Bootrom

Introduction / old+new

The bootrom (called "SecureROM" by Apple) is the first significant code that runs on an iDevice. The bootrom is unwritable. Finding exploits in the bootrom level is a big achievement since Apple won't be able to fix it without a hardware revision.

Often users refer to old bootrom or new bootrom devices. The new bootrom devices were released after 9 September 2009 and have the 0x24000 Segment Overflow fixed. Therefore these newer versions of the iPod touch 2G and iPhone 3GS are not vulnerable to this exploit and had only a tethered jailbreak/unlock until Spirit came out. Currently, these devices can be jailbroken on iOS 4.0 with Star.

Please see also Apple's stage 2 bootloader, which also uses the "iBoot" name.

Check bootrom version

To find out if you have an old or new bootrom, the easiest way is to look at the serial number. If the 4th and 5th digits are lower than 40, then you probably have an old bootrom. If they are higher than 45, then you probably have a new bootrom. These two digits show the production week. For refurbished phones and for numbers inbetween, the result is undefined and you have to make the following exact check.

To check your device's bootrom version, you must put your device into DFU mode. Make sure it is not in Recovery Mode, as Recovery Mode does not mention the bootrom version. If you have Mac OS X, go to System Profiler, and under the "Hardware" category, go to USB, and click on "Apple Mobile Device (DFU Mode)." If you have Windows, go to Device Manager, find USB controller, subitem Apple Mobile Device USB Driver. In Properties, Details, select Device Instance Path in the dropdown. The end of the info string will show the bootrom version.

Revisions

S5L8720, used in the iPod touch 2G

• iBoot-240.4 "old bootrom"
• iBoot-240.5.1 "new bootrom"

S5L8920, used in the iPhone 3GS

• iBoot-359.3 "old bootrom"
• iBoot-359.3.2 "new bootrom"

S5L8922, used in the iPod touch 3G

• iBoot-359.5

S5L8930, used in the iPad and in the iPhone 4

• iBoot-574.4