iPhone Boot Sequence - from power of to OS start up... how does this occur

looking for info if someone can help with to understand what the sequence is of the device going from being turned off to starting up and running the os.

what are the steps for bootstrapping it self.

Does anyone have some expertise in this area and can help?

Thanks.

Quote:

---

Originally Posted by dustbyter

looking for info if someone can help with to understand what the sequence is of the device going from being turned off to starting up and running the os.

what are the steps for bootstrapping it self.

Does anyone have some expertise in this area and can help?

---

The bootchain for the app-cpu is

VROM(Bootrom)->LLB->iBoot->Kernel->System Software

The entire boot chain (except the bootrom) resides on the NOR flash (some of the very latest devices like the iPod Touch 3G use NAND flash).

There is an open source version of iBoot openiboot at master from planetbeing's iphonelinux - GitHub that is used for iPhone Linux / iDroid I would start with that if I was interested in understanding the boot process.

thanks for this info.

its exactly what i was looking for.

Reading up on this there appears to be a lot of learning still ahead of me.
Thanks for providing the link to the open source iBoot which I'll need to review to understand the details of what is signed and what isn't when the loading process runs.

I've spent some time reading up on the exploits used so far to provide access to the lower level functionality in the application and they are pretty standard with what has been seen on other deviced as well. Try to get your code to run on the device set up a command handler to run your commands...

If you have any other pointers or locations to understand what is currently out there i'd be more then appreciative of that to read it and do some learning :)

Quote:

---

Originally Posted by dustbyter

Reading up on this there appears to be a lot of learning still ahead of me.
Thanks for providing the link to the open source iBoot which I'll need to review to understand the details of what is signed and what isn't when the loading process runs.

I've spent some time reading up on the exploits used so far to provide access to the lower level functionality in the application and they are pretty standard with what has been seen on other deviced as well. Try to get your code to run on the device set up a command handler to run your commands...

If you have any other pointers or locations to understand what is currently out there i'd be more then appreciative of that to read it and do some learning :)

---

Everything is signed, this is how they implement the chain of trust from hardware onwards. There is an Apple patent for the IMG3 / boot process

see Single Security Model In Booting A ... - Google Patent Search

ChronicDev's wiki provides a lot of good info (it's all from OS 2.x but the IMG3 format has hardly changed in OS 3.x) Wiki Pages - chronicdev - Project Hosting on Google Code

Thanks for the info you provided.

Going through as much as I can to learn about the boot process.
If i have any more questions I'll ask here.