This article discusses software internally used by Apple.
Acquiring a copy without Apple's consent is illegal and may result in being scammed.
Engaging in illegal activity is not condoned. This information is provided for educational purposes only.
|
This is a documented list of known NonUI firmwares, used by Apple engineers in California to do engineering tests on prototype devices and also by factory workers on production ones during manufacturing. NonUI is based on production iOS ones, but adapted for internal engineering tests, development and debugging.
They are known as "NonUI (No User Interface)" builds, because most applications are command line ones and the UI is different to that of a regular device. The SpringBoard replacement, named SwitchBoard, allows the launching of a GUI for some of those applications. Unlike production iOS firmwares, NonUI ones have the following differences:
- DEVELOPMENT fused bootloaders in
/Firmware/dfu/ and /Firmware/all_flash/all_flash.[board codename].factory[fa/sa]/.
- FACTORY fused SEP firmware in
/Firmware/all_flash/all_flash.[board codename].factory[fa/sa]/
- DEVELOPMENT fused kernelcache with more symbols (located in
/System/Library/Caches/com.apple.kernelcaches on the filesystem), and with individual kexts in /System/Library/Extensions.
- DEVELOPMENT dyld_shared_cache in
/System/Library/Caches/com.apple.dyld.
- DEBUG fused baseband firmware in
/Firmware/.
- Skankwerk (gear) logo image file in
/Firmware/all_flash/all_flash.[board codename].factoryfa/.
/AppleInternal folder, which the hierarchy inside get priority over hierarchy in /.- No SpringBoard, requires the use of daemons to launch SwitchBoard.app as a multi-app launcher instead.
/usr and subfolders contain many UNIX command line utilities.- SSH daemon is pre-installed as dropbear, can be connected to over usb
- Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable AMFI
- It has some additional Private Frameworks in
/System/Library/PrivateFrameworks for internal GUI apps and command line utilities.
- Most internal applications require the use of SkankKit (replacement for UIKit in NonUI firmwares) to produce special layers such as text on the framebuffer.
Unlike regular iOS Firmwares, NonUI ones are distributed in "restore bundles". Restore bundles are like contents of IPSW files which can be restored on devices using internal restore software such as PurpleRestore or AirSwitch. Release and NonUI "restore bundles" have the same packaging structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem), but can also include other files such as debug and development variants of each respective component.
Some interesting facts about NonUI[edit | edit source]
- Design: Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 7.x NonUIs, but seems more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in Operator). For newer versions, production iOS 8.x and above flat design is mostly used in 8.x and above NonUIs. For example, the new "Skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
- Other: The "skank" word is used to name multiple elements of NonUIs. For example, there is "SkankPhone", "SkankBattery" (the green battery shown in SwitchBoard), "Skankwerk" logo, "SkankKit" framework, "PurpleSkank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on Wikipedia.
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 2.0
|
5A274a
|
Big Bear?
|
?
|
-
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 5.0
|
9A2264r
|
TellurideNanshan
|
?
|
-
|
| 6.0
|
10A23941a
|
SundanceNanshan
|
2.0.0.2
|
-
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 9.0
|
13A22120w
|
Monarch?
|
?
|
-
|
| 13A23161b
|
MonarchNanshan
|
?
|
-
|
iPhone SE (1st generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 9.3
|
13E180
|
Eagle?
|
4.70.10
|
Found on an FCC test report [7]
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 12.0
|
16A93020u
|
PeaceAni
|
?
|
-
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 13.0
|
17A13130m
|
YukonAni
|
?
|
-
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 13.0
|
17A566
|
Yukon
|
?
|
-
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 3.2
|
7B3341e
|
Wildcat
|
?
|
-
|
| 7B5286a
|
?
|
Found by SonnyDickson, documented on 9to5mac
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 4.3
|
8F3178a
|
Durango
|
?
|
-
|
| 8F3191d
|
?
|
-
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 5.1
|
9B87
|
Hoodoo?
|
?
|
Found on an FCC test report [10]
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 13.0
|
17A571
|
Yukon
|
?
|
-
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 14.1
|
18A8394
|
Azul
|
?
|
-
|
iPad mini (1st generation)[edit | edit source]
iPad mini (2nd generation)[edit | edit source]
iPad mini (3rd generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 11.3
|
15E61570m
|
Emet?
|
?
|
From @mcg29_ on Twitter
|
iPad mini (4th generation)[edit | edit source]
iPad mini (5th generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 8.1
|
12B331
|
OkemoTaos?
|
?
|
Found on an FCC test report [15]
|
| 12B33610i
|
?
|
From journaldulapin.com [16].
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 12.2
|
16E31120m
|
PeaceEYabuli
|
?
|
-
|
| 16E31520i
|
?
|
Found on an FCC test report [17]
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 9.0
|
13A165
|
Monarch
|
2.15.00 (debug)
|
This comes as a Restore Bundle, and is for J98/99AP
|
iPad Pro (9.7-inch) (1st generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 9.3
|
13E31820k
|
Eagle?
|
?
|
Found on an FCC test report [18]
|
iPad Pro (12.9-inch) (1st generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 9.1
|
13B72
|
Boulder?
|
?
|
Found on an FCC test report [19]
|
iPad Pro (12.9-inch) (2nd generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 10.3
|
14E232
|
Erie?
|
?
|
Found on an FCC test report [20]
|
| 14E32020u
|
?
|
Found on an FCC test report [21]
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 10.3
|
14E22020w
|
Erie?
|
?
|
Found on an FCC test report [22]
|
iPad Pro (12.9-inch) (3rd generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 12.1
|
16B91
|
PeaceB?
|
?
|
-
|
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 12.1
|
16B94
|
PeaceB
|
?
|
-
|
iPad Pro (12.9-inch) (4th generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 13.4
|
17E186
|
YukonE
|
?
|
-
|
| 17E192
|
YukonE?
|
?
|
-
|
iPad Pro (11-inch) (2nd generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 13.4
|
17E8255
|
YukonE
|
?
|
-
|
| 17E8258
|
YukonE?
|
?
|
-
|
iPad Pro (12.9-inch) (5th generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 14.5
|
18E20700y
|
AzulE?
|
?
|
Found on a FCC test report [23]
|
iPad Pro (11-inch) (3rd generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Baseband
|
Comments
|
| 14.5
|
18E182
|
AzulE?
|
?
|
-
|
iPod touch (1st generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Comments
|
| 1.1
|
3A53
|
Snowbird
|
Found on an FCC test report [24]
|
iPod touch (2nd generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Comments
|
| 2.0.2
|
5C274
|
Big Bear?
|
-
|
iPod touch (3rd generation)[edit | edit source]
iPod touch (4th generation)[edit | edit source]
iPod touch (5th generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Comments
|
| 6.0
|
10A219
|
Sundance
|
-
|
| 10A351
|
Sundance?
|
Found on an FCC test report [25]
|
iPod touch (6th generation)[edit | edit source]
iPod touch (7th generation)[edit | edit source]
| Version
|
Build
|
Codename
|
Comments
|
| 12.4
|
16G73
|
PeaceG?
|
-
|
| Version
|
iOS Counterpart
|
Build
|
Codename
|
Comments
|
| 3.0
|
iOS 10.0
|
14S32872i
|
Daytona
|
From @MrTordse on Twitter.
|
| Version
|
iOS Counterpart
|
Build
|
Codename
|
Comments
|
| 4.0
|
iOS 11.0
|
15R31660m
|
Fortune
|
From @nyan_satan on Twitter.
|
| Version
|
iOS Counterpart
|
Build
|
Codename
|
Comments
|
| 6.0
|
iOS 13.0
|
17R13130m
|
GraceSky
|
From @nyan_satan on Twitter.
|
![[1]](https://web.archive.org/web/20110730023951/http://imageshack.us/photo/my-images/399/iphone2go0.jpg/){kind=link}