IMG4 File Format - Revision history

5urd at 20:15, 8 April 2022

2022-04-08T20:15:50Z

AS967 at 18:27, 3 April 2022

2022-04-03T18:27:13Z

Kritanta: very very minor clarification

2021-09-28T13:44:44Z

very very minor clarification

ForestCorgi: Fix anchor link

2017-11-23T17:37:05Z

Fix anchor link

AS967 at 21:19, 2 February 2017

2017-02-02T21:19:04Z

IAdam1n at 01:40, 14 September 2016

2016-09-14T01:40:32Z

IAdam1n: Added Category:File Formats

2016-07-06T21:06:43Z

Added Category:File Formats

5urd at 00:54, 5 April 2016

2016-04-05T00:54:54Z

5urd: moving from IM4P File Format

2016-04-05T00:28:17Z

moving from IM4P File Format

Npupyshev: Documented structure of IMG4 files. Most of the data taken from MobileDevice framework.

2016-04-04T15:18:59Z

Documented structure of IMG4 files. Most of the data taken from MobileDevice framework.

@@ Line 2: / Line 2: @@
 == Structure ==
-Contrary to the [[IMG3 File Format|IMG3 file format]] where a custom binary format was used, IMG4 files (and their payloads) are [[wikipedia:X.690#DER encoding|DER]] encoded [[wikipedia:Abstract Syntax Notation One|ASN.1]] objects. The reason for Apple's choice of ASN.1/DER encoding over their own [[PList File Format|Property List]] (PList) file format is currently unknown.
+Contrary to the [[IMG3 File Format|IMG3 file format]] where a custom binary format was used, IMG4 files (and their payloads) are [[wikipedia:X.690#DER encoding|DER]] encoded [[wikipedia:Abstract Syntax Notation One|ASN.1]] objects. The reason for Apple's choice of ASN.1/DER encoding over their own binary [[PList File Format|Property List]] (PList) file format is unknown.
 <pre>

← Older revision		Revision as of 18:27, 3 April 2022
Line 1:		Line 1:
−	The '''IMG4 file format''' is a replacement for the [[IMG3 File Format\|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer). It's also used across the entire [[List of Apple Watches\| Apple Watch series]], in both the armv7k and arm64_32 processors. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#IMG4_Payload\|'''im4p''' files]]), signatures of those files (<code>ApImg4Ticket</code>) and ~~likely~~ some info used in the [[Restore_Process\|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). ~~The only known place in iOS filesystem where a~~ complete IMG4 file ~~can be found~~ is ~~[[/usr/standalone/firmware/sep-firmware.img4]].~~ ~~Extracting~~ a ~~PersonalizedBundle~~ ~~from~~ ~~/tmp~~ ~~during~~ a restore ~~will~~ ~~also~~ ~~yield~~ ~~complete IMG4 files. The embeddedOS images~~ in ~~the~~ ~~macOS~~ ~~filesystem~~ ~~for~~ ~~the~~ ~~2016~~ ~~MacBook Pros also have complete~~ IMG4 ~~files~~.	+	The '''IMG4 file format''' is a replacement for the [[IMG3 File Format\|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer). It's also used across the entire [[List of Apple Watches\| Apple Watch series]], in both the armv7k and arm64_32 processors. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#IMG4_Payload\|'''im4p''' files]]), signatures of those files ([[#IMG4_Manifest\|'''im4m''']]/<code>ApImg4Ticket</code> files) and some info used in the [[Restore_Process\|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). A complete IMG4 file is the result of concatenating the payload, manifest and restore info (aka boot nonce) in one file and wrapping it with an IMG4 header.

	== Structure ==		== Structure ==

← Older revision		Revision as of 13:44, 28 September 2021
Line 1:		Line 1:
−	The '''IMG4 file format''' is a replacement for the [[IMG3 File Format\|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer) ~~and~~ the [[List of Apple Watches\| Apple Watch series]]. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#IMG4_Payload\|'''im4p''' files]]), signatures of those files (<code>ApImg4Ticket</code>) and likely some info used in the [[Restore_Process\|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is [[/usr/standalone/firmware/sep-firmware.img4]]. Extracting a PersonalizedBundle from /tmp during a restore will also yield complete IMG4 files. The embeddedOS images in the macOS filesystem for the 2016 MacBook Pros also have complete IMG4 files.	+	The '''IMG4 file format''' is a replacement for the [[IMG3 File Format\|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer). It's also used across the entire [[List of Apple Watches\| Apple Watch series]], in both the armv7k and arm64_32 processors. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#IMG4_Payload\|'''im4p''' files]]), signatures of those files (<code>ApImg4Ticket</code>) and likely some info used in the [[Restore_Process\|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is [[/usr/standalone/firmware/sep-firmware.img4]]. Extracting a PersonalizedBundle from /tmp during a restore will also yield complete IMG4 files. The embeddedOS images in the macOS filesystem for the 2016 MacBook Pros also have complete IMG4 files.

	== Structure ==		== Structure ==

← Older revision		Revision as of 17:37, 23 November 2017
Line 1:		Line 1:
−	The '''IMG4 file format''' is a replacement for the [[IMG3 File Format\|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer) and the [[List of Apple Watches\| Apple Watch series]]. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#~~Payload~~\|'''im4p''' files]]), signatures of those files (<code>ApImg4Ticket</code>) and likely some info used in the [[Restore_Process\|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is [[/usr/standalone/firmware/sep-firmware.img4]]. Extracting a PersonalizedBundle from /tmp during a restore will also yield complete IMG4 files. The embeddedOS images in the macOS filesystem for the 2016 MacBook Pros also have complete IMG4 files.	+	The '''IMG4 file format''' is a replacement for the [[IMG3 File Format\|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer) and the [[List of Apple Watches\| Apple Watch series]]. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#IMG4_Payload\|'''im4p''' files]]), signatures of those files (<code>ApImg4Ticket</code>) and likely some info used in the [[Restore_Process\|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is [[/usr/standalone/firmware/sep-firmware.img4]]. Extracting a PersonalizedBundle from /tmp during a restore will also yield complete IMG4 files. The embeddedOS images in the macOS filesystem for the 2016 MacBook Pros also have complete IMG4 files.

	== Structure ==		== Structure ==

← Older revision		Revision as of 21:19, 2 February 2017
Line 1:		Line 1:
−	The '''IMG4 file format''' is a replacement for the [[IMG3 File Format\|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer) and the [[List of Apple Watches\| Apple Watch series]]. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#Payload\|'''im4p''' files]]), signatures of those files (<code>ApImg4Ticket</code>) and likely some info used in the [[Restore_Process\|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is [[/usr/standalone/firmware/sep-firmware.img4]].	+	The '''IMG4 file format''' is a replacement for the [[IMG3 File Format\|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer) and the [[List of Apple Watches\| Apple Watch series]]. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#Payload\|'''im4p''' files]]), signatures of those files (<code>ApImg4Ticket</code>) and likely some info used in the [[Restore_Process\|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is [[/usr/standalone/firmware/sep-firmware.img4]]. Extracting a PersonalizedBundle from /tmp during a restore will also yield complete IMG4 files. The embeddedOS images in the macOS filesystem for the 2016 MacBook Pros also have complete IMG4 files.

	== Structure ==		== Structure ==

← Older revision		Revision as of 01:40, 14 September 2016
Line 1:		Line 1:
−	The '''IMG4 file format''' is a replacement for the [[IMG3 File Format\|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer) and the [[Apple Watch]]. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#Payload\|'''im4p''' files]]), signatures of those files (<code>ApImg4Ticket</code>) and likely some info used in the [[Restore_Process\|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is [[/usr/standalone/firmware/sep-firmware.img4]].	+	The '''IMG4 file format''' is a replacement for the [[IMG3 File Format\|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer) and the [[List of Apple Watches\| Apple Watch series]]. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#Payload\|'''im4p''' files]]), signatures of those files (<code>ApImg4Ticket</code>) and likely some info used in the [[Restore_Process\|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is [[/usr/standalone/firmware/sep-firmware.img4]].

	== Structure ==		== Structure ==

← Older revision		Revision as of 21:06, 6 July 2016
Line 86:		Line 86:
	* [https://twitter.com/i0n1c/status/501299082603020288 i0n1c's tweet]<!-- TODO: Work this into the article -->		* [https://twitter.com/i0n1c/status/501299082603020288 i0n1c's tweet]<!-- TODO: Work this into the article -->
	* [https://www.itu.int/rec/T-REC-X.690/en X.690 - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)]		* [https://www.itu.int/rec/T-REC-X.690/en X.690 - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)]
		+
		+	[[Category:File Formats]]

@@ Line 1: / Line 1: @@
-IMG4 is a file format that replaces [[IMG3_File_Format|IMG3]] on [[iPhone 5s]] and newer, [[iPad Air]] and newer, [[iPad mini 2]] and newer, [[N102AP|iPod touch 6G]], [[J42dAP‎|Apple TV 4G]] and [[Apple Watch]]. It is used to store files used by iOS secure boot chain ('''im4p''' files), signatures of those files (ApImg4Ticket) and likely some info used in the [[Restore_Process|Restore Process]] ("IM4R" string can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is /usr/standalone/firmware/sep-firmware.img4.
+The '''IMG4 file format''' is a replacement for the [[IMG3 File Format|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer) and the [[Apple Watch]]. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#Payload|'''im4p''' files]]), signatures of those files (<code>ApImg4Ticket</code>) and likely some info used in the [[Restore_Process|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is [[/usr/standalone/firmware/sep-firmware.img4]].
 <pre>
@@ Line 83: / Line 84: @@
 == External Links ==
-* [https://twitter.com/i0n1c/status/501299082603020288 i0n1c's tweet]
+* [https://twitter.com/i0n1c/status/501299082603020288 i0n1c's tweet]<!-- TODO: Work this into the article -->

← Older revision		Revision as of 00:28, 5 April 2016
Line 80:		Line 80:
	]		]
	</pre>		</pre>
		+
		+
		+	== External Links ==
		+	* [https://twitter.com/i0n1c/status/501299082603020288 i0n1c's tweet]

← Older revision		Revision as of 15:18, 4 April 2016
Line 1:		Line 1:
−	~~There~~ is ~~an '''img4'''~~ file ~~(sep-firmware.img4)~~ ~~found~~ ~~in /usr/standalone/firmware on~~ [[~~iOS~~]] ~~7.0 for the~~ [iPhone 5s]] and newer, [[iPad Air]] and newer, [[iPad mini 2]] and newer,[[N102AP\|iPod touch 6G]], [[J42dAP‎\|Apple TV 4G]] and [[Apple Watch]] . ~~The~~ ~~IPSWFILE/Firmware/all_flash/all_flash.DEVICEIDENTIFIER.production~~ ~~for~~ ~~any~~ ~~[[A7]]~~ (64 ~~bit~~) ~~device~~ and ~~newer~~ as ~~well~~ as [[~~Apple~~ ~~Watch~~]], ~~contains~~ an ~~IM4P~~ ~~version~~ of ~~the~~ ~~same~~ ~~file~~. The ~~file~~ is an ~~[http://en.wikipedia.org/wiki/Abstract_Syntax_Notation_One#Example_encoded_in_DER~~ ~~DER~~ ~~encoded~~ ~~ASN.1~~ ~~object]~~ ~~and~~ ~~structured~~ as ~~follows:~~	+	IMG4 is a file format that replaces [[IMG3_File_Format\|IMG3]] on [[iPhone 5s]] and newer, [[iPad Air]] and newer, [[iPad mini 2]] and newer, [[N102AP\|iPod touch 6G]], [[J42dAP‎\|Apple TV 4G]] and [[Apple Watch]]. It is used to store files used by iOS secure boot chain ('''im4p''' files), signatures of those files (ApImg4Ticket) and likely some info used in the [[Restore_Process\|Restore Process]] ("IM4R" string can be found in MobileDevice framework). The only known place in iOS filesystem where a complete IMG4 file can be found is /usr/standalone/firmware/sep-firmware.img4.

		+	IMG4 files are [http://en.wikipedia.org/wiki/Abstract_Syntax_Notation_One#Example_encoded_in_DER DER encoded ASN.1 objects] structured as follows:
−	==Header==
−	30 - type tag indicating SEQUENCE
−	8 - ?
−	3 - 2,3,4 length in octets of value that follows (length of next value; size of file)
−	x octets - size of file from here
−	16 - indicating an [http://en.wikipedia.org/wiki/IA5String IA5String] to follow
−	04 - length in octets of IA5String that follows
−	49 4D 47 34 - IA5String, the magic "IMG4"
−	... - sequential data

		+	<pre>
		+	sequence [
		+	0: string "IMG4"
		+	1: payload - IMG4 Payload, IM4P
		+	2: [0] (constructed) [
		+	manifest - IMG4 Manifest, IM4M
		+	]
		+	]
		+	</pre>

		+	==IMG4 Payload==
−	{{stub\|software}}
		+	Payload contains the actual content of the file. IMG4 format allows to store payload in a separate file with '''im4p''' extension. '''im4p''' files are used more often than complete IMG4 files. Payload is structured as follows:
		+	<pre>
		+	sequence [
		+	0: string "IM4P"
		+	1: string type - ibot, rdsk, sepi, ...
		+	2: string description - 'iBoot-1940.1.75'
		+	3: octetstring - the encrypted/raw data
		+	4: octetstring - containing DER encoded KBAG values (optional)
		+	sequence [
		+	sequence [
		+	0: int: 01
		+	1: octetstring: iv
		+	2: octetstring: key
		+	]
		+	sequence [
		+	0: int: 02
		+	1: octetstring: iv
		+	2: octetstring: key
		+	]
		+	]
		+	]
		+	</pre>
		+
		+	==IMG4 Manifest==
		+	A.k.a. IM4M. Contains signature for one or multiple IMG4 payloads. Manifests are designed in a way that they can be stored separately from an IMG4 file or be a part of one. An example of an IMG4 manifest is ApImg4Ticket. Each IMG4 manifest is made of tags structured as follows (content = DER encoded object):
		+	<pre>
		+	[type] (private) [ - DER tag's class is the type of the tag (4 bytes) encoded as a big-endian integer
		+	sequence [
		+	string type - type of the tag, 4 bytes
		+	content - content of the tag
		+	]
		+	]
		+	</pre>
		+	Manifest structure (tag <type> = tag of type 'type'):
		+	<pre>
		+	sequence [
		+	0: string "IM4M"
		+	1: integer version - currently 0
		+	2: set [
		+	tag MANB [ - manifest body
		+	set [
		+	tag MANP [ - manifest properties
		+	set [
		+	tag <manifest property> [
		+	content
		+	]
		+	... - tags, describing other properties
		+	]
		+	]
		+	tag <type> [ - ibot, illb, sepi, krnl, NvMR, bbcl...
		+	set [
		+	tag <tag property> [
		+	content
		+	]
		+	...
		+	]
		+	]
		+	... - tags for other images
		+	]
		+	]
		+	]
		+	3: octet string signature
		+	4: sequence [ - containing certificate chain (arbitrary number of certificates)
		+	certificates
		+	]
		+	</pre>