IPSW File Format

IPSW (iPod^[1] Software) files have the Magic Number 504B0304 (PK\003\004) and thus are ZIP archives. They can be modified with typical zip/unzip tools (i.e. change extension to .zip and double click). IPSWs are used to deliver the device's firmware to the end-user.

Archive Structure

Restore Ramdisk
Update Ramdisk (some firmwares don't have one due to various reasons)
Filesystem (the largest .dmg file)
Device Tree (model specific)
Kernelcache (model specific; processor specific on pre-A4)
BuildManifest.plist (first appeared in iPhone OS 3.0 beta 2)
Restore.plist
Firmware/
- all_flash/
  - all_flash.XXXXX.production/ (model specific i.e. M68AP, N82AP, etc.)
    - IMG2/IMG3 files
    - manifest
- dfu/
  - iBEC.XXXXX.dfu (model specific i.e. M68AP, N82AP, etc.)
  - iBSS.XXXXX.dfu
  - WTF.XXXXX.dfu (model specific and only for M68AP, N82AP, N45AP, N72AP; not present in firmwares for the iPhone 3GS and later, because it was used to patch issues with the DFU mode that was burned into the bootrom)
- Baseband (may be one or many files depending on the model)

Example

Here are the contents of the iPhone 3GS 3.0 (7A341) firmware IPSW:

018-5302-002.dmg (281214976 bytes)
018-5304-002.dmg (12769604 bytes)
018-5306-002.dmg (12777796 bytes)
BuildManifest.plist (21097 bytes)
kernelcache.release.s5l8920x (4695492 bytes)
Restore.plist (1763 bytes)
Firmware/
- all_flash/
  - all_flash.n88ap.production/
    - applelogo.s5l8920x.img3 (9604 bytes)
    - batterycharging0.s5l8920x.img3 (19716 bytes)
    - batterycharging1.s5l8920x.img3 (24900 bytes)
    - batteryfull.s5l8920x.img3 (76100 bytes)
    - batterylow0.s5l8920x.img3 (56772 bytes)
    - batterylow1.s5l8920x.img3 (65348 bytes)
    - DeviceTree.n88ap.img3 (44996 bytes)
    - glyphcharging.s5l8920x.img3 (20356 bytes)
    - glyphplugin.s5l8920x.img3 (19332 bytes)
    - iBoot.n88ap.RELEASE.img3 (178500 bytes)
    - LLB.n88ap.RELEASE.img3 (67908 bytes)
    - manifest (341 bytes)
    - needservice.s5l8920x.img3 (20484 bytes)
    - recoverymode.s5l8920x.img3 (47876 bytes)
- dfu/
  - iBEC.n88ap.RELEASE.dfu (104772 bytes)
  - iBSS.n88ap.RELEASE.dfu (104772 bytes)

Firmwares found in IPSW

Per http://newosxbook.com/bonus/vol1AppA.html

Filename	Use
ICE17-1.xx.xx.Release.bbfw	Intel modem / baseband
Mav17-1.xx.xx.Release.bbfw	Maverick modem / baseband
AOP/aopfw-iphone##aop.im4p	Always on processor
Savage/Savage.B[0/2]-[Dev/Prod].[vt.]fw	FaceID
Yonkers/Yonkers.EA01_F###_[Dev/Prod]fw	FaceID (A12+)
SE/Stockholm##.RELEASE.sefw	Secure Element
Maggie/AppleMaggieFirmwareImage.im4p	?
cpu_Multitouch.im4p	Multitouch controller
isp/adc-petra-d3x.im4p	Image Signal Processor
ane/h11_ane_fw_quin.im4p	Apple Neural Engine
WirelessPower/WirelessPower.iphone##.im4p	Wireless charging controller
SmartIOFirmwareCHIP.im4p	T8020 and later Smart I/O
board_CallanFirmware.im4p	Haptics Firmware
ave/AppleAVE2FW.im4p	Audio/Video Encoder
agx/armfw_g11p.im4p	GPU Scheduler/Command Stream Processor
all_flash/sep-firmware.*.im4p	Secure Enclave Processor
liquiddetect@2436~iphone-lightning.im4p	Liquid Damage Detection
pmp/t8030pmp.im4p	Power Management Processor
Rose/r1p0/ftab.bin	U1 chip (Ultra Wideband)
vinyl_05.vnlfw	eSIM
Veridian	? (Some form of signing/device integrity)

Notes

IPSW files have been used since the very first iPod, though they have a different format than firmwares for iOS devices.