|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "IMG3 File Format"
ChronicDev (talk | contribs) (→Encryption) |
ChronicDev (talk | contribs) (→Header) |
||
| Line 3: | Line 3: | ||
==Header== |
==Header== |
||
struct Img3 { |
struct Img3 { |
||
| − | unsigned int magic; |
+ | unsigned int magic; // fourcc="IMG3" |
| − | unsigned int |
+ | unsigned int fullSize; // full size of fw image |
| − | unsigned int |
+ | unsigned int sizeNoPack; // size of fw image without header |
| + | unsigned int sigCheckArea; // although that is just my name for it, this is the |
||
| − | unsigned int certOffset; |
||
| + | // size of the start of the data section (the code) up to |
||
| − | unsigned int name; |
||
| + | // the start of the RSA signature (SHSH section) |
||
| − | unsigned int type; |
||
| + | unsigned int iden; // identifier of image, used when bootrom is parsing images |
||
| − | unsigned int nameOffset; |
||
| + | // list to find LLB (illb), LLB parsing it to find iBoot (ibot), |
||
| − | unsigned int dataLen; |
||
| + | // etc. |
||
| + | |||
} typedef Img3; |
} typedef Img3; |
||
Revision as of 02:44, 6 February 2009
This is the replacement for the IMG2 File Format in 2.0 firmware.
Contents
Header
struct Img3 {
unsigned int magic; // fourcc="IMG3"
unsigned int fullSize; // full size of fw image
unsigned int sizeNoPack; // size of fw image without header
unsigned int sigCheckArea; // although that is just my name for it, this is the
// size of the start of the data section (the code) up to
// the start of the RSA signature (SHSH section)
unsigned int iden; // identifier of image, used when bootrom is parsing images
// list to find LLB (illb), LLB parsing it to find iBoot (ibot),
// etc.
} typedef Img3;
Tag Format
unsigned int magic; unsigned int total_length; //data_length+0xC unsigned int data_length;
Tags
VERS: Version SEPO: Unknown PROD: Processor to be used with. CHIP: Chip to be used with. "0x8900" for S5L8900 and "0x8720" for S5L8720. Instead of there being a check against some piece of hardware, whatever is verifying this (bootrom / iBoot / LLB / etc.) has this hardcoded in. BORD: Board to be used with KBAG: contains the KEY and IV required to decrypt encrypted with the GID-key SHSH: RSA encrypted SHA1 hash of the file CERT: Certificate
Encryption
Apple got smarter this time, requiring the Hardware AES engine to be run per file. Decrypt the KBAG tag data (0x20 byte?) with the hardware AES engine and get the 0x10 byte IV and the 0x10 byte KEY.
iBoot has support for aes-192 and aes-256 also. In the current method, iBoot will always use the first 16 bytes as the IV, then the remaining 16 (aes-128, current method), 24 (aes-192), or 32 (aes-256) bytes for the key.
