FTAB File Format

The FTAB file format is mostly found in firmware of some Apple accessories (notably AirPods, probably others), but is also present in IPSW images for devices with an Ultra Wideband chip. It represents a collection of images addressed by 4-byte tags and optionally provides an IMG4 manifest with the signature of its contents.

Structure

A FTAB file starts with a fixed-size header followed by a list of segments, concatenated segment contents and optionally an IMG4 manifest. The header structure is as follows (all integers are little-endian):

// unk_* fields are ignored by all the available parsers at the time of writing.
struct ftab_header {
    uint32_t unk_0; // has different values for different devices
    uint32_t unk_1; // = 0xFFFFFFFF
    uint32_t unk_2; // = 0
    uint32_t unk_3; // = 0
    uint32_t ticket_offset; // offset of the manifest from the start of the file if one is included or 0
    uint32_t ticket_length; // length of the manifest if one is included or 0
    uint32_t unk_4; // = 0
    uint32_t unk_5; // = 0
    uint8_t magic[8]; // = "rkosftab"
    uint32_t segments_count; // the number of segment headers
    uint32_t unk_6; // = 0
};

A list of segment headers directly follows the FTAB header:

struct segment_header {
    uint8_t tag[4]; // The 4-byte tag corresponding to the segment.
    uint32_t offset; // Offset of the segment from the start of the file.
    uint32_t length; // Length of the segment.
    uint32_t unk; // = 0
};

Segment starts are aligned to a 4-byte boundary. Ticket is, however, not aligned.

Tools

• ftabutil: a dumper/builder for FTAB files.
• ftab-dump: dumps contents of a FTAB file into a directory.