File Descriptions
0000C18A61A80013A.7z
An almost complete 7zip archive, with two sections of zeroed bytes, one of which is the end of the file. The password for this archive was supposed to be vincenza.
1632.40..tar.xz
An XZ compressed tarball which contains two directories, each with a single file inside. Both are SEPOS dumps for A12Z (t8027) on the DTK (t485). As one might guess, the directory names are the version numbers.
1632.40.29/AppleSEPOS.t485ap.release-1632.40.29: Uploaded previously aseven_more_fake.tar.xz1632.40.31/sep-firmware.t485.RELEASE
3777.7z
Inside is another archive 1337.7z with the same password. This archive contains the development build of iBoot, the IDA database, and the patched iBoot from ThatsNotIt.7z.
5s-X.7z
0001C6D112488402E.7z
Contains the zip archive DVT_diag_image_15A783601y~Tigris.zip, which is a filesystem dump from an iPhone10,3 (d22) running Non-UI iOS 11.0 (15A783601y). The same dump is extracted to the directory Tigris 15A783601y in this archive. There is also a file DVT_diag_fs, which has no data.
0001C15442439083A.7z
Contains the Gzip compressed tarball 13.0UI-t8010-t8015.tar.gz, which has a filesystem dump from an iPhone10,1 (d20) running internal UI iOS 13.0 (17A508) under the path /Users/noname/MEGA/13.0 UI D211AP/. There is also the file UI_with_usable_rsep, which has no data, and the directory Users/, which contains a file FSCl-F6G726203XXHM9C6WD and the empty directory noname/MEGA/.
D22AP_pvt_rev_a.7z
Contains an im4p for iBoot version 5540.0.117.3, uploaded previously in ZukonTools.7z/A11Preboot/.
generic.7z
A SEPOS dump version 806.200.118 for the A11 (t8015), uploaded previously as SCAM.tar.xz
A12.7z
iPad.7z
Contains the directory j273ap/, and a bookmark for the file dtk_11.0_20A5374.internal.ipsw (found in OS.7z). j273ap/ contains the following files:
sep-firmware.im4m,sep-firmware.im4p,sep-firmware.img4: The manifest, payload, and complete img4 file for SEP.apticket.der: The same assep-firmware.im4m.iboot_firmware_j217ap: An img4 for iBoot version 4513.250.214.100.5 for iPad11,3 (j217).iboot.j217ap.dev.i64/iboot.j217ap.dev.i64.zip: An IDA database for iBoot.illb22: A development build of iBoot version 4513.250.214.100.5 for iPad11,3 (j217).AppleSMCFirmware-1631.40.72.ipad8.DBG.dump/AppleStorageProcessorANS2-177.250.8~20.dump: Firmware extracted from iBoot.- Some other files related to the device tree for a j218ap.
j273ap/ also contains the directory SEP_BOOTS_AND_KRNL/, with two subdirectories, Bootables/ and SEPOS/. Bootables/ contains files for iBoot version 6723.40.86.0.5 built for the DTK (j273a):
iBEC.j273a.RELEASE: iBootStage2 decrypted.iBSS.j273a.RELEASE: iBootStage1 decrypted.NOTE: A text file with the contents:
SEPOS/ contains files related to the file SepOS-.j273ap.release~1632.40.29, which is a dump of SEPOS version 1632.40.29 for A12Z (t8027) on the DTK (j273a):
j273a.AppleSEPOS-1632.40.29.7z: A 7zip archive of the same SEPOS dump, with a different name.SepOS-.j273ap.release~1632.40.29-cutoff: A cutoff version of the dump.- Two IDA databases, one that is a part of an open workspace.
- A directory
split/with another copy of the SEPOS dump and a component disassembly.
iPhone.7z
Contains the following files:
SOC-INFO.txt: A text log of commands and their output from diags run on an iPhone11,4 (d331).SwitchBoard.7z: A bookmark for a file of the same name (found inOS.7z).Xs-Xr~Diags.7z: Contains the directory001D358E389A493A, with three subdirectories:AppleInternal/: The/AppleInternal/directory from an iPhone11,4 (d331) running a Non-UI variant of iOS.DVT_DIAGS_IMAGE/: A duplicate of theDiags/directory from the previously mentioned/AppleInternal/, with a couple small differences:bin/lacks the binarydiagXs.Menu/lacks the directoriesD2x,D4xandSkyeA0.
sepi/: Contains the following files:D321.debug~AppleSEPOS-806.200.75.dump: A dump of SEPOS version 806.200.75 for A12 (t8020) on iPhone11,2 (d321).sep-firmware.im4m,sep-firmware.im4p,sep-firmware.img4: The manifest, payload, and complete img4 file for SEP.sepi.asn1.txt: Output from$ openssl asn1parse.raw-sepi.img4-contents.dump: A mostly hex view of the SEP img4.Split.zip: A zip archive which is also extracted to a subdirectory insepi, which contains a disassembly of the SEPOS found in the same directory into its components, as well as the Python scriptsp.py. The extracted version of the folder also contains the files a cutoff version of the dump and an IDA database for the dump.
XsUI.tar.gz: A filesystem dump from an iPhone11,2 running internal UI iOS 12.1 (16B92) but with incorrect permsissions.Xs_dvt_variant_c_Approx-13.4-beta-4~17E5249a.7z: Uploaded previously in ZukonTools.7z/Xs_dvt_variant_c_Approx-13.4-beta-4~17E5249a/.Xs_UI~12.7z: The same filesystem dump fromXsUI.tar.gz, but symbolic links are not preserved.
Other_.tar.gz
A Gzip compressed tarball with the directories SEPOS/ and update/. SEPOS/ contains the following directories:
XR-Release-1267.100.68.0.1/: Containsn841~AppleSEPOS-1267.100.68.0.1, a dump of SEPOS version 1267.100.68.0.1 for A12 (t8020) on iPhone11,8 (n841), a cutoff version of the same dump, an im4p for the SEP firmware,asn1.txtwhich contains the viewed contents of the im4p, anddecrypt.txtwhich contains the IV and Key for decrypting the SEP payload, as originally published by Siguza on Twitter. There is also a directorySplit, containing another copy of this SEPOS dump and its component disassembly.XS-Proto-01-806.200.75/: Contains the directory001D358E389A493A, with the same contents asiPhone.7z/Xs-Xr~Diags.7z/sepi/, excluding the cutoff SEPOS dump and IDA database.XsMax-806.200.25.100.6-EVT/: ContainsSOC-INFO.txt, which is the same file fromiPhone.7z, and the directorysepi_dump/.sepi_dump/containsAppleSEPOS-806.200.25.100.6.dump, a dump of debug SEPOS version 806.200.25.100.6 for A12 (t8020) for iPhone11,4 (d331), a cutoff version of this dump, the imageSections.png, and aSplitdirectory with another copy of the SEPOS dump and its component disassembly.
update/ contains the directory update/Xs_/xs_MobileSoftwareUpdate/ which has files from an OTA update.
A12x-A12z.7z
Contains a Gzip compressed tarball of the same name. Within the tarball there is the bookmark dtk_20A5374internal.ipsw (found in OS.7z), and three subdirectories.
A12z/t485ap/
Contains AppleSEPOS.t485ap.release-1632.40.29, a dump of SEPOS version 1632.40.29 for A12Z (t8027) on the DTK (t485), previously uploaded in even_more_fake.tar.xz, as well as a cutoff version, an IDA database, and a component disassembly with the Python script pysep. There is also a bootables/ subdirectory. It contains AppleStorageProcessorANS2-1161.40.15~115.dump, a StorageProcessor firmware extracted from iBoot, and the iBEC and iBSS files previously uploaded in fakebullshit.tar.xz.
SEPROM/
Contains SEPROM-t8027si/SEPROM-t8027si-1, both the same SEPROM previously uploaded as Suprise.7z, an IDA database for the SEPROM, Apple-Secure-Boot-Root-CA-G2.der/Apple Secure Boot Root CA - G2.der, and the empty subdirectory out/.
t8027si/A12x
The parent directory t8027si/ contains duplicate copies of A12z/t485ap/ and SEPROM/. A12x/ contains MVP.png, which appears to be a picture of an open iPad8,5, with it's very identifiable A12X processor in the center. There are three subdirectories in A12x/:
-
j320ap/: Contains files related toLLB.17B50.J320.DEVELOPMENT, a development build of iBoot version 5540.40.46 built for iPad8,5 (j320).LLB.17B50.J320.i64/LLB.17B50.J320.i64.zip/LLB.17B50.J320.sqlite: An IDA database for the iBoot build.AppleSMCFirmware-798.250.230.100.2.ipad11.DBG.dump/AppleStorageProcessorANS2-717.40.5~188.dump: Firmware extracted from iBoot.SEP_BOOTS_KRNL: A bookmark to the directorySEP_BOOTS_AND_KRNL/(found inA12.7z/iPad.7z/j273ap/).
mlb-820-01325-08-EVT/: This directory is filled with images of the development board we can assume everything inj320ap/is from, as well as the text filemlb.txtwith a transcription of some of the board and chip labels.SwitchBoard/: Contains two directories,iboot_firmware/andt8027/.iboot_firmware/containsiBoot.j321ap~Development.4513.200.204.100.6.img4, an img4 for development iBoot version 4513.200.204.100.6,iBoot_firmware, an img4 with the same payload as the development iBoot as well as a payload for "EmbeddedImages-73.200.4", andiboot_partition.txt, a text file with a display of the img4 contents in a viewer.t8027/contains a filesystem dump of an iPad8,3 (j318) running NonUI iOS 12.0 (16A63060n). The contents of an updated/private/var/(based on log modification dates) was copied to the root directory, and symlinks are not preserved. A version of this dump that does not have a copy of/private/var/in the root can be found inSYNCP.7z/FS/.
A13_.7z
Contains the directory t8030si/, with SepSections.png and SysCFG_and_EDTables_Factory_default.txt alongside four Gzip compressed tarballs. SepSections.png is a screenshot of lldb being used to dump the sections of the SEPOS dump SepOS.debug.d421ap~1134.0.0.100.1.dump.cutoff. SysCFG_and_EDTables_Factory_default.txt is a text log of commands and their output from diags run on a A13 (t8030) device. The contents of the four tarballs are below:
0000C18A61A80013A.tar.gz
Not yet finished
0000D686C1E80012E.tar.gz
Not yet finished.
0001621600240012E.tar.gz
Only contains a bookmark for the file 14.0~UI.t8020si-t8030si.ipsw (found in OS.7z as 14.0~UI.t8020si-t8030si.7z), and the file UI, which contains no data.
backupA13FS.tar.gz
A partial filesystem dump from an iPhone12,3 (d421) running some very weird build of iOS 14.0 (17S42550e). This dump has the root filesystem moved to the directory /private/var/ as a result of being dumped via ramdisk, and is modified a considerable bit with files and whole directories missing, such as any kernelcache as well as the original contents of /private/var/.
Ar.7z
Contains the files pwd and forthegigs.zip. The password for forthegigs.zip is from the contents of pwd, wekeepourusersdatasecureaswell.
Ar254.7z
Contains a root directory Compress/ with the archives 5s-X.7z, A12.7z, A12x-A12z.7z, A13_.7z and T2.7z. For each of these archives, all of their contained 7zip archives are encrypted with the password 123.
basejumper.7z
A 7zip archive containing two SEPROMs:
SEPROM_t8020si.bin: A SEPROM private build, dated 2018/03/15 16:24:52. Built with [email protected] for A12 (t8020).SEPROM_t8027si.bin: Originally uploaded asSuprise.7z.
BigPacks.7z
Contains the following files:
CoreOS.tar.gz: ContainsBATS/unit_tests/nanocom.plistandtests/metadata/nanocom/nanocom.plist, copied from/AppleInternal/CoreOS/on some unknown device.iBootSrc.tar.gz: A Gzip compressed tarball, containing a 7zip archiveIbootSRCOLD.7z, which contains the leaked iBoot source code from 2017.idbs~etc.7zLibrary.tar.gz: A Gzip compressed tarball containing some frameworks:ATDeviceElements.framework/EZFDR.framework/EZSockets.framework/FactoryDeviceControl.framework/PowerSignatures.framework/StackSignaturization.framework/
misc.tar.gz: A Gzip compressed tarball containing:horizon.pem: An RSA private key.factory_restore_key.pub: A public key.device_model_map.sql3
OS.7zPacks.7z
D4x.zip
A zip archive containing two versions of diagnostics for an iPhone, diag-zelus-25.89.50.bin and diag-zelus-25.96.52.bin, likely for the iPhone 10,3 (d22), on iOS 10.3.1. It also contains pairs of .bin and .prm files.
dfu.7z
This archive contains many duplicate files and extracted archive contents. The most notable files include:
RestoreTools+HomeDiagnostic.zip: A set of RestoreTools and Home Diagnostics installation files. This specific compilation was organized and uploaded by @ForestCorgi.iBoot_BootROM_iBSS_iBSS_iLLB_Source_Codes.zip: The leaked iBoot source code from 2017.patch SNR.zip: Astris binary patches for Butler (14B70), Tigris (15A287b) and Yukon (17A400) Home Diagnostics.
diag-Cebu31C.html
An html development document for "Cebu31Cdiag Diagnostics Commands".
DTK10.0.0.7z
Contains the directory Developer_transision_kit_firsft_dev_dw_ipsw/, with what appears to be an incomplete root filesystem of a device running beta iOS 14.0 (18A5342e). The largest folder in this filesystem appears to be an added directory, /10.0.0/, which contains:
10.0.dtk/UniversalMac_11.0_20A5299w_Restore/: An extracted restore for the DTK version 11.0 (20A5299w).a12zTest: A hello world XCode project.co-processors/isp-nike-L_debug.bin: A debug ISP firmware.dtr/: Device tree and registers for the DTK (j273).iBridge1_1Customer.bundle/: An extracted iBridge1,1 restore bundle.interesting_docs/pre_auth_isakc/: Kernelcaches for the DTK (j273) and iBridge1,1 (x619), with img4 payloads and an IDA database.kpep/: PList files from/usr/local/share/kpep/.wifi/C-4378__s-B1/:armv8.3_bins.dmg: Root filesystem DMG from DTK version 11.0 (20A5299w) restore above.
Some of the files from kc/ are also duplicated in the root of this directory.
dump.bin
Part of a 7zip archive, which was posted as a CTF they titled "Aruba-ctf". A reply to the original posting of this file stated "t8027si + CN lab", and context made it sound as though the contents would include a virtual machine image.
Although meant to be part of a "CTF", what was supposed to be the solution was posted less than 24 hours later. A few tweets were posted about the context of the archive.
-
final tip to make it easy for gov.. if it's not cracked by now.. twice aes 7z packed with an asn1 once and tar.xz'ed another time.. should be possible i believe in you
-
7z x -p #1 7z x -p #2 add 2 keybags to what came out, than decode the img4 payload youll get a tar.xz
-
1 == on4g34o84gt0834gtnc8tct84ycnto8434o38v
2 == fiugfre7gnr9ger98gr9vg8vern98grn98eb9g8eb
Ignoring the issue of how cracking the passwords would have been, to put it lightly, difficult, half of the file is zeroed bytes and therefore any indication of where the metadata block is, which would be involved in decryption, is missing. Unless there is a step before those that were posted which fixed the malformed 7zip archive, there is likely no recovery of any real data from this file.
DVT-D42-APOVB.tar.xz
An XZ compressed tarball containing the im4m and im4r files originally posted in ThatsNotIt.7z.
even_more_fake.tar.xz
A zip archive, unlike what the extension implies. Inside is the file even_more_fake.bin, which is a SEPOS dump version 1632.40.29 for A12Z (t8027) on the DTK (t485).
fakebullshit.tar.xz
A zip archive, unlike what the extension implies. Inside are the files:
iBEC.t485.RELEASE: iBootStage2 decrypted (<3).iBSS.t485.RELEASE: iBootStage1 decrypted.
Both are iBoot version 6723.40.86.0.5 built for the DTK (t485).
forthegigs.zip
From Ar.7z, contains 3 files:
Unicorn: Originally uploaded asSuprise.7z.Untitled06.txt: An EC Private Key.Untitled07.txt: A Makefile for SEP on L4, as made clear by the comment at the top of the file.
FS.tar.xz
An XZ compressed tarball, meant to contain a root filesystem dump of an iPad8,3 (j318). However, an extraction error is reached when extracting the file FS/System/Library/Caches/com.apple.kernelcaches/kc.i64, which you may recognize as an IDA database. It was for some reason either created and left on the device or added to the filesystem contents after they were copied to a different device and then included when the directory was tarballed. An accessible copy of this filesystem dump can be found in SYNCP.7z/FS/.
fw.7z
A 7zip archive with two directories, astris/ and JTAGFW/. astris/ contains portions of a root filesystem which appear to be the installation files for Astris software. JTAGFW/ contains two directories itself, fw/, which contains firmware files for several JTAG probes, and haywire/, which contains a copy of Yukon (17A400) Home Diagnostics, as well as a zip archive with what appears to be a patch for the Astris probe daemon.
HD201.7z
Contains a zip archive containing HomeDiagnostic.pkg, which is Azul (18B86) Home Diagnostics.
iBoot-6723.80.19
A release build of iBoot version 6723.80.19 for iPhone12,3 (d421).
idbs~etc.7z
Contains the following archives:
BINS.7z
Contains folders with different ROMs, firmware and SEPOS dumps, split SEPOS components and IDA databases. The below list outlines some of the dumps and ROMs that exist in this directory, and each location where they can be found. Note that most of these also exist in other archives/uploads.
- SecureROM version 3332.0.0.1.23 for A11 (t8015).
APRom/SecureROM for t8015si, iBoot-3332.0.0.1.23
- SecureROM version 3865.0.0.4.6 for A12 (t8020).
APRom/SecureROM for t8020si, iBoot-3865.0.0.4.6
- SecureROM version 4479.0.0.100.4 for A13 (t8030).
APRom/SecureROM for t8030si, iBoot-4479.0.0.100.4
- Development build of iBoot version 5403.0.0.100.15 for iPhone12,3 (d421).
iDev/iBoot.d421.DEVELOPMENT-5403.0.0.100.15.dump
- Debug SEPOS version 1134.0.0.100.1 for A13 (t8030).
SEPOS/AppleSEPOS-1134.0.0.100.1
- SEPROM version 156.0.0.1.10 for A8 (t7000).
SEPRom/AppleSEPROM-156.0.0.1.10
- SEPROM version 175.0.0.1.9 for A8 (t7000).
SEPRom/AppleSEPROM-175.0.0.1.9
- SEPROM version 230.0.0.4.1 for A9 (s8003).
SEPRom/AppleSEPROM-230.0.0.4.1
- SEPROM version 268.0.0.1.16 for A10 (t8010).
SEPRom/AppleSEPROM-268.0.0.1.16
idbs.7z
Contains a duplicate of the folder BINS.7z/APRom/, as well as the same iBoot dump from BINS.7z/iDev/ accompanied by an IDA database. The directory XNU/ contains several kernelcaches for a few devices, both release and development.
kc.14b5.t8030si_symkernelcache.release.iphone12cmach.development.t8030xnu_development-5894.0.0.92.1~1_DEVELOPMENT_ARM64_T8020xnu_development-6110~31_DEVELOPMENT_ARM64_T8015
These kernelcache files also come with IDA database files.
Additionally, there is a zip archive secret.zip, which is password protected, and contains the file mach.development.8030.i64. Although an IDA database of the same name and size exists in the XNU/ directory already, the CRC hashes do not match (498F69B1 for the database inside secret.zip, 65559B60 for the database outside).
roms.zip
Contains two SEPROM private builds:
SEPROM_t8006.bin: Dated 2017/05/30 14:40:04. Built with [email protected] for S4/S5 (t8006).SEPROM_t8027.bin: Dated 2017/09/13 21:46:04. Built with [email protected] for A12X (t8027).
XNU.7z
Contains a subset of the files already seen in idbs.7z/XNU/.
iMac System Regulatory Certification.lpdf.pdf
iMac System Regulatory Certification for Model Number A1419. Yeah.
kch.7z
Contains the directory Keys/, split into multiple subdirectories. A majority of the files in this archive appear to be certificates and key files, with the notable exception of Keys/Critical/Cr.7z. This archive contains three 7zip archives for three SDKs, which can also be found in Packs.7z/SDKs.zip. The only difference in files is that MacOSX10.14.Internal.sdk.7z has the contents of MacOSX10.14.Internal.sdk/usr\local/share/tz/tzdata2018d.tar.gz extracted to the same directory.
Magic_.7z
Inside is another 7zip archive MAGIC.7z with the same password. The contents of this archive are relevant to hacktivation of devices, as first line of the file Howto.txt reads
This archive is meant to have files for techniques used by repair shops.
OFFER.7z
Inside is the file Summery.txt, which to an extent describes the files which are available for purchase, and a directory dump_summery/, with many screenshots of directories, data, and terminals.
OS.7z
This archive contains several filesystem dumps, restores, and other Non-UI iOS files:
13.0UI-t8010-t8015.tar.gz: A Gzip compressed tarball containing a filesystem dump for an iPhone10,1 running internal UI iOS 13.0 (17A508).14.0~UI.t8020si-t8030si.7z: Contains a Gzip compressed tarballsystem.tar.gz, which is an incomplete filesystem dump from an iPhone12,1 running internal UI iOS 14.0 (18A188), with it's var wiped, likely due to being passcode locked.AppleInternal_very_old.zip: Contains some demoloop files inApple Retail.ASW/Demo related/and some older internal iOS apps inIPAs/. The directoryIPSWs/SwitchBoard/contains:iPhone 5S 7.0(11A24580o).zip: A filesystem dump from an iPhone6,1 running Non-UI iOS 7.0 (11A24580o).iPhone 6S 9.0(13A93051l).zip: A filesystem dump from an iPhone8,1 running Non-UI iOS 9.0 (13A93051l).Restore iPhone 4 to 5.1 SwitchBoard Factory Firmware.ipsw: A modified restore for Non-UI iOS 5.1 (9B3176n) on an iPhone3,1.
D32DVT12.1.tar: A tarball containing a filesystem dump from an iPhone11,2 running internal UI iOS 12.1 (16B92). Also uploaded asA12.7z/iPhone.7z/XsUI.tar.gz.dtk_11.0_20A5374.internal.ipsw: A DTK restore version 11.0 (20A5374i).DVT_t8030si_FactoryOS.7z: Contains the extracted contents of a LLDiags .dmg, with IDA databases alongside some files. two builds of iBoot can be found in this archive:usr/standalone/illb.dev-5403.0.0.100.15/illb.dev-5403.0.0.100.15: A development build of iBoot version 5403.0.0.100.15 for iPhone12,3 (d421). Directory also contains img4 components, similar to the previous upload inThatsNotIt.7z.usr/standalone/firmware/iBoot-6723.0.48: A build of iBoot version 6723.0.48 for iPhone12,3 (d421).
SwitchBoard.7z: Same contents asA12.7z/iPhone.7z/Xs-Xr~Diags.7z/001D358E389A493A/AppleInternal/, with the same differences as seen inA12.7z/iPhone.7z/Xs-Xr~Diags.7z/001D358E389A493A/DVT_DIAGS_IMAGE/.XS_AppleInternal.zip: The same contents asSwitchBoard.7z, in a zip archive and with a__MACOSXdirectory in the root.XS_diags.zip: TheDiags/directory fromSwitchBoard.7z, the same contents asA12.7z/iPhone.7z/Xs-Xr~Diags.7z/001D358E389A493A/DVT_DIAGS_IMAGE/.
There is also a bookmark file protos.
Packs.7z
Contains two zip archives.
SDKS.zip
Contains four SDKs:
bridgeOSHostAdditions.sdk/MacOSX10.14.Internal.sdk/MacOSX10.14.sdk/Raft.sdk/
TBDS.7z
Contains certain bundles from /System/Library/ as well as .tbd files from /usr/lib/
p0.zip
Contains the directory Pairing/ with the files:
0_MobileDevice.pkg,1_RepairCal-17S42550e-iPhoneSE2_36.pkg,2_RepairCal_SupportSoftware13-iOS13_36.pkg: RepairCal 2.5 installation packages for iOS 13.4 (17S42550e).038-49596-013.dmg/038-49597-013.dmg: Horizon ramdisks from2_RepairCal_SupportSoftware13-iOS13_36.pkg/usr/local/RepairCal/Ramdisks/Restore_13_4/.astris: Astris 827.1.2 binary.conference-proceeding.pdf: "Method Confusion Attack on Bluetooth Pairing" (link).HomeDiagnositc.pkg: Butler (14B70) Home Diagnostics.iBSS.n841.RELEASE.im4p: iBSS payload for iBoot version 5540.102.4.100.1.N84-COMPLETE-RD.rlistPurpleRegister.app.zip: Zipped PurpleRegister application files.TestAutomation.pkg: TestAutomation install package.
The subdirectory Archivio/ contains extracted contents of archives in the root.
s.7z
A broken 7zip archive. A tweet directly after this upload states
https://twitter.com/_0000100000/status/1364702328792748034
Supposedly this archive would contain more builds of SEP, or some other set of related files, and would have been decrypted with the first password from those posted for decrypting dump.bin.
sbt.7z
A 7zip archive containing a directory titled securebootsupport/. Contains Python 2.7 scripts and keys saved in JSON files. From bridgeOSHostAdditions.sdk. Appears to be related to signing img4 files.
SCAM.tar.xz
An XZ compressed tarball. The context of the name is that this file was uploaded seemingly in response to being called a scammer.
https://twitter.com/_0000100000/status/1363649090844827649
The file inside, SCAM, is a dump of debug SEPOS version 806.200.118 for A11 (t8015) for iPhone10,3 (d22).
seps.tar.gz
A Gzip compressed tarball containing a large set of SEPOS dumps, ROMs, split SEPOS components, IDA databases, and memory dumps. The below list outlines what dumps and ROMs exist in this directory, and each location where they can be found. Note that most of these also exist in other archives/uploads.
-
SEPOS version 1632.0.148 for A10 (t8010). Note that this file looks different from bother earlier and later SEPOS dumps and may not be proper.
A7/sep-firmware.d101.RELEASEA10/D10AP.Release-AppleSepOS-1632.0.148-iOS14
- SEPOS version 806.200.118 for A11 (t8015).
A11/AppleSEPOS-806.200.118-A11A11/sep-firmware.d20.RELEASEA11/split/AppleSEPOS-806.200.118.t8015share/sep-firmware.d20.RELEASE
- Debug SEPOS version 806.200.118 for A11 (t8015).
A11/sep-firmware.d20.FACTORYA11/Fac/AppleSEPOS.d20~806.200.118.Factoryshare/sep-firmware.d20.FACTORY
- Debug SEPOS version 1134.0.0.100.1 for A13 (t8030).
APS/D421AP/1134.0.0.100.1/AppleSEPOS-1134.0.0.100.1APS/D421AP/1134.0.0.100.1/Splits/AppleSEPOS-1134.0.0.100.1
- SEPROM private build, dated 2017/05/30 14:40:04. Built with [email protected] for S4/S5 (t8006).
APS/D421AP/1134.0.0.100.1/roms/SEPROM_t8006.binroms/SEPROM_t8006.bin
- SEPROM private build, dated 2017/09/13 21:46:04. Built with [email protected] for A12X (t8027).
APS/D421AP/1134.0.0.100.1/roms/SEPROM_t8027.binroms/SEPROM_t8027.binroms/xx/SEPROM_t8027.bin
- SEPOS version 1632.40.29 for A12Z (t8027) on the DTK (j273).
APS/J273AP/1632.40.29/AppleSEPOS-1632.40.29APS/J273AP/1632.40.29/j273a.AppleSEPOS-1632.40.29APS/J273AP/1632.40.29/SepOS-.j273ap.release~1632.40.29APS/J273AP/1632.40.29/split/SEPOS.j273ap.release.1632.40.29SEPOS/Apple-SEPOS-1632.40.29
- SEPOS version 1632.40.31 for A12Z (t8027) on the DTK (j273).
APS/J273AP/1632.40.31/Apple-SEPOS~Release.1632.40.31APS/J273AP/1632.40.31/sep-firmware.j273a.RELEASE
- Debug SEPOS version 806.200.95 for T2 (t8012).
APS/T2/J140KAP/t8012si.Debug~AppleSEPOS.T2-806.200.95.dump
- SEPOS version 1632.40.29 for A12Z (t8027) on the DTK (t485).
APS/T485AP/1632.40.29/AppleSEPOS.t485ap.release-1632.40.29
- SEPOS version 1632.40.31 for A12Z (t8027) on the DTK (t485).
APS/T485AP/1632.40.31/sep-firmware.t485.RELEASE
- SecureROM version 3865.0.0.4.6 for A12 (t8020).
roms/SecureROM for t8020si, iBoot-3865.0.0.4.6
Skkk.7z
A broken 7zip archive. No context provided as to what the contents were supposed to be.
SoFunny.7z
Contains the directory Ar/. Contains
Suprise.7z
Not actually a 7zip archive as the extension implies, but instead a SEPROM private build, dated 2017/09/13 21:46:04. Built with [email protected] for A12X (t8027).
Suprise2.7z
A 7zip archive containing the directory J140KAP/, which is the board identifier for the T2 MacBookAir8,1. Inside this directory are the following files:
IM4M: Output from$ openssl asn1parse.sep-firmware.im4m,sep-firmware.im4p,sep-firmware.img4: The manifest, payload, and complete img4 file for SEP.t8012si.Debug~AppleSEPOS.T2-806.200.95.dump: A dump of debug SEPOS version 806.200.95 for the T2 (t8012).
SYNCP.7z
Contains the following directories:
CRL/: Contains three certificates:Ap.cer,Escrow.cerandiCloudDevCert.der.Factivate/: Contains three certificates:Apple iPhone Activation.cer,appv-00008027-001A24C82411E92E.cerandscrt-00008027-001A24C82411E92E.der.FS/: A filesystem dump of an iPad8,3 (j318) running NonUI iOS 12.0 (16A63060n).logs/: Containslog.txt, a text log dump of the iPad8,3 (j318) running NonUIUI iOS 12.0 (16A63060n).
T2.7z
BridgeOS-3dev.zip
A zip archive containing a filesystem dump of an iBridge2,8 running Non-UI bridgeOS 3.0 (16P25070u). This filesystem is found both in the root of the zip archive, in the subdirectory dump/, and preserved properly inside the tarball dump.tar.
Diags-T2.zip
Contains a directory of diagnostic binaries for the T2 MacBookAir8,1 (j140k). diags-J140K is a build dated 2018/07/05 17:38:05, and has an IDA database and img4 payload alongside it. There is also the complete diag.img4 for a build dated 2018/07/30 20:07:14 as well as a dummy payload in the directory.
mmu_T2_Tz0
Contains the text log of a diags session which becomes a console session interacting with a ChimpSWD via Astris.
SEP.7z
The contents of this archive were uploaded previously in Suprise2.7z.
ThatsNotIt.7z
Inside this 7zip archive is a directory illb.dev-5403.0.0.100.15.2/, which contains the following files:
idev_better.patched: A copy of the following iBoot build, with a few binary differences.illb.dev-5403.0.0.100.15: A development build of iBoot version 5403.0.0.100.15 for iPhone12,3 (d421).illb.dev-5403.0.0.100.i64: An IDA database for the iBoot build.illb.im4m,illb.im4p,illb.img4: The manifest, payload, and complete img4 file for the iBoot.illb.im4r: The DER-encoded BNCN information for the iBoot img4.
Tim.7z
Inside this 7zip archive is another archive radians.7z with the same password. Inside is a directory DiagsAndDev/ which contains a set of diagnostics img4 files for T2 (t8012), A11 (t8015), A12 (t8020), A12X/Z (t8027) and A13 (t8030). It also contains a 7zip file diags_old_soc_no_fs.7z, which in it has diagnostics, iBEC, iBoot and iBSS img4 files for several device models. The subdirectory contains all the same img4 files, as well as a cmd.txt file with the contents
There is also a shell script in the original directory, dodiags_d221ap.sh, with the contents
And finally, there is a device blob in the subdirectory shsh/, 692486708461614-iPhone10,6-14.2.shsh.
totallyfakeandcurropted.tar.xz
A zip archive, unlike what the extension implies. Contains a single file named the same as the archive, totallyfakeandcurropted, which is dump of debug SEPOS version 806.200.95 for the T2 (t8012). This file was originally uploaded in Suprise2.7z.
x.tar.xz
An XZ compressed tarball containing 3 files:
persona.kbREADME.md: A markdown readme file titled "Darwin Preinit RAMDISK testing"systembag.kb
The two keybag files are potentially the files that would have been necessary for extracting the contents of dump.bin, as the steps posted include "add 2 keybags to what came out".
XXXCA14.7z
Contains the Gzip compressed tarball dump.tar.gz. This is an incomplete filesystem dump from an iPhone13,3 (d53p) running internal UI iOS 14.3 (18C57). The entirety of /private/ is missing from this dump. Sources say this is because the former owner of the device this dump is from didn't want /private/ included, their reason being it contained an iOS 15 OTA update.
XXXZ34.7z
Contains the following files:
Astris.tar.gz: The contents of/usr/local/share/astris/after installing Yukon (17A400) Home Diagnostics.BackupA13.tar.gz: The same partial filesystem dump asA13_.7z/backupA13FS.tar.gz.BigPacks.7zdfu.7zDTK10.0.0.7zkch.7zp0.zippp0.zip: The same contents asp0.zip, with the directoryArchivio/1_RepairCal-17S42550e-iPhoneSE2_36 Folder/usr/local/RepairCal/removed andPurpleRegister.app.zipextracted in and deleted from the root directory.SDKs2.zip: Same asPacks.7z/SDKs.zip.seps.tar.gzSYNCP.7zUniversalMac_11.0.1_20B29_Restore.ipsw: A DTK restore version 11.0.1 (20B29).
ZukonTools.7z
Here are the files inside this archive broken down by directory from the root.
A11Preboot/
This directory contains two subdirectories each with one file inside:
D22AP_pvt_rev_a/iboot_firmware: An img4 for iBoot version 5540.0.117.3.generic/AppleSEPOS-806.200.118-A11: A dump of debug SEPOS, previously uploaded asSCAM.tar.xz
There is also a text file WHAT with the contents:
sepsepsep/
This directory contains two subdirectories, Fac/ and Release/. Both directories contain a dump of SEPOS version 806.200.118 for the A11 (t8015), as well as a disassembly of each SEPOS into its components.
The copy of SEPOS in Release/ is identical to the copy in A11Preboot/, while the copy in Fac/ is a debug build of the same version. Additionally, Fac/ contains the file sep-firmware.d20.FACTORY.cuttoff, which appears to be an incomplete dump of the same SEPOS, as well as a related IDA database sep-firmware.d20.FACTORY.i64.
Between the two directories, the component files sepdump_kernel and sepdump_sbio-triton64 are identical. All other components are different between the two. Additionally, Fac/ contains a few components Release/ doesn't have: sepdump_pairing, sepdump_scrd, sepdump_test and sepdump_unit_test.
Xs_dvt_variant_c_Approx-13.4-beta-4~17E5249a/
This directory, as the name might suggest, contains files relevant to an iPhone11,2 (d321) DVT device, running a build of iOS version 13.4 (17E5249a). There is a file Timeline-Approx-13.4-beta-4~17E5249a.txt in the root of this directory containing a copy of the relevant portion of the iBoot version timeline from The iPhone Wiki.
The following are the subdirectories and a summary of their contents:
Baseband/: Files from/usr/standalone/updateon the deviceFactoryData/Firmware/: Files from/usr/standalone/firmwareon the deviceiBoot/: Contains a development build of iBoot version 5540.102.3 for iPhone11,2 (d321), alongside all component files, an IDA database as well as a SQLITE database, apticket, and some co-processor components in a subdirectory.Pearl/: A set of firmware files, seemingly for NFC and other hardware on the device board.Preboot/: A device tree and img4 for iBoot version 5540.102.3sepi/: SEP img4 payload and manifest filesTickets_CRL/: DER-encoded BNCN information
from ceta and bin
rentry and corrections by orangera1n