On the iPhone Wiki there are decryption keys for several, but not all, of the iPhone firmwares (root filesystems and kernelcache files). How were these keys found?

  • 1
    This is hardware specific you don't mention the hardware version. Commented Feb 18, 2017 at 4:19

1 Answer 1


AFAIK these keys are calculated by the bootrom code using the GID (model-specific) key which is disabled afterwards (IIRC) and cannot be used even if you have kernel code execution. So you need to have some kind of bootrom code exec for the specific model you have the kernelcache for.

The actual keys are stored in the KBAG section of the .img4 wrapper format, encrypted with the GID key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.