TigrisAni 15A93261h

This article discusses software internally used by Apple. Acquiring a copy without Apple's consent is illegal and may result in being scammed. Engaging in illegal activity is not condoned. This information is provided for educational purposes only.

Background

This firmware is an internal NonUI version of iOS 11.0. It has been seen on various iPhone 8 prototype units. Similarly to other recent builds, this one has a rather large filesize - a dump of its filesystem is around 9.1 GB.

Interestingly, this build contains kernels for Apple A7 to A11 processors, including differfent processor varieties. This has previously not been the case since iOS version 7.0. It also appears to support an unreleased processor type known as t8020. Based on previous NonUI firmwares having support for as of then unreleased processors, it's safe to assume that this processor is most likely the Apple A12. Found in the kernel extensions are references to another processor known as t8027. Judging by files in the same directory - these processors seem to be under the codename "Vortex".

iPhone 8 prototype running 15A93261h

Notable Changes

This build is known to have various differences compared to previous builds, which will be listed here.

• T500AP and T501AP - Wi-Fi drivers for these unknown board identifiers can be found in /AppleInternal/Diags/WifiFirmware/ alongside the iPhone 8 (D20AP) and iPhone 8 Plus (D21AP).

• mach.kasan - apart from the usual mach.development.{Processor Name / Identifier} kernels found within NonUI builds, this build contains kernels with the Kernel Address SANitizer, a tool used to detect bad memory accesses, enabled.

• Tailspin / Ariadne - A readme file located within /AppleInternal/tailspin references a previously unheard of application known as Ariadne, as well as "tailspin" files. The readme states that "tailspin holds onto 20-30 seconds of historical spindump and Ariadne data, from before the sysdiagnose invocation." The Ariadne application appears to be used for the visualization of these tailspin files.

• Firmware references - In the same readme - two iOS firmwares are referenced - Tigris 15A221 (an apparent version of iOS 11.0) and Lobo 17A202. Judging by the build number of the latter firmware compared to the standard build number scheme - it seems that this is a future version of iOS that has yet to be released, being newer than iOS 11.

• Test scripts - Located in AppleInternal/CoreOS/AppleSEP/unit_tests/hilo, these test scripts seem to communicate with the Secure Enclave. The scripts are written to only work on D22AP, the iPhone X, meaning that they may be used to test various sensors in the TrueDepth sensor housing. They contain multiple references to a display module with the codename Hilo.

Applications

This firmware contains many applications launchable from SwitchBoard.app, however roughly half of them are hidden by default:

• AltoMobile
• CoexBlender (hidden)
• ExtendedOQC
• FactoryStencil
• GrapeCal
• GrapeCal_Lite
• LCDMura (hidden)
• LcdUTest (hidden)
• MesaCal
• Ness (hidden)
• NonUIQRCode (hidden)
• NonUIConsoleViewer
• Operator (hidden)
• OrbCal
• Pippi (hidden)
• Reliability
• Reliability (again) (hidden)
• Sequencer
• Spelunx
• ThermalDOE (hidden)
• USBHost
• WiPASmini