8900

So called due to both their magic number and their use on the S5L8900 processor, 8900 files are very basic. Their usage was, as far as is known, to simply provide a wrapper for IMG2 and DMG files. They can only be parsed by iBoot-304 (iPhone OS 2.0 beta 3) or earlier and the S5L8900. Later processors have no support for this format.

File Format

All file offsets are in hexadecimal, and all values except magic and version are stored in little endian.

Apple8900 {
   0  uint8[4]  magic;   // "8900" in big endian
   4  uint8[3]  version; // "1.0" in big endian
   7  uint8     format;  // 0x1: boot payload encrypted with UID key
                         // 0x2: unencrypted boot payload
                         // 0x3: payload encrypted with Key 0x837
                         // 0x4: unencrypted payload
   8  uint32;
   C  uint32    payloadLength;
  10  uint32    footerSigOffset;  // ignoring header
  14  uint32    footerCertOffset; // ignoring header
  18  uint32    footerCertLength;
  1C  uint8[32] salt;
  3C  uint16;
  3E  uint16    epoch;
  40  uint8[16] headerSig;  // aes128cbc(sha1(file[0:0x40])[0:0x10], Key0x837, ZeroIV)
  50  uint8[0x7B0] pad;
 800  uint8[]   payload;    // sizeof(payload) == payloadLength
????  uint8[]   footerSig;  // sizeof(footerSig) == footerCertOffset - footerSigOffset
????  uint8[]   footerCert; // sizeof(footerCert) == footerCertLength
}