https://www.theiphonewiki.com/w/api.php?action=feedcontributions&user=Posixninja&feedformat=atom
The iPhone Wiki - User contributions [en]
2024-03-28T23:58:12Z
User contributions
MediaWiki 1.31.14
https://www.theiphonewiki.com/w/index.php?title=Firmware&diff=40026
Firmware
2014-02-22T20:17:02Z
<p>Posixninja: </p>
<hr />
<div>{{float toc|left}}<br />
iTunes contacts [http://www.itunes.com/version ax.phobos.apple.com] to check for updates.<br />
<br />
Beware of [[Scam Sites|scams]] that repackage freely available jailbreaks! Only use legit [[:Category:Jailbreaks|jailbreaks]].<br />
<br />
{{clear}}<br />
== [[Apple TV]] ==<br />
Apple TV firmwares have two different version and build numbers, which can lead to confusion when referencing them. The internal build number is the best way to refer to a specific firmware, since it can't get confused for another number.<br />
* The "Marketing"/"Displayed" information is what is reported on the Apple TV's About screen.<br />
* The "Internal" information refers to the "ProductVersion" and "ProductBuildVersion" keys in the IPSW's BuildManifest.plist.<br />
<br />
=== [[k66ap|Apple TV 2nd generation]] ===<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! colspan="2" | Version<br />
! colspan="2" | Build<br />
! rowspan="2" | Codename<br />
! rowspan="2" | Release Date<br />
! rowspan="2" | IPSW Download URL<br />
! rowspan="2" | SHA1 Hash<br />
! rowspan="2" | Comments<br />
! rowspan="2" | File Size<br />
|-<br />
! Marketing<br />
! Internal<br />
! Displayed<br />
! class="rborderplz" | Internal<br />
|-<br />
| 4.0<br />
| 4.1<br />
| ?<br />
| [[Mojave 8M89 (AppleTV2,1)|8M89]]<br />
| Mojave<br />
| 1 Sep 2010<br />
| [http://appldnld.apple.com/AppleTV/061-8940.20100926.Tvtnz/AppleTV2,1_4.1_8M89_Restore.ipsw AppleTV2,1_4.1_8M89_Restore.ipsw]<br />
| <code>68647d6ce163fc20891ca5bcff647c8eecc2b8d9</code><br />
| Initial shipment.<br />
| 253,759,976<br />
|-<br />
| 4.1<br />
| 4.2<br />
| 1539<br />
| [[Jasper 8C150 (Apple TV 2G)|8C150]]<br />
| rowspan="2" | Jasper<br />
| 22 Nov 2010<br />
| [http://appldnld.apple.com/AppleTV/061-8747.20101122.Vgtr5/AppleTV2,1_4.2_8C150_Restore.ipsw AppleTV2,1_4.2_8C150_Restore.ipsw]<br />
| <code>58f9ab479783dad3dff3834452abc2917aaef2a5</code><br />
| <br />
| 279,991,056<br />
|-<br />
| 4.1.1<br />
| 4.2.1<br />
| 1553<br />
| [[Jasper 8C154 (Apple TV 2G)|8C154]]<br />
| 14 Dec 2010<br />
| [http://appldnld.apple.com/AppleTV/061-9978.20101214.gmabr/AppleTV2,1_4.2.1_8C154_Restore.ipsw AppleTV2,1_4.2.1_8C154_Restore.ipsw]<br />
| <code>c2b1adea595afa2b9caf633f0a820d3b66424dbf</code><br />
| <br />
| 280,052,510<br />
|-<br />
| 4.2<br />
| rowspan="3" | 4.3<br />
| 2060<br />
| [[Durango 8F191m (Apple TV 2G)|8F191m]]<br />
| Durango<br />
| 11 Mar 2011<br />
| [http://appldnld.apple.com/AppleTV/061-9584.20110308.Cxdew/AppleTV2,1_4.3_8F191m_Restore.ipsw AppleTV2,1_4.3_8F191m_Restore.ipsw]<br />
| <code>71bf070e755753e6dd29e2fc13cff9e248b58bd0</code><br />
| <br />
| 332,470,394<br />
|-<br />
| 4.2.1<br />
| 2100<br />
| [[DurangoTide 8F202 (Apple TV 2G)|8F202]]<br />
| rowspan="2" | DurangoTide<br />
| 22 Mar 2011<br />
| [http://appldnld.apple.com/AppleTV/041-0574.20110322.Dcfr5/AppleTV2,1_4.3_8F202_Restore.ipsw AppleTV2,1_4.3_8F202_Restore.ipsw]<br />
| <code>41faee6b543ecace1f31558c0a167e86fe784122</code><br />
| <br />
| 334,284,882<br />
|-<br />
| 4.2.2<br />
| 2203<br />
| [[DurangoTide 8F305 (Apple TV 2G)|8F305]]<br />
| 10 May 2011<br />
| [http://appldnld.apple.com/AppleTV/041-0596.20110511.Zz7mC/AppleTV2,1_4.3_8F305_Restore.ipsw AppleTV2,1_4.3_8F305_Restore.ipsw]<br />
| <code>26551145dc4b72ccfbc313e24566cfb35437bd09</code><br />
| <br />
| 334,235,633<br />
|-<br />
| colspan="2" | 4.3<br />
| 2557<br />
| [[DurangoTideCuba 8F455 (Apple TV 2G)|8F455]]<br />
| DurangoTideCuba<br />
| 1 Aug 2011<br />
| [http://appldnld.apple.com/AppleTV/041-0895.20110728.TcF4T/AppleTV2,1_4.3_8F455_Restore.ipsw AppleTV2,1_4.3_8F455_Restore.ipsw]<br />
| <code>b6a2b0baae79daf95f75044c12946839c662d01d</code><br />
| <br />
| 335,297,625<br />
|-<br />
| 4.4<br />
| rowspan="3" | 5.0<br />
| 3140<br />
| [[Telluride 9A334v (Apple TV 2G)|9A334v]]<br />
| rowspan="5" | Telluride<br />
| 12 Oct 2011<br />
| [http://appldnld.apple.com/AppleTV/061-9621.20111012.Vgijx/AppleTV2,1_4.4_9A334v_Restore.ipsw AppleTV2,1_4.4_9A334v_Restore.ipsw]<br />
| <code>19ac03b22fc7eb2bad00a2eaa5cc79b16a121f46</code><br />
| <br />
| 395,310,614<br />
|-<br />
| 4.4.1<br />
| 3150<br />
| [[Telluride 9A335a (Apple TV 2G)|9A335a]]<br />
| 18 Oct 2011<br />
| [http://appldnld.apple.com/AppleTV/041-2846.20111017.34NPe/AppleTV2,1_4.4.1_9A335a_Restore.ipsw AppleTV2,1_4.4.1_9A335a_Restore.ipsw]<br />
| <code>ea0c88db323454d6b9a52937e0ec61b010206b89</code><br />
| <br />
| 395,371,402<br />
|-<br />
| 4.4.2<br />
| 3160<br />
| [[Telluride 9A336a (Apple TV 2G)|9A336a]]<br />
| 2 Nov 2011<br />
| [http://appldnld.apple.com/AppleTV/041-2995.20111024.Tfscw/AppleTV2,1_4.4.2_9A336a_Restore.ipsw AppleTV2,1_4.4.2_9A336a_Restore.ipsw]<br />
| <code>83ad3c602fc94bfe1894920472c522c58771998a</code><br />
| <br />
| 395,330,948<br />
|-<br />
| 4.4.3<br />
| rowspan="2" | 5.0.1<br />
| 3323<br />
| [[Telluride 9A405l (Apple TV 2G)|9A405l]]<br />
| 17 Nov 2011<br />
| [http://appldnld.apple.com/AppleTV/041-3117.20111117.Gj79d/AppleTV2,1_4.4.3_9A405l_Restore.ipsw AppleTV2,1_4.4.3_9A405l_Restore.ipsw]<br />
| <code>438f16c28ae83a6dbf64ea39cced67570d1b05a2</code><br />
| <br />
| 396,258,190<br />
|-<br />
| 4.4.4<br />
| 3330<br />
| [[Telluride 9A406a (Apple TV 2G)|9A406a]]<br />
| 15 Dec 2011<br />
| [http://appldnld.apple.com/AppleTV/041-3539.20111215.EQTW8/AppleTV2,1_4.4.4_9A406a_Restore.ipsw AppleTV2,1_4.4.4_9A406a_Restore.ipsw]<br />
| <code>6bcf6d6566c581687025def9946c4da378a24668</code><br />
| <br />
| 396,277,727<br />
|-<br />
| 5.0<br />
| 5.1<br />
| 4099<br />
| [[Hoodoo 9B179b (Apple TV 2G)|9B179b]]<br />
| rowspan="2" | Hoodoo<br />
| 7 Mar 2012<br />
| [http://appldnld.apple.com/AppleTV/041-1538.20120307.Ve5H3/AppleTV2,1_5.0_9B179b_Restore.ipsw AppleTV2,1_5.0_9B179b_Restore.ipsw]<br />
| <code>5c430596af7f225ebdf24ed27fbd345f5436e272</code><br />
| <br />
| 511,005,832<br />
|-<br />
| 5.0.1<br />
| rowspan="2" | 5.1.1<br />
| 4224<br />
| [[Hoodoo 9B206f (Apple TV 2G)|9B206f]]<br />
| 25 May 2012<br />
| [http://appldnld.apple.com/AppleTV/041-4348.20120510.Axdep/AppleTV2,1_5.0_9B206f_Restore.ipsw AppleTV2,1_5.0_9B206f_Restore.ipsw]<br />
| <code>03e93c32f57fa672464dd060613ed1a81dc2f3cb</code><br />
| <br />
| 510,891,699<br />
|-<br />
| 5.0.2<br />
| 4250<br />
| [[HoodooTide 9B830 (Apple TV 2G)|9B830]]<br />
| HoodooTide<br />
| 5 Jun 2012<br />
| [http://appldnld.apple.com/AppleTV/041-4362.20120605.t8i4U/AppleTV2,1_5.0.2_9B830_Restore.ipsw AppleTV2,1_5.0.2_9B830_Restore.ipsw]<br />
| <code>bdf2a296dc5fdc215e8d756b99d2a0984e814b86</code><br />
| <br />
| 510,559,840<br />
|-<br />
| 5.1<br />
| 6.0<br />
| 5201<br />
| [[Sundance 10A406e (Apple TV 2G)|10A406e]]<br />
| Sundance<br />
| 24 Sep 2012<br />
| [http://appldnld.apple.com/AppleTV/041-0803.20120924.LOop5/AppleTV2,1_5.1_10A406e_Restore.ipsw AppleTV2,1_5.1_10A406e_Restore.ipsw]<br />
| <code>a3f8e3955f460786d88b879f10be69a9858f1688</code><br />
| <br />
| 585,426,528<br />
|-<br />
| 5.1.1<br />
| 6.0.1<br />
| 5433<br />
| [[SundanceTide 10A831 (Apple TV 2G)|10A831]]<br />
| SundanceTide<br />
| 26 Nov 2012<br />
| [http://appldnld.apple.com/AppleTV/041-7275.20121128.qw234/AppleTV2,1_5.1.1_10A831_Restore.ipsw AppleTV2,1_5.1.1_10A831_Restore.ipsw]<br />
| <code>1ff50161d8fb7d0a804aaea49f4b31d5690a3e4a</code><br />
| <br />
| 584,721,306<br />
|-<br />
| 5.2<br />
| 6.1<br />
| 6010.96<br />
| [[Brighton 10B144b (Apple TV 2G)|10B144b]]<br />
| Brighton<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/AppleTV/041-6474.20130128.Cnnew/AppleTV2,1_5.2_10B144b_Restore.ipsw AppleTV2,1_5.2_10B144b_Restore.ipsw]<br />
| <code>78358d14f776f70a7de719af6ca697221bd8f4bb</code><br />
| <br />
| 588,830,446<br />
|-<br />
| 5.2.1<br />
| 6.1.3<br />
| 6025<br />
| [[BrightonMaps 10B329a (Apple TV 2G)|10B329a]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/AppleTV/091-2469.20130319.Scop4/AppleTV2,1_5.2.1_10B329a_Restore.ipsw AppleTV2,1_5.2.1_10B329a_Restore.ipsw]<br />
| <code>bd51213ae4c80b3080fa0a7a069fc53aa031a79f</code><br />
| <br />
| 588,881,122<br />
|-<br />
| 5.3<br />
| 6.1.4<br />
| 6105<br />
| [[BrightonTide 10B809 (Apple TV 2G)|10B809]]<br />
| BrightonTide<br />
| 19 Jun 2013<br />
| [http://appldnld.apple.com/AppleTV/091-5256.20130618.MagBg/AppleTV2,1_5.3_10B809_Restore.ipsw AppleTV2,1_5.3_10B809_Restore.ipsw]<br />
| <code>6208f0518f3529aa290e4cbf2ea585e891ed61d3</code><br />
| <br />
| 588,383,593<br />
|-<br />
| rowspan="2" | 6.0<br />
| 7.0.1<br />
| rowspan="2" | 6646.65<br />
| [[Innsbruck 11A470e (Apple TV 2G)|11A470e]]<br />
| rowspan="2" | Innsbruck<br />
| 20 Sep 2013<br />
| [http://appldnld.apple.com/AppleTV/031-0397.20130919.4ovPq/AppleTV2,1_6.0_11A470e_Restore.ipsw AppleTV2,1_6.0_11A470e_Restore.ipsw]<br />
| <code>016e574f56ef1548b3108eec4e5a848cf3d5a8bc</code><br />
| <br />
| 694,072,367<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A502 (Apple TV 2G)|11A502]]<br />
| 23 Sep 2013<br />
| [http://appldnld.apple.com/AppleTV/031-0449.20130923.xlzdm/AppleTV2,1_6.0_11A502_Restore.ipsw AppleTV2,1_6.0_11A502_Restore.ipsw]<br />
| <code>ba292870c73667682d2fdc1e3feae80c2d94533f</code><br />
| <br />
| 694,043,692<br />
|-<br />
| 6.0.1<br />
| 7.0.3<br />
| 6646.80.1<br />
| [[InnsbruckTaos 11B511d (Apple TV 2G)|11B511d]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 24 Oct 2013<br />
| [http://appldnld.apple.com/AppleTV/091-8981.20131024.CoPt5/AppleTV2,1_6.0.1_11B511d_Restore.ipsw AppleTV2,1_6.0.1_11B511d_Restore.ipsw]<br />
| <code>bbb592b55b3ee4af7c37df1fae400eb9d9be21c7</code><br />
| <br />
| 694,238,541<br />
|-<br />
| rowspan="2" | 6.0.2<br />
| 7.0.4<br />
| 6646.81.1<br />
| [[InnsbruckTaos 11B554a (AppleTV2,1)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1765.20131114.P3wE4/AppleTV2,1_6.0.2_11B554a_Restore.ipsw AppleTV2,1_6.0.2_11B554a_Restore.ipsw]<br />
| <code>d60f9eee5ddfddbe71220ccdf7cf249f68a6346c</code><br />
| <br />
| 694,049,341<br />
|-<br />
| 7.0.6<br />
| ?<br />
| [[InnsbruckTaos 11B651 (AppleTV2,1)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2955.20140221.8j5GW/AppleTV2,1_6.0.2_11B651_Restore.ipsw AppleTV2,1_6.0.2_11B651_Restore.ipsw]<br />
| <code>247d5c7005255caddfe2b01b4c6c9b20c247b7ad</code><br />
| <br />
| 694,184,106<br />
|}<br />
<br />
=== [[Apple TV 3G|Apple TV 3rd generation]] ===<br />
==== [[j33ap|AppleTV3,1]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! colspan="2" | Version<br />
! colspan="2" | Build<br />
! rowspan="2" | Codename<br />
! rowspan="2" | Release Date<br />
! rowspan="2" | IPSW Download URL<br />
! rowspan="2" | SHA1 Hash<br />
! rowspan="2" | Comments<br />
! rowspan="2" | File Size<br />
|-<br />
! Marketing<br />
! Internal<br />
! Displayed<br />
! class="rborderplz" | Internal<br />
|-<br />
| 5.0<br />
| 5.1<br />
| 4099<br />
| [[Hoodoo 9B179b (AppleTV3,1)|9B179b]]<br />
| rowspan="2" | Hoodoo<br />
| 7 Mar 2012<br />
| [http://appldnld.apple.com/AppleTV/041-2855.20120307.SD8A4/AppleTV3,1_5.0_9B179b_Restore.ipsw AppleTV3,1_5.0_9B179b_Restore.ipsw]<br />
| <code>fc04f80a3e6705d35db9e12fa05e1e34d08792c8</code><br />
| Initial shipment.<br />
| 566,043,326<br />
|-<br />
| 5.0.1<br />
| rowspan="2" | 5.1.1<br />
| 4224<br />
| [[Hoodoo 9B206f (AppleTV3,1)|9B206f]]<br />
| 10 May 2012<br />
| [http://appldnld.apple.com/AppleTV/041-4350.20120510.Tvfr4/AppleTV3,1_5.0_9B206f_Restore.ipsw AppleTV3,1_5.0_9B206f_Restore.ipsw]<br />
| <code>6565252c230893837c4e82a8d676ded2d702fa26</code><br />
| <br />
| 566,055,791<br />
|-<br />
| 5.0.2<br />
| 4250<br />
| [[HoodooTide 9B830 (AppleTV3,1)|9B830]]<br />
| HoodooTide<br />
| 5 Jun 2012<br />
| [http://appldnld.apple.com/AppleTV/041-4361.20120605.grjot/AppleTV3,1_5.0.2_9B830_Restore.ipsw AppleTV3,1_5.0.2_9B830_Restore.ipsw]<br />
| <code>347944608d4697036fd944f615614768b1f7642c</code><br />
| <br />
| 565,875,516<br />
|-<br />
| 5.1<br />
| 6.0<br />
| 5201<br />
| [[Sundance 10A406e (AppleTV3,1)|10A406e]]<br />
| Sundance<br />
| 24 Sep 2012<br />
| [http://appldnld.apple.com/AppleTV/041-4043.20120924.ClUd5/AppleTV3,1_5.1_10A406e_Restore.ipsw AppleTV3,1_5.1_10A406e_Restore.ipsw]<br />
| <code>c0a77b01fc8992d45e36c4449a61c6fe719bb8ef</code><br />
| <br />
| 653,617,939<br />
|-<br />
| 5.1.1<br />
| 6.0.1<br />
| 5433<br />
| [[SundanceTide 10A831 (AppleTV3,1)|10A831]]<br />
| SundanceTide<br />
| 26 Nov 2012<br />
| [http://appldnld.apple.com/AppleTV/041-7274.20121228.Avt45/AppleTV3,1_5.1.1_10A831_Restore.ipsw AppleTV3,1_5.1.1_10A831_Restore.ipsw]<br />
| <code>034e15492a84cd49b32070aa014528763d980ecd</code><br />
| <br />
| 653,209,382<br />
|-<br />
| 5.2<br />
| 6.1<br />
| 6010.96<br />
| [[Brighton 10B144b (AppleTV3,1)|10B144b]]<br />
| Brighton<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/AppleTV/041-5903.20130128.aswe4/AppleTV3,1_5.2_10B144b_Restore.ipsw AppleTV3,1_5.2_10B144b_Restore.ipsw]<br />
| <code>0d7f83114975fdac211e63745f94295c04efb9d7</code><br />
| <br />
| 656,351,315<br />
|-<br />
| 5.2.1<br />
| 6.1.3<br />
| 6025<br />
| [[BrightonMaps 10B329a (AppleTV3,1)|10B329a]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/AppleTV/091-2614.20130319.Aro9t/AppleTV3,1_5.2.1_10B329a_Restore.ipsw AppleTV3,1_5.2.1_10B329a_Restore.ipsw]<br />
| <code>f74c3c5ce0ac21a5320cb491b32e51b400877196</code><br />
| <br />
| 656,326,445<br />
|-<br />
| 5.3<br />
| 6.1.4<br />
| 6105<br />
| [[BrightonTide 10B809 (AppleTV3,1)|10B809]]<br />
| BrightonTide<br />
| 19 Jun 2013<br />
| [http://appldnld.apple.com/AppleTV/091-5257.20130618.Eu5uy/AppleTV3,1_5.3_10B809_Restore.ipsw AppleTV3,1_5.3_10B809_Restore.ipsw]<br />
| <code>90a7c1e5219df1d148779fdd32150c902f15acab</code><br />
| <br />
| 655,995,407<br />
|-<br />
| rowspan="2" | 6.0<br />
| 7.0.1<br />
| rowspan="2" | 6646.65<br />
| [[Innsbruck 11A470e (AppleTV3,1)|11A470e]]<br />
| rowspan="2" | Innsbruck<br />
| 20 Sep 2013<br />
| [http://appldnld.apple.com/AppleTV/031-0405.20130919.DgLvd/AppleTV3,1_6.0_11A470e_Restore.ipsw AppleTV3,1_6.0_11A470e_Restore.ipsw]<br />
| <code>0444e72fef8f3ece66a6d7cf29a114e59b2e3c0a</code><br />
| <br />
| 764,230,178<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A502 (AppleTV3,1)|11A502]]<br />
| 23 Sep 2013<br />
| [http://appldnld.apple.com/AppleTV/031-0456.20130923.3Wtrk/AppleTV3,1_6.0_11A502_Restore.ipsw AppleTV3,1_6.0_11A502_Restore.ipsw]<br />
| <code>52cb2c15dc67d820705328091d23ff5bdbba98fe</code><br />
| <br />
| 764,421,176<br />
|-<br />
| 6.0.1<br />
| 7.0.3<br />
| 6646.80.1<br />
| [[InnsbruckTaos 11B511d (AppleTV3,1)|11B511d]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 24 Oct 2013<br />
| [http://appldnld.apple.com/AppleTV/091-8951.20131024.mvt4t/AppleTV3,1_6.0.1_11B511d_Restore.ipsw AppleTV3,1_6.0.1_11B511d_Restore.ipsw]<br />
| <code>3b0a4a610a28a8bae702e7b98c1d068f19d9473e</code><br />
| <br />
| 764,460,956<br />
|-<br />
| rowspan="2" | 6.0.2<br />
| 7.0.4<br />
| 6646.81.1<br />
| [[InnsbruckTaos 11B554a (AppleTV3,1)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1834.20131114.P3wE4/AppleTV3,1_6.0.2_11B554a_Restore.ipsw AppleTV3,1_6.0.2_11B554a_Restore.ipsw]<br />
| <code>fcad030a832accef9e9015cc862247bee7e10254</code><br />
| <br />
| 764,364,506<br />
|-<br />
| 7.0.6<br />
| ?<br />
| [[InnsbruckTaos 11B651 (AppleTV3,1)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-3021.20140221.8j5GW/AppleTV3,1_6.0.2_11B651_Restore.ipsw AppleTV3,1_6.0.2_11B651_Restore.ipsw]<br />
| <code>f0497e03a49f357ee06415841a514e7858df0b8f</code><br />
| <br />
| 763,971,716<br />
|}<br />
<br />
==== [[j33iap|AppleTV3,2]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! colspan="2" | Version<br />
! colspan="2" | Build<br />
! rowspan="2" | Codename<br />
! rowspan="2" | Release Date<br />
! rowspan="2" | IPSW Download URL<br />
! rowspan="2" | SHA1 Hash<br />
! rowspan="2" | Comments<br />
! rowspan="2" | File Size<br />
|-<br />
! Marketing<br />
! Internal<br />
! Displayed<br />
! class="rborderplz" | Internal<br />
|-<br />
| 5.2<br />
| 6.1<br />
| 6010.96<br />
| [[Brighton 10B144b (AppleTV3,2)|10B144b]]<br />
| Brighton<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/AppleTV/041-6472.20130128.dUtpr/AppleTV3,2_5.2_10B144b_Restore.ipsw AppleTV3,2_5.2_10B144b_Restore.ipsw]<br />
| <code>f64d0d425ae193c43adb1167a5678343fa01ee8d</code><br />
| Initial Release.<br />
| 656,072,051<br />
|-<br />
| 5.2.1<br />
| 6.1.3<br />
| 6025<br />
| [[BrightonMaps 10B329a (AppleTV3,2)|10B329a]]<br />
| BrightonMaps<br />
| 19 May 2013<br />
| [http://appldnld.apple.com/AppleTV/091-2665.20130319.M1nul/AppleTV3,2_5.2.1_10B329a_Restore.ipsw AppleTV3,2_5.2.1_10B329a_Restore.ipsw]<br />
| <code>1f1803ef5efc947f0e618811c4e1daabd04fc176</code><br />
| <br />
| 656,210,571<br />
|-<br />
| 5.3<br />
| 6.1.4<br />
| 6105<br />
| [[BrightonTide 10B809 (AppleTV3,2)|10B809]]<br />
| BrightonTide<br />
| 19 Jun 2013<br />
| [http://appldnld.apple.com/AppleTV/091-5259.20130618.90Rft/AppleTV3,2_5.3_10B809_Restore.ipsw AppleTV3,2_5.3_10B809_Restore.ipsw]<br />
| <code>600b5232ac6ec26f78d86aac667ad3fc7efe992e</code><br />
| <br />
| 655,703,298<br />
|-<br />
| rowspan="2" | 6.0<br />
| 7.0.1<br />
| rowspan="2" | 6646.65<br />
| [[Innsbruck 11A470e (AppleTV3,2)|11A470e]]<br />
| rowspan="2" | Innsbruck<br />
| 20 Sep 2013<br />
| [http://appldnld.apple.com/AppleTV/031-0406.20130919.AZNiA/AppleTV3,2_6.0_11A470e_Restore.ipsw AppleTV3,2_6.0_11A470e_Restore.ipsw]<br />
| <code>f3a0d542c056cb248c66ba89398672dcd4962d61</code><br />
| <br />
| 764,017,177<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A502 (AppleTV3,2)|11A502]]<br />
| 23 Sep 2013<br />
| [http://appldnld.apple.com/AppleTV/031-0457.20130923.8n2FL/AppleTV3,2_6.0_11A502_Restore.ipsw AppleTV3,2_6.0_11A502_Restore.ipsw]<br />
| <code>e3c42ae7e610fe742eb2c72af18494768a4f212d</code><br />
| <br />
| 763,995,640<br />
|-<br />
| 6.0.1<br />
| 7.0.3<br />
| 6646.80.1<br />
| [[InnsbruckTaos 11B511d (AppleTV3,2)|11B511d]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 24 Oct 2013<br />
| [http://appldnld.apple.com/AppleTV/091-8994.20131024.BbedF/AppleTV3,2_6.0.1_11B511d_Restore.ipsw AppleTV3,2_6.0.1_11B511d_Restore.ipsw]<br />
| <code>312404d97b2b68334e73427e8e2bb2ac1d0e747d</code><br />
| <br />
| 764,320,731<br />
|-<br />
| rowspan="2" | 6.0.2<br />
| 7.0.4<br />
| 6646.81.1<br />
| [[InnsbruckTaos 11B554a (AppleTV3,2)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1850.20131114.P3wE4/AppleTV3,2_6.0.2_11B554a_Restore.ipsw AppleTV3,2_6.0.2_11B554a_Restore.ipsw]<br />
| <code>32b533a1b0eb9eb48762d2bc36966960269508ba</code><br />
| <br />
| 763,991,693<br />
|-<br />
| 7.0.6<br />
| ?<br />
| [[InnsbruckTaos 11B651 (AppleTV3,2)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-3039.20140221.8j5GW/AppleTV3,2_6.0.2_11B651_Restore.ipsw AppleTV3,2_6.0.2_11B651_Restore.ipsw]<br />
| <code>53ae0063f21441ecb10452816af82c9fae4685ea</code><br />
| <br />
| 763,987,587<br />
|}<br />
<br />
== [[iPad]] ==<br />
{{:Firmware/Deprecated iPads}}<br />
=== [[iPad 2]] ===<br />
==== [[k93ap|iPad2,1]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 4.3<br />
| [[Durango 8F191 (iPad2,1)|8F191]]<br />
| rowspan="6" | Durango<br />
| 9 Mar 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0368.20110311.SwtHr/iPad2,1_4.3_8F191_Restore.ipsw iPad2,1_4.3_8F191_Restore.ipsw]<br />
| <code>c4db3a44dc0986bc8344f7672cfa0255bea8af14</code><br />
| Initial shipment.<br />
| 641,816,049<br />
|-<br />
| 4.3.1<br />
| [[Durango 8G4 (iPad2,1)|8G4]]<br />
| 25 Mar 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0556.20110325.64rfg/iPad2,1_4.3.1_8G4_Restore.ipsw iPad2,1_4.3.1_8G4_Restore.ipsw]<br />
| <code>becf01c807e4c9f2654e3ffd1b83973f512ae51d</code><br />
| <br />
| 636,932,642<br />
|-<br />
| 4.3.2<br />
| [[Durango 8H7 (iPad2,1)|8H7]]<br />
| 15 Apr 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0663.20110414.U7bTI/iPad2,1_4.3.2_8H7_Restore.ipsw iPad2,1_4.3.2_8H7_Restore.ipsw]<br />
| <code>f3df44893159ec283166a77ee75fe091ac0899b0</code><br />
| <br />
| 637,204,516<br />
|-<br />
| 4.3.3<br />
| [[Durango 8J2 (iPad2,1)|8J2]]<br />
| 4 May 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1012.20110503.tmmBc/iPad2,1_4.3.3_8J2_Restore.ipsw iPad2,1_4.3.3_8J2_Restore.ipsw]<br />
| <code>71142e8c876ceaf64799727fc79726d1264aab6c</code><br />
| <br />
| 637,183,974<br />
|-<br />
| 4.3.4<br />
| [[Durango 8K2 (iPad2,1)|8K2]]<br />
| 15 Jul 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1924.2011.0715.qP4r3/iPad2,1_4.3.4_8K2_Restore.ipsw iPad2,1_4.3.4_8K2_Restore.ipsw]<br />
| <code>f12c297e562c6dbb459a8533b746bd8e36c05ac0</code><br />
| Hotfix to prevent malicious use of [[Saffron]]'s exploits<br />
| 637,253,809<br />
|-<br />
| 4.3.5<br />
| [[Durango 8L1 (iPad2,1)|8L1]]<br />
| 25 Jul 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1960.20110721.UsAO4/iPad2,1_4.3.5_8L1_Restore.ipsw iPad2,1_4.3.5_8L1_Restore.ipsw]<br />
| <code>e4d70f8d647580fe275f8b513aca30dad21711d4</code><br />
| <br />
| 637,318,311<br />
|-<br />
| 5.0<br />
| [[Telluride 9A334 (iPad2,1)|9A334]]<br />
| rowspan="2" | Telluride<br />
| 12 Oct 2011<br />
| [http://appldnld.apple.com/iPhone4/041-9618.20111012.Zxb22/iPad2,1_5.0_9A334_Restore.ipsw iPad2,1_5.0_9A334_Restore.ipsw]<br />
| <code>c9ec1f15890c5956847cc2318b166fbdf06fe972</code><br />
| <br />
| 741,493,281<br />
|-<br />
| 5.0.1<br />
| [[Telluride 9A405 (iPad2,1)|9A405]]<br />
| 10 Nov 2011<br />
| [http://appldnld.apple.com/iPhone4/041-3310.20111109.Cfp76/iPad2,1_5.0.1_9A405_Restore.ipsw iPad2,1_5.0.1_9A405_Restore.ipsw]<br />
| <code>f33caa9c22d9737ea211e571c9014ff971ee69c3</code><br />
| <br />
| 758,693,514<br />
|-<br />
| 5.1<br />
| [[Hoodoo 9B176 (iPad2,1)|9B176]]<br />
| rowspan="2" | Hoodoo<br />
| 7 Mar 2012<br />
| [http://appldnld.apple.com/iOS5/041-1539.20120307.JwD8A/iPad2,1_5.1_9B176_Restore.ipsw iPad2,1_5.1_9B176_Restore.ipsw]<br />
| <code>9ad05caa469906f91bec4627a25132e9f9859720</code><br />
| <br />
| 764,320,555<br />
|-<br />
| 5.1.1<br />
| [[Hoodoo 9B206 (iPad2,1)|9B206]]<br />
| 10 May 2012<br />
| [http://appldnld.apple.com/iOS5.1.1/041-4294.20120427.Pp5qM/iPad2,1_5.1.1_9B206_Restore.ipsw iPad2,1_5.1.1_9B206_Restore.ipsw]<br />
| <code>1c3c34fedb7b41b7eeb0773c0871be05fa236fee</code><br />
| <br />
| 764,332,929<br />
|-<br />
| 6.0<br />
| [[Sundance 10A403 (iPad2,1)|10A403]]<br />
| rowspan="2" | Sundance<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-0804.20120919.9SgHU/iPad2,1_6.0_10A403_Restore.ipsw iPad2,1_6.0_10A403_Restore.ipsw]<br />
| <code>d839f59f3f605f6d39304e44ff783758eaed7ee3</code><br />
| <br />
| 829,223,862<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPad2,1)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7942.20121101.Intn3/iPad2,1_6.0.1_10A523_Restore.ipsw iPad2,1_6.0.1_10A523_Restore.ipsw]<br />
| <code>2c68427154208b3a1001beebdc2ed547e6e7049d</code><br />
| <br />
| 829,170,781<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad2,1)|10B141]]<br />
| rowspan="2" | Brighton<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6476.20130128.Hrb56/iPad2,1_6.1_10B141_Restore.ipsw iPad2,1_6.1_10B141_Restore.ipsw]<br />
| <code>5c59397bbeeb7cde06ce6b0e1021f69eb008d3b4</code><br />
| <br />
| 832,454,995<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPad2,1)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0714.20130215.Mpsr2/iPad2,1_6.1.2_10B146_Restore.ipsw iPad2,1_6.1.2_10B146_Restore.ipsw]<br />
| <code>0e3d505c124a2f5b348689c096059662f02d65ee</code><br />
| Exchange bug fix. <br />
| 832,401,128<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad2,1)|10B329]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2397.20130319.EEae9/iPad2,1_6.1.3_10B329_Restore.ipsw iPad2,1_6.1.3_10B329_Restore.ipsw]<br />
| <code>241a02bb446c21e44e8470b77e09b5fbfba7d6c4</code><br />
|<br />
| 832,740,317<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad2,1)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9464.20130918.jozAF/iPad2,1_7.0_11A465_Restore.ipsw iPad2,1_7.0_11A465_Restore.ipsw]<br />
| <code>730ec775b941be35b50b862379c2afb29c6a7cae</code><br />
| <br />
| 1,121,910,250<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad2,1)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9807.20130924.uIRgn/iPad2,1_7.0.2_11A501_Restore.ipsw iPad2,1_7.0.2_11A501_Restore.ipsw]<br />
| <code>027a6e688f4c17512b66d90a66b8056bdd0615e7</code><br />
| <br />
| 1,122,016,149<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad2,1)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-1020.20131022.14lik/iPad2,1_7.0.3_11B511_Restore.ipsw iPad2,1_7.0.3_11B511_Restore.ipsw]<br />
| <code>d328d5ef5f276ca9bd482c7f57e7612ec522e80d</code><br />
| <br />
| 1,121,957,127<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad2,1)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1724.20131114.P3wE4/iPad2,1_7.0.4_11B554a_Restore.ipsw iPad2,1_7.0.4_11B554a_Restore.ipsw]<br />
| <code>012d89520f093e008b553ea0f41b5676788bbf1f</code><br />
| <br />
| 1,121,978,667<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad2,1)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2920.20140221.8j5GW/iPad2,1_7.0.6_11B651_Restore.ipsw iPad2,1_7.0.6_11B651_Restore.ipsw]<br />
| <code>8851bab8f9e8afaabe505f51116fa837c576c914</code><br />
| <br />
| 1,122,135,351<br />
|}<br />
<br />
==== [[k94ap|iPad2,2]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! [[XMM 6180#Known Firmware Versions|Baseband]]<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 4.3<br />
| [[Durango 8F191 (iPad2,2)|8F191]]<br />
| rowspan="6" | Durango<br />
| rowspan="6" | [[04.10.01]]<br />
| 9 Mar 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0369.20110311.Xzsew/iPad2,2_4.3_8F191_Restore.ipsw iPad2,2_4.3_8F191_Restore.ipsw]<br />
| <code>03f4af63f7751e429aef57ae00e675f96b271573</code><br />
| Initial shipment.<br />
| 649,374,499<br />
|-<br />
| 4.3.1<br />
| [[Durango 8G4 (iPad2,2)|8G4]]<br />
| 25 Mar 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0557.20110325.Jy76y/iPad2,2_4.3.1_8G4_Restore.ipsw iPad2,2_4.3.1_8G4_Restore.ipsw]<br />
| <code>862dbf2c94dc2f30b02101905a91a45c95c353a7</code><br />
| <br />
| 644,359,977<br />
|-<br />
| 4.3.2<br />
| [[Durango 8H7 (iPad2,2)|8H7]]<br />
| 14 Apr 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0664.20110414.39vUS/iPad2,2_4.3.2_8H7_Restore.ipsw iPad2,2_4.3.2_8H7_Restore.ipsw]<br />
| <code>e52bd4bd8eabd48e5cfd02f895292d5644e805be</code><br />
| <br />
| 644,615,497<br />
|-<br />
| 4.3.3<br />
| [[Durango 8J2 (iPad2,2)|8J2]]<br />
| 4 May 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1013.20110503.1m73D/iPad2,2_4.3.3_8J2_Restore.ipsw iPad2,2_4.3.3_8J2_Restore.ipsw]<br />
| <code>e378037ce0689013bf7f4689dfbb162c3c4edd16</code><br />
| <br />
| 644,652,318<br />
|-<br />
| 4.3.4<br />
| [[Durango 8K2 (iPad2,2)|8K2]]<br />
| 15 Jul 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1914.20110715.Xdw2Q/iPad2,2_4.3.4_8K2_Restore.ipsw iPad2,2_4.3.4_8K2_Restore.ipsw]<br />
| <code>504c8a4286cb288a6196f3cec17684ac9de5cebd</code><br />
| Hotfix to prevent malicious use of [[Saffron]]'s exploits<br />
| 644,771,277<br />
|-<br />
| 4.3.5<br />
| [[Durango 8L1 (iPad2,2)|8L1]]<br />
| 25 Jul 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1961.20110721.zigyd/iPad2,2_4.3.5_8L1_Restore.ipsw iPad2,2_4.3.5_8L1_Restore.ipsw]<br />
| <code>b7806a6cdcf5f1f7ab2fb426fef8d0cf0b7357f2</code><br />
| <br />
| 644,716,962<br />
|-<br />
| 5.0<br />
| [[Telluride 9A334 (iPad2,2)|9A334]]<br />
| rowspan="2" | Telluride<br />
| rowspan="2"| [[04.11.08]]<br />
| 12 Oct 2011<br />
| [http://appldnld.apple.com/iPhone4/041-9619.20111012.y34Nx/iPad2,2_5.0_9A334_Restore.ipsw iPad2,2_5.0_9A334_Restore.ipsw]<br />
| <code>a1a84c55409b076a3eeb41726513aaf8d7e98894</code><br />
| <br />
| 750,839,256<br />
|-<br />
| 5.0.1<br />
| [[Telluride 9A405 (iPad2,2)|9A405]]<br />
| 10 Nov 2011<br />
| [http://appldnld.apple.com/iPhone4/041-3311.20111109.Vpr43/iPad2,2_5.0.1_9A405_Restore.ipsw iPad2,2_5.0.1_9A405_Restore.ipsw]<br />
| <code>af6fb9a8a3f97a7e0a56fa529aab88e18e079061</code><br />
| <br />
| 767,568,362<br />
|-<br />
| 5.1<br />
| [[Hoodoo 9B176 (iPad2,2)|9B176]]<br />
| rowspan="2" | Hoodoo<br />
| rowspan="2" | [[04.12.01]]<br />
| 7 Mar 2012<br />
| [http://appldnld.apple.com/iOS5/041-1540.20120307.tw0go/iPad2,2_5.1_9B176_Restore.ipsw iPad2,2_5.1_9B176_Restore.ipsw]<br />
| <code>986d379ee08772262bbcfb3f0aa84bd3ed530ba0</code><br />
| <br />
| 773,288,354<br />
|-<br />
| 5.1.1<br />
| [[Hoodoo 9B206 (iPad2,2)|9B206]]<br />
| 10 May 2012<br />
| [http://appldnld.apple.com/iOS5.1.1/041-4296.20120427.dPX6x/iPad2,2_5.1.1_9B206_Restore.ipsw iPad2,2_5.1.1_9B206_Restore.ipsw]<br />
| <code>8c94614fec35be166b648523f53368f6e7dbc22d</code><br />
| <br />
| 773,321,564<br />
|-<br />
| 6.0<br />
| [[Sundance 10A403 (iPad2,2)|10A403]]<br />
| rowspan="2" | Sundance<br />
| rowspan="2" | [[04.12.02]]<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-7165.20120919.eZTyh/iPad2,2_6.0_10A403_Restore.ipsw iPad2,2_6.0_10A403_Restore.ipsw]<br />
| <code>8635d642aee348f23de21653273046bdff635e8a</code><br />
| <br />
| 845,910,846<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPad2,2)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7945.20121101.Ofr42/iPad2,2_6.0.1_10A523_Restore.ipsw iPad2,2_6.0.1_10A523_Restore.ipsw]<br />
| <code>c2725e3e1adbd986de61af6507611653a310de52</code><br />
| <br />
| 845,707,790<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad2,2)|10B141]]<br />
| rowspan="2" | Brighton<br />
| rowspan="3" | [[04.12.05]]<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6508.20130128.Ohdre/iPad2,2_6.1_10B141_Restore.ipsw iPad2,2_6.1_10B141_Restore.ipsw]<br />
| <code>3b35197a563cf71e4ed8ae35b5f3bcf298d2963f</code><br />
| <br />
| 849,025,303<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPad2,2)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0724.20130215.2D4rt/iPad2,2_6.1.2_10B146_Restore.ipsw iPad2,2_6.1.2_10B146_Restore.ipsw]<br />
| <code>e15419883b94aae6efe60462b67d5af5449bb552</code><br />
| Exchange bug fix. <br />
| 849,014,812<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad2,2)|10B329]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2472.20130319.Ta4rt/iPad2,2_6.1.3_10B329_Restore.ipsw iPad2,2_6.1.3_10B329_Restore.ipsw]<br />
| <code>1b7897aea7b23d2e00e3d3c5c0ad2a0c47b345cd</code><br />
|<br />
| 849,337,150<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad2,2)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| rowspan="5" | [[04.12.09]]<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9472.20130918.Ew3Qs/iPad2,2_7.0_11A465_Restore.ipsw iPad2,2_7.0_11A465_Restore.ipsw]<br />
| <code>026876e81eb61b631a3f051185a1c4db3c8848a8</code><br />
| <br />
| 1,138,668,207<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad2,2)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9832.20130924.LlIm6/iPad2,2_7.0.2_11A501_Restore.ipsw iPad2,2_7.0.2_11A501_Restore.ipsw]<br />
| <code>0c33a58f3db5a38d15c95545cb6a0a773b255dd9</code><br />
| <br />
| 1,138,978,972<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad2,2)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-1029.20131022.Llkfc/iPad2,2_7.0.3_11B511_Restore.ipsw iPad2,2_7.0.3_11B511_Restore.ipsw]<br />
| <code>6e410a4be9f353b0bf10c7a69783e15e34e3df70</code><br />
| <br />
| 1,138,793,323<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad2,2)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1767.20131114.P3wE4/iPad2,2_7.0.4_11B554a_Restore.ipsw iPad2,2_7.0.4_11B554a_Restore.ipsw]<br />
| <code>a1c65b49274f7662baa4ce450afde7d7726b04da</code><br />
| <br />
| 1,138,900,912<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad2,2)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2957.20140221.8j5GW/iPad2,2_7.0.6_11B651_Restore.ipsw iPad2,2_7.0.6_11B651_Restore.ipsw]<br />
| <code>a527e5faf8d1e31f359638906b3642fa63a7d02c</code><br />
| <br />
| 1,138,789,787<br />
|}<br />
<br />
==== [[k95ap|iPad2,3]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 4.3<br />
| [[Durango 8F191 (iPad2,3)|8F191]]<br />
| rowspan="6" | Durango<br />
| rowspan="6" | [[2.0.4]]<br />
| 9 Mar 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0334.20110311Plgt5/iPad2,3_4.3_8F191_Restore.ipsw iPad2,3_4.3_8F191_Restore.ipsw]<br />
| <code>435b84104aa3f0ae7883f9d6b1a7a3e96e552dd2</code><br />
| Initial shipment.<br />
| 656,018,665<br />
|-<br />
| 4.3.1<br />
| [[Durango 8G4 (iPad2,3)|8G4]]<br />
| 25 Mar 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0544.20110325.Dew3r/iPad2,3_4.3.1_8G4_Restore.ipsw iPad2,3_4.3.1_8G4_Restore.ipsw]<br />
| <code>1903162ce3ffa9725304eb78275583977d1808cc</code><br />
| <br />
| 650,897,625<br />
|-<br />
| 4.3.2<br />
| [[Durango 8H8 (iPad2,3)|8H8]]<br />
| 14 Apr 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0665.20110414.MbwVr/iPad2,3_4.3.2_8H8_Restore.ipsw iPad2,3_4.3.2_8H8_Restore.ipsw]<br />
| <code>aee35de332048941f72bfbbbdf8591a1f306c65d</code><br />
| <br />
| 651,222,830<br />
|-<br />
| 4.3.3<br />
| [[Durango 8J2 (iPad2,3)|8J2]]<br />
| 4 May 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1014.20110503.52dap/iPad2,3_4.3.3_8J2_Restore.ipsw iPad2,3_4.3.3_8J2_Restore.ipsw]<br />
| <code>f087ae60c778f32bdd130043f8b67a96939489f3</code><br />
| <br />
| 651,189,996<br />
|-<br />
| 4.3.4<br />
| [[Durango 8K2 (iPad2,3)|8K2]]<br />
| 15 Jul 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1917.2011.715.ZbLkn/iPad2,3_4.3.4_8K2_Restore.ipsw iPad2,3_4.3.4_8K2_Restore.ipsw]<br />
| <code>ca17c830b4d847a1d0829817f350850873d43e66</code><br />
| Hotfix to prevent malicious use of [[Saffron]]'s exploits<br />
| 651,132,813<br />
|-<br />
| 4.3.5<br />
| [[Durango 8L1 (iPad2,3)|8L1]]<br />
| 25 Jul 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1962.20110721.rWxrf/iPad2,3_4.3.5_8L1_Restore.ipsw iPad2,3_4.3.5_8L1_Restore.ipsw]<br />
| <code>282c03b30331fd44049d9b4203fd0d145dc477e4</code><br />
| <br />
| 651,250,594<br />
|-<br />
| 5.0<br />
| [[Telluride 9A334 (iPad2,3)|9A334]]<br />
| rowspan="2" | Telluride<br />
| rowspan="2" | [[3.0.03]]<br />
| 12 Oct 2011<br />
| [http://appldnld.apple.com/iPhone4/041-9620.20111012.pnB4r/iPad2,3_5.0_9A334_Restore.ipsw iPad2,3_5.0_9A334_Restore.ipsw]<br />
| <code>b4a17539a1292d08256709411d459e03e763c7d1</code><br />
| <br />
| 756,356,953<br />
|-<br />
| 5.0.1<br />
| [[Telluride 9A405 (iPad2,3)|9A405]]<br />
| 10 Nov 2011<br />
| [http://appldnld.apple.com/iPhone4/041-3312.20111109.zp3ws/iPad2,3_5.0.1_9A405_Restore.ipsw iPad2,3_5.0.1_9A405_Restore.ipsw]<br />
| <code>2f13e6fd75155e88014f04b2ae2aeab484ceb952</code><br />
| <br />
| 773,224,632<br />
|-<br />
| 5.1<br />
| [[Hoodoo 9B176 (iPad2,3)|9B176]]<br />
| rowspan="2" | Hoodoo<br />
| rowspan="12" | [[3.0.04 (MDM6600)|3.0.04]]<br />
| 7 Mar 2012<br />
| [http://appldnld.apple.com/iOS5/041-1541.20120307.WrbS2/iPad2,3_5.1_9B176_Restore.ipsw iPad2,3_5.1_9B176_Restore.ipsw]<br />
| <code>32bedf657dc7e996a75a86cfce47d4b50ddd3d93</code><br />
| <br />
| 778,891,778<br />
|-<br />
| 5.1.1<br />
| [[Hoodoo 9B206 (iPad2,3)|9B206]]<br />
| 10 May 2012<br />
| [http://appldnld.apple.com/iOS5.1.1/041-4297.20120427.NAvbf/iPad2,3_5.1.1_9B206_Restore.ipsw iPad2,3_5.1.1_9B206_Restore.ipsw]<br />
| <code>a6ba4103ed103c43be80b58769f7922592b517a9</code><br />
| <br />
| 779,002,389<br />
|-<br />
| 6.0<br />
| [[Sundance 10A403 (iPad2,3)|10A403]]<br />
| rowspan="2" | Sundance<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-7167.20120919.y2ard/iPad2,3_6.0_10A403_Restore.ipsw iPad2,3_6.0_10A403_Restore.ipsw]<br />
| <code>3916fdd5e6c269dc1c44ddbb1172bdb9abc8cdbc</code><br />
| <br />
| 843,798,909<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPad2,3)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7946.20121101.Mxs3e/iPad2,3_6.0.1_10A523_Restore.ipsw iPad2,3_6.0.1_10A523_Restore.ipsw]<br />
| <code>aa9daddde156105a2f96b18683b6afbe9d2b7d52</code><br />
| <br />
| 843,706,588<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad2,3)|10B141]]<br />
| rowspan="2" | Brighton<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6483.20130128.Gdsob/iPad2,3_6.1_10B141_Restore.ipsw iPad2,3_6.1_10B141_Restore.ipsw]<br />
| <code>908de0af794749e08534c8a48664709a31b508d4</code><br />
| <br />
| 846,987,486<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPad2,3)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0708.20130215.Qm6q4/iPad2,3_6.1.2_10B146_Restore.ipsw iPad2,3_6.1.2_10B146_Restore.ipsw]<br />
| <code>9f0611f0073d073b5afcacad31622e652ab19010</code><br />
| Exchange bug fix. <br />
| 847,028,614<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad2,3)|10B329]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2464.20130319.KF6yt/iPad2,3_6.1.3_10B329_Restore.ipsw iPad2,3_6.1.3_10B329_Restore.ipsw]<br />
| <code>b02a4f3f5b6b948bdcd036caee71449201e72f63</code><br />
|<br />
| 847,289,245<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad2,3)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9471.20130918.Sin12/iPad2,3_7.0_11A465_Restore.ipsw iPad2,3_7.0_11A465_Restore.ipsw]<br />
| <code>83ca40062f963688e095c1670872c77bd1026222</code><br />
| <br />
| 1,137,553,673<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad2,3)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9830.20130924.xfiBi/iPad2,3_7.0.2_11A501_Restore.ipsw iPad2,3_7.0.2_11A501_Restore.ipsw]<br />
| <code>47ca6b2d94bc1d47d1aa25512d702de2553d5bf6</code><br />
| <br />
| 1,137,857,110<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad2,3)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-1027.20131022.cpykg/iPad2,3_7.0.3_11B511_Restore.ipsw iPad2,3_7.0.3_11B511_Restore.ipsw]<br />
| <code>f9ea2f17f9c21af2562d0ccf71f7a391c1c0a45b</code><br />
| <br />
| 1,137,701,903<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad2,3)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1762.20131114.P3wE4/iPad2,3_7.0.4_11B554a_Restore.ipsw iPad2,3_7.0.4_11B554a_Restore.ipsw]<br />
| <code>1b5ca32be0a112b167cc11613a312495d9cd9dff</code><br />
| <br />
| 1,137,806,933<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad2,3)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2954.20140221.8j5GW/iPad2,3_7.0.6_11B651_Restore.ipsw iPad2,3_7.0.6_11B651_Restore.ipsw]<br />
| <code>793f0ec09d243cfdc413d79acc2d84cfce941828</code><br />
| <br />
| 1,137,703,464<br />
|}<br />
<br />
==== [[k93aap|iPad2,4]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 5.1<br />
| [[Hoodoo 9B176 (iPad2,4)|9B176]]<br />
| rowspan="2" | Hoodoo<br />
| 7 Mar 2012<br />
| [http://appldnld.apple.com/iOS5/041-2052.20120307.5JGht/iPad2,4_5.1_9B176_Restore.ipsw iPad2,4_5.1_9B176_Restore.ipsw]<br />
| <code>e559b325fe81279589343f3d2d8bf279247772f9</code><br />
| Initial shipment.<br />
| 764,640,084<br />
|-<br />
| 5.1.1<br />
| [[Hoodoo 9B206 (iPad2,4)|9B206]]<br />
| 10 May 2012<br />
| [http://appldnld.apple.com/iOS5.1.1/041-4295.20120427.8nB8U/iPad2,4_5.1.1_9B206_Restore.ipsw iPad2,4_5.1.1_9B206_Restore.ipsw]<br />
| <code>2dbc44ab9a4c84dd8b3f545270ee4d0e24bcdf62</code><br />
| <br />
| 764,828,572<br />
|-<br />
| 6.0<br />
| [[Sundance 10A403 (iPad2,4)|10A403]]<br />
| rowspan="2" | Sundance<br />
| 12 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-2187.20120919.vmGkW/iPad2,4_6.0_10A403_Restore.ipsw iPad2,4_6.0_10A403_Restore.ipsw]<br />
| <code>a21c644c4c397823cc828f3ae8c1b37538192968</code><br />
| <br />
| 829,044,310<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPad2,4)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7944.20121101.Tre3r/iPad2,4_6.0.1_10A523_Restore.ipsw iPad2,4_6.0.1_10A523_Restore.ipsw]<br />
| <code>8a8532c1ab19ec03b34f1d0c3b15093bc7e7569c</code><br />
| <br />
| 828,968,398<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad2,4)|10B141]]<br />
| rowspan="2" | Brighton<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6478.20130128.Mgr4g/iPad2,4_6.1_10B141_Restore.ipsw iPad2,4_6.1_10B141_Restore.ipsw]<br />
| <code>9499ec3791ea10b30f5085880d7fb1249c844888</code><br />
| <br />
| 832,075,445<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPad2,4)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0750.20130215.Fb65t/iPad2,4_6.1.2_10B146_Restore.ipsw iPad2,4_6.1.2_10B146_Restore.ipsw]<br />
| <code>e473e3f7d3c23fd2675c0caf124c26ef9a0c214c</code><br />
| Exchange bug fix. <br />
| 832,088,422<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad2,4)|10B329]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2633.20130319.Xd54r/iPad2,4_6.1.3_10B329_Restore.ipsw iPad2,4_6.1.3_10B329_Restore.ipsw]<br />
| <code>120e8ffec8a8564728704c06b93d06c3a4e94d23</code><br />
|<br />
| 832,493,873<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad2,4)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9487.20130918.u45rf/iPad2,4_7.0_11A465_Restore.ipsw iPad2,4_7.0_11A465_Restore.ipsw]<br />
| <code>f0d32b53656d2ef22f9d80afbd5ded4331e66cbf</code><br />
| <br />
| 1,121,444,938<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad2,4)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9881.20130924.yCStT/iPad2,4_7.0.2_11A501_Restore.ipsw iPad2,4_7.0.2_11A501_Restore.ipsw]<br />
| <code>4b64602bc23b462a934fb1b9e8654fff85d92b32</code><br />
| <br />
| 1,121,792,963<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad2,4)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0955.20131022.Lion3/iPad2,4_7.0.3_11B511_Restore.ipsw iPad2,4_7.0.3_11B511_Restore.ipsw]<br />
| <code>dbeea8194daab6b4c0b3add7651fc8ae9dc17976</code><br />
| <br />
| 1,121,563,378<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad2,4)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1843.20131114.P3wE4/iPad2,4_7.0.4_11B554a_Restore.ipsw iPad2,4_7.0.4_11B554a_Restore.ipsw]<br />
| <code>4ea96465334bcf2f0205a9e2f716c06617f4b671</code><br />
| <br />
| 1,121,418,985<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad2,4)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-3032.20140221.8j5GW/iPad2,4_7.0.6_11B651_Restore.ipsw iPad2,4_7.0.6_11B651_Restore.ipsw]<br />
| <code>8473134743d299b1f9274b5c13507727c5bcd8bf</code><br />
| <br />
| 1,121,643,921<br />
|}<br />
<br />
=== [[iPad 3]] ===<br />
==== [[j1ap|iPad3,1]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 5.1<br />
| [[Hoodoo 9B176 (iPad 3 Wi-Fi)|9B176]]<br />
| rowspan="2" | Hoodoo<br />
| 7 Mar 2012<br />
| [http://appldnld.apple.com/iOS5/041-1954.20120307.FFase/iPad3,1_5.1_9B176_Restore.ipsw iPad3,1_5.1_9B176_Restore.ipsw]<br />
| <code>47377eba715b3536e3f1685b8a5b10606b5a41ed</code><br />
| Initial shipment.<br />
| 1,116,116,546<br />
|-<br />
| 5.1.1<br />
| [[Hoodoo 9B206 (iPad 3 Wi-Fi)|9B206]]<br />
| 10 May 2012<br />
| [http://appldnld.apple.com/iOS5.1.1/041-4327.20120427.xW6U6/iPad3,1_5.1.1_9B206_Restore.ipsw iPad3,1_5.1.1_9B206_Restore.ipsw]<br />
| <code>e09c8a2e6dc015b6344cafd9cdd181f9e865b26f</code><br />
| <br />
| 1,116,227,820<br />
|-<br />
| 6.0<br />
| [[Sundance 10A403 (iPad 3 Wi-Fi)|10A403]]<br />
| rowspan="2" | Sundance<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-3515.20120919.OYzOG/iPad3,1_6.0_10A403_Restore.ipsw iPad3,1_6.0_10A403_Restore.ipsw]<br />
| <code>242a1802392f212dc070a88480a482f4a118692c</code><br />
| <br />
| 1,149,395,453<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPad 3 Wi-Fi)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7940.20121101.Sand6/iPad3,1_6.0.1_10A523_Restore.ipsw iPad3,1_6.0.1_10A523_Restore.ipsw]<br />
| <code>b5670ddb2f300c42434dd5c551a8a0ad170a4e09</code><br />
| <br />
| 1,149,432,591<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad 3 Wi-Fi)|10B141]]<br />
| rowspan="2" | Brighton<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6462.20130128.cnlgh5/iPad3,1_6.1_10B141_Restore.ipsw iPad3,1_6.1_10B141_Restore.ipsw]<br />
| <code>f6f1f831b5edac27deaf68fcc4e692fdb02181a4</code><br />
| <br />
| 1,157,252,488<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPad 3 Wi-Fi)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0736.20130215.Wwft4/iPad3,1_6.1.2_10B146_Restore.ipsw iPad3,1_6.1.2_10B146_Restore.ipsw]<br />
| <code>ec85e851bc57f54749d71c910b570baf6f7803fd</code><br />
| Exchange bug fix. <br />
| 1,157,225,703<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad 3 Wi-Fi)|10B329]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2576.20130319.JeX43/iPad3,1_6.1.3_10B329_Restore.ipsw iPad3,1_6.1.3_10B329_Restore.ipsw]<br />
| <code>4c2a39d499004e53e9ce0edd81e4fad78fb0d0ec</code><br />
|<br />
| 1,157,566,764<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad 3 Wi-Fi)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9480.20130918.Qvy54/iPad3,1_7.0_11A465_Restore.ipsw iPad3,1_7.0_11A465_Restore.ipsw]<br />
| <code>ce19cc080da7bbd1e5cae8776e090b7a59df21bf</code><br />
| <br />
| 1,403,956,911<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad 3 Wi-Fi)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9859.20130924.r3x8l/iPad3,1_7.0.2_11A501_Restore.ipsw iPad3,1_7.0.2_11A501_Restore.ipsw]<br />
| <code>1b4904d5c87f557e33462cf7029878f7e3629e40</code><br />
| <br />
| 1,404,228,667<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad 3 Wi-Fi)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0929.20131022.092ed/iPad3,1_7.0.3_11B511_Restore.ipsw iPad3,1_7.0.3_11B511_Restore.ipsw]<br />
| <code>63648a561d10766221fc26daa753e88bb176614f</code><br />
| <br />
| 1,403,837,704<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad 3 Wi-Fi)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1815.20131114.P3wE4/iPad3,1_7.0.4_11B554a_Restore.ipsw iPad3,1_7.0.4_11B554a_Restore.ipsw]<br />
| <code>515811f329671ff057412c2051933d7faea74585</code><br />
| <br />
| 1,403,855,634<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad 3 Wi-Fi)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-3005.20140221.8j5GW/iPad3,1_7.0.6_11B651_Restore.ipsw iPad3,1_7.0.6_11B651_Restore.ipsw]<br />
| <code>436d47eb17377570dc2077671450da61c3dfeab3</code><br />
| <br />
| 1,403,848,852<br />
|}<br />
<br />
==== [[j2ap|iPad3,2]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 5.1<br />
| [[Hoodoo 9B176 (iPad 3 CDMA)|9B176]]<br />
| rowspan="2" | Hoodoo<br />
| [[1.0.10]]<br />
| 7 Mar 2012<br />
| [http://appldnld.apple.com/iOS5/041-1955.20120307.CQvrt/iPad3,2_5.1_9B176_Restore.ipsw iPad3,2_5.1_9B176_Restore.ipsw]<br />
| <code>eadcdc38961a280398344482348371cc99c6b17a</code><br />
| Initial shipment.<br />
| 1,133,434,898<br />
|-<br />
| 5.1.1<br />
| [[Hoodoo 9B206 (iPad 3 CDMA)|9B206]]<br />
| [[1.0.11 (MDM9x00)|1.0.11]]<br />
| 10 May 2012<br />
| [http://appldnld.apple.com/iOS5.1.1/041-4328.20120427.1sCra/iPad3,2_5.1.1_9B206_Restore.ipsw iPad3,2_5.1.1_9B206_Restore.ipsw]<br />
| <code>b2a916c58d42641c7b8b98d530c35371b7c66656</code><br />
| <br />
| 1,133,459,884<br />
|-<br />
| 6.0<br />
| [[Sundance 10A403 (iPad 3 CDMA)|10A403]]<br />
| rowspan="2" | Sundance<br />
| rowspan="2" | [[2.0.02]]<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-7161.20120919.5CyjO/iPad3,2_6.0_10A403_Restore.ipsw iPad3,2_6.0_10A403_Restore.ipsw]<br />
| <code>a81a4557fbd134033c31727e0f8b0c79b15edea2</code><br />
| <br />
| 1,182,296,996<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPad 3 CDMA)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7941.20121101.Sami5/iPad3,2_6.0.1_10A523_Restore.ipsw iPad3,2_6.0.1_10A523_Restore.ipsw]<br />
| <code>255b9c46e31cb21440e998e4210e8b04e597d2de</code><br />
| <br />
| 1,182,238,888<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad 3 CDMA)|10B141]]<br />
| rowspan="2" | Brighton<br />
| rowspan="2" | [[2.3.03]]<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-5907.20130128.tgt54/iPad3,2_6.1_10B141_Restore.ipsw iPad3,2_6.1_10B141_Restore.ipsw]<br />
| <code>ccf3592bd95f5a99b33545e0009a854834ac8efe</code><br />
| <br />
| 1,190,049,008<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPad 3 CDMA)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0710.20130215.Vfgst/iPad3,2_6.1.2_10B146_Restore.ipsw iPad3,2_6.1.2_10B146_Restore.ipsw]<br />
| <code>26887ff4004229fa7dac395557294877b8cbbc59</code><br />
| Exchange bug fix. <br />
| 1,190,140,557<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad 3 CDMA)|10B329]]<br />
| BrightonMaps<br />
| [[2.3.04]]<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2432.20130319.Be867/iPad3,2_6.1.3_10B329_Restore.ipsw iPad3,2_6.1.3_10B329_Restore.ipsw]<br />
| <code>4e2b6b01f226838925c33ffa58c5ba6dcb214d81</code><br />
|<br />
| 1,190,453,074<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad 3 CDMA)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| rowspan="2" | [[4.0.01]]<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9467.20130918.GT54R/iPad3,2_7.0_11A465_Restore.ipsw iPad3,2_7.0_11A465_Restore.ipsw]<br />
| <code>55639a0d2f70763834d894d43c22064846dd3b00</code><br />
| <br />
| 1,438,713,523<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad 3 CDMA)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9815.20130924.jhXk0/iPad3,2_7.0.2_11A501_Restore.ipsw iPad3,2_7.0.2_11A501_Restore.ipsw]<br />
| <code>fff678e22a192d98dde82000c6c89e8a594d2601</code><br />
| <br />
| 1,438,926,724<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad 3 CDMA)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| rowspan="3" | [[4.1.02]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0880.20131022.Pag3r/iPad3,2_7.0.3_11B511_Restore.ipsw iPad3,2_7.0.3_11B511_Restore.ipsw]<br />
| <code>142fc09ddd458e08328bc78801d858bf6f6c8f0c</code><br />
| <br />
| 1,438,542,373<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad 3 CDMA)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1744.20131114.P3wE4/iPad3,2_7.0.4_11B554a_Restore.ipsw iPad3,2_7.0.4_11B554a_Restore.ipsw]<br />
| <code>c5bd47788b7a14490a7779c7c6c813b203f7126a</code><br />
| <br />
| 1,438,505,017<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad 3 CDMA)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2939.20140221.8j5GW/iPad3,2_7.0.6_11B651_Restore.ipsw iPad3,2_7.0.6_11B651_Restore.ipsw]<br />
| <code>7e3dfe7e3668496c001bd5ced52753646eed3c6e</code><br />
| <br />
| 1,438,566,490<br />
|}<br />
<br />
==== [[j2aap|iPad3,3]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 5.1<br />
| [[Hoodoo 9B176 (iPad 3 Global)|9B176]]<br />
| rowspan="2" | Hoodoo<br />
| [[1.0.10]]<br />
| 7 Mar 2012<br />
| [http://appldnld.apple.com/iOS5/041-1956.20120307.jzugh/iPad3,3_5.1_9B176_Restore.ipsw iPad3,3_5.1_9B176_Restore.ipsw]<br />
| <code>dd0d3d2bbf299459c7bf8db59b1e2daed9addead</code><br />
| Initial shipment.<br />
| 1,133,402,209<br />
|-<br />
| 5.1.1<br />
| [[Hoodoo 9B206 (iPad 3 Global)|9B206]]<br />
| [[1.0.11 (MDM9x00)|1.0.11]]<br />
| 10 May 2012<br />
| [http://appldnld.apple.com/iOS5.1.1/041-4329.20120427.LTkro/iPad3,3_5.1.1_9B206_Restore.ipsw iPad3,3_5.1.1_9B206_Restore.ipsw]<br />
| <code>d294f3d2db8193033fa28de98347bb728d1a5e7a</code><br />
| <br />
| 1,133,545,818<br />
|-<br />
| 6.0<br />
| [[Sundance 10A403 (iPad 3 Global)|10A403]]<br />
| rowspan="2" | Sundance<br />
| rowspan="2" | [[2.0.02]]<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-7163.20120919.19UEI/iPad3,3_6.0_10A403_Restore.ipsw iPad3,3_6.0_10A403_Restore.ipsw]<br />
| <code>02ae5aeef497d4847e836c5866b9b77d1fbac7c7</code><br />
| <br />
| 1,182,367,743<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPad 3 Global)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7943.20121101.DuI5t/iPad3,3_6.0.1_10A523_Restore.ipsw iPad3,3_6.0.1_10A523_Restore.ipsw]<br />
| <code>2f6c515904464d01dfc4743debf656c1c01293cb</code><br />
| <br />
| 1,182,263,670<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad 3 Global)|10B141]]<br />
| rowspan="2" | Brighton<br />
| rowspan="2" | [[2.3.03]]<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6467.20130128.Ugw14/iPad3,3_6.1_10B141_Restore.ipsw iPad3,3_6.1_10B141_Restore.ipsw]<br />
| <code>ca04e4a4bcc898497036e636e35d6863652112b4</code><br />
| <br />
| 1,190,269,932<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPad 3 Global)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0747.20130215.6994G/iPad3,3_6.1.2_10B146_Restore.ipsw iPad3,3_6.1.2_10B146_Restore.ipsw]<br />
| <code>acc7fb2f474dd05a79cf011cca0ab6e3611d268d</code><br />
| Exchange bug fix. <br />
| 1,190,242,049<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad 3 Global)|10B329]]<br />
| BrightonMaps<br />
| [[2.3.04]]<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2592.20130319.64uy6/iPad3,3_6.1.3_10B329_Restore.ipsw iPad3,3_6.1.3_10B329_Restore.ipsw]<br />
| <code>5dee332abebbb3924d176cfa5e6ee7b76f1cc46f</code><br />
|<br />
| 1,190,447,288<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad 3 Global)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| rowspan="2" | [[4.0.01]]<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9483.20130918.AOc12/iPad3,3_7.0_11A465_Restore.ipsw iPad3,3_7.0_11A465_Restore.ipsw]<br />
| <code>7c33998c89a696a100b29c76f1e1737d81dc4f40</code><br />
| <br />
| 1,438,751,475<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad 3 Global)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9866.20130924.ngB18/iPad3,3_7.0.2_11A501_Restore.ipsw iPad3,3_7.0.2_11A501_Restore.ipsw]<br />
| <code>99dbc00b195331a7d11bad3be6c6bba8d6f0ca1f</code><br />
| <br />
| 1,439,074,180<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad 3 Global)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| rowspan="3" | [[4.1.02]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0938.20131022.Qw23d/iPad3,3_7.0.3_11B511_Restore.ipsw iPad3,3_7.0.3_11B511_Restore.ipsw]<br />
| <code>058584c846fa340e1b693cc4b63e945cde2d16d1</code><br />
| <br />
| 1,438,568,686<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad 3 Global)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1823.20131114.P3wE4/iPad3,3_7.0.4_11B554a_Restore.ipsw iPad3,3_7.0.4_11B554a_Restore.ipsw]<br />
| <code>4ec8a7e263ea2d1bcfbb0f11018d0ee182344e84</code><br />
| <br />
| 1,438,695,606<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad 3 Global)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-3012.20140221.8j5GW/iPad3,3_7.0.6_11B651_Restore.ipsw iPad3,3_7.0.6_11B651_Restore.ipsw]<br />
| <code>c58e8ad06414398974dbb37547a444fa441cb07a</code><br />
| <br />
| 1,438,613,683<br />
|}<br />
<br />
=== [[iPad 4]] ===<br />
==== [[p101ap|iPad3,4]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 6.0<br />
| [[Sundance 10A407 (iPad 4 Wi-Fi)|10A407]]<br />
| rowspan="2" | Sundance<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/041-7543.20121101.trs43/iPad3,4_6.0_10A407_Restore.ipsw iPad3,4_6.0_10A407_Restore.ipsw]<br />
| <code>681b5e7cbb2f385ddbf57af5c163cc6b64212e65</code><br />
| Initial shipment.<br />
| 1,171,280,572<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPad 4 Wi-Fi)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7858.20121101.Hbhy6/iPad3,4_6.0.1_10A523_Restore.ipsw iPad3,4_6.0.1_10A523_Restore.ipsw]<br />
| <code>278c41801594141a5b582f37591352c9c3658514</code><br />
|<br />
| 1,171,234,478<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad 4 Wi-Fi)|10B141]]<br />
| rowspan="2" | Brighton<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6468.20130128.Ch565/iPad3,4_6.1_10B141_Restore.ipsw iPad3,4_6.1_10B141_Restore.ipsw]<br />
| <code>7aebea7c074ae88fc5d49c96133be8b6d74e909a</code><br />
| <br />
| 1,174,632,808<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPad 4 Wi-Fi)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0734.20130215.543df/iPad3,4_6.1.2_10B146_Restore.ipsw iPad3,4_6.1.2_10B146_Restore.ipsw]<br />
| <code>097799dce920dd210a77e5319300e2ced3e80028</code><br />
| Exchange bug fix. <br />
| 1,174,563,463<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad 4 Wi-Fi)|10B329]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2407.20130319.vs6yt/iPad3,4_6.1.3_10B329_Restore.ipsw iPad3,4_6.1.3_10B329_Restore.ipsw]<br />
| <code>e4de25259eff8deb00859c0482e57c02630b3103</code><br />
|<br />
| 1,174,878,398<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad 4 Wi-Fi)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9465.20130918.OBH6T/iPad3,4_7.0_11A465_Restore.ipsw iPad3,4_7.0_11A465_Restore.ipsw]<br />
| <code>e5551865ce19e8a97a4880364212daa266abaf9c</code><br />
| <br />
| 1,419,494,798<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad 4 Wi-Fi)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9811.20130924.bz21c/iPad3,4_7.0.2_11A501_Restore.ipsw iPad3,4_7.0.2_11A501_Restore.ipsw]<br />
| <code>3b6bc668a0f76a22f1b54cd19908ea0793f6a2d4</code><br />
| <br />
| 1,419,751,121<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad 4 Wi-Fi)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0868.20131022.444e3/iPad3,4_7.0.3_11B511_Restore.ipsw iPad3,4_7.0.3_11B511_Restore.ipsw]<br />
| <code>292ec5790b620bab25a689320e44ad6889f49fbb</code><br />
| <br />
| 1,419,296,299<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad 4 Wi-Fi)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1725.20131114.P3wE4/iPad3,4_7.0.4_11B554a_Restore.ipsw iPad3,4_7.0.4_11B554a_Restore.ipsw]<br />
| <code>9885eafcc31bf65331da3629b43d6fa3eb1ce08d</code><br />
| <br />
| 1,419,411,059<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad 4 Wi-Fi)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2921.20140221.8j5GW/iPad3,4_7.0.6_11B651_Restore.ipsw iPad3,4_7.0.6_11B651_Restore.ipsw]<br />
| <code>54ff23e3dbb5ab78c4af8e3eb76038ebbec3f2cd</code><br />
| <br />
| 1,419,421,328<br />
|}<br />
<br />
==== [[p102ap|iPad3,5]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename <br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 6.0.1<br />
| [[SundanceTaos 10A8426 (iPad 4 GSM)|10A8426]]<br />
| SundanceTaos<br />
| [[2.03.09]]<br />
| 9 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-5481.20121109.aPCdk/iPad3,5_6.0.1_10A8426_Restore.ipsw iPad3,5_6.0.1_10A8426_Restore.ipsw]<br />
| <code>488dd71c9bb7f4b8df83c9bc778fb6adcd2dc12d</code><br />
| Initial shipment.<br />
| 1,210,479,774<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad 4 GSM)|10B141]]<br />
| rowspan="2" | Brighton<br />
| [[3.04.24]]<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6608.20130128.6605t/iPad3,5_6.1_10B141_Restore.ipsw iPad3,5_6.1_10B141_Restore.ipsw]<br />
| <code>ec210c9d682900b16ae41fae776afcb9d09639e4</code><br />
| <br />
| 1,213,624,570<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B147 (iPad 4 GSM)|10B147]]<br />
| rowspan="2" | [[3.04.25]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0719.20130215.FssOd/iPad3,5_6.1.2_10B147_Restore.ipsw iPad3,5_6.1.2_10B147_Restore.ipsw]<br />
| <code>cac221fdaab3ebaf3f231187c4c2abe3a644b172</code><br />
| Exchange bug fix. <br />
| 1,213,692,168<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad 4 GSM)|10B329]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2560.20130319.ySu43/iPad3,5_6.1.3_10B329_Restore.ipsw iPad3,5_6.1.3_10B329_Restore.ipsw]<br />
| <code>e2765c0d546a0edb21241aeb56c53dbfe6c1f684</code><br />
|<br />
| 1,214,068,430<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad 4 GSM)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| rowspan="2" | [[5.00.01]]<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9479.20130918.grt5t/iPad3,5_7.0_11A465_Restore.ipsw iPad3,5_7.0_11A465_Restore.ipsw]<br />
| <code>a4e7b308404a8baef2099c8006b770d8bb7a7316</code><br />
| <br />
| 1,478,626,754<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad 4 GSM)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9855.20130924.kp7DF/iPad3,5_7.0.2_11A501_Restore.ipsw iPad3,5_7.0.2_11A501_Restore.ipsw]<br />
| <code>ca4b90b2145f077c1c2feeae1a699f9e176e65d8</code><br />
| <br />
| 1,478,892,771<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad 4 GSM)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| rowspan="3" | [[5.02.00]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0924.20131022.vajre/iPad3,5_7.0.3_11B511_Restore.ipsw iPad3,5_7.0.3_11B511_Restore.ipsw]<br />
| <code>d3558136515a614c9032e59c171d3b35f24e115b</code><br />
| <br />
| 1,478,349,454<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad 4 GSM)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1807.20131114.P3wE4/iPad3,5_7.0.4_11B554a_Restore.ipsw iPad3,5_7.0.4_11B554a_Restore.ipsw]<br />
| <code>0952412579a5feaaecd272f86dda82ad43bc3aae</code><br />
| <br />
| 1,478,303,874<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad 4 GSM)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2996.20140221.8j5GW/iPad3,5_7.0.6_11B651_Restore.ipsw iPad3,5_7.0.6_11B651_Restore.ipsw]<br />
| <code>bccf2a48649bd1139e840342659d7fdc2add8421</code><br />
| <br />
| 1,478,290,567<br />
|}<br />
<br />
==== [[p103ap|iPad3,6]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 6.0.1<br />
| [[SundanceTaos 10A8426 (iPad 4 Global)|10A8426]]<br />
| SundanceTaos<br />
| [[2.03.09]]<br />
| 9 Nov 2012<br />
| [http://appldnld.apple.com//iOS6/041-5482.20121209.479Gv/iPad3,6_6.0.1_10A8426_Restore.ipsw iPad3,6_6.0.1_10A8426_Restore.ipsw]<br />
| <code>2396de5f9581f473f695fdeb0ba33f9aa2502966</code><br />
| Initial shipment.<br />
| 1,210,416,676<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad 4 Global)|10B141]]<br />
| rowspan="2" | Brighton<br />
| [[3.04.24]]<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6611.20130128.cagw3/iPad3,6_6.1_10B141_Restore.ipsw iPad3,6_6.1_10B141_Restore.ipsw]<br />
| <code>4119ccedf339daafcfab794ef3b8b211e7e3c547</code><br />
| <br />
| 1,213,820,448<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B147 (iPad 4 Global)|10B147]]<br />
| rowspan="2" | [[3.04.25]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0721.20130215.FkaJr/iPad3,6_6.1.2_10B147_Restore.ipsw iPad3,6_6.1.2_10B147_Restore.ipsw]<br />
| <code>63a982c781692e9f9eaed32db134fe0c5fcbf8ce</code><br />
| Exchange bug fix. <br />
| 1,213,809,705<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad 4 Global)|10B329]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2347.20130319.Aqwe3/iPad3,6_6.1.3_10B329_Restore.ipsw iPad3,6_6.1.3_10B329_Restore.ipsw]<br />
| <code>a7df3c07ec9ff56fc229cddd7bd5c667f83fecc5</code><br />
|<br />
| 1,214,243,848<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad 4 Global)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| rowspan="2" | [[5.00.01]]<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9461.20130918.Bqjnt/iPad3,6_7.0_11A465_Restore.ipsw iPad3,6_7.0_11A465_Restore.ipsw]<br />
| <code>8b9ff5b606daf3864d3ec8890fd036ee7089281d</code><br />
| <br />
| 1,478,669,811<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad 4 Global)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9793.20130924.Et3Tj/iPad3,6_7.0.2_11A501_Restore.ipsw iPad3,6_7.0.2_11A501_Restore.ipsw]<br />
| <code>6dcbcac6d3a3ffef88bf08984d4a59c78bf061a3</code><br />
| <br />
| 1,478,866,008<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad 4 Global)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| rowspan="3" | [[5.02.00]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0852.20131022.Okedf/iPad3,6_7.0.3_11B511_Restore.ipsw iPad3,6_7.0.3_11B511_Restore.ipsw]<br />
| <code>eaaee02d65f2e4271f87aed4f10a0aea8b14b234</code><br />
| <br />
| 1,478,543,809<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad 4 Global)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1863.20131114.P3wE4/iPad3,6_7.0.4_11B554a_Restore.ipsw iPad3,6_7.0.4_11B554a_Restore.ipsw]<br />
| <code>d0674fb72cf831e7df3fb0ccc8507358fbb474fb</code><br />
| <br />
| 1,478,513,059<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad 4 Global)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2904.20140221.8j5GW/iPad3,6_7.0.6_11B651_Restore.ipsw iPad3,6_7.0.6_11B651_Restore.ipsw]<br />
| <code>eb9748312ecf321286bd475ab5e10939a097c0de</code><br />
| <br />
| 1,478,520,369<br />
|}<br />
<br />
=== [[iPad Air]] ===<br />
==== [[j71ap|iPad4,1]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad Air Wi-Fi)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0904.20131022.Estog/iPad4,1_7.0.3_11B511_Restore.ipsw iPad4,1_7.0.3_11B511_Restore.ipsw]<br />
| <code>230afdd67a76a4025b2e47d201bc9f14ff5712a8</code><br />
| Initial shipment.<br />
| 1,574,469,851<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad Air Wi-Fi)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1783.20131114.P3wE4/iPad4,1_7.0.4_11B554a_Restore.ipsw iPad4,1_7.0.4_11B554a_Restore.ipsw]<br />
| <code>4ec62dd7bdcb6577ab681ce7331eee957c7c5104</code><br />
| <br />
| 1,574,458,112<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad Air Wi-Fi)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2972.20140221.8j5GW/iPad4,1_7.0.6_11B651_Restore.ipsw iPad4,1_7.0.6_11B651_Restore.ipsw]<br />
| <code>f3fe1c243477251118ee5b59aacb1703f058cec2</code><br />
| <br />
| 1,574,473,425<br />
|}<br />
<br />
==== [[j72ap|iPad4,2]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad Air Cellular)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| [[1.02.02]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0939.20131022.10Cpy/iPad4,2_7.0.3_11B511_Restore.ipsw iPad4,2_7.0.3_11B511_Restore.ipsw]<br />
| <code>1041bd228e36f37d323c68bd7b03737d14855fdd</code><br />
| Initial shipment.<br />
| 1,642,052,411<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad Air Cellular)|11B554a]]<br />
| [[1.03.01]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1824.20131114.P3wE4/iPad4,2_7.0.4_11B554a_Restore.ipsw iPad4,2_7.0.4_11B554a_Restore.ipsw]<br />
| <code>1e0f709d716f906d2a9c197dc20e2d2174e634f5</code><br />
| <br />
| 1,642,100,893<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad Air Cellular)|11B651]]<br />
| [[1.03.02]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-3013.20140221.8j5GW/iPad4,2_7.0.6_11B651_Restore.ipsw iPad4,2_7.0.6_11B651_Restore.ipsw]<br />
| <code>f860669e71b370f5b7cb920b130062561a6667f2</code><br />
| <br />
| 1,642,150,659<br />
|}<br />
<br />
== [[iPad mini]] ==<br />
=== [[iPad mini 1G]] ===<br />
==== [[p105ap|iPad2,5]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 6.0<br />
| [[Sundance 10A406 (iPad mini 1G Wi-Fi)|10A406]]<br />
| rowspan="3" | Sundance<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/041-5525.20121101.Rstre/iPad2,5_6.0_10A406_Restore.ipsw iPad2,5_6.0_10A406_Restore.ipsw]<br />
| <code>f60d64fe30dbc2396e6f3dedc3b8683ffef1d99f</code><br />
| Initial shipment.<br />
| 858,741,949<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPad mini 1G Wi-Fi)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7859.20121101.gys65/iPad2,5_6.0.1_10A523_Restore.ipsw iPad2,5_6.0.1_10A523_Restore.ipsw]<br />
| <code>4210d4c9c5f9501c752a43a4efe5a11fbf9fbbdc</code><br />
| <br />
| 858,734,598<br />
|-<br />
| 6.0.2<br />
| [[Sundance 10A550 (iPad mini 1G Wi-Fi)|10A550]]<br />
| 19 Dec 2012<br />
| [http://appldnld.apple.com/iOS6/041-0785.20121217.Fvrt4/iPad2,5_6.0.2_10A550_Restore.ipsw iPad2,5_6.0.2_10A550_Restore.ipsw]<br />
| <code>2478703098b51df1928747639983c825a3d03612</code><br />
| <br />
| 900,517,068<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad mini 1G Wi-Fi)|10B141]]<br />
| rowspan="3" | Brighton<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6469.20130128.tasor/iPad2,5_6.1_10B141_Restore.ipsw iPad2,5_6.1_10B141_Restore.ipsw]<br />
| <code>3c56f63764c7f4e01f129bb190104c8e4b419fee</code><br />
| <br />
| 859,488,333<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPad mini 1G Wi-Fi)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0746.20130215.436Gb/iPad2,5_6.1.2_10B146_Restore.ipsw iPad2,5_6.1.2_10B146_Restore.ipsw]<br />
| <code>09a0196d309465387afd4a6b11a610a32a39ce15</code><br />
| Exchange bug fix. <br />
| 859,491,043<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad mini 1G Wi-Fi)|10B329]]<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2417.20130319.Nh23w/iPad2,5_6.1.3_10B329_Restore.ipsw iPad2,5_6.1.3_10B329_Restore.ipsw]<br />
| <code>02a679b092037c2086fb27646c1ca2698307c7f4</code><br />
| <br />
| 859,761,674<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad mini 1G Wi-Fi)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9466.20130918.F9UYG/iPad2,5_7.0_11A465_Restore.ipsw iPad2,5_7.0_11A465_Restore.ipsw]<br />
| <code>9748b5abaf640b5b74cbf02dbfc65a0e99ba9f07</code><br />
| <br />
| 1,192,579,837<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad mini 1G Wi-Fi)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9812.20130924.S2dgY/iPad2,5_7.0.2_11A501_Restore.ipsw iPad2,5_7.0.2_11A501_Restore.ipsw]<br />
| <code>0c34dac95389922e2ae94245931230215c9f32df</code><br />
| <br />
| 1,192,898,475<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad mini 1G Wi-Fi)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0870.20131022.ser34/iPad2,5_7.0.3_11B511_Restore.ipsw iPad2,5_7.0.3_11B511_Restore.ipsw]<br />
| <code>f6e7398a6eaac7fa22360c1c71cdda2afff28f99</code><br />
| <br />
| 1,192,732,645<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad mini 1G Wi-Fi)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1732.20131114.P3wE4/iPad2,5_7.0.4_11B554a_Restore.ipsw iPad2,5_7.0.4_11B554a_Restore.ipsw]<br />
| <code>41301bbaea6d3bd1bca7f739bd84c4a9ceb98d0d</code><br />
| <br />
| 1,192,721,560<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad mini 1G Wi-Fi)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2927.20140221.8j5GW/iPad2,5_7.0.6_11B651_Restore.ipsw iPad2,5_7.0.6_11B651_Restore.ipsw]<br />
| <code>7a65128ca6ae525492e4bc67e8c5167fbb46560f</code><br />
| <br />
| 1,192,699,391<br />
|}<br />
<br />
==== [[p106ap|iPad2,6]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 6.0.1<br />
| [[SundanceTaos 10A8426 (iPad mini 1G GSM)|10A8426]]<br />
| rowspan="2" | SundanceTaos<br />
| rowspan="2" | [[2.03.09]]<br />
| 9 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-5484.20121109.ALets/iPad2,6_6.0.1_10A8426_Restore.ipsw iPad2,6_6.0.1_10A8426_Restore.ipsw]<br />
| <code>95efc0e3f6f489035f245b119c9f9db9eac1d822</code><br />
| Initial shipment.<br />
| 897,743,316<br />
|-<br />
| 6.0.2<br />
| [[SundanceTaos 10A8500 (iPad mini 1G GSM)|10A8500]]<br />
| 19 Dec 2012<br />
| [http://appldnld.apple.com/iOS6/041-9158.20121217.d65tr/iPad2,6_6.0.2_10A8500_Restore.ipsw iPad2,6_6.0.2_10A8500_Restore.ipsw]<br />
| <code>d6670bf5e2848f48be3fb502fda293a5c298d698</code><br />
| <br />
| 940,572,672<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad mini 1G GSM)|10B141]]<br />
| rowspan="3" | Brighton<br />
| [[3.04.24]]<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6613.20130128.Pre3r/iPad2,6_6.1_10B141_Restore.ipsw iPad2,6_6.1_10B141_Restore.ipsw]<br />
| <code>5f7e9bc2ad0bd60d15f7e390e36db4624346ed16</code><br />
| <br />
| 898,661,102<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B147 (iPad mini 1G GSM)|10B147]]<br />
| rowspan="2" | [[3.04.25]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0749.20130215.96TgY/iPad2,6_6.1.2_10B147_Restore.ipsw iPad2,6_6.1.2_10B147_Restore.ipsw]<br />
| <code>840f08c508df9beb9a8ee1220878154ff76b08ce</code><br />
| Exchange bug fix. <br />
| 898,698,946<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad mini 1G GSM)|10B329]]<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2461.20130319.Hgt54/iPad2,6_6.1.3_10B329_Restore.ipsw iPad2,6_6.1.3_10B329_Restore.ipsw]<br />
| <code>bc507ad8eec55f0e084486e23436fef271248e70</code><br />
| <br />
| 898,933,835<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad mini 1G GSM)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| rowspan="2" | [[5.00.01]]<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9470.20130918.vvn4r/iPad2,6_7.0_11A465_Restore.ipsw iPad2,6_7.0_11A465_Restore.ipsw]<br />
| <code>a3f0f1d2c53ef2505084d0a6438ac484b79b2867</code><br />
| <br />
| 1,232,515,525<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad mini 1G GSM)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9829.20130924.eVzUT/iPad2,6_7.0.2_11A501_Restore.ipsw iPad2,6_7.0.2_11A501_Restore.ipsw]<br />
| <code>21b8f1f7d9ca54b9b9bb67513436f868b0879260</code><br />
| <br />
| 1,232,833,767<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad mini 1G GSM)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| rowspan="3" | [[5.02.00]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0891.20131022.mmanD/iPad2,6_7.0.3_11B511_Restore.ipsw iPad2,6_7.0.3_11B511_Restore.ipsw]<br />
| <code>26e33d318e36aabc47dbb9abbbe5d65f31415b6d</code><br />
| <br />
| 1,232,674,471<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad mini 1G GSM)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1761.20131114.P3wE4/iPad2,6_7.0.4_11B554a_Restore.ipsw iPad2,6_7.0.4_11B554a_Restore.ipsw]<br />
| <code>68ee2b59eaf51714db5614acf3ff6ea258109273</code><br />
| <br />
| 1,232,671,436<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad mini 1G GSM)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2953.20140221.8j5GW/iPad2,6_7.0.6_11B651_Restore.ipsw iPad2,6_7.0.6_11B651_Restore.ipsw]<br />
| <code>3ea68058edd1ceb5d7c4b459f3f9256870952f53</code><br />
| <br />
| 1,232,641,212<br />
|}<br />
<br />
==== [[p107ap|iPad2,7]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 6.0.1<br />
| [[SundanceTaos 10A8426 (iPad mini 1G Global)|10A8426]]<br />
| rowspan="2" | SundanceTaos<br />
| rowspan="2" | [[2.03.09]]<br />
| 9 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-5485.20121109.Zp6Ki/iPad2,7_6.0.1_10A8426_Restore.ipsw iPad2,7_6.0.1_10A8426_Restore.ipsw]<br />
| <code>8cbcdc63854905e9326a584537202715cc2f31e3</code><br />
| Initial shipment.<br />
| 897,931,321<br />
|-<br />
| 6.0.2<br />
| [[SundanceTaos 10A8500 (iPad mini 1G Global)|10A8500]]<br />
| 19 Dec 2012<br />
| [http://appldnld.apple.com/iOS6/041-9154.20121217.Nestg/iPad2,7_6.0.2_10A8500_Restore.ipsw iPad2,7_6.0.2_10A8500_Restore.ipsw]<br />
| <code>fdd10634929933f673d8cff6464770d885011b53</code><br />
| <br />
| 940,572,672<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPad mini 1G Global)|10B141]]<br />
| rowspan="3" | Brighton<br />
| [[3.04.24]]<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6615.20130128.i5rft/iPad2,7_6.1_10B141_Restore.ipsw iPad2,7_6.1_10B141_Restore.ipsw]<br />
| <code>52a05ffd839ed4380651aa70adb8d1e71dea7330</code><br />
| <br />
| 898,702,892<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B147 (iPad mini 1G Global)|10B147]]<br />
| rowspan="2" | [[3.04.25]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0730.20130215.Acsit/iPad2,7_6.1.2_10B147_Restore.ipsw iPad2,7_6.1.2_10B147_Restore.ipsw]<br />
| <code>a1ef619a9ac5f6244806dba5b13eb862bff0b718</code><br />
| Exchange bug fix. <br />
| 898,668,333<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPad mini 1G Global)|10B329]]<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2356.20130319.54rGB/iPad2,7_6.1.3_10B329_Restore.ipsw iPad2,7_6.1.3_10B329_Restore.ipsw]<br />
| <code>1b06da56b129536b6bd58c732746962972442be1</code><br />
| <br />
| 899,020,515<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPad mini 1G Global)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| rowspan="2" | [[5.00.01]]<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9460.20130918.re34f/iPad2,7_7.0_11A465_Restore.ipsw iPad2,7_7.0_11A465_Restore.ipsw]<br />
| <code>d31dfa9ae5c17c5816a5c0183325cb5d466e3fed</code><br />
| <br />
| 1,232,528,339<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPad mini 1G Global)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9796.20130924.jumlN/iPad2,7_7.0.2_11A501_Restore.ipsw iPad2,7_7.0.2_11A501_Restore.ipsw]<br />
| <code>1894f93a8927d64c7e744febfb4ac94527eebfc2</code><br />
| <br />
| 1,232,753,339<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad mini 1G Global)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| rowspan="3" | [[5.02.00]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0845.20131022.GoTed/iPad2,7_7.0.3_11B511_Restore.ipsw iPad2,7_7.0.3_11B511_Restore.ipsw]<br />
| <code>3786743ce7917bb3f846b6d10e94a6872f699c39</code><br />
| <br />
| 1,232,760,331<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad mini 1G Global)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1868.20131114.P3wE4/iPad2,7_7.0.4_11B554a_Restore.ipsw iPad2,7_7.0.4_11B554a_Restore.ipsw]<br />
| <code>63d777814b4f2da0833fdabff8339628e2f2cf87</code><br />
| <br />
| 1,232,740,295<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad mini 1G Global)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2905.20140221.8j5GW/iPad2,7_7.0.6_11B651_Restore.ipsw iPad2,7_7.0.6_11B651_Restore.ipsw]<br />
| <code>d306172a812b11313e0c5dbc98cc51e871966544</code><br />
| <br />
| 1,232,807,970<br />
|}<br />
<br />
=== [[iPad mini 2G]] ===<br />
==== [[j85ap|iPad4,4]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad mini 2G Wi-Fi)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0897.20131022.Xbstt/iPad4,4_7.0.3_11B511_Restore.ipsw iPad4,4_7.0.3_11B511_Restore.ipsw]<br />
| <code>2482efcc8e6405fe70b6ed2788d6ad442755c301</code><br />
| Initial shipment.<br />
| 1,574,336,524<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad mini 2G Wi-Fi)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1772.20131114.P3wE4/iPad4,4_7.0.4_11B554a_Restore.ipsw iPad4,4_7.0.4_11B554a_Restore.ipsw]<br />
| <code>92b0009c29a2ad9906749d5c0e87e6ff95da6cd2</code><br />
| <br />
| 1,574,419,462<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad mini 2G Wi-Fi)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2961.20140221.8j5GW/iPad4,4_7.0.6_11B651_Restore.ipsw iPad4,4_7.0.6_11B651_Restore.ipsw]<br />
| <code>ec501c0ea6c64caa75ca23bfeca02bdd097b82bf</code><br />
| <br />
| 1,574,506,543<br />
|}<br />
<br />
==== [[j86ap|iPad4,5]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPad mini 2G Cellular)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| [[1.02.02]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0863.20131022.ewh5t/iPad4,5_7.0.3_11B511_Restore.ipsw iPad4,5_7.0.3_11B511_Restore.ipsw]<br />
| <code>effdb4626144c9d07b54112ba11671b075fdebab</code><br />
| Initial shipment.<br />
| 1,642,134,944<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPad mini 2G Cellular)|11B554a]]<br />
| [[1.03.01]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1722.20131114.P3wE4/iPad4,5_7.0.4_11B554a_Restore.ipsw iPad4,5_7.0.4_11B554a_Restore.ipsw]<br />
| <code>770762e5db4d37cd645619e44a6764f3f173284e</code><br />
| <br />
| 1,642,210,601<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPad mini 2G Cellular)|11B651]]<br />
| [[1.03.02]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2918.20140221.8j5GW/iPad4,5_7.0.6_11B651_Restore.ipsw iPad4,5_7.0.6_11B651_Restore.ipsw]<br />
| <code>a4a9dc02eb1baaa05db1d14401f7ea0d8a041b27</code><br />
| <br />
| 1,642,058,615<br />
|}<br />
<br />
== [[iPhone]] ==<br />
{{:Firmware/Deprecated iPhones}}<br />
=== [[iPhone 4]] ===<br />
==== [[n90ap|iPhone3,1]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! [[XMM 6180#Known iPhone Firmware Versions|Baseband]]<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 4.0<br />
| [[Apex 8A293 (iPhone 4 GSM)|8A293]]<br />
| rowspan="3" | Apex<br />
| rowspan="3" | [[01.59.00]]<br />
| 21 Jun 2010<br />
| [http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone4/061-7380.20100621,Vfgb5/iPhone3,1_4.0_8A293_Restore.ipsw iPhone3,1_4.0_8A293_Restore.ipsw]<br />
| <code>171c2a3995fa149f2a369ccd87f82c5c30da3f88</code><br />
| Initial shipment.<br />
| 607,363,121<br />
|-<br />
| 4.0.1<br />
| [[Apex 8A306 (iPhone 4 GSM)|8A306]]<br />
| 15 Jul 2010<br />
| [http://appldnld.apple.com/iPhone4/061-8619.20100715.4Pnsx/iPhone3,1_4.0.1_8A306_Restore.ipsw iPhone3,1_4.0.1_8A306_Restore.ipsw]<br />
| <code>a9cf20679273b7e502ab384854ba96cc2a54d532</code><br />
| New formula to calculate bars.<br />
| 607,380,127<br />
|-<br />
| 4.0.2<br />
| [[Apex 8A400 (iPhone 4 GSM)|8A400]]<br />
| 11 Aug 2010<br />
| [http://appldnld.apple.com/iPhone4/061-8807.20100811.3Edre/iPhone3,1_4.0.2_8A400_Restore.ipsw iPhone3,1_4.0.2_8A400_Restore.ipsw]<br />
| <code>19eb071cdb9f1601b106825d0a16b1449c6eef8c</code><br />
| Hotfix to prevent malicious use of [[Star]]'s exploits.<br />
| 607,375,880<br />
|-<br />
| 4.1<br />
| [[Baker 8B117 (iPhone 4 GSM)|8B117]]<br />
| Baker<br />
| [[02.10.04]]<br />
| 8 Sep 2010<br />
| [http://appldnld.apple.com/iPhone4/061-7939.20100908.Lcyg3/iPhone3,1_4.1_8B117_Restore.ipsw iPhone3,1_4.1_8B117_Restore.ipsw]<br />
| <code>a3f8a333ca181146b862ca6a59c9a6e7c27eba0b</code><br />
| <br />
| 618,501,195<br />
|-<br />
| 4.2.1<br />
| [[Jasper 8C148 (iPhone 4 GSM)|8C148]]<br />
| Jasper<br />
| [[03.10.01]]<br />
| 22 Nov 2010<br />
| [http://appldnld.apple.com/iPhone4/061-9858.20101122.Er456/iPhone3,1_4.2.1_8C148_Restore.ipsw iPhone3,1_4.2.1_8C148_Restore.ipsw]<br />
| <code>366b28e9c95936bd4b11a84d54fefaf079fd6411</code><br />
| <br />
| 654,550,096<br />
|-<br />
| 4.3<br />
| [[Durango 8F190 (iPhone 4 GSM)|8F190]]<br />
| rowspan="6" | Durango<br />
| rowspan="6" | [[04.10.01]]<br />
| 9 Mar 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0330.20110311.Cswe3/iPhone3,1_4.3_8F190_Restore.ipsw iPhone3,1_4.3_8F190_Restore.ipsw]<br />
| <code>146cd896abb21680383fe675cbc99fc36d3cce57</code><br />
| <br />
| 702,264,955<br />
|-<br />
| 4.3.1<br />
| [[Durango 8G4 (iPhone 4 GSM)|8G4]]<br />
| 25 Mar 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0551.20110325.Aw2Dr/iPhone3,1_4.3.1_8G4_Restore.ipsw iPhone3,1_4.3.1_8G4_Restore.ipsw]<br />
| <code>6694f69c84d36248d5bb71ba78ddb1f4946260f0</code><br />
| <br />
| 698,304,690<br />
|-<br />
| 4.3.2<br />
| [[Durango 8H7 (iPhone 4 GSM)|8H7]]<br />
| 14 Apr 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0662.20110414.byQ84/iPhone3,1_4.3.2_8H7_Restore.ipsw iPhone3,1_4.3.2_8H7_Restore.ipsw]<br />
| <code>211e556a558ad18921c8b837db65aa20a373db77</code><br />
| <br />
| 698,525,410<br />
|-<br />
| 4.3.3<br />
| [[Durango 8J2 (iPhone 4 GSM)|8J2]]<br />
| 4 May 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1011.20110503.q7fGc/iPhone3,1_4.3.3_8J2_Restore.ipsw iPhone3,1_4.3.3_8J2_Restore.ipsw]<br />
| <code>b2e221543f24a66209c70e8465d037fe22afeefa</code><br />
| <br />
| 698,558,606<br />
|-<br />
| 4.3.4<br />
| [[Durango 8K2 (iPhone 4 GSM)|8K2]]<br />
| 15 Jul 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1923.20110715.BnATg/iPhone3,1_4.3.4_8K2_Restore.ipsw iPhone3,1_4.3.4_8K2_Restore.ipsw]<br />
| <code>65eed031140b908c9f879b8f84d744d1fba2276c</code><br />
| Hotfix to prevent malicious use of [[Saffron]]'s exploits<br />
| 699,045,659<br />
|-<br />
| 4.3.5<br />
| [[Durango 8L1 (iPhone 4 GSM)|8L1]]<br />
| 25 Jul 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1966.20110721.V3Ufe/iPhone3,1_4.3.5_8L1_Restore.ipsw iPhone3,1_4.3.5_8L1_Restore.ipsw]<br />
| <code>7099307319c669356955e9aff11a3129d6b8d8b4</code><br />
| <br />
| 698,976,299<br />
|-<br />
| 5.0<br />
| [[Telluride 9A334 (iPhone 4 GSM)|9A334]]<br />
| rowspan="2" | Telluride<br />
| rowspan="2" | [[04.11.08]]<br />
| 12 Oct 2011<br />
| [http://appldnld.apple.com/iPhone4/041-8358.20111012.FFc34/iPhone3,1_5.0_9A334_Restore.ipsw iPhone3,1_5.0_9A334_Restore.ipsw]<br />
| <code>aacd559fee6652685c89de74b89a62de27ce938f</code><br />
| <br />
| 811,948,143<br />
|-<br />
| 5.0.1<br />
| [[Telluride 9A405 (iPhone 4 GSM)|9A405]]<br />
| 10 Nov 2011<br />
| [http://appldnld.apple.com/iPhone4/041-3309.20111109.64rtg/iPhone3,1_5.0.1_9A405_Restore.ipsw iPhone3,1_5.0.1_9A405_Restore.ipsw]<br />
| <code>a123b049c7a03cc952c6328de998d4f74d49c18b</code><br />
| First non-beta also available as OTA update.<br />
| 829,060,929<br />
|-<br />
| 5.1<br />
| [[Hoodoo 9B176 (iPhone 4 GSM)|9B176]]<br />
| rowspan="3" | Hoodoo<br />
| rowspan="3" | [[04.12.01]]<br />
| 7 Mar 2012<br />
| [http://appldnld.apple.com/iOS5/041-1537.20120307.EJrm4/iPhone3,1_5.1_9B176_Restore.ipsw iPhone3,1_5.1_9B176_Restore.ipsw]<br />
| <code>1454b106551053804f3ac39fff4c17454cb6ae90</code><br />
| <br />
| 821,606,151<br />
|-<br />
| rowspan="2" | 5.1.1<br />
| [[Hoodoo 9B206 (iPhone 4 GSM)|9B206]]<br />
| 10 May 2012<br />
| [http://appldnld.apple.com/iOS5.1.1/041-4293.20120427.3DRyb/iPhone3,1_5.1.1_9B206_Restore.ipsw iPhone3,1_5.1.1_9B206_Restore.ipsw]<br />
| <code>a03a29c4dd2016edb3da72c3e26e30fbf0f42b2f</code><br />
| <br />
| 821,442,817<br />
|-<br />
| [[Hoodoo 9B208 (iPhone 4 GSM)|9B208]]<br />
| 25 May 2012<br />
| [http://appldnld.apple.com/iOS5.1.1/041-6051.2012.0525.Cvby7/iPhone3,1_5.1.1_9B208_Restore.ipsw iPhone3,1_5.1.1_9B208_Restore.ipsw]<br />
| <code>1209f57051f675d0328c08a894b073589f9eeb20</code><br />
| <br />
| 821,572,938<br />
|-<br />
| 6.0<br />
| [[Sundance 10A403 (iPhone 4 GSM)|10A403]]<br />
| rowspan="2" | Sundance<br />
| rowspan="2" | [[04.12.02]]<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-7175.20120919.wvv7Y/iPhone3,1_6.0_10A403_Restore.ipsw iPhone3,1_6.0_10A403_Restore.ipsw]<br />
| <code>4553077c61fd9c487c906ee419d2159f807a00fb</code><br />
| <br />
| 930,637,985<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPhone 4 GSM)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7950.20121101.Lmr45/iPhone3,1_6.0.1_10A523_Restore.ipsw iPhone3,1_6.0.1_10A523_Restore.ipsw]<br />
| <code>3d123107c71588fef6f03bd1fc8ca42bda400621</code><br />
|<br />
| 930,639,149<br />
|-<br />
| 6.1<br />
| [[Brighton 10B144 (iPhone 4 GSM)|10B144]]<br />
| rowspan="2" | Brighton<br />
| rowspan="3" | [[04.12.05]]<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0682.20130128.mefc4/iPhone3,1_6.1_10B144_Restore.ipsw iPhone3,1_6.1_10B144_Restore.ipsw]<br />
| <code>2dcaae314ae8e0a353ad43010159cf15f7f6bd4e</code><br />
| <br />
| 938,516,113<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPhone 4 GSM)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0722.20130215.BzrgV/iPhone3,1_6.1.2_10B146_Restore.ipsw iPhone3,1_6.1.2_10B146_Restore.ipsw]<br />
| <code>b62c043338898893c210bb81e608b4b099de7c5f</code><br />
| Exchange bug fix. <br />
| 938,592,821<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPhone 4 GSM)|10B329]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2610.20130319.Bedr4/iPhone3,1_6.1.3_10B329_Restore.ipsw iPhone3,1_6.1.3_10B329_Restore.ipsw]<br />
| <code>f8c53328656f2708e1d2bcb793f12ae46dd4eb23</code><br />
|<br />
| 938,891,219<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPhone 4 GSM)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| rowspan="5" | [[04.12.09]]<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9485.20130918.Xa98u/iPhone3,1_7.0_11A465_Restore.ipsw iPhone3,1_7.0_11A465_Restore.ipsw]<br />
| <code>c4e75b4c2be8480c1b61cd1f1a0c9c3291b03db7</code><br />
| <br />
| 1,201,795,093<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPhone 4 GSM)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9871.20130924.7imYu/iPhone3,1_7.0.2_11A501_Restore.ipsw iPhone3,1_7.0.2_11A501_Restore.ipsw]<br />
| <code>d4d085097955b64a9c2722531282e708027dd263</code><br />
| <br />
| 1,202,285,197<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPhone 4 GSM)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-1038.20131022.Llkit/iPhone3,1_7.0.3_11B511_Restore.ipsw iPhone3,1_7.0.3_11B511_Restore.ipsw]<br />
| <code>5fb262e82c64ca5ed0cf4773f283a83b1f8b4969</code><br />
| <br />
| 1,201,639,385<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPhone 4 GSM)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1831.20131114.P3wE4/iPhone3,1_7.0.4_11B554a_Restore.ipsw iPhone3,1_7.0.4_11B554a_Restore.ipsw]<br />
| <code>964c2e3e152cc4ca3efe4cedbc71aa7b06350555</code><br />
| <br />
| 1,201,639,929<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPhone 4 GSM)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-3020.20140221.8j5GW/iPhone3,1_7.0.6_11B651_Restore.ipsw iPhone3,1_7.0.6_11B651_Restore.ipsw]<br />
| <code>7fee14771f451dbb5c64d536b521ff199f6c6cd9</code><br />
| <br />
| 1,201,645,522<br />
|}<br />
<br />
==== [[n90bap|iPhone3,2]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 6.0<br />
| [[Sundance 10A403 (iPhone 4 GSM Rev A)|10A403]]<br />
| rowspan="2" | Sundance<br />
| rowspan="2" | [[04.12.02]]<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-7177.20120919.xqoqs/iPhone3,2_6.0_10A403_Restore.ipsw iPhone3,2_6.0_10A403_Restore.ipsw]<br />
| <code>4aefb7146df559d29c77f65c29c663a29cf43514</code><br />
| <br />
| 930,555,533<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPhone 4 GSM Rev A)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7951.20121101.GetM4/iPhone3,2_6.0.1_10A523_Restore.ipsw iPhone3,2_6.0.1_10A523_Restore.ipsw]<br />
| <code>f311dd43f23f4ab33a4ede6075034f740a9dfd3f</code><br />
| <br />
| 930,588,541<br />
|-<br />
| 6.1<br />
| [[Brighton 10B144 (iPhone 4 GSM Rev A)|10B144]]<br />
| rowspan="2" | Brighton<br />
| rowspan="3" | [[04.12.05]]<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0692.20130128.R3lr4/iPhone3,2_6.1_10B144_Restore.ipsw iPhone3,2_6.1_10B144_Restore.ipsw]<br />
| <code>f3086f7aca0750e843819c84fe2acc3c1f325b7c</code><br />
| <br />
| 938,303,367<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPhone 4 GSM Rev A)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0739.20130215.F654R/iPhone3,2_6.1.2_10B146_Restore.ipsw iPhone3,2_6.1.2_10B146_Restore.ipsw]<br />
| <code>054a21fb789d05055f11b99f3d0acf19c344d9be</code><br />
| Exchange bug fix.<br />
| 938,287,748<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPhone 4 GSM Rev A)|10B329]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2444.20130319.exFqm/iPhone3,2_6.1.3_10B329_Restore.ipsw iPhone3,2_6.1.3_10B329_Restore.ipsw]<br />
| <code>5eb08bf9a952943fd23515fdcb9f7590e284b6a2</code><br />
|<br />
| 938,612,166<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPhone 4 GSM Rev A)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| rowspan="5" | [[04.12.09]]<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9469.20130918.XXW3g/iPhone3,2_7.0_11A465_Restore.ipsw iPhone3,2_7.0_11A465_Restore.ipsw]<br />
| <code>84a7fd6bcb85c610129aaa1e70628281f6791790</code><br />
| <br />
| 1,201,074,564<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPhone 4 GSM Rev A)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9821.20130924.jJ61o/iPhone3,2_7.0.2_11A501_Restore.ipsw iPhone3,2_7.0.2_11A501_Restore.ipsw]<br />
| <code>bae60f8fe4fe431df25fff82fb1dc88086fc7062</code><br />
| <br />
| 1,201,319,028<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPhone 4 GSM Rev A)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0884.20131022.54554/iPhone3,2_7.0.3_11B511_Restore.ipsw iPhone3,2_7.0.3_11B511_Restore.ipsw]<br />
| <code>37bc86c162464ff97507facf5d3068df4ac3b0f5</code><br />
| <br />
| 1,200,810,705<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPhone 4 GSM Rev A)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1748.20131114.P3wE4/iPhone3,2_7.0.4_11B554a_Restore.ipsw iPhone3,2_7.0.4_11B554a_Restore.ipsw]<br />
| <code>1050be42499019915bbc4fbd7ce5a461fb964da7</code><br />
| <br />
| 1,200,962,863<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPhone 4 GSM Rev A)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2943.20140221.8j5GW/iPhone3,2_7.0.6_11B651_Restore.ipsw iPhone3,2_7.0.6_11B651_Restore.ipsw]<br />
| <code>a5f40e9384e209d4b98d497a0b2a3f5ed061fe13</code><br />
| <br />
| 1,200,957,711<br />
|}<br />
<br />
==== [[n92ap|iPhone3,3]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 4.2.5<br />
| [[Phoenix 8E128 (iPhone 4 CDMA)|8E128]]<br />
| rowspan="6" | Phoenix<br />
| rowspan="2" | [[1.0.05]]<br />
| 7 Feb 2011<br />
| No download available<br />
| <code>n/a</code><br />
| rowspan="2" | Initial shipment.<br />
| ?<br />
|-<br />
| 4.2.6<br />
| [[Phoenix 8E200 (iPhone 4 CDMA)|8E200]]<br />
| 10 Feb 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0177.20110131.Pyvrz/iPhone3,3_4.2.6_8E200_Restore.ipsw iPhone3,3_4.2.6_8E200_Restore.ipsw]<br />
| <code>f32cf46790a473a6c12f9dbd3773bf40fbdf6eee</code><br />
| 683,594,406<br />
|-<br />
| 4.2.7<br />
| [[Phoenix 8E303 (iPhone 4 CDMA)|8E303]]<br />
| rowspan="4" | [[1.0.06]]<br />
| 14 Apr 2011<br />
| [http://appldnld.apple.com/iPhone4/041-0614.20110414.B47xa/iPhone3,3_4.2.7_8E303_Restore.ipsw iPhone3,3_4.2.7_8E303_Restore.ipsw]<br />
| <code>724c173be65ffb1ca3ea5da73a331ddf1319884f</code><br />
| <br />
| 684,508,142<br />
|-<br />
| 4.2.8<br />
| [[Phoenix 8E401 (iPhone 4 CDMA)|8E401]]<br />
| 4 May 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1022.20110503.5g8k7/iPhone3,3_4.2.8_8E401_Restore.ipsw iPhone3,3_4.2.8_8E401_Restore.ipsw]<br />
| <code>84a695036cc6ab4954147ac1822144b33fbc5c31</code><br />
| <br />
| 684,458,963<br />
|-<br />
| 4.2.9<br />
| [[Phoenix 8E501 (iPhone 4 CDMA)|8E501]]<br />
| 15 Jul 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1916.20110715.V5rUA/iPhone3,3_4.2.9_8E501_Restore.ipsw iPhone3,3_4.2.9_8E501_Restore.ipsw]<br />
| <code>d44aae3b6997e0e8a30d88118d45d5e72aca8a2e</code><br />
| Hotfix to prevent malicious use of [[Saffron]]'s exploits<br />
| 684,524,858<br />
|-<br />
| 4.2.10<br />
| [[Phoenix 8E600 (iPhone 4 CDMA)|8E600]]<br />
| 25 Jul 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1959.20110721.jvP29/iPhone3,3_4.2.10_8E600_Restore.ipsw iPhone3,3_4.2.10_8E600_Restore.ipsw]<br />
| <code>789ee18ee9659c87cfff304f69fd7ea4c205693b</code><br />
| <br />
| 684,446,946<br />
|-<br />
| 5.0<br />
| [[Telluride 9A334 (iPhone 4 CDMA)|9A334]]<br />
| rowspan="2" | Telluride<br />
| rowspan="2" | [[3.0.03]]<br />
| 12 Oct 2011<br />
| [http://appldnld.apple.com/iPhone4/041-9743.20111012.vjhfp/iPhone3,3_5.0_9A334_Restore.ipsw iPhone3,3_5.0_9A334_Restore.ipsw]<br />
| <code>3258689a46c7ebd03b621531ee0511a88ae4a9e3</code><br />
| <br />
| 819,821,067<br />
|-<br />
| 5.0.1<br />
| [[Telluride 9A405 (iPhone 4 CDMA)|9A405]]<br />
| 10 Nov 2011<br />
| [http://appldnld.apple.com/iPhone4/041-3304.20111109.Vgtyh/iPhone3,3_5.0.1_9A405_Restore.ipsw iPhone3,3_5.0.1_9A405_Restore.ipsw]<br />
| <code>81afa9d2079a7153e5d27e30f1f08e7c53074591</code><br />
| <br />
| 836,999,205<br />
|-<br />
| 5.1<br />
| [[Hoodoo 9B176 (iPhone 4 CDMA)|9B176]]<br />
| rowspan="2" | Hoodoo<br />
| rowspan="12" | [[3.0.04 (MDM6600)|3.0.04]]<br />
| 7 Mar 2012<br />
| [http://appldnld.apple.com/iOS5/041-1529.20120307.looTW/iPhone3,3_5.1_9B176_Restore.ipsw iPhone3,3_5.1_9B176_Restore.ipsw]<br />
| <code>9c3b42bac8e61323646ca8daf2abe862bd4be4ce</code><br />
| <br />
| 829,786,277<br />
|-<br />
| 5.1.1<br />
| [[Hoodoo 9B206 (iPhone 4 CDMA)| 9B206]]<br />
| 10 May 2012<br />
| [http://appldnld.apple.com/iOS5.1.1/041-4291.20120427.Zs8F0/iPhone3,3_5.1.1_9B206_Restore.ipsw iPhone3,3_5.1.1_9B206_Restore.ipsw]<br />
| <code>70b736f826335ccefbc9941c3bb5d3b211236461</code><br />
| <br />
| 829,725,323<br />
|-<br />
| 6.0<br />
| [[Sundance 10A403 (iPhone 4 CDMA)|10A403]]<br />
| rowspan="2" | Sundance<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-7179.20120919.bDw4g/iPhone3,3_6.0_10A403_Restore.ipsw iPhone3,3_6.0_10A403_Restore.ipsw]<br />
| <code>82c8774281d97cde005da969ac50827ff4fab173</code><br />
| <br />
| 927,983,821<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPhone 4 CDMA)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7952.20121101.aClm5/iPhone3,3_6.0.1_10A523_Restore.ipsw iPhone3,3_6.0.1_10A523_Restore.ipsw]<br />
| <code>3084e9bbc9c6fedefc52f098590d57dbcc6da97e</code><br />
| <br />
| 927,849,448<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPhone 4 CDMA)|10B141]]<br />
| rowspan="2" | Brighton<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6505.20130128.Cpt63/iPhone3,3_6.1_10B141_Restore.ipsw iPhone3,3_6.1_10B141_Restore.ipsw]<br />
| <code>18c3b2fda21a12729976ecbb44344686ef27442b</code><br />
| <br />
| 935,561,144<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPhone 4 CDMA)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0726.20130215.Npal4/iPhone3,3_6.1.2_10B146_Restore.ipsw iPhone3,3_6.1.2_10B146_Restore.ipsw]<br />
| <code>8e975c8028daf68ed2fe8e6af3d5e065486b013c</code><br />
| Exchange bug fix. <br />
| 935,611,971<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPhone 4 CDMA)|10B329]]<br />
| BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2351.20130319.Fe431/iPhone3,3_6.1.3_10B329_Restore.ipsw iPhone3,3_6.1.3_10B329_Restore.ipsw]<br />
| <code>42f09fdc2e35426cc402ee683efb3b5e62dfe46a</code><br />
|<br />
| 936,050,758<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPhone 4 CDMA)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9459.20130918.Fre43/iPhone3,3_7.0_11A465_Restore.ipsw iPhone3,3_7.0_11A465_Restore.ipsw]<br />
| <code>fa143ba3119462db61e3e0e81d82d6f03c50ed64</code><br />
| <br />
| 1,200,255,851<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPhone 4 CDMA)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9794.20130924.umlNu/iPhone3,3_7.0.2_11A501_Restore.ipsw iPhone3,3_7.0.2_11A501_Restore.ipsw]<br />
| <code>a20c172c401c5dc42c328daebd5d3f1712caf412</code><br />
| <br />
| 1,200,488,975<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPhone 4 CDMA)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-1022.20131022.pptgk/iPhone3,3_7.0.3_11B511_Restore.ipsw iPhone3,3_7.0.3_11B511_Restore.ipsw]<br />
| <code>32f23fbbfd416e3cc45920b65b0d776886463d6f</code><br />
| <br />
| 1,200,248,170<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPhone 4 CDMA)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1864.20131114.P3wE4/iPhone3,3_7.0.4_11B554a_Restore.ipsw iPhone3,3_7.0.4_11B554a_Restore.ipsw]<br />
| <code>b29b29c48d6c27a8de9d2fdc104abd02a70e56b5</code><br />
| <br />
| 1,200,185,471<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPhone 4 CDMA)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2901.20140221.8j5GW/iPhone3,3_7.0.6_11B651_Restore.ipsw iPhone3,3_7.0.6_11B651_Restore.ipsw]<br />
| <code>535f5ff04e0218f54865b02278e245ee42315b0d</code><br />
| <br />
| 1,200,299,215<br />
|}<br />
<br />
=== [[n94ap|iPhone 4S]] ===<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 5.0<br />
| [[Telluride 9A334 (iPhone 4S)|9A334]]<br />
| rowspan="3" | Telluride<br />
| [[1.0.11 (MDM6610)|1.0.11]]<br />
| 12 Oct 2011<br />
| [http://appldnld.apple.com/iPhone4/041-1317.20111012.UVTgr/iPhone4,1_5.0_9A334_Restore.ipsw iPhone4,1_5.0_9A334_Restore.ipsw]<br />
| <code>efab39972534df65eb357e7500ece5b010c3e8ca</code><br />
| Initial shipment<br />[[IPSW File Format|IPSW]] also contains baseband [[04.11.08]]<br />
| 835,490,060<br />
|-<br />
| rowspan="2" | 5.0.1<br />
| [[Telluride 9A405 (iPhone 4S)|9A405]]<br />
| [[1.0.13]]<br />
| 10 Nov 2011<br />
| [http://appldnld.apple.com/iPhone4/041-3305.20111109.Bghy6/iPhone4,1_5.0.1_9A405_Restore.ipsw iPhone4,1_5.0.1_9A405_Restore.ipsw]<br />
| <code>df036914f0dc069963589cc590575e04b6e3745a</code><br />
| <br />
| 852,471,592<br />
|-<br />
| [[Telluride 9A406 (iPhone 4S)|9A406]]<br />
| [[1.0.14]]<br />
| 15 Dec 2011<br />
| [http://appldnld.apple.com/iPhone4/041-3417.20111215.Slnt4/iPhone4,1_5.0.1_9A406_Restore.ipsw iPhone4,1_5.0.1_9A406_Restore.ipsw]<br />
| <code>869caa17e6b3176efb11b5de653ec8330d43b176</code><br />
| Released to fix "No SIM" issue.<br />
| 849,922,173<br />
|-<br />
| 5.1<br />
| [[Hoodoo 9B179 (iPhone 4S)|9B179]]<br />
| rowspan="2" | Hoodoo<br />
| [[2.0.10]]<br />
| 7 Mar 2012<br />
| [http://appldnld.apple.com/iOS5/041-1530.20120307.LDDac/iPhone4,1_5.1_9B179_Restore.ipsw iPhone4,1_5.1_9B179_Restore.ipsw]<br />
| <code>44f86c53e90a177292b4df45186cccbb12ceb1bc</code><br />
| <br />
| 841,955,251<br />
|-<br />
| 5.1.1<br />
| [[Hoodoo 9B206 (iPhone 4S)|9B206]]<br />
| [[2.0.12]]<br />
| 10 May 2012<br />
| [http://appldnld.apple.com/iOS5.1.1/041-4346.20120427.1RuDG/iPhone4,1_5.1.1_9B206_Restore.ipsw iPhone4,1_5.1.1_9B206_Restore.ipsw]<br />
| <code>ac99928cc52fcb24502959ace3c36a63ba75ab6c</code><br />
| <br />
| 841,767,623<br />
|-<br />
| 6.0<br />
| [[Sundance 10A403 (iPhone 4S)|10A403]]<br />
| rowspan="2" | Sundance<br />
| rowspan="2" | [[3.0.04 (MDM6610)|3.0.04]]<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-7181.20120919.lEuOK/iPhone4,1_6.0_10A403_Restore.ipsw iPhone4,1_6.0_10A403_Restore.ipsw]<br />
| <code>12cee460eefc2055b4bb3b52b20843fe4ca035fc</code><br />
| <br />
| 957,042,795<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPhone 4S)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7953.20121101.Apmtr/iPhone4,1_6.0.1_10A523_Restore.ipsw iPhone4,1_6.0.1_10A523_Restore.ipsw]<br />
| <code>c71881dc7d5e8f37974a441478b77389bbfea009</code><br />
| <br />
| 957,030,240<br />
|-<br />
| 6.1<br />
| [[Brighton 10B142 (iPhone 4S)|10B142]]<br />
| rowspan="3" | Brighton<br />
| [[3.4.01]]<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-5902.20130128.bhyt6/iPhone4,1_6.1_10B142_Restore.ipsw iPhone4,1_6.1_10B142_Restore.ipsw]<br />
| <code>e49a848895823c61b7a1bb1f22650766a9ea9157</code><br />
| <br />
| 964,624,379<br />
|-<br />
| 6.1.1<br />
| [[Brighton 10B145 (iPhone 4S)|10B145]]<br />
| rowspan="2" | [[3.4.02]]<br />
| 11 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0723.20130211.Fcr43/iPhone4,1_6.1.1_10B145_Restore.ipsw iPhone4,1_6.1.1_10B145_Restore.ipsw]<br />
| <code>5f80fa7db28bd372099f0dec706c05e92c834281</code><br />
| UMTS bug fix. <br />
| 964,781,377<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPhone 4S)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0926.20130215.DaTe4/iPhone4,1_6.1.2_10B146_Restore.ipsw iPhone4,1_6.1.2_10B146_Restore.ipsw]<br />
| <code>40392e8b3cf6934e639374a215cae7859f83f02c</code><br />
| Exchange bug fix. <br />
| 964,701,770<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPhone 4S)|10B329]]<br />
| BrightonMaps<br />
| [[3.4.03]]<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2611.20130319.Fr54r/iPhone4,1_6.1.3_10B329_Restore.ipsw iPhone4,1_6.1.3_10B329_Restore.ipsw]<br />
| <code>7a62ee60b574301a6aafc48dcc9cccf0894ffb27</code><br />
|<br />
| 965,016,471<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPhone 4S)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| rowspan="2" | [[5.0.00]]<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9486.20130918.V5WIX/iPhone4,1_7.0_11A465_Restore.ipsw iPhone4,1_7.0_11A465_Restore.ipsw]<br />
| <code>b4e6627c3de97405e04e5dc122834082ab386a13</code><br />
| <br />
| 1,268,447,276<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPhone 4S)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9872.20130924.2wc82/iPhone4,1_7.0.2_11A501_Restore.ipsw iPhone4,1_7.0.2_11A501_Restore.ipsw]<br />
| <code>0223583ec3c71a9f47f7bd860e371d076aed829e</code><br />
| <br />
| 1,268,798,284<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPhone 4S)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| rowspan="3" | [[5.0.02]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0948.20131022.Sim1l/iPhone4,1_7.0.3_11B511_Restore.ipsw iPhone4,1_7.0.3_11B511_Restore.ipsw]<br />
| <code>75e46b940d1caf432e2c5ac8b263050fa0c059d2</code><br />
| <br />
| 1,268,480,065<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPhone 4S)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1833.20131114.P3wE4/iPhone4,1_7.0.4_11B554a_Restore.ipsw iPhone4,1_7.0.4_11B554a_Restore.ipsw]<br />
| <code>76b111adb02d2de53fcc5edcb02e8e176a4c6723</code><br />
| <br />
| 1,268,348,817<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPhone 4S)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-3023.20140221.8j5GW/iPhone4,1_7.0.6_11B651_Restore.ipsw iPhone4,1_7.0.6_11B651_Restore.ipsw]<br />
| <code>0db6297cfa36101fb531ff4b06ec28057d97f8f8</code><br />
| <br />
| 1,268,480,940<br />
|}<br />
<br />
=== [[iPhone 5]] ===<br />
==== [[n41ap|iPhone5,1]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 6.0<br />
| [[Sundance 10A405 (iPhone 5 GSM)|10A405]]<br />
| rowspan="3" | Sundance<br />
| [[1.00.16]]<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-7169.20120919.5Mial/iPhone5,1_6.0_10A405_Restore.ipsw iPhone5,1_6.0_10A405_Restore.ipsw]<br />
| <code>e746a07feabaadc86b46615b33197c8ac1c80605</code><br />
| Initial shipment.<br />
| 1,030,720,411<br />
|-<br />
| 6.0.1 <br />
| [[Sundance 10A525 (iPhone 5 GSM)|10A525]]<br />
| rowspan="2" | [[1.01.00]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-8530.20121101.svtly/iPhone5,1_6.0.1_10A525_Restore.ipsw iPhone5,1_6.0.1_10A525_Restore.ipsw]<br />
| <code>68f3bbcfd867bd0c9484086dd0639f6f0cba0578</code><br />
| <br />
| 1,030,747,959<br />
|-<br />
| 6.0.2<br />
| [[Sundance 10A551 (iPhone 5 GSM)|10A551]]<br />
| 19 Dec 2012<br />
| [http://appldnld.apple.com/iOS6/041-0779.20121217.Dre43/iPhone5,1_6.0.2_10A551_Restore.ipsw iPhone5,1_6.0.2_10A551_Restore.ipsw]<br />
| <code> b68b927f245ce8b6ab7c3ff88ac2f9e2fbf2fe6b </code><br />
| Wi-Fi bug fix.<br />
| 1,030,789,834<br />
|-<br />
| 6.1<br />
| [[Brighton 10B143 (iPhone 5 GSM)|10B143]]<br />
| rowspan="2" | Brighton<br />
| rowspan="4" | [[3.04.25]]<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6485.20130128.mt0dy/iPhone5,1_6.1_10B143_Restore.ipsw iPhone5,1_6.1_10B143_Restore.ipsw]<br />
| <code>42ffd7f16d32fa71dab964314387140164c5af10</code><br />
| <br />
| 1,037,222,452<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPhone 5 GSM)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0720.20130215.Xerg4/iPhone5,1_6.1.2_10B146_Restore.ipsw iPhone5,1_6.1.2_10B146_Restore.ipsw]<br />
| <code>969754380f9236dc25d60de8892b9a889894274d</code><br />
| Exchange bug fix.<br />
| 1,037,195,381<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPhone 5 GSM)|10B329]]<br />
| rowspan="2" | BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2341.20130319.C24tg/iPhone5,1_6.1.3_10B329_Restore.ipsw iPhone5,1_6.1.3_10B329_Restore.ipsw]<br />
| <code>967154e902dda814a0fe0ec757f8124c43973701</code><br />
|<br />
| 1,037,540,044<br />
|-<br />
| 6.1.4<br />
| [[BrightonMaps 10B350 (iPhone 5 GSM)|10B350]]<br />
| 02 May 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-3403.20130502.Xerz1/iPhone5,1_6.1.4_10B350_Restore.ipsw iPhone5,1_6.1.4_10B350_Restore.ipsw]<br />
| <code>53b6aa61ee9c258ea66d8c28bb5bfe3fd4ba7939</code><br />
|<br />
| 1,037,550,400<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPhone 5 GSM)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| rowspan="2" | [[5.00.01]]<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9495.20130918.FuFu4/iPhone5,1_7.0_11A465_Restore.ipsw iPhone5,1_7.0_11A465_Restore.ipsw]<br />
| <code>1de0e8055ff81e26a3a13c883656581bc97b4908</code><br />
| <br />
| 1,323,683,109<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPhone 5 GSM)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9790.20130924.sMNZz/iPhone5,1_7.0.2_11A501_Restore.ipsw iPhone5,1_7.0.2_11A501_Restore.ipsw]<br />
| <code>75e9e19545b579dd6d4c60808090a360f9fc9ebe</code><br />
| <br />
| 1,323,990,276<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPhone 5 GSM)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| rowspan="3" | [[5.02.00]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0855.20131022.astg4/iPhone5,1_7.0.3_11B511_Restore.ipsw iPhone5,1_7.0.3_11B511_Restore.ipsw]<br />
| <code>e16200c10d7b93f99526583f520dc4b027fc1da7</code><br />
| <br />
| 1,323,506,674<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPhone 5 GSM)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1700.20131114.P3wE4/iPhone5,1_7.0.4_11B554a_Restore.ipsw iPhone5,1_7.0.4_11B554a_Restore.ipsw]<br />
| <code>00f13e376490e0aa91b950d65a43bf93d46a1e79</code><br />
| <br />
| 1,323,630,611<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPhone 5 GSM)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2899.20140221.8j5GW/iPhone5,1_7.0.6_11B651_Restore.ipsw iPhone5,1_7.0.6_11B651_Restore.ipsw]<br />
| <code>0f47de2d381732bf2e463a3062abd2a58d05176e</code><br />
| <br />
| 1,323,568,179<br />
|}<br />
<br />
==== [[n42ap|iPhone5,2]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 6.0<br />
| [[Sundance 10A405 (iPhone 5 Global)|10A405]]<br />
| rowspan="3" | Sundance<br />
| [[1.00.16]]<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-7171.20120919.doJ1e/iPhone5,2_6.0_10A405_Restore.ipsw iPhone5,2_6.0_10A405_Restore.ipsw]<br />
| <code>bd86f460ffcb0a7d198ab1db591335e832593dc1</code><br />
| Initial shipment.<br />
| 1,030,868,962<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A525 (iPhone 5 Global)|10A525]]<br />
| rowspan="2" | [[1.01.00]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-8531.20121101.Fvjr6/iPhone5,2_6.0.1_10A525_Restore.ipsw iPhone5,2_6.0.1_10A525_Restore.ipsw]<br />
| <code>cc306ca0ae099ed90f3d85ac120b6d0f3b0cdb87</code><br />
| <br />
| 1,030,935,804<br />
|-<br />
| 6.0.2<br />
| [[Sundance 10A551 (iPhone 5 Global)|10A551]]<br />
| 19 Dec 2012<br />
| [http://appldnld.apple.com/iOS6/041-4272.20121217.Zsw29/iPhone5,2_6.0.2_10A551_Restore.ipsw iPhone5,2_6.0.2_10A551_Restore.ipsw]<br />
| <code>baa6bfccf748e6d2c0723fd48bbb87eb494be19d</code><br />
| Wi-Fi bug fix.<br />
| 1,105,954,078<br />
|-<br />
| 6.1<br />
| [[Brighton 10B143 (iPhone 5 Global)|10B143]]<br />
| rowspan="2" | Brighton<br />
| rowspan="4" | [[3.04.25]]<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6487.20130128.Ihb56/iPhone5,2_6.1_10B143_Restore.ipsw iPhone5,2_6.1_10B143_Restore.ipsw]<br />
| <code>a32af87309a7e01a976eb73cac3f06370c5a1079</code><br />
| <br />
| 1,037,462,937<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPhone 5 Global)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0727.20130215.Prgt5/iPhone5,2_6.1.2_10B146_Restore.ipsw iPhone5,2_6.1.2_10B146_Restore.ipsw]<br />
| <code>a4f9d2a100b10869be43037eee4a3210e88f9d53</code><br />
| Exchange bug fix.<br />
| 1,037,483,522<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPhone 5 Global)|10B329]]<br />
| rowspan="2" | BrightonMaps<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2516.20130319.7164R/iPhone5,2_6.1.3_10B329_Restore.ipsw iPhone5,2_6.1.3_10B329_Restore.ipsw]<br />
| <code>9f7dcc672fd54a3aeefcabbcd547c0e53818513d</code><br />
|<br />
| 1,037,889,939<br />
|-<br />
| 6.1.4<br />
| [[BrightonMaps 10B350 (iPhone 5 Global)|10B350]]<br />
| 02 May 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-3423.20130502.Tr3Lz/iPhone5,2_6.1.4_10B350_Restore.ipsw iPhone5,2_6.1.4_10B350_Restore.ipsw]<br />
| <code>5afaa5f085d19595d0884c2662a954d61b1a627e</code><br />
|<br />
| 1,037,923,480<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPhone 5 Global)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| rowspan="2" | [[5.00.01]]<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9475.20130918.9Fu45/iPhone5,2_7.0_11A465_Restore.ipsw iPhone5,2_7.0_11A465_Restore.ipsw]<br />
| <code>137e2031a4c03b5da2e05bf33b2741883131371c</code><br />
| <br />
| 1,324,088,264<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPhone 5 Global)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9843.20130924.FYUxd/iPhone5,2_7.0.2_11A501_Restore.ipsw iPhone5,2_7.0.2_11A501_Restore.ipsw]<br />
| <code>5f05f380d1308ea78cfce333fad4e684c3e0e5bc</code><br />
| <br />
| 1,324,262,488<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPhone 5 Global)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| rowspan="3" | [[5.02.00]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0910.20131022.EerKf/iPhone5,2_7.0.3_11B511_Restore.ipsw iPhone5,2_7.0.3_11B511_Restore.ipsw]<br />
| <code>8914b74051935633c846f630a3c99f38d0e4815b</code><br />
| <br />
| 1,323,934,864<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPhone 5 Global)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1790.20131114.P3wE4/iPhone5,2_7.0.4_11B554a_Restore.ipsw iPhone5,2_7.0.4_11B554a_Restore.ipsw]<br />
| <code>bccc1b1fc17bb3b701a4ee2c6869c4679f0fc2fa</code><br />
| <br />
| 1,324,053,055<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPhone 5 Global)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2979.20140221.8j5GW/iPhone5,2_7.0.6_11B651_Restore.ipsw iPhone5,2_7.0.6_11B651_Restore.ipsw]<br />
| <code>5d053695d6423943f17a91efbdc17ca39df12c3b</code><br />
| <br />
| 1,324,105,849<br />
|}<br />
<br />
=== [[iPhone 5c]] ===<br />
==== [[n48ap|iPhone5,3]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A466 (iPhone 5c GSM)|11A466]]<br />
| rowspan="3" | Innsbruck<br />
| rowspan="3" | [[1.00.06]]<br />
| rowspan="2" | 18 Sep 2013<br />
| No download available<br />
| <code>n/a</code><br />
| rowspan="2" | Initial release.<br />
| ?<br />
|-<br />
| 7.0.1<br />
| [[Innsbruck 11A470a (iPhone 5c GSM)|11A470a]]<br />
| [http://appldnld.apple.com/iOS7/031-0289.20130914.DoOPv/iPhone5,3_7.0.1_11A470a_Restore.ipsw iPhone5,3_7.0.1_11A470a_Restore.ipsw]<br />
| <code>8a48f5b328411706a16bae9384ef10206c6bf80a</code><br />
| 1,333,623,990<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPhone 5c GSM)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/031-0318.20130924.hffwa/iPhone5,3_7.0.2_11A501_Restore.ipsw iPhone5,3_7.0.2_11A501_Restore.ipsw]<br />
| <code>249d01f2aef489cf41565005cbb368722da49c2a</code><br />
| <br />
| 1,333,713,977<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPhone 5c GSM)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| [[1.02.02]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0943.20131022.Mestt/iPhone5,3_7.0.3_11B511_Restore.ipsw iPhone5,3_7.0.3_11B511_Restore.ipsw]<br />
| <code>6bbc19a14e7033cb5d025f2cc9fed7145f72893e</code><br />
| <br />
| 1,333,324,771<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPhone 5c GSM)|11B554a]]<br />
| [[1.03.01]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1828.20131114.P3wE4/iPhone5,3_7.0.4_11B554a_Restore.ipsw iPhone5,3_7.0.4_11B554a_Restore.ipsw]<br />
| <code>252a699947452efd599cd3418578e39182a842c2</code><br />
| <br />
| 1,333,375,798<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPhone 5c GSM)|11B651]]<br />
| [[1.03.02]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-3017.20140221.8j5GW/iPhone5,3_7.0.6_11B651_Restore.ipsw iPhone5,3_7.0.6_11B651_Restore.ipsw]<br />
| <code>73e6a5fd08a172e44aa77a8a58be26a08fd80456</code><br />
| <br />
| 1,333,386,554<br />
|}<br />
<br />
==== [[n49ap|iPhone5,4]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A466 (iPhone 5c Global)|11A466]]<br />
| rowspan="3" | Innsbruck<br />
| rowspan="3" | [[1.00.06]]<br />
| rowspan="2" | 18 Sep 2013<br />
| No download available<br />
| <code>n/a</code><br />
| rowspan="2" | Initial release.<br />
| ?<br />
|-<br />
| 7.0.1<br />
| [[Innsbruck 11A470a (iPhone 5c Global)|11A470a]]<br />
| [http://appldnld.apple.com/iOS7/031-0292.20130914.rHLcE/iPhone5,4_7.0.1_11A470a_Restore.ipsw iPhone5,4_7.0.1_11A470a_Restore.ipsw]<br />
| <code>55340ec0c1f74c35b1b4899bcb91772b317cd9a7</code><br />
| 1,333,488,439<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPhone 5c Global)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/031-0307.20130924.yxzkZ/iPhone5,4_7.0.2_11A501_Restore.ipsw iPhone5,4_7.0.2_11A501_Restore.ipsw]<br />
| <code>91812cbaf794f2cee51eee6284efb617cf563ed0</code><br />
| <br />
| 1,333,480,451<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPhone 5c Global)|11B511]]<br />
| rowspan="4" | InnsbruckTaos<br />
| [[1.02.02]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0853.20131022.suup3/iPhone5,4_7.0.3_11B511_Restore.ipsw iPhone5,4_7.0.3_11B511_Restore.ipsw]<br />
| <code>2dea0cb085451db62c823ba708e53837f779dc71</code><br />
| <br />
| 1,333,092,310<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPhone 5c Global)|11B554a]]<br />
| [[1.03.01]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1869.20131114.P3wE4/iPhone5,4_7.0.4_11B554a_Restore.ipsw iPhone5,4_7.0.4_11B554a_Restore.ipsw]<br />
| <code>30c583c6582d1e7bb2380b602140a3ee15533082</code><br />
| <br />
| 1,333,231,834<br />
|-<br />
| 7.0.5<br />
| [[InnsbruckTaos 11B601 (iPhone 5c Global)|11B601]]<br />
| rowspan="2" | [[1.03.02]]<br />
| 29 Jan 2014<br />
| [http://appldnld.apple.com/iOS7/031-2903.20140129.AaQe3/iPhone5,4_7.0.5_11B601_Restore.ipsw iPhone5,4_7.0.5_11B601_Restore.ipsw]<br />
| <code>ee0cd7f98220d94f700221002ff76ecfee64ba5b</code><br />
| <br />
| 1,333,289,883<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPhone 5c Global)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-3516.20140221.8j5GW/iPhone5,4_7.0.6_11B651_Restore.ipsw iPhone5,4_7.0.6_11B651_Restore.ipsw]<br />
| <code>b109b4d8e6e5f14cf1c26cf9ed73a496f092466d</code><br />
| <br />
| 1,333,185,263<br />
|}<br />
<br />
=== [[iPhone 5s]] ===<br />
==== [[n51ap|iPhone6,1]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A466 (iPhone 5s GSM)|11A466]]<br />
| rowspan="3" | Innsbruck<br />
| rowspan="3" | [[1.00.06]]<br />
| rowspan="2" | 18 Sep 2013<br />
| No download available<br />
| <code>n/a</code><br />
| rowspan="2" | Initial release.<br />
| ?<br />
|-<br />
| 7.0.1<br />
| [[Innsbruck 11A470a (iPhone 5s GSM)|11A470a]]<br />
| [http://appldnld.apple.com/iOS7/031-0290.20130914.khyTp/iPhone6,1_7.0.1_11A470a_Restore.ipsw iPhone6,1_7.0.1_11A470a_Restore.ipsw]<br />
| <code>df7c1790291470e1a734f16adc122c3b1dc993f2</code><br />
| 1,489,997,303<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPhone 5s GSM)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/031-0322.20130924.gpNkP/iPhone6,1_7.0.2_11A501_Restore.ipsw iPhone6,1_7.0.2_11A501_Restore.ipsw]<br />
| <code>d32daeec0a1478451b72d8414af5debfc0b9e5be</code><br />
| <br />
| 1,490,132,470<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPhone 5s GSM)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| [[1.02.02]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0966.20131022.45gBg/iPhone6,1_7.0.3_11B511_Restore.ipsw iPhone6,1_7.0.3_11B511_Restore.ipsw]<br />
| <code>d937e7d24223167ed6f4214caf7e33e508d0c6f9</code><br />
| <br />
| 1,488,238,204<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPhone 5s GSM)|11B554a]]<br />
| [[1.03.01]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1855.20131114.P3wE4/iPhone6,1_7.0.4_11B554a_Restore.ipsw iPhone6,1_7.0.4_11B554a_Restore.ipsw]<br />
| <code>2a572e9c64b074c8bcd33611d330a82dc5986000</code><br />
| <br />
| 1,488,122,800<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPhone 5s GSM)|11B651]]<br />
| [[1.03.02]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-3045.20140221.8j5GW/iPhone6,1_7.0.6_11B651_Restore.ipsw iPhone6,1_7.0.6_11B651_Restore.ipsw]<br />
| <code>efa41357bdaff73e183c3aabaa3203a31c83d76a</code><br />
| <br />
| 1,488,005,853<br />
|}<br />
<br />
==== [[n53ap|iPhone6,2]] ====<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Baseband<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A466 (iPhone 5s Global)|11A466]]<br />
| rowspan="3" | Innsbruck<br />
| rowspan="3" | [[1.00.06]]<br />
| rowspan="2" | 18 Sep 2013<br />
| No download available<br />
| <code>n/a</code><br />
| rowspan="2" | Initial release.<br />
| ?<br />
|-<br />
| 7.0.1<br />
| [[Innsbruck 11A470a (iPhone 5s Global)|11A470a]]<br />
| [http://appldnld.apple.com/iOS7/031-0286.20130914.oNmiv/iPhone6,2_7.0.1_11A470a_Restore.ipsw iPhone6,2_7.0.1_11A470a_Restore.ipsw]<br />
| <code>17e83e7b8858c4c0940915dc749a325d33303f8f</code><br />
| 1,489,792,461<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPhone 5s Global)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/031-0310.20130924.Ym8Ej/iPhone6,2_7.0.2_11A501_Restore.ipsw iPhone6,2_7.0.2_11A501_Restore.ipsw]<br />
| <code>afa12b24f7134801f28cfa71f36cc875bc20eab3</code><br />
| <br />
| 1,489,951,321<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPhone 5s Global)|11B511]]<br />
| rowspan="4" | InnsbruckTaos<br />
| [[1.02.02]]<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0885.20131022.TG555/iPhone6,2_7.0.3_11B511_Restore.ipsw iPhone6,2_7.0.3_11B511_Restore.ipsw]<br />
| <code>0aacaded38c126066ffde1c4a79edaaccd762050</code><br />
| <br />
| 1,487,897,519<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPhone 5s Global)|11B554a]]<br />
| [[1.03.01]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1751.20131114.P3wE4/iPhone6,2_7.0.4_11B554a_Restore.ipsw iPhone6,2_7.0.4_11B554a_Restore.ipsw]<br />
| <code>3a124b0066d1d76264da6662a6b3e82f11388a1f</code><br />
| <br />
| 1,487,957,738<br />
|-<br />
| 7.0.5<br />
| [[InnsbruckTaos 11B601 (iPhone 5s Global)|11B601]]<br />
| rowspan="2" | [[1.03.02]]<br />
| 29 Jan 2014<br />
| [http://appldnld.apple.com/iOS7/031-2945.20140129.ww3Ed/iPhone6,2_7.0.5_11B601_Restore.ipsw iPhone6,2_7.0.5_11B601_Restore.ipsw]<br />
| <code>95f922ac40888b4ffe53b56449745cde30199c7d</code><br />
| <br />
| 1,488,076,167<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPhone 5s Global)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-3521.20140221.8j5GW/iPhone6,2_7.0.6_11B651_Restore.ipsw iPhone6,2_7.0.6_11B651_Restore.ipsw]<br />
| <code>3e38018fc9b7c261cd0c203bded21734f070999a</code><br />
| <br />
| 1,488,005,853<br />
|}<br />
<br />
== [[iPod touch]] ==<br />
{{:Firmware/Deprecated iPod touches}}<br />
=== [[iPod touch 5G|iPod touch (5th generation)]] ===<br />
{| class="wikitable" style="font-size: smaller; text-align: center;"<br />
|-<br />
! Version<br />
! Build<br />
! Codename<br />
! Release Date<br />
! IPSW Download URL<br />
! SHA1 Hash<br />
! Comments<br />
! File Size<br />
|-<br />
| 6.0<br />
| [[Sundance 10A406 (iPod touch 5G)|10A406]]<br />
| rowspan="2" | Sundance<br />
| 19 Sep 2012<br />
| [http://appldnld.apple.com/iOS6/Restore/041-3517.20120919.9ln3Q/iPod5,1_6.0_10A406_Restore.ipsw iPod5,1_6.0_10A406_Restore.ipsw]<br />
| <code>0f540ac8b38f91e5d16854dfa08f144d6f146193</code><br />
| Initial shipment.<br />
| 930,354,630<br />
|-<br />
| 6.0.1<br />
| [[Sundance 10A523 (iPod touch 5G)|10A523]]<br />
| 1 Nov 2012<br />
| [http://appldnld.apple.com/iOS6/041-7438.20121101.Usre4/iPod5,1_6.0.1_10A523_Restore.ipsw iPod5,1_6.0.1_10A523_Restore.ipsw]<br />
| <code>ca8710e9878d9e64318d69badfa29f0e40dce849</code><br />
| <br />
| 930,376,846<br />
|-<br />
| 6.1<br />
| [[Brighton 10B141 (iPod touch 5G)|10B141]]<br />
| rowspan="3" | Brighton<br />
| 28 Jan 2013<br />
| [http://appldnld.apple.com/iOS6.1/041-6488.20130128.L3etg/iPod5,1_6.1_10B141_Restore.ipsw iPod5,1_6.1_10B141_Restore.ipsw]<br />
| <code>cc79241eb3f5712a867a216445044d794884d83b</code><br />
| <br />
| 936,568,628<br />
|-<br />
| 6.1.2<br />
| [[Brighton 10B146 (iPod touch 5G)|10B146]]<br />
| 19 Feb 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-0731.20130215.At0tt/iPod5,1_6.1.2_10B146_Restore.ipsw iPod5,1_6.1.2_10B146_Restore.ipsw]<br />
| <code>5999e122124fbeb372b978eb8bf05eb7e243ff08</code><br />
| Exchange bug fix. <br />
| 936,577,616<br />
|-<br />
| 6.1.3<br />
| [[BrightonMaps 10B329 (iPod touch 5G)|10B329]]<br />
| 19 Mar 2013<br />
| [http://appldnld.apple.com/iOS6.1/091-2520.20130319.5gty7/iPod5,1_6.1.3_10B329_Restore.ipsw iPod5,1_6.1.3_10B329_Restore.ipsw]<br />
| <code>9cd17c39294c62447c2a6ef2e4e9445b98ce88a4</code><br />
| <br />
| 936,891,855<br />
|-<br />
| 7.0<br />
| [[Innsbruck 11A465 (iPod touch 5G)|11A465]]<br />
| rowspan="2" | Innsbruck<br />
| 18 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9476.20130918.jVRTr/iPod5,1_7.0_11A465_Restore.ipsw iPod5,1_7.0_11A465_Restore.ipsw]<br />
| <code>653ed7bedb6af2273ec5f542c41fba5b85a58891</code><br />
| <br />
| 1,246,340,596<br />
|-<br />
| 7.0.2<br />
| [[Innsbruck 11A501 (iPod touch 5G)|11A501]]<br />
| 26 Sep 2013<br />
| [http://appldnld.apple.com/iOS7/091-9844.20130924.XT0DT/iPod5,1_7.0.2_11A501_Restore.ipsw iPod5,1_7.0.2_11A501_Restore.ipsw]<br />
| <code>4d46ec1dd880bce19662fb59531d0df55d824e45</code><br />
| <br />
| 1,246,503,521<br />
|-<br />
| 7.0.3<br />
| [[InnsbruckTaos 11B511 (iPod touch 5G)|11B511]]<br />
| rowspan="3" | InnsbruckTaos<br />
| 22 Oct 2013<br />
| [http://appldnld.apple.com/iOS7/031-0912.20131022.Seedf/iPod5,1_7.0.3_11B511_Restore.ipsw iPod5,1_7.0.3_11B511_Restore.ipsw]<br />
| <code>04812c17c7f3085b4532f3de0691cd590c6c1df9</code><br />
| <br />
| 1,246,069,673<br />
|-<br />
| 7.0.4<br />
| [[InnsbruckTaos 11B554a (iPod touch 5G)|11B554a]]<br />
| 14 Nov 2013<br />
| [http://appldnld.apple.com/iOS7/031-1792.20131114.P3wE4/iPod5,1_7.0.4_11B554a_Restore.ipsw iPod5,1_7.0.4_11B554a_Restore.ipsw]<br />
| <code>dc9462881e9ff7726b0c51961cf941c410dbb757</code><br />
| <br />
| 1,246,118,227<br />
|-<br />
| 7.0.6<br />
| [[InnsbruckTaos 11B651 (iPod touch 5G)|11B651]]<br />
| 21 Feb 2014<br />
| [http://appldnld.apple.com/iOS7/031-2981.20140221.8j5GW/iPod5,1_7.0.6_11B651_Restore.ipsw iPod5,1_7.0.6_11B651_Restore.ipsw]<br />
| <code>92e5e3c036da614cc5d9f127eb667ffe7fa9844a</code><br />
| <br />
| 1,246,198,162<br />
|}<br />
<br />
== See also ==<br />
* [[Beta Firmware]]<br />
* [[OTA Updates]]<br />
* [[Jailbreak]]<br />
* [[VFDecrypt]]<br />
* [[Firmware Keys]]<br />
<br />
== External Links ==<br />
* [http://itunes.com/version Apple Firmware plist]<br />
* [http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml Apple OTA Firmware plist]<br />
<br />
[[Category:Firmware]]</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Chronic_Dev_(team)&diff=32075
Chronic Dev (team)
2013-05-08T06:07:53Z
<p>Posixninja: </p>
<hr />
<div>{{DISPLAYTITLE:Chronic Dev Team}}<br />
[[Chronic Dev (team)|Chronic Dev]] is not the same as the [[iPhone Dev Team]]. [[Chronic Dev (team)|Chronic Dev]] is a team of hackers. Actually they cannot be distinctly assigned with such a "team", some just work losely together and might also be in another team. According to their [http://chronic-dev.org/blog/who-we-are/ Blog page] the following members are currently in the team:<br />
<br />
== Official Members ==<br />
*[[User:DHowett|DHowett]]<br />
*[[User:Jaywalker|Jaywalker]]<br />
*[[User:Semaphore|semaphore]]<br />
*[[User:Westbaer|westbaer]]<br />
<br />
== Former Members ==<br />
*[[AriX]]<br />
*[[User:ChronicDev|chronic]]<br />
*[[CPICH]]<br />
*[[pod2g]]<br />
*[[User:posixninja|p0sixninja]]<br />
<br />
== Associates ==<br />
*[[bugout]]<br />
*[[User:Bushing|bushing]]<br />
*[[c1de0x]]<br />
*[[User:Chpwn|chpwn]]<br />
*[[User:Comex|comex]]<br />
*[[User:Geohot|geohot]]<br />
*[[ius]]<br />
*[[User:lilstevie|Lilstevie]]<br />
*[[User:MuscleNerd|MuscleNerd]]<br />
*[[User:NerveGas|NerveGas]]<br />
*[[nikias]]<br />
*[[User:Planetbeing|planetbeing]]<br />
*[[psp250]]<br />
*[[User:Jan0|jan0]]<br />
*[[User:pumpkin|pumpkin]]<br />
*[[saurik]]<br />
<br />
==Projects==<br />
*[[iRecovery|iRecovery / libirecovery]]<br />
*[[Greenpois0n (toolkit)|greenpois0n]]<br />
*[[GenPass]]<br />
<br />
==Links==<br />
*[http://chronic-dev.org/blog/ Chronic Dev Blog]<br />
*[https://github.com/Chronic-Dev GitHub]<br />
*[http://chronicdev.googlecode.com/ Chronic Dev google code]<br />
*[http://twitter.com/chronicdevteam Chronic Dev Team on Twitter]<br />
[[Category:Hackers]]<br />
[[Category:Teams]]</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Talk:OTA_Updates&diff=28254
Talk:OTA Updates
2012-11-23T00:18:23Z
<p>Posixninja: </p>
<hr />
<div>== Encryption ==<br />
Are the updates encrypted in any way ([[VFDecrypt]]?) --[[User:5urd|5urd]] 18:31, 30 August 2011 (MDT)<br />
:No. Just regular Zips. --[[User:M2m|M2m]] 22:36, 30 August 2011 (MDT)<br />
:Only NOR payloads and RAM disks are encrypted, rest of the "asset" is unencrypted --pjakuszew 04:19, 31 August 2011 (MDT)<br />
::But if you need to update iTunes to 'decrypt' the newest firmware (as iTunes contains the 'password' to do so), then that means that the encrypted stuff has a 'password' that is somewhere on the file system. Maybe if we could access it, we could get them. (maybe disassembling iTunes could get us them also :D) --[[User:5urd|5urd]] 11:12, 31 August 2011 (MDT)<br />
:::iTunes doesn't contain any "passwords" 5urd. Everything is done on the device and usually uses the device's built in hardware AES crypt keys. -- [[User:iH8sn0w|iH8sn0w]] 13:32, 31 August 2011 (EST)<br />
::::Dang, but then why do we need to update iTunes to update our device? --[[User:5urd|5urd]] 11:35, 31 August 2011 (MDT)<br />
:::::Its purpose is to send out firmware files to the device, and only that. --pjakuszew 11:36, 31 August 2011 (MDT)<br />
::::::I still don't get the point of updating iTunes (other than avoiding an error) --[[User:5urd|5urd]] 11:45, 31 August 2011 (MDT)<br />
:::::::Updating is required because of incompatibilites with newer iOS versions. I think it's about Fairplay and encryption of iPod library database. Another example is support of new hardware; how would you update a 3GS with iTunes 7.5? --pjakuszew 11:56, 31 August 2011 (MDT)<br />
::::::::Ok, that makes sense. Thanks! --[[User:5urd|5urd]] 12:14, 31 August 2011 (MDT)<br />
<br />
== Tracker ==<br />
Anyone into making a watchguard that tracks mesu.apple.com for changes (and records them)? --[[User:M2m|M2m]] 00:55, 12 November 2011 (MST)<br />
:I did a [http://cole.freehostingcloud.com/scripts/Apple%20OTA%20Update%20Checker.php crude one]. It works by comparing against a list of already done URLs in an array --[[User:5urd|5urd]] 13:16, 12 November 2011 (MST)<br />
:::I would just curl --user-agent="softwareupdateservicesd (unknown version) CFNetwork/539 Darwin/11.0.0" http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml -o OTA.xml and pipe it into shasum. In case shasum change, save as new version with date and time (and display)... --[[User:M2m|M2m]] 19:00, 12 November 2011 (MST)<br />
::::One problem with that is that I can't test it on my computer here at my house as I am on windows. To test it with curl I would need to upload it to my website. What I did was open a connection with fsockopen(), sent some request headers, then read the response to a string. After that, I parsed the [[PLIST File Format|plist]] to an array. Unfortunately, the parser leaves some artifacts on the hash as it is a compressed hash. So I decided to use the file location instead. It still works pretty well. I had to remove the URL form area as it messed with the array in unwanted ways. I am working on moving it from an array to just line by line URLs preventing the failure as I just append the line to it. When I finish it, I will post the code on [http://cole.freehostinglcoud.com/cms/Scripts:PHP/Apple_OTA_Update_Checker my website]. --[[User:5urd|5urd]] 21:43, 12 November 2011 (MST)<br />
::::: curl is avialable for windows[http://curl.haxx.se/download.html] --[[User:M2m|M2m]] 04:43, 13 November 2011 (MST)<br />
:::::: doesn't matter, it already works and spits out a nice table. --[[User:5urd|5urd]] 16:05, 13 November 2011 (MST)<br />
::::::: So is your tracker available online already ? --[[User:M2m|M2m]] 19:59, 26 November 2011 (MST)<br />
:::::::: Yes. When you add a link to the wiki, you can add it to the textbox one per line and click submit and it wont show up again. --[[User:5urd|5urd]] 13:37, 27 November 2011 (MST)<br />
:::::::: [http://pastie.org/2930838 Spammers]. It doesn't work because it works like this:<br />
for (<br />
$i = 0;<br />
$i < sizeof(array_keys($plist['Assets']));<br />
$i++)<br />
{<br />
if (<br />
!in_array(<br />
$plist['Assets'][$i]['__BaseURL'] . $plist['Assets'][$i]['__RelativePath'],<br />
$usedurls)<br />
)<br />
{<br />
// Output table<br />
}<br />
}<br />
:::::::: --[[User:5urd|5urd]] 17:34, 27 November 2011 (MST)<br />
::::::::: Should do the trick to make a backup of OTA.xml's whenever there is a change<br />
#!/bin/bash<br />
SHA_OLD=1<br />
while true; do<br />
SHA_CUR=$(curl --user-agent 'softwareupdateservicesd (unknown version) CFNetwork/539 Darwin/11.0.0' http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml | shasum)<br />
<br />
if [ "$SHA_OLD" = "$SHA_CUR" ]; then<br />
echo nothing to do<br />
else<br />
NOW=$(date +"%F")<br />
NOWT=$(date +"%T")<br />
echo download<br />
curl --user-agent 'softwareupdateservicesd (unknown version) CFNetwork/539 Darwin/11.0.0' http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml -o OTA_$NOW-$NOWT.xml<br />
<br />
SHA_OLD=$(curl --user-agent 'softwareupdateservicesd (unknown version) CFNetwork/539 Darwin/11.0.0' http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml | shasum)<br />
fi<br />
sleep 600<br />
done<br />
:::::::::--[[User:M2m|M2m]] 08:33, 24 March 2012 (MDT)<br />
<br />
== Carrier Beta ==<br />
What is a carrier beta? --[[User:5urd|5urd]] 18:33, 9 January 2012 (MST)<br />
:Most likely a beta for carrier provisions. --[[User:Rdqronos|rdqronos]] 16:19, 26 March 2012 (MDT)<br />
:: <code>-_-</code> --[[User:5urd|5urd]] 14:33, 21 July 2012 (MDT)<br />
<br />
== Applying .patch files from OTA updates ==<br />
Hey guys, has anyone successfully "patched" a file with a .patch file from the "patches" folder of an OTA update? I am trying to do this and can't get it to work. I have tried on OS X, iOS, and Linux, with multiple different patches, and always get the same error:<br /><br />
patch: **** Only garbage was found in the patch input.<br />
With --verbose option:<br />
Hmm... I can't seem to find a patch in there anywhere.<br />
I understand from some research that common .patch files have a certain syntax to them, bu I have looked inside these .patch files (using a text editor) and they never contain any readable text (even a .txt.patch file). This leads me to believe that iOS uses a specific and exclusively designed version of Patch. If so, how would I make use of that?<br /><br />
Ideally I would patch the files on-device via SSH, as I am developing something yet-to-be-announced which would need to do so automatically. If needed, it could alternatively be done using Mac OS X or Linux.<br /><br />
I would greatly appreciate any help, --[[User:ValleyForge|ValleyForge]] 23:12, 28 June 2012 (MDT)<br />
:I'd like to help, but I need to learn :P --[[User:Dylan Laws|Haifisch]] 21:49, 5 July 2012 (MDT)<br />
::I actually figured it out, you have to use the bspatch command which is available on iOS, Mac OS X, Linux, and Windows :) --[[User:ValleyForge|ValleyForge]] 22:59, 5 July 2012 (MDT)<br />
:::Fancy wanna iMessage me and we can brain storm what good can come out of this. Maybe a jailbreak technique ;) --[[User:Dylan Laws|Haifisch]] 10:21, 6 July 2012 (MDT)<br />
::::Quick note: all OTA updates are signed with a private key owned by Apple. Unless you get into that department of Apple, you can't sign them without brute force. --[[User:5urd|5urd]] 12:09, 6 July 2012 (MDT)<br />
<br />
== File Names ==<br />
Does anyone have the slightest on how Apple names their files? It looks like a hash that is 20 bytes long (40 hex chars/160 bits). From [[wikipedia:List of hash functions|this list]], there are a few like that, but none that I have heard of. --[[User:5urd|5urd]] 14:32, 21 July 2012 (MDT)<br />
: Should be the SHA-1 of the file.--[[User:M2m|M2m]] 21:14, 21 July 2012 (MDT)<br />
<br />
== Resequence? and deleting files? ==<br />
# In most updates there are "added", "patches", and "replace" folders in the payload folder. In the iOS 6.0 updates, there is a folder among those named "resequence". What does this do? Currently the only file contained in the resequence folder is the dyld cache.<br />
# How do OTA updates control which/whether files are deleted? Where is it specified which files are deleted, or do they delete files at all?<br />
--[[User:ValleyForge|ValleyForge]] 23:55, 29 September 2012 (MDT)<br />
<br />
== Documentation ==<br />
Someone should make a page with the documentation links, here's the XML: http://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdateDocumentation/com_apple_MobileAsset_SoftwareUpdateDocumentation.xml --[[User:Srb21103|Srb21103]] 20:16, 20 November 2012 (MST)<br />
<br />
== Exploits ==<br />
I'm interested in this stuff also. I have a sense there's an exploit here somewhere, but I haven't had time to look into it --[[User:Posixninja|posixninja]] 17:18, 22 November 2012 (MST)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Talk:Main_Page&diff=27115
Talk:Main Page
2012-10-11T07:42:26Z
<p>Posixninja: </p>
<hr />
<div>{{Talk Archive|2010|2011|2012}}<br />
<br />
== [[iPhone Tracker]] ==<br />
Can we add iPhone Tracker to this page? --[[User:5urd|5urd]] 10:06, 8 October 2012 (MDT)<br />
<br />
== Apple TV 3 ==<br />
As I am told, it is Apple TV 3G. Just because the blogs use "iPod Touch 4," that doesnt mean we use that. --[[User:5urd|5urd]] 17:30, 7 March 2012 (MST)<br />
<br />
== Firmware ==<br />
How is iOS 5.1 for iPhone 3GS Jailbreakable untethered for old bootrom and tethered for new bootrom when the holes were patched(from what I understand) and on the main page it shows there is no jailbreak for everything else. I'm confused here. {{unsigned|Staycool72|8 March 2012, 0:43 GMT}}<br />
:I am going to try and answer though it is hard to tell what you are asking by your grammar. Those are bootrom exploits, which cannot be patched by any firmware update. There isn't a jailbreak available though, they have to update the programs like redsn0w to work with the new version of iOS. Once it is updated the jailbreak will be untethered for old bootroms and tethered for the new ones (excluding 4S and iPads since there isn't any bootrom exploits for those). Modern jailbreaks require userland exploits to be untethered, but iOS 5.1 patched the vulnerabilities we have been using to get untethered. Hope that helps. --[[User:Jacob|Jacob]] 18:09, 7 March 2012 (MST)<br />
::Correct the vulnerabilities for iOS 5.1 are patched so therefor on the firmware page iOS 5.1 for iPhone 3GS should say no for (Can it be jailbroken? (old bootrom and new bootrom) and not yes, that it why I am confused because the main page says no --[[User:Staycool72|Staycool72]] 20:30, 7 March 2012 (EST)<br />
:::iOS 5.1 can be jailbroken on the iPhone 3GS, but at the time of writing this, there are no tools that support jailbreaking iOS 5.1. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 18:34, 7 March 2012 (MST)<br />
::::ok it answers my question. --Staycool72 20:49, 7 March 2012 (EST)<br />
<br />
== Brazilian Carriers and Cellular Devices ==<br />
Wanted to let you people know that all Cellular devices sold in Brazil must be factory-unlocked according to a federal law. This should be added to the main page, as it already states the same about GSM iPads in everywhere but Japan. Cellular devices sold in Brazil must be factory-unlocked or the supplier must provide an official unlock if the user demands so.<br />
[[User:Luxiel|Luxiel]] 06:55, 24 April 2012 (MDT)<br />
:I'm against this. Japan is the other way round, an exception. Many countries now sell unlocked devices. Anybody else? --[[User:Http|http]] 16:15, 24 April 2012 (MDT)<br />
::I'll have to say no to this also. Cellular iPads are sold unlocked in every country except Japan (and maybe a few others that we don't know of). --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 16:56, 24 April 2012 (MDT)<br />
:::My bad, I think I mistook the real reason behind that information being stated... Thanks for the answers. --[[User:Luxiel|Luxiel]] 08:28, 2 May 2012 (MDT)<br />
<br />
== Baseband Chip Page Titles ==<br />
<br />
For the baseband chip page titles, I think we should stick with the model number despite the marketing name. Pages:<br />
* [[S-Gold 2|PMB8876]] marketed "S-Gold 2"<br />
* [[X-Gold 608|PMB8878]] marketed "X-Gold 608"<br />
* [[XMM 6180]] marketed "X-Gold 618"<br />
* [[MDM6600]] (unknown marketing name)<br />
* [[MDM6610]] (unknown marketing name)<br />
* [[MDM9x00]] (unknown marketing name)<br />
--[[User:5urd|5urd]] 21:35, 8 May 2012 (MDT)<br />
:I'm leaning more towards the marketing names, since I think people are more familiar with them and they've been in use for a long time. We've always referred to the iPhone 2G's baseband as the "S-Gold 2" and the iPhone 3G/3GS's baseband as the "X-Gold 608." (By the way, it sounds like Qualcomm "markets" their chips by model number. [http://www.qualcomm.com/media/releases/2011/02/14/qualcomm-announces-commercial-availability-gobi3000-modules]) --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 00:11, 9 May 2012 (MDT)<br />
:I created most of these newer pages and always used the model number (without space). So I agree with that in general. Changing old ones is a totally different story though, where we need more consent. I would be for it (and create a redirect on the marketing names). --[[User:Http|http]] 01:52, 9 May 2012 (MDT)<br />
<br />
== Baseband downgrade possibility: Attempt for 04.11.08/04.12.01 to 04.10.01 ==<br />
'''0x1''' There is no downgrade possibility; according to the most basis of fact in how baseband works as explained by dear MuscleNerd and there is signature checks as well as bootloader's chain of trust that I'm not going to repeat them again, but for this topic I start from iTunes error 1,-1,11 <br />
<br />
'''0x2''' iTunes error 1,-1,11 :<br />
We will get this error whenever we want to do something with BB which is not allowed by apple. you can read about these error in detail from here[http://theiphonewiki.com/wiki/index.php?title=ITunes_Errors].<br />
Going deeper, this error raise by baseband's bootloader whenever you attempt to downgrade BB (in this case), this happens inside the NOR so this is why we can not exploit it easily from the outside.<br />
Another reason for this error (and in here the most important one that I wanted to discuss) is that apple no longer signing that firmware.<br />
<br />
'''0x3''' The situation that there is no BB installed on iPhone! :<br />
I could restore my iPhone4 in the case of there will be no BB at all. I called it reset my BB. There will be no Wifi, no BT.<br />
At the first time (a few months since I've started to work on) I thought it is dead (as apple confirmed this also). But I could restore it only to stock firmware with the latest one.<br />
So for who stays in 04.11.08 it may lead to do upgrade to 04.12.01 permanently with the latest iOS, now is 5.1.1 and before for me was 5.0.1, so be sure what you are doing and then go to reset the BB.<br />
So back to the game, if there was no BB then there is no bootloeader inside the NOR to stuck BB update process but I do not know that in this case what happened to "sectable" also known as "locktable" which is the master accountable to unlock the carrier, any way I think so only firmware signature checking by apple will be remain in "restore verify process" by iTunes. because as mentioned earlier, "currentBB"(BB to be updated) is allowed to be update by "comingBB" (BB to be updating to) only if :<br />
1. "currentBB" < "comingBB" (= are you the most recent/lastest BB?)<br />
2. "comingBB" is now signing by apple (=if so, does apple sign you? Are you eligible?) <br />
Huum... What happens if "currentBB"="null/zero/no matter"? Could we eliminate option (1) from the security check above in this case? So what next?<br />
<br />
'''0x4''' Track back to the issue lead us inside the bbfw file (ICE3_04.11.08_BOOT_02.13.Release) which contains four .fls files inside, and the most important one is psi_flash.fls who is in charge of security checks before handover the routines to stack.fls which is responsible for updating the baseband. This file does like NOR bootloader but fortunately it's outside the device so it is accessible but not such easy format to be understand by programmers. They are raw ROM based images for XMM6180 chip, ARM based and programmed in Thread-X, but the compiler is unknown; I will write about some disassembly notes using ida pro 6.1; by the way I leave my iPhone with no BB trying to find out and break the trust chains in the above files in order to bypass the bootloader security checks which may let us to downgrade to 04.10.01 which is currently unlocked by Gevey.<br />
Keep in mind that if this solution works..., it will need the SHSH for downgrading the iOS firmware to do reset the BB.<br />
I heard that iPhoneDevTeam are going to release the new version of Redsn0w which there will be no need to restore by iTunes but I do not know if the baseband approaches supposed to be addressed or it will work like iFaith that is basically bypass (preserve) BB, any way if I found this article useful I will note about disassembly and possibility approach as well as BB reset to share with any followers.<br />
'''--[[User:Kambiz|Kambiz]] 07:49, 13 May 2012 (MDT)K.N'''<br />
<br />
== Bluetooth Chip on [[iPhone 5]] ==<br />
Is there any confirmation of the Bluetooth chip used in the iPhone 5? If there is, can we edit this page and add it? --|[[User:5urd|5urd]] 10:04, 8 October 2012 (MDT)<br />
:Chipworks [http://www.chipworks.com/blog/recentteardowns/2012/10/02/apple-iphone-5-the-rf/ analyzed the iPhone 5's Murata Wi-Fi module] and determined it uses the [[BCM4334]]. I'll add it to the Main Page now. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 20:35, 8 October 2012 (MDT)<br />
<br />
== Change Jailbreak Table ==<br />
Can we change the jailbreak table to be vertical? Or at least put deprecated devices on a new line? Because at apple releases the iPad 4 while still keeping the 3GS and most likely the iPad 2 until iOS 7, the page is going to get really wide and making sure it looks good at almost all screen resolutions will be a real pain in the @$$ (like what iDebStore really is).<br /><br />
A vertical table may not be appealing for a home page, but putting the old devices on in a new table or making it like [[VFDecrypt Keys]]' tables are. Any thoughts? --[[User:5urd|5urd]] 10:11, 8 October 2012 (MDT)<br />
:Maybe we can drop devices that Apple no longer updates from the table entirely. Owners of these devices don't really need to worry about whether or not their device can be jailbroken, after all. --[[User:Dialexio|<span style="color:#C20; font-weight:normal;">Dialexio</span>]] 20:35, 8 October 2012 (MDT)<br />
::I like the idea of getting rid of dropped devices. We could just redirect them to [[Jailbreak]]. --[[User:5urd|5urd]] 10:22, 9 October 2012 (MDT)<br />
<br />
== Administration ==<br />
Someone needs to help this website. It's starting to fall apart... --[[User:Posixninja|posixninja]] 01:42, 11 October 2012 (MDT)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Durango_8G4_(iPad2,1)&diff=17031
Durango 8G4 (iPad2,1)
2011-03-26T06:40:20Z
<p>Posixninja: this isn't a scoreboard</p>
<hr />
<div>== Decryption Keys ==<br />
=== [[/|Root Filesystem]] (038-0887-005.dmg) ===<br />
*'''[[VFDecrypt]] Key''': 6f7502e91f3239f907b6bf8955f191b276ec57c392d2beffb3fbc5392da0bc86e65d684e</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Talk:Bootrom_Dumper_Utility&diff=14467
Talk:Bootrom Dumper Utility
2010-12-29T23:41:52Z
<p>Posixninja: </p>
<hr />
<div>If anyone gets it working for iPod touch 2G let me know. I am trying to work on it, but not much spare time --[[User:JacobVengeance|JakeAnthraX]] 07:27, 23 December 2010 (UTC)<br />
:[https://github.com/liamchat/Bootrom-Dumper/tree/master/stake4uce my fork] should work --[[User:Liamchat|liamchat]] 16:27, 24 December 2010 (UTC)<br />
:You can also use the current iPod touch 2G openiBoot [https://github.com/kleemajo/openiBoot link]. The bootrom is at 0x20000000 on the 2g touch --[[User:Kleemajo|Kleemajo]] 01:02, 26 December 2010 (UTC)<br />
::I ended up making my own very crappy steaks4uce version to dump it. I didn't realize you made a version liam, nice job. Also where did you guys get your ARM toolchain? The one I use keeps breaking and giving me errors lately.--[[User:JacobVengeance|JakeAnthraX]] 03:38, 29 December 2010 (UTC)<br />
::: i use sudo port install arm-elf-binutils and sudo port instal arm-elf-gcc--[[User:Liamchat|liamchat]] 10:56, 29 December 2010 (UTC)<br />
:::: Using that I just get errors when compiling everything. I had it working on my last setup when I wrote my crappy syeaks4uce method, but now it isn't working. I will figure it out sooner or later. Thanks anyways. --[[User:JacobVengeance|JakeAnthraX]] 22:45, 29 December 2010 (UTC)<br />
use toolchain.txt from openiboot, it works perfect --[[User:Posixninja|posixninja]] 23:41, 29 December 2010 (UTC)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Greenpois0n_(jailbreak)&diff=14466
Greenpois0n (jailbreak)
2010-12-29T23:23:56Z
<p>Posixninja: </p>
<hr />
<div>[[Image:Gp.png|180px|right]]<br />
<br />
Greenpois0n is both a cross-platform hacker toolkit (that helps users to find their own exploits for jailbreaks, write custom ramdisks, and create custom firmwares) as well as a [[jailbreak]] tool for iDevices written by [[Chronic Dev (team)]]. <br />
<br />
== Toolkit ==<br />
*[http://github.com/Chronic-Dev/syringe GreenPois0n Syringe]: Greenpois0n's exploit injector, to assist in booting devices into jailbroken states.<br />
*[http://github.com/Chronic-Dev/cyanide GreenPois0n Cyanide]: [[iBoot]] payload toolkit to help developers discover new vulnerabilities and design super fast, low-level iBoot jailbreaks and exploit payloads, much like the way [[blackra1n]]/[[purplera1n]] works.<br />
*[http://github.com/Chronic-Dev/libdioxin GreenPois0n Dioxin]: MobileDevice toolkit designed to help developers design awesome userland jailbreaks, like how [[Spirit]] works.<br />
*[http://github.com/Chronic-Dev/anthrax GreenPois0n Anthrax]: iPhone ramdisk toolkit to help developers design extremely stable and portable ramdisk jailbreaks, much like the same way [[QuickPwn]]/[[redsn0w]] works.<br />
*[http://github.com/Chronic-Dev/arsenic GreenPois0n Arsenic]: custom firmware toolkit to help developers design jailbreaks to help preserve [[Baseband Firmware|baseband]] and keep unlocks, much in the same way [[PwnageTool]]/[[sn0wbreeze]] works.<br />
<br />
== Jailbreak ==<br />
The downloads for greenpois0n can be found on the [http://www.greenpois0n.com/ website]. It is available for Windows, Mac, and Linux.<br />
<br />
Source Code: [https://github.com/Chronic-Dev Greenpois0n]<br />
<br />
== History ==<br />
Greenpois0n was originally written using two exploits: SHAtter (a [[bootrom]] [[exploit]]) as well as a userland [[kernel]] [[exploit]] provided by [[User:Comex|Comex]] to make the jailbreak [[untethered jailbreak|untethered]]. A release date of 10/10/10 10:10:10 AM (GMT) was announced, as well as the list of supported devices. Due to the nature of SHAtter, only iDevices using the [[S5L8930|A4 Processor]] were supported.<br />
[[user:geohot|geohot]] later released another jailbreak ([[limera1n]] using a different [[bootrom]] [[exploit]]) on 9 October 2010, which led to a delay in greenpois0n's release (to implement geohot's exploit, not SHAtter).<br />
<br />
=== Controversy ===<br />
There was much controversy surrounding the sudden release of [[limera1n]] and the motives behind it. The main reasons for the [[limera1n]] release were:<br />
<br />
#Use an exploit that Apple already knew about (newer [[iBoot]]s shows the exploit patched) <br />
#Supports more iDevices than SHAtter<br />
#Hopefully save the SHAtter [[bootrom]] [[exploit]] for future iDevices<br />
<br />
The reason for this is [[bootrom]] [[exploit]]s are not patchable with software updates. It requires new hardware to fix the security hole. Since the [[limera1n]] hole was already discovered and patched by Apple, it benefits the community if SHAtter is saved in hopes of using it with new hardware, like the 5th generation iPhone/iPod touch and the iPad 2G.<br />
<br />
=== Supported Devices ===<br />
greenpois0n requires the device to be on either iOS 3.2.2 ([[K48ap|iPad 1G]]) or iOS 4.1 (all other devices). Of the devices that support these firmware revisions, the only one ''not'' supported is the [[N82ap|iPhone 3G]].<br />
<br />
=== Output ===<br />
[[N90ap|iPhone 4]] with [[greenpois0n]] output (via irecovery):<br />
<br />
Attempting to initialize greenpois0n<br />
Initializing commands<br />
Searching for cmd_ramdisk<br />
Found cmd_ramdisk string at 0x8401c7ac<br />
Found cmd_ramdisk reference at 0x84000d64<br />
Found cmd_ramdisk function at 0x84000cd1<br />
Initializing patches<br />
Initializing memory<br />
Initializing aes<br />
Searching for aes_crypto_cmd<br />
Found aes_crypto_cmd string at 0x84021a8c<br />
Found aes_crypto_cmd reference at 0x84017bb8<br />
Found aes_crypto_cmd fnction at 0x84017b51<br />
Initializing bdev<br />
Initializing image<br />
Initializing nvram<br />
Initializing kernel<br />
Greenpois0n initialized<br />
<br />
<br />
[[Category:Hacking Software]]</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=S5L8930&diff=9109
S5L8930
2010-09-09T17:53:09Z
<p>Posixninja: </p>
<hr />
<div>An SoC developed by Apple in-house chip design department. It is currently used in [[k48ap|iPad]], [[N90ap|iPhone 4]], and [[N81ap|iPod Touch 4G]]. Publicly, Apple refers to this chip as the '''A4'''.<br />
<br />
== Exploits ==<br />
===[[Bootrom]]===<br />
* [[SHAtter]]<br />
<br />
=== [[iBoot]] ===<br />
* [http://www.youtube.com/watch?v=0NValNoW5Rc Unreleased Untethered iBoot Exploit]<br />
<br />
=== [[Kernel]] ===<br />
* [[BPF STX Kernel Write Exploit]] - Works up to [[iOS]] 3.2<br />
* [[IOSurface Kernel Exploit]] - Works up to [[iOS]] 3.2.1<br />
<br />
=== [[Userland]] ===<br />
* [[MobileBackup Copy Exploit]] - Works up to [[iOS]] 3.2<br />
* [[PDF CFF Font Stack Overflow]] - Works up to [[iOS]] 3.2.1<br />
<br />
== Boot Chain ==<br />
[[S5L8930 (Bootrom)|Bootrom]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[Firmware|System Software]]<br />
<br />
== Specifications ==<br />
* '''CPU''': ARM Cortex-A8<br />
* '''GPU''': PowerVR SGX 535<br />
* '''A/V Playback''': PowerVR VXD<br />
<br />
These are the same specifications as the [[S5L8920]] and [[S5L8922]], except this processor has a higher clock speed.<br />
<br />
== See also ==<br />
* [[S5L8930 (Bootrom)]]<br />
<br />
== Links ==<br />
* http://www.apple.com/ipad/specs/<br />
* http://www.brightsideofnews.com/news/2010/1/27/apple-a4-soc-unveiled---its-an-arm-cpu-and-the-gpu!.aspx</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Usb_control_msg(0x21,_2)_Exploit&diff=8528
Usb control msg(0x21, 2) Exploit
2010-08-20T03:16:38Z
<p>Posixninja: Added a bit more detail about what kind of vulnerabality it is, how it was exploited, and removed some of the first person talk</p>
<hr />
<div>{{DISPLAYTITLE:usb_control_msg(0x21, 2) Exploit}}<br />
A null pointer dereference vulnerability exists in the versions of [[iBoot]]/[[iBSS]]/[[iBEC]] found in firmwares 3.1/3.1.1 and 3.1.2 (and presumably everything before) on all iDevices. It was fixed in [[iBoot-636.66.33]], which was included with 3.1.3. [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]]) and [[N18ap|iPod touch 3G]] owners who saved their [[SHSH]] for the aforementioned firmwares, and MC-model [[N72ap|iPod touch 2G]] owners can use it for a [[tethered jailbreak]] on 4.0. [http://ih8sn0wforums.com/viewtopic.php?f=56&t=1928] [http://blog.qwertyoruiop.com/?p=154]<br />
<br />
== Credit (Alphabetical) ==<br />
* '''vulnerability''': [[pod2g]] and [[westbaer]], also discovered independently by [[gray]], also discovered independently by [[geohot]]<br />
* '''exploitation''': [[ius]], [[chronic]], [[pod2g]], and [[posixninja]]<br />
* '''payload ([[greenpois0n]])''': [[chronic]] and [[posixninja]]<br />
<br />
== Vulnerability ==<br />
'''[[pod2g]]''' and '''[[westbaer]]''' discovered, via some reversing + fuzzing, you could overwrite the content of 0x0 thanks to Apple not checking the contents of a register they should have, shown in the disassm below. This can be exploited because MMU maps whatever is running ([[LLB]], [[iBoot]], etc.) to 0x0 so that if an exception vector is triggered, it would jump to the one designed to be used with what is running, versus jumping to what is normally located at 0x0, the [[S5L8920 (Bootrom)|bootrom]].<br />
<br />
All you need to do is send the following (assuming you're using libusb 0.1.x)...<br />
usb_control_msg(iDev, 0x21, 2, 0, 0, 0, 0, 1000);<br />
And thanks to our vulnerability, it will do this:<br />
memcpy(0, LOAD_ADDR, 0x2000);<br />
<br />
As you can see, we now have full control over the first 0x2000 bytes of iBoot.<br />
<br />
=== Disassm ===<br />
<pre><br />
// R5: a pointer to a buffer is here if requesttype==0xA1.<br />
// however, if requesttype==0x21, R5 is undefined.<br />
<br />
SRAM:22009ED2 code_1 ; CODE XREF: handle_file_io_control_req+62�j<br />
SRAM:22009ED2 014 36 49 LDR R1, =usb_file_loadaddr<br />
SRAM:22009ED4 014 36 4B LDR R3, =usb_file_offset<br />
SRAM:22009ED6 014 28 68 LDR R0, [R5]<br />
SRAM:22009ED8 014 09 68 LDR R1, [R1]<br />
SRAM:22009EDA 014 1B 68 LDR R3, [R3]<br />
SRAM:22009EDC 014 22 1C ADDS R2, R4, #0<br />
SRAM:22009EDE 014 C9 18 ADDS R1, R1, R3<br />
SRAM:22009EE0 014 07 F0 94 EF BLX memcpy<br />
SRAM:22009EE4 014 00 2E CMP R6, #0<br />
SRAM:22009EE6 014 53 D0 BEQ return<br />
SRAM:22009EE8 014 01 23 MOVS R3, #1<br />
SRAM:22009EEA 014 33 60 STR R3, [R6]<br />
SRAM:22009EEC 014 50 E0 B return<br />
</pre><br />
<br />
== Exploitation ==<br />
By using a vector rewrite attack [http://www.juniper.net/solutions/literature/white_papers/Vector-Rewrite-Attack.pdf], it's possible to replace the address of the irq vector handler (0x38) within a 0x2000 [[iBoot]] chunk that we send, with the location of the payload to be executed. Although, since we are hijacking the irq exception vector, you must disable interrupts first. Here is the basic procedure:<br />
* Call enter_critical_task(); disabling interrupts, so that your code can reliably execute.<br />
* Restore 0x38 (irq handler) with the original irq vector address<br />
* '''DO WHAT YOU WANT AT THIS POINT, YOU MAY NOT USE INTERRUPTS'''.<br />
* Call exit_critical_task(); re-enabling interrupts.<br />
* Call the irq handler so that the interrupt request that you hijacked can execute.<br />
<br />
=== Roadblocks ===<br />
If what you send is not 0x2000 bytes, the remainder is filled in with zeroes, which is bad. Due to this, you need to restore the first 0x2000 of iBoot before your payload returns execution to [[iBoot]]. Also you must disable interrupts, to prevent iBoot from calling the irq vector while your payload is being executed. Because of this, it rules out the possibility of reading the 0x2000 iBoot chunk needed from NOR, from within iBoot itself, since nor_read(); requires interrupts.<br />
<br />
One way to get around the need of sending the 0x2000 [[iBoot]] chunk is to hook the image_load(); function in the LLB which is sitting intact in memory. This was successfully done in [[blackra1n]]. <br />
<br />
The [[PwnageTool]] method requires an [[IPSW]] to be input in order to create a custom firmware anyway, so the 0x2000 chunk is not an issue. It can just be copied from the [[iBoot]] in the [[IPSW]].<br />
<br />
=== Implementation ===<br />
[[blackra1n]]<br />
<br />
[[Category:Exploits]]</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Chronic_Dev_(team)&diff=8522
Chronic Dev (team)
2010-08-20T02:31:46Z
<p>Posixninja: /* Associates */</p>
<hr />
<div>{{DISPLAYTITLE:Chronic Dev Team}}<br />
[[Chronic Dev (team)|Chronic Dev]] is not the same as the [[iPhone Dev Team]]. [[Chronic Dev (team)|Chronic Dev]] is a team of hackers. Actually they cannot be distinctly assigned with such a "team", some just work losely together and might also be in another team. According to their [http://chronic-dev.org/blog/who-we-are/ Blog page] the following members are currently in the team:<br />
<br />
== Official Members ==<br />
*[[posixninja]]<br />
*[[User:ChronicDev|chronic]]<br />
*[[pod2g]]<br />
*[[OPK]]<br />
*[[User:Semaphore|semaphore]]<br />
*[[User:DHowett|DHowett]]<br />
*[[AriX]]<br />
*[[westbaer]]<br />
*[[ius]]<br />
*[[User:Jaywalker|Jaywalker]]<br />
*[[User:NerveGas|NerveGas]]<br />
<br />
== Associates ==<br />
*[[bugout]]<br />
*[[User:Bushing|bushing]]<br />
*[[c1de0x]]<br />
*[[chpwn]]<br />
*[[User:Comex|comex]]<br />
*[[copumpkin]]<br />
*[[CPICH]]<br />
*[[User:MuscleNerd|MuscleNerd]]<br />
*[[nikias]]<br />
*[[User:Planetbeing|planetbeing]]<br />
*[[psp250]]<br />
*[[saurik]]<br />
<br />
==Projects==<br />
*[[iRecovery|iRecovery / libirecovery]]<br />
*[[greenpois0n]]<br />
*[[GenPass]]<br />
<br />
==Links==<br />
*[http://chronic-dev.org/blog/ Chronic Dev Blog]<br />
*[http://chronicdev.googlecode.com/ Chronic Dev google code]<br />
*[http://twitter.com/chronicdevteam Chronic Dev Team on Twitter]<br />
[[Category:Hackers]]</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Talk:Zeratul&diff=8431
Talk:Zeratul
2010-08-18T04:08:57Z
<p>Posixninja: </p>
<hr />
<div>hmmm.... no credits for the actual makers of irecovery? well that's kinda bullshit --[[User:Posixninja|posixninja]] 04:08, 18 August 2010 (UTC)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Talk:Zeratul&diff=8430
Talk:Zeratul
2010-08-18T04:08:10Z
<p>Posixninja: New page: hmmm.... no credits for the makes of the actually irecovery too? well that's kinda bullshit --~~~~</p>
<hr />
<div>hmmm.... no credits for the makes of the actually irecovery too? well that's kinda bullshit --[[User:Posixninja|posixninja]] 04:08, 18 August 2010 (UTC)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Chronic_Dev_(team)&diff=8324
Chronic Dev (team)
2010-08-14T20:31:57Z
<p>Posixninja: </p>
<hr />
<div>{{DISPLAYTITLE:Chronic Dev Team}}<br />
[[Chronic Dev (team)|Chronic Dev]] is not the same as the [[iPhone Dev Team]]. [[Chronic Dev (team)|Chronic Dev]] is a team of hackers. Actually they cannot be distinctly assigned with such a "team", some just work losely together and might also be in another team. According to their [http://chronic-dev.org/blog/who-we-are/ Blog page] the following members are currently in the team:<br />
<br />
== Official Members ==<br />
*[[posixninja]]<br />
*[[User:ChronicDev|chronic]]<br />
*[[pod2g]]<br />
*[[OPK]]<br />
*[[semaphore]]<br />
*[[DHowett]]<br />
*[[AriX]]<br />
*[[westbaer]]<br />
*[[ius]]<br />
*[[User:Jaywalker|Jaywalker]]<br />
*[[User:NerveGas|NerveGas]]<br />
<br />
== Associates ==<br />
*[[bugout]]<br />
*[[bushing]]<br />
*[[c1de0x]]<br />
*[[chpwn]]<br />
*[[comex]]<br />
*[[copumpkin]]<br />
*[[CPICH]]<br />
*[[MuscleNerd]]<br />
*[[copumpkin]]<br />
*[[planetbeing]]<br />
*[[psp250]]<br />
*[[saurik]]<br />
<br />
==Projects==<br />
*[[irecovery]] / [[libirecovery]]<br />
*[[greenpois0n]]<br />
*[[genpass]]<br />
<br />
==Links==<br />
*[http://chronic-dev.org/blog/ Chronic Dev Blog]<br />
*[http://chronicdev.googlecode.com/ Chronic Dev google code]<br />
*[http://twitter.com/chronicdevteam Chronic Dev Team on Twitter]<br />
[[Category:Hackers]]</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=User_talk:Jacob&diff=7831
User talk:Jacob
2010-08-02T07:27:42Z
<p>Posixninja: </p>
<hr />
<div>a new exploit is probably something best brought to us in private, rather then posted on a public wiki --[[User:Posixninja|posixninja]] 06:11, 2 August 2010 (UTC)<br />
<br />
Well I did not plan on actually saying what it is.<br />
I tried to seek for one of you guys, but I got ignored. So now I am going to work on it on my own.<br />
Once I fail then I will let you know.<br />
<br />
most of us are usually busy, but I always find time to look at new possible exploits. If you need help you can usually find me on IRC. --[[User:Posixninja|posixninja]] 07:27, 2 August 2010 (UTC)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=User_talk:Jacob&diff=7822
User talk:Jacob
2010-08-02T06:11:06Z
<p>Posixninja: </p>
<hr />
<div>a new exploit is probably something best brought to us in private, rather then posted on a public wiki --[[User:Posixninja|posixninja]] 06:11, 2 August 2010 (UTC)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=User_talk:Jacob&diff=7821
User talk:Jacob
2010-08-02T06:10:54Z
<p>Posixninja: New page: a new exploit is probably something best brought to us in private, rather then posted on a public wiki</p>
<hr />
<div>a new exploit is probably something best brought to us in private, rather then posted on a public wiki</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=User:Comex&diff=7814
User:Comex
2010-08-02T02:37:32Z
<p>Posixninja: </p>
<hr />
<div>Comex is a Wii and iOS hacker that was born in April 1992 [https://twitter.com/comex/status/19621324086][https://twitter.com/comex/status/19621504697]. Comex released [[Spirit]] to [[jailbreak]] iOS 3.1.3 and iOS 3.2, and a new version of [[Jailbreakme]] (codenamed [[star]]) for iOS 3.2.1 through 4.0.1.<br />
<br />
[https://twitter.com/comex comex on Twitter]<br />
[[Category:Hackers]]</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Star&diff=7812
Star
2010-08-02T02:35:17Z
<p>Posixninja: </p>
<hr />
<div>Star is a userland [[jailbreak]] from [[User:Comex|comex]] that utilizes 3 unknown exploits (2 new exploits, and 1 from spirit) to jailbreak iOS 3.1.2 and later. Star warns that 3.1.2 and 3.1.3 are known to fail though, and that performing a fresh restore to 4.0 is recommended. It can be used via [[Jailbreakme]].</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=User:Posixninja&diff=7042
User:Posixninja
2010-07-15T18:47:56Z
<p>Posixninja: New page: {{DISPLAYTITLE:posixninja}} Joshua Hill (aka posixninja, p0sixninja) is a member of Chronic-Dev Team. [http://www.twitter.com/p0sixninja p0sixninja on Twitter] Category:Hackers</p>
<hr />
<div>{{DISPLAYTITLE:posixninja}}<br />
<br />
Joshua Hill (aka posixninja, p0sixninja) is a member of Chronic-Dev Team.<br />
<br />
[http://www.twitter.com/p0sixninja p0sixninja on Twitter]<br />
[[Category:Hackers]]</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Timeline&diff=7041
Timeline
2010-07-15T18:40:38Z
<p>Posixninja: </p>
<hr />
<div>==2010==<br />
===June===<br />
*June 24 -- [[N90ap|iPhone 4]] is launched.<br />
*June 22 -- [[iPhone Dev Team]] releases [[PwnageTool]] 4.0 and later 4.0.1 for all devices on 4.0 except iPod Touch 3G.<br />
*June 21 -- [[iPhone Dev Team]] releases [[Redsn0w]] 0.9.5 to jailbreak 4.0 on iPhone 3G and iPhone Touch 2G.<br />
*June 21 -- [[iPhone Dev Team]] releases [[Ultrasn0w]] 0.93, an unlock for baseband firmwares 4.26.08, 5.11.07, 5.12.01 and 5.13.04<br />
*June 21 -- Apple releases 4.0 firmware<br />
*June 19 -- [[User:Geohot|geohot]] holds a speech at the [[Nuit_du_hack_2010|Nuit du Hack]]<br />
<br />
===May===<br />
*May 3 -- Windows version of [[Spirit]] has been updated to not require Windows 98 compatibility mode to run and fixed a photo deletion issue.<br />
*May 2 -- [[comex]] releases [[Spirit]], an [[untethered jailbreak]] for all iDevices with firmware 3.1.2 through 3.2. Previously [[blackra1n]] was a tethered jailbreak on newer devices and people that updated to firmware 3.1.3 had no jailbreak at all.<br />
<br />
===Feb===<br />
*Feb 12 -- [http://twitter.com/sherif_hashim sherif_hashim] discovers [[AT+XAPP Vulnerability]] and passes it to [[MuscleNerd]] elite member of the [[iPhone Dev Team]]<br />
*Feb 2 -- Apple releases 3.1.3 firmware closing [[usb_control_msg(0x21, 2) Exploit|usb_control_msg(0x21, 2)]] vulnerability used by [[blackra1n]].<br />
<br />
==2009==<br />
===November===<br />
*November 3 -- [[Geohot]] releases [[blackra1n]] RC3, a software jailbreak for all devices. Includes a new unlock for the baseband 5.11.07 called [[blacksn0w]] and is also noticeably faster than previous versions.<br />
<br />
===October===<br />
*October 11 -- [[Geohot]] releases [[blackra1n]] RC1, a 30 second software jailbreak for all devices, including a tethered jailbreak for the [[iPod touch 3G]].<br />
<br />
===September===<br />
* September 24 -- [[ih8sn0w|ih8sn0w]] Discovers the [[AT+XEMN|AT+XEMN]] Vulnerability used in [[blacksn0w|blacksn0w]] independently.<br />
* September 9 -- The [[iPod touch 3G]] w/ [[S5L8922]] processor is released, as well as an "MC Model" [[n72ap|iPod touch 2G]]. Both are no longer vulnerable to [[24kPwn]].<br />
* Firmware 3.1/3.1.1 (7C144/7C145) Released to the Public. Firmware closes [[iBoot Environment Variable Overflow|iBoot Environment Variable Overflow]] and [[AT+XLOG Vulnerability|AT+XLOG]] + [[AT+FNS|AT+FNS]] Baseband Exploits.<br />
<br />
===July===<br />
* July 14 -- [[Geohot]] releases [[purplesn0w]], a software unlock for the [[iPhone 3GS]] using [[AT+XLOG Vulnerability|the same exploit as ultrasn0w]], but handled differently. Minutes later, an explanation and source code was posted.<br />
* July 7 -- [[The dev team]] updates [[redsn0w]] and [[ultrasn0w]] to version 0.8, now with [[iPhone 3GS]] support. Saurik also updates Winterboard to support the [[iPhone 3GS]].<br />
* July 3 -- [[Geohot]] releases [[purplera1n]], a software jailbreak for the [[iPhone 3GS]].<br />
<br />
===June===<br />
* June 28 -- [[Geohot]] posts pictures on his blog of the first fully jailbroken [[iPhone 3GS]].<br />
* June 25 -- It's discovered that [[iPhone 3GS]] is vulnerable to [[0x24000 Segment Overflow|24kpwn]] exploit.<br />
* June 24 -- [[The dev team]] release [[ultrasn0w]] unlock for [[iPhone 3G]] thanks to [[AT+XLOG Vulnerability|a new exploit]] discovered by [[User:Oranav|Oranav]].<br />
* June 23 -- [[Geohot]] announces he's found a new exploit in [[iBoot]] he calls purplera1n.<br />
* June 19 -- Release of [[iPhone2,1|iPhone 3GS]] to the public and the release of [[PwnageTool|Pwnage Tool 3.0]] and [[RedSn0w|Redsn0w]] for jailbreaking devices running firmware 3.0<br />
* June 17 -- Release of firmware 3.0 to the public.<br />
* June 8 -- Apple announces the [[iPhone2,1|iPhone 3GS]].<br />
<br />
===March===<br />
* March 10 -- The [[0x24000 Segment Overflow|untethered jailbreak]] for the [[iPod touch 2G]] is released thanks to the combined work of chronic, CPICH, [[posixninja]], pod2g, ius, [[planetbeing]], [[MuscleNerd]], and co after being leaked and sold by [[NitroKey]]. To prevent users wasting their money on a stolen exploit, the Hybrid DevTeam decided to release it immediately.<br />
<br />
===January===<br />
* January 31 -- The [[iPhone Dev Team]] released a [[redsn0w Lite]], a tethered jailbreak for the [[N72ap|iPod touch 2G]]. It combines the [[ARM7 Go]] vulnerability with the well-established pwnage flow for other Apple mobile devices. It was bundled in a way that will allow usage on the 2.2.1 firmware through uploading the [[ARM7 Go]] vulnerable 2.1.1 iBoot to the device while in DFU mode.<br />
<br />
* January 25 -- [[0wnboot]] is released to chronicdev google code page, thanks to AriX, chronic, CPICH, westbaer, ius, pod2g, the rest of the iPod devel crew on IRC, and to the #iphone-hax lab rats. Within days, the AriX and the chronic dev team got a ramdisk booting for a tethered jailbreak.<br />
<br />
* January 17 -- [[MuscleNerd]] of the [[iPhone Dev Team]] [http://twitter.com/MuscleNerd/status/1127346766 shows a video demo] of the first jailbroken iPod Touch 2G.<br />
<br />
* January 16 -- [[ARM7 Go]] hole disclosed where else but here on The iPhone Wiki, for developers to poke and prod at<br />
<br />
* January 15 -- The [[iPhone Dev Team]] [http://twitter.com/iphone_dev/status/1120595069 tweets the vfdecrypt key] for the [[iPod touch 2G]] 2.2 firmware, demonstrating for the first time that unsigned code can now be run on that device.<br />
<br />
* January 1 -- The [[iPhone Dev Team]] releases [[yellowsn0w]] 0.9 beta for baseband 02.28.00.<br />
<br />
==2008==<br />
<br />
===December===<br />
* December 27 -- [[25C3_presentation_Hacking_the_iPhone|25C3 presentation "Hacking the iPhone"]]<br />
* December 21 -- [[MuscleNerd]], of [[the dev team]] does a live demo of the 3G unlock, dubbed as [[yellowsn0w]]: http://qik.com/video/729275<br />
<br />
===August===<br />
* August 18 -- [[The dev team]] releases [http://wikee.iphwn.org/news:pwnage20announcement QuickPwn], a 2.x [[pwnage]]/ramdisk combination exploit that allows jailbreaking without needing to create custom IPSWs.<br />
<br />
===July===<br />
* July 22 -- [[TA_Mobile]] hardware dumps the 3G baseband (bootloader 5.8 & FW 1.45.00) by desoldering the [[NOR]].<br />
* July 19 -- [[The dev team]] releases [[PwnageTool]] 2.0, jailbreaking and unlocking the 2.0 software on the iPhone 2G and jailbreaking the 2.0 software on the iPhone 3G.<br />
* July 11 -- [[iPhone 3G]] is released.<br />
<br />
===June===<br />
* June 9 - [[iPhone 3G]] is announced at [[WWDC]] '08.<br />
<br />
===April===<br />
* April 3 -- Dev team releases [[PwnageTool]] 1.0, making use of the pmdx exploit (to patch RSA checks out of the [[kernel]], to write unsigned to [[NOR]])<br />
<br />
===March===<br />
* March 12 -- Dev team releases dual-boot jailbreak method, only to be silently fixed in 2.0.<br />
* March 4 -- [[User:N000b|George Zhu (n000b)]] releases [[ILiberty / ILiberty%2B]].<br />
<br />
===February===<br />
* February 28 -- [[Cydia]] is released as an open-source alternative to Installer.app, and prepares to take over the jailbreak application scene upon 2.0's release.<br />
* February 11 -- [[Zibri]] releases [[ZiPhone]], the first all-in-one unlock, activate, jailbreak solution.<br />
* February 8 -- [[User:Geohot|geohot]] releases software unlock for 4.6, Apple states 25% of phones were never activated with AT&T.<br />
<br />
===January===<br />
* January 28 -- Dev team releases soft upgrade jailbreak for 1.1.3.<br />
* January 18 -- Geohot and his friends [http://iphonejtag.blogspot.com/2008/01/112-otb-unlocked.html unlocked 1.1.2 OTB 4.6 by test point], the unbeatable version at that time.<br />
* January 18 -- Dev team posts YouTube video of a jailbroken 1.1.3, which was made possible by the dual boot jailbreak from bgm.<br />
<br />
== 2007 ==<br />
===November===<br />
* November 15 -- New baseband [[Bootloader 4.6|bootloader (4.6)]] comes out, new iPhones can't be unlocked.<br />
* November 2 -- [[Jailbreakme]] is released, bringing jailbreaking to the mainstream iPhone user.<br />
<br />
===October===<br />
* October 23 -- iPhone-Elite Team releases the [[Virginizer]].<br />
* October 14 -- AriX releases iJailBreak, the first automated iPod touch jailbreak for the Mac.<br />
* October 12 -- planetbeing releases touchFree, the first automated iPod touch jailbreak.<br />
* October 10 -- niacin, cmw, and dre release the [[LibTiff]] exploit to jailbreak the iPod touch, which is later adapted for use in [[Jailbreakme]].<br />
<br />
===September===<br />
* September 11 -- [[The dev team]] releases [[iUnlock]], first free software unlock.<br />
* September 10 -- [[IPSF]] releases first paid software unlock.<br />
* September 9 -- Apple announces the [[iPod touch]] at a media event.<br />
<br />
===August===<br />
* August 23 -- [[User:Geohot|geohot]] and team release [[hardware unlock]] method.<br />
* August 21 -- Installer.app is released by Nullriver, first GUI apps are distributed.<br />
<br />
===July===<br />
* July 23 -- First phones are used with other carriers by means of [[SIM hacks]].<br />
* July 20 -- nightwatch adapts a [[toolchain]] to the iPhone. The first apps are compiled.<br />
* July 9 -- [[The dev team]] releases a [[jailbreak]] method. The first use of this is ringtones.<br />
* July 3 -- DVD Jon first cracks [[activation]]. People can use the apps on the phone without a subscription.<br />
<br />
===June===<br />
* June 29 -- [[iPhone]] is released. World's most hyped consumer product.</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Talk:GIDecrypt&diff=6063
Talk:GIDecrypt
2010-04-13T02:22:11Z
<p>Posixninja: </p>
<hr />
<div>== It's old article, i know, but i wanna give it a try ;) ==<br />
<br />
When i try to compile it (on Mac with openssl, and Linux with openssl, libssl-dev, libssl) i'm getting these errors:<br />
<br />
<code>Undefined symbols:<br />
"_AES_set_decrypt_key", referenced from:<br />
_main in ccebEdc1.o<br />
"_AES_cbc_encrypt", referenced from:<br />
_main in ccebEdc1.o<br />
ld: symbol(s) not found</code><br />
<br />
What i'm doing wrong? --[[User:Cichacz|Cichacz]] 20:16, 12 April 2010 (UTC)<br />
<br />
it requires openssl to compile, you need to pass "-lcrypto" to gcc --[[User:Posixninja|posixninja]] 02:22, 13 April 2010 (UTC)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=S5L8922&diff=5972
S5L8922
2010-03-30T15:15:39Z
<p>Posixninja: </p>
<hr />
<div>This is the processor used in the [[N18ap|iPod Touch 3G]].<br />
<br />
== Exploits ==<br />
=== [[iBoot]] / [[Kernel]] ===<br />
* [[usb_control_msg(0x21, 2) Exploit]] - 3.1.2 and below.<br />
* Unreleased exploit (demonstrated by Geohot)<br />
<br />
=== [[S5L8922 (Bootrom)|Bootrom]] ===<br />
* None at this time.<br />
<br />
==Information==<br />
<br />
The load address is at 0x41000000 (same as the S5l8920).<br />
<br />
== Boot Chain ==<br />
[[S5L8922 (Bootrom)|Bootrom]]->[[LLB]]->[[iBoot]]->[[Kernel]]->[[System|System Software]]<br />
<br />
The entire boot chain (except the bootrom) resides on the NAND flash (instead of part of it on NOR flash as in earlier devices).<br />
<br />
== See also ==<br />
* [[S5L8922 (Bootrom)]]<br />
* [[S5L8922 (Hardware)]]<br />
<br />
==External Links==<br />
* [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0301h/DDI0301H_arm1176jzfs_r0p7_trm.pdf Technical Reference Manual: ARM1176JZF-S]</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Talk:CmdArg&diff=5905
Talk:CmdArg
2010-03-11T17:37:13Z
<p>Posixninja: </p>
<hr />
<div>== unk0 ==<br />
<br />
pretty sure it's the name of the command issued, as in, the equivalent of argv[0]. can anyone confirm?<br />
<br />
from the dumps i've seen it's a repeat of uinteger. I'm not sure what it's used for, perhaps it's used with the next one for a 64bit value?</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Ramdisk_(iBoot_command)&diff=5892
Ramdisk (iBoot command)
2010-03-11T08:47:06Z
<p>Posixninja: /* Decompilation */</p>
<hr />
<div>== Description == <br />
A command found in [[iBoot]], [[iBSS]], and [[iBEC]] that verifies and preps a ramdisk image which has been previously uploaded.<br />
<br />
== Decompilation ==<br />
iPhone 3GS 8920x from iBoot-636.66<br />
#define kLoadAddress 0x41000000<br />
#define kRamdiskMaxSize 0x2000000<br />
#define kRamdiskAddress 0x44000000<br />
#define kRamdiskImageType 0x7264736B<br />
<br />
unsigned int* gRamdiskSize;<br />
unsigned char** gRamdiskAddr;<br />
<br />
int cmd_ramdisk(int argc, [[CmdArg]]* argv) {<br />
if(argc > 3 || !strcmp("help", argv[1].string)) {<br />
printf("usage:\n\t%s [<len>] [<address>]\n", argv[0].string);<br />
return -1;<br />
}<br />
<br />
unsigned int filesize = (unsigned int) [[nvram_getint]]("filesize", 0);<br />
unsigned char* loadaddr = (unsigned char*) [[nvram_getint]]("loadaddr", kLoadAddress);<br />
if(filesize == 0) {<br />
printf("filesize variable invalid or not set, aborting\n");<br />
return -1;<br />
}<br />
<br />
if(range_check(loadaddr, filesize) == 0) {<br />
printf("Permission Denied\n");<br />
return -1;<br />
}<br />
<br />
[[MemzDescriptor]]* memz = [[memz_create]](loadaddr, filesize, 0);<br />
if(memz == NULL) {<br />
printf("Ramdisk image not valid\n");<br />
return -1;<br />
}<br />
<br />
if(memz->imageSize > kRamdiskMaxSize) {<br />
printf("Ramdisk too large\n");<br />
return -1;<br />
}<br />
<br />
*gRamdiskAddr = kRamdiskAddress;<br />
*gRamdiskSize = memz->imageSize;<br />
if(image_load(memz, kRamdiskImageType, gRamdiskAddr, gRamdiskSize) >= 0) {<br />
printf("creating ramdisk at 0x%x of size 0x%x, from image at 0x%x\n", gRamdiskAddr, gRamdiskSize, loadaddr);<br />
return 0;<br />
}<br />
<br />
*gRamdiskAddr = 0;<br />
*gRamdiskSize = 0;<br />
return -1;<br />
}</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Ramdisk_(iBoot_command)&diff=5890
Ramdisk (iBoot command)
2010-03-11T05:51:26Z
<p>Posixninja: /* Decompilation */</p>
<hr />
<div>== Description == <br />
A command found in [[iBoot]], [[iBSS]], and [[iBEC]] that verifies and preps a ramdisk image which has been previously uploaded.<br />
<br />
== Decompilation ==<br />
iPhone 3GS 8920x from iBoot-636.66<br />
#define kLoadAddress 0x41000000<br />
#define kRamdiskMaxSize 0x2000000<br />
#define kRamdiskAddress 0x44000000<br />
#define kRamdiskImageType 0x7264736B<br />
<br />
unsigned int* gRamdiskSize;<br />
unsigned char** gRamdiskAddr;<br />
<br />
int cmd_ramdisk(int argc, [[CmdArg]]* argv) {<br />
if(argc > 3 || !strcmp("help", argv[1].string)) {<br />
printf("usage:\n\t%s [<len>] [<address>]\n", argv[0].string);<br />
return -1;<br />
}<br />
<br />
unsigned int filesize = (unsigned int) nvram_getint("filesize", 0);<br />
unsigned char* loadaddr = (unsigned char*) nvram_getint("loadaddr", kLoadAddress);<br />
if(filesize == 0) {<br />
printf("filesize variable invalid or not set, aborting\n");<br />
return -1;<br />
}<br />
<br />
if(range_check(loadaddr, filesize) == 0) {<br />
printf("Permission Denied\n");<br />
return -1;<br />
}<br />
<br />
[[MemzDescriptor]]* memz = [[memz_create]](loadaddr, filesize, 0);<br />
if(memz == NULL) {<br />
printf("Ramdisk image not valid\n");<br />
return -1;<br />
}<br />
<br />
if(memz->imageSize > kRamdiskMaxSize) {<br />
printf("Ramdisk too large\n");<br />
return -1;<br />
}<br />
<br />
*gRamdiskAddr = kRamdiskAddress;<br />
*gRamdiskSize = memz->imageSize;<br />
if(image_load(memz, kRamdiskImageType, gRamdiskAddr, gRamdiskSize) >= 0) {<br />
printf("creating ramdisk at 0x%x of size 0x%x, from image at 0x%x\n", gRamdiskAddr, gRamdiskSize, loadaddr);<br />
return 0;<br />
}<br />
<br />
*gRamdiskAddr = 0;<br />
*gRamdiskSize = 0;<br />
return -1;<br />
}</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Memz_create&diff=5889
Memz create
2010-03-11T05:23:11Z
<p>Posixninja: New page: ==Decompilation== #define kMemzImageContainer 0x4D656D7A MemzDescriptor* memz_create(unsigned char* address, unsigned int size, unsigned int flags) { MemzDescriptor* memz ...</p>
<hr />
<div>==Decompilation==<br />
#define kMemzImageContainer 0x4D656D7A<br />
<br />
[[MemzDescriptor]]* memz_create(unsigned char* address, unsigned int size, unsigned int flags) {<br />
[[MemzDescriptor]]* memz = ([[MemzDescriptor]]*) malloc(sizeof([[MemzDescriptor]]));<br />
if(memz != NULL) {<br />
memz->fileSize = size;<br />
memz->imageSize = size;<br />
memz->type = kMemzImageContainer;<br />
memz->flags = flags;<br />
memz->address = address;<br />
}<br />
return memz;<br />
}</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=MemzDescriptor&diff=5888
MemzDescriptor
2010-03-11T05:18:31Z
<p>Posixninja: New page: ==Structure== typedef struct MemzDescriptor { unsigned int fileSize; unsigned int imageSize; unsigned int dataSize; unsigned int container; unsigned int flags; unsigned char* ...</p>
<hr />
<div>==Structure==<br />
typedef struct MemzDescriptor {<br />
unsigned int fileSize;<br />
unsigned int imageSize;<br />
unsigned int dataSize;<br />
unsigned int container;<br />
unsigned int flags;<br />
unsigned char* address;<br />
unsigned int unk18;<br />
};</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Ramdisk_(iBoot_command)&diff=5887
Ramdisk (iBoot command)
2010-03-11T05:17:44Z
<p>Posixninja: </p>
<hr />
<div>== Description == <br />
A command found in [[iBoot]], [[iBSS]], and [[iBEC]] that verifies and preps a ramdisk image which has been previously uploaded.<br />
<br />
== Decompilation ==<br />
iPhone 3GS 8920x from iBoot-636.66<br />
#define kLoadAddress 0x41000000<br />
#define kRamdiskMaxSize 0x2000000<br />
#define kRamdiskAddress 0x44000000<br />
#define kRamdiskImageType 0x7264736B<br />
<br />
unsigned int* gRamdiskSize;<br />
unsigned char** gRamdiskAddr;<br />
<br />
int cmd_ramdisk(int argc, [[CmdArg]]* argv) {<br />
if(argc > 3 || !strcmp("help", argv[1].string)) {<br />
printf("usage:\n\t%s [<len>] [<address>]\n", argv[0].string);<br />
return -1;<br />
}<br />
<br />
unsigned char* filesize = (unsigned int) nvram_getint("filesize", 0);<br />
unsigned int loadaddr = (unsigned char*) nvram_getint("loadaddr", kLoadAddress);<br />
if(filesize == 0) {<br />
printf("filesize variable invalid or not set, aborting\n");<br />
return -1;<br />
}<br />
<br />
if(range_check(loadaddr, filesize) == 0) {<br />
printf("Permission Denied\n");<br />
return -1;<br />
}<br />
<br />
[[MemzDescriptor]]* memz = [[memz_create]](loadaddr, filesize, 0);<br />
if(memz == NULL) {<br />
printf("Ramdisk image not valid\n");<br />
return -1;<br />
}<br />
<br />
if(memz->imageSize > kRamdiskMaxSize) {<br />
printf("Ramdisk too large\n");<br />
return -1;<br />
}<br />
<br />
*gRamdiskAddr = kRamdiskAddress;<br />
*gRamdiskSize = memz->imageSize;<br />
if(image_load(memz, kRamdiskImageType, gRamdiskAddr, gRamdiskSize) >= 0) {<br />
printf("creating ramdisk at 0x%x of size 0x%x, from image at 0x%x\n", gRamdiskAddr, gRamdiskSize, loadaddr);<br />
return 0;<br />
}<br />
<br />
*gRamdiskAddr = 0;<br />
*gRamdiskSize = 0;<br />
return -1;<br />
}</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Bootx_(iBoot_command)&diff=5886
Bootx (iBoot command)
2010-03-11T05:11:18Z
<p>Posixninja: </p>
<hr />
<div>== Description ==<br />
A command found in iBoot, iBSS, and iBEC that verifies and boots a kernelcache image which has been uploaded.<br />
<br />
==Decompliation==<br />
iPhone 3GS 8920x from iBoot-636.66<br />
#define kLoadAddress 0x41000000<br />
#define kKernelMaxSize 0xF00000<br />
<br />
char** gBootArgs;<br />
<br />
int cmd_bootx(int argc, [[CmdArg]]* argv) {<br />
void* address = NULL;<br />
if(argc > 1 && !strcmp("help", argv[1].string)) {<br />
printf("usage:\n\t%s [<address>]\n", argv[0].string);<br />
return -1;<br />
}<br />
<br />
if(range_check(kLoadAddress, kKernelMaxSize) < 0) {<br />
printf("Permission Denied\n");<br />
return -1;<br />
}<br />
<br />
printf("Attempting to validate kernelcache @ 0x%08x\n", kLoadAddress);<br />
int err = load_macho_image(kLoadAddress, kKernelMaxSize, &address)<br />
if(err >= 0) {<br />
printf("kernelcache prepped at address 0x%08x\n", address);<br />
jump_to(3, address, gBootArgs);<br />
<br />
} else {<br />
printf("error loading kernelcache\n");<br />
}<br />
<br />
return err;<br />
}</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Ramdisk_(iBoot_command)&diff=5884
Ramdisk (iBoot command)
2010-03-11T05:03:11Z
<p>Posixninja: </p>
<hr />
<div>== Description == <br />
A command found in [[iBoot]], [[iBSS]], and [[iBEC]] that verifies and preps a ramdisk image which has been previously uploaded.<br />
<br />
== Decompilation ==<br />
iPhone 3GS 8920x from iBoot-636.66<br />
#define kLoadAddress 0x41000000<br />
#define kRamdiskMaxSize 0x2000000<br />
#define kRamdiskAddress 0x44000000<br />
#define kRamdiskImageType 0x7264736B<br />
<br />
unsigned int* gRamdiskSize;<br />
unsigned char** gRamdiskAddr;<br />
<br />
int cmd_ramdisk(int argc, [[CmdArg]]* argv) {<br />
if(argc > 3 || !strcmp("help", argv[1].string)) {<br />
printf("usage:\n\t%s [<len>] [<address>]\n", argv[0].string);<br />
return -1;<br />
}<br />
<br />
unsigned char* filesize = (unsigned int) nvram_getint("filesize", 0);<br />
unsigned int loadaddr = (unsigned char*) nvram_getint("loadaddr", kLoadAddress);<br />
if(filesize == 0) {<br />
printf("filesize variable invalid or not set, aborting\n");<br />
return -1;<br />
}<br />
<br />
if(range_check(loadaddr, filesize) == 0) {<br />
printf("Permission Denied\n");<br />
return -1;<br />
}<br />
<br />
MemzDescriptor* memz = memz_create(loadaddr, filesize, 0);<br />
if(memz == NULL) {<br />
printf("Ramdisk image not valid\n");<br />
return -1;<br />
}<br />
<br />
if(memz->imageSize > kRamdiskMaxSize) {<br />
printf("Ramdisk too large\n");<br />
return -1;<br />
}<br />
<br />
*gRamdiskAddr = kRamdiskAddress;<br />
*gRamdiskSize = memz->imageSize;<br />
if(image_load(memz, kRamdiskImageType, gRamdiskAddr, gRamdiskSize) >= 0) {<br />
printf("creating ramdisk at 0x%x of size 0x%x, from image at 0x%x\n", gRamdiskAddr, gRamdiskSize, loadaddr);<br />
return 0;<br />
}<br />
<br />
*gRamdiskAddr = 0;<br />
*gRamdiskSize = 0;<br />
return -1;<br />
}</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Ramdisk_(iBoot_command)&diff=5883
Ramdisk (iBoot command)
2010-03-11T05:00:38Z
<p>Posixninja: please try to keep command entries more like this</p>
<hr />
<div>== Description == <br />
A command found in [[iBoot]], [[iBSS]], and [[iBEC]] that verifies and preps a ramdisk image which has been previously uploaded.<br />
<br />
== Decompilation ==<br />
iPhone 3GS 8920x from iBoot-636.66<br />
#define kLoadAddress 0x41000000<br />
#define kRamdiskMaxSize 0x2000000<br />
#define kRamdiskAddress 0x44000000<br />
#define kRamdiskImageType 0x7264736B<br />
<br />
unsigned int* gRamdiskSize;<br />
unsigned char** gRamdiskAddr;<br />
<br />
int cmd_ramdisk(int argc, CmdArg* argv) {<br />
if(argc > 3 || !strcmp("help", argv[1].string)) {<br />
printf("usage:\n\t%s [<len>] [<address>]\n", argv[0].string);<br />
return -1;<br />
}<br />
<br />
unsigned char* filesize = (unsigned int) nvram_getint("filesize", 0);<br />
unsigned int loadaddr = (unsigned char*) nvram_getint("loadaddr", kLoadAddress);<br />
if(filesize == 0) {<br />
printf("filesize variable invalid or not set, aborting\n");<br />
return -1;<br />
}<br />
<br />
if(range_check(loadaddr, filesize) == 0) {<br />
printf("Permission Denied\n");<br />
return -1;<br />
}<br />
<br />
MemzDescriptor* memz = memz_create(loadaddr, filesize, 0);<br />
if(memz == NULL) {<br />
printf("Ramdisk image not valid\n");<br />
return -1;<br />
}<br />
<br />
if(memz->imageSize > kRamdiskMaxSize) {<br />
printf("Ramdisk too large\n");<br />
return -1;<br />
}<br />
<br />
*gRamdiskAddr = kRamdiskAddress;<br />
*gRamdiskSize = memz->imageSize;<br />
if(image_load(memz, kRamdiskImageType, gRamdiskAddr, gRamdiskSize) >= 0) {<br />
printf("creating ramdisk at 0x%x of size 0x%x, from image at 0x%x\n", gRamdiskAddr, gRamdiskSize, loadaddr);<br />
return 0;<br />
}<br />
<br />
*gRamdiskAddr = 0;<br />
*gRamdiskSize = 0;<br />
return -1;<br />
}</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Talk:Ramdisk_(iBoot_command)&diff=5880
Talk:Ramdisk (iBoot command)
2010-03-09T18:34:36Z
<p>Posixninja: New page: ok, now this is just silly. --~~~~</p>
<hr />
<div>ok, now this is just silly. --[[User:Posixninja|posixninja]] 18:34, 9 March 2010 (UTC)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Talk:Bootx_(iBoot_command)&diff=5870
Talk:Bootx (iBoot command)
2010-03-07T12:46:51Z
<p>Posixninja: </p>
<hr />
<div>how useful is this page really?? it might be better if you showed data in pseudocode, or even a flowchart --[[User:Posixninja|posixninja]] 05:58, 4 March 2010 (UTC)<br />
<br />
I think this page is kinda useful... --[[User:Charybdis|Charybdis]] 17:34, 6 March 2010 (UTC)<br />
<br />
the symbols are nice, but most of the comments seem repetitive and pointless. I just posted my C reversing of the code, I think it's a lot easier to understand --[[User:Posixninja|posixninja]] 03:46, 7 March 2010 (UTC)<br />
<br />
Yeah, that's nice. Got any other bits of code you've reversed like that laying around? :) --[[User:Charybdis|Charybdis]] 06:29, 7 March 2010 (UTC)<br />
<br />
lol, I have more shit then I know what to do with. I'm open to any specific requests... although it takes some time to dig through my mass of unorganized files. --[[User:Posixninja|posixninja]] 12:46, 7 March 2010 (UTC)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Bootx_(iBoot_command)&diff=5869
Bootx (iBoot command)
2010-03-07T12:41:47Z
<p>Posixninja: </p>
<hr />
<div>== iPhone 3GS 8920x from iBoot-636.66 ==<br />
<br />
==Disassembly==<br />
<pre><br />
N88AP_iBoot:4FF007E8 n88ap__iBoot__bootx_function ; DATA XREF: N88AP_iBoot:n88ap__iBoot__bootx�o<br />
N88AP_iBoot:4FF007E8<br />
N88AP_iBoot:4FF007E8 kernelcache_prepped_memory_pos= -0x10<br />
N88AP_iBoot:4FF007E8 oldR4 = -0xC<br />
N88AP_iBoot:4FF007E8 oldR7 = -8<br />
N88AP_iBoot:4FF007E8 oldLR = -4<br />
N88AP_iBoot:4FF007E8<br />
N88AP_iBoot:4FF007E8 000 PUSH {R4,R7,LR} ; Push registers<br />
N88AP_iBoot:4FF007EA 00C ADD R7, SP, #4 ; Rd = Op1 + Op2<br />
N88AP_iBoot:4FF007EC 00C SUB SP, SP, #4 ; Rd = Op1 - Op2<br />
N88AP_iBoot:4FF007EE 010 CMP R0, #1 ; Set cond. codes on Op1 - Op2<br />
N88AP_iBoot:4FF007F0 010 MOV R4, R1 ; Rd = Op2<br />
N88AP_iBoot:4FF007F2 010 BLE loc_4FF00808 ; Branch<br />
N88AP_iBoot:4FF007F4 010 LDR R1, [R1,#0x24] ; argv[1]<br />
N88AP_iBoot:4FF007F6 010 LDR R0, =aHelp ; "help"<br />
N88AP_iBoot:4FF007F8 010 BL strcmp ; Branch with Link<br />
N88AP_iBoot:4FF007FC 010 CBNZ R0, loc_4FF00808 ; Compare and Branch on Non-Zero<br />
N88AP_iBoot:4FF007FE 010 LDR R1, [R4,#0x10] ; param_R1<br />
N88AP_iBoot:4FF00800 010 LDR R0, =aUsageSAddress ; "usage:\n\t%s [<address>]\n"<br />
N88AP_iBoot:4FF00802 010 BL N88AP__iBOOT__console_printf ; Branch with Link<br />
N88AP_iBoot:4FF00806 010 B loc_4FF0081C ; Branch<br />
N88AP_iBoot:4FF00808 ; ---------------------------------------------------------------------------<br />
N88AP_iBoot:4FF00808<br />
N88AP_iBoot:4FF00808 loc_4FF00808 ; CODE XREF: n88ap__iBoot__bootx_function+A�j<br />
N88AP_iBoot:4FF00808 ; n88ap__iBoot__bootx_function+14�j<br />
N88AP_iBoot:4FF00808 010 MOV.W R0, #n88ap_ramdisk ; addr<br />
N88AP_iBoot:4FF0080C 010 MOV.W R1, #0xF00000 ; size<br />
N88AP_iBoot:4FF00810 010 BL check_range ; Branch with Link<br />
N88AP_iBoot:4FF00814 010 CBNZ R0, loc_4FF00822 ; Compare and Branch on Non-Zero<br />
N88AP_iBoot:4FF00816 010 LDR R0, =aPermissionDenied ; "Permission Denied\n"<br />
N88AP_iBoot:4FF00818 010 BL N88AP__iBOOT__console_printf ; Branch with Link<br />
N88AP_iBoot:4FF0081C<br />
N88AP_iBoot:4FF0081C loc_4FF0081C ; CODE XREF: n88ap__iBoot__bootx_function+1E�j<br />
N88AP_iBoot:4FF0081C 010 MOV.W R4, #0xFFFFFFFF ; fail<br />
N88AP_iBoot:4FF00820 010 B loc_4FF0085C ; Branch<br />
N88AP_iBoot:4FF00822 ; ---------------------------------------------------------------------------<br />
N88AP_iBoot:4FF00822<br />
N88AP_iBoot:4FF00822 loc_4FF00822 ; CODE XREF: n88ap__iBoot__bootx_function+2C�j<br />
N88AP_iBoot:4FF00822 010 MOV.W R1, #n88ap_ramdisk ; param_R1<br />
N88AP_iBoot:4FF00826 010 LDR R0, =aAttemptingToValidateKernelcache0x08x ; "Attempting to validate kernelcache @ 0x"...<br />
N88AP_iBoot:4FF00828 010 BL N88AP__iBOOT__console_printf ; Branch with Link<br />
N88AP_iBoot:4FF0082C 010 MOV.W R0, #n88ap_ramdisk ; memoery_pos<br />
N88AP_iBoot:4FF00830 010 MOV.W R1, #0xF00000 ; memory_size<br />
N88AP_iBoot:4FF00834 010 MOV R2, SP ; Rd = Op2<br />
N88AP_iBoot:4FF00836 010 BL LoadImage_kernelcache_img3 ; Branch with Link<br />
N88AP_iBoot:4FF0083A 010 CMP R0, #0 ; Set cond. codes on Op1 - Op2<br />
N88AP_iBoot:4FF0083C 010 MOV R4, R0 ; Rd = Op2<br />
N88AP_iBoot:4FF0083E 010 BGE loc_4FF00848 ; Branch<br />
N88AP_iBoot:4FF00840 010 LDR R0, =aErrorLoadingKernelcache ; "error loading kernelcache\n"<br />
N88AP_iBoot:4FF00842 010 BL N88AP__iBOOT__console_printf ; Branch with Link<br />
N88AP_iBoot:4FF00846 010 B loc_4FF0085C ; Branch<br />
N88AP_iBoot:4FF00848 ; ---------------------------------------------------------------------------<br />
N88AP_iBoot:4FF00848<br />
N88AP_iBoot:4FF00848 loc_4FF00848 ; CODE XREF: n88ap__iBoot__bootx_function+56�j<br />
N88AP_iBoot:4FF00848 010 LDR R1, [SP,#0x10+kernelcache_prepped_memory_pos] ; param_R1<br />
N88AP_iBoot:4FF0084A 010 LDR R0, =aKernelcachePreppedAtAddress0x08x ; "kernelcache prepped at address 0x%08x\n"<br />
N88AP_iBoot:4FF0084C 010 BL N88AP__iBOOT__console_printf ; Branch with Link<br />
N88AP_iBoot:4FF00850 010 LDR R2, =dword_4FF2DC40 ; Load from Memory<br />
N88AP_iBoot:4FF00852 010 MOVS R0, #3 ; Rd = Op2<br />
N88AP_iBoot:4FF00854 010 LDR R1, [SP,#0x10+kernelcache_prepped_memory_pos] ; Load from Memory<br />
N88AP_iBoot:4FF00856 010 LDR R2, [R2] ; Load from Memory<br />
N88AP_iBoot:4FF00858 010 BL jump_to_addr ; Branch with Link<br />
N88AP_iBoot:4FF0085C<br />
N88AP_iBoot:4FF0085C loc_4FF0085C ; CODE XREF: n88ap__iBoot__bootx_function+38�j<br />
N88AP_iBoot:4FF0085C ; n88ap__iBoot__bootx_function+5E�j<br />
N88AP_iBoot:4FF0085C 010 MOV R0, R4 ; Rd = Op2<br />
N88AP_iBoot:4FF0085E 010 SUB.W SP, R7, #4 ; Rd = Op1 - Op2<br />
N88AP_iBoot:4FF00862 010 POP {R4,R7,PC} ; Pop registers<br />
N88AP_iBoot:4FF00862 ; End of function n88ap__iBoot__bootx_function<br />
N88AP_iBoot:4FF00862<br />
N88AP_iBoot:4FF00862 ; ---------------------------------------------------------------------------<br />
N88AP_iBoot:4FF00864 off_4FF00864 DCD aHelp ; DATA XREF: n88ap__iBoot__bootx_function+E�r<br />
N88AP_iBoot:4FF00864 ; "help"<br />
N88AP_iBoot:4FF00868 ; int off_4FF00868<br />
N88AP_iBoot:4FF00868 off_4FF00868 DCD aUsageSAddress ; DATA XREF: n88ap__iBoot__bootx_function+18�r<br />
N88AP_iBoot:4FF00868 ; "usage:\n\t%s [<address>]\n"<br />
N88AP_iBoot:4FF0086C ; int off_4FF0086C<br />
N88AP_iBoot:4FF0086C off_4FF0086C DCD aPermissionDenied ; DATA XREF: n88ap__iBoot__bootx_function+2E�r<br />
N88AP_iBoot:4FF0086C ; "Permission Denied\n"<br />
N88AP_iBoot:4FF00870 ; int off_4FF00870<br />
N88AP_iBoot:4FF00870 off_4FF00870 DCD aAttemptingToValidateKernelcache0x08x<br />
N88AP_iBoot:4FF00870 ; DATA XREF: n88ap__iBoot__bootx_function+3E�r<br />
N88AP_iBoot:4FF00870 ; "Attempting to validate kernelcache @ 0x"...<br />
N88AP_iBoot:4FF00874 ; int off_4FF00874<br />
N88AP_iBoot:4FF00874 off_4FF00874 DCD aErrorLoadingKernelcache<br />
N88AP_iBoot:4FF00874 ; DATA XREF: n88ap__iBoot__bootx_function+58�r<br />
N88AP_iBoot:4FF00874 ; "error loading kernelcache\n"<br />
N88AP_iBoot:4FF00878 ; int off_4FF00878<br />
N88AP_iBoot:4FF00878 off_4FF00878 DCD aKernelcachePreppedAtAddress0x08x<br />
N88AP_iBoot:4FF00878 ; DATA XREF: n88ap__iBoot__bootx_function+62�r<br />
N88AP_iBoot:4FF00878 ; "kernelcache prepped at address 0x%08x\n"<br />
N88AP_iBoot:4FF0087C off_4FF0087C DCD dword_4FF2DC40 ; DATA XREF: n88ap__iBoot__bootx_function+68�r<br />
</pre><br />
<br />
==Decompliation==<br />
<pre><br />
#define kLoadAddress 0x41000000<br />
#define kKernelMaxSize 0xF00000<br />
<br />
int cmd_bootx(int argc, CmdArg* argv) {<br />
void* address = NULL;<br />
if(argc > 1 && !strcmp("help", argv[1].string)) {<br />
printf("usage:\n\t%s [<address>]\n", argv[0].string);<br />
return -1;<br />
}<br />
<br />
if(range_check(kLoadAddress, kKernelMaxSize) < 0) {<br />
printf("Permission Denied\n");<br />
return -1;<br />
}<br />
<br />
printf("Attempting to validate kernelcache @ 0x%08x\n", kLoadAddress);<br />
int err = load_macho_image(kLoadAddress, kKernelMaxSize, &address)<br />
if(err >= 0) {<br />
printf("kernelcache prepped at address 0x%08x\n", address);<br />
jump_to(3, address, gBootArgs);<br />
<br />
} else {<br />
printf("error loading kernelcache\n");<br />
}<br />
<br />
return err;<br />
}<br />
</pre></div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Talk:Bootx_(iBoot_command)&diff=5867
Talk:Bootx (iBoot command)
2010-03-07T03:46:07Z
<p>Posixninja: </p>
<hr />
<div>how useful is this page really?? it might be better if you showed data in pseudocode, or even a flowchart --[[User:Posixninja|posixninja]] 05:58, 4 March 2010 (UTC)<br />
<br />
I think this page is kinda useful... --[[User:Charybdis|Charybdis]] 17:34, 6 March 2010 (UTC)<br />
<br />
the symbols are nice, but most of the comments seem repetitive and pointless. I just posted my C reversing of the code, I think it's a lot easier to understand --[[User:Posixninja|posixninja]] 03:46, 7 March 2010 (UTC)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Bootx_(iBoot_command)&diff=5866
Bootx (iBoot command)
2010-03-07T03:37:12Z
<p>Posixninja: added something a little more understandable (IMHO)</p>
<hr />
<div>== iPhone 3GS 8920x from iBoot-636.66 ==<br />
<br />
==Disassembly==<br />
<pre><br />
N88AP_iBoot:4FF007E8 n88ap__iBoot__bootx_function ; DATA XREF: N88AP_iBoot:n88ap__iBoot__bootx�o<br />
N88AP_iBoot:4FF007E8<br />
N88AP_iBoot:4FF007E8 kernelcache_prepped_memory_pos= -0x10<br />
N88AP_iBoot:4FF007E8 oldR4 = -0xC<br />
N88AP_iBoot:4FF007E8 oldR7 = -8<br />
N88AP_iBoot:4FF007E8 oldLR = -4<br />
N88AP_iBoot:4FF007E8<br />
N88AP_iBoot:4FF007E8 000 PUSH {R4,R7,LR} ; Push registers<br />
N88AP_iBoot:4FF007EA 00C ADD R7, SP, #4 ; Rd = Op1 + Op2<br />
N88AP_iBoot:4FF007EC 00C SUB SP, SP, #4 ; Rd = Op1 - Op2<br />
N88AP_iBoot:4FF007EE 010 CMP R0, #1 ; Set cond. codes on Op1 - Op2<br />
N88AP_iBoot:4FF007F0 010 MOV R4, R1 ; Rd = Op2<br />
N88AP_iBoot:4FF007F2 010 BLE loc_4FF00808 ; Branch<br />
N88AP_iBoot:4FF007F4 010 LDR R1, [R1,#0x24] ; argv[1]<br />
N88AP_iBoot:4FF007F6 010 LDR R0, =aHelp ; "help"<br />
N88AP_iBoot:4FF007F8 010 BL strcmp ; Branch with Link<br />
N88AP_iBoot:4FF007FC 010 CBNZ R0, loc_4FF00808 ; Compare and Branch on Non-Zero<br />
N88AP_iBoot:4FF007FE 010 LDR R1, [R4,#0x10] ; param_R1<br />
N88AP_iBoot:4FF00800 010 LDR R0, =aUsageSAddress ; "usage:\n\t%s [<address>]\n"<br />
N88AP_iBoot:4FF00802 010 BL N88AP__iBOOT__console_printf ; Branch with Link<br />
N88AP_iBoot:4FF00806 010 B loc_4FF0081C ; Branch<br />
N88AP_iBoot:4FF00808 ; ---------------------------------------------------------------------------<br />
N88AP_iBoot:4FF00808<br />
N88AP_iBoot:4FF00808 loc_4FF00808 ; CODE XREF: n88ap__iBoot__bootx_function+A�j<br />
N88AP_iBoot:4FF00808 ; n88ap__iBoot__bootx_function+14�j<br />
N88AP_iBoot:4FF00808 010 MOV.W R0, #n88ap_ramdisk ; addr<br />
N88AP_iBoot:4FF0080C 010 MOV.W R1, #0xF00000 ; size<br />
N88AP_iBoot:4FF00810 010 BL check_range ; Branch with Link<br />
N88AP_iBoot:4FF00814 010 CBNZ R0, loc_4FF00822 ; Compare and Branch on Non-Zero<br />
N88AP_iBoot:4FF00816 010 LDR R0, =aPermissionDenied ; "Permission Denied\n"<br />
N88AP_iBoot:4FF00818 010 BL N88AP__iBOOT__console_printf ; Branch with Link<br />
N88AP_iBoot:4FF0081C<br />
N88AP_iBoot:4FF0081C loc_4FF0081C ; CODE XREF: n88ap__iBoot__bootx_function+1E�j<br />
N88AP_iBoot:4FF0081C 010 MOV.W R4, #0xFFFFFFFF ; fail<br />
N88AP_iBoot:4FF00820 010 B loc_4FF0085C ; Branch<br />
N88AP_iBoot:4FF00822 ; ---------------------------------------------------------------------------<br />
N88AP_iBoot:4FF00822<br />
N88AP_iBoot:4FF00822 loc_4FF00822 ; CODE XREF: n88ap__iBoot__bootx_function+2C�j<br />
N88AP_iBoot:4FF00822 010 MOV.W R1, #n88ap_ramdisk ; param_R1<br />
N88AP_iBoot:4FF00826 010 LDR R0, =aAttemptingToValidateKernelcache0x08x ; "Attempting to validate kernelcache @ 0x"...<br />
N88AP_iBoot:4FF00828 010 BL N88AP__iBOOT__console_printf ; Branch with Link<br />
N88AP_iBoot:4FF0082C 010 MOV.W R0, #n88ap_ramdisk ; memoery_pos<br />
N88AP_iBoot:4FF00830 010 MOV.W R1, #0xF00000 ; memory_size<br />
N88AP_iBoot:4FF00834 010 MOV R2, SP ; Rd = Op2<br />
N88AP_iBoot:4FF00836 010 BL LoadImage_kernelcache_img3 ; Branch with Link<br />
N88AP_iBoot:4FF0083A 010 CMP R0, #0 ; Set cond. codes on Op1 - Op2<br />
N88AP_iBoot:4FF0083C 010 MOV R4, R0 ; Rd = Op2<br />
N88AP_iBoot:4FF0083E 010 BGE loc_4FF00848 ; Branch<br />
N88AP_iBoot:4FF00840 010 LDR R0, =aErrorLoadingKernelcache ; "error loading kernelcache\n"<br />
N88AP_iBoot:4FF00842 010 BL N88AP__iBOOT__console_printf ; Branch with Link<br />
N88AP_iBoot:4FF00846 010 B loc_4FF0085C ; Branch<br />
N88AP_iBoot:4FF00848 ; ---------------------------------------------------------------------------<br />
N88AP_iBoot:4FF00848<br />
N88AP_iBoot:4FF00848 loc_4FF00848 ; CODE XREF: n88ap__iBoot__bootx_function+56�j<br />
N88AP_iBoot:4FF00848 010 LDR R1, [SP,#0x10+kernelcache_prepped_memory_pos] ; param_R1<br />
N88AP_iBoot:4FF0084A 010 LDR R0, =aKernelcachePreppedAtAddress0x08x ; "kernelcache prepped at address 0x%08x\n"<br />
N88AP_iBoot:4FF0084C 010 BL N88AP__iBOOT__console_printf ; Branch with Link<br />
N88AP_iBoot:4FF00850 010 LDR R2, =dword_4FF2DC40 ; Load from Memory<br />
N88AP_iBoot:4FF00852 010 MOVS R0, #3 ; Rd = Op2<br />
N88AP_iBoot:4FF00854 010 LDR R1, [SP,#0x10+kernelcache_prepped_memory_pos] ; Load from Memory<br />
N88AP_iBoot:4FF00856 010 LDR R2, [R2] ; Load from Memory<br />
N88AP_iBoot:4FF00858 010 BL jump_to_addr ; Branch with Link<br />
N88AP_iBoot:4FF0085C<br />
N88AP_iBoot:4FF0085C loc_4FF0085C ; CODE XREF: n88ap__iBoot__bootx_function+38�j<br />
N88AP_iBoot:4FF0085C ; n88ap__iBoot__bootx_function+5E�j<br />
N88AP_iBoot:4FF0085C 010 MOV R0, R4 ; Rd = Op2<br />
N88AP_iBoot:4FF0085E 010 SUB.W SP, R7, #4 ; Rd = Op1 - Op2<br />
N88AP_iBoot:4FF00862 010 POP {R4,R7,PC} ; Pop registers<br />
N88AP_iBoot:4FF00862 ; End of function n88ap__iBoot__bootx_function<br />
N88AP_iBoot:4FF00862<br />
N88AP_iBoot:4FF00862 ; ---------------------------------------------------------------------------<br />
N88AP_iBoot:4FF00864 off_4FF00864 DCD aHelp ; DATA XREF: n88ap__iBoot__bootx_function+E�r<br />
N88AP_iBoot:4FF00864 ; "help"<br />
N88AP_iBoot:4FF00868 ; int off_4FF00868<br />
N88AP_iBoot:4FF00868 off_4FF00868 DCD aUsageSAddress ; DATA XREF: n88ap__iBoot__bootx_function+18�r<br />
N88AP_iBoot:4FF00868 ; "usage:\n\t%s [<address>]\n"<br />
N88AP_iBoot:4FF0086C ; int off_4FF0086C<br />
N88AP_iBoot:4FF0086C off_4FF0086C DCD aPermissionDenied ; DATA XREF: n88ap__iBoot__bootx_function+2E�r<br />
N88AP_iBoot:4FF0086C ; "Permission Denied\n"<br />
N88AP_iBoot:4FF00870 ; int off_4FF00870<br />
N88AP_iBoot:4FF00870 off_4FF00870 DCD aAttemptingToValidateKernelcache0x08x<br />
N88AP_iBoot:4FF00870 ; DATA XREF: n88ap__iBoot__bootx_function+3E�r<br />
N88AP_iBoot:4FF00870 ; "Attempting to validate kernelcache @ 0x"...<br />
N88AP_iBoot:4FF00874 ; int off_4FF00874<br />
N88AP_iBoot:4FF00874 off_4FF00874 DCD aErrorLoadingKernelcache<br />
N88AP_iBoot:4FF00874 ; DATA XREF: n88ap__iBoot__bootx_function+58�r<br />
N88AP_iBoot:4FF00874 ; "error loading kernelcache\n"<br />
N88AP_iBoot:4FF00878 ; int off_4FF00878<br />
N88AP_iBoot:4FF00878 off_4FF00878 DCD aKernelcachePreppedAtAddress0x08x<br />
N88AP_iBoot:4FF00878 ; DATA XREF: n88ap__iBoot__bootx_function+62�r<br />
N88AP_iBoot:4FF00878 ; "kernelcache prepped at address 0x%08x\n"<br />
N88AP_iBoot:4FF0087C off_4FF0087C DCD dword_4FF2DC40 ; DATA XREF: n88ap__iBoot__bootx_function+68�r<br />
</pre><br />
<br />
==Decompliation==<br />
<pre><br />
#define kLoadAddress 0x41000000<br />
#define kKernelMaxSize 0xF00000<br />
<br />
int cmd_bootx(int argv, CmdArg* argv) {<br />
void* address = NULL;<br />
if(argc > 1 && !strcmp("help", argv[1].string)) {<br />
printf("usage:\n\t%s [<address>]\n", argv[0].string);<br />
return -1;<br />
}<br />
<br />
if(range_check(kLoadAddress, kKernelMaxSize) < 0) {<br />
printf("Permission Denied\n");<br />
return -1;<br />
}<br />
<br />
printf("Attempting to validate kernelcache @ 0x%08x\n", kLoadAddress);<br />
int err = load_macho_image(kLoadAddress, kKernelMaxSize, &address)<br />
if(err >= 0) {<br />
printf("kernelcache prepped at address 0x%08x\n", address);<br />
jump_to(3, address, gBootArgs);<br />
<br />
} else {<br />
printf("error loading kernelcache\n");<br />
}<br />
<br />
return err;<br />
}<br />
</pre></div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=DFU_Mode&diff=5864
DFU Mode
2010-03-06T06:47:44Z
<p>Posixninja: removed fsboot method for getting out of DFU since fsboot no longer exists in newer firmware</p>
<hr />
<div>'''DFU''' or '''Device Firmware Upgrade''' mode allows the [[S5L8900]], [[S5L8720]] and [[S5L8920]] to be restored from any state. It resides in the [[VROM]] and the [[S5L8900]] variant is vulnerable to the [[Pwnage 2.0]] exploit.<br />
<br />
==Entering / Exitting DFU==<br />
Software cannot be used to reliably enter DFU. Software methods rely on sending a signed WTF file which either calls the "real" DFU mode in bootrom or emulates it. Only ones calling the bootrom DFU is useful for exploiting bootrom (unpatchable) exploits and none exist that work for firmware 2.0 and later. If you are attempting to exploit the DFU, it is advisable to always use the hardware method. If your NOR firmware is corrupted, of course you have no recourse but to use the hardware method.<br />
<br />
===How to Enter True Hardware DFU===<br />
# Turn off the device.<br />
# Hold Power and Home for 10 seconds<br />
# Release Power, and keep holding Home<br />
# Keep holding home for 4-8 seconds or until you are alerted by your computer that it has detected a device in DFU.<br />
<br />
If the Restore Logo is present on the screen, you are in ''[[Recovery Mode]]'', '''not''' ''DFU''.<br />
<br />
===Exiting DFU===<br />
While in DFU, hold the power button for 30-60 seconds. When I have tested it, it has varied, so I don't know an exact length of time to hold it. Note that sometimes if you do this, when the device reboots from DFU, it will go into recovery mode for reasons unknown.<br />
<br />
==Revisions==<br />
===[[S5L8900]] (0x1222)===<br />
This is the device ID in the [[N45ap|iPod Touch 1G]], the [[M68ap|iPhone]], and the [[N82ap|iPhone 3G]]. For more information about the protocol, see [[DFU 0x1222]].<br />
<br />
===[[S5L8720 Bootrom|S5L8720]], [[S5L8920]], and [[WTF|WTF mode post-2.0]] (0x1227)===<br />
This is the device ID in the [[N72ap|iPod Touch 2G]], the [[N88ap|iPhone 3GS]], and [[WTF|WTF mode]]. For more information on the protocol, see [[DFU 0x1227]].<br />
<br />
[[Category:VROM]]</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Main_Page&diff=5863
Main Page
2010-03-06T06:39:08Z
<p>Posixninja: removed stupid ikee virus from front page</p>
<hr />
<div><!-- Logo by iHassan --><br />
<center>[[Image:Iptwiki.jpg]]</center><br />
<!-- Added a split column information box- computid --><br />
{{:Main Page/Welcome}}<br />
<table border="1" width="100%" style="background-color:orange;"><tr><br />
<td style="background-color:orange; text-align:center; width:25%;"><b>[[Jailbreak iPhone2,1 / iPod3,1|Find bootrom exploit allowing unsigned code exec via USB (S5L8920+)]]</b></td><br />
<td style="background-color:orange; text-align:center; width:25%;"><b>[[Unlock 2.0|Break Chain of Trust (X-Gold 608)]]</b></td><br />
</tr><br />
</table><br /><br />
<br />
{{col-begin}}<br />
{{col-2}}<br />
{{HeadingA|Software}}<br />
* [[/|Filesystem]]<br />
* [[Firmware]]<br />
* [[Keys]]<br />
** [[AES Keys]]<br />
** [[Apple Certificate]]<br />
** [[Baseband RSA Keys|RSA Keys]]<br />
** [[Baseband TEA Keys|TEA Keys]]<br />
** [[NCK]]<br />
* [[Protocols]]<br />
** [[Normal Mode]]<br />
** [[Recovery Mode (Protocols)|Recovery Mode]]<br />
** [[Restore Mode]]<br />
** [[DFU (Protocol)|DFU]]<br />
** [[Baseband Bootrom Protocol]]<br />
** [[Interactive Mode|Baseband Bootloader Protocol]]<br />
* [[System Log|System Log (syslog)]]<br />
{{col-2}}<br />
{{HeadingB|Hardware}}<br />
====iPhone====<br />
* [[m68ap|iPhone (m68ap)]]<br />
* [[n82ap|iPhone 3G (n82ap)]]<br />
* [[N88ap|iPhone 3GS (n88ap)]]<br />
<br />
====iPod Touch====<br />
* [[n45ap|iPod touch (n45ap)]]<br />
* [[n72ap|iPod touch 2nd Generation (n72ap)]]<br />
* [[N18ap|iPod touch 3rd Generation (n18ap)]]<br />
<br />
====iPad====<br />
* [[K48ap|iPad (k48ap)]]<br />
<br />
====Processors====<br />
* [[S5L8900]] ([[iPhone]], [[iPod Touch]], [[iPhone 3G]])<br />
* [[S5L8720]] ([[iPod touch 2G]])<br />
* [[S5L8920]] ([[N88AP|iPhone 3GS]])<br />
* [[S5L8922]] ([[N18ap|iPod Touch 3G]])<br />
* [[A4]] ([[k48ap|iPad]])<br />
* [[Baseband Device]]<br />
<br />
====Other====<br />
* [[Bluetooth]]<br />
{{col-end}}<br />
<br />
{{col-begin}}<br />
{{col-2}}<br />
{{HeadingA|Development}}<br />
====Application Development====<br />
* [[Toolchain]] (Includes tutorials)<br />
* [[Toolchain 2.0]] (Includes tutorials)<br />
* [[Frameworks]]<br />
* [[MobileDevice Library]]<br />
* [[Apple Certification Process]]<br />
* [[Bypassing iPhone Code Signatures]]<br />
* [[Distribution Methods]]<br />
<br />
====Application Copy Protection====<br />
* [[Copy Protection Overview]]<br />
* [[Application Structure and Signatures]]<br />
* [[Mach-O Loading Process]]<br />
* [[Bugging Debuggers]]<br />
* [[Defeating Cracks]]<br />
{{col-2}}<br />
{{HeadingB|Help}}<br />
====Guides====<br />
* [[Tutorials]]<br />
* [[Useful Links]]<br />
<br />
====Definitions====<br />
* [[Glossary]]<br />
* [[Jailbreak]]<br />
* [[Activation]]<br />
* [[Unlock]]<br />
* [[Baseband Device|Baseband]]<br />
* [[Baseband Bootloader|Bootloader]]<br />
* [[DFU]]<br />
* [[iBoot]]<br />
* [[iBEC]]<br />
* [[iBSS]]<br />
* [[NORID]]<br />
* [[CHIPID]]<br />
{{col-end}}<br />
<br />
<br />
<table border="1" width="100%" style="background-color:orange;"><br />
<tr><br />
<td colspan="4" style="background-color:orange; text-align:center;"><br />
<center>[[Disclaimer]]</center><br />
</td><br />
</tr><br />
</table><br />
<br />
__NOTOC____NOEDITSECTION__</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Talk:Bootx_(iBoot_command)&diff=5862
Talk:Bootx (iBoot command)
2010-03-04T05:58:00Z
<p>Posixninja: New page: how useful is this page really?? it might be better if you showed data in pseudocode, or even a flowchart --~~~~</p>
<hr />
<div>how useful is this page really?? it might be better if you showed data in pseudocode, or even a flowchart --[[User:Posixninja|posixninja]] 05:58, 4 March 2010 (UTC)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=The_iPhone_Wiki:Spam&diff=5628
The iPhone Wiki:Spam
2009-11-09T04:08:05Z
<p>Posixninja: </p>
<hr />
<div>How do we combat this recent spamming of this wiki? I suggest a possible invite system or similar? --[[User:Srts|Srts]] 02:24, 9 November 2009 (UTC)<br />
<br />
I have already blocked account signup, they must have had this account for a while. --[[User:Geohot|geohot]] 02:29, 9 November 2009 (UTC)<br />
<br />
Well if they don't stop, we can't have account creation disabled forever, defeats the purpose of the wiki. People like him are sad. Great work to all the sysops et all. keeping disruption to a minimal :D --[[User:Srts|Srts]] 02:34, 9 November 2009 (UTC)<br />
<br />
Yea thanks a lot guys for putting up with this. We'll give a bit of time, and if they continue, we'll figure something out. This kid keep trying to reset my password for hosting and the wiki. Too bad he doesn't have a life. --[[User:Geohot|geohot]] 03:10, 9 November 2009 (UTC)<br />
<br />
An invite system might not be a bad idea actually [[User:ChronicDev|Will Strafach]] 03:16, 9 November 2009 (UTC)<br />
<br />
feel free to post their IP addresses, lol --[[User:Posixninja|posixninja]] 04:08, 9 November 2009 (UTC)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Help:Contents&diff=5561
Help:Contents
2009-11-07T07:38:43Z
<p>Posixninja: Undo revision 5529 by 1337urmompois0n (Talk)</p>
<hr />
<div>[http://en.wikipedia.org/wiki/Wikipedia:How_to_edit_a_page How to edit a page]<br />
<br />
[http://en.wikipedia.org/wiki/Help:Editing Help for formatting text]<br />
<br />
Please remember to read the [[Ground Rules]]</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=The_iPhone_Wiki:Current_events&diff=5560
The iPhone Wiki:Current events
2009-11-07T07:38:09Z
<p>Posixninja: Replacing page with '== Primary Goals ==
* Break Chain of Trust (X-Gold)
* Untether the new iPhone 3GS model w/ new bootrom.
== Secondary ==
* Get iPhoneLinux running on...'</p>
<hr />
<div>== Primary Goals ==<br />
* [[X-Gold 608 Unlock|Break Chain of Trust (X-Gold)]]<br />
* Untether the new iPhone 3GS model w/ new bootrom.<br />
<br />
== Secondary ==<br />
* Get [[iPhoneLinux]] running on [[iPod touch 2G]]<br />
* Get kernel extensions working on 2.x<br />
* Get kernel extensions working on 3.x</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=The_iPhone_Wiki:Community_portal&diff=5559
The iPhone Wiki:Community portal
2009-11-07T07:37:10Z
<p>Posixninja: Replacing page with 'This is the place to post tasks that need to be done on the wiki. Also this is the place for proposed changes. I heard about people wanting a favicon and arranging the main pag...'</p>
<hr />
<div>This is the place to post tasks that need to be done on the wiki. Also this is the place for proposed changes. I heard about people wanting a favicon and arranging the main page into categories.<br />
<br />
== Site Related Requests ==<br />
<br />
=== Favicon ===<br />
<br />
Better? - Very nice :-) Damn, [http://www.tdupree.com/2008/06/12/manually-refresh-faviconico-files-in-firefox-3/ firefox bug].<br />
<br />
==iPhone Related Requests==<br />
<i>See: [[Unsolved problems]]</i></div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=BurnIn&diff=5557
BurnIn
2009-11-07T07:35:00Z
<p>Posixninja: Undo revision 5525 by 1337urmompois0n (Talk)</p>
<hr />
<div>[[Image:Burnin2.jpg|thumb|left|"Drag To Unlock" screen. Text is "Drag To Unlock" and "Shut Down"|150px]]<br />
[[Image:Burnin1.jpg|thumb|After "Drag To Unlock" screen, when you "Drag To Unlock", you get this screen. In order, "Start Burnin", "Reset Test Enviroment", and "Quit"|150px]]<br />
[[Image:Burnin3.jpg|thumb|left|boot logo|150px]]<br />
'''BurnIn''' is codename for a tool used by Apple. Nothing is really known about it, but somebody on Hackint0sh got their iPhone back with [[BurnIn]] on it, suggesting that it is a diagnotstics or a repair tool.<br />
<br />
== What it does ==<br />
Leftover strings on firmware 2.1 have told me this; Apple restores a special firmware to the iPhone, but it is based on a regular firmware. At boot, /AppleInternal/Applications/SwitchBoard/BurnIn.app/BurnIn will run. It checks /AppleInternal/Diags/purpleskank/config.plist for configuration information, such as version (v3.0 in this case), where to store the logs (/Library/Logs/BurnIn/ in this case), what level to set the backlight to, and also, some kind of cleanup script is defined (/AppleInternal/Diags/Utilities/burnin_cleanup.sh). What it actually does is still not known though. Two log files are also left by it, by doing whatever is done. They are /Library/Logs/BurnIn/burning_log.xml and /Library/Logs/BurnIn/burnin_log.txt.<br />
<br />
On the old iPhone prototypes, BurnIn is launched by the /AppleInternal/Applications/SkankPhone.app/SkankPhone, a SpringBoard replacement. It starts the /AppleInternal/Diags/purpleskank/factoryharness, which loads the configuration from config.plist file in the same directory. Factoryharness loads the index.plist file from location specified in config.plist (default is /AppleInternal/Diags/purpleskank/tables/index.plist) and begins to execute the tests specified in index.plist ("Burnin process"). When tests are successful, logs from burnin process are saved to /AppleInternal/Diags/Logs/ (or to other directory that can be set in config.plist). In case of failure, a failures.plist file is created in Logs directory. If Burnin process has not been completed, file state.plist is parsed by factoryharness and it continues the burnin process. If burnin process has failed, Skankphone.app shows a FAILURE screen and displays contents of burnin_log.txt. To get rid of that screen, user must select the Reset Test Environment option in SkankPhone - it executes the /AppleInternal/Diags/Utilities/burnin_cleanup.sh.<br />
<br />
==BurnIn on iPod touch==<br />
The day of the launch, numerous iPod touches shipped with BurnIn on it. In order to get it off them, you just did a restore. A few of these were sold on eBay.<br />
<br />
<div style="clear:both;"></div><br />
<br />
<gallery caption="BurnIn on iPod touch" widths="100px" heights="100px" perrow="5"><br />
Image:0.jpg|boot logo<br />
Image:1.jpg|The main menu.<br />
Image:2.jpg|Wi-Fi antenna test.<br />
Image:3.jpg|The "Bluetooth" screen.<br />
Image:4.jpg|The "Battery" screen.<br />
Image:5.jpg|The "Accelerometer" menu.<br />
Image:6.jpg|The "Buttons" menu.<br />
Image:7.jpg|Speaker screen.<br />
Image:8.jpg|"Touch" screen.<br />
Image:9.jpg|The "Serial Number" screen.<br />
Image:10.jpg|Tests the ambient light sensor.<br />
Image:11.jpg|A test for any connected headphones.<br />
Image:12.jpg|The temperature inside the device.<br />
</gallery><br />
<br />
Video: http://www.youtube.com/watch?v=nVMY1aC1kk4</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=ARM7_Go&diff=5556
ARM7 Go
2009-11-07T07:34:35Z
<p>Posixninja: Undo revision 5524 by 1337urmompois0n (Talk)</p>
<hr />
<div>This vulnerability is exclusive to the [[iPod touch 2G]]. It is present in the device's 2.1.1 firmware, as well as the [[iBEC]] / [[iBSS]] if you choose to upload it via DFU. It allows the running of unsigned code on the ARM7 coprocessor.<br />
<br />
==Credit==<br />
[[User:ChronicDev|Chronic]] and [[iPhone Dev Team]] (independently)<br />
<br />
==Exploit==<br />
There is an ARM7 coprocessor in the iPod Touch 2G in addition to the main processor, the ARM11. Like the [[Audio DSP Module|ADM]] in the [[S5L8900]] devices, it has access to everything the ARM11 has access to, such as the AES engine, the PKE accelerator, and such. The actual vulnerability is that, in the iPod Touch 2G 2.1.1 firmware, they left behind two commands from what was presumably a debug [[iBoot]]: arm7_stop and arm7_go. They were promptly removed in 2.2, but in 2.1.1 it would read the environmental variable "loadaddr" and have the ARM7 coprocessor execute whatever code was at that address. There was no signature or range checks in place for the command.<br />
<br />
==Payload==<br />
The command gives the ARM7 the load address (default is 0x09000000) of an "image" you sent it, and it will jump to it. The limitation is, unlike the [[diags]] exploit you cannot just pass a patched [[iBoot]] or [[iBEC]]. You must write a payload for it to run, but one that patches [[iBEC]] or [[iBoot]] in memory would do fine.<br />
<br />
==Implementations==<br />
Two released payloads are [[RedSn0w]] and [[0wnboot]]<br />
<br />
==How to use==<br />
* Enter device in [[DFU]] mode.<br />
* Upload iBSS 2.1.1.<br />
* Unplug and then replug the device.<br />
* Upload payload you wish to execute.<br />
* Run arm7_go command to execute payload.<br />
* Run arm7_stop to stop ARM7, needed if you plan on sending anything else to 0x09000000<br />
<br />
[[Category:Exploits]]</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Filesystem&diff=5555
Filesystem
2009-11-07T07:34:10Z
<p>Posixninja: Undo revision 5523 by 1337urmompois0n (Talk)</p>
<hr />
<div>This is a ls -al from the shell of a JB 3.0 iPhone 3G.<br />
<nowiki><br />
drwxrwxr-t 15 root admin 748 Jun 25 19:21 ./<br />
drwxrwxr-t 15 root admin 748 Jun 25 19:21 ../<br />
drwx------ 2 _unknown _unknown 204 May 22 17:33 .fseventsd/<br />
lrwxr-xr-x 1 root admin 27 Jun 22 01:00 Applications -> /var/stash/Applications.pwn/<br />
drwxrwxr-x 2 root admin 68 May 14 17:17 Developer/<br />
drwxr-xr-t 14 root admin 714 Jun 22 07:29 Library/<br />
drwxr-xr-x 3 root wheel 102 Jun 18 07:38 System/<br />
lrwxr-xr-x 1 root admin 11 Jun 25 19:21 User -> /var/mobile/<br />
drwxr-xr-x 2 root wheel 2006 Jun 22 23:38 bin/<br />
drwxr-xr-x 2 root wheel 68 Oct 28 2006 boot/<br />
drwxrwxr-t 2 root admin 68 May 14 14:17 cores/<br />
dr-xr-xr-x 3 root wheel 1237 Jun 25 19:20 dev/<br />
lrwxrwxrwx 1 root wheel 12 Jun 22 01:00 etc -> private/etc//<br />
drwxr-xr-x 2 root wheel 68 Oct 28 2006 lib/<br />
drwxr-xr-x 2 root wheel 68 Oct 28 2006 mnt/<br />
drwxr-xr-x 4 root wheel 136 Jun 18 07:41 private/<br />
drwxr-xr-x 2 root wheel 1224 Jun 22 01:05 sbin/<br />
lrwxrwxrwx 1 root wheel 16 Jun 22 01:00 tmp -> private/var/tmp/<br />
drwxr-xr-x 6 root wheel 306 Jun 22 01:02 </nowiki>[[usr]]<nowiki><br />
lrwxrwxrwx 1 root wheel 12 Jun 22 01:00 var -> private/var/<br />
</nowiki></div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=/System/Library/Frameworks&diff=5554
/System/Library/Frameworks
2009-11-07T07:33:43Z
<p>Posixninja: Undo revision 5522 by 1337urmompois0n (Talk)</p>
<hr />
<div>[[Frameworks]] are folders each containing a dynamic library and resources for that, library such as images and localization strings. All frameworks have the file extension <tt>.framework</tt>. <br />
<br />
On the iPhoneOS there are 2 kinds of frameworks: '''public frameworks''' and '''private frameworks'''. Public frameworks are those ones endorsed by Apple and are allowed to be used in AppStore apps. Private frameworks are intended to be used only by original apps, and are more unstable against firmware changes, but many of the interesting features are in the private frameworks.<br />
<br />
== Public Frameworks ==<br />
<br />
All public frameworks can be found inside <tt>/System/Library/Frameworks/</tt>.<br />
<br />
* [http://developer.apple.com/iphone/library/documentation/Miscellaneous/Conceptual/iPhoneOSTechOverview/iPhoneOSFrameworks/iPhoneOSFrameworks.html List of iPhoneOS Public Frameworks from Apple].<br />
* [http://developer.apple.com/iphone/library/documentation/MusicAudio/Conceptual/CoreAudioOverview/CoreAudioFrameworks/CoreAudioFrameworks.html List of frameworks related to CoreAudio].<br />
<br />
== Private Frameworks ==<br />
<br />
All private frameworks can be found inside <tt>/System/Library/PrivateFrameworks/</tt>. The descriptions may be incorrect, since most frameworks are not documented after all.<br />
<br />
{| class="sortable" style="table-layout: fixed; border-collapse: collapse;" border="1"<br />
|-<br />
! Framework<br />
| 2.x<br />
| 3.x<br />
! Prefix<br />
! Language<br />
! Description<br />
|-<br />
| AOSNotification<br />
| {{yes}}<br />
| {{yes}}<br />
| AOS<br />
| C<br />
| MobileMe Sync.<br />
|-<br />
| AXRuntime<br />
| {{no}}<br />
| {{yes}}<br />
| AX<br />
| C<br />
| Supports accessibility (VoiceOver, etc.)<br />
|-<br />
| Accelerate<br />
| {{yes}}<br />
| {{yes}}<br />
| --<br />
| --<br />
| High-performance vector-accelerated libraries [http://developer.apple.com/performance/accelerateframework.html]. Pulls in vecLib, which contains libLAPACK, libBLAS and libvDSP.<br />
|-<br />
| AccessorySupport<br />
| {{no}}<br />
| {{yes}}<br />
| AS<br />
| C<br />
| Probably related to the new accessory API<br />
|-<br />
| AccountSettings<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| ObjC<br />
| (Mail) accounts managing.<br />
|-<br />
| AccountSettingsUI<br />
| {{no}}<br />
| {{yes}}<br />
| -<br />
| ObjC<br />
| UI for managing accounts.<br />
|-<br />
| ActorKit<br />
| {{no}}<br />
| {{yes}}<br />
| AK<br />
| ObjC<br />
| [http://en.wikipedia.org/wiki/Actor_model Actor model]<br />
|-<br />
| AdminLite<br />
| {{no}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Unknown. Provides only 1 function: <tt>AdminLiteNVRAMSet</tt>.<br />
|-<br />
| AppSupport<br />
| {{yes}}<br />
| {{yes}}<br />
| CP<br />
| C, ObjC<br />
| Distributed messaging, Phone number formatting, Geographical info, SQLite, etc.<br />
|-<br />
| Apple80211<br />
| {{yes}}<br />
| {{no}}<br />
| -<br />
| C<br />
| WiFi. On 3.0 the same functionality is provided by the MobileWiFi framework.<br />
|-<br />
| AppleJPEG<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Create CGImage from JPEG.<br />
|-<br />
| ApplePushService<br />
| {{no}}<br />
| {{yes}}<br />
| APS<br />
| ObjC<br />
| Apple push service. Manages connection to Apple's servers for push notifications.<br />
|-<br />
| AppleVXD375Framework<br />
| {{no}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| MPEG-4 hardware related (???)<br />
|-<br />
| ArtworkCache<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Process .artwork files<br />
|-<br />
| BluetoothManager<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| ObjC<br />
| Higher-level bluetooth manager using MobileBluetooth.<br />
|-<br />
| Bom<br />
| {{yes}}<br />
| {{yes}}<br />
| BOM<br />
| C<br />
| Filesystem and PKZip related (???)<br />
|-<br />
| Calculate<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Compute results of mathematical equations (as a C string). See [http://code.google.com/p/undocumented-goodness/source/browse/trunk/UndocumentedGoodness/main.m] for usage.<br />
|-<br />
| Calendar<br />
| {{yes}}<br />
| {{yes}}<br />
| Cal<br />
| C, ObjC<br />
| Manages the calendar (and events).<br />
|-<br />
| CalendarUI<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| ObjC<br />
| UI toolkits for the calendar.<br />
|-<br />
| Camera<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Take and preview photos from camera.<br />
|-<br />
| Celestial<br />
| {{yes}}<br />
| {{yes}}<br />
| AV, Fig<br />
| C, ObjC<br />
| (AV) Audio & video control; (Fig) Recoding, photo, video capturing and post-processing.<br />
|-<br />
| ChatKit<br />
| {{no}}<br />
| {{yes}}<br />
| CK<br />
| ObjC<br />
| UI toolkit for SMS messages.<br />
|-<br />
| ContentIndex<br />
| {{no}}<br />
| {{yes}}<br />
| CX<br />
| C<br />
| Document processing (???)<br />
|-<br />
| CoreMedia<br />
| {{yes}}<br />
| {{yes}}<br />
| CM, Fig<br />
| C<br />
| ?<br />
|-<br />
| CoreSurface<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Direct read/write of screen buffer. <br />
|-<br />
| CoreTelephony<br />
| {{yes}}<br />
| {{yes}}<br />
| CT, VM, Mms<br />
| C, C++ (for Mms)<br />
| Telephone services, Voice mailbox, MMS.<br />
|-<br />
| CoreText<br />
| {{no}}<br />
| {{yes}}<br />
| CT<br />
| C<br />
| Advanced font management.<br />
|-<br />
| CoreVideo<br />
| {{yes}}<br />
| {{yes}}<br />
| CV<br />
| C<br />
| Frame-by-frame video processing [http://developer.apple.com/documentation/GraphicsImaging/Conceptual/CoreVideo/CVProg_Intro/CVProg_Intro.html]<br />
|-<br />
| CrashReporterSupport<br />
| {{yes}}<br />
| {{yes}}<br />
| CR<br />
| C<br />
| Crash reporter support.<br />
|-<br />
| DAVKit<br />
| {{no}}<br />
| {{yes}}<br />
| AY, DAV, DK<br />
| ObjC<br />
| WebDAV support.<br />
|-<br />
| DataAccess<br />
| {{yes}}<br />
| {{yes}}<br />
| AS, CalDAV, DA<br />
| ObjC<br />
| Push mail/calendar support.<br />
|-<br />
| DataAccessExpress<br />
| {{yes}}<br />
| {{yes}}<br />
| DA<br />
| ObjC<br />
| Query/search push mails (???).<br />
|-<br />
| DataDetectorsCore<br />
| {{no}}<br />
| {{yes}}<br />
| DD<br />
| C<br />
| Match form fields to auto-fill fields (e.g. name, zip-code, etc.) or linkable texts (e.g. URL, phone number, etc.)<br />
|-<br />
| DataDetectorsUI<br />
| {{no}}<br />
| {{yes}}<br />
| DD<br />
| ObjC<br />
| ?<br />
|-<br />
| DataMigration<br />
| {{yes}}<br />
| {{yes}}<br />
| DM<br />
| C<br />
| Migrate data on restoring to updated firmware.<br />
|-<br />
| DeviceToDeviceManager<br />
| {{no}}<br />
| {{yes}}<br />
| D2D<br />
| C<br />
| Device-to-device manager.<br />
|-<br />
| EAP8021X<br />
| {{yes}}<br />
| {{yes}}<br />
| EAP<br />
| C<br />
| Extensible Authentication Protocol for wireless network [http://en.wikipedia.org/wiki/IEEE_802.1X]<br />
|-<br />
| GMM<br />
| {{yes}}<br />
| {{yes}}<br />
| GMM<br />
| ObjC, C++<br />
| Google Mobile Maps.<br />
|-<br />
| GraphicsServices<br />
| {{yes}}<br />
| {{yes}}<br />
| GS<br />
| C<br />
| Event handling, capability check, colors and fonts, etc.<br />
|-<br />
| H2ISPServices<br />
| {{no}}<br />
| {{yes}}<br />
| -<br />
| C++<br />
| Camera related.<br />
|-<br />
| IAP<br />
| {{yes}}<br />
| {{yes}}<br />
| IAP<br />
| C<br />
| Manages accessory connections.<br />
|-<br />
| IOMobileFramebuffer<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Framebuffer access.<br />
|-<br />
| IOSurface<br />
| {{no}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Lower level interface of CoreSurface.<br />
|-<br />
| ITSync<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| ObjC<br />
| iTunes Sync.<br />
|-<br />
| ImageIO<br />
| {{yes}}<br />
| {{yes}}<br />
| CG<br />
| C<br />
| Read/write images for common image formats. [http://developer.apple.com/graphicsimaging/workingwithimageio.html]<br />
|-<br />
| JavaScriptCore<br />
| {{yes}}<br />
| {{yes}}<br />
| JS, WTF<br />
| C, C++<br />
| WebKit's Javascript interpreter. Source code available in [http://opensource.apple.com/source/JavaScriptCore/JavaScriptCore-521/].<br />
|-<br />
| LDAP<br />
| {{no}}<br />
| {{yes}}<br />
| ber, ldap<br />
| C<br />
| Lightweight Directory Access Protocol (LDAP).<br />
|-<br />
| MBX2D<br />
| {{yes}}<br />
| {{yes}}<br />
| mbx<br />
| C<br />
| 2D (and a little 3D) image operations (blending, affine transform, etc.) on the GPU.<br />
|-<br />
| MBXConnect<br />
| {{yes}}<br />
| {{no}}<br />
| mbx<br />
| C<br />
| Send commands to GPU. This framework is merged into MBX2D in 3.0.<br />
|-<br />
| MIME<br />
| {{no}}<br />
| {{yes}}<br />
| -<br />
| ObjC<br />
| MIME encoder/decoder. This was split from the Message framwork from 2.x.<br />
|-<br />
| ManagedConfiguration<br />
| {{yes}}<br />
| {{yes}}<br />
| MC<br />
| ObjC<br />
| Manager for VPN and certificates. (???)<br />
|-<br />
| MapKit<br />
| {{yes}}<br />
| {{no}}<br />
| MK<br />
| ObjC<br />
| Objective-C Wrapper and UI toolkit for maps. It becomes a [http://developer.apple.com/iPhone/library/navigation/Frameworks/CocoaTouch/MapKit/index.html public framework] in 3.0.<br />
|-<br />
| MediaToolbox<br />
| {{yes}}<br />
| {{yes}}<br />
| Fig<br />
| C<br />
| Manages media file formats.<br />
|-<br />
| Message<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| ObjC<br />
| Manages emails.<br />
|-<br />
| MessageUI <br />
| {{yes}}<br />
| {{no}}<br />
| -<br />
| ObjC<br />
| UI toolkit for composing emails. It becomes a public framework in 3.0.<br />
|-<br />
| MessageUtilities<br />
| {{yes}}<br />
| {{no}}<br />
| -<br />
| ObjC<br />
| String utilities for email parsing. It is merged with the new framework "MIME" in 3.0.<br />
|-<br />
| MobileBluetooth<br />
| {{yes}}<br />
| {{yes}}<br />
| BT<br />
| C<br />
| Manages bluetooth connections.<br />
|-<br />
| MobileDeviceLink<br />
| {{yes}}<br />
| {{yes}}<br />
| DL<br />
| C<br />
| Send and receive file on device, with encryption support.<br />
|-<br />
| MobileInstallation<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Install apps.<br />
|-<br />
| MobileMusicPlayer<br />
| {{yes}}<br />
| {{yes}}<br />
| PC, _MPlayer<br />
| C<br />
| Read and set properties about the global music player (current song, is Genius enabled, etc.).<br />
|-<br />
| MobileQuickLook<br />
| {{no}}<br />
| {{yes}}<br />
| QL<br />
| C<br />
| View attachments.<br />
|-<br />
| MobileSync<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Sync calendars, bookmarks, mail accounts, notes and contacts with computer.<br />
|-<br />
| MobileWiFi<br />
| {{no}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Obtain WiFi info, e.g. WEP/WPA, SSID, power output etc. <br />
|-<br />
| MobileWirelessSync<br />
| style="background:#ffff90; color:black;" class="table-yes" | ≥2.1<br />
| {{yes}}<br />
| MWS<br />
| C<br />
| Sync calendars, bookmarks, notes and contacts with Mobile Me.<br />
|-<br />
| MultitouchSupport<br />
| {{yes}}<br />
| {{yes}}<br />
| MT<br />
| C<br />
| Multitouch support, e.g. pressure, proximity and path detection.<br />
|-<br />
| MusicLibrary<br />
| {{yes}}<br />
| {{yes}}<br />
| ML<br />
| ObjC<br />
| Access music library and photo album.<br />
|-<br />
| MusicLibraryDDB<br />
| {{no}}<br />
| {{yes}}<br />
| -<br />
| ObjC, C++<br />
| Looks similar to MusicLibrary, yet they are independent frameworks...<br />
|-<br />
| Notes<br />
| {{no}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Read/write notes. It is split off from the Notes.app in 3.0 to support Spotlight.<br />
|-<br />
| OfficeImport<br />
| {{yes}}<br />
| {{yes}}<br />
| OI<br />
| C<br />
| Convert Microsoft Office documents into HTML.<br />
|-<br />
| PersistentConnection<br />
| {{yes}}<br />
| {{yes}}<br />
| PC<br />
| C<br />
| Maintain a persistent connection with another server. It also deals with power managements for this purpose.<br />
|-<br />
| PhotoLibrary<br />
| {{yes}}<br />
| {{yes}}<br />
| PL<br />
| ObjC<br />
| UI toolkit for the photo album, video list, the camera view and media publishing.<br />
|-<br />
| Preferences<br />
| {{yes}}<br />
| {{yes}}<br />
| PS<br />
| ObjC<br />
| Supports custom preference bundles.<br />
|-<br />
| ProtocolBuffer<br />
| {{no}}<br />
| {{yes}}<br />
| PB<br />
| ObjC<br />
| Provides support for Protocol Buffers. [http://code.google.com/intl/iw/apis/protocolbuffers/]<br />
|-<br />
| SMSCTServer<br />
| {{no}}<br />
| {{yes}}<br />
| SMS<br />
| ObjC<br />
| Server to receive and interpret SMS.<br />
|-<br />
| ScreenReaderCore<br />
| {{no}}<br />
| {{yes}}<br />
| SCRC<br />
| ObjC<br />
| Screen reader (read text at finger position).<br />
|-<br />
| Search<br />
| {{no}}<br />
| {{yes}}<br />
| SP<br />
| ObjC<br />
| Spotlight support.<br />
|-<br />
| SportsTrainer<br />
| {{no}}<br />
| {{yes}}<br />
| ST<br />
| ObjC<br />
| UI toolkit for Nike+iPod workouts.<br />
|-<br />
| SpringBoardServices<br />
| {{yes}}<br />
| {{yes}}<br />
| SB, SBS<br />
| C<br />
| Provides Mach port and convenient functions for apps to communicate with the SpringBoard. Content includes get/set app properties, get/set watchdog assertions, get accelerometer events and UI orientation, get/set status bar appearance, and send/receive push notifications.<br />
|-<br />
| SpringBoardUI<br />
| style="background:#ffff90; color:black;" class="table-yes" | ≥2.1<br />
| {{yes}}<br />
| -<br />
| ObjC<br />
| Supports SBAwayView plugins (lock screen widgets).<br />
|-<br />
| Symbolication<br />
| {{yes}}<br />
| {{yes}}<br />
| VMU<br />
| ObjC<br />
| Analyze Mach-O executables, task sampling, memory view.<br />
|-<br />
| TelephonyUI<br />
| {{yes}}<br />
| {{yes}}<br />
| TP<br />
| ObjC<br />
| UI toolkit for telephone system.<br />
|-<br />
| TextInput<br />
| {{no}}<br />
| {{yes}}<br />
| UI, KB<br />
| ObjC, C++<br />
| Keyboard input managers. This framework is split from UIKit from 2.x.<br />
|-<br />
| UIAccessibility<br />
| {{no}}<br />
| {{yes}}<br />
| -<br />
| ObjC<br />
| Accessibility server. <br />
|-<br />
| URLify<br />
| {{yes}}<br />
| {{no}}<br />
| CP<br />
| ObjC<br />
| Match URL in a string. Replaced by data detectors in 3.0.<br />
|-<br />
| VideoToolbox<br />
| {{yes}}<br />
| {{yes}}<br />
| VT<br />
| C<br />
| Video compression/decompression, encoding/decoding for H.264 and MP4 Video.<br />
|-<br />
| VisualVoicemail<br />
| {{yes}}<br />
| {{yes}}<br />
| VV<br />
| ObjC<br />
| Supports visual voicemail.<br />
|-<br />
| VoiceMemos<br />
| {{no}}<br />
| {{yes}}<br />
| RC<br />
| ObjC<br />
| UI toolkit for recording voice memos.<br />
|-<br />
| VoiceServices<br />
| {{no}}<br />
| {{yes}}<br />
| VS<br />
| ObjC<br />
| Voice recognition.<br />
|-<br />
| WebCore<br />
| {{yes}}<br />
| {{yes}}<br />
| DOM, WAK, WK<br />
| ObjC, C++<br />
| WebKit's Rendering engine. Source code available in [http://opensource.apple.com/source/WebCore/WebCore-514/].<br />
|-<br />
| WebKit<br />
| {{yes}}<br />
| {{yes}}<br />
| Web<br />
| ObjC<br />
| WebKit. UI toolkit to show a web page.<br />
|-<br />
| WebUI<br />
| {{no}}<br />
| {{yes}}<br />
| -<br />
| ObjC<br />
| Addition UI for Web views, e.g. Authentication view, certificate view, etc.<br />
|-<br />
| XMPP<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Extensible Messaging and Presence Protocol (XMPP / Jabber).<br />
|-<br />
| YouTube<br />
| {{yes}}<br />
| {{yes}}<br />
| YT<br />
| ObjC<br />
| YouTube support. <br />
|-<br />
| iCalendar<br />
| {{no}}<br />
| {{yes}}<br />
| ICS<br />
| ObjC, C++<br />
| iCalendar support.<br />
|-<br />
| iTunesStore<br />
| {{yes}}<br />
| {{yes}}<br />
| IS<br />
| C, ObjC<br />
| iTunes music store support.<br />
|-<br />
| iTunesStoreUI<br />
| {{yes}}<br />
| {{yes}}<br />
| SU<br />
| ObjC<br />
| UI toolkit for iTunes music store.<br />
|-<br />
| iWorkImport<br />
| {{yes}}<br />
| {{yes}}<br />
| -<br />
| C<br />
| Convert iWork documents to HTML.<br />
|}</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=S5L8720_(Hardware_-_SHA1)&diff=5553
S5L8720 (Hardware - SHA1)
2009-11-07T07:33:06Z
<p>Posixninja: Undo revision 5521 by 1337urmompois0n (Talk)</p>
<hr />
<div>==S5L8720 SHA-1 Hardware==<br />
Base Address: 0x38000000<br />
<br />
===Programming Guide===<br />
As there is no real documentation of the hardware (The Samsung S3C6400X seams to use a very similar SHA-1 generator, but not the same), this is based on what [[iBoot]] does and on a lot of trial-and-error.<br />
====How it works====<br />
Basically it is like a hardware version of a SHA-1 algorithm. The hardware processes data in 512Bit (64 Bytes) chunks (Just like a software algorithm). <br><br />
It does NO pre-processing (appending a '1' Bit to the data, pad the data so that the length mod 512 is 448, and append the bit-length of the data as a 64-bit big-endian integer). <br><br />
This has to be done in software.<br />
<br />
====Calculating the SHA-1 of a message====<br />
# Prepare the message as usual. See [http://en.wikipedia.org/wiki/SHA_hash_functions Wikipedia on SHA]<br />
# Switch on the clock for the SHA-1 generator<br />
# Reset the generator. To do this set bit 0 of reset register and clear it afterwards (iBoot waits until the hash is ready before resetting it)<br />
# Clear (Write 0) to the Configuration Register (Not sure if this is needed as it already reads 0 after resetting, but iBoot does it)<br />
# Clear register 0x80 and 0x10 (Also not sure why, as they also read 0)<br />
# Write 64 bytes of the message to the data input registers starting at the lowest<br />
# If this were the the first 64 bytes clear bit 3 in the Configuration register, else set it<br />
# Set bit 1 (Start Hash) of the Configuration register and wait until bit 0 (Hash Busy) is cleared<br />
# If more data to hash go to point 6<br />
# Read the calculated hash of the Output SHA-1 Hash registers<br />
# Switch off the clock<br />
<br />
==Registers==<br />
===Register Summary===<br />
<table border=1 width=100%><br />
<tr><br />
<td align=left width=100pix><b>Register</b></td><br />
<td><b>Description</b></td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>0x00</td><br />
<td align=left>Configuration</td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>0x04</td><br />
<td align=left>Reset</td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>0x08</td><br />
<td align=left>Unknown, but referenced in iBoot</td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>0x0C</td><br />
<td align=left>Unknown, but referenced in iBoot</td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>0x10</td><br />
<td align=left>Unknown, but referenced in iBoot (Set to 0 before calculating a hash)</td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>0x20 - 0x30</td><br />
<td align=left>Output SHA-1 hash / Input Initialization Vector</td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>0x40 - 0x7C</td><br />
<td align=left>Data Input (64 Bytes)</td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>0x80</td><br />
<td align=left>Unknown, but referenced in iBoot (Set to 0 before calculating a hash)</td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>0x84</td><br />
<td align=left>Unknown, but referenced in iBoot</td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>0x8C</td><br />
<td align=left>Unknown, but referenced in iBoot</td><br />
</tr><br />
</table><br />
<br />
===Configuration Register===<br />
<table border=1 width=100%><br />
<tr><br />
<td align=left width=100pix><b>Bit</b></td><br />
<td><b>Function</b></td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>Bit 0</td><br />
<td align=left>Hash Busy. Is set when the hash calculation is started and cleared when the generator is done.</td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>Bit 1</td><br />
<td align=left>Start Hash. Set to 1 to start hashing of the data in the Input Data registers.</td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>Bit 2</td><br />
<td align=left>Unknown</td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>Bit 3</td><br />
<td align=left>Config IV. Use arbitary IV (=1), Use SHA-1 constants (=0) (Used for starting a new hash (=0), or continue a previous one (=1)).</td><br />
</tr><br />
</table><br />
All other bits are unknown or not used<br />
<br />
===Reset Register===<br />
<table border=1 width=100%><br />
<tr><br />
<td align=left width=100pix><b>Bit</b></td><br />
<td><b>Function</b></td><br />
</tr><br />
<tr><br />
<td align=left width=100pix>Bit 0</td><br />
<td align=left>Reset Hash. Resets the generator and all registers.</td><br />
</tr><br />
</table><br />
All other bits are unknown or not used<br />
<br />
===Hash Out / IV In===<br />
Read: Outputs the hash in little-endian <br><br />
Write: Set the initialization vectors<br />
<br />
===Data Input===<br />
Read: Read what was previously written there (like normal RAM) <br><br />
Write: The current 64 byte data chunk to calculate the hash of. (little-endian)</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=EDA&diff=5552
EDA
2009-11-07T07:32:44Z
<p>Posixninja: Undo revision 5520 by 1337urmompois0n (Talk)</p>
<hr />
<div>The embedded disassembler.<br />
<br />
[[Image:eda.png|right|thumb]]<br />
<br />
==Purpose==<br />
* Static disassembly misses a lot and requires you to keep a lot in your head.<br />
* Debuggers require you have that sort of access to the target system<br />
* Simulators are painful to set up and don't really behave like debuggers<br />
<br />
EDA is a cross between these three; a static disassembler with support for things like breakpoints and quick system configuration(like a system designed to run one function). Also, it keeps all past states of the system allowing the memory and registers to be viewed from any point of code execution. Click an instruction or memory address, and see every access and the system state at that point. No more missing xref because of things like(MOV R0, #0x1004 ADD R0, PC). This is all within an IDA-like frontend.<br />
<br />
And this is just phase one. Theres planned support for differential paths(run twice and graphical compare), a version migrator and differ(compare iBoot 1.0 and 1.1, find exploits, and at worst not have to migrate the names), a built in patching engine based on a lot more than pattern matching, and collaboration.<br />
<br />
==History==<br />
EDA is a descendant of [http://opengsm.blogspot.com/ DBS](Disassembly by Simulation), an idea I had after coming home from a party at college and couldn't keep stuff straight in IDA. I used DBS to work out the bugs and verify nckbf. Unfortunately, like simulators, it was annoying to set up and the GUI I wrote used Microsoft CLR; arrays crapped out at like 5000 elements.<br />
<br />
EDA alpha was the version I did at the end of August. It was designed without a clear plan in mind, basically I wrote a frontend, then bsed my way through a backend. It was written in C, with the frontend in Web(HTML,CSS,JS). It looked nice, and did function as both a disassembler and a simulator. But the code base became very unmanagable; I would add a button to the frontend then hack on the backend to make it work.<br />
<br />
==EDA==<br />
As of yesterday, I got motivated to work on this again, and hopefully motivated posixninja and westbaer to help. This is too big a project to do alone. We discussed design and have a plan this time. The backend will be C++, running a web server that any webkit browser can run the front end in. It's fully cross platform. Initially, we plan only to support ARM, but it should be easily extendable to support more architechures.<br />
<br />
I believe this is well within the reach of this community. Think of this as a meta-project, finish this and all your reversing tasks will be sped up 2-20x<br />
<br />
==Tasks==<br />
* Front-end coding: We are looking for skilled HTML/CSS/JS devs to write a front-end and help think up the protocol<br />
* Arch extensions: If we get someone on this now, it'll be easy later. I don't know how much ARM I assume.<br />
* Skilled C++ developers: The whole EDA kernel is in C++, we need a web server and someone to deal with threads and messages<br />
* Good reversers: To tell me why IDA frustrates them<br />
<br />
==Sites==<br />
http://code.google.com/p/eda-reversing/ -- Google code for the wiki and releases<br />
<br />
http://github.com/geohot/eda-reversing/tree/master -- github for the source in development<br />
<br />
If you join the project, we have an internal Google Doc too, viewable at http://docs.google.com/View?docid=dg49sn22_167kkh2vcn</div>
Posixninja
https://www.theiphonewiki.com/w/index.php?title=Northstar_7C145_(iPod2,1)&diff=5551
Northstar 7C145 (iPod2,1)
2009-11-07T07:32:21Z
<p>Posixninja: </p>
<hr />
<div>==Decryption Keys==<br />
=== Root Filesystem ===<br />
* '''VFDecrypt''': d00e2975e96e8558a25249015bad7aca26e3ada1f15cb34fa70d1ff205a21ac9<br />
<br />
===LLB===<br />
* '''IV''': e13f59246bd7c165727d442bb8061db1<br />
* '''Key''': c8239d8284b672a685348549886c2561<br />
<br />
===iBoot===<br />
* '''IV''': b31c608013ab8980178b79a1d8ba21df<br />
* '''Key''': edebb477d07161edeac17b12c33ba783<br />
<br />
===DeviceTree===<br />
* '''IV''': 6293813000127aadcd0dc9a61afdf0e3<br />
* '''Key''': 9d5302a7aee09045840ec2d3a3ba7fe5<br />
<br />
===kernelcache===<br />
* '''IV''': e5e63f072fe983d6615affcb103dc7cd<br />
* '''Key''': 647e06e61b93719f63d1f02bc661b28c<br />
<br />
===iBEC===<br />
* '''IV''': 5ea1608ce309fd33669f9a0fe691ede0<br />
* '''Key''': 5465ffeaec67bf1d5e47333b6a8525d9<br />
<br />
===iBSS===<br />
* '''IV''': 9036da1779c8d2a2a3b460b0a52146b<br />
* '''Key''': 1ea15c674bf6086a4a3840c310521dd24<br />
<br />
===Restore Ramdisk [018-6041-001.dmg]===<br />
* '''IV''': 8E84AFA0B935D969CED792B5C91C4018<br />
* '''Key''': B3978D4668C85B11E9C16628F3BFE96C<br />
<br />
===Update Ramdisk [018-6048-001.dmg]===<br />
* '''IV''': bbbd60012088d253bf3648285a735e13<br />
* '''Key''': 7b0a441f1b70943461c4444300a8f455</div>
Posixninja