8900

So called due to both their magic number and their use on the S5L8900 processor, 8900 files are very basic. Their usage was, as far as is known, to simply provide a wrapper for IMG2 and DMG files. They can only be parsed by iBoot-304 (iPhone OS 2.0 beta 3) or earlier and the S5L8900. Later processors have no support for this format.

File Format

Apple8900 {
   0  u8[4]      magic              // '8900' in big endian
   4  u8[3]      version            // '1.0' in big endian
   7  u8         format             // 1: boot payload encrypted with UID key
                                    // 2: unencrypted boot payload
                                    // 3: generic payload encrypted with key 0x837
                                    // 4: unencrypted generic payload
   8  u32        --unknown
   C  u32        payloadLength
  10  u32        footerSigOffset    // ignoring header
  14  u32        footerCertOffset   // ignoring header
  18  u32        footerCertLength
  1C  u8[32]     salt
  3C  u16        --unknown
  3E  u16        epoch
  40  u8[16]     headerSignature    // SHA1 hash of first 0x40 bytes, truncated to 16 bytes (drop last four)
                                    // AES-128-CBC of above hash with key 0x837 and a zero IV
  50  u8[0x7B0]  padding
 800  u8[]       payload            // typically an IMG2 or DMG file
????  u8[]       footerSignature    // `footerCertOffset - footerSigOffset` bytes
????  u8[]       footerCertificate  // `footerCertLength` bytes
}