The iPhone Wiki - User contributions [en]

Greenpois0n (jailbreak)

2010-10-26T02:46:33Z

Yelow13:

[[Image:Gp.png|180px|right]]

Greenpois0n is both a cross-platform hacker toolkit (that helps users to find their own exploits for jailbreaks, write custom ramdisks, and create custom firmwares) as well as a [[jailbreak]] tool for iDevices written by [[Chronic Dev (team)]].

== Current Toolset ==

*[http://github.com/chronicdev/cyanide GreenPois0n Cyanide]: [[iBoot]] payload toolkit to help developers discover new vulnerabilities and design super fast, low-level iBoot jailbreaks and exploit payloads, much like the way [[blackra1n]]/[[purplera1n]] works.
*[http://github.com/chronicdev/libdioxin GreenPois0n Dioxin]: MobileDevice toolkit designed to help developers design awesome userland jailbreaks, like how [[Spirit]] works.
*[http://github.com/chronicdev/anthrax GreenPois0n Anthrax]: iPhone ramdisk toolkit to help developers design extremely stable and portable ramdisk jailbreaks, much like the same way [[QuickPwn]]/[[redsn0w]] works.
*[http://github.com/chronicdev/arsenic GreenPois0n Arsenic]: custom firmware toolkit to help developers design jailbreaks to help preserve [[Baseband Firmware|baseband]] and keep unlocks, much in the same way [[PwnageTool]]/[[sn0wbreeze]] works.

== History ==
Greenpois0n was originally written using two exploits: SHAtter (a [[bootrom]] [[exploit]]) as well as a userland [[exploit]] provided by [[User:Comex|Comex]] to make the jailbreak [[untethered jailbreak|untethered]]. A release date of 10/10/10 10:10:10 AM (GMT) was announced, as well as the list of supported devices. Due to the nature of SHAtter, only iDevices using the [[S5L8930|A4 Processor]] were supported.
[[user:geohot|geohot]] later released another jailbreak ([[limera1n]] using a different [[bootrom]] [[exploit]]) on 9 October 2010, which led to a delay in greenpois0n's release (to implement geohot's exploit, not SHAtter).

=== Controversy ===
There was much controversy surrounding the sudden release of [[limera1n]] and the motives behind it. The main reasons for the [[limera1n]] release were:

#Use an exploit that Apple already knew about (newer [[iBoot]]s shows the exploit patched)
#Supports more iDevices than SHAtter
#Hopefully save the SHAtter [[bootrom]] [[exploit]] for future iDevices

The reason for this is [[bootrom]] [[exploit]]s are not patchable with software updates. It requires new hardware to fix the security hole. Since the [[limera1n]] hole was already discovered and patched by Apple, it benefits the community if SHAtter is saved in hopes of using it with new hardware, like the 5th generation iPhone/iPod touch and the iPad 2G.

=== Supported Devices ===
The current version of Greenp0ison (RC4) supports the following iDevices:

{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|iDevice
|{{iOS 3.2.x - iPad only}}
|{{iOS 4.0}}
|{{iOS 4.1}}
|{{iOS 4.2}}
|-
|iPhone 2G
|{{no|iOS not supported}}
|{{no|iOS not supported}}
|{{no|iOS not supported}}
|{{no|iOS not supported}}
|-
|iPhone 3G
|{{no|iOS not supported}}
|{{yes|Yes - Untethered}}
|{{yes|Yes - Untethered}}
|{{no|iOS not supported}}
|-
|iPhone 3Gs new/old bootrom
|{{no|iOS not supported}}
|{{yes|Yes - Untethered}}
|{{yes|Yes - Untethered}}
|{{no|iOS not supported}}
|-
|iPhone 4
|{{no|iOS not supported}}
|{{yes|Yes - Untethered}}
|{{yes|Yes - Untethered}}
|{{no|iOS not supported}}
|-
|iPod touch 1G
|{{no|iOS not supported}}
|{{no|iOS not supported}}
|{{no|iOS not supported}}
|{{no|iOS not supported}}
|-
|iPod touch 2G MB/MC
|{{no|iOS not supported}}
|{{yes|Yes - Untethered}}
|{{yes|Yes - Untethered}}
|{{no|iOS not supported}}
|-
|iPod touch 3G
|{{no|iOS not supported}}
|{{yes|Yes - Untethered}}
|{{yes|Yes - Untethered}}
|{{no|iOS not supported}}
|-
|iPod touch 4G
|{{no|iOS not supported}}
|{{no|iOS not supported}}
|{{yes|Yes - Untethered}}
|{{no|iOS not supported}}
|-
|iPad 1G Wifi/3G
|{{yes|Yes - Untethered}}
|{{no|iOS not supported}}
|{{no|iOS not supported}}
|{{no|iOS not supported}}
|-
|ATV2 (Apple TV 2G)
|{{no|iOS not supported}}
|{{no|iOS not supported}}
|{{yes|Yes - Untethered}}
|{{no|iOS not supported}}
|}

=== Output ===
[[N90ap|iPhone 4]] with [[greenpois0n]] output (via irecovery):

Attempting to initialize greenpois0n
Initializing commands
Searching for cmd_ramdisk
Found cmd_ramdisk string at 0x8401c7ac
Found cmd_ramdisk reference at 0x84000d64
Found cmd_ramdisk function at 0x84000cd1
Initializing patches
Initializing memory
Initializing aes
Searching for aes_crypto_cmd
Found aes_crypto_cmd string at 0x84021a8c
Found aes_crypto_cmd reference at 0x84017bb8
Found aes_crypto_cmd fnction at 0x84017b51
Initializing bdev
Initializing image
Initializing nvram
Initializing kernel
Greenpois0n initialized

==Decompiled Exploit Code==
Apocolipse has provided a decompiled version of the exploit function (note. it is incomplete, x86 decompilers can only do so much)

signed int __cdecl upload_exploit()
{
int v0; // eax@1
signed int v1; // edx@2
int v2; // ebx@2
int v3; // eax@4
char *v4; // eax@5
unsigned int v5; // ebx@8
int v6; // ecx@14
signed int result; // eax@15
signed int v8; // ST38_4@18
int v9; // eax@28
signed int v10; // [sp+38h] [bp-1030h]@4
signed int v11; // [sp+3Ch] [bp-102Ch]@2
char v12; // [sp+4Ch] [bp-101Ch]@3
char v13; // [sp+84Ch] [bp-81Ch]@5
int v14; // [sp+104Ch] [bp-1Ch]@1

v14 = *MK_FP(__GS__, 20);
v0 = *(_DWORD *)(device + 16);
if ( v0 == 8930 )
{
v11 = 174080;
v1 = -2080198655;
v2 = -2080129124;
}
else
{
v1 = -2080231423;
v11 = 141312;
v2 = (((v0 == 8920) - 1) & 0xFFFFFFF4) - 2080161884;
}
memset(&v12, 0, 0x800u);
memcpy(&v12, exploit, 0x230u);
if ( libpois0n_debug )
{
v8 = v1;
((void (__cdecl *)(int, signed int, _DWORD))__fprintf_chk)(stderr, 1, "Resetting device counters\n");
v1 = v8;
}
v10 = v1;
v3 = irecv_reset_counters(client);
if ( v3 )
{
irecv_strerror(v3);
__fprintf_chk(stderr, 1, &aCannotFindS[12]);
result = -1;
}
else
{
memset(&v13, -858993460, 0x800u);
v4 = &v13;
do
{
*(_DWORD *)v4 = 1029;
*((_DWORD *)v4 + 1) = 257;
*((_DWORD *)v4 + 2) = v10;
*((_DWORD *)v4 + 3) = v2;
v4 += 64;
}
while ( (int *)v4 != &v14 );
if ( libpois0n_debug )
((void (__cdecl *)(int, signed int, _DWORD))__fprintf_chk)(stderr, 1, "Sending chunk headers\n");
v5 = 0;
irecv_control_transfer(client, 33, 1, 0, 0, &v13, 2048);
memset(&v13, -858993460, 0x800u);
do
{
v5 += 2048;
irecv_control_transfer(client, 33, 1, 0, 0, &v13, 2048);
}
while ( v5 < v11 );
if ( libpois0n_debug )
((void (__cdecl *)(_DWORD, _DWORD, _DWORD))__fprintf_chk)(stderr, 1, "Sending exploit payload\n");
irecv_control_transfer(client, 33, 1, 0, 0, &v12, 2048);
if ( libpois0n_debug )
((void (__cdecl *)(_DWORD, _DWORD, _DWORD))__fprintf_chk)(stderr, 1, "Sending fake data\n");
memset(&v13, -1145324613, 0x800u);
irecv_control_transfer(client, 161, 1, 0, 0, &v13, 2048);
irecv_control_transfer(client, 33, 1, 0, 0, &v13, 2048);
if ( libpois0n_debug )
((void (__cdecl *)(_DWORD, _DWORD, _DWORD))__fprintf_chk)(stderr, 1, "Executing exploit\n");
irecv_control_transfer(client, 33, 2, 0, 0, &v13, 0);
irecv_reset(client);
irecv_finish_transfer(client);
if ( libpois0n_debug )
{
((void (__cdecl *)(_DWORD, _DWORD, _DWORD))__fprintf_chk)(stderr, 1, "Exploit sent\n");
if ( libpois0n_debug )
((void (__cdecl *)(_DWORD, _DWORD, _DWORD))__fprintf_chk)(stderr, 1, "Reconnecting to device\n");
}
client = (void *)irecv_reconnect(client, 2u);
if ( client )
{
result = 0;
}
else
{
if ( libpois0n_debug )
{
v9 = irecv_strerror(0);
__fprintf_chk(stderr, 1, &aCannotFindS[12], v9);
}
__fprintf_chk(stderr, 1, "Unable to reconnect\n");
result = -1;
}
}
if ( *MK_FP(__GS__, 20) != v14 )
__stack_chk_fail(v6, *MK_FP(__GS__, 20) ^ v14);
return result;
}

List of iPod touches

2010-10-26T01:24:52Z

Yelow13:

{{DISPLAYTITLE:iPod touch}}
There are currently four generations of the iPod touch. A comparison of them is below:

{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
!Feature
![[N45ap|iPod touch 1G]]
![[N72ap|iPod touch 2G]]
![[N18ap|iPod touch 3G]]
![[N81ap|iPod touch 4G]]
|-
|Picture
|[[Image:Oldipt.jpg]]
|[[Image:2gipt.jpg]]
|[[Image:2gipt.jpg]]
|[[Image:iPod touch 4G.jpg]]
|-
|Dimensions (mm)
|110.0 x 61.8 x 8.0
|110.0 x 61.8 x 8.5
|110.0 x 61.8 x 8.6
|111.0 x 58.9 x 7.2
|-
|Dimensions (in.)
|4.3 x 2.4 x 0.31
|4.3 x 2.4 x 0.33
|4.3 x 2.4 x 0.33
|4.4 x 2.3 x 0.28
|-
|Weight
|120g / 4.20 oz
|115g / 4.05 oz
|115g / 4.05 oz
|101g / 3.56 oz
|-
|Capacity (GB)
|8/16/32
|8/16/32
|32/64
|8/32/64
|-
|Processor Speed (MHz)
|400 (iOS 1.1 and 1.1.1)
412 (iOS 1.1.2 and later)
|533
|620
|1000
|-
|RAM (MB)
|128
|128
|256
|256
|-
|Buttons
|sleep, home
|sleep, home, volume up/down
|sleep, home, volume up/down
|sleep, home, volume up/down
|-
|Battery Life (Music, hours)
|22
|36
30 ("MC" model)
|30
|40
|-
|Battery Life (Video, hours)
|5
|6
|6
|7
|-
|Initial Firmware
|1.1 (3A100a)
|2.1.1 (5F138)
3.1.1 (7C145) ("MC" model)
|3.1.1 (7C145)
|4.1 (8B117)
|-
|Built-in speaker
|{{no}}
|{{yes}}
|{{yes}}
|{{yes}}
|-
|Nike+ Support
|{{no}}
|{{yes}}
|{{yes}}
|{{yes}}
|-
|Light Sensor
|{{yes}}
|{{yes}}
|{{yes}}
|{{yes|Replaced by front camera}}
|-
|[[Bluetooth]] 2.1
|{{no}}
|{{yes|Yes (as of iOS 3.0)}}
|{{yes}}
|{{yes}}
|-
|Voice Controls
|{{no}}
|{{no}}
|{{yes}}
|{{yes}}
|-
|Camera
|{{no}}
|{{no}}
|{{no}}
|{{yes| Yes - Front and Back}}
|-
|[[FaceTime]]
|{{no}}
|{{no}}
|{{no}}
|{{yes}}
|-
|Microphone
|{{no}}
|{{partial|Accessory purchase}}
|{{yes|On included headphone cable}}
|{{yes|Integrated}}
|-
|Screen
|{{no|Multi-touch LCD screen}}
|{{no|Multi-touch LCD screen}}
|{{no|Multi-touch LCD screen}}
|{{yes|Multi-touch retina display}}
|-
|iOS 3.X
|{{yes}}
|{{yes}}
|{{yes|3.1.1+}}
|{{no}}
|-
|iOS 4.X
|{{no}}
|{{partial|Yes, with limited features}}
|{{yes}}
|{{yes|4.1+}}
|-

List of iPod touches

2010-10-26T01:13:59Z

Yelow13:

{{DISPLAYTITLE:iPod touch}}
There are currently four generations of the iPod touch. A comparison of them is below:

{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
!Feature
![[N45ap|iPod touch 1G]]
![[N72ap|iPod touch 2G]]
![[N18ap|iPod touch 3G]]
![[N81ap|iPod touch 4G]]
|-
|Picture
|[[Image:Oldipt.jpg]]
|[[Image:2gipt.jpg]]
|[[Image:2gipt.jpg]]
|[[Image:iPod touch 4G.jpg]]
|-
|Dimensions (mm)
|110.0 x 61.8 x 8.0
|110.0 x 61.8 x 8.5
|110.0 x 61.8 x 8.6
|111.0 x 58.9 x 7.2
|-
|Dimensions (in.)
|4.3 x 2.4 x 0.31
|4.3 x 2.4 x 0.33
|4.3 x 2.4 x 0.33
|4.4 x 2.3 x 0.28
|-
|Weight
|120g / 4.20 oz
|115g / 4.05 oz
|115g / 4.05 oz
|101g / 3.56 oz
|-
|Capacity (GB)
|8/16/32
|8/16/32
|32/64
|8/32/64
|-
|Processor Speed (MHz)
|400 (iOS 1.1 and 1.1.1)
412 (iOS 1.1.2 and later)
|533
|620
|1000
|-
|RAM (MB)
|128
|128
|256
|256
|-
|Buttons
|sleep, home
|sleep, home, volume up/down
|sleep, home, volume up/down
|sleep, home, volume up/down
|-
|Battery Life (Music, hours)
|22
|36
30 ("MC" model)
|30
|40
|-
|Battery Life (Video, hours)
|5
|6
|6
|7
|-
|Initial Firmware
|1.1 (3A100a)
|2.1.1 (5F138)
3.1.1 (7C145) ("MC" model)
|3.1.1 (7C145)
|4.1 (8B117)
|-
|Built-in speaker
|{{no}}
|{{yes}}
|{{yes}}
|{{yes}}
|-
|Nike+ Support
|{{no}}
|{{yes}}
|{{yes}}
|{{yes}}
|-
|Light Sensor
|{{yes}}
|{{yes}}
|{{yes}}
|{{yes|Replaced by front camera}}
|-
|[[Bluetooth]] 2.1
|{{no}}
|{{yes|Yes (as of iOS 3.0)}}
|{{yes}}
|{{yes}}
|-
|Voice Controls
|{{no}}
|{{no}}
|{{yes}}
|{{yes}}
|-
|Camera
|{{no}}
|{{no}}
|{{no}}
|{{yes| Yes - Front and Back}}
|-
|[[FaceTime]]
|{{no}}
|{{no}}
|{{no}}
|{{yes}}
|-
|Microphone
|{{no}}
|{{partial|Accessory purchase}}
|{{yes|On included headphone cable}}
|{{yes|Integrated}}
|-
|iOS 3.X
|{{yes}}
|{{yes}}
|{{yes|3.1.1+}}
|{{no}}
|-
|iOS 4.X
|{{no}}
|{{partial|Yes, with limited features}}
|{{yes}}
|{{yes|4.1+}}
|-

List of iPod touches

2010-10-26T01:11:44Z

Yelow13:

{{DISPLAYTITLE:iPod touch}}
There are currently four generations of the iPod touch. A comparison of them is below:

{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
!Feature
![[N45ap|iPod touch 1G]]
![[N72ap|iPod touch 2G]]
![[N18ap|iPod touch 3G]]
![[N81ap|iPod touch 4G]]
|-
|Picture
|[[Image:Oldipt.jpg]]
|[[Image:2gipt.jpg]]
|[[Image:2gipt.jpg]]
|[[Image:iPod touch 4G.jpg]]
|-
|Dimensions (mm)
|110.0 x 61.8 x 8.0
|110.0 x 61.8 x 8.5
|110.0 x 61.8 x 8.6
|111.0 x 58.9 x 7.2
|-
|Dimensions (in.)
|4.3 x 2.4 x 0.31
|4.3 x 2.4 x 0.33
|4.3 x 2.4 x 0.33
|4.4 x 2.3 x 0.28
|-
|Weight
|120g / 4.20 oz
|115g / 4.05 oz
|115g / 4.05 oz
|101g / 3.56 oz
|-
|Capacity (GB)
|8/16/32
|8/16/32
|32/64
|8/32/64
|-
|Processor Speed (MHz)
|400 (iOS 1.1 and 1.1.1)
412 (iOS 1.1.2 and later)
|533
|620
|1000
|-
|RAM (MB)
|128
|128
|256
|256
|-
|Buttons
|sleep, home
|sleep, home, volume up/down
|sleep, home, volume up/down
|sleep, home, volume up/down
|-
|Battery Life (Music, hours)
|22
|36
30 ("MC" model)
|30
|40
|-
|Battery Life (Video, hours)
|5
|6
|6
|7
|-
|Initial Firmware
|1.1 (3A100a)
|2.1.1 (5F138)
3.1.1 (7C145) ("MC" model)
|3.1.1 (7C145)
|4.1 (8B117)
|-
|Built-in speaker
|{{no}}
|{{yes}}
|{{yes}}
|{{yes}}
|-
|Nike+ Support
|{{no}}
|{{yes}}
|{{yes}}
|{{yes}}
|-
|[[Bluetooth]] 2.1
|{{no}}
|{{yes|Yes (as of iOS 3.0)}}
|{{yes}}
|{{yes}}
|-
|Voice Controls
|{{no}}
|{{no}}
|{{yes}}
|{{yes}}
|-
|Camera
|{{no}}
|{{no}}
|{{no}}
|{{yes| Yes - Front and Back}}
|-
|[[FaceTime]]
|{{no}}
|{{no}}
|{{no}}
|{{yes}}
|-
|Microphone
|{{no}}
|{{partial|Accessory purchase}}
|{{yes|On included headphone cable}}
|{{yes|Integrated}}
|-
|iOS 3.X
|{{yes}}
|{{yes}}
|{{yes|3.1.1+}}
|{{no}}
|-
|iOS 4.X
|{{no}}
|{{partial|Yes, with limited features}}
|{{yes}}
|{{yes|4.1+}}
|-

List of iPod touches

2010-10-26T00:14:49Z

Yelow13:

{{DISPLAYTITLE:iPod touch}}
There are currently four generations of iPod Touch. A comparison of them is below:

{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
!Feature
![[N45ap|iPod touch 1G]]
![[N72ap|iPod touch 2G]]
![[N18ap|iPod touch 3G]]
![[N81ap|iPod touch 4G]]
|-
|Picture
|[[Image:Oldipt.jpg]]
|[[Image:2gipt.jpg]]
|[[Image:2gipt.jpg]]
|[[Image:iPod touch 4G.jpg]]
|-
|Dimensions (mm)
|110.0 x 61.8 x 8.0
|110.0 x 61.8 x 8.5
|110.0 x 61.8 x 8.6
|111.0 x 58.9 x 7.2
|-
|Dimensions (in.)
|4.3 x 2.4 x 0.31
|4.3 x 2.4 x 0.33
|4.3 x 2.4 x 0.33
|4.4 x 2.3 x 0.28
|-
|Weight
|120g / 4.20 oz
|115g / 4.05 oz
|115g / 4.05 oz
|101g / 3.56 oz
|-
|Capacity (GB)
|8/16/32
|8/16/32
|32/64
|8/32/64
|-
|Processor Speed (MHz)
|412
|533
|620
|1000
|-
|RAM (MB)
|128
|128
|256
|256
|-
|Buttons
|sleep, home
|sleep, home, volume up/down
|sleep, home, volume up/down
|sleep, home, volume up/down
|-
|Battery Life (Music, hours)
|22
|36
30 ("MC" model)
|30
|40
|-
|Battery Life (Video, hours)
|5
|6
|6
|7
|-
|Initial Firmware
|1.1 (3A100a)
|2.1.1 (5F138)
3.1.1 (7C145) ("MC" model)
|3.1.1 (7C145)
|4.1 (8B117)
|-
|Built-in speaker
|{{no}}
|{{yes}}
|{{yes}}
|{{yes}}
|-
|Nike+ Support
|{{no}}
|{{yes}}
|{{yes}}
|{{yes}}
|-
|Bluetooth 2.1
|{{no}}
|{{yes|Yes (as of iOS 3.0)}}
|{{yes}}
|{{yes}}
|-
|Voice Controls
|{{no}}
|{{no}}
|{{yes}}
|{{yes}}
|-
|Camera
|{{no}}
|{{no}}
|{{no}}
|{{yes}}
|-
|Facetime
|{{no}}
|{{no}}
|{{no}}
|{{yes}}
|-
|Microphone
|{{no}}
|{{yes | Yes (purchasable accessory)}}
|{{yes | Yes (accessory comes with device)}}
|{{yes | Yes (built-in)}}
|}

DFU Mode

2010-10-25T23:59:18Z

Yelow13:

'''DFU''' or '''Device Firmware Upgrade''' mode allows the [[S5L8900]], [[S5L8720]] and [[S5L8920]] to be restored from any state. It resides in the [[VROM]] and the [[S5L8900]] variant is vulnerable to the [[Pwnage 2.0]] exploit.

==Entering / Exiting DFU==
Software cannot be used to reliably enter DFU. Software methods rely on sending a signed WTF file which either calls the "real" DFU mode in bootrom or emulates it. Only ones calling the bootrom DFU is useful for exploiting bootrom (unpatchable) exploits and none exist that work for firmware 2.0 and later. If you are attempting to exploit the DFU, it is advisable to always use the hardware method. If your NOR firmware is corrupted then you have no other choice but to use the hardware method.

===How to Enter True Hardware DFU===
# Plug your device into your computer.
# Turn off the device.
# Hold Power and Home for 10 seconds
# Release Power, and keep holding Home
# Keep holding home for 4-8 seconds or until you are alerted by your computer that it has detected a device in DFU.

If the Restore Logo is present on the screen, you are in ''[[Recovery Mode]]'', '''not''' ''DFU''.

===How to Enter DFU mode on [[K66ap|Apple TV (2G)]]===
# Plug the device into your computer using a microUSB cable.
# Force the device to reboot by holding down the "Menu" and "Down" buttons simultaneously for 6-7 seconds.
# Press "Menu" and "Play" simultaneously right after reboot, until a message pops up in [[iTunes]], saying that it has detected an [[K66ap|Apple TV]] in recovery mode.

===Exiting DFU===
Option 1: While in DFU, hold the power and home buttons for 30-60 seconds. When I have tested it, it has varied, so I don't know an exact length of time to hold it. Note that sometimes if you do this, when the device reboots from DFU, it will go into recovery mode for unknown reasons.

Option 2: While in DFU, hold the power and home buttons for 10 seconds. Then,let go of the home button and continue to hold the power button until the apple logo appears. (This is similar to entering DFU mode, except that the power/lock button is kept pressed instead of the home button). Since nothing will appear on the screen until you are out of DFU mode, you may need to try it a few times if it does not work.

Note: I have not seen this (second) method posted online anywhere, and cannot confirm it, except that I have tested it multiple times on an iPod touch 2G MC-model 8GB.

==Revisions==
===[[S5L8900]] (0x1222)===
This is the device ID in the [[N45ap|iPod Touch 1G]], the [[M68ap|iPhone]], and the [[N82ap|iPhone 3G]]. For more information about the protocol, see [[DFU 0x1222]].

===[[S5L8720 Bootrom|S5L8720]], [[S5L8920]], and [[WTF|WTF mode post-2.0]] (0x1227)===
This is the device ID in the [[N72ap|iPod Touch 2G]], the [[N88ap|iPhone 3GS]], and [[WTF|WTF mode]]. For more information on the protocol, see [[DFU 0x1227]].

[[Category:VROM]]