| iBoot | |
| Developer: | Apple Inc. |
| Operating System: | Darwin, macOS,[1] iPadOS and iOS |
| Platform: | x86, ARM |
| Genre: | Boot loader |
| License: | Proprietary software |
iBoot is the stage 2 bootloader for all Apple products.[2] It replaces the older EFI-based bootloader on Intel-based Macs. Compared with its predecessor, iBoot improves authentication performed in the boot chain.[3]
For x86-based Macs, the boot process starts by running code stored in secured UEFI boot ROM (stage 1). The boot ROM has two primary responsibilities: to initialize system hardware and to select an operating system to run (the POST and UEFI component). For ARM-based Macs, the boot ROM does not include UEFI.[4] For x86-based Macs, the Low-Level Bootloader (LLB) is usually referred to UEFI firmware itself.
For iPhones, iPads and ARM-based Macs, the boot process starts by running the device's boot ROM. The boot ROM loads the (LLB), which is the stage 1 bootloader and loads iBoot. If all goes well, iBoot will then proceed to load the iOS, iPadOS or macOS kernel as well as the rest of the operating system.[5] [6] If the iBoot fails to load or fails to verify iOS, iPadOS or macOS, the bootloader jumps to DFU (Device Firmware Update)[7] mode; otherwise it loads the remaining kernel modules. Since Apple A7, the LLB is stored on NAND flash of iPhone or iPad[8] ; since Apple M1, the LLB is stored on internal SSD of Apple Silicon Mac.[9]
On x86 Macs, iBoot is located in /System/Library/CoreServices/boot.efi.[10] Once the kernel and all drivers necessary for booting are loaded, the boot loader starts the kernel’s initialization procedure. At this point, enough drivers are loaded for the kernel to find the root device.[11]
For iBoot, it features a command prompt when in recovery, DFU, or restore mode (it's also in "DEBUG" builds of iBoot, but was never seen in future builds). Command availability depends on the type of iBoot being used, especially the build style.
When using iBoot's command prompt, you use the included commands to manage the behaviour, such as its boot arguments (internally called the "boot-args" in the NVRAM), or if the startup command (fsboot) should be used when iBoot is automatically loaded (known as auto-boot).[12] [13]
Apple has modified the C compiler toolchain that is used to build iBoot in order to advance memory safety since iOS 14. This advancement is designed to mitigate entire classes of common memory corruption vulnerabilities such as buffer overflows, heap exploitations, type confusion vulnerabilities, and use-after-free attacks. These modifications can potentially prevent attackers from successfully escalating their privileges to run malicious code, such as an attack involving arbitrary code execution.[14]
In 2018, a portion of iBoot source code for iOS 9 was leaked on GitHub,[15] Apple then issued a copyright takedown request (DMCA) to GitHub to remove the repository. It was believed an Apple employee was responsible for the leak. However, this was not confirmed by Apple.
The earliest known version of iBoot was iBoot-87.1, seen on very early prototypes during the iPhone's production in 2006-2007. It had the same features as the first known version of iBoot (iBoot-99), except it not having features before the final release. This version of iBoot could be considered the "first beta" of iBoot.[16]
