Difference between revisions of "Bootrom"

From The iPhone Wiki
Jump to: navigation, search
m
(8 intermediate revisions by 3 users not shown)
Line 2: Line 2:
   
 
== Old & New bootrom ==
 
== Old & New bootrom ==
Certain models, including the [[N72AP|iPod touch 2G]] and [[N88AP|iPhone 3GS]], have different bootrom versions. These are most commonly referred to with the terms "old bootrom" and "new bootrom." These "new bootrom" devices were released after [[Timeline#September|9 September 2009]] and have the [[0x24000 Segment Overflow]] fixed. While the new bootrom revisions have an exploit, the exploit needs the assistance of a firmware-based exploit to achieve an [[untethered jailbreak]].
+
Certain models, including the [[N72AP|iPod touch (2nd generation)]] and [[N88AP|iPhone 3GS]], have different bootrom versions. These are most commonly referred to with the terms "old bootrom" and "new bootrom." These "new bootrom" devices were released after [[Timeline#September|9 September 2009]] and have the [[0x24000 Segment Overflow]] fixed. While the new bootrom revisions have an exploit, the exploit needs the assistance of a firmware-based exploit to achieve an [[untethered jailbreak]].
   
 
You might also be looking for [[iBoot (Bootloader)|Apple's stage 2 bootloader]], which also uses the "iBoot" name.
 
You might also be looking for [[iBoot (Bootloader)|Apple's stage 2 bootloader]], which also uses the "iBoot" name.
Line 9: Line 9:
   
 
==Finding bootrom version==
 
==Finding bootrom version==
===From the model number ([[N72AP|iPod touch 2G]])===
+
===From the model number ([[N72AP|iPod touch (2nd generation)]])===
 
If the second character of your Model Number is "B" (e.g.- '''FB533''', '''MB533''', or '''PB533'''), your iPod has the old bootrom. If the second character is "C" ('''FC086''', '''MC086''' or '''PC086'''), your iPod has the new bootrom.
 
If the second character of your Model Number is "B" (e.g.- '''FB533''', '''MB533''', or '''PB533'''), your iPod has the old bootrom. If the second character is "C" ('''FC086''', '''MC086''' or '''PC086'''), your iPod has the new bootrom.
   
Line 40: Line 40:
 
* [[pwnage|Pwnage 1.0 (Ramdisk + AppleImage2NORAccess)]] up to Rev.2
 
* [[pwnage|Pwnage 1.0 (Ramdisk + AppleImage2NORAccess)]] up to Rev.2
 
* [[Pwnage 2.0|Pwnage 2.0 (DFU + Malformed Certificate)]] up to Rev.2
 
* [[Pwnage 2.0|Pwnage 2.0 (DFU + Malformed Certificate)]] up to Rev.2
* [[0x24000 Segment Overflow]] up to 240.4/359.3
 
 
* [[usb_control_msg(0xA1, 1) Exploit]] (also called "steaks4uce" exploit) only for 240.4 and 240.5.1
 
* [[usb_control_msg(0xA1, 1) Exploit]] (also called "steaks4uce" exploit) only for 240.4 and 240.5.1
  +
* [[0x24000 Segment Overflow]] only for 240.4 and 359.3
  +
* [[alloc8 Exploit]] only for 359.3 and 359.3.2
 
* [[Limera1n Exploit]] up to 574.4
 
* [[Limera1n Exploit]] up to 574.4
 
* [[SHA-1 Image Segment Overflow|SHAtter]] up to 574.4
 
* [[SHA-1 Image Segment Overflow|SHAtter]] up to 574.4
Line 54: Line 55:
 
* [[Bootrom 574.4]] in [[S5L8930]]
 
* [[Bootrom 574.4]] in [[S5L8930]]
 
* [[Bootrom 838.3]] in [[S5L8940]]
 
* [[Bootrom 838.3]] in [[S5L8940]]
* [[Bootrom 878.3]] in [[S5L8942]]
+
* [[rom]] in [[S5L8942]]
 
* [[Bootrom 1062.2]] in [[S5L8945]]
 
* [[Bootrom 1062.2]] in [[S5L8945]]
  +
* [[Bootrom 1413.8]] in [[S5L8747]]
 
* [[Bootrom 1458.2]] in [[S5L8947]]
 
* [[Bootrom 1458.2]] in [[S5L8947]]
 
* [[Bootrom 1145.3]] in [[S5L8950]]
 
* [[Bootrom 1145.3]] in [[S5L8950]]
Line 62: Line 64:
 
* [[Bootrom 1992.0.0.1.19]] in [[T7000]]
 
* [[Bootrom 1992.0.0.1.19]] in [[T7000]]
 
* [[Bootrom 1991.0.0.2.16‎]] in [[T7001]]
 
* [[Bootrom 1991.0.0.2.16‎]] in [[T7001]]
* unknown [[S7002]]
+
* [[Bootrom 2098.0.0.2.4]] in [[S7002]]
 
* [[Bootrom 2234.0.0.3.3]] in [[S8000]]
 
* [[Bootrom 2234.0.0.3.3]] in [[S8000]]
 
* [[Bootrom 2234.0.0.2.22]] in [[S8003]]
 
* [[Bootrom 2234.0.0.2.22]] in [[S8003]]
  +
* [[Bootrom 2481.0.0.2.1]] in [[S8001]]
  +
* [[Bootrom 2651.0.0.1.31]] in [[T8002]]
  +
* [[Bootrom 2696.0.0.1.33]] in [[T8010]]
  +
   
 
===[[S5L8900]], used in the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]]===
 
===[[S5L8900]], used in the [[M68AP|iPhone]], [[N45AP|iPod touch]], and [[N82AP|iPhone 3G]]===
Line 70: Line 76:
 
* [[Bootrom Rev.2]]
 
* [[Bootrom Rev.2]]
   
===[[S5L8720]], used in the [[N72AP|iPod touch 2G]]===
+
===[[S5L8720]], used in the [[N72AP|iPod touch (2nd generation)]]===
 
* [[Bootrom 240.4]] "old bootrom"
 
* [[Bootrom 240.4]] "old bootrom"
 
* [[Bootrom 240.5.1]] "new bootrom"
 
* [[Bootrom 240.5.1]] "new bootrom"
Line 78: Line 84:
 
* [[Bootrom 359.3.2]] "new bootrom"
 
* [[Bootrom 359.3.2]] "new bootrom"
   
===[[S5L8922]], used in the [[N18AP|iPod touch 3G]]===
+
===[[S5L8747]], used in the [[Haywire]]===
  +
* [[Bootrom 1413.8]]
  +
  +
===[[S5L8922]], used in the [[N18AP|iPod touch (3rd generation)]]===
 
* [[Bootrom 359.5]]
 
* [[Bootrom 359.5]]
   
===[[S5L8930]], used in the [[K48AP|iPad]], [[N90AP|iPhone 4]], [[K66AP|Apple TV 2G]], and [[N81AP|iPod touch 4G]]===
+
===[[S5L8930]], used in the [[K48AP|iPad]], [[N90AP|iPhone 4]], [[K66AP|Apple TV (2nd generation)]], and [[N81AP|iPod touch (4th generation)]]===
 
* [[Bootrom 574.4]]
 
* [[Bootrom 574.4]]
   
Line 87: Line 96:
 
* [[Bootrom 838.3]]
 
* [[Bootrom 838.3]]
   
===[[S5L8942]], used in the [[K93AAP|iPad 2 (iPad2,4)]], [[J33AP|Apple TV 3G (AppleTV3,1)]], [[iPod touch 5G]], and [[iPad mini]] ===
+
===[[S5L8942]], used in the [[K93AAP|iPad 2 (iPad2,4)]], [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]], [[iPod touch (5th generation)]], and [[iPad mini]] ===
* [[Bootrom 878.3]]
+
* [[rom]]
 
<!--
 
<!--
* Apple TV 3G (J33) does not print Bootrom revision over USB Descriptor while in DFU.
+
* Apple TV (3rd generation) (J33) does not print Bootrom revision over USB Descriptor while in DFU.
   
 
e.g CPID:8942_CPRV:10_CPFM:03_SCEP:10_BDID:08_ECID:00000XXXXXXXXXXX_IBFL:00_SRTG:[ROM]
 
e.g CPID:8942_CPRV:10_CPFM:03_SCEP:10_BDID:08_ECID:00000XXXXXXXXXXX_IBFL:00_SRTG:[ROM]
 
-->
 
-->
   
===[[S5L8945]], used in the [[iPad 3]]===
+
===[[S5L8945]], used in the [[iPad (3rd generation)]]===
 
* [[Bootrom 1062.2]]
 
* [[Bootrom 1062.2]]
   
===[[S5L8947]], used in the [[J33IAP|Apple TV 3G (AppleTV3,2)]]===
+
===[[S5L8947]], used in the [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]===
 
* [[Bootrom 1458.2]]
 
* [[Bootrom 1458.2]]
   
Line 104: Line 113:
 
* [[Bootrom 1145.3]]
 
* [[Bootrom 1145.3]]
   
===[[S5L8955]], used in the [[iPad 4]]===
+
===[[S5L8955]], used in the [[iPad (4th generation)]]===
 
* [[Bootrom 1145.3.3]]
 
* [[Bootrom 1145.3.3]]
   
Line 110: Line 119:
 
* [[Bootrom 1704.10]]
 
* [[Bootrom 1704.10]]
   
===[[T7000]], used in the [[J42dAP|Apple TV 4G]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], and [[N102AP|iPod touch 6G]]===
+
===[[T7000]], used in the [[J42dAP|Apple TV (4th generation)]], [[B238aAP|HomePod]], [[iPad mini 4]], [[N61AP|iPhone 6]], [[N56AP|iPhone 6 Plus]], and [[N102AP|iPod touch (6th generation)]]===
 
* [[Bootrom 1992.0.0.1.19]]
 
* [[Bootrom 1992.0.0.1.19]]
   
Line 117: Line 126:
   
 
===[[S7002]], used in the [[Apple Watch (1st generation)]]===
 
===[[S7002]], used in the [[Apple Watch (1st generation)]]===
  +
* [[Bootrom 2098.0.0.2.4]]
* unknown
 
   
===[[S8000]], used in the [[N71AP|iPhone 6s]], [[N66AP|iPhone 6s Plus]] and [[N69uAP|iPhone SE]]===
+
===[[S8000]], used in the [[iPad (5th generation)]], [[N71AP|iPhone 6s]], [[N66AP|iPhone 6s Plus]] and [[N69uAP|iPhone SE]]===
 
* [[Bootrom 2234.0.0.3.3]]
 
* [[Bootrom 2234.0.0.3.3]]
   

Revision as of 07:40, 29 July 2017

The bootrom (called "SecureROM" by Apple) is the first significant code that runs on an iDevice. The bootrom is read-only. Finding exploits in the bootrom level is a big achievement since Apple won't be able to fix it without a hardware revision.

Contents

Old & New bootrom

Certain models, including the iPod touch (2nd generation) and iPhone 3GS, have different bootrom versions. These are most commonly referred to with the terms "old bootrom" and "new bootrom." These "new bootrom" devices were released after 9 September 2009 and have the 0x24000 Segment Overflow fixed. While the new bootrom revisions have an exploit, the exploit needs the assistance of a firmware-based exploit to achieve an untethered jailbreak.

You might also be looking for Apple's stage 2 bootloader, which also uses the "iBoot" name.

Usually also looking at the CPRV (Chip Revision) tag will also tell you whether the device is new unit or not also.

Finding bootrom version

From the model number (iPod touch (2nd generation))

If the second character of your Model Number is "B" (e.g.- FB533, MB533, or PB533), your iPod has the old bootrom. If the second character is "C" (FC086, MC086 or PC086), your iPod has the new bootrom.

From the serial number (iPhone 3GS)

The third digit of the serial number identifies the year of manufacture (9=2009, 0=2010, 1=2011, 2=2012), while the fourth and the fifth indicate the week. There is a gray area between week 40 of 2009 (??940??????) and week 45 of 2009 (??945??????) where some devices have new bootrom whilst others have old bootrom. . Any iPhone made after Week 45 of 2009 (??945?????? and higher or ??0???????? serials) has the new bootrom.

From the DFU Device descriptors (all devices except S5L8900)

Windows

  1. Connect Device & Enter DFU Mode
  2. Open Device Manager, find USB controller, subitem Apple Mobile Device USB Driver
  3. Right-Click & click Properties
  4. Go to Details tab & select Device Instance Path in the dropdown box
  5. The end of the info string will show the bootrom version

Mac OS X

  1. Connect Device & Enter DFU Mode
  2. Go to System Profiler, and under the Hardware category, go to USB, and click on Apple Mobile Device (DFU Mode)
  3. The end of the Serial Number string will show the bootrom version in brackets (ie: [iBoot-574.4])

Linux

  1. Make sure your distribution has usbutils installed. (most distributions have it by default)
  2. Connect Device & Enter DFU Mode
  3. In terminal, run sudo lsusb -v
  4. Find the line that says iSerial and your bootrom version will be at the end of the line.

Dumping the bootrom

You can use Bootrom Dumper Utility by pod2g to dump the bootrom on devices that are vulnerable to the Limera1n Exploit.

Bootrom Exploits

Revisions


S5L8900, used in the iPhone, iPod touch, and iPhone 3G

see also VROM (S5L8900)

S5L8720, used in the iPod touch (2nd generation)

S5L8920, used in the iPhone 3GS

S5L8747, used in the Haywire

S5L8922, used in the iPod touch (3rd generation)

S5L8930, used in the iPad, iPhone 4, Apple TV (2nd generation), and iPod touch (4th generation)

S5L8940, used in the iPad 2 and iPhone 4S

S5L8942, used in the iPad 2 (iPad2,4), Apple TV (3rd generation) (AppleTV3,1), iPod touch (5th generation), and iPad mini

S5L8945, used in the iPad (3rd generation)

S5L8947, used in the Apple TV (3rd generation) (AppleTV3,2)

S5L8950, used in the iPhone 5 and iPhone 5c

S5L8955, used in the iPad (4th generation)

S5L8960/S5L8965, used in the iPhone 5s, iPad Air, iPad mini 2, and iPad mini 3

T7000, used in the Apple TV (4th generation), HomePod, iPad mini 4, iPhone 6, iPhone 6 Plus, and iPod touch (6th generation)

T7001, used in the iPad Air 2

S7002, used in the Apple Watch (1st generation)

S8000, used in the iPad (5th generation), iPhone 6s, iPhone 6s Plus and iPhone SE

S8001, used in the iPad Pro

S8003, used in the iPhone 6s, iPhone 6s Plus and iPhone SE

T8002, used in the Apple Watch Series 1 and Apple Watch Series 2

T8010, used in the iPhone 7 and iPhone 7 Plus

References