Skip to content

Extracting more artwork

0xced edited this page Sep 18, 2014 · 11 revisions

You can extract even more artwork if you decrypt and mount an iOS firmware (.ipsw file).

Requirements

  1. ipsw_decrypt.py
  2. Python 3.2 (required by ipsw_decrypt.py)
  3. VFDecrypt (required by ipsw_decrypt.py)
    Make sure to install the vfdecrypt binary somewhere in your PATH or use the -d option of the the ipsw_decrypt.py script.

How to decrypt and mount an iOS firmware

  1. Download an iPhone or iPad firmware that matches your simulator version and make sure that there is a VFDecrypt Key by checking the corresponding Build column. For beta versions, check the VFDecrypt Keys page instead.

  2. Run the ipsw_decrypt.py script on the firmware you downloaded. The output should look like this:

     <Info> Extracting content from iPhone3,1_5.1_9B176_Restore.ipsw, it may take a minute...
     <Info> Extracted firmware to 'iPhone 4, 5.1 (9B176)'. You may use the '-o "iPhone 4, 5.1 (9B176)"' switch in the future to skip this step.
     <Info> iPhone 4 (iPhone3,1), class n90ap
     <Info> iOS version 5.1, build Hoodoo 9B176
     <Info> Downloading decryption keys from 'http://theiphonewiki.com/wiki/index.php?title=Hoodoo_9B176_(iPhone_4)'...
     <Info> Retrieved 18 keys.
     <Notice> Skipping BasebandFirmware (ICE3_04.12.01_BOOT_02.13.Release.bbfw): No decryption key
     <Info> Decrypting 'iBEC.n90ap.RELEASE.dfu'... 
     <Info> Decrypting 'iBSS.n90ap.RELEASE.dfu'... 
     <Info> Decrypting 'recoverymode@2x~iphone.s5l8930x.img3'... 
     <Notice> Image color format: argb; size: 172x786
     <Info> Decrypting '038-1768-165.dmg', it may take a minute...
     sig	encrcdsa
     blocksize	
     datasize	774709676
     dataoffset	122880
     keyDerivationAlgorithm      0
     keyDerivationPRNGAlgorithm  0
     keyDerivationIterationCount 0
     keyDerivationSaltSize       0
     keyDerivationSalt           
     
     
     blobEncryptionIVSize        0
     blobEncryptionIV            
     
     
     blobEncryptionKeySizeInBits 0
     blobEncryptionAlgorithm     0
     blobEncryptionPadding       0
     blobEncryptionMode          0
     encryptedBlobSize           0
     encryptedBlob               
     
     
     <Info> Decrypting 'batterylow0@2x.s5l8930x.img3'... 
     <Notice> Image color format: argb; size: 504x556
     <Info> Decrypting 'LLB.n90ap.RELEASE.img3'... 
     <Info> Decrypting '038-1800-166.dmg'... 
     <Info> Decrypting 'glyphplugin@2x.s5l8930x.img3'... 
     <Notice> Image color format: grey; size: 238x68
     <Info> Decrypting 'kernelcache.release.n90'... 
     <Info> Decompressing LZSS... (100%)
     <Info> Decrypting 'batteryfull@2x.s5l8930x.img3'... 
     <Notice> Image color format: argb; size: 70x556
     <Info> Decrypting 'applelogo@2x.s5l8930x.img3'... 
     <Notice> Image color format: grey; size: 132x164
     <Info> Decrypting 'DeviceTree.n90ap.img3'... 
     <Info> Decrypting 'batterylow1@2x.s5l8930x.img3'... 
     <Notice> Image color format: argb; size: 70x556
     <Info> Decrypting '038-1813-172.dmg'... 
     <Info> Decrypting 'batterycharging1@2x.s5l8930x.img3'... 
     <Notice> Image color format: grey; size: 296x346
     <Info> Decrypting 'glyphcharging@2x.s5l8930x.img3'... 
     <Notice> Image color format: grey; size: 86x102
     <Info> Decrypting 'batterycharging0@2x.s5l8930x.img3'... 
     <Notice> Image color format: grey; size: 154x216
     <Info> Decrypting 'iBoot.n90ap.RELEASE.img3'... 
    
  3. Go into the iPhone 4, 5.1 (9B176) folder or whatever folder was created depending on the firmware you chose.

  4. Open the biggest file ending with .decrypted.dmg in order to mount the disk image. In this example: 038-1768-165.decrypted.dmg

  5. Run iOS Artwork Extractor. If the mounted iOS firmware version matches your simulator version, then you will discover much more artwork.

iOS 8 firmware

VFDecrypt Keys are not widely available for iOS 8. You will have to use vfdecrypt directly on the unzipped iPhone 4S ipsw with the key provided by @iH8sn0w:

@Jato_BZ which keys? Or just rootfs like the 4S one? 5059b2da95c93f754ce4a701cf6564877dfee899ad884d78f3403dcec7bbd6fe6d3079a8

Clone this wiki locally