The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information.

Difference between revisions of "Firmware Keys"

From The iPhone Wiki
Jump to: navigation, search
m (Undo revision 25834 by 5urd (talk))
(→‎Firmware Versions: 16.x placeholder)
 
(515 intermediate revisions by 21 users not shown)
Line 1: Line 1:
  +
__NOTOC__
−
'''VFDecrypt Keys''' are the keys which can decrypt the files that come with the [[firmware]]. Apple uses a public-private key encryption to ensure the safety of their files. Over time Apple has changed the way to encrypt firmware files, thus the way to decrypt files as well as the way to get the VFDecrypt Keys has also.
 
  +
'''Firmware Keys''' are keys which decrypt bootloaders, ramdisks, and [[:/|root filesystem]] of iOS [[firmware]], if those components are encrypted. Apple uses encryption to make it harder to analyze and modify them. Over time Apple changed the way they encrypt firmware files, hence the way to decrypt them and get decryption keys changed as well.
   
  +
== History ==
−
[[S5L File Formats#IMG2|IMG2]] was the file format used prior to iOS 2.0. For iOS 1.1.x, IMG2 files were encrypted with Key 0x837.
 
  +
With the release of the iPhone came the [[S5L File Formats#IMG2|IMG2]] file format. They were used on all known [[iOS|iPhone OS]] [[#1.x|1.x]] firmwares. For the 1.1.x series, they were encrypted with the [[AES Keys#Key 0x837|0x837 key]]. The discovery of the 0x837 key led to the ability to decrypt ''any'' 1.x firmware.
   
  +
Following IMG2 came the [[IMG3 File Format|IMG3]] file format. They were introduced with iPhone OS [[#1.x.2F2.x|2.0 beta 4]], and have been in use ever since. In order to maintain their integrity, they use multiple layers of encryption. Apple took encryption seriously with IMG3 by utilizing [[wikipedia:Advanced Encryption Standard|AES]] (based on the [[wikipedia:Rijndael key schedule|Rinjndael key schedule]]). In terms of the pre-iPhone OS 3 [[VFDecrypt]] key, it is stored as plain-text in the "__restore" segment of the ASR image within the [[ramdisk]]s.
−
[[IMG3 File Format|IMG3]] encrypted files contain encrypted versions of the VFDecrypt Keys as part of the [[KBAG]] (key bag). These can be decrypted with the [[GID-key]]. For jailbroken iDevices the VFDecrypt keys can be retrieved with the devices [[AES Keys|hardware AES engine]]. The VFDecrypt key for the root filesystem image of an iDevice (~500 MB to 800MB in the case of iOS 5) requires either a decrypted [[Restore Ramdisk]] or [[Update Ramdisk]]. Once you have a decrypted Restore or Update Ramdisk, [[GenPass]] can be used to gather the keys for the root filesystem.
 
−
For the root filesystem there is one key per device model, with no IV. You can mount this once it has been decrypted using your program of choice. (For example, 7-zip on Windows (after extracting the DMG on Windows, extract the biggest file with [[Wikipedia:7-Zip|7-Zip]])
  
   
  +
The ramdisk keys can ''only'' be retrieved with the processor specific [[GID Key]]. The GID key is currently unretrievable and can only be utilized through the built-in [[AES Keys|AES engine]]. To complicate things ''even more'', the engine is only accessible through a special [[bootrom]] or [[iBoot]] exploit ([[jailbreak]]s typically expose it with [[/dev/aes_0]]). This makes usage of the key nearly impossible.
−
== Notes ==
  
−
The Update Ramdisk and Restore Ramdisks share the same IV and key per type of Application Processor. The current models are:
  
   
  +
However, once you have access to the AES engine, the entire system falls apart. You are able to upload an encrypted ramdisk and grab the decryption keys for it. Once you manage to decrypt the ramdisk, you can run it through [[GenPass]] to decrypt the firmware key.
−
{| class="wikitable sortable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
  
  +
−
|-
  
  +
To find the keys, you can either use the methods on [[AES Keys]] or the easier option for OS X, [[keylimepie]].
−
! width="200" | Application Processor
  
  +
−
! width="200" | iDevice
  
  +
== Decrypting ==
−
|-
  
  +
{{main|Decrypting Firmwares}}
−
| [[S5L8900]]
  
  +
== Notes ==
−
| [[M68ap|iPhone]], [[N82ap|iPhone 3G]], [[N45ap|iPod touch]]
  
  +
Certain files share the same key and IV per [[Application Processor|application processor]] (per build) provided the devices have the same pixel resolution:
−
|-
  
−
| [[S5L8720]]
 +
* [[Update Ramdisk]]
  +
* [[Restore Ramdisk]]
−
| [[M68ap|iPhone]], [[N72ap|iPod touch 2G]]
  
  +
* [[AppleLogo]]
−
|-
  
−
| [[N88ap|iPhone 3GS]]
 +
* [[BatteryCharging1]]
  +
* [[BatteryFull]]
−
|-
  
  +
* [[BatteryLow1]]
−
| [[N18ap|iPod touch 3G]]
  
  +
* [[GlyphCharging]]
−
|-
  
−
| [[S5L8930]] (A4)
 +
* [[GlyphPlugin]]
  +
* [[Kernelcache]]
−
| [[K48ap|iPad]], [[iPhone 4]], [[N81ap|iPod touch 4G]], [[K66ap|Apple TV 2G]]
  
  +
* [[NeedService]]
−
|-
  
  +
* [[SEP Firmware]]
−
| [[iPad 2]], [[N94ap|iPhone 4S]]
  
  +
* [[WTF]]
−
|-
  
−
| [[S5L8920]]
 +
* [[BatteryCharging0]]
−
| [[S5L8922]]
 +
* [[BatteryLow0]]
−
| [[S5L8940]] (A5)
 +
* [[RecoveryMode]]
−
| [[S5L8942]] (revised A5)
  
−
| [[k93aap|iPad 2 Wi-Fi R2]], [[J33ap|Apple TV 3G]]
  
−
|-
  
−
| [[S5L8945]] (A5X)
  
−
| [[iPad 3]]
  
−
|}
  
   
−
You can use [[img3decrypt]][http://code.google.com/p/img3decrypt/] or [[xpwntool]][http://github.com/planetbeing/xpwn/tree/master] to decrypt these as described in [[Ramdisk Decryption]]. Once done, mount or extract using the tool of your choice.
 +
You can use [[img3decrypt]] or [[xpwntool]] to decrypt these files as described in [[Decrypting Firmwares]]. Once done, mount or extract using the tool of your choice.
   
  +
The firmware version number for the [[List of Apple TVs|Apple TV]] builds are the ones that the Apple TV reports (also known as the "marketing version").
−
When posting a key page, please use the [[Template:Keys|key template]] ('''IN THE CORRECT ORDER''') and do '''NOT''' [[Wikipedia:WP:SUBST|substitute]] it.
  
   
  +
All dates are relative to [[wikipedia:Coordinated Universal Time|UTC]].
−
For the VFDecrypt Keys of each firmware please check the builds listed at the appropiate firmware version page.
  
   
  +
GID AES is used by iBoot to decrypt firmware images. When iBoot loads the kernelcache, GID AES is disabled. This means in order to get firmware keys, you must gain code execution in a setting where GID AES is still enabled. In most cases, this means exploiting iBoot itself, before the kernelcache is loaded.
−
== Firmware versions ==
  
−
=== Final ===
  
−
{{main|Firmware}}
  
−
==== 1.x ====
  
−
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
  
−
|-
  
−
! Date
  
−
! Build
  
−
! [[m68ap|iPhone]]
  
−
! [[n45ap|iPod touch 1G]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 1A420
  
−
| [[Alpine 1A420 (iPhone)|1.0]]
  
−
| rowspan="4" | Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 1A543a
  
−
| [[Heavenly 1A543a (iPhone)|1.0.0]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 1C25
  
−
| [[Heavenly 1C25 (iPhone)|1.0.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 1C28
  
−
| [[Heavenly 1C28 (iPhone)|1.0.2]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 3A100a
  
−
| rowspan="2" | Unavailable
  
−
| [[Snowbird 3A100a (iPod touch)|1.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 3A101a
  
−
| [[Snowbird 3A101a (iPod touch)|1.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 3A109a
  
−
| [[Snowbird 3A109a (iPhone)|1.1.1]]
  
−
| Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 3A110a
  
−
| Unavailable
  
−
| [[Snowbird 3A110a (iPod touch)|1.1.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 3B48b
  
−
| [[Oktoberfest 3B48b (iPhone)|1.1.2]]
  
−
| [[Oktoberfest 3B48b (iPod touch)|1.1.2]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 4A93
  
−
| [[Little Bear 4A93 (iPhone)|1.1.3]]
  
−
| [[Little Bear 4A93 (iPod touch)|1.1.3]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 4A102
  
−
| [[Little Bear 4A102 (iPhone)|1.1.4]]
  
−
| [[Little Bear 4A102 (iPod touch)|1.1.4]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 4B1
  
−
| Unavailable
  
−
| [[Little Bear 4B1 (iPod touch)|1.1.5]]
  
−
|}
  
−
==== 2.x ====
  
−
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
  
−
|-
  
−
! Date
  
−
! Build
  
−
! [[m68ap|iPhone]]
  
−
! [[n82ap|iPhone 3G]]
  
−
! [[n45ap|iPod touch 1G]]
  
−
! [[n72ap|iPod touch 2G]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5A345
  
−
| Unavailable
  
−
| [[Big Bear 5A345 (iPhone 3G)|2.0]]
  
−
| Unavailable
  
−
| rowspan="6" | Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5A347
  
−
| [[Big Bear 5A347 (iPhone)|2.0]]
  
−
| [[Big Bear 5A347 (iPhone 3G)|2.0]]
  
−
| [[Big Bear 5A347 (iPod touch)|2.0]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5B108
  
−
| [[Big Bear 5B108 (iPhone)|2.0.1]]
  
−
| [[Big Bear 5B108 (iPhone 3G)|2.0.1]]
  
−
| [[Big Bear 5B108 (iPod touch)|2.0.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5C1
  
−
| [[Big Bear 5C1 (iPhone)|2.0.2]]
  
−
| [[Big Bear 5C1 (iPhone 3G)|2.0.2]]
  
−
| [[Big Bear 5C1 (iPod touch)|2.0.2]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5F136
  
−
| [[Sugar Bowl 5F136 (iPhone)|2.1]]
  
−
| [[Sugar Bowl 5F136 (iPhone 3G)|2.1]]
  
−
| Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5F137
  
−
| rowspan="2" colspan="2" | Unavailable
  
−
| [[Sugar Bowl 5F137 (iPod touch)|2.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5F138
  
−
| Unavailable
  
−
| [[Sugar Bowl 5F138 (iPod touch 2G)|2.1.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5G77
  
−
| [[Timberline 5G77 (iPhone)|2.2]]
  
−
| [[Timberline 5G77 (iPhone 3G)|2.2]]
  
−
| [[Timberline 5G77 (iPod touch)|2.2]]
  
−
| Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5G77a
  
−
| colspan="3" | Unavailable
  
−
| [[Timberline 5G77a (iPod touch 2G)|2.2]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5H11
  
−
| [[SUTimberline 5H11 (iPhone)|2.2.1]]
  
−
| [[SUTimberline 5H11 (iPhone 3G)|2.2.1]]
  
−
| [[SUTimberline 5H11 (iPod touch)|2.2.1]]
  
−
| Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5H11a
  
−
| colspan="3" | Unavailable
  
−
| [[SUTimberline 5H11a (iPod touch 2G)|2.2.1]]
  
−
|}
  
−
==== 3.x ====
  
−
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
  
−
|-
  
−
! Date
  
−
! Build
  
−
! [[k48ap|iPad]]
  
−
! [[m68ap|iPhone]]
  
−
! [[n82ap|iPhone 3G]]
  
−
! [[n88ap|iPhone 3GS]]
  
−
! [[n45ap|iPod touch 1G]]
  
−
! [[n72ap|iPod touch 2G]]
  
−
! [[n18ap|iPod touch 3G]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7A341
  
−
| rowspan="7" | Unavailable
  
−
| [[Kirkwood 7A341 (iPhone)|3.0]]
  
−
| [[Kirkwood 7A341 (iPhone 3G)|3.0]]
  
−
| [[Kirkwood 7A341 (iPhone 3GS)|3.0]]
  
−
| [[Kirkwood 7A341 (iPod touch)|3.0]]
  
−
| [[Kirkwood 7A341 (iPod touch 2G)|3.0]]
  
−
| Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7A400
  
−
| [[Kirkwood 7A400 (iPhone)|3.0.1]]
  
−
| [[Kirkwood 7A400 (iPhone 3G)|3.0.1]]
  
−
| [[Kirkwood 7A400 (iPhone 3GS)|3.0.1]]
  
−
| colspan="3" rowspan="2" | Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7C144
  
−
| [[Northstar 7C144 (iPhone)|3.1]]
  
−
| [[Northstar 7C144 (iPhone 3G)|3.1]]
  
−
| [[Northstar 7C144 (iPhone 3GS)|3.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7C145
  
−
| rowspan="2" colspan="3" | Unavailable
  
−
| [[Northstar 7C145 (iPod touch)|3.1.1]]
  
−
| [[Northstar 7C145 (iPod touch 2G)|3.1.1]]
  
−
| [[Northstar 7C145 (iPod touch 3G)|3.1.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7C146
  
−
| colspan="2" | Unavailable
  
−
| [[Northstar 7C146 (iPod touch 3G)|3.1.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7D11
  
−
| [[Northstar 7D11 (iPhone)|3.1.2]]
  
−
| [[Northstar 7D11 (iPhone 3G)|3.1.2]]
  
−
| [[Northstar 7D11 (iPhone 3GS)|3.1.2]]
  
−
| [[Northstar 7D11 (iPod touch)|3.1.2]]
  
−
| [[Northstar 7D11 (iPod touch 2G)|3.1.2]]
  
−
| [[Northstar 7D11 (iPod touch 3G)|3.1.2]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7E18
  
−
| [[SUNorthstarTwo 7E18 (iPhone)|3.1.3]]
  
−
| [[SUNorthstarTwo 7E18 (iPhone 3G)|3.1.3]]
  
−
| [[SUNorthstarTwo 7E18 (iPhone 3GS)|3.1.3]]
  
−
| [[SUNorthstarTwo 7E18 (iPod touch)|3.1.3]]
  
−
| [[SUNorthstarTwo 7E18 (iPod touch 2G)|3.1.3]]
  
−
| [[SUNorthstarTwo 7E18 (iPod touch 3G)|3.1.3]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7B367
  
−
| [[Wildcat 7B367 (iPad)|3.2]]
  
−
| colspan="6" rowspan="3" | Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7B405
  
−
| [[Wildcat 7B405 (iPad)|3.2.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7B500
  
−
| [[Wildcat 7B500 (iPad)|3.2.2]]
  
−
|}
  
−
==== 4.x ====
  
−
Please note that for the Apple TV the firmware listed in this table is the one that your Apple TV reports. See also [[Apple TV Firmware Versions]].
  
−
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
  
−
|-
  
−
! Date (YYYY/MM/DD)
  
−
! Build
  
−
! [[k66ap|Apple TV 2G]]
  
−
! [[k48ap|iPad]]
  
−
! [[k93ap|iPad 2 (Wi-Fi)]]
  
−
! [[k94ap|iPad 2 (GSM)]]
  
−
! [[k95ap|iPad 2 (CDMA)]]
  
−
! [[n82ap|iPhone 3G]]
  
−
! [[n88ap|iPhone 3GS]]
  
−
! [[n90ap|iPhone 4 (GSM)]]
  
−
! [[n92ap|iPhone 4 (CDMA)]]
  
−
! [[n72ap|iPod touch 2G]]
  
−
! [[n18ap|iPod touch 3G]]
  
−
! [[n81ap|iPod touch 4G]]
  
−
|-
  
−
| 2010/09/01
  
−
! style="text-align:left;" | 8M89
  
−
| [[Mojave 8M89 (Apple TV 2G)|4.0]]
  
−
| colspan="11" | Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8A293
  
−
| rowspan="7" | Unavailable
  
−
| rowspan="4" colspan="4" | Unavailable
  
−
| [[Apex 8A293 (iPhone 3G)|4.0]]
  
−
| [[Apex 8A293 (iPhone 3GS)|4.0]]
  
−
| [[Apex 8A293 (iPhone 4)|4.0]]
  
−
| Unavailable
  
−
| [[Apex 8A293 (iPod touch 2G)|4.0]]
  
−
| [[Apex 8A293 (iPod touch 3G)|4.0]]
  
−
| Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8A306
  
−
| [[Apex 8A306 (iPhone 3G)|4.0.1]]
  
−
| [[Apex 8A306 (iPhone 3GS)|4.0.1]]
  
−
| [[Apex 8A306 (iPhone 4)|4.0.1]]
  
−
| colspan="4" | Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8A400
  
−
| [[Apex 8A400 (iPhone 3G)|4.0.2]]
  
−
| [[Apex 8A400 (iPhone 3GS)|4.0.2]]
  
−
| [[Apex 8A400 (iPhone 4)|4.0.2]]
  
−
| rowspan="2" | Unavailable
  
−
| [[Apex 8A400 (iPod touch 2G)|4.0.2]]
  
−
| [[Apex 8A400 (iPod touch 3G)|4.0.2]]
  
−
| Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8B117
  
−
| [[Baker 8B117 (iPhone 3G)|4.1]]
  
−
| [[Baker 8B117 (iPhone 3GS)|4.1]]
  
−
| [[Baker 8B117 (iPhone 4)|4.1]]
  
−
| [[Baker 8B117 (iPod touch 2G)|4.1]]
  
−
| [[Baker 8B117 (iPod touch 3G)|4.1]]
  
−
| [[Baker 8B117 (iPod touch 4G)|4.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8B118
  
−
| colspan="9" | Unavailable
  
−
| [[Baker 8B118 (iPod touch 4G)|4.1]]
  
−
| Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8C148
  
−
| [[Jasper 8C148 (iPad)|4.2.1]]
  
−
| colspan="3" | Unavailable
  
−
| [[Jasper 8C148 (iPhone 3G)|4.2.1]]
  
−
| Unavailable
  
−
| [[Jasper 8C148 (iPhone 4)|4.2.1]]
  
−
| Unavailable
  
−
| [[Jasper 8C148 (iPod touch 2G)|4.2.1]]
  
−
| [[Jasper 8C148 (iPod touch 3G)|4.2.1]]
  
−
| [[Jasper 8C148 (iPod touch 4G)|4.2.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8C148a
  
−
| colspan="5" | Unavailable
  
−
| [[Jasper 8C148a (iPhone 3GS)|4.2.1]]
  
−
| colspan="5" | Unavailable
  
−
|-
  
−
| 2010/11/22
  
−
! style="text-align:left;" | 8C150
  
−
| [[Jasper 8C150 (Apple TV 2G)|4.1]]
  
−
| rowspan="2" colspan="11" | Unavailable
  
−
|-
  
−
| 2010/12/14
  
−
! style="text-align:left;" | 8C154
  
−
| [[Jasper 8C154 (Apple TV 2G)|4.1.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8E128
  
−
| colspan="8" rowspan="6" | Unavailable
  
−
| [[Phoenix 8E128 (iPhone 4 CDMA)|4.2.5]]
  
−
| colspan="3" rowspan="6" | Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8E200
  
−
| [[Phoenix 8E200 (iPhone 4 CDMA)|4.2.6]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8E303
  
−
| [[Phoenix 8E303 (iPhone 4 CDMA)|4.2.7]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8E401
  
−
| [[Phoenix 8E401 (iPhone 4 CDMA)|4.2.8]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8E501
  
−
| [[Phoenix 8E501 (iPhone 4 CDMA)|4.2.9]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8E600
  
−
| [[Phoenix 8E600 (iPhone 4 CDMA)|4.2.10]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8F190
  
−
| rowspan="2" | Unavailable
  
−
| [[Durango 8F190 (iPad)|4.3]]
  
−
| colspan="3" | Unavailable
  
−
| rowspan="14" | Unavailable
  
−
| [[Durango 8F190 (iPhone 3GS)|4.3]]
  
−
| [[Durango 8F190 (iPhone 4)|4.3]]
  
−
| colspan="2" rowspan="14" | Unavailable
  
−
| [[Durango 8F190 (iPod touch 3G)|4.3]]
  
−
| [[Durango 8F190 (iPod touch 4G)|4.3]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8F191
  
−
| Unavailable
  
−
| [[Durango 8F191 (iPad 2 Wi-Fi)|4.3]]
  
−
| [[Durango 8F191 (iPad 2 GSM)|4.3]]
  
−
| [[Durango 8F191 (iPad 2 CDMA)|4.3]]
  
−
| rowspan="5" colspan="2" | Unavailable
  
−
| rowspan="5" colspan="2" | Unavailable
  
−
|-
  
−
| 2011/03/11
  
−
! style="text-align:left;" | 8F191m
  
−
| [[Durango 8F191m (Apple TV 2G)|4.2]]
  
−
| rowspan="4" colspan="4" | Unavailable
  
−
|-
  
−
| 2011/03/22
  
−
! style="text-align:left;" | 8F202
  
−
| [[Durango 8F202 (Apple TV 2G)|4.2.1]]
  
−
|-
  
−
| 2011/03/11
  
−
! style="text-align:left;" | 8F305
  
−
| [[Durango 8F305 (Apple TV 2G)|4.2.2]]
  
−
|-
  
−
| 2011/08/01
  
−
! style="text-align:left;" | 8F455
  
−
| [[DurangoTideCuba 8F455 (Apple TV 2G)|4.3]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8G4
  
−
| rowspan="7" | Unavailable
  
−
| [[Durango 8G4 (iPad)|4.3.1]]
  
−
| [[Durango 8G4 (iPad 2 Wi-Fi)|4.3.1]]
  
−
| [[Durango 8G4 (iPad 2 GSM)|4.3.1]]
  
−
| [[Durango 8G4 (iPad 2 CDMA)|4.3.1]]
  
−
| [[Durango 8G4 (iPhone 3GS)|4.3.1]]
  
−
| [[Durango 8G4 (iPhone 4)|4.3.1]]
  
−
| [[Durango 8G4 (iPod touch 3G)|4.3.1]]
  
−
| [[Durango 8G4 (iPod touch 4G)|4.3.1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8H7
  
−
| [[Durango 8H7 (iPad)|4.3.2]]
  
−
| [[Durango 8H7 (iPad 2 Wi-Fi)|4.3.2]]
  
−
| [[Durango 8H7 (iPad 2 GSM)|4.3.2]]
  
−
| Unavailable
  
−
| [[Durango 8H7 (iPhone 3GS)|4.3.2]]
  
−
| [[Durango 8H7 (iPhone 4)|4.3.2]]
  
−
| [[Durango 8H7 (iPod touch 3G)|4.3.2]]
  
−
| [[Durango 8H7 (iPod touch 4G)|4.3.2]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8H8
  
−
| colspan="3" | Unavailable
  
−
| [[Durango 8H8 (iPad 2 CDMA)|4.3.2]]
  
−
| colspan="2" | Unavailable
  
−
| colspan="2" | Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8J2
  
−
| Unavailable
  
−
| [[Durango 8J2 (iPad 2 Wi-Fi)|4.3.3]]
  
−
| [[Durango 8J2 (iPad 2 GSM)|4.3.3]]
  
−
| [[Durango 8J2 (iPad 2 CDMA)|4.3.3]]
  
−
| [[Durango 8J2 (iPhone 3GS)|4.3.3]]
  
−
| [[Durango 8J2 (iPhone 4)|4.3.3]]
  
−
| [[Durango 8J2 (iPod touch 3G)|4.3.3]]
  
−
| [[Durango 8J2 (iPod touch 4G)|4.3.3]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8J3
  
−
| [[Durango 8J3 (iPad)|4.3.3]]
  
−
| colspan="3" | Unavailable
  
−
| colspan="2" | Unavailable
  
−
| colspan="2" | Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8K2
  
−
| [[Durango 8K2 (iPad)|4.3.4]]
  
−
| [[Durango 8K2 (iPad 2 Wi-Fi)|4.3.4]]
  
−
| [[Durango 8K2 (iPad 2 GSM)|4.3.4]]
  
−
| [[Durango 8K2 (iPad 2 CDMA)|4.3.4]]
  
−
| [[Durango 8K2 (iPhone 3GS)|4.3.4]]
  
−
| [[Durango 8K2 (iPhone 4)|4.3.4]]
  
−
| [[Durango 8K2 (iPod touch 3G)|4.3.4]]
  
−
| [[Durango 8K2 (iPod touch 4G)|4.3.4]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8L1
  
−
| [[Durango 8L1 (iPad)|4.3.5]]
  
−
| [[Durango 8L1 (iPad 2 Wi-Fi)|4.3.5]]
  
−
| [[Durango 8L1 (iPad 2 GSM)|4.3.5]]
  
−
| [[Durango 8L1 (iPad 2 CDMA)|4.3.5]]
  
−
| [[Durango 8L1 (iPhone 3GS)|4.3.5]]
  
−
| [[Durango 8L1 (iPhone 4)|4.3.5]]
  
−
| [[Durango 8L1 (iPod touch 3G)|4.3.5]]
  
−
| [[Durango 8L1 (iPod touch 4G)|4.3.5]]
  
−
|}
  
   
−
==== 5.x ====
 +
==Firmware Versions==
  +
{{see also|Prototypes}}
−
Please note that for the Apple TV the firmware listed in this table is the one that your Apple TV reports. See also [[Apple TV Firmware Versions]].
  
  +
This is a full and comprehensive list of all firmwares Apple Inc. has made available to the public in some way, be it the [[Apple Developer|dev center]] or [[iTunes]]. This list also contains a few firmwares for which there never was an IPSW (as far as can be told) such as 4.2.5 for the [[N92AP|CDMA iPhone 4]] (iPhone3,3). These few builds came preinstalled on the device, but are not available for download.
−
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
  
−
|-
  
−
! Date (YYYY/MM/DD)
  
−
! Build
  
−
! [[k66ap|Apple TV 2G]]
  
−
! [[j33ap|Apple TV 3G]]
  
−
! [[k48ap|iPad]]
  
−
! [[k93ap|iPad 2 (Wi-Fi)]]
  
−
! [[k94ap|iPad 2 (GSM)]]
  
−
! [[k95ap|iPad 2 (CDMA)]]
  
−
! [[k93aap|iPad 2 R2]]
  
−
! [[j1ap|iPad 3 (Wi-Fi)]]
  
−
! [[j2ap|iPad 3 (CDMA)]]
  
−
! [[j2aap|iPad 3 (Global)]]
  
−
! [[n88ap|iPhone 3GS]]
  
−
! [[n90ap|iPhone 4 (GSM)]]
  
−
! [[n92ap|iPhone 4 (CDMA)]]
  
−
! [[n94ap|iPhone 4S]]
  
−
! [[n18ap|iPod touch 3G]]
  
−
! [[n81ap|iPod touch 4G]]
  
−
|-
  
−
| 2011/10/12
  
−
! style="text-align:left;" | 9A334
  
−
| colspan="2" | Unavailable
  
−
| [[Telluride 9A334 (iPad)|5.0]]
  
−
| [[Telluride 9A334 (iPad 2 Wi-Fi)|5.0]]
  
−
| [[Telluride 9A334 (iPad 2 GSM)|5.0]]
  
−
| [[Telluride 9A334 (iPad 2 CDMA)|5.0]]
  
−
| colspan="4" | Unavailable
  
−
| [[Telluride 9A334 (iPhone 3GS)|5.0]]
  
−
| [[Telluride 9A334 (iPhone 4)|5.0]]
  
−
| [[Telluride 9A334 (iPhone 4 CDMA)|5.0]]
  
−
| [[Telluride 9A334 (iPhone 4S)|5.0]]
  
−
| [[Telluride 9A334 (iPod touch 3G)|5.0]]
  
−
| [[Telluride 9A334 (iPod touch 4G)|5.0]]
  
−
|-
  
−
| 2011/10/12
  
−
! style="text-align:left;" | 9A334v
  
−
| [[Telluride 9A334v (Apple TV 2G)|4.4]]
  
−
| rowspan="3" colspan="15" | Unavailable
  
−
|-
  
−
| 2011/10/18
  
−
! style="text-align:left;" | 9A335a
  
−
| [[Telluride 9A335a (Apple TV 2G)|4.4.1]]
  
−
|-
  
−
| 2011/11/02
  
−
! style="text-align:left;" | 9A336a
  
−
| [[Telluride 9A336a (Apple TV 2G)|4.4.2]]
  
−
|-
  
−
| 2011/11/10
  
−
! style="text-align:left;" | 9A405
  
−
| colspan="2" | Unavailable
  
−
| [[Telluride 9A405 (iPad)|5.0.1]]
  
−
| [[Telluride 9A405 (iPad 2 Wi-Fi)|5.0.1]]
  
−
| [[Telluride 9A405 (iPad 2 GSM)|5.0.1]]
  
−
| [[Telluride 9A405 (iPad 2 CDMA)|5.0.1]]
  
−
| colspan="4" | Unavailable
  
−
| [[Telluride 9A405 (iPhone 3GS)|5.0.1]]
  
−
| [[Telluride 9A405 (iPhone 4)|5.0.1]]
  
−
| [[Telluride 9A405 (iPhone 4 CDMA)|5.0.1]]
  
−
| [[Telluride 9A405 (iPhone 4S)|5.0.1]]
  
−
| [[Telluride_9A405 (iPod touch 3G)|5.0.1]]
  
−
| [[Telluride_9A405 (iPod touch 4G)|5.0.1]]
  
−
|-
  
−
| 2011/11/17
  
−
! style="text-align:left;" | 9A405l
  
−
| [[Telluride 9A405l (Apple TV 2G)|4.4.3]]
  
−
| colspan="15" | Unavailable
  
−
|-
  
−
| 2011/12/15
  
−
! style="text-align:left;" | 9A406
  
−
| colspan="13" | Unavailable
  
−
| [[Telluride 9A406 (iPhone 4S)|5.0.1]]
  
−
| colspan="2" | Unavailable
  
−
|-
  
−
| 2011/12/15
  
−
! style="text-align:left;" | 9A406a
  
−
| [[Telluride 9A406a (Apple TV 2G)|4.4.4]]
  
−
| colspan="15" | Unavailable
  
−
|-
  
−
| 2012/03/07
  
−
! style="text-align:left;" | 9B176
  
−
| colspan="2" | Unavailable
  
−
| [[Hoodoo 9B176 (iPad)|5.1]]
  
−
| [[Hoodoo 9B176 (iPad 2 Wi-Fi)|5.1]]
  
−
| [[Hoodoo 9B176 (iPad 2 GSM)|5.1]]
  
−
| [[Hoodoo 9B176 (iPad 2 CDMA)|5.1]]
  
−
| [[Hoodoo 9B176 (iPad 2 R2)|5.1]]
  
−
| [[Hoodoo 9B176 (iPad 3 Wi-Fi)|5.1]]
  
−
| [[Hoodoo 9B176 (iPad 3 CDMA)|5.1]]
  
−
| [[Hoodoo 9B176 (iPad 3 Global)|5.1]]
  
−
| [[Hoodoo 9B176 (iPhone 3GS)|5.1]]
  
−
| [[Hoodoo 9B176 (iPhone 4)|5.1]]
  
−
| [[Hoodoo 9B176 (iPhone 4 CDMA)|5.1]]
  
−
| Unavailable
  
−
| [[Hoodoo 9B176 (iPod touch 3G)|5.1]]
  
−
| [[Hoodoo 9B176 (iPod touch 4G)|5.1]]
  
−
|-
  
−
| 2012/03/07
  
−
! style="text-align:left;" | 9B179
  
−
| colspan="13" | Unavailable
  
−
| [[Hoodoo 9B179 (iPhone 4S)|5.1]]
  
−
| colspan="2" | Unavailable
  
−
|-
  
−
| 2012/03/07
  
−
! style="text-align:left;" | 9B179b
  
−
| [[Hoodoo 9B179b (Apple TV 2G)|5.0]]
  
−
| [[Hoodoo 9B179b (Apple TV 3G)|5.0]]
  
−
| colspan="14" | Unavailable
  
−
|-
  
−
| 2012/05/10
  
−
! style="text-align:left;" | 9B206
  
−
| colspan="2" | Unavailable
  
−
| [[Hoodoo 9B206 (iPad)|5.1.1]]
  
−
| [[Hoodoo 9B206 (iPad 2 Wi-Fi)|5.1.1]]
  
−
| [[Hoodoo 9B206 (iPad 2 GSM)|5.1.1]]
  
−
| [[Hoodoo 9B206 (iPad 2 CDMA)|5.1.1]]
  
−
| [[Hoodoo 9B206 (iPad 2 R2)|5.1.1]]
  
−
| [[Hoodoo 9B206 (iPad 3 Wi-Fi)|5.1.1]]
  
−
| [[Hoodoo 9B206 (iPad 3 CDMA)|5.1.1]]
  
−
| [[Hoodoo 9B206 (iPad 3 Global)|5.1.1]]
  
−
| [[Hoodoo 9B206 (iPhone 3GS)|5.1.1]]
  
−
| [[Hoodoo 9B206 (iPhone 4)|5.1.1]]
  
−
| [[Hoodoo 9B206 (iPhone 4 CDMA)|5.1.1]]
  
−
| [[Hoodoo 9B206 (iPhone 4S)|5.1.1]]
  
−
| [[Hoodoo_9B206 (iPod touch 3G)|5.1.1]]
  
−
| [[Hoodoo 9B206 (iPod touch 4G)|5.1.1]]
  
−
|-
  
−
| 2012/05/10
  
−
! style="text-align:left;" | 9B206f
  
−
| [[Hoodoo 9B206f (Apple TV 2G)|5.0.1]]
  
−
| [[Hoodoo 9B206f (Apple TV 3G)|5.0.1]]
  
−
| colspan="14" | Unavailable
  
−
|-
  
−
| 2012/05/25
  
−
! style="text-align:left;" | 9B208
  
−
| colspan="11" | Unavailable
  
−
| [[Hoodoo 9B208 (iPhone 4)|5.1.1]]
  
−
| colspan="4" | Unavailable
  
−
|-
  
−
| 2012/06/05
  
−
! style="text-align:left;" | 9B830
  
−
| [[HoodooTide 9B830 (Apple TV 2G)|5.0.2]]
  
−
| [[HoodooTide 9B830 (Apple TV 3G)|5.0.2]]
  
−
| colspan="14" | Unavailable
  
−
|}
  
   
  +
* [[Firmware Keys/1.x|1.x]]
−
=== Beta ===
  
−
{{main|Beta Firmware}}
 +
* [[Firmware Keys/2.x|2.x]]
  +
* [[Firmware Keys/3.x|3.x]]
−
==== 1.x/2.x ====
  
  +
* [[Firmware Keys/4.x|4.x]]
−
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
  
  +
* [[Firmware Keys/5.x|5.x]]
−
|-
  
  +
* [[Firmware Keys/6.x|6.x]]
−
! Date
  
  +
* [[Firmware Keys/7.x|7.x]]
−
! Build
  
  +
* [[Firmware Keys/8.x|8.x]]
−
! [[m68ap|iPhone]]
  
  +
* [[Firmware Keys/9.x|9.x]]
−
! [[n82ap|iPhone 3G]]
  
  +
* [[Firmware Keys/10.x|10.x]]
−
! [[n45ap|iPod touch]]
  
  +
* [[Firmware Keys/11.x|11.x]]
−
|-
  
  +
* [[Firmware Keys/12.x|12.x]]
−
| ?
  
  +
* [[Firmware Keys/13.x|13.x]]
−
! style="text-align:left;" | 5A147p
  
  +
* [[Firmware Keys/14.x|14.x]]
−
| [[Big Bear 5A147p (iPhone)|1.2b1]]
  
  +
* [[Firmware Keys/15.x|15.x]]
−
| rowspan="10" | Unavailable
  
  +
* [[Firmware Keys/16.x|16.x]]
−
| [[Big Bear 5A147p (iPod touch)|1.2b1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5A225c
  
−
| [[Big Bear 5A225c (iPhone)|2.0b2]]
  
−
| [[Big Bear 5A225c (iPod touch)|2.0b2]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5A240d
  
−
| [[Big Bear 5A240d (iPhone)|2.0b3]]
  
−
| [[Big Bear 5A240d (iPod touch)|2.0b3]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5A258f
  
−
| [[Big Bear 5A258f (iPhone)|2.0b4]]
  
−
| [[Big Bear 5A258f (iPod touch)|2.0b4]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5A274d
  
−
| [[Big Bear 5A274d (iPhone)|2.0b5]]
  
−
| [[Big Bear 5A274d (iPod touch)|2.0b5]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5A292g
  
−
| [[Big Bear 5A292g (iPhone)|2.0b6P]]
  
−
| [[Big Bear 5A292g (iPod touch)|2.0b6P]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5A308
  
−
| [[Big Bear 5A308 (iPhone)|2.0b6F]]
  
−
| [[Big Bear 5A308 (iPod touch)|2.0b6F]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5A331
  
−
| [[Big Bear 5A331 (iPhone)|2.0b7]]
  
−
| [[Big Bear 5A331 (iPod touch)|2.0b7]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5A345
  
−
| [[Big Bear 5A345 (iPhone)|2.0b8GM]]
  
−
| [[Big Bear 5A345 (iPod touch)|2.0b8GM]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5F90
  
−
| [[Sugar Bowl 5F90 (iPhone)|2.1b1]]
  
−
| [[Sugar Bowl 5F90 (iPod touch)|2.1b1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 5G26
  
−
| [[Sugar Bowl 5G26 (iPhone)|2.2b1]]
  
−
| [[Sugar Bowl 5G26 (iPhone 3G)|2.2b1]]
  
−
| [[Sugar Bowl 5G26 (iPod touch)|2.2b1]]
  
−
|}
  
−
==== 3.x ====
  
−
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
  
−
|-
  
−
! Date
  
−
! Build
  
−
! [[m68ap|iPhone]]
  
−
! [[n82ap|iPhone 3G]]
  
−
! [[n88ap|iPhone 3GS]]
  
−
! [[n45ap|iPod touch]]
  
−
! [[n72ap|iPod touch 2G]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7A238j
  
−
| [[Kirkwood 7A238j (iPhone)|3.0b1]]
  
−
| [[Kirkwood 7A238j (iPhone 3G)|3.0b1]]
  
−
| rowspan="5" | Unavailable
  
−
| [[Kirkwood 7A238j (iPod touch)|3.0b1]]
  
−
| [[Kirkwood 7A238j (iPod touch 2G)|3.0b1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7A259g
  
−
| [[Kirkwood 7A259g (iPhone)|3.0b2]]
  
−
| [[Kirkwood 7A259g (iPhone 3G)|3.0b2]]
  
−
| [[Kirkwood 7A259g (iPod touch)|3.0b2]]
  
−
| [[Kirkwood 7A259g (iPod touch 2G)|3.0b2]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7A280f
  
−
| [[Kirkwood 7A280f (iPhone)|3.0b3]]
  
−
| [[Kirkwood 7A280f (iPhone 3G)|3.0b3]]
  
−
| [[Kirkwood 7A280f (iPod touch)|3.0b3]]
  
−
| [[Kirkwood 7A280f (iPod touch 2G)|3.0b3]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7A300g
  
−
| [[Kirkwood 7A300g (iPhone)|3.0b4]]
  
−
| [[Kirkwood 7A300g (iPhone 3G)|3.0b4]]
  
−
| [[Kirkwood 7A300g (iPod touch)|3.0b4]]
  
−
| [[Kirkwood 7A300g (iPod touch 2G)|3.0b4]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7A312g
  
−
| [[Kirkwood 7A312g (iPhone)|3.0b5]]
  
−
| [[Kirkwood 7A312g (iPhone 3G)|3.0b5]]
  
−
| [[Kirkwood 7A312g (iPod touch)|3.0b5]]
  
−
| [[Kirkwood 7A312g (iPod touch 2G)|3.0b5]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7C97d
  
−
| [[NorthVail 7C97d (iPhone)|3.1b1]]
  
−
| [[NorthVail 7C97d (iPhone 3G)|3.1b1]]
  
−
| [[NorthVail 7C97d (iPhone 3GS)|3.1b1]]
  
−
| [[NorthVail 7C97d (iPod touch)|3.1b1]]
  
−
| [[NorthVail 7C97d (iPod touch 2G)|3.1b1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7C106c
  
−
| [[NorthVail 7C106c (iPhone)|3.1b2]]
  
−
| [[NorthVail 7C106c (iPhone 3G)|3.1b2]]
  
−
| [[NorthVail 7C106c (iPhone 3GS)|3.1b2]]
  
−
| [[NorthVail 7C106c (iPod touch)|3.1b2]]
  
−
| [[NorthVail 7C106c (iPod touch 2G)|3.1b2]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 7C116a
  
−
| [[NorthVail 7C116a (iPhone)|3.1b3]]
  
−
| [[NorthVail 7C116a (iPhone 3G)|3.1b3]]
  
−
| [[NorthVail 7C116a (iPhone 3GS)|3.1b3]]
  
−
| [[NorthVail 7C116a (iPod touch)|3.1b3]]
  
−
| [[NorthVail 7C116a (iPod touch 2G)|3.1b3]]
  
−
|}
  
−
==== 4.x ====
  
−
Please note that for the Apple TV the firmware listed in this table is the one that your Apple TV reports. See also [[Apple TV Firmware Versions]].
  
−
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
  
−
|-
  
−
! Date (YYYY/MM/DD)
  
−
! Build
  
−
! [[k66ap|Apple TV 2G]]
  
−
! [[k48ap|iPad]]
  
−
! [[n82ap|iPhone 3G]]
  
−
! [[n88ap|iPhone 3GS]]
  
−
! [[n90ap|iPhone 4 (GSM)]]
  
−
! [[n72ap|iPod touch 2G]]
  
−
! [[n18ap|iPod touch 3G]]
  
−
! [[n81ap|iPod touch 4G]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8A230m
  
−
| colspan="2" rowspan="7" | Unavailable
  
−
| [[ApexVail 8A230m (iPhone 3G)|4.0b1]]
  
−
| [[ApexVail 8A230m (iPhone 3GS)|4.0b1]]
  
−
| rowspan="6" | Unavailable
  
−
| [[ApexVail 8A230m (iPod touch 2G)|4.0b1]]
  
−
| [[ApexVail 8A230m (iPod touch 3G)|4.0b1]]
  
−
| rowspan="8" | Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8A248c
  
−
| [[ApexVail 8A248c (iPhone 3G)|4.0b2]]
  
−
| [[ApexVail 8A248c (iPhone 3GS)|4.0b2]]
  
−
| [[ApexVail 8A248c (iPod touch 2G)|4.0b2]]
  
−
| [[ApexVail 8A248c (iPod touch 3G)|4.0b2]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8A260b
  
−
| [[ApexVail 8A260b (iPhone 3G)|4.0b3]]
  
−
| [[ApexVail 8A260b (iPhone 3GS)|4.0b3]]
  
−
| [[ApexVail 8A260b (iPod touch 2G)|4.0b3]]
  
−
| [[ApexVail 8A260b (iPod touch 3G)|4.0b3]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8A274b
  
−
| [[ApexVail 8A274b (iPhone 3G)|4.0b4]]
  
−
| [[ApexVail 8A274b (iPhone 3GS)|4.0b4]]
  
−
| [[ApexVail 8A274b (iPod touch 2G)|4.0b4]]
  
−
| [[ApexVail 8A274b (iPod touch 3G)|4.0b4]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8A293
  
−
| [[Apex 8A293 (iPhone 3G)|4.0GM]]
  
−
| [[Apex 8A293 (iPhone 3GS)|4.0GM]]
  
−
| [[Apex 8A293 (iPod touch 2G)|4.0GM]]
  
−
| [[Apex 8A293 (iPod touch 3G)|4.0GM]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8B5080
  
−
| colspan="2" | Unavailable
  
−
| [[BakerVail 8B5080 (iPod touch 2G)|4.1b1]]
  
−
| [[BakerVail 8B5080 (iPod touch 3G)|4.1b1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8B5080c
  
−
| [[BakerVail 8B5080c (iPhone 3G)|4.1b1]]
  
−
| [[BakerVail 8B5080c (iPhone 3GS)|4.1b1]]
  
−
| [[BakerVail 8B5080c (iPhone 4)|4.1b1]]
  
−
| rowspan="2" colspan="2" | Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8B5091b
  
−
| [[BakerVail 8B5091b (iPhone 3G)|4.1b2]]
  
−
| [[BakerVail 8B5091b (iPhone 3GS)|4.1b2]]
  
−
| [[BakerVail 8B5091b (iPhone 4)|4.1b2]]
  
−
| [[BakerVail 8B5091b (iPod touch 2G)|4.1b2]]
  
−
| [[BakerVail 8B5091b (iPod touch 3G)|4.1b2]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8C5091e
  
−
| rowspan="6" | Unavailable
  
−
| [[JasperVail 8C5091e (iPad)|4.2b1]]
  
−
| [[JasperVail 8C5091e (iPhone 3G)|4.2b1]]
  
−
| [[JasperVail 8C5091e (iPhone 3GS)|4.2b1]]
  
−
| [[JasperVail 8C5091e (iPhone 4)|4.2b1]]
  
−
| [[JasperVail 8C5091e (iPod touch 2G)|4.2b1]]
  
−
| [[JasperVail 8C5091e (iPod touch 3G)|4.2b1]]
  
−
| [[JasperVail 8C5091e (iPod touch 4G)|4.2b1]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8C5101c
  
−
| [[JasperVail 8C5101c (iPad)|4.2b2]]
  
−
| [[JasperVail 8C5101c (iPhone 3G)|4.2b2]]
  
−
| [[JasperVail 8C5101c (iPhone 3GS)|4.2b2]]
  
−
| [[JasperVail 8C5101c (iPhone 4)|4.2b2]]
  
−
| [[JasperVail 8C5101c (iPod touch 2G)|4.2b2]]
  
−
| [[JasperVail 8C5101c (iPod touch 3G)|4.2b2]]
  
−
| [[JasperVail 8C5101c (iPod touch 4G)|4.2b2]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8C5115c
  
−
| [[JasperVail 8C5115c (iPad)|4.2b3]]
  
−
| [[JasperVail 8C5115c (iPhone 3G)|4.2b3]]
  
−
| [[JasperVail 8C5115c (iPhone 3GS)|4.2b3]]
  
−
| [[JasperVail 8C5115c (iPhone 4)|4.2b3]]
  
−
| [[JasperVail 8C5115c (iPod touch 2G)|4.2b3]]
  
−
| [[JasperVail 8C5115c (iPod touch 3G)|4.2b3]]
  
−
| [[JasperVail 8C5115c (iPod touch 4G)|4.2b3]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8C134
  
−
| [[JasperVail 8C134 (iPad)|4.2GM]]
  
−
| [[JasperVail 8C134 (iPhone 3G)|4.2GM]]
  
−
| [[JasperVail 8C134 (iPhone 3GS)|4.2GM]]
  
−
| [[JasperVail 8C134 (iPhone 4)|4.2GM]]
  
−
| [[JasperVail 8C134 (iPod touch 2G)|4.2GM]]
  
−
| [[JasperVail 8C134 (iPod touch 3G)|4.2GM]]
  
−
| [[JasperVail 8C134 (iPod touch 4G)|4.2GM]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8C134b
  
−
| [[JasperVail 8C134b (iPad)|4.2GM]]
  
−
| colspan="6" | Unavailable
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8C148
  
−
| [[JasperVail 8C148 (iPad)|4.2.1GM]]
  
−
| [[JasperVail 8C148 (iPhone 3G)|4.2.1GM]]
  
−
| [[JasperVail 8C148 (iPhone 3GS)|4.2.1GM]]
  
−
| [[JasperVail 8C148 (iPhone 4)|4.2.1GM]]
  
−
| [[JasperVail 8C148 (iPod touch 2G)|4.2.1GM]]
  
−
| [[JasperVail 8C148 (iPod touch 3G)|4.2.1GM]]
  
−
| [[JasperVail 8C148 (iPod touch 4G)|4.2.1GM]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 8F5148b
  
−
| Unavailable
  
−
| [[DurangoVail 8F5148b (iPad)|4.3b1]]
  
−
| rowspan="5" | Unavailable
  
−
| [[DurangoVail 8F5148b (iPhone 3GS)|4.3b1]]
  
−
| [[DurangoVail 8F5148b (iPhone 4)|4.3b1]]
  
−
| rowspan="5" | Unavailable
  
−
| [[DurangoVail 8F5148b (iPod touch 3G)|4.3b1]]
  
−
| [[DurangoVail 8F5148b (iPod touch 4G)|4.3b1]]
  
−
|-
  
−
| 2011/01/12
  
−
! style="text-align:left;" | 8F5148c
  
−
| [[DurangoVail 8F5148c (Apple TV 2G)|4.2b1]]
  
−
| Unavailable
  
−
| Unavailable
  
−
| Unavailable
  
−
| Unavailable
  
−
| Unavailable
  
−
|-
  
−
| 2011/01/19
  
−
! style="text-align:left;" | 8F5153d
  
−
| [[DurangoVail 8F5153d (Apple TV 2G)|4.2b2]]
  
−
| [[DurangoVail 8F5153d (iPad)|4.3b2]]
  
−
| [[DurangoVail 8F5153d (iPhone 3GS)|4.3b2]]
  
−
| [[DurangoVail 8F5153d (iPhone 4)|4.3b2]]
  
−
| [[DurangoVail 8F5153d (iPod touch 3G)|4.3b2]]
  
−
| [[DurangoVail 8F5153d (iPod touch 4G)|4.3b2]]
  
−
|-
  
−
| 2011/02/01
  
−
! style="text-align:left;" | 8F5166b
  
−
| [[DurangoVail 8F5166b (Apple TV 2G)|4.2b3]]
  
−
| [[DurangoVail 8F5166b (iPad)|4.3b3]]
  
−
| [[DurangoVail 8F5166b (iPhone 3GS)|4.3b3]]
  
−
| [[DurangoVail 8F5166b (iPhone 4)|4.3b3]]
  
−
| [[DurangoVail 8F5166b (iPod touch 3G)|4.3b3]]
  
−
| [[DurangoVail 8F5166b (iPod touch 4G)|4.3b3]]
  
−
|-
  
−
| 2011/03/03
  
−
! style="text-align:left;" | 8F190
  
−
| Unavailable
  
−
| [[Durango 8F190 (iPad)|4.3GM]]
  
−
| [[Durango 8F190 (iPhone 3GS)|4.3GM]]
  
−
| [[Durango 8F190 (iPhone 4)|4.3GM]]
  
−
| [[Durango 8F190 (iPod touch 3G)|4.3GM]]
  
−
| [[Durango 8F190 (iPod touch 4G)|4.3GM]]
  
−
|}
  
   
−
==== 5.x ====
 +
== See also ==
  +
* [[Application Processor]]
−
Please note that for the Apple TV the firmware listed in this table is the one that your Apple TV reports. See also [[Apple TV Firmware Versions]].
  
−
{| border="1" class="wikitable" style="text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;"
  
−
|-
  
−
! Date (YYYY/MM/DD)
  
−
! Build
  
−
! [[k66ap|Apple TV 2G]]
  
−
! [[j33ap|Apple TV 3G]]
  
−
! [[k48ap|iPad]]
  
−
! [[k93ap|iPad 2 (Wi-Fi)]]
  
−
! [[k94ap|iPad 2 (GSM)]]
  
−
! [[k95ap|iPad 2 (CDMA)]]
  
−
! [[n88ap|iPhone 3GS]]
  
−
! [[n90ap|iPhone 4 (GSM)]]
  
−
! [[n92ap|iPhone 4 (CDMA)]]
  
−
! [[n18ap|iPod touch 3G]]
  
−
! [[n81ap|iPod touch 4G]]
  
−
|-
  
−
| 2011/06/07
  
−
! style="text-align:left;" | 9A5220p
  
−
| [[TellurideVail 9A5220p (Apple TV 2G)|4.4b1]]
  
−
| rowspan="10" | Unavailable
  
−
| [[TellurideVail 9A5220p (iPad)|5.0b1]]
  
−
| [[TellurideVail 9A5220p (iPad 2 Wi-Fi)|5.0b1]]
  
−
| [[TellurideVail 9A5220p (iPad 2 GSM)|5.0b1]]
  
−
| [[TellurideVail 9A5220p (iPad 2 CDMA)|5.0b1]]
  
−
| [[TellurideVail 9A5220p (iPhone 3GS)|5.0b1]]
  
−
| [[TellurideVail 9A5220p (iPhone 4)|5.0b1]]
  
−
| [[TellurideVail 9A5220p (iPhone 4 CDMA)|5.0b1]]
  
−
| [[TellurideVail 9A5220p (iPod touch 3G)|5.0b1]]
  
−
| [[TellurideVail 9A5220p (iPod touch 4G)|5.0b1]]
  
−
|-
  
−
| 2011/06/24
  
−
! style="text-align:left;" | 9A5248d
  
−
| [[TellurideVail 9A5248d (Apple TV 2G)|4.4b2]]
  
−
| [[TellurideVail 9A5248d (iPad)|5.0b2]]
  
−
| [[TellurideVail 9A5248d (iPad 2 Wi-Fi)|5.0b2]]
  
−
| [[TellurideVail 9A5248d (iPad 2 GSM)|5.0b2]]
  
−
| [[TellurideVail 9A5248d (iPad 2 CDMA)|5.0b2]]
  
−
| [[TellurideVail 9A5248d (iPhone 3GS)|5.0b2]]
  
−
| [[TellurideVail 9A5248d (iPhone 4)|5.0b2]]
  
−
| [[TellurideVail 9A5248d (iPhone 4 CDMA)|5.0b2]]
  
−
| [[TellurideVail 9A5248d (iPod touch 3G)|5.0b2]]
  
−
| [[TellurideVail 9A5248d (iPod touch 4G)|5.0b2]]
  
−
|-
  
−
| 2011/07/12
  
−
! style="text-align:left;" | 9A5259f
  
−
| [[TellurideVail 9A5259f (Apple TV 2G)|4.4b3]]
  
−
| [[TellurideVail 9A5259f (iPad)|5.0b3]]
  
−
| [[TellurideVail 9A5259f (iPad 2 Wi-Fi)|5.0b3]]
  
−
| [[TellurideVail 9A5259f (iPad 2 GSM)|5.0b3]]
  
−
| [[TellurideVail 9A5259f (iPad 2 CDMA)|5.0b3]]
  
−
| [[TellurideVail 9A5259f (iPhone 3GS)|5.0b3]]
  
−
| [[TellurideVail 9A5259f (iPhone 4)|5.0b3]]
  
−
| [[TellurideVail 9A5259f (iPhone 4 CDMA)|5.0b3]]
  
−
| [[TellurideVail 9A5259f (iPod touch 3G)|5.0b3]]
  
−
| [[TellurideVail 9A5259f (iPod touch 4G)|5.0b3]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 9A5274d
  
−
| Unavailable
  
−
| [[TellurideVail 9A5274d (iPad)|5.0b4]]
  
−
| [[TellurideVail 9A5274d (iPad 2 Wi-Fi)|5.0b4]]
  
−
| [[TellurideVail 9A5274d (iPad 2 GSM)|5.0b4]]
  
−
| [[TellurideVail 9A5274d (iPad 2 CDMA)|5.0b4]]
  
−
| [[TellurideVail 9A5274d (iPhone 3GS)|5.0b4]]
  
−
| [[TellurideVail 9A5274d (iPhone 4)|5.0b4]]
  
−
| [[TellurideVail 9A5274d (iPhone 4 CDMA)|5.0b4]]
  
−
| [[TellurideVail 9A5274d (iPod touch 3G)|5.0b4]]
  
−
| [[TellurideVail 9A5274d (iPod touch 4G)|5.0b4]]
  
−
|-
  
−
| 2011/08/06
  
−
! style="text-align:left;" | 9A5288d
  
−
| [[TellurideVail 9A5288d (Apple TV 2G)|4.4b5<!-- Keep it as b5 as it is the same build as 5.0b5 -->]]
  
−
| [[TellurideVail 9A5288d (iPad)|5.0b5]]
  
−
| [[TellurideVail 9A5288d (iPad 2 Wi-Fi)|5.0b5]]
  
−
| [[TellurideVail 9A5288d (iPad 2 GSM)|5.0b5]]
  
−
| [[TellurideVail 9A5288d (iPad 2 CDMA)|5.0b5]]
  
−
| [[TellurideVail 9A5288d (iPhone 3GS)|5.0b5]]
  
−
| [[TellurideVail 9A5288d (iPhone 4)|5.0b5]]
  
−
| [[TellurideVail 9A5288d (iPhone 4 CDMA)|5.0b5]]
  
−
| [[TellurideVail 9A5288d (iPod touch 3G)|5.0b5]]
  
−
| [[TellurideVail 9A5288d (iPod touch 4G)|5.0b5]]
  
−
|-
  
−
| 2011/08/19
  
−
! style="text-align:left;" | 9A5302b
  
−
| [[TellurideVail 9A5302b (Apple TV 2G)|4.4b6<!-- Keep it as b6 as it is the same build as 5.0b6 -->]]
  
−
| [[TellurideVail 9A5302b (iPad)|5.0b6]]
  
−
| [[TellurideVail 9A5302b (iPad 2 Wi-Fi)|5.0b6]]
  
−
| [[TellurideVail 9A5302b (iPad 2 GSM)|5.0b6]]
  
−
| [[TellurideVail 9A5302b (iPad 2 CDMA)|5.0b6]]
  
−
| [[TellurideVail 9A5302b (iPhone 3GS)|5.0b6]]
  
−
| [[TellurideVail 9A5302b (iPhone 4)|5.0b6]]
  
−
| [[TellurideVail 9A5302b (iPhone 4 CDMA)|5.0b6]]
  
−
| [[TellurideVail 9A5302b (iPod touch 3G)|5.0b6]]
  
−
| [[TellurideVail 9A5302b (iPod touch 4G)|5.0b6]]
  
−
|-
  
−
| 2011/08/31
  
−
! style="text-align:left;" | 9A5313e
  
−
| [[TellurideVail 9A5313e (Apple TV 2G)|4.4b7<!-- Keep it as b7 as it is the same build as 5.0b7 -->]]
  
−
| [[TellurideVail 9A5313e (iPad)|5.0b7]]
  
−
| [[TellurideVail 9A5313e (iPad 2 Wi-Fi)|5.0b7]]
  
−
| [[TellurideVail 9A5313e (iPad 2 GSM)|5.0b7]]
  
−
| [[TellurideVail 9A5313e (iPad 2 CDMA)|5.0b7]]
  
−
| [[TellurideVail 9A5313e (iPhone 3GS)|5.0b7]]
  
−
| [[TellurideVail 9A5313e (iPhone 4)|5.0b7]]
  
−
| [[TellurideVail 9A5313e (iPhone 4 CDMA)|5.0b7]]
  
−
| [[TellurideVail 9A5313e (iPod touch 3G)|5.0b7]]
  
−
| [[TellurideVail 9A5313e (iPod touch 4G)|5.0b7]]
  
−
|-
  
−
| ?
  
−
! style="text-align:left;" | 9A334
  
−
| Unavailable
  
−
| [[Telluride 9A334 (iPad)|5.0GM]]
  
−
| [[Telluride 9A334 (iPad 2 Wi-Fi)|5.0GM]]
  
−
| [[Telluride 9A334 (iPad 2 GSM)|5.0GM]]
  
−
| [[Telluride 9A334 (iPad 2 CDMA)|5.0GM]]
  
−
| [[Telluride 9A334 (iPhone 3GS)|5.0GM]]
  
−
| [[Telluride 9A334 (iPhone 4)|5.0GM]]
  
−
| [[Telluride 9A334 (iPhone 4 CDMA)|5.0GM]]
  
−
| [[Telluride 9A334 (iPod touch 3G)|5.0GM]]
  
−
| [[Telluride 9A334 (iPod touch 4G)|5.0GM]]
  
−
|-
  
−
| 2011/12/12
  
−
! style="text-align:left;" | 9B5127c
  
−
| [[HoodooVail 9B5127c (Apple TV 2G)|5.0b1]]
  
−
| rowspan="2" colspan="9" | Unavailable
  
−
|-
  
−
| 2011/12/12
  
−
! style="text-align:left;" | 9B5141a
  
−
| [[HoodooVail 9B5141a (Apple TV 2G)|5.0b2]]
  
−
|}
  
   
−
[[Category:VFDecrypt]]
 +
[[Category:Decryption]]

Latest revision as of 10:42, 6 June 2022

Firmware Keys are keys which decrypt bootloaders, ramdisks, and root filesystem of iOS firmware, if those components are encrypted. Apple uses encryption to make it harder to analyze and modify them. Over time Apple changed the way they encrypt firmware files, hence the way to decrypt them and get decryption keys changed as well.

History

With the release of the iPhone came the IMG2 file format. They were used on all known iPhone OS 1.x firmwares. For the 1.1.x series, they were encrypted with the 0x837 key. The discovery of the 0x837 key led to the ability to decrypt any 1.x firmware.

Following IMG2 came the IMG3 file format. They were introduced with iPhone OS 2.0 beta 4, and have been in use ever since. In order to maintain their integrity, they use multiple layers of encryption. Apple took encryption seriously with IMG3 by utilizing AES (based on the Rinjndael key schedule). In terms of the pre-iPhone OS 3 VFDecrypt key, it is stored as plain-text in the "__restore" segment of the ASR image within the ramdisks.

The ramdisk keys can only be retrieved with the processor specific GID Key. The GID key is currently unretrievable and can only be utilized through the built-in AES engine. To complicate things even more, the engine is only accessible through a special bootrom or iBoot exploit (jailbreaks typically expose it with /dev/aes_0). This makes usage of the key nearly impossible.

However, once you have access to the AES engine, the entire system falls apart. You are able to upload an encrypted ramdisk and grab the decryption keys for it. Once you manage to decrypt the ramdisk, you can run it through GenPass to decrypt the firmware key.

To find the keys, you can either use the methods on AES Keys or the easier option for OS X, keylimepie.

Decrypting

Main article: Decrypting Firmwares

Notes

Certain files share the same key and IV per application processor (per build) provided the devices have the same pixel resolution:

You can use img3decrypt or xpwntool to decrypt these files as described in Decrypting Firmwares. Once done, mount or extract using the tool of your choice.

The firmware version number for the Apple TV builds are the ones that the Apple TV reports (also known as the "marketing version").

All dates are relative to UTC.

GID AES is used by iBoot to decrypt firmware images. When iBoot loads the kernelcache, GID AES is disabled. This means in order to get firmware keys, you must gain code execution in a setting where GID AES is still enabled. In most cases, this means exploiting iBoot itself, before the kernelcache is loaded.

Firmware Versions

See also: Prototypes

This is a full and comprehensive list of all firmwares Apple Inc. has made available to the public in some way, be it the dev center or iTunes. This list also contains a few firmwares for which there never was an IPSW (as far as can be told) such as 4.2.5 for the CDMA iPhone 4 (iPhone3,3). These few builds came preinstalled on the device, but are not available for download.

See also

Retrieved from "https://www.theiphonewiki.com/w/index.php?title=Firmware_Keys&oldid=122962"