https://www.theiphonewiki.com/w/api.php?action=feedcontributions&user=AS967&feedformat=atomThe iPhone Wiki - User contributions [en]2024-03-28T09:54:41ZUser contributionsMediaWiki 1.31.14https://www.theiphonewiki.com/w/index.php?title=SHSH_Protocol&diff=125975SHSH Protocol2023-01-03T00:21:51Z<p>AS967: /* Status responses */</p>
<hr />
<div>Here is a description of the protocol that is used when [[iTunes]] requests the [[SHSH]] certificate from Apple. For details about what this is used for, please see the main article [[SHSH]].<br />
<br />
This is a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] ([[wikipedia:POST (HTTP)|POST]]) request and answer. You can retry this via a [[wikipedia:Telnet|Telnet]] session or similar. The destination host is [http://gs.apple.com/TSS/controller?action=2 gs.apple.com] and runs on the common [[wikipedia:TCP and UDP port|port]] 80. The data is plaintext and not encoded in any way. For details about the [[wikipedia:Hypertext Transfer Protocol|HTTP]] protocol itself, please see [http://www.w3.org/Protocols/HTTP/1.1/rfc2616.pdf RFC2616].<br />
<br />
== Communication ==<br />
<br />
Reliable communication to the TSS server is best achieved with the following HTTP header configuration:<br />
<br />
* <code>Proxy-Connection: Keep-Alive</code><br />
* <code>Pragma: no-cache</code><br />
* <code>Content-Type: text/xml; charset="utf-8"</code><br />
<br />
The following [https://curl.haxx.se/ curl] command demonstrates a command-line request to the server:<br />
<br />
curl -i -s -m 1.0 -X POST -A "InetURL/1.0" -H "Proxy-Connection: Keep=Alive" -H "Pragma: no-cache" -H "Content-Type: text/xml; charset=\"utf-8\"" -d @/location/to/TSSRequest.xml gs.apple.com/TSS/controller?action=2<br />
<br />
===Action types===<br />
Attached to the http://gs.apple.com/TSS/controller URL is commonly <code>?action=2</code>, which can be discovered when performing an iTunes restore and observing packets sent with a packet sniffer such as [https://www.wireshark.org Wireshark]. However, values other than 2 may produce different server responses, of which all known value/response pairs have been listed below.<br />
<br />
* <code>?action=0</code>: Performs a "Tatsu Signing Server HealthCheck", returning an HTML body of "Server not ready". This may be a general ping protocol for ensuring the TSS service is online.<br />
* <code>?action=2</code>: Common SHSH protocol. See [[#Status responses]] for all known server responses.<br />
* <code>?action=3</code>: Functionally the same as <code>?action=2</code>.<br />
* <code>?action=5</code>: Generates <code>respCode</code> and <code>respMsg</code>. This response syntax differs slightly from the SHSH protocol. The name "cpsn" is referenced.<br />
<br />
All unlisted action types appear to respond without HTML content, only status.<br />
<br />
===Sending data (request)===<br />
The request is actually a single XML-encoded property list. It contains a dictionary which describes the target iOS version, restore behavior, etc. Some of the required information can be taken from the BuildManifest.plist. BuildManifest contains some info about the firmware version and "BuildIdentities" dictionary. Inside it you can find two (or more?) build identities. Each of them contains the information which depends on every type of restore ("Erase" or "Update"). Some information is device-dependent (ECID, nonce) and is received from the device.<br />
<br />
Request property list should have these properties:<br />
<br />
* '''@APTicket:''' Optional boolean value. If true, the server adds an [[APTicket]] to the request.<br />
* '''@BBTicket:''' Optional boolean value. The same for the [[BBTicket]].<br />
* '''@HostPlatformInfo:''' Optional string value. "mac" for OS X client, "windows" for Windows client (can be anything you want).<br />
* '''@Locality:''' Optional string value. Language used for the error response (ex. "en_US").<br />
* '''@UUID:''' Optional string value. Just a random request UUID (ex. D9C1F33D-62E0-4D25-8068-F5F46FE80057).<br />
* '''@VersionInfo:''' Optional string value. The version of 'libauthinstall' used (ex. "libauthinstall-391.0.0.1.3"). You can pass any string here.<br />
* '''ApBoardID:''' Integer value. [[BORD |Board ID]] of the target device. You can take this value from the build manifest.<br />
* '''ApChipID:''' Integer value. [[CHIP|Chip ID]] of the target device. You can take this value from the build manifest.<br />
* '''ApECID:''' Integer value. [[ECID]] of the target device.<br />
* '''ApNonce:''' Data value. The [[nonce]] generated by your device.<br />
* '''ApProductionMode:''' Boolean value. Always true (unless your SOC is PROD 0 - Apple only).<br />
* '''ApSecurityDomain:''' Integer value. The use is unknown. You can take this value from the build manifest.<br />
* '''UniqueBuildID:''' Optional data value. This is a unique identifier for every build (different even for "Erase" and "Update" types of restore). You can take this value from the build manifest.<br />
<br />
The SHSH request also contains information about files from the [[IPSW]] (or restore bundle for [[PurpleRestore]]). They can be obtained from the 'build identity' you've chosen in the previous step. Each 'build identity' contains a "Manifest" dictionary. It's entries look like<br />
<key>BatteryCharging0</key><br />
<dict><br />
<key>Digest</key><br />
<nowiki><data>...</data></nowiki><br />
<key>Info</key><br />
<dict>...</dict><br />
<key>Trusted<key/><br />
<true/><br />
<dict/><br />
They are just copied to the SHSH request, but the "Info" dictionary is removed.<br />
Example of a SHSH request (... values are identical, *** values are different per device):<br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"> <br />
<dict> <br />
<key>@[[APTicket]]</key> <br />
<true /> <br />
<key>@[[BBTicket]]</key> <br />
<true /> <br />
<key>@HostPlatformInfo</key> <br />
<string>mac</string> <br />
<key>@Locality</key> <br />
<string>en_US</string> <br />
<key>@UUID</key> <br />
<string>D9C1F33D-62E0-4D25-8068-F5F46FE80057</string> <br />
<key>@VersionInfo</key> <br />
<string>libauthinstall-391.0.0.1.3</string> <br />
<key>[[BORD |ApBoardID]]</key> <br />
<integer>10</integer><br />
<key>[[CHIP |ApChipID]]</key> <br />
<integer>35152</integer> <br />
<key>[[ECID |ApECID]]</key> <br />
<integer>***</integer> <br />
<key>[[Nonce |ApNonce]]</key> <br />
<nowiki><data>***</data> </nowiki><br />
<key>ApProductionMode</key> <br />
<true /> <br />
<key>ApSecurityDomain</key> <br />
<integer>1</integer> <br />
<key>UniqueBuildID</key> <br />
<data> fqzW0B++Zdrs+PRwohkwU6prjbk=</data> <br />
<key>AppleLogo</key> <br />
<dict> <br />
<key>Digest</key> <br />
<nowiki><data> uH5QQax5YmIrgcuEHwOhAB//yc8=</data> </nowiki><br />
<key>Trusted</key> <br />
<true /> <br />
</dict><br />
<key>BatteryCharging0</key> <br />
<dict> <br />
... See AppleLogo dictionary.<br />
</dict> <br />
<key>BatteryCharging1</key> <br />
<dict> <br />
...<br />
</dict> <br />
<key>BatteryFull</key> <br />
<dict> <br />
... <br />
</dict> <br />
<key>BatteryLow0</key> <br />
<dict> <br />
...<br />
</dict> <br />
<key>BatteryLow1</key> <br />
<dict> <br />
...<br />
</dict> <br />
<key>BatteryPlugin</key> <br />
<dict> <br />
...<br />
</dict> <br />
<key>DeviceTree</key> <br />
<dict> <br />
...<br />
</dict> <br />
<key>KernelCache</key> <br />
<dict> <br />
...<br />
</dict> <br />
<key>LLB</key> <br />
<dict> <br />
<key>BuildString</key> <br />
<string>iBoot-2817.0.0.1.2~2</string> <br />
<key>PartialDigest</key> <br />
<nowiki><data> QAAAAHhRAgC22ZPWJB9J1Nh3H+0XeyRTU72ObA==</data> </nowiki><br />
...<br />
</dict> <br />
<key>RecoveryMode</key> <br />
<dict> <br />
...<br />
</dict> <br />
<key>RestoreDeviceTree</key> <br />
<dict> <br />
...<br />
</dict> <br />
<key>RestoreKernelCache</key> <br />
<dict> <br />
...<br />
</dict> <br />
<key>RestoreLogo</key> <br />
<dict> <br />
... <br />
</dict> <br />
<key>RestoreRamDisk</key> <br />
<dict> <br />
...<br />
</dict> <br />
<key>[[iBEC]]</key> <br />
<dict> <br />
<key>BuildString</key> <br />
<string>iBoot-2817.0.0.1.2~2</string> <br />
...<br />
</dict> <br />
<key>[[iBSS]]</key> <br />
<dict> <br />
<key>BuildString</key> <br />
<string>iBoot-2817.0.0.1.2~2</string> <br />
<key>PartialDigest</key> <br />
<nowiki><data> QAAAAHhBAQCRc2PuoresMjW7zNLePMPmX7zaHg==</data> </nowiki><br />
...<br />
</dict> <br />
<key>[[iBoot]]</key> <br />
<dict> <br />
...<br />
</dict> <br />
</dict> <br />
</plist><br />
<br />
===Receiving data (answer)===<br />
The response is a simple HTTP POST response, containing 3 values: STATUS, MESSAGE (a description string) and REQUEST_STRING (only if the request was successful). STATUS contains numeric status, MESSAGE contains an error message on error and "SUCCESS" string on success and REQUEST_STRING contains response property list encoded as XML.<br />
<br />
===Status responses===<br />
*'''STATUS=0&MESSAGE=SUCCESS'''<br />
** The request was sent successfully, and a response was returned.'''<br />
*'''STATUS=8&MESSAGE=An internal error occurred.'''<br />
** A key contained an unknown name.<br />
*'''STATUS=69&MESSAGE=This device isn't eligible for the requested build.'''<br />
*'''STATUS=83&MESSAGE=An internal error occurred.'''<br />
** A key was assigned an invalid value type.<br />
*'''STATUS=92&MESSAGE=An internal error occurred.'''<br />
** The request contained more than 65536 bytes.<br />
*'''STATUS=93&MESSAGE=An internal error occurred.'''<br />
** The request contained less than 10 bytes.<br />
*'''STATUS=94&MESSAGE=This device isn't eligible for the requested build.'''<br />
** The specified build is either unsigned or nonexistent, or a property was requested which the server declined to authorize (example: DPRO and DSEC values of 1, EPRO and ESEC values of 0).<br />
*'''STATUS=98&MESSAGE=An internal error occurred.'''<br />
** The XML/PList identification tag is missing or the start of the tag is malformed.<br />
*'''STATUS=100&MESSAGE=An internal error occurred.'''<br />
** A general XML error was found: the XML/PList version is nonexistent or not "1.0", the end of the XML/PList identification tag is malformed, an unknown or empty tag was found, the root <code><plist></code> tag is missing, no keys were found, a value tag contained an invalid type, an unescaped ampersand character was found, two consecutive dash characters were found in a comment, or a tag was found without its counterpart.<br />
*'''STATUS=103&MESSAGE=An internal error occurred.'''<br />
** Multiple '@' characters were found at the beginning of a key name.<br />
*'''STATUS=128&MESSAGE=An internal error occurred.'''<br />
*'''STATUS=131&MESSAGE=An internal error occurred.'''<br />
** ''TBD: Something to do with <code>@APTicket</code>?''<br />
*'''STATUS=132&MESSAGE=An internal error occurred.'''<br />
*'''STATUS=133&MESSAGE=An internal error occurred.'''<br />
** The <code>BbGoldCertId</code> key is missing in a Baseband install.<br />
*'''STATUS=511&MESSAGE=No data in the request'''<br />
*'''STATUS=551&MESSAGE=Error occured while importing config packet with cpsn: '''<br />
*'''STATUS=5000&MESSAGE=Invalid Option!'''<br />
<br />
===Notes===<br />
* Interestingly, if all you're interested in is the ServerVersion (and a SUCCESS response), sending any one valid Ap-prefixed key will do, like so:<br />
<?xml version="1.0"?><br />
<plist><br />
<dict><br />
<key>ApSecurityDomain</key><br />
<integer>1</integer><br />
</dict><br />
</plist><br />
<br />
* In regards to fuzzing and malformed data, the server (as of 2.1.0, at least) seems to have no bounds checking for the ApNonce, or even checking to see if the ApNonce exists. Because the APTicket changes even when specifying an invalid-sized nonce, it is assumed nonces too short are padded while nonces too large are ignored past the 16th character.<br />
<br />
* Most textual characters between tags are ignored. For example, inserting non-bracket text (excluding XML special characters, such as '&') after a <code><dict></code> and before the following <code><key></code> will have no effect.<br />
<br />
* A version string in the XML/Plist identification tag is '''required''', or a <code>STATUS=100</code> internal error message will result. Any encoding string provided is ignored and defaulted to (presumably) "UTF-8".<br />
<br />
* The DOCTYPE tag is completely ignored. As such, specifying any non-PList DTD has no effect.<br />
<br />
===Other parameters / open questions===<br />
Some parameters could have other values. Not all details are known.<br />
*ApSecurityDomain: Meaning? (Related to [[SDOM]] tag)<br />
*Trusted: What is this for?<br />
*Full description of the above values for UniqueBuildID, Digest, PartialDigest and BuildString.<br />
<br />
==PartialDigest==<br />
The PartialDigest is structured like so:<br />
<br />
typedef struct PartialDigest {<br />
uint32_t transformSize; // Always 0x40.<br />
uint32_t img3DataSize; // data size of the img3.<br />
uint8_t hash[SHA1HashSize]; // Result of SHA1ResultPartial from the stripped img3.<br />
};<br />
<br />
The img3 is first stripped of it's code signature (if present) and then passed through SHA1Update. SHA1ResultPartial is then performed. It is purposely not the final resulting SHA1. The reason for this being, when TSS processes the PartialDigest, it performs one more SHA1Update on the hash to include the [[ECID]] before doing SHA1Final and creating the SHSH blob.<br />
<br />
Code for SHA1ResultPartial:<br />
int SHA1ResultPartial(SHA1Context* ctx, unsigned char* buf) {<br />
// Do we have valid buffer and context pointers?<br />
if(ctx && buf) {<br />
// Is the Context in good shape?<br />
if(!ctx->Corrupted && !ctx->Computed && !ctx->Message_Block_Index) {<br />
for(int i = 0; i < SHA1HashSize; i++) {<br />
buf[i] = ctx->Intermediate_Hash[i >> 2] >> 8 * (3 - (i & 0x3));<br />
}<br />
return 0;<br />
}<br />
}<br />
return 1;<br />
}<br />
Code for tss_strip_img3_signature:<br />
int tss_strip_img3_signature(img3Header* img3, int* len) {<br />
// Do we have a non-null ptr?<br />
if(!img3) {<br />
return 10004;<br />
}<br />
// Does the buffer start with the img3 magic?<br />
if(img3->magic != IMG3_MAGIC) {<br />
printf("tss_strip_img3_signature: bad magic 0x%08x expecting 0x%08x\n", img3->magic, IMG3_MAGIC);<br />
return 10004;<br />
}<br />
// Sanity checks<br />
if(img3->shshOffset > img3->dataSize) {<br />
printf("tss_strip_img3_signature: signed length %u too large for buffer length %u\n", img3->shshOffset, img3->dataSize);<br />
return 10004;<br />
}<br />
// Trim the image by adjusting the header.<br />
if(img3->shshOffset) {<br />
*len += img3->shshOffset - img3->dataSize;<br />
img3->dataSize = img3->shshOffset;<br />
img3->fullSize = *len;<br />
}<br />
return 0;<br />
}<br />
<br />
==Digest==<br />
Digest is the SHA1 of the stripped img3. They are used instead of PartialDigests for the APTicket since the ticket is already personalized for the ECID and all other tags.<br />
<br />
[[Category:Firmware Tags]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Security_Fusings&diff=125908Security Fusings2022-12-05T19:38:10Z<p>AS967: </p>
<hr />
<div>iDevice security and APTicket configuration settings are often determined by security fuses on the SoC.<br />
<br />
== Effective vs. Raw fusing ==<br />
<br />
iDevices have two views of fuses, the "raw" fuse status which represent the actual state of the fuses, and the "effective" fusing status, which is a copy of the raw fuses loaded into SoC registers that can override security configuration normally determined by the fuses, assuming one can write to the effective fusing status register.<br />
<br />
=== Pre-A7 devices ===<br />
<br />
Pre-A7 devices only had one view of fuses, which could be overridden. However, production-fused devices have the security epoch set while development-fused devices don't, so that one can distinguish a production-fused device from a demoted device.<br />
<br />
=== Post-A7 devices ===<br />
<br />
Post-A7 devices have two views of fuses, effective and raw, and the AP and SEP can read both to distinguish a demoted device from a development-fused one.<br />
<br />
== ECID ==<br />
<br />
See [[ECID]].<br />
<br />
== Production Mode ==<br />
<br />
The production mode fuse in the SoC controls whether JTAG/SWD is enabled on the AP or not as well as what UID/GID keys the AP AES engine will use to decrypt data. <br />
<br />
== Security Mode ==<br />
<br />
The secure mode fuse controls whether JTAG/SWD is enabled on the SEP, and controls the GID/UID used by the SEP AES engine. It also governs whether the AP SecureROM can boot untrusted code on post-A7 devices, in addition to the Test Mode board configuration setting. From an AP perspective, the secure mode fuse is always read from the raw fuses.<br />
<br />
<br />
== Fuse seal ==<br />
<br />
Unclear as to what the fuse seal does, though from the name it seems to lock the raw fuses from being altered further. Only present on post-A7 devices.<br />
<br />
== Fuse lock ==<br />
<br />
Fuse locking sets a lock register such that changes to the effective fuses are no longer possible until the next device reset. This ensures that the only way to demote a device is to have a validly signed APTicket loaded by SecureROM. (assuming no vulnerabilities)<br />
<br />
== Use in APTickets ==<br />
<br />
The Apple signing server uses the raw and effective production/security status to ensure that iOS builds are only being signed for devices that are expected to have them.<br />
<br />
<br />
== Demotion ==<br />
<br />
Demotion is the term used to refer to changing a device's effective fuse status to enable debugging of the AP and SEP. The effective fuse status register will accept writes (assuming it hasn't been locked) to change the effective fuse status. For example, a production, secure fused device can be demoted to development and insecure by changing the effective fuse status register. AP can only change production mode, and SEP can only change secure mode. By default, this is only done when DPRO and DSEC are present in the APTicket.</div>AS967https://www.theiphonewiki.com/w/index.php?title=SHSH&diff=121993SHSH2022-04-04T15:28:56Z<p>AS967: </p>
<hr />
<div>'''SHSH''', or '''"Signed Hash"''' refers to the signature (currently RSA) on boot images or APTickets that the device bootloader will verify before allowing execution of an image.<br />
<br />
SHSH often also refers to backup files with this signature ("SHSH blobs"). This signature is needed to restore a specific iOS version; it is generated by Apple based on hardware keys of the device and the hash of the firmware. Apple only issues signatures for the currently-available iOS version, which disallows installing older iOS versions. But if you have saved signatures for an older iOS version, you may be able to use a [[wikipedia:replay attack|replay attack]] to restore that version. Therefore it is recommended to save the signature for your device as long as Apple issues it.<br />
<br />
With the tools mentioned below it is possible to backup the signature. It is not necessary that the device is jailbroken to do the backup.<br />
<br />
Users often misunderstand this system and think that the SHSH firmware version they back up depends on the firmware version they have installed on their device. This is the case for [[iFaith]], but not for TinyUmbrella. iFaith dumps the SHSHs from your device's storage (whatever's installed on your device, e.g. 4.3.3), while TinyUmbrella gets SHSHs from Apple's servers (whatever firmwares Apple is currently signing).<br />
<br />
SHSH blobs are unique to each device by [[ECID]].<br />
<br />
==Using SHSH==<br />
Older devices ([[M68AP|iPhone]] and [[N45AP|iPod touch]]) do not use SHSH signatures, so installation of any firmware on these devices is possible.<br />
<br />
iPhone OS 1.x and 2.x do not use SHSH signatures, and can therefore be downgraded to at any time, even on devices that do use SHSH signatures, such as [[N82AP|iPhone 3G]].<br />
<br />
Versions above iPhone OS 3.0 require the [[iBEC]], [[iBSS]], and [[LLB]] to be fully signed with an SHSH for the ECID of that device.<br />
<br />
However, some devices are vulnerable to untethered [[Bootrom#Bootrom Exploits|bootrom exploits]], such as [[0x24000 Segment Overflow]] or [[alloc8 Exploit|alloc8]]. These devices can be restored to a custom [[IPSW]] in Pwned [[DFU Mode]] for any version that is available to that particular device. Notable devices vulnerable to untethered bootrom exploits are the [[iPhone 3GS]] and [[iPod touch (2nd generation)]]. The [[limera1n Exploit]] is able to provide a [[Tethered Downgrade|tethered downgrade]] for vulnerable devices.<br />
<br />
Since various exploits, such as the [[limera1n Exploit]], are fixed in the [[bootrom]] since version [[Bootrom 838.3]] and because iOS versions 5.0 and above includes a [[nonce]] in their SHSH hashes, downgrading newer devices is not as simple. Blobs must be stitched into a custom firmware, and restored to in Pwned [[DFU Mode]].<br />
<br />
Blobs can be saved with tools such as [[iFaith]] and [[TinyUmbrella]]. Firmwares can be stitched using [[iFaith]], [[redsn0w]] or [[sn0wbreeze]].<br />
<br />
Newer methods such as [[Odysseus]], [[Prometheus]] or [[iDeviceReRestore]] are used now because other tools have become outdated and newer versions of [[iTunes]] prevents restores to custom versions.<br />
<br />
==Timeline==<br />
As noted above, the original [[M68AP|iPhone]] and [[N45AP|iPod touch]] didn't use SHSH blobs. iPhone OS 1.x and 2.x didn't use SHSH blobs either. iPhone 3G and iPod touch (2nd generation) both used SHSH blobs on iOS 4,<ref>http://jaxov.com/2010/07/why-save-iphone-3g-ipod-touch-2g-shsh-blobs/</ref> but following the re-opening on {{date|2018|01|10}}, all versions (excluding betas) that they ever ran can now be freely installed.<br />
<br />
=== iOS/iPadOS ===<br />
{| class="wikitable"<br />
|-<br />
! Firmware<br />
! For Device(s)<br />
! From<br />
! Until<br />
! Status<br />
|-<br />
| 15.4.1<br />
| rowspan="2" | [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad (8th generation)]], [[iPad (9th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad mini (6th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Air (4th generation)]], [[iPad Air (5th generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPad Pro (11-inch) (3rd generation)]], [[iPad Pro (12.9-inch) (5th generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]], [[D16AP|iPhone 13 mini]], [[D17AP|iPhone 13]], [[D63AP|iPhone 13 Pro]], [[D64AP|iPhone 13 Pro Max]], [[D49AP|iPhone SE (3rd generation)]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2022|03|31}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 15.4<br />
| {{date|2022|03|14}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 15.3.1<br />
| rowspan="4" | [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad (8th generation)]], [[iPad (9th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad mini (6th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Air (4th generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPad Pro (11-inch) (3rd generation)]], [[iPad Pro (12.9-inch) (5th generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]], [[D16AP|iPhone 13 mini]], [[D17AP|iPhone 13]], [[D63AP|iPhone 13 Pro]], [[D64AP|iPhone 13 Pro Max]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2022|02|10}}<br />
| {{date|2022|03|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.3<br />
| {{date|2022|01|26}}<br />
| {{date|2022|02|17}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.2.1<br />
| {{date|2022|01|12}}<br />
| {{date|2022|02|03}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.2<br />
| {{date|2021|12|13}}<br />
| {{date|2022|01|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.1.1<br />
| [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]], [[D16AP|iPhone 13 mini]], [[D17AP|iPhone 13]], [[D63AP|iPhone 13 Pro]], [[D64AP|iPhone 13 Pro Max]]<br />
| {{date|2021|11|17}}<br />
| rowspan="2" | {{date|2021|12|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 15.1<br />
| [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad (8th generation)]], [[iPad (9th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad mini (6th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Air (4th generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPad Pro (11-inch) (3rd generation)]], [[iPad Pro (12.9-inch) (5th generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[N112AP|iPod touch (7th generation)]]<br />
| rowspan="2" | {{date|2021|10|25}}<br />
| {{no|Closed}}<br />
|-<br />
| [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]], [[D16AP|iPhone 13 mini]], [[D17AP|iPhone 13]], [[D63AP|iPhone 13 Pro]], [[D64AP|iPhone 13 Pro Max]]<br />
| {{date|2021|11|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.0.2<br />
| rowspan="2" | [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad (8th generation)]], [[iPad (9th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad mini (6th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Air (4th generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPad Pro (11-inch) (3rd generation)]], [[iPad Pro (12.9-inch) (5th generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]], [[D16AP|iPhone 13 mini]], [[D17AP|iPhone 13]], [[D63AP|iPhone 13 Pro]], [[D64AP|iPhone 13 Pro Max]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2021|10|11}}<br />
| {{date|2021|11|02}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.0.1<br />
| {{date|2021|10|01}}<br />
| {{date|2021|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="5" | 15.0<br />
|-<br />
| [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad (8th generation)]], [[iPad (9th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad mini (6th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Air (4th generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPad Pro (11-inch) (3rd generation)]], [[iPad Pro (12.9-inch) (5th generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2021|09|20}}<br />
| rowspan="2" | {{date|2021|10|08}}<br />
| rowspan="3" {{no|Closed}}<br />
|-<br />
| rowspan="3" | [[D16AP|iPhone 13 mini]], [[D17AP|iPhone 13]], [[D63AP|iPhone 13 Pro]], [[D64AP|iPhone 13 Pro Max]]<br />
| {{date|2021|09|30}}<br />
|-<br />
| rowspan="2" | {{date|2021|09|20}}<br />
| {{date|2021|09|29}}<br />
|-<br />
| -<br />
| {{partial|OTA}}<br />
|-<br />
| 14.8<br />
| rowspan="2" | [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad (8th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Air (4th generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPad Pro (11-inch) (3rd generation)]], [[iPad Pro (12.9-inch) (5th generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2021|09|13}}<br />
| {{date|2021|10|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.7.1<br />
| {{date|2021|07|26}}<br />
| {{date|2021|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.7<br/>(18G70)<br />
| [[iPad (8th generation)|iPad (8th generation) (iPad11,7)]] and [[iPad Air (4th generation)|iPad Air (4th generation) (iPad13,2)]]<br />
| rowspan="2" | {{date|2021|07|21}}<br />
| rowspan="3" | {{date|2021|08|03}}<br />
| rowspan="3" {{no|Closed}}<br />
|-<br />
| rowspan="2" | 14.7<br/>(18G69)<br />
| [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad (8th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Air (4th generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPad Pro (11-inch) (3rd generation)]], [[iPad Pro (12.9-inch) (5th generation)]]<br />
|-<br />
| [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2021|07|19}}<br />
|-<br />
| 14.6<br />
| rowspan="3" | [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad (8th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Air (4th generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPad Pro (11-inch) (3rd generation)]], [[iPad Pro (12.9-inch) (5th generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2021|05|24}}<br />
| {{date|2021|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.5.1<br />
| {{date|2021|05|03}}<br />
| {{date|2021|06|02}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.5<br />
| {{date|2021|04|26}}<br />
| {{date|2021|05|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.4.2<br />
| rowspan="4" | [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad (8th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Air (4th generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2021|03|26}}<br />
| {{date|2021|05|03}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.4.1<br />
| {{date|2021|03|09}}<br />
| {{date|2021|04|02}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.4<br />
| {{date|2021|01|26}}<br />
| {{date|2021|03|16}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.3<br />
| {{date|2020|12|14}}<br />
| {{date|2021|02|03}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 14.2.1<br />
| [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]]<br />
| rowspan="2" | {{date|2020|11|19}}<br />
| {{date|2021|01|08}}<br />
| rowspan="2" {{no|Closed}}<br />
|-<br />
| [[D52gAP|iPhone 12 mini]]<br />
| {{date|2021|01|07}}<br />
|-<br />
| 14.2 (18B111)<br />
| [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]]<br />
| {{date|2020|11|18}}<br />
| {{date|2021|01|08}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 14.2 (18B92)<br />
| [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad (8th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad Air 2]], [[iPad11,4|iPad Air (3rd generation) (iPad11,4)]], [[iPad Air (4th generation)]], [[iPad6,8|iPad Pro (12.9-inch) (iPad6,8)]], [[iPad6,4|iPad Pro (9.7-inch) (iPad6,4)]], [[iPad7,2|iPad Pro (12.9-inch) (2nd generation) (iPad7,2)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad8,12|iPad Pro (12.9-inch) (4th generation) (iPad8,12)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[N69uAP|iPhone SE (1st generation) (N69uAP)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]], [[N112AP|iPod touch (7th generation)]]<br />
| rowspan="2" | {{date|2020|11|05}}<br />
| {{date|2021|01|08}}<br />
| rowspan="2" {{no|Closed}}<br />
|-<br />
| [[iPad11,3|iPad Air (3rd generation) (iPad11,3)]], [[iPad6,3|iPad Pro (9.7-inch) (iPad6,3)]], [[iPad6,7|iPad Pro (12.9-inch) (iPad6,7)]], [[iPad7,1|iPad Pro (12.9-inch) (2nd generation) (iPad7,1)]], [[iPad8,11|iPad Pro (12.9-inch) (4th generation) (iPad8,11)]], [[N69AP|iPhone SE (1st generation) (N69AP)]],<br />
| {{date|2021|01|07}}<br />
|-<br />
| 14.1<br />
| [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad (8th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Air (4th generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[D331pAP|iPhone XS Max (iPhone11,6)]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[D52gAP|iPhone 12 mini]], [[D53gAP|iPhone 12]], [[D53pAP|iPhone 12 Pro]], [[D54pAP|iPhone 12 Pro Max]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2020|10|20}}<br />
| {{date|2020|11|12}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.0.1<br />
| rowspan="2" | [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad (8th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Air (4th generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2020|09|24}}<br />
| {{date|2020|10|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.0<br />
| {{date|2020|09|16}}<br />
| {{date|2020|10|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.7<br />
| rowspan="5" | [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[D79AP|iPhone SE (2nd generation)]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2020|09|01}}<br />
| {{date|2020|09|22}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.6.1<br />
| {{date|2020|08|12}}<br />
| {{date|2020|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.6<br />
| {{date|2020|07|15}}<br />
| {{date|2020|08|19}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.5.1<br />
| {{date|2020|06|01}}<br />
| {{date|2020|07|22}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.5<br />
| {{date|2020|05|20}}<br />
| {{date|2020|06|08}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 13.4.1<br />
| [[D79AP|iPhone SE (2nd generation)]]<br />
| {{date|2020|04|23}}<br />
| rowspan="2" | {{date|2020|05|27}}<br />
| rowspan="2" {{no|Closed}}<br />
|-<br />
| rowspan="2" | [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Pro (11-inch) (2nd generation)]], [[iPad Pro (12.9-inch) (4th generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2020|04|07}}<br />
|-<br />
| 13.4<br />
| {{date|2020|03|24}}<br />
| {{date|2020|04|16}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.3.1<br />
| rowspan="9" | [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad (7th generation)]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPad Air 2]], [[iPad Air (3rd generation)]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2020|01|28}}<br />
| {{date|2020|03|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.3<br />
| {{date|2019|12|10}}<br />
| {{date|2020|02|12}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.2.3<br />
| {{date|2019|11|18}}<br />
| {{date|2019|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.2.2<br />
| {{date|2019|11|07}}<br />
| {{date|2019|12|02}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.2<br />
| {{date|2019|10|28}}<br />
| {{date|2019|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.1.3<br />
| {{date|2019|10|15}}<br />
| rowspan="2" | {{date|2019|11|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.1.2<br />
| {{date|2019|09|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.1.1<br />
| {{date|2019|09|27}}<br />
| {{date|2019|10|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.1<br />
| {{date|2019|09|24}}<br />
| {{date|2019|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.0<br />
| [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N104AP|iPhone 11]], [[D421AP|iPhone 11 Pro]], [[D431AP|iPhone 11 Pro Max]]<br />
| {{date|2019|09|19}}<br />
| {{date|2019|10|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.5.5<br />
| rowspan="6" | [[iPad Air]], [[iPad mini 2]], [[iPad mini 3]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2021|09|23}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 12.5.4<br />
| {{date|2021|06|14}}<br />
| {{date|2021|10|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.5.3<br />
| {{date|2021|05|03}}<br />
| {{date|2021|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.5.2<br />
| {{date|2021|03|26}}<br />
| {{date|2021|05|19}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.5.1<br />
| {{date|2021|01|11}}<br />
| {{date|2021|04|02}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.5<br />
| {{date|2020|12|14}}<br />
| {{date|2021|01|19}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 12.4.9<br />
| [[iPad Air|iPad Air (iPad4,3)]]<br />
| rowspan="3" | {{date|2020|11|05}}<br />
| {{date|2021|01|19}}<br />
| rowspan="3" {{no|Closed}}<br />
|-<br />
| [[iPad Air|iPad Air (iPad4,2 and iPad4,1)]], [[iPad mini 2]], [[iPad mini 3|iPad mini 3 (iPad4,7)]], [[iPhone 5s|iPhone 5s (iPhone6,2)]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2021|01|08}}<br />
|-<br />
| [[iPad mini 3|iPad mini 3 (iPad4,8 and iPad4,9)]], [[iPhone 5s|iPhone 5s (iPhone6,1)]]<br />
| {{date|2021|01|07}}<br />
|-<br />
| 12.4.8<br />
| rowspan="7" | [[iPad Air]], [[iPad mini 2]], [[iPad mini 3]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2020|07|15}}<br />
| {{date|2020|11|12}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.4.7<br />
| {{date|2020|05|20}}<br />
| {{date|2020|07|22}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.4.6<br />
| {{date|2020|03|24}}<br />
| {{date|2020|05|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.4.5<br />
| {{date|2020|01|28}}<br />
| {{date|2020|03|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.4.4<br />
| {{date|2019|12|10}}<br />
| {{date|2020|05|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.4.3<br />
| {{date|2019|10|28}}<br />
| {{date|2020|01|09}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 12.4.2<br />
| rowspan="2" | {{date|2019|09|26}}<br />
| {{date|2019|11|06}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad Air 2]], [[iPad mini 4]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]]<br />
| {{date|2019|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.4.1<br />
| rowspan="2" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Air (3rd generation)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N102AP|iPod touch (6th generation)]], [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2019|08|26}}<br />
| {{date|2019|10|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.4<br />
| {{date|2019|07|22}}<br />
| {{date|2019|09|12}}<br />
| {{no|Closed}}<br />
|-<br />
|-<br />
| 12.3.2<br />
| [[iPhone 8 Plus]]<br />
| {{date|2019|06|10}}<br />
| rowspan="4" | {{date|2019|07|31}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 12.3.1<br />
| [[N112AP|iPod touch (7th generation)]]<br />
| {{date|2019|05|28}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad Air (3rd generation)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPad mini (5th generation)]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2019|05|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.3<br />
| {{date|2019|05|13}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.2<br />
| {{date|2019|03|25}}<br />
| {{date|2019|05|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.1.4<br />
| rowspan="2" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N102AP|iPod touch (6th generation)]]<br />
<br />
| {{date|2019|02|07}}<br />
| {{date|2019|04|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.1.3<br />
| {{date|2019|01|22}}<br />
| {{date|2019|03|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.1.2 (16C104)<br />
| rowspan="2" | [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]]<br />
| {{date|2018|12|20}}<br />
| rowspan="2" | {{date|2019|02|05}}<br />
| rowspan="2" {{no|Closed}}<br />
|-<br />
| 12.1.2 (16C101)<br />
| {{date|2018|12|17}}<br />
|-<br />
| 12.1.1<br />
| rowspan="2" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad Pro (11-inch)]], [[iPad Pro (12.9-inch) (3rd generation)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N102AP|iPod touch (6th generation)]]<br />
<br />
| {{date|2018|12|05}}<br />
| {{date|2019|02|05}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.1<br />
| {{date|2018|10|30}}<br />
| {{date|2018|12|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.0.1<br />
| [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N841AP|iPhone XR]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2018|10|08}}<br />
| {{date|2018|11|27}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 12.0<br />
| [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[D321AP|iPhone XS]], [[iPhone XS Max]], [[N102AP|iPod touch (6th generation)]]<br />
| rowspan="2" | {{date|2018|09|17}}<br />
| {{date|2018|10|22}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N841AP|iPhone XR]]<br />
| {{date|2018|09|17}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.4.1<br />
| rowspan="3" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad (6th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2018|07|09}}<br />
| {{date|2018|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.4<br />
| {{date|2018|05|29}}<br />
| {{date|2018|07|17}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.3.1<br />
| {{date|2018|04|24}}<br />
| {{date|2018|06|07}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 11.3<br />
| [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2018|03|29}}<br />
| rowspan="2" | {{date|2018|05|02}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad (6th generation)]]<br />
| {{date|2018|03|28}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2.6<br />
| rowspan="5" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2018|02|19}}<br />
| {{date|2018|04|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2.5<br />
| {{date|2018|01|23}}<br />
| {{date|2018|03|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2.2<br />
| {{date|2018|01|08}}<br />
| {{date|2018|01|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2.1<br />
| {{date|2017|12|13}}<br />
| {{date|2018|01|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2 (15C114)<br />
| {{date|2017|12|02}}<br />
| {{date|2018|01|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2 (15C113)<br />
| [[D22AP|iPhone X (iPhone10,3)]]<br />
| {{date|2017|12|04}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 11.1.2<br />
| rowspan="3" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2017|11|16}}<br />
| {{date|2017|12|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.1.1<br />
| {{date|2017|11|09}}<br />
| {{date|2017|12|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.1<br />
| {{date|2017|10|31}}<br />
| {{date|2017|12|05}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.0.3<br />
| rowspan="2" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2017|10|11}}<br />
| {{date|2017|11|28}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.0.2<br />
| {{date|2017|10|03}}<br />
| {{date|2017|11|16}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 11.0.1<br />
| [[iPhone 8]], [[iPhone 8 Plus]]<br />
| rowspan="2" | {{date|2017|09|26}}<br />
| {{date|2017|12|15}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2017|11|16}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.0<br />
| {{date|2017|09|19}}<br />
| {{date|2017|10|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.3.4<br />
| [[iPad (4th generation)]], [[iPhone 5]], [[iPhone 5c]]<br />
| {{date|2019|07|22}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| rowspan="4" | 10.3.3<br />
| [[iPhone 6s]]<br />
| {{date|2017|10|05}}<br />
| {{date|2017|11|16}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| rowspan="3" | {{date|2017|07|19}}<br />
| {{date|2017|10|04}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad Air]], [[iPad mini 2]] (except [[iPad4,6]]), [[iPhone 5s]]<br />
| rowspan="2" | -<br />
| {{partial|OTA}}<br />
|-<br />
| [[iPad (4th generation)]], [[iPhone 5]], [[iPhone 5c]]<br />
| {{yes|Open}}<br />
|-<br />
| rowspan="2" | 10.3.2<br />
| [[iPad Pro (12.9-inch) (2nd generation)]], [[iPad Pro (10.5-inch)]]<br />
| {{date|2017|06|05}}<br />
| {{date|2017|08|09}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2017|05|15}}<br />
| {{date|2017|08|09}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.3.1<br />
| {{date|2017|04|03}}<br />
| {{date|2017|06|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.3<br />
| {{date|2017|03|27}}<br />
| {{date|2017|04|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.2.1<br />
| rowspan="5" | [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2017|01|23}}<br />
| {{date|2017|04|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.2<br />
| {{date|2016|12|12}}<br />
| {{date|2017|01|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.1.1 (14B150)<br />
| {{date|2016|11|09}}<br />
| {{date|2016|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.1.1 (14B100)<br />
| {{date|2016|10|31}}<br />
| {{date|2016|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.1<br />
| {{date|2016|10|24}}<br />
| {{date|2016|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.3<br />
| [[iPhone 7]], [[iPhone 7 Plus]]<br />
| {{date|2016|10|17}}<br />
| {{date|2016|10|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.2<br />
| rowspan="2" | [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2016|09|23}}<br />
| {{date|2016|10|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.1<br />
| {{date|2016|09|13}}<br />
| {{date|2016|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.6<br />
| [[K95AP|iPad2,3]], [[iPad mini|iPad2,6 iPad2,7]] [[iPad (3rd generation)|iPad3,2 iPad3,3]], [[N94AP|iPhone 4S]]<br />
| {{date|2019|07|22}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| rowspan="2 | 9.3.5<br />
| [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| rowspan="2 | {{date|2016|08|25}}<br />
| {{date|2016|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad mini]], [[N94AP|iPhone 4S]], [[iPod touch (5th generation)]]<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 9.3.4<br />
| rowspan="2" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2016|08|04}}<br />
| {{date|2016|09|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.3<br />
| {{date|2016|07|18}}<br />
| {{date|2016|08|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.2 (13F72)<br />
| [[iPad Pro (9.7-inch)]]<br />
| {{date|2016|06|02}}<br />
| {{date|2016|08|24}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.3.2 (13F69)<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[J128AP|iPad Pro (iPad6,4)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| rowspan="2" | {{date|2016|05|16}}<br />
| {{date|2016|08|24}}<br />
| {{no|Closed}}<br />
|-<br />
| [[J127AP|iPad Pro (iPad6,3)]]<br />
| {{date|2016|05|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.1<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2016|03|31}}<br />
| {{date|2016|06|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3 (13E237)<br />
| [[K93AP|iPad 2 (iPad2,1)]], [[K95AP|iPad 2 (iPad2,3)]], [[K93AAP|iPad 2 (iPad2,4)]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]<br />
| {{date|2016|03|28}}<br />
| rowspan="2" | {{date|2016|04|22}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3 (13E236)<br />
| [[K94AP|iPad 2 (iPad2,2)]]<br />
| {{date|2016|03|25}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3 (13E234)<br />
| [[iPad Pro (9.7-inch)]]<br />
| rowspan="3" | {{date|2016|03|21}}<br />
| rowspan="2" | {{date|2016|04|18}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.3 (13E233)<br />
| [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini 3]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE (1st generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]<br />
| {{date|2016|03|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.1 (13D20)<br />
| [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini 3]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]]<br />
| {{date|2016|02|18}}<br />
| rowspan="2" | {{date|2016|04|05}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.1 (13D15)<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2016|01|19}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.2<br />
| [[K93AAP|iPad 2 (iPad2,4)]], [[J1AP|iPad (3rd generation) (iPad3,1)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| rowspan="2" | {{date|2015|12|08}}<br />
| {{date|2016|02|05}}<br />
| {{no|Closed}}<br />
|-<br />
| [[K93AP|iPad 2 (iPad2,1)]], [[K94AP|iPad 2 (iPad2,2)]], [[K95AP|iPad 2 (iPad2,3)]], [[J2AP|iPad (3rd generation) (iPad3,2)]], [[J2AAP|iPad (3rd generation) (iPad3,3)]], [[N94AP|iPhone 4S]]<br />
| {{date|2016|02|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.1 (13B144)<br />
| [[iPad Pro (12.9-inch)]]<br />
| {{date|2015|11|17}}<br />
| rowspan="2" | {{date|2015|12|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.1 (13B143)<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| rowspan="2" | {{date|2015|10|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad Pro]]<br />
| {{date|2015|12|02}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0.2<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2015|09|30}}<br />
| {{date|2015|10|29}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.0.1<br />
| [[iPhone 6s]], [[iPhone 6s Plus]]<br />
| {{date|2015|09|24}}<br />
| rowspan="2" | {{date|2015|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2015|09|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2015|09|16}}<br />
| rowspan="2" | {{date|2015|09|30}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 8.4.1<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| rowspan="2" | {{date|2015|08|13}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[iPhone 4S]], [[iPhone 5]], [[iPod touch (5th generation)]]<br />
| -<br />
| {{partial|OTA}}<br />
|-<br />
| rowspan="2" | 8.4<br />
| [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2015|07|15}}<br />
| rowspan="2" | {{date|2015|08|23}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="7" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]]<br />
| {{date|2015|06|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.3<br />
| {{date|2015|04|08}}<br />
| {{date|2015|07|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.2<br />
| {{date|2015|03|09}}<br />
| {{date|2015|05|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1.3<br />
| {{date|2015|01|27}}<br />
| {{date|2015|03|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1.2<br />
| {{date|2014|12|09}}<br />
| {{date|2015|02|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1.1<br />
| {{date|2014|11|17}}<br />
| {{date|2014|12|17}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1<br />
| {{date|2014|10|20}}<br />
| {{date|2014|12|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.0.2<br />
| rowspan="3" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]]<br />
| {{date|2014|09|25}}<br />
| {{date|2014|10|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.0.1<br />
| colspan="2" | {{date|2014|09|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.0<br />
| {{date|2014|09|17}}<br />
| {{date|2014|10|22}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 7.1.2<br />
| [[iPhone 4]]<br />
| rowspan="2" | {{date|2014|06|30}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]<br />
| {{date|2014|09|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.1.1<br />
| rowspan="3" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]<br />
| {{date|2014|04|22}}<br />
| {{date|2014|08|12}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.1<br />
| {{date|2014|03|10}}<br />
| {{date|2014|04|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.6<br />
| {{date|2014|02|21}}<br />
| {{date|2014|03|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.5<br />
| [[N49AP|iPhone 5c (iPhone5,4)]], [[N53AP|iPhone 5s (iPhone6,2)]]<br />
| {{date|2014|01|29}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.4<br />
| rowspan="2" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]<br />
| {{date|2013|11|14}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.3<br />
| {{date|2013|10|22}}<br />
| {{date|2013|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 7.0.2<br />
| [[P105AP|iPad mini (iPad2,5)]]<br />
| rowspan="2" | {{date|2013|09|26}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[P106AP|iPad mini (iPad2,6)]], [[P107AP|iPad mini (iPad2,7)]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]<br />
| {{date|2013|10|29}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.1<br />
| [[iPhone 5c]], [[iPhone 5s]]<br />
| {{date|2013|09|18}}<br />
| {{date|2013|10|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPod touch (5th generation)]]<br />
| {{date|2013|09|18}}<br />
| {{date|2013|10|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.6<br />
| [[N88AP|iPhone 3GS]], [[N88AP|iPod touch (4th generation)]]<br />
| {{date|2014|02|21}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 6.1.5<br />
| [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2013|11|14}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.4<br />
| [[iPhone 5]]<br />
| {{date|2013|05|02}}<br />
| {{date|2013|09|20}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="7" | 6.1.3<br />
| [[iPad 2]] (except [[iPad2,4]]), [[iPhone 4S]]<br />
| {{date|2018|01|10}}<br />
| {{date|2019|11|07}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N88AP|iPhone 3GS]]<br />
| rowspan="6" | {{date|2013|03|19}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2013|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPhone 5]]<br />
| {{date|2013|05|02}}<br />
| {{no|Closed}}<br />
|-<br />
| [[P106AP|iPad mini (iPad2,6)]]<br />
| {{date|2013|09|25}}<br />
| {{no|Closed}}<br />
|-<br />
| [[K93AAP|iPad2,4]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[P105AP|iPad mini (iPad2,5)]], [[P107AP|iPad mini (iPad2,7)]], [[iPhone 4]], [[iPod touch (5th generation)]]<br />
| {{date|2013|09|20}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]] (except [[iPad2,4]]), [[iPhone 4S]]<br />
| -<br />
| {{partial|OTA}}<br />
|-<br />
| rowspan="2" | 6.1.2<br />
| [[N78AP|iPod touch (5th generation)]]<br />
| rowspan="2" | {{date|2013|02|19}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]] [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2013|03|19}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.1<br />
| [[N94AP|iPhone 4S]]<br />
| {{date|2013|02|11}}<br />
| {{date|2013|02|19}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.1<br />
| [[P106AP|iPad mini (iPad2,6)]], [[N81AP|iPod touch (4th generation)]]<br />
| rowspan="2" | {{date|2013|01|28}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N78AP|iPod touch (5th generation)]]<br />
| {{date|2013|02|19}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.0.2<br />
| [[P105AP|iPad mini (iPad2,5)]], [[iPhone 5]]<br />
| colspan="2" | {{date|2013|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad mini]], [[iPhone 5]]<br />
| {{date|2012|12|18}}<br />
| {{date|2013|01|28}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="4" | 6.0.1<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]<br />
| {{date|2012|11|01}}<br />
| {{date|2013|01|28}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[P101AP|iPad (4th generation) (iPad3,4)]], [[P105AP|iPad mini (iPad2,5)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]<br />
| colspan="2" | {{date|2013|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad mini]]<br />
| {{date|2012|11|01}}<br />
| {{date|2013|01|08}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad (4th generation)]], [[iPad mini]]<br />
| {{date|2012|11|09}}<br />
| {{date|2013|01|28}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 6.0<br />
| [[P101AP|iPad (4th generation) (iPad3,4)]], [[P105AP|iPad mini (iPad2,5)]]<br />
| {{date|2012|10|30}}<br />
| {{date|2012|11|01}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[P105AP|iPad mini (iPad2,5)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]<br />
| colspan="2" | {{date|2013|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]<br />
| {{date|2012|09|19}}<br />
| {{date|2012|11|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1.1 (9B208)<br />
| [[N90AP|iPhone 4 (iPhone3,1)]]<br />
| {{date|2012|05|25}}<br />
| {{date|2012|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="4" | 5.1.1 (9B206)<br />
| rowspan="2" |[[K48AP|iPad]]<br />
| {{date|2017|02|13}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| rowspan="3" | {{date|2012|05|07}}<br />
| {{date|2017|02|13}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N18AP|iPod touch (3rd generation)]]<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2012|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1<br />
| [[K48AP|iPad]], [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2012|03|07}}<br />
| {{date|2012|05|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.0.1<br />
| [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2011|11|09}}<br />
| {{date|2012|02|08}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 5.0<br />
| [[N94AP|iPhone 4S]]<br />
| {{date|2011|10|14}}<br />
| {{date|2011|11|10}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2011|10|04}}<br />
| {{date|2011|11|10}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.5<br />
| rowspan="6" | [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4(iPhone3,1)]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2011|07|25}}<br />
| {{date|2011|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.4<br />
| {{date|2011|07|15}}<br />
| {{date|2011|07|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.3<br />
| {{date|2011|05|04}}<br />
| {{date|2011|07|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.2<br />
| {{date|2011|04|14}}<br />
| {{date|2011|05|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.1<br />
| {{date|2011|03|25}}<br />
| {{date|2011|04|19}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.3<br />
| {{date|2011|03|09}}<br />
| {{date|2011|03|27}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.10<br />
| rowspan="5" | [[N92AP|iPhone 4 (iPhone3,3)]]<br />
| {{date|2011|07|25}}<br />
| {{date|2011|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.9<br />
| {{date|2011|07|15}}<br />
| {{date|2011|07|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.8<br />
| {{date|2011|05|04}}<br />
| {{date|2011|07|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.7<br />
| {{date|2011|04|14}}<br />
| {{date|2011|05|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.6<br />
| {{date|2011|02|01}}<br />
| {{date|2011|04|19}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 4.2.1<br />
| [[N82AP|iPhone 3G]], [[N72AP|iPod touch (2nd generation)]]<br />
| rowspan="2" | {{date|2010|11|22}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[K48AP|iPad]], [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2011|03|11}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.1 (8B118)<br />
| [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2010|09|21}}<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="4" | 4.1 (8B117)<br />
| [[N72AP|iPod touch (2nd generation)]], [[N18AP|iPod touch (3rd generation)]]<br />
| {{date|2010|09|08}}<br />
| rowspan="2" | -<br />
| {{yes|Open}}<br />
|-<br />
| rowspan="2" | [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]]<br />
| {{date|2017|02|13}}<br />
| {{yes|Open}}<br />
|-<br />
| rowspan="2" | {{date|2010|09|08}}<br />
| {{date|2017|02|13}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N90AP|iPhone 4 (iPhone3,1)]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 4.0.2<br />
| [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]], [[N18AP|iPod touch (3rd generation)]]<br />
| {{date|2010|08|11}}<br />
| {{date|2010|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | [[N82AP|iPhone 3G]], [[N72AP|iPod touch (2nd generation)]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| {{date|2010|08|11}}<br />
| {{date|2010|09|18}}<!--Apple may have ceased signing earlier.--><br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 4.0.1<br />
| rowspan="2" | [[N82AP|iPhone 3G]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| {{date|2010|07|15}}<br />
| {{date|2010|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]]<br />
| {{date|2010|07|15}}<br />
| {{date|2010|08|19}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="6" | 4.0<br />
| [[N82AP|iPhone 3G]], [[N72AP|iPod touch (2nd generation)]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[N18AP|iPod touch (3rd generation)]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|08|09}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N72AP|iPod touch (2nd generation)]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N82AP|iPhone 3G]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N88AP|iPhone 3GS]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N90AP|iPhone 4 (iPhone3,1)]]<br />
| {{date|2010|06|24}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.2.2<br />
| rowspan="3" | [[K48AP|iPad]]<br />
| {{date|2010|08|11}}<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 3.2.1<br />
| {{date|2010|07|15}}<br />
| {{date|2010|08|19}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.2<br />
| {{date|2010|04|03}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 3.1.3<br />
| [[N72AP|iPod touch (2nd generation)]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[N88AP|iPhone 3GS]], [[N72AP|iPod touch (2nd generation)]], [[N18AP|iPod touch (3rd generation)]] <br />
| {{date|2010|02|02}}<br />
| {{date|2010|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 3.1.2<br />
| [[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]]<br />
| {{date|2009|10|08}}<br />
| {{date|2010|02|02}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | [[N72AP|iPod touch (2nd generation)]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| {{date|2009|10|08}}<br />
| {{date|2010|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.1.1 (7C146)<br />
| rowspan="2" | [[N18AP|iPod touch (3rd generation)]]<br />
| {{date|2009|09|17}}<br />
| {{date|2009|10|08}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 3.1.1 (7C145)<br />
| {{date|2009|09|09}}<br />
| {{date|2009|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | [[N72AP|iPod touch (2nd generation)]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| {{date|2009|09|09}}<br />
| {{date|2010|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.1<br />
| rowspan="3" | [[N88AP|iPhone 3GS]]<br />
| {{date|2009|09|09}}<br />
| {{date|2009|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.0.1<br />
| {{date|2009|07|31}}<br />
| rowspan="2" | {{date|2009|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.0<br />
| {{date|2009|06|19}}<br />
| {{no|Closed}}<br />
|}<br />
<br />
=== tvOS ===<br />
{| class="wikitable"<br />
|-<br />
! Firmware<br />
! For Device(s)<br />
! From<br />
! Until<br />
! Status<br />
|-<br />
| 15.4.1<br />
| rowspan="10" | [[J42dAP|Apple TV HD]]<br/>[[Apple TV 4K]]<br/>[[Apple TV 4K (2nd generation)]]<br />
| {{date|2022|03|31}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 15.4<br />
| {{date|2022|03|14}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 15.3<br />
| {{date|2022|01|26}}<br />
| {{date|2022|03|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.2<br />
| {{date|2021|12|13}}<br />
| {{date|2022|02|03}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.1.1<br />
| {{date|2021|11|01}}<br />
| {{date|2021|12|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.1<br />
| {{date|2021|10|25}}<br />
| {{date|2021|11|09}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.0<br />
| {{date|2021|09|20}}<br />
| {{date|2021|11|02}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.7<br />
| {{date|2021|07|19}}<br />
| {{date|2021|10|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.6<br />
| {{date|2021|05|24}}<br />
| {{date|2021|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.5<br />
| {{date|2021|04|26}}<br />
| {{date|2021|06|02}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.4<br />
| rowspan="34" | [[J42dAP|Apple TV HD]]<br/>[[Apple TV 4K]]<br />
| {{date|2021|01|26}}<br />
| {{date|2021|05|03}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.3<br />
| {{date|2020|12|14}}<br />
| {{date|2021|02|03}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.2<br />
| {{date|2020|11|05}}<br />
| {{date|2021|01|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.0.2<br />
| {{date|2020|10|05}}<br />
| {{date|2020|11|12}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.0.1<br />
| {{date|2020|09|24}}<br />
| {{date|2020|10|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.0<br />
| {{date|2020|09|16}}<br />
| {{date|2020|10|01}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 13.4.8<br />
| {{date|2020|10|28}}<br />
| -<br />
| rowspan="2" {{yes|Open}}<br />
|-<br />
| {{date|2020|07|15}}<br />
| {{date|2020|10|27}}<br />
|-<br />
| 13.4.6<br />
| {{date|2020|06|01}}<br />
| {{date|2020|07|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.4.5<br />
| {{date|2020|05|20}}<br />
| {{date|2020|06|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.4<br />
| {{date|2020|03|24}}<br />
| {{date|2020|05|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.3.1<br />
| {{date|2020|01|28}}<br />
| {{date|2020|03|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.3<br />
| {{date|2019|12|10}}<br />
| {{date|2020|02|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.2<br />
| {{date|2019|10|28}}<br />
| {{date|2020|01|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.0<br />
| {{date|2019|09|24}}<br />
| {{date|2019|11|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.4.1<br />
| {{date|2019|08|26}}<br />
| {{date|2019|10|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.4<br />
| {{date|2019|07|22}}<br />
| {{date|2019|09|12}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.3<br />
| {{date|2019|05|13}}<br />
| {{date|2019|07|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.2.1<br />
| {{date|2019|04|10}}<br />
| {{date|2019|05|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.2<br />
| {{date|2019|03|25}}<br />
| {{date|2019|05|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.1.2<br />
| {{date|2019|01|22}}<br />
| {{date|2019|04|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.1.1<br />
| {{date|2018|12|05}}<br />
| {{date|2019|02|05}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.1<br />
| {{date|2018|10|30}}<br />
| {{date|2018|12|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.0.1<br />
| {{date|2018|09|24}}<br />
| {{date|2018|11|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.0<br />
| {{date|2018|09|17}}<br />
| {{date|2018|10|22}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.4.1<br />
| {{date|2018|07|09}}<br />
| {{date|2018|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.4<br />
| {{date|2018|05|29}}<br />
| {{date|2018|07|17}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.3<br />
| {{date|2018|03|29}}<br />
| {{date|2018|06|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2.6<br />
| {{date|2018|02|19}}<br />
| {{date|2018|04|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2.5<br />
| {{date|2018|01|23}}<br />
| {{date|2018|03|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2.1<br />
| {{date|2017|12|13}}<br />
| {{date|2018|01|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2<br />
| {{date|2017|12|02}}<br />
| {{date|2018|01|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.1<br />
| {{date|2017|10|31}}<br />
| {{date|2017|12|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.0<br />
| {{date|2017|09|19}}<br />
| {{date|2017|12|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.2.2<br />
| rowspan="14" | [[J42dAP|Apple TV HD]]<br />
| {{date|2017|07|19}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 10.2.1<br />
| {{date|2017|05|15}}<br />
| {{date|2017|08|09}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.2<br />
| {{date|2017|03|27}}<br />
| {{date|2017|06|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.1.1<br />
| {{date|2017|01|23}}<br />
| {{date|2017|04|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.1<br />
| {{date|2016|12|12}}<br />
| {{date|2017|01|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.1<br />
| {{date|2016|10|24}}<br />
| {{date|2017|01|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0<br />
| {{date|2016|09|13}}<br />
| {{date|2016|10|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.2<br />
| {{date|2016|07|18}}<br />
| {{date|2016|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.1<br />
| {{date|2016|05|16}}<br />
| {{date|2016|09|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2<br />
| {{date|2016|03|21}}<br />
| {{date|2016|06|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.1.1<br />
| {{date|2016|01|25}}<br />
| {{date|2016|04|05}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.1<br />
| {{date|2015|12|08}}<br />
| {{date|2016|02|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0.1<br />
| {{date|2015|11|09}}<br />
| {{date|2015|12|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0<br />
| {{date|2015|10|29}}<br />
| {{date|2015|12|14}}<br />
| {{no|Closed}}<br />
|}<br />
<br />
=== Apple TV ===<br />
{| class="wikitable"<br />
|-<br />
! Marketing Firmware<br />
! OS Firmware<br />
! For Device(s)<br />
! From<br />
! Until<br />
! Status<br />
|-<br />
| 7.9<br />
| rowspan="7" | 8.4.4<br />
| rowspan="18" | [[Apple TV (3rd generation)]]<br />
| {{date|2022|03|14}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 7.8<br />
| {{date|2021|09|20}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 7.7<br />
| {{date|2021|04|26}}<br />
| {{date|2021|10|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.6.2<br />
| {{date|2020|12|14}}<br />
| {{date|2021|05|03}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.6.1<br />
| {{date|2020|11|05}}<br />
| rowspan="3" | {{date|2021|01|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.6<br />
| {{date|2020|09|16}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.5<br />
| {{date|2020|03|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.4<br />
| 8.4.3<br />
| {{date|2019|09|24}}<br />
| {{date|2020|08|11}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.3.1<br />
| rowspan="3" | 8.4.2<br />
| {{date|2019|07|22}}<br />
| {{date|2019|10|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.3<br />
| {{date|2019|05|13}}<br />
| {{date|2019|07|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.2.2<br />
| {{date|2016|12|12}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 7.2.1<br />
| 8.4.1<br />
| {{date|2016|02|25}}<br />
| {{date|2016|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.2<br />
| 8.3<br />
| {{date|2015|04|08}}<br />
| {{date|2016|04|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.1<br />
| 8.2<br />
| {{date|2015|03|09}}<br />
| {{date|2015|05|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.3<br />
| 8.1.3<br />
| {{date|2015|01|27}}<br />
| {{date|2015|03|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.2<br />
| 8.1.1<br />
| {{date|2014|11|17}}<br />
| {{date|2015|04|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.1<br />
| 8.1<br />
| {{date|2014|10|20}}<br />
| {{date|2014|12|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0<br />
| 8.0<br />
| {{date|2014|09|17}}<br />
| {{date|2014|10|22}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.2.1<br />
| rowspan="2" | 7.1.2<br />
| [[K66AP|Apple TV (2nd generation)]]<br />
| {{date|2014|09|17}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 6.2<br />
| rowspan="8" | [[K66AP|Apple TV (2nd generation)]], [[Apple TV (3rd generation)]]<br />
| {{date|2014|06|30}}<br />
| {{date|2014|09|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.1<br />
| 7.1.1<br />
| {{date|2014|04|22}}<br />
| {{date|2014|07|11}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1<br />
| 7.1<br />
| {{date|2014|03|10}}<br />
| {{date|2014|04|30}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.0.2<br />
| 7.0.6<br />
| {{date|2014|02|21}}<br />
| {{date|2014|03|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.4<br />
| {{date|2013|11|14}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.0.1<br />
| 7.0.3<br />
| {{date|2013|10|24}}<br />
| {{date|2013|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.0<br />
| 7.0.2<br />
| {{date|2013|09|24}}<br />
| {{date|2013|10|29}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.1<br />
| {{date|2013|09|20}}<br />
| {{date|2013|09|24}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 5.3<br />
| rowspan="2" | 6.1.4<br />
| [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]<br />
| {{date|2013|06|19}}<br />
| {{date|2013|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[K66AP|Apple TV (2nd generation)]], [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]<br />
| {{date|2013|06|19}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 5.2.1<br />
| 6.1.3<br />
| rowspan="2" | [[K66AP|Apple TV (2nd generation)]], [[Apple TV (3rd generation)]]<br />
| {{date|2013|03|19}}<br />
| {{date|2013|06|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.2<br />
| 6.1<br />
| {{date|2013|01|28}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1.1<br />
| 6.0.1<br />
| rowspan="5" | [[K66AP|Apple TV (2nd generation)]], [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]<br />
| {{date|2012|11|26}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1<br />
| 6.0<br />
| {{date|2012|09|24}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.0.2<br />
| rowspan="2" | 5.1.1<br />
| {{date|2012|06|05}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.0.1<br />
| {{date|2012|05|10}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 5.0<br />
| 5.1<br />
| {{date|2012|03|07}}<br />
| {{date|2012|05|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.4<br />
| rowspan="2" | 5.0.1<br />
| rowspan="12" | [[K66AP|Apple TV (2nd generation)]]<br />
| {{date|2011|12|15}}<br />
| {{date|2012|03|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.3<br />
| {{date|2011|11|17}}<br />
| {{date|2012|01|11}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.2<br />
| rowspan="3" | 5.0<br />
| {{date|2011|10|24}}<br />
| {{date|2012|01|11}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.1<br />
| {{date|2011|10|17}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 4.4<br />
| {{date|2011|10|04}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 4.3<br />
| rowspan="4" | 4.3<br />
| {{date|2011|03|09}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.2<br />
| {{date|2011|05|11}}<br />
| {{date|2011|10|18}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.1<br />
| {{date|2011|03|22}}<br />
| {{date|2011|05|28}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.2<br />
| {{date|2011|03|09}}<br />
| {{date|2011|03|22}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.1.1<br />
| 4.2.1<br />
| {{date|2010|12|14}}<br />
| {{date|2011|05|28}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.1<br />
| 4.2<br />
| {{date|2010|11|22}}<br />
| {{date|2010|12|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.0<br />
| 4.1<br />
| {{date|2010|09|29}}<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|}<br />
<br />
=== audioOS ===<br />
{| class="wikitable"<br />
|-<br />
! Firmware<br />
! For Device(s)<br />
! From<br />
! Until<br />
! Status<br />
|-<br />
| 15.4.1<br />
| rowspan="15" | [[HomePod]]<br/>[[B520AP|HomePod mini]]<br />
| {{date|2022|03|31}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 15.4<br />
| {{date|2022|03|14}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 15.3<br />
| {{date|2022|01|26}}<br />
| {{date|2022|03|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.2<br />
| {{date|2021|12|13}}<br />
| {{date|2022|02|03}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.1.1<br />
| {{date|2021|11|03}}<br />
| {{date|2021|12|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 15.1<br />
| {{date|2021|10|25}}<br />
| {{date|2021|11|10}}<br />
| {{no|Closed}}<br />
|-<br />
|15.0<br />
| {{date|2021|09|20}}<br />
| {{date|2021|11|02}}<br />
| {{no|Closed}}<br />
|-<br />
|14.7<br />
| {{date|2021|07|19}}<br />
| {{date|2021|10|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.6<br />
| {{date|2021|05|24}}<br />
| {{date|2021|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.5<br />
| {{date|2021|04|26}}<br />
| {{date|2021|06|02}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.4<br />
| {{date|2021|01|26}}<br />
| {{date|2021|05|03}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.3<br />
| {{date|2020|12|14}}<br />
| {{date|2021|02|03}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.2.1<br />
| {{date|2020|12|07}}<br />
| {{date|2021|01|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.2<br />
| {{date|2020|11|05}}<br />
| {{date|2020|12|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 14.1<br />
| {{date|2020|10|20}}<br />
| {{date|2020|11|12}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.4.8<br />
| rowspan="19" | [[HomePod]]<br />
| {{date|2020|07|15}}<br />
| {{date|2020|10|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.4.6<br />
| {{date|2020|06|01}}<br />
| {{date|2020|07|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.4.5<br />
| {{date|2020|05|20}}<br />
| {{date|2020|06|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.4<br />
| {{date|2020|03|24}}<br />
| {{date|2020|05|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.3.1<br />
| {{date|2020|01|28}}<br />
| {{date|2020|03|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.3<br />
| {{date|2019|12|10}}<br />
| {{date|2020|02|12}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.2.1<br />
| {{date|2019|10|30}}<br />
| {{date|2019|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 13.2<br />
| colspan="2" | {{date|2019|10|28}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.4<br />
| {{date|2019|07|22}}<br />
| {{date|2019|11|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.3<br />
| {{date|2019|05|19}}<br />
| {{date|2019|07|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.2<br />
| {{date|2019|03|25}}<br />
| {{date|2019|05|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 12.1.3<br />
| {{date|2019|01|22}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 12.1.1<br />
| {{date|2018|12|05}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 12.1<br />
| {{date|2018|10|30}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 12.0<br />
| {{date|2018|09|17}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 11.4.1<br />
| {{date|2018|07|09}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 11.4<br />
| {{date|2018|05|29}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 11.3<br />
| {{date|2018|03|29}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 11.0.2<br />
| {{date|2017|07|28}}<br />
| ?<br />
| {{no|Closed}}<br />
|}<br />
<br />
== Protocol ==<br />
To request a SHSH blob from Apple, a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] request can be made. For a full description, see the separate articles [[SHSH Protocol]] and [[Baseband SHSH Protocol]].<br />
<br />
== See Also ==<br />
* [[APTicket]]<br />
* [[Redsn0w]]<br />
* [[iFaith]]<br />
* [[TinyUmbrella]]<br />
<br />
== References ==<br />
<references /><br />
<br />
== External Links ==<br />
* [http://www.saurik.com/id/12 Detailed background info from Saurik]<br />
* [https://github.com/tihmstar/tsschecker tsschecker]<br />
* [https://github.com/Neal/savethemblobs savethemblobs]<br />
<br />
[[Category:Firmware Tags]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=UID_key&diff=121990UID key2022-04-03T20:38:24Z<p>AS967: </p>
<hr />
<div>The '''UID key''' (device's unique ID key) is an AES 256-bit hardware key, unique to each iPhone. It is fused into the application processor during manufacturing. It was previously used to encrypt things in the [[NOR]]. In later iOS versions, it is used to encrypt the entire file system, so that the flash chips cannot moved to another device and read out there again. On the [[S5L8960]] and later, the [[Secure Enclave|SEP]] has its own UID in its own AES engine, used to encrypt user data keybags. On the [[S8000]] and later, the chip securely generates the UID for the device rather than the UID being externally fused in.<br />
<br />
Apple says about this key:<br/><br />
''"The UID is unique to each device and is not recorded by Apple or any of its suppliers."''<br/><br />
and also<br/><br />
''"The UID is not related to any other identifier on the device."''<br />
<br />
See also: [[GID Key]].<br />
<br />
===References===<br />
*[https://www.apple.com/br/privacy/docs/iOS_Security_Guide_Oct_2014.pdf iOS Security document by Apple]<br />
<br />
[[Category:Decryption]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=IMG4_File_Format&diff=121989IMG4 File Format2022-04-03T18:27:13Z<p>AS967: </p>
<hr />
<div>The '''IMG4 file format''' is a replacement for the [[IMG3 File Format|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer). It's also used across the entire [[List of Apple Watches| Apple Watch series]], in both the armv7k and arm64_32 processors. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#IMG4_Payload|'''im4p''' files]]), signatures of those files ([[#IMG4_Manifest|'''im4m''']]/<code>ApImg4Ticket</code> files) and some info used in the [[Restore_Process|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). A complete IMG4 file is the result of concatenating the payload, manifest and restore info (aka boot nonce) in one file and wrapping it with an IMG4 header.<br />
<br />
== Structure ==<br />
Contrary to the [[IMG3 File Format|IMG3 file format]] where a custom binary format was used, IMG4 files (and their payloads) are [[wikipedia:X.690#DER encoding|DER]] encoded [[wikipedia:Abstract Syntax Notation One|ASN.1]] objects. The reason for Apple's choice of ASN.1/DER encoding over their own [[PList File Format|Property List]] (PList) file format is currently unknown.<br />
<br />
<pre><br />
sequence [<br />
0: string "IMG4"<br />
1: payload - IMG4 Payload, IM4P<br />
2: [0] (constructed) [<br />
manifest - IMG4 Manifest, IM4M<br />
]<br />
]<br />
</pre><br />
<br />
==IMG4 Payload==<br />
Payload contains the actual content of the file. IMG4 format allows to store payload in a separate file with '''im4p''' extension. '''im4p''' files are used more often than complete IMG4 files. Payload is structured as follows:<br />
<pre><br />
sequence [<br />
0: string "IM4P"<br />
1: string type - ibot, rdsk, sepi, ...<br />
2: string description - 'iBoot-1940.1.75'<br />
3: octetstring - the encrypted/raw data<br />
4: octetstring - containing DER encoded KBAG values (optional)<br />
sequence [<br />
sequence [<br />
0: int: 01<br />
1: octetstring: iv<br />
2: octetstring: key<br />
]<br />
sequence [<br />
0: int: 02<br />
1: octetstring: iv<br />
2: octetstring: key<br />
]<br />
]<br />
]<br />
</pre><br />
<br />
==IMG4 Manifest==<br />
A.k.a. IM4M. Contains signature for one or multiple IMG4 payloads. Manifests are designed in a way that they can be stored separately from an IMG4 file or be a part of one. An example of an IMG4 manifest is ApImg4Ticket. Each IMG4 manifest is made of tags structured as follows (content = DER encoded object):<br />
<pre><br />
[type] (private) [ - DER tag's class is the type of the tag (4 bytes) encoded as a big-endian integer<br />
sequence [<br />
string type - type of the tag, 4 bytes<br />
content - content of the tag<br />
]<br />
]<br />
</pre><br />
Manifest structure (tag <type> = tag of type 'type'):<br />
<pre><br />
sequence [<br />
0: string "IM4M"<br />
1: integer version - currently 0<br />
2: set [<br />
tag MANB [ - manifest body<br />
set [<br />
tag MANP [ - manifest properties<br />
set [<br />
tag <manifest property> [<br />
content<br />
]<br />
... - tags, describing other properties<br />
]<br />
]<br />
tag <type> [ - ibot, illb, sepi, krnl, NvMR, bbcl...<br />
set [<br />
tag <tag property> [<br />
content<br />
]<br />
...<br />
]<br />
]<br />
... - tags for other images<br />
]<br />
]<br />
]<br />
3: octet string signature<br />
4: sequence [ - containing certificate chain (arbitrary number of certificates)<br />
certificates<br />
]<br />
</pre><br />
<br />
<br />
== External Links ==<br />
* [https://twitter.com/i0n1c/status/501299082603020288 i0n1c's tweet]<!-- TODO: Work this into the article --><br />
* [https://www.itu.int/rec/T-REC-X.690/en X.690 - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)]<br />
<br />
[[Category:File Formats]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Security_Fusings&diff=120286Security Fusings2022-01-04T02:06:48Z<p>AS967: /* Fuse seal */</p>
<hr />
<div>iDevice security and APTicket configuration settings are often determined by security fuses on the SoC.<br />
<br />
== Effective vs. Raw fusing ==<br />
<br />
iDevices have two views of fuses, the "raw" fuse status which represent the actual state of the fuses, and the "effective" fusing status, which is a copy of the raw fuses that can override security configuration normally set by the fuses, assuming one can write to the effective fusing status register.<br />
<br />
=== Pre-A7 devices ===<br />
<br />
Pre-A7 devices only had one view of fuses and it could have overrides enabled. However, production-fused devices have the security epoch set while development-fused devices don't, so that one can distinguish a production-fused device from a demoted device.<br />
<br />
=== Post-A7 devices ===<br />
<br />
Post-A7 devices have two views of fuses, effective and raw, and the AP and SEP can read both to distinguish a demoted device from a development-fused one.<br />
<br />
== ECID ==<br />
<br />
See [[ECID]].<br />
<br />
== Production Mode ==<br />
<br />
The production mode fuse in the SoC controls not only whether JTAG/SWD is enabled on the AP or not, but also controls what UID and GID keys the AP AES engine will use to decrypt data. <br />
<br />
== Security Mode ==<br />
<br />
The secure mode fuse controls whether JTAG/SWD is enabled on the SEP, and controls the GID and UID used by the SEP AES engine. It also governs whether the AP SecureROM can boot untrusted code on post-A7 devices, in addition to the Test Mode board configuration setting. From an AP perspective, the secure mode fuse is always read from the raw fuses.<br />
<br />
<br />
== Fuse seal ==<br />
<br />
Unclear as to what the fuse seal does, though from the name it seems to lock the raw fuses from being altered further. Only present on post-A7 devices.<br />
<br />
== Fuse lock ==<br />
<br />
Fuse locking sets a register such that changes to the effective fuses are no longer possible until the next device reset. This ensures that the only way to demote a device is to have a validly signed APTicket loaded by SecureROM. (assuming no vulnerabilities)<br />
<br />
== Use in APTickets ==<br />
<br />
The Apple signing server uses the raw and effective production/security status to ensure that iOS builds are only being signed for devices that are expected to have them.<br />
<br />
<br />
== Demotion ==<br />
<br />
Demotion is the term used to refer to changing a device's effective fuse status to enable debugging of the AP and SEP. The effective fuse status register will accept writes (assuming it hasn't been locked) to change the effective fuse status. For example, a production, secure fused device can be demoted to development and insecure by changing the effective fuse status register. AP can only change production mode, and SEP can only change secure mode. By default, this is only done when DPRO and DSEC are present in the APTicket.</div>AS967https://www.theiphonewiki.com/w/index.php?title=Security_Fusings&diff=120285Security Fusings2022-01-04T02:05:38Z<p>AS967: /* Fuse lock */</p>
<hr />
<div>iDevice security and APTicket configuration settings are often determined by security fuses on the SoC.<br />
<br />
== Effective vs. Raw fusing ==<br />
<br />
iDevices have two views of fuses, the "raw" fuse status which represent the actual state of the fuses, and the "effective" fusing status, which is a copy of the raw fuses that can override security configuration normally set by the fuses, assuming one can write to the effective fusing status register.<br />
<br />
=== Pre-A7 devices ===<br />
<br />
Pre-A7 devices only had one view of fuses and it could have overrides enabled. However, production-fused devices have the security epoch set while development-fused devices don't, so that one can distinguish a production-fused device from a demoted device.<br />
<br />
=== Post-A7 devices ===<br />
<br />
Post-A7 devices have two views of fuses, effective and raw, and the AP and SEP can read both to distinguish a demoted device from a development-fused one.<br />
<br />
== ECID ==<br />
<br />
See [[ECID]].<br />
<br />
== Production Mode ==<br />
<br />
The production mode fuse in the SoC controls not only whether JTAG/SWD is enabled on the AP or not, but also controls what UID and GID keys the AP AES engine will use to decrypt data. <br />
<br />
== Security Mode ==<br />
<br />
The secure mode fuse controls whether JTAG/SWD is enabled on the SEP, and controls the GID and UID used by the SEP AES engine. It also governs whether the AP SecureROM can boot untrusted code on post-A7 devices, in addition to the Test Mode board configuration setting. From an AP perspective, the secure mode fuse is always read from the raw fuses.<br />
<br />
<br />
== Fuse seal ==<br />
<br />
Unclear as to what the fuse seal does, though from the name it seems to lock the raw fuses from being altered further.<br />
<br />
<br />
== Fuse lock ==<br />
<br />
Fuse locking sets a register such that changes to the effective fuses are no longer possible until the next device reset. This ensures that the only way to demote a device is to have a validly signed APTicket loaded by SecureROM. (assuming no vulnerabilities)<br />
<br />
== Use in APTickets ==<br />
<br />
The Apple signing server uses the raw and effective production/security status to ensure that iOS builds are only being signed for devices that are expected to have them.<br />
<br />
<br />
== Demotion ==<br />
<br />
Demotion is the term used to refer to changing a device's effective fuse status to enable debugging of the AP and SEP. The effective fuse status register will accept writes (assuming it hasn't been locked) to change the effective fuse status. For example, a production, secure fused device can be demoted to development and insecure by changing the effective fuse status register. AP can only change production mode, and SEP can only change secure mode. By default, this is only done when DPRO and DSEC are present in the APTicket.</div>AS967https://www.theiphonewiki.com/w/index.php?title=Security_Fusings&diff=120284Security Fusings2022-01-04T02:04:59Z<p>AS967: completely updating the page based on current knowledge</p>
<hr />
<div>iDevice security and APTicket configuration settings are often determined by security fuses on the SoC.<br />
<br />
== Effective vs. Raw fusing ==<br />
<br />
iDevices have two views of fuses, the "raw" fuse status which represent the actual state of the fuses, and the "effective" fusing status, which is a copy of the raw fuses that can override security configuration normally set by the fuses, assuming one can write to the effective fusing status register.<br />
<br />
=== Pre-A7 devices ===<br />
<br />
Pre-A7 devices only had one view of fuses and it could have overrides enabled. However, production-fused devices have the security epoch set while development-fused devices don't, so that one can distinguish a production-fused device from a demoted device.<br />
<br />
=== Post-A7 devices ===<br />
<br />
Post-A7 devices have two views of fuses, effective and raw, and the AP and SEP can read both to distinguish a demoted device from a development-fused one.<br />
<br />
== ECID ==<br />
<br />
See [[ECID]].<br />
<br />
== Production Mode ==<br />
<br />
The production mode fuse in the SoC controls not only whether JTAG/SWD is enabled on the AP or not, but also controls what UID and GID keys the AP AES engine will use to decrypt data. <br />
<br />
== Security Mode ==<br />
<br />
The secure mode fuse controls whether JTAG/SWD is enabled on the SEP, and controls the GID and UID used by the SEP AES engine. It also governs whether the AP SecureROM can boot untrusted code on post-A7 devices, in addition to the Test Mode board configuration setting. From an AP perspective, the secure mode fuse is always read from the raw fuses.<br />
<br />
<br />
== Fuse seal ==<br />
<br />
Unclear as to what the fuse seal does, though from the name it seems to lock the raw fuses from being altered further.<br />
<br />
<br />
== Fuse lock ==<br />
<br />
Fuse locking sets a register such that changes to the effective fuses are no longer possible until the next device reset. This ensures that the only way to demote a device is to have a validly signed APTicket loaded by SecureROM.<br />
<br />
== Use in APTickets ==<br />
<br />
The Apple signing server uses the raw and effective production/security status to ensure that iOS builds are only being signed for devices that are expected to have them.<br />
<br />
<br />
== Demotion ==<br />
<br />
Demotion is the term used to refer to changing a device's effective fuse status to enable debugging of the AP and SEP. The effective fuse status register will accept writes (assuming it hasn't been locked) to change the effective fuse status. For example, a production, secure fused device can be demoted to development and insecure by changing the effective fuse status register. AP can only change production mode, and SEP can only change secure mode. By default, this is only done when DPRO and DSEC are present in the APTicket.</div>AS967https://www.theiphonewiki.com/w/index.php?title=UID_key&diff=70140UID key2018-08-21T02:19:07Z<p>AS967: </p>
<hr />
<div>The '''UID key''' (device's unique ID key) is an AES 256-bit hardware key, unique to each iPhone. It's fused into the application processor during manufacturing. It was previously used to encrypt things in the [[NOR]]. In later iOS versions, it is used to encrypt the entire file system, so that the flash chips cannot moved to another device and read out there again. On the [[S5L8960]] and later, the [[Secure Enclave|SEP]] has it's own UID in it's own AES Engine, and that UID is the one used to encrypt the filesystem on iOS. On the [[S8000]] and [[S8003]] and later, the chip securely generates the UID for the device which is then used to encrypt the whole filesystem.<br />
<br />
Apple says about this key:<br/><br />
''"The UID is unique to each device and is not recorded by Apple or any of its suppliers."''<br/><br />
and also<br/><br />
''"The UID is not related to any other identifier on the device."''<br />
<br />
See also: [[GID Key]].<br />
<br />
===References===<br />
*[https://www.apple.com/br/privacy/docs/iOS_Security_Guide_Oct_2014.pdf iOS Security document by Apple]<br />
<br />
[[Category:Decryption]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=ECID&diff=70020ECID2018-08-11T02:11:11Z<p>AS967: </p>
<hr />
<div>The '''ECID''' (possibly standing for '''E'''xclusive '''C'''hip '''ID''' or '''E'''lectronic '''C'''hip '''ID''', referred to as Unique Chip ID in official Apple terms) is an identifier unique to every unit, or more accurately, to every SoC.<br />
<br />
It is 64 bits wide, with the first ~20 bits usually set to zero (looks like <tt>00000XXXXXXXXXXX</tt> in hex).<br />
<br />
It holds a key position in the [[SHSH Protocol]], being one of 2 elements that limit each [[APTicket]] to a single specific device.<br />
<br />
'''Note''': Some tools show it in decimal format while others do it in hexadecimal.<br />
<br />
== Getting the ECID ==<br />
<br />
===Via iTunes===<br />
<br />
* Connect your iDevice to your computer.<br />
* Open iTunes.<br />
* Navigate to the "Summary" tab for your device.<br />
* At the top of the panel, click twice on the line that says "Serial Number".<br />
* Your ECID is displayed in '''hexadecimal'''.<br />
<br />
===Via third-party software===<br />
<br />
====On-device====<br />
<br />
The [http://cydia.saurik.com/package/com.malcolmhall.udidcalculator/ UDID Calculator] application from Cydia displays (among other things) the ECID of your device (shown in '''decimal''').<br />
<br />
====Via USB====<br />
<br />
* Install [https://github.com/libimobiledevice/libimobiledevice libimobiledevice].<br />
* Connect your device over USB.<br />
* Run <code>ideviceinfo | grep UniqueChipID</code> command.<br />
* There should be exactly one line, reading <code>UniqueChipID</code> followed by your ECID (in '''decimal''').<br />
* Alternatively you can run <code>ideviceinfo -k UniqueChipID</code> which fetches the UniqueChipID key directly (which is also faster).<br />
<br />
===Via [[Recovery Mode]] or [[DFU Mode]]===<br />
<br />
====Mac Instructions====<br />
<br />
*Put your device in [[Recovery Mode]] or [[DFU Mode]].<br />
*Open System Profiler. (in /Applications/Utilities/).<br />
*In the sidebar, go to "USB" (in the "Hardware" section).<br />
*Under "Serial Number", there should be a part called "ECID". There you go.<br />
<br />
====Windows Instructions====<br />
<br />
* Put your device in [[Recovery Mode]] or [[DFU Mode]].<br />
* Open Device Manager and right click on Apple Mobile Device (Recovery or DFU Mode) for properties.<br />
* Click on the details tab.<br />
* Click on the dropdown box and select Device Instance Path.<br />
* You should find it in the textbox.<br />
<br />
===Extracting from an SHSH===<br />
<br />
====Img3====<br />
<br />
There are 19 blobs in an SHSH, and the first line of every blob is the same as below:<br />
<br />
<code>RElDRUAAAAAIAAAA********AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</code><br />
<br />
The * part is the ECID(Dec) encrypted by a certain formula which is <br />
<br />
a.Transform ECID(Dec) into ECID(Hex) such as 58608372174291 ---> 35 4D D3 34 4D D3<br />
<br />
b.Reverse the ECID(Hex) string such as 35 4D D3 34 4D D3 ---> D3 4D 34 D3 4D 35<br />
<br />
c.Transform the string we have got into binary such as D3 4D 34 D3 4D 35 ---> ÓM4ÓM5<br />
<br />
d.Encode the binary with base64 such as ÓM4ÓM5 ---> 00000001<br />
<br />
Use this formula backward (d. to a.) we can extract the * part into ECID(Dec).<br />
<br />
====Img4====<br />
<br />
First, get your apticket.der. There are two options:<br />
* Copy it from your device in <code>/System/Library/Caches/apticket.der</code>.<br />
* Extract it from an SHSH file, e.g. using <code>plutil -extract ApImg4Ticket xml1 -o - *.shsh | xmllint -xpath '/plist/data/text()' - | base64 -D > apticket.der;</code>.<br />
<br />
Now you can use any old ASN.1 parser to display the file, such as <code>openssl asn1parse -i -inform DER -in apticket.der</code>.<br />
To get only the ECID part, use <code>openssl asn1parse -inform DER -in apticket.der | grep -A1 ECID</code>. It should show on the second line after the colon (in '''hexadecimal''', possibly with a leading zero).<br />
<br />
===Developer Instructions===<br />
<br />
On OSX, call <code>AMDeviceCopyValue</code> in the [[MobileDevice Library|MobileDevice Framework]] with "UniqueChipID". It returns the ECID as a <code>CFNumberRef(kCFNumberSInt64Type)</code> object.<br />
<br />
Example implementation (all safeties removed, will probably crash if connection fails), compile with <code>clang -F/System/Library/PrivateFrameworks -framework MobileDevice -framework CoreFoundation</code>:<br />
<br />
<pre><br />
// Please ping @s1guza on Twitter if this file stops compiling/working<br />
#include <stdint.h><br />
#include <stdio.h><br />
#include <stdlib.h><br />
#include <CoreFoundation/CoreFoundation.h><br />
<br />
// Cheap aliases to make things compile without headers<br />
typedef void am_device;<br />
typedef void am_device_notification;<br />
typedef void* am_device_notification_callback_info;<br />
extern void AMDeviceNotificationSubscribe(void(*callback)(am_device_notification_callback_info *info, void *arg), int unused1, int unused2, void *unknown, am_device_notification** notification);<br />
extern void AMDeviceConnect(am_device *device);<br />
extern void AMDeviceStartSession(am_device *device);<br />
extern void* AMDeviceCopyValue(am_device *device, int unknown, CFStringRef value);<br />
<br />
void cb(am_device_notification_callback_info *info, void *arg)<br />
{<br />
uint64_t ecid;<br />
am_device *dev = *info; /* info->dev */<br />
CFRetain(dev);<br />
AMDeviceConnect(dev);<br />
AMDeviceStartSession(dev);<br />
<br />
CFNumberRef ecidRef = AMDeviceCopyValue(dev, 0, CFSTR("UniqueChipID"));<br />
CFNumberGetValue(ecidRef, kCFNumberSInt64Type, &ecid);<br />
printf("ECID: %llX\n", ecid);<br />
<br />
CFRelease(dev);<br />
exit(0);<br />
}<br />
<br />
int main()<br />
{<br />
uint32_t buf[5];<br />
am_device_notification *notification = (am_device_notification*)buf;<br />
AMDeviceNotificationSubscribe(&cb, 0, 0, NULL, &notification);<br />
CFRunLoopRun();<br />
return 0;<br />
}<br />
</pre></div>AS967https://www.theiphonewiki.com/w/index.php?title=AES_Keys&diff=70014AES Keys2018-08-09T00:23:48Z<p>AS967: </p>
<hr />
<div>The [[wikipedia:System-on-a-chip|SoC]] in each device have an [[wikipedia:Advanced Encryption Standard|AES]] coprocessor with the [[GID Key]] and [[UID-key]] built in.<br />
<br />
== Running The Engine ==<br />
Currently, there are several ways to run the hardware AES engine:<br />
* Patch [[iBoot (Bootloader)|iBoot]] to jump to <code>aes_crypto_cmd</code>, presuming the AES keys are still enabled.<br />
* Use [http://github.com/planetbeing/iphonelinux/tree/master OpenIBoot].<br />
* Use the crypto bundle provided in [[XPwn]] to utilize it via userland. This method requires a kernel patch.<br />
* Use [[Greenpois0n (toolkit)|Greenpois0n]] console. <br />
<br />
If you want to decrypt [[IMG3 File Format|IMG3]] files you need to use this. The [[GID Key]] currently has not been extracted from the phone, so the only way to use it is on the phone itself.<br />
<br />
See [[Obtaining IMG3 Keys#Method 2|Obtaining IMG3 Keys]] for an [[iBoot (Bootloader)|iBoot]] patch.<br />
<br />
== Derived keys ==<br />
Some derived keys are computed by the IOAESAccelerator kernel service at boot. These keys are generated by encrypting static values either with the UID key (0x7D0 identifier) or the GID key (0x3E8 identifier). The values defined in the [[N90AP|iPhone 4 (iPhone3,1)]] 5.0 kernel are :<br />
__text:807E3000 keys_to_compute DCD 0x835,0x7D0,0x01010101,0x01010101,0x01010101,0x01010101<br />
__text:807E3018 DCD 0x899,0x7D0,0xB5FCE8D1,0x8DBF3739,0xD14CC7EF,0xB0D4F1D0<br />
__text:807E3030 DCD 0x89B,0x7D0,0x67993E18,0x543CB06B,0xF568A46F,0x49BD0C1C<br />
__text:807E3048 DCD 0x89A,0x7D0,0x335B1FDB,0x1C5F6C60,0x66AA3419,0x61069C58<br />
=== Key 0x835 ===<br />
Generated by encrypting 0x01010101010101010101010101010101 with the [[UID-key]].<br /><br />
Used for data protection.<br />
=== Key 0x836 ===<br />
Generated by encrypting 0x00E5A0E6526FAE66C5C1C6D4F16D6180 with the [[UID-key]].<br /><br />
This is computed by the kernel during a restore, but is zeroed out during a normal boot. It is also computed by the Secure Bootloader, and its only known use is to decrypt LLB in NOR. Like 0x835, it is different for each device.<br />
=== Key 0x837 ===<br />
Generated by encrypting 0x345A2D6C5050D058780DA431F0710E15 with the [[S5L8900]] [[GID Key]], resulting in 0x188458A6D15034DFE386F23B61D43774.<br /><br />
It is used as the encryption key for [[S5L File Formats#IMG2|IMG2 files]]. With the introduction of [[IMG3 File Format|IMG3]] in iPhone OS 2.0, [[KBAG]]s are now used instead of the 0x837 key. Because iPhone OS versions 1.x were used only on the [[M68AP|iPhone]] and [[N45AP|iPod touch]] (both use the [[S5L8900]]) the encrypted values for other processors don't matter.<br />
<br />
=== Key 0x838 ===<br />
Generated by encrypting 0x8C8318A27D7F030717D2B8FC5514F8E1 with the [[UID-key]].<br /><br />
Another UID-AES-key-based key, it is used to encrypt everything but LLB in the NOR (iBoot, DeviceTree, pictures).<br />
=== Key 0x899 ===<br />
Generated by encrypting 0xD1E8FCB53937BF8DEFC74CD1D0F1D4B0 with the [[UID-key]]. Usage unknown.<br />
=== Key 0x89A ===<br />
Used on A4 devices. Generated by encrypting 0xDB1F5B33606C5F1C1934AA66589C0661 with the [[UID-key]], getting a device-specific key.<br /><br />
It is used to encrypt the [[SHSH]] blobs on the device.<br />
=== Key 0x89B ===<br />
Generated by encrypting 0x183E99676BB03C546FA468F51C0CBD49 with the [[UID-key]]. It is used to encrypt the data partition key.<br />
<br />
== Using [[Greenpois0n (toolkit)|greenpois0n]] ==<br />
* Use 'xpwntool file.img3 /dev/null' to extract the KBAG hex string from ''file.img3''<br />
* Run steps 1 through 5 from [[PwnStrap]]<br />
* Start greenpois0n console: 'irecovery -s'<br />
* Execute 'go aes dec _KBAG_STRING_' in irecovery console<br />
<br />
==Resources==<br />
* [http://wikee.iphwn.org/s5l8900:encryption_keys Dev Team wiki]<br />
* [http://conference.hitb.org/hitbsecconf2011ams/materials/D2T2%20-%20Jean-Baptiste%20Be%cc%81drune%20&%20Jean%20Sigwald%20-%20iPhone%20Data%20Protection%20in%20Depth.pdf Jean-Baptiste Bédrune & Jean Sigwald - iPhone Data Protection in Depth (PDF from HITB 2011)]<br />
<br />
[[Category:Decryption]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Secure_Enclave&diff=69894Secure Enclave2018-08-03T12:24:13Z<p>AS967: </p>
<hr />
<div>The '''Secure Enclave''' is part of the [[A7]] and newer chips used for [[Touch ID]]. The purpose of the Secure Enclave is to handle keys and other info such as biometrics that is sensitive enough to not be handled by the [[Application Processor|AP]]. It is isolated with a hardware filter so the AP cannot access it. It shares RAM with the AP, but it's portion of the RAM (known as TZ0) is encrypted. The secure enclave itself is a flashable 4MB AKF processor core called the secure enclave processor (SEP) as documented in [http://appft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1&f=G&l=50&s1=%2220130308838%22.PGNR.&OS=DN/20130308838&RS=DN/20130308838 Apple Patent Application 20130308838]. The technology used is similar to [http://www.arm.com/products/processors/technologies/trustzone/index.php ARM's TrustZone/SecurCore] but contains proprietary code for Apple KF cores in general and SEP specifically. It is also responsible for generating the UID key on A9 or newer chips that protects user data at rest.<br />
<br />
The SEP is located in the devicetree under IODeviceTree:/arm-io/sep and manged by the AppleSEPManager driver as seen [http://winocm.com/images/ioregdump.txt here]<br />
<br />
==SEP OS==<br />
<br />
The SEP has its own OS called SEP OS and there exists a tool called [[seputil]] which is used to communicate with it.<br />
<br />
==Further References==<br />
<br />
[http://www.forbes.com/sites/quora/2013/09/18/what-is-apples-new-secure-enclave-and-why-is-it-important/ www.forbes.com]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Secure_Enclave&diff=69875Secure Enclave2018-08-02T12:17:31Z<p>AS967: </p>
<hr />
<div>The '''Secure Enclave''' is part of the [[A7]] and newer chips used for [[Touch ID]]. The purpose of the Secure Enclave is to handle keys and other info such as biometrics that is sensitive enough to not be handled by the [[Application Processor|AP]]. It is isolated with a hardware filter so the AP cannot access it. It shares RAM with the AP, but it's portion of the RAM (known as TZ0) is encrypted. The secure enclave itself is a flashable 4MB AKF processor core called the secure enclave processor (SEP) as documented in [http://appft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1&f=G&l=50&s1=%2220130308838%22.PGNR.&OS=DN/20130308838&RS=DN/20130308838 Apple Patent Application 20130308838]. The technology used is similar [http://www.arm.com/products/processors/technologies/trustzone/index.php ARM's TrustZone/SecurCore] but contains proprietary code for Apple KF cores in general and SEP specifically. It is also responsible for generating the UID key on A9 or newer chips that protects user data at rest.<br />
<br />
The SEP is located in the devicetree under IODeviceTree:/arm-io/sep and manged by the AppleSEPManager driver as seen [http://winocm.com/images/ioregdump.txt here]<br />
<br />
==SEP OS==<br />
<br />
The SEP has its own OS called SEP OS and there exists a tool called [[seputil]] which is used to communicate with it.<br />
<br />
==Further References==<br />
<br />
[http://www.forbes.com/sites/quora/2013/09/18/what-is-apples-new-secure-enclave-and-why-is-it-important/ www.forbes.com]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Bootrom_3332.0.0.1.23&diff=69800Bootrom 3332.0.0.1.232018-07-30T02:02:11Z<p>AS967: </p>
<hr />
<div>This is the bootrom version found in the [[iPhone 8]], [[iPhone 8 Plus]], and [[iPhone X]]. It has no known exploits. This bootrom was compiled right before 10.0 beta 1.<br />
{{stub|firmware}}<br />
[[Category:Bootrom]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=PurpleRestore&diff=69792PurpleRestore2018-07-23T02:16:13Z<p>AS967: </p>
<hr />
<div>{{internal software}}<br />
{{Infobox software<br />
| name = PurpleRestore<br />
| title = PurpleRestore<br />
| logo = [[File:PurpleRestore3_logo.png|150px]]<br />
| screenshot = [[File:PurpleRestore3.png|300px]]<br />
| caption = PurpleRestore 3.0 (313.1.5.1.1)(14A83432a)<br />
| collapsible = <br />
| author = Apple Inc.<br />
| developer = Apple Inc.<br />
| released = <br />
| discontinued = <br />
| latest release version = 3.0 (313.1.5.1.1) (14A83432a)<br /><small>(latest ''known'' version)</small><br />
| latest release date = <br />
| latest preview version = <br />
| latest preview date = <br />
| programming language = <br />
| operating system = [[wikipedia:macOS|macOS]]<br />
| platform = <br />
| size = <br />
| language = [[wikipedia:English language|English]]<br />
| status = <br />
| genre = Firmware flasher<br />
| license = [[wikipedia:Proprietary software|Closed source]]<br />
| website = <br />
}}<br />
{{float toc|left}}<br />
'''PurpleRestore''' is a tool made by Apple and is used for flashing [[iDevice]]s. It provides far more customization than [[iTunes]], and is known to be used to flash internal firmware to [[prototypes]]. Little is currently known about which versions it "supports" for restoring as such. PurpleRestore is installed by [[RestoreTools.pkg]] or Home Diagnostics. A CLI version of PurpleRestore is included.<br />
<br />
This tool can (and is meant to) handle multiple restores. When performing restores, PurpleRestore color coordinates the device in the table and when the device is about to receive the AppleLogo it will turn the background color of the screen to the color assigned to the device. Like [[iTunes]], PurpleRestore communicates with devices using a [[usbmux]] connection.<br />
<br />
== Restore Bundles ==<br />
PurpleRestore uses "Restore Bundles" which can be obtained from a server specific to versions of iOS, such as <code>afp://fieldgoal.apple.com/RestoreImages/</code> and <code>afp://endzone.apple.com/OldRestoreImages/</code> (among many others) . Unfortunately, these <code>afp</code> servers can only be accessed through Apple's internal VPN. PurpleRestore is essentially useless to the general public, because it can only install currently signed iOS versions without having Apple VPN access.<br />
<br />
You can create your own bundles by extracting an IPSW into a folder, and restore them if they are being signed; or if you have SHSH blobs saved for an A4 device (and below) then you can either stitch or use [[TinyUmbrella]] to assist in a downgrade without the need for iTunes; you will still need to put your device into pwned DFU Mode. This will not give you any internal debugging abilities nor jailbreak your device.<br />
<br />
As of PurpleRestore 3, an IPSW may be used in place of a restore bundle.<br />
<br />
== Restore Components ==<br />
Restore Components has several options:<br />
* '''Restore Bundle''': Specify the bundle to use in restoring<br />
* '''Firmware Directory''': Specify the folder where the [[LLB]], [[iBoot (Bootloader)|iBoot]], etc. [[IMG3 File Format|IMG3]]/[[IMG4 File Format|IMG4]] files are located.<br />
* '''Ramdisk Image''': Specify a [[ramdisk]] to be used (i.e. [[Restore Ramdisk|restore]] or [[Update Ramdisk|update]] ramdisk)<br />
* '''DFU''': Specify what tools to upload based on a selection of "Debug", "Development", or "Release". A specific file can also be selected.<br />
<br />
== Restore Operations ==<br />
[[File:IPhoneDuringPurpleRestore.jpeg|250px|thumb|right|iPhone 5 undergoing a PurpleRestore]]<br />
Restore Operations contains the most options to configure. These may also be the most useful ones.<br />
<br />
* '''Hardware Readiness'''<br />
** '''Minimum Battery Charge (mV)''': This value controls the minimum charge level at which the restore will be allowed to continue. Below this threshold, we either wait to charge (if we're charging) or fail (if we're not charging). If this option is not specified, a default value is used (currently 3.8&nbsp;V). Setting this option to 0 bypasses all battery level checks.<br />
** '''Wait for Minimum Charge''': If the current voltage is below the minimum level, then the default behavior is to let the device charge and then continue. This option overrides that behavior when false.<br />
** '''Wait for Storage Device''': Controls whether the restore waits for the storage device /dev/disk0 to be available before the restore is initiated.<br />
** '''Allow Untethered Restore''': Permit the restore to run untethered (not connected to a host). The result of specifying this option when the restore needs data from the host (for instance, when flashing NOR) is undefined (but probably bad). If this option is specified and the device remains tethered, things should proceed as usual.<br />
* '''Storage Media'''<br />
** '''Use LwVM''': Controls whether the device is formatted for LwVM (if supported).<br />
** '''Repartition''': Controls whether a new partition map is created on the device.<br />
** '''System Partition Size (MiB)''': Specifies the size (in mebibytes) that is desired for the system partition. Because the partition size can only be changed when creating a new partition map, this option is only relevant when used in conjunction with repartition. A size of 0 indicates that the restore library should choose a suitable size for you, based on the specific restore bundle and image being used if possible.<br />
** '''Content Protection Type''': Controls the type of data protection used on the device.<br />
** '''Low-Level Erase''': Do a low level erase (wipe with null or random data) of the entire storage device prior to restoring.<br />
* '''Restore System Partition'''<br />
** '''System Image''': Determines which type of system image to restore, or which file to use for the system image.<br />
** '''Kernel Cache Type''': This option controls the kernel cache that gets installed on the device.<br />
* '''Baseband'''<br />
** '''Update Baseband''': Controls whether the [[baseband]] and baseband bootloader are updated as part of the restore.<br />
** '''Force Update''': The baseband update is skipped when the existing firmware matches the available firmware. In some cases, it is desirable to force the firmware update to occur, regardless of what is currently on there. This option, when set to true, forces the update to be attempted.<br />
<br />
== Restore OS ==<br />
Restore OS options allow you to specify the following:<br />
* '''Restore Boot-Args''': Boot-Args used when the Restore OS is loaded. By default those arguments are used: "debug=0x14e serial=3 rd=md0 nand-enable-reformat=1 -progress"<br />
* '''Firmware Type:''' Specify the firmware which should be flashed when restoring. This can either be "Debug", "Factory FA", "Factory SA", "Firmware Development" or "Production".<br />
* '''Boot Image Type:''' Can be "Internal", "User or Internal", "User" or "Update".<br />
* '''Boot Kernel Cache:''' Specify whether the "Production" or "Development" kernel cache should be used.<br />
<br />
== Personalization Settings ==<br />
As with iTunes, PurpleRestore can personalize builds for iOS devices (since recent Bootroms expect a valid APTicket). The tooltip for the "Personalized Restore" checkbox reads "Your ticket to the Orwellian cloud." This may suggest that Apple developed TSS in part to control access to internal build variants (i.e. prevent leaks of "interesting" builds of iOS), in addition to preventing production users from downgrading. <br />
* '''Variants''': "A predefined combination of restore pieces." The options are: "Customer Install", "Internal Debug", "Internal Development", "Internal Install", "Internal Qualification", and "Vendor install." <br />
* '''AppleConnect''': Used to authenticate all restores for personalization. Interestingly, AppleConnect will allow members of the iOS Developer Program (including non-employees) to install public builds of iOS (latest current and beta). It's likely AppleConnect is also used to authenticate signing of internal builds using the public TSS server, should the device be on the whitelist. <br />
<br />
== Restore Settings ==<br />
[[File:PurpleRestoreOptions.png|250px|thumb|right|PurpleRestore configuration screen]]<br />
By default, PurpleRestore comes with two pre-made restore settings. "Erase Install" and "Update Install". Those restore settings are [[wikipedia:property list|property list]]s that define the options PurpleRestore will use when restoring a device.<br />
* '''Erase Install''': Repartition the media and erase all data before restoring. Includes all internal development tools and updates flash and the baseband by default.<br />
* '''Update Install''': Includes all internal development tools and updates flash and the baseband by default.<br />
{{clear}}<br />
<br />
== PurpleRestore 3 ==<br />
PurpleRestore 3 is the latest known version of PurpleRestore. It was initially leaked on Twitter in October 2016. The update sports a redesigned user interface and icon, support for IPSW files, and revealed the existence of an internal PurpleRestore wiki, which most likely requires access to Apple's internal VPN. The boot screen on the device doesn't turn purple when restoring with the tool without a debug UART cable, unlike previous versions of the tool. PurpleRestore 3 also has full macOS Sierra support, which was broken in most of the previous builds.<br />
<br />
The updated utility also allows you to flash a custom boot logo. This likely requires authorization with TSS to personalize the IMG3/IMG4 before flashing the image to the device.<br />
<br />
== Problems ==<br />
There are some problems with the leaked versions, because they may not support current devices or iOS versions.<br />
<br />
[[File:IBECStuck.png|250px|thumb|right|Stuck on Executing iBEC]]<br />
One problem (common) is getting stuck at "Executing iBEC to bootstrap update". This is likely a signing error; the device may have rejected the iBEC image due to an invalid or missing APTicket, trying to use AppleConnect, the TSS server is no longer accepting signatures for the version you are installing, or the nonce has been mismatched.<br />
<br />
Another problem can be encountered when a device is in [[DFU Mode]]; the tool will send the DFU image, and the iDevice will repeatedly disconnect and reconnect.<br />
<br />
If you check "Allow baseband roll-backs", disable "Allow AppleConnect", and uncheck using of LwVM under Editor, selecting Personalized IPSW will cause PurpleRestore to freeze on "Waiting for device" and creates another session with "IDLE" status. If you then try to select that new session and try the same settings, it starts the restore process and successfully restore the IPSW to device.<br />
<br />
Versions older than PurpleRestore 3 do not support A7+ devices, due to many changes in newer architectures, BootROM, etc.<br />
<br />
PurpleRestore 3 also is supposed to have icons for each device plugged in, but many devices (including iPhones) don't have icons; they are replaced with a grey question mark. <br />
<br />
== See Also ==<br />
* [[iTunes]]<br />
* [https://www.youtube.com/watch?v=jaZ2JPUv-AU Video of process]<br />
<br />
[[Category:Software]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=NAND&diff=69043NAND2018-05-17T23:13:54Z<p>AS967: </p>
<hr />
<div>[[File:8GBflash.jpg|thumb|right|An 8&nbsp;GiB Samsung <code>KMCMN0000M-B998</code> NAND chip]]<!-- info: http://www.elnec.com/device/Samsung/KMAKG0000M-B998+%5BFBGA169%5D --><br />
'''NAND''', so called because of its use of [[wikipedia:NAND gate|NOT AND (NAND) gates]], is a type of [[wikipedia:Flash memory|non-volatile memory chip]] that is used in all [[iDevice]]s. This chip is where all the ''storage'' of the device is located. In the case of [[iOS]], the chips can range anywhere from 4&nbsp;GiB to 128&nbsp;GiB.<br />
<br />
== Partitions ==<br />
{{see also|/private/etc/fstab}}<br />
Although the NAND houses two visible filesystems, it actually has more partitions, including: NVRM (the NVRam store), SCFG (system configuration), BOOT (iBoot + more) and others. The visible filesystems are in a partition called FSYS, and are further split into two [[/private/etc/fstab|partitions]], a root partition ranging from 256(?) MiB to ~2 GiB, and a user partition occupying the rest, by using the Lightweight Volume Manager (LwVM) or on iOS 10.3 and later on A7 and newer, the Apple File System driver (APFS). It is important to emphasize that these are LOGICAL rather than PHYSICAL partitions. The root partition is mounted to the [[/|root of the filesystem]] (<code>/</code>). The user partition is located after the root partition on the chip and is mounted to [[/private/var]].<br />
=== Size of Partitions ===<br />
The size of the root partition has varied throughout [[iOS]]'s history, while the user partition just fills the rest of the space of the NAND chip. Here is a comparison of the size of the root partition compared to iOS version:<br />
* 256 MiB: ?<!-- did this even exist? --><br />
* 512 MiB: ? - 4.0<br />
* 1024 MiB: 4.0 - 8.0<br />
* 2048 MiB: 8.0 - present<br />
<br />
== Jailbreaking ==<br />
{{main|Jailbreak}}<br />
Jailbreaking, in it's simplest form, involves modifying [[/private/etc/fstab]] before being parsed by the [[kernelcache|kernel]] to mount the [[/|root partition]] as read-write (<code>rw</code>), as opposed to read-only (<code>ro</code>). The only use of a so called "bare-bones" jailbreak is a proof-of-concept. A semi known example (the only publicly disclosed) of a "bare-bones" jailbreak is the [[K66AP|Apple TV (2nd generation)]] from [[Mojave 8M89 (AppleTV2,1)|4.0]] (4.1) to [[Jasper 8C150 (AppleTV2,1)|4.1]] (4.2). Not all jailbreak payloads modify [[/private/etc/fstab]], some of them remount the [[/|root partition]] manually.<br />
<br />
== Data Layout ==<br />
As NAND chips are not hard drives, their "sector" sizes are different than that of a typical hard drive. In fact, they aren't even called sectors, but instead called a "page".<br />
<br />
The difference between a page and a sector is that a ''modern'' hard drive sector contains either 512 or 4096 bytes of data with anywhere from roughly 30 to 250 bytes of [[wikipedia:Error detection and correction|error correction code]] (ECC) data, while a page contains 8192 bytes of data and ''no'' ECC. ECC is most likely not used as flash memory uses transistors, which are more reliable than magnetism to store data. It has, however, been [http://www.micron.com/~/media/Documents/Products/Software%20Article/SWNL_implementing_ecc.pdf proposed to implement ECC in flash memory] as the smaller [[wikipedia:Semiconductor device fabrication|fabrication process]] has shrunk to the width of about [[wikipedia:22 nanometer|150]] helium atoms (<code>.14 nm</code>, or <code>22 nm</code> total).<br />
<br />
The next level up from a page is a block which is a collection of 128 pages (1&nbsp;MiB). A block can be compared to a 4K sector hard drive that emulates 512 byte sectors.<br />
<br />
The layout of an 8 GiB chip containing [[iOS]] has been documented by [[CPICH]]. He [https://twitter.com/cpich3g/status/15966288660660224 notes] that an [[iPhone 4]] is documented, but it could easily be adapted to any other device or [[firmware]]. He uploaded the document to [http://freepdfhosting.com/29256fdff9.pdf FreePDFHosting], but it was later removed after 30 days as per their policy. [[User:MuscleNerd|MuscleNerd]] rasterized the document's pages and uploaded the images here:<br />
<gallery><br />
File:N1.png|Page 1<br />
File:N2.png|Page 2<br />
File:N3.png|Page 3<br />
File:N4.png|Page 4<br />
File:N5.png|Page 5<br />
</gallery><br />
<br />
== See Also ==<br />
* [[/private/etc/fstab]]<br />
* [[Jailbreak]]<br />
<br />
== External Links ==<br />
* [https://web.archive.org/web/20110124110405/http://freepdfhosting.com/29256fdff9.pdf NAND Layout of iPhone 4] documented by [[CPICH]]<br />
* [http://esec-lab.sogeti.com/ SOGETI ESEC-Labs] on the [http://esec-lab.sogeti.com/dotclear/public/publications/11-hitbamsterdam-iphonedataprotection.pdf encryption of iOS devices]</div>AS967https://www.theiphonewiki.com/w/index.php?title=DFU_Mode&diff=68592DFU Mode2018-04-07T01:39:14Z<p>AS967: </p>
<hr />
<div>'''DFU''' or '''Device Firmware Upgrade''' mode allows all devices to be restored from any state. It is essentially a mode where the BootROM can accept iBSS. DFU is part of the [[Bootrom|SecureROM]] which is burned into the hardware, so it cannot be removed. On A7+ devices, it generates an ApNonce and recognizes APTickets as well, so even in DFU, it can accept an APTicket.<br />
<br />
== Entering DFU Mode ==<br />
=== Apple TV ===<br />
# Plug the device into your computer using a Micro-USB cable.<br />
# Force the device to reboot by holding down the "Menu" and "Down" buttons simultaneously for 6-7 seconds.<br />
# Press "Menu" and "Play" simultaneously right after reboot, until a message pops up in [[iTunes]], saying that it has detected an Apple TV in Recovery Mode.<br />
<br />
=== iPad, iPhone 6s and below, iPhone SE and iPod touch ===<br />
# Connect the device to a computer using a USB cable.<br />
# Hold down both the Home button and Lock button.<br />
# After 8 seconds, release the Lock button while continuing to hold down the Home button.<br />
#* If the Apple logo appears, the Lock button was held down for too long.<br />
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.<br />
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.<br />
<br />
=== iPhone 7 and iPhone 7 Plus ===<br />
# Connect the device to a computer using a USB cable.<br />
# Hold down both the Side button and Volume Down button.<br />
# After 8 seconds, release the Side button while continuing to hold down the Volume Down button.<br />
#* If the Apple logo appears, the Side button was held down for too long.<br />
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.<br />
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.<br />
<br />
=== iPhone 8, iPhone 8 Plus and iPhone X ===<br />
# Connect the device to a computer using a USB cable.<br />
# Quick-press the Volume Up button<br />
# Quick-press the Volume Down button<br />
# Hold down the Side button until the screen goes black, then hold down both the Side button and Volume Down button.<br />
# After 5 seconds, release the Side button while continuing to hold down the Volume Down button.<br />
#* If the Apple logo appears, the Side button was held down for too long.<br />
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.<br />
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.<br />
<br />
== Exiting DFU Mode ==<br />
To exit DFU Mode, simply force restart your device.<br />
<br />
* For Apple TV, hold down the "Menu" and "Down" buttons on your remote until the Apple TV reboots.<br />
* For iPad, iPhone 6s and below, iPhone SE and iPod touch, hold the Home button and the Lock button until the device reboots.<br />
* For iPhone 7 and iPhone 7 Plus, hold down the Side button and Volume Down button until the device reboots.<br />
* For iPhone 8, iPhone 8 Plus, and iPhone X, quick-press the Volume Up button, then quick-press the Volume Down button, then hold down the Side button until the device reboots.<br />
<br />
==Enter True Hardware DFU Mode Automatically==<br />
The EnterDFU function in the [[MobileDevice Library]] does not enter the true DFU Mode in the hardware. It's possible to enter the true DFU Mode without doing it manually, but it cannot be exited unless a restore is performed, as it creates a [[DFU Loop]]. This doesn't work with [[S5L8900]] devices.<br />
<br />
===Steps===<br />
# Make a copy of a fresh IPSW file.<br />
# Open the IPSW as a zip folder and browse to /firmware/all_flash/all_flash.xxxxx.production/<br />
# Extract LLB.*****.RELEASE.img3/im4p and open it in a hex editor.<br />
# Change some random bit or bits, it doesn't matter which or what you write.<br />
# Add the edited file back to the zip, rename zip to ipsw and restore it to your device using iTunes.<br />
# The restore will error out and your device will be in DFU Mode.<br />
<br />
===Alternative Method===<br />
If the previous method does not work for you, try this one.<br />
# Do steps 1 and 2 from above.<br />
# Delete LLB.*****.RELEASE.img3.<br />
# Copy applelogo.********.img3 to temporary directory.<br />
# Rename the copy of applelogo.********.img3/im4p to LLB.*****.RELEASE.img3/im4p. (If you forget the name of the LLB file, you can find it again in the file named manifest.)<br />
# Copy the renamed applelogo file back to the all_flash.xxxxx.production directory.<br />
# Rename the zip.<br />
# Restore the file using iTunes. (If every thing goes well, you should receive an error 31 from iTunes.)<br />
<br />
==DFU Mode Output to the computer==<br />
<pre>iProduct: "Apple Mobile Device (DFU Mode)"</pre> <pre>iSerialNumber: "CPID:XXXX CPRV:15 CPFM:03 SCEP:03 BDID:00 ECID:XXXXXXXXXXXXXXXX SRTG:[iBoot-XXX.X.X]"</pre><br />
<br />
==Revisions==<br />
===[[S5L8900]] (0x1222)===<br />
This is the device ID in the [[N45AP|iPod touch]], the [[M68AP|iPhone]], and the [[N82AP|iPhone 3G]]. For more information about the protocol, see [[DFU 0x1222]].<br />
<br />
===[[S5L8720 Bootrom|S5L8720]], [[S5L8920]], and [[WTF|WTF mode post-2.0]] (0x1227)===<br />
This is the device ID in the [[N72AP|iPod touch (2nd generation)]], the [[N88AP|iPhone 3GS]], the [[N90AP|iPhone 4]], subsequent 32 bit devices, all 64 bit devices, and [[WTF|WTF mode]]. For more information on the protocol, see [[DFU 0x1227]].<br />
<br />
[[Category:Bootrom]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=SHSH&diff=67933SHSH2018-02-15T02:48:19Z<p>AS967: </p>
<hr />
<div>SHSH, or "Signed Hash" is a 1024-bit RSA signature that is verified by the bootloader before execution of an image is permitted.<br />
<br />
Technically, the SHSH of a firmware image is a 1024-bit (<code>0x80</code> bytes) [[wikipedia:RSA (cryptosystem)|RSA]] signature. This often also refers to backup files with the signature ("SHSH blobs"). This signature is needed to restore a specific iOS version; it is generated by Apple based on hardware keys of the device and the hash of the firmware. Apple only issues signatures for the currently-available iOS version, which disallows installing older iOS versions. But if you have saved signatures for an older iOS version, you may be able to use a [[wikipedia:replay attack|replay attack]] to restore that version. Therefore it is recommended to save the signature for your device as long as Apple issues it.<br />
<br />
With the tools mentioned below it is possible to backup the signature. It is not necessary that the device is jailbroken to do the backup. Usually the SHSH signature file is stored on [[Cydia Server|Saurik's server]]. If it is stored there, then you can see in the top of [[Cydia Application|Cydia]] (on jailbroken devices) for which version a backup exists. This moved to [[TSS Center]] which can be located on the main page and then they are shown at the top of that. <br />
<br />
Users often misunderstand this system and think that the SHSH firmware version they back up depends on the firmware version they have installed on their device. This is the case for [[iFaith]], but not for TinyUmbrella. iFaith dumps the SHSHs from your device's storage (whatever's installed on your device, e.g. 4.3.3), while TinyUmbrella gets SHSHs from Apple's servers (whatever firmwares Apple is currently signing).<br />
<br />
==Using SHSH==<br />
Older devices ([[M68AP|iPhone]] and [[N45AP|iPod touch]]) do not use SHSH signatures, so installation of any firmware on these devices is possible.<br />
<br />
iPhone OS 1.x and 2.x do not use SHSH signatures, and can therefore be downgraded to at any time, even on devices that do use SHSH signatures, such as [[N82AP|iPhone 3G]].<br />
<br />
Versions above iPhone OS 3.0 require the [[iBEC]], [[iBSS]], and [[LLB]] to be fully signed with an SHSH for the ECID of that device.<br />
<br />
However, some devices are vulnerable to untethered [[Bootrom#Bootrom Exploits|bootrom exploits]], such as [[0x24000 Segment Overflow]] or [[alloc8 Exploit|alloc8]]. These devices can be restored to a custom [[IPSW]] in Pwned [[DFU Mode]] for any version that is available to that particular device. Notable devices vulnerable to untethered bootrom exploits are the [[iPhone 3GS]] and [[iPod touch (2nd generation)]]. The [[limera1n Exploit]] is able to provide a [[Tethered Downgrade|tethered downgrade]] for vulnerable devices.<br />
<br />
Since various exploits, such as the [[limera1n Exploit]], are fixed in the [[bootrom]] since version [[Bootrom 838.3]] and because iOS versions 5.0 and above includes a [[nonce]] in their SHSH hashes, downgrading newer devices is not as simple. Blobs must be stitched into a custom firmware, and restored to in Pwned [[DFU Mode]].<br />
<br />
Blobs can be saved with tools such as [[iFaith]] and [[TinyUmbrella]]. Firmwares can be stitched using [[iFaith]], [[redsn0w]] or [[sn0wbreeze]].<br />
<br />
Newer methods such as [[Odysseus]], [[Prometheus]] or [[iDeviceReRestore]] are used now because other tools have become outdated and newer versions of [[iTunes]] prevents restores to custom versions.<br />
<br />
==Timeline==<br />
As noted above, the original [[M68AP|iPhone]] and [[N45AP|iPod touch]] didn't use SHSH blobs. iPhone OS 1.x and 2.x didn't use SHSH blobs either. iPhone 3G and iPod touch (2nd generation) both used SHSH blobs on iOS 4,<ref>http://jaxov.com/2010/07/why-save-iphone-3g-ipod-touch-2g-shsh-blobs/</ref> but following the re-opening on 10 January 2018, all versions (excluding betas) that they ever ran can now be freely installed.<br />
<br />
=== iOS ===<br />
{| class="wikitable"<br />
|-<br />
! Firmware<br />
! For Device(s)<br />
! From<br />
! Until<br />
! Status<br />
|-<br />
| 11.2.5<br />
| rowspan="4" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2018|01|23}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 11.2.2<br />
| {{date|2018|01|08}}<br />
| {{date|2018|01|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2.1<br />
| {{date|2017|12|13}}<br />
| {{date|2018|01|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2 (15C114)<br />
| {{date|2017|12|02}}<br />
| {{date|2018|01|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2 (15C113)<br />
| [[D22AP|iPhone X (iPhone10,3)]]<br />
| {{date|2017|12|04}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 11.1.2<br />
| rowspan="3" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[iPhone X]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2017|11|16}}<br />
| {{date|2017|12|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.1.1<br />
| {{date|2017|11|09}}<br />
| {{date|2017|12|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.1<br />
| {{date|2017|10|31}}<br />
| {{date|2017|12|05}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.0.3<br />
| rowspan="2" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[iPhone 8]], [[iPhone 8 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2017|10|11}}<br />
| {{date|2017|11|28}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.0.2<br />
| {{date|2017|10|03}}<br />
| {{date|2017|11|16}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 11.0.1<br />
| [[iPhone 8]], [[iPhone 8 Plus]]<br />
| rowspan="2" | {{date|2017|09|26}}<br />
| {{date|2017|12|15}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2017|11|16}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.0<br />
| {{date|2017|09|19}}<br />
| {{date|2017|10|04}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 10.3.3<br />
| [[iPhone 6s]]<br />
| {{date|2017|10|05}}<br />
| {{date|2017|11|16}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2017|07|19}}<br />
| {{date|2017|10|04}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad (4th generation)]], [[iPhone 5]], [[iPhone 5c]]<br />
| {{date|2017|07|19}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| rowspan="2" | 10.3.2<br />
| [[iPad Pro (12.9-inch, 2nd generation)]], [[iPad Pro (10.5-inch)]]<br />
| {{date|2017|06|05}}<br />
| {{date|2017|08|09}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad (5th generation)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2017|05|15}}<br />
| {{date|2017|08|09}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.3.1<br />
| {{date|2017|04|03}}<br />
| {{date|2017|06|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.3<br />
| {{date|2017|03|27}}<br />
| {{date|2017|04|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.2.1<br />
| rowspan="5" | [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2017|01|23}}<br />
| {{date|2017|04|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.2<br />
| {{date|2016|12|12}}<br />
| {{date|2017|01|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.1.1 (14B150)<br />
| {{date|2016|11|09}}<br />
| {{date|2016|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.1.1 (14B100)<br />
| {{date|2016|10|31}}<br />
| {{date|2016|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.1<br />
| {{date|2016|10|24}}<br />
| {{date|2016|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.3<br />
| [[iPhone 7]], [[iPhone 7 Plus]]<br />
| {{date|2016|10|17}}<br />
| {{date|2016|10|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.2<br />
| rowspan="2" | [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2016|09|23}}<br />
| {{date|2016|10|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.1<br />
| {{date|2016|09|13}}<br />
| {{date|2016|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2 | 9.3.5<br />
| [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[N102AP|iPod touch (6th generation)]]<br />
| rowspan="2 | {{date|2016|08|25}}<br />
| {{date|2016|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad mini]], [[N94AP|iPhone 4S]], [[iPod touch (5th generation)]]<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 9.3.4<br />
| rowspan="2" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2016|08|04}}<br />
| {{date|2016|09|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.3<br />
| {{date|2016|07|18}}<br />
| {{date|2016|08|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.2 (13F72)<br />
| [[iPad Pro (9.7-inch)]]<br />
| {{date|2016|06|02}}<br />
| {{date|2016|08|24}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.3.2 (13F69)<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[J128AP|iPad Pro (iPad6,4)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| rowspan="2" | {{date|2016|05|16}}<br />
| {{date|2016|08|24}}<br />
| {{no|Closed}}<br />
|-<br />
| [[J127AP|iPad Pro (iPad6,3)]]<br />
| {{date|2016|05|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.1<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad Pro (9.7-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2016|03|31}}<br />
| {{date|2016|06|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3 (13E237)<br />
| [[K93AP|iPad 2 (iPad2,1)]], [[K95AP|iPad 2 (iPad2,3)]], [[K93AAP|iPad 2 (iPad2,4)]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]<br />
| {{date|2016|03|28}}<br />
| rowspan="2" | {{date|2016|04|22}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3 (13E236)<br />
| [[K94AP|iPad 2 (iPad2,2)]]<br />
| {{date|2016|03|25}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3 (13E234)<br />
| [[iPad Pro (9.7-inch)]]<br />
| rowspan="3" | {{date|2016|03|21}}<br />
| rowspan="2" | {{date|2016|04|18}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.3 (13E233)<br />
| [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini 3]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[N102AP|iPod touch (6th generation)]]<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]<br />
| {{date|2016|03|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.1 (13D20)<br />
| [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini 3]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]]<br />
| {{date|2016|02|18}}<br />
| {{date|2016|04|05}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.1 (13D15)<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2016|01|19}}<br />
| {{date|2016|04|05}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.2<br />
| [[K93AAP|iPad 2 (iPad2,4)]], [[J1AP|iPad (3rd generation) (iPad3,1)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| rowspan="2" | {{date|2015|12|08}}<br />
| {{date|2016|02|05}}<br />
| {{no|Closed}}<br />
|-<br />
| [[K93AP|iPad 2 (iPad2,1)]], [[K94AP|iPad 2 (iPad2,2)]], [[K95AP|iPad 2 (iPad2,3)]], [[J2AP|iPad (3rd generation) (iPad3,2)]], [[J2AAP|iPad (3rd generation) (iPad3,3)]], [[N94AP|iPhone 4S]]<br />
| {{date|2016|02|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.1 (13B144)<br />
| [[iPad Pro (12.9-inch)]]<br />
| {{date|2015|11|17}}<br />
| rowspan="2" | {{date|2015|12|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.1 (13B143)<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| rowspan="2" | {{date|2015|10|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad Pro]]<br />
| {{date|2015|12|02}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0.2<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2015|09|30}}<br />
| {{date|2015|10|29}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.0.1<br />
| [[iPhone 6s]], [[iPhone 6s Plus]]<br />
| {{date|2015|09|24}}<br />
| rowspan="2" | {{date|2015|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2015|09|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2015|09|16}}<br />
| rowspan="2" | {{date|2015|09|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.4.1<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]], [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2015|08|13}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 8.4<br />
| [[N102AP|iPod touch (6th generation)]]<br />
| {{date|2015|07|15}}<br />
| {{date|2015|08|23}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="7" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]]<br />
| {{date|2015|06|30}}<br />
| {{date|2015|08|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.3<br />
| {{date|2015|04|08}}<br />
| {{date|2015|07|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.2<br />
| {{date|2015|03|09}}<br />
| {{date|2015|05|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1.3<br />
| {{date|2015|01|27}}<br />
| {{date|2015|03|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1.2<br />
| {{date|2014|12|09}}<br />
| {{date|2015|02|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1.1<br />
| {{date|2014|11|17}}<br />
| {{date|2014|12|17}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1<br />
| {{date|2014|10|20}}<br />
| {{date|2014|12|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.0.2<br />
| rowspan="3" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch (5th generation)]]<br />
| {{date|2014|09|25}}<br />
| {{date|2014|10|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.0.1<br />
| {{date|2014|09|24}}<br />
| {{date|2014|09|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.0<br />
| {{date|2014|09|17}}<br />
| {{date|2014|10|22}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 7.1.2<br />
| rowspan="2" | [[iPhone 4]]<br />
| {{date|2017|02|13}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| rowspan="2" | {{date|2014|06|30}}<br />
| {{date|2017|02|13}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]<br />
| {{date|2014|09|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.1.1<br />
| rowspan="3" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]<br />
| {{date|2014|04|22}}<br />
| {{date|2014|08|12}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.1<br />
| {{date|2014|03|10}}<br />
| {{date|2014|04|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.6<br />
| {{date|2014|02|21}}<br />
| {{date|2014|03|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.5<br />
| [[N49AP|iPhone 5c (iPhone5,4)]], [[N53AP|iPhone 5s (iPhone6,2)]]<br />
| {{date|2014|01|29}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.4<br />
| rowspan="2" | [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]<br />
| {{date|2013|11|14}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.3<br />
| {{date|2013|10|22}}<br />
| {{date|2013|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 7.0.2<br />
| [[P105AP|iPad mini (iPad2,5)]]<br />
| rowspan="2" | {{date|2013|09|26}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[P106AP|iPad mini (iPad2,6)]], [[P107AP|iPad mini (iPad2,7)]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch (5th generation)]]<br />
| {{date|2013|10|29}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.1<br />
| [[iPhone 5c]], [[iPhone 5s]]<br />
| {{date|2013|09|18}}<br />
| {{date|2013|10|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPod touch (5th generation)]]<br />
| {{date|2013|09|18}}<br />
| {{date|2013|10|07}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.1.6<br />
| rowspan="2" | [[N88AP|iPhone 3GS]], [[N88AP|iPod touch (4th generation)]]<br />
| {{date|2017|02|13}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| {{date|2013|11|24}}<br />
| {{date|2017|02|13}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.5<br />
| [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2013|09|24}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.4<br />
| [[iPhone 5]]<br />
| {{date|2013|05|02}}<br />
| {{date|2013|09|20}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="6" | 6.1.3<br />
| [[K93AP|iPad2,1]], [[K94AP|iPad2,2]], [[K95AP|iPad2,3]], [[N94AP|iPhone 4S]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[N88AP|iPhone 3GS]]<br />
| rowspan="5" | {{date|2013|03|19}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2013|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPhone 5]]<br />
| {{date|2013|05|02}}<br />
| {{no|Closed}}<br />
|-<br />
| [[P106AP|iPad mini (iPad2,6)]]<br />
| {{date|2013|09|25}}<br />
| {{no|Closed}}<br />
|-<br />
| [[K93AAP|iPad2,4]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[P105AP|iPad mini (iPad2,5)]], [[P107AP|iPad mini (iPad2,7)]], [[iPhone 4]], [[iPod touch (5th generation)]]<br />
| {{date|2013|09|20}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.1.2<br />
| [[N78AP|iPod touch (5th generation)]]<br />
| rowspan="2" | {{date|2013|02|19}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]] [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2013|03|19}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.1<br />
| [[N94AP|iPhone 4S]]<br />
| {{date|2013|02|11}}<br />
| {{date|2013|02|19}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.1<br />
| [[P106AP|iPad mini (iPad2,6)]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2013|01|28}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N78AP|iPod touch (5th generation)]]<br />
| {{date|2013|01|28}}<br />
| {{date|2013|02|19}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.0.2<br />
| [[P105AP|iPad mini (iPad2,5)]], [[iPhone 5]]<br />
| colspan="2" | {{date|2013|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad mini]], [[iPhone 5]]<br />
| {{date|2012|12|18}}<br />
| {{date|2013|01|28}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="4" | 6.0.1<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[iPad (4th generation)]], [[iPad mini]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]<br />
| {{date|2012|11|01}}<br />
| {{date|2013|01|28}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[P101AP|iPad (4th generation) (iPad3,4)]], [[P105AP|iPad mini (iPad2,5)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]<br />
| colspan="2" | {{date|2013|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad mini]]<br />
| {{date|2012|11|01}}<br />
| {{date|2013|01|08}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad (4th generation)]], [[iPad mini]]<br />
| {{date|2012|11|09}}<br />
| {{date|2013|01|28}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 6.0<br />
| [[P101AP|iPad (4th generation) (iPad3,4)]], [[P105AP|iPad mini (iPad2,5)]]<br />
| {{date|2012|10|30}}<br />
| {{date|2012|11|01}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[P105AP|iPad mini (iPad2,5)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]<br />
| colspan="2" | {{date|2013|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch (4th generation)]], [[iPod touch (5th generation)]]<br />
| {{date|2012|09|19}}<br />
| {{date|2012|11|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1.1 (9B208)<br />
| [[N90AP|iPhone 4 (iPhone3,1)]]<br />
| {{date|2012|05|25}}<br />
| {{date|2012|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="4" | 5.1.1 (9B206)<br />
| rowspan="2" |[[K48AP|iPad]]<br />
| {{date|2017|02|13}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| rowspan="3" | {{date|2012|05|07}}<br />
| {{date|2017|02|13}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N18AP|iPod touch (3rd generation)]]<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2012|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1<br />
| [[K48AP|iPad]], [[iPad 2]], [[iPad (3rd generation)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2012|03|07}}<br />
| {{date|2012|05|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.0.1<br />
| [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2011|11|09}}<br />
| {{date|2012|02|08}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 5.0<br />
| [[N94AP|iPhone 4S]]<br />
| {{date|2011|10|14}}<br />
| {{date|2011|11|10}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2011|10|04}}<br />
| {{date|2011|11|10}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.5<br />
| rowspan="6" | [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4(iPhone3,1)]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]<br />
| 25 July 2011<br />
| {{date|2011|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.4<br />
| {{date|2011|07|15}}<br />
| {{date|2011|07|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.3<br />
| {{date|2011|05|04}}<br />
| {{date|2011|07|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.2<br />
| {{date|2011|04|14}}<br />
| {{date|2011|05|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.1<br />
| {{date|2011|03|25}}<br />
| {{date|2011|04|19}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.3<br />
| {{date|2011|03|09}}<br />
| {{date|2011|03|27}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.10<br />
| rowspan="5" | [[N92AP|iPhone 4 (iPhone3,3)]]<br />
| {{date|2011|07|25}}<br />
| {{date|2011|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.9<br />
| {{date|2011|07|15}}<br />
| {{date|2011|07|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.8<br />
| {{date|2011|05|04}}<br />
| {{date|2011|07|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.7<br />
| {{date|2011|04|14}}<br />
| {{date|2011|05|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.6<br />
| {{date|2011|02|01}}<br />
| {{date|2011|04|19}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 4.2.1<br />
| [[N82AP|iPhone 3G]], [[N72AP|iPod touch (2nd generation)]]<br />
| rowspan="2" | {{date|2010|11|22}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[K48AP|iPad]], [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]], [[N18AP|iPod touch (3rd generation)]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2011|03|11}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.1 (8B118)<br />
| [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2010|09|21}}<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="4" | 4.1 (8B117)<br />
| [[N72AP|iPod touch (2nd generation)]], [[N18AP|iPod touch (3rd generation)]]<br />
| {{date|2010|09|08}}<br />
| rowspan="2" | -<br />
| {{yes|Open}}<br />
|-<br />
| rowspan="2" | [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]]<br />
| {{date|2017|02|13}}<br />
| {{yes|Open}}<br />
|-<br />
| rowspan="2" | {{date|2010|09|08}}<br />
| {{date|2017|02|13}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N90AP|iPhone 4 (iPhone3,1)]], [[N81AP|iPod touch (4th generation)]]<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 4.0.2<br />
| [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]], [[N18AP|iPod touch (3rd generation)]]<br />
| {{date|2010|08|11}}<br />
| {{date|2010|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | [[N82AP|iPhone 3G]], [[N72AP|iPod touch (2nd generation)]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| {{date|2010|08|11}}<br />
| {{date|2010|09|18}}<!--Apple may have ceased signing earlier.--><br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 4.0.1<br />
| rowspan="2" | [[N82AP|iPhone 3G]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| {{date|2010|07|15}}<br />
| {{date|2010|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]]<br />
| {{date|2010|07|15}}<br />
| {{date|2010|08|19}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="6" | 4.0<br />
| [[N82AP|iPhone 3G]], [[N72AP|iPod touch (2nd generation)]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[N18AP|iPod touch (3rd generation)]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|08|09}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N72AP|iPod touch (2nd generation)]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N82AP|iPhone 3G]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N88AP|iPhone 3GS]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N90AP|iPhone 4 (iPhone3,1)]]<br />
| {{date|2010|06|24}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.2.2<br />
| rowspan="3" | [[K48AP|iPad]]<br />
| {{date|2010|08|11}}<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 3.2.1<br />
| {{date|2010|07|15}}<br />
| {{date|2010|08|19}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.2<br />
| {{date|2010|04|03}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 3.1.3<br />
| [[N72AP|iPod touch (2nd generation)]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[N88AP|iPhone 3GS]], [[N72AP|iPod touch (2nd generation)]], [[N18AP|iPod touch (3rd generation)]] <br />
| {{date|2010|02|02}}<br />
| {{date|2010|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 3.1.2<br />
| [[N88AP|iPhone 3GS]], [[N18AP|iPod touch (3rd generation)]]<br />
| {{date|2009|10|08}}<br />
| {{date|2010|02|02}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | [[N72AP|iPod touch (2nd generation)]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| {{date|2009|10|08}}<br />
| {{date|2010|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.1.1 (7C146)<br />
| rowspan="2" | [[N18AP|iPod touch (3rd generation)]]<br />
| {{date|2009|09|17}}<br />
| {{date|2009|10|08}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 3.1.1 (7C145)<br />
| {{date|2009|09|09}}<br />
| {{date|2009|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | [[N72AP|iPod touch (2nd generation)]]<br />
| {{date|2018|01|10}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| {{date|2009|09|09}}<br />
| {{date|2010|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.1<br />
| rowspan="3" | [[N88AP|iPhone 3GS]]<br />
| {{date|2009|09|09}}<br />
| {{date|2009|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.0.1<br />
| {{date|2009|07|31}}<br />
| rowspan="2" | {{date|2009|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.0<br />
| {{date|2009|06|19}}<br />
| {{no|Closed}}<br />
|}<br />
<br />
=== Apple TV ===<br />
{| class="wikitable"<br />
|-<br />
! Marketing Version<br />
! OS Version<br />
! For Device(s)<br />
! From<br />
! Until<br />
! Status<br />
|-<br />
| rowspan="19" {{n/a}}<br />
| 11.2.5<br />
| rowspan="5" | [[J42dAP|Apple TV (4th generation)]], [[Apple TV 4K]]<br />
| {{date|2018|01|23}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 11.2.1<br />
| {{date|2017|12|13}}<br />
| {{date|2018|01|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.2<br />
| {{date|2017|12|02}}<br />
| {{date|2018|01|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.1<br />
| {{date|2017|10|31}}<br />
| {{date|2017|12|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 11.0<br />
| {{date|2017|09|19}}<br />
| {{date|2017|12|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.2.2<br />
| rowspan="14" | [[J42dAP|Apple TV (4th generation)]]<br />
| {{date|2017|07|19}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 10.2.1<br />
| {{date|2017|05|15}}<br />
| {{date|2017|08|09}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.2<br />
| {{date|2017|03|27}}<br />
| {{date|2017|06|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.1.1<br />
| {{date|2017|01|23}}<br />
| {{date|2017|04|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.1<br />
| {{date|2016|12|12}}<br />
| {{date|2017|01|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.1<br />
| {{date|2016|10|24}}<br />
| {{date|2017|01|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0<br />
| {{date|2016|09|13}}<br />
| {{date|2016|10|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.2<br />
| {{date|2016|07|18}}<br />
| {{date|2016|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.1<br />
| {{date|2016|05|16}}<br />
| {{date|2016|09|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2<br />
| {{date|2016|03|21}}<br />
| {{date|2016|06|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.1.1<br />
| {{date|2016|01|25}}<br />
| {{date|2016|04|05}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.1<br />
| {{date|2015|12|08}}<br />
| {{date|2016|02|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0.1<br />
| {{date|2015|11|09}}<br />
| {{date|2015|12|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0<br />
| {{date|2015|10|29}}<br />
| {{date|2015|12|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.2.2<br />
| 8.4.2<br />
| rowspan="8" | [[Apple TV (3rd generation)]]<br />
| {{date|2016|12|12}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 7.2.1<br />
| 8.4.1<br />
| {{date|2016|02|25}}<br />
| {{date|2016|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.2<br />
| 8.3<br />
| {{date|2015|04|08}}<br />
| {{date|2016|04|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.1<br />
| 8.2<br />
| {{date|2015|03|09}}<br />
| {{date|2015|05|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.3<br />
| 8.1.3<br />
| {{date|2015|01|27}}<br />
| {{date|2015|03|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.2<br />
| 8.1.1<br />
| {{date|2014|11|17}}<br />
| {{date|2015|04|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.1<br />
| 8.1<br />
| {{date|2014|10|20}}<br />
| {{date|2014|12|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0<br />
| 8.0<br />
| {{date|2014|09|17}}<br />
| {{date|2014|10|22}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.2.1<br />
| rowspan="3" | 7.1.2<br />
| rowspan="2" | [[K66AP|Apple TV (2nd generation)]]<br />
| {{date|2017|02|13}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| {{date|2014|09|17}}<br />
| {{date|2017|02|13}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.2<br />
| rowspan="8" | [[K66AP|Apple TV (2nd generation)]], [[Apple TV (3rd generation)]]<br />
| {{date|2014|06|30}}<br />
| {{date|2014|09|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.1<br />
| 7.1.1<br />
| {{date|2014|04|22}}<br />
| {{date|2014|07|11}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1<br />
| 7.1<br />
| {{date|2014|03|10}}<br />
| {{date|2014|04|30}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.0.2<br />
| 7.0.6<br />
| {{date|2014|02|21}}<br />
| {{date|2014|03|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.4<br />
| {{date|2013|11|14}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.0.1<br />
| 7.0.3<br />
| {{date|2013|10|24}}<br />
| {{date|2013|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.0<br />
| 7.0.2<br />
| {{date|2013|09|24}}<br />
| {{date|2013|10|29}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.1<br />
| {{date|2013|09|20}}<br />
| {{date|2013|09|24}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 5.3<br />
| rowspan="3" | 6.1.4<br />
| [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]<br />
| {{date|2013|06|19}}<br />
| {{date|2013|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | [[K66AP|Apple TV (2nd generation)]], [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]<br />
| {{date|2017|02|13}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| {{date|2013|06|19}}<br />
| {{date|2017|02|13}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.2.1<br />
| 6.1.3<br />
| rowspan="2" | [[K66AP|Apple TV (2nd generation)]], [[Apple TV (3rd generation)]]<br />
| {{date|2013|03|19}}<br />
| {{date|2013|06|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.2<br />
| 6.1<br />
| {{date|2013|01|28}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1.1<br />
| 6.0.1<br />
| rowspan="5" | [[K66AP|Apple TV (2nd generation)]], [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]]<br />
| {{date|2012|11|26}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1<br />
| 6.0<br />
| {{date|2012|09|24}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.0.2<br />
| rowspan="2" | 5.1.1<br />
| {{date|2012|06|05}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.0.1<br />
| {{date|2012|05|10}}<br />
| {{date|2012|7}} (day unknown)<br />
| {{no|Closed}}<br />
|-<br />
| 5.0<br />
| 5.1<br />
| {{date|2012|03|07}}<br />
| {{date|2012|05|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.4<br />
| rowspan="2" | 5.0.1<br />
| rowspan="12" | [[K66AP|Apple TV (2nd generation)]]<br />
| {{date|2011|12|15}}<br />
| {{date|2012|03|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.3<br />
| {{date|2011|11|17}}<br />
| {{date|2012|01|11}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.2<br />
| rowspan="3" | 5.0<br />
| {{date|2011|10|24}}<br />
| {{date|2012|01|11}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.1<br />
| {{date|2011|10|17}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 4.4<br />
| {{date|2011|10|04}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| colspan="2" | 4.3<br />
| {{date|2011|03|09}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.2<br />
| rowspan="3" | 4.3<br />
| {{date|2011|05|11}}<br />
| {{date|2011|10|18}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.1<br />
| {{date|2011|03|22}}<br />
| {{date|2011|05|28}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.2<br />
| {{date|2011|03|09}}<br />
| {{date|2011|03|22}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.1.1<br />
| 4.2.1<br />
| {{date|2010|12|14}}<br />
| {{date|2011|05|28}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.1<br />
| 4.2<br />
| {{date|2010|11|22}}<br />
| {{date|2010|12|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.0<br />
| 4.1<br />
| {{date|2010|09|29}}<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|}<br />
<br />
== Protocol ==<br />
To request a SHSH blob from Apple, a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] request can be made. For a full description, see the separate articles [[SHSH Protocol]] and [[Baseband SHSH Protocol]].<br />
<br />
== See Also ==<br />
* [[APTicket]]<br />
* [[Redsn0w]]<br />
* [[iFaith]]<br />
* [[TinyUmbrella]]<br />
<br />
== References ==<br />
<references /><br />
<br />
== External Links ==<br />
* [http://www.saurik.com/id/12 Detailed background info from Saurik]<br />
* [https://github.com/tihmstar/tsschecker tsschecker]<br />
* [https://github.com/Neal/savethemblobs savethemblobs]<br />
<br />
[[Category:Firmware Tags]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=/boot&diff=65670/boot2017-12-26T01:57:04Z<p>AS967: </p>
<hr />
<div>The /boot directory is used to store OTA update data and is the mount point for the upgrade partition for an OTA update.<br />
<br />
== Children ==<br />
Usually empty, except for OTA update data.<br />
<br />
== Parents ==<br />
{{parent}}</div>AS967https://www.theiphonewiki.com/w/index.php?title=PurpleSNIFF&diff=65181PurpleSNIFF2017-12-04T00:12:35Z<p>AS967: </p>
<hr />
<div>{{internal software}}<br />
{{Infobox software<br />
| name = PurpleSNIFF<br />
| title = <br />
| logo = [[File:PurpleSNIFF logo.png|300px]]<br />
| caption = PurpleSNIFF 2.0 (76)<br />
| collapsible = <br />
| author = Apple Inc.<br />
| developer = Apple Inc.<br />
| released = <br />
| discontinued = <br />
| latest release version = <br />
| latest release date = <br />
| latest preview version = <br />
| latest preview date = <br />
| programming language = <br />
| operating system = [[wikipedia:OS X|OS X]]<br />
| platform = <br />
| size = 3,969,269 bytes [APP] <small>(76)</small> <br />
| language = [[wikipedia:English language|English]]<br />
| status = <br />
| genre = ?<br />
| license = [[wikipedia:Proprietary software|Closed source]]<br />
| website = <br />
}}<br />
{{float toc|left}}<br />
'''PurpleSNIFF''' is a tool made by Apple to read identification and diagnostic information from the device. The tool is used by Apple engineers as well as factory workers at Foxconn/Pegatron. It's included in the [[RestoreTools]] or Home Diagnostics package.<br />
<br />
Like [[iTunes]], [[PurpleSNIFF]] communicates with iDevices using a [[usbmux]] connection.<br />
<br />
==Device Information==<br />
PurpleSNIFF displays the value of all keys accessible by liblockdown and mobilegestaltd. <br />
Data is broken into categories:<br />
* '''SNIFF''': Report date and host machine configuration<br />
* '''Battery''': Battery charge state <br />
* '''Debug''': Lockdown and CLTM (thermal) extended logging. <br />
* '''Developer''': "Development" if has installed XCode developer diskimage.<br />
* '''Device Mode''': "OS Mode", "Recovery", "DFU", and possibly other internal modes.<br />
* '''Diagnostic Data''': Includes device test data from different factory stations, including their timestamps. There are over 300 testing stations devices can be tested on. Each device will usually pass through about 6 testing stations before shipping. The diagnostic platform is called iPCB.<br />
* '''Disk Usage''': Stats for both System and Data partitions<br />
* '''General''': Activation info, baseband identifiers and state, current carrier bundle, device certificate, public key, name, device color, ECID, MAC addresses, UDID, Serial Number, Hardware Model, [[Fusing Status]], platform, architecture, IMEI/IMSI/ICCID, NVRAM data, OS Build/Version, passcode lock-state, proximity sensor calibration, region code, [[Security Fusings|Security Fusing]] (secure or insecure), Production Mode (Production or Development), SIM card status, presence of Springboard/lockdown, and many more.<br />
* '''Internal''': isInternal and isCarrierBuild, isUIBuild, raw hex dump of SysCfg and DIAGS blocks. <br />
* '''Localization''': Language<br />
* '''Mobile iTunes''': Fairplay related parameters (e.g. certificate)<br />
* '''Restore From Backup''': If it has been restored from a backup<br />
* '''Setup Assistant''': YES/NO listing of which screens have been presented.<br />
* '''Software Behavior''': A bitmask that is decoded into the following boolean properties: China Brick, Google Mail, No VOIP, No Wi Fi, NTSC, Shutter Click, Valid, and Volume Limit.<br />
* '''Sync''': Device support for clearing data and encrypted backups, as well as mail accounts connected.<br />
* '''Sync Backup''': iCloud sync information.<br />
* '''SysCfg''': Device hardware information such as sensor calibration data, device color, NAND size, and serial numbers. This block is read-write for AppleInternal tool that must run on the device, so that Apple can refurbish devices and give them a new serial number. <br />
* '''Wireless''': Bonjour service name, Wifi support, Wifi-sync support.<br />
<br />
<br />
[[File:PurpleSniffSS.png|350px|thumb|right| General Section of PurpleSNIFF with sensitive identifiers redacted.]]<br />
<br />
==White List==<br />
"Request White List Authorization" composes a new email to whitelist-request@group.apple.com. This email address is only reachable if you have an @apple.com email account. The address does not accept outside (external) senders. This feature allows a factory worker or Apple engineer to request that the device be SIM-unlocked for use on certain carriers. <br />
<br />
TO: whitelist-request@group.apple.com<br />
SUBJECT: White-list Request<br />
<br />
Please whitelist the following device<br />
<br />
device: n41ap-prodfuse<br />
imei: 00...[redacted]...0<br />
<br />
carriers:<br />
justification:<br />
<br />
==Auth List==<br />
"Request Personalized Install Authorization" composes a new email to authlist-request@group.apple.com. As with White List, this email address is only reachable if you have an @apple.com email account. This feature allows a factory worker or Apple engineer to request special firmware personalization for their device. This is useful because Apple could order prototypes of unreleased iPhones but refuse to sign any firmware for them. This way, if the devices are lost/leaked into the wild for some reason, the device is [[bricked]]. When prototype phones arrive safely/securely to Cupertino, engineers can have them activated for firmware personalization through this mechanism. It is not known the requests are to permit firmware signing on the public or internal (VPN-only) TSS server. <br />
<br />
TO: authlist-request@group.apple.com<br />
SUBJECT: Authorization List Request<br />
<br />
Please authorize the following device<br />
<br />
device: n41ap-prodfuse<br />
ecid: 0[redacted]0<br />
bbsn: 0x0[redacted]0<br />
<br />
audience:<br />
restore tool:<br />
justification:<br />
<br />
==Extras==<br />
The other main tabs of the application reveal the live Syslog and the IORegistry hierarchy. <br />
Menu options include commands to enable extra logging, reboot devices (with optional prompt), obliterate and reset them, read diagnostic data from GasGauge, WIFI, and NAND, query MobileGestalt directly, enter and exit recovery, and "Lookup Device" in PDCA. It can also pull logs off of the device, as well as content in var/mobile/library . The log archive can be huge because it includes data like the SMS database and all MMS attachments). <br />
<br />
PurpleSNIFF also tracks location, maybe for some sort of monitoring where and how the tool is used. Be careful with this, it may land you in trouble.<br />
<br />
[[Category:Software]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Bootrom&diff=63495Bootrom2017-10-09T00:03:59Z<p>AS967: </p>
<hr />
<div>The '''bootrom''' (called "SecureROM" by Apple) is the first significant code that runs on an iDevice. The bootrom is read-only. Finding exploits in the bootrom level is a big achievement since Apple won't be able to fix it without a hardware revision.<br />
<br />
== Old & New bootrom ==<br />
Certain models, including the [[N72AP|iPod touch (2nd generation)]] and [[N88AP|iPhone 3GS]], have different bootrom versions. These are most commonly referred to with the terms "old bootrom" and "new bootrom." These "new bootrom" devices were released after [[Timeline#September|9 September 2009]] and have the [[0x24000 Segment Overflow]] fixed. While the new bootrom revisions have an exploit, the exploit needs the assistance of a firmware-based exploit to achieve an [[untethered jailbreak]].<br />
<br />
You might also be looking for [[iBoot (Bootloader)|Apple's stage 2 bootloader]], which also uses the "iBoot" name.<br />
<br />
Usually also looking at the CPRV (Chip Revision) tag will also tell you whether the device is new unit or not also.<br />
<br />
==Finding bootrom version==<br />
===From the model number ([[N72AP|iPod touch (2nd generation)]])===<br />
If the second character of your Model Number is "B" (e.g.- '''FB533''', '''MB533''', or '''PB533'''), your iPod has the old bootrom. If the second character is "C" ('''FC086''', '''MC086''' or '''PC086'''), your iPod has the new bootrom.<br />
<br />
===From the serial number ([[N88AP|iPhone 3GS]])===<br />
The third digit of the serial number identifies the year of manufacture (9=2009, 0=2010, 1=2011, 2=2012), while the fourth and the fifth indicate the week. There is a gray area between week 40 of 2009 (??940??????) and week 45 of 2009 (??945??????) where some devices have new bootrom whilst others have old bootrom. . Any iPhone made after Week 45 of 2009 (??945?????? and higher or ??0???????? serials) has the new bootrom.<br />
<br />
===From the DFU Device descriptors (all devices except S5L8900)===<br />
====Windows====<br />
# Connect Device & Enter [[DFU Mode]] <br />
# Open Device Manager, find USB controller, subitem Apple Mobile Device USB Driver<br />
# Right-Click & click Properties<br />
# Go to Details tab & select Device Instance Path in the dropdown box<br />
# The end of the info string will show the bootrom version<br />
<br />
====Mac OS X====<br />
# Connect Device & Enter [[DFU Mode]]<br />
# Go to System Profiler, and under the Hardware category, go to USB, and click on Apple Mobile Device (DFU Mode)<br />
# The end of the Serial Number string will show the bootrom version in brackets (ie: [iBoot-574.4])<br />
<br />
====Linux====<br />
# Make sure your distribution has '''usbutils''' installed. (most distributions have it by default) <br />
# Connect Device & Enter [[DFU Mode]] <br />
# In terminal, run '''sudo lsusb -v'''<br />
# Find the line that says '''iSerial''' and your bootrom version will be at the end of the line.<br />
<br />
== Dumping the bootrom ==<br />
You can use [[Bootrom Dumper Utility]] by [[User:pod2g|pod2g]] to dump the bootrom on devices that are vulnerable to the [[Limera1n Exploit]].<br />
<br />
== Bootrom Exploits ==<br />
* [[pwnage|Pwnage 1.0 (Ramdisk + AppleImage2NORAccess)]] up to Rev.2<br />
* [[Pwnage 2.0|Pwnage 2.0 (DFU + Malformed Certificate)]] up to Rev.2<br />
* [[usb_control_msg(0xA1, 1) Exploit]] (also called "steaks4uce" exploit) only for 240.4 and 240.5.1<br />
* [[0x24000 Segment Overflow]] only for 240.4 and 359.3<br />
* [[alloc8 Exploit]] only for 359.3 and 359.3.2<br />
* [[Limera1n Exploit]] up to 574.4<br />
* [[SHA-1 Image Segment Overflow|SHAtter]] up to 574.4<br />
<br />
== Revisions ==<br />
* [[Bootrom Rev.2]] in [[S5L8900]]<br />
* [[Bootrom 240.4]] in [[S5L8720]] (old version only)<br />
* [[Bootrom 359.3]] in [[S5L8920]] (old version only)<br />
* [[Bootrom 240.5.1]] in [[S5L8720]] (new version only)<br />
* [[Bootrom 359.3.2]] in [[S5L8920]] (new version only)<br />
* [[Bootrom 359.5]] in [[S5L8922]]<br />
* [[Bootrom 574.4]] in [[S5L8930]]<br />
* [[Bootrom 838.3]] in [[S5L8940]]<br />
* [[rom]] in [[S5L8942]]<br />
* [[Bootrom 1062.2]] in [[S5L8945]]<br />
* [[Bootrom 1413.8]] in [[S5L8747]]<br />
* [[Bootrom 1458.2]] in [[S5L8947]]<br />
* [[Bootrom 1145.3]] in [[S5L8950]]<br />
* [[Bootrom 1145.3.3]] in [[S5L8955]]<br />
* [[Bootrom 1704.10]] in [[S5L8960]] and [[S5L8965]]<br />
* [[Bootrom 1992.0.0.1.19]] in [[T7000]]<br />
* [[Bootrom 1991.0.0.2.16]] in [[T7001]]<br />
* [[Bootrom 2098.0.0.2.4]] in [[S7002]]<br />
* [[Bootrom 2234.0.0.3.3]] in [[S8000]]<br />
* [[Bootrom 2234.0.0.2.22]] in [[S8003]]<br />
* [[Bootrom 2481.0.0.2.1]] in [[S8001]]<br />
* [[Bootrom 2651.0.0.1.31]] in [[T8002]]<br />
* [[Bootrom 2696.0.0.1.33]] in [[T8010]]<br />
* [[Bootrom 3332.0.0.1.23]] in [[T8015]]<br />
<br />
<br />
===[[S5L8900]], used in the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]]===<br />
see also [[VROM (S5L8900)]]<br />
* [[Bootrom Rev.2]]<br />
<br />
===[[S5L8720]], used in the [[N72AP|iPod touch (2nd generation)]]===<br />
* [[Bootrom 240.4]] "old bootrom"<br />
* [[Bootrom 240.5.1]] "new bootrom"<br />
<br />
===[[S5L8920]], used in the [[N88AP|iPhone 3GS]]===<br />
* [[Bootrom 359.3]] "old bootrom"<br />
* [[Bootrom 359.3.2]] "new bootrom"<br />
<br />
===[[S5L8747]], used in the [[Haywire]]===<br />
* [[Bootrom 1413.8]]<br />
<br />
===[[S5L8922]], used in the [[N18AP|iPod touch (3rd generation)]]===<br />
* [[Bootrom 359.5]]<br />
<br />
===[[S5L8930]], used in the [[K48AP|iPad]], [[N90AP|iPhone 4]], [[K66AP|Apple TV (2nd generation)]], and [[N81AP|iPod touch (4th generation)]]===<br />
* [[Bootrom 574.4]]<br />
<br />
===[[S5L8940]], used in the [[iPad 2]] and [[N94AP|iPhone 4S]]===<br />
* [[Bootrom 838.3]]<br />
<br />
===[[S5L8942]], used in the [[K93AAP|iPad 2 (iPad2,4)]], [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]], [[iPod touch (5th generation)]], and [[iPad mini]] ===<br />
* [[rom]]<br />
<!--<br />
* Apple TV (3rd generation) (J33) does not print Bootrom revision over USB Descriptor while in DFU.<br />
<br />
e.g CPID:8942_CPRV:10_CPFM:03_SCEP:10_BDID:08_ECID:00000XXXXXXXXXXX_IBFL:00_SRTG:[ROM]<br />
--><br />
<br />
===[[S5L8945]], used in the [[iPad (3rd generation)]]===<br />
* [[Bootrom 1062.2]]<br />
<br />
===[[S5L8947]], used in the [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]===<br />
* [[Bootrom 1458.2]]<br />
<br />
===[[S5L8950]], used in the [[iPhone 5]] and [[iPhone 5c]] ===<br />
* [[Bootrom 1145.3]]<br />
<br />
===[[S5L8955]], used in the [[iPad (4th generation)]]===<br />
* [[Bootrom 1145.3.3]]<br />
<br />
===[[S5L8960]]/[[S5L8965]], used in the [[iPhone 5s]], [[iPad Air]], [[iPad mini 2]], and [[iPad mini 3]]===<br />
* [[Bootrom 1704.10]]<br />
<br />
===[[T7000]], used in the [[J42dAP|Apple TV (4th generation)]], [[B238aAP|HomePod]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], and [[N102AP|iPod touch (6th generation)]]===<br />
* [[Bootrom 1992.0.0.1.19]]<br />
<br />
===[[T7001]], used in the [[iPad Air 2]]===<br />
* [[Bootrom 1991.0.0.2.16]]<br />
<br />
===[[S7002]], used in the [[Apple Watch (1st generation)]]===<br />
* [[Bootrom 2098.0.0.2.4]]<br />
<br />
===[[S8000]], used in the [[iPad (5th generation)]], [[N71AP|iPhone 6s]], [[N66AP|iPhone 6s Plus]] and [[N69uAP|iPhone SE]]===<br />
* [[Bootrom 2234.0.0.3.3]]<br />
<br />
===[[S8001]], used in the [[iPad Pro]]===<br />
* [[Bootrom 2481.0.0.2.1]]<br />
<br />
===[[S8003]], used in the [[N71mAP|iPhone 6s]], [[N66mAP|iPhone 6s Plus]] and [[N69AP|iPhone SE]]===<br />
* [[Bootrom 2234.0.0.2.22]]<br />
<br />
===[[T8002]], used in the [[Apple Watch Series 1]] and [[Apple Watch Series 2]]===<br />
* [[Bootrom 2651.0.0.1.31]]<br />
<br />
===[[T8010]], used in the [[iPhone 7]] and [[iPhone 7 Plus]]===<br />
* [[Bootrom 2696.0.0.1.33]]<br />
<br />
===[[T8015]], used in the [[iPhone 8]], [[iPhone 8 Plus]], and [[iPhone X]]===<br />
* [[Bootrom 3332.0.0.1.23]]<br />
<br />
== References ==<br />
* [http://conference.hitb.org/hitbsecconf2013kul/materials/D2T1%20-%20Joshua%20'p0sixninja'%20Hill%20-%20SHAttered%20Dreams.pdf p0sixninja's presentation SHAttered Dreams - Adventures in BootROM Land]<br />
<br />
[[Category:Bootrom]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Bootrom_3332.0.0.1.23&diff=63421Bootrom 3332.0.0.1.232017-10-01T01:28:33Z<p>AS967: </p>
<hr />
<div>This is the bootrom version found in the [[iPhone 8 Plus]]. It has no known exploits. This bootrom was compiled right before 10.0 beta 1<br />
{{stub|firmware}}<br />
[[Category:Bootrom]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Bootrom_3332.0.0.1.23&diff=63417Bootrom 3332.0.0.1.232017-09-30T02:38:56Z<p>AS967: </p>
<hr />
<div>This is the bootrom version found in the [[iPhone 8 Plus]]. It has no known exploits. This bootrom was compiled between 9.3.5 and 10.0 beta 1<br />
{{stub|firmware}}<br />
[[Category:Bootrom]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=D22AP&diff=62899D22AP2017-09-12T20:40:27Z<p>AS967: Created page with "This is the iPhone X announced at Apple's event on September 12, 2017."</p>
<hr />
<div>This is the [[iPhone X]] announced at Apple's event on September 12, 2017.</div>AS967https://www.theiphonewiki.com/w/index.php?title=Nonce&diff=62596Nonce2017-09-10T03:06:02Z<p>AS967: </p>
<hr />
<div>'''Nonce''' is a signing method that randomizes Apple's cryptographic signature hash blobs ([[SHSH]] blobs) and is used with the BBTicket (baseband signing ticket), the APTicket (firmware signing ticket), and SEP ([[Secure Enclave]]). <br />
<br />
==Method==<br />
The device bootloaders (baseband, firmware, and SEP) generate a random number at the restore, then send them to iTunes which sends them to Apple. Then Apple sends the APTicket / BBTicket [[SHSH]] certificate with the number generated. This level is the most critical: the number within the certificate is matched to the number generated on device, and if they match iTunes will prepare the matched certificate and finally will stitch the randomized blobs to the firmware. If the blobs don't match the restore will fail and the bootloaders will reject the certificate.<br />
<br />
==Usage==<br />
===BBTicket===<br />
*No iPod touch (or iPad Wi-Fi) has been signed with the BBTicket, since by definition it has no baseband.<br />
*[[M68AP|iPhone]] (bootloaders can be neutered to cancel this signchecks). [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]] and [[K48AP|iPad Wi-Fi+3G]] - if the baseband is higher or equal (or just higher on bootloader 3.9 on [[M68AP|iPhone]]). Some bootloaders allow downgrade of the baseband if it is still signed.<br />
*[[N90AP|iPhone 4 (iPhone3,1)]], [[N92AP|iPhone 4 (iPhone3,3)]], [[N94AP|iPhone 4S]], and [[K94AP|iPad 2 (iPad2,2)]] and [[K95AP|iPad 2 (iPad2,3)]] - [[AT+XNONCE]] - restores the baseband only if Apple is still signing it. On bootloaders 2.8, 2.13, Trek and Phoenix, both the [[AT+XNONCE]] and the "higher or equal" checks happen.<br />
<br />
===APTicket===<br />
*Devices with the [[S5L8900]] get [[SHSH]] blobs without APTicket on 4.0 - 4.2.1, even though they are not required and can be avoided with [[Pwnage]]+[[Pwnage 2.0]].<br />
*Devices with the [[S5L8720]] get [[SHSH]] blobs without APTicket from 3.1.1 and on, even though [[Bootrom 240.4]] doesn't require them and they can be avoided with the [[0x24000 Segment Overflow]]<br />
*Devices with the [[S5L8920]], [[S5L8922]], [[S5L8930]] and [[S5L8940]] got [[SHSH]] blobs without APTicket between 3.0 - 4.3.5, and they can not be avoided (except for the [[Bootrom 359.3]] with the 0x24000 Segment Overflow)<br />
*Devices with the [[S5L8920]], [[S5L8922]], [[S5L8930]], [[S5L8940]], [[S5L8942]], [[S5L8945]], [[S5L8950]], and [[S5L8955]] get APTicket SHSH blobs on 5.0+. The SHSH requirement can not be avoided (except for the [[Bootrom 359.3]] with 0x24000 Segment Overflow), and the APTicket requirement can only be avoided on devices vulnerable to the [[limera1n Exploit]], or if the device is on iOS 5.1.1 or lower.<br />
*Devices with the [[S5L8960]], [[S5L8965]], [[T7000]], [[T7001]], [[S7002]], [[S8000]], [[S8001]], [[S8003]], [[T8010]], and [[T8011]] get APTickets exclusively (with SepNonce, which also needs to match) and they cannot be avoided, but can be utilized with the prometheus method.<br />
==Jailbreak difficulties==<br />
With nonce signatures, signatures can't be cached, because signatures will not match if they have been reused. In other words, the widely used replay attack is no longer possible unless the nonce(s) (SepNonce + ApNonce on 64 bit, ApNonce only on 32 bit) the device generates matches the one on the APTicket.<br />
<br />
==See also==<br />
*[[AT+XNONCE]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Restore_Ramdisk&diff=62129Restore Ramdisk2017-09-05T13:32:45Z<p>AS967: </p>
<hr />
<div>Wipes everything out on the [[NAND]] and reflashes it with the OS provided in the [[IPSW File Format|IPSW]]. After, it will flash the [[NOR]] with the firmware files in the [[IPSW File Format|IPSW]], and if it is an [[List of iPhones|iPhone]], re-flash the [[Baseband Device|baseband]] as well (provided it is not an earlier [[Baseband Device|baseband]] version, except in the case of the [[N90AP|iPhone 4]] and newer which depends on whether or not Apple is signing the baseband firmware you are trying to flash). On [[N51AP|iPhone 5S]] and newer, it's also responsible for updating the [[Secure Enclave|SEP]] via [[seputil]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Bootrom_2098.0.0.2.4&diff=62128Bootrom 2098.0.0.2.42017-09-05T02:13:23Z<p>AS967: </p>
<hr />
<div>This is the [[bootrom]] version found in the [[Apple Watch (1st generation)]]. It has no known exploits. Strangely, despite being a 32 bit ARMv7k SoC, it uses the newer [[IMG4 File Format|IMG4]] format instead of the [[IMG3 File Format|IMG3]] format.<br />
<br />
{{stub}}<br />
[[Category:Bootrom]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=APTicket&diff=61062APTicket2017-08-27T14:28:24Z<p>AS967: </p>
<hr />
<div>'''APTickets''' (short for '''Application Processor Ticket'''<ref>[https://opensource.apple.com/source/CommonCrypto/CommonCrypto-60027/Source/libDER/Tests/DER_Ticket.c DER_Ticket.c (libDER) at Apple Open Source]</ref>) are the new type of [[SHSH|SHSH blobs]], used by iOS 5.0 and newer. The client (iBSS/LLB/iBoot/BootROM) generates a random string (nonce), then iTunes and the device sends the request for blob signing and the server returns the data, just like the original [[SHSH Protocol|SHSH protocol]].<br />
<br />
==Restoring==<br />
When iTunes or the on-device firmware upgrader sends a request to Apple's servers to confirm the APTicket, instead of returning the one already stored on the server, a new one is generated. Furthermore, devices with iOS 5 depend on the APTicket being legitimate to be able to boot; the device will enter [[Recovery Mode]] if it isn't.<br />
<br />
==Downgrading==<br />
Saurik's original replay attack method of allowing downgrades for any [[firmware]] that had been backed up on his server was partially halted for [[iOS]] 5 users due to this new system; now it will back up APTickets, but it can't send it directly from his servers; [[Redsn0w]] and [[iFaith]] can stitch a stock or custom firmware to enable downgrading with APTicket, but it only works for devices vulnerable to [[Limera1n Exploit]]. <br />
<br />
Faking APTickets is complicated because they are signed with a private key that only Apple knows and they are also partly generated from a random string (nonce).<br />
<br />
[[iOS]] 4.3.5 and older can still be downgraded if [[SHSH]] blobs were saved.<br />
<br />
[[iPad 2]] users with iOS 4.3.x [[SHSH]] blobs can upload their 4.3.x iBSS via DFU and jump to [[iOS]] 5's iBEC. At this point, a signed [[IPSW]] can be used to restore to cached iOS 5 blobs. (This method is very effective on WiFi-only models. 3G models require the baseband to be installed/signed... Something like semaphore's TinyCFW can be implemented to get around this).<br />
<br />
A vulnerability found independently by [[iH8sn0w]] and the [[iPhone Dev Team]] allowed downgrading all [[A5]] devices running 5.x with their saved APTickets by restoring the latest [[firmware]]- verifying APTicket with the [[iBSS]] or [[iBoot]] then restoring the hacked [[firmware]] without APTicket- then when the restore ends, the requisite firmware is restored. This method theoretically works with BBTickets, but such a [[baseband]] downgrade was never out.<br />
<br />
A bug existing in several 32-bit versions of iOS, though only exploitable in iOS 9.x, allows users to downgrade using cached iBSS/LLB blobs and APTicket, provided that the APTicket does not contain a nonce. A missing nonce is not treated as a mismatch, allowing the restore to continue and effectively defeating the improved downgrade prevention introduced by APTickets. The first public tool that exploited the bug was iDeviceReRestore (released on 2 April 2017), which, unlike Odysseus, does not require the device to be jailbroken. This brought a way to restore 32-bit devices to jailbreakable firmware, devices that had not seen a jailbreak for signed firmware since the release of Pangu9 for iOS 9.0.x more than 17 months earlier. The method was later incorporated into futurerestore.<br />
<br />
==APTicket structure==<br />
APTicket is a piece DER encoded data. The format of the data is different for 32-bit and 64-bit devices, but these formats have something in common. Each APTicket has a header, signed DER encoded SET, which contains hashes of all signed images and some additional data, PKCS#1 signature and two certificates. The first certificate is an Apple Secure Boot Certificate and the second one is specific for each TSS server and device CPU.<br />
<br />
===Old APTicket format===<br />
Old APTickets begin with a SEQUENCE which contains a signature type. This signature type shall match one in the first certificate. Next comes a SET with ECID, chip ID, board ID, SHA1 hashes of all signed images and some boolean values indicating true. Seems like tag of each element in the SET describes it's meaning. Old APTickets end with a signature and two certificates.<br />
<br />
===IM4M APTicket/ApImg4Ticket format===<br />
These begin with an IA5String "IM4M" and an INTEGER which is likely a version number. SET in these APTickets contains data structures of similar format. Each structure is of constructed type with PRIVATE class and contains a SEQUENCE with IA5String and a SET. The string describes the contents of the SET. Lets call these structures ''tags'' and their strings ''types''. Root tag has type MANB and contains all other tags. The first of the MANB tags is MANP. It stores some tags describing the device and some tags which purpose is unknown. Other MANB tags describe each signed image.<br />
<br />
==References==<br />
*[http://blog.iphone-dev.org/post/6952986620/blob-monster Dev-Team Blog- explanation on APTicket's restrictions]<br />
*[http://blog.iphone-dev.org/post/22834622159/5x-redux Release post for the A5 downgrade]<br />
<references /><br />
<br />
==See Also==<br />
*[[wikipedia:Cydia#iOS_.22signature.22_feature|Cydia article on Wikipedia]]<br />
*[[redsn0w]], which has functionality to backup APTickets on devices exploitable with [[limera1n Exploit|limera1n]]<br />
*[http://www.saurik.com/id/12 Details from saurik about the replay attack]</div>AS967https://www.theiphonewiki.com/w/index.php?title=GID_Key&diff=61043GID Key2017-08-27T01:00:44Z<p>AS967: </p>
<hr />
<div>The '''GID key''' ('''Group ID key''') is a 256-bit [[wikipedia:Advanced Encryption Standard|AES]] key shared by all devices with the same application processor. The GID key is part of how iOS encrypts software on the device ([https://books.google.com/books?id=CEzB2avQjR4C&lpg=PA268&vq=gid%20key&dq=GID%20Key&pg=PA268#v=onepage&q&f=false more explanation]). This is one component of the iOS security system, which also includes [[SHSH]] signatures.<br />
<br />
This key is different on each [[Application Processor|processor model]] ([[wikipedia:System on a chip|system on a chip]]) - in other words, the [[S5L8900]] (chip for iPhone 3G for example) has a different key compared to the [[S5L8930]] (A4 chip for iPhone 4, iPod touch (4th generation), etc.). On [[S5L8960]] and later processors, the [[Secure Enclave]] has it's own GID that is separate from the AP's which is used to encrypt the SEP Firmware before delivery to the end user.<br />
<br />
Apple explains GID keys in its official [https://www.apple.com/br/privacy/docs/iOS_Security_Guide_Oct_2014.pdf iOS security guide] (page 9, chapter "Encryption and Data Protection"), along with [[UID key]]s:<br />
<blockquote>"The device’s unique ID (UID) and a device group ID (GID) are AES 256-bit keys fused (UID) or compiled (GID) into the application processor during manufacturing. No software or firmware can read them directly; they can see only the results of encryption or decryption operations performed using them. The UID is unique to each device and is not recorded by Apple or any of its suppliers. The GID is common to all processors in a class of devices (for example, all devices using the Apple A8 processor), and is used as an additional level of protection when delivering system software during installation and restore. Integrating these keys into the silicon helps prevent them from being tampered with or bypassed, or accessed outside the AES engine. The UID and GID are also not available via JTAG or other debugging interfaces."</blockquote><br />
<br />
On [[S5L8900]], the GID key was used to generate [[AES Keys#Key 0x837|AES Key 0x837]], used as the encryption key for [[S5L File Formats#IMG2|IMG2 files]]. With the introduction of [[IMG3 File Format|IMG3]] in iOS 2.0, iOS started using [[KBAG]]s instead of the 0x837 key. iOS 7.0 introduced the [[IM4P File Format]] and [[IMG4 File Format]] for [[A7]] and newer devices.<br />
<br />
In [[iOS]] 3.0GM/3.0, a pseudo GID Key was used, which allowed getting [[Firmware Keys|firmware decryption keys]] for these firmwares without the device and with tools such as GitKeys or OpenSSL. See [[Decrypting Firmwares#S5L8900]].<br />
<br />
== Potential attacks ==<br />
A hypothetical way to extract this key could be to perform some sort of [[wikipedia:side-channel attack|side-channel attack]] (see also [[Talk:GID Key]] for more speculation about potential attacks).<br />
<br />
A presentation from May/June 2011 that explains a variety of attacks aiming to get this kind of information out of a chip: [http://www.cl.cam.ac.uk/~sps32/ECRYPT2011_1.pdf Fault attacks on secure chips: from glitch to flash (Part 1)] and [http://www.cl.cam.ac.uk/~sps32/ECRYPT2011_2.pdf Side-channel attacks: new directions and horizons (Part 2)].<br />
<br />
Research into AES key extraction using side-channel analysis, done from 2010 to 2012: [http://www.cl.cam.ac.uk/~sps32/qvl_proj.html developing new technology for efficient side-channel analysis] - using a tool from [http://www.quovadislabs.com/ Quo Vadis Labs].<br />
<br />
=== CIA research into attacks ===<br />
[https://firstlook.org/theintercept/2015/03/10/ispy-cia-campaign-steal-apples-secrets/ According to this March 2015 article in ''The Intercept''] based on documents provided by Edward Snowden, the CIA has been particularly interested in figuring out how to extract GID keys as part of their efforts to get access to modifying iOS to insert spy software and to research further vulnerabilities:<br />
<br />
<blockquote>"At the 2011 Jamboree conference, there were two separate presentations on hacking the GID key on Apple’s processors. One was focused on non-invasively obtaining it by studying the electromagnetic emissions of — and the amount of power used by — the iPhone’s processor while encryption is being performed. Careful analysis of that information could be used to extract the encryption key. Such a tactic is known as a "side channel" attack. The second focused on a "method to physically extract the GID key.'"([https://firstlook.org/theintercept/document/2015/03/10/differential-power-analysis-apple-a4-processor/ The first document] and [https://firstlook.org/theintercept/document/2015/03/10/secure-key-extraction-physical-de-processing-apples-a4-processor/ the second one].)</blockquote><br />
<blockquote>"According to the 2011 document describing the Jamboree presentations on Apple's processor, the researchers asserted that extracting the GID key could also allow them to look for other potential gateways into Apple devices. 'If successful, it would enable decryption and analysis of the boot firmware for vulnerabilities, and development of associated exploits across the entire A4-based product-line, which includes the iPhone 4, the iPod touch and the iPad.'"</blockquote><br />
<br />
The 2011 timing is interesting, since [[User:geohot|geohot]] had publicly released a powerful [[bootrom]] exploit ([[limera1n]]) for A4 devices in October 2010, which presumably the CIA was already using (probably one of the "very small number of security flaws, many of which are public, which Apple eventually patches" they mentioned). If a person has a bootrom exploit like limera1n, they can decrypt firmwares by generating the firmware keys from the [[KBAG]]s (since they can use the GID keys on-device even if they can't extract them) - see [[Firmware Keys]]. It's possible this talk had been written earlier and presented as still relevant for A5 and future chips.<br />
<br />
=== Discussion of CIA research ===<br />
<br />
[[User:NerveGas|NerveGas]] wrote [http://www.zdziarski.com/blog/?p=5009 a blog post about the implications of that article]. He says: "The UID key is what you’d want to get if you made an arrest and were looking to scrape data off of a suspect’s device. Instead, what CIA was trying to get instead was the GID, which is a key shared across an entire chip architecture (e.g. product line), that’s used for decrypting the low level boot firmware on a device...What that tells us is that CIA was NOT interested in getting forensic level access to personal data on a seized device in physical custody, but is instead more interested in cooking their own low level boot firmware to potentially deploy across an entire product line of device. With a private cache of exploits and/or cooked boot loader firmware, CIA could potentially infect millions of devices with malicious firmware to give them persistent access to monitor or surveil devices worldwide."<br />
<br />
[[i0n1c]] wrote some tweets responding to the article and disputing what NerveGas said, including these (quoted in chronological order):<br />
* [https://twitter.com/i0n1c/status/575202998554595328 "The GID key allows you to decrypt iDevice firmware files. It does not allow you to pretend to be Apple. For that you need to break RSA."] (For context, RSA signatures are used in the [[SHSH]] system, which is Apple's [[wikipedia:digital signature|digital signature]] system designed to make sure only official Apple software can be installed on iOS devices.)<br />
* [https://twitter.com/i0n1c/status/575228562535550977 "The next thing is: I do not read in the abstracts linked by The Intercept that they actually succeeded in getting the GID key."] <br />
* [https://twitter.com/i0n1c/status/575228886985895936 "The abstract linked by The Intercept merely say that they are working on extracting the GID key and that it is work in progress."] <br />
* [https://twitter.com/i0n1c/status/575229014907953152 "Several Jailbreakers also tried hardware attacks to extract GID keys. Everybody with the capability did. So no surprise…"] <br />
* [https://twitter.com/i0n1c/status/575343599031820290 "The GID key does not enable you to prepare a fake firmware. For that you need first and foremost a digital signature."] <br />
* [https://twitter.com/i0n1c/status/575344476534751232 "The reason why the CIA and everybody else is after the GID key is simply because it allows decrypting firmware for reversing purposes."]<br />
* [https://twitter.com/i0n1c/status/575346239522357248 "BTW a single key for a single firmware file for a group is enough to create correctly encrypted (but not signed) firmware (no GID needed)"] <br />
* [https://twitter.com/i0n1c/status/575347464934420480 "With limera1n millions of people had access to the GID key via bootrom code. Not a single person managed to create a bad accepted firmware"]<br />
<br />
The overall ''Intercept'' article was somewhat controversial among security researchers, with comments in [https://twitter.com/jeremyscahill/status/575509558556237825 this Twitter thread] and [http://blog.erratasec.com/2015/03/no-cia-isnt-stealing-apples-secrets.html this post] with [https://twitter.com/i0n1c/status/575550172815618049 responses], with disagreements about the goals of the CIA research and about which people should have been consulted as experts on the subject.<br />
<br />
== Related tools ==<br />
* [http://iphonedevwiki.net/index.php/IOCryptoAcceleratorFamily IOCryptoAcceleratorFamily] - "a collection of kernel extensions that provide hardware-accelerated cryptographic functions, e.g. SHA1, AES, pseudo-random number generator (PRNG), etc."<br />
* [https://github.com/planetbeing/xpwn/tree/master/crypto crypto by planetbeing] - "This package allows you to directly access the iPhone's AES engine from userland. You may encrypt and decrypt with the UID and GID keys, as well as any custom keys you provide."<br />
* [https://code.google.com/p/iphone-dataprotection/ iphone-dataprotection] - wiki includes a list of [https://code.google.com/p/iphone-dataprotection/wiki/EncryptionKeys types of encryption keys used for data protection], including a chart of key hierarchy on iPhone 4.<br />
<br />
[[Category:Decryption]]<br />
[[Category:Malware research]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=UID_key&diff=61042UID key2017-08-27T00:59:02Z<p>AS967: </p>
<hr />
<div>The '''UID key''' (device's unique ID key) is an AES 256-bit hardware key, unique to each iPhone. It's fused into the application processor during manufacturing. It was previously used to encrypt things in the [[NOR]]. In later iOS versions, it is used to encrypt the entire file system, so that the flash chips cannot moved to another device and read out there again. On the [[S5L8960]] and later, the [[Secure Enclave|SEP]] has it's own UID in it's own AES Engine, and that UID is the one used to encrypt the filesystem on iOS, not the AP's anymore. On the [[S8000]] and [[S8003]] and later, the chip securely generates the UID for the device which is then used to encrypt the whole filesystem.<br />
<br />
Apple says about this key:<br/><br />
''"The UID is unique to each device and is not recorded by Apple or any of its suppliers."''<br/><br />
and also<br/><br />
''"The UID is not related to any other identifier on the device."''<br />
<br />
See also: [[GID Key]].<br />
<br />
===References===<br />
*[https://www.apple.com/br/privacy/docs/iOS_Security_Guide_Oct_2014.pdf iOS Security document by Apple]<br />
<br />
[[Category:Decryption]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=UID_key&diff=61041UID key2017-08-27T00:57:28Z<p>AS967: </p>
<hr />
<div>The '''UID key''' (device's unique ID key) is an AES 256-bit hardware key, unique to each iPhone. It's fused into the application processor during manufacturing. It was previously used to encrypt things in the [[NOR]]. In later iOS versions, it is used to encrypt the entire file system, so that the flash chips cannot moved to another device and read out there again. On the [[S5L8960]] and later, the [[Secure Enclave|SEP]] has it's own UID in it's own AES Engine, and that UID is the one used to encrypt the filesystem on iOS, not the AP's anymore. On the [[S8000]] and [[S8003]] and later, the chip when powered for the first time generates the UID for the device.<br />
<br />
Apple says about this key:<br/><br />
''"The UID is unique to each device and is not recorded by Apple or any of its suppliers."''<br/><br />
and also<br/><br />
''"The UID is not related to any other identifier on the device."''<br />
<br />
See also: [[GID Key]].<br />
<br />
===References===<br />
*[https://www.apple.com/br/privacy/docs/iOS_Security_Guide_Oct_2014.pdf iOS Security document by Apple]<br />
<br />
[[Category:Decryption]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=PurpleSNIFF&diff=59893PurpleSNIFF2017-08-08T01:10:43Z<p>AS967: </p>
<hr />
<div>{{internal software}}<br />
{{Infobox software<br />
| name = PurpleSNIFF<br />
| title = <br />
| logo = [[File:PurpleSNIFF logo.png|300px]]<br />
| caption = PurpleSNIFF 2.0 (76)<br />
| collapsible = <br />
| author = Apple Inc.<br />
| developer = Apple Inc.<br />
| released = <br />
| discontinued = <br />
| latest release version = <br />
| latest release date = <br />
| latest preview version = <br />
| latest preview date = <br />
| programming language = <br />
| operating system = [[wikipedia:OS X|OS X]]<br />
| platform = <br />
| size = 3,969,269 bytes [APP] <small>(76)</small> <br />
| language = [[wikipedia:English language|English]]<br />
| status = <br />
| genre = ?<br />
| license = [[wikipedia:Proprietary software|Closed source]]<br />
| website = <br />
}}<br />
{{float toc|left}}<br />
'''PurpleSNIFF''' is a tool made by Apple to read identification and diagnostic information from the device. The tool is used by Apple engineers as well as factory workers at Foxconn/Pegatron. It's included in the [[RestoreTools]] package.<br />
<br />
Like [[iTunes]], [[PurpleSNIFF]] communicates with iDevices using a [[usbmux]] connection.<br />
<br />
==Device Information==<br />
PurpleSNIFF displays the value of all keys accessible by liblockdown and mobilegestaltd. <br />
Data is broken into categories:<br />
* '''SNIFF''': Report date and host machine configuration<br />
* '''Battery''': Battery charge state <br />
* '''Debug''': Lockdown and CLTM (thermal) extended logging. <br />
* '''Developer''': "Development" if has installed XCode developer diskimage.<br />
* '''Device Mode''': "OS Mode", "Recovery", "DFU", and possibly other internal modes.<br />
* '''Diagnostic Data''': Includes device test data from different factory stations, including their timestamps. There are over 300 testing stations devices can be tested on. Each device will usually pass through about 6 testing stations before shipping. The diagnostic platform is called iPCB.<br />
* '''Disk Usage''': Stats for both System and Data partitions<br />
* '''General''': Activation info, baseband identifiers and state, current carrier bundle, device certificate, public key, name, device color, ECID, MAC addresses, UDID, Serial Number, Hardware Model, [[Fusing Status]], platform, architecture, IMEI/IMSI/ICCID, NVRAM data, OS Build/Version, passcode lock-state, proximity sensor calibration, region code, [[Security Fusings|Security Fusing]] (secure or insecure), Production Mode (Production or Development), SIM card status, presence of Springboard/lockdown, and many more.<br />
* '''Internal''': isInternal and isCarrierBuild, isUIBuild, raw hex dump of SysCfg and DIAGS blocks. <br />
* '''Localization''': Language<br />
* '''Mobile iTunes''': Fairplay related parameters (e.g. certificate)<br />
* '''Restore From Backup''': If it has been restored from a backup<br />
* '''Setup Assistant''': YES/NO listing of which screens have been presented.<br />
* '''Software Behavior''': A bitmask that is decoded into the following boolean properties: China Brick, Google Mail, No VOIP, No Wi Fi, NTSC, Shutter Click, Valid, and Volume Limit.<br />
* '''Sync''': Device support for clearing data and encrypted backups, as well as mail accounts connected.<br />
* '''Sync Backup''': iCloud sync information.<br />
* '''SysCfg''': Device hardware information such as sensor calibration data, device color, NAND size, and serial numbers. This block is read-write for AppleInternal tool that must run on the device, so that Apple can refurbish devices and give them a new serial number. <br />
* '''Wireless''': Bonjour service name, Wifi support, Wifi-sync support.<br />
<br />
<br />
[[File:PurpleSniffSS.png|350px|thumb|right| General Section of PurpleSNIFF with sensitive identifiers redacted.]]<br />
<br />
==White List==<br />
"Request White List Authorization" composes a new email to whitelist-request@group.apple.com. This email address is only reachable if you have an @apple.com email account. The address does not accept outside (external) senders. This feature allows a factory worker or Apple engineer to request that the device be SIM-unlocked for use on certain carriers. <br />
<br />
TO: whitelist-request@group.apple.com<br />
SUBJECT: White-list Request<br />
<br />
Please whitelist the following device<br />
<br />
device: n41ap-prodfuse<br />
imei: 00...[redacted]...0<br />
<br />
carriers:<br />
justification:<br />
<br />
==Auth List==<br />
"Request Personalized Install Authorization" composes a new email to authlist-request@group.apple.com. As with White List, this email address is only reachable if you have an @apple.com email account. This feature allows a factory worker or Apple engineer to request special firmware personalization for their device. This is useful because Apple could order prototypes of unreleased iPhones but refuse to sign any firmware for them. This way, if the devices are lost/leaked into the wild for some reason, the device is [[bricked]]. When prototype phones arrive safely/securely to Cupertino, engineers can have them activated for firmware personalization through this mechanism. It is not known the requests are to permit firmware signing on the public or internal (VPN-only) TSS server. <br />
<br />
TO: authlist-request@group.apple.com<br />
SUBJECT: Authorization List Request<br />
<br />
Please authorize the following device<br />
<br />
device: n41ap-prodfuse<br />
ecid: 0[redacted]0<br />
bbsn: 0x0[redacted]0<br />
<br />
audience:<br />
restore tool:<br />
justification:<br />
<br />
==Extras==<br />
The other main tabs of the application reveal the live Syslog and the IORegistry hierarchy. <br />
Menu options include commands to enable extra logging, reboot devices (with optional prompt), obliterate and reset them, read diagnostic data from GasGauge, WIFI, and NAND, query MobileGestalt directly, enter and exit recovery, and "Lookup Device" in PDCA. It can also pull logs off of the device, as well as content in var/mobile/library . The log archive can be huge because it includes data like the SMS database and all MMS attachments). <br />
<br />
PurpleSNIFF also tracks location, maybe for some sort of monitoring where and how the tool is used. Be careful with this, it may land you in trouble.<br />
<br />
[[Category:Software]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Talk:Security_Fusings&diff=59812Talk:Security Fusings2017-08-02T02:55:36Z<p>AS967: </p>
<hr />
<div>Is it possible to change Security Fusing from Secure to Insecure? [[User:AS967|AS967]] ([[User talk:AS967|talk]]) 02:55, 2 August 2017 (UTC)</div>AS967https://www.theiphonewiki.com/w/index.php?title=Talk:Security_Fusings&diff=59779Talk:Security Fusings2017-07-29T16:15:05Z<p>AS967: Created page with "Is it possible to change Security Fusing from Secure to Insecure?"</p>
<hr />
<div>Is it possible to change Security Fusing from Secure to Insecure?</div>AS967https://www.theiphonewiki.com/w/index.php?title=PurpleSNIFF&diff=59776PurpleSNIFF2017-07-29T11:11:41Z<p>AS967: </p>
<hr />
<div>{{internal software}}<br />
{{Infobox software<br />
| name = PurpleSNIFF<br />
| title = <br />
| logo = [[File:PurpleSNIFF logo.png|300px]]<br />
| caption = PurpleSNIFF 2.0 (76)<br />
| collapsible = <br />
| author = Apple Inc.<br />
| developer = Apple Inc.<br />
| released = <br />
| discontinued = <br />
| latest release version = <br />
| latest release date = <br />
| latest preview version = <br />
| latest preview date = <br />
| programming language = <br />
| operating system = [[wikipedia:OS X|OS X]]<br />
| platform = <br />
| size = 3,969,269 bytes [APP] <small>(76)</small> <br />
| language = [[wikipedia:English language|English]]<br />
| status = <br />
| genre = ?<br />
| license = [[wikipedia:Proprietary software|Closed source]]<br />
| website = <br />
}}<br />
{{float toc|left}}<br />
'''PurpleSNIFF''' is a tool made by Apple to read identification and diagnostic information from the device. The tool is used by Apple engineers as well as factory workers at Foxconn/Pegatron. It's included in the [[RestoreTools]] package.<br />
<br />
Like [[iTunes]], [[PurpleSNIFF]] communicates with iDevices using a [[usbmux]] connection.<br />
<br />
==Device Information==<br />
PurpleSNIFF displays the value of all keys accessible by liblockdown and mobilegestaltd. <br />
Data is broken into categories:<br />
* '''SNIFF''': Report date and host machine configuration<br />
* '''Battery''': Battery charge state <br />
* '''Debug''': Lockdown and CLTM (thermal) extended logging. <br />
* '''Developer''': "Development" if has installed XCode developer diskimage.<br />
* '''Device Mode''': "OS Mode", "Recovery", "DFU", and possibly other internal modes.<br />
* '''Diagnostic Data''': Includes device test data from different factory stations, including their timestamps. There are over 300 testing stations devices can be tested on. Each device will usually pass through about 6 testing stations before shipping. The diagnostic platform is called iPCB.<br />
* '''Disk Usage''': Stats for both System and Data partitions<br />
* '''General''': Activation info, baseband identifiers and state, current carrier bundle, device certificate, public key, name, device color, ECID, MAC addresses, UDID, Serial Number, Hardware Model, [[Fusing Status]], platform, architecture, IMEI/IMSI/ICCID, NVRAM data, OS Build/Version, passcode lock-state, proximity sensor calibration, region code, [[Security Fusing]] (secure or insecure), Production Mode (Production or Development), SIM card status, presence of Springboard/lockdown, and many more.<br />
* '''Internal''': isInternal and isCarrierBuild, isUIBuild, raw hex dump of SysCfg and DIAGS blocks. <br />
* '''Localization''': Language<br />
* '''Mobile iTunes''': Fairplay related parameters (e.g. certificate)<br />
* '''Restore From Backup''': If it has been restored from a backup<br />
* '''Setup Assistant''': YES/NO listing of which screens have been presented.<br />
* '''Software Behavior''': A bitmask that is decoded into the following boolean properties: China Brick, Google Mail, No VOIP, No Wi Fi, NTSC, Shutter Click, Valid, and Volume Limit.<br />
* '''Sync''': Device support for clearing data and encrypted backups, as well as mail accounts connected.<br />
* '''Sync Backup''': iCloud sync information.<br />
* '''SysCfg''': Device hardware information such as sensor calibration data, device color, NAND size, and serial numbers. This block is read-write for AppleInternal tool that must run on the device, so that Apple can refurbish devices and give them a new serial number. <br />
* '''Wireless''': Bonjour service name, Wifi support, Wifi-sync support.<br />
<br />
<br />
[[File:PurpleSniffSS.png|350px|thumb|right| General Section of PurpleSNIFF with sensitive identifiers redacted.]]<br />
<br />
==White List==<br />
"Request White List Authorization" composes a new email to whitelist-request@group.apple.com. This email address is only reachable if you have an @apple.com email account. The address does not accept outside (external) senders. This feature allows a factory worker or Apple engineer to request that the device be SIM-unlocked for use on certain carriers. <br />
<br />
TO: whitelist-request@group.apple.com<br />
SUBJECT: White-list Request<br />
<br />
Please whitelist the following device<br />
<br />
device: n41ap-prodfuse<br />
imei: 00...[redacted]...0<br />
<br />
carriers:<br />
justification:<br />
<br />
==Auth List==<br />
"Request Personalized Install Authorization" composes a new email to authlist-request@group.apple.com. As with White List, this email address is only reachable if you have an @apple.com email account. This feature allows a factory worker or Apple engineer to request special firmware personalization for their device. This is useful because Apple could order prototypes of unreleased iPhones but refuse to sign any firmware for them. This way, if the devices are lost/leaked into the wild for some reason, the device is [[bricked]]. When prototype phones arrive safely/securely to Cupertino, engineers can have them activated for firmware personalization through this mechanism. It is not known the requests are to permit firmware signing on the public or internal (VPN-only) TSS server. <br />
<br />
TO: authlist-request@group.apple.com<br />
SUBJECT: Authorization List Request<br />
<br />
Please authorize the following device<br />
<br />
device: n41ap-prodfuse<br />
ecid: 0[redacted]0<br />
bbsn: 0x0[redacted]0<br />
<br />
audience:<br />
restore tool:<br />
justification:<br />
<br />
==Extras==<br />
The other main tabs of the application reveal the live Syslog and the IORegistry hierarchy. <br />
Menu options include commands to enable extra logging, reboot devices (with optional prompt), obliterate and reset them, read diagnostic data from GasGauge, WIFI, and NAND, query MobileGestalt directly, enter and exit recovery, and "Lookup Device" in PDCA. It can also pull logs off of the device, as well as content in var/mobile/library . The log archive can be huge because it includes data like the SMS database and all MMS attachments). <br />
<br />
PurpleSNIFF also tracks location, maybe for some sort of monitoring where and how the tool is used. Be careful with this, it may land you in trouble.<br />
<br />
[[Category:Software]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Diags_(iBoot_command)&diff=58009Diags (iBoot command)2017-07-12T20:15:31Z<p>AS967: </p>
<hr />
<div>The <code>diags</code> command is an iBoot command that loads an image from an address in memory after disabling all the GPIO devices. This is meant for diagnostic purposes, so even unsigned images will be loaded. This command had no permission checks in 1.0-1.1.4 iBoots, so it was exploitable to load a patched iBoot, but in 2.0 iBoots, this command has a permission check to make sure it is not being run on a RELEASE fused CHIPID. In 3.1+, this command was removed entirely, but is still present in DEVELOPMENT iBoots. This command can also be set as the boot-command variable. In that case, as well as if you run diags without any args, it looks for the diags image in NOR/NAND, and also checks the diags-path value in NVRAM. If it doesn't find it, the command will fail.<br />
<br />
==Credit==<br />
[[iPhone Dev Team]]<br />
<br />
==Exploit==<br />
This is a very easy-to-use exploit on 1.x iBoots. In earlier iBoots, if a parameter was given to the 'diags' command, then it would jump to whatever address argv[1] specified, but not before disabling the GPIO devices. You can run unsigned code on the [[S5L8900]] using this, but the GPIOs need to be restored if you intend to use any I/O again (such as the screen, serial, or USB). <br />
<br />
In 2.0 iBoots, they have a flag check on this command (checks bit 4 of the iBoot flags), and that flag will not be present on a RELEASE fused CHIPID, just a whitelisted engineering CHIPID, so this exploit doesn't work on RELEASE fused devices after 2.0. However, the 1.1.4 [[iBSS]] can still be used on the [[M68AP|iPhone]], [[N82AP|iPhone 3G]], or [[N45AP|iPod touch]], and can be used to boot a modified 2.0+ [[iBoot (Bootloader)|iBoot]]. Therefore, it is still an open exploit for these devices.<br />
<br />
[[Category:Exploits]] [[Category:iBoot commands]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=ECID&diff=58008ECID2017-07-12T17:32:08Z<p>AS967: </p>
<hr />
<div>The '''ECID''' (possibly standing for '''E'''xclusive '''C'''hip '''ID''' or '''E'''lectronic '''C'''hip '''ID''') is an identifier unique to every unit.<br />
<br />
It is 64 bits wide, with the first ~20 bits usually set to zero (looks like <tt>00000XXXXXXXXXXX</tt> in hex).<br />
<br />
It holds a key position in the [[SHSH Protocol]], being one of 2 elements that limit each [[APTicket]] to a single specific device.<br />
<br />
'''Note''': Some tools show it in decimal format while others do it in hexadecimal.<br />
<br />
== Getting the ECID ==<br />
<br />
===Via iTunes===<br />
<br />
* Connect your iDevice to your computer.<br />
* Open iTunes.<br />
* Navigate to the "Summary" tab for your device.<br />
* At the top of the panel, click twice on the line that says "Serial Number".<br />
* Your ECID is displayed in '''hexadecimal'''.<br />
<br />
===Via third-party software===<br />
<br />
====On-device====<br />
<br />
The [http://cydia.saurik.com/package/com.malcolmhall.udidcalculator/ UDID Calculator] application from Cydia displays (among other things) the ECID of your device (shown in '''decimal''').<br />
<br />
====Via USB====<br />
<br />
* Install [https://github.com/libimobiledevice/libimobiledevice libimobiledevice].<br />
* Connect your device over USB.<br />
* Run <code>ideviceinfo | grep UniqueChipID</code> command.<br />
* There should be exactly one line, reading <code>UniqueChipID</code> followed by your ECID (in '''decimal''').<br />
* Alternatively you can run <code>ideviceinfo -k UniqueChipID</code> which fetches the UniqueChipID key directly (which is also faster).<br />
<br />
===Via [[Recovery Mode]] or [[DFU Mode]]===<br />
<br />
====Mac Instructions====<br />
<br />
*Put your device in [[Recovery Mode]] or [[DFU Mode]].<br />
*Open System Profiler. (in /Applications/Utilities/).<br />
*In the sidebar, go to "USB" (in the "Hardware" section).<br />
*Under "Serial Number", there should be a part called "ECID". There you go.<br />
<br />
====Windows Instructions====<br />
<br />
* Put your device in [[Recovery Mode]] or [[DFU Mode]].<br />
* Open Device Manager and right click on Apple Mobile Device (Recovery or DFU Mode) for properties.<br />
* Click on the details tab.<br />
* Click on the dropdown box and select Device Instance Path.<br />
* You should find it in the textbox.<br />
<br />
===Extracting from an SHSH===<br />
<br />
====Img3====<br />
<br />
There are 19 blobs in an SHSH, and the first line of every blob is the same as below:<br />
<br />
<code>RElDRUAAAAAIAAAA********AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</code><br />
<br />
The * part is the ECID(Dec) encrypted by a certain formula which is <br />
<br />
a.Transform ECID(Dec) into ECID(Hex) such as 58608372174291 ---> 35 4D D3 34 4D D3<br />
<br />
b.Reverse the ECID(Hex) string such as 35 4D D3 34 4D D3 ---> D3 4D 34 D3 4D 35<br />
<br />
c.Transform the string we have got into binary such as D3 4D 34 D3 4D 35 ---> ÓM4ÓM5<br />
<br />
d.Encode the binary with base64 such as ÓM4ÓM5 ---> 00000001<br />
<br />
Use this formula backward (d. to a.) we can extract the * part into ECID(Dec).<br />
<br />
====Img4====<br />
<br />
First, get your apticket.der. There are two options:<br />
* Copy it from your device in <code>/System/Library/Caches/apticket.der</code>.<br />
* Extract it from an SHSH file, e.g. using <code>plutil -extract ApImg4Ticket xml1 -o - *.shsh | xmllint -xpath '/plist/data/text()' - | base64 -D > apticket.der;</code>.<br />
<br />
Now you can use any old ASN.1 parser to display the file, such as <code>openssl asn1parse -i -inform DER -in apticket.der</code>.<br />
To get only the ECID part, use <code>openssl asn1parse -inform DER -in apticket.der | grep -A1 ECID</code>. It should show on the second line after the colon (in '''hexadecimal''', possibly with a leading zero).<br />
<br />
===Developer Instructions===<br />
<br />
On OSX, call <code>AMDeviceCopyValue</code> in the [[MobileDevice Library|MobileDevice Framework]] with "UniqueChipID". It returns the ECID as a <code>CFNumberRef(kCFNumberSInt64Type)</code> object.<br />
<br />
Example implementation (all safeties removed, will probably crash if connection fails), compile with <code>clang -F/System/Library/PrivateFrameworks -framework MobileDevice -framework CoreFoundation</code>:<br />
<br />
<pre><br />
// Please ping @s1guza on Twitter if this file stops compiling/working<br />
#include <stdint.h><br />
#include <stdio.h><br />
#include <stdlib.h><br />
#include <CoreFoundation/CoreFoundation.h><br />
<br />
// Cheap aliases to make things compile without headers<br />
typedef void am_device;<br />
typedef void am_device_notification;<br />
typedef void* am_device_notification_callback_info;<br />
extern void AMDeviceNotificationSubscribe(void(*callback)(am_device_notification_callback_info *info, void *arg), int unused1, int unused2, void *unknown, am_device_notification** notification);<br />
extern void AMDeviceConnect(am_device *device);<br />
extern void AMDeviceStartSession(am_device *device);<br />
extern void* AMDeviceCopyValue(am_device *device, int unknown, CFStringRef value);<br />
<br />
void cb(am_device_notification_callback_info *info, void *arg)<br />
{<br />
uint64_t ecid;<br />
am_device *dev = *info; /* info->dev */<br />
CFRetain(dev);<br />
AMDeviceConnect(dev);<br />
AMDeviceStartSession(dev);<br />
<br />
CFNumberRef ecidRef = AMDeviceCopyValue(dev, 0, CFSTR("UniqueChipID"));<br />
CFNumberGetValue(ecidRef, kCFNumberSInt64Type, &ecid);<br />
printf("ECID: %llX\n", ecid);<br />
<br />
CFRelease(dev);<br />
exit(0);<br />
}<br />
<br />
int main()<br />
{<br />
uint32_t buf[5];<br />
am_device_notification *notification = (am_device_notification*)buf;<br />
AMDeviceNotificationSubscribe(&cb, 0, 0, NULL, &notification);<br />
CFRunLoopRun();<br />
return 0;<br />
}<br />
</pre></div>AS967https://www.theiphonewiki.com/w/index.php?title=S5L_File_Formats&diff=58007S5L File Formats2017-07-12T17:01:54Z<p>AS967: </p>
<hr />
<div>== IMG2 ==<br />
This was the file format used prior to iPhone OS 2.0. For iPhone OS 1.1.x, IMG2 files were encrypted with [[AES Keys|Key 0x837]]. IMG2 files can only be parsed by an [[iBoot]] in firmwares prior to iPhone OS 2.0 beta 3, or the [[S5L8900]] [[VROM]]. The [[S5L8720]] and newer [[bootrom]]s have no support for it.<br />
<br />
== 8900 ==<br />
This is the file format used by the [[S5L8900]]. Usually this wraps around an [[#IMG2|IMG2]] file. It can only be parsed by an iBoot in a firmware version less than 2.0 beta 3, or the [[S5L8900]] [[VROM]]. The [[S5L8720]] and newer have no support for it.<br />
=== Header ===<br />
typedef struct {<br />
uint8 magic[4]; // string "8900"<br />
uint8 version[3]; // string "1.0"<br />
uint8 format; // plaintext format is 0x4, encrypted with [[AES Keys#Key 0x837|Key 0x837]] format is 0x3,<br />
// boot plaintext is 0x2, boot encrypted with [[UID-key]] is 0x1.<br />
uint32 unknown1;<br />
uint32 sizeOfData; // size of data (i.e: file size - header(0x800) - footerSig(0x80) - footerCert(0xC0A))<br />
uint32 footerSignatureOffset; // offset to footer signature (relative to end of header)<br />
uint32 footerCertOffset; // offset to footer certificate, (relative to end of header)<br />
uint32 footerCertLen;<br />
uint8 salt[0x20]; // a seemingly random salt for the signature<br />
uint16 unknown2;<br />
uint16 epoch; // the security epoch of the file<br />
uint8 headerSignature[0x10]; // encrypt(sha1(header[0:0x40])[0:0x10], key_0x837, zero_iv)<br />
uint8 padding[0x7B0]; // pad to 0x800 (i.e: 2 KiB)<br />
} Apple8900Header;<br />
<br />
== [[IMG3 File Format|IMG3]] ==<br />
This is the replacement for the [[#IMG2|IMG2 file format]] in iPhone OS 2.0. The [[S5L8720]] (and newer) bootroms can understand this by default, but [[WTF#Version 2|WTF 2.0]] must be uploaded to the [[DFU Mode]] of an [[S5L8900]] that has code in it to parse IMG3 files, or the [[S5L8900]] will not be able to understand them.<br />
=== Header ===<br />
typedef struct {<br />
uint8 magic[4]; // string "IMG3"<br />
uint32 fullSize; // full size of fw image<br />
uint32 sizeNoPack; // size of fw image without header<br />
uint32 sigCheckArea; // although that is just my name for it, this is the<br />
// size of the start of the data section (the code)<br />
// up to the start of the RSA signature (SHSH section)<br />
uint32 iden; // identifier of image, used when bootrom is parsing images<br />
// list to find LLB (illb), LLB parsing it to find<br />
// iBoot (ibot), etc.<br />
<br />
} AppleImg3Header;<br />
=== Tag Header ===<br />
typedef struct {<br />
uint8 magic[4]; // one of the tags [[#Tags|below]] (stored in little-endian order)<br />
uint32 totalLength; // (dataLength + sizeof(AppleImg3TagHeader))<br />
uint32 dataLength; // <br />
} AppleImg3TagHeader<br />
=== Tags ===<br />
[[VERS]]: Version<br />
[[SDOM]]: Security Domain<br />
[[PROD]]: Production Mode, intended to determine if the image is for a dev or production fused device. Like CHIP, whatever verifies this has the intended value hardcoded. If the device is development fused, the check is skipped.<br />
[[CHIP]]: Chip to be used with. "0x8900" for [[S5L8900]] and "0x8720" for [[N72AP|S5L8720]].<br />
Instead of there being a check against some piece of hardware,<br />
whatever is verifying this (bootrom / iBoot / LLB / etc.) has this hardcoded in.<br />
[[BORD]]: Board to be used with<br />
[[KBAG]]: contains the KEY and IV required to decrypt encrypted with the [[GID Key]]<br />
[[SHSH]]: RSA encrypted SHA1 hash of the file<br />
[[CERT]]: Certificate<br />
[[ECID]]: Exclusive Chip ID<br />
[[TYPE]]: Type of IMG3 (like 0x6C6F676F for logo)<br />
[[DATA]]: actual content<br />
[[SEPO]]: Security Epoch<br />
<br />
=== Encryption ===<br />
Apple got smarter this time, requiring the hardware AES engine to be run per file. Decrypt the [[KBAG]] tag data (0x20 bytes?) with the hardware AES engine and get the 0x10 byte [[wikipedia:Initialization vector|IV]] and the 0x10 byte KEY.<br />
<br />
[[iBoot]] has support for AES-192 and AES-256 also, but the former remains unused. In the current method, iBoot will always use the first 16 bytes as the IV, then the remaining 16 (AES-128), 24 (AES-192, unused), or 32 (AES-256) bytes for the key.<br />
<br />
== Resources ==<br />
* [http://www.jbfaq.com/article.asp?id=70 cmw's IMG3 Unpacker]<br />
* [http://wikee.iphwn.org/s5l8900:8900_format The iPhone Dev Team on 8900]<br />
<br />
[[Category:File Formats]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=DFU_Mode&diff=56003DFU Mode2017-03-11T21:38:25Z<p>AS967: </p>
<hr />
<div>'''DFU''' or '''Device Firmware Upgrade''' mode allows all devices to be restored from any state. It is essentially a mode where the BootROM can accept iBSS. DFU is burned into the hardware, so it cannot be removed. On A7+ devices, it generates an ApNonce and recognizes APTickets as well, so even in DFU, it can accept an APTicket.<br />
<br />
==DFU Mode==<br />
===Entering DFU Mode on iPhone, iPad or iPod touch===<br />
# Plug your device into your computer with a USB cable.<br />
# Turn off the device.<br />
# Hold the Power button for 3 seconds.<br />
# Hold the Home and Power buttons for 10 seconds.<br />
# Release the Power button but keep holding the Home button.<br />
# After about 15 seconds you will be alerted by iTunes saying that it has detected a device in Recovery Mode.<br />
<br />
'''Make sure the device screen is blank and no logos are present'''<br />
<br />
===Exiting DFU Mode on iPhone, iPad or iPod touch===<br />
# Hold the Home and Power buttons until the Apple Logo appears.<br />
<br />
===Entering DFU Mode on Apple TV===<br />
# Plug the device into your computer using a microUSB cable.<br />
# Force the device to reboot by holding down the "Menu" and "Down" buttons simultaneously for 6-7 seconds.<br />
# Press "Menu" and "Play" simultaneously right after reboot, until a message pops up in [[iTunes]], saying that it has detected an Apple TV in Recovery Mode.<br />
<br />
===Exiting DFU Mode on Apple TV===<br />
# Hold down the "Menu" and "Down" buttons. The Apple TV will reboot.<br />
<br />
==Enter True Hardware DFU Mode Automatically==<br />
The EnterDFU function in the [[MobileDevice Library]] does not enter the true DFU Mode in the hardware. It's possible to enter the true DFU Mode without doing it manually, but it cannot be exited unless a restore is performed, as it creates a [[DFU Loop]]. This doesn't work with [[S5L8900]] devices.<br />
<br />
===Steps===<br />
# Make a copy of a fresh IPSW file.<br />
# Open the IPSW as a zip folder and browse to /firmware/all_flash/all_flash.xxxxx.production/<br />
# Extract LLB.*****.RELEASE.img3/im4p and open it in a hex editor.<br />
# Change some random bit or bits, it doesn't matter which or what you write.<br />
# Add the edited file back to the zip, rename zip to ipsw and restore it to your device using iTunes.<br />
# The restore will error out and your device will be in DFU Mode.<br />
<br />
===Alternative Method===<br />
If the previous method does not work for you, try this one.<br />
# Do steps 1 and 2 from above.<br />
# Delete LLB.*****.RELEASE.img3.<br />
# Copy applelogo.********.img3 to temporary directory.<br />
# Rename the copy of applelogo.********.img3/im4p to LLB.*****.RELEASE.img3/im4p. (If you forget the name of the LLB file, you can find it again in the file named manifest.)<br />
# Copy the renamed applelogo file back to the all_flash.xxxxx.production directory.<br />
# Rename the zip.<br />
# Restore the file using iTunes. (If every thing goes well, you should receive an error 31 from iTunes.)<br />
<br />
==DFU Mode Output to the computer==<br />
<pre>iProduct: "Apple Mobile Device (DFU Mode)"</pre> <pre>iSerialNumber: "CPID:XXXX CPRV:15 CPFM:03 SCEP:03 BDID:00 ECID:XXXXXXXXXXXXXXXX SRTG:[iBoot-XXX.X.X]"</pre><br />
<br />
==Revisions==<br />
===[[S5L8900]] (0x1222)===<br />
This is the device ID in the [[N45AP|iPod touch]], the [[M68AP|iPhone]], and the [[N82AP|iPhone 3G]]. For more information about the protocol, see [[DFU 0x1222]].<br />
<br />
===[[S5L8720 Bootrom|S5L8720]], [[S5L8920]], and [[WTF|WTF mode post-2.0]] (0x1227)===<br />
This is the device ID in the [[N72AP|iPod touch 2G]], the [[N88AP|iPhone 3GS]], the [[N90AP|iPhone 4]], subsequent 32 bit devices, all 64 bit devices, and [[WTF|WTF mode]]. For more information on the protocol, see [[DFU 0x1227]].<br />
<br />
[[Category:Bootrom]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Bootrom_1458.2&diff=55724Bootrom 1458.22017-02-15T20:55:01Z<p>AS967: </p>
<hr />
<div>This is the bootrom version found in the [[J33IAP|Apple TV 3 (AppleTV3,2)]]. It has no known exploits. Compiled after 5.1.1, but before 6.0 and after the iPad 4th gen bootrom. It is strange that APTicket isn't enforced by the device (Enforced by LLB/iBSS, not bootrom) considering it was based on an iBoot that supports APTicket (any iBoot after iBoot-1219)<br />
[[Category:Bootrom]]<br />
{{stub}}</div>AS967https://www.theiphonewiki.com/w/index.php?title=Bootrom_1458.2&diff=55723Bootrom 1458.22017-02-15T20:51:34Z<p>AS967: </p>
<hr />
<div>This is the bootrom version found in the [[J33IAP|Apple TV 3 (AppleTV3,2)]]. It has no known exploits. Compiled after 4.x and after the iPad 4th gen bootrom.<br />
[[Category:Bootrom]]<br />
{{stub}}</div>AS967https://www.theiphonewiki.com/w/index.php?title=Talk:S5L_File_Formats&diff=55673Talk:S5L File Formats2017-02-06T20:26:23Z<p>AS967: /* Shouldn't IMG4 be added to this page? */ new section</p>
<hr />
<div>== Shouldn't IMG4 be added to this page? ==<br />
<br />
We know a lot more about IMG4 than we did during the 5S 7.x days, so isn't it only viable to put what we know about IMG4 in this page?</div>AS967https://www.theiphonewiki.com/w/index.php?title=IMG4_File_Format&diff=55622IMG4 File Format2017-02-02T21:19:04Z<p>AS967: </p>
<hr />
<div>The '''IMG4 file format''' is a replacement for the [[IMG3 File Format|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer) and the [[List of Apple Watches| Apple Watch series]]. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#Payload|'''im4p''' files]]), signatures of those files (<code>ApImg4Ticket</code>) and likely some info used in the [[Restore_Process|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is [[/usr/standalone/firmware/sep-firmware.img4]]. Extracting a PersonalizedBundle from /tmp during a restore will also yield complete IMG4 files. The embeddedOS images in the macOS filesystem for the 2016 MacBook Pros also have complete IMG4 files.<br />
<br />
== Structure ==<br />
Contrary to the [[IMG3 File Format|IMG3 file format]] where a custom binary format was used, IMG4 files (and their payloads) are [[wikipedia:X.690#DER encoding|DER]] encoded [[wikipedia:Abstract Syntax Notation One|ASN.1]] objects. The reason for Apple's choice of ASN.1/DER encoding over their own [[PList File Format|Property List]] (PList) file format is currently unknown.<br />
<br />
<pre><br />
sequence [<br />
0: string "IMG4"<br />
1: payload - IMG4 Payload, IM4P<br />
2: [0] (constructed) [<br />
manifest - IMG4 Manifest, IM4M<br />
]<br />
]<br />
</pre><br />
<br />
==IMG4 Payload==<br />
Payload contains the actual content of the file. IMG4 format allows to store payload in a separate file with '''im4p''' extension. '''im4p''' files are used more often than complete IMG4 files. Payload is structured as follows:<br />
<pre><br />
sequence [<br />
0: string "IM4P"<br />
1: string type - ibot, rdsk, sepi, ...<br />
2: string description - 'iBoot-1940.1.75'<br />
3: octetstring - the encrypted/raw data<br />
4: octetstring - containing DER encoded KBAG values (optional)<br />
sequence [<br />
sequence [<br />
0: int: 01<br />
1: octetstring: iv<br />
2: octetstring: key<br />
]<br />
sequence [<br />
0: int: 02<br />
1: octetstring: iv<br />
2: octetstring: key<br />
]<br />
]<br />
]<br />
</pre><br />
<br />
==IMG4 Manifest==<br />
A.k.a. IM4M. Contains signature for one or multiple IMG4 payloads. Manifests are designed in a way that they can be stored separately from an IMG4 file or be a part of one. An example of an IMG4 manifest is ApImg4Ticket. Each IMG4 manifest is made of tags structured as follows (content = DER encoded object):<br />
<pre><br />
[type] (private) [ - DER tag's class is the type of the tag (4 bytes) encoded as a big-endian integer<br />
sequence [<br />
string type - type of the tag, 4 bytes<br />
content - content of the tag<br />
]<br />
]<br />
</pre><br />
Manifest structure (tag <type> = tag of type 'type'):<br />
<pre><br />
sequence [<br />
0: string "IM4M"<br />
1: integer version - currently 0<br />
2: set [<br />
tag MANB [ - manifest body<br />
set [<br />
tag MANP [ - manifest properties<br />
set [<br />
tag <manifest property> [<br />
content<br />
]<br />
... - tags, describing other properties<br />
]<br />
]<br />
tag <type> [ - ibot, illb, sepi, krnl, NvMR, bbcl...<br />
set [<br />
tag <tag property> [<br />
content<br />
]<br />
...<br />
]<br />
]<br />
... - tags for other images<br />
]<br />
]<br />
]<br />
3: octet string signature<br />
4: sequence [ - containing certificate chain (arbitrary number of certificates)<br />
certificates<br />
]<br />
</pre><br />
<br />
<br />
== External Links ==<br />
* [https://twitter.com/i0n1c/status/501299082603020288 i0n1c's tweet]<!-- TODO: Work this into the article --><br />
* [https://www.itu.int/rec/T-REC-X.690/en X.690 - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)]<br />
<br />
[[Category:File Formats]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=ARMv7k&diff=55621ARMv7k2017-02-02T21:09:08Z<p>AS967: </p>
<hr />
<div>'''ARMv7k''' is the processor architecture used inside the [[Apple Watch]]. It started with [[S7002]] (S1). Despite it being based on the ARMv7 32 bit architecture, it uses [[IMG4 File Format|IMG4]] files, instead of IMG3 files.<br />
<br />
{{stub}}</div>AS967https://www.theiphonewiki.com/w/index.php?title=GlyphCharging&diff=55357GlyphCharging2017-01-23T21:25:34Z<p>AS967: </p>
<hr />
<div>'''GlyphCharging''' is located at <code>/Firmware/all_flash/all_flash.(MODEL-NAME).production/(GLYPHCHARGING-IMG3-FILE-NAME).img3</code> in the [[IPSW File Format|IPSW]] and flashed to [[NOR]] (or [[NAND|a functionally equivalent partition]]). It is displayed when the battery is too low for the device to boot up (under 5%)and external power is connected and charging the battery.<br />
<br />
It probably is a PNG picture packed into an [[IMG3 File Format|IMG3]]/[[IMG4 File Format|IMG4]] archive. No (user-friendly) method of replacing this icon is known.</div>AS967https://www.theiphonewiki.com/w/index.php?title=Bootchain&diff=55324Bootchain2017-01-21T21:02:41Z<p>AS967: </p>
<hr />
<div>The '''bootchain''' (or '''secure boot chain''', also called '''chain of trust''') is the system by which Apple tries to ensure that only signed or trusted code is loaded on an iOS device.<br />
<br />
The initial code ([[bootrom]]) is contained within the processor and cannot be changed (due to it being read-only memory). It decrypts the next stage ([[LLB]]) and verifies the integrity before it executes any code of the next stage. This continues for all stages until the execution of the [[kernel]] and applications. The integrity verification uses the keys on the device. To sign such code, you need the corresponding private key that only Apple holds. This way Apple has total control of any code that runs on your device. The idea of jailbreaking is to break this chain somewhere so that you can run any application or customize some firmware changes (unlock for example).<br />
<br />
==Application Processor==<br />
*[[Bootrom]]<br />
*[[LLB]]<br />
*[[iBoot]]<br />
*[[Secure Enclave|SEP]]<br />
*[[Kernel]]<br />
*Applications<br />
<br />
==Baseband==<br />
*[[Baseband_Bootrom|Bootrom]]<br />
*[[Baseband_Bootloader|Bootloader]]<br />
*[[Baseband_Firmware|Firmware]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=Talk:Seputil&diff=55263Talk:Seputil2017-01-16T03:13:40Z<p>AS967: /* What is the SEP ART? */ new section</p>
<hr />
<div>For me all the rom related commands ( --rom status, --rom tz0, --rom nop, --rom nonce ) end up in a short "blue screen" and then the device reboots. Anyone have a different experience ?--[[User:M2m|M2m]] ([[User talk:M2m|talk]]) 01:11, 2 January 2014 (UTC)<br />
<br />
suptil is by the way in H6SURamDisk.dmg (which is in /standalone/update/ramdisk folder on 7.0.4 iPhone5s). You just have to get rid of the 1st 0x1b (27) bytes to make the dmg readable. --[[User:M2m|M2m]] ([[User talk:M2m|talk]]) 09:57, 2 January 2014 (UTC)<br />
<br />
== What is the SEP ART? ==<br />
<br />
I've been wondering, what is the ART in a SEP? Is it yet another nonce type thing, or is it a different security measure?</div>AS967https://www.theiphonewiki.com/w/index.php?title=Nonce&diff=55262Nonce2017-01-16T03:11:47Z<p>AS967: </p>
<hr />
<div>'''Nonce''' is a signing method that randomizes Apple's cryptographic signature hash blobs ([[SHSH]] blobs) and is used with the BBTicket (baseband signing ticket), the APTicket (firmware signing ticket), and SEP ([[Secure Enclave]]). <br />
<br />
==Method==<br />
The device bootloaders (baseband, firmware, and SEP) generate a random number at the restore, then send them to iTunes which sends them to Apple. Then Apple sends the APTicket / BBTicket [[SHSH]] certificate with the number generated. This level is the most critical: the number within the certificate is matched to the number generated on device, and if they match iTunes will prepare the matched certificate and finally will stitch the randomized blobs to the firmware. If the blobs don't match the restore will fail and the bootloaders will reject the certificate.<br />
<br />
==Usage==<br />
===BBTicket===<br />
*No iPod touch (or iPad Wi-Fi) has been signed with the BBTicket, since by definition it has no baseband.<br />
*[[M68AP|iPhone]] (bootloaders can be neutered to cancel this signchecks). [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]] and [[K48AP|iPad Wi-Fi+3G]] - if the baseband is higher or equal (or just higher on bootloader 3.9 on [[M68AP|iPhone]]). Some bootloaders allow downgrade of the baseband if it is still signed.<br />
*[[N90AP|iPhone 4 (iPhone3,1)]], [[N92AP|iPhone 4 (iPhone3,3)]], [[N94AP|iPhone 4S]], and [[K94AP|iPad 2 (iPad2,2)]] and [[K95AP|iPad 2 (iPad2,3)]] - [[AT+XNONCE]] - restores the baseband only if Apple is still signing it. On bootloaders 2.8, 2.13, Trek and Phoenix, both the [[AT+XNONCE]] and the "higher or equal" checks happen.<br />
<br />
===APTicket===<br />
*Devices with the [[S5L8900]] get [[SHSH]] blobs without APTicket on 4.0 - 4.2.1, even though they are not required and can be avoided with [[Pwnage]]+[[Pwnage 2.0]].<br />
*Devices with the [[S5L8720]] get [[SHSH]] blobs without APTicket from 3.1.1 and on, even though [[Bootrom 240.4]] doesn't require them and they can be avoided with the [[0x24000 Segment Overflow]]<br />
*Devices with the [[S5L8920]], [[S5L8922]], [[S5L8930]] and [[S5L8940]] got [[SHSH]] blobs without APTicket between 3.0 - 4.3.5, and they can not be avoided (except for the [[Bootrom 359.3]] with the 0x24000 Segment Overflow)<br />
*Devices with the [[S5L8920]], [[S5L8922]], [[S5L8930]], [[S5L8940]], [[S5L8942]], [[S5L8945]], [[S5L8950]], and [[S5L8955]] get APTicket SHSH blobs on 5.0+. The SHSH requirement can not be avoided (except for the [[Bootrom 359.3]] with 0x24000 Segment Overflow), and the APTicket requirement can only be avoided on devices vulnerable to the [[limera1n Exploit]], or if the device is on iOS 5.1.1 or lower.<br />
*Devices with the [[S5L8960]], [[S5L8965]], [[T7000]], [[T7001]], [[S7002]], [[S8000]], [[S8001]], [[S8003]], and [[T8010]] get APTickets exclusively (with SepNonce, which also needs to match) and they cannot be avoided, but can be utilized with the prometheus method.<br />
==Jailbreak difficulties==<br />
With nonce signatures, signatures can't be cached, because signatures will not match if they have been reused. In other words, the widely used replay attack is no longer possible unless the nonce(s) (SepNonce + ApNonce on 64 bit, ApNonce only on 32 bit) the device generates matches the one on the APTicket.<br />
<br />
==See also==<br />
*[[AT+XNONCE]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=SHSH&diff=55144SHSH2016-12-20T22:20:49Z<p>AS967: </p>
<hr />
<div>As the [[wikipedia:SHSH blob | '''SHSH''' blob article on Wikipedia]] summarizes it: "SHSH blob is a jargon term for a small piece of data that is part of Apple's digital signature protocol for iOS restores and updates, designed to control the iOS versions that users can install on their iOS devices (iPhones, iPads, iPod touches, and Apple TVs), generally only allowing the newest iOS version to be installable. "<br />
<br />
Technically, the SHSH of a firmware image is a 1024-bit (<code>0x80</code> bytes) [[wikipedia:RSA (cryptosystem)|RSA]] signature. This often also refers to backup files with the signature ("SHSH blobs"). This signature is needed to restore a specific iOS version; it is generated by Apple based on hardware keys of the device and the hash of the firmware. Apple only issues signatures for the currently-available iOS version, which disallows installing older iOS versions. But if you have saved signatures for an older iOS version, you may be able to use a [[wikipedia:replay attack|replay attack]] to restore that version. Therefore it is recommended to save the signature for your device as long as Apple issues it.<br />
<br />
With the tools mentioned below it is possible to backup the signature. It is not necessary that the device is jailbroken to do the backup. Usually the SHSH signature file is stored on [[Cydia Server|Saurik's server]]. If it is stored there, then you can see in the top of [[Cydia Application|Cydia]] (on jailbroken devices) for which version a backup exists. This moved to [[TSS Center]] which can be located on the main page and then they are shown at the top of that. <br />
<br />
Users often misunderstand this system and think that the SHSH firmware version they back up depends on the firmware version they have installed on their device. This is the case for [[iFaith]], but not for TinyUmbrella. iFaith dumps the SHSHs from your device's storage (whatever's installed on your device, e.g. 4.3.3), while TinyUmbrella gets SHSHs from Apple's servers (whatever firmwares Apple is currently signing).<br />
<br />
==Using SHSH==<br />
Older devices allow installation of any correctly signed firmware, so no backup of the certificate is necessary. Devices that need Apple signatures are: [[N88AP|iPhone 3GS]] (new Bootrom), [[N90AP|iPhone 4]], [[N18AP|iPod touch 3G]], [[K48AP|iPad]], [[iPad 2]], [[N81AP|iPod touch 4G]], [[K66AP|Apple TV 2G]] and all newer devices. The [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS Old Bootrom]] and [[N72AP|iPod touch 2G]] bootroms do not require these SHSHs; however, newer versions of iOS require them (unless the chain of trust is broken and custom firmwares are installed). To restore to arbitrary versions of iOS 4.0, the SHSH is also needed for the [[N72AP|iPod touch 2G]] and [[N82AP|iPhone 3G]]. not only does [[DFU Mode]] require the [[iBSS]]/[[iBEC]] files to be signed with an SHSH that includes the device's [[ECID]], but the normal boot-chain requires the [[LLB]] to be fully signed with an [[ECID]]+SHSH, so a downgrade [[IPSW File Format|IPSW]] is not possible without a bootrom exploit of normal boot-chain (e.g. [[0x24000 Segment Overflow]]). See also the [http://blog.iphone-dev.org/post/833937433 Dev Team Blog post] about this.<br />
<br />
To restore to iOS 3.x or 4.x, change your hosts file to map any request to an Apple server to point to [[saurik]]'s server instead, if your device's signatures are hosted there. If you have the signature file on your computer, run [[TinyUmbrella]]'s TSS Server on your local machine.<br />
<br />
Since the [[limera1n Exploit]] is fixed in the [[bootrom]] since version [[Bootrom 838.3]] and because iOS since 5.0 includes a [[nonce]] in their SHSH hashes, downgrading newer devices ([[N94AP|iPhone 4S]], [[iPad 2]], [[iPad 3]], [[J33AP|Apple TV 3G]]) to earlier 5.x firmwares is not as simple. To restore to iOS 5.x on older devices, stitch iOS 5.x blobs into custom firmware (using redsn0w for example) and restore with that firmware. To restore to iOS 5.x on newer devices, use redsn0w's restore method. See the [http://www.jailbreakqa.com/questions/32462/frequently-asked-questions#94647 JailbreakQA guide to restoring to iOS 5.x using SHSH blobs] (for all devices that can run iOS 5.x except Apple TV 3G).<br />
<br />
==Timeline==<br />
The original [[M68AP|iPhone]] and [[N45AP|iPod touch]] didn't use SHSH blobs.<br />
<br />
{| class="wikitable"<br />
|-<br />
! Firmware<br />
! For Device(s)<br />
! From<br />
! Until<br />
! Status<br />
|-<br />
| 10.2<br />
| rowspan="4" | [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad Pro (9.7 inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch 6G]]<br />
| {{date|2016|12|12}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 10.1.1 (14B150)<br />
| {{date|2016|11|09}}<br />
| {{date|2016|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.1.1 (14B100)<br />
| {{date|2016|10|31}}<br />
| {{date|2016|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.1<br />
| {{date|2016|10|24}}<br />
| {{date|2016|12|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.3<br />
| [[iPhone 7]], [[iPhone 7 Plus]]<br />
| {{date|2016|10|17}}<br />
| {{date|2016|10|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.2<br />
| rowspan="2" | [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad Pro (9.7 inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch 6G]]<br />
| {{date|2016|09|23}}<br />
| {{date|2016|10|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.1<br />
| {{date|2016|09|13}}<br />
| {{date|2016|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2 | 9.3.5<br />
| [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad Pro (9.7 inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[N102AP|iPod touch 6G]]<br />
| rowspan="2 | {{date|2016|08|25}}<br />
| {{date|2016|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad mini]], [[N94AP|iPhone 4S]], [[iPod touch 5G]]<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 9.3.4<br />
| rowspan="2" | [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad Pro (9.7 inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2016|08|04}}<br />
| {{date|2016|09|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.3<br />
| {{date|2016|07|18}}<br />
| {{date|2016|08|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.2 (13F72)<br />
| [[iPad Pro (9.7 inch)]]<br />
| {{date|2016|06|02}}<br />
| {{date|2016|08|24}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.3.2 (13F69)<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[J128AP|iPad Pro (iPad6,4)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| rowspan="2" | {{date|2016|05|16}}<br />
| {{date|2016|08|24}}<br />
| {{no|Closed}}<br />
|-<br />
| [[J127AP|iPad Pro (iPad6,3)]]<br />
| {{date|2016|05|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.1<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad Pro (9.7 inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2016|03|31}}<br />
| {{date|2016|06|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3 (13E237)<br />
| [[K93AP|iPad 2 (iPad2,1)]], [[K95AP|iPad 2 (iPad2,3)]], [[K93AAP|iPad 2 (iPad2,4)]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch 5G]]<br />
| {{date|2016|03|28}}<br />
| rowspan="2" | {{date|2016|04|22}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3 (13E236)<br />
| [[K94AP|iPad 2 (iPad2,2)]]<br />
| {{date|2016|03|25}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3 (13E234)<br />
| [[iPad Pro (9.7 inch)]]<br />
| rowspan="3" | {{date|2016|03|21}}<br />
| rowspan="2" | {{date|2016|04|18}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.3 (13E233)<br />
| [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad mini 3]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[N102AP|iPod touch 6G]]<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch 5G]]<br />
| {{date|2016|03|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.1 (13D20)<br />
| [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad mini 3]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]]<br />
| {{date|2016|02|18}}<br />
| {{date|2016|04|05}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.1 (13D15)<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2016|01|19}}<br />
| {{date|2016|04|05}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.2<br />
| [[K93AAP|iPad 2 (iPad2,4)]], [[J1AP|iPad 3 (iPad3,1)]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| rowspan="2" | {{date|2015|12|08}}<br />
| {{date|2016|02|05}}<br />
| {{no|Closed}}<br />
|-<br />
| [[K93AP|iPad 2 (iPad2,1)]], [[K94AP|iPad 2 (iPad2,2)]], [[K95AP|iPad 2 (iPad2,3)]], [[J2AP|iPad 3 (iPad3,2)]], [[J2AAP|iPad 3 (iPad3,3)]], [[N94AP|iPhone 4S]]<br />
| {{date|2016|02|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.1 (13B144)<br />
| [[iPad Pro (12.9 inch)]]<br />
| {{date|2015|11|17}}<br />
| rowspan="2" | {{date|2015|12|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.1 (13B143)<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| rowspan="2" | {{date|2015|10|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad Pro]]<br />
| {{date|2015|12|02}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0.2<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2015|09|30}}<br />
| {{date|2015|10|29}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.0.1<br />
| [[iPhone 6s]], [[iPhone 6s Plus]]<br />
| {{date|2015|09|24}}<br />
| rowspan="2" | {{date|2015|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2015|09|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2015|09|16}}<br />
| rowspan="2" | {{date|2015|09|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.4.1<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2015|08|13}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 8.4<br />
| [[N102AP|iPod touch 6G]]<br />
| {{date|2015|07|15}}<br />
| {{date|2015|08|23}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="7" | [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch 5G]]<br />
| {{date|2015|06|30}}<br />
| {{date|2015|08|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.3<br />
| {{date|2015|04|08}}<br />
| {{date|2015|07|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.2<br />
| {{date|2015|03|09}}<br />
| {{date|2015|05|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1.3<br />
| {{date|2015|01|27}}<br />
| {{date|2015|03|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1.2<br />
| {{date|2014|12|09}}<br />
| {{date|2015|02|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1.1<br />
| {{date|2014|11|17}}<br />
| {{date|2014|12|17}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1<br />
| {{date|2014|10|20}}<br />
| {{date|2014|12|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.0.2<br />
| rowspan="3" | [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch 5G]]<br />
| {{date|2014|09|25}}<br />
| {{date|2014|10|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.0.1<br />
| {{date|2014|09|24}}<br />
| {{date|2014|09|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.0<br />
| {{date|2014|09|17}}<br />
| {{date|2014|10|22}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 7.1.2<br />
| [[iPhone 4]]<br />
| rowspan="2" | {{date|2014|06|30}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch 5G]]<br />
| {{date|2014|09|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.1.1<br />
| rowspan="3" | [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch 5G]]<br />
| {{date|2014|04|22}}<br />
| {{date|2014|08|12}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.1<br />
| {{date|2014|03|10}}<br />
| {{date|2014|04|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.6<br />
| {{date|2014|02|21}}<br />
| {{date|2014|03|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.5<br />
| [[N49AP|iPhone 5c (iPhone5,4)]], [[N53AP|iPhone 5s (iPhone6,2)]]<br />
| {{date|2014|01|29}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.4<br />
| rowspan="2" | [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch 5G]]<br />
| {{date|2013|11|14}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.3<br />
| {{date|2013|10|22}}<br />
| {{date|2013|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 7.0.2<br />
| [[P105AP|iPad mini (iPad2,5)]]<br />
| rowspan="2" | {{date|2013|09|26}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[P106AP|iPad mini (iPad2,6)]], [[P107AP|iPad mini (iPad2,7)]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch 5G]]<br />
| {{date|2013|10|29}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.1<br />
| [[iPhone 5c]], [[iPhone 5s]]<br />
| {{date|2013|09|18}}<br />
| {{date|2013|10|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad mini]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPod touch 5G]]<br />
| {{date|2013|09|18}}<br />
| {{date|2013|10|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.6<br />
| [[N88AP|iPhone 3GS]], [[N88AP|iPod touch 4G]]<br />
| {{date|2013|11|24}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 6.1.5<br />
| [[N81AP|iPod touch 4G]]<br />
| {{date|2013|09|24}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.4<br />
| [[iPhone 5]]<br />
| {{date|2013|05|02}}<br />
| {{date|2013|09|20}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="5" | 6.1.3<br />
| [[N88AP|iPhone 3GS]]<br />
| rowspan="5" | {{date|2013|03|19}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N81AP|iPod touch 4G]]<br />
| {{date|2013|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPhone 5]]<br />
| {{date|2013|05|02}}<br />
| {{no|Closed}}<br />
|-<br />
| [[P106AP|iPad mini (iPad2,6)]]<br />
| {{date|2013|09|25}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[P105AP|iPad mini (iPad2,5)]], [[P107AP|iPad mini (iPad2,7)]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPod touch 5G]]<br />
| {{date|2013|09|20}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.1.2<br />
| [[N78AP|iPod touch 5G]]<br />
| rowspan="2" | {{date|2013|02|19}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad mini]] [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch 4G]]<br />
| {{date|2013|03|19}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.1<br />
| [[N94AP|iPhone 4S]]<br />
| {{date|2013|02|11}}<br />
| {{date|2013|02|19}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.1<br />
| [[P106AP|iPad mini (iPad2,6)]], [[N81AP|iPod touch 4G]]<br />
| {{date|2013|01|28}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad mini]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N78AP|iPod touch 5G]]<br />
| {{date|2013|01|28}}<br />
| {{date|2013|02|19}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.0.2<br />
| [[P105AP|iPad mini (iPad2,5)]], [[iPhone 5]]<br />
| colspan="2" | {{date|2013|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad mini]], [[iPhone 5]]<br />
| {{date|2012|12|18}}<br />
| {{date|2013|01|28}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="4" | 6.0.1<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad mini]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch 4G]], [[iPod touch 5G]]<br />
| {{date|2012|11|01}}<br />
| {{date|2013|01|28}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[P101AP|iPad 4 (iPad3,4)]], [[P105AP|iPad mini (iPad2,5)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch 4G]], [[iPod touch 5G]]<br />
| colspan="2" | {{date|2013|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad mini]]<br />
| {{date|2012|11|01}}<br />
| {{date|2013|01|08}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 4]], [[iPad mini]]<br />
| {{date|2012|11|09}}<br />
| {{date|2013|01|28}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 6.0<br />
| [[P101AP|iPad 4 (iPad3,4)]], [[P105AP|iPad mini (iPad2,5)]]<br />
| {{date|2012|10|30}}<br />
| {{date|2012|11|01}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[P105AP|iPad mini (iPad2,5)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch 4G]], [[iPod touch 5G]]<br />
| colspan="2" | {{date|2013|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch 4G]], [[iPod touch 5G]]<br />
| {{date|2012|09|19}}<br />
| {{date|2012|11|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1.1 (9B208)<br />
| [[N90AP|iPhone 4 (iPhone3,1)]]<br />
| {{date|2012|05|25}}<br />
| {{date|2012|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 5.1.1 (9B206)<br />
| [[K48AP|iPad]], [[N18AP|iPod touch 3G]]<br />
| rowspan="2" | {{date|2012|05|07}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N81AP|iPod touch 4G]]<br />
| {{date|2012|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1<br />
| [[K48AP|iPad]], [[iPad 2]], [[iPad 3]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch 3G]], [[N81AP|iPod touch 4G]]<br />
| {{date|2012|03|07}}<br />
| {{date|2012|05|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.0.1<br />
| [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch 3G]], [[N81AP|iPod touch 4G]]<br />
| {{date|2011|11|09}}<br />
| {{date|2012|02|08}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 5.0<br />
| [[N94AP|iPhone 4S]]<br />
| {{date|2011|10|14}}<br />
| {{date|2011|11|10}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N18AP|iPod touch 3G]], [[N81AP|iPod touch 4G]]<br />
| {{date|2011|10|04}}<br />
| {{date|2011|11|10}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.5<br />
| rowspan="6" | [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4(iPhone3,1)]], [[N18AP|iPod touch 3G]], [[N81AP|iPod touch 4G]]<br />
| 25 July 2011<br />
| {{date|2011|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.4<br />
| {{date|2011|07|15}}<br />
| {{date|2011|07|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.3<br />
| {{date|2011|05|04}}<br />
| {{date|2011|07|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.2<br />
| {{date|2011|04|14}}<br />
| {{date|2011|05|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.1<br />
| {{date|2011|03|25}}<br />
| {{date|2011|04|19}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.3<br />
| {{date|2011|03|09}}<br />
| {{date|2011|03|27}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.10<br />
| rowspan="5" | [[N92AP|iPhone 4 (iPhone3,3)]]<br />
| {{date|2011|07|25}}<br />
| {{date|2011|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.9<br />
| {{date|2011|07|15}}<br />
| {{date|2011|07|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.8<br />
| {{date|2011|05|04}}<br />
| {{date|2011|07|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.7<br />
| {{date|2011|04|14}}<br />
| {{date|2011|05|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.6<br />
| {{date|2011|02|01}}<br />
| {{date|2011|04|19}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 4.2.1<br />
| [[N82AP|iPhone 3G]], [[N72AP|iPod touch 2G]]<br />
| rowspan="2" | {{date|2010|11|22}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[K48AP|iPad]], [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]], [[N18AP|iPod touch 3G]], [[N81AP|iPod touch 4G]]<br />
| {{date|2011|03|11}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.1 (8B118)<br />
| [[N81AP|iPod touch 4G]]<br />
| {{date|2010|09|21}}<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 4.1 (8B117)<br />
| [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]], [[N72AP|iPod touch 2G]], [[N18AP|iPod touch 3G]]<br />
| rowspan="2" | {{date|2010|09|08}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[N90AP|iPhone 4 (iPhone3,1)]], [[N81AP|iPod touch 4G]]<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 4.0.2<br />
| [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]], [[N18AP|iPod touch 3G]]<br />
| {{date|2010|08|11}}<br />
| {{date|2010|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N82AP|iPhone 3G]], [[N72AP|iPod touch 2G]]<br />
| {{date|2010|08|11}}<br />
| {{date|2010|09|18}}<!--Apple may have ceased signing earlier.--><br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 4.0.1<br />
| [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]]<br />
| {{date|2010|07|15}}<br />
| {{date|2010|08|19}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N82AP|iPhone 3G]]<br />
| {{date|2010|07|15}}<br />
| {{date|2010|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="4" | 4.0<br />
| [[N18AP|iPod touch 3G]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|08|09}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N72AP|iPod touch 2G]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N90AP|iPhone 4 (iPhone3,1)]]<br />
| {{date|2010|06|24}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.2.2<br />
| rowspan="3" | [[K48AP|iPad]]<br />
| {{date|2010|08|11}}<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 3.2.1<br />
| {{date|2010|07|15}}<br />
| {{date|2010|08|19}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.2<br />
| {{date|2010|04|03}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.1.3<br />
| [[N88AP|iPhone 3GS]], [[N72AP|iPod touch 2G]], [[N18AP|iPod touch 3G]] <br />
| {{date|2010|02|02}}<br />
| {{date|2010|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 3.1.2<br />
| [[N88AP|iPhone 3GS]], [[N18AP|iPod touch 3G]]<br />
| {{date|2009|10|08}}<br />
| {{date|2010|02|02}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N72AP|iPod touch 2G]]<br />
| {{date|2009|10|08}}<br />
| {{date|2010|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.1.1 (7C146)<br />
| rowspan="2" | [[N18AP|iPod touch 3G]]<br />
| {{date|2009|09|17}}<br />
| {{date|2009|10|08}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 3.1.1 (7C145)<br />
| {{date|2009|09|09}}<br />
| {{date|2009|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N72AP|iPod touch 2G]]<br />
| {{date|2009|09|09}}<br />
| {{date|2010|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.1<br />
| rowspan="3" | [[N88AP|iPhone 3GS]]<br />
| {{date|2009|09|09}}<br />
| {{date|2009|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.0.1<br />
| {{date|2009|07|31}}<br />
| rowspan="2" | {{date|2009|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.0<br />
| {{date|2009|06|19}}<br />
| {{no|Closed}}<br />
|}<br />
<br />
=== Apple TV ===<br />
{| class="wikitable"<br />
|-<br />
! Marketing Version<br />
! OS Version<br />
! For Device(s)<br />
! From<br />
! Until<br />
! Status<br />
|-<br />
| rowspan="10" {{n/a}}<br />
| 10.1<br />
| rowspan="10" | [[J42dAP|Apple TV 4G]]<br />
| {{date|2016|12|12}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 10.0.1<br />
| {{date|2016|10|24}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 10.0<br />
| {{date|2016|09|13}}<br />
| {{date|2016|10|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.2<br />
| {{date|2016|07|18}}<br />
| {{date|2016|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.1<br />
| {{date|2016|05|16}}<br />
| {{date|2016|09|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2<br />
| {{date|2016|03|21}}<br />
| {{date|2016|06|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.1.1<br />
| {{date|2016|01|25}}<br />
| {{date|2016|04|05}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.1<br />
| {{date|2015|12|08}}<br />
| {{date|2016|02|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0.1<br />
| {{date|2015|11|09}}<br />
| {{date|2015|12|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0<br />
| {{date|2015|10|29}}<br />
| {{date|2015|12|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.2.2<br />
| 8.4.2<br />
| rowspan="8" | [[Apple TV 3G]]<br />
| {{date|2016|12|12}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 7.2.1<br />
| 8.4.1<br />
| {{date|2016|02|25}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 7.2<br />
| 8.3<br />
| {{date|2015|04|08}}<br />
| {{date|2016|04|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.1<br />
| 8.2<br />
| {{date|2015|03|09}}<br />
| {{date|2015|05|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.3<br />
| 8.1.3<br />
| {{date|2015|01|27}}<br />
| {{date|2015|03|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.2<br />
| 8.1.1<br />
| {{date|2014|11|17}}<br />
| {{date|2015|04|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.1<br />
| 8.1<br />
| {{date|2014|10|20}}<br />
| {{date|2014|12|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0<br />
| 8.0<br />
| {{date|2014|09|17}}<br />
| {{date|2014|10|22}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.2.1<br />
| rowspan="2" | 7.1.2<br />
| [[K66AP|Apple TV 2G]]<br />
| {{date|2014|09|17}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 6.2<br />
| rowspan="8" | [[K66AP|Apple TV 2G]], [[Apple TV 3G]]<br />
| {{date|2014|06|30}}<br />
| {{date|2014|09|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.1<br />
| 7.1.1<br />
| {{date|2014|04|22}}<br />
| {{date|2014|07|11}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1<br />
| 7.1<br />
| {{date|2014|03|10}}<br />
| {{date|2014|04|30}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.0.2<br />
| 7.0.6<br />
| {{date|2014|02|21}}<br />
| {{date|2014|03|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.4<br />
| {{date|2013|11|14}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.0.1<br />
| 7.0.3<br />
| {{date|2013|10|24}}<br />
| {{date|2013|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.0<br />
| 7.0.2<br />
| {{date|2013|09|24}}<br />
| {{date|2013|10|29}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.1<br />
| {{date|2013|09|20}}<br />
| {{date|2013|09|24}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 5.3<br />
| rowspan="2" | 6.1.4<br />
| [[J33IAP|Apple TV 3G (AppleTV3,2)]]<br />
| {{date|2013|06|19}}<br />
| {{date|2013|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[K66AP|Apple TV 2G]], [[J33AP|Apple TV 3G (AppleTV3,1)]]<br />
| {{date|2013|06|19}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 5.2.1<br />
| 6.1.3<br />
| rowspan="2" | [[K66AP|Apple TV 2G]], [[Apple TV 3G]]<br />
| {{date|2013|03|19}}<br />
| {{date|2013|06|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.2<br />
| 6.1<br />
| {{date|2013|01|28}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1.1<br />
| 6.0.1<br />
| rowspan="5" | [[K66AP|Apple TV 2G]], [[J33AP|Apple TV 3G (AppleTV3,1)]]<br />
| {{date|2012|11|26}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1<br />
| 6.0<br />
| {{date|2012|09|24}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.0.2<br />
| rowspan="2" | 5.1.1<br />
| {{date|2012|06|05}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.0.1<br />
| {{date|2012|05|10}}<br />
| {{date|2012|7}} (day unknown)<br />
| {{no|Closed}}<br />
|-<br />
| 5.0<br />
| 5.1<br />
| {{date|2012|03|07}}<br />
| {{date|2012|05|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.4<br />
| rowspan="2" | 5.0.1<br />
| rowspan="12" | [[K66AP|Apple TV 2G]]<br />
| {{date|2011|12|15}}<br />
| {{date|2012|03|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.3<br />
| {{date|2011|11|17}}<br />
| {{date|2012|01|11}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.2<br />
| rowspan="3" | 5.0<br />
| {{date|2011|10|24}}<br />
| {{date|2012|01|11}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.1<br />
| {{date|2011|10|17}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 4.4<br />
| {{date|2011|10|04}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| colspan="2" | 4.3<br />
| {{date|2011|03|09}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.2<br />
| rowspan="3" | 4.3<br />
| {{date|2011|05|11}}<br />
| {{date|2011|10|18}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.1<br />
| {{date|2011|03|22}}<br />
| {{date|2011|05|28}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.2<br />
| {{date|2011|03|09}}<br />
| {{date|2011|03|22}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.1.1<br />
| 4.2.1<br />
| {{date|2010|12|14}}<br />
| {{date|2011|05|28}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.1<br />
| 4.2<br />
| {{date|2010|11|22}}<br />
| {{date|2010|12|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.0<br />
| 4.1<br />
| {{date|2010|09|29}}<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|}<br />
<br />
== Protocol ==<br />
To request a SHSH blob from Apple, a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] request can be made. For a full description, see the separate articles [[SHSH Protocol]] and [[Baseband SHSH Protocol]].<br />
<br />
== See Also ==<br />
* [[APTicket]]<br />
* [[Redsn0w]]<br />
* [[iFaith]]<br />
* [[TinyUmbrella]]<br />
<br />
== External Links ==<br />
* [http://www.saurik.com/id/12 Detailed background info from Saurik]<br />
* [https://github.com/tihmstar/tsschecker tsschecker]<br />
* [https://github.com/Neal/savethemblobs savethemblobs]<br />
<br />
[[Category:Firmware Tags]]</div>AS967https://www.theiphonewiki.com/w/index.php?title=SHSH&diff=55143SHSH2016-12-20T22:18:48Z<p>AS967: </p>
<hr />
<div>As the [[wikipedia:SHSH blob | '''SHSH''' blob article on Wikipedia]] summarizes it: "SHSH blob is a jargon term for a small piece of data that is part of Apple's digital signature protocol for iOS restores and updates, designed to control the iOS versions that users can install on their iOS devices (iPhones, iPads, iPod touches, and Apple TVs), generally only allowing the newest iOS version to be installable. "<br />
<br />
Technically, the SHSH of a firmware image is a 1024-bit (<code>0x80</code> bytes) [[wikipedia:RSA (cryptosystem)|RSA]] signature. This often also refers to backup files with the signature ("SHSH blobs"). This signature is needed to restore a specific iOS version; it is generated by Apple based on hardware keys of the device and the hash of the firmware. Apple only issues signatures for the currently-available iOS version, which disallows installing older iOS versions. But if you have saved signatures for an older iOS version, you may be able to use a [[wikipedia:replay attack|replay attack]] to restore that version. Therefore it is recommended to save the signature for your device as long as Apple issues it.<br />
<br />
With the tools mentioned below it is possible to backup the signature. It is not necessary that the device is jailbroken to do the backup. Usually the SHSH signature file is stored on [[Cydia Server|Saurik's server]]. If it is stored there, then you can see in the top of [[Cydia Application|Cydia]] (on jailbroken devices) for which version a backup exists. This moved to [[TSS Center]] which can be located on the main page and then they are shown at the top of that. <br />
<br />
Users often misunderstand this system and think that the SHSH firmware version they back up depends on the firmware version they have installed on their device. This is the case for [[iFaith]], but not for TinyUmbrella. iFaith dumps the SHSHs from your device's storage (whatever's installed on your device, e.g. 4.3.3), while TinyUmbrella gets SHSHs from Apple's servers (whatever firmwares Apple is currently signing).<br />
<br />
==Using SHSH==<br />
Older devices allow installation of any correctly signed firmware, so no backup of the certificate is necessary. Devices that need Apple signatures are: [[N88AP|iPhone 3GS]] (new Bootrom), [[N90AP|iPhone 4]], [[N18AP|iPod touch 3G]], [[K48AP|iPad]], [[iPad 2]], [[N81AP|iPod touch 4G]], [[K66AP|Apple TV 2G]] and all newer devices. The [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS Old Bootrom]] and [[N72AP|iPod touch 2G]] bootroms do not require these SHSHs; however, newer versions of iOS require them (unless the chain of trust is broken and custom firmwares are installed). To restore to arbitrary versions of iOS 4.0, the SHSH is also needed for the [[N72AP|iPod touch 2G]] and [[N82AP|iPhone 3G]]. not only does [[DFU Mode]] require the [[iBSS]]/[[iBEC]] files to be signed with an SHSH that includes the device's [[ECID]], but the normal boot-chain requires the [[LLB]] to be fully signed with an [[ECID]]+SHSH, so a downgrade [[IPSW File Format|IPSW]] is not possible without a bootrom exploit of normal boot-chain (e.g. [[0x24000 Segment Overflow]]). See also the [http://blog.iphone-dev.org/post/833937433 Dev Team Blog post] about this.<br />
<br />
To restore to iOS 3.x or 4.x, change your hosts file to map any request to an Apple server to point to [[saurik]]'s server instead, if your device's signatures are hosted there. If you have the signature file on your computer, run [[TinyUmbrella]]'s TSS Server on your local machine.<br />
<br />
Since the [[limera1n Exploit]] is fixed in the [[bootrom]] since version [[Bootrom 838.3]] and because iOS since 5.0 includes a [[nonce]] in their SHSH hashes, downgrading newer devices ([[N94AP|iPhone 4S]], [[iPad 2]], [[iPad 3]], [[J33AP|Apple TV 3G]]) to earlier 5.x firmwares is not as simple. To restore to iOS 5.x on older devices, stitch iOS 5.x blobs into custom firmware (using redsn0w for example) and restore with that firmware. To restore to iOS 5.x on newer devices, use redsn0w's restore method. See the [http://www.jailbreakqa.com/questions/32462/frequently-asked-questions#94647 JailbreakQA guide to restoring to iOS 5.x using SHSH blobs] (for all devices that can run iOS 5.x except Apple TV 3G).<br />
<br />
==Timeline==<br />
The original [[M68AP|iPhone]] and [[N45AP|iPod touch]] didn't use SHSH blobs.<br />
<br />
{| class="wikitable"<br />
|-<br />
! Firmware<br />
! For Device(s)<br />
! From<br />
! Until<br />
! Status<br />
|-<br />
| 10.2<br />
| rowspan="4" | [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad Pro (9.7 inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch 6G]]<br />
| {{date|2016|12|12}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 10.1.1 (14B150)<br />
| {{date|2016|11|09}}<br />
| -<br />
| {{no|Closed}}<br />
|-<br />
| 10.1.1 (14B100)<br />
| {{date|2016|10|31}}<br />
| -<br />
| {{no|Closed}}<br />
|-<br />
| 10.1<br />
| {{date|2016|10|24}}<br />
| -<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.3<br />
| [[iPhone 7]], [[iPhone 7 Plus]]<br />
| {{date|2016|10|17}}<br />
| {{date|2016|10|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.2<br />
| rowspan="2" | [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad Pro (9.7 inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPhone 7]], [[iPhone 7 Plus]], [[N102AP|iPod touch 6G]]<br />
| {{date|2016|09|23}}<br />
| {{date|2016|10|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 10.0.1<br />
| {{date|2016|09|13}}<br />
| {{date|2016|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2 | 9.3.5<br />
| [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad Pro (9.7 inch)]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[N102AP|iPod touch 6G]]<br />
| rowspan="2 | {{date|2016|08|25}}<br />
| {{date|2016|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad mini]], [[N94AP|iPhone 4S]], [[iPod touch 5G]]<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 9.3.4<br />
| rowspan="2" | [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad Pro (9.7 inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2016|08|04}}<br />
| {{date|2016|09|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.3<br />
| {{date|2016|07|18}}<br />
| {{date|2016|08|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.2 (13F72)<br />
| [[iPad Pro (9.7 inch)]]<br />
| {{date|2016|06|02}}<br />
| {{date|2016|08|24}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.3.2 (13F69)<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[J128AP|iPad Pro (iPad6,4)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| rowspan="2" | {{date|2016|05|16}}<br />
| {{date|2016|08|24}}<br />
| {{no|Closed}}<br />
|-<br />
| [[J127AP|iPad Pro (iPad6,3)]]<br />
| {{date|2016|05|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3.1<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad Pro (9.7 inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2016|03|31}}<br />
| {{date|2016|06|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3 (13E237)<br />
| [[K93AP|iPad 2 (iPad2,1)]], [[K95AP|iPad 2 (iPad2,3)]], [[K93AAP|iPad 2 (iPad2,4)]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch 5G]]<br />
| {{date|2016|03|28}}<br />
| rowspan="2" | {{date|2016|04|22}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3 (13E236)<br />
| [[K94AP|iPad 2 (iPad2,2)]]<br />
| {{date|2016|03|25}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.3 (13E234)<br />
| [[iPad Pro (9.7 inch)]]<br />
| rowspan="3" | {{date|2016|03|21}}<br />
| rowspan="2" | {{date|2016|04|18}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.3 (13E233)<br />
| [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad mini 3]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPhone SE]], [[N102AP|iPod touch 6G]]<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch 5G]]<br />
| {{date|2016|03|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.1 (13D20)<br />
| [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad mini 3]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]]<br />
| {{date|2016|02|18}}<br />
| {{date|2016|04|05}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.1 (13D15)<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2016|01|19}}<br />
| {{date|2016|04|05}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.2<br />
| [[K93AAP|iPad 2 (iPad2,4)]], [[J1AP|iPad 3 (iPad3,1)]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad Pro (12.9 inch)]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| rowspan="2" | {{date|2015|12|08}}<br />
| {{date|2016|02|05}}<br />
| {{no|Closed}}<br />
|-<br />
| [[K93AP|iPad 2 (iPad2,1)]], [[K94AP|iPad 2 (iPad2,2)]], [[K95AP|iPad 2 (iPad2,3)]], [[J2AP|iPad 3 (iPad3,2)]], [[J2AAP|iPad 3 (iPad3,3)]], [[N94AP|iPhone 4S]]<br />
| {{date|2016|02|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.1 (13B144)<br />
| [[iPad Pro (12.9 inch)]]<br />
| {{date|2015|11|17}}<br />
| rowspan="2" | {{date|2015|12|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.1 (13B143)<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| rowspan="2" | {{date|2015|10|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad Pro]]<br />
| {{date|2015|12|02}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0.2<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2015|09|30}}<br />
| {{date|2015|10|29}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 9.0.1<br />
| [[iPhone 6s]], [[iPhone 6s Plus]]<br />
| {{date|2015|09|24}}<br />
| rowspan="2" | {{date|2015|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2015|09|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPad mini 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPhone 6s]], [[iPhone 6s Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2015|09|16}}<br />
| rowspan="2" | {{date|2015|09|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.4.1<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch 5G]], [[N102AP|iPod touch 6G]]<br />
| {{date|2015|08|13}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 8.4<br />
| [[N102AP|iPod touch 6G]]<br />
| {{date|2015|07|15}}<br />
| {{date|2015|08|23}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="7" | [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad Air 2]], [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch 5G]]<br />
| {{date|2015|06|30}}<br />
| {{date|2015|08|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.3<br />
| {{date|2015|04|08}}<br />
| {{date|2015|07|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.2<br />
| {{date|2015|03|09}}<br />
| {{date|2015|05|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1.3<br />
| {{date|2015|01|27}}<br />
| {{date|2015|03|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1.2<br />
| {{date|2014|12|09}}<br />
| {{date|2015|02|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1.1<br />
| {{date|2014|11|17}}<br />
| {{date|2014|12|17}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.1<br />
| {{date|2014|10|20}}<br />
| {{date|2014|12|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.0.2<br />
| rowspan="3" | [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], [[iPod touch 5G]]<br />
| {{date|2014|09|25}}<br />
| {{date|2014|10|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.0.1<br />
| {{date|2014|09|24}}<br />
| {{date|2014|09|24}}<br />
| {{no|Closed}}<br />
|-<br />
| 8.0<br />
| {{date|2014|09|17}}<br />
| {{date|2014|10|22}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 7.1.2<br />
| [[iPhone 4]]<br />
| rowspan="2" | {{date|2014|06|30}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch 5G]]<br />
| {{date|2014|09|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.1.1<br />
| rowspan="3" | [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch 5G]]<br />
| {{date|2014|04|22}}<br />
| {{date|2014|08|12}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.1<br />
| {{date|2014|03|10}}<br />
| {{date|2014|04|30}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.6<br />
| {{date|2014|02|21}}<br />
| {{date|2014|03|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.5<br />
| [[N49AP|iPhone 5c (iPhone5,4)]], [[N53AP|iPhone 5s (iPhone6,2)]]<br />
| {{date|2014|01|29}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.4<br />
| rowspan="2" | [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad Air]], [[iPad mini]], [[iPad mini 2]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch 5G]]<br />
| {{date|2013|11|14}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.3<br />
| {{date|2013|10|22}}<br />
| {{date|2013|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 7.0.2<br />
| [[P105AP|iPad mini (iPad2,5)]]<br />
| rowspan="2" | {{date|2013|09|26}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[P106AP|iPad mini (iPad2,6)]], [[P107AP|iPad mini (iPad2,7)]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPhone 5c]], [[iPhone 5s]], [[iPod touch 5G]]<br />
| {{date|2013|10|29}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.1<br />
| [[iPhone 5c]], [[iPhone 5s]]<br />
| {{date|2013|09|18}}<br />
| {{date|2013|10|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad mini]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[iPod touch 5G]]<br />
| {{date|2013|09|18}}<br />
| {{date|2013|10|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.6<br />
| [[N88AP|iPhone 3GS]], [[N88AP|iPod touch 4G]]<br />
| {{date|2013|11|24}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 6.1.5<br />
| [[N81AP|iPod touch 4G]]<br />
| {{date|2013|09|24}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.4<br />
| [[iPhone 5]]<br />
| {{date|2013|05|02}}<br />
| {{date|2013|09|20}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="5" | 6.1.3<br />
| [[N88AP|iPhone 3GS]]<br />
| rowspan="5" | {{date|2013|03|19}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N81AP|iPod touch 4G]]<br />
| {{date|2013|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPhone 5]]<br />
| {{date|2013|05|02}}<br />
| {{no|Closed}}<br />
|-<br />
| [[P106AP|iPad mini (iPad2,6)]]<br />
| {{date|2013|09|25}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[P105AP|iPad mini (iPad2,5)]], [[P107AP|iPad mini (iPad2,7)]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPod touch 5G]]<br />
| {{date|2013|09|20}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.1.2<br />
| [[N78AP|iPod touch 5G]]<br />
| rowspan="2" | {{date|2013|02|19}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad mini]] [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch 4G]]<br />
| {{date|2013|03|19}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.1<br />
| [[N94AP|iPhone 4S]]<br />
| {{date|2013|02|11}}<br />
| {{date|2013|02|19}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.1<br />
| [[P106AP|iPad mini (iPad2,6)]], [[N81AP|iPod touch 4G]]<br />
| {{date|2013|01|28}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad mini]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N78AP|iPod touch 5G]]<br />
| {{date|2013|01|28}}<br />
| {{date|2013|02|19}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.0.2<br />
| [[P105AP|iPad mini (iPad2,5)]], [[iPhone 5]]<br />
| colspan="2" | {{date|2013|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad mini]], [[iPhone 5]]<br />
| {{date|2012|12|18}}<br />
| {{date|2013|01|28}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="4" | 6.0.1<br />
| [[iPad 2]], [[iPad 3]], [[iPad 4]], [[iPad mini]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch 4G]], [[iPod touch 5G]]<br />
| {{date|2012|11|01}}<br />
| {{date|2013|01|28}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[P101AP|iPad 4 (iPad3,4)]], [[P105AP|iPad mini (iPad2,5)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch 4G]], [[iPod touch 5G]]<br />
| colspan="2" | {{date|2013|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad mini]]<br />
| {{date|2012|11|01}}<br />
| {{date|2013|01|08}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 4]], [[iPad mini]]<br />
| {{date|2012|11|09}}<br />
| {{date|2013|01|28}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="3" | 6.0<br />
| [[P101AP|iPad 4 (iPad3,4)]], [[P105AP|iPad mini (iPad2,5)]]<br />
| {{date|2012|10|30}}<br />
| {{date|2012|11|01}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[P105AP|iPad mini (iPad2,5)]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch 4G]], [[iPod touch 5G]]<br />
| colspan="2" | {{date|2013|07|26}}<br />
| {{no|Closed}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[iPhone 5]], [[N81AP|iPod touch 4G]], [[iPod touch 5G]]<br />
| {{date|2012|09|19}}<br />
| {{date|2012|11|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1.1 (9B208)<br />
| [[N90AP|iPhone 4 (iPhone3,1)]]<br />
| {{date|2012|05|25}}<br />
| {{date|2012|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 5.1.1 (9B206)<br />
| [[K48AP|iPad]], [[N18AP|iPod touch 3G]]<br />
| rowspan="2" | {{date|2012|05|07}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[iPad 2]], [[iPad 3]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N81AP|iPod touch 4G]]<br />
| {{date|2012|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1<br />
| [[K48AP|iPad]], [[iPad 2]], [[iPad 3]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch 3G]], [[N81AP|iPod touch 4G]]<br />
| {{date|2012|03|07}}<br />
| {{date|2012|05|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.0.1<br />
| [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N94AP|iPhone 4S]], [[N18AP|iPod touch 3G]], [[N81AP|iPod touch 4G]]<br />
| {{date|2011|11|09}}<br />
| {{date|2012|02|08}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 5.0<br />
| [[N94AP|iPhone 4S]]<br />
| {{date|2011|10|14}}<br />
| {{date|2011|11|10}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[iPhone 4]], [[N18AP|iPod touch 3G]], [[N81AP|iPod touch 4G]]<br />
| {{date|2011|10|04}}<br />
| {{date|2011|11|10}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.5<br />
| rowspan="6" | [[K48AP|iPad]], [[iPad 2]], [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4(iPhone3,1)]], [[N18AP|iPod touch 3G]], [[N81AP|iPod touch 4G]]<br />
| 25 July 2011<br />
| {{date|2011|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.4<br />
| {{date|2011|07|15}}<br />
| {{date|2011|07|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.3<br />
| {{date|2011|05|04}}<br />
| {{date|2011|07|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.2<br />
| {{date|2011|04|14}}<br />
| {{date|2011|05|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.3.1<br />
| {{date|2011|03|25}}<br />
| {{date|2011|04|19}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.3<br />
| {{date|2011|03|09}}<br />
| {{date|2011|03|27}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.10<br />
| rowspan="5" | [[N92AP|iPhone 4 (iPhone3,3)]]<br />
| {{date|2011|07|25}}<br />
| {{date|2011|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.9<br />
| {{date|2011|07|15}}<br />
| {{date|2011|07|27}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.8<br />
| {{date|2011|05|04}}<br />
| {{date|2011|07|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.7<br />
| {{date|2011|04|14}}<br />
| {{date|2011|05|06}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.6<br />
| {{date|2011|02|01}}<br />
| {{date|2011|04|19}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 4.2.1<br />
| [[N82AP|iPhone 3G]], [[N72AP|iPod touch 2G]]<br />
| rowspan="2" | {{date|2010|11|22}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[K48AP|iPad]], [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]], [[N18AP|iPod touch 3G]], [[N81AP|iPod touch 4G]]<br />
| {{date|2011|03|11}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.1 (8B118)<br />
| [[N81AP|iPod touch 4G]]<br />
| {{date|2010|09|21}}<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 4.1 (8B117)<br />
| [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]], [[N72AP|iPod touch 2G]], [[N18AP|iPod touch 3G]]<br />
| rowspan="2" | {{date|2010|09|08}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| [[N90AP|iPhone 4 (iPhone3,1)]], [[N81AP|iPod touch 4G]]<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 4.0.2<br />
| [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]], [[N18AP|iPod touch 3G]]<br />
| {{date|2010|08|11}}<br />
| {{date|2010|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N82AP|iPhone 3G]], [[N72AP|iPod touch 2G]]<br />
| {{date|2010|08|11}}<br />
| {{date|2010|09|18}}<!--Apple may have ceased signing earlier.--><br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 4.0.1<br />
| [[N88AP|iPhone 3GS]], [[N90AP|iPhone 4 (iPhone3,1)]]<br />
| {{date|2010|07|15}}<br />
| {{date|2010|08|19}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N82AP|iPhone 3G]]<br />
| {{date|2010|07|15}}<br />
| {{date|2010|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="4" | 4.0<br />
| [[N18AP|iPod touch 3G]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|08|09}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N72AP|iPod touch 2G]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N82AP|iPhone 3G]], [[N88AP|iPhone 3GS]]<br />
| {{date|2010|06|21}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N90AP|iPhone 4 (iPhone3,1)]]<br />
| {{date|2010|06|24}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.2.2<br />
| rowspan="3" | [[K48AP|iPad]]<br />
| {{date|2010|08|11}}<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 3.2.1<br />
| {{date|2010|07|15}}<br />
| {{date|2010|08|19}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.2<br />
| {{date|2010|04|03}}<br />
| {{date|2010|07|15}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.1.3<br />
| [[N88AP|iPhone 3GS]], [[N72AP|iPod touch 2G]], [[N18AP|iPod touch 3G]] <br />
| {{date|2010|02|02}}<br />
| {{date|2010|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 3.1.2<br />
| [[N88AP|iPhone 3GS]], [[N18AP|iPod touch 3G]]<br />
| {{date|2009|10|08}}<br />
| {{date|2010|02|02}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N72AP|iPod touch 2G]]<br />
| {{date|2009|10|08}}<br />
| {{date|2010|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.1.1 (7C146)<br />
| rowspan="2" | [[N18AP|iPod touch 3G]]<br />
| {{date|2009|09|17}}<br />
| {{date|2009|10|08}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 3.1.1 (7C145)<br />
| {{date|2009|09|09}}<br />
| {{date|2009|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| [[N72AP|iPod touch 2G]]<br />
| {{date|2009|09|09}}<br />
| {{date|2010|06|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.1<br />
| rowspan="3" | [[N88AP|iPhone 3GS]]<br />
| {{date|2009|09|09}}<br />
| {{date|2009|10|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.0.1<br />
| {{date|2009|07|31}}<br />
| rowspan="2" | {{date|2009|09|09}}<br />
| {{no|Closed}}<br />
|-<br />
| 3.0<br />
| {{date|2009|06|19}}<br />
| {{no|Closed}}<br />
|}<br />
<br />
=== Apple TV ===<br />
{| class="wikitable"<br />
|-<br />
! Marketing Version<br />
! OS Version<br />
! For Device(s)<br />
! From<br />
! Until<br />
! Status<br />
|-<br />
| rowspan="10" {{n/a}}<br />
| 10.1<br />
| rowspan="10" | [[J42dAP|Apple TV 4G]]<br />
| {{date|2016|12|12}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 10.0.1<br />
| {{date|2016|10|24}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 10.0<br />
| {{date|2016|09|13}}<br />
| {{date|2016|10|31}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.2<br />
| {{date|2016|07|18}}<br />
| {{date|2016|10|18}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2.1<br />
| {{date|2016|05|16}}<br />
| {{date|2016|09|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.2<br />
| {{date|2016|03|21}}<br />
| {{date|2016|06|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.1.1<br />
| {{date|2016|01|25}}<br />
| {{date|2016|04|05}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.1<br />
| {{date|2015|12|08}}<br />
| {{date|2016|02|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0.1<br />
| {{date|2015|11|09}}<br />
| {{date|2015|12|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 9.0<br />
| {{date|2015|10|29}}<br />
| {{date|2015|12|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.2.2<br />
| 8.4.2<br />
| rowspan="8" | [[Apple TV 3G]]<br />
| {{date|2016|12|12}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 7.2.1<br />
| 8.4.1<br />
| {{date|2016|02|25}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 7.2<br />
| 8.3<br />
| {{date|2015|04|08}}<br />
| {{date|2016|04|07}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.1<br />
| 8.2<br />
| {{date|2015|03|09}}<br />
| {{date|2015|05|04}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.3<br />
| 8.1.3<br />
| {{date|2015|01|27}}<br />
| {{date|2015|03|23}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.2<br />
| 8.1.1<br />
| {{date|2014|11|17}}<br />
| {{date|2015|04|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.1<br />
| 8.1<br />
| {{date|2014|10|20}}<br />
| {{date|2014|12|01}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0<br />
| 8.0<br />
| {{date|2014|09|17}}<br />
| {{date|2014|10|22}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.2.1<br />
| rowspan="2" | 7.1.2<br />
| [[K66AP|Apple TV 2G]]<br />
| {{date|2014|09|17}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 6.2<br />
| rowspan="8" | [[K66AP|Apple TV 2G]], [[Apple TV 3G]]<br />
| {{date|2014|06|30}}<br />
| {{date|2014|09|26}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1.1<br />
| 7.1.1<br />
| {{date|2014|04|22}}<br />
| {{date|2014|07|11}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.1<br />
| 7.1<br />
| {{date|2014|03|10}}<br />
| {{date|2014|04|30}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.0.2<br />
| 7.0.6<br />
| {{date|2014|02|21}}<br />
| {{date|2014|03|10}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.4<br />
| {{date|2013|11|14}}<br />
| {{date|2014|02|21}}<br />
| {{no|Closed}}<br />
|-<br />
| 6.0.1<br />
| 7.0.3<br />
| {{date|2013|10|24}}<br />
| {{date|2013|11|14}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 6.0<br />
| 7.0.2<br />
| {{date|2013|09|24}}<br />
| {{date|2013|10|29}}<br />
| {{no|Closed}}<br />
|-<br />
| 7.0.1<br />
| {{date|2013|09|20}}<br />
| {{date|2013|09|24}}<br />
| {{no|Closed}}<br />
|-<br />
| rowspan="2" | 5.3<br />
| rowspan="2" | 6.1.4<br />
| [[J33IAP|Apple TV 3G (AppleTV3,2)]]<br />
| {{date|2013|06|19}}<br />
| {{date|2013|09|21}}<br />
| {{no|Closed}}<br />
|-<br />
| [[K66AP|Apple TV 2G]], [[J33AP|Apple TV 3G (AppleTV3,1)]]<br />
| {{date|2013|06|19}}<br />
| -<br />
| {{yes|Open}}<br />
|-<br />
| 5.2.1<br />
| 6.1.3<br />
| rowspan="2" | [[K66AP|Apple TV 2G]], [[Apple TV 3G]]<br />
| {{date|2013|03|19}}<br />
| {{date|2013|06|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.2<br />
| 6.1<br />
| {{date|2013|01|28}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1.1<br />
| 6.0.1<br />
| rowspan="5" | [[K66AP|Apple TV 2G]], [[J33AP|Apple TV 3G (AppleTV3,1)]]<br />
| {{date|2012|11|26}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.1<br />
| 6.0<br />
| {{date|2012|09|24}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.0.2<br />
| rowspan="2" | 5.1.1<br />
| {{date|2012|06|05}}<br />
| {{date|2013|03|20}}<br />
| {{no|Closed}}<br />
|-<br />
| 5.0.1<br />
| {{date|2012|05|10}}<br />
| {{date|2012|7}} (day unknown)<br />
| {{no|Closed}}<br />
|-<br />
| 5.0<br />
| 5.1<br />
| {{date|2012|03|07}}<br />
| {{date|2012|05|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.4<br />
| rowspan="2" | 5.0.1<br />
| rowspan="12" | [[K66AP|Apple TV 2G]]<br />
| {{date|2011|12|15}}<br />
| {{date|2012|03|08}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.3<br />
| {{date|2011|11|17}}<br />
| {{date|2012|01|11}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.2<br />
| rowspan="3" | 5.0<br />
| {{date|2011|10|24}}<br />
| {{date|2012|01|11}}(?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.4.1<br />
| {{date|2011|10|17}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 4.4<br />
| {{date|2011|10|04}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| colspan="2" | 4.3<br />
| {{date|2011|03|09}}<br />
| ?<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.2<br />
| rowspan="3" | 4.3<br />
| {{date|2011|05|11}}<br />
| {{date|2011|10|18}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.2.1<br />
| {{date|2011|03|22}}<br />
| {{date|2011|05|28}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.2<br />
| {{date|2011|03|09}}<br />
| {{date|2011|03|22}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.1.1<br />
| 4.2.1<br />
| {{date|2010|12|14}}<br />
| {{date|2011|05|28}} (?)<br />
| {{no|Closed}}<br />
|-<br />
| 4.1<br />
| 4.2<br />
| {{date|2010|11|22}}<br />
| {{date|2010|12|14}}<br />
| {{no|Closed}}<br />
|-<br />
| 4.0<br />
| 4.1<br />
| {{date|2010|09|29}}<br />
| {{date|2010|12|02}} (?)<br />
| {{no|Closed}}<br />
|}<br />
<br />
== Protocol ==<br />
To request a SHSH blob from Apple, a simple [[wikipedia:Hypertext Transfer Protocol|HTTP]] request can be made. For a full description, see the separate articles [[SHSH Protocol]] and [[Baseband SHSH Protocol]].<br />
<br />
== See Also ==<br />
* [[APTicket]]<br />
* [[Redsn0w]]<br />
* [[iFaith]]<br />
* [[TinyUmbrella]]<br />
<br />
== External Links ==<br />
* [http://www.saurik.com/id/12 Detailed background info from Saurik]<br />
* [https://github.com/tihmstar/tsschecker tsschecker]<br />
* [https://github.com/Neal/savethemblobs savethemblobs]<br />
<br />
[[Category:Firmware Tags]]</div>AS967