Contents
- 1. Tag Format
- 1. IMG3
- 1. IMG3
- 2. Example Tag
- 3. Known Values
The TYPE
tag is a four byte little endian string that states what type of firmare image the payload is.
Tag Format
IMG3
Img3TypeTag { 0 u32 magic // 'EPYT' ('TYPE' in little endian) 4 u32 fullSize // including header and padding 8 u32 size // including padding C u32 value 10 u8[] padding // optional }
Example Tag
The following tag is from the AppleLogo payload from the 10.0.1 (build 14A403) build for the iPad 4 (iPhone3,6
).
Offset | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | A | B | C | D | E | F | ASCII | ||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
10 | 45 | 50 | 59 | 54 | 20 | 00 | 00 | 00 | 04 | 00 | 00 | 00 | E | P | Y | T | . | . | . | . | . | . | . | ||||||||||
20 | 6F | 67 | 6F | 6C | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | o | g | o | l | . | . | . | . | . | . | . | . | . | . | . | . | |
30 | 00 | 00 | 00 | 00 | . | . | . | . |
Offset | Length | Explanation |
---|---|---|
0x14 | 4 | magic : When interpreted in little endian order, these bytes give the string, TYPE . |
0x18 | 4 | fullSize : This tag is 0x20 (32) bytes long. |
0x1C | 4 | size : The actual payload (including padding) is 4 bytes long. |
0x20 | 4 | value : The actual value of the tag. When interpreted in little endian order, this gives the ASCII string LOGO (indicating that it's an AppleLogo file). |
0x24 | 16 | padding |
Known Values
The value
(located at relative offset 0xC
) specifies what payload is contained in this file. It is stored in little endian form, but presented in big endian; Reverse the four bytes to get the stored form. These are the known possible values, sorted by value
:
0x00
(four null bytes): Anything (any image type)acfw
: Audio Codec Firmwareacib
: ACI Bluetooth Firmwareaciw
: ACI Wi-Fi Firmwarealmo
: Alamoanef
: Apple Neural Engineansf
: ANSFaopf
: "Always On Processor" Firmwareauac
: Accessibility Chimeaubt
: Boot Chimeaupr
: Attach Chimeauxk
: Auxiliary Kernelcacheavef
: Apple Audio/Video Encoderbat0
: BatteryLow0bat1
: BatteryLow1batF
: BatteryFullbstc
: Base System TrustCachecfel
: CFE Loadercgh0
: BatteryCharging0chg1
: BatteryCharging1ciof
csys
: Base System Volume Root Hashdaig
: Diagsdali
: DALIdcpf
dtre
: DeviceTreedtrs
: EngineeringTrustCachefdrs
: FDR Trust Object for SEPfdrt
: FDR Trust Object for APgfxf
: Graphics (GFX) FirmwareglyC
: GlyphChargingglyP
: GlyphPluginhmmr
: PE Hammerhomr
: Homer Firmwarehypr
: Hypervisoribdt
: iBoot Dataibec
: iBoot Epoch Change (iBEC)ibot
: iBoot stage 2ibss
: iBoot Single Stage (iBSS)ienv
: Environment Variablesillb
: Low Level Bootloader (LLB; iBoot stage 1)ipdf
: Input Deviceispf
: ISP Firmwareisys
: System Volume Root Hashitst
: iBootTestkrnl
: Kernelcachelckr
: System Lockerlogo
: AppleLogolphp
: Leap Hapticslpol
lpw0
: LowPowerWallet0lpw1
: LowPowerWallet1lpw2
: LowPowerWallet2ltrs
: LoadableTrustCachemagg
: Apple Maggie (vibration motor controller)mefi
: Mac EFImsys
: System Volume Canonical Metadatamtfw
: Multitouch Firmwarensrv
: NeedServicensrv
osrd
: OS Ramdiskpdmg
: Personalized DMGpert
: PERT OSphlt
: PHLEETpmpf
: Power Management Processor (PMP)rans
: RANSrbmt
: RBMrcio
rdcp
rdsk
: Restore Ramdiskrdtr
: Restore DeviceTreerecm
: RecoveryModerkrn
: Restore Kernelcacherlgo
: Restore AppleLogorosi
: Restore OSrpmp
rsep
: Restore SEP Firmware (secure enclave processor)rtmu
rtpf
: RTPrtsc
: Restore TrustCachescef
: SCEsepi
: SEP Firmware (secure enclave processor)siof
: SmartIO Firmwaretmuf
trst
: TrustCachetsys
: TSYS Testerwchf
: Wireless Charging Controllerxbtc
: x86 Base System TrustCachexsys
: x86 System Volume Root Hash