Prototypes are Pre-Production Apple Devices. They tend to be rare and difficult to find, especially for older or newer devices or earlier stage prototypes.
Stages
Common stages for Prototypes (in chronological order) are:
- DROP# (Non-(or minimally) functional devices)
- PROTO# (usually PROTO0-2, sometimes shortened to P)
- EVT# (Usually EVT1-4)
- EVTX (Usually EVTA-C)
- CRB (Carrier Research Build)
- DVT# (Usually DVT1-4)
- DVTX (Usually DVTA-C)
- PrePVT
- PVT (Includes PVTe, which are meant for software devices (Typically testing devices))
- MP (Mass production devices (usually just testing devices and/or rejected standard units))
Watch this video to learn more.
Prototypes tend to have different Security Fusings than production devices, the main exception is PVT and MP, which often have production fusings due to being production hardware
Software
These device tend to run the following internal software:
NonUI - Seen on every known stage, except DROP.
InternalUI - Typically seen on DVT and PVTe, occasionally EVT.
CarrierOS - sometimes seen on DVT units, which are typically carrier phones.
Diags - Present on the vast majority of units not running InternalUI or CarrierOS, including units that boot to Recovery Mode.
These devices can also sometimes be running release iOS (including betas and internal builds that are compiled as release builds).
Fusings
As mentioned before, Prototypes tend to have different security fusings than production Devices, due to their developmental nature, as Apple has to debug them for testing puproses. More information is available here.
Fusing can be explained as:
CPFM 00: This allows for SEP debugging aswell as AP debugging. This is typically seen on PROTO or EVT stage devices, but has also been seen on later devices with higher CPRV's.
CPFM 01: This allows for AP debugging, but disallows SEP debugging. This is typically seen on DVT or PVTe stage devices, but can also be rarely found on later (MP) devices.
CPFM 03: This is standard fusing, which is on most PVT and MP devices (with a few exemptions). This disallows for any low level debugging. However, with BootROM exploits, such as checkm8, it can be reenabled and used with a SWD cable, such as the Kanzi cable.