Main Page

emCORE r779 on iPod nano (2nd generation), iPod nano (4th generation) and iPod classic (6th generation)

This is the wiki for the freemyipod project. Freemyipod is a project aimed at reverse-engineering non-iOS iPods (all models other than the Touch) and creating tools and documentation so that other people can port alternative firmwares to them such as rockbox or Linux. Freemyipod is a relaunch of Linux4nano.

FAQ

What can I do with my iPod nano (2nd generation), iPod classic or older iPods?

There's an upstream Rockbox port for these devices. Go use that.

What can I do with my iPod nano (3rd generation) or newer?

Not much (yet) unless you're an embedded developer :).

On the 3rd, 4th and 5th generation, we have a stable tethered exploit (wInd3x) which allows early, untethered and safe (no permanent modification) code execution. This in turn allows you to run U-Boot and an early Linux port or experiment with reverse-engineering/modifying the original firmware, retailOS.

On the 6th and 7th generation, a font parsing vulnerability (CVE-2010-1797) can be exploited with ipod_sun.

On the 7th generation (and possibly 6th generation), a vulnerability in DFU_DNLOAD packet parsing code can be exploited with S5Late.

There's a set of earlier tooling (emCORE/emBIOS/iBugger) which was exploiting other vulnerabilities and was a lead-up to a port of Rockbox, but it's mostly abandoned.

Getting an account

Due to spambots, registration is closed. For an account contact User890104 or q3k.

Updates

• 2025-12-26 - Some of us will be at 39C3 in Hamburg! Get in touch with q3k and/or Slackware if you're around!
• 2025-06-12 - Some of us will be at GPN23 in Karlsruhe! More info here. Let us know on IRC/Discord/Matrix if you're also there!
• 2024-12-25 - Some of us will be at 38C3 in Hamburg! Come say hi!
• 2024-12-16 - S5Late, a tethered iPod bootrom/DFU exploit for Nano 7G (and possibly Nano 6G), is released.
• 2023-12-28 - ipod_sun, a tool that enables code execution on the iPod nano 6th and 7th generation, is released.
• 2023-01-07 - A preliminary U-Boot port to the Nano 5G has been developed.

Follow our Twitter feed to get status updates automatically. See the Status page for more detailed information. Check our SVN activity page for the latest changes to our source code.

Project info Status Contact Contributing Released Software wInd3x ipod_sun U-Boot port Linux port Legacy: iBugger iLoader emCORE

Basic skills Working with binaries Dumping firmware Extracting firmware Firmware downgrading Troubleshooting Reverse engineering results Firmware BootROM Boot Process Firmware decryption Flash Translation Layer retailOS retailOS Options GUID table JTAG Nano 2G Nano2G clock gates‎ Nano2G LCD init Nano2G HW analysis S5L8701 analysis Nano 4G Nano4G firmware upgrade process Nano 5G General Other guides Modes

Hardware Hardware iPod nano (1st generation) iPod nano (2nd generation) iPod nano (3rd generation) iPod nano (4th generation) 920-0614-03 iPod nano (5th generation) iPod nano (6th generation) iPod nano (7th generation) iPod classic (6th generation) Chronology S5L8700 datasheet Exploiting wInd3x Pwnage 2.0 Notes vulnerability Address bruteforcing Nanotron 3000