8900

So called due to both their magic number and their use on the S5L8900 processor, 8900 files are very basic. Their usage was, as far as is known, to simply provide a wrapper for IMG2 and DMG files. They can only be parsed by iBoot-304 (iPhone OS 2.0 beta 3) or earlier and the S5L8900. Later processors have no support for this format.

File Format

Apple8900 {
   0  uint8[4]     magic             // '8900' in big endian
   4  uint8[3]     version           // '1.0' in big endian
   7  uint8        format            // 1: boot payload encrypted with UID key
                                     // 2: unencrypted boot payload
                                     // 3: generic payload encrypted with key 0x837
                                     // 4: unencrypted generic payload
   8  uint32       --unknown
   C  uint32       payloadLength
  10  uint32       footerSigOffset   // ignoring header
  14  uint32       footerCertOffset  // ignoring header
  18  uint32       footerCertLength
  1C  uint8[32]    salt
  3C  uint16       --unknown
  3E  uint16       epoch
  40  uint8[16]    headerSignature   // SHA1 hash of first 0x40 bytes, truncated to 16 bytes (drop last four)
                                     // AES-128-CBC of above hash with key 0x837 and a zero IV
  50  uint8[0x7B0] padding
 800  uint8[]      payload
????  uint8[]      footerSignature   // `footerCertOffset - footerSigOffset` bytes
????  uint8[]      footerCertificate // `footerCertLength` bytes
}