Recovery Mode (Protocols)

An iPhone 13 Pro Max running in Recovery Mode, recreated using an extracted graphic.

Recovery Mode 1.x (DevID=0x1280)

This is the old Recovery Mode protocol.

Implementions

• kernel driver
• iBooter

Recovery Mode 2.x (DevID=0x1281)

This is the new Recovery Mode protocol used in 2.0 iBoots.

Recovery Mode 3.x (DevID=0x1282)

This is the new Recovery Mode protocol used in 3.0 iBoots.

Recovery Mode 4.x (DevID=0x1283)

This is the new Recovery Mode protocol used in 4.1 iBoots.

Commands

usb_control_msg(idev, 0xA1, 3, 0, 0, buf, 6, 1000); //get status
usb_control_msg(idev, 0x40, 0, 0, 0, buf, strlen(buf), 1000); //send command
usb_control_msg(idev, 0x21, 1, x, 0, fbuf, s, 1000); //send file

After sending a file, request the status several times. Also increment x as you send.

It also has another interface which appears like a USB to serial converter.

Implementations

• iRecovery
• OpeniSend_rec