iOS USB device modes

In addition to "configuration", "interface" and "alternate interface setting" concepts of the USB specification, iOS devices also have a notion of "modes". In different modes, iOS devices expose a different set of available configurations.

The set of available modes depends on the iOS version. Modes are denoted by numeric indices. The default mode is 0. Only one mode can be set at a time. Doing a USB reset, or disconnecting/reconnecting the device resets the mode back to the default.

Different modes and different configurations explain, for example, why screen capture (Valeria) and internet sharing (USB Ethernet) aren't able to work simultaneously, as there isn't a mode/configuration that supports both at the same time.

Getting the active mode

Currently there is no known way of explicitly querying an iOS device for the mode it's in.

The mode can be inferred from the set of available configurations advertised by the device. This is the approach taken by libimobiledevice's usbmuxd.

Changing the mode

The mode can be changed by sending a control transfer with the following fields:

bmRequestType	bRequest	wValue	wIndex	wLength
`0xc0`	`0x52`	`0x0000`	mode index	`0x0001`

In case of a successful mode change, 1 byte of data is returned. Usually this byte equals 0x00. The only known exception is mode 1, which returns 0x04 instead. It is unknown what this value means.

Changing the mode multiple times may result in the device advertising an unusual combination of configurations. It is recommended to do a USB reset before making a (second or further) mode change.

Some, but not all, mode changes are slow and result in a USB disconnect/reconnect from the iOS device side.

Known modes

Mode 0

Introduced: iOS 1.0 (USB Ethernet: iOS 3.0)
Triggers reconnect: no

Configuration 1: PTP
    Interface 0.0: PTP
        Class 6 / Subclass 1 / Protocol 1
        Endpoint 2 OUT BULK
        Endpoint 1 IN BULK
        Endpoint 3 IN INT
Configuration 2: iPod USB Interface
    Interface 0.0: -
        Class 1 / Subclass 1 / Protocol 0
    Interface 1.0: -
        Class 1 / Subclass 2 / Protocol 0
    Interface 1.1: -
        Class 1 / Subclass 2 / Protocol 0
        Endpoint 1 IN ISO
    Interface 2.0: -
        Class 3 / Subclass 0 / Protocol 0
        Endpoint 3 IN INT
Configuration 3: PTP + Apple Mobile Device
    Interface 0.0: PTP
        Class 6 / Subclass 1 / Protocol 1
        Endpoint 2 OUT BULK
        Endpoint 1 IN BULK
        Endpoint 3 IN INT
    Interface 1.0: Apple USB Multiplexor
        Class 255 / Subclass 254 / Protocol 2
        Endpoint 4 OUT BULK
        Endpoint 5 IN BULK
Configuration 4: PTP + Apple Mobile Device + Apple USB Ethernet
    Interface 0.0: PTP
        Class 6 / Subclass 1 / Protocol 1
        Endpoint 2 OUT BULK
        Endpoint 1 IN BULK
        Endpoint 3 IN INT
    Interface 1.0: Apple USB Multiplexor
        Class 255 / Subclass 254 / Protocol 2
        Endpoint 4 OUT BULK
        Endpoint 5 IN BULK
    Interface 2.0: AppleUSBEthernet
        Class 255 / Subclass 253 / Protocol 1
    Interface 2.1: AppleUSBEthernet
        Class 255 / Subclass 253 / Protocol 1
        Endpoint 6 IN BULK
        Endpoint 5 OUT BULK
    Interface 2.2: AppleUSBEthernet
        Class 255 / Subclass 253 / Protocol 1
        Endpoint 6 IN BULK
        Endpoint 5 OUT BULK

Mode 1

Introduced: unknown
Triggers reconnect: no

Exposes the same set of configurations as mode 0. There are a few subtle differences compared to mode 0:

Switching to this mode returns 0x04, unlike other modes.
The first byte of the "carrier status" control transfer is 0x04 regardless of the carrier state.

Wasn't observed being used by any official driver/system.

Mode 2

Introduced: iOS 8.0 (CDC-NCM: iOS 16.0)
Triggers reconnect: no

Configuration 5: PTP + Apple Mobile Device + Valeria
    Interface 0.0: PTP
        Class 6 / Subclass 1 / Protocol 1
        Endpoint 2 OUT BULK
        Endpoint 1 IN BULK
        Endpoint 3 IN INT
    Interface 1.0: Apple USB Multiplexor
        Class 255 / Subclass 254 / Protocol 2
        Endpoint 4 OUT BULK
        Endpoint 5 IN BULK
    Interface 2.0: Valeria
        Class 255 / Subclass 42 / Protocol 255
        Endpoint 6 IN BULK
        Endpoint 5 OUT BULK

    [CDC-NCM interfaces introduced in iOS 16.0]
    Interface 3.0: NCM Control
        Class 2 / Subclass 13 / Protocol 0
    Interface 4.0: NCM Data
        Class 10 / Subclass 0 / Protocol 1
    Interface 4.1: NCM Data
        Class 10 / Subclass 0 / Protocol 1
        Endpoint 7 IN BULK
        Endpoint 6 OUT BULK

Mode 3

Introduced: iOS 10.3
Triggers reconnect: yes

[Configurations 1-4 same as in mode 0]

Configuration 5: PTP + Apple Mobile Device + NCM
    Interface 0.0: PTP
        Class 6 / Subclass 1 / Protocol 1
        Endpoint 2 OUT BULK
        Endpoint 1 IN BULK
        Endpoint 3 IN INT
    Interface 1.0: Apple USB Multiplexor
        Class 255 / Subclass 254 / Protocol 2
        Endpoint 4 OUT BULK
        Endpoint 5 IN BULK
    Interface 2.0: NCM Control
        Class 2 / Subclass 13 / Protocol 0
        Endpoint 6 IN INT
    Interface 3.0: NCM Data
        Class 10 / Subclass 0 / Protocol 1
    Interface 3.1: NCM Data
        Class 10 / Subclass 0 / Protocol 1
        Endpoint 7 IN BULK
        Endpoint 5 OUT BULK
    Interface 4.0: NCM Control
        Class 2 / Subclass 13 / Protocol 0
    Interface 5.0: NCM Data
        Class 10 / Subclass 0 / Protocol 1
    Interface 5.1: NCM Data
        Class 10 / Subclass 0 / Protocol 1
        Endpoint 8 IN BULK
        Endpoint 6 OUT BULK

Mode 4

Introduced: iOS 16.0
Triggers reconnect: yes

[Configurations 1-5 same as in mode 3]

Configuration 6: PTP + Apple Mobile Device + Apple USB Ethernet + NCM
    Interface 0.0: PTP
        Class 6 / Subclass 1 / Protocol 1
        Endpoint 2 OUT BULK
        Endpoint 1 IN BULK
        Endpoint 3 IN INT
    Interface 1.0: Apple USB Multiplexor
        Class 255 / Subclass 254 / Protocol 2
        Endpoint 4 OUT BULK
        Endpoint 5 IN BULK
    Interface 2.0: AppleUSBEthernet
        Class 255 / Subclass 253 / Protocol 1
    Interface 2.1: AppleUSBEthernet
        Class 255 / Subclass 253 / Protocol 1
        Endpoint 6 IN BULK
        Endpoint 5 OUT BULK
    Interface 2.2: AppleUSBEthernet
        Class 255 / Subclass 253 / Protocol 1
        Endpoint 6 IN BULK
        Endpoint 5 OUT BULK
    Interface 3.0: NCM Control
        Class 2 / Subclass 13 / Protocol 0
        Endpoint 7 IN INT
    Interface 4.0: NCM Data
        Class 10 / Subclass 0 / Protocol 1
    Interface 4.1: NCM Data
        Class 10 / Subclass 0 / Protocol 1
        Endpoint 8 IN BULK
        Endpoint 6 OUT BULK
    Interface 5.0: NCM Control
        Class 2 / Subclass 13 / Protocol 0
    Interface 6.0: NCM Data
        Class 10 / Subclass 0 / Protocol 1
    Interface 6.1: NCM Data
        Class 10 / Subclass 0 / Protocol 1
        Endpoint 9 IN BULK
        Endpoint 7 OUT BULK

Mode 5

Introduced: iOS 17.0
Triggers reconnect: yes

Configuration 1: NCM Direct Only
    Interface 0.0: NCM Control Direct
        Class 2 / Subclass 13 / Protocol 0
        Endpoint 1 IN INT
    Interface 1.0: NCM Data
        Class 10 / Subclass 0 / Protocol 1
    Interface 1.1: NCM Data
        Class 10 / Subclass 0 / Protocol 1
        Endpoint 3 IN BULK
        Endpoint 2 OUT BULK

Mode support

Below is the empirical data observed when trying to switch to different modes on a set of test devices. This should give an approximate idea when certain modes were introduced.

Device	iOS version	Mode 0	Mode 1	Mode 2	Mode 3	Mode 4	Mode 5
iPhone 5	10.3.4	Yes	No	Yes	Crash^[1]	No	No
iPhone 6	12.5.7	Yes	No	Yes	Crash^[1]	No	No
iPhone XS Max	17.5.1	Yes	Yes	Yes	Yes	Yes	Yes
iPhone 15 Pro Max	17.5.1	Yes	Yes	Yes	Yes	Yes	Yes

^ ^a ^b Attempting to switch to Mode 3, then enumerating the configuration descriptors leads to the device freezing. When the USB cable is disconnected, a kernel panic occurs and the device reboots.

Availability of modes in different iOS versions can also be inferred from /System/Library/AppleUSBDevice/USBDeviceConfiguration.plist in the iOS device's root filesystem. In this file one can search for USB configuration names, which suggests that it's supported.

[mode3_crash-1] Attempting to switch to Mode 3, then enumerating the configuration descriptors leads to the device freezing. When the USB cable is disconnected, a kernel panic occurs and the device reboots.

[1]