freemyipod - User contributions [en]

EmCORE Installation/iPodClassic/DFUiTunes

2012-01-16T14:53:37Z

Farthen:

* Download [http://files.freemyipod.org/misc/bootstrap_ipodclassic_itunes.exe this] file
* Connect your iPod to your computer
* Make sure iTunes is closed
* Kill "AppleMobileDeviceService.exe" using the task manager
** Open the task manager (press CTRL + SHIFT + ESC)
** Click on the "Processes" tab
** Choose "AppleMobileDeviceService.exe"
** Press the "End Process" button
** Press "End Process" to confirm
* Do the same for "iTunesHelper.exe"
* Make sure the hold switch is not locked
* Press and hold the menu and select buttons for between 10 and 15 seconds (The iPod will show an apple logo after about 5 seconds, keep holding the buttons until it seems to turn off completely)

The display of your iPod should now stay black, and a new USB device called "Apple Recovery (DFU) USB Driver" should connect to your PC.

* Wait for the driver installation to complete
* Run bootstrap_ipodclassic_itunes.exe

Your iPod should now turn on and connect a 64MB drive called "UMSboot". If it doesn't, please ask for [[Contact|support]].

* [[EmCORE Installation/iPodClassic/UMSboot|Next step]]

2011-08-25T12:51:41Z

2011-05-01T13:04:54Z

Farthen:

iPods have special modes that they can boot into called disk mode, DFU mode, and debug mode.

==Disk mode==
Disk mode has existed ever since the iPod has existed. Disk mode is stored in different locations (depends on the iPod model). Disk mode basically makes the iPod behave as a massive storage device, allowing the computer to directly read and write the data flash chip. For more information on how to enter Disk mode, refer to [http://support.apple.com/kb/ht1363 this Apple support document].

[[Image:Diskmode.jpg]]

([http://www.ipodlinux.org/ iPodLinux project])

==DFU mode==
DFU (Device Firmware Upgrade) mode is a relatively new standard for upgrading firmware that is used in many devices like the OpenMoko and the newer iPods. DFU mode (since nano 2G) is contained in the on-processor bootrom. Newer iPods have both DFU mode and disk mode, while iPod Touch and iPhones have exclusively DFU mode. It is worth noting that DFU mode was implemented at the exact time that Apple switched from PortalPlayer to Samsung processors.

The Nano 2G also has a DFU mode, but this mode can only be entered by shorting testpoints on the circuit board or flashing the NOR with an image with a wrong signature/hash. There's a NOR DFU mode though, that can be entered by holding down BACK+PLAY right after rebooting the device.

===Getting DFU mode on iPod Classic, Nano 3G and newer ===
# Make sure your iPod is turned on and connected to your computer.
# Press and hold the menu and select buttons for between 10 and 15 seconds (The iPod starts to reboot after about 5 seconds, keep holding the buttons until it seems to turn off completely)
# The display of your iPod should now stay black, and a new USB device called "USB DFU Device" should connect to your PC.

You can use lsusb to determine if your iPod is in DFU mode. 05ac is the Vendor ID (Apple), and the number after the colon is the Product ID. The Product ID depends on whether the iPod is in DFU mode or not. Here is a table of Product IDs:
{| class="wikitable"
! Device !! Normal !! DFU !! WTF
|-
| Nano 2G
| 1260
| 1220
| 1240
|-
| Nano 3G
| 1262
| 1223/1224
| 1242
|-
| Nano 4G
| 1263
| 1225
| 1243
|-
| Nano 5G
| 1265
| 1231
| 1246
|-
| Nano 6G
| 1266
| 1232
| 1248
|-
| Classic 1G
| 1261
| 1223
| 1241
|-
| Classic 2G
| 1261
| 1223
| 1245
|-
| Classic 3G
| 1261
| 1223
| 1247
|}

Sources:

http://www.linux-usb.org/usb.ids

http://www.trejan.com/projects/ipod/phobos.html#DFURECOVERY

===DFU utility===
TheSeven has written libipoddfu.py for communicating with the iPod's DFU interface. It also has a utility called ipoddfu.py for uploading files in DFU mode. These utilities can be found in [http://svn.freemyipod.org/tools/ipoddfu/ the SVN repository].

==Debug (diagnostics) mode==
This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot.

==Helpful pages==
http://www.ipodlinux.org/wiki/Key_Combinations

http://daniel.haxx.se/blog/2008/09/03/dfu-mode-on-2nd-gen-nanos/

http://www.usb.org/developers/devclass_docs/DFU_1.1.pdf

http://www.usb.org/developers/devclass_docs/usbdfu10.pdf

Modes

2011-05-01T13:03:13Z

Farthen:

iPods have special modes that they can boot into called disk mode, DFU mode, and debug mode.

==Disk mode==
Disk mode has existed ever since the iPod has existed. Disk mode is stored in different locations (depends on the iPod model). Disk mode basically makes the iPod behave as a massive storage device, allowing the computer to directly read and write the data flash chip. For more information on how to enter Disk mode (or Reboot), refer to [http://support.apple.com/kb/ht1363 this Apple support document].

[[Image:Diskmode.jpg]]

([http://www.ipodlinux.org/ iPodLinux project])

==DFU mode==
DFU (Device Firmware Upgrade) mode is a relatively new standard for upgrading firmware that is used in many devices like the OpenMoko and the newer iPods. DFU mode (since nano 2G) is contained in the on-processor bootrom. Newer iPods have both DFU mode and disk mode, while iPod Touch and iPhones have exclusively DFU mode. It is worth noting that DFU mode was implemented at the exact time that Apple switched from PortalPlayer to Samsung processors.

The Nano 2G also has a DFU mode, but this mode can only be entered by shorting testpoints on the circuit board or flashing the NOR with an image with a wrong signature/hash. There's a NOR DFU mode though, that can be entered by holding down BACK+PLAY right after rebooting the device.

===Getting DFU mode on iPod Classic, Nano 3G and newer ===
# Make sure your iPod is turned on and connected to your computer.
# Press and hold the menu and select buttons for between 10 and 15 seconds (The iPod starts to reboot after about 5 seconds, keep holding the buttons until it seems to turn off completely)
# The display of your iPod should now stay black, and a new USB device called "USB DFU Device" should connect to your PC.

You can use lsusb to determine if your iPod is in DFU mode. 05ac is the Vendor ID (Apple), and the number after the colon is the Product ID. The Product ID depends on whether the iPod is in DFU mode or not. Here is a table of Product IDs:
{| class="wikitable"
! Device !! Normal !! DFU !! WTF
|-
| Nano 2G
| 1260
| 1220
| 1240
|-
| Nano 3G
| 1262
| 1223/1224
| 1242
|-
| Nano 4G
| 1263
| 1225
| 1243
|-
| Nano 5G
| 1265
| 1231
| 1246
|-
| Nano 6G
| 1266
| 1232
| 1248
|-
| Classic 1G
| 1261
| 1223
| 1241
|-
| Classic 2G
| 1261
| 1223
| 1245
|-
| Classic 3G
| 1261
| 1223
| 1247
|}

Sources:

http://www.linux-usb.org/usb.ids

http://www.trejan.com/projects/ipod/phobos.html#DFURECOVERY

===DFU utility===
TheSeven has written libipoddfu.py for communicating with the iPod's DFU interface. It also has a utility called ipoddfu.py for uploading files in DFU mode. These utilities can be found in [http://svn.freemyipod.org/tools/ipoddfu/ the SVN repository].

==Debug (diagnostics) mode==
This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot.

==Helpful pages==
http://www.ipodlinux.org/wiki/Key_Combinations

http://daniel.haxx.se/blog/2008/09/03/dfu-mode-on-2nd-gen-nanos/

http://www.usb.org/developers/devclass_docs/DFU_1.1.pdf

http://www.usb.org/developers/devclass_docs/usbdfu10.pdf

Main Page

2011-04-15T08:39:34Z

Farthen:

__NOTOC__
[[File:Iloader_ipc.jpg|115px|thumb|right|[[iLoader]] alpha on the iPod classic]]
This is the wiki for the freemyipod project. Freemyipod is a project for reverse-engineering iPods with clickwheel ('''no''' iOS devices) and creating tools and documentation so that other people can port alternative firmwares to them such as [http://www.rockbox.org rockbox]. Freemyipod is a relaunch of [[Linux4nano]]

'''emCORE installation instructions:''' [[emCORE Installation]]

==Updates==
*{{#dateformat:2011-03-25}} - [[emCORE]] is replacing [[emBIOS]] completely now. Therefore [[emBIOS]] will be deprecated software as of now! All emBIOS users are advised to upgrade to emCORE including people using iLoader 0.2.2 or less. More detailed update instructions will follow!
* {{#dateformat:2011-01-08}} - The Rockbox port for the iPod Classic is slowly getting usable. Most of the blocking issues have been fixed. The first-generation 160GB model still doesn't work, and some people are experiencing slightly garbled display contents.
* {{#dateformat:2011-01-04}} - There is an early Rockbox port for the iPod Classic! It still isn't quite usable, playback stutters etc., but if you want to play around with it, here are some quick'n'dirty notes on the installation procedure: [[IPod Classic iLoader Installation]]
*{{#dateformat:2010-11-22}} - We now have emBIOS support for the iPod classic 1g, the others might follow soon
*{{#dateformat:2010-08-29}} - We're proud to announce the release of [[emBIOS]] v0.1.0 and [[iLoader]] v0.2.0!
*{{#dateformat:2010-08-26}} - [[iLoader]], its installer and uninstaller all have been fully ported to [[emBIOS]] now. A beta release will be coming soon!
*{{#dateformat:2010-08-13}} - [[emBIOS]] is continually being improved and the next step is porting tools like [[iLoader]] to use it.
* {{#dateformat:2010-08-06}} - The wiki has now been moved to www.freemyipod.org
* {{#dateformat:2010-08-05}} - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [http://websvn.freemyipod.org/listing.php?repname=freemyipod&path=/embios/ here]
* {{#dateformat:2010-08-03}} - We can now access the Nano 4G accelerometer.
* {{#dateformat:2010-08-02}} - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].
* {{#dateformat:2010-08-01}} - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.
* {{#dateformat:2010-07-27}} - The server got zapped by lightning but a new one was up and running within a day.
* {{#dateformat:2010-02-23}} - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!
* {{#dateformat:2009-11-01}} - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]

Follow [http://twitter.com/freemyipod our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]
** [[ Toolchain ]]
* [[ SVN ]]
* [[ Todo list ]]
* [[ Project summary ]]

===Released Software===
* [[iLoader]]
* [[iBugger]]
* [[emCORE]]
** [[emCORE Monitor Protocol]]
* [[emBIOS]]
** [[emBIOS Monitor Protocol]]

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
* [[Firmware downgrading]]
* [[Troubleshooting]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Reverse engineering results===
* [[Firmware]]
* [[Firmware decryption]]
* [[GUID table]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Nano 6G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]
* [[S5L8700 datasheet]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

EmCORE Installation/iPodClassic/DFUNoiTunes

2011-04-12T13:16:04Z

Farthen:

* Make sure that you have .NET Framework 3.5 or later installed
* Download [http://files.freemyipod.org/misc/winusb_driver.zip this] file and extract it somewhere
* Download [http://files.freemyipod.org/misc/bootstrap_ipodclassic.exe this] file as well
* Connect your iPod to your computer
* Make sure the hold switch is not locked
* Press and hold the menu and select buttons for between 10 and 15 seconds (The iPod starts to reboot after about 5 seconds, keep holding the buttons until it seems to turn off completely)

The display of your iPod should now stay black, and a new USB device called "USB DFU Device" should connect to your PC.

* Wait for Windows to ask you for a driver for this device
* Always choose the bottom-most option (don't search on windows update, choose everything manually) until you get to the list of available drivers
* Choose "All device types" and click "Next"
* Click "Have disk"
* Click "Browse"
* Navigate to the folder where you extracted the winusb_driver.zip file, and choose the "winusb.inf" file from it
* Click "Open"
* Click "OK"
* Click "Next"
* Wait for the driver installation to complete
* Run bootstrap_ipodclassic.exe

Your iPod should now turn on and connect a 64MB drive called "UMSboot". If it doesn't, please ask for [[Contact|support]].

* [[EmCORE Installation/iPodClassic/UMSboot|Next step]]

2011-01-14T14:47:27Z

Farthen: /* Basic skills */

__NOTOC__
[[File:Iloader_ipc.jpg|115px|thumb|right|[[iLoader]] alpha on the iPod classic]]
This is the wiki for the freemyipod project. Freemyipod is a project for reverse-engineering iPods with clickwheel ('''no''' iOS devices) and creating tools and documentation so that other people can port alternative firmwares to them such as [http://www.rockbox.org rockbox]. Freemyipod is a relaunch of [[Linux4nano]]

==Updates==
* {{#dateformat:2011-01-08}} - The Rockbox port for the iPod Classic is slowly getting usable. Most of the blocking issues have been fixed. The first-generation 160GB model still doesn't work, and some people are experiencing slightly garbled display contents.
* {{#dateformat:2011-01-04}} - There is an early Rockbox port for the iPod Classic! It still isn't quite usable, playback stutters etc., but if you want to play around with it, here are some quick'n'dirty notes on the installation procedure: [[IPod Classic iLoader Installation]]
*{{#dateformat:2010-11-22}} - We now have emBIOS support for the iPod classic 1g, the others might follow soon
*{{#dateformat:2010-08-29}} - We're proud to announce the release of [[emBIOS]] v0.1.0 and [[iLoader]] v0.2.0!
*{{#dateformat:2010-08-26}} - [[iLoader]], its installer and uninstaller all have been fully ported to [[emBIOS]] now. A beta release will be coming soon!
*{{#dateformat:2010-08-13}} - [[emBIOS]] is continually being improved and the next step is porting tools like [[iLoader]] to use it.
* {{#dateformat:2010-08-06}} - The wiki has now been moved to www.freemyipod.org
* {{#dateformat:2010-08-05}} - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [http://websvn.freemyipod.org/listing.php?repname=freemyipod&path=/embios/ here]
* {{#dateformat:2010-08-03}} - We can now access the Nano 4G accelerometer.
* {{#dateformat:2010-08-02}} - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].
* {{#dateformat:2010-08-01}} - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.
* {{#dateformat:2010-07-27}} - The server got zapped by lightning but a new one was up and running within a day.
* {{#dateformat:2010-02-23}} - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!
* {{#dateformat:2009-11-01}} - iBugger core v0.1 successfully running on [[Nano 4G]]! [http://img217.imageshack.us/img217/4122/img0969.jpg]

Follow [http://twitter.com/freemyipod our Twitter feed] to get status updates automatically. See the [[Status]] page for more detailed information.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]
** [[ Toolchain ]]
* [[ SVN ]]
* [[ Todo list ]]
* [[ Project summary ]]

===Released Software===
* [[iLoader]]
* [[iBugger]]
* [[emBIOS]]
** [[emBIOS Monitor Protocol]]

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
* [[Firmware downgrading]]
* [[Troubleshooting]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Reverse engineering results===
* [[Firmware]]
* [[Firmware decryption]]
* [[GUID table]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G FTL]]
* Nano 4G
** [[Nano4G firmware upgrade process]]

===Exploiting===
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
*** [[Nano2G HW analysis]]
*** [[S5L8701 analysis]]
** [[Nano 3G]]
** [[Nano 4G]]
** [[Nano 5G]]
** [[Nano 6G]]
** [[Classic 1G]]
** [[Classic 2G]]
** [[Classic 3G]]
* [[Chronology]]
* [[S5L8700 datasheet]]

===Other guides===
* [[MPEG movies]]
* [[Modes]]
|}

Nano 4G

Farthen:

The first step to examining iPod's firmware is getting an image of it. You can retrieve either retrieve an image from the iPod or from the internet.

==From the iPod==
Getting a firmware dump of a nano 2g is very easy in Linux. Just:

# Make sure the iPod is plugged in.
# Type "dd if=/dev/sdX1 of=dump.img" in the terminal, but make sure you edit the drive to match your configuration.
# A dump.img file should be created after a while. If you have a lot of data on your iPod, it can take a very long time.

To dump the firmware of any iPod classic or iPod nano from version 3 on you need to run own code on the device to be able to dump the flash with the firmware code on it.

==From the internet==
You can download pretty much every firmware version from http://www.felixbruns.de/iPod/firmware/. These files are called .ipsw files, but they are really .zip files in disguise. Open the .ipsw file as a .zip file, and you can view it's contents:

===1G-3G Nano firmware structure===
{| class="wikitable"
! Filename !! Description
|-
| Firmware-XX.X.X.X || The actual firmware file
|-
| manifest.plist || An XML file that gives basic info about the Firmware. Probably for iTunes.
|}

===4G Nano firmware structure===
The 4G Nanos seem to have a different structure with an interesting new file:
{| class="wikitable"
! Filename !! Description
|-
| Firmware.MSE || The actual firmware file
|-
| manifest.plist || An XML file that gives basic info about the Firmware. Probably for iTunes.
|-
| N58s.bootloader.release.rb3 || This is a very interesting new file that should be checked out! At the end there are clusters of strings that mention things like "Apple iPod Certification Authority", "S5L8720", and "Secure Boot". This means that the 4G uses the S5L8720 processor, the exact same as the iPod Touch 2G. It is also likely that the 4G Nano uses the same Secure Boot technology as iPhone's and iPod Touch's.
|}

You can copy over the firmware file and that is the same as extracting a dump.img file from the iPod.

==Helpful pages==
http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf

http://www.ipodlinux.org/wiki/Firmware

http://www.trejan.com/projects/ipod/phobos.html#REGFIRMWARE