|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
PMB8878
This is the baseband processor used in the iPhone 3G, iPhone 3GS and iPad (3G version). It is upgraded with BBUpdaterExtreme. It is also known as the PMB8878 and is also used on the LG KM900 ARENA. There is a team working on how to port Android on LG ARENA.
Contents
Datasheet
Anyone got one? Infineon provides this, which isn't really useful.
The firmware is a version of Nucleos OS, a realtime OS for embedded platforms. The parser for the AT commands is generated from GNU bison.
Secpack 2.0
This is the security region in the files sent to the X-Gold 608. This is the first 0xCF8 is new fls and eep files.
Layout
0x634--Memory Map 0x714--Descriptor 0xCD4--Post secpack pointer to name 0xCEC--Data length
Endpack
The fls and eep files also have a footer tacked onto the end containing the loader and signature.
Memory Map
FLASH 0x20000000 0x1000000 CODE 0x20000000 0x40000 0b0010(bootstrapper) CODE 0x20040000 0xDC0000 0b0100(main firmware) FFS 0x20A00000 0x100000 0b1100(empty) DYNFFS 0x20A00000 0x100000 0b1100(empty) FFS 0x20B00000 0x40000 0b1011(empty) DYN_EEP 0x20E40000 0x80000 0b0110 SECPACK 0x20EC0000 0x40000 SECZONE 0x20F80000 0x40000 STATIC_EEP 0x20FC0000 0x40000 0b0111 RAM 0x40000000 0x800000
MMU relocation table
Bootloader
Firmware
Complete memory dump
Known iPhone Firmware Versions
1.43.00 2.0 (Build 5A331 - Internal Beta) 1.45.00 2.0 (Build 5A347 - Gold Master) 1.48.02 2.0.1 (Build 5B108) 2.04.03 2.1 (Build 5F90) 2.08.01 2.0.2 (Build 5C1) 2.11.07 2.1 (Build 5F136) 2.28.00 2.2 (Build 5G77) 2.30.03 2.2.1 (Build 5H11) 4.20.01 3.0 beta 1 (Build 7A238j) 4.22.01 3.0 beta 2 (Build 7A259g) 4.24.02 3.0 beta 3 (Build 7A280f) 4.26.08 3.0 (Build 7A341) and 3.0.1 (Build 7A400) 5.08.01 3.1 beta 1 (Build 7C97d) 5.10.01 3.1 beta 2 (Build 7C106c) 5.11.04 3.1 beta 3 (Build 7C116a) 5.11.07 3.1 (Build 7C144) and 3.1.2 (Build 7D11) 5.12.01 3.1.3 (Build 7E18) 5.13.03 4.0 beta 1 (Build 8A230m) and 4.0 beta 2 (Build 8A248c) 5.13.04 4.0 (Build 8A293) 5.14.01 4.1 beta 2 (Build 8B5091b)
Known iPad Firmware Versions
6.15.00 3.2 (Build 7B367)
Accessing Interactive Mode
Interactive mode isn't accessed by sending characters to the baseband. Instead a GPIO pin is raised with a kernel call to preupdate reset.
result = IOConnectCallScalarMethod(conn, 0, 0, 0, 0, 0); //reset(kAppleBasebandConnectMethodResetModem) result = IOConnectCallScalarMethod(conn, 1, 0, 0, 0, 0); //power set(kAppleBasebandConnectMethodRadioOn) result = IOConnectCallScalarMethod(conn, 2, ?, 0, 0, 0); //configuring mux result = IOConnectCallScalarMethod(conn, 7, 0, 0, 0, 0); //powercycle result = IOConnectCallScalarMethod(conn, 8, 0, 0, 0, 0); //preupdate reset result = IOConnectCallScalarMethod(conn, 9, 0, 0, 0, 0); //kAppleBasebandConnectMethodNotifyBasebandPoweringDown
