The iPhone Wiki - User contributions [en]

ITunes Errors/Below 100

2012-05-24T00:25:59Z

XiiiX: /* Error 21 */

=== Error 1 ===

* You are attempting to downgrade an iPhone from iOS 5 to iOS 4.x. To resolve, use either custom firmware created by [[PwnageTool]]/[[sn0wbreeze]] or use [[User:semaphore|notcom]]'s [[FixRecovery]] utility available on [http://thefirmwareumbrella.blogspot.com his site].
* On an [[iPhone 4]] downgrading from iOS 5, use the option in [[TinyUmbrella]] to allow a baseband "upgrade" to bypass the error and go back to basband [[4.10.1]].
* Unable to downgrade. Try changing the USB port (the back one of chassis is better) and restart computer.
* The installed version of [[iTunes]] may also be too old. Update iTunes.
* You are trying to downgrade an [[iPhone 4]] to an earlier version of iOS 5, using redsn0w. To resolve, stitch your blobs to a "No_BB" ipsw of the firmware you are trying to downgrade to.

=== Error 2 ===
* ASR does not exist on ramdisk or is corrupt/not signed.
* [[sn0wbreeze]] 1.6 Custom Firmware has a [[ASR]] patch problem. Use [[sn0wbreeze]] 1.7+ or [[PwnageTool]]. Device isn't bootable.

=== Error 6 ===
Not enter the downgrading mode, change USB port (the back one of chassis is better) and restart computer.

=== Error 9 ===
* Due to asr being patched, the SHA signature is automatically changed and after being resigned the kernel will refuse to use it. Therefore proper kernel patches are required. If necessary kernel patches are not applied, it will fail to load asr and error 9 would occur during restore.
* Rebooting your Mac or PC may resolve this issue.

=== Error 10 ===
[[LLB]] is missing from the [[IPSW File Format|IPSW]]. The device cannot be booted up. The trick to skip the baseband update no longer works.

=== Error 11 ===
* Removed [[Baseband|BB]]<nowiki />FW file in the firmware folder of an unzipped [[IPSW File Format|IPSW]]. Can also be used to prevent a baseband update. The device is bootable, if you set the auto-boot to true or use TinyUmbrella and use "Kick Device out of Recovery".
* You are trying to update to a custom firmware from [[PwnageTool]] 4.1+. You always have to go into DFU mode and restore from there.

=== Error 13 ===
* Occurs when you want to install a beta firmware with [[iTunes]] for Windows (actively blocked by Apple; beta users are developers and therefore must have a Mac).
* USB problem. Check the USB connection and try other direct ports or maybe the USB cable is an older one. Device isn't bootable.
* The installed version of [[iTunes]] may also be too old. For firmwares 4.0 and higher you need iTunes 9.2 or higher. Update iTunes.

=== Error 14 ===
* Custom firmware update fail ([[PwnageTool]] until 4.0.1). You have to restore the device with a custom firmware. Update to a custom firmware isn't working. Device isn't bootable. 2
* USB Problem. Check the USB connection and try other direct ports or maybe the USB cable is an older one. Device isn't bootable.
* You're trying to 'update' to a [[Beta Firmware|beta firmware]] instead of performing a restore. Device is still bootable if you kick it out of recovery mode.
* Rebooting your Mac or PC may resolve this issue.
* Root file-system partition size was set too small in the ramdisk's options plist.

=== Error 17 ===
* Device failed to display the applelogo img3 which results in this error.
* One or more of the nand0/nor0 flash images were missing from the IPSW.

=== Error 18 ===
This occurs when the media library on the device is corrupt and cannot be modified or updated.

Updating to the latest version of iTunes and then restoring should resolve this issue

=== Error 20 ===
Reportedly happens during failed downgrade attempts (iOS 2.0 to 1.1.1, 5 beta to 4.3.3).

Some have seen success afterwards by doing the downgrade from DFU mode instead of the normal Recovery mode.

=== Error 21 ===
* Custom firmware restore fail ([[PwnageTool]] since 4.1). You have to put your device into the DFU mode and not into recovery mode. Device won't boot correctly an stuck at the Apple logo after the error. Press and hold power and home button until it reboots.
* Error when using Sauriks server for a restore with iOS 5.x in the recovery mode at least on a A5 device.
* This error can also happen when you try to restore an iPod with hardware dfu. Use iREB r5 to solve this.

=== Error 23 ===
Cannot restore or update due to hardware problems.
* In software you have to set default web browser.
* In hardware, it's a communication problem. Check all connections, also try to change battery.
* Faulty [[baseband]] flash or processor
* Happens frequently after water damage. Remove and clean motherboard.

=== Error 26 ===
* Values or variables in the options property list within the ramdisk are incorrect.
* False version of the [[NOR]] flash firmware. Use the correct [[sn0wbreeze]] version.

=== Error 27 ===
* I got this after I tried to flash iOS5 from 3Gs on a 3G Phone (I modified the restore.plist so it would flash and also exchanged RestoreRamDisk and kernelcache)

=== Error 28 ===
* Hardware error. Return your device to Apple if possible. The problem is a bad dock connector on the iPhone. Must change the connector.
* If you have tried almost everything, reset the logic board (leave uncharged for five days or remove battery for half an hour), then pwn and restore. If this doesn't work, the {{wp|flash memory}}/{{wp|hard drive}} of your device is damaged.

=== Error 29 ===
See [http://discussions.apple.com/ Apple's discussion thread] number [http://discussions.apple.com/thread.jspa?threadID=2329795 2329795] about this problem. You might need to change the battery.

=== Error 31 ===
{{main|DFU Loop}}

=== Error 34 ===
Hard disk is run out of space when trying to download. Clear space and then continue downloading.

=== Error 37 ===
* [[N72ap|iPod touch 2G]] [[LLB]] patched with the [[0x24000 Segment Overflow]] was used on an [[N88ap|iPhone 3GS]] custom firmware. Known on damaged bundles from unofficial [[PwnageTool]] distributions or bundles.
* [[sn0wbreeze]] 2.0.1 bug, which was fixed in 2.0.2.
* Recent [[sn0wbreeze]] can cause this issue. Deselect all custom boot logos, recreate [[IPSW File Format|IPSW]]. If received on an [[N88ap|iPhone 3GS]], select "new boot-rom" and deselect all custom bootlogos, then recreate the [[IPSW File Format|IPSW]].

=== Error 40 ===
Hacktivation bug in [[Sn0wbreeze]] 2.0.1, which was fixed in [[Sn0wbreeze]] 2.0.2.

=== Error 46 ===
?

Talk:Bootrom Dumper Utility

2012-01-02T23:09:07Z

XiiiX:

If anyone gets it working for [[n72ap|iPod touch 2G]], let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current [[n72ap|iPod touch 2G]] [[OpeniBoot]] [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy [[steaks4uce]] version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 03:38, 29 December 2010 (UTC)
:::i use ''sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc'' --[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
::::Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 22:45, 29 December 2010 (UTC)
::hey liam when I try running this on linux i get 84 00 00 00 05 00 00 00 80 00 00 00 80 62 02 22 FF FF FF FF 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 01 38 02 22 90 D7 02 22 and then the rest of it gets filled with nulls until the next 0x800 bytes start :( [[User:Revolution|Revolution]] 19:02, 19 February 2011 (UTC)
:::use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)
:::run:
::::''<code>sudo apt-get install libusb-1.0-0 libusb-1.0-0-dev libreadline6-dev readline-common libreadline6 libreadline-dev texinfo cmake git-core build-essential texinfo libreadline-dev libssl-dev libusb-1.0-0-dev libpng12-dev libusb-dev autoconf automake libnewlib-dev</code>'' [[Image:Return.png|15px]] Return
::::''<code>sudo build-toolchain.sh</code>'' [[Image:Return.png|15px]] Return
:::for linux
:::--[[User:Liamchat|liamchat]] 01:35, 20 February 2011 (UTC)
::::um liam I did that... on line 145 you need to make that specified for macosx only, well at least that's what the pod2g's version did... try building it on linux. [[User:Revolution|Revolution]] 16:51, 20 February 2011 (UTC)
::::i fixed the error there does not need to be any specific platform support for [[usb control msg(0xA1, 1) Exploit|stake]] or [[pwnage2]] i think there is better way using [http://www.beyondlogic.org/usbnutshell/usb5.shtml|USB Descriptors] --[[User:Liamchat|liamchat]] 00:02, 21 February 2011 (UTC)
::::: I just tried your new version. It still doesn't work. i managed to dump the bootrom with openiboot but yeah. here is the dump your ipod produces. it contains no copy writed code so i'll paste it here. [http://www.mediafire.com/?um4gz4ga00v067a] [[User:Revolution|Revolution]] 21:11, 24 February 2011 (UTC)
:::::: None of his things will work, I can promise you that. He doensn't know what he is doing. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 00:22, 25 February 2011 (UTC)
:::::::i have edited it again however i cant the usb wait for image call offset i origany thought it was the [https://github.com/Chronic-Dev/syringe/blob/master/syringe/exploits/steaks4uce/steaks4uce.S#L30 usb wait for image offset] from syringe. --[[User:Liamchat|liamchat]] 20:41, 7 March 2011 (UTC)
== VMware + Windows ==
anyone tried this on vmware + windows? can't make it work. tried on [[n90ap|iPhone 4]] & [[n18ap|iPod touch 3G]] -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the [[limera1n]] exploit. it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

== A5 devices ==
Can we use this tool to dump A5 devices? --[[User:XiiiX|XiiiX]] 12:28, 2 January 2012 (MST)
:Not until there is a jailbreak for A5 devices.--[[User:M2m|M2m]] 12:51, 2 January 2012 (MST)
:No. Limera1n doesn't work on A5 devices. --[[User:Http|http]] 13:04, 2 January 2012 (MST)
::It's kind of non-sense this tool so. To dump already hacked bootroms? --[[User:XiiiX|XiiiX]] 14:21, 2 January 2012 (MST)
:::No. Not really. You may find an exploit outside the bootrom which leads to a jailbreak which you can use to dump the bootrom which can help you to find exploits in the bootrom for later jailbreaks. Jailbreaks based on bootrom exploits can only be fixed with new hardware.--[[User:M2m|M2m]] 15:28, 2 January 2012 (MST)
::::That's a better explanation. So we don't need a bootrom jailbreak to use this, just a user-land could work? Why is the necessity of a jailbreak to dump te bootrom? We need the offsets? --[[User:XiiiX|XiiiX]] 16:09, 2 January 2012 (MST)
:Look the source code, it use an BootROM exploit, there is no public BootROM exploit for A5 ~zmaster

Talk:Bootrom Dumper Utility

2012-01-02T21:21:56Z

XiiiX:

If anyone gets it working for [[n72ap|iPod touch 2G]], let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current [[n72ap|iPod touch 2G]] [[OpeniBoot]] [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy [[steaks4uce]] version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 03:38, 29 December 2010 (UTC)
:::i use ''sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc'' --[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
::::Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 22:45, 29 December 2010 (UTC)
::hey liam when I try running this on linux i get 84 00 00 00 05 00 00 00 80 00 00 00 80 62 02 22 FF FF FF FF 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 01 38 02 22 90 D7 02 22 and then the rest of it gets filled with nulls until the next 0x800 bytes start :( [[User:Revolution|Revolution]] 19:02, 19 February 2011 (UTC)
:::use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)
:::run:
::::''<code>sudo apt-get install libusb-1.0-0 libusb-1.0-0-dev libreadline6-dev readline-common libreadline6 libreadline-dev texinfo cmake git-core build-essential texinfo libreadline-dev libssl-dev libusb-1.0-0-dev libpng12-dev libusb-dev autoconf automake libnewlib-dev</code>'' [[Image:Return.png|15px]] Return
::::''<code>sudo build-toolchain.sh</code>'' [[Image:Return.png|15px]] Return
:::for linux
:::--[[User:Liamchat|liamchat]] 01:35, 20 February 2011 (UTC)
::::um liam I did that... on line 145 you need to make that specified for macosx only, well at least that's what the pod2g's version did... try building it on linux. [[User:Revolution|Revolution]] 16:51, 20 February 2011 (UTC)
::::i fixed the error there does not need to be any specific platform support for [[usb control msg(0xA1, 1) Exploit|stake]] or [[pwnage2]] i think there is better way using [http://www.beyondlogic.org/usbnutshell/usb5.shtml|USB Descriptors] --[[User:Liamchat|liamchat]] 00:02, 21 February 2011 (UTC)
::::: I just tried your new version. It still doesn't work. i managed to dump the bootrom with openiboot but yeah. here is the dump your ipod produces. it contains no copy writed code so i'll paste it here. [http://www.mediafire.com/?um4gz4ga00v067a] [[User:Revolution|Revolution]] 21:11, 24 February 2011 (UTC)
:::::: None of his things will work, I can promise you that. He doensn't know what he is doing. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 00:22, 25 February 2011 (UTC)
:::::::i have edited it again however i cant the usb wait for image call offset i origany thought it was the [https://github.com/Chronic-Dev/syringe/blob/master/syringe/exploits/steaks4uce/steaks4uce.S#L30 usb wait for image offset] from syringe. --[[User:Liamchat|liamchat]] 20:41, 7 March 2011 (UTC)
== VMware + Windows ==
anyone tried this on vmware + windows? can't make it work. tried on [[n90ap|iPhone 4]] & [[n18ap|iPod touch 3G]] -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the [[limera1n]] exploit. it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

== A5 devices ==
Can we use this tool to dump A5 devices? --[[User:XiiiX|XiiiX]] 12:28, 2 January 2012 (MST)
:Not until there is a jailbreak for A5 devices.--[[User:M2m|M2m]] 12:51, 2 January 2012 (MST)
:No. Limera1n doesn't work on A5 devices. --[[User:Http|http]] 13:04, 2 January 2012 (MST)
::It's kind of non-sense this tool so. To dump already hacked bootroms? --[[User:XiiiX|XiiiX]] 14:21, 2 January 2012 (MST)
:Look the source code, it use an BootROM exploit, there is no public BootROM exploit for A5 ~zmaster

Talk:Bootrom Dumper Utility

2012-01-02T19:28:50Z

XiiiX: /* A5 devices */ new section

If anyone gets it working for [[n72ap|iPod touch 2G]], let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current [[n72ap|iPod touch 2G]] [[OpeniBoot]] [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy [[steaks4uce]] version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 03:38, 29 December 2010 (UTC)
:::i use ''sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc'' --[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
::::Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 22:45, 29 December 2010 (UTC)
::hey liam when I try running this on linux i get 84 00 00 00 05 00 00 00 80 00 00 00 80 62 02 22 FF FF FF FF 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 01 38 02 22 90 D7 02 22 and then the rest of it gets filled with nulls until the next 0x800 bytes start :( [[User:Revolution|Revolution]] 19:02, 19 February 2011 (UTC)
:::use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)
:::run:
::::''<code>sudo apt-get install libusb-1.0-0 libusb-1.0-0-dev libreadline6-dev readline-common libreadline6 libreadline-dev texinfo cmake git-core build-essential texinfo libreadline-dev libssl-dev libusb-1.0-0-dev libpng12-dev libusb-dev autoconf automake libnewlib-dev</code>'' [[Image:Return.png|15px]] Return
::::''<code>sudo build-toolchain.sh</code>'' [[Image:Return.png|15px]] Return
:::for linux
:::--[[User:Liamchat|liamchat]] 01:35, 20 February 2011 (UTC)
::::um liam I did that... on line 145 you need to make that specified for macosx only, well at least that's what the pod2g's version did... try building it on linux. [[User:Revolution|Revolution]] 16:51, 20 February 2011 (UTC)
::::i fixed the error there does not need to be any specific platform support for [[usb control msg(0xA1, 1) Exploit|stake]] or [[pwnage2]] i think there is better way using [http://www.beyondlogic.org/usbnutshell/usb5.shtml|USB Descriptors] --[[User:Liamchat|liamchat]] 00:02, 21 February 2011 (UTC)
::::: I just tried your new version. It still doesn't work. i managed to dump the bootrom with openiboot but yeah. here is the dump your ipod produces. it contains no copy writed code so i'll paste it here. [http://www.mediafire.com/?um4gz4ga00v067a] [[User:Revolution|Revolution]] 21:11, 24 February 2011 (UTC)
:::::: None of his things will work, I can promise you that. He doensn't know what he is doing. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 00:22, 25 February 2011 (UTC)
:::::::i have edited it again however i cant the usb wait for image call offset i origany thought it was the [https://github.com/Chronic-Dev/syringe/blob/master/syringe/exploits/steaks4uce/steaks4uce.S#L30 usb wait for image offset] from syringe. --[[User:Liamchat|liamchat]] 20:41, 7 March 2011 (UTC)
== VMware + Windows ==
anyone tried this on vmware + windows? can't make it work. tried on [[n90ap|iPhone 4]] & [[n18ap|iPod touch 3G]] -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the [[limera1n]] exploit. it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

== A5 devices ==

Can we use this tool to dump A5 devices? --[[User:XiiiX|XiiiX]] 12:28, 2 January 2012 (MST)

Talk:NAND

2011-12-24T02:04:13Z

XiiiX: Reading the NAND

== Reading the NAND ==

Could we use Progskeet (Yeah, the one from PS3) to read the NAND? --[[User:XiiiX|XiiiX]] 19:04, 23 December 2011 (MST)

Talk:Main Page

2011-12-24T01:42:54Z

XiiiX: /* TODO List */ new section

{{Talk Archive|2010|2011}}

== [[iPhone Tracker]] ==
[[iPhone Tracker]]? --[[User:Balloonhead66|Balloonhead66]] 11:34, 9 September 2011 (MDT)

== Steve Jobs ==
Rest in peace, Steve. You will be especially missed by us here at the iPhone Wiki, as without you, we wouldn't have the iPhone, the iPod, or the iPad, and we wouldn't be hacking them. You were a true genius, a true visionary, and most of all, the best person this world has ever seen. Thank you, Steve. --[[User:Rdqronos|rdqronos]] 18:28, 5 October 2011 (MDT)
:<nowiki />*thumbs up* --[[User:Balloonhead66|Balloonhead66]] 20:49, 19 November 2011 (MST)

== Block ==
Why is there a three year block on this? (I'm surprised it has been one year already...) --[[User:Balloonhead66|Balloonhead66]] 20:49, 19 November 2011 (MST)
:As I recall, an edit war kept breaking out in the "Hackers" section. I gave a warning that the next time an edit war occurred, it would be protected for three years.[http://theiphonewiki.com/wiki/index.php?title=Special%3ALog&type=protect&page=Main+Page] --[[User:Dialexio|Dialexio]] 10:04, 20 November 2011 (MST)
::What about moving it (and the header of the next one to keep people from placing it below the <nowiki>{{Main Page/Hackers}}</nowiki>) to [[Main Page/Hackers]] and protecting that page? --[[User:Balloonhead66|Balloonhead66]] 13:13, 20 November 2011 (MST)
:::I don't think we should have to edit the main page enough to branch it off like that. We should keep things organized rather than making new pages. --[[User:JacobVengeance|Jacob]] 14:05, 20 November 2011 (MST)
::::I agree with Jabob. If Dialexio is not so lazy like I am in the last few weeks, valid change requests on the page [[Talk:Main Page]] (here) will get implemented within a day or so. -- [[User:Http|http]] 17:41, 23 November 2011 (MST)
:::::I'm not as lazy as you are; I'm ''lazier'' than you. :P …Kidding aside, I'll be around more often than not to look into any edit requests made. --[[User:Dialexio|Dialexio]] 19:07, 23 November 2011 (MST)

== Update on jailbreak sector ==

Guys, on the Main page, we can find a coloured board showing wich devices can be jailbroken and untethered. Well, I don't know how to change, but there is an error. The iPhone 3GS OldBootrom can be jailbroken and untethered with the 24kpwn exploit. The board shows that any version of the 3GS are not succeptible to untether at the moment. If I'm right, please someone change and delete this post. --[[User:XiiiX|XiiiX]] 16:12, 23 December 2011 (MST)
:Done. -- [[User:Http|http]] 15:38, 23 December 2011 (MST)

== TODO List ==

Do we have a TODO List? People could put things there to make more people understand the priorities of now. --[[User:XiiiX|XiiiX]] 18:42, 23 December 2011 (MST)

Talk:Main Page

2011-12-23T23:12:19Z

XiiiX:

Talk:/dev

2011-12-23T23:08:12Z

XiiiX:

==Importance==
Is this page really that important? I think this should be merged into something else (sans the folder structure). [[User:LiNK|LiNK]] 22:47, 24 October 2010 (UTC)

:This page is more useful for app developer's ( e.g ultrasnow need's [[/dev/tty.debug]] to work ) and it these node's change per type of device --[[User:Liamchat|liamchat]] 23:01, 24 October 2010 (UTC)

==Devices that the Nodes were gathered from==
Can we say witch devices have the nodes because it will get confusing once the page is complete --[[User:Liamchat|liamchat]] 22:56, 25 October 2010 (UTC)
:Let's try with [http://pastebin.com/pn2guvRi]--[[User:Ryccardo|Ryccardo]] 14:09, 26 October 2010 (UTC)
:Hey, I don't think colors are a good thing. A lot of devices are available on all models. We should make a table row for every device and use Yes and No.--[[User:Ryccardo|Ryccardo]] 19:13, 26 October 2010 (UTC)
::Can someone please change <nowiki>{{partial|ipad 3g}} to {{partial|[[K48ap|iPad Wifi+3G}}</nowiki> ? --[[User:Balloonhead66|Balloonhead66]] 22:23, 26 October 2010 (UTC)

==Table==
{| border="1"
|-
| width="500"| I was thinking that after every like 40 nodes, we add another one of these things to keep things organized. --[[User:Balloonhead66|Balloonhead66]] 22:29, 26 October 2010 (UTC)
| width="500"| <nowiki>|-</nowiki> 
<nowiki>! Node</nowiki> 
<nowiki>! Description</nowiki> 
<nowiki>! width="80"| [[m68ap|iPhone]]</nowiki> 
<nowiki>! width="80"| [[n82ap|iPhone3G]]</nowiki> 
<nowiki>! width="80"| [[n88ap|iPhone 3GS]]</nowiki> 
<nowiki>! width="80"| [[n90ap|iPhone 4]]</nowiki> 
<nowiki>! width="80"| [[n45ap|iPod touch]]</nowiki> 
<nowiki>! width="80"| [[n72ap|iPod touch 2G]]</nowiki> 
<nowiki>! width="80"| [[n18ap|iPod touch 3G]]</nowiki> 
<nowiki>! width="80"| [[n81ap|iPod touch 4G]]</nowiki> 
<nowiki>! width="80"| [[k48ap|iPad 1G]]</nowiki> 
<nowiki>! width="80"| [[k66ap|Apple TV 2G]]</nowiki>
|}

== Split the table? ==

It looks like maintaining the table for the future is going to get a bit messy. Therefore, I would like to propose splitting the table based on file name. Does this sound good to everyone? --[[User:Dialexio|Dialexio]] 22:50, 26 October 2010 (UTC)
:i think it look ok for now because when i started the page it was upside and when more info is found about the node's then we can split the table's --[[User:Liamchat|liamchat]] 22:58, 26 October 2010 (UTC)

== progress ==
can we use this to keep track of what node's are for witch devices and the proof of it --[[User:Liamchat|liamchat]] 23:16, 26 October 2010 (UTC)
{| class="sortable" style="table-layout: fixed; border-collapse: collapse;" border="1"
|-
! Devices
! [[m68ap|iPhone]]
! [[n82ap|iPhone3G]]
! [[n88ap|iPhone 3GS]]
! [[n90ap|iPhone 4]]
! [[n45ap|iPod touch]]
! [[n72ap|iPod touch 2G]]
! [[n18ap|iPod touch 3G]]
! [[n81ap|iPod touch 4G]]
! [[k48ap|iPad 1G]]
! [[k66ap|Apple TV 2G]]
|-
! Data From
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-

== Where is the iPad 2 column? ==

Where is the iPad 2 column? There have the iPad 1, but not iPad 2. --[[User:XiiiX|XiiiX]] 16:08, 23 December 2011 (MST)

Talk:UID key

2011-12-23T23:07:20Z

XiiiX:

Is there a public way to get this key? --[[User:XiiiX|XiiiX]] 16:07, 23 December 2011 (MST)

Talk:UID key

2011-12-23T23:07:01Z

XiiiX: Created page with "Is there a public way to get this key?"

Is there a public way to get this key?

/dev

2011-12-23T22:52:47Z

XiiiX: /* Files */

== Summary ==
[[Device Nodes]] are here, as with any other standard UNIX system. The directory is read-only.

== Children ==
=== Files ===







{| class="wikitable sortable"
|-
! Node
! Description
! width="80"| [[m68ap|iPhone]]
! width="80"| [[n82ap|iPhone3G]]
! width="80"| [[n88ap|iPhone 3GS]]
! width="80"| [[n90ap|iPhone 4]]
! width="80"| [[n45ap|iPod touch]]
! width="80"| [[n72ap|iPod touch 2G]]
! width="80"| [[n18ap|iPod touch 3G]]
! width="80"| [[n81ap|iPod touch 4G]]
! width="80"| [[k48ap|iPad 1G]]
! width="80"| [[k66ap|Apple TV 2G]]
|-
|[[/dev/zero|zero]]
|(Outputs 0x0, discards input)
|colspan="10" {{yes}}
|-
|[[/dev/vn1|vn1]]
|?
|colspan="10" {{yes|made by jailbreak}}
|-
|[[/dev/vn0|vn0]]
|?
|colspan="10" {{yes|made by jailbreak}}
|-
|[[/dev/urandom|urandom]]
|(Outputs pseudo-random data)
|colspan="10" {{yes}}
|-
|[[/dev/uart.umts|uart.utms]]
|(new data line added on the iPhone 4)
|colspan="3" {{partial|?}}
|{{yes}}
|colspan="6" {{partial|?}}
|-
|[[/dev/uart.iap|uart.iap]]
|([http://devdot.wikispaces.com/Iphone+Serial+Port+Tutorial Dock connector serial interface])
|colspan="10" {{yes}}
|-
|[[/dev/uart.highland-park|uart.highland-park]]
|?
|colspan="10" {{partial|?}}
|-
|[[/dev/uart.gps|uart.gps]]
|(Something with GPS)
|{{no}}
|colspan="3" {{yes}}
|colspan="4" {{no}}
|{{partial|iPad 3G}}
|{{no}}
|-
|[[/dev/uart.gas-gauge|uart.gas-gauge]]
|(Battery meter)
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="3" {{yes}}
|{{no}}
|-
|[[/dev/uart.debug|uart.debug]]
|[[Baseband_Commands|(Baseband)]]
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|iPad 3G}}
|{{no}}
|-
|[[/dev/uart.bluetooth|uart.bluetooth]]
|(Bluetooth Dev Node disabled by the kernel for power saving)
|colspan="4" {{yes}}
|{{no}}
|colspan="5" {{yes}}
|-
|[[/dev/ttypf|ttypf]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttype|ttype]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttypd|ttypd]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttypc|ttypc]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttypb|ttypb]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttypa|ttypa]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttyp9|ttyp9]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttyp8|ttyp8]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ttyp7|ttyp7]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp6|ttyp6]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp5|ttyp5]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp4|ttyp4]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp3|ttyp3]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp2|ttyp2]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp1|ttyp1]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/ttyp0|ttyp0]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/tty.umts|tty.umts]]
|Used for UMTS (3G) connection tecnology
|{{no}}
|colspan="3" {{yes}}
|colspan="4" {{no}}
|{{partial|iPad 3G}}
|{{no}}
|-
|[[/dev/tty.iap|tty.iap]]
|([http://devdot.wikispaces.com/Iphone+Serial+Port+Tutorial Dock connector serial interface])
|colspan="10" {{yes}}
|-
|[[/dev/tty.highland-park|tty.highland-park]]
|?
|colspan="10" {{partial|?}}
|-
|[[/dev/tty.gas-gauge|tty.gas-gauge]]
|(Battery meter)
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="3" {{yes}}
|{{no}}
|-
|[[/dev/tty.debug|tty.debug]]
|[[Baseband_Commands|(Baseband)]]
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|iPad 3G}}
|{{no}}
|-
|[[/dev/tty.bluetooth|tty.bluetooth]]
|(Bluetooth Node)
|colspan="4" {{yes}}
|{{no}}
|colspan="5" {{yes}}
|-
|[[/dev/tty|tty]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/sha1_0|sha1_0]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/rdisk0s2|rdisk0s2s1]]
|(Character device equivalent of disk0s2s1)
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/rdisk0s2|rdisk0s2]]
|(Character device equivalent of disk0s2)
|colspan="10" {{yes}}
|-
|[[/dev/rdisk0s1|rdisk0s1]]
|(Character device equivalent of disk0s1)
|colspan="10" {{yes}}
|-
|[[/dev/rdisk0|rdisk0]]
|(Character device equivalent of disk0)
|colspan="10" {{yes}}
|-
|[[/dev/random|random]]
|(Outputs random data)
|colspan="10" {{yes}}
|-
|[[/dev/ptypf|ptypf]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptype|ptype]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptypd|ptypd]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptypc|ptypc]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptypb|ptypb]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptypa|ptypa]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptyp9|ptyp9]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptyp8|ptyp8]]
|?
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="4" {{yes}}
|-
|[[/dev/ptyp7|ptyp7]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp6|ptyp6]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp5|ptyp5]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp4|ptyp4]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp3|ptyp3]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp2|ptyp2]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp1|ptyp1]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptyp0|ptyp0]]
|
|colspan="10" {{yes}}
|-
|[[/dev/ptmx|ptmx]]
|( Posix terminal )
|colspan="10" {{yes|made by jailbreak}}
|-
|[[/dev/pf|pf]]
|( [[wikipedia:PF (firewall)|firewall]] )
|colspan="10" {{yes}}
|-
|[[/dev/null|null]]
|(Doesn't output, discards input)
|colspan="10" {{yes}}
|-
|[[/dev/mem|mem]]
|(Memory)
|colspan="10" {{partial|On patched kernels}}
|-
|[[/dev/klog|klog]]
|part of the kernel used to receive kernel panic count
|colspan="10" {{yes}}
|-
|[[/dev/kmem|kmem]]
|(Kernel memory)
|colspan="10" {{partial|On patched kernels}}
|-
|[[/dev/io8logmt|io8logmt]]
|?
|colspan="10" {{yes}}
|-
|[[/dev/io8log|io8log]]
|( replied AT S7=45 S0=0 L1 V1 X4 &c1 E1 Q0 when opened [http://yfrog.com/hta56p] )
|colspan="10" {{yes}}
|-
|[[/dev/dlci.spi-baseband.sms|dlci.spi-baseband.sms]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.reg|dlci.spi-baseband.reg]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.pdp_ctl|dlci.spi-baseband.pdp_ctl]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.pdp_3|dlci.spi-baseband.pdp_3]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.pdp_2|dlci.spi-baseband.pdp_2]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.pdp_1|dlci.spi-baseband.pdp_1]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.pdp_0|dlci.spi-baseband.pdp_0]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.low|dlci.spi-baseband.low]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.iq|dlci.spi-baseband.iq]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.extra_13|dlci.spi-baseband.extra_13]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.cl1|dlci.spi-bseband.cl1]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.chatty|dlci.spi-baseband.chatty]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/dlci.spi-baseband.call|dlci.spi-baseband.call]]
|( compatibility node made by [[Cydia.app|Cydia]] )
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/disk1|disk1]]
|([[/Developer|Virtual drive for SDK tools image]])
|colspan="10" {{yes}}
|-
|[[/dev/disk0s2s1|disk0s2s1]]
|(Encrypted user partition on 3GS?)
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="3" {{no}}
|colspan="3" {{yes}}
|-
|[[/dev/disk0s2|disk0s2]]
|(NAND, [[/private/var|user partition]])
|colspan="10" {{yes}}
|-
|[[/dev/disk0s1|disk0s1]]
|(NAND, [[/|system partition]])
|colspan="10" {{yes}}
|-
|[[/dev/disk0|disk0]]
|([[NAND]])
|colspan="10" {{yes}}
|-
|[[/dev/cu.umts|cu.umts]]
|?
|colspan="10" {{partial|?}}
|-
|[[/dev/cu.iap|cu.iap]]
|([http://devdot.wikispaces.com/Iphone+Serial+Port+Tutorial Dock connector serial interface])
|colspan="10" {{yes}}
|-
|[[/dev/cu.highland-park|cu.highland-park]]
|(Camera)
|colspan="10" {{partial|?}}
|-
|[[/dev/cu.gps|cu.gps]]
|(Something with GPS)
|{{no}}
|colspan="3" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/cu.gas-gauge|cu.gas-gauge]]
|(Exclusive access to the battery meter)
|colspan="2" {{no}}
|colspan="2" {{yes}}
|colspan="2" {{no}}
|colspan="3" {{yes}}
|{{no}}
|-
|[[/dev/cu.debug|cu.debug]]
|[[Baseband_Commands|(Exclusive access to Baseband used, for example, by BBUpdater)]]
|colspan="4" {{yes}}
|colspan="4" {{no}}
|{{partial|ipad 3g}}
|{{no}}
|-
|[[/dev/cu.bluetooth|cu.bluetooth]]
|(primary Dev Node to comunicate with the bluetooth chip)
|colspan="4" {{yes}}
|{{no}}
|colspan="5" {{yes}}
|-
|[[/dev/console|console]]
|(System console, displayed during a verbose boot)
|colspan="10" {{yes}}
|-
|[[/dev/compass2_0|compass2_0]]
|([[Gyroscope]])
|colspan="3" {{no}}
|{{yes}}
|colspan="3" {{no}}
|{{yes}}
|colspan="2" {{no}}
|-
|[[/dev/compass1_0|compass1_0]]
|(This may exist as [[Accelerometer]])
|colspan="10" {{partial|?}}
|-
|[[/dev/compass_0|compass_0]]
|([[Magnetometer]])
|{{no}}
|colspan="2" {{yes}}
|colspan="5" {{no}}
|{{yes}}
|{{no}}
|-
|[[/dev/btwake|btwake]]
|(sent to switch the bluetooth chip on from standby)
|colspan="10" {{yes}}
|-
|[[/dev/btreset|btreset]]
|(used if the bluetooth chip becomes unresponsive)
|colspan="10" {{yes}}
|-
|[[/dev/bpf3|bpf3]]
|({{wp|Berkeley Packet Filter}})
|colspan="10" {{yes}}
|-
|[[/dev/bpf2|bpf2]]
|({{wp|Berkeley Packet Filter}})
|colspan="10" {{yes}}
|-
|[[/dev/bpf1|bpf1]]
|({{wp|Berkeley Packet Filter}})
|colspan="10" {{yes}}
|-
|[[/dev/bpf0|bpf0]]
|({{wp|Berkeley Packet Filter}})
|colspan="10" {{yes}}
|-
|[[/dev/aes_0|aes_0]]
|(used with a crypto bundle provided in [[XPwn]] to utilize the [[AES Keys]] in userland)
|colspan="10" {{yes}}
|-
|}

== Parents ==
*[[/]]

Talk:/dev

2011-12-23T22:41:07Z

XiiiX: /* Where is the iPad 2 column? */ new section

Talk:Main Page

2011-12-23T22:06:56Z

XiiiX: /* Update on jailbreak sector */ new section

Talk:Baseband Commands

2011-08-14T23:10:49Z

XiiiX: /* Working on the iPhone 4? */

i bought an iphone from 2weeks with baseband 02.30.03 and bootlooder 6.2 and i need to unlock it to work with vodafone sim card need you'r help plz find me a sulution to unlock or downgrade my baseband so i can use yellowsn0w {{unsigned|Na7la|15:57, April 16, 2009 (UTC)}}

I am having trouble figuring out how to run these commands on my iPhone 4. I mean minicom does not work. I saved and all but it wont let me see what command im typing and it says "offline" in the bottom. {{unsigned|Grisolp|22:25, April 5, 2011 (UTC)}}
:You have to remember, minicom hasn't been updated in a while. It's probably not going to work very well with iOS 4+, and pretty much any device after the iPhone 3G... also, sign your talk page comments :) --[[User:Rdqronos|rdqronos]] 06:22, 23 July 2011 (MDT)

== Working on the iPhone 4? ==

Well, I tried tty.debug, dlci.baseband.blablabla... amd it didn't seem to work very well. Are there new releases of minicom? Or the source of it? --[[User:XiiiX|XiiiX]] 17:09, 14 August 2011 (MDT)

Talk:Baseband Commands

2011-08-14T23:09:39Z

XiiiX: /* Working on the iPhone 4? */ new section

Talk:Baseband Commands

2011-08-14T23:09:11Z

XiiiX: /* Working on the iPhone 4? */ new section

Talk:Unlock

2011-08-14T23:06:44Z

XiiiX: /* Understanding unlock */ new section

== Page naming ==

I propose we name this page iPhone(2G) unlock due to links to this page on xgold 608 unlock page (and others) that may be confusing to some. Or we could move the contentets of this page and replace it with some basic info about unlock (what unlocking is. And some links to more specific pages) --[[User:Toddyt1|Toddyt1]] 20:24 (edited 20:45), 9 January 2011 (UTC)

If you get your phone officially unlocked through cutyoursim.com or other services, ad they send the NCK and an updated wildcardticket then apple decides to re-lock it, isnt that only through wildcardticket? so the NCK is still entered? So if the NCK is still there, couldnt you just hacktivate and not accept the wildcardticket? so then its unlocked?--Grisolp 14:59, 28 April 2011 (UTC)

== Understanding unlock ==

I really don't understand the way MuscleNerd, Sherif_Hashim, GeoHot, etc., unlock our devices. Do they use IDA, of course, do they use minicom, I don't know, do they use other applications, I don't know. I want to know the details, if possible. --[[User:XiiiX|XiiiX]] 17:06, 14 August 2011 (MDT)

Talk:CHIPID

2011-08-14T22:54:18Z

XiiiX: Created page with "== Extraction == How extract this information from the iPhone 4? --~~~~"

== Extraction ==
How extract this information from the iPhone 4? --[[User:XiiiX|XiiiX]] 16:54, 14 August 2011 (MDT)

Talk:TinyUmbrella

2011-08-14T22:46:33Z

XiiiX: /* Source */ new section

Didn't he used to support Linux? --[[User:JacobVengeance|JakeAnthraX]] 19:59, 7 May 2011 (UTC)
:Not that I know of. --[[User:Balloonhead66|Balloonhead66]] 21:56, 15 July 2011 (UTC)
:The JAR file is in the Mac .app file (right-click>show package contents), wouldn't that work (sortof) with Linux? --[[User:Rdqronos|rdqronos]] 20:02, 18 July 2011 (MDT)

== Restore / downgrade iPad 2 GSM without baseband ==

Does anybody know details on how semaphore does a TSS downgrade of an [[K94ap|iPad 2 (GSM)]] firmware, without modifying the baseband and without running into a recovery loop? (see [http://cl.ly/2i151c3x1C3z3W2i0l0q this screenshot]) The latest TinyUmbrella release supports such downgrades and there is no bootrom exploit that would allow a kick out of recovery. I thought such a downgrade is possible by getting the [[SHSH]] from the local backup and the baseband SHSH from Apple (because of the nonce problem). As long as Apple signs the same baseband, even a baseband downgrade from an iOS5 beta baseband would be possible. Or, in the more common case, a complete restore from iOS 4.3.4 to 4.3.3 (including baseband). But TinyUmbrella doesn't even try to change the baseband, so his method must be totally different. He also twitted me "it is WAY more complicated". Anybody knows more? --[[User:Http|http]] 06:13, 20 July 2011 (MDT)

== Source ==

Where is teh source of TinyUmbrella? --[[User:XiiiX|XiiiX]] 16:46, 14 August 2011 (MDT)

Talk:XMM6180

2011-08-14T22:39:48Z

XiiiX: /* Using Replay-attack */

== Flash Possibility ==
Okay, so hypothetically speaking, if I flashed my baseband to [[1.59.00]] from [[3.10.01]] while my phone is on 4.2.1 (ONLY 4.2.1 [[SHSH]] IS AVAILABLE), it would enter the boot loop because the baseband doesnt meet the requirements for [[iOS]] 4.2.1. I am willing to try and flash my baseband in an attempt to downgrade and use [[ultrasn0w]]. And if the downgrade was to work and I restored it to a pwned 4.2.1 fw where the baseband update would be neglected, would the boot loop occur? [[User:Leobruh|Leobruh]] 01:20, 10 February 2011 (UTC)!
:You can't flash baseband [[1.59.00]]; Apple's not signing it anymore. --[[User:Dialexio|Dialexio]] 02:47, 10 February 2011 (UTC)
:Well look at [http://tysiphonehelp.com/forum/showthread.php?7908-Manually-flash-iphone-to-05.11.07-baseband this]. I don't know whether or not this could be done to the [[n90ap|iPhone 4]] but it proves that a manual flash can be used so long as you have the proper firmware ipsw available. I mean if this is possible for the [[n90ap|iPhone 4]], then I will do it without a doubt. [[User:Leobruh|Leobruh]] 04:05, 10 February 2011 (UTC)!
::Um, that is for the iPhone 3G/3GS basebands. That probably wont work on the [[n90ap|iPhone 4]]. For those devices, Apple didn't sign the baseband, so a manual flash was possible (going up version #'s). Downgrading required one to have the 5.8 bootloader iPhone 3G. Sorry to burst your bubble, but you are mistaken. --[[User:Gamer765|Gamer765]] 04:28, 10 February 2011 (UTC)
:::Word I got you bro, haha I wish it would be easier I have had an i4 for almost 2 months with the carrier lock. I will keep waiting sooner or later it will come out. [[User:Leobruh|Leobruh]] 20:43, 10 February 2011 (UTC)!

== Device for iPhone 4 ==
Are we sure this is the baseband? The infineon spec-sheet says "HSDPA/HSUPA capabilities of 7.2Mbps/2.9Mbps". At the keynote Steve mentioned 5.8Mbps HSUPA. --[[User:Iemit737|Iemit737]] 19:26, 21 June 2010 (UTC)
:Running "string" on the new baseband files shows "XGold 618" multiple times. --[[User:Miketress|Miketress]] 19:35, 21 June 2010 (UTC)
::Ok, awesome. Thanks for finding this so quickly! [[User:Iemit737|Iemit737]] 19:50, 21 June 2010 (UTC)
:::Very unlikely it's the 618 after looking at the spec sheet.
In case anyone is interested, [http://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a39470bb00555 X-Gold 616 spec sheet], [https://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a3948dc76055b X-Gold 618 spec sheet]. --[[User:D235j|D235j]] 21:43, 22 June 2010 (UTC)
::::Actually, it's the XMM 6180. ebl.fls says so. --[[User:Oranav|oranav]] 21:56, 22 June 2010 (UTC)

== Downgrade ==
Anybody knows more about the bb downgrade signatures? Or how to backup them like the shsh certs? Or how to use the replay attack here? Actually this is more related to baseband firmware and not to this iPhone 4 hardware. [[User:http|http]]
:The baseband is signed with an [[AT+XNONCE]] which is a random string generated on every bootup. Therefore, it is not possible to cache the SHSH signatures with a replay attack. I think this info either belongs on this page because it is specific to its baseband or in a special section on [[Baseband Firmware]]. [[User:Iemit737|Iemit737]] 18:18, 16 July 2010 (UTC)
::I think, why dont we save the signature for every random string? In that way, when your iPhone gives the same string, it will accept the saved signature of that string and accept changes in BB. --[[User:XiiiX|XiiiX]]
:::For every random string? That would be millions of SHSH's for every phone. Impossible. Thea idea of a nonce is that it NEVER gives the same value. --[[User:Http|http]] 17:37, 19 February 2011 (UTC)

::Ah, that's what [[User:MuscleNerd|MuscleNerd]] meant with [http://twitter.com/MuscleNerd/status/18667056119 "stricter signed"]. I also found [http://iphwn.org/nonce.txt this example]. And someone suggested to change iTunes to always send the same string. That would work, but BB wouldn't accept the response. My only idea would be to let BB generate (or store) the same string on every boot (I don't know how though). But even then we would have to backup the signatures at the time they were available. -- [[User:Http|http]] 23:11, 16 July 2010 (UTC)
:::So how does TinyUmbrella give baseband protection ? ---Whiteshinyapple
::::It manages to error out the signature for the baseband, that's why you get the 1004 error, not sure exactly how it's done but I'd assume that's how. ---OMEGA_RAZER
:::::I think there's not much to do. When hosts is pointing to Cydia, you also won't get baseband downgraded, even if it would work when pointing to real Apple server. Same should apply for upgrade. Maybe local TSS server from TinyUmbrella just handles error returns better, so that firmware up/downgrade doesn't fail - maybe it just returns an invalid certificate for the baseband, but returns 'ok'. --[[User:Http|http]] 11:08, 9 September 2010 (UTC)

== Using Replay-attack ==

Can't we make the baseband send just one message to iTunes to, in that way, using replay-attack, downgrade the baseband? I mean, the baseband sends a random message to iTunes to allow the downgrade/upgrade, but it just allows when Apple is still signing the firmware. If we made the baseband send just one message, not a random, we could downgrade the baseband even if Apple is not signing anymore, of course if used a replay-attack. So, how can we make the baseband send just one message? --[[User:XiiiX|XiiiX]] 16:39, 14 August 2011 (MDT)

Talk:XMM6180

2011-08-14T22:39:22Z

XiiiX: /* Using Replay-attack */ new section

== Flash Possibility ==
Okay, so hypothetically speaking, if I flashed my baseband to [[1.59.00]] from [[3.10.01]] while my phone is on 4.2.1 (ONLY 4.2.1 [[SHSH]] IS AVAILABLE), it would enter the boot loop because the baseband doesnt meet the requirements for [[iOS]] 4.2.1. I am willing to try and flash my baseband in an attempt to downgrade and use [[ultrasn0w]]. And if the downgrade was to work and I restored it to a pwned 4.2.1 fw where the baseband update would be neglected, would the boot loop occur? [[User:Leobruh|Leobruh]] 01:20, 10 February 2011 (UTC)!
:You can't flash baseband [[1.59.00]]; Apple's not signing it anymore. --[[User:Dialexio|Dialexio]] 02:47, 10 February 2011 (UTC)
:Well look at [http://tysiphonehelp.com/forum/showthread.php?7908-Manually-flash-iphone-to-05.11.07-baseband this]. I don't know whether or not this could be done to the [[n90ap|iPhone 4]] but it proves that a manual flash can be used so long as you have the proper firmware ipsw available. I mean if this is possible for the [[n90ap|iPhone 4]], then I will do it without a doubt. [[User:Leobruh|Leobruh]] 04:05, 10 February 2011 (UTC)!
::Um, that is for the iPhone 3G/3GS basebands. That probably wont work on the [[n90ap|iPhone 4]]. For those devices, Apple didn't sign the baseband, so a manual flash was possible (going up version #'s). Downgrading required one to have the 5.8 bootloader iPhone 3G. Sorry to burst your bubble, but you are mistaken. --[[User:Gamer765|Gamer765]] 04:28, 10 February 2011 (UTC)
:::Word I got you bro, haha I wish it would be easier I have had an i4 for almost 2 months with the carrier lock. I will keep waiting sooner or later it will come out. [[User:Leobruh|Leobruh]] 20:43, 10 February 2011 (UTC)!

== Device for iPhone 4 ==
Are we sure this is the baseband? The infineon spec-sheet says "HSDPA/HSUPA capabilities of 7.2Mbps/2.9Mbps". At the keynote Steve mentioned 5.8Mbps HSUPA. --[[User:Iemit737|Iemit737]] 19:26, 21 June 2010 (UTC)
:Running "string" on the new baseband files shows "XGold 618" multiple times. --[[User:Miketress|Miketress]] 19:35, 21 June 2010 (UTC)
::Ok, awesome. Thanks for finding this so quickly! [[User:Iemit737|Iemit737]] 19:50, 21 June 2010 (UTC)
:::Very unlikely it's the 618 after looking at the spec sheet.
In case anyone is interested, [http://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a39470bb00555 X-Gold 616 spec sheet], [https://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a3948dc76055b X-Gold 618 spec sheet]. --[[User:D235j|D235j]] 21:43, 22 June 2010 (UTC)
::::Actually, it's the XMM 6180. ebl.fls says so. --[[User:Oranav|oranav]] 21:56, 22 June 2010 (UTC)

== Downgrade ==
Anybody knows more about the bb downgrade signatures? Or how to backup them like the shsh certs? Or how to use the replay attack here? Actually this is more related to baseband firmware and not to this iPhone 4 hardware. [[User:http|http]]
:The baseband is signed with an [[AT+XNONCE]] which is a random string generated on every bootup. Therefore, it is not possible to cache the SHSH signatures with a replay attack. I think this info either belongs on this page because it is specific to its baseband or in a special section on [[Baseband Firmware]]. [[User:Iemit737|Iemit737]] 18:18, 16 July 2010 (UTC)
::I think, why dont we save the signature for every random string? In that way, when your iPhone gives the same string, it will accept the saved signature of that string and accept changes in BB. --[[User:XiiiX|XiiiX]]
:::For every random string? That would be millions of SHSH's for every phone. Impossible. Thea idea of a nonce is that it NEVER gives the same value. --[[User:Http|http]] 17:37, 19 February 2011 (UTC)

::Ah, that's what [[User:MuscleNerd|MuscleNerd]] meant with [http://twitter.com/MuscleNerd/status/18667056119 "stricter signed"]. I also found [http://iphwn.org/nonce.txt this example]. And someone suggested to change iTunes to always send the same string. That would work, but BB wouldn't accept the response. My only idea would be to let BB generate (or store) the same string on every boot (I don't know how though). But even then we would have to backup the signatures at the time they were available. -- [[User:Http|http]] 23:11, 16 July 2010 (UTC)
:::So how does TinyUmbrella give baseband protection ? ---Whiteshinyapple
::::It manages to error out the signature for the baseband, that's why you get the 1004 error, not sure exactly how it's done but I'd assume that's how. ---OMEGA_RAZER
:::::I think there's not much to do. When hosts is pointing to Cydia, you also won't get baseband downgraded, even if it would work when pointing to real Apple server. Same should apply for upgrade. Maybe local TSS server from TinyUmbrella just handles error returns better, so that firmware up/downgrade doesn't fail - maybe it just returns an invalid certificate for the baseband, but returns 'ok'. --[[User:Http|http]] 11:08, 9 September 2010 (UTC)

== Using Replay-attack ==

Can't we make the baseband send just one message to iTunes to, in that way, using replay-attack, downgrade the baseband? I mean, the baseband sends a random message to iTunes to allow the downgrade/upgrade, but it just allows when Apple is still signing the firmware. If we made the baseband send just one message, not a random, we could downgrade the baseband even if Apple is not signing anymore, of course if used a replay-attack. So, how can we make the baseband send just one message?

== Using Replay-attack ==

Can't we make the baseband send just one message to iTunes to, in that way, using replay-attack, downgrade the baseband? I mean, the baseband sends a random message to iTunes to allow the downgrade/upgrade, but it just allows when Apple is still signing the firmware. If we made the baseband send just one message, not a random, we could downgrade the baseband even if Apple is not signing anymore, of course if used a replay-attack. So, how can we make the baseband send just one message? --[[User:XiiiX|XiiiX]] 16:39, 14 August 2011 (MDT)

Talk:XMM6180

2011-08-14T22:39:16Z

XiiiX: /* Using Replay-attack */ new section

Talk:NCK

2011-08-14T22:11:43Z

XiiiX: /* The NCK composition */

is this info correct because the the firmware showed that it is capable of a 8-16 digit and The lock on the baseband is known as a PN(Network Personalization) lock. That requires the first 6 digits MCCMNC of the stored IMSI to match the first 6 digits of the IMSI from the SIM card. The command to remove this lock is known 'AT+CLCK="PN",0,"XXXXXXXX"'. Those X's are known as the NCK, the network control key. and The firmware actually requests the IMSI three times from the SIM card. The PN check is done in the first two, while the network registration is done with the third. --[[User:Liamchat|liamchat]] 22:14, 27 September 2010 (UTC)

== The NCK composition ==

MuscleNerd has said that he discovered the way the NCK is made. There are 15 digits, 5 for the [[NORID]], 5 for the [[CHIPID]] and the last 5 are for the NCK key that Apple holds. Is that right? --[[User:XiiiX|XiiiX]] 16:11, 14 August 2011 (MDT)

Talk:NCK

2011-08-14T22:11:25Z

XiiiX: /* The NCK composition */ new section

is this info correct because the the firmware showed that it is capable of a 8-16 digit and The lock on the baseband is known as a PN(Network Personalization) lock. That requires the first 6 digits MCCMNC of the stored IMSI to match the first 6 digits of the IMSI from the SIM card. The command to remove this lock is known 'AT+CLCK="PN",0,"XXXXXXXX"'. Those X's are known as the NCK, the network control key. and The firmware actually requests the IMSI three times from the SIM card. The PN check is done in the first two, while the network registration is done with the third. --[[User:Liamchat|liamchat]] 22:14, 27 September 2010 (UTC)

== The NCK composition ==

MuscleNerd has said that he discovered the way the KCK is made. There are 15 digits, 5 for the [[NORID]], 5 for the [[CHIPID]] and the last 5 are for the NCK key that Apple holds. Is that right? --[[User:XiiiX|XiiiX]] 16:11, 14 August 2011 (MDT)

Talk:NORID

2011-08-14T22:07:09Z

XiiiX: Created page with "== Size of iPhone 4 == Is it still 128-bit in the iPhone 4? --~~~~"

== Size of iPhone 4 ==
Is it still 128-bit in the iPhone 4? --[[User:XiiiX|XiiiX]] 16:07, 14 August 2011 (MDT)

ARM

2011-08-10T22:13:08Z

XiiiX:

This is the short form for [http://en.wikipedia.org/wiki/ARM_architecture ARM architecture]. The ARM, or Acorn RISC Machine, is a 32-bit CPU which is found in many consumer gadgets.

On the iPhone, iPod Touch and iPad, there are various processors in use, which all use this architecture:
* Main processors: [[S5L8900]], [[S5L8720]], [[S5L8920]], [[S5L8922]], [[S5L8930]] and [[S5L8940]].
* [[Baseband_Device|Baseband processors]]: [[S-Gold_2|PMB8876]], [[X-Gold_608|PMB8878]], [[XMM_6180|XMM6180]]

{{stub|hardware}}

NCK Brute Force

2011-05-06T00:15:01Z

XiiiX: /* Feasibility */

This is a theoretical exploit which involves brute forcing the NCK from the [[seczone]] the CHIPID and the NORID. So far no one has made public an instance of NCK discovery using this theoretical approach.

==Credit==
[[gray]], [[User:Geohot|geohot]]

==Feasibility==
Given that [[NCK]]s are 15 digits long, the keyspace is 1015 (about 250). This would be searchable if all the cryptography used was symmetric. But the algorithm is TEA(RSA(token),[[NCK]]+[[CHIPID]]+[[NORID]]) [[wikipedia:Tiny Encryption Algorithm|TEA]]. So that inside [[wikipedia:RSA|RSA]] has to be done. A modern machine can search the 8 digit keyspace in about 5 minutes, which means we need a couple orders of magnitude speed increase to consider 15 digit.

==Implementation==
[http://george.insideiphone.com/index.php/2007/12/16/brute-force-on-nck-is-impossible/ Multithreaded NCK Brute Forcer] discussion and link to download.

[[Category:Baseband]]
[[Category:Unlocking Methods]]

The iPhone Wiki:Current events

2011-03-23T11:43:29Z

XiiiX: Untethered is better!

== Primary Goals ==
* [[X-Gold 608 Unlock|Break X-Gold 608 Chain of Trust]]
* [[X-Gold 618 Unlock|Break X-Gold 618 Chain of Trust]]
* Break the chain of trust on devices with newer bootroms ([[N72ap|iPod touch 2G]], [[N18ap|iPod touch 3G]], [[N88ap|iPhone 3GS]], [[K48ap|iPad]], [[N90ap|iPhone 4 (GSM model)]], [[N81ap|iPod touch 4G]], [[K66ap|Apple TV 2G]], [[N92ap|iPhone 4 (CDMA model)]]).
* Find a bootrom exploit on startup that allows unsigned code execution on newer devices ([[iPad 2]]).

== Secondary ==
* Get [[iPhoneLinux]] running on [[N72ap|iPod touch 2G]] and newer devices.
* Get kernel extensions working on 2.x
* Get kernel extensions working on 3.x
* Get kernel extensions working on 4.x
* Finish the [[/|Firmware]] Listing

NCK

2011-03-21T00:38:56Z

XiiiX:

Abreviation of '''N'''etwork '''C'''ontrol '''K'''ey. The NCK is a 15-digit key required to "legitimately" [[unlock]] the [[M68ap|iPhone 2G]]. Every other [[iPhone]] revision is unlocked with a [[WildcardTicket]] which permits every [[wikipedia:Mobile Network Code|MNC]]/[[wikipedia:Mobile Country Code|MCC]]/[[wikipedia:ICCID|ICCID]] combination. This WildcardTicket is a combination of the NCK key from Apple, which is 5 digits long, your ChipID, 8 digits long, and NorID, 12 digits long.

[[Category:Baseband]]

NCK

2011-03-21T00:38:02Z

XiiiX: Explaining better

Abreviation of '''N'''etwork '''C'''ontrol '''K'''ey. The NCK is a 15-digit key required to "legitimately" [[unlock]] the [[M68ap|iPhone 2G]]. Every other [[iPhone]] revision is unlocked with a [[WildcardTicket]] which permits every [[wikipedia:Mobile Network Code|MNC]]/[[wikipedia:Mobile Country Code|MCC]]/[[wikipedia:ICCID|ICCID]] combination. This WildcardTicket is a combination of the NCK, key from Apple, which is 5 digits long, your ChipID, 8 digits long, and NorID, 12 digits long.

[[Category:Baseband]]

Talk:NCK Brute Force

2011-03-14T22:42:20Z

XiiiX: Answear

== Permanent unlock? ==
Is this method usable to permanently unlock the iPhone (like IPSF) aka upgrade resistant and not needing a software like signal.app (and being able to use SIM PIN Code)?
This would allowed to have the "official" unlock (except activation)?

== Time calculations ==

How long would it take to search the 15 digit one?

Geohots NCKBF program could do around 100,000 keys/second which would produce a hit in many years, or complete a search in 317 years.

To get to a point where this is actually doable we would need many orders of magnitude of improvement. Even if you use a PSP3 or special hardware (within 1,000 US$ range) you will only get an improvement of 20-100 times.. which doesn't help much. - Deco

I assume in the article there's something wrong regarding time calculation. It states that for 8 bit you need 5 mins and we have 15 bit. That would mean 128 fold more or only 11 hours with a PC two years old. That must be wrong. -- [[User:Http|http]] 08:26, 24 July 2010 (UTC)

It's clear now. We are talking about decimal digits, not bits! So it takes 10(15-8) times longer, or about 95 years. -- [[User:Http|http]] 21:53, 5 August 2010 (UTC)

== Cloud project ==

Using a system like BOINC ( known for seti @ home) would not help to distribute the load ?

If Apple sold 10 Million devices, and lets say maybe 10k to 100k people participated,
we should be able to reduce that time from, lets say 200 years to a maximum of 2 weeks to 2 months.

Now we would just need someone to create a modified client, manage the calculated packages and provide the packages which would need to be calculated/crunched.

Just an idea.

Chris

And you'll end up with exactly ''one'' unlocked iPhone. Better off selling the machine hours. ~geohot

But with such a project you could compare the results of every calculation not only with one iPhone, but with a list of all iPhones that have registered in the project. That's the advantage of brute force attack. So it would still be possible I think - assuming we could create such a network. But it could also arise legal problems. -- [[User:Http|http]] 08:33, 24 July 2010 (UTC)

== Brute force master key ==

Is it not possible to brute force the key that apple uses and then use that to unlock all iPhones?

if we get say 1 million computers then how long would it theoretically take to generate one key? 1 million isn't that impossible given that 3 million iPhone 3Gs have been sold of most geeks have more than one computer. Assuming that on average everyone contributes 2 computers then we only need 500000 people to reach 1 million. subtract the speed of networking and the fact that some people will turn their computers off every so often and we should be able to generate 5 or 6 keys a day? this is kinda pathetic for just a proof of concept but just proving that we can generate code and can harness this much power would be a massive psychological blow to apple. also i would assume that we would need some main server to control all the computers which probably doesn't exist :P

blog.iphone-dev.org had 276,688 unique visitors on July 20th (PwnageTool release 2.0/2.0.1), so I would assume that number is the sort of participants we would get. I think 2 computers from each person is also optimistic, it would probably be less than 1 on average as most people won't run it 24/7.

== Mirror ==
Does anyone have a mirror for the Multithreaded NCK Brute Forcer I think the link is down.--[[User:Bob|Bob]] 14:49, 22 August 2008 (UTC)

Reply: done --[[User:Zuezuo|Zuezuo]] 10:32, 9 March 2010 (UTC)

The link doesn't appear to be active anymore. I have an interest in this code, and maybe porting it to some faster machines. Does it still exist, or did someone erase it/stop hosting it? ---[[User:Unrstuart|Unrstuart]] 15:10, 24 July 2010 (PDT)

I have updated the page with a valid link to a blog discussing geohot's Multithreaded NCK Brute Forcer. This page contains a link to the source code and a Windows binary. --[[User:Jmh9072|Jmh9072]] Feb 4, 2011, 23:52 (EST)

== RSA attack ==

Some researches recently published this paper:
"Fault-Based Attack of RSA Authentication" - http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf

Could that be useful in this NCK attack?
--[[User:Zuezuo|Zuezuo]] 10:32, 9 March 2010 (UTC)
NO, just if you are in apple's server and shot-circuit one of the servers.

NCK

2011-03-13T01:21:25Z

XiiiX: Some more infos.

Network Control Key. The 15-digit key required to "legitimately" [[unlock]] the [[M68ap|iPhone 2G]]. Every other [[iPhone]] revision is unlocked with a [[WildcardTicket]] which permits every [[wikipedia:Mobile Network Code|MNC]]/[[wikipedia:Mobile Country Code|MCC]]/[[wikipedia:ICCID|ICCID]] combination. This WildcardTicket is a combination of the NCK key from Apple, and your ChipID and NorID.

[[Category:Baseband]]

Jailbreak (S5L8920+)

2011-03-13T01:07:47Z

XiiiX:

When the [[N88ap|iPhone 3GS]] was initially released, Apple did not have enough time to fix the [[0x24000 Segment Overflow]] in the [[S5L8920 (Bootrom)|S5L8920]]. However, in order to flash an exploited [[LLB]] and jailbreak the iPhone 3GS, '''one''' of the following needs to be done:
* Find a new [[iBoot]] exploit every time a new firmware is out.
* Find a way to bypass the [[ECID]] checks.
* Use a bootrom exploit that allows unsigned code execution via USB (2 of them were finally found by Geohot and Chronic Dev Team).

This also applies to the iPhone 3GS with [[iBoot-359.3.2|the new bootrom]], [[N18ap|iPod touch 3G]] and later devices, except a bootrom exploit for the normal boot-chain or a library based jailbreak payload (similar to [[Star]]) is needed as well.

==ECID==
Apple added a new tag to the [[IMG3 File Format]] called ECID. The ECID is ''unique'' to each phone, and its signature is being checked. With this method, Apple attempts to block downgrades once newer firmware becomes available, unless you have a dump of your old firmware's unique IMG3 or signed certificate. Therefore, iBoot exploits won't be so useful for tethered jailbreaks, because such exploits will be closed in new firmwares. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html].

The issue with this is that, even with the [[0x24000 Segment Overflow]] still in bootrom, an [[iBoot]] exploit was still needed to actually flash the exploited [[LLB]]. Apple uses this ECID stuff to block downgrading iBoot to a vulnerable version. It was resolved when Geohot released his [[limera1n]] tool, which used a bootrom exploit to upload an unsigned iBoot. Still the problem remains with newer devices with [[0x24000 Segment Overflow|0x24000]] fixed - tampering with firmware makes such jailbreak tethered unless some other exploit is used.

There are methods to help keep your downgrading ability, though.

* If it was cached prior to 3.1's release, 3GS owners were able save a file which contains the signature of the 3.0 [[iBSS]] containing their [[ECID]], using the [http://purplera1n.com/ purplera1n website]. A tool has not been created to incorporate this file into a fully signed iBSS, however.
* Saurik's servers are actively caching the necessary files. [http://www.saurik.com/id/12#howto Instructions] to use the servers are included.
* The [[SHSH]] associated with an ECID can be also saved by running [[TinyUmbrella]]. [[TinyUmbrella]] allows the user to restore to whatever version is associated with that [[SHSH]] file permanently. This is based on the aforementioned service [[Saurik]] provides remotely from [[Cydia Server|his server(s)]].

==Jailbreak tools ==
===[[K66ap |Apple TV 2G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{partial|no package management GUI}}
| {{no}}
| {{yes|RC6}}
| {{no}}
|-
| [[PwnageTool]]
| {{partial|no package management GUI}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
| {{yes|4.2}}
| {{no}}
|-
| [[Seas0nPass]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
|-
|}
1 [[Tethered jailbreak]].

===[[K48ap|iPad]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="5"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.2
|style="width:100px;"| 3.2.1
|style="width:100px;"| 3.2.2
|style="width:150px;"| 4.2.1
|style="width:100px;"| 4.3
|-
| [[Spirit]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{yes|RC4 and earlier}}
| {{yes|RC5}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
| {{yes|0.9.6rc81 or 0.9.7b61 2}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{yes|4.1-4.1.3}}
| {{yes|4.2}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

===[[N94ap|iPad 2]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="11"| Works with [[firmware]]...
|-
|style="width:90px;"| 4.3
|-
| [[Any Jailbreak Tool]]
| {{no}}
|-
|}
===[[N88ap|iPhone 3GS]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="11"| Works with [[firmware]]...
|-
|style="width:90px;"| 3.0
|style="width:90px;"| 3.0.1
|style="width:90px;"| 3.1
|style="width:90px;"| 3.1.2
|style="width:90px;"| 3.1.3
|style="width:90px;"| 4.0
|style="width:90px;"| 4.0.1
|style="width:90px;"| 4.0.2
|style="width:90px;"| 4.1
|style="width:90px;"| 4.2.1
|style="width:90px;"| 4.3
|-
| [[purplera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.8}}
| {{yes|0.8}}
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
| {{yes|0.9.6rc81}}
| {{no}}
|-
| [[blackra1n]]
| {{no}}
| {{no}}
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Spirit]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{partial|Restore from a custom firmware2}}
| {{yes|3.1.42}}
|colspan="2" {{partial|Restore from a custom firmware2}}
|colspan="2" {{partial|Restore from a custom firmware with unofficial firmware bundle2}}
| {{yes|4.1-4.1.3}}
| {{yes|4.2}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{partial|1.42 or 2.0.21 2}}
| {{partial|1.5.12 or 2.0.21 2}}
| {{partial|1.71 2 or 2.0.21 2}}
|colspan="2" {{partial|2.0.21 2}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4 and earlier}}
| {{yes|RC5}}
| {{no}}
|}
1 [[Tethered jailbreak]] on devices with the [[iBoot-359.3.2|new bootrom]].

2 Only applicable for devices with the [[iBoot-359.3|old bootrom]]. Requires the device to have signature checks disabled (pwned).

3 Requires an unofficial firmware bundle.

===[[N90ap|iPhone 4]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="6"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.1
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4 and earlier}}
| {{yes|RC5}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
| {{yes|0.9.6rc81 or 0.9.7b61 2}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1-4.1.3}}
| {{yes|4.2}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

===[[N18ap|iPod touch 3G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="8"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.1.1
|style="width:100px;"| 3.1.2
|style="width:100px;"| 3.1.3
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|-
| [[blackra1n]]
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6b2}}
| {{yes|0.9.6rc81}}
| {{no}}
|-
| [[Spirit]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.0.21}}
| {{partial|2.0.21}}
| {{partial|1.71 or 2.0.21}}
| {{partial|2.0.21}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4 and earlier}}
| {{yes|RC5}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1-4.1.3}}
| {{yes|4.2}}
| {{no}}
|}
1 [[Tethered jailbreak]].

===[[N81ap |iPod touch 4G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (both builds)
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|-
| [[limera1n]]
| {{yes}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.9.4b2}}
| {{yes|0.9.6rc81 or 0.9.7b61 2}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{yes|RC4 and earlier}}
| {{yes|RC5}}
| {{no}}
|-
| [[PwnageTool]]
| {{yes|4.1-4.1.3}}
| {{yes|4.2}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{yes|2.1}}
| {{yes|2.2}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

X-Gold 618 Unlock

2011-03-10T19:34:29Z

XiiiX:

The [[N90ap|iPhone 4]] and the new iPad 2 uses the [[X-Gold 618]]. Unlike the [[X-Gold 608]], the baseband now requires a signature akin to Apple's [[SHSH]] blobs for firmware files, so downgrading an updated baseband, provided there is a bootloader exploit, will be tougher.

Unsigned code execution has been achieved by [[MuscleNerd]] on the device and the ability to insert a custom AT command has been demonstrated. Shortly after, a persistent/background task was inserted. Also, the bootrom has been successfully dumped.

On July 13, 2010, planetbeing demonstrated a primitive but functional unlock on YouTube.[http://www.youtube.com/watch?v=41rm8MCdoh8]. The unlock was made ready for release and on August 3, 2010, it was made available in Cydia via [[ultrasn0w]].

==Possible Methods==

===Class 1===

* Find an exploit in the bootrom to break the chain of trust.
* Improve by several orders of magnitude the [[NCK Brute Force]]r, and find a way to extract the [[CHIPID]] and [[NORID]]
* Find the theorized algorithm of NCK generation

===Class 2===

* Use a SIM hack such as the TurboSIM Unlock
* Find a way to patch running memory to "unlock" the phone on every bootup. This is how [[ultrasn0w]] works.
* Find an exploit in the Baseband Bootloader so you can downgrade the baseband, then use an unlocking payload, similar to ultrasn0w.

Talk:Baseband SHSH Protocol

2011-03-10T19:31:35Z

XiiiX:

I just have 1 question: in the request file, the BBChipID is required. how can we extract it? And, if we can't get it, could we extract it capturing the request sent to apple? or it is encrypted? --XiiiX

Talk:Baseband SHSH Protocol

2011-03-10T19:30:52Z

XiiiX:

Talk:Baseband SHSH Protocol

2011-03-10T19:14:46Z

XiiiX: New page: I just have 1 question: in the request file, the BBChipID is required. how can we extract it? And, if we can't get it, could we extract it capturing the request sent to apple? or it is enc...

I just have 1 question: in the request file, the BBChipID is required. how can we extract it? And, if we can't get it, could we extract it capturing the request sent to apple? or it is encrypted?

Talk:XMM6180

2011-02-19T17:21:12Z

XiiiX: /* Downgrade */

== Flash Possibility ==
Okay, so hypothetically speaking, if I flashed my baseband to [[1.59.00]] from [[3.10.01]] while my phone is on 4.2.1 (ONLY 4.2.1 [[SHSH]] IS AVAILABLE), it would enter the boot loop because the baseband doesnt meet the requirements for [[iOS]] 4.2.1. I am willing to try and flash my baseband in an attempt to downgrade and use [[ultrasn0w]]. And if the downgrade was to work and I restored it to a pwned 4.2.1 fw where the baseband update would be neglected, would the boot loop occur? [[User:Leobruh|Leobruh]] 01:20, 10 February 2011 (UTC)!
:You can't flash baseband [[1.59.00]]; Apple's not signing it anymore. --[[User:Dialexio|Dialexio]] 02:47, 10 February 2011 (UTC)
:Well look at [http://tysiphonehelp.com/forum/showthread.php?7908-Manually-flash-iphone-to-05.11.07-baseband this]. I don't know whether or not this could be done to the [[n90ap|iPhone 4]] but it proves that a manual flash can be used so long as you have the proper firmware ipsw available. I mean if this is possible for the [[n90ap|iPhone 4]], then I will do it without a doubt. [[User:Leobruh|Leobruh]] 04:05, 10 February 2011 (UTC)!
::Um, that is for the iPhone 3G/3GS basebands. That probably wont work on the [[n90ap|iPhone 4]]. For those devices, Apple didn't sign the baseband, so a manual flash was possible (going up version #'s). Downgrading required one to have the 5.8 bootloader iPhone 3G. Sorry to burst your bubble, but you are mistaken. --[[User:Gamer765|Gamer765]] 04:28, 10 February 2011 (UTC)
:::Word I got you bro, haha I wish it would be easier I have had an i4 for almost 2 months with the carrier lock. I will keep waiting sooner or later it will come out. [[User:Leobruh|Leobruh]] 20:43, 10 February 2011 (UTC)!

== Device for iPhone 4 ==
Are we sure this is the baseband? The infineon spec-sheet says "HSDPA/HSUPA capabilities of 7.2Mbps/2.9Mbps". At the keynote Steve mentioned 5.8Mbps HSUPA. --[[User:Iemit737|Iemit737]] 19:26, 21 June 2010 (UTC)
:Running "string" on the new baseband files shows "XGold 618" multiple times. --[[User:Miketress|Miketress]] 19:35, 21 June 2010 (UTC)
::Ok, awesome. Thanks for finding this so quickly! [[User:Iemit737|Iemit737]] 19:50, 21 June 2010 (UTC)
:::Very unlikely it's the 618 after looking at the spec sheet.
In case anyone is interested, [http://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a39470bb00555 X-Gold 616 spec sheet], [https://www.infineon.com/cms/en/product/channel.html?channel=db3a304319c6f18c011a3948dc76055b X-Gold 618 spec sheet]. --[[User:D235j|D235j]] 21:43, 22 June 2010 (UTC)
::::Actually, it's the XMM 6180. ebl.fls says so. --[[User:Oranav|oranav]] 21:56, 22 June 2010 (UTC)

== Downgrade ==
Anybody knows more about the bb downgrade signatures? Or how to backup them like the shsh certs? Or how to use the replay attack here? Actually this is more related to baseband firmware and not to this iPhone 4 hardware. [[User:http|http]]
:The baseband is signed with an [[AT+XNONCE]] which is a random string generated on every bootup. Therefore, it is not possible to cache the SHSH signatures with a replay attack. I think this info either belongs on this page because it is specific to its baseband or in a special section on [[Baseband Firmware]]. [[User:Iemit737|Iemit737]] 18:18, 16 July 2010 (UTC)
::I think, why dont we save the signature for every random string? In that way, when your iPhone gives the same string, it will accept the saved signature of that string and accept changes in BB. --[[User:XiiiX|XiiiX]]
::Ah, that's what [[User:MuscleNerd|MuscleNerd]] meant with [http://twitter.com/MuscleNerd/status/18667056119 "stricter signed"]. I also found [http://iphwn.org/nonce.txt this example]. And someone suggested to change iTunes to always send the same string. That would work, but BB wouldn't accept the response. My only idea would be to let BB generate (or store) the same string on every boot (I don't know how though). But even then we would have to backup the signatures at the time they were available. -- [[User:Http|http]] 23:11, 16 July 2010 (UTC)
:::So how does TinyUmbrella give baseband protection ? ---Whiteshinyapple
::::It manages to error out the signature for the baseband, that's why you get the 1004 error, not sure exactly how it's done but I'd assume that's how. ---OMEGA_RAZER
:::::I think there's not much to do. When hosts is pointing to Cydia, you also won't get baseband downgraded, even if it would work when pointing to real Apple server. Same should apply for upgrade. Maybe local TSS server from TinyUmbrella just handles error returns better, so that firmware up/downgrade doesn't fail - maybe it just returns an invalid certificate for the baseband, but returns 'ok'. --[[User:Http|http]] 11:08, 9 September 2010 (UTC)

Talk:N90AP

2011-02-12T01:38:56Z

XiiiX:

Anyone yet have more info on the White iPhone 4? As we have included this on the main page for the N90ap, but AFAIK you can't yet get a (''legal'') version. {{unsigned|DanClarkePro|14:33, 23 November 2010 (UTC)}}

Why dont we put "iPhone 4" as page title instead of "N90AP"? Begginers would find more easily with iPhone 4.

Preventing Baseband Update

2011-02-06T15:58:14Z

XiiiX: /* TinyUmbrella/Cydia Method (iPhone 4) */

===Edit options.plist===
# Unpack custom IPSW
# Decrypt Restore Ramdisk using [[xpwntool]] and mount it
# Navigate to /usr/local/share/restore
# Edit options.plist on the restore ramdisk
(Ignore any other settings specified in the plist, don't edit them)
<pre>
<key>UpdateBaseband</key>
<false/>
</pre>
<ol start="5">
<li>Reencrypt the restore ramdisk</li>
<li>Repack the IPSW</li>
<li>Prepare device for custom firmware using [[redsn0w]]</li>
<li>Restore IPSW to [[iTunes]] in pwned [[DFU Mode]] using the appropriate method(Look at Restoring The Modified IPSW Section)</li>
</ol>

You must load a patched [[iBSS]]/[[iBEC]] for this to work. Using an original IPSW will not work, because redsn0w's pwned DFU Mode doesn't patch sigchecks in [[iBSS]] (which is loaded from the IPSW).

==Restoring The Modified IPSW==
Firmwares like 4.2.1 and above have baseband checks on the [[Restore Ramdisk]].If the modified IPSW is restored, iTunes will give a Error 1015 and iPhone will be in a recovery mode loop which cannot be exited by TinyUmbrella or the 'setenv auto-boot true' command 
Fortunately, the [[Update Ramdisk]] does not contain that baseband check so if the Update Method is used which is mentioned below,iTunes will give error 1013 and it can be exited by TinyUmbrella and the irecovery command.
===Update Method===
*Windows Users, Open iTunes. hold the Shift button and click Update then select the modified IPSW
*Mac Users, Open iTunes, hold the Alt button and click Update then select the modified IPSW
===Restore Method===
*Windows Users, Open iTunes. hold the Shift button and click Restore then select the modified IPSW
*Mac Users, Open iTunes, hold the Alt button and click Restore then select the modified IPSW

==[[TinyUmbrella]]/[[Cydia.app|Cydia]] Method (iPhone 4)==

The [[N90ap|iPhone 4]] requires a [[AT+XNONCE]] key signature from Apple in order to update the baseband. Pointing the hosts file to [[Cydia Server]] or running [[TinyUmbrella]] will allow this request for signature to be ignored, thus preventing a [[baseband]] update.

*'''This only works if [[Cydia]]/[[TinyUmbrella]] accepts the firmware's SHSH.'''
*'''This method 'works' with [[iOS]] 4.2.1, but in the restore ramdisk there is a baseband version check. If it doesn't match, it will crash before the Apple logo with the loading bar (the 2nd one, not the restore one) appears. It will boot and crash again. The usual 'Kick out of recovery mode' methods or "setenv auto-boot true" won't work, because it's not the problem that the auto-boot is false. So this method is actually not useful for [[iOS]] 4.2.1.'''
*'''But, users can now upgrade to 4.2.1 preserving the baseband, when you get into the iPhone 4 not booting after restore, just initialize the GreenPois0n RC5 and it will get you untethered jailbroken and it will kick you out of the recovery!'''
# Edit the hosts file and add the line "74.208.10.249 gs.apple.com" without the quotes, or run [[TinyUmbrella]] after saving the firmware's SHSH. If [[Cydia Server]] hasn't got your [[SHSH]], but you have it locally, use TSS Server method in [[TinyUmbrella]].
# Use the "Restore" button in [[iTunes]] to update if your firmware version is below 4.2 else use the "Update" button in [[iTunes]] to update.
# You will get Error 1013 and it can be easily bypassed by using the Exit Recovery Mode button in [[TinyUmbrella]] or typing 'setenv auto-boot true' and 'saveenv' in [[iRecovery]]

==[[User:Ih8sn0w|iH8Sn0w]]'s Method==
User [[User:Ih8sn0w|IH8sn0w]] mentioned a new method in [http://twitter.com/iH8sn0w/status/19249886721478656 this tweet] (an upgrade-only option in [[Sn0wbreeze]]). [http://twitter.com/iH8sn0w/status/19453808090288128 He confirmed] that his method is not the same as the above mentioned methods. To get more details, someone would have to compare the generated ipsw content.

This method can also be used on the iPhone 3GS and the iPhone 4 to downgrade from the 4.3 betas back to 4.2.1, as long as the device can be restored (and activated) to iOS 4.1 or an earlier version.
[[Category:Baseband]]

Untethered jailbreak

2011-02-05T22:14:01Z

XiiiX: /* Device support */

An untethered jailbreak is a type of [[jailbreak]] where your device does not require you to reboot with a connection to an external device capable of executing commands on the device.

== Device support ==
Many device/firmware combinations can use an untethered jailbreak. The most current version of iOS (4.2.1), as well as the [[N81ap|iPod touch 4G]], can be untethered jailbroken already using [[Greenpois0n (jailbreak)|greenpois0n]].

Devices as new as the [[N81ap|iPod touch 4G]]/[[K66ap|Apple TV 2G]] have known [[bootrom]] exploits. However, the [[N88ap|iPhone 3GS]] ([[iBoot-359.3|old bootrom]]) and older have bootrom exploits that allow for an untethered jailbreak. Newer devices as old as the [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]]), [[N72ap|iPod touch 2G]] ([[iBoot-240.5.1|new bootrom]]), and [[N18ap|iPod touch 3G]] have bootrom exploits that are limited to a [[tethered jailbreak]] (without the assistance of a firmware-based exploit).

==Utilities capable of untethered jailbreaks==
These jailbreak utilities can perform an untethered jailbreak, sorted by operating system.

===iOS===
[[Star]] runs on the device itself, and is completely independent of a computer's operating system.

===Mac OS X===
* [[Spirit]]
* [[blackra1n]]
* [[Greenpois0n (jailbreak)|greenpois0n]]
* [[limera1n]]
* [[PwnageTool]]
* [[redsn0w]]

===Windows===
* [[Spirit]]
* [[blackra1n]]
* [[Greenpois0n (jailbreak)|greenpois0n]]
* [[limera1n]]
* [[redsn0w]]
* [[sn0wbreeze]]

===Linux===
* [[Spirit]]
* [[Greenpois0n (jailbreak)|greenpois0n]]
* [[redsn0w]] (Certain Versions)

XMM6180

2011-02-02T19:09:15Z

XiiiX: /* Known Firmware Versions */

This is the baseband platform used in the iPhone 4 and build by Infineon. It uses the X-Gold 618.

The firmware is based on [http://rtos.com/products/threadx/ ThreadX], a realtime OS.

Firmware files are signed for a specific device by Apple during the restore process. As a result, the baseband will allow downgrades provided that Apple is still signing the firmware.

==Main Features (according to [http://de.sitestat.com/infineon/infineon/s?infineon.Products.Mobile_Phone_Platforms.WCDMA___HSDPA.XMM__6180.PRODUCT_TYPE_DOCUMENTS.X-GOLD%20618.pdf&ns_type=pdf&ns_url=http://www.infineon.com/dgdl/X-GOLD+618.pdf?folderId=db3a304312fcb1bc0113000c158f0004&fileId=db3a30431ed1d7b2011f5bec418f75e6 Datasheet])==

===Modem===
* HSDPA/HSUPA 7.2Mbps/2.9Mbps
* WCDMA: 384kbps DL/UL
* EDGE up to MSC33 with SAIC
* Speech: NB-AMR, WB-AMR

===CPU===
* ARM1176 @ 416MHz

=== Memory===
* LPDDR1-SDRAM
* NOR & NAND Flash
* eSD/eMMC

=== Connectivity and Interfaces ===
* Digital RF interface V3.09
* High speed SIM card interface
* USB 2.0 HS
* 3 x USIF; 2xI2S; 2xI2C
* 3 x SD/MMC card interface
[[Category:Baseband]]

==Memory Map==
*0x40FE0000-0x41000000 -- Bootloader(0x2)
*0x40040000-0x40800000 -- Main Code(0x4)
*0x40800000-0x41000000 -- AENEAS(0x5)
*0x60000000-0x60200000 -- EBL(0x3)
*0x00080000-0x00A00000 -- PSI_RAM(0x1)
*0x40800000-0x40A00000 -- CDS(0x4)
Although the crash dump would seem to contradict this, code running from 0x60xxxxxx

==Flash Files in 01.59.00==
*psi_ram.fls
**RAM bootloader?
**0x80000 size 0xFF00
*psi_flash.fls
**Flash bootloader
**0x40FE0000 size 0x8000
*stack.fls(ICE3.fls)
**Main baseband code
**0x40040000 size 0x6F7E5C
**start vector @ 0x40040408
*ebl.fls
**Flashing loader??
**0x60000000 size 0xDFB0

== Known Firmware Versions ==
[[1.59.00]] 4.0 (Build 8A293), 4.0.1 (Build 8A306), and 4.0.2 (Build 8A400)
[[2.07.01]] 4.1 beta 1 (Build 8B5080c)
[[2.10.04]] 4.1 (Build 8B117)
[[3.08.00]] 4.2 beta 1 (Build 8C5091e)
[[3.09.00]] 4.2 beta 2 (Build 8C5101c)
[[3.10.01]] 4.2.1 (Build 8C148)
[[4.08.00]] 4.3 beta 1 (Build 8F5148b)
[[4.09.00]] 4.3 beta 2 (Build 8F5153d)
[[4.10.01]] 4.3 beta 3 (Build 8F5166b)

XMM6180

2011-02-02T19:07:10Z

XiiiX: /* Known Firmware Versions */

This is the baseband platform used in the iPhone 4 and build by Infineon. It uses the X-Gold 618.

The firmware is based on [http://rtos.com/products/threadx/ ThreadX], a realtime OS.

Firmware files are signed for a specific device by Apple during the restore process. As a result, the baseband will allow downgrades provided that Apple is still signing the firmware.

==Main Features (according to [http://de.sitestat.com/infineon/infineon/s?infineon.Products.Mobile_Phone_Platforms.WCDMA___HSDPA.XMM__6180.PRODUCT_TYPE_DOCUMENTS.X-GOLD%20618.pdf&ns_type=pdf&ns_url=http://www.infineon.com/dgdl/X-GOLD+618.pdf?folderId=db3a304312fcb1bc0113000c158f0004&fileId=db3a30431ed1d7b2011f5bec418f75e6 Datasheet])==

===Modem===
* HSDPA/HSUPA 7.2Mbps/2.9Mbps
* WCDMA: 384kbps DL/UL
* EDGE up to MSC33 with SAIC
* Speech: NB-AMR, WB-AMR

===CPU===
* ARM1176 @ 416MHz

=== Memory===
* LPDDR1-SDRAM
* NOR & NAND Flash
* eSD/eMMC

=== Connectivity and Interfaces ===
* Digital RF interface V3.09
* High speed SIM card interface
* USB 2.0 HS
* 3 x USIF; 2xI2S; 2xI2C
* 3 x SD/MMC card interface
[[Category:Baseband]]

==Memory Map==
*0x40FE0000-0x41000000 -- Bootloader(0x2)
*0x40040000-0x40800000 -- Main Code(0x4)
*0x40800000-0x41000000 -- AENEAS(0x5)
*0x60000000-0x60200000 -- EBL(0x3)
*0x00080000-0x00A00000 -- PSI_RAM(0x1)
*0x40800000-0x40A00000 -- CDS(0x4)
Although the crash dump would seem to contradict this, code running from 0x60xxxxxx

==Flash Files in 01.59.00==
*psi_ram.fls
**RAM bootloader?
**0x80000 size 0xFF00
*psi_flash.fls
**Flash bootloader
**0x40FE0000 size 0x8000
*stack.fls(ICE3.fls)
**Main baseband code
**0x40040000 size 0x6F7E5C
**start vector @ 0x40040408
*ebl.fls
**Flashing loader??
**0x60000000 size 0xDFB0

== Known Firmware Versions ==
[[1.59.00]] 4.0 (Build 8A293), 4.0.1 (Build 8A306), and 4.0.2 (Build 8A400)
[[2.07.01]] 4.1 beta 1 (Build 8B5080c)
[[2.10.04]] 4.1 (Build 8B117)
[[3.09.00]] 4.2 beta 2 (Build 8C5101c)
[[3.10.01]] 4.2.1 (Build 8C148)
[[4.08.00]] 4.3 beta 1 (Build 8F5148b)
[[4.09.00]] 4.3 beta 2 (Build 8F5153d)
[[4.10.01]] 4.3 beta 3 (Build 8F5166b)

Firmware

2011-02-01T21:24:09Z

XiiiX: /* iPhone 4 (GSM model) */

Latest Apple download links can be found [http://www.itunes.com/version here].

==[[Apple TV]]==
===[[K66ap|Apple TV (2nd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.1
| [[Mojave 8M89 (Apple TV 2G)|Mojave 8M89]]
| [http://appldnld.apple.com/AppleTV/061-8940.20100926.Tvtnz/AppleTV2,1_4.1_8M89_Restore.ipsw AppleTV2,1_4.1_8M89_Restore.ipsw]
| <code>68647d6ce163fc20891ca5bcff647c8eecc2b8d9</code>
| Initial shipment.
| {{yes}}
| 253,759,976
|-
| 4.2
| [[jasper 8C150 (Apple TV 2G)|Jasper 8C150]]
| [http://appldnld.apple.com/AppleTV/061-8747.20101122.Vgtr5/AppleTV2,1_4.2_8C150_Restore.ipsw AppleTV2,1_4.2_8C150_Restore.ipsw]
| <code>58f9ab479783dad3dff3834452abc2917aaef2a5</code>
|
| {{no}}
| 279,991,056
|-
| 4.2.1
| [[jasper 8C154 (Apple TV 2G)|Jasper 8C154]]
| [http://appldnld.apple.com/AppleTV/061-9978.20101214.gmabr/AppleTV2,1_4.2.1_8C154_Restore.ipsw AppleTV2,1_4.2.1_8C154_Restore.ipsw]
| <code>c2b1adea595afa2b9caf633f0a820d3b66424dbf</code>
|
| {{yes|Yes1}}
| 280,052,510
|}

1 [[Tethered jailbreak]] only.

==[[iPad]]==
===[[K48ap|iPad (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPad Firmware Versions|Baseband]] (3G only)
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 3.2
| [[Wildcat 7B367 (iPad)|Wildcat 7B367]]
|rowspan="3" | [[6.15.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPad/061-7987.20100403.mjiTr/iPad1,1_3.2_7B367_Restore.ipsw iPad1,1_3.2_7B367_Restore.ipsw]
| <code>172e8297af74b91971a802e6ad137c891f553099</code>
| Initial shipment.
| {{yes}}
| 478,959,325
|-
| 3.2.1
| [[Wildcat 7B405 (iPad)|Wildcat 7B405]]
| [http://appldnld.apple.com/iPad/061-8282.20100713.vgtgh/iPad1,1_3.2.1_7B405_Restore.ipsw iPad1,1_3.2.1_7B405_Restore.ipsw]
| <code>de0a2b64cd335d48fb4abc9ed8700f5dbdf768ca</code>
|
| {{yes}}
| 479,012,625
|-
| 3.2.2
| [[Wildcat 7B500 (iPad)|Wildcat 7B500]]
| [http://appldnld.apple.com/iPad/061-8801.20100811.CvfR5/iPad1,1_3.2.2_7B500_Restore.ipsw iPad1,1_3.2.2_7B500_Restore.ipsw]
| <code>68b613f78581d36eab96aa5a007001dff142baa3</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 479,001,595
|-
| 4.2.1
| [[Jasper 8C148 (iPad)|Jasper 8C148]]
| [[7.10.00]]
| [http://appldnld.apple.com/iPad/061-9857.20101122.VGthy/iPad1,1_4.2.1_8C148_Restore.ipsw iPad1,1_4.2.1_8C148_Restore.ipsw]
| <code>8717b3bedc925b587566442ad375aa65d857e79a</code>
|
| {{yes|Yes1 2}}
| 578,084,840
|}

1 [[Tethered jailbreak]] only.

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

==[[iPhone]]==
===[[M68ap|iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband Firmware]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="91"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{no}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| Heavenly 1A543a
| 03.11.02_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| Heavenly 1C25
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| Heavenly 1C28
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| Snowbird 3A109a
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| Oktoberfest 3B48b
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| Little Bear 4A93
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| Little Bear 4A102
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| [[Big Bear 5A347 (iPhone)|Big Bear 5A347]]
|rowspan="11"| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
|rowspan="11" {{yes|[[BootNeuter]]}}
| 228,768,637
|-
| 2.0.1
| [[Big Bear 5B108 (iPhone)|Big Bear 5B108]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| 254,048,068
|-
| 2.0.2
| [[Big Bear 5C1 (iPhone)|Big Bear 5C1]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| 253,589,000
|-
| 2.1
| [[Sugar Bowl 5F136 (iPhone)|Sugar Bowl 5F136]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| 242,171,241
|-
| 2.2
| [[Timberline 5G77 (iPhone)|Timberline 5G77]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| 257,576,980
|-
| 2.2.1
| [[SUTimberline 5H11 (iPhone)|SUTimberline 5H11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| 252,536,460
|-
| 3.1.2
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code>
|
| {{yes}}
| 252,515,888
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone)|SUNorthstarTwo 7E18]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7481.20100202.4orot/iPhone1,1_3.1.3_7E18_Restore.ipsw iPhone1,1_3.1.3_7E18_Restore.ipsw]
| <code>eab23a7f8d2a17cb71046c50fc5f67ec390a3c2b</code>
|
| {{yes}}
| 238,319,275
|}

===[[N82ap|iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="90"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 2.0
| [[Big Bear 5A345 (iPhone 3G)|Big Bear 5A345]]
|rowspan="2" | [[1.45.00]]
| No download available
|
| Initial shipment.
| {{yes}}
|rowspan="5" {{partial|Upgrade to 2.2}}
|
|-
| 2.0
| [[Big Bear 5A347 (iPhone 3G)|Big Bear 5A347]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| 235,957,125
|-
| 2.0.1
| [[Big Bear 5B108 (iPhone 3G)|Big Bear 5B108]]
| [[1.48.02]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| 261,224,227
|-
| 2.0.2
| [[Big Bear 5C1 (iPhone 3G)|Big Bear 5C1]]
| [[2.08.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| 260,761,030
|-
| 2.1
| [[Sugar Bowl 5F136 (iPhone 3G)|Sugar Bowl 5F136]]
| [[2.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| 249,341,655
|-
| 2.2
| [[Timberline 5G77 (iPhone 3G)|Timberline 5G77]]
| [[2.28.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|yellowsn0w]]}}
| 258,342,348
|-
| 2.2.1
| [[SUTimberline 5H11 (iPhone 3G)|SUTimberline 5H11]]
| [[2.30.03]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{partial|Upgrade to 3.0}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
|rowspan="2" | [[4.26.08]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
|rowspan="2" {{yes|[[ultrasn0w]]}}
| 241,229,233
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone 3G)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
|rowspan="2" | [[5.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}
| 253,361,339
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| {{yes}}
| 253,340,786
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3G)|SUNorthstarTwo 7E18]]
| [[5.12.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7468.20100202.pbnrt/iPhone1,2_3.1.3_7E18_Restore.ipsw iPhone1,2_3.1.3_7E18_Restore.ipsw]
| <code>f5950afca546f93e281ba3cdb08bc0cfed7f0896</code>
|
| {{yes}}
| {{yes|[[ultrasn0w]]}}
| 239,139,281
|-
| 4.0
| [[Apex 8A293 (iPhone 3G)|Apex 8A293]]
|rowspan="3" | [[5.13.04]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7436.20100621.58Yt4/iPhone1,2_4.0_8A293_Restore.ipsw iPhone1,2_4.0_8A293_Restore.ipsw]
| <code>ee1eba9281b902d7ff3f24d50f9aebff0df27f92</code>
|
| {{yes}}
|rowspan="3" {{yes|[[ultrasn0w]]}}
| 306,274,631
|-
| 4.0.1
| [[Apex 8A306 (iPhone 3G)|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8616.20100715.phnt4/iPhone1,2_4.0.1_8A306_Restore.ipsw iPhone1,2_4.0.1_8A306_Restore.ipsw]
| <code>940bd2b36c646f6673419eab661ac1f13248e592</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| 320,237,975
|-
| 4.0.2
| [[Apex 8A400 (iPhone 3G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8802.20100811.XcfpR/iPhone1,2_4.0.2_8A400_Restore.ipsw iPhone1,2_4.0.2_8A400_Restore.ipsw]
| <code>ee2bc74719170a7a2440b593b6f300727c930c69</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 320,216,794
|-
| 4.1
| [[Baker 8B117 (iPhone 3G)|Baker 8B117]]
| [[5.14.02]]
| [http://appldnld.apple.com/iPhone4/061-7932.20100908.3fgt5/iPhone1,2_4.1_8B117_Restore.ipsw iPhone1,2_4.1_8B117_Restore.ipsw]
|<code>d87bab469dd1146ab83ddcc23f03b3164d7e09d4</code>
|
| {{Yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 323,137,556
|-
|-
| 4.2.1
| [[Jasper 8C148 (iPhone 3G)|Jasper 8C148]]
| [[5.15.04]]
| [http://appldnld.apple.com/iPhone4/061-9853.20101122.Vfgt5/iPhone1,2_4.2.1_8C148_Restore.ipsw iPhone1,2_4.2.1_8C148_Restore.ipsw]
|<code>d2ed58586e8ca2153f2e2ec585bba8afc5173378</code>
|
| {{Yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 338,579,762
|-
|}

===[[N88ap|iPhone 3GS]]===
Units with the new bootrom began shipping around September 2009.

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3|old bootrom]])
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3.2|new bootrom]])
!width="80"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
|rowspan="2" | [[4.26.08]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
|rowspan="2" {{no|[[SHSH]]s unavailable at release}}
|rowspan="2" {{yes|[[ultrasn0w]]}}
| 312,292,933
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone_3GS)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
|rowspan="2" | [[5.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
|
| {{yes}}
| {{yes|Yes1}}
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}
| 321,011,474
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3GS)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code>
|
| {{yes}}
| {{yes}}
| 321,015,700
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|SUNorthstarTwo 7E18]]
| [[5.12.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7472.20100202.8tugj/iPhone2,1_3.1.3_7E18_Restore.ipsw iPhone2,1_3.1.3_7E18_Restore.ipsw]
| <code>8cb3775e62c6f72059a962bf891b4e145b965052</code>
|
| {{yes}}
| {{yes}}
| {{yes|[[ultrasn0w]]}}
| 305,122,343
|-
| 4.0
| [[Apex 8A293 (iPhone 3GS)|Apex 8A293]]
|rowspan="3" | [[5.13.04]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7437.20100621.5urG8/iPhone2,1_4.0_8A293_Restore.ipsw iPhone2,1_4.0_8A293_Restore.ipsw]
| <code>e065245874c73510ceb8fa4bd9388b60d46eb252</code>
|
| {{yes}}
| {{yes}}
|rowspan="3" {{yes|[[ultrasn0w]]}}
| 396,281,280
|-
| 4.0.1
| [[Apex 8A306 (iPhone 3GS)‎|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8618.20100715.Zapn4/iPhone2,1_4.0.1_8A306_Restore.ipsw iPhone2,1_4.0.1_8A306_Restore.ipsw]
| <code>c2b6fb9a158547ce726baa1bf8f0558a71518fec</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| {{yes}}
| 396,322,891
|-
| 4.0.2
| [[Apex 8A400 (iPhone 3GS)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8805.20100811.Dcr4e/iPhone2,1_4.0.2_8A400_Restore.ipsw iPhone2,1_4.0.2_8A400_Restore.ipsw]
| <code>61d21363ced6e006cc226f9a0a0e9c6ed8e048ab</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| {{yes}}
| 396,310,640
|-
| 4.1
| [[Baker 8B117 (iPhone 3GS)|Baker 8B117]]
| [[5.14.02]]
| [http://appldnld.apple.com/iPhone4/061-7938.20100908.F3rCk/iPhone2,1_4.1_8B117_Restore.ipsw iPhone2,1_4.1_8B117_Restore.ipsw]
|<code>2d1657cd33ae23b8d4e79e41fe758d09d3c52e30</code>
|
| {{yes}}
| {{yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 400,572,133
|-
| 4.2.1
| [[Jasper 8C148a (iPhone 3GS)|Jasper 8C148a]]
| [[5.15.04]]
| [http://appldnld.apple.com/iPhone4/061-9895.20101122.Cdew2/iPhone2,1_4.2.1_8C148a_Restore.ipsw iPhone2,1_4.2.1_8C148a_Restore.ipsw]
| <code>2787bb9fbf18594279d05682e6fd16d2b9612a2a</code>
|
| {{yes}}
| {{yes|Yes1}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 420,813,164
|}
1 [[Tethered jailbreak]] only.

===[[N90ap|iPhone 4 (GSM model)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[XMM 6180#Known Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]?
!width="95"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 4.0
| [[Apex 8A293 (iPhone 4)|Apex 8A293]]
|rowspan="3" | [[1.59.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7380.20100621,Vfgb5/iPhone3,1_4.0_8A293_Restore.ipsw iPhone3,1_4.0_8A293_Restore.ipsw]
| <code>171c2a3995fa149f2a369ccd87f82c5c30da3f88</code>
| Initial shipment.
| {{yes}}
|rowspan="3" {{Yes|[[ultrasn0w]]}}
| 607,363,121
|-
| 4.0.1
| [[Apex 8A306 (iPhone 4)|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8619.20100715.4Pnsx/iPhone3,1_4.0.1_8A306_Restore.ipsw iPhone3,1_4.0.1_8A306_Restore.ipsw]
| <code>a9cf20679273b7e502ab384854ba96cc2a54d532</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| 607,380,127
|-
| 4.0.2
| [[Apex 8A400 (iPhone 4)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8807.20100811.3Edre/iPhone3,1_4.0.2_8A400_Restore.ipsw iPhone3,1_4.0.2_8A400_Restore.ipsw]
| <code>19eb071cdb9f1601b106825d0a16b1449c6eef8c</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 607,375,880
|-
| 4.1
| [[Baker 8B117 (iPhone 4)|Baker 8B117]]
| [[2.10.04]]
| [http://appldnld.apple.com/iPhone4/061-7939.20100908.Lcyg3/iPhone3,1_4.1_8B117_Restore.ipsw iPhone3,1_4.1_8B117_Restore.ipsw]
|<code>a3f8a333ca181146b862ca6a59c9a6e7c27eba0b</code>
|
| {{yes}}
| {{No}}
| 618,501,195
|-
| 4.2.1
| [[Jasper 8C148 (iPhone 4)|Jasper 8C148]]
| [[3.10.01]]
| [http://appldnld.apple.com/iPhone4/061-9858.20101122.Er456/iPhone3,1_4.2.1_8C148_Restore.ipsw iPhone3,1_4.2.1_8C148_Restore.ipsw]
|<code>366b28e9c95936bd4b11a84d54fefaf079fd6411</code>
|
| {{yes|Yes1 2}}
| {{No}}
| 654,550,096
|}
1 [[Tethered jailbreak]] only.

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, an untethered solution can be used, called [[Jailbreak Monte]].

===[[N92ap|iPhone 4 (CDMA model)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| Baseband
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]?
!width="95"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 4.2.6
| [[Phoenix 8E200 (iPhone 4 CDMA)|Phoenix 8E200]]
| 1.0.05
| [http://appldnld.apple.com/iPhone4/041-0177.20110131.Pyvrz/iPhone3,3_4.2.6_8E200_Restore.ipsw iPhone3,3_4.2.6_8E200_Restore.ipsw]
|<code>f32cf46790a473a6c12f9dbd3773bf40fbdf6eee</code>
|
| {{No}}
| {{No}}
| 683,594,406
|}

==[[iPod touch]]==
===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 1.1
| Snowbird 3A100a
| No download available
|
| Initial shipment.
| {{no}}
|
|-
| 1.1
| Snowbird 3A101a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{no}}
| 157,890,186
|-
| 1.1.1
| Snowbird 3A110a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| Oktoberfest 3B48b
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| Little Bear 4A93
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| Little Bear 4A102
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| Little Bear 4B1
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| [[Big Bear 5A347 (iPod touch 1G)|Big Bear 5A347]]
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| [[Big Bear 5B108 (iPod touch 1G)|Big Bear 5B108]]
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| [[Big Bear 5C1 (iPod touch 1G)|Big Bear 5C1]]
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| [[Sugar Bowl 5F137 (iPod touch 1G)|Sugar Bowl 5F137]]
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| [[Timberline 5G77 (iPod touch 1G)|Timberline 5G77]]
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| [[SUTimberline 5H11 (iPod touch 1G)|SUTimberline 5H11]]
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 1G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 1G)|Northstar 7C145]]
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 1G)|Northstar 7D11]]
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| {{yes}}
| 249,780,497
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 1G)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f897990f19d2f093b35e0813d7d77806404fb1f</code>
|
| {{yes}}
| 235,678,189
|}

===[[N72ap|iPod touch (2nd generation)]]===
Units with the new bootrom have model numbers that start with "MC."

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.4|old bootrom]])
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.5.1|new bootrom]])
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138 (iPod touch 2G)|Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes|Yes1}}
|rowspan="4" {{no|Incompatible device/
firmware match}}
| 282,083,944
|-
| 2.2
| [[Timberline 5G77a (iPod touch 2G)|Timberline 5G77a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{no}}
| 291,123,491
|-
| 2.2.1
| [[SUTimberline 5H11a (iPod touch 2G)|SUTimberline 5H11a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.x is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
| Initial shipment for units with the new bootrom.
| {{yes}}
| {{yes|Yes1}}
| 277,753,989
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 2G)|Northstar 7D11]]
| Download Link Prohibited
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code>
|
| {{yes}}
| {{yes}}
| 277,794,671
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f4f5c01eda2f811f73167e7d1f82dbeed82367b</code>
|
| {{yes}}
| {{yes}}
| 263,275,211
|-
| 4.0
| [[Apex 8A293 (iPod touch 2G)|Apex 8A293]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7435.20100621.tr49t/iPod2,1_4.0_8A293_Restore.ipsw iPod2,1_4.0_8A293_Restore.ipsw]
| <code>c026c373bc535496a6f901de2ba37d4a487413bf</code>
|
| {{yes}}
| {{yes}}
| 330,278,777
|-
| 4.0.2
| [[Apex 8A400 (iPod touch 2G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8551.20100811.Xcder/iPod2,1_4.0.2_8A400_Restore.ipsw iPod2,1_4.0.2_8A400_Restore.ipsw]
| <code>06a42297d94461264eb64d7c8640cc5d1c19edeb</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| {{yes|Yes1}}
| 344,248,876
|-
| 4.1
| [[Baker 8B117 (iPod touch 2G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-7937.20100908.ghj4f/iPod2,1_4.1_8B117_Restore.ipsw iPod2,1_4.1_8B117_Restore.ipsw]
|<code>97abde6207660bd876fd476275dd526d0dcf3d19</code>
|
| {{Yes}}
| {{yes}}
| 348,027,174
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 2G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9855.20101122.Lrft6/iPod2,1_4.2.1_8C148_Restore.ipsw iPod2,1_4.2.1_8C148_Restore.ipsw]
|<code>b9efddc7bb4350c237a8d3846af61bbfc8a2f647</code>
|
| {{yes}}
| {{no}}
|363,553,480
|}
1 [[Tethered jailbreak]] only.

===[[N18ap|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| {{yes|Yes1}}

| 311,702,789
|-
| 3.1.1
| [[Northstar 7C146 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| {{yes|Yes1}}
| 311,690,768
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code>
|
| {{yes}}
| 311,740,034
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|SUNorthstarTwo 7E18]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7473.20100202.4i44t/iPod3,1_3.1.3_7E18_Restore.ipsw iPod3,1_3.1.3_7E18_Restore.ipsw]
| <code>375fd469b18bfc0b74c7cfa5b4d5945197b1d106</code>
|
| {{yes}}
| 295,870,806
|-
| 4.0
| [[Apex 8A293 (iPod touch 3G)|Apex 8A293]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7381.20100621.AzSP9/iPod3,1_4.0_8A293_Restore.ipsw iPod3,1_4.0_8A293_Restore.ipsw]
| <code>36fe02b83f87d6305db572e1644841e3cd64cc7d</code>
|
| {{yes}}
| 384,178,784
|-
| 4.0.2
| [[Apex 8A400 (iPod touch 3G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8554.20100811.Bgt54/iPod3,1_4.0.2_8A400_Restore.ipsw iPod3,1_4.0.2_8A400_Restore.ipsw]
| <code>481b21044130125b117d53207f725b70fb061855</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 384,203,993
|-
| 4.1
| [[Baker 8B117 (iPod touch 3G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-7941.20100908.sV9KE/iPod3,1_4.1_8B117_Restore.ipsw iPod3,1_4.1_8B117_Restore.ipsw]
|<code>3162bad4060b7a58c9942ddb483e5bd9bcc5269f</code>
|
| {{yes}}
| 388,255,189
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 3G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9860.20101122.Xsde3/iPod3,1_4.2.1_8C148_Restore.ipsw iPod3,1_4.2.1_8C148_Restore.ipsw]
|<code>1127a042c535f7cf0be950ff8946862d5fb05b36</code>
|
| {{yes|Yes1}}
| 408,118,620
|}

1 [[Tethered jailbreak]] only.

===[[N81ap|iPod touch (4th generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.1
| [[Baker 8B117 (iPod touch 4G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-8490.20100901.hyjtR/iPod4,1_4.1_8B117_Restore.ipsw iPod4,1_4.1_8B117_Restore.ipsw]
| <code>a464492bf6ad25d65b378c85d8b181f973ede38a</code>
| Initial shipment.
| {{yes}}
| 608,360,672
|-
| 4.1
| [[Baker 8B118 (iPod touch 4G)|Baker 8B118]]
| [http://appldnld.apple.com/iPhone4/061-9344.20100922.Urgt43/iPod4,1_4.1_8B118_Restore.ipsw iPod4,1_4.1_8B118_Restore.ipsw]
| <code>331fb1342f5dab8c04cead74384a1e0fc1145952</code>
|
| {{yes}}
| 608,360,927
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 4G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9859.20101122.$erft/iPod4,1_4.2.1_8C148_Restore.ipsw iPod4,1_4.2.1_8C148_Restore.ipsw]
| <code>6a890696126d0cb7f9ccd6b913ecb09cf2029820</code>
|
| {{yes|Yes1 2}}
|638,177,119
|}

1 [[Tethered jailbreak]] only.

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, an untethered solution can be used, called [[Jailbreak Monte]].

==See also==
* [[VFDecrypt]]
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://itunes.com/version Apple Firmware XML]

Firmware

2011-02-01T20:37:57Z

XiiiX: /* iPod touch (4th generation) */

Latest Apple download links can be found [http://www.itunes.com/version here].

==[[Apple TV]]==
===[[K66ap|Apple TV (2nd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.1
| [[Mojave 8M89 (Apple TV 2G)|Mojave 8M89]]
| [http://appldnld.apple.com/AppleTV/061-8940.20100926.Tvtnz/AppleTV2,1_4.1_8M89_Restore.ipsw AppleTV2,1_4.1_8M89_Restore.ipsw]
| <code>68647d6ce163fc20891ca5bcff647c8eecc2b8d9</code>
| Initial shipment.
| {{yes}}
| 253,759,976
|-
| 4.2
| [[jasper 8C150 (Apple TV 2G)|Jasper 8C150]]
| [http://appldnld.apple.com/AppleTV/061-8747.20101122.Vgtr5/AppleTV2,1_4.2_8C150_Restore.ipsw AppleTV2,1_4.2_8C150_Restore.ipsw]
| <code>58f9ab479783dad3dff3834452abc2917aaef2a5</code>
|
| {{no}}
| 279,991,056
|-
| 4.2.1
| [[jasper 8C154 (Apple TV 2G)|Jasper 8C154]]
| [http://appldnld.apple.com/AppleTV/061-9978.20101214.gmabr/AppleTV2,1_4.2.1_8C154_Restore.ipsw AppleTV2,1_4.2.1_8C154_Restore.ipsw]
| <code>c2b1adea595afa2b9caf633f0a820d3b66424dbf</code>
|
| {{yes|Yes1}}
| 280,052,510
|}

1 [[Tethered jailbreak]] only.

==[[iPad]]==
===[[K48ap|iPad (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPad Firmware Versions|Baseband]] (3G only)
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 3.2
| [[Wildcat 7B367 (iPad)|Wildcat 7B367]]
|rowspan="3" | [[6.15.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPad/061-7987.20100403.mjiTr/iPad1,1_3.2_7B367_Restore.ipsw iPad1,1_3.2_7B367_Restore.ipsw]
| <code>172e8297af74b91971a802e6ad137c891f553099</code>
| Initial shipment.
| {{yes}}
| 478,959,325
|-
| 3.2.1
| [[Wildcat 7B405 (iPad)|Wildcat 7B405]]
| [http://appldnld.apple.com/iPad/061-8282.20100713.vgtgh/iPad1,1_3.2.1_7B405_Restore.ipsw iPad1,1_3.2.1_7B405_Restore.ipsw]
| <code>de0a2b64cd335d48fb4abc9ed8700f5dbdf768ca</code>
|
| {{yes}}
| 479,012,625
|-
| 3.2.2
| [[Wildcat 7B500 (iPad)|Wildcat 7B500]]
| [http://appldnld.apple.com/iPad/061-8801.20100811.CvfR5/iPad1,1_3.2.2_7B500_Restore.ipsw iPad1,1_3.2.2_7B500_Restore.ipsw]
| <code>68b613f78581d36eab96aa5a007001dff142baa3</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 479,001,595
|-
| 4.2.1
| [[Jasper 8C148 (iPad)|Jasper 8C148]]
| [[7.10.00]]
| [http://appldnld.apple.com/iPad/061-9857.20101122.VGthy/iPad1,1_4.2.1_8C148_Restore.ipsw iPad1,1_4.2.1_8C148_Restore.ipsw]
| <code>8717b3bedc925b587566442ad375aa65d857e79a</code>
|
| {{yes|Yes1 2}}
| 578,084,840
|}

1 [[Tethered jailbreak]] only.

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

==[[iPhone]]==
===[[M68ap|iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband Firmware]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="91"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 03.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{no}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| Heavenly 1A543a
| 03.11.02_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| Heavenly 1C25
| 03.12.06_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| Heavenly 1C28
| 03.14.08_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| Snowbird 3A109a
| 04.01.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| Oktoberfest 3B48b
| 04.02.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| Little Bear 4A93
| 04.03.13_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| Little Bear 4A102
| 04.04.05_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| [[Big Bear 5A347 (iPhone)|Big Bear 5A347]]
|rowspan="11"| 04.05.04_G
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
|rowspan="11" {{yes|[[BootNeuter]]}}
| 228,768,637
|-
| 2.0.1
| [[Big Bear 5B108 (iPhone)|Big Bear 5B108]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| 254,048,068
|-
| 2.0.2
| [[Big Bear 5C1 (iPhone)|Big Bear 5C1]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| 253,589,000
|-
| 2.1
| [[Sugar Bowl 5F136 (iPhone)|Sugar Bowl 5F136]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| 242,171,241
|-
| 2.2
| [[Timberline 5G77 (iPhone)|Timberline 5G77]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| 257,576,980
|-
| 2.2.1
| [[SUTimberline 5H11 (iPhone)|SUTimberline 5H11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| 252,536,460
|-
| 3.1.2
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code>
|
| {{yes}}
| 252,515,888
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone)|SUNorthstarTwo 7E18]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7481.20100202.4orot/iPhone1,1_3.1.3_7E18_Restore.ipsw iPhone1,1_3.1.3_7E18_Restore.ipsw]
| <code>eab23a7f8d2a17cb71046c50fc5f67ec390a3c2b</code>
|
| {{yes}}
| 238,319,275
|}

===[[N82ap|iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="90"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 2.0
| [[Big Bear 5A345 (iPhone 3G)|Big Bear 5A345]]
|rowspan="2" | [[1.45.00]]
| No download available
|
| Initial shipment.
| {{yes}}
|rowspan="5" {{partial|Upgrade to 2.2}}
|
|-
| 2.0
| [[Big Bear 5A347 (iPhone 3G)|Big Bear 5A347]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| 235,957,125
|-
| 2.0.1
| [[Big Bear 5B108 (iPhone 3G)|Big Bear 5B108]]
| [[1.48.02]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| 261,224,227
|-
| 2.0.2
| [[Big Bear 5C1 (iPhone 3G)|Big Bear 5C1]]
| [[2.08.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| 260,761,030
|-
| 2.1
| [[Sugar Bowl 5F136 (iPhone 3G)|Sugar Bowl 5F136]]
| [[2.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| 249,341,655
|-
| 2.2
| [[Timberline 5G77 (iPhone 3G)|Timberline 5G77]]
| [[2.28.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|yellowsn0w]]}}
| 258,342,348
|-
| 2.2.1
| [[SUTimberline 5H11 (iPhone 3G)|SUTimberline 5H11]]
| [[2.30.03]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{partial|Upgrade to 3.0}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
|rowspan="2" | [[4.26.08]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
|rowspan="2" {{yes|[[ultrasn0w]]}}
| 241,229,233
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone 3G)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
|rowspan="2" | [[5.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}
| 253,361,339
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| {{yes}}
| 253,340,786
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3G)|SUNorthstarTwo 7E18]]
| [[5.12.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7468.20100202.pbnrt/iPhone1,2_3.1.3_7E18_Restore.ipsw iPhone1,2_3.1.3_7E18_Restore.ipsw]
| <code>f5950afca546f93e281ba3cdb08bc0cfed7f0896</code>
|
| {{yes}}
| {{yes|[[ultrasn0w]]}}
| 239,139,281
|-
| 4.0
| [[Apex 8A293 (iPhone 3G)|Apex 8A293]]
|rowspan="3" | [[5.13.04]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7436.20100621.58Yt4/iPhone1,2_4.0_8A293_Restore.ipsw iPhone1,2_4.0_8A293_Restore.ipsw]
| <code>ee1eba9281b902d7ff3f24d50f9aebff0df27f92</code>
|
| {{yes}}
|rowspan="3" {{yes|[[ultrasn0w]]}}
| 306,274,631
|-
| 4.0.1
| [[Apex 8A306 (iPhone 3G)|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8616.20100715.phnt4/iPhone1,2_4.0.1_8A306_Restore.ipsw iPhone1,2_4.0.1_8A306_Restore.ipsw]
| <code>940bd2b36c646f6673419eab661ac1f13248e592</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| 320,237,975
|-
| 4.0.2
| [[Apex 8A400 (iPhone 3G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8802.20100811.XcfpR/iPhone1,2_4.0.2_8A400_Restore.ipsw iPhone1,2_4.0.2_8A400_Restore.ipsw]
| <code>ee2bc74719170a7a2440b593b6f300727c930c69</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 320,216,794
|-
| 4.1
| [[Baker 8B117 (iPhone 3G)|Baker 8B117]]
| [[5.14.02]]
| [http://appldnld.apple.com/iPhone4/061-7932.20100908.3fgt5/iPhone1,2_4.1_8B117_Restore.ipsw iPhone1,2_4.1_8B117_Restore.ipsw]
|<code>d87bab469dd1146ab83ddcc23f03b3164d7e09d4</code>
|
| {{Yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 323,137,556
|-
|-
| 4.2.1
| [[Jasper 8C148 (iPhone 3G)|Jasper 8C148]]
| [[5.15.04]]
| [http://appldnld.apple.com/iPhone4/061-9853.20101122.Vfgt5/iPhone1,2_4.2.1_8C148_Restore.ipsw iPhone1,2_4.2.1_8C148_Restore.ipsw]
|<code>d2ed58586e8ca2153f2e2ec585bba8afc5173378</code>
|
| {{Yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 338,579,762
|-
|}

===[[N88ap|iPhone 3GS]]===
Units with the new bootrom began shipping around September 2009.

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3|old bootrom]])
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3.2|new bootrom]])
!width="80"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
|rowspan="2" | [[4.26.08]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
|rowspan="2" {{no|[[SHSH]]s unavailable at release}}
|rowspan="2" {{yes|[[ultrasn0w]]}}
| 312,292,933
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone_3GS)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
|rowspan="2" | [[5.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
|
| {{yes}}
| {{yes|Yes1}}
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}
| 321,011,474
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3GS)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code>
|
| {{yes}}
| {{yes}}
| 321,015,700
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|SUNorthstarTwo 7E18]]
| [[5.12.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7472.20100202.8tugj/iPhone2,1_3.1.3_7E18_Restore.ipsw iPhone2,1_3.1.3_7E18_Restore.ipsw]
| <code>8cb3775e62c6f72059a962bf891b4e145b965052</code>
|
| {{yes}}
| {{yes}}
| {{yes|[[ultrasn0w]]}}
| 305,122,343
|-
| 4.0
| [[Apex 8A293 (iPhone 3GS)|Apex 8A293]]
|rowspan="3" | [[5.13.04]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7437.20100621.5urG8/iPhone2,1_4.0_8A293_Restore.ipsw iPhone2,1_4.0_8A293_Restore.ipsw]
| <code>e065245874c73510ceb8fa4bd9388b60d46eb252</code>
|
| {{yes}}
| {{yes}}
|rowspan="3" {{yes|[[ultrasn0w]]}}
| 396,281,280
|-
| 4.0.1
| [[Apex 8A306 (iPhone 3GS)‎|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8618.20100715.Zapn4/iPhone2,1_4.0.1_8A306_Restore.ipsw iPhone2,1_4.0.1_8A306_Restore.ipsw]
| <code>c2b6fb9a158547ce726baa1bf8f0558a71518fec</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| {{yes}}
| 396,322,891
|-
| 4.0.2
| [[Apex 8A400 (iPhone 3GS)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8805.20100811.Dcr4e/iPhone2,1_4.0.2_8A400_Restore.ipsw iPhone2,1_4.0.2_8A400_Restore.ipsw]
| <code>61d21363ced6e006cc226f9a0a0e9c6ed8e048ab</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| {{yes}}
| 396,310,640
|-
| 4.1
| [[Baker 8B117 (iPhone 3GS)|Baker 8B117]]
| [[5.14.02]]
| [http://appldnld.apple.com/iPhone4/061-7938.20100908.F3rCk/iPhone2,1_4.1_8B117_Restore.ipsw iPhone2,1_4.1_8B117_Restore.ipsw]
|<code>2d1657cd33ae23b8d4e79e41fe758d09d3c52e30</code>
|
| {{yes}}
| {{yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 400,572,133
|-
| 4.2.1
| [[Jasper 8C148a (iPhone 3GS)|Jasper 8C148a]]
| [[5.15.04]]
| [http://appldnld.apple.com/iPhone4/061-9895.20101122.Cdew2/iPhone2,1_4.2.1_8C148a_Restore.ipsw iPhone2,1_4.2.1_8C148a_Restore.ipsw]
| <code>2787bb9fbf18594279d05682e6fd16d2b9612a2a</code>
|
| {{yes}}
| {{yes|Yes1}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 420,813,164
|}
1 [[Tethered jailbreak]] only.

===[[N90ap|iPhone 4 (GSM model)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[XMM 6180#Known Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]?
!width="95"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 4.0
| [[Apex 8A293 (iPhone 4)|Apex 8A293]]
|rowspan="3" | [[1.59.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7380.20100621,Vfgb5/iPhone3,1_4.0_8A293_Restore.ipsw iPhone3,1_4.0_8A293_Restore.ipsw]
| <code>171c2a3995fa149f2a369ccd87f82c5c30da3f88</code>
| Initial shipment.
| {{yes}}
|rowspan="3" {{Yes|[[ultrasn0w]]}}
| 607,363,121
|-
| 4.0.1
| [[Apex 8A306 (iPhone 4)|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8619.20100715.4Pnsx/iPhone3,1_4.0.1_8A306_Restore.ipsw iPhone3,1_4.0.1_8A306_Restore.ipsw]
| <code>a9cf20679273b7e502ab384854ba96cc2a54d532</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| 607,380,127
|-
| 4.0.2
| [[Apex 8A400 (iPhone 4)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8807.20100811.3Edre/iPhone3,1_4.0.2_8A400_Restore.ipsw iPhone3,1_4.0.2_8A400_Restore.ipsw]
| <code>19eb071cdb9f1601b106825d0a16b1449c6eef8c</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 607,375,880
|-
| 4.1
| [[Baker 8B117 (iPhone 4)|Baker 8B117]]
| [[2.10.04]]
| [http://appldnld.apple.com/iPhone4/061-7939.20100908.Lcyg3/iPhone3,1_4.1_8B117_Restore.ipsw iPhone3,1_4.1_8B117_Restore.ipsw]
|<code>a3f8a333ca181146b862ca6a59c9a6e7c27eba0b</code>
|
| {{yes}}
| {{No}}
| 618,501,195
|-
| 4.2.1
| [[Jasper 8C148 (iPhone 4)|Jasper 8C148]]
| [[3.10.01]]
| [http://appldnld.apple.com/iPhone4/061-9858.20101122.Er456/iPhone3,1_4.2.1_8C148_Restore.ipsw iPhone3,1_4.2.1_8C148_Restore.ipsw]
|<code>366b28e9c95936bd4b11a84d54fefaf079fd6411</code>
|
| {{yes|Yes1 2}}
| {{No}}
| 654,550,096
|}
1 [[Tethered jailbreak]] only.

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

===[[N92ap|iPhone 4 (CDMA model)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| Baseband
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]?
!width="95"| Publicly available virgin [[unlock]]?
!width="70"| File Size
|-
| 4.2.6
| [[Phoenix 8E200 (iPhone 4 CDMA)|Phoenix 8E200]]
| 1.0.05
| [http://appldnld.apple.com/iPhone4/041-0177.20110131.Pyvrz/iPhone3,3_4.2.6_8E200_Restore.ipsw iPhone3,3_4.2.6_8E200_Restore.ipsw]
|<code>f32cf46790a473a6c12f9dbd3773bf40fbdf6eee</code>
|
| {{No}}
| {{No}}
| 683,594,406
|}

==[[iPod touch]]==
===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 1.1
| Snowbird 3A100a
| No download available
|
| Initial shipment.
| {{no}}
|
|-
| 1.1
| Snowbird 3A101a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{no}}
| 157,890,186
|-
| 1.1.1
| Snowbird 3A110a
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| Oktoberfest 3B48b
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| Little Bear 4A93
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| Little Bear 4A102
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| Little Bear 4B1
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| [[Big Bear 5A347 (iPod touch 1G)|Big Bear 5A347]]
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| [[Big Bear 5B108 (iPod touch 1G)|Big Bear 5B108]]
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| [[Big Bear 5C1 (iPod touch 1G)|Big Bear 5C1]]
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| [[Sugar Bowl 5F137 (iPod touch 1G)|Sugar Bowl 5F137]]
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| [[Timberline 5G77 (iPod touch 1G)|Timberline 5G77]]
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| [[SUTimberline 5H11 (iPod touch 1G)|SUTimberline 5H11]]
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 1G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 1G)|Northstar 7C145]]
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 1G)|Northstar 7D11]]
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| {{yes}}
| 249,780,497
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 1G)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f897990f19d2f093b35e0813d7d77806404fb1f</code>
|
| {{yes}}
| 235,678,189
|}

===[[N72ap|iPod touch (2nd generation)]]===
Units with the new bootrom have model numbers that start with "MC."

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.4|old bootrom]])
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.5.1|new bootrom]])
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138 (iPod touch 2G)|Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes|Yes1}}
|rowspan="4" {{no|Incompatible device/
firmware match}}
| 282,083,944
|-
| 2.2
| [[Timberline 5G77a (iPod touch 2G)|Timberline 5G77a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{no}}
| 291,123,491
|-
| 2.2.1
| [[SUTimberline 5H11a (iPod touch 2G)|SUTimberline 5H11a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.x is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
| Initial shipment for units with the new bootrom.
| {{yes}}
| {{yes|Yes1}}
| 277,753,989
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 2G)|Northstar 7D11]]
| Download Link Prohibited
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code>
|
| {{yes}}
| {{yes}}
| 277,794,671
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f4f5c01eda2f811f73167e7d1f82dbeed82367b</code>
|
| {{yes}}
| {{yes}}
| 263,275,211
|-
| 4.0
| [[Apex 8A293 (iPod touch 2G)|Apex 8A293]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7435.20100621.tr49t/iPod2,1_4.0_8A293_Restore.ipsw iPod2,1_4.0_8A293_Restore.ipsw]
| <code>c026c373bc535496a6f901de2ba37d4a487413bf</code>
|
| {{yes}}
| {{yes}}
| 330,278,777
|-
| 4.0.2
| [[Apex 8A400 (iPod touch 2G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8551.20100811.Xcder/iPod2,1_4.0.2_8A400_Restore.ipsw iPod2,1_4.0.2_8A400_Restore.ipsw]
| <code>06a42297d94461264eb64d7c8640cc5d1c19edeb</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| {{yes|Yes1}}
| 344,248,876
|-
| 4.1
| [[Baker 8B117 (iPod touch 2G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-7937.20100908.ghj4f/iPod2,1_4.1_8B117_Restore.ipsw iPod2,1_4.1_8B117_Restore.ipsw]
|<code>97abde6207660bd876fd476275dd526d0dcf3d19</code>
|
| {{Yes}}
| {{yes}}
| 348,027,174
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 2G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9855.20101122.Lrft6/iPod2,1_4.2.1_8C148_Restore.ipsw iPod2,1_4.2.1_8C148_Restore.ipsw]
|<code>b9efddc7bb4350c237a8d3846af61bbfc8a2f647</code>
|
| {{yes}}
| {{no}}
|363,553,480
|}
1 [[Tethered jailbreak]] only.

===[[N18ap|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| {{yes|Yes1}}

| 311,702,789
|-
| 3.1.1
| [[Northstar 7C146 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| {{yes|Yes1}}
| 311,690,768
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code>
|
| {{yes}}
| 311,740,034
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|SUNorthstarTwo 7E18]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7473.20100202.4i44t/iPod3,1_3.1.3_7E18_Restore.ipsw iPod3,1_3.1.3_7E18_Restore.ipsw]
| <code>375fd469b18bfc0b74c7cfa5b4d5945197b1d106</code>
|
| {{yes}}
| 295,870,806
|-
| 4.0
| [[Apex 8A293 (iPod touch 3G)|Apex 8A293]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7381.20100621.AzSP9/iPod3,1_4.0_8A293_Restore.ipsw iPod3,1_4.0_8A293_Restore.ipsw]
| <code>36fe02b83f87d6305db572e1644841e3cd64cc7d</code>
|
| {{yes}}
| 384,178,784
|-
| 4.0.2
| [[Apex 8A400 (iPod touch 3G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8554.20100811.Bgt54/iPod3,1_4.0.2_8A400_Restore.ipsw iPod3,1_4.0.2_8A400_Restore.ipsw]
| <code>481b21044130125b117d53207f725b70fb061855</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 384,203,993
|-
| 4.1
| [[Baker 8B117 (iPod touch 3G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-7941.20100908.sV9KE/iPod3,1_4.1_8B117_Restore.ipsw iPod3,1_4.1_8B117_Restore.ipsw]
|<code>3162bad4060b7a58c9942ddb483e5bd9bcc5269f</code>
|
| {{yes}}
| 388,255,189
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 3G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9860.20101122.Xsde3/iPod3,1_4.2.1_8C148_Restore.ipsw iPod3,1_4.2.1_8C148_Restore.ipsw]
|<code>1127a042c535f7cf0be950ff8946862d5fb05b36</code>
|
| {{yes|Yes1}}
| 408,118,620
|}

1 [[Tethered jailbreak]] only.

===[[N81ap|iPod touch (4th generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.1
| [[Baker 8B117 (iPod touch 4G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-8490.20100901.hyjtR/iPod4,1_4.1_8B117_Restore.ipsw iPod4,1_4.1_8B117_Restore.ipsw]
| <code>a464492bf6ad25d65b378c85d8b181f973ede38a</code>
| Initial shipment.
| {{yes}}
| 608,360,672
|-
| 4.1
| [[Baker 8B118 (iPod touch 4G)|Baker 8B118]]
| [http://appldnld.apple.com/iPhone4/061-9344.20100922.Urgt43/iPod4,1_4.1_8B118_Restore.ipsw iPod4,1_4.1_8B118_Restore.ipsw]
| <code>331fb1342f5dab8c04cead74384a1e0fc1145952</code>
|
| {{yes}}
| 608,360,927
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 4G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9859.20101122.$erft/iPod4,1_4.2.1_8C148_Restore.ipsw iPod4,1_4.2.1_8C148_Restore.ipsw]
| <code>6a890696126d0cb7f9ccd6b913ecb09cf2029820</code>
|
| {{yes|Yes1 2}}
|638,177,119
|}

1 [[Tethered jailbreak]] only.

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, an untethered solution can be used, called [[Jailbreak Monte]].

==See also==
* [[VFDecrypt]]
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://itunes.com/version Apple Firmware XML]

List of iPhones

2011-01-18T19:02:37Z

XiiiX: /* Differences between iPhone Models */

{{DISPLAYTITLE:iPhone}}
There are many iterations of the iPhone.

== Differences between iPhone Models ==
{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1" cellpadding="5"
! Phone
! [[M68ap|iPhone 2G]]
! [[N82ap|iPhone 3G]]
! [[N88ap|iPhone 3GS]]
! [[N90ap|iPhone 4]]
|-
! Image
| [[Image:iPhone1G.png|200px|frameless]]
| [[Image:iPhone3G.png|200px|frameless]]
| [[Image:IPhone3GS.png|200px|frameless]]
| [[Image:IPhone4.png|200px|frameless]]
|-
! Case Material
| Aluminum
|colspan="2"| Plastic
| Glass/Steel
|-
! Colors
| Aluminum
|colspan="2"| Black/White
| Black
|-
! Dimensions
| 4.5x2.4x0.46 in.
|colspan="2"| 4.5x2.4x0.48 in.
| 4.5x2.31x0.37 in.
|-
! Weight
| 4.8 oz
| 4.7 oz.
| 4.8 oz.
| 4.8 oz.
|-
! Capacity (GB)
| 4/8/16
| 8/16
| 8/16/32
| 16/32
|-
! CPU Speed (MHz)
| 412 (initially 400)
| 412
| 620
| 1024
|-
! RAM (MB)
| 128
| 128
| 256
| 512
|-
! Cellular Radio (<code>telephony-maximum-generation</code>)
| EDGE (2.5G)
| UMTS (3G)
| HSDPA (3.5G)
| HSDPA (3.5G)
|-
! Rated Battery Life (Standby)(hrs.)
| ?
| ?
| 300
| ?
|-
! Rated Battery Life (2G talk)(hrs.)
| ?
| ?
| 12
| ?
|-
! Rated Battery Life (3G talk and data)(hrs.)
| N/A
| ?
| 5
| ?
|-
! Rated Battery Life (Wi-Fi data)(hrs.)
| ?
| ?
| 9
| ?
|-
! Rated Battery Life (Music playback)(hrs.)
| 24
| 24
| 30
| 40
|-
! Rated Battery Life (Video playback)(hrs.)
| 7
| 7
| 10
| 10
|-
! Rated Battery Life (FaceTime)(hrs.)
| N/A
| N/A
| N/A
| ?
|-
! Initial Firmware
|[[Heavenly 1A543a (iPhone)|1.0 (1A543a)]]
|[[Big Bear 5A345 (iPhone 3G)|2.0 (5A345)]]
|[[Kirkwood 7A341 (iPhone 3GS)|3.0 (7A341)]]
|[[Apex 8A293 (iPhone 4)|4.0 (8A293)]]
|-
! Latest (publicly available) firmware
|[[SUNorthstarTwo 7E18 (iPhone)|3.1.3 (7E18)]]
|[[Jasper 8C148 (iPhone 3G)|4.1.2 (8C148)]]
|[[Jasper 8C148 (iPhone 3GS)|4.1.2 (8C148)]]
|[[Jasper 8C148 (iPhone 4)|4.1.2 (8C148)]]
|-
! [[Bluetooth]] (<code>bluetooth</code>)
| [[BlueCore 4|2.0 EDR]]
| [[BlueCore 6|2.1 EDR]]
| [[BCM4325|2.1 EDR]]
| [[BCM4329|2.1 EDR]]
|-
! Camera (MP) (<code>still-camera</code>)
| 2
| 2
| 3.2
| 5
|-
! Video recording (<code>video-camera</code>)
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
|-
! Auto-Focus (<code>auto-focus-camera</code>)
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
|-
! LED Flash
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|-
! Voice Controls (<code>voice-control</code>)
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
|-
! Nike+iPod (<code>victoria</code>)
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
|-
! Hardware encryption (<code>encrypted-data-partition</code>)
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
|-
! GPS (<code>gps</code>)
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
! [[Magnetometer|Digital Compass]] (<code>magnetometer</code>)
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
|-
! Gyroscope
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|-
! Video Calls ([[FaceTime]]) (<code>venice</code>)
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
|}

Jailbreak

2011-01-17T06:08:17Z

XiiiX: /* iPhone 4 */

This is the process by which full execute and write access is obtained on all the partitions of the iPhone. It is done by patching /etc/fstab to mount the System partition as read-write. This is entirely different from an [[unlock]]. Jailbreaking is the first action that must be taken before things like unofficial [[activation]] (hacktivation), and unofficial unlocking can be applied.

The original jailbreak also included modifying the [[AFC|afc]] service (used by [[iTunes]] to access the filesystem) to give full filesystem access from root. This was later updated to create a new service ([[AFC|afc2]]) that allows access to the full filesystem.

Modern jailbreaks also include patching the kernel to get around code signing and other restrictions.

==Exploits which were used in order to jailbreak (in chronological order)==
=== 1.0.2 ===
* [[Restore Mode]] ([[iBoot (Bootloader)|iBoot]] had a command named cp, which had access to the whole filesystem)

=== 1.1.1 ===
* [[Symlinks]] (an upgrade jailbreak)
* [[LibTiff | libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]])
=== 1.1.2 ===
* [[Mknod]] (an upgrade jailbreak)
=== 1.1.3 / 1.1.4 ===
* [[Soft Upgrade]] (an upgrade jailbreak)
* [[Ramdisk Hack]]

==Exploits which are used in order to jailbreak 2.0 and above==

===[[Userland]] (used for all devices)===
*[[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (together for [[Spirit]])
*[[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (together for [[Star]])

===[[M68ap|iPhone]] / [[N82ap|iPhone 3G]] / [[N45ap|iPod touch]]===
* [[Pwnage]] and [[Pwnage 2.0]] (together)

===[[N72ap|iPod touch 2G]]===
* [[ARM7 Go]] (used by [[tethered jailbreak]]s)
* [[0x24000 Segment Overflow]] (used on "MB" models for an [[untethered jailbreak]])
*[[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak|tethered]] for "MC" models)
*[[usb_control_msg(0xA1, 1) Exploit]] (used for a [[tethered jailbreak]] on "MC" models)

===[[N88ap|iPhone 3GS]]===
* [[0x24000 Segment Overflow]] (used on older devices for an [[untethered jailbreak]])
* [[iBoot Environment Variable Overflow]]
* [[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak|tethered]] for newer devices)

===[[N90ap|iPhone 4]]===
* [[limera1n]] (BootRom tethered exploit for iPhone 4, 3GS; iPod Touches 3G and 4G; iPad and AppleTV 2G) + [[Comex]]`s Userland Exploit (Which makes limera1n in 4.1 Firmware untethered)

===[[N18ap|iPod touch 3G]]===
*[[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak|tethered]] only)

Jailbreak

2011-01-17T06:05:36Z

XiiiX: /* Exploits which are used in order to jailbreak 2.0 and above */

This is the process by which full execute and write access is obtained on all the partitions of the iPhone. It is done by patching /etc/fstab to mount the System partition as read-write. This is entirely different from an [[unlock]]. Jailbreaking is the first action that must be taken before things like unofficial [[activation]] (hacktivation), and unofficial unlocking can be applied.

The original jailbreak also included modifying the [[AFC|afc]] service (used by [[iTunes]] to access the filesystem) to give full filesystem access from root. This was later updated to create a new service ([[AFC|afc2]]) that allows access to the full filesystem.

Modern jailbreaks also include patching the kernel to get around code signing and other restrictions.

==Exploits which were used in order to jailbreak (in chronological order)==
=== 1.0.2 ===
* [[Restore Mode]] ([[iBoot (Bootloader)|iBoot]] had a command named cp, which had access to the whole filesystem)

=== 1.1.1 ===
* [[Symlinks]] (an upgrade jailbreak)
* [[LibTiff | libtiff exploit]] (Adapted from the PSP scene, used by [[JailbreakMe]])
=== 1.1.2 ===
* [[Mknod]] (an upgrade jailbreak)
=== 1.1.3 / 1.1.4 ===
* [[Soft Upgrade]] (an upgrade jailbreak)
* [[Ramdisk Hack]]

==Exploits which are used in order to jailbreak 2.0 and above==

===[[Userland]] (used for all devices)===
*[[MobileBackup Copy Exploit]] + [[Incomplete Codesign Exploit]] + [[BPF_STX Kernel Write Exploit]] (together for [[Spirit]])
*[[Malformed CFF Vulnerability]] + [[Incomplete Codesign Exploit]] + [[IOSurface Kernel Exploit]] (together for [[Star]])

===[[M68ap|iPhone]] / [[N82ap|iPhone 3G]] / [[N45ap|iPod touch]]===
* [[Pwnage]] and [[Pwnage 2.0]] (together)

===[[N72ap|iPod touch 2G]]===
* [[ARM7 Go]] (used by [[tethered jailbreak]]s)
* [[0x24000 Segment Overflow]] (used on "MB" models for an [[untethered jailbreak]])
*[[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak|tethered]] for "MC" models)
*[[usb_control_msg(0xA1, 1) Exploit]] (used for a [[tethered jailbreak]] on "MC" models)

===[[N88ap|iPhone 3GS]]===
* [[0x24000 Segment Overflow]] (used on older devices for an [[untethered jailbreak]])
* [[iBoot Environment Variable Overflow]]
* [[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak|tethered]] for newer devices)

===[[N90ap|iPhone 4]]===
* [[limera1n]] (BootRom tethered exploit for iPhone 4, 3GS and 3G; iPod Touches 2G, 3G and 4G) + [[Comex]]`s Userland Exploit (Which makes limera1n in 4.1 Firmware untethered)

===[[N18ap|iPod touch 3G]]===
*[[usb_control_msg(0x21, 2) Exploit]] ([[tethered jailbreak|tethered]] only)