Nate True's Weblog: Posts tagged with quiche

Details on decrypting the new iPhone 1.0.1 firmware image

Posted by natetrue 48 weeks ago

Not sure how DMCA-legal this is, but here's the skinny.

Download the Restore package using iTunes. Hit Restore on your iPhone screen and accept all the wild legal mumbo jumbo (after reading it thoroughly). Then unplug your iPhone as it downloads.

Head over to where iPhone updates are stored (on Windows, Run "application data\Apple Computer\iTunes\iPhone Software Updates") and rename the new .ipsw to .zip.

Extract the contents.

Run this command on the Ramdisk DMG:

strings 009-7662-6.dmg | grep "^[0-9a-fA-F]*$"

Look at the strings that come out. One of them is very long.

Now grab vfdecrypt.

Edit vfdecrypt.c putting in the key you found where it says INSERT KEY HERE. Use the same amount of characters as the hyphens in there, replacing them with parts of the key.

Now compile vfdecrypt. You can use Cygwin - use the command gcc vfdecrypt.c -lcrypto -o vfdecrypt.exe

Run vfdecrypt, passing it the name of the encrypted DMG ("694-5281-6.dmg") and the name of an output file (say, "694-5281-6-decrypted.dmg").

Now if you're on Windows you need Transmac to open the DMG. If you're on Mac you can just open it.

Voila, files for you!