freemyipod - User contributions [en]

Linux

2026-05-09T09:38:53Z

Jdkjkjj: Add steps for iPod nano 2g

== Current: Freemyipod Linux ==

We are working on supporting Samsung/S5L-based devices which have an MMU. Currently our main focus is the [[Nano 7G]], there are also builds for [[Nano 2G]] and [[Nano 5G]]. An experimental source tree is available on [https://github.com/freemyipod/linux github.com/freemyipod/linux]. Aditionaly [[User:ZeOne]] is working on making it work with the [[Nano 6G]] you can read more about that on his page.

=== User Guide ===

Not yet available, as the Linux port isn't yet practical to use. We have no storage drivers, no sound driver...

=== Developer Guide ===

If you're somewhat familiar with embedded Linux, you can get started by building [[WInd3x|wInd3x]], [[U-Boot]] and the Kernel as described below. However, '''you will have to provide your own userland''' (eg. buildroot, archlinux arm, ... anything armv6 compatible) and either run it from an initramfs or over NFS. '''A serial cable is not necessary, but very useful to troubleshoot boot issues.'''

==== Build everything ====

''These are not copy-paste instructions. You are expected to understand what's happening.'

You will need an arm-none-eabi- toolchain into your $PATH, eg. gcc-arm-embedded from your package manager.

First, wInd3x: this will be used to run u-boot.

$ git clone https://github.com/freemyipod/wInd3x
$ cd wInd3x
$ go build ./cmd/wInd3x

Second, U-Boot:

$ git clone https://github.com/freemyipod/u-boot
$ cd u-boot
$ git checkout s5l87xx
$ make apple_n36_defconfig # for Nano 2G OR
$ make apple_n33_defconfig # for Nano 5G OR
$ make apple_n31_defconfig # for Nano 7G
$ make CROSS_COMPILE=arm-none-eabi- dtbs # for Nano 2G
$ make CROSS_COMPILE=arm-none-eabi- -j $(nproc) u-boot.bin # don’t run this for Nano 2G yet

On macOS, you need to install openssl using homebrew. If the build system does not find it, append the following to the last command:

HOSTCFLAGS="-I/opt/homebrew/Cellar/openssl@3/3.6.1/include" HOSTLDFLAGS="-L/opt/homebrew/Cellar/openssl@3/3.6.1/lib"

substituting your OpenSSL version/path as needed.

Third, Linux:

$ git clone https://github.com/freemyipod/linux
$ cd linux
$ git checkout n2g-wip # for Nano 2G OR
$ git checkout n5g-wip # for Nano 5G OR
$ git checkout n7g-wip # for Nano 7G
$ make ARCH=arm nano2g_defconfig # for Nano 2G
$ make ARCH=arm nano5g_defconfig # for Nano 5G
$ make ARCH=arm apple_n31_defconfig # for Nano 7G
$ make ARCH=arm CROSS_COMPILE=arm-none-eabi- -j $(nproc) zImage

By this point, have a initramfs ready. If you wanna boot directly from nfs, edit CMDLINE in the kernel .config accordingly.

Finally, bundle together an u-boot image containing the kernel, your initramfs, and the device-tree (built by u-boot):

$ mkimage -A arm -C none -O linux -T multi -a 0x08000000 -e 0x08000000 -d arch/arm/boot/zImage:initramfs.gz:../u-boot/arch/arm/dts/s5l8730.dtb mImage

''mImage'' is your combined image.

==== Running ====

Connect your iPod nano in DFU mode.

For [[Nano 3G]] and later, execute u-boot using wInd3x:

$ ./wInd3x cfw run ../u-boot/u-boot.bin

This should start u-boot. Running this for the first time will take a while, as some bootloader stages need to be downloaded, decrypted and modified. A new USB device (05ac:8007) appear on your host. Use dfu-util to upload mImage:

dfu-util -d 05ac:8007 -D mImage && dfu-util -d 05ac:8007 -e

For the [[Nano 2G]], you will have to chainload the rockbox bootloader with u-boot.

To do this, we assume you have already built u-boot dtbs along with Linux.

To create the mImage, run this command inside your Linux folder:

$ ./create_image.sh

Note: if it dosen’t work, you will have to make it executable, usually by running:

$ chmod +x create_image.sh

After it creates the mImage, go to your u-boot folder and build u-boot.bin.

$ make CROSS_COMPILE=arm-none-eabi- -j $(nproc) u-boot.bin

Now generate a fake rockbox.ipod that tricks it into starting U-Boot:

$ ./tools/mkimage -T ipod -d u-boot.bin rockbox.ipod

Copy this new rockbox.ipod into the .rockbox folder on your iPod nano 2G.

Then, in the serial console you'll see Linux booting:

## Booting kernel from Legacy Image at 08000000 ...
...
Starting kernel ...

[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 6.2.0-rc4-00476-g4c4af4d7e53c (q3k@mimeomia) (arm-none-eabi-gcc (GNU Arm Embedded Toolchain 10.3-2021.10) 10.3.1 20210824 (release), GNU ld (GNU Arm Embedded Toolchain 10.3-2021.10) 2.36.1.20210621) #70 Fri Jan 20 18:02:56 CET 2023
...

The LCD display should start up and show a boot log. If not, try adding <code>console=tty0</code> to your CMDLINE? You might also use <code>fbcon=rotate:1</code> to rotate the framebuffer 90 degrees.

If everything goes well, the kernel should boot up and attempt to mount a rootfs. It's up to you to get this part working, at least until we streamline the process. The USB CDC EEM ethernet gadget should also appear on your host (probably as usb0, or some long systemd predictable name). The other end will be visible as 'usb0' on the device.

On [[Nano 7G]] you'll need a DCSD cable (Alex/Magico), and the command line to get proper serial output:

picocom --baud 115200 --imap lfcrlf /dev/ttyUSB0

Now go on and have a go at reverse-engineering some peripherals! :)

== Legacy: iPodLinux ==

The [http://www.ipodlinux.org/ iPodLinux] project supports all the PortalPlayer based iPods: iPod 1G-4G, Photo/Color, Video/5G/5.5G, Mini, iPod Nano 1G. It is currently semi-abandoned, and uses a very old ucLinux kernel build.

Main Page

2026-05-09T09:18:53Z

Jdkjkjj: Add iPod nano 2g demo image

__NOTOC__
[[File:Sysfetch on iPod Nano 2G.jpg|thumb|right|sysfetch on the [[Nano 2G]] running [[Linux]] 6.10]]
[[File:Photo 2025-12-27 20-36-24.jpg|280px|thumb|right|[[Linux]] 6.14.0 on [[Nano 7G]]]]
[[File:EmCORE_Nano2G_Nano4G_Classic.jpg|280px|thumb|right|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]]]
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].

== FAQ ==

=== What can I do with my [[Nano 2G]], [[Classic 6G]] or older iPods? ===

There's an upstream Rockbox port for these devices. [https://www.rockbox.org/download/ Go use that].

=== What can I do with my [[Nano 3G]] or newer? ===

Not much (yet) unless you're an embedded developer :).

On the [[Nano 3G]], [[Nano 4G]] and [[Nano 5G]], we have a stable tethered exploit ([[wInd3x]]) which allows early, untethered and safe (no permanent modification) code execution. This in turn allows you to run [[U-Boot]] and an early [[Linux|Linux port]] or experiment with reverse-engineering/modifying the original firmware, [[retailOS]].

On the [[Nano 6G]], [[Nano 7G]] and iPod shuffle (4th generation), a vulnerability in DFU_DNLOAD packet parsing code can be exploited with [[S5Late]]. It allows tethered code execution.

On the [[Nano 6G]] and [[Nano 7G]], a font parsing vulnerability (CVE-2010-1797) can be exploited with [[ipod_sun]]. It allows untethered code execution.

There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.

== Getting an account ==
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].

==Updates==
* {{#dateformat:2026-03-30}} - Some of us will be at [https://entropia.de/GPN24 GPN24] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].
* {{#dateformat:2025-12-26}} - Some of us will be at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!
* {{#dateformat:2025-06-12}} - Some of us will be at [https://entropia.de/GPN23 GPN23] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2024-12-25}} - Some of us will be at [https://events.ccc.de/congress/2024/infos/startpage.html 38C3] in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.
* {{#dateformat:2023-01-07}} - A preliminary [[U-Boot]] port to the [[Nano 5G]] [https://social.hackerspace.pl/@q3k/109655916469636189 has been developed].
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!
* {{#dateformat:2021-12-31}} - An exploit named [[wInd3x]], which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!

Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]

===Released Software===
* [[wInd3x]]
* [[ipod_sun]]
* [[U-Boot|U-Boot port]]
* [[Linux|Linux port]]
* Legacy:
** [[iBugger]]
** [[iLoader]]
** [[emCORE]]

|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
* [[Firmware downgrading]]
* [[Troubleshooting]]

===Reverse engineering results===
* [[Firmware]]
** [[Bootrom]]
** [[Boot Process]]
** [[Firmware decryption]]
** [[FTL|Flash Translation Layer]]
** [[RetailOS]]
*** [[RetailOS Options]]
* [[GUID table]]
* [[JTAG]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G HW analysis]]
** [[S5L8701 analysis]]
* Nano 4G
** [[Nano4G firmware upgrade process]]
* Nano 5G
** [[Nano 5G|General]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
** [[Nano 3G]]
** [[Nano 4G]]
*** [[920-0614-03]]
** [[Nano 5G]]
** [[Nano 6G]]
** [[Nano 7G]]
** [[Classic 6G]]
* [[Chronology]]
* [[S5L8700 datasheet]]
* [[Modes]]

===Exploiting===
* [[wInd3x]]
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|}

File:Sysfetch on iPod Nano 2G.jpg

2026-05-09T09:13:38Z

Jdkjkjj:

sysfetch, a C-written clone of neofetch running on iPod nano 2G