The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information.

Difference between revisions of "IMG3 File Format"

From The iPhone Wiki
Jump to: navigation, search
(moving explanation to top)
Line 1: Line 1:
−
The '''IMG3 File Format''' is the replacement for the [[S5L File Formats#IMG2|IMG2 file format]] for iOS 2.0 and onward. iOS 7.0.1 introduced the [[IM4P File Format]] and the [[IMG4 File Format]] for [[A7]] and newer devices.
 +
The '''IMG3''' file format was introduced with [[iOS|iPhone OS]] 2.0b4 to replace the broken [[S5L File Formats|IMG2 format]]. This format is used on all devices with an [[S5L8955|A6X]] or older; [[S5L8960|A7]] and newer devices use [[IM4P File Format|IM4P]] and [[IMG4 File Format|IMG4]] files.
   
 
==Encryption==
  
==Encryption==
Line 6: Line 6:
 
In the current method, iBoot will always use the first 16 bytes of the [[KBAG]] as the IV, then the remaining 16 (aes-128, used with [[S5L8900]] and [[S5L8720]]), 24 (aes-192), or 32 (aes-256, used with [[S5L8920]]) bytes for the key.
  
In the current method, iBoot will always use the first 16 bytes of the [[KBAG]] as the IV, then the remaining 16 (aes-128, used with [[S5L8900]] and [[S5L8720]]), 24 (aes-192), or 32 (aes-256, used with [[S5L8920]]) bytes for the key.
   
−
==Header==
 +
== Contents ==
  +
All numbers are stored in [[wikipedia:Endianness#Little-endian|little endian]] byte order; this includes the magic ''numbers'' (<code>magic</code> and <code>ident</code>).
−
typedef struct Img3_t {
  
  +
typedef struct img3File {
−
uint32_t magic; // ASCII_LITTLE_ENDIAN("Img3")
  
  +
uint32_t magic; // ASCII_LE("Img3")
 
uint32_t fullSize; // full size of fw image
  
uint32_t fullSize; // full size of fw image
 
uint32_t sizeNoPack; // size of fw image without header
  
uint32_t sizeNoPack; // size of fw image without header
Line 14: Line 15:
 
// size of the start of the data section (the code) up to
  
// size of the start of the data section (the code) up to
 
// the start of the RSA signature (SHSH section)
  
// the start of the RSA signature (SHSH section)
−
uint32_t iden; // identifier of image, used when bootrom is parsing images
 +
uint32_t ident; // identifier of image, used when bootrom is parsing images
 
// list to find LLB (illb), LLB parsing it to find iBoot (ibot),
  
// list to find LLB (illb), LLB parsing it to find iBoot (ibot),
−
// etc.
 +
// etc.
−
Img3Tag_t tags[]; // continues until end of file
 +
img3Tag tags[]; // continues until end of file
 
};
  
};
   
  +
typedef struct img3Tag {
−
==Tag Format==
  
  +
uint32_t magic; // [[#Tags|see below]]
−
typedef struct Img3Tag_t {
  
−
uint32_t magic; // [[#Tags|see below]]
 +
uint32_t totalLength; // length of tag including "magic" and these two length values
−
uint32_t total_length; // length of tag including "magic"
 +
uint32_t dataLength; // length of tag data
  +
uint8_t data[dataLength];
−
// and these two length values
  
  +
uint8_t pad[totalLength - dataLength - 12]; // Typically padded to 4 byte multiple
−
uint32_t data_length; // length of tag data
  
−
uint8_t data[data_length];
  
−
uint8_t pad[total_length - data_length - 12]; // padding
  
 
};
  
};
   
−
==Tags==
 +
== Tags ==
−
[[VERS]]: iBoot version of the image
 +
[[VERS]]: [[iBoot]] version of the image
 
[[SEPO]]: Security Epoch
  
[[SEPO]]: Security Epoch
 
[[SDOM]]: Security Domain
  
[[SDOM]]: Security Domain
 
[[PROD]]: Production Mode
  
[[PROD]]: Production Mode
−
[[CHIP]]: Chip to be used with. example: "0x8900" for [[S5L8900]].
 +
[[CHIP]]: Chip to be used with. example: <code>0x8900</code> for [[S5L8900]].
 
[[BORD]]: Board to be used with
  
[[BORD]]: Board to be used with
−
[[KBAG]]: contains the KEY and IV required to decrypt encrypted with the [[GID Key]]
 +
[[KBAG]]: Contains the IV and key required to decrypt; encrypted with the [[GID Key]]
 
[[SHSH]]: RSA encrypted SHA1 hash of the file
  
[[SHSH]]: RSA encrypted SHA1 hash of the file
 
[[CERT]]: Certificate
  
[[CERT]]: Certificate
−
[[ECID]]: Exclusive Chip ID unique to every device with iPhone OS.
 +
[[ECID]]: Exclusive Chip ID unique to every device
−
[[TYPE]]: Type of image, should contain the same string as 'iden' of the header
 +
[[TYPE]]: Type of image, should contain the same string as the header's <code>ident</code>
 
[[DATA]]: Real content of the file
  
[[DATA]]: Real content of the file
   

Revision as of 18:47, 18 March 2015

The IMG3 file format was introduced with iPhone OS 2.0b4 to replace the broken IMG2 format. This format is used on all devices with an A6X or older; A7 and newer devices use IM4P and IMG4 files.

Encryption

Apple got smarter this time, requiring the Hardware AES engine to be run per file. Decrypt the KBAG tag data with the GID Key to get the key and IV, and use those to decrypt the DATA section of the firmware file.

In the current method, iBoot will always use the first 16 bytes of the KBAG as the IV, then the remaining 16 (aes-128, used with S5L8900 and S5L8720), 24 (aes-192), or 32 (aes-256, used with S5L8920) bytes for the key.

Contents

All numbers are stored in little endian byte order; this includes the magic numbers (magic and ident). 

typedef struct img3File {
    uint32_t magic;       // ASCII_LE("Img3")
    uint32_t fullSize;    // full size of fw image
    uint32_t sizeNoPack;  // size of fw image without header
    uint32_t sigCheckArea;// although that is just my name for it, this is the
                          // size of the start of the data section (the code) up to
                          // the start of the RSA signature (SHSH section)
    uint32_t ident;       // identifier of image, used when bootrom is parsing images
                          // list to find LLB (illb), LLB parsing it to find iBoot (ibot),
                          // etc. 
    img3Tag  tags[];      // continues until end of file
};

typedef struct img3Tag {
    uint32_t magic;            // see below
    uint32_t totalLength;      // length of tag including "magic" and these two length values
    uint32_t dataLength;       // length of tag data
    uint8_t  data[dataLength];
    uint8_t  pad[totalLength - dataLength - 12]; // Typically padded to 4 byte multiple
};

Tags

VERS: iBoot version of the image
SEPO: Security Epoch
SDOM: Security Domain
PROD: Production Mode
CHIP: Chip to be used with. example: 0x8900 for S5L8900.
BORD: Board to be used with
KBAG: Contains the IV and key required to decrypt; encrypted with the GID Key
SHSH: RSA encrypted SHA1 hash of the file
CERT: Certificate
ECID: Exclusive Chip ID unique to every device
TYPE: Type of image, should contain the same string as the header's ident
DATA: Real content of the file

Signature Check

Decryption is done using the modulus at cert + 0xA15
0xC to SHSH is SHAed
Retrieved from "https://www.theiphonewiki.com/w/index.php?title=IMG3_File_Format&oldid=45090"