https://freemyipod.org/api.php?action=feedcontributions&feedformat=atom&user=760ceb3b9c0ba4872cadf3ce35a7a494 2026-04-09T02:46:37Z User contributions MediaWiki 1.45.1 https://freemyipod.org/index.php?title=RetailOS_Options&diff=22195 2025-12-30T12:01:51Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: fix title and duplicate row</p> <hr /> <div>{{DISPLAYTITLE:retailOS Options}}<br /> <br /> [[retailOS]] has some 'secret' options that you can enable by placing files into iPod_Control/Device.<br /> <br /> The following table shows all known options, with information on what device are they supported. Some of these appear to have no cross-references in [[User:Q3k|q3k]]'s decompilation, but that might be a tooling issue. Ideally, we should test every single one of these :). <br /> <br /> {| class=&quot;wikitable sortable&quot; style=&quot;&quot;<br /> |-<br /> ! rowspan=2 | Name<br /> ! colspan=1 | [[Nano 5G]]<br /> ! colspan=3 | [[Nano 6G]]<br /> ! rowspan=2 | Notes<br /> |-<br /> ! 1.0.2<br /> ! 1.0<br /> ! 1.1<br /> ! 1.2<br /> |-<br /> | _enable_options<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | Required for any other option to work.<br /> |-<br /> | _6bits_accel<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _EQBiasScale<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Contents read.<br /> |-<br /> | _RecorderGainDB<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Contents read.<br /> |-<br /> | _RecorderGainLimit<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Contents read.<br /> |-<br /> | _SpeakerEQPreset<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Contents read.<br /> |-<br /> | _SpeakerEQ_HPF_Fc<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Contents read.<br /> |-<br /> | _accel_data<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _accel_state_logging<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _amc_pde<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _amc_r2d<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _amc_sfd<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _autopow_overlay<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _battery_always_low<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _bvtpowertest<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _camera_one_to_one<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _camera_tvout<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _car_adapter<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _clock_second_tick_type<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _compare_gk2d_tdraw_perf<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _compositor_benchmark<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _compositor_fps<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _compositor_show_overdraw<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _continuous_display_update<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _crossfade_nextprev_disable<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _crossfade_nextprev_long<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _crossfade_nextprev_med<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _crossfade_on<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _dartboard<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Weird mode in which menu/play are swapped and iTunes database seems to be ignored.<br /> |-<br /> | _deblocking_off<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _debug_db<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _demo_freeze_time<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _demo_layout_toggle<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _disable_bpfix<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _disable_cache<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _disable_clock_gating<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _disable_hibe<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _disable_jpeg_decoder<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _disable_mbx_timeout<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Mailbox timeouts? PowerVR MBX timeouts? Untested.<br /> |-<br /> | _disable_overlay_limit<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | _enable_options not required.<br /> |-<br /> | _disable_sleep<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _disable_unsplit_decoders<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _dont_reject_vid<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _drag_back_perf<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _dragster_on<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _enable_amc_logfile<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _enable_crash_logging<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _enable_logging<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Writes high-level logs into iPod_Control/Logs.<br /> |-<br /> | _enable_memory_logging<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _enable_pcm_write2file<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _enable_screenshots<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _enable_tpodlog<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _fast_debug<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _faster_baud_debug<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _firewire_supported<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _fixed_brightness<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _fm_fieldtesting<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _force_AACHE<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _force_AACLC<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _force_volume_level<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _go_fast<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _hang_frame_drop<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _heap_beep<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _hibe_beep<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _hibe_sleep<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _hibernation_ignores_accessories<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _hifi_video_encoding<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _hold3beep<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Halt and wait for JTAG in C_exception_handler. Probably.<br /> |-<br /> | _honor_repeat<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _ignore_volume_pref<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _isp_manual<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _isp_settings_file<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _krypton_firmware<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _krypton_no_autoupdate<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _log_memory_on_vol_keys<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _log_sys_model<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _look_ahead_video_encoding<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _mecca_trace_debug<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _mie_on<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _mikey_state_logging<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _mikey_verbose_logging<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _minutes_to_standby<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _mockup_mode<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _nand_high_clock<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _no_deepsleep<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Preempted by _short_deepsleep.<br /> |-<br /> | _no_look_ahead_video_encoding<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _no_vc0_autopower<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _no_volume_control<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _np_overlay_persist<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _orient_me_not<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _ped_event_logging<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _ped_heartbeat<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _ped_seconds_to_hibernate<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _ped_steps_1000x<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _ped_steps_100x<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _ped_time_1000x<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _ped_time_100x<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _ped_time_10x<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _ped_xyz_logging<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _photo_albums_test<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _power_testing<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _pushui_app_icon_show<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _quick_3bits<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | _enable_options not required.<br /> |-<br /> | _raw_uart_debug<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _rds_robot<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _rds_robot_internal<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _record_max_16mb<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _rental_notify_always<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _reset_rtc<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _seconds_to_graphics_off<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _seconds_to_hibernation<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _seconds_to_screen_off<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _serial_acc_iap_status<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _shake_data<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _short_deepsleep<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _show_autobaud<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _show_bin_voltage<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_brightness<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _show_cache_size<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _show_fixed_time<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _show_fps<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_headset_model<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_max_battery<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_memory<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_numeric_volume<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | Displays numeric volume when changing volume.<br /> |-<br /> | _show_pll<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_speed<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _show_stuck_accelerometer_axis<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_voltage<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | Displays battery voltage at bottom of screen.<br /> |-<br /> | _skipgamedrm<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Seemingly allows Manifest.plist.p7b to not be present when reading eApps/games. If present, will still be checked.<br /> |-<br /> | _speed<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | File contents read (number likely expected). Default -1.<br /> |-<br /> | _springboard_always_hint<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _springboard_fast_swipe_threshold<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _springboard_tumbler_edit_mode<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _springboard_tumbler_fast_swipe_decel_factor<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _springboard_tumbler_slow_swipe_decel_factor<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _springboard_tumbler_text_mode<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _springboard_tumblermode<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _sw_max_minutes<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _sw_seconds_to_dim<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tcsize<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | File contents read (number likely expected).<br /> |-<br /> | _tgfx_benchmark<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _thermal_Stress_enable<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tpodlogprint_to_uart<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _try_spirit_codecs<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _tuner_auto_scan<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _tuner_blend_mono_threshold<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_blend_stereo_threshold<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_buffer_disable<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_buffer_time_show<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_hicut_disable<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_metadata_events_show<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_metadata_parsed_logging<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_metadata_raw_logging<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_metadata_rt_validation_off<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_readings_logging<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_readings_show<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_region_worldwide_enable<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_region_worldwide_force<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_scan_logging<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_scan_logging_start_delay<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_softmute_disable<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_volume_buttons_walk_frequency<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tvout_video_display<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _tvoutwidescreen<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _uart2_debug<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Preempted by _uart30pin_debug.<br /> |-<br /> | _uart30pin_debug<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _ultra_high_power<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _usb_audio_authentication_optional<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_lame_resampling<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_negotiation_optional<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_resampling_method<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_samplerate_match_style<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_show_status<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_sinewave<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_test_mode<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_hub_subclass<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _usb_swap_configs<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _use_SW_ALAC_decoder<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _use_aac_encoder<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _use_tdraw_in_tgfx<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _volume_single_step<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _vp_lang<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _wheel_app_data<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _wheel_raw_data<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _writerawyuvstills<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=User:760ceb3b9c0ba4872cadf3ce35a7a494&diff=22189 2025-12-29T08:53:08Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: </p> <hr /> <div>find me in the iPod Nano Hacking discord! my web site:<br /> https://760ceb3b9c0ba4872cadf3ce35a7a494.neocities.org/</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=RetailOS_Options&diff=22188 2025-12-29T08:51:37Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: rewrote table + added nano 6g</p> <hr /> <div>[[retailOS]] has some 'secret' options that you can enable by placing files into iPod_Control/Device.<br /> <br /> The following table shows all known options, with information on what device are they supported. Some of these appear to have no cross-references in [[User:Q3k|q3k]]'s decompilation, but that might be a tooling issue. Ideally, we should test every single one of these :). <br /> <br /> {| class=&quot;wikitable sortable&quot; style=&quot;&quot;<br /> |-<br /> ! rowspan=2 | Name<br /> ! colspan=1 | [[Nano 5G]]<br /> ! colspan=3 | [[Nano 6G]]<br /> ! rowspan=2 | Notes<br /> |-<br /> ! 1.0.2<br /> ! 1.0<br /> ! 1.1<br /> ! 1.2<br /> |-<br /> | _enable_options<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | Required for any other option to work.<br /> |-<br /> | _6bits_accel<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _EQBiasScale<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Contents read.<br /> |-<br /> | _RecorderGainDB<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Contents read.<br /> |-<br /> | _RecorderGainLimit<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Contents read.<br /> |-<br /> | _SpeakerEQPreset<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Contents read.<br /> |-<br /> | _SpeakerEQ_HPF_Fc<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Contents read.<br /> |-<br /> | _accel_data<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _accel_state_logging<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _amc_pde<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _amc_r2d<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _amc_sfd<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _autopow_overlay<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _battery_always_low<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _bvtpowertest<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _camera_one_to_one<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _camera_tvout<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _car_adapter<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _clock_second_tick_type<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _compare_gk2d_tdraw_perf<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _compositor_benchmark<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _compositor_fps<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _compositor_show_overdraw<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _continuous_display_update<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _crossfade_nextprev_disable<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _crossfade_nextprev_long<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _crossfade_nextprev_med<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _crossfade_on<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _dartboard<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Weird mode in which menu/play are swapped and iTunes database seems to be ignored.<br /> |-<br /> | _deblocking_off<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _debug_db<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _demo_freeze_time<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _demo_layout_toggle<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _disable_bpfix<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _disable_cache<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _disable_clock_gating<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _disable_hibe<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _disable_jpeg_decoder<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _disable_mbx_timeout<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Mailbox timeouts? PowerVR MBX timeouts? Untested.<br /> |-<br /> | _disable_overlay_limit<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | _enable_options not required.<br /> |-<br /> | _disable_sleep<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _disable_unsplit_decoders<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _dont_reject_vid<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _drag_back_perf<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _dragster_on<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _enable_amc_logfile<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _enable_crash_logging<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _enable_logging<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Writes high-level logs into iPod_Control/Logs.<br /> |-<br /> | _enable_memory_logging<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _enable_options<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Required for any other option to work.<br /> |-<br /> | _enable_pcm_write2file<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _enable_screenshots<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _enable_tpodlog<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _fast_debug<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _faster_baud_debug<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _firewire_supported<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _fixed_brightness<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _fm_fieldtesting<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _force_AACHE<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _force_AACLC<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _force_volume_level<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _go_fast<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _hang_frame_drop<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _heap_beep<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _hibe_beep<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _hibe_sleep<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _hibernation_ignores_accessories<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _hifi_video_encoding<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _hold3beep<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Halt and wait for JTAG in C_exception_handler. Probably.<br /> |-<br /> | _honor_repeat<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _ignore_volume_pref<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _isp_manual<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _isp_settings_file<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _krypton_firmware<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _krypton_no_autoupdate<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _log_memory_on_vol_keys<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _log_sys_model<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _look_ahead_video_encoding<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _mecca_trace_debug<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _mie_on<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _mikey_state_logging<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _mikey_verbose_logging<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _minutes_to_standby<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _mockup_mode<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _nand_high_clock<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _no_deepsleep<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Preempted by _short_deepsleep.<br /> |-<br /> | _no_look_ahead_video_encoding<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _no_vc0_autopower<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _no_volume_control<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _np_overlay_persist<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _orient_me_not<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _ped_event_logging<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _ped_heartbeat<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _ped_seconds_to_hibernate<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _ped_steps_1000x<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _ped_steps_100x<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _ped_time_1000x<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _ped_time_100x<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _ped_time_10x<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _ped_xyz_logging<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _photo_albums_test<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _power_testing<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _pushui_app_icon_show<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _quick_3bits<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | _enable_options not required.<br /> |-<br /> | _raw_uart_debug<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _rds_robot<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _rds_robot_internal<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _record_max_16mb<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _rental_notify_always<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _reset_rtc<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _seconds_to_graphics_off<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _seconds_to_hibernation<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _seconds_to_screen_off<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _serial_acc_iap_status<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _shake_data<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _short_deepsleep<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _show_autobaud<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _show_bin_voltage<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_brightness<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _show_cache_size<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _show_fixed_time<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _show_fps<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_headset_model<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_max_battery<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_memory<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_numeric_volume<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | Displays numeric volume when changing volume.<br /> |-<br /> | _show_pll<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_speed<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _show_stuck_accelerometer_axis<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _show_voltage<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | Displays battery voltage at bottom of screen.<br /> |-<br /> | _skipgamedrm<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Seemingly allows Manifest.plist.p7b to not be present when reading eApps/games. If present, will still be checked.<br /> |-<br /> | _speed<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | File contents read (number likely expected). Default -1.<br /> |-<br /> | _springboard_always_hint<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _springboard_fast_swipe_threshold<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _springboard_tumbler_edit_mode<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _springboard_tumbler_fast_swipe_decel_factor<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _springboard_tumbler_slow_swipe_decel_factor<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _springboard_tumbler_text_mode<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _springboard_tumblermode<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _sw_max_minutes<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _sw_seconds_to_dim<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tcsize<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | File contents read (number likely expected).<br /> |-<br /> | _tgfx_benchmark<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _thermal_Stress_enable<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tpodlogprint_to_uart<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _try_spirit_codecs<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _tuner_auto_scan<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _tuner_blend_mono_threshold<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_blend_stereo_threshold<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_buffer_disable<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_buffer_time_show<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_hicut_disable<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_metadata_events_show<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_metadata_parsed_logging<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_metadata_raw_logging<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_metadata_rt_validation_off<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_readings_logging<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_readings_show<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_region_worldwide_enable<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_region_worldwide_force<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_scan_logging<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_scan_logging_start_delay<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_softmute_disable<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tuner_volume_buttons_walk_frequency<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _tvout_video_display<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _tvoutwidescreen<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _uart2_debug<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | Preempted by _uart30pin_debug.<br /> |-<br /> | _uart30pin_debug<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _ultra_high_power<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _usb_audio_authentication_optional<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_lame_resampling<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_negotiation_optional<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_resampling_method<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_samplerate_match_style<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_show_status<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_sinewave<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_audio_test_mode<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _usb_hub_subclass<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _usb_swap_configs<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _use_SW_ALAC_decoder<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _use_aac_encoder<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _use_tdraw_in_tgfx<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _volume_single_step<br /> | {{no}}<br /> | {{yes}}<br /> | {{yes}}<br /> | {{yes}}<br /> | <br /> |-<br /> | _vp_lang<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _wheel_app_data<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _wheel_raw_data<br /> | {{yes}}&lt;ref name=&quot;unused&quot;&gt;Possibly unused?&lt;/ref&gt;<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |-<br /> | _writerawyuvstills<br /> | {{yes}}<br /> | {{no}}<br /> | {{no}}<br /> | {{no}}<br /> | <br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Template:No&diff=22187 2025-12-29T07:50:30Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: Created page with &quot;&lt;noinclude&gt;{| class=&quot;wikitable&quot; |- |&lt;/noinclude&gt;style=&quot;background:#FFC7C7;color:black;vertical-align:middle;text-align:{{{align|center}}};{{{style|}}}&quot; class=&quot;table-no&quot;|{{{1|N...&quot;</p> <hr /> <div>&lt;noinclude&gt;{| class=&quot;wikitable&quot;<br /> |-<br /> |&lt;/noinclude&gt;style=&quot;background:#FFC7C7;color:black;vertical-align:middle;text-align:{{{align|center}}};{{{style|}}}&quot; class=&quot;table-no&quot;|{{{1|No}}}&lt;noinclude&gt;<br /> |}<br /> {{documentation}}<br /> &lt;/noinclude&gt;</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Template:Yes&diff=22186 2025-12-29T07:50:13Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: Created page with &quot;&lt;noinclude&gt; {| class=&quot;wikitable&quot; |- |&lt;/noinclude&gt;style=&quot;background:#9EFF9E;color:black;vertical-align:middle;text-align:{{{align|center}}};{{{style|}}}&quot; class=&quot;table-yes&quot;|{{{1...&quot;</p> <hr /> <div>&lt;noinclude&gt;<br /> {| class=&quot;wikitable&quot;<br /> |-<br /> |&lt;/noinclude&gt;style=&quot;background:#9EFF9E;color:black;vertical-align:middle;text-align:{{{align|center}}};{{{style|}}}&quot; class=&quot;table-yes&quot;|{{{1|Yes}}}&lt;noinclude&gt;<br /> |}<br /> {{documentation}}<br /> &lt;/noinclude&gt;</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=RetailOS_Options&diff=22165 2025-07-04T04:47:10Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: change link</p> <hr /> <div>{{DISPLAYTITLE:retailOS Options}}<br /> [[RetailOS]] has some 'secret' options that you can enable by placing files into iPod_Control/Device.<br /> <br /> The following table shows all known options, with information on what device are they supported. Some of these appear to have no cross-references in q3k's decompilation, but that might be a tooling issue. Ideally, we should test every single one of these :).<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! File !! Functionality !! Nano 5G<br /> |-<br /> | '''_enable_options''' || '''This file must be present for any other option to work.''' || ✔️<br /> |-<br /> | _show_numeric_volume || Displays numeric value when changing volume. || ✔️<br /> |-<br /> | _disable_cache || || ✔️ (Unused?)<br /> |-<br /> | _go_fast || || ✔️ (Unused?)<br /> |-<br /> | _show_voltage || Displays battery voltage at bottom of screen. || ✔️<br /> |-<br /> | _show_speed || || ✔️<br /> |-<br /> | _show_memory || Displays heap statistics at bottom of screen. || ✔️<br /> |-<br /> | _show_fps || || ✔️<br /> |-<br /> | _disable_mbx_timeout || Mailbox timeouts? PowerVR MBX timeouts? Untested. || ✔️<br /> |-<br /> | _tvoutwidescreen || || ✔️<br /> |-<br /> | _enable_logging || Writes high-level logs into iPod_Control/Logs. || ✔️<br /> |-<br /> | _enable_crash_logging || || ✔️ (Unused?)<br /> |-<br /> | _enable_memory_logging || || ✔️ (Unused?)<br /> |-<br /> | _disable_jpeg_decoder || || ✔️ (Unused?)<br /> |-<br /> | _disable_sleep || || ✔️<br /> |-<br /> | _hibe_sleep || || ✔️<br /> |-<br /> | _disable_hibe || || ✔️<br /> |-<br /> | _hibe_beep || || ✔️<br /> |-<br /> | _short_deepsleep || || ✔️<br /> |-<br /> | _no_deepsleep || Preempted by _short_deepsleep. || ✔️<br /> |-<br /> | _dont_reject_vid || || ✔️<br /> |-<br /> | _tcsize || File contents read (number likely expected). || ✔️<br /> |-<br /> | _speed || File contents read (number likely expected). Default -1. || ✔️ (Unused?)<br /> |-<br /> | _no_vc0_autopower || || ✔️ (Unused?)<br /> |-<br /> | _autopow_overlay || || ✔️ (Unused?)<br /> |-<br /> | _dartboard || Weird mode in which menu/play are swapped and iTunes database seems to be ignored. || ✔️ <br /> |-<br /> | _show_brightness || || ✔️ (Unused?)<br /> |-<br /> | _car_adapter || || ✔️<br /> |-<br /> | _usb_swap_configs || || ✔️<br /> |-<br /> | _usb_audio_sinewave || || ✔️<br /> |-<br /> | _usb_audio_authentication_optional || || ✔️ (Unused?)<br /> |-<br /> | _usb_audio_negotiation_optional || || ✔️ (Unused?)<br /> |-<br /> | _usb_audio_test_mode || || ✔️ (Unused?)<br /> |-<br /> | _usb_audio_lame_resampling || || ✔️ (Unused?)<br /> |-<br /> | _usb_audio_samplerate_match_style || || ✔️ (Unused?)<br /> |-<br /> | _usb_audio_resampling_method || || ✔️ (Unused?)<br /> |-<br /> | _usb_audio_show_status || || ✔️<br /> |-<br /> | _serial_acc_iap_status || || ✔️ (Unused?)<br /> |-<br /> | _battery_always_low || || ✔️<br /> |-<br /> | _show_cache_size || || ✔️<br /> |-<br /> | _disable_unsplit_decoders || || ✔️ (Unused?)<br /> |-<br /> | _heap_beep || || ✔️ (Unused?)<br /> |-<br /> | _show_autobaud || || ✔️<br /> |-<br /> | _ignore_volume_pref || || ✔️<br /> |-<br /> | _no_volume_control || || ✔️<br /> |-<br /> | _record_max_16mb || || ✔️<br /> |-<br /> | _vp_lang || || ✔️ (Unused?)<br /> |-<br /> | _mockup_mode || || ✔️ (Unused?)<br /> |-<br /> | _tvout_video_display || || ✔️ (Unused?)<br /> |-<br /> | _deblocking_off || || ✔️ (Unused?)<br /> |-<br /> | _force_AACHE || || ✔️ (Unused?)<br /> |-<br /> | _force_AACLC || || ✔️ (Unused?)<br /> |-<br /> | _reset_rtc || || ✔️ (Unused?)<br /> |-<br /> | _no_volume_control || || ✔️<br /> |-<br /> | _honor_repeat || || ✔️<br /> |-<br /> | _rental_notify_always || || ✔️<br /> |-<br /> | _uart30pin_debug || || ✔️<br /> |-<br /> | _uart2_debug || Preempted by _uart30pin_debug. || ✔️<br /> |-<br /> | _mie_on || || ✔️ (Unused?)<br /> |-<br /> | _dragster_on || || ✔️ (Unused?)<br /> |-<br /> | _try_spirit_codecs || || ✔️<br /> |-<br /> | _amc_r2d || || ✔️<br /> |-<br /> | _crossfade_on || || ✔️ (Unused?)<br /> |-<br /> | _mecca_trace_debug || || ✔️ (Unused?)<br /> |-<br /> | _use_aac_encoder || || ✔️<br /> |-<br /> | _wheel_raw_data || || ✔️ (Unused?)<br /> |-<br /> | _wheel_app_data || || ✔️<br /> |-<br /> | _accel_data || || ✔️<br /> |-<br /> | _orient_me_not || || ✔️<br /> |-<br /> | _shake_data || || ✔️ (Unused?)<br /> |-<br /> | _hold3beep || Halt and wait for JTAG in C_exception_handler. Probably. || ✔️<br /> |-<br /> | _skipgamedrm || Seemingly allows Manifest.plist.p7b to not be present when reading eApps/games. If present, will still be checked. || ✔️<br /> |-<br /> | _firewire_supported || || ✔️<br /> |-<br /> | _debug_db || || ✔️ (Unused?)<br /> |-<br /> | _EQBiasScale || Contents read. || ✔️ (Unused?)<br /> |-<br /> | _RecorderGainDB || Contents read. || ✔️ (Unused?)<br /> |-<br /> | _SpeakerEQ_HPF_Fc || Contents read. || ✔️ (Unused?)<br /> |-<br /> | _SpeakerEQPreset || Contents read. || ✔️ (Unused?)<br /> |-<br /> | _RecorderGainLimit || Contents read. || ✔️ (Unused?)<br /> |-<br /> | _6bits_accel || || ✔️ (Unused?)<br /> |-<br /> | _disable_bpfix || || ✔️ (Unused?)<br /> |-<br /> | _tuner_readings_show || || ✔️<br /> |-<br /> | _tuner_metadata_events_show || || ✔️<br /> |-<br /> | _tuner_buffer_time_show || || ✔️<br /> |-<br /> | _tuner_readings_logging || || ✔️<br /> |-<br /> | _tuner_metadata_raw_logging || || ✔️<br /> |-<br /> | _tuner_metadata_parsed_logging || || ✔️<br /> |-<br /> | _tuner_scan_logging || || ✔️<br /> |-<br /> | _tuner_auto_scan || || ✔️<br /> |-<br /> | _tuner_softmute_disable || || ✔️<br /> |-<br /> | _tuner_hicut_disable || || ✔️<br /> |-<br /> | _hifi_video_encoding || || ✔️<br /> |-<br /> | _no_look_ahead_video_encoding || || ✔️<br /> |-<br /> | _look_ahead_video_encoding || || ✔️<br /> |-<br /> | _bvtpowertest || || ✔️<br /> |-<br /> | _disable_clock_gating || || ✔️<br /> |-<br /> | _writerawyuvstills || || ✔️<br /> |-<br /> | _ped_time_10x || || ✔️<br /> |-<br /> | _power_testing || || ✔️<br /> |-<br /> | _ped_xyz_logging || || ✔️<br /> |-<br /> | _ped_heartbeat || || ✔️<br /> |-<br /> | _ped_time_100x || || ✔️<br /> |-<br /> | _ped_time_1000x || || ✔️<br /> |-<br /> | _log_sys_model || || ✔️ (Unused?)<br /> |-<br /> | _fm_fieldtesting || || ✔️<br /> |-<br /> | _nand_high_clock || || ✔️ (Unused?)<br /> |-<br /> | _disable_overlay_limit || || ✔️ (Unused?)<br /> |-<br /> | _show_max_battery || || ✔️<br /> |-<br /> | _show_fixed_time || || ✔️<br /> |-<br /> | _photo_albums_test || || ✔️<br /> |-<br /> | _show_pll || || ✔️<br /> |-<br /> | _hang_frame_drop || || ✔️<br /> |-<br /> | _disable_overlay_limit || _enable_options not required. || ✔️ (Unused?)<br /> |-<br /> | _quick_3bits || _enable_options not required. || ✔️ (Unused?)<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Classic&diff=22164 2025-07-03T04:55:00Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: fix broken page</p> <hr /> <div>#REDIRECT [[Classic 6G]]<br /> {{DISPLAYTITLE:iPod classic}}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Classic_6G&diff=22163 2025-06-23T05:10:24Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: fix all dead links + add links</p> <hr /> <div>{{DISPLAYTITLE:iPod classic (6th generation)}}<br /> This page concerns the mainline iPods branded with the &quot;classic&quot; name. These iPods mark the switch from PortalPlayer to Samsung processors and were the last mainline iPods ever released. Four versions of this iPod exist, all branded with &quot;classic&quot;: the [[#Initial|initial version]], released in 2007, a thinner [[#Rev A|Rev A]], released in 2008, [[#Rev B|Rev B]] released in 2009 and a final Rev C revision not documented here. These revisions are sometimes called the 6th, 6.5th, 7th, and 7.5th generation respectively.<br /> <br /> ==Initial==<br /> This is the first version of the 6th generation &quot;classic&quot; branded iPod. It was available in an 80GB and 160GB model.<br /> <br /> ===Components===<br /> [[File:classic_1g_frt_a.png|500px|thumb|none|Front of the circuit board]]<br /> [[File:classic_1g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 3<br /> | CPU<br /> | Samsung S5L8702<br /> |<br /> | ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702. Same as on the [[Nano 3G]]<br /> |-<br /> | 2<br /> | SDRAM<br /> | K4X51163PE<br /> |<br /> | <br /> |-<br /> | 5<br /> | Utility Flash<br /> | [https://web.archive.org/web/20101130050518/http://sst.com/products/?inode=41340 SST25VF080B]<br /> |<br /> | Same as on the [[Nano 3G]]<br /> |-<br /> | 4<br /> | Audio codec<br /> | [https://web.archive.org/web/20110626184448id_/http://www.cirrus.com/en/pubs/proDatasheet/CS42L55_F1.pdf Cirrus Logic CS42L55]<br /> | APPLE, 338S0394, A1GIO736, MAL<br /> | <br /> |-<br /> | 1<br /> | Power manager<br /> | NXP PCF50635<br /> | APPLE, 338S0445, 2114.102, ZPD7383Y<br /> | <br /> |-<br /> | 6<br /> | USB charging<br /> | LTC4066<br /> |<br /> |<br /> |}<br /> <br /> ===Helpful pages===<br /> Teardowns:<br /> *&lt;s&gt;TheSeven's broken Classic 1G board (High-res): [http://img43.imageshack.us/img43/6619/6gback.jpg front] [http://img7.imageshack.us/img7/1858/6gfront.jpg back]&lt;/s&gt;&lt;sup&gt;(dead link)&lt;/sup&gt;<br /> Other: <br /> *https://web.archive.org/web/20100527224740/http://homepage.mac.com/marc.heijligers/audio/ipod/comparison/measurements/measurements.html<br /> <br /> ==Rev A==<br /> This is a revised version of the 6th generation iPod with the &quot;classic&quot; name. It is thinner than the [[#Initial||160GB initial model]] and was only available with 120GB storage.<br /> <br /> ===Components===<br /> [[File:classic_2g_frt_a.jpg|500px|thumb|none|Front of the circuit board]]<br /> [[File:classic_2g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br /> <br /> Almost exactly the same hardware as the [[#Initial|initial model]], except that region A is populated. This presumably communicates with the new headphone/remote that Apple chose for this device to support.<br /> ===Helpful pages===<br /> Teardowns:<br /> *&lt;s&gt;http://www.chinaveboss.com/faq_info.html?faqs_id=53&amp;fcPath=1&amp;zenid=19755464b2fde0cb4f7a8877cfa6649c&lt;/s&gt;&lt;sup&gt;(dead link)&lt;/sup&gt;<br /> <br /> ==Rev B==<br /> Rev B is a re-introduced 160GB revision of the classic, announced on September 9, 2009. It is the same size as the [[#Rev A|Rev A]] model.<br /> <br /> ===Components===<br /> [[File:Front_3g.jpg|500px|thumb|none|Front of the circuit board]]<br /> [[File:Back_3g.jpg|500px|thumb|none|Back of the circuit board]]<br /> <br /> No better teardown pictures of this revision have been found or made by us yet. There is, however, [http://www.ilounge.com/index.php/news/comments/ipod-classic-160gb-changes-new-firmware-engraving/ a basic guide of the non-electronic differences] by iLounge. Since the model number is the same as [[#Rev A|Rev A]], there probably aren't any worthwhile (if any) changes in the hardware.<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 3<br /> | CPU<br /> | [https://freemyipod.org/wiki/S5L8702 Samsung S5L8702]<br /> |337S3526 8702 N26P9U4 1011 ARM<br /> | ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702. Same as on the [[Nano 3G]]<br /> |-<br /> | 2<br /> | SDRAM<br /> | K4X51163PE<br /> |<br /> | <br /> |-<br /> | 5<br /> | Utility Flash<br /> | [https://web.archive.org/web/20101130050518/http://sst.com/products/?inode=41340 SST25VF080B]<br /> |<br /> | Same as on the [[Nano 3G]]<br /> |-<br /> | 4<br /> | Audio codec<br /> | [https://web.archive.org/web/20110626184448id_/http://www.cirrus.com/en/pubs/proDatasheet/CS42L55_F1.pdf Cirrus Logic CS42L55]<br /> | APPLE 338S0394 AICK0952 MAL<br /> | <br /> |-<br /> | 1<br /> | Power manager<br /> | NXP PCF50635<br /> | APPLE 338S0445 78030 82 D780113<br /> | <br /> |-<br /> | 6<br /> | USB charging<br /> | LTC4066<br /> |4066T 84453<br /> |<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Classic_6G&diff=22162 2025-06-23T05:00:03Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: get rid of &quot;terminology&quot; and move into h3 heading + move images to Components subheading + minor changes</p> <hr /> <div>{{DISPLAYTITLE:iPod classic (6th generation)}}<br /> This page concerns the mainline iPods branded with the &quot;classic&quot; name. These iPods mark the switch from PortalPlayer to Samsung processors and were the last mainline iPods ever released. Four versions of this iPod exist, all branded with &quot;classic&quot;: the [[#Initial|initial version]], released in 2007, a thinner [[#Rev A|Rev A]], released in 2008, [[#Rev B|Rev B]] released in 2009 and a final Rev C revision not documented here. These revisions are sometimes called the 6th, 6.5th, 7th, and 7.5th generation respectively.<br /> <br /> ==Initial==<br /> This is the first version of the 6th generation &quot;classic&quot; branded iPod. It was available in an 80GB and 160GB model.<br /> <br /> ===Components===<br /> [[File:classic_1g_frt_a.png|500px|thumb|none|Front of the circuit board]]<br /> [[File:classic_1g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 3<br /> | CPU<br /> | Samsung S5L8702<br /> |<br /> | ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702. Same as on the Nano 3G<br /> |-<br /> | 2<br /> | SDRAM<br /> | K4X51163PE<br /> |<br /> | <br /> |-<br /> | 5<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41340 SST25VF080B]<br /> |<br /> | Same as on the Nano 3G<br /> |-<br /> | 4<br /> | Audio codec<br /> | [http://www.cirrus.com/en/pubs/proDatasheet/CS42L55_F1.pdf Cirrus Logic CS42L55]<br /> | APPLE, 338S0394, A1GIO736, MAL<br /> | <br /> |-<br /> | 1<br /> | Power manager<br /> | NXP PCF50635<br /> | APPLE, 338S0445, 2114.102, ZPD7383Y<br /> | <br /> |-<br /> | 6<br /> | USB charging<br /> | LTC4066<br /> |<br /> |<br /> |}<br /> <br /> ===Helpful pages===<br /> Teardowns:<br /> *TheSeven's broken Classic 1G board (High-res): [http://img43.imageshack.us/img43/6619/6gback.jpg front] [http://img7.imageshack.us/img7/1858/6gfront.jpg back]<br /> Other:<br /> *http://homepage.mac.com/marc.heijligers/audio/ipod/comparison/measurements/measurements.html<br /> <br /> ==Rev A==<br /> This is a revised version of the 6th generation iPod with the &quot;classic&quot; name. It is thinner than the 160GB [[#Initial||initial revision]] and was only available with 120GB storage.<br /> <br /> ===Components===<br /> [[File:classic_2g_frt_a.jpg|500px|thumb|none|Front of the circuit board]]<br /> [[File:classic_2g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br /> Almost exactly the same hardware as the [[#Initial]], except that region A is populated. This presumably communicates with the new headphone/remote that Apple chose for this device to support.<br /> ===Helpful pages===<br /> Teardowns:<br /> *http://www.chinaveboss.com/faq_info.html?faqs_id=53&amp;fcPath=1&amp;zenid=19755464b2fde0cb4f7a8877cfa6649c<br /> <br /> ==Rev B==<br /> Rev B is a re-introduced 160GB revision of the classic, announced on September 9, 2009. It is the same size as the [[#Rev A|Rev A]] model.<br /> <br /> ===Components===<br /> [[File:Front_3g.jpg|500px|thumb|none|Front of the circuit board]]<br /> [[File:Back_3g.jpg|500px|thumb|none|Back of the circuit board]]<br /> <br /> No better teardown pictures of this revision have been found or made by us yet. There is, however, [http://www.ilounge.com/index.php/news/comments/ipod-classic-160gb-changes-new-firmware-engraving/ a basic guide of the non-electronic differences] by iLounge. Since the model number is the same as [[#Rev A|Rev A]], there probably aren't any worthwhile (if any) changes in the hardware.<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 3<br /> | CPU<br /> | [https://freemyipod.org/wiki/S5L8702 Samsung S5L8702]<br /> |337S3526 8702 N26P9U4 1011 ARM<br /> | ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702. Same as on the Nano 3G<br /> |-<br /> | 2<br /> | SDRAM<br /> | K4X51163PE<br /> |<br /> | <br /> |-<br /> | 5<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41340 SST25VF080B]<br /> |<br /> | Same as on the Nano 3G<br /> |-<br /> | 4<br /> | Audio codec<br /> | [http://www.cirrus.com/en/pubs/proDatasheet/CS42L55_F1.pdf Cirrus Logic CS42L55]<br /> | APPLE 338S0394 AICK0952 MAL<br /> | <br /> |-<br /> | 1<br /> | Power manager<br /> | NXP PCF50635<br /> | APPLE 338S0445 78030 82 D780113<br /> | <br /> |-<br /> | 6<br /> | USB charging<br /> | LTC4066<br /> |4066T 84453<br /> |<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Classic&diff=22161 2025-06-23T04:56:53Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: add display title</p> <hr /> <div>{{DISPLAYTITLE:iPod classic}}<br /> #REDIRECT [[Classic 6G]]</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_7G&diff=22160 2025-06-23T04:56:12Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: move images to components section</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (7th generation)}}<br /> ==Components==<br /> [[File:Nano7g_front.jpg|500px|thumb|none|Photo of the circuit board]]<br /> [[File:Nano7g_back.jpg|500px|thumb|none|Close up of the larger chips on the circuit board]]<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | &lt;span style=&quot;color:#ff0004&quot;&gt;Red&lt;/span&gt;<br /> | PMIC<br /> | <br /> | Apple 338S1099<br /> | Guessing based on connectivity to power components around.<br /> |-<br /> | &lt;span style=&quot;color:#ff9024&quot;&gt;Orange&lt;/span&gt;<br /> | Bluetooth + FM radio<br /> | Broadcom BCM2078KUBG<br /> |<br /> | <br /> |-<br /> | &lt;span style=&quot;color:#f3e00e&quot;&gt;Yellow&lt;/span&gt;<br /> |<br /> | NXP Semiconductors 1609A1<br /> |<br /> |<br /> |-<br /> | &lt;span style=&quot;color:#16dc81&quot;&gt;Green&lt;/span&gt;<br /> |<br /> |<br /> | 75203 23017<br /> |<br /> |-<br /> | &lt;span style=&quot;color:#2343e8&quot;&gt;Blue&lt;/span&gt;<br /> |<br /> |<br /> | 75292 98820<br /> |<br /> |}<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | &lt;span style=&quot;color:#ff0000&quot;&gt;Red&lt;/span&gt;<br /> | NAND flash<br /> | Toshiba THGBX2G7D2JLA01 128 Gb (16 GB)<br /> |<br /> | <br /> |-<br /> | &lt;span style=&quot;color:#ff9024&quot;&gt;Orange&lt;/span&gt;<br /> | Touchscreen controller<br /> | Texas Instruments 343S0538<br /> |<br /> | <br /> |-<br /> | &lt;span style=&quot;color:#f3e00e&quot;&gt;Yellow&lt;/span&gt;<br /> |<br /> | <br /> | Apple 338S1146<br /> |<br /> |-<br /> | &lt;span style=&quot;color:#16dc81&quot;&gt;Green&lt;/span&gt;<br /> | SoC/CPU<br /> | S5L8740<br /> | 339S0193<br /> | 8740 per IMG1. Guessing based on similar package to N6G SoC/CPU. Also has the most diffpairs running to/from it (from delayered PCB).<br /> |}<br /> <br /> ==Helpful pages==<br /> Teardowns:<br /> * https://www.ifixit.com/Teardown/iPod+Nano+7th+Generation+Teardown/10826<br /> &lt;!--<br /> Reviews:<br /> * TODO<br /> --&gt;<br /> <br /> == Core ==<br /> <br /> Cortex A5 according to CP15:<br /> <br /> &lt;pre&gt;<br /> ID code: 0x410fc050<br /> Implementer: ARM<br /> Variant: 0x0<br /> Architecture: See CPUID<br /> Part number: c05, Revision: 0<br /> &lt;/pre&gt;<br /> <br /> == Memory Map ==<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Address !! Name<br /> |-<br /> | 0x38C00000<br /> | AES<br /> |-<br /> | 0x3C500000<br /> | CLKCON<br /> |-<br /> | 0x3C700000<br /> | TIMER<br /> |-<br /> | 0x3CC00000<br /> | UART0<br /> |-<br /> | 0x3CF00000<br /> | GPIO<br /> |-<br /> | 0x3D100000<br /> | CHIPID<br /> |}<br /> <br /> == Clock Gates ==<br /> <br /> There is no big debug table with all clock gates in N7G RetailOS, so the following has been written out by hand:<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Address !! Bits (clear to power on) !! Meaning !! Source<br /> |-<br /> | 0x3C50006C<br /> | 0x2000<br /> | 'SPI power'<br /> | WTF DevicePowerManagement.dll<br /> |-<br /> | 0x3C50004C<br /> | 0x4<br /> | 'SPI power'<br /> | WTF DevicePowerManagement.dll<br /> |-<br /> | 0x3C50004c<br /> | 0x1f800020<br /> | Timer<br /> | WTF IpodSec.dll<br /> |-<br /> | 0x3C500058<br /> | 0x60<br /> | Timer<br /> | WTF IpodSec.dll<br /> |-<br /> | 0x3c50006c<br /> | 0xc0007f<br /> | Timer<br /> | WTF IpodSec.dll<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_6G&diff=22159 2025-06-23T04:54:09Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: move images to components section</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (6th generation)}}<br /> ==Components==<br /> [[File:nano_6g_frt_a.png|500px|thumb|none|Front of the circuit board]]<br /> [[File:nano_6g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | &lt;span style=&quot;color:red&quot;&gt;Red&lt;/span&gt;<br /> | NAND Flash<br /> | <br /> | Toshiba TH58NVG6E2FLA4C<br /> | <br /> |-<br /> | &lt;span style=&quot;color:cyan&quot;&gt;Cyan&lt;/span&gt;<br /> | Audio codec<br /> | Cirrus Logic CLI1544C0<br /> | Apple 33850859 C0E111022<br /> | <br /> |-<br /> | &lt;span style=&quot;color:orange&quot;&gt;Orange&lt;/span&gt;<br /> | PMU<br /> | Dialog D1830B<br /> | Apple 338S0783-B1 10298HLS<br /> | <br /> |-<br /> | &lt;span style=&quot;color:#e8e838&quot;&gt;Yellow&lt;/span&gt;<br /> | FM receiver<br /> | Silicon Labs Si4800<br /> | 0650 D0UY 027<br /> | <br /> |-<br /> | &lt;span style=&quot;color:blue&quot;&gt;Blue&lt;/span&gt;<br /> | CPU<br /> | Samsung S5L8723<br /> | Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031<br /> | Samsung APL3278A01 ARM Application processor<br /> Samsung K4X51323PI Mobile DDR SDRAM (64 MB)<br /> <br /> Rusty Mercury says it's a Samsung S5L8723, a step up from the previous Samsung 8730. [http://twitter.com/RustyMercury/status/23268805957 source]<br /> <br /> |-<br /> | &lt;span style=&quot;color:#cf5eea&quot;&gt;Pink&lt;/span&gt;<br /> | Touchscreen controller<br /> | Cypress CY8C20746B<br /> | 35758907 1025 A 04 629749<br /> | <br /> |}<br /> <br /> ==Notes==<br /> The red and black wires lead to the battery.<br /> <br /> ==Helpful pages==<br /> Teardowns:<br /> *http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563<br /> Reviews:<br /> *http://arstechnica.com/apple/reviews/2010/09/6th-generation-ipod-nano.ars<br /> *http://www.ubmtechinsights.com/reports-and-subscriptions/investigative-analysis/apple-ipod-nano/</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_5G&diff=22158 2025-06-23T04:53:52Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: move images to components section</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (5th generation)}}<br /> ==Components==<br /> [[File:nano_5g_frt_a.png|500px|thumb|none|Front of the circuit board]]<br /> [[File:nano_5g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 2<br /> | CPU<br /> | Samsung S5L8730<br /> | 339S0081 ARM, K4X51323PG-UGC6, EDE168AG 0928, APL0378A00, N1X2XW 0931<br /> | Printed backwards on the chip - how sneaky. ARM1176JZF-S core (per CP15 data).<br /> |-<br /> | <br /> | SDRAM<br /> | <br /> |<br /> | Integrated into the processor, similar to the iPod Touch and iPhone lines.<br /> |-<br /> | 8<br /> | NAND Flash<br /> | Various 8/16 GB chips<br /> | TH58NVG6D2ELA49, ID8038, TAIWAN, 09299AE<br /> | One example is TH58NVG6D2ELA49 visible on the iFixit Teardown<br /> |-<br /> | 1<br /> | Power manager<br /> | Probably Dialog<br /> | 338S0707, -AD, 09278HGZ<br /> | Similar looking and named chips like this have been power managers. Apple uses chips like these in just about every device.<br /> |-<br /> | 3<br /> | <br /> | <br /> | <br /> | <br /> |-<br /> | 4<br /> | <br /> | <br /> | <br /> | <br /> |-<br /> | 5<br /> | Audio codec<br /> | Cirrus Logic CLI1480A<br /> | 338S0559, ATWV0926, SGP<br /> | Also found in the Touch 3G. Stereo CODEC w/ Headphone and Speaker Amp<br /> |-<br /> | 6<br /> | Accelerometer<br /> | [http://www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATASHEET/CD00213611.pdf LIS331DLM]<br /> | 33DM, 2910<br /> | The newer Touch's, iPhone's, and even the iPad have similar accelerometers, and I've discovered a pattern in the chip names.<br /> |-<br /> | 7<br /> | <br /> | <br /> | 0630, CK9Y, 925<br /> | <br /> |}<br /> <br /> == Code Execution ==<br /> <br /> Code execution on the Nano 5G was achieved by blindly porting [[WInd3x|wInd3x]].<br /> <br /> == CP15 Registers ==<br /> <br /> Dump of CP15 registers from bootrom context:<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! cX !! cY !! opc2 !! Description !! Value !! Interpretation<br /> |-<br /> | 0<br /> | 0<br /> | 0<br /> | Main ID<br /> | 410fb764<br /> | ARM (0x41), Variant 0, Architecture: see CPUID, Part: ARM1176<br /> |-<br /> | 0<br /> | 0<br /> | 1<br /> | Cache Type<br /> | 1d152152<br /> | Write back, format C cache lockdown, Register 7 cache cleaning operations, separate I/D caches; data cache: (no restriction on page allocation, 16KB, 4-way associative, 2 word line length) istrunction cache: (no restrictions on page allocation, 16KB, 4-way, 2 word)<br /> |-<br /> | 0<br /> | 0<br /> | 2<br /> | TCM Status<br /> | 00000000<br /> | No tightly coupled memory.<br /> |-<br /> | 0<br /> | 0<br /> | 3<br /> | TLB Type<br /> | 00000800<br /> |<br /> |-<br /> | 0<br /> | 1<br /> | 0<br /> | Processor Feature 0<br /> | 00000111<br /> | Jazelle, Thumb1, ARM (no Thumb2)<br /> |-<br /> | 0<br /> | 1<br /> | 1<br /> | Processor Feature 1<br /> | 00000011<br /> | Security Extensions Architecture v1, Standard ARMv4 programmer's model. No microcontroller model.<br /> |-<br /> | 0<br /> | 1<br /> | 2<br /> | Debug Feature 0<br /> | 00000033<br /> | v6.1 Secure Debug, v6.1 Debug.<br /> |-<br /> | 0<br /> | 1<br /> | 3<br /> | Auxiliary Feature 0<br /> | 00000000<br /> | <br /> |-<br /> | 0<br /> | 1<br /> | 4<br /> | Memory Model Feature 0<br /> | 01130003<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 1<br /> | 5<br /> | Memory Model Feature 1<br /> | 10030302<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 1<br /> | 6<br /> | Memory Model Feature 2<br /> | 01222100<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 1<br /> | 7<br /> | Memory Model Feature 3<br /> | 00000000<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 2<br /> | 0<br /> | Instruction Set Feature Attribute 0<br /> | 00140011<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 2<br /> | 1<br /> | Instruction Set Feature Attribute 1<br /> | 12002111<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 2<br /> | 2<br /> | Instruction Set Feature Attribute 2<br /> | 11231121<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 2<br /> | 3<br /> | Instruction Set Feature Attribute 3<br /> | 01102131<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 2<br /> | 4<br /> | Instruction Set Feature Attribute 4<br /> | 00001141<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 2<br /> | 5<br /> | Instruction Set Feature Attribute 5<br /> | 00000000<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 1<br /> | 0<br /> | 0<br /> | Control<br /> | 00450078<br /> | No Force AP, no TEX remap, CPSR E set to 0 on exception, no VIC, no extended page tables, allow unaligned data access, no fast interrupts, global enable for instruction/data TCM, loads to PC set the T bit, random cache replacement, exceptions vectors at Vector Base Address Register. I$, D$ disabled by wInd3x, branch prediction disabled, no strict alignment fault checking, no MMU.<br /> |-<br /> | 1<br /> | 0<br /> | 1<br /> | Auxiliary Control<br /> | 00000007<br /> | ...<br /> |-<br /> | 1<br /> | 0<br /> | 2<br /> | Coprocessor Access Control<br /> | 00000000<br /> | ...<br /> |-<br /> | 1<br /> | 1<br /> | 0<br /> | Secure Configuration<br /> | 00000000<br /> | ...<br /> |-<br /> | 1<br /> | 1<br /> | 1<br /> | Secure Debug Enable<br /> | 00000000<br /> | ...<br /> |-<br /> | 1<br /> | 1<br /> | 2<br /> | Non-Secure Access Control<br /> | 00000000<br /> | ...<br /> |-<br /> | 2<br /> | 0<br /> | 0<br /> | Translation Table Base 0<br /> | 00000000<br /> | ...<br /> |-<br /> | 2<br /> | 0<br /> | 1<br /> | Translation Table Base 1<br /> | 00000000<br /> | ...<br /> |-<br /> | 2<br /> | 0<br /> | 2<br /> | Translation Table Base Control<br /> | 00000000<br /> | ...<br /> |-<br /> | 3<br /> | 0<br /> | 0<br /> | Domain Access Control<br /> | 00000000<br /> | ...<br /> |-<br /> | 7<br /> | 4<br /> | 0<br /> | PCA<br /> | 00000000<br /> | ...<br /> |-<br /> | 7<br /> | 10<br /> | 6<br /> | Cache Dirty Status<br /> | 00000000<br /> | ...<br /> |-<br /> | 9<br /> | 0<br /> | 0<br /> | Data Cache Lockdown<br /> | fffffff0<br /> | ...<br /> |-<br /> | 9<br /> | 0<br /> | 1<br /> | Instruction Cache Lockdown<br /> | fffffff0<br /> | ...<br /> |-<br /> | 9<br /> | 1<br /> | 0<br /> | Data TCM Region<br /> | 00000000<br /> | ...<br /> |-<br /> | 9<br /> | 1<br /> | 1<br /> | Instruction TCM Region<br /> | 00000000<br /> | ...<br /> |-<br /> | 9<br /> | 1<br /> | 2<br /> | Data TCM Non-secure Control Access<br /> | 00000000<br /> | ...<br /> |-<br /> | 9<br /> | 1<br /> | 3<br /> | Instruction TCM Non-secure Control Access<br /> | 00000000<br /> | ...<br /> |-<br /> | 9<br /> | 2<br /> | 0<br /> | TCM Selection<br /> | 00000000<br /> | ...<br /> |-<br /> | 9<br /> | 8<br /> | 0<br /> | Cache Behavior Override<br /> | 00000000<br /> | ...<br /> |}<br /> <br /> == Clock Gates ==<br /> <br /> The clock gate registers are:<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Address !! Name<br /> |-<br /> | 0x3C500048<br /> | GATES[0]<br /> |-<br /> | 0x3C50004C<br /> | GATES[1]<br /> |-<br /> | 0x3C500058<br /> | GATES[4]<br /> |-<br /> | 0x3C500068<br /> | GATES[8]<br /> |-<br /> | 0x3C50006C<br /> | GATES[9]<br /> |}<br /> <br /> GATES[2, 3, 5, 6, 7], etc seem to be unused. A clock is enabled by setting a corresponding bit (GATE[n][m]) low. The following clock gates have been extracted by analyzing debug structures in OSOS. We also provide the 'numerical' argument that can be passed to the clkgen_{enable,disable}_gate function calls in the BootROM. The BootROM will automatically enable some function-related gates together if one is specified. This is probably a leftover from earlier codebases where one functionality would correspond to one clock gate bit, while now a functionality might be gated behind multiple bits.<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Function !! Register(s)/Bit(s) !! Number in BootROM<br /> |-<br /> | AES<br /> | GATE[0][7]<br /> | 7<br /> |-<br /> | AMC<br /> | GATE[0][3]<br /> | 3<br /> |-<br /> | AMC-core<br /> | GATE[0][4]<br /> | 4<br /> |-<br /> | AMCSS<br /> | GATE[1][17]<br /> | 38<br /> |-<br /> | ARM-core<br /> | GATE[0][15]<br /> | 15<br /> |-<br /> | ARM-icu<br /> | GATE[0][16]<br /> | 16<br /> |-<br /> | ARM-sleep<br /> | GATE[0][20]<br /> | 20<br /> |-<br /> | AXI-bus<br /> | GATE[1][18]<br /> | 39<br /> |-<br /> | AXI-spine<br /> | GATE[8][13]<br /> | 63<br /> |-<br /> | AXI-video<br /> | GATE[8][14]<br /> | 64<br /> |-<br /> | CAMIF<br /> | GATE[0][17], GATE[8][15]<br /> | 17, 65<br /> |-<br /> | CEATA<br /> | GATE[0][6]<br /> | 6<br /> |-<br /> | CLCD<br /> | GATE[8][9]<br /> | 59<br /> |-<br /> | CLCD-OTF<br /> | GATE[8][10]<br /> | 60<br /> |-<br /> | CSIS<br /> | GATE[0][18]<br /> | 18<br /> |-<br /> | DDR-MIU<br /> | GATE[9][17]<br /> | 89<br /> |-<br /> | DMAC0<br /> | GATE[0][11]<br /> | 11<br /> |-<br /> | DMAC1<br /> | GATE[0][12]<br /> | 12<br /> |-<br /> | DMAX<br /> | GATE[8][8]<br /> | 58<br /> |-<br /> | ECC<br /> | GATE[0][9]<br /> | 9<br /> |-<br /> | ECID<br /> | GATE[1][14]<br /> | 35<br /> |-<br /> | FMC<br /> | GATE[0][5]<br /> | 5<br /> |-<br /> | GPIO<br /> | GATE[1][12]<br /> | 33<br /> |-<br /> | H264<br /> | GATE[8][2], GATE[9][18]<br /> | 52, 90<br /> |-<br /> | H264ENC<br /> | GATE[4][7], GATE[8][16], GATE[8][17]<br /> | 60, 66, 67<br /> |-<br /> | IIC0<br /> | GATE[1][4], GATE[9][11]<br /> | 25, 83<br /> |-<br /> | IIC1<br /> | GATE[1][6], GATE[9][12]<br /> | 27, 84<br /> |-<br /> | IIS0<br /> | GATE[1][7]<br /> | 28<br /> |-<br /> | IIS1<br /> | GATE[1][10]<br /> | 31<br /> |-<br /> | IIS2<br /> | GATE[1][16]<br /> | 37<br /> |-<br /> | JPEG<br /> | GATE[0][19]<br /> | 19<br /> |-<br /> | LCD<br /> | GATE[0][1], GATE[9][16]<br /> | 1, 88<br /> |-<br /> | MBX-3D<br /> | GATE[8][6]<br /> | 56<br /> |-<br /> | MBX-bus<br /> | GATE[8][7]<br /> | 57<br /> |-<br /> | MBX-core<br /> | GATE[8][5]<br /> | 55<br /> |-<br /> | MIPI-link<br /> | GATE[1][19]<br /> | 40<br /> |-<br /> | MIXER<br /> | GATE[8][1]<br /> | 51<br /> |-<br /> | MPVD<br /> | GATE[8][3]<br /> | 53<br /> |-<br /> | PKE<br /> | GATE[1][13]<br /> | 34<br /> |-<br /> | PL301MPVD<br /> | GATE[1][21]<br /> | 42<br /> |-<br /> | PRNG<br /> | GATE[1][0]<br /> | 21<br /> |-<br /> | RINGOSC<br /> | GATE[4][0]<br /> | 53<br /> |-<br /> | SCALER<br /> | GATE[8][4], GATE[9][25]<br /> | 54, 97<br /> |-<br /> | SDIO<br /> | GATE[0][8]<br /> | 8<br /> |-<br /> | SHA1<br /> | GATE[0][0]<br /> | 0<br /> |-<br /> | SPD<br /> | GATE[1][8]<br /> | 29<br /> |-<br /> | SPI0<br /> | GATE[1][2], GATE[9][13]<br /> | 23, 85<br /> |-<br /> | SPI1<br /> | GATE[1][11], GATE[9][14]<br /> | 32, 86<br /> |-<br /> | SPI2<br /> | GATE[1][15], GATE[9][15]<br /> | 36, 87<br /> |-<br /> | SPI3<br /> | GATE[4][1], GATE[9][19]<br /> | 54, 91<br /> |-<br /> | SPI4<br /> | GATE[4][4], GATE[9][20]<br /> | 57, 92<br /> |-<br /> | SWI<br /> | GATE[4][2], GATE[9][21]<br /> | 55, 93<br /> |-<br /> | TIMER0<br /> | GATE[1][5], GATE[9][0]<br /> | 26, 72<br /> |-<br /> | TIMER1<br /> | GATE[1][23], GATE[9][1]<br /> | 44, 73<br /> |-<br /> | TIMER2<br /> | GATE[1][24], GATE[9][2]<br /> | 45, 74<br /> |-<br /> | TIMER3<br /> | GATE[1][25], GATE[9][3]<br /> | 46, 75<br /> |-<br /> | TIMER4<br /> | GATE[1][26], GATE[9][4]<br /> | 47, 76<br /> |-<br /> | TIMER5<br /> | GATE[1][27], GATE[9][5]<br /> | 48, 77<br /> |-<br /> | TIMER6<br /> | GATE[1][28], GATE[9][6]<br /> | 49, 78<br /> |-<br /> | TIMER7<br /> | GATE[4][5], GATE[9][22]<br /> | 58, 94<br /> |-<br /> | TIMER8<br /> | GATE[4][6], GATE[9][23]<br /> | 59, 95<br /> |-<br /> | TVOUT<br /> | GATE[0][10]<br /> | 10<br /> |-<br /> | TW<br /> | GATE[1][1]<br /> | 22<br /> |-<br /> | UART0<br /> | GATE[1][9], GATE[9][7]<br /> | 30, 79<br /> |-<br /> | UART1<br /> | GATE[1][29], GATE[9][8]<br /> | 50, 80<br /> |-<br /> | UART2<br /> | GATE[1][30], GATE[9][9]<br /> | 51, 81<br /> |-<br /> | UART3<br /> | GATE[1][31], GATE[9][10]<br /> | 52, 82<br /> |-<br /> | UART4<br /> | GATE[4][8], GATE[9][26]<br /> | 61, 98<br /> |-<br /> | USB-OTG<br /> | GATE[0][2]<br /> | 2<br /> |-<br /> | USB2-PHY<br /> | GATE[1][3]<br /> | 24<br /> |-<br /> | VP<br /> | GATE[8][0]<br /> | 50<br /> |-<br /> | VROM<br /> | GATE[0][13]<br /> | 13<br /> |-<br /> | XMC<br /> | GATE[8][12]<br /> | 62<br /> |}<br /> <br /> ==Helpful pages==<br /> Teardowns:<br /> *http://www.ifixit.com/Teardown/iPod-nano-5th-Generation-Teardown/1157<br /> Other:<br /> *http://purpleskank.wikidot.com/ipod-nano-5g<br /> *http://www.ubmtechinsights.com/reports-and-subscriptions/device-library/Device-Profile/?SINumber=23271</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Modes&diff=22157 2025-06-23T04:52:40Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: change ipod names to page links</p> <hr /> <div>At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting. <br /> <br /> ==Normal mode==<br /> &quot;Normal mode&quot; is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.<br /> <br /> ==Disk mode==<br /> In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text &quot;Do not disconnect.&quot; or a checkmark symbol with the text &quot;OK to disconnect.&quot; depending on whether the iPod is connected and if it has been ejected. <br /> <br /> Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]<br /> <br /> Disk mode is also referred to as &quot;forced disk mode&quot; in device information received from the iPod.<br /> <br /> The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the &quot;disk&quot; partition of the [[Firmware]]. <br /> <br /> ==DFU mode==<br /> [https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the [[Nano 3G]] and newer and the [[Classic 6G]] and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].<br /> <br /> When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other IMG1 images cannot be sent in this mode.<br /> <br /> The [[Nano 2G]] also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does, however, support a NOR DFU mode that can be entered by holding down Back+Play right after rebooting the device&lt;ref&gt;https://www.rockbox.org/irc/log-20080904#13:31:44&lt;/ref&gt;.<br /> <br /> ==WTF mode==<br /> In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.<br /> <br /> The iTunes behavior upon seeing an iPod in WTF mode is to send it a &quot;recovery&quot; firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the &quot;osos&quot; partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].<br /> <br /> ==Diagnostic mode==<br /> This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot.&lt;sup&gt;(clarification needed)&lt;/sup&gt;<br /> <br /> ==USB IDs==<br /> When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in: <br /> {| class=&quot;wikitable&quot; <br /> |-<br /> ! colspan=&quot;2&quot; | Model<br /> ! Normal/disk mode<br /> ! DFU mode<br /> ! WTF mode<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 2G]]<br /> | &lt;code&gt;1260&lt;/code&gt;<br /> | &lt;code&gt;1220&lt;/code&gt;<br /> | &lt;code&gt;1240&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 3G]]<br /> | &lt;code&gt;1262&lt;/code&gt;<br /> | &lt;code&gt;1223&lt;/code&gt;/&lt;code&gt;1224&lt;/code&gt;<br /> | &lt;code&gt;1242&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 4G]]<br /> | &lt;code&gt;1263&lt;/code&gt;<br /> | &lt;code&gt;1225&lt;/code&gt;<br /> | &lt;code&gt;1243&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 5G]]<br /> | &lt;code&gt;1265&lt;/code&gt;<br /> | &lt;code&gt;1231&lt;/code&gt;<br /> | &lt;code&gt;1246&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 6G]]<br /> | &lt;code&gt;1266&lt;/code&gt;<br /> | &lt;code&gt;1232&lt;/code&gt;<br /> | &lt;code&gt;1248&lt;/code&gt;<br /> |-<br /> | rowspan=&quot;2&quot; | [[Nano 7G]]<br /> | Initial<br /> | rowspan=&quot;2&quot; | &lt;code&gt;1267&lt;/code&gt;<br /> | rowspan=&quot;2&quot; | &lt;code&gt;1234&lt;/code&gt;<br /> | &lt;code&gt;1249&lt;/code&gt;<br /> |-<br /> | Rev A<br /> | &lt;code&gt;124a&lt;/code&gt;<br /> |-<br /> | rowspan=&quot;4&quot; | [[Classic 6G]]<br /> | [[Classic 6G#Initial|Initial]]<br /> | rowspan=&quot;4&quot; | &lt;code&gt;1261&lt;/code&gt;<br /> | rowspan=&quot;4&quot; | &lt;code&gt;1223&lt;/code&gt;<br /> | &lt;code&gt;1241&lt;/code&gt;<br /> |-<br /> | [[Classic 6G#Rev A|Rev A]]<br /> | &lt;code&gt;1245&lt;/code&gt;<br /> |-<br /> | [[Classic 6G#Rev B|Rev B]]<br /> | &lt;code&gt;1247&lt;/code&gt;<br /> |-<br /> | Rev C<br /> | &lt;code&gt;1250&lt;/code&gt;<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Bootrom&diff=22156 2025-06-23T04:51:02Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: update display title to BootROM</p> <hr /> <div>{{DISPLAYTITLE:BootROM}}<br /> == Introduction ==<br /> <br /> The iPod bootrom is different from the iBoot/SecureROM bootrom present on iOS-based devices. This is true even for iOS/non-iOS devices that share the same SoC, eg. the iPod touch 2G and Nano 4G (both of which are based around an S5L8720).<br /> <br /> The reverse engineering efforts below have been based on a ROM extract from a Nano 4G with the following SHA256 sum: 9cc05fb83024c9d51fd31c97a137447ce5ea87fe7cefba7b9aa6d54609bfbafb .<br /> <br /> == BootROM functionality ==<br /> <br /> The BootROM can perform the following actions:<br /> <br /> # Boot from NAND flash (via built-in flash translation layer implementation)<br /> # Boot from some other unknown storage (NOR? Although NOR is not present on the N4G...)<br /> # Boot from USB DFU mode.<br /> <br /> The mode is selected based on straps, pressed buttons and mode priorities (first NAND or 'NOR' is performed, then DFU).<br /> <br /> All three boot paths end up performing the same [[IMG1|image]] verification steps:<br /> <br /> # Load image into memory at beginning of SRAM.<br /> # Verify image header ([[IMG1]] 2.0): perform SHA1 then AES of first 0x40 bytes, compare against stored sum.<br /> # Parse footer certificates and verify footer signature against body (undocumented).<br /> # Decrypt and jump into body.<br /> <br /> == Certificate parsing ==<br /> <br /> The certificate parsing code is subject to [[Pwnage 2.0]]. This is one of the few codebases shared with iBoot/SecureROM, and is why the bug was portable to the Nano bootroms.<br /> <br /> == DFU mode ==<br /> <br /> The DFU mode codebase seems to be different from the iBoot/SecureROM codebase, with very little code shared (perhaps apart from low-level DesignWare HS OTG register access code). There are no iBoot-like tasks present, the heap is very minimalistic (bitmap based, so no unlink/house of $x heap attacks), and the entire data transfer is effectively performed in poll/synchronous mode (with all transfers initiated via USB DMA directly into temporary receive buffers).<br /> <br /> The difference between the Nano and SecureROM bootrom codebases seem to be the main cause of none of the SecureROM USB exploits working (steaks4uce, usb_control_msg(0xa1, 1), checkm8, etc. However, a full pass over the USB codepaths is still yet to be performed, other vulnerabilities are likely to exist.<br /> <br /> The USB codebase of the DFU is where the [[WInd3x|wInd3x]] bug lives.</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_4G&diff=22155 2025-06-23T04:50:27Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: move images to components section</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (4th generation)}}<br /> ==Components==<br /> [[File:nano_4g_frt_a.png|500px|thumb|none|Front of the circuit board]]<br /> [[File:nano_4g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 2<br /> | CPU<br /> | Samsung S5L8720<br /> | 339S0049 ARM, K4X56323PI-KGC4, YWE025QH 825, APL0278A00, N1B2HOP 0831<br /> | ARM1176JZF-S processor. It is definitely worth knowing that this is the exact same processor used in the iTouch 2G. This could mean that some of the same exploits for that could possibly be used. [http://theiphonewiki.com/wiki/index.php?title=S5L8720_(Hardware) Here] is a very interesting page about the S5L8720 processor.<br /> |-<br /> | <br /> | SDRAM<br /> | <br /> |<br /> | 32MB, probably MDDR. Integrated into the processor, similar to the iPod Touch and iPhone lines.<br /> |-<br /> | 4<br /> | Accelerometer<br /> | [http://www.st.com/stonline/products/literature/ds/12726.pdf LIS302DL]<br /> | 33DL, 2827<br /> | The newer Touch's, iPhone's, and even the iPad have similar accelerometers, and I've discovered a pattern in the chip names.<br /> |-<br /> | 6<br /> | NAND Flash<br /> | Varies<br /> | TH58NVG6D1DLA87, U20516, JAPAN, 0826MAE<br /> |<br /> |-<br /> | 5<br /> | Audio codec<br /> | [http://www.cirrus.com/en/pubs/proDatasheet/CS42L55_F1.pdf CS42L58]<br /> | 338S055C, 189N0824, SGP<br /> | I determined this because the [[Nano 5G]] has a similar chip, which we are sure of the identity. One person lifted this chip and found that the pins connect to the LCD connector. Not much info was given, and it could just be a common ground, but the identity of this chip is still up in the air.<br /> |-<br /> | 1<br /> | Power manager<br /> | Dialog D1759<br /> | 338S0687-AC, 08288HBB<br /> | <br /> |-<br /> | 3<br /> | <br /> | <br /> |<br /> | <br /> |}<br /> <br /> == Bootrom ==<br /> <br /> See [[S5L8720 Bootrom]]. Different from the S5L8720 bootrom used in the iPod Touch 2G (which is iBoot-based, a.k.a. SecureROM).<br /> <br /> == Memory Map ==<br /> <br /> See [https://www.theiphonewiki.com/wiki/S5L8720_(Hardware)] and [https://code.google.com/archive/p/chronicdev/wikis/N72APDevTree.wiki].<br /> <br /> In addition to the above, a few extra memory regions have been found while reverse engineering the [[S5L8720 Bootrom]]:<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Name !! Address !! Notes<br /> |-<br /> | Mystery DMA<br /> | 0x3880_0000<br /> | A PL080-like DMA engine, but with slightly different MMIO register structure. Used by the [[S5L8720 Bootrom|bootrom]] to copy the DFU payload from 0x2200_0600 to 0x2200_0000 after decryption and verification. Or maybe that's actually doing the decryption? To be investigated.<br /> |-<br /> | Mystery Interrupt Thing<br /> | 0x39a0_0000<br /> | Not the VICs (0x38e0_0000, 0x38e0_1000), not the EdgeIC (0x38e0_2000). Seems to hold 7 different 32-bit registers for interrupt status at 0xa0, and 7 different 32-bit registers for interrupt mask at 0xc0. The 7 different registers correspond to 7 'modes' of ISRs set up in the bootrom. Not much is known about what it does, and what these 'modes' are. To be investigated.<br /> |}<br /> <br /> ==Reverse Engineering Results==<br /> Timers: These clockgates have been found to be related to timers: 37, 55, 56, 57, 58, 59, 60, 69, 70, 128, 129, 130, 131, 132, 133, 134, 150 and 151.<br /> <br /> ==Status registers==<br /> We dumped all c0 coprocessor registers:<br /> <br /> ===c0,c0===<br /> '''Value:''' 0x410FB764<br /> <br /> '''Interpretation:''' ARM1176 rev. 4<br /> ===c0,c1===<br /> '''Value:''' 0x1D152152<br /> <br /> '''Interpretation:''' DCache/ICache 16KB each, 4 way associative, 32 bytes line size<br /> ===c0,c2===<br /> '''Value:''' 0x00000000<br /> <br /> '''Interpretation:''' No TCM<br /> ===c0,c3===<br /> '''Value:''' 0x00000800<br /> <br /> '''Interpretation:''' Unified TLB, 8 lockable entries<br /> ===c1,c0===<br /> '''Value:''' 0x00000111<br /> <br /> '''Interpretation:''' ARM/Thumb1/Jazelle support, no Thumb2 support<br /> ===c1,c1===<br /> '''Value:''' 0x00000011<br /> <br /> '''Interpretation:''' Trustzone v1<br /> ===c1,c2===<br /> '''Value:''' 0x00000033<br /> <br /> '''Interpretation:''' Supports debug model v6.1, both applications processor and secure<br /> ===c1,c3===<br /> '''Value:''' 0x00000000<br /> <br /> '''Interpretation:''' No auxiliary features<br /> ===c1,c4===<br /> '''Value:''' 0x01130003<br /> <br /> '''Interpretation:''' FCSE, Auxiliary Control register, ARMv6 TCM/DMA, no DMA cache coherency, no multicore cache coherency, VMSA v7<br /> ===c1,c5===<br /> <br /> '''Value:''' 0x10030302<br /> <br /> '''Interpretation:''' Branch target buffer, Harvard architecture, various cache operations supported (see TRM)<br /> ===c1,c6===<br /> <br /> '''Value:''' 0x01222100<br /> <br /> '''Interpretation:''' WFI, Data synchronization barrier, Prefetch flush, Data memory barrier, various TLB/cache operations supported (see TRM), no prefetch cache range operation<br /> <br /> ===c1,c7===<br /> '''Value:''' 0x00000000<br /> <br /> '''Interpretation:''' No hierarchical cache maintenance support<br /> ===c2,c0===<br /> '''Value:''' 0x00140011<br /> <br /> '''Interpretation:''' Supports BKPT, CDP, CDP2, LDC, LDC2, MCD, MCD2, MRC, MRC2, STC, STC2, MCRR, MCRR2, MRRC, MRRC2, CLZ, SWP and SWPB, doesn't support division, combined compare and branch or bitfield instructions<br /> ===c2,c1===<br /> '''Value:''' 0x12002111<br /> <br /> '''Interpretation:''' Supports BXJ, BX, BLX, PC loads have BX behavior, supports SXTB, SXTAB, SXTB16, SXTAB16, SXTH, SXTAH, UXTB, <br /> UXTAB, UXTB16, UXTAB16, UXTH, UXTAH, SRS, RFE, CPS, LDM(2), LDM(3), STM(2) and SETEND<br /> ===c2,c2===<br /> '''Value:''' 0x11231121<br /> <br /> '''Interpretation:''' Supports REV, REV16, REVSH, MRS, MSR, UMULL, UMLAL, UMAAL, SMULL, SMLAL, SMLABB, SMLABT, SMLALBB, SMLALBT, SMLALTB, SMLALTT, SMLATB, SMLATT, SMLAWB, SMLAWT, SMULBB, SMULBT, SMULTB, SMULTT, SMULWB, SMULWT, SMLAD, SMLADX, SMLALD, SMLALDX, SMLSD, SMLSDX, SMLSLD, SMLSLDX, SMMLA, SMMLAR, SMMLS, SMMLSR, SMMUL, SMMULR, SMUAD, SMUADX, SMUSD, SMUSDX, MLA, restartable LDM/STM, PLD, LDRD, STRD and Q bit in PSRs<br /> ===c2,c3===<br /> '''Value:''' 0x01102131<br /> <br /> '''Interpretation:''' Supports true NOP, Thumb MOV(3)/CPU, LDREX, STREX, LDREXB, LDREXH, LDREXD, STREXB, STREXH, STREXD, CLREX, SVC, PKHBT, PKHTB, QADD16, QADD8, QADDSUBX, QSUB16, QSUB8, QSUBADDX, SADD16, SADD8, SADDSUBX, SEL, SHADD16, SHADD8, SHADDSUBX, SHSUB16, SHSUB8, SHSUBADDX, SSAT, SSAT16, SSUB16, SSUB8, SSUBADDX, SXTAB16, SXTB16, UADD16, UADD8, UADDSUBX, UHADD16, UHADD8, UHADDSUBX, UHSUB16, UHSUB8, UHSUBADDX, UQADD16, UQADD8, UQADDSUBX, UQSUB16, UQSUB8, UQSUBADDX, USAD8, USADA8, USAT, USAT16, USUB16, USUB8, USUBADDX, UXTAB16, UXTB16, QADD, QDADD, QDSUB, QSUB, and the Q and GE[3:0] bits in the PSRs. Does nut support branch table and Thumb2 instructions.<br /> ===c2,c4===<br /> '''Value:''' 0x00001141<br /> <br /> '''Interpretation:''' Supports SMC, writeback instructions, shift of loads and stores by 0-3 bits to the left, constant shift options, register controlled shift options, LDRBT, LDRT, STRBT and STRT. No barrier instructions support.<br /> ===c2,c5===<br /> '''Value:''' 0x00000000<br /> <br /> '''Interpretation:''' No additional implementation defined instruction set extensions<br /> <br /> ==Helpful pages==<br /> Teardowns:<br /> *http://www.ifixit.com/Guide/First-Look/iPod-Nano-4th-Generation/584/1<br /> Other:<br /> *http://theiphonewiki.com/wiki/index.php?title=S5L8720_(Hardware)</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_3G&diff=22154 2025-06-23T04:49:57Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: oops fix images</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (3rd generation)}}<br /> ==Components==<br /> [[File:nano_3g_frt_a.png|500px|thumb|none|Front of the circuit board]]<br /> [[File:nano_3g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 2<br /> | CPU<br /> | Samsung S5L8702<br /> | 337S3473 8702, NONBWOEC, 0731 ARM<br /> | ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702.<br /> |-<br /> | 3<br /> | SDRAM<br /> | [http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] or Qimonda HYE18M169CX75<br /> | 0728, C, HYE18M256, 169CX75, W3338092<br /> | SDRAM - Mobile DDR, 256Mb, 1.8V. WORK ON THIS: Like the flash chip, the memory also varies. The most popular chip seems to be the [http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]. Another similar one that is sometimes used is the Qimonda HYE18M169CX75<br /> |-<br /> | 5<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41340 SST25VF080B]<br /> | V80B, 729379<br /> | Flash - NOR, 8Mb, Serial SPI<br /> |-<br /> | 6<br /> | NAND Flash<br /> | Varies<br /> | Samsung 728, K9HCG08U5M, PCB0, FCF285X1<br /> |<br /> |-<br /> | 1<br /> | Audio codec<br /> | WM1870<br /> | APPLE, 338S0462, 76BZKTM<br /> | <br /> |-<br /> | 4<br /> | Power manager<br /> | D1671B<br /> | 338S0408, 07258HAH<br /> | <br /> |}<br /> <br /> == SPI NOR Test Pads ==<br /> <br /> Test pads are available on the back of the board to access SCK, MISO and CS between the SoC and the NOR utility flash. MOSI is also present, but is buried in an internal layer (second from back) which can be accessed by carefully scraping off the top FR4 using a sharp tool, or by using a tiny carbide bit on a milling machine.<br /> <br /> [[Image:N3g-spi-nor.png|500px]]<br /> [[Image:N3g-spi-nor-zoom.png|500px]]<br /> <br /> == Hardware Notes ==<br /> === CPU ===<br /> The Apple S5L8702 is an ARM926EJ-S processor designed by Samsung. It is estimated to run at 100MHz (I read this somewhere but I don't remember where). The basics of the chip are similar to the S5L8700x for which there is [[S5L8700 datasheet|a leaked datasheet]]. For some peripherals, merely a base address has changed. For others, full subsystems have been updated and refined. <br /> <br /> === GPU ===<br /> Very little is known about the GPU core other than the fact that it almost certainly exists. It's likely a single PowerVR GPU core that can maybe can decode H.264 content up to 480p (or perhaps there's another peripheral responsible for this?). It's also possible that the GPU is responsible for rendering games, since it appears the games use some form of OpenGL ES. CoverFlow also probably leverages the GPU.<br /> <br /> === I2C ===<br /> The S5L8702 has several I2C busses (two, probably?), but possibly only one is used (bus #0). On this bus, there are currently two known slaves:<br /> * The PMU at address 0x73<br /> * The DAC at address 0x1A<br /> The bus runs at 1.8V with a clock of 333.33KHz.<br /> <br /> Other notes about the I2C peripheral from Rockbox:<br /> * s5l8702 I2C controller is similar to s5l8700, known differences are:<br /> ** IICCON[5] is not used in s5l8702.<br /> ** IICCON[13:8] are used to enable interrupts.<br /> ** IICSTA2[13:8] are used to read the status and write-clear interrupts.<br /> * Known interrupts:<br /> ** [13] STOP on bus (TBC)<br /> ** [12] START on bus (TBC)<br /> ** [8] byte transmitted or received in Master mode (not tested in Slave)<br /> ** IICCON[4] does not clear interrupts, it is enabled when a byte is transmited or received, in Master mode the tx/rx of the next byte starts when it is written as &quot;1&quot;.<br /> <br /> === Digital Audio Subsystem (I2S) ===<br /> The iPod n3g uses a Wolfson DAC (WM1870) to convert digital audio to analog audio. The S5L8702 sends digital audio in the form of I2S data at 44.1kHz with 16-bit resolution. Even if there is no audio playing, at some point during boot up, the I2S peripheral is turned on, meaning the Bit Clock and Word Select are always on. During the 1kHz tone test in the diagnostic menu, the I2S mode is different, possibly a half-data mode since the test tone is one channel.<br /> The S5L8702 seems to support 3 I2S interfaces, but only one is used for audio playback. It's possible another one is used for microphone recording (when an Apple headset with a microphone is plugged in, you can record voice memos) but this is unconfirmed.<br /> <br /> The S5L8702 sends data to the DAC at full volume no matter what. Volume is configured via I2C bus #0. As far as I can tell, two commands are issued to change the volume:<br /> Address 0x1A, Data 0x04 &lt;volume&gt;<br /> Address 0x1A, Data 0x07 &lt;volume&gt;<br /> Where &lt;volume&gt; is a number between 0xB7 for quietest to 0xF5 for loudest. It's also possible that a special value of 0x80 is for full mute, but this is unconfirmed. It's also unclear what the 0x04 and 0x07 mean, perhaps it's capable of changing the volume of both channels independently?<br /> <br /> Both the I2C and I2S busses run at 1.8V.<br /> <br /> === NAND ===<br /> NAND hardware is an enigma. There has been a rather substantial effort on this subsystem alone. Most of that is documented [https://github.com/lemonjesus/S5L8702-FMISS-Tools here].<br /> <br /> ==Helpful pages==<br /> Chip analyses:<br /> *http://www2.electronicproducts.com/Applie_iPod_Nano_(4GB)_3rd_Generation-whatsinside-16.aspx#<br /> Teardowns:<br /> *http://content.techrepublic.com.com/2346-13636_11-170826-1.html<br /> *http://www.ifixit.com/Guide/First-Look/iPod-Nano-3rd-Generation/594/1<br /> *http://insidetronics.blogspot.com/2007/09/teardown-ipod-nano-3g.html<br /> *[http://www.combert-elec.com/www/bookpic/200810916515460624.jpg Image of 3G Nano board]</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_3G&diff=22153 2025-06-23T04:49:05Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: move images to components section</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (3rd generation)}}<br /> ==Components==<br /> [[File:nano_3g_frt_a.jpg|500px|thumb|none|Front of the circuit board]]<br /> [[File:nano_3g_bck_a.jpg|500px|thumb|none|Back of the circuit board]]<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 2<br /> | CPU<br /> | Samsung S5L8702<br /> | 337S3473 8702, NONBWOEC, 0731 ARM<br /> | ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702.<br /> |-<br /> | 3<br /> | SDRAM<br /> | [http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] or Qimonda HYE18M169CX75<br /> | 0728, C, HYE18M256, 169CX75, W3338092<br /> | SDRAM - Mobile DDR, 256Mb, 1.8V. WORK ON THIS: Like the flash chip, the memory also varies. The most popular chip seems to be the [http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]. Another similar one that is sometimes used is the Qimonda HYE18M169CX75<br /> |-<br /> | 5<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41340 SST25VF080B]<br /> | V80B, 729379<br /> | Flash - NOR, 8Mb, Serial SPI<br /> |-<br /> | 6<br /> | NAND Flash<br /> | Varies<br /> | Samsung 728, K9HCG08U5M, PCB0, FCF285X1<br /> |<br /> |-<br /> | 1<br /> | Audio codec<br /> | WM1870<br /> | APPLE, 338S0462, 76BZKTM<br /> | <br /> |-<br /> | 4<br /> | Power manager<br /> | D1671B<br /> | 338S0408, 07258HAH<br /> | <br /> |}<br /> <br /> == SPI NOR Test Pads ==<br /> <br /> Test pads are available on the back of the board to access SCK, MISO and CS between the SoC and the NOR utility flash. MOSI is also present, but is buried in an internal layer (second from back) which can be accessed by carefully scraping off the top FR4 using a sharp tool, or by using a tiny carbide bit on a milling machine.<br /> <br /> [[Image:N3g-spi-nor.png|500px]]<br /> [[Image:N3g-spi-nor-zoom.png|500px]]<br /> <br /> == Hardware Notes ==<br /> === CPU ===<br /> The Apple S5L8702 is an ARM926EJ-S processor designed by Samsung. It is estimated to run at 100MHz (I read this somewhere but I don't remember where). The basics of the chip are similar to the S5L8700x for which there is [[S5L8700 datasheet|a leaked datasheet]]. For some peripherals, merely a base address has changed. For others, full subsystems have been updated and refined. <br /> <br /> === GPU ===<br /> Very little is known about the GPU core other than the fact that it almost certainly exists. It's likely a single PowerVR GPU core that can maybe can decode H.264 content up to 480p (or perhaps there's another peripheral responsible for this?). It's also possible that the GPU is responsible for rendering games, since it appears the games use some form of OpenGL ES. CoverFlow also probably leverages the GPU.<br /> <br /> === I2C ===<br /> The S5L8702 has several I2C busses (two, probably?), but possibly only one is used (bus #0). On this bus, there are currently two known slaves:<br /> * The PMU at address 0x73<br /> * The DAC at address 0x1A<br /> The bus runs at 1.8V with a clock of 333.33KHz.<br /> <br /> Other notes about the I2C peripheral from Rockbox:<br /> * s5l8702 I2C controller is similar to s5l8700, known differences are:<br /> ** IICCON[5] is not used in s5l8702.<br /> ** IICCON[13:8] are used to enable interrupts.<br /> ** IICSTA2[13:8] are used to read the status and write-clear interrupts.<br /> * Known interrupts:<br /> ** [13] STOP on bus (TBC)<br /> ** [12] START on bus (TBC)<br /> ** [8] byte transmitted or received in Master mode (not tested in Slave)<br /> ** IICCON[4] does not clear interrupts, it is enabled when a byte is transmited or received, in Master mode the tx/rx of the next byte starts when it is written as &quot;1&quot;.<br /> <br /> === Digital Audio Subsystem (I2S) ===<br /> The iPod n3g uses a Wolfson DAC (WM1870) to convert digital audio to analog audio. The S5L8702 sends digital audio in the form of I2S data at 44.1kHz with 16-bit resolution. Even if there is no audio playing, at some point during boot up, the I2S peripheral is turned on, meaning the Bit Clock and Word Select are always on. During the 1kHz tone test in the diagnostic menu, the I2S mode is different, possibly a half-data mode since the test tone is one channel.<br /> The S5L8702 seems to support 3 I2S interfaces, but only one is used for audio playback. It's possible another one is used for microphone recording (when an Apple headset with a microphone is plugged in, you can record voice memos) but this is unconfirmed.<br /> <br /> The S5L8702 sends data to the DAC at full volume no matter what. Volume is configured via I2C bus #0. As far as I can tell, two commands are issued to change the volume:<br /> Address 0x1A, Data 0x04 &lt;volume&gt;<br /> Address 0x1A, Data 0x07 &lt;volume&gt;<br /> Where &lt;volume&gt; is a number between 0xB7 for quietest to 0xF5 for loudest. It's also possible that a special value of 0x80 is for full mute, but this is unconfirmed. It's also unclear what the 0x04 and 0x07 mean, perhaps it's capable of changing the volume of both channels independently?<br /> <br /> Both the I2C and I2S busses run at 1.8V.<br /> <br /> === NAND ===<br /> NAND hardware is an enigma. There has been a rather substantial effort on this subsystem alone. Most of that is documented [https://github.com/lemonjesus/S5L8702-FMISS-Tools here].<br /> <br /> ==Helpful pages==<br /> Chip analyses:<br /> *http://www2.electronicproducts.com/Applie_iPod_Nano_(4GB)_3rd_Generation-whatsinside-16.aspx#<br /> Teardowns:<br /> *http://content.techrepublic.com.com/2346-13636_11-170826-1.html<br /> *http://www.ifixit.com/Guide/First-Look/iPod-Nano-3rd-Generation/594/1<br /> *http://insidetronics.blogspot.com/2007/09/teardown-ipod-nano-3g.html<br /> *[http://www.combert-elec.com/www/bookpic/200810916515460624.jpg Image of 3G Nano board]</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_2G&diff=22152 2025-06-23T04:48:48Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: move images to components section</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (2nd generation)}}<br /> ==Components==<br /> [[File:nano_2g_frt_a.jpg|500px|thumb|none|Front of the circuit board]]<br /> [[File:nano_2g_bck_a.jpg|500px|thumb|none|Back of the circuit board]]<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 1<br /> | CPU<br /> | Samsung S5L8701<br /> |337S32918701, N042DQS, 0636 ARM<br /> | System On Chip (SoC), includes ARM940T central processor, advanced DSP, 50kB boot ROM, 176kB SRAM, external RAM, flash and LCD controllers, USB(1.1-host; 2.0-function) and some other parts. Package: [http://www.samsung.com/global/business/semiconductor/support/PackageInformation/downloads/SystemLSI/FBGA/232_FBGA_1010_12_05.pdf 232-pin FBGA 10x10mm] or 224/226-pin 9x9mm. Similar chips: [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=212&amp;partnum=SA58700 SA58700X07]. Some documentation available for the S5L series can be found [[S5L8700 datasheet|here]]. The processor itself is Apple-branded and marked 337S3291 8701.<br /> |-<br /> | 2<br /> | SDRAM<br /> | [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&amp;partnum=K4M56163PG Samsung K4M56163PG]<br /> |SEC 637 GG75, K4M56163PG, AQH373P1<br /> | [http://pdf1.alldatasheet.net/datasheet-pdf/view/168204/SAMSUNG/K4M56163PG.html here] is the datasheet. This is the same chip used in the [[Nano 1G]]. Sometimes the Qimonda [http://www.alldatasheet.com/datasheet-pdf/pdf/207179/QIMONDA/HYE18L256169BFX-7.5.html HYE18L256] chip is used instead.<br /> |-<br /> | 3<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41422 SST39WF800A]<br /> |SST39WF800A, 90-4C-C2QE, 0631287-A<br /> | stores Disk Mode, Diagnostic Mode and the code to flash this chip. Tof has [http://home.gna.org/linux4nano/dumping_SST39WF800A.html managed to extract] this data and the dump can be obtained by emailing Emmanuel Fleury. All of the contents in the utility flash chip are encrypted from now on.<br /> |-<br /> | N/A<br /> | DSP<br /> | N/A<br /> | N/A<br /> | Doesn't seem to be present at all.<br /> |-<br /> | B1<br /> | NAND Flash<br /> | Varies<br /> |TOSHIBA P11023, JAPAN 0636 KAE, TP0560, TH58NVG5D4CTG20<br /> |<br /> |-<br /> | 6<br /> | USB charging<br /> | LTC4066<br /> |Linear Technology, 6H, 4066, B8966<br /> | <br /> |-<br /> | 5<br /> | Audio codec<br /> | Wolfson WM8975<br /> |APPLE, 338S0310, 68BTST8<br /> | <br /> |-<br /> | 4<br /> | Step down regulator<br /> | LM34910<br /> |National Semiconductor, JM66RJ, L34910B<br /> |<br /> |-<br /> | B2<br /> | Power manager (below)<br /> | NXP PCF50633UM<br /> |APPLE, 338S0261, P29T6 04, cPG0637Y, 01/N2<br /> |<br /> |}<br /> <br /> ==Helpful pages==<br /> Teardowns:<br /> *http://www.ifixit.com/Guide/First-Look/iPod-Nano-2nd-Generation/592/1<br /> *http://arstechnica.com/apple/reviews/2006/09/ipod-2g.ars/4<br /> *http://www.eetimes.com/design/audio-design/4016200/Tear-Down-Inside-the-Apple-8GB-iPod-nano (useful because it shows the power manager)<br /> *http://forums.rockbox.org/index.php?PHPSESSID=d69e900c3215a165adee7165ece4eccb&amp;topic=6518.msg62700#msg62700 (beautiful PCB scans)<br /> Other:<br /> *http://home.gna.org/linux4nano/download/hardware_synth-1.0.pdf</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Modes&diff=22151 2025-06-22T01:21:45Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: update usb PID model links/names</p> <hr /> <div>At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting. <br /> <br /> ==Normal mode==<br /> &quot;Normal mode&quot; is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.<br /> <br /> ==Disk mode==<br /> In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text &quot;Do not disconnect.&quot; or a checkmark symbol with the text &quot;OK to disconnect.&quot; depending on whether the iPod is connected and if it has been ejected. <br /> <br /> Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]<br /> <br /> Disk mode is also referred to as &quot;forced disk mode&quot; in device information received from the iPod.<br /> <br /> The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the &quot;disk&quot; partition of the [[Firmware]]. <br /> <br /> ==DFU mode==<br /> [https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the iPod nano (3rd generation) and newer and the iPod classic (6th generation) and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].<br /> <br /> When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other [[IMG1]] images cannot be sent in this mode.<br /> <br /> The iPod nano (2nd generation) also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does, however, support a NOR DFU mode that can be entered by holding down Back+Play right after rebooting the device&lt;ref&gt;https://www.rockbox.org/irc/log-20080904#13:31:44&lt;/ref&gt;.<br /> <br /> ==WTF mode==<br /> In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.<br /> <br /> The iTunes behavior upon seeing an iPod in WTF mode is to send it a &quot;recovery&quot; firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the &quot;osos&quot; partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].<br /> <br /> ==Diagnostic mode==<br /> This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot.&lt;sup&gt;(clarification needed)&lt;/sup&gt;<br /> <br /> ==USB IDs==<br /> When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in: <br /> {| class=&quot;wikitable&quot; <br /> |-<br /> ! colspan=&quot;2&quot; | Model<br /> ! Normal/disk mode<br /> ! DFU mode<br /> ! WTF mode<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 2G]]<br /> | &lt;code&gt;1260&lt;/code&gt;<br /> | &lt;code&gt;1220&lt;/code&gt;<br /> | &lt;code&gt;1240&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 3G]]<br /> | &lt;code&gt;1262&lt;/code&gt;<br /> | &lt;code&gt;1223&lt;/code&gt;/&lt;code&gt;1224&lt;/code&gt;<br /> | &lt;code&gt;1242&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 4G]]<br /> | &lt;code&gt;1263&lt;/code&gt;<br /> | &lt;code&gt;1225&lt;/code&gt;<br /> | &lt;code&gt;1243&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 5G]]<br /> | &lt;code&gt;1265&lt;/code&gt;<br /> | &lt;code&gt;1231&lt;/code&gt;<br /> | &lt;code&gt;1246&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 6G]]<br /> | &lt;code&gt;1266&lt;/code&gt;<br /> | &lt;code&gt;1232&lt;/code&gt;<br /> | &lt;code&gt;1248&lt;/code&gt;<br /> |-<br /> | rowspan=&quot;2&quot; | [[Nano 7G]]<br /> | Initial<br /> | rowspan=&quot;2&quot; | &lt;code&gt;1267&lt;/code&gt;<br /> | rowspan=&quot;2&quot; | &lt;code&gt;1234&lt;/code&gt;<br /> | &lt;code&gt;1249&lt;/code&gt;<br /> |-<br /> | Rev A<br /> | &lt;code&gt;124a&lt;/code&gt;<br /> |-<br /> | rowspan=&quot;4&quot; | [[Classic 6G]]<br /> | [[Classic 6G#Initial|Initial]]<br /> | rowspan=&quot;4&quot; | &lt;code&gt;1261&lt;/code&gt;<br /> | rowspan=&quot;4&quot; | &lt;code&gt;1223&lt;/code&gt;<br /> | &lt;code&gt;1241&lt;/code&gt;<br /> |-<br /> | [[Classic 6G#Rev A|Rev A]]<br /> | &lt;code&gt;1245&lt;/code&gt;<br /> |-<br /> | [[Classic 6G#Rev B|Rev B]]<br /> | &lt;code&gt;1247&lt;/code&gt;<br /> |-<br /> | Rev C<br /> | &lt;code&gt;1250&lt;/code&gt;<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Classic_6G&diff=22150 2025-06-22T01:07:35Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: fix factual inaccuracy in intro text</p> <hr /> <div>{{DISPLAYTITLE:iPod classic (6th generation)}}<br /> This page concerns the mainline iPods branded with the &quot;classic&quot; name. These iPods mark the switch from PortalPlayer to Samsung processors and were the last mainline iPods ever released. Four versions of this iPod exist, all branded with &quot;classic&quot;: the [[#Initial|initial version]], released in 2007, a thinner [[#Rev A|Rev A]], released in 2008, [[#Rev B|Rev B]] released in 2009 and a final Rev C revision not documented here. These revisions are sometimes called the 6th, 6.5th, 7th, and 7.5th generation respectively.<br /> <br /> ==Initial==<br /> [[Image:classic_1g_frt_a.png|500px]]<br /> [[Image:classic_1g_bck_a.png|500px]]<br /> ===Terminology===<br /> This is the first version of the 6th generation &quot;classic&quot; branded iPod. It was available in an 80GB and 160GB model.<br /> <br /> ===Components===<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 3<br /> | CPU<br /> | Samsung S5L8702<br /> |<br /> | ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702. Same as on the Nano 3G<br /> |-<br /> | 2<br /> | SDRAM<br /> | K4X51163PE<br /> |<br /> | <br /> |-<br /> | 5<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41340 SST25VF080B]<br /> |<br /> | Same as on the Nano 3G<br /> |-<br /> | 4<br /> | Audio codec<br /> | [http://www.cirrus.com/en/pubs/proDatasheet/CS42L55_F1.pdf Cirrus Logic CS42L55]<br /> | APPLE, 338S0394, A1GIO736, MAL<br /> | <br /> |-<br /> | 1<br /> | Power manager<br /> | NXP PCF50635<br /> | APPLE, 338S0445, 2114.102, ZPD7383Y<br /> | <br /> |-<br /> | 6<br /> | USB charging<br /> | LTC4066<br /> |<br /> |<br /> |}<br /> <br /> ===Helpful pages===<br /> Teardowns:<br /> *TheSeven's broken Classic 1G board (High-res): [http://img43.imageshack.us/img43/6619/6gback.jpg front] [http://img7.imageshack.us/img7/1858/6gfront.jpg back]<br /> Other:<br /> *http://homepage.mac.com/marc.heijligers/audio/ipod/comparison/measurements/measurements.html<br /> <br /> ==Rev A==<br /> [[Image:classic_2g_frt_a.jpg|500px]]<br /> [[Image:classic_2g_bck_a.png|500px]]<br /> <br /> ===Terminology===<br /> This is a revised version of the 6th generation iPod with the &quot;classic&quot; name. It is thinner than the 160GB [[#Initial||initial revision]] and was only available with 120GB storage.<br /> <br /> ===Components===<br /> Almost exactly the same hardware as the [[#Initial]], except that region A is populated. This presumably communicates with the new headphone/remote that Apple chose for this device to support.<br /> ===Helpful pages===<br /> Teardowns:<br /> *http://www.chinaveboss.com/faq_info.html?faqs_id=53&amp;fcPath=1&amp;zenid=19755464b2fde0cb4f7a8877cfa6649c<br /> <br /> ==Rev B==<br /> [[Image:Front_3g.jpg|500px]]<br /> [[Image:Back_3g.jpg|500px]]<br /> <br /> iPod classic MC293, 160GB, silver<br /> <br /> <br /> No better teardown pictures of this revision have been found or made by us yet. There is, however, [http://www.ilounge.com/index.php/news/comments/ipod-classic-160gb-changes-new-firmware-engraving/ a basic guide of the non-electronic differences] by iLounge. Since the model number is the same as [[#Rev A|Rev A]], there probably aren't any worthwhile (if any) in the hardware.<br /> <br /> ===Terminology===<br /> Rev B is a re-introduced 160GB revision of the classic, announced on September 9, 2009. It is the same size as the [[#Rev A|Rev A]] model.<br /> <br /> <br /> ===Components===<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 3<br /> | CPU<br /> | [https://freemyipod.org/wiki/S5L8702 Samsung S5L8702]<br /> |337S3526 8702 N26P9U4 1011 ARM<br /> | ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702. Same as on the Nano 3G<br /> |-<br /> | 2<br /> | SDRAM<br /> | K4X51163PE<br /> |<br /> | <br /> |-<br /> | 5<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41340 SST25VF080B]<br /> |<br /> | Same as on the Nano 3G<br /> |-<br /> | 4<br /> | Audio codec<br /> | [http://www.cirrus.com/en/pubs/proDatasheet/CS42L55_F1.pdf Cirrus Logic CS42L55]<br /> | APPLE 338S0394 AICK0952 MAL<br /> | <br /> |-<br /> | 1<br /> | Power manager<br /> | NXP PCF50635<br /> | APPLE 338S0445 78030 82 D780113<br /> | <br /> |-<br /> | 6<br /> | USB charging<br /> | LTC4066<br /> |4066T 84453<br /> |<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Classic&diff=22148 2025-06-21T19:45:28Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: create redirect to classic 6g</p> <hr /> <div>#REDIRECT [[Classic 6G]]</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Main_Page&diff=22147 2025-06-21T19:44:55Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: remove multiple classic revisions from hardware</p> <hr /> <div>__NOTOC__<br /> [[File:EmCORE_Nano2G_Nano4G_Classic.jpg|280px|thumb|right|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]]]<br /> This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [http://www.rockbox.org rockbox] or Linux. Freemyipod is a relaunch of [[Linux4nano]].<br /> <br /> == FAQ ==<br /> <br /> === What can I do with my iPod nano (2nd generation), iPod classic or older iPods? ===<br /> <br /> There's an upstream Rockbox port for these devices. Go use that.<br /> <br /> === What can I do with my iPod nano (3rd generation) or newer? ===<br /> <br /> Not much (yet) unless you're an embedded developer :).<br /> <br /> On the 3rd, 4th and 5th generation, we have a stable tethered exploit ([[wInd3x]]) which allows early, untethered and safe (no permanent modification) code execution. This in turn allows you to run [[U-Boot]] and an early [[Linux|Linux port]] or experiment with reverse-engineering/modifying the original firmware, [[retailOS]].<br /> <br /> On the 6th and 7th generation, a font parsing vulnerability (CVE-2010-1797) can be exploited with [[ipod_sun]].<br /> <br /> On the 7th generation (and possibly 6th generation), a vulnerability in DFU_DNLOAD packet parsing code can be exploited with [[S5Late]].<br /> <br /> There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.<br /> <br /> == Getting an account ==<br /> Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].<br /> <br /> ==Updates==<br /> * {{#dateformat:2025-06-12}} - Some of us will be at GPN23 in Karlsruhe! [https://entropia.de/GPN23 More info here]. Let us know on IRC/Discord/Matrix if you're also there!<br /> * {{#dateformat:2024-12-25}} - Some of us will be at 38C3 in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]<br /> * {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for Nano 7G (and possibly Nano 6G), is released.<br /> * {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the iPod nano 6th and 7th generation, is released.<br /> * {{#dateformat:2023-01-07}} - [https://social.hackerspace.pl/@q3k/109655916469636189 A preliminary U-Boot port to the Nano 5G has been developed.]<br /> * {{#dateformat:2022-01-04}} - The bootrom of iPod Nano 5G was successfully dumped, and is in the process of being reverse-engineered!<br /> * {{#dateformat:2021-12-31}} - An exploit named wInd3x, which exploits the latest vulnerability, is being prepared for Nano 4G and Nano 5G.<br /> * {{#dateformat:2021-12-27}} - A new vulnerability was discovered in iPod Nano 4G and Nano 5G bootrom, which allows arbitrary code execution!<br /> &lt;!--<br /> * {{#dateformat:2018-08-25}} - The website software has been updated to MediaWiki 1.31 after about 2 months of downtime.<br /> * {{#dateformat:2016-06-17}} - The freemyipod project is becoming deprecated, as parts of the code is slowly being integrated in Rockbox. It is likely that no future development on the freemyipod project will take place. Essential parts of emCORE helped building a Rockbox bootloader for iPod Classic, and any future development will take place in the Rockbox project.<br /> * {{#dateformat:2014-03-26}} - A bug that prevented [[emCORE]] installations on certain Windows configurations (getting stuck on &quot;Booting UBI file...&quot;), has been finally fixed! If the installation has failed for you before, you can retry it using the updated version of our tool (use the iTunes method for now).<br /> * {{#dateformat:2012-01-02}} - There have been some problems with the latest release. A hotfix release ([[EmCORE_Releases/r859|r859]]) has been published to fix some of these problems. iPod nano 2g users are advised to upgrade. See the [[EmCORE_Releases/r859|release details page]] for more information.<br /> * {{#dateformat:2012-01-01}} - A new release &lt;s&gt;([[EmCORE_Releases/r855|r855]])&lt;/s&gt; is out! It includes a couple of new features, several bugfixes and a new bootmenu theme! More information on the &lt;s&gt;[[EmCORE_Releases/r855|release details page]]&lt;/s&gt;.<br /> * {{#dateformat:2011-04-25}} - The [[emCORE]] kernel now runs on the iPod Touch 2G as well, thanks to the help of kleemajo. This is of course not a fully functional port yet, but we'll see how it continues. It's about the same state as the iPod Nano 4G now. /7<br /> * {{#dateformat:2011-03-25}} - [[emCORE]] is replacing [[emBIOS]] completely now. Therefore [[emBIOS]] will be deprecated software as of now! All emBIOS users are advised to upgrade to emCORE including people using iLoader 0.2.2 or less. More detailed update instructions will follow!<br /> * {{#dateformat:2011-01-08}} - The Rockbox port for the iPod Classic is slowly getting usable. Most of the blocking issues have been fixed. The first-generation 160GB model still doesn't work, and some people are experiencing slightly garbled display contents.<br /> * {{#dateformat:2011-01-04}} - There is an early Rockbox port for the iPod Classic! It still isn't quite usable, playback stutters etc., but if you want to play around with it, here are some quick'n'dirty notes on the installation procedure: [[IPod Classic iLoader Installation]]<br /> * {{#dateformat:2010-11-22}} - We now have emBIOS support for the iPod classic 1g, the others might follow soon<br /> * {{#dateformat:2010-08-29}} - We're proud to announce the release of [[emBIOS]] v0.1.0 and [[iLoader]] v0.2.0!<br /> * {{#dateformat:2010-08-26}} - [[iLoader]], its installer and uninstaller all have been fully ported to [[emBIOS]] now. A beta release will be coming soon!<br /> * {{#dateformat:2010-08-13}} - [[emBIOS]] is continually being improved and the next step is porting tools like [[iLoader]] to use it.<br /> * {{#dateformat:2010-08-06}} - The wiki has now been moved to www.freemyipod.org<br /> * {{#dateformat:2010-08-05}} - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [http://websvn.freemyipod.org/listing.php?repname=freemyipod&amp;path=/embios/ here]<br /> * {{#dateformat:2010-08-03}} - We can now access the Nano 4G accelerometer.<br /> * {{#dateformat:2010-08-02}} - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].<br /> * {{#dateformat:2010-08-01}} - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.<br /> * {{#dateformat:2010-07-27}} - The server got zapped by lightning but a new one was up and running within a day.<br /> * {{#dateformat:2010-02-23}} - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!<br /> * {{#dateformat:2009-11-01}} - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]<br /> --&gt;<br /> Follow [http://twitter.com/freemyipod our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [[ Special:Code/freemyipod|SVN activity ]] page for the latest changes to our source code.<br /> <br /> {| cellspacing=&quot;3&quot; width=&quot;100%&quot;<br /> |- valign=&quot;top&quot;<br /> |style=&quot;border: 1px dashed #c6c9ff; background-color: #f0f0ff&quot;|<br /> ===Project info===<br /> * [[ Status ]]<br /> * [[ Contact ]]<br /> * [[ Contributing ]]<br /> <br /> ===Released Software===<br /> * [[wInd3x]]<br /> * [[ipod_sun]]<br /> * [[U-Boot|U-Boot port]]<br /> * [[Linux|Linux port]]<br /> * Legacy:<br /> ** [[iBugger]]<br /> ** [[iLoader]]<br /> ** [[emCORE]]<br /> <br /> |style=&quot;border: 1px dashed #c6c9ff; background-color: #f0f0ff&quot;|<br /> <br /> ===Basic skills===<br /> * [[Working with binaries]]<br /> * [[Dumping firmware]]<br /> * [[Extracting firmware]]<br /> * [[Firmware downgrading]]<br /> * [[Troubleshooting]]<br /> <br /> ===Reverse engineering results===<br /> * [[Firmware]]<br /> ** [[Bootrom]]<br /> ** [[Boot Process]]<br /> ** [[Firmware decryption]]<br /> ** [[FTL|Flash Translation Layer]]<br /> ** [[RetailOS]]<br /> *** [[RetailOS Options]]<br /> * [[GUID table]]<br /> * [[JTAG]]<br /> * Nano 2G<br /> ** [[Nano2G clock gates‎]]<br /> ** [[Nano2G LCD init]]<br /> ** [[Nano2G HW analysis]]<br /> ** [[S5L8701 analysis]]<br /> * Nano 4G<br /> ** [[Nano4G firmware upgrade process]]<br /> * Nano 5G<br /> ** [[Nano 5G|General]]<br /> <br /> ===Other guides===<br /> * [[Modes]]<br /> |style=&quot;border: 1px dashed #c6c9ff; background-color: #f0f0ff&quot;|<br /> ===Hardware===<br /> * [[Hardware]]<br /> ** [[Nano 1G]]<br /> ** [[Nano 2G]]<br /> ** [[Nano 3G]]<br /> ** [[Nano 4G]]<br /> *** [[920-0614-03]]<br /> ** [[Nano 5G]]<br /> ** [[Nano 6G]]<br /> ** [[Nano 7G]]<br /> ** [[Classic 6G]]<br /> * [[Chronology]]<br /> * [[S5L8700 datasheet]]<br /> <br /> ===Exploiting===<br /> * [[wInd3x]]<br /> * [[Pwnage 2.0]]<br /> * [[Notes vulnerability]]<br /> ** [[Address bruteforcing]]<br /> ** [[Nanotron 3000]]<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Classic_1G&diff=22146 2025-06-21T19:43:39Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: redirect to new merged page</p> <hr /> <div>#REDIRECT [[Classic 6G#Initial]]</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Classic_2G&diff=22145 2025-06-21T19:43:27Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: redirect to new merged page</p> <hr /> <div>#REDIRECT [[Classic 6G#Rev A]]</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Classic_3G&diff=22144 2025-06-21T19:42:53Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: redirect to new merged page</p> <hr /> <div>#REDIRECT [[Classic 6G#Rev B]]</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Classic_6G&diff=22143 2025-06-21T19:41:56Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: create merged iPod classic page from Classic 1G, Classic 2G, Classic 3G</p> <hr /> <div>{{DISPLAYTITLE:iPod classic (6th generation)}}<br /> This page concerns the mainline iPods branded with the &quot;classic&quot; name. These iPods mark the switch from PortalPlayer to Samsung processors and were the last mainline iPods ever released. Four versions of this iPod exist, all branded with &quot;classic&quot;: the [[#Initial|initial version]], released in 2007, [[#Rev A|Rev A]], released in 2008, a thinner [[#Rev B|Rev B]] released in 2009 and a final Rev C revision not documented here. These revisions are sometimes called the 6th, 6.5th, 7th, and 7.5th generation respectively.<br /> <br /> ==Initial==<br /> [[Image:classic_1g_frt_a.png|500px]]<br /> [[Image:classic_1g_bck_a.png|500px]]<br /> ===Terminology===<br /> This is the first version of the 6th generation &quot;classic&quot; branded iPod. It was available in an 80GB and 160GB model.<br /> <br /> ===Components===<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 3<br /> | CPU<br /> | Samsung S5L8702<br /> |<br /> | ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702. Same as on the Nano 3G<br /> |-<br /> | 2<br /> | SDRAM<br /> | K4X51163PE<br /> |<br /> | <br /> |-<br /> | 5<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41340 SST25VF080B]<br /> |<br /> | Same as on the Nano 3G<br /> |-<br /> | 4<br /> | Audio codec<br /> | [http://www.cirrus.com/en/pubs/proDatasheet/CS42L55_F1.pdf Cirrus Logic CS42L55]<br /> | APPLE, 338S0394, A1GIO736, MAL<br /> | <br /> |-<br /> | 1<br /> | Power manager<br /> | NXP PCF50635<br /> | APPLE, 338S0445, 2114.102, ZPD7383Y<br /> | <br /> |-<br /> | 6<br /> | USB charging<br /> | LTC4066<br /> |<br /> |<br /> |}<br /> <br /> ===Helpful pages===<br /> Teardowns:<br /> *TheSeven's broken Classic 1G board (High-res): [http://img43.imageshack.us/img43/6619/6gback.jpg front] [http://img7.imageshack.us/img7/1858/6gfront.jpg back]<br /> Other:<br /> *http://homepage.mac.com/marc.heijligers/audio/ipod/comparison/measurements/measurements.html<br /> <br /> ==Rev A==<br /> [[Image:classic_2g_frt_a.jpg|500px]]<br /> [[Image:classic_2g_bck_a.png|500px]]<br /> <br /> ===Terminology===<br /> This is a revised version of the 6th generation iPod with the &quot;classic&quot; name. It is thinner than the 160GB [[#Initial||initial revision]] and was only available with 120GB storage.<br /> <br /> ===Components===<br /> Almost exactly the same hardware as the [[#Initial]], except that region A is populated. This presumably communicates with the new headphone/remote that Apple chose for this device to support.<br /> ===Helpful pages===<br /> Teardowns:<br /> *http://www.chinaveboss.com/faq_info.html?faqs_id=53&amp;fcPath=1&amp;zenid=19755464b2fde0cb4f7a8877cfa6649c<br /> <br /> ==Rev B==<br /> [[Image:Front_3g.jpg|500px]]<br /> [[Image:Back_3g.jpg|500px]]<br /> <br /> iPod classic MC293, 160GB, silver<br /> <br /> <br /> No better teardown pictures of this revision have been found or made by us yet. There is, however, [http://www.ilounge.com/index.php/news/comments/ipod-classic-160gb-changes-new-firmware-engraving/ a basic guide of the non-electronic differences] by iLounge. Since the model number is the same as [[#Rev A|Rev A]], there probably aren't any worthwhile (if any) in the hardware.<br /> <br /> ===Terminology===<br /> Rev B is a re-introduced 160GB revision of the classic, announced on September 9, 2009. It is the same size as the [[#Rev A|Rev A]] model.<br /> <br /> <br /> ===Components===<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 3<br /> | CPU<br /> | [https://freemyipod.org/wiki/S5L8702 Samsung S5L8702]<br /> |337S3526 8702 N26P9U4 1011 ARM<br /> | ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702. Same as on the Nano 3G<br /> |-<br /> | 2<br /> | SDRAM<br /> | K4X51163PE<br /> |<br /> | <br /> |-<br /> | 5<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41340 SST25VF080B]<br /> |<br /> | Same as on the Nano 3G<br /> |-<br /> | 4<br /> | Audio codec<br /> | [http://www.cirrus.com/en/pubs/proDatasheet/CS42L55_F1.pdf Cirrus Logic CS42L55]<br /> | APPLE 338S0394 AICK0952 MAL<br /> | <br /> |-<br /> | 1<br /> | Power manager<br /> | NXP PCF50635<br /> | APPLE 338S0445 78030 82 D780113<br /> | <br /> |-<br /> | 6<br /> | USB charging<br /> | LTC4066<br /> |4066T 84453<br /> |<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_1G&diff=22142 2025-06-21T19:20:16Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: update pcb images</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (1st generation)}}<br /> ==Components==<br /> [[File:Nano 1g frt a.png|500px|thumb|none|Front of the circuit board]]<br /> [[File:Nano 1g bck a.png|500px|thumb|none|Back of the circuit board]]<br /> {| class=&quot;wikitable&quot;<br /> <br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 4<br /> | CPU<br /> | Portal Player PP5021C-TDF<br /> | PP5021C-TDF, L9A0633, U0530 Logo, WYH30113.1, TAIWAN<br /> | This is the last Nano that used a PortalPlayer processor before Apple started using Samsung. If anybody knows of a datasheet for this, please add a link to it.<br /> |-<br /> | 5<br /> | SDRAMg<br /> | [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&amp;partnum=K4M56163PG Samsung K4M56163PG]<br /> | SEC534 BG75, K4M56163PG, AQF061WX<br /> | A datasheet for this Mobile SDRAM chip can be found [http://pdf1.alldatasheet.net/datasheet-pdf/view/168204/SAMSUNG/K4M56163PG.html here].<br /> |-<br /> | 10<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41856 SST39WF400A]<br /> | SST39WF400A, 90-4C-C1QE, 0528149A<br /> | This chip is documented very well. A similar chip is on the [[Nano 2G]].<br /> |-<br /> | 1<br /> | NAND Flash<br /> | Varies<br /> |<br /> |<br /> |-<br /> | 2<br /> | Click wheel controller<br /> | CY8C21434<br /> | CPMCYP, 6360A 02, K0R0512, 610881<br /> |<br /> |-<br /> | 3<br /> | ATA flash disk controller<br /> | SST5SLD019K<br /> | Logo, 55LD019K, 45-C-MWE, 0528071-A4<br /> | <br /> |-<br /> | 6<br /> | Audio codec<br /> | WM8975G<br /> | WM8975G, 56AGVF4<br /> | <br /> |-<br /> | 7<br /> | Step down regulator<br /> | LM34910<br /> | JM54RE, 34910SD<br /> | <br /> |-<br /> | 8<br /> | Power manager<br /> | PCF50607<br /> | CF50607, 605940, Bug528, 23e/N1Y<br /> | <br /> |-<br /> | 9<br /> | USB charging<br /> | LTC4066<br /> | Logo, 5F, 4066, N7537<br /> | <br /> |}<br /> <br /> ==Helpful pages==<br /> Chip analyses:<br /> *http://www2.electronicproducts.com/Apple_iPod_nano-whatsinside-2.aspx<br /> Teardowns:<br /> *http://arstechnica.com/apple/reviews/2005/09/nano.ars/4<br /> *[http://pc.watch.impress.co.jp/docs/2005/0908/nano21.jpg Image of the 1G Nano board]<br /> *[http://www.ipodlinux.org/wiki/Generations#iPod_Nano_.28Nano1G.29] - See the pictures listed<br /> Other:<br /> *http://www.ipodlinux.org/wiki/Generations</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Modes&diff=22141 2025-06-21T18:38:42Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: add links to usb ids section</p> <hr /> <div>At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting. <br /> <br /> ==Normal mode==<br /> &quot;Normal mode&quot; is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.<br /> <br /> ==Disk mode==<br /> In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text &quot;Do not disconnect.&quot; or a checkmark symbol with the text &quot;OK to disconnect.&quot; depending on whether the iPod is connected and if it has been ejected. <br /> <br /> Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]<br /> <br /> Disk mode is also referred to as &quot;forced disk mode&quot; in device information received from the iPod.<br /> <br /> The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the &quot;disk&quot; partition of the [[Firmware]]. <br /> <br /> ==DFU mode==<br /> [https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the iPod nano (3rd generation) and newer and the iPod classic (6th generation) and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].<br /> <br /> When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other [[IMG1]] images cannot be sent in this mode.<br /> <br /> The iPod nano (2nd generation) also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does, however, support a NOR DFU mode that can be entered by holding down Back+Play right after rebooting the device&lt;ref&gt;https://www.rockbox.org/irc/log-20080904#13:31:44&lt;/ref&gt;.<br /> <br /> ==WTF mode==<br /> In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.<br /> <br /> The iTunes behavior upon seeing an iPod in WTF mode is to send it a &quot;recovery&quot; firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the &quot;osos&quot; partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].<br /> <br /> ==Diagnostic mode==<br /> This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot.&lt;sup&gt;(clarification needed)&lt;/sup&gt;<br /> <br /> ==USB IDs==<br /> When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in: <br /> {| class=&quot;wikitable&quot; <br /> |-<br /> ! colspan=&quot;2&quot; | Model<br /> ! Normal/disk mode<br /> ! DFU mode<br /> ! WTF mode<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 2G]]<br /> | &lt;code&gt;1260&lt;/code&gt;<br /> | &lt;code&gt;1220&lt;/code&gt;<br /> | &lt;code&gt;1240&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 3G]]<br /> | &lt;code&gt;1262&lt;/code&gt;<br /> | &lt;code&gt;1223&lt;/code&gt;/&lt;code&gt;1224&lt;/code&gt;<br /> | &lt;code&gt;1242&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 4G]]<br /> | &lt;code&gt;1263&lt;/code&gt;<br /> | &lt;code&gt;1225&lt;/code&gt;<br /> | &lt;code&gt;1243&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 5G]]<br /> | &lt;code&gt;1265&lt;/code&gt;<br /> | &lt;code&gt;1231&lt;/code&gt;<br /> | &lt;code&gt;1246&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | [[Nano 6G]]<br /> | &lt;code&gt;1266&lt;/code&gt;<br /> | &lt;code&gt;1232&lt;/code&gt;<br /> | &lt;code&gt;1248&lt;/code&gt;<br /> |-<br /> | rowspan=&quot;2&quot; | [[Nano 7G]]<br /> | 2012<br /> | rowspan=&quot;2&quot; | &lt;code&gt;1267&lt;/code&gt;<br /> | rowspan=&quot;2&quot; | &lt;code&gt;1234&lt;/code&gt;<br /> | &lt;code&gt;1249&lt;/code&gt;<br /> |-<br /> | 2015<br /> | &lt;code&gt;124a&lt;/code&gt;<br /> |-<br /> | rowspan=&quot;4&quot; | iPod classic (6th generation)<br /> | Initial<br /> | rowspan=&quot;4&quot; | &lt;code&gt;1261&lt;/code&gt;<br /> | rowspan=&quot;4&quot; | &lt;code&gt;1223&lt;/code&gt;<br /> | &lt;code&gt;1241&lt;/code&gt;<br /> |-<br /> | Rev A<br /> | &lt;code&gt;1245&lt;/code&gt;<br /> |-<br /> | Rev B<br /> | &lt;code&gt;1247&lt;/code&gt;<br /> |-<br /> | Rev C<br /> | &lt;code&gt;1250&lt;/code&gt;<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_7G&diff=22140 2025-06-21T18:37:54Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: add display title</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (7th generation)}}<br /> [[Image:Nano7g_front.jpg|500px]]<br /> [[Image:Nano7g_back.jpg|500px]]<br /> ==Components==<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | &lt;span style=&quot;color:#ff0004&quot;&gt;Red&lt;/span&gt;<br /> | PMIC<br /> | <br /> | Apple 338S1099<br /> | Guessing based on connectivity to power components around.<br /> |-<br /> | &lt;span style=&quot;color:#ff9024&quot;&gt;Orange&lt;/span&gt;<br /> | Bluetooth + FM radio<br /> | Broadcom BCM2078KUBG<br /> |<br /> | <br /> |-<br /> | &lt;span style=&quot;color:#f3e00e&quot;&gt;Yellow&lt;/span&gt;<br /> |<br /> | NXP Semiconductors 1609A1<br /> |<br /> |<br /> |-<br /> | &lt;span style=&quot;color:#16dc81&quot;&gt;Green&lt;/span&gt;<br /> |<br /> |<br /> | 75203 23017<br /> |<br /> |-<br /> | &lt;span style=&quot;color:#2343e8&quot;&gt;Blue&lt;/span&gt;<br /> |<br /> |<br /> | 75292 98820<br /> |<br /> |}<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | &lt;span style=&quot;color:#ff0000&quot;&gt;Red&lt;/span&gt;<br /> | NAND flash<br /> | Toshiba THGBX2G7D2JLA01 128 Gb (16 GB)<br /> |<br /> | <br /> |-<br /> | &lt;span style=&quot;color:#ff9024&quot;&gt;Orange&lt;/span&gt;<br /> | Touchscreen controller<br /> | Texas Instruments 343S0538<br /> |<br /> | <br /> |-<br /> | &lt;span style=&quot;color:#f3e00e&quot;&gt;Yellow&lt;/span&gt;<br /> |<br /> | <br /> | Apple 338S1146<br /> |<br /> |-<br /> | &lt;span style=&quot;color:#16dc81&quot;&gt;Green&lt;/span&gt;<br /> | SoC/CPU<br /> | S5L8740<br /> | 339S0193<br /> | 8740 per IMG1. Guessing based on similar package to N6G SoC/CPU. Also has the most diffpairs running to/from it (from delayered PCB).<br /> |}<br /> <br /> ==Helpful pages==<br /> Teardowns:<br /> * https://www.ifixit.com/Teardown/iPod+Nano+7th+Generation+Teardown/10826<br /> &lt;!--<br /> Reviews:<br /> * TODO<br /> --&gt;<br /> <br /> == Core ==<br /> <br /> Cortex A5 according to CP15:<br /> <br /> &lt;pre&gt;<br /> ID code: 0x410fc050<br /> Implementer: ARM<br /> Variant: 0x0<br /> Architecture: See CPUID<br /> Part number: c05, Revision: 0<br /> &lt;/pre&gt;<br /> <br /> == Memory Map ==<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Address !! Name<br /> |-<br /> | 0x38C00000<br /> | AES<br /> |-<br /> | 0x3C500000<br /> | CLKCON<br /> |-<br /> | 0x3C700000<br /> | TIMER<br /> |-<br /> | 0x3CC00000<br /> | UART0<br /> |-<br /> | 0x3CF00000<br /> | GPIO<br /> |-<br /> | 0x3D100000<br /> | CHIPID<br /> |}<br /> <br /> == Clock Gates ==<br /> <br /> There is no big debug table with all clock gates in N7G RetailOS, so the following has been written out by hand:<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Address !! Bits (clear to power on) !! Meaning !! Source<br /> |-<br /> | 0x3C50006C<br /> | 0x2000<br /> | 'SPI power'<br /> | WTF DevicePowerManagement.dll<br /> |-<br /> | 0x3C50004C<br /> | 0x4<br /> | 'SPI power'<br /> | WTF DevicePowerManagement.dll<br /> |-<br /> | 0x3C50004c<br /> | 0x1f800020<br /> | Timer<br /> | WTF IpodSec.dll<br /> |-<br /> | 0x3C500058<br /> | 0x60<br /> | Timer<br /> | WTF IpodSec.dll<br /> |-<br /> | 0x3c50006c<br /> | 0xc0007f<br /> | Timer<br /> | WTF IpodSec.dll<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_6G&diff=22139 2025-06-21T18:37:44Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: add display title</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (6th generation)}}<br /> [[Image:nano_6g_frt_a.png|500px]]<br /> [[Image:nano_6g_bck_a.png|500px]]<br /> ==Components==<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | &lt;span style=&quot;color:red&quot;&gt;Red&lt;/span&gt;<br /> | NAND Flash<br /> | <br /> | Toshiba TH58NVG6E2FLA4C<br /> | <br /> |-<br /> | &lt;span style=&quot;color:cyan&quot;&gt;Cyan&lt;/span&gt;<br /> | Audio codec<br /> | Cirrus Logic CLI1544C0<br /> | Apple 33850859 C0E111022<br /> | <br /> |-<br /> | &lt;span style=&quot;color:orange&quot;&gt;Orange&lt;/span&gt;<br /> | PMU<br /> | Dialog D1830B<br /> | Apple 338S0783-B1 10298HLS<br /> | <br /> |-<br /> | &lt;span style=&quot;color:#e8e838&quot;&gt;Yellow&lt;/span&gt;<br /> | FM receiver<br /> | Silicon Labs Si4800<br /> | 0650 D0UY 027<br /> | <br /> |-<br /> | &lt;span style=&quot;color:blue&quot;&gt;Blue&lt;/span&gt;<br /> | CPU<br /> | Samsung S5L8723<br /> | Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031<br /> | Samsung APL3278A01 ARM Application processor<br /> Samsung K4X51323PI Mobile DDR SDRAM (64 MB)<br /> <br /> Rusty Mercury says it's a Samsung S5L8723, a step up from the previous Samsung 8730. [http://twitter.com/RustyMercury/status/23268805957 source]<br /> <br /> |-<br /> | &lt;span style=&quot;color:#cf5eea&quot;&gt;Pink&lt;/span&gt;<br /> | Touchscreen controller<br /> | Cypress CY8C20746B<br /> | 35758907 1025 A 04 629749<br /> | <br /> |}<br /> <br /> ==Notes==<br /> The red and black wires lead to the battery.<br /> <br /> ==Helpful pages==<br /> Teardowns:<br /> *http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563<br /> Reviews:<br /> *http://arstechnica.com/apple/reviews/2010/09/6th-generation-ipod-nano.ars<br /> *http://www.ubmtechinsights.com/reports-and-subscriptions/investigative-analysis/apple-ipod-nano/</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_5G&diff=22138 2025-06-21T18:37:33Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: add display title</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (5th generation)}}<br /> [[Image:nano_5g_frt_a.png|500px]]<br /> [[Image:nano_5g_bck_a.png|500px]]<br /> ==Components==<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 2<br /> | CPU<br /> | Samsung S5L8730<br /> | 339S0081 ARM, K4X51323PG-UGC6, EDE168AG 0928, APL0378A00, N1X2XW 0931<br /> | Printed backwards on the chip - how sneaky. ARM1176JZF-S core (per CP15 data).<br /> |-<br /> | <br /> | SDRAM<br /> | <br /> |<br /> | Integrated into the processor, similar to the iPod Touch and iPhone lines.<br /> |-<br /> | 8<br /> | NAND Flash<br /> | Various 8/16 GB chips<br /> | TH58NVG6D2ELA49, ID8038, TAIWAN, 09299AE<br /> | One example is TH58NVG6D2ELA49 visible on the iFixit Teardown<br /> |-<br /> | 1<br /> | Power manager<br /> | Probably Dialog<br /> | 338S0707, -AD, 09278HGZ<br /> | Similar looking and named chips like this have been power managers. Apple uses chips like these in just about every device.<br /> |-<br /> | 3<br /> | <br /> | <br /> | <br /> | <br /> |-<br /> | 4<br /> | <br /> | <br /> | <br /> | <br /> |-<br /> | 5<br /> | Audio codec<br /> | Cirrus Logic CLI1480A<br /> | 338S0559, ATWV0926, SGP<br /> | Also found in the Touch 3G. Stereo CODEC w/ Headphone and Speaker Amp<br /> |-<br /> | 6<br /> | Accelerometer<br /> | [http://www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATASHEET/CD00213611.pdf LIS331DLM]<br /> | 33DM, 2910<br /> | The newer Touch's, iPhone's, and even the iPad have similar accelerometers, and I've discovered a pattern in the chip names.<br /> |-<br /> | 7<br /> | <br /> | <br /> | 0630, CK9Y, 925<br /> | <br /> |}<br /> <br /> == Code Execution ==<br /> <br /> Code execution on the Nano 5G was achieved by blindly porting [[WInd3x|wInd3x]].<br /> <br /> == CP15 Registers ==<br /> <br /> Dump of CP15 registers from bootrom context:<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! cX !! cY !! opc2 !! Description !! Value !! Interpretation<br /> |-<br /> | 0<br /> | 0<br /> | 0<br /> | Main ID<br /> | 410fb764<br /> | ARM (0x41), Variant 0, Architecture: see CPUID, Part: ARM1176<br /> |-<br /> | 0<br /> | 0<br /> | 1<br /> | Cache Type<br /> | 1d152152<br /> | Write back, format C cache lockdown, Register 7 cache cleaning operations, separate I/D caches; data cache: (no restriction on page allocation, 16KB, 4-way associative, 2 word line length) istrunction cache: (no restrictions on page allocation, 16KB, 4-way, 2 word)<br /> |-<br /> | 0<br /> | 0<br /> | 2<br /> | TCM Status<br /> | 00000000<br /> | No tightly coupled memory.<br /> |-<br /> | 0<br /> | 0<br /> | 3<br /> | TLB Type<br /> | 00000800<br /> |<br /> |-<br /> | 0<br /> | 1<br /> | 0<br /> | Processor Feature 0<br /> | 00000111<br /> | Jazelle, Thumb1, ARM (no Thumb2)<br /> |-<br /> | 0<br /> | 1<br /> | 1<br /> | Processor Feature 1<br /> | 00000011<br /> | Security Extensions Architecture v1, Standard ARMv4 programmer's model. No microcontroller model.<br /> |-<br /> | 0<br /> | 1<br /> | 2<br /> | Debug Feature 0<br /> | 00000033<br /> | v6.1 Secure Debug, v6.1 Debug.<br /> |-<br /> | 0<br /> | 1<br /> | 3<br /> | Auxiliary Feature 0<br /> | 00000000<br /> | <br /> |-<br /> | 0<br /> | 1<br /> | 4<br /> | Memory Model Feature 0<br /> | 01130003<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 1<br /> | 5<br /> | Memory Model Feature 1<br /> | 10030302<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 1<br /> | 6<br /> | Memory Model Feature 2<br /> | 01222100<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 1<br /> | 7<br /> | Memory Model Feature 3<br /> | 00000000<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 2<br /> | 0<br /> | Instruction Set Feature Attribute 0<br /> | 00140011<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 2<br /> | 1<br /> | Instruction Set Feature Attribute 1<br /> | 12002111<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 2<br /> | 2<br /> | Instruction Set Feature Attribute 2<br /> | 11231121<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 2<br /> | 3<br /> | Instruction Set Feature Attribute 3<br /> | 01102131<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 2<br /> | 4<br /> | Instruction Set Feature Attribute 4<br /> | 00001141<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 0<br /> | 2<br /> | 5<br /> | Instruction Set Feature Attribute 5<br /> | 00000000<br /> | Standard ARM1176JZF-S.<br /> |-<br /> | 1<br /> | 0<br /> | 0<br /> | Control<br /> | 00450078<br /> | No Force AP, no TEX remap, CPSR E set to 0 on exception, no VIC, no extended page tables, allow unaligned data access, no fast interrupts, global enable for instruction/data TCM, loads to PC set the T bit, random cache replacement, exceptions vectors at Vector Base Address Register. I$, D$ disabled by wInd3x, branch prediction disabled, no strict alignment fault checking, no MMU.<br /> |-<br /> | 1<br /> | 0<br /> | 1<br /> | Auxiliary Control<br /> | 00000007<br /> | ...<br /> |-<br /> | 1<br /> | 0<br /> | 2<br /> | Coprocessor Access Control<br /> | 00000000<br /> | ...<br /> |-<br /> | 1<br /> | 1<br /> | 0<br /> | Secure Configuration<br /> | 00000000<br /> | ...<br /> |-<br /> | 1<br /> | 1<br /> | 1<br /> | Secure Debug Enable<br /> | 00000000<br /> | ...<br /> |-<br /> | 1<br /> | 1<br /> | 2<br /> | Non-Secure Access Control<br /> | 00000000<br /> | ...<br /> |-<br /> | 2<br /> | 0<br /> | 0<br /> | Translation Table Base 0<br /> | 00000000<br /> | ...<br /> |-<br /> | 2<br /> | 0<br /> | 1<br /> | Translation Table Base 1<br /> | 00000000<br /> | ...<br /> |-<br /> | 2<br /> | 0<br /> | 2<br /> | Translation Table Base Control<br /> | 00000000<br /> | ...<br /> |-<br /> | 3<br /> | 0<br /> | 0<br /> | Domain Access Control<br /> | 00000000<br /> | ...<br /> |-<br /> | 7<br /> | 4<br /> | 0<br /> | PCA<br /> | 00000000<br /> | ...<br /> |-<br /> | 7<br /> | 10<br /> | 6<br /> | Cache Dirty Status<br /> | 00000000<br /> | ...<br /> |-<br /> | 9<br /> | 0<br /> | 0<br /> | Data Cache Lockdown<br /> | fffffff0<br /> | ...<br /> |-<br /> | 9<br /> | 0<br /> | 1<br /> | Instruction Cache Lockdown<br /> | fffffff0<br /> | ...<br /> |-<br /> | 9<br /> | 1<br /> | 0<br /> | Data TCM Region<br /> | 00000000<br /> | ...<br /> |-<br /> | 9<br /> | 1<br /> | 1<br /> | Instruction TCM Region<br /> | 00000000<br /> | ...<br /> |-<br /> | 9<br /> | 1<br /> | 2<br /> | Data TCM Non-secure Control Access<br /> | 00000000<br /> | ...<br /> |-<br /> | 9<br /> | 1<br /> | 3<br /> | Instruction TCM Non-secure Control Access<br /> | 00000000<br /> | ...<br /> |-<br /> | 9<br /> | 2<br /> | 0<br /> | TCM Selection<br /> | 00000000<br /> | ...<br /> |-<br /> | 9<br /> | 8<br /> | 0<br /> | Cache Behavior Override<br /> | 00000000<br /> | ...<br /> |}<br /> <br /> == Clock Gates ==<br /> <br /> The clock gate registers are:<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Address !! Name<br /> |-<br /> | 0x3C500048<br /> | GATES[0]<br /> |-<br /> | 0x3C50004C<br /> | GATES[1]<br /> |-<br /> | 0x3C500058<br /> | GATES[4]<br /> |-<br /> | 0x3C500068<br /> | GATES[8]<br /> |-<br /> | 0x3C50006C<br /> | GATES[9]<br /> |}<br /> <br /> GATES[2, 3, 5, 6, 7], etc seem to be unused. A clock is enabled by setting a corresponding bit (GATE[n][m]) low. The following clock gates have been extracted by analyzing debug structures in OSOS. We also provide the 'numerical' argument that can be passed to the clkgen_{enable,disable}_gate function calls in the BootROM. The BootROM will automatically enable some function-related gates together if one is specified. This is probably a leftover from earlier codebases where one functionality would correspond to one clock gate bit, while now a functionality might be gated behind multiple bits.<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Function !! Register(s)/Bit(s) !! Number in BootROM<br /> |-<br /> | AES<br /> | GATE[0][7]<br /> | 7<br /> |-<br /> | AMC<br /> | GATE[0][3]<br /> | 3<br /> |-<br /> | AMC-core<br /> | GATE[0][4]<br /> | 4<br /> |-<br /> | AMCSS<br /> | GATE[1][17]<br /> | 38<br /> |-<br /> | ARM-core<br /> | GATE[0][15]<br /> | 15<br /> |-<br /> | ARM-icu<br /> | GATE[0][16]<br /> | 16<br /> |-<br /> | ARM-sleep<br /> | GATE[0][20]<br /> | 20<br /> |-<br /> | AXI-bus<br /> | GATE[1][18]<br /> | 39<br /> |-<br /> | AXI-spine<br /> | GATE[8][13]<br /> | 63<br /> |-<br /> | AXI-video<br /> | GATE[8][14]<br /> | 64<br /> |-<br /> | CAMIF<br /> | GATE[0][17], GATE[8][15]<br /> | 17, 65<br /> |-<br /> | CEATA<br /> | GATE[0][6]<br /> | 6<br /> |-<br /> | CLCD<br /> | GATE[8][9]<br /> | 59<br /> |-<br /> | CLCD-OTF<br /> | GATE[8][10]<br /> | 60<br /> |-<br /> | CSIS<br /> | GATE[0][18]<br /> | 18<br /> |-<br /> | DDR-MIU<br /> | GATE[9][17]<br /> | 89<br /> |-<br /> | DMAC0<br /> | GATE[0][11]<br /> | 11<br /> |-<br /> | DMAC1<br /> | GATE[0][12]<br /> | 12<br /> |-<br /> | DMAX<br /> | GATE[8][8]<br /> | 58<br /> |-<br /> | ECC<br /> | GATE[0][9]<br /> | 9<br /> |-<br /> | ECID<br /> | GATE[1][14]<br /> | 35<br /> |-<br /> | FMC<br /> | GATE[0][5]<br /> | 5<br /> |-<br /> | GPIO<br /> | GATE[1][12]<br /> | 33<br /> |-<br /> | H264<br /> | GATE[8][2], GATE[9][18]<br /> | 52, 90<br /> |-<br /> | H264ENC<br /> | GATE[4][7], GATE[8][16], GATE[8][17]<br /> | 60, 66, 67<br /> |-<br /> | IIC0<br /> | GATE[1][4], GATE[9][11]<br /> | 25, 83<br /> |-<br /> | IIC1<br /> | GATE[1][6], GATE[9][12]<br /> | 27, 84<br /> |-<br /> | IIS0<br /> | GATE[1][7]<br /> | 28<br /> |-<br /> | IIS1<br /> | GATE[1][10]<br /> | 31<br /> |-<br /> | IIS2<br /> | GATE[1][16]<br /> | 37<br /> |-<br /> | JPEG<br /> | GATE[0][19]<br /> | 19<br /> |-<br /> | LCD<br /> | GATE[0][1], GATE[9][16]<br /> | 1, 88<br /> |-<br /> | MBX-3D<br /> | GATE[8][6]<br /> | 56<br /> |-<br /> | MBX-bus<br /> | GATE[8][7]<br /> | 57<br /> |-<br /> | MBX-core<br /> | GATE[8][5]<br /> | 55<br /> |-<br /> | MIPI-link<br /> | GATE[1][19]<br /> | 40<br /> |-<br /> | MIXER<br /> | GATE[8][1]<br /> | 51<br /> |-<br /> | MPVD<br /> | GATE[8][3]<br /> | 53<br /> |-<br /> | PKE<br /> | GATE[1][13]<br /> | 34<br /> |-<br /> | PL301MPVD<br /> | GATE[1][21]<br /> | 42<br /> |-<br /> | PRNG<br /> | GATE[1][0]<br /> | 21<br /> |-<br /> | RINGOSC<br /> | GATE[4][0]<br /> | 53<br /> |-<br /> | SCALER<br /> | GATE[8][4], GATE[9][25]<br /> | 54, 97<br /> |-<br /> | SDIO<br /> | GATE[0][8]<br /> | 8<br /> |-<br /> | SHA1<br /> | GATE[0][0]<br /> | 0<br /> |-<br /> | SPD<br /> | GATE[1][8]<br /> | 29<br /> |-<br /> | SPI0<br /> | GATE[1][2], GATE[9][13]<br /> | 23, 85<br /> |-<br /> | SPI1<br /> | GATE[1][11], GATE[9][14]<br /> | 32, 86<br /> |-<br /> | SPI2<br /> | GATE[1][15], GATE[9][15]<br /> | 36, 87<br /> |-<br /> | SPI3<br /> | GATE[4][1], GATE[9][19]<br /> | 54, 91<br /> |-<br /> | SPI4<br /> | GATE[4][4], GATE[9][20]<br /> | 57, 92<br /> |-<br /> | SWI<br /> | GATE[4][2], GATE[9][21]<br /> | 55, 93<br /> |-<br /> | TIMER0<br /> | GATE[1][5], GATE[9][0]<br /> | 26, 72<br /> |-<br /> | TIMER1<br /> | GATE[1][23], GATE[9][1]<br /> | 44, 73<br /> |-<br /> | TIMER2<br /> | GATE[1][24], GATE[9][2]<br /> | 45, 74<br /> |-<br /> | TIMER3<br /> | GATE[1][25], GATE[9][3]<br /> | 46, 75<br /> |-<br /> | TIMER4<br /> | GATE[1][26], GATE[9][4]<br /> | 47, 76<br /> |-<br /> | TIMER5<br /> | GATE[1][27], GATE[9][5]<br /> | 48, 77<br /> |-<br /> | TIMER6<br /> | GATE[1][28], GATE[9][6]<br /> | 49, 78<br /> |-<br /> | TIMER7<br /> | GATE[4][5], GATE[9][22]<br /> | 58, 94<br /> |-<br /> | TIMER8<br /> | GATE[4][6], GATE[9][23]<br /> | 59, 95<br /> |-<br /> | TVOUT<br /> | GATE[0][10]<br /> | 10<br /> |-<br /> | TW<br /> | GATE[1][1]<br /> | 22<br /> |-<br /> | UART0<br /> | GATE[1][9], GATE[9][7]<br /> | 30, 79<br /> |-<br /> | UART1<br /> | GATE[1][29], GATE[9][8]<br /> | 50, 80<br /> |-<br /> | UART2<br /> | GATE[1][30], GATE[9][9]<br /> | 51, 81<br /> |-<br /> | UART3<br /> | GATE[1][31], GATE[9][10]<br /> | 52, 82<br /> |-<br /> | UART4<br /> | GATE[4][8], GATE[9][26]<br /> | 61, 98<br /> |-<br /> | USB-OTG<br /> | GATE[0][2]<br /> | 2<br /> |-<br /> | USB2-PHY<br /> | GATE[1][3]<br /> | 24<br /> |-<br /> | VP<br /> | GATE[8][0]<br /> | 50<br /> |-<br /> | VROM<br /> | GATE[0][13]<br /> | 13<br /> |-<br /> | XMC<br /> | GATE[8][12]<br /> | 62<br /> |}<br /> <br /> ==Helpful pages==<br /> Teardowns:<br /> *http://www.ifixit.com/Teardown/iPod-nano-5th-Generation-Teardown/1157<br /> Other:<br /> *http://purpleskank.wikidot.com/ipod-nano-5g<br /> *http://www.ubmtechinsights.com/reports-and-subscriptions/device-library/Device-Profile/?SINumber=23271</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_4G&diff=22137 2025-06-21T18:37:24Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: add display title</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (4th generation)}}<br /> [[Image:nano_4g_frt_a.png|500px]]<br /> [[Image:nano_4g_bck_a.png|500px]]<br /> ==Components==<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 2<br /> | CPU<br /> | Samsung S5L8720<br /> | 339S0049 ARM, K4X56323PI-KGC4, YWE025QH 825, APL0278A00, N1B2HOP 0831<br /> | ARM1176JZF-S processor. It is definitely worth knowing that this is the exact same processor used in the iTouch 2G. This could mean that some of the same exploits for that could possibly be used. [http://theiphonewiki.com/wiki/index.php?title=S5L8720_(Hardware) Here] is a very interesting page about the S5L8720 processor.<br /> |-<br /> | <br /> | SDRAM<br /> | <br /> |<br /> | 32MB, probably MDDR. Integrated into the processor, similar to the iPod Touch and iPhone lines.<br /> |-<br /> | 4<br /> | Accelerometer<br /> | [http://www.st.com/stonline/products/literature/ds/12726.pdf LIS302DL]<br /> | 33DL, 2827<br /> | The newer Touch's, iPhone's, and even the iPad have similar accelerometers, and I've discovered a pattern in the chip names.<br /> |-<br /> | 6<br /> | NAND Flash<br /> | Varies<br /> | TH58NVG6D1DLA87, U20516, JAPAN, 0826MAE<br /> |<br /> |-<br /> | 5<br /> | Audio codec<br /> | [http://www.cirrus.com/en/pubs/proDatasheet/CS42L55_F1.pdf CS42L58]<br /> | 338S055C, 189N0824, SGP<br /> | I determined this because the [[Nano 5G]] has a similar chip, which we are sure of the identity. One person lifted this chip and found that the pins connect to the LCD connector. Not much info was given, and it could just be a common ground, but the identity of this chip is still up in the air.<br /> |-<br /> | 1<br /> | Power manager<br /> | Dialog D1759<br /> | 338S0687-AC, 08288HBB<br /> | <br /> |-<br /> | 3<br /> | <br /> | <br /> |<br /> | <br /> |}<br /> <br /> == Bootrom ==<br /> <br /> See [[S5L8720 Bootrom]]. Different from the S5L8720 bootrom used in the iPod Touch 2G (which is iBoot-based, a.k.a. SecureROM).<br /> <br /> == Memory Map ==<br /> <br /> See [https://www.theiphonewiki.com/wiki/S5L8720_(Hardware)] and [https://code.google.com/archive/p/chronicdev/wikis/N72APDevTree.wiki].<br /> <br /> In addition to the above, a few extra memory regions have been found while reverse engineering the [[S5L8720 Bootrom]]:<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Name !! Address !! Notes<br /> |-<br /> | Mystery DMA<br /> | 0x3880_0000<br /> | A PL080-like DMA engine, but with slightly different MMIO register structure. Used by the [[S5L8720 Bootrom|bootrom]] to copy the DFU payload from 0x2200_0600 to 0x2200_0000 after decryption and verification. Or maybe that's actually doing the decryption? To be investigated.<br /> |-<br /> | Mystery Interrupt Thing<br /> | 0x39a0_0000<br /> | Not the VICs (0x38e0_0000, 0x38e0_1000), not the EdgeIC (0x38e0_2000). Seems to hold 7 different 32-bit registers for interrupt status at 0xa0, and 7 different 32-bit registers for interrupt mask at 0xc0. The 7 different registers correspond to 7 'modes' of ISRs set up in the bootrom. Not much is known about what it does, and what these 'modes' are. To be investigated.<br /> |}<br /> <br /> ==Reverse Engineering Results==<br /> Timers: These clockgates have been found to be related to timers: 37, 55, 56, 57, 58, 59, 60, 69, 70, 128, 129, 130, 131, 132, 133, 134, 150 and 151.<br /> <br /> ==Status registers==<br /> We dumped all c0 coprocessor registers:<br /> <br /> ===c0,c0===<br /> '''Value:''' 0x410FB764<br /> <br /> '''Interpretation:''' ARM1176 rev. 4<br /> ===c0,c1===<br /> '''Value:''' 0x1D152152<br /> <br /> '''Interpretation:''' DCache/ICache 16KB each, 4 way associative, 32 bytes line size<br /> ===c0,c2===<br /> '''Value:''' 0x00000000<br /> <br /> '''Interpretation:''' No TCM<br /> ===c0,c3===<br /> '''Value:''' 0x00000800<br /> <br /> '''Interpretation:''' Unified TLB, 8 lockable entries<br /> ===c1,c0===<br /> '''Value:''' 0x00000111<br /> <br /> '''Interpretation:''' ARM/Thumb1/Jazelle support, no Thumb2 support<br /> ===c1,c1===<br /> '''Value:''' 0x00000011<br /> <br /> '''Interpretation:''' Trustzone v1<br /> ===c1,c2===<br /> '''Value:''' 0x00000033<br /> <br /> '''Interpretation:''' Supports debug model v6.1, both applications processor and secure<br /> ===c1,c3===<br /> '''Value:''' 0x00000000<br /> <br /> '''Interpretation:''' No auxiliary features<br /> ===c1,c4===<br /> '''Value:''' 0x01130003<br /> <br /> '''Interpretation:''' FCSE, Auxiliary Control register, ARMv6 TCM/DMA, no DMA cache coherency, no multicore cache coherency, VMSA v7<br /> ===c1,c5===<br /> <br /> '''Value:''' 0x10030302<br /> <br /> '''Interpretation:''' Branch target buffer, Harvard architecture, various cache operations supported (see TRM)<br /> ===c1,c6===<br /> <br /> '''Value:''' 0x01222100<br /> <br /> '''Interpretation:''' WFI, Data synchronization barrier, Prefetch flush, Data memory barrier, various TLB/cache operations supported (see TRM), no prefetch cache range operation<br /> <br /> ===c1,c7===<br /> '''Value:''' 0x00000000<br /> <br /> '''Interpretation:''' No hierarchical cache maintenance support<br /> ===c2,c0===<br /> '''Value:''' 0x00140011<br /> <br /> '''Interpretation:''' Supports BKPT, CDP, CDP2, LDC, LDC2, MCD, MCD2, MRC, MRC2, STC, STC2, MCRR, MCRR2, MRRC, MRRC2, CLZ, SWP and SWPB, doesn't support division, combined compare and branch or bitfield instructions<br /> ===c2,c1===<br /> '''Value:''' 0x12002111<br /> <br /> '''Interpretation:''' Supports BXJ, BX, BLX, PC loads have BX behavior, supports SXTB, SXTAB, SXTB16, SXTAB16, SXTH, SXTAH, UXTB, <br /> UXTAB, UXTB16, UXTAB16, UXTH, UXTAH, SRS, RFE, CPS, LDM(2), LDM(3), STM(2) and SETEND<br /> ===c2,c2===<br /> '''Value:''' 0x11231121<br /> <br /> '''Interpretation:''' Supports REV, REV16, REVSH, MRS, MSR, UMULL, UMLAL, UMAAL, SMULL, SMLAL, SMLABB, SMLABT, SMLALBB, SMLALBT, SMLALTB, SMLALTT, SMLATB, SMLATT, SMLAWB, SMLAWT, SMULBB, SMULBT, SMULTB, SMULTT, SMULWB, SMULWT, SMLAD, SMLADX, SMLALD, SMLALDX, SMLSD, SMLSDX, SMLSLD, SMLSLDX, SMMLA, SMMLAR, SMMLS, SMMLSR, SMMUL, SMMULR, SMUAD, SMUADX, SMUSD, SMUSDX, MLA, restartable LDM/STM, PLD, LDRD, STRD and Q bit in PSRs<br /> ===c2,c3===<br /> '''Value:''' 0x01102131<br /> <br /> '''Interpretation:''' Supports true NOP, Thumb MOV(3)/CPU, LDREX, STREX, LDREXB, LDREXH, LDREXD, STREXB, STREXH, STREXD, CLREX, SVC, PKHBT, PKHTB, QADD16, QADD8, QADDSUBX, QSUB16, QSUB8, QSUBADDX, SADD16, SADD8, SADDSUBX, SEL, SHADD16, SHADD8, SHADDSUBX, SHSUB16, SHSUB8, SHSUBADDX, SSAT, SSAT16, SSUB16, SSUB8, SSUBADDX, SXTAB16, SXTB16, UADD16, UADD8, UADDSUBX, UHADD16, UHADD8, UHADDSUBX, UHSUB16, UHSUB8, UHSUBADDX, UQADD16, UQADD8, UQADDSUBX, UQSUB16, UQSUB8, UQSUBADDX, USAD8, USADA8, USAT, USAT16, USUB16, USUB8, USUBADDX, UXTAB16, UXTB16, QADD, QDADD, QDSUB, QSUB, and the Q and GE[3:0] bits in the PSRs. Does nut support branch table and Thumb2 instructions.<br /> ===c2,c4===<br /> '''Value:''' 0x00001141<br /> <br /> '''Interpretation:''' Supports SMC, writeback instructions, shift of loads and stores by 0-3 bits to the left, constant shift options, register controlled shift options, LDRBT, LDRT, STRBT and STRT. No barrier instructions support.<br /> ===c2,c5===<br /> '''Value:''' 0x00000000<br /> <br /> '''Interpretation:''' No additional implementation defined instruction set extensions<br /> <br /> ==Helpful pages==<br /> Teardowns:<br /> *http://www.ifixit.com/Guide/First-Look/iPod-Nano-4th-Generation/584/1<br /> Other:<br /> *http://theiphonewiki.com/wiki/index.php?title=S5L8720_(Hardware)</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_3G&diff=22136 2025-06-21T18:37:13Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: add display title</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (3rd generation)}}<br /> [[Image:nano_3g_frt_a.png|500px]]<br /> [[Image:nano_3g_bck_a.png|500px]]<br /> ==Components==<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 2<br /> | CPU<br /> | Samsung S5L8702<br /> | 337S3473 8702, NONBWOEC, 0731 ARM<br /> | ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702.<br /> |-<br /> | 3<br /> | SDRAM<br /> | [http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] or Qimonda HYE18M169CX75<br /> | 0728, C, HYE18M256, 169CX75, W3338092<br /> | SDRAM - Mobile DDR, 256Mb, 1.8V. WORK ON THIS: Like the flash chip, the memory also varies. The most popular chip seems to be the [http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]. Another similar one that is sometimes used is the Qimonda HYE18M169CX75<br /> |-<br /> | 5<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41340 SST25VF080B]<br /> | V80B, 729379<br /> | Flash - NOR, 8Mb, Serial SPI<br /> |-<br /> | 6<br /> | NAND Flash<br /> | Varies<br /> | Samsung 728, K9HCG08U5M, PCB0, FCF285X1<br /> |<br /> |-<br /> | 1<br /> | Audio codec<br /> | WM1870<br /> | APPLE, 338S0462, 76BZKTM<br /> | <br /> |-<br /> | 4<br /> | Power manager<br /> | D1671B<br /> | 338S0408, 07258HAH<br /> | <br /> |}<br /> <br /> == SPI NOR Test Pads ==<br /> <br /> Test pads are available on the back of the board to access SCK, MISO and CS between the SoC and the NOR utility flash. MOSI is also present, but is buried in an internal layer (second from back) which can be accessed by carefully scraping off the top FR4 using a sharp tool, or by using a tiny carbide bit on a milling machine.<br /> <br /> [[Image:N3g-spi-nor.png|500px]]<br /> [[Image:N3g-spi-nor-zoom.png|500px]]<br /> <br /> == Hardware Notes ==<br /> === CPU ===<br /> The Apple S5L8702 is an ARM926EJ-S processor designed by Samsung. It is estimated to run at 100MHz (I read this somewhere but I don't remember where). The basics of the chip are similar to the S5L8700x for which there is [[S5L8700 datasheet|a leaked datasheet]]. For some peripherals, merely a base address has changed. For others, full subsystems have been updated and refined. <br /> <br /> === GPU ===<br /> Very little is known about the GPU core other than the fact that it almost certainly exists. It's likely a single PowerVR GPU core that can maybe can decode H.264 content up to 480p (or perhaps there's another peripheral responsible for this?). It's also possible that the GPU is responsible for rendering games, since it appears the games use some form of OpenGL ES. CoverFlow also probably leverages the GPU.<br /> <br /> === I2C ===<br /> The S5L8702 has several I2C busses (two, probably?), but possibly only one is used (bus #0). On this bus, there are currently two known slaves:<br /> * The PMU at address 0x73<br /> * The DAC at address 0x1A<br /> The bus runs at 1.8V with a clock of 333.33KHz.<br /> <br /> Other notes about the I2C peripheral from Rockbox:<br /> * s5l8702 I2C controller is similar to s5l8700, known differences are:<br /> ** IICCON[5] is not used in s5l8702.<br /> ** IICCON[13:8] are used to enable interrupts.<br /> ** IICSTA2[13:8] are used to read the status and write-clear interrupts.<br /> * Known interrupts:<br /> ** [13] STOP on bus (TBC)<br /> ** [12] START on bus (TBC)<br /> ** [8] byte transmitted or received in Master mode (not tested in Slave)<br /> ** IICCON[4] does not clear interrupts, it is enabled when a byte is transmited or received, in Master mode the tx/rx of the next byte starts when it is written as &quot;1&quot;.<br /> <br /> === Digital Audio Subsystem (I2S) ===<br /> The iPod n3g uses a Wolfson DAC (WM1870) to convert digital audio to analog audio. The S5L8702 sends digital audio in the form of I2S data at 44.1kHz with 16-bit resolution. Even if there is no audio playing, at some point during boot up, the I2S peripheral is turned on, meaning the Bit Clock and Word Select are always on. During the 1kHz tone test in the diagnostic menu, the I2S mode is different, possibly a half-data mode since the test tone is one channel.<br /> The S5L8702 seems to support 3 I2S interfaces, but only one is used for audio playback. It's possible another one is used for microphone recording (when an Apple headset with a microphone is plugged in, you can record voice memos) but this is unconfirmed.<br /> <br /> The S5L8702 sends data to the DAC at full volume no matter what. Volume is configured via I2C bus #0. As far as I can tell, two commands are issued to change the volume:<br /> Address 0x1A, Data 0x04 &lt;volume&gt;<br /> Address 0x1A, Data 0x07 &lt;volume&gt;<br /> Where &lt;volume&gt; is a number between 0xB7 for quietest to 0xF5 for loudest. It's also possible that a special value of 0x80 is for full mute, but this is unconfirmed. It's also unclear what the 0x04 and 0x07 mean, perhaps it's capable of changing the volume of both channels independently?<br /> <br /> Both the I2C and I2S busses run at 1.8V.<br /> <br /> === NAND ===<br /> NAND hardware is an enigma. There has been a rather substantial effort on this subsystem alone. Most of that is documented [https://github.com/lemonjesus/S5L8702-FMISS-Tools here].<br /> <br /> ==Helpful pages==<br /> Chip analyses:<br /> *http://www2.electronicproducts.com/Applie_iPod_Nano_(4GB)_3rd_Generation-whatsinside-16.aspx#<br /> Teardowns:<br /> *http://content.techrepublic.com.com/2346-13636_11-170826-1.html<br /> *http://www.ifixit.com/Guide/First-Look/iPod-Nano-3rd-Generation/594/1<br /> *http://insidetronics.blogspot.com/2007/09/teardown-ipod-nano-3g.html<br /> *[http://www.combert-elec.com/www/bookpic/200810916515460624.jpg Image of 3G Nano board]</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_1G&diff=22135 2025-06-21T18:37:02Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: add display title</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (1st generation)}}<br /> [[Image:nano_1g_frt_a.png|500px]]<br /> [[Image:nano_1g_bck_a.png|500px]]<br /> ==Components==<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 4<br /> | CPU<br /> | Portal Player PP5021C-TDF<br /> | PP5021C-TDF, L9A0633, U0530 Logo, WYH30113.1, TAIWAN<br /> | This is the last Nano that used a PortalPlayer processor before Apple started using Samsung. If anybody knows of a datasheet for this, please add a link to it.<br /> |-<br /> | 5<br /> | SDRAM<br /> | [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&amp;partnum=K4M56163PG Samsung K4M56163PG]<br /> | SEC534 BG75, K4M56163PG, AQF061WX<br /> | A datasheet for this Mobile SDRAM chip can be found [http://pdf1.alldatasheet.net/datasheet-pdf/view/168204/SAMSUNG/K4M56163PG.html here].<br /> |-<br /> | 10<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41856 SST39WF400A]<br /> | SST39WF400A, 90-4C-C1QE, 0528149A<br /> | This chip is documented very well. A similar chip is on the [[Nano 2G]].<br /> |-<br /> | 1<br /> | NAND Flash<br /> | Varies<br /> |<br /> |<br /> |-<br /> | 2<br /> | Click wheel controller<br /> | CY8C21434<br /> | CPMCYP, 6360A 02, K0R0512, 610881<br /> |<br /> |-<br /> | 3<br /> | ATA flash disk controller<br /> | SST5SLD019K<br /> | Logo, 55LD019K, 45-C-MWE, 0528071-A4<br /> | <br /> |-<br /> | 6<br /> | Audio codec<br /> | WM8975G<br /> | WM8975G, 56AGVF4<br /> | <br /> |-<br /> | 7<br /> | Step down regulator<br /> | LM34910<br /> | JM54RE, 34910SD<br /> | <br /> |-<br /> | 8<br /> | Power manager<br /> | PCF50607<br /> | CF50607, 605940, Bug528, 23e/N1Y<br /> | <br /> |-<br /> | 9<br /> | USB charging<br /> | LTC4066<br /> | Logo, 5F, 4066, N7537<br /> | <br /> |}<br /> <br /> ==Helpful pages==<br /> Chip analyses:<br /> *http://www2.electronicproducts.com/Apple_iPod_nano-whatsinside-2.aspx<br /> Teardowns:<br /> *http://arstechnica.com/apple/reviews/2005/09/nano.ars/4<br /> *[http://pc.watch.impress.co.jp/docs/2005/0908/nano21.jpg Image of the 1G Nano board]<br /> *[http://www.ipodlinux.org/wiki/Generations#iPod_Nano_.28Nano1G.29] - See the pictures listed<br /> Other:<br /> *http://www.ipodlinux.org/wiki/Generations</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Nano_2G&diff=22134 2025-06-21T18:35:15Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: add display title</p> <hr /> <div>{{DISPLAYTITLE:iPod nano (2nd generation)}}<br /> [[Image:nano_2g_frt_a.jpg|300px]]<br /> [[Image:nano_2g_bck_a.jpg|300px]]<br /> ==Components==<br /> {| class=&quot;wikitable&quot;<br /> ! Label !! Component !! Part !! Markings !! Notes<br /> |-<br /> | 1<br /> | CPU<br /> | Samsung S5L8701<br /> |337S32918701, N042DQS, 0636 ARM<br /> | System On Chip (SoC), includes ARM940T central processor, advanced DSP, 50kB boot ROM, 176kB SRAM, external RAM, flash and LCD controllers, USB(1.1-host; 2.0-function) and some other parts. Package: [http://www.samsung.com/global/business/semiconductor/support/PackageInformation/downloads/SystemLSI/FBGA/232_FBGA_1010_12_05.pdf 232-pin FBGA 10x10mm] or 224/226-pin 9x9mm. Similar chips: [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=212&amp;partnum=SA58700 SA58700X07]. Some documentation available for the S5L series can be found [[S5L8700 datasheet|here]]. The processor itself is Apple-branded and marked 337S3291 8701.<br /> |-<br /> | 2<br /> | SDRAM<br /> | [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&amp;partnum=K4M56163PG Samsung K4M56163PG]<br /> |SEC 637 GG75, K4M56163PG, AQH373P1<br /> | [http://pdf1.alldatasheet.net/datasheet-pdf/view/168204/SAMSUNG/K4M56163PG.html here] is the datasheet. This is the same chip used in the [[Nano 1G]]. Sometimes the Qimonda [http://www.alldatasheet.com/datasheet-pdf/pdf/207179/QIMONDA/HYE18L256169BFX-7.5.html HYE18L256] chip is used instead.<br /> |-<br /> | 3<br /> | Utility Flash<br /> | [http://www.sst.com/products/?inode=41422 SST39WF800A]<br /> |SST39WF800A, 90-4C-C2QE, 0631287-A<br /> | stores Disk Mode, Diagnostic Mode and the code to flash this chip. Tof has [http://home.gna.org/linux4nano/dumping_SST39WF800A.html managed to extract] this data and the dump can be obtained by emailing Emmanuel Fleury. All of the contents in the utility flash chip are encrypted from now on.<br /> |-<br /> | N/A<br /> | DSP<br /> | N/A<br /> | N/A<br /> | Doesn't seem to be present at all.<br /> |-<br /> | B1<br /> | NAND Flash<br /> | Varies<br /> |TOSHIBA P11023, JAPAN 0636 KAE, TP0560, TH58NVG5D4CTG20<br /> |<br /> |-<br /> | 6<br /> | USB charging<br /> | LTC4066<br /> |Linear Technology, 6H, 4066, B8966<br /> | <br /> |-<br /> | 5<br /> | Audio codec<br /> | Wolfson WM8975<br /> |APPLE, 338S0310, 68BTST8<br /> | <br /> |-<br /> | 4<br /> | Step down regulator<br /> | LM34910<br /> |National Semiconductor, JM66RJ, L34910B<br /> |<br /> |-<br /> | B2<br /> | Power manager (below)<br /> | NXP PCF50633UM<br /> |APPLE, 338S0261, P29T6 04, cPG0637Y, 01/N2<br /> |<br /> |}<br /> <br /> ==Helpful pages==<br /> Teardowns:<br /> *http://www.ifixit.com/Guide/First-Look/iPod-Nano-2nd-Generation/592/1<br /> *http://arstechnica.com/apple/reviews/2006/09/ipod-2g.ars/4<br /> *http://www.eetimes.com/design/audio-design/4016200/Tear-Down-Inside-the-Apple-8GB-iPod-nano (useful because it shows the power manager)<br /> *http://forums.rockbox.org/index.php?PHPSESSID=d69e900c3215a165adee7165ece4eccb&amp;topic=6518.msg62700#msg62700 (beautiful PCB scans)<br /> Other:<br /> *http://home.gna.org/linux4nano/download/hardware_synth-1.0.pdf</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Modes&diff=22132 2025-06-21T16:58:13Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: add reference for n2g NOR DFU mode</p> <hr /> <div>At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting. <br /> <br /> ==Normal mode==<br /> &quot;Normal mode&quot; is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.<br /> <br /> ==Disk mode==<br /> In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text &quot;Do not disconnect.&quot; or a checkmark symbol with the text &quot;OK to disconnect.&quot; depending on whether the iPod is connected and if it has been ejected. <br /> <br /> Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]<br /> <br /> Disk mode is also referred to as &quot;forced disk mode&quot; in device information received from the iPod.<br /> <br /> The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the &quot;disk&quot; partition of the [[Firmware]]. <br /> <br /> ==DFU mode==<br /> [https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the iPod nano (3rd generation) and newer and the iPod classic (6th generation) and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].<br /> <br /> When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other [[IMG1]] images cannot be sent in this mode.<br /> <br /> The iPod nano (2nd generation) also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does, however, support a NOR DFU mode that can be entered by holding down Back+Play right after rebooting the device&lt;ref&gt;https://www.rockbox.org/irc/log-20080904#13:31:44&lt;/ref&gt;.<br /> <br /> ==WTF mode==<br /> In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.<br /> <br /> The iTunes behavior upon seeing an iPod in WTF mode is to send it a &quot;recovery&quot; firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the &quot;osos&quot; partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].<br /> <br /> ==Diagnostic mode==<br /> This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot.&lt;sup&gt;(clarification needed)&lt;/sup&gt;<br /> <br /> ==USB IDs==<br /> When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in: <br /> {| class=&quot;wikitable&quot; <br /> |-<br /> ! colspan=&quot;2&quot; | Model<br /> ! Normal/disk mode<br /> ! DFU mode<br /> ! WTF mode<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (2nd generation)<br /> | &lt;code&gt;1260&lt;/code&gt;<br /> | &lt;code&gt;1220&lt;/code&gt;<br /> | &lt;code&gt;1240&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (3rd generation)<br /> | &lt;code&gt;1262&lt;/code&gt;<br /> | &lt;code&gt;1223&lt;/code&gt;/&lt;code&gt;1224&lt;/code&gt;<br /> | &lt;code&gt;1242&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (4th generation)<br /> | &lt;code&gt;1263&lt;/code&gt;<br /> | &lt;code&gt;1225&lt;/code&gt;<br /> | &lt;code&gt;1243&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (5th generation)<br /> | &lt;code&gt;1265&lt;/code&gt;<br /> | &lt;code&gt;1231&lt;/code&gt;<br /> | &lt;code&gt;1246&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (6th generation)<br /> | &lt;code&gt;1266&lt;/code&gt;<br /> | &lt;code&gt;1232&lt;/code&gt;<br /> | &lt;code&gt;1248&lt;/code&gt;<br /> |-<br /> | rowspan=&quot;2&quot; | iPod nano (7th generation)<br /> | 2012<br /> | rowspan=&quot;2&quot; | &lt;code&gt;1267&lt;/code&gt;<br /> | rowspan=&quot;2&quot; | &lt;code&gt;1234&lt;/code&gt;<br /> | &lt;code&gt;1249&lt;/code&gt;<br /> |-<br /> | 2015<br /> | &lt;code&gt;124a&lt;/code&gt;<br /> |-<br /> | rowspan=&quot;4&quot; | iPod classic (6th generation)<br /> | Initial<br /> | rowspan=&quot;4&quot; | &lt;code&gt;1261&lt;/code&gt;<br /> | rowspan=&quot;4&quot; | &lt;code&gt;1223&lt;/code&gt;<br /> | &lt;code&gt;1241&lt;/code&gt;<br /> |-<br /> | Rev A<br /> | &lt;code&gt;1245&lt;/code&gt;<br /> |-<br /> | Rev B<br /> | &lt;code&gt;1247&lt;/code&gt;<br /> |-<br /> | Rev C<br /> | &lt;code&gt;1250&lt;/code&gt;<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Chronology&diff=22131 2025-06-21T15:56:30Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: make this page outdated</p> <hr /> <div>{{outdated|reason=This information is out of date. See [https://theapplewiki.com/wiki/List_of_iPods List of iPods] and [https://theapplewiki.com/wiki/List_of_iPod_nanos List of iPod nanos] for an up-to-date listing of iPod models.}}<br /> This page list all models of iPods and set the naming of it. So that, on this wiki, or on IRC nobody can be confused with what we are speaking about. Please also refer to Apple's [http://support.apple.com/kb/HT1353 Identifying iPod Models]&quot; page<br /> <br /> ==iPod Series==<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Model !! Introduced !! Capacity !! Notes <br /> |-<br /> | [http://support.apple.com/kb/HT1353#scrollwheel 1G] <br /> | 2001-10<br /> | 5 GB or 10 GB<br /> |<br /> |-<br /> | [http://support.apple.com/kb/HT1353#touchwheel 2G]<br /> | 2002-07 <br /> | 10 GB or 20 GB<br /> |<br /> |-<br /> | [http://support.apple.com/kb/HT1353#dockconnector 3G] <br /> | 2003-04<br /> | 10 GB, 15 GB, 20 GB, 30 GB, or 40 GB<br /> |<br /> |-<br /> | [http://support.apple.com/kb/HT1353#clickwheel 4G (Greyscale)]<br /> | 2004-07<br /> | 20 GB or 40 GB<br /> |<br /> |-<br /> | [http://support.apple.com/kb/HT1353#ipodphoto 4G (Color)]<br /> | 2004-10<br /> | 20 GB, 30 GB, or 60 GB<br /> |<br /> |-<br /> | [http://support.apple.com/kb/HT1353#ipodfifth 5G (Video)]<br /> | 2005-10<br /> | 30 GB or 60 GB<br /> |<br /> |-<br /> | [http://support.apple.com/kb/HT1353#ipodfifth2 5.5G (Video)]<br /> | 2006-09<br /> | 30 GB or 80 GB<br /> |<br /> |-<br /> | [http://support.apple.com/kb/HT1353#ipodclassic (6G) Classic 1G]<br /> | 2007-09<br /> | 80 GB or 160 GB<br /> | Encryption starts<br /> |-<br /> | [http://support.apple.com/kb/HT1353#iPod_classic_120GB (6G) Classic 2G]<br /> | 2008-09<br /> | 120 GB<br /> |<br /> |-<br /> | [http://support.apple.com/kb/HT1353#iPod_classic_160GB (6G) Classic 3G]<br /> | 2009-09<br /> | 160 GB<br /> |<br /> |}<br /> <br /> ==iPod Nano Series==<br /> <br /> {| class=&quot;wikitable&quot;<br /> ! Model !! Introduced !! Capacity !! Notes <br /> |-<br /> | [http://support.apple.com/kb/HT1353#ipodnano Nano 1G]<br /> | 2005-09<br /> | 1 GB, 2 GB, or 4 GB<br /> |<br /> |-<br /> | [http://support.apple.com/kb/HT1353#ipodnano2 Nano 2G]<br /> | 2006-09<br /> | 2 GB, 4 GB, or 8 GB<br /> | Encryption starts<br /> |-<br /> | [http://support.apple.com/kb/HT1353#ipodnano3 Nano 3G]<br /> | 2007-09<br /> | 4 GB or 8 GB<br /> |<br /> |-<br /> | [http://support.apple.com/kb/HT1353#iPod_nano_4th_generation Nano 4G]<br /> | 2008-09<br /> | 8 GB or 16 GB<br /> |<br /> |-<br /> | [http://support.apple.com/kb/HT1353#iPod_nano5G Nano 5G]<br /> | 2009-09<br /> | 8 GB or 16 GB<br /> |<br /> |-<br /> | [http://support.apple.com/kb/HT1353#iPod_Nano_6G Nano 6G]<br /> | 2010-09<br /> | 8 GB or 16 GB<br /> | Multi-Touch display<br /> |}<br /> <br /> ==Timeline==<br /> [[Image:IPod Timeline.png|800px|The timeline of iPod releases (from Wikipedia)]]<br /> <br /> ==The Motive==<br /> Understanding the mindset and motives behind Apple is key to understanding how and why the iPod was encrypted. While many people believe that the iPod was encrypted to put an end to iPodLinux and Rockbox, the main reason for the encryption was to thwart third-party imitators. Apple was not as concerned with iPodLinux and Rockbox because people were still buying their (overpriced) hardware, and therefore still generating profits. The main reason was because there were many imitations that replicated the hardware and ran the exact firmware that was run on normal iPods. This was a major drain of money for Apple. Another reason was that the DRM mechanism in the unencrypted firmware was being hacked. This allowed pirated content like games to be run without being bought.<br /> ==The Response==<br /> Since Apple was losing money from the iPod imitators, they encrypted the firmware so the iPod clones could no longer use Apple firmware on their devices. There are still iPod clones out there (just search eBay), but very few use the Apple firmware anymore. Apple has encrypted all of their portable devices since the iPod Nano 2G.<br /> ==The Change==<br /> In order to stop the fake iPods from using their firmware, Apple encrypted the firmware so only their devices could decrypt it. Apple changed their processor to Samsung and no longer used PortalPlayer.<br /> ==Helpful Pages==<br /> http://support.apple.com/kb/HT1353</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=RetailOS_Options&diff=22130 2025-06-21T15:48:53Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: displaytitle</p> <hr /> <div>{{DISPLAYTITLE:retailOS Options}}<br /> [[OSOS]] has some 'secret' options that you can enable by placing files into iPod_Control/Device.<br /> <br /> The following table shows all known options, with information on what device are they supported. Some of these appear to have no cross-references in q3k's decompilation, but that might be a tooling issue. Ideally, we should test every single one of these :).<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! File !! Functionality !! Nano 5G<br /> |-<br /> | '''_enable_options''' || '''This file must be present for any other option to work.''' || ✔️<br /> |-<br /> | _show_numeric_volume || Displays numeric value when changing volume. || ✔️<br /> |-<br /> | _disable_cache || || ✔️ (Unused?)<br /> |-<br /> | _go_fast || || ✔️ (Unused?)<br /> |-<br /> | _show_voltage || Displays battery voltage at bottom of screen. || ✔️<br /> |-<br /> | _show_speed || || ✔️<br /> |-<br /> | _show_memory || Displays heap statistics at bottom of screen. || ✔️<br /> |-<br /> | _show_fps || || ✔️<br /> |-<br /> | _disable_mbx_timeout || Mailbox timeouts? PowerVR MBX timeouts? Untested. || ✔️<br /> |-<br /> | _tvoutwidescreen || || ✔️<br /> |-<br /> | _enable_logging || Writes high-level logs into iPod_Control/Logs. || ✔️<br /> |-<br /> | _enable_crash_logging || || ✔️ (Unused?)<br /> |-<br /> | _enable_memory_logging || || ✔️ (Unused?)<br /> |-<br /> | _disable_jpeg_decoder || || ✔️ (Unused?)<br /> |-<br /> | _disable_sleep || || ✔️<br /> |-<br /> | _hibe_sleep || || ✔️<br /> |-<br /> | _disable_hibe || || ✔️<br /> |-<br /> | _hibe_beep || || ✔️<br /> |-<br /> | _short_deepsleep || || ✔️<br /> |-<br /> | _no_deepsleep || Preempted by _short_deepsleep. || ✔️<br /> |-<br /> | _dont_reject_vid || || ✔️<br /> |-<br /> | _tcsize || File contents read (number likely expected). || ✔️<br /> |-<br /> | _speed || File contents read (number likely expected). Default -1. || ✔️ (Unused?)<br /> |-<br /> | _no_vc0_autopower || || ✔️ (Unused?)<br /> |-<br /> | _autopow_overlay || || ✔️ (Unused?)<br /> |-<br /> | _dartboard || Weird mode in which menu/play are swapped and iTunes database seems to be ignored. || ✔️ <br /> |-<br /> | _show_brightness || || ✔️ (Unused?)<br /> |-<br /> | _car_adapter || || ✔️<br /> |-<br /> | _usb_swap_configs || || ✔️<br /> |-<br /> | _usb_audio_sinewave || || ✔️<br /> |-<br /> | _usb_audio_authentication_optional || || ✔️ (Unused?)<br /> |-<br /> | _usb_audio_negotiation_optional || || ✔️ (Unused?)<br /> |-<br /> | _usb_audio_test_mode || || ✔️ (Unused?)<br /> |-<br /> | _usb_audio_lame_resampling || || ✔️ (Unused?)<br /> |-<br /> | _usb_audio_samplerate_match_style || || ✔️ (Unused?)<br /> |-<br /> | _usb_audio_resampling_method || || ✔️ (Unused?)<br /> |-<br /> | _usb_audio_show_status || || ✔️<br /> |-<br /> | _serial_acc_iap_status || || ✔️ (Unused?)<br /> |-<br /> | _battery_always_low || || ✔️<br /> |-<br /> | _show_cache_size || || ✔️<br /> |-<br /> | _disable_unsplit_decoders || || ✔️ (Unused?)<br /> |-<br /> | _heap_beep || || ✔️ (Unused?)<br /> |-<br /> | _show_autobaud || || ✔️<br /> |-<br /> | _ignore_volume_pref || || ✔️<br /> |-<br /> | _no_volume_control || || ✔️<br /> |-<br /> | _record_max_16mb || || ✔️<br /> |-<br /> | _vp_lang || || ✔️ (Unused?)<br /> |-<br /> | _mockup_mode || || ✔️ (Unused?)<br /> |-<br /> | _tvout_video_display || || ✔️ (Unused?)<br /> |-<br /> | _deblocking_off || || ✔️ (Unused?)<br /> |-<br /> | _force_AACHE || || ✔️ (Unused?)<br /> |-<br /> | _force_AACLC || || ✔️ (Unused?)<br /> |-<br /> | _reset_rtc || || ✔️ (Unused?)<br /> |-<br /> | _no_volume_control || || ✔️<br /> |-<br /> | _honor_repeat || || ✔️<br /> |-<br /> | _rental_notify_always || || ✔️<br /> |-<br /> | _uart30pin_debug || || ✔️<br /> |-<br /> | _uart2_debug || Preempted by _uart30pin_debug. || ✔️<br /> |-<br /> | _mie_on || || ✔️ (Unused?)<br /> |-<br /> | _dragster_on || || ✔️ (Unused?)<br /> |-<br /> | _try_spirit_codecs || || ✔️<br /> |-<br /> | _amc_r2d || || ✔️<br /> |-<br /> | _crossfade_on || || ✔️ (Unused?)<br /> |-<br /> | _mecca_trace_debug || || ✔️ (Unused?)<br /> |-<br /> | _use_aac_encoder || || ✔️<br /> |-<br /> | _wheel_raw_data || || ✔️ (Unused?)<br /> |-<br /> | _wheel_app_data || || ✔️<br /> |-<br /> | _accel_data || || ✔️<br /> |-<br /> | _orient_me_not || || ✔️<br /> |-<br /> | _shake_data || || ✔️ (Unused?)<br /> |-<br /> | _hold3beep || Halt and wait for JTAG in C_exception_handler. Probably. || ✔️<br /> |-<br /> | _skipgamedrm || Seemingly allows Manifest.plist.p7b to not be present when reading eApps/games. If present, will still be checked. || ✔️<br /> |-<br /> | _firewire_supported || || ✔️<br /> |-<br /> | _debug_db || || ✔️ (Unused?)<br /> |-<br /> | _EQBiasScale || Contents read. || ✔️ (Unused?)<br /> |-<br /> | _RecorderGainDB || Contents read. || ✔️ (Unused?)<br /> |-<br /> | _SpeakerEQ_HPF_Fc || Contents read. || ✔️ (Unused?)<br /> |-<br /> | _SpeakerEQPreset || Contents read. || ✔️ (Unused?)<br /> |-<br /> | _RecorderGainLimit || Contents read. || ✔️ (Unused?)<br /> |-<br /> | _6bits_accel || || ✔️ (Unused?)<br /> |-<br /> | _disable_bpfix || || ✔️ (Unused?)<br /> |-<br /> | _tuner_readings_show || || ✔️<br /> |-<br /> | _tuner_metadata_events_show || || ✔️<br /> |-<br /> | _tuner_buffer_time_show || || ✔️<br /> |-<br /> | _tuner_readings_logging || || ✔️<br /> |-<br /> | _tuner_metadata_raw_logging || || ✔️<br /> |-<br /> | _tuner_metadata_parsed_logging || || ✔️<br /> |-<br /> | _tuner_scan_logging || || ✔️<br /> |-<br /> | _tuner_auto_scan || || ✔️<br /> |-<br /> | _tuner_softmute_disable || || ✔️<br /> |-<br /> | _tuner_hicut_disable || || ✔️<br /> |-<br /> | _hifi_video_encoding || || ✔️<br /> |-<br /> | _no_look_ahead_video_encoding || || ✔️<br /> |-<br /> | _look_ahead_video_encoding || || ✔️<br /> |-<br /> | _bvtpowertest || || ✔️<br /> |-<br /> | _disable_clock_gating || || ✔️<br /> |-<br /> | _writerawyuvstills || || ✔️<br /> |-<br /> | _ped_time_10x || || ✔️<br /> |-<br /> | _power_testing || || ✔️<br /> |-<br /> | _ped_xyz_logging || || ✔️<br /> |-<br /> | _ped_heartbeat || || ✔️<br /> |-<br /> | _ped_time_100x || || ✔️<br /> |-<br /> | _ped_time_1000x || || ✔️<br /> |-<br /> | _log_sys_model || || ✔️ (Unused?)<br /> |-<br /> | _fm_fieldtesting || || ✔️<br /> |-<br /> | _nand_high_clock || || ✔️ (Unused?)<br /> |-<br /> | _disable_overlay_limit || || ✔️ (Unused?)<br /> |-<br /> | _show_max_battery || || ✔️<br /> |-<br /> | _show_fixed_time || || ✔️<br /> |-<br /> | _photo_albums_test || || ✔️<br /> |-<br /> | _show_pll || || ✔️<br /> |-<br /> | _hang_frame_drop || || ✔️<br /> |-<br /> | _disable_overlay_limit || _enable_options not required. || ✔️ (Unused?)<br /> |-<br /> | _quick_3bits || _enable_options not required. || ✔️ (Unused?)<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Modes&diff=22129 2025-06-21T15:42:13Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: wrap usb ids in code</p> <hr /> <div>At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting. <br /> <br /> ==Normal mode==<br /> &quot;Normal mode&quot; is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.<br /> <br /> ==Disk mode==<br /> In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text &quot;Do not disconnect.&quot; or a checkmark symbol with the text &quot;OK to disconnect.&quot; depending on whether the iPod is connected and if it has been ejected. <br /> <br /> Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]<br /> <br /> Disk mode is also referred to as &quot;forced disk mode&quot; in device information received from the iPod.<br /> <br /> The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the &quot;disk&quot; partition of the [[Firmware]]. <br /> <br /> ==DFU mode==<br /> [https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the iPod nano (3rd generation) and newer and the iPod classic (6th generation) and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].<br /> <br /> When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other [[IMG1]] images cannot be sent in this mode.<br /> <br /> The iPod nano (2nd generation) also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does support a NOR DFU mode that can be entered by holding down Back+Play right after rebooting the device.&lt;sup&gt;(clarification needed)&lt;/sup&gt;<br /> <br /> ==WTF mode==<br /> In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.<br /> <br /> The iTunes behavior upon seeing an iPod in WTF mode is to send it a &quot;recovery&quot; firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the &quot;osos&quot; partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].<br /> <br /> ==Diagnostic mode==<br /> This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot.&lt;sup&gt;(clarification needed)&lt;/sup&gt;<br /> <br /> ==USB IDs==<br /> When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in: <br /> {| class=&quot;wikitable&quot; <br /> |-<br /> ! colspan=&quot;2&quot; | Model<br /> ! Normal/disk mode<br /> ! DFU mode<br /> ! WTF mode<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (2nd generation)<br /> | &lt;code&gt;1260&lt;/code&gt;<br /> | &lt;code&gt;1220&lt;/code&gt;<br /> | &lt;code&gt;1240&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (3rd generation)<br /> | &lt;code&gt;1262&lt;/code&gt;<br /> | &lt;code&gt;1223&lt;/code&gt;/&lt;code&gt;1224&lt;/code&gt;<br /> | &lt;code&gt;1242&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (4th generation)<br /> | &lt;code&gt;1263&lt;/code&gt;<br /> | &lt;code&gt;1225&lt;/code&gt;<br /> | &lt;code&gt;1243&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (5th generation)<br /> | &lt;code&gt;1265&lt;/code&gt;<br /> | &lt;code&gt;1231&lt;/code&gt;<br /> | &lt;code&gt;1246&lt;/code&gt;<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (6th generation)<br /> | &lt;code&gt;1266&lt;/code&gt;<br /> | &lt;code&gt;1232&lt;/code&gt;<br /> | &lt;code&gt;1248&lt;/code&gt;<br /> |-<br /> | rowspan=&quot;2&quot; | iPod nano (7th generation)<br /> | 2012<br /> | rowspan=&quot;2&quot; | &lt;code&gt;1267&lt;/code&gt;<br /> | rowspan=&quot;2&quot; | &lt;code&gt;1234&lt;/code&gt;<br /> | &lt;code&gt;1249&lt;/code&gt;<br /> |-<br /> | 2015<br /> | &lt;code&gt;124a&lt;/code&gt;<br /> |-<br /> | rowspan=&quot;4&quot; | iPod classic (6th generation)<br /> | Initial<br /> | rowspan=&quot;4&quot; | &lt;code&gt;1261&lt;/code&gt;<br /> | rowspan=&quot;4&quot; | &lt;code&gt;1223&lt;/code&gt;<br /> | &lt;code&gt;1241&lt;/code&gt;<br /> |-<br /> | Rev A<br /> | &lt;code&gt;1245&lt;/code&gt;<br /> |-<br /> | Rev B<br /> | &lt;code&gt;1247&lt;/code&gt;<br /> |-<br /> | Rev C<br /> | &lt;code&gt;1250&lt;/code&gt;<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Modes&diff=22128 2025-06-21T15:38:24Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: fix classic WTF pids</p> <hr /> <div>At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting. <br /> <br /> ==Normal mode==<br /> &quot;Normal mode&quot; is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.<br /> <br /> ==Disk mode==<br /> In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text &quot;Do not disconnect.&quot; or a checkmark symbol with the text &quot;OK to disconnect.&quot; depending on whether the iPod is connected and if it has been ejected. <br /> <br /> Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]<br /> <br /> Disk mode is also referred to as &quot;forced disk mode&quot; in device information received from the iPod.<br /> <br /> The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the &quot;disk&quot; partition of the [[Firmware]]. <br /> <br /> ==DFU mode==<br /> [https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the iPod nano (3rd generation) and newer and the iPod classic (6th generation) and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].<br /> <br /> When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other [[IMG1]] images cannot be sent in this mode.<br /> <br /> The iPod nano (2nd generation) also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does support a NOR DFU mode that can be entered by holding down Back+Play right after rebooting the device.&lt;sup&gt;(clarification needed)&lt;/sup&gt;<br /> <br /> ==WTF mode==<br /> In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.<br /> <br /> The iTunes behavior upon seeing an iPod in WTF mode is to send it a &quot;recovery&quot; firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the &quot;osos&quot; partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].<br /> <br /> ==Diagnostic mode==<br /> This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot.&lt;sup&gt;(clarification needed)&lt;/sup&gt;<br /> <br /> ==USB IDs==<br /> When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in: <br /> {| class=&quot;wikitable&quot; <br /> |-<br /> ! colspan=&quot;2&quot; | Model<br /> ! Normal/disk mode<br /> ! DFU mode<br /> ! WTF mode<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (2nd generation)<br /> | 1260<br /> | 1220<br /> | 1240<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (3rd generation)<br /> | 1262<br /> | 1223/1224<br /> | 1242<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (4th generation)<br /> | 1263<br /> | 1225<br /> | 1243<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (5th generation)<br /> | 1265<br /> | 1231<br /> | 1246<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (6th generation)<br /> | 1266<br /> | 1232<br /> | 1248<br /> |-<br /> | rowspan=&quot;2&quot; | iPod nano (7th generation)<br /> | 2012<br /> | rowspan=&quot;2&quot; | 1267<br /> | rowspan=&quot;2&quot; | 1234<br /> | 1249<br /> |-<br /> | 2015<br /> | 124a<br /> |-<br /> | rowspan=&quot;4&quot; | iPod classic (6th generation)<br /> | Initial<br /> | rowspan=&quot;4&quot; | 1261<br /> | rowspan=&quot;4&quot; | 1223<br /> | 1241<br /> |-<br /> | Rev A<br /> | 1245<br /> |-<br /> | Rev B<br /> | 1247<br /> |-<br /> | Rev C<br /> | 1250<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Modes&diff=22127 2025-06-21T15:36:26Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: use proper revision names for classic</p> <hr /> <div>At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting. <br /> <br /> ==Normal mode==<br /> &quot;Normal mode&quot; is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.<br /> <br /> ==Disk mode==<br /> In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text &quot;Do not disconnect.&quot; or a checkmark symbol with the text &quot;OK to disconnect.&quot; depending on whether the iPod is connected and if it has been ejected. <br /> <br /> Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]<br /> <br /> Disk mode is also referred to as &quot;forced disk mode&quot; in device information received from the iPod.<br /> <br /> The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the &quot;disk&quot; partition of the [[Firmware]]. <br /> <br /> ==DFU mode==<br /> [https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the iPod nano (3rd generation) and newer and the iPod classic (6th generation) and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].<br /> <br /> When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other [[IMG1]] images cannot be sent in this mode.<br /> <br /> The iPod nano (2nd generation) also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does support a NOR DFU mode that can be entered by holding down Back+Play right after rebooting the device.&lt;sup&gt;(clarification needed)&lt;/sup&gt;<br /> <br /> ==WTF mode==<br /> In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.<br /> <br /> The iTunes behavior upon seeing an iPod in WTF mode is to send it a &quot;recovery&quot; firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the &quot;osos&quot; partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].<br /> <br /> ==Diagnostic mode==<br /> This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot.&lt;sup&gt;(clarification needed)&lt;/sup&gt;<br /> <br /> ==USB IDs==<br /> When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in: <br /> {| class=&quot;wikitable&quot; <br /> |-<br /> ! colspan=&quot;2&quot; | Model<br /> ! Normal/disk mode<br /> ! DFU mode<br /> ! WTF mode<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (2nd generation)<br /> | 1260<br /> | 1220<br /> | 1240<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (3rd generation)<br /> | 1262<br /> | 1223/1224<br /> | 1242<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (4th generation)<br /> | 1263<br /> | 1225<br /> | 1243<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (5th generation)<br /> | 1265<br /> | 1231<br /> | 1246<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (6th generation)<br /> | 1266<br /> | 1232<br /> | 1248<br /> |-<br /> | rowspan=&quot;2&quot; | iPod nano (7th generation)<br /> | 2012<br /> | rowspan=&quot;2&quot; | 1267<br /> | rowspan=&quot;2&quot; | 1234<br /> | 1249<br /> |-<br /> | 2015<br /> | 124a<br /> |-<br /> | rowspan=&quot;3&quot; | iPod classic (6th generation)<br /> | Initial<br /> | rowspan=&quot;3&quot; | 1261<br /> | rowspan=&quot;3&quot; | 1223<br /> | 1241<br /> |-<br /> | Rev A<br /> | 1245<br /> |-<br /> | Rev B/Rev C<br /> | 1247<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Contributing&diff=22125 2025-06-21T04:41:29Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: we now have code execution on nano</p> <hr /> <div>The first question people generally ask about this project is, &quot;How can I help out?&quot;. Here are some ways someone can be useful to the project:<br /> <br /> ==Developing==<br /> This is perhaps the most valuable way one can help the project. We get many people who want to help with development but they don't have the necessary skills. If you don't, think of it as an opportunity to learn new and worthwhile skills instead of a roadblock. After all, the best way to learn is in the field doing real work. Here are some topics that developers need to know about:<br /> *'''ARM assembly''' - this is probably the hardest topic for beginners to grasp. Resources:<br /> **[http://simplemachines.it/doc/arm_inst.pdf an ARM primer]<br /> **[http://simplemachines.it/doc/QRC0001H_rvct_v2.1_arm.pdf ARM Quick Ref]<br /> **[http://www.lysator.liu.se/~kjell-e/embedded/ARM-ARM.pdf ARM ARM]<br /> **http://simplemachines.it has great resources for learning ARM<br /> *'''Rust''' and '''C''' - Used whenever we can avoid using ARM assembly.<br /> *'''Go''' and '''Python''' - Used to implement host-side software like wInd3x and bits of EMcore/Rockbox/...<br /> <br /> ==Vulnerabilities==<br /> If you've ever found a way to get your iPod to crash by corrupting things or inputting weird things, we could use the info to see if the bug is a vulnerability. Some examples of bugs like this are the [[Notes vulnerability]] and the [[Pwnage 2.0]] vulnerability. [[OSOS]] bugs in any releases are also appreciated, as they might allow to potentially untether [[wInd3x]].<br /> <br /> If you find any bug, report it via IRC.<br /> <br /> ==Development==<br /> <br /> We need an open-source reimplementation of the [[Nano2G FTL|Samsung Whimory FTL]] used in S5L-based iPods. This will allow us to access the FAT/HFS partition on NAND from any open source software. The FTL is a complex piece of software, and it needs a high-quality, clean-room implementation for reliable read/write access.<br /> <br /> ==Writing guides==<br /> Another way to help out is writing guides like these on the Wiki. Make it easier for new users to get information.<br /> <br /> ==Testing==<br /> Testers are always good to have, and its also a good way to help out if you don't want to spend much time on the project or don't know much about development. Developers, however, will get tired of working with you if you are clueless about how everything works, so make sure you have a good understanding about the tools you're testing.</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=RetailOS&diff=22124 2025-06-21T04:39:46Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: update display title to retailOS</p> <hr /> <div>{{DISPLAYTITLE:retailOS}}<br /> The stock operating system running on non-iOS iPods. It runs everything from device drivers to the clickwheel user interface.<br /> <br /> == Naming ==<br /> <br /> The only 'official' name seems to be 'retailOS', found in the [[Nano 3G]] WTF. It is also referred to as 'osos' per the file name in the resource partition of the firmware bundle.<br /> <br /> == Architecture ==<br /> <br /> retailOS is a small, embedded, single-user, single-binary, real time operating system. With time it acquire more and more complex functionality, like PowerVR drivers and being able to load external applications ('eApps') which are used for games.<br /> <br /> The core of the system is based on RTXC 3.2, with the end-user interface based on intellectual property from a company called Pixo. &lt;ref&gt;https://web.archive.org/web/20230224105131/https://twitter.com/johnwhitley/status/1451952369248264201&lt;/ref&gt;<br /> <br /> == Security ==<br /> <br /> As evidenced by the success of the [[Notes vulnerability]] and [[ipod_sun]], retailOS has no security hardening, and in fact all processes, including games, seem to be running in ARM system mode.<br /> <br /> === Boot chain ===<br /> <br /> retailOS is loaded by the second-stage bootloader (stored on NOR/NAND depending on the device generation), from NAND into DRAM.<br /> <br /> While other stages of the boot chain (eg. the bootloader, WTF mode in newer devices, the diagnostics tool) are based around EFI firmware volumes and an EFI runtime, retailOS is a single binary blob without any built-in modularity.<br /> <br /> === eApp Signing ===<br /> <br /> Not yet documented fully. Each game seems to ship with a Manifest.plist.p7p which is a PKCS#7 signature for the main Manifest.plist.<br /> <br /> == Options ==<br /> <br /> We have found some 'secret' options that can be set by creating specially named files. See [[RetailOS_Options|Options]].<br /> <br /> == Analysis / Memory Layout ==<br /> <br /> Loading RetailOS correctly into a decompiler/disassembler is tricky, as the contents of the IMG1 image are a binary blob which self-relocates to the correct places in memory.<br /> <br /> These are the memory segments within RetailOS that we know of (at least on Nano 5G):<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Name !! Marker !! Location in memory !! Description<br /> |-<br /> | sram.text || n/a || SRAM 0x22000000 || SRAM-resident code, most of RTXC lives here.<br /> |-<br /> | sram.bss || n/a || SRAM 0x22030000 || SRAM-resident zero data.<br /> |-<br /> | sram.data || n/a || SRAM 0x22030000 + sram_bss_size || SRAM-resident data.<br /> |-<br /> | dram.textdata || hibe || DRAM 0x08000000 || Combined .text and .data which lives in DRAM. Bulk of code lives here.<br /> |-<br /> | dram.frameworks || miscTBD || DRAM 0x08000000 + dram_textdata_size || 'Framework' system of some kind, interfaces used by eApps.<br /> |-<br /> | dram.bss || n/a || DRAM 0x08000000 + dram_textdata_size + dram_frameworks_size || DRAM-resident zero data.<br /> |}<br /> <br /> And here's how the segments are built up within the RetailOS binary blob:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Name !! Size<br /> |-<br /> | Start || sram.text || sram_text_size<br /> |-<br /> | || sram.bss || sram_bss_size<br /> |-<br /> | || sram.data || sram_data_size<br /> |-<br /> | || dram.text || dram_text_size<br /> |-<br /> | End || dram.frameworks || dram_frameworks_size<br /> |}<br /> <br /> (yes, the firmware blob ships a sram.bss physically in the file)<br /> <br /> So the goal to be able to load the binary is to figure out the segment sizes and then load them into a decompiler/disassembler. <br /> <br /> Here, we'll show how to figure out the segment sizes for N5G. First, load the RetailOS body (without the header!) at 0x22000000 in a decompiler. We load it there (intead of into DRAM as it is done on the device) as the stub relocates to this address first by performing the SRAM .text/.data copies very early in the process, and the code is position independent for only a short time.<br /> <br /> Then, look at the start function (follow the reset vector):<br /> <br /> &lt;pre&gt;<br /> void start(void) { // 0x2200505c<br /> offs = relocation_offset();<br /> /* ... peeks/pokes to bus matrix periph at 0x3ff00000 ... */<br /> if (offs != 0) {<br /> relocate(offs);<br /> }<br /> (*0x22000000) = 0xea000007;<br /> zero_bss();<br /> }<br /> &lt;/pre&gt;<br /> <br /> relocation_offset will return 0 if the stub is already at 0x22000000, so will return 0 for the way we've loaded it. On a real device, this will be 0x22000000 - 0x08000000 ==<br /> 0x1a000000, as the real device loads RetailOS into DRAM first. Thus, relocate() will be called:<br /> <br /> &lt;pre&gt;<br /> void relocate(int offs) { // 0x22005ec8<br /> int iVar1 = -offs;<br /> void *blob_start = iVar1 + 0x22000000;<br /> memmove(0x22000000, blob_start, 0xe27c); // copy sram.text<br /> memzero(0x22000000 + 0xe27c, 0xbc4); // zero out sram.bss within blob<br /> memmove(0x22030000, 0x22000000 + 0xe27c + iVar1, 0x20000); // copy sram.bss + sram.data<br /> jump_offset(offs);<br /> memmove(0x08000000, 0x22000000 + 0xe27c + 0x20000 + iVar1, 0x6c3768); // copy dram.textdata<br /> memmove(0x08000000 + 0x6c3768, iVar1 + 0x22000000 + 0xe27c + 0x20000 + 0x6c3768), 0xc40); // copy dram.frameworks<br /> start();<br /> return;<br /> }<br /> &lt;/pre&gt;<br /> <br /> The above listing shows reconstituted address calculations - in a plain decompilation, all the additions will of course be simplified to a single constant. But you should be able to figure out the following:<br /> <br /> # sram_text_size is 0xe27c<br /> # sram_bss_size is 0xbc4<br /> # sram_bss_size + sram_data_size is 0x20000<br /> # dram_textdata_size is 0x6c3768<br /> # dram_frameworks_size is 0xc40<br /> <br /> Then, in zero_bss we can find the size of dram.bss:<br /> <br /> &lt;pre&gt;<br /> void zero_bss(void) { // 0x22005fec<br /> memzero(0x2200e27c, 0xbc4); // zero out sram.bss<br /> // inlined memzero:<br /> void *start = 0x08000000 + 0x6c3768 + 0xc40;<br /> int size = 0x790a84;<br /> // ...<br /> }<br /> &lt;/pre&gt;<br /> <br /> From which we can figure out that the dram.bss segment size is 0x790a84.<br /> <br /> Thus we can load the file like so (combining sram.bss and sram.data) into a 'clean' decompiler/disassembler session:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Name !! Memory Address !! File Offset<br /> |-<br /> | sram.text || 0x22000000 || 0x00000000<br /> |-<br /> | sram.bssdata || 0x22030000 || 0x0000e27c<br /> |-<br /> | dram.textdata || 0x08000000 || 0x0002e27c (0xe27c + 0x20000)<br /> |-<br /> | dram.frameworks || 0x086c3768 || 0x006f19e4 (0xe27c + 0x20000 + 0x6c3768)<br /> |-<br /> | dram.bss || 0x086c43a || n/a (0x790a84 zeroes)<br /> |}<br /> <br /> Writing an automated converter into ELF from arbitrary RetailOS blobs is an exercise left to the reader.<br /> <br /> == RTXC == <br /> <br /> === Documentation ===<br /> <br /> This seems to be the best public document available about RTXC 3.2: [https://web.archive.org/web/20230218212424/https://datasheet.datasheetarchive.com/originals/library/Datasheets-AS2/DSAAXSA0003458.pdf DSAAXSA0003458.pdf]. It contains example code for most services, but unfortunately is still missing any structure definitions.<br /> <br /> There's also some training slides available: [https://ia801800.us.archive.org/26/items/manualzilla-id-5752851/5752851.pdf 5752851.pdf]. These introduce the general architecture and concept of RTXC 3.2. <br /> <br /> === Services / Syscalls ===<br /> <br /> While RTXC documentation speaks mostly of 'kernel services' (which are defined as C function signatures/symbols), we like to talk about 'syscalls' and 'syscall numbers' when reverse engineering retailOS. All service functions go through a central dispatch function and that's the easiest point to start reverse engineering the kernel service interface.<br /> <br /> The dispatcher receives a saved caller state which contains a pointer to a serialized syscall request in its saved R0. The syscall request is a trivial structure containing a syscall number and arguments. The dispatcher is executed with interrupts enabled (and thus is non-preemptable) and performs actual work on kernel structures. There is no privilege-granting 'gate' mechanism, all caller code is just as privileged as the kernel code.<br /> <br /> Service functions in turn prepare the syscall request structure (including syscall number), and then call an intermediary state saving function which then calls the dispatcher after disabling interrupts. Some syscall numbers are used by multiple service functions, with some extra arguments in the request being used to decide on the behaviour of the service call (eg. blocking/nonblocking).<br /> <br /> The following table comes from cross-referencing retailOS, publicly available RTXC PDFs and publicly availble RTXC binaries with debug symbols.<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Name !! Number !! Description<br /> |-<br /> | &lt;code&gt;void KS_pend(SEMA sema)&lt;/code&gt; || 0x03 || Semaphore DONE -&gt; PENDING.<br /> |-<br /> | &lt;code&gt;RTXCMSG *KS_receive(MBOX mailbox, TASK task)&lt;/code&gt; || 0x05 || Receive from mailbox.<br /> |-<br /> | &lt;code&gt;KSRC KS_enqueue[w](QUEUE queue, void *entry)&lt;/code&gt; || 0x0c || Push into FIFO (and block if full with 'w' variant).<br /> |-<br /> | &lt;code&gt;void KS_dequeue[w](QUEUE queue, void *dest)&lt;/code&gt; || 0x0d || Pop from FIFO (and block if empty with 'w' variant).<br /> |-<br /> | &lt;code&gt;KSRC KS_lock(RESOURCE resource)&lt;/code&gt; || 0x0e || Lock a resource.<br /> |-<br /> | &lt;code&gt;KSRC KS_lockt(RESOURCE resource, TICKS timoeut)&lt;/code&gt; || 0x0e || Lock a resource with timeout.<br /> |-<br /> | &lt;code&gt;KSRC KS_unlock(RESOURCE resource)&lt;/code&gt; || 0x0f || Unlock an owned resource.<br /> |-<br /> | &lt;code&gt;CLKBLK *KS_alloc_timer(void)&lt;/code&gt; || 0x10 || Allocate next free timer from pool.<br /> |-<br /> | &lt;code&gt;CLKBLK *KS_start_timer(CLKBLK *timer, TICKS initial_period, TICKS cycle_time, SEMA sema)&lt;/code&gt; || 0x12 || Start timer.<br /> |-<br /> | &lt;code&gt;KSRC KS_stop_timer(CLKBLK *timer)&lt;/code&gt; || 0x13 || Stop timer.<br /> |-<br /> | &lt;code&gt;void KS_delay(TASK task, TICKS period)&lt;/code&gt; || 0x14 || Block specified task for a period of time.<br /> |-<br /> | &lt;code&gt;void KS_execute(TASK task)&lt;/code&gt; || 0x15 || Start a task from its beginning address.<br /> |-<br /> | &lt;code&gt;KSRC KS_deftask(TASK task, PRIORITY priority, char *stack, size_t stacksize, void (*entry)(void))&lt;/code&gt; || 0x16 || Define the attributes of an inactive task.<br /> |-<br /> | &lt;code&gt;TASK KS_alloc_task(void)&lt;/code&gt; || 0x17 || Allocate the next available Task Control Block from the pool of free TCBs. <br /> |-<br /> | &lt;code&gt;void KS_terminate(TASK task)&lt;/code&gt; || 0x18 || Stop a task by setting it to INACTIVE.<br /> |-<br /> | &lt;code&gt;void KS_suspend(TASK task)&lt;/code&gt; || 0x19 || Suspend a task until resumed or re-executed.<br /> |-<br /> | &lt;code&gt;void KS_defpriority(TASK task, PRIORITY priority)&lt;/code&gt; || 0x1b || Define or set priority of task.<br /> |-<br /> | &lt;code&gt;void KS_yield(void)&lt;/code&gt; || 0x1c || Voluntary release of control to any other task of the same priority.<br /> |-<br /> | &lt;code&gt;SEMA KS_waitm(SEMA *semalist)&lt;/code&gt; || 0x22 || Wait on multiple semaphores.<br /> |-<br /> | &lt;code&gt;time_t KS_inqtime(void)&lt;/code&gt; || 0x24 || Get current time-of-day.<br /> |-<br /> | &lt;code&gt;void KS_deftime(time_t time)&lt;/code&gt; || 0x25 || Set current time-of-day.<br /> |-<br /> | &lt;code&gt;TASK KS_inqres(RESOURCE resource)&lt;/code&gt; || 0x26 || Get owner of resource.<br /> |-<br /> | &lt;code&gt;KSRC KS_defres(RESOURCE resource, RESATTR condition)&lt;/code&gt; || 0x27 || Define priority inversion on resource.<br /> |-<br /> | &lt;code&gt;void *KS_inqtask_arg(TASK task)&lt;/code&gt; || 0x28 || Get environment arguments of task.<br /> |-<br /> | &lt;code&gt;void KS_deftask_arg(TASK task, void *arg)&lt;/code&gt; || 0x29 || Set environment arguments for task.<br /> |-<br /> | &lt;code&gt;KSRC KS_defqueue(QUEUE queue, size_t width, int depth, void *body, int currsize)&lt;/code&gt; || 0x2e || Define queue.<br /> |-<br /> | &lt;code&gt;int KS_user(int (*func) (void *), void *arg)&lt;/code&gt; || 0x30 || Execute function as if it were kernel service.<br /> |}<br /> <br /> The RTXC memory allocation facilities (&lt;code&gt;KS_alloc/free/create_part/alloc_part/defpart/free_part&lt;/code&gt;) are ''not'' used by retailOS and not built into the service dispatcher, at least on [[Nano 5G]].<br /> <br /> === Semaphores ===<br /> <br /> The following semaphores are defined in the [[Nano 3G]] retailOS:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Number !! Name !! Description<br /> |-<br /> | 0x01 || &lt;code&gt;S_FW_PWR_CHANGE&lt;/code&gt; || <br /> |-<br /> | 0x02 || &lt;code&gt;S_BAT_PWR_CHANGE&lt;/code&gt; || <br /> |-<br /> | 0x03 || &lt;code&gt;S_USB_PWR_CHANGE&lt;/code&gt; || <br /> |-<br /> | 0x04 || &lt;code&gt;S_CNA_CHANGE&lt;/code&gt; || <br /> |-<br /> | 0x05 || &lt;code&gt;S_WHEEL_CHANGE&lt;/code&gt; || <br /> |-<br /> | 0x06 || &lt;code&gt;S_DISKMGRQ&lt;/code&gt; || <br /> |-<br /> | 0x07 || &lt;code&gt;S_TOPPLUG_SWITCH&lt;/code&gt; || <br /> |-<br /> | 0x08 || &lt;code&gt;S_RTCTIMERMGR&lt;/code&gt; || <br /> |-<br /> | 0x09 || &lt;code&gt;S_ALARM_01&lt;/code&gt; || <br /> |-<br /> | 0x0a || &lt;code&gt;S_ALARM_02&lt;/code&gt; || <br /> |-<br /> | 0x0b || &lt;code&gt;S_ALARM_03&lt;/code&gt; || <br /> |-<br /> | 0x0c || &lt;code&gt;S_WATCHDOG&lt;/code&gt; || <br /> |-<br /> | 0x0d || &lt;code&gt;S_CPUMGRQ&lt;/code&gt; || <br /> |-<br /> | 0x0e || &lt;code&gt;S_PCFPOWERMGR&lt;/code&gt; || <br /> |-<br /> | 0x0f || &lt;code&gt;S_POWER_STATE_AC&lt;/code&gt; || <br /> |-<br /> | 0x10 || &lt;code&gt;S_CGR_STATE_TMR&lt;/code&gt; || <br /> |-<br /> | 0x11 || &lt;code&gt;S_DEEPSLEEP&lt;/code&gt; || <br /> |-<br /> | 0x12 || &lt;code&gt;S_ALARM_DONE&lt;/code&gt; || <br /> |-<br /> | 0x13 || &lt;code&gt;S_PIEZOMGR&lt;/code&gt; || <br /> |-<br /> | 0x14 || &lt;code&gt;S_PIEZOMGRSNDR&lt;/code&gt; || <br /> |-<br /> | 0x15 || &lt;code&gt;S_PIEZODONE&lt;/code&gt; || <br /> |-<br /> | 0x16 || &lt;code&gt;S_ACCPOWER&lt;/code&gt; || <br /> |-<br /> | 0x17 || &lt;code&gt;S_ACC_REINIT&lt;/code&gt; || <br /> |-<br /> | 0x18 || &lt;code&gt;S_TOPPLUGSENSER&lt;/code&gt; || <br /> |-<br /> | 0x19 || &lt;code&gt;S_TOPPLUGCHANGE&lt;/code&gt; || <br /> |-<br /> | 0x1a || &lt;code&gt;S_BTMCONNECT&lt;/code&gt; || <br /> |-<br /> | 0x1b || &lt;code&gt;S_BTMPLUGCHANGE&lt;/code&gt; || <br /> |-<br /> | 0x1c || &lt;code&gt;S_BTMREVERIFY&lt;/code&gt; || <br /> |-<br /> | 0x1d || &lt;code&gt;S_BTMREVERTIMED&lt;/code&gt; || <br /> |-<br /> | 0x1e || &lt;code&gt;S_BTMVERCOMP&lt;/code&gt; || <br /> |-<br /> | 0x1f || &lt;code&gt;S_TOPACCPKTRCVD&lt;/code&gt; || <br /> |-<br /> | 0x20 || &lt;code&gt;S_BTMACCPKTRCVD&lt;/code&gt; || <br /> |-<br /> | 0x21 || &lt;code&gt;S_SERIALIDRCVD&lt;/code&gt; || <br /> |-<br /> | 0x22 || &lt;code&gt;S_UARTATXEMPTY&lt;/code&gt; || <br /> |-<br /> | 0x23 || &lt;code&gt;S_UARTBTXEMPTY&lt;/code&gt; || <br /> |-<br /> | 0x24 || &lt;code&gt;S_HDDSCANCOMP&lt;/code&gt; || <br /> |-<br /> | 0x25 || &lt;code&gt;S_BL_ON&lt;/code&gt; || <br /> |-<br /> | 0x26 || &lt;code&gt;S_BL_OFF&lt;/code&gt; || <br /> |-<br /> | 0x27 || &lt;code&gt;S_BL_RAMPDOWN&lt;/code&gt; || <br /> |-<br /> | 0x28 || &lt;code&gt;S_BL_RAMPUP&lt;/code&gt; || <br /> |-<br /> | 0x29 || &lt;code&gt;S_BL_TIMESUP&lt;/code&gt; || <br /> |-<br /> | 0x2a || &lt;code&gt;S_BATT_TIMESUP&lt;/code&gt; || <br /> |-<br /> | 0x2b || &lt;code&gt;S_BATT_AC_PWR&lt;/code&gt; || <br /> |-<br /> | 0x2c || &lt;code&gt;S_BATT_TMR_RST&lt;/code&gt; || <br /> |-<br /> | 0x2d || &lt;code&gt;S_GRAPHMGR&lt;/code&gt; || <br /> |-<br /> | 0x2e || &lt;code&gt;S_VBL&lt;/code&gt; || <br /> |-<br /> | 0x2f || &lt;code&gt;S_DTVRECOVERY&lt;/code&gt; || <br /> |-<br /> | 0x30 || &lt;code&gt;S_CM_HEADPHONE&lt;/code&gt; || <br /> |-<br /> | 0x31 || &lt;code&gt;S_CM_EXTPOWER&lt;/code&gt; || <br /> |-<br /> | 0x32 || &lt;code&gt;S_CM_ACCATTACHED&lt;/code&gt; || <br /> |-<br /> | 0x33 || &lt;code&gt;S_CM_DAC_SETUP&lt;/code&gt; || <br /> |-<br /> | 0x34 || &lt;code&gt;S_ATAWRKLPRDY&lt;/code&gt; || <br /> |-<br /> | 0x35 || &lt;code&gt;S_RTXCBUG&lt;/code&gt; || <br /> |-<br /> | 0x36 || &lt;code&gt;S_BLOCKDEVICE&lt;/code&gt; || <br /> |-<br /> | 0x37 || &lt;code&gt;S_BLOCKDEVICEQ&lt;/code&gt; || <br /> |-<br /> | 0x38 || &lt;code&gt;S_DISPLAY&lt;/code&gt; || <br /> |-<br /> | 0x39 || &lt;code&gt;S_ARB_READY&lt;/code&gt; || <br /> |-<br /> | 0x3a || &lt;code&gt;S_I2C_DONE&lt;/code&gt; || <br /> |-<br /> | 0x3b || &lt;code&gt;S_VSYNC&lt;/code&gt; || <br /> |}<br /> <br /> There are three more semaphores (0x3c, 0x3d, 0x3e) that have no name defined and are likely unused. Anything 0x3f and up is a 'Dynamic' semaphore defined at runtime (which we haven't reversed yet).<br /> <br /> === Queues ===<br /> <br /> The following queues are defined in the [[Nano 3G]] retailOS:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Number !! Name !! Description<br /> |-<br /> | 0x01 || PIXORESQ ||<br /> |-<br /> | 0x02 || PIXOSEMAQ ||<br /> |-<br /> | 0x03 || POSIXRESQ ||<br /> |-<br /> | 0x04 || POSIXSEMAQ ||<br /> |}<br /> <br /> === Mailboxes ===<br /> <br /> The following mailboxes are defined in the [[Nano 3G]] retailOS:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Number !! Name !! Description<br /> |-<br /> | 0x01 || M_DISKMGR ||<br /> |-<br /> | 0x02 || M_PIEZOMGR ||<br /> |-<br /> | 0x03 || M_GRAPHMGR ||<br /> |-<br /> | 0x04 || M_BLOCKDEVICE ||<br /> |-<br /> | 0x05 || M_DISPLAY ||<br /> |}<br /> <br /> === Resources ===<br /> <br /> The following lockable resources are defined in the [[Nano 3G]] retailOS:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Number !! Name !! Description<br /> |-<br /> | 0x01 || GPIO_REG_WRITE ||<br /> |-<br /> | 0x02 || GPIO_INT_INIT ||<br /> |-<br /> | 0x03 || RTC_TIME_ADJUST ||<br /> |-<br /> | 0x04 || RTC_ALARM_ADJUST ||<br /> |-<br /> | 0x05 || I2C_MASTER ||<br /> |-<br /> | 0x06 || USB_GRANT ||<br /> |-<br /> | 0x07 || USB_RESP_INIT ||<br /> |-<br /> | 0x08 || USB_RESPONDER ||<br /> |-<br /> | 0x09 || DISKPWRMGRSEND ||<br /> |-<br /> | 0x0a || PIEZOMGRSEND ||<br /> |- <br /> | 0x0b || SERIALVERIFIER ||<br /> |-<br /> | 0x0c || RESISTORVERIFIER ||<br /> |-<br /> | 0x0d || FW_IRAM ||<br /> |-<br /> | 0x0e || ACCPOWER ||<br /> |-<br /> | 0x0f || UARTA ||<br /> |-<br /> | 0x10 || UARGB ||<br /> |-<br /> | 0x11 || PMU_LOCK ||<br /> |-<br /> | 0x12 || ADC_LOCK ||<br /> |-<br /> | 0x13 || DTV_ENC_INIT ||<br /> |-<br /> | 0x14 || BACKLIGHT ||<br /> |}<br /> <br /> == External links ==<br /> <br /> * [https://web.archive.org/web/19990220054659/http://www.rtxc.com/Products/RTXC/Services.htm RTXC Kernel Services (1999)]<br /> * [https://archive.org/details/manualzilla-id-5752851 RTXC 3.2 Training Manual]</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=RetailOS&diff=22123 2025-06-21T04:39:24Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: /* Security */</p> <hr /> <div>The stock operating system running on non-iOS iPods. It runs everything from device drivers to the clickwheel user interface.<br /> <br /> == Naming ==<br /> <br /> The only 'official' name seems to be 'retailOS', found in the [[Nano 3G]] WTF. It is also referred to as 'osos' per the file name in the resource partition of the firmware bundle.<br /> <br /> == Architecture ==<br /> <br /> retailOS is a small, embedded, single-user, single-binary, real time operating system. With time it acquire more and more complex functionality, like PowerVR drivers and being able to load external applications ('eApps') which are used for games.<br /> <br /> The core of the system is based on RTXC 3.2, with the end-user interface based on intellectual property from a company called Pixo. &lt;ref&gt;https://web.archive.org/web/20230224105131/https://twitter.com/johnwhitley/status/1451952369248264201&lt;/ref&gt;<br /> <br /> == Security ==<br /> <br /> As evidenced by the success of the [[Notes vulnerability]] and [[ipod_sun]], retailOS has no security hardening, and in fact all processes, including games, seem to be running in ARM system mode.<br /> <br /> === Boot chain ===<br /> <br /> retailOS is loaded by the second-stage bootloader (stored on NOR/NAND depending on the device generation), from NAND into DRAM.<br /> <br /> While other stages of the boot chain (eg. the bootloader, WTF mode in newer devices, the diagnostics tool) are based around EFI firmware volumes and an EFI runtime, retailOS is a single binary blob without any built-in modularity.<br /> <br /> === eApp Signing ===<br /> <br /> Not yet documented fully. Each game seems to ship with a Manifest.plist.p7p which is a PKCS#7 signature for the main Manifest.plist.<br /> <br /> == Options ==<br /> <br /> We have found some 'secret' options that can be set by creating specially named files. See [[RetailOS_Options|Options]].<br /> <br /> == Analysis / Memory Layout ==<br /> <br /> Loading RetailOS correctly into a decompiler/disassembler is tricky, as the contents of the IMG1 image are a binary blob which self-relocates to the correct places in memory.<br /> <br /> These are the memory segments within RetailOS that we know of (at least on Nano 5G):<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Name !! Marker !! Location in memory !! Description<br /> |-<br /> | sram.text || n/a || SRAM 0x22000000 || SRAM-resident code, most of RTXC lives here.<br /> |-<br /> | sram.bss || n/a || SRAM 0x22030000 || SRAM-resident zero data.<br /> |-<br /> | sram.data || n/a || SRAM 0x22030000 + sram_bss_size || SRAM-resident data.<br /> |-<br /> | dram.textdata || hibe || DRAM 0x08000000 || Combined .text and .data which lives in DRAM. Bulk of code lives here.<br /> |-<br /> | dram.frameworks || miscTBD || DRAM 0x08000000 + dram_textdata_size || 'Framework' system of some kind, interfaces used by eApps.<br /> |-<br /> | dram.bss || n/a || DRAM 0x08000000 + dram_textdata_size + dram_frameworks_size || DRAM-resident zero data.<br /> |}<br /> <br /> And here's how the segments are built up within the RetailOS binary blob:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Address !! Name !! Size<br /> |-<br /> | Start || sram.text || sram_text_size<br /> |-<br /> | || sram.bss || sram_bss_size<br /> |-<br /> | || sram.data || sram_data_size<br /> |-<br /> | || dram.text || dram_text_size<br /> |-<br /> | End || dram.frameworks || dram_frameworks_size<br /> |}<br /> <br /> (yes, the firmware blob ships a sram.bss physically in the file)<br /> <br /> So the goal to be able to load the binary is to figure out the segment sizes and then load them into a decompiler/disassembler. <br /> <br /> Here, we'll show how to figure out the segment sizes for N5G. First, load the RetailOS body (without the header!) at 0x22000000 in a decompiler. We load it there (intead of into DRAM as it is done on the device) as the stub relocates to this address first by performing the SRAM .text/.data copies very early in the process, and the code is position independent for only a short time.<br /> <br /> Then, look at the start function (follow the reset vector):<br /> <br /> &lt;pre&gt;<br /> void start(void) { // 0x2200505c<br /> offs = relocation_offset();<br /> /* ... peeks/pokes to bus matrix periph at 0x3ff00000 ... */<br /> if (offs != 0) {<br /> relocate(offs);<br /> }<br /> (*0x22000000) = 0xea000007;<br /> zero_bss();<br /> }<br /> &lt;/pre&gt;<br /> <br /> relocation_offset will return 0 if the stub is already at 0x22000000, so will return 0 for the way we've loaded it. On a real device, this will be 0x22000000 - 0x08000000 ==<br /> 0x1a000000, as the real device loads RetailOS into DRAM first. Thus, relocate() will be called:<br /> <br /> &lt;pre&gt;<br /> void relocate(int offs) { // 0x22005ec8<br /> int iVar1 = -offs;<br /> void *blob_start = iVar1 + 0x22000000;<br /> memmove(0x22000000, blob_start, 0xe27c); // copy sram.text<br /> memzero(0x22000000 + 0xe27c, 0xbc4); // zero out sram.bss within blob<br /> memmove(0x22030000, 0x22000000 + 0xe27c + iVar1, 0x20000); // copy sram.bss + sram.data<br /> jump_offset(offs);<br /> memmove(0x08000000, 0x22000000 + 0xe27c + 0x20000 + iVar1, 0x6c3768); // copy dram.textdata<br /> memmove(0x08000000 + 0x6c3768, iVar1 + 0x22000000 + 0xe27c + 0x20000 + 0x6c3768), 0xc40); // copy dram.frameworks<br /> start();<br /> return;<br /> }<br /> &lt;/pre&gt;<br /> <br /> The above listing shows reconstituted address calculations - in a plain decompilation, all the additions will of course be simplified to a single constant. But you should be able to figure out the following:<br /> <br /> # sram_text_size is 0xe27c<br /> # sram_bss_size is 0xbc4<br /> # sram_bss_size + sram_data_size is 0x20000<br /> # dram_textdata_size is 0x6c3768<br /> # dram_frameworks_size is 0xc40<br /> <br /> Then, in zero_bss we can find the size of dram.bss:<br /> <br /> &lt;pre&gt;<br /> void zero_bss(void) { // 0x22005fec<br /> memzero(0x2200e27c, 0xbc4); // zero out sram.bss<br /> // inlined memzero:<br /> void *start = 0x08000000 + 0x6c3768 + 0xc40;<br /> int size = 0x790a84;<br /> // ...<br /> }<br /> &lt;/pre&gt;<br /> <br /> From which we can figure out that the dram.bss segment size is 0x790a84.<br /> <br /> Thus we can load the file like so (combining sram.bss and sram.data) into a 'clean' decompiler/disassembler session:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Name !! Memory Address !! File Offset<br /> |-<br /> | sram.text || 0x22000000 || 0x00000000<br /> |-<br /> | sram.bssdata || 0x22030000 || 0x0000e27c<br /> |-<br /> | dram.textdata || 0x08000000 || 0x0002e27c (0xe27c + 0x20000)<br /> |-<br /> | dram.frameworks || 0x086c3768 || 0x006f19e4 (0xe27c + 0x20000 + 0x6c3768)<br /> |-<br /> | dram.bss || 0x086c43a || n/a (0x790a84 zeroes)<br /> |}<br /> <br /> Writing an automated converter into ELF from arbitrary RetailOS blobs is an exercise left to the reader.<br /> <br /> == RTXC == <br /> <br /> === Documentation ===<br /> <br /> This seems to be the best public document available about RTXC 3.2: [https://web.archive.org/web/20230218212424/https://datasheet.datasheetarchive.com/originals/library/Datasheets-AS2/DSAAXSA0003458.pdf DSAAXSA0003458.pdf]. It contains example code for most services, but unfortunately is still missing any structure definitions.<br /> <br /> There's also some training slides available: [https://ia801800.us.archive.org/26/items/manualzilla-id-5752851/5752851.pdf 5752851.pdf]. These introduce the general architecture and concept of RTXC 3.2. <br /> <br /> === Services / Syscalls ===<br /> <br /> While RTXC documentation speaks mostly of 'kernel services' (which are defined as C function signatures/symbols), we like to talk about 'syscalls' and 'syscall numbers' when reverse engineering retailOS. All service functions go through a central dispatch function and that's the easiest point to start reverse engineering the kernel service interface.<br /> <br /> The dispatcher receives a saved caller state which contains a pointer to a serialized syscall request in its saved R0. The syscall request is a trivial structure containing a syscall number and arguments. The dispatcher is executed with interrupts enabled (and thus is non-preemptable) and performs actual work on kernel structures. There is no privilege-granting 'gate' mechanism, all caller code is just as privileged as the kernel code.<br /> <br /> Service functions in turn prepare the syscall request structure (including syscall number), and then call an intermediary state saving function which then calls the dispatcher after disabling interrupts. Some syscall numbers are used by multiple service functions, with some extra arguments in the request being used to decide on the behaviour of the service call (eg. blocking/nonblocking).<br /> <br /> The following table comes from cross-referencing retailOS, publicly available RTXC PDFs and publicly availble RTXC binaries with debug symbols.<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Name !! Number !! Description<br /> |-<br /> | &lt;code&gt;void KS_pend(SEMA sema)&lt;/code&gt; || 0x03 || Semaphore DONE -&gt; PENDING.<br /> |-<br /> | &lt;code&gt;RTXCMSG *KS_receive(MBOX mailbox, TASK task)&lt;/code&gt; || 0x05 || Receive from mailbox.<br /> |-<br /> | &lt;code&gt;KSRC KS_enqueue[w](QUEUE queue, void *entry)&lt;/code&gt; || 0x0c || Push into FIFO (and block if full with 'w' variant).<br /> |-<br /> | &lt;code&gt;void KS_dequeue[w](QUEUE queue, void *dest)&lt;/code&gt; || 0x0d || Pop from FIFO (and block if empty with 'w' variant).<br /> |-<br /> | &lt;code&gt;KSRC KS_lock(RESOURCE resource)&lt;/code&gt; || 0x0e || Lock a resource.<br /> |-<br /> | &lt;code&gt;KSRC KS_lockt(RESOURCE resource, TICKS timoeut)&lt;/code&gt; || 0x0e || Lock a resource with timeout.<br /> |-<br /> | &lt;code&gt;KSRC KS_unlock(RESOURCE resource)&lt;/code&gt; || 0x0f || Unlock an owned resource.<br /> |-<br /> | &lt;code&gt;CLKBLK *KS_alloc_timer(void)&lt;/code&gt; || 0x10 || Allocate next free timer from pool.<br /> |-<br /> | &lt;code&gt;CLKBLK *KS_start_timer(CLKBLK *timer, TICKS initial_period, TICKS cycle_time, SEMA sema)&lt;/code&gt; || 0x12 || Start timer.<br /> |-<br /> | &lt;code&gt;KSRC KS_stop_timer(CLKBLK *timer)&lt;/code&gt; || 0x13 || Stop timer.<br /> |-<br /> | &lt;code&gt;void KS_delay(TASK task, TICKS period)&lt;/code&gt; || 0x14 || Block specified task for a period of time.<br /> |-<br /> | &lt;code&gt;void KS_execute(TASK task)&lt;/code&gt; || 0x15 || Start a task from its beginning address.<br /> |-<br /> | &lt;code&gt;KSRC KS_deftask(TASK task, PRIORITY priority, char *stack, size_t stacksize, void (*entry)(void))&lt;/code&gt; || 0x16 || Define the attributes of an inactive task.<br /> |-<br /> | &lt;code&gt;TASK KS_alloc_task(void)&lt;/code&gt; || 0x17 || Allocate the next available Task Control Block from the pool of free TCBs. <br /> |-<br /> | &lt;code&gt;void KS_terminate(TASK task)&lt;/code&gt; || 0x18 || Stop a task by setting it to INACTIVE.<br /> |-<br /> | &lt;code&gt;void KS_suspend(TASK task)&lt;/code&gt; || 0x19 || Suspend a task until resumed or re-executed.<br /> |-<br /> | &lt;code&gt;void KS_defpriority(TASK task, PRIORITY priority)&lt;/code&gt; || 0x1b || Define or set priority of task.<br /> |-<br /> | &lt;code&gt;void KS_yield(void)&lt;/code&gt; || 0x1c || Voluntary release of control to any other task of the same priority.<br /> |-<br /> | &lt;code&gt;SEMA KS_waitm(SEMA *semalist)&lt;/code&gt; || 0x22 || Wait on multiple semaphores.<br /> |-<br /> | &lt;code&gt;time_t KS_inqtime(void)&lt;/code&gt; || 0x24 || Get current time-of-day.<br /> |-<br /> | &lt;code&gt;void KS_deftime(time_t time)&lt;/code&gt; || 0x25 || Set current time-of-day.<br /> |-<br /> | &lt;code&gt;TASK KS_inqres(RESOURCE resource)&lt;/code&gt; || 0x26 || Get owner of resource.<br /> |-<br /> | &lt;code&gt;KSRC KS_defres(RESOURCE resource, RESATTR condition)&lt;/code&gt; || 0x27 || Define priority inversion on resource.<br /> |-<br /> | &lt;code&gt;void *KS_inqtask_arg(TASK task)&lt;/code&gt; || 0x28 || Get environment arguments of task.<br /> |-<br /> | &lt;code&gt;void KS_deftask_arg(TASK task, void *arg)&lt;/code&gt; || 0x29 || Set environment arguments for task.<br /> |-<br /> | &lt;code&gt;KSRC KS_defqueue(QUEUE queue, size_t width, int depth, void *body, int currsize)&lt;/code&gt; || 0x2e || Define queue.<br /> |-<br /> | &lt;code&gt;int KS_user(int (*func) (void *), void *arg)&lt;/code&gt; || 0x30 || Execute function as if it were kernel service.<br /> |}<br /> <br /> The RTXC memory allocation facilities (&lt;code&gt;KS_alloc/free/create_part/alloc_part/defpart/free_part&lt;/code&gt;) are ''not'' used by retailOS and not built into the service dispatcher, at least on [[Nano 5G]].<br /> <br /> === Semaphores ===<br /> <br /> The following semaphores are defined in the [[Nano 3G]] retailOS:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Number !! Name !! Description<br /> |-<br /> | 0x01 || &lt;code&gt;S_FW_PWR_CHANGE&lt;/code&gt; || <br /> |-<br /> | 0x02 || &lt;code&gt;S_BAT_PWR_CHANGE&lt;/code&gt; || <br /> |-<br /> | 0x03 || &lt;code&gt;S_USB_PWR_CHANGE&lt;/code&gt; || <br /> |-<br /> | 0x04 || &lt;code&gt;S_CNA_CHANGE&lt;/code&gt; || <br /> |-<br /> | 0x05 || &lt;code&gt;S_WHEEL_CHANGE&lt;/code&gt; || <br /> |-<br /> | 0x06 || &lt;code&gt;S_DISKMGRQ&lt;/code&gt; || <br /> |-<br /> | 0x07 || &lt;code&gt;S_TOPPLUG_SWITCH&lt;/code&gt; || <br /> |-<br /> | 0x08 || &lt;code&gt;S_RTCTIMERMGR&lt;/code&gt; || <br /> |-<br /> | 0x09 || &lt;code&gt;S_ALARM_01&lt;/code&gt; || <br /> |-<br /> | 0x0a || &lt;code&gt;S_ALARM_02&lt;/code&gt; || <br /> |-<br /> | 0x0b || &lt;code&gt;S_ALARM_03&lt;/code&gt; || <br /> |-<br /> | 0x0c || &lt;code&gt;S_WATCHDOG&lt;/code&gt; || <br /> |-<br /> | 0x0d || &lt;code&gt;S_CPUMGRQ&lt;/code&gt; || <br /> |-<br /> | 0x0e || &lt;code&gt;S_PCFPOWERMGR&lt;/code&gt; || <br /> |-<br /> | 0x0f || &lt;code&gt;S_POWER_STATE_AC&lt;/code&gt; || <br /> |-<br /> | 0x10 || &lt;code&gt;S_CGR_STATE_TMR&lt;/code&gt; || <br /> |-<br /> | 0x11 || &lt;code&gt;S_DEEPSLEEP&lt;/code&gt; || <br /> |-<br /> | 0x12 || &lt;code&gt;S_ALARM_DONE&lt;/code&gt; || <br /> |-<br /> | 0x13 || &lt;code&gt;S_PIEZOMGR&lt;/code&gt; || <br /> |-<br /> | 0x14 || &lt;code&gt;S_PIEZOMGRSNDR&lt;/code&gt; || <br /> |-<br /> | 0x15 || &lt;code&gt;S_PIEZODONE&lt;/code&gt; || <br /> |-<br /> | 0x16 || &lt;code&gt;S_ACCPOWER&lt;/code&gt; || <br /> |-<br /> | 0x17 || &lt;code&gt;S_ACC_REINIT&lt;/code&gt; || <br /> |-<br /> | 0x18 || &lt;code&gt;S_TOPPLUGSENSER&lt;/code&gt; || <br /> |-<br /> | 0x19 || &lt;code&gt;S_TOPPLUGCHANGE&lt;/code&gt; || <br /> |-<br /> | 0x1a || &lt;code&gt;S_BTMCONNECT&lt;/code&gt; || <br /> |-<br /> | 0x1b || &lt;code&gt;S_BTMPLUGCHANGE&lt;/code&gt; || <br /> |-<br /> | 0x1c || &lt;code&gt;S_BTMREVERIFY&lt;/code&gt; || <br /> |-<br /> | 0x1d || &lt;code&gt;S_BTMREVERTIMED&lt;/code&gt; || <br /> |-<br /> | 0x1e || &lt;code&gt;S_BTMVERCOMP&lt;/code&gt; || <br /> |-<br /> | 0x1f || &lt;code&gt;S_TOPACCPKTRCVD&lt;/code&gt; || <br /> |-<br /> | 0x20 || &lt;code&gt;S_BTMACCPKTRCVD&lt;/code&gt; || <br /> |-<br /> | 0x21 || &lt;code&gt;S_SERIALIDRCVD&lt;/code&gt; || <br /> |-<br /> | 0x22 || &lt;code&gt;S_UARTATXEMPTY&lt;/code&gt; || <br /> |-<br /> | 0x23 || &lt;code&gt;S_UARTBTXEMPTY&lt;/code&gt; || <br /> |-<br /> | 0x24 || &lt;code&gt;S_HDDSCANCOMP&lt;/code&gt; || <br /> |-<br /> | 0x25 || &lt;code&gt;S_BL_ON&lt;/code&gt; || <br /> |-<br /> | 0x26 || &lt;code&gt;S_BL_OFF&lt;/code&gt; || <br /> |-<br /> | 0x27 || &lt;code&gt;S_BL_RAMPDOWN&lt;/code&gt; || <br /> |-<br /> | 0x28 || &lt;code&gt;S_BL_RAMPUP&lt;/code&gt; || <br /> |-<br /> | 0x29 || &lt;code&gt;S_BL_TIMESUP&lt;/code&gt; || <br /> |-<br /> | 0x2a || &lt;code&gt;S_BATT_TIMESUP&lt;/code&gt; || <br /> |-<br /> | 0x2b || &lt;code&gt;S_BATT_AC_PWR&lt;/code&gt; || <br /> |-<br /> | 0x2c || &lt;code&gt;S_BATT_TMR_RST&lt;/code&gt; || <br /> |-<br /> | 0x2d || &lt;code&gt;S_GRAPHMGR&lt;/code&gt; || <br /> |-<br /> | 0x2e || &lt;code&gt;S_VBL&lt;/code&gt; || <br /> |-<br /> | 0x2f || &lt;code&gt;S_DTVRECOVERY&lt;/code&gt; || <br /> |-<br /> | 0x30 || &lt;code&gt;S_CM_HEADPHONE&lt;/code&gt; || <br /> |-<br /> | 0x31 || &lt;code&gt;S_CM_EXTPOWER&lt;/code&gt; || <br /> |-<br /> | 0x32 || &lt;code&gt;S_CM_ACCATTACHED&lt;/code&gt; || <br /> |-<br /> | 0x33 || &lt;code&gt;S_CM_DAC_SETUP&lt;/code&gt; || <br /> |-<br /> | 0x34 || &lt;code&gt;S_ATAWRKLPRDY&lt;/code&gt; || <br /> |-<br /> | 0x35 || &lt;code&gt;S_RTXCBUG&lt;/code&gt; || <br /> |-<br /> | 0x36 || &lt;code&gt;S_BLOCKDEVICE&lt;/code&gt; || <br /> |-<br /> | 0x37 || &lt;code&gt;S_BLOCKDEVICEQ&lt;/code&gt; || <br /> |-<br /> | 0x38 || &lt;code&gt;S_DISPLAY&lt;/code&gt; || <br /> |-<br /> | 0x39 || &lt;code&gt;S_ARB_READY&lt;/code&gt; || <br /> |-<br /> | 0x3a || &lt;code&gt;S_I2C_DONE&lt;/code&gt; || <br /> |-<br /> | 0x3b || &lt;code&gt;S_VSYNC&lt;/code&gt; || <br /> |}<br /> <br /> There are three more semaphores (0x3c, 0x3d, 0x3e) that have no name defined and are likely unused. Anything 0x3f and up is a 'Dynamic' semaphore defined at runtime (which we haven't reversed yet).<br /> <br /> === Queues ===<br /> <br /> The following queues are defined in the [[Nano 3G]] retailOS:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Number !! Name !! Description<br /> |-<br /> | 0x01 || PIXORESQ ||<br /> |-<br /> | 0x02 || PIXOSEMAQ ||<br /> |-<br /> | 0x03 || POSIXRESQ ||<br /> |-<br /> | 0x04 || POSIXSEMAQ ||<br /> |}<br /> <br /> === Mailboxes ===<br /> <br /> The following mailboxes are defined in the [[Nano 3G]] retailOS:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Number !! Name !! Description<br /> |-<br /> | 0x01 || M_DISKMGR ||<br /> |-<br /> | 0x02 || M_PIEZOMGR ||<br /> |-<br /> | 0x03 || M_GRAPHMGR ||<br /> |-<br /> | 0x04 || M_BLOCKDEVICE ||<br /> |-<br /> | 0x05 || M_DISPLAY ||<br /> |}<br /> <br /> === Resources ===<br /> <br /> The following lockable resources are defined in the [[Nano 3G]] retailOS:<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Number !! Name !! Description<br /> |-<br /> | 0x01 || GPIO_REG_WRITE ||<br /> |-<br /> | 0x02 || GPIO_INT_INIT ||<br /> |-<br /> | 0x03 || RTC_TIME_ADJUST ||<br /> |-<br /> | 0x04 || RTC_ALARM_ADJUST ||<br /> |-<br /> | 0x05 || I2C_MASTER ||<br /> |-<br /> | 0x06 || USB_GRANT ||<br /> |-<br /> | 0x07 || USB_RESP_INIT ||<br /> |-<br /> | 0x08 || USB_RESPONDER ||<br /> |-<br /> | 0x09 || DISKPWRMGRSEND ||<br /> |-<br /> | 0x0a || PIEZOMGRSEND ||<br /> |- <br /> | 0x0b || SERIALVERIFIER ||<br /> |-<br /> | 0x0c || RESISTORVERIFIER ||<br /> |-<br /> | 0x0d || FW_IRAM ||<br /> |-<br /> | 0x0e || ACCPOWER ||<br /> |-<br /> | 0x0f || UARTA ||<br /> |-<br /> | 0x10 || UARGB ||<br /> |-<br /> | 0x11 || PMU_LOCK ||<br /> |-<br /> | 0x12 || ADC_LOCK ||<br /> |-<br /> | 0x13 || DTV_ENC_INIT ||<br /> |-<br /> | 0x14 || BACKLIGHT ||<br /> |}<br /> <br /> == External links ==<br /> <br /> * [https://web.archive.org/web/19990220054659/http://www.rtxc.com/Products/RTXC/Services.htm RTXC Kernel Services (1999)]<br /> * [https://archive.org/details/manualzilla-id-5752851 RTXC 3.2 Training Manual]</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Modes&diff=22122 2025-06-21T04:29:47Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: redo modes page</p> <hr /> <div>At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting. <br /> <br /> ==Normal mode==<br /> &quot;Normal mode&quot; is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.<br /> <br /> ==Disk mode==<br /> In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text &quot;Do not disconnect.&quot; or a checkmark symbol with the text &quot;OK to disconnect.&quot; depending on whether the iPod is connected and if it has been ejected. <br /> <br /> Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]<br /> <br /> Disk mode is also referred to as &quot;forced disk mode&quot; in device information received from the iPod.<br /> <br /> The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the &quot;disk&quot; partition of the [[Firmware]]. <br /> <br /> ==DFU mode==<br /> [https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the iPod nano (3rd generation) and newer and the iPod classic (6th generation) and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].<br /> <br /> When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other [[IMG1]] images cannot be sent in this mode.<br /> <br /> The iPod nano (2nd generation) also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does support a NOR DFU mode that can be entered by holding down Back+Play right after rebooting the device.&lt;sup&gt;(clarification needed)&lt;/sup&gt;<br /> <br /> ==WTF mode==<br /> In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.<br /> <br /> The iTunes behavior upon seeing an iPod in WTF mode is to send it a &quot;recovery&quot; firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the &quot;osos&quot; partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].<br /> <br /> ==Diagnostic mode==<br /> This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot.&lt;sup&gt;(clarification needed)&lt;/sup&gt;<br /> <br /> ==USB IDs==<br /> When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in: <br /> {| class=&quot;wikitable&quot; <br /> |-<br /> ! colspan=&quot;2&quot; | Model<br /> ! Normal/disk mode<br /> ! DFU mode<br /> ! WTF mode<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (2nd generation)<br /> | 1260<br /> | 1220<br /> | 1240<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (3rd generation)<br /> | 1262<br /> | 1223/1224<br /> | 1242<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (4th generation)<br /> | 1263<br /> | 1225<br /> | 1243<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (5th generation)<br /> | 1265<br /> | 1231<br /> | 1246<br /> |-<br /> | colspan=&quot;2&quot; | iPod nano (6th generation)<br /> | 1266<br /> | 1232<br /> | 1248<br /> |-<br /> | rowspan=&quot;2&quot; | iPod nano (7th generation)<br /> | 2012<br /> | rowspan=&quot;2&quot; | 1267<br /> | rowspan=&quot;2&quot; | 1234<br /> | 1249<br /> |-<br /> | 2015<br /> | 124a<br /> |-<br /> | rowspan=&quot;3&quot; | iPod classic (6th generation)<br /> | rev. 1<br /> | rowspan=&quot;3&quot; | 1261<br /> | rowspan=&quot;3&quot; | 1223<br /> | 1241<br /> |-<br /> | rev. 2<br /> | 1245<br /> |-<br /> | rev. 3<br /> | 1247<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Main_Page&diff=22091 2024-08-20T00:11:09Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: remove duplicate text</p> <hr /> <div>__NOTOC__<br /> [[File:EmCORE_Nano2G_Nano4G_Classic.jpg|280px|thumb|right|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]]]<br /> This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [http://www.rockbox.org rockbox] or Linux. Freemyipod is a relaunch of [[Linux4nano]].<br /> <br /> == FAQ ==<br /> <br /> === What can I do with my iPod nano (2nd generation), iPod classic or older iPods? ===<br /> <br /> There's an upstream Rockbox port for these devices. Go use that.<br /> <br /> === What can I do with my iPod nano (3rd generation) or newer? ===<br /> <br /> Not much (yet) unless you're an embedded developer :).<br /> <br /> On the 3rd, 4th and 5th generation, we have a stable tethered exploit ([[wInd3x]]) which allows early, untethered and safe (no permanent modification) code execution. This in turn allows you to run [[U-Boot]] and an early [[Linux|Linux port]] or experiment with reverse-engineering/modifying the original firmware, [[retailOS]].<br /> <br /> On the 6th and 7th generation, a font parsing vulnerability (CVE-2010-1797) can be exploited with [[ipod_sun]].<br /> <br /> There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.<br /> <br /> == Getting an account ==<br /> Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].<br /> <br /> ==Updates==<br /> * {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the iPod nano 6th and 7th generation, is released.<br /> * {{#dateformat:2023-01-07}} - [https://social.hackerspace.pl/@q3k/109655916469636189 A preliminary U-Boot port to the Nano 5G has been developed.]<br /> * {{#dateformat:2022-01-04}} - The bootrom of iPod Nano 5G was successfully dumped, and is in the process of being reverse-engineered!<br /> * {{#dateformat:2021-12-31}} - An exploit named wInd3x, which exploits the latest vulnerability, is being prepared for Nano 4G and Nano 5G.<br /> * {{#dateformat:2021-12-27}} - A new vulnerability was discovered in iPod Nano 4G and Nano 5G bootrom, which allows arbitrary code execution!<br /> * {{#dateformat:2018-08-25}} - The website software has been updated to MediaWiki 1.31 after about 2 months of downtime.<br /> &lt;!--<br /> * {{#dateformat:2016-06-17}} - The freemyipod project is becoming deprecated, as parts of the code is slowly being integrated in Rockbox. It is likely that no future development on the freemyipod project will take place. Essential parts of emCORE helped building a Rockbox bootloader for iPod Classic, and any future development will take place in the Rockbox project.<br /> * {{#dateformat:2014-03-26}} - A bug that prevented [[emCORE]] installations on certain Windows configurations (getting stuck on &quot;Booting UBI file...&quot;), has been finally fixed! If the installation has failed for you before, you can retry it using the updated version of our tool (use the iTunes method for now).<br /> * {{#dateformat:2012-01-02}} - There have been some problems with the latest release. A hotfix release ([[EmCORE_Releases/r859|r859]]) has been published to fix some of these problems. iPod nano 2g users are advised to upgrade. See the [[EmCORE_Releases/r859|release details page]] for more information.<br /> * {{#dateformat:2012-01-01}} - A new release &lt;s&gt;([[EmCORE_Releases/r855|r855]])&lt;/s&gt; is out! It includes a couple of new features, several bugfixes and a new bootmenu theme! More information on the &lt;s&gt;[[EmCORE_Releases/r855|release details page]]&lt;/s&gt;.<br /> * {{#dateformat:2011-04-25}} - The [[emCORE]] kernel now runs on the iPod Touch 2G as well, thanks to the help of kleemajo. This is of course not a fully functional port yet, but we'll see how it continues. It's about the same state as the iPod Nano 4G now. /7<br /> * {{#dateformat:2011-03-25}} - [[emCORE]] is replacing [[emBIOS]] completely now. Therefore [[emBIOS]] will be deprecated software as of now! All emBIOS users are advised to upgrade to emCORE including people using iLoader 0.2.2 or less. More detailed update instructions will follow!<br /> * {{#dateformat:2011-01-08}} - The Rockbox port for the iPod Classic is slowly getting usable. Most of the blocking issues have been fixed. The first-generation 160GB model still doesn't work, and some people are experiencing slightly garbled display contents.<br /> * {{#dateformat:2011-01-04}} - There is an early Rockbox port for the iPod Classic! It still isn't quite usable, playback stutters etc., but if you want to play around with it, here are some quick'n'dirty notes on the installation procedure: [[IPod Classic iLoader Installation]]<br /> * {{#dateformat:2010-11-22}} - We now have emBIOS support for the iPod classic 1g, the others might follow soon<br /> * {{#dateformat:2010-08-29}} - We're proud to announce the release of [[emBIOS]] v0.1.0 and [[iLoader]] v0.2.0!<br /> * {{#dateformat:2010-08-26}} - [[iLoader]], its installer and uninstaller all have been fully ported to [[emBIOS]] now. A beta release will be coming soon!<br /> * {{#dateformat:2010-08-13}} - [[emBIOS]] is continually being improved and the next step is porting tools like [[iLoader]] to use it.<br /> * {{#dateformat:2010-08-06}} - The wiki has now been moved to www.freemyipod.org<br /> * {{#dateformat:2010-08-05}} - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [http://websvn.freemyipod.org/listing.php?repname=freemyipod&amp;path=/embios/ here]<br /> * {{#dateformat:2010-08-03}} - We can now access the Nano 4G accelerometer.<br /> * {{#dateformat:2010-08-02}} - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].<br /> * {{#dateformat:2010-08-01}} - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.<br /> * {{#dateformat:2010-07-27}} - The server got zapped by lightning but a new one was up and running within a day.<br /> * {{#dateformat:2010-02-23}} - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!<br /> * {{#dateformat:2009-11-01}} - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]<br /> --&gt;<br /> Follow [http://twitter.com/freemyipod our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [[ Special:Code/freemyipod|SVN activity ]] page for the latest changes to our source code.<br /> <br /> {| cellspacing=&quot;3&quot; width=&quot;100%&quot;<br /> |- valign=&quot;top&quot;<br /> |style=&quot;border: 1px dashed #c6c9ff; background-color: #f0f0ff&quot;|<br /> ===Project info===<br /> * [[ Status ]]<br /> * [[ Contact ]]<br /> * [[ Contributing ]]<br /> <br /> ===Released Software===<br /> * [[wInd3x]]<br /> * [[ipod_sun]]<br /> * [[U-Boot|U-Boot port]]<br /> * [[Linux|Linux port]]<br /> * Legacy:<br /> ** [[iBugger]]<br /> ** [[iLoader]]<br /> ** [[emCORE]]<br /> <br /> |style=&quot;border: 1px dashed #c6c9ff; background-color: #f0f0ff&quot;|<br /> <br /> ===Basic skills===<br /> * [[Working with binaries]]<br /> * [[Dumping firmware]]<br /> * [[Extracting firmware]]<br /> * [[Firmware downgrading]]<br /> * [[Troubleshooting]]<br /> <br /> ===Reverse engineering results===<br /> * [[Firmware]]<br /> ** [[Bootrom]]<br /> ** [[Boot Process]]<br /> ** [[Firmware decryption]]<br /> ** [[FTL|Flash Translation Layer]]<br /> ** [[RetailOS]]<br /> *** [[RetailOS Options]]<br /> * [[GUID table]]<br /> * [[JTAG]]<br /> * Nano 2G<br /> ** [[Nano2G clock gates‎]]<br /> ** [[Nano2G LCD init]]<br /> ** [[Nano2G HW analysis]]<br /> ** [[S5L8701 analysis]]<br /> * Nano 4G<br /> ** [[Nano4G firmware upgrade process]]<br /> * Nano 5G<br /> ** [[Nano 5G|General]]<br /> <br /> ===Other guides===<br /> * [[Modes]]<br /> |style=&quot;border: 1px dashed #c6c9ff; background-color: #f0f0ff&quot;|<br /> ===Hardware===<br /> * [[Hardware]]<br /> ** [[Nano 1G]]<br /> ** [[Nano 2G]]<br /> ** [[Nano 3G]]<br /> ** [[Nano 4G]]<br /> *** [[920-0614-03]]<br /> ** [[Nano 5G]]<br /> ** [[Nano 6G]]<br /> ** [[Nano 7G]]<br /> ** [[Classic 1G]]<br /> ** [[Classic 2G]]<br /> ** [[Classic 3G]]<br /> * [[Chronology]]<br /> * [[S5L8700 datasheet]]<br /> <br /> ===Exploiting===<br /> * [[wInd3x]]<br /> * [[Pwnage 2.0]]<br /> * [[Notes vulnerability]]<br /> ** [[Address bruteforcing]]<br /> ** [[Nanotron 3000]]<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=WInd3x&diff=22090 2024-08-04T23:55:31Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: lowercase display title</p> <hr /> <div>== wInd3x Vulnerability ==<br /> {{DISPLAYTITLE:wInd3x}}<br /> <br /> A [[S5L8720 Bootrom|Bootrom]] vulnerability discovered and exploited by [[User:Q3k|q3k]] in December 2021. It allows code execution in the bootrom over USB.<br /> <br /> === Affected Devices ===<br /> <br /> {| class=&quot;wikitable&quot;<br /> |-<br /> ! Device/SoC !! Vulnerable? !! Exploited?<br /> |-<br /> | [[Nano 3G]] || Yes || Yes<br /> |-<br /> | [[Nano 4G]] || Yes || Yes<br /> |-<br /> | [[Nano 5G]] || Yes || Yes<br /> |-<br /> | [[Nano 6G]] || No || <br /> |-<br /> | [[Nano 7G]] || No || <br /> |-<br /> | Classic “6G” || Yes || Yes<br /> |-<br /> | iPhone || ? ||<br /> |-<br /> | iPhone 3G || Yes || No<br /> |}<br /> <br /> === Running / Usage ===<br /> <br /> wInd3x currently allows you to:<br /> <br /> # Decrypt [[IMG1]] files, like [[OSOS]] or the bootloader/[[WTF]]/...<br /> # Access arbitrary memory and experiment with peripherals<br /> # Run unsigned DFU payloads<br /> # Run an unsigned [[OSOS]] or [[U-Boot]] by first running an automatically patched [[WTF]].<br /> <br /> For guides, see [https://github.com/freemyipod/wInd3x github.com/freemyipod/wInd3x]<br /> <br /> === Vulnerability ===<br /> <br /> This exploits a vulnerability in the standard SETUP packet parsing code of the bootrom, in which the wIndex parameter is not checked for bmRequest == {0x20, 0x40}, but is still used to index an array of interface/class handlers (that in the Bootrom has a length of 1).<br /> <br /> ==== Nano 4G and 5G Exploit Chain ====<br /> <br /> The first requirement is to find a suitable (blx r0) instruction in the bootrom code of the device. For Nano 4G the only one such instruction is at offset 0x3b0, and for Nano 5G there is such instruction at 0x37c. We'll refer to it as X below.<br /> <br /> We abuse the fact that wIndex == 3 for bmRequest 0x40 treats a 'bytes left to sent over USB' counter as a function pointer and calls it with r0 == address of SETUP. We massage the DFU mode into attempting to send us X+0x40 bytes, and failing after 0x40 bytes, thereby leaving the counter at X bytes and executing code at address X.<br /> <br /> Since the bootrom is mapped at offset 0x0 as well as 0x20000000 at boot, this means we execute bootrom code, and X happens to point to a 'blx r0' instruction. This in turn causes the CPU to interpret the SETUP packet received as ARM code, because the SETUP handler is called with the SETUP packet as its argument, i.e. r0.<br /> <br /> We specially craft the SETUP packet to be a valid ARM branch instruction, pointing somewhere into a temporary DFU image buffer. By first sending a payload as a partial DFU image (aborting before causing a MANIFEST), we finally get up to be able to execute either 0x800 on Nano 4G or 0x400 on Nano 5G bytes of fully user controlled code.<br /> <br /> In that payload, we send a stub which performs some runtime changes to the DFU's data structures to a) return a different product string b) overwrite an image verification vtable entry with a function that allows unsigned images. Some SRAM is carved out by this pay<br /> <br /> ==== Nano 3G and Classic (”6G”) ====<br /> <br /> With bRequestType == 0x20 and wIndex == 6 we directly jump to code execution at the SETUP packet.<br /> <br /> This Bootroom does not have a VTable which can be easily hooked to override functions to provide Haxed DFU functionality. However, an 'OnImage' function pointer is present in the State structure, which we override with our own code (copied to carved out SRAM). This code reimplements the bare minimum of the hooked function, without calling any decryption/verification code on the header/body.</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Main_Page&diff=22089 2024-08-04T04:58:50Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: rework :3</p> <hr /> <div>__NOTOC__<br /> [[File:EmCORE_Nano2G_Nano4G_Classic.jpg|280px|thumb|right|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]]]<br /> This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [http://www.rockbox.org rockbox] or Linux. Freemyipod is a relaunch of [[Linux4nano]].<br /> <br /> == FAQ ==<br /> <br /> === What can I do with my iPod nano (2nd generation), iPod classic or older iPods? ===<br /> <br /> There's an upstream Rockbox port for these devices. Go use that.<br /> <br /> === What can I do with my iPod nano (3rd generation) or newer? ===<br /> <br /> Not much (yet) unless you're an embedded developer :).<br /> <br /> On the 3rd, 4th and 5th generation, we have a stable tethered exploit ([[wInd3x]]) which allows early, untethered and safe (no permanent modification) code execution on Nano 3G-5G. This in turn allows you to run [[U-Boot]] and an early [[Linux|Linux port]] or experiment with reverse-engineering/modifying the original firmware, [[retailOS]].<br /> <br /> On the 6th and 7th generation, a font parsing vulnerability (CVE-2010-1797) can be exploited with [[ipod_sun]].<br /> <br /> There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.<br /> <br /> == Getting an account ==<br /> Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].<br /> <br /> ==Updates==<br /> * {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the iPod nano 6th and 7th generation, is released.<br /> * {{#dateformat:2023-01-07}} - [https://social.hackerspace.pl/@q3k/109655916469636189 A preliminary U-Boot port to the Nano 5G has been developed.]<br /> * {{#dateformat:2022-01-04}} - The bootrom of iPod Nano 5G was successfully dumped, and is in the process of being reverse-engineered!<br /> * {{#dateformat:2021-12-31}} - An exploit named wInd3x, which exploits the latest vulnerability, is being prepared for Nano 4G and Nano 5G.<br /> * {{#dateformat:2021-12-27}} - A new vulnerability was discovered in iPod Nano 4G and Nano 5G bootrom, which allows arbitrary code execution!<br /> * {{#dateformat:2018-08-25}} - The website software has been updated to MediaWiki 1.31 after about 2 months of downtime.<br /> &lt;!--<br /> * {{#dateformat:2016-06-17}} - The freemyipod project is becoming deprecated, as parts of the code is slowly being integrated in Rockbox. It is likely that no future development on the freemyipod project will take place. Essential parts of emCORE helped building a Rockbox bootloader for iPod Classic, and any future development will take place in the Rockbox project.<br /> * {{#dateformat:2014-03-26}} - A bug that prevented [[emCORE]] installations on certain Windows configurations (getting stuck on &quot;Booting UBI file...&quot;), has been finally fixed! If the installation has failed for you before, you can retry it using the updated version of our tool (use the iTunes method for now).<br /> * {{#dateformat:2012-01-02}} - There have been some problems with the latest release. A hotfix release ([[EmCORE_Releases/r859|r859]]) has been published to fix some of these problems. iPod nano 2g users are advised to upgrade. See the [[EmCORE_Releases/r859|release details page]] for more information.<br /> * {{#dateformat:2012-01-01}} - A new release &lt;s&gt;([[EmCORE_Releases/r855|r855]])&lt;/s&gt; is out! It includes a couple of new features, several bugfixes and a new bootmenu theme! More information on the &lt;s&gt;[[EmCORE_Releases/r855|release details page]]&lt;/s&gt;.<br /> * {{#dateformat:2011-04-25}} - The [[emCORE]] kernel now runs on the iPod Touch 2G as well, thanks to the help of kleemajo. This is of course not a fully functional port yet, but we'll see how it continues. It's about the same state as the iPod Nano 4G now. /7<br /> * {{#dateformat:2011-03-25}} - [[emCORE]] is replacing [[emBIOS]] completely now. Therefore [[emBIOS]] will be deprecated software as of now! All emBIOS users are advised to upgrade to emCORE including people using iLoader 0.2.2 or less. More detailed update instructions will follow!<br /> * {{#dateformat:2011-01-08}} - The Rockbox port for the iPod Classic is slowly getting usable. Most of the blocking issues have been fixed. The first-generation 160GB model still doesn't work, and some people are experiencing slightly garbled display contents.<br /> * {{#dateformat:2011-01-04}} - There is an early Rockbox port for the iPod Classic! It still isn't quite usable, playback stutters etc., but if you want to play around with it, here are some quick'n'dirty notes on the installation procedure: [[IPod Classic iLoader Installation]]<br /> * {{#dateformat:2010-11-22}} - We now have emBIOS support for the iPod classic 1g, the others might follow soon<br /> * {{#dateformat:2010-08-29}} - We're proud to announce the release of [[emBIOS]] v0.1.0 and [[iLoader]] v0.2.0!<br /> * {{#dateformat:2010-08-26}} - [[iLoader]], its installer and uninstaller all have been fully ported to [[emBIOS]] now. A beta release will be coming soon!<br /> * {{#dateformat:2010-08-13}} - [[emBIOS]] is continually being improved and the next step is porting tools like [[iLoader]] to use it.<br /> * {{#dateformat:2010-08-06}} - The wiki has now been moved to www.freemyipod.org<br /> * {{#dateformat:2010-08-05}} - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [http://websvn.freemyipod.org/listing.php?repname=freemyipod&amp;path=/embios/ here]<br /> * {{#dateformat:2010-08-03}} - We can now access the Nano 4G accelerometer.<br /> * {{#dateformat:2010-08-02}} - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].<br /> * {{#dateformat:2010-08-01}} - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.<br /> * {{#dateformat:2010-07-27}} - The server got zapped by lightning but a new one was up and running within a day.<br /> * {{#dateformat:2010-02-23}} - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!<br /> * {{#dateformat:2009-11-01}} - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]<br /> --&gt;<br /> Follow [http://twitter.com/freemyipod our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [[ Special:Code/freemyipod|SVN activity ]] page for the latest changes to our source code.<br /> <br /> {| cellspacing=&quot;3&quot; width=&quot;100%&quot;<br /> |- valign=&quot;top&quot;<br /> |style=&quot;border: 1px dashed #c6c9ff; background-color: #f0f0ff&quot;|<br /> ===Project info===<br /> * [[ Status ]]<br /> * [[ Contact ]]<br /> * [[ Contributing ]]<br /> <br /> ===Released Software===<br /> * [[wInd3x]]<br /> * [[ipod_sun]]<br /> * [[U-Boot|U-Boot port]]<br /> * [[Linux|Linux port]]<br /> * Legacy:<br /> ** [[iBugger]]<br /> ** [[iLoader]]<br /> ** [[emCORE]]<br /> <br /> |style=&quot;border: 1px dashed #c6c9ff; background-color: #f0f0ff&quot;|<br /> <br /> ===Basic skills===<br /> * [[Working with binaries]]<br /> * [[Dumping firmware]]<br /> * [[Extracting firmware]]<br /> * [[Firmware downgrading]]<br /> * [[Troubleshooting]]<br /> <br /> ===Reverse engineering results===<br /> * [[Firmware]]<br /> ** [[Bootrom]]<br /> ** [[Boot Process]]<br /> ** [[Firmware decryption]]<br /> ** [[FTL|Flash Translation Layer]]<br /> ** [[RetailOS]]<br /> *** [[RetailOS Options]]<br /> * [[GUID table]]<br /> * [[JTAG]]<br /> * Nano 2G<br /> ** [[Nano2G clock gates‎]]<br /> ** [[Nano2G LCD init]]<br /> ** [[Nano2G HW analysis]]<br /> ** [[S5L8701 analysis]]<br /> * Nano 4G<br /> ** [[Nano4G firmware upgrade process]]<br /> * Nano 5G<br /> ** [[Nano 5G|General]]<br /> <br /> ===Other guides===<br /> * [[Modes]]<br /> |style=&quot;border: 1px dashed #c6c9ff; background-color: #f0f0ff&quot;|<br /> ===Hardware===<br /> * [[Hardware]]<br /> ** [[Nano 1G]]<br /> ** [[Nano 2G]]<br /> ** [[Nano 3G]]<br /> ** [[Nano 4G]]<br /> *** [[920-0614-03]]<br /> ** [[Nano 5G]]<br /> ** [[Nano 6G]]<br /> ** [[Nano 7G]]<br /> ** [[Classic 1G]]<br /> ** [[Classic 2G]]<br /> ** [[Classic 3G]]<br /> * [[Chronology]]<br /> * [[S5L8700 datasheet]]<br /> <br /> ===Exploiting===<br /> * [[wInd3x]]<br /> * [[Pwnage 2.0]]<br /> * [[Notes vulnerability]]<br /> ** [[Address bruteforcing]]<br /> ** [[Nanotron 3000]]<br /> |}</div>

760ceb3b9c0ba4872cadf3ce35a7a494 https://freemyipod.org/index.php?title=Osos/disk_swapping_bug&diff=22088 2024-08-04T04:42:23Z

<p>760ceb3b9c0ba4872cadf3ce35a7a494: </p> <hr /> <div>{{DISPLAYTITLE:osos/disk swapping bug}}<br /> [[File:Disk swap visualization.png|thumb|right|Simplified visualization of the boot logic of an iPod nano (6th generation)]]<br /> <br /> The osos/disk swapping bug is a bug in the boot process of the iPod nano (3rd generation and later) allowing for untethered boot of the [[retailOS]] with a modified resource partition. <br /> <br /> == Explanation ==<br /> In the firmware, the retailOS is stored in the &lt;code&gt;osos&lt;/code&gt; partition, and disk mode is stored in the &lt;code&gt;disk&lt;/code&gt; partition. <br /> The retailOS on the iPod nano reads from from the &lt;code&gt;rsrc&lt;/code&gt; partition, a FAT16 filesystem containing UI images, translation strings, fonts, and more. Unlike all other partitions ever included in official firmware, the &lt;code&gt;rsrc&lt;/code&gt; partition is signed, but not encrypted. The disk mode does not use the &lt;code&gt;rsrc&lt;/code&gt; partition. <br /> <br /> When the device is powered on, it decides whether to boot into disk mode or retailOS based on whether a button is pressed (on the iPod nano (6th generation), this is the Volume Up button). The basic logic is this:<br /> <br /> if volume up pressed:<br /> boot &quot;disk&quot;<br /> else:<br /> if &quot;rsrc&quot; signature check passed:<br /> boot &quot;osos&quot;<br /> else:<br /> error out<br /> <br /> If the firmware is modified so that the &lt;code&gt;disk&lt;/code&gt; and &lt;code&gt;osos&lt;/code&gt; partitions are swapped - that is, the names of the two partitions are switched - the behavior reverses, meaning the iPod will boot into disk mode by default and retailOS if the volume up button is held. This is where the bug exists: if the iPod is booted with the volume up button pressed, the iPod, expecting to boot disk mode, will boot into retailOS without performing a signature check on &lt;code&gt;rsrc&lt;/code&gt;.<br /> <br /> == Notes ==<br /> On at least the iPod nano (6th generation), booting retailOS this way seems to make the filesystem read only to the device: no actions taken on the device persist after a reboot.</div>

760ceb3b9c0ba4872cadf3ce35a7a494