The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information.

Difference between revisions of "Firmware Keys"

From The iPhone Wiki
Jump to: navigation, search
(Removed VFDecrypt program info, minor fix-ups, and drastic table alterations.)
(→‎Firmware Versions: 16.x placeholder)
 
(682 intermediate revisions by 30 users not shown)
Line 1: Line 1:
  +
__NOTOC__
−
== Gaps ==
  
  +
'''Firmware Keys''' are keys which decrypt bootloaders, ramdisks, and [[:/|root filesystem]] of iOS [[firmware]], if those components are encrypted. Apple uses encryption to make it harder to analyze and modify them. Over time Apple changed the way they encrypt firmware files, hence the way to decrypt them and get decryption keys changed as well.
−
As you will notice, there may be a gap or two, or a key for a current build that is not there. Please feel free to add them, but please be sure that it is only the key for a User or Developer build, as if you gave the key for another type of build that might or may not be out there '''people could get in trouble, and we do not want that'''. Thanks for contributing!
  
   
−
== Notes ==
 +
== History ==
  +
With the release of the iPhone came the [[S5L File Formats#IMG2|IMG2]] file format. They were used on all known [[iOS|iPhone OS]] [[#1.x|1.x]] firmwares. For the 1.1.x series, they were encrypted with the [[AES Keys#Key 0x837|0x837 key]]. The discovery of the 0x837 key led to the ability to decrypt ''any'' 1.x firmware.
−
The root filesystem is by far the largest (300+ MB in the case of iOS 4), for which there is one key per device model, with no IV. Use [[VFDecrypt]] to decrypt this. You can mount/this once it has been decrypted using your program of choice. (For example, 7-zip on Windows.)
  
   
  +
Following IMG2 came the [[IMG3 File Format|IMG3]] file format. They were introduced with iPhone OS [[#1.x.2F2.x|2.0 beta 4]], and have been in use ever since. In order to maintain their integrity, they use multiple layers of encryption. Apple took encryption seriously with IMG3 by utilizing [[wikipedia:Advanced Encryption Standard|AES]] (based on the [[wikipedia:Rijndael key schedule|Rinjndael key schedule]]). In terms of the pre-iPhone OS 3 [[VFDecrypt]] key, it is stored as plain-text in the "__restore" segment of the ASR image within the [[ramdisk]]s.
−
The Update and Restore ramdisks share the same IV and key per type of Application Processor (current choices are [[S5L8900]] in the [[N82ap|iPhone 3G]], [[S5L8720]] in the [[N72ap|iPod touch 2G]], [[S5L8920]] in the [[N88ap|iPhone 3GS]], and [[S5L8922]] in the [[N18ap|iPod touch 3G]]). Use [http://code.google.com/p/img3decrypt/ img3decrypt] or [http://github.com/planetbeing/xpwn/tree/master xpwntool] to decrypt these. Likewise, once this is decrypted, you can mount this as well, using the tool of your choice.
  
  +
  +
The ramdisk keys can ''only'' be retrieved with the processor specific [[GID Key]]. The GID key is currently unretrievable and can only be utilized through the built-in [[AES Keys|AES engine]]. To complicate things ''even more'', the engine is only accessible through a special [[bootrom]] or [[iBoot]] exploit ([[jailbreak]]s typically expose it with [[/dev/aes_0]]). This makes usage of the key nearly impossible.
  +
  +
However, once you have access to the AES engine, the entire system falls apart. You are able to upload an encrypted ramdisk and grab the decryption keys for it. Once you manage to decrypt the ramdisk, you can run it through [[GenPass]] to decrypt the firmware key.
  +
  +
To find the keys, you can either use the methods on [[AES Keys]] or the easier option for OS X, [[keylimepie]].
  +
  +
== Decrypting ==
  +
{{main|Decrypting Firmwares}}
  +
== Notes ==
  +
Certain files share the same key and IV per [[Application Processor|application processor]] (per build) provided the devices have the same pixel resolution:
  +
* [[Update Ramdisk]]
  +
* [[Restore Ramdisk]]
  +
* [[AppleLogo]]
  +
* [[BatteryCharging0]]
  +
* [[BatteryCharging1]]
  +
* [[BatteryFull]]
  +
* [[BatteryLow0]]
  +
* [[BatteryLow1]]
  +
* [[GlyphCharging]]
  +
* [[GlyphPlugin]]
  +
* [[Kernelcache]]
  +
* [[NeedService]]
  +
* [[RecoveryMode]]
  +
* [[SEP Firmware]]
  +
* [[WTF]]
   
  +
You can use [[img3decrypt]] or [[xpwntool]] to decrypt these files as described in [[Decrypting Firmwares]]. Once done, mount or extract using the tool of your choice.
−
You may find [[Ramdisk Decryption]] to be helpful.
  
   
  +
The firmware version number for the [[List of Apple TVs|Apple TV]] builds are the ones that the Apple TV reports (also known as the "marketing version").
−
For those wanting to decrypt their own keys, you must use [[GenPass]] to get the keys for 4.x.
  
   
  +
All dates are relative to [[wikipedia:Coordinated Universal Time|UTC]].
−
==Firmware versions==
  
−
===Table of Links to Keys===
  
−
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
  
−
|-
  
−
|
  
−
! 1.x
  
−
! 2.x
  
−
! 3.x
  
−
! 4.x
  
−
|-
  
−
! Beta
  
−
|
 
−
| rowspan="2"| [[VFDecrypt Keys: 2.x|Keys]]
  
−
|[[VFDecrypt Keys: 3.x BETA|Keys]]
  
−
|[[VFDecrypt Keys: 4.x BETA|Keys]]
  
−
|-
  
−
|-
  
−
! Final
  
−
|[[VFDecrypt Keys: 1.x|Keys]]
  
−
|[[VFDecrypt Keys: 3.x|Keys]]
  
−
|
  
−
|}
  
   
  +
GID AES is used by iBoot to decrypt firmware images. When iBoot loads the kernelcache, GID AES is disabled. This means in order to get firmware keys, you must gain code execution in a setting where GID AES is still enabled. In most cases, this means exploiting iBoot itself, before the kernelcache is loaded.
−
===Final===
  
−
'''Main Article: ''[[Firmware]]'''''
  
   
  +
==Firmware Versions==
−
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
  
  +
{{see also|Prototypes}}
−
|-
  
  +
This is a full and comprehensive list of all firmwares Apple Inc. has made available to the public in some way, be it the [[Apple Developer|dev center]] or [[iTunes]]. This list also contains a few firmwares for which there never was an IPSW (as far as can be told) such as 4.2.5 for the [[N92AP|CDMA iPhone 4]] (iPhone3,3). These few builds came preinstalled on the device, but are not available for download.
−
|
  
−
! [[M68ap|iPhone]]
  
−
! [[N82ap|iPhone 3G]]
  
−
! [[N88ap|iPhone 3GS]]
  
−
! [[N90ap|iPhone 4]]
  
−
! [[N45ap|iPod touch]]
  
−
! [[N72ap|iPod touch 2G]]
  
−
! [[N18ap|iPod touch 3G]]
  
−
! [[N81ap|iPod touch 4G]]
  
−
! [[K48ap|iPad]]
  
−
! [[K66ap|Apple TV 2G]]
  
−
|-
  
−
! style="text-align:left;" | 1.0
  
−
| [[Alpine 1A420 (iPhone)|1A420]]
  
−
| rowspan="10" | Unavailable
  
−
| rowspan="17" | Unavailable
  
−
| rowspan="26" | Unavailable
  
−
| rowspan="4" | Unavailable
  
−
| rowspan="14" | Unavailable
  
−
| rowspan="20" | Unavailable
  
−
| rowspan="29" | Unavailable
  
−
| rowspan="23" | Unavailable
  
−
| rowspan="29" | Unavailable
  
−
|-
  
−
! style="text-align:left;" | 1.0.0
  
−
| [[Heavenly 1A543a (iPhone)|1A543a]]
  
−
|-
  
−
! style="text-align:left;" | 1.0.1
  
−
| [[Heavenly 1C25 (iPhone)|1C25]]
  
−
|-
  
−
! style="text-align:left;" | 1.0.2
  
−
| [[Heavenly 1C28 (iPhone)|1C28]]
  
−
|-
  
−
! style="text-align:left;" | 1.1
  
−
| Unavailable
  
−
| [[Snowbird 3A100a (iPod touch)|3A100a]]+[[Snowbird 3A101a (iPod touch)|3A101a]]
  
−
|-
  
−
! style="text-align:left;" | 1.1.1
  
−
| [[Snowbird 3A109a (iPhone)|3A110a]]
  
−
| [[Snowbird 3A110a (iPod touch)|3A110a]]
  
−
|-
  
−
! style="text-align:left;" | 1.1.2
  
−
| [[Oktoberfest 3B48b (iPhone)|3B48b]]
  
−
| [[Oktoberfest 3B48b (iPod touch)|3B48b]]
  
−
|-
  
−
! style="text-align:left;" | 1.1.3
  
−
| [[Little Bear 4A93 (iPhone)|4A93]]
  
−
| [[Little Bear 4A93 (iPod touch)|4A93]]
  
−
|-
  
−
! style="text-align:left;" | 1.1.4
  
−
| [[Little Bear 4A102 (iPhone)|4A102]]
  
−
| [[Little Bear 4A102 (iPod touch)|4A102]]
  
−
|-
  
−
! style="text-align:left;" | 1.1.5
  
−
| Unavailable
  
−
| [[Little Bear 4B1 (iPod touch)|4B1]]
  
−
|-
  
−
! style="text-align:left;" | 2.0
  
−
| [[Big Bear 5A347 (iPhone)|5A347]]
  
−
| [[Big Bear 5A345 (iPhone 3G)|5A345]]+[[Big Bear 5A347 (iPhone 3G)|5A347]]
  
−
| [[Big Bear 5A347 (iPod touch)|5A347]]
  
−
|-
  
−
! style="text-align:left;" | 2.0.1
  
−
| [[Big Bear 5B108 (iPhone)|5B108]]
  
−
| [[Big Bear 5B108 (iPhone 3G)|5B108]]
  
−
| [[Big Bear 5B108 (iPod touch)|5B108]]
  
−
|-
  
−
! style="text-align:left;" | 2.0.2
  
−
| [[Big Bear 5C1 (iPhone)|5C1]]
  
−
| [[Big Bear 5C1 (iPhone 3G)|5C1]]
  
−
| [[Big Bear 5C1 (iPod touch)|5C1]]
  
−
|-
  
−
! style="text-align:left;" | 2.1
  
−
| [[Sugar Bowl 5F136 (iPhone)|5F136]]
  
−
| [[Sugar Bowl 5F136 (iPhone 3G)|5F136]]
  
−
| [[Sugar Bowl 5F137 (iPod touch)|5F137]]
  
−
|-
  
−
! style="text-align:left;" | 2.1.1
  
−
| colspan="2" | Unavailable
  
−
| Unavailable
  
−
| [[Sugar Bowl 5F138 (iPod touch 2G)|5F138]]
  
−
|-
  
−
! style="text-align:left;" | 2.2
  
−
| [[Timberline 5G77 (iPhone)|5G77]]
  
−
| [[Timberline 5G77 (iPhone 3G)|5G77]]
  
−
| [[Timberline 5G77 (iPod touch)|5G77]]
  
−
| [[Timberline 5G77a (iPod touch 2G)|5G77a]]
  
−
|-
  
−
! style="text-align:left;" | 2.2.1
  
−
| [[SUTimberline 5H11 (iPhone)|5H11]]
  
−
| [[SUTimberline 5H11 (iPhone 3G)|5H11]]
  
−
| [[SUTimberline 5H11 (iPod touch)|5H11]]
  
−
| [[SUTimberline 5H11a (iPod touch 2G)|5H11a]]
  
−
|-
  
−
! style="text-align:left;" | 3.0
  
−
| [[Kirkwood 7A341 (iPhone)|7A341]]
  
−
| [[Kirkwood 7A341 (iPhone 3G)|7A341]]
  
−
| [[Kirkwood 7A341 (iPhone 3GS)|7A341]]
  
−
| [[Kirkwood 7A341 (iPod touch)|7A341]]
  
−
| [[Kirkwood 7A341 (iPod touch 2G)|7A341]]
  
−
|-
  
−
! style="text-align:left;" | 3.0.1
  
−
| [[Kirkwood 7A400 (iPhone)|7A400]]
  
−
| [[Kirkwood 7A400 (iPhone 3G)|7A400]]
  
−
| [[Kirkwood 7A400 (iPhone 3GS)|7A400]]
  
−
| colspan="2" rowspan="2"| Unavailable
  
−
|-
  
−
! style="text-align:left;" | 3.1
  
−
| [[Northstar 7C144 (iPhone)|7C144]]
  
−
| [[Northstar 7C144 (iPhone 3G)|7C144]]
  
−
| [[Northstar 7C144 (iPhone 3GS)|7C144]]
  
−
|-
  
−
! style="text-align:left;" | 3.1.1
  
−
| colspan="3" | Unavailable
  
−
| [[Northstar 7C145 (iPod touch)|7C145]]
  
−
| [[Northstar 7C145 (iPod touch 2G)|7C145]]
  
−
| [[Northstar 7C145 (iPod touch 3G)|7C145]]+[[Northstar 7C146 (iPod touch 3G)|7C146]]
  
−
|-
  
−
! style="text-align:left;" | 3.1.2
  
−
| [[Northstar 7D11 (iPhone)|7D11]]
  
−
| [[Northstar 7D11 (iPhone 3G)|7D11]]
  
−
| [[Northstar 7D11 (iPhone 3GS)|7D11]]
  
−
| [[Northstar 7D11 (iPod touch)|7D11]]
  
−
| [[Northstar 7D11 (iPod touch 2G)|7D11]]
  
−
| [[Northstar 7D11 (iPod touch 3G)|7D11]]
  
−
|-
  
−
! style="text-align:left;" | 3.1.3
  
−
| [[SUNorthstarTwo 7E18 (iPhone)|7E18]]
  
−
| [[SUNorthstarTwo 7E18 (iPhone 3G)|7E18]]
  
−
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|7E18]]
  
−
| [[SUNorthstarTwo 7E18 (iPod touch)|7E18]]
  
−
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|7E18]]
  
−
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|7E18]]
  
−
|-
  
−
! style="text-align:left;" | 3.2
  
−
| rowspan="7" | Unavailable
  
−
| colspan="2" rowspan="3" | Unavailable
  
−
| rowspan="7" | Unavailable
  
−
| colspan="2" rowspan="3" | Unavailable
  
−
| [[Wildcat 7B367 (iPad)|7B367]]
  
−
|-
  
−
! style="text-align:left;" | 3.2.1
  
−
| [[Wildcat 7B405 (iPad)|7B405]]
  
−
|-
  
−
! style="text-align:left;" | 3.2.2
  
−
| [[Wildcat 7B500 (iPad)|7B500]]
  
−
|-
  
−
! style="text-align:left;" | 4.0
  
−
| [[Apex 8A293 (iPhone 3G)|8A293]]
  
−
| [[Apex 8A293 (iPhone 3GS)|8A293]]
  
−
| [[Apex 8A293 (iPhone 4)|8A293]]
  
−
| [[Apex 8A293 (iPod touch 2G)|8A293]]
  
−
| [[Apex 8A293 (iPod touch 3G)|8A293]]
  
−
| rowspan="4" | Unavailable
  
−
|-
  
−
! style="text-align:left;" | 4.0.1
  
−
| [[Apex 8A306 (iPhone 3G)|8A306]]
  
−
| [[Apex 8A306 (iPhone 3GS)|8A306]]
  
−
| [[Apex 8A306 (iPhone 4)|8A306]]
  
−
| colspan="2" | Unavailable
  
−
|-
  
−
! style="text-align:left;" | 4.0.2
  
−
| [[Apex 8A400 (iPhone 3G)|8A400]]
  
−
| [[Apex 8A400 (iPhone 3GS)|8A400]]
  
−
| [[Apex 8A400 (iPhone 4)|8A400]]
  
−
| [[Apex 8A400 (iPod touch 2G)|8A400]]
  
−
| [[Apex 8A400 (iPod touch 3G)|8A400]]
  
−
|-
  
−
! style="text-align:left;" | 4.1
  
−
| [[Baker 8B117 (iPhone 3G)|8B117]]
  
−
| [[Baker 8B117 (iPhone 3GS)|8B117]]
  
−
| [[Baker 8B117 (iPhone 4)|8B117]]
  
−
| [[Baker 8B117 (iPod touch 2G)|8B117]]
  
−
| [[Baker 8B117 (iPod touch 3G)|8B117]]
  
−
| [[Baker 8B117 (iPod touch 4G)|8B117]]+[[Baker 8B118 (iPod touch 4G)|8B118]]
  
−
| [[Mojave 8M89 (Apple TV 2G)|8M89]]
  
−
|-
  
−
|}
  
   
  +
* [[Firmware Keys/1.x|1.x]]
−
===Beta===
  
  +
* [[Firmware Keys/2.x|2.x]]
−
'''Main Article: ''[[Beta Firmware]]'''''
  
  +
* [[Firmware Keys/3.x|3.x]]
  +
* [[Firmware Keys/4.x|4.x]]
  +
* [[Firmware Keys/5.x|5.x]]
  +
* [[Firmware Keys/6.x|6.x]]
  +
* [[Firmware Keys/7.x|7.x]]
  +
* [[Firmware Keys/8.x|8.x]]
  +
* [[Firmware Keys/9.x|9.x]]
  +
* [[Firmware Keys/10.x|10.x]]
  +
* [[Firmware Keys/11.x|11.x]]
  +
* [[Firmware Keys/12.x|12.x]]
  +
* [[Firmware Keys/13.x|13.x]]
  +
* [[Firmware Keys/14.x|14.x]]
  +
* [[Firmware Keys/15.x|15.x]]
  +
* [[Firmware Keys/16.x|16.x]]
   
  +
== See also ==
−
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
  
  +
* [[Application Processor]]
−
|-
  
−
|
  
−
! [[M68ap|iPhone]]
  
−
! [[N82ap|iPhone 3G]]
  
−
! [[N88ap|iPhone 3GS]]
  
−
! [[N90ap|iPhone 4]]
  
−
! [[N45ap|iPod touch]]
  
−
! [[N72ap|iPod touch 2G]]
  
−
! [[N18ap|iPod touch 3G]]
  
−
! [[N81ap|iPod touch 4G]]
  
−
! [[K48ap|iPad]]
  
−
! [[K66ap|Apple TV 2G]]
  
−
|-
  
−
! style="text-align:left;" | 1.2b1
  
−
| [[Big Bear 5A147p (iPhone)|5A147p]]
  
−
| rowspan="8" | Unavailable
  
−
| rowspan="13" | Unavailable
  
−
| rowspan="20" | Unavailable
  
−
| [[Big Bear 5A147p (iPod touch)|5A147p]]
  
−
| rowspan="8" | Unavailable
  
−
| rowspan="15" | Unavailable
  
−
| colspan="2" rowspan="21" | Unavailable
  
−
| rowspan="23" | Unavailable
  
−
|-
  
−
! style="text-align:left;" | 2.0b2
  
−
| [[Big Bear 5A225c (iPhone)|5A225c]]
  
−
| [[Big Bear 5A225c (iPod touch)|5A225c]]
  
−
|-
  
−
! style="text-align:left;" | 2.0b3
  
−
| [[Big Bear 5A240d (iPhone)|5A240d]]
  
−
| [[Big Bear 5A240d (iPod touch)|5A240d]]
  
−
|-
  
−
! style="text-align:left;" | 2.0b4
  
−
| [[Big Bear 5A258f (iPhone)|5A258f]]
  
−
| [[Big Bear 5A258f (iPod touch)|5A258f]]
  
−
|-
  
−
! style="text-align:left;" | 2.0b5
  
−
| [[Big Bear 5A274d (iPhone)|5A274d]]
  
−
| [[Big Bear 5A274d (iPod touch)|5A274d]]
  
−
|-
  
−
! style="text-align:left;" | 2.0b6P
  
−
| [[Big Bear 5A292g (iPhone)|5A292g]]
  
−
| [[Big Bear 5A292g (iPod touch)|5A292g]]
  
−
|-
  
−
! style="text-align:left;" | 2.0b6F
  
−
| [[Big Bear 5A308 (iPhone)|5A308]]
  
−
| [[Big Bear 5A308 (iPod touch)|5A308]]
  
−
|-
  
−
! style="text-align:left;" | 2.0b7
  
−
| [[Big Bear 5A331 (iPhone)|5A331]]
  
−
| [[Big Bear 5A331 (iPod touch)|5A331]]
  
−
|-
  
−
! style="text-align:left;" | 3.0b1
  
−
| [[Kirkwood 7A238j (iPhone)|7A238j]]
  
−
| [[Kirkwood 7A238j (iPhone 3G)|7A238j]]
  
−
| [[Kirkwood 7A238j (iPod touch)|7A238j]]
  
−
| [[Kirkwood 7A238j (iPod touch 2G)|7A238j]]
  
−
|-
  
−
! style="text-align:left;" | 3.0b2
  
−
| [[Kirkwood 7A259g (iPhone)|7A259g]]
  
−
| [[Kirkwood 7A259g (iPhone 3G)|7A259g]]
  
−
| [[Kirkwood 7A259g (iPod touch)|7A259g]]
  
−
| [[Kirkwood 7A259g (iPod touch 2G)|7A259g]]
  
−
|-
  
−
! style="text-align:left;" | 3.0b3
  
−
| [[Kirkwood 7A280f (iPhone)|7A280f]]
  
−
| [[Kirkwood 7A280f (iPhone 3G)|7A280f]]
  
−
| [[Kirkwood 7A280f (iPod touch)|7A280f]]
  
−
| [[Kirkwood 7A280f (iPod touch 2G)|7A280f]]
  
−
|-
  
−
! style="text-align:left;" | 3.0b4
  
−
| [[Kirkwood 7A300g (iPhone)|7A300g]]
  
−
| [[Kirkwood 7A300g (iPhone 3G)|7A300g]]
  
−
| [[Kirkwood 7A300g (iPod touch)|7A300g]]
  
−
| [[Kirkwood 7A300g (iPod touch 2G)|7A300g]]
  
−
|-
  
−
! style="text-align:left;" | 3.0b5
  
−
| [[Kirkwood 7A312g (iPhone)|7A312g]]
  
−
| [[Kirkwood 7A312g (iPhone 3G)|7A312g]]
  
−
| [[Kirkwood 7A312g (iPod touch)|7A312g]]
  
−
| [[Kirkwood 7A312g (iPod touch 2G)|7A312g]]
  
−
|-
  
−
! style="text-align:left;" | 3.1b1
  
−
| [[NorthVail 7C97d (iPhone)|7C97d]]
  
−
| [[NorthVail 7C97d (iPhone 3G)|7C97d]]
  
−
| [[NorthVail 7C97d (iPhone 3GS)|7C97d]]
  
−
| [[NorthVail 7C97d (iPod touch)|7C97d]]
  
−
| [[NorthVail 7C97d (iPod touch 2G)|7C97d]]
  
−
|-
  
−
! style="text-align:left;" | 3.1b2
  
−
| [[NorthVail 7C106c (iPhone)|7C106c]]
  
−
| [[NorthVail 7C106c (iPhone 3G)|7C106c]]
  
−
| [[NorthVail 7C106c (iPhone 3GS)|7C106c]]
  
−
| [[NorthVail 7C106c (iPod touch)|7C106c]]
  
−
| [[NorthVail 7C106c (iPod touch 2G)|7C106c]]
  
−
|-
  
−
! style="text-align:left;" | 4.0b1
  
−
| rowspan="8" | Unavailable
  
−
| [[ApexVail 8A230m (iPhone 3G)|8A230m]]
  
−
| [[ApexVail 8A230m (iPhone 3GS)|8A230m]]
  
−
| rowspan="8" | Unavailable
  
−
| [[ApexVail 8A230m (iPod touch 2G)|8A230m]]
  
−
| [[ApexVail 8A230m (iPod touch 3G)|8A230m]]
  
−
|-
  
−
! style="text-align:left;" | 4.0b2
  
−
| [[ApexVail 8A248c (iPhone 3G)|8A248c]]
  
−
| [[ApexVail 8A248c (iPhone 3GS)|8A248c]]
  
−
| [[ApexVail 8A248c (iPod touch 2G)|8A248c]]
  
−
| [[ApexVail 8A248c (iPod touch 3G)|8A248c]]
  
−
|-
  
−
! style="text-align:left;" | 4.0b3
  
−
| [[ApexVail 8A260b (iPhone 3G)|8A260b]]
  
−
| [[ApexVail 8A260b (iPhone 3GS)|8A260b]]
  
−
| [[ApexVail 8A260b (iPod touch 2G)|8A260b]]
  
−
| [[ApexVail 8A260b (iPod touch 3G)|8A260b]]
  
−
|-
  
−
! style="text-align:left;" | 4.0b4
  
−
| [[ApexVail 8A274b (iPhone 3G)|8A274b]]
  
−
| [[ApexVail 8A274b (iPhone 3GS)|8A274b]]
  
−
| [[ApexVail 8A274b (iPod touch 2G)|8A274b]]
  
−
| [[ApexVail 8A274b (iPod touch 3G)|8A274b]]
  
−
|-
  
−
! style="text-align:left;" | 4.0GM
  
−
| [[ApexVail 8A293 (iPhone 3G)|8A293]]
  
−
| [[ApexVail 8A293 (iPhone 3GS)|8A293]]
  
−
| [[ApexVail 8A293 (iPod touch 2G)|8A293]]
  
−
| [[ApexVail 8A293 (iPod touch 3G)|8A293]]
  
−
|-
  
−
! style="text-align:left;" | 4.1b1
  
−
| [[BakerVail 8B5080c (iPhone 3G)|8B5080c]]
  
−
| [[BakerVail 8B5080c (iPhone 3GS)|8B5080c]]
  
−
| [[BakerVail 8B5080c (iPhone 4)|8B5080c]]
  
−
| [[BakerVail 8B5080 (iPod touch 2G)|8B5080 (?)]]
  
−
| [[BakerVail 8B5080 (iPod touch 3G)|8B5080 (?)]]
  
−
|-
  
−
! style="text-align:left;" | 4.2b3
  
−
| [[JasperVail 8C5115c (iPhone 3G)|8C5115c]]
  
−
| [[JasperVail 8C5115c (iPhone 3GS)|8C5115c]]
  
−
| [[JasperVail 8C5115c (iPhone 4)|8C5115c]]
  
−
| [[JasperVail 8C5115c (iPod touch 2G)|8C5115c]]
  
−
| [[JasperVail 8C5115c (iPod touch 3G)|8C5115c]]
  
−
| [[JasperVail 8C5115c (iPod touch 4G)|8C5115c]]
  
−
| [[JasperVail 8C5115c (iPad)|8C5115c]]
  
−
|-
  
−
! style="text-align:left;" | 4.2GM
  
−
| [[JasperVail 8C134 (iPhone 3G)|8C134]]
  
−
| [[JasperVail 8C134 (iPhone 3GS)|8C134]]
  
−
| [[JasperVail 8C134 (iPhone 4)|8C134]]
  
−
| [[JasperVail 8C134 (iPod touch 2G)|8C134]]
  
−
| [[JasperVail 8C134 (iPod touch 3G)|8C134]]
  
−
| [[JasperVail 8C134 (iPod touch 4G)|8C134]]
  
−
| [[JasperVail 8C134 (iPad)|8C134]]
  
−
|-
  
−
|}
  
   
−
[[Category:VFDecrypt]]
 +
[[Category:Decryption]]

Latest revision as of 10:42, 6 June 2022

Firmware Keys are keys which decrypt bootloaders, ramdisks, and root filesystem of iOS firmware, if those components are encrypted. Apple uses encryption to make it harder to analyze and modify them. Over time Apple changed the way they encrypt firmware files, hence the way to decrypt them and get decryption keys changed as well.

History

With the release of the iPhone came the IMG2 file format. They were used on all known iPhone OS 1.x firmwares. For the 1.1.x series, they were encrypted with the 0x837 key. The discovery of the 0x837 key led to the ability to decrypt any 1.x firmware.

Following IMG2 came the IMG3 file format. They were introduced with iPhone OS 2.0 beta 4, and have been in use ever since. In order to maintain their integrity, they use multiple layers of encryption. Apple took encryption seriously with IMG3 by utilizing AES (based on the Rinjndael key schedule). In terms of the pre-iPhone OS 3 VFDecrypt key, it is stored as plain-text in the "__restore" segment of the ASR image within the ramdisks.

The ramdisk keys can only be retrieved with the processor specific GID Key. The GID key is currently unretrievable and can only be utilized through the built-in AES engine. To complicate things even more, the engine is only accessible through a special bootrom or iBoot exploit (jailbreaks typically expose it with /dev/aes_0). This makes usage of the key nearly impossible.

However, once you have access to the AES engine, the entire system falls apart. You are able to upload an encrypted ramdisk and grab the decryption keys for it. Once you manage to decrypt the ramdisk, you can run it through GenPass to decrypt the firmware key.

To find the keys, you can either use the methods on AES Keys or the easier option for OS X, keylimepie.

Decrypting

Main article: Decrypting Firmwares

Notes

Certain files share the same key and IV per application processor (per build) provided the devices have the same pixel resolution:

You can use img3decrypt or xpwntool to decrypt these files as described in Decrypting Firmwares. Once done, mount or extract using the tool of your choice.

The firmware version number for the Apple TV builds are the ones that the Apple TV reports (also known as the "marketing version").

All dates are relative to UTC.

GID AES is used by iBoot to decrypt firmware images. When iBoot loads the kernelcache, GID AES is disabled. This means in order to get firmware keys, you must gain code execution in a setting where GID AES is still enabled. In most cases, this means exploiting iBoot itself, before the kernelcache is loaded.

Firmware Versions

See also: Prototypes

This is a full and comprehensive list of all firmwares Apple Inc. has made available to the public in some way, be it the dev center or iTunes. This list also contains a few firmwares for which there never was an IPSW (as far as can be told) such as 4.2.5 for the CDMA iPhone 4 (iPhone3,3). These few builds came preinstalled on the device, but are not available for download.

See also

Retrieved from "https://www.theiphonewiki.com/w/index.php?title=Firmware_Keys&oldid=122962"