Thread by @nyan_satan

Here is my little thread about Lightning video adapters – also known as Haywire – which are actually computers that feature Apple Secure Boot and run Darwin kernel

There’re 2 kinds of Haywire:

1. Lightning Digital AV Adapter (b137ap/iAccy1,1) – Lightning to HDMI adapter, supports both video and audio

2. Lightning to VGA Adapter (b165ap/iAccy1,2) – doesn’t support audio output for obvious reason

Both support up to 1080p video output according to Apple and make use of the same SoC – S5L8747. Its part number is H9TKNNN2GD and according to The iPhone Wiki it has 256MB of RAM. Not much else is known about it

Unfortunately, these adapters are of terrible quality. HDMI adapter got 2 out 5 stars on US Apple Store web-site and reviews are all like this one:

My b137 met the same faith, so we can disassemble it. Here is how it looks like without its plastic closure:

Let’s destroy this metal shell with pliers

These copper dots are test points - some of them must be UART and SWD (both are unavailable over Lightning):

Haywire itself doesn’t store any firmware (well, except for SecureROM), so iOS has to upload it every time. Firmware bundle for it is very tiny, around 25MB uncompressed. Shipped as preinstalled asset with iOS and/or can be downloaded. That’s how its folder structure looks like:

Firmware is pre-signed and doesn’t require any personalization. APTicket is although used, but yet static, i.e. isn’t bound to any ECID and nonce

Unlike for all other devices since iOS 5, iBSS for Haywire features Recovery mode with interactive shell and used to boot kernel cache sent over USB (along with DeviceTree and ramdisk, of course)

https://twitter.com/nyan_satan/status/1111313993237442566?s=20

Some interesting information about the software on its ramdisk:

theiphonewiki.com/wiki/Lightning…

iBSS’es Image3 has weird previously unknown tag ‘RAND’, that contains 64-bit integer and some padding. I couldn’t find what this tag means even in the leaked iBoot source code. Also it always has only one KBAG

Memory map:

0x20000000-0x20020000 - ROM (128 KB)
0x22000000-0x22020000 - SRAM (128 KB) (iBSS works from here)
0x8000000-0x18000000 - SDRAM (256 MB)

0x08000000-0x0B000000 - Load area (48 MB)
0x0B000000-0x0DF00000 - Kernel (47 MB)
0x0DF00000-0x0E000000 - Device tree (1 MB)
0x0E000000-0x11000000 - Ramdisk (48 MB)

0x11000000-0x17F00000 - Heap (111 MB)
0x17F00000-0x17FFC000 - iBoot (unused) (1008 kB)
0x17FFC000-0x18000000 - Panic (16kB)

Its SecureROM (iBoot-1413.8 for latest chip revision) is known to be dumped using hardware tricks at least by one person. I asked that person for the dump, but obviously was refused. According to the person, this ROM is very much like A6 one

According to the leaked iBoot source code, Haywire has SPI NOR, but even if production ones actually have it, it doesn’t seem to be formatted, because “saveenv” iBoot commands fails

You can easily connect Haywire to PC because it’s basically an USB device. All you need to get to accomplish is Lightning and micro-USB female breakout boards and few connecting wires:

Scheme of connection:

GND -> GND
L0p -> D+
L0n -> D-
ID1 (ACC_PWR1) -> VCC

Please note that iPhone gives it 3.3V originally, but USB has 5V. Not sure if it’s a good idea, but it works. Anyway don't blame me if you break something

And here we are!