So called due to both their magic number and their use on the S5L8900 processor, 8900 files are very basic. Their usage was, as far as is known, to simply provide a wrapper for IMG2 and DMG files. They can only be parsed by iBoot-304 (iPhone OS 2.0 beta 3) or earlier and the S5L8900. Later processors have no support for this format.

File Format

Apple8900 {
   0  uint8[4]     magic             // '8900' in big endian
   4  uint8[3]     version           // '1.0' in big endian
   7  uint8        format            // 1: boot payload encrypted with UID key
                                     // 2: unencrypted boot payload
                                     // 3: generic payload encrypted with key 0x837
                                     // 4: unencrypted generic payload
   8  uint32       --unknown
   C  uint32       payloadLength
  10  uint32       footerSigOffset   // ignoring header
  14  uint32       footerCertOffset  // ignoring header
  18  uint32       footerCertLength
  1C  uint8[32]    salt
  3C  uint16       --unknown
  3E  uint16       epoch
  40  uint8[16]    headerSignature   // SHA1 hash of first 0x40 bytes, truncated to 16 bytes (drop last four)
                                     // AES-128-CBC of above hash with key 0x837 and a zero IV
  50  uint8[0x7B0] padding
 800  uint8[]      payload
????  uint8[]      footerSignature   // `footerCertOffset - footerSigOffset` bytes
????  uint8[]      footerCertificate // `footerCertLength` bytes