The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "Firmware Keys"
m (→6.x) |
m (→7.x) |
||
Line 1,871: | Line 1,871: | ||
|- |
|- |
||
! rowspan="2" | [[k66ap|2G]] |
! rowspan="2" | [[k66ap|2G]] |
||
− | ! |
+ | ! colspan="2" | [[Apple TV 3G|3G]] |
− | ! rowspan="2" | [[j33iap|3G (A)]] |
||
! colspan="4" | [[iPad 2|2]] |
! colspan="4" | [[iPad 2|2]] |
||
! colspan="3" | [[iPad 3|3]] |
! colspan="3" | [[iPad 3|3]] |
||
Line 1,882: | Line 1,881: | ||
! rowspan="2" | [[iPod touch 5G|5G]] |
! rowspan="2" | [[iPod touch 5G|5G]] |
||
|- |
|- |
||
+ | ! [[j33ap|Orig]] |
||
+ | ! [[j33iap|Rev A]] |
||
! [[k93ap|Wi‑Fi]] |
! [[k93ap|Wi‑Fi]] |
||
! [[k94ap|GSM]] |
! [[k94ap|GSM]] |
Revision as of 01:25, 16 June 2013
VFDecrypt Keys are the keys which can decrypt the files that come with the (beta) firmware. Apple uses a public/private key encryption to ensure the safety of their files. Over time Apple has changed the way to encrypt firmware files, thus the way to decrypt files as well as the way to get the keys has also.
IMG2 was the file format used prior to iPhone OS 2.0. For iPhone OS 1.1.x, IMG2 files were encrypted with Key 0x837.
IMG3 encrypted files contain encrypted versions of the VFDecrypt Keys as part of the KBAG (key bag). These can be decrypted with the GID-key. For jailbroken iDevices the VFDecrypt keys can be retrieved with the devices hardware AES engine. The VFDecrypt key for the root filesystem (the biggest file) image of an iDevice requires either a decrypted Restore Ramdisk or Update Ramdisk. Once you have a decrypted Restore or Update Ramdisk, GenPass can be used to gather the keys for the root filesystem.
For the root filesystem there is one key per device model, with no IV. You can mount this once it has been decrypted using your program of choice. (For example, 7-zip on Windows (after extracting the DMG on Windows, extract the biggest file with 7-Zip)
Notes
Application Processor | iDevice |
---|---|
S5L8900 | iPhone 2G iPhone 3G iPod touch 1G |
S5L8720 | iPod touch 2G |
S5L8920 | iPhone 3GS |
S5L8922 | iPod touch 3G |
S5L8930 (A4) | iPad 1G iPhone 4 iPod touch 4G Apple TV 2G |
S5L8940 (A5) | iPad 2 iPhone 4S |
S5L8942 (A5 Rev A) | iPad 2 (Wi‑Fi) [Rev A] Apple TV 3G iPod touch 5G iPad mini |
S5L8945 (A5X) | iPad 3 |
S5L8947 (A5 Rev B) | Apple TV 3G (Rev A) |
S5L8950 (A6) | iPhone 5 |
S5L8955 (A6X) | iPad 4 |
Certain files share the same key and IV per application processor (per build):
- Update Ramdisk
- Restore Ramdisk
- AppleLogo
- BatteryCharging0
- BatteryCharging1
- BatteryFull
- BatteryLow0
- BatteryLow1
- GlyphCharging
- GlyphPlugin
- Kernelcache
- NeedService
- RecoveryMode
- WTF?
The table on the right lists the application processors and their corrosponding devices. This list is also accessable from the main page.
You can use img3decrypt[1] or xpwntool[2] to decrypt these files as described in Ramdisk Decryption. Once done, mount or extract using the tool of your choice.
When posting a key page, please use the key template (IN THE CORRECT ORDER) and do NOT substitute it.
The firmware version number for the Apple TV builds are the ones that the Apple TV reports.
All dates are relative to UTC.
iOS 6.0b1 and higher no longer work with VFDecrypt. You need to use dmg[3] to decrypt these. The decryption process is longer as it writes the progress to the terminal unlike VFDecrypt.
Decrypting 3.0GM+ Firmware
S5L8900
To decrypt a firmware file, decrypt the encrypted key and IV in the KBAG using GIDecrypt, or OpenSSL with the key 5F650295E1FFFC97CE77ABD49DD955B3 and the iv 0
S5L8720
Business as usual, but keys and IVs have to be decrypted on the device still, unlike with the new S5L8900 KBAGs. Apple incorrectly assumed that by encrypting iBEC and iBSS they were being sly. They were not. You can decrypt those on a 2.2.1 aes setup no problem whatsoever.
S5L8920
The iPhone 3GS firmware files are interesting. They have two KBAGs, which use AES-256 instead of the S5L8900 and S5L8720 that are using AES-128 still. The first KBAG has an identifier in it's header indicating that it is to be decrypted with the gid key, and the second is not known. For those that don't know how AES256 works, this now means that the first 0x10 bytes are the IV, and the remaining 0x20 bytes (not 0x10 anymore!) are the key.
Firmware Versions
This is a full and comprehensive list of all firmwares Apple Inc. has made available to the public in some way, be it the dev center or iTunes.
Final
- Main article: Firmware
1.x
Date | Build | iPhone | iPod touch |
---|---|---|---|
2G | 1G | ||
29 Jun 2007 | 1A543a | 1.0 | N/A |
31 Jul 2007 | 1C25 | 1.0.1 | |
21 Aug 2007 | 1C28 | 1.0.2 | |
14 Sep 2007 | 3A100a | N/A | 1.1 |
3A101a | 1.1 | ||
27 Sep 2007 | 3A109a | 1.1.1 | N/A |
3A110a | N/A | 1.1.1 | |
12 Nov 2007 | 3B48b | 1.1.2 | 1.1.2 |
15 Jan 2008 | 4A93 | 1.1.3 | 1.1.3 |
26 Feb 2008 | 4A102 | 1.1.4 | 1.1.4 |
15 Jul 2008 | 4B1 | N/A | 1.1.5 |
2.x
Date | Build | iPhone | iPod touch | ||
---|---|---|---|---|---|
2G | 3G | 1G | 2G | ||
11 Jul 2008 | 5A345 | N/A | 2.0 | N/A | N/A |
5A347 | 2.0 | 2.0 | 2.0 | ||
04 Aug 2008 | 5B108 | 2.0.1 | 2.0.1 | 2.0.1 | |
18 Aug 2008 | 5C1 | 2.0.2 | 2.0.2 | 2.0.2 | |
12 Sep 2008 | 5F136 | 2.1 | 2.1 | N/A | |
09 Sep 2008 | 5F137 | N/A | 2.1 | ||
5F138 | N/A | 2.1.1 | |||
21 Nov 2008 | 5G77 | 2.2 | 2.2 | 2.2 | N/A |
5G77a | N/A | 2.2 | |||
27 Jan 2009 | 5H11 | 2.2.1 | 2.2.1 | 2.2.1 | N/A |
5H11a | N/A | 2.2.1 |
3.x
Date | Build | iPad | iPhone | iPod touch | ||||
---|---|---|---|---|---|---|---|---|
1G | 2G | 3G | 3GS | 1G | 2G | 3G | ||
17 Jun 2009 | 7A341 | N/A | 3.0 | 3.0 | 3.0 | 3.0 | 3.0 | N/A |
31 Jul 2009 | 7A400 | 3.0.1 | 3.0.1 | 3.0.1 | N/A | |||
09 Sep 2009 | 7C144 | 3.1 | 3.1 | 3.1 | ||||
7C145 | N/A | 3.1.1 | 3.1.1 | 3.1.1 | ||||
17 Sep 2009 | 7C146 | N/A | 3.1.1 | |||||
08 Oct 2009 | 7D11 | N/A | 3.1.2 | 3.1.2 | 3.1.2 | 3.1.2 | 3.1.2 | 3.1.2 |
02 Feb 2010 | 7E18 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.3 | |
03 Apr 2010 | 7B367 | 3.2 | N/A | |||||
15 Jul 2010 | 7B405 | 3.2.1 | ||||||
11 Aug 2010 | 7B500 | 3.2.2 |
4.x
Date | Build | Apple TV | iPad | iPhone | iPod touch | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2G | 1G | 2 | 3G | 3GS | 4 | 2G | 3G | 4G | |||||
Wi‑Fi | GSM | CDMA | GSM | CDMA | |||||||||
01 Sep 2010 | 8M89 | 4.0 | N/A | ||||||||||
21 Jun 2010 | 8A293 | N/A | 4.0 | 4.0 | 4.0 | N/A | 4.0 | 4.0 | N/A | ||||
15 Jul 2010 | 8A306 | 4.0.1 | 4.0.1 | 4.0.1 | N/A | ||||||||
11 Aug 2010 | 8A400 | 4.0.2 | 4.0.2 | 4.0.2 | N/A | 4.0.2 | 4.0.2 | N/A | |||||
08 Sep 2010 | 8B117 | 4.1 | 4.1 | 4.1 | 4.1 | 4.1 | 4.1 | ||||||
21 Sep 2010 | 8B118 | N/A | 4.1 | ||||||||||
22 Nov 2010 | 8C148 | N/A | 4.2.1 | N/A | 4.2.1 | N/A | 4.2.1 | N/A | 4.2.1 | 4.2.1 | 4.2.1 | ||
8C148a | N/A | 4.2.1 | N/A | ||||||||||
22 Nov 2010 | 8C150 | 4.1 | N/A | ||||||||||
14 Dec 2010 | 8C154 | 4.1.1 | |||||||||||
07 Feb 2010 | 8E128 | N/A | 4.2.5 | N/A | |||||||||
10 Feb 2010 | 8E200 | 4.2.6 | |||||||||||
14 Apr 2011 | 8E303 | 4.2.7 | |||||||||||
04 May 2011 | 8E401 | 4.2.8 | |||||||||||
15 Jul 2011 | 8E501 | 4.2.9 | |||||||||||
25 Jul 2011 | 8E600 | 4.2.10 | |||||||||||
09 Mar 2011 | 8F190 | N/A | 4.3 | N/A | 4.3 | 4.3 | N/A | 4.3 | 4.3 | ||||
8F191 | N/A | 4.3 | 4.3 | 4.3 | N/A | ||||||||
11 Mar 2011 | 8F191m | 4.2 | N/A | ||||||||||
22 Mar 2011 | 8F202 | 4.2.1 | |||||||||||
11 Mar 2011 | 8F305 | 4.2.2 | |||||||||||
01 Aug 2011 | 8F455 | 4.3 | |||||||||||
25 Mar 2011 | 8G4 | N/A | 4.3.1 | 4.3.1 | 4.3.1 | 4.3.1 | N/A | 4.3.1 | 4.3.1 | N/A | 4.3.1 | 4.3.1 | |
14 Apr 2011 | 8H7 | 4.3.2 | 4.3.2 | 4.3.2 | N/A | 4.3.2 | 4.3.2 | 4.3.2 | 4.3.2 | ||||
8H8 | N/A | 4.3.2 | N/A | ||||||||||
04 May 2011 | 8J2 | N/A | 4.3.3 | 4.3.3 | 4.3.3 | N/A | 4.3.3 | 4.3.3 | N/A | 4.3.3 | 4.3.3 | ||
8J3 | N/A | 4.3.3 | N/A | ||||||||||
15 Jul 2011 | 8K2 | 4.3.4 | 4.3.4 | 4.3.4 | 4.3.4 | N/A | 4.3.4 | 4.3.4 | N/A | 4.3.4 | 4.3.4 | ||
25 Jul 2011 | 8L1 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 |
5.x
Date | Build | Apple TV | iPad | iPhone | iPod touch | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2G | 3G | 1G | 2 | 3 | 3GS | 4 | 4S | 3G | 4G | ||||||||
Wi‑Fi | GSM | CDMA | Wi‑Fi (A) | Wi-Fi | CDMA | Global | GSM | CDMA | |||||||||
12 Oct 2011 | 9A334 | N/A | 5.0 | 5.0 | 5.0 | 5.0 | N/A | 5.0 | 5.0 | 5.0 | 5.0 | 5.0 | 5.0 | ||||
9A334v | 4.4 | N/A | |||||||||||||||
18 Oct 2011 | 9A335a | 4.4.1 | |||||||||||||||
02 Nov 2011 | 9A336a | 4.4.2 | |||||||||||||||
10 Nov 2011 | 9A405 | N/A | 5.0.1 | 5.0.1 | 5.0.1 | 5.0.1 | N/A | 5.0.1 | 5.0.1 | 5.0.1 | 5.0.1 | 5.0.1 | 5.0.1 | ||||
17 Nov 2011 | 9A405l | 4.4.3 | N/A | ||||||||||||||
15 Dec 2011 | 9A406 | N/A | 5.0.1 | N/A | |||||||||||||
9A406a | 4.4.4 | N/A | |||||||||||||||
07 Mar 2012 | 9B176 | N/A | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | N/A | 5.1 | 5.1 | |
9B179 | N/A | 5.1 | N/A | ||||||||||||||
9B179b | 5.0 | 5.0 | N/A | ||||||||||||||
10 May 2012 | 9B206 | N/A | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | |
9B206f | 5.0.1 | 5.0.1 | N/A | ||||||||||||||
25 May 2012 | 9B208 | N/A | 5.1.1 | N/A | |||||||||||||
05 Jun 2012 | 9B830 | 5.0.2 | 5.0.2 | N/A |
6.x
Beta
- Main article: Beta Firmware
1.x/2.x
Date | Build | iPhone | iPod touch | |
---|---|---|---|---|
2G | 3G | 1G | ||
06 Mar 2008 | 5A147p | 1.2b1 | N/A | 1.2b1 |
27 Mar 2008 | 5A225c | 2.0b2 | 2.0b2 | |
08 Apr 2008 | 5A240d | 2.0b3 | 2.0b3 | |
23 Apr 2008 | 5A258f | 2.0b4 | 2.0b4 | |
06 May 2008 | 5A274d | 2.0b5 | 2.0b5 | |
28 May 2008 | 5A292g | 2.0b6P | 2.0b6P | |
29 May 2008 | 5A308 | 2.0b6F | 2.0b6F | |
09 Jun 2008 | 5A331 | 2.0b7 | 2.0b7 | |
26 Jun 2008 | 5A345 | 2.0b8GM | 2.0b8GM | |
24 Jul 2008 | 5F90 | 2.1b1 | 2.1b1 | |
30 Jul 2008 | ? | 2.1b2 | 2.1b2 | |
08 Aug 2008 | ? | 2.1b3 | 2.1b3 | |
16 Aug 2008 | ? | 2.1b4 | 2.1b4 | |
25 Sep 2008 | 5G29 | 2.2b1 | 2.2b1 | 2.2b1 |
24 Oct 2008 | ? | 2.2b2 | 2.2b2 | 2.2b2 |
3.x
Date | Build | iPhone | iPod touch | |||
---|---|---|---|---|---|---|
2G | 3G | 3GS | 1G | 2G | ||
17 Mar 2009 | 7A238j | 3.0b1 | 3.0b1 | N/A | 3.0b1 | 3.0b1 |
31 Mar 2009 | 7A259g | 3.0b2 | 3.0b2 | 3.0b2 | 3.0b2 | |
14 Apr 2009 | 7A280f | 3.0b3 | 3.0b3 | 3.0b3 | 3.0b3 | |
28 Apr 2009 | 7A300g | 3.0b4 | 3.0b4 | 3.0b4 | 3.0b4 | |
06 May 2009 | 7A312g | 3.0b5 | 3.0b5 | 3.0b5 | 3.0b5 | |
08 Jun 2009 | 7A341 | 3.0GM | 3.0GM | 3.0GM | 3.0GM | |
30 Jun 2009 | 7C97d | 3.1b1 | 3.1b1 | 3.1b1 | 3.1b1 | 3.1b1 |
14 Jul 2009 | 7C106c | 3.1b2 | 3.1b2 | 3.1b2 | 3.1b2 | 3.1b2 |
27 Jul 2009 | 7C116a | 3.1b3 | 3.1b3 | 3.1b3 | 3.1b3 | 3.1b3 |
4.x
Date | Build | Apple TV | iPad | iPhone | iPod touch | ||||
---|---|---|---|---|---|---|---|---|---|
2G | 1G | 3G | 3GS | 4 | 2G | 3G | 4G | ||
GSM | |||||||||
08 Apr 2010 | 8A230m | N/A | 4.0b1 | 4.0b1 | N/A | 4.0b1 | 4.0b1 | N/A | |
20 Apr 2010 | 8A248c | 4.0b2 | 4.0b2 | 4.0b2 | 4.0b2 | ||||
04 May 2010 | 8A260b | 4.0b3 | 4.0b3 | 4.0b3 | 4.0b3 | ||||
18 May 2010 | 8A274b | 4.0b4 | 4.0b4 | 4.0b4 | 4.0b4 | ||||
07 Jun 2010 | 8A293 | 4.0GM | 4.0GM | 4.0GM | 4.0GM | ||||
14 Jul 2010 | 8B5080 | N/A | 4.1b1 | 4.1b1 | |||||
8B5080c | N/A | 4.1b1 | 4.1b1 | 4.1b1 | N/A | ||||
27 Jul 2010 | 8B5091b | 4.1b2 | 4.1b2 | 4.1b2 | 4.1b2 | 4.1b2 | N/A | ||
03 Aug 2010 | 8B5097d | 4.1b3 | 4.1b3 | 4.1b3 | 4.1b3 | 4.1b3 | |||
15 Sep 2010 | 8C5091e | N/A | 4.2b1 | 4.2b1 | 4.2b1 | 4.2b1 | 4.2b1 | 4.2b1 | 4.2b1 |
28 Sep 2010 | 8C5101c | 4.2b2 | 4.2b2 | 4.2b2 | 4.2b2 | 4.2b2 | 4.2b2 | 4.2b2 | |
12 Oct 2010 | 8C5115c | 4.2b3 | 4.2b3 | 4.2b3 | 4.2b3 | 4.2b3 | 4.2b3 | 4.2b3 | |
01 Nov 2010 | 8C134 | 4.2GM | 4.2GM | 4.2GM | 4.2GM | 4.2GM | 4.2GM | 4.2GM | |
18 Nov 2010 | 8C134b | 4.2GM | N/A | ||||||
18 Nov 2010 | 8C148 | 4.2.1GM | 4.2.1GM | 4.2.1GM | 4.2.1GM | 4.2.1GM | 4.2.1GM | 4.2.1GM | |
12 Jan 2011 | 8F5148b | 4.3b1 | N/A | 4.3b1 | 4.3b1 | N/A | 4.3b1 | 4.3b1 | |
12 Jan 2011 | 8F5148c | 4.2b1 | N/A | ||||||
19 Jan 2011 | 8F5153d | 4.2b2 | 4.3b2 | N/A | 4.3b2 | 4.3b2 | N/A | 4.3b2 | 4.3b2 |
01 Feb 2011 | 8F5166b | 4.2b3 | 4.3b3 | 4.3b3 | 4.3b3 | 4.3b3 | 4.3b3 | ||
03 Mar 2011 | 8F190 | N/A | 4.3GM | 4.3GM | 4.3GM | 4.3GM | 4.3GM |
5.x
6.x
7.x
Date | Build | Apple TV | iPad | iPad mini | iPhone | iPod touch | ||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2G | 3G | 2 | 3 | 4 | 1G | 4 | 4S | 5 | 5G | |||||||||||||||
Orig | Rev A | Wi‑Fi | GSM | CDMA | Wi‑Fi (A) | Wi‑Fi | CDMA | Global | Wi‑Fi | GSM | Global | Wi‑Fi | GSM | Global | GSM | GSM (A) | CDMA | GSM | Global | |||||
10 Jun 2013 | 11A4372q | 5.4b1 | 5.4b1 | 5.4b1 | N/A | 7.0b1 | 7.0b1 | 7.0b1 | 7.0b1 | 7.0b1 | 7.0b1 | 7.0b1 |