TigrisAni 15A93261h

This article discusses software internally used by Apple. Acquiring a copy without Apple's consent is illegal and may result in being scammed. Engaging in illegal activity is not condoned. This information is provided for educational purposes only.

Background

This firmware is an internal NonUI version of iOS 11.0. It has been seen on various iPhone 8 prototype units. Similarly to other recent builds, this one has a rather large filesize - a dump of its filesystem is around 9.1 GB.

Interestingly, this build contains kernels for Apple A7 to A11 processors, including differfent processor varieties. This has previously not been the case since iOS version 7.0. It also appears to support an unreleased processor type known as t8020. Based on previous NonUI firmwares having support for as of then unreleased processors - it's safe to assume that this processor is most likely the Apple A12 or A11X.

iPhone 8 prototype running 15A93261h

Notable Changes

This build is known to have various differences compared to previous builds, which will be listed here.

• T500AP and T501AP - Wi-Fi drivers for these unknown board identifiers can be found in /AppleInternal/Diags/WifiFirmware/ alongside the iPhone 8 (D20AP) and iPhone 8 Plus (D21AP).

• mach.kasan - apart from the usual mach.development.{Processor Name / Identifier} files found within NonUI builds - this build contains a new type of file - known as mach.kasan. It is currently unknown what the purpose of this new filetype is, since it has not been encountered in previous firmwares.

• Tailspin / Ariadne - A readme file located within /AppleInternal/tailspin references a previously unheard of application known as Ariadne, as well as "tailspin" files. The readme states that "tailspin holds onto 20-30 seconds of historical spindump and Ariadne data, from before the sysdiagnose invocation." The Ariadne application appears to be used for the visualization of these tailspin files.

• Firmware references - In the same readme - two iOS firmwares are referenced - Tigris 15A221 (an apparent version of iOS 11.0) and Lobo 17A202. Judging by the build number of the latter firmware compared to the standard build number scheme - it seems that this is a future version of iOS that has yet to be released, being newer than iOS 11.

• Test scripts - Located in AppleInternal/CoreOS/AppleSEP/unit_tests/hilo, these test scripts seem to communicate with the Secure Enclave. The scripts are written to only work on D22AP, the iPhone X, meaning that they may be used to test various sensors in the TrueDepth sensor housing. They contain multiple references to a display module with the codename Hilo.

Applications

This firmware contains many applications launchable from SwitchBoard.app, however roughly half of them are hidden by default:

• AltoMobile
• CoexBlender (hidden)
• NonUIConsoleViewer
• ExtendedOQC
• FactoryStencil
• GrapeCal
• GrapeCal_Lite
• LCDMura (hidden)
• LcdUTest (hidden)
• MesaCal
• Ness (hidden)
• NonUIQRCode (hidden)
• Operator (hidden)
• OrbCal
• Pippi (hidden)
• Reliability
• Reliability (again) (hidden)
• Sequencer
• Spelunx
• USBHost
• WiPASmini
• ThermalDOE (hidden)