [[S5L8900]] devices.

===Steps===
# Make a copy of a fresh IPSW file.
# Open the IPSW as a zip folder and browse to /firmware/all_flash/all_flash.xxxxx.production/
# Extract LLB.*****.RELEASE.img3/im4p and open it in a hex editor.
# Change some random bit or bits, it doesn't matter which or what you write.
# Add the edited file back to the zip, rename zip to ipsw and restore it to your device using iTunes.
# The restore will error out and your device will be in DFU Mode.

===Alternative Method===
If the previous method does not work for you, try this one.
# Do steps 1 and 2 from above.
# Delete LLB.*****.RELEASE.img3.
# Copy applelogo.********.img3 to temporary directory.
# Rename the copy of applelogo.********.img3/im4p to LLB.*****.RELEASE.img3/im4p. (If you forget the name of the LLB file, you can find it again in the file named manifest.)
# Copy the renamed applelogo file back to the all_flash.xxxxx.production directory.
# Rename the zip.
# Restore the file using iTunes. (If every thing goes well, you should receive an error 31 from iTunes.)

==DFU Mode Output to the computer==
<pre>iProduct: "Apple Mobile Device (DFU Mode)"</pre> <pre>iSerialNumber: "CPID:XXXX CPRV:15 CPFM:03 SCEP:03 BDID:00 ECID:XXXXXXXXXXXXXXXX SRTG:[iBoot-XXX.X.X]"</pre>

==Revisions==
===[[S5L8900]] (0x1222)===
This is the device ID in the [[N45AP|iPod touch]], the [[M68AP|iPhone]], and the [[N82AP|iPhone 3G]]. For more information about the protocol, see [[DFU 0x1222]].

===[[S5L8720 Bootrom|S5L8720]], [[S5L8920]], and [[WTF|WTF mode post-2.0]] (0x1227)===
This is the device ID in the [[N72AP|iPod touch (2nd generation)]], the [[N88AP|iPhone 3GS]], the [[N90AP|iPhone 4]], subsequent 32 bit devices, all 64 bit devices, and [[WTF|WTF mode]]. For more information on the protocol, see [[DFU 0x1227]].

[[Category:Bootrom]]

IFPGA

2020-04-18T18:28:48Z

Vanished user 20210509: Reorganized table, more FPGAs

{{lowercase}}
'''iFPGAs''' are Apple's internal [https://en.wikipedia.org/wiki/Field-programmable_gate_array field-programmable gate arrays] and are used for prototyping new device models before manufacturing.

== FastSim ==
A variant of iFPGA is called '''FastSim''', which is likely derived from "Fast Simulation". References to the "FastSim" name are scarce online, but one possible match for Apple's use of it is http://pages.cs.wisc.edu/~wwt/fastsim/index.html, which is a micro-architecture simulator.

== List of Known iFPGAs ==
''iFPGA devices with "sim" in the name are FastSim.''

{| class="wikitable"
|-
! SoC
! Device
! [[BORD]]
|-
| [[S7002]]
| s7002simdev
| 0xFD
|-
| rowspan="2" | [[S8000]]
| s8000simdev
| 0xFD
|-
| s8000fpgadev
| 0xFF
|-
| rowspan="2" | [[S8001]]
| s8001simdev
| 0xFD
|-
| s8001fpgadev
| 0xFF
|-
| rowspan="2" | [[S8003]]
| s8003simdev
| 0xFD
|-
| s8003fpgadev
| 0xFF
|-
| rowspan="2" | [[T8002]]
| t8002simdev
| 0x3D
|-
| t8002fpgadev
| 0x3F
|-
| rowspan="2" | [[T8004]]
| t8004simdev
| 0x3D
|-
| t8004fpgadev
| 0x3F
|-
| rowspan="2" | [[T8010]]
| t8010simdev
| 0xFD
|-
| t8010fpgadev
| 0xFF
|}

{{stub|hardware}}

IFPGA

2020-04-16T03:26:39Z

Vanished user 20210509: Add stub, list of iFPGAs

{{lowercase}}
'''iFPGAs''' are Apple's internal [https://en.wikipedia.org/wiki/Field-programmable_gate_array field-programmable gate arrays], which are used for prototyping new device models before manufacturing.

== FastSim ==
A variant of iFPGA is called '''FastSim''', which is likely derived from "Fast Simulation". References to the "FastSim" name are scarce online, but one possible match for Apple's use of it is http://pages.cs.wisc.edu/~wwt/fastsim/index.html, which is a micro-architecture simulator.

== List of Known iFPGAs ==

{| class="wikitable"
|-
! Device
! [[BORD]]
! FastSim?
|-
| s7002simdev
| 0x3D
| {{yes}}
|-
| s8001fpgadev
| 0xFF
| {{no}}
|-
| t8004simdev
| 0x3D
| {{yes}}
|-
| t8004fpgadev
| 0x3F
| {{no}}
|-
| t8010simdev
| 0xFD
| {{yes}}
|-
| t8010fpgadev
| 0xFF
| {{no}}
|}

{{stub|hardware}}

IFPGA

2020-04-16T03:01:50Z

Vanished user 20210509: Make lowercase

IFPGA

2020-04-16T03:01:03Z

Vanished user 20210509: Created page with "'''iFPGAs''' are Apple's internal [https://en.wikipedia.org/wiki/Field-programmable_gate_array field-programmable gate arrays], which are used for prototyping new device model..."

'''iFPGAs''' are Apple's internal [https://en.wikipedia.org/wiki/Field-programmable_gate_array field-programmable gate arrays], which are used for prototyping new device models before manufacturing.

== FastSim ==
A variant of iFPGA is called '''FastSim''', which is likely derived from "Fast Simulation". References to the "FastSim" name are scarce online, but one possible match for Apple's use of it is http://pages.cs.wisc.edu/~wwt/fastsim/index.html, which is a micro-architecture simulator.

SHSH Protocol

2020-04-11T02:06:04Z

Vanished user 20210509: Moar statuses

Here is a description of the protocol that is used when [[iTunes]] requests the [[SHSH]] certificate from Apple. For details about what this is used for, please see the main article [[SHSH]].

This is a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] ([[wikipedia:POST (HTTP)|POST]]) request and answer. You can retry this via a [[wikipedia:Telnet|Telnet]] session or similar. The destination host is [http://gs.apple.com/TSS/controller?action=2 gs.apple.com] and runs on the common [[wikipedia:TCP and UDP port|port]] 80. The data is plaintext and not encoded in any way. For details about the [[wikipedia:Hypertext Transfer Protocol|HTTP]] protocol itself, please see [http://www.w3.org/Protocols/HTTP/1.1/rfc2616.pdf RFC2616].

== Communication ==

Reliable communication to the TSS server is best achieved with the following HTTP header configuration:

* <code>Host: gs.apple.com</code>
* <code>User-Agent: InetURL/1.0</code>
* <code>Content-Type: text/xml</code>

The following [https://curl.haxx.se/ curl] command demonstrates a command-line request to the server:

curl -i -s -m 1.0 -A 'InetURL/1.0' -X POST -H 'Content-Type: text/xml' -H 'Host: gs.apple.com' -d @/location/to/my/request.xml gs.apple.com/TSS/controller?action=2

===Action types===
Attached to the http://gs.apple.com/TSS/controller URL is commonly <code>?action=2</code>, which can be discovered when performing an iTunes restore and observing packets sent with a packet sniffer such as [https://www.wireshark.org Wireshark]. However, values other than 2 may produce different server responses, of which all known value/response pairs have been listed below.

* <code>?action=0</code>: Performs a "Tatsu Signing Server HealthCheck", returning an HTML body of "Server not ready". This may be a general ping protocol for ensuring the TSS service is online.
* <code>?action=2</code>: Common SHSH protocol. See [[#Status responses]] for all known server responses.
* <code>?action=3</code>: Functionally the same as <code>?action=2</code>.
* <code>?action=5</code>: Generates <code>respCode</code> and <code>respMsg</code>. This response syntax differs slightly from the SHSH protocol. The name "cpsn" is referenced.

All unlisted action types appear to respond without HTML content, only status.

===Sending data (request)===
The request is actually a single XML-encoded property list. It contains a dictionary which describes the target iOS version, restore behavior, etc. Some of the required information can be taken from the BuildManifest.plist. BuildManifest contains some info about the firmware version and "BuildIdentities" dictionary. Inside it you can find two (or more?) build identities. Each of them contains the information which depends on every type of restore ("Erase" or "Update"). Some information is device-dependent (ECID, nonce) and is received from the device.

Request property list should have these properties:

* '''@APTicket:''' Optional boolean value. If true, the server adds an [[APTicket]] to the request.
* '''@BBTicket:''' Optional boolean value. The same for the [[BBTicket]].
* '''@UDID:''' Optional string value. Just request UDID (ex. D9C1F33D-62E0-4D25-8068-F5F46FE80057).
* '''@HostPlatformInfo:''' Optional string value. "mac" for OS X client, "windows" for Windows client (can be everything you want).
* '''@Locality:''' Optional string value. Language used for the error response (ex. "en_US").
* '''@VersionInfo:''' Optional string value. The version of 'libauthinstall' used (ex. "libauthinstall-391.0.0.1.3"). You can pass any string here.
* '''ApBoardID:''' Integer value. [[BORD |Board ID]] of the target device. You can take this value from build manifest.
* '''ApChipID:''' Integer value. [[CHIP|Chip ID]] of the target device. You can take this value from build manifest.
* '''ApECID:''' Integer value. [[ECID]] of the target device.
* '''ApNonce:''' Data value. The [[nonce]] generated by your device.
* '''ApProductionMode:''' Boolean value. Always true (unless your SOC is PROD 0 - Apple only).
* '''ApSecurityDomain:''' Integer value. The use is unknown. You can take this value from build manifest.
* '''UniqueBuildID:''' Optional data value. This is a unique identifier for every build (different even for "Erase" and "Update" types of restore). You can take this value from build manifest.

The SHSH request also contains information about files from the [[IPSW]] (or restore bundle for [[PurpleRestore]]). They can be obtained from the 'build identity' you've chosen in the previous step. Each 'build identity' contains a "Manifest" dictionary. It's entries look like
<key>BatteryCharging0</key>
<dict>
<key>Digest</key>
<nowiki><data>...</data></nowiki>
<key>Info</key>
<dict>...</dict>
<key>Trusted<key/>
<true/>
<dict/>
They are just copied to the SHSH request, but the "Info" dictionary is removed.
Example of a SHSH request (... values are identical, *** values are different per device):
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>@[[APTicket]]</key>
<true />
<key>@[[BBTicket]]</key>
<true />
<key>@HostPlatformInfo</key>
<string>mac</string>
<key>@Locality</key>
<string>en_US</string>
<key>@UUID</key>
<string>D9C1F33D-62E0-4D25-8068-F5F46FE80057</string>
<key>@VersionInfo</key>
<string>libauthinstall-391.0.0.1.3</string>
<key>[[BORD |ApBoardID]]</key>
<integer>10</integer>
<key>[[CHIP |ApChipID]]</key>
<integer>35152</integer>
<key>[[ECID |ApECID]]</key>
<integer>***</integer>
<key>[[Nonce |ApNonce]]</key>
<nowiki><data>***</data> </nowiki>
<key>ApProductionMode</key>
<true />
<key>ApSecurityDomain</key>
<integer>1</integer>
<key>UniqueBuildID</key>
<data> fqzW0B++Zdrs+PRwohkwU6prjbk=</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<nowiki><data> uH5QQax5YmIrgcuEHwOhAB//yc8=</data> </nowiki>
<key>Trusted</key>
<true />
</dict>
<key>BatteryCharging0</key>
<dict>
... See AppleLogo dictionary.
</dict>
<key>BatteryCharging1</key>
<dict>
...
</dict>
<key>BatteryFull</key>
<dict>
...
</dict>
<key>BatteryLow0</key>
<dict>
...
</dict>
<key>BatteryLow1</key>
<dict>
...
</dict>
<key>BatteryPlugin</key>
<dict>
...
</dict>
<key>DeviceTree</key>
<dict>
...
</dict>
<key>KernelCache</key>
<dict>
...
</dict>
<key>LLB</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhRAgC22ZPWJB9J1Nh3H+0XeyRTU72ObA==</data> </nowiki>
...
</dict>
<key>RecoveryMode</key>
<dict>
...
</dict>
<key>RestoreDeviceTree</key>
<dict>
...
</dict>
<key>RestoreKernelCache</key>
<dict>
...
</dict>
<key>RestoreLogo</key>
<dict>
...
</dict>
<key>RestoreRamDisk</key>
<dict>
...
</dict>
<key>[[iBEC]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
...
</dict>
<key>[[iBSS]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhBAQCRc2PuoresMjW7zNLePMPmX7zaHg==</data> </nowiki>
...
</dict>
<key>[[iBoot]]</key>
<dict>
...
</dict>
</dict>
</plist>

===Receiving data (answer)===
The response is a simple HTTP POST response, containing 3 values: STATUS, MESSAGE (a description string) and REQUEST_STRING (only if the request was successful). STATUS contains numeric status, MESSAGE contains an error message on error and "SUCCESS" string on success and REQUEST_STRING contains response property list encoded as XML.

===Status responses===
*'''STATUS=0&MESSAGE=SUCCESS'''
** The request was sent successfully, and a response was returned.'''
*'''STATUS=8&MESSAGE=An internal error occurred.'''
** A key contained an unknown name.
*'''STATUS=69&MESSAGE=This device isn't eligible for the requested build.'''
*'''STATUS=83&MESSAGE=An internal error occurred.'''
** A key was assigned an invalid value type.
*'''STATUS=92&MESSAGE=An internal error occurred.'''
** The request contained more than 65536 bytes.
*'''STATUS=93&MESSAGE=An internal error occurred.'''
** The request contained less than 10 bytes.
*'''STATUS=94&MESSAGE=This device isn't eligible for the requested build.'''
** The specified build is either unsigned or nonexistent.
*'''STATUS=98&MESSAGE=An internal error occurred.'''
** The XML/PList identification tag is missing or the start of the tag is malformed.
*'''STATUS=100&MESSAGE=An internal error occurred.'''
** A general XML error was found: the XML/PList version is nonexistent or not "1.0", the end of the XML/PList identification tag is malformed, an unknown or empty tag was found, the root <code><plist></code> tag is missing, no keys were found, a value tag contained an invalid type, an unescaped ampersand character was found, two consecutive dash characters were found in a comment, or a tag was found without its counterpart.
*'''STATUS=103&MESSAGE=An internal error occurred.'''
** Multiple '@' characters were found at the beginning of a key name.
*'''STATUS=128&MESSAGE=An internal error occurred.'''
*'''STATUS=131&MESSAGE=An internal error occurred.'''
** ''TBD: Something to do with <code>@APTicket</code>?''
*'''STATUS=132&MESSAGE=An internal error occurred.'''
*'''STATUS=133&MESSAGE=An internal error occurred.'''
** The <code>BbGoldCertId</code> key is missing in a Baseband install.
*'''STATUS=511&MESSAGE=No data in the request'''
*'''STATUS=551&MESSAGE=Error occured while importing config packet with cpsn: '''
*'''STATUS=5000&MESSAGE=Invalid Option!'''

===Notes===
* Interestingly, if all you're interested in is the ServerVersion (and a SUCCESS response), sending any one valid Ap-prefixed key will do, like so:
<?xml version="1.0"?>
<plist>
<dict>
<key>ApSecurityDomain</key>
<integer>1</integer>
</dict>
</plist>

* In regards to fuzzing and malformed data, the server (as of 2.1.0, at least) seems to have no bounds checking for the ApNonce, or even checking to see if the ApNonce exists. Because the APTicket changes even when specifying an invalid-sized nonce, it is assumed nonces too short are padded while nonces too large are ignored past the 16th character.

* Most textual characters between tags are ignored. For example, inserting non-bracket text (excluding XML special characters, such as '&') after a <code><dict></code> and before the following <code><key></code> will have no effect.

* A version string in the XML/Plist identification tag is '''required''', or a <code>STATUS=100</code> internal error message will result. Any encoding string provided is ignored and defaulted to (presumably) "UTF-8".

* The DOCTYPE tag is completely ignored. As such, specifying any non-PList DTD has no effect.

===Other parameters / open questions===
Some parameters could have other values. Not all details are known.
*ApSecurityDomain: Meaning? (Related to [[SDOM]] tag)
*Trusted: What is this for?
*Full description of the above values for UniqueBuildID, Digest, PartialDigest and BuildString.

==PartialDigest==
The PartialDigest is structured like so:

typedef struct PartialDigest {
uint32_t transformSize; // Always 0x40.
uint32_t img3DataSize; // data size of the img3.
uint8_t hash[SHA1HashSize]; // Result of SHA1ResultPartial from the stripped img3.
};

The img3 is first stripped of it's code signature (if present) and then passed through SHA1Update. SHA1ResultPartial is then performed. It is purposely not the final resulting SHA1. The reason for this being, when TSS processes the PartialDigest, it performs one more SHA1Update on the hash to include the [[ECID]] before doing SHA1Final and creating the SHSH blob.

Code for SHA1ResultPartial:
int SHA1ResultPartial(SHA1Context* ctx, unsigned char* buf) {
// Do we have valid buffer and context pointers?
if(ctx && buf) {
// Is the Context in good shape?
if(!ctx->Corrupted && !ctx->Computed && !ctx->Message_Block_Index) {
for(int i = 0; i < SHA1HashSize; i++) {
buf[i] = ctx->Intermediate_Hash[i >> 2] >> 8 * (3 - (i & 0x3));
}
return 0;
}
}
return 1;
}
Code for tss_strip_img3_signature:
int tss_strip_img3_signature(img3Header* img3, int* len) {
// Do we have a non-null ptr?
if(!img3) {
return 10004;
}
// Does the buffer start with the img3 magic?
if(img3->magic != IMG3_MAGIC) {
printf("tss_strip_img3_signature: bad magic 0x%08x expecting 0x%08x\n", img3->magic, IMG3_MAGIC);
return 10004;
}
// Sanity checks
if(img3->shshOffset > img3->dataSize) {
printf("tss_strip_img3_signature: signed length %u too large for buffer length %u\n", img3->shshOffset, img3->dataSize);
return 10004;
}
// Trim the image by adjusting the header.
if(img3->shshOffset) {
*len += img3->shshOffset - img3->dataSize;
img3->dataSize = img3->shshOffset;
img3->fullSize = *len;
}
return 0;
}

==Digest==
Digest is the SHA1 of the stripped img3. They are used instead of PartialDigests for the APTicket since the ticket is already personalized for the ECID and all other tags.

[[Category:Firmware Tags]]

SHSH Protocol

2020-04-10T23:25:24Z

Vanished user 20210509: Another status error

Here is a description of the protocol that is used when [[iTunes]] requests the [[SHSH]] certificate from Apple. For details about what this is used for, please see the main article [[SHSH]].

This is a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] ([[wikipedia:POST (HTTP)|POST]]) request and answer. You can retry this via a [[wikipedia:Telnet|Telnet]] session or similar. The destination host is [http://gs.apple.com/TSS/controller?action=2 gs.apple.com] and runs on the common [[wikipedia:TCP and UDP port|port]] 80. The data is plaintext and not encoded in any way. For details about the [[wikipedia:Hypertext Transfer Protocol|HTTP]] protocol itself, please see [http://www.w3.org/Protocols/HTTP/1.1/rfc2616.pdf RFC2616].

== Communication ==

Reliable communication to the TSS server is best achieved with the following HTTP header configuration:

* <code>Host: gs.apple.com</code>
* <code>User-Agent: InetURL/1.0</code>
* <code>Content-Type: text/xml</code>

The following [https://curl.haxx.se/ curl] command demonstrates a command-line request to the server:

curl -i -s -m 1.0 -A 'InetURL/1.0' -X POST -H 'Content-Type: text/xml' -H 'Host: gs.apple.com' -d @/location/to/my/request.xml gs.apple.com/TSS/controller?action=2

===Action types===
Attached to the http://gs.apple.com/TSS/controller URL is commonly <code>?action=2</code>, which can be discovered when performing an iTunes restore and observing packets sent with a packet sniffer such as [https://www.wireshark.org Wireshark]. However, values other than 2 may produce different server responses, of which all known value/response pairs have been listed below.

* <code>?action=0</code>: Performs a "Tatsu Signing Server HealthCheck", returning an HTML body of "Server not ready". This may be a general ping protocol for ensuring the TSS service is online.
* <code>?action=2</code>: Common SHSH protocol. See [[#Status responses]] for all known server responses.
* <code>?action=3</code>: Functionally the same as <code>?action=2</code>.
* <code>?action=5</code>: Generates <code>respCode</code> and <code>respMsg</code>. This response syntax differs slightly from the SHSH protocol. The name "cpsn" is referenced.

All unlisted action types appear to respond without HTML content, only status.

===Sending data (request)===
The request is actually a single XML-encoded property list. It contains a dictionary which describes the target iOS version, restore behavior, etc. Some of the required information can be taken from the BuildManifest.plist. BuildManifest contains some info about the firmware version and "BuildIdentities" dictionary. Inside it you can find two (or more?) build identities. Each of them contains the information which depends on every type of restore ("Erase" or "Update"). Some information is device-dependent (ECID, nonce) and is received from the device.

Request property list should have these properties:

* '''@APTicket:''' Optional boolean value. If true, the server adds an [[APTicket]] to the request.
* '''@BBTicket:''' Optional boolean value. The same for the [[BBTicket]].
* '''@UDID:''' Optional string value. Just request UDID (ex. D9C1F33D-62E0-4D25-8068-F5F46FE80057).
* '''@HostPlatformInfo:''' Optional string value. "mac" for OS X client, "windows" for Windows client (can be everything you want).
* '''@Locality:''' Optional string value. Language used for the error response (ex. "en_US").
* '''@VersionInfo:''' Optional string value. The version of 'libauthinstall' used (ex. "libauthinstall-391.0.0.1.3"). You can pass any string here.
* '''ApBoardID:''' Integer value. [[BORD |Board ID]] of the target device. You can take this value from build manifest.
* '''ApChipID:''' Integer value. [[CHIP|Chip ID]] of the target device. You can take this value from build manifest.
* '''ApECID:''' Integer value. [[ECID]] of the target device.
* '''ApNonce:''' Data value. The [[nonce]] generated by your device.
* '''ApProductionMode:''' Boolean value. Always true (unless your SOC is PROD 0 - Apple only).
* '''ApSecurityDomain:''' Integer value. The use is unknown. You can take this value from build manifest.
* '''UniqueBuildID:''' Optional data value. This is a unique identifier for every build (different even for "Erase" and "Update" types of restore). You can take this value from build manifest.

The SHSH request also contains information about files from the [[IPSW]] (or restore bundle for [[PurpleRestore]]). They can be obtained from the 'build identity' you've chosen in the previous step. Each 'build identity' contains a "Manifest" dictionary. It's entries look like
<key>BatteryCharging0</key>
<dict>
<key>Digest</key>
<nowiki><data>...</data></nowiki>
<key>Info</key>
<dict>...</dict>
<key>Trusted<key/>
<true/>
<dict/>
They are just copied to the SHSH request, but the "Info" dictionary is removed.
Example of a SHSH request (... values are identical, *** values are different per device):
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>@[[APTicket]]</key>
<true />
<key>@[[BBTicket]]</key>
<true />
<key>@HostPlatformInfo</key>
<string>mac</string>
<key>@Locality</key>
<string>en_US</string>
<key>@UUID</key>
<string>D9C1F33D-62E0-4D25-8068-F5F46FE80057</string>
<key>@VersionInfo</key>
<string>libauthinstall-391.0.0.1.3</string>
<key>[[BORD |ApBoardID]]</key>
<integer>10</integer>
<key>[[CHIP |ApChipID]]</key>
<integer>35152</integer>
<key>[[ECID |ApECID]]</key>
<integer>***</integer>
<key>[[Nonce |ApNonce]]</key>
<nowiki><data>***</data> </nowiki>
<key>ApProductionMode</key>
<true />
<key>ApSecurityDomain</key>
<integer>1</integer>
<key>UniqueBuildID</key>
<data> fqzW0B++Zdrs+PRwohkwU6prjbk=</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<nowiki><data> uH5QQax5YmIrgcuEHwOhAB//yc8=</data> </nowiki>
<key>Trusted</key>
<true />
</dict>
<key>BatteryCharging0</key>
<dict>
... See AppleLogo dictionary.
</dict>
<key>BatteryCharging1</key>
<dict>
...
</dict>
<key>BatteryFull</key>
<dict>
...
</dict>
<key>BatteryLow0</key>
<dict>
...
</dict>
<key>BatteryLow1</key>
<dict>
...
</dict>
<key>BatteryPlugin</key>
<dict>
...
</dict>
<key>DeviceTree</key>
<dict>
...
</dict>
<key>KernelCache</key>
<dict>
...
</dict>
<key>LLB</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhRAgC22ZPWJB9J1Nh3H+0XeyRTU72ObA==</data> </nowiki>
...
</dict>
<key>RecoveryMode</key>
<dict>
...
</dict>
<key>RestoreDeviceTree</key>
<dict>
...
</dict>
<key>RestoreKernelCache</key>
<dict>
...
</dict>
<key>RestoreLogo</key>
<dict>
...
</dict>
<key>RestoreRamDisk</key>
<dict>
...
</dict>
<key>[[iBEC]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
...
</dict>
<key>[[iBSS]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhBAQCRc2PuoresMjW7zNLePMPmX7zaHg==</data> </nowiki>
...
</dict>
<key>[[iBoot]]</key>
<dict>
...
</dict>
</dict>
</plist>

===Receiving data (answer)===
The response is a simple HTTP POST response, containing 3 values: STATUS, MESSAGE (a description string) and REQUEST_STRING (only if the request was successful). STATUS contains numeric status, MESSAGE contains an error message on error and "SUCCESS" string on success and REQUEST_STRING contains response property list encoded as XML.

===Status responses===
*'''STATUS=0&MESSAGE=SUCCESS'''
** The request was sent successfully, and a response was returned.'''
*'''STATUS=8&MESSAGE=An internal error occurred.'''
** A key contained an unknown name.
*'''STATUS=69&MESSAGE=This device isn't eligible for the requested build.'''
*'''STATUS=83&MESSAGE=An internal error occurred.'''
** A key was assigned an invalid value type.
*'''STATUS=92&MESSAGE=An internal error occurred.'''
** The request contained more than 65536 bytes.
*'''STATUS=93&MESSAGE=An internal error occurred.'''
** The request contained less than 10 bytes.
*'''STATUS=94&MESSAGE=This device isn't eligible for the requested build.'''
** The specified build is either unsigned or nonexistent.
*'''STATUS=98&MESSAGE=An internal error occurred.'''
** The XML/PList identification tag is missing or the start of the tag is malformed.
*'''STATUS=100&MESSAGE=An internal error occurred.'''
** A general XML error was found: the XML/PList version is nonexistent or not "1.0", the end of the XML/PList identification tag is malformed, an unknown or empty tag was found, the root <code><plist></code> tag is missing, no keys were found, a value tag contained an invalid type, an unescaped ampersand character was found, two consecutive dash characters were found in a comment, or a tag was found without its counterpart.
*'''STATUS=103&MESSAGE=An internal error occurred.'''
** Multiple '@' characters were found at the beginning of a key name.
*'''STATUS=128&MESSAGE=An internal error occurred.'''
*'''STATUS=131&MESSAGE=An internal error occurred.'''
** ''TBD: Something to do with @APTicket?''
*'''STATUS=132&MESSAGE=An internal error occurred.'''
*'''STATUS=511&MESSAGE=No data in the request'''
*'''STATUS=551&MESSAGE=Error occured while importing config packet with cpsn: '''
*'''STATUS=5000&MESSAGE=Invalid Option!'''

===Notes===
* Interestingly, if all you're interested in is the ServerVersion (and a SUCCESS response), sending any one valid Ap-prefixed key will do, like so:
<?xml version="1.0"?>
<plist>
<dict>
<key>ApSecurityDomain</key>
<integer>1</integer>
</dict>
</plist>

* In regards to fuzzing and malformed data, the server (as of 2.1.0, at least) seems to have no bounds checking for the ApNonce, or even checking to see if the ApNonce exists. Because the APTicket changes even when specifying an invalid-sized nonce, it is assumed nonces too short are padded while nonces too large are ignored past the 16th character.

* Most textual characters between tags are ignored. For example, inserting non-bracket text (excluding XML special characters, such as '&') after a <code><dict></code> and before the following <code><key></code> will have no effect.

* A version string in the XML/Plist identification tag is '''required''', or a <code>STATUS=100</code> internal error message will result. Any encoding string provided is ignored and defaulted to (presumably) "UTF-8".

* The DOCTYPE tag is completely ignored. As such, specifying any non-PList DTD has no effect.

===Other parameters / open questions===
Some parameters could have other values. Not all details are known.
*ApSecurityDomain: Meaning? (Related to [[SDOM]] tag)
*Trusted: What is this for?
*Full description of the above values for UniqueBuildID, Digest, PartialDigest and BuildString.

==PartialDigest==
The PartialDigest is structured like so:

typedef struct PartialDigest {
uint32_t transformSize; // Always 0x40.
uint32_t img3DataSize; // data size of the img3.
uint8_t hash[SHA1HashSize]; // Result of SHA1ResultPartial from the stripped img3.
};

The img3 is first stripped of it's code signature (if present) and then passed through SHA1Update. SHA1ResultPartial is then performed. It is purposely not the final resulting SHA1. The reason for this being, when TSS processes the PartialDigest, it performs one more SHA1Update on the hash to include the [[ECID]] before doing SHA1Final and creating the SHSH blob.

Code for SHA1ResultPartial:
int SHA1ResultPartial(SHA1Context* ctx, unsigned char* buf) {
// Do we have valid buffer and context pointers?
if(ctx && buf) {
// Is the Context in good shape?
if(!ctx->Corrupted && !ctx->Computed && !ctx->Message_Block_Index) {
for(int i = 0; i < SHA1HashSize; i++) {
buf[i] = ctx->Intermediate_Hash[i >> 2] >> 8 * (3 - (i & 0x3));
}
return 0;
}
}
return 1;
}
Code for tss_strip_img3_signature:
int tss_strip_img3_signature(img3Header* img3, int* len) {
// Do we have a non-null ptr?
if(!img3) {
return 10004;
}
// Does the buffer start with the img3 magic?
if(img3->magic != IMG3_MAGIC) {
printf("tss_strip_img3_signature: bad magic 0x%08x expecting 0x%08x\n", img3->magic, IMG3_MAGIC);
return 10004;
}
// Sanity checks
if(img3->shshOffset > img3->dataSize) {
printf("tss_strip_img3_signature: signed length %u too large for buffer length %u\n", img3->shshOffset, img3->dataSize);
return 10004;
}
// Trim the image by adjusting the header.
if(img3->shshOffset) {
*len += img3->shshOffset - img3->dataSize;
img3->dataSize = img3->shshOffset;
img3->fullSize = *len;
}
return 0;
}

==Digest==
Digest is the SHA1 of the stripped img3. They are used instead of PartialDigests for the APTicket since the ticket is already personalized for the ECID and all other tags.

[[Category:Firmware Tags]]

SHSH Protocol

2020-04-10T21:02:59Z

Vanished user 20210509: Added new error status

Here is a description of the protocol that is used when [[iTunes]] requests the [[SHSH]] certificate from Apple. For details about what this is used for, please see the main article [[SHSH]].

This is a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] ([[wikipedia:POST (HTTP)|POST]]) request and answer. You can retry this via a [[wikipedia:Telnet|Telnet]] session or similar. The destination host is [http://gs.apple.com/TSS/controller?action=2 gs.apple.com] and runs on the common [[wikipedia:TCP and UDP port|port]] 80. The data is plaintext and not encoded in any way. For details about the [[wikipedia:Hypertext Transfer Protocol|HTTP]] protocol itself, please see [http://www.w3.org/Protocols/HTTP/1.1/rfc2616.pdf RFC2616].

== Communication ==

Reliable communication to the TSS server is best achieved with the following HTTP header configuration:

* <code>Host: gs.apple.com</code>
* <code>User-Agent: InetURL/1.0</code>
* <code>Content-Type: text/xml</code>

The following [https://curl.haxx.se/ curl] command demonstrates a command-line request to the server:

curl -i -s -m 1.0 -A 'InetURL/1.0' -X POST -H 'Content-Type: text/xml' -H 'Host: gs.apple.com' -d @/location/to/my/request.xml gs.apple.com/TSS/controller?action=2

===Action types===
Attached to the http://gs.apple.com/TSS/controller URL is commonly <code>?action=2</code>, which can be discovered when performing an iTunes restore and observing packets sent with a packet sniffer such as [https://www.wireshark.org Wireshark]. However, values other than 2 may produce different server responses, of which all known value/response pairs have been listed below.

* <code>?action=0</code>: Performs a "Tatsu Signing Server HealthCheck", returning an HTML body of "Server not ready". This may be a general ping protocol for ensuring the TSS service is online.
* <code>?action=2</code>: Common SHSH protocol. See [[#Status responses]] for all known server responses.
* <code>?action=3</code>: Functionally the same as <code>?action=2</code>.
* <code>?action=5</code>: Generates <code>respCode</code> and <code>respMsg</code>. This response syntax differs slightly from the SHSH protocol. The name "cpsn" is referenced.

All unlisted action types appear to respond without HTML content, only status.

===Sending data (request)===
The request is actually a single XML-encoded property list. It contains a dictionary which describes the target iOS version, restore behavior, etc. Some of the required information can be taken from the BuildManifest.plist. BuildManifest contains some info about the firmware version and "BuildIdentities" dictionary. Inside it you can find two (or more?) build identities. Each of them contains the information which depends on every type of restore ("Erase" or "Update"). Some information is device-dependent (ECID, nonce) and is received from the device.

Request property list should have these properties:

* '''@APTicket:''' Optional boolean value. If true, the server adds an [[APTicket]] to the request.
* '''@BBTicket:''' Optional boolean value. The same for the [[BBTicket]].
* '''@UDID:''' Optional string value. Just request UDID (ex. D9C1F33D-62E0-4D25-8068-F5F46FE80057).
* '''@HostPlatformInfo:''' Optional string value. "mac" for OS X client, "windows" for Windows client (can be everything you want).
* '''@Locality:''' Optional string value. Language used for the error response (ex. "en_US").
* '''@VersionInfo:''' Optional string value. The version of 'libauthinstall' used (ex. "libauthinstall-391.0.0.1.3"). You can pass any string here.
* '''ApBoardID:''' Integer value. [[BORD |Board ID]] of the target device. You can take this value from build manifest.
* '''ApChipID:''' Integer value. [[CHIP|Chip ID]] of the target device. You can take this value from build manifest.
* '''ApECID:''' Integer value. [[ECID]] of the target device.
* '''ApNonce:''' Data value. The [[nonce]] generated by your device.
* '''ApProductionMode:''' Boolean value. Always true (unless your SOC is PROD 0 - Apple only).
* '''ApSecurityDomain:''' Integer value. The use is unknown. You can take this value from build manifest.
* '''UniqueBuildID:''' Optional data value. This is a unique identifier for every build (different even for "Erase" and "Update" types of restore). You can take this value from build manifest.

The SHSH request also contains information about files from the [[IPSW]] (or restore bundle for [[PurpleRestore]]). They can be obtained from the 'build identity' you've chosen in the previous step. Each 'build identity' contains a "Manifest" dictionary. It's entries look like
<key>BatteryCharging0</key>
<dict>
<key>Digest</key>
<nowiki><data>...</data></nowiki>
<key>Info</key>
<dict>...</dict>
<key>Trusted<key/>
<true/>
<dict/>
They are just copied to the SHSH request, but the "Info" dictionary is removed.
Example of a SHSH request (... values are identical, *** values are different per device):
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>@[[APTicket]]</key>
<true />
<key>@[[BBTicket]]</key>
<true />
<key>@HostPlatformInfo</key>
<string>mac</string>
<key>@Locality</key>
<string>en_US</string>
<key>@UUID</key>
<string>D9C1F33D-62E0-4D25-8068-F5F46FE80057</string>
<key>@VersionInfo</key>
<string>libauthinstall-391.0.0.1.3</string>
<key>[[BORD |ApBoardID]]</key>
<integer>10</integer>
<key>[[CHIP |ApChipID]]</key>
<integer>35152</integer>
<key>[[ECID |ApECID]]</key>
<integer>***</integer>
<key>[[Nonce |ApNonce]]</key>
<nowiki><data>***</data> </nowiki>
<key>ApProductionMode</key>
<true />
<key>ApSecurityDomain</key>
<integer>1</integer>
<key>UniqueBuildID</key>
<data> fqzW0B++Zdrs+PRwohkwU6prjbk=</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<nowiki><data> uH5QQax5YmIrgcuEHwOhAB//yc8=</data> </nowiki>
<key>Trusted</key>
<true />
</dict>
<key>BatteryCharging0</key>
<dict>
... See AppleLogo dictionary.
</dict>
<key>BatteryCharging1</key>
<dict>
...
</dict>
<key>BatteryFull</key>
<dict>
...
</dict>
<key>BatteryLow0</key>
<dict>
...
</dict>
<key>BatteryLow1</key>
<dict>
...
</dict>
<key>BatteryPlugin</key>
<dict>
...
</dict>
<key>DeviceTree</key>
<dict>
...
</dict>
<key>KernelCache</key>
<dict>
...
</dict>
<key>LLB</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhRAgC22ZPWJB9J1Nh3H+0XeyRTU72ObA==</data> </nowiki>
...
</dict>
<key>RecoveryMode</key>
<dict>
...
</dict>
<key>RestoreDeviceTree</key>
<dict>
...
</dict>
<key>RestoreKernelCache</key>
<dict>
...
</dict>
<key>RestoreLogo</key>
<dict>
...
</dict>
<key>RestoreRamDisk</key>
<dict>
...
</dict>
<key>[[iBEC]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
...
</dict>
<key>[[iBSS]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhBAQCRc2PuoresMjW7zNLePMPmX7zaHg==</data> </nowiki>
...
</dict>
<key>[[iBoot]]</key>
<dict>
...
</dict>
</dict>
</plist>

===Receiving data (answer)===
The response is a simple HTTP POST response, containing 3 values: STATUS, MESSAGE (a description string) and REQUEST_STRING (only if the request was successful). STATUS contains numeric status, MESSAGE contains an error message on error and "SUCCESS" string on success and REQUEST_STRING contains response property list encoded as XML.

===Status responses===
*'''STATUS=0&MESSAGE=SUCCESS'''
** The request was sent successfully, and a response was returned.'''
*'''STATUS=8&MESSAGE=An internal error occurred.'''
** A key contained an unknown name.
*'''STATUS=83&MESSAGE=An internal error occurred.'''
** A key was assigned an invalid value type.
*'''STATUS=92&MESSAGE=An internal error occurred.'''
** The request contained more than 65536 bytes.
*'''STATUS=93&MESSAGE=An internal error occurred.'''
** The request contained less than 10 bytes.
*'''STATUS=94&MESSAGE=This device isn't eligible for the requested build.'''
** The specified build is either unsigned or nonexistent.
*'''STATUS=98&MESSAGE=An internal error occurred.'''
** The XML/PList identification tag is missing or the start of the tag is malformed.
*'''STATUS=100&MESSAGE=An internal error occurred.'''
** A general XML error was found: the XML/PList version is nonexistent or not "1.0", the end of the XML/PList identification tag is malformed, an unknown or empty tag was found, the root <code><plist></code> tag is missing, no keys were found, a value tag contained an invalid type, an unescaped ampersand character was found, two consecutive dash characters were found in a comment, or a tag was found without its counterpart.
*'''STATUS=103&MESSAGE=An internal error occurred.'''
** Multiple '@' characters were found at the beginning of a key name.
*'''STATUS=128&MESSAGE=An internal error occurred.'''
*'''STATUS=131&MESSAGE=An internal error occurred.'''
*'''STATUS=511&MESSAGE=No data in the request'''
*'''STATUS=551&MESSAGE=Error occured while importing config packet with cpsn: '''
*'''STATUS=5000&MESSAGE=Invalid Option!'''

===Notes===
* Interestingly, if all you're interested in is the ServerVersion (and a SUCCESS response), sending any one valid Ap-prefixed key will do, like so:
<?xml version="1.0"?>
<plist>
<dict>
<key>ApSecurityDomain</key>
<integer>1</integer>
</dict>
</plist>

* In regards to fuzzing and malformed data, the server (as of 2.1.0, at least) seems to have no bounds checking for the ApNonce, or even checking to see if the ApNonce exists. Because the APTicket changes even when specifying an invalid-sized nonce, it is assumed nonces too short are padded while nonces too large are ignored past the 16th character.

* Most textual characters between tags are ignored. For example, inserting non-bracket text (excluding XML special characters, such as '&') after a <code><dict></code> and before the following <code><key></code> will have no effect.

* A version string in the XML/Plist identification tag is '''required''', or a <code>STATUS=100</code> internal error message will result. Any encoding string provided is ignored and defaulted to (presumably) "UTF-8".

* The DOCTYPE tag is completely ignored. As such, specifying any non-PList DTD has no effect.

===Other parameters / open questions===
Some parameters could have other values. Not all details are known.
*ApSecurityDomain: Meaning? (Related to [[SDOM]] tag)
*Trusted: What is this for?
*Full description of the above values for UniqueBuildID, Digest, PartialDigest and BuildString.

==PartialDigest==
The PartialDigest is structured like so:

typedef struct PartialDigest {
uint32_t transformSize; // Always 0x40.
uint32_t img3DataSize; // data size of the img3.
uint8_t hash[SHA1HashSize]; // Result of SHA1ResultPartial from the stripped img3.
};

The img3 is first stripped of it's code signature (if present) and then passed through SHA1Update. SHA1ResultPartial is then performed. It is purposely not the final resulting SHA1. The reason for this being, when TSS processes the PartialDigest, it performs one more SHA1Update on the hash to include the [[ECID]] before doing SHA1Final and creating the SHSH blob.

Code for SHA1ResultPartial:
int SHA1ResultPartial(SHA1Context* ctx, unsigned char* buf) {
// Do we have valid buffer and context pointers?
if(ctx && buf) {
// Is the Context in good shape?
if(!ctx->Corrupted && !ctx->Computed && !ctx->Message_Block_Index) {
for(int i = 0; i < SHA1HashSize; i++) {
buf[i] = ctx->Intermediate_Hash[i >> 2] >> 8 * (3 - (i & 0x3));
}
return 0;
}
}
return 1;
}
Code for tss_strip_img3_signature:
int tss_strip_img3_signature(img3Header* img3, int* len) {
// Do we have a non-null ptr?
if(!img3) {
return 10004;
}
// Does the buffer start with the img3 magic?
if(img3->magic != IMG3_MAGIC) {
printf("tss_strip_img3_signature: bad magic 0x%08x expecting 0x%08x\n", img3->magic, IMG3_MAGIC);
return 10004;
}
// Sanity checks
if(img3->shshOffset > img3->dataSize) {
printf("tss_strip_img3_signature: signed length %u too large for buffer length %u\n", img3->shshOffset, img3->dataSize);
return 10004;
}
// Trim the image by adjusting the header.
if(img3->shshOffset) {
*len += img3->shshOffset - img3->dataSize;
img3->dataSize = img3->shshOffset;
img3->fullSize = *len;
}
return 0;
}

==Digest==
Digest is the SHA1 of the stripped img3. They are used instead of PartialDigests for the APTicket since the ticket is already personalized for the ECID and all other tags.

[[Category:Firmware Tags]]

Tatsu Signing Server

2020-03-28T19:40:54Z

Vanished user 20210509: It was fun while it lasted.

The '''Tatsu Signing Server''' ('''TSS''') is a collection of services provided by Apple. In late 2012, the list of available services was briefly made public at [https://web.archive.org/web/20121128012112/http://gs.apple.com/TSS/ gs.apple.com]. This index page has since been removed, although at least one archived capture exists.
TSS is accessed chiefly for use of the [[SHSH Protocol]] to receive signed blobs for a given iOS build. This is achieved with the SHSH controller at http://gs.apple.com/TSS/controller.

There is an Apple internal equivalent, known as SpiderCab, running at [http://tatsu-tss-internal.apple.com:80 tatsu-tss-internal.apple.com] and [http://tss-int.apple.com:80 tss-int.apple.com], which are only accessible within Apple's VPN. SpiderCab is used to sign internal/debug and test builds of iOS, including old versions that are no longer signed on production.

'''Note: As of 2/18/2020, access to TSS SOAP services is forbidden, likely to all outside of Apple's internal network.''' Reliable communication to the TSS server requires the appropriate HTTP header, as described in [[SHSH Protocol#Communication]]. If you are communicating with a TSS service and not the SHSH controller itself, you must additionally provide a <code>SOAPAction:</code> header containing the URL of the service you are accessing. Also note that '''not all TSS servers accept SOAP requests.'''

== Services ==

There are two services provided, both accessible via [https://en.wikipedia.org/wiki/SOAP SOAP] requests. They are located in http://gs.apple.com/TSS/services/ under their respective names. A sample request concerning "getReceiptPacketStatus" from the "tatsuReceiptsStatusPort" service is demonstrated below:

> POST /TSS/services/tatsuReceiptsStatusPort HTTP/1.1
> Host: gs.apple.com
> User-Agent: InetURL/1.0
> Accept: */*
> Content-Length: 588
> Content-Type: text/xml;charset=utf-8
> SOAPAction: http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort

SOAP XML:
<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<soapenv:Body>
<ns1:getReceiptPacketStatus
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns1="http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort">
<ns1:param0
xsi:type="ns2:ReceiptDataPacketStatusRequest"
xmlns:ns2="http://receiptsstatus.web.tss.apple.com">
<ns2:status><nowiki><code>1</code></nowiki></ns2:status>
</ns1:param0>
</ns1:getReceiptPacketStatus>
</soapenv:Body>

</soapenv:Envelope>

Response:
<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<soapenv:Body>
<ns1:getReceiptPacketStatusResponse
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns1="http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort">

<param1 href="#id0"/>
</ns1:getReceiptPacketStatusResponse>
<multiRef
id="id0"
soapenc:root="0"
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="ns2:ReceiptDataPacketStatusResponse"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns2="http://receiptsstatus.web.tss.apple.com">

<batchIdhref="#id1"/>
<status href="#id2"/>
<ip xsi:type="xsd:string">10.108.105.161</ip>
</multiRef>
<multiRef
id="id1"
soapenc:root="0"
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="xsd:long"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
0
</multiRef>
<multiRef
id="id2"
soapenc:root="0"
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="ns3:status"
xmlns:ns3="http://receiptsstatus.web.tss.apple.com"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">

<nowiki><code href="#id3"/></nowiki>
<desc xsi:type="xsd:string"></desc>
</multiRef>
<multiRef
id="id3"
soapenc:root="0"
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="xsd:int"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
3
</multiRef>
</soapenv:Body>

</soapenv:Envelope>

This type of SOAP request/response can be performed with a cURL request, like so (where <code>soap.xml</code> is the location of the aforementioned SOAP XML):

curl -i -m 1.0 -H "Content-Type: text/xml;charset=utf-8" -A InetURL/1.0 -H "SOAPAction: http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort" -H "Host: gs.apple.com" -d @soap.xml http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort

'''Note: ''' The server may occasionally return <code>java.lang.NullPointerException</code> despite a valid response. Retrying the request will likely remedy this. ''Is this a race condition bug on the server side?''

===PacketPort===

====pushDataPacket====

* '''Input Message''' (<code>pushDataPacketRequest</code>)
* '''Output Message''' (<code>pushDataPacketResponse</code>)

===tatsuReceiptsStatusPort===

====Custom Types====

These are custom types defined by the http://receiptsstatus.web.tss.apple.com/ namespace, documented below:

* <code>status</code> contains a status code and the description for the aforementioned code. The only known status code is 3.
** <code>code</code> (Integer)
** <code>desc</code> (String)
* <code>ReceiptDataPacketStatusRequest</code>
** <code>code</code> (Number)
* <code>ReceiptDataPacketStatusResponse</code>
** <code>[no name]</code> (Long)
** <code>status</code> (type=<code>status</code>)
** <code>ip</code> (String)
* <code>ExpireTSAQueryRequest</code>
** <code>tsa</code> (Number)
* <code>ExpireTSAQueryResponse</code>

====getReceiptPacketStatus====

Returns an unknown number, a status type, and a [https://en.m.wikipedia.org/wiki/Reserved_IP_addresses private IP address] (likely meant to be accessed within Apple’s internal VPN).

* '''Input Message''' (<code>getReceiptPacketStatusRequest</code>)
** <code>param0</code> (type=<code>ReceiptDataPacketStatusRequest</code>)
* '''Output Message''' (<code>getReceiptPacketStatusResponse</code>)
** <code>param1</code> (type=<code>ReceiptDataPacketStatusResponse</code>)

====queryTASExpireTSA====

* '''Input Message''' (<code>queryTASExpireTSARequest</code>)
** <code>param2</code> (type=<code>ExpireTSAQueryRequest</code>)
* '''Output Message''' (<code>queryTASExpireTSAResponse</code>)
** <code>param3</code> (type=<code>ExpireTSAQueryResponse</code>)

====updateTSSStatus====

* '''Input Message''' (<code>updateTSSStatusRequest</code>)
** <code>param4</code> (type=<code>status</code>)
* '''Output Message''' (<code>updateTSSStatusResponse</code>)
** <code>param5</code> (type=<code>status</code>)

== Notes ==

[https://www.soapui.org SoapUI], a test automation framework for the SOAP protocol, lists Apple among their largest users [https://www.soapui.org/downloads/download-soapui-pro-trial.html].

===Server Details===
It is of moderate security concern to know that the TSS server runs [http://tomcat.apache.org/ Apache Tomcat], which is exposed, alongside version number, in the default 404 page. The SOAP implementation used is [http://axis.apache.org/axis/ Apache Axis] (Java).

== References ==
* [[TinyUmbrella]]
* [https://www.w3.org/TR/2000/NOTE-SOAP-20000508 SOAP specification]

== External Links ==
* [https://web.archive.org/web/20121128012112/http://gs.apple.com/TSS/ List of available services (archive.org)]

Tatsu Signing Server

2020-02-18T05:13:39Z

Vanished user 20210509: The IP is unreachable because it is private. Likely meant for Apple’s VPN

The '''Tatsu Signing Server''' ('''TSS''') is a collection of services provided by Apple. In late 2012, the list of available services was briefly made public at [https://web.archive.org/web/20121128012112/http://gs.apple.com/TSS/ gs.apple.com]. This index page has since been removed, although at least one archived capture exists.
TSS is accessed chiefly for use of the [[SHSH Protocol]] to receive signed blobs for a given iOS build. This is achieved with the SHSH controller at http://gs.apple.com/TSS/controller.

There is an Apple internal equivalent, known as SpiderCab, running at [http://tatsu-tss-internal.apple.com:80 tatsu-tss-internal.apple.com] and [http://tss-int.apple.com:80 tss-int.apple.com], which are only accessible within Apple's VPN. SpiderCab is used to sign internal/debug and test builds of iOS, including old versions that are no longer signed on production.

Reliable communication to the TSS server requires the appropriate HTTP header, as described in [[SHSH Protocol#Communication]]. If you are communicating with a TSS service and not the SHSH controller itself, you must additionally provide a <code>SOAPAction:</code> header containing the URL of the service you are accessing. Also note that '''not all TSS servers accept SOAP requests.''' Because http://gs.apple.com automatically resolves to one of the half-a-dozen TSS servers, some of which indiscriminately returning "403 Forbidden" to SOAP, it is recommended to communicate directly with a known-working TSS IP address.

== Services ==

There are two services provided, both accessible via [https://en.wikipedia.org/wiki/SOAP SOAP] requests. They are located in http://gs.apple.com/TSS/services/ under their respective names. A sample request concerning "getReceiptPacketStatus" from the "tatsuReceiptsStatusPort" service is demonstrated below:

> POST /TSS/services/tatsuReceiptsStatusPort HTTP/1.1
> Host: gs.apple.com
> User-Agent: InetURL/1.0
> Accept: */*
> Content-Length: 588
> Content-Type: text/xml;charset=utf-8
> SOAPAction: http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort

SOAP XML:
<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<soapenv:Body>
<ns1:getReceiptPacketStatus
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns1="http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort">
<ns1:param0
xsi:type="ns2:ReceiptDataPacketStatusRequest"
xmlns:ns2="http://receiptsstatus.web.tss.apple.com">
<ns2:status><code>1</code></ns2:status>
</ns1:param0>
</ns1:getReceiptPacketStatus>
</soapenv:Body>

</soapenv:Envelope>

Response:
<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<soapenv:Body>
<ns1:getReceiptPacketStatusResponse
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns1="http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort">

<param1 href="#id0"/>
</ns1:getReceiptPacketStatusResponse>
<multiRef
id="id0"
soapenc:root="0"
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="ns2:ReceiptDataPacketStatusResponse"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns2="http://receiptsstatus.web.tss.apple.com">

<batchIdhref="#id1"/>
<status href="#id2"/>
<ip xsi:type="xsd:string">10.108.105.161</ip>
</multiRef>
<multiRef
id="id1"
soapenc:root="0"
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="xsd:long"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
0
</multiRef>
<multiRef
id="id2"
soapenc:root="0"
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="ns3:status"
xmlns:ns3="http://receiptsstatus.web.tss.apple.com"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">

<nowiki><code href="#id3"/></nowiki>
<desc xsi:type="xsd:string"></desc>
</multiRef>
<multiRef
id="id3"
soapenc:root="0"
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="xsd:int"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
3
</multiRef>
</soapenv:Body>

</soapenv:Envelope>

This type of SOAP request/response can be performed with a cURL request, like so (where <code>soap.xml</code> is the location of the aforementioned SOAP XML):

curl -i -m 1.0 -H "Content-Type: text/xml;charset=utf-8" -A InetURL/1.0 -H "SOAPAction: http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort" -H "Host: gs.apple.com" -d @soap.xml http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort

'''Note: ''' The server may occasionally return <code>java.lang.NullPointerException</code> despite a valid response. Retrying the request will likely remedy this. ''Is this a race condition bug on the server side?''

===PacketPort===

====pushDataPacket====

* '''Input Message''' (<code>pushDataPacketRequest</code>)
* '''Output Message''' (<code>pushDataPacketResponse</code>)

===tatsuReceiptsStatusPort===

====getReceiptPacketStatus====

Returns two unknown numbers, a [https://en.m.wikipedia.org/wiki/Reserved_IP_addresses private IP address] (likely meant to be accessed within Apple’s internal VPN), and some <code>multiRef</code> tags (how are these supposed to be parsed?).

* '''Input Message''' (<code>getReceiptPacketStatusRequest</code>)
** <code>param0</code>: (type=<code>ReceiptDataPacketStatusRequest</code>)
*** Elements: <code>code</code> (Number)
* '''Output Message''' (<code>getReceiptPacketStatusResponse</code>)
** <code>param1</code>: (type=<code>ReceiptDataPacketStatusResponse</code>)
*** Elements: <code>status</code>, <code>ip</code> (String), <code>code</code>, <code>desc</code> (String)

====queryTASExpireTSA====

* '''Input Message''' (<code>queryTASExpireTSARequest</code>)
** <code>param2</code>: (type=<code>ExpireTSAQueryRequest</code>)
*** Elements: <code>tsa</code> (Number)
* '''Output Message''' (<code>queryTASExpireTSAResponse</code>)
** <code>param3</code>: (type=<code>ExpireTSAQueryResponse</code>)

====updateTSSStatus====

* '''Input Message''' (<code>updateTSSStatusRequest</code>)
** <code>param4</code>: (type=<code>status</code>)
* '''Output Message''' (<code>updateTSSStatusResponse</code>)
** <code>param5</code>: (type=<code>status</code>)
*** Elements: <code>status</code> (Number)

== Notes ==

[https://www.soapui.org SoapUI], a test automation framework for the SOAP protocol, lists Apple among their largest users [https://www.soapui.org/downloads/download-soapui-pro-trial.html].

===Server Details===
It is of moderate security concern to know that the TSS server runs [http://tomcat.apache.org/ Apache Tomcat], which is exposed, alongside version number, in the default 404 page. The SOAP implementation used is [http://axis.apache.org/axis/ Apache Axis] (Java).

== References ==
* [[TinyUmbrella]]
* [https://www.w3.org/TR/2000/NOTE-SOAP-20000508 SOAP specification]

== External Links ==
* [https://web.archive.org/web/20121128012112/http://gs.apple.com/TSS/ List of available services (archive.org)]

Tatsu Signing Server

2020-02-17T23:04:20Z

Vanished user 20210509: Nevermind, looks like this may be possible

The '''Tatsu Signing Server''' ('''TSS''') is a collection of services provided by Apple. In late 2012, the list of available services was briefly made public at [https://web.archive.org/web/20121128012112/http://gs.apple.com/TSS/ gs.apple.com]. This index page has since been removed, although at least one archived capture exists.
TSS is accessed chiefly for use of the [[SHSH Protocol]] to receive signed blobs for a given iOS build. This is achieved with the SHSH controller at http://gs.apple.com/TSS/controller.

There is an Apple internal equivalent, known as SpiderCab, running at [http://tatsu-tss-internal.apple.com:80 tatsu-tss-internal.apple.com] and [http://tss-int.apple.com:80 tss-int.apple.com], which are only accessible within Apple's VPN. SpiderCab is used to sign internal/debug and test builds of iOS, including old versions that are no longer signed on production.

Reliable communication to the TSS server requires the appropriate HTTP header, as described in [[SHSH Protocol#Communication]]. If you are communicating with a TSS service and not the SHSH controller itself, you must additionally provide a <code>SOAPAction:</code> header containing the URL of the service you are accessing. Also note that '''not all TSS servers accept SOAP requests.''' Because http://gs.apple.com automatically resolves to one of the half-a-dozen TSS servers, some of which indiscriminately returning "403 Forbidden" to SOAP, it is recommended to communicate directly with a known-working TSS IP address.

== Services ==

There are two services provided, both accessible via [https://en.wikipedia.org/wiki/SOAP SOAP] requests. They are located in http://gs.apple.com/TSS/services/ under their respective names. A sample request concerning "getReceiptPacketStatus" from the "tatsuReceiptsStatusPort" service is demonstrated below:

> POST /TSS/services/tatsuReceiptsStatusPort HTTP/1.1
> Host: gs.apple.com
> User-Agent: InetURL/1.0
> Accept: */*
> Content-Length: 588
> Content-Type: text/xml;charset=utf-8
> SOAPAction: http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort

SOAP XML:
<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<soapenv:Body>
<ns1:getReceiptPacketStatus
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns1="http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort">
<ns1:param0
xsi:type="ns2:ReceiptDataPacketStatusRequest"
xmlns:ns2="http://receiptsstatus.web.tss.apple.com">
<ns2:status><code>1</code></ns2:status>
</ns1:param0>
</ns1:getReceiptPacketStatus>
</soapenv:Body>

</soapenv:Envelope>

Response:
<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<soapenv:Body>
<ns1:getReceiptPacketStatusResponse
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns1="http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort">

<param1 href="#id0"/>
</ns1:getReceiptPacketStatusResponse>
<multiRef
id="id0"
soapenc:root="0"
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="ns2:ReceiptDataPacketStatusResponse"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns2="http://receiptsstatus.web.tss.apple.com">

<batchIdhref="#id1"/>
<status href="#id2"/>
<ip xsi:type="xsd:string">10.108.105.161</ip>
</multiRef>
<multiRef
id="id1"
soapenc:root="0"
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="xsd:long"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
0
</multiRef>
<multiRef
id="id2"
soapenc:root="0"
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="ns3:status"
xmlns:ns3="http://receiptsstatus.web.tss.apple.com"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">

<nowiki><code href="#id3"/></nowiki>
<desc xsi:type="xsd:string"></desc>
</multiRef>
<multiRef
id="id3"
soapenc:root="0"
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="xsd:int"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
3
</multiRef>
</soapenv:Body>

</soapenv:Envelope>

This type of SOAP request/response can be performed with a cURL request, like so (where <code>soap.xml</code> is the location of the aforementioned SOAP XML):

curl -i -m 1.0 -H "Content-Type: text/xml;charset=utf-8" -A InetURL/1.0 -H "SOAPAction: http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort" -H "Host: gs.apple.com" -d @soap.xml http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort

'''Note: ''' The server may occasionally return <code>java.lang.NullPointerException</code> despite a valid response. Retrying the request will likely remedy this. ''Is this a race condition bug on the server side?''

===PacketPort===

====pushDataPacket====

* '''Input Message''' (<code>pushDataPacketRequest</code>)
* '''Output Message''' (<code>pushDataPacketResponse</code>)

===tatsuReceiptsStatusPort===

====getReceiptPacketStatus====

Returns two unknown numbers, an IP address with an unreachable destination (not in the common 17.x.x.x Apple IP range, either), and some <code>multiRef</code> tags (how are these supposed to be parsed?).

* '''Input Message''' (<code>getReceiptPacketStatusRequest</code>)
** <code>param0</code>: (type=<code>ReceiptDataPacketStatusRequest</code>)
*** Elements: <code>code</code> (Number)
* '''Output Message''' (<code>getReceiptPacketStatusResponse</code>)
** <code>param1</code>: (type=<code>ReceiptDataPacketStatusResponse</code>)
*** Elements: <code>status</code>, <code>ip</code> (String), <code>code</code>, <code>desc</code> (String)

====queryTASExpireTSA====

* '''Input Message''' (<code>queryTASExpireTSARequest</code>)
** <code>param2</code>: (type=<code>ExpireTSAQueryRequest</code>)
*** Elements: <code>tsa</code> (Number)
* '''Output Message''' (<code>queryTASExpireTSAResponse</code>)
** <code>param3</code>: (type=<code>ExpireTSAQueryResponse</code>)

====updateTSSStatus====

* '''Input Message''' (<code>updateTSSStatusRequest</code>)
** <code>param4</code>: (type=<code>status</code>)
* '''Output Message''' (<code>updateTSSStatusResponse</code>)
** <code>param5</code>: (type=<code>status</code>)
*** Elements: <code>status</code> (Number)

== Notes ==

[https://www.soapui.org SoapUI], an automation framework for the SOAP protocol, lists Apple among their largest users [https://www.soapui.org/downloads/download-soapui-pro-trial.html].

===Server Details===
It is of moderate security concern to know that the TSS server runs [http://tomcat.apache.org/ Apache Tomcat], which is exposed, alongside version number, in the default 404 page. The SOAP implementation used is [http://axis.apache.org/axis/ Apache Axis] (Java).

== References ==
* [[TinyUmbrella]]
* [https://www.w3.org/TR/2000/NOTE-SOAP-20000508 SOAP specification]

== External Links ==
* [https://web.archive.org/web/20121128012112/http://gs.apple.com/TSS/ List of available services (archive.org)]

Tatsu Signing Server

2020-02-17T22:07:20Z

Vanished user 20210509: Don't think I can get much farther without seeing the WSDL itself.

The '''Tatsu Signing Server''' ('''TSS''') is a collection of services provided by Apple. In late 2012, the list of available services was briefly made public at [https://web.archive.org/web/20121128012112/http://gs.apple.com/TSS/ gs.apple.com]. This index page has since been removed, although at least one archived capture exists.
TSS is accessed chiefly for use of the [[SHSH Protocol]] to receive signed blobs for a given iOS build. This is achieved with the SHSH controller at http://gs.apple.com/TSS/controller.

There is an Apple internal equivalent, known as SpiderCab, running at [http://tatsu-tss-internal.apple.com:80 tatsu-tss-internal.apple.com] and [http://tss-int.apple.com:80 tss-int.apple.com], which are only accessible within Apple's VPN. SpiderCab is used to sign internal/debug and test builds of iOS, including old versions that are no longer signed on production.

Reliable communication to the TSS server requires the appropriate HTTP header, as described in [[SHSH Protocol#Communication]]. If you are communicating with a TSS service and not the SHSH controller itself, you must additionally provide a <code>SOAPAction:</code> header containing the URL of the service you are accessing. Also note that '''not all TSS servers accept SOAP requests.''' Because http://gs.apple.com automatically resolves to one of the half-a-dozen TSS servers, some of which indiscriminately returning "403 Forbidden" to SOAP, it is recommended to communicate directly with a known-working TSS IP address.

== Services ==

There are two services provided, both accessible via [https://en.wikipedia.org/wiki/SOAP SOAP] requests. They are located in http://gs.apple.com/TSS/services/ under their respective names. A sample request concerning "getReceiptPacketStatus" from the "tatsuReceiptsStatusPort" service is demonstrated below:

> POST /TSS/services/tatsuReceiptsStatusPort HTTP/1.1
> Host: gs.apple.com
> User-Agent: InetURL/1.0
> Accept: */*
> Content-Length: 588
> Content-Type: text/xml;charset=utf-8
> SOAPAction: http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort

SOAP XML:
<?xml version="1.0" encoding="UTF-8"?>
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<soapenv:Body>
<ns1:getReceiptPacketStatus
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns1="http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort">
<ns1:param0
xsi:type="ns2:ReceiptDataPacketStatusRequest"
xmlns:ns2="http://receiptsstatus.web.tss.apple.com">
</ns1:param0>
</ns1:getReceiptPacketStatus>
</soapenv:Body>

</soapenv:Envelope>

Response:
<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<soapenv:Body>
<ns1:getReceiptPacketStatusResponse
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns1="http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort">
<param1
xsi:type="ns2:ReceiptDataPacketStatusResponse"
xsi:nil="true"
xmlns:ns2="http://receiptsstatus.web.tss.apple.com"/>
</ns1:getReceiptPacketStatusResponse>
</soapenv:Body>

</soapenv:Envelope>

This type of SOAP request/response can be performed with a cURL request, like so (where <code>soap.xml</code> is the location of the aforementioned SOAP XML):

curl -i -m 1.0 -H "Content-Type: text/xml;charset=utf-8" -A InetURL/1.0 -H "SOAPAction: http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort" -H "Host: gs.apple.com" -d @soap.xml http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort

'''Note: ''' The server may occasionally return <code>java.lang.NullPointerException</code> despite a valid response. Retrying the request will likely remedy this. ''Is this a race condition bug on the server side?''

===PacketPort===

====pushDataPacket====

* '''Input Message''' (<code>pushDataPacketRequest</code>)
* '''Output Message''' (<code>pushDataPacketResponse</code>)

===tatsuReceiptsStatusPort===

====getReceiptPacketStatus====

* '''Input Message''' (<code>getReceiptPacketStatusRequest</code>)
** <code>param0</code>: (type=<code>ReceiptDataPacketStatusRequest</code>)
* '''Output Message''' (<code>getReceiptPacketStatusResponse</code>)
** <code>param1</code>: (type=<code>ReceiptDataPacketStatusResponse</code>)

====queryTASExpireTSA====

* '''Input Message''' (<code>queryTASExpireTSARequest</code>)
** <code>param2</code>: (type=<code>ExpireTSAQueryRequest</code>)
* '''Output Message''' (<code>queryTASExpireTSAResponse</code>)
** <code>param3</code>: (type=<code>ExpireTSAQueryResponse</code>)

====updateTSSStatus====

* '''Input Message''' (<code>updateTSSStatusRequest</code>)
** <code>param4</code>: (type=<code>status</code>)
*** Elements: <code>status</code> (Number)
* '''Output Message''' (<code>updateTSSStatusResponse</code>)
** <code>param5</code>: (type=<code>status</code>)
*** Elements: <code>status</code> (Number)

== Notes ==

[https://www.soapui.org SoapUI], an automation framework for the SOAP protocol, lists Apple among their largest users [https://www.soapui.org/downloads/download-soapui-pro-trial.html].

===Server Details===
It is of moderate security concern to know that the TSS server runs [http://tomcat.apache.org/ Apache Tomcat], which is exposed, alongside version number, in the default 404 page. The SOAP implementation used is [http://axis.apache.org/axis/ Apache Axis] (Java).

== References ==
* [[TinyUmbrella]]
* [https://www.w3.org/TR/2000/NOTE-SOAP-20000508 SOAP specification]

== External Links ==
* [https://web.archive.org/web/20121128012112/http://gs.apple.com/TSS/ List of available services (archive.org)]

Tatsu Signing Server

2020-02-16T23:04:49Z

Vanished user 20210509: More research. Still can't access the WSDL, though :(

Unc0ver

2020-02-16T21:54:13Z

Vanished user 20210509: Updated for v4.0.1

{{lowercase}}{{Infobox software
| name = unc0ver
| title = unc0ver
| developer = [https://twitter.com/pwn20wnd pwn20wnd]<br />[https://twitter.com/sbingner sbingner]
| released = {{Start date|2018|10|13|df=yes}}
| latest release version = v4.0.1
| latest release date = {{Start date and age|2020|02|16|df=yes}}
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [https://unc0ver.dev The Official Website]<br />[https://www.reddit.com/9nwxei/ The Reddit thread]<br />[https://github.com/pwn20wndstuff/Undecimus The GitHub repo]
}}
'''unc0ver''' is a [[semi-untethered jailbreak]] for all devices running iOS 11.0-12.2 and 12.4 (excluding iOS 12.3, 12.3.1 and 12.3.2) and all A12-A13 devices running iOS 13.0-13.3.

It uses the same, and a few more, exploits as [[Electra]] and [[Chimera]] whilst providing more features.

In order to download the latest IPA, download links from the README section has been moved to the releases section of the repository (you can find this by looking under the colored bars where you can find the releases page which is in the middle, alongside branches and contributors).
==Release History==
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| RC1
| {{date|2018|10|13}}
|
* Initial release
|-
| RC2
| rowspan="5" | {{date|2018|10|14}}
|
* Add the Dynastic repo by default
* Fix a bug in firmware checker
|-
| RC3
|
* Add a switch to manually enable restoring RootFS
* Stop erasing user preferences when restoring RootFS
* Fix bugs
|-
| RC4
|
* Add a label to display the uptime
* Add a label to display the app's version number
* Spawn to the PATH
* Stop bundling system fonts
|-
| RC5
|
* Run videosubscriptionsd in the jailed state
* Fix a bug in firmware and update checker
|-
| RC6
|
* Start logging again
* Improve update checker
* Fix multi_path
|-
| RC7
| {{date|2018|10|17}}
|
* Fix a bug in RootFS Restore and multi_path
|-
| RC8
| {{date|2018|10|18}}
|
* Fix a bug in RootFS Remount
* Add a work in progress warning for some firmwares
|-
| RC9
| {{date|2018|10|19}}
|
* Fix a bug in RootFS Remount
* Add even more detailed error messages
* Add a switch to increase the memory limit to improve the stability
* Improve the compatibility layer to work correctly with some tweaks that were specifically made for the other jailbreaks
|-
| v1
| {{date|2018|10|20}}
|
* Fix a bug in RootFS Restore and Remount
* Make the settings tab match with the rest of the UI
* Fix bugs
|-
| v1.0.1
| {{date|2018|10|21}}
|
* Disable the RootFS Restore for the unstable versions
|-
| v1.0.2
| {{date|2018|10|22}}
|
* Enable and fix the RootFS Restore for all versions
|-
| v1.0.3
| {{date|2018|10|23}}
|
* Fix the beta firmwares
|-
| v1.1
| {{date|2018|10|27}}
|
* Automatically select the best exploit
* Rewrite the versions checker
* Improve assertion
* Show the code which has failed in the error messages
* Improve memory management
* Optimize and clean up the code
* Fix the Storage settings
* Switch to a new technique to disable auto updates
* Remove so much useless logging
* Only set the boot-nonce if the switch is on without checking if it exists or not
* Log offsets
* Remove static sleeps to improve the speed
* Fix series of bugs and leave no known bug
|-
| v1.1.1
| rowspan="2" | {{date|2018|11|03}}
|
* Add a label to show the ECID
* Add a button to open the source code
* Improve auto layout
* Fix various bugs within RootFS interaction, Icon cache refresher, Version checker, Exploit selector, jailbreak state detector and others
|-
| v1.1.2
|
* Improve auto layout and code
* Significantly improve Empty_List (VFS) exploit
* Slightly improve Multi_Path (MPTCP)
|-
| v1.1.3
| rowspan="2" | {{date|2018|11|06}}
|
* Fix a bug in starting jailbreakd
|-
| v1.1.4
|
* Fix a bug in finding offsets
|-
| v2.0
| {{date|2018|11|30}}
|
* Initial Cydia Substrate support
* OTA upgrades for the jailbreak patches from Cydia without rebooting
* A new button to restart SpringBoard from the jailed state
* A switch to (re)install OpenSSH
* A switch to reinstall Cydia
* A switch to restart backboardd only so that you can jailbreak with broken tweaks
* Fix and update bootstrap
* Fix for the jailbreakd error
* Battery life fixes
* ELOD (Electra Loop Of Death) mitigations
* Improve the speed of system reload
* Fixes for countless bugs
* Enable Restart and Restart SpringBoard buttons on iOS 11.4 - 11.4.1 (Jailbreak itself doesn't work on iOS 11.4 - 11.4.1)
* Improve the reliability of the Restart button
* Fix the broken multi_path entitlement check
* Add the compatibility layer for the other jailbreaks back to fix the apps like iCleaner
* Fix the famous snapshot creation bug
* Add a button to manually reset the logs instead of automatically resetting them when the diagnostics button is tapped
* Fix the trust cache injection bug
|-
| v2.0.1
| {{date|2018|12|02}}
|
* The official release of v2.0 with a version number bump to make tracking versions easier
|-
| v2.0.2
| {{date|2018|12|06}}
|
* Fix bugs in the app
* Improve the the speed of the jailbreak
* Update bundled resources
* Switch to a new technique for blocking revokes
|-
| v2.1
| {{date|2018|12|14}}
|
* Make internal changes to make fixing issues easier
* Add T-Mobile support for the revoke disabler
* Make re-jailbreaking without restarting possible
* Make switching from Electra possible without restoring RootFS
* Update bundled resources
* Fix a bug in extracting bootstrap
* Only quit the app if the error is fatal
* Fix a bug in loading daemons
* Make the jailbreaking process faster and more stable
* Add more feedback to the user interface
* Other fixes and improvements
* Fix a bug in extracting bootstrap that was introduced with the previous build
* Fix a bug in installing Cydia that was introduced with the previous build
* Fix a bug in switching from Electra without restoring RootFS
* Update "No Tweaks" mode to support new "Disable Loader" option in Cydia Substrate
* Added the ability to completely disable jailbreakd when Substrate is installed via a future Cydia update.
* Add internal support for completely disabling jailbreakd with a Resources update
* Make a special alert for the exploit error to make it more clear
* Automatically reboot when the user taps "OK" on the exploit error
* Improve the version checker
* Fix a really weird bug in the system that would stop Cydia Substrate from loading tweaks although this bug isn't caused by the tool
* Make the UI support different font sizes or styles (E.g. Bold Text)
* Add the initial localization support (No localizations included yet)
* Reduce the number of stages
* Fix a bug in installing OpenSSH
* Switch to Sam Bingner's new superb trust cache injector thereby enable support for dual-hash signatures
* Don't update the hosts file unless it is needed
* Unblock Saurik's repo if it is blocked
* Reduce the number of stages
* Remove unnecessary checks
* Avoid applying unnecessary kernel patches unless they are needed
* Make sure that the system snapshot was correctly mounted before using it
* Unmount the system snapshot after root filesystem snapshot bypass or restore
* Simplify the credits view
* Don't do unnecessary logging
* Improve empty_list (vfs) exploit's success rate
* Fix runCommand to correctly log
* Don't run jailbreakd if Cydia Substrate is installed
* Don't set the boot nonce if it already is
* Make obvious internal changes
* Make jailbreaking obviously faster
* Fix a brutal kernel memory leak
* Fix shutdown or halt leading to a reboot
* Fix a logic error that would disable jailbreak patches when Substrate was installed but Load Daemons was disabled that was introduced with the previous build
* Fix a bug in RootFS Restore for iOS 11.0 - 11.2.6 that was introduced with the previous build
* Fix a bug in trust cache injection
* Improve update checker
* Make jailbreaking obviously faster
* Fix a bug in RootFS Restore for iOS 11.0 - 11.2.6 that would cause it to not work on some devices
* Fix a bug in update checker
* Fix a bug in the posix_spawn wrapper that would cause weird issues on some devices (Known for causing the "(24/40)" issue)
|-
| v2.1.1
| {{date|2019|01|05}}
|
* Make jailbreaking faster
* Don't error out if the hosts file doesn't exist
* Ignore dependencies in Cydia reinstallation
* Fix false positives
* Clean Cydia's user data in RootFS Restore
* Fix a snapshot name confusion bug in RootFS Restore
* Fix another bug in RootFS Restore
* Improve memory management
* Use less external binaries
* Completely clean Cydia's user data in RootFS Restore
|-
| v2.1.3
| rowspan="2" | {{date|2019|01|26}}
|
* Fix a bug in patch finder that affected the shenanigans finder on specific iOS versions
* Switch to a better versioning system
* Make downgrading from v2.2.0 possible (Unreleased as of now)
|-
| v2.1.4
|
*Decrease the app's size from 63MBs to 22MBs by optimizing assets
|-
| v2.2.0
| rowspan="3" | {{date|2019|01|30}}
|
* Install Cydia Substrate if it's not already installed
* Validate Cydia Substrate files and reinstall it if the validation fails
* Fix a bug in switching from Electra without RootFS Restore
* Clean up the kernel data structure patches to improve the performance and the security
* Remove Substitute support files in the filesystem
* Remove Substitute support links in the filesystem
* Uninstall Electra's Cydia Upgrade Helper if it is present
* Improve preference management
* Switch to a more efficient versioning system
* Use a new implementation of the system's libarchive to extract the bootstrap to increase the perfomance
* Update rsync to increase the performance and the stability of RootFS Restore
* Improve memory management
* Re-Extract bootstrap if it was extracted on a different iOS version
* Credit Saurik in the credits view for Cydia and Substrate
* Avoid writing to the disk when not necessary
* Add a verbose log window for the jailbreak
* Make the exploits slightly faster
* Make the jailbreak significantly faster and more performant
* Jailbreak itself now takes almost less than a second run (Exploit not included)
* Fix a bug in patch finder that would cause the sandbox escape to fail on certain devices
* Fix theoretical bugs
* Improve assertion
* Performance improvements
* Fix a bug in logging
* Update bootstrap
* Enable overwriting files in the bootstrap extractor
* Fix switching from Electra without restoring root filesystem
* Fix certain error descriptions
* Fix RootFS Restore on certain devices
* Add a switch to hide the log window
* Decrease the app's size from 81MBs to 25MBs by optimizing assets
* Add a switch to reset Cydia cache on request
* Rewrite Cydia installation
* Install a local repo
* Remove bootstrap
* Hide the local APT repo from Cydia
|-
| v2.2.1
|
* Fix a bug in installing Cydia / extracting bootstrap
|-
| v2.2.2
|
* Fully fix a bug in installing Cydia / extracting bootstrap
|-
| v2.2.3
| {{date|2019|01|31}}
|
* Fix a bug with extracting rsync
|-
| v3.0.0
| {{date|2019|04|19}}
|
* Add support for iOS 12.0-12.1.2.
|-
| v3.0.1
| {{date|2019|04|23}}
|
* Iterate the proc list with proper data locks in Unrestrict to fix a possible race condition in the kernel (Important stability fix)
* Fix a typo in the app
* Fix a bug in logging
* Add iOS 12.1.3 - 12.2 support for the restart button
|-
| v3.1
| {{date|2019|05|23}}
|
* Rewrite the kernel patches from scratch to improve the stability and the reliability of the jailbreak
* Rewrite the preference management system from scratch to optimize the jailbreak
* Rewrite the diagnostics system from scratch to provide more useful information
* Rewrite unrestrict libary from scratch to improve the stability of the system after jailbreak
* Add support for switching from the other iOS 12 jailbreaks without restoring the root filesystem and losing data
* Make Unrestrict add sandbox exceptions for mach_lookup and mach_register
* Fix issues with processes looking up Substrate port on iOS 12 to fix stability and performance issues
* Fix support for the broken versions of RocketBootstrap and hid-support tweaks
* Fix the iMessage audio crash
* Fix FaceTime calls disappearing on some devices
* Fix Camera crash on some devices
* Update the local APT repo to include the latest updates from the Elucubratus repository, including the updated uikittools with rewritten uicache and sbreload commands to make refreshing the icon cache and reloading the SpringBoard significantly faster when installing packages from Cydia
* Refresh the icon cache during the root filesystem restore to fix jailbreak apps staying on the home screen after restoring the root filesystem
* Update mobilesubstrate to version 0.9.7033 to disable loader in the securityd daemon to fix a freeze issue on iOS 12
* Significantly improve the reliability of the jailbreak when using the machswap or the machswap2 exploit
* Wait for the user to tap OK on the jailbreak completed alert before respringing the device
* Improve the jailbreak's self-repairability feature
* Add a progress HUD to display the status of the jailbreak process
* Optimize the code
* Improve assertion
* Add error-specific error messages
* Display info about the device on launch
* Clean up logging
* Reconfigure the "Reload System Daemons" and "Enable get-task-allow" preferences
* Make "Enable get-task-allow" a default option
|-
| v3.1.1
| rowspan="2" | {{date|2019|05|24}}
|
* Fix running root filesystem restore when not in the jailbroken state on iOS 11
* Add an option to automatically restart the SpringBoard once the jailbreak is done instead of waiting for the user to tap the OK button (Requested by a Redditor)
|-
| v3.1.2
|
* Fix a bug in the settings user interface on smaller devices
* Add an option to hide the progress HUD (Requested by a Redditor)
|-
| v3.1.3
| {{date|2019|05|28}}
|
* Fix a bug in updating the status
* Fix a logic bug in remounting the root filesystem (Addresses https://www.reddit.com/r/jailbreak/comments/btxqng/help_still_cant_jb_on_ios_1211_using_the_newest/)
* Make machswap and machswap2 not depend on stealing kernel's credentials to fix a possible reliability issue
* Update kernel patches to use a safer allocation method
* Fix missing information in the jailbreak completed notice
* Fix false information in the jailbreak completed notice
|-
| v3.2
| {{date|2019|06|01}}
|
* Redesign the user interface (https://twitter.com/HiMyNameIsUbik/status/1134938278489182208)
* Add dark mode for the user interface
* Add info buttons for the options
* Increase the reliability of the jailbreak with the machswap and machswap2 exploits
* Update jailbreak-resources to fix an issue with the CS_DEBUGGED option
|-
| v3.2.1
| {{date|2019|06|02}}
|
* Fix several typos in the app
* Update the bundled uikittools
* Ignore refresh icon cache failures unless they are actually fatal
|-
| v3.3.0
| {{date|2019|07|14}}
|
* Add the Sock Puppet exploit for iOS 12.0-12.2 support on A8X-A11 devices
* Remove the empty_list and multi_path exploits
* Replace the kernel exploit segmented switch with picker view
* Add code substitution platform picker view
|-
| v3.3.1
| rowspan="2" | {{date|2019|07|16}}
|
* Improve the speed of the jailbreak process by a few seconds
* Fix a bug in dark mode on the iPads
|-
| v3.3.2
|
* Fix a bug in finding kernel offsets on iOS 11
|-
| v3.3.3
| {{date|2019|07|18}}
|
* Fix the Sock Puppet kernel exploit on iOS 11
* Fix the Voucher Swap exploit's compatibility status with iPad Air 2 and iPad Mini 4 on iOS 11
|-
| v3.3.4
| rowspan="4" | {{date|2019|07|19}}
|
* Add the Sock Port exploit by [https://twitter.com/jakeashacks @jakeashacks] for iOS 11.0-12.1.4 on A7-A9X devices
|-
| v3.3.5
|
* Fix a reliability bug in Sock Port
* Fix Sock Puppet on A8X
|-
| v3.3.6
|
* Fix Sock Port failing on 4K devices
|-
| v3.3.7
|
* Improve the reliability of the Sock Port kernel exploit on 4K devices
|-
| v3.3.8
| {{date|2019|07|22}}
|
* Use the rewritten SockPort 2.0 exploit with ~100% reliability, ~100 milliseconds run time and support for all devices on iOS 11.0-12.2 (12.1.3-12.2 on A12-A12X excluded)
* Fix the jailbreak on iOS 12.2 iPhones and iPods
|-
| v3.4.0
| {{date|2019|07|23}}
|
* Replace the SockPort 2.0 exploit with the SockPuppet 2.0 exploit with better reliability and stability on older devices
|-
| v3.4.1
| rowspan="2" | {{date|2019|07|25}}
|
* Fix the sandbox swap error when using the exploits that are not SockPuppet
* Add the SockPort 1.5 exploit by [https://github.com/jakeajames @jakeajames] for A7-A9X devices (Reliability: ~95% from extensive testing)
* Disable the SockPuppet exploit on A7-A7X due to reliability issues
* Add iOS 12.3~b1 support to the jailbreak (Verified working on iPhone 5s)
* Fix a theoretical reliability bug with SockPuppet
|-
| v3.4.2
|
* Fix the SockPuppet kernel exploit not displaying on A8-A8X devices
|-
| v3.5.0
| {{date|2019|08|18}}
|
* Add iOS 12.4 support to the Sock Puppet (A8-A11) and Sock Port (A7-A7X) exploits
|-
| v3.5.1
| rowspan="3" | {{date|2019|08|19}}
|
* Add the updated SockPuppet 3.0 exploit by @umanghere
* Remove the SockPort and SockPort2 exploits
* Update system-memory-reset fix to fix random reboots
* Add Apple to the credits section for development
* Fix error at stage 2 when jailbreaking after updating from a lower firmware while preserving the app data
* Fix the app crashing up on stared up on iOS 11
|-
| v3.5.2
|
* Fix the SockPuppet 3.0 exploit on iPad Mini 4 and iPad Air 2
|-
| v3.5.3
|
* Add WIP partial support for A12-A12X devices on iOS 12.1.3, 12.1.4, 12.2 and 12.4 with support for setting HSP#4 as TFP0, setting kernel_task info, exporting kernel_task port, dumping APTicket, logging KASLR shift and ECID and disabling auto updates
|-
| v3.5.4
| rowspan="2" | {{date|2019|08|22}}
|
* Add full-fledged SSH support with root-shell for A12-A12X devices on iOS 12.1.3-12.4
* Add support for arbitrary unsigned code execution on A12-A12 devices on iOS 12.1.3-12.4
(Note: Object files will have to be signed with a CMS blob using the codesign utility)
* Add support for running expired or revoked apps on A12-A12X devices on iOS 12.1.3-12.4
* Fix instant or random reboots after jailbreaking with the SockPuppet3.0 exploit on A7-A12X devices on iOS 11.0-12.4
Note: Code injection is not supported on A12-A12X devices as of yet
|-
| v3.5.5
|
* Fixes issues with the jailbreak introduced with the last update
* Fixes iOS 11 support
|-
| v3.5.6
| {{date|2019|08|24}}
|
* Add support for remounting the RootFS as read-write on A12-A12X devices running iOS 12.1.3-12.4
* Adds support for restoring the RootFS on A12-A12X devices running iOS 12.1.3-12.4
|-
| v3.6.0
| rowspan="2" | {{date|2019|09|08}}
|
* Completely redesign and rewrite all jailbreak patches from scratch.
* Make the jailbreak patches static and not dynamic, Meaning that the system stability will be completely stock after the jailbreak.
* Fix the app crashing on launch when signed with provisioning profiles with non-ASCII characters.
* Internally prepare jailbreak patches for full-fledged A12-A12X support.
* Make the jailbreak significantly and noticeably more reliable and faster to run.
* Add the SockPort 3.0 exploit for improved reliability on iOS 12.4 and devices with low RAM.
* Fix SSH support for arm64e devices running iOS 12.0-12.1.2.
* Make it possible to jailbreak with corrupted SystemVersion.plist on iOS 12.4.
* Make the jailbreak perform proper clean up to preserve system stability in case of a failure.
* Fix the jbctl command-line utility.
* Switch to a new technique for setting the system boot nonce generator that works on all arm64e devices running iOS12.0-12.4, (Thanks to [https://github.com/0x7ff @0x7ff] for the idea).
* Fix a bug with the initial Cydia installation getting stuck sometimes.
* Significantly speed up the initial Cydia installation process.
* Internally prepare upcoming stable substitute support.
* Internally prepare Cydia and its resources for full-fledged arm64e support.
|-
| v3.6.1
|
* Improves auto-exploit selection.
|-
| v3.6.2
| rowspan="2" | {{date|2019|09|09}}
|
* Fix an issue with the kernel virtual memory access APIs on A7-A8 devices that rendered the jailbreak useless by causing it to fail to copy big kernel data (Error known as: "Unable to copy container profile in kernel memory.")
|-
| v3.6.3
|
* Fix an issue with finding kernel offsets on A8
|-
| v3.7.0~b2
| rowspan="2" | {{date|2019|10|14}}
|
* Full-fledged A12-A12X support with Cydia and system-wide tweak injection
* Fix Camera on A12-A12X devices
* Fix GPS on A12-A12X devices
* Fix App Store purchases on A12-A12X devices
* Fix Face ID on A12-A12X devices
* Fix performance issues on A12-A12X devices
* Fix stability issues on A12-A12X devices
* Fix reload system daemons issues on A12-A12X devices
* Fix general stability issues with system services on A12-A12X devices
* Fix system shutdown on A12-A12X devices
* Fix system restart on A12-A12X devices
* Fix USB on A12-A12X devices
* Fix Xcode debugging on A12-A12X devices
* Fix a bug in libsubstitute that broke the TetherMe tweak A12-A12X devices
* Enable full-fledged AMFI/CoreTrust bypass on A12-A12X devices
* Fix memory management issues on A12-A12X devices
* Fix tweak injection to MobileSafari on A12-A12X devices
* Make reload system daemons reload services with launchctl instead of ldrestart
* Reload system daemons before restarting SpringBoard
|-
| v3.7.0~b3
|
* Correct a problem with reload system daemons when using Substrate (non-A12 devices)
|-
| v3.7.0~b4
| {{date|2019|12|02}}
|
* Update bundled Cydia to prompt for network access on China devices
* Rename the bundled mobilesubstrate to match other jailbreaks
* Update the bundled substitute to 0.1.0
|-
| v3.8.0~b1
| {{date|2019|12|09}}
|
* Add iOS 12.4.1 support for A12 iPhones (iPads not supported at this time)
|-
| v4.0.0
| {{date|2020|02|15}}
|
* Full-fledged support for A12-A13 devices on iOS 13.0-13.3 with Cydia and system-wide tweak injection
|-
| v4.0.1
| {{date|2020|02|16}}
|
* Fix App Store for A12-A13
* Fix push notifications for A12-A13
* Improve reliability for A12-A13 devices on iOS 13.0-13.3
|}

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Tatsu Signing Server

2020-02-16T00:20:49Z

Vanished user 20210509: TSS research

Tatsu Signing Server

2020-02-15T22:32:44Z

Vanished user 20210509:

SHSH Protocol

2020-02-15T22:29:59Z

Vanished user 20210509: Organization; described HTTP header in more detail

Here is a description of the protocol that is used when [[iTunes]] requests the [[SHSH]] certificate from Apple. For details about what this is used for, please see the main article [[SHSH]].

This is a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] ([[wikipedia:POST (HTTP)|POST]]) request and answer. You can retry this via a [[wikipedia:Telnet|Telnet]] session or similar. The destination host is [http://gs.apple.com/TSS/controller?action=2 gs.apple.com] and runs on the common [[wikipedia:TCP and UDP port|port]] 80. The data is plaintext and not encoded in any way. For details about the [[wikipedia:Hypertext Transfer Protocol|HTTP]] protocol itself, please see [http://www.w3.org/Protocols/HTTP/1.1/rfc2616.pdf RFC2616].

== Communication ==

Reliable communication to the TSS server is best achieved with the following HTTP header configuration:

* <code>Host: gs.apple.com</code>
* <code>User-Agent: InetURL/1.0</code>
* <code>Content-Type: text/xml</code>

The following [https://curl.haxx.se/ curl] command demonstrates a command-line request to the server:

curl -i -s -m 1.0 -A 'InetURL/1.0' -X POST -H 'Content-Type: text/xml' -H 'Host: gs.apple.com' -d @/location/to/my/request.xml gs.apple.com/TSS/controller?action=2

===Action types===
Attached to the http://gs.apple.com/TSS/controller URL is commonly <code>?action=2</code>, which can be discovered when performing an iTunes restore and observing packets sent with a packet sniffer such as [https://www.wireshark.org Wireshark]. However, values other than 2 may produce different server responses, of which all known value/response pairs have been listed below.

* <code>?action=0</code>: Performs a "Tatsu Signing Server HealthCheck", returning an HTML body of "Server not ready". This may be a general ping protocol for ensuring the TSS service is online.
* <code>?action=2</code>: Common SHSH protocol. See [[#Status responses]] for all known server responses.
* <code>?action=3</code>: Functionally the same as <code>?action=2</code>.
* <code>?action=5</code>: Generates <code>respCode</code> and <code>respMsg</code>. This response syntax differs slightly from the SHSH protocol. The name "cpsn" is referenced.

All unlisted action types appear to respond without HTML content, only status.

===Sending data (request)===
The request is actually a single XML-encoded property list. It contains a dictionary which describes the target iOS version, restore behavior, etc. Some of the required information can be taken from the BuildManifest.plist. BuildManifest contains some info about the firmware version and "BuildIdentities" dictionary. Inside it you can find two (or more?) build identities. Each of them contains the information which depends on every type of restore ("Erase" or "Update"). Some information is device-dependent (ECID, nonce) and is received from the device.

Request property list should have these properties:

* '''@APTicket:''' Optional boolean value. If true, the server adds an [[APTicket]] to the request.
* '''@BBTicket:''' Optional boolean value. The same for the [[BBTicket]].
* '''@UDID:''' Optional string value. Just request UDID (ex. D9C1F33D-62E0-4D25-8068-F5F46FE80057).
* '''@HostPlatformInfo:''' Optional string value. "mac" for OS X client, "windows" for Windows client (can be everything you want).
* '''@Locality:''' Optional string value. Language used for the error response (ex. "en_US").
* '''@VersionInfo:''' Optional string value. The version of 'libauthinstall' used (ex. "libauthinstall-391.0.0.1.3"). You can pass any string here.
* '''ApBoardID:''' Integer value. [[BORD |Board ID]] of the target device. You can take this value from build manifest.
* '''ApChipID:''' Integer value. [[CHIP|Chip ID]] of the target device. You can take this value from build manifest.
* '''ApECID:''' Integer value. [[ECID]] of the target device.
* '''ApNonce:''' Data value. The [[nonce]] generated by your device.
* '''ApProductionMode:''' Boolean value. Always true (unless your SOC is PROD 0 - Apple only).
* '''ApSecurityDomain:''' Integer value. The use is unknown. You can take this value from build manifest.
* '''UniqueBuildID:''' Optional data value. This is a unique identifier for every build (different even for "Erase" and "Update" types of restore). You can take this value from build manifest.

The SHSH request also contains information about files from the [[IPSW]] (or restore bundle for [[PurpleRestore]]). They can be obtained from the 'build identity' you've chosen in the previous step. Each 'build identity' contains a "Manifest" dictionary. It's entries look like
<key>BatteryCharging0</key>
<dict>
<key>Digest</key>
<nowiki><data>...</data></nowiki>
<key>Info</key>
<dict>...</dict>
<key>Trusted<key/>
<true/>
<dict/>
They are just copied to the SHSH request, but the "Info" dictionary is removed.
Example of a SHSH request (... values are identical, *** values are different per device):
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>@[[APTicket]]</key>
<true />
<key>@[[BBTicket]]</key>
<true />
<key>@HostPlatformInfo</key>
<string>mac</string>
<key>@Locality</key>
<string>en_US</string>
<key>@UUID</key>
<string>D9C1F33D-62E0-4D25-8068-F5F46FE80057</string>
<key>@VersionInfo</key>
<string>libauthinstall-391.0.0.1.3</string>
<key>[[BORD |ApBoardID]]</key>
<integer>10</integer>
<key>[[CHIP |ApChipID]]</key>
<integer>35152</integer>
<key>[[ECID |ApECID]]</key>
<integer>***</integer>
<key>[[Nonce |ApNonce]]</key>
<nowiki><data>***</data> </nowiki>
<key>ApProductionMode</key>
<true />
<key>ApSecurityDomain</key>
<integer>1</integer>
<key>UniqueBuildID</key>
<data> fqzW0B++Zdrs+PRwohkwU6prjbk=</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<nowiki><data> uH5QQax5YmIrgcuEHwOhAB//yc8=</data> </nowiki>
<key>Trusted</key>
<true />
</dict>
<key>BatteryCharging0</key>
<dict>
... See AppleLogo dictionary.
</dict>
<key>BatteryCharging1</key>
<dict>
...
</dict>
<key>BatteryFull</key>
<dict>
...
</dict>
<key>BatteryLow0</key>
<dict>
...
</dict>
<key>BatteryLow1</key>
<dict>
...
</dict>
<key>BatteryPlugin</key>
<dict>
...
</dict>
<key>DeviceTree</key>
<dict>
...
</dict>
<key>KernelCache</key>
<dict>
...
</dict>
<key>LLB</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhRAgC22ZPWJB9J1Nh3H+0XeyRTU72ObA==</data> </nowiki>
...
</dict>
<key>RecoveryMode</key>
<dict>
...
</dict>
<key>RestoreDeviceTree</key>
<dict>
...
</dict>
<key>RestoreKernelCache</key>
<dict>
...
</dict>
<key>RestoreLogo</key>
<dict>
...
</dict>
<key>RestoreRamDisk</key>
<dict>
...
</dict>
<key>[[iBEC]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
...
</dict>
<key>[[iBSS]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhBAQCRc2PuoresMjW7zNLePMPmX7zaHg==</data> </nowiki>
...
</dict>
<key>[[iBoot]]</key>
<dict>
...
</dict>
</dict>
</plist>

===Receiving data (answer)===
The response is a simple HTTP POST response, containing 3 values: STATUS, MESSAGE (a description string) and REQUEST_STRING (only if the request was successful). STATUS contains numeric status, MESSAGE contains an error message on error and "SUCCESS" string on success and REQUEST_STRING contains response property list encoded as XML.

===Status responses===
*'''STATUS=0&MESSAGE=SUCCESS'''
** The request was sent successfully, and a response was returned.'''
*'''STATUS=8&MESSAGE=An internal error occurred.'''
** A key contained an unknown name.
*'''STATUS=83&MESSAGE=An internal error occurred.'''
** A key was assigned an invalid value type.
*'''STATUS=92&MESSAGE=An internal error occurred.'''
** The request contained more than 65536 bytes.
*'''STATUS=93&MESSAGE=An internal error occurred.'''
** The request contained less than 10 bytes.
*'''STATUS=94&MESSAGE=This device isn't eligible for the requested build.'''
** The specified build is either unsigned or nonexistent.
*'''STATUS=98&MESSAGE=An internal error occurred.'''
** The XML/PList identification tag is missing or the start of the tag is malformed.
*'''STATUS=100&MESSAGE=An internal error occurred.'''
** A general XML error was found: the XML/PList version is nonexistent or not "1.0", the end of the XML/PList identification tag is malformed, an unknown or empty tag was found, the root <code><plist></code> tag is missing, no keys were found, a value tag contained an invalid type, an unescaped ampersand character was found, two consecutive dash characters were found in a comment, or a tag was found without its counterpart.
*'''STATUS=103&MESSAGE=An internal error occurred.'''
** Multiple '@' characters were found at the beginning of a key name.
*'''STATUS=128&MESSAGE=An internal error occurred.'''
*'''STATUS=511&MESSAGE=No data in the request'''
*'''STATUS=551&MESSAGE=Error occured while importing config packet with cpsn: '''
*'''STATUS=5000&MESSAGE=Invalid Option!'''

===Notes===
* Interestingly, if all you're interested in is the ServerVersion (and a SUCCESS response), sending any one valid Ap-prefixed key will do, like so:
<?xml version="1.0"?>
<plist>
<dict>
<key>ApSecurityDomain</key>
<integer>1</integer>
</dict>
</plist>

* In regards to fuzzing and malformed data, the server (as of 2.1.0, at least) seems to have no bounds checking for the ApNonce, or even checking to see if the ApNonce exists. Because the APTicket changes even when specifying an invalid-sized nonce, it is assumed nonces too short are padded while nonces too large are ignored past the 16th character.

* Most textual characters between tags are ignored. For example, inserting non-bracket text (excluding XML special characters, such as '&') after a <code><dict></code> and before the following <code><key></code> will have no effect.

* A version string in the XML/Plist identification tag is '''required''', or a <code>STATUS=100</code> internal error message will result. Any encoding string provided is ignored and defaulted to (presumably) "UTF-8".

* The DOCTYPE tag is completely ignored. As such, specifying any non-PList DTD has no effect.

===Other parameters / open questions===
Some parameters could have other values. Not all details are known.
*ApSecurityDomain: Meaning? (Related to [[SDOM]] tag)
*Trusted: What is this for?
*Full description of the above values for UniqueBuildID, Digest, PartialDigest and BuildString.

==PartialDigest==
The PartialDigest is structured like so:

typedef struct PartialDigest {
uint32_t transformSize; // Always 0x40.
uint32_t img3DataSize; // data size of the img3.
uint8_t hash[SHA1HashSize]; // Result of SHA1ResultPartial from the stripped img3.
};

The img3 is first stripped of it's code signature (if present) and then passed through SHA1Update. SHA1ResultPartial is then performed. It is purposely not the final resulting SHA1. The reason for this being, when TSS processes the PartialDigest, it performs one more SHA1Update on the hash to include the [[ECID]] before doing SHA1Final and creating the SHSH blob.

Code for SHA1ResultPartial:
int SHA1ResultPartial(SHA1Context* ctx, unsigned char* buf) {
// Do we have valid buffer and context pointers?
if(ctx && buf) {
// Is the Context in good shape?
if(!ctx->Corrupted && !ctx->Computed && !ctx->Message_Block_Index) {
for(int i = 0; i < SHA1HashSize; i++) {
buf[i] = ctx->Intermediate_Hash[i >> 2] >> 8 * (3 - (i & 0x3));
}
return 0;
}
}
return 1;
}
Code for tss_strip_img3_signature:
int tss_strip_img3_signature(img3Header* img3, int* len) {
// Do we have a non-null ptr?
if(!img3) {
return 10004;
}
// Does the buffer start with the img3 magic?
if(img3->magic != IMG3_MAGIC) {
printf("tss_strip_img3_signature: bad magic 0x%08x expecting 0x%08x\n", img3->magic, IMG3_MAGIC);
return 10004;
}
// Sanity checks
if(img3->shshOffset > img3->dataSize) {
printf("tss_strip_img3_signature: signed length %u too large for buffer length %u\n", img3->shshOffset, img3->dataSize);
return 10004;
}
// Trim the image by adjusting the header.
if(img3->shshOffset) {
*len += img3->shshOffset - img3->dataSize;
img3->dataSize = img3->shshOffset;
img3->fullSize = *len;
}
return 0;
}

==Digest==
Digest is the SHA1 of the stripped img3. They are used instead of PartialDigests for the APTicket since the ticket is already personalized for the ECID and all other tags.

[[Category:Firmware Tags]]

SHSH Protocol

2020-02-15T07:07:46Z

Vanished user 20210509: Added "Action types

Here is a description of the protocol that is used when [[iTunes]] requests the [[SHSH]] certificate from Apple. For details about what this is used for, please see the main article [[SHSH]].

This is a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] ([[wikipedia:POST (HTTP)|POST]]) request and answer. You can retry this via a [[wikipedia:Telnet|Telnet]] session or similar. The destination host is [http://gs.apple.com/TSS/controller?action=2 gs.apple.com] and runs on the common [[wikipedia:TCP and UDP port|port]] 80. The data is plaintext and not encoded in any way. For details about the [[wikipedia:Hypertext Transfer Protocol|HTTP]] protocol itself, please see [http://www.w3.org/Protocols/HTTP/1.1/rfc2616.pdf RFC2616].

===Action types===
Attached to the http://gs.apple.com/TSS/controller URL is commonly <code>?action=2</code>, which can be discovered when performing an iTunes restore and observing packets sent with a packet sniffer such as [https://www.wireshark.org Wireshark]. However, values other than 2 may produce different server responses, of which all known value/response pairs have been listed below.

* <code>?action=0</code>: Performs a "Tatsu Signing Server HealthCheck", returning an HTML body of "Server not ready". This may be a general ping protocol for ensuring the TSS service is online.
* <code>?action=2</code>: Common SHSH protocol. See [[#Status responses]] for all known server responses.
* <code>?action=3</code>: Functionally the same as <code>?action=2</code>.
* <code>?action=5</code>: Generates <code>respCode</code> and <code>respMsg</code>. This response syntax differs slightly from the SHSH protocol. The name "cspn" is referenced.

All unlisted action types appear to respond without HTML content, only status.

===Sending data (request)===
The request is actually a single XML-encoded property list. It contains a dictionary which describes the target iOS version, restore behavior, etc. Some of the required information can be taken from the BuildManifest.plist. BuildManifest contains some info about the firmware version and "BuildIdentities" dictionary. Inside it you can find two (or more?) build identities. Each of them contains the information which depends on every type of restore ("Erase" or "Update"). Some information is device-dependent (ECID, nonce) and is received from the device.

Request property list should have these properties:

* '''@APTicket:''' Optional boolean value. If true, the server adds an [[APTicket]] to the request.
* '''@BBTicket:''' Optional boolean value. The same for the [[BBTicket]].
* '''@UDID:''' Optional string value. Just request UDID (ex. D9C1F33D-62E0-4D25-8068-F5F46FE80057).
* '''@HostPlatformInfo:''' Optional string value. "mac" for OS X client, "windows" for Windows client (can be everything you want).
* '''@Locality:''' Optional string value. Language used for the error response (ex. "en_US").
* '''@VersionInfo:''' Optional string value. The version of 'libauthinstall' used (ex. "libauthinstall-391.0.0.1.3"). You can pass any string here.
* '''ApBoardID:''' Integer value. [[BORD |Board ID]] of the target device. You can take this value from build manifest.
* '''ApChipID:''' Integer value. [[CHIP|Chip ID]] of the target device. You can take this value from build manifest.
* '''ApECID:''' Integer value. [[ECID]] of the target device.
* '''ApNonce:''' Data value. The [[nonce]] generated by your device.
* '''ApProductionMode:''' Boolean value. Always true (unless your SOC is PROD 0 - Apple only).
* '''ApSecurityDomain:''' Integer value. The use is unknown. You can take this value from build manifest.
* '''UniqueBuildID:''' Optional data value. This is a unique identifier for every build (different even for "Erase" and "Update" types of restore). You can take this value from build manifest.

The SHSH request also contains information about files from the [[IPSW]] (or restore bundle for [[PurpleRestore]]). They can be obtained from the 'build identity' you've chosen in the previous step. Each 'build identity' contains a "Manifest" dictionary. It's entries look like
<key>BatteryCharging0</key>
<dict>
<key>Digest</key>
<nowiki><data>...</data></nowiki>
<key>Info</key>
<dict>...</dict>
<key>Trusted<key/>
<true/>
<dict/>
They are just copied to the SHSH request, but the "Info" dictionary is removed.
Example of a SHSH request (... values are identical, *** values are different per device):
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>@[[APTicket]]</key>
<true />
<key>@[[BBTicket]]</key>
<true />
<key>@HostPlatformInfo</key>
<string>mac</string>
<key>@Locality</key>
<string>en_US</string>
<key>@UUID</key>
<string>D9C1F33D-62E0-4D25-8068-F5F46FE80057</string>
<key>@VersionInfo</key>
<string>libauthinstall-391.0.0.1.3</string>
<key>[[BORD |ApBoardID]]</key>
<integer>10</integer>
<key>[[CHIP |ApChipID]]</key>
<integer>35152</integer>
<key>[[ECID |ApECID]]</key>
<integer>***</integer>
<key>[[Nonce |ApNonce]]</key>
<nowiki><data>***</data> </nowiki>
<key>ApProductionMode</key>
<true />
<key>ApSecurityDomain</key>
<integer>1</integer>
<key>UniqueBuildID</key>
<data> fqzW0B++Zdrs+PRwohkwU6prjbk=</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<nowiki><data> uH5QQax5YmIrgcuEHwOhAB//yc8=</data> </nowiki>
<key>Trusted</key>
<true />
</dict>
<key>BatteryCharging0</key>
<dict>
... See AppleLogo dictionary.
</dict>
<key>BatteryCharging1</key>
<dict>
...
</dict>
<key>BatteryFull</key>
<dict>
...
</dict>
<key>BatteryLow0</key>
<dict>
...
</dict>
<key>BatteryLow1</key>
<dict>
...
</dict>
<key>BatteryPlugin</key>
<dict>
...
</dict>
<key>DeviceTree</key>
<dict>
...
</dict>
<key>KernelCache</key>
<dict>
...
</dict>
<key>LLB</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhRAgC22ZPWJB9J1Nh3H+0XeyRTU72ObA==</data> </nowiki>
...
</dict>
<key>RecoveryMode</key>
<dict>
...
</dict>
<key>RestoreDeviceTree</key>
<dict>
...
</dict>
<key>RestoreKernelCache</key>
<dict>
...
</dict>
<key>RestoreLogo</key>
<dict>
...
</dict>
<key>RestoreRamDisk</key>
<dict>
...
</dict>
<key>[[iBEC]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
...
</dict>
<key>[[iBSS]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhBAQCRc2PuoresMjW7zNLePMPmX7zaHg==</data> </nowiki>
...
</dict>
<key>[[iBoot]]</key>
<dict>
...
</dict>
</dict>
</plist>

===Receiving data (answer)===
The response is a simple HTTP POST response, containing 3 values: STATUS, MESSAGE (a description string) and REQUEST_STRING (only if the request was successful). STATUS contains numeric status, MESSAGE contains an error message on error and "SUCCESS" string on success and REQUEST_STRING contains response property list encoded as XML.

===Status responses===
*'''STATUS=0&MESSAGE=SUCCESS'''
** The request was sent successfully, and a response was returned.'''
*'''STATUS=8&MESSAGE=An internal error occurred.'''
** A key contained an unknown name.
*'''STATUS=83&MESSAGE=An internal error occurred.'''
** A key was assigned an invalid value type.
*'''STATUS=92&MESSAGE=An internal error occurred.'''
** The request contained more than 65536 bytes.
*'''STATUS=93&MESSAGE=An internal error occurred.'''
** The request contained less than 10 bytes.
*'''STATUS=94&MESSAGE=This device isn't eligible for the requested build.'''
** The specified build is either unsigned or nonexistent.
*'''STATUS=98&MESSAGE=An internal error occurred.'''
** The XML/PList identification tag is missing or the start of the tag is malformed.
*'''STATUS=100&MESSAGE=An internal error occurred.'''
** A general XML error was found: the XML/PList version is nonexistent or not "1.0", the end of the XML/PList identification tag is malformed, an unknown or empty tag was found, the root <code><plist></code> tag is missing, no keys were found, a value tag contained an invalid type, an unescaped ampersand character was found, two consecutive dash characters were found in a comment, or a tag was found without its counterpart.
*'''STATUS=103&MESSAGE=An internal error occurred.'''
** Multiple '@' characters were found at the beginning of a key name.
*'''STATUS=128&MESSAGE=An internal error occurred.'''
*'''STATUS=511&MESSAGE=No data in the request'''
*'''STATUS=551&MESSAGE=Error occured while importing config packet with cpsn: '''
*'''STATUS=5000&MESSAGE=Invalid Option!'''

===Notes===
* Interestingly, if all you're interested in is the ServerVersion (and a SUCCESS response), sending any one valid Ap-prefixed key will do, like so:
<?xml version="1.0"?>
<plist>
<dict>
<key>ApSecurityDomain</key>
<integer>1</integer>
</dict>
</plist>

* In regards to fuzzing and malformed data, the server (as of 2.1.0, at least) seems to have no bounds checking for the ApNonce, or even checking to see if the ApNonce exists. Because the APTicket changes even when specifying an invalid-sized nonce, it is assumed nonces too short are padded while nonces too large are ignored past the 16th character.

* Most textual characters between tags are ignored. For example, inserting non-bracket text (excluding XML special characters, such as '&') after a <code><dict></code> and before the following <code><key></code> will have no effect.

* A version string in the XML/Plist identification tag is '''required''', or a <code>STATUS=100</code> internal error message will result. Any encoding string provided is ignored and defaulted to (presumably) "UTF-8".

* The DOCTYPE tag is completely ignored. As such, specifying any non-PList DTD has no effect.

===Other parameters / open questions===
Some parameters could have other values. Not all details are known.
*ApSecurityDomain: Meaning? (Related to [[SDOM]] tag)
*Trusted: What is this for?
*Full description of the above values for UniqueBuildID, Digest, PartialDigest and BuildString.

===PartialDigest===
The PartialDigest is structured like so:

typedef struct PartialDigest {
uint32_t transformSize; // Always 0x40.
uint32_t img3DataSize; // data size of the img3.
uint8_t hash[SHA1HashSize]; // Result of SHA1ResultPartial from the stripped img3.
};

The img3 is first stripped of it's code signature (if present) and then passed through SHA1Update. SHA1ResultPartial is then performed. It is purposely not the final resulting SHA1. The reason for this being, when TSS processes the PartialDigest, it performs one more SHA1Update on the hash to include the [[ECID]] before doing SHA1Final and creating the SHSH blob.

Code for SHA1ResultPartial:
int SHA1ResultPartial(SHA1Context* ctx, unsigned char* buf) {
// Do we have valid buffer and context pointers?
if(ctx && buf) {
// Is the Context in good shape?
if(!ctx->Corrupted && !ctx->Computed && !ctx->Message_Block_Index) {
for(int i = 0; i < SHA1HashSize; i++) {
buf[i] = ctx->Intermediate_Hash[i >> 2] >> 8 * (3 - (i & 0x3));
}
return 0;
}
}
return 1;
}
Code for tss_strip_img3_signature:
int tss_strip_img3_signature(img3Header* img3, int* len) {
// Do we have a non-null ptr?
if(!img3) {
return 10004;
}
// Does the buffer start with the img3 magic?
if(img3->magic != IMG3_MAGIC) {
printf("tss_strip_img3_signature: bad magic 0x%08x expecting 0x%08x\n", img3->magic, IMG3_MAGIC);
return 10004;
}
// Sanity checks
if(img3->shshOffset > img3->dataSize) {
printf("tss_strip_img3_signature: signed length %u too large for buffer length %u\n", img3->shshOffset, img3->dataSize);
return 10004;
}
// Trim the image by adjusting the header.
if(img3->shshOffset) {
*len += img3->shshOffset - img3->dataSize;
img3->dataSize = img3->shshOffset;
img3->fullSize = *len;
}
return 0;
}

===Digest===
Digest is the SHA1 of the stripped img3. They are used instead of PartialDigests for the APTicket since the ticket is already personalized for the ECID and all other tags.

[[Category:Firmware Tags]]

SHSH Protocol

2020-02-14T20:10:13Z

Vanished user 20210509: More notes, general fixes. Removed IP note on gs.apple.com; those attempting to send TSS requests should use gs.apple.com instead of an IP, which may change

Here is a description about the protocol that is used when [[iTunes]] requests the [[SHSH]] certificate from Apple. For details about what this is used for, please see the main article [[SHSH]].

This is a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] ([[wikipedia:POST (HTTP)|POST]]) request and answer. You can retry this via a [[wikipedia:Telnet|Telnet]] session or similar. The destination host is [http://gs.apple.com/TSS/controller?action=2 gs.apple.com] and runs on the common [[wikipedia:TCP and UDP port|port]] 80. The data is plaintext and not encoded in any way. For details about the [[wikipedia:Hypertext Transfer Protocol|HTTP]] protocol itself, please see [http://www.w3.org/Protocols/HTTP/1.1/rfc2616.pdf RFC2616].

===Sending data (request)===
The request is actually a single XML encoded poperty list. It contains a dictionary which describes the target iOS version, restore behavior etc. Some of the required information can be taken from the BuildManifest.plist. BuildManifest contains some info about the firmware version and "BuildIdentities" dictionary. Inside it you can find two (or more?) build identities. Each of them contains the information which depends on every type of restore ("Erase" or "Update"). Some information is device-dependent (ECID, nonce) and is received from the device.

Request property list should have these properties:

* '''@APTicket:''' Optional boolean value. If true, the server adds an [[APTicket]] to the request.
* '''@BBTicket:''' Optional boolean value. The same for the [[BBTicket]].
* '''@UDID:''' Optional string value. Just request UDID (ex. D9C1F33D-62E0-4D25-8068-F5F46FE80057).
* '''@HostPlatformInfo:''' Optional string value. "mac" for OS X client, "windows" for Windows client (can be everything you want).
* '''@Locality:''' Optional string value. Language used for the error response (ex. "en_US").
* '''@VersionInfo:''' Optional string value. The version of 'libauthinstall' used (ex. "libauthinstall-391.0.0.1.3"). You can pass any string here.
* '''ApBoardID:''' Integer value. [[BORD |Board ID]] of the target device. You can take this value from build manifest.
* '''ApChipID:''' Integer value. [[CHIP|Chip ID]] of the target device. You can take this value from build manifest.
* '''ApECID:''' Integer value. [[ECID]] of the target device.
* '''ApNonce:''' Data value. The [[nonce]] generated by your device.
* '''ApProductionMode:''' Boolean value. Always true (unless your SOC is PROD 0 - Apple only).
* '''ApSecurityDomain:''' Integer value. The use is unknown. You can take this value from build manifest.
* '''UniqueBuildID:''' Optional data value. This is a unique identifier for every build (different even for "Erase" and "Update" types of restore). You can take this value from build manifest.

The SHSH request also contains information about files from the [[IPSW]] (or restore bundle for [[PurpleRestore]]). They can be obtained from the 'build identity' you've chosen in the previous step. Each 'build identity' contains a "Manifest" dictionary. It's entries look like
<key>BatteryCharging0</key>
<dict>
<key>Digest</key>
<nowiki><data>...</data></nowiki>
<key>Info</key>
<dict>...</dict>
<key>Trusted<key/>
<true/>
<dict/>
They are just copied to the SHSH request, but the "Info" dictionary is removed.
Example of a SHSH request (... values are identical, *** values are different per device):
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>@[[APTicket]]</key>
<true />
<key>@[[BBTicket]]</key>
<true />
<key>@HostPlatformInfo</key>
<string>mac</string>
<key>@Locality</key>
<string>en_US</string>
<key>@UUID</key>
<string>D9C1F33D-62E0-4D25-8068-F5F46FE80057</string>
<key>@VersionInfo</key>
<string>libauthinstall-391.0.0.1.3</string>
<key>[[BORD |ApBoardID]]</key>
<integer>10</integer>
<key>[[CHIP |ApChipID]]</key>
<integer>35152</integer>
<key>[[ECID |ApECID]]</key>
<integer>***</integer>
<key>[[Nonce |ApNonce]]</key>
<nowiki><data>***</data> </nowiki>
<key>ApProductionMode</key>
<true />
<key>ApSecurityDomain</key>
<integer>1</integer>
<key>UniqueBuildID</key>
<data> fqzW0B++Zdrs+PRwohkwU6prjbk=</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<nowiki><data> uH5QQax5YmIrgcuEHwOhAB//yc8=</data> </nowiki>
<key>Trusted</key>
<true />
</dict>
<key>BatteryCharging0</key>
<dict>
... See AppleLogo dictionary.
</dict>
<key>BatteryCharging1</key>
<dict>
...
</dict>
<key>BatteryFull</key>
<dict>
...
</dict>
<key>BatteryLow0</key>
<dict>
...
</dict>
<key>BatteryLow1</key>
<dict>
...
</dict>
<key>BatteryPlugin</key>
<dict>
...
</dict>
<key>DeviceTree</key>
<dict>
...
</dict>
<key>KernelCache</key>
<dict>
...
</dict>
<key>LLB</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhRAgC22ZPWJB9J1Nh3H+0XeyRTU72ObA==</data> </nowiki>
...
</dict>
<key>RecoveryMode</key>
<dict>
...
</dict>
<key>RestoreDeviceTree</key>
<dict>
...
</dict>
<key>RestoreKernelCache</key>
<dict>
...
</dict>
<key>RestoreLogo</key>
<dict>
...
</dict>
<key>RestoreRamDisk</key>
<dict>
...
</dict>
<key>[[iBEC]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
...
</dict>
<key>[[iBSS]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhBAQCRc2PuoresMjW7zNLePMPmX7zaHg==</data> </nowiki>
...
</dict>
<key>[[iBoot]]</key>
<dict>
...
</dict>
</dict>
</plist>

===Receiving data (answer)===
The response is a simple HTTP POST response, containing 3 values: STATUS, MESSAGE (a description string) and REQUEST_STRING (only if the request was successful). STATUS contains numeric status, MESSAGE contains an error message on error and "SUCCESS" string on success and REQUEST_STRING contains response property list encoded as XML.

===Status responses===
*'''STATUS=0&MESSAGE=SUCCESS'''
** The request was sent successfully, and a response was returned.'''
*'''STATUS=8&MESSAGE=An internal error occurred.'''
** A key contained an unknown name.
*'''STATUS=83&MESSAGE=An internal error occurred.'''
** A key was assigned an invalid value type.
*'''STATUS=92&MESSAGE=An internal error occurred.'''
** The request contained more than 65536 bytes.
*'''STATUS=93&MESSAGE=An internal error occurred.'''
** The request contained less than 10 bytes.
*'''STATUS=94&MESSAGE=This device isn't eligible for the requested build.'''
** The specified build is either unsigned or nonexistent.
*'''STATUS=98&MESSAGE=An internal error occurred.'''
** The XML/PList identification tag is missing or the start of the tag is malformed.
*'''STATUS=100&MESSAGE=An internal error occurred.'''
** A general XML error was found: the XML/PList version is nonexistent or not "1.0", the end of the XML/PList identification tag is malformed, an unknown or empty tag was found, the root <code><plist></code> tag is missing, no keys were found, a value tag contained an invalid type, an unescaped ampersand character was found, two consecutive dash characters were found in a comment, or a tag was found without its counterpart.
*'''STATUS=103&MESSAGE=An internal error occurred.'''
** Multiple '@' characters were found at the beginning of a key name.
*'''STATUS=128&MESSAGE=An internal error occurred.'''
*'''STATUS=511&MESSAGE=No data in the request'''
*'''STATUS=551&MESSAGE=Error occured while importing config packet with cpsn: '''
*'''STATUS=5000&MESSAGE=Invalid Option!'''

===Notes===
* Interestingly, if all you're interested in is the ServerVersion (and a SUCCESS response), sending any one valid Ap-prefixed key will do, like so:
<?xml version="1.0"?>
<plist>
<dict>
<key>ApSecurityDomain</key>
<integer>1</integer>
</dict>
</plist>

* In regards to fuzzing and malformed data, the server (as of 2.1.0, at least) seems to have no bounds checking for the ApNonce, or even checking to see if the ApNonce exists. Because the APTicket changes even when specifying an invalid-sized nonce, it is assumed nonces too short are padded while nonces too large are ignored past the 16th character.

* Most textual characters between tags are ignored. For example, inserting non-bracket text (excluding XML special characters, such as '&') after a <code><dict></code> and before the following <code><key></code> will have no effect.

* A version string in the XML/Plist identification tag is '''required''', or a <code>STATUS=100</code> internal error message will result. Any encoding string provided is ignored and defaulted to (presumably) "UTF-8".

* The DOCTYPE tag is completely ignored. As such, specifying any non-PList DTD has no effect.

===Other parameters / open questions===
Some parameters could have other values. Not all details are known.
*<code>action=2</code> in the request. What other values exist, and what is their meaning?
*ApSecurityDomain: Meaning? (Related to [[SDOM]] tag)
*Trusted: What is this for?
*Full description of the above values for UniqueBuildID, Digest, PartialDigest and BuildString.

===PartialDigest===
The PartialDigest is structured like so:

typedef struct PartialDigest {
uint32_t transformSize; // Always 0x40.
uint32_t img3DataSize; // data size of the img3.
uint8_t hash[SHA1HashSize]; // Result of SHA1ResultPartial from the stripped img3.
};

The img3 is first stripped of it's code signature (if present) and then passed through SHA1Update. SHA1ResultPartial is then performed. It is purposely not the final resulting SHA1. The reason for this being, when TSS processes the PartialDigest, it performs one more SHA1Update on the hash to include the [[ECID]] before doing SHA1Final and creating the SHSH blob.

Code for SHA1ResultPartial:
int SHA1ResultPartial(SHA1Context* ctx, unsigned char* buf) {
// Do we have valid buffer and context pointers?
if(ctx && buf) {
// Is the Context in good shape?
if(!ctx->Corrupted && !ctx->Computed && !ctx->Message_Block_Index) {
for(int i = 0; i < SHA1HashSize; i++) {
buf[i] = ctx->Intermediate_Hash[i >> 2] >> 8 * (3 - (i & 0x3));
}
return 0;
}
}
return 1;
}
Code for tss_strip_img3_signature:
int tss_strip_img3_signature(img3Header* img3, int* len) {
// Do we have a non-null ptr?
if(!img3) {
return 10004;
}
// Does the buffer start with the img3 magic?
if(img3->magic != IMG3_MAGIC) {
printf("tss_strip_img3_signature: bad magic 0x%08x expecting 0x%08x\n", img3->magic, IMG3_MAGIC);
return 10004;
}
// Sanity checks
if(img3->shshOffset > img3->dataSize) {
printf("tss_strip_img3_signature: signed length %u too large for buffer length %u\n", img3->shshOffset, img3->dataSize);
return 10004;
}
// Trim the image by adjusting the header.
if(img3->shshOffset) {
*len += img3->shshOffset - img3->dataSize;
img3->dataSize = img3->shshOffset;
img3->fullSize = *len;
}
return 0;
}

===Digest===
Digest is the SHA1 of the stripped img3. They are used instead of PartialDigests for the APTicket since the ticket is already personalized for the ECID and all other tags.

[[Category:Firmware Tags]]

SHSH Protocol

2020-02-14T02:10:24Z

Vanished user 20210509: A few new quirks/notes discovered

Here is a description about the protocol that is used when [[iTunes]] requests the [[SHSH]] certificate from Apple. For details about what this is used for, please see the main article [[SHSH]].

This is a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] ([[wikipedia:POST (HTTP)|POST]]) request and answer. You can retry this via a [[wikipedia:Telnet|Telnet]] session or similar. The destination host is gs.apple.com (IP 17.171.36.30 [previously 17.112.176.11]) and runs on the common [[wikipedia:TCP and UDP port|port]] 80. The data is plaintext and not encoded in any way. For details about the [[wikipedia:Hypertext Transfer Protocol|HTTP]] protocol itself, please see [http://www.w3.org/Protocols/HTTP/1.1/rfc2616.pdf RFC2616].

===Sending data (request)===
The request is actually a single XML encoded poperty list. It contains a dictionary which describes the target iOS version, restore behavior etc. Some of the required information can be taken from the BuildManifest.plist. BuildManifest contains some info about the firmware version and "BuildIdentities" dictionary. Inside it you can find two (or more?) build identities. Each of them contains the information which depends on every type of restore ("Erase" or "Update"). Some information is device-dependent (ECID, nonce) and is received from the device.

Request property list should have these properties:

* @APTicket: Optional boolean value. If true, the server adds an [[APTicket]] to the request.
* @BBTicket: Optional boolean value. The same for the [[BBTicket]].
* @UDID: Optional string value. Just request UDID. (ex. D9C1F33D-62E0-4D25-8068-F5F46FE80057).
* @HostPlatformInfo: Optional string value. "mac" for OS X client, "windows" for windows client (can be everything you want).
* @Locality: Optional string value. Language used for the error response (ex. "en_US");
* @VersionInfo: Optional string value. The version of 'libauthinstall' used (ex. "libauthinstall-391.0.0.1.3"). You can pass any string here.
* ApBoardID: Integer value. [[BORD |Board ID]] of the target device. You can take this value from build manifest.
* ApChipID: Integer value. [[CHIP|Chip ID]] of the target device. You can take this value from build manifest.
* ApECID: Integer value. [[ECID]] of the target device.
* ApNonce: Data value. The [[nonce]] generated by your device.
* ApProductionMode: Boolean value. Always true (unless your SOC is PROD 0 - Apple only).
* ApSecurityDomain: Integer value. The use is unknown. You can take this value from build manifest.
* UniqueBuildID: Optional data value. This is a unique identifier for every build (different even for "Erase" and "Update" types of restore). You can take this value from build manifest.

The SHSH request also contains information about files from the [[IPSW]] (or restore bundle for [[PurpleRestore]]). They can be obtained from the 'build identity' you've chosen in the previous step. Each 'build identity' contains a "Manifest" dictionary. It's entries look like
<key>BatteryCharging0</key>
<dict>
<key>Digest</key>
<nowiki><data>...</data></nowiki>
<key>Info</key>
<dict>...</dict>
<key>Trusted<key/>
<true/>
<dict/>
They are just copied to the SHSH request, but the "Info" dictionary is removed.
Example of a SHSH request (... values are identical, *** values are different per device):
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>@[[APTicket]]</key>
<true />
<key>@[[BBTicket]]</key>
<true />
<key>@HostPlatformInfo</key>
<string>mac</string>
<key>@Locality</key>
<string>en_US</string>
<key>@UUID</key>
<string>D9C1F33D-62E0-4D25-8068-F5F46FE80057</string>
<key>@VersionInfo</key>
<string>libauthinstall-391.0.0.1.3</string>
<key>[[BORD |ApBoardID]]</key>
<integer>10</integer>
<key>[[CHIP |ApChipID]]</key>
<integer>35152</integer>
<key>[[ECID |ApECID]]</key>
<integer>***</integer>
<key>[[Nonce |ApNonce]]</key>
<nowiki><data>***</data> </nowiki>
<key>ApProductionMode</key>
<true />
<key>ApSecurityDomain</key>
<integer>1</integer>
<key>UniqueBuildID</key>
<data> fqzW0B++Zdrs+PRwohkwU6prjbk=</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<nowiki><data> uH5QQax5YmIrgcuEHwOhAB//yc8=</data> </nowiki>
<key>Trusted</key>
<true />
</dict>
<key>BatteryCharging0</key>
<dict>
... See AppleLogo dictionary.
</dict>
<key>BatteryCharging1</key>
<dict>
...
</dict>
<key>BatteryFull</key>
<dict>
...
</dict>
<key>BatteryLow0</key>
<dict>
...
</dict>
<key>BatteryLow1</key>
<dict>
...
</dict>
<key>BatteryPlugin</key>
<dict>
...
</dict>
<key>DeviceTree</key>
<dict>
...
</dict>
<key>KernelCache</key>
<dict>
...
</dict>
<key>LLB</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhRAgC22ZPWJB9J1Nh3H+0XeyRTU72ObA==</data> </nowiki>
...
</dict>
<key>RecoveryMode</key>
<dict>
...
</dict>
<key>RestoreDeviceTree</key>
<dict>
...
</dict>
<key>RestoreKernelCache</key>
<dict>
...
</dict>
<key>RestoreLogo</key>
<dict>
...
</dict>
<key>RestoreRamDisk</key>
<dict>
...
</dict>
<key>[[iBEC]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
...
</dict>
<key>[[iBSS]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhBAQCRc2PuoresMjW7zNLePMPmX7zaHg==</data> </nowiki>
...
</dict>
<key>[[iBoot]]</key>
<dict>
...
</dict>
</dict>
</plist>

===Receiving data (answer)===
The response is a simple HTTP POST response, containing 3 values: STATUS, MESSAGE (a description string) and REQUEST_STRING (only if the request was successful). STATUS contains numeric status, MESSAGE contains an error message on error and "SUCCESS" string on success and REQUEST_STRING contains response property list encoded as XML.

===Status responses===
*'''STATUS=0&MESSAGE=SUCCESS'''
** The request was sent successfully, and a response was returned.'''
*'''STATUS=8&MESSAGE=An internal error occurred.'''
** A key contained an unknown name.
*'''STATUS=83&MESSAGE=An internal error occurred.'''
** A key was assigned an invalid value type.
*'''STATUS=92&MESSAGE=An internal error occurred.'''
** The request contained more than 65536 bytes.
*'''STATUS=93&MESSAGE=An internal error occurred.'''
** The request contained less than 10 bytes.
*'''STATUS=94&MESSAGE=This device isn't eligible for the requested build.'''
** The specified build is either unsigned or nonexistent.
*'''STATUS=98&MESSAGE=An internal error occurred.'''
** The XML/PList identification tag is missing, or the start of the tag is malformed.
*'''STATUS=100&MESSAGE=An internal error occurred.'''
** The XML/PList version is nonexistent or not "1.0", the end of the XML/PList identification tag is malformed, an unknown tag was found, a value tag contained an invalid type, an unescaped ampersand character was found, or a tag was found without its counterpart.
*'''STATUS=103&MESSAGE=An internal error occurred.'''
** Multiple '@' characters were found at the beginning of a key name.
*'''STATUS=128&MESSAGE=An internal error occurred.'''
*'''STATUS=511&MESSAGE=No data in the request'''
*'''STATUS=551&MESSAGE=Error occured while importing config packet with cpsn: '''
*'''STATUS=5000&MESSAGE=Invalid Option!'''

===Notes===
* Interestingly, if all you're interested in is the ServerVersion (and a SUCCESS response), sending any one valid Ap-prefixed key will do, like so:
<?xml version="1.0"?>
<plist>
<dict>
<key>ApSecurityDomain</key>
<integer>1</integer>
</dict>
</plist>

* In regards to fuzzing and malformed data, the server (as of 2.1.0, at least) seems to have no bounds checking for the ApNonce, or even checking to see if the ApNonce exists. Because the APTicket changes even when specifying an invalid-sized nonce, it is assumed nonces too short are padded while nonces too large are ignored past the 16th character.

* Most textual characters between tags are ignored. For example, inserting non-bracket text (excluding XML special characters, such as '&') after a <code><dict></code> and before the following <code><key></code> will have no effect.

* A version string in the XML/Plist identification tag is '''required''', or a <code>STATUS=100</code> internal message will result.

===Other parameters / open questions===
Some parameters could have other values. Not all details are known.
*action=2 in the request. What other values exist and what is their meaning?
*ApSecurityDomain Meaning? (Related to [[SDOM]] tag)
*Trusted What is this for?
*Full description of the above values for UniqueBuildID, Digest, PartialDigest and BuildString.

===PartialDigest===
The PartialDigest is structured like so:

typedef struct PartialDigest {
uint32_t transformSize; // Always 0x40.
uint32_t img3DataSize; // data size of the img3.
uint8_t hash[SHA1HashSize]; // Result of SHA1ResultPartial from the stripped img3.
};

The img3 is first stripped of it's code signature (if present) and then passed through SHA1Update. SHA1ResultPartial is then performed. It is purposely not the final resulting SHA1. The reason for this being, when TSS processes the PartialDigest, it performs one more SHA1Update on the hash to include the [[ECID]] before doing SHA1Final and creating the SHSH blob.

Code for SHA1ResultPartial:
int SHA1ResultPartial(SHA1Context* ctx, unsigned char* buf) {
// Do we have valid buffer and context pointers?
if(ctx && buf) {
// Is the Context in good shape?
if(!ctx->Corrupted && !ctx->Computed && !ctx->Message_Block_Index) {
for(int i = 0; i < SHA1HashSize; i++) {
buf[i] = ctx->Intermediate_Hash[i >> 2] >> 8 * (3 - (i & 0x3));
}
return 0;
}
}
return 1;
}
Code for tss_strip_img3_signature:
int tss_strip_img3_signature(img3Header* img3, int* len) {
// Do we have a non-null ptr?
if(!img3) {
return 10004;
}
// Does the buffer start with the img3 magic?
if(img3->magic != IMG3_MAGIC) {
printf("tss_strip_img3_signature: bad magic 0x%08x expecting 0x%08x\n", img3->magic, IMG3_MAGIC);
return 10004;
}
// Sanity checks
if(img3->shshOffset > img3->dataSize) {
printf("tss_strip_img3_signature: signed length %u too large for buffer length %u\n", img3->shshOffset, img3->dataSize);
return 10004;
}
// Trim the image by adjusting the header.
if(img3->shshOffset) {
*len += img3->shshOffset - img3->dataSize;
img3->dataSize = img3->shshOffset;
img3->fullSize = *len;
}
return 0;
}

===Digest===
Digest is the SHA1 of the stripped img3. They are used instead of PartialDigests for the APTicket since the ticket is already personalized for the ECID and all other tags.

[[Category:Firmware Tags]]

SHSH Protocol

2020-02-14T02:00:31Z

Vanished user 20210509: Added more status responses and improved documentation

Here is a description about the protocol that is used when [[iTunes]] requests the [[SHSH]] certificate from Apple. For details about what this is used for, please see the main article [[SHSH]].

This is a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] ([[wikipedia:POST (HTTP)|POST]]) request and answer. You can retry this via a [[wikipedia:Telnet|Telnet]] session or similar. The destination host is gs.apple.com (IP 17.171.36.30 [previously 17.112.176.11]) and runs on the common [[wikipedia:TCP and UDP port|port]] 80. The data is plaintext and not encoded in any way. For details about the [[wikipedia:Hypertext Transfer Protocol|HTTP]] protocol itself, please see [http://www.w3.org/Protocols/HTTP/1.1/rfc2616.pdf RFC2616].

===Sending data (request)===
The request is actually a single XML encoded poperty list. It contains a dictionary which describes the target iOS version, restore behavior etc. Some of the required information can be taken from the BuildManifest.plist. BuildManifest contains some info about the firmware version and "BuildIdentities" dictionary. Inside it you can find two (or more?) build identities. Each of them contains the information which depends on every type of restore ("Erase" or "Update"). Some information is device-dependent (ECID, nonce) and is received from the device.

Request property list should have these properties:

* @APTicket: Optional boolean value. If true, the server adds an [[APTicket]] to the request.
* @BBTicket: Optional boolean value. The same for the [[BBTicket]].
* @UDID: Optional string value. Just request UDID. (ex. D9C1F33D-62E0-4D25-8068-F5F46FE80057).
* @HostPlatformInfo: Optional string value. "mac" for OS X client, "windows" for windows client (can be everything you want).
* @Locality: Optional string value. Language used for the error response (ex. "en_US");
* @VersionInfo: Optional string value. The version of 'libauthinstall' used (ex. "libauthinstall-391.0.0.1.3"). You can pass any string here.
* ApBoardID: Integer value. [[BORD |Board ID]] of the target device. You can take this value from build manifest.
* ApChipID: Integer value. [[CHIP|Chip ID]] of the target device. You can take this value from build manifest.
* ApECID: Integer value. [[ECID]] of the target device.
* ApNonce: Data value. The [[nonce]] generated by your device.
* ApProductionMode: Boolean value. Always true (unless your SOC is PROD 0 - Apple only).
* ApSecurityDomain: Integer value. The use is unknown. You can take this value from build manifest.
* UniqueBuildID: Optional data value. This is a unique identifier for every build (different even for "Erase" and "Update" types of restore). You can take this value from build manifest.

The SHSH request also contains information about files from the [[IPSW]] (or restore bundle for [[PurpleRestore]]). They can be obtained from the 'build identity' you've chosen in the previous step. Each 'build identity' contains a "Manifest" dictionary. It's entries look like
<key>BatteryCharging0</key>
<dict>
<key>Digest</key>
<nowiki><data>...</data></nowiki>
<key>Info</key>
<dict>...</dict>
<key>Trusted<key/>
<true/>
<dict/>
They are just copied to the SHSH request, but the "Info" dictionary is removed.
Example of a SHSH request (... values are identical, *** values are different per device):
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>@[[APTicket]]</key>
<true />
<key>@[[BBTicket]]</key>
<true />
<key>@HostPlatformInfo</key>
<string>mac</string>
<key>@Locality</key>
<string>en_US</string>
<key>@UUID</key>
<string>D9C1F33D-62E0-4D25-8068-F5F46FE80057</string>
<key>@VersionInfo</key>
<string>libauthinstall-391.0.0.1.3</string>
<key>[[BORD |ApBoardID]]</key>
<integer>10</integer>
<key>[[CHIP |ApChipID]]</key>
<integer>35152</integer>
<key>[[ECID |ApECID]]</key>
<integer>***</integer>
<key>[[Nonce |ApNonce]]</key>
<nowiki><data>***</data> </nowiki>
<key>ApProductionMode</key>
<true />
<key>ApSecurityDomain</key>
<integer>1</integer>
<key>UniqueBuildID</key>
<data> fqzW0B++Zdrs+PRwohkwU6prjbk=</data>
<key>AppleLogo</key>
<dict>
<key>Digest</key>
<nowiki><data> uH5QQax5YmIrgcuEHwOhAB//yc8=</data> </nowiki>
<key>Trusted</key>
<true />
</dict>
<key>BatteryCharging0</key>
<dict>
... See AppleLogo dictionary.
</dict>
<key>BatteryCharging1</key>
<dict>
...
</dict>
<key>BatteryFull</key>
<dict>
...
</dict>
<key>BatteryLow0</key>
<dict>
...
</dict>
<key>BatteryLow1</key>
<dict>
...
</dict>
<key>BatteryPlugin</key>
<dict>
...
</dict>
<key>DeviceTree</key>
<dict>
...
</dict>
<key>KernelCache</key>
<dict>
...
</dict>
<key>LLB</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhRAgC22ZPWJB9J1Nh3H+0XeyRTU72ObA==</data> </nowiki>
...
</dict>
<key>RecoveryMode</key>
<dict>
...
</dict>
<key>RestoreDeviceTree</key>
<dict>
...
</dict>
<key>RestoreKernelCache</key>
<dict>
...
</dict>
<key>RestoreLogo</key>
<dict>
...
</dict>
<key>RestoreRamDisk</key>
<dict>
...
</dict>
<key>[[iBEC]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
...
</dict>
<key>[[iBSS]]</key>
<dict>
<key>BuildString</key>
<string>iBoot-2817.0.0.1.2~2</string>
<key>PartialDigest</key>
<nowiki><data> QAAAAHhBAQCRc2PuoresMjW7zNLePMPmX7zaHg==</data> </nowiki>
...
</dict>
<key>[[iBoot]]</key>
<dict>
...
</dict>
</dict>
</plist>

===Receiving data (answer)===
The response is a simple HTTP POST response, containing 3 values: STATUS, MESSAGE (a description string) and REQUEST_STRING (only if the request was successful). STATUS contains numeric status, MESSAGE contains an error message on error and "SUCCESS" string on success and REQUEST_STRING contains response property list encoded as XML.

===Status responses===
*'''STATUS=0&MESSAGE=SUCCESS'''
** The request was sent successfully, and a response was returned.'''
*'''STATUS=8&MESSAGE=An internal error occurred.'''
** A key contained an unknown name.
*'''STATUS=83&MESSAGE=An internal error occurred.'''
** A key was assigned an invalid value type.
*'''STATUS=92&MESSAGE=An internal error occurred.'''
** The request contained more than 65536 bytes.
*'''STATUS=93&MESSAGE=An internal error occurred.'''
** The request contained less than 10 bytes.
*'''STATUS=94&MESSAGE=This device isn't eligible for the requested build.'''
** The specified build is either unsigned or nonexistent.
*'''STATUS=98&MESSAGE=An internal error occurred.'''
** The XML/PList identification tag is missing, or the start of the tag is malformed.
*'''STATUS=100&MESSAGE=An internal error occurred.'''
** The XML/PList version is nonexistent or not "1.0", the end of the XML/PList identification tag is malformed, an unknown tag was found, a value tag contained an invalid type, an unescaped ampersand character was found, or a tag was found without its counterpart.
*'''STATUS=103&MESSAGE=An internal error occurred.'''
** Multiple '@' characters were found at the beginning of a key name.
*'''STATUS=128&MESSAGE=An internal error occurred.'''
*'''STATUS=511&MESSAGE=No data in the request'''
*'''STATUS=551&MESSAGE=Error occured while importing config packet with cpsn: '''
*'''STATUS=5000&MESSAGE=Invalid Option!'''

===Notes===
Interestingly, if all you're interested in is the ServerVersion (and a SUCCESS response), sending any one valid Ap-prefixed key will do, like so:
<?xml version="1.0"?>
<plist>
<dict>
<key>ApSecurityDomain</key>
<integer>1</integer>
</dict>
</plist>
In regards to fuzzing and malformed data, the server (as of 2.1.0, at least) seems to have no bounds checking for the ApNonce, or even checking to see if the ApNonce exists. Because the APTicket changes even when specifying an invalid-sized nonce, it is assumed nonces too short are padded, while nonces too large are ignored past the 16th character.

===Other parameters / open questions===
Some parameters could have other values. Not all details are known.
*action=2 in the request. What other values exist and what is their meaning?
*ApSecurityDomain Meaning? (Related to [[SDOM]] tag)
*Trusted What is this for?
*Full description of the above values for UniqueBuildID, Digest, PartialDigest and BuildString.

===PartialDigest===
The PartialDigest is structured like so:

typedef struct PartialDigest {
uint32_t transformSize; // Always 0x40.
uint32_t img3DataSize; // data size of the img3.
uint8_t hash[SHA1HashSize]; // Result of SHA1ResultPartial from the stripped img3.
};

The img3 is first stripped of it's code signature (if present) and then passed through SHA1Update. SHA1ResultPartial is then performed. It is purposely not the final resulting SHA1. The reason for this being, when TSS processes the PartialDigest, it performs one more SHA1Update on the hash to include the [[ECID]] before doing SHA1Final and creating the SHSH blob.

Code for SHA1ResultPartial:
int SHA1ResultPartial(SHA1Context* ctx, unsigned char* buf) {
// Do we have valid buffer and context pointers?
if(ctx && buf) {
// Is the Context in good shape?
if(!ctx->Corrupted && !ctx->Computed && !ctx->Message_Block_Index) {
for(int i = 0; i < SHA1HashSize; i++) {
buf[i] = ctx->Intermediate_Hash[i >> 2] >> 8 * (3 - (i & 0x3));
}
return 0;
}
}
return 1;
}
Code for tss_strip_img3_signature:
int tss_strip_img3_signature(img3Header* img3, int* len) {
// Do we have a non-null ptr?
if(!img3) {
return 10004;
}
// Does the buffer start with the img3 magic?
if(img3->magic != IMG3_MAGIC) {
printf("tss_strip_img3_signature: bad magic 0x%08x expecting 0x%08x\n", img3->magic, IMG3_MAGIC);
return 10004;
}
// Sanity checks
if(img3->shshOffset > img3->dataSize) {
printf("tss_strip_img3_signature: signed length %u too large for buffer length %u\n", img3->shshOffset, img3->dataSize);
return 10004;
}
// Trim the image by adjusting the header.
if(img3->shshOffset) {
*len += img3->shshOffset - img3->dataSize;
img3->dataSize = img3->shshOffset;
img3->fullSize = *len;
}
return 0;
}

===Digest===
Digest is the SHA1 of the stripped img3. They are used instead of PartialDigests for the APTicket since the ticket is already personalized for the ECID and all other tags.

[[Category:Firmware Tags]]

NonUI builds

2019-11-07T20:29:22Z

Vanished user 20210509: Removed Baseband versions from iPod Touches

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|130px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|130px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|130px|right|Prototype showing newer Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|130px|left|Prototype showing older Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="4" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| 1.1.3
| [[Alpine 4A102a|4A102a]]
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| rowspan="2" | Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 5.0
| [[HoodooYabuli 9A2264r|9A2264r]]
| HoodooYabuli?
| ?
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 1.0.10
| -
|-
| rowspan="2" | 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|-
| [[SundanceNanshan 10B63290m|10B63290m]]
| SundanceNanshan?
| ?
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| rowspan="2" | Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| rowspan="2" | Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| rowspan="2" | InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="6" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| rowspan="2" | Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| rowspan="4" | OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93650z|12A93650z]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| 1.00.05
| -
|-
|}

== [[iPhone 6 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.0
| [[OkemoAni 12A22121a|12A22121a]]
| OkemoAni?
| ?
| -
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="6" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[MonarchAni 13A93051r|13A93051r]]
| MonarchAni?
| ?
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| rowspan="3" | Monarch?
| ?
| -
|-
| [[Monarch 13A93420i|13A93420i]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[Monarch 13A93420m|13A93420m]]
| 1.00.05
| -
|-
| 10.0
| [[Whitetail 14A83432m|14A83432m]]
| Whitetail?
| ?
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter.
|}

== [[iPhone 6s Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchNanshan 13A23161b|13A23161b]]
| MonarchNanshan
| ?
| -
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| rowspan="3" | Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| rowspan="2" | WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| ?
| -
|-
| 10.0.1
| [[BigShot 14Z1062|14Z1062]]
| BigShot
| ?
| -
|}

== [[iPhone 7 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 10.0
| [[WhitetailAni 14A22161a|14A22161a]]
| rowspan="2" | WhitetailAni?
| ?
| -
|-
| [[WhitetailAni 14A22181a|14A22181a]]
| ?
| -
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|-
| [[TigrisAni 15A93720p|15A93720p]]
| TigrisAni?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[iPhone 8 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.0
| [[TigrisAni 15A93261l|15A93261l? (or f?)]]
| TigrisAni?
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter.
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A783601x|15A783601x]]
| rowspan="2" | TigrisAni?
| ?
| -
|-
| [[TigrisAni 15A783601y|15A783601y]]
| ?
| -
|}

== [[N841AP|iPhone XR]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 12.0
| [[Peace 16A13580z|16A13580z]]
| rowspan="2" | Peace?
| ?
| -
|-
| [[Peace 16A73281c|16A73281c]]
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| rowspan="2" | Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango
| ?
| -
|-
|}

== [[IPad_(5th_generation)|iPad (5th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 10.0?
| [[WhitetailAni 14E62210l|14E62210l]]
| WhitetailAni?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| rowspan="3" | SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|-
| 7.1
| [[Sochi 11D167|11D167]]
| Sochi?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| rowspan="2" | 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A64520d|13A64520d]]
| Monarch?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[J72AP|iPad Air 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 10.0?
| [[WhitetailAni 14F60900i|14F60900i]]
| WhitetailAni?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| rowspan="2" | Inferno?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| -
|}

== [[N102AP|iPod touch (6th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Comments
|-
| rowspan="2" | 8.3
| [[Okemo 12H1150f|12H1150f]]
| Okemo?
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter.
|-
| [[Okemo 12H10570d|12H10570d]]
| Okemo?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter.
|}

[[Category:Firmware]]

Talk:NonUI builds

2019-11-07T20:16:53Z

Vanished user 20210509: /* Device/Model Organization */

Thank you for modifying my page! I agree, my markdown hurt my brain too :P

But I must ask: we should add a line about illegally downloaded firmwares. From elsewhere in the wiki (I think the Apple Internal Apps talk page) geohot mentions that it must be legally acquired (e.g not stolen). Where should we add about that? --[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 01:53, 13 March 2015 (UTC)
:I had to edit the part about Inferno prototype firmware for the iPhone 5, iPad Mini 2, and iPhone 6, these devices run the Factory SwitchBoard Prototype Firmware that just happens to run Inferno and other diagnostic utility's within SwitchBoard
--[[User:EverythingApplesPro|EverythingApplesPro]] ([[User talk:EverythingApplesPro|talk]]) 02:02, 13 March 2015 (UTC)
::Sure, and thank you! The other devices are running SwitchBoard too, so I'll add about that.--[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 02:43, 13 March 2015 (UTC)

== Move page ==

I request to add a "s" to Firmware, making it Firmwares. It won't hurt anything if this move is rejected, but there are more than one firmware on the page. --[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 03:48, 13 July 2015 (UTC)

:I did not add a "s" to "Firmware", because [[Firmware]] and [[Beta Firmware]] actually don't have a "s". Unless we are talking about "The" Firmware, I agree that add a "s" is a good idea if there are more than one firmware on those pages. --[[User:ShadowLee19|ShadowLee19]] ([[User talk:ShadowLee19|talk]])
:: Good point. I think we'd better leave this page's name alone for a while. --[[User:Awesomebing1|Awesomebing1]] ([[User talk:Awesomebing1|talk]]) 18:11, 20 July 2015 (UTC)

== Build numbers and internal codenames ==

It is okay and safe from troubles to add build numbers and codenames of internal factory firmwares on the dedicated page ? {{unsigned|ShadowLee19|18:52, July 22, 2015 (UTC)}}

== Verification ==
A user that contacted me is concerned about the legitimacy of information on this page. "I saw someone's forum post say it" isn't enough, as anyone can make up a build number. If I can pull a fake build name/number like "TigrisKendall 15A25308t" out of thin air, anyone else can too. Although they can be faked as well, screenshots/pictures or videos would certainly help. But going forward, we need a way to ensure that the information on this page is legitimate. I think we should require some evidence be provided that the build actually exists, and it's not made up. But how much evidence should we ask for? How much evidence would suffice for this? --[[User:Dialexio|Dialexio]] ([[User talk:Dialexio|talk]]) 16:39, 8 September 2017 (UTC)

== Device/Model Organization ==

I'm going to begin organizing devices by their model identifier (eg. iPhone3,1). Devices that do not have multiple identifiers will maintain their product name. This is being done to provide more information about compatible models for Switchboard builds and to maintain consistency with [[Carrier Firmware]]. If anyone has a reason to object, please place it here.
--[[User:Wxblank|wxblank]] ([[User talk:Wxblank|talk]]) 20:16, 7 November 2019 (UTC)

Talk:NonUI builds

2019-11-07T20:16:17Z

Vanished user 20210509: /* Device/Model Organization */ new section

NonUI builds

2019-10-24T23:42:13Z

Vanished user 20210509:

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|130px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|130px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|130px|right|Prototype showing newer Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|130px|left|Prototype showing older Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="4" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| 1.1.3
| [[Alpine 4A102a|4A102a]]
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| rowspan="2" | Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 5.0
| [[HoodooYabuli 9A2264r|9A2264r]]
| HoodooYabuli?
| ?
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 1.0.10
| -
|-
| rowspan="2" | 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|-
| [[SundanceNanshan 10B63290m|10B63290m]]
| SundanceNanshan?
| ?
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| rowspan="2" | Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| rowspan="2" | Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| rowspan="2" | InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="6" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| rowspan="2" | Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| rowspan="4" | OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93650z|12A93650z]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| 1.00.05
| -
|-
|}

== [[iPhone 6 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.0
| [[OkemoAni 12A22121a|12A22121a]]
| OkemoAni?
| ?
| -
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="6" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[MonarchAni 13A93051r|13A93051r]]
| MonarchAni?
| ?
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| rowspan="3" | Monarch?
| ?
| -
|-
| [[Monarch 13A93420i|13A93420i]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[Monarch 13A93420m|13A93420m]]
| 1.00.05
| -
|-
| 10.0
| [[Whitetail 14A83432m|14A83432m]]
| Whitetail?
| ?
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter.
|}

== [[iPhone 6s Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchNanshan 13A23161b|13A23161b]]
| MonarchNanshan
| ?
| -
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| rowspan="3" | Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| rowspan="2" | WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| ?
| -
|-
| 10.0.1
| [[BigShot 14Z1062|14Z1062]]
| BigShot
| ?
| -
|}

== [[iPhone 7 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 10.0
| [[WhitetailAni 14A22161a|14A22161a]]
| rowspan="2" | WhitetailAni?
| ?
| -
|-
| [[WhitetailAni 14A22181a|14A22181a]]
| ?
| -
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|-
| [[TigrisAni 15A93720p|15A93720p]]
| TigrisAni?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[iPhone 8 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 11.0
| [[TigrisAni 15A93261l|15A93261l? (or f?)]]
| TigrisAni?
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter.
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A783601x|15A783601x]]
| rowspan="2" | TigrisAni?
| ?
| -
|-
| [[TigrisAni 15A783601y|15A783601y]]
| ?
| -
|}

== [[N841AP|iPhone XR]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 12.0
| [[Peace 16A13580z|16A13580z]]
| rowspan="2" | Peace?
| ?
| -
|-
| [[Peace 16A73281c|16A73281c]]
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| rowspan="2" | Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango
| ?
| -
|-
|}

== [[IPad_(5th_generation)|iPad (5th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 10.0?
| [[WhitetailAni 14E62210l|14E62210l]]
| WhitetailAni?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| rowspan="3" | SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|-
| 7.1
| [[Sochi 11D167|11D167]]
| Sochi?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| rowspan="2" | 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A64520d|13A64520d]]
| Monarch?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[J72AP|iPad Air 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 10.0?
| [[WhitetailAni 14F60900i|14F60900i]]
| WhitetailAni?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| rowspan="2" | Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| ?
| -
|}

== [[N102AP|iPod touch (6th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 8.3
| [[Okemo 12H1150f|12H1150f]]
| Okemo?
| ?
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter.
|-
| [[Okemo 12H10570d|12H10570d]]
| Okemo?
| ?
| From [https://twitter.com/1nsane_dev @1nsane_dev] on Twitter.
|}

[[Category:Firmware]]

NonUI builds

2019-09-10T23:00:42Z

Vanished user 20210509:

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|130px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|130px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|130px|right|Prototype showing newer Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|130px|left|Prototype showing older Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="4" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| 1.1.3
| [[Alpine 4A102a|4A102a]]
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| rowspan="2" | Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 5.0
| [[HoodooYabuli 9A2264r|9A2264r]]
| HoodooYabuli?
| ?
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 1.0.10
| -
|-
| rowspan="2" | 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|-
| [[SundanceNanshan 10B63290m|10B63290m]]
| SundanceNanshan?
| ?
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| rowspan="2" | Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| rowspan="2" | Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| rowspan="2" | InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="6" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| rowspan="2" | Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| rowspan="4" | OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93650z|12A93650z]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| 1.00.05
| -
|-
|}

== [[iPhone 6 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.0
| [[OkemoAni 12A22121a|12A22121a]]
| OkemoAni?
| ?
| -
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="6" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[MonarchAni 13A93051r|13A93051r]]
| MonarchAni?
| ?
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| rowspan="3" | Monarch?
| ?
| -
|-
| [[Monarch 13A93420i|13A93420i]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[Monarch 13A93420m|13A93420m]]
| 1.00.05
| -
|-
|}

== [[iPhone 6s Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchNanshan 13A23161b|13A23161b]]
| MonarchNanshan
| ?
| -
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| rowspan="3" | Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| rowspan="2" | WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| ?
| -
|-
| 10.0.1
| [[BigShot 14Z1062|14Z1062]]
| BigShot
| ?
| -
|}

== [[iPhone 7 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 10.0
| [[WhitetailAni 14A22161a|14A22161a]]
| rowspan="2" | WhitetailAni?
| ?
| -
|-
| [[WhitetailAni 14A22181a|14A22181a]]
| ?
| -
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|-
| [[TigrisAni 15A93720p|15A93720p]]
| TigrisAni?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A783601x|15A783601x]]
| rowspan="2" | TigrisAni?
| ?
| -
|-
| [[TigrisAni 15A783601y|15A783601y]]
| ?
| -
|}

== [[N841AP|iPhone XR]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 12.0
| [[Peace 16A13580z|16A13580z]]
| rowspan="2" | Peace?
| ?
| -
|-
| [[Peace 16A73281c|16A73281c]]
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| rowspan="2" | Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango
| ?
| -
|-
|}

== [[IPad_(5th_generation)|iPad (5th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 10.0?
| [[WhitetailAni 14E62210l|14E62210l]]
| WhitetailAni?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| rowspan="3" | SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|-
| 7.1
| [[Sochi 11D167|11D167]]
| Sochi?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| rowspan="2" | 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A64520d|13A64520d]]
| Monarch?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[J72AP|iPad Air 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 10.0?
| [[WhitetailAni 14F60900i|14F60900i]]
| WhitetailAni?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| rowspan="2" | Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| ?
| -
|}

== [[N102AP|iPod touch (6th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.3
| [[Okemo 12H1150f|12H1150f]]
| Okemo?
| ?
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter.
|}

[[Category:Firmware]]

NonUI builds

2019-09-10T00:44:02Z

Vanished user 20210509:

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|130px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|130px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|130px|right|Prototype showing newer Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|130px|left|Prototype showing older Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="4" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| 1.1.3
| [[Alpine 4A102a|4A102a]]
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| rowspan="2" | Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 5.0
| [[HoodooYabuli 9A2264r|9A2264r]]
| HoodooYabuli?
| ?
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 1.0.10
| -
|-
| rowspan="2" | 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|-
| [[SundanceNanshan 10B63290m|10B63290m]]
| SundanceNanshan?
| ?
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| rowspan="2" | Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| rowspan="2" | Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| rowspan="2" | InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="6" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| rowspan="2" | Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| rowspan="4" | OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93650z|12A93650z]]
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| 1.00.05
| -
|-
|}

== [[iPhone 6 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.0
| [[OkemoAni 12A22121a|12A22121a]]
| OkemoAni?
| ?
| -
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[MonarchAni 13A93051r|13A93051r]]
| MonarchAni?
| ?
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| rowspan="2" | Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| 1.00.05
| -
|-
|}

== [[iPhone 6s Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchNanshan 13A23161b|13A23161b]]
| MonarchNanshan
| ?
| -
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| rowspan="3" | Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| rowspan="2" | WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| ?
| -
|-
| 10.0.1
| [[BigShot 14Z1062|14Z1062]]
| BigShot
| ?
| -
|}

== [[iPhone 7 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 10.0
| [[WhitetailAni 14A22161a|14A22161a]]
| rowspan="2" | WhitetailAni?
| ?
| -
|-
| [[WhitetailAni 14A22181a|14A22181a]]
| ?
| -
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|-
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A783601x|15A783601x]]
| rowspan="2" | TigrisAni?
| ?
| -
|-
| [[TigrisAni 15A783601y|15A783601y]]
| ?
| -
|}

== [[N841AP|iPhone XR]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 12.0
| [[Peace 16A13580z|16A13580z]]
| rowspan="2" | Peace?
| ?
| -
|-
| [[Peace 16A73281c|16A73281c]]
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| rowspan="2" | Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| rowspan="3" | SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|-
| 7.1
| [[Sochi 11D167|11D167]]
| Sochi?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[J72AP|iPad Air 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 10.0?
| [[WhitetailAni 14F60900i|14F60900i]]
| WhitetailAni?
| ?
| From [https://twitter.com/AppleInternalsh @AppleInternalsh] on Twitter.
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| rowspan="2" | Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| ?
| -
|}

== [[N102AP|iPod touch (6th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.3
| [[Okemo 12H1150f|12H1150f]]
| Okemo?
| ?
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter.
|}

[[Category:Firmware]]

Unc0ver

2019-09-09T23:01:38Z

Vanished user 20210509:

{{lowercase}}{{Infobox software
| name = unc0ver
| title = unc0ver
| developer = [https://twitter.com/pwn20wnd pwn20wnd]<br />[https://twitter.com/sbingner sbingner]
| released = {{Start date|2018|10|13|df=yes}}
| latest release version = v3.6.1
| latest release date = {{Start date and age|2019|09|08|df=yes}}
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = [https://www.reddit.com/9nwxei/ The Reddit thread]<br />[https://github.com/pwn20wndstuff/Undecimus The GitHub repo]
}}
'''unc0ver''' is a [[semi-untethered jailbreak]] for all devices running iOS 11.0-12.2 and 12.4, (A12/A12X support is limited on iOS 12.0-12.2 and 12.4).

It uses the same, and a few more, exploits as [[Electra]] and [[Chimera]] whilst providing more features.

In order to download the latest IPA, download links from the README section has been moved to the releases section of the repository (you can find this by looking under the colored bars where you can find the releases page which is in the middle, alongside branches and contributors).
==Release History==
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| RC1
| {{date|2018|10|13}}
|
* Initial release
|-
| RC2
| rowspan="5" | {{date|2018|10|14}}
|
* Add the Dynastic repo by default
* Fix a bug in firmware checker
|-
| RC3
|
* Add a switch to manually enable restoring RootFS
* Stop erasing user preferences when restoring RootFS
* Fix bugs
|-
| RC4
|
* Add a label to display the uptime
* Add a label to display the app's version number
* Spawn to the PATH
* Stop bundling system fonts
|-
| RC5
|
* Run videosubscriptionsd in the jailed state
* Fix a bug in firmware and update checker
|-
| RC6
|
* Start logging again
* Improve update checker
* Fix multi_path
|-
| RC7
| {{date|2018|10|17}}
|
* Fix a bug in RootFS Restore and multi_path
|-
| RC8
| {{date|2018|10|18}}
|
* Fix a bug in RootFS Remount
* Add a work in progress warning for some firmwares
|-
| RC9
| {{date|2018|10|19}}
|
* Fix a bug in RootFS Remount
* Add even more detailed error messages
* Add a switch to increase the memory limit to improve the stability
* Improve the compatibility layer to work correctly with some tweaks that were specifically made for the other jailbreaks
|-
| v1
| {{date|2018|10|20}}
|
* Fix a bug in RootFS Restore and Remount
* Make the settings tab match with the rest of the UI
* Fix bugs
|-
| v1.0.1
| {{date|2018|10|21}}
|
* Disable the RootFS Restore for the unstable versions
|-
| v1.0.2
| {{date|2018|10|22}}
|
* Enable and fix the RootFS Restore for all versions
|-
| v1.0.3
| {{date|2018|10|23}}
|
* Fix the beta firmwares
|-
| v1.1
| {{date|2018|10|27}}
|
* Automatically select the best exploit
* Rewrite the versions checker
* Improve assertion
* Show the code which has failed in the error messages
* Improve memory management
* Optimize and clean up the code
* Fix the Storage settings
* Switch to a new technique to disable auto updates
* Remove so much useless logging
* Only set the boot-nonce if the switch is on without checking if it exists or not
* Log offsets
* Remove static sleeps to improve the speed
* Fix series of bugs and leave no known bug
|-
| v1.1.1
| rowspan="2" | {{date|2018|11|03}}
|
* Add a label to show the ECID
* Add a button to open the source code
* Improve auto layout
* Fix various bugs within RootFS interaction, Icon cache refresher, Version checker, Exploit selector, jailbreak state detector and others
|-
| v1.1.2
|
* Improve auto layout and code
* Significantly improve Empty_List (VFS) exploit
* Slightly improve Multi_Path (MPTCP)
|-
| v1.1.3
| rowspan="2" | {{date|2018|11|06}}
|
* Fix a bug in starting jailbreakd
|-
| v1.1.4
|
* Fix a bug in finding offsets
|-
| v2.0
| {{date|2018|11|30}}
|
* Initial Cydia Substrate support
* OTA upgrades for the jailbreak patches from Cydia without rebooting
* A new button to restart SpringBoard from the jailed state
* A switch to (re)install OpenSSH
* A switch to reinstall Cydia
* A switch to restart backboardd only so that you can jailbreak with broken tweaks
* Fix and update bootstrap
* Fix for the jailbreakd error
* Battery life fixes
* ELOD (Electra Loop Of Death) mitigations
* Improve the speed of system reload
* Fixes for countless bugs
* Enable Restart and Restart SpringBoard buttons on iOS 11.4 - 11.4.1 (Jailbreak itself doesn't work on iOS 11.4 - 11.4.1)
* Improve the reliability of the Restart button
* Fix the broken multi_path entitlement check
* Add the compatibility layer for the other jailbreaks back to fix the apps like iCleaner
* Fix the famous snapshot creation bug
* Add a button to manually reset the logs instead of automatically resetting them when the diagnostics button is tapped
* Fix the trust cache injection bug
|-
| v2.0.1
| {{date|2018|12|02}}
|
* The official release of v2.0 with a version number bump to make tracking versions easier
|-
| v2.0.2
| {{date|2018|12|06}}
|
* Fix bugs in the app
* Improve the the speed of the jailbreak
* Update bundled resources
* Switch to a new technique for blocking revokes
|-
| v2.1
| {{date|2018|12|14}}
|
* Make internal changes to make fixing issues easier
* Add T-Mobile support for the revoke disabler
* Make re-jailbreaking without restarting possible
* Make switching from Electra possible without restoring RootFS
* Update bundled resources
* Fix a bug in extracting bootstrap
* Only quit the app if the error is fatal
* Fix a bug in loading daemons
* Make the jailbreaking process faster and more stable
* Add more feedback to the user interface
* Other fixes and improvements
* Fix a bug in extracting bootstrap that was introduced with the previous build
* Fix a bug in installing Cydia that was introduced with the previous build
* Fix a bug in switching from Electra without restoring RootFS
* Update "No Tweaks" mode to support new "Disable Loader" option in Cydia Substrate
* Added the ability to completely disable jailbreakd when Substrate is installed via a future Cydia update.
* Add internal support for completely disabling jailbreakd with a Resources update
* Make a special alert for the exploit error to make it more clear
* Automatically reboot when the user taps "OK" on the exploit error
* Improve the version checker
* Fix a really weird bug in the system that would stop Cydia Substrate from loading tweaks although this bug isn't caused by the tool
* Make the UI support different font sizes or styles (E.g. Bold Text)
* Add the initial localization support (No localizations included yet)
* Reduce the number of stages
* Fix a bug in installing OpenSSH
* Switch to Sam Bingner's new superb trust cache injector thereby enable support for dual-hash signatures
* Don't update the hosts file unless it is needed
* Unblock Saurik's repo if it is blocked
* Reduce the number of stages
* Remove unnecessary checks
* Avoid applying unnecessary kernel patches unless they are needed
* Make sure that the system snapshot was correctly mounted before using it
* Unmount the system snapshot after root filesystem snapshot bypass or restore
* Simplify the credits view
* Don't do unnecessary logging
* Improve empty_list (vfs) exploit's success rate
* Fix runCommand to correctly log
* Don't run jailbreakd if Cydia Substrate is installed
* Don't set the boot nonce if it already is
* Make obvious internal changes
* Make jailbreaking obviously faster
* Fix a brutal kernel memory leak
* Fix shutdown or halt leading to a reboot
* Fix a logic error that would disable jailbreak patches when Substrate was installed but Load Daemons was disabled that was introduced with the previous build
* Fix a bug in RootFS Restore for iOS 11.0 - 11.2.6 that was introduced with the previous build
* Fix a bug in trust cache injection
* Improve update checker
* Make jailbreaking obviously faster
* Fix a bug in RootFS Restore for iOS 11.0 - 11.2.6 that would cause it to not work on some devices
* Fix a bug in update checker
* Fix a bug in the posix_spawn wrapper that would cause weird issues on some devices (Known for causing the "(24/40)" issue)
|-
| v2.1.1
| {{date|2019|01|05}}
|
* Make jailbreaking faster
* Don't error out if the hosts file doesn't exist
* Ignore dependencies in Cydia reinstallation
* Fix false positives
* Clean Cydia's user data in RootFS Restore
* Fix a snapshot name confusion bug in RootFS Restore
* Fix another bug in RootFS Restore
* Improve memory management
* Use less external binaries
* Completely clean Cydia's user data in RootFS Restore
|-
| v2.1.3
| rowspan="2" | {{date|2019|01|26}}
|
* Fix a bug in patch finder that affected the shenanigans finder on specific iOS versions
* Switch to a better versioning system
* Make downgrading from v2.2.0 possible (Unreleased as of now)
|-
| v2.1.4
|
*Decrease the app's size from 63MBs to 22MBs by optimizing assets
|-
| v2.2.0
| rowspan="3" | {{date|2019|01|30}}
|
* Install Cydia Substrate if it's not already installed
* Validate Cydia Substrate files and reinstall it if the validation fails
* Fix a bug in switching from Electra without RootFS Restore
* Clean up the kernel data structure patches to improve the performance and the security
* Remove Substitute support files in the filesystem
* Remove Substitute support links in the filesystem
* Uninstall Electra's Cydia Upgrade Helper if it is present
* Improve preference management
* Switch to a more efficient versioning system
* Use a new implementation of the system's libarchive to extract the bootstrap to increase the perfomance
* Update rsync to increase the performance and the stability of RootFS Restore
* Improve memory management
* Re-Extract bootstrap if it was extracted on a different iOS version
* Credit Saurik in the credits view for Cydia and Substrate
* Avoid writing to the disk when not necessary
* Add a verbose log window for the jailbreak
* Make the exploits slightly faster
* Make the jailbreak significantly faster and more performant
* Jailbreak itself now takes almost less than a second run (Exploit not included)
* Fix a bug in patch finder that would cause the sandbox escape to fail on certain devices
* Fix theoretical bugs
* Improve assertion
* Performance improvements
* Fix a bug in logging
* Update bootstrap
* Enable overwriting files in the bootstrap extractor
* Fix switching from Electra without restoring root filesystem
* Fix certain error descriptions
* Fix RootFS Restore on certain devices
* Add a switch to hide the log window
* Decrease the app's size from 81MBs to 25MBs by optimizing assets
* Add a switch to reset Cydia cache on request
* Rewrite Cydia installation
* Install a local repo
* Remove bootstrap
* Hide the local APT repo from Cydia
|-
| v2.2.1
|
* Fix a bug in installing Cydia / extracting bootstrap
|-
| v2.2.2
|
* Fully fix a bug in installing Cydia / extracting bootstrap
|-
| v2.2.3
| {{date|2019|01|31}}
|
* Fix a bug with extracting rsync
|-
| v3.0.0
| {{date|2019|04|19}}
|
* Add support for iOS 12.0-12.1.2.
|-
| v3.0.1
| {{date|2019|04|23}}
|
* Iterate the proc list with proper data locks in Unrestrict to fix a possible race condition in the kernel (Important stability fix)
* Fix a typo in the app
* Fix a bug in logging
* Add iOS 12.1.3 - 12.2 support for the restart button
|-
| v3.1
| {{date|2019|05|23}}
|
* Rewrite the kernel patches from scratch to improve the stability and the reliability of the jailbreak
* Rewrite the preference management system from scratch to optimize the jailbreak
* Rewrite the diagnostics system from scratch to provide more useful information
* Rewrite unrestrict libary from scratch to improve the stability of the system after jailbreak
* Add support for switching from the other iOS 12 jailbreaks without restoring the root filesystem and losing data
* Make Unrestrict add sandbox exceptions for mach_lookup and mach_register
* Fix issues with processes looking up Substrate port on iOS 12 to fix stability and performance issues
* Fix support for the broken versions of RocketBootstrap and hid-support tweaks
* Fix the iMessage audio crash
* Fix FaceTime calls disappearing on some devices
* Fix Camera crash on some devices
* Update the local APT repo to include the latest updates from the Elucubratus repository, including the updated uikittools with rewritten uicache and sbreload commands to make refreshing the icon cache and reloading the SpringBoard significantly faster when installing packages from Cydia
* Refresh the icon cache during the root filesystem restore to fix jailbreak apps staying on the home screen after restoring the root filesystem
* Update mobilesubstrate to version 0.9.7033 to disable loader in the securityd daemon to fix a freeze issue on iOS 12
* Significantly improve the reliability of the jailbreak when using the machswap or the machswap2 exploit
* Wait for the user to tap OK on the jailbreak completed alert before respringing the device
* Improve the jailbreak's self-repairability feature
* Add a progress HUD to display the status of the jailbreak process
* Optimize the code
* Improve assertion
* Add error-specific error messages
* Display info about the device on launch
* Clean up logging
* Reconfigure the "Reload System Daemons" and "Enable get-task-allow" preferences
* Make "Enable get-task-allow" a default option
|-
| v3.1.1
| rowspan="2" | {{date|2019|05|24}}
|
* Fix running root filesystem restore when not in the jailbroken state on iOS 11
* Add an option to automatically restart the SpringBoard once the jailbreak is done instead of waiting for the user to tap the OK button (Requested by a Redditor)
|-
| v3.1.2
|
* Fix a bug in the settings user interface on smaller devices
* Add an option to hide the progress HUD (Requested by a Redditor)
|-
| v3.1.3
| {{date|2019|05|28}}
|
* Fix a bug in updating the status
* Fix a logic bug in remounting the root filesystem (Addresses https://www.reddit.com/r/jailbreak/comments/btxqng/help_still_cant_jb_on_ios_1211_using_the_newest/)
* Make machswap and machswap2 not depend on stealing kernel's credentials to fix a possible reliability issue
* Update kernel patches to use a safer allocation method
* Fix missing information in the jailbreak completed notice
* Fix false information in the jailbreak completed notice
|-
| v3.2
| {{date|2019|06|01}}
|
* Redesign the user interface (https://twitter.com/HiMyNameIsUbik/status/1134938278489182208)
* Add dark mode for the user interface
* Add info buttons for the options
* Increase the reliability of the jailbreak with the machswap and machswap2 exploits
* Update jailbreak-resources to fix an issue with the CS_DEBUGGED option
|-
| v3.2.1
| {{date|2019|06|02}}
|
* Fix several typos in the app
* Update the bundled uikittools
* Ignore refresh icon cache failures unless they are actually fatal
|-
| v3.3.0
| {{date|2019|07|14}}
|
* Add the Sock Puppet exploit for iOS 12.0-12.2 support on A8X-A11 devices
* Remove the empty_list and multi_path exploits
* Replace the kernel exploit segmented switch with picker view
* Add code substitution platform picker view
|-
| v3.3.1
| rowspan="2" | {{date|2019|07|16}}
|
* Improve the speed of the jailbreak process by a few seconds
* Fix a bug in dark mode on the iPads
|-
| v3.3.2
|
* Fix a bug in finding kernel offsets on iOS 11
|-
| v3.3.3
| {{date|2019|07|18}}
|
* Fix the Sock Puppet kernel exploit on iOS 11
* Fix the Voucher Swap exploit's compatibility status with iPad Air 2 and iPad Mini 4 on iOS 11
|-
| v3.3.4
| rowspan="4" | {{date|2019|07|19}}
|
* Add the Sock Port exploit by [https://twitter.com/jakeashacks @jakeashacks] for iOS 11.0-12.1.4 on A7-A9X devices
|-
| v3.3.5
|
* Fix a reliability bug in Sock Port
* Fix Sock Puppet on A8X
|-
| v3.3.6
|
* Fix Sock Port failing on 4K devices
|-
| v3.3.7
|
* Improve the reliability of the Sock Port kernel exploit on 4K devices
|-
| v3.3.8
| {{date|2019|07|22}}
|
* Use the rewritten SockPort 2.0 exploit with ~100% reliability, ~100 milliseconds run time and support for all devices on iOS 11.0-12.2 (12.1.3-12.2 on A12-A12X excluded)
* Fix the jailbreak on iOS 12.2 iPhones and iPods
|-
| v3.4.0
| {{date|2019|07|23}}
|
* Replace the SockPort 2.0 exploit with the SockPuppet 2.0 exploit with better reliability and stability on older devices
|-
| v3.4.1
| rowspan="2" | {{date|2019|07|25}}
|
* Fix the sandbox swap error when using the exploits that are not SockPuppet
* Add the SockPort 1.5 exploit by [https://github.com/jakeajames @jakeajames] for A7-A9X devices (Reliability: ~95% from extensive testing)
* Disable the SockPuppet exploit on A7-A7X due to reliability issues
* Add iOS 12.3~b1 support to the jailbreak (Verified working on iPhone 5s)
* Fix a theoretical reliability bug with SockPuppet
|-
| v3.4.2
|
* Fix the SockPuppet kernel exploit not displaying on A8-A8X devices
|-
| v3.5.0
| {{date|2019|08|18}}
|
* Add iOS 12.4 support to the Sock Puppet (A8-A11) and Sock Port (A7-A7X) exploits
|-
| v3.5.1
| rowspan="3" | {{date|2019|08|19}}
|
* Add the updated SockPuppet 3.0 exploit by @umanghere
* Remove the SockPort and SockPort2 exploits
* Update system-memory-reset fix to fix random reboots
* Add Apple to the credits section for development
* Fix error at stage 2 when jailbreaking after updating from a lower firmware while preserving the app data
* Fix the app crashing up on stared up on iOS 11
|-
| v3.5.2
|
* Fix the SockPuppet 3.0 exploit on iPad Mini 4 and iPad Air 2
|-
| v3.5.3
|
* Add WIP partial support for A12-A12X devices on iOS 12.1.3, 12.1.4, 12.2 and 12.4 with support for setting HSP#4 as TFP0, setting kernel_task info, exporting kernel_task port, dumping APTicket, logging KASLR shift and ECID and disabling auto updates
|-
| v3.5.4
| rowspan="2" | {{date|2019|08|22}}
|
* Add full-fledged SSH support with root-shell for A12-A12X devices on iOS 12.1.3-12.4
* Add support for arbitrary unsigned code execution on A12-A12 devices on iOS 12.1.3-12.4
(Note: Object files will have to be signed with a CMS blob using the codesign utility)
* Add support for running expired or revoked apps on A12-A12X devices on iOS 12.1.3-12.4
* Fix instant or random reboots after jailbreaking with the SockPuppet3.0 exploit on A7-A12X devices on iOS 11.0-12.4
Note: Code injection is not supported on A12-A12X devices as of yet
|-
| v3.5.5
|
* Fixes issues with the jailbreak introduced with the last update
* Fixes iOS 11 support
|-
| v3.5.6
| {{date|2019|08|24}}
|
* Add support for remounting the RootFS as read-write on A12-A12X devices running iOS 12.1.3-12.4
* Adds support for restoring the RootFS on A12-A12X devices running iOS 12.1.3-12.4
|-
| v3.6.0
| {{date|2019|09|08}}
|
* Completely redesign and rewrite all jailbreak patches from scratch.
* Make the jailbreak patches static and not dynamic, Meaning that the system stability will be completely stock after the jailbreak.
* Fix the app crashing on launch when signed with provisioning profiles with non-ASCII characters.
* Internally prepare jailbreak patches for full-fledged A12-A12X support.
* Make the jailbreak significantly and noticeably more reliable and faster to run.
* Add the SockPort 3.0 exploit for improved reliability on iOS 12.4 and devices with low RAM.
* Fix SSH support for arm64e devices running iOS 12.0-12.1.2.
* Make it possible to jailbreak with corrupted SystemVersion.plist on iOS 12.4.
* Make the jailbreak perform proper clean up to preserve system stability in case of a failure.
* Fix the jbctl command-line utility.
* Switch to a new technique for setting the system boot nonce generator that works on all arm64e devices running iOS12.0-12.4, (Thanks to [https://github.com/0x7ff @0x7ff] for the idea).
* Fix a bug with the initial Cydia installation getting stuck sometimes.
* Significantly speed up the initial Cydia installation process.
* Internally prepare upcoming stable substitute support.
* Internally prepare Cydia and its resources for full-fledged arm64e support.
|-
| v3.6.1
| {{date|2019|09|08}}
|
* Improves auto-exploit selection.
|-
| v3.6.2
| rowspan="2" | {{date|2019|09|09}}
|
* Fix an issue with the kernel virtual memory access APIs on A7-A8 devices that rendered the jailbreak useless by causing it to fail to copy big kernel data (Error known as: "Unable to copy container profile in kernel memory.")
|-
| v3.6.3
|
* Fix an issue with finding kernel offsets on A8
|}

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

NonUI builds

2019-09-09T00:57:35Z

Vanished user 20210509:

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|130px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|130px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|130px|right|Prototype showing newer Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|130px|left|Prototype showing older Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="4" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| 1.1.3
| [[Alpine 4A102a|4A102a]]
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| rowspan="2" | Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 5.0
| [[HoodooYabuli 9A2264r|9A2264r]]
| HoodooYabuli?
| ?
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 1.0.10
| -
|-
| rowspan="2" | 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|-
| [[SundanceNanshan 10B63290m|10B63290m]]
| SundanceNanshan?
| ?
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| rowspan="2" | Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| rowspan="2" | Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| rowspan="2" | InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| rowspan="2" | Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| rowspan="3" | OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| 1.00.05
| -
|-
|}

== [[iPhone 6 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.0
| [[OkemoAni 12A22121a|12A22121a]]
| OkemoAni?
| ?
| -
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[MonarchAni 13A93051r|13A93051r]]
| MonarchAni?
| ?
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| rowspan="2" | Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| 1.00.05
| -
|-
|}

== [[iPhone 6s Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchNanshan 13A23161b|13A23161b]]
| MonarchNanshan
| ?
| -
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| rowspan="3" | Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| rowspan="2" | WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| ?
| -
|-
| 10.0.1
| [[BigShot 14Z1062|14Z1062]]
| BigShot
| ?
| -
|}

== [[iPhone 7 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 10.0
| [[WhitetailAni 14A22161a|14A22161a]]
| rowspan="2" | WhitetailAni?
| ?
| -
|-
| [[WhitetailAni 14A22181a|14A22181a]]
| ?
| -
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|-
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A783601x|15A783601x]]
| rowspan="2" | TigrisAni?
| ?
| -
|-
| [[TigrisAni 15A783601y|15A783601y]]
| ?
| -
|}

== [[N841AP|iPhone XR]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 12.0
| [[Peace 16A13580z|16A13580z]]
| rowspan="2" | Peace?
| ?
| -
|-
| [[Peace 16A73281c|16A73281c]]
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| rowspan="2" | Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| rowspan="3" | SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|-
| 7.1
| [[Sochi 11D167|11D167]]
| Sochi?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| rowspan="2" | Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| ?
| -
|}

== [[N102AP|iPod touch (6th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.3
| [[Okemo 12H1150f|12H1150f]]
| Okemo?
| ?
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter.
|}

[[Category:Firmware]]

NonUI builds

2019-09-08T21:58:22Z

Vanished user 20210509:

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|130px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|130px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|130px|right|Prototype showing newer Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|130px|left|Prototype showing older Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="4" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| 1.1.3
| [[Alpine 4A102a|4A102a]]
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| rowspan="2" | Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 5.0
| [[HoodooYabuli 9A2264r|9A2264r]]
| HoodooYabuli?
| ?
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 1.0.10
| -
|-
| rowspan="2" | 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|-
| [[SundanceNanshan 10B63290m|10B63290m]]
| SundanceNanshan?
| ?
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| rowspan="2" | Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| rowspan="2" | Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| rowspan="2" | InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| rowspan="2" | Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| rowspan="3" | OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| 1.00.05
| -
|-
|}

== [[iPhone 6 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.0
| [[OkemoAni 12A22121a|12A22121a]]
| OkemoAni?
| ?
| -
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[MonarchAni 13A93051r|13A93051r]]
| MonarchAni?
| ?
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| rowspan="2" | Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| 1.00.05
| -
|-
|}

== [[iPhone 6s Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A23161b|13A23161b]]
| MonarchAni?
| ?
| -
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| rowspan="3" | Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| rowspan="2" | WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| ?
| -
|-
|}

== [[iPhone 7 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 10.0
| [[WhitetailAni 14A22161a|14A22161a]]
| rowspan="2" | WhitetailAni?
| ?
| -
|-
| [[WhitetailAni 14A22181a|14A22181a]]
| ?
| -
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|-
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A783601x|15A783601x]]
| rowspan="2" | TigrisAni?
| ?
| -
|-
| [[TigrisAni 15A783601y|15A783601y]]
| ?
| -
|}

== [[N841AP|iPhone XR]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 12.0
| [[Peace 16A13580z|16A13580z]]
| rowspan="2" | Peace?
| ?
| -
|-
| [[Peace 16A73281c|16A73281c]]
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| rowspan="2" | Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| rowspan="3" | SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|-
| 7.1
| [[Sochi 11D167|11D167]]
| Sochi?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| rowspan="2" | Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| ?
| -
|}

== [[N102AP|iPod touch (6th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.3
| [[Okemo 12H1150f|12H1150f]]
| Okemo?
| ?
| From [https://twitter.com/OkemoZurs @OkemoZurs] on Twitter.
|}

[[Category:Firmware]]

NonUI builds

2019-09-02T17:35:37Z

Vanished user 20210509: /* iPhone 4S */

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|130px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|130px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|130px|right|Prototype showing newer Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|130px|left|Prototype showing older Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="4" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| 1.1.3
| [[Alpine 4A102a|4A102a]]
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| rowspan="2" | Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 5.0
| [[HoodooYabuli 9A2264r|9A2264r]]
| HoodooYabuli?
| ?
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 1.0.10
| -
|-
| rowspan="2" | 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|-
| [[SundanceNanshan 10B63290m|10B63290m]]
| SundanceNanshan?
| ?
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| rowspan="2" | Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| rowspan="2" | Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| rowspan="2" | InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| rowspan="2" | Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| rowspan="3" | OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| 1.00.05
| -
|-
|}

== [[iPhone 6 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.0
| [[OkemoAni 12A22121a|12A22121a]]
| OkemoAni?
| ?
| -
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[MonarchAni 13A93051r|13A93051r]]
| MonarchAni?
| ?
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| rowspan="2" | Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| 1.00.05
| -
|-
|}

== [[iPhone 6s Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A23161b|13A23161b]]
| MonarchAni?
| ?
| -
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| rowspan="3" | Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| rowspan="2" | WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| ?
| -
|-
|}

== [[iPhone 7 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 10.0
| [[WhitetailAni 14A22161a|14A22161a]]
| rowspan="2" | WhitetailAni?
| ?
| -
|-
| [[WhitetailAni 14A22181a|14A22181a]]
| ?
| -
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|-
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A783601x|15A783601x]]
| rowspan="2" | TigrisAni?
| ?
| -
|-
| [[TigrisAni 15A783601y|15A783601y]]
| ?
| -
|}

== [[N841AP|iPhone XR]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 12.0
| [[Peace 16A13580z|16A13580z]]
| rowspan="2" | Peace?
| ?
| -
|-
| [[Peace 16A73281c|16A73281c]]
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| rowspan="2" | Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| rowspan="3" | SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|-
| 7.1
| [[Sochi 11D167|11D167]]
| Sochi?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| rowspan="2" | Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| ?
| -
|}

[[Category:Firmware]]

Snowwhite

2019-08-27T00:22:44Z

Vanished user 20210509: Created page with "{{internal software}} 250px '''snowwhite''' is an internal CLI tool (see SwitchBoard:_/usr/local/bin) that appears to displa..."

{{internal software}}

[[File:snowwhite1.png|thumb|Example output.|250px]]
'''snowwhite''' is an internal CLI tool (see [[SwitchBoard:_/usr/local/bin]]) that appears to display information (and update firmware?) across DisplayPort adapters.

Functionality has been largely untested, and is useless without a connected DisplayPort "sink".

{{stub|software}}

File:Snowwhite1.png

2019-08-27T00:20:16Z

Vanished user 20210509:

NonUI builds

2019-08-25T16:59:35Z

Vanished user 20210509: /* Some interesting facts about factory firmwares */

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|130px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|130px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|130px|right|Prototype showing newer Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|130px|left|Prototype showing older Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="4" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| 1.1.3
| [[Alpine 4A102a|4A102a]]
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| rowspan="2" | Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| rowspan="2" | ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| 1.0.10
| -
|-
| rowspan="2" | 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|-
| [[SundanceNanshan 10B63290m|10B63290m]]
| SundanceNanshan?
| ?
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| rowspan="2" | Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| rowspan="2" | Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| rowspan="2" | InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| rowspan="2" | Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| rowspan="3" | OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| 1.00.05
| -
|-
|}

== [[iPhone 6 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.0
| [[OkemoAni 12A22121a|12A22121a]]
| OkemoAni?
| ?
| -
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[MonarchAni 13A93051r|13A93051r]]
| MonarchAni?
| ?
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| rowspan="2" | Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| 1.00.05
| -
|-
|}

== [[iPhone 6s Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A23161b|13A23161b]]
| MonarchAni?
| ?
| -
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| rowspan="3" | Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| rowspan="2" | WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| ?
| -
|-
|}

== [[iPhone 7 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 10.0
| [[WhitetailAni 14A22161a|14A22161a]]
| rowspan="2" | WhitetailAni?
| ?
| -
|-
| [[WhitetailAni 14A22181a|14A22181a]]
| ?
| -
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|-
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A783601x|15A783601x]]
| rowspan="2" | TigrisAni?
| ?
| -
|-
| [[TigrisAni 15A783601y|15A783601y]]
| ?
| -
|}

== [[N841AP|iPhone XR]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 12.0
| [[Peace 16A13580z|16A13580z]]
| rowspan="2" | Peace?
| ?
| -
|-
| [[Peace 16A73281c|16A73281c]]
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| rowspan="2" | Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| rowspan="3" | SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|-
| 7.1
| [[Sochi 11D167|11D167]]
| Sochi?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| rowspan="2" | Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| rowspan="3" | HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| ?
| -
|}

[[Category:Firmware]]

NonUI builds

2019-08-25T05:20:23Z

Vanished user 20210509: /* Some interesting facts about factory firmwares */

{{internal software}}
{{see also|Beta Firmware|Internal OTA Updates}}
<div class="toclimit-3">{{float toc|left}}</div>
This is a documented list of known '''factory firmwares''', used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
{{see also|Prototypes}}
{{clear}}
[[File:newsblogo.png|thumb|130px|right|"Skankwerk" logo on 7.x and up]]
[[File:oldswblogo.png|thumb|130px|left|"Skankwerk" logo on 6.x and below]]
[[File:newswblogo.jpg|thumb|130px|right|Prototype showing newer Skankwerk logo during boot]]
[[File:oldswblogodevice.jpg|thumb|130px|left|Prototype showing older Skankwerk logo during boot]]
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
* DEVELOPMENT/DEBUG fused bootloaders in <code>\Firmware\dfu\</code> and <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* DEVELOPMENT/DEBUG fused [[kernelcache]] with more symbols (located in <code>/System/Library/Caches/com.apple.kernelcaches</code> on the filesystem), and with individual kexts in <code>/System/Library/Extensions</code>.
* DEVELOPMENT dyld_shared_cache in <code>/System/Library/Caches/com.apple.dyld</code>.
* DEBUG fused baseband firmware in <code>\Firmware\</code>.
* Skankwerk (gear) logo image file in <code>\Firmware\all_flash\all_flash.[board codename].factoryfa\</code>.
* <code>/AppleInternal</code> folder, which the hierarchy inside get priority over hierarchy in <code>/</code>.
* No SpringBoard, requires the use of daemons to launch [[SwitchBoard.app]] as a multi-app launcher instead.
* <code>/usr</code> and subfolders contain many UNIX command line utilities.
* SSH daemon is pre-installed as dropbear, can be connected to over usb
* Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable [[AMFI]]
* It has some additional Private Frameworks in <code>/System/Library/PrivateFrameworks</code> for internal GUI apps and command line utilities.
* Most [[Apple Internal Apps|internal applications]] require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in both IPSWs and "restore bundles". These bundles are unzipped IPSW files which can be restored on devices using internal restore software such as [[PurpleRestore]]. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem).
{{clear}}
= Some interesting facts about factory firmwares =
* '''Design:''' Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in [[Operator]]). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
* '''Other:''' The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on [https://en.wikipedia.org/wiki/Skunkworks_project Wikipedia].
== [[M68AP|iPhone]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 1.0
| [[Alpine 1A420|1A420]]
| rowspan="3" | Alpine
| 03.06.01_G<sup>[http://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/]</sup>
| Originally available [http://forums.macrumors.com/showpost.php?p=7249071&postcount=85 here], but was soon taken down.
|-
| [[Alpine 4A57|4A57]]
| 04.02.13_G
| -
|-
| rowspan="1" | 1.1.2
| [[Alpine 3B48|3B48]]
| 04.02.13_G
| -
|-
| rowspan="2" | 1.1.3
| [[Alpine 4A102a|4A102a]]
| Alpine
| 04.04.05_G
| -
|-
|}

== [[N82AP|iPhone 3G]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
|}

== [[N88AP|iPhone 3GS]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.1b
| [[Sierra 7C108b|7C108b]]
| Sierra?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
| rowspan="2" | 4.0
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 05.12.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 05.16.05
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 05.16.06
| -
|}

== [[iPhone 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 4.0
| [[Apex 8A133|8A133]]
| Apex?
| 01.32.01
| -
|-
| [[Apex 8A2062a|8A2062a]]
| Apex?
| ?
| -
|-
| [[ApexNanshan 8A2130h|8A2130h]]
| ApexNanshan
| ?
| -
|-
| [[ApexNanshan 8A2180g|8A2180g]]
| ApexNanshan
| 01.42.01
| -
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 04.12.01
| -
|-
| 6.0
| [[Sundance 10A316|10A316]]
| Sundance
| 04.12.02
| -
|-
|}

== [[N94AP|iPhone 4S]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| 1.0.10
| -
|-
| 6.0
| [[SundanceNanshan 10A23941a|10A23941a]]
| SundanceNanshan
| 2.0.0.2
| -
|}

== [[iPhone 5]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[Sundance 10A23110z|10A23110z]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A23941s|10A23941s]]
| Sundance?
| ?
| -
|-
| [[Sundance 10A316|10A316]]
| Sundance
| 1.7.00
| -
|-
|}
== [[iPhone 5c]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0
| [[Sochi 11A93840l|11A93840l]]
| Sochi?
| ?
| -
|-
| 7.1
| [[Sochi 11D31620l|11D31620l]]
| Sochi?
| ?
| -
|}

== [[iPhone 5s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 7.0
| [[InnsbruckNanshan 11A24580o|11A24580o]]
| InnsbruckNanshan
| 1.00.05
| -
|-
| [[InnsbruckNanshan 11A24581c|11A24581c]]
| InnsbruckNanshan
| ?
| -
|-
| [[Innsbruck 11A93840f|11A93840f]]
| Innsbruck?
| ?
| Originally found on a [https://forums.macrumors.com/threads/unusual-iphone-possible-engineering-sample-os.1885755/ Macrumors] post.
|-
|}

== [[N61AP|iPhone 6]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 8.0
| [[Okemo 12A22121a|12A22121a]]
| Okemo?
| ?
| -
|-
| [[Okemo 12A93311h|12A93311h]]
| Okemo?
| 1.00.01
| -
|-
| [[OkemoAni 12A93650o|12A93650o]]
| OkemoAni
| 1.00.05
| This build is pretty obscure, but it is in the wild.
|-
| [[OkemoAni 12A93651a|12A93651a]]
| OkemoAni
| 1.00.05
| -
|-
| [[OkemoAni 12A93651b|12A93651b]]
| OkemoAni
| 1.00.05
| -
|-
|}

== [[iPhone 6 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.0
| [[OkemoAni 12A22121a|12A22121a]]
| OkemoAni?
| ?
| -
|}

== [[iPhone 6s]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="4" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A93051l|13A93051l]]
| MonarchAni
| 0.37.08
| -
|-
| [[Monarch 13A93420d|13A93420d]]
| Monarch?
| ?
| -
|-
| [[Monarch 13A93420m|13A93420m]]
| Monarch?
| 1.00.05
| -
|-
|}

== [[iPhone 6s Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 9.0
| [[Monarch 13A22120w|13A22120w]]
| Monarch?
| ?
| -
|-
| [[MonarchAni 13A23161b|13A23161b]]
| ?
| ?
| -
|}

== [[D10AP|iPhone 7]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="5" | 10.0
| [[Whitetail 14A22580n|14A22580n]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A22881a|14A22881a]]
| Whitetail?
| ?
| -
|-
| [[Whitetail 14A92340t|14A92340t]]
| Whitetail?
| ?
| -
|-
| [[WhitetailAni 14A93012r|14A93012r]]
| WhitetailAni
| ?
| -
|-
| [[WhitetailAni 14A93013a|14A93013a]]
| WhitetailAni
| ?
| -
|-
|}

== [[iPhone 7 Plus]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 10.0
| [[WhitetailAni 14A22161a|14A22161a]]
| WhitetailAni?
| ?
| -
|-
| [[WhitetailAni 14A22181a|14A22181a]]
| WhitetailAni?
| ?
| -
|}

== [[D20AP|iPhone 8]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A93261h|15A93261h]]
| TigrisAni
| 00.34.09
| -
|-
| [[TigrisAni 15A93720r|15A93720r]]
| TigrisAni?
| ?
| -
|}

== [[D21AP|iPhone X]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 11.0
| [[TigrisAni 15A783601x|15A783601x]]
| TigrisAni?
| ?
| -
|-
| [[TigrisAni 15A783601y|15A783601y]]
| TigrisAni?
| ?
| -
|}

== [[N841AP|iPhone XR]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 12.0
| [[16A13580z]]
| Peace?
| ?
| -
|-
| [[16A73281c]]
| Peace?
| ?
| -
|}

== [[K48AP|iPad]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 3.2
| [[Wildcat 7B3341e|7B3341e]]
| Wildcat?
| ?
| -
|-
| [[Wildcat 7B5286a|7B5286a]]
| Wildcat?
| ?
| Found by SonnyDickson, documented on [https://9to5mac.com/2017/05/15/ipad-1-prototype/ 9to5mac]
|-
|}

== [[K93AP|iPad 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="2" | 4.3
| [[Durango 8F3178a|8F3178a]]
| Durango?
| ?
| -
|-
| [[Durango 8F3191d|8F3191d]]
| Durango
| ?
| -
|-
|}

== [[P106AP|iPad mini]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 6.0
| [[SundanceTaosTianshan 10A63970m|10A63970m]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63970v|10A63970v]]
| SundanceTaosTianshan
| ?
| -
|-
| [[SundanceTaosTianshan 10A63971b|10A63971b]]
| SundanceTaosTianshan
| ?
| -
|-
|}

== [[J86AP|iPad mini 2]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.3
| [[InnsbruckTaos 11B64940j|11B64940j]]
| InnsbruckTaos?
| ?
| -
|}

== [[J96AP|iPad mini 4]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 8.4
| [[Donner 12H60160o|12H60160o]]
| Donner?
| ?
| -
|-
| 9.0
| [[Monarch 13A62950o|13A62950o]]
| Monarch?
| ?
| -
|-
|}

== [[J71AP|iPad Air]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| 7.0.1
| [[Innsbruck 11B34640l|11B34640l]]
| Innsbruck?
| ?
| -
|}

== [[N18AP|iPod touch (3rd generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 3.1
| [[Inferno 7C1023e|7C1023e]]
| Inferno?
| ?
| -
|-
| [[Inferno 7C1095a|7C1095a]]
| Inferno?
| ?
| -
|-
| [[Northstar 7C144|7C144]]
| Northstar?
| ?
| -
|-
|}

== [[N81AP|iPod touch (4th generation)]] ==
{| class="wikitable"
|-
! Version
! Build
! Codename
! Baseband
! Comments
|-
| rowspan="3" | 5.1
| [[HoodooYabuli 9B3145a|9B3145a]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176b|9B3176b]]
| HoodooYabuli
| ?
| -
|-
| [[HoodooYabuli 9B3176n|9B3176n]]
| HoodooYabuli
| ?
| -
|}

[[Category:Firmware]]

ECID

2019-08-02T03:14:46Z

Vanished user 20210509:

The '''ECID''' ('''Exclusive Chip Identification'''<ref>https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf</ref> also referred to as '''Unique Chip ID''' in official Apple terms) is an identifier unique to every unit, or more accurately, to every SoC.

It is 64 bits wide, with either the first 12 or 20 bits set to zero (looks like <tt>000??XXXXXXXXXXX</tt> in hex).

It holds a key position in the [[SHSH Protocol]], being one of 2 elements that limit each [[APTicket]] to a single specific device.

'''Note''': Some tools show it in decimal format while others do it in hexadecimal.

== Getting the ECID ==
===Via iTunes===
* Connect your iDevice to your computer.
* Open iTunes.
* Navigate to the "Summary" tab for your device.
* At the top of the panel, click twice on the line that says "Serial Number".
* Your ECID is displayed in '''hexadecimal'''.

===Via third-party software===
====On-device====
The [http://cydia.saurik.com/package/com.malcolmhall.udidcalculator/ UDID Calculator] application from Cydia displays (among other things) the ECID of your device (shown in '''decimal''').

====Via USB====
* Install [https://github.com/libimobiledevice/libimobiledevice libimobiledevice].
* Connect your device over USB.
* Run <code>ideviceinfo | grep UniqueChipID</code> command.
* There should be exactly one line, reading <code>UniqueChipID</code> followed by your ECID (in '''decimal''').
* Alternatively you can run <code>ideviceinfo -k UniqueChipID</code> which fetches the UniqueChipID key directly (which is also faster).

===Via [[Recovery Mode]] or [[DFU Mode]]===
====Mac Instructions====
*Put your device in [[Recovery Mode]] or [[DFU Mode]].
*Open System Profiler. (in /Applications/Utilities/).
*In the sidebar, go to "USB" (in the "Hardware" section).
*Under "Serial Number", there should be a part called "ECID". There you go.

====Windows Instructions====
* Put your device in [[Recovery Mode]] or [[DFU Mode]].
* Open Device Manager and right click on Apple Mobile Device (Recovery or DFU Mode) for properties.
* Click on the details tab.
* Click on the dropdown box and select Device Instance Path.
* You should find it in the textbox.

===Extracting from an SHSH===
====Img3====
There are 19 blobs in an SHSH, and the first line of every blob is the same as below:

<code>RElDRUAAAAAIAAAA********AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</code>

The * part is the ECID(Dec) encrypted by a certain formula which is

a.Transform ECID(Dec) into ECID(Hex) such as 58608372174291 ---> 35 4D D3 34 4D D3

b.Reverse the ECID(Hex) string such as 35 4D D3 34 4D D3 ---> D3 4D 34 D3 4D 35

c.Transform the string we have got into binary such as D3 4D 34 D3 4D 35 ---> ÓM4ÓM5

d.Encode the binary with base64 such as ÓM4ÓM5 ---> 00000001

Use this formula backward (d. to a.) we can extract the * part into ECID(Dec).

====Img4====
First, get your apticket.der. There are two options:
* Copy it from your device in <code>/System/Library/Caches/apticket.der</code>.
* Extract it from an SHSH file, e.g. using <code>plutil -extract ApImg4Ticket xml1 -o - *.shsh | xmllint -xpath '/plist/data/text()' - | base64 -D > apticket.der;</code>.

Now you can use any old ASN.1 parser to display the file, such as <code>openssl asn1parse -i -inform DER -in apticket.der</code>.
To get only the ECID part, use <code>openssl asn1parse -inform DER -in apticket.der | grep -A1 ECID</code>. It should show on the second line after the colon (in '''hexadecimal''', possibly with a leading zero).

===Developer Instructions===
On OSX, call <code>AMDeviceCopyValue</code> in the [[MobileDevice Library|MobileDevice Framework]] with "UniqueChipID". It returns the ECID as a <code>CFNumberRef(kCFNumberSInt64Type)</code> object.

Example implementation (all safeties removed, will probably crash if connection fails), compile with <code>clang -F/System/Library/PrivateFrameworks -framework MobileDevice -framework CoreFoundation</code>:

<pre>
// Please ping @s1guza on Twitter if this file stops compiling/working
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <CoreFoundation/CoreFoundation.h>

// Cheap aliases to make things compile without headers
typedef void am_device;
typedef void am_device_notification;
typedef void* am_device_notification_callback_info;
extern void AMDeviceNotificationSubscribe(void(*callback)(am_device_notification_callback_info *info, void *arg), int unused1, int unused2, void *unknown, am_device_notification** notification);
extern void AMDeviceConnect(am_device *device);
extern void AMDeviceStartSession(am_device *device);
extern void* AMDeviceCopyValue(am_device *device, int unknown, CFStringRef value);

void cb(am_device_notification_callback_info *info, void *arg)
{
uint64_t ecid;
am_device *dev = *info; /* info->dev */
CFRetain(dev);
AMDeviceConnect(dev);
AMDeviceStartSession(dev);

CFNumberRef ecidRef = AMDeviceCopyValue(dev, 0, CFSTR("UniqueChipID"));
CFNumberGetValue(ecidRef, kCFNumberSInt64Type, &ecid);
printf("ECID: %llX\n", ecid);

CFRelease(dev);
exit(0);
}

int main()
{
uint32_t buf[5];
am_device_notification *notification = (am_device_notification*)buf;
AMDeviceNotificationSubscribe(&cb, 0, 0, NULL, &notification);
CFRunLoopRun();
return 0;
}
</pre>

===References===
<references />

File:Apple Connect Icon.png

2019-07-25T18:53:57Z

Vanished user 20210509: Wxblank uploaded a new version of File:Apple Connect Icon.png