Category:Apple
This is a generic page for all information surrounding Apple devices running postmarketOS.
iDevices
iDevices are any Apple device that is not a desktop or laptop. These usually have the brand name of "i(Hardware Line)", such as iPhones, iPads, etc. Hence the name iDevices.
Flashing
Summary
Flashing iDevices works quite differently from most devices supported. Since Apple does not allow running alternative operating systems in any way, nor licensing their operating system to third-party distributors, Apple does not have a public tool for flashing like Android's fastboot. Because of this, hackers have had to find exploits in the boot process to allow running unsigned code. The exploit that supports most modern iDevices, and the one currently used for postmarketOS ports, is the checkm8 exploit.
The checkm8 exploit is commonly used for "jailbreaking" iDevices to allow running custom software in iOS. This can be extended to also running custom software at the boot level, meaning a Linux kernel can be booted. To do this, a bootloader called m1n1, developed by the Asahi Linux team, is used to create a sane C environment that the kernel can be executed from. m1n1 is run in RAM with a Linux kernel, dtbs, and an initramfs appended. This allows getting around checkm8's tethered nature, disallowing persistent kernel booting, by acting similarly to Android's fastboot boot
.
A postmarketOS rootfs can be netbooted using the initramfs hook, or it can be flashed by using dd
after the initramfs has run setup_usb_storage /dev/nvme0n1
to flash the rootfs and boot partitions to the disk. This also allows dual-booting iOS by running resize_apfs from a jailbroken iOS and flashing pmOS to the freed space. Although, running in this configuration is unsupported.
Tooling
While flashing using the checkm8 method is not in pmbootstrap yet, it is still possible to exploit without it. Commonly, exploitation is done using the proprietary checkra1n tool, but it is entirely possible to flash using wholly FOSS tools, if a bit more convoluted.
First, a device running the A7 to A11 SOC must be put into what is called the "pwn'd DFU mode", with "pwn'd" meaning exploited. This means putting the device into regular Device Firmware Update Mode (DFU mode) and then running the gaster tool to pwn it. Then gaster reset
is run to enter into a "pwd'd recovery mode", where, on A10 to A11 a patched iBoot is passed, and on A7-A9 a patched iBoot Single Stage (iBSS) and a patched iBoot Epoch Change (iBEC) are passed to allow bypassing signature verification.
The patched iBoots are specific to each device and, because they are non-distributable, are required to be obtained at runtime by the user. This is done by using the ipsw tool with the commands
ipsw download ipsw --device <iDevice model> --latest --pattern <iBSS,iBEC,DeviceTree>
. The "DeviceTree" downloaded is not a Linux dtb, but instead an Apple Device Tree (ADT), which is slightly different in implementation from the Linux dtb.
To patch iBoot, it must be decrypted first. The decryption algorithm lies in the device, so the iv and key must be gotten from each of the iBoot binaries using ipsw img4 im4p extract -b <iBSS,iBEC>.im4p
. This prints the iv and key in JSON format, which can be appended and used to get the decryption keys from the device in pwn'd DFU mode using gaster decrypt_kbag <iv><key>
. This will print the actual iv and key that can be used to decrypt the iBoot it came from. This is done using ipsw img4 im4p extract --iv=<decrypted_iv> --key=<decrypted_key> <iBSS,iBEC>.im4p
. This will give the raw binaries, which are then patched using the iBootPatcher from ra1nsn0w.
Now that iBSS and iBEC are patched, efforts can move over to the Linux side. This means building m1n1-idevice to act as the bootloader and appending the Linux kernel, dtbs, and initramfs with the command
cat /path/to/m1n1.macho \
/path/to/linux/boot/dtbs/apple/*.dtb \
/tmp/postmarketOS-export/vmlinuz \
/tmp/postmarketOS-export/initramfs \
> m1n1-linux.macho
Finally, these can all be booted using irecovery. If all goes well, the postmarketOS logo should appear.
Aarch64 Macs
Aarch64 Macs are any desktop or laptop Apple device that runs ARM, commonly branded as "Mac"s. These include the Apple Silicon line of SOCs (M1,2,3...) and may include some mobile devices that make use of these SOCs.
Apple Devices
To make it easier to find devices, all Apple devices are named after the codename of the first model of the product, excluding the "ap" suffix. For example, the iPad Gen 3 has the codenames j1ap, j2ap, and j2aap, but all three of them are similar enough to be one device. Thus the pmOS codename is apple-j1.
Device | Codename | Chipset | Release year | Booting | USB Net | Flashing | Touch | Screen | Wifi | FDE | Battery | 3D | IMU | Audio | Bluetooth | Camera | GPS | Mobile Data | SMS | Calls | USB-OTG | NFC |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Apple Apple M-series Macs | generic-apple-mac | Apple M1/ Apple M2/ Apple M3/Apple M4 | 2020 | Yes | - | - | - | Y | Y | P | Y | Y | - | P | Y | Y | - | - | - | - | - | - |
Apple Generic iDevice | apple-idevice | Yes | Y | P | N | P | N | N | N | N | N | N | N | N | - | - | - | - | N | N | ||
Apple iBridge T2 | apple-ibridgeT2 | Apple T2 | 2017 | Yes | N | N | N | N | - | N | N | N | - | - | - | - | - | - | - | - | N | - |
Apple iPad (1G) | apple-k48 | Apple A4 | 2010 | Yes | N | P | N | P | N | N | - | - | - | - | - | - | ||||||
Apple iPhone 4 | apple-n90 | Apple A4 | 2010 | Yes | Y | N | N | N | N | N | N | N | N | N | N | N | N | N | N | - | ||
Apple iPhone 5s | apple-n51 | Apple A7 | 2013 | Yes | Y | N | Y | N | N | N | N | N | N | N | N | N | - | |||||
Apple iPhone 6 | apple-n61 | Apple A8 | 2014 | Yes | Y | N | N | P | N | N | N | N | N | N | N | N | N | N | N | N | N | - |
Apple iPhone 6s/6s+ plus | apple-n71 | Apple A9 | 2015 | Yes | N | Y | P | - | ||||||||||||||
Apple iPhone 7/7 plus | apple-d10 | Apple A10 Fusion | 2016 | Yes | P | Y | P | - | ||||||||||||||
Apple iPhone 8 | apple-d20 | Apple A11 Bionic | 2017 | Yes | ||||||||||||||||||
Apple iPhone SE (1st generation) | apple-n69 | Apple A9 | 2016 | Yes | Y | N | P | - | ||||||||||||||
Apple iPhone X (Global) | apple-d22 | Apple A11 | 2017 | Yes | Y | N | N | P | N | N | N | N | N | N | N | N | N | N | N | N | N | - |
Apple MacBook Air | apple-tonga | Apple M1 | 2020 | Yes | Y | - | - | Y | P | Y | P | - | P | Y | Y | - | - | - | - | Y | - | |
Apple iPad 2 | apple-k93 | Apple A5 | 2011 | No | ||||||||||||||||||
Apple iPad 3 | apple-j1 | Apple A5X | 2012 | No | ||||||||||||||||||
Apple iPad 6th generation | apple-j71b | Apple A10 fusion | 2018 | No | - | - | ||||||||||||||||
Apple iPad Air 2 | apple-j81 | Apple A8X | 2014 | No | ||||||||||||||||||
Apple iPad Air 2 | apple-j82 | Apple A8X | 2014 | No | - | - | ||||||||||||||||
Apple iPhone 12 mini | apple-d52g | Apple A14 | 2020 | No | - | |||||||||||||||||
Apple iPhone 3G | apple-n82 | Samsung 1176JZ(F)-S | 2008 | No | - | - | ||||||||||||||||
Apple iPhone 4s | apple-n94 | Apple A5 | 2011 | No | - | |||||||||||||||||
Apple iPhone 5 | apple-n41 | Apple A6 | 2012 | No | - | |||||||||||||||||
Apple iPod Touch (1G) | apple-n45 | Samsung S5L8900 | 2007 | No | - | - | - | - | - | |||||||||||||
Apple Mac mini M1 | apple-j274 | Apple M1 | 2020 | No | Y | - | - | Y | Y | P | - | Y | - | Y | Y | - | - | - | - | - | - | - |
Apple Tonga | tonga-generic | Apple M1 | 2020 | No | Y | N | N | Y | Y | N | - | Y | - | Y | Y | Y | N | N | N | N | Y | - |
Apple TV (1G) | apple-itv | 2007 | No | - | - | - | - | - | - | - | - | - | - | - | - | - | - | - | - | - | - | |
Apple iPad mini | apple-p105 | Apple A5 | 2012 | - | - | - | - | - |
Apple SoCs
SoC | Arch | Year | UART | USB | Storage | Display | CPU | GPU | Pinctrl | I²C | Audio | Video | Thermal | WiFi | BT | Modem | GPS | Camera | Suspend |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Apple A4 | armv7 | 2010 | P | N | N | N | N | N | N | N | N | N | N | - | - | - | - | N | N |
Apple A5 | armv7 | 2011 | P | N | N | N | N | N | N | N | N | N | N | - | - | - | - | N | N |
Apple A7 (S5L8960X/S5L8965X) | aarch64 | 2013 | Y | P | P | P | Y | Y | - | - | - | - | N | ||||||
Apple A8 | aarch64 | 2014 | Y | P | N | P | P | N | Y | Y | N | N | N | N | |||||
Apple M1 (T8103/Tonga) | aarch64 | 2020 | Y | Y | Y | Y | Y | Y | Y | Y | - | - | - | - | Y | P |
Pages in category "Apple"
The following 32 pages are in this category, out of 32 total.
A
- Apple A4
- Apple A5
- Apple A7
- Apple A8
- Apple Generic iDevice (apple-idevice)
- Apple iBridge T2 (apple-ibridgeT2)
- Apple iPad 1G (apple-k48)
- Apple iPad 2 (apple-k93)
- Apple iPad 3 (apple-j1)
- Apple iPad 6th gen (apple-j71b)
- Apple iPad Air 2 (apple-j81)
- Apple iPad Air 2 (apple-j82)
- Apple iPad mini (apple-p105)
- Apple iPhone 12 mini (apple-d52g)
- Apple iPhone 3G (apple-n82)
- Apple iPhone 4 (apple-iphone4)
- Apple iPhone 4s (apple-n94)
- Apple iPhone 5 (apple-n41)
- Apple iPhone 5s (apple-n51)
- Apple iPhone 6 (apple-n61)
- Apple iPhone 6s/6s+ (apple-n71)
- Apple iPhone 7/7+ (apple-d10)
- Apple iPhone 8 (apple-d20)
- Apple iPhone SE (1st generation) (apple-n69)
- Apple iPhone X (Global) (apple-d22)
- Apple iPod Touch 1G (apple-n45)
- Apple M1
- Apple M1 Generic Port
- Apple Mac mini 2020 M1 (apple-j274)
- Apple Macbook Air M1 (apple-tonga)
- Apple TV 1G (apple-itv)