iPod Classic and iPod Nano 3G, 4G

[dandin1]

It's not much use at this point of development, but if things ever get going, I've made a scan of the iPod nano 3g 4gb.  Yes, I know there's one on ifixit, but parts seem to be different on this one! 
Product details: 4g, Model No. A1236, EMC No. 2174.

http://www.nastyprisms.com/rockbox/nano3g/logicboard_edit.jpg
http://www.nastyprisms.com/rockbox/nano3g/toshiba.jpg

[sexenox]

As I am a member of the [linux4nano-dev] Mailing-List, I can say that they also plan a brute force attack on the ROM.

The 1G FLSHLOGO section only contained 0xFF's and has 9700 bytes.
The 2G FLSHLOGO has 9728 bytes (I stripped the section header).
This could be a good starting point. There's probably a key hidden in
those 28 bytes.

[GodEater]

I got my hands on a 3G Nano last week, and got an lsusb -v output from it :

Code: [Select]

Bus 008 Device 015: ID 05ac:1262 Apple, Inc. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x05ac Apple, Inc.
  idProduct          0x1262 
  bcdDevice            0.01
  iManufacturer           1 Apple Inc.
  iProduct                2 iPod
  iSerial                 3 000A27001AD79186
  bNumConfigurations      2
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xc0
      Self Powered
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk (Zip)
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength          149
    bNumInterfaces          3
    bConfigurationValue     2
    iConfiguration          4 iPod USB Interface
    bmAttributes         0xc0
      Self Powered
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass         1 Audio
      bInterfaceSubClass      1 Control Device
      bInterfaceProtocol      0 
      iInterface              0 
      AudioControl Interface Descriptor:
        bLength                 9
        bDescriptorType        36
        bDescriptorSubtype      1 (HEADER)
        bcdADC               1.00
        wTotalLength           30
        bInCollection           1
        baInterfaceNr( 0)       1
      AudioControl Interface Descriptor:
        bLength                12
        bDescriptorType        36
        bDescriptorSubtype      2 (INPUT_TERMINAL)
        bTerminalID             1
        wTerminalType      0x0201 Microphone
        bAssocTerminal          2
        bNrChannels             2
        wChannelConfig     0x0003
          Left Front (L)
          Right Front (R)
        iChannelNames           0 
        iTerminal               0 
      AudioControl Interface Descriptor:
        bLength                 9
        bDescriptorType        36
        bDescriptorSubtype      3 (OUTPUT_TERMINAL)
        bTerminalID             2
        wTerminalType      0x0101 USB Streaming
        bAssocTerminal          1
        bSourceID               1
        iTerminal               0 
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass         1 Audio
      bInterfaceSubClass      2 Streaming
      bInterfaceProtocol      0 
      iInterface              0 
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       1
      bNumEndpoints           1
      bInterfaceClass         1 Audio
      bInterfaceSubClass      2 Streaming
      bInterfaceProtocol      0 
      iInterface              0 
      AudioStreaming Interface Descriptor:
        bLength                 7
        bDescriptorType        36
        bDescriptorSubtype      1 (AS_GENERAL)
        bTerminalLink           2
        bDelay                  1 frames
        wFormatTag              1 PCM
      AudioStreaming Interface Descriptor:
        bLength                35
        bDescriptorType        36
        bDescriptorSubtype      2 (FORMAT_TYPE)
        bFormatType             1 (FORMAT_TYPE_I)
        bNrChannels             2
        bSubframeSize           2
        bBitResolution         16
        bSamFreqType            9 Discrete
        tSamFreq[ 0]         8000
        tSamFreq[ 1]        11025
        tSamFreq[ 2]        12000
        tSamFreq[ 3]        16000
        tSamFreq[ 4]        22050
        tSamFreq[ 5]        24000
        tSamFreq[ 6]        32000
        tSamFreq[ 7]        44100
        tSamFreq[ 8]        48000
      Endpoint Descriptor:
        bLength                 9
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            1
          Transfer Type            Isochronous
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x00c0  1x 192 bytes
        bInterval               4
        bRefresh                0
        bSynchAddress           0
        AudioControl Endpoint Descriptor:
          bLength                 7
          bDescriptorType        37
          bDescriptorSubtype      1 (EP_GENERAL)
          bmAttributes         0x01
            Sampling Frequency
          bLockDelayUnits         0 Undefined
          wLockDelay              0 Undefined
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      0 No Subclass
      bInterfaceProtocol      0 None
      iInterface              0 
        HID Device Descriptor:
          bLength                 9
          bDescriptorType        33
          bcdHID               1.01
          bCountryCode            0 Not supported
          bNumDescriptors         1
          bDescriptorType        34 Report
          wDescriptorLength     208
         Report Descriptors: 
           ** UNAVAILABLE **
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               1
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      2
Device Status:     0x0000
  (Bus Powered)

Haven't done anything further with it yet.

[dreamlayers]

The iPod Classic 1.0.1 firmware uses a "8702" file format which is similar to the "8900" file format used by the iPhone.  There's a similar DER-encoded certificate chain, and the encryption byte is 03, which probably also implies AES-128-CBC encryption.  There are two "8702" files after the FAT16 image.

I wonder if some methods used on the iPhone and iPod Touch apply.

[Amarus]

I don't know if mods will be annoyed that I'm posting in a really old thread, but with the breakthrough in the Nanos I thought that this thread should be revived for the sake of Classics.
I'm talking about this:
http://home.gna.org/linux4nano/tof_victory_message.txt
From over here:
http://home.gna.org/linux4nano/

Maybe someone could contact one of the team members and ask for details about the exploits.

My Classic is currently out of service (dead hard disk and no replacements in my country) so I'll try this as soon as it's fixed (if nobody did by then).

[GodEater]

The Rockbox developers who are interested in this are already well aware of this information. We've been in and out of the linux4nano guys' irc channel for the last 5 days or so. If something comes out of it (and it's still by no means certain that it will - no-one has managed to run more than a few bytes of code on these things yet) we'll be aware of it before you I imagine

[linuxstb]

There seems to be light at the end of the tunnel regarding Rockbox on the Classic -  the same "Notes" exploit that has allowed us to start running code on the 2nd Gen Nano has been confirmed to also exist on the Classic.  i.e. the first third-party code has now been confirmed to run.

By attaching a serial cable to the dock connector, the boot ROM has been partially dumped (timing issues seem to exist which are preventing a full dump so far).  Once this succeeds, we should have enough information to decrypt and dump the contents of the NOR flash, which in turn gives us access to the diagnostics mode code which can be used to reverse-engineer drivers.

So at least it looks like a Rockbox port can be started soon...

The iPod Classic and Nano 3G also seem very similar hardware-wise (sharing the same S5L8702 CPU), so hopefully the notes exploit can be made to work on the Nano 3G as well.

[TheSeven]

I've noticed there are some really cheap ($70) 6g oem boards on eBay, and the linux4nano guys do not seem to have one to brick, from what I see.

Actually, we don't even need one to brick (we've already passed that stage without bricking one :-) ), we just need testers for our code, if possible with some development skills in order to track down issues. So if any donation, we would need just a working 6G for one of the devs interested in it.

[washedaway]

Actually, we don't even need one to brick (we've already passed that stage without bricking one :-) ), we just need testers for our code, if possible with some development skills in order to track down issues. So if any donation, we would need just a working 6G for one of the devs interested in it.

All of this is completely above my head.  I have an 80gb Classic I can donate to a developer (with avatar).  If interested, please contact me through a pm.


Edit:  I suppose limiting this potential donation to just a dev w/ avatar limits the possibilities... if I could simply find someone who I can verify contributes to the Rockbox project via posts/postcount or possibly a recomendation from a notated dev, that would suffice. 

This is my second day to be aware of Rockbox, but a certain amount of trust can be gained by the fact that this is a prolific open source project.  I admire the effort by everyone involved. 

[zivan56]

IBugger is running on the iPod Nano 4G.  Along with primitive drivers for: USB, I2C, Backlight, and LCD.  So development can start on the Nano 4G if anybody is interested.
Source: http://l4n.clustur.com/index.php/Main_Page

[Jon8RFC]

Can someone post the latest news on ipod classic support?

What can I do to contribute?  I don't know any of the low-level programming needed to rip firmware, but I can follow instructions to test things out.

Are the ipod classic 80/160, 120, and 160 all three entirely different generations within themselves, or will one rockbox edition work across all three?  I'm asking because would I need to donate just an 80gig, or an 80 and a 120?  As far as I know, the 160 (most recent) just takes advantage of increased platter density, unless I'm wrong.  I read that you're past the point of potentially bricking an ipod, but would a donation be of any use, or are y'all not equipped to rip and decrypt the firmware?

Would cyanogen (android custom rom creator...but I can't recall if he was involved in getting root from Android) be of any assistance in this, since it's linux-based?  Would shipping the ipod to a professional data recovery center, such as http://www.eprovided.com/ be useful?  They charge an arm and a leg for tearing apart a hard drive for low-level recovery (or soldering a chip to a diagnostic board for the raw data), but is there any reason to do such a thing at this point, or is just cracking the encryption where the project is stuck?

Whatever the case, please post the latest news and what you need from us, the appreciative users =]

[Llorean]

The lack of posts is the latest news. There's information on the wiki, but if it doesn't change that generally means the situation hasn't changed.

As well, Rockbox is not Linux based.

[saratoga]

Can someone post the latest news on ipod classic support?

AFAIK the wiki is up to date.  Take a look at it.

What can I do to contribute?  I don't know any of the low-level programming needed to rip firmware, but I can follow instructions to test things out.

Other then programming theres not much else to do.

I read that you're past the point of potentially bricking an ipod, but would a donation be of any use, or are y'all not equipped to rip and decrypt the firmware?

The main issue is that no one is working on a port to the classic.  Donating might help if you got someone interested in working on it.

[Jon8RFC]

Thanks.  Donated from jon8rfc@yahoo.com!

What about an ipod classic donation?

[funman]

A useful link