This article discusses software internally used by Apple. Acquiring a copy without Apple's consent is illegal and may result in being scammed. |
This is a documented list of known NonUI builds, used by Apple workers in California to do engineering tests on prototype devices and also by factory workers on production devices during manufacturing. These "factory firmwares" are based on production iOS firmware, but are adapted for internal engineering tests, development and debugging.
The name "NonUI" (Non-User Interface) refers to how a majority of applications in these builds are accessible via command line interace. The applications which do use a graphical user interface can be launched through SwitchBoard, a minimal version of SpringBoard. Unlike production iOS firmwares, factory firmwares have the following differences:
- DEVELOPMENT fused bootloaders in
\Firmware\dfu\
and\Firmware\all_flash\all_flash.[board codename].factory[fa/sa]\
. - FACTORY fused SEP firmware in
\Firmware\all_flash\all_flash.[board codename].factory[fa/sa]\
- DEVELOPMENT fused kernelcache with more symbols (located in
/System/Library/Caches/com.apple.kernelcaches
on the filesystem), and with individual kexts in/System/Library/Extensions
. - DEVELOPMENT dyld_shared_cache in
/System/Library/Caches/com.apple.dyld
. - DEBUG fused baseband firmware in
\Firmware\
. - Skankwerk (gear) logo image file in
\Firmware\all_flash\all_flash.[board codename].factoryfa\
. /AppleInternal
folder, which the hierarchy inside get priority over hierarchy in/
.- No SpringBoard, requires the use of daemons to launch SwitchBoard.app as a multi-app launcher instead.
/usr
and subfolders contain many UNIX command line utilities.- SSH daemon is pre-installed as dropbear, can be connected to over usb
- Boot loader passes arguments to kernel (unlike RELEASE boot loaders as of iOS 5.0) which makes it easy to disable AMFI
- It has some additional Private Frameworks in
/System/Library/PrivateFrameworks
for internal GUI apps and command line utilities. - Most internal applications require the use of SkankKit (replacement for UIKit in nonUI firmwares) to produce special layers such as text on the framebuffer.
Factory firmwares are distributed via internal "restore bundles", which can only be restored on devices using internal restore software such as PurpleRestore. Release and factory firmware "restore bundles" have the same directory structure (bootloaders, kernel, restore ramdisk, update ramdisk and root filesystem), but can also include other files specific to internal development builds of iOS.
Some interesting facts about factory firmwares[edit source]
- Design: Apple seems to use the same GUI design from the production firmware to the factory one.
Production iOS 1.x to 6.x skeuomorphism design is also present on 1.x to 6.x factory firmwares, but seems really more excessive than production ones. For example, the "skankwerk" boot logo represents a real gear and many GUI icons are realistic or simply photos of real life things (especially in Operator). For newer versions, production iOS 7.x to 9.x flat design is mostly used in 7.x to 9.x factory firmwares. For example, the new "skankwerk" boot logo is a flat, simple white gear. Some newer internal applications like Earthbound also use a "flat" design.
- Other: The "skank" word is used to name multiple elements of factory firmwares. For example, there is "skankphone", "skankbattery" (the green battery shown in SwitchBoard), "skankwerk" logo, "skankkit" framework, "purpleskank" (used by BurnIn) and most likely others. The "skank" word seems to be a reference to "Skunkworks" projects, which are secrecy projects that are usually innovative. Read more about "Skunkworks" on Wikipedia.
iPhones[edit source]
iPhone[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
1.0 | 1A420 | Alpine | 03.06.01_G[1] | Originally posted to MacRumors |
4A57 | 04.02.13_G | - | ||
1.1.1 | 3A109f | ? | - | |
1.1.2 | 3B48 | 04.02.13_G | - | |
1.1.3 | 4A93 | ? | From @mcg29_ on Twitter | |
1.1.4 | 4A102a | 04.04.05_G | - |
iPhone 3G[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
2.0.2 | 5C274a | BigBear | ? | - |
4.0 | 8A2180g | 05.12.01 | ApexNanshan |
iPhone 3GS[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
3.0 | 7A2168d | Kirkwood? | ? | From @1nsane_dev on Twitter |
3.1b | 7C108b | Sierra? | ? | - |
4.0 | 8A133 | Apex | ? | - |
8A2180g | ApexNanshan | 05.12.01 | - | |
5.1 | 9B3176n | HoodooYabuli | 05.16.05 | - |
6.0 | 10A316 | Sundance | 05.16.06 | - |
iPhone 4[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
4.0 | 8A133 | Apex? | 01.32.01 | - |
8A2062a | ? | - | ||
8A2130h | ApexNanshan | ? | - | |
8A2180g | 01.42.01 | - | ||
5.1 | 9B3176n | HoodooYabuli | 04.12.01 | - |
6.0 | 10A316 | Sundance | 04.12.02 | - |
iPhone 4 (CDMA)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
4.2 | 8E5074b | Phoenix? | ? | Found on an FCC test report [2] |
6.0 | 10A63971b | SundanceTaosTianshan | ? | - |
iPhone 4S[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
5.0 | 9A2264r | TellurideNanshan | ? | - |
5.1 | 9B3145a | HoodooYabuli | ? | - |
9B3176b | ? | - | ||
9B3176n | 1.0.10 | - | ||
6.0 | 10A23941a | SundanceNanshan | 2.0.0.2 | - |
10B63290m | Brighton? | ? | - |
iPhone 5[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
6.0 | 10A23110j | SundanceNanshan | ? | From @nyan_satan on Twitter |
10A23110z | ? | - | ||
10A316 | Sundance | 1.7.00 | - | |
10A23941s | SundanceNanshan | ? | - |
iPhone 5c[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
7.0 | 11A63840h | InnsbruckTianshan | ? | From @pazbobrov on Twitter |
11A93840f | InnsbruckAni? | ? | - | |
11A93840h | ? | From @1nsane_dev on Twitter | ||
11A93840l | InnsbruckAni | ? | - | |
7.1 | 11D31620l | SochiYabuli | ? | |
11D31620u | ? |
iPhone 5s[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
7.0 | 11A22051f | InnsbruckNanshan? | ? | From @DongleBookPro on Twitter |
11A93840f | InnsbruckAni? | ? | Originally posted to MacRumors | |
11A24580o | InnsbruckNanshan | 1.00.05 | - | |
11A24581c | ? | - | ||
11A24581k | ? | From @1nsane_dev on Twitter | ||
11A360 | Innsbruck | 7.02-16 | Found on an FCC test report [3] | |
11.0 | 15A93720r | TigrisAni? | ? | - |
iPhone 6[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
8.0 | 12A310 | Okemo | 0.26.01 | Found on an FCC test report [4] |
12A93311h | OkemoAni | 1.00.01 | - | |
12A93650j | 1.00.05 | Found on an Idlefish listing by @TipzRickyCheung on Twitter | ||
12A93650o | 1.00.05 | - | ||
12A93650z | ? | From @AppleInternalsh on Twitter | ||
12A93651a | 1.00.05 | - | ||
12A93651b | 1.00.05 | - | ||
8.3 | 12F69 | Stowe? | ? | Seen on iFixit's forum [5] |
9.0 | 13A83261u | MonarchSajo | ? | From @CollectorApple on Twitter |
13A83262c | ? | From @ThermalDOE on Twitter | ||
11.3 | 15E61570m | Emet? | ? | From @mcg29_ on Twitter |
iPhone 6 Plus[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
8.0 | 12A22121a | OkemoNanshan? | ? | - |
12A23410x | ? | from @DongleBookPro on Twitter |
iPhone 6s[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
9.0 | 13A93051l | MonarchAni | 0.37.08 | - |
13A93051r | MonarchAni? | ? | - | |
13A93420d | Monarch? | ? | - | |
13A93420i | ? | From @AppleInternalsh on Twitter | ||
13A93420m | 1.00.05 | - | ||
10.0 | 14A83432m | WhitetailSajo? | ? | From @OkemoZurs on Twitter |
11.0 | 15A23061c | TigrisNanshan | ? | From @mcg29_ on Twitter |
iPhone 6s Plus[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
9.0 | 13A22120w | MonarchNanshan? | ? | - |
13A22121a | MonarchNanshan? | Found on an IdleFish listing | ||
13A283 | Monarch? | 0.31.02 | Found on an FCC test report [6] |
iPhone SE (1st generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
9.3 | 13E180 | Eagle? | 4.70.10 | Found on an FCC test report [7] |
iPhone 7[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
10.0 | 14A22580n | WhitetailNanshan? | 0.16.01-3 | Found on an FCC test report [8] |
14A92340t | WhitetailAni | ? | - | |
14A93012r | ? | - | ||
14A93013a | ? | - |
iPhone 7 Plus[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
10.0 | 14A22000v | WhitetailNanshan? | ? | Found on an Idlefish listing and documented by @_orangera1n on Twitter |
14A22001a | ? | |||
14A22161a | ? | From @Dashelus on Twitter | ||
14A22181a | ? | From @1nsane_dev on Twitter | ||
14A22881a | ? | From @Jin_Store on Twitter |
iPhone 8[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
11.0 | 15A93261h | TigrisAni | 00.34.09 | - |
15A93720p | ? | From @AppleInternalsh on Twitter. | ||
15A93720r | ? | - |
iPhone 8 Plus[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
11.0 | 15A23061c | TigrisNanshan | ? | From @mcg29_ on Twitter |
15A93260r | TigrisAni | ? | From @1nsane_dev on Twitter | |
15A93621f | ? | From @1nsane_dev on Twitter |
iPhone X[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
11.0 | 15A783601x | TigrisAni | ? | From @1nsane_dev on Twitter |
15A783601y | ? | - |
iPhone XR[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
12.0 | 16A295 | Peace? | ? | Found on an FCC test report [9]. |
16A13580t | PeaceJade | Found on an Idlefish listing | ||
16A13580x | From this eBay listing | |||
16A13580z | From @1nsane_dev on Twitter | |||
16A13581a | From @ThermalDOE on Twitter | |||
16A73281c | Peace? | - |
iPhone XS[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
12.0 | 16A272 | Peace? | ? | Found on an FCC test report [10] |
16A93020u | PeaceAni | ? | - |
iPhone XS Max[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
12.0 | 16A295 | Peace? | ? | Found on an FCC test report [11]. |
16A22481b | PeaceNanshan? | From @YRH04E on Twitter. | ||
16A23250u | From @1nsane_dev on Twitter. |
iPhone 11 Pro[edit source]
Verison | Build | Codename | Baseband | Comments |
---|---|---|---|---|
13.0 | 17A525 | Yukon? | ? | Found on an FCC test report [12] |
iPhone 11 Pro Max[edit source]
Verison | Build | Codename | Baseband | Comments |
---|---|---|---|---|
13.0 | 17A94460w | YukonAni? | ? | Found on an eBay listing and documented by @_orangera1n on Twitter |
17A500a | Yukon? | Found on an FCC test report [13] |
iPhone SE (2nd generation)[edit source]
Verison | Build | Codename | Baseband | Comments |
---|---|---|---|---|
13.2.2 | 17E160 | YukonE? | ? | Found on an FCC test report [14] |
iPhone 12 Mini[edit source]
Verison | Build | Codename | Baseband | Comments |
---|---|---|---|---|
14.0 | 18A33310l | AzulYabuli? | ? | Found on an FCC test report [15] |
14.1 | 18A33771c | AzulHWYabuli? | ? | From @_orangera1n on Twitter |
iPhone 12[edit source]
Verison | Build | Codename | Baseband | Comments |
---|---|---|---|---|
14.0 | 18A23120m | AzulNanshan? | ? | Found on an FCC test report [16] |
18A23120p | Found on an Idlefish listing and documented by @_orangera1n on Twitter |
iPhone 12 Pro[edit source]
Verison | Build | Codename | Baseband | Comments |
---|---|---|---|---|
14.0 | 18A23120m | AzulNanshan? | ? | Found on an FCC test report [17] |
14.1 | 18A23581a | ? | From @1nsane_dev on Twitter |
iPhone 12 Pro Max[edit source]
Verison | Build | Codename | Baseband | Comments |
---|---|---|---|---|
14.0 | 18A23120o | AzulNanshan? | ? | From @OkemoZurs on Twitter |
18A23121e | ? | Found on an FCC test report [18] |
iPhone 13 mini[edit source]
Verison | Build | Codename | Baseband | Comments |
---|---|---|---|---|
15.0 | 19A272 | Sky? | ? | Found on an FCC test report [19] |
iPhone 13 Pro[edit source]
Verison | Build | Codename | Baseband | Comments |
---|---|---|---|---|
15.0 | 19A272 | Sky? | ? | Found on an FCC test report [20] |
iPhone 13 Pro Max[edit source]
Verison | Build | Codename | Baseband | Comments |
---|---|---|---|---|
15.0 | 19A272 | Sky? | ? | Found on an FCC test report [21] |
iPads[edit source]
iPad (1st generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
3.2 | 7B3341c | WildcatYabuli | ? | Found on a MacRumors post |
7B3341e | - | |||
7B5286a | Wildcat | Found by SonnyDickson, documented on 9to5mac | ||
5.1 | 9B3176n | HoodooYaubli | - |
iPad (2nd generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
4.3 | 8F3178a | Durango | ? | - |
8F3191d | ? | - |
iPad (3rd generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
5.1 | 9B87 | Hoodoo? | ? | Found on an FCC test report [22] |
9B3110u | HoodooYabuli | ? | Found on an Idlefish listing | |
9B3176a | ? | From @mcg29_ on Twitter | ||
6.0 | 10A316 | Sundance | ? | - |
iPad (4th generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
6.0 | 10A33901a | SundanceYabuli? | ? | From @DongleBookPro on Twitter |
7.0 | 11A63840h | InnsbruckTianshan | ? | Horizontal mode only. |
iPad (5th generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
10.3 | 14E61810k | ErieTianshan? | ? | From @AppleInternalsh on Twitter |
14E62210l | ? | From @AppleInternalsh on Twitter | ||
14E232 | Erie? | ? | Found on an FCC test report [23] | |
10.3.2 | 14F60900i | FranklinTianshan | ? | From @AppleInternalsh on Twitter |
14F60900l | ? | From @mcg29_ on Twitter |
iPad (6th generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
11.3 | 15E61120h | EmetTianshan? | ? | - |
15E61120i | From @ThermalDOE on Twitter | |||
15E61340m | From @AppleProto03 on Twitter | |||
15E61570l | Found on an FCC test report [24] | |||
15E61570m | From @mcg29_ on Twitter | |||
15E61570o | - | |||
15E61570x | ||||
15E62180f | From this video by @AppleDemoYT |
iPad (7th generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
13.0 | 17A522 | Yukon? | ? | Found on an FCC test report [25] |
iPad (8th generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
14.0 | 18A325 | Azul | ? | Found on an FCC test report [26] |
iPad (9th generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
15.0 | 19A311 | Sky? | ? | Found on an FCC test report [27] |
iPad (10th generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
16.0 | 20A32640u | SydneyYabuli? | ? | Found on an FCC test report [28] |
iPad minis[edit source]
iPad mini (1st generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
6.0 | 10A378 | Sundance? | ? | Found on an FCC test report [29] |
10A63970m | SundanceTaosTianshan | ? | - | |
10A63970v | ? | - | ||
10A63971b | ? | - |
iPad mini (2nd generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
7.0.3 | 11B64940j | InnsbruckTaos? | ? | - |
10.3 | 14E62210l | ErieTianshan? | ? | - |
11.0 | 15A93720r | TigrisAni? | ? | - |
iPad mini (3rd generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
8.0 | 12A314 | Okemo? | 3.08.08 | Found on an FCC test report [30] |
12A63340h | OkemoTianshan? | ? | From @FileAnAardvark on Twitter |
iPad mini (4th generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
8.4 | 12H33 | Donner? | ? | Found on an FCC test report [31] |
12H60160o | ? | - | ||
9.0 | 13A62950o | Monarch? | ? | - |
9.0.2 | 13A64520d | MonarchTianshan | 4.02.00 | From @AppleInternalsh on Twitter. |
iPad mini (5th generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
12.2 | 16E31120n | PeaceEYabuli? | ? | From @laobaiTD on Twitter |
16E31520i | ? | Found on an FCC test report [32] |
iPad Airs[edit source]
iPad Air (1st generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
7.0.3 | 11B34210y | InnsbruckTaosYabuli | ? | This is for the iPad4,2 model. |
11B34640l | InnsbruckTaosYabuli? | ? | - | |
7.1 | 11D31620c | SochiYabuli? | ? | From this eBay listing |
iPad Air (2nd generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
8.1 | 12B331 | OkemoTaos? | ? | Found on an FCC test report [33] |
12B33610i | OkemoTaosYabuli? | ? | From journaldulapin.com [34]. |
iPad Air (3rd generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
12.2 | 16E31120m | PeaceEYabuli | ? | - |
16E31520i | ? | Found on an FCC test report [35] |
iPad Air (4th generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
14.0 | 18A325 | Azul | ? | Found on an FCC test report [36] |
iPad Air (5th generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
15.4 | 19E11500q | SkyEJade? | ? | Found on an FCC test report [37] |
iPad Pros[edit source]
iPad Pro (unreleased)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
9.0 | 13A165 | Monarch | 2.15.00 (debug) | For J98/99AP |
iPad Pro (9.7-inch) (1st generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
9.3 | 13E31820k | EagleYabuli? | ? | Found on an FCC test report [38] |
iPad Pro (12.9-inch) (1st generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
9.1 | 13B72 | Boulder? | ? | Found on an FCC test report [39] |
iPad Pro (12.9-inch) (2nd generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
10.3 | 14E232 | Erie? | ? | Found on an FCC test report [40] |
14E32020u | ErieYabuli? | ? | Found on an FCC test report [41] |
iPad Pro (10.5-inch)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
10.3 | 14E22020w | ErieNanshan? | ? | Found on an FCC test report [42] |
iPad Pro 12.9 (3rd generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
12.1 | 16B64 | PeaceB? | ? | Found on a FCC test report [43] |
iPad Pro 11 (2nd generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
123.4 | 17E228 | YukonE? | ? | Found on a FCC test report [ https://fccid.io/BCGA2228/Test-Report/DFS-Test-Report-4649340] |
iPad Pro 12.9 (5th generation)[edit source]
Version | Build | Codename | Baseband | Comments |
---|---|---|---|---|
14.5 | 18E20700y | AzulENanshan? | ? | Found on a FCC test report [44] |
iPods[edit source]
iPod touch (1st generation)[edit source]
Version | Build | Codename | Comments |
---|---|---|---|
1.1 | 3A53 | Snowbird | Found on an FCC test report [45] |
iPod touch (2nd generation)[edit source]
Version | Build | Codename | Comments |
---|---|---|---|
2.1 | 5F122 | SugarBowl | From @1nsane_dev on Twitter |
iPod touch (3rd generation)[edit source]
Version | Build | Codename | Comments |
---|---|---|---|
3.1 | 7C1023e | Inferno? | - |
7C1095a | - | ||
7C144 | Northstar? | - |
iPod touch (4th generation)[edit source]
Version | Build | Codename | Comments |
---|---|---|---|
4.1 | 8B1016c | Baker | Found on an ebay listing by Hap Plain |
8B1069b | From this DongleBookPro video | ||
8B1084b | From @mcg29_ on Twitter | ||
5.1 | 9B3145a | HoodooYabuli | - |
9B3176b | - | ||
9B3176n | - |
iPod touch (5th generation)[edit source]
Version | Build | Codename | Comments |
---|---|---|---|
6.0 | 10A219 | Sundance | From @nyan_satan on Twitter. |
10A351 | Sundance? | Found on an FCC test report [46] |
iPod touch (6th generation)[edit source]
Version | Build | Codename | Comments |
---|---|---|---|
8.3 | 12H1150f | CopperJade | From @OkemoZurs on Twitter. |
8.4 | 12H10570d | From @1nsane_dev on Twitter. | |
9.0 | 13A83262h | MonarchSajo | From this archived tweet |
9.3 | 13C75 | Castlerock |
iBridge[edit source]
iBridge2,3[edit source]
Version | Build | Codename | Comments |
---|---|---|---|
2.4.1 | 15P765831x | LoboGoatHWBridge? | From @ _cc999 on Twitter |
iBridge2,8[edit source]
Version | Build | Codename | Comments |
---|---|---|---|
3.2 | 16P25070u | BridgeOSLibertyC? | Leaked by @Unknown_tags on Twitter |