Dumping firmware

The first step to examining iPod's firmware is getting an image of it. You can retrieve either retrieve an image from the iPod or from the internet.

From the iPod

iPod nano (2nd generation)

Getting a firmware dump of a iPod nano (2nd generation) is easy on both Linux and macOS. It is stored on a hidden partition of the NAND flash. First, make sure the iPod is plugged in and Enable disk use is checked in iTunes/Finder.

Linux

• Use the lsblk command to find out the partition ID:

$ lsblk
NAME                        MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINTS
[...]
sda                           8:0    1  1,9G  0 disk  
├─sda1                        8:1    1   94M  0 part  
└─sda2                        8:2    1  1,8G  0 part  

In this case, the firmware partition is the smaller of the two, i.e. sda1.

• Use the sudo dd if=/dev/sda1 status=progress > firmware.mse command to dump the firmware to a file.

macOS

• Use the diskutil list command to find out the disk ID:

$ diskutil list
[...]
/dev/disk6 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *2.0 GB     disk6
   1:                 DOS_FAT_32 MY IPOD                 1.9 GB     disk6s2

• Unlike Linux, macOS does not show the hidden firmware partition. Note the disk ID, in this case disk6. Then use the sudo fdisk /dev/disk6 command to list the partition table.

$ sudo fdisk /dev/disk6
Password:
Disk: /dev/disk6	geometry: 983/16/63 [991232 sectors]
Sector size: 2048 bytes
Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 2: 0B    3   0   1 -   61 178  52 [     48195 -     943036] Win95 FAT-32
 3: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused      

Even though it's there, the firmware partition's properties are not listed. So we take another approach: calculate them using partition 2. The firmware partition always starts at sector 63, so its size is: 48195 - 63 = 48132. You also need to provide the Sector size, in this case 2048.

• Use the sudo dd if=/dev/disk6 status=progress bs=2048 skip=63 count=48132 > firmware.mse command to dump the firmware to a file.

Verifying the dump

• To verify the dump, use the head -c 256 firmware.mse | hexdump -C command. You should see something like this if successful:

00000000  7b 7b 7e 7e 20 20 2f 2d  2d 2d 2d 2d 5c 20 20 20  |{{~~  /-----\   |
00000010  7b 7b 7e 7e 20 2f 20 20  20 20 20 20 20 5c 20 20  |{{~~ /       \  |
00000020  7b 7b 7e 7e 7c 20 20 20  20 20 20 20 20 20 7c 20  |{{~~|         | |
00000030  7b 7b 7e 7e 7c 20 53 20  54 20 4f 20 50 20 7c 20  |{{~~| S T O P | |
00000040  7b 7b 7e 7e 7c 20 20 20  20 20 20 20 20 20 7c 20  |{{~~|         | |
00000050  7b 7b 7e 7e 20 5c 20 20  20 20 20 20 20 2f 20 20  |{{~~ \       /  |
00000060  7b 7b 7e 7e 20 20 5c 2d  2d 2d 2d 2d 2f 20 20 20  |{{~~  \-----/   |
00000070  43 6f 70 79 72 69 67 68  74 28 43 29 20 32 30 30  |Copyright(C) 200|
00000080  31 20 41 70 70 6c 65 20  43 6f 6d 70 75 74 65 72  |1 Apple Computer|
00000090  2c 20 49 6e 63 2e 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |, Inc.----------|
000000a0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 2d  |----------------|
*
000000f0  2d 2d 2d 2d 2d 2d 2d 2d  2d 2d 2d 2d 2d 2d 2d 00  |---------------.|
00000100

iPod nano (3rd generation) and newer

To dump the firmware of any iPod classic (6th generation) or iPod nano (3rd generation) or later, you need to run own code on the device to be able to dump the flash with the firmware code on it. We don't have a ready-made guide for this yet, as development of the software needed is still in progress.

From the internet

You can download pretty much every firmware version from these websites:

• http://www.felixbruns.de/iPod/firmware/
• https://theapplewiki.com/wiki/Firmware/iPod#iPod_nano
• https://appledb.dev/device-selection/iPods.html

These files are called .ipsw files, but they are really .zip files in disguise. Open the .ipsw file as a .zip file, and you can view it's contents.

iPod nano (1st generation), iPod nano (2nd generation) and iPod nano (3rd generation) firmware structure

Filename	Description
Firmware-XX.X.X[.X]	The actual firmware file
manifest.plist	An XML file that gives basic info about the Firmware. Probably for iTunes.

Depending on the firmware version, there are either 3 or 4 elements of the version number. First one is the iTunes model ID, the next one is either 8 or 9 and the last 1 or 2 match the ipsw version number.

You can copy over the Firmware-* file and that is the same as extracting a firmware.mse file from the iPod.

iPod nano (4th generation) and later firmware structure

The iPod nano (4th generation) and later seem to have a different structure with an interesting new file:

Filename	Description
Firmware.MSE	The actual firmware file containing encrypted osos, etc.
manifest.plist	An XML file that gives basic info about the Firmware. Probably for iTunes.
N58s.bootloader[.release].rb3	IMG1 containing encrypted bootloader.

On iPod nano (7th generation) the .release part of the filename is left off.

Helpful pages

https://web.archive.org/web/20150226052553/http://home.gna.org/linux4nano/download/crypto_synth-1.0.pdf

http://www.ipodlinux.org/Firmware.html

https://web.archive.org/web/20111227131446/http://www.trejan.com/projects/ipod/phobos.html#REGFIRMWARE