IPSW File Format

"IPSW" redirects here. For the component of XPwn, see ipsw.

See also: Disk Image Formats

IPSW (iPod^[1] Software) files have the Magic Number 504B0304 (PK\003\004) and thus are ZIP archives. They can be modified with typical zip/unzip tools (i.e. change extension to .zip and double click). IPSWs are used to deliver the device's firmware to the end-user.

Archive Structure

• Restore Ramdisk
• Update Ramdisk (some firmwares don't have one due to various reasons)
• Filesystem (the largest .dmg file)
• Device Tree (model specific)
• Kernelcache (model specific; processor specific on pre-A4)
• BuildManifest.plist (first appeared in iPhone OS 3.0 beta 2)
• Restore.plist
• Firmware/
  • all_flash/
    • all_flash.XXXXX.production/ (model specific i.e. M68AP, N82AP, etc.)
      • IMG2/IMG3 files
      • manifest
  • dfu/
    • iBEC.XXXXX.dfu (model specific i.e. M68AP, N82AP, etc.)
    • iBSS.XXXXX.dfu
    • WTF.XXXXX.dfu (model specific and only for M68AP, N82AP, N45AP, N72AP; not present in firmwares for the iPhone 3GS and later, because it was used to patch issues with the DFU mode that was burned into the bootrom)
  • Baseband (may be one or many files depending on the model)

Example

Here are the contents of the iPhone 3GS 3.0 (7A341) firmware IPSW:

• 018-5302-002.dmg (281214976 bytes)
• 018-5304-002.dmg (12769604 bytes)
• 018-5306-002.dmg (12777796 bytes)
• BuildManifest.plist (21097 bytes)
• kernelcache.release.s5l8920x (4695492 bytes)
• Restore.plist (1763 bytes)
• Firmware/
  • all_flash/
    • all_flash.n88ap.production/
      • applelogo.s5l8920x.img3 (9604 bytes)
      • batterycharging0.s5l8920x.img3 (19716 bytes)
      • batterycharging1.s5l8920x.img3 (24900 bytes)
      • batteryfull.s5l8920x.img3 (76100 bytes)
      • batterylow0.s5l8920x.img3 (56772 bytes)
      • batterylow1.s5l8920x.img3 (65348 bytes)
      • DeviceTree.n88ap.img3 (44996 bytes)
      • glyphcharging.s5l8920x.img3 (20356 bytes)
      • glyphplugin.s5l8920x.img3 (19332 bytes)
      • iBoot.n88ap.RELEASE.img3 (178500 bytes)
      • LLB.n88ap.RELEASE.img3 (67908 bytes)
      • manifest (341 bytes)
      • needservice.s5l8920x.img3 (20484 bytes)
      • recoverymode.s5l8920x.img3 (47876 bytes)
  • dfu/
    • iBEC.n88ap.RELEASE.dfu (104772 bytes)
    • iBSS.n88ap.RELEASE.dfu (104772 bytes)

Firmwares found in IPSW

Per http://newosxbook.com/bonus/vol1AppA.html

Filename	Use
ICE17-1.xx.xx.Release.bbfw	Intel modem / baseband
Mav17-1.xx.xx.Release.bbfw	Maverick modem / baseband
AOP/aopfw-iphone##aop.im4p	Always on processor
Savage/Savage.B[0/2]-[Dev/Prod].[vt.]fw	FaceID
Yonkers/Yonkers.EA01_F###_[Dev/Prod]fw	FaceID
SE/Stockholm##.RELEASE.sefw	Secure Element
Maggie/AppleMaggieFirmwareImage.im4p	?
cpu_Multitouch.im4p	Multitouch controller
isp/adc-petra-d3x.im4p	Image Signal Processor
ane/h11_ane_fw_quin.im4p	Apple Neural Engine
WirelessPower/WirelessPower.iphone##.im4p	Wireless charging controller
SmartIOFirmwareCHIP.im4p	T8020 and later Smart I/O
board_CallanFirmware.im4p	Haptics Firmware
ave/AppleAVE2FW.im4p	Audio/Video Encoder
agx/armfw_g11p.im4p	GPU Scheduler/Command Stream Processor
all_flash/sep-firmware.*.im4p	Secure Enclave Processor
liquiddetect@2436~iphone-lightning.im4p	Liquid Damage Detection
pmp/t8030pmp.im4p	Power Management Processor
Rose/r1p0/ftab.bin	Rose (TouchID) sensor
vinyl_05.vnlfw	eSIM
Veridian	? (Some form of signing/device integrity)

Notes

1. IPSW files have been used since the very first iPod, though they have a different format than firmwares for iOS devices.