ByteFau1t

ByteFau1t Vulnerability

ByteFau1t is a flaw in the IMG1 partition-type handling logic inside the SecureROM of the iPod nano (7th generation). The bug causes the integrity verification step for certain IMG1 images to be skipped, allowing modified data inside the rsrc partition to load without any signature checks.

The issue was discovered by Fong and publicly disclosed on 30 June 2025.

Affected Devices

Device	Vulnerable?	Notes
iPod nano 7G (2012)	Yes	Verified working
iPod nano 7G (rev A)(2015)	Yes	Same SecureROM code path
iPod nano 6G	?	Early tests suggest it does not work
Other S5L-based devices	Unknown	No confirmed evidence

Summary

The vulnerability is triggered by modifying the *format byte* inside the IMG1 header stored within the rsrc partition. Inside the IPSW, this byte is found in the MSE file. There is only one instance of the signature:

 38 37 34 30 32 2E 30 04

The final byte (04) represents an *unencrypted + signed* IMG1 image. Changing it to 03 marks the image as *encrypted + signed*.

When SecureROM processes an IMG1 image marked as encrypted (03) but whose contents are actually unencrypted, it enters an alternative decryption-handling path. This path has an unhandled condition for unencrypted data, causing the entire integrity verification step to be skipped. As a result, SecureROM accepts and loads modified IMG1 data as if it were valid.

What ByteFau1t Allows

• Modification of rsrc contents without using any previous untethered exploits And it doesn't require pressing any buttons.

ByteFau1t does **not** provide full SecureROM code execution, but it enables UI customization, resource patching, and limited modification of system content embedded in rsrc.

Technical Details

• The MSE file holds multiple IMG1 headers
• The format byte determines the SecureROM decryption/verification path
• The “encrypted + signed” path (03) expects a specific internal decoder state
• Feeding unencrypted data into this path results in an inconsistent state
• In this state, the final cryptographic integrity check is skipped entirely
• SecureROM proceeds as though the image were verified

This is a logic flaw, not a memory-corruption vulnerability.

Status / Fix

Property	Value
Fixed in	Not fixed
Patched devices	None
Discovered by	Fong
Disclosed	30 June 2025

Nano 6G Possibility

Attempts to apply the method to the iPod nano 6G were unsuccessful. Nano 6 SecureROM uses a probably different circuit. Current research status: incompatible.