At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting.

==Normal mode==
"Normal mode" is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.

==Disk mode==
In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text "Do not disconnect." or a checkmark symbol with the text "OK to disconnect." depending on whether the iPod is connected and if it has been ejected.

Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]

Disk mode is also referred to as "forced disk mode" in device information received from the iPod.

The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the "disk" partition of the [[Firmware]].

=== How to access it===
* Clickwheel iPods (except for the very first models):
** hold down '''Menu''' and '''Select''' to do a hard reboot
** hold down '''Select''' and '''Play/Pause''' when the Apple logo appears
* [[Nano 6G]]
** hold down '''Volume Down''' and '''Power''' to do a hard reboot
** hold down '''Volume Up''' when the Apple logo appears
* [[Nano 7G]]
** hold down '''Power''' and '''Menu''' to do a hard reboot
** hold down '''Volume Up''' and '''Volume Down''' when the Apple logo appears

==DFU mode==
[https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the [[Nano 3G]] and newer and the [[Classic 6G]] and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].

When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other IMG1 images cannot be sent in this mode.

The [[Nano 2G]] also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does, however, support a NOR DFU mode that can be entered by holding down '''Rewind''' and '''Play/Pause''' right after rebooting the device<ref>https://www.rockbox.org/irc/log-20080904#13:31:44</ref>.

=== How to access it===
# Connect the iPod to a computer using a USB cable
# Check which key combo you need to hold down depending on the iPod's model
# Keep holding down the same buttons until the Apple logo appears, keep holding until the screen goes black, wait about 1 second and release the buttons.

* [[Nano_3G]], [[Nano_4G]], [[Nano_5G]] and [[Classic_1G]]: '''Menu''' and '''Select'''
* [[Nano 6G]]: '''Volume Down''' and '''Power'''
* [[Nano 7G]]: '''Power''' and '''Menu'''

==WTF mode==
In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.

The iTunes behavior upon seeing an iPod in WTF mode is to send it a "recovery" firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the "osos" partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].

==Diagnostic mode==
[[File:Nano 7G diagnostic mode.jpg|thumb|right|[[Nano 7G]] in diagnostics mode]]
This mode will give quite a lot of info about your iPod. In diagnostics mode you can find info about the battery power check the LCD, button inputs, radio signals, DRAM, NAND, Accelerometer, dock information and an about section. On touchscreen iPods there is also a section for touchscreen testing.
=== How to access it===
* Clickwheel iPods (except for the very first models):
** hold down '''Menu''' and '''Select''' to do a hard reboot
** hold down '''Select''' and '''Rewind''' when the Apple logo appears
* [[Nano 6G]]
** hold down '''Volume Down''' and '''Power''' to do a hard reboot
** hold down '''Volume Up''', '''Volume Down''' and '''Power''' when the Apple logo appears
* [[Nano 7G]]
** hold down '''Power''' and '''Menu''' to do a hard reboot
** hold down '''Volume Up''', '''Volume Down''' and '''Power''' when the Apple logo appears
 
==USB IDs==
When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in:
{| class="wikitable"
|-
! colspan="2" | Model
! Normal/disk mode
! DFU mode
! WTF mode
|-
| colspan="2" | [[Nano 2G]]
| <code>1260</code>
| <code>1220</code>
| <code>1240</code>
|-
| colspan="2" | [[Nano 3G]]
| <code>1262</code>
| <code>1223</code>/<code>1224</code>
| <code>1242</code>
|-
| colspan="2" | [[Nano 4G]]
| <code>1263</code>
| <code>1225</code>
| <code>1243</code>
|-
| colspan="2" | [[Nano 5G]]
| <code>1265</code>
| <code>1231</code>
| <code>1246</code>
|-
| colspan="2" | [[Nano 6G]]
| <code>1266</code>
| <code>1232</code>
| <code>1248</code>
|-
| rowspan="2" | [[Nano 7G]]
| Initial
| rowspan="2" | <code>1267</code>
| rowspan="2" | <code>1234</code>
| <code>1249</code>
|-
| Rev A
| <code>124a</code>
|-
| rowspan="4" | [[Classic 6G]]
| [[Classic 6G#Initial|Initial]]
| rowspan="4" | <code>1261</code>
| rowspan="4" | <code>1223</code>
| <code>1241</code>
|-
| [[Classic 6G#Rev A|Rev A]]
| <code>1245</code>
|-
| [[Classic 6G#Rev B|Rev B]]
| <code>1247</code>
|-
| Rev C
| <code>1250</code>
|}

Main Page

2026-05-14T21:06:57Z

User890104: Convert homepage pictures to a gallery

__NOTOC__
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].

== FAQ ==

=== What can I do with my [[Nano 2G]], [[Classic 6G]] or older iPods? ===

There's an upstream Rockbox port for these devices. [https://www.rockbox.org/download/ Go use that].

=== What can I do with my [[Nano 3G]] or newer? ===

Not much (yet) unless you're an embedded developer :).

Here's the current progress, by iPod model:

[[Nano 3G]] and [[Nano 4G]]
* [[wInd3x]] allows untethered and safe code execution (no permanent modification).
* Rockbox bootloader has been published, but [https://isthererockboxonipodnano3g.freemyipod.org/ the Rockbox port is not yet completed].

[[Nano 5G]]
* [[wInd3x]] allows untethered and safe code execution (no permanent modification).
* There's a [[U-Boot]] port, and [[Linux|Linux]] boots with an initramfs.

[[Nano 6G]] and [[Nano 7G]]
* Tethered code execution using [[S5Late]] (a vulnerability in DFU_DNLOAD packet parsing code) (also for iPod shuffle (4th generation))
* Untethered code execution using [[ipod_sun]] (CVE-2010-1797)

[[Nano 7G]]
* There's a [[U-Boot]] port, and [[Linux|Linux]] boots with an initramfs.

There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.

== Gallery ==
<gallery>
File:Fastfetch_nano_7g_7.1-rc3.png|fastfetch on [[Nano 7G]]
File:Linux nano 7g 7.1-rc3.jpg|[[Linux]] 7.1.0-rc3 on [[Nano 7G]]
File:Albafetchdemo.png|albafetch on the [[Nano 2G]] running [[Linux]] 6.10
File:Photo 2025-12-27 20-36-24.jpg|[[Linux]] 6.14.0 on [[Nano 7G]]
File:EmCORE_Nano2G_Nano4G_Classic.jpg|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]
</gallery>

== Getting an account ==
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].

==Updates==
* {{#dateformat:2026-03-30}} - Some of us will be at [https://entropia.de/GPN24 GPN24] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].
* {{#dateformat:2025-12-26}} - Some of us will be at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!
* {{#dateformat:2025-06-12}} - Some of us will be at [https://entropia.de/GPN23 GPN23] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2024-12-25}} - Some of us will be at [https://events.ccc.de/congress/2024/infos/startpage.html 38C3] in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.
* {{#dateformat:2023-01-07}} - A preliminary [[U-Boot]] port to the [[Nano 5G]] [https://social.hackerspace.pl/@q3k/109655916469636189 has been developed].
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!
* {{#dateformat:2021-12-31}} - An exploit named [[wInd3x]], which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!

Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]

===Released Software===
* [[wInd3x]]
* [[ipod_sun]]
* [[U-Boot|U-Boot port]]
* [[Linux|Linux port]]
* Legacy:
** [[iBugger]]
** [[iLoader]]
** [[emCORE]]

|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
* [[Firmware downgrading]]
* [[Troubleshooting]]

===Reverse engineering results===
* [[Firmware]]
** [[Bootrom]]
** [[Boot Process]]
** [[Firmware decryption]]
** [[FTL|Flash Translation Layer]]
** [[RetailOS]]
*** [[RetailOS Options]]
* [[GUID table]]
* [[JTAG]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G HW analysis]]
** [[S5L8701 analysis]]
* Nano 4G
** [[Nano4G firmware upgrade process]]
* Nano 5G
** [[Nano 5G|General]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
** [[Nano 3G]]
** [[Nano 4G]]
*** [[920-0614-03]]
** [[Nano 5G]]
** [[Nano 6G]]
** [[Nano 7G]]
** [[Classic 6G]]
* [[Chronology]]
* [[S5L8700 datasheet]]
* [[Modes]]

===Exploiting===
* [[wInd3x]]
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|}

File:Linux nano 7g 7.1-rc3.jpg

2026-05-14T20:30:17Z

User890104:

File:Fastfetch nano 7g 7.1-rc3.png

2026-05-14T20:21:53Z

User890104:

Main Page

2026-05-10T14:12:31Z

User890104: update faq/progress

__NOTOC__
[[File:Sysfetch on iPod Nano 2G.jpg|thumb|right|sysfetch on the [[Nano 2G]] running [[Linux]] 6.10]]
[[File:Photo 2025-12-27 20-36-24.jpg|280px|thumb|right|[[Linux]] 6.14.0 on [[Nano 7G]]]]
[[File:EmCORE_Nano2G_Nano4G_Classic.jpg|280px|thumb|right|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]]]
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].

== FAQ ==

=== What can I do with my [[Nano 2G]], [[Classic 6G]] or older iPods? ===

There's an upstream Rockbox port for these devices. [https://www.rockbox.org/download/ Go use that].

=== What can I do with my [[Nano 3G]] or newer? ===

Not much (yet) unless you're an embedded developer :).

Here's the current progress, by iPod model:

[[Nano 3G]] and [[Nano 4G]]
* [[wInd3x]] allows untethered and safe code execution (no permanent modification).
* Rockbox bootloader has been published, but [https://isthererockboxonipodnano3g.freemyipod.org/ the Rockbox port is not yet completed].

[[Nano 5G]]
* [[wInd3x]] allows untethered and safe code execution (no permanent modification).
* There's a [[U-Boot]] port, and [[Linux|Linux]] boots with an initramfs.

[[Nano 6G]] and [[Nano 7G]]
* Tethered code execution using [[S5Late]] (a vulnerability in DFU_DNLOAD packet parsing code) (also for iPod shuffle (4th generation))
* Untethered code execution using [[ipod_sun]] (CVE-2010-1797)

[[Nano 7G]]
* There's a [[U-Boot]] port, and [[Linux|Linux]] boots with an initramfs.

There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.

== Getting an account ==
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].

==Updates==
* {{#dateformat:2026-03-30}} - Some of us will be at [https://entropia.de/GPN24 GPN24] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].
* {{#dateformat:2025-12-26}} - Some of us will be at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!
* {{#dateformat:2025-06-12}} - Some of us will be at [https://entropia.de/GPN23 GPN23] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2024-12-25}} - Some of us will be at [https://events.ccc.de/congress/2024/infos/startpage.html 38C3] in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.
* {{#dateformat:2023-01-07}} - A preliminary [[U-Boot]] port to the [[Nano 5G]] [https://social.hackerspace.pl/@q3k/109655916469636189 has been developed].
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!
* {{#dateformat:2021-12-31}} - An exploit named [[wInd3x]], which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!

Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]

===Released Software===
* [[wInd3x]]
* [[ipod_sun]]
* [[U-Boot|U-Boot port]]
* [[Linux|Linux port]]
* Legacy:
** [[iBugger]]
** [[iLoader]]
** [[emCORE]]

|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
* [[Firmware downgrading]]
* [[Troubleshooting]]

===Reverse engineering results===
* [[Firmware]]
** [[Bootrom]]
** [[Boot Process]]
** [[Firmware decryption]]
** [[FTL|Flash Translation Layer]]
** [[RetailOS]]
*** [[RetailOS Options]]
* [[GUID table]]
* [[JTAG]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G HW analysis]]
** [[S5L8701 analysis]]
* Nano 4G
** [[Nano4G firmware upgrade process]]
* Nano 5G
** [[Nano 5G|General]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
** [[Nano 3G]]
** [[Nano 4G]]
*** [[920-0614-03]]
** [[Nano 5G]]
** [[Nano 6G]]
** [[Nano 7G]]
** [[Classic 6G]]
* [[Chronology]]
* [[S5L8700 datasheet]]
* [[Modes]]

===Exploiting===
* [[wInd3x]]
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|}

Notes vulnerability

2026-05-10T13:53:03Z

User890104:

=== Basics ===

The notes functionality is basically a HTML browser included in the iPod.
Some documentation about it can be found in Apple's [https://files.freemyipod.org/misc/iPodNotesFeatureGuideCB.pdf iPod Notes Feature Guide].

Basic rules are:
* 64kB files are loaded just after the boot of the iPod, however they are not kept in RAM
* each file is limited to 4kB
* the links point to other files, notes, or media files.
* the link is limited to 256 chars. Apple documents this limit, but they don't say it can cause a buffer overflow ;)

There are many buffers scattered throughout the RAM:
# Some are perfect copies of the disc file, including BOM, etc... These are the ideal buffers to jump to.
# Some have UTF16 processing. These are a burden but can be worked around.
# Some have UTF8 processing. These are virtually unusable.

The main disadvantage to this vulnerability is that small buffers must be located in megabytes of RAM. The [[Pwnage 2.0]] vulnerability is now preferred since it does not have this disadvantage.

=== Dealing with UTF-16 ===

If jumping to a UTF16-processed buffer, the possible character sequences are limited.
The best thing to have the most charset possibilities is to encode the exploit directly to [https://unicode.org/faq/utf_bom#utf16-1 UTF16].

The forbidden values in UTF16 are:
* FE FF: UTF16 BOM
* D8 00 up to DF FF: not checked what happens if inserting them
* 00 00: would stop string processing

The payload is placed in the body of the .htm file.

=== Link overflow ===

After loading the file, the links are then checked against the file system.
Many modified copies of this string are present on the stack.
We could identify the most important steps of this process, until the string overflow in the stack (order could be a little different):

*Fist, the link is extracted from the file, and copied to some heap or fixed buffers
*The link is converted to UTF8. Every char >7F is encoded in many bytes
*Then it is passed through an uppercase function
*The URL encoding is decoded : %xx values are converted to their equivalent (limited to valid UTF8 or the like)
*Finally, this link is copied in a limited buffer which is located on the stack. By putting a return adress repetitively in the link, the processor will jump to this adress.

For conveninece, the return adress is always encoded using %xx URL encodings. This avoids problems with some special chars and with lowercase chars. Possible values are 00 < xx <= 7F. (the unescaped chars seem to be transcoded from ISO-8859-1 to UTF8 again)

== Exploiting, getting execution ==

(Credit for the exploit goes to [[Sto]])

To exploit, we used [[Nano2G_HW_analysis#JTAG|JTAG]] to determine the correct paddings and return adresses of the buffers.

In my case, I had to place a second file to influence the buffer's location in order to have a return adress which conforms to UTF8 (no byte of the return address can be >7F).

An example of a working overflow file is [https://files.freemyipod.org/releases/20120101/installer-ipodnano2g-r855-20120101.bootnote here]. The source code is [https://github.com/freemyipod/freemyipod/tree/master/noteboot at GitHub, named noteboot]. It installs [[emCORE]] if executed on [[Nano 2G]].

The original exploit file begins with a UTF16 BOM, then "AA" as padding, then the overflowing link (the return address is 0x08640D60), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"

This "while(1);" does not freeze or reset the iPod, but instead just crashes the background task since interrupts are still enabled. You can still scroll the menus, but the ipod will freeze as soon as you press "play" or if you enter the notes menu, etc...

The processor arrives at the notes payload in supervisor state, with interrupts activated (menu scrolling) and so on.
Caches are also activated. Disabling them is recommended if you are performing complex IO & DMA stuff because they can interfere.

== Dumping memories ==

For dumping the iPod's memories, first the cache was used (JTAG dumps), but it turned out that the UART is more flexible.
The dumps can't be published here, due to copyright issues.

== UART ==

The UART is exactly the same as described in the datasheet (if one did indeed exist).

See [https://web.archive.org/web/20100924130558/http://pargon.nl/?p=6 this guide] for building a UART cable for the iPod dock connector.

My complete setup is a little bit more complex: [[Image:Nanofighter.jpg|100px|thumb]]
* left board: DLC5 JTAG interface, modified for reset and USB switching
* right board: some programmer board, only the ST232 is used
* upper board: this was the JTAG scanner, now only the power supply and 5V regulator are used
* middle board: all the switching stuff

To automatically enter DFU mode, I wired transistors to the USB 5V line, and to the "play" and "enter" buttons of the clickwheel.

== USB ==
USB was eventually figured out so we no longer needed the UART cables.

Notes vulnerability

2026-05-10T13:52:00Z

User890104: fix broken links

=== Basics ===

The notes functionality is basically a HTML browser included in the iPod.
Some documentation about it can be found in Apple's [https://files.freemyipod.org/misc/iPodNotesFeatureGuideCB.pdf iPod Notes Feature Guide].

Basic rules are:
* 64kB files are loaded just after the boot of the iPod, however they are not kept in RAM
* each file is limited to 4kB
* the links point to other files, notes, or media files.
* the link is limited to 256 chars. Apple documents this limit, but they don't say it can cause a buffer overflow ;)

There are many buffers scattered throughout the RAM:
# Some are perfect copies of the disc file, including BOM, etc... These are the ideal buffers to jump to.
# Some have UTF16 processing. These are a burden but can be worked around.
# Some have UTF8 processing. These are virtually unusable.

The main disadvantage to this vulnerability is that small buffers must be located in megabytes of RAM. The [[Pwnage 2.0]] vulnerability is now preferred since it does not have this disadvantage.

=== Dealing with UTF-16 ===

If jumping to a UTF16-processed buffer, the possible character sequences are limited.
The best thing to have the most charset possibilities is to encode the exploit directly to [https://unicode.org/faq/utf_bom#utf16-1 UTF16].

The forbidden values in UTF16 are:
* FE FF: UTF16 BOM
* D8 00 up to DF FF: not checked what happens if inserting them
* 00 00: would stop string processing

The payload is placed in the body of the .htm file.

=== Link overflow ===

After loading the file, the links are then checked against the file system.
Many modified copies of this string are present on the stack.
We could identify the most important steps of this process, until the string overflow in the stack (order could be a little different):

*Fist, the link is extracted from the file, and copied to some heap or fixed buffers
*The link is converted to UTF8. Every char >7F is encoded in many bytes
*Then it is passed through an uppercase function
*The URL encoding is decoded : %xx values are converted to their equivalent (limited to valid UTF8 or the like)
*Finally, this link is copied in a limited buffer which is located on the stack. By putting a return adress repetitively in the link, the processor will jump to this adress.

For conveninece, the return adress is always encoded using %xx URL encodings. This avoids problems with some special chars and with lowercase chars. Possible values are 00 < xx <= 7F. (the unescaped chars seem to be transcoded from ISO-8859-1 to UTF8 again)

== Exploiting, getting execution ==

(Credit for the exploit goes to [[Sto]])

To exploit, we used [[Nano2G_HW_analysis#JTAG|JTAG]] to determine the correct paddings and return adresses of the buffers.

In my case, I had to place a second file to influence the buffer's location in order to have a return adress which conforms to UTF8 (no byte of the return address can be >7F).

An example of a working overflow file is [https://files.freemyipod.org/releases/20120101/installer-ipodnano2g-r855-20120101.bootnote here]. The source code is [https://github.com/freemyipod/freemyipod/tree/master/noteboot at GitHub, named noteboot]. It install emCORE if executed on [[Nano 2G]].

The original exploit file begins with a UTF16 BOM, then "AA" as padding, then the overflowing link (the return address is 0x08640D60), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"

This "while(1);" does not freeze or reset the iPod, but instead just crashes the background task since interrupts are still enabled. You can still scroll the menus, but the ipod will freeze as soon as you press "play" or if you enter the notes menu, etc...

The processor arrives at the notes payload in supervisor state, with interrupts activated (menu scrolling) and so on.
Caches are also activated. Disabling them is recommended if you are performing complex IO & DMA stuff because they can interfere.

== Dumping memories ==

For dumping the iPod's memories, first the cache was used (JTAG dumps), but it turned out that the UART is more flexible.
The dumps can't be published here, due to copyright issues.

== UART ==

The UART is exactly the same as described in the datasheet (if one did indeed exist).

See [https://web.archive.org/web/20100924130558/http://pargon.nl/?p=6 this guide] for building a UART cable for the iPod dock connector.

My complete setup is a little bit more complex: [[Image:Nanofighter.jpg|100px|thumb]]
* left board: DLC5 JTAG interface, modified for reset and USB switching
* right board: some programmer board, only the ST232 is used
* upper board: this was the JTAG scanner, now only the power supply and 5V regulator are used
* middle board: all the switching stuff

To automatically enter DFU mode, I wired transistors to the USB 5V line, and to the "play" and "enter" buttons of the clickwheel.

== USB ==
USB was eventually figured out so we no longer needed the UART cables.

Contributing

2026-05-10T13:33:41Z

User890104: fix link

The first question people generally ask about this project is, "How can I help out?". Here are some ways someone can be useful to the project:

==Developing==
This is perhaps the most valuable way one can help the project. We get many people who want to help with development but they don't have the necessary skills. If you don't, think of it as an opportunity to learn new and worthwhile skills instead of a roadblock. After all, the best way to learn is in the field doing real work. Here are some topics that developers need to know about:
*'''ARM assembly''' - this is probably the hardest topic for beginners to grasp. Resources:
**[https://documentation-service.arm.com/static/6813592879c4c17ad8038691 ARM's guide (PDF)]
**[http://simplemachines.it/doc/arm_inst.pdf an ARM primer]
**[http://simplemachines.it/doc/QRC0001H_rvct_v2.1_arm.pdf ARM Quick Ref]
**[http://www.lysator.liu.se/~kjell-e/embedded/ARM-ARM.pdf ARM ARM]
**http://simplemachines.it has great resources for learning ARM
*'''Rust''' and '''C''' - Used whenever we can avoid using ARM assembly.
*'''Go''' and '''Python''' - Used to implement host-side software like wInd3x and bits of EMcore/Rockbox/...

==Vulnerabilities==
If you've ever found a way to get your iPod to crash by corrupting things or inputting weird things, we could use the info to see if the bug is a vulnerability. Some examples of bugs like this are the [[Notes vulnerability]] and the [[Pwnage 2.0]] vulnerability. [[OSOS]] bugs in any releases are also appreciated, as they might allow to potentially untether [[wInd3x]].

If you find any bug, report it via IRC.

==Development==

We need an open-source reimplementation of the [[Nano2G FTL|Samsung Whimory FTL]] used in S5L-based iPods. This will allow us to access the FAT/HFS partition on NAND from any open source software. The FTL is a complex piece of software, and it needs a high-quality, clean-room implementation for reliable read/write access.

==Writing guides==
Another way to help out is writing guides like these on the Wiki. Make it easier for new users to get information.

==Testing==
Testers are always good to have, and its also a good way to help out if you don't want to spend much time on the project or don't know much about development. Developers, however, will get tired of working with you if you are clueless about how everything works, so make sure you have a good understanding about the tools you're testing.

Chronology

2026-05-10T13:31:08Z

User890104: fix ipod classic model names

This page list all models of iPods and set the naming of it. So that, on this wiki, the Discord, or on IRC nobody can be confused with what we are speaking about. Please also refer to Apple's [https://support.apple.com/en-us/103823 Identifying iPod Models] page and The Apple Wiki's [https://theapplewiki.com/wiki/List_of_iPods List of iPods] and [https://theapplewiki.com/wiki/List_of_iPod_nanos List of iPod nanos]. There is also alot of information on [https://en.wikipedia.org/wiki/IPod Wikipedia's iPod page].

==iPod Series==

{| class="wikitable"
! Model !! Introduced !! Capacity !! Notes
|-
| [https://support.apple.com/en-us/103823#:~:text=generation%20iPod%20models.-,iPod%20(Scroll%20Wheel),-Navigation%3A%20Scroll%20Wheel 1G (Scroll Wheel)]
| 2001-10
| 5 GB or 10 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=generation%20iPod%20models.-,iPod%20(Touch%20Wheel),-Navigation%3A%20Touch%20Wheel 2G (Touch Wheel)]
| 2002-07
| 10 GB or 20 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=fourth%2Dgeneration%20iPod.-,iPod%20(Dock%20Connector),-Navigation%3A%20Touch%20Wheel 3G (Dock Connector)]
| 2003-04
| 10 GB, 15 GB, 20 GB, 30 GB, or 40 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=see%20above%20photo).-,iPod%20(Click%20Wheel),-Navigation%3A%20Click%20Wheel 4G (Click Wheel)]
| 2004-07
| 20 GB or 40 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=iPod%20photo%20(also%20known%20as%20iPod%20with%20color%20display) 4G (Photo/Color)]
| 2004-10
| 20 GB, 30 GB, 40 GB or 60 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=iPod%20(5th%20generation)%E2%80%94also%20known%20as%20iPod%20with%20video%20or%20Fifth%20Generation%20iPod 5G (Video)]
| 2005-10
| 30 GB or 60 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=iPod%20(5th%20generation%20Late%202006)%E2%80%94also%20known%20as%20iPod%20with%20video%20or%20Fifth%20Generation%20iPod 5.5G (Video, Late 2006)]
| 2006-09
| 30 GB or 80 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=stainless%20steel%20enclosure.-,iPod%20classic,-Navigation%3A%20Click%20Wheel 6G (Classic 1G)]
| 2007-09
| 80 GB or 160 GB
| Encryption starts
|-
| [https://support.apple.com/en-us/103823#:~:text=stainless%20steel%20enclosure.-,iPod%20classic%20(120%20GB),-Navigation%3A%20Click%20Wheel 6G (Classic 2G)]
| 2008-09
| 120 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=the%20wheel%20itself-,iPod%20classic%20160%20GB%20(Late%202009),-Navigation%3A%20Click%20Wheel 6G (Classic 3G, Late 2009)]
| 2009-09
| 160 GB
|
|}

==iPod Nano Series==

{| class="wikitable"
! Model !! Introduced !! Capacity !! Notes
|-
| [https://support.apple.com/en-us/103823#:~:text=AIDS%20in%20Africa.-,iPod%20nano,-Navigation%3A%20Click%20Wheel Nano 1G]
| 2005-09
| 1 GB, 2 GB, or 4 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=in%20five%20colors.-,iPod%20nano%20(2nd%20generation),-Navigation%3A%20Click%20Wheel Nano 2G]
| 2006-09
| 2 GB, 4 GB, or 8 GB
| Encryption starts
|-
| [https://support.apple.com/en-us/103823#:~:text=in%20nine%20colors.-,iPod%20nano%20(3rd%20generation),-Navigation%3A%20Click%20Wheel Nano 3G]
| 2007-09
| 4 GB or 8 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=in%20nine%20colors.-,iPod%20nano%20(4th%20generation),-Navigation%3A%20Click%20Wheel Nano 4G]
| 2008-09
| 8 GB or 16 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=AIDS%20in%20Africa.-,iPod%20nano%20(5th%20generation),-Navigation%3A%20Click%20Wheel Nano 5G]
| 2009-09
| 8 GB or 16 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=in%20eight%20colors.-,iPod%20nano%20(6th%20generation),-Navigation%3A%20Multi%2DTouch Nano 6G]
| 2010-09
| 8 GB or 16 GB
| Multi-Touch display
|-
| [https://support.apple.com/en-us/103823#:~:text=PRODUCT)RED%20version.-,iPod%20nano%20(7th%20generation),-Navigation%3A%20Multi%2DTouch Nano 7G]
| 2012-10
| 16 GB
| Newest retailOS 1.0.4
|-
| [https://support.apple.com/en-us/103823#:~:text=on%20iPod%20touch.-,iPod%20nano%20(7th%20generation%20Mid%202015),-Navigation%3A%20Multi%2DTouch Nano 7G (Mid 2015)]
| 2015-06
| 16 GB
| Newest retailOS 1.1.2
|}

==Timeline==
[[File:TimeLineofIPod.png|800px|The timeline of iPod releases (from Wikipedia)]]

==The Motive==
Understanding the mindset and motives behind Apple is key to understanding how and why the iPod was encrypted. While many people believe that the iPod was encrypted to put an end to iPodLinux and Rockbox, the main reason for the encryption was to thwart third-party imitators. Apple was not as concerned with iPodLinux and Rockbox because people were still buying their (overpriced) hardware, and therefore still generating profits. The main reason was because there were many imitations that replicated the hardware and ran the exact firmware that was run on normal iPods. This was a major drain of money for Apple. Another reason was that the DRM mechanism in the unencrypted firmware was being hacked. This allowed pirated content like games to be run without being bought.
==The Response==
Since Apple was losing money from the iPod imitators, they encrypted the firmware so the iPod clones could no longer use Apple firmware on their devices. There are still iPod clones out there (just search eBay), but very few use the Apple firmware anymore. Apple has encrypted all of their portable devices since the iPod Nano 2G.
==The Change==
In order to stop the fake iPods from using their firmware, Apple encrypted the firmware so only their devices could decrypt it. Apple changed their processor to Samsung and no longer used PortalPlayer.
==Helpful Pages==
https://support.apple.com/en-us/103823

Chronology

2026-05-10T13:29:52Z

User890104: fix links to apple's page

This page list all models of iPods and set the naming of it. So that, on this wiki, the Discord, or on IRC nobody can be confused with what we are speaking about. Please also refer to Apple's [https://support.apple.com/en-us/103823 Identifying iPod Models] page and The Apple Wiki's [https://theapplewiki.com/wiki/List_of_iPods List of iPods] and [https://theapplewiki.com/wiki/List_of_iPod_nanos List of iPod nanos]. There is also alot of information on [https://en.wikipedia.org/wiki/IPod Wikipedia's iPod page].

==iPod Series==

{| class="wikitable"
! Model !! Introduced !! Capacity !! Notes
|-
| [https://support.apple.com/en-us/103823#:~:text=generation%20iPod%20models.-,iPod%20(Scroll%20Wheel),-Navigation%3A%20Scroll%20Wheel 1G (Scroll Wheel)]
| 2001-10
| 5 GB or 10 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=generation%20iPod%20models.-,iPod%20(Touch%20Wheel),-Navigation%3A%20Touch%20Wheel 2G (Touch Wheel)]
| 2002-07
| 10 GB or 20 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=fourth%2Dgeneration%20iPod.-,iPod%20(Dock%20Connector),-Navigation%3A%20Touch%20Wheel 3G (Dock Connector)]
| 2003-04
| 10 GB, 15 GB, 20 GB, 30 GB, or 40 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=see%20above%20photo).-,iPod%20(Click%20Wheel),-Navigation%3A%20Click%20Wheel 4G (Click Wheel)]
| 2004-07
| 20 GB or 40 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=iPod%20photo%20(also%20known%20as%20iPod%20with%20color%20display) 4G (Photo/Color)]
| 2004-10
| 20 GB, 30 GB, 40 GB or 60 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=iPod%20(5th%20generation)%E2%80%94also%20known%20as%20iPod%20with%20video%20or%20Fifth%20Generation%20iPod 5G (Video)]
| 2005-10
| 30 GB or 60 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=iPod%20(5th%20generation%20Late%202006)%E2%80%94also%20known%20as%20iPod%20with%20video%20or%20Fifth%20Generation%20iPod 5.5G (Video, Late 2006)]
| 2006-09
| 30 GB or 80 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=stainless%20steel%20enclosure.-,iPod%20classic,-Navigation%3A%20Click%20Wheel (6G) Classic 1G]
| 2007-09
| 80 GB or 160 GB
| Encryption starts
|-
| [https://support.apple.com/en-us/103823#:~:text=stainless%20steel%20enclosure.-,iPod%20classic%20(120%20GB),-Navigation%3A%20Click%20Wheel (6G) Classic 2G]
| 2008-09
| 120 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=the%20wheel%20itself-,iPod%20classic%20160%20GB%20(Late%202009),-Navigation%3A%20Click%20Wheel (6G) Classic 3G (Late 2009)]
| 2009-09
| 160 GB
|
|}

==iPod Nano Series==

{| class="wikitable"
! Model !! Introduced !! Capacity !! Notes
|-
| [https://support.apple.com/en-us/103823#:~:text=AIDS%20in%20Africa.-,iPod%20nano,-Navigation%3A%20Click%20Wheel Nano 1G]
| 2005-09
| 1 GB, 2 GB, or 4 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=in%20five%20colors.-,iPod%20nano%20(2nd%20generation),-Navigation%3A%20Click%20Wheel Nano 2G]
| 2006-09
| 2 GB, 4 GB, or 8 GB
| Encryption starts
|-
| [https://support.apple.com/en-us/103823#:~:text=in%20nine%20colors.-,iPod%20nano%20(3rd%20generation),-Navigation%3A%20Click%20Wheel Nano 3G]
| 2007-09
| 4 GB or 8 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=in%20nine%20colors.-,iPod%20nano%20(4th%20generation),-Navigation%3A%20Click%20Wheel Nano 4G]
| 2008-09
| 8 GB or 16 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=AIDS%20in%20Africa.-,iPod%20nano%20(5th%20generation),-Navigation%3A%20Click%20Wheel Nano 5G]
| 2009-09
| 8 GB or 16 GB
|
|-
| [https://support.apple.com/en-us/103823#:~:text=in%20eight%20colors.-,iPod%20nano%20(6th%20generation),-Navigation%3A%20Multi%2DTouch Nano 6G]
| 2010-09
| 8 GB or 16 GB
| Multi-Touch display
|-
| [https://support.apple.com/en-us/103823#:~:text=PRODUCT)RED%20version.-,iPod%20nano%20(7th%20generation),-Navigation%3A%20Multi%2DTouch Nano 7G]
| 2012-10
| 16 GB
| Newest retailOS 1.0.4
|-
| [https://support.apple.com/en-us/103823#:~:text=on%20iPod%20touch.-,iPod%20nano%20(7th%20generation%20Mid%202015),-Navigation%3A%20Multi%2DTouch Nano 7G (Mid 2015)]
| 2015-06
| 16 GB
| Newest retailOS 1.1.2
|}

==Timeline==
[[File:TimeLineofIPod.png|800px|The timeline of iPod releases (from Wikipedia)]]

==The Motive==
Understanding the mindset and motives behind Apple is key to understanding how and why the iPod was encrypted. While many people believe that the iPod was encrypted to put an end to iPodLinux and Rockbox, the main reason for the encryption was to thwart third-party imitators. Apple was not as concerned with iPodLinux and Rockbox because people were still buying their (overpriced) hardware, and therefore still generating profits. The main reason was because there were many imitations that replicated the hardware and ran the exact firmware that was run on normal iPods. This was a major drain of money for Apple. Another reason was that the DRM mechanism in the unencrypted firmware was being hacked. This allowed pirated content like games to be run without being bought.
==The Response==
Since Apple was losing money from the iPod imitators, they encrypted the firmware so the iPod clones could no longer use Apple firmware on their devices. There are still iPod clones out there (just search eBay), but very few use the Apple firmware anymore. Apple has encrypted all of their portable devices since the iPod Nano 2G.
==The Change==
In order to stop the fake iPods from using their firmware, Apple encrypted the firmware so only their devices could decrypt it. Apple changed their processor to Samsung and no longer used PortalPlayer.
==Helpful Pages==
https://support.apple.com/en-us/103823

Notes vulnerability

2026-05-10T13:14:15Z

User890104: Reverted edits by ZeOne (talk) to last revision by Farthen

=== Basics ===

The notes functionality is basically a HTML browser included in the iPod.
Some documentation about it can be found [http://developer.apple.com/ipod/iPodNotesFeatureGuideCB.pdf here].

Basic rules are:
* 64kB files are loaded just after the boot of the iPod, however they are not kept in RAM
* each file is limited to 4kB
* the links point to other files, notes, or media files.
* the link is limited to 256 chars. Apple documents this limit, but they don't say it can cause a buffer overflow ;)

There are many buffers scattered throughout the RAM:
# Some are perfect copies of the disc file, including BOM, etc... These are the ideal buffers to jump to.
# Some have UTF16 processing. These are a burden but can be worked around.
# Some have UTF8 processing. These are virtually unusable.

The main disadvantage to this vulnerability is that small buffers must be located in megabytes of RAM. The [[Pwnage 2.0]] vulnerability is now preferred since it does not have this disadvantage.

=== Dealing with UTF-16 ===

If jumping to a UTF16-processed buffer, the possible character sequences are limited.
The best thing to have the most charset possibilities is to encode the exploit directly to [http://unicode.org/faq/utf_bom.html#utf16-2 UTF16].

The forbidden values in UTF16 are:
* FE FF: UTF16 BOM
* D8 00 up to DF FF: not checked what happens if inserting them
* 00 00: would stop string processing

The payload is placed in the body of the .htm file.

=== Link overflow ===

After loading the file, the links are then checked against the file system.
Many modified copies of this string are present on the stack.
We could identify the most important steps of this process, until the string overflow in the stack (order could be a little different):

*Fist, the link is extracted from the file, and copied to some heap or fixed buffers
*The link is converted to UTF8. Every char >7F is encoded in many bytes
*Then it is passed through an uppercase function
*The URL encoding is decoded : %xx values are converted to their equivalent (limited to valid UTF8 or the like)
*Finally, this link is copied in a limited buffer which is located on the stack. By putting a return adress repetitively in the link, the processor will jump to this adress.

For conveninece, the return adress is always encoded using %xx URL encodings. This avoids problems with some special chars and with lowercase chars. Possible values are 00 < xx <= 7F. (the unescaped chars seem to be transcoded from ISO-8859-1 to UTF8 again)

== Exploiting, getting execution ==

(Credit for the exploit goes to [[Sto]])

To exploit, we used [[Nano2G%2BHW%2Banalysis|JTAG]] to determine the correct paddings and return adresses of the buffers.

In my case, I had to place a second file to influence the buffer's location in order to have a return adress which conforms to UTF8 (no byte of the return address can be >7F).

An example of a working overflow file set is [http://f4eru.free.fr/8701/Notes_overflow_example.zip here].
The file "Brokenlink.htm" begins with a UTF16 BOM, then "AA" as padding, then the overflowing link (the return address is 0x08640D60), then a NOP (opcode E1A01001) landing zone, and finally a "while(1);"

This "while(1);" does not freeze or reset the iPod, but instead just crashes the background task since interrupts are still enabled. You can still scroll the menus, but the ipod will freeze as soon as you press "play" or if you enter the notes menu, etc...

The processor arrives at the notes payload in supervisor state, with interrupts activated (menu scrolling) and so on.
Caches are also activated. Disabling them is recommended if you are performing complex IO & DMA stuff because they can interfere.

== Dumping memories ==

For dumping the iPod's memories, first the cache was used (JTAG dumps), but it turned out that the UART is more flexible.
The dumps can't be published here, due to copyright issues.

== UART ==

The UART is exactly the same as described in the datasheet (if one did indeed exist).

See [http://pargon.nl/?p=6 this guide] for building a UART cable for the iPod dock connector.

My complete setup is a little bit more complex: [[Image:Nanofighter.jpg|100px|thumb]]
* left board: DLC5 JTAG interface, modified for reset and USB switching
* right board: some programmer board, only the ST232 is used
* upper board: this was the JTAG scanner, now only the power supply and 5V regulator are used
* middle board: all the switching stuff

To automatically enter DFU mode, I wired transistors to the USB 5V line, and to the "play" and "enter" buttons of the clickwheel.

== USB ==
USB was eventually figured out so we no longer needed the UART cables.

2026-04-07T14:04:59Z

User890104:

Sorry, your device is not currently supported by [[emCORE]].

Porting [[emCORE]] to a new device is generally a lot of work and requires lots of experience with embedded system development.

The exact amount of work needed varies greatly and depends on the complexity of the device and similarities to devices that [[emCORE]] has already been ported to.

An exploit has been found [[S5Late]] and a modified version made to work with the [[Nano 6G]] exists. (find it here [https://github.com/NyanSatan/S5Late-8723 S5Late-8723]) there is some work in progress to getting it to work with wInd3x and getting alpine linux booted on it (not emCORE for now).