Baseband Device

From The iPhone Wiki
Jump to: navigation, search

This is the device in the iPhone and iPad that manages all the functions which require an antenna. The baseband processor has its own RAM and firmware in NOR flash, separate from the ARM core resources. The baseband is a resource to the OS. The Wi-Fi and Bluetooth are managed by the main CPU, although the baseband stores their MAC addresses in its NVRAM.

The iPhone's baseband processor is the S-Gold 2. The iPhone 3G, the iPhone 3GS and the iPad make use of the X-Gold 608 chip for this purpose. The iPhone 4 (iPhone3,1) and iPad 2 (iPad2,2) use the XMM 6180, while the iPhone 4 (iPhone3,3) uses the MDM6600 and the iPhone 4S uses the MDM6610. iPad (3rd generation) uses MDM9600. iPad (4th generation), iPad Air , iPad mini, iPad mini 2, iPad mini 3, iPhone 5, iPhone 5c and iPhone 5s use MDM9615 while iPad Air 2, iPad Pro (12.9-inch), iPad (5th generation), iPad mini 4, iPhone 6, iPhone 6 Plus and iPhone SE use MDM9625. Apple Watch Series 3, iPhone 6s, iPhone 6s Plus and iPad Pro (9.7-inch) use MDM9635. The iPhone 8, iPhone 8 Plus and iPhone X use MDM9655 and PMB9948. The iPad (7th generation), iPad Air (3rd generation), iPad Pro (11-inch), iPad Pro (12.9-inch) (3rd generation), iPad mini (5th generation), iPhone XR, iPhone XS and iPhone XS Max use the PMB9955. And the iPhone 11, iPhone 11 Pro and iPhone 11 Pro Max use the PMB9960.

See also: Baseband Commands and iOS Baseband Tools.


This is the area in the baseband where the lock state is stored.


0x400--NCK token
0xA00--IMEI signature
0xC00--Locks table


Many of the sections are encrypted using TEA based off the CHIPID and NORID. See NCK Brute Force for more info.


PMB8876 S-Gold 2

PMB8878 X-Gold 608

XMM 6180 X-Gold 618


  • None


  • None


  • None


  • None


  • None


  • None


  • none

PMB9943 X-Gold 736

  • none


  • none

PMB9948 X-Gold 748

  • none

PMB9955 X-Gold 756

  • none

PMB9960 X-Gold 766

  • none

Theoretical Attacks

Boot Chain