The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "Firmware Keys"
m (→7.x: fix wrong links) |
m (→7.x: fix wrong links) |
||
Line 2,126: | Line 2,126: | ||
! rowspan="2" | [[n94ap|4S]] |
! rowspan="2" | [[n94ap|4S]] |
||
! colspan="2" | [[iPhone 5|5]] |
! colspan="2" | [[iPhone 5|5]] |
||
− | ! colspan="2" | [[iPhone |
+ | ! colspan="2" | [[iPhone 5c|5c]] |
− | ! colspan="2" | [[iPhone |
+ | ! colspan="2" | [[iPhone 5s|5s]] |
! rowspan="2" | [[iPod touch 5G|5G]] |
! rowspan="2" | [[iPod touch 5G|5G]] |
||
|- |
|- |
Revision as of 00:13, 31 December 2013
Firmware Keys are keys which decrypt the root filesystem of certain (beta) firmwares. Apple uses a to ensure the safety of their files. Over time Apple has changed the way to encrypt firmware files, thus the way to decrypt files as well as the way to get the keys has also.
History
With the release of the iPhone came the IMG2 file format. They were used on all known iPhone OS 1.x firmwares. For the 1.1.x series, they were encrypted with the 0x837 key. The discovery of the 0x837 key led to the ability to decrypt any 1.x firmware.
Following IMG2 came the IMG3 file format. They were introduced with iPhone OS 2.0b4, and have been in use ever since. In order to maintain their integrity, they contain multiple layers of encryption, all based around a public/private key encryption method. Apple took encryption seriously with IMG3 by utilizing AES (based on the Rinjndael key schedule). In order to complicate things, they contain the VFDecrypt key, albeit encrypted, as part of the KBAG structure in the ramdisks.
The ramdisk keys can only be retrieved with the processor specific GID Key. The GID key is currently unretrievable and can only be utilized through the built-in AES engine. To complicate things even more, the engine is only accessible through a special bootrom exploit (jailbreaks typically expose it with /dev/aes_0). This makes usage of the key nearly impossible.
However, once you have access to the AES engine, the entire system falls apart. You are able to upload an encrypted ramdisk and grab the decryption keys for it. Once you manage to decrypt the ramdisk, you can run it through GenPass to decrypt the Firmware key.
Beginning with iOS 6.0b1, Apple tweaked their disk images so they no longer work with VFDecrypt. VFDecrypt will report that the filesystem is decrypted, but you will be unable to mount it. The current workaround is to use dmg from Xpwn to decrypt them. What has changed to break VFDecrypt is currently unknown. Decryption will take slightly longer due to dmg writing its progress to the terminal, but the difference is negligible.
To find the keys, you can either use the the methods on AES Keys or the easier option, for OS X, keylimepie.
Decrypting
- Main article: Decrypting Firmwares
Notes
Application Processor | iDevice |
---|---|
S5L8900 | iPhone 2G iPhone 3G iPod touch 1G |
S5L8720 | iPod touch 2G |
S5L8920 | iPhone 3GS |
S5L8922 | iPod touch 3G |
S5L8930 (A4) | iPad 1G iPhone 4 iPod touch 4G Apple TV 2G |
S5L8940 (A5) | iPad 2 iPhone 4S |
S5L8942 (A5 Rev A) | iPad 2 (Wi‑Fi) [Rev A] Apple TV 3G iPod touch 5G iPad mini 1G |
S5L8945 (A5X) | iPad 3 |
S5L8947 (A5 Rev B) | Apple TV 3G (Rev A) |
S5L8950 (A6) | iPhone 5 iPhone 5c |
S5L8955 (A6X) | iPad 4 |
S5L8960 (A7) | iPhone 5s, iPad mini 2G |
S5L8965 (A7 Rev A) | iPad Air |
Certain files share the same key and IV per application processor (per build) provided the devices have the same pixel resolution:
- Update Ramdisk
- Restore Ramdisk
- AppleLogo
- BatteryCharging0
- BatteryCharging1
- BatteryFull
- BatteryLow0
- BatteryLow1
- GlyphCharging
- GlyphPlugin
- Kernelcache
- NeedService
- RecoveryMode
- WTF
The table on the right lists the application processors and their corresponding devices. This list is also accessable from the main page.
You can use img3decrypt or xpwntool to decrypt these files as described in Decrypting Firmwares. Once done, mount or extract using the tool of your choice.
When posting a key page, please use the key template.
The firmware version number for the Apple TV builds are the ones that the Apple TV reports (also known as the "marketing version").
All dates are relative to UTC.
You cannot get A5+ keys until a bootrom exploit is found. If the ramdisk is not encrypted, you may then get the RootFS key ONLY.
Firmware Versions
This is a full and comprehensive list of all firmwares Apple Inc. has made available to the public in some way, be it the dev center or iTunes.
Final
- Main article: Firmware
1.x
Date | Build | iPhone | iPod touch |
---|---|---|---|
2G | 1G | ||
29 Jun 2007 | 1A543a | 1.0 | N/A |
31 Jul 2007 | 1C25 | 1.0.1 | |
21 Aug 2007 | 1C28 | 1.0.2 | |
14 Sep 2007 | 3A100a | N/A | 1.1 |
3A101a | 1.1 | ||
27 Sep 2007 | 3A109a | 1.1.1 | N/A |
3A110a | N/A | 1.1.1 | |
12 Nov 2007 | 3B48b | 1.1.2 | 1.1.2 |
15 Jan 2008 | 4A93 | 1.1.3 | 1.1.3 |
26 Feb 2008 | 4A102 | 1.1.4 | 1.1.4 |
14 Jul 2008 | 4B1 | N/A | 1.1.5 |
2.x
Date | Build | iPhone | iPod touch | ||
---|---|---|---|---|---|
2G | 3G | 1G | 2G | ||
11 Jul 2008 | 5A345 | N/A | 2.0 | N/A | N/A |
5A347 | 2.0 | 2.0 | 2.0 | ||
4 Aug 2008 | 5B108 | 2.0.1 | 2.0.1 | 2.0.1 | |
18 Aug 2008 | 5C1 | 2.0.2 | 2.0.2 | 2.0.2 | |
12 Sep 2008 | 5F136 | 2.1 | 2.1 | N/A | |
9 Sep 2008 | 5F137 | N/A | 2.1 | ||
5F138 | N/A | 2.1.1 | |||
21 Nov 2008 | 5G77 | 2.2 | 2.2 | 2.2 | N/A |
5G77a | N/A | 2.2 | |||
27 Jan 2009 | 5H11 | 2.2.1 | 2.2.1 | 2.2.1 | N/A |
5H11a | N/A | 2.2.1 |
3.x
Date | Build | iPad | iPhone | iPod touch | ||||
---|---|---|---|---|---|---|---|---|
1G | 2G | 3G | 3GS | 1G | 2G | 3G | ||
17 Jun 2009 | 7A341 | N/A | 3.0 | 3.0 | 3.0 | 3.0 | 3.0 | N/A |
31 Jul 2009 | 7A400 | 3.0.1 | 3.0.1 | 3.0.1 | N/A | |||
9 Sep 2009 | 7C144 | 3.1 | 3.1 | 3.1 | ||||
7C145 | N/A | 3.1.1 | 3.1.1 | 3.1.1 | ||||
17 Sep 2009 | 7C146 | N/A | 3.1.1 | |||||
8 Oct 2009 | 7D11 | N/A | 3.1.2 | 3.1.2 | 3.1.2 | 3.1.2 | 3.1.2 | 3.1.2 |
2 Feb 2010 | 7E18 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.3 | |
3 Apr 2010 | 7B367 | 3.2 | N/A | |||||
15 Jul 2010 | 7B405 | 3.2.1 | ||||||
11 Aug 2010 | 7B500 | 3.2.2 |
4.x
Date | Build | Apple TV | iPad | iPhone | iPod touch | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2G | 1G | 2 | 3G | 3GS | 4 | 2G | 3G | 4G | |||||
Wi‑Fi | GSM | CDMA | GSM | CDMA | |||||||||
1 Sep 2010 | 8M89 | 4.1 | N/A | ||||||||||
21 Jun 2010 | 8A293 | N/A | 4.0 | 4.0 | 4.0 | N/A | 4.0 | 4.0 | N/A | ||||
15 Jul 2010 | 8A306 | 4.0.1 | 4.0.1 | 4.0.1 | N/A | ||||||||
11 Aug 2010 | 8A400 | 4.0.2 | 4.0.2 | 4.0.2 | N/A | 4.0.2 | 4.0.2 | N/A | |||||
8 Sep 2010 | 8B117 | 4.1 | 4.1 | 4.1 | 4.1 | 4.1 | 4.1 | ||||||
21 Sep 2010 | 8B118 | N/A | 4.1 | ||||||||||
22 Nov 2010 | 8C148 | N/A | 4.2.1 | N/A | 4.2.1 | N/A | 4.2.1 | N/A | 4.2.1 | 4.2.1 | 4.2.1 | ||
8C148a | N/A | 4.2.1 | N/A | ||||||||||
22 Nov 2010 | 8C150 | 4.2 | N/A | ||||||||||
14 Dec 2010 | 8C154 | 4.2.1 | |||||||||||
7 Feb 2011 | 8E128 | N/A | 4.2.5 | N/A | |||||||||
10 Feb 2011 | 8E200 | 4.2.6 | |||||||||||
14 Apr 2011 | 8E303 | 4.2.7 | |||||||||||
4 May 2011 | 8E401 | 4.2.8 | |||||||||||
15 Jul 2011 | 8E501 | 4.2.9 | |||||||||||
25 Jul 2011 | 8E600 | 4.2.10 | |||||||||||
9 Mar 2011 | 8F190 | N/A | 4.3 | N/A | 4.3 | 4.3 | N/A | 4.3 | 4.3 | ||||
8F191 | N/A | 4.3 | 4.3 | 4.3 | N/A | ||||||||
11 Mar 2011 | 8F191m | 4.3 | N/A | ||||||||||
22 Mar 2011 | 8F202 | 4.3 | |||||||||||
10 May 2011 | 8F305 | 4.3 | |||||||||||
1 Aug 2011 | 8F455 | 4.3 | |||||||||||
25 Mar 2011 | 8G4 | N/A | 4.3.1 | 4.3.1 | 4.3.1 | 4.3.1 | N/A | 4.3.1 | 4.3.1 | N/A | 4.3.1 | 4.3.1 | |
14 Apr 2011 | 8H7 | 4.3.2 | 4.3.2 | 4.3.2 | N/A | 4.3.2 | 4.3.2 | 4.3.2 | 4.3.2 | ||||
8H8 | N/A | 4.3.2 | N/A | ||||||||||
4 May 2011 | 8J2 | N/A | 4.3.3 | 4.3.3 | 4.3.3 | N/A | 4.3.3 | 4.3.3 | N/A | 4.3.3 | 4.3.3 | ||
8J3 | N/A | 4.3.3 | N/A | ||||||||||
15 Jul 2011 | 8K2 | 4.3.4 | 4.3.4 | 4.3.4 | 4.3.4 | N/A | 4.3.4 | 4.3.4 | N/A | 4.3.4 | 4.3.4 | ||
25 Jul 2011 | 8L1 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 |
5.x
Date | Build | Apple TV | iPad | iPhone | iPod touch | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2G | 3G | 1G | 2 | 3 | 3GS | 4 | 4S | 3G | 4G | ||||||||
Wi‑Fi | GSM | CDMA | Wi‑Fi (A) | Wi-Fi | CDMA | Global | GSM | CDMA | |||||||||
12 Oct 2011 | 9A334 | N/A | 5.0 | 5.0 | 5.0 | 5.0 | N/A | 5.0 | 5.0 | 5.0 | 5.0 | 5.0 | 5.0 | ||||
9A334v | 4.4 | N/A | |||||||||||||||
18 Oct 2011 | 9A335a | 4.4.1 | |||||||||||||||
2 Nov 2011 | 9A336a | 4.4.2 | |||||||||||||||
10 Nov 2011 | 9A405 | N/A | 5.0.1 | 5.0.1 | 5.0.1 | 5.0.1 | N/A | 5.0.1 | 5.0.1 | 5.0.1 | 5.0.1 | 5.0.1 | 5.0.1 | ||||
17 Nov 2011 | 9A405l | 4.4.3 | N/A | ||||||||||||||
15 Dec 2011 | 9A406 | N/A | 5.0.1 | N/A | |||||||||||||
9A406a | 4.4.4 | N/A | |||||||||||||||
7 Mar 2012 | 9B176 | N/A | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | N/A | 5.1 | 5.1 | |
9B179 | N/A | 5.1 | N/A | ||||||||||||||
9B179b | 5.0 | 5.0 | N/A | ||||||||||||||
10 May 2012 | 9B206 | N/A | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | |
9B206f | 5.0.1 | 5.0.1 | N/A | ||||||||||||||
25 May 2012 | 9B208 | N/A | 5.1.1 | N/A | |||||||||||||
5 Jun 2012 | 9B830 | 5.0.2 | 5.0.2 | N/A |
6.x
Date | Build | Apple TV | iPad | iPad mini | iPhone | iPod touch | ||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2G | 3G | 2 | 3 | 4 | 1G | 3GS | 4 | 4S | 5 | 4G | 5G | |||||||||||||||||
Orig | Rev A | Wi‑Fi | GSM | CDMA | Wi‑Fi (A) | Wi‑Fi | CDMA | Global | Wi‑Fi | GSM | Global | Wi‑Fi | GSM | Global | GSM | GSM (A) | CDMA | GSM | Global | |||||||||
19 Sep 2012 | 10A403 | N/A | 6.0 | 6.0 | 6.0 | 6.0 | 6.0 | 6.0 | 6.0 | N/A | 6.0 | 6.0 | 6.0 | 6.0 | 6.0 | N/A | 6.0 | N/A | ||||||||||
10A405 | N/A | 6.0 | 6.0 | N/A | ||||||||||||||||||||||||
10A406 | N/A | 6.0 | ||||||||||||||||||||||||||
30 Oct 2012 | N/A | 6.0 | N/A | |||||||||||||||||||||||||
24 Sep 2012 | 10A406e | 5.1 | 5.1 | N/A | ||||||||||||||||||||||||
30 Oct 2012 | 10A407 | N/A | 6.0 | N/A | ||||||||||||||||||||||||
1 Nov 2012 | 10A523 | N/A | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | N/A | 6.0.1 | N/A | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | N/A | 6.0.1 | 6.0.1 | |||||||
10A525 | N/A | 6.0.1 | 6.0.1 | N/A | ||||||||||||||||||||||||
9 Nov 2012 | 10A8426 | N/A | 6.0.1 | 6.0.1 | N/A | 6.0.1 | 6.0.1 | N/A | ||||||||||||||||||||
26 Nov 2012 | 10A831 | 5.1.1 | 5.1.1 | 5.1.1 | N/A | |||||||||||||||||||||||
19 Dec 2012 | 10A550 | N/A | 6.0.2 | N/A | ||||||||||||||||||||||||
10A551 | N/A | 6.0.2 | 6.0.2 | N/A | ||||||||||||||||||||||||
10A8550 | N/A | 6.0.2 | 6.0.2 | N/A | ||||||||||||||||||||||||
28 Jan 2013 | 10B141 | N/A | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | N/A | 6.1 | N/A | 6.1 | ||||||||
10B142 | N/A | 6.1 | N/A | |||||||||||||||||||||||||
10B143 | N/A | 6.1 | 6.1 | N/A | ||||||||||||||||||||||||
10B144 | N/A | 6.1 | 6.1 | N/A | 6.1 | N/A | ||||||||||||||||||||||
10B144b | 5.2 | 5.2 | 5.2 | N/A | ||||||||||||||||||||||||
11 Feb 2013 | 10B145 | N/A | 6.1.1 | N/A | ||||||||||||||||||||||||
19 Feb 2013 | 10B146 | N/A | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | N/A | 6.1.2 | N/A | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | ||||||
10B147 | N/A | 6.1.2 | 6.1.2 | N/A | 6.1.2 | 6.1.2 | N/A | |||||||||||||||||||||
19 Mar 2013 | 10B329 | N/A | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | ||||
10B329a | 5.2.1 | 5.2.1 | 5.2.1 | N/A | ||||||||||||||||||||||||
2 May 2013 | 10B350 | N/A | 6.1.4 | 6.1.4 | N/A | |||||||||||||||||||||||
19 Jun 2013 | 10B809 | 5.3 | 5.3 | 5.3 | N/A | |||||||||||||||||||||||
14 Nov 2013 | 10B400 | N/A | 6.1.5 | N/A |
7.x
Beta
- Main article: Beta Firmware
1.x/2.x
Date | Build | iPhone | iPod touch | |
---|---|---|---|---|
2G | 3G | 1G | ||
6 Mar 2008 | 5A147p | 1.2b | N/A | 1.2b |
27 Mar 2008 | 5A225c | 2.0b2 | 2.0b2 | |
8 Apr 2008 | 5A240d | 2.0b3 | 2.0b3 | |
23 Apr 2008 | 5A258f | 2.0b4 | 2.0b4 | |
6 May 2008 | 5A274d | 2.0b5 | 2.0b5 | |
28 May 2008 | 5A292g | 2.0b6P | 2.0b6P | |
29 May 2008 | 5A308 | 2.0b6F | 2.0b6F | |
9 Jun 2008 | 5A331 | 2.0b7 | 2.0b7 | |
26 Jun 2008 | 5A345 | 2.0GM | 2.0GM | |
24 Jul 2008 | 5F90 | 2.1b | 2.1b | |
30 Jul 2008 | ? | 2.1b2 | 2.1b2 | |
8 Aug 2008 | ? | 2.1b3 | 2.1b3 | |
16 Aug 2008 | ? | 2.1b4 | 2.1b4 | |
25 Sep 2008 | 5G29 | 2.2b | 2.2b | 2.2b |
20 Oct 2008 | 5G53 | 2.2b2 | 2.2b2 | 2.2b2 |
3.x
Date | Build | iPhone | iPod touch | |||
---|---|---|---|---|---|---|
2G | 3G | 3GS | 1G | 2G | ||
17 Mar 2009 | 7A238j | 3.0b | 3.0b | N/A | 3.0b | 3.0b |
31 Mar 2009 | 7A259g | 3.0b2 | 3.0b2 | 3.0b2 | 3.0b2 | |
14 Apr 2009 | 7A280f | 3.0b3 | 3.0b3 | 3.0b3 | 3.0b3 | |
28 Apr 2009 | 7A300g | 3.0b4 | 3.0b4 | 3.0b4 | 3.0b4 | |
6 May 2009 | 7A312g | 3.0b5 | 3.0b5 | 3.0b5 | 3.0b5 | |
8 Jun 2009 | 7A341 | 3.0GM | 3.0GM | 3.0GM | 3.0GM | |
30 Jun 2009 | 7C97d | 3.1b | 3.1b | 3.1b | 3.1b | 3.1b |
14 Jul 2009 | 7C106c | 3.1b2 | 3.1b2 | 3.1b2 | 3.1b2 | 3.1b2 |
27 Jul 2009 | 7C116a | 3.1b3 | 3.1b3 | 3.1b3 | 3.1b3 | 3.1b3 |
4.x
Date | Build | Apple TV | iPad | iPhone | iPod touch | ||||
---|---|---|---|---|---|---|---|---|---|
2G | 1G | 3G | 3GS | 4 | 2G | 3G | 4G | ||
GSM | |||||||||
8 Apr 2010 | 8A230m | N/A | 4.0b | 4.0b | N/A | 4.0b | 4.0b | N/A | |
20 Apr 2010 | 8A248c | 4.0b2 | 4.0b2 | 4.0b2 | 4.0b2 | ||||
4 May 2010 | 8A260b | 4.0b3 | 4.0b3 | 4.0b3 | 4.0b3 | ||||
18 May 2010 | 8A274b | 4.0b4 | 4.0b4 | 4.0b4 | 4.0b4 | ||||
7 Jun 2010 | 8A293 | 4.0GM | 4.0GM | 4.0GM | 4.0GM | ||||
14 Jul 2010 | 8B5080c | 4.1b | 4.1b | 4.1b | 4.1b | 4.1b | |||
27 Jul 2010 | 8B5091b | 4.1b2 | 4.1b2 | 4.1b2 | 4.1b2 | 4.1b2 | |||
3 Aug 2010 | 8B5097d | 4.1b3 | 4.1b3 | 4.1b3 | 4.1b3 | 4.1b3 | |||
1 Sep 2010 | 8B117 | 4.1GM | 4.1GM | 4.1GM | 4.1GM | 4.1GM | |||
15 Sep 2010 | 8C5091e | N/A | 4.2b | 4.2b | 4.2b | 4.2b | 4.2b | 4.2b | 4.2b |
28 Sep 2010 | 8C5101c | 4.2b2 | 4.2b2 | 4.2b2 | 4.2b2 | 4.2b2 | 4.2b2 | 4.2b2 | |
12 Oct 2010 | 8C5115c | 4.2b3 | 4.2b3 | 4.2b3 | 4.2b3 | 4.2b3 | 4.2b3 | 4.2b3 | |
1 Nov 2010 | 8C134 | 4.2GM | 4.2GM | 4.2GM | 4.2GM | 4.2GM | 4.2GM | 4.2GM | |
18 Nov 2010 | 8C134b | 4.2GM2 | N/A | ||||||
18 Nov 2010 | 8C148 | 4.2.1GM | 4.2.1GM | 4.2.1GM | 4.2.1GM | 4.2.1GM | 4.2.1GM | 4.2.1GM | |
12 Jan 2011 | 8F5148b | 4.3b | N/A | 4.3b | 4.3b | N/A | 4.3b | 4.3b | |
12 Jan 2011 | 8F5148c | 4.2b | N/A | ||||||
19 Jan 2011 | 8F5153d | 4.2b2 | 4.3b2 | N/A | 4.3b2 | 4.3b2 | N/A | 4.3b2 | 4.3b2 |
1 Feb 2011 | 8F5166b | 4.2b3 | 4.3b3 | 4.3b3 | 4.3b3 | 4.3b3 | 4.3b3 | ||
3 Mar 2011 | 8F190 | N/A | 4.3GM | 4.3GM | 4.3GM | 4.3GM | 4.3GM |