IBSS - Revision history

Gjest: new name in iOS 10

2018-02-08T03:07:07Z

new name in iOS 10

Gjest: dongle products have iBSS too

2018-02-08T02:08:55Z

dongle products have iBSS too

Gjest: link

2018-02-08T02:02:45Z

link

Gjest: capitalising Single Stage (source is all lower case)

2018-02-08T01:34:21Z

capitalising Single Stage (source is all lower case)

Gjest: abbrev is short for iBoot single stage (src is the leaked iBoot src)

2018-02-08T01:32:56Z

abbrev is short for iBoot single stage (src is the leaked iBoot src)

AS967 at 02:16, 19 October 2015

2015-10-19T02:16:14Z

Winocm at 20:54, 16 September 2012

2012-09-16T20:54:11Z

Http: 2 typos, links, grammar typo fix (not sure if correct now "does create image")

2012-03-04T11:16:45Z

2 typos, links, grammar typo fix (not sure if correct now "does create image")

Itaiyz97: /* Use of the iBSS */

2012-03-04T09:26:29Z

‎Use of the iBSS

Http: typo

2012-03-04T08:26:32Z

typo

← Older revision		Revision as of 03:07, 8 February 2018
Line 1:		Line 1:
		+	{{lowercase}}
−	{{DISPLAYTITLE:iBSS}}
−	'''iBSS''' (short for '''''iB'''oot '''S'''ingle '''S'''tage'') is a stripped down version of [[IBoot (Bootloader)\|iBoot]], missing things such as interacting with the [[/\|filesystem]]. Can be uploaded via [[DFU (Protocol)\|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore.	+	'''iBSS''' (short for '''''iB'''oot '''S'''ingle '''S'''tage'') is a stripped down version of [[IBoot (Bootloader)\|iBoot]], missing things such as interacting with the [[/\|filesystem]]. Can be uploaded via [[DFU (Protocol)\|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore. It was renamed '''iBootStage1''' in iOS 10.

	According to Apple’s source code, ''“dongle products get an iBSS with all of iBoot’s recovery mode accroutements, EXCEPT for filesystem support”''.		According to Apple’s source code, ''“dongle products get an iBSS with all of iBoot’s recovery mode accroutements, EXCEPT for filesystem support”''.

@@ Line 1: / Line 1: @@
 {{DISPLAYTITLE:iBSS}}
 '''iBSS''' (short for '''''iB'''oot '''S'''ingle '''S'''tage'') is a stripped down version of [[IBoot (Bootloader)|iBoot]], missing things such as interacting with the [[/|filesystem]]. Can be uploaded via [[DFU (Protocol)|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore.
 == Use of the iBSS ==

@@ Line 2: / Line 2: @@
 '''iBSS''' (short for '''''iB'''oot '''S'''ingle '''S'''tage'') is a stripped down version of [[IBoot (Bootloader)|iBoot]], missing things such as interacting with the [[/|filesystem]]. Can be uploaded via [[DFU (Protocol)|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore.
-==Use of the iBSS==
+== Use of the iBSS ==
 The [[iBSS]] bootstraps the [[iBEC]], which prepares and executes the [[Restore Ramdisk]]. in addition, it sends messages to [[iTunes]] on the restore to supervise the restore process. It also integrity checks the images uploaded, and on iOS5+ does the image responsible for [[APTicket]], by uploading the [[nonce]] string to [[iTunes]] then checks for the match of the [[APTicket]] and [[nonce]] and the signatures on [[APTicket]]. On custom firmwares, the [[iBSS]] is patched out of every signature check, but on certain circumstances it still generates [[nonce]]. Check [[APTicket]] for further detail.
 On jailbreak softwares like [[redsn0w]] and [[greenpois0n]], the [[iBSS]] bootstraps [[iBEC]] and executes a payload. It is patched out of its signature checks, of course.
-==iBSS 5.x==
+== iBSS 5.x ==
 iBSS in iOS 5.x is very similar to LLB/DFU, where it has the same protocol. On UART out, it says: "iBSS ready. Asking for DFU...", or something along those lines.
 Interesting things I've noted are when certain bits in chip ID are set, it uses a different DFU device identifier (I've personally seen 0x1226/0x1228), and these modes reject any Img3 files sent over USB.

@@ Line 1: / Line 1: @@
 {{DISPLAYTITLE:iBSS}}
-'''iBSS''' (short for '''''iB'''oot '''s'''ingle '''s'''tage'') is a stripped down version of [[IBoot (Bootloader)|iBoot]], missing things such as interacting with the [[/|filesystem]]. Can be uploaded via [[DFU (Protocol)|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore.
+'''iBSS''' (short for '''''iB'''oot '''S'''ingle '''S'''tage'') is a stripped down version of [[IBoot (Bootloader)|iBoot]], missing things such as interacting with the [[/|filesystem]]. Can be uploaded via [[DFU (Protocol)|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore.
 ==Use of the iBSS==

@@ Line 1: / Line 1: @@
 {{DISPLAYTITLE:iBSS}}
-A stripped down version of [[IBoot (Bootloader)|iBoot]], missing things such as interacting with the [[/|filesystem]]. Can be uploaded via [[DFU (Protocol)|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore.
+'''iBSS''' (short for '''''iB'''oot '''s'''ingle '''s'''tage'') is a stripped down version of [[IBoot (Bootloader)|iBoot]], missing things such as interacting with the [[/|filesystem]]. Can be uploaded via [[DFU (Protocol)|DFU]] to bootstrap [[iBEC]] during a [[DFU Mode]] restore.
 ==Use of the iBSS==

← Older revision		Revision as of 20:54, 16 September 2012
Line 6:		Line 6:

	On jailbreak softwares like [[redsn0w]] and [[greenpois0n]], the [[iBSS]] bootstraps [[iBEC]] and executes a payload. It is patched out of its signature checks, of course.		On jailbreak softwares like [[redsn0w]] and [[greenpois0n]], the [[iBSS]] bootstraps [[iBEC]] and executes a payload. It is patched out of its signature checks, of course.
		+
		+	==iBSS 5.x==
		+
		+	iBSS in iOS 5.x is very similar to LLB/DFU, where it has the same protocol. On UART out, it says: "iBSS ready. DFU start", or something along those lines.
		+
		+	Interesting things I've noted are when certain bits in chip ID are set, it uses a different DFU device identifier (I've personally seen 0x1226/0x1228), and these modes reject any Img3 files sent over USB.

← Older revision		Revision as of 09:26, 4 March 2012
Line 3:		Line 3:

	==Use of the iBSS==		==Use of the iBSS==
		+	The iBSS bootstraps the [[iBEC]], which prepars and executes the [[Restore Ramdisk]]. in addition, it sends messages to iTunes on the restore to supervise the restore process. It also integrity checks the images uploaded, and on iOS5+ os the image responsible for [[APTicket]], by uploading the nonce string to iTunes then checks for the match of the APTicket and nonce and the signatures on APTicket. On custom firmwares, the iBSS is patched out of every signature check, but on certain corcumstances it still generates nonce. Check [[APTicket]] for further detail.
−	Your [[iBSS]] and [[iBEC]] is used to sign the firmware before uploading it to the ROM. This was a new layer of security (certificates) Apple had added to try stop jailbreakers.
		+
		+	On jailbreak softwares like [[redsn0w]] and [[greenpois0n]], the iBSS bootstraps [[iBEC]] and executes a payload. It is patched out of its signature checks, of course.