The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
NonUI builds
This article discusses software internally used by Apple. Acquiring a copy without Apple's consent is illegal and may result in being scammed. |
This is a documented list of known factory firmwares, used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. Factory firmwares are based on production iOS ones, but adapted for internal engineering tests, development and debugging.
They are also known as "NonUI (No User Interface)" builds, probably because most applications are command line ones. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, factory ones have the following differences:
- DEVELOPMENT fused bootloaders in
\Firmware\dfu\
and\Firmware\all_flash\all_flash.[board codename].factory[fa/sa]\
. - FACTORY fused SEP firmware in
\Firmware\all_flash\all_flash.[board codename].factory[fa/sa]\
- DEVELOPMENT fused kernelcache with more symbols (located in
/System/Library/Caches/com.apple.kernelcaches
on the filesystem), and with individual kexts in/System/Library/Extensions
. - DEVELOPMENT dyld_shared_cache in
/System/Library/Caches/com.apple.dyld
. - DEBUG fused baseband firmware in
\Firmware\
. - Skankwerk (gear) logo image file in
\Firmware\all_flash\all_flash.[board codename].factoryfa\
. /AppleInternal
folder, which the hierarchy inside get priority over hierarchy in/
.- No SpringBoard, requires the use of daemons to launch SwitchBoard.app as a multi-app launcher instead.
/usr
and subfolders contain many UNIX command line utilities.- SSH daemon is pre-installed as dropbear, can be connected to over usb
- Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable AMFI
- It has some additional Private Frameworks in
/System/Library/PrivateFrameworks
for internal GUI apps and command line utilities. - Most internal applications require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, factory ones are distributed in "restore bundles". Restore bundles are like contents of IPSW files which can be restored on devices using internal restore software such as PurpleRestore. Release and factory firmware "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem), but can also include other files.
Some interesting facts about factory firmwares
- Design: Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in Operator). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
- Other: The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on Wikipedia.
iPhones
iPhone
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
1.0 | 1A420 | Alpine | 03.06.01_G[1] | Originally available here, but was soon taken down. |
4A57 | 04.02.13_G | - | ||
1.1.2 | 3B48 | 04.02.13_G | - | |
1.1.3 | 4A102a | 04.04.05_G | - |
iPhone 3G
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
4.0 | 8A2180g | - | ? | Installing this build will probably brick the device. |
iPhone 3GS
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
3.0 | 7A2168d | Kirkwood? | ? | From @1nsane_dev on Twitter |
3.1b | 7C108b | Sierra? | ? | - |
7C144 | Northstar? | ? | - | |
4.0 | 8A2130h | ApexNanshan | ? | - |
8A2180g | 05.12.01 | - | ||
5.1 | 9B3145a | HoodooYabuli | ? | - |
9B3176b | ? | - | ||
9B3176n | 05.16.05 | - | ||
6.0 | 10A316 | Sundance | 05.16.06 | - |
iPhone 4
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
4.0 | 8A133 | Apex? | 01.32.01 | - |
8A2062a | ? | - | ||
8A2130h | ApexNanshan | ? | - | |
8A2180g | 01.42.01 | - | ||
4.2 | 8E5074b | Phoenix? | ? | Found on an FCC test report [2] |
5.1 | 9B3145a | HoodooYabuli | ? | - |
9B3176b | ? | - | ||
9B3176n | 04.12.01 | - | ||
6.0 | 10A316 | Sundance | 04.12.02 | - |
iPhone 4S
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
5.0 | 9A2264r | TellurideNanshan | ? | - |
5.1 | 9B3145a | HoodooYabuli | ? | - |
9B3176b | ? | - | ||
9B3176n | 1.0.10 | - | ||
6.0 | 10A23941a | SundanceNanshan | 2.0.0.2 | - |
10B63290m | Brighton? | ? | - |
iPhone 5
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
6.0 | 10A23110j | SundanceNanshan? | ? | |
10A23110z | SundanceNanshan | ? | - | |
10A23941s | SundanceNanshan? | ? | - | |
10A316 | Sundance | 1.7.00 | - |
iPhone 5c
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
7.0 | 11A63840h | InnsbruckTianshan | ? | From @mcg29_ on Twitter [3] |
11A93840f | InnsbruckAni? | ? | - | |
11A93840l | InnsbruckAni | ? | - | |
7.1 | 11D31620l | Sochi | ? | - |
11D31620u | SochiYabuli | ? | - |
iPhone 5s
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
6.0 | 10A101 | Sundance? | ? | From @1nsane_dev on Twitter |
7.0 | 11A22051f | Innsbruck? | ? | From @DongleBookPro on Twitter |
11A24580o | InnsbruckNanshan | 1.00.05 | - | |
11A24581c | ? | - | ||
11A24581k | ? | From @1nsane_dev on Twitter | ||
11A360 | 7.02-16 | Found on an FCC test report [4] | ||
11A93840f | InnsbruckAni? | ? | Originally found on a MacRumors post | |
11.0 | 15A93720r | TigrisAni? | ? | - |
iPhone 6
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
8.0 | 12A22121a | Okemo? | ? | - |
12A310 | Okemo | 0.26.01 | Found on an FCC test report [5] | |
12A93311h | 1.00.01 | - | ||
12A93650o | OkemoAni | 1.00.05 | - | |
12A93650z | ? | From @AppleInternalsh on Twitter | ||
12A93651a | 1.00.05 | - | ||
12A93651b | 1.00.05 | - | ||
8.3 | 12F69 | Stowe? | ? | Seen on iFixit's forum [6] |
9.0 | 13A83261u | MonarchSajo | ? | From @CollectorApple on Twitter |
13A83262c | ? | From @ThermalDOE on Twitter | ||
11.3 | 15E61570m | Emet? | ? | From @mcg29_ on Twitter |
iPhone 6 Plus
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
8.0 | 12A22121a | Okemo? | ? | - |
12A23410x | Okemo? | ? | from @DongleBookPro on Twitter |
iPhone 6s
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
9.0 | 13A22120w | Monarch? | ? | - |
13A93051l | MonarchAni | 0.37.08 | - | |
13A93051r | MonarchAni? | ? | - | |
13A93420d | Monarch? | ? | - | |
13A93420i | ? | From @AppleInternalsh on Twitter | ||
13A93420m | 1.00.05 | - | ||
10.0 | 14A83432m | Whitetail? | ? | From @OkemoZurs on Twitter |
11.0 | 15A23061c | Tigris? | ? | From @mcg29_ on Twitter |
iPhone 6s Plus
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
9.0 | 13A22120w | Monarch? | ? | - |
13A23161b | MonarchNanshan | ? | - |
iPhone SE (1st generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
9.3 | 13E180 | Eagle? | 4.70.10 | Found on an FCC test report [7] |
iPhone 7
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
10.0 | 14A22580n | Whitetail? | 0.16.01-3 | Found on an FCC test report [8] |
14A22881a | ? | - | ||
14A92340t | ? | - | ||
14A93012r | WhitetailAni | ? | - | |
14A93013a | ? | - |
iPhone 7 Plus
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
10.0 | 14A22161a | WhitetailAni? | ? | - |
14A22181a | ? | - |
iPhone 8
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
11.0 | 15A93261h | TigrisAni | 00.34.09 | - |
15A93720p | ? | From @AppleInternalsh on Twitter. | ||
15A93720r | ? | - |
iPhone 8 Plus
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
11.0 | 15A93260r | Tigris | ? | From @1nsane_dev on Twitter |
15A93621f | ? | From @1nsane_dev on Twitter |
iPhone X
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
11.0 | 15A783601x | TigrisAni | ? | - |
15A783601y | ? | - |
iPhone XR
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
12.0 | 16A13580x | Peace | ? | From this eBay listing |
16A13580z | ? | From @1nsane_dev on Twitter | ||
16A13581a | ? | From @ThermalDOE on Twitter | ||
16A73281c | ? | - |
iPhone XS
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
12.0 | 16A93020u | PeaceAni | ? | - |
iPhone XS Max
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
12.0 | 16A23250u | Peace? | ? | From @1nsane_dev on Twitter. |
16A22481b | ? | From @YRH04E on Twitter |
iPhone 12 Pro
Verison | Build | Codename | Baseband | Comments |
---|---|---|---|---|
14.1 | 18A23581a | Azul? | ? | From @1nsane_dev on Twitter |
iPhone 12 Pro Max
Verison | Build | Codename | Baseband | Comments |
---|---|---|---|---|
14.0 | 18A23121e | Azul | ? | Found on an FCC test report [9] |
18A311 | ? | From @BenGeskin on Twitter |
iPads
iPad (1st generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
3.2 | 7B3341e | Wildcat | ? | - |
7B5286a | ? | Found by SonnyDickson, documented on 9to5mac | ||
5.1 | 9B3176n | HoodooYaubli | ? | Installing this firmware may permanently brick the device |
iPad (2nd generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
4.3 | 8F3178a | Durango | ? | - |
8F3191d | ? | - |
iPad (3rd generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
5.1 | 9B87 | Hoodoo? | ? | Found on an FCC test report [10] |
6.0 | 10A316 | Sundance | ? | - |
iPad (4th generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
6.0 | 10A33901a | Sundance? | ? | - |
7.0 | 11A63840h | InnsbruckTianshan | ? | Horizontal mode only. |
iPad (5th generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
10.3 | 14E61810k | Erie? | ? | From @AppleInternalsh on Twitter |
14E62210l | ? | From @AppleInternalsh on Twitter | ||
10.3.2 | 14F60900i | Franklin | ? | From @AppleInternalsh on Twitter |
14F60900l | ? | From @mcg29_ on Twitter |
iPad (6th generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
11.3 | 15E61570l | Emet | ? | Found on an FCC test report [11] |
15E61570m | ? | From @mcg29_ on Twitter |
iPad mini (1st generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
6.0 | 10A378 | Sundance? | ? | Found on an FCC test report [12] |
10A63970m | SundanceTaosTianshan | ? | - | |
10A63970v | ? | - | ||
10A63971b | ? | - |
iPad mini (2nd generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
7.0.3 | 11B64940j | InnsbruckTaos? | ? | - |
10.3 | 14E62210l | Erie? | ? | - |
11.0 | 15A93720r | TigrisAni? | ? | - |
iPad mini (3rd generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
11.3 | 15E61570m | Emet? | ? | From @mcg29_ on Twitter |
iPad mini (4th generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
8.4 | 12H33 | Donner? | ? | Found on an FCC test report [13] |
12H60160o | ? | - | ||
9.0 | 13A62950o | Monarch? | ? | - |
9.0.2 | 13A64520d | MonarchTianshan | 4.02.00 | From @AppleInternalsh on Twitter. |
iPad mini (5th generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
12.2 | 16E31120n | PeaceEYabuli? | ? | From @laobaiTD on Twitter |
16E31520i | ? | Found on an FCC test report [14] |
iPad Air (1st generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
7.0 | 11B34210y | InnsbruckTaosYabuli | ? | This is for the iPad4,2 model. |
7.0.x | 11B34640l | InnsbruckTaosYabuli? | ? | - |
7.1 | 11D31620c | Sochi? | ? | From This eBay listing that has sold |
iPad Air (2nd generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
8.1 | 12B331 | OkemoTaos? | ? | Found on an FCC test report [15] |
12B33610i | ? | From journaldulapin.com [16]. |
iPad Air (3rd generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
12.2 | 16E31120m | PeaceEYabuli | ? | - |
16E31520i | ? | Found on an FCC test report [17] |
iPad Pro (unreleased)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
9.0 | 13A165 | Monarch | 2.15.00 (debug) | This comes as a Restore Bundle, and is for J98/99AP |
iPad Pro (9.7-inch) (1st generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
9.3 | 13E31820k | Eagle? | ? | Found on an FCC test report [18] |
iPad Pro (12.9-inch) (1st generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
9.1 | 13B72 | Boulder? | ? | Found on an FCC test report [19] |
iPad Pro (12.9-inch) (2nd generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
10.3 | 14E232 | Erie? | ? | Found on an FCC test report [20] |
14E32020u | ? | Found on an FCC test report [21] |
iPad Pro (10.5-inch)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
10.3 | 14E22020w | Erie? | ? | Found on an FCC test report [22] |
iPad Pro 12.9 (5th generation)
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
14.5 | 18E20700y | AzulE? | ? | Found on a FCC test report [23] |
iPods
iPod touch (1st generation)
Version | Build | Codename | Comments |
---|---|---|---|
1.1 | 3A53 | Snowbird | Found on an FCC test report [24] |
iPod touch (3rd generation)
Version | Build | Codename | Comments |
---|---|---|---|
3.1 | 7C1023e | Inferno? | - |
7C1095a | - | ||
7C144 | Northstar? | - |
iPod touch (4th generation)
Version | Build | Codename | Comments |
---|---|---|---|
4.1 | 8B1016c | Baker | From this ebay listing by hap plain |
5.1 | 9B3145a | HoodooYabuli | - |
9B3176b | - | ||
9B3176n | - |
iPod touch (5th generation)
Version | Build | Codename | Comments |
---|---|---|---|
6.0 | 10A351 | Sundance? | Found on an FCC test report [25] |
iPod touch (6th generation)
Version | Build | Codename | Comments |
---|---|---|---|
8.3 | 12H1150f | CopperJade | From @OkemoZurs on Twitter. |
8.4 | 12H10570d | From @1nsane_dev on Twitter. | |
9.3 | 13C75 | Castlerock |