https://freemyipod.org/api.php?action=feedcontributions&feedformat=atom&user=User890104freemyipod - User contributions [en]2026-04-26T16:05:20ZUser contributionsMediaWiki 1.45.1https://freemyipod.org/index.php?title=EmCORE_Installation/iPodNano6G&diff=22297EmCORE Installation/iPodNano6G2026-04-14T00:32:27Z<p>User890104: </p>
<hr />
<div>Sorry, your device is not currently supported by [[emCORE]].<br />
<br />
<br />
Porting [[emCORE]] to a new device is generally a lot of work and requires lots of experience with embedded system development.<br />
<br />
The exact amount of work needed varies greatly and depends on the complexity of the device and similarities to devices that [[emCORE]] has already been ported to.<br />
<br />
Additionally as [[emCORE]] is deprecated and Rockbox should be used instead, there is no reason you should be waiting for an [[emCORE]] port on the [[Nano 6G]].<br />
<br />
An exploit has been found [[S5Late]] and a modified version made to work with the [[Nano 6G]] exists. (find it here [https://github.com/NyanSatan/S5Late-8723 S5Late-8723]) there is some work in progress to getting it to work with wInd3x and getting Alpine Linux booted on it (not [[emCORE]] for now).</div>User890104https://freemyipod.org/index.php?title=Modes&diff=22290Modes2026-04-09T20:42:00Z<p>User890104: </p>
<hr />
<div>At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting. <br />
<br />
==Normal mode==<br />
"Normal mode" is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.<br />
<br />
==Disk mode==<br />
In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text "Do not disconnect." or a checkmark symbol with the text "OK to disconnect." depending on whether the iPod is connected and if it has been ejected. <br />
<br />
Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]<br />
<br />
Disk mode is also referred to as "forced disk mode" in device information received from the iPod.<br />
<br />
The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the "disk" partition of the [[Firmware]]. <br />
<br />
==DFU mode==<br />
[https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the [[Nano 3G]] and newer and the [[Classic 6G]] and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].<br />
<br />
When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other IMG1 images cannot be sent in this mode.<br />
<br />
The [[Nano 2G]] also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does, however, support a NOR DFU mode that can be entered by holding down Back+Play right after rebooting the device<ref>https://www.rockbox.org/irc/log-20080904#13:31:44</ref>.<br />
<br />
==WTF mode==<br />
In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.<br />
<br />
The iTunes behavior upon seeing an iPod in WTF mode is to send it a "recovery" firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the "osos" partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].<br />
<br />
==Diagnostic mode==<br />
[[File:Nano 7G diagnostic mode.jpg|thumb|right|[[Nano 7G]] in diagnostics mode]]<br />
This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed on clickwheel iPods by holding Select and Rewind when the Apple logo appears during reboot. For the [[Nano 6G]] you enter it by holding down the Volume Up, Volume Down and Power buttons. For the [[Nano 7G]] you enter it by holding down the Volume Up, Volume Down, Power and Menu buttons. <br />
In diagnostics mode you can find info about the battery power check the LCD, button inputs, radio signals, DRAM, NAND, Accelerometer, dock information and an about section. On touchscreen iPods there is also a section for touchscreen testing.<br />
<br clear="all" /><br />
==USB IDs==<br />
When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in: <br />
{| class="wikitable" <br />
|-<br />
! colspan="2" | Model<br />
! Normal/disk mode<br />
! DFU mode<br />
! WTF mode<br />
|-<br />
| colspan="2" | [[Nano 2G]]<br />
| <code>1260</code><br />
| <code>1220</code><br />
| <code>1240</code><br />
|-<br />
| colspan="2" | [[Nano 3G]]<br />
| <code>1262</code><br />
| <code>1223</code>/<code>1224</code><br />
| <code>1242</code><br />
|-<br />
| colspan="2" | [[Nano 4G]]<br />
| <code>1263</code><br />
| <code>1225</code><br />
| <code>1243</code><br />
|-<br />
| colspan="2" | [[Nano 5G]]<br />
| <code>1265</code><br />
| <code>1231</code><br />
| <code>1246</code><br />
|-<br />
| colspan="2" | [[Nano 6G]]<br />
| <code>1266</code><br />
| <code>1232</code><br />
| <code>1248</code><br />
|-<br />
| rowspan="2" | [[Nano 7G]]<br />
| Initial<br />
| rowspan="2" | <code>1267</code><br />
| rowspan="2" | <code>1234</code><br />
| <code>1249</code><br />
|-<br />
| Rev A<br />
| <code>124a</code><br />
|-<br />
| rowspan="4" | [[Classic 6G]]<br />
| [[Classic 6G#Initial|Initial]]<br />
| rowspan="4" | <code>1261</code><br />
| rowspan="4" | <code>1223</code><br />
| <code>1241</code><br />
|-<br />
| [[Classic 6G#Rev A|Rev A]]<br />
| <code>1245</code><br />
|-<br />
| [[Classic 6G#Rev B|Rev B]]<br />
| <code>1247</code><br />
|-<br />
| Rev C<br />
| <code>1250</code><br />
|}</div>User890104https://freemyipod.org/index.php?title=Modes&diff=22289Modes2026-04-09T20:39:14Z<p>User890104: fix spelling and formatting</p>
<hr />
<div>At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting. <br />
<br />
==Normal mode==<br />
"Normal mode" is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.<br />
<br />
==Disk mode==<br />
In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text "Do not disconnect." or a checkmark symbol with the text "OK to disconnect." depending on whether the iPod is connected and if it has been ejected. <br />
<br />
Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]<br />
<br />
Disk mode is also referred to as "forced disk mode" in device information received from the iPod.<br />
<br />
The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the "disk" partition of the [[Firmware]]. <br />
<br />
==DFU mode==<br />
[https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the [[Nano 3G]] and newer and the [[Classic 6G]] and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].<br />
<br />
When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other IMG1 images cannot be sent in this mode.<br />
<br />
The [[Nano 2G]] also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does, however, support a NOR DFU mode that can be entered by holding down Back+Play right after rebooting the device<ref>https://www.rockbox.org/irc/log-20080904#13:31:44</ref>.<br />
<br />
==WTF mode==<br />
In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.<br />
<br />
The iTunes behavior upon seeing an iPod in WTF mode is to send it a "recovery" firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the "osos" partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].<br />
<br />
==Diagnostic mode==<br />
__NOTOC__<br />
[[File:Nano 7G diagnostic mode.jpg|thumb|right|[[Nano 7G]] in diagnostics mode]]<br />
This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed on clickwheel iPods by holding center and rewind when the Apple logo appears during reboot. For the [[Nano 6G]] you enter Diagnostics mode by holding down all three buttons. For the [[Nano 7G]] you press and hold the volume up, volume down, power and menu buttons. <br />
In diagnostics mode you can find info about the battery power check the LCD, button inputs, radio signals, DRAM, NAND, Accelerometer, dock information and an about section. On touchscreen iPods there is also a section for touchscreen testing.<br />
<br clear="all" /><br />
==USB IDs==<br />
When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in: <br />
{| class="wikitable" <br />
|-<br />
! colspan="2" | Model<br />
! Normal/disk mode<br />
! DFU mode<br />
! WTF mode<br />
|-<br />
| colspan="2" | [[Nano 2G]]<br />
| <code>1260</code><br />
| <code>1220</code><br />
| <code>1240</code><br />
|-<br />
| colspan="2" | [[Nano 3G]]<br />
| <code>1262</code><br />
| <code>1223</code>/<code>1224</code><br />
| <code>1242</code><br />
|-<br />
| colspan="2" | [[Nano 4G]]<br />
| <code>1263</code><br />
| <code>1225</code><br />
| <code>1243</code><br />
|-<br />
| colspan="2" | [[Nano 5G]]<br />
| <code>1265</code><br />
| <code>1231</code><br />
| <code>1246</code><br />
|-<br />
| colspan="2" | [[Nano 6G]]<br />
| <code>1266</code><br />
| <code>1232</code><br />
| <code>1248</code><br />
|-<br />
| rowspan="2" | [[Nano 7G]]<br />
| Initial<br />
| rowspan="2" | <code>1267</code><br />
| rowspan="2" | <code>1234</code><br />
| <code>1249</code><br />
|-<br />
| Rev A<br />
| <code>124a</code><br />
|-<br />
| rowspan="4" | [[Classic 6G]]<br />
| [[Classic 6G#Initial|Initial]]<br />
| rowspan="4" | <code>1261</code><br />
| rowspan="4" | <code>1223</code><br />
| <code>1241</code><br />
|-<br />
| [[Classic 6G#Rev A|Rev A]]<br />
| <code>1245</code><br />
|-<br />
| [[Classic 6G#Rev B|Rev B]]<br />
| <code>1247</code><br />
|-<br />
| Rev C<br />
| <code>1250</code><br />
|}</div>User890104https://freemyipod.org/index.php?title=Main_Page&diff=22270Main Page2026-04-07T18:59:25Z<p>User890104: /* Hardware */</p>
<hr />
<div>__NOTOC__<br />
[[File:Photo 2025-12-27 20-36-24.jpg|280px|thumb|right|[[Linux]] 6.14.0 on [[Nano 7G]]]]<br />
[[File:EmCORE_Nano2G_Nano4G_Classic.jpg|280px|thumb|right|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]]]<br />
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].<br />
<br />
== FAQ ==<br />
<br />
=== What can I do with my [[Nano 2G]], [[Classic 6G]] or older iPods? ===<br />
<br />
There's an upstream Rockbox port for these devices. [https://www.rockbox.org/download/ Go use that].<br />
<br />
=== What can I do with my [[Nano 3G]] or newer? ===<br />
<br />
Not much (yet) unless you're an embedded developer :).<br />
<br />
On the [[Nano 3G]], [[Nano 4G]] and [[Nano 5G]], we have a stable tethered exploit ([[wInd3x]]) which allows early, untethered and safe (no permanent modification) code execution. This in turn allows you to run [[U-Boot]] and an early [[Linux|Linux port]] or experiment with reverse-engineering/modifying the original firmware, [[retailOS]].<br />
<br />
On the [[Nano 6G]], [[Nano 7G]] and iPod shuffle (4th generation), a vulnerability in DFU_DNLOAD packet parsing code can be exploited with [[S5Late]]. It allows tethered code execution.<br />
<br />
On the [[Nano 6G]] and [[Nano 7G]], a font parsing vulnerability (CVE-2010-1797) can be exploited with [[ipod_sun]]. It allows untethered code execution.<br />
<br />
There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.<br />
<br />
== Getting an account ==<br />
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].<br />
<br />
==Updates==<br />
* {{#dateformat:2026-03-30}} - Some of us will be at [https://entropia.de/GPN24 GPN24] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!<br />
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].<br />
* {{#dateformat:2025-12-26}} - Some of us will be at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!<br />
* {{#dateformat:2025-06-12}} - Some of us will be at [https://entropia.de/GPN23 GPN23] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!<br />
* {{#dateformat:2024-12-25}} - Some of us will be at [https://events.ccc.de/congress/2024/infos/startpage.html 38C3] in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]<br />
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.<br />
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.<br />
* {{#dateformat:2023-01-07}} - A preliminary [[U-Boot]] port to the [[Nano 5G]] [https://social.hackerspace.pl/@q3k/109655916469636189 has been developed].<br />
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!<br />
* {{#dateformat:2021-12-31}} - An exploit named [[wInd3x]], which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].<br />
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!<br />
<!--<br />
* {{#dateformat:2018-08-25}} - The website software has been updated to MediaWiki 1.31 after about 2 months of downtime.<br />
* {{#dateformat:2016-06-17}} - The freemyipod project is becoming deprecated, as parts of the code is slowly being integrated in Rockbox. It is likely that no future development on the freemyipod project will take place. Essential parts of emCORE helped building a Rockbox bootloader for iPod Classic, and any future development will take place in the Rockbox project.<br />
* {{#dateformat:2014-03-26}} - A bug that prevented [[emCORE]] installations on certain Windows configurations (getting stuck on "Booting UBI file..."), has been finally fixed! If the installation has failed for you before, you can retry it using the updated version of our tool (use the iTunes method for now).<br />
* {{#dateformat:2012-01-02}} - There have been some problems with the latest release. A hotfix release ([[EmCORE_Releases/r859|r859]]) has been published to fix some of these problems. [[Nano 2G]] users are advised to upgrade. See the [[EmCORE_Releases/r859|release details page]] for more information.<br />
* {{#dateformat:2012-01-01}} - A new release <s>([[EmCORE_Releases/r855|r855]])</s> is out! It includes a couple of new features, several bugfixes and a new bootmenu theme! More information on the <s>[[EmCORE_Releases/r855|release details page]]</s>.<br />
* {{#dateformat:2011-04-25}} - The [[emCORE]] kernel now runs on the iPod Touch 2G as well, thanks to the help of kleemajo. This is of course not a fully functional port yet, but we'll see how it continues. It's about the same state as the [[Nano 4G]] now. /7<br />
* {{#dateformat:2011-03-25}} - [[emCORE]] is replacing [[emBIOS]] completely now. Therefore [[emBIOS]] will be deprecated software as of now! All emBIOS users are advised to upgrade to emCORE including people using iLoader 0.2.2 or less. More detailed update instructions will follow!<br />
* {{#dateformat:2011-01-08}} - The Rockbox port for the iPod Classic is slowly getting usable. Most of the blocking issues have been fixed. The first-generation 160GB model still doesn't work, and some people are experiencing slightly garbled display contents.<br />
* {{#dateformat:2011-01-04}} - There is an early Rockbox port for the iPod Classic! It still isn't quite usable, playback stutters etc., but if you want to play around with it, here are some quick'n'dirty notes on the installation procedure: [[IPod Classic iLoader Installation]]<br />
* {{#dateformat:2010-11-22}} - We now have emBIOS support for the iPod classic 1g, the others might follow soon<br />
* {{#dateformat:2010-08-29}} - We're proud to announce the release of [[emBIOS]] v0.1.0 and [[iLoader]] v0.2.0!<br />
* {{#dateformat:2010-08-26}} - [[iLoader]], its installer and uninstaller all have been fully ported to [[emBIOS]] now. A beta release will be coming soon!<br />
* {{#dateformat:2010-08-13}} - [[emBIOS]] is continually being improved and the next step is porting tools like [[iLoader]] to use it.<br />
* {{#dateformat:2010-08-06}} - The wiki has now been moved to www.freemyipod.org<br />
* {{#dateformat:2010-08-05}} - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [https://websvn.freemyipod.org/listing.php?repname=freemyipod&path=/embios/ here]<br />
* {{#dateformat:2010-08-03}} - We can now access the [[Nano 4G]] accelerometer.<br />
* {{#dateformat:2010-08-02}} - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].<br />
* {{#dateformat:2010-08-01}} - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.<br />
* {{#dateformat:2010-07-27}} - The server got zapped by lightning but a new one was up and running within a day.<br />
* {{#dateformat:2010-02-23}} - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!<br />
* {{#dateformat:2009-11-01}} - iBugger core v0.1 successfully running on [[Nano 4G]]! [https://img217.imageshack.us/img217/4122/img0969.jpg]<br />
--><br />
Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.<br />
<br />
{| cellspacing="3" width="100%"<br />
|- valign="top"<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
===Project info===<br />
* [[ Status ]]<br />
* [[ Contact ]]<br />
* [[ Contributing ]]<br />
<br />
===Released Software===<br />
* [[wInd3x]]<br />
* [[ipod_sun]]<br />
* [[U-Boot|U-Boot port]]<br />
* [[Linux|Linux port]]<br />
* Legacy:<br />
** [[iBugger]]<br />
** [[iLoader]]<br />
** [[emCORE]]<br />
<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
<br />
===Basic skills===<br />
* [[Working with binaries]]<br />
* [[Dumping firmware]]<br />
* [[Extracting firmware]]<br />
* [[Firmware downgrading]]<br />
* [[Troubleshooting]]<br />
<br />
===Reverse engineering results===<br />
* [[Firmware]]<br />
** [[Bootrom]]<br />
** [[Boot Process]]<br />
** [[Firmware decryption]]<br />
** [[FTL|Flash Translation Layer]]<br />
** [[RetailOS]]<br />
*** [[RetailOS Options]]<br />
* [[GUID table]]<br />
* [[JTAG]]<br />
* Nano 2G<br />
** [[Nano2G clock gates]]<br />
** [[Nano2G LCD init]]<br />
** [[Nano2G HW analysis]]<br />
** [[S5L8701 analysis]]<br />
* Nano 4G<br />
** [[Nano4G firmware upgrade process]]<br />
* Nano 5G<br />
** [[Nano 5G|General]]<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
===Hardware===<br />
* [[Hardware]]<br />
** [[Nano 1G]]<br />
** [[Nano 2G]]<br />
** [[Nano 3G]]<br />
** [[Nano 4G]]<br />
*** [[920-0614-03]]<br />
** [[Nano 5G]]<br />
** [[Nano 6G]]<br />
** [[Nano 7G]]<br />
** [[Classic 6G]]<br />
* [[Chronology]]<br />
* [[S5L8700 datasheet]]<br />
* [[Modes]]<br />
<br />
===Exploiting===<br />
* [[wInd3x]]<br />
* [[Pwnage 2.0]]<br />
* [[Notes vulnerability]]<br />
** [[Address bruteforcing]]<br />
** [[Nanotron 3000]]<br />
|}</div>User890104https://freemyipod.org/index.php?title=Main_Page&diff=22269Main Page2026-04-07T18:59:06Z<p>User890104: move modes menu item</p>
<hr />
<div>__NOTOC__<br />
[[File:Photo 2025-12-27 20-36-24.jpg|280px|thumb|right|[[Linux]] 6.14.0 on [[Nano 7G]]]]<br />
[[File:EmCORE_Nano2G_Nano4G_Classic.jpg|280px|thumb|right|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]]]<br />
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].<br />
<br />
== FAQ ==<br />
<br />
=== What can I do with my [[Nano 2G]], [[Classic 6G]] or older iPods? ===<br />
<br />
There's an upstream Rockbox port for these devices. [https://www.rockbox.org/download/ Go use that].<br />
<br />
=== What can I do with my [[Nano 3G]] or newer? ===<br />
<br />
Not much (yet) unless you're an embedded developer :).<br />
<br />
On the [[Nano 3G]], [[Nano 4G]] and [[Nano 5G]], we have a stable tethered exploit ([[wInd3x]]) which allows early, untethered and safe (no permanent modification) code execution. This in turn allows you to run [[U-Boot]] and an early [[Linux|Linux port]] or experiment with reverse-engineering/modifying the original firmware, [[retailOS]].<br />
<br />
On the [[Nano 6G]], [[Nano 7G]] and iPod shuffle (4th generation), a vulnerability in DFU_DNLOAD packet parsing code can be exploited with [[S5Late]]. It allows tethered code execution.<br />
<br />
On the [[Nano 6G]] and [[Nano 7G]], a font parsing vulnerability (CVE-2010-1797) can be exploited with [[ipod_sun]]. It allows untethered code execution.<br />
<br />
There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.<br />
<br />
== Getting an account ==<br />
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].<br />
<br />
==Updates==<br />
* {{#dateformat:2026-03-30}} - Some of us will be at [https://entropia.de/GPN24 GPN24] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!<br />
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].<br />
* {{#dateformat:2025-12-26}} - Some of us will be at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!<br />
* {{#dateformat:2025-06-12}} - Some of us will be at [https://entropia.de/GPN23 GPN23] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!<br />
* {{#dateformat:2024-12-25}} - Some of us will be at [https://events.ccc.de/congress/2024/infos/startpage.html 38C3] in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]<br />
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.<br />
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.<br />
* {{#dateformat:2023-01-07}} - A preliminary [[U-Boot]] port to the [[Nano 5G]] [https://social.hackerspace.pl/@q3k/109655916469636189 has been developed].<br />
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!<br />
* {{#dateformat:2021-12-31}} - An exploit named [[wInd3x]], which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].<br />
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!<br />
<!--<br />
* {{#dateformat:2018-08-25}} - The website software has been updated to MediaWiki 1.31 after about 2 months of downtime.<br />
* {{#dateformat:2016-06-17}} - The freemyipod project is becoming deprecated, as parts of the code is slowly being integrated in Rockbox. It is likely that no future development on the freemyipod project will take place. Essential parts of emCORE helped building a Rockbox bootloader for iPod Classic, and any future development will take place in the Rockbox project.<br />
* {{#dateformat:2014-03-26}} - A bug that prevented [[emCORE]] installations on certain Windows configurations (getting stuck on "Booting UBI file..."), has been finally fixed! If the installation has failed for you before, you can retry it using the updated version of our tool (use the iTunes method for now).<br />
* {{#dateformat:2012-01-02}} - There have been some problems with the latest release. A hotfix release ([[EmCORE_Releases/r859|r859]]) has been published to fix some of these problems. [[Nano 2G]] users are advised to upgrade. See the [[EmCORE_Releases/r859|release details page]] for more information.<br />
* {{#dateformat:2012-01-01}} - A new release <s>([[EmCORE_Releases/r855|r855]])</s> is out! It includes a couple of new features, several bugfixes and a new bootmenu theme! More information on the <s>[[EmCORE_Releases/r855|release details page]]</s>.<br />
* {{#dateformat:2011-04-25}} - The [[emCORE]] kernel now runs on the iPod Touch 2G as well, thanks to the help of kleemajo. This is of course not a fully functional port yet, but we'll see how it continues. It's about the same state as the [[Nano 4G]] now. /7<br />
* {{#dateformat:2011-03-25}} - [[emCORE]] is replacing [[emBIOS]] completely now. Therefore [[emBIOS]] will be deprecated software as of now! All emBIOS users are advised to upgrade to emCORE including people using iLoader 0.2.2 or less. More detailed update instructions will follow!<br />
* {{#dateformat:2011-01-08}} - The Rockbox port for the iPod Classic is slowly getting usable. Most of the blocking issues have been fixed. The first-generation 160GB model still doesn't work, and some people are experiencing slightly garbled display contents.<br />
* {{#dateformat:2011-01-04}} - There is an early Rockbox port for the iPod Classic! It still isn't quite usable, playback stutters etc., but if you want to play around with it, here are some quick'n'dirty notes on the installation procedure: [[IPod Classic iLoader Installation]]<br />
* {{#dateformat:2010-11-22}} - We now have emBIOS support for the iPod classic 1g, the others might follow soon<br />
* {{#dateformat:2010-08-29}} - We're proud to announce the release of [[emBIOS]] v0.1.0 and [[iLoader]] v0.2.0!<br />
* {{#dateformat:2010-08-26}} - [[iLoader]], its installer and uninstaller all have been fully ported to [[emBIOS]] now. A beta release will be coming soon!<br />
* {{#dateformat:2010-08-13}} - [[emBIOS]] is continually being improved and the next step is porting tools like [[iLoader]] to use it.<br />
* {{#dateformat:2010-08-06}} - The wiki has now been moved to www.freemyipod.org<br />
* {{#dateformat:2010-08-05}} - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [https://websvn.freemyipod.org/listing.php?repname=freemyipod&path=/embios/ here]<br />
* {{#dateformat:2010-08-03}} - We can now access the [[Nano 4G]] accelerometer.<br />
* {{#dateformat:2010-08-02}} - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].<br />
* {{#dateformat:2010-08-01}} - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.<br />
* {{#dateformat:2010-07-27}} - The server got zapped by lightning but a new one was up and running within a day.<br />
* {{#dateformat:2010-02-23}} - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!<br />
* {{#dateformat:2009-11-01}} - iBugger core v0.1 successfully running on [[Nano 4G]]! [https://img217.imageshack.us/img217/4122/img0969.jpg]<br />
--><br />
Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.<br />
<br />
{| cellspacing="3" width="100%"<br />
|- valign="top"<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
===Project info===<br />
* [[ Status ]]<br />
* [[ Contact ]]<br />
* [[ Contributing ]]<br />
<br />
===Released Software===<br />
* [[wInd3x]]<br />
* [[ipod_sun]]<br />
* [[U-Boot|U-Boot port]]<br />
* [[Linux|Linux port]]<br />
* Legacy:<br />
** [[iBugger]]<br />
** [[iLoader]]<br />
** [[emCORE]]<br />
<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
<br />
===Basic skills===<br />
* [[Working with binaries]]<br />
* [[Dumping firmware]]<br />
* [[Extracting firmware]]<br />
* [[Firmware downgrading]]<br />
* [[Troubleshooting]]<br />
<br />
===Reverse engineering results===<br />
* [[Firmware]]<br />
** [[Bootrom]]<br />
** [[Boot Process]]<br />
** [[Firmware decryption]]<br />
** [[FTL|Flash Translation Layer]]<br />
** [[RetailOS]]<br />
*** [[RetailOS Options]]<br />
* [[GUID table]]<br />
* [[JTAG]]<br />
* Nano 2G<br />
** [[Nano2G clock gates]]<br />
** [[Nano2G LCD init]]<br />
** [[Nano2G HW analysis]]<br />
** [[S5L8701 analysis]]<br />
* Nano 4G<br />
** [[Nano4G firmware upgrade process]]<br />
* Nano 5G<br />
** [[Nano 5G|General]]<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
===Hardware===<br />
* [[Hardware]]<br />
** [[Nano 1G]]<br />
** [[Nano 2G]]<br />
** [[Nano 3G]]<br />
** [[Nano 4G]]<br />
*** [[920-0614-03]]<br />
** [[Nano 5G]]<br />
** [[Nano 6G]]<br />
** [[Nano 7G]]<br />
** [[Classic 6G]]<br />
* [[Modes]]<br />
* [[Chronology]]<br />
* [[S5L8700 datasheet]]<br />
<br />
===Exploiting===<br />
* [[wInd3x]]<br />
* [[Pwnage 2.0]]<br />
* [[Notes vulnerability]]<br />
** [[Address bruteforcing]]<br />
** [[Nanotron 3000]]<br />
|}</div>User890104https://freemyipod.org/index.php?title=Modes&diff=22268Modes2026-04-07T14:08:21Z<p>User890104: </p>
<hr />
<div>At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting. <br />
<br />
==Normal mode==<br />
"Normal mode" is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.<br />
<br />
==Disk mode==<br />
In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text "Do not disconnect." or a checkmark symbol with the text "OK to disconnect." depending on whether the iPod is connected and if it has been ejected. <br />
<br />
Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]<br />
<br />
Disk mode is also referred to as "forced disk mode" in device information received from the iPod.<br />
<br />
The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the "disk" partition of the [[Firmware]]. <br />
<br />
==DFU mode==<br />
[https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the [[Nano 3G]] and newer and the [[Classic 6G]] and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].<br />
<br />
When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other IMG1 images cannot be sent in this mode.<br />
<br />
The [[Nano 2G]] also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does, however, support a NOR DFU mode that can be entered by holding down Back+Play right after rebooting the device<ref>https://www.rockbox.org/irc/log-20080904#13:31:44</ref>.<br />
<br />
==WTF mode==<br />
In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.<br />
<br />
The iTunes behavior upon seeing an iPod in WTF mode is to send it a "recovery" firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the "osos" partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].<br />
<br />
==Diagnostic mode==<br />
This mode will give quite a lot of info about your iPod. Except for the very first iPods, it can be accessed by holding center and rewind when the apple logo appears during reboot. For the [[Nano 6G]] you enter Diagnostics mode by holding down all three boutons. <sup>(clarification needed)</sup><br />
<br />
==USB IDs==<br />
When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in: <br />
{| class="wikitable" <br />
|-<br />
! colspan="2" | Model<br />
! Normal/disk mode<br />
! DFU mode<br />
! WTF mode<br />
|-<br />
| colspan="2" | [[Nano 2G]]<br />
| <code>1260</code><br />
| <code>1220</code><br />
| <code>1240</code><br />
|-<br />
| colspan="2" | [[Nano 3G]]<br />
| <code>1262</code><br />
| <code>1223</code>/<code>1224</code><br />
| <code>1242</code><br />
|-<br />
| colspan="2" | [[Nano 4G]]<br />
| <code>1263</code><br />
| <code>1225</code><br />
| <code>1243</code><br />
|-<br />
| colspan="2" | [[Nano 5G]]<br />
| <code>1265</code><br />
| <code>1231</code><br />
| <code>1246</code><br />
|-<br />
| colspan="2" | [[Nano 6G]]<br />
| <code>1266</code><br />
| <code>1232</code><br />
| <code>1248</code><br />
|-<br />
| rowspan="2" | [[Nano 7G]]<br />
| Initial<br />
| rowspan="2" | <code>1267</code><br />
| rowspan="2" | <code>1234</code><br />
| <code>1249</code><br />
|-<br />
| Rev A<br />
| <code>124a</code><br />
|-<br />
| rowspan="4" | [[Classic 6G]]<br />
| [[Classic 6G#Initial|Initial]]<br />
| rowspan="4" | <code>1261</code><br />
| rowspan="4" | <code>1223</code><br />
| <code>1241</code><br />
|-<br />
| [[Classic 6G#Rev A|Rev A]]<br />
| <code>1245</code><br />
|-<br />
| [[Classic 6G#Rev B|Rev B]]<br />
| <code>1247</code><br />
|-<br />
| Rev C<br />
| <code>1250</code><br />
|}</div>User890104https://freemyipod.org/index.php?title=EmCORE_Installation/iPodNano6G&diff=22267EmCORE Installation/iPodNano6G2026-04-07T14:04:59Z<p>User890104: </p>
<hr />
<div>Sorry, your device is not currently supported by [[emCORE]].<br />
<br />
<br />
Porting [[emCORE]] to a new device is generally a lot of work and requires lots of experience with embedded system development.<br />
<br />
The exact amount of work needed varies greatly and depends on the complexity of the device and similarities to devices that [[emCORE]] has already been ported to.<br />
<br />
An exploit has been found [[S5Late]] and a modified version made to work with the [[Nano 6G]] exists. (find it here [https://github.com/NyanSatan/S5Late-8723 S5Late-8723]) there is some work in progress to getting it to work with wInd3x and getting alpine linux booted on it (not emCORE for now).</div>User890104https://freemyipod.org/index.php?title=Linux&diff=22258Linux2026-04-06T17:51:23Z<p>User890104: </p>
<hr />
<div><br />
== Current: Freemyipod Linux ==<br />
<br />
We are working on supporting Samsung/S5L-based devices which have an MMU. Currently our main focus is the [[Nano 7G]], there are also builds for [[Nano 2G]] and [[Nano 5G]]. An experimental source tree is available on [https://github.com/freemyipod/linux github.com/freemyipod/linux]. Aditionaly [[User:ZeOne]] is working on making it work with the [[Nano 6G]] you can read more about that on his page.<br />
<br />
=== User Guide ===<br />
<br />
Not yet available, as the Linux port isn't yet practical to use. We have no storage drivers, no sound driver...<br />
<br />
=== Developer Guide ===<br />
<br />
If you're somewhat familiar with embedded Linux, you can get started by building [[WInd3x|wInd3x]], [[U-Boot]] and the Kernel as described below. However, '''you will have to provide your own userland''' (eg. buildroot, archlinux arm, ... anything armv6 compatible) and either run it from an initramfs or over NFS. '''A serial cable is not necessary, but very useful to troubleshoot boot issues.'''<br />
<br />
==== Build everything ====<br />
<br />
''These are not copy-paste instructions. You are expected to understand what's happening.'<br />
<br />
You will need an arm-none-eabi- toolchain into your $PATH, eg. gcc-arm-embedded from your package manager.<br />
<br />
First, wInd3x: this will be used to run u-boot.<br />
<br />
$ git clone https://github.com/freemyipod/wInd3x<br />
$ cd wInd3x<br />
$ go build ./cmd/wInd3x<br />
<br />
Second, U-Boot:<br />
<br />
$ git clone https://github.com/freemyipod/u-boot<br />
$ cd u-boot<br />
$ git checkout s5l87xx<br />
$ make apple_ipodnano2g_defconfig # for Nano 2G OR<br />
$ make apple_n33_defconfig # for Nano 5G OR<br />
$ make apple_n31_defconfig # for Nano 7G<br />
$ make CROSS_COMPILE=arm-none-eabi- -j $(nproc) u-boot.bin<br />
<br />
Third, Linux:<br />
<br />
$ git clone https://github.com/freemyipod/linux<br />
$ cd linux<br />
$ git checkout n5g-wip # for Nano 5G OR<br />
$ git checkout n7g-wip # for Nano 7G<br />
$ make ARCH=arm nano5g_defconfig # for Nano 5G<br />
$ make ARCH=arm apple_n31_defconfig # for Nano 7G<br />
$ make ARCH=arm CROSS_COMPILE=arm-none-eabi- -j $(nproc) zImage<br />
<br />
By this point, have a initramfs ready. If you wanna boot directly from nfs, edit CMDLINE in the kernel .config accordingly.<br />
<br />
Finally, bundle together an u-boot image containing the kernel, your initramfs, and the device-tree (built by u-boot):<br />
<br />
$ mkimage -A arm -C none -O linux -T multi -a 0x08000000 -e 0x08000000 -d arch/arm/boot/zImage:initramfs.gz:../u-boot/arch/arm/dts/s5l8730.dtb mImage<br />
<br />
''mImage'' is your combined image.<br />
<br />
==== Running ====<br />
<br />
Connect your iPod nano in DFU mode.<br />
<br />
Run u-boot using wInd3x:<br />
<br />
$ ./wInd3x cfw run ../u-boot/u-boot.bin<br />
<br />
This should start u-boot. Running this for the first time will take a while, as some bootloader stages need to be downloaded, decrypted and modified. A new USB device (05ac:8007) appear on your host. Use dfu-util to upload mImage:<br />
<br />
dfu-util -d 05ac:8007 -D mImage && dfu-util -d 05ac:8007 -e<br />
<br />
Then, in the serial console you'll see Linux booting:<br />
<br />
## Booting kernel from Legacy Image at 08000000 ...<br />
...<br />
Starting kernel ...<br />
<br />
[ 0.000000] Booting Linux on physical CPU 0x0<br />
[ 0.000000] Linux version 6.2.0-rc4-00476-g4c4af4d7e53c (q3k@mimeomia) (arm-none-eabi-gcc (GNU Arm Embedded Toolchain 10.3-2021.10) 10.3.1 20210824 (release), GNU ld (GNU Arm Embedded Toolchain 10.3-2021.10) 2.36.1.20210621) #70 Fri Jan 20 18:02:56 CET 2023<br />
...<br />
<br />
The LCD display should start up and show a boot log. If not, try adding <code>console=tty0</code> to your CMDLINE? You might also use <code>fbcon=rotate:1</code> to rotate the framebuffer 90 degrees.<br />
<br />
If everything goes well, the kernel should boot up and attempt to mount a rootfs. It's up to you to get this part working, at least until we streamline the process. The USB CDC EEM ethernet gadget should also appear on your host (probably as usb0, or some long systemd predictable name). The other end will be visible as 'usb0' on the device.<br />
<br />
On [[Nano 7G]] you'll need a DCSD cable (Alex/Magico), and the command line to get proper serial output:<br />
<br />
picocom --baud 115200 --imap lfcrlf /dev/ttyUSB0<br />
<br />
Now go on and have a go at reverse-engineering some peripherals! :)<br />
<br />
== Legacy: iPodLinux ==<br />
<br />
The [http://www.ipodlinux.org/ iPodLinux] project supports all the PortalPlayer based iPods: iPod 1G-4G, Photo/Color, Video/5G/5.5G, Mini, iPod Nano 1G. It is currently semi-abandoned, and uses a very old ucLinux kernel build.</div>User890104https://freemyipod.org/index.php?title=Hardware&diff=22255Hardware2026-04-05T16:21:25Z<p>User890104: </p>
<hr />
<div>== Overview ==<br />
<br />
This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.<br />
<br />
{| class="wikitable"<br />
! Generation !! SoC !! CPU Core !! RAM !! NOR/Utility Flash !! Device Code Name !! SoC Family Code Name !! UpdaterFamilyID<br />
|-<br />
|[[Nano 1G]]<br />
|PP5021C-TDF<br />
|ARM7TDMI x 2<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41856 SST39WF400A] (512KiB)<br />
|M26<br />
|<br />
|14/17<br />
|-<br />
|[[Nano 2G]]<br />
|S5L8701<br />
|ARM940T<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41422 SST39WF800A] (1MiB)<br />
|N36<br />
|M1<br />
|19/29<br />
|-<br />
|[[Nano 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (32MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N46<br />
|M1A<br />
|26<br />
|-<br />
|[[Nano 4G]]<br />
|S5L8720<br />
|ARM1176<br />
|Integrated (32MiB)<br />
|''none''<br />
|N58<br />
|M2<br />
|31<br />
|-<br />
|[[Nano 5G]]<br />
|S5L8730<br />
|ARM1176<br />
|Integrated (64MiB)<br />
|''none''<br />
|N33<br />
|M2<br />
|34<br />
|-<br />
|[[Nano 6G|Nano 6G]]<br />
|S5L8723<br />
|ARM1176<br />
|Integrated (64MiB)<br />
|''none''<br />
|N20<ref>N20 Snowfox in the ''Diagnostics mode'' header</ref><br />
|<br />
|36<br />
|-<br />
|[[Nano 7G|Nano 7G]]<br />
|S5L8740<br />
|Cortex A5<br />
|Integrated (64MiB)<br />
|''none''<br />
|N31<ref>N31 Snowfox in the ''Diagnostics mode'' header</ref><br />
|M2R<ref>m2rfmssWriteBLPage in 1.0.4 [[RetailOS]]</ref><br />
|37<br />
|-<br />
|[[Classic 1G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
|M1A<br />
|24<br />
|-<br />
|[[Classic 2G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
|M1A<br />
|33<br />
|-<br />
|[[Classic 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X51163PE] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
|M1A<br />
|35/38<br />
|}<br />
<br />
=== Explanations ===<br />
<br />
* '''Device Code Name''': product code name, from early prototype phases to production run device. Most commonly used internal reference.<br />
* '''SoC Family Code Name''': device family code name, seems to follow large generational changes in SoC. Mostly seen around hardware (init) code, eg. flash interface, diags, etc.<br />
<br />
==Helpful pages==<br />
Chip analyses<br />
*http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx<br />
*http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx<br />
Additional information<br />
*http://dendrites.blog.163.com/blog/static/165376178201082112922174/<br />
*https://theapplewiki.com/wiki/User:Ilikeiphone123/Playground/Codenames<br />
<br />
==Notes==<br />
<references /></div>User890104https://freemyipod.org/index.php?title=User:User890104&diff=22254User:User8901042026-04-05T16:11:03Z<p>User890104: </p>
<hr />
<div>My name is Vencislav Atanasov. I am from Sofia, Bulgaria. I enjoy writing pieces of software, mainly to improve my experience and knowledge. I own some [https://docs.google.com/spreadsheets/d/1g5pdCug-kiW9oF1QSWFShjuld8iIiKZhvSVK1sywjak/edit?usp=sharing iDevices].<br />
<br />
If you want to get in touch, my contacts are [https://blog.slackwa.re/p/contact.html on my blog]<br />
<br />
Recently, I have been working on:<br />
* An unified [[U-Boot]] [https://github.com/freemyipod/u-boot repository] for [[Nano_2G]], [[Nano_5G]] and [[Nano_7G]], compiled from other developers' own research and implementation<br />
* A [[Linux]] [https://github.com/freemyipod/linux repository] for [[Nano_7G]] which is going to incorporate changes from the [[Nano_2G]] and [[Nano_5G]] ports of the other developers<br />
* Merged the incomplete [[Nano_3G]] and [[Nano_4G]] branch of Rockbox into upstream together with some fixes<br />
<br />
I'm currently working on:<br />
* More [[Linux]] drivers for [[Nano_7G]]<br />
* [https://www.rockbox.org/ Rockbox] on [[Nano_3G]] and [[Nano_4G]]<br />
<br />
My long-term goals are:<br />
* [[U-Boot]] for the whole S5L nano series<br />
* [[Linux]] for the whole S5L nano series<br />
* [https://www.rockbox.org/ Rockbox] for the whole S5L nano series<br />
<br />
I used to provide the project with iPod Nano 2G and iPod classic [[emCORE]] installer builds, which are not suitable for everyday use. The binaries can be found at http://builds.freemyipod.org/<br />
<br />
I used to work on [[emCOREFS]], it provides easy access to iPod's internal storage using [[emCORE_Monitor_Protocol|emCORE's monitor protocol]], libusb and FUSE. It is working somehow, but it's still incomplete and needs to be optimised. If you are curious about my current progress, you can check it out at [https://github.com/freemyipod/freemyipod/tree/master/emcore/tools/emcorefs emcore/tools/emcorefs on the freemyipod GitHub repo]</div>User890104https://freemyipod.org/index.php?title=User:User890104&diff=22253User:User8901042026-04-05T16:09:34Z<p>User890104: </p>
<hr />
<div>My name is Vencislav Atanasov. I am from Sofia, Bulgaria. I enjoy writing pieces of software, mainly to improve my experience and knowledge. I own some [https://docs.google.com/spreadsheets/d/1g5pdCug-kiW9oF1QSWFShjuld8iIiKZhvSVK1sywjak/edit?usp=sharing iDevices].<br />
<br />
If you want to get in touch, my contacts are [https://blog.slackwa.re/p/contact.html on my blog]<br />
<br />
Recently, I have been working on:<br />
* An unified [[U-Boot]] [https://github.com/freemyipod/u-boot repository] for [[Nano_2G]], [[Nano_5G]] and [[Nano_7G]], compiled from other developers' own research and implementations<br />
* A [[Linux]] [https://github.com/freemyipod/linux repository] for [[Nano_7G]] which is going to incorporate changes from the [[Nano_2G]] and [[Nano_5G]] ports of the other developers<br />
* Merged the [[Nano_3G]] and [[Nano_4G]] incomplete branch of Rockbox into upstream together with some fixes<br />
<br />
I'm currently working on:<br />
* More [[Linux]] drivers for [[Nano_7G]]<br />
* Rockbox on [[Nano_3G]] and [[Nano_4G]]<br />
<br />
My long-term goals are:<br />
* [[U-Boot]] for the whole S5L nano series<br />
* [[Linux]] for the whole S5L nano series<br />
* Rockbox for the whole S5L nano series<br />
<br />
I used to provide the project with iPod Nano 2G and iPod classic [[emCORE]] installer builds, which are not suitable for everyday use. The binaries can be found at http://builds.freemyipod.org/<br />
<br />
I used to work on [[emCOREFS]], it provides easy access to iPod's internal storage using [[emCORE_Monitor_Protocol|emCORE's monitor protocol]], libusb and FUSE. It is working somehow, but it's still incomplete and needs to be optimised. If you are curious about my current progress, you can check it out at [https://github.com/freemyipod/freemyipod/tree/master/emcore/tools/emcorefs emcore/tools/emcorefs on the freemyipod GitHub repo]</div>User890104https://freemyipod.org/index.php?title=Hardware&diff=22252Hardware2026-04-05T14:36:40Z<p>User890104: </p>
<hr />
<div>== Overview ==<br />
<br />
This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.<br />
<br />
{| class="wikitable"<br />
! Generation !! SoC !! CPU Core !! RAM !! NOR/Utility Flash !! Device Code Name !! SoC Family Code Name !! UpdaterFamilyID<br />
|-<br />
|[[Nano 1G]]<br />
|PP5021C-TDF<br />
|ARM7TDMI x 2<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41856 SST39WF400A] (512KiB)<br />
|M26<br />
|<br />
|14/17<br />
|-<br />
|[[Nano 2G]]<br />
|S5L8701<br />
|ARM940T<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41422 SST39WF800A] (1MiB)<br />
|N36<br />
|M1<br />
|19/29<br />
|-<br />
|[[Nano 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (32MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N46<br />
|M1A<br />
|26<br />
|-<br />
|[[Nano 4G]]<br />
|S5L8720<br />
|ARM1176<br />
|Integrated (32MiB)<br />
|''none''<br />
|N58<br />
|M2<br />
|31<br />
|-<br />
|[[Nano 5G]]<br />
|S5L8730<br />
|ARM1176<br />
|Integrated (64MiB)<br />
|''none''<br />
|N33<br />
|M2<br />
|34<br />
|-<br />
|[[Nano 6G|Nano 6G]]<br />
|S5L8723<br />
|ARM1176<br />
|Integrated (64MiB)<br />
|''none''<br />
|N20<ref>N20 Snowfox in the ''Diagnostics mode'' header</ref><br />
|<br />
|36<br />
|-<br />
|[[Nano 7G|Nano 7G]]<br />
|S5L8740<br />
|Cortex A5<br />
|Integrated (64MiB)<br />
|''none''<br />
|N31<ref>N31 Snowfox in the ''Diagnostics mode'' header</ref><br />
|M2R<ref>m2rfmssWriteBLPage in 1.0.4 [[RetailOS]]</ref><br />
|37<br />
|-<br />
|[[Classic 1G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
|M1A<br />
|24<br />
|-<br />
|[[Classic 2G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
|M1A<br />
|33<br />
|-<br />
|[[Classic 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X51163PE] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
|M1A<br />
|35/38<br />
|}<br />
<br />
=== Explanations ===<br />
<br />
* '''Device Code Name''': product code name, from early prototype phases to production run device. Most commonly used internal reference.<br />
* '''SoC Family Code Name''': device family code name, seems to follow large generational changes in SoC. Mostly seen around hardware (init) code, eg. flash interface, diags, etc.<br />
<br />
==Helpful pages==<br />
Chip analyses<br />
*http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx<br />
*http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx<br />
Additional information<br />
*http://dendrites.blog.163.com/blog/static/165376178201082112922174/<br />
<br />
<br />
==Notes==<br />
<references /></div>User890104https://freemyipod.org/index.php?title=Hardware&diff=22251Hardware2026-04-05T14:26:21Z<p>User890104: add cpu core and device code name from the apple wiki</p>
<hr />
<div>== Overview ==<br />
<br />
This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.<br />
<br />
{| class="wikitable"<br />
! Generation !! SoC !! CPU Core !! RAM !! NOR/Utility Flash !! Device Code Name !! SoC Family Code Name !! UpdaterFamilyID<br />
|-<br />
|[[Nano 1G]]<br />
|PP5021C-TDF<br />
|ARM7TDMI x 2<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41856 SST39WF400A] (512KiB)<br />
|M26<br />
|<br />
|14/17<br />
|-<br />
|[[Nano 2G]]<br />
|S5L8701<br />
|ARM940T<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41422 SST39WF800A] (1MiB)<br />
|N36<br />
|M1<br />
|19/29<br />
|-<br />
|[[Nano 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (32MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N46<br />
|M1A<br />
|26<br />
|-<br />
|[[Nano 4G]]<br />
|S5L8720<br />
|ARM1176<br />
|Integrated (32MiB)<br />
|''none''<br />
|N58<br />
|M2<br />
|31<br />
|-<br />
|[[Nano 5G]]<br />
|S5L8730<br />
|ARM1176<br />
|Integrated (64MiB)<br />
|''none''<br />
|N33<br />
|M2<br />
|34<br />
|-<br />
|[[Nano 6G|Nano 6G]]<br />
|S5L8723<br />
|ARM1176<br />
|Integrated (64MiB)<br />
|''none''<br />
|N20<br />
|<br />
|36<br />
|-<br />
|[[Nano 7G|Nano 7G]]<br />
|S5L8740<br />
|Cortex A5<br />
|Integrated (64MiB)<br />
|''none''<br />
|N31<br />
|M2R<ref>m2rfmssWriteBLPage in 1.0.4 RetailOS</ref><br />
|37<br />
|-<br />
|[[Classic 1G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
|M1A<br />
|24<br />
|-<br />
|[[Classic 2G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
|M1A<br />
|33<br />
|-<br />
|[[Classic 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X51163PE] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
|M1A<br />
|35/38<br />
|}<br />
<br />
=== Explanations ===<br />
<br />
* '''Device Code Name''': product code name, from early prototype phases to production run device. Most commonly used internal reference.<br />
* '''SoC Family Code Name''': device family code name, seems to follow large generational changes in SoC. Mostly seen around hardware (init) code, eg. flash interface, diags, etc.<br />
<br />
==Helpful pages==<br />
Chip analyses<br />
*http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx<br />
*http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx<br />
Additional information<br />
*http://dendrites.blog.163.com/blog/static/165376178201082112922174/<br />
<br />
<br />
==Notes==<br />
<references /></div>User890104https://freemyipod.org/index.php?title=Status&diff=22247Status2026-03-30T22:40:31Z<p>User890104: </p>
<hr />
<div><!--<br />
{{outdated|reason=This page is not updated anymore, please refer to [https://www.rockbox.org/ Rockbox's website] for a list of supported iPod models.}}<br />
--><br />
This status is based on the progress the freemyipod team has made so far. This is mostly a summary of reverse engineering and "janitorial" work required to run end-user software like Rockbox or Linux.<br />
<br />
{| class="wikitable"<br />
! !! [[Nano 2G]] !! [[Nano 3G]] !! [[Nano 4G]] !! [[Nano 5G]] !! [[Nano 6G]] !! [[Nano 7G]] !! [[Classic 1G]] !! [[Classic 2G]] !! [[Classic 3G]]<br />
|-<br />
| Code execution<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Tethered'''</span><br />
| <span style="color:green">'''Yes'''<ref name="nano6g7g"/></span><br />
| <span style="color:green">'''Yes'''<ref name="nano6g7g"/></span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Firmware decryption<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| [[U-Boot]]<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
|-<br />
| [[emCORE]]<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| [https://www.rockbox.org/ Rockbox]<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| [[Linux]]<br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
|-<br />
| Boot [[OSOS]]<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| SDRAM<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| UART<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''No'''<ref name="uartnotneeded"/></span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| USB<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| SPI<br />
| <span style="color:grey">'''Unused'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| I2C<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Backlight<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| LCD<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Clickwheel<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Audio<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| NAND/Hard Drive<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Power management<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
|-<br />
| RTC<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Piezo<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Accelerometer<br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
|}<br />
<br />
===Annotations===<br />
<references><br />
<ref name="uartnotneeded">UART is not really needed here as we can already access the device via USB.</ref><br />
<ref name="nano6g7g">Untethered Nano 6G and Nano 7G code execution is implemented using CVE-2010-1797, tethered is implemented using [[S5Late]]/[[wInd3x]]</ref><br />
<ref name="tethered">Support is implemented in a tethered fashion via [[wInd3x]], where we re-use parts of the original Apple boot chain which negates the need of some features.</ref><br />
</references></div>User890104https://freemyipod.org/index.php?title=Status&diff=22246Status2026-03-30T22:37:31Z<p>User890104: </p>
<hr />
<div><!--<br />
{{outdated|reason=This page is not updated anymore, please refer to [https://www.rockbox.org/ Rockbox's website] for a list of supported iPod models.}}<br />
--><br />
This status is based on the progress the freemyipod team has made so far. This is mostly a summary of reverse engineering and "janitorial" work required to run end-user software like Rockbox or Linux.<br />
<br />
{| class="wikitable"<br />
! !! [[Nano 2G]] !! [[Nano 3G]] !! [[Nano 4G]] !! [[Nano 5G]] !! [[Nano 6G]] !! [[Nano 7G]] !! [[Classic 1G]] !! [[Classic 2G]] !! [[Classic 3G]]<br />
|-<br />
| Code execution<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Tethered'''</span><br />
| <span style="color:green">'''Yes'''<ref name="nano6g7g"/></span><br />
| <span style="color:green">'''Yes'''<ref name="nano6g7g"/></span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Firmware decryption<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| [[U-Boot]]<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
|-<br />
| [[emCORE]]<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Boot [[OSOS]]<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| SDRAM<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| UART<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''No'''<ref name="uartnotneeded"/></span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| USB<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| SPI<br />
| <span style="color:grey">'''Unused'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| I2C<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Backlight<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| LCD<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Clickwheel<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Audio<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| NAND/Hard Drive<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Power management<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
|-<br />
| RTC<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Piezo<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Accelerometer<br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
|}<br />
<br />
===Annotations===<br />
<references><br />
<ref name="uartnotneeded">UART is not really needed here as we can already access the device via USB.</ref><br />
<ref name="nano6g7g">Untethered Nano 6G and Nano 7G code execution is implemented using CVE-2010-1797, tethered is implemented using [[S5Late]]/[[wInd3x]]</ref><br />
<ref name="tethered">Support is implemented in a tethered fashion via [[wInd3x]], where we re-use parts of the original Apple boot chain which negates the need of some features.</ref><br />
</references></div>User890104https://freemyipod.org/index.php?title=Status&diff=22245Status2026-03-30T22:36:42Z<p>User890104: </p>
<hr />
<div><!--<br />
{{outdated|reason=This page is not updated anymore, please refer to [https://www.rockbox.org/ Rockbox's website] for a list of supported iPod models.}}<br />
--><br />
This status is based on the progress the freemyipod team has made so far. This is mostly a summary of reverse engineering and "janitorial" work required to run end-user software like Rockbox or Linux.<br />
<br />
{| class="wikitable"<br />
! !! [[Nano 2G]] !! [[Nano 3G]] !! [[Nano 4G]] !! [[Nano 5G]] !! [[Nano 6G]] !! [[Nano 7G]] !! [[Classic 1G]] !! [[Classic 2G]] !! [[Classic 3G]]<br />
|-<br />
| Code execution<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Tethered'''</span><br />
| <span style="color:green">'''Yes'''<ref name="nano6g7g"/></span><br />
| <span style="color:green">'''Yes'''<ref name="nano6g7g"/></span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Firmware decryption<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| [[U-Boot]]<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
|-<br />
| [[emCORE]]<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Boot [[OSOS]]<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| SDRAM<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| UART<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''No'''<ref name="uartnotneeded"/></span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| USB<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| SPI<br />
| <span style="color:grey">'''Unused'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| I2C<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Backlight<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| LCD<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Clickwheel<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Audio<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| NAND/Hard Drive<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Power management<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
|-<br />
| RTC<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Piezo<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Accelerometer<br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
|}<br />
<br />
===Annotations===<br />
<references><br />
<ref name="uartnotneeded">UART is not really needed here as we can already access the device via USB.</ref><br />
<ref name="nano6g7g">Untethered Nano 6G and Nano 7G code execution is implemented using CVE-2010-1797, tethered is implemented using [[S5Late]]/[[wInd3x]]</ref><br />
<ref name="tethered">Support is implemented in a tethered fashion via [[wInd3x]], where we re-use parts of the original Apple boot chain which negates the need of some features.</ref><br />
</references></div>User890104https://freemyipod.org/index.php?title=EmCORE_Releases/r708&diff=22244EmCORE Releases/r7082026-03-30T22:17:38Z<p>User890104: Removed protection from "EmCORE Releases/r708"</p>
<hr />
<div>__NOTOC__<br />
[[emCORE]] r708 was released on April 24th, 2011<br />
==Release notes / Known issues==<br />
* The display doesn't work on some iPod Nano 2G devices. If this happens to you, we suggest to stick with iLoader for now.<br />
* Reducing the CPU core voltage on the iPod Classic has been disabled. Battery life might be adversely affected.<br />
* There's a small number of iPod Classic devices where USB doesn't work unless the device was booted through DFU.<br />
<br />
==Fixes / Improvements==<br />
* Fixed several kernel bugs that affected CPU exception and panic handling and caused the device to just lock up instead of showing proper error messages.<br />
* Added trivial memory protection to catch most null pointer or garbage memory address accesses.<br />
* Fixed a race condition in libUI that caused the boot menu to crash occasionally.<br />
* Fixed various graphics glitches in the boot menu.<br />
<br />
==Files==<br />
===Common===<br />
[http://files.freemyipod.org/releases/20110424/fastboot-r708-20110424.emcoreapp fastboot.emcoreapp]<br/><br />
===iPod Nano 2G===<br />
[http://files.freemyipod.org/releases/20110424/installer-ipodnano2g-r708-20110424.bootnote installer-ipodnano2g.bootnote]<br/><br />
[http://files.freemyipod.org/releases/20110424/installer-ipodnano2g-r708-20110424.ipodx installer-ipodnano2g.ipodx]<br/><br />
[http://files.freemyipod.org/releases/20110424/installer-ipodnano2g-r708-20110424.ubi installer-ipodnano2g.ubi]<br/><br />
[http://files.freemyipod.org/releases/20110424/rockbox-ipodnano2g-r29777-20110424.zip rockbox-ipodnano2g.zip]<br/><br />
===iPod Classic===<br />
[http://files.freemyipod.org/releases/20110424/bootstrap-ipodclassic-r708-20110424.dfu bootstrap-ipodclassic.dfu]<br/><br />
[http://files.freemyipod.org/releases/20110424/installer-ipodclassic-r708-20110424.ubi installer-ipodclassic.ubi]<br/><br />
[http://files.freemyipod.org/releases/20110424/rockbox-ipodclassic-r29777-20110424.zip rockbox-ipodclassic.zip]<br/></div>User890104https://freemyipod.org/index.php?title=EmCORE_Releases/r692&diff=22243EmCORE Releases/r6922026-03-30T22:17:32Z<p>User890104: Removed protection from "EmCORE Releases/r692"</p>
<hr />
<div>__NOTOC__<br />
[[emCORE]] r692 was released on April 6th, 2011<br />
==Release notes / Known issues==<br />
* The boot menu occasionally locks up due to a combination of a kernel bug and a libUI bug. Rebooting the iPod the hard way by holding the menu and select buttons for 5 seconds should help.<br />
* The display doesn't work on some iPod Nano 2G devices. If this happens to you, we suggest to stick with iLoader for now.<br />
* Reducing the CPU core voltage on the iPod Classic has been disabled. Battery life might be adversely affected.<br />
* There's a small number of iPod Classic devices where USB doesn't work unless the device was booted through DFU.<br />
<br />
==Fixes / Improvements==<br />
* Disabled undervolting for the iPod Classic.<br />
* Fixed a kernel bug that causes lockups when injecting a firmware image while the boot menu is updating the display.<br />
<br />
==Files==<br />
===Common===<br />
[http://files.freemyipod.org/releases/20110406/fastboot-r692-20110406.emcoreapp fastboot.emcoreapp]<br/><br />
===iPod Nano 2G===<br />
[http://files.freemyipod.org/releases/20110406/installer-ipodnano2g-r692-20110406.bootnote installer-ipodnano2g.bootnote]<br/><br />
[http://files.freemyipod.org/releases/20110406/installer-ipodnano2g-r692-20110406.ipodx installer-ipodnano2g.ipodx]<br/><br />
[http://files.freemyipod.org/releases/20110406/installer-ipodnano2g-r692-20110406.ubi installer-ipodnano2g.ubi]<br/><br />
[http://files.freemyipod.org/releases/20110406/rockbox-ipodnano2g-r29681-20110406.zip rockbox-ipodnano2g.zip]<br/><br />
===iPod Classic===<br />
[http://files.freemyipod.org/releases/20110406/bootstrap-ipodclassic-r692-20110406.dfu bootstrap-ipodclassic.dfu]<br/><br />
[http://files.freemyipod.org/releases/20110406/installer-ipodclassic-r692-20110406.ubi installer-ipodclassic.ubi]<br/><br />
[http://files.freemyipod.org/releases/20110406/rockbox-ipodclassic-r29681-20110406.zip rockbox-ipodclassic.zip]<br/></div>User890104https://freemyipod.org/index.php?title=EmCORE_Releases/r674&diff=22242EmCORE Releases/r6742026-03-30T22:17:20Z<p>User890104: Removed protection from "EmCORE Releases/r674"</p>
<hr />
<div>__NOTOC__<br />
[[emCORE]] r674 was released on March 25th, 2011<br />
==Release notes / Known issues==<br />
* This is the first public release, so please be aware that there might be a bunch of still unknown bugs in the wild.<br />
* The boot menu occasionally locks up due to a combination of a kernel bug and a libUI bug. Rebooting the iPod the hard way by holding the menu and select buttons for 5 seconds should help.<br />
* The display doesn't work on some iPod Nano 2G devices. If this happens to you, we suggest to stick with iLoader for now.<br />
* This release reduces the CPU core voltage to conserve battery power, but apparently by a bit too much for some iPod Classic devices, causing all kinds of weird behavior. This was disabled in the r692 release, so please update if you suspect that you're affected by this.<br />
* We found a kernel bug in this release that causes lockups when injecting a firmware image while the boot menu is updating the display. This should not affect normal users.<br />
* There's a small number of iPod Classic devices where USB doesn't work unless the device was booted through DFU.<br />
==Fixes / Improvements==<br />
* Initial public [[emCORE]] release<br />
<br />
==Files==<br />
===Common===<br />
[http://files.freemyipod.org/releases/20110325/fastboot-r674-20110325.emcoreapp fastboot.emcoreapp]<br/><br />
===iPod Nano 2G===<br />
[http://files.freemyipod.org/releases/20110325/installer-ipodnano2g-r674-20110325.bootnote installer-ipodnano2g.bootnote]<br/><br />
[http://files.freemyipod.org/releases/20110325/installer-ipodnano2g-r674-20110325.ipodx installer-ipodnano2g.ipodx]<br/><br />
[http://files.freemyipod.org/releases/20110325/installer-ipodnano2g-r674-20110325.ubi installer-ipodnano2g.ubi]<br/><br />
[http://files.freemyipod.org/releases/20110325/rockbox-ipodnano2g-r29644-20110325.zip rockbox-ipodnano2g.zip]<br/><br />
===iPod Classic===<br />
[http://files.freemyipod.org/releases/20110325/bootstrap-ipodclassic-r674-20110325.dfu bootstrap-ipodclassic.dfu]<br/><br />
[http://files.freemyipod.org/releases/20110325/installer-ipodclassic-r674-20110325.ubi installer-ipodclassic.ubi]<br/><br />
[http://files.freemyipod.org/releases/20110325/rockbox-ipodclassic-r29644-20110325.zip rockbox-ipodclassic.zip]<br/></div>User890104https://freemyipod.org/index.php?title=EmCORE_Releases&diff=22241EmCORE Releases2026-03-30T22:17:09Z<p>User890104: Removed protection from "EmCORE Releases"</p>
<hr />
<div>{{outdated|reason=emCORE on iPod Classic is DEPRECATED, please use the [https://files.freemyipod.org/~user890104/bootloader-ipodclassic.html Rockbox bootloader] instead.}}<br />
<br />
Here is a list of all builds of [[emCORE]] that have been released into public so far.<br />
<br />
'''Please do not use any other builds unless you really know what you're doing!'''<br />
<br />
The most recent version is the topmost one in the following list. It is recommended to use that one, unless you have a specific reason to use another.<br />
<br />
* [[EmCORE_Releases/r859|'''emCORE r859 (2012-01-02)''']]<br />
<br />
* <s>[[EmCORE_Releases/r855|emCORE r855 (2012-01-01)]]</s><br />
<br />
* [[EmCORE_Releases/r708|emCORE r708 (2011-04-24)]]<br />
<br />
* [[EmCORE_Releases/r692|emCORE r692 (2011-04-06)]]<br />
<br />
* [[EmCORE_Releases/r674|emCORE r674 (2011-03-25)]]</div>User890104https://freemyipod.org/index.php?title=ILoader&diff=22240ILoader2026-03-30T22:16:56Z<p>User890104: Removed protection from "ILoader"</p>
<hr />
<div>{{outdated|reason=[[U-Boot]] is the current approach for starting custom firmware on iPods.}}</div>User890104https://freemyipod.org/index.php?title=About&diff=22239About2026-03-30T22:16:33Z<p>User890104: Removed protection from "About"</p>
<hr />
<div>#REDIRECT [[Main Page]]</div>User890104https://freemyipod.org/index.php?title=Status&diff=22238Status2026-03-30T22:10:33Z<p>User890104: Removed protection from "Status"</p>
<hr />
<div><!--<br />
{{outdated|reason=This page is not updated anymore, please refer to [https://www.rockbox.org/ Rockbox's website] for a list of supported iPod models.}}<br />
--><br />
This status is based on the progress the freemyipod team has made so far. This is mostly a summary of reverse engineering and 'janitorial' work required to run end-user software like Rockbox or Linux.<br />
<br />
{| class="wikitable"<br />
! !! [[Nano 2G]] !! [[Nano 3G]] !! [[Nano 4G]] !! [[Nano 5G]] !! [[Nano 6G]] !! [[Nano 7G]] !! [[Classic 1G]] !! [[Classic 2G]] !! [[Classic 3G]]<br />
|-<br />
| Code execution<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Tethered'''</span><br />
| <span style="color:green">'''Yes'''<ref name="nano6g7g"/></span><br />
| <span style="color:green">'''Yes'''<ref name="nano6g7g"/></span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Firmware decryption<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| [[U-Boot]]<br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
|-<br />
| [[emCORE]]<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Boot [[OSOS]]<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| SDRAM<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''No'''<ref name="tethered"/></span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| UART<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:grey">'''No'''<ref name="uartnotneeded"/></span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| USB<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| SPI<br />
| <span style="color:grey">'''Unused'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| I2C<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Backlight<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| LCD<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Clickwheel<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Audio<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| NAND/Hard Drive<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Power management<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
| <span style="color:grey">'''Partially'''</span><br />
|-<br />
| RTC<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
|-<br />
| Piezo<br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
|-<br />
| Accelerometer<br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:green">'''Yes'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:red">'''No'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
| <span style="color:grey">'''N/A'''</span><br />
|}<br />
<br />
===Annotations===<br />
<references><br />
<ref name="uartnotneeded">UART is not really needed here as we can already access the device via USB.</ref><br />
<ref name="nano6g7g">Nano 6G and Nano 7G code execution is implemented using CVE-2010-1797</ref><br />
<ref name="tethered">Nano 5G support is implemented in a tethered fashion via wInd3x, where we re-use parts of the original Apple boot chain which negates the need of some features.</ref><br />
</references></div>User890104https://freemyipod.org/index.php?title=Main_Page&diff=22237Main Page2026-03-30T04:33:02Z<p>User890104: add links</p>
<hr />
<div>__NOTOC__<br />
[[File:Photo 2025-12-27 20-36-24.jpg|280px|thumb|right|[[Linux]] 6.14.0 on [[Nano 7G]]]]<br />
[[File:EmCORE_Nano2G_Nano4G_Classic.jpg|280px|thumb|right|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]]]<br />
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].<br />
<br />
== FAQ ==<br />
<br />
=== What can I do with my [[Nano 2G]], [[Classic 6G]] or older iPods? ===<br />
<br />
There's an upstream Rockbox port for these devices. [https://www.rockbox.org/download/ Go use that].<br />
<br />
=== What can I do with my [[Nano 3G]] or newer? ===<br />
<br />
Not much (yet) unless you're an embedded developer :).<br />
<br />
On the [[Nano 3G]], [[Nano 4G]] and [[Nano 5G]], we have a stable tethered exploit ([[wInd3x]]) which allows early, untethered and safe (no permanent modification) code execution. This in turn allows you to run [[U-Boot]] and an early [[Linux|Linux port]] or experiment with reverse-engineering/modifying the original firmware, [[retailOS]].<br />
<br />
On the [[Nano 6G]], [[Nano 7G]] and iPod shuffle (4th generation), a vulnerability in DFU_DNLOAD packet parsing code can be exploited with [[S5Late]]. It allows tethered code execution.<br />
<br />
On the [[Nano 6G]] and [[Nano 7G]], a font parsing vulnerability (CVE-2010-1797) can be exploited with [[ipod_sun]]. It allows untethered code execution.<br />
<br />
There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.<br />
<br />
== Getting an account ==<br />
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].<br />
<br />
==Updates==<br />
* {{#dateformat:2026-03-30}} - Some of us will be at [https://entropia.de/GPN24 GPN24] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!<br />
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].<br />
* {{#dateformat:2025-12-26}} - Some of us will be at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!<br />
* {{#dateformat:2025-06-12}} - Some of us will be at [https://entropia.de/GPN23 GPN23] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!<br />
* {{#dateformat:2024-12-25}} - Some of us will be at [https://events.ccc.de/congress/2024/infos/startpage.html 38C3] in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]<br />
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.<br />
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.<br />
* {{#dateformat:2023-01-07}} - A preliminary [[U-Boot]] port to the [[Nano 5G]] [https://social.hackerspace.pl/@q3k/109655916469636189 has been developed].<br />
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!<br />
* {{#dateformat:2021-12-31}} - An exploit named [[wInd3x]], which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].<br />
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!<br />
<!--<br />
* {{#dateformat:2018-08-25}} - The website software has been updated to MediaWiki 1.31 after about 2 months of downtime.<br />
* {{#dateformat:2016-06-17}} - The freemyipod project is becoming deprecated, as parts of the code is slowly being integrated in Rockbox. It is likely that no future development on the freemyipod project will take place. Essential parts of emCORE helped building a Rockbox bootloader for iPod Classic, and any future development will take place in the Rockbox project.<br />
* {{#dateformat:2014-03-26}} - A bug that prevented [[emCORE]] installations on certain Windows configurations (getting stuck on "Booting UBI file..."), has been finally fixed! If the installation has failed for you before, you can retry it using the updated version of our tool (use the iTunes method for now).<br />
* {{#dateformat:2012-01-02}} - There have been some problems with the latest release. A hotfix release ([[EmCORE_Releases/r859|r859]]) has been published to fix some of these problems. [[Nano 2G]] users are advised to upgrade. See the [[EmCORE_Releases/r859|release details page]] for more information.<br />
* {{#dateformat:2012-01-01}} - A new release <s>([[EmCORE_Releases/r855|r855]])</s> is out! It includes a couple of new features, several bugfixes and a new bootmenu theme! More information on the <s>[[EmCORE_Releases/r855|release details page]]</s>.<br />
* {{#dateformat:2011-04-25}} - The [[emCORE]] kernel now runs on the iPod Touch 2G as well, thanks to the help of kleemajo. This is of course not a fully functional port yet, but we'll see how it continues. It's about the same state as the [[Nano 4G]] now. /7<br />
* {{#dateformat:2011-03-25}} - [[emCORE]] is replacing [[emBIOS]] completely now. Therefore [[emBIOS]] will be deprecated software as of now! All emBIOS users are advised to upgrade to emCORE including people using iLoader 0.2.2 or less. More detailed update instructions will follow!<br />
* {{#dateformat:2011-01-08}} - The Rockbox port for the iPod Classic is slowly getting usable. Most of the blocking issues have been fixed. The first-generation 160GB model still doesn't work, and some people are experiencing slightly garbled display contents.<br />
* {{#dateformat:2011-01-04}} - There is an early Rockbox port for the iPod Classic! It still isn't quite usable, playback stutters etc., but if you want to play around with it, here are some quick'n'dirty notes on the installation procedure: [[IPod Classic iLoader Installation]]<br />
* {{#dateformat:2010-11-22}} - We now have emBIOS support for the iPod classic 1g, the others might follow soon<br />
* {{#dateformat:2010-08-29}} - We're proud to announce the release of [[emBIOS]] v0.1.0 and [[iLoader]] v0.2.0!<br />
* {{#dateformat:2010-08-26}} - [[iLoader]], its installer and uninstaller all have been fully ported to [[emBIOS]] now. A beta release will be coming soon!<br />
* {{#dateformat:2010-08-13}} - [[emBIOS]] is continually being improved and the next step is porting tools like [[iLoader]] to use it.<br />
* {{#dateformat:2010-08-06}} - The wiki has now been moved to www.freemyipod.org<br />
* {{#dateformat:2010-08-05}} - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [https://websvn.freemyipod.org/listing.php?repname=freemyipod&path=/embios/ here]<br />
* {{#dateformat:2010-08-03}} - We can now access the [[Nano 4G]] accelerometer.<br />
* {{#dateformat:2010-08-02}} - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].<br />
* {{#dateformat:2010-08-01}} - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.<br />
* {{#dateformat:2010-07-27}} - The server got zapped by lightning but a new one was up and running within a day.<br />
* {{#dateformat:2010-02-23}} - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!<br />
* {{#dateformat:2009-11-01}} - iBugger core v0.1 successfully running on [[Nano 4G]]! [https://img217.imageshack.us/img217/4122/img0969.jpg]<br />
--><br />
Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.<br />
<br />
{| cellspacing="3" width="100%"<br />
|- valign="top"<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
===Project info===<br />
* [[ Status ]]<br />
* [[ Contact ]]<br />
* [[ Contributing ]]<br />
<br />
===Released Software===<br />
* [[wInd3x]]<br />
* [[ipod_sun]]<br />
* [[U-Boot|U-Boot port]]<br />
* [[Linux|Linux port]]<br />
* Legacy:<br />
** [[iBugger]]<br />
** [[iLoader]]<br />
** [[emCORE]]<br />
<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
<br />
===Basic skills===<br />
* [[Working with binaries]]<br />
* [[Dumping firmware]]<br />
* [[Extracting firmware]]<br />
* [[Firmware downgrading]]<br />
* [[Troubleshooting]]<br />
<br />
===Reverse engineering results===<br />
* [[Firmware]]<br />
** [[Bootrom]]<br />
** [[Boot Process]]<br />
** [[Firmware decryption]]<br />
** [[FTL|Flash Translation Layer]]<br />
** [[RetailOS]]<br />
*** [[RetailOS Options]]<br />
* [[GUID table]]<br />
* [[JTAG]]<br />
* Nano 2G<br />
** [[Nano2G clock gates]]<br />
** [[Nano2G LCD init]]<br />
** [[Nano2G HW analysis]]<br />
** [[S5L8701 analysis]]<br />
* Nano 4G<br />
** [[Nano4G firmware upgrade process]]<br />
* Nano 5G<br />
** [[Nano 5G|General]]<br />
<br />
===Other guides===<br />
* [[Modes]]<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
===Hardware===<br />
* [[Hardware]]<br />
** [[Nano 1G]]<br />
** [[Nano 2G]]<br />
** [[Nano 3G]]<br />
** [[Nano 4G]]<br />
*** [[920-0614-03]]<br />
** [[Nano 5G]]<br />
** [[Nano 6G]]<br />
** [[Nano 7G]]<br />
** [[Classic 6G]]<br />
* [[Chronology]]<br />
* [[S5L8700 datasheet]]<br />
<br />
===Exploiting===<br />
* [[wInd3x]]<br />
* [[Pwnage 2.0]]<br />
* [[Notes vulnerability]]<br />
** [[Address bruteforcing]]<br />
** [[Nanotron 3000]]<br />
|}</div>User890104https://freemyipod.org/index.php?title=Main_Page&diff=22236Main Page2026-03-30T04:26:00Z<p>User890104: show all updates since and including wInd3x</p>
<hr />
<div>__NOTOC__<br />
[[File:Photo 2025-12-27 20-36-24.jpg|280px|thumb|right|[[Linux]] 6.14.0 on [[Nano 7G]]]]<br />
[[File:EmCORE_Nano2G_Nano4G_Classic.jpg|280px|thumb|right|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]]]<br />
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].<br />
<br />
== FAQ ==<br />
<br />
=== What can I do with my [[Nano 2G]], [[Classic 6G]] or older iPods? ===<br />
<br />
There's an upstream Rockbox port for these devices. [https://www.rockbox.org/download/ Go use that].<br />
<br />
=== What can I do with my [[Nano 3G]] or newer? ===<br />
<br />
Not much (yet) unless you're an embedded developer :).<br />
<br />
On the [[Nano 3G]], [[Nano 4G]] and [[Nano 5G]], we have a stable tethered exploit ([[wInd3x]]) which allows early, untethered and safe (no permanent modification) code execution. This in turn allows you to run [[U-Boot]] and an early [[Linux|Linux port]] or experiment with reverse-engineering/modifying the original firmware, [[retailOS]].<br />
<br />
On the [[Nano 6G]], [[Nano 7G]] and iPod shuffle (4th generation), a vulnerability in DFU_DNLOAD packet parsing code can be exploited with [[S5Late]]. It allows tethered code execution.<br />
<br />
On the [[Nano 6G]] and [[Nano 7G]], a font parsing vulnerability (CVE-2010-1797) can be exploited with [[ipod_sun]]. It allows untethered code execution.<br />
<br />
There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.<br />
<br />
== Getting an account ==<br />
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].<br />
<br />
==Updates==<br />
* {{#dateformat:2026-03-30}} - Some of us will be at GPN24 in Karlsruhe! [https://entropia.de/GPN24 More info here]. Let us know on IRC/Discord/Matrix if you're also there!<br />
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at 39C3 on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].<br />
* {{#dateformat:2025-12-26}} - Some of us will be at 39C3 in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!<br />
* {{#dateformat:2025-06-12}} - Some of us will be at GPN23 in Karlsruhe! [https://entropia.de/GPN23 More info here]. Let us know on IRC/Discord/Matrix if you're also there!<br />
* {{#dateformat:2024-12-25}} - Some of us will be at 38C3 in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]<br />
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.<br />
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.<br />
* {{#dateformat:2023-01-07}} - [https://social.hackerspace.pl/@q3k/109655916469636189 A preliminary U-Boot port to the [[Nano 5G]] has been developed.]<br />
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!<br />
* {{#dateformat:2021-12-31}} - An exploit named wInd3x, which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].<br />
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!<br />
<!--<br />
* {{#dateformat:2018-08-25}} - The website software has been updated to MediaWiki 1.31 after about 2 months of downtime.<br />
* {{#dateformat:2016-06-17}} - The freemyipod project is becoming deprecated, as parts of the code is slowly being integrated in Rockbox. It is likely that no future development on the freemyipod project will take place. Essential parts of emCORE helped building a Rockbox bootloader for iPod Classic, and any future development will take place in the Rockbox project.<br />
* {{#dateformat:2014-03-26}} - A bug that prevented [[emCORE]] installations on certain Windows configurations (getting stuck on "Booting UBI file..."), has been finally fixed! If the installation has failed for you before, you can retry it using the updated version of our tool (use the iTunes method for now).<br />
* {{#dateformat:2012-01-02}} - There have been some problems with the latest release. A hotfix release ([[EmCORE_Releases/r859|r859]]) has been published to fix some of these problems. [[Nano 2G]] users are advised to upgrade. See the [[EmCORE_Releases/r859|release details page]] for more information.<br />
* {{#dateformat:2012-01-01}} - A new release <s>([[EmCORE_Releases/r855|r855]])</s> is out! It includes a couple of new features, several bugfixes and a new bootmenu theme! More information on the <s>[[EmCORE_Releases/r855|release details page]]</s>.<br />
* {{#dateformat:2011-04-25}} - The [[emCORE]] kernel now runs on the iPod Touch 2G as well, thanks to the help of kleemajo. This is of course not a fully functional port yet, but we'll see how it continues. It's about the same state as the [[Nano 4G]] now. /7<br />
* {{#dateformat:2011-03-25}} - [[emCORE]] is replacing [[emBIOS]] completely now. Therefore [[emBIOS]] will be deprecated software as of now! All emBIOS users are advised to upgrade to emCORE including people using iLoader 0.2.2 or less. More detailed update instructions will follow!<br />
* {{#dateformat:2011-01-08}} - The Rockbox port for the iPod Classic is slowly getting usable. Most of the blocking issues have been fixed. The first-generation 160GB model still doesn't work, and some people are experiencing slightly garbled display contents.<br />
* {{#dateformat:2011-01-04}} - There is an early Rockbox port for the iPod Classic! It still isn't quite usable, playback stutters etc., but if you want to play around with it, here are some quick'n'dirty notes on the installation procedure: [[IPod Classic iLoader Installation]]<br />
* {{#dateformat:2010-11-22}} - We now have emBIOS support for the iPod classic 1g, the others might follow soon<br />
* {{#dateformat:2010-08-29}} - We're proud to announce the release of [[emBIOS]] v0.1.0 and [[iLoader]] v0.2.0!<br />
* {{#dateformat:2010-08-26}} - [[iLoader]], its installer and uninstaller all have been fully ported to [[emBIOS]] now. A beta release will be coming soon!<br />
* {{#dateformat:2010-08-13}} - [[emBIOS]] is continually being improved and the next step is porting tools like [[iLoader]] to use it.<br />
* {{#dateformat:2010-08-06}} - The wiki has now been moved to www.freemyipod.org<br />
* {{#dateformat:2010-08-05}} - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [https://websvn.freemyipod.org/listing.php?repname=freemyipod&path=/embios/ here]<br />
* {{#dateformat:2010-08-03}} - We can now access the [[Nano 4G]] accelerometer.<br />
* {{#dateformat:2010-08-02}} - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].<br />
* {{#dateformat:2010-08-01}} - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.<br />
* {{#dateformat:2010-07-27}} - The server got zapped by lightning but a new one was up and running within a day.<br />
* {{#dateformat:2010-02-23}} - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!<br />
* {{#dateformat:2009-11-01}} - iBugger core v0.1 successfully running on [[Nano 4G]]! [https://img217.imageshack.us/img217/4122/img0969.jpg]<br />
--><br />
Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.<br />
<br />
{| cellspacing="3" width="100%"<br />
|- valign="top"<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
===Project info===<br />
* [[ Status ]]<br />
* [[ Contact ]]<br />
* [[ Contributing ]]<br />
<br />
===Released Software===<br />
* [[wInd3x]]<br />
* [[ipod_sun]]<br />
* [[U-Boot|U-Boot port]]<br />
* [[Linux|Linux port]]<br />
* Legacy:<br />
** [[iBugger]]<br />
** [[iLoader]]<br />
** [[emCORE]]<br />
<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
<br />
===Basic skills===<br />
* [[Working with binaries]]<br />
* [[Dumping firmware]]<br />
* [[Extracting firmware]]<br />
* [[Firmware downgrading]]<br />
* [[Troubleshooting]]<br />
<br />
===Reverse engineering results===<br />
* [[Firmware]]<br />
** [[Bootrom]]<br />
** [[Boot Process]]<br />
** [[Firmware decryption]]<br />
** [[FTL|Flash Translation Layer]]<br />
** [[RetailOS]]<br />
*** [[RetailOS Options]]<br />
* [[GUID table]]<br />
* [[JTAG]]<br />
* Nano 2G<br />
** [[Nano2G clock gates]]<br />
** [[Nano2G LCD init]]<br />
** [[Nano2G HW analysis]]<br />
** [[S5L8701 analysis]]<br />
* Nano 4G<br />
** [[Nano4G firmware upgrade process]]<br />
* Nano 5G<br />
** [[Nano 5G|General]]<br />
<br />
===Other guides===<br />
* [[Modes]]<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
===Hardware===<br />
* [[Hardware]]<br />
** [[Nano 1G]]<br />
** [[Nano 2G]]<br />
** [[Nano 3G]]<br />
** [[Nano 4G]]<br />
*** [[920-0614-03]]<br />
** [[Nano 5G]]<br />
** [[Nano 6G]]<br />
** [[Nano 7G]]<br />
** [[Classic 6G]]<br />
* [[Chronology]]<br />
* [[S5L8700 datasheet]]<br />
<br />
===Exploiting===<br />
* [[wInd3x]]<br />
* [[Pwnage 2.0]]<br />
* [[Notes vulnerability]]<br />
** [[Address bruteforcing]]<br />
** [[Nanotron 3000]]<br />
|}</div>User890104https://freemyipod.org/index.php?title=Main_Page&diff=22235Main Page2026-03-30T04:22:59Z<p>User890104: add note about GPN24</p>
<hr />
<div>__NOTOC__<br />
[[File:Photo 2025-12-27 20-36-24.jpg|280px|thumb|right|[[Linux]] 6.14.0 on [[Nano 7G]]]]<br />
[[File:EmCORE_Nano2G_Nano4G_Classic.jpg|280px|thumb|right|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]]]<br />
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].<br />
<br />
== FAQ ==<br />
<br />
=== What can I do with my [[Nano 2G]], [[Classic 6G]] or older iPods? ===<br />
<br />
There's an upstream Rockbox port for these devices. [https://www.rockbox.org/download/ Go use that].<br />
<br />
=== What can I do with my [[Nano 3G]] or newer? ===<br />
<br />
Not much (yet) unless you're an embedded developer :).<br />
<br />
On the [[Nano 3G]], [[Nano 4G]] and [[Nano 5G]], we have a stable tethered exploit ([[wInd3x]]) which allows early, untethered and safe (no permanent modification) code execution. This in turn allows you to run [[U-Boot]] and an early [[Linux|Linux port]] or experiment with reverse-engineering/modifying the original firmware, [[retailOS]].<br />
<br />
On the [[Nano 6G]], [[Nano 7G]] and iPod shuffle (4th generation), a vulnerability in DFU_DNLOAD packet parsing code can be exploited with [[S5Late]]. It allows tethered code execution.<br />
<br />
On the [[Nano 6G]] and [[Nano 7G]], a font parsing vulnerability (CVE-2010-1797) can be exploited with [[ipod_sun]]. It allows untethered code execution.<br />
<br />
There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.<br />
<br />
== Getting an account ==<br />
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].<br />
<br />
==Updates==<br />
* {{#dateformat:2026-03-30}} - Some of us will be at GPN24 in Karlsruhe! [https://entropia.de/GPN24 More info here]. Let us know on IRC/Discord/Matrix if you're also there!<br />
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at 39C3 on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].<br />
* {{#dateformat:2025-12-26}} - Some of us will be at 39C3 in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!<br />
* {{#dateformat:2025-06-12}} - Some of us will be at GPN23 in Karlsruhe! [https://entropia.de/GPN23 More info here]. Let us know on IRC/Discord/Matrix if you're also there!<br />
* {{#dateformat:2024-12-25}} - Some of us will be at 38C3 in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]<br />
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.<br />
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.<br />
* {{#dateformat:2023-01-07}} - [https://social.hackerspace.pl/@q3k/109655916469636189 A preliminary U-Boot port to the [[Nano 5G]] has been developed.]<br />
<!--<br />
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!<br />
* {{#dateformat:2021-12-31}} - An exploit named wInd3x, which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].<br />
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!<br />
* {{#dateformat:2018-08-25}} - The website software has been updated to MediaWiki 1.31 after about 2 months of downtime.<br />
* {{#dateformat:2016-06-17}} - The freemyipod project is becoming deprecated, as parts of the code is slowly being integrated in Rockbox. It is likely that no future development on the freemyipod project will take place. Essential parts of emCORE helped building a Rockbox bootloader for iPod Classic, and any future development will take place in the Rockbox project.<br />
* {{#dateformat:2014-03-26}} - A bug that prevented [[emCORE]] installations on certain Windows configurations (getting stuck on "Booting UBI file..."), has been finally fixed! If the installation has failed for you before, you can retry it using the updated version of our tool (use the iTunes method for now).<br />
* {{#dateformat:2012-01-02}} - There have been some problems with the latest release. A hotfix release ([[EmCORE_Releases/r859|r859]]) has been published to fix some of these problems. [[Nano 2G]] users are advised to upgrade. See the [[EmCORE_Releases/r859|release details page]] for more information.<br />
* {{#dateformat:2012-01-01}} - A new release <s>([[EmCORE_Releases/r855|r855]])</s> is out! It includes a couple of new features, several bugfixes and a new bootmenu theme! More information on the <s>[[EmCORE_Releases/r855|release details page]]</s>.<br />
* {{#dateformat:2011-04-25}} - The [[emCORE]] kernel now runs on the iPod Touch 2G as well, thanks to the help of kleemajo. This is of course not a fully functional port yet, but we'll see how it continues. It's about the same state as the [[Nano 4G]] now. /7<br />
* {{#dateformat:2011-03-25}} - [[emCORE]] is replacing [[emBIOS]] completely now. Therefore [[emBIOS]] will be deprecated software as of now! All emBIOS users are advised to upgrade to emCORE including people using iLoader 0.2.2 or less. More detailed update instructions will follow!<br />
* {{#dateformat:2011-01-08}} - The Rockbox port for the iPod Classic is slowly getting usable. Most of the blocking issues have been fixed. The first-generation 160GB model still doesn't work, and some people are experiencing slightly garbled display contents.<br />
* {{#dateformat:2011-01-04}} - There is an early Rockbox port for the iPod Classic! It still isn't quite usable, playback stutters etc., but if you want to play around with it, here are some quick'n'dirty notes on the installation procedure: [[IPod Classic iLoader Installation]]<br />
* {{#dateformat:2010-11-22}} - We now have emBIOS support for the iPod classic 1g, the others might follow soon<br />
* {{#dateformat:2010-08-29}} - We're proud to announce the release of [[emBIOS]] v0.1.0 and [[iLoader]] v0.2.0!<br />
* {{#dateformat:2010-08-26}} - [[iLoader]], its installer and uninstaller all have been fully ported to [[emBIOS]] now. A beta release will be coming soon!<br />
* {{#dateformat:2010-08-13}} - [[emBIOS]] is continually being improved and the next step is porting tools like [[iLoader]] to use it.<br />
* {{#dateformat:2010-08-06}} - The wiki has now been moved to www.freemyipod.org<br />
* {{#dateformat:2010-08-05}} - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [https://websvn.freemyipod.org/listing.php?repname=freemyipod&path=/embios/ here]<br />
* {{#dateformat:2010-08-03}} - We can now access the [[Nano 4G]] accelerometer.<br />
* {{#dateformat:2010-08-02}} - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].<br />
* {{#dateformat:2010-08-01}} - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.<br />
* {{#dateformat:2010-07-27}} - The server got zapped by lightning but a new one was up and running within a day.<br />
* {{#dateformat:2010-02-23}} - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!<br />
* {{#dateformat:2009-11-01}} - iBugger core v0.1 successfully running on [[Nano 4G]]! [https://img217.imageshack.us/img217/4122/img0969.jpg]<br />
--><br />
Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.<br />
<br />
{| cellspacing="3" width="100%"<br />
|- valign="top"<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
===Project info===<br />
* [[ Status ]]<br />
* [[ Contact ]]<br />
* [[ Contributing ]]<br />
<br />
===Released Software===<br />
* [[wInd3x]]<br />
* [[ipod_sun]]<br />
* [[U-Boot|U-Boot port]]<br />
* [[Linux|Linux port]]<br />
* Legacy:<br />
** [[iBugger]]<br />
** [[iLoader]]<br />
** [[emCORE]]<br />
<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
<br />
===Basic skills===<br />
* [[Working with binaries]]<br />
* [[Dumping firmware]]<br />
* [[Extracting firmware]]<br />
* [[Firmware downgrading]]<br />
* [[Troubleshooting]]<br />
<br />
===Reverse engineering results===<br />
* [[Firmware]]<br />
** [[Bootrom]]<br />
** [[Boot Process]]<br />
** [[Firmware decryption]]<br />
** [[FTL|Flash Translation Layer]]<br />
** [[RetailOS]]<br />
*** [[RetailOS Options]]<br />
* [[GUID table]]<br />
* [[JTAG]]<br />
* Nano 2G<br />
** [[Nano2G clock gates]]<br />
** [[Nano2G LCD init]]<br />
** [[Nano2G HW analysis]]<br />
** [[S5L8701 analysis]]<br />
* Nano 4G<br />
** [[Nano4G firmware upgrade process]]<br />
* Nano 5G<br />
** [[Nano 5G|General]]<br />
<br />
===Other guides===<br />
* [[Modes]]<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
===Hardware===<br />
* [[Hardware]]<br />
** [[Nano 1G]]<br />
** [[Nano 2G]]<br />
** [[Nano 3G]]<br />
** [[Nano 4G]]<br />
*** [[920-0614-03]]<br />
** [[Nano 5G]]<br />
** [[Nano 6G]]<br />
** [[Nano 7G]]<br />
** [[Classic 6G]]<br />
* [[Chronology]]<br />
* [[S5L8700 datasheet]]<br />
<br />
===Exploiting===<br />
* [[wInd3x]]<br />
* [[Pwnage 2.0]]<br />
* [[Notes vulnerability]]<br />
** [[Address bruteforcing]]<br />
** [[Nanotron 3000]]<br />
|}</div>User890104https://freemyipod.org/index.php?title=Nano_7G&diff=22234Nano 7G2026-03-29T22:14:15Z<p>User890104: add nano 7th audio codec info</p>
<hr />
<div>{{DISPLAYTITLE:iPod nano (7th generation)}}<br />
==Components==<br />
[[File:Nano7g_front.jpg|500px|thumb|none|Photo of the circuit board]]<br />
[[File:Nano7g_back.jpg|500px|thumb|none|Close up of the larger chips on the circuit board]]<br />
{| class="wikitable"<br />
! Label !! Component !! Part !! Markings !! Notes<br />
|-<br />
| <span style="color:#ff0004">Red</span><br />
| PMIC<br />
| Dialog D1830<br />
| Apple 338S1099<br />
| Guessing based on connectivity to power components around.<br />
|-<br />
| <span style="color:#ff9024">Orange</span><br />
| Bluetooth + FM radio<br />
| Broadcom BCM2078KUBG<br />
|<br />
| <br />
|-<br />
| <span style="color:#f3e00e">Yellow</span><br />
|<br />
| NXP Semiconductors 1609A1<br />
|<br />
|<br />
|-<br />
| <span style="color:#16dc81">Green</span><br />
|<br />
|<br />
| 75203 23017<br />
|<br />
|-<br />
| <span style="color:#2343e8">Blue</span><br />
|<br />
|<br />
| 75292 98820<br />
|<br />
|}<br />
{| class="wikitable"<br />
! Label !! Component !! Part !! Markings !! Notes<br />
|-<br />
| <span style="color:#ff0000">Red</span><br />
| NAND flash<br />
| Toshiba THGBX2G7D2JLA01 128 Gb (16 GB)<br />
|<br />
| <br />
|-<br />
| <span style="color:#ff9024">Orange</span><br />
| Touchscreen controller<br />
| Texas Instruments 343S0538<br />
|<br />
| <br />
|-<br />
| <span style="color:#f3e00e">Yellow</span><br />
| Audio Codec<br />
| Cirrus Logic CLI1599A1<br />
| Apple 338S1146<br />
| [https://web.archive.org/web/20141220042233/https://chipworks.secure.force.com/catalog/ProductDetails?sku=APP-338S1146&viewState=DetailView&cartID=&g=&parentCategory=&navigationStr=CatalogSearchInc&searchText=cirrus Source]<br />
|-<br />
| <span style="color:#16dc81">Green</span><br />
| SoC/CPU<br />
| S5L8740<br />
| 339S0193<br />
| 8740 per IMG1. Guessing based on similar package to N6G SoC/CPU. Also has the most diffpairs running to/from it (from delayered PCB).<br />
|}<br />
<br />
==Helpful pages==<br />
Teardowns:<br />
* https://www.ifixit.com/Teardown/iPod+Nano+7th+Generation+Teardown/10826<br />
<!--<br />
Reviews:<br />
* TODO<br />
--><br />
<br />
== Core ==<br />
<br />
Cortex A5 according to CP15:<br />
<br />
<pre><br />
ID code: 0x410fc050<br />
Implementer: ARM<br />
Variant: 0x0<br />
Architecture: See CPUID<br />
Part number: c05, Revision: 0<br />
</pre><br />
<br />
== Memory Map ==<br />
<br />
{| class="wikitable"<br />
! Address !! Name<br />
|-<br />
| 0x38C00000<br />
| AES<br />
|-<br />
| 0x3C500000<br />
| CLKCON<br />
|-<br />
| 0x3C700000<br />
| TIMER<br />
|-<br />
| 0x3CC00000<br />
| UART0<br />
|-<br />
| 0x3CF00000<br />
| GPIO<br />
|-<br />
| 0x3D100000<br />
| CHIPID<br />
|}<br />
<br />
== Clock Gates ==<br />
<br />
There is no big debug table with all clock gates in N7G RetailOS, so the following has been written out by hand:<br />
<br />
{| class="wikitable"<br />
! Address !! Bits (clear to power on) !! Meaning !! Source<br />
|-<br />
| 0x3C50006C<br />
| 0x2000<br />
| 'SPI power'<br />
| WTF DevicePowerManagement.dll<br />
|-<br />
| 0x3C50004C<br />
| 0x4<br />
| 'SPI power'<br />
| WTF DevicePowerManagement.dll<br />
|-<br />
| 0x3C50004c<br />
| 0x1f800020<br />
| Timer<br />
| WTF IpodSec.dll<br />
|-<br />
| 0x3C500058<br />
| 0x60<br />
| Timer<br />
| WTF IpodSec.dll<br />
|-<br />
| 0x3c50006c<br />
| 0xc0007f<br />
| Timer<br />
| WTF IpodSec.dll<br />
|}</div>User890104https://freemyipod.org/index.php?title=Linux&diff=22233Linux2026-03-21T22:19:40Z<p>User890104: we have a display driver already</p>
<hr />
<div><br />
== Current: Freemyipod Linux ==<br />
<br />
We are working on supporting Samsung/S5L-based devices which have an MMU. Currently our main focus is the [[Nano 5G]], there are also builds for [[Nano 2G]] and [[Nano 7G]]. An experimental source tree is available on [https://github.com/freemyipod/linux github.com/freemyipod/linux].<br />
<br />
=== User Guide ===<br />
<br />
Not yet available, as the Linux port isn't yet practical to use. We have no storage drivers, no sound driver...<br />
<br />
=== Developer Guide ===<br />
<br />
If you're somewhat familiar with embedded Linux, you can get started by building [[WInd3x|wInd3x]], [[U-Boot]] and the Kernel as described below. However, '''you will have to provide your own userland''' (eg. buildroot, archlinux arm, ... anything armv6 compatible) and either run it from an initramfs or over NFS. '''A serial cable is not necessary, but very useful to troubleshoot boot issues.'''<br />
<br />
==== Build everything ====<br />
<br />
''These are not copy-paste instructions. You are expected to understand what's happening.'<br />
<br />
You will need an arm-none-eabi- toolchain into your $PATH, eg. gcc-arm-embedded from your package manager.<br />
<br />
First, wInd3x: this will be used to run u-boot.<br />
<br />
$ git clone https://github.com/freemyipod/wInd3x<br />
$ cd wInd3x<br />
$ go build ./cmd/wInd3x<br />
<br />
Second, U-Boot:<br />
<br />
$ git clone https://github.com/freemyipod/u-boot<br />
$ cd u-boot<br />
$ git checkout s5l87xx<br />
$ make apple_ipodnano2g_defconfig # for Nano 2G OR<br />
$ make apple_n33_defconfig # for Nano 5G OR<br />
$ make apple_n31_defconfig # for Nano 7G<br />
$ make CROSS_COMPILE=arm-none-eabi- -j $(nproc) u-boot.bin<br />
<br />
Third, Linux:<br />
<br />
$ git clone https://github.com/freemyipod/linux<br />
$ cd linux<br />
$ git checkout n5g-wip # for Nano 5G OR<br />
$ git checkout n7g-wip # for Nano 7G<br />
$ make ARCH=arm nano5g_defconfig # for Nano 5G<br />
$ make ARCH=arm apple_n31_defconfig # for Nano 7G<br />
$ make ARCH=arm CROSS_COMPILE=arm-none-eabi- -j $(nproc) zImage<br />
<br />
By this point, have a initramfs ready. If you wanna boot directly from nfs, edit CMDLINE in the kernel .config accordingly.<br />
<br />
Finally, bundle together an u-boot image containing the kernel, your initramfs, and the device-tree (built by u-boot):<br />
<br />
$ mkimage -A arm -C none -O linux -T multi -a 0x08000000 -e 0x08000000 -d arch/arm/boot/zImage:initramfs.gz:../u-boot/arch/arm/dts/s5l8730.dtb mImage<br />
<br />
''mImage'' is your combined image.<br />
<br />
==== Running ====<br />
<br />
Connect your iPod nano in DFU mode.<br />
<br />
Run u-boot using wInd3x:<br />
<br />
$ ./wInd3x cfw run ../u-boot/u-boot.bin<br />
<br />
This should start u-boot. Running this for the first time will take a while, as some bootloader stages need to be downloaded, decrypted and modified. A new USB device (05ac:8007) appear on your host. Use dfu-util to upload mImage:<br />
<br />
dfu-util -d 05ac:8007 -D mImage && dfu-util -d 05ac:8007 -e<br />
<br />
Then, in the serial console you'll see Linux booting:<br />
<br />
## Booting kernel from Legacy Image at 08000000 ...<br />
...<br />
Starting kernel ...<br />
<br />
[ 0.000000] Booting Linux on physical CPU 0x0<br />
[ 0.000000] Linux version 6.2.0-rc4-00476-g4c4af4d7e53c (q3k@mimeomia) (arm-none-eabi-gcc (GNU Arm Embedded Toolchain 10.3-2021.10) 10.3.1 20210824 (release), GNU ld (GNU Arm Embedded Toolchain 10.3-2021.10) 2.36.1.20210621) #70 Fri Jan 20 18:02:56 CET 2023<br />
...<br />
<br />
The LCD display should start up and show a boot log. If not, try adding <code>console=tty0</code> to your CMDLINE? You might also use <code>fbcon=rotate:1</code> to rotate the framebuffer 90 degrees.<br />
<br />
If everything goes well, the kernel should boot up and attempt to mount a rootfs. It's up to you to get this part working, at least until we streamline the process. The USB CDC EEM ethernet gadget should also appear on your host (probably as usb0, or some long systemd predictable name). The other end will be visible as 'usb0' on the device.<br />
<br />
On [[Nano 7G]] you'll need a DCSD cable (Alex/Magico), and the command line to get proper serial output:<br />
<br />
picocom --baud 115200 --imap lfcrlf /dev/ttyUSB0<br />
<br />
Now go on and have a go at reverse-engineering some peripherals! :)<br />
<br />
== Legacy: iPodLinux ==<br />
<br />
The [http://www.ipodlinux.org/ iPodLinux] project supports all the PortalPlayer based iPods: iPod 1G-4G, Photo/Color, Video/5G/5.5G, Mini, iPod Nano 1G. It is currently semi-abandoned, and uses a very old ucLinux kernel build.</div>User890104https://freemyipod.org/index.php?title=Nano_7G&diff=22232Nano 7G2026-02-28T17:30:41Z<p>User890104: </p>
<hr />
<div>{{DISPLAYTITLE:iPod nano (7th generation)}}<br />
==Components==<br />
[[File:Nano7g_front.jpg|500px|thumb|none|Photo of the circuit board]]<br />
[[File:Nano7g_back.jpg|500px|thumb|none|Close up of the larger chips on the circuit board]]<br />
{| class="wikitable"<br />
! Label !! Component !! Part !! Markings !! Notes<br />
|-<br />
| <span style="color:#ff0004">Red</span><br />
| PMIC<br />
| Dialog D1830<br />
| Apple 338S1099<br />
| Guessing based on connectivity to power components around.<br />
|-<br />
| <span style="color:#ff9024">Orange</span><br />
| Bluetooth + FM radio<br />
| Broadcom BCM2078KUBG<br />
|<br />
| <br />
|-<br />
| <span style="color:#f3e00e">Yellow</span><br />
|<br />
| NXP Semiconductors 1609A1<br />
|<br />
|<br />
|-<br />
| <span style="color:#16dc81">Green</span><br />
|<br />
|<br />
| 75203 23017<br />
|<br />
|-<br />
| <span style="color:#2343e8">Blue</span><br />
|<br />
|<br />
| 75292 98820<br />
|<br />
|}<br />
{| class="wikitable"<br />
! Label !! Component !! Part !! Markings !! Notes<br />
|-<br />
| <span style="color:#ff0000">Red</span><br />
| NAND flash<br />
| Toshiba THGBX2G7D2JLA01 128 Gb (16 GB)<br />
|<br />
| <br />
|-<br />
| <span style="color:#ff9024">Orange</span><br />
| Touchscreen controller<br />
| Texas Instruments 343S0538<br />
|<br />
| <br />
|-<br />
| <span style="color:#f3e00e">Yellow</span><br />
|<br />
| <br />
| Apple 338S1146<br />
|<br />
|-<br />
| <span style="color:#16dc81">Green</span><br />
| SoC/CPU<br />
| S5L8740<br />
| 339S0193<br />
| 8740 per IMG1. Guessing based on similar package to N6G SoC/CPU. Also has the most diffpairs running to/from it (from delayered PCB).<br />
|}<br />
<br />
==Helpful pages==<br />
Teardowns:<br />
* https://www.ifixit.com/Teardown/iPod+Nano+7th+Generation+Teardown/10826<br />
<!--<br />
Reviews:<br />
* TODO<br />
--><br />
<br />
== Core ==<br />
<br />
Cortex A5 according to CP15:<br />
<br />
<pre><br />
ID code: 0x410fc050<br />
Implementer: ARM<br />
Variant: 0x0<br />
Architecture: See CPUID<br />
Part number: c05, Revision: 0<br />
</pre><br />
<br />
== Memory Map ==<br />
<br />
{| class="wikitable"<br />
! Address !! Name<br />
|-<br />
| 0x38C00000<br />
| AES<br />
|-<br />
| 0x3C500000<br />
| CLKCON<br />
|-<br />
| 0x3C700000<br />
| TIMER<br />
|-<br />
| 0x3CC00000<br />
| UART0<br />
|-<br />
| 0x3CF00000<br />
| GPIO<br />
|-<br />
| 0x3D100000<br />
| CHIPID<br />
|}<br />
<br />
== Clock Gates ==<br />
<br />
There is no big debug table with all clock gates in N7G RetailOS, so the following has been written out by hand:<br />
<br />
{| class="wikitable"<br />
! Address !! Bits (clear to power on) !! Meaning !! Source<br />
|-<br />
| 0x3C50006C<br />
| 0x2000<br />
| 'SPI power'<br />
| WTF DevicePowerManagement.dll<br />
|-<br />
| 0x3C50004C<br />
| 0x4<br />
| 'SPI power'<br />
| WTF DevicePowerManagement.dll<br />
|-<br />
| 0x3C50004c<br />
| 0x1f800020<br />
| Timer<br />
| WTF IpodSec.dll<br />
|-<br />
| 0x3C500058<br />
| 0x60<br />
| Timer<br />
| WTF IpodSec.dll<br />
|-<br />
| 0x3c50006c<br />
| 0xc0007f<br />
| Timer<br />
| WTF IpodSec.dll<br />
|}</div>User890104https://freemyipod.org/index.php?title=WInd3x&diff=22231WInd3x2026-02-28T15:30:13Z<p>User890104: </p>
<hr />
<div>== wInd3x Vulnerability ==<br />
{{DISPLAYTITLE:wInd3x}}<br />
<br />
A [[S5L8720 Bootrom|Bootrom]] vulnerability discovered and exploited by [[User:Q3k|q3k]] in December 2021. It allows code execution in the bootrom over USB.<br />
<br />
=== Affected Devices ===<br />
<br />
{| class="wikitable"<br />
|-<br />
! Device/SoC !! Vulnerable? !! Exploited?<br />
|-<br />
| [[Nano 3G]] || Yes || Yes<br />
|-<br />
| [[Nano 4G]] || Yes || Yes<br />
|-<br />
| [[Nano 5G]] || Yes || Yes<br />
|-<br />
| [[Nano 6G]] || No || <br />
|-<br />
| [[Nano 7G]] || No || <br />
|-<br />
| Classic “6G” || Yes || Yes<br />
|-<br />
| iPhone || ? ||<br />
|-<br />
| iPhone 3G || Yes || No<br />
|}<br />
<br />
=== Running / Usage ===<br />
<br />
wInd3x currently allows you to:<br />
<br />
# Decrypt [[IMG1]] files, like [[OSOS]] or the bootloader/[[WTF]]/...<br />
# Access arbitrary memory and experiment with peripherals<br />
# Run unsigned DFU payloads<br />
# Run an unsigned [[OSOS]] or [[U-Boot]] by first running an automatically patched [[WTF]].<br />
<br />
For guides, see [https://github.com/freemyipod/wInd3x github.com/freemyipod/wInd3x]<br />
<br />
=== Vulnerability ===<br />
<br />
This exploits a vulnerability in the standard SETUP packet parsing code of the bootrom, in which the wIndex parameter is not checked for bmRequest == {0x20, 0x40}, but is still used to index an array of interface/class handlers (that in the Bootrom has a length of 1).<br />
<br />
==== Nano 4G and 5G Exploit Chain ====<br />
<br />
The first requirement is to find a suitable (blx r0) instruction in the bootrom code of the device. For Nano 4G the only one such instruction is at offset 0x3b0, and for Nano 5G there is such instruction at 0x37c. We'll refer to it as X below.<br />
<br />
We abuse the fact that wIndex == 3 for bmRequest 0x40 treats a 'bytes left to sent over USB' counter as a function pointer and calls it with r0 == address of SETUP. We massage the DFU mode into attempting to send us X+0x40 bytes, and failing after 0x40 bytes, thereby leaving the counter at X bytes and executing code at address X.<br />
<br />
Since the bootrom is mapped at offset 0x0 as well as 0x20000000 at boot, this means we execute bootrom code, and X happens to point to a 'blx r0' instruction. This in turn causes the CPU to interpret the SETUP packet received as ARM code, because the SETUP handler is called with the SETUP packet as its argument, i.e. r0.<br />
<br />
We specially craft the SETUP packet to be a valid ARM branch instruction, pointing somewhere into a temporary DFU image buffer. By first sending a payload as a partial DFU image (aborting before causing a MANIFEST), we finally get up to be able to execute either 0x800 on Nano 4G or 0x400 on Nano 5G bytes of fully user controlled code.<br />
<br />
In that payload, we send a stub which performs some runtime changes to the DFU's data structures to a) return a different product string b) overwrite an image verification vtable entry with a function that allows unsigned images. Some SRAM is carved out by this pay<br />
<br />
==== Nano 3G and Classic (”6G”) ====<br />
<br />
With bRequestType == 0x20 and wIndex == 6 we directly jump to code execution at the SETUP packet.<br />
<br />
This Bootroom does not have a VTable which can be easily hooked to override functions to provide Haxed DFU functionality. However, an 'OnImage' function pointer is present in the State structure, which we override with our own code (copied to carved out SRAM). This code reimplements the bare minimum of the hooked function, without calling any decryption/verification code on the header/body.</div>User890104https://freemyipod.org/index.php?title=WInd3x&diff=22230WInd3x2026-02-28T15:26:40Z<p>User890104: </p>
<hr />
<div>== wInd3x Vulnerability ==<br />
{{DISPLAYTITLE:wInd3x}}<br />
<br />
A [[S5L8720 Bootrom|Bootrom]] vulnerability discovered and exploited by [[User:Q3k|q3k]] in December 2021. It allows code execution in the bootrom over USB.<br />
<br />
=== Affected Devices ===<br />
<br />
{| class="wikitable"<br />
|-<br />
! Device/SoC !! Vulnerable? !! Exploited?<br />
|-<br />
| [[Nano 3G]] || Yes || Yes<br />
|-<br />
| [[Nano 4G]] || Yes || Yes<br />
|-<br />
| [[Nano 5G]] || Yes || Yes<br />
|-<br />
| [[Nano 6G]] || No || <br />
|-<br />
| [[Nano 7G]] || No || <br />
|-<br />
| Classic “6G” || Yes || Yes<br />
|-<br />
| iPhone || ? ||<br />
|-<br />
| iPhone 3G || Yes || No<br />
|}<br />
<br />
=== Running / Usage ===<br />
<br />
wInd3x currently allows you to:<br />
<br />
# Decrypt [[IMG1]] files, like [[OSOS]] or the bootloader/[[WTF|WTF]]/...<br />
# Access arbitrary memory and experiment with peripherals<br />
# Run unsigned DFU payloads<br />
# Run an unsigned [[OSOS]] or [[U-Boot]] by first running an automatically patched [[WTF|WTF]].<br />
<br />
For guides, see [https://github.com/freemyipod/wInd3x github.com/freemyipod/wInd3x]<br />
<br />
=== Vulnerability ===<br />
<br />
This exploits a vulnerability in the standard SETUP packet parsing code of the bootrom, in which the wIndex parameter is not checked for bmRequest == {0x20, 0x40}, but is still used to index an array of interface/class handlers (that in the Bootrom has a length of 1).<br />
<br />
==== Nano 4G and 5G Exploit Chain ====<br />
<br />
The first requirement is to find a suitable (blx r0) instruction in the bootrom code of the device. For Nano 4G the only one such instruction is at offset 0x3b0, and for Nano 5G there is such instruction at 0x37c. We'll refer to it as X below.<br />
<br />
We abuse the fact that wIndex == 3 for bmRequest 0x40 treats a 'bytes left to sent over USB' counter as a function pointer and calls it with r0 == address of SETUP. We massage the DFU mode into attempting to send us X+0x40 bytes, and failing after 0x40 bytes, thereby leaving the counter at X bytes and executing code at address X.<br />
<br />
Since the bootrom is mapped at offset 0x0 as well as 0x20000000 at boot, this means we execute bootrom code, and X happens to point to a 'blx r0' instruction. This in turn causes the CPU to interpret the SETUP packet received as ARM code, because the SETUP handler is called with the SETUP packet as its argument, i.e. r0.<br />
<br />
We specially craft the SETUP packet to be a valid ARM branch instruction, pointing somewhere into a temporary DFU image buffer. By first sending a payload as a partial DFU image (aborting before causing a MANIFEST), we finally get up to be able to execute either 0x800 on Nano 4G or 0x400 on Nano 5G bytes of fully user controlled code.<br />
<br />
In that payload, we send a stub which performs some runtime changes to the DFU's data structures to a) return a different product string b) overwrite an image verification vtable entry with a function that allows unsigned images. Some SRAM is carved out by this pay<br />
<br />
==== Nano 3G and Classic (”6G”) ====<br />
<br />
With bRequestType == 0x20 and wIndex == 6 we directly jump to code execution at the SETUP packet.<br />
<br />
This Bootroom does not have a VTable which can be easily hooked to override functions to provide Haxed DFU functionality. However, an 'OnImage' function pointer is present in the State structure, which we override with our own code (copied to carved out SRAM). This code reimplements the bare minimum of the hooked function, without calling any decryption/verification code on the header/body.</div>User890104https://freemyipod.org/index.php?title=SVN&diff=22224SVN2026-02-28T12:05:11Z<p>User890104: </p>
<hr />
<div>{{Template:Outdated|reason=SVN has been abandoned and new code is only published on the [https://github.com/freemyipod freemyipod GitHub]. The SVN repository is still available with read-only access for archival purposes.}}<br />
We have a Subversion repository where we store our code for our software projects.<br />
<br />
== Builds ==<br />
We have automatic builds of our software. Just head over to http://builds.freemyipod.org/ to download the build you want.<br />
<br />
== WebSVN ==<br />
If you just want to browse the SVN, go to http://websvn.freemyipod.org/<br />
<br />
== Checkout ==<br />
If you want to checkout the repository, please use this url: svn://svn.freemyipod.org/<br />
<br />
== Commit ==<br />
If you are a registered developer you need to use this url to checkout and commit: svn+ssh://svn@svn.freemyipod.org/<br />
<br />
Developers are authenticated using SSH keys.</div>User890104https://freemyipod.org/index.php?title=Extracting_firmware&diff=22223Extracting firmware2026-02-28T12:02:30Z<p>User890104: svn -> github</p>
<hr />
<div>The tool for extracting iPod firmware is called extract2g. Extract2g can be found on the freemyipod GitHub at <br />
https://github.com/freemyipod/freemyipod/tree/master/tools/extract2g. The Windows and the Linux versions can be built with a simple make command. Extract2g supports all of the Nanos and the 5G and 6G iPods (haven't tested any others). If the output says something similar to "Extracting from osos.fw," you should be fine.<br />
<br />
To obtain a list of availible files, type in:<br />
<pre>extract2g -l dump.img</pre><br />
Please note that "dump.img" can be replaced with whatever your dump file is named. To actually extract the firmwares, type in:<br />
<pre>extract2g -A dump.img</pre><br />
You should now have 3 files:<br />
*osos.fw<br />
*aupd.fw<br />
*rsrc.fw<br />
<br />
On Nano 4G, you should use the -4 or --4g-compat option in order to dump the correct data from the firmware. This option is considered as a workaround, because the Nano 4G firmwares are detected as Nano 3G's, but the offset is different.<br />
<br />
To list the files, type in:<br />
<pre>extract2g -l -4 dump.img</pre><br />
To extract all files, type in:<br />
<pre>extract2g -A -4 dump.img</pre><br />
You should now have 9 files:<br />
*appl.fw<br />
*bdhw.fw<br />
*bdsw.fw<br />
*chrg.fw<br />
*diag.fw<br />
*disk.fw<br />
*lbat.fw<br />
*osos.fw<br />
*rsrc.fw<br />
These are your extracted firmware images. To learn more about these, please visit the [[Firmware]] page. If you need more information about using extract2g, type in:<br />
<pre>extract2g - -help</pre><br />
<br />
===Decrypting blobs===<br />
<br />
On iPod Nano3G and above some of these resources (notably [[OSOS|osos.fw]] and other executables) are encrypted and signed. [[wInd3x]] can be used to decrypt them as long as a compatible devices is connected in DFU mode.<br />
<br />
===Removing header===<br />
<br />
Also if you are using the osos.fw outputted by extract2g in [[emCORE]] you need to remove the 2 KiB header from it:<br />
<pre>dd if=osos.fw of=osos.out bs=2048 skip=1</pre><br />
Or alternatively, under Windows open osos.fw in HxD and select 'select block' from the edit menu, select from 0x0 to 0x7FF, then delete this region and save.<br />
<br />
Then put osos.out into /.boot/AppleOS.bin<br />
<br />
==Helpful pages==<br />
http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf<br />
<br />
http://www.ipodlinux.org/wiki/Firmware</div>User890104https://freemyipod.org/index.php?title=Main_Page&diff=22222Main Page2026-02-28T11:58:45Z<p>User890104: svn -> github, twitter -> X</p>
<hr />
<div>__NOTOC__<br />
[[File:Photo 2025-12-27 20-36-24.jpg|280px|thumb|right|[[Linux]] 6.14.0 on [[Nano 7G]]]]<br />
[[File:EmCORE_Nano2G_Nano4G_Classic.jpg|280px|thumb|right|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]]]<br />
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].<br />
<br />
== FAQ ==<br />
<br />
=== What can I do with my [[Nano 2G]], [[Classic 6G]] or older iPods? ===<br />
<br />
There's an upstream Rockbox port for these devices. [https://www.rockbox.org/download/ Go use that].<br />
<br />
=== What can I do with my [[Nano 3G]] or newer? ===<br />
<br />
Not much (yet) unless you're an embedded developer :).<br />
<br />
On the [[Nano 3G]], [[Nano 4G]] and [[Nano 5G]], we have a stable tethered exploit ([[wInd3x]]) which allows early, untethered and safe (no permanent modification) code execution. This in turn allows you to run [[U-Boot]] and an early [[Linux|Linux port]] or experiment with reverse-engineering/modifying the original firmware, [[retailOS]].<br />
<br />
On the [[Nano 6G]], [[Nano 7G]] and iPod shuffle (4th generation), a vulnerability in DFU_DNLOAD packet parsing code can be exploited with [[S5Late]]. It allows tethered code execution.<br />
<br />
On the [[Nano 6G]] and [[Nano 7G]], a font parsing vulnerability (CVE-2010-1797) can be exploited with [[ipod_sun]]. It allows untethered code execution.<br />
<br />
There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.<br />
<br />
== Getting an account ==<br />
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].<br />
<br />
==Updates==<br />
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at 39C3 on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].<br />
* {{#dateformat:2025-12-26}} - Some of us will be at 39C3 in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!<br />
* {{#dateformat:2025-06-12}} - Some of us will be at GPN23 in Karlsruhe! [https://entropia.de/GPN23 More info here]. Let us know on IRC/Discord/Matrix if you're also there!<br />
* {{#dateformat:2024-12-25}} - Some of us will be at 38C3 in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]<br />
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.<br />
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.<br />
* {{#dateformat:2023-01-07}} - [https://social.hackerspace.pl/@q3k/109655916469636189 A preliminary U-Boot port to the [[Nano 5G]] has been developed.]<br />
<!--<br />
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!<br />
* {{#dateformat:2021-12-31}} - An exploit named wInd3x, which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].<br />
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!<br />
* {{#dateformat:2018-08-25}} - The website software has been updated to MediaWiki 1.31 after about 2 months of downtime.<br />
* {{#dateformat:2016-06-17}} - The freemyipod project is becoming deprecated, as parts of the code is slowly being integrated in Rockbox. It is likely that no future development on the freemyipod project will take place. Essential parts of emCORE helped building a Rockbox bootloader for iPod Classic, and any future development will take place in the Rockbox project.<br />
* {{#dateformat:2014-03-26}} - A bug that prevented [[emCORE]] installations on certain Windows configurations (getting stuck on "Booting UBI file..."), has been finally fixed! If the installation has failed for you before, you can retry it using the updated version of our tool (use the iTunes method for now).<br />
* {{#dateformat:2012-01-02}} - There have been some problems with the latest release. A hotfix release ([[EmCORE_Releases/r859|r859]]) has been published to fix some of these problems. [[Nano 2G]] users are advised to upgrade. See the [[EmCORE_Releases/r859|release details page]] for more information.<br />
* {{#dateformat:2012-01-01}} - A new release <s>([[EmCORE_Releases/r855|r855]])</s> is out! It includes a couple of new features, several bugfixes and a new bootmenu theme! More information on the <s>[[EmCORE_Releases/r855|release details page]]</s>.<br />
* {{#dateformat:2011-04-25}} - The [[emCORE]] kernel now runs on the iPod Touch 2G as well, thanks to the help of kleemajo. This is of course not a fully functional port yet, but we'll see how it continues. It's about the same state as the [[Nano 4G]] now. /7<br />
* {{#dateformat:2011-03-25}} - [[emCORE]] is replacing [[emBIOS]] completely now. Therefore [[emBIOS]] will be deprecated software as of now! All emBIOS users are advised to upgrade to emCORE including people using iLoader 0.2.2 or less. More detailed update instructions will follow!<br />
* {{#dateformat:2011-01-08}} - The Rockbox port for the iPod Classic is slowly getting usable. Most of the blocking issues have been fixed. The first-generation 160GB model still doesn't work, and some people are experiencing slightly garbled display contents.<br />
* {{#dateformat:2011-01-04}} - There is an early Rockbox port for the iPod Classic! It still isn't quite usable, playback stutters etc., but if you want to play around with it, here are some quick'n'dirty notes on the installation procedure: [[IPod Classic iLoader Installation]]<br />
* {{#dateformat:2010-11-22}} - We now have emBIOS support for the iPod classic 1g, the others might follow soon<br />
* {{#dateformat:2010-08-29}} - We're proud to announce the release of [[emBIOS]] v0.1.0 and [[iLoader]] v0.2.0!<br />
* {{#dateformat:2010-08-26}} - [[iLoader]], its installer and uninstaller all have been fully ported to [[emBIOS]] now. A beta release will be coming soon!<br />
* {{#dateformat:2010-08-13}} - [[emBIOS]] is continually being improved and the next step is porting tools like [[iLoader]] to use it.<br />
* {{#dateformat:2010-08-06}} - The wiki has now been moved to www.freemyipod.org<br />
* {{#dateformat:2010-08-05}} - Recently we've been working on a hardware abstraction project called [[emBIOS]]. Follow development [https://websvn.freemyipod.org/listing.php?repname=freemyipod&path=/embios/ here]<br />
* {{#dateformat:2010-08-03}} - We can now access the [[Nano 4G]] accelerometer.<br />
* {{#dateformat:2010-08-02}} - serpilliere managed to decrypt the NOR flash on the [[Nano 3G]].<br />
* {{#dateformat:2010-08-01}} - serpilliere managed to access and dump the NOR flash on the [[Nano 3G]]. This code could possibly work on the Classics.<br />
* {{#dateformat:2010-07-27}} - The server got zapped by lightning but a new one was up and running within a day.<br />
* {{#dateformat:2010-02-23}} - We can now execute code on everything besides the [[Nano 5G]]! Minimalistic iBugger working on [[Nano 3G]]!<br />
* {{#dateformat:2009-11-01}} - iBugger core v0.1 successfully running on [[Nano 4G]]! [https://img217.imageshack.us/img217/4122/img0969.jpg]<br />
--><br />
Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.<br />
<br />
{| cellspacing="3" width="100%"<br />
|- valign="top"<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
===Project info===<br />
* [[ Status ]]<br />
* [[ Contact ]]<br />
* [[ Contributing ]]<br />
<br />
===Released Software===<br />
* [[wInd3x]]<br />
* [[ipod_sun]]<br />
* [[U-Boot|U-Boot port]]<br />
* [[Linux|Linux port]]<br />
* Legacy:<br />
** [[iBugger]]<br />
** [[iLoader]]<br />
** [[emCORE]]<br />
<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
<br />
===Basic skills===<br />
* [[Working with binaries]]<br />
* [[Dumping firmware]]<br />
* [[Extracting firmware]]<br />
* [[Firmware downgrading]]<br />
* [[Troubleshooting]]<br />
<br />
===Reverse engineering results===<br />
* [[Firmware]]<br />
** [[Bootrom]]<br />
** [[Boot Process]]<br />
** [[Firmware decryption]]<br />
** [[FTL|Flash Translation Layer]]<br />
** [[RetailOS]]<br />
*** [[RetailOS Options]]<br />
* [[GUID table]]<br />
* [[JTAG]]<br />
* Nano 2G<br />
** [[Nano2G clock gates]]<br />
** [[Nano2G LCD init]]<br />
** [[Nano2G HW analysis]]<br />
** [[S5L8701 analysis]]<br />
* Nano 4G<br />
** [[Nano4G firmware upgrade process]]<br />
* Nano 5G<br />
** [[Nano 5G|General]]<br />
<br />
===Other guides===<br />
* [[Modes]]<br />
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|<br />
===Hardware===<br />
* [[Hardware]]<br />
** [[Nano 1G]]<br />
** [[Nano 2G]]<br />
** [[Nano 3G]]<br />
** [[Nano 4G]]<br />
*** [[920-0614-03]]<br />
** [[Nano 5G]]<br />
** [[Nano 6G]]<br />
** [[Nano 7G]]<br />
** [[Classic 6G]]<br />
* [[Chronology]]<br />
* [[S5L8700 datasheet]]<br />
<br />
===Exploiting===<br />
* [[wInd3x]]<br />
* [[Pwnage 2.0]]<br />
* [[Notes vulnerability]]<br />
** [[Address bruteforcing]]<br />
** [[Nanotron 3000]]<br />
|}</div>User890104https://freemyipod.org/index.php?title=MediaWiki:Sidebar&diff=22221MediaWiki:Sidebar2026-02-23T22:51:23Z<p>User890104: </p>
<hr />
<div>* navigation<br />
** mainpage|mainpage-description<br />
** recentchanges-url|recentchanges<br />
** randompage-url|randompage<br />
<br />
* SEARCH<br />
<br />
* Info<br />
** Status|Status<br />
** Contact|Contact<br />
** Contributing|Contributing<br />
** Todo list|Todo list<br />
** Project summary|Project summary<br />
<br />
* Reverse engineering Results<br />
** Firmware|Firmware<br />
** Firmware decryption|Firmware decryption<br />
** GUID table|GUID Table<br />
** Nano_2G<br />
** Nano_3G<br />
** Nano_4G<br />
** Nano_5G<br />
<br />
* Exploiting<br />
** WInd3x|wIndex<br />
** Pwnage 2.0|Pwnage 2.0<br />
** Notes vulnerability|Notes vulnerability<br />
<br />
* Other Guides<br />
** Modes|Modes<br />
<br />
* TOOLBOX<br />
<br />
* LANGUAGES</div>User890104https://freemyipod.org/index.php?title=Hardware&diff=22219Hardware2026-02-08T10:11:24Z<p>User890104: /* Overview */</p>
<hr />
<div>== Overview ==<br />
<br />
This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.<br />
<br />
{| class="wikitable"<br />
! Generation !! SoC !! CPU Core !! RAM !! NOR/Utility Flash !! Device Code Name !! SoC Family Code Name !! UpdaterFamilyID<br />
|-<br />
|[[Nano 1G]]<br />
|PP5021C-TDF<br />
|<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41856 SST39WF400A] (512KiB)<br />
|<br />
|<br />
| 14/17<br />
|-<br />
|[[Nano 2G]]<br />
|S5L8701<br />
|ARM940T<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41422 SST39WF800A] (1MiB)<br />
|<br />
| M1<br />
| 19/29<br />
|-<br />
|[[Nano 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (32MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
| N46<br />
| M1A<br />
| 26<br />
|-<br />
|[[Nano 4G]]<br />
|S5L8720<br />
|ARM1176<br />
|Integrated (32MiB)<br />
| ''none''<br />
| N58<br />
| M2<br />
| 31<br />
|-<br />
|[[Nano 5G]]<br />
|S5L8730<br />
|ARM1176<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N33<br />
| M2<br />
| 34<br />
|-<br />
|[[Nano 6G|Nano 6G]]<br />
|S5L8723<br />
|ARM1176<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N20<br />
|<br />
| 36<br />
|-<br />
|[[Nano 7G|Nano 7G]]<br />
|S5L8740<br />
|Cortex A5<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N31<br />
| H4<br />
| 37<br />
|-<br />
|[[Classic 1G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
| M1A<br />
| 24<br />
|-<br />
|[[Classic 2G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
| M1A<br />
| 33<br />
|-<br />
|[[Classic 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X51163PE] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
| M1A<br />
| 35/38<br />
|}<br />
<br />
=== Explanations ===<br />
<br />
* '''Device Code Name''': product code name, from early prototype phases to production run device. Most commonly used internal reference.<br />
* '''SoC Family Code Name''': device family code name, seems to follow large generational changes in SoC. Mostly seen around hardware (init) code, eg. flash interface, diags, etc.<br />
<br />
==Helpful pages==<br />
Chip analyses<br />
*http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx<br />
*http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx<br />
Additional information<br />
*http://dendrites.blog.163.com/blog/static/165376178201082112922174/</div>User890104https://freemyipod.org/index.php?title=Hardware&diff=22218Hardware2026-01-15T20:17:39Z<p>User890104: </p>
<hr />
<div>== Overview ==<br />
<br />
This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.<br />
<br />
{| class="wikitable"<br />
! Generation !! SoC !! CPU Core !! RAM !! NOR/Utility Flash !! Device Code Name !! SoC Family Code Name !! UpdaterFamilyID<br />
|-<br />
|[[Nano 1G]]<br />
|PP5021C-TDF<br />
|<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41856 SST39WF400A] (512KiB)<br />
|<br />
|<br />
| 14/17<br />
|-<br />
|[[Nano 2G]]<br />
|S5L8701<br />
|ARM940T<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41422 SST39WF800A] (1MiB)<br />
|<br />
| M1<br />
| 19/29<br />
|-<br />
|[[Nano 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (32MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
| N46<br />
| M1A<br />
| 26<br />
|-<br />
|[[Nano 4G]]<br />
|S5L8720<br />
|ARM1176<br />
|Integrated (32MiB)<br />
| ''none''<br />
| N58<br />
| M2<br />
| 31<br />
|-<br />
|[[Nano 5G]]<br />
|S5L8730<br />
|ARM1176<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N33<br />
| M2<br />
| 34<br />
|-<br />
|[[Nano 6G|Nano 6G]]<br />
|S5L8723<br />
|ARM1176<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N20<br />
|<br />
| 36<br />
|-<br />
|[[Nano 7G|Nano 7G]]<br />
|S5L8740<br />
|Cortex A5<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N31<br />
| H4<br />
| 37<br />
|-<br />
|[[Classic 1G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
|<br />
| 24<br />
|-<br />
|[[Classic 2G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
|<br />
| 33<br />
|-<br />
|[[Classic 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X51163PE] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|N25<br />
|<br />
| 35/38<br />
|}<br />
<br />
=== Explanations ===<br />
<br />
* '''Device Code Name''': product code name, from early prototype phases to production run device. Most commonly used internal reference.<br />
* '''SoC Family Code Name''': device family code name, seems to follow large generational changes in SoC. Mostly seen around hardware (init) code, eg. flash interface, diags, etc.<br />
<br />
==Helpful pages==<br />
Chip analyses<br />
*http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx<br />
*http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx<br />
Additional information<br />
*http://dendrites.blog.163.com/blog/static/165376178201082112922174/</div>User890104https://freemyipod.org/index.php?title=Hardware&diff=22217Hardware2026-01-10T23:13:54Z<p>User890104: </p>
<hr />
<div>== Overview ==<br />
<br />
This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.<br />
<br />
{| class="wikitable"<br />
! Generation !! SoC !! CPU Core !! RAM !! NOR/Utility Flash !! Device Code Name !! SoC Family Code Name !! UpdaterFamilyID<br />
|-<br />
|[[Nano 1G]]<br />
|PP5021C-TDF<br />
|<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41856 SST39WF400A] (512KiB)<br />
|<br />
|<br />
| 14/17<br />
|-<br />
|[[Nano 2G]]<br />
|S5L8701<br />
|ARM940T<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41422 SST39WF800A] (1MiB)<br />
|<br />
| M1<br />
| 19/29<br />
|-<br />
|[[Nano 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (32MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
| N46<br />
| M1A<br />
| 26<br />
|-<br />
|[[Nano 4G]]<br />
|S5L8720<br />
|ARM1176<br />
|Integrated (32MiB)<br />
| ''none''<br />
| N58<br />
| M2<br />
| 31<br />
|-<br />
|[[Nano 5G]]<br />
|S5L8730<br />
|ARM1176<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N33<br />
| M2<br />
| 34<br />
|-<br />
|[[Nano 6G|Nano 6G]]<br />
|S5L8723<br />
|ARM1176<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N20<br />
|<br />
| 36<br />
|-<br />
|[[Nano 7G|Nano 7G]]<br />
|S5L8740<br />
|Cortex A5<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N31<br />
| H4<br />
| 37<br />
|-<br />
|[[Classic 1G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|<br />
|<br />
| 24<br />
|-<br />
|[[Classic 2G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|<br />
|<br />
| 33<br />
|-<br />
|[[Classic 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X51163PE] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|<br />
|<br />
| 35/38<br />
|}<br />
<br />
=== Explanations ===<br />
<br />
* '''Device Code Name''': product code name, from early prototype phases to production run device. Most commonly used internal reference.<br />
* '''SoC Family Code Name''': device family code name, seems to follow large generational changes in SoC. Mostly seen around hardware (init) code, eg. flash interface, diags, etc.<br />
<br />
==Helpful pages==<br />
Chip analyses<br />
*http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx<br />
*http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx<br />
Additional information<br />
*http://dendrites.blog.163.com/blog/static/165376178201082112922174/</div>User890104https://freemyipod.org/index.php?title=S5L8720_Device_Tree&diff=22216S5L8720 Device Tree2026-01-10T17:26:07Z<p>User890104: Created page with "This is a formatted copy of https://code.google.com/archive/p/chronicdev/wikis/N72APDevTree.wiki The whitespaces/newlines have been added manually, since the Google Code wiki..."</p>
<hr />
<div>This is a formatted copy of https://code.google.com/archive/p/chronicdev/wikis/N72APDevTree.wiki<br />
<br />
The whitespaces/newlines have been added manually, since the Google Code wiki probably trashed them at some point.<br />
<br />
<pre><br />
/arm-io: base = 38000000<br />
/arm-io/vic: 38E00000:00002000<br />
/arm-io/edgeic: 38E02000:00001000<br />
/arm-io/gpio: 3CF00000:00001000<br />
/arm-io/gpio: 39700000:00001000<br />
/arm-io/power: 39700000:00001000<br />
/arm-io/clkrstgen: 3C500000:00001000<br />
/arm-io/clkrstgen: 3E000000:00001000<br />
/arm-io/dmac0: 38200000:00001000<br />
/arm-io/dmac1: 38700000:00001000<br />
/arm-io/sha1: 38000000:00001000<br />
/arm-io/usb-otg: 38400000:00010000<br />
/arm-io/amc: 38500000:00003000<br />
/arm-io/amc: 52000000:00030000<br />
/arm-io/clcd: 38900000:00002000<br />
/arm-io/flash-controller0: 38A00000:00001000<br />
/arm-io/aes: 38C00000:00001000<br />
/arm-io/sdio: 38D00000:00001000<br />
/arm-io/h264decoder: 38F00000:00004000<br />
/arm-io/scaler: 39000000:00001000<br />
/arm-io/tv-out: 39300000:00001000<br />
/arm-io/tv-out: 39200000:00001000<br />
/arm-io/tv-out: 39100000:00001000<br />
/arm-io/mbx: 3B000000:01000000<br />
/arm-io/mbx: 39400000:00001000<br />
/arm-io/mpvd: 39600000:00001000<br />
/arm-io/mpvd: 39610000:00001000<br />
/arm-io/mpvd: 39620000:00001000<br />
/arm-io/mpvd: 39630000:00001000<br />
/arm-io/mpvd: 39641000:00001000<br />
/arm-io/mpvd: 39650000:00001000<br />
/arm-io/mpvd: 39660000:00001000<br />
/arm-io/prng: 3C100000:00001000<br />
/arm-io/spi0: 3C300000:00001000<br />
/arm-io/spi0/nor-flash: base = 00000000<br />
/arm-io/spi0/nor-flash/diagnostic-data: 00006000:00002000<br />
/arm-io/spi0/nor-flash/diagnostic-data: 00004000:00002000<br />
/arm-io/spi0/nor-flash/nvram: 000FC000:00002000<br />
/arm-io/spi0/nor-flash/nvram: 000FE000:00002000<br />
/arm-io/spi0/nor-flash/raw-device: 00008000:000F4000<br />
/arm-io/spi0/nor-flash/raw-device: 00000000:00001000<br />
/arm-io/spi1: 3CE00000:00001000<br />
/arm-io/spi1/nor-flash: base = 00000000<br />
/arm-io/spi1/nor-flash/diagnostic-data: 00006000:00002000<br />
/arm-io/spi1/nor-flash/diagnostic-data: 00004000:00002000<br />
/arm-io/spi1/nor-flash/nvram: 000FC000:00002000<br />
/arm-io/spi1/nor-flash/nvram: 000FE000:00002000<br />
/arm-io/spi1/nor-flash/raw-device: 00008000:000F4000<br />
/arm-io/spi1/nor-flash/raw-device: 00000000:00001000<br />
/arm-io/spi4: 3E100000:00001000<br />
/arm-io/otgphyctrl: 3C400000:00001000<br />
/arm-io/i2c0: 3C600000:00001000<br />
/arm-io/i2c1: 3C900000:00001000<br />
/arm-io/timer: 3C700000:00001000<br />
/arm-io/wdt: 3C800000:00001000<br />
/arm-io/i2s0: 3CA00000:00001000<br />
/arm-io/uart0: 3CC00000:00001000<br />
/arm-io/uart1: 3DB00000:00001000<br />
/arm-io/pke: 3D000000:00001000<br />
/arm-io/mipi-dsim: 3D800000:00001000<br />
/arm-io/swi: 3DE00000:00001000<br />
00101640: / [bootrom]<br />
00101E20: /chosen<br />
00101EE0: /cpus<br />
00102580: /chosen/memory-map<br />
001026C0: /options<br />
001026E0: /chosen/iBoot<br />
00102E10: /aliases<br />
00102E50: /cpus/cpu0 [cpu]<br />
ipi_dispatch = /arm-io/vic['IPID'](0x00000004)<br />
cpu_idle = /arm-io/clkrstgen['cpuI']()<br />
interrupt-parent = /arm-io/vic<br />
00103AE0: /memory [memory]<br />
00103D20: /pram [pram]<br />
00103FE0: /vram [vram]<br />
00104260: /arm-io [s5l8720x-io]<br />
clock_gate = /arm-io/clkrstgen['clkG']()<br />
00104850: /buttons [buttons]<br />
button_voldown = /arm-io/gpio['GPIO'](0x00000C00, 0x00000000)<br />
button_volup = /arm-io/gpio['GPIO'](0x00000902, 0x00000000)<br />
wake_button_menu = /arm-io/i2c0/pmu['STAT'](0x00000190)<br />
wake_button_hold = /arm-io/i2c0/pmu['STAT'](0x00000191)<br />
button_hold = /arm-io/gpio['GPIO'](0x00000C02, 0x00000100)<br />
button_menu = /arm-io/gpio['GPIO'](0x00000C01, 0x00000100)<br />
interrupt-parent = /arm-io/gpio<br />
001048C0: /arm-io/vic [interrupt-controller]<br />
00104E90: /arm-io/gpio [interrupt-controller]<br />
interrupt-parent = /arm-io/vic<br />
00104EB0: /arm-io/edgeic [interrupt-controller]<br />
interrupt-parent = /arm-io/vic<br />
00105C50: /arm-io/power [power]<br />
00105F70: /arm-io/clkrstgen [clkrstgen]<br />
core_voltage_1 = /arm-io/i2c0/pmu['corV'](0x04B00000, 0x00000096)<br />
core_voltage_0 = /arm-io/i2c0/pmu['corV'](0x041A0000, 0x00000096)<br />
001079C0: /arm-io/dmac0 [dmac]<br />
interrupt-parent = /arm-io/vic<br />
00107EC0: /arm-io/dmac1 [dmac]<br />
interrupt-parent = /arm-io/vic<br />
00108370: /arm-io/sha1 [sha1]<br />
interrupt-parent = /arm-io/vic<br />
001088F0: /arm-io/usb-otg [usb-otg]<br />
usb_500_100 = /charger['CHRG'](0x00000000)<br />
usb_swap_config = /dock['accA'](0x0000000A)<br />
usb_suspend = /charger['CHRG'](0x00000001)<br />
usb_brick_detect = /charger['CHRG'](0x00000002)<br />
interrupt-parent = /arm-io/vic<br />
00109260: /arm-io/amc [amc]<br />
de_reset = /arm-io/clkrstgen['ARST'](0x00000A00)<br />
perf_advise = /arm-io/clkrstgen['PRFA']()<br />
core_reset = /arm-io/clkrstgen['ARST'](0x0000A000)<br />
interrupt-parent = /arm-io/vic<br />
001092A0: /arm-io/usb-otg/usb-device [usb-device]<br />
interrupt-parent = /arm-io/vic<br />
001096A0: /arm-io/usb-otg/usb-host [usb-host]<br />
interrupt-parent = /arm-io/vic<br />
0010A350: /arm-io/clcd [clcd]<br />
lcd_enable = /arm-io/mipi-dsim/lcd['lcdE']()<br />
interrupt-parent = /arm-io/vic<br />
0010A930: /arm-io/flash-controller0 [fmss]<br />
interrupt-parent = /arm-io/vic<br />
0010ADE0: /arm-io/aes [aes]<br />
disable_keys = /arm-io/power['disK']()<br />
interrupt-parent = /arm-io/vic<br />
0010AE20: /arm-io/flash-controller0/disk [nand]<br />
0010B8F0: /arm-io/sdio [sdio]<br />
device_wake = /arm-io/gpio['GPIO'](0x00000A02, 0x00000101)<br />
device_reset = /arm-io/gpio['GPIO'](0x00000E05, 0x00010001)<br />
power_enable = /arm-io/i2c0/pmu['GPIO'](0x00000006, 0x00010101)<br />
interrupt-parent = /arm-io/vic<br />
0010B9C0: /arm-io/h264decoder [h264decoder]<br />
interrupt-parent = /arm-io/vic<br />
0010C860: /arm-io/scaler [scaler]<br />
interrupt-parent = /arm-io/vic<br />
0010CD20: /arm-io/tv-out [tv-out]<br />
amp_enable = /arm-io/gpio['GPIO'](0x00000807, 0x00000101)<br />
interrupt-parent = /arm-io/vic<br />
0010D3B0: /arm-io/mbx [mbx]<br />
interrupt-parent = /arm-io/vic<br />
dma-parent = /arm-io/dmac1<br />
0010DA90: /arm-io/mpvd [mpvd]<br />
interrupt-parent = /arm-io/vic<br />
0010E180: /arm-io/prng [prng]<br />
interrupt-parent = /arm-io/edgeic<br />
0010E670: /arm-io/spi0 [spi]<br />
spi_cs0 = /arm-io/gpio['GPIO'](0x00000000, 0x00000001)<br />
interrupt-parent = /arm-io/vic<br />
0010EDF0: /arm-io/spi1 [spi]<br />
spi_cs0 = /arm-io/gpio['GPIO'](0x00000406, 0x00000001)<br />
interrupt-parent = /arm-io/vic<br />
0010EE30: /arm-io/spi0/nor-flash [nor-flash]<br />
0010F2E0: /arm-io/spi0/nor-flash/diagnostic-data [diagnostic-data]<br />
0010F630: /arm-io/spi0/nor-flash/raw-device [raw-device]<br />
0010F650: /arm-io/spi0/nor-flash/nvram [nvram]<br />
00110530: /arm-io/spi4 [spi]<br />
spi_cs0 = /arm-io/gpio['GPIO'](0x00000A07, 0x00000001)<br />
interrupt-parent = /arm-io/vic<br />
dma-parent = /arm-io/dmac1<br />
00110570: /arm-io/spi1/nor-flash [nor-flash]<br />
00110A20: /arm-io/spi1/nor-flash/diagnostic-data [diagnostic-data]<br />
00110D70: /arm-io/spi1/nor-flash/raw-device [raw-device]<br />
00110D90: /arm-io/spi1/nor-flash/nvram [nvram]<br />
00111E50: /arm-io/otgphyctrl [otgphyctrl]<br />
00111E90: /arm-io/spi4/multi-touch [multi-touch]<br />
reset = /arm-io/gpio['GPIO'](0x00000A06, 0x00010101)<br />
power_ldo = /arm-io/i2c0/pmu['pmuL'](0x07080203)<br />
interrupt-parent = /arm-io/gpio<br />
00112AB0: /arm-io/i2c0 [i2c]<br />
iic_sda = /arm-io/gpio['GPIO'](0x00000300, 0x00010101)<br />
iic_scl = /arm-io/gpio['GPIO'](0x00000207, 0x00010101)<br />
interrupt-parent = /arm-io/vic<br />
00113350: /arm-io/i2c1 [i2c]<br />
iic_sda = /arm-io/gpio['GPIO'](0x00000103, 0x00010101)<br />
iic_scl = /arm-io/gpio['GPIO'](0x00000102, 0x00010101)<br />
interrupt-parent = /arm-io/vic<br />
00113390: /arm-io/i2c0/accelerometer [accelerometer]<br />
interrupt-parent = /arm-io/gpio<br />
001138A0: /arm-io/i2c0/audio0 [audio-control]<br />
reset = /arm-io/gpio['GPIO'](0x00000900, 0x00010001)<br />
hp_detect = /arm-io/i2c0/pmu['GPIO'](0x00000002, 0x00000100)<br />
interrupt-parent = /arm-io/i2c0/pmu<br />
001138C0: /arm-io/i2c0/pmu [interrupt-controller]<br />
swi_write = /arm-io/swi['swiB']()<br />
interrupt-parent = /arm-io/gpio<br />
00114B60: /arm-io/i2c0/spkr-amp [audio-control]<br />
amp_enable = /arm-io/gpio['GPIO'](0x00000E02, 0x00000001)<br />
00114FE0: /arm-io/i2c0/tethered [tethered]<br />
00115B60: /arm-io/timer [timer]<br />
interrupt-parent = /arm-io/vic<br />
00115BA0: /arm-io/i2c1/als [als]<br />
interrupt-parent = /arm-io/gpio<br />
00116180: /arm-io/i2c1/mikey [mikey]<br />
interrupt_status = /arm-io/i2c0/pmu['GPIO'](0x00000007, 0x00000000)<br />
interrupt-parent = /arm-io/i2c0/pmu<br />
00116CA0: /arm-io/wdt [wdt]<br />
interrupt-parent = /arm-io/vic<br />
001171F0: /arm-io/i2s0 [i2s]<br />
interrupt-parent = /arm-io/gpio<br />
dma-parent = /arm-io/dmac0<br />
00117970: /arm-io/uart0 [uart]<br />
rx = /arm-io/gpio['GPIO'](0x00000004, 0x00000102)<br />
tx = /arm-io/gpio['GPIO'](0x00000005, 0x00000102)<br />
interrupt-parent = /arm-io/vic<br />
dma-parent = /arm-io/dmac0<br />
001179D0: /arm-io/i2s0/audio0 [audio-data]<br />
00118850: /arm-io/uart1 [uart]<br />
tx = /arm-io/gpio['GPIO'](0x00000907, 0x00000102)<br />
rts = /arm-io/gpio['GPIO'](0x00000A00, 0x00000002)<br />
interrupt-parent = /arm-io/vic dma-parent = /arm-io/dmac0<br />
001188C0: /arm-io/uart0/iap<br />
001194B0: /arm-io/pke [pke]<br />
interrupt-parent = /arm-io/vic<br />
001194F0: /arm-io/uart1/bluetooth [bluetooth]<br />
bt_wake = /arm-io/gpio['GPIO'](0x00000A03, 0x00000101)<br />
bt_reset = /arm-io/gpio['GPIO'](0x00000A04, 0x00000001)<br />
0011A0C0: /arm-io/mipi-dsim [mipi-dsim]<br />
0011A4A0: /arm-io/swi [swi]<br />
interrupt-parent = /arm-io/vic<br />
0011A4E0: /arm-io/mipi-dsim/lcd [lcd]<br />
reset = /arm-io/gpio['GPIO'](0x00000107, 0x00000001)<br />
lcd_ldo = /arm-io/i2c0/pmu['pmuL'](0x0BB80104)<br />
interrupt-parent = /arm-io/gpio<br />
0011BD40: /dock [dock]<br />
read_acc = /arm-io/i2c0/pmu['pmuA'](0x00000003)<br />
acc_sw_en = /arm-io/i2c0/pmu['pmuL'](0x80000005)<br />
acc_detect = /arm-io/i2c0/pmu['STAT'](0x00000005)<br />
acc_pwr = /arm-io/i2c0/pmu['pmuL'](0x0CE40005)<br />
interrupt-parent = /arm-io/i2c0/pmu<br />
0011C4F0: /charger [charger]<br />
battery_pack = /dock['accA'](0x0000000B)<br />
set_dmonitor = /arm-io/otgphyctrl['DMON'](0x00000000)<br />
<gpio><br />
0x0 = gpio_spi0_spi_cs0<br />
0x2 = gpio_audio0_hp_detect<br />
0x4 = gpio_uart0_rx<br />
0x5 = gpio_uart0_tx<br />
0x6 = gpio_sdio_power_enable<br />
0x7 = gpio_mikey_interrupt_status<br />
0x102 = gpio_i2c1_iic_scl<br />
0x103 = gpio_i2c1_iic_sda<br />
0x107 = gpio_lcd_reset<br />
0x207 = gpio_i2c0_iic_scl<br />
0x300 = gpio_i2c0_iic_sda<br />
0x406 = gpio_spi1_spi_cs0<br />
0x807 = gpio_tv-out_amp_enable<br />
0x900 = gpio_audio0_reset<br />
0x902 = gpio_buttons_button_volup<br />
0x907 = gpio_uart1_tx<br />
0xA00 = gpio_uart1_rts<br />
0xA02 = gpio_sdio_device_wake<br />
0xA03 = gpio_bluetooth_bt_wake<br />
0xA04 = gpio_bluetooth_bt_reset<br />
0xA06 = gpio_multi-touch_reset<br />
0xA07 = gpio_spi4_spi_cs0<br />
0xC00 = gpio_buttons_button_voldown<br />
0xC01 = gpio_buttons_button_menu<br />
0xC02 = gpio_buttons_button_hold<br />
0xE02 = gpio_spkr-amp_amp_enable<br />
0xE05 = gpio_sdio_device_reset<br />
<interrupts for /arm-io/vic><br />
int 00000002 = /arm-io/gpio<br />
int 00000003 = /arm-io/gpio<br />
int 00000004 = /cpus/cpu0<br />
int 00000008 = /arm-io/timer<br />
int 00000009 = /arm-io/spi0<br />
int 0000000A = /arm-io/spi1<br />
int 0000000D = /arm-io/clcd<br />
int 00000010 = /arm-io/dmac0<br />
int 00000011 = /arm-io/dmac1<br />
int 00000012 = /arm-io/amc<br />
int 00000013 = /arm-io/usb-otg/usb-host<br />
int 00000015 = /arm-io/i2c0<br />
int 00000016 = /arm-io/i2c1<br />
int 00000018 = /arm-io/uart0<br />
int 00000019 = /arm-io/uart1<br />
int 0000001E = /arm-io/tv-out<br />
int 0000001F = /arm-io/gpio<br />
int 00000020 = /arm-io/gpio<br />
int 00000021 = /arm-io/gpio<br />
int 00000023 = /arm-io/h264decoder<br />
int 00000024 = /arm-io/pke<br />
int 00000025 = /arm-io/scaler<br />
int 00000026 = /arm-io/tv-out<br />
int 00000027 = /arm-io/aes<br />
int 00000028 = /arm-io/sha1<br />
int 00000029 = /arm-io/edgeic<br />
int 0000002A = /arm-io/sdio<br />
int 0000002B = /arm-io/flash-controller0<br />
int 0000002D = /arm-io/mpvd<br />
int 00000033 = /arm-io/wdt<br />
int 00000034 = /arm-io/swi<br />
int 00000035 = /arm-io/mbx<br />
int 00000036 = /arm-io/flash-controller0<br />
int 00000037 = /arm-io/spi4<br />
int 0000003F = /cpus/cpu0<br />
<interrupts for /arm-io/gpio><br />
int 00000000 = /arm-io/i2s0<br />
int 00000001 = /arm-io/i2c1/als<br />
int 00000002 = /arm-io/mipi-dsim/lcd<br />
int 00000003 = /arm-io/i2c0/accelerometer<br />
int 00000007 = /buttons<br />
int 00000025 = /arm-io/i2c1/als<br />
int 00000026 = /arm-io/mipi-dsim/lcd<br />
int 0000002C = /arm-io/i2s0<br />
int 00000061 = /arm-io/i2c0/pmu<br />
int 00000062 = /buttons<br />
int 00000063 = /arm-io/i2c0/accelerometer<br />
int 0000006D = /arm-io/spi4/multi-touch<br />
int 00000078 = /buttons<br />
int 00000079 = /buttons<br />
int 0000007A = /buttons<br />
<interrupts for /arm-io/edgeic><br />
int 00000000 = /arm-io/prng<br />
int 00000029 = /arm-io/prng<br />
<interrupts for /arm-io/i2c0/pmu><br />
int 00000005 = /dock<br />
int 0000000E = /arm-io/i2c1/mikey<br />
int 00000016 = /arm-io/i2c0/audio0<br />
<clock gates for clock id 1><br />
gate 0000000C = /arm-io/clcd<br />
gate 00000011 = /arm-io/h264decoder<br />
gate 00000018 = /arm-io/mbx<br />
gate 0000001A = /arm-io/mpvd<br />
gate 0000001C = /arm-io/prng<br />
gate 0000001E = /arm-io/scaler<br />
gate 0000002F = /arm-io/tv-out<br />
<clock gates for clock id 2><br />
gate 00000008 = /arm-io/aes<br />
gate 00000009 = /arm-io/amc<br />
gate 0000000D = /arm-io/dmac0<br />
gate 0000000E = /arm-io/dmac1<br />
gate 00000010 = /arm-io/flash-controller0<br />
gate 0000001F = /arm-io/sdio<br />
gate 00000020 = /arm-io/sha1<br />
gate 00000033 = /arm-io/usb-otg<br />
<clock gates for clock id 3><br />
gate 00000000 = /arm-io/uart0<br />
gate 00000012 = /arm-io/i2c0<br />
gate 00000013 = /arm-io/i2c1<br />
gate 00000014 = /arm-io/i2s0<br />
gate 00000019 = /arm-io/mipi-dsim<br />
gate 0000001B = /arm-io/pke<br />
gate 00000022 = /arm-io/spi0<br />
gate 00000023 = /arm-io/spi1<br />
gate 00000026 = /arm-io/spi4<br />
gate 00000027 = /arm-io/swi<br />
gate 00000028 = /arm-io/timer<br />
gate 00000029 = /arm-io/timer<br />
gate 0000002A = /arm-io/timer<br />
gate 0000002B = /arm-io/timer<br />
gate 0000002C = /arm-io/timer<br />
gate 0000002D = /arm-io/timer<br />
gate 0000002E = /arm-io/timer<br />
gate 00000030 = /arm-io/uart1<br />
gate 00000034 = /arm-io/otgphyctrl<br />
<dma channels for /arm-io/dmac1><br />
dma 00000000 = /arm-io/spi4<br />
dma 00000003 = /arm-io/spi4<br />
dma 00000005 = /arm-io/mbx<br />
dma 00000040 = /arm-io/mbx<br />
dma 00000980 = /arm-io/spi4<br />
dma 00089000 = /arm-io/spi4<br />
dma 00489000 = /arm-io/mbx<br />
dma 3B800000 = /arm-io/mbx<br />
dma 3E100010 = /arm-io/spi4<br />
<dma channels for /arm-io/dmac0><br />
dma 00000000 = /arm-io/uart1<br />
dma 00000A80 = /arm-io/i2s0<br />
dma 0000100E = /arm-io/uart0<br />
dma 00001012 = /arm-io/uart1<br />
dma 00001056 = /arm-io/i2s0<br />
dma 00249000 = /arm-io/i2s0<br />
dma 3CA00010 = /arm-io/i2s0<br />
dma 3CA00038 = /arm-io/i2s0<br />
dma 3CC00024 = /arm-io/uart0<br />
dma 3DB00024 = /arm-io/uart1<br />
</pre></div>User890104https://freemyipod.org/index.php?title=Linux&diff=22215Linux2026-01-08T23:59:20Z<p>User890104: </p>
<hr />
<div><br />
== Current: Freemyipod Linux ==<br />
<br />
We are working on supporting Samsung/S5L-based devices which have an MMU. Currently our main focus is the [[Nano 5G]], there are also builds for [[Nano 2G]] and [[Nano 7G]]. An experimental source tree is available on [https://github.com/freemyipod/linux github.com/freemyipod/linux].<br />
<br />
=== User Guide ===<br />
<br />
Not yet available, as the Linux port isn't yet practical to use. We have no storage drivers, no screen driver, no sound driver...<br />
<br />
=== Developer Guide ===<br />
<br />
If you're somewhat familiar with embedded Linux, you can get started by building [[WInd3x|wInd3x]], [[U-Boot]] and the Kernel as described below. However, '''you will have to provide your own userland''' (eg. buildroot, archlinux arm, ... anything armv6 compatible) and either run it from an initramfs or over NFS. '''A serial cable is not necessary, but very useful to troubleshoot boot issues.'''<br />
<br />
==== Build everything ====<br />
<br />
''These are not copy-paste instructions. You are expected to understand what's happening.'<br />
<br />
You will need an arm-none-eabi- toolchain into your $PATH, eg. gcc-arm-embedded from your package manager.<br />
<br />
First, wInd3x: this will be used to run u-boot.<br />
<br />
$ git clone https://github.com/freemyipod/wInd3x<br />
$ cd wInd3x<br />
$ go build ./cmd/wInd3x<br />
<br />
Second, U-Boot:<br />
<br />
$ git clone https://github.com/freemyipod/u-boot<br />
$ cd u-boot<br />
$ git checkout s5l87xx<br />
$ make apple_ipodnano2g_defconfig # for Nano 2G OR<br />
$ make apple_n33_defconfig # for Nano 5G OR<br />
$ make apple_n31_defconfig # for Nano 7G<br />
$ make CROSS_COMPILE=arm-none-eabi- -j $(nproc) u-boot.bin<br />
<br />
Third, Linux:<br />
<br />
$ git clone https://github.com/freemyipod/linux<br />
$ cd linux<br />
$ git checkout n5g-wip # for Nano 5G OR<br />
$ git checkout n7g-wip # for Nano 7G<br />
$ make ARCH=arm nano5g_defconfig # for Nano 5G<br />
$ make ARCH=arm apple_n31_defconfig # for Nano 7G<br />
$ make ARCH=arm CROSS_COMPILE=arm-none-eabi- -j $(nproc) zImage<br />
<br />
By this point, have a initramfs ready. If you wanna boot directly from nfs, edit CMDLINE in the kernel .config accordingly.<br />
<br />
Finally, bundle together an u-boot image containing the kernel, your initramfs, and the device-tree (built by u-boot):<br />
<br />
$ mkimage -A arm -C none -O linux -T multi -a 0x08000000 -e 0x08000000 -d arch/arm/boot/zImage:initramfs.gz:../u-boot/arch/arm/dts/s5l8730.dtb mImage<br />
<br />
''mImage'' is your combined image.<br />
<br />
==== Running ====<br />
<br />
Connect your iPod nano in DFU mode.<br />
<br />
Run u-boot using wInd3x:<br />
<br />
$ ./wInd3x cfw run ../u-boot/u-boot.bin<br />
<br />
This should start u-boot. Running this for the first time will take a while, as some bootloader stages need to be downloaded, decrypted and modified. A new USB device (05ac:8007) appear on your host. Use dfu-util to upload mImage:<br />
<br />
dfu-util -d 05ac:8007 -D mImage && dfu-util -d 05ac:8007 -e<br />
<br />
Then, in the serial console you'll see Linux booting:<br />
<br />
## Booting kernel from Legacy Image at 08000000 ...<br />
...<br />
Starting kernel ...<br />
<br />
[ 0.000000] Booting Linux on physical CPU 0x0<br />
[ 0.000000] Linux version 6.2.0-rc4-00476-g4c4af4d7e53c (q3k@mimeomia) (arm-none-eabi-gcc (GNU Arm Embedded Toolchain 10.3-2021.10) 10.3.1 20210824 (release), GNU ld (GNU Arm Embedded Toolchain 10.3-2021.10) 2.36.1.20210621) #70 Fri Jan 20 18:02:56 CET 2023<br />
...<br />
<br />
The LCD display should start up and show a boot log. If not, try adding <code>console=tty0</code> to your CMDLINE? You might also use <code>fbcon=rotate:1</code> to rotate the framebuffer 90 degrees.<br />
<br />
If everything goes well, the kernel should boot up and attempt to mount a rootfs. It's up to you to get this part working, at least until we streamline the process. The USB CDC EEM ethernet gadget should also appear on your host (probably as usb0, or some long systemd predictable name). The other end will be visible as 'usb0' on the device.<br />
<br />
On [[Nano 7G]] you'll need a DCSD cable (Alex/Magico), and the command line to get proper serial output:<br />
<br />
picocom --baud 115200 --imap lfcrlf /dev/ttyUSB0<br />
<br />
Now go on and have a go at reverse-engineering some peripherals! :)<br />
<br />
== Legacy: iPodLinux ==<br />
<br />
The [http://www.ipodlinux.org/ iPodLinux] project supports all the PortalPlayer based iPods: iPod 1G-4G, Photo/Color, Video/5G/5.5G, Mini, iPod Nano 1G. It is currently semi-abandoned, and uses a very old ucLinux kernel build.</div>User890104https://freemyipod.org/index.php?title=Linux&diff=22214Linux2026-01-08T21:14:20Z<p>User890104: /* Running */</p>
<hr />
<div><br />
== Current: Freemyipod Linux ==<br />
<br />
We are working on supporting Samsung/S5L-based devices which have an MMU. Currently our main focus is the [[Nano 5G]], there are also builds for [[Nano 2G]] and [[Nano 7G]]. An experimental source tree is available on [https://github.com/freemyipod/linux github.com/freemyipod/linux].<br />
<br />
=== User Guide ===<br />
<br />
Not yet available, as the Linux port isn't yet practical to use. We have no storage drivers, no screen driver, no sound driver...<br />
<br />
=== Developer Guide ===<br />
<br />
If you're somewhat familiar with embedded Linux, you can get started by building [[WInd3x|wInd3x]], [[U-Boot]] and the Kernel as described below. However, '''you will have to provide your own userland''' (eg. buildroot, archlinux arm, ... anything armv6 compatible) and either run it from an initramfs or over NFS. '''A serial cable is not necessary, but very useful to troubleshoot boot issues.'''<br />
<br />
==== Build everything ====<br />
<br />
''These are not copy-paste instructions. You are expected to understand what's happening.'<br />
<br />
You will need an arm-none-eabi- toolchain into your $PATH, eg. gcc-arm-embedded from your package manager.<br />
<br />
First, wInd3x: this will be used to run u-boot.<br />
<br />
$ git clone https://github.com/freemyipod/wInd3x<br />
$ cd wInd3x<br />
$ go build ./cmd/wInd3x<br />
<br />
Second, U-Boot:<br />
<br />
$ git clone https://github.com/freemyipod/u-boot<br />
$ cd u-boot<br />
$ git checkout s5l87xx<br />
$ make apple_ipodnano2g_defconfig # for Nano 2G OR<br />
$ make apple_n33_defconfig # for Nano 5G OR<br />
$ make apple_n31_defconfig # for Nano 7G<br />
$ make CROSS_COMPILE=arm-none-eabi- u-boot.bin -j $(nproc)<br />
<br />
Third, Linux:<br />
<br />
$ git clone https://github.com/freemyipod/linux<br />
$ cd linux<br />
$ git checkout n5g-wip # for Nano 5G OR<br />
$ git checkout n7g-wip # for Nano 7G<br />
$ make ARCH=arm nano5g_defconfig # for Nano 5G<br />
$ make ARCH=arm apple_n31_defconfig # for Nano 7G<br />
$ make ARCH=arm CROSS_COMPILE=arm-none-eabi- -j $(nproc) zImage<br />
<br />
By this point, have a initramfs ready. If you wanna boot directly from nfs, edit CMDLINE in the kernel .config accordingly.<br />
<br />
Finally, bundle together an u-boot image containing the kernel, your initramfs, and the device-tree (built by u-boot):<br />
<br />
$ mkimage -A arm -C none -O linux -T multi -a 0x08000000 -e 0x08000000 -d arch/arm/boot/zImage:initramfs.gz:../u-boot/arch/arm/dts/s5l8730.dtb mImage<br />
<br />
''mImage'' is your combined image.<br />
<br />
==== Running ====<br />
<br />
Connect your iPod nano in DFU mode.<br />
<br />
Run u-boot using wInd3x:<br />
<br />
$ ./wInd3x cfw run ../u-boot/u-boot.bin<br />
<br />
This should start u-boot. Running this for the first time will take a while, as some bootloader stages need to be downloaded, decrypted and modified. A new USB device (05ac:8007) appear on your host. Use dfu-util to upload mImage:<br />
<br />
dfu-util -d 05ac:8007 -D mImage && dfu-util -d 05ac:8007 -e<br />
<br />
Then, in the serial console you'll see Linux booting:<br />
<br />
## Booting kernel from Legacy Image at 08000000 ...<br />
...<br />
Starting kernel ...<br />
<br />
[ 0.000000] Booting Linux on physical CPU 0x0<br />
[ 0.000000] Linux version 6.2.0-rc4-00476-g4c4af4d7e53c (q3k@mimeomia) (arm-none-eabi-gcc (GNU Arm Embedded Toolchain 10.3-2021.10) 10.3.1 20210824 (release), GNU ld (GNU Arm Embedded Toolchain 10.3-2021.10) 2.36.1.20210621) #70 Fri Jan 20 18:02:56 CET 2023<br />
...<br />
<br />
The LCD display should start up and show a boot log. If not, try adding <code>console=tty0</code> to your CMDLINE? You might also use <code>fbcon=rotate:1</code> to rotate the framebuffer 90 degrees.<br />
<br />
If everything goes well, the kernel should boot up and attempt to mount a rootfs. It's up to you to get this part working, at least until we streamline the process. The USB CDC EEM ethernet gadget should also appear on your host (probably as usb0, or some long systemd predictable name). The other end will be visible as 'usb0' on the device.<br />
<br />
On [[Nano 7G]] you'll need a DCSD cable (Alex/Magico), and the command line to get proper serial output:<br />
<br />
picocom --baud 115200 --imap lfcrlf /dev/ttyUSB0<br />
<br />
Now go on and have a go at reverse-engineering some peripherals! :)<br />
<br />
== Legacy: iPodLinux ==<br />
<br />
The [http://www.ipodlinux.org/ iPodLinux] project supports all the PortalPlayer based iPods: iPod 1G-4G, Photo/Color, Video/5G/5.5G, Mini, iPod Nano 1G. It is currently semi-abandoned, and uses a very old ucLinux kernel build.</div>User890104https://freemyipod.org/index.php?title=Hardware&diff=22213Hardware2026-01-08T17:16:37Z<p>User890104: </p>
<hr />
<div>== Overview ==<br />
<br />
This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.<br />
<br />
{| class="wikitable"<br />
! Generation !! SoC !! CPU Core !! RAM !! NOR/Utility Flash !! Device Code Name !! SoC Family Code Name !! UpdaterFamilyID<br />
|-<br />
|[[Nano 1G]]<br />
|PP5021C-TDF<br />
|<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41856 SST39WF400A] (512KiB)<br />
|<br />
|<br />
| 14/17<br />
|-<br />
|[[Nano 2G]]<br />
|S5L8701<br />
|ARM940T<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41422 SST39WF800A] (1MiB)<br />
|<br />
| M1<br />
| 19/29<br />
|-<br />
|[[Nano 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (32MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
| N46<br />
| M1A<br />
| 26<br />
|-<br />
|[[Nano 4G]]<br />
|S5L8720<br />
|ARM1176<br />
|Integrated (32MiB)<br />
| ''none''<br />
| N58<br />
| M2<br />
| 31<br />
|-<br />
|[[Nano 5G]]<br />
|S5L8730<br />
|ARM1176<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N33<br />
| M2<br />
| 34<br />
|-<br />
|[[Nano 6G|Nano 6G]]<br />
|S5L8723<br />
|ARM1176<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N20<br />
|<br />
| 36<br />
|-<br />
|[[Nano 7G|Nano 7G]]<br />
|S5L8740<br />
|Cortex A5<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N31<br />
| H4<br />
| 37<br />
|-<br />
|[[Classic 1G]]<br />
|S5L8702<br />
|<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|<br />
|<br />
| 24<br />
|-<br />
|[[Classic 2G]]<br />
|S5L8702<br />
|<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|<br />
|<br />
| 33<br />
|-<br />
|[[Classic 3G]]<br />
|S5L8702<br />
|<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X51163PE] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|<br />
|<br />
| 35/38<br />
|}<br />
<br />
=== Explanations ===<br />
<br />
* '''Device Code Name''': product code name, from early prototype phases to production run device. Most commonly used internal reference.<br />
* '''SoC Family Code Name''': device family code name, seems to follow large generational changes in SoC. Mostly seen around hardware (init) code, eg. flash interface, diags, etc.<br />
<br />
==Helpful pages==<br />
Chip analyses<br />
*http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx<br />
*http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx<br />
Additional information<br />
*http://dendrites.blog.163.com/blog/static/165376178201082112922174/</div>User890104https://freemyipod.org/index.php?title=Nano_6G&diff=22212Nano 6G2026-01-08T17:16:15Z<p>User890104: </p>
<hr />
<div>{{DISPLAYTITLE:iPod nano (6th generation)}}<br />
==Components==<br />
[[File:nano_6g_frt_a.png|500px|thumb|none|Front of the circuit board]]<br />
[[File:nano_6g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br />
{| class="wikitable"<br />
! Label !! Component !! Part !! Markings !! Notes<br />
|-<br />
| <span style="color:red">Red</span><br />
| NAND Flash<br />
| Toshiba TH58NVG6E2FLA4C<br />
| Toshiba TH58NVG6E2FLA4C E00474 JAPAN 1032KAE<br />
| Flash - MLC NAND, 8 GB<br />
|-<br />
| <span style="color:cyan">Cyan</span><br />
| Audio codec<br />
| Cirrus Logic CLI1544C0<br />
| Apple 33850859 C0E111022<br />
| Cirrus Logic CS42L59 according to another report<ref name="elektroniknet"/><br />
|-<br />
| <span style="color:orange">Orange</span><br />
| PMU<br />
| Dialog D1830B<br />
| Apple 338S0783-B1 10298HLS<br />
| <br />
|-<br />
| <span style="color:#e8e838">Yellow</span><br />
| FM receiver<br />
| Silicon Labs Si4800<br />
| 0650 D0UY 027<br />
| Silicon Labs Si4706 according to another report<ref name="elektroniknet"/><br />
|-<br />
| <span style="color:blue">Blue</span><br />
| CPU<br />
| Samsung S5L8723<br />
| Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031<br />
| Samsung APL3278A01 ARM Application processor (ARM1176JZF-S core)<br />
Samsung K4X51323PI Mobile DDR SDRAM 512 Mbytes (64 MB) (16 Mbytes x 32), 1.8 V, PoP<br />
|-<br />
| <span style="color:#cf5eea">Pink</span><br />
| Touchscreen controller<br />
| Cypress CY8C20746B<br />
| 35758907 1025 A 04 629749<br />
| Controller for capacitive touchscreen, 16 KB Flash, 1 KB SRAM<br />
|-<br />
| <br />
| Video driver<br />
| Intersil ISL59121<ref name="elektroniknet"/><br />
| <br />
| Three channels with low-pass filter (based on ISL59123)<br />
|}<br />
<br />
==Notes==<br />
The red and black wires lead to the battery.<br />
<br />
==Helpful pages==<br />
Teardowns:<br />
*http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563<br />
Reviews:<br />
*http://arstechnica.com/apple/reviews/2010/09/6th-generation-ipod-nano.ars<br />
*https://web.archive.org/web/20121107004843/http://www.ubmtechinsights.com/reports-and-subscriptions/investigative-analysis/apple-ipod-nano/<br />
===Annotations===<br />
<references><br />
<ref name="elektroniknet">https://www.elektroniknet.de/halbleiter/aufgeschraubt-und-reingeschaut-ipod-nano.29651.html</ref><br />
</references></div>User890104https://freemyipod.org/index.php?title=Nano_6G&diff=22211Nano 6G2026-01-08T17:00:08Z<p>User890104: </p>
<hr />
<div>{{DISPLAYTITLE:iPod nano (6th generation)}}<br />
==Components==<br />
[[File:nano_6g_frt_a.png|500px|thumb|none|Front of the circuit board]]<br />
[[File:nano_6g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br />
{| class="wikitable"<br />
! Label !! Component !! Part !! Markings !! Notes<br />
|-<br />
| <span style="color:red">Red</span><br />
| NAND Flash<br />
| Toshiba TH58NVG6E2FLA4C<br />
| Toshiba TH58NVG6E2FLA4C E00474 JAPAN 1032KAE<br />
| Flash - MLC NAND, 8 GB<br />
|-<br />
| <span style="color:cyan">Cyan</span><br />
| Audio codec<br />
| Cirrus Logic CLI1544C0<br />
| Apple 33850859 C0E111022<br />
| Cirrus Logic CS42L59 according to another report<ref name="elektroniknet"/><br />
|-<br />
| <span style="color:orange">Orange</span><br />
| PMU<br />
| Dialog D1830B<br />
| Apple 338S0783-B1 10298HLS<br />
| <br />
|-<br />
| <span style="color:#e8e838">Yellow</span><br />
| FM receiver<br />
| Silicon Labs Si4800<br />
| 0650 D0UY 027<br />
| Silicon Labs Si4706 according to another report<ref name="elektroniknet"/><br />
|-<br />
| <span style="color:blue">Blue</span><br />
| CPU<br />
| Samsung S5L8723<br />
| Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031<br />
| Samsung APL3278A01 ARM Application processor<br />
Samsung K4X51323PI Mobile DDR SDRAM 512 Mbytes (64 MB) (16 Mbytes x 32), 1.8 V, PoP<br />
|-<br />
| <span style="color:#cf5eea">Pink</span><br />
| Touchscreen controller<br />
| Cypress CY8C20746B<br />
| 35758907 1025 A 04 629749<br />
| Controller for capacitive touchscreen, 16 KB Flash, 1 KB SRAM<br />
|-<br />
| <br />
| Video driver<br />
| Intersil ISL59121<ref name="elektroniknet"/><br />
| <br />
| Three channels with low-pass filter (based on ISL59123)<br />
|}<br />
<br />
==Notes==<br />
The red and black wires lead to the battery.<br />
<br />
==Helpful pages==<br />
Teardowns:<br />
*http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563<br />
Reviews:<br />
*http://arstechnica.com/apple/reviews/2010/09/6th-generation-ipod-nano.ars<br />
*https://web.archive.org/web/20121107004843/http://www.ubmtechinsights.com/reports-and-subscriptions/investigative-analysis/apple-ipod-nano/<br />
===Annotations===<br />
<references><br />
<ref name="elektroniknet">https://www.elektroniknet.de/halbleiter/aufgeschraubt-und-reingeschaut-ipod-nano.29651.html</ref><br />
</references></div>User890104https://freemyipod.org/index.php?title=Nano_6G&diff=22210Nano 6G2026-01-08T16:58:16Z<p>User890104: </p>
<hr />
<div>{{DISPLAYTITLE:iPod nano (6th generation)}}<br />
==Components==<br />
[[File:nano_6g_frt_a.png|500px|thumb|none|Front of the circuit board]]<br />
[[File:nano_6g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br />
{| class="wikitable"<br />
! Label !! Component !! Part !! Markings !! Notes<br />
|-<br />
| <span style="color:red">Red</span><br />
| NAND Flash<br />
| Toshiba TH58NVG6E2FLA4C<br />
| Toshiba TH58NVG6E2FLA4C E00474 JAPAN 1032KAE<br />
| Flash - MLC NAND, 8 GB<br />
|-<br />
| <span style="color:cyan">Cyan</span><br />
| Audio codec<br />
| Cirrus Logic CLI1544C0<br />
| Apple 33850859 C0E111022<br />
| Cirrus Logic CS42L59 according to another report<ref name="elektroniknet"/><br />
|-<br />
| <span style="color:orange">Orange</span><br />
| PMU<br />
| Dialog D1830B<br />
| Apple 338S0783-B1 10298HLS<br />
| <br />
|-<br />
| <span style="color:#e8e838">Yellow</span><br />
| FM receiver<br />
| Silicon Labs Si4800<br />
| 0650 D0UY 027<br />
| Silicon Labs Si4706 according to another report<ref name="elektroniknet"/><br />
|-<br />
| <span style="color:blue">Blue</span><br />
| CPU<br />
| Samsung S5L8723<br />
| Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031<br />
| Samsung APL3278A01 ARM Application processor<br />
Samsung K4X51323PI Mobile DDR SDRAM 512 Mbytes (64 MB) (16 Mbytes x 32), 1.8 V, PoP<br />
|-<br />
| <span style="color:#cf5eea">Pink</span><br />
| Touchscreen controller<br />
| Cypress CY8C20746B<br />
| 35758907 1025 A 04 629749<br />
| Controller for capacitive touchscreen, 16 KB Flash, 1 KB SRAM<br />
|-<br />
| <br />
| Video driver<br />
| Intersil ISL59121<ref name="elektroniknet"/><br />
| <br />
| Three channels with low-pass filter (based on ISL59123)<br />
|}<br />
<br />
==Notes==<br />
The red and black wires lead to the battery.<br />
<br />
==Helpful pages==<br />
Teardowns:<br />
*http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563<br />
Reviews:<br />
*http://arstechnica.com/apple/reviews/2010/09/6th-generation-ipod-nano.ars<br />
*http://www.ubmtechinsights.com/reports-and-subscriptions/investigative-analysis/apple-ipod-nano/<br />
===Annotations===<br />
<references><br />
<ref name="elektroniknet">https://www.elektroniknet.de/halbleiter/aufgeschraubt-und-reingeschaut-ipod-nano.29651.html</ref><br />
</references></div>User890104https://freemyipod.org/index.php?title=Nano_6G&diff=22209Nano 6G2026-01-08T16:57:02Z<p>User890104: </p>
<hr />
<div>{{DISPLAYTITLE:iPod nano (6th generation)}}<br />
==Components==<br />
[[File:nano_6g_frt_a.png|500px|thumb|none|Front of the circuit board]]<br />
[[File:nano_6g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br />
{| class="wikitable"<br />
! Label !! Component !! Part !! Markings !! Notes<br />
|-<br />
| <span style="color:red">Red</span><br />
| NAND Flash<br />
| <br />
| Toshiba TH58NVG6E2FLA4C<br />
| Flash - MLC NAND, 8 GB<br />
|-<br />
| <span style="color:cyan">Cyan</span><br />
| Audio codec<br />
| Cirrus Logic CLI1544C0<br />
| Apple 33850859 C0E111022<br />
| Cirrus Logic CS42L59 according to another report<ref name="elektroniknet"/><br />
|-<br />
| <span style="color:orange">Orange</span><br />
| PMU<br />
| Dialog D1830B<br />
| Apple 338S0783-B1 10298HLS<br />
| <br />
|-<br />
| <span style="color:#e8e838">Yellow</span><br />
| FM receiver<br />
| Silicon Labs Si4800<br />
| 0650 D0UY 027<br />
| Silicon Labs Si4706 according to another report<ref name="elektroniknet"/><br />
|-<br />
| <span style="color:blue">Blue</span><br />
| CPU<br />
| Samsung S5L8723<br />
| Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031<br />
| Samsung APL3278A01 ARM Application processor<br />
Samsung K4X51323PI Mobile DDR SDRAM 512 Mbytes (64 MB) (16 Mbytes x 32), 1.8 V, PoP<br />
|-<br />
| <span style="color:#cf5eea">Pink</span><br />
| Touchscreen controller<br />
| Cypress CY8C20746B<br />
| 35758907 1025 A 04 629749<br />
| Controller for capacitive touchscreen, 16 KB Flash, 1 KB SRAM<br />
|-<br />
| <br />
| Video driver<br />
| Intersil ISL59121<ref name="elektroniknet"/><br />
| <br />
| Three channels with low-pass filter (based on ISL59123)<br />
|}<br />
<br />
==Notes==<br />
The red and black wires lead to the battery.<br />
<br />
==Helpful pages==<br />
Teardowns:<br />
*http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563<br />
Reviews:<br />
*http://arstechnica.com/apple/reviews/2010/09/6th-generation-ipod-nano.ars<br />
*http://www.ubmtechinsights.com/reports-and-subscriptions/investigative-analysis/apple-ipod-nano/<br />
===Annotations===<br />
<references><br />
<ref name="elektroniknet">https://www.elektroniknet.de/halbleiter/aufgeschraubt-und-reingeschaut-ipod-nano.29651.html</ref><br />
</references></div>User890104https://freemyipod.org/index.php?title=Nano_6G&diff=22208Nano 6G2026-01-08T16:51:38Z<p>User890104: add more nano 6g in</p>
<hr />
<div>{{DISPLAYTITLE:iPod nano (6th generation)}}<br />
==Components==<br />
[[File:nano_6g_frt_a.png|500px|thumb|none|Front of the circuit board]]<br />
[[File:nano_6g_bck_a.png|500px|thumb|none|Back of the circuit board]]<br />
{| class="wikitable"<br />
! Label !! Component !! Part !! Markings !! Notes<br />
|-<br />
| <span style="color:red">Red</span><br />
| NAND Flash<br />
| <br />
| Toshiba TH58NVG6E2FLA4C<br />
| Flash - MLC NAND, 8 GB<br />
|-<br />
| <span style="color:cyan">Cyan</span><br />
| Audio codec<br />
| Cirrus Logic CLI1544C0<br />
| Apple 33850859 C0E111022<br />
| Cirrus Logic CS42L59 according to another report<br />
|-<br />
| <span style="color:orange">Orange</span><br />
| PMU<br />
| Dialog D1830B<br />
| Apple 338S0783-B1 10298HLS<br />
| <br />
|-<br />
| <span style="color:#e8e838">Yellow</span><br />
| FM receiver<br />
| Silicon Labs Si4800<br />
| 0650 D0UY 027<br />
| Silicon Labs Si4706 according to another report<br />
|-<br />
| <span style="color:blue">Blue</span><br />
| CPU<br />
| Samsung S5L8723<br />
| Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031<br />
| Samsung APL3278A01 ARM Application processor<br />
Samsung K4X51323PI Mobile DDR SDRAM 512 Mbytes (64 MB) (16 Mbytes x 32), 1.8 V, PoP<br />
<br />
Rusty Mercury says it's a Samsung S5L8723, a step up from the previous Samsung 8730. [http://twitter.com/RustyMercury/status/23268805957 source]<br />
<br />
|-<br />
| <span style="color:#cf5eea">Pink</span><br />
| Touchscreen controller<br />
| Cypress CY8C20746B<br />
| 35758907 1025 A 04 629749<br />
| Controller for capacitive touchscreen, 16 KB Flash, 1 KB SRAM<br />
|-<br />
| <br />
| Video driver<br />
| Intersil ISL59121<br />
| <br />
| Three channels with low-pass filter (based on ISL59123)<br />
|}<br />
<br />
==Notes==<br />
The red and black wires lead to the battery.<br />
<br />
==Helpful pages==<br />
Teardowns:<br />
*http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563<br />
Reviews:<br />
*http://arstechnica.com/apple/reviews/2010/09/6th-generation-ipod-nano.ars<br />
*http://www.ubmtechinsights.com/reports-and-subscriptions/investigative-analysis/apple-ipod-nano/</div>User890104https://freemyipod.org/index.php?title=Hardware&diff=22207Hardware2026-01-08T16:36:15Z<p>User890104: </p>
<hr />
<div>== Overview ==<br />
<br />
This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.<br />
<br />
{| class="wikitable"<br />
! Generation !! SoC !! CPU Core !! RAM !! NOR/Utility Flash !! Device Code Name !! SoC Family Code Name !! UpdaterFamilyID<br />
|-<br />
|[[Nano 1G]]<br />
|PP5021C-TDF<br />
|<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41856 SST39WF400A] (512KiB)<br />
|<br />
|<br />
| 14/17<br />
|-<br />
|[[Nano 2G]]<br />
|S5L8701<br />
|ARM940T<br />
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG] (32MiB)<br />
|[http://www.sst.com/products/?inode=41422 SST39WF800A] (1MiB)<br />
|<br />
| M1<br />
| 19/29<br />
|-<br />
|[[Nano 3G]]<br />
|S5L8702<br />
|ARM926<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (32MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
| N46<br />
| M1A<br />
| 26<br />
|-<br />
|[[Nano 4G]]<br />
|S5L8720<br />
|ARM1176<br />
|Integrated (32MiB)<br />
| ''none''<br />
| N58<br />
| M2<br />
| 31<br />
|-<br />
|[[Nano 5G]]<br />
|S5L8730<br />
|ARM1176<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N33<br />
| M2<br />
| 34<br />
|-<br />
|[[Nano 6G|Nano 6G]]<br />
|S5L8723<br />
|<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N20<br />
|<br />
| 36<br />
|-<br />
|[[Nano 7G|Nano 7G]]<br />
|S5L8740<br />
|Cortex A5<br />
|Integrated (64MiB)<br />
| ''none''<br />
| N31<br />
| H4<br />
| 37<br />
|-<br />
|[[Classic 1G]]<br />
|S5L8702<br />
|<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|<br />
|<br />
| 24<br />
|-<br />
|[[Classic 2G]]<br />
|S5L8702<br />
|<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|<br />
|<br />
| 33<br />
|-<br />
|[[Classic 3G]]<br />
|S5L8702<br />
|<br />
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X51163PE] (64MiB)<br />
|[http://www.sst.com/products/?inode=41340 SST25VF080B] (1MiB)<br />
|<br />
|<br />
| 35/38<br />
|}<br />
<br />
=== Explanations ===<br />
<br />
* '''Device Code Name''': product code name, from early prototype phases to production run device. Most commonly used internal reference.<br />
* '''SoC Family Code Name''': device family code name, seems to follow large generational changes in SoC. Mostly seen around hardware (init) code, eg. flash interface, diags, etc.<br />
<br />
==Helpful pages==<br />
Chip analyses<br />
*http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx<br />
*http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx<br />
Additional information<br />
*http://dendrites.blog.163.com/blog/static/165376178201082112922174/</div>User890104https://freemyipod.org/index.php?title=Contact&diff=22206Contact2026-01-07T20:06:04Z<p>User890104: </p>
<hr />
<div>There are various ways to contact the freemyipod team.<br />
<br />
Please do '''not''' contact us about any iOS device like iPod touch. We don't do anything with them nor can we help you with anything on these devices.<br />
<br />
<br />
== IRC ==<br />
We have an IRC channel on [https://libera.chat/ Libera]. You can join it on [ircs://irc.libera.chat/freemyipod #freemyipod]. (Web client [https://web.libera.chat/?channels=#freemyipod here])<br />
<br />
Very outdated IRC logs are available at https://logs.freemyipod.org and automatic sync is planned.<br />
<br />
If you have questions about Rockbox that are not iPod related, please look for support at [https://www.rockbox.org/ rockbox.org].<br />
<br />
If you happen to have any question related to the original iPod firmware, please ask elsewhere.<br />
<br />
== Matrix ==<br />
<br />
The IRC channel above is bridged to [https://matrix.to/#/#freemyipod:hackerspace.pl #freemyipod:hackerspace.pl] on Matrix.<br />
<br />
== Discord ==<br />
While not an official channel for support, you can find others interested in iPod Nano/Classic development in the [https://discord.gg/7PnGEXjW3X iPod Nano Hacking discord server].<br />
<br />
== Mailing lists ==<br />
We used to have mailing lists, but they are not operational anymore.<br />
<br />
== Mail ==<br />
We used to have individual mailboxes for project members, but they are not operational anymore.</div>User890104https://freemyipod.org/index.php?title=Contact&diff=22205Contact2026-01-07T01:09:34Z<p>User890104: </p>
<hr />
<div>There are various ways to contact the freemyipod team.<br />
<br />
Please do '''not''' contact us about any iOS device like iPod touch. We don't do anything with them nor can we help you with anything on these devices.<br />
<br />
<br />
== IRC ==<br />
We have an IRC channel on [https://libera.chat/ Libera]. You can join it on [ircs://irc.libera.chat/freemyipod #freemyipod]. (Web client [https://web.libera.chat/?channels=#freemyipod here])<br />
<br />
Very outdated IRC logs are available at https://logs.freemyipod.org and automatic sync is planned.<br />
<br />
If you have questions about Rockbox that are not iPod related, please look for support at [https://www.rockbox.org/ rockbox.org] and if you happen to have any question related to the original iPod firmware please ask elsewhere.<br />
<br />
== Matrix ==<br />
<br />
The IRC channel above is bridged to [https://matrix.to/#/#freemyipod:hackerspace.pl #freemyipod:hackerspace.pl] on Matrix.<br />
<br />
== Discord ==<br />
While not an official channel for support, you can find others interested in iPod Nano/Classic development in the [https://discord.gg/7PnGEXjW3X iPod Nano Hacking discord server].<br />
<br />
== Mailing lists ==<br />
We used to have mailing lists, but they are not operational anymore.<br />
<br />
== Mail ==<br />
We used to have individual mailboxes for project members, but they are not operational anymore.</div>User890104