Contents
- 1. Tag Format
- 1. IMG3
- 1. IMG3
- 2. Example Tag
- 3. Known Values
The TYPE tag is a four byte little endian string that states what type of firmare image the payload is.
Tag Format
IMG3
Img3TypeTag {
0 u32 magic // 'EPYT' ('TYPE' in little endian)
4 u32 fullSize // including header and padding
8 u32 size // including padding
C u32 value
10 u8[] padding // optional
}Example Tag
The following tag is from the AppleLogo payload from the 10.0.1 (build 14A403) build for the iPad 4 (iPhone3,6).
| Offset | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | A | B | C | D | E | F | ASCII | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 10 | 45 | 50 | 59 | 54 | 20 | 00 | 00 | 00 | 04 | 00 | 00 | 00 | E | P | Y | T | . | . | . | . | . | . | . | ||||||||||
| 20 | 6F | 67 | 6F | 6C | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | 00 | o | g | o | l | . | . | . | . | . | . | . | . | . | . | . | . | |
| 30 | 00 | 00 | 00 | 00 | . | . | . | . | |||||||||||||||||||||||||
| Offset | Length | Explanation |
|---|---|---|
| 0x14 | 4 | magic: When interpreted in little endian order, these bytes give the string, TYPE. |
| 0x18 | 4 | fullSize: This tag is 0x20 (32) bytes long. |
| 0x1C | 4 | size: The actual payload (including padding) is 4 bytes long. |
| 0x20 | 4 | value: The actual value of the tag. When interpreted in little endian order, this gives the ASCII string LOGO (indicating that it's an AppleLogo file). |
| 0x24 | 16 | padding |
Known Values
The value (located at relative offset 0xC) specifies what payload is contained in this file. It is stored in little endian form, but presented in big endian; Reverse the four bytes to get the stored form. These are the known possible values, sorted by value:
0x00(four null bytes): Anything (any image type)acfw: Audio Codec Firmwareacib: ACI Bluetooth Firmwareaciw: ACI Wi-Fi Firmwarealmo: Alamoanef: Apple Neural Engineansf: ANSFaopf: "Always On Processor" Firmwareauac: Accessibility Chimeaubt: Boot Chimeaupr: Attach Chimeauxk: Auxiliary Kernelcacheavef: Apple Audio/Video Encoderbat0: BatteryLow0bat1: BatteryLow1batF: BatteryFullbstc: Base System TrustCachecfel: CFE Loadercgh0: BatteryCharging0chg1: BatteryCharging1ciofcsys: Base System Volume Root Hashdaig: Diagsdali: DALIdcpfdtre: DeviceTreedtrs: EngineeringTrustCachefdrs: FDR Trust Object for SEPfdrt: FDR Trust Object for APgfxf: Graphics (GFX) FirmwareglyC: GlyphChargingglyP: GlyphPluginhmmr: PE Hammerhomr: Homer Firmwarehypr: Hypervisoribdt: iBoot Dataibec: iBoot Epoch Change (iBEC)ibot: iBoot stage 2ibss: iBoot Single Stage (iBSS)ienv: Environment Variablesillb: Low Level Bootloader (LLB; iBoot stage 1)ipdf: Input Deviceispf: ISP Firmwareisys: System Volume Root Hashitst: iBootTestkrnl: Kernelcachelckr: System Lockerlogo: AppleLogolphp: Leap Hapticslpollpw0: LowPowerWallet0lpw1: LowPowerWallet1lpw2: LowPowerWallet2ltrs: LoadableTrustCachemagg: Apple Maggie (vibration motor controller)mefi: Mac EFImsys: System Volume Canonical Metadatamtfw: Multitouch Firmwarensrv: NeedServicensrvosrd: OS Ramdiskpdmg: Personalized DMGpert: PERT OSphlt: PHLEETpmpf: Power Management Processor (PMP)rans: RANSrbmt: RBMrciordcprdsk: Restore Ramdiskrdtr: Restore DeviceTreerecm: RecoveryModerkrn: Restore Kernelcacherlgo: Restore AppleLogorosi: Restore OSrpmprsep: Restore SEP Firmware (secure enclave processor)rtmurtpf: RTPrtsc: Restore TrustCachescef: SCEsepi: SEP Firmware (secure enclave processor)siof: SmartIO Firmwaretmuftrst: TrustCachetsys: TSYS Testerwchf: Wireless Charging Controllerxbtc: x86 Base System TrustCachexsys: x86 System Volume Root Hash