Jump to content

Category:Apple

From postmarketOS Wiki

This is a generic page for all information surrounding Apple devices running postmarketOS.

iDevices

iDevices are any Apple device that is not a desktop or laptop. These usually have the brand name of "i(Hardware Line)", such as iPhones, iPads, etc. Hence the name iDevices.

Flashing

Summary

Flashing iDevices works quite differently from most devices supported. Since Apple does not allow running alternative operating systems in any way, nor licensing their operating system to third-party distributors, Apple does not have a public tool for flashing like Android's fastboot. Because of this, hackers have had to find exploits in the boot process to allow running unsigned code. The exploit that supports most modern iDevices, and the one currently used for postmarketOS ports, is the checkm8 exploit.

The checkm8 exploit is commonly used for "jailbreaking" iDevices to allow running custom software in iOS. This can be extended to also running custom software at the boot level, meaning a Linux kernel can be booted. To do this, a bootloader called m1n1, developed by the Asahi Linux team, is used to create a sane C environment that the kernel can be executed from. m1n1 is run in RAM with a Linux kernel, dtbs, and an initramfs appended. This allows getting around checkm8's tethered nature, disallowing persistent kernel booting, by acting similarly to Android's fastboot boot.

A postmarketOS rootfs can be netbooted using the initramfs hook, or it can be flashed by using dd after the initramfs has run setup_usb_storage /dev/nvme0n1 to flash the rootfs and boot partitions to the disk. This also allows dual-booting iOS by running resize_apfs from a jailbroken iOS and flashing pmOS to the freed space. Although, running in this configuration is unsupported.

Tooling

While flashing using the checkm8 method is not in pmbootstrap yet, it is still possible to exploit without it. Commonly, exploitation is done using the proprietary checkra1n tool, but it is entirely possible to flash using wholly FOSS tools, if a bit more convoluted.

First, a device running the A7 to A11 SOC must be put into what is called the "pwn'd DFU mode", with "pwn'd" meaning exploited. This means putting the device into regular Device Firmware Update Mode (DFU mode) and then running the gaster tool to pwn it. Then gaster reset is run to enter into a "pwd'd recovery mode", where, on A10 to A11 a patched iBoot is passed, and on A7-A9 a patched iBoot Single Stage (iBSS) and a patched iBoot Epoch Change (iBEC) are passed to allow bypassing signature verification.

The patched iBoots are specific to each device and, because they are non-distributable, are required to be obtained at runtime by the user. This is done by using the ipsw tool with the commands ipsw download ipsw --device <iDevice model> --latest --pattern <iBSS,iBEC,DeviceTree>. The "DeviceTree" downloaded is not a Linux dtb, but instead an Apple Device Tree (ADT), which is slightly different in implementation from the Linux dtb.

To patch iBoot, it must be decrypted first. The decryption algorithm lies in the device, so the iv and key must be gotten from each of the iBoot binaries using ipsw img4 im4p extract -b <iBSS,iBEC>.im4p. This prints the iv and key in JSON format, which can be appended and used to get the decryption keys from the device in pwn'd DFU mode using gaster decrypt_kbag <iv><key>. This will print the actual iv and key that can be used to decrypt the iBoot it came from. This is done using ipsw img4 im4p extract --iv=<decrypted_iv> --key=<decrypted_key> <iBSS,iBEC>.im4p. This will give the raw binaries, which are then patched using the iBootPatcher from ra1nsn0w.

Now that iBSS and iBEC are patched, efforts can move over to the Linux side. This means building m1n1-idevice to act as the bootloader and appending the Linux kernel, dtbs, and initramfs with the command

cat /path/to/m1n1.macho \
    /path/to/linux/boot/dtbs/apple/*.dtb \
    /tmp/postmarketOS-export/vmlinuz  \
    /tmp/postmarketOS-export/initramfs \
    > m1n1-linux.macho

Finally, these can all be booted using irecovery. If all goes well, the postmarketOS logo should appear.

Aarch64 Macs

Aarch64 Macs are any desktop or laptop Apple device that runs ARM, commonly branded as "Mac"s. These include the Apple Silicon line of SOCs (M1,2,3...) and may include some mobile devices that make use of these SOCs.

Apple Devices

To make it easier to find devices, all Apple devices are named after the codename of the first model of the product, excluding the "ap" suffix. For example, the iPad Gen 3 has the codenames j1ap, j2ap, and j2aap, but all three of them are similar enough to be one device. Thus the pmOS codename is apple-j1.

Device Codename Chipset Release year Booting USB Net Flashing Touch Screen Wifi FDE Battery 3D IMU Audio Bluetooth Camera GPS Mobile Data SMS Calls USB-OTG NFC
Apple Apple M-series Macs generic-apple-mac Apple M1/ Apple M2/ Apple M3/Apple M4 2020 Yes - - - Y Y P Y Y - P Y Y - - - - - -
Apple Generic iDevice apple-idevice Yes Y P N P N N N N N N N N - - - - N N
Apple iBridge T2 apple-ibridgeT2 Apple T2 2017 Yes N N N N - N N N - - - - - - - - N -
Apple iPad (1G) apple-k48 Apple A4 2010 Yes N P N P N N - - - - - -
Apple iPhone 4 apple-n90 Apple A4 2010 Yes Y N N N N N N N N N N N N N N -
Apple iPhone 5s apple-n51 Apple A7 2013 Yes Y N Y N N N N N N N N N -
Apple iPhone 6 apple-n61 Apple A8 2014 Yes Y N N P N N N N N N N N N N N N N -
Apple iPhone 6s/6s+ plus apple-n71 Apple A9 2015 Yes N Y P -
Apple iPhone 7/7 plus apple-d10 Apple A10 Fusion 2016 Yes P Y P -
Apple iPhone 8 apple-d20 Apple A11 Bionic 2017 Yes
Apple iPhone SE (1st generation) apple-n69 Apple A9 2016 Yes Y N P -
Apple iPhone X (Global) apple-d22 Apple A11 2017 Yes Y N N P N N N N N N N N N N N N N -
Apple MacBook Air apple-tonga Apple M1 2020 Yes Y - - Y P Y P - P Y Y - - - - Y -
Apple iPad 2 apple-k93 Apple A5 2011 No
Apple iPad 3 apple-j1 Apple A5X 2012 No
Apple iPad 6th generation apple-j71b Apple A10 fusion 2018 No - -
Apple iPad Air 2 apple-j81 Apple A8X 2014 No
Apple iPad Air 2 apple-j82 Apple A8X 2014 No - -
Apple iPhone 12 mini apple-d52g Apple A14 2020 No -
Apple iPhone 3G apple-n82 Samsung 1176JZ(F)-S 2008 No - -
Apple iPhone 4s apple-n94 Apple A5 2011 No -
Apple iPhone 5 apple-n41 Apple A6 2012 No -
Apple iPod Touch (1G) apple-n45 Samsung S5L8900 2007 No - - - - -
Apple Mac mini M1 apple-j274 Apple M1 2020 No Y - - Y Y P - Y - Y Y - - - - - - -
Apple Tonga tonga-generic Apple M1 2020 No Y N N Y Y N - Y - Y Y Y N N N N Y -
Apple TV (1G) apple-itv 2007 No - - - - - - - - - - - - - - - - - -
Apple iPad mini apple-p105 Apple A5 2012 - - - - -

Apple SoCs

SoC Arch Year UART USB Storage Display CPU GPU Pinctrl I²C Audio Video Thermal WiFi BT Modem GPS Camera Suspend
Apple A4 armv7 2010 P N N N N N N N N N N - - - - N N
Apple A5 armv7 2011 P N N N N N N N N N N - - - - N N
Apple A7 (S5L8960X/S5L8965X) aarch64 2013 Y P P P Y Y - - - - N
Apple A8 aarch64 2014 Y P N P P N Y Y N N N N
Apple M1 (T8103/Tonga) aarch64 2020 Y Y Y Y Y Y Y Y - - - - Y P