freemyipod - User contributions [en]

Modes

2026-07-31T15:44:39Z

User890104: /* Diagnostic mode */

At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting.

==Normal mode==
"Normal mode" is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.

==Disk mode==
In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text "Do not disconnect." or a checkmark symbol with the text "OK to disconnect." depending on whether the iPod is connected and if it has been ejected.

Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]

Disk mode is also referred to as "forced disk mode" in device information received from the iPod.

The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the "disk" partition of the [[Firmware]].

=== How to access it===
* Clickwheel iPods (except for the very first models):
** hold down '''Menu''' and '''Center''' to do a hard reboot
** hold down '''Center''' and '''Play/Pause''' when the Apple logo appears
* [[Nano 6G]]
** hold down '''Sleep/Wake''' and '''Volume Down''' to do a hard reboot
** hold down '''Volume Up''' when the Apple logo appears
* [[Nano 7G]]
** hold down '''Sleep/Wake''' and '''Menu''' to do a hard reboot
** hold down '''Volume Up''' and '''Volume Down''' when the Apple logo appears

<gallery>
File:Nano2g-diskmode-1.jpg|[[Nano 2G]] Do not disconnect
File:Nano2g-diskmode-2.jpg|[[Nano 2G]] OK to disconnect
File:Nano3g-diskmode-1.jpg|[[Nano 3G]] Do not disconnect
File:Nano3g-diskmode-2.jpg|[[Nano 3G]] OK to disconnect
File:Nano4g-diskmode-1.jpg|[[Nano 4G]] Do not disconnect
File:Nano4g-diskmode-2.jpg|[[Nano 4G]] OK to disconnect
File:Nano5g-diskmode-1.jpg|[[Nano 5G]] Do not disconnect
File:Nano5g-diskmode-2.jpg|[[Nano 5G]] OK to disconnect
File:Nano6g-diskmode-1.jpg|[[Nano 6G]] Do not disconnect
File:Nano6g-diskmode-2.jpg|[[Nano 6G]] OK to disconnect
File:Nano7g-diskmode-1.jpg|[[Nano 7G]] Do not disconnect
File:Nano7g-diskmode-2.jpg|[[Nano 7G]] OK to disconnect
</gallery>

==DFU mode==
[https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the [[Nano 3G]] and newer and the [[Classic 6G]] and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].

When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other IMG1 images cannot be sent in this mode.

The [[Nano 2G]] also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does, however, support a NOR DFU mode that can be entered by holding down '''Rewind''' and '''Play/Pause''' right after rebooting the device<ref>https://www.rockbox.org/irc/log-20080904#13:31:44</ref>.

=== How to access it===
# Connect the iPod to a computer using a USB cable
# Check which key combo you need to hold down depending on the iPod's model
# Keep holding down the same buttons until the Apple logo appears, keep holding until the screen goes black, wait about 1 second and release the buttons.

* [[Nano_3G]], [[Nano_4G]], [[Nano_5G]] and [[Classic_1G]]: '''Menu''' and '''Center'''
* [[Nano 6G]]: '''Sleep/Wake''' and '''Volume Down'''
* [[Nano 7G]]: '''Sleep/Wake''' and '''Menu'''

Note: On [[Nano 7G]] use a USB-A to Lightning cable. You cannot enter DFU mode using a USB-C to Lightning cable.

==WTF mode==
In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.

The iTunes behavior upon seeing an iPod in WTF mode is to send it a "recovery" firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the "osos" partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].

==Diagnostic mode==
This mode will give quite a lot of info about your iPod. In diagnostics mode you can find info about the battery power check the LCD, button inputs, radio signals, DRAM, NAND, Accelerometer, dock information and an about section. On touchscreen iPods there is also a section for touchscreen testing.
=== How to access it===
* Clickwheel iPods (except for the very first models):
** hold down '''Menu''' and '''Center''' to do a hard reboot
** hold down '''Center''' and '''Rewind''' when the Apple logo appears
* [[Nano 6G]]
** hold down '''Sleep/Wake''' and '''Volume Down''' to do a hard reboot
** hold down '''Volume Up''', '''Volume Down''' and '''Sleep/Wake''' when the Apple logo appears
* [[Nano 7G]]
** hold down '''Sleep/Wake''' and '''Menu''' to do a hard reboot
** hold down '''Volume Up''', '''Volume Down''' and '''Sleep/Wake''' when the Apple logo appears

<gallery>
File:Nano2g-diagmode.jpg|[[Nano 2G]]
File:Nano3g-diagmode.jpg|[[Nano 3G]]
File:Nano4g-diagmode.jpg|[[Nano 4G]]
File:Nano5g-diagmode.jpg|[[Nano 5G]]
File:Nano6g-diagmode.jpg|[[Nano 6G]]
File:Nano7g-diagmode.jpg|[[Nano 7G]]
</gallery>

==USB IDs==
When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in:
{| class="wikitable"
|-
! colspan="2" | Model
! Normal/disk mode
! DFU mode
! WTF mode
|-
| colspan="2" | [[Nano 2G]]
| <code>1260</code>
| <code>1220</code>
| <code>1240</code>
|-
| colspan="2" | [[Nano 3G]]
| <code>1262</code>
| <code>1223</code>/<code>1224</code>
| <code>1242</code>
|-
| colspan="2" | [[Nano 4G]]
| <code>1263</code>
| <code>1225</code>
| <code>1243</code>
|-
| colspan="2" | [[Nano 5G]]
| <code>1265</code>
| <code>1231</code>
| <code>1246</code>
|-
| colspan="2" | [[Nano 6G]]
| <code>1266</code>
| <code>1232</code>
| <code>1248</code>
|-
| rowspan="2" | [[Nano 7G]]
| Initial
| rowspan="2" | <code>1267</code>
| rowspan="2" | <code>1234</code>
| <code>1249</code>
|-
| Rev A
| <code>124a</code>
|-
| rowspan="4" | [[Classic 6G]]
| [[Classic 6G#Initial|Initial]]
| rowspan="4" | <code>1261</code>
| rowspan="4" | <code>1223</code>
| <code>1241</code>
|-
| [[Classic 6G#Rev A|Rev A]]
| <code>1245</code>
|-
| [[Classic 6G#Rev B|Rev B]]
| <code>1247</code>
|-
| Rev C
| <code>1250</code>
|}

Modes

2026-07-31T15:42:58Z

User890104: /* Disk mode */

At any given time an iPod can be in one of several modes, some of which can be activated by holding down certain buttons while the iPod is booting.

==Normal mode==
"Normal mode" is when the iPod is booted into [[RetailOS]] normally. In this mode the iPod presents as a mass storage device to a computer, allowing files to be transferred. Receiving device information from the iPod, as well as updating the iPod's [[Firmware]], can be done from normal mode through the use of proprietary SCSI commands.

==Disk mode==
In disk mode, like normal mode, the iPod presents as a mass storage device to a computer and can have its information read and firmware updated. When in disk mode, the iPod screen will display, with a black foreground and white background, either a no symbol with the text "Do not disconnect." or a checkmark symbol with the text "OK to disconnect." depending on whether the iPod is connected and if it has been ejected.

Disk mode exists on all iPod models. For more information on how to enter disk mode, refer to [https://support.apple.com/kb/ht1363 this Apple support document]

Disk mode is also referred to as "forced disk mode" in device information received from the iPod.

The place where disk mode is stored on the device differs depending on the iPod model. On the iPod nano (4th generation) and newer, disk mode is stored in the "disk" partition of the [[Firmware]].

=== How to access it===
* Clickwheel iPods (except for the very first models):
** hold down '''Menu''' and '''Center''' to do a hard reboot
** hold down '''Center''' and '''Play/Pause''' when the Apple logo appears
* [[Nano 6G]]
** hold down '''Sleep/Wake''' and '''Volume Down''' to do a hard reboot
** hold down '''Volume Up''' when the Apple logo appears
* [[Nano 7G]]
** hold down '''Sleep/Wake''' and '''Menu''' to do a hard reboot
** hold down '''Volume Up''' and '''Volume Down''' when the Apple logo appears

<gallery>
File:Nano2g-diskmode-1.jpg|[[Nano 2G]] Do not disconnect
File:Nano2g-diskmode-2.jpg|[[Nano 2G]] OK to disconnect
File:Nano3g-diskmode-1.jpg|[[Nano 3G]] Do not disconnect
File:Nano3g-diskmode-2.jpg|[[Nano 3G]] OK to disconnect
File:Nano4g-diskmode-1.jpg|[[Nano 4G]] Do not disconnect
File:Nano4g-diskmode-2.jpg|[[Nano 4G]] OK to disconnect
File:Nano5g-diskmode-1.jpg|[[Nano 5G]] Do not disconnect
File:Nano5g-diskmode-2.jpg|[[Nano 5G]] OK to disconnect
File:Nano6g-diskmode-1.jpg|[[Nano 6G]] Do not disconnect
File:Nano6g-diskmode-2.jpg|[[Nano 6G]] OK to disconnect
File:Nano7g-diskmode-1.jpg|[[Nano 7G]] Do not disconnect
File:Nano7g-diskmode-2.jpg|[[Nano 7G]] OK to disconnect
</gallery>

==DFU mode==
[https://en.wikipedia.org/wiki/Device_Firmware_Upgrade Device Firmware Upgrade], or DFU, is a standard for upgrading firmware over USB that is used by many devices, including iOS devices and newer iPods. DFU mode exists on the [[Nano 3G]] and newer and the [[Classic 6G]] and newer, coinciding with Apple's switch from PortalPlayer to Samsung processors. DFU mode is contained in the on-processor BootROM. Instructions on entering DFU mode can be found [https://theapplewiki.com/wiki/DFU_Mode#iPod here].

When in DFU mode, the iPod can be sent a special WTF [[IMG1]] firmware image to enter WTF mode. Other IMG1 images cannot be sent in this mode.

The [[Nano 2G]] also has a DFU mode, but it can only be entered by shorting testpoints on the iPod's circuit board or flashing the NOR with an image with an invalid signature or hash. It does, however, support a NOR DFU mode that can be entered by holding down '''Rewind''' and '''Play/Pause''' right after rebooting the device<ref>https://www.rockbox.org/irc/log-20080904#13:31:44</ref>.

=== How to access it===
# Connect the iPod to a computer using a USB cable
# Check which key combo you need to hold down depending on the iPod's model
# Keep holding down the same buttons until the Apple logo appears, keep holding until the screen goes black, wait about 1 second and release the buttons.

* [[Nano_3G]], [[Nano_4G]], [[Nano_5G]] and [[Classic_1G]]: '''Menu''' and '''Center'''
* [[Nano 6G]]: '''Sleep/Wake''' and '''Volume Down'''
* [[Nano 7G]]: '''Sleep/Wake''' and '''Menu'''

Note: On [[Nano 7G]] use a USB-A to Lightning cable. You cannot enter DFU mode using a USB-C to Lightning cable.

==WTF mode==
In WTF mode (possibly 'Where's The Firmware?'), the iPod will accept any [[IMG1]] image it is sent over DFU and, if signature and decryption checks pass, will attempt to boot to it. It is entered from DFU mode when a specific WTF [[IMG1]] firmware image is sent. While in WTF mode the iPod still uses the standard DFU protocol.

The iTunes behavior upon seeing an iPod in WTF mode is to send it a "recovery" firmware image, which places the iPod in disk mode. However, any firmware image can be sent to it, including, for example, the "osos" partition from production iPod firmware, which enables tethered booting an iPod into [[RetailOS]].

==Diagnostic mode==
[[File:Nano 7G diagnostic mode.jpg|thumb|right|[[Nano 7G]] in diagnostics mode]]
This mode will give quite a lot of info about your iPod. In diagnostics mode you can find info about the battery power check the LCD, button inputs, radio signals, DRAM, NAND, Accelerometer, dock information and an about section. On touchscreen iPods there is also a section for touchscreen testing.
=== How to access it===
* Clickwheel iPods (except for the very first models):
** hold down '''Menu''' and '''Center''' to do a hard reboot
** hold down '''Center''' and '''Rewind''' when the Apple logo appears
* [[Nano 6G]]
** hold down '''Sleep/Wake''' and '''Volume Down''' to do a hard reboot
** hold down '''Volume Up''', '''Volume Down''' and '''Sleep/Wake''' when the Apple logo appears
* [[Nano 7G]]
** hold down '''Sleep/Wake''' and '''Menu''' to do a hard reboot
** hold down '''Volume Up''', '''Volume Down''' and '''Sleep/Wake''' when the Apple logo appears
<br clear="all" />
==USB IDs==
When connected to a computer, the iPod presents a vendor ID of 05ac (Apple Inc.) and a product ID that depends on its model and which mode it is in:
{| class="wikitable"
|-
! colspan="2" | Model
! Normal/disk mode
! DFU mode
! WTF mode
|-
| colspan="2" | [[Nano 2G]]
| <code>1260</code>
| <code>1220</code>
| <code>1240</code>
|-
| colspan="2" | [[Nano 3G]]
| <code>1262</code>
| <code>1223</code>/<code>1224</code>
| <code>1242</code>
|-
| colspan="2" | [[Nano 4G]]
| <code>1263</code>
| <code>1225</code>
| <code>1243</code>
|-
| colspan="2" | [[Nano 5G]]
| <code>1265</code>
| <code>1231</code>
| <code>1246</code>
|-
| colspan="2" | [[Nano 6G]]
| <code>1266</code>
| <code>1232</code>
| <code>1248</code>
|-
| rowspan="2" | [[Nano 7G]]
| Initial
| rowspan="2" | <code>1267</code>
| rowspan="2" | <code>1234</code>
| <code>1249</code>
|-
| Rev A
| <code>124a</code>
|-
| rowspan="4" | [[Classic 6G]]
| [[Classic 6G#Initial|Initial]]
| rowspan="4" | <code>1261</code>
| rowspan="4" | <code>1223</code>
| <code>1241</code>
|-
| [[Classic 6G#Rev A|Rev A]]
| <code>1245</code>
|-
| [[Classic 6G#Rev B|Rev B]]
| <code>1247</code>
|-
| Rev C
| <code>1250</code>
|}

Main Page

2026-07-31T15:40:38Z

User890104: /* Gallery */

__NOTOC__
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].

== FAQ ==

=== I'm not an embedded software developer, what can I do with my iPod? ===
* If you have an [[Nano 2G]], [[Classic 6G]] or an older iPod, you can install [https://www.rockbox.org/download/ Rockbox].
* If you have an [[Nano 6G]] or [[Nano 7G]], you can [https://github.com/nfzerox/ipod_theme#ipod_theme install a theme].
* If you have an [[Nano 7G]], you can install [[NanoApps]].
* If you have another model, there's nothing you can currently do to help us add support and/or speed up the process, since it requires '''a lot''' of time and effort. Keep an eye on our wiki and social media for any updates!

=== I'm an embedded software developer, what can I do with my iPod? ===

* There's a [[U-Boot]] port, and [[Linux|Linux]] boots with an initramfs on [[Nano 2G]], [[Nano 3G]], [[Nano 5G]] and [[Nano 7G]]
* [[wInd3x]] allows untethered and safe code execution (no permanent modification) on [[Nano 3G]], [[Nano 4G]], [[Nano 5G]], [[Nano 6G]] and [[Nano 7G]]
* Rockbox bootloader has been published for [[Nano 3G]] and [[Nano 4G]], but [https://isthererockboxonipodnano3g.freemyipod.org/ the Rockbox port is not yet completed].
* Tethered code execution using [[S5Late]] (a vulnerability in DFU_DNLOAD packet parsing code) for [[Nano 6G]], [[Nano 7G]] and iPod shuffle (4th generation).
* Untethered code execution using [[ipod_sun]] (CVE-2010-1797) for [[Nano 6G]] and [[Nano 7G]].
* There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) for [[Nano 2G]], [[Nano 3G]], [[Nano 4G]] and [[Classic 1G]] which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.

== Gallery ==
<gallery>
File:Nano6g-patched-osos.jpeg|Patched [[retailOS]] on [[Nano 6G]]
File:Fastfetch_nano_7g_7.1-rc3.png|fastfetch on [[Nano 7G]]
File:Fastfetch nano 2g 6.10.png|fastfetch on [[Nano 2G]]
File:Linux nano 7g 7.1-rc3.jpg|[[Linux]] 7.1.0-rc3 on [[Nano 7G]]
File:Photo 2025-12-27 20-36-24.jpg|[[Linux]] 6.14.0 on [[Nano 7G]]
File:S5L8702X01.png|S5L8702 under an EM
File:S5L8701B05.png|S5L8701 under an EM
File:Nano7g-patched-osos.png|Patched [[retailOS]] on [[Nano 7G]]
File:Nano5g-wayland.png|Wayland on [[Nano 5G]]
File:Nano5g-neofetch.png|neofetch on [[Nano 5G]]
File:Nano5g-diskmode-patched.png|Patched [[Modes#Disk_mode|disk mode]] on [[Nano 5G]]
File:Nano5g-console2.png|[[Linux]] on [[Nano 5G]]
File:Nano5g-console.png|[[Linux]] 6.2.0-rc4 on [[Nano 5G]]
File:EmCORE_Nano2G_Nano4G_Classic.jpg|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]
</gallery>

== Getting an account ==
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].

==Updates==
* {{#dateformat:2026-03-30}} - Some of us will be at [https://entropia.de/GPN24 GPN24] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].
* {{#dateformat:2025-12-26}} - Some of us will be at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!
* {{#dateformat:2025-06-12}} - Some of us will be at [https://entropia.de/GPN23 GPN23] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2024-12-25}} - Some of us will be at [https://events.ccc.de/congress/2024/infos/startpage.html 38C3] in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.
* {{#dateformat:2023-01-07}} - A preliminary [[U-Boot]] port to the [[Nano 5G]] [https://social.hackerspace.pl/@q3k/109655916469636189 has been developed].
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!
* {{#dateformat:2021-12-31}} - An exploit named [[wInd3x]], which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!

Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]

===Released Software===
* [[wInd3x]]
* [[ipod_sun]]
* [[U-Boot|U-Boot port]]
* [[Linux|Linux port]]
* Legacy:
** [[iBugger]]
** [[iLoader]]
** [[emCORE]]

|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
* [[Firmware downgrading]]
* [[Troubleshooting]]

===Reverse engineering results===
* [[Firmware]]
** [[Bootrom]]
** [[Boot Process]]
** [[Firmware decryption]]
** [[FTL|Flash Translation Layer]]
** [[RetailOS]]
*** [[RetailOS Options]]
* [[GUID table]]
* [[JTAG]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G HW analysis]]
** [[S5L8701 analysis]]
* Nano 4G
** [[Nano4G firmware upgrade process]]
* Nano 5G
** [[Nano 5G|General]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
** [[Nano 3G]]
** [[Nano 4G]]
*** [[920-0614-03]]
** [[Nano 5G]]
** [[Nano 6G]]
** [[Nano 7G]]
** [[Classic 6G]]
* [[Chronology]]
* [[S5L8700 datasheet]]
* [[Modes]]

===Exploiting===
* [[wInd3x]]
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|}

File:Nano7g-diskmode-2.jpg

2026-07-31T15:37:07Z

User890104:

File:Nano7g-diskmode-1.jpg

2026-07-31T15:36:53Z

User890104:

File:Nano7g-diagmode.jpg

2026-07-31T15:36:38Z

User890104:

File:Nano6g-diskmode-2.jpg

2026-07-31T15:36:23Z

User890104:

File:Nano6g-diskmode-1.jpg

2026-07-31T15:36:04Z

User890104:

File:Nano6g-diagmode.jpg

2026-07-31T15:35:45Z

User890104:

File:Nano5g-diskmode-2.jpg

2026-07-31T15:35:29Z

User890104:

File:Nano5g-diskmode-1.jpg

2026-07-31T15:35:14Z

User890104:

File:Nano5g-diagmode.jpg

2026-07-31T15:34:56Z

User890104:

File:Nano4g-diskmode-2.jpg

2026-07-31T15:34:39Z

User890104:

File:Nano4g-diskmode-1.jpg

2026-07-31T15:34:24Z

User890104:

File:Nano4g-diagmode.jpg

2026-07-31T15:34:05Z

User890104:

File:Nano3g-diskmode-2.jpg

2026-07-31T15:33:44Z

User890104:

File:Nano3g-diskmode-1.jpg

2026-07-31T15:33:28Z

User890104:

File:Nano3g-diagmode.jpg

2026-07-31T15:33:11Z

User890104:

File:Nano2g-diskmode-2.jpg

2026-07-31T15:32:49Z

User890104:

File:Nano2g-diskmode-1.jpg

2026-07-31T15:31:50Z

User890104:

File:Nano2g-diagmode.jpg

2026-07-31T15:28:39Z

User890104:

U-Boot

2026-07-31T10:12:06Z

User890104:

== U-Boot Port ==

We've been working on an experimental U-Boot port for the [[Nano 2G]], [[Nano 3G]], [[Nano 5G]] and [[Nano 7G]]. It can be started using [[wInd3x]] and will start up a CDC-ACM serial console over USB for debugging purposes. Currently it has no storage driver.

The current port expects to be loaded in place of [[OSOS]], eg. by packaging it into an [[IMG1]] and sending it to [[WTF]]. This is what [[wInd3x]] does. This way, U-Boot does not have to do any of the 'annoying' early boot stuff like bringing up DRAM.

=== Getting the source ===

$ git clone git@github.com:freemyipod/u-boot.git
$ cd u-boot

=== Configuring ===

$ make apple_n36_defconfig # iPod nano (2nd generation)
$ make apple_n46_defconfig # iPod nano (3rd generation)
$ make apple_n33_defconfig # iPod nano (5th generation)
$ make apple_n31_defconfig # iPod nano (7th generation)

=== Building ===

You'll need GCC for ARM (for bare metal targets, not for Linux targets), OpenSSL and GnuTLS.

On Linux distros that use apt, these can be installed using the following command.

# apt install gcc-arm-none-eabi libssl-dev gnutls-dev

Then, build the U-boot binary.

$ make CROSS_COMPILE=arm-none-eabi- u-boot.bin

On macOS, you need to install openssl using homebrew. If the build system does not find it, append the following to the build command:

HOSTCFLAGS="-I/opt/homebrew/Cellar/openssl@3/3.6.1/include" HOSTLDFLAGS="-L/opt/homebrew/Cellar/openssl@3/3.6.1/lib"

substituting your OpenSSL version/path as needed.

=== Running ===

If you have a 30-pin breakout cable with the UART pins connected to your computer (for [[Nano 6G]] and older), or a Alex/DCSD cable (for [[Nano 7G]]), you can see and interact with U-boot's console. Launch a serial client like picocom before running U-boot. Here is an example command line.

$ picocom --quiet --baud 115200 --imap lfcrlf /dev/ttyUSB0 # or whatever the correct port is

Make sure your user is in the <code>dialout</code> group or similar, so you can access serial ports.

If you have a regular cable, skip this command. USB DFU interface will still be accessible.

==== [[Nano 2G]] ====

Install Rockbox. Create an u-boot.ipod file by using the following tool from the Rockbox source code:
$ ./rockbox/tools/scramble -add=nn2g u-boot.bin u-boot.ipod
Upload the file to your iPod. Run Rockbox, go to File Manager, find the u-boot.ipod file and select it.

==== [[Nano 3G]], [[Nano 5G]] and [[Nano 7G]] ====

Connect your iPod in [[Modes|DFU Mode]] and use [[wInd3x]] to start U-Boot:

$ ./wInd3x cfw run u-boot.bin

Make sure your user can access the raw USB device, add udev rules (recommended) or run with root (not recommended).

The command may fail the first time, retry one or two times before asking for help.

=== Pushing an image to U-boot ===

When successfully started, U-Boot will then enumerate as yet another DFU device, this time ready to receive an U-Boot compatible image. You can load an image using dfu-util:

$ dfu-util --device 05ac:8007 --download foo
$ dfu-util --device 05ac:8007 --detach

Note the <code>--detach</code> command: this is needed to get U-Boot to exit DFU mode and actually execute the image.

Make sure your user can access the raw USB device, add udev rules (recommended) or run with root (not recommended).

== Work in progress==

You can run the [[Nano 5G]] image on a [[Nano 4G]] and it seems to be working at first glance.

You can run the [[Nano 5G]] image on a [[Nano 6G]], but if you don't stop the countdown before auto-booting, it gets stuck since the timer which is used to measure how much a second takes is not initialized properly. You can flood the UART console with key presses just while U-boot is printing the messages to skip the auto-boot prompt entiery and get dropped into a U-boot console.

Your mileage may vary. Patches welcome.

== U-boot logs ==
=== [[Nano 2G]] ===
<pre>
<debug_uart>

U-Boot 2025.07-rc4-g116c6099a58f (Jul 31 2026 - 12:47:02 +0300)

CPU: Samsung S5L8701 (ARM940T)
Model: Apple iPod nano (2nd generation)
DRAM: 32 MiB
Core: 8 devices, 7 uclasses, devicetree: separate
MMC:
Loading Environment from nowhere... OK
In: uart@3cc00000
Out: uart@3cc00000
Err: uart@3cc00000
Net: No ethernet found.
Hit any key to stop autoboot: 0
</pre>
=== [[Nano 3G]] ===
<pre>
<debug_uart>

U-Boot 2025.07-rc4-g116c6099a58f (Jul 31 2026 - 12:47:14 +0300)

CPU: Samsung S5L8702 (ARM926EJ-S)
Model: Apple iPod nano (3rd generation)
DRAM: 32 MiB
LCD: Type 38b3 (0)
Core: 8 devices, 7 uclasses, devicetree: separate
MMC:
Loading Environment from nowhere... OK
In: uart@3cc00000
Out: uart@3cc00000
Err: uart@3cc00000
Net: No ethernet found.
Hit any key to stop autoboot: 0
</pre>
=== [[Nano 5G]] ===
<pre>
<debug_uart>

U-Boot 2025.07-rc4-g116c6099a58f (Jul 31 2026 - 12:47:25 +0300)

CPU: Samsung S5L8730 (ARM1176JZF-S)
Model: Apple iPod nano (5th generation)
DRAM: 64 MiB
LCD: Type 38b3 (0)
Core: 8 devices, 7 uclasses, devicetree: separate
MMC:
Loading Environment from nowhere... OK
In: uart@3cc00000
Out: uart@3cc00000
Err: uart@3cc00000
Net: No ethernet found.
Hit any key to stop autoboot: 0
</pre>
=== [[Nano 7G]] ===
<pre>
<debug_uart>

U-Boot 2025.07-rc4-g116c6099a58f (Jul 31 2026 - 12:47:39 +0300)

CPU: Samsung S5L8740 (ARM Cortex A5)
Model: Apple iPod nano (7th generation)
DRAM: 64 MiB
Core: 10 devices, 7 uclasses, devicetree: separate
MMC:
Loading Environment from nowhere... OK
In: uart@3dd00000
Out: uart@3dd00000
Err: uart@3dd00000
Net: No ethernet found.
Hit any key to stop autoboot: 0
</pre>

NanoApps

2026-07-29T20:41:42Z

User890104:

===== Run custom homebrew apps on iPod nano 7th generation. =====
== Overview ==
NanoApps is an early developer preview for hobbyists and tinkerers who want to build and run custom apps for iPod nano 7th generation. This is the very beginning of custom apps on nano: it needs a lot more research and polish before it can become a daily-driver app platform, but early results are promising, allowing you to run basic versions of [[:File:NanoApps_Paint.png|Paint]], [[:File:NanoApps_Notes.png|Notes]], [[:File:NanoApps_WAV_Player.png|WAV Player]], and [[:File:NanoApps_Launcher.png|Homebrew Launcher]] on nano today. Contributions are very welcome; see [https://github.com/nfzerox/NanoApps/blob/main/README.md#contributing-to-nanoapps Contributing to NanoApps], join the [https://discord.gg/Er3KJwaCMg Discord server], and share what you build on [https://www.reddit.com/r/ipod/ r/ipod].

[[File:NanoApps_Overview.png|640px]]

== Links ==
* Source code: https://github.com/nfzerox/NanoApps
* Discord server: https://discord.gg/Er3KJwaCMg

NanoApps

2026-07-29T20:41:24Z

User890104:

===== Run custom homebrew apps on iPod nano 7th generation. =====
== Overview ==
NanoApps is an early developer preview for hobbyists and tinkerers who want to build and run custom apps for iPod nano 7th generation. This is the very beginning of custom apps on nano: it needs a lot more research and polish before it can become a daily-driver app platform, but early results are promising, allowing you to run basic versions of [[:File:NanoApps_Paint.png|Paint]], [[:File:NanoApps_Notes.png|Notes]], [[:File:NanoApps_WAV_Player.png|WAV Player]], and [[:File:NanoApps_Launcher.png|Homebrew Launcher]] on nano today. Contributions are very welcome; see [https://github.com/nfzerox/NanoApps/blob/main/README.md#contributing-to-nanoapps Contributing to NanoApps], join the Discord server, and share what you build on [https://www.reddit.com/r/ipod/ r/ipod].

[[File:NanoApps_Overview.png|640px]]

== Links ==
* Source code: https://github.com/nfzerox/NanoApps
* Discord server: https://discord.gg/Er3KJwaCMg

NanoApps

2026-07-29T20:40:45Z

User890104:

===== Run custom homebrew apps on iPod nano 7th generation. =====
== Overview ==
NanoApps is an early developer preview for hobbyists and tinkerers who want to build and run custom apps for iPod nano 7th generation. This is the very beginning of custom apps on nano: it needs a lot more research and polish before it can become a daily-driver app platform, but early results are promising, allowing you to run basic versions of [[:File:NanoApps_Paint.png|Paint]], [[:File:NanoApps_Notes.png|Notes]], [[:File:NanoApps_WAV_Player.png|WAV Player]], and [[:File:NanoApps_Launcher.png|Homebrew Launcher]] on nano today. Contributions are very welcome; see [https://github.com/nfzerox/NanoApps/blob/main/README.md#contributing-to-nanoapps Contributing to NanoApps], join the [https://discord.gg/7PnGEXjW3X iPod nano Hacking Discord], and share what you build on [https://www.reddit.com/r/ipod/ r/ipod].

[[File:NanoApps_Overview.png|640px]]

== Links ==
* Source code: https://github.com/nfzerox/NanoApps
* Discord server: https://discord.gg/Er3KJwaCMg

WInd3x

2026-07-28T21:14:25Z

User890104:

== wInd3x Vulnerability ==
{{DISPLAYTITLE:wInd3x}}

A [[S5L8720 Bootrom|Bootrom]] vulnerability discovered and exploited by [[User:Q3k|q3k]] in December 2021. It allows code execution in the bootrom over USB.

=== Affected Devices ===

{| class="wikitable"
|-
! Device/SoC !! Vulnerable? !! Exploited?
|-
| [[Nano 3G]] || Yes || Yes
|-
| [[Nano 4G]] || Yes || Yes
|-
| [[Nano 5G]] || Yes || Yes
|-
| [[Nano 6G]] || No ||
|-
| [[Nano 7G]] || No ||
|-
| Classic “6G” || Yes || Yes
|-
| iPhone || ? ||
|-
| iPhone 3G || Yes || No
|}

=== Building ===

$ git clone https://github.com/freemyipod/wInd3x
$ cd wInd3x

You'll need Golang and libusb. On a Linux system that uses apt, they can be installed using:
# apt install golang libusb-1.0-0-dev
It is recommended that you get an up-to-date Golang distribution from https://go.dev/ or build it yourself, instead of relying on your distro's probably outdated version.

Then:
$ go build ./cmd/wInd3x
Or, if you have Nix(OS), just do:
$ nix-build
=== Running / Usage ===

wInd3x currently allows you to:

# Decrypt [[IMG1]] files, like [[OSOS]] or the bootloader/[[WTF]]/...
# Access arbitrary memory and experiment with peripherals
# Run unsigned DFU payloads
# Run an unsigned [[OSOS]] or [[U-Boot]] by first running an automatically patched [[WTF]].

For guides, see [https://github.com/freemyipod/wInd3x github.com/freemyipod/wInd3x]

Make sure your user can access the raw USB device, add udev rules (recommended) or run with root (not recommended).

=== Vulnerability ===

This exploits a vulnerability in the standard SETUP packet parsing code of the bootrom, in which the wIndex parameter is not checked for bmRequest == {0x20, 0x40}, but is still used to index an array of interface/class handlers (that in the Bootrom has a length of 1).

==== Nano 4G and 5G Exploit Chain ====

The first requirement is to find a suitable (blx r0) instruction in the bootrom code of the device. For Nano 4G the only one such instruction is at offset 0x3b0, and for Nano 5G there is such instruction at 0x37c. We'll refer to it as X below.

We abuse the fact that wIndex == 3 for bmRequest 0x40 treats a 'bytes left to sent over USB' counter as a function pointer and calls it with r0 == address of SETUP. We massage the DFU mode into attempting to send us X+0x40 bytes, and failing after 0x40 bytes, thereby leaving the counter at X bytes and executing code at address X.

Since the bootrom is mapped at offset 0x0 as well as 0x20000000 at boot, this means we execute bootrom code, and X happens to point to a 'blx r0' instruction. This in turn causes the CPU to interpret the SETUP packet received as ARM code, because the SETUP handler is called with the SETUP packet as its argument, i.e. r0.

We specially craft the SETUP packet to be a valid ARM branch instruction, pointing somewhere into a temporary DFU image buffer. By first sending a payload as a partial DFU image (aborting before causing a MANIFEST), we finally get up to be able to execute either 0x800 on Nano 4G or 0x400 on Nano 5G bytes of fully user controlled code.

In that payload, we send a stub which performs some runtime changes to the DFU's data structures to a) return a different product string b) overwrite an image verification vtable entry with a function that allows unsigned images. Some SRAM is carved out by this pay

==== Nano 3G and Classic (”6G”) ====

With bRequestType == 0x20 and wIndex == 6 we directly jump to code execution at the SETUP packet.

This Bootroom does not have a VTable which can be easily hooked to override functions to provide Haxed DFU functionality. However, an 'OnImage' function pointer is present in the State structure, which we override with our own code (copied to carved out SRAM). This code reimplements the bare minimum of the hooked function, without calling any decryption/verification code on the header/body.

U-Boot

2026-07-28T21:10:43Z

User890104:

U-Boot

2026-07-28T16:55:10Z

User890104:

== U-Boot Port ==

An experimental U-Boot port for the [[Nano 2G]], [[Nano 3G]], [[Nano 5G]] and [[Nano 7G]] lives at https://github.com/freemyipod/u-boot/tree/s5l87xx .

It can be started using [[wInd3x]] and will start up a CDC-ACM serial console over USB for debugging purposes. Currently it has no storage driver.

The current port expects to be loaded in place of [[OSOS]], eg. by packaging it into an IMG1 and sending it to [[WTF]]. This is what wInd3x does. This way, U-Boot does not have to do any of the 'annoying' early boot stuff like bringing up DRAM.

=== Configuring ===

$ make apple_n36_defconfig # iPod nano (2nd generation)
$ make apple_n46_defconfig # iPod nano (3rd generation)
$ make apple_n33_defconfig # iPod nano (5th generation)
$ make apple_n31_defconfig # iPod nano (7th generation)

=== Building ===

$ make CROSS_COMPILE=arm-none-eabi- u-boot.bin

On macOS, you need to install openssl using homebrew. If the build system does not find it, append the following to the build command:

HOSTCFLAGS="-I/opt/homebrew/Cellar/openssl@3/3.6.1/include" HOSTLDFLAGS="-L/opt/homebrew/Cellar/openssl@3/3.6.1/lib"

substituting your OpenSSL version/path as needed.

=== Running ===

==== [[Nano 2G]] ====

Install Rockbox. Create an u-boot.ipod file by using the following tool from the Rockbox source code:
$ ./rockbox/tools/scramble -add=nn2g u-boot.bin u-boot.ipod
Upload the file to your iPod. Run Rockbox, go to File Manager, find the u-boot.ipod file and select it.

==== [[Nano 3G]], [[Nano 5G]] and [[Nano 7G]] ====

Connect your iPod in [[Modes|DFU Mode]] and use [[wInd3x]] to start U-Boot:

$ ./wInd3x cfw run u-boot.bin

=== Pushing an image to U-boot ===

When successfully started, U-Boot will then enumerate as yet another DFU device, this time ready to receive an U-Boot compatible image. You can load an image using dfu-util:

$ dfu-util --device 05ac:8007 --download foo
$ dfu-util --device 05ac:8007 --detach

Note the <code>--detach</code> command: this is needed to get U-Boot to exit DFU mode and actually execute the image.

== Work in progress==

You can run the [[Nano 5G]] image on a [[Nano 4G]] and it seems to be working at first glance.

You can run the [[Nano 5G]] image on a [[Nano 6G]], but if you don't stop the countdown before auto-booting, it gets stuck since the timer which is used to measure how much a second takes is not initialized properly. You can flood the UART console with key presses just while U-boot is printing the messages to skip the auto-boot prompt entiery and get dropped into a U-boot console.

Your mileage may vary. Patches welcome.

Linux

2026-07-26T21:04:19Z

User890104:

== Current: Freemyipod Linux ==

We are working on supporting Samsung/S5L-based devices which have an MMU. Currently our main focus is the [[Nano 7G]], there are also builds for [[Nano 2G]], [[Nano 3G]] and [[Nano 5G]]. An experimental source tree is available on [https://github.com/freemyipod/linux github.com/freemyipod/linux]. Aditionaly [[User:ZeOne]] is working on making it work with the [[Nano 6G]] you can read more about that on his page.

=== User Guide ===

Not yet available, as the Linux port isn't yet practical to use. We have no storage drivers, no sound driver...

=== Developer Guide ===

If you're somewhat familiar with embedded Linux, you can get started by building [[WInd3x|wInd3x]], [[U-Boot]] and the Kernel as described below. However, '''you will have to provide your own userland''' (eg. buildroot, archlinux arm, ... anything armv6 compatible) and either run it from an initramfs or over NFS. '''A serial cable is not necessary, but very useful to troubleshoot boot issues.'''

==== Build everything ====

''These are not copy-paste instructions. You are expected to understand what's happening.''

You will need an arm-none-eabi- toolchain into your $PATH, eg. gcc-arm-embedded from your package manager.

First, build [[wInd3x#Building]].

Second, build [[U-Boot]].

Third, Linux:

$ git clone https://github.com/freemyipod/linux
$ cd linux

For [[Nano 2G]]:
$ git checkout n2g-wip
$ make ARCH=arm nano2g_defconfig

For [[Nano 3G]] and [[Nano 7G]]:
$ git checkout s5l87xx
$ make ARCH=arm apple_n46_defconfig # iPod nano (3rd generation)
$ make ARCH=arm apple_n31_defconfig # iPod nano (7th generation)

For iPod nano (5th generation):
$ git checkout n5g-wip
$ make ARCH=arm nano5g_defconfig

After configuring, build the kernel:
$ make ARCH=arm CROSS_COMPILE=arm-none-eabi- -j $(nproc) zImage

By this point, have a initramfs ready. If you wanna boot directly from nfs, edit CMDLINE in the kernel .config accordingly.

Finally, bundle together an u-boot image containing the kernel, your initramfs, and the device-tree (built by u-boot):

$ mkimage -A arm -C none -O linux -T multi -a 0x08000000 -e 0x08000000 -d arch/arm/boot/zImage:initramfs.gz:../u-boot/arch/arm/dts/s5l8730.dtb mImage

''mImage'' is your combined image.

TODO: add instructions how to use the Makefile-based initramfs generation script and mkimage from U-boot.

==== Running ====

Connect your iPod nano in DFU mode.

===== For [[Nano 3G]] and later =====

Execute u-boot using wInd3x:

$ ./wInd3x cfw run ../u-boot/u-boot.bin

This should start u-boot. Running this for the first time will take a while, as some bootloader stages need to be downloaded, decrypted and modified. A new USB device (05ac:8007) appear on your host. Use dfu-util to upload mImage:

dfu-util --device 05ac:8007 --download mImage
dfu-util --device 05ac:8007 --detach

Note the <code>--detach</code> command: this is needed to get U-Boot to exit DFU mode and actually execute the image.

===== For the [[Nano 2G]] =====

You will have to chainload the rockbox bootloader with U-boot.

To do this, we assume you have already built U-boot dtbs along with Linux.

To create the mImage, run this command inside your Linux folder:

$ ./create_image.sh

Note: if it dosen’t work, you will have to make it executable, usually by running:

$ chmod +x create_image.sh

After it creates the mImage, go to your u-boot folder and build u-boot.bin.

$ make CROSS_COMPILE=arm-none-eabi- -j $(nproc) u-boot.bin

Now generate a fake rockbox.ipod that tricks it into starting U-Boot:

$ ./tools/mkimage -T ipod -d u-boot.bin rockbox.ipod

Copy this new rockbox.ipod into the .rockbox folder on your iPod nano 2G.

Then, in the serial console you'll see Linux booting:

## Booting kernel from Legacy Image at 08000000 ...
...
Starting kernel ...

[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 6.2.0-rc4-00476-g4c4af4d7e53c (q3k@mimeomia) (arm-none-eabi-gcc (GNU Arm Embedded Toolchain 10.3-2021.10) 10.3.1 20210824 (release), GNU ld (GNU Arm Embedded Toolchain 10.3-2021.10) 2.36.1.20210621) #70 Fri Jan 20 18:02:56 CET 2023
...

The LCD display should start up and show a boot log. If not, try adding <code>console=tty0</code> to your CMDLINE? You might also use <code>fbcon=rotate:1</code> to rotate the framebuffer 90 degrees.

If everything goes well, the kernel should boot up and attempt to mount a rootfs. It's up to you to get this part working, at least until we streamline the process. The USB CDC EEM ethernet gadget should also appear on your host (probably as usb0, or some long systemd predictable name). The other end will be visible as 'usb0' on the device.

On [[Nano 7G]] you'll need a DCSD cable (Alex/Magico), and the command line to get proper serial output:

picocom --baud 115200 --imap lfcrlf /dev/ttyUSB0

Now go on and have a go at reverse-engineering some peripherals! :)

== Legacy: iPodLinux ==

The [http://www.ipodlinux.org/ iPodLinux] project supports all the PortalPlayer based iPods: iPod 1G-4G, Photo/Color, Video/5G/5.5G, Mini, iPod Nano 1G. It is currently semi-abandoned, and uses a very old ucLinux kernel build.

U-Boot

2026-07-26T20:57:51Z

User890104:

== U-Boot Port ==

An experimental U-Boot port for the [[Nano 2G]], [[Nano 3G]], [[Nano 5G]] and [[Nano 7G]] lives at https://github.com/freemyipod/u-boot/tree/s5l87xx .

It can be started using [[wInd3x]] and will start up a CDC-ACM serial console over USB for debugging purposes. Currently it has no storage driver.

The current port expects to be loaded in place of [[OSOS]], eg. by packaging it into an IMG1 and sending it to [[WTF]]. This is what wInd3x does. This way, U-Boot does not have to do any of the 'annoying' early boot stuff like bringing up DRAM.

=== Configuring ===

$ make apple_n36_defconfig # iPod nano (2nd generation)
$ make apple_n46_defconfig # iPod nano (3rd generation)
$ make apple_n33_defconfig # iPod nano (5th generation)
$ make apple_n31_defconfig # iPod nano (7th generation)

=== Building ===

$ make CROSS_COMPILE=arm-none-eabi-

On macOS, you need to install openssl using homebrew. If the build system does not find it, append the following to the build command:

HOSTCFLAGS="-I/opt/homebrew/Cellar/openssl@3/3.6.1/include" HOSTLDFLAGS="-L/opt/homebrew/Cellar/openssl@3/3.6.1/lib"

substituting your OpenSSL version/path as needed.

=== Running ===

==== [[Nano 2G]] ====

Install Rockbox. Create an u-boot.ipod file by using the following tool from the Rockbox source code:
$ ./rockbox/tools/scramble -add=nn2g u-boot.bin u-boot.ipod
Upload the file to your iPod. Run Rockbox, go to File Manager, find the u-boot.ipod file and select it.

==== [[Nano 3G]], [[Nano 5G]] and [[Nano 7G]] ====

Connect your iPod in [[Modes|DFU Mode]] and use [[wInd3x]] to start U-Boot:

$ ./wInd3x cfw run u-boot.bin

=== Pushing an image to U-boot ===

When successfully started, U-Boot will then enumerate as yet another DFU device, this time ready to receive an U-Boot compatible image. You can load an image using dfu-util:

$ dfu-util --device 05ac:8007 --download foo
$ dfu-util --device 05ac:8007 --detach

Note the <code>--detach</code> command: this is needed to get U-Boot to exit DFU mode and actually execute the image.

== Work in progress==

You can run the [[Nano 5G]] image on a [[Nano 4G]] and it seems to be working at first glance.

You can run the [[Nano 5G]] image on a [[Nano 6G]], but if you don't stop the countdown before auto-booting, it gets stuck since the timer which is used to measure how much a second takes is not initialized properly. You can flood the UART console with key presses just while U-boot is printing the messages to skip the auto-boot prompt entiery and get dropped into a U-boot console.

Your mileage may vary. Patches welcome.

Main Page

2026-07-26T00:19:03Z

User890104: /* Gallery */

__NOTOC__
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].

== FAQ ==

=== I'm not an embedded software developer, what can I do with my iPod? ===
* If you have an [[Nano 2G]], [[Classic 6G]] or an older iPod, you can install [https://www.rockbox.org/download/ Rockbox].
* If you have an [[Nano 6G]] or [[Nano 7G]], you can [https://github.com/nfzerox/ipod_theme#ipod_theme install a theme].
* If you have an [[Nano 7G]], you can install [[NanoApps]].
* If you have another model, there's nothing you can currently do to help us add support and/or speed up the process, since it requires '''a lot''' of time and effort. Keep an eye on our wiki and social media for any updates!

=== I'm an embedded software developer, what can I do with my iPod? ===

* There's a [[U-Boot]] port, and [[Linux|Linux]] boots with an initramfs on [[Nano 2G]], [[Nano 3G]], [[Nano 5G]] and [[Nano 7G]]
* [[wInd3x]] allows untethered and safe code execution (no permanent modification) on [[Nano 3G]], [[Nano 4G]], [[Nano 5G]], [[Nano 6G]] and [[Nano 7G]]
* Rockbox bootloader has been published for [[Nano 3G]] and [[Nano 4G]], but [https://isthererockboxonipodnano3g.freemyipod.org/ the Rockbox port is not yet completed].
* Tethered code execution using [[S5Late]] (a vulnerability in DFU_DNLOAD packet parsing code) for [[Nano 6G]], [[Nano 7G]] and iPod shuffle (4th generation).
* Untethered code execution using [[ipod_sun]] (CVE-2010-1797) for [[Nano 6G]] and [[Nano 7G]].
* There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) for [[Nano 2G]], [[Nano 3G]], [[Nano 4G]] and [[Classic 1G]] which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.

== Gallery ==
<gallery>
File:Nano6g-patched-osos.jpeg|Patched [[retailOS]] on [[Nano 6G]]
File:Fastfetch_nano_7g_7.1-rc3.png|fastfetch on [[Nano 7G]]
File:Fastfetch nano 2g 6.10.png|fastfetch on [[Nano 2G]]
File:Linux nano 7g 7.1-rc3.jpg|[[Linux]] 7.1.0-rc3 on [[Nano 7G]]
File:Photo 2025-12-27 20-36-24.jpg|[[Linux]] 6.14.0 on [[Nano 7G]]
File:S5L8702X01.png|S5L8702 under an EM
File:S5L8701B05.png|S5L8701 under an EM
File:Nano7g-patched-osos.png|Patched [[retailOS]] on [[Nano 7G]]
File:Nano5g-wayland.png|Wayland on [[Nano 5G]]
File:Nano5g-neofetch.png|neofetch on [[Nano 5G]]
File:Nano5g-diskmode-patched.png|Patched [[Modes#Disk_mode|disk mode]] on [[Nano 5G]]
File:Nano5g-console2.png|[[Linux]] on [[Nano 5G]]
File:Nano5g-console.png|[[Linux]] 6.2.0-rc4 on [[Nano 5G]]

File:EmCORE_Nano2G_Nano4G_Classic.jpg|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]
</gallery>

== Getting an account ==
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].

==Updates==
* {{#dateformat:2026-03-30}} - Some of us will be at [https://entropia.de/GPN24 GPN24] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].
* {{#dateformat:2025-12-26}} - Some of us will be at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!
* {{#dateformat:2025-06-12}} - Some of us will be at [https://entropia.de/GPN23 GPN23] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2024-12-25}} - Some of us will be at [https://events.ccc.de/congress/2024/infos/startpage.html 38C3] in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.
* {{#dateformat:2023-01-07}} - A preliminary [[U-Boot]] port to the [[Nano 5G]] [https://social.hackerspace.pl/@q3k/109655916469636189 has been developed].
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!
* {{#dateformat:2021-12-31}} - An exploit named [[wInd3x]], which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!

Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]

===Released Software===
* [[wInd3x]]
* [[ipod_sun]]
* [[U-Boot|U-Boot port]]
* [[Linux|Linux port]]
* Legacy:
** [[iBugger]]
** [[iLoader]]
** [[emCORE]]

|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
* [[Firmware downgrading]]
* [[Troubleshooting]]

===Reverse engineering results===
* [[Firmware]]
** [[Bootrom]]
** [[Boot Process]]
** [[Firmware decryption]]
** [[FTL|Flash Translation Layer]]
** [[RetailOS]]
*** [[RetailOS Options]]
* [[GUID table]]
* [[JTAG]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G HW analysis]]
** [[S5L8701 analysis]]
* Nano 4G
** [[Nano4G firmware upgrade process]]
* Nano 5G
** [[Nano 5G|General]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
** [[Nano 3G]]
** [[Nano 4G]]
*** [[920-0614-03]]
** [[Nano 5G]]
** [[Nano 6G]]
** [[Nano 7G]]
** [[Classic 6G]]
* [[Chronology]]
* [[S5L8700 datasheet]]
* [[Modes]]

===Exploiting===
* [[wInd3x]]
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|}

File:Nano6g-patched-osos.jpeg

2026-07-26T00:18:03Z

User890104:

Main Page

2026-07-26T00:15:30Z

User890104:

__NOTOC__
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].

== FAQ ==

=== I'm not an embedded software developer, what can I do with my iPod? ===
* If you have an [[Nano 2G]], [[Classic 6G]] or an older iPod, you can install [https://www.rockbox.org/download/ Rockbox].
* If you have an [[Nano 6G]] or [[Nano 7G]], you can [https://github.com/nfzerox/ipod_theme#ipod_theme install a theme].
* If you have an [[Nano 7G]], you can install [[NanoApps]].
* If you have another model, there's nothing you can currently do to help us add support and/or speed up the process, since it requires '''a lot''' of time and effort. Keep an eye on our wiki and social media for any updates!

=== I'm an embedded software developer, what can I do with my iPod? ===

* There's a [[U-Boot]] port, and [[Linux|Linux]] boots with an initramfs on [[Nano 2G]], [[Nano 3G]], [[Nano 5G]] and [[Nano 7G]]
* [[wInd3x]] allows untethered and safe code execution (no permanent modification) on [[Nano 3G]], [[Nano 4G]], [[Nano 5G]], [[Nano 6G]] and [[Nano 7G]]
* Rockbox bootloader has been published for [[Nano 3G]] and [[Nano 4G]], but [https://isthererockboxonipodnano3g.freemyipod.org/ the Rockbox port is not yet completed].
* Tethered code execution using [[S5Late]] (a vulnerability in DFU_DNLOAD packet parsing code) for [[Nano 6G]], [[Nano 7G]] and iPod shuffle (4th generation).
* Untethered code execution using [[ipod_sun]] (CVE-2010-1797) for [[Nano 6G]] and [[Nano 7G]].
* There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) for [[Nano 2G]], [[Nano 3G]], [[Nano 4G]] and [[Classic 1G]] which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.

== Gallery ==
<gallery>
File:Fastfetch_nano_7g_7.1-rc3.png|fastfetch on [[Nano 7G]]
File:Fastfetch nano 2g 6.10.png|fastfetch on [[Nano 2G]]
File:Linux nano 7g 7.1-rc3.jpg|[[Linux]] 7.1.0-rc3 on [[Nano 7G]]
File:Photo 2025-12-27 20-36-24.jpg|[[Linux]] 6.14.0 on [[Nano 7G]]

File:S5L8702X01.png|S5L8702 under an EM
File:S5L8701B05.png|S5L8701 under an EM
File:Nano7g-patched-osos.png|Patched [[retailOS]] on [[Nano 7G]]
File:Nano5g-wayland.png|Wayland on [[Nano 5G]]
File:Nano5g-neofetch.png|neofetch on [[Nano 5G]]
File:Nano5g-diskmode-patched.png|Patched [[Modes#Disk_mode|disk mode]] on [[Nano 5G]]
File:Nano5g-console2.png|[[Linux]] on [[Nano 5G]]
File:Nano5g-console.png|[[Linux]] 6.2.0-rc4 on [[Nano 5G]]

File:EmCORE_Nano2G_Nano4G_Classic.jpg|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]
</gallery>

== Getting an account ==
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].

==Updates==
* {{#dateformat:2026-03-30}} - Some of us will be at [https://entropia.de/GPN24 GPN24] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].
* {{#dateformat:2025-12-26}} - Some of us will be at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!
* {{#dateformat:2025-06-12}} - Some of us will be at [https://entropia.de/GPN23 GPN23] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2024-12-25}} - Some of us will be at [https://events.ccc.de/congress/2024/infos/startpage.html 38C3] in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.
* {{#dateformat:2023-01-07}} - A preliminary [[U-Boot]] port to the [[Nano 5G]] [https://social.hackerspace.pl/@q3k/109655916469636189 has been developed].
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!
* {{#dateformat:2021-12-31}} - An exploit named [[wInd3x]], which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!

Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]

===Released Software===
* [[wInd3x]]
* [[ipod_sun]]
* [[U-Boot|U-Boot port]]
* [[Linux|Linux port]]
* Legacy:
** [[iBugger]]
** [[iLoader]]
** [[emCORE]]

|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
* [[Firmware downgrading]]
* [[Troubleshooting]]

===Reverse engineering results===
* [[Firmware]]
** [[Bootrom]]
** [[Boot Process]]
** [[Firmware decryption]]
** [[FTL|Flash Translation Layer]]
** [[RetailOS]]
*** [[RetailOS Options]]
* [[GUID table]]
* [[JTAG]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G HW analysis]]
** [[S5L8701 analysis]]
* Nano 4G
** [[Nano4G firmware upgrade process]]
* Nano 5G
** [[Nano 5G|General]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
** [[Nano 3G]]
** [[Nano 4G]]
*** [[920-0614-03]]
** [[Nano 5G]]
** [[Nano 6G]]
** [[Nano 7G]]
** [[Classic 6G]]
* [[Chronology]]
* [[S5L8700 datasheet]]
* [[Modes]]

===Exploiting===
* [[wInd3x]]
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|}

Main Page

2026-07-26T00:14:28Z

User890104: reorder the developer faq items

__NOTOC__
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].

== FAQ ==

=== I'm not an embedded software developer, what can I do with my iPod? ===
If you have an [[Nano 2G]], [[Classic 6G]] or an older iPod, you can install [https://www.rockbox.org/download/ Rockbox].

If you have an [[Nano 6G]] or [[Nano 7G]], you can [https://github.com/nfzerox/ipod_theme#ipod_theme install a theme].

If you have an [[Nano 7G]], you can install [[NanoApps]].

If you have another model, there's nothing you can currently do to help us add support and/or speed up the process, since it requires '''a lot''' of time and effort. Keep an eye on our wiki and social media for any updates!

=== I'm an embedded software developer, what can I do with my iPod? ===

* There's a [[U-Boot]] port, and [[Linux|Linux]] boots with an initramfs on [[Nano 2G]], [[Nano 3G]], [[Nano 5G]] and [[Nano 7G]]
* [[wInd3x]] allows untethered and safe code execution (no permanent modification) on [[Nano 3G]], [[Nano 4G]], [[Nano 5G]], [[Nano 6G]] and [[Nano 7G]]
* Rockbox bootloader has been published for [[Nano 3G]] and [[Nano 4G]], but [https://isthererockboxonipodnano3g.freemyipod.org/ the Rockbox port is not yet completed].
* Tethered code execution using [[S5Late]] (a vulnerability in DFU_DNLOAD packet parsing code) for [[Nano 6G]], [[Nano 7G]] and iPod shuffle (4th generation).
* Untethered code execution using [[ipod_sun]] (CVE-2010-1797) for [[Nano 6G]] and [[Nano 7G]].
* There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) for [[Nano 2G]], [[Nano 3G]], [[Nano 4G]] and [[Classic 1G]] which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.

== Gallery ==
<gallery>
File:Fastfetch_nano_7g_7.1-rc3.png|fastfetch on [[Nano 7G]]
File:Fastfetch nano 2g 6.10.png|fastfetch on [[Nano 2G]]
File:Linux nano 7g 7.1-rc3.jpg|[[Linux]] 7.1.0-rc3 on [[Nano 7G]]
File:Photo 2025-12-27 20-36-24.jpg|[[Linux]] 6.14.0 on [[Nano 7G]]

File:S5L8702X01.png|S5L8702 under an EM
File:S5L8701B05.png|S5L8701 under an EM
File:Nano7g-patched-osos.png|Patched [[retailOS]] on [[Nano 7G]]
File:Nano5g-wayland.png|Wayland on [[Nano 5G]]
File:Nano5g-neofetch.png|neofetch on [[Nano 5G]]
File:Nano5g-diskmode-patched.png|Patched [[Modes#Disk_mode|disk mode]] on [[Nano 5G]]
File:Nano5g-console2.png|[[Linux]] on [[Nano 5G]]
File:Nano5g-console.png|[[Linux]] 6.2.0-rc4 on [[Nano 5G]]

File:EmCORE_Nano2G_Nano4G_Classic.jpg|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]
</gallery>

== Getting an account ==
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].

==Updates==
* {{#dateformat:2026-03-30}} - Some of us will be at [https://entropia.de/GPN24 GPN24] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].
* {{#dateformat:2025-12-26}} - Some of us will be at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!
* {{#dateformat:2025-06-12}} - Some of us will be at [https://entropia.de/GPN23 GPN23] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2024-12-25}} - Some of us will be at [https://events.ccc.de/congress/2024/infos/startpage.html 38C3] in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.
* {{#dateformat:2023-01-07}} - A preliminary [[U-Boot]] port to the [[Nano 5G]] [https://social.hackerspace.pl/@q3k/109655916469636189 has been developed].
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!
* {{#dateformat:2021-12-31}} - An exploit named [[wInd3x]], which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!

Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]

===Released Software===
* [[wInd3x]]
* [[ipod_sun]]
* [[U-Boot|U-Boot port]]
* [[Linux|Linux port]]
* Legacy:
** [[iBugger]]
** [[iLoader]]
** [[emCORE]]

|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
* [[Firmware downgrading]]
* [[Troubleshooting]]

===Reverse engineering results===
* [[Firmware]]
** [[Bootrom]]
** [[Boot Process]]
** [[Firmware decryption]]
** [[FTL|Flash Translation Layer]]
** [[RetailOS]]
*** [[RetailOS Options]]
* [[GUID table]]
* [[JTAG]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G HW analysis]]
** [[S5L8701 analysis]]
* Nano 4G
** [[Nano4G firmware upgrade process]]
* Nano 5G
** [[Nano 5G|General]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
** [[Nano 3G]]
** [[Nano 4G]]
*** [[920-0614-03]]
** [[Nano 5G]]
** [[Nano 6G]]
** [[Nano 7G]]
** [[Classic 6G]]
* [[Chronology]]
* [[S5L8700 datasheet]]
* [[Modes]]

===Exploiting===
* [[wInd3x]]
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|}

Main Page

2026-07-26T00:06:43Z

User890104: update faq

__NOTOC__
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].

== FAQ ==

=== I'm not an embedded software developer, what can I do with my iPod? ===
If you have an [[Nano 2G]], [[Classic 6G]] or an older iPod, you can install [https://www.rockbox.org/download/ Rockbox].

If you have an [[Nano 6G]] or [[Nano 7G]], you can [https://github.com/nfzerox/ipod_theme#ipod_theme install a theme].

If you have an [[Nano 7G]], you can install [[NanoApps]].

If you have another model, there's nothing you can currently do to help us add support and/or speed up the process, since it requires '''a lot''' of time and effort. Keep an eye on our wiki and social media for any updates!

=== I'm an embedded software developer, what can I do with my iPod? ===

Here's the current progress, by iPod model:

[[Nano 2G]]
* [[U-Boot]] can be chainloaded from Rockbox.

[[Nano 3G]] and [[Nano 4G]]
* [[wInd3x]] allows untethered and safe code execution (no permanent modification).
* Rockbox bootloader has been published, but [https://isthererockboxonipodnano3g.freemyipod.org/ the Rockbox port is not yet completed].

[[Nano 5G]]
* [[wInd3x]] allows untethered and safe code execution (no permanent modification).
* There's a [[U-Boot]] port, and [[Linux|Linux]] boots with an initramfs.

[[Nano 6G]] and [[Nano 7G]]
* Tethered code execution using [[S5Late]] (a vulnerability in DFU_DNLOAD packet parsing code) (also for iPod shuffle (4th generation))
* Untethered code execution using [[ipod_sun]] (CVE-2010-1797)

[[Nano 7G]]
* There's a [[U-Boot]] port, and [[Linux|Linux]] boots with an initramfs.

There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.

== Gallery ==
<gallery>
File:Fastfetch_nano_7g_7.1-rc3.png|fastfetch on [[Nano 7G]]
File:Fastfetch nano 2g 6.10.png|fastfetch on [[Nano 2G]]
File:Linux nano 7g 7.1-rc3.jpg|[[Linux]] 7.1.0-rc3 on [[Nano 7G]]
File:Photo 2025-12-27 20-36-24.jpg|[[Linux]] 6.14.0 on [[Nano 7G]]

File:S5L8702X01.png|S5L8702 under an EM
File:S5L8701B05.png|S5L8701 under an EM
File:Nano7g-patched-osos.png|Patched [[retailOS]] on [[Nano 7G]]
File:Nano5g-wayland.png|Wayland on [[Nano 5G]]
File:Nano5g-neofetch.png|neofetch on [[Nano 5G]]
File:Nano5g-diskmode-patched.png|Patched [[Modes#Disk_mode|disk mode]] on [[Nano 5G]]
File:Nano5g-console2.png|[[Linux]] on [[Nano 5G]]
File:Nano5g-console.png|[[Linux]] 6.2.0-rc4 on [[Nano 5G]]

File:EmCORE_Nano2G_Nano4G_Classic.jpg|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]
</gallery>

== Getting an account ==
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].

==Updates==
* {{#dateformat:2026-03-30}} - Some of us will be at [https://entropia.de/GPN24 GPN24] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].
* {{#dateformat:2025-12-26}} - Some of us will be at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!
* {{#dateformat:2025-06-12}} - Some of us will be at [https://entropia.de/GPN23 GPN23] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2024-12-25}} - Some of us will be at [https://events.ccc.de/congress/2024/infos/startpage.html 38C3] in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.
* {{#dateformat:2023-01-07}} - A preliminary [[U-Boot]] port to the [[Nano 5G]] [https://social.hackerspace.pl/@q3k/109655916469636189 has been developed].
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!
* {{#dateformat:2021-12-31}} - An exploit named [[wInd3x]], which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!

Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]

===Released Software===
* [[wInd3x]]
* [[ipod_sun]]
* [[U-Boot|U-Boot port]]
* [[Linux|Linux port]]
* Legacy:
** [[iBugger]]
** [[iLoader]]
** [[emCORE]]

|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
* [[Firmware downgrading]]
* [[Troubleshooting]]

===Reverse engineering results===
* [[Firmware]]
** [[Bootrom]]
** [[Boot Process]]
** [[Firmware decryption]]
** [[FTL|Flash Translation Layer]]
** [[RetailOS]]
*** [[RetailOS Options]]
* [[GUID table]]
* [[JTAG]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G HW analysis]]
** [[S5L8701 analysis]]
* Nano 4G
** [[Nano4G firmware upgrade process]]
* Nano 5G
** [[Nano 5G|General]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
** [[Nano 3G]]
** [[Nano 4G]]
*** [[920-0614-03]]
** [[Nano 5G]]
** [[Nano 6G]]
** [[Nano 7G]]
** [[Classic 6G]]
* [[Chronology]]
* [[S5L8700 datasheet]]
* [[Modes]]

===Exploiting===
* [[wInd3x]]
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|}

Main Page

2026-07-25T23:49:11Z

User890104: add images to the gallery

__NOTOC__
This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as [https://www.rockbox.org/ Rockbox] or [https://kernel.org/ Linux]. Freemyipod is a relaunch of [[Linux4nano]].

== FAQ ==

=== What can I do with my [[Nano 2G]], [[Classic 6G]] or older iPods? ===

There's an upstream Rockbox port for these devices. [https://www.rockbox.org/download/ Go use that].

=== What can I do with my [[Nano 3G]] or newer? ===

Not much (yet) unless you're an embedded developer :).

Here's the current progress, by iPod model:

[[Nano 3G]] and [[Nano 4G]]
* [[wInd3x]] allows untethered and safe code execution (no permanent modification).
* Rockbox bootloader has been published, but [https://isthererockboxonipodnano3g.freemyipod.org/ the Rockbox port is not yet completed].

[[Nano 5G]]
* [[wInd3x]] allows untethered and safe code execution (no permanent modification).
* There's a [[U-Boot]] port, and [[Linux|Linux]] boots with an initramfs.

[[Nano 6G]] and [[Nano 7G]]
* Tethered code execution using [[S5Late]] (a vulnerability in DFU_DNLOAD packet parsing code) (also for iPod shuffle (4th generation))
* Untethered code execution using [[ipod_sun]] (CVE-2010-1797)

[[Nano 7G]]
* There's a [[U-Boot]] port, and [[Linux|Linux]] boots with an initramfs.
* [[NanoApps]] allows you to run custom homebrew apps.

There's a set of earlier tooling ([[emCORE]]/[[emBIOS]]/[[iBugger]]) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.

== Gallery ==
<gallery>
File:Fastfetch_nano_7g_7.1-rc3.png|fastfetch on [[Nano 7G]]
File:Fastfetch nano 2g 6.10.png|fastfetch on [[Nano 2G]]
File:Linux nano 7g 7.1-rc3.jpg|[[Linux]] 7.1.0-rc3 on [[Nano 7G]]
File:Photo 2025-12-27 20-36-24.jpg|[[Linux]] 6.14.0 on [[Nano 7G]]

File:S5L8702X01.png|S5L8702 under an EM
File:S5L8701B05.png|S5L8701 under an EM
File:Nano7g-patched-osos.png|Patched [[retailOS]] on [[Nano 7G]]
File:Nano5g-wayland.png|Wayland on [[Nano 5G]]
File:Nano5g-neofetch.png|neofetch on [[Nano 5G]]
File:Nano5g-diskmode-patched.png|Patched [[Modes#Disk_mode|disk mode]] on [[Nano 5G]]
File:Nano5g-console2.png|[[Linux]] on [[Nano 5G]]
File:Nano5g-console.png|[[Linux]] 6.2.0-rc4 on [[Nano 5G]]

File:EmCORE_Nano2G_Nano4G_Classic.jpg|[[emCORE]] r779 on [[Nano 2G]], [[Nano 4G]] and [[Classic 2G]]
</gallery>

== Getting an account ==
Due to spambots, registration is closed. For an account contact [[User:User890104|User890104]] or [[User:Q3k|q3k]].

==Updates==
* {{#dateformat:2026-03-30}} - Some of us will be at [https://entropia.de/GPN24 GPN24] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2025-12-28}} - [[User:Hug0|Hug0]] made a lightning talk at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] on [https://www.youtube.com/watch?v=FKHL1yyOKJc iPod Nano reverse engineering].
* {{#dateformat:2025-12-26}} - Some of us will be at [https://events.ccc.de/congress/2025/infos/startpage.html 39C3] in Hamburg! Get in touch with [https://events.ccc.de/congress/2025/hub/en/user/q3k q3k] and/or [https://events.ccc.de/congress/2025/hub/en/user/slackware Slackware] if you're around!
* {{#dateformat:2025-06-12}} - Some of us will be at [https://entropia.de/GPN23 GPN23] in Karlsruhe! [[Contact|Let us know on IRC/Discord/Matrix]] if you're also there!
* {{#dateformat:2024-12-25}} - Some of us will be at [https://events.ccc.de/congress/2024/infos/startpage.html 38C3] in Hamburg! [https://events.ccc.de/congress/2024/hub/en/project/ipod-nano-hacking-freemyipod/ Come say hi!]
* {{#dateformat:2024-12-16}} - [[S5Late]], a tethered iPod bootrom/DFU exploit for [[Nano 7G]] (and possibly [[Nano 6G]]), is released.
* {{#dateformat:2023-12-28}} - [[ipod_sun]], a tool that enables code execution on the [[Nano 6G]] and [[Nano 7G]], is released.
* {{#dateformat:2023-01-07}} - A preliminary [[U-Boot]] port to the [[Nano 5G]] [https://social.hackerspace.pl/@q3k/109655916469636189 has been developed].
* {{#dateformat:2022-01-04}} - The bootrom of [[Nano 5G]] was successfully dumped, and is in the process of being reverse-engineered!
* {{#dateformat:2021-12-31}} - An exploit named [[wInd3x]], which exploits the latest vulnerability, is being prepared for [[Nano 4G]] and [[Nano 5G]].
* {{#dateformat:2021-12-27}} - A new vulnerability was discovered in [[Nano 4G]] and [[Nano 5G]] bootrom, which allows arbitrary code execution!

Follow [https://x.com/freemyipod our X feed] to get status updates automatically. See the [[Status]] page for more detailed information. Check our [https://github.com/freemyipod GitHub repositories] for the latest changes to our source code.

{| cellspacing="3" width="100%"
|- valign="top"
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Project info===
* [[ Status ]]
* [[ Contact ]]
* [[ Contributing ]]

===Released Software===
* [[wInd3x]]
* [[ipod_sun]]
* [[U-Boot|U-Boot port]]
* [[Linux|Linux port]]
* Legacy:
** [[iBugger]]
** [[iLoader]]
** [[emCORE]]

|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|

===Basic skills===
* [[Working with binaries]]
* [[Dumping firmware]]
* [[Extracting firmware]]
* [[Firmware downgrading]]
* [[Troubleshooting]]

===Reverse engineering results===
* [[Firmware]]
** [[Bootrom]]
** [[Boot Process]]
** [[Firmware decryption]]
** [[FTL|Flash Translation Layer]]
** [[RetailOS]]
*** [[RetailOS Options]]
* [[GUID table]]
* [[JTAG]]
* Nano 2G
** [[Nano2G clock gates‎]]
** [[Nano2G LCD init]]
** [[Nano2G HW analysis]]
** [[S5L8701 analysis]]
* Nano 4G
** [[Nano4G firmware upgrade process]]
* Nano 5G
** [[Nano 5G|General]]
|style="border: 1px dashed #c6c9ff; background-color: #f0f0ff"|
===Hardware===
* [[Hardware]]
** [[Nano 1G]]
** [[Nano 2G]]
** [[Nano 3G]]
** [[Nano 4G]]
*** [[920-0614-03]]
** [[Nano 5G]]
** [[Nano 6G]]
** [[Nano 7G]]
** [[Classic 6G]]
* [[Chronology]]
* [[S5L8700 datasheet]]
* [[Modes]]

===Exploiting===
* [[wInd3x]]
* [[Pwnage 2.0]]
* [[Notes vulnerability]]
** [[Address bruteforcing]]
** [[Nanotron 3000]]
|}

File:Nano5g-console.png

2026-07-25T23:42:26Z

User890104:

File:Nano5g-console2.png

2026-07-25T23:42:15Z

User890104:

File:Nano5g-diskmode-patched.png

2026-07-25T23:42:00Z

User890104:

File:Nano5g-neofetch.png

2026-07-25T23:41:51Z

User890104:

File:Nano5g-wayland.png

2026-07-25T23:41:39Z

User890104:

File:Nano7g-patched-osos.png

2026-07-25T23:41:30Z

User890104:

File:S5L8701B05.png

2026-07-25T23:41:20Z

User890104:

File:S5L8702X01.png

2026-07-25T23:41:02Z

User890104:

U-Boot

2026-07-25T23:32:51Z

User890104: add nano 2nd instructions

== U-Boot Port ==

An experimental U-Boot port for the [[Nano 2G]], [[Nano 3G]], [[Nano 5G]] and [[Nano 7G]] lives at https://github.com/freemyipod/u-boot/tree/s5l87xx .

It can be started using [[wInd3x]] and will start up a CDC-ACM serial console over USB for debugging purposes. Currently it has no storage driver.

The current port expects to be loaded in place of [[OSOS]], eg. by packaging it into an IMG1 and sending it to [[WTF]]. This is what wInd3x does. This way, U-Boot does not have to do any of the 'annoying' early boot stuff like bringing up DRAM.

=== Configuring ===

$ make apple_n36_defconfig # iPod nano (2nd generation)
$ make apple_n46_defconfig # iPod nano (3rd generation)
$ make apple_n33_defconfig # iPod nano (5th generation)
$ make apple_n31_defconfig # iPod nano (7th generation)

=== Building ===

$ make CROSS_COMPILE=arm-none-eabi-

On macOS, you need to install openssl using homebrew. If the build system does not find it, append the following to the build command:

HOSTCFLAGS="-I/opt/homebrew/Cellar/openssl@3/3.6.1/include" HOSTLDFLAGS="-L/opt/homebrew/Cellar/openssl@3/3.6.1/lib"

substituting your OpenSSL version/path as needed.

=== Running ===

==== [[Nano 2G]] ====

Install Rockbox. Create an u-boot.ipod file by using the following tool from the Rockbox source code:
$ ./rockbox/tools/scramble -add=nn2g u-boot.bin u-boot.ipod
Upload the file to your iPod. Run Rockbox, go to File Manager, find the u-boot.ipod file and select it.

==== [[Nano 3G]], [[Nano 5G]] and [[Nano 7G]] ====

Connect your iPod in [[Modes|DFU Mode]] and use [[wInd3x]] to start U-Boot:

$ ./wInd3x cfw run u-boot.bin

=== Pushing an image to U-boot ===

When successfully started, U-Boot will then enumerate as yet another DFU device, this time ready to receive an U-Boot compatible image. You can load an image using dfu-util:

$ dfu-util --device 05ac:8007 --download foo
$ dfu-util --device 05ac:8007 --detach

Note the <code>--detach</code> command: this is needed to get U-Boot to exit DFU mode and actually execute the image.

Linux

2026-07-25T23:17:55Z

User890104:

== Current: Freemyipod Linux ==

We are working on supporting Samsung/S5L-based devices which have an MMU. Currently our main focus is the [[Nano 7G]], there are also builds for [[Nano 2G]], [[Nano 3G]] and [[Nano 5G]]. An experimental source tree is available on [https://github.com/freemyipod/linux github.com/freemyipod/linux]. Aditionaly [[User:ZeOne]] is working on making it work with the [[Nano 6G]] you can read more about that on his page.

=== User Guide ===

Not yet available, as the Linux port isn't yet practical to use. We have no storage drivers, no sound driver...

=== Developer Guide ===

If you're somewhat familiar with embedded Linux, you can get started by building [[WInd3x|wInd3x]], [[U-Boot]] and the Kernel as described below. However, '''you will have to provide your own userland''' (eg. buildroot, archlinux arm, ... anything armv6 compatible) and either run it from an initramfs or over NFS. '''A serial cable is not necessary, but very useful to troubleshoot boot issues.'''

==== Build everything ====

''These are not copy-paste instructions. You are expected to understand what's happening.''

You will need an arm-none-eabi- toolchain into your $PATH, eg. gcc-arm-embedded from your package manager.

First, build [[wInd3x#Building]].

Second, build [[U-Boot]].

Third, Linux:

$ git clone https://github.com/freemyipod/linux
$ cd linux

For iPod nano (2nd generation):
$ git checkout n2g-wip
$ make ARCH=arm nano2g_defconfig

For iPod nano (3rd generation):
$ git checkout n3g-wip
$ make ARCH=arm nano3g_defconfig

For iPod nano (5th generation):
$ git checkout n5g-wip
$ make ARCH=arm nano5g_defconfig

For iPod nano (7th generation):
$ git checkout n7g-wip
$ make ARCH=arm apple_n31_defconfig

Alternatively, there is an experimental branch which should merge all of the ports:
$ git checkout s5l87xx
Then use the relevant defconfig according to the above commands.

After configuring, build the kernel:
$ make ARCH=arm CROSS_COMPILE=arm-none-eabi- -j $(nproc) zImage

By this point, have a initramfs ready. If you wanna boot directly from nfs, edit CMDLINE in the kernel .config accordingly.

Finally, bundle together an u-boot image containing the kernel, your initramfs, and the device-tree (built by u-boot):

$ mkimage -A arm -C none -O linux -T multi -a 0x08000000 -e 0x08000000 -d arch/arm/boot/zImage:initramfs.gz:../u-boot/arch/arm/dts/s5l8730.dtb mImage

''mImage'' is your combined image.

==== Running ====

Connect your iPod nano in DFU mode.

For [[Nano 3G]] and later, execute u-boot using wInd3x:

$ ./wInd3x cfw run ../u-boot/u-boot.bin

This should start u-boot. Running this for the first time will take a while, as some bootloader stages need to be downloaded, decrypted and modified. A new USB device (05ac:8007) appear on your host. Use dfu-util to upload mImage:

dfu-util -d 05ac:8007 -D mImage && dfu-util -d 05ac:8007 -e

For the [[Nano 2G]], you will have to chainload the rockbox bootloader with u-boot.

To do this, we assume you have already built u-boot dtbs along with Linux.

To create the mImage, run this command inside your Linux folder:

$ ./create_image.sh

Note: if it dosen’t work, you will have to make it executable, usually by running:

$ chmod +x create_image.sh

After it creates the mImage, go to your u-boot folder and build u-boot.bin.

$ make CROSS_COMPILE=arm-none-eabi- -j $(nproc) u-boot.bin

Now generate a fake rockbox.ipod that tricks it into starting U-Boot:

$ ./tools/mkimage -T ipod -d u-boot.bin rockbox.ipod

Copy this new rockbox.ipod into the .rockbox folder on your iPod nano 2G.

Then, in the serial console you'll see Linux booting:

## Booting kernel from Legacy Image at 08000000 ...
...
Starting kernel ...

[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 6.2.0-rc4-00476-g4c4af4d7e53c (q3k@mimeomia) (arm-none-eabi-gcc (GNU Arm Embedded Toolchain 10.3-2021.10) 10.3.1 20210824 (release), GNU ld (GNU Arm Embedded Toolchain 10.3-2021.10) 2.36.1.20210621) #70 Fri Jan 20 18:02:56 CET 2023
...

The LCD display should start up and show a boot log. If not, try adding <code>console=tty0</code> to your CMDLINE? You might also use <code>fbcon=rotate:1</code> to rotate the framebuffer 90 degrees.

If everything goes well, the kernel should boot up and attempt to mount a rootfs. It's up to you to get this part working, at least until we streamline the process. The USB CDC EEM ethernet gadget should also appear on your host (probably as usb0, or some long systemd predictable name). The other end will be visible as 'usb0' on the device.

On [[Nano 7G]] you'll need a DCSD cable (Alex/Magico), and the command line to get proper serial output:

picocom --baud 115200 --imap lfcrlf /dev/ttyUSB0

Now go on and have a go at reverse-engineering some peripherals! :)

== Legacy: iPodLinux ==

The [http://www.ipodlinux.org/ iPodLinux] project supports all the PortalPlayer based iPods: iPod 1G-4G, Photo/Color, Video/5G/5.5G, Mini, iPod Nano 1G. It is currently semi-abandoned, and uses a very old ucLinux kernel build.

Linux

2026-07-25T23:15:28Z

User890104: update building instructions

== Current: Freemyipod Linux ==

We are working on supporting Samsung/S5L-based devices which have an MMU. Currently our main focus is the [[Nano 7G]], there are also builds for [[Nano 2G]], [[Nano 3G]] and [[Nano 5G]]. An experimental source tree is available on [https://github.com/freemyipod/linux github.com/freemyipod/linux]. Aditionaly [[User:ZeOne]] is working on making it work with the [[Nano 6G]] you can read more about that on his page.

=== User Guide ===

Not yet available, as the Linux port isn't yet practical to use. We have no storage drivers, no sound driver...

=== Developer Guide ===

If you're somewhat familiar with embedded Linux, you can get started by building [[WInd3x|wInd3x]], [[U-Boot]] and the Kernel as described below. However, '''you will have to provide your own userland''' (eg. buildroot, archlinux arm, ... anything armv6 compatible) and either run it from an initramfs or over NFS. '''A serial cable is not necessary, but very useful to troubleshoot boot issues.'''

==== Build everything ====

''These are not copy-paste instructions. You are expected to understand what's happening.'

You will need an arm-none-eabi- toolchain into your $PATH, eg. gcc-arm-embedded from your package manager.

First, build [[wInd3x#Building]].

Second, build [[U-Boot]].

Third, Linux:

$ git clone https://github.com/freemyipod/linux
$ cd linux

For iPod nano (2nd generation):
$ git checkout n2g-wip
$ make ARCH=arm nano2g_defconfig

For iPod nano (3rd generation):
$ git checkout n3g-wip
$ make ARCH=arm nano3g_defconfig

For iPod nano (5th generation):
$ git checkout n5g-wip
$ make ARCH=arm nano5g_defconfig

For iPod nano (7th generation):
$ git checkout n7g-wip
$ make ARCH=arm apple_n31_defconfig

Alternatively, there is an experimental branch which should merge all of the ports:
$ git checkout s5l87xx
Then use the relevant defconfig according to the above commands.

After configuring, build the kernel:
$ make ARCH=arm CROSS_COMPILE=arm-none-eabi- -j $(nproc) zImage

By this point, have a initramfs ready. If you wanna boot directly from nfs, edit CMDLINE in the kernel .config accordingly.

Finally, bundle together an u-boot image containing the kernel, your initramfs, and the device-tree (built by u-boot):

$ mkimage -A arm -C none -O linux -T multi -a 0x08000000 -e 0x08000000 -d arch/arm/boot/zImage:initramfs.gz:../u-boot/arch/arm/dts/s5l8730.dtb mImage

''mImage'' is your combined image.

==== Running ====

Connect your iPod nano in DFU mode.

For [[Nano 3G]] and later, execute u-boot using wInd3x:

$ ./wInd3x cfw run ../u-boot/u-boot.bin

This should start u-boot. Running this for the first time will take a while, as some bootloader stages need to be downloaded, decrypted and modified. A new USB device (05ac:8007) appear on your host. Use dfu-util to upload mImage:

dfu-util -d 05ac:8007 -D mImage && dfu-util -d 05ac:8007 -e

For the [[Nano 2G]], you will have to chainload the rockbox bootloader with u-boot.

To do this, we assume you have already built u-boot dtbs along with Linux.

To create the mImage, run this command inside your Linux folder:

$ ./create_image.sh

Note: if it dosen’t work, you will have to make it executable, usually by running:

$ chmod +x create_image.sh

After it creates the mImage, go to your u-boot folder and build u-boot.bin.

$ make CROSS_COMPILE=arm-none-eabi- -j $(nproc) u-boot.bin

Now generate a fake rockbox.ipod that tricks it into starting U-Boot:

$ ./tools/mkimage -T ipod -d u-boot.bin rockbox.ipod

Copy this new rockbox.ipod into the .rockbox folder on your iPod nano 2G.

Then, in the serial console you'll see Linux booting:

## Booting kernel from Legacy Image at 08000000 ...
...
Starting kernel ...

[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 6.2.0-rc4-00476-g4c4af4d7e53c (q3k@mimeomia) (arm-none-eabi-gcc (GNU Arm Embedded Toolchain 10.3-2021.10) 10.3.1 20210824 (release), GNU ld (GNU Arm Embedded Toolchain 10.3-2021.10) 2.36.1.20210621) #70 Fri Jan 20 18:02:56 CET 2023
...

The LCD display should start up and show a boot log. If not, try adding <code>console=tty0</code> to your CMDLINE? You might also use <code>fbcon=rotate:1</code> to rotate the framebuffer 90 degrees.

If everything goes well, the kernel should boot up and attempt to mount a rootfs. It's up to you to get this part working, at least until we streamline the process. The USB CDC EEM ethernet gadget should also appear on your host (probably as usb0, or some long systemd predictable name). The other end will be visible as 'usb0' on the device.

On [[Nano 7G]] you'll need a DCSD cable (Alex/Magico), and the command line to get proper serial output:

picocom --baud 115200 --imap lfcrlf /dev/ttyUSB0

Now go on and have a go at reverse-engineering some peripherals! :)

== Legacy: iPodLinux ==

The [http://www.ipodlinux.org/ iPodLinux] project supports all the PortalPlayer based iPods: iPod 1G-4G, Photo/Color, Video/5G/5.5G, Mini, iPod Nano 1G. It is currently semi-abandoned, and uses a very old ucLinux kernel build.

WInd3x

2026-07-25T23:04:06Z

User890104: add building instructions

== wInd3x Vulnerability ==
{{DISPLAYTITLE:wInd3x}}

A [[S5L8720 Bootrom|Bootrom]] vulnerability discovered and exploited by [[User:Q3k|q3k]] in December 2021. It allows code execution in the bootrom over USB.

=== Affected Devices ===

{| class="wikitable"
|-
! Device/SoC !! Vulnerable? !! Exploited?
|-
| [[Nano 3G]] || Yes || Yes
|-
| [[Nano 4G]] || Yes || Yes
|-
| [[Nano 5G]] || Yes || Yes
|-
| [[Nano 6G]] || No ||
|-
| [[Nano 7G]] || No ||
|-
| Classic “6G” || Yes || Yes
|-
| iPhone || ? ||
|-
| iPhone 3G || Yes || No
|}

=== Building ===

$ git clone https://github.com/freemyipod/wInd3x
$ cd wInd3x

You'll need go and libusb. Then:
$ go build ./cmd/wInd3x
Or, if you have Nix(OS), just do:
$ nix-build
=== Running / Usage ===

wInd3x currently allows you to:

# Decrypt [[IMG1]] files, like [[OSOS]] or the bootloader/[[WTF]]/...
# Access arbitrary memory and experiment with peripherals
# Run unsigned DFU payloads
# Run an unsigned [[OSOS]] or [[U-Boot]] by first running an automatically patched [[WTF]].

For guides, see [https://github.com/freemyipod/wInd3x github.com/freemyipod/wInd3x]

=== Vulnerability ===

This exploits a vulnerability in the standard SETUP packet parsing code of the bootrom, in which the wIndex parameter is not checked for bmRequest == {0x20, 0x40}, but is still used to index an array of interface/class handlers (that in the Bootrom has a length of 1).

==== Nano 4G and 5G Exploit Chain ====

The first requirement is to find a suitable (blx r0) instruction in the bootrom code of the device. For Nano 4G the only one such instruction is at offset 0x3b0, and for Nano 5G there is such instruction at 0x37c. We'll refer to it as X below.

We abuse the fact that wIndex == 3 for bmRequest 0x40 treats a 'bytes left to sent over USB' counter as a function pointer and calls it with r0 == address of SETUP. We massage the DFU mode into attempting to send us X+0x40 bytes, and failing after 0x40 bytes, thereby leaving the counter at X bytes and executing code at address X.

Since the bootrom is mapped at offset 0x0 as well as 0x20000000 at boot, this means we execute bootrom code, and X happens to point to a 'blx r0' instruction. This in turn causes the CPU to interpret the SETUP packet received as ARM code, because the SETUP handler is called with the SETUP packet as its argument, i.e. r0.

We specially craft the SETUP packet to be a valid ARM branch instruction, pointing somewhere into a temporary DFU image buffer. By first sending a payload as a partial DFU image (aborting before causing a MANIFEST), we finally get up to be able to execute either 0x800 on Nano 4G or 0x400 on Nano 5G bytes of fully user controlled code.

In that payload, we send a stub which performs some runtime changes to the DFU's data structures to a) return a different product string b) overwrite an image verification vtable entry with a function that allows unsigned images. Some SRAM is carved out by this pay

==== Nano 3G and Classic (”6G”) ====

With bRequestType == 0x20 and wIndex == 6 we directly jump to code execution at the SETUP packet.

This Bootroom does not have a VTable which can be easily hooked to override functions to provide Haxed DFU functionality. However, an 'OnImage' function pointer is present in the State structure, which we override with our own code (copied to carved out SRAM). This code reimplements the bare minimum of the hooked function, without calling any decryption/verification code on the header/body.

U-Boot

2026-07-25T23:01:16Z

User890104: add macOS instruction

U-Boot

2026-07-25T22:58:47Z

User890104: update with support for other models besides n5g