freemyipod - User contributions [en]

EmCORE Releases

2011-05-09T14:52:24Z

Wolftail: /* Release notes / Known issues */ fixed a typo

Here is a list of all builds of [[emCORE]] that have been released into public so far.

'''Please do not use any other builds unless you really know what you're doing!'''

==r708: April 24th, 2011==
===Release notes / Known issues===
* The display doesn't work on some iPod Nano 2G devices. If this happens to you, we suggest to stick with iLoader for now.
* Reducing the CPU core voltage on the iPod Classic has been disabled. Battery life might be adversely affected.
* There's a small number of iPod Classic devices where USB doesn't work unless the device was booted through DFU.

===Fixes / Improvements===
* Fixed several kernel bugs that affected CPU exception and panic handling and caused the device to just lock up instead of showing proper error messages.
* Added trivial memory protection to catch most null pointer or garbage memory address accesses.
* Fixed a race condition in libUI that caused the boot menu to crash occasionally.
* Fixed various graphics glitches in the boot menu.

===Files===
[http://files.freemyipod.org/releases/20110406/bootstrap-ipodclassic-r692-20110406.dfu bootstrap-ipodclassic.dfu] 
[http://files.freemyipod.org/releases/20110424/fastboot-r708-20110424.emcoreapp fastboot.emcoreapp] 
[http://files.freemyipod.org/releases/20110424/installer-ipodclassic-r708-20110424.ubi installer-ipodclassic.ubi] 
[http://files.freemyipod.org/releases/20110424/installer-ipodnano2g-r708-20110424.bootnote installer-ipodnano2g.bootnote] 
[http://files.freemyipod.org/releases/20110424/installer-ipodnano2g-r708-20110424.ipodx installer-ipodnano2g.ipodx] 
[http://files.freemyipod.org/releases/20110424/installer-ipodnano2g-r708-20110424.ubi installer-ipodnano2g.ubi] 
[http://files.freemyipod.org/releases/20110424/rockbox-ipodclassic-r29777-20110424.zip rockbox-ipodclassic.zip] 
[http://files.freemyipod.org/releases/20110424/rockbox-ipodnano2g-r29777-20110424.zip rockbox-ipodnano2g.zip] 

==r692: April 6th, 2011==
===Release notes / Known issues===
* The boot menu occasionally locks up due to a combination of a kernel bug and a libUI bug. Rebooting the iPod the hard way by holding the menu and select buttons for 5 seconds should help.
* The display doesn't work on some iPod Nano 2G devices. If this happens to you, we suggest to stick with iLoader for now.
* Reducing the CPU core voltage on the iPod Classic has been disabled. Battery life might be adversely affected.
* There's a small number of iPod Classic devices where USB doesn't work unless the device was booted through DFU.

===Fixes / Improvements===
* Disabled undervolting for the iPod Classic.
* Fixed a kernel bug that causes lockups when injecting a firmware image while the boot menu is updating the display.

===Files===
[http://files.freemyipod.org/releases/20110406/bootstrap-ipodclassic-r692-20110406.dfu bootstrap-ipodclassic.dfu] (some people have reported that this file gives an error: ''Exception: DFU upload failed! (2 / 7)'' so if you also see this message, please use bootstrap-ipodclassic.dfu from the previous release) 
[http://files.freemyipod.org/releases/20110406/fastboot-r692-20110406.emcoreapp fastboot.emcoreapp] 
[http://files.freemyipod.org/releases/20110406/installer-ipodclassic-r692-20110406.ubi installer-ipodclassic.ubi] 
[http://files.freemyipod.org/releases/20110406/installer-ipodnano2g-r692-20110406.bootnote installer-ipodnano2g.bootnote] 
[http://files.freemyipod.org/releases/20110406/installer-ipodnano2g-r692-20110406.ipodx installer-ipodnano2g.ipodx] 
[http://files.freemyipod.org/releases/20110406/installer-ipodnano2g-r692-20110406.ubi installer-ipodnano2g.ubi] 
[http://files.freemyipod.org/releases/20110406/rockbox-ipodclassic-r29681-20110406.zip rockbox-ipodclassic.zip] 
[http://files.freemyipod.org/releases/20110406/rockbox-ipodnano2g-r29681-20110406.zip rockbox-ipodnano2g.zip] 

==r674: March 25th, 2011==
===Release notes / Known issues===
* This is the first public release, so please be aware that there might be a bunch of still unknown bugs in the wild.
* The boot menu occasionally locks up due to a cinbination of a kernel bug and a libUI bug. Rebooting the iPod the hard way by holding the menu and select buttons for 5 seconds should help.
* The display doesn't work on some iPod Nano 2G devices. If this happens to you, we suggest to stick with iLoader for now.
* This release reduces the CPU core voltage to conserve battery power, but apparently by a bit too much for some iPod Classic devices, causing all kinds of weird behavior. This was disabled in the r692 release, so please update if you suspect that you're affected by this.
* We found a kernel bug in this release that causes lockups when injecting a firmware image while the boot menu is updating the display. This should not affect normal users.
* There's a small number of iPod Classic devices where USB doesn't work unless the device was booted through DFU.
===Fixes / Improvements===
* Initial public [[emCORE]] release

===Files===
[http://files.freemyipod.org/releases/20110325/bootstrap-ipodclassic-r674-20110325.dfu bootstrap-ipodclassic.dfu] 
[http://files.freemyipod.org/releases/20110325/fastboot-r674-20110325.emcoreapp fastboot.emcoreapp] 
[http://files.freemyipod.org/releases/20110325/installer-ipodclassic-r674-20110325.ubi installer-ipodclassic.ubi] 
[http://files.freemyipod.org/releases/20110325/installer-ipodnano2g-r674-20110325.bootnote installer-ipodnano2g.bootnote] 
[http://files.freemyipod.org/releases/20110325/installer-ipodnano2g-r674-20110325.ipodx installer-ipodnano2g.ipodx] 
[http://files.freemyipod.org/releases/20110325/installer-ipodnano2g-r674-20110325.ubi installer-ipodnano2g.ubi] 
[http://files.freemyipod.org/releases/20110325/rockbox-ipodclassic-r29644-20110325.zip rockbox-ipodclassic.zip] 
[http://files.freemyipod.org/releases/20110325/rockbox-ipodnano2g-r29644-20110325.zip rockbox-ipodnano2g.zip]

User talk:TheSeven

2011-01-08T19:55:34Z

Wolftail:

is there any scope of finding vulnerabilities, being able to execute code through the nike+ ipod kits? as in control the alter the sensor to send modified data to the ipod through the kit? i guess we havent already tried that. -- [[User:Psgarcha92]], 19:29, 21 November 2010
:I don't the sensor will ever send data that's complex enough for the parser to have an exploitable bug. --[[User:TheSeven|TheSeven]] 18:22, 22 November 2010 (UTC)

Hello.my classic 3g's HDD just broke,as no one provide classic 3g's PCB scan yet,if l4n need this,i will snap some photos of it..
Then where should i upload it? -- [[User:sinless]]
:I think you should upload them here [http://www.freemyipod.org/wiki/Special:Upload] and then add them to the Classic 3G page. --[[User:Benedikt93|Benedikt93]] 15:00, 17 December 2010 (UTC)

OK.I will take apart it soon,and does anybody know can classic work with a ssd? -- [[User:sinless]] 23:00, 17 December 2010 (GMT+8)
:It should be able to handle pretty much everything that's PATA or CE-ATA, and the OF also supports LBA48. --[[User:TheSeven|TheSeven]] 13:49, 20 December 2010 (UTC)
I just took apart my classic 3g,but the only camera I can use is Nokia 5310..the pictures are not clear enough
Notice that my classic(MC293,160GB,firmware 2.o.4)'s motherboard is the same to the 2g classic board in hardware page,Apple's mark is the same 820-2437-- [[User:sinless]] 21:00, 21 December 2010 (GMT+8)

== Asked about IPL on the Nano 2G ==

When will I be able to use ipl on my Nano 2g? I assume it needs to be ported, but I don't know how to do so. Is there someone working on that? --[[User:ArthuruhtrA|ArthuruhtrA]]
:AFAIK no --[[User:TheSeven|TheSeven]] 00:00, 4 January 2011 (UTC)

Can you point me to any sort of information that would help me do it? The IPL site is down currently, no idea when it will be up. I do have the files found on SourceForge, but they are not very recent. I also have no experience with this, and don't want to brick my iPod. However, I may be able to get a spare Nano 2G to try it on. Thanks. --[[User:ArthuruhtrA|ArthuruhtrA]]

I found [http://ipl.derpapst.eu/ this] mirror of the ipl site last updated in '09. That is more recent. --[[User:ArthuruhtrA|ArthuruhtrA]]
:I don't have much more either, and I don't think there are newer files. iPodLinux hasn't really been developed any more for quite some time now. As this is a completely different architecture, I would suggest throwing the iPL kernel away and starting from a recent vanilla kernel, but I haven't really dealt with Linux kernels myself yet, so I probably can't help you much with this. --[[User:TheSeven|TheSeven]] 07:23, 5 January 2011 (UTC)

If I can port it, will you create the installer/incorporate it into what you have? And can you help me with porting to an extent? I bet you know more about it then I do. I got the latest kernel from linux.org (released yesterday) and the old kernel from ipl, and will look in them, and hopefully find something that I can do, but I don't quite know what I'm doing, as I don't quite understand the ipod as well as you. Should I be using the uCLinux kernel instead? --[[User:ArthuruhtrA|ArthuruhtrA]]
:I really don't know anything about embedded Linux. IIUC uCLinux is a fork of Linux 2.4 for MMU-less systems, but someone told me that the Linux 2.6 branch supports those natively. That's about everything I can tell you regarding Linux. I will of course be able to help you on the hardware side of things, i.e. answer questions about the hardware and the drivers emBIOS uses. What I certainly won't to is incorporating any kind of non-FAT filesystem support into my tools, as this would be a huge amount of work. But if the user handles creating an e.g. ext2 partition himself and the installer only needs to copy some files and add Linux to the iLoader menu, that's rather trivial. --[[User:TheSeven|TheSeven]] 13:13, 7 January 2011 (UTC)

== Still can't recognized by UMSboot ==
Sorry to trouble you but...
First,the INF file has some error..After I mod the driver(follow microsoft's WDK guide),it finally installed,but UMS can't recognized classic,windows recognized it as a freemyipod.org ipod nano3/classic dfu
I hope you provide us a one-click install tool or just fix the inf file,or just tell us what other software is needed,I have installed .NET 2.0 and WDK.thanks
:Which changes to the inf file were needed? Did you change anything else besides the CoInstallers? Did you change one of the GUIDs? The DFU tool uses the GUID, VID and PID to recognize the device. If one of those doesn't match, it won't work. --[[User:TheSeven|TheSeven]] 15:59, 7 January 2011 (UTC)

Compared to microsoft's example file,i think your inf lost these lines,and filled them after dev_addreg like this
[Dev_AddReg]
HKR,,DeviceInterfaceGUIDs,0x10000,"{2084a03c-04b1-4acc-9236-69fe2e7d5770}"

[USB_Install.CoInstallers]
AddReg=CoInstallers_AddReg
CopyFiles=CoInstallers_CopyFiles
[CoInstallers_AddReg]
HKR,,CoInstallers32,0x00010000,"WdfCoInstaller01009.dll,WdfCoInstaller","WinUSBCoInstaller2.dll"
[CoInstallers_CopyFiles]
WinUSBCoInstaller2.dll
WdfCoInstaller01009.dll
Of course,I put the two .dll files under the same floder with winusb.inf
Then,I can install the driver successful,but the new problem is UmsBOOT not recognized.

Addition:I have just reinstall WINXP,and directly install winusb without itunes.here are the details:
* put classic 3g into DFU,and connected it to computer,windows recognized a usb dfu device,i force windows to install winusb.inf,windows said installed driver filed,some lines may missing or error,with a error code 28. After that, the hardware name was freemyipod.org-usb dfu device
* install MICROSOFT WDK and reboot,still had the same problem.
* add that lines to winusb.inf and copy the two dll files,reinstall the driver,then succeed.the new hardware name is iPod Classic/Nano 3G Bootrom DFU.
* open umsboot,show an error window,I know it is because the lack of .NET framework
* install .NET 2.0,open ums again,it said no dfu device found.
* reboot and try,filed.
* still filed...
And I have some small questions about the wiki...how to show my ID at the last of the words i say,and,where can i find file/picture upload link...In my country no one uses wiki pages like this,sorry:)
And sorry for my poor English..--[[User:Sinless|Sinless]] 01:02, 8 January 2011 (GMT+8)
this time i copied ID from your massage..
And here is the "driver" i made,if it can help http://down.qiannao.com/space/file/qiannao/share/2011/1/8/iPodClassicWindowsInstaller.rar/.page
:The changes look good, I can't see why that shouldn't work. If the first installation try failed because of the coinstallers, there might have been some leftovers. Uninstall the device completely, choose yes if windows asks you if you want to remove the driver. Then try installing the modified one directly. Other than that, I'm pretty much out of ideas. You might want to go the Python/PyUSB/libusb-win32 route instead.
:The wiki editor will replace a sequence of four ~ signs with your signature. The upload link is hiding in the toolbox on the left side. --[[User:TheSeven|TheSeven]] 17:57, 7 January 2011 (UTC)
::I finally got it worked!the problem was umsboot need microsoft .net framework 3.5,it seemd that .net 2.0 not support USB.
And you should update the winusb driver,surely your driver lack that two dll files that install Winusb service,I couldn't upload a .rar file.--[[User:Sinless|Sinless]] 12:17, 8 January 2011 (UTC)
:::Interesting... I actually compiled it for .NET 4.0, but it seemed to work on 2.0 as well. I should probaby make another zip file with all the things needed by XP. --[[User:TheSeven|TheSeven]] 13:11, 8 January 2011 (UTC)
::::Yes,.net 2.0 can open umsboot but it can't work.XP need that two dll,I met the display problem,LCD=2,I just upload the photo and with LCD take apart and write the LCD SN.Hopefully you can make use of the photos
:::::The type 2 LCD of my 3G classic works fine within iLoader at least. --[[User:TheSeven|TheSeven]] 13:35, 8 January 2011 (UTC)
::::::maybe it has several versions,I just tested on my friend's classic 1g 80g,also has the problem.
:::::::Is the problem you're experiencing similar to the photo on the wiki page?
::::::::Yes,Look at the picture,I took apart the screen.Maybe it's a type 3,have taken many classic,I saw at least 4 versions of screen.
::::::::http://www.freemyipod.org/wiki/File:IMG_0014.jpg
::::::::http://www.freemyipod.org/wiki/File:IMG_0013.jpg
::::::::If you need to test new display driver..call me,and if it is possible,please make classic's rockbox can bass to 24db,I really miss that super bass on ipod mini..
:::::::::The tone controls are handled by hardware (to save processing power and thus battery power), and that can only handle up to +12dB. If you need more, you'll have to use a build which uses software-based tone controls instead. --[[User:TheSeven|TheSeven]] 14:09, 8 January 2011 (UTC)
:::::::::The problem LCD has a small tube looks like a rheostat on the wire.It is similiar to NANO2G's type 2 lcd,type1 lcd doesn't has a rheostat

== ==

Nano 6G

2010-12-27T12:42:28Z

Wolftail: /* Notes */

[[Image:nano_6g_frt_a.png|500px]]
[[Image:nano_6g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| Red
| NAND Flash
|
| Toshiba TH58NVG6E2FLA4C
|
|-
| Cyan
|
|
| Apple 33850859 C0E111022
|
|-
| Orange
|
|
| Apple 338S0783-B1 10298HLS
| Could be the Power Manager? Someone please confirm this.
|-
| Yellow
|
|
| 0650 D0UY 027
|
|-
| Blue
| CPU
| Samsung S5L8723
| Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031
| Rusty Mercury says it's a Samsung S5L8723, a step up from the previous Samsung 8730. [http://twitter.com/RustyMercury/status/23268805957 source]
|-
| Pink
|
|
| 35758907 1025 A 04 629749
|
|}

==Notes==
The "Nano" 6G is something entirely new, that doesn't seem to have much in common with the older generations of the Nano series. We don't yet know how this device works and if we want to do something with it at all. 
The red and black wires lead to the battery.

==Helpful pages==
Teardowns:
*http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563
Reviews:
*http://arstechnica.com/apple/reviews/2010/09/6th-generation-ipod-nano.ars

Nano 6G

2010-09-11T21:25:29Z

Wolftail: added a link

[[Image:nano_6g_frt_a.png|500px]]
[[Image:nano_6g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| Red
| NAND Flash
|
| Toshiba TH58NVG6E2FLA4C
|
|-
| Cyan
|
|
| Apple 33850859 C0E111022
|
|-
| Orange
|
|
| Apple 338S0783-B1 10298HLS
| Could be the Power Manager? Someone please confirm this.
|-
| Yellow
|
|
| 0650 D0UY 027
|
|-
| Blue
| CPU
| Samsung S5L8723
| Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031
| Rusty Mercury says it's a Samsung S5L8723, a step up from the previous Samsung 8730. [http://twitter.com/RustyMercury/status/23268805957 source]
|-
| Pink
|
|
| 35758907 1025 A 04 629749
|
|}

==Notes==
The "Nano" 6G is something entirely new, that doesn't seem to have much in common with the older generations of the Nano series. We don't yet know how this device works and if we want to do something with it at all. 
The red and black cables lead to the battery.

==Helpful pages==
Teardowns:
*http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563
Reviews:
*http://arstechnica.com/apple/reviews/2010/09/6th-generation-ipod-nano.ars

Nano 6G

2010-09-09T20:11:54Z

Wolftail: /* Components */

[[Image:nano_6g_frt_a.png|500px]]
[[Image:nano_6g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| Red
| NAND Flash
|
| Toshiba TH58NVG6E2FLA4C
|
|-
| Cyan
|
|
| Apple 33850859 C0E111022
|
|-
| Orange
|
|
| Apple 338S0783-B1 10298HLS
| Could be the Power Manager? Someone please confirm this.
|-
| Yellow
|
|
| 0650 D0UY 027
|
|-
| Blue
| CPU
| Samsung S5L8723
| Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031
| Rusty Mercury says it's a Samsung S5L8723, a step up from the previous Samsung 8730. [http://twitter.com/RustyMercury/status/23268805957 source]
|-
| Pink
|
|
| 35758907 1025 A 04 629749
|
|}

==Notes==
The "Nano" 6G is something entirely new, that doesn't seem to have much in common with the older generations of the Nano series. We don't yet know how this device works and if we want to do something with it at all.
The red and black cables lead to the battery.

==Helpful pages==
Teardowns:
*http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563

Hardware

2010-09-09T14:23:08Z

Wolftail:

This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.

{| class="wikitable"
! Generation !! CPU !! RAM !! size !! Utility flash !! size
|-
|[[Nano 1G]]
|PP5021C-TDF
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG]
|32MB
|[http://www.sst.com/products/?inode=41856 SST39WF400A]
|512kB
|-
|[[Nano 2G]]
|S5L8701
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG]
|32MB
|[http://www.sst.com/products/?inode=41422 SST39WF800A]
|1MB
|-
|[[Nano 3G]]
|S5L8702
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]
|32MB
|[http://www.sst.com/products/?inode=41340 SST25VF080B]
|1MB
|-
|[[Nano 4G]]
|S5L8720
|Integrated
|32MB
|?
|?
|-
|[[Nano 5G]]
|S5L8730
|Integrated
|?
|?
|?
|-

|[[Nano 6G|"Nano" 6G]]
|?
|?
|?
|?
|?
|-
|[[Classic 1G]]
|S5L8702
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]
|32MB
|[http://www.sst.com/products/?inode=41340 SST25VF080B]
|1MB
|-
|[[Classic 2G]]
|S5L8702
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]
|32MB
|[http://www.sst.com/products/?inode=41340 SST25VF080B]
|1MB
|-
|[[Classic 3G]]
|S5L8702
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]
|32MB
|[http://www.sst.com/products/?inode=41340 SST25VF080B]
|1MB
|}

Concerning the detailed generation pages:
*If you can prove or disprove any of these chip names, please let us know on the mailing list.
*The sources for the original and annotated PCB scans can found at http://l4n.clustur.com/data/board_imgs.

==Helpful pages==
Chip analyses
*http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx
*http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx

Hardware

2010-09-09T14:20:01Z

Wolftail: added the new nano 6g to the list

This is just a basic comparison of each generation's main components. For a detailed hardware analysis of a generation, click on it's link.

{| class="wikitable"
! Generation !! CPU !! RAM !! size !! Utility flash !! size
|-
|[[Nano 1G]]
|PP5021C-TDF
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG]
|32MB
|[http://www.sst.com/products/?inode=41856 SST39WF400A]
|512kB
|-
|[[Nano 2G]]
|S5L8701
|[http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=753&partnum=K4M56163PG K4M56163PG]
|32MB
|[http://www.sst.com/products/?inode=41422 SST39WF800A]
|1MB
|-
|[[Nano 3G]]
|S5L8702
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]
|32MB
|[http://www.sst.com/products/?inode=41340 SST25VF080B]
|1MB
|-
|[[Nano 4G]]
|S5L8720
|Integrated
|32MB
|?
|?
|-
|[[Nano 5G]]
|S5L8730
|Integrated
|?
|?
|?
|-

|[[Nano 6G]]
|?
|?
|?
|?
|?
|-
|[[Classic 1G]]
|S5L8702
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]
|32MB
|[http://www.sst.com/products/?inode=41340 SST25VF080B]
|1MB
|-
|[[Classic 2G]]
|S5L8702
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]
|32MB
|[http://www.sst.com/products/?inode=41340 SST25VF080B]
|1MB
|-
|[[Classic 3G]]
|S5L8702
|[http://www.samsung.com/global/system/business/semiconductor/product/2007/11/13/236652ds_k4x56163pi.pdf K4X56163PI]
|32MB
|[http://www.sst.com/products/?inode=41340 SST25VF080B]
|1MB
|}

Concerning the detailed generation pages:
*If you can prove or disprove any of these chip names, please let us know on the mailing list.
*The sources for the original and annotated PCB scans can found at http://l4n.clustur.com/data/board_imgs.

==Helpful pages==
Chip analyses
*http://www2.electronicproducts.com/Apple_iPod_Touch-whatsinside-57.aspx
*http://www2.electronicproducts.com/Apple_iPhone-whatsinside-4.aspx

Nano 6G

2010-09-09T14:10:24Z

Wolftail: made some of the colors more readable

[[Image:nano_6g_frt_a.png|500px]]
[[Image:nano_6g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| Red
| NAND Flash
|
| Toshiba TH58NVG6E2FLA4C
|
|-
| Cyan
|
|
| Apple 33850859 C0E111022
|
|-
| Orange
|
|
| Apple 338S0783-B1 10298HLS
|
|-
| Yellow
|
|
| 0650 D0UY 027
|
|-
| Blue
|
|
| Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031
|
|-
| Pink
|
|
| 35758907 1025 A 04 629749
|
|}

==Notes==
The "Nano" 6G is something entirely new, that doesn't seem to have much in common with the older generations of the Nano series. We don't yet know how this device works and if we want to do something with it at all.
The red and black cables lead to the battery.

==Helpful pages==
Teardowns:
*http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563

Nano 6G

2010-09-09T14:04:55Z

Wolftail: Added Colors to the components table.

[[Image:nano_6g_frt_a.png|500px]]
[[Image:nano_6g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| Red
| NAND Flash
|
| Toshiba TH58NVG6E2FLA4C
|
|-
| Cyan
|
|
| Apple 33850859 C0E111022
|
|-
| Orange
|
|
| Apple 338S0783-B1 10298HLS
|
|-
| Yellow
|
|
| 0650 D0UY 027
|
|-
| Blue
|
|
| Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031
|
|-
| Pink
|
|
| 35758907 1025 A 04 629749
|
|}

==Notes==
The "Nano" 6G is something entirely new, that doesn't seem to have much in common with the older generations of the Nano series. We don't yet know how this device works and if we want to do something with it at all.
The red and black cables lead to the battery.

==Helpful pages==
Teardowns:
*http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563

Nano 6G

2010-09-09T13:51:14Z

Wolftail: /* Components */

[[Image:nano_6g_frt_a.png|500px]]
[[Image:nano_6g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| Red
| NAND Flash
|
| Toshiba TH58NVG6E2FLA4C
|
|-
| Cyan
|
|
| Apple 33850859 C0E111022
|
|-
| Orange
|
|
| Apple 338S0783-B1 10298HLS
|
|-
| Yellow
|
|
| 0650 D0UY 027
|
|-
| Blue
|
|
| Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031
|
|-
| Pink
|
|
| 35758907 1025 A 04 629749
|
|}

==Notes==
The "Nano" 6G is something entirely new, that doesn't seem to have much in common with the older generations of the Nano series. We don't yet know how this device works and if we want to do something with it at all.
The red and black cables lead to the battery.

==Helpful pages==
Teardowns:
*http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563

Nano 6G

2010-09-09T13:48:10Z

Wolftail: Created a page for the new iPod Nano 6G.

[[Image:nano_6g_frt_a.png|500px]]
[[Image:nano_6g_bck_a.png|500px]]
==Components==
{| class="wikitable"
! Label !! Component !! Part !! Markings !! Notes
|-
| Red
| NAND Flash
|
| Toshiba TH58NVG6E2FLA4C 8GB NAND
|
|-
| Cyan
|
|
| Apple 33850859 C0E111022
|
|-
| Orange
|
|
| Apple 338S0783-B1 10298HLS
|
|-
| Yellow
|
|
| 0650 D0UY 027
|
|-
| Blue
|
|
| Apple 339S0104 YGC7 1031 K4X51323P1 YRF 020A3 ARM N2HXHZMP 4 1031
|
|-
| Pink
|
|
| 35758907 1025 A 04 629749
|
|}

==Notes==
The "Nano" 6G is something entirely new, that doesn't seem to have much in common with the older generations of the Nano series. We don't yet know how this device works and if we want to do something with it at all.
The red and black cables lead to the battery.

==Helpful pages==
Teardowns:
*http://www.ifixit.com/Teardown/iPod-Nano-6th-Generation-Teardown/3563

File:Nano 6g bck a.png

2010-09-09T13:35:26Z

Wolftail: This is the back of the logic board of the newly released iPod Nano 6g (the one with multitouch).

This is the back of the logic board of the newly released iPod Nano 6g (the one with multitouch).

File:Nano 6g frt a.png

2010-09-09T13:34:52Z

Wolftail: This is the front of the logic board of the newly released iPod Nano 6g (the one with multitouch).

This is the front of the logic board of the newly released iPod Nano 6g (the one with multitouch).

Firmware decryption

2010-09-06T13:44:44Z

Wolftail: /* Background */ corrected a typo

==Background==
Encrypting the firmware started with the release of iPod 4G. Only the AUPD part is encrypted, it uses RC4 encryption and the key is contained within the firmware. The iPodLinux project has more information about understanding and decrypting it: http://ipodlinux.org/wiki/Flash_Decryption

Starting with [[Nano 2G]], the encryption method changed. The best guess so far is that the encryption is AES-CBC with 128-bit blocks and a 128-bit key. The key isn't found yet, but it is not needed to decrypt the firmware.

After discovering the notes exploit, it became possible to upload and execute custom code on the ipods. TheSeven wrote an utility (ipodcrypt.py), which allows decrypting parts of the firmware using the iPod's crypto engine. The utility is being loaded via [[iBugger]] in the iPod's memory then the encrypted data is being sent. After the decryption process completes, the decrypted data is downloaded.

==ipodcrypt==
The ipodcrypt utility has the following features:

for [[Nano 2G]]:

*encrypt/decrypt DFU image
*encrypt/decrypt firmware file contents
*encrypt/decrypt dump of NOR flash's contents

for [[Nano 4G]]:

*decrypt firmware file contents

The process of decrypting is taking part on the iPod itself, so you must have a compatible device in order to use the utility. Also, you must run the iBugger utility on the device before using ipodcrypt.

You can find both utilities in the development snapshot, which is located on the iLoader homepage: http://the-seven.tk/ipod/iloader/sourcecode.php

In order to run these utilities, you will need the Python interpreter installed, the pyUSB module and libusb. It is possible to run the utilities on both Windows and Linux.
==Prerequisites==
===Windows===
First you need TheSeven's iBugger USB driver (http://l4n.clustur.com/data/theseven/releases/iBugger%20Windows%20Driver.7z). It uses libusb-win32 1.1.x. (see notes below)

Next, you need ActivePython (http://www.activestate.com/activepython) or another Python distribution for Windows. You can get ActivePython's latest version at: http://www.activestate.com/activepython/downloads

You also need [http://pyusb.sourceforge.net/ pyUSB] - a Python module for communicating with USB devices. Its download page is: You can get it from the [http://sourceforge.net/projects/pyusb/files/ download page] or [http://developer.berlios.de/project/showfiles.php?group_id=4354 another mirror]. The 0.x branch is compatible with the libusb version included TheSeven's iBugger driver.

'''Important note''': If you are using Windows Vista/7, you'll need the signed (1.2.x) version of libusb-win32. Otherwise the driver will install (after confirmation that it is unsigned), but it will not load unless you disable driver signature check, which is not recommended.

To use the 1.2.x version, you need to extract in the folder where you extracted the iBugger driver, then overwrite the .dll and .sys with the ones in 1.2.x package. Installing the driver then is as usual.

'''Important note 2''': You may need to kill iTunes's iPod service if you have iTunes installed, and to uninstall the iPod drivers that iTunes installed, before following the above instructions
===Linux===
Python is usually included in most distributions, so you don't need to worry about installing it. If you have easy_install, you can install pyUSB with:
<pre>
easy_install install pyusb
</pre>
Otherwise, you need to download it and install it manually as in the Windows instructions.

To install libusb, you need to use your distribution's package management utility and look for libusb, then install it.
===Mac OS X===
(to be added later)

==Helpful pages==
http://ipodlinux.org/wiki/Flash_Decryption

http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf

http://code.google.com/p/iphone-elite/w/list

http://code.google.com/p/chronicdev/w/list

http://wikee.iphwn.org/

http://iphonejtag.blogspot.com/

User:Wolftail

2010-09-02T20:42:12Z

Wolftail: Moved some stuff from my profile to the talk page where it belongs. Nothing new.

User talk:Wolftail

2010-09-02T20:41:50Z

Wolftail: Moved some stuff from my profile to the talk page where it belongs. Nothing new.

PS: If anyone will read this... Is it possible to update the 1G Classic (160GB) to the 2.0.x firmware of the 2G/3G Classic? (I know that the hardware is almost a perfect match.) I think it could be done by getting an image of the HDD of an iPod Classic with the new software and overwrite it to the older one. Has anyone tried this? Can it be done?

Thank You very much for all your work!

:Yes, this should be possible and in fact we have done something similar with the 4G. One time we copied the contents of a 8GB Nano 4G and gave it to me to put on my 16GB Nano 4G. It booted fine. But the thing is the Classic 2G has some headphone hardware that the 1G does not, and this could cause a crash when booting or using. We are more interested in copying the Classic 2G firmware to the Classic 3G since the 3G ships with firmware that has the notes vulnerability patched. [[User:Cmwslw|Cmwslw]] 05:18, 16 August 2010 (UTC)

Thanks for the quick reply! I know about the headphone difference but I still hope that those really tiny chips that are added on the motherboard of the Classic 2G aren't so important that the OS will crash without them. I believe that porting new features to iPods via the original firmware if possible should also be included in this wiki. I do also understand that porting Rockbox on the new iPods is of higher priority and just hope that someone will find some spare time for this. [[User:Wolftail|Wolftail]] 12:55, 16 August 2010 (UTC)

User:Wolftail

2010-08-16T12:55:01Z

Wolftail:

Hey, there!

My name is Lala Ionuț, I live in Romania and I own an iPod Classic 1G (160GB) and can't wait for Rockbox and/or iPodLinux to be available for it. I am willing to do non-destructive testing in order to help the project.

PS: If anyone will read this... Is it possible to update the 1G Classic (160GB) to the 2.0.x firmware of the 2G/3G Classic? (I know that the hardware is almost a perfect match.) I think it could be done by getting an image of the HDD of an iPod Classic with the new software and overwrite it to the older one. Has anyone tried this? Can it be done?

Thank You very much for all your work!

:Yes, this should be possible and in fact we have done something similar with the 4G. One time we copied the contents of a 8GB Nano 4G and gave it to me to put on my 16GB Nano 4G. It booted fine. But the thing is the Classic 2G has some headphone hardware that the 1G does not, and this could cause a crash when booting or using. We are more interested in copying the Classic 2G firmware to the Classic 3G since the 3G ships with firmware that has the notes vulnerability patched. [[User:Cmwslw|Cmwslw]] 05:18, 16 August 2010 (UTC)

Thanks for the quick reply! I know about the headphone difference but I still hope that those really tiny chips that are added on the motherboard of the Classic 2G aren't so important that the OS will crash without them. I believe that porting new features to iPods via the original firmware if possible should also be included in this wiki. I do also understand that porting Rockbox on the new iPods is of higher priority and just hope that someone will find some spare time for this. [[User:Wolftail|Wolftail]] 12:55, 16 August 2010 (UTC)

User:Wolftail

2010-08-15T18:54:48Z

Wolftail:

User:Wolftail

2010-08-15T18:45:00Z

Wolftail: Created page with "Hey, there! My name is Lala Ionuț, I live in Romania and I own an iPod Classic 1G (160GB) and can't wait for Rockbox and/or iPodLinux to be available for it. PS: If anyone wil..."

Hey, there!

My name is Lala Ionuț, I live in Romania and I own an iPod Classic 1G (160GB) and can't wait for Rockbox and/or iPodLinux to be available for it.

PS: If anyone will read this... Is it possible to update the 1G Classic (160GB) to the 2.0.x firmware of the 2G/3G Classic? (I know that the hardware is almost a perfect match.) I think it could be done by getting an image of the HDD of an iPod with the new software and overwrite it to the older one. Has anyone tried this? Can it be done?

Thank You very much for all your work!

Firmware

2010-08-15T08:16:57Z

Wolftail: /* Nano 4G */

This article is about the different parts of the iPod's firmware. There is also a very basic analysis of the firmware headers. If you are trying to get a copy of the firmware files, please see [[Dumping firmware]] and [[Extracting firmware]]. NOTE: Please excuse the chaotic layout of this article. It is not very comprehensive, but it's still useful.
==Nano 2G==
===osos===
This is the main firmware image of the iPod. This part has been encrypted ever since the iPod Nano 2G.
[[Image:IN2G firmware osos header.png|thumb|caption]]
[[Image:Firmware layout.png|150px]]
===aupd===
Here is a comparison between the different aupd partitions of firmware version in the iPod Nano 2G:
[[Image:IN2G firmware aupd header.png|thumb|caption]]
[[Image:IN2G cipher aupd diffs.png|500px]]
===rsrc===
This is the resource filesystem of the iPod firmware. It is unencrypted and of not much use to this project.
==Nano 3G==
The Nano 3G has the same ''osos'', ''aupd'', and ''rsrc'' sections as the Nano 2G, but it also has an added ''hash'' section. The ''hash'' section is populated with 0x1800 bytes of 0xFF.
==Classic 1G (6G)==
The Classic 1G has the same firmware structure as the Nano 3G. This makes sense because they were released at the same time.

==Nano 4G==
The Nano 4G kept the ''osos'' but all the old sections were removed. Instead, seven new sections were added:

* Binaries
** ''diag'' - Diagnostic mode. This depends on EFI modules being loaded so it can't be booted directly.
** ''disk'' - Disk mode
* Bitmaps
** ''appl'' - Apple logo for booting
** ''bdhw'' - Bad hardware image
** ''bdsw'' - Bad software image (Use iTunes to restore)
** ''lbat'' - Low battery image
** ''chrg'' - Same as lbat but showing that the iPod is charging

==Helpful pages==
http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf

http://www.ipodlinux.org/wiki/Firmware

Firmware

2010-08-15T08:16:03Z

Wolftail: clarified that 3G means Nano 3G

This article is about the different parts of the iPod's firmware. There is also a very basic analysis of the firmware headers. If you are trying to get a copy of the firmware files, please see [[Dumping firmware]] and [[Extracting firmware]]. NOTE: Please excuse the chaotic layout of this article. It is not very comprehensive, but it's still useful.
==Nano 2G==
===osos===
This is the main firmware image of the iPod. This part has been encrypted ever since the iPod Nano 2G.
[[Image:IN2G firmware osos header.png|thumb|caption]]
[[Image:Firmware layout.png|150px]]
===aupd===
Here is a comparison between the different aupd partitions of firmware version in the iPod Nano 2G:
[[Image:IN2G firmware aupd header.png|thumb|caption]]
[[Image:IN2G cipher aupd diffs.png|500px]]
===rsrc===
This is the resource filesystem of the iPod firmware. It is unencrypted and of not much use to this project.
==Nano 3G==
The Nano 3G has the same ''osos'', ''aupd'', and ''rsrc'' sections as the Nano 2G, but it also has an added ''hash'' section. The ''hash'' section is populated with 0x1800 bytes of 0xFF.
==Classic 1G (6G)==
The Classic 1G has the same firmware structure as the Nano 3G. This makes sense because they were released at the same time.

==Nano 4G==
The Nano 4G kept the ''osos'' but all the old sections were removed. Instead, seven new sections were added:

* Binaries
** ''diag'' - Diagnostic mode. This depends on EFI modules being loaded so it can't be booted directly.
** ''disk'' - Disk mode
* Bitmaps
** ''appl'' - Apple logo for booting
** ''bdhw'' - Bad hardware image
** ''bdsw'' - Bad software image (Use iTunes to restore)
** ''lbat'' - Low battery image** ''chrg'' - Same as lbat but showing that the iPod is charging

==Helpful pages==
http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf

http://www.ipodlinux.org/wiki/Firmware

EmBIOS Monitor Protocol

2010-08-05T20:48:50Z

Wolftail: /* 9: Read from I2C device */

This article describes the USB communcation protocol of emBIOS monitor.

== Endpoints ==

The emBIOS Monitor interface contains 4 bulk endpoints, in the following order:
* Command OUT Endpoint
* Command IN Endpoint
* Data OUT Endpoint
* Data IN Endpoint

If not stated otherwise, everything is little endian.

== General Structure ==
Each packet send to the Command OUT Endpoint has a 16 byte header. The first 4 bytes, interpreted as a 32bit little endian word, contain the command ID. The meaning of the other bytes depends on the command. For commands that send data to the device, it will immediately follow that header.

After sending a packet to the Command OUT Endpoint, listen on the Command IN Endpoint for a response. The response also has a 16 byte header, followed by an optional data stage, depending on the command. The first 4 bytes of the header, interpreted as a 32bit word, is the status code, the meaning of the other bytes depends on the command.

{| class="wikitable prettytable"
|+ Status Codes
|-
! Status Code !! Description
|-
| style="text-align:right" | 0 || Invalid response, you should bail out when receiving this
|-
| style="text-align:right" | 1 || OK (everything went fine)
|-
| style="text-align:right" | 2 || Command not supported
|-
| style="text-align:right" | 3 || Device is busy, retry later (another asynchronous command is already running)
|-
|}

== Commands ==

=== 0: Invalid ===
Never issue this command. It will be rejected with status code 2.

=== 1: Get device information ===
Use this command to figure out various device properties.

==== Get version information ====
{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Requested information type (0)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || SVN Revision Number
|-
| style="text-align:right" | 8 || style="text-align:right" | 1 || Major version
|-
| style="text-align:right" | 9 || style="text-align:right" | 1 || Minor version
|-
| style="text-align:right" | 10 || style="text-align:right" | 1 || Patch version
|-
| style="text-align:right" | 11 || style="text-align:right" | 1 || Software Type ID
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Device Type ID
|-
|}

{| class="wikitable prettytable"
|+ Software Types
|-
! Software Type ID !! Description
|-
| style="text-align:right" | 0 || invalid
|-
| style="text-align:right" | 1 || emBIOS Debugger
|-
|}

{| class="wikitable prettytable"
|+ Hardware Types
|-
! Software Type ID !! Description
|-
| style="text-align:right" | 0 || invalid
|-
| style="text-align:right" | 0x47324e49 || iPod Nano 2G
|-
| style="text-align:right" | 0x47334e49 || iPod Nano 3G
|-
| style="text-align:right" | 0x47344e49 || iPod Nano 4G
|-
| style="text-align:right" | 0x4c435049 || iPod Classic
|-
|}

==== Get packet size information ====
{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Requested information type (1)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 2 || Maximum Command OUT Endpoint packet size
|-
| style="text-align:right" | 6 || style="text-align:right" | 2 || Maximum Command IN Endpoint packet size
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Maximum Data OUT Endpoint packet size
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Maximum Data IN Endpoint packet size
|-
|}

=== 2: Reset ===
Reboot the device.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (2)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Type: Reboot forcibly (0) / Reboot gracefully (1)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

Graceful reboots are asynchronous commands. Forced reboots won't send a response packet before rebooting.

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1 or 3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

The response indicates that the request has been acknowledged, however there might be substantial delay before device actually reboots.

=== 3: Power off ===
Power the device off.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Type: Power off forcibly (0) / Shut down gracefully (1)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

Both variants are asynchronous commands.

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1 or 3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

The response indicates that the request has been acknowledged, however there might be substantial delay before device actually powers off.

=== 4: Read memory ===
Use this command to read small amouts of memory through the command pipe. You may not request a transfer that would exceed the maximum Command IN Endpoint packet size (including the header).

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (4)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to read from
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to be read
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data read from memory
|-
|}

=== 5: Write memory ===
Use this command to write small amouts of memory through the command pipe. You may not request a transfer that would exceed the maximum Command OUT Endpoint packet size (including the header).

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (5)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to write to
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to write
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data to be written
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 6: Read memory using DMA ===
Use this command to read large amouts of memory through the data pipe. You may not request a transfer that would exceed the maximum Data IN Endpoint packet size.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (6)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to read from
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to be read
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

After receiving the response, read the requested data from the Data IN Endpoint.

=== 7: Write memory using DMA ===
Use this command to read large amouts of memory through the data pipe. You may not request a transfer that would exceed the maximum Data OUT Endpoint packet size.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (7)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to write to
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to be written
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

After receiving the response, send the data to be written to the Data OUT Endpoint.

=== 8: Read from I2C device ===
Use this command to read from an I2C slave. You may not request a transfer that would exceed the maximum Command IN Endpoint packet size (including the header) or 255 bytes (excluding the header), whichever is smaller.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (8)
|-
| style="text-align:right" | 4 || style="text-align:right" | 1 || I2C bus index
|-
| style="text-align:right" | 5 || style="text-align:right" | 1 || I2C slave address (in the upper 7 bits)
|-
| style="text-align:right" | 6 || style="text-align:right" | 1 || Start address on the I2C device
|-
| style="text-align:right" | 7 || style="text-align:right" | 1 || Number of bytes to be read
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

I2C transactions are asynchronous commands.

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1 or 3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data read from the I2C device (undefined if the status code is not 1)
|-
|}

=== 9: Write from I2C device ===
Use this command to write to an I2C slave. You may not request a transfer that would exceed the maximum Command OUT Endpoint packet size (including the header) or 255 bytes (excluding the header), whichever is smaller.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (8)
|-
| style="text-align:right" | 4 || style="text-align:right" | 1 || I2C bus index
|-
| style="text-align:right" | 5 || style="text-align:right" | 1 || I2C slave address (in the upper 7 bits)
|-
| style="text-align:right" | 6 || style="text-align:right" | 1 || Start address on the I2C device
|-
| style="text-align:right" | 7 || style="text-align:right" | 1 || Number of bytes to be written
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data to be written to the I2C device
|-
|}

I2C transactions are asynchronous commands.

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1 or 3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 10: Read from the USB console ===
Use this command to get data written to the USB console. You may not request a transfer that would exceed the maximum Command IN Endpoint packet size (including the header).

As long as the console application is running, make sure to issue this request at least once a second. Otherwise the console might start dropping data and inserting an "\n\n[overflowed]\n\n" mark. If you can't receive any data but need to keep the console from dropping data, issue zero-length read requests.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (10)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Number of bytes requested
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Actual number of valid response bytes
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Size of the on-device USB console read buffer
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Number of bytes still waiting in the on-device USB console read buffer
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || Valid console data padded with undefined data to meet the requested size
|-
|}

=== 11: Write to the USB console ===
Use this command to write data to the USB console. You may not request a transfer that would exceed the maximum Command OUT Endpoint packet size (including the header).

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (10)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Number of bytes to be written
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || Data to be written
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Actual number of bytes written (the remainder will have to be resent)
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Size of the on-device USB console write buffer
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Number of bytes still free in the on-device USB console write buffer
|-
|}

EmBIOS Monitor Protocol

2010-08-05T20:47:48Z

Wolftail: /* 5: Read memory */

This article describes the USB communcation protocol of emBIOS monitor.

== Endpoints ==

The emBIOS Monitor interface contains 4 bulk endpoints, in the following order:
* Command OUT Endpoint
* Command IN Endpoint
* Data OUT Endpoint
* Data IN Endpoint

If not stated otherwise, everything is little endian.

== General Structure ==
Each packet send to the Command OUT Endpoint has a 16 byte header. The first 4 bytes, interpreted as a 32bit little endian word, contain the command ID. The meaning of the other bytes depends on the command. For commands that send data to the device, it will immediately follow that header.

After sending a packet to the Command OUT Endpoint, listen on the Command IN Endpoint for a response. The response also has a 16 byte header, followed by an optional data stage, depending on the command. The first 4 bytes of the header, interpreted as a 32bit word, is the status code, the meaning of the other bytes depends on the command.

{| class="wikitable prettytable"
|+ Status Codes
|-
! Status Code !! Description
|-
| style="text-align:right" | 0 || Invalid response, you should bail out when receiving this
|-
| style="text-align:right" | 1 || OK (everything went fine)
|-
| style="text-align:right" | 2 || Command not supported
|-
| style="text-align:right" | 3 || Device is busy, retry later (another asynchronous command is already running)
|-
|}

== Commands ==

=== 0: Invalid ===
Never issue this command. It will be rejected with status code 2.

=== 1: Get device information ===
Use this command to figure out various device properties.

==== Get version information ====
{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Requested information type (0)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || SVN Revision Number
|-
| style="text-align:right" | 8 || style="text-align:right" | 1 || Major version
|-
| style="text-align:right" | 9 || style="text-align:right" | 1 || Minor version
|-
| style="text-align:right" | 10 || style="text-align:right" | 1 || Patch version
|-
| style="text-align:right" | 11 || style="text-align:right" | 1 || Software Type ID
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Device Type ID
|-
|}

{| class="wikitable prettytable"
|+ Software Types
|-
! Software Type ID !! Description
|-
| style="text-align:right" | 0 || invalid
|-
| style="text-align:right" | 1 || emBIOS Debugger
|-
|}

{| class="wikitable prettytable"
|+ Hardware Types
|-
! Software Type ID !! Description
|-
| style="text-align:right" | 0 || invalid
|-
| style="text-align:right" | 0x47324e49 || iPod Nano 2G
|-
| style="text-align:right" | 0x47334e49 || iPod Nano 3G
|-
| style="text-align:right" | 0x47344e49 || iPod Nano 4G
|-
| style="text-align:right" | 0x4c435049 || iPod Classic
|-
|}

==== Get packet size information ====
{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Requested information type (1)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 2 || Maximum Command OUT Endpoint packet size
|-
| style="text-align:right" | 6 || style="text-align:right" | 2 || Maximum Command IN Endpoint packet size
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Maximum Data OUT Endpoint packet size
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Maximum Data IN Endpoint packet size
|-
|}

=== 2: Reset ===
Reboot the device.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (2)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Type: Reboot forcibly (0) / Reboot gracefully (1)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

Graceful reboots are asynchronous commands. Forced reboots won't send a response packet before rebooting.

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1 or 3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

The response indicates that the request has been acknowledged, however there might be substantial delay before device actually reboots.

=== 3: Power off ===
Power the device off.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Type: Power off forcibly (0) / Shut down gracefully (1)
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

Both variants are asynchronous commands.

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1 or 3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

The response indicates that the request has been acknowledged, however there might be substantial delay before device actually powers off.

=== 4: Read memory ===
Use this command to read small amouts of memory through the command pipe. You may not request a transfer that would exceed the maximum Command IN Endpoint packet size (including the header).

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (4)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to read from
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to be read
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data read from memory
|-
|}

=== 5: Write memory ===
Use this command to write small amouts of memory through the command pipe. You may not request a transfer that would exceed the maximum Command OUT Endpoint packet size (including the header).

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (5)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to write to
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to write
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data to be written
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 6: Read memory using DMA ===
Use this command to read large amouts of memory through the data pipe. You may not request a transfer that would exceed the maximum Data IN Endpoint packet size.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (6)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to read from
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to be read
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

After receiving the response, read the requested data from the Data IN Endpoint.

=== 7: Write memory using DMA ===
Use this command to read large amouts of memory through the data pipe. You may not request a transfer that would exceed the maximum Data OUT Endpoint packet size.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (7)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Memory address to write to
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Number of bytes to be written
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

After receiving the response, send the data to be written to the Data OUT Endpoint.

=== 8: Read from I2C device ===
Use this command to read from an I2C slave. You may not request a transfer that would exceed the maximum Command IN Endpoint packet size (including the header) or 255 bytes (excluding the header), whichever is smaller.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (8)
|-
| style="text-align:right" | 4 || style="text-align:right" | 1 || I2C bus index
|-
| style="text-align:right" | 5 || style="text-align:right" | 1 || I2C slave address (in the upper 7 bits)
|-
| style="text-align:right" | 6 || style="text-align:right" | 1 || Start address on the I2C device
|-
| style="text-align:right" | 7 || style="text-align:right" | 1 || Number of bytes to be read
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

I2C transactions are asynchronous commands.

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1 or 3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data read from the I2C device (undefined if the status code is not 1)
|-
|}

=== 9: Read from I2C device ===
Use this command to write to an I2C slave. You may not request a transfer that would exceed the maximum Command OUT Endpoint packet size (including the header) or 255 bytes (excluding the header), whichever is smaller.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (8)
|-
| style="text-align:right" | 4 || style="text-align:right" | 1 || I2C bus index
|-
| style="text-align:right" | 5 || style="text-align:right" | 1 || I2C slave address (in the upper 7 bits)
|-
| style="text-align:right" | 6 || style="text-align:right" | 1 || Start address on the I2C device
|-
| style="text-align:right" | 7 || style="text-align:right" | 1 || Number of bytes to be written
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || The data to be written to the I2C device
|-
|}

I2C transactions are asynchronous commands.

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1 or 3)
|-
| style="text-align:right" | 4 || style="text-align:right" | 12 || Undefined
|-
|}

=== 10: Read from the USB console ===
Use this command to get data written to the USB console. You may not request a transfer that would exceed the maximum Command IN Endpoint packet size (including the header).

As long as the console application is running, make sure to issue this request at least once a second. Otherwise the console might start dropping data and inserting an "\n\n[overflowed]\n\n" mark. If you can't receive any data but need to keep the console from dropping data, issue zero-length read requests.

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (10)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Number of bytes requested
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Actual number of valid response bytes
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Size of the on-device USB console read buffer
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Number of bytes still waiting in the on-device USB console read buffer
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || Valid console data padded with undefined data to meet the requested size
|-
|}

=== 11: Write to the USB console ===
Use this command to write data to the USB console. You may not request a transfer that would exceed the maximum Command OUT Endpoint packet size (including the header).

{| class="wikitable prettytable"
|+ Command Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Command ID (10)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Number of bytes to be written
|-
| style="text-align:right" | 8 || style="text-align:right" | 8 || Should be zero
|-
| style="text-align:right" | 16 || style="text-align:right" | variable || Data to be written
|-
|}

{| class="wikitable prettytable"
|+ Response Packet
|-
! Offset !! Size (bytes) !! Description
|-
| style="text-align:right" | 0 || style="text-align:right" | 4 || Status Code (1)
|-
| style="text-align:right" | 4 || style="text-align:right" | 4 || Actual number of bytes written (the remainder will have to be resent)
|-
| style="text-align:right" | 8 || style="text-align:right" | 4 || Size of the on-device USB console write buffer
|-
| style="text-align:right" | 12 || style="text-align:right" | 4 || Number of bytes still free in the on-device USB console write buffer
|-
|}