Jump to content

iBoot

Edit links
From Wikipedia, the free encyclopedia
(Redirected from IBoot (Bootloader))
iBoot
Developer(s)Apple Inc.
Initial releaseJune 29, 2007
Stable release
iBoot-11881.40.163~61 (RELEASE)
Preview release
iBoot-11881.80.44~18 (RELEASE)
Operating systemDarwin, macOS,[1] iPadOS and iOS[2]
Platformx86, ARM
TypeBoot loader
LicenseProprietary software

iBoot is the stage 2 bootloader for iPhones, iPads, Apple silicon-based Macs, and the T2 chip in Intel-based Macs with such a chip.[3] [4] Compared with its predecessor, iBoot improves authentication performed in the boot chain.[2]

For Intel-based Macs with a T2 chip, the boot process starts by running code on the T2 chip from the boot ROM. That code has two primary responsibilities: to initialize system hardware (POST) and to load and run iBoot on the T2 chip. iBoot loads the bridgeOS operating system onto the T2 chip and starts it; bridgeOS loads the UEFI firmware into memory on the T2 chip, and starts the main Intel processor, which runs the UEFI firmware from the memory image on the T2 chip. The UEFI firmware loads boot.efi, which loads and starts the macOS kernel.[4]

For iPhones, iPads and Apple silicon-based Macs, the boot process starts by running the device's boot ROM. On iPhones and iPads with A9 or earlier A-series processors, the boot ROM loads the Low-Level Bootloader (LLB), which is the stage 1 bootloader and loads iBoot; on Macs and devices with A10 or later processors, the boot ROM loads iBoot. If all goes well, iBoot will then proceed to load the iOS, iPadOS or macOS kernel as well as the rest of the operating system.[5][6][7] If iBoot fails to load or fails to verify iOS, iPadOS or macOS, the bootloader jumps to DFU (Device Firmware Update)[8] mode; otherwise it loads the remaining kernel modules.[2][9]

Once the kernel and all drivers necessary for booting are loaded, the boot loader starts the kernel’s initialization procedure. At this point, enough drivers are loaded for the kernel to find the root device.[10]

Since Apple A7, the LLB and iBoot are stored on NAND flash of iPhone or iPad;[11] since Apple M1, the LLB is stored on the internal SSD of Apple silicon Mac.[12]

Build styles

[edit]

In iBoot, the build style varies on the version being used. Apple, Inc often uses "DEVELOPMENT" builds of iBoot, having features that are not available to "RELEASE" versions of it. This could apply to "DEBUG" or "SECRET" builds of it, but is not yet known.

Meanings

[edit]

RELEASE - A release version

DEVELOPMENT - A build that is used on developmental hardware, allows access to some developmental tools, such as the 'diags' command.

DEBUG - A build used for debugging iOS and other lower-level components

Features

[edit]

iBoot features a command prompt when in recovery, DFU, or restore mode (it is also in "DEBUG" builds of iBoot, but was never seen in future builds). Command availability depends on the type of iBoot being used, especially the build style (can be RELEASE, DEVELOPMENT, DEBUG, SECRET, etc).[citation needed]

When using iBoot's command prompt, the included commands are used to manage the behaviour, such as its boot arguments (internally called the "boot-args" in the NVRAM), or if the startup command (fsboot) should be used when iBoot is automatically loaded (known as auto-boot).[13][14]

Memory safety

[edit]

Apple has modified the C compiler toolchain that is used to build iBoot in order to advance memory safety since iOS 14. This advancement is designed to mitigate entire classes of common memory corruption vulnerabilities such as buffer overflows, heap exploitations, type confusion vulnerabilities, and use-after-free attacks. These modifications can potentially prevent attackers from successfully escalating their privileges to run malicious code, such as an attack involving arbitrary code execution.[15]

Source code leak incident

[edit]

In 2018, a portion of iBoot source code for iOS 9 was leaked on GitHub for various iPhone, iPad, iPod touch, and Apple Watch models,[16] Apple then issued a copyright takedown request (DMCA) to GitHub to remove the repository. It was believed an Apple employee was responsible for the leak. However, this was not confirmed by Apple. It is known that a user by the name of "ZioShiba" was responsible for the publication of the iBoot source code.

History

[edit]
iBoot-87.1, the earliest known version of iBoot running on production hardware over serial. Screenshot by mcg29 on X.

The earliest known version of iBoot was iBoot-87.1, seen on very early prototypes during the iPhone's production in 2006-2007.[17] It had the same features as the first known version of iBoot (iBoot-99), except it not having features before the final release. This version of iBoot could be considered the "first early beta" of iBoot. Following the release of the iPhone 2G and iPhone OS 1, the first release iBoot version was iBoot-159.

References

[edit]
  1. ^ "Darwin 9.2 Source Code". Apple Inc. Archived from the original on September 21, 2020. Retrieved January 19, 2020.
  2. ^ a b c Ryan, Peter Y. A.; Naccache, David; Quisquater, Jean-Jacques (2016-03-17). The New Codebreakers: Essays Dedicated to David Kahn on the Occasion of His 85th Birthday. Springer. ISBN 9783662493014.
  3. ^ Hayes, Darren R. (2014-12-17). A Practical Guide to Computer Forensics Investigations. Pearson IT Certification. ISBN 9780132756150.
  4. ^ a b "Boot process for an Intel-based Mac - Apple Support". Apple Platform Security.
  5. ^ Apple Inc. (May 2016). "iOS Security Guide" (PDF). apple.com. Archived (PDF) from the original on February 27, 2016.
  6. ^ "Boot process for iPhone and iPad devices - Apple Support". Apple Platform Security.
  7. ^ "Boot process for a Mac with Apple silicon - Apple Support". Apple Platform Security.
  8. ^ "iFixit Support: DFU Restore". iFixit. Retrieved 2019-09-29.
  9. ^ "*OS: iBoot" (PDF).
  10. ^ "The Early Boot Process". developer.apple.com. Retrieved 2017-08-26.
  11. ^ "LLB". The Apple Wiki. 2023-09-10. Retrieved 2024-11-27.
  12. ^ hoakley (2021-01-14). "M1 Macs radically change boot and recovery". The Eclectic Light Company. Retrieved 2024-11-27.
  13. ^ "iRecovery on GitHub".
  14. ^ "iBoot information from the Apple Wiki".
  15. ^ "Memory safe iBoot implementation". Apple Platform Security. Apple. Retrieved 25 January 2023.
  16. ^ "Apple confirms iPhone source code leak". BBC News. 9 February 2018.
  17. ^ "iBoot-87.1 on the iPhone 2G by mcg29 on Twitter". 6 March 2024.
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=IBoot&oldid=1265561659"