KBAG

Apple's IMG3 security scheme uses a data format called a KBAG. At the bottom of a firmware file, you will see something that will, on the ASCII side of your hex editor, say "GABK", which, as ARM is little-endian based, is "KBAG" flipped. Look on the hex side and you will see the KBAG according to this format:

How it works
It boils down to using the GID Key to decrypt  and , then using that key and IV to decrypt the DATA section of the file (the code itself).

Because of the circumstances with the IMG3 File Format, the kernel never needs to even touch the GID Key anymore, as its job is to just flash the image to the NOR as is, with container and all.

In order to decrypt the KBAG, you need to remove them from IMG3 using this command

KBAG128
typedef struct { uint32_t magic;      // string with bytes flipped ("KBAG" in little endian) uint32_t fullSize;   // size of KBAG from beyond that point to the end of it      uint32_t tagDataSize; // size of KBAG without this 0xC header uint32_t cryptState; // 1 if the key and IV in the KBAG are encrypted with the GID Key // 2 is used with a second KBAG for the S5L8920, use is unknown. uint32_t aesType;    // 0x80 = aes128 / 0xc0 = aes192 / 0x100 = aes256 uint8_t encIV[16];   // IV for the firmware file, encrypted with the GID Key uint8_t encKey[16];  // Key for the firmware file, encrypted with the GID Key } UnparsedKbagAes128_t;

KBAG192
typedef struct Unparsed_KBAG_AES192 { uint32_t magic;      // string with bytes flipped ("KBAG" in little endian) uint32_t fullSize;   // size of KBAG from beyond that point to the end of it      uint32_t tagDataSize; // size of KBAG without this 0xC header uint32_t cryptState; // 1 if the key and IV in the KBAG are encrypted with the GID Key // 2 is used with a second KBAG for the S5L8920, use is unknown. uint32_t aesType;    // 0x80 = aes128 / 0xc0 = aes192 / 0x100 = aes256 uint8_t encIV[16];   // IV for the firmware file, encrypted with the GID Key uint8_t encKey[24];  // Key for the firmware file, encrypted with the GID Key } UparsedKbagAes192_t;

KBAG256
typedef struct Unparsed_KBAG_256 { uint32_t magic;      // string with bytes flipped ("KBAG" in little endian) uint32_t fullSize;   // size of KBAG from beyond that point to the end of it      uint32_t tagDataSize; // size of KBAG without this 0xC header uint32_t cryptState; // 1 if the key and IV in the KBAG are encrypted with the GID Key // 2 is used with a second KBAG for the S5L8920, use is unknown. uint32_t aesType;    // 0x80 = aes128 / 0xc0 = aes192 / 0x100 = aes256 uint8_t encIV[16];   // IV for the firmware file, encrypted with the GID Key uint8_t encKey[32];  // Key for the firmware file, encrypted with the GID Key } UparsedKbagAes256_t;