Restore Mode

Restore Mode is the mode that an iDevice enters to run a ramdisk.

Restore Procedure

 * 1) "Preparing (iDevice type) for the restore." (Get the device from userland to iBoot or from DFU Mode to iBSS)
 * 2) "Verifying (iDevice type) restore with Apple" (or Cydia or TinyUmbrella).
 * 3) Preparing the firmware for the restore.
 * 4) "Preparing &lt;iDevice type> for the restore."
 * 5) "Restoring &lt;iDevice type> software." (ASR RESTORE)
 * 6) "Verifying &lt;iDevice type> software." (ASR VERIFY)
 * 7) "Restoring &lt;iDevice type> firmware." (The rest of the restore process isn't reported to the host computer in real-time. This includes the restore of the NOR/boot partition image, the installation of the baseband firmware, ...)

Files used
The /|firmware is the biggest Disk Image file in the IPSW and contains all files for the root partition. The ramdisks are the smaller Disk Images, and in the case of the iPhone 2G, iPhone 3G, iPhone 3GS, and iPad 1G, the baseband also. The firmware images are stored in the  path (relative to the root of the IPSW) and are eventually sent to the device after device-specific customization, if applicable.

Exploits
The original jailbreaks were done by booting the phone into restore mode and copying an fstab[ WP ] and afcd plist from the user partition to the /|root partition. This was done by using the  iBoot command, a command which had access to the whole filesystem.