|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Firmware Keys
Contents
VFDecrypt Usage
mac: ./vfdecrypt -i <dmg location> -o decrypt.dmg -k <key> windows: vfdecrypt.exe -i <dmg location> -o decrypt.dmg -k <key>
Gaps
As you will notice, there may be a gap or two, or a key for a current build that is not there. Please feel free to add them, but please be sure that it is only the key for a User or Developer build, as if you gave the key for another type of build that might or may not be out there people could get in trouble, and we do not want that. Thanks for contributing!
Notes
The root filesystem is by far the largest (300+ MB in the case of iOS 4), for which there is one key per device model, with no IV. Use VFDecrypt to decrypt this. You can mount/this once it has been decrypted using your program of choice. (For example, 7-zip on Windows.)
The Update and Restore ramdisks share the same IV and key per type of Application Processor (current choices are S5L8900 in the iPhone 3G, S5L8720 in the iPod touch 2G, S5L8920 in the iPhone 3GS, and S5L8922 in the iPod touch 3G). Use img3decrypt or xpwntool to decrypt these. Likewise, once this is decrypted, you can mount this as well, using the tool of your choice.
You may find Ramdisk Decryption to be helpful.
For those wanting to decrypt their own keys, you must use GenPass to get the keys for 4.x.
Downloads
| Program Name | Creator | Credit | GitHub | Interface | Windows (x86) | Windows (x64) | Mac OS X (Universal) | Mac OS X (Intel) | Mac OS X (PowerPC) | Linux Installer (.deb) | Linux Installer (.rpm) | Linux (.tar.gz) | Haiku | Solaris (x86) | Solaris (x64) | Solaris (SPARC) | Solaris (PowerPC) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| AutoDecrypt | Unknown | None | None | GUI/CLI | No | No | No | No | No | No | No | No | No | No | No | No | No |
| DMG Decrypter | MCTD81 | None | None | GUI | No | No | No | DMG Decrypter Blog | No | No | No | No | No | No | No | No | No |
| iDecrypt | Bennyboi | None | None | GUI | FileDen HTTP MediaFire HTTP |
Use 32-bit version. | No | FileDen HTTP | No | No | No | No | No | No | No | No | No |
| iDecryptIt | Balloonhead66 | VFDecrypt | None | GUI | No | No | No | No | No | No | No | No | No | No | No | No | No |
| iDecrypter | Fallensn0w | VFDecrypt | fallensn0w's iDecrypter | GUI | GitHub HTTP | Use 32-bit version. | No | No | No | No | No | No | No | No | No | No | No |
| VFDecrypt | Unknown | http://lorenzo.yellowspace.net/corrupt-sparseimage.html | dra1nerdrake's VFDecrypt | CLI | Google Code HTTP | Use 32-bit version. | No | YellowSpace HTTP | YellowSpace HTTP | No | No | Google Code HTTP | No | No | No | No | No |
Firmware versions
Table of Links to Keys
| 1.x | 2.x | 3.x | 4.x | |
|---|---|---|---|---|
| Beta | Keys | Keys | Keys | |
| Final | Keys | Keys |
Final
Main Article: Firmware
| iPhone | iPhone 3G | iPhone 3GS | iPhone 4 | iPod touch | iPod touch 2G | iPod touch 3G | iPod touch 4G | iPad | Apple TV 2G | |
|---|---|---|---|---|---|---|---|---|---|---|
| 1.0 | 1A420 | no | no | no | no | no | no | no | no | no |
| 1.0.0 | 1A543a | |||||||||
| 1.0.1 | 1C25 | |||||||||
| 1.0.2 | 1C28 | |||||||||
| 1.1 | no | 3A100a+3A101a | ||||||||
| 1.1.1 | 3A110a | 3A110a | ||||||||
| 1.1.2 | 3B48b | 3B48b | ||||||||
| 1.1.3 | 4A93 | 4A93 | ||||||||
| 1.1.4 | 4A102 | 4A102 | ||||||||
| 1.1.5 | no | 4B1 | ||||||||
| 2.0 | 5A347 | 5A345+5A347 | 5A347 | |||||||
| 2.0.1 | 5B108 | 5B108 | 5B108 | |||||||
| 2.0.2 | 5C1 | 5C1 | 5C1 | |||||||
| 2.1 | 5F136 | 5F136 | 5F137 | |||||||
| 2.1.1 | no | no | 5F138 | no | ||||||
| 2.2 | 5G77 | 5G77 | 5G77 | 5G77 | ||||||
| 2.2.1 | 5H11 | 5H11 | 5H11 | 5H11a | ||||||
| 3.0 | 7A341 | 7A341 | 7A341 | 7A341 | 7A341 | |||||
| 3.0.1 | 7A400 | 7A400 | 7A400 | no | no | |||||
| 3.1 | 7C144 | 7C144 | 7C144 | no | no | |||||
| 3.1.1 | only for iPod touches | 7C145 | 7C145 | 7C145+7C146 | ||||||
| 3.1.2 | 7D11 | 7D11 | 7D11 | 7D11 | 7D11 | 7D11 | ||||
| 3.1.3 | 7E18 | 7E18 | 7E18 | 7E18 | 7E18 | 7E18 | ||||
| 3.2 | Firmware 3.2.x is only for iPad | 7B367 | Firmware 3.2.x is only for iPad | |||||||
| 3.2.1 | 7B405 | |||||||||
| 3.2.2 | 7B500 | |||||||||
| 4.0 | no more supported | 8A293 | 8A293 | 8A293 | no more supported | 8A293 | 8A293 | no | not yet supported | no |
| 4.0.1 | 8A306 | 8A306 | 8A306 | only fix for iPhones | ||||||
| 4.0.2 | 8A400 | 8A400 | 8A400 | 8A400 | 8A400 | no | ||||
| 4.1 | 8B117 | 8B117 | 8B117 | 8B117 | 8B117 | 8B117+8B118 | 8M89 | |||
Beta
Main Article: Beta Firmware
| iPhone | iPhone 3G | iPhone 3GS | iPhone 4 | iPod touch | iPod touch 2G | iPod touch 3G | iPod touch 4G | iPad | Apple TV 2G | |
|---|---|---|---|---|---|---|---|---|---|---|
| 1.2b1 | 5A147p | no | no | no | 5A147p | no | no | no | no | no |
| 2.0b2 | 5A225c | 5A225c | ||||||||
| 2.0b3 | 5A240d | 5A240d | ||||||||
| 2.0b4 | 5A258f | 5A258f | ||||||||
| 2.0b5 | 5A274d | 5A274d | ||||||||
| 2.0b6P | 5A292g | 5A292g | ||||||||
| 2.0b6F | 5A308 | 5A308 | ||||||||
| 2.0b7 | 5A331 | 5A331 | ||||||||
| 3.0b1 | 7A238j | 7A238j | 7A238j | 7A238j | ||||||
| 3.0b2 | 7A259g | 7A259g | 7A259g | 7A259g | ||||||
| 3.0b3 | 7A280f | 7A280f | 7A280f | 7A280f | ||||||
| 3.0b4 | 7A300g | 7A300g | 7A300g | 7A300g | ||||||
| 3.0b5 | 7A312g | 7A312g | 7A312g | 7A312g | ||||||
| 3.1b1 | 7C97d | 7C97d | 7C97d | no | no | |||||
| 3.1b2 | 7C106c | 7C106c | 7C106c | |||||||
| 4.0b1 | no more supported | 8A230m | 8A230m | no more supported | 8A230m | 8A230m | not yet supported | |||
| 4.0b2 | 8A248c | 8A248c | 8A248c | 8A248c | ||||||
| 4.0b3 | 8A260b | 8A260b | 8A260b | 8A260b | ||||||
| 4.0b4 | 8A274b | 8A274b | 8A274b | 8A274b | ||||||
| 4.0GM | 8A293 | 8A293 | 8A293 | 8A293 | ||||||
| 4.1b1 | 8B5080c | 8B5080c | 8B5080c | 8B5080 (?) | 8B5080 (?) | |||||
| 4.2b3 | 8C5115c | 8C5115c | 8C5115c | 8C5115c | 8C5115c | 8C5115c | 8C5115c | ? | ||
| 4.2GM | 8C134 | 8C134 | 8C134 | 8C134 | 8C134 | 8C134 | 8C134 | ? |
