The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information.

Difference between revisions of "IPSW File Format"

From The iPhone Wiki
Jump to: navigation, search
(→‎Firmware Folder)
(Clarify Yonkers)
 
(26 intermediate revisions by 11 users not shown)
Line 1: Line 1:
  +
{{redirect|IPSW|the component of XPwn|ipsw}}
−
'''IPSW''' ('''iP'''od¹ '''S'''oft'''W'''are) Files have the Magic Number 504B0304 (PK\003\004) and thus are [http://en.wikipedia.org/wiki/ZIP_%28file_format%29 ZIP] Archives. They can be modified with typical zip/unzip tools (i.e. change extension to .zip and double click). An IPSW File is used to deliver the iPod Touch / iPhone [[firmware]] to the end-user.
  
  +
{{see also|Disk Image Formats}}
  +
'''IPSW''' ('''iP'''od<sup>[[#Notes|[1]<nowiki/>]]</sup> '''S'''oft'''w'''are) files have the Magic Number 504B0304 (PK\003\004) and thus are [[wikipedia:ZIP (file format)|ZIP]] archives. They can be modified with typical zip/unzip tools (i.e. change extension to .zip and double click). IPSWs are used to deliver the [[iDevice|device's]] firmware to the end-user.
   
  +
== Archive Structure ==
−
¹The IPSW files are used starting from the iPod 1G, even though they have [http://www.freemyipod.org/wiki/Firmware a different format than] iOS-based devices.
  
  +
* [[Restore Ramdisk]]
−
== IPSW Contents ==
  
  +
* [[Update Ramdisk]] (some firmwares don't have one due to various reasons)
  +
* [[:/|Filesystem]] (the largest [[Apple Disk Image|.dmg]] file)
  +
* [[Device Tree]] (model specific)
  +
* [[Kernelcache]] (model specific; processor specific on pre-[[S5L8930|A4]])
  +
* BuildManifest.plist (first appeared in [[iOS|iPhone OS]] 3.0 beta 2)
  +
* Restore.plist
  +
* ''Firmware/''
  +
** ''all_flash/''
  +
*** ''all_flash.XXXXX.production/'' (model specific i.e. [[M68AP]], [[N82AP]], etc.)
  +
**** [[S5L File Formats#IMG2|IMG2]]/[[IMG3 File Format|IMG3]] files
  +
**** manifest
  +
** dfu/''
  +
*** [[iBEC]].XXXXX.dfu (model specific i.e. [[M68AP]], [[N82AP]], etc.)
  +
*** [[iBSS]].XXXXX.dfu
  +
*** [[WTF]].XXXXX.dfu (model specific and only for [[M68AP]], [[N82AP]], [[N45AP]], [[N72AP]]; not present in firmwares for the [[N88AP|iPhone 3GS]] and later, because it was used to patch issues with the DFU mode that was burned into the bootrom)
  +
** [[Baseband Device|Baseband]] (may be one or many files depending on the model)
   
−
=== root folder ===
 +
=== Example ===
  +
Here are the contents of the [[Kirkwood 7A341 (iPhone2,1)|iPhone 3GS 3.0 (7A341)]] firmware IPSW:
−
*[[Restore Ramdisk]]
  
  +
* <code>[[:/|018-5302-002.dmg]]</code> (281214976 bytes)
−
*[[Update Ramdisk]] (Firmware 1.0 didn't contain an Update Ramdisk as there is no official firmware to update from)
  
  +
* <code>[[Update Ramdisk|018-5304-002.dmg]]</code> (12769604 bytes)
−
*[[Disk Image Formats|Filesystem Ramdisk]] (the largest .dmg file)
  
  +
* <code>[[Restore Ramdisk|018-5306-002.dmg]]</code> (12777796 bytes)
−
*[[Kernelcache|kernelcache.release.XXXXXXX file]] (application processor specific i.e [[S5L8900]], [[S5L8920]], [[S5L8720]], [[S5L8922]], [[S5L8930]])
  
  +
* <code>[[kernelcache]].release.s5l8920x</code> (4695492 bytes)
−
*Restore.plist file
  
−
*BuildManifest.plist (first appeared in firmware 3.0, I guess)
 +
* <code><!--[[#BuildManifest.plist|-->BuildManifest.plist<!--]]--></code> (21097 bytes)
  +
* <code><!--[[#Restore.plist|-->Restore.plist<!--]]--></code> (1763 bytes)
  +
* ''<code>Firmware/</code>''
  +
** ''<code>all_flash/</code>''
  +
*** ''<code>all_flash.n88ap.production/</code>''
  +
**** <code>[[AppleLogo|applelogo]].s5l8920x.img3</code> (9604 bytes)
  +
**** <code>[[BatteryCharging0|batterycharging0]].s5l8920x.img3</code> (19716 bytes)
  +
**** <code>[[BatteryCharging1|batterycharging1]].s5l8920x.img3</code> (24900 bytes)
  +
**** <code>[[BatteryFull|batteryfull]].s5l8920x.img3</code> (76100 bytes)
  +
**** <code>[[BatteryLow0|batterylow0]].s5l8920x.img3</code> (56772 bytes)
  +
**** <code>[[BatteryLow1|batterylow1]].s5l8920x.img3</code> (65348 bytes)
  +
**** <code>[[DeviceTree]].n88ap.img3</code> (44996 bytes)
  +
**** <code>[[GlyphCharging|glyphcharging]].s5l8920x.img3</code> (20356 bytes)
  +
**** <code>[[GlyphPlugin|glyphplugin]].s5l8920x.img3</code> (19332 bytes)
  +
**** <code>[[iBoot (Bootloader)|iBoot]].n88ap.RELEASE.img3</code> (178500 bytes)
  +
**** <code>[[LLB]].n88ap.RELEASE.img3</code> (67908 bytes)
  +
**** <code>manifest</code> (341 bytes)
  +
**** <code>[[NeedService|needservice]].s5l8920x.img3</code> (20484 bytes)
  +
**** <code>[[RecoveryMode|recoverymode]].s5l8920x.img3</code> (47876 bytes)
  +
** ''<code>dfu/</code>''
  +
*** <code>[[iBEC]].n88ap.RELEASE.dfu</code> (104772 bytes)
  +
*** <code>[[iBSS]].n88ap.RELEASE.dfu</code> (104772 bytes)
   
  +
== Firmwares found in IPSW ==
−
*\Firmware (Folder)
  
  +
Per http://newosxbook.com/bonus/vol1AppA.html
  +
{| class="wikitable"
  +
|-
  +
! Filename
  +
! Use
  +
|-
  +
| ICE17-1.xx.xx.Release.bbfw
  +
| Intel modem / baseband
  +
|-
  +
| Mav17-1.xx.xx.Release.bbfw
  +
| Maverick modem / baseband
  +
|-
  +
| AOP/aopfw-iphone##aop.im4p
  +
| Always on processor
  +
|-
  +
| Savage/Savage.B[0/2]-[Dev/Prod].[vt.]fw
  +
| FaceID
  +
|-
  +
| Yonkers/Yonkers.EA01_F###_[Dev/Prod]fw
  +
| FaceID (A12+)
  +
|-
  +
| SE/Stockholm##.RELEASE.sefw
  +
| Secure Element
  +
|-
  +
| Maggie/AppleMaggieFirmwareImage.im4p
  +
| ?
  +
|-
  +
| cpu_Multitouch.im4p
  +
| Multitouch controller
  +
|-
  +
| isp/adc-petra-d3x.im4p
  +
| Image Signal Processor
  +
|-
  +
| ane/h11_ane_fw_quin.im4p
  +
| [[Apple Neural Engine]]
  +
|-
  +
| WirelessPower/WirelessPower.iphone##.im4p
  +
| Wireless charging controller
  +
|-
  +
| SmartIOFirmwareCHIP.im4p
  +
| [[T8020]] and later Smart I/O
  +
|-
  +
| board_CallanFirmware.im4p
  +
| Haptics Firmware
  +
|-
  +
| ave/AppleAVE2FW.im4p
  +
| Audio/Video Encoder
  +
|-
  +
| agx/armfw_g11p.im4p
  +
| GPU Scheduler/Command Stream Processor
  +
|-
  +
| all_flash/sep-firmware.*.im4p
  +
| Secure Enclave Processor
  +
|-
  +
| liquiddetect@2436~iphone-lightning.im4p
  +
| Liquid Damage Detection
  +
|-
  +
| pmp/t8030pmp.im4p
  +
| Power Management Processor
  +
|-
  +
| Rose/r1p0/ftab.bin
  +
| U1 chip (Ultra Wideband)
  +
|-
  +
| vinyl_05.vnlfw
  +
| eSIM
  +
|-
  +
| Veridian
  +
| ? (Some form of signing/device integrity)
  +
|}
   
−
=== Firmware Folder ===
 +
== Notes ==
  +
# IPSW files have been used since the very first iPod, though they have [http://www.freemyipod.org/wiki/Firmware a different format] than firmwares for iOS devices.
−
*\all_flash\all_flash.XXXXX.production (Folder - hardware specific i.e. [[M68ap]], [[N82ap]], [[N88ap]], [[N45ap]], [[N72ap]], [[N18ap]], [[K48ap]])
  
−
*\dfu (Folder)
  
−
*ICE3_XX.XX.XX_BOOT_02.06.Release.bbfw (Contains the baseband and the bootloader. X stands for a number. This is the baseband version. 02.06 is the bootloader. Only in the iPhone 4 firmware.)
  
   
  +
[[Category:File Formats]]
−
=== all_flash.XXXXX.production Folder ===
  
−
*[[S5L File Formats#IMG2|IMG2]]/[[IMG3 File Format|IMG3]] files
  
−
*manifest
  
−  
−
=== dfu Folder ===
  
−
*[[iBEC]].XXXXX.DFU (hardware specific i.e. [[M68ap]], [[N82ap]], [[N88ap]], [[N45ap]], [[N72ap]], [[N18ap]], [[K48ap]])
  
−
*[[iBSS]].XXXXX.DFU (hardware specific i.e. [[M68ap]], [[N82ap]], [[N88ap]], [[N45ap]], [[N72ap]], [[N18ap]], [[K48ap]])
  
−
*[[WTF]].XXXXX.DFU (hardware specific i.e. [[M68ap]], [[N82ap]], [[N45ap]], [[N72ap]] - currently not present in firmwares for the [[N88ap|iPhone 3GS]] and later, because it is mostly used to patch issues with the DFU mode that was burned into the bootrom)
  
−  
−
== Example ==
  
−
This is a ls -alR of an extracted iPhone 3GS 3.0 Firmware IPSW.
  
−  
−
<pre>total 608400
  
−
drwx------@ 11 m staff 374 17 Jun 07:11 .
  
−
drwxrwxrwx 5 m staff 170 18 Jul 07:34 ..
  
−
-rw-r--r--@ 1 m admin 281214976 22 Mai 17:10 018-5302-002.dmg
  
−
-rw-r--r--@ 1 m admin 12769604 22 Mai 16:59 018-5304-002.dmg
  
−
-rw-r--r--@ 1 m admin 12777796 22 Mai 16:59 018-5306-002.dmg
  
−
-rw-r--r-- 1 m admin 21097 22 Mai 17:29 BuildManifest.plist
  
−
drwxr-xr-x@ 5 m staff 170 17 Jun 07:11 Firmware
  
−
-rw-r--r-- 1 m admin 1763 22 Mai 17:10 Restore.plist
  
−
-rw-r--r--@ 1 m staff 4695492 22 Mai 14:32 kernelcache.release.s5l8920x
  
−  
−
./Firmware:
  
−
total 16
  
−
drwxr-xr-x@ 5 m staff 170 17 Jun 07:11 .
  
−
drwx------@ 11 m staff 374 17 Jun 07:11 ..
  
−
drwxr-xr-x@ 4 m staff 136 18 Jun 02:10 all_flash
  
−
drwxr-xr-x@ 4 m staff 136 22 Mai 13:39 dfu
  
−  
−
./Firmware/all_flash:
  
−
total 16
  
−
drwxr-xr-x@ 4 m staff 136 18 Jun 02:10 .
  
−
drwxr-xr-x@ 5 m staff 170 17 Jun 07:11 ..
  
−
drwxr-xr-x@ 16 m staff 544 22 Mai 13:43 all_flash.n88ap.production
  
−  
−
./Firmware/all_flash/all_flash.n88ap.production:
  
−
total 1320
  
−
drwxr-xr-x@ 16 m staff 544 22 Mai 13:43 .
  
−
drwxr-xr-x@ 4 m staff 136 18 Jun 02:10 ..
  
−
-rw-r--r--@ 1 m staff 44996 22 Mai 13:08 DeviceTree.n88ap.img3
  
−
-rw-r--r--@ 1 m staff 67908 22 Mai 13:12 LLB.n88ap.RELEASE.img3
  
−
-rw-r--r--@ 1 m staff 9604 22 Mai 13:15 applelogo.s5l8920x.img3
  
−
-rw-r--r--@ 1 m staff 19716 22 Mai 13:15 batterycharging0.s5l8920x.img3
  
−
-rw-r--r--@ 1 m staff 24900 22 Mai 13:16 batterycharging1.s5l8920x.img3
  
−
-rw-r--r--@ 1 m staff 76100 22 Mai 13:16 batteryfull.s5l8920x.img3
  
−
-rw-r--r--@ 1 m staff 56772 22 Mai 13:16 batterylow0.s5l8920x.img3
  
−
-rw-r--r--@ 1 m staff 65348 22 Mai 13:17 batterylow1.s5l8920x.img3
  
−
-rw-r--r--@ 1 m staff 20356 22 Mai 13:17 glyphcharging.s5l8920x.img3
  
−
-rw-r--r--@ 1 m staff 19332 22 Mai 13:18 glyphplugin.s5l8920x.img3
  
−
-rw-r--r--@ 1 m staff 178500 22 Mai 13:21 iBoot.n88ap.RELEASE.img3
  
−
-rw-r--r--@ 1 m staff 341 22 Mai 13:43 manifest
  
−
-rw-r--r--@ 1 m staff 20484 22 Mai 13:24 needservice.s5l8920x.img3
  
−
-rw-r--r--@ 1 m staff 47876 22 Mai 13:24 recoverymode.s5l8920x.img3
  
−  
−
./Firmware/dfu:
  
−
total 416
  
−
drwxr-xr-x@ 4 m staff 136 22 Mai 13:39 .
  
−
drwxr-xr-x@ 5 m staff 170 17 Jun 07:11 ..
  
−
-rw-r--r--@ 1 m staff 104772 22 Mai 13:30 iBEC.n88ap.RELEASE.dfu
  
−
-rw-r--r--@ 1 m staff 104772 22 Mai 13:36 iBSS.n88ap.RELEASE.dfu
  
−
</pre>
  

Latest revision as of 00:44, 21 March 2022

"IPSW" redirects here. For the component of XPwn, see ipsw.

See also: Disk Image Formats

IPSW (iPod[1] Software) files have the Magic Number 504B0304 (PK\003\004) and thus are ZIP archives. They can be modified with typical zip/unzip tools (i.e. change extension to .zip and double click). IPSWs are used to deliver the device's firmware to the end-user.

Archive Structure

Example

Here are the contents of the iPhone 3GS 3.0 (7A341) firmware IPSW:

Firmwares found in IPSW

Per http://newosxbook.com/bonus/vol1AppA.html

Filename Use
ICE17-1.xx.xx.Release.bbfw Intel modem / baseband
Mav17-1.xx.xx.Release.bbfw Maverick modem / baseband
AOP/aopfw-iphone##aop.im4p Always on processor
Savage/Savage.B[0/2]-[Dev/Prod].[vt.]fw FaceID
Yonkers/Yonkers.EA01_F###_[Dev/Prod]fw FaceID (A12+)
SE/Stockholm##.RELEASE.sefw Secure Element
Maggie/AppleMaggieFirmwareImage.im4p ?
cpu_Multitouch.im4p Multitouch controller
isp/adc-petra-d3x.im4p Image Signal Processor
ane/h11_ane_fw_quin.im4p Apple Neural Engine
WirelessPower/WirelessPower.iphone##.im4p Wireless charging controller
SmartIOFirmwareCHIP.im4p T8020 and later Smart I/O
board_CallanFirmware.im4p Haptics Firmware
ave/AppleAVE2FW.im4p Audio/Video Encoder
agx/armfw_g11p.im4p GPU Scheduler/Command Stream Processor
all_flash/sep-firmware.*.im4p Secure Enclave Processor
liquiddetect@2436~iphone-lightning.im4p Liquid Damage Detection
pmp/t8030pmp.im4p Power Management Processor
Rose/r1p0/ftab.bin U1 chip (Ultra Wideband)
vinyl_05.vnlfw eSIM
Veridian ? (Some form of signing/device integrity)

Notes

  1. IPSW files have been used since the very first iPod, though they have a different format than firmwares for iOS devices.
Retrieved from "https://www.theiphonewiki.com/w/index.php?title=IPSW_File_Format&oldid=121860"