The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Firmware Keys
VFDecrypt Keys are keys which decrypt the root filesystem of certain (beta) firmwares. Apple uses a to ensure the safety of their files. Over time Apple has changed the way to encrypt firmware files, thus the way to decrypt files as well as the way to get the keys has also.
History
With the release of the iPhone came the IMG2 file format. They were used on all known iPhone OS 1.x firmwares. For the 1.1.x series, they were encrypted with the 0x837 key. The discovery of the 0x837 key led to the ability to decrypt any 1.x firmware.
Following IMG2 came the IMG3 file format. They were introduced with iPhone OS 2.0b4, and have been in use ever since. In order to maintain their integrity, they contain multiple layers of encryption, all based around a public/private key encryption method. Apple took encryption seriously with IMG3 by utilizing AES (based on the Rinjndael key schedule). In order to complicate things, they contain the VFDecrypt key, albeit encrypted, as part of the KBAG structure in the ramdisks.
The ramdisk keys can only be retrieved with the processor specific GID Key. The GID key is currently unretrievable and can only be utilized through the built-in AES engine. To complicate things even more, the engine is only accessible through a special bootrom exploit (jailbreaks typically expose it with /dev/aes_0). This makes usage of the key nearly impossible.
However, once you have access to the AES engine, the entire system falls apart. You are able to upload an encrypted ramdisk and grab the decryption keys for it. Once you manage to decrypt the ramdisk, you can run it through GenPass to decrypt the VFDecrypt key.
Beginning with iOS 6.0b1, Apple tweaked their disk images so they no longer work with VFDecrypt. VFDecrypt will report that the filesystem is decrypted, but you will be unable to mount it. The current workaround is to use dmg from Xpwn to decrypt them. What has changed to break VFDecrypt is currently unknown. Decryption will take slightly longer due to dmg writing its progress to the terminal, but the difference is negligible.
Decrypting
- Main article: Decrypting Firmwares
Notes
Application Processor | iDevice |
---|---|
S5L8900 | iPhone 2G iPhone 3G iPod touch 1G |
S5L8720 | iPod touch 2G |
S5L8920 | iPhone 3GS |
S5L8922 | iPod touch 3G |
S5L8930 (A4) | iPad 1G iPhone 4 iPod touch 4G Apple TV 2G |
S5L8940 (A5) | iPad 2 iPhone 4S |
S5L8942 (A5 Rev A) | iPad 2 (Wi‑Fi) [Rev A] Apple TV 3G iPod touch 5G iPad mini |
S5L8945 (A5X) | iPad 3 |
S5L8947 (A5 Rev B) | Apple TV 3G (Rev A) |
S5L8950 (A6) | iPhone 5 |
S5L8955 (A6X) | iPad 4 |
Certain files share the same key and IV per application processor (per build):
- Update Ramdisk
- Restore Ramdisk
- AppleLogo
- BatteryCharging0
- BatteryCharging1
- BatteryFull
- BatteryLow0
- BatteryLow1
- GlyphCharging
- GlyphPlugin
- Kernelcache
- NeedService
- RecoveryMode
- WTF?
The table on the right lists the application processors and their corresponding devices. This list is also accessable from the main page.
You can use img3decrypt[1] or xpwntool[2] to decrypt these files as described in Ramdisk Decryption. Once done, mount or extract using the tool of your choice.
When posting a key page, please use the key template (IN THE CORRECT ORDER) and do NOT substitute it.
The firmware version number for the Apple TV builds are the ones that the Apple TV reports.
All dates are relative to UTC.
You cannot get A5+ keys until a bootrom exploit is found. If the ramdisk is not encrypted, you may then get the RootFS key ONLY.
Firmware Versions
This is a full and comprehensive list of all firmwares Apple Inc. has made available to the public in some way, be it the dev center or iTunes.
Final
- Main article: Firmware
1.x
Date | Build | iPhone | iPod touch |
---|---|---|---|
2G | 1G | ||
29 Jun 2007 | 1A543a | 1.0 | N/A |
31 Jul 2007 | 1C25 | 1.0.1 | |
21 Aug 2007 | 1C28 | 1.0.2 | |
14 Sep 2007 | 3A100a | N/A | 1.1 |
3A101a | 1.1 | ||
27 Sep 2007 | 3A109a | 1.1.1 | N/A |
3A110a | N/A | 1.1.1 | |
12 Nov 2007 | 3B48b | 1.1.2 | 1.1.2 |
15 Jan 2008 | 4A93 | 1.1.3 | 1.1.3 |
26 Feb 2008 | 4A102 | 1.1.4 | 1.1.4 |
14 Jul 2008 | 4B1 | N/A | 1.1.5 |
2.x
Date | Build | iPhone | iPod touch | ||
---|---|---|---|---|---|
2G | 3G | 1G | 2G | ||
11 Jul 2008 | 5A345 | N/A | 2.0 | N/A | N/A |
5A347 | 2.0 | 2.0 | 2.0 | ||
04 Aug 2008 | 5B108 | 2.0.1 | 2.0.1 | 2.0.1 | |
18 Aug 2008 | 5C1 | 2.0.2 | 2.0.2 | 2.0.2 | |
12 Sep 2008 | 5F136 | 2.1 | 2.1 | N/A | |
09 Sep 2008 | 5F137 | N/A | 2.1 | ||
5F138 | N/A | 2.1.1 | |||
21 Nov 2008 | 5G77 | 2.2 | 2.2 | 2.2 | N/A |
5G77a | N/A | 2.2 | |||
27 Jan 2009 | 5H11 | 2.2.1 | 2.2.1 | 2.2.1 | N/A |
5H11a | N/A | 2.2.1 |
3.x
Date | Build | iPad | iPhone | iPod touch | ||||
---|---|---|---|---|---|---|---|---|
1G | 2G | 3G | 3GS | 1G | 2G | 3G | ||
17 Jun 2009 | 7A341 | N/A | 3.0 | 3.0 | 3.0 | 3.0 | 3.0 | N/A |
31 Jul 2009 | 7A400 | 3.0.1 | 3.0.1 | 3.0.1 | N/A | |||
09 Sep 2009 | 7C144 | 3.1 | 3.1 | 3.1 | ||||
7C145 | N/A | 3.1.1 | 3.1.1 | 3.1.1 | ||||
17 Sep 2009 | 7C146 | N/A | 3.1.1 | |||||
08 Oct 2009 | 7D11 | N/A | 3.1.2 | 3.1.2 | 3.1.2 | 3.1.2 | 3.1.2 | 3.1.2 |
02 Feb 2010 | 7E18 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.3 | 3.1.3 | |
03 Apr 2010 | 7B367 | 3.2 | N/A | |||||
15 Jul 2010 | 7B405 | 3.2.1 | ||||||
11 Aug 2010 | 7B500 | 3.2.2 |
4.x
Date | Build | Apple TV | iPad | iPhone | iPod touch | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2G | 1G | 2 | 3G | 3GS | 4 | 2G | 3G | 4G | |||||
Wi‑Fi | GSM | CDMA | GSM | CDMA | |||||||||
01 Sep 2010 | 8M89 | 4.1 | N/A | ||||||||||
21 Jun 2010 | 8A293 | N/A | 4.0 | 4.0 | 4.0 | N/A | 4.0 | 4.0 | N/A | ||||
15 Jul 2010 | 8A306 | 4.0.1 | 4.0.1 | 4.0.1 | N/A | ||||||||
11 Aug 2010 | 8A400 | 4.0.2 | 4.0.2 | 4.0.2 | N/A | 4.0.2 | 4.0.2 | N/A | |||||
08 Sep 2010 | 8B117 | 4.1 | 4.1 | 4.1 | 4.1 | 4.1 | 4.1 | ||||||
21 Sep 2010 | 8B118 | N/A | 4.1 | ||||||||||
22 Nov 2010 | 8C148 | N/A | 4.2.1 | N/A | 4.2.1 | N/A | 4.2.1 | N/A | 4.2.1 | 4.2.1 | 4.2.1 | ||
8C148a | N/A | 4.2.1 | N/A | ||||||||||
22 Nov 2010 | 8C150 | 4.2 | N/A | ||||||||||
14 Dec 2010 | 8C154 | 4.2.1 | |||||||||||
07 Feb 2010 | 8E128 | N/A | 4.2.5 | N/A | |||||||||
10 Feb 2010 | 8E200 | 4.2.6 | |||||||||||
14 Apr 2011 | 8E303 | 4.2.7 | |||||||||||
04 May 2011 | 8E401 | 4.2.8 | |||||||||||
15 Jul 2011 | 8E501 | 4.2.9 | |||||||||||
25 Jul 2011 | 8E600 | 4.2.10 | |||||||||||
09 Mar 2011 | 8F190 | N/A | 4.3 | N/A | 4.3 | 4.3 | N/A | 4.3 | 4.3 | ||||
8F191 | N/A | 4.3 | 4.3 | 4.3 | N/A | ||||||||
11 Mar 2011 | 8F191m | 4.3 | N/A | ||||||||||
22 Mar 2011 | 8F202 | 4.3 | |||||||||||
10 May 2011 | 8F305 | 4.3 | |||||||||||
01 Aug 2011 | 8F455 | 4.3 | |||||||||||
25 Mar 2011 | 8G4 | N/A | 4.3.1 | 4.3.1 | 4.3.1 | 4.3.1 | N/A | 4.3.1 | 4.3.1 | N/A | 4.3.1 | 4.3.1 | |
14 Apr 2011 | 8H7 | 4.3.2 | 4.3.2 | 4.3.2 | N/A | 4.3.2 | 4.3.2 | 4.3.2 | 4.3.2 | ||||
8H8 | N/A | 4.3.2 | N/A | ||||||||||
04 May 2011 | 8J2 | N/A | 4.3.3 | 4.3.3 | 4.3.3 | N/A | 4.3.3 | 4.3.3 | N/A | 4.3.3 | 4.3.3 | ||
8J3 | N/A | 4.3.3 | N/A | ||||||||||
15 Jul 2011 | 8K2 | 4.3.4 | 4.3.4 | 4.3.4 | 4.3.4 | N/A | 4.3.4 | 4.3.4 | N/A | 4.3.4 | 4.3.4 | ||
25 Jul 2011 | 8L1 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 | 4.3.5 |
5.x
Date | Build | Apple TV | iPad | iPhone | iPod touch | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2G | 3G | 1G | 2 | 3 | 3GS | 4 | 4S | 3G | 4G | ||||||||
Wi‑Fi | GSM | CDMA | Wi‑Fi (A) | Wi-Fi | CDMA | Global | GSM | CDMA | |||||||||
12 Oct 2011 | 9A334 | N/A | 5.0 | 5.0 | 5.0 | 5.0 | N/A | 5.0 | 5.0 | 5.0 | 5.0 | 5.0 | 5.0 | ||||
9A334v | 4.4 | N/A | |||||||||||||||
18 Oct 2011 | 9A335a | 4.4.1 | |||||||||||||||
02 Nov 2011 | 9A336a | 4.4.2 | |||||||||||||||
10 Nov 2011 | 9A405 | N/A | 5.0.1 | 5.0.1 | 5.0.1 | 5.0.1 | N/A | 5.0.1 | 5.0.1 | 5.0.1 | 5.0.1 | 5.0.1 | 5.0.1 | ||||
17 Nov 2011 | 9A405l | 4.4.3 | N/A | ||||||||||||||
15 Dec 2011 | 9A406 | N/A | 5.0.1 | N/A | |||||||||||||
9A406a | 4.4.4 | N/A | |||||||||||||||
07 Mar 2012 | 9B176 | N/A | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | 5.1 | N/A | 5.1 | 5.1 | |
9B179 | N/A | 5.1 | N/A | ||||||||||||||
9B179b | 5.0 | 5.0 | N/A | ||||||||||||||
10 May 2012 | 9B206 | N/A | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | 5.1.1 | |
9B206f | 5.0.1 | 5.0.1 | N/A | ||||||||||||||
25 May 2012 | 9B208 | N/A | 5.1.1 | N/A | |||||||||||||
05 Jun 2012 | 9B830 | 5.0.2 | 5.0.2 | N/A |
6.x
Date | Build | Apple TV | iPad | iPad mini | iPhone | iPod touch | ||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2G | 3G | 2 | 3 | 4 | 1G | 3GS | 4 | 4S | 5 | 4G | 5G | |||||||||||||||||
Orig | Rev A | Wi‑Fi | GSM | CDMA | Wi‑Fi (A) | Wi‑Fi | CDMA | Global | Wi‑Fi | GSM | Global | Wi‑Fi | GSM | Global | GSM | GSM (A) | CDMA | GSM | Global | |||||||||
19 Sep 2012 | 10A403 | N/A | 6.0 | 6.0 | 6.0 | 6.0 | 6.0 | 6.0 | 6.0 | N/A | 6.0 | 6.0 | 6.0 | 6.0 | 6.0 | N/A | 6.0 | N/A | ||||||||||
10A405 | N/A | 6.0 | 6.0 | N/A | ||||||||||||||||||||||||
10A406 | N/A | 6.0 | ||||||||||||||||||||||||||
30 Oct 2012 | N/A | 6.0 | N/A | |||||||||||||||||||||||||
24 Sep 2012 | 10A406e | 5.1 | 5.1 | N/A | ||||||||||||||||||||||||
30 Oct 2012 | 10A407 | N/A | 6.0 | N/A | ||||||||||||||||||||||||
01 Nov 2012 | 10A523 | N/A | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | N/A | 6.0.1 | N/A | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | 6.0.1 | N/A | 6.0.1 | 6.0.1 | |||||||
10A525 | N/A | 6.0.1 | 6.0.1 | N/A | ||||||||||||||||||||||||
09 Nov 2012 | 10A8426 | N/A | 6.0.1 | 6.0.1 | N/A | 6.0.1 | 6.0.1 | N/A | ||||||||||||||||||||
26 Nov 2012 | 10A831 | 5.1.1 | 5.1.1 | 5.1.1 | N/A | |||||||||||||||||||||||
19 Dec 2012 | 10A550 | N/A | 6.0.2 | N/A | ||||||||||||||||||||||||
10A551 | N/A | 6.0.2 | 6.0.2 | N/A | ||||||||||||||||||||||||
10A8550 | N/A | 6.0.2 | 6.0.2 | N/A | ||||||||||||||||||||||||
28 Jan 2013 | 10B141 | N/A | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | 6.1 | N/A | 6.1 | N/A | 6.1 | ||||||||
10B142 | N/A | 6.1 | N/A | |||||||||||||||||||||||||
10B143 | N/A | 6.1 | 6.1 | N/A | ||||||||||||||||||||||||
10B144 | N/A | 6.1 | 6.1 | N/A | 6.1 | N/A | ||||||||||||||||||||||
10B144b | 5.2 | 5.2 | 5.2 | N/A | ||||||||||||||||||||||||
11 Feb 2013 | 10B145 | N/A | 6.1.1 | N/A | ||||||||||||||||||||||||
19 Feb 2013 | 10B146 | N/A | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | N/A | 6.1.2 | N/A | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | 6.1.2 | ||||||
10B147 | N/A | 6.1.2 | 6.1.2 | N/A | 6.1.2 | 6.1.2 | N/A | |||||||||||||||||||||
19 Mar 2013 | 10B329 | N/A | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | 6.1.3 | ||||
10B329a | 5.2.1 | 5.2.1 | 5.2.1 | N/A | ||||||||||||||||||||||||
02 May 2013 | 10B350 | N/A | 6.1.4 | 6.1.4 | N/A | |||||||||||||||||||||||
19 Jun 2013 | 10B809 | 5.3 | 5.3 | 5.3 | N/A |
Beta
- Main article: Beta Firmware
1.x/2.x
Date | Build | iPhone | iPod touch | |
---|---|---|---|---|
2G | 3G | 1G | ||
06 Mar 2008 | 5A147p | 1.2b | N/A | 1.2b |
27 Mar 2008 | 5A225c | 2.0b2 | 2.0b2 | |
08 Apr 2008 | 5A240d | 2.0b3 | 2.0b3 | |
23 Apr 2008 | 5A258f | 2.0b4 | 2.0b4 | |
06 May 2008 | 5A274d | 2.0b5 | 2.0b5 | |
28 May 2008 | 5A292g | 2.0b6P | 2.0b6P | |
29 May 2008 | 5A308 | 2.0b6F | 2.0b6F | |
09 Jun 2008 | 5A331 | 2.0b7 | 2.0b7 | |
26 Jun 2008 | 5A345 | 2.0b8GM | 2.0b8GM | |
24 Jul 2008 | 5F90 | 2.1b | 2.1b | |
30 Jul 2008 | ? | 2.1b2 | 2.1b2 | |
08 Aug 2008 | ? | 2.1b3 | 2.1b3 | |
16 Aug 2008 | ? | 2.1b4 | 2.1b4 | |
25 Sep 2008 | 5G29 | 2.2b | 2.2b | 2.2b |
24 Oct 2008 | ? | 2.2b2 | 2.2b2 | 2.2b2 |
3.x
Date | Build | iPhone | iPod touch | |||
---|---|---|---|---|---|---|
2G | 3G | 3GS | 1G | 2G | ||
17 Mar 2009 | 7A238j | 3.0b | 3.0b | N/A | 3.0b | 3.0b |
31 Mar 2009 | 7A259g | 3.0b2 | 3.0b2 | 3.0b2 | 3.0b2 | |
14 Apr 2009 | 7A280f | 3.0b3 | 3.0b3 | 3.0b3 | 3.0b3 | |
28 Apr 2009 | 7A300g | 3.0b4 | 3.0b4 | 3.0b4 | 3.0b4 | |
06 May 2009 | 7A312g | 3.0b5 | 3.0b5 | 3.0b5 | 3.0b5 | |
08 Jun 2009 | 7A341 | 3.0GM | 3.0GM | 3.0GM | 3.0GM | |
30 Jun 2009 | 7C97d | 3.1b | 3.1b | 3.1b | 3.1b | 3.1b |
14 Jul 2009 | 7C106c | 3.1b2 | 3.1b2 | 3.1b2 | 3.1b2 | 3.1b2 |
27 Jul 2009 | 7C116a | 3.1b3 | 3.1b3 | 3.1b3 | 3.1b3 | 3.1b3 |
4.x
Date | Build | Apple TV | iPad | iPhone | iPod touch | ||||
---|---|---|---|---|---|---|---|---|---|
2G | 1G | 3G | 3GS | 4 | 2G | 3G | 4G | ||
GSM | |||||||||
08 Apr 2010 | 8A230m | N/A | 4.0b | 4.0b | N/A | 4.0b | 4.0b | N/A | |
20 Apr 2010 | 8A248c | 4.0b2 | 4.0b2 | 4.0b2 | 4.0b2 | ||||
04 May 2010 | 8A260b | 4.0b3 | 4.0b3 | 4.0b3 | 4.0b3 | ||||
18 May 2010 | 8A274b | 4.0b4 | 4.0b4 | 4.0b4 | 4.0b4 | ||||
07 Jun 2010 | 8A293 | 4.0GM | 4.0GM | 4.0GM | 4.0GM | ||||
14 Jul 2010 | 8B5080 | N/A | 4.1b | 4.1b | |||||
8B5080c | N/A | 4.1b | 4.1b | 4.1b | N/A | ||||
27 Jul 2010 | 8B5091b | 4.1b2 | 4.1b2 | 4.1b2 | 4.1b2 | 4.1b2 | N/A | ||
03 Aug 2010 | 8B5097d | 4.1b3 | 4.1b3 | 4.1b3 | 4.1b3 | 4.1b3 | |||
01 Sep 2010 | 8B117 | 4.1GM | 4.1GM | 4.1GM | 4.1GM | 4.1GM | |||
15 Sep 2010 | 8C5091e | N/A | 4.2b | 4.2b | 4.2b | 4.2b | 4.2b | 4.2b | 4.2b |
28 Sep 2010 | 8C5101c | 4.2b2 | 4.2b2 | 4.2b2 | 4.2b2 | 4.2b2 | 4.2b2 | 4.2b2 | |
12 Oct 2010 | 8C5115c | 4.2b3 | 4.2b3 | 4.2b3 | 4.2b3 | 4.2b3 | 4.2b3 | 4.2b3 | |
01 Nov 2010 | 8C134 | 4.2GM | 4.2GM | 4.2GM | 4.2GM | 4.2GM | 4.2GM | 4.2GM | |
18 Nov 2010 | 8C134b | 4.2GM2 | N/A | ||||||
18 Nov 2010 | 8C148 | 4.2.1GM | 4.2.1GM | 4.2.1GM | 4.2.1GM | 4.2.1GM | 4.2.1GM | 4.2.1GM | |
12 Jan 2011 | 8F5148b | 4.3b | N/A | 4.3b | 4.3b | N/A | 4.3b | 4.3b | |
12 Jan 2011 | 8F5148c | 4.2b | N/A | ||||||
19 Jan 2011 | 8F5153d | 4.2b2 | 4.3b2 | N/A | 4.3b2 | 4.3b2 | N/A | 4.3b2 | 4.3b2 |
01 Feb 2011 | 8F5166b | 4.2b3 | 4.3b3 | 4.3b3 | 4.3b3 | 4.3b3 | 4.3b3 | ||
03 Mar 2011 | 8F190 | N/A | 4.3GM | 4.3GM | 4.3GM | 4.3GM | 4.3GM |