Firmware Keys

Introduction

These keys are for use with the tool "VFDecrypt" to decrypt the root filesystem DMG found in every IPSW. The DMG that you are after is the bigger one, in the case of the most recent builds, it can sometimes be more than 400MB!

VFDecrypt Usage

mac: ./vfdecrypt -i <dmg> -o decrypted_fs.dmg -k <key> 
windows: vfdecrypt.exe -i <dmg> -o decrypted_fs.dmg -k <key>

Gaps

As you will notice, there may be a gap or two, or a key for a current build that is not there. Please feel free to add them, but please be sure that it is only the key for a User or Developer build, as if you gave the key for another type of build that might or may not be out there people could get in trouble, and we do not want that. Thanks for contributing!

Notes

The root filesystem is by far the largest (300+ MB in the case of iOS 4), for which there is one key per device model, with no IV. Use VFDecrypt to decrypt this. You can mount/this once it has been decrypted using your program of choice. (For example, 7-zip on Windows.)

The Update and Restore ramdisks share the same IV and key per type of Application Processor (current choices are S5L8900 in the iPhone 3G, S5L8720 in the iPod touch 2G, S5L8920 in the iPhone 3GS, and S5L8922 in the iPod touch 3G). Use img3decrypt or xpwntool to decrypt these. Likewise, once this is decrypted, you can mount this as well, using the tool of your choice.

You may find Ramdisk Decryption to be helpful.

For those wanting to decrypt their own keys, you must use GenPass to get the keys for 4.x.

Downloads

Program Name	Creator	Credit	GitHub	Interface	Windows (x86)	Windows (x64)	Mac OS X (Universal)	Mac OS X (Intel)	Mac OS X (PowerPC)	Linux Installer (.deb)	Linux Installer (.rpm)	Linux (.tar.gz)	Haiku	Solaris (x86)	Solaris (x64)	Solaris (SPARC)	Solaris (PowerPC)
AutoDecrypt	Unknown	None	None	GUI/CLI	No	No	No	No	No	No	No	No	No	No	No	No	No
DMG Decrypter	MCTD81	None	None	GUI	No	No	No	DMG Decrypter Blog	No	No	No	No	No	No	No	No	No
iDecrypt	bennyyboi	Maybach Dev Team member bennyyboi	None	GUI	FileDen HTTP MediaFire HTTP	Use 32-bit version.	No	No	No	No	No	No	No	No	No	No	No
iDecryptIt	Balloonhead66	VFDecrypt	None	GUI	No	No	No	No	No	No	No	No	No	No	No	No	No
iDecrypter	Fallensn0w	VFDecrypt	fallensn0w's iDecrypter	GUI	GitHub HTTP	Use 32-bit version.	No	No	No	No	No	No	No	No	No	No	No
VFDecrypt	Unknown	http://lorenzo.yellowspace.net/corrupt-sparseimage.html	dra1nerdrake's VFDecrypt	CLI	Google Code HTTP	Use 32-bit version.	RGov.org HTTP	YellowSpace HTTP	YellowSpace HTTP	No	No	Google Code HTTP	No	No	No	No	No

Firmware versions

Table of Links to Keys

	1.x	2.x	3.x	4.x
Beta		Keys	Keys	Keys
Final	Keys		Keys

Final

Main Article: Firmware

	iPhone	iPhone 3G	iPhone 3GS	iPhone 4	iPod touch	iPod touch 2G	iPod touch 3G	iPod touch 4G	iPad	Apple TV 2G
1.0	1A420	no	no	no	no	no	no	no	no	no
1.0.0	1A543a
1.0.1	1C25
1.0.2	1C28
1.1	no				3A100a+3A101a
1.1.1	3A110a				3A110a
1.1.2	3B48b				3B48b
1.1.3	4A93				4A93
1.1.4	4A102				4A102
1.1.5	no				4B1
2.0	5A347	5A345+5A347			5A347
2.0.1	5B108	5B108			5B108
2.0.2	5C1	5C1			5C1
2.1	5F136	5F136			5F137
2.1.1	no	no			5F138	no
2.2	5G77	5G77			5G77	5G77
2.2.1	5H11	5H11			5H11	5H11a
3.0	7A341	7A341	7A341		7A341	7A341
3.0.1	7A400	7A400	7A400		no	no
3.1	7C144	7C144	7C144		no	no
3.1.1	only for iPod touches				7C145	7C145	7C145+7C146
3.1.2	7D11	7D11	7D11		7D11	7D11	7D11
3.1.3	7E18	7E18	7E18		7E18	7E18	7E18
3.2	Firmware 3.2.x is only for iPad								7B367	Firmware 3.2.x is only for iPad
3.2.1									7B405
3.2.2									7B500
4.0	no more supported	8A293	8A293	8A293	no more supported	8A293	8A293	no	not yet supported	no
4.0.1		8A306	8A306	8A306		only fix for iPhones
4.0.2		8A400	8A400	8A400		8A400	8A400	no
4.1		8B117	8B117	8B117		8B117	8B117	8B117+8B118		8M89

Beta

Main Article: Beta Firmware

	iPhone	iPhone 3G	iPhone 3GS	iPhone 4	iPod touch	iPod touch 2G	iPod touch 3G	iPod touch 4G	iPad	Apple TV 2G
1.2b1	5A147p	no	no	no	5A147p	no	no	no	no	no
2.0b2	5A225c				5A225c
2.0b3	5A240d				5A240d
2.0b4	5A258f				5A258f
2.0b5	5A274d				5A274d
2.0b6P	5A292g				5A292g
2.0b6F	5A308				5A308
2.0b7	5A331				5A331
3.0b1	7A238j	7A238j			7A238j	7A238j
3.0b2	7A259g	7A259g			7A259g	7A259g
3.0b3	7A280f	7A280f			7A280f	7A280f
3.0b4	7A300g	7A300g			7A300g	7A300g
3.0b5	7A312g	7A312g			7A312g	7A312g
3.1b1	7C97d	7C97d	7C97d		no	no
3.1b2	7C106c	7C106c	7C106c
4.0b1	no more supported	8A230m	8A230m		no more supported	8A230m	8A230m		not yet supported
4.0b2		8A248c	8A248c			8A248c	8A248c
4.0b3		8A260b	8A260b			8A260b	8A260b
4.0b4		8A274b	8A274b			8A274b	8A274b
4.0GM		8A293	8A293			8A293	8A293
4.1b1		8B5080c	8B5080c	8B5080c		8B5080 (?)	8B5080 (?)
4.2b3		8C5115c	8C5115c	8C5115c		8C5115c	8C5115c	8C5115c	8C5115c	?
4.2GM		8C134	8C134	8C134		8C134	8C134	8C134	8C134	?