This repository documents the decryption and analysis of 39 iPod firmware binaries spanning every PortalPlayer and Samsung S5L-based iPod generation (2001–2014). This represents the most comprehensive publicly available firmware analysis of Apple's iPod product line.

All firmware binaries were extracted from official Apple IPSW files and — where applicable — decrypted using the device's hardware AES engine via the wInd3x BootROM exploit. Analysis performed using Ghidra and Capstone disassembly.

Additional firmware dumps analyzed: iPod 4th Gen Mono (FamilyID 10), 4th Gen Color (FamilyID 5), 5G Video (13.1.3, 20.1.3), 5.5G (25.1.2.3, 25.1.3), Classic 7G (2.0.4 no-DRM variant).

All iPod firmware is distributed as IPSW files (standard ZIP archives). Two formats exist:

53 IPSWs cataloged across 18 generations. See architecture/IPSW_FORMAT.md for complete inventory.

Power On → BootROM (silicon, 64KB) → NOR Bootloader (IMG1) → AES Decrypt → RetailOS (OSOS) → RTXC Kernel → Application Layer

The S5L8702 boot chain has no post-decryption hash verification — encryption serves as the sole authentication mechanism. See architecture/BOOT_CHAIN.md.

SysCfg tags: SCfg, SrNm, FwId, HwId, HwVr, SwVr, MLBN, MMod, Regn, Codc. See architecture/NOR_FLASH.md.

Peripheral reference counts from firmware analysis: GPIO (1,155 refs), LCD (0x38200000), Clock/Power (1,313 refs), Timer/IRQ (871 refs), AES Engine (866 refs). See architecture/MEMORY_MAP.md.

├── README.md                          ← You are here
├── DECRYPTION_GUIDE.md                All-model decryption/extraction guide
├── LICENSE                            MIT License
├── wind3x-patch/                      wInd3x device descriptor patch (code)
│   ├── README.md
│   ├── devices.go
│   ├── devices.go.patch
│   ├── BUILD.md
│   └── TESTED_OUTPUT.md
├── specs/                             Per-device firmware feature specifications
│   ├── iPod_1st_Gen_1_1_5.md
│   ├── iPod_3rd_Gen_2_2_3.md
│   ├── iPod_Mini_1st_Gen_6_1_4_1.md
│   ├── iPod_Mini_2nd_Gen_7_1_4_1.md
│   ├── iPod_4th_Gen_Mono_4_3_1_1.md
│   ├── iPod_4th_Gen_Color_11_1_2_1.md
│   ├── iPod_4th_Gen_Photo_5_1_2_1.md
│   ├── iPod_5th_Gen_Video_13_1_2_1.md
│   ├── iPod_5th_Gen_Video_Late_20_1_2_1.md
│   ├── iPod_5_5G_Video_Enhanced_25_1_2_1.md
│   ├── iPod_Nano_1st_Gen_2GB_14_1_3_1.md
│   ├── iPod_Nano_1st_Gen_4GB_17_1_3_1.md
│   ├── iPod_Nano_3rd_Gen_4GB_26_1_1_3.md
│   ├── iPod_Classic_6G_Initial_24_1_0_1.md
│   ├── iPod_Classic_6G_Initial_24_1_0_3.md
│   ├── iPod_Classic_6G_Initial_24_1_1.md
│   ├── iPod_Classic_6G_Initial_24_1_1_2.md
│   ├── iPod_Classic_6_5G_Rev_A_33_2_0.md
│   ├── iPod_Classic_6_5G_Rev_A_33_2_0_1.md
│   ├── iPod_Nano_5th_Gen_34_1_0_2.md
│   ├── iPod_Classic_7G_35_2_0_4.md
│   └── iPod_Classic_7G_38_2_0_5.md
├── comparisons/                       Version-to-version diffs
│   ├── Classic_Evolution_6G_to_7G.md
│   ├── Classic_6G_vs_6_5G_vs_7G.md
│   ├── Nano_3G_vs_Classic_6G.md
│   ├── Classic_204_vs_205.md
│   ├── Nano3G_vs_Classic.md
│   ├── iPod_4th_Gen_Mono_vs_Color.md
│   ├── iPod_5th_Gen_versions.md
│   └── iPod_Nano_1G_2GB_vs_4GB.md
└── architecture/                      Deep dive documents
    ├── BOOT_CHAIN.md
    ├── MEMORY_MAP.md
    ├── IPSW_FORMAT.md
    ├── NOR_FLASH.md
    ├── RTOS_INTERNALS.md
    ├── CODEC_FRAMEWORK.md
    ├── DRM_ARCHITECTURE.md
    ├── COVERFLOW_ENGINE.md
    └── RSRC_RESOURCES.md

• PortalPlayer era (2001–2006): PP5002/PP5020/PP5021/PP5022 SoCs running Pixo OS
• Samsung S5L8702 era (2007–2012): S5L8702 SoC (ARM926EJ-S) running RTXC with "Silver" UI framework
• Samsung S5L8730 era (2009): S5L8730 SoC (ARM Cortex-A8, ARMv7) — first iPod with ARMv7
• All iPods use ARM cores (ARM7TDMI → ARM926EJ-S → Cortex-A8)
• The Nano 3G and ALL Classic variants share the same S5L8702 SoC and N25C codename
• Classic firmware grew from 9.47 MB (6G, 2007) to 10.14 MB (7G 2.0.5, 2012) — a 7% increase over 5 years

• Classic 6G Initial (2007): 21,203 functions, 67,349 strings — no Genius, no EU Volume
• Classic 6.5G Rev A (2008): 22,810 functions (+7.6%), 71,744 strings — Genius added
• Classic 7G Rev B (2009): 23,036 functions (+1.0%), 72,926 strings — minor refinements
• Classic 7G Rev C (2012): 23,164 functions (+0.6%), 73,500+ strings — EU Volume Limit added

• First ARM Cortex-A8 iPod — transitions from ARMv5TEJ to ARMv7
• First Thumb-dominant firmware — 94.9% Thumb-2 code (vs 76.5% ARM on Nano 3G)
• Smaller binary, more features — 6.95 MB with camera, pedometer, FM Live Pause, VoiceOver
• 30 RTOS tasks (vs 11 on Classic) — dedicated tasks for camera, pedometer, radio

• iPod 4th Gen Mono: FamilyID 4 and FamilyID 10 are byte-identical
• iPod 4th Gen Color/Photo: Color, Color FamilyID 11, and Photo FamilyID 5 are byte-identical
• iPod Nano 1G: 2GB (FamilyID 14) and 4GB (FamilyID 17) are byte-identical

• Debug Menu — Full internal debug interface with disk browser, memory viewer, unit tests
• Demo Mode — Apple Store kiosk mode (TCDemoMode controller)
• RTXCbug — Interactive RTOS debugger with task/object inspection
• 22 Logging Channels — Disk, USB, playback, photo import telemetry
• Unit Test Framework — Built-in test suite (TUnitTestSuiteCntlr)
• MockupMode — Developer UI prototyping tool

The S5L8702 has no GPU or hardware 2D/3D accelerator. Cover Flow is achieved through highly optimized fixed-point ARM assembly rendering at ~30 FPS on a 200MHz CPU. Column-by-column affine texture mapping with DMA double-buffering.

See DECRYPTION_GUIDE.md for complete instructions covering all iPod models:

• Unencrypted models (1G–5G, Nano 1G, Mini): Simple IPSW extraction
• Encrypted models (Classic 6G/7G, Nano 3G+): Hardware AES decryption via wInd3x

See wind3x-patch/ for the device descriptor patch that adds iPod Classic support to wInd3x.

Quick reference:

DFU PID: 0x1223 (Rev A/B) / 0x1250 (Rev C)
WTF PID: 0x1247 (Rev B) / 0x1250 (Rev C)
SoC:     S5L8702 (same as Nano 3G)
Protocol: DFUProtoVersion1

Note: All iPod Classic variants (6G Initial, 6.5G Rev A, 7G Rev B, 7G Rev C) share the N25C codename because they use the same S5L8702 SoC and PCB design. The hardware revisions differ only in HDD capacity, minor board component changes, and USB PID assignments.

• freemyipod/wInd3x — BootROM exploit and firmware tool
• Olsro/reddit-ipod-guides — iPod Classic modding guides
• DavidBuchanan314/classic-ipod-tools — NOR flash tools
• TheAppleWiki - USB Product IDs
• TheAppleWiki - DFU Mode
• TheAppleWiki - iPod Firmware

This research is conducted for educational and interoperability purposes under fair use principles. All analyzed iPod models are discontinued products. No copyrighted Apple code is distributed — only analysis results and documentation.

MIT License — see LICENSE.