Fig. 1.1: iPod timeline, from the rst release to 2009
The following facts do not deal with hardware specicities of each model (if you want to learn more about this, have a look to appendix B). It is only notes about the new things each model brougth in relations to the previous ones.

iPod Classic

1G: rst release 2G: compatibility with Windows (2000/XP), touch wheel 3G: USB2 connector, dock connector, photo card reader 4G: click wheel, rmware is ciphered(1) Photo/Color: color screen 5G (replace iPod Color): USB only, can read videos 5.5G: can run downloaded games 6G (Classic): Cover Flow, new encryption(2) Fig. 1.2: iPod Classic

iPod Mini/Nano

Mini 1G: smaller than classic iPods, click wheel, storage on microdrive Mini 2G: no more FireWire link Nano 1G (replace iPod Mini): color screen, USB only, storage on ash memory Nano 2G: new encryption(2) , DFU mode, access to the NAND ash with a FTL software Nano 3G: Cover Flow, can read videos, can run downloaded games Nano 4G: accelerometer

Fig. 1.3: iPod Nano 2G

Nano 5G: CMOS camera, Voice Over Commands

iPod Shue

Shue 1G: very small, no screen, storage on ash memory Shue 2G: no real changes (new design.) Shue 3G: Voice Over Commands

Fig. 1.4: iPod Shue 3G

one of the three images inside the rmware is encrypted (with RC4); see part 4.1.1 of this report two of the three images are now encrypted (with AES ?); see part 4.1.2 (and following) of this report

iPod Touch

Touch 1G: touch screen, Cover Flow, access to the Internet, storage on ash memory Touch 2G: integrated speaker Touch 3G: CPU and GPU are faster than 2Gs ones, CMOS camera

Fig. 1.5: iPod Touch 3G

Complements
For the last models : - audio formats supported, according to Apples website: AAC (8 to 320 Kbps), Protected AAC (from iTunes Store), HE-AAC, MP3 (8 to 320 Kbps), MP3 VBR, Audible (formats 2, 3, 4, Audible Enhanced Audio, AAX, AAX+), Apple Lossless, AIFF, and WAV (with the exception of iPod Touch: HE-AAC, Audible Enhanced Audio, AAX and AAX+ arent supported) - video formats supported (for iPods which can read videos of course): MPEG-4 and H.264 (MPEG-4 AVC). Each iPod is formatted in FAT-32 (Windows/Linux) or HFS+ (Mac). One exception: iPod Shue is formatted in FAT-32 whatever your OS is. If you want more precise fact sheets about a model (CPU, RAM, storage,.), we have copied the iPodLinux page about hardware specications of the dierent iPod generations(1). It is available in the appendix B. You can also read technical specications on Apples website(2) : click on a model, and then on Tech Specs (top right of the page).

character k occurences, and n =
A high entropy (here, 8 is the maximum) means that the le looks like a random le, and here, according to the results shown in table 4.1, it leads to this conclusion.
1 http://ipodlinux.org/wiki/Flash_Decryption (on this page, you can download the AUPD decrypter, wrote for iPod 4G, 5G and 5.5G)
Firmware osos 19.1.1.0 aupd 19.1.1.0 osos 19.1.1.1 aupd 19.1.1.1 osos 19.1.1.2 aupd 19.1.1.2
Value 7.999958 7.999459 7.999959 7.999497 7.999964 7.999496
Tab. 4.1: entropy values of osos.fw and aupd.fw These values shows another thing: an entropy which is that high means that the le is encrypted.
Monoalphabetic substitution
The rst algorithm considered is monoalphabetic substitution. Each character (ASCII) corresponds to an other. For instance, adding 13 modulo 256 is a possible encryption function. Any substitution on the ASCII characters is possible too. This type of algorithm keeps one of the original texts property: the frequency of each character is the signature of a text. A simple program was made to analyze dumped les. The result was that each character appears quite as many time as the others in the osos.fw le: the encryption algorithm is more complex than this simple monoalphabetic substitution.
Polyalphabetic substitution
The rst assertion has been invalidated. Using several dierent substitutions could basically give a balanced repartition. Thus, this hypothesis can be assumed. It can be supposed the substitution number is a multiple of 4 (which represents ARM9 instruction length; see part 6.2 of this report). To assert this hypothesis, the previous program was modied in order to analyze the rst bits of each instruction, corresponding to the opcode. Again, according to gure 4.1, frequency seems to be the same for each ASCII character. Furthermore, comparing with an analysis (see gure 4.2) done on an ARM binary version of ls software, frequencies are really dierent. Thus, polyalphabetic substitution hypothesis has also been invalidated.
Fig. 4.1: Statistics on osos.fw opcodes

Fig. 4.3: Dierences between some versions of aupd.fw (in red)

Current assumptions

Encryption algorithm
At the present time, the assumption is that the rmware is encrypted by AES-CBC(1) , with 128 bits long blocks (and a 128 bits long key). Some reasons point to this conclusion: the iPhone is encrypted by FileVault (which protects Mac OS X), based on AES-128 it takes around ten second to decrypt the rmware, which is compatible with the speed of the SOC and the number of operations needed to decrypt a le ciphered by AES-128 each version of the rmware has a size (in bytes) divisible by 16 (table 3.1 shows these sizes) the number of identical bytes at the beggining of the data part of dierent versions of osos.fw is 1680, and for aupd.fw, it is a multiple of 16 (see table 3.7)
As the number of common bytes between the versions 19.1.1.1 and 19.1.1.2 of aupd.fw is 32, we could think that blocks size is 32, but neither 1680 nor 240 is divisible by 32. According to the previous facts, blocks length could be less than 128 bits, but it is not very credible because AES runs with 128, 192 or 256 bits long blocks, and choosing a smaller size would give very small advantages (speed,etc.), but would reduce a lot the security.
Keys and Initialization Vector location
The CBC scheme needs two things: a key, of course, and an Initialization Vector (IV). This IV has the same length as the blocks. Some references always set it to 0x0000000000000000, but in facts it can have any 128-bits value. So, we are here trying to nd two 128 bits long integers. In a previous version (iPod 5G, where only aupd.fw was ciphered), a part of the key was hidden in its header. The key was computed by an algorithm located in the bootloader, using the header and a constant variable located in the bootloader. Nevertheless, things have changed with the IN2G: the key is now located in an AES unit (see part 8.3). It allows us to encrypt / decrypt, but we have no access to its value.

Conclusion

If all the hypothesis above are right, we cannot break the encryption: the only known method, which works in every case, to attack AES is the brute-force attack, and it would take years. But, as we found how to decrypt / encrypt without knowing the key, it is not very important anymore!
http://www.faqs.org/rfcs/rfc3602.html

Notes buer overow

This part is mainly a copy of Linux4Nano wiki(1). Remark: the leak which was exploited by the buer overow is xed by Apple since the last Nano 4G rmware, and the rst one for Nano 5G.

Noticing

Buer overow noticing
On February, 14th 2009, Cory cmwslw Walker rst found a bug in the Notes folders feature(2) : when you copy an HTML le with an hyperlink (which respects some conditions(3) ), the iPod crashes. This bug presumably happens because the lesystem of the iPod Nano cannot handle les which contain a very long character string.

Creation of a working overow le
To reproduce this buer overow, you have to create an HTML le with only the following code: <a href="STRING">Crash!</a> Then, just copy it in the Notes folder. To remove it, you have to put the iPod into disk mod (see appendix A). The content of the STRING eld has to follow some rules: it has to be more than 256 chars long (Apple documents this limit, but they do not say it may cause a buer overow) it cannot be more than 4096 chars long, or the iPod will truncate it (and wont recognize it as a correct link: </a> tag will be missing) the le size is limited to 4kB (3788 bytes for the payload to be exact) 64kB les are loaded just after the boot of the nano, however they are not kept in RAM There are many copies of the buer, but they can be divided into 2 types. One being the RAW le data, and one being corrupted by some UTF16 chars. The HTML le is converted to UTF-16 rst. This limits the possible char sequences. The best thing to have most charset possibilities is to encode the exploit directly to UTF16. A consequence of this UTF-16 conversion is that there are some forbidden values: 0xFEFF: UTF16 BOM 0xD800 up to 0xDFFF 0x0000: would stop string processing
http://l4n.clustur.com/index.php/Getting_execution it is basically a HTML browser included in the iPod 3 These conditions were found by fuzzing with les of dierent contents and sizes

Link overow

After loading the le, the links are then checked against the le system. Many modied copies of this string are present on the stack. We could identify the most important steps of this process, until the string overows in the stack (order could be a little dierent): First, the link is extracted from the le, and copied to some heap or xed buers The link is converted to UTF8. Every char over 0x7F is encoded in many bytes, making some useless code Then it is passes through an uppercase function The URL encoding is decoded: %xx values are converted to their equivalent (limited to valid UTF8 or alike) Finally, this link is copied in a limited buer which is located on the stack. By putting a return address repetitively in the link, the processor will jump to this address. For convenience, the return address is always encoded using %xx URL encodings. This avoids problems with some special chars and with lowercase chars. Possible values are 00 < xx 0x7F (the unescaped chars seem to be transcoded from ISO-8859-1 to UTF8 again).
Exploiting, getting execution
To exploit, we used JTAG (see part 7) to determine the correct paddings and return addresses of the buers. At http://f4eru.free.fr/8701/Notes_overflow_example.zip, you can download an example of a working overow le. The le Brokenlink.htm contains rst an UTF16 BOM, then AA as padding, then the overowing link (return address is 08640D60), then a NOP (opcode E1A01001) landing zone, and nally a while(1); This while(1) does not freeze or reset the iPod, but instead just locks up the background task. You can still scroll menus, but the iPod will freeze as soon as you press play or if you enter the Notes menu, etc. The processor arrives to the Notes in supervisor state, with interruptions activated (menu scrolling), etc. Remark: Direct Memory Access could cause cache problems, but it does not with the call of some cache coherency CP15 functions.

NAND Flash Chip

This chip is used to store program data (audio, photos, games). It is not the same in every IN2G, partly because of the dierent available capacities. The one we found here is part numbered HY27UW08BGFM, from Hynix Semiconductor (see gure 6.4). It is a 4GB MLC NAND ash memory. Several versions have been used in iPods.

Utility Flash Memory

The utility ash is part numbered SST39WF800A, and is made by Silicon Storage Tech (see gure 6.5). It is a 8 Mbit multi-purpose ash(4) , which stores the bootloader, Disk mode, Diagnostic mode, DFU mode and the code to ash it. tof has managed to extract this data (and it led to iLoader: see part 8)

Mobile SDRAM

The external Samsung SDRAM is a 256Mbits ash chip, and part numbered K4M56163PG(4) (see gure 6.6). This is the same chip used in the iPod Nano 1G.

Audio Codec

This chip is part numbered Apple 338S0310 68CXST8 (see gure 6.7). According to SeekingAlpha(3) it used to be an audio codec formerly supplied by Wolfson Micro, probably a Wolfson WM8750L(4).

Voltage Regulator

This LM34910(4) step down switching regulator manages the power supply. This is a low cost buck bias regulator capable of supplying 1.25A to the IN2G. Figure 6.8 shows the chip, pinout is easily recognisable.

USB Power Manager

This chip part numbered LT 6I 4066 or LTC4066(4) is from Linear Technology (see gure 6.9). It is designed to manage Li-Ion battery charge through USB, which requires very accurate voltages. It also
provides USB power management and short circuit protection.

6.1.8.1

Pictures (taken during the autopsy of the IN2G)

Overview

Pictures 6.1 and 6.2 show the IN2G once opened (rst one is the front view, and second one the back):
Fig. 6.1: Front side of the IN2G
Fig. 6.2: Back side of the IN2G 6.1.8.2 Details
Next gures show each chip separately:
Fig. 6.4: The NAND ash chip Fig. 6.3: The System On Chip
http://www.eetimes.com/news/latest/showArticle.jhtml?articleID=193000601 http://www.samsung.com/global/business/semiconductor/productInfo.do?fmly_id=212&partnum=S5Lhttp://seekingalpha.com/article/16904-component-makers-who-won-placement-in-the-new-ipod-nano 4 you can download its datasheet from Linux4Nano website
Fig. 6.5: The utility ash memory
Fig. 6.6: The external SDRAM
Fig. 6.7: The audio codec
Fig. 6.8: The voltage regulator
Fig. 6.9: The USB power manager

ARM 940T Survey

We are now focusing on the IN2G main chip.

The SOCs internals

The iPod main chip is the Samsung S5L8701B5 ARM SOC (System On Chip), which will be refered as SoC. This SoC contains (among many other things): an ARM940T(1) application processor clocked at 200 MHz with 256KB of SDRAM a ash chip controller The ash chip controller does not interest us so we will focus on the ARM940T application CPU. It is using the ARM-9 instruction set.

1 the bootROM is the ROM inside the processor, that loads NORboot, and the NORboot is the Apple bootloader (in the NOR ash)

iBugger

Basically iBugger is a tool which permits to upload/download binaries between the iPod memory and a PC (that is also the rst function that was implemented). The next step in the evolution of it was the LCD driver : you could tell it to copy some graphics from memory to the screen. Then came I2C(2) , which nally allowed to access the power management unit and thus control the backlight and other things. In fact while iBugger loader is just polling the USB controller in an endless loop, iBugger core is interruptdriven and thus can operate in the background, while other code is running. In that way, you can debug your code by halting/resuming it, dumping the current state of it, modifying it on the y etc. iBugger core also implements a debugging console that can be written to using a syscall that is basically doing an equivalent to printf to it. The data will be buered and transferred via USB to a console application on the PC. The console is bi-directional, but we can notice that only the iPod to PC part has been implemented on the PC side, because TheSeven did not ever need to use the other direction yet. iBugger is coded in ASM as the loader needed to t into a Notes exploit payload, which only allows approximatively 4KB of space.
Scripts used are ipodcrypt.py, libipodcrypto.py which are ndable on http://l4n.clustur.com/ I2C is an interconnect protocol between chips; you can refer to Wikipedia for more details

Versions

NAND-based iLoader

History

After the release of iBugger, we could dump some debug information through the UART while trying to get USB working using the rst iBugger version. TheSeven then explored further pieces of the hardware. The next step was the LCD. After that, he gured out how to control the backlight. More and more drivers were written, and the RockBox port was started. Once he had a working ash driver, he began hacking on a read-only FTL. After reading disassemblies, and coding/debugging, he got that mostly working. Then he started to develop a rst version of iLoader, that was booting from NAND (it was still way before Dave linuxstb Chapman wrote the RockBox bootloader for nano 2g).

Processing

During installation, the osos le on the rmware partition is renamed to osbk (osos backup), and iLoader itself will be written to a newly-created osos le. When the iPod boots, Apple bootloader will thus load iLoader from the rmware partition, which can then decrypt and run the Apple rmware (from the osbk le), or an arbitrary unencrypted third-party rmware. At that point, iLoader did not touch the NOR ash yet, so it relied on the Apple bootloader in that ash for booting. That way, if anything went wrong, we could just recover using disk mode, as everything we had overwritten can be accessed using the mass storage device. The disk mode button combination will be checked for by the Apple bootloader before iLoader gets booted, so we didnt need to care about that either. The disadvantage of that method is of course the way longer boot time, because that Apple bootloader is not really fast.

NOR-based iLoader

After the rst realease the FTL was ported to RockBox. Once again, a whole bunch of drivers was being written, and RockBox was getting more and more usable. Some day, TheSeven implemented read-write support for the FTL, which took several months of debugging until it worked awlessly. Once RockBox was mostly working, TheSeven started researching how to use the DFU modes, and how to ash data to the NOR ash and recover from corruption. Then he worked out which additional hardware init steps are needed when taking over control earlier, and worked on the code doing them. Once that part (NORloader) was completed, he ported over iLoader to NOR, and then added a trivial scripting engine to allow for customization.
To kick o installation, osos will be renamed to osbk as with the old iLoader, but this time, some installation code will be written to osos. During installation, the osbk image from the rmware partition and the disksh and diagsh images from the NOR ash will be loaded to memory and will be decrypted. Then osbk will be patched (to x some Apple bugs regarding superoppy formatting and to remove the EU volume limit) and saved as /iLoader/appleos.bin. Then disksh and diagsh will be compressed and saved to the new (trivial) le system that will be created on the NOR ash during installation. The Apple bootloader will be replaced by NORloader, which will be decrypted and started by the processors bootROM. It will initialize some hardware and execute iLoader (which is not encrypted any more), unless the hold button is switched on quickly to enter the recovery stub (which is basically an iBugger loader, and is used to reduce the bricking risk). iLoader itself and its welcome screen theme will also be installed to the NOR ash. The rmware partition on the NAND ash wont be needed any more, so it will be removed, and the FAT32 data partition will be resized to span the whole device. This allows to reclaim roughly 100MB of otherwise unused space. iLoader will then look for a theme le, which will control its further behavior.

Tutorial about iLoader

This tutorial was written on April 2010. It may be outdated now. Please refer to Linux4Nano wiki to check the last version: http://l4n.clustur.com/index.php/ILoader_Howto
It explains how to install iLoader, RockBox and the Apple rmwares on iPod Nano 2G only. Nevertheless, the drivers developpement is not nished(1). If you want to help, go to the RockBox SVN(2) , and on the IRC channel #linux4nano-dev at FreeNode (irc.freenode.net).

iLoader Installation

This might semi-brick your device! We have taken all possible measures to prevent it, but if norloader (and its recovery mode) should fail for some reason (which has not happened yet), you will have to open your device to recover. BEWARE: As usual, these instructions are supplied in the hope that it will be useful but WITHOUT ANY WARRANTY! Do not blame us if you crash your data or even brick your iPod. You should also read through the Known Issues section below.

10.1.1

Caution: the iLoader installation has to be done on a working and original rmware. If there is any doubt, you should make a recovery from iTunes or see part 3.2 before the installation. 1. Fetch ipodpatcher (3) - there are versions for Linux (32-bit and 64-bit), Windows and OS X. 2. Fetch installer.ipodx (4). 3. Put those two in the same folder. 4. Type chmod +x ipodpatcher 5. Connect your iPod to your computer. 6. Open a terminal (or equivalent) and cd to the directory of those les. 7. Type the following command:./ipodpatcher -a installer.ipodx 8. Now safely eject your iPod and unplug it. The iPod will reboot and start the installation, which can take up to 5 minutes. 9. Plug your iPod in, press Menu and then select Disk Mode. 10. When the installation is complete, it will ask you for a theme. You can download one at http: //l4n.clustur.com/index.php/ILoader_Themes. Then, you have to unzip it and copy what is in the folder iLoader created that way, to the same folder iLoader on your iPod. 11. In this iLoader folder on the iPod, will be a le named NORFLASH.BAK. Copy that le to a safe place! It is your only way back! Apple does not oer this as as download, and it is device-specic!
visit http://www.rockbox.org/wiki/IPodNano2GPort#Driver_status to see the drivers developpement status http://svn.rockbox.org/viewvc.cgi/trunk/firmware/target/arm/s5l8700/ipodnano2g/ 3 http://download.rockbox.org/bootloader/ipod/ipodpatcher/ 4 http://bit.ly/bl7q12
12. Now you can move on to installing RockBox! (keep your iPod plugged in) Please report your testing results on http://l4n.clustur.com/index.php/ILoader_Testing_ Results. Thanks!

10.1.2

Caution: the iLoader installation has to be done on a working and original rmware. If in doubt, you should make a recovery from iTunes or see part 3.2 before the installation. 1. Fetch ipodpatcher (1) - there are versions for Linux (32-bit and 64-bit), Windows and OS X. 2. Fetch installer.ipodx (2). 3. Put those two in the same folder. 4. Connect your iPod to your computer. 5. Open a command terminal and cd to the directory of those les. 6. Type the following command: ipodpatcher -a installer.ipodx 7. Now safely eject your iPod and unplug it. The iPod will reboot and start the installation, which can take up to 5 minutes. 8. Plug your iPod in, press Menu and then select Disk Mode. 9. When the installation is complete, it will ask you for a theme. You can download one at http: //l4n.clustur.com/index.php/ILoader_Themes. Then, you have to unzip it and copy what is in the folder iLoader created that way, to the same folder iLoader on your iPod. 10. In this iLoader folder on the iPod, will be a le named NORFLASH.BAK. Copy that le to a safe place! It is your only way back! Apple does not oer this as as download, and it is device-specic! 11. Now you can move on to installing RockBox! (keep your iPod plugged in) Please report your testing results on http://l4n.clustur.com/index.php/ILoader_Testing_ Results. Thanks!

Installing RockBox

1. First you need to download RockBox. The latest RockBox build, updated automatically on each source code change, is available(3). Remember this a a development build and can contain bugs. 2. Then unzip this le to the root of your iPod (be carefull the folder is.rockbox so it is hidden on Linux, you must keep it in that way). 3. Eject safely your iPod then unplug it (you might have to reboot your iPod by holding down the Menu and Select buttons after that) 4. Then, from iLoader, select the play/pause button to boot RockBox. If you want more information concerning RockBox, take a look at its current status(4)
http://download.rockbox.org/bootloader/ipod/ipodpatcher/ http://bit.ly/bl7qhttp://build.rockbox.org/data/rockbox-ipodnano2g.zip 4 http://www.rockbox.org/wiki/IPodNano2GPort

Making Apple rmware work

The Apple rmware wont work out of the box because whoever wrote it, their le system code mixed up decimal and hex at some point. In order to x it, you need to patch 2 bytes in the APPLEOS.BIN le: oset 0x64d48: replace 0x2b by 0x43 oset 0x64d54: replace 0x34 by 0x52 If you also want to remove the EU volume limit (uncap): oset 0x3acd8: replace 0x01 by 0x00 These osets are for the most recent rmware verison (1.1.3). The osets for older versions might dier.

Updates

The theme and iLoader itself can usually be updated independently. 1. To update the theme, just re-download it and extract it to your iPod, overwriting the old les. 2. To update iLoader, fetch installer.bin (1) and update.cfg (1). 3. Copy both les to the iLoader directory on your iPod. 4. Reboot to the iLoader menu, press the Menu button to get to the advanced menu, and select Update iLoader.

Uninstallation

1. Fetch uninst.bin (1) and uninst.cfg (1). 2. Copy uninst.bin and NORFLASH.BAK (if it is not there any more) to the iLoader folder on your iPod. 3. Delete iloader.cfg, copy uninst.cfg to the iLoader folder and rename it to iloader.cfg. 4. Unmount and unplug your iPod and wait few seconds (you might have to reboot your iPod by pressing the Menu and Select buttons). 5. There should be a new menu, select run nandfcsk and wait. 6. You may have to restore your iPod (or to download a working rmware and copy it: see part 3.2)

Known issues

If something should go terribly wrong, this might semi-brick your iPod. Go to L4N IRC channel (#linux4nano-dev at irc.freenode.net) for recovery instructions. If it should complain that it cannot mount the FTL, unplug it, reset it and boot into Disk Mode, do not connect it to the PC, and just reset it again when it says OK to disconnect. It should work now. If not, please let us know. There is currently a very high rate of ash problems. Were still investigating what the root cause is. Just hit run nandfsck and wait some seconds. If that does not help, run Disk Mode. Fixed. Some iPod accessories (especially Nikepod) may refuse to work if iLoader is installed. (This could also be worked around if need be.)

http://bit.ly/bl7q12

Do not reboot via the Menu+Select key combination shortly after you have booted up the Apple rmware for the rst time after installing iLoader. If you do, it will probably not save its settings and start up with the language selection menu again the next time you boot it. We do not know at which point it will save the settings, but we have found a trick: Just connect the iPod via USB, add or remove a le, and properly unmount and unplug it. This will cause a controlled reboot, which will save the settings. Depending on your le system contents, it is possible that all data on the iPod will get erased during the installation. iTunes will probably want to restore your iPod, as with every other rmware replacement.

Part V

Modes and keys combinations
A.1 Description. A.1.1 Reboot iPod. A.1.2 Disk Mode. A.1.3 Diagnostic Mode. A.1.4 Device Firmware Upgrade Mode. A.2 Combinations. A.2.1 1st, 2nd, and 3rd Generations. A.2.2 Mini, 4th, Photo, Nano, and 5G Generations A.2.3 Pictures. 46. 46. 46. 46. 47. 47. 47. 47. 48
We would like to thank iPodLinux: this is mainly a copy of the wiki Key Combinations(1) page.

Description

Reboot iPod
Forces a power cycle. Use this whenever your iPod freezes, or if you want to switch between third-part rmware and Apple one. Important: Do not reboot the iPod while it says do not disconnect, because that might have the bad eect that the modications you made from your PC to the iPod might get lost. Make sure you eject the iPod so that it says ready to disconnect before you reboot it! Also, do not reboot your iPod while it is booting for the rst time after a rmware update (using the Apple updater). This will abort the ROM ashing, and, except for iPod from Nano 2G and Classic, this WILL RENDER YOUR iPod USELESS. See also this Apple support document on resetting the iPod(2).

Disk Mode

Forces the iPod to wait for a Firewire/USB connection to a computer. If your iPod do not boot up, you can boot into Disk Mode and reload Apple rmware. See also this Apple support document on disk mode(3).

Diagnostic Mode

Presents a menu of diagnostic utilities to check your iPod hardware. Use this menu to check if your iPod is working properly. Note the wheel does not work: you have to use the forward and rewind buttons to move around the menu. For more information see Craig A. Finseths article(4) on diagnostic mode. iPodlounge has an article on the iPod Photos diagnostic mode(5).

http://ipodlinux.org/wiki/Key_Combinations http://docs.info.apple.com/article.html?artnum=http://docs.info.apple.com/article.html?artnum=http://www.finseth.com/parts/ipod.php 5 http://www.ipodlounge.com/index.php/articles/comments/ipod-photo-diagnostic-mode-revealed/
Device Firmware Upgrade Mode
DFU mode is a relatively new standard for upgrading rmware that is used in many devices like the OpenMoko and newer iPods. DFU mode (since nano 2G) is stored in the on-processor bootrom. Newer iPods have both DFU mode and disk mode, while iPod Touch and iPhones have exclusively DFU mode. The nano 2G has two DFU modes. One in the bootrom (and cannot be entered manually), and one stored in the NOR ash, inside norboot (and can be triggered through the key combination you can see below). To switch to DFU mode on an iPod Nano 3G or 4G, follow these steps: 1. Make sure your iPod is turned on and connected to your computer. 2. Press the menu button and select (central) button simultaneously. 3. The iPod screen will go black, and the Apple logo will shortly appear (ie the iPod reboots). 4. Keep on pressing until the Apple logo turns into a black screen. This can take up to 10 seconds. 5. Release the menu and select buttons.

Combinations

1st, 2nd, and 3rd Generations
Reboot iPod: Hold down the Menu and Play buttons. You might have to hold both buttons for a very long time (30 seconds) in some cases. If that still does not work, switch the hold button on and o and try again. Disk Mode: Immediately hold down the Rewind and Fast Forward buttons as the iPod reboots.(1) Diagnostic Mode: Hold Rewind, Fast Forward, and Select buttons as the iPod reboots. Third-part rmware (only when the old bootloader is installed): hold Rewind after rebooting the iPod
Mini, 4th, Photo, Nano, and 5G Generations
Reboot iPod: Hold down the Menu and Select buttons. You might have to hold both buttons for a very long time (30 seconds) in some cases. If that still does not work, switch the hold button on and o and try again. Disk Mode: immediately hold down the Play and Select buttons as the iPod reboots.(1) Diagnostic Mode: hold Rewind and Select buttons as the iPod reboots. DFU Mode (NOR DFU): hold Rewind and Play buttons as the iPod reboots. (works on Nano 2G, but not on 5G, DFU protocol not explored yet) Third-part rmware (only when the old bootloader is installed): hold Rewind after rebooting the iPod. (Alternatively switch the hold button to lock position after rebooting) The Select button is the one in the center of the click/scroll wheel.

iPod Nano Second Generation (Nano2G)
Tiny iPod with Color Display Distinguish Metal case which wraps around the entire iPod. Available in a few colors including silver and black. CPU S5L8701 SoC, which contains an ARM940T processor and 176KB of internal SRAM. Audio Wolfson WM8750S, based on the WM8975G) I/O RAM Samsung 32MB (256 Megabits) SDRAM Silicon Storage Technology SST39WF800A 8 Mbit Multi-Purpose Flash Storage Provided by either Samsung ,Hynix or Toshiba depending on the model Display Sharp/Optrex/Toshiba 1.5-inch (diagonal) liquid crystal display with blue-white LED backlight 176-by-132pixel resolution,.168-mm dot pitch Power Apple branded PMU (Probably a Philips PCF50635, based on the PCF50607) National Semiconductor LM34910 Step Down Switching Regulator Other Cypress CY8C21434 - Click wheel controller Linear Technology LTC4066 USB battery charging circuitry Gestalt Does not exist in new Firmware. Apple Name iPod Nano Notes Ars Technica Dissection and Analysis
iPod Nano Third Generation (Nano3G)
Smaller, metal case, larger screen, plays videos Distinguish Shorter, stubbier, large TV shaped color screen. Can play movies with Apple rmware. Sharp edge around the front metal face CPU S5L8702 SoC, which contains an ARM926EJ-S processor and 256KB of internal SRAM. Audio Apple branded 76BZKTM (Known to be some Wolfson Chip), or is it the Apple branded 338S0462 76ARKTM chip (it is on the same side as the CPU but right next to the output capacitors on the opposite side)? I/O Touch wheel uses a Synaptics controller TACV1846 (ribbon and wheel also Synaptics branded, 940-151-4RA) RAM Hynix HYE1SM256 - 32MB SDRAM or Samsung K4X56163PI-GGC3 - 32MB Mobile DDR SDRAM Storage Intel, Micron or Samsung Chip, 4GB: Intel 29F32G08FAMB2 / 8GB: Samsung 728K9HCG08U5M Display 320x240, 204ppi 2 color LCD screen Power Apple branded 338S0408 07288HAX (e4 in a circle like on the Intel NAND ash)? Other ?? Gestalt ?? Apple Name iPod nano Notes iFixit Teardown
iPod Nano Fourth Generation (Nano4G)
Slimmer, rounded metal case, longer screen, plays videos sideways Distinguish Portrait color screen, rounded edges. Plays movies horizontally. Has the Genius feature. Built-in accelerometer. CPU S5L8720 SoC containing an ARM1136JZF-S processor and 192KB of internal SRAM. Audio ?? I/O ?? RAM 32MB of external SDRAM Storage Toshiba TH58NVG6D1DLA87 4GB Flash RAM chips Display 2 inch, 320x240 resolution, 204ppi (Unknown supplier and unknown controller) Power ?? Other ?? Gestalt ?? Apple Name iPod nano Notes iFixit Teardown

iPod Nano Fifth Generation (Nano5G)
Added video camera, radio Distinguish Bigger screen, built-in video camera, radio. CPU Apple branded Samsung S5L8730 ARM CPU Audio ?? I/O ?? RAM ?? Storage Toshiba NAND Display 2,2 inch, 240x376 resolution (Unknown supplier and unknown controller) Power ?? Other ?? Gestalt ?? Apple Name iPod nano Notes Teardown CPU model similar to the one in Touch2G (S5L8720). IPSW les have a header 87302.0. It seems that 5G uses a derivation of iPhone 8900 les

Widescreen iPods

iPod with touch screen Distinguish Touch screen, no click wheel. CPU Apple branded ARM cpu, 339S0029ARM with integrated Samsung memory Audio Wolfson Microelectronics WM87588G Audio codec I/O ?? RAM 128MB Storage Toshiba TH58NVG5D4CTG20 4GB Flash RAM chips for 8GB,16GB or 32GB Flashbased storage Display 3,5 480x320 widescreen multi-touch display Wireless LAN Marvell W8686B13 (802.11a/b/g WLAN) Power ?? Other ?? Gestalt ?? Notes iFixit Teardown 2D barcodes reads 9C73608WAX45B (unable to read the one on the battery). More details on this iPods hardware are currently unknown and will be added whenever someone does a vivisection.

Shue iPods

Ultra-portable ash-based iPod. Listed here for completeness. Distinguish Size similar to a pack of gum. CPU SigmaTels D-Major. This chip has a DSP56004 core. There is currently no recent GCC compiler for DSP56000 and therefore no uClinux/iPodLinux. Gestalt Does not exist on iPod shues. Apple Name iPod shue Notes Old gcc DSP56000 compiler
iPod Shue Second Generation
ash-based iPod. Listed here for completeness. Clip-on design. Apple branded ARM chip, 337S3300 844A N05WDKDoes not exist on iPod shues. iPod shue
Ultra-portable Distinguish CPU Gestalt Apple Name
iPod Shue Third Generation
Apple calls this also second generation Shue. The only dierence in naming is: iPod shue (2nd generation Early 2008) (introduced 2008-02) iPod shue (2nd generation) (introduced 2006-09)
Ultra-portable Distinguish CPU Storage Gestalt Apple Name
ash-based iPod. Listed here for completeness. (Same as 2nd Generation) Clip-on design. ?? 1GB or 2GB Does not exist on iPod shues. iPod shue
iPod Shue Fourth Generation
Please note that Apple calls this the third generation Shue.
Ultra-portable Distinguish CPU Storage Gestalt Apple Name Notes
ash-based iPod. Listed here for completeness. Clip-on design. As small as a key. ?? 4GB only Does not exist on iPod shues. iPod shue Has got voice function installed, as user interface.
iLounge has written a great article, A Brief History of iPod: http://www.ilounge.com/index.php/ articles/comments/instant-expert-a-brief-history-of-ipod/. Apple has a nice guide about identifying dierent iPod models: http://support.apple.com/kb/HT1353.

Credits

Special thanks to : Our teacher Emmanuel Fleury without whom this report would not have existed Michael TheSeven Sparmann who highly participated to the project and had the patience to listen to our questions and give us some of his time to explain us many points Christophe tof Riehl, Cory cmwslw Walker, Dave linuxstb Chapman, Taylor n00b81 Gordon, Felix fxb Bruns, David planetbeing Wang, Finn Farthen Wilke and Franz-Josef liar Haider, who highly contributed as well to achieve the whole understanding of the iPod nano 2G and the port of a third-pard rmware on it Everybody else who donated broken or even working hardware Here is also a non-exhaustive list of those who contributed to the project/report. Please excuse us if some people are missing : 3mpty AW Aaron P. DSouza Alex Willisson Alexander Jrgensen Alexander Papst Amaya Anton Zweistein Apage43 Ari Bahattin Tozyilmaz Benoit Badrignans Beno Ryder t Biscuit Thomas bizthepirate C@che DaHoC Dan Andrews Daniel Mason EdwardRF GearForce Isaac Caldwell James Watkins Jean-Damien Brossillon Jean-Loup Le Roux Jeremy Prater Jrme Soumagne eo John Pitsburg John Gaylord Keenan Pepper Keripo lala32 Manuel Naranjo Markus Macher Martin Sandsmark mat h max Michael Thomas ndsrox Niklas Ulvinge Oliver McFadden Paul Martin Paul McCabe Patrick Wohlschlegel Raoul Guggenheim Sebastian Elsner Sebastian Schutte Sbastien Fourestier e serpilliere Stephane Dekeyzer Tom Stellard Tyler Steinmetz Vincent Mauge Wayfarer William Poetra Yoga Hadisoeseno

UVO SYSTEM Media Device Compatibility
Foryourconvenience,hereisalistingofmediadevicesthathavebeentestedwiththeUVOSystemandtheirfunctionality.Newmediadevicesare introducedfrequentlyalthoughyourmediadevicemaynotbelistedhere,itmayworkwiththeUVOSystem. NOTE:Thisinformationisbasedoninformationprovidedbyotherparties;Kiaisnotresponsibleforerrors

AppleiPod/iPhone

iPodClassic(4G) iPodClassic(5G) iPodClassic(6G) iPodNano(2G) iPodNano(3G) iPodNano(4G) iPodNano(5G) iPodNano(6G) iPodMini(2G) iPodShuffle(3G) iPodShuffle(4G) iPodTouch(1G) iPodTouch(2G) iPodTouch(3G) iPodTouch(4G) iPhone(original) iPhone(3G) iPhone(3GS) iPhone(4G) Firmware 1.2.1/ 3.1.1 1.3 1.1.2 1.1.3 1.1.3 1.0.4 1.0.2 1.1 1.4.1 1.1 1.0.1 3.1.3 4.2.1 4.3 4.3 3.1.3 4.2.1 4.3 4.2.6/4.3 GB 20/30/ 40/60 30/60/ 80 80/120 /160 2/4/8 4/8 4/8/16 8/16 8/16 4/6 2/8/16/ 32 8/16/ 32 32/64 8/32/ 64 4/8/16 8/16 8/16/ 32 16/32

Indexall formats

Next/ previoustrack

Auto play

Manual playback
Prevtrack Prevtrack at1sec at10sec.

Nexttrackw/ audiobook

Prevtrackw/ audiobook

Podcasts

Comments Requiresa 2wirecable

Requiresa 2wirecable

Page1of2 3/21/2011

MicrosoftZune

Zune Zune(2G) ZuneHD Music Audio books Podcasts ZunePass Artist Album TrackTitle Genre BrowseWhile Indexing AlbumArt FFW/RW AudioBlips

iPodisaregisteredtrademarkofAppleInc.iPodmobiledigitaldevicesoldseparately. MicrosoftisaregisteredtrademarkofMicrosoftCorporationintheUnitedStatesand/orothercountries.

Page2of2 3/21/2011