merged some changes from dksite, fixed up some stuff in crypto

README.markdown

@@ -5,7 +5,7 @@ The X is for "cross", because unlike PwnageTool, this utility has no
 dependencies on proprietary, closed-source software and can potentially be
 compiled and used on any platform.
 
-This is a special proof-of-concept version available only on Linux,
+This is a special proof-of-concept version available on any platform,
 compiled with static libraries to minimize potential issues (which is why the
 executables are a bit on the heavy side).
 

crypto/BUILD

@@ -0,0 +1,4 @@
+These tools are meant to be built and run from the iPhone.
+
+Use apt to install iphone-gcc, make, and get the headers from somewhere.
+

crypto/Makefile

@@ -0,0 +1,13 @@
+all:	aes patch-kernel-crypto
+
+aes:	aes.c
+	gcc aes.c -lIOKit -o aes
+	ldid -S aes
+
+patch-kernel-crypto:	patch-kernel-crypto.c
+	gcc patch-kernel-crypto.c -o patch-kernel-crypto
+	ldid -S patch-kernel-crypto
+
+clean:
+	rm aes patch-kernel-crypto
+

crypto/README

@@ -0,0 +1,89 @@
+Hardware AES utilities
+(C) The iPhone Dev Team
+
+README BEFORE DOING ANYTHING
+
+If you don't read this document before attempting to use the software, you are
+a fool. One of the utilities included herein attempts to patch your kernel,
+which can potentially render your iPhone/iPod unbootable.
+
+This package allows you to directly access the iPhone's AES engine from
+userland. You may encrypt and decrypt with the UID and GID keys, as well as
+any custom keys you provide.
+
+These tools are designed to run on an iPhone with firmare >= 2.0.
+
+In order to enable encryption/decryption with the UID and GID keys, a kernel
+patch is required. This can be done with the following command:
+
+	sudo ./patch-kernel.sh <iv> <key>
+
+The IV and key must have been previously unwrapped from the kernel's KBAG. You
+can find the ones the Dev Team have unwrapped in PwnageTool's FirmwareBundles'
+Info.plists. For example, for the 2.0.1 kernel, you would use the following
+command:
+
+	sudo ./patch_kernel.sh 285df0aa00b76e8c0b9870a4dd7bd5f6 \
+		444f19d072e725f8a27d88ce50ce73de
+
+Change the underscore to a dash. This prevents people who don't actually pay
+attention from working it out.
+
+If the kernel is unencrypted (2.0.2, for example), the iv and key arguments
+should be omitted.
+
+The script attempts a generic patch, but there's no guarantee it won't screw
+up your kernel. A backup copy of your kernel will be made at /kernel.backup
+
+Please note that this patch creates a security vulnerability in which
+malicious code (which you must execute yourself) can use your UID key without
+your knowledge or authorization. This may lead to your personal information
+being compromised. Possibly not a big deal if you're already running a
+jailbroken system anyway.
+
+Afterwards, reboot your phone:
+
+	sudo reboot
+
+This script requires xpwntool (included), sources for which are available from
+http://www.github.com/planetbeing/xpwn. It easily builds on the iPhone (and
+with the Linux toolchain) if you compile a copy of libpng.a for the iPhone and
+cmake.
+
+The utility itself is easy to use:
+
+	./aes <enc|dec> <UID/GID/custom key> [data] [iv]
+
+For example, if you wanted to generate the 0x837 key:
+
+	./aes enc GID 345A2D6C5050D058780DA431F0710E15
+
+Or if you wanted to encrypt with your own key/IV:
+
+	./aes enc 850AFC271132D15AE6989565567E65BF \
+		e92d4090e59f0038e59f1038e5810000 \
+		29681F625D1F61271EC3116601B8BCDE
+
+If stdin is a file, then the third argument will be taken as the
+initialization vector, and the data to encrypt or decrypt will be taken from
+stdin in binary format. If stdout is a file, then instead of printing out the
+results in hex format, the results will be written to the file in binary
+format. So say, you wanted to decrypt an old 8900 ramdisk:
+
+	./aes dec 188458a6d15034dfe386f23b61d43774 < ramdisk.img2 > x.dec
+
+Sources for the tools are included. The Makefile is designed to be used on a
+2.0 iPhone that has Saurik's toolchain installed.
+
+CREDITS
+-------
+
+The direct ancestor of this utility is a piece of code wizdaz wrote to do
+something similar. In this version, the code was stripped down, adapted and
+ported to 2.0.
+
+Probably a bunch of people had reverse engineered poor hwaes_crypt in the
+Security framework. I know pumpkin has certainly looked at it. The calling
+conventions for IOAESAccelerator is pretty clear from the disassembly of that.
+=P
+

crypto/aes.c

@@ -0,0 +1,229 @@
+// Shamelesssly ripped off from wizdaz
+
+#include <stdlib.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <IOKit/IOKitLib.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <libgen.h>
+
+typedef struct 
+{
+	void*		inbuf;
+	void*		outbuf;
+	uint32_t	size;
+	uint8_t		iv[16];
+	uint32_t	mode;
+	uint32_t	bits;
+	uint8_t		keybuf[32];
+	uint32_t	mask;
+} IOAESStruct;
+
+#define kIOAESAcceleratorInfo 0
+#define kIOAESAcceleratorTask 1
+#define kIOAESAcceleratorTest 2
+
+#define kIOAESAcceleratorEncrypt 0
+#define kIOAESAcceleratorDecrypt 1
+
+#define kIOAESAcceleratorGIDMask 0x3E8
+#define kIOAESAcceleratorUIDMask 0x7D0
+#define kIOAESAcceleratorCustomMask 0
+
+typedef enum {
+	UID,
+	GID,
+	Custom
+} IOAESKeyType;
+
+IOReturn doAES(io_connect_t conn, void* inbuf, void *outbuf, uint32_t size, IOAESKeyType keyType, void* key, void* iv, int mode) {
+	IOAESStruct in;
+
+	in.mode = mode;
+	in.bits = 128;
+	in.inbuf = inbuf;
+	in.outbuf = outbuf;
+	in.size = size;
+
+	switch(keyType) {
+		case UID:
+			in.mask = kIOAESAcceleratorUIDMask;
+			break;
+		case GID:
+			in.mask = kIOAESAcceleratorGIDMask;
+			break;
+		case Custom:
+			in.mask = kIOAESAcceleratorCustomMask;
+			break;
+	}
+	memset(in.keybuf, 0, sizeof(in.keybuf));
+
+	if(key)
+		memcpy(in.keybuf, key, in.bits / 8);
+
+	if(iv)
+		memcpy(in.iv, iv, 16);
+	else
+		memset(in.iv, 0, 16);
+
+	IOByteCount inSize = sizeof(in);
+
+	return IOConnectCallStructMethod(conn, kIOAESAcceleratorTask, &in, inSize, &in, &inSize);
+}
+
+void hexToBytes(const char* hex, uint8_t** buffer, size_t* bytes) {
+	*bytes = strlen(hex) / 2;
+	*buffer = (uint8_t*) malloc(*bytes);
+	size_t i;
+	for(i = 0; i < *bytes; i++) {
+		uint32_t byte;
+		sscanf(hex, "%02x", &byte);
+		(*buffer)[i] = byte;
+		hex += 2;
+	}
+}
+
+void bytesToHex(const uint8_t* buffer, size_t bytes) {
+	size_t i;
+	while(bytes > 0) {
+		printf("%02x", *buffer);
+		buffer++;
+		bytes--;
+	}
+}
+
+int main(int argc, char* argv[]) {
+	IOReturn ret;
+
+	size_t keyLength;
+	size_t ivLength;
+	size_t dataLength;
+
+	uint8_t* key = NULL;
+	uint8_t* iv = NULL;
+	uint8_t* data = NULL;
+
+	int direction;
+	IOAESKeyType keyType;
+
+	int stdinFile = 0;
+	int stdoutFile = 0;
+
+	struct stat std_stat;
+	fstat(fileno(stdin), &std_stat);
+	if((std_stat.st_mode & S_IFREG) != 0)
+		stdinFile = 1;
+
+	fstat(fileno(stdout), &std_stat);
+	if((std_stat.st_mode & S_IFREG) != 0)
+		stdoutFile = 1;
+
+	if(strcmp(basename(argv[0]), "aescmd") == 0) {
+		stdinFile = 0;
+		stdoutFile = 0;
+	}
+
+	if(argc < 3) {
+		fprintf(stderr, "usage: %s <enc/dec> <GID/UID/key> [data] [iv]\n", argv[0]);
+		return 0;
+	}
+
+	if(strncasecmp(argv[1], "enc", 3) == 0) {
+		direction = kIOAESAcceleratorEncrypt;
+	} else if(strncasecmp(argv[1], "dec", 3) == 0) {
+		direction = kIOAESAcceleratorDecrypt;
+	} else {
+		fprintf(stderr, "error: method must be 'enc' or 'dec'\n");
+		return 1;
+	}
+
+	if(strcasecmp(argv[2], "GID") == 0) {
+		keyType = GID;
+	} else if(strcasecmp(argv[2], "UID") == 0) {
+		keyType = UID;
+	} else {
+		keyType = Custom;
+		hexToBytes(argv[2], &key, &keyLength);
+	}
+
+	if(stdinFile) {
+		if(argc >= 4)
+			hexToBytes(argv[3], &iv, &ivLength);
+	} else {
+		hexToBytes(argv[3], &data, &dataLength);
+
+		if(argc >= 5)
+			hexToBytes(argv[4], &iv, &ivLength);
+	}
+
+
+	CFMutableDictionaryRef dict = IOServiceMatching("IOAESAccelerator");
+	io_service_t dev = IOServiceGetMatchingService(kIOMasterPortDefault, dict);
+	io_connect_t conn = 0;
+
+	if(!dev) {
+		fprintf(stderr, "error: IOAESAccelerator device not found!\n");
+		goto quit;
+	}
+
+	ret = IOServiceOpen(dev, mach_task_self(), 0, &conn);
+
+	if(ret != kIOReturnSuccess) {
+		fprintf(stderr, "error: Cannot open service\n");
+		goto quit;
+	}
+
+	if(stdinFile) {
+		uint8_t aIV[16];
+		if(!iv) {
+			memset(aIV, 0, 16);
+			iv = aIV;
+		}
+		data = (uint8_t*) malloc(16);
+		while(!feof(stdin)) {
+			dataLength = 16;
+			dataLength = fread(data, 1, dataLength, stdin);
+			
+			if(dataLength == 0)
+				break;
+
+			if((ret = doAES(conn, data, data, dataLength, keyType, key, iv, direction)) != kIOReturnSuccess) {
+				fprintf(stderr, "IOAESAccelerator returned: %x\n", ret);
+				goto quit;
+			}
+			if(stdoutFile) {
+				fwrite(data, 1, dataLength, stdout);
+			} else {
+				bytesToHex(data, dataLength);
+				printf("\n");
+			}
+		}
+	} else {
+		if((ret = doAES(conn, data, data, dataLength, keyType, key, iv, direction)) != kIOReturnSuccess) {
+			fprintf(stderr, "IOAESAccelerator returned: %x\n", ret);
+			goto quit;
+		}
+
+		if(stdoutFile) {
+			fwrite(data, 1, dataLength, stdout);
+		} else {
+			bytesToHex(data, dataLength);
+			printf("\n");
+		}
+	}
+
+quit:
+	if(data)
+		free(data);
+
+	if(conn)
+		IOServiceClose(conn);
+
+	if(dev)
+		IOObjectRelease(dev);
+
+	return 0;
+}
+

crypto/aescmd

@@ -0,0 +1 @@
+aes

crypto/patch-kernel-crypto.c

@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+
+const char patch[] = {0x7d, 0x0e, 0x53, 0xe3, 0x02, 0x60, 0xa0, 0xe1};
+
+const char patch2[] = {0xfa, 0x0f, 0x53, 0xe3, 0x05, 0x00, 0x00, 0x1a};
+
+int main(int argc, char* argv[]) {
+	int matchLoc = 0;
+	FILE* file = fopen(argv[1], "rb+");
+	fseek(file, 0, SEEK_END);
+	int length = ftell(file);
+	fseek(file, 0, SEEK_SET);
+	uint8_t* buffer = malloc(length);
+	fread(buffer, 1, length, file);
+
+	int i;
+	for(i = 0; i < length; i++) {
+		uint8_t* candidate = &buffer[i];
+		if(memcmp(candidate, patch, sizeof(patch)) == 0) {
+			candidate[2] = 0x5f;
+			fseek(file, i, SEEK_SET);
+			fwrite(candidate, sizeof(patch), 1, file);
+			continue;
+		}
+		if(memcmp(candidate, patch2, sizeof(patch2)) == 0) {
+			candidate[2] = 0x5f;
+			fseek(file, i, SEEK_SET);
+			fwrite(candidate, sizeof(patch2), 1, file);
+			continue;
+		}
+	}
+
+	fclose(file);
+
+	return 0;
+}
+

crypto/patch-kernel.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+XPWNTOOL=./xpwntool
+PATCHKERNEL=./patch-kernel-crypto
+KERNEL=/System/Library/Caches/com.apple.kernelcaches/kernelcache.s5l8900x
+
+if [ $# -ne 2 ]
+then
+	${XPWNTOOL} ${KERNEL} /tmp/a
+	${PATCHKERNEL} /tmp/a
+	${XPWNTOOL} /tmp/a /tmp/b -t ${KERNEL}
+else
+	${XPWNTOOL} ${KERNEL} /tmp/a -iv $1 -k $2
+	${PATCHKERNEL} /tmp/a
+	${XPWNTOOL} /tmp/a /tmp/b -t ${KERNEL} -iv $1 -k $2
+fi
+
+rm /tmp/a
+cp ${KERNEL} /kernel.backup
+cp /tmp/b ${KERNEL}
+rm /tmp/b
+

ipsw-patch/FirmwareBundles/iPhone1,1_2.0.2_5C1.bundle/Info.plist

@@ -0,0 +1,250 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>BasebandPatches</key>
+	<dict>
+		<key>BBUpdater</key>
+		<dict>
+			<key>File</key>
+			<string>usr/local/bin/bbupdater</string>
+			<key>Patch</key>
+			<string>bbupdater.patch</string>
+			<key>Path</key>
+			<string>Applications/BootNeuter.app/bin/bbupdater</string>
+		</dict>
+		<key>Baseband EEP</key>
+		<dict>
+			<key>File</key>
+			<string>usr/local/standalone/firmware/ICE04.05.04_G.eep</string>
+			<key>Path</key>
+			<string>Applications/BootNeuter.app/firmware/ICE04.05.04_G.eep</string>
+		</dict>
+		<key>Baseband FLS</key>
+		<dict>
+			<key>File</key>
+			<string>usr/local/standalone/firmware/ICE04.05.04_G.fls</string>
+			<key>Path</key>
+			<string>Applications/BootNeuter.app/firmware/ICE04.05.04_G.fls</string>
+		</dict>
+		<key>Bootloader 3.9</key>
+		<dict>
+			<key>Path</key>
+			<string>Applications/BootNeuter.app/firmware/bl39.bin</string>
+		</dict>
+		<key>Bootloader 4.6</key>
+		<dict>
+			<key>Path</key>
+			<string>Applications/BootNeuter.app/firmware/bl46.bin</string>
+		</dict>
+	</dict>
+	<key>FilesystemPatches</key>
+	<dict>
+		<key>Core Files Installation</key>
+		<array>
+			<dict>
+				<key>Action</key>
+				<string>ReplaceKernel</string>
+				<key>File</key>
+				<string>kernelcache.release.s5l8900x</string>
+				<key>Name</key>
+				<string>KernelCache</string>
+				<key>Path</key>
+				<string>System/Library/Caches/com.apple.kernelcaches/kernelcache.s5l8900x</string>
+			</dict>
+		</array>
+		<key>Filesystem Jailbreak</key>
+		<array>
+			<dict>
+				<key>Action</key>
+				<string>Patch</string>
+				<key>File</key>
+				<string>etc/fstab</string>
+				<key>Name</key>
+				<string>Filesystem Write Access</string>
+				<key>Patch</key>
+				<string>fstab.patch</string>
+			</dict>
+			<dict>
+				<key>Action</key>
+				<string>Patch</string>
+				<key>File</key>
+				<string>System/Library/Lockdown/Services.plist</string>
+				<key>Name</key>
+				<string>Apple File Connection v2</string>
+				<key>Patch</key>
+				<string>Services.plist.patch</string>
+			</dict>
+		</array>
+		<key>Phone Activation</key>
+		<array>
+			<dict>
+				<key>Action</key>
+				<string>Patch</string>
+				<key>File</key>
+				<string>usr/libexec/lockdownd</string>
+				<key>Name</key>
+				<string>Lockdownd Patch</string>
+				<key>Patch</key>
+				<string>lockdownd.patch</string>
+			</dict>
+		</array>
+	</dict>
+	<key>FirmwarePatches</key>
+	<dict>
+		<key>AppleLogo</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.m68ap.production/applelogo.s5l8900x.img3</string>
+			<key>IV</key>
+			<string>bf67cfba9160ad7dbdf44f2baf176458</string>
+			<key>Key</key>
+			<string>4b69f6c9eed042cacf89fc575ff3b193</string>
+		</dict>
+		<key>DeviceTree</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.m68ap.production/DeviceTree.m68ap.img3</string>
+			<key>Patch</key>
+			<string>DeviceTree.m68ap.patch</string>
+			<key>IV</key>
+			<string>45254ae98f0e3460e5190812ac627b15</string>
+			<key>Key</key>
+			<string>26d739a57194a59926edb4112798c447</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>KernelCache</key>
+		<dict>
+			<key>File</key>
+			<string>kernelcache.release.s5l8900x</string>
+			<key>Patch</key>
+			<string>kernelcache.release.patch</string>
+			<key>TypeFlag</key>
+			<integer>4</integer>
+		</dict>
+		<key>LLB</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.m68ap.production/LLB.m68ap.RELEASE.img3</string>
+			<key>Patch</key>
+			<string>LLB.m68ap.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>RecoveryMode</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.m68ap.production/recoverymode.s5l8900x.img3</string>
+			<key>IV</key>
+			<string>0e1504c70c2b7eabe2488a5bf7b1ac60</string>
+			<key>Key</key>
+			<string>2e5d3470a5a1c9ab8b6c7c334569e86f</string>
+		</dict>
+		<key>Restore Ramdisk</key>
+		<dict>
+			<key>File</key>
+			<string>018-4000-1.dmg</string>
+			<key>Patch</key>
+			<string>018-4000-1.patch</string>
+			<key>Patch2</key>
+			<string>018-4000-1-nowipe.patch</string>
+			<key>IV</key>
+			<string>cbafeb5d381dcba6a6dd94edc3b63bfe</string>
+			<key>Key</key>
+			<string>3635e76652cd326c3005a6eb48e549cc</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>Update Ramdisk</key>
+		<dict>
+			<key>File</key>
+			<string>018-3984-1.dmg</string>
+			<key>Patch</key>
+			<string>018-3984-1.patch</string>
+			<key>IV</key>
+			<string>537eb4e7129ea81f572ec23dbec42b80</string>
+			<key>Key</key>
+			<string>cc028fd29dc27f895e401d9865e72100</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>iBEC</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/dfu/iBEC.m68ap.RELEASE.dfu</string>
+			<key>Patch</key>
+			<string>iBEC.m68ap.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>iBSS</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/dfu/iBSS.m68ap.RELEASE.dfu</string>
+			<key>Patch</key>
+			<string>iBSS.m68ap.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>WTF</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/dfu/WTF.m68ap.RELEASE.dfu</string>
+			<key>Patch</key>
+			<string>WTF.m68ap.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>WTF 2</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/dfu/WTF.s5l8900xall.RELEASE.dfu</string>
+			<key>Patch</key>
+			<string>WTF.s5l8900xall.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>iBoot</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.m68ap.production/iBoot.m68ap.RELEASE.img3</string>
+			<key>Patch</key>
+			<string>iBoot.m68ap.RELEASE.patch</string>
+			<key>IV</key>
+			<string>2e3a392e8c2e0e5c9f00ef4c23259596</string>
+			<key>Key</key>
+			<string>dedefcf601e83b05dcd36bce41b83e5e</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+	</dict>
+	<key>PreInstalledPackages</key>
+	<array>
+		<string>com.ripdev.install</string>
+		<string>org.saurik.cydia</string>
+	</array>
+	<key>RamdiskMountVolume</key>
+	<string>ramdisk</string>
+	<key>RootFilesystem</key>
+	<string>018-3998-1.dmg</string>
+	<key>RootFilesystemUsedSpace</key>
+	<integer>438</integer>
+	<key>RootFilesystemSize</key>
+	<integer>500</integer>
+	<key>RootFilesystemKey</key>
+	<string>31E3FF09FF046D5237187346EE893015354D2135E3F0F39480BE63DD2A18444961C2DA5D</string>
+	<key>RootFilesystemMountVolume</key>
+	<string>BigBear5C1.M68OS</string>
+	<key>SHA1</key>
+	<string>b84b57bea919bdc720287ec908c1378e7d7b5e1b</string>
+	<key>Filename</key>
+	<string>iPhone1,1_2.0.2_5C1_Restore.ipsw</string>
+	<key>Name</key>
+	<string>iPhone1,1_2.0.2_5C1</string>
+	<key>DownloadUrl</key>
+	<string>http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5246.20080818.2V0hO/iPhone1,1_2.0.2_5C1_Restore.ipsw</string>
+	<key>Platform</key>
+	<integer>1</integer>	
+</dict>
+</plist>

ipsw-patch/FirmwareBundles/iPhone1,2_2.0.2_5C1.bundle/Info.plist

@@ -0,0 +1,214 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>FilesystemPatches</key>
+	<dict>
+		<key>Core Files Installation</key>
+		<array>
+			<dict>
+				<key>Action</key>
+				<string>ReplaceKernel</string>
+				<key>File</key>
+				<string>kernelcache.release.s5l8900x</string>
+				<key>Name</key>
+				<string>KernelCache</string>
+				<key>Path</key>
+				<string>System/Library/Caches/com.apple.kernelcaches/kernelcache.s5l8900x</string>
+			</dict>
+		</array>
+		<key>Filesystem Jailbreak</key>
+		<array>
+			<dict>
+				<key>Action</key>
+				<string>Patch</string>
+				<key>File</key>
+				<string>etc/fstab</string>
+				<key>Name</key>
+				<string>Filesystem Write Access</string>
+				<key>Patch</key>
+				<string>fstab.patch</string>
+			</dict>
+			<dict>
+				<key>Action</key>
+				<string>Patch</string>
+				<key>File</key>
+				<string>System/Library/Lockdown/Services.plist</string>
+				<key>Name</key>
+				<string>Apple File Connection v2</string>
+				<key>Patch</key>
+				<string>Services.plist.patch</string>
+			</dict>
+		</array>
+		<key>Phone Activation</key>
+		<array>
+			<dict>
+				<key>Action</key>
+				<string>Patch</string>
+				<key>File</key>
+				<string>usr/libexec/lockdownd</string>
+				<key>Name</key>
+				<string>Lockdownd Patch</string>
+				<key>Patch</key>
+				<string>lockdownd.patch</string>
+			</dict>
+		</array>
+	</dict>
+	<key>FirmwarePatches</key>
+	<dict>
+		<key>AppleLogo</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.n82ap.production/applelogo.s5l8900x.img3</string>
+			<key>IV</key>
+			<string>bf67cfba9160ad7dbdf44f2baf176458</string>
+			<key>Key</key>
+			<string>4b69f6c9eed042cacf89fc575ff3b193</string>
+		</dict>
+		<key>DeviceTree</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.n82ap.production/DeviceTree.n82ap.img3</string>
+			<key>Patch</key>
+			<string>DeviceTree.n82ap.patch</string>
+			<key>IV</key>
+			<string>1cc36eafa09616b4a879fcf1faf970a8</string>
+			<key>Key</key>
+			<string>6da79b6e3f0f496f8651593916ff2b32</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>KernelCache</key>
+		<dict>
+			<key>File</key>
+			<string>kernelcache.release.s5l8900x</string>
+			<key>Patch</key>
+			<string>kernelcache.release.patch</string>
+			<key>TypeFlag</key>
+			<integer>4</integer>
+		</dict>
+		<key>LLB</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.n82ap.production/LLB.n82ap.RELEASE.img3</string>
+			<key>Patch</key>
+			<string>LLB.n82ap.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>RecoveryMode</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.n82ap.production/recoverymode.s5l8900x.img3</string>
+			<key>IV</key>
+			<string>0e1504c70c2b7eabe2488a5bf7b1ac60</string>
+			<key>Key</key>
+			<string>2e5d3470a5a1c9ab8b6c7c334569e86f</string>
+		</dict>
+		<key>Restore Ramdisk</key>
+		<dict>
+			<key>File</key>
+			<string>018-3990-1.dmg</string>
+			<key>Patch</key>
+			<string>018-3990-1.patch</string>
+			<key>Patch2</key>
+			<string>018-3990-1-nowipe.patch</string>
+			<key>IV</key>
+			<string>e3ae96be1b77d92431e9458381cffdc7</string>
+			<key>Key</key>
+			<string>0efc377a2982a98b2ab2e3c098a12908</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>Update Ramdisk</key>
+		<dict>
+			<key>File</key>
+			<string>018-3984-1.dmg</string>
+			<key>Patch</key>
+			<string>018-3984-1.patch</string>
+			<key>IV</key>
+			<string>537eb4e7129ea81f572ec23dbec42b80</string>
+			<key>Key</key>
+			<string>cc028fd29dc27f895e401d9865e72100</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>iBEC</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/dfu/iBEC.n82ap.RELEASE.dfu</string>
+			<key>Patch</key>
+			<string>iBEC.n82ap.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>iBSS</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/dfu/iBSS.n82ap.RELEASE.dfu</string>
+			<key>Patch</key>
+			<string>iBSS.n82ap.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>WTF</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/dfu/WTF.n82ap.RELEASE.dfu</string>
+			<key>Patch</key>
+			<string>WTF.n82ap.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>WTF 2</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/dfu/WTF.s5l8900xall.RELEASE.dfu</string>
+			<key>Patch</key>
+			<string>WTF.s5l8900xall.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>iBoot</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.n82ap.production/iBoot.n82ap.RELEASE.img3</string>
+			<key>Patch</key>
+			<string>iBoot.n82ap.RELEASE.patch</string>
+			<key>IV</key>
+			<string>e5da914dbe543767dc71a076dfbf7317</string>
+			<key>Key</key>
+			<string>467b29af0350ba297cffd14bfb0f94c8</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+	</dict>
+	<key>PreInstalledPackages</key>
+	<array>
+		<string>com.ripdev.install</string>
+		<string>org.saurik.cydia</string>
+	</array>
+	<key>RamdiskMountVolume</key>
+	<string>ramdisk</string>
+	<key>RootFilesystem</key>
+	<string>018-3978-1.dmg</string>
+	<key>RootFilesystemUsedSpace</key>
+	<integer>438</integer>
+	<key>RootFilesystemSize</key>
+	<integer>500</integer>
+	<key>RootFilesystemKey</key>
+	<string>31e3ff09ff046d5237187346ee893015354d2135e3f0f39480be63dd2a18444961c2da5d</string>
+	<key>RootFilesystemMountVolume</key>
+	<string>BigBear5C1.N82OS</string>
+	<key>SHA1</key>
+	<string>bef7fef954293046420fbcf947379839178a195b</string>
+	<key>Filename</key>
+	<string>iPhone1,2_2.0.2_5C1_Restore.ipsw</string>
+	<key>Name</key>
+	<string>iPhone1,2_2.0.2_5C1</string>
+	<key>DownloadUrl</key>
+	<string>http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-5241.20080818.t5Fv3/iPhone1,2_2.0.2_5C1_Restore.ipsw</string>
+	<key>Platform</key>
+	<integer>3</integer>
+</dict>
+</plist>

ipsw-patch/FirmwareBundles/iPod1,1_2.0.2_5C1.bundle/Info.plist

@@ -0,0 +1,199 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>FilesystemPatches</key>
+	<dict>
+		<key>Core Files Installation</key>
+		<array>
+			<dict>
+				<key>Action</key>
+				<string>ReplaceKernel</string>
+				<key>File</key>
+				<string>kernelcache.release.s5l8900x</string>
+				<key>Name</key>
+				<string>KernelCache</string>
+				<key>Path</key>
+				<string>System/Library/Caches/com.apple.kernelcaches/kernelcache.s5l8900x</string>
+			</dict>
+		</array>
+		<key>Filesystem Jailbreak</key>
+		<array>
+			<dict>
+				<key>Action</key>
+				<string>Patch</string>
+				<key>File</key>
+				<string>etc/fstab</string>
+				<key>Name</key>
+				<string>Filesystem Write Access</string>
+				<key>Patch</key>
+				<string>fstab.patch</string>
+			</dict>
+			<dict>
+				<key>Action</key>
+				<string>Patch</string>
+				<key>File</key>
+				<string>System/Library/Lockdown/Services.plist</string>
+				<key>Name</key>
+				<string>Apple File Connection v2</string>
+				<key>Patch</key>
+				<string>Services.plist.patch</string>
+			</dict>
+		</array>
+	</dict>
+	<key>FirmwarePatches</key>
+	<dict>
+		<key>AppleLogo</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.n45ap.production/applelogo.s5l8900x.img3</string>
+			<key>IV</key>
+			<string>bf67cfba9160ad7dbdf44f2baf176458</string>
+			<key>Key</key>
+			<string>4b69f6c9eed042cacf89fc575ff3b193</string>
+		</dict>
+		<key>DeviceTree</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.n45ap.production/DeviceTree.n45ap.img3</string>
+			<key>Patch</key>
+			<string>DeviceTree.n45ap.patch</string>
+			<key>IV</key>
+			<string>be606c8201a122182df9b0e3db4a9bcc</string>
+			<key>Key</key>
+			<string>dbe4e063c3e863e4e8c4a2492b44b50f</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>KernelCache</key>
+		<dict>
+			<key>File</key>
+			<string>kernelcache.release.s5l8900x</string>
+			<key>Patch</key>
+			<string>kernelcache.release.patch</string>
+			<key>TypeFlag</key>
+			<integer>4</integer>
+		</dict>
+		<key>LLB</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.n45ap.production/LLB.n45ap.RELEASE.img3</string>
+			<key>Patch</key>
+			<string>LLB.n45ap.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>RecoveryMode</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.n45ap.production/recoverymode.s5l8900x.img3</string>
+			<key>IV</key>
+			<string>0e1504c70c2b7eabe2488a5bf7b1ac60</string>
+			<key>Key</key>
+			<string>2e5d3470a5a1c9ab8b6c7c334569e86f</string>
+		</dict>
+		<key>Restore Ramdisk</key>
+		<dict>
+			<key>File</key>
+			<string>018-3990-1.dmg</string>
+			<key>Patch</key>
+			<string>018-3990-1.patch</string>
+			<key>Patch2</key>
+			<string>018-3990-1-nowipe.patch</string>
+			<key>IV</key>
+			<string>e3ae96be1b77d92431e9458381cffdc7</string>
+			<key>Key</key>
+			<string>0efc377a2982a98b2ab2e3c098a12908</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>Update Ramdisk</key>
+		<dict>
+			<key>File</key>
+			<string>018-3984-1.dmg</string>
+			<key>Patch</key>
+			<string>018-3984-1.patch</string>
+			<key>IV</key>
+			<string>537eb4e7129ea81f572ec23dbec42b80</string>
+			<key>Key</key>
+			<string>cc028fd29dc27f895e401d9865e72100</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>iBEC</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/dfu/iBEC.n45ap.RELEASE.dfu</string>
+			<key>Patch</key>
+			<string>iBEC.n45ap.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>iBSS</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/dfu/iBSS.n45ap.RELEASE.dfu</string>
+			<key>Patch</key>
+			<string>iBSS.n45ap.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>WTF</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/dfu/WTF.n45ap.RELEASE.dfu</string>
+			<key>Patch</key>
+			<string>WTF.n45ap.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>WTF 2</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/dfu/WTF.s5l8900xall.RELEASE.dfu</string>
+			<key>Patch</key>
+			<string>WTF.s5l8900xall.RELEASE.patch</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+		<key>iBoot</key>
+		<dict>
+			<key>File</key>
+			<string>Firmware/all_flash/all_flash.n45ap.production/iBoot.n45ap.RELEASE.img3</string>
+			<key>Patch</key>
+			<string>iBoot.n45ap.RELEASE.patch</string>
+			<key>IV</key>
+			<string>f7e464f98b0b7fe6dfdbd8d0a7f239a1</string>
+			<key>Key</key>
+			<string>524df80669f9f0237f097db25e8e0c6b</string>
+			<key>TypeFlag</key>
+			<integer>8</integer>
+		</dict>
+	</dict>
+	<key>PreInstalledPackages</key>
+	<array>
+		<string>com.ripdev.install</string>
+		<string>org.saurik.cydia</string>
+	</array>
+	<key>RamdiskMountVolume</key>
+	<string>ramdisk</string>
+	<key>RootFilesystem</key>
+	<string>018-3976-1.dmg</string>
+	<key>RootFilesystemUsedSpace</key>
+	<integer>430</integer>
+	<key>RootFilesystemSize</key>
+	<integer>500</integer>
+	<key>RootFilesystemKey</key>
+	<string>31e3ff09ff046d5237187346ee893015354d2135e3f0f39480be63dd2a18444961c2da5d</string>
+	<key>RootFilesystemMountVolume</key>
+	<string>BigBear5C1.N45OS</string>
+	<key>SHA1</key>
+	<string>c8b6f9fefa3f3777c56285dfe4c735b1e08a81a2</string>
+	<key>Filename</key>
+	<string>iPod1,1_2.0.2_5C1_Restore.ipsw</string>
+	<key>Name</key>
+	<string>iPod1,1_2.0.2_5C1</string>
+	<key>Platform</key>
+	<integer>2</integer>
+</dict>
+</plist>