The iPhone Wiki - User contributions [en]

Geeksn0w

2016-10-11T01:32:10Z

Xblkx: /* The Semi-Tether */

{{about|the semi-tethered jailbreak for iOS 7.1.x|the untethered jailbreak for iOS 7.1.x|Pangu}}
{{Infobox software
| title = Geeksn0w
| logo = [[File:Geeksn0w.png|75px]]
| screenshot = [[File:Geeksn0w_2.8.2.png|250px]]
| caption = Geeksn0w 2.8.2 on Windows 7
| author = [http://twitter.com/blackgeektuto BlackGeek]
| developer = [http://twitter.com/blackgeektuto BlackGeek]
| released =
| discontinued =
| latest release version = 2.9.1
| latest release date = {{Start date and age|2014|6|13|df=yes}}
| latest preview version = 1.0 beta (CLI)
| latest preview date = {{Start date and age|2014|5|1|df=yes}}
| programming language = .NET Visual Basic
| operating system = [[wikipedia:Microsoft Windows|Windows]] / [[wikipedia:OS X|OS X]]
| size =
| platform =
| language = [[wikipedia:English|English]]
| status = Active
| genre = Jailbreaking
| license = [[wikipedia:Freeware|Freeware]]
| website = [http://Geeksn0w.it Geeksn0w.it]
}}

'''Geeksn0w''' is a [[jailbreak]] program that performs a semi-[[tethered jailbreak]] for the [[iPhone 4]] on iOS 7.1.x.

== Supported Devices and Requirements==
The only supported devices are those of the [[iPhone 4]]. This is because Geeksn0w uses the [[A4]]-dependent [[limera1n exploit]] and the [[iPhone 4]] is the only A4 device running [[iOS]] 7. Geeksn0w currently only supports Windows (unless you use BootCamp or another VM on your Mac to install Windows). Geeksn0w requires [http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html Java Development Kit for 32-bit PCs] and [http://www.microsoft.com/net .NET Framework] installed on your computer to be able to run. Unlike other jailbreak tools (such as [[evasi0n7]]), Geeksn0w does not need iTunes to be installed.

==Versions and Updates==
Geeksn0w originally performed a [[tethered jailbreak]] on [[iOS]] 7.0 on the [[iPhone 4]] until [[evasi0n7]] was released. BlackGeek then updated Geeksn0w to use the same exploits as [[evasi0n7]] for all devices. Versions 2.5 and above perform a tethered jailbreak on iOS 7.1 for the iPhone 4. Version 2.9 performs a semi-tethered jailbreak on iOS 7.1 and 7.1.1.
On May 1, 2014, BlackGeek released the Mac beta cli for OS X.

===Download===
{| class="wikitable" style="text-align:center;"
! Version
! OS
! Download
! Changelog
|-
! 2.5
| class="noborderplz" rowspan="8" | [[wikipedia:Microsoft Windows|Windows]]
| [https://www.mega.co.nz/#!cA0nRQZA!khTx3YZ-Q5nZq2nYaB0dJtLrp16OLaTmi-TUEaBjk0s MEGA]
| First release that jailbreaks iOS 7.1
|-
! 2.6
| [https://www.mega.co.nz#!YBcCmKTL!ViKwyAzB8k30nly_LBTVnzlH_KK7LUyvTgQMcBOENXs MEGA]
| Bug fixes
|-
! 2.7
| [https://www.mediafire.com/download/1j4q76u9bm24wc0/geeksn0w_win_2.7_ea343bc6ca7b07ad662e2c4b3e0cefa.zip MediaFire]
|
* Added official Cydia 1.1.9 build
* Fixed Mail, Safari, Calculator and Weather crash after doing a tethered boot (SandBox fix)
* Added auto-Hacktivation for locked iPhones
* Fixed a bug in the Progress Bar
* Added iDevice arch finder: now GeekSn0w can auto-detect your iPhone model
* Improved speed of root_fs mount
* Fixed mount.sh error
* Reduced the .exe size
* Speeded up the Jailbreak process
* Added AFC2 protocol (iFunBox, iExplorer)
|-
! 2.8
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.8_7c148dc55660b4466dade25aa19bb.zip geeksn0w.it]
|
* Fixed a huge bug of GeekSn0w's dfuarch extension
|-
! 2.8.1
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.8.1_0b65917a7fd23e279ac97763338ecf.zip geeksn0w.it]
|
* Removed "dfuarch", now GeekSn0w uses iRecovery to identify the iPhone model
* Fixed "New Curses" installation error
|-
! 2.8.2
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_2.8.2_win_c7e3b8f62934143a93e69042c9de96f.zip geeksn0w.it]
|
* Fixed an issue with iPhone 3,2 and 3,3 Jailbreak's process
|-
! 2.8.3
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.8.3_3f17cffb2b38bc34a5d3dae91da8c2b.zip geeksn0w.it]
|
* Fixed an issue with New Curses installation
|-
! 2.9
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.9_6322a7e8d3b4bfefe9f585beb7d6d4a5.zip geeksn0w.it]
|
* Updated Jailbreak payload: GeekSn0w now executes a [[Tethered jailbreak|Semi-Tethered Jailbreak]]
* Updated .NET Framework version of some resources
* Removed Respring after any reboot: now all the hack stuff is executed during Apple Logo stage
* Supports iOS 7.1.1
|-
! 1.0 beta (cli)
| [[wikipedia:OS X|OS X]]
| [http://www.geeksn0w.it/GeekSn0w/Releases/Mac_cli/geeksn0w_cli_mac_1.0_d4bdaea1f30d353297d3d4293491f741.zip geeksn0w.it]
|
* First version for OS X.
|-
! 2.9.1
| Windows
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.9.1_c2d308ebe982521ba066a7299598372e.zip geeksn0w.it]
|
* Bundled with Cydia 1.1.12.
* Minor bug fixes
|}

==How it works==
Geeksn0w uses msftguy and DevBug's [[SSH Ramdisk]] tool which uses [[geohot]]'s [[limera1n exploit]] to obtain root access. It then installs Cydia and mounts the root filesystem. It then uses [[opensn0w]] to boot the [[iPhone 4]] tethered. Geeksn0w is technically a GUI of [[opensn0w]] and [[SSH Ramdisk|ssh_rd]].
===The Semi-Tether===
When the device is booted, it uses a LaunchDaemon to start a script in /gfix that reinstalls MobileSubstrate and PreferenceLoader from a local package and then kills the springboard and remounts the system partition as r/w. At installation time it sets the 'nvram' variable boot-args to true, which prevents [[Recovery Mode]]. However, it reinstalls MobileSubstrate and PreferenceLoader from a local package, which prevents [[saurik]] from updating it. It also kills the [[SpringBoard]] which adds additional boot time, and it remounts the fs after the first [[SpringBoard]] launch, which may cause other LaunchDaemons that needs r/w at boot time to fail. This is why many people have made their own SemiTether packages that use the 'dirhelper' which is being executed during the boot, to remount the fs and looping through /etc/rc.d and execute every binary there, just like [[evasi0n7]] does, which directly injects MobileSubstrate. They then use 'auto-boot' to prevent [[Recovery Mode]]. This resulting package boots faster and is far more efficient than the way it is currently used by. The reason that Geeksn0w is not an [[untethered jailbreak]], is that there is no kernel exploit. (Also call Semi-Untethered).

==The Semi-Tether==
*On April 21, 2014, BlackGeek announced on Twitter that he had achieved a [[Tethered_jailbreak#Using_a_tethered_(or_semi-tethered)_jailbreak|Semi-Tethered Jailbreak]] on the iPhone 4 on 7.1<ref>https://twitter.com/blackgeektuto/status/458283310100541441</ref>. On April 25, BlackGeek updated Geeksn0w to version 2.9 which achieved a semi-tethered jailbreak for 7.1 or 7.1.1. He also added the semi-tether package to his repo (http://geekrepo.beiphone.it) for people who had already jailbroken tethered on 7.1 and wanted to upgrade to Semi-Tethered.

==Exploits==
*[[geohot]]'s [[Limera1n exploit]] - Tethered

==See Also==
*[[Tethered jailbreak]]
*[[limera1n exploit]]
*[[opensn0w]]
*[http://twitter.com/blackgeektuto BlackGeek] on Twitter

==References==
<references/>

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

Geeksn0w

2016-10-11T01:25:25Z

Xblkx: /* Supported Devices and Requirements */ (typo)

{{about|the semi-tethered jailbreak for iOS 7.1.x|the untethered jailbreak for iOS 7.1.x|Pangu}}
{{Infobox software
| title = Geeksn0w
| logo = [[File:Geeksn0w.png|75px]]
| screenshot = [[File:Geeksn0w_2.8.2.png|250px]]
| caption = Geeksn0w 2.8.2 on Windows 7
| author = [http://twitter.com/blackgeektuto BlackGeek]
| developer = [http://twitter.com/blackgeektuto BlackGeek]
| released =
| discontinued =
| latest release version = 2.9.1
| latest release date = {{Start date and age|2014|6|13|df=yes}}
| latest preview version = 1.0 beta (CLI)
| latest preview date = {{Start date and age|2014|5|1|df=yes}}
| programming language = .NET Visual Basic
| operating system = [[wikipedia:Microsoft Windows|Windows]] / [[wikipedia:OS X|OS X]]
| size =
| platform =
| language = [[wikipedia:English|English]]
| status = Active
| genre = Jailbreaking
| license = [[wikipedia:Freeware|Freeware]]
| website = [http://Geeksn0w.it Geeksn0w.it]
}}

'''Geeksn0w''' is a [[jailbreak]] program that performs a semi-[[tethered jailbreak]] for the [[iPhone 4]] on iOS 7.1.x.

== Supported Devices and Requirements==
The only supported devices are those of the [[iPhone 4]]. This is because Geeksn0w uses the [[A4]]-dependent [[limera1n exploit]] and the [[iPhone 4]] is the only A4 device running [[iOS]] 7. Geeksn0w currently only supports Windows (unless you use BootCamp or another VM on your Mac to install Windows). Geeksn0w requires [http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html Java Development Kit for 32-bit PCs] and [http://www.microsoft.com/net .NET Framework] installed on your computer to be able to run. Unlike other jailbreak tools (such as [[evasi0n7]]), Geeksn0w does not need iTunes to be installed.

==Versions and Updates==
Geeksn0w originally performed a [[tethered jailbreak]] on [[iOS]] 7.0 on the [[iPhone 4]] until [[evasi0n7]] was released. BlackGeek then updated Geeksn0w to use the same exploits as [[evasi0n7]] for all devices. Versions 2.5 and above perform a tethered jailbreak on iOS 7.1 for the iPhone 4. Version 2.9 performs a semi-tethered jailbreak on iOS 7.1 and 7.1.1.
On May 1, 2014, BlackGeek released the Mac beta cli for OS X.

===Download===
{| class="wikitable" style="text-align:center;"
! Version
! OS
! Download
! Changelog
|-
! 2.5
| class="noborderplz" rowspan="8" | [[wikipedia:Microsoft Windows|Windows]]
| [https://www.mega.co.nz/#!cA0nRQZA!khTx3YZ-Q5nZq2nYaB0dJtLrp16OLaTmi-TUEaBjk0s MEGA]
| First release that jailbreaks iOS 7.1
|-
! 2.6
| [https://www.mega.co.nz#!YBcCmKTL!ViKwyAzB8k30nly_LBTVnzlH_KK7LUyvTgQMcBOENXs MEGA]
| Bug fixes
|-
! 2.7
| [https://www.mediafire.com/download/1j4q76u9bm24wc0/geeksn0w_win_2.7_ea343bc6ca7b07ad662e2c4b3e0cefa.zip MediaFire]
|
* Added official Cydia 1.1.9 build
* Fixed Mail, Safari, Calculator and Weather crash after doing a tethered boot (SandBox fix)
* Added auto-Hacktivation for locked iPhones
* Fixed a bug in the Progress Bar
* Added iDevice arch finder: now GeekSn0w can auto-detect your iPhone model
* Improved speed of root_fs mount
* Fixed mount.sh error
* Reduced the .exe size
* Speeded up the Jailbreak process
* Added AFC2 protocol (iFunBox, iExplorer)
|-
! 2.8
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.8_7c148dc55660b4466dade25aa19bb.zip geeksn0w.it]
|
* Fixed a huge bug of GeekSn0w's dfuarch extension
|-
! 2.8.1
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.8.1_0b65917a7fd23e279ac97763338ecf.zip geeksn0w.it]
|
* Removed "dfuarch", now GeekSn0w uses iRecovery to identify the iPhone model
* Fixed "New Curses" installation error
|-
! 2.8.2
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_2.8.2_win_c7e3b8f62934143a93e69042c9de96f.zip geeksn0w.it]
|
* Fixed an issue with iPhone 3,2 and 3,3 Jailbreak's process
|-
! 2.8.3
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.8.3_3f17cffb2b38bc34a5d3dae91da8c2b.zip geeksn0w.it]
|
* Fixed an issue with New Curses installation
|-
! 2.9
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.9_6322a7e8d3b4bfefe9f585beb7d6d4a5.zip geeksn0w.it]
|
* Updated Jailbreak payload: GeekSn0w now executes a [[Tethered jailbreak|Semi-Tethered Jailbreak]]
* Updated .NET Framework version of some resources
* Removed Respring after any reboot: now all the hack stuff is executed during Apple Logo stage
* Supports iOS 7.1.1
|-
! 1.0 beta (cli)
| [[wikipedia:OS X|OS X]]
| [http://www.geeksn0w.it/GeekSn0w/Releases/Mac_cli/geeksn0w_cli_mac_1.0_d4bdaea1f30d353297d3d4293491f741.zip geeksn0w.it]
|
* First version for OS X.
|-
! 2.9.1
| Windows
| [http://www.geeksn0w.it/GeekSn0w/Releases/Windows/geeksn0w_win_2.9.1_c2d308ebe982521ba066a7299598372e.zip geeksn0w.it]
|
* Bundled with Cydia 1.1.12.
* Minor bug fixes
|}

==How it works==
Geeksn0w uses msftguy and DevBug's [[SSH Ramdisk]] tool which uses [[geohot]]'s [[limera1n exploit]] to obtain root access. It then installs Cydia and mounts the root filesystem. It then uses [[opensn0w]] to boot the [[iPhone 4]] tethered. Geeksn0w is technically a GUI of [[opensn0w]] and [[SSH Ramdisk|ssh_rd]].
===The Semi-Tether===
When the device is booted, it uses a LaunchDaemon to start a script in /gfix that reinstalls MobileSubstrate and PreferenceLoader from a local package and then kills the springboard and remounts the system partition as r/w. At installation time it sets the 'nvram' variable boot-args to true, which prevents [[Recovery Mode]]. However, it reinstalls MobileSubstrate and PreferenceLoader from a local package, which prevents [[saurik]] from updating it. It also kills the [[SpringBoard]] which adds additional boot time, and it remounts the fs after the first [[SpringBoard]] launch, which may cause other LaunchDaemons that needs r/w at boot time to fail. This is why many people have made their own SemiTether packages that use the 'dirhelper' which is being executed during the boot, to remount the fs and looping through /etc/rc.d and execute every binary there, just like [[evasi0n7]] does, which directly injects MobileSubstrate. They then use 'auto-boot' to prevent [[Recovery Mode]]. This resulting package boots faster and is far more efficient than the way it is currently used by. The reason that Geeksn0w is not an [[untethered jailbreak]], is that there is no kernal exploit. (Also call Semi-Untethered).

==The Semi-Tether==
*On April 21, 2014, BlackGeek announced on Twitter that he had achieved a [[Tethered_jailbreak#Using_a_tethered_(or_semi-tethered)_jailbreak|Semi-Tethered Jailbreak]] on the iPhone 4 on 7.1<ref>https://twitter.com/blackgeektuto/status/458283310100541441</ref>. On April 25, BlackGeek updated Geeksn0w to version 2.9 which achieved a semi-tethered jailbreak for 7.1 or 7.1.1. He also added the semi-tether package to his repo (http://geekrepo.beiphone.it) for people who had already jailbroken tethered on 7.1 and wanted to upgrade to Semi-Tethered.

==Exploits==
*[[geohot]]'s [[Limera1n exploit]] - Tethered

==See Also==
*[[Tethered jailbreak]]
*[[limera1n exploit]]
*[[opensn0w]]
*[http://twitter.com/blackgeektuto BlackGeek] on Twitter

==References==
<references/>

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

ITunes Backup

2016-09-26T06:40:51Z

Xblkx: /* Location BPList */ correct typo (dcit-->dict)

{{lowercase}}
The following description is to describe the '''backup system of [[iTunes]]''', which is often used for forensic analysis of iDevices. This description is for the format used in iTunes 10.5.3 an newer - older versions are slightly different (see [[Understanding iPhone Backup Files]]). The description is for non-encrypted backups only.

On the iDevice the file <code>/System/Library/Backup/Domains.plist</code> determines what files to backup. There is a differentiation between "domains" and relative files.

In the backup location (see below) there are all backups that iTunes has made so far. Every backup folder name corresponds to the [[UDID]] of the device for a full backup. A differential backup has the same folder name, but appened with a dash and the ISO date of the backup (8 digit yyyymmdd) and a dash and the time in 24-hour format with seconds.

In each backup, there are four files with infos, which are described later:
*Info.plist
*Manifest.mdbd
*Manifest.plist
*Status.plist
There are also the files themselves, but with a new file name.

The file names are made by a SHA-1 hash of their name, together with their path and domain. Between the domain and the path there is a dash. Example:
SHA1('HomeDomain-Library/SMS/sms.db') = 3d0d7e5fb2ce288813306e4d4636395e047a3d28
It is not clear what would happen in case of hash collisions. Probably Apple assumes it won't happen.

The data itself is encrypted with AES-256 CBC.

===iTunes backup location===
*Windows XP: <code>%HOMEPATH%\Application Data\Apple Computer\MobileSync\Backup\{UDID}</code>
*Windows Vista/7/8: <code>%HOMEPATH%\AppData\Roaming\Apple Computer\MobileSync\Backup\{UDID}</code> or <code>%APPDATA%\Apple Computer\MobileSync\Backup\{UDID}</code>
*OS X: <code>~/Library/Application Support/MobileSync/Backup/{UDID}</code>

=== Info.plist ===
This is a plaintext plist that contains the following dict:
*Build Version (string): 9A406 (iOS build version of the device that was backed up)
*Device Name (string): (name of the device that was backed up)
*Display Name (string): (name of the device that was backed up)
*GUID (string): unknown 16-byte GUID without any dashes
*ICCID (string)
*IMEI (string)
*Last Backup Date (date): format "yyyy-mm-ddThh:mm:ssZ"
*Phone Number (string)
*Product Type (string): iPhone4,1
*Product Version (string): 5.0.1
*Serial Number (string)
*Sync Settings (dict):
**Calendar Day Limit (integer): 30
**Calendars Collections: (array of dict, 1 element):
***AMSCollectionDisplayName (string): Calendar
***AMSCollectionFiltered (bool): false
***AMSCollectionName (string): Calendar
***AMSCollectionReadOnly (bool): false
**Data Class Info: (array of dict, 5 elements)
***[0] dict:
****kAMSDataClassEnabled (bool): false
****kAMSDataClassName (string): com.apple.Bookmarks
****kAMSDataClassReset (bool): false
***[1] dict:
****kAMSDataClassEnabled (bool): false
****kAMSDataClassName (string): com.apple.Calendars
****kAMSDataClassReset (bool): false
***[2] dict:
****kAMSDataClassEnabled (bool): false
****kAMSDataClassName (string): com.apple.Accounts
****kAMSDataClassReset (bool): false
***[3] dict:
****kAMSDataClassEnabled (bool): false
****kAMSDataClassName (string): com.apple.MailAccounts
****kAMSDataClassReset (bool): false
***[4] dict:
****kAMSDataClassEnabled (bool): true
****kAMSDataClassName (string): com.apple.Notes
****kAMSDataClassReset (bool): false
**New Record Calendar Name (string): Home
**iTunes User ID (string): (8-byte hex code)
*Target Identifier (string): 20-byte hex code
*Terget Type (string): Device
*Unique Identifier (string): same 20-byte hex code
*iBooks Data 2 (data): (base-64 encoded blob, see below)
*iTunes Files (dict):
**IC-Info.siv (data): (base-64 encoded blob, see below)
**PhotosFolderAlbums (data): (base-64 encoded blob, see below)
**PhotosFolderName (data): (base-64 encoded blob, see below)
**PhotosFolderPrefs (data): (base-64 encoded blob, see below)
**ShowMarketing (data): (empty)
**iTunesPrefs (data): (base-64 encoded blob, see below)
**iTunesPrefs.plist (data): (base-64 encoded blob, see below)
*iTunes Settings (dict):
**LibraryApplications (array of string): The array of string contains the identification string of each application, for example <code>com.apple.store.caseprogram</code>
*iTunes Version (string): 10.5.3

==== iBooks Data 2 ====
This blob is actually another plist (dict):
*1.2 (dict):
**BKBookmark (array of dict):
***[0] dict:
****bookDatabaseKey (string)
****date (integer)
****deletedFlag (bool)
****highlightColor (integer)
****lastModification (integer)
****locationBPlist (data): (base-64 encoded blob, see below)
****ordinal (integer)
****serverSyncUniqueId (string): Reading Location
****type (integer): 1
*CollectionsData-1.2 (dict):
**BKCollection (array of 2 dict):
***[0] dict:
****databaseKeys (array): (empty)
****lastModification_Since1970 (integer)
****ServerSyncUniqueId (string): Pdfs_Collenction_ID
****sortKey (integer): -2
****title (string): PDFs
***[1] dict:
****databaseKeys (array): (empty)
****lastModification_Since1970 (integer)
****ServerSyncUniqueId (string): Pdfs_Collenction_ID
****sortKey (integer): -1
****title (string): Books
**rolling_version (integer): 17

===== Location BPList =====
This is actually a binary plist with the following content (dict): (example):
*class (string): BKEpubLocation
*endOffset (real): 0,0
*endPath (array of dict):
**[0] dict
***id (string): seeAlsoSection
***index (integer): 32
***tagName (string): div
**[1] dict
***index (integer): 3
***tagName (string): p
*startOffset (real): 0.0
*startPath (array of dict):
**[0] dict:
***id (string): seeAlsoSection
***index (integer): 32
***tagName (string): div
**[1] dict:
***index (integer): 3
***tagName (string): p
*super (dict):
**class (string): BKLocation
**ordinal (integer): 3

==== IC-Info.siv ====
binary file, content unknown

==== PhotosFolderAlbums ====
[[frpd]] binary file. Starts with 0x66 0x72 0x70 0x64 ('frpd'). Then only very few bytes and the content is mostly zero. Then at 0x68 and 0x26C, 0x470, 0x674, etc. there are folder names (in unicode, starting with the name length).

==== PhotosFolderName ====
A 0x200 byte long file, starting with the text "Pictures" (in unicode) and the name length before it. Rest filled with zeroes.

==== iTunesPrefs ====
This is another [[frpd]] file. It contains names of computers found on the network, like iPodPrefs below.

==== iTunesPrefs.plist ====
plist with this content (dict):
*ApplicationIDs (array of string): list of applications (like <code>com.apple.iBooks</code>
*AudiobookPlaylistIDs (array): (empty)
*AudioTrackIDs (array): (empty)
*BookTrackIDs (array of integer): (signed long integer values)
*LibraryBookTrackIDs (array of integer): (signed long integer values)
*MoviePlaylistIDs (array): (empty)
*MovieTrackIDs (array): (empty)
*MusicAlbumIDs (array): (empty)
*MusicArtistIDs (array): (empty)
*MusicGenreNames (array): (empty)
*MusicPlaylistIDs (array of integer): (signed long integer values)
*MusicTrackIDs (array): (empty)
*PodcastChannelIDs (array): (empty)
*PodcastPlaylistIDs (array): (empty)
*PodcastTrackIDs (array of integer): (signed long integer values)
*RingtoneTrackIDs (array): (empty)
*TVShowAlbumIDs (array): (empty)
*TVShowNames (array): (empty)
*TVShowPlaylistIDs (array): (empty)
*TVShowTrackIDs (array): (empty)
*iPodPrefs (data): (base-64 encoded blob, see below)
*iTunesUChannelIDs (array): (empty)
*iTunesUPlaylistIDs (array): (empty)
*iTunesUTrackIDs (array): (empty)

===== iPodPrefs =====
[[frpd]] file, content unknown, but it contains server names on the network it was sync'd to, like iTunesPrefs above.

=== Manifest.mbdb ===
Binary file containing many text strings. Probably a database of file names in the backup. Format (from [http://code.google.com/p/iphonebackupbrowser/wiki/MbdbMbdxFormat here]):
==== Header ====
6 bytes: 'mbdb\5\0'
==== Record (variable size) ====
string Domain Backup domain (one of
"AppDomain-com.some.user.installed.app",
"CameraRollDomain",
"DatabaseDomain"
"HomeDomain",
"KeychainDomain",
"ManagedPreferencesDomain",
"MediaDomain",
"MobileDeviceDomain",
"RootDomain",
"SystemPreferencesDomain",
"WirelessDomain",
... others?
string Path
string LinkTarget absolute path
string DataHash SHA-1 of file contents, actual file objects only
string encryptionKey Encryption key for encrypted backups
uint16 Mode Unix file permissions. See /usr/include/stat.h and stat(2)
file mode: 0xAxxx symbolic link (aka S_IFLNK or 00120000)
0x4xxx directory (aka S_IFDIR or 0040000)
0x8xxx regular file (aka S_IFREG or 0100000)
Mask out ~ 0xf000 (aka S_IFMT) for file permissions
uint32 inode inode number
uint32 uid owner
uint32 gid group
uint32 mtime time of last modification
uint32 atime time of last access
uint32 ctime time of last change of status
uint64 length file size (always 0 for link or directory)
uint8 protectionclass unknown
uint8 PropertyCount number of properties following
Property is a couple of strings:
string name
string value can be a string or aa binary content
All values are big endian, strings are composed of a uint16 that contains the length or 0xffff for NULL, then the characters in UTF-8 with canonical decomposition (Unicode normalization form D).

To determine the actual filename corresponding to a record (this will be the actual file in the mobile backup directory), calculate a sha-1 checksum of the Domain and Path seperated by '-' as follows:
SHA1(<Domain>-<Path>)

It is possible to modify files in a mobile backup by understanding this structure as well. If you change the file contents, update the DataHash and length

=== Manifest.plist ===
Binary plist with the following content (dict):
*Applications (dict):
**com.apple.iBooks (dict)
***CFBundleIdentifier (string): com.apple.iBooks
***CFBundleVersion (string): 804
***Path (string): /private/var/mobile/Applications/[GUID]/iBooks.app
**etc. for other apps
*BackupKeyBag (data): (base-64 encoded blob, see below)
*Date (date): yyyy-mm-ddThh:mm:ssZ
*IsEncrypted (bool): false
*Lockdown (dict):
**BuildVersion (string): 9A406
**DeviceName (string)
**ProductType (string): iPhone4,1
**ProductVersion (string): 5.0.1
**SerialNumber (string)
**UniqueDeviceID (string): 20-byte hex
**com.apple.Accessibility (dict):
***InvertDisplayEnabledByiTunes (bool): false
***MonoAudioEnabledByiTunes (bool): false
***VoiceOverTouchEnabledByiTunes (bool): false
***ZoomTouchEnabledByiTunes (bool): false
**com.apple.MobileDeviceCrashCopy (dict):
***ShouldPrompt (bool): false
***ShouldSubmit (bool): false
**com.apple.TerminalFlashr (dict): (empty)
**com.apple.iTunes.backup (dict):
***LastBackupComputerName (string)
***LastBackupComputerType (string): PC
**com.apple.itunesstored (dict):
***AccountAvailableServiceTypes (integer): 0
***AccountKind (integer): 0
***AccountServiceTypes (integer): 0
***AccountSocialEnabled (bool): false
***AccountStoreFront (string): (unknown text string)
***AccountURLBagType (string): production
***AppleID (string)
***CreditDisplayString (string): (empty string)
***DSPersonID (integer)
***TempStorefront (string): (unknown text string)
**com.apple.mobile.data_sync (dict):
***Bookmarks (dict):
****AccountNames (array of string, 1 element): iCloud
****Sources (array of string, 1 element): iCloud
***Calendars (dict):
****AccountNames (array of string, 1 element): iCloud
****Sources (array of string, 1 element): iCloud
***Contacts (dict):
****AccountNames (array of string, 1 element): iCloud
****Sources (array of string, 1 element): iCloud
**com.apple.mobile.iTunes.accessories (dict): (empty)
**com.apple.mobile.wireless_lockdown (dict): (empty)
*SystemDomainsVersion (string): 12.0
*Version (string): 9.0
*WasPasscodeSet (bool): false

==== BackupKeyBag ====
Binary file in the following format:
*4-byte block identifier
*4-byte block length (most significant byte first), length 4 means total block length of 0xC bytes.
*data
First block is "VERS" with a version number of 3. There are a lot of block types: VERS, TYPE, UUID, HMCK, WRAP, SALT, ITER, UUID, CLAS, WRAP, KTYP, WPKY, etc.

=== Status.plist ===
Binary plist with the following content (dict):
*BackupState (string): new
*Date (date): "yyyy-mm-ddThh:mm:ssZ"
*IsFullBackup (bool): false
*SnapshotState (string): finished
*UUID (string)
*Version (string): 2.4

== Files ==
Here is a list of commonly used files:
{| class="wikitable" style="font-size: small; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!domain
!path and file name
!SHA-1 backup file name
|-
|HomeDomain
|[[Messages#Serialization|Library/SMS/sms.db]]
|3d0d7e5fb2ce288813306e4d4636395e047a3d28
|-
|HomeDomain
|Library/AddressBook/AddressBook.sqlitedb
|31bb7ba8914766d4ba40d6dfb6113c8b614be442
|-
|HomeDomain
|[[Notes|Library/Notes/notes.sqlite]]
|ca3bc056d4da0bbf88b5fb3be254f3b7147e639c
|-
|WirelessDomain
|[[Call History Database|Library/CallHistory/call_history.db]]
|2b2b0084a1bc3a5ac8c27afdf14afb42c61a19ca
|}

== References ==
*[[:/System/Library/Backup]]
*[[Understanding iPhone Backup Files]]
*[http://www.ssddfj.org/papers/SSDDFJ_V4_1_Bader_Bagilli.pdf iPhone 3GS Forensics]
*[http://www.scip.ch/?labs.20110512 SCIP backup infos (german only)]
*[http://stackoverflow.com/questions/6569004/how-to-parse-the-manifest-mbdb-file-in-an-ios-5-0-beta-2-without-manifest-mbdx SHA-1 hash generation]
*[http://code.google.com/p/iphonebackupbrowser/wiki/MbdbMbdxFormat description of mbdx and mbdb files]

[[Category:File Formats]]