freemyipod - User contributions [en]

User:Wolftail

2010-08-16T05:18:32Z

Cmwslw:

Hey, there!

My name is Lala Ionuț, I live in Romania and I own an iPod Classic 1G (160GB) and can't wait for Rockbox and/or iPodLinux to be available for it. I am willing to do non-destructive testing in order to help the project.

PS: If anyone will read this... Is it possible to update the 1G Classic (160GB) to the 2.0.x firmware of the 2G/3G Classic? (I know that the hardware is almost a perfect match.) I think it could be done by getting an image of the HDD of an iPod Classic with the new software and overwrite it to the older one. Has anyone tried this? Can it be done?

Thank You very much for all your work!

:Yes, this should be possible and in fact we have done something similar with the 4G. One time we copied the contents of a 8GB Nano 4G and gave it to me to put on my 16GB Nano 4G. It booted fine. But the thing is the Classic 2G has some headphone hardware that the 1G does not, and this could cause a crash when booting or using. We are more interested in copying the Classic 2G firmware to the Classic 3G since the 3G ships with firmware that has the notes vulnerability patched. [[User:Cmwslw|Cmwslw]] 05:18, 16 August 2010 (UTC)

Firmware

2010-08-15T02:35:48Z

Cmwslw: /* Nano 4G */

This article is about the different parts of the iPod's firmware. There is also a very basic analysis of the firmware headers. If you are trying to get a copy of the firmware files, please see [[Dumping firmware]] and [[Extracting firmware]]. NOTE: Please excuse the chaotic layout of this article. It is not very comprehensive, but it's still useful.
==Nano 2G==
===osos===
This is the main firmware image of the iPod. This part has been encrypted ever since the iPod Nano 2G.
[[Image:IN2G firmware osos header.png|thumb|caption]]
[[Image:Firmware layout.png|150px]]
===aupd===
Here is a comparison between the different aupd partitions of firmware version in the iPod Nano 2G:
[[Image:IN2G firmware aupd header.png|thumb|caption]]
[[Image:IN2G cipher aupd diffs.png|500px]]
===rsrc===
This is the resource filesystem of the iPod firmware. It is unencrypted and of not much use to this project.
==Nano 3G==
The Nano 3G has the same ''osos'', ''aupd'', and ''rsrc'' sections as the Nano 2G, but it also has an added ''hash'' section. The ''hash'' section is populated with 0x1800 bytes of 0xFF.
==Classic 1G (6G)==
The Classic 1G has the same firmware structure as the 3G. This makes sense because they were released at the same time.
==Nano 4G==
The Nano 4G kept the ''osos'' but all the old sections were removed. Instead, seven new sections were added:

* Binaries
** ''diag'' - Diagnostic mode. This depends on EFI modules being loaded so it can't be booted directly.
** ''disk'' - Disk mode
* Bitmaps
** ''appl'' - Apple logo for booting
** ''bdhw'' - Bad hardware image
** ''bdsw'' - Bad software image (Use iTunes to restore)
** ''lbat'' - Low battery image** ''chrg'' - Same as lbat but showing that the iPod is charging

==Helpful pages==
http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf

http://www.ipodlinux.org/wiki/Firmware

Firmware

2010-08-15T02:35:07Z

Cmwslw: /* Nano 4G */

This article is about the different parts of the iPod's firmware. There is also a very basic analysis of the firmware headers. If you are trying to get a copy of the firmware files, please see [[Dumping firmware]] and [[Extracting firmware]]. NOTE: Please excuse the chaotic layout of this article. It is not very comprehensive, but it's still useful.
==Nano 2G==
===osos===
This is the main firmware image of the iPod. This part has been encrypted ever since the iPod Nano 2G.
[[Image:IN2G firmware osos header.png|thumb|caption]]
[[Image:Firmware layout.png|150px]]
===aupd===
Here is a comparison between the different aupd partitions of firmware version in the iPod Nano 2G:
[[Image:IN2G firmware aupd header.png|thumb|caption]]
[[Image:IN2G cipher aupd diffs.png|500px]]
===rsrc===
This is the resource filesystem of the iPod firmware. It is unencrypted and of not much use to this project.
==Nano 3G==
The Nano 3G has the same ''osos'', ''aupd'', and ''rsrc'' sections as the Nano 2G, but it also has an added ''hash'' section. The ''hash'' section is populated with 0x1800 bytes of 0xFF.
==Classic 1G (6G)==
The Classic 1G has the same firmware structure as the 3G. This makes sense because they were released at the same time.
==Nano 4G==
The Nano 4G kept the ''osos'' but all the old sections were removed. Instead, seven new sections were added:

* Binaries

** ''diag'' - Diagnostic mode. This depends on EFI modules being loaded so it can't be booted directly.
** ''disk'' - Disk mode
* Bitmaps
** ''appl'' - Apple logo for booting
** ''bdhw'' - Bad hardware image
** ''bdsw'' - Bad software image (Use iTunes to restore)
** ''lbat'' - Low battery image** ''chrg'' - Same as lbat but showing that the iPod is charging

==Helpful pages==
http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf

http://www.ipodlinux.org/wiki/Firmware

Main Page

2010-08-14T02:45:44Z

Cmwslw: /* Updates */

__NOTOC__
[[File:Embios.jpg|115px|thumb|right|[[emBIOS]] on the 4G Nano]]
This is the wiki for the freemyipod project. Freemyipod is a project for reverse-engineering iPods with clickwheel and creating tools and documentation so that other people can port alternative firmwares to them such as [http://www.rockbox.org rockbox].

==Updates==
*2010/08/13 - [[emBIOS]] is continually being improved and the next step is porting tools like [[iLoader]] to use it.
*2010/08/06 - The wiki has now been moved to www.freemyipod.org
*2010/08/05 - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [http://websvn.freemyipod.org/listing.php?repname=freemyipod&path=/embios/ here]
*2010/08/03 - We can now access the Nano 4G accelerometer.
*2010/08/02 - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].
*2010/08/01 - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.
*2010/07/27 - The server got zapped by lightning but a new one was up and running within a day.
*2010/02/23 - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!
*2009/11/01 - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]

Follow [http://twitter.com/freemyipod our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]
* [[ SVN ]]
* [[ Todo list ]]
* [[ Project summary ]]

===Released Software===
* [[iLoader]]
** [[iLoader howto]]
** [[iLoader themes]]
** [[iLoader testing results]]
* [[iBugger]]
* [[emBIOS]]
** [[emBIOS Monitor Protocol]]

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Software efforts===
* [[Firmware]]
* [[Bootstrapping sequence]]
* [[Firmware decryption]]
* [[GUID table]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware efforts===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]
* [[S5L8700 datasheet]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

S5L8700 datasheet

2010-08-12T00:54:24Z

Cmwslw:

The datasheet for the S5L8700X was found [http://rapidshare.com/files/101234522/S5L8700X-DS.pdf.html here]. It matches the [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=136&partnum=K4M56163PG official Samsung 8700 info page]. The datasheet describes every pin (page 1-5) and instruction (page 3-1) of the 8700 series in detail. The pin locations described in the datasheet are not the actual locations for the iPod's [http://www.samsung.com/global/business/semiconductor/support/PackageInformation/downloads/SystemLSI/FBGA/226_FBGA_0909_08_05.pdf 226-pin FBGA] version.
==Helpful pages==
http://www.samsung.com/global/business/semiconductor/support/PackageInformation/download_FBGA.html
http://www.rockbox.org/twiki/bin/view/Main/SamsungSA58#SA58700_codename_Blues

www.meizume.com/rockbox/5797-technical-information-s5l8700x07-sip.html

File:8700 ball layout.png

2010-08-12T00:53:27Z

Cmwslw:

S5L8700 ball layout (not the iPod's, though). This is a graphical representation of the grid array described here:
www.meizume.com/rockbox/5797-technical-information-s5l8700x07-sip.html

File:8700 ball layout.png

2010-08-12T00:51:32Z

Cmwslw:

S5L8700 ball layout (not the iPod's, though)

GUID table

2010-08-10T18:37:46Z

Cmwslw: moved GUID Table to GUID table

{| class="wikitable prettytable sortable"
|+ This is a list of all GUIDs found in various Apple code that we've analyzed so far
|-
! GUID !! Description
|-
| <0x3FD4147F, 0xAF65, 0x49B0, 0x78CE098, 0x8BC1132B> || Nano4G: DisplayPlatform:40030540
|-
| <0x4EEECD0C, 0xAE61, 0x4977, 0xBE3AA2AA, 0x12004FC2> || Nano4G: Timer:40020488
|-
| <0x144D4ACA, 0x93EF, 0x47E4, 0xCAB686A4, 0x81D57EF9> || Nano4G: Lcd:40090620
|-
|}

Main Page

2010-08-10T18:37:11Z

Cmwslw: /* Software efforts */

__NOTOC__
[[File:Embios.jpg|115px|thumb|right|[[emBIOS]] on the 4G Nano]]
This is the wiki for the freemyipod project. Freemyipod is a project for reverse-engineering iPods with clickwheel and creating tools and documentation so that other people can port alternative firmwares to them such as [http://www.rockbox.org rockbox].



==Updates==
*2010/08/06 - The wiki has now been moved to www.freemyipod.org
*2010/08/05 - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [http://websvn.freemyipod.org/listing.php?repname=freemyipod&path=/embios/ here]
*2010/08/03 - We can now access the Nano 4G accelerometer.
*2010/08/02 - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].
*2010/08/01 - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.
*2010/07/27 - The server got zapped by lightning but a new one was up and running within a day.
*2010/02/23 - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!
*2009/11/01 - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]
*2009/10/26 - USB now (somewhat) functional on [[Nano 4G]] via iBugger! This will be used instead of UART to dump memories.

Follow [http://twitter.com/freemyipod our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]
* [[ SVN ]]
* [[ Todo list ]]
* [[ Project summary ]]

===Released Software===
* [[iLoader]]
** [[iLoader howto]]
** [[iLoader themes]]
** [[iLoader testing results]]
* [[iBugger]]
* [[emBIOS]]
** [[emBIOS Monitor Protocol]]

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Software efforts===
* [[Firmware]]
* [[Bootstrapping sequence]]
* [[Firmware decryption]]
* [[GUID table]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware efforts===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]
* [[S5L8700 datasheet]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

Nano2G HW analysis

2010-08-10T18:33:31Z

Cmwslw: Fix an old link

[[File:Top_annote.jpg|200px|thumb|Top layer, including JTAG]]
[[File:Bot_annote.jpg|200px|thumb|Bottom layer]]
[[File:2G_frt_annotation.png|300px]]
[[File:2G_bck_annotation.png|300px]]
== previous work ==

See [[Nano 2G]].

== SOC analysis ==

[[S5L8701_analysis]]

== Circuit analysis ==

After desoldering all components, the circuit was analyzed with a continuity tester.

Small test needles (nailbed needles are great) were used for contacting.

For easing the search, a more coarse search was first performed by a novel method : soldering a coil wire to one end, and moving a iron wool pad over the rest of the PCB until the tester beeps. After finding a spot, the needle allows to find the exact pad.

Not all connection were routed, mainly the connections to the S5L8701 SOC.

Results are a [http://f4eru.free.fr/8701/ detailed pinout of the 8701]

See also [[S5L8701_analysis]].

== JTAG ==

The jtag was found after searching with a jtag bruteforce scanner i wrote.(to be published later)
There were a lot of problems, including the scanner not working properly, and a nTRST pin. (still cannot understand why).

But now we have the locations of the pins : see picture [[Image:Top_annote.jpg|40px|thumb|pin locations]].

The pins are basically available on the DOCK connector after putting in place some jumpers (2 for nTRST, 1 for other pins).

After connecting a xilinx parallel cable, and installing openwince, we can try to connect to the JTAG :

'''The screen freezes directly when we use the JTAG.''' This seems to be a protection against hackers, but it could also be an issue with openocd.
In fact, the ARM 940T processor is still fully functionnal, but it gets disconnected from the main bus, all memories are not reachable any more. The only memory preserved are the Data and instruction caches.

== JTAG cache dumps ==

As the caches are mainly alive, we focused first on dumping whatever the cache contained. As the caches are mostly not activated through the boot cycle, we made a lot of cache dumps (Dcache only can be dumped, the Icache can only give the indexes).

We used some [http://f4eru.free.fr/8701/openocd_config.zip openocd and bash scripts]. The command "dc" dumps the Dcache, "ic" shows the icache indexes. Be careful, these values can be corrupt due to the mem bus disconnection. We used statistics on many dumps to have helpful dumps (look at [http://f4eru.free.fr/8701/openocd_config.zip dumpsoorter.py]).

Please note that the DLC5 cable was modified to include a nSRST pin, and openocd was recompiled for this. It is a desirable feature to have a reset. nTrst was simply tied to the 3.0V power supply, it is just not necessary.
Also, one important thing is to cut the power supply during reset, with a MOSFET, for example. If this is not done, the ipod can often go to a "broken battery" state, where the processor thinks the successive resets are due to a defective battery.

[http://f4eru.free.fr/8701/dump_example.txt Dump example]

== getting code execution ? ==

[[Nano2G getting exec]]

S5L8701 analysis

2010-08-10T18:30:13Z

Cmwslw: /* Guessed pinout table */

[[File:S5L8701_bonding_wires_via_x-ray_bottom_view_2.jpg|200px|thumb|View of the bonding via X-ray]]
[[File:S5L8701_top_layer_bottom_view_2.jpg|200px|thumb|View of the top layer]]
[[File:S5L8701 bottom layer bot view 2.jpg|200px|thumb|View of the bottom layer]]
== Introduction ==

The samsung S5L8701 is the SOC of the IN2G. This chip is supposed to be close to the 8700 used on some concurrent MP3 players.

We currently know nearly nothing about the differences of both chips, and the further evolutions. There is probably a small unencrypted boot ROM inside, which would be very useful for integrating user SW. Probably containing crypto information.
Knowing the location of some JTAG pins could be very helpful.

There is an OpenOffice Calc document describing possible pinouts [http://f4eru.free.fr/8701/ here]. There is also [https://mail.gna.org/public/linux4nano-dev/2009-05/msg00003.html tof's mailing list post].

== Structure of the packaging ==

The chip is a 226-pin TFBGA with a pitch of 0.5mm.
This is the structure of a BGA package: [http://www.freepatentsonline.com/6569694-0-display.jpg BGA package]

The chip is glued to a small double side PCB substrate.
the electrical current passes through:
*a pad of the chip die
*a bonding wire
*the top layer of the substrate
*a via
*the bottom layer
*finally, the BGA ball

The [[S5L8700 datasheet|known datasheet]] shows die pad numbers that need to be correlated to ball numbers (the specified package has a different ball layout).
In order to do this, we make an analysis of the bonding and PCB.

== Packaging analysis ==

Following steps were made:
*desoldering of the IC
*removing of the balls and filler glue
*X-ray picture
*microscope picture of the bottom layer
*removing the bottom layer and most of the substrate (by careful manual grinding)
*microscope picture of the top layer
*superposition of these views, and path finding from the die to the ball

== Guessed pinout table ==

the pinout is currently under study. See [http://f4eru.free.fr/8701/ here] for the actual status.
This is not an easy part of the work, each pad has to be tested for connections all over the board (most IC's removed). See [[Nano2G HW analysis]] for further PCB analysis.

EmBIOS

2010-08-09T22:37:36Z

Cmwslw:

[[File:Embios.jpg|115px|thumb|right|emBIOS on the 4G Nano]]
emBIOS is best described as a hardware abstraction with threading and debugging capabilities built in. It simplifies development immensely by integrating drivers for all the iPods. Before drivers were scattered throughout multiple tools built for multiple iPods. If there was a bug fix for a driver, it would have to be applied in many different places. emBIOS attempts to solve this problem by providing a syscall interface that is standard throughout all iPod generations. This means that a build of a tool can work across generations as long as it is run on a native emBIOS. This allows for maximum code reuse.

If you're curious about how emBIOS works, you can browse it's SVN folder [http://websvn.freemyipod.org/listing.php?repname=freemyipod&path=/embios/&#a70ba5517efd721bf4f2b7b4285a23990 here]. The emBIOS trunk has temporarily abandoned support for the [[Nano 4G]] since there was a holdup concerning it's timer. 4G development continues in the '4g_compat' branch. It will be merged in as soon as this holdup is solved.
==Building==
If you want to try it out on your own iPod, there are automatic builds but you might as well just check out the SVN and compile it yourself. After all, emBIOS itself doesn't do much except print out its version string to the console. You must put something in main.c if you want it to do anything. Here are the basic steps to getting emBIOS up and running on your iPod:
* Check out the Freemyipod [[SVN]].
* Build the UCL tool in the root of the SVN using make. You will need access to the UCL libraries to build this.
* Make sure you have the arm-eabi toolchain. You can easily build this using the rockboxdev.sh script in the tools directory of the Rockbox SVN.
* If you are on a Nano 2G, build the trunk using 'make ipodnano2g'. If on a Nano 4G, build the 4g_compat branch using 'make ipodnano4g'.

EmBIOS

2010-08-09T21:38:19Z

Cmwslw: Created page with "[[emBIOS on the 4G Nano]] emBIOS is best described as a hardware abstraction with threading and debugging capabilities built in. It simplifi..."

[[File:Embios.jpg|115px|thumb|right|[[emBIOS]] on the 4G Nano]]
emBIOS is best described as a hardware abstraction with threading and debugging capabilities built in. It simplifies development immensely by integrating drivers for all the iPods. Before drivers were scattered throughout multiple tools built for multiple iPods. If there was a bug fix for a driver, it would have to be applied in many different places. emBIOS attempts to solve this problem by providing a syscall interface that is standard throughout all iPod generations. This means that a build of a tool can work across generations as long as it is run on a native emBIOS. This allows for maximum code reuse.

File:Embios.jpg

2010-08-09T20:53:18Z

Cmwslw: uploaded a new version of "File:Embios.jpg"

Main Page

2010-08-09T20:45:05Z

Cmwslw:

__NOTOC__
[[File:Embios.jpg|115px|thumb|right|[[emBIOS]] on the 4G Nano]]
This is the wiki for the freemyipod project. Freemyipod is a project for reverse-engineering iPods with clickwheel and creating tools and documentation so that other people can port alternative firmwares to them such as [http://www.rockbox.org rockbox].



==Updates==
*2010/08/06 - The wiki has now been moved to www.freemyipod.org
*2010/08/05 - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [http://websvn.freemyipod.org/listing.php?repname=freemyipod&path=/embios/ here]
*2010/08/03 - We can now access the Nano 4G accelerometer.
*2010/08/02 - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].
*2010/08/01 - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.
*2010/07/27 - The server got zapped by lightning but a new one was up and running within a day.
*2010/02/23 - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!
*2009/11/01 - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]
*2009/10/26 - USB now (somewhat) functional on [[Nano 4G]] via iBugger! This will be used instead of UART to dump memories.

Follow [http://twitter.com/freemyipod our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]
* [[ SVN ]]
* [[ Todo list ]]
* [[ Project summary ]]

===Released Software===
* [[iLoader]]
** [[iLoader howto]]
** [[iLoader themes]]
** [[iLoader testing results]]
* [[iBugger]]
* [[emBIOS]]
** [[emBIOS Monitor Protocol]]

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Software efforts===
* [[Firmware]]
* [[Bootstrapping sequence]]
* [[Firmware decryption]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware efforts===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]
* [[S5L8700 datasheet]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

File:Embios.jpg

2010-08-09T20:43:50Z

Cmwslw:

Main Page

2010-08-05T22:59:58Z

Cmwslw: /* Released Software */

__NOTOC__
[[File:4g_ibugger.jpg|115px|thumb|right|iBugger on the 4G Nano]]
This is the wiki for the Linux4nano project. Linux4nano has a fairly active IRC channel, [irc://irc.freenode.net/linux4nano-dev #linux4nano-dev] on Freenode for development related discussion. Please save questions and comments for [irc://irc.freenode.net/linux4nano #linux4nano]. There is a [http://home.gna.org/linux4nano/ project homepage] and a [http://mail.gna.org/public/linux4nano-dev/ mailing list], but these two are rarely updated.

==Updates==
*2010/08/05 - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development here: http://bit.ly/cQAuam
*2010/08/03 - We can now access the Nano 4G accelerometer.
*2010/08/02 - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].
*2010/08/01 - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.
*2010/07/27 - The server got zapped by lightning but a new one was up and running within a day.
*2010/02/23 - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!
*2009/11/01 - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]
*2009/10/26 - USB now (somewhat) functional on [[Nano 4G]] via iBugger! This will be used instead of UART to dump memories.

Follow [http://twitter.com/linux4nano our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contributing ]]
* [[ Todo list ]]
* [[ Willing testers]]
* [[ Project summary ]]

===Released Software===
* [[iLoader]]
** [[iLoader howto]]
** [[iLoader themes]]
** [[iLoader testing results]]
* [[iBugger]]
* [[emBIOS]]
** [[emBIOS Monitor Protocol]]

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Software efforts===
* [[Firmware]]
* [[Bootstrapping sequence]]
* [[Firmware decryption]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware efforts===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]
* [[S5L8700 datasheet]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

Main Page

2010-08-05T15:18:42Z

Cmwslw: /* Updates */

__NOTOC__
[[File:4g_ibugger.jpg|115px|thumb|right|iBugger on the 4G Nano]]
This is the wiki for the Linux4nano project. Linux4nano has a fairly active IRC channel, [irc://irc.freenode.net/linux4nano-dev #linux4nano-dev] on Freenode for development related discussion. Please save questions and comments for [irc://irc.freenode.net/linux4nano #linux4nano]. There is a [http://home.gna.org/linux4nano/ project homepage] and a [http://mail.gna.org/public/linux4nano-dev/ mailing list], but these two are rarely updated.

==Updates==
*2010/08/05 - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development here: http://bit.ly/cQAuam
*2010/08/03 - We can now access the Nano 4G accelerometer.
*2010/08/02 - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].
*2010/08/01 - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.
*2010/07/27 - The server got zapped by lightning but a new one was up and running within a day.
*2010/02/23 - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!
*2009/11/01 - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]
*2009/10/26 - USB now (somewhat) functional on [[Nano 4G]] via iBugger! This will be used instead of UART to dump memories.

Follow [http://twitter.com/linux4nano our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contributing ]]
* [[ Todo list ]]
* [[ Willing testers]]
* [[ Project summary ]]

===Released Software===
* [[iLoader]]
** [[iLoader howto]]
** [[iLoader themes]]
** [[iLoader testing results]]
* [[iBugger]]
===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Software efforts===
* [[Firmware]]
* [[Bootstrapping sequence]]
* [[Firmware decryption]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware efforts===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]
* [[S5L8700 datasheet]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

Modes

2010-08-05T15:17:21Z

Cmwslw: /* Getting DFU mode on 3G/4G */

Nanos have special modes that they can boot into called disk mode, DFU mode, and debug mode.

==Disk mode==
Disk mode has existed ever since the iPod has existed. Disk mode is stored in the 1MB NOR auxillary flash (along with the bootloader), so this is pretty much always there, no matter what sort of tampering you have done. Disk mode basically makes the iPod behave as a massive storage device, allowing the computer to directly read and write the data flash chip. For more information on how to enter Disk mode (or Reboot), refer to the [http://www.ipodlinux.org/wiki/Key_Combinations Key Combination] page from iPodLinux Wiki.

[[Image:Diskmode.jpg]]

([http://www.ipodlinux.org/ iPodLinux project])

==DFU mode==
DFU (Device Firmware Upgrade) mode is a relatively new standard for upgrading firmware that is used in many devices like the OpenMoko and the newer iPods. DFU mode (since nano 3G) is probably contained in the on-processor's bootrom. Newer iPods have both DFU mode and disk mode, while iPod Touch and iPhones have exclusively DFU mode. It is worth noting that DFU mode was implemented at the exact time that Apple switched from PortalPlayer to Samsung processors.

The Nano 2G also has a DFU mode, but this mode can only be entered by shorting testpoints on the circuit board.

===Getting DFU mode on 3G/4G===
# Make sure your iPod is turned on and connected to your computer.
# Press the menu button and select (central) button simultaneously.
# The iPod's screen will go black, and the Apple logo will shortly appear.
# Keep on pressing till the Apple logo turns into a black screen. This is about 10 seconds.
# Release the menu and select buttons.

You can use lsusb to determine if your iPod is in DFU mode. 05ac is the vendor ID (apple), and the number after the colon is the Product ID. The product ID depends on whether the iPod is in DFU mode or not. Here is a table of product IDs:
{| class="wikitable"
! Device !! Normal !! DFU
|-
| Nano 2G
| ?
| ?
|-
| Nano 3G
| 1262
| 1223/1224
|-
| Nano 4G
| 1263
| 1225
|-
| Nano 5G
| 1265
| 1231
|-
| Classic 1G
| ?
| ?
|-
| Classic 2G
| ?
| ?
|-
| Classic 3G
| 1261
| 1223

|}
Please replace the question marks if you can.

===DFU utility===
TheSeven has written libipoddfu.py for communicating with the iPod's DFU interface. It also has a utility called ipoddfu.py for uploading files in DFU mode. These utilities can be found in the tools section in TheSeven's [http://the-seven.tk/ipod/iloader/sourcecode.php development repository].

==Debug (diagnostics) mode==
This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot.

==Helpful pages==
http://www.ipodlinux.org/wiki/Key_Combinations

http://daniel.haxx.se/blog/2008/09/03/dfu-mode-on-2nd-gen-nanos/

http://www.usb.org/developers/devclass_docs/DFU_1.1.pdf

http://www.usb.org/developers/devclass_docs/usbdfu10.pdf

MPEG movies

2010-08-05T15:16:47Z

Cmwslw:

Note: I'm not that great of a formatter so please edit to make this look neat and nice.
Note#2: Most of the information for this Article is taken from http://www.rockbox.org/wiki/PluginMpegplayer

----

Anyway to the main topic of this page.
These instructions are basicly for ipod nano 2g but can easily be modified to work for any rockbox version.

Do you want to watch movies on your iPod Nano 2g? Feel left out that every iPod Nano except yours can watch movies? Here is how you can watch movies on your iPod:

First do everything in this article ([[ILoader Howto]])including installing rockbox.

== Windows Instructions: ==

Then go to [http://ffdshow.faireal.net/mirror/ffmpeg/ link] and download ffmpeg. Extract the 7z archive with a program such as [http://www.7-zip.org/download.html 7-zip]. Tell the program to extract the archive to your desktop.
Then press windows key+R type: "cmd" (without quotes) and press enter.
Now type "cd Desktop" (without quotes). Now find the video file you want to watch and drag it it your Desktop.
Now type the following into the windows that poped up when you typed cmd and then enter:
ffmpeg -i [inputfilename] -s 176x128 -vcodec mpeg2video -b 200k -ab 128k -ac 2 -ar 44100 -acodec libmp3lame [outputfilename]
Also make sure to replace [inputfilename] with your video file and [outputfilename] with the name of the file you want it to be name .mpeg. An example string you would type in would be:
ffmpeg -i myvideofile.mp4 -s 176x128 -vcodec mpeg2video -b 200k -ab 128k -ac 2 -ar 44100 -acodec libmp3lame mynewfile.mpeg
Now wait for the program to finish.
Now on your Desktop you should see a new file.
Boot your ipod to disk mode. (pressing the middle button in iLoader.
Copy your new file to your iPod Nano 2G.
Reboot your ipod to rockbox and click files and click on your movie file and it should play.

== Linux Instructions: ==

Mac OS X follow these getting ffmpeg from [http://www.finkproject.org/ fink]

First install ffmpeg. On Debian-based systems you can use sudo apt-get install ffmpeg.

Now put your video file in a directory. Open up terminal and navigate to the directory of your video file.
Type the following:
ffmpeg -i [inputfilename] -s 176x128 -vcodec mpeg2video -b 200k -ab 128k -ac 2 -ar 44100 -acodec libmp3lame [outputfilename]
Also make sure to replace [inputfilename] with your video file and [outputfilename] with the name of the file you want it to be name .mpeg. An example string you would type in would be:
ffmpeg -i myvideofile.mp4 -s 176x128 -vcodec mpeg2video -b 200k -ab 128k -ac 2 -ar 44100 -acodec libmp3lame mynewfile.mpeg
''Note: If libmp3lame doesn't work use just mp3.''

Now copy the resulting video file to your iPod Nano 2G.
In rockbox navigate to your file and play it.

== Several Notes ==

To get a widescreen aspect ratio try 170x128 try changing the ratio to make a better view.

Your videos might take some time to convert.

Chronology

2010-08-05T15:15:44Z

Cmwslw:

This page list all models of iPods and set the naming of it. So that, on this wiki, or on IRC nobody can be confused with what we are speaking about. Please also refer to Apple's [http://support.apple.com/kb/HT1353 Identifying iPod Models]" page

==iPod Series==

{| class="wikitable"
! Model !! Introduced !! Capacity !! Notes
|-
| [http://support.apple.com/kb/HT1353#scrollwheel 1G]
| 2001-10
| 5 GB or 10 GB
|
|-
| [http://support.apple.com/kb/HT1353#touchwheel 2G]
| 2002-07
| 10 GB or 20 GB
|
|-
| [http://support.apple.com/kb/HT1353#dockconnector 3G]
| 2003-04
| 10 GB, 15 GB, 20 GB, 30 GB, or 40 GB
|
|-
| [http://support.apple.com/kb/HT1353#clickwheel 4G (Greyscale)]
| 2004-07
| 20 GB or 40 GB
|
|-
| [http://support.apple.com/kb/HT1353#ipodphoto 4G (Color)]
| 2004-10
| 20 GB, 30 GB, or 60 GB
|
|-
| [http://support.apple.com/kb/HT1353#ipodfifth 5G (Video)]
| 2005-10
| 30 GB or 60 GB
|
|-
| [http://support.apple.com/kb/HT1353#ipodfifth2 5.5G (Video)]
| 2006-09
| 30 GB or 80 GB
|
|-
| [http://support.apple.com/kb/HT1353#ipodclassic (6G) Classic 1G]
| 2007-09
| 80 GB or 160 GB
| Encryption starts
|-
| [http://support.apple.com/kb/HT1353#iPod_classic_120GB (6G) Classic 2G]
| 2008-09
| 120 GB
|
|-
| [http://support.apple.com/kb/HT1353#iPod_classic_160GB (6G) Classic 3G]
| 2009-09
| 160 GB
|
|}

==iPod Nano Series==

{| class="wikitable"
! Model !! Introduced !! Capacity !! Notes
|-
| [http://support.apple.com/kb/HT1353#ipodnano Nano 1G]
| 2005-09
| 1 GB, 2 GB, or 4 GB
|
|-
| [http://support.apple.com/kb/HT1353#ipodnano2 Nano 2G]
| 2006-09
| 2 GB, 4 GB, or 8 GB
| Encryption starts
|-
| [http://support.apple.com/kb/HT1353#ipodnano3 Nano 3G]
| 2007-09
| 4 GB or 8 GB
|
|-
| [http://support.apple.com/kb/HT1353#iPod_nano_4th_generation Nano 4G]
| 2008-09
| 8 GB or 16 GB
|
|-
| [http://support.apple.com/kb/HT1353#iPod_nano5G Nano 5G]
| 2009-09
| 8 GB or 16 GB
|
|}

==Timeline==
[[Image:IPod Timeline.png|800px|The timeline of iPod releases (from Wikipedia)]]

==The Motive==
Understanding the mindset and motives behind Apple is key to understanding how and why the iPod was encrypted. While many people believe that the iPod was encrypted to put an end to iPodLinux and Rockbox, the main reason for the encryption was to thwart third-party imitators. Apple was not as concerned with iPodLinux and Rockbox because people were still buying their (overpriced) hardware, and therefore still generating profits. The main reason was because there were many imitations that replicated the hardware and ran the exact firmware that was run on normal iPods. This was a major drain of money for Apple. Another reason was that the DRM mechanism in the unencrypted firmware was being hacked. This allowed pirated content like games to be run without being bought.
==The Response==
Since Apple was losing money from the iPod imitators, they encrypted the firmware so the iPod clones could no longer use Apple firmware on their devices. There are still iPod clones out there (just search eBay), but very few use the Apple firmware anymore. Apple has encrypted all of their portable devices since the iPod Nano 2G.
==The Change==
In order to stop the fake iPods from using their firmware, Apple encrypted the firmware so only their devices could decrypt it. Apple changed their processor to Samsung and no longer used PortalPlayer.
==Helpful Pages==
http://support.apple.com/kb/HT1353

Classic 1G

2010-08-05T15:15:13Z

Cmwslw: /* Components */

[[Image:classic_1g_frt_a.png|500px]]
[[Image:classic_1g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| 3
| CPU
| Samsung S5L8702
|
| ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702. Same as on the Nano 3G
|-
| 2
| SDRAM
| K4X51163PE
|
|
|-
| 5
| Utility Flash
| [http://www.sst.com/products/?inode=41340 SST25VF080B]
|
| Same as on the Nano 3G
|-
| 4
| Audio codec
| Cirrus
|
|
|-
| 1
| Power manager
| Probably Dialog?
| APPLE, 338S0445, 2114.102, ZPD7383Y
|
|-
| 6
| USB charging
| LTC4066
|
|
|}

==Helpful pages==
Teardowns:
*TheSeven's broken Classic 1G board (High-res): [http://img43.imageshack.us/img43/6619/6gback.jpg front] [http://img7.imageshack.us/img7/1858/6gfront.jpg back]
Other:
*http://homepage.mac.com/marc.heijligers/audio/ipod/comparison/measurements/measurements.html

Nano 5G

2010-08-05T15:14:50Z

Cmwslw: /* Components */

[[Image:nano_5g_frt_a.png|500px]]
[[Image:nano_5g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| 2
| CPU
| Samsung S5L8730
| 339S0081 ARM, K4X51323PG-UGC6, EDE168AG 0928, APL0378A00, N1X2XW 0931
| Printed backwards on the chip - how sneaky.
|-
|
| SDRAM
|
|
| Integrated into the processor, similar to the iPod Touch and iPhone lines.
|-
| 8
| NAND Flash
| Various 8/16 GB chips
| TH58NVG6D2ELA49, ID8038, TAIWAN, 09299AE
| One example is TH58NVG6D2ELA49 visible on the iFixit Teardown
|-
| 1
| Power manager
| Probably Dialog
| 338S0707, -AD, 09278HGZ
| Similar looking and named chips like this have been power managers. Apple uses chips like these in just about every device.
|-
| 3
|
|
|
|
|-
| 4
|
|
|
|
|-
| 5
| Audio codec
| Cirrus Logic CLI1480A
| 338S0559, ATWV0926, SGP
| Also found in the Touch 3G. Stereo CODEC w/ Headphone and Speaker Amp
|-
| 6
| Accelerometer
| [http://www.st.com/stonline/products/literature/ds/15102/lis331dlm.htm LIS331DLM]
| 33DM, 2910
| The newer Touch's, iPhone's, and even the iPad have similar accelerometers, and I've discovered a pattern in the chip names.
|-
| 7
|
|
| 0630, CK9Y, 925
|
|}

==Helpful pages==
Teardowns:
*http://www.ifixit.com/Teardown/iPod-nano-5th-Generation-Teardown/1157
Other:
*http://purpleskank.wikidot.com/ipod-nano-5g
*http://www.ubmtechinsights.com/reports-and-subscriptions/device-library/Device-Profile/?SINumber=23271

Nano 4G

2010-08-05T15:14:35Z

Cmwslw: /* Components */

[[Image:nano_4g_frt_a.png|500px]]
[[Image:nano_4g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| 2
| CPU
| Samsung S5L8720
| 339S0049 ARM, K4X56323PI-KGC4, YWE025QH 825, APL0278A00, N1B2HOP 0831
| ARM1136JZF-S processor. It is definitely worth knowing that this is the exact same processor used in the iTouch 2G. This could mean that some of the same exploits for that could possibly be used. [http://theiphonewiki.com/wiki/index.php?title=S5L8720_(Hardware) Here] is a very interesting page about the S5L8720 processor.
|-
|
| SDRAM
|
|
| 32MB, probably MDDR. Integrated into the processor, similar to the iPod Touch and iPhone lines.
|-
| 4
| Accelerometer
| [http://www.st.com/stonline/products/families/sensors/motion_sensors/lis331dl.htm LIS331DL]
| 33DL, 2827
| The newer Touch's, iPhone's, and even the iPad have similar accelerometers, and I've discovered a pattern in the chip names.
|-
| 6
| NAND Flash
| Varies
| TH58NVG6D1DLA87, U20516, JAPAN, 0826MAE
|
|-
| 5
| Audio codec
| Probably Cirrus
| 338S055C, 189N0824, SGP
| I determined this because the [[Nano 5G]] has a similar chip, which we are sure of the identity. One person lifted this chip and found that the pins connect to the LCD connector. Not much info was given, and it could just be a common ground, but the identity of this chip is still up in the air.
|-
| 1
| Power manager
| Probably Dialog?
| 338S0687-AC, 08288HBB
|
|-
| 3
|
|
|
|
|}

==Helpful pages==
Teardowns:
*http://www.ifixit.com/Guide/First-Look/iPod-Nano-4th-Generation/584/1
Other:
*http://theiphonewiki.com/wiki/index.php?title=S5L8720_(Hardware)

Nano 3G

2010-08-05T15:14:17Z

Cmwslw: /* Components */

[[Image:nano_3g_frt_a.png|500px]]
[[Image:nano_3g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| 2
| CPU
| Samsung S5L8702
| 337S3473 8702, NONBWOEC, 0731 ARM
| ARM926EJ-S processor. The package itself is Apple-branded and marked 337S3473 8702.
|-
| 3
| SDRAM
| [http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] or Qimonda HYE18M169CX75
| 0728, C, HYE18M256, 169CX75, W3338092
| SDRAM - Mobile DDR, 256Mb, 1.8V. WORK ON THIS: Like the flash chip, the memory also varies. The most popular chip seems to be the [http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]. Another similar one that is sometimes used is the Qimonda HYE18M169CX75
|-
| 5
| Utility Flash
| [http://www.sst.com/products/?inode=41340 SST25VF080B]
| V80B, 729379
| Flash - NOR, 8Mb, Serial SPI
|-
| 6
| NAND Flash
| Varies
| Samsung 728, K9HCG08U5M, PCB0, FCF285X1
|
|-
| 1
| Audio codec
| WM1870
| APPLE, 338S0462, 76BZKTM
|
|-
| 4
| Power manager
| D1671B
| 338S0408, 07258HAH
|
|}

==Helpful pages==
Chip analyses:
*http://www2.electronicproducts.com/Applie_iPod_Nano_(4GB)_3rd_Generation-whatsinside-16.aspx#
Teardowns:
*http://content.techrepublic.com.com/2346-13636_11-170826-1.html
*http://www.ifixit.com/Guide/First-Look/iPod-Nano-3rd-Generation/594/1
*http://insidetronics.blogspot.com/2007/09/teardown-ipod-nano-3g.html
*[http://www.combert-elec.com/www/bookpic/200810916515460624.jpg Image of 3G Nano board]

S5L8701 analysis

2010-08-05T15:13:47Z

Cmwslw:

Nano 2G

2010-08-05T15:12:06Z

Cmwslw: /* Components */

[[Image:nano_2g_frt_a.jpg|300px]]
[[Image:nano_2g_bck_a.jpg|300px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| 1
| CPU
| Samsung S5L8701
|337S32918701, N042DQS, 0636 ARM
| System On Chip (SoC), includes ARM940T central processor, advanced DSP, 50kB boot ROM, 256kB SRAM, external RAM, flash and LCD controllers, USB(1.1-host; 2.0-function) and some other parts. Package: [http://www.samsung.com/global/business/semiconductor/support/PackageInformation/downloads/SystemLSI/FBGA/232_FBGA_1010_12_05.pdf 232-pin FBGA 10x10mm] or 224/226-pin 9x9mm. Similar chips: [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=212&partnum=SA58700 SA58700X07]. Some documentation available for the S5L series can be found [[S5L8700 datasheet|here]]. The processor itself is Apple-branded and marked 337S3291 8701.
|-
| 2
| SDRAM
| [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG Samsung K4M56163PG]
|SEC 637 GG75, K4M56163PG, AQH373P1
| [http://pdf1.alldatasheet.net/datasheet-pdf/view/168204/SAMSUNG/K4M56163PG.html here] is the datasheet. This is the same chip used in the [[Nano 1G]]. Sometimes the Qimonda [http://www.alldatasheet.com/datasheet-pdf/pdf/207179/QIMONDA/HYE18L256169BFX-7.5.html HYE18L256] chip is used instead.
|-
| 3
| Utility Flash
| [http://www.sst.com/products/?inode=41422 SST39WF800A]
|SST39WF800A, 90-4C-C2QE, 0631287-A
| stores Disk Mode, Diagnostic Mode and the code to flash this chip. Tof has [http://home.gna.org/linux4nano/dumping_SST39WF800A.html managed to extract] this data and the dump can be obtained by emailing Emmanuel Fleury. All of the contents in the utility flash chip are encrypted from now on.
|-
| N/A
| DSP
| N/A
| N/A
| Combination of Samsung 16-bit CalmRisc16 and Samsung 24-bit CalmMAC2424.
|-
| B1
| NAND Flash
| Varies
|TOSHIBA P11023, JAPAN 0636 KAE, TP0560, TH58NVG5D4CTG20
|
|-
| 6
| USB charging
| LTC4066
|Linear Technology, 6H, 4066, B8966
|
|-
| 5
| Audio codec?
| WM something?
|APPLE, 338S0310, 68BTST8
|
|-
| 4
| Step down regulator
| LM34910
|National Semiconductor, JM66RJ, L34910B
|
|-
| B2
| Power manager (below)
| Probably Dialog?
|APPLE, 338S0261, P29T6 04, cPG0637Y, 01/N2
|
|}

==Helpful pages==
Teardowns:
*http://www.ifixit.com/Guide/First-Look/iPod-Nano-2nd-Generation/592/1
*http://arstechnica.com/apple/reviews/2006/09/ipod-2g.ars/4
*http://www.eetimes.com/design/audio-design/4016200/Tear-Down-Inside-the-Apple-8GB-iPod-nano (useful because it shows the power manager)
*http://forums.rockbox.org/index.php?PHPSESSID=d69e900c3215a165adee7165ece4eccb&topic=6518.msg62700#msg62700 (beautiful PCB scans)
Other:
*http://home.gna.org/linux4nano/download/hardware_synth-1.0.pdf

Nano 1G

2010-08-05T15:11:50Z

Cmwslw: /* Components */

[[Image:nano_1g_frt_a.png|500px]]
[[Image:nano_1g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| 4
| CPU
| Portal Player PP5021C-TDF
| PP5021C-TDF, L9A0633, U0530 Logo, WYH30113.1, TAIWAN
| This is the last Nano that used a PortalPlayer processor before Apple started using Samsung. If anybody knows of a datasheet for this, please add a link to it.
|-
| 5
| SDRAM
| [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG Samsung K4M56163PG]
| SEC534 BG75, K4M56163PG, AQF061WX
| A datasheet for this Mobile SDRAM chip can be found [http://pdf1.alldatasheet.net/datasheet-pdf/view/168204/SAMSUNG/K4M56163PG.html here].
|-
| 10
| Utility Flash
| [http://www.sst.com/products/?inode=41856 SST39WF400A]
| SST39WF400A, 90-4C-C1QE, 0528149A
| This chip is documented very well. A similar chip is on the [[Nano 2G]].
|-
| 1
| NAND Flash
| Varies
|
|
|-
| 2
| Click wheel controller
| CY8C21434
| CPMCYP, 6360A 02, K0R0512, 610881
|
|-
| 3
| ATA flash disk controller
| SST5SLD019K
| Logo, 55LD019K, 45-C-MWE, 0528071-A4
|
|-
| 6
| Audio codec
| WM8975G
| WM8975G, 56AGVF4
|
|-
| 7
| Step down regulator
| LM34910
| JM54RE, 34910SD
|
|-
| 8
| Power manager
| PCF50607
| CF50607, 605940, Bug528, 23e/N1Y
|
|-
| 9
| USB charging
| LTC4066
| Logo, 5F, 4066, N7537
|
|}

==Helpful pages==
Chip analyses:
*http://www2.electronicproducts.com/Apple_iPod_nano-whatsinside-2.aspx
Teardowns:
*http://arstechnica.com/apple/reviews/2005/09/nano.ars/4
*[http://pc.watch.impress.co.jp/docs/2005/0908/nano21.jpg Image of the 1G Nano board]
*[http://www.ipodlinux.org/wiki/Generations#iPod_Nano_.28Nano1G.29] - See the pictures listed
Other:
*http://www.ipodlinux.org/wiki/Generations

Hardware

2010-08-05T15:11:35Z

Cmwslw:

This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.

{| class="wikitable"
! Generation !! CPU !! RAM !! size !! Utility flash !! size
|-
|[[Nano 1G]]
|PP5021C-TDF
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG]
|32MB
|[http://www.sst.com/products/?inode=41856 SST39WF400A]
|512kB
|-
|[[Nano 2G]]
|S5L8701
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG]
|32MB
|[http://www.sst.com/products/?inode=41422 SST39WF800A]
|1MB
|-
|[[Nano 3G]]
|S5L8702
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]
|32MB
|[http://www.sst.com/products/?inode=41340 SST25VF080B]
|1MB
|-
|[[Nano 4G]]
|S5L8720
|Integrated
|32MB
|?
|?
|-
|[[Nano 5G]]
|S5L8730
|Integrated
|?
|?
|?
|-
|[[Classic 1G]]
|S5L8702
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]
|32MB
|[http://www.sst.com/products/?inode=41340 SST25VF080B]
|1MB
|-
|[[Classic 2G]]
|S5L8702
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]
|32MB
|[http://www.sst.com/products/?inode=41340 SST25VF080B]
|1MB
|-
|[[Classic 3G]]
|S5L8702
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]
|32MB
|[http://www.sst.com/products/?inode=41340 SST25VF080B]
|1MB
|}

Concerning the detailed generation pages:
*If you can prove or disprove any of these chip names, please let us know on the mailing list.
*The sources for the original and annotated PCB scans can found at http://l4n.clustur.com/data/board_imgs.

==Helpful pages==
Chip analyses
*http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx
*http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx

Nanotron 3000

2010-08-05T15:11:10Z

Cmwslw: /* Timings for resetting and rebooting iPods */

'''NOTICE: This project is an old attempt at [[Address bruteforcing]].''' Nanotrons are no longer needed.

Because of the immense amount of time it will take to brute force the 3G and the 4G by hand, the Linux4nano team has hatched an ambitious idea. We have decided to build a brute forcing robot with LEGO Mindstorms. We can leave this bot running overnight and hopefully find out the correct addresses. If the LEGO idea is not feasible we can resort to using transistors like [[Sto]] used on the 2G. This would be more expensive but easier IMO.

== Completed Nanotrons ==
=== Farthen ===
[[File:Nanotron-3000-farthen-1.jpg|200px]]
[[File:Nanotron-3000-farthen-2.jpg|200px]]

This is my first nanotron. I had some mechanical difficulties and needed to rebuild it. I'll upload some pictures of the second one at some time.
==== Specific technical details of my nanotron ====
* motor for pressing menu is connected to motor slot 1
* motor for pressing select is connected to motor slot 2
* motor for pressing play is connected to motor slot 3
* all motors press the buttons when powered to the "upright" direction

=== TheSeven ===
[[File:Nanotron2G-TheSeven-1.jpg|200px]]
[[File:Nanotron2G-TheSeven-2.jpg|200px]]
[[File:Nanotron2G-TheSeven-3.jpg|200px]]
[[File:Nanotron2G-TheSeven-4.jpg|200px]]
[[File:Nanotron2G-TheSeven-5.jpg|200px]]

My Nanotron2G was designed as a hardware proof of concept, and as a development platform for the software (and thus was the first one to actually work). It's designed for a Nano 2G, but adapting it to other players should be easy. It also has the advantage that the Nano can easily be removed from it. This Nanotron will probably never do real bruteforcing work, though, as I currently don't have a player that hasn't already been cracked. It took me about 4 hours to design and build that. If you need information on how to build it, just ask. The pictures aren't up to date any more, as I have replaced parts of the front construction by technic bars for enhanced stability. The moving parts have stayed the same, though.
==== Specific technical details of my nanotron ====
* light sensor is connected to sensor port 1 and faced in direction of the screen (~1mm above it).
* motor for pressing the menu+select combo is connected to motor port A
* motor for pressing the select+play combo is connected to motor port C

=== cmwslw ===
[[File:IMG_0016.JPG|200px]]
[[File:IMG_0017.JPG|200px]]
[[File:IMG_0018.JPG|200px]]
[[File:IMG_0019.JPG|200px]]
[[File:IMG_0020.JPG|200px]]

My Nanotron is currently the only NXT-based one. I am working on the software for this using the nxt-python module. Instead of using diagonal rods to press buttons down, this uses 3 motors to use levers to press the buttons. It also has a light sensor (for backlight detection), and a touch sensor (for debugging and user intervention). Hopefully this design will prove to be very reliable.

=== tucenaber ===
[[File:Nanotron3g1.jpg|200px]]
[[File:Nanotron3g2.jpg|200px]]
[[File:Nanotron3g3.jpg|200px]]
[[File:Nanotron3g4.jpg|200px]]

This Nanotron is built from stuff I either had or could buy cheaply and is constructed for hacking the Nano 3G. The main parts are the servo motor and the Arduino microcontroller. Both are extremely cheap and the whole thing is powered entirely through USB. The two arms which rest on one rubber ring each, come from a bicycle wheel and as can be seen in the pictures they bent too easily and had to be reinforced by steel wire. One such ring, when placed correctly, is enough to push down two buttons on the iPod simultaneously. The servo was also not entirely up to the task which explains the complicated pulling arrangement. The Arduino program is five lines long, and on the whole it is extremely easy to set up.
The software is a slightly modified version of [[cmwslw]]'s code.

== Timings for resetting and rebooting iPods ==
{| class="wikitable"
|-
! Action
! Nano 4G
! Classic 2G
|-
| Reset
| 5 seconds
| 5 seconds
|-
| Reboot to main menu (cable disconnected)
| 17.5 seconds
| 28 seconds
|-
| Reboot to main menu (cable connected)
| 35 seconds
| 28 seconds
|-
| Reboot to disk mode (cable disconnected)
| 2-3 seconds
| 4-5 seconds
|-
| Reboot to disk mode (cable connected)
| 11 seconds
| 4-5 seconds
|-
|}

Using the times I've gathered, we can make a timeline of how our process will work, starting from disk mode:
# Take off old note file, put in new one (half a second)
# Hold down menu and select to reboot (5 seconds)
# Wait for boot (35 seconds)
# Find out what state the iPod is in and react accordingly (5 seconds if we have to force reboot)
# Boot to disk mode and start from beginning (11 seconds)

So the amount of time to test one file would take roughly 56.5 seconds (most likely 60 seconds with some delays in between). With that time we can test about 1440 files a day. With a 16-byte step (4 instructions, maybe we should do 2?) we could bust through a whopping 23040 bytes a day (0x5A00). Some addresses will have to be skipped for UTF-8 reasons.

We might end up having to try both the freeze and the crash files for the same address, which would double the time, but still be very practical.

TODO: work out ways from the robot's perspective to determine how the iPod reacts to the notes file. The easiest way seems to use the backlight, but this needs to be looked into. Perhaps we could use the iPod's USB status to tell...

=== Testing for freeze ===
'''This info is sort of outdated but possibly useful.'''

Currently, the easiest way to test for a working iPod is to look for a line similar to:
<pre>
[ 9275.123081] scsi 17:0:0:0: Direct-Access Apple iPod 1.62 PQ: 0 ANSI: 0
</pre>
in the kernel logs. There is a delay of a few seconds before this is displayed. Frozen iPods will either keep generating USB errors or show nothing at all (if the cable was plugged in late). Careful attention will need to be made to make sure past log entries do not interfere with the current test. Perhaps we could fiddle with the log level/verbosity to only show important info. If anyone knows an easier way to test this, let us know.

TODO: post kernel logs and investigate reboot log behavior

Address bruteforcing

2010-08-05T15:10:16Z

Cmwslw:

'''NOTICE: This process is no longer needed.''' Anybody left trying this is wasting their time, but we are preserving it for reference.

The best way people can help us out right now is by helping find the correct address we need to jump to in order to execute code. This has already been done on the 2G Nano and the 1G Classic. But now we really need help with the other iPods. Regardless of technical experience, anyone can help us out and get Rockbox and iPodLinux ported to the Nano's quicker. If you find the correct return address, you can rightfully brag about being the first person to run non-Apple code on that iPod :-). I'd also like to point out that your iPod cannot be bricked by this process and the Linux4nano team will gladly help you out on IRC if you encounter any problems.

== Setup ==
OK, so here's how to help out: first of all download a copy of [http://l4n.clustur.com/data/sweep/sweepfreeze.7z sweepfreeze.7z]. You will also need [http://l4n.clustur.com/data/sweep/sweepcrash.7z sweepcrash.7z]. Don't be fooled by the small sizes, because uncompressed these archives are ~250MB. Each one contains every return address that can possibly be jumped to. The best way to get the files is to just extract the files you need one by one, rather than the whole thing. Also update your iPod to the latest firmware (except for the 4G Nano - update or [[Firmware_Downgrading|downgrade]] to 1.0.3) because we want everyone to have the same version. Once you have these things set up, you are ready to go.

This process involves trying out various sweep files in the .7z archives. The files in sweepfreeze.7z will freeze if code has executed and the files in sweepcrash.7z will crash if code is executed. The files are .htm format. They are prefixed with either an 'a' or a 'b' and then the address they jump to. You should try only the A files for right now. As you can see, there are many sweep files, and only some of them will do anything interesting. If nobody has started on your iPod yet, start trying files starting at a080a2004.htm, otherwise continue where the others have left off.

Be sure to reserve a range for yourself to test in the table below. (we don't wont anyone doing the same files at the same time) Reserve small amounts at a time.

== Known problems ==
Note: if you are using your iPod with a Mac, your note files will not do anything. You will need to reformat the iPod to FAT32, and restore using iTunes on a Windows machine.

As stated above, this will not work with the 4G Nano with the 1.0.4 firmware or the 5G Nano. If you have 1.0.4, see [[Firmware_Downgrading|firmware downgrading]].

== Steps ==
# Connect your iPod to the computer if it isn't already and browse to it's Notes directory. Clear out any previous notes files and put a new one from the sweepfreeze.7z archive in there. Unmount your iPod and disconnect it.
# Reboot your iPod by holding the menu and center buttons for a few seconds. The apple logo will show while it is booting, and when the iPod is done booting you will see 1 of 4 scenarios:
## The iPod reboots automatically the instant the main menu is shown. This will lead to an endless reboot cycle until the note is taken off
## The iPod works completely normally. You can navigate menus, play music, etc. without any problems.
## The iPod seems to work normally ie. you can still navigate menus, but when you try to play a song it freezes or crashes
## The iPod freezes up entirely.
# The next step is to get into disk mode in order to remove the notes file. First, you need to reboot by holding menu+center. If your note causes a type #1 behavior, the iPod is always rebooting and you do not need to reboot manually. When the apple logo shows up, hold the play and center buttons until the disk mode screen comes up. Repeat these steps for the next file, but read the paragraph below first!

Most sweep files will usually either crash(#1) or freeze(#4). If you have one/s that is not either of these, record it in the table. If you have one that crashes, you will need to test the same address again with the sweepcrash.7z archive. If the iPod crashes or does anything different this time, it is a good sign that we have execution. Definitely record any of these incidents in the table!

== Table of reserved or tested files ==
{| class="wikitable"
|-
! Username
! iPod generation
! Firmware version
! Windows/Mac
! Starting filename
! Ending filename
! Status
|-
| Farthen
| 4G Nano
| 1.0.3
| Windows
| a080a2004.htm
| a080a4e04.htm
| Tested
|-
| watto
| 4G Nano
| 1.0.3
| Windows
| a080a4f04.htm
| a080b3f04.htm
| Tested
|-
| watto
| 4G Nano
| 1.0.3
| Windows
| a080b4004.htm
| a080b7f04.htm
| Reserved
|-
| kylemsguy
| 4G Nano
| 1.0.3
| Windows
| a080c0104.htm
| a080c1004.htm
| Tested
|-
| clueX
| 4G Nano
| 1.0.3
| Windows
| a080d0a04.htm
| a080d0f04.htm
| Tested (All #1)
|-
| clueX
| 4G Nano
| 1.0.3
| Windows
| a080d0104.htm
| a080d1004.htm
| Tested (All #1, except a080d0304 #4)
|-
| kylemsguy
| 4G Nano
| 1.0.3
| Windows
| a080d1104.htm
| a080d2f04.htm
| Reserved
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a08010b04.htm
| a08027f04.htm
| Tested
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a08050104.htm
| a08057f04.htm
| Tested
|-
| Eosphere46
| 3G Nano
| 1.1.3
| Windows
| a080a0a04
| a080a1904
| Tested Results Below
|-
| Eosphere46
| 3G Nano
| 1.1.3
| Windows
| a080a2004.htm
| a080a5904.htm
| Tested!
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a080a6104.htm
| a080c7f04.htm
| Tested
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a080d0104.htm
| a080d7f04.htm
| Tested
|-
| BlackLotus
| 3G Nano
| 1.1.3
| Windows
| a080e0104.htm
| a080e7f04.htm
| Reserved
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a080f0104.htm
| a080f7f04.htm
| Tested
|-
| JoeWheeler
| 3G Nano
| 1.1.3
| Windows
| a08100104.htm
| a08100904.htm
| Reserved
|}

== Table of non-#1 (or non-#4) behaviors ==
If you leave an entry in here and don't normally hang out on IRC, send your email address to me at (cwalker32 AT gmail DOT com). This will give us a way to contact you if necessary.
{| class="wikitable"
|-
! Username
! iPod generation
! Firmware version
! Windows/Mac
! Sweep filename
! Behavior type
! Notes
|-
| Sto
| 2G Nano
| 1.1.3
| Windows
| a08640568.htm
| #4
| Direct jump to buffer
|-
| 3mpty
| 1G Classic
| 1.0.3
| Windows
| a080a2004.htm
| #4
| Indirect - an ldmia instruction in firmware portion of ram jumps to the correct buffer location
|-
| PharaohsVizier
| 2G Classic
| 2.0.1
| Windows
| a09352f04.htm a09352a04.htm a09352b04.htm
| #2
| Unknown, definitely check this out
|-
| farthen, cmwslw, kylemsguy
| 4G Nano
| 1.0.4
| Windows/Mac
| All
| #2
| Not exploitable, as the bug is fixed in 1.0.4
|-
| farthen
| 4G Nano
| 1.0.3
| Mac
| All
| #2
| Not exploitable because it's a macpod
|-
| Superandy
| 3G Nano
| 1.1.3
| Windows
| a08010c04
| Freezes when I play a song - Please try a08010c04 from http://tinyurl.com/sweepdelay and post behavior :)
Ok, done that. It does the same thing, freezes. The 1st boot it froze stright away as soon as it loaded the album artwork for the menu. The second time it took about 10 seconds to freeze.
| Pretty cool
|-
| Jwnordquist
| 2G Nano
| latest
| Windows
| a08010404.htm a08010504.htm a08010d04.htm a08010e04.htm a08010f04.htm a08011204.htm a08011304.htm a08011404.htm a08011904.htm
| #4
|
|-
| Farthen
| 4G Nano
| 1.0.3
| Windows
| a080a2104.htm, a080a3b04.htm, a080a3e04.htm, a080a4604.htm, a080a4d04.htm
| #4
| I don't know why I record this, *maybe* it can help. Should be of no interest but who knows... Crasher files have same result as freezer.
|-
| Farthen
| 4G Nano
| 1.0.3
| Windows
| a080a2f04.htm, a080a3a04.htm,
| #2
| I don't know why I record this, *maybe* it can help. Should be of no interest but who knows... Crasher files have same result as freezer.
|-
| watto
| 4G Nano
| 1.0.3
| Windows
| a080a4f04.htm, a080a6c04 to a080a7504 inc.
| #4
| Same result with crash and freeze files.
|-
| watto
| 4G Nano
| 1.0.3
| Windows
| a080a5c04.htm
| #2
| Same result with crash and freeze files.
|-
| kylemsguy
| 4G Nano
| 1.0.3
| Windows
| a080c0304.htm
| #4
| The results for the sweep files were the same
|-
| Eosphere46
| 3G Nano
| 1.1.3
| Windows
| a080a3504.htm a080a0104.htm a080a0204.htm a080a0304.htm a080a0404.htm a080a0504.htm a080a0604.htm a080a0704.htm a080a0804.htm a080a0904.htm
| #4
| Same result with crash and freeze files, they both froze.
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a08012f04.htm a08013a04.htm a08015c04.htm a08022f04.htm a08023a04.htm a08025c04.htm
| #2
| Same result for both freeze & crash files
|-
| tucenaber
| 3G Nano
| 1.1.3
| Windows
| a08012b04.htm a08026104.htm
| #4 for sweepfreeze #1 for sweepcrash!
| Seems interesting to me but these are low addresses (below a080a2004)
|-
|Eosphere46
|3G Nano
|1.1.3
|Windows
|a080a2f04.htm a080a3a04.htm a080a5c04.htm
|#2 for sweepfreeze #2 for sweepcrash
|Probably nothing much, but check it out.
|-
|Eosphere46
|3G Nano
|1.1.3
|Windows
|a080a4b04.htm
|VERY Strange..hard to describe 1
|Check this out.. Same for the sweepcrash..
|-
|Eosphere46
|3G Nano
|1.1.3
|Windows
|a080a1004.htm
|#3
|Freezes when I play a song. Sweepcrash is #3 too. Sweepdelay is #3...
|-
|KAB123
|2G Classic
|2.0.1
|Windows
|09196804.htm 08334d04.htm
|#4 for sweepfreeze, #4 for sweepcrash.
|
|}

1 - I have added video demonstration, d00p3k: [http://www.youtube.com/watch?v=qPNLKXXpmMM]

Nano2G clock gates

2010-08-05T15:08:33Z

Cmwslw:

(State: When taking over from norboot, IIRC, needs verification. Beware: 1 = Masked, 0 = Running!)

===PWRCON===
{| class="wikitable"
! Bit !! State !! Meaning
|-
| 31
| 0
| Probably a padding bit
|-
| 30
| 0
| Probably a padding bit
|-
| 29
| 0
| Probably a padding bit
|-
| 28
| 0
| Probably a padding bit
|-
| 27
| 0
| Probably a padding bit
|-
| 26
| 0
| Probably a padding bit
|-
| 25
| 0
| Probably a padding bit
|-
| 24
| 0
| Probably a padding bit
|-
|
|
|
|-
| 23
| 0
| Probably a padding bit
|-
| 22
| 0
| RTC? (Datasheet)
|-
| 21
| 0
| SDRAM? (Datasheet)
|-
| 20
| 0
| ECC (Datasheet mismatch, proven to be ECC)
|-
| 19
| 1
| ATA? (Datasheet)
|-
| 18
| 1
| LCD? (Datasheet)
|-
| 17
| 1
| DSP? (Datasheet)
|-
| 16
| 0
| USBHOST? (Datasheet)
|-
|
|
|
|-
| 15
| 0
| USBFUNC? (Datasheet)
|-
| 14
| 1
| USB PHY
|-
| 13
| 1
| RTC? (Datasheet)
|-
| 12
| 1
| CHIPID? (Datasheet)
|-
| 11
| 0
| GPIO? (Datasheet)
|-
| 10
| 0
| ADC? (Datasheet)
|-
| 09
| 1
| SPI? (Datasheet)
|-
| 08
| 1
| UART? (Datasheet)
|-
|
|
|
|-
| 07
| 1
| SPDIF? (Datasheet)
|-
| 06
| 0
| I2S (Datasheet, verified)
|-
| 05
| 0
| I2C (Datasheet, verified)
|-
| 04
| 0
| TIMER (Datasheet, verified)
|-
| 03
| 0
| MEMSTICK? (Datasheet)
|-
| 02
| 0
| SDC/MMC? (Datasheet)
|-
| 01
| 0
| FMC? (Datasheet)
|-
| 00
| 0
| LCDC? (Datasheet)
|}

===PWRCONEXT===
{| class="wikitable"
! Bit !! State !! Meaning
|-
| 31
| 0
| Probably a padding bit
|-
| 30
| 0
| Probably a padding bit
|-
| 29
| 0
| Probably a padding bit
|-
| 28
| 0
| Probably a padding bit
|-
| 27
| 0
| Probably a padding bit
|-
| 26
| 0
| Probably a padding bit
|-
| 25
| 0
| Probably a padding bit
|-
| 24
| 0
| Probably a padding bit
|-
|
|
|
|-
| 23
| 0
| Probably a padding bit
|-
| 22
| 0
| Probably a padding bit
|-
| 21
| 0
| Probably a padding bit
|-
| 20
| 0
| Probably a padding bit
|-
| 19
| 0
| Probably a padding bit
|-
| 18
| 0
| Probably a padding bit
|-
| 17
| 0
| Probably a padding bit
|-
| 16
| 0
| Probably a padding bit
|-
|
|
|
|-
| 15
| 0
| Probably a padding bit
|-
| 14
| 0
| Probably a padding bit
|-
| 13
| 1
| Unknown
|-
| 12
| 0
| Unknown, but needs to be powered on
|-
| 11
| 1
| USB OTG
|-
| 10
| 1
| AES unit
|-
| 09
| 1
| Unknown
|-
| 08
| 1
| Unknown
|-
|
|
|
|-
| 07
| 0
| LCD SPI I/F
|-
| 06
| 0
| NAND/FMC
|-
| 05
| 1
| Unknown
|-
| 04
| 1
| Unknown
|-
| 03
| 1
| Unknown
|-
| 02
| 1
| Hashing unit
|-
| 01
| 1
| Unknown
|-
| 00
| 0
| Clickwheel?
|}

Dumping firmware

2010-08-05T15:07:16Z

Cmwslw: /* From the internet */

The first step to examining iPod's firmware is getting an image of it. You can retrieve either retrieve an image from the iPod or from the internet.

==From the iPod==
Getting a firmware dump is very easy in Linux. Just:

# Make sure the iPod is plugged in.
# Type "dd if=/dev/sdX1 of=dump.img" in the terminal, but make sure you edit the drive to match your configuration.
# A dump.img file should be created after a while. If you have a lot of data on your iPod, it can take a very long time.

==From the internet==
You can download pretty much every firmware version from http://www.felixbruns.de/iPod/firmware/. These files are called .ipsw files, but they are really .zip files in disguise. Open the .ipsw file as a .zip file, and you can view it's contents:

===1G-3G Nano firmware structure===
{| class="wikitable"
! Filename !! Description
|-
| Firmware-XX.X.X.X || The actual firmware file
|-
| manifest.plist || An XML file that gives basic info about the Firmware. Probably for iTunes.
|}

===4G Nano firmware structure===
The 4G Nanos seem to have a different structure with an interesting new file:
{| class="wikitable"
! Filename !! Description
|-
| Firmware.MSE || The actual firmware file
|-
| manifest.plist || An XML file that gives basic info about the Firmware. Probably for iTunes.
|-
| N58s.bootloader.release.rb3 || This is a very interesting new file that should be checked out! At the end there are clusters of strings that mention things like "Apple iPod Certification Authority", "S5L8720", and "Secure Boot". This means that the 4G uses the S5L8720 processor, the exact same as the iPod Touch 2G. It is also likely that the 4G Nano uses the same Secure Boot technology as iPhone's and iPod Touch's.
|}

You can copy over the firmware file and that is the same as extracting a dump.img file from the iPod.

==Helpful pages==
http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf

http://www.ipodlinux.org/wiki/Firmware

Status

2010-08-05T15:03:37Z

Cmwslw:

This status is based on the progress the Linux4nano team has made.

== Basic drivers or steps: ==
In semi-chronological order:
{| class="wikitable"
! !! [[Nano 2G]] !! [[Nano 3G]] !! [[Nano 4G]] !! [[Nano 5G]] !! [[Classic 1G]] (80/160thick) !! [[Classic 2G]] (120) !! [[Classic 3G]] (160thin)
|-
| Code execution
| '''Yes'''
| '''Yes'''
| '''Yes'''
| '''Needs new exploit'''
| '''Yes'''
| '''Yes'''
| '''Yes'''
|-
| UART
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''Yes'''
| '''No'''
| '''No'''
|-
| USB
| '''Yes'''
| '''Yes'''
| '''Yes'''
| '''No'''
| '''Work in progress'''
| '''Work in progress'''
| '''Work in progress'''
|-
| iBugger
| '''Yes'''
| '''Minimalistic SRAMbugger loader'''
| '''Yes'''
| '''No'''
| '''Work in progress'''
| '''Work in progress'''
| '''Work in progress'''
|-
| I2C
| '''Yes'''
| '''No'''
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Backlight
| '''Yes'''
| '''No'''
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| LCD
| '''Yes'''
| '''No'''
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Piezo
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Clickwheel
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Audio
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| NAND/Hard Drive
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Power management
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Firmware encryption
| '''Yes'''
| '''No'''
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Accelerometer
| '''N/A'''
| '''N/A'''
| '''Yes'''
| '''No'''
| '''N/A'''
| '''N/A'''
| '''N/A'''
|}

== Custom firmware ==
{| class="wikitable"
! !! [[Nano 2G]] !! [[Nano 3G]] !! [[Nano 4G]] !! [[Nano 5G]] !! [[Classic 1G]] (80/160thick) !! [[Classic 2G]] (120) !! [[Classic 3G]] (160thin)
|-
| Bootloader
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Rockbox
| '''Mostly working''', see [http://www.rockbox.org/wiki/IPodNano2GPort here]
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Linux
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Uncap
| '''Yes''', see [http://l4n.clustur.com/index.php/ILoader_howto#Uncapping here]
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-

Contributing

2010-08-05T00:36:15Z

Cmwslw: /* Testing */

The first question people generally ask about this project is, "How can I help out?". Here are some ways someone can be useful to the project:
==Developing==
This is perhaps the most valuable way one can help the project. We get many people who want to help with development but they don't have the necessary skills. If you don't, think of it as an opportunity to learn new and worthwhile skills instead of a roadblock. After all, the best way to learn is in the field doing real work. Here are some topics that developers need to know about:
*'''ARM assembly''' - this is probably the hardest topic for beginners to grasp. Resources:
**[http://simplemachines.it/doc/arm_inst.pdf an ARM primer]
**[http://simplemachines.it/doc/QRC0001H_rvct_v2.1_arm.pdf ARM Quick Ref]
**[http://www.lysator.liu.se/~kjell-e/embedded/ARM-ARM.pdf ARM ARM]
**http://simplemachines.it has great resources for learning ARM
*'''C''' - Used whenever we can avoid using ARM assembly.
*'''Python''' - Python is used often for various scripts we write.
==Vulnerabilities==
If you've ever found a way to get your iPod to crash by corrupting things or inputting weird things, we could use the info to see if the bug is a vulnerability. Some examples of bugs like this are the [[Notes vulnerability]] and the [[Pwnage 2.0]] vulnerability. Right now, we mostly need this for the [[Nano 5G]] since we have no means of execution on that device. If you do find such a bug, report it via private message on IRC to a main developer. DO NOT, I repeat, DO NOT, exclaim the bug to the world on a public IRC channel or mailing list. We made this mistake with the [[Notes vulnerability]]. As a result, Apple patched it on the [[Nano 4G]] and even patched the original firmware on the [[Nano 5G]] (thus making it impossible to downgrade to a vulnerable firmware).
==Writing guides==
Another way to help out is writing guides like these on the Wiki. Make it easier for new users to get information.
==Testing==
Testers are always good to have, and its also a good way to help out if you don't want to spend much time on the project or don't know much about development. Developers, however, will get tired of working with you if you are clueless about how everything works, so make sure you have a good understanding about the tools you're testing. Besides we already have a lot of [[Willing testers]] already.

Contributing

2010-08-05T00:35:42Z

Cmwslw:

Contributing

2010-08-05T00:27:13Z

Cmwslw:

Contributing

2010-08-04T22:41:49Z

Cmwslw: Created page with 'The first question people generally ask about this project is, "How can I help out?". Here are some ways someone can be useful to the project: ==Developing== This is perhaps the ...'

Main Page

2010-08-04T19:35:41Z

Cmwslw: /* Project info */

__NOTOC__
[[File:4g_ibugger.jpg|115px|thumb|right|iBugger on the 4G Nano]]
This is the wiki for the Linux4nano project. Linux4nano has a fairly active IRC channel, [irc://irc.freenode.net/linux4nano-dev #linux4nano-dev] on Freenode for development related discussion. Please save questions and comments for [irc://irc.freenode.net/linux4nano #linux4nano]. There is a [http://home.gna.org/linux4nano/ project homepage] and a [http://mail.gna.org/public/linux4nano-dev/ mailing list], but these two are rarely updated.

==Updates==
*2010/08/03 - We can now access the Nano 4G accelerometer.
*2010/08/02 - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].
*2010/08/01 - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.
*2010/07/27 - The server got zapped by lightning but a new one was up and running within a day.
*2010/02/23 - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!
*2009/11/01 - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]
*2009/10/26 - USB now (somewhat) functional on [[Nano 4G]] via iBugger! This will be used instead of UART to dump memories.
*2009/10/07 - RB for [[Nano 2G]] is close to being stable. Working on UART for 4G - anyone have an iPT 2G+know about ARM7_go? Hop on #linux4nano-dev if you do

Follow [http://twitter.com/linux4nano our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contributing ]]
* [[ Todo list ]]
* [[ Willing testers]]
* [[ Project summary ]]

===Released Software===
* [[iLoader]]
** [[iLoader howto]]
** [[iLoader themes]]
** [[iLoader testing results]]
* [[iBugger]]
===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Software efforts===
* [[Firmware]]
* [[Bootstrapping sequence]]
* [[Firmware decryption]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware efforts===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]
* [[S5L8700 datasheet]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

Main Page

2010-08-03T20:49:15Z

Cmwslw: /* Updates */

__NOTOC__
[[File:4g_ibugger.jpg|115px|thumb|right|iBugger on the 4G Nano]]
This is the wiki for the Linux4nano project. Linux4nano has a fairly active IRC channel, [irc://irc.freenode.net/linux4nano-dev #linux4nano-dev] on Freenode for development related discussion. Please save questions and comments for [irc://irc.freenode.net/linux4nano #linux4nano]. There is a [http://home.gna.org/linux4nano/ project homepage] and a [http://mail.gna.org/public/linux4nano-dev/ mailing list], but these two are rarely updated.

==Updates==
*2010/08/03 - We can now access the Nano 4G accelerometer.
*2010/08/02 - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].
*2010/08/01 - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.
*2010/07/27 - The server got zapped by lightning but a new one was up and running within a day.
*2010/02/23 - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!
*2009/11/01 - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]
*2009/10/26 - USB now (somewhat) functional on [[Nano 4G]] via iBugger! This will be used instead of UART to dump memories.
*2009/10/07 - RB for [[Nano 2G]] is close to being stable. Working on UART for 4G - anyone have an iPT 2G+know about ARM7_go? Hop on #linux4nano-dev if you do

Follow [http://twitter.com/linux4nano our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Todo list ]]
* [[ Willing testers]]
* [[ Project summary ]]
===Released Software===
* [[iLoader]]
** [[iLoader howto]]
** [[iLoader themes]]
** [[iLoader testing results]]
* [[iBugger]]
===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Software efforts===
* [[Firmware]]
* [[Bootstrapping sequence]]
* [[Firmware decryption]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware efforts===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]
* [[S5L8700 datasheet]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

Status

2010-08-03T19:32:16Z

Cmwslw: /* Basic drivers or steps: */

This status is based on the progress the Linux4nano team has made.

== Basic drivers or steps: ==
In semi-chronological order:
{| border="1" cellpadding="5" cellspacing="0"
! !! [[Nano 2G]] !! [[Nano 3G]] !! [[Nano 4G]] !! [[Nano 5G]] !! [[Classic 1G]] (80/160thick) !! [[Classic 2G]] (120) !! [[Classic 3G]] (160thin)
|-
| Code execution
| '''Yes'''
| '''Yes'''
| '''Yes'''
| '''Needs new exploit'''
| '''Yes'''
| '''Yes'''
| '''Yes'''
|-
| UART
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''Yes'''
| '''No'''
| '''No'''
|-
| USB
| '''Yes'''
| '''Yes'''
| '''Yes'''
| '''No'''
| '''Work in progress'''
| '''Work in progress'''
| '''Work in progress'''
|-
| iBugger
| '''Yes'''
| '''Minimalistic SRAMbugger loader'''
| '''Yes'''
| '''No'''
| '''Work in progress'''
| '''Work in progress'''
| '''Work in progress'''
|-
| I2C
| '''Yes'''
| '''No'''
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Backlight
| '''Yes'''
| '''No'''
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| LCD
| '''Yes'''
| '''No'''
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Piezo
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Clickwheel
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Audio
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| NAND/Hard Drive
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Power management
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Firmware encryption
| '''Yes'''
| '''No'''
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Accelerometer
| '''N/A'''
| '''N/A'''
| '''Yes'''
| '''No'''
| '''N/A'''
| '''N/A'''
| '''N/A'''
|}

== Custom firmware ==
{| border="1" cellpadding="5" cellspacing="0"
! !! [[Nano 2G]] !! [[Nano 3G]] !! [[Nano 4G]] !! [[Nano 5G]] !! [[Classic 1G]] (80/160thick) !! [[Classic 2G]] (120) !! [[Classic 3G]] (160thin)
|-
| Bootloader
| '''Yes'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Rockbox
| '''Mostly working''', see [http://www.rockbox.org/wiki/IPodNano2GPort here]
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Linux
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-
| Uncap
| '''Yes''', see [http://l4n.clustur.com/index.php/ILoader_howto#Uncapping here]
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
| '''No'''
|-

IBugger

2010-08-03T17:22:55Z

Cmwslw:

[[File:iBL_greeting.jpg|150px|thumb|right|iBugger Loader]]
'''Starting August 3, 2010, development of iBugger has stopped in favor of a more useful debugger in [[emBIOS]].''' The two iBugger utilities use a Python script that handles USB communication with the iPod.
===iBugger Loader===
iBugger Loader is the loader for iBugger, a debugger written by TheSeven. It is a .htm file invoked via the notes exploit. iBugger Loader allows code to be uploaded and data to be dumped through USB. The most recent released version of the iBugger package is located [http://bit.ly/oXZRO here]. iBugger Loader can also be used to upload arbitrary unsigned code without space restrictions (besides RAM size), and it removes the hassle of having to boot to disk mode all the time to upload new code.

You can think of iBugger Loader as a simplified version of iBugger that can fit in a notes file. While it is useful for simple operations, its main purpose is to load the iBugger Core. There are iBugger Loader releases for the 2G and 4G Nanos.
===iBugger (Core)===
[[File:iBL_logo.jpg|150px|thumb|right|iBugger]]
iBugger aims to be a fully-featured debugger on the iPod. It is sent to iBugger Loader via USB.
Current features are:
* Up- and downloading memory regions
* Executing uploaded code
* Dumping the processor's registers
* Halting the program and showing/modifying registers and/or memory contents
* Catching prefetch aborts, data aborts and undefined instruction exceptions, and keeping record of the register contents at the time the abort occurred
* Debugging console (printf and other functions available to uploaded code, which will print via USB to a console on the attached PC. The client (PC) side is still read-only, but the core would support a bidirectional console. Feel free to add this on the PC side)
* Very little changes needed to the code being debugged, to allow running it in iBugger

There are iBugger Loader releases for the 2G and 4G Nanos.

Main Page

2010-08-03T01:06:02Z

Cmwslw: /* Hardware efforts */

__NOTOC__
[[File:4g_ibugger.jpg|115px|thumb|right|iBugger on the 4G Nano]]
This is the wiki for the Linux4nano project. Linux4nano has a fairly active IRC channel, [irc://irc.freenode.net/linux4nano-dev #linux4nano-dev] on Freenode for development related discussion. Please save questions and comments for [irc://irc.freenode.net/linux4nano #linux4nano]. There is a [http://home.gna.org/linux4nano/ project homepage] and a [http://mail.gna.org/public/linux4nano-dev/ mailing list], but these two are rarely updated.

==Updates==
*2010/08/02 - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].
*2010/08/01 - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.
*2010/07/27 - The server got zapped by lightning but a new one was up and running within a day.
*2010/02/23 - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!
*2009/11/01 - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]
*2009/10/26 - USB now (somewhat) functional on [[Nano 4G]] via iBugger! This will be used instead of UART to dump memories.
*2009/10/07 - RB for [[Nano 2G]] is close to being stable. Working on UART for 4G - anyone have an iPT 2G+know about ARM7_go? Hop on #linux4nano-dev if you do
*2009/09/16 - We now have code execution on the [[Nano 4G]]! Also, *VERY* primitive Rockbox running on [[Nano 2G]].

'''[[iLoader]] needs beta-testers ([[Nano 2G]])!'''

Follow [http://twitter.com/linux4nano our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Todo list ]]
* [[ Willing testers]]
* [[ Project summary ]]
===Released Software===
* [[iLoader]]
** [[iLoader howto]]
** [[iLoader themes]]
** [[iLoader testing results]]
* [[iBugger]]
===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Software efforts===
* [[Firmware]]
* [[Bootstrapping sequence]]
* [[Firmware decryption]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware efforts===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]
* [[S5L8700 datasheet]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

S5L8700 datasheet

2010-08-03T01:04:45Z

Cmwslw:

[[Image:8700 ball layout.png|thumb|S5L8700 ball layout (not the iPod's, though)]]
The datasheet for the S5L8700X was found [http://rapidshare.com/files/101234522/S5L8700X-DS.pdf.html here]. It matches the [http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=136&partnum=K4M56163PG official Samsung 8700 info page]. The datasheet describes every pin (page 1-5) and instruction (page 3-1) of the 8700 series in detail.
==Package differences==
The pin locations described in the datasheet are not the actual locations for the iPod's [http://www.samsung.com/global/business/semiconductor/support/PackageInformation/downloads/SystemLSI/FBGA/226_FBGA_0909_08_05.pdf 226-pin FBGA] version. [http://www.meizume.com/rockbox/5797-technical-information-s5l8700x07-sip.html This forum thread] describes the pinout of another S5L8700 package in another device (see right for ball layout).
==Helpful pages==
http://www.samsung.com/global/business/semiconductor/support/PackageInformation/download_FBGA.html
http://www.rockbox.org/twiki/bin/view/Main/SamsungSA58#SA58700_codename_Blues

Main Page

2010-08-03T00:58:25Z

Cmwslw: /* Updates */

__NOTOC__
[[File:4g_ibugger.jpg|115px|thumb|right|iBugger on the 4G Nano]]
This is the wiki for the Linux4nano project. Linux4nano has a fairly active IRC channel, [irc://irc.freenode.net/linux4nano-dev #linux4nano-dev] on Freenode for development related discussion. Please save questions and comments for [irc://irc.freenode.net/linux4nano #linux4nano]. There is a [http://home.gna.org/linux4nano/ project homepage] and a [http://mail.gna.org/public/linux4nano-dev/ mailing list], but these two are rarely updated.

==Updates==
*2010/08/02 - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].
*2010/08/01 - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.
*2010/07/27 - The server got zapped by lightning but a new one was up and running within a day.
*2010/02/23 - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!
*2009/11/01 - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]
*2009/10/26 - USB now (somewhat) functional on [[Nano 4G]] via iBugger! This will be used instead of UART to dump memories.
*2009/10/07 - RB for [[Nano 2G]] is close to being stable. Working on UART for 4G - anyone have an iPT 2G+know about ARM7_go? Hop on #linux4nano-dev if you do
*2009/09/16 - We now have code execution on the [[Nano 4G]]! Also, *VERY* primitive Rockbox running on [[Nano 2G]].

'''[[iLoader]] needs beta-testers ([[Nano 2G]])!'''

Follow [http://twitter.com/linux4nano our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Todo list ]]
* [[ Willing testers]]
* [[ Project summary ]]
===Released Software===
* [[iLoader]]
** [[iLoader howto]]
** [[iLoader themes]]
** [[iLoader testing results]]
* [[iBugger]]
===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Software efforts===
* [[Firmware]]
* [[Bootstrapping sequence]]
* [[Firmware decryption]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware efforts===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

Main Page

2010-08-03T00:54:11Z

Cmwslw: /* Updates */

__NOTOC__
[[File:4g_ibugger.jpg|115px|thumb|right|iBugger on the 4G Nano]]
This is the wiki for the Linux4nano project. Linux4nano has a fairly active IRC channel, [irc://irc.freenode.net/linux4nano-dev #linux4nano-dev] on Freenode for development related discussion. Please save questions and comments for [irc://irc.freenode.net/linux4nano #linux4nano]. There is a [http://home.gna.org/linux4nano/ project homepage] and a [http://mail.gna.org/public/linux4nano-dev/ mailing list], but these two are rarely updated.

==Updates==
*2010/08/02 - serpilliere managed to decrypt the NOR flash on the Nano 3G.
*2010/08/01 - serpilliere managed to access and dump the NOR flash on the Nano 3G. This code could possibly work on the Classics.
*2010/07/27 - The server got zapped by lightning but a new one was up and running within a day.
*2010/02/23 - We can now execute code on everything besides the 5th generation iPod Nano! Minimalistic iBugger working on Nano 3G!
*2009/11/01 - iBugger core v0.1 successfully running on 4G nano! [http://img217.imageshack.us/img217/4122/img0969.jpg]
*2009/10/26 - USB now (somewhat) functional on 4G Nano via iBugger! This will be used instead of UART to dump memories.
*2009/10/07 - RB for 2G Nano is close to being stable. Working on UART for 4G - anyone have an iPT 2G+know about ARM7_go? Hop on #linux4nano-dev if you do
*2009/09/16 - We now have code execution on the 4G Nano! Also, *VERY* primitive Rockbox running on 2G Nano.

'''[[iLoader]] needs beta-testers (Nano 2G)!'''

Follow [http://twitter.com/linux4nano our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Todo list ]]
* [[ Willing testers]]
* [[ Project summary ]]
===Released Software===
* [[iLoader]]
** [[iLoader howto]]
** [[iLoader themes]]
** [[iLoader testing results]]
* [[iBugger]]
===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Software efforts===
* [[Firmware]]
* [[Bootstrapping sequence]]
* [[Firmware decryption]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware efforts===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

Main Page

2010-08-03T00:49:56Z

Cmwslw: /* Software efforts */

__NOTOC__
[[File:4g_ibugger.jpg|115px|thumb|right|iBugger on the 4G Nano]]
This is the wiki for the Linux4nano project. Linux4nano has a fairly active IRC channel, [irc://irc.freenode.net/linux4nano-dev #linux4nano-dev] on Freenode for development related discussion. Please save questions and comments for [irc://irc.freenode.net/linux4nano #linux4nano]. There is a [http://home.gna.org/linux4nano/ project homepage] and a [http://mail.gna.org/public/linux4nano-dev/ mailing list], but these two are rarely updated.

==Updates==
*2010/08/01 - serpilliere managed to access and dump the SPI flash on the Nano 3G. This code could possibly work on the Classics.
*2010/07/27 - The server got zapped by lightning but a new one was up and running within a day.
*2010/02/23 - We can now execute code on everything besides the 5th generation iPod Nano! Minimalistic iBugger working on Nano 3G!
*2009/11/01 - iBugger core v0.1 successfully running on 4G nano! [http://img217.imageshack.us/img217/4122/img0969.jpg]
*2009/10/26 - USB now (somewhat) functional on 4G Nano via iBugger! This will be used instead of UART to dump memories.
*2009/10/07 - RB for 2G Nano is close to being stable. Working on UART for 4G - anyone have an iPT 2G+know about ARM7_go? Hop on #linux4nano-dev if you do
*2009/09/16 - We now have code execution on the 4G Nano! Also, *VERY* primitive Rockbox running on 2G Nano.
*2009/09/15 - Guide for installing iLoader on any 2G: http://bit.ly/2K6hHy
*2009/09/06 - Working dual-booting bootloader for 2G! Also, read only FTL support, and 2nd Nanotron about to be running.

'''[[iLoader]] needs beta-testers (Nano 2G)!'''

Follow [http://twitter.com/linux4nano our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Todo list ]]
* [[ Willing testers]]
* [[ Project summary ]]
===Released Software===
* [[iLoader]]
** [[iLoader howto]]
** [[iLoader themes]]
** [[iLoader testing results]]
* [[iBugger]]
===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Software efforts===
* [[Firmware]]
* [[Bootstrapping sequence]]
* [[Firmware decryption]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware efforts===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

Firmware decryption

2010-08-03T00:48:27Z

Cmwslw: /* Prerequisites */

==Background==
Encrypting the firmware started with the release of iPod 4G. Only the AUPD part is encrypted, it uses RC4 encryption and the key is contained within the firmware. The iPodLinux project has more information about understanding and decrypting it: http://ipodlinux.org/wiki/Flash_Decryption

Starting with [[Nano 2G]], the encryption method changed. The best guess so far is that the encryption is AES-CBC with 128-bit blocks and a 128-bit key. The key isn't found yet, but it is not needed to decrypt the firmware.

After discovering the notes exploit, it became possible to upload and execute custom code on the ipods. TheSeven wrote an utility (ipodcrypt.py), which allows decrypting parts of the firmware using the iPod's crypto engine. The utility is being loaded via [[iBugger]] in the iPod's memory, then the encrypted data is being send. After the decryption process completes, the decrypted data is downloaded.
==ipodcrypt==
The ipodcrypt utility has the following features:

for [[Nano 2G]]:

*encrypt/decrypt DFU image
*encrypt/decrypt firmware file contents
*encrypt/decrypt dump of NOR flash's contents

for [[Nano 4G]]:

*decrypt firmware file contents

The process of decrypting is taking part on the iPod itself, so you must have a compatible device in order to use the utility. Also, you must run the iBugger utility on the device before using ipodcrypt.

You can find both utilities in the development snapshot, which is located on the iLoader homepage: http://the-seven.tk/ipod/iloader/sourcecode.php

In order to run these utilities, you will need the Python interpreter installed, the pyUSB module and libusb. It is possible to run the utilities on both Windows and Linux.
==Prerequisites==
===Windows===
First you need TheSeven's iBugger USB driver (http://l4n.clustur.com/data/theseven/releases/iBugger%20Windows%20Driver.7z). It uses libusb-win32 1.1.x. (see notes below)

Next, you need ActivePython (http://www.activestate.com/activepython) or another Python distribution for Windows. You can get ActivePython's latest version at: http://www.activestate.com/activepython/downloads

You also need [http://pyusb.sourceforge.net/ pyUSB] - a Python module for communicating with USB devices. Its download page is: You can get it from the [http://sourceforge.net/projects/pyusb/files/ download page] or [http://developer.berlios.de/project/showfiles.php?group_id=4354 another mirror]. The 0.x branch is compatible with the libusb version included TheSeven's iBugger driver.

'''Important note''': If you are using Windows Vista/7, you'll need the signed (1.2.x) version of libusb-win32. Otherwise the driver will install (after confirmation that it is unsigned), but it will not load unless you disable driver signature check, which is not recommended.

To use the 1.2.x version, you need to extract in the folder where you extracted the iBugger driver, then overwrite the .dll and .sys with the ones in 1.2.x package. Installing the driver then is as usual.

'''Important note 2''': You may need to kill iTunes's iPod service if you have iTunes installed, and to uninstall the iPod drivers that iTunes installed, before following the above instructions
===Linux===
Python is usually included in most distributions, so you don't need to worry about installing it. If you have easy_install, you can install pyUSB with:
<pre>
easy_install install pyusb
</pre>
Otherwise, you need to download it and install it manually as in the Windows instructions.

To install libusb, you need to use your distribution's package management utility and look for libusb, then install it.
===Mac OS X===
(to be added later)

==Helpful pages==
http://ipodlinux.org/wiki/Flash_Decryption

http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf

http://code.google.com/p/iphone-elite/w/list

http://code.google.com/p/chronicdev/w/list

http://wikee.iphwn.org/

http://iphonejtag.blogspot.com/

Firmware decryption

2010-08-03T00:39:52Z

Cmwslw:

==Background==
Encrypting the firmware started with the release of iPod 4G. Only the AUPD part is encrypted, it uses RC4 encryption and the key is contained within the firmware. The iPodLinux project has more information about understanding and decrypting it: http://ipodlinux.org/wiki/Flash_Decryption

Starting with [[Nano 2G]], the encryption method changed. The best guess so far is that the encryption is AES-CBC with 128-bit blocks and a 128-bit key. The key isn't found yet, but it is not needed to decrypt the firmware.

After discovering the notes exploit, it became possible to upload and execute custom code on the ipods. TheSeven wrote an utility (ipodcrypt.py), which allows decrypting parts of the firmware using the iPod's crypto engine. The utility is being loaded via [[iBugger]] in the iPod's memory, then the encrypted data is being send. After the decryption process completes, the decrypted data is downloaded.
==ipodcrypt==
The ipodcrypt utility has the following features:

for [[Nano 2G]]:

*encrypt/decrypt DFU image
*encrypt/decrypt firmware file contents
*encrypt/decrypt dump of NOR flash's contents

for [[Nano 4G]]:

*decrypt firmware file contents

The process of decrypting is taking part on the iPod itself, so you must have a compatible device in order to use the utility. Also, you must run the iBugger utility on the device before using ipodcrypt.

You can find both utilities in the development snapshot, which is located on the iLoader homepage: http://the-seven.tk/ipod/iloader/sourcecode.php

In order to run these utilities, you will need the Python interpreter installed, the pyUSB module and libusb. It is possible to run the utilities on both Windows and Linux.
==Prerequisites==
===Windows===
First you need TheSeven's iBugger USB driver (http://l4n.clustur.com/data/theseven/releases/iBugger%20Windows%20Driver.7z). It uses libusb-win32 1.1.x. (see notes below)

Next, you need ActivePython (http://www.activestate.com/activepython) or another Python distribution for Windows. You can get ActivePython's latest version at: http://www.activestate.com/activepython/downloads

You also need pyUSB (http://pyusb.sourceforge.net/) - a Python module that provides command for communicating with USB devices. Its download page is: http://sourceforge.net/projects/pyusb/files/ (newer versions) or http://developer.berlios.de/project/showfiles.php?group_id=4354 (another mirror). The 0.x branch is compatible with the libusb version included TheSeven's iBugger driver.

Important note:
If you are using Windows Vista/7, you'll need the signed (1.2.x) version of libusb-win32. Otherwise the driver will install (after confirmation that it is unsigned), but it will not load unless you disable driver signature check, which is not recommended.

To use the 1.2.x version, you need to extract in the folder where you extracted the iBugger driver, then overwrite the .dll and .sys with the ones in 1.2.x package. Installing the driver then is as usual.

Important note 2:
You may need to kill iTunes's iPod service if you have iTunes installed, and to uninstall the iPod drivers that iTunes installed, before following the above instructions
===Linux===
Python is usually included in most distributions, so you don't need to worry about installing it. If you have easy_install, you can install pyUSB with:

easy_install install pyusb

Otherwise, you need to download it and install it manually as in the Windows instructions.

To install libusb, you need to use your distribution's package management utility and look for libusb, then install it.
===Mac OS X===
(to be added later)
==Helpful pages==
http://ipodlinux.org/wiki/Flash_Decryption

http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf

http://code.google.com/p/iphone-elite/w/list

http://code.google.com/p/chronicdev/w/list

http://wikee.iphwn.org/

http://iphonejtag.blogspot.com/

Firmware decryption

2010-08-03T00:37:28Z

Cmwslw:

==Background==
Encrypting the firmware started with the release of iPod 4G. Only the AUPD part is encrypted, it uses RC4 encryption and the key is contained within the firmware. The iPodLinux project has more information about understanding and decrypting it: http://ipodlinux.org/wiki/Flash_Decryption

Starting with [[Nano 2G]], the encryption method changed. The best guess so far is that the encryption is AES-CBC with 128-bit blocks and a 128-bit key. The key isn't found yet, but it is not needed to decrypt the firmware.

After discovering the notes exploit, it became possible to upload and execute custom code on the ipods. TheSeven wrote an utility (ipodcrypt.py), which allows decrypting parts of the firmware using the iPod's crypto engine. The utility is being loaded via [[iBugger]] in the iPod's memory, then the encrypted data is being send. After the decryption process completes, the decrypted data is downloaded.
==ipodcrypt==
The ipodcrypt utility has the following features:

for [[Nano 2G]]:

*encrypt/decrypt DFU image
*encrypt/decrypt firmware file contents
*encrypt/decrypt dump of NOR flash's contents

for [[Nano 4G]]:

*decrypt firmware file contents

The process of decrypting is taking part on the iPod itself, so you must have a compatible device in order to use the utility. Also, you must run the iBugger utility on the device before using ipodcrypt.

You can find both utilities in the development snapshot, which is located on the iLoader homepage: http://the-seven.tk/ipod/iloader/sourcecode.php

In order to run these utilities, you will need the Python interpreter installed, the pyUSB module and libusb. It is possible to run the utilities on both Windows and Linux.

Windows

First you need TheSeven's iBugger USB driver (http://l4n.clustur.com/data/theseven/releases/iBugger%20Windows%20Driver.7z). It uses libusb-win32 1.1.x. (see notes below)

Next, you need ActivePython (http://www.activestate.com/activepython) or another Python distribution for Windows. You can get ActivePython's latest version at: http://www.activestate.com/activepython/downloads

You also need pyUSB (http://pyusb.sourceforge.net/) - a Python module that provides command for communicating with USB devices. Its download page is: http://sourceforge.net/projects/pyusb/files/ (newer versions) or http://developer.berlios.de/project/showfiles.php?group_id=4354 (another mirror). The 0.x branch is compatible with the libusb version included TheSeven's iBugger driver.

Important note:
If you are using Windows Vista/7, you'll need the signed (1.2.x) version of libusb-win32. Otherwise the driver will install (after confirmation that it is unsigned), but it will not load unless you disable driver signature check, which is not recommended.

To use the 1.2.x version, you need to extract in the folder where you extracted the iBugger driver, then overwrite the .dll and .sys with the ones in 1.2.x package. Installing the driver then is as usual.

Important note 2:
You may need to kill iTunes's iPod service if you have iTunes installed, and to uninstall the iPod drivers that iTunes installed, before following the above instructions

Linux

Python is usually included in most distributions, so you don't need to worry about installing it. If you have easy_install, you can install pyUSB with:

easy_install install pyusb

Otherwise, you need to download it and install it manually as in the Windows instructions.

To install libusb, you need to use your distribution's package management utility and look for libusb, then install it.

Mac OS X

(to be added later)

==Helpful pages==
http://ipodlinux.org/wiki/Flash_Decryption

http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf

http://code.google.com/p/iphone-elite/w/list

http://code.google.com/p/chronicdev/w/list

http://wikee.iphwn.org/

http://iphonejtag.blogspot.com/