hw/arm: add authenticated A6 IMG3 boot lab

Model the A6 crypto, interrupt, USB, and platform blocks needed to boot SecureROM through iBSS into iBEC Recovery. Add local lab identity, IMG3, and APTicket tooling, patched macOS recovery utilities, UART and GDB access, and English end-user documentation.
2026-09-01 09:51:49 -07:00
parent 47977dd34a
commit 5d9a60a926
45 changed files with 6002 additions and 265 deletions
@@ -0,0 +1,66 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+set -eu
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+source_dir=$(CDPATH= cd -- "$script_dir/.." && pwd)
+
+usage()
+{
+    echo "usage: $0 SECUREROM OUTPUT_DIRECTORY [BOOT_NONCE_HEX]" >&2
+    exit 2
+}
+
+[ "$#" -ge 2 ] && [ "$#" -le 3 ] || usage
+source_rom=$1
+output_dir=$2
+boot_nonce=${3:-${A6_BOOT_NONCE:-8d82693c897d1b9d}}
+ibss_payload=${A6_IBSS_PAYLOAD:-"$source_dir/firmware/iBSS.iphone5.RELEASE.bin"}
+ibec_payload=${A6_IBEC_PAYLOAD:-"$source_dir/firmware/iBEC.iphone5.RELEASE.bin"}
+
+for input in \
+    "$source_rom" \
+    "$source_dir/firmware/iBSS.iphone5.RELEASE.dfu" \
+    "$source_dir/firmware/iBEC.iphone5.RELEASE.dfu" \
+    "$ibss_payload" \
+    "$ibec_payload"; do
+    if [ ! -f "$input" ]; then
+        echo "required input not found: $input" >&2
+        exit 1
+    fi
+done
+
+python3 "$script_dir/a6-lab-identity.py" "$source_rom" "$output_dir"
+output_dir=$(CDPATH= cd -- "$output_dir" && pwd)
+
+python3 "$script_dir/a6-lab-patch-iboot-root.py" \
+    --source-rom "$source_rom" --identity "$output_dir" \
+    --input "$ibss_payload" \
+    --output "$output_dir/iBSS.lab-root.bin"
+python3 "$script_dir/a6-lab-patch-iboot-root.py" \
+    --source-rom "$source_rom" --identity "$output_dir" \
+    --input "$ibec_payload" \
+    --output "$output_dir/iBEC.lab-root.bin"
+
+python3 "$script_dir/a6-lab-img3.py" \
+    --template "$source_dir/firmware/iBSS.iphone5.RELEASE.dfu" \
+    --payload "$output_dir/iBSS.lab-root.bin" \
+    --identity "$output_dir" --encrypt \
+    --output "$output_dir/iBSS.chain-encrypted.dfu"
+python3 "$script_dir/a6-lab-img3.py" \
+    --template "$source_dir/firmware/iBEC.iphone5.RELEASE.dfu" \
+    --payload "$output_dir/iBEC.lab-root.bin" \
+    --identity "$output_dir" --encrypt --ticketed \
+    --output "$output_dir/iBEC.ticketed-encrypted.img3"
+
+python3 "$script_dir/a6-lab-apticket.py" \
+    --component "$output_dir/iBEC.ticketed-encrypted.img3" \
+    --identity "$output_dir" \
+    --boot-nonce "$boot_nonce" \
+    --ticket-output "$output_dir/apticket-nonce.der" \
+    --output "$output_dir/iBEC.chain-nonce-encrypted.dfu"
+
+echo
+echo "A6 lab chain created in $output_dir"
+echo "Run: A6_LAB_DIR='$output_dir' ./Run-iPhone5-macOS.sh"