What is the iPhone Secpack?

Secpack is a file that contains several digital signatures, including the one of a matching baseband firmware. It’s used by the bootloader to verify the baseband’s integrity and where does it come actually before baseband is flashed. The secpack is a security pack used in iPhone 2.

A secpack is a tiny part of info which is needed for successful iPhone basenband update. File’s size is 2048k and it is generated with help of ICE*.{eep,fls} files which are included in the Apple iPhone’s restore file. Once the file is extracted you are  free to use tools like ieraser for baseband wiping. After that the new baseband software must be applied with help of bbupdate. If you want to learn more about secpack in-detail description and its header decryption go to this article on iPhone Elite Development Team blog.

To extract the secpack form Apple’s IPSW you need to download the firmware. The file restore or upgrade file format is basically a .zip file with special iTunes-compatible extension. Few browsers are even trying to unzip it after the download is finished which you won’t actually need to do.

The file contains sections like the ones showed below:

struct section_header  {  	unsigned int	id;  	unsigned int	size;  	unsigned int	sub_id;  };

and followed by the data. The size define the header size (0xC) and the size of data.

Section ID

0xCF8 -- Header  0x2 -- Footer  0xB -- Memory Map  0x10 -- File Description (type (EEP, FLS, ...), ...)

Offsets

• secpack
  • 0xCD4 — offset to name(add 0xCF8 for secpack 2.0)
  • 0xCEC — size
  • 0xCF8 — data??
• endpack(starts after data)
  • 0×830 — 0x01FEDABE
  • 0×834 — address
  • 0×838 — region size
  • 0x83C — real size

Secpack Loader

It has two loaders:

1. bootrom loader which loads at 0×80000
2. bootloader loader which loads at 0×86000

How to extract Seckpack from iPhone Firmware

The only way to dump secpack is to decrypt the iPhone Firmware file and extract the secpack file. We are going to published detailed how to guide for iPhone 2g fans.

Tags: baseband, exploit, secpack, seczone

Loading

Popular Posts