Contents
- 1. File Format
So called due to both their magic number and their use on the S5L8900 processor, 8900 files are very basic. Their usage was, as far as is known, to simply provide a wrapper for IMG2 and DMG files. They can only be parsed by iBoot-304 (iPhone OS 2.0 beta 3) or earlier and the S5L8900. Later processors have no support for this format.
File Format
Apple8900 { 0 uint8[4] magic // '8900' in big endian 4 uint8[3] version // '1.0' in big endian 7 uint8 format // 1: boot payload encrypted with UID key // 2: unencrypted boot payload // 3: generic payload encrypted with key 0x837 // 4: unencrypted generic payload 8 uint32 --unknown C uint32 payloadLength 10 uint32 footerSigOffset // ignoring header 14 uint32 footerCertOffset // ignoring header 18 uint32 footerCertLength 1C uint8[32] salt 3C uint16 --unknown 3E uint16 epoch 40 uint8[16] headerSignature // SHA1 hash of first 0x40 bytes, truncated to 16 bytes (drop last four) // AES-128-CBC of above hash with key 0x837 and a zero IV 50 uint8[0x7B0] padding 800 uint8[] payload ???? uint8[] footerSignature // `footerCertOffset - footerSigOffset` bytes ???? uint8[] footerCertificate // `footerCertLength` bytes }