On the iPhone Wiki there are decryption keys for several, but not all, of the iPhone firmwares (root filesystems and kernelcache files). How were these keys found?

  • 1
    This is hardware specific you don't mention the hardware version. Feb 18 '17 at 4:19

AFAIK these keys are calculated by the bootrom code using the GID (model-specific) key which is disabled afterwards (IIRC) and cannot be used even if you have kernel code execution. So you need to have some kind of bootrom code exec for the specific model you have the kernelcache for.

The actual keys are stored in the KBAG section of the .img4 wrapper format, encrypted with the GID key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.