The iPhone Wiki - User contributions [en]

Evasi0n

2013-02-06T15:18:39Z

Zmaster: /* Supported Devices */

{{lowercase}}
{{float toc|right}}
'''evasi0n''' is a [[jailbreak]] tool that can be used to [[jailbreak]] ([[untethered jailbreak|untethered]]) [[iOS]] 6.0-6.1 on all [[#Supported Devices|supported devices]], excluding the [[j33ap|Apple TV 3G]]. It was releasd on 4 Feburary 2013 by its developers, [[evad3rs]], and supports Windows, OS X, and Linux (x86 and x86_64).

== Supported Devices ==
As of evasi0n's release, the only unsupported device is the [[Apple TV 3G]], since there is still missing a injector vector to run unsigned code. All other devices on iOS 6.0-6.1 are supported (as well as iOS 5.2 for the [[k66ap|Apple TV 2G]]).

== Version History ==
=== 1.0 ===
Version 1.0 was released on 4 February 2013. This version contains a bug that causes the [[:/Applications/Weather.app|Weather]] app to not work. The [[Notification Center]] widget is unaffected.
==== Changelog ====
* Initial release

== Download ==
{| class="wikitable" style="text-align:center;"
! Version
! Release Date
! OS
! SHA-1 Hash
! colspan="4" | Download
|-
| rowspan="3" | 1.0
| rowspan="3" | 04 Feb 2013
| Linux
| <code>c9e4b15a161b89f0e412721f471c5f8559b6054f</code>
| [https://sites.google.com/site/evad3rs/evasi0n-linux-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.tar.lzma Google Sites]
| [https://evad3rs.box.com/shared/static/5dped2c9ejnk5r6ahfpg.lzma Box]
| [https://mega.co.nz/#!0kUkXBLC!Q8e53kQZpLbGL7PquHWgQFhMU9Ru3WJWxBuzEdkiMJo Mega]
| [http://rapidshare.com/files/2561828874/evasi0n-linux-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.tar.lzma RapidShare]
|-
| OS X
| <code>23f99a0d65e71fd79ff072b227f0ecb176f0ffa8</code>
| [https://sites.google.com/site/evad3rs/evasi0n-mac-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.dmg Google Sites]
| [https://evad3rs.box.com/shared/static/du66n0g9wl1j4ta57hpx.dmg Box]
| [https://mega.co.nz/#!5h0BwQoa!KdRLFwNJ3OjMS-7Zs2YGQnsvPxAKEsaAjabY__8pNtY Mega]
| [http://rapidshare.com/files/3010870584/evasi0n-mac-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.dmg RapidShare]
|-
| Windows
| <code>2ff288e1798b4711020e9dd7f26480e57704d8b2</code>
| [https://sites.google.com/site/evad3rs/evasi0n-win-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.zip Google Sites]
| [https://evad3rs.box.com/shared/static/tg1t0cz7oakvq7hsv0bd.zip Box]
| [https://mega.co.nz/#!d9ciUApQ!AkwevVU1OtUrEUU7U4fE-V8qqM9aINTAGgjkukShihE Mega]
| [http://rapidshare.com/files/3503186483/evasi0n-win-1.0-3c53ba10e2448d311b0f4157f2d7eb568f106c4f-release.zip RapidShare]
|}

== Exploits ==
The program takes advantage of at least five distinct new vulnerabilities:
* Use of symbolic links in time zone file to socket
* [http://en.wikipedia.org/wiki/Shebang_(Unix) Unix "shebang" trick]
* Change of launchd.conf for untethering
* AMFID code-signing kernel changes
* ASLR circumvention by using ARM exception vectors

== External Links ==
* [http://www.evasi0n.com/ Official Website]
* [http://blog.accuvantlabs.com/blog/bthomas/evasi0n-jailbreaks-userland-component Accuvant Labs analysis]
* [http://www.forbes.com/sites/andygreenberg/2013/02/05/inside-evasi0n-the-most-elaborate-jailbreak-to-ever-hack-your-iphone/ Forbes news with an explanation by planetbeing]

{{stub|jailbreaking}}
[[Category:Jailbreaks]]

/private/etc/fstab

2013-01-07T20:31:34Z

Zmaster:

fstab controls the read/write access of the root and media partitions. A barebones jailbreak can be put in place simply by modifying this file to grant full read/write access to the user.

== File Contents ==
Note the empty line. This is required for the file to be parsed correctly.
=== Before [[jailbreak]] ===
[[/dev/disk0s1s1]] / hfs ro 0 1
[[/dev/disk0s1s2]] /private/var hfs rw 0 2

=== After jailbreak ===
/dev/disk0s1s1 / hfs rw 0 1
/dev/disk0s1s2 /private/var hfs rw 0 2

== Parents ==
{{parent|private|etc}}

[[Category:Filesystem]]
[[Category:Ramdisk Patches]]

Signature Check Patch

2013-01-07T20:24:04Z

Zmaster:

For a [[bootrom]] based [[jailbreak]] to work, you need to patch the signature checking. After patching the NOR images, the authenticity of the files being loaded is not verified

== External Links ==
* YouTube video [http://www.youtube.com/watch?v=9lLBfArLzuo detailing how to make the patch]

{{stub|jailbreak}}
[[Category:NOR Patches]]

Signature Check Patch

2013-01-07T17:38:25Z

Zmaster: more infos coming just need to get home :P

{{DISPLAYTITLE:Signature Patch}}
*Kernel boot
*img3 tags check
*Custom ramdisk

Disabling signature check is a must on a [[bootrom]] based [[Jailbreak]]. Patching that, the NOR images do not verify the authenticity of the files beeing booted.

Video showing how to make this patch: http://www.youtube.com/watch?v=9lLBfArLzuo&feature=youtu.be

[[Category:NOR Patches]]

Signature Check Patch

2013-01-07T17:37:32Z

Zmaster:

{{DISPLAYTITLE:Signature Patch}}

*kernel boot
*img3 tags check
*custom ramdisk

Disabling signature check is a must on a [[bootrom]] based [[Jailbreak]]. Patching that, the NOR images do not verify the authenticity of the files beeing booted.

Video showing how to make this patch: http://www.youtube.com/watch?v=9lLBfArLzuo&feature=youtu.be

[[Category:NOR Patches]]

Signature Check Patch

2013-01-07T17:31:53Z

Zmaster: Created page with "{{DISPLAYTITLE:Signature Patch}} *kernel boot *img3 tags check *custom ramdisk Patch signature check is a must on a bootrom based Jailbreak. This allow you too boot..."

{{DISPLAYTITLE:Signature Patch}}

*kernel boot
*img3 tags check
*custom ramdisk

Patch signature check is a must on a [[bootrom]] based [[Jailbreak]]. This allow you too boot custom ramdisks and execute anything you want on the target device.

Video showing how to make this patch: http://www.youtube.com/watch?v=9lLBfArLzuo&feature=youtu.be

[[Category:NOR Patches]]

Category:NOR Patches

2013-01-07T17:26:16Z

Zmaster: Created page with "These patches are performed on the NOR images(LLB/iBoot/iBEC/iBSS) Category:Patches"

These patches are performed on the NOR images([[LLB]]/[[iBoot]]/[[iBEC]]/[[iBSS]])

[[Category:Patches]]

Greenpois0n (toolkit)

2013-01-05T21:32:49Z

Zmaster:

{{lowercase}}
[[Image:gp.png|200px|right|greenpois0n]]
{{other|toolkit|jailbreak|greenpois0n (jailbreak)}}
*[http://github.com/Chronic-Dev/syringe GreenPois0n Syringe]: Greenpois0n's exploit injector, to assist in booting devices into jailbroken states.
*[http://github.com/Chronic-Dev/cyanide GreenPois0n Cyanide]: [[iBoot]] payload toolkit to help developers discover new vulnerabilities and design super fast, low-level iBoot jailbreaks and exploit payloads, much like the way [[blackra1n]]/[[purplera1n]] works.
*[http://github.com/Chronic-Dev/libdioxin GreenPois0n Dioxin]: MobileDevice toolkit designed to help developers design awesome userland jailbreaks, like how [[Spirit]] works.
*[http://github.com/Chronic-Dev/anthrax GreenPois0n Anthrax]: iPhone ramdisk toolkit to help developers design extremely stable and portable ramdisk jailbreaks, much like the same way [[QuickPwn]]/[[redsn0w]] works.

Source Code: [https://github.com/Chronic-Dev Greenpois0n]

[[Category:greenpois0n|toolkit]]

User:Zmaster

2013-01-05T21:30:34Z

Zmaster: Created page with "'''Twitter:''' [http://www.twitter.com/themrzmaster @themrzmaster] '''Website:''' [http://www.iParelhos.com iParelhos.com]"

'''Twitter:''' [http://www.twitter.com/themrzmaster @themrzmaster]
'''Website:''' [http://www.iParelhos.com iParelhos.com]

Talk:IFaith

2013-01-05T21:15:03Z

Zmaster: /* SHSH Dumping */

Wiki seems to be down again. I cannot add a link to the source code. I opened a ticket with hostmonster: Support Ticket SVA-11613-583
If anyone else wants to try, add this to references:
* [https://github.com/iH8sn0w/iFaith Sourcecode on github]
--[[User:Http|http]] 00:56, 28 July 2011 (MDT)
: hi, http. it's funny... i went down the same path as you. i tried to add the same link to this page and then opened a a ticket with hostmonster (GYT-78304-604). this was before i saw this talk page. anyway, hostmonster support got back to me. they said "mod_security has been temporarily disabled for theiphonewiki.org until our system administrators can address the false-positive. We will contact you with any further updates."
: cheers,
: [[User:Beej|beej]] 08:37, 29 July 2011 (MDT)
::Yes, I saw that it's fixed since today. In the meantime they wrote me back that one of their request numbers was missing in my ticket. Anyway, hopefully it remains fixed. --[[User:Http|http]] 14:30, 29 July 2011 (MDT)

== 1.2.2 ==
So is there a 1.2.2 or not? If iH8sn0w made the program, he would know, so maybe 1.2.2 was a branch made by somebody else? --[[User:5urd|5urd]] 11:55, 10 August 2011 (MDT)

== SHSH Dumping ==
Can anyone explain whether this can in fact dump SHSH *from* a device, even if the firmware is no longer being signed, and if so, how? --[[User:Srb21103|Srb21103]] ([[User talk:Srb21103|talk]]) 03:27, 4 January 2013 (UTC)
:Yes, it reads the signatures from the device directly. You can't convert these signatures back to SHSH signatures, but you can use them to reinstall the firmware on the same device without having to contact Apple server again. --[[User:Http|http]] ([[User talk:Http|talk]]) 07:43, 4 January 2013 (UTC)
:If you want to know how exactly, it utilizes [[MobileDevice Library]] (iTunesMobileDevice.dll) to communicate with the device. If you want to know more, you can examine the source of 1.2 (C#). If you don't understand some portions, you can contact me. --[[User:5urd|5urd]] ([[User talk:5urd|talk]]) 21:20, 4 January 2013 (UTC)
:The code that run on the device is on the payload sent by iFaith UI. The payload dump APTicket and get another hashes from the firmware files. This hashes are used to 'modify' the new iOS, checking it with the current firmware and allowing the new image to pass. --[[User:Zmaster|Zmaster]] ([[User talk:Zmaster|talk]]) 21:15, 5 January 2013 (UTC)

User talk:Dialexio

2012-01-04T22:57:18Z

Zmaster: /* GenPass */

{{float toc}}
'''If you have questions/concerns about an edit I made to an article, please use the talk page for the article in question.'''

==Baseband Help==
hey i need help {{unsigned|Leobruh|03:35, March 29, 2010 (UTC)}}
:with...? {{unsigned|Gojohnnyboi|04:00, March 29, 2010 (UTC)}}
::im trying to learn how to find baseband exploits but i need some PC friendly tools to find those baseband exploits [[User:Leobruh|Leobruh]]!
:::I can't help you there, sorry. --[[User:Dialexio|Dialexio]] 15:06, 24 June 2010 (UTC)

==Rant deletion==
alright i agree with what u did. [[User:Leobruh|Leobruh]] 04:39, 3 July 2010 (UTC)!

==Thanks==
Thanks for curating this wiki by wikifying paragraphs and adding tons of relevant, accurate, and grammatically correct info. :) [[User:Iemit737|Iemit737]] 01:00, 14 July 2010 (UTC)
:Thanks! You've done a pretty amazing job also. :D --[[User:Dialexio|Dialexio]] 02:50, 14 July 2010 (UTC)

==Presentation links==
Thanks for adding those HQ torrent links, probably better than my FLV anyway ;) [[User:MaybachMan|MaybachMan]] 22:06, 14 July 2010 (UTC)

... And once again for the Bluetooth additions. I'll shut up now ;) [[User:MaybachMan|MaybachMan]] 22:14, 14 July 2010 (UTC)

==Beta Firmwares==
should we start a beta firmwares page that contains a table with release dates, baseband versions, and iboot versions but without links? It might be interesting for reference purposes, and a good way to link to the decryption keys. [[User:Iemit737|Iemit737]] 03:53, 20 July 2010 (UTC)
:I suppose this could be done (at [[Firmware/Beta]]?). I don't think hashes should be provided, though. A hash will probably only serve to help idiots pirate, verify, and install a beta firmware. --[[User:Dialexio|Dialexio]] 04:57, 20 July 2010 (UTC)

==Sysop Status==
You are now a sysop. --[[User:Geohot|geohot]] 15:32, 21 July 2010 (UTC)
:Thanks geohot! I'll be sure to do the best I can. --[[User:Dialexio|Dialexio]] 21:48, 21 July 2010 (UTC)

==Q==
idc if the link is there or not
u can C&P my paragraph to keep people informed [[User:Leobruh|Leobruh]] 05:37, 25 August 2010 (UTC)!
:What do you mean with Q, idc, C&P? Ah, and yes, I agree that he deleted the advertisement page you made. It doesn't really belong into this wiki and the page had no content except the link to your blog. -- [[User:Http|http]] 10:34, 25 August 2010 (UTC)
::C&P is copy and paste :P if i just copy my post will that be okay? [[User:Leobruh|Leobruh]] 17:10, 25 August 2010 (UTC)!
::: I feel that there isn't much (if anything) to be concerned about, so I don't believe the article is needed. Those are just my thoughts, though. --[[User:Dialexio|Dialexio]] 15:24, 26 August 2010 (UTC)

== likes ==
i like you --[[User:Ifish|Ifish]] 03:39, 31 August 2010 (UTC)ifish

== :) ==
You're awesome! --[[User:desertsn0w|desertsn0w]] 17:57, 5 September 2010 (UTC)

== Twitter ==
Hey since weve had problems here, I sent you a Twitter request because we sortove know eachother. :D [[User:Balloonhead66|Balloonhead66]] 00:22, 7 October 2010 (UTC)

== Birthday ==

happy birthday [[User:Balloonhead66|Balloonhead66]] 22:48, 7 October 2010 (UTC)
:Thanks! ^_^ --[[User:Dialexio|Dialexio]] 23:42, 7 October 2010 (UTC)

Happy Birthday Buddy! <3 --[[User:Ifish|Ifish]] 18:20, 9 October 2010 (UTC)ifish

== Signing posts ==
Sorry if you get upse while seeing unsigned posts. I try my best -- Balloonhead66| 23:58, October 8, 2010 (UTC)
:I am not amused. :P --[[User:Dialexio|Dialexio]] 00:02, 9 October 2010 (UTC)
::OK, I did that on accident, but when you are also updating a page with a lot of posting like [[Talk:Limera1n|Limera1n Talk]] It is hard because 1 second could be the differance between yours getting accepted and another person beating you to the save button, sorry :( [[User:Balloonhead66|Balloonhead66]] 00:04, 9 October 2010 (UTC)

==PNG to IMG3==
Hey, Why did you remove my project PNG TO IMG3 Thanks --[[User:Seifhatem|Seifhatem]] 20:20, 10 February 2011 (UTC)
:There was no link to the program, and we've had some problems in the past when it came to program pages on The iPhone Wiki. If you feel your program is notable enough to be on the wiki, drop a note in the [[The iPhone Wiki:Community Portal|community portal]], and then any active community members will decide. --[[User:Dialexio|Dialexio]] 21:44, 10 February 2011 (UTC)
:I don't get why it is in the [[VFDecrypt]] section if it deals with PNG's and IMG3's as [[VFDecrypt]] only deals with FileVault encrypted files... --[[User:Balloonhead66|Balloonhead66]] 22:37, 10 February 2011 (UTC)
:Please see also the [[:Category:GUI Tools|new rules]] for such tools in this wiki. --[[User:Http|http]] 00:39, 11 February 2011 (UTC)
::there was a 4shared link for the program and i wrote credits for img3decrypt someone changed it to vfdecrypt i didn't announce before i release it.--[[User:Seifhatem|Seifhatem]] 13:12, 11 February 2011 (UTC)
:I apologize for hastily calling the program vaporware. The download link wasn't made available on the page, just the VFDecrypt page (on which it didn't quite belong, as Balloonhead66 mentioned). --[[User:Dialexio|Dialexio]] 15:22, 11 February 2011 (UTC)
::[http://theiphonewiki.com/wiki/index.php?title=VFDecrypt&diff=prev&oldid=15965 this edit] to [[VFDecrypt]] says that is is coded on VFDevcrypt, '''NOT''' img3decrypt {{unsigned|Balloonhead66|20:11, February 11, 2011 (UTC)}}
:::The PNG to IMG3 page stated it was based on img3decrypt. --[[User:Dialexio|Dialexio]] 20:34, 11 February 2011 (UTC)
::::I get that, but the edit said VFDecrypt, so it is confusing. --[[User:Balloonhead66|Balloonhead66]] 20:37, 11 February 2011 (UTC)

== Messed up emails ==
Why did you hide you email in some stuff. Is it to prevent spam? --[[User:Balloonhead66|Balloonhead66]] 17:18, 12 July 2011 (UTC)
:Yup. Spam bots will have a lot of fun trying to read the source code. ;) --[[User:Dialexio|Dialexio]] 17:19, 12 July 2011 (UTC)
::Makes sense. --[[User:Balloonhead66|Balloonhead66]] 17:21, 12 July 2011 (UTC)
:::Advanced spam bots just filter that stuff away, and even better ones also the visible:none parts, so you're not totally safe. Just as a warning. -- [[User:Http|http]] 19:24, 12 July 2011 (UTC)
::::I never expected it to be fool-proof. :P Oh well. --[[User:Dialexio|Dialexio]] 20:02, 12 July 2011 (UTC)

== Password ==
For the only user I created so far I have set a temp password, but he already changed it before I gave it to him, so I think we don't need to request a temp password, just set something. -- [[User:Http|http]] 19:24, 12 July 2011 (UTC)
:Got it. --[[User:Dialexio|Dialexio]] 20:02, 12 July 2011 (UTC)

== GenPass ==
You said to try it out yourself, but I don't have GenPass compiled and MinGW or Visual Studio won't compile it for me. Do you have a copy? --[[User:Balloonhead66|Balloonhead66]] 18:54, 16 December 2011 (MST)
:Nope. It should compile fine in a Linux VM, though. But take my word for it, the "x" is needed to get the correct VFDecrypt key. --[[User:Dialexio|Dialexio]] 19:26, 16 December 2011 (MST)

User talk:Dialexio

2012-01-04T22:53:32Z

Zmaster: /* WTF? */

User talk:Dialexio

2012-01-04T22:52:57Z

Zmaster: /* WTF? */ new section

Talk:Bootrom Dumper Utility

2012-01-02T23:55:20Z

Zmaster: /* A5 devices */

If anyone gets it working for [[n72ap|iPod touch 2G]], let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current [[n72ap|iPod touch 2G]] [[OpeniBoot]] [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy [[steaks4uce]] version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 03:38, 29 December 2010 (UTC)
:::i use ''sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc'' --[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
::::Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 22:45, 29 December 2010 (UTC)
::hey liam when I try running this on linux i get 84 00 00 00 05 00 00 00 80 00 00 00 80 62 02 22 FF FF FF FF 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 01 38 02 22 90 D7 02 22 and then the rest of it gets filled with nulls until the next 0x800 bytes start :( [[User:Revolution|Revolution]] 19:02, 19 February 2011 (UTC)
:::use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)
:::run:
::::''<code>sudo apt-get install libusb-1.0-0 libusb-1.0-0-dev libreadline6-dev readline-common libreadline6 libreadline-dev texinfo cmake git-core build-essential texinfo libreadline-dev libssl-dev libusb-1.0-0-dev libpng12-dev libusb-dev autoconf automake libnewlib-dev</code>'' [[Image:Return.png|15px]] Return
::::''<code>sudo build-toolchain.sh</code>'' [[Image:Return.png|15px]] Return
:::for linux
:::--[[User:Liamchat|liamchat]] 01:35, 20 February 2011 (UTC)
::::um liam I did that... on line 145 you need to make that specified for macosx only, well at least that's what the pod2g's version did... try building it on linux. [[User:Revolution|Revolution]] 16:51, 20 February 2011 (UTC)
::::i fixed the error there does not need to be any specific platform support for [[usb control msg(0xA1, 1) Exploit|stake]] or [[pwnage2]] i think there is better way using [http://www.beyondlogic.org/usbnutshell/usb5.shtml|USB Descriptors] --[[User:Liamchat|liamchat]] 00:02, 21 February 2011 (UTC)
::::: I just tried your new version. It still doesn't work. i managed to dump the bootrom with openiboot but yeah. here is the dump your ipod produces. it contains no copy writed code so i'll paste it here. [http://www.mediafire.com/?um4gz4ga00v067a] [[User:Revolution|Revolution]] 21:11, 24 February 2011 (UTC)
:::::: None of his things will work, I can promise you that. He doensn't know what he is doing. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 00:22, 25 February 2011 (UTC)
:::::::i have edited it again however i cant the usb wait for image call offset i origany thought it was the [https://github.com/Chronic-Dev/syringe/blob/master/syringe/exploits/steaks4uce/steaks4uce.S#L30 usb wait for image offset] from syringe. --[[User:Liamchat|liamchat]] 20:41, 7 March 2011 (UTC)
== VMware + Windows ==
anyone tried this on vmware + windows? can't make it work. tried on [[n90ap|iPhone 4]] & [[n18ap|iPod touch 3G]] -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the [[limera1n]] exploit. it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

== A5 devices ==
Can we use this tool to dump A5 devices? --[[User:XiiiX|XiiiX]] 12:28, 2 January 2012 (MST)
:Not until there is a jailbreak for A5 devices.--[[User:M2m|M2m]] 12:51, 2 January 2012 (MST)
:No. Limera1n doesn't work on A5 devices. --[[User:Http|http]] 13:04, 2 January 2012 (MST)
::It's kind of non-sense this tool so. To dump already hacked bootroms? --[[User:XiiiX|XiiiX]] 14:21, 2 January 2012 (MST)
:::No. Not really. You may find an exploit outside the bootrom which leads to a jailbreak which you can use to dump the bootrom which can help you to find exploits in the bootrom for later jailbreaks. Jailbreaks based on bootrom exploits can only be fixed with new hardware.--[[User:M2m|M2m]] 15:28, 2 January 2012 (MST)
:::There is no such thing as an "hacked BootROM". We cannot change the contents of the BootROM. Note "ROM" - Read Only Memory. -SquiffyPwn 17:10, 2 January 2012 (CST)
::::That's a better explanation. So we don't need a bootrom jailbreak to use this, just a user-land could work? Why is the necessity of a jailbreak to dump te bootrom? We need the offsets? --[[User:XiiiX|XiiiX]] 16:09, 2 January 2012 (MST)
Do you know what is dump? dump is a copy, to use this tool you MUST have a BootROM Exploit, look the source code, it send the exploit to allow acess to the read-only BootROM memory. Userland exploit here? what offsets?~zmaster

Talk:Bootrom Dumper Utility

2012-01-02T23:54:34Z

Zmaster: /* A5 devices */

Talk:Bootrom Dumper Utility

2012-01-02T23:51:18Z

Zmaster: /* A5 devices */

If anyone gets it working for [[n72ap|iPod touch 2G]], let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current [[n72ap|iPod touch 2G]] [[OpeniBoot]] [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy [[steaks4uce]] version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 03:38, 29 December 2010 (UTC)
:::i use ''sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc'' --[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
::::Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 22:45, 29 December 2010 (UTC)
::hey liam when I try running this on linux i get 84 00 00 00 05 00 00 00 80 00 00 00 80 62 02 22 FF FF FF FF 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 01 38 02 22 90 D7 02 22 and then the rest of it gets filled with nulls until the next 0x800 bytes start :( [[User:Revolution|Revolution]] 19:02, 19 February 2011 (UTC)
:::use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)
:::run:
::::''<code>sudo apt-get install libusb-1.0-0 libusb-1.0-0-dev libreadline6-dev readline-common libreadline6 libreadline-dev texinfo cmake git-core build-essential texinfo libreadline-dev libssl-dev libusb-1.0-0-dev libpng12-dev libusb-dev autoconf automake libnewlib-dev</code>'' [[Image:Return.png|15px]] Return
::::''<code>sudo build-toolchain.sh</code>'' [[Image:Return.png|15px]] Return
:::for linux
:::--[[User:Liamchat|liamchat]] 01:35, 20 February 2011 (UTC)
::::um liam I did that... on line 145 you need to make that specified for macosx only, well at least that's what the pod2g's version did... try building it on linux. [[User:Revolution|Revolution]] 16:51, 20 February 2011 (UTC)
::::i fixed the error there does not need to be any specific platform support for [[usb control msg(0xA1, 1) Exploit|stake]] or [[pwnage2]] i think there is better way using [http://www.beyondlogic.org/usbnutshell/usb5.shtml|USB Descriptors] --[[User:Liamchat|liamchat]] 00:02, 21 February 2011 (UTC)
::::: I just tried your new version. It still doesn't work. i managed to dump the bootrom with openiboot but yeah. here is the dump your ipod produces. it contains no copy writed code so i'll paste it here. [http://www.mediafire.com/?um4gz4ga00v067a] [[User:Revolution|Revolution]] 21:11, 24 February 2011 (UTC)
:::::: None of his things will work, I can promise you that. He doensn't know what he is doing. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 00:22, 25 February 2011 (UTC)
:::::::i have edited it again however i cant the usb wait for image call offset i origany thought it was the [https://github.com/Chronic-Dev/syringe/blob/master/syringe/exploits/steaks4uce/steaks4uce.S#L30 usb wait for image offset] from syringe. --[[User:Liamchat|liamchat]] 20:41, 7 March 2011 (UTC)
== VMware + Windows ==
anyone tried this on vmware + windows? can't make it work. tried on [[n90ap|iPhone 4]] & [[n18ap|iPod touch 3G]] -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the [[limera1n]] exploit. it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

== A5 devices ==
Can we use this tool to dump A5 devices? --[[User:XiiiX|XiiiX]] 12:28, 2 January 2012 (MST)
:Not until there is a jailbreak for A5 devices.--[[User:M2m|M2m]] 12:51, 2 January 2012 (MST)
:No. Limera1n doesn't work on A5 devices. --[[User:Http|http]] 13:04, 2 January 2012 (MST)
::It's kind of non-sense this tool so. To dump already hacked bootroms? --[[User:XiiiX|XiiiX]] 14:21, 2 January 2012 (MST)
:::No. Not really. You may find an exploit outside the bootrom which leads to a jailbreak which you can use to dump the bootrom which can help you to find exploits in the bootrom for later jailbreaks. Jailbreaks based on bootrom exploits can only be fixed with new hardware.--[[User:M2m|M2m]] 15:28, 2 January 2012 (MST)
:::There is no such thing as an "hacked BootROM". We cannot change the contents of the BootROM. Note "ROM" - Read Only Memory. -SquiffyPwn 17:10, 2 January 2012 (CST)
::::That's a better explanation. So we don't need a bootrom jailbreak to use this, just a user-land could work? Why is the necessity of a jailbreak to dump te bootrom? We need the offsets? --[[User:XiiiX|XiiiX]] 16:09, 2 January 2012 (MST)
Do you know what is dump? dump is a copy, to use this tool, you MUST have a BootROM Exploit, look the source code! ~zmaster

Talk:Bootrom Dumper Utility

2012-01-02T20:39:55Z

Zmaster: /* A5 devices */

If anyone gets it working for [[n72ap|iPod touch 2G]], let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 07:27, 23 December 2010 (UTC)
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)
:You can also use the current [[n72ap|iPod touch 2G]] [[OpeniBoot]] [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)
::I ended up making my own very crappy [[steaks4uce]] version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 03:38, 29 December 2010 (UTC)
:::i use ''sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc'' --[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)
::::Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 22:45, 29 December 2010 (UTC)
::hey liam when I try running this on linux i get 84 00 00 00 05 00 00 00 80 00 00 00 80 62 02 22 FF FF FF FF 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 00 00 00 02 00 00 00 01 38 02 22 90 D7 02 22 and then the rest of it gets filled with nulls until the next 0x800 bytes start :( [[User:Revolution|Revolution]] 19:02, 19 February 2011 (UTC)
:::use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)
:::run:
::::''<code>sudo apt-get install libusb-1.0-0 libusb-1.0-0-dev libreadline6-dev readline-common libreadline6 libreadline-dev texinfo cmake git-core build-essential texinfo libreadline-dev libssl-dev libusb-1.0-0-dev libpng12-dev libusb-dev autoconf automake libnewlib-dev</code>'' [[Image:Return.png|15px]] Return
::::''<code>sudo build-toolchain.sh</code>'' [[Image:Return.png|15px]] Return
:::for linux
:::--[[User:Liamchat|liamchat]] 01:35, 20 February 2011 (UTC)
::::um liam I did that... on line 145 you need to make that specified for macosx only, well at least that's what the pod2g's version did... try building it on linux. [[User:Revolution|Revolution]] 16:51, 20 February 2011 (UTC)
::::i fixed the error there does not need to be any specific platform support for [[usb control msg(0xA1, 1) Exploit|stake]] or [[pwnage2]] i think there is better way using [http://www.beyondlogic.org/usbnutshell/usb5.shtml|USB Descriptors] --[[User:Liamchat|liamchat]] 00:02, 21 February 2011 (UTC)
::::: I just tried your new version. It still doesn't work. i managed to dump the bootrom with openiboot but yeah. here is the dump your ipod produces. it contains no copy writed code so i'll paste it here. [http://www.mediafire.com/?um4gz4ga00v067a] [[User:Revolution|Revolution]] 21:11, 24 February 2011 (UTC)
:::::: None of his things will work, I can promise you that. He doensn't know what he is doing. --[[User:JacobVengeance|JacobVengeance (JakeAnthraX)]] 00:22, 25 February 2011 (UTC)
:::::::i have edited it again however i cant the usb wait for image call offset i origany thought it was the [https://github.com/Chronic-Dev/syringe/blob/master/syringe/exploits/steaks4uce/steaks4uce.S#L30 usb wait for image offset] from syringe. --[[User:Liamchat|liamchat]] 20:41, 7 March 2011 (UTC)
== VMware + Windows ==
anyone tried this on vmware + windows? can't make it work. tried on [[n90ap|iPhone 4]] & [[n18ap|iPod touch 3G]] -- [[User:Paul0|paulzero]] 10:38, 13 February 2011 (UTC)
:it's the [[limera1n]] exploit. it does not work throughout a vm --[[User:Liamchat|liamchat]] 14:45, 13 February 2011 (UTC)

== A5 devices ==

Can we use this tool to dump A5 devices? --[[User:XiiiX|XiiiX]] 12:28, 2 January 2012 (MST)
: Not until there is a jailbreak for A5 devices.--[[User:M2m|M2m]] 12:51, 2 January 2012 (MST)
:No. Limera1n doesn't work on A5 devices. --[[User:Http|http]] 13:04, 2 January 2012 (MST)
Look the source code, it use an BootROM exploit, there is no public BootROm exploit for A5 ~zmaster

The iPhone Wiki:Community portal

2011-12-24T19:08:23Z

Zmaster: /* New Upper Left Image */

{{Talk Archive|2010|2011|2012}}
This is the place to post tasks that need to be done on the wiki. Also this is the place for proposed changes. I heard about people wanting a favicon and arranging the main page into categories.

== Site Related Requests ==
=== 2.2b1 ===
Is 2.2b1 5G26 or 5G27, because on [[Beta Firmware]], it says 5G27... --[[User:Balloonhead66|Balloonhead66]] 19:48, 6 August 2011 (MDT)

=== Key pages ===
I would like to propose a new rule: Do not create a key page (e.g.- [[Jasper 8C148 (iPad)]]) unless you can also provide at least one key. Key pages are meant to share decryption keys with others. Copying and pasting from a template page provides us with no information whatsoever, and also wastes time (both the poster's and the administrators'). Thoughts on this? --[[User:Dialexio|Dialexio]] 21:50, 4 November 2011 (MDT)
:I'm against that. While I agree we shouldn't create all empty pages to fill out later, I don't see any reason to have a rule for that. Or was that a problem recently and I missed it? I also created pages with very few content (like [[Siri]]), that other users picked up or hopefully will pick up and enhanced. Key pages are a little different though. And the page you reference was never empty (but had wrong keys initially). So if you feel a big need to have such a rule, go on. -- [[User:Http|http]] 05:06, 5 November 2011 (MDT)
::I was simply using that page as an example of a key page, for those that had no clue what I was talking about. I think that posting an article with little content is a bit different from an empty key page; at least a small amount of information is being provided. In addition, it's easier to tell whether a key page needs to be filled out or not if the key page's link is red because the page was never created. I'll wait for additional feedback from anybody else before I decide on whether or not to add this to the rules. --[[User:Dialexio|Dialexio]] 11:31, 5 November 2011 (MDT)
:::Ok --[[User:Balloonhead66|Balloonhead66]] 16:58, 12 December 2011 (MST)

=== New Upper Left Image ===
If someone has a good one, I'll change it. Who still has an iPhone 2G? --[[User:Geohot|geohot]] 13:11, 12 December 2011 (MST)
:[[:File:NewLogo.png]]? Problem is one like that doesnt scale well. Maybe a rotated (like this) image of an [[n94ap|iPhone 4S]] or an [[iPad 2]]. I have an image of a rotated iPhone 4S if you want... --[[User:Balloonhead66|Balloonhead66]] 14:04, 12 December 2011 (MST)
:Something with an iPhone and the [[:File:Iptwiki.png|iPhone wiki logo]] from the main page would look good. I'll see if I can make one up. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 23:06, 17 December 2011 (MST)
:why not the [http://en.wikipedia.org/wiki/File:Apple_iOS.svg iOS logo]? --[[User:M2m|M2m]] 10:02, 18 December 2011 (MST)
::I don't think we can use that because it's a copyrighted logo. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 18:06, 18 December 2011 (MST)
::Agreed --[[User:Balloonhead66|Balloonhead66]] 18:15, 18 December 2011 (MST)
:Here's mine: [[File:thekirbylover's iPhone Wiki logo.png|top]]. It also requires a bit of [[User:thekirbylover/skin.css|extra CSS]]. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 17:59, 19 December 2011 (MST)

i have an iPhone 2G geohot! --[[User:Zmaster|Zmaster]] 12:08, 24 December 2011 (MST)

=== Cydia links ===
Links to Cydia, such as cydia://package/com.example.test, don't seem to wanna be linkified by the wiki, but there's an internal setting you can change: <tt>$wgUrlProtocols[] = "cydia://";</tt>. You might also want to use [[MediaWiki:Vector.css]] to add a mini Cydia icon next to it. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 18:06, 18 December 2011 (MST)
:As for the ''localsettings.php'' change, this is [[user:geohot|geohot]]'s problem. As for the CSS change, we could use [http://theiphonewiki.com/wiki/images/thumb/9/91/Cydia.png/16px-Cydia.png Cydia.png@16px]. --[[User:Balloonhead66|Balloonhead66]] 18:15, 18 December 2011 (MST)
::Yep, I was gonna put that CSS in my [[User:thekirbylover/monobook.css]] after I posted that. Also, correct me if I'm wrong, but I think Monobook.css is used on Vector pages too. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 18:21, 18 December 2011 (MST)
:::I checked the source and the "/load.php?{CRAP}" are empty and for some reason, {{wp|Google Chrome}}'s "Inspect Element" show up styles... --[[User:Balloonhead66|Balloonhead66]] 18:29, 18 December 2011 (MST)
:::/skin.css is cross skin while /vector.css and /monobook.css are per-skin --[[User:Balloonhead66|Balloonhead66]] 18:31, 18 December 2011 (MST)

=== MD Bootrom ===
Editing the [[models]] page, I noticed that the new white [[iPod4,2|iPod touch 4]]s have MD bootroms. However, I'm not sure about the black models, so can someone with a black touch 4 bought after September please tell me which model is reported in Settings? Thanks. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 23:46, 22 December 2011 (MST)
:Those are not bootroms; those are model numbers. According to Apple's online store, the black iPod touch 4G still has the same "MC" model numbers as before. --[[User:Dialexio|Dialexio]] 10:27, 23 December 2011 (MST)
::Ah, I see. Thanks for checking. [[User:thekirbylover|the]][[User talk:thekirbylover|kirby]][[Special:Contributions/thekirbylover|lover]] 16:33, 23 December 2011 (MST)

Talk:UID key

2011-12-23T23:35:57Z

Zmaster:

Is there a public way to get this key? --[[User:XiiiX|XiiiX]] 16:07, 23 December 2011 (MST)

No :(, someone know where it is located? --[[User:Zmaster|Zmaster]] 16:35, 23 December 2011 (MST)

Talk:Jailbreak

2011-12-19T13:45:43Z

Zmaster: /* 5.x PwnageTool bundles */

Actually, I believe redsn0w (normal version) still loads a 2.1.1 iBoot & uses the arm7_go exploit to bootstrap the ramdisk that flashes the NOR, including an LLB with the 24kpwn exploit. Can someone confirm this? --[[User:Cool name|Cool name]] 01:33, 27 July 2009 (UTC)

==Limera1n/Greenpois0n==

We should really try to get a name for the exploit or find a way to add it to exploits used post 2.0 --[[User:JacobVengeance|JakeAnthraX]] 05:13, 30 October 2010 (UTC)
:Apparenttly, limera1n uses SHAtter as it is unmatchable. Also google it --[[User:Balloonhead66|Balloonhead66]] 05:15, 30 October 2010 (UTC)
:: SHAtter was not used and was saved. This is the iPhone wiki, usually people come here before googling and after all it should be here. --[[User:JacobVengeance|JakeAnthraX]] 05:20, 30 October 2010 (UTC)
:::the exploit is used differently on both jailbreaks on [[limera1n]] it creates a command called geohot then reboots to recovery mode and boots a [[ramdisk]] however on [[Greenpois0n (jailbreak)|greenpois0n]] it injects [[IBSS]] and then uses the exploit to inject a pwnd [[IBEC]] in the description of shatter it did say it rebooted --[[User:Liamchat|liamchat]] 11:31, 30 October 2010 (UTC)
::[SHAtter] was saved, [greenpois0n] uses the same exploit as [limera1n]. Also can someone stem the flow of crap coming from liamchat? It's getting annoying now. --[[User:GreySyntax|GreySyntax]] 11:45, 30 October 2010 (UTC)

== "Exploits which are used in order to jailbreak 2.x?" ==

The exploits used for jailbreaking iOS 1.x are broken down by firmware version. I'd like to accomplish the same thing for the 2.0 and onward section, since it's formatted much differently. But then I thought to myself, "This is going to be a huge revision that may receive sharp criticism. Let me make a talk page entry for this." So that's what I did…

So, in other words, would it be fine if the "Exploits which are used in order to jailbreak 2.0+" section was changed to something similar to the "Exploits which are used in order to jailbreak 1.x" section? --[[User:Dialexio|Dialexio]] 02:16, 11 July 2011 (UTC)
:Sounds like a good idea to me. Wouldn't it be easier to also separate them by major revisions? Like have a 2.X section, a 3.X section, a 4.X section, and soon to be 5.X? --[[User:JacobVengeance|JakeAnthraX]] 02:27, 11 July 2011 (UTC)
::Of course! I was planning to do that, too. :P --[[User:Dialexio|Dialexio]] 02:31, 11 July 2011 (UTC)

== 4.3.5 / 4.2.10 ==
I've changed references to 0.9.8b3 to 0.9.8b7 for 4.3.5 tethered jailbreaks (see latest iPhone Dev rs iOS5beta posting). Should the Main Page be changed to reflect that an official jailbreak is available? Or will this only be changed on release of an untethered exploit being made available? Also fixed an error in which a reference to 0.9.6rc18 was existent with a question mark. Now changed to the accurate version of rs beta that needs to be used for 4.3.4 on that device. I've left 0.9.8b3 for 4.3.4 simply because that was the first release supporting it. Hope this is okay. [[User:Windows Helpdesk|blackthund3r]] 04:57, 31 August 2011 (MDT)
:Actually it should list the lowest and highest version number that supports the listed firmware version, not just the latest. That's why all other pre 4.3.3 versions for redsn0w have ranges. -- [[User:Http|http]] 00:57, 1 September 2011 (MDT)

== 3GS separation ==

From a jailbreak point of view, the 3GS with old and new bootrom are totally different devices. Can we separate that into two tables? -- [[User:Http|http]] 12:48, 14 December 2011 (MST)

== 5.x PwnageTool bundles ==

The list says there are PwnageTool custom bundles for 5.0 for iPad and iPhone 4 (GSM) available. Is that correct? -- [[User:Http|http]] 05:06, 19 December 2011 (MST)

see pwnbundles.com --[[User:Zmaster|Zmaster]] 06:45, 19 December 2011 (MST)

Talk:Bluefreeze

2011-12-12T14:52:00Z

Zmaster: /* Claiming false functionality */

== Claiming false functionality ==

What? Are you joking? It works, have you tried it yet? I've worked countless hours trying to get this right, and you say it doesn't work? Look, try it before you say such things, I assure you it works. And where did I break the ground rules? These are all false claims.

i just wanna say i thing, stop thinking that you are a hacker. Learn Reverse Enginer, C, C++, Pyhton, Exploitation and etc. After you can say that you made an exploit :) --[[User:Zmaster|Zmaster]] 07:52, 12 December 2011 (MST)

Talk:Bluefreeze

2011-12-12T14:51:48Z

Zmaster: /* Claiming false functionality */

IFaith

2011-12-12T12:48:37Z

Zmaster: stop thinking that your hackers!!

{{lowercase}}
{{Infobox software
| name = iFaith
| title = iFaith
| logo = 
| screenshot = [[File:IFaithv10.png|300px]]
| caption = iFaith 1.0 on Windows XP
| collapsible =
| author = [[User:ih8sn0w|iH8sn0w]]
| developer = [[User:ih8sn0w|iH8sn0w]]
| released = {{Start date|2011|06|02|df=yes}}
| discontinued =
| latest release version = 1.4
| latest release date = {{Start date and age|2011|12|03|df=yes}}
| latest preview version =
| latest preview date =
| programming language = {{wp|C Sharp (programming language)|C#}}
| operating system = {{wp|Microsoft Windows}} XP or greater
| platform =
| size = ZIP: 6,240,633 bytes (5.95 MB) EXE: 9,562,112 bytes (9.11 MB)
| language = {{wp|English language|English}}
| status = Active
| genre = Backup
| license = {{wp|GNU General Public License#Version 3|GNU GPL v3}}
| website = [http://ih8sn0w.com www.ih8sn0w.com]
}}
'''iFaith''' is an open source [[SHSH]] dumper for the Windows family of operating systems written by [[User:Ih8sn0w|iH8sn0w]]. It works on all devices that are susceptible to the [[limera1n]] exploit (all devices except the [[iPad 2]]). This is useful if you receive a device with old firmware on it that you want to be able to restore. Even if Apple doesn't sign that firmware anymore, you can backup the [[SHSH]] data directly from the device, so that you can install the firmware later again to avoid upgrading the firmware.

=== Credits ===
* [[User:Ih8sn0w|iH8sn0w]] author
* [[User:Geohot|geohot]] for [[limera1n]] exploit

{{clear}}
=== Releases ===
{| class="wikitable" width="100%" style="font-size:smaller;border-collapse:collapse;" border="1"
! style="background-color:#E9E9E9;text-align:center;width:50px;" | Version
! style="background-color:#E9E9E9;text-align:center;width:65px;" | Release date
! style="background-color:#E9E9E9;text-align:center;" | Changes
|-
! 1.0
| style="text-align:center;" | 2-Jun-2011
|
* Official release of [[iFaith]]
|-
! 1.1
| style="text-align:center;" | 2-Jul-2011
|
* Code improvement.
* iFaith now SHA1's the [[SHSH]] blob.
* Now alerts user when iFaith was unable to hook iTunes instead of crashing.
* Minor bug fixes with device / iOS detection.
* [http://pastie.org/2152582 change log]
|-
! 1.2
| style="text-align:center;" | 27-Jul-2011
|
* Added [[N72ap|iPod touch 2G]] dumping capability (MC-Model users recommened)
* IPSW Creation for [[N72ap|iPod touch 2G]] is still a work in progress.
* Fixed exe compression issues (resulting in many DFU loops on IPSW creation)
* Fixed any Windows XP issues
* Source code released
* It is currently not possible to add [[iPad 2]] support
* [http://pastie.org/2282544 change log]
|-
! 1.2.1
| style="text-align:center;" | 27-Jul-2011
|
* Bugfix ("Who knew one last second mod could screw the whole build?")
|-
! 1.2.2
| style="text-align:center;" | 31-Jul-2011 (?)
|
* Contains a minor fix.
|-
! 1.3
| style="text-align:center;" | 9-Aug-2011
|
* For iOS 3.1.x/3.2.x/4.0.x/4.1/4.2.1/4.2.6/4.2.7/4.2.8/4.3/4.3.1/4.3.2/4.3.3
* DFU loops were being caused on devices that had the factory certificate. On this new version, when building the signed [[IPSW]], if you were getting a DFU loop, say "NO" to the prompt about using the standard signing certificate.
* You can now use [[TinyUmbrella]] blobs to build a signed [[IPSW]]. (Change file type in browse dialog to "[[TinyUmbrella]] [[SHSH]] blobs".)
* Now adds [[ECID]] to beginning of the [[SHSH]] filename after dumping.
* Now adds [[ECID]] to beginning of the [[IPSW]] filename after being built.
* Cleaned up code and payload
* It's not possible to add [[iPad 2]] support until a bootrom exploit arises.
* [http://pastie.org/2346028 change log]
|-
! 1.3.1
| style="text-align:center;" | 12-Aug-2011
|
* Used a different method to convert binary plists from TinyUmbrella SHSH Blobs to xml format to parse.
* Fixed minor restore issues on 4.3.x for [[iPad]] 3G models.
|-
! 1.3.2
| style="text-align:center;" | 14-Aug-2011
|
* The .NET framework that came pre-shipped with Windows Vista didn't have an essential resource used in iFaith. A new method has been implemented to get around this requirement.
* Fixed issue where [[iTunes]]' plist utility was unable to be located on international language formatted pcs.
|-
! 1.4
| style="text-align:center;" | 03-Dec-2011 
|
* Now dumps iOS 4.4.x (Apple TV 2)/5.0.x apticket + SHSH blobs!
* Dumping is MUCH faster.
* Full Windows XP support.
* Major code improvements.
* Bug fixes.
|-
|}

== External Links ==

* [http://ih8sn0w.com/index.php/download/file/ifaith/pc Download iFaith] (1.4)
* [http://ih8sn0w.com/index.php/products/view/ifaith.snow iFaith homepage]
* [https://github.com/iH8sn0w/iFaith Sourcecode on github]

[[Category:Hacking Software]]

Talk:Kernel Syscalls

2011-11-29T20:58:16Z

Zmaster: Created page with "i dont know if its right, pls correct me if im wrong :) --~~~~"

i dont know if its right, pls correct me if im wrong :) --[[User:Zmaster|Zmaster]] 13:58, 29 November 2011 (MST)

Kernel Syscalls

2011-11-29T20:52:59Z

Zmaster: working on 4+

== Note on these ==
Args go in their normal registers, like arg1 in R0, as usual...

== CPU ==

=== Usage ===
<pre>
MOV R12, #x // number from list
swi 0x80
bx lr
</pre>

=== List ===
* '''Clear Instruction Cache''': 0
* '''Flush Data Cache''': 1
* '''_pthread_set_self''': 2
* '''Unknown''': 3

== Unix ==
=== Usage ===
<pre>
MOV IP, #x // number from list
swi 0x80
</pre>

=== List ===
* '''exit''': 1
* '''fork''': 2
* '''read''': 3
* '''write''': 4
* '''open''': 5
* '''close''': 6
* '''wait4''': 7
* '''link''': 9
* '''unlink''': 10
* '''chdir''': 12
* '''fchdir''': 13
* '''mknod''': 14
* '''chmod''': 15
* '''chown''': 16
* '''getfsstat''': 18
* '''getpid''': 20
* '''setuid''': 23
* '''getuid''': 24
* '''geteuid''': 25
* '''ptrace''': 26
* '''recvmsg''': 27
* '''sendmsg''': 28
* '''recvfrom''': 29
* '''accept''': 30
* '''getpeername''': 31
* '''getsockname''': 32
* '''access''': 33
* '''chflags''': 34
* '''fchflags''': 35
* '''sync''': 36
* '''kill''': 37
* '''getppid''': 39
* '''dup''': 41
* '''pipe''': 42
* '''getegid''': 43
* '''profil''': 44
* '''sigaction''': 46
* '''getgid''': 47
* '''sigprocmask''': 48
* '''getlogin''': 49
* '''setlogin''': 50
* '''acct''': 51
* '''sigpending''': 52
* '''signalstack''': 53
* '''ioctl''': 54
* '''reboot''': 55
* '''revoke''': 56
* '''symlink''': 57
* '''readlink''': 58
* '''execve''': 59
* '''umask''': 60
* '''chroot''': 61
* '''msync''': 65
* '''vfork''': 66
* '''munmap''': 73
* '''mprotect''': 74
* '''madvise''': 75
* '''mincore''': 78
* '''getgroups''': 79
* '''setgroups''': 80
* '''getpgrp''': 81
* '''setpgid''': 82
* '''setitimer''': 83
* '''swapon''': 85
* '''getitimer''': 86
* '''getdtablesize''': 89
* '''dup2''': 90
* '''fnctl''': 92
* '''select''': 93
* '''fsync''': 95
* '''setpriority''': 96
* '''socket''': 97
* '''connect''': 98
* '''getpriority''': 100
* '''bind''': 104
* '''setsockopt''': 105
* '''listen''': 106
* '''sigsuspend''': 111
* '''gettimeofday''': 116
* '''getrusage''': 117
* '''getsockopt''': 118
* '''readv''': 120
* '''writev''': 121
* '''settimeofday''': 122
* '''fchown''': 123
* '''fchmod''': 124
* '''setreuid''': 126
* '''setregid''': 127
* '''rename''': 128
* '''flock''': 131
* '''mkfifo''': 132
* '''sendto''': 133
* '''shutdown''': 134
* '''socketpair''': 135
* '''mkdir''': 136
* '''rmdir''': 137
* '''utimes''': 138
* '''futimes''': 139
* '''adjtime''': 140
* '''gethostuuid''': 142
* '''setsid''': 145
* '''getpgid''': 151
* '''setprivexec''': 152
* '''pread''': 153
* '''pwrite''': 154
* '''statfs''': 157
* '''fstatfs''': 158
* '''unmount''': 159
* '''quotactl''': 165
* '''mount''': 167
* '''csops''': 169
* '''waitid''': 173
* '''add_profil''': 176
* '''kdebug_trace''': 180
* '''setgid''': 181
* '''setegid''': 182
* '''seteuid''': 183
* '''sigreturn''': 184
* '''chod''': 185
* '''fdatasync''': 187
* '''stat''': 188
* '''fstat''': 189
* '''lstat''': 190
* '''pathconf''': 191
* '''fpathconf''': 192
* '''getrlimit''': 194
* '''setrlimit''': 195
* '''getdirentries''': 196
* '''mmap''': 197
* '''lseek''': 199
* '''truncate''': 200
* '''ftruncate''': 201
* '''__sysctl''': 202
* '''mlock''': 203
* '''munlock''': 204
* '''undelete''': 205
* '''mkcomplex''': 216
* '''statv''': 217
* '''lstatv''': 218
* '''fstatv''': 219
* '''getattrlist''': 220
* '''setattrlist''': 221
* '''getdirentriesattr''': 222
* '''exchangedata''': 223
* '''fsgetpath''': 224
* '''searchfs''': 225
* '''delete''': 226
* '''copyfile''': 227
* '''fgetattrlist''': 228
* '''fsetattrlist''': 229
* '''poll''': 230
* '''watchevent''': 231
* '''waitevent''': 232
* '''modwatch''': 233
* '''getxattr''': 234
* '''fgetxattr''': 235
* '''setxattr''': 236
* '''fsetxattr''': 237
* '''removexattr''': 238
* '''fremovexattr''': 239
* '''listxattr''': 240
* '''flistxattr''': 241
* '''fsctl''': 242
* '''initgroups''': 243
* '''posix_spawn''': 244
* '''ffsctl''': 245
* '''minherit''': 250
* '''shm_open''': 266
* '''shm_unlink''': 267
* '''sem_open''': 268
* '''sem_close''': 269
* '''sem_unlink''': 270
* '''sem_wait''': 271
* '''sem_trywait''': 272
* '''sem_post''': 273
* '''sem_getvalue''': 274
* '''sem_init''': 275
* '''sem_destroy''': 276
* '''open_extended''': 277
* '''umask_extended''': 278
* '''stat_extended''': 279
* '''lstat_extended''': 280
* '''fstat_extended''': 281
* '''chmod_extended''': 282
* '''fchmod_extended''': 283
* '''access_extended''': 284
* '''settid''': 285
* '''gettid''': 286
* '''setsgroups''': 287
* '''getsgroups''': 288
* '''setwgroups''': 289
* '''getwgroups''': 290
* '''mkfifo_extended''': 291
* '''mkdir_extended''': 292
* '''identitysvc''': 293
* '''shared_region_check_np''': 294
* '''shared_region_map_np''': 295
* '''vm_pressure_monitor''': 296
* '''__pthread_mutex_destroy''': 301
* '''__pthread_mutex_init''': 302
* '''__pthread_mutex_lock''': 303
* '''__pthread_mutex_trylock''': 304
* '''__pthread_mutex_unlock''': 305
* '''__pthread_cond_init''': 306
* '''__pthread_cond_destroy''': 307
* '''__pthread_cond_broadcast''': 308
* '''__pthread_cond_signal''': 309
* '''getsid''': 310
* '''settid_with_pid''': 311
* '''__pthread_cond_timedwait''': 312
* '''aio_fsync''': 313
* '''aio_return''': 314
* '''aio_suspend''': 315
* '''aio_cancel''': 316
* '''aio_error''': 317
* '''aio_read''': 318
* '''aio_write''': 319
* '''lio_listio''': 320
* '''__pthread_cond_wait''': 321
* '''iopolicysys''': 322
* '''mlockall''': 324
* '''munlockall''': 325
* '''issetugid''': 327
* '''__pthread_kill''': 328
* '''__pthread_sigmask''': 329
* '''__sigwait''': 330
* '''__disable_threadsignal''': 331
* '''__pthread_markcancel''': 332
* '''__pthread_canceled''': 333
* '''proc_info''': 336
* '''stat64''': 338
* '''fstat64''': 339
* '''lstat64''': 340
* '''stat64_extended''': 341
* '''lstat64_extended''': 342
* '''fstat64_extended''': 343
* '''getdirectories64''': 344
* '''statfs64''': 345
* '''fstatfs64''': 346
* '''getfsstat64''': 347
* '''__pthread_chdir''': 348
* '''__pthread_fchdir''': 349
* '''kqueue''': 362
* '''kevent''': 363
* '''lchown''': 364
* '''stack_snapshot''': 365
* '''kevent64''': 369
* '''__semwait_signal''': 370
* '''__semwait_signal_nocancel''': 371
* '''__mac_execve''': 380
* '''__mac_syscall''': 381
* '''__mac_get_file''': 382
* '''__mac_set_file''': 383
* '''__mac_get_link''': 384
* '''__mac_set_link''': 385
* '''__mac_get_proc''': 386
* '''__mac_set_proc''': 387
* '''__mac_get_fd''': 388
* '''__mac_set_fd''': 389
* '''__mac_get_pid''': 390
* '''__mac_get_lcid''': 391
* '''__mac_get_lctx''': 392
* '''__mac_set_lctx''': 393
* '''setlcid''': 394
* '''getlcid''': 395
* '''read_nocancel''': 396
* '''write_nocancel''': 397
* '''open_nocancel''': 398
* '''close_nocancel''': 399
* '''wait4_nocancel''': 400
* '''recvmsg_nocancel''': 401
* '''sendmsg_nocancel''': 402
* '''recvfrom_nocancel''': 403
* '''accept_nocancel''': 404
* '''msync_nocancel''': 405
* '''fnctl_nocancel''': 406
* '''select_nocancel''': 407
* '''fsync_nocancel''': 408
* '''connect_nocancel''': 409
* '''sigsuspend_nocancel''': 410
* '''readv_nocancel''': 411
* '''writev_nocancel''': 412
* '''sendto_nocancel''': 413
* '''pread_nocancel''': 414
* '''pwrite_nocancel''': 415
* '''waitid_nocancel''': 416
* '''poll_nocancel''': 417
* '''sem_wait_nocancel''': 420
* '''aio_suspend_nocancel''': 421
* '''__sigwait_nocancel''': 422
* '''__semwait_signal_nocancel''': 423
* '''__mac_mount''': 424
* '''__mac_get_mount''': 425
* '''__mac_getfsstat''': 426
* '''fsgetpath_1''': 427
* '''_audit_session_self''': 428
* '''_audit_session_join''': 429

Kernel Syscalls

2011-11-29T20:52:32Z

Zmaster: /* Usage */

== Note on these ==
Args go in their normal registers, like arg1 in R0, as usual...

== CPU ==
'''Unconfirmed''': These may not work on iOS 4 and beyond.

=== Usage ===
<pre>
MOV R12, #x // number from list
swi 0x80
bx lr
</pre>

=== List ===
* '''Clear Instruction Cache''': 0
* '''Flush Data Cache''': 1
* '''_pthread_set_self''': 2
* '''Unknown''': 3

== Unix ==
=== Usage ===
<pre>
MOV IP, #x // number from list
swi 0x80
</pre>

=== List ===
* '''exit''': 1
* '''fork''': 2
* '''read''': 3
* '''write''': 4
* '''open''': 5
* '''close''': 6
* '''wait4''': 7
* '''link''': 9
* '''unlink''': 10
* '''chdir''': 12
* '''fchdir''': 13
* '''mknod''': 14
* '''chmod''': 15
* '''chown''': 16
* '''getfsstat''': 18
* '''getpid''': 20
* '''setuid''': 23
* '''getuid''': 24
* '''geteuid''': 25
* '''ptrace''': 26
* '''recvmsg''': 27
* '''sendmsg''': 28
* '''recvfrom''': 29
* '''accept''': 30
* '''getpeername''': 31
* '''getsockname''': 32
* '''access''': 33
* '''chflags''': 34
* '''fchflags''': 35
* '''sync''': 36
* '''kill''': 37
* '''getppid''': 39
* '''dup''': 41
* '''pipe''': 42
* '''getegid''': 43
* '''profil''': 44
* '''sigaction''': 46
* '''getgid''': 47
* '''sigprocmask''': 48
* '''getlogin''': 49
* '''setlogin''': 50
* '''acct''': 51
* '''sigpending''': 52
* '''signalstack''': 53
* '''ioctl''': 54
* '''reboot''': 55
* '''revoke''': 56
* '''symlink''': 57
* '''readlink''': 58
* '''execve''': 59
* '''umask''': 60
* '''chroot''': 61
* '''msync''': 65
* '''vfork''': 66
* '''munmap''': 73
* '''mprotect''': 74
* '''madvise''': 75
* '''mincore''': 78
* '''getgroups''': 79
* '''setgroups''': 80
* '''getpgrp''': 81
* '''setpgid''': 82
* '''setitimer''': 83
* '''swapon''': 85
* '''getitimer''': 86
* '''getdtablesize''': 89
* '''dup2''': 90
* '''fnctl''': 92
* '''select''': 93
* '''fsync''': 95
* '''setpriority''': 96
* '''socket''': 97
* '''connect''': 98
* '''getpriority''': 100
* '''bind''': 104
* '''setsockopt''': 105
* '''listen''': 106
* '''sigsuspend''': 111
* '''gettimeofday''': 116
* '''getrusage''': 117
* '''getsockopt''': 118
* '''readv''': 120
* '''writev''': 121
* '''settimeofday''': 122
* '''fchown''': 123
* '''fchmod''': 124
* '''setreuid''': 126
* '''setregid''': 127
* '''rename''': 128
* '''flock''': 131
* '''mkfifo''': 132
* '''sendto''': 133
* '''shutdown''': 134
* '''socketpair''': 135
* '''mkdir''': 136
* '''rmdir''': 137
* '''utimes''': 138
* '''futimes''': 139
* '''adjtime''': 140
* '''gethostuuid''': 142
* '''setsid''': 145
* '''getpgid''': 151
* '''setprivexec''': 152
* '''pread''': 153
* '''pwrite''': 154
* '''statfs''': 157
* '''fstatfs''': 158
* '''unmount''': 159
* '''quotactl''': 165
* '''mount''': 167
* '''csops''': 169
* '''waitid''': 173
* '''add_profil''': 176
* '''kdebug_trace''': 180
* '''setgid''': 181
* '''setegid''': 182
* '''seteuid''': 183
* '''sigreturn''': 184
* '''chod''': 185
* '''fdatasync''': 187
* '''stat''': 188
* '''fstat''': 189
* '''lstat''': 190
* '''pathconf''': 191
* '''fpathconf''': 192
* '''getrlimit''': 194
* '''setrlimit''': 195
* '''getdirentries''': 196
* '''mmap''': 197
* '''lseek''': 199
* '''truncate''': 200
* '''ftruncate''': 201
* '''__sysctl''': 202
* '''mlock''': 203
* '''munlock''': 204
* '''undelete''': 205
* '''mkcomplex''': 216
* '''statv''': 217
* '''lstatv''': 218
* '''fstatv''': 219
* '''getattrlist''': 220
* '''setattrlist''': 221
* '''getdirentriesattr''': 222
* '''exchangedata''': 223
* '''fsgetpath''': 224
* '''searchfs''': 225
* '''delete''': 226
* '''copyfile''': 227
* '''fgetattrlist''': 228
* '''fsetattrlist''': 229
* '''poll''': 230
* '''watchevent''': 231
* '''waitevent''': 232
* '''modwatch''': 233
* '''getxattr''': 234
* '''fgetxattr''': 235
* '''setxattr''': 236
* '''fsetxattr''': 237
* '''removexattr''': 238
* '''fremovexattr''': 239
* '''listxattr''': 240
* '''flistxattr''': 241
* '''fsctl''': 242
* '''initgroups''': 243
* '''posix_spawn''': 244
* '''ffsctl''': 245
* '''minherit''': 250
* '''shm_open''': 266
* '''shm_unlink''': 267
* '''sem_open''': 268
* '''sem_close''': 269
* '''sem_unlink''': 270
* '''sem_wait''': 271
* '''sem_trywait''': 272
* '''sem_post''': 273
* '''sem_getvalue''': 274
* '''sem_init''': 275
* '''sem_destroy''': 276
* '''open_extended''': 277
* '''umask_extended''': 278
* '''stat_extended''': 279
* '''lstat_extended''': 280
* '''fstat_extended''': 281
* '''chmod_extended''': 282
* '''fchmod_extended''': 283
* '''access_extended''': 284
* '''settid''': 285
* '''gettid''': 286
* '''setsgroups''': 287
* '''getsgroups''': 288
* '''setwgroups''': 289
* '''getwgroups''': 290
* '''mkfifo_extended''': 291
* '''mkdir_extended''': 292
* '''identitysvc''': 293
* '''shared_region_check_np''': 294
* '''shared_region_map_np''': 295
* '''vm_pressure_monitor''': 296
* '''__pthread_mutex_destroy''': 301
* '''__pthread_mutex_init''': 302
* '''__pthread_mutex_lock''': 303
* '''__pthread_mutex_trylock''': 304
* '''__pthread_mutex_unlock''': 305
* '''__pthread_cond_init''': 306
* '''__pthread_cond_destroy''': 307
* '''__pthread_cond_broadcast''': 308
* '''__pthread_cond_signal''': 309
* '''getsid''': 310
* '''settid_with_pid''': 311
* '''__pthread_cond_timedwait''': 312
* '''aio_fsync''': 313
* '''aio_return''': 314
* '''aio_suspend''': 315
* '''aio_cancel''': 316
* '''aio_error''': 317
* '''aio_read''': 318
* '''aio_write''': 319
* '''lio_listio''': 320
* '''__pthread_cond_wait''': 321
* '''iopolicysys''': 322
* '''mlockall''': 324
* '''munlockall''': 325
* '''issetugid''': 327
* '''__pthread_kill''': 328
* '''__pthread_sigmask''': 329
* '''__sigwait''': 330
* '''__disable_threadsignal''': 331
* '''__pthread_markcancel''': 332
* '''__pthread_canceled''': 333
* '''proc_info''': 336
* '''stat64''': 338
* '''fstat64''': 339
* '''lstat64''': 340
* '''stat64_extended''': 341
* '''lstat64_extended''': 342
* '''fstat64_extended''': 343
* '''getdirectories64''': 344
* '''statfs64''': 345
* '''fstatfs64''': 346
* '''getfsstat64''': 347
* '''__pthread_chdir''': 348
* '''__pthread_fchdir''': 349
* '''kqueue''': 362
* '''kevent''': 363
* '''lchown''': 364
* '''stack_snapshot''': 365
* '''kevent64''': 369
* '''__semwait_signal''': 370
* '''__semwait_signal_nocancel''': 371
* '''__mac_execve''': 380
* '''__mac_syscall''': 381
* '''__mac_get_file''': 382
* '''__mac_set_file''': 383
* '''__mac_get_link''': 384
* '''__mac_set_link''': 385
* '''__mac_get_proc''': 386
* '''__mac_set_proc''': 387
* '''__mac_get_fd''': 388
* '''__mac_set_fd''': 389
* '''__mac_get_pid''': 390
* '''__mac_get_lcid''': 391
* '''__mac_get_lctx''': 392
* '''__mac_set_lctx''': 393
* '''setlcid''': 394
* '''getlcid''': 395
* '''read_nocancel''': 396
* '''write_nocancel''': 397
* '''open_nocancel''': 398
* '''close_nocancel''': 399
* '''wait4_nocancel''': 400
* '''recvmsg_nocancel''': 401
* '''sendmsg_nocancel''': 402
* '''recvfrom_nocancel''': 403
* '''accept_nocancel''': 404
* '''msync_nocancel''': 405
* '''fnctl_nocancel''': 406
* '''select_nocancel''': 407
* '''fsync_nocancel''': 408
* '''connect_nocancel''': 409
* '''sigsuspend_nocancel''': 410
* '''readv_nocancel''': 411
* '''writev_nocancel''': 412
* '''sendto_nocancel''': 413
* '''pread_nocancel''': 414
* '''pwrite_nocancel''': 415
* '''waitid_nocancel''': 416
* '''poll_nocancel''': 417
* '''sem_wait_nocancel''': 420
* '''aio_suspend_nocancel''': 421
* '''__sigwait_nocancel''': 422
* '''__semwait_signal_nocancel''': 423
* '''__mac_mount''': 424
* '''__mac_get_mount''': 425
* '''__mac_getfsstat''': 426
* '''fsgetpath_1''': 427
* '''_audit_session_self''': 428
* '''_audit_session_join''': 429

Kernel Syscalls

2011-11-29T20:50:33Z

Zmaster: added new syscall

== Note on these ==
Args go in their normal registers, like arg1 in R0, as usual...

== CPU ==
'''Unconfirmed''': These may not work on iOS 4 and beyond.

=== Usage ===
<pre>
MOV R3, #x // number from list
MOV IP, #0x80000000
swi 0x80
</pre>

=== List ===
* '''Clear Instruction Cache''': 0
* '''Flush Data Cache''': 1
* '''_pthread_set_self''': 2
* '''Unknown''': 3

== Unix ==
=== Usage ===
<pre>
MOV IP, #x // number from list
swi 0x80
</pre>

=== List ===
* '''exit''': 1
* '''fork''': 2
* '''read''': 3
* '''write''': 4
* '''open''': 5
* '''close''': 6
* '''wait4''': 7
* '''link''': 9
* '''unlink''': 10
* '''chdir''': 12
* '''fchdir''': 13
* '''mknod''': 14
* '''chmod''': 15
* '''chown''': 16
* '''getfsstat''': 18
* '''getpid''': 20
* '''setuid''': 23
* '''getuid''': 24
* '''geteuid''': 25
* '''ptrace''': 26
* '''recvmsg''': 27
* '''sendmsg''': 28
* '''recvfrom''': 29
* '''accept''': 30
* '''getpeername''': 31
* '''getsockname''': 32
* '''access''': 33
* '''chflags''': 34
* '''fchflags''': 35
* '''sync''': 36
* '''kill''': 37
* '''getppid''': 39
* '''dup''': 41
* '''pipe''': 42
* '''getegid''': 43
* '''profil''': 44
* '''sigaction''': 46
* '''getgid''': 47
* '''sigprocmask''': 48
* '''getlogin''': 49
* '''setlogin''': 50
* '''acct''': 51
* '''sigpending''': 52
* '''signalstack''': 53
* '''ioctl''': 54
* '''reboot''': 55
* '''revoke''': 56
* '''symlink''': 57
* '''readlink''': 58
* '''execve''': 59
* '''umask''': 60
* '''chroot''': 61
* '''msync''': 65
* '''vfork''': 66
* '''munmap''': 73
* '''mprotect''': 74
* '''madvise''': 75
* '''mincore''': 78
* '''getgroups''': 79
* '''setgroups''': 80
* '''getpgrp''': 81
* '''setpgid''': 82
* '''setitimer''': 83
* '''swapon''': 85
* '''getitimer''': 86
* '''getdtablesize''': 89
* '''dup2''': 90
* '''fnctl''': 92
* '''select''': 93
* '''fsync''': 95
* '''setpriority''': 96
* '''socket''': 97
* '''connect''': 98
* '''getpriority''': 100
* '''bind''': 104
* '''setsockopt''': 105
* '''listen''': 106
* '''sigsuspend''': 111
* '''gettimeofday''': 116
* '''getrusage''': 117
* '''getsockopt''': 118
* '''readv''': 120
* '''writev''': 121
* '''settimeofday''': 122
* '''fchown''': 123
* '''fchmod''': 124
* '''setreuid''': 126
* '''setregid''': 127
* '''rename''': 128
* '''flock''': 131
* '''mkfifo''': 132
* '''sendto''': 133
* '''shutdown''': 134
* '''socketpair''': 135
* '''mkdir''': 136
* '''rmdir''': 137
* '''utimes''': 138
* '''futimes''': 139
* '''adjtime''': 140
* '''gethostuuid''': 142
* '''setsid''': 145
* '''getpgid''': 151
* '''setprivexec''': 152
* '''pread''': 153
* '''pwrite''': 154
* '''statfs''': 157
* '''fstatfs''': 158
* '''unmount''': 159
* '''quotactl''': 165
* '''mount''': 167
* '''csops''': 169
* '''waitid''': 173
* '''add_profil''': 176
* '''kdebug_trace''': 180
* '''setgid''': 181
* '''setegid''': 182
* '''seteuid''': 183
* '''sigreturn''': 184
* '''chod''': 185
* '''fdatasync''': 187
* '''stat''': 188
* '''fstat''': 189
* '''lstat''': 190
* '''pathconf''': 191
* '''fpathconf''': 192
* '''getrlimit''': 194
* '''setrlimit''': 195
* '''getdirentries''': 196
* '''mmap''': 197
* '''lseek''': 199
* '''truncate''': 200
* '''ftruncate''': 201
* '''__sysctl''': 202
* '''mlock''': 203
* '''munlock''': 204
* '''undelete''': 205
* '''mkcomplex''': 216
* '''statv''': 217
* '''lstatv''': 218
* '''fstatv''': 219
* '''getattrlist''': 220
* '''setattrlist''': 221
* '''getdirentriesattr''': 222
* '''exchangedata''': 223
* '''fsgetpath''': 224
* '''searchfs''': 225
* '''delete''': 226
* '''copyfile''': 227
* '''fgetattrlist''': 228
* '''fsetattrlist''': 229
* '''poll''': 230
* '''watchevent''': 231
* '''waitevent''': 232
* '''modwatch''': 233
* '''getxattr''': 234
* '''fgetxattr''': 235
* '''setxattr''': 236
* '''fsetxattr''': 237
* '''removexattr''': 238
* '''fremovexattr''': 239
* '''listxattr''': 240
* '''flistxattr''': 241
* '''fsctl''': 242
* '''initgroups''': 243
* '''posix_spawn''': 244
* '''ffsctl''': 245
* '''minherit''': 250
* '''shm_open''': 266
* '''shm_unlink''': 267
* '''sem_open''': 268
* '''sem_close''': 269
* '''sem_unlink''': 270
* '''sem_wait''': 271
* '''sem_trywait''': 272
* '''sem_post''': 273
* '''sem_getvalue''': 274
* '''sem_init''': 275
* '''sem_destroy''': 276
* '''open_extended''': 277
* '''umask_extended''': 278
* '''stat_extended''': 279
* '''lstat_extended''': 280
* '''fstat_extended''': 281
* '''chmod_extended''': 282
* '''fchmod_extended''': 283
* '''access_extended''': 284
* '''settid''': 285
* '''gettid''': 286
* '''setsgroups''': 287
* '''getsgroups''': 288
* '''setwgroups''': 289
* '''getwgroups''': 290
* '''mkfifo_extended''': 291
* '''mkdir_extended''': 292
* '''identitysvc''': 293
* '''shared_region_check_np''': 294
* '''shared_region_map_np''': 295
* '''vm_pressure_monitor''': 296
* '''__pthread_mutex_destroy''': 301
* '''__pthread_mutex_init''': 302
* '''__pthread_mutex_lock''': 303
* '''__pthread_mutex_trylock''': 304
* '''__pthread_mutex_unlock''': 305
* '''__pthread_cond_init''': 306
* '''__pthread_cond_destroy''': 307
* '''__pthread_cond_broadcast''': 308
* '''__pthread_cond_signal''': 309
* '''getsid''': 310
* '''settid_with_pid''': 311
* '''__pthread_cond_timedwait''': 312
* '''aio_fsync''': 313
* '''aio_return''': 314
* '''aio_suspend''': 315
* '''aio_cancel''': 316
* '''aio_error''': 317
* '''aio_read''': 318
* '''aio_write''': 319
* '''lio_listio''': 320
* '''__pthread_cond_wait''': 321
* '''iopolicysys''': 322
* '''mlockall''': 324
* '''munlockall''': 325
* '''issetugid''': 327
* '''__pthread_kill''': 328
* '''__pthread_sigmask''': 329
* '''__sigwait''': 330
* '''__disable_threadsignal''': 331
* '''__pthread_markcancel''': 332
* '''__pthread_canceled''': 333
* '''proc_info''': 336
* '''stat64''': 338
* '''fstat64''': 339
* '''lstat64''': 340
* '''stat64_extended''': 341
* '''lstat64_extended''': 342
* '''fstat64_extended''': 343
* '''getdirectories64''': 344
* '''statfs64''': 345
* '''fstatfs64''': 346
* '''getfsstat64''': 347
* '''__pthread_chdir''': 348
* '''__pthread_fchdir''': 349
* '''kqueue''': 362
* '''kevent''': 363
* '''lchown''': 364
* '''stack_snapshot''': 365
* '''kevent64''': 369
* '''__semwait_signal''': 370
* '''__semwait_signal_nocancel''': 371
* '''__mac_execve''': 380
* '''__mac_syscall''': 381
* '''__mac_get_file''': 382
* '''__mac_set_file''': 383
* '''__mac_get_link''': 384
* '''__mac_set_link''': 385
* '''__mac_get_proc''': 386
* '''__mac_set_proc''': 387
* '''__mac_get_fd''': 388
* '''__mac_set_fd''': 389
* '''__mac_get_pid''': 390
* '''__mac_get_lcid''': 391
* '''__mac_get_lctx''': 392
* '''__mac_set_lctx''': 393
* '''setlcid''': 394
* '''getlcid''': 395
* '''read_nocancel''': 396
* '''write_nocancel''': 397
* '''open_nocancel''': 398
* '''close_nocancel''': 399
* '''wait4_nocancel''': 400
* '''recvmsg_nocancel''': 401
* '''sendmsg_nocancel''': 402
* '''recvfrom_nocancel''': 403
* '''accept_nocancel''': 404
* '''msync_nocancel''': 405
* '''fnctl_nocancel''': 406
* '''select_nocancel''': 407
* '''fsync_nocancel''': 408
* '''connect_nocancel''': 409
* '''sigsuspend_nocancel''': 410
* '''readv_nocancel''': 411
* '''writev_nocancel''': 412
* '''sendto_nocancel''': 413
* '''pread_nocancel''': 414
* '''pwrite_nocancel''': 415
* '''waitid_nocancel''': 416
* '''poll_nocancel''': 417
* '''sem_wait_nocancel''': 420
* '''aio_suspend_nocancel''': 421
* '''__sigwait_nocancel''': 422
* '''__semwait_signal_nocancel''': 423
* '''__mac_mount''': 424
* '''__mac_get_mount''': 425
* '''__mac_getfsstat''': 426
* '''fsgetpath_1''': 427
* '''_audit_session_self''': 428
* '''_audit_session_join''': 429

S5L8922

2011-11-18T18:41:20Z

Zmaster: /* Kernel */

This is the processor used in the [[N18ap|iPod touch 3G]].

== Exploits ==
=== [[iBoot]] ===
* [[usb_control_msg(0x21, 2) Exploit]] - Works up to [[iOS]] 3.1.2

=== [[S5L8922 (Bootrom)|Bootrom]] ===
[[User:Geohot|Geohot]] has made use of his previously undisclosed bootrom exploit in [[limera1n]]. It is also implemented in Chronic Dev's [[Greenpois0n (toolkit)|greenpois0n]]. Source code for Greenpois0n can be found here: https://github.com/Chronic-Dev/syringe

=== [[Kernel]] ===
* [[BPF STX Kernel Write Exploit]] - Works up to [[iOS]] 3.1.3
* [[IOSurface Kernel Exploit]] - Works up to [[iOS]] 4.0
* [[Packet Filter Kernel Exploit]] - Works up to [[iOS]] [[JasperVail 8C5115c (iPod touch 3G)|4.2b3]]
* [[HFS Legacy Volume Name Stack Buffer Overflow]] - Works up to [[iOS]] [[Jasper 8C148 (iPod touch 3G)|4.2.1]]
* [[ndrv_setspec() Integer Overflow]] - Works on [[iOS]] [[Durango 8J2 (iPod touch 3G)|4.3.1 / 4.3.2 / 4.3.3]]

=== [[Userland]] ===
* [[MobileBackup Copy Exploit]] - Works up to [[iOS]] 3.1.3
* [[Malformed CFF Vulnerability]] - Works up to [[iOS]] 4.0
* [[T1 Font Integer Overflow]] - Works up to [[iOS]] 4.3.3

==Information==

The load address is at 0x41000000 (same as the [[S5L8920]]).

== Boot Chain ==
[[S5L8922 (Bootrom)|Bootrom]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[Firmware|System Software]]

The entire boot chain (except the bootrom) resides on the [[NAND]] flash (instead of part of it on [[NOR]] flash as in earlier devices).
This is the only main difference from the [[S5L8920]] used in the [[N88ap|iPhone 3GS]].

== See also ==
* [[S5L8922 (Bootrom)]]
* [[S5L8922 (Hardware)]]

==External Links==
* [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf Technical Reference Manual: ARM1176JZF-S]

Telluride 9A402 (iPad1,1)

2011-11-04T00:07:36Z

Zmaster: keys

== Decryption Keys ==
=== [[:/|Root Filesystem]] ({{#if:{{{rootfsdmg|}}}|{{{rootfsdmg|}}}|018-8029-086}}.dmg) ===
* '''[[VFDecrypt]] Key''': f6b52151627b37c0678e85471b4ac07921f95e71855be247acacdcf5261e52f9b4c742e7

=== [[Update Ramdisk]] ({{#if:{{{updatedmg|}}}|{{{updatedmg|}}}|018-7910-348}}.dmg) ===
* '''IV''': edf85c5df6d4c101747357645a9f08b2
* '''Key''': 0f757c7418b0c31cb0f10a2249f9bf5417434763b39de9066928151cb085c143

=== [[Restore Ramdisk]] ({{#if:{{{restoredmg|}}}|{{{restoredmg|}}}|038-3577-004}}.dmg) ===
* '''IV''': df1722388a4ca41853c8eae4d7dbf13c
* '''Key''': 3afaa18e256219a834b1e95e01f46b622c6b5cd9d68ea3d6c87a7e4648f8db38

=== [[AppleLogo]] ===
* '''IV''': TODO
* '''Key''': TODO

=== [[BatteryCharging0]] ===
* '''IV''': TODO
* '''Key''': TODO

=== [[BatteryCharging1]] ===
* '''IV''': TODO
* '''Key''': TODO

=== [[BatteryFull]] ===
* '''IV''': TODO
* '''Key''': TODO

=== [[BatteryLow0]] ===
* '''IV''': TODO
* '''Key''': TODO

=== [[BatteryLow1]] ===
* '''IV''': TODO
* '''Key''': TODO

=== [[DeviceTree]] ===
* '''IV''': TODO
* '''Key''': TODO

=== [[GlyphCharging]] ===
* '''IV''': TODO
* '''Key''': TODO

=== [[GlyphPlugin]] ===
* '''IV''': TODO
* '''Key''': TODO

=== [[iBEC]] ===
* '''IV''': ea8eaf29acdc85a66dfc060212d3bb6a
* '''Key''': cf022164277fcc4450ce81ddeeae934f1ace62bbbce64fcf7e0f22c0d9a8e595

=== [[iBoot]] ===
* '''IV''': 55d2edcbf957596a444081ca985bc320
* '''Key''': cb262f82aba6075a0fc9854e242e9c0944238f8089334f67a7ad3e86df0d546a

=== [[iBSS]] ===
* '''IV''': 9c5186f10dc765010c0997414da4f06a
* '''Key''': fc04446c52f6b40589e2b9339d9158302ae6d20368bb4dd0df9f649535167f00

=== [[Kernelcache]] ===
* '''IV''': cbf88d44ea4e6f11c8d9a39cb9775ab4
* '''Key''': 6c9a232cf7e499c340950597019e66513f3ae632dfdd6274065255690f689a5f

=== [[LLB]] ===
* '''IV''': 485ed1f9cd299e7bd44ec6853d00945a
* '''Key''': 7334fa22ce6523292ff1e07445ead14bf0f301d12021fd23b04f2f5ff214aba5

Talk:PurpleRestore

2011-07-22T13:06:03Z

Zmaster:

Where does the Reverse Engineer Information come from? From the original program ? --[[User:M2m|M2m]] 08:10, 1 October 2010 (UTC)

:I just removed it. According to page history it came from [[User:EinCodierer|EinCodierer]], someone just beginning to learn assembler. These few assembler instructions weren't of any help understanding [[PurpleRestore]]. -- [[User:Http|http]] 10:35, 1 October 2010 (UTC)

::Would just be interesting if this is some hidden code out fo itunes, the iphone kernel or wherever else... not just code without knowing where it came from .... --[[User:M2m|M2m]] 11:24, 1 October 2010 (UTC)

:::That specific code that the user posted is from iTunes. It will detect if PurpleRestore is running so that it does not interfere with any operations that PurpleRestore is performing. [[User:ChronicDev|Will Strafach]] 14:43, 2 October 2010 (UTC)

::::Thanks for the clarification ! --[[User:M2m|M2m]] 09:49, 3 October 2010 (UTC)

:::If you think it's useful for anything, we can put it back in. With some more comments perhaps. --[[User:Http|http]] 09:54, 3 October 2010 (UTC)
:::I thought this was an old Cydia tool on the iPhone and thought a few x86 assembly lines were totally unrelated. As this seems to be a "secret" Apple flashing tool running on PC or Mac, this code makes a little more sense, so I added it back (from history) with Will's comments and reformatted. --[[User:Http|http]] 05:04, 22 July 2011 (MDT)

WHATS THIS?? {{unsigned|Zmaster|16:46, 21 July 2011 (UTC)}}
:What is your question exactly? --[[User:Http|http]] 05:04, 22 July 2011 (MDT)

is it a program? how it execute? what it do? --[[User:Zmaster|Zmaster]] 07:06, 22 July 2011 (MDT)

Animate

2011-07-21T15:16:02Z

Zmaster: source code

{{lowercase}}
'''animate''' (Package name: '''''BootLogo''''', Package ID: <code>org.chronic-dev.animate</code>) is a software bundled in [[greenpois0n (jailbreak)|greenpois0n RC5]] that enables users to display (a sequence of) PNG images on boot.

This approach has the advantage of being usable on all devices, regardless of their ability of [[0x24000 Segment Overflow|accepting custom firmware]], and supporting animated boot logos.

[[Applelogo|The original boot logo]] will always show first.

== Notes for logo designers ==
The animation currently runs at about 5 frames per second.

A picture of the Apple logo is available at http://yfrog.com/gzqigp

Animations must be stored in png format in [[/Library]]/BootLogos/(animationName)/ and be listed in order, from 0.png to x.png.

Packages containing (animated) logos should depend on <code>org.chronic-dev.animate</code>.

== Installation ==
The '''animate''' tweak has been released on Cydia but it is invisible for some reason. To install it, search and install a package named ''Apple boot logo'' ('''animate''' is a dependency). After the installation, a new tab will appear in the [[:/var/stash/Applications.*****/Preferences.app|Settings app]] named ''BootLogos''. Anyone having trouble keeping settings should be sure that /Library/BootLogos/ is chown mobile:mobile. Sometime uninstalling all boot animation packages and reinstalling fixes this issue.

== Conflicts ==
'''animate''' conflicts with the package '''ImageMagick''' (Package ID: <code>imagemagick</code>). It has to be removed in order to successfully install '''animate'''. Currently, [[Cydia.app|Cydia]] will not display a conflict, but the conflict is still there.

== Dependencies ==
'''animate''' uses [[PreferenceLoader]] to add a new page to the Settings app.

== References ==
[[User:Jaywalker|Jaywalker's]] [http://www.twitlonger.com/show/8lepqg notes]

== Source Code ==
The Source Code was released on [https://github.com/Chronic-Dev/animate github]

Greenpois0n (toolkit)

2011-07-21T15:10:47Z

Zmaster:

{{lowercase}}
[[Image:gp.png|200px|right|greenpois0n]]
{{other|toolkit|jailbreak|greenpois0n (jailbreak)}}
*[http://github.com/Chronic-Dev/syringe GreenPois0n Syringe]: Greenpois0n's exploit injector, to assist in booting devices into jailbroken states.
*[http://github.com/Chronic-Dev/cyanide GreenPois0n Cyanide]: [[iBoot]] payload toolkit to help developers discover new vulnerabilities and design super fast, low-level iBoot jailbreaks and exploit payloads, much like the way [[blackra1n]]/[[purplera1n]] works.
*[http://github.com/Chronic-Dev/libdioxin GreenPois0n Dioxin]: MobileDevice toolkit designed to help developers design awesome userland jailbreaks, like how [[Spirit]] works.
*[http://github.com/Chronic-Dev/anthrax GreenPois0n Anthrax]: iPhone ramdisk toolkit to help developers design extremely stable and portable ramdisk jailbreaks, much like the same way [[QuickPwn]]/[[redsn0w]] works.
*[http://github.com/Chronic-Dev/arsenic GreenPois0n Arsenic]: custom firmware toolkit to help developers design jailbreaks to help preserve [[Baseband Firmware|baseband]] and keep unlocks, much in the same way [[PwnageTool]]/[[sn0wbreeze]] works. (Never Released)

Source Code: [https://github.com/Chronic-Dev Greenpois0n]

[[Category:greenpois0n|toolkit]]

Talk:Making PwnageTool Bundles

2011-07-21T15:09:56Z

Zmaster: Created page with "How we patch img3 with IDA? --~~~~"

How we patch img3 with IDA? --[[User:Zmaster|Zmaster]] 09:09, 21 July 2011 (MDT)

/sbin

2011-07-21T15:03:57Z

Zmaster:

Part of the Ramdisk
Important files like "mount", "launchd" ,"fsck". Used during boot.
If you uninstall sbin from Cydia or delete this folder, the iPhone will get into a boot loop. Only a restore can help you out.

T1 Font Integer Overflow

2011-07-21T14:58:27Z

Zmaster: apple patched this

The '''T1 Font Integer Overflow''' (A.K.A '''DejaVu''' as it is very similar to the [[Malformed CFF Vulnerability]][https://twitter.com/comex/status/88208990789578752]) is a vulnerability used in [[Saffron]].

== Credit for Exploitation ==
* [[User:comex|comex]]

== Description ==
When dealing with op_callothersubr, arg_cnt is defined as an integer. arg_cnt is read from decoder‑>stack, which could be set to 0xfea50000 by charstring "fb ef". And this will bypass stack checking. Then "top ‑= arg_cnt" will make top point to data outside of decoder‑>stack. Actually it points to decoder‑>parse_callback. decoder‑>parse_callback address minus default address of that function to get ASLR offset. That's how it bypasses ASLR.

This vulnerability was actually addressed by Apple in {{wp|Mac OS X Snow Leopard|Mac OS X v10.6.8}}/[http://support.apple.com/kb/HT4723 Security Update 2011-004] (Its CVE identifier is ''CVE-2011-0202''.)

When Apple released iOS 4.2.9/4.3.4 to patch this vulnerability, it received a different CVE identifier (CVE-2011-0226).

==Sources==
* Tweets from [https://twitter.com/windknown @windknown]: [https://twitter.com/windknown/status/88170553948651520][https://twitter.com/windknown/status/88171950886760448][https://twitter.com/windknown/status/88172830029651968][https://twitter.com/windknown/status/88173940391940096]
* [http://support.apple.com/kb/HT4723 Apple KB]
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0202
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0226
* http://intrepidusgroup.com/insight/2011/07/reversing-jailbreakme-com-4/
* http://esec-lab.sogeti.com/post/Analysis-of-the-jailbreakme-v3-font-exploit

[[Category:Exploits]]

Talk:PurpleRestore

2011-07-21T14:46:54Z

Zmaster:

Firmware

2011-07-16T02:44:05Z

Zmaster: /* iPad */

Latest Apple download links can be found [http://www.itunes.com/version here].

==[[Apple TV]]==
{{:Firmware/Apple TV 2G}}

==[[iPad]]==

===[[K48ap|iPad]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPad Firmware Versions|Baseband]] (3G only)
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 3.2
| [[Wildcat 7B367 (iPad)|Wildcat 7B367]]
|rowspan="3" | [[6.15.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPad/061-7987.20100403.mjiTr/iPad1,1_3.2_7B367_Restore.ipsw iPad1,1_3.2_7B367_Restore.ipsw]
| <code>172e8297af74b91971a802e6ad137c891f553099</code>
| Initial shipment.
| {{yes}}
| 478,959,325
|-
| 3.2.1
| [[Wildcat 7B405 (iPad)|Wildcat 7B405]]
| [http://appldnld.apple.com/iPad/061-8282.20100713.vgtgh/iPad1,1_3.2.1_7B405_Restore.ipsw iPad1,1_3.2.1_7B405_Restore.ipsw]
| <code>de0a2b64cd335d48fb4abc9ed8700f5dbdf768ca</code>
|
| {{yes}}
| 479,012,625
|-
| 3.2.2
| [[Wildcat 7B500 (iPad)|Wildcat 7B500]]
| [http://appldnld.apple.com/iPad/061-8801.20100811.CvfR5/iPad1,1_3.2.2_7B500_Restore.ipsw iPad1,1_3.2.2_7B500_Restore.ipsw]
| <code>68b613f78581d36eab96aa5a007001dff142baa3</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 479,001,595
|-
| 4.2.1
| [[Jasper 8C148 (iPad)|Jasper 8C148]]
| [[7.10.00]]
| [http://appldnld.apple.com/iPad/061-9857.20101122.VGthy/iPad1,1_4.2.1_8C148_Restore.ipsw iPad1,1_4.2.1_8C148_Restore.ipsw]
| <code>8717b3bedc925b587566442ad375aa65d857e79a</code>
|
| {{yes}}
| 578,084,840
|-
| 4.3
| [[Durango 8F190 (iPad)|Durango 8F190]]
| [[7.11.00]]
| [http://appldnld.apple.com/iPhone4/041-0329.20110311.Cvfre/iPad1,1_4.3_8F190_Restore.ipsw iPad1,1_4.3_8F190_Restore.ipsw]
| <code>fc97d5959a1e29d707586871004ea12e95815237</code>
|
| {{yes|Yes1}}
| 625,814,678
|-
| 4.3.1
| [[Durango 8G4 (iPad)|Durango 8G4]]
|rowspan="3"| [[7.11.01]]
| [http://appldnld.apple.com/iPhone4/041-0550.20110325.Zsw6y/iPad1,1_4.3.1_8G4_Restore.ipsw iPad1,1_4.3.1_8G4_Restore.ipsw]
| <code>6615b368d665630e80da975232567daf87a042b6</code>
|
| {{yes}}
| 621,768,387
|-
| 4.3.2
| [[Durango 8H7 (iPad)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0661.20110414.W9Q8r/iPad1,1_4.3.2_8H7_Restore.ipsw iPad1,1_4.3.2_8H7_Restore.ipsw]
| <code>2c86c5915a8f9e56776deba22dc048c2f42db8b7</code>
|
| {{yes}}
| 622,148,907
|-
| 4.3.3
| [[Durango 8J3 (iPad)|Durango 8J3]]
| [http://appldnld.apple.com/iPhone4/041-1010.20110503.ScEp3/iPad1,1_4.3.3_8J3_Restore.ipsw iPad1,1_4.3.3_8J3_Restore.ipsw]
| <code>e2906ef04d5991663cd6ea8b19548ec190144d46</code>
|
| {{yes}}
| 622,048,364
|-
| 4.3.4
| [[Durango 8K2 (iPad)|Durango 8K2]]
|rowspan="3"| [[7.11.01]]
| [http://appldnld.apple.com/iPhone4/041-1913.20110715.cvTyu/iPad1,1_4.3.4_8K2_Restore.ipsw iPad1,1_4.3.4_8K2_Restore.ipsw ]
| <code>3c38b8c3792141484f6a8cffae0a38c25947ec28</code>
| Saffron Exploit Closed :(
| {{yes}}
| 622,279,895
|}

1 [[Tethered jailbreak]] only.

===[[iPad 2]]===
====[[K93ap|Wi-Fi model]]====
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.3
| [[Durango 8F191 (iPad 2 Wi-Fi)|Durango 8F191]]
| [http://appldnld.apple.com/iPhone4/041-0368.20110311.SwtHr/iPad2,1_4.3_8F191_Restore.ipsw iPad2,1_4.3_8F191_Restore.ipsw]
| <code>c4db3a44dc0986bc8344f7672cfa0255bea8af14</code>
| Initial shipment.
| {{yes}}
| 641,816,049
|-
| 4.3.1
| [[Durango 8G4 (iPad 2 Wi-Fi)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0556.20110325.64rfg/iPad2,1_4.3.1_8G4_Restore.ipsw iPad2,1_4.3.1_8G4_Restore.ipsw]
| <code>becf01c807e4c9f2654e3ffd1b83973f512ae51d</code>
|
| {{no}}
| 636,932,642
|-
| 4.3.2
| [[Durango 8H7 (iPad 2 Wi-Fi)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0663.20110414.U7bTI/iPad2,1_4.3.2_8H7_Restore.ipsw iPad2,1_4.3.2_8H7_Restore.ipsw]
| <code>f3df44893159ec283166a77ee75fe091ac0899b0</code>
|
| {{no}}
| 637,204,516
|-
| 4.3.3
| [[Durango 8J2 (iPad 2 Wi-Fi)|Durango 8J2]]
| [http://appldnld.apple.com/iPhone4/041-1012.20110503.tmmBc/iPad2,1_4.3.3_8J2_Restore.ipsw iPad2,1_4.3.3_8J2_Restore.ipsw]
| <code>71142e8c876ceaf64799727fc79726d1264aab6c</code>
|
| {{yes}}
| 637,183,974
|}

====[[K94ap|GSM model]]====
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[XMM 6180#Known Firmware Versions|Baseband]]
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.3
| [[Durango 8F191 (iPad 2 GSM)|Durango 8F191]]
|rowspan="4"| [[4.10.01]]
| [http://appldnld.apple.com/iPhone4/041-0369.20110311.Xzsew/iPad2,2_4.3_8F191_Restore.ipsw iPad2,2_4.3_8F191_Restore.ipsw]
| <code>03f4af63f7751e429aef57ae00e675f96b271573</code>
| Initial shipment.
| {{yes}}
| 649,374,499
|-
| 4.3.1
| [[Durango 8G4 (iPad 2 GSM)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0557.20110325.Jy76y/iPad2,2_4.3.1_8G4_Restore.ipsw iPad2,2_4.3.1_8G4_Restore.ipsw]
| <code>862dbf2c94dc2f30b02101905a91a45c95c353a7</code>
|
| {{no}}
| 644,359,977
|-
| 4.3.2
| [[Durango 8H7 (iPad 2 GSM)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0664.20110414.39vUS/iPad2,2_4.3.2_8H7_Restore.ipsw iPad2,2_4.3.2_8H7_Restore.ipsw]
| <code>e52bd4bd8eabd48e5cfd02f895292d5644e805be</code>
|
| {{no}}
| 644,615,497
|-
| 4.3.3
| [[Durango 8J2 (iPad 2 GSM)|Durango 8J2]]
| [http://appldnld.apple.com/iPhone4/041-1013.20110503.1m73D/iPad2,2_4.3.3_8J2_Restore.ipsw iPad2,2_4.3.3_8J2_Restore.ipsw]
| <code>e378037ce0689013bf7f4689dfbb162c3c4edd16</code>
|
| {{yes}}
| 644,652,318
|}

====[[K95ap|CDMA model]]====
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| Baseband
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.3
| [[Durango 8F191 (iPad 2 CDMA)|Durango 8F191]]
|rowspan="4"| [[2.0.4]]
| [http://appldnld.apple.com/iPhone4/041-0334.20110311Plgt5/iPad2,3_4.3_8F191_Restore.ipsw iPad2,3_4.3_8F191_Restore.ipsw]
| <code>435b84104aa3f0ae7883f9d6b1a7a3e96e552dd2</code>
| Initial shipment.
| {{yes}}
| 656,018,665
|-
| 4.3.1
| [[Durango 8G4 (iPad 2 CDMA)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0544.20110325.Dew3r/iPad2,3_4.3.1_8G4_Restore.ipsw iPad2,3_4.3.1_8G4_Restore.ipsw]
| <code>1903162ce3ffa9725304eb78275583977d1808cc</code>
|
| {{no}}
| 650,897,625
|-
| 4.3.2
| [[Durango 8H8 (iPad 2 CDMA)|Durango 8H8]]
| [http://appldnld.apple.com/iPhone4/041-0665.20110414.MbwVr/iPad2,3_4.3.2_8H8_Restore.ipsw iPad2,3_4.3.2_8H8_Restore.ipsw]
| <code>aee35de332048941f72bfbbbdf8591a1f306c65d</code>
|
| {{no}}
| 651,222,830
|-
| 4.3.3
| [[Durango 8J2 (iPad 2 CDMA)|Durango 8J2]]
| [http://appldnld.apple.com/iPhone4/041-1014.20110503.52dap/iPad2,3_4.3.3_8J2_Restore.ipsw iPad2,3_4.3.3_8J2_Restore.ipsw]
| <code>f087ae60c778f32bdd130043f8b67a96939489f3</code>
|
| {{yes}}
| 651,189,996
|}

==[[iPhone]]==
===[[M68ap|iPhone]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[Baseband Firmware]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="91"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 1.0
| [[Alpine 1A420]]
| [http://img399.imageshack.us/i/iphone2go0.jpg/ 3.06.01_G]
| iphoneproto.zip
| <code>6e798e906c6590a7521ef89b731569be6d05b3aa</code>
| Prototype; [http://forums.macrumors.com/showthread.php?t=627449 macrumors]
| {{no}}
| {{no}}
| 109,813,128
|-
| 1.0.0
| [[Heavenly 1A543a (iPhone)|Heavenly 1A543a]]
| [[3.11.02_G]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw iPhone1,1_1.0_1A543a_Restore.ipsw]
| <code>fb8bb3ee2e9a997affbb97868599f2995c78209c</code>
| Initial US shipment.
| {{yes}}
| {{yes}}
| 95,604,348
|-
| 1.0.1
| [[Heavenly 1C25 (iPhone)|Heavenly 1C25]]
| [[3.12.06_G]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw iPhone1,1_1.0.1_1C25_Restore.ipsw]
| <code>a00b85a7a55d62a94be5fbf5effbc42fd63f3097</code>
|
| {{yes}}
| {{yes}}
| 95,627,958
|-
| 1.0.2
| [[Heavenly 1C28 (iPhone)|Heavenly 1C28]]
| [[3.14.08_G]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw iPhone1,1_1.0.2_1C28_Restore.ipsw]
| <code>7f5c0ff1f84a0202b75a55c3fcb362e415334d1e</code>
|
| {{yes}}
| {{yes}}
| 95,627,324
|-
| 1.1.1
| [[Snowbird 3A109a (iPhone)|Snowbird 3A109a]]
| [[4.01.13_G]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw iPhone1,1_1.1.1_3A109a_Restore.ipsw]
| <code>d441dd1c71ce18f25d8fc4faa71c1e6eaa02d02c</code>
|
| {{yes}}
| {{yes}}
| 159,668,150
|-
| 1.1.2
| [[Oktoberfest 3B48b (iPhone)|Oktoberfest 3B48b]]
| [[4.02.13_G]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw iPhone1,1_1.1.2_3B48b_Restore.ipsw]
| <code>797c02e7d660940e8d9a16cc7229ccf3f67dd8b1</code>
| Initial Euro shipment.
| {{yes}}
| {{yes}}
| 167,927,501
|-
| 1.1.3
| [[Little Bear 4A93 (iPhone)|Little Bear 4A93]]
| [[4.03.13_G]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw iPhone1,1_1.1.3_4A93_Restore.ipsw]
| <code>b3dec7580bd00dc4faf28449d9618ef40aeacc96</code>
|
| {{yes}}
| {{yes}}
| 169,950,551
|-
| 1.1.4
| [[Little Bear 4A102 (iPhone)|Little Bear 4A102]]
| [[4.04.05_G]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw iPhone1,1_1.1.4_4A102_Restore.ipsw]
| <code>000811bac096011b50ebf6ec1ec2285b62fda4cb</code>
|
| {{yes}}
| {{yes}}
| 169,946,442
|-
| 2.0
| [[Big Bear 5A347 (iPhone)|Big Bear 5A347]]
| rowspan="11" | [[4.05.04_G]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4956.20080710.V50OI/iPhone1,1_2.0_5A347_Restore.ipsw iPhone1,1_2.0_5A347_Restore.ipsw]
| <code>9c510a3cfce789fa5f92a8f763c231bac82ff6d4</code>
|
| {{yes}}
|rowspan="11" {{yes|[[BootNeuter]]}}
| 228,768,637
|-
| 2.0.1
| [[Big Bear 5B108 (iPhone)|Big Bear 5B108]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5135.20080729.Vfgtr/iPhone1,1_2.0.1_5B108_Restore.ipsw iPhone1,1_2.0.1_5B108_Restore.ipsw]
| <code>61de6a2bd6ceddc9ecabad1671b91a59b3824bc4</code>
|
| {{yes}}
| 254,048,068
|-
| 2.0.2
| [[Big Bear 5C1 (iPhone)|Big Bear 5C1]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw iPhone1,1_2.0.2_5C1_Restore.ipsw]
| <code>b84b57bea919bdc720287ec908c1378e7d7b5e1b</code>
|
| {{yes}}
| 253,589,000
|-
| 2.1
| [[Sugar Bowl 5F136 (iPhone)|Sugar Bowl 5F136]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5202.20080909.gkbEj/iPhone1,1_2.1_5F136_Restore.ipsw iPhone1,1_2.1_5F136_Restore.ipsw]
| <code>353b7745767b85932e14e262e69463620939bdf7</code>
|
| {{yes}}
| 242,171,241
|-
| 2.2
| [[Timberline 5G77 (iPhone)|Timberline 5G77]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5779.20081120.Pt5yH/iPhone1,1_2.2_5G77_Restore.ipsw iPhone1,1_2.2_5G77_Restore.ipsw]
| <code>cbfc6ff886ce89868a55547b9fb980dbf92e6418</code>
|
| {{yes}}
| 257,576,980
|-
| 2.2.1
| [[SUTimberline 5H11 (iPhone)|SUTimberline 5H11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5830.20090127.Mmni6/iPhone1,1_2.2.1_5H11_Restore.ipsw iPhone1,1_2.2.1_5H11_Restore.ipsw]
| <code>43b95ebe1e51f8d30eae916053396595c08440d3</code>
|
| {{yes}}
| 257,593,705
|-
| 3.0
| [[Kirkwood 7A341 (iPhone)|Kirkwood 7A341]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6580.20090617.XsP76/iPhone1,1_3.0_7A341_Restore.ipsw iPhone1,1_3.0_7A341_Restore.ipsw]
| <code>2afd3f8ede17390737f508473ed205506a0bd23f</code>
|
| {{yes}}
| 240,394,111
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6974.20090731.Cf4Tg/iPhone1,1_3.0.1_7A400_Restore.ipsw iPhone1,1_3.0.1_7A400_Restore.ipsw]
| <code>34c391fbbc7b31b159372766de39ce5c9cc26ebb</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 240,439,502
|-
| 3.1
| [[Northstar 7C144 (iPhone)|Northstar 7C144]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6605.20090909.PQ3ws/iPhone1,1_3.1_7C144_Restore.ipsw iPhone1,1_3.1_7C144_Restore.ipsw]
| <code>b7b5f436f81c6f855410e8b44a3d432ccaacd6fc</code>
|
| {{yes}}
| 252,536,460
|-
| 3.1.2
| [[Northstar 7D11 (iPhone)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7268.20091008.32pNe/iPhone1,1_3.1.2_7D11_Restore.ipsw iPhone1,1_3.1.2_7D11_Restore.ipsw]
| <code>e4a1171542dbbd3093516d9c02047b9f7e143050</code>
|
| {{yes}}
| 252,515,888
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone)|SUNorthstarTwo 7E18]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7481.20100202.4orot/iPhone1,1_3.1.3_7E18_Restore.ipsw iPhone1,1_3.1.3_7E18_Restore.ipsw]
| <code>eab23a7f8d2a17cb71046c50fc5f67ec390a3c2b</code>
|
| {{yes}}
| 238,319,275
|}

===[[N82ap|iPhone 3G]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="90"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 2.0
| [[Big Bear 5A345 (iPhone 3G)|Big Bear 5A345]]
|rowspan="2" | [[1.45.00]]
| No download available
|
| Initial shipment.
| {{yes}}
|rowspan="5" {{partial|Upgrade to 2.2}}
|
|-
| 2.0
| [[Big Bear 5A347 (iPhone 3G)|Big Bear 5A347]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4955.20080710.bgt53/iPhone1,2_2.0_5A347_Restore.ipsw iPhone1,2_2.0_5A347_Restore.ipsw]
| <code>af9506ca0034e462674f9f59c5406f159eaf9fc1</code>
|
| {{yes}}
| 235,957,125
|-
| 2.0.1
| [[Big Bear 5B108 (iPhone 3G)|Big Bear 5B108]]
| [[1.48.02]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5134.20080729.Q2W3E/iPhone1,2_2.0.1_5B108_Restore.ipsw iPhone1,2_2.0.1_5B108_Restore.ipsw]
| <code>e81c7ac7e334a3e9d81b3b47894bfaa1ec495482</code>
|
| {{yes}}
| 261,224,227
|-
| 2.0.2
| [[Big Bear 5C1 (iPhone 3G)|Big Bear 5C1]]
| [[2.08.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw iPhone1,2_2.0.2_5C1_Restore.ipsw]
| <code>bef7fef954293046420fbcf947379839178a195b</code>
|
| {{yes}}
| 260,761,030
|-
| 2.1
| [[Sugar Bowl 5F136 (iPhone 3G)|Sugar Bowl 5F136]]
| [[2.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5198.20080909.K3294/iPhone1,2_2.1_5F136_Restore.ipsw iPhone1,2_2.1_5F136_Restore.ipsw]
| <code>c6957dcbf2a95ccfd6dce374a727b1b7700a9043</code>
|
| {{yes}}
| 249,341,655
|-
| 2.2
| [[Timberline 5G77 (iPhone 3G)|Timberline 5G77]]
| [[2.28.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5778.20081120.Aqw4R/iPhone1,2_2.2_5G77_Restore.ipsw iPhone1,2_2.2_5G77_Restore.ipsw]
| <code>f67f8b2b842428bf89456cda0c2d5cf954d111a4</code>
|
| {{yes}}
| {{yes|[[Ultrasn0w|yellowsn0w]]}}
| 258,342,348
|-
| 2.2.1
| [[SUTimberline 5H11 (iPhone 3G)|SUTimberline 5H11]]
| [[2.30.03]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5828.20090127.aQLi8/iPhone1,2_2.2.1_5H11_Restore.ipsw iPhone1,2_2.2.1_5H11_Restore.ipsw]
| <code>e0098e6fab5c90b59e067e03ae3ccd4a7cd0f39c</code>
|
| {{yes}}
| {{partial|Upgrade to 3.0}}
| 258,359,073
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3G)|Kirkwood 7A341]]
|rowspan="2" | [[4.26.08]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6578.20090617.VfgtU/iPhone1,2_3.0_7A341_Restore.ipsw iPhone1,2_3.0_7A341_Restore.ipsw]
| <code>94f1fb43de12bff0f168ce690b7e794cc6220ae3</code>
|
| {{yes}}
|rowspan="2" {{yes|[[ultrasn0w]]}}
| 241,229,233
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone 3G)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6972.20090731.Zx3Rr/iPhone1,2_3.0.1_7A400_Restore.ipsw iPhone1,2_3.0.1_7A400_Restore.ipsw]
| <code>a148ff39fa4dea499e7a9dd007b63e90c4f56666</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 241,274,617
|-
| 3.1
| [[Northstar 7C144 (iPhone 3G)|Northstar 7C144]]
|rowspan="2" | [[5.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6600.20090909.AwndZ/iPhone1,2_3.1_7C144_Restore.ipsw iPhone1,2_3.1_7C144_Restore.ipsw]
| <code>9b3b3c148170b012012278efda9ff5c38282d559</code>
|
| {{yes}}
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}
| 253,361,339
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7265.20091008.Xsd32/iPhone1,2_3.1.2_7D11_Restore.ipsw iPhone1,2_3.1.2_7D11_Restore.ipsw]
| <code>b1a6ab2771bb5da372ba75a8fa3e1d72b71359d0</code>
|
| {{yes}}
| 253,340,786
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3G)|SUNorthstarTwo 7E18]]
| [[5.12.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7468.20100202.pbnrt/iPhone1,2_3.1.3_7E18_Restore.ipsw iPhone1,2_3.1.3_7E18_Restore.ipsw]
| <code>f5950afca546f93e281ba3cdb08bc0cfed7f0896</code>
|
| {{yes}}
| {{yes|[[ultrasn0w]]}}
| 239,139,281
|-
| 4.0
| [[Apex 8A293 (iPhone 3G)|Apex 8A293]]
|rowspan="3" | [[5.13.04]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7436.20100621.58Yt4/iPhone1,2_4.0_8A293_Restore.ipsw iPhone1,2_4.0_8A293_Restore.ipsw]
| <code>ee1eba9281b902d7ff3f24d50f9aebff0df27f92</code>
|
| {{yes}}
|rowspan="3" {{yes|[[ultrasn0w]]}}
| 306,274,631
|-
| 4.0.1
| [[Apex 8A306 (iPhone 3G)|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8616.20100715.phnt4/iPhone1,2_4.0.1_8A306_Restore.ipsw iPhone1,2_4.0.1_8A306_Restore.ipsw]
| <code>940bd2b36c646f6673419eab661ac1f13248e592</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| 320,237,975
|-
| 4.0.2
| [[Apex 8A400 (iPhone 3G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8802.20100811.XcfpR/iPhone1,2_4.0.2_8A400_Restore.ipsw iPhone1,2_4.0.2_8A400_Restore.ipsw]
| <code>ee2bc74719170a7a2440b593b6f300727c930c69</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 320,216,794
|-
| 4.1
| [[Baker 8B117 (iPhone 3G)|Baker 8B117]]
| [[5.14.02]]
| [http://appldnld.apple.com/iPhone4/061-7932.20100908.3fgt5/iPhone1,2_4.1_8B117_Restore.ipsw iPhone1,2_4.1_8B117_Restore.ipsw]
|<code>d87bab469dd1146ab83ddcc23f03b3164d7e09d4</code>
|
| {{Yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 323,137,556
|-
|-
| 4.2.1
| [[Jasper 8C148 (iPhone 3G)|Jasper 8C148]]
| [[5.15.04]]
| [http://appldnld.apple.com/iPhone4/061-9853.20101122.Vfgt5/iPhone1,2_4.2.1_8C148_Restore.ipsw iPhone1,2_4.2.1_8C148_Restore.ipsw]
|<code>d2ed58586e8ca2153f2e2ec585bba8afc5173378</code>
|
| {{Yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 338,579,762
|-
|}

===[[N88ap|iPhone 3GS]]===
Units with the new bootrom began shipping around September 2009.

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[X-Gold 608#Known iPhone Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3|old bootrom]])
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-359.3.2|new bootrom]])
!width="80"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 3.0
| [[Kirkwood 7A341 (iPhone 3GS)|Kirkwood 7A341]]
|rowspan="2" | [[4.26.08]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6582.20090617.LlI87/iPhone2,1_3.0_7A341_Restore.ipsw iPhone2,1_3.0_7A341_Restore.ipsw]
| <code>d8534408c8679c830fd0c4e36ef9762c11ef73df</code>
| Initial shipment.
| {{yes}}
|rowspan="2" {{no|[[SHSH]]s unavailable at release}}
|rowspan="2" {{yes|[[ultrasn0w]]}}
| 312,292,933
|-
| 3.0.1
| [[Kirkwood 7A400 (iPhone 3GS)|Kirkwood 7A400]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6976.20090731.Vgbt5/iPhone2,1_3.0.1_7A400_Restore.ipsw iPhone2,1_3.0.1_7A400_Restore.ipsw]
| <code>30006575af931e3da0521febace005152cdb8853</code>
| Hotfix for an SMS exploit.
| {{yes}}
| 312,330,244
|-
| 3.1
| [[Northstar 7C144 (iPhone 3GS)|Northstar 7C144]]
|rowspan="2" | [[5.11.07]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-6609.20090909.mwws4/iPhone2,1_3.1_7C144_Restore.ipsw iPhone2,1_3.1_7C144_Restore.ipsw]
| <code>527c74f87588afa1d69c1e2c08eedc88f113013a</code>
|
| {{yes}}
| {{yes|Yes1}}
|rowspan="2" {{yes|[[blacksn0w]] or [[ultrasn0w]]}}
| 321,011,474
|-
| 3.1.2
| [[Northstar 7D11 (iPhone 3GS)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7270.20091008.phn32/iPhone2,1_3.1.2_7D11_Restore.ipsw iPhone2,1_3.1.2_7D11_Restore.ipsw]
| <code>6998bb7d9e869b2d89a08853312f9457d070fb1f</code>
|
| {{yes}}
| {{yes}}
| 321,015,700
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|SUNorthstarTwo 7E18]]
| [[5.12.01]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7472.20100202.8tugj/iPhone2,1_3.1.3_7E18_Restore.ipsw iPhone2,1_3.1.3_7E18_Restore.ipsw]
| <code>8cb3775e62c6f72059a962bf891b4e145b965052</code>
|
| {{yes}}
| {{yes}}
| {{yes|[[ultrasn0w]]}}
| 305,122,343
|-
| 4.0
| [[Apex 8A293 (iPhone 3GS)|Apex 8A293]]
|rowspan="3" | [[5.13.04]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7437.20100621.5urG8/iPhone2,1_4.0_8A293_Restore.ipsw iPhone2,1_4.0_8A293_Restore.ipsw]
| <code>e065245874c73510ceb8fa4bd9388b60d46eb252</code>
|
| {{yes}}
| {{yes}}
|rowspan="3" {{yes|[[ultrasn0w]]}}
| 396,281,280
|-
| 4.0.1
| [[Apex 8A306 (iPhone 3GS)‎|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8618.20100715.Zapn4/iPhone2,1_4.0.1_8A306_Restore.ipsw iPhone2,1_4.0.1_8A306_Restore.ipsw]
| <code>c2b6fb9a158547ce726baa1bf8f0558a71518fec</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| {{yes}}
| 396,322,891
|-
| 4.0.2
| [[Apex 8A400 (iPhone 3GS)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8805.20100811.Dcr4e/iPhone2,1_4.0.2_8A400_Restore.ipsw iPhone2,1_4.0.2_8A400_Restore.ipsw]
| <code>61d21363ced6e006cc226f9a0a0e9c6ed8e048ab</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| {{yes}}
| 396,310,640
|-
| 4.1
| [[Baker 8B117 (iPhone 3GS)|Baker 8B117]]
| [[5.14.02]]
| [http://appldnld.apple.com/iPhone4/061-7938.20100908.F3rCk/iPhone2,1_4.1_8B117_Restore.ipsw iPhone2,1_4.1_8B117_Restore.ipsw]
|<code>2d1657cd33ae23b8d4e79e41fe758d09d3c52e30</code>
|
| {{yes}}
| {{yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 400,572,133
|-
| 4.2.1
| [[Jasper 8C148a (iPhone 3GS)|Jasper 8C148a]]
| [[5.15.04]]
| [http://appldnld.apple.com/iPhone4/061-9895.20101122.Cdew2/iPhone2,1_4.2.1_8C148a_Restore.ipsw iPhone2,1_4.2.1_8C148a_Restore.ipsw]
| <code>2787bb9fbf18594279d05682e6fd16d2b9612a2a</code>
|
| {{yes}}
| {{yes}}
| {{partial|Upgrade baseband to [[6.15.00]]}}
| 420,813,164
|-
| 4.3
| [[Durango 8F190 (iPhone 3GS)|Durango 8F190]]
|rowspan="2"| [[5.16.00]]
| [http://appldnld.apple.com/iPhone4/041-0328.20110311.Lkhy6/iPhone2,1_4.3_8F190_Restore.ipsw iPhone2,1_4.3_8F190_Restore.ipsw]
| <code>d05108c7338f7df7026b2d9a84f632a096bace92</code>
|
| {{yes}}
| {{yes|Yes1}}
|rowspan="2" {{partial|Upgrade baseband to [[6.15.00]]}}
| 443,762,287
|-
| 4.3.1
| [[Durango 8G4 (iPhone 3GS)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0549.20110325.ZxP8u/iPhone2,1_4.3.1_8G4_Restore.ipsw iPhone2,1_4.3.1_8G4_Restore.ipsw]
| <code>6de986f2dbd16a65db122e7c54a70f31812d028a</code>
|
| {{yes}}
| {{yes}}
| 440,276,917
|-
| 4.3.2
| [[Durango 8H7 (iPhone 3GS)|Durango 8H7]]
|rowspan="2"| [[5.16.02]]
| [http://appldnld.apple.com/iPhone4/041-0660.20110414.Gwed5/iPhone2,1_4.3.2_8H7_Restore.ipsw iPhone2,1_4.3.2_8H7_Restore.ipsw]
| <code>4021a2d82971fc4c637f1fdb6ce7c4dcfb7ac0d7</code>
|
| {{yes}}
| {{yes}}
|rowspan="2" {{partial|Upgrade baseband to [[6.15.00]]}}
| 440,519,356
|-
| 4.3.3
| [[Durango 8J2 (iPhone 3GS)|Durango 8J2]]
| [http://appldnld.apple.com/iPhone4/041-1009.20110503.M73Yr/iPhone2,1_4.3.3_8J2_Restore.ipsw iPhone2,1_4.3.3_8J2_Restore.ipsw]
| <code>027aaf90744076551a93a7f78e9aae2c740f3b40</code>
|
| {{yes}}
| {{yes}}
| 440,519,759
|}

1 [[Tethered jailbreak]] only.

===[[N90ap|iPhone 4 (GSM model)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| [[XMM 6180#Known Firmware Versions|Baseband]]
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]?
!width="95"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 4.0
| [[Apex 8A293 (iPhone 4)|Apex 8A293]]
|rowspan="3" | [[1.59.00]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7380.20100621,Vfgb5/iPhone3,1_4.0_8A293_Restore.ipsw iPhone3,1_4.0_8A293_Restore.ipsw]
| <code>171c2a3995fa149f2a369ccd87f82c5c30da3f88</code>
| Initial shipment.
| {{yes}}
|rowspan="3" {{Yes|[[ultrasn0w]]}}
| 607,363,121
|-
| 4.0.1
| [[Apex 8A306 (iPhone 4)|Apex 8A306]]
| [http://appldnld.apple.com/iPhone4/061-8619.20100715.4Pnsx/iPhone3,1_4.0.1_8A306_Restore.ipsw iPhone3,1_4.0.1_8A306_Restore.ipsw]
| <code>a9cf20679273b7e502ab384854ba96cc2a54d532</code>
| New formula to calculate bars. Otherwise, it's the same as 4.0.
| {{yes}}
| 607,380,127
|-
| 4.0.2
| [[Apex 8A400 (iPhone 4)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8807.20100811.3Edre/iPhone3,1_4.0.2_8A400_Restore.ipsw iPhone3,1_4.0.2_8A400_Restore.ipsw]
| <code>19eb071cdb9f1601b106825d0a16b1449c6eef8c</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 607,375,880
|-
| 4.1
| [[Baker 8B117 (iPhone 4)|Baker 8B117]]
| [[2.10.04]]
| [http://appldnld.apple.com/iPhone4/061-7939.20100908.Lcyg3/iPhone3,1_4.1_8B117_Restore.ipsw iPhone3,1_4.1_8B117_Restore.ipsw]
|<code>a3f8a333ca181146b862ca6a59c9a6e7c27eba0b</code>
|
| {{yes}}
| {{No}}
| 618,501,195
|-
| 4.2.1
| [[Jasper 8C148 (iPhone 4)|Jasper 8C148]]
| [[3.10.01]]
| [http://appldnld.apple.com/iPhone4/061-9858.20101122.Er456/iPhone3,1_4.2.1_8C148_Restore.ipsw iPhone3,1_4.2.1_8C148_Restore.ipsw]
|<code>366b28e9c95936bd4b11a84d54fefaf079fd6411</code>
|
| {{yes}}
| {{No}}
| 654,550,096
|-
| 4.3
| [[Durango 8F190 (iPhone 4)|Durango 8F190]]
|rowspan="4"| [[4.10.01]]
| [http://appldnld.apple.com/iPhone4/041-0330.20110311.Cswe3/iPhone3,1_4.3_8F190_Restore.ipsw iPhone3,1_4.3_8F190_Restore.ipsw]
|<code>146cd896abb21680383fe675cbc99fc36d3cce57</code>
|
| {{yes|Yes1}}
|rowspan="4" {{No}}
| 702,264,955
|-
| 4.3.1
| [[Durango 8G4 (iPhone 4)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0551.20110325.Aw2Dr/iPhone3,1_4.3.1_8G4_Restore.ipsw iPhone3,1_4.3.1_8G4_Restore.ipsw]
|<code>6694f69c84d36248d5bb71ba78ddb1f4946260f0</code>
|
| {{yes}}
| 698,304,690
|-
| 4.3.2
| [[Durango 8H7 (iPhone 4)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0662.20110414.byQ84/iPhone3,1_4.3.2_8H7_Restore.ipsw iPhone3,1_4.3.2_8H7_Restore.ipsw]
|<code>211e556a558ad18921c8b837db65aa20a373db77</code>
|
| {{yes}}
| 698,525,410
|-
| 4.3.3
| [[Durango 8J2 (iPhone 4)|Durango 8J2]]
| [http://appldnld.apple.com/iPhone4/041-1011.20110503.q7fGc/iPhone3,1_4.3.3_8J2_Restore.ipsw iPhone3,1_4.3.3_8J2_Restore.ipsw]
|<code>b2e221543f24a66209c70e8465d037fe22afeefa</code>
|
| {{yes}}
| 698,558,606
|}

1 [[Tethered jailbreak]] only.

===[[N92ap|iPhone 4 (CDMA model)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="120"| Build
!width="70"| Baseband
!width="210"| IPSW Download URL
!width="220"| SHA1 Hash
!width="140"| Comments
!width="95"| Publicly available virgin [[jailbreak]]?
!width="95"| Publicly available virgin SW [[unlock]]?
!width="70"| File Size
|-
| 4.2.5
| [[Phoenix 8E128 (iPhone 4 CDMA)|Phoenix 8E128]]
|rowspan="2"| [[1.0.05]]
| No download available
| <code>?</code>
| Initial shipment.
| {{no}}
| rowspan="2" {{no}}
| ?
|-
| 4.2.6
| [[Phoenix 8E200 (iPhone 4 CDMA)|Phoenix 8E200]]
| [http://appldnld.apple.com/iPhone4/041-0177.20110131.Pyvrz/iPhone3,3_4.2.6_8E200_Restore.ipsw iPhone3,3_4.2.6_8E200_Restore.ipsw]
| <code>f32cf46790a473a6c12f9dbd3773bf40fbdf6eee</code>
| Initial shipment.
| {{yes}}
| 683,594,406
|-
| 4.2.7
| [[Phoenix 8E303 (iPhone 4 CDMA)|Phoenix 8E303]]
| rowspan="2"| [[1.0.06]]
| [http://appldnld.apple.com/iPhone4/041-0614.20110414.B47xa/iPhone3,3_4.2.7_8E303_Restore.ipsw iPhone3,3_4.2.7_8E303_Restore.ipsw]
| <code>724c173be65ffb1ca3ea5da73a331ddf1319884f</code>
|
| {{yes}}
| rowspan="2" {{no}}
| 684,508,142
|-
| 4.2.8
| [[Phoenix 8E401 (iPhone 4 CDMA)|Phoenix 8E401]]
| [http://appldnld.apple.com/iPhone4/041-1022.20110503.5g8k7/iPhone3,3_4.2.8_8E401_Restore.ipsw iPhone3,3_4.2.8_8E401_Restore.ipsw]
| <code>84a695036cc6ab4954147ac1822144b33fbc5c31</code>
|
| {{yes}}
| 684,458,963
|}
1 [[Tethered jailbreak]] only.

==[[iPod touch]]==
===[[N45ap|iPod touch (1st generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="100"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 1.1
| [[Snowbird 3A100a (iPod touch)|Snowbird 3A100a]]
| No download available
|
| Initial shipment.
| {{no}}
|
|-
| 1.1
| [[Snowbird 3A101a (iPod touch)|Snowbird 3A101a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3882.20070910.N8uyT/iPod1,1_1.1_3A101a_Restore.ipsw iPod1,1_1.1_3A101a_Restore.ipsw]
| <code>9b0d83c7f8b4328174a3f31e0e93f60e591ae143</code>
|
| {{no}}
| 157,890,186
|-
| 1.1.1
| [[Snowbird 3A110a (iPod touch)|Snowbird 3A110a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-3932.20070927.p23dD/iPod1,1_1.1.1_3A110a_Restore.ipsw iPod1,1_1.1.1_3A110a_Restore.ipsw]
| <code>84bbc6ea8bf29745195bc9926c1874f7c2a36f32</code>
|
| {{yes}}
| 157,906,686
|-
| 1.1.2
| [[Oktoberfest 3B48b (iPod touch)|Oktoberfest 3B48b]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4036.20071107.9g3DF/iPod1,1_1.1.2_3B48b_Restore.ipsw iPod1,1_1.1.2_3B48b_Restore.ipsw]
| <code>108d8ffe9ea75e61cd5e57170ad388b7fa00d923</code>
|
| {{yes}}
| 165,567,897
|-
| 1.1.3
| [[Little Bear 4A93 (iPod touch)|Little Bear 4A93]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-4060.20080115.9Iuh5/iPod1,1_1.1.3_4A93_Restore.ipsw iPod1,1_1.1.3_4A93_Restore.ipsw]
| <code>8dca23eec69d5ae58fbf3d4a23276e46cbb2e3c6</code>
|
| {{yes}}
| 173,511,411
|-
| 1.1.4
| [[Little Bear 4A102 (iPod touch)|Little Bear 4A102]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw iPod1,1_1.1.4_4A102_Restore.ipsw]
| <code>c148d1eb1c979bb6434175411d4a372103a4fdd2</code>
|
| {{yes}}
| 173,519,589
|-
| 1.1.5
| [[Little Bear 4B1 (iPod touch)|Little Bear 4B1]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4841.20080714.bgy8O/iPod1,1_1.1.5_4B1_Restore.ipsw iPod1,1_1.1.5_4B1_Restore.ipsw]
| <code>1b818911316e4248ee01d3ec67f9d39afc3db240</code>
|
| {{yes}}
| 173,519,637
|-
| 2.0
| [[Big Bear 5A347 (iPod touch)|Big Bear 5A347]]
| Download Link Prohibited
| <code>ae82798e85f9953b0f4798bad36187cb020c9d22</code>
| 2.0+ is a paid upgrade series
| {{yes}}
| 233,409,573
|-
| 2.0.1
| [[Big Bear 5B108 (iPod touch)|Big Bear 5B108]]
| Download Link Prohibited
| <code>a81b6e7af4b85ef436d047f9da57c0f694d8964a</code>
|
| {{yes}}
| 258,660,321
|-
| 2.0.2
| [[Big Bear 5C1 (iPod touch)|Big Bear 5C1]]
| Download Link Prohibited
| <code>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</code>
|
| {{yes}}
| 258,201,218
|-
| 2.1
| [[Sugar Bowl 5F137 (iPod touch)|Sugar Bowl 5F137]]
| Download Link Prohibited
| <code>fc7f6d0972927df502ffca47438ca75dcccffaf3</code>
|
| {{yes}}
| 251,155,156
|-
| 2.2
| [[Timberline 5G77 (iPod touch)|Timberline 5G77]]
| Download Link Prohibited
| <code>081a7de363230fb38d0ce092cbbe42f2a50c8a5f</code>
|
| {{yes}}
| 260,186,851
|-
| 2.2.1
| [[SUTimberline 5H11 (iPod touch)|SUTimberline 5H11]]
| Download Link Prohibited
| <code>fc69be9e421bc0630567184506ab771f6b7ef68b</code>
|
| {{yes}}
| 260,166,688
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>dff2bd14931225908a360fb8e60a336f17d2dd6d</code>
| 3.0+ is a paid upgrade series
| {{yes}}
| 242,458,552
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch)|Northstar 7C145]]
| Download Link Prohibited
| <code>c6270780c166db4c9f4f0a7fa945754a1f9fe7e8</code>
|
| {{yes}}
| 249,755,862
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch)|Northstar 7D11]]
| Download Link Prohibited
| <code>7367dd9ba58a3b9777307368a0128e696fdfc9a6</code>
|
| {{yes}}
| 249,780,497
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f897990f19d2f093b35e0813d7d77806404fb1f</code>
|
| {{yes}}
| 235,678,189
|}

===[[N72ap|iPod touch (2nd generation)]]===
Units with the new bootrom have model numbers that start with "MC."

{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="95"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.4|old bootrom]])
!width="100"| Publicly available virgin [[jailbreak]]? ([[IBoot-240.5.1|new bootrom]])
!width="70"| File Size
|-
| 2.1.1
| [[Sugar Bowl 5F138 (iPod touch 2G)|Sugar Bowl 5F138]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-5494.20080909.8i9o0/iPod2,1_2.1.1_5F138_Restore.ipsw iPod2,1_2.1.1_5F138_Restore.ipsw]
| <code>c3c700be49ad227d1152188e7c1e46b8958fd1e4</code>
| Initial shipment.
| {{yes|Yes1}}
|rowspan="4" {{no|Incompatible device/
firmware match}}
| 282,083,944
|-
| 2.2
| [[Timberline 5G77a (iPod touch 2G)|Timberline 5G77a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw iPod2,1_2.2_5G77a_Restore.ipsw]
| <code>34a0a489605f34d6cc6c9954edcaaf9a050deedc</code>
|
| {{no}}
| 291,123,491
|-
| 2.2.1
| [[SUTimberline 5H11a (iPod touch 2G)|SUTimberline 5H11a]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5863.20090127.rt56K/iPod2,1_2.2.1_5H11a_Restore.ipsw iPod2,1_2.2.1_5H11a_Restore.ipsw]
| <code>9af5625ea34acdd8abeb6fce71a72651d0c815d5</code>
|
| {{yes}}
| 291,140,244
|-
| 3.0
| [[Kirkwood 7A341 (iPod touch 2G)|Kirkwood 7A341]]
| Download Link Prohibited
| <code>0f7fc76d9b9aa826b5ab14be9821a315d3d9dc42</code>
| 3.x is a paid upgrade series
| {{yes}}
| 270,315,364
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 2G)|Northstar 7C145]]
| Download Link Prohibited
| <code>e0d8800a4fc7cc5be6976ddbceb43c2d2a7120d7</code>
| Initial shipment for units with the new bootrom.
| {{yes}}
| {{yes|Yes1}}
| 277,753,989
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 2G)|Northstar 7D11]]
| Download Link Prohibited
| <code>e7c83d4a5baec0e81816ae1cd1caf9a4dc38ebf0</code>
|
| {{yes}}
| {{yes}}
| 277,794,671
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|SUNorthstarTwo 7E18]]
| Download Link Prohibited
| <code>5f4f5c01eda2f811f73167e7d1f82dbeed82367b</code>
|
| {{yes}}
| {{yes}}
| 263,275,211
|-
| 4.0
| [[Apex 8A293 (iPod touch 2G)|Apex 8A293]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7435.20100621.tr49t/iPod2,1_4.0_8A293_Restore.ipsw iPod2,1_4.0_8A293_Restore.ipsw]
| <code>c026c373bc535496a6f901de2ba37d4a487413bf</code>
|
| {{yes}}
| {{yes}}
| 330,278,777
|-
| 4.0.2
| [[Apex 8A400 (iPod touch 2G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8551.20100811.Xcder/iPod2,1_4.0.2_8A400_Restore.ipsw iPod2,1_4.0.2_8A400_Restore.ipsw]
| <code>06a42297d94461264eb64d7c8640cc5d1c19edeb</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| {{yes|Yes1}}
| 344,248,876
|-
| 4.1
| [[Baker 8B117 (iPod touch 2G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-7937.20100908.ghj4f/iPod2,1_4.1_8B117_Restore.ipsw iPod2,1_4.1_8B117_Restore.ipsw]
|<code>97abde6207660bd876fd476275dd526d0dcf3d19</code>
|
| {{Yes}}
| {{yes}}
| 348,027,174
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 2G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9855.20101122.Lrft6/iPod2,1_4.2.1_8C148_Restore.ipsw iPod2,1_4.2.1_8C148_Restore.ipsw]
|<code>b9efddc7bb4350c237a8d3846af61bbfc8a2f647</code>
|
| {{yes}}
| {{yes}}
|363,553,480
|}

1 [[Tethered jailbreak]] only.

===[[N18ap|iPod touch (3rd generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 3.1.1
| [[Northstar 7C145 (iPod touch 3G)|Northstar 7C145]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-7163.20090909.NtstR/iPod3,1_3.1.1_7C145_Restore.ipsw iPod3,1_3.1.1_7C145_Restore.ipsw]
| <code>a3eddbe2cf77858bae7087dc8b2035f0d3097e57</code>
| Initial shipment.
| {{yes|Yes1}}

| 311,702,789
|-
| 3.1.1
| [[Northstar 7C146 (iPod touch 3G)|Northstar 7C146]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7238.20090918.23GhT/iPod3,1_3.1.1_7C146_Restore.ipsw iPod3,1_3.1.1_7C146_Restore.ipsw]
| <code>f66a7286b261137f25ddbbd84047f9a7ea181904</code>
|
| {{yes|Yes1}}
| 311,690,768
|-
| 3.1.2
| [[Northstar 7D11 (iPod touch 3G)|Northstar 7D11]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7271.20091008.Tch23/iPod3,1_3.1.2_7D11_Restore.ipsw iPod3,1_3.1.2_7D11_Restore.ipsw]
| <code>02dcee28d788d594a2939ab564f4f183af6ccdf2</code>
|
| {{yes}}
| 311,740,034
|-
| 3.1.3
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|SUNorthstarTwo 7E18]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-7473.20100202.4i44t/iPod3,1_3.1.3_7E18_Restore.ipsw iPod3,1_3.1.3_7E18_Restore.ipsw]
| <code>375fd469b18bfc0b74c7cfa5b4d5945197b1d106</code>
|
| {{yes}}
| 295,870,806
|-
| 4.0
| [[Apex 8A293 (iPod touch 3G)|Apex 8A293]]
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7381.20100621.AzSP9/iPod3,1_4.0_8A293_Restore.ipsw iPod3,1_4.0_8A293_Restore.ipsw]
| <code>36fe02b83f87d6305db572e1644841e3cd64cc7d</code>
|
| {{yes}}
| 384,178,784
|-
| 4.0.2
| [[Apex 8A400 (iPod touch 3G)|Apex 8A400]]
| [http://appldnld.apple.com/iPhone4/061-8554.20100811.Bgt54/iPod3,1_4.0.2_8A400_Restore.ipsw iPod3,1_4.0.2_8A400_Restore.ipsw]
| <code>481b21044130125b117d53207f725b70fb061855</code>
| Hotfix to prevent malicious misuse of [[Star]]'s exploits.
| {{yes}}
| 384,203,993
|-
| 4.1
| [[Baker 8B117 (iPod touch 3G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-7941.20100908.sV9KE/iPod3,1_4.1_8B117_Restore.ipsw iPod3,1_4.1_8B117_Restore.ipsw]
|<code>3162bad4060b7a58c9942ddb483e5bd9bcc5269f</code>
|
| {{yes}}
| 388,255,189
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 3G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9860.20101122.Xsde3/iPod3,1_4.2.1_8C148_Restore.ipsw iPod3,1_4.2.1_8C148_Restore.ipsw]
|<code>1127a042c535f7cf0be950ff8946862d5fb05b36</code>
|
| {{yes}}
| 408,118,620
|-
| 4.3
| [[Durango 8F190 (iPod touch 3G)|Durango 8F190]]
| [http://appldnld.apple.com/iPhone4/061-8366.20110311.Fr45t/iPod3,1_4.3_8F190_Restore.ipsw iPod3,1_4.3_8F190_Restore.ipsw]
|<code>3df936f2caf0759e6ac7f2339d663f3cad8b95f9</code>
|
| {{yes|Yes1}}
| 433,166,165
|-
| 4.3.1
| [[Durango 8G4 (iPod touch 3G)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0552.20110325.Yt67u/iPod3,1_4.3.1_8G4_Restore.ipsw iPod3,1_4.3.1_8G4_Restore.ipsw]
|<code>6879818321fd18267a15b91afbb1758dddd5dd5e</code>
|
| {{yes}}
| 429,132,326
|-
| 4.3.2
| [[Durango 8H7 (iPod touch 3G)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0667.20110414.95hVL/iPod3,1_4.3.2_8H7_Restore.ipsw iPod3,1_4.3.2_8H7_Restore.ipsw]
|<code>cac5436f85d9b42a5d2e9e495d34bd4ec2e4cf7f</code>
|
| {{yes}}
| 429,339,223
|-
| 4.3.3
| [[Durango 8J2 (iPod touch 3G)|Durango 8J2]]
| [http://appldnld.apple.com/iPhone4/041-1021.20110503.8Lfs1/iPod3,1_4.3.3_8J2_Restore.ipsw iPod3,1_4.3.3_8J2_Restore.ipsw]
|<code>b67300ebdc32b1e55b7212b937a3d4df83463d20</code>
|
| {{yes}}
| 429,343,499
|}

1 [[Tethered jailbreak]] only.

===[[N81ap|iPod touch (4th generation)]]===
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!width="40"| Version
!width="168"| Build
!width="200"| IPSW Download URL
!width="220"| SHA1 Hash
!width="150"| Comments
!width="99"| Publicly available virgin [[jailbreak]]?
!width="70"| File Size
|-
| 4.1
| [[Baker 8B117 (iPod touch 4G)|Baker 8B117]]
| [http://appldnld.apple.com/iPhone4/061-8490.20100901.hyjtR/iPod4,1_4.1_8B117_Restore.ipsw iPod4,1_4.1_8B117_Restore.ipsw]
| <code>a464492bf6ad25d65b378c85d8b181f973ede38a</code>
| Initial shipment.
| {{yes}}
| 608,360,672
|-
| 4.1
| [[Baker 8B118 (iPod touch 4G)|Baker 8B118]]
| [http://appldnld.apple.com/iPhone4/061-9344.20100922.Urgt43/iPod4,1_4.1_8B118_Restore.ipsw iPod4,1_4.1_8B118_Restore.ipsw]
| <code>331fb1342f5dab8c04cead74384a1e0fc1145952</code>
|
| {{yes}}
| 608,360,927
|-
| 4.2.1
| [[Jasper 8C148 (iPod touch 4G)|Jasper 8C148]]
| [http://appldnld.apple.com/iPhone4/061-9859.20101122.$erft/iPod4,1_4.2.1_8C148_Restore.ipsw iPod4,1_4.2.1_8C148_Restore.ipsw]
| <code>6a890696126d0cb7f9ccd6b913ecb09cf2029820</code>
|
| {{yes}}
| 638,177,119
|-
| 4.3
| [[Durango 8F190 (iPod touch 4G)|Durango 8F190]]
| [http://appldnld.apple.com/iPhone4/061-9588.20110311.GtP7y/iPod4,1_4.3_8F190_Restore.ipsw iPod4,1_4.3_8F190_Restore.ipsw]
| <code>0a463245f640d3e9a7528b6da0b6ff04b75c96bc</code>
|
| {{yes|Yes1}}
| 684,595,902
|-
| 4.3.1
| [[Durango 8G4 (iPod touch 4G)|Durango 8G4]]
| [http://appldnld.apple.com/iPhone4/041-0545.20110325.We3Rt/iPod4,1_4.3.1_8G4_Restore.ipsw iPod4,1_4.3.1_8G4_Restore.ipsw]
| <code>4a395e045a722de53e78e7aa7584a5201f455b5c</code>
|
| {{yes}}
| 681,680,434
|-
| 4.3.2
| [[Durango 8H7 (iPod touch 4G)|Durango 8H7]]
| [http://appldnld.apple.com/iPhone4/041-0666.20110414.3QvM1/iPod4,1_4.3.2_8H7_Restore.ipsw iPod4,1_4.3.2_8H7_Restore.ipsw]
| <code>4ee16cf07e792e1f4369e940ddf0786ac4bb2fd2</code>
|
| {{yes}}
| 681,851,983
|-
| 4.3.3
| [[Durango 8J2 (iPod touch 4G)|Durango 8J2]]
| [http://appldnld.apple.com/iPhone4/041-1015.20110503.d7i57/iPod4,1_4.3.3_8J2_Restore.ipsw iPod4,1_4.3.3_8J2_Restore.ipsw]
| <code>1b208377ee0e74d8c20c56e943eeef5ddea5f5ee</code>
|
| {{yes}}
| 681,860,586
|}

1 [[Tethered jailbreak]] only.

==See also==
* [[VFDecrypt]]
* [[VFDecrypt Keys]]

==Resources==
*[http://www.trejan.com/projects/ipod/ Firmware List]
*[http://itunes.com/version Apple Firmware XML]

Talk:Sn0wbreeze

2011-07-12T23:01:28Z

Zmaster: /* sn0wbreeze for 5.0b */

{{lowercase|Talk:}}

==Themes==
Now that sn0wbreeze is open-source, would anyone be interested in themes for it? I have been going through and improving the underlying code for a few days now, soon to be on my github or something. It is really simple to change the UI for it, so anyone interested? --[[User:JacobVengeance|JakeAnthraX]] 01:07, 19 November 2010 (UTC)
:I would like the ability NOT to install Cydia, since we can now only install SSH+afc2. Just like in "Micro$oft v. the European Union", 90% of the users will be happy with the defaults, but th3 g33kz aren't. :)
:Also, an easier way to enter pwned DFU (like, from the main page).
:The biggest problem, to be fair, is that downloading packages from saurik's source is broken. The package "apt" ends up containing a colon in the filename (impossible in a Windows environment) due to its version number. Thanks in advance for considering these improvements! --[[User:Ryccardo|Ryccardo]] 14:39, 19 November 2010 (UTC)
::The funny part is that I already did put another menu on the top to DFU Pwner. I am going to keep Cydia on there for most users. I am hopefully adding custom fonts on it too. Since that is the first thing I do when I jailbreak. --[[User:JacobVengeance|JakeAnthraX]] 20:12, 19 November 2010 (UTC)

== 2.2 ==
There is now 2.2r3 and 2.2.1 versions of sn0wbreeze, drag'n'drop in 2.2.1 is cool! --[[User:Srb21103|Srb21103]] 02:28, 23 February 2011 (UTC)
:Added. --[[User:Dialexio|Dialexio]] 03:19, 21 February 2011 (UTC)

== sn0wbreeze for 5.0b ==
If snowbreeze works by decrypting and can jailbreak all supported devices couldn't we rip the vfdecrypt keys out of it's source code? I looked at the 4.3.3 code and yes they were there. --[[User:Balloonhead66|Balloonhead66]] 12:50, 12 July 2011 (UTC)
:Are any keys missing? It would probably be easier to ask IH8sn0w or look into the source code on github instead of reverse engineering sn0wbreeze. -- [[User:Http|http]] 21:39, 12 July 2011 (UTC)
::Yes, iPhone 4 GSM, iPad 2 and iPod touch 3G. And since no computer based exploit exists, how did we get the keys for 4.3.1, .2, and .3 on the iPad 2 if the ramdisks are encrypted? --[[User:Balloonhead66|Balloonhead66]] 22:14, 12 July 2011 (UTC)
::The source code has about half of the 2.6.1 code and the modIPSW.vb file is for 2.5.1 (4.3.2) for some reason. And I wasnt talking about reverse engineering it though --[[User:Balloonhead66|Balloonhead66]] 22:01, 12 July 2011 (UTC)
::Some one knows how to make a tethered custom IPSW, like sn0wbreeze ones? is it just add cydia, patch ibss and create IPSW(and boot with limera1n)? --[[User:Zmaster|Zmaster]] 20:00, 12 July BRA)

Saffron

2011-07-07T09:46:50Z

Zmaster: /* Exploits used */ I0nic said that he didnt use his xploit

[[Image:Saffron.png|thumb|right|Saffron on an [[N81ap|iPod touch 4G]].]]
Saffron (also known as '''JailbreakMe 3.0''') is a [[userland]] [[jailbreak]] from [[User:comex|comex]] that utilizes [[JailbreakMe]].com, yet again. It was the first jailbreak made available for the [[iPad 2]]. Saffron made its debut on July 6, 2011, but a prerelease version leaked a few days before.

==Exploits used==
* [[DejaVu]]
(This needs work.)

{{clear}}

==Compatibility==
{| class="wikitable" style="text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2" style="width:20%;"| Device
!colspan="8"| Works with [[firmware]]...
|-
|style="width:11%;" | 4.2.6
|style="width:11%;" | 4.2.7
|style="width:11%;" | 4.2.8
|style="width:11%;" | 4.3
|style="width:11%;" | 4.3.1
|style="width:11%;" | 4.3.2
|style="width:11%;" | 4.3.3
|-
| [[K48ap|iPad]]
|colspan="3" {{no|N/A}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
| [[iPad 2]]
|colspan="3" {{no|N/A}}
| {{yes}}
| {{no}}
| {{no}}
| {{yes}}
|-
| [[iPhone 3GS]]
|colspan="3" {{no|N/A}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
| [[N90ap|iPhone 4 (GSM model)]]
|colspan="3" {{no|N/A}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
|-
| [[N92ap|iPhone 4 (CDMA model)]]
| {{yes}}
| {{yes}}
| {{yes}}
|colspan="4" {{no|N/A}}
|-
| [[N18ap|iPod touch 3G]]
|colspan="3" {{no|N/A}}
| {{yes}}
| {{no}}
| {{yes}}
| {{yes}}
|-
| [[N81ap|iPod touch 4G]]
|colspan="3" {{no|N/A}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
|}

==Links==
* [http://www.jailbreakme.com/ Saffron]

ITunes Errors

2011-07-06T23:32:22Z

Zmaster: /* Error 2003 */

{{lowercase}}
__NOTOC__
Most of the errors can be found at Apple's [http://support.apple.com/kb/ts1275 Knowledge Base].

Here is a list of [[iTunes]] errors that could appear during a restore or a USB connection via iTunes:

=Negative -98xx=
{{:iTunes Errors/-98xx}}

=Negative -32xx=
{{:iTunes Errors/-32xx}}

=Negative -1 ... -100=
==Error -50==
Delete Storm Video, QuickTime, iTunes, then reinstall iTunes. See also [http://support.apple.com/kb/TS1583?viewlocale=en_US Apple's KB article].

==Error -35==
Error when downloading songs purchased on iTunes. Also see [http://support.apple.com/kb/TS1475?viewlocale=en_US Apple's KB article].

==Error -1==
Error occurs when one uses the "last ditch" method for preventing baseband updates on the iPhone 4. The baseband does not get updated using this method. Simply use TinyUmbrella to kick it out of recovery mode.

=Below 100=
{{:iTunes Errors/Below 100}}

=Errors 10xx=
==Error 1002==
Error when restoring.

==Error 1004==
This is caused by a failure to match the [[AT+XNONCE|Baseband Nonce]] currently in memory to the [[AT+XNONCE|nonce]] returned in the [[Baseband Firmware]] [[SHSH]] blob. This happens if you edited the [[wikipedia:Hosts (file)|hosts file]] ([[Cydia Server|Saurik's Server]]) or you are using [[TinyUmbrella]]. Use [[TinyUmbrella]] and "Kick Device Out Of Recovery" to boot. 1

==Error 1011==
This is caused by recovery mode being in userland (1.1.1 firmware). The file iTunesMobileDevice.dll is damaged or updated.

==Error 1013==
'''iPhone 4'''

This means that the baseband did not get updated. Either remove the gs.apple.com entry from your hosts file and let the baseband upgrade or if you want to preserve the baseband just jailbreak at this point to boot it up.

'''Other Devices'''

Restart computer; change computer; reinstall system, if iPhone is always in restoring mode: XP users can jump from restoring mode with ibus; MAC users can use iNdependence. (usually on the iPhone with 1.0.2 firmware downgraded from 1.1.1)

==Error 1014==
This occurs when you try to downgrade your phone's baseband.

==Error 1015==
This error is common when downgrading [[iPhone]]s and 3G-enabled [[iPad]]s. The problem occurs when the device's [[Baseband Firmware|baseband]] has a higher version number than the baseband in the firmware you restored to. Just set auto-boot true in [[iRecovery]] or use [[iREB]]/[[TinyUmbrella]]/[[RecBoot]].1

=Errors 13xx=
==Error 1394==
When Spirit2Pwn flashes parts of the boot chain on [[iOS]] 4, the device may crash into [[DFU Mode]]. [http://ih8sn0wforums.com/viewtopic.php?f=8&t=3407]

=Errors 14xx=
==Error 1413==
Restart computer; change USB port; reinstall system. See also [http://support.apple.com/kb/TS1927?viewlocale=en_US Apple's KB article].

==Error 1415==
Restart computer; change USB port; reinstall system.

==Error 1417==
Restart computer; change USB port; reinstall system.

==Error 1418==
Restart computer; change USB port; reinstall system.

==Error 1428==
Restart computer; change USB port; reinstall system. (downgrade from www.iphonebus.com)

==Error 1050==
Bad response from gs.apple.com OR need iReb for preparing iPhone for restoring to custom ipsw

=Errors 16xx=
==Error 1600==
Custom firmware can't be restored on a device with [[DFU Mode]]. The software of the iPhone isn't patched. Using iREB, Sn0wbreeze, Redsn0w or Pwnage Tool, you need to enter a pwned DFU-Mode. During that process the software gets patched and the custom firmware should run without any problems.

==Error 1601==
See also this [http://support.apple.com/kb/TA38633 old KB article from Apple].

==Error 1602==
Restart computer; change computer; reinstall system.

If this error occured during an Apple TV restore, then unplug the Apple TV from the power cable, after you entered the recovery or DFU mode, and then try it again.

==Error 1603==
False [[kernelcache]] patch. Known on damaged bundles from unofficial [[PwnageTool]] distributions or bundles. See also [http://support.apple.com/kb/TA38603?viewlocale=en_US Apple KB article]

==Error 1604==
Device was not pwned (signature checks were not blocked). Custom firmware can't be restored. Can also happen when there's a problem with the ipsw.

==Error 1611==
[[iTunes]] tried to enter the [[Restore Mode]], but the device turned back to the [[Recovery Mode]].

==Error 1618==
Missing system files or corrupt data in iTunes installation. Try to uninstall iTunes, restart computer, install again.

==Error 1619 ==
[[iTunes]] is too old and couldn't read the iPhone in Recovery or DFU Mode. Please update iTunes and try it again.

==Error 1644==
[[IPSW File Format|IPSW]] was moved during prepare with [[iTunes]]. Try it again and don't move the IPSW.

=Errors 20xx=
==Error 2001==
The Mac OS X kernel extension "IOUSBFamily" that was bundled with late 2008 / early 2009 MacBooks, as well as the 10.5.6 update, has a bug where it fails to properly recognize an iDevice in [[DFU Mode]]. It can be resolved by updating to 10.5.7 (or later), or using a USB hub.

Also if you have [[Limera1n]] opened during you try to restore the iOS device.

==Error 2002==
[[iTunes]] can't connect because another program is using it or it's disconnected during the Apple Server check.

==Error 2003==
Connection problem; change USB cable and check USB port.
Sn0wbreeze IPSW failure to restore; unplug and plug iDevice and try again

==Error 2005==
Problem connecting. Probably a hardware failure.

=Errors 30xx=
==Error 3002==
*Update to an older firmware isn't working, because Apple is no longer handing out [[SHSH]]s for the device/firmware combination.
*Or a timeout checking Apple server - retry later.
*This error also happens if you try to ''Update'' with a local TSS server ([[TinyUmbrella|TinyUmbrella tool]]) and probably also when connecting to [[Cydia Server]]. Use ''Restore'' instead.

==Error 3004==
No internet connection during the firmware restore.
[[iTunes]] can't connect to gs.apple.com. Maybe Port 80 and Port 443 is blocked. Open it on your router.

==Error 3014==
False edited hosts. The SHSH request couldn't be completed. No connection to the Apple Server, Sauriks Server or localhost.
[[iTunes]] can't connect to gs.apple.com. Maybe Port 80 and Port 443 is blocked. Open it on your router.

=Errors 31xx=
==Error 3123==
Something dealing with movie rentals.

==Error 3191==
QuickTime corrupted must reinstall before iTunes will work or Turn off Compatibility Mode for QuickTime.

1. Right-click on the QuickTimePlayer application (located in C:Program FilesQuickTime) and choose Properties from the shortcut menu.

2. In the Properties window, click on the Compatibility tab Deselect the checkbox labeled “Run this program in compatibility mode for.”

3. Click Apply.

4. Close the Properties window

==Error 3194==
Occurs when trying to install an old firmware and Apple's server disallows the installation. The only solution is to have [[SHSH]] backup and modify the hosts file to point to [[Saurik]]'s [[Cydia Server]] where they are backed up (or localhost if you have it yourself).

==Error 3195==
"An internal error occurred." Missing SHSH for the firmware. Maybe the same as "This device isn't eligible for the request build." but with an cache error.

=Higher Errors=
==Error 11222==
A security software you have installed may be conflicting with iTunes.

==Error 13019==
?

==Error 20000==
Is caused by a custom theme pack on your Windows. Use default Theme.

This error can also be caused by the iDevice rebooting during the "Extracting Firmware" stage of restore.

==Error 20008==
?

This happened on a Mac with TinyUmbrella running before resotring a firmware to the Apple TV.

=Hex codes=
==0xE800001==
Device was suddenly unplugged. [[iTunes]] couldn't connect with the device. Try it again

==0xE8000022==
Error in your firmware files. Restore.

==0xE800003D==
False permissions in the Carrier Bundle folder. Restore, update or fix the permissions from the carrier bundle to update the carrier settings via iTunes.

==0xE800006B==
Device was suddenly unplugged. [[iTunes]] couldn't connect with the device. Try it again.

==0xE8000065==
[[sn0wbreeze]] custom firmware error on USB connection. Unplug the device, reboot it, and plug it in again.

==0xE8008001==
'''''See also: [[MobileInstallation]]'''''

''"The following app(s) were not installed {...}. An unknown error occurred. (0xE8008001)"''

IPA signature verification failed. (We do not allow illegal help on this wiki)

=Error texts=
==This device isn't eligible for the requested build==
Apple doesn't sign the firmware anymore. See [[SHSH]].

==The iPhone "xxx" could not be restored because the firmware file is not compatible.==
You downloaded the wrong firmware file (or it is corrupt). Download the correct firmware file that matches your device. Here's an overview of file names (beginning) and devices:
*AppleTV2,1_ [[K66ap|Apple TV 2G]]
*iPad1,1_ [[K48ap|iPad (or 1G or first generation)]]
*iPad2,1_ [[K93ap|iPad 2 Wi-Fi model]]
*iPad2,2_ [[K94ap|iPad 2 GSM model]]
*iPad2,3_ [[K95ap|iPad 2 CDMA model]]
*iPhone1,1_ [[M68ap|iPhone (or 2G or first generation)]]
*iPhone1,2_ [[N82ap|iPhone 3G]]
*iPhone2,1_ [[N88ap|iPhone 3GS]]
*iPhone3,1_ [[N90ap|iPhone 4 GSM model]]
*iPhone3,3_ [[N92ap|iPhone 4 CDMA model]]
*iPod1,1_ [[N45ap|iPod touch (or 1G or first generation)]]
*iPod2,1_ [[N72ap|iPod touch 2G]]
*iPod3,1_ [[N18ap|iPod touch 3G]]
*iPod4,1_ [[N81ap|iPod touch 4G]]

==The iPhone "xxx" cannot be restored at this time because the iPhone software update server could not be contacted or is temporarily unavailable.==
If you want to upgrade or downgrade the baseband, make sure you didn't change the hosts file. The Cydia server cannot handle the requests for the baseband certificates.

== There was a problem downloading the software for the iPhone “XXXXXXX” the network connection was reset, make sure your network settings are correct and your network connection is active, or try again later.==
You need to disable both your antivirus ''and'' your windows/security firewall in order for the update/restore to go through.

----

1 Use [[TinyUmbrella]] (Kick Device out of Recovery), [[iRecovery]] or [[redsn0w Lite]] and enter "setenv auto-boot true", "saveenv", "reboot" to boot.

2 Device isn't bootable, but a custom firmware can be restored if it has a jailbreak and the requirements.

PwnPie

2011-07-04T17:22:02Z

Zmaster: /* Notes */

'''PwnPie''' also is what [[iKeys]] should be, but [[iKeys]] isn't real.

== What it does ==
* Basically it takes an [[IPSW]] and parses every [[img3]] inside.
* Using [[BASH]], we launch [[Greenpois0n (toolkit)|greenpois0n]] monitoring its output, and when it loads [[iBSS]] we kill it.
We will have an iDevice in [[iBSS]] [[pwned]].
* Using the <pre>go aes dec</pre> command we find keys/IVs and format them.
* The tool will also decrypt for you the whole [[IPSW]], so you can play with it easily.
* A private beta version can produce a page, allowing to add keys easily.
* Latest version can be found on [https://github.com/qwertyoruiop/PwnPie/blob/master/PwnPie.sh GitHub]

== Requirements ==
* [[XPwn]]: [http://www.megaupload.com/?d=J9A84LP7 MegaUpload.com]
* [[IRecovery]]: [http://cl.ly/38TE CloudApp]
* [[LibPNG]]: [http://ethan.tira-thompson.org/Mac_OS_X_Ports_files/libpng%20%28universal%29.dmg Ethan.Tira-Thompson.org]
* [[LibUSB]]: [http://0wn-team.info/LibUSB%20Installer.zip 0wn-team.info]

== Notes ==
* This app is outdated, PyPie it recommended.

[[Category:GUI Tools]]

Durango 8H7 (iPhone2,1)

2011-06-26T15:25:16Z

Zmaster: /* Decryption Keys */

== Decryption Keys ==
=== Root Filesystem (038-1022-007.dmg) ===
*'''[[VFDecrypt]] Key''': 69a370c1b64b35f692e87e866bcd460a98a10c56ed05055eb7c675f101894ea504f7bc46
=== Update Ramdisk (038-1030-007.dmg) ===

Not Encrypted

=== Restore Ramdisk (038-1033-007.dmg) ===

Not Encrypted

=== AppleLogo ===

* '''IV''': ccc3515c3a505bd045debf219de37c03
* '''Key''': fb1fe36294b8183e03cedfe7edee54ee6fe3919ddd682d55e694ad77fa6f0b1b

=== BatteryCharging0 ===

* '''IV''': 8fd0b33c4a6f19e7ee15d84e4d0d8efb
* '''Key''': 240f6a35dfedc9c8af03e56a100a292431a0867e8458afb4591c70de7eff604f

=== BatteryCharging1 ===

* '''IV''': 644061a63336b67559fd9a32c09e065b
* '''Key''': 8849525435de89566df2acea4c6664d96eaef5a4ee16422420808c6b8c5a7f9f

=== BatteryFull ===

* '''IV''': c74fe929ef1c5e25f20d3d63222127ca
* '''Key''': 1d89b7eaacab41a476eb914e2eb6bf4e6227d2edcc0f65698cd4eaee66eab3ee

=== BatteryLow0 ===

* '''IV''': d0f84740dbb37b41351e912b9f89a5ef
* '''Key''': 3c2c6f824867ae23b978ce7fb5492f03b4513ba217a0e9f6f3dd918c6b71e9c4

=== BatteryLow1 ===

* '''IV''':
* '''Key''':

=== DeviceTree ===

* '''IV''':
* '''Key''':

=== GlyphCharging ===

* '''IV''':
* '''Key''':

=== GlyphPlugin ===

* '''IV''':
* '''Key''':

=== [[iBEC]] ===

* '''IV''': 0034860a2b91ffc9d09471d02f98d06d
* '''Key''': 124ddf2693a216e33a6645e3624ba4cbeda541e42aed603162fc4c49a6795abf

=== [[iBoot (Bootloader)|iBoot]] ===

* '''IV''': 096984dbafb19c1c708e5c7b1299f269
* '''Key''': 6d14c496a0fe42f49898b06c70dca353a6634f67003715830c0c45b6aa822cbc

=== [[iBSS]] ===

* '''IV''': 181ee0b292538b2052dbd119770d7348
* '''Key''': f131471b406795abf7ae70617dd30968e5ad6b847b84a1671d5801c04fc07643

=== [[Kernelcache]] ===

* '''IV''': a69d6cc5f006cd1facff95f2305e8c92
* '''Key''': eb528d11638e2c8567916fc6a336d140dd1f2a5045c471f05cf2b409e37c8fe3

=== [[LLB]] ===

* '''IV''': b889e456f735ee52858cca09df3c5909
* '''Key''': d700547fd945b5be12ec74f578838c746093ff7317e09fff1c88039989d2f7e3

=== RecoveryMode ===

* '''IV''':
* '''Key''':

Durango 8H7 (iPhone2,1)

2011-06-26T15:12:56Z

Zmaster: /* AppleLogo */

== Decryption Keys ==
=== Root Filesystem (038-1022-007.dmg) ===
*'''[[VFDecrypt]] Key''': 69a370c1b64b35f692e87e866bcd460a98a10c56ed05055eb7c675f101894ea504f7bc46
=== Update Ramdisk (038-1030-007.dmg) ===

Not Encrypted

=== Restore Ramdisk (038-1033-007.dmg) ===

Not Encrypted

=== AppleLogo ===

* '''IV''': ccc3515c3a505bd045debf219de37c03
* '''Key''': fb1fe36294b8183e03cedfe7edee54ee6fe3919ddd682d55e694ad77fa6f0b1b

=== BatteryCharging0 ===

* '''IV''':
* '''Key''':

=== BatteryCharging1 ===

* '''IV''':
* '''Key''':

=== BatteryFull ===

* '''IV''':
* '''Key''':

=== BatteryLow0 ===

* '''IV''':
* '''Key''':

=== BatteryLow1 ===

* '''IV''':
* '''Key''':

=== DeviceTree ===

* '''IV''':
* '''Key''':

=== GlyphCharging ===

* '''IV''':
* '''Key''':

=== GlyphPlugin ===

* '''IV''':
* '''Key''':

=== [[iBEC]] ===

* '''IV''': 0034860a2b91ffc9d09471d02f98d06d
* '''Key''': 124ddf2693a216e33a6645e3624ba4cbeda541e42aed603162fc4c49a6795abf

=== [[iBoot (Bootloader)|iBoot]] ===

* '''IV''': 096984dbafb19c1c708e5c7b1299f269
* '''Key''': 6d14c496a0fe42f49898b06c70dca353a6634f67003715830c0c45b6aa822cbc

=== [[iBSS]] ===

* '''IV''': 181ee0b292538b2052dbd119770d7348
* '''Key''': f131471b406795abf7ae70617dd30968e5ad6b847b84a1671d5801c04fc07643

=== [[Kernelcache]] ===

* '''IV''': a69d6cc5f006cd1facff95f2305e8c92
* '''Key''': eb528d11638e2c8567916fc6a336d140dd1f2a5045c471f05cf2b409e37c8fe3

=== [[LLB]] ===

* '''IV''': b889e456f735ee52858cca09df3c5909
* '''Key''': d700547fd945b5be12ec74f578838c746093ff7317e09fff1c88039989d2f7e3

=== RecoveryMode ===

* '''IV''':
* '''Key''':

Tutorial:Creating a NOR-only IPSW

2011-06-25T14:06:52Z

Zmaster: untethered bootrom exploit need

1. Create a custom ipsw

2. Unpack it, remove rootfs dmg

3. Decrypt ramdisk (xpwntool), mount it.

4. Edit options.plist on the restore ramdisk:

/usr/local/share/restore/options.plist
<pre><?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CreateFilesystemPartitions</key>
<false/>
<key>UpdateBaseband</key>
<false/>
<key>SystemImage</key>
<false/>
</dict>
</plist>
</pre>

5. Unmount and reencrypt the restore ramdisk.

6. Repack the ipsw.

NOTE: This technique only works with the [[N72ap|iPod touch 2G]] [[Models|MB-version]] and the [[N88ap|iPhone 3GS]] old [[bootrom]] (devices that are vulnerable to bootrom untethered exploit)

Tutorial:Creating a NOR-only IPSW

2011-06-24T17:46:21Z

Zmaster:

1. Create a custom ipsw

2. Unpack it, remove rootfs dmg

3. Decrypt ramdisk (xpwntool), mount it.

4. Edit options.plist on the restore ramdisk:

/usr/local/share/restore/options.plist
<pre><?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CreateFilesystemPartitions</key>
<false/>
<key>UpdateBaseband</key>
<false/>
<key>SystemImage</key>
<false/>
</dict>
</plist>
</pre>

5. Unmount and reencrypt the restore ramdisk.

6. Repack the ipsw.

NOTE: It just works with iPod Touch 2G MB and iPhone 3Gs old bootrom