The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information.

Difference between revisions of "Firmware Keys"

From The iPhone Wiki
Jump to: navigation, search
(→‎7.x: ATV 5.4b3)
(moving in)
Line 1: Line 1:
 
__NOTOC__
  
__NOTOC__
−
'''VFDecrypt Keys''' are the keys which can decrypt the files that come with the ([[Beta Firmware|beta]]) [[firmware]]. Apple uses a [[wikipedia:Public-key cryptography|public/private key encryption]] to ensure the safety of their files. Over time Apple has changed the way to encrypt firmware files, thus the way to decrypt files as well as the way to get the keys has also.
+
'''VFDecrypt Keys''' are keys which decrypt the [[:/|root filesystem]] of certain ([[Beta Firmware|beta]]) [[firmware]]s. Apple uses a to ensure the safety of their files. Over time Apple has changed the way to encrypt firmware files, thus the way to decrypt files as well as the way to get the keys has also.
   
  +
== Background ==
−
[[S5L File Formats#IMG2|IMG2]] was the file format used prior to [[iOS|iPhone OS]] 2.0. For iPhone OS 1.1.x, IMG2 files were encrypted with [[AES Keys#Key 0x837|Key 0x837]].
  
  +
With the release of the iPhone came the [[S5L File Formats#IMG2|IMG2]] file format. They were used on all known [[iOS|iPhone OS]] [[#1.x|1.x]] firmwares. For the 1.1.x series, they were encrypted with the [[AES Keys#Key 0x837|0x837 key]]. The discovery of the 0x837 key led to the ability to decrypt ''any'' 1.x firmware.
   
  +
Following IMG2 came the [[IMG3 File Format|IMG3]] file format. They were introduced with iPhone OS [[#1.x.2F2.x|2.0b4]], and have been in use ever since. In order to maintain their integrity, they contain multiple layers of encryption, all based around a [[wikipedia:Public-key cryptography|public/private key]] encryption method. Apple took encryption seriously with IMG3 by utilizing [[wikipedia:Advanced Encryption Standard|AES]] (based on the [[wikipedia:Rijndael key schedule|Rinjndael key schedule]]). In order to complicate things, they contain the [[VFDecrypt]] key, albeit encrypted, as part of the [[KBAG]] structure in the [[ramdisk]]s.
−
[[IMG3 File Format|IMG3]] encrypted files contain encrypted versions of the VFDecrypt Keys as part of the [[KBAG]] (key bag). These can be decrypted with the [[GID-key]]. For jailbroken iDevices the VFDecrypt keys can be retrieved with the devices [[AES Keys|hardware AES engine]]. The VFDecrypt key for the root filesystem (the biggest file) image of an [[iDevice]] requires either a decrypted [[Restore Ramdisk]] or [[Update Ramdisk]]. Once you have a decrypted Restore or Update Ramdisk, [[GenPass]] can be used to gather the keys for the root filesystem.
  
   
  +
The ramdisk keys can ''only'' be retrieved with the processor specific [[GID Key]]. The GID key is currently unretrievable and can only be utilized through the built-in [[AES Keys|AES engine]]. To complicate things ''even more'', the engine is only accessible through a special [[bootrom]] exploit ([[jailbreak]]s typically expose it with [[:/dev/aes_0]]). This makes usage of the key nearly impossible.
−
For the root filesystem there is one key per device model, with no IV. You can mount this once it has been decrypted using your program of choice. (For example, 7-zip on Windows (after extracting the DMG on Windows, extract the biggest file with [[wikipedia:7-Zip|7-Zip]])
  
  +
  +
However, once you have access to the AES engine, the entire system falls apart. You are able to upload an encrypted ramdisk and grab the decryption keys for it. Once you manage to decrypt the ramdisk, you can run it through [[GenPass]] to decrypt the VFDecrypt key.
  +
  +
Beginning with iOS 6.0b1, Apple<!-- most likely --> decided to tweak their disk images so they no longer work with VFDecrypt. VFDecrypt will report that the filesystem is decrypted, but you will be unable to mount it. The current workaround is to use [[dmg]] from [[Xpwn]] to decrypt them. What has changed to break VFDecrypt is currently unknown. Decryption will take slightly longer due to dmg writing its progress to the terminal, but the difference is negligible.
  +
  +
== Decrypting 3.0GM+ Firmware ==
  +
=== [[S5L8900]] ===
  +
To decrypt a firmware file, decrypt the encrypted key and IV in the [[KBAG]] using [[GIDecrypt]], or OpenSSL with the key 5F650295E1FFFC97CE77ABD49DD955B3 and the iv 0
  +
  +
=== [[S5L8720]] ===
  +
Business as usual, but keys and IVs have to be decrypted on the device still, unlike with the new [[S5L8900]] [[KBAG]]s. Apple incorrectly assumed that by encrypting iBEC and iBSS they were being sly. They were not. You can decrypt those on a 2.2.1 aes setup no problem whatsoever.
  +
  +
=== [[S5L8920]] ===
  +
The [[n88ap|iPhone 3GS]] firmware files are interesting. They have two [[KBAG]]s, which use AES-256 instead of the [[S5L8900]] and [[S5L8720]] that are using AES-128 still. The first KBAG has an identifier in it's header indicating that it is to be decrypted with the gid key, and the second is not known. For those that don't know how AES256 works, this now means that the first 0x10 bytes are the IV, and the remaining 0x20 bytes (not 0x10 anymore!) are the key.
   
 
== Notes ==
  
== Notes ==
Line 73: Line 88:
   
 
All dates are relative to [[wikipedia:Coordinated Universal Time|UTC]].
  
All dates are relative to [[wikipedia:Coordinated Universal Time|UTC]].
−  
−
[[iOS]] 6.0b1 and higher no longer work with [[VFDecrypt]]. You need to use [[dmg]][https://github.com/planetbeing/xpwn/tree/master/hfs] to decrypt these. The decryption process is longer as it writes the progress to the terminal unlike [[VFDecrypt]].
  
−  
−
== Decrypting 3.0GM+ Firmware ==
  
−
=== [[S5L8900]] ===
  
−
To decrypt a firmware file, decrypt the encrypted key and IV in the [[KBAG]] using [[GIDecrypt]], or OpenSSL with the key 5F650295E1FFFC97CE77ABD49DD955B3 and the iv 0
  
−  
−
=== [[S5L8720]] ===
  
−
Business as usual, but keys and IVs have to be decrypted on the device still, unlike with the new [[S5L8900]] [[KBAG]]s. Apple incorrectly assumed that by encrypting iBEC and iBSS they were being sly. They were not. You can decrypt those on a 2.2.1 aes setup no problem whatsoever.
  
−  
−
=== [[S5L8920]] ===
  
−
The [[n88ap|iPhone 3GS]] firmware files are interesting. They have two [[KBAG]]s, which use AES-256 instead of the [[S5L8900]] and [[S5L8720]] that are using AES-128 still. The first KBAG has an identifier in it's header indicating that it is to be decrypted with the gid key, and the second is not known. For those that don't know how AES256 works, this now means that the first 0x10 bytes are the IV, and the remaining 0x20 bytes (not 0x10 anymore!) are the key.
  
   
 
== Firmware Versions ==
  
== Firmware Versions ==

Revision as of 00:07, 4 August 2013

VFDecrypt Keys are keys which decrypt the root filesystem of certain (beta) firmwares. Apple uses a to ensure the safety of their files. Over time Apple has changed the way to encrypt firmware files, thus the way to decrypt files as well as the way to get the keys has also.

Background

With the release of the iPhone came the IMG2 file format. They were used on all known iPhone OS 1.x firmwares. For the 1.1.x series, they were encrypted with the 0x837 key. The discovery of the 0x837 key led to the ability to decrypt any 1.x firmware.

Following IMG2 came the IMG3 file format. They were introduced with iPhone OS 2.0b4, and have been in use ever since. In order to maintain their integrity, they contain multiple layers of encryption, all based around a public/private key encryption method. Apple took encryption seriously with IMG3 by utilizing AES (based on the Rinjndael key schedule). In order to complicate things, they contain the VFDecrypt key, albeit encrypted, as part of the KBAG structure in the ramdisks.

The ramdisk keys can only be retrieved with the processor specific GID Key. The GID key is currently unretrievable and can only be utilized through the built-in AES engine. To complicate things even more, the engine is only accessible through a special bootrom exploit (jailbreaks typically expose it with /dev/aes_0). This makes usage of the key nearly impossible.

However, once you have access to the AES engine, the entire system falls apart. You are able to upload an encrypted ramdisk and grab the decryption keys for it. Once you manage to decrypt the ramdisk, you can run it through GenPass to decrypt the VFDecrypt key.

Beginning with iOS 6.0b1, Apple decided to tweak their disk images so they no longer work with VFDecrypt. VFDecrypt will report that the filesystem is decrypted, but you will be unable to mount it. The current workaround is to use dmg from Xpwn to decrypt them. What has changed to break VFDecrypt is currently unknown. Decryption will take slightly longer due to dmg writing its progress to the terminal, but the difference is negligible.

Decrypting 3.0GM+ Firmware

S5L8900

To decrypt a firmware file, decrypt the encrypted key and IV in the KBAG using GIDecrypt, or OpenSSL with the key 5F650295E1FFFC97CE77ABD49DD955B3 and the iv 0

S5L8720

Business as usual, but keys and IVs have to be decrypted on the device still, unlike with the new S5L8900 KBAGs. Apple incorrectly assumed that by encrypting iBEC and iBSS they were being sly. They were not. You can decrypt those on a 2.2.1 aes setup no problem whatsoever.

S5L8920

The iPhone 3GS firmware files are interesting. They have two KBAGs, which use AES-256 instead of the S5L8900 and S5L8720 that are using AES-128 still. The first KBAG has an identifier in it's header indicating that it is to be decrypted with the gid key, and the second is not known. For those that don't know how AES256 works, this now means that the first 0x10 bytes are the IV, and the remaining 0x20 bytes (not 0x10 anymore!) are the key.

Notes

Application Processor iDevice
S5L8900 iPhone 2G
iPhone 3G
iPod touch 1G
S5L8720 iPod touch 2G
S5L8920 iPhone 3GS
S5L8922 iPod touch 3G
S5L8930 (A4) iPad 1G
iPhone 4
iPod touch 4G
Apple TV 2G
S5L8940 (A5) iPad 2
iPhone 4S
S5L8942 (A5 Rev A) iPad 2 (Wi‑Fi) [Rev A]
Apple TV 3G
iPod touch 5G
iPad mini
S5L8945 (A5X) iPad 3
S5L8947 (A5 Rev B) Apple TV 3G (Rev A)
S5L8950 (A6) iPhone 5
S5L8955 (A6X) iPad 4

Certain files share the same key and IV per application processor (per build):

The table on the right lists the application processors and their corrosponding devices. This list is also accessable from the main page.

You can use img3decrypt[1] or xpwntool[2] to decrypt these files as described in Ramdisk Decryption. Once done, mount or extract using the tool of your choice.

When posting a key page, please use the key template (IN THE CORRECT ORDER) and do NOT substitute it.

The firmware version number for the Apple TV builds are the ones that the Apple TV reports.

All dates are relative to UTC.

Firmware Versions

See also: Prototypes

This is a full and comprehensive list of all firmwares Apple Inc. has made available to the public in some way, be it the dev center or iTunes.

Final

Main article: Firmware

1.x

Date Build iPhone iPod touch
2G 1G
29 Jun 2007 1A543a 1.0 N/A
31 Jul 2007 1C25 1.0.1
21 Aug 2007 1C28 1.0.2
14 Sep 2007 3A100a N/A 1.1
3A101a 1.1
27 Sep 2007 3A109a 1.1.1 N/A
3A110a N/A 1.1.1
12 Nov 2007 3B48b 1.1.2 1.1.2
15 Jan 2008 4A93 1.1.3 1.1.3
26 Feb 2008 4A102 1.1.4 1.1.4
14 Jul 2008 4B1 N/A 1.1.5

2.x

Date Build iPhone iPod touch
2G 3G 1G 2G
11 Jul 2008 5A345 N/A 2.0 N/A N/A
5A347 2.0 2.0 2.0
04 Aug 2008 5B108 2.0.1 2.0.1 2.0.1
18 Aug 2008 5C1 2.0.2 2.0.2 2.0.2
12 Sep 2008 5F136 2.1 2.1 N/A
09 Sep 2008 5F137 N/A 2.1
5F138 N/A 2.1.1
21 Nov 2008 5G77 2.2 2.2 2.2 N/A
5G77a N/A 2.2
27 Jan 2009 5H11 2.2.1 2.2.1 2.2.1 N/A
5H11a N/A 2.2.1

3.x

Date Build iPad iPhone iPod touch
1G 2G 3G 3GS 1G 2G 3G
17 Jun 2009 7A341 N/A 3.0 3.0 3.0 3.0 3.0 N/A
31 Jul 2009 7A400 3.0.1 3.0.1 3.0.1 N/A
09 Sep 2009 7C144 3.1 3.1 3.1
7C145 N/A 3.1.1 3.1.1 3.1.1
17 Sep 2009 7C146 N/A 3.1.1
08 Oct 2009 7D11 N/A 3.1.2 3.1.2 3.1.2 3.1.2 3.1.2 3.1.2
02 Feb 2010 7E18 3.1.3 3.1.3 3.1.3 3.1.3 3.1.3 3.1.3
03 Apr 2010 7B367 3.2 N/A
15 Jul 2010 7B405 3.2.1
11 Aug 2010 7B500 3.2.2

4.x

Date Build Apple TV iPad iPhone iPod touch
2G 1G 2 3G 3GS 4 2G 3G 4G
Wi‑Fi GSM CDMA GSM CDMA
01 Sep 2010 8M89 4.1 N/A
21 Jun 2010 8A293 N/A 4.0 4.0 4.0 N/A 4.0 4.0 N/A
15 Jul 2010 8A306 4.0.1 4.0.1 4.0.1 N/A
11 Aug 2010 8A400 4.0.2 4.0.2 4.0.2 N/A 4.0.2 4.0.2 N/A
08 Sep 2010 8B117 4.1 4.1 4.1 4.1 4.1 4.1
21 Sep 2010 8B118 N/A 4.1
22 Nov 2010 8C148 N/A 4.2.1 N/A 4.2.1 N/A 4.2.1 N/A 4.2.1 4.2.1 4.2.1
8C148a N/A 4.2.1 N/A
22 Nov 2010 8C150 4.2 N/A
14 Dec 2010 8C154 4.2.1
07 Feb 2010 8E128 N/A 4.2.5 N/A
10 Feb 2010 8E200 4.2.6
14 Apr 2011 8E303 4.2.7
04 May 2011 8E401 4.2.8
15 Jul 2011 8E501 4.2.9
25 Jul 2011 8E600 4.2.10
09 Mar 2011 8F190 N/A 4.3 N/A 4.3 4.3 N/A 4.3 4.3
8F191 N/A 4.3 4.3 4.3 N/A
11 Mar 2011 8F191m 4.3 N/A
22 Mar 2011 8F202 4.3
10 May 2011 8F305 4.3
01 Aug 2011 8F455 4.3
25 Mar 2011 8G4 N/A 4.3.1 4.3.1 4.3.1 4.3.1 N/A 4.3.1 4.3.1 N/A 4.3.1 4.3.1
14 Apr 2011 8H7 4.3.2 4.3.2 4.3.2 N/A 4.3.2 4.3.2 4.3.2 4.3.2
8H8 N/A 4.3.2 N/A
04 May 2011 8J2 N/A 4.3.3 4.3.3 4.3.3 N/A 4.3.3 4.3.3 N/A 4.3.3 4.3.3
8J3 N/A 4.3.3 N/A
15 Jul 2011 8K2 4.3.4 4.3.4 4.3.4 4.3.4 N/A 4.3.4 4.3.4 N/A 4.3.4 4.3.4
25 Jul 2011 8L1 4.3.5 4.3.5 4.3.5 4.3.5 4.3.5 4.3.5 4.3.5 4.3.5

5.x

Date Build Apple TV iPad iPhone iPod touch
2G 3G 1G 2 3 3GS 4 4S 3G 4G
Wi‑Fi GSM CDMA Wi‑Fi (A) Wi-Fi CDMA Global GSM CDMA
12 Oct 2011 9A334 N/A 5.0 5.0 5.0 5.0 N/A 5.0 5.0 5.0 5.0 5.0 5.0
9A334v 4.4 N/A
18 Oct 2011 9A335a 4.4.1
02 Nov 2011 9A336a 4.4.2
10 Nov 2011 9A405 N/A 5.0.1 5.0.1 5.0.1 5.0.1 N/A 5.0.1 5.0.1 5.0.1 5.0.1 5.0.1 5.0.1
17 Nov 2011 9A405l 4.4.3 N/A
15 Dec 2011 9A406 N/A 5.0.1 N/A
9A406a 4.4.4 N/A
07 Mar 2012 9B176 N/A 5.1 5.1 5.1 5.1 5.1 5.1 5.1 5.1 5.1 5.1 5.1 N/A 5.1 5.1
9B179 N/A 5.1 N/A
9B179b 5.0 5.0 N/A
10 May 2012 9B206 N/A 5.1.1 5.1.1 5.1.1 5.1.1 5.1.1 5.1.1 5.1.1 5.1.1 5.1.1 5.1.1 5.1.1 5.1.1 5.1.1 5.1.1
9B206f 5.0.1 5.0.1 N/A
25 May 2012 9B208 N/A 5.1.1 N/A
05 Jun 2012 9B830 5.0.2 5.0.2 N/A

6.x

Date Build Apple TV iPad iPad mini iPhone iPod touch
2G 3G 2 3 4 1G 3GS 4 4S 5 4G 5G
Orig Rev A Wi‑Fi GSM CDMA Wi‑Fi (A) Wi‑Fi CDMA Global Wi‑Fi GSM Global Wi‑Fi GSM Global GSM GSM (A) CDMA GSM Global
19 Sep 2012 10A403 N/A 6.0 6.0 6.0 6.0 6.0 6.0 6.0 N/A 6.0 6.0 6.0 6.0 6.0 N/A 6.0 N/A
10A405 N/A 6.0 6.0 N/A
10A406 N/A 6.0
30 Oct 2012 N/A 6.0 N/A
24 Sep 2012 10A406e 5.1 5.1 N/A
30 Oct 2012 10A407 N/A 6.0 N/A
01 Nov 2012 10A523 N/A 6.0.1 6.0.1 6.0.1 6.0.1 6.0.1 6.0.1 6.0.1 6.0.1 N/A 6.0.1 N/A 6.0.1 6.0.1 6.0.1 6.0.1 6.0.1 N/A 6.0.1 6.0.1
10A525 N/A 6.0.1 6.0.1 N/A
09 Nov 2012 10A8426 N/A 6.0.1 6.0.1 N/A 6.0.1 6.0.1 N/A
26 Nov 2012 10A831 5.1.1 5.1.1 5.1.1 N/A
19 Dec 2012 10A550 N/A 6.0.2 N/A
10A551 N/A 6.0.2 6.0.2 N/A
10A8550 N/A 6.0.2 6.0.2 N/A
28 Jan 2013 10B141 N/A 6.1 6.1 6.1 6.1 6.1 6.1 6.1 6.1 6.1 6.1 6.1 6.1 6.1 6.1 N/A 6.1 N/A 6.1
10B142 N/A 6.1 N/A
10B143 N/A 6.1 6.1 N/A
10B144 N/A 6.1 6.1 N/A 6.1 N/A
10B144b 5.2 5.2 5.2 N/A
11 Feb 2013 10B145 N/A 6.1.1 N/A
19 Feb 2013 10B146 N/A 6.1.2 6.1.2 6.1.2 6.1.2 6.1.2 6.1.2 6.1.2 6.1.2 N/A 6.1.2 N/A 6.1.2 6.1.2 6.1.2 6.1.2 6.1.2 6.1.2 6.1.2 6.1.2 6.1.2
10B147 N/A 6.1.2 6.1.2 N/A 6.1.2 6.1.2 N/A
19 Mar 2013 10B329 N/A 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3 6.1.3
10B329a 5.2.1 5.2.1 5.2.1 N/A
02 May 2013 10B350 N/A 6.1.4 6.1.4 N/A
19 Jun 2013 10B809 5.3 5.3 5.3 N/A

Beta

Main article: Beta Firmware

1.x/2.x

Date Build iPhone iPod touch
2G 3G 1G
06 Mar 2008 5A147p 1.2b N/A 1.2b
27 Mar 2008 5A225c 2.0b2 2.0b2
08 Apr 2008 5A240d 2.0b3 2.0b3
23 Apr 2008 5A258f 2.0b4 2.0b4
06 May 2008 5A274d 2.0b5 2.0b5
28 May 2008 5A292g 2.0b6P 2.0b6P
29 May 2008 5A308 2.0b6F 2.0b6F
09 Jun 2008 5A331 2.0b7 2.0b7
26 Jun 2008 5A345 2.0b8GM 2.0b8GM
24 Jul 2008 5F90 2.1b 2.1b
30 Jul 2008 ? 2.1b2 2.1b2
08 Aug 2008 ? 2.1b3 2.1b3
16 Aug 2008 ? 2.1b4 2.1b4
25 Sep 2008 5G29 2.2b 2.2b 2.2b
24 Oct 2008 ? 2.2b2 2.2b2 2.2b2

3.x

Date Build iPhone iPod touch
2G 3G 3GS 1G 2G
17 Mar 2009 7A238j 3.0b 3.0b N/A 3.0b 3.0b
31 Mar 2009 7A259g 3.0b2 3.0b2 3.0b2 3.0b2
14 Apr 2009 7A280f 3.0b3 3.0b3 3.0b3 3.0b3
28 Apr 2009 7A300g 3.0b4 3.0b4 3.0b4 3.0b4
06 May 2009 7A312g 3.0b5 3.0b5 3.0b5 3.0b5
08 Jun 2009 7A341 3.0GM 3.0GM 3.0GM 3.0GM
30 Jun 2009 7C97d 3.1b 3.1b 3.1b 3.1b 3.1b
14 Jul 2009 7C106c 3.1b2 3.1b2 3.1b2 3.1b2 3.1b2
27 Jul 2009 7C116a 3.1b3 3.1b3 3.1b3 3.1b3 3.1b3

4.x

Date Build Apple TV iPad iPhone iPod touch
2G 1G 3G 3GS 4 2G 3G 4G
GSM
08 Apr 2010 8A230m N/A 4.0b 4.0b N/A 4.0b 4.0b N/A
20 Apr 2010 8A248c 4.0b2 4.0b2 4.0b2 4.0b2
04 May 2010 8A260b 4.0b3 4.0b3 4.0b3 4.0b3
18 May 2010 8A274b 4.0b4 4.0b4 4.0b4 4.0b4
07 Jun 2010 8A293 4.0GM 4.0GM 4.0GM 4.0GM
14 Jul 2010 8B5080 N/A 4.1b 4.1b
8B5080c N/A 4.1b 4.1b 4.1b N/A
27 Jul 2010 8B5091b 4.1b2 4.1b2 4.1b2 4.1b2 4.1b2 N/A
03 Aug 2010 8B5097d 4.1b3 4.1b3 4.1b3 4.1b3 4.1b3
15 Sep 2010 8C5091e N/A 4.2b 4.2b 4.2b 4.2b 4.2b 4.2b 4.2b
28 Sep 2010 8C5101c 4.2b2 4.2b2 4.2b2 4.2b2 4.2b2 4.2b2 4.2b2
12 Oct 2010 8C5115c 4.2b3 4.2b3 4.2b3 4.2b3 4.2b3 4.2b3 4.2b3
01 Nov 2010 8C134 4.2GM 4.2GM 4.2GM 4.2GM 4.2GM 4.2GM 4.2GM
18 Nov 2010 8C134b 4.2GM2 N/A
18 Nov 2010 8C148 4.2.1GM 4.2.1GM 4.2.1GM 4.2.1GM 4.2.1GM 4.2.1GM 4.2.1GM
12 Jan 2011 8F5148b 4.3b N/A 4.3b 4.3b N/A 4.3b 4.3b
12 Jan 2011 8F5148c 4.2b N/A
19 Jan 2011 8F5153d 4.2b2 4.3b2 N/A 4.3b2 4.3b2 N/A 4.3b2 4.3b2
01 Feb 2011 8F5166b 4.2b3 4.3b3 4.3b3 4.3b3 4.3b3 4.3b3
03 Mar 2011 8F190 N/A 4.3GM 4.3GM 4.3GM 4.3GM 4.3GM

5.x

Date Build Apple TV iPad iPhone iPod touch
2G 1G 2 3GS 4 4S 3G 4G
Wi‑Fi GSM CDMA GSM CDMA
07 Jun 2011 9A5220p 4.4b 5.0b 5.0b 5.0b 5.0b 5.0b 5.0b 5.0b N/A 5.0b 5.0b
24 Jun 2011 9A5248d 4.4b2 5.0b2 5.0b2 5.0b2 5.0b2 5.0b2 5.0b2 5.0b2 5.0b2 5.0b2
11 Jul 2011 9A5259f 4.4b3 5.0b3 5.0b3 5.0b3 5.0b3 5.0b3 5.0b3 5.0b3 5.0b3 5.0b3
22 Jul 2011 9A5274d N/A 5.0b4 5.0b4 5.0b4 5.0b4 5.0b4 5.0b4 5.0b4 5.0b4 5.0b4
06 Aug 2011 9A5288d 4.4b5 5.0b5 5.0b5 5.0b5 5.0b5 5.0b5 5.0b5 5.0b5 5.0b5 5.0b5
19 Aug 2011 9A5302b 4.4b6 5.0b6 5.0b6 5.0b6 5.0b6 5.0b6 5.0b6 5.0b6 5.0b6 5.0b6
31 Aug 2011 9A5313e 4.4b7 5.0b7 5.0b7 5.0b7 5.0b7 5.0b7 5.0b7 5.0b7 5.0b7 5.0b7
04 Oct 2011 9A334 N/A 5.0GM 5.0GM 5.0GM 5.0GM 5.0GM 5.0GM 5.0GM 5.0GM 5.0GM
02 Nov 2011 9A402 5.0.1b 5.0.1b 5.0.1b 5.0.1b 5.0.1b 5.0.1b 5.0.1b 5.0.1b 5.0.1b 5.0.1b
04 Nov 2011 9A404 5.0.1b2 5.0.1b2 5.0.1b2 5.0.1b2 5.0.1b2 5.0.1b2 5.0.1b2 5.0.1b2 5.0.1b2 5.0.1b2
28 Nov 2011 9B5117b 5.1b1 5.1b 5.1b 5.1b 5.1b 5.1b 5.1b 5.1b 5.1b 5.1b
12 Dec 2011 9B5127c 5.0b2 5.1b2 5.1b2 5.1b2 5.1b2 5.1b2 5.1b2 5.1b2 5.1b2 5.1b2 5.1b2
09 Jan 2012 9B5141a 5.0b3 5.1b3 5.1b3 5.1b3 5.1b3 5.1b3 5.1b3 5.1b3 5.1b3 5.1b3 5.1b3

6.x

Date Build Apple TV iPad iPad mini iPhone iPod touch
2G 3G 2 3 4 1G 3GS 4 4S 5 4G 5G
Wi‑Fi GSM CDMA Wi‑Fi (A) Wi‑Fi CDMA Global Wi‑Fi GSM Global Wi‑Fi GSM Global GSM GSM (A) CDMA GSM Global
11 Jun 2012 10A5316k 5.1b 5.1b 6.0b 6.0b 6.0b 6.0b 6.0b 6.0b 6.0b N/A 6.0b 6.0b N/A 6.0b 6.0b N/A 6.0b N/A
25 Jun 2012 10A5338d 5.1b2 5.1b2 6.0b2 6.0b2 6.0b2 6.0b2 6.0b2 6.0b2 6.0b2 6.0b2 6.0b2 6.0b2 6.0b2 6.0b2
16 Jul 2012 10A5355d 5.1b3 5.1b3 6.0b3 6.0b3 6.0b3 6.0b3 6.0b3 6.0b3 6.0b3 6.0b3 6.0b3 6.0b3 6.0b3 6.0b3
06 Aug 2012 10A5376e 5.1b4 5.1b4 6.0b4 6.0b4 6.0b4 6.0b4 6.0b4 6.0b4 6.0b4 6.0b4 6.0b4 6.0b4 6.0b4 6.0b4
12 Sep 2012 10A403 N/A 6.0GM 6.0GM 6.0GM 6.0GM 6.0GM 6.0GM 6.0GM 6.0GM 6.0GM 6.0GM 6.0GM 6.0GM
01 Nov 2012 10B5095f 6.1b 6.1b 6.1b 6.1b 6.1b 6.1b 6.1b 6.1b N/A 6.1b N/A 6.1b 6.1b 6.1b 6.1b 6.1b 6.1b 6.1b 6.1b
12 Nov 2012 10B5105c 5.2b2 5.2b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2 6.1b2
03 Dec 2012 10B5117b 5.2b3 5.2b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3 6.1b3
17 Dec 2012 10B5126b 5.2b4 5.2b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4 6.1b4
26 Jan 2013 10B141 N/A 6.1b5 6.1b5 6.1b5 6.1b5 6.1b5 6.1b5 6.1b5 6.1b5 6.1b5 6.1b5 6.1b5 6.1b5 6.1b5 6.1b5 N/A 6.1b5 N/A 6.1b5
10B142 N/A 6.1b5 N/A
10B143 N/A 6.1b5 6.1b5 N/A
10B144 N/A 6.1b5 6.1b5 N/A 6.1b5 N/A
6 Feb 2013 10B311 N/A 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b 6.1.1b
21 Feb 2013 10B318 N/A 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2
10B318a N/A 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 6.1.3b2 N/A

7.x

Date Build Apple TV iPad iPad mini iPhone iPod touch
2G 3G 2 3 4 1G 4 4S 5 5G
Orig Rev A Wi‑Fi GSM CDMA Wi‑Fi (A) Wi‑Fi CDMA Global Wi‑Fi GSM Global Wi‑Fi GSM Global GSM GSM (A) CDMA GSM Global
10 Jun 2013 11A4372q 5.4b 5.4b 5.4b N/A 7.0b 7.0b 7.0b 7.0b 7.0b 7.0b 7.0b
24 Jun 2013 11A4400f 5.4b2 5.4b2 5.4b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2 7.0b2
08 Jul 2013 11a4414e N/A 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3 7.0b3
29 Jul 2013 11A4435d 5.4b3 5.4b3 5.4b3 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4 7.0b4
Retrieved from "https://www.theiphonewiki.com/w/index.php?title=Firmware_Keys&oldid=33365"