IBSS commands

You can access this command list by typing "help" after iBSS is uploaded.

       bootx            boot a kernel cache at specified address
       tsys             boot into tsys (if present)
       diags            boot into diagnostics (if present)
       setpicture       set the image on the display
       bgcolor          set the display background color
       poweroff         power off the device
       halt             halt the system (good for JTAG)
       reboot           reboot the device
       run              use contents of enironment var as script
       script           run script at specific address
       go               jump directly to address
       mws              memory write - string
       mwb              memory write - 8bit
       mwh              memory write - 16bit
       mw               memory write - 32bit
       mdb              memory display - 8bit
       mdh              memory display - 16bit
       md               memory display - 32bit
       ramdisk          create a radisk from the specified address
       powernvram       Access Power NVRAM.
       charge           Manage the charger chip.
       devicetree       create a device tree from the specified address
       saveenv          save current environment to flash
       syscfg           flash SysCfg inspection
       chunk            chunk a file
       arm7_stop        stop the arm7
       arm7_go          start the arm7 with a downloaded image
       iic              iic read/write
       usb              run a USB command
       sha1             SHA-1 hash of memory
       crc              POSIX 1003.2 checksum of memory
       clearenv         clear all environment variables
       setenv           set an environment variable
       printenv         print one or all environment variables
       image            flash image inspection
       pki              PKI
       bdev             block device commands

command descriptions

(Recovery) iPhone$ usb
Usage:
       usb get <filename> [address] [amount]
       usb get tftp://servername.com/file.bin [address] [amount]
       usb put <filename> <amount> [address]
(Recovery) iPhone$ pki
not enough arguments.
pki verify <cert-chain-as-concatenated-der-blobs-data> <length>  <signature-blob-data> <length> <hash-blob-data> <length>
       verify-image <8900-1.0-image-data> <length>
(Recovery) iPhone$ bdev
not enough arguments
usage:
bdev list
bdev read <dev> <offset> <len> [<address>]
bdev write <dev> <offset> [<len>] [<address>]
bdev memcmp <dev> <offset> [<len>] [<address>]
bdev erase <dev> <offset> <len>
(Recovery) iPhone$ image
not enough arguments.
image list [<detailed>]
image load [<type>|memory] [<address>]
(Recovery) iPhone$ printenv
 config_board = 'n72ap'
 loadaddr = '0x9000000'
 boot-command = 'fsboot'
 idle-off = 'true'
 boot-device = 'nand0'
 boot-partition = '0'
 boot-path = '/System/Library/Caches/com.apple.kernelcaches/kernelcache.s5l8720x'
 display-color-space = 'RGB888'
 display-timing = 'n72'
P bootdelay = '0'
P platform-uuid = 
P backlight-level = '56'
P debug-uarts = '4'
P auto-boot = 'false'
 image-version = '0x3'
 framebuffer = '0xfb04000'
 secure-boot = '0x1'
 ? = '0xfffffff'
(Recovery) iPhone$ crc
not enough arguments.
crc <address> <len>
(Recovery) iPhone$ sha1
not enough arguments.
sha1 <address> <len>
(Recovery) iPhone$ iic
not enough arguments.
iic read <bus> <iicaddr> <len>
iic readreg <bus> <iicaddr> <reg> <len>
iic write <bus> <iicaddr> <data0> <data1> ...
(Recovery) iPhone$ chunk
Enter a sub-command

Commands:
       put_test
       get_test
(Recovery) iPhone$ syscfg
0x53724e6d 'SrNm'  0x30304539 0x48453134 0x00333032 0x00000000
0x46774964 'FwId'  0x01000000 0x00000000 0x000a2700 0x00000000
0x48775672 'HwVr'  0x00000000 0x00000000 0x00000000 0x00000000
0x48774964 'HwId'  0x00000000 0x00000000 0x00000000 0x00000000
0x53775672 'SwVr'  0x00000000 0x00000000 0x00000000 0x00000000
(Recovery) iPhone$ saveenv
0x4d4c424e 'MLBN'  0x00000000 0x00000000 0x00000000 0x00000000
0x4d6f6423 'Mod#'  0x3335424d 0x00000031 0x00000000 0x00000000
0x5265676e 'Regn'  0x412f4446 0x00000000 0x00000000 0x00000000
0x4d4c4223 'MLB#'  0x30394339 0x50393237 0x5a323437 0x00000041
(Recovery) iPhone$ devicetree
0x42617474 'Batt'  0x42617474 0x00000012 0x00001fd8 0xffffffff
0x53425672 'SBVr'  0x00000031 0x00000000 0x00000000 0x00000000
0x4d74436c 'MtCl'  0x4d74436c 0x00000100 0x00001ed8 0xffffffff
(Recovery) iPhone$ powernvram
usage:
       powernvram <command>
               list                  List NVRAM Properties.
               set <prop#> <value>   Set NVRAM Property.
(Recovery) iPhone$ powernvram list
0: [iBootState] 0x00
1: [iBootDebug] 0x00
2: [iBootStage] 0x00
3: [iBootErrorCount] 0x05
4: [iBootErrorStage] 0x30
(Recovery) iPhone$ md
0x09000000: e59f3014 e3a02a02  e1c320b0 e3e02000
0x09000010: e2833c9d e58326c0  eafffffe 2200f300
0x09000020: 00000000 00000000  00000000 00000000
0x09000030: 00000000 00000000  00000000 00000000
0x09000040: 00000000 00000000  00000000 00000000
0x09000050: 00000000 00000000  00000000 00000000
0x09000060: 00000000 00000000  00000000 00000000
0x09000070: 00000000 00000000  00000000 00000000
0x09000090: 00000000 00000000  00000000 00000000
0x090000a0: 00000000 00000000  00000000 00000000
0x090000b0: 00000000 00000000  00000000 00000000
0x090000c0: 00000000 00000000  00000000 00000000
0x090000d0: 00000000 00000000  00000000 00000000
0x090000e0: 00000000 00000000  00000000 00000000
0x090000f0: 00000000 00000000  00000000 00000000
(Recovery) iPhone$ mdh
0x09000100: 0000 0000 0000 0000  0000 0000 0000 0000
0x09000110: 0000 0000 0000 0000  0000 0000 0000 0000
0x09000120: 0000 0000 0000 0000  0000 0000 0000 0000
0x09000130: 0000 0000 0000 0000  0000 0000 0000 0000
0x09000140: 0000 0000 0000 0000  0000 0000 0000 0000
0x09000150: 0000 0000 0000 0000  0000 0000 0000 0000
0x09000160: 0000 0000 0000 0000  0000 0000 0000 0000
0x09000170: 0000 0000 0000 0000  0000 0000 0000 000
0x09000180: 0000 0000 0000 0000  0000 0000 0000 0000
0x09000190: 0000 0000 0000 0000  0000 0000 0000 0000
0x090001a0: 0000 0000 0000 0000  0000 0000 0000 0000
0x090001b0: 0000 0000 0000 0000  0000 0000 0000 0000
0x090001c0: 0000 0000 0000 0000  0000 0000 0000 0000
0x090001d0: 0000 0000 0000 0000  0000 0000 0000 0000
0x090001e0: 0000 0000 0000 0000  0000 0000 0000 0000
0x090001f0: 0000 0000 0000 0000  0000 0000 0000 0000
59f3014 (Recovery) iPhone$ mdd
(Recovery) iPhone$ mdb
0x09000200: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x09000210: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x09000220: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x09000230: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x09000240: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x09000250: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x09000260: 00 00 00 0 00 00 00 00  00 00 00 00 00 00 00 00
0x09000270: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x09000280: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x09000290: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x090002a0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x090002b0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x090002c0: 00 00 00 00 00 00 00 00  00 0000 00 00 00 00 00
0x090002d0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x090002e0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
0x090002f0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
(Recovery) iPhone$ mw
mw [<address>] 
(Recovery) iPhone$ mwh
mwh [<address>] 
(Recovery) iPhone$ mwb
mwb [<address>] 
(Recovery) iPhone$ mws
mws [<address>] 
(Recovery) iPhone$ bgcolor
wrong number of args.
bgcolor <red> <green> <blue>
(Recovery) iPhone$ setpicture
wrong number of args.
setpicture update? [<addr> [<size>]]
(Recovery) iPhone$ tsys
boot_flash: could not find image
(Recovery) iPhone$ diags
boot_flash: could not find image
(Recovery) iPhone$ run
run <variable>
(Recovery) iPhone$ script
running script at 0x9000000
finished running script (EOF at 0x900000c)
0??*?? ??

?SYNTAX ERROR
]      POSIX 1003.2 cpresent)
(Recovery) iPhone$ bootx
Attempting to validate kernelcache @ 0x09000000
(Recovery) iPhone$  usb_control_msg(iDev, 0x21, 2, 0, 0, 0, 0, 1000)
Kernelcache image not valid
error loading kernelcache

Commands from iBoot

An asterisk (*) next to a name means that the command is disabled.

JOB_SPEC [&]                       (( expression ))
. filename [arguments]             :
[ arg... ]                         expression 
alias [-p] [name[=value] ... ]     bg [job_spec ...]
bind [-lpvsPVS] [-m keymap] [-f fi break [n]
builtin [shell-builtin [arg ...]]  caller [EXPR]
case WORD in [PATTERN [| PATTERN]. cd [-L|-P] [dir]
command [-pVv] command [arg ...]   compgen [-abcdefgjksuv] [-o option
complete [-abcdefgjksuv] [-pr] [-o continue [n]
declare [-afFirtx] [-p] [name[=val dirs [-clpv] [+N] [-N]
disown [-h] [-ar] [jobspec ...]    echo [-neE] [arg ...]
enable [-pnds] [-a] [-f filename]  eval [arg ...]
exec [-cl] [-a name] file [redirec exit [n]
export [-nf] [name[=value] ...] or false
fc [-e ename] [-nlr] [first] [last fg [job_spec]
for NAME [in WORDS ... ;] do COMMA for (( exp1; exp2; exp3 )); do COM
function NAME { COMMANDS ; } or NA getopts optstring name [arg]
hash [-lr] [-p pathname] [-dt] [na help [-s] [pattern ...]
history [-c] [-d offset] [n] or hi if COMMANDS; then COMMANDS; [ elif
jobs [-lnprs] [jobspec ...] or job kill [-s sigspec | -n signum | -si
let arg [arg ...]                  local name[=value] ...
logout                             popd [+N | -N] [-n]
printf [-v var] format [arguments] pushd [dir | +N | -N] [-n]
pwd [-LP]                          read [-ers] [-u fd] [-t timeout] [
readonly [-af] [name[=value] ...]  return [n]
select NAME [in WORDS ... ;] do CO set [--abefhkmnptuvxBCHP] [-o opti
shift [n]                          shopt [-pqsu] [-o long-option] opt
source filename [arguments]        suspend [-f]
test [expr]                        time [-p] PIPELINE
times                              trap [-lp] [arg signal_spec ...]
true                               type [-afptP] name [name ...]
typeset [-afFirtx] [-p] name[=valu ulimit [-SHacdfilmnpqstuvx] [limit
umask [-p] [-S] [mode]             unalias [-a] name [name ...]
unset [-f] [-v] [name ...]         until COMMANDS; do COMMANDS; done
variables - Some variable names an wait [n]
while COMMANDS; do COMMANDS; done  { COMMANDS ; }