Talk:Firmware Keys

2.0 beta 8 key?

Would anyone, by any chance, have the key for 2.0 build 5A345? For some reason, it's missing on this page. -Dialexio 16:13, 17 August 2008 (UTC)

VFDecrypt error

When I try with the command I get a warning message.It shows that cygcrypto-0.9.8.dll was not found.I've searched this file but it seems I can't find it.Thanks for helping me in advance. --The preceding unsigned comment was added by Delstam (talk) 14:30, August 1, 2009 (UTC). Please consult this page for more info on how to sign pages, and how to fix this.

This DLL is part of Cygwin. You can get it here: [1] --Blackbox 14:45, 1 August 2009 (UTC)

Thanks --The preceding unsigned comment was added by Delstam (talk) 14:58, August 1, 2009 (UTC). Please consult this page for more info on how to sign pages, and how to fix this.

Hey, I need this file too, but the link seems to now be broken. I just got it from here instead. Just thought I'd make a note in case anyone else needs it. MaybachMan 13:17, 17 August 2010 (UTC)

...Cygwin1.dll can also be gotten here. --The preceding unsigned comment was added by MaybachMan (talk) 13:27, August 17, 2010 (UTC). Please consult this page for more info on how to sign pages, and how to fix this.

I'm working on getting my fork of VFDecrypt running on Windows. Soon as I get it compiled, I'll post the download link to a /native/ Windows binary. --dra1nerdrake 17:35, 17 August 2010 (UTC)

VFDecrypt for Mac link

The link in the article is broken, does anyone have a working one? MaybachMan 11:39, 19 August 2010 (UTC)

Use mine from github and build it with 'make linux'. It (should) work. If it does, please post back here so I can update the program. If it doesn't, post back here with the error and I'll try to debug it. --dra1nerdrake 21:13, 19 August 2010 (UTC)

vfdecrypt.c:42:22: error: byteswap.h: No such file or directory
make: *** [linux] Error 1

--MaybachMan 10:44, 20 August 2010 (UTC)

You can get a version that will compile on Mac OS X at GitHub.

iKeys

I was wondering if anyone had any info on "iKeys". It's mentioned here at the bottom. I'd Imagine it's like GenPass but just wondering. Any info is appreciated. --OMEGA_RAZER

Remove Request

As someone mentioned on the Firmware 3.x Beta talk page, I want to request that the whole section "Firmware" on this page here gets removed and all mentioned pages deleted as well. The information there (the VFDecrypt keys) should go into their appropriate firmware page. Or do we still need all VFDecrypt keys (only) together also? If yes, then at least it should be cleaned up and these pages should mention that these are duplicates for the sake of grouping. --http 10:17, 23 October 2010 (UTC)

I think we should just protect the pages VFDecrypt Keys:_1.x, VFDecrypt Keys: 2.x, VFDecrypt Keys: 3.x, and VFDecrypt Keys: 3.x BETA. And if someone discovers a key for those Firmwares we should add it to the talk page for an admin to add. --5urd 15:03, 23 October 2010 (UTC)

These pages are really chaotic. For the 1.x and 2.x pages, it is unknown if they are for the iPhone or iPod touch (or for both). We can just assume something, or try. The 3.x pages contain not only vfdecrypt keys, but some ramdisk keys as well. And some have beta mixed within, others not. I assume that all keys are on their respective firmware page already. If not, then we should create the missing pages and link them to the Firmware or Beta Firmware page. I'll start with that some time if I find the time - feel free to help. But then, if all keys are available on their firmware page, why would we still need these pages? I still request to delete them. We could add a cross table on this page with firmware vs. device and in each cell a link, so that we easily find the page with the keys. I think I'll add this table right away. Then there's no need for these pages anymore. Please discuss here if you agree to remove them afterwards. -- http 20:14, 29 October 2010 (UTC)

I don't think we should delete the key pages until the table shows all blue links so that way we don't trash any keys on accident. --5urd 15:33, 30 October 2010 (UTC)

After making sure we have all keys on their firmware pages, I went ahead and copied the text to this page and deleted the 4.x (final) page. The others will follow, after checking them also. -- http 21:25, 6 November 2010 (UTC)

Ok, now the other pages are also removed and all keys there are on its own page as discussed. Sorry for spamming the Recent changes list. I copied mostly the existing pages, but some of them were not following the standard, so this means the new pages also don't follow the standard. This means more cleanup is necessary. Also I removed the KBAGs as discussed somewhere else where I saw them. I added the Pesudo-GID on three pages (S5L8900 for 3.0 Build 7A341). I have no idea what this is for, so feel free to remove it again if you think this is not necessary. For the 1.x pages Dialexio wrote that the VFDecrypt keys are for both iPhone and iPod touch, so I copied them to both pages. I hope this is correct. For the 2.x pages there was also not mentioned for what device the keys were, so I copied them to the iPhone, or, where it was clear from the version number, only to iPod touch. For versions lower than 2.1 I copied them to both, but since 2.1 only the ramdisk keys were copied to both pages (as S5L8900 applies to iPhone, iPod touch and iPhone 3G). I hope this is all correct. (I'm not very experienced with handling these keys yet.) Because I didn't look into each ipsw, I don't know what files are in there, so I didn't create all necessary sections. This means more cleanup is necessary. Also all keys should be in lower case. I didn't change them, I just copied them over, hopefully without any copy/paste errors. There is much more work left, but I hope I didn't mess it up, but helped to improve the overall structure. Ok, now you can reply and shoot on me. -- http 00:25, 31 December 2010 (UTC)

Exploit?

am i to understand that a low level exploit is needed to get the vfdecrypt key??? --Shengis14 18:50, 8 October 2010 (UTC)

No, that's not completely true. :P One has to manage to get the key/iv for an update/restore ramdisk, and then use Genpass to get a VFDecrypt key. --dra1nerdrake 21:27, 8 October 2010 (UTC)

And how would someone like myself go about getting the Key/IV for an update/restore ramdisk --Shengis14 22:13, 8 October 2010 (UTC)

You would need at least an iBoot exploit and a payload to upload that is able to access the AES engine of the device. --OMEGA RAZER 22:16, 8 October 2010 (UTC)

It's just one of the reasons I'm confused is how is there a sudden jump in the number of vfdecrypt keys for the iPod touch 3G on like 4.0-1??

There isnt a exploit that is iBoot or lower for that device. Any thoughts ? --Shengis14 22:50, 8 October 2010 (UTC)

New page?

I think we should make a new page detailing how to utilise Gojohnnyboi's AES payload to get the keys including screenies on opening up an img3 in a hex editor and getting the KBAG etc. Then the keys won't be left to the main devs and iH8sn0w to post. Then all these beta FWs can be decrypted faster and more keys can be posted. I myself would definitely be interested in getting the KBAG etc. and if anybody could create such a page then I would definitely be interested in posting keys myself. Once created the page shouldn't need too much housekeeping either since the process won't change until IMG4 comes along which I will dread :P Who's up to it?? blackthund3r 11:43, 20 October 2010 (UTC)

Page split request

I think we should split this page into two. The first half deals more with the VFDecrypt program, not the keys as the title would suggest. Perhaps we can move the info related to the program to VFDecrypt (program), and make VFDecrypt a disambiguation page. --Dialexio 00:17, 7 November 2010 (UTC)

I like that, but think it should just be VFDecrypt for the program and dont make a disambiguation page, Category:VFDecrypt is like a disambiguation page already... Also making the current page info on the keys would be more like it as that is what the page waws orrigionally... --5urd 00:25, 7 November 2010 (UTC)

Yes, VFDecrypt should be about the program or a disambiguation page and here only infos about the keys. All this stuff about the other programs don't really belong here either. That could go to the disambiguation page or small under a "see also" section. Don't forget all the links like [[VFDecrypt Keys|VFDecrypt]] have to get fixed. -- http 00:56, 7 November 2010 (UTC)

So, it's settled. I'll get to moving all of the info related to the actual program to the page VFDecrypt. --Dialexio 21:25, 10 November 2010 (UTC)

Comments from deleted page VFDecrypt Keys: 4.x BETA

i'm trying to genpass a s5l8720x key, but seems to be invalid --Qwertyoruiop 00:19, 11 April 2010 (UTC)

GenPass for 3.x isn't working on 4.0 rootfs. --Cichacz 10:40, 11 April 2010 (UTC)

thx --Qwertyoruiop 10:57, 11 April 2010 (UTC)

We can only try asking MuscleNerd to post the new one script :) --Cichacz 11:05, 11 April 2010 (UTC)

ih8sn0w has some scripts too, maybe try asking him --pjakuszew 13:34, 11 April 2010 (UTC)

is there a manual way to aquire those keys? after looking at genpass source it looks like openssl could be involved. couldnt hurt to ask someone for their script though --Jimmy.M

reversing asr could be a solution. --Qwertyoruiop 15:37, 11 April 2010 (UTC)

I think it's better to keep the scripts non-public. If there was a public script for getting the vfdecrypt keys, Apple developers could move the keys again and we will have to find yet another method for getting the vfdecryptk's. --pjakuszew 15:41, 11 April 2010 (UTC)

Comments from deleted page VFDecrypt Keys: 3.x (BETA)

What's about ramdisk decrypt keys for beta 1? --The preceding unsigned comment was added by Cartman (talk) 15:22, April 15, 2009. Please consult this page for more info on how to sign pages, and how to fix this.

There were no ramdisk decrypt keys for beta 1, beta 1 firmware files were not encrypted, only wrapped in an IMG3 container with no encryption.--Cool name 15:39, 15 April 2009 (UTC)

James

James, would you mind explaining this last edit for me? I don't see any problem with leaving the iPod touch & iPhone 3G keys both on the page....--The preceding unsigned comment was added by Cool name (talk) 01:02, April 17, 2009. Please consult this page for more info on how to sign pages, and how to fix this.

Those are the ramdisk keys and they're exactly the same. They have always been the same and I was waiting for someone to post another model and confirm that. The only model that will have different keys will be the iPod 2G, which I should really edit in. --James 01:51, 17 April 2009 (UTC)

Ahh, my bad with that. I didn't realize they were the same keys :P Feel free to edit the page however you want --Cool name 02:08, 17 April 2009 (UTC)

Octothorpe

Why cleanup the ramdisk keys? They are split into bytes on the 2.x page also, so changing them just makes formatting inconsistent. I can why the rest of the changes were needed though. --James 03:55, 18 April 2009 (UTC)

I like them not separated, I only did that at first because I was lazy. --The preceding unsigned comment was added by Geohot (talk) 05:46, April 18, 2009. Please consult this page for more info on how to sign pages, and how to fix this.

Well, it's all corrected now on the 2.x page. If anyone has a problem, feel free to revert. --James 09:40, 18 April 2009 (UTC)

@Octothorpe: thanks for moving this page, I thought about doing it earlier, i'm just a lazy bastard --posixninja 02:23, 18 June 2009 (UTC)

@OmegaRazor: about VFDecrypt Keys: 3.x, not VFDecrypt Keys: 3.x BETA, chronic has a better idea about orginizing the key/iv for each firmware, see Kirkwood_7A341_(iPhone_3G) so this page will probably be deleted in the future. also you didn't really explain how the kbag key was used, or mentions GIDecrypt --posixninja 14:57, 18 June 2009 (UTC)

all these keys are over at Kirkwood 7A341 (iPhone 3G) and Kirkwood 7A341 (iPod touch 2G) --The preceding unsigned comment was added by posixninja (talk) 15:51, June 21, 2009. Please consult this page for more info on how to sign pages, and how to fix this.

Whould you please post vfdecrypt keys for 3.1 beta firmware? --Redart

Here they are:

2G: dd832e7ce186077bf0b4c5934c1b38b6d55c01c1f04e1ffde721792b1fe06e68e1125f29

3G: f526d42d44dcf61dadf5a0b4be7eb18dafd66c88ec6d91e3ac2f08d3179b63ce64108530

Not sure where is the proper place to put them.... --Redart

How did you get these anyways? I didn't even look into it until today, and you certainly didn't use any of our tools as they're all broke as of 3.1. I'm just curious, i've noticed a couple people posting fsroot keys while genpass has been broke for awhile, is there another group out there making their own private tools or something? --posixninja 18:50, 10 July 2009 (UTC)

The man who got them said that he used GenPass. I assume that he is the one who made custom quickPwns for 3.0 betas from Russia. --Redart

This vfdecrypt key for iPod Touch 2G 3.1 Beta Software doesn't work for me.I'm trying it on iPod2,1_3.1_7C97d Software Please post another vfdecrypt key.Thanks. --The preceding unsigned comment was added by Delstam (talk) 08:04, August 3, 2009. Please consult this page for more info on how to sign pages, and how to fix this.

3GS 3.1.3

And the key for 3gs 3.1.3 firmware? --L0g0 01:26, 26 July 2010 (UTC)

You mean these? --Dialexio 01:54, 26 July 2010 (UTC)

STOP

The article says to stop adding/editing pages like this one, add the keys to a firmware version and add a link to the firmware page. Fine. But on the Firmware page we dont list the beta firmwares. Should we create a beta firmware page to link to all the beta firmware key pages? --http 22:36, 22 October 2010 (UTC)

yes User:iH8sn0w know's how to get the key's and now i realise that that is what makes him a hacker (not even the real hackers look after the wiki) --liamchat 23:07, 22 October 2010 (UTC)

Table merge

Any one but me think about merging the two tables? I will do it. --5urd 14:26, 17 July 2011 (MDT)

I intentionally kept them separate when creating them, as it was a wish not to include betas in the real list. Looking back, I think it was still a good idea, so let's leave it like this. Merging them would mean we should also merge the two firmware pages and I think nobody wants that. --http 18:07, 17 July 2011 (MDT)

Split up the table?

Updating the tables on this page is rather unwieldy, so I'd like to split the tables up by firmware version. (i.e.- 1.x, 2.x, 3.x…) Is this fine with everyone? --Dialexio 15:07, 26 July 2011 (MDT)

Agreed. This way we can remove the columns of the devices that did not exist at the time of the firmware release (like iPad 2 columns in the 2.x table) and also those devices that are no longer supported on the given firmware versions (like ipt1g column in 4.x table). But maybe add a comment of what is missing to each table. --http 03:33, 27 July 2011 (MDT)

agreed as the table is getting waaaaaay to wide for small displays. So like for 1.x, we could have only 2 columns: ipt1g and iph2g --5urd 09:48, 30 July 2011 (MDT)

Wow! That looks way nicer! Now we just need to do the betas --5urd 16:10, 1 August 2011 (MDT)

http's edit

Where did 3140 come from? Was it a typo? --5urd 18:01, 13 October 2011 (MDT)

That's what the ATV displays. I didn't look at the ipsw yet. -- http 18:03, 13 October 2011 (MDT)

Well, there may be two firmwares, the original 4.4 9A334v and not 3140... but that doesn't seem like apple to break a standard like build codes... --5urd 18:05, 13 October 2011 (MDT)

No, not two firmwares, just the display. -- http 11:49, 18 October 2011 (MDT)

The display shows this (in About menu):

Apple TV-Software     4.4 (3140)
Apple TV-Software     4.4.2 (3160)

As this is obviously not a build number, any idea what this is? --http 16:30, 24 October 2011 (MDT)

I will assume that 4.4.1 would be (3150)... @http, I would assume that the reason you couldn't update was that Apple had briefly pulled it... --5urd 17:12, 24 October 2011 (MDT)

Well, shortly after 4.4.2 came out, I clicked on update. After the update the version shown was still 4.0 (3140). But a few minutes later, a push update came through and asked me to update again. After that was through, the above mentioned 4.4.2 (3160) was shown. Quite strange. --http 06:13, 25 October 2011 (MDT)

Fail in build? --5urd 14:04, 26 October 2011 (MDT)

Major Resorting Request

I would like to change the sorting etc. on this page. Right now we have ATV versions that belong to 5.x under the 4.x section, because we put them under the displayed version section. So I would suggest to change these tables to sort by build number. Rows that have different build numbers should get split up to two rows. So far so good. But two questions remain: 1. Where do we see the iOS version number? Just in front of the build number? And what about the ATV iOS numbers on the screen, do we show those as well and where? 2. If we have the build number in the first column already, then what do we write as the link? Just an "X" or what? Anybody disagrees with the resorting in general? -- http 11:49, 18 October 2011 (MDT)

see discussion here: The_iPhone_Wiki:Community_portal#Apple_TV_2G_versions_.28Part_34.29 --http 06:00, 25 October 2011 (MDT)

Frankly spoken this page looks messy and I suggest an overhaul. What are the tables here used for anyway? The VFDecrypt Keys for every firmware can be reached easily from the firmware page via the Link in the Build column. Maybe the colum should be renamed to Build/VFDecrypt Keys. Then the issue about the aTV firmeware numbers would also be taken care of as these columns are also already available (for 'real' and reported). This page here could then explain how the VFDecrypt keys can be generated.--M2m 06:30, 25 October 2011 (MDT)

An overhaul was done a while back by dialexio to seperate it by major versions. But this page does seem like a duplicate of firmware and I kind of agree that we should just change this to list the ways to get the keys. But a lot of tech blogs on decrypting the firmwares link to this page... Maybe the above info stays the same, but the tables are replaced with:

== Firmware Versions ==
{{main|Firmware|Beta Firmware}}

Any other thoughts? --5urd 14:04, 26 October 2011 (MDT)

Well just like I said I would remove all tables here and just refer to the Firmware Page for the Keys themselves. In case really necessary add an extra column as shown below.

VFDecrypt Key
Yes

Otherwise I also see lots of double maintenance.. --M2m 04:35, 29 October 2011 (MDT)

I love your edit. But yes, I think we should resort to removing the tables from this page and adding the column "VFDecrypt Key" to Firmware and Beta Firmware as the Apple TV does get confusing. --5urd 18:53, 29 October 2011 (MDT)

This is awful, there used to be a nice table you could look at and know which keys are available by firmware based on if the page is created or not... or at least what the links are to each one. Now you have to scroll through a giant list sorted by PRODUCT instead of by firmware to figure out which keys are available. What was wrong with having a little redundancy for the sake of usability? --Sbingner 19:17, 11 November 2011 (MST)

Personally, I liked the table as well as I could easily find the keys by version instead of device. If we bring the table back now, we only have the 5.0.1 betas and 5.0.1 final to bring back. But the Apple TV screwed it all. Maybe if it had its own dedicated section... Perhaps:

== Final ==
=== 1.x ===
=== 2.x ===
=== 3.x ===
=== 4.x ===
=== 5.x ===
=== Apple TV ===
== Beta ==
=== 1.x/2.x ===
=== 3.x ===
=== 4.x ===
=== 5.x ===
=== Apple TV ===

Any thoughts? --5urd 21:48, 12 November 2011 (MST)

Despite its… "unique" versioning, I'm not too keen on splitting the Apple TV from the rest of the bunch. (To an extent, it would split the table based on product again.) I think that we should decide on what we should use for the Apple TV's firmware versions before discussing this further. --Dialexio 00:15, 13 November 2011 (MST)

What about bringing back the list like this:

	Apple TV 2G	iPad	iPad 2 (Wi-Fi)
8F190	-	4.3	-
8F191	-	-	4.3
8F191m	4.2	-	-
8F202	4.2.1	-	-
8F305	4.2.2	-	-
8F455	4.3	-	-
9A334	-	5.0	5.0
9A334v	4.4	-	-

--http 15:43, 14 November 2011 (MST)

What about

	Apple TV 2G	iPad 2 (Wi-Fi)
8F191	-	Durango 4.3
8F191m	Durango 4.2	-

--5urd 17:49, 14 November 2011 (MST)

We don't need to repeat the names for every link. They are already on each page in case anybody needs to know. Having them here in the link too just wastes the space. --http 17:52, 14 November 2011 (MST)

Now that you say that, I can see that. I like your idea. --5urd 17:53, 14 November 2011 (MST)

I do see a problem in that... The iPad 3.2.x builds are in the 7B*** range while the 3.1.3 builds are 7D11(?)... --5urd 20:24, 15 November 2011 (MST)

Apologies for neglecting to respond; I have a bit of college work on my hands. It sounds good to me as well. --Dialexio 08:05, 15 November 2011 (MST)

2.0 beta 1

After 1.2 beta 1, the version was renamed to 2.0. The question now is if the next beta was 2.0 beta 1 or beta 2. According to wiki it was beta 1, but I don't believe that, as there was no evidence in this wiki. Does anybody know more? --http 10:44, 24 October 2011 (MDT)

Discussing this on Twitter resulted in the fact that just the iOS version name changed after beta 1 (or was wrong on beta 1), but the beta numbers were continuously. So I removed the non-existent 2.0b1 from the list. -- http 15:43, 24 October 2011 (MDT)

I edited wikipedia to 2.0b2, I doubt anyone will challange that... If they do, I will referance them to this wiki --5urd 14:11, 24 October 2011 (MDT)

iOS 5.1 betas

iOS 5.1 betas are not on the list... --5urd 19:49, 9 May 2012 (MDT)

They are not on the Beta Firmware list either. I have no Apple developer account. Feel free to add known missing ones. --http 00:26, 10 May 2012 (MDT)

ATV Beta Numbering for 5.0

The last 5urd change opened some questions. I don't have access to betas, but I assume the beta version will not be shown anywhere on the screen. Correct me if I'm wrong. This page shows Display Versions of ATV numbers as far as I understand this. And there never was a 4th beta available for ATV. Does this mean we leave out the b4 and match the internal beta version? I would assume so. In any case all pages should match. We currently have these pages:

• this page
• Beta Firmware
• Apple TV Firmware Versions
• key pages (a, b, c)

Right now they don't match (before and after 5urd's change). So we should decide what we want first. --http 13:09, 24 June 2012 (MDT)

I changed it back as HoodooVail 9B5141a is 5.1b3, but (due to Apple's versioning), it is 5.0b3, but listed as b2. I was the one who originally set b4 to b5 and so on. --5urd 17:54, 24 June 2012 (MDT)

Header Rows

The header rows spanning two lines looks really ugly on small screens. I think we should change it to look like this: (6.x Beta)

Date (YYYY/MM/DD)	Build	Apple TV		iPad							iPhone				iPod touch
		2G	3G	2 (Wi‑Fi)	2 (GSM)	2 (CDMA)	2 (Wi‑Fi) [R2]	3 (Wi‑Fi)	3 (CDMA)	3 (Global)	3GS	4 (GSM)	4 (CDMA)	4S	4G

Notice (in the source) the use of a non-breaking hyphen (‑) instead of a hyphen (-) so that a line break won't be used if the column is too small. Also notice the use of a non-breaking space ( ) instead of spaces for the same reason. --5urd 18:16, 24 June 2012 (MDT)

Looks good for me. I'm working mostly on the iPhone though. Let's wait for some other opinions first (or a few days if nobody answers). --http 00:23, 25 June 2012 (MDT)

How to

How can I get the VFDecrypt Key of a Firmware's Filesystem? Because I need the key for the Filesystem of iOS 6 GM (iPad 2 GSM), but on the VFDecrypt Keys page there isn't. Thanks. --Jaggions 13:56, 14 September 2012 (MDT)

GenPass requires a decrypted ramdisk. But to get that, an exploit is needed. So ATM, the iPad 2 (+) and iPhone 4S (+) and iPod touch 5G (+) keys can't be retrieved. As I said, an exploit is needed. But that's kindof a lie. You need an iBoot exploit to upload a custom ramdisk that will be able to access the AES engine of the device. --5urd 19:48, 19 October 2012 (MDT)

So does the iPod touch 4G have a decrypted ramdisk in IPSW's? --adaminsull (talk) 00:28, 30 December 2012 (UTC)