IPSW is a file format used to install

iOS Ios, Io or Nio (, ; ; locally Nios, Νιός) is a Greek island in the Cyclades group in the Aegean Sea. Ios is a hilly island with cliffs down to the sea on most sides. It is situated halfway between Naxos and Santorini. It is about long an ...

iPadOS iPadOS is a mobile operating system developed by Apple for its iPad line of tablet computers. It was given a name distinct from iOS, the operating system used by Apple's iPhones to reflect the diverging features of the two product lines, suc ...

tvOS tvOS (formerly Apple TV Software) is an operating system developed by Apple for the Apple TV, a digital media player. In the first-generation Apple TV, Apple TV Software was based on Mac OS X. The software for the second-generation and later ...

HomePod The HomePod is a series of smart speakers developed by Apple Inc., Apple. Designed to work with the Apple Music subscription service, the HomePod incorporates beamforming and eight speakers and is sold in two colors: white and midnight. It is s ...

watchOS watchOS is the operating system of the Apple Watch, developed by Apple Inc., Apple. It is based on iOS, the operating system used by the iPhone, and has many similar features. It was released on April 24, 2015, along with the Apple Watch, the o ...

, and most recently,

macOS macOS, previously OS X and originally Mac OS X, is a Unix, Unix-based operating system developed and marketed by Apple Inc., Apple since 2001. It is the current operating system for Apple's Mac (computer), Mac computers. With ...

firmware In computing Computing is any goal-oriented activity requiring, benefiting from, or creating computer, computing machinery. It includes the study and experimentation of algorithmic processes, and the development of both computer hardware, h ...

for devices equipped with

Apple silicon Apple silicon is a series of system on a chip (SoC) and system in a package (SiP) processors designed by Apple Inc., mainly using the ARM architecture family, ARM architecture. They are used in nearly all of the company's devices including Mac ...

. All

Apple An apple is a round, edible fruit produced by an apple tree (''Malus'' spp.). Fruit trees of the orchard or domestic apple (''Malus domestica''), the most widely grown in the genus, are agriculture, cultivated worldwide. The tree originated ...

devices share the same IPSW file format for

firmware and their derivatives, allowing users to flash their devices through Finder or

iTunes iTunes is a media player, media library, and mobile device management (MDM) utility developed by Apple. It is used to purchase, play, download and organize digital multimedia on personal computers running the macOS and Windows operating s ...

Windows Windows is a Product lining, product line of Proprietary software, proprietary graphical user interface, graphical operating systems developed and marketed by Microsoft. It is grouped into families and subfamilies that cater to particular sec ...

, respectively. Users can flash Apple silicon Macs through Apple Configurator 2.

Structure

The .ipsw file itself is a compressed

archive file In computing, an archive file stores the content of one or more files, possibly compressed, with associated metadata such as file name, directory structure, error detection and correction information, commentary, compressed data archives, sto ...

(renamed Zip archive) containing at least three

Apple Disk Image Apple Disk Image is a disk image format commonly used by the macOS operating system. When opened, an Apple Disk Image is mounted as a volume within the Finder. An Apple Disk Image can be structured according to one of several proprietary disk ...

files with one containing the root file system of the OS and two ram disks for restore and update.

audioOS The HomePod is a series of smart speakers developed by Apple. Designed to work with the Apple Music subscription service, the HomePod incorporates beamforming and eight speakers and is sold in two colors: white and midnight. It is sold alongs ...

and

also include a disk image for the recovery environment (recoveryOS). The file also holds the kernel caches, and a "Firmware" folder which contains iBoot, LLB (Low-Level Bootloader), iBSS (iBoot Single Stage), iBEC (iBoot Epoch Change), the Secure Enclave Processor firmware, the Device Tree, Firmware Images (Apple logo, battery images, Recovery mode screen and more),

baseband In telecommunications and signal processing, baseband is the range of frequencies occupied by a signal that has not been modulated to higher frequencies. Baseband signals typically originate from transducers, converting some other variable into ...

firmware files in .bbfw format (renamed zip file), and other firmware files. There are two more files named "BuildManifest.plist" and "Restore.plist", both property lists that contain compatibility information and SHA-256 hashes for different components. BuildManifest.plist is sent to Apple's TSS server and checked in order to obtain SHSH blobs before every restore. Without SHSH blobs, the device will refuse to restore, thus making downgrades very difficult to achieve. The IPSW file format plays a crucial role in managing the software updates and restores for a variety of Apple devices. Its use extends beyond jus
iPhones and iPads
as it now also covers Apple silicon Macs, which can be updated using Apple Configurator 2. These files are integral to the device's firmware and contain various critical components needed for proper functioning, such as the kernel, device drivers, and booting files. The careful organization of these components ensures that the device not only runs smoothly after an update or restore but also maintains security by verifying the integrity of the firmware files. The inclusion of SHSH blobs, which are required for validating firmware restoration, further demonstrates the controlled environment that Apple enforces for updates and downgrades. These mechanisms help prevent users from inadvertently downgrading to insecure or outdated versions, protecting the security of the devices and the integrity of the Apple ecosystem as a whole.

Security and rooting

The archive is not password-protected, but iBoot, LLB, iBEC, iBSS, iBootData and the Secure Enclave Processor firmware images inside it are encrypted with AES. Until

iOS 10 iOS 10 is the iOS version history, tenth major release of the iOS mobile operating system developed by Apple Inc., being the successor to iOS 9. It was announced at the company's Worldwide Developers Conference on June 13, 2016, and was release ...

, all the firmware files (including the root file system and Restore and Update ramdisks) were encrypted. While Apple does not release these keys, they can be extracted using different iBoot or

bootloader A bootloader, also spelled as boot loader or called bootstrap loader, is a computer program that is responsible for booting a computer and booting an operating system. If it also provides an interactive menu with multiple boot choices then it's o ...

exploits, such as limera1n (created by George Hotz, more commonly known as ''geohot''). Since then, many tools were created for the decryption and modification of the root file system.

Government data access

After the 2015 San Bernardino attack, the FBI recovered the shooter's

iPhone 5C The iPhone 5c is a smartphone that was developed and marketed by Apple Inc. It is part of the sixth generation of the iPhone. The device was unveiled on September 10, 2013, and released on September 20, 2013, along with its higher-end counte ...

, which belonged to the San Bernardino County Department of Public Health. The FBI recovered

iCloud iCloud is the personal cloud service of Apple Inc. Launched on October 12, 2011, iCloud enables users to store and Data synchronization, sync data across devices, including Apple Mail, Calendar (Apple), Apple Calendar, Photos (Apple), Apple Ph ...

backups from one and a half months before the shooting, and wanted to access encrypted files on the device. The U.S. government ordered Apple to produce an IPSW file that would allow investigators to brute force the passcode of the iPhone. The order used the All Writs Act, originally created by the

Judiciary Act of 1789 The Judiciary Act of 1789 (ch. 20, ) was a United States federal statute enacted on September 24, 1789, during the first session of the First United States Congress. It established the federal judiciary of the United States. Article Three of th ...

, to demand the firmware, in the same way as other smartphone manufacturers have been ordered to comply.

Tim Cook Timothy Donald Cook (born November 1, 1960) is an American business executive who is the current chief executive officer of Apple Inc. Cook had previously been the company's chief operating officer under its co-founder Steve Jobs. Cook joined ...

responded on the company's webpage, outlining a need for encryption, and arguing that if they produce a backdoor for one device, it would inevitably be used to compromise the privacy of other iPhone users:

References

{{reflist, 30em

Structure

Security and rooting

Government data access

References

External links