Difference between revisions of "Baseband Device"

From The iPhone Wiki
Jump to: navigation, search
(some links; is it ok to link TEA to Baseband TEA Keys?)
(iPhone X.)
(35 intermediate revisions by 13 users not shown)
Line 1: Line 1:
This is the device in the iPhone that manages all the functions which require an antenna. The baseband processor has its own RAM and firmware in NOR flash, separate from the [[ARM]] core resources. The baseband is a resource to the OS. The Wi-Fi and Bluetooth are managed by the main CPU, although the baseband stores their MAC addresses in it's NVRAM.
+
This is the device in the iPhone and iPad that manages all the functions which require an antenna. The baseband processor has its own RAM and firmware in NOR flash, separate from the [[ARM]] core resources. The baseband is a resource to the OS. The Wi-Fi and Bluetooth are managed by the main CPU, although the baseband stores their MAC addresses in its NVRAM.
   
  +
The [[M68AP|iPhone]]'s baseband processor is the [[S-Gold 2]]. The [[N82AP|iPhone 3G]], the [[N88AP|iPhone 3GS]] and the [[K48AP|iPad]] make use of the [[X-Gold 608]] chip for this purpose. The [[N90AP|iPhone 4 (iPhone3,1)]] and [[K94AP|iPad 2 (iPad2,2)]] use the [[XMM 6180]], while the [[N92AP|iPhone 4 (iPhone3,3)]] uses the [[MDM6600]] and the [[N94AP|iPhone 4S]] uses the [[MDM6610]]. [[iPad (3rd generation)]] uses [[MDM9600]]. [[iPad (4th generation)]], [[iPad Air]] , [[iPad mini]], [[iPad mini 2]], [[iPad mini 3]], [[iPhone 5]], [[iPhone 5c]] and [[iPhone 5s]] use [[MDM9615]] while [[iPad Air 2]], [[iPad Pro (12.9-inch)]], [[iPad (5th generation)]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]] and [[iPhone SE]] use [[MDM9625]]. [[Apple Watch Series 3]], [[iPhone 6s]], [[iPhone 6s Plus]] and [[iPad Pro (9.7-inch)]] use [[MDM9635]]. The [[iPhone 8]], [[iPhone 8 Plus]] and [[iPhone X]] use MDM9656 and PMB9948.
The [[M68ap|iPhone]]'s baseband processor is the [[S-Gold 2]]. The [[N82ap|iPhone 3G]] and the [[N88ap|iPhone 3GS]] make use of the [[X-Gold 608]] chip for this purpose. The [[N90ap|iPhone 4]] uses the [[XMM 6180]].
 
   
You can check some [[Baseband Commands]] too (by pH and EvilPenguin).
+
See also: [[Baseband Commands]] and [[iOS Baseband Tools]].
   
 
==[[Seczone]]==
 
==[[Seczone]]==
Line 20: Line 20:
 
* [[SIM hacks]]
 
* [[SIM hacks]]
   
===[[S-Gold 2]]===
+
===[[PMB8876]] S-Gold 2===
 
* [[Fakeblank]]
 
* [[Fakeblank]]
 
* [[IPSF]]
 
* [[IPSF]]
Line 26: Line 26:
 
* [[Minus 0x20000 with Back Extend Erase]]
 
* [[Minus 0x20000 with Back Extend Erase]]
   
===[[X-Gold 608]]===
+
===[[PMB8878]] X-Gold 608===
 
* [[JerrySIM]]
 
* [[JerrySIM]]
 
* [[AT+stkprof]]
 
* [[AT+stkprof]]
Line 32: Line 32:
 
* [[AT+XEMN Heap Overflow]]
 
* [[AT+XEMN Heap Overflow]]
 
* [[AT+XAPP Vulnerability]]
 
* [[AT+XAPP Vulnerability]]
  +
* [[AT+FNS]]
   
===[[XMM 6180]]===
+
===[[XMM 6180]] X-Gold 618===
 
* [[AT+XAPP Vulnerability]]
 
* [[AT+XAPP Vulnerability]]
  +
  +
===[[MDM6600]]===
  +
* None
  +
  +
===[[MDM6610]]===
  +
* None
  +
  +
===[[MDM9600]]===
  +
* None
  +
  +
===[[MDM9615]]===
  +
* None
  +
  +
===[[MDM9625]]===
  +
* None
  +
  +
===[[MDM9635]]===
  +
* None
  +
  +
===[[MDM9645]]===
  +
* none
  +
  +
===[[PMB9943]] X-Gold 736===
  +
* none
  +
  +
===[[MDM9655]]===
  +
* none
  +
  +
===[[PMB9948]]===
  +
* none
   
 
==Theoretical Attacks==
 
==Theoretical Attacks==

Revision as of 21:48, 31 October 2017

This is the device in the iPhone and iPad that manages all the functions which require an antenna. The baseband processor has its own RAM and firmware in NOR flash, separate from the ARM core resources. The baseband is a resource to the OS. The Wi-Fi and Bluetooth are managed by the main CPU, although the baseband stores their MAC addresses in its NVRAM.

The iPhone's baseband processor is the S-Gold 2. The iPhone 3G, the iPhone 3GS and the iPad make use of the X-Gold 608 chip for this purpose. The iPhone 4 (iPhone3,1) and iPad 2 (iPad2,2) use the XMM 6180, while the iPhone 4 (iPhone3,3) uses the MDM6600 and the iPhone 4S uses the MDM6610. iPad (3rd generation) uses MDM9600. iPad (4th generation), iPad Air , iPad mini, iPad mini 2, iPad mini 3, iPhone 5, iPhone 5c and iPhone 5s use MDM9615 while iPad Air 2, iPad Pro (12.9-inch), iPad (5th generation), iPad mini 4, iPhone 6, iPhone 6 Plus and iPhone SE use MDM9625. Apple Watch Series 3, iPhone 6s, iPhone 6s Plus and iPad Pro (9.7-inch) use MDM9635. The iPhone 8, iPhone 8 Plus and iPhone X use MDM9656 and PMB9948.

See also: Baseband Commands and iOS Baseband Tools.

Seczone

This is the area in the baseband where the lock state is stored.

Layout

0x400--NCK token
0xA00--IMEI signature
0xB00--IMEI
0xC00--Locks table

Encryption

Many of the sections are encrypted using TEA based off the CHIPID and NORID. See NCK Brute Force for more info.

Exploits

PMB8876 S-Gold 2

PMB8878 X-Gold 608

XMM 6180 X-Gold 618

MDM6600

  • None

MDM6610

  • None

MDM9600

  • None

MDM9615

  • None

MDM9625

  • None

MDM9635

  • None

MDM9645

  • none

PMB9943 X-Gold 736

  • none

MDM9655

  • none

PMB9948

  • none

Theoretical Attacks

Boot Chain

bootrom->bootloader->firmware