A collection of reverse engineered Apple formats, protocols, or other interesting bits.
Join us on Discord: https://discord.gg/hackdifferent
Repo inspired by https://github.com/papers-we-love/papers-we-love
We want this collection to be around for new jailbreakers and hobbiests for years to come, so we must say: this
collection accepts (with gratitude) pull-requests that improve it, but under no circumstances
will a PR based on AppleInternal, or any other copyrighted works protected by the
DMCA be accepted. If
you need help determining this, tag the PR with license help, join the
Discord server, and ask a #Legit or higher role for help.
Violation of the DMCA or Copyright law is the responsibility of the submitter.
Wiki's best serve prose, and part of the goal here is to leverage machine readable and ingestable information with human augmentation wherever possible. Also GitHub is more conducive to allowing any user to fork and PR the repo lowering the barrier to entry. The core team reviews PRs for quality before merging.
The contents of this repo are dual-licensed:
Licensed under the MIT license
Also licensed under the CC-BY-SA
Apple Knowledge by Hack Different is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
All data is derived from machine readable files (YAML) in this repo under _data
Updates and additions there should automatically be reflected in the documents
hack-different/apple-knowledge/_data
- IDA Disassembler by HexRays
- VisUAL ARM Simulator
- Ghidra Disassembler
- Hopper Disassembler
blacktop/ipsw
- OWASP: iOS Tampering and Reverse Engineering
- Kernel Debug Kit
- *OS Internals by Jonathan Levin
- T2 Dev Setup
- Apple 4CC
- APFS - Apple Filesystem
- NeXT / Apple "Bill of Materials" /
pkg/bom pbzx- Apple Disk Image -
dmg - Signed System Volumes (SSV) /
root_hash
- Property Lists
- iTunes database
- Apple iDevice Backup Format
- Apple Flavored PNG
- Apple IMA ADPCM
- AirPlay2
- Mach-O / Signing / Entitlements
- img4 - Apple signed images, version 4
- TrustCache - Pre-authorized Binary Hashes
- EALF -
eficheckbaselines - ChunkList - Used to verify macOS Recovery / Internet Recovery
dyldShared Cache- iBoot LocalPolicy, RemotePolicy and BAA signing
- Rosetta2
- Basically all iDevice / iTunes
- DFU / Recovery
- usbmuxd - USB transport for iDevices
com.apple.restored- iDevice Restore Protocol- UTDM - USB Target Disk Mode
- USB-C Power Delivery - Vendor Defined Messages
- Apple Wi-Fi Password Sharing
- AWDL - Apple Wireless Distribution Link
- Bluetooth Bonjour (Service Discovery)
- Apple Watch Pairing
com.apple.terminusd- Magic Pairing
- ATC - Air Traffic Control - iTunes Wi-Fi Sync
- RemoteXPC
- macOS Internet Recovery
- FDR - Factory Data Restore
- SysCfg - System Configuration - Serial Number and other Device Info
- APTicket - The root of an authorized version set
- AWDD - Apple Wireless Diagnostics (misnomer, more then wireless, system trace)
- iCloud Keychain (Umbrella for multiple formats)
- Mojo Serial
- XHC20 USB Capture
Hack Different's Knowledge is a product of the entire community and belongs to the community. It is facilitated by the volunteer work of the Hack Different moderation team.
Portions of data and knowledge come from https://theiphonewiki.org, https://libimobiledevice.org and https://checkra.in as well as the individuals who brought you those projects.
A list of all projects and their contributors is at CREDITS
Here’s to the crazy ones, the misfits, the rebels, the troublemakers
the round pegs in the square holes…
the ones who see things differently — they’re not fond of rules…
You can quote them, disagree with them, glorify or vilify them, but the only thing you can’t do is ignore them because they change things…
They push the human race forward, and while some may see them as the crazy ones,
we see genius,
because the ones who are crazy enough to think that they can change the world,
are the ones who do.
— Steve Jobs, 1997
Also dedicated to the volunteer work of those who use this for good, and deny the shadow to those who seek to harm.