So called due to both their magic number and their use on the S5L8900 processor, 8900 files are very basic. Their usage was, as far as is known, to simply provide a wrapper for IMG2 and DMG files. They can only be parsed by iBoot-304 (iPhone OS 2.0 beta 3) or earlier and the S5L8900. Later processors have no support for this format.

File Format

Apple8900 {
   0  u8[4]      magic              // '8900' in big endian
   4  u8[3]      version            // '1.0' in big endian
   7  u8         format             // 1: boot payload encrypted with UID key
                                    // 2: unencrypted boot payload
                                    // 3: generic payload encrypted with key 0x837
                                    // 4: unencrypted generic payload
   8  u32        --unknown
   C  u32        payloadLength
  10  u32        footerSigOffset    // ignoring header
  14  u32        footerCertOffset   // ignoring header
  18  u32        footerCertLength
  1C  u8[32]     salt
  3C  u16        --unknown
  3E  u16        epoch
  40  u8[16]     headerSignature    // SHA1 hash of first 0x40 bytes, truncated to 16 bytes (drop last four)
                                    // AES-128-CBC of above hash with key 0x837 and a zero IV
  50  u8[0x7B0]  padding
 800  u8[]       payload            // typically an IMG2 or DMG file
????  u8[]       footerSignature    // `footerCertOffset - footerSigOffset` bytes
????  u8[]       footerCertificate  // `footerCertLength` bytes