Difference between revisions of "IMG4 File Format"

From The iPhone Wiki
Jump to: navigation, search
(Created page with "There is a img4 file (sep-firmware.img4) found in /user/standalone/firmware on 7.0.4 (iPhone5S). It has a IMG40 header, but also refers to IM4P. By guess the name sep refers t...")
 
m
 
(26 intermediate revisions by 10 users not shown)
Line 1: Line 1:
  +
The '''IMG4 file format''' is a replacement for the [[IMG3 File Format|IMG3 file format]] and is used on devices running a 64-bit processor (A7 or newer). It's also used across the entire [[List of Apple Watches| Apple Watch series]], in both the armv7k and arm64_32 processors. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain ([[#IMG4_Payload|'''im4p''' files]]), signatures of those files ([[#IMG4_Manifest|'''im4m''']]/<code>ApImg4Ticket</code> files) and some info used in the [[Restore_Process|Restore Process]] ("<code>IM4R</code>" can be found in MobileDevice framework). A complete IMG4 file is the result of concatenating the payload, manifest and restore info (aka boot nonce) in one file and wrapping it with an IMG4 header.
There is a img4 file (sep-firmware.img4) found in /user/standalone/firmware on 7.0.4 (iPhone5S). It has a IMG40 header, but also refers to IM4P. By guess the name sep refers to the Secure Enclave Processor.
 
  +
  +
== Structure ==
  +
Contrary to the [[IMG3 File Format|IMG3 file format]] where a custom binary format was used, IMG4 files (and their payloads) are [[wikipedia:X.690#DER encoding|DER]] encoded [[wikipedia:Abstract Syntax Notation One|ASN.1]] objects. The reason for Apple's choice of ASN.1/DER encoding over their own binary [[PList File Format|Property List]] (PList) file format is unknown.
  +
  +
<pre>
  +
sequence [
  +
0: string "IMG4"
  +
1: payload - IMG4 Payload, IM4P
  +
2: [0] (constructed) [
  +
manifest - IMG4 Manifest, IM4M
  +
]
  +
]
  +
</pre>
  +
  +
==IMG4 Payload==
  +
Payload contains the actual content of the file. IMG4 format allows to store payload in a separate file with '''im4p''' extension. '''im4p''' files are used more often than complete IMG4 files. Payload is structured as follows:
  +
<pre>
  +
sequence [
  +
0: string "IM4P"
  +
1: string type - ibot, rdsk, sepi, ...
  +
2: string description - 'iBoot-1940.1.75'
  +
3: octetstring - the encrypted/raw data
  +
4: octetstring - containing DER encoded KBAG values (optional)
  +
sequence [
  +
sequence [
  +
0: int: 01
  +
1: octetstring: iv
  +
2: octetstring: key
  +
]
  +
sequence [
  +
0: int: 02
  +
1: octetstring: iv
  +
2: octetstring: key
  +
]
  +
]
  +
]
  +
</pre>
  +
  +
==IMG4 Manifest==
  +
A.k.a. IM4M. Contains signature for one or multiple IMG4 payloads. Manifests are designed in a way that they can be stored separately from an IMG4 file or be a part of one. An example of an IMG4 manifest is ApImg4Ticket. Each IMG4 manifest is made of tags structured as follows (content = DER encoded object):
  +
<pre>
  +
[type] (private) [ - DER tag's class is the type of the tag (4 bytes) encoded as a big-endian integer
  +
sequence [
  +
string type - type of the tag, 4 bytes
  +
content - content of the tag
  +
]
  +
]
  +
</pre>
  +
Manifest structure (tag <type> = tag of type 'type'):
  +
<pre>
  +
sequence [
  +
0: string "IM4M"
  +
1: integer version - currently 0
  +
2: set [
  +
tag MANB [ - manifest body
  +
set [
  +
tag MANP [ - manifest properties
  +
set [
  +
tag <manifest property> [
  +
content
  +
]
  +
... - tags, describing other properties
  +
]
  +
]
  +
tag <type> [ - ibot, illb, sepi, krnl, NvMR, bbcl...
  +
set [
  +
tag <tag property> [
  +
content
  +
]
  +
...
  +
]
  +
]
  +
... - tags for other images
  +
]
  +
]
  +
]
  +
3: octet string signature
  +
4: sequence [ - containing certificate chain (arbitrary number of certificates)
  +
certificates
  +
]
  +
</pre>
  +
  +
  +
== External Links ==
  +
* [https://twitter.com/i0n1c/status/501299082603020288 i0n1c's tweet]<!-- TODO: Work this into the article -->
  +
* [https://www.itu.int/rec/T-REC-X.690/en X.690 - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)]
  +
  +
[[Category:File Formats]]

Latest revision as of 20:15, 8 April 2022

The IMG4 file format is a replacement for the IMG3 file format and is used on devices running a 64-bit processor (A7 or newer). It's also used across the entire Apple Watch series, in both the armv7k and arm64_32 processors. Just like the old IMG3 file format, it is used to contain files used by iOS' secure boot chain (im4p files), signatures of those files (im4m/ApImg4Ticket files) and some info used in the Restore Process ("IM4R" can be found in MobileDevice framework). A complete IMG4 file is the result of concatenating the payload, manifest and restore info (aka boot nonce) in one file and wrapping it with an IMG4 header.

Structure

Contrary to the IMG3 file format where a custom binary format was used, IMG4 files (and their payloads) are DER encoded ASN.1 objects. The reason for Apple's choice of ASN.1/DER encoding over their own binary Property List (PList) file format is unknown.

sequence [
   0: string "IMG4"
   1: payload   - IMG4 Payload, IM4P
   2: [0] (constructed) [
          manifest   - IMG4 Manifest, IM4M
      ]
]

IMG4 Payload

Payload contains the actual content of the file. IMG4 format allows to store payload in a separate file with im4p extension. im4p files are used more often than complete IMG4 files. Payload is structured as follows:

sequence [
   0: string "IM4P"
   1: string type    - ibot, rdsk, sepi, ...
   2: string description    - 'iBoot-1940.1.75'
   3: octetstring    - the encrypted/raw data
   4: octetstring    - containing DER encoded KBAG values (optional)
         sequence [
            sequence [
                0: int: 01
                1: octetstring: iv
                2: octetstring: key
            ]
            sequence [
                0: int: 02
                1: octetstring: iv
                2: octetstring: key
            ]
         ]
      ]

IMG4 Manifest

A.k.a. IM4M. Contains signature for one or multiple IMG4 payloads. Manifests are designed in a way that they can be stored separately from an IMG4 file or be a part of one. An example of an IMG4 manifest is ApImg4Ticket. Each IMG4 manifest is made of tags structured as follows (content = DER encoded object):

[type] (private) [   - DER tag's class is the type of the tag (4 bytes) encoded as a big-endian integer
   sequence [
      string type    - type of the tag, 4 bytes
      content    - content of the tag
   ]
]

Manifest structure (tag <type> = tag of type 'type'):

sequence [
   0: string "IM4M"
   1: integer version    - currently 0
   2: set [
          tag MANB [   - manifest body
              set [
                  tag MANP [   - manifest properties
                      set [
                          tag <manifest property> [
                              content
                          ]
                          ...   - tags, describing other properties
                      ]
                  ]
                  tag <type> [   - ibot, illb, sepi, krnl, NvMR, bbcl...
                      set [
                          tag <tag property> [
                              content
                          ]
                          ...
                      ]
                  ]
                  ...   - tags for other images
              ]
          ]
      ]
   3: octet string signature
   4: sequence [   - containing certificate chain (arbitrary number of certificates)
          certificates
      ]


External Links