iPhone 7 CPFM 00, 32bit SEP

Reference:

$700.00

* iPhone 7, with modified A10 SoC. Unfused to CPFM 00, ready for debug.

See our CPU replacement process.

Quantity
In Stock

Modified iPhone 7 ready for debug. This modified board can be switched into JTAG/SWD mode (Serial Wire Debug), for CPU/SEP access and debugging.

Contents:

* iPhone 7, with modified A10 SoC (Unfused to CPFM 00 + Pineapple logo)

USB:

* DFU mode

* VID/PID: 0x05ac/0x1227

CPFM setting:

* 00 ("insecure development mode")

CPU cores available for debug:

* CPU0: yes

* CPU1: yes

* SEP: yes

* SIO: yes

* PMP: yes

* AOP: yes

* GFX: yes

* ISP: yes

Watchout:

This device does not boot. It can be used only for debugging, development and research purposes. You wont be able to place any calls, send messages, etc.

Details on CPFM fuse mode:

* CPFM 03: When buying an iPhone at the shop, the CPFM (ChiP Fuse Mode) bits are hard fused to the value 03, which means "secure production mode". Such devices have all debug features disabled.

* CPFM 01: When using BootROM exploits such as checkm8, the phone can be demoted, by changing the CPFM settings to 01 ("secure development mode"). These change is temporary, because it happens only in memory (not at the physical fuse level) and thus does not persist at the next reboot. When in CPFM 01, the device can be attached with a JTAG probe. This gives debug access to the Application Processor, to control its execution and registers.

* CPFM 00: In order to debug SEP (Secure Enclave Processor), the CPFM setting must be set to 00 ("insecure development mode"). While this is not possible to achieve with any publicly known software exploit, physical access to the fuse remains possible by replacing the whole SoC chip by a modified one, with CPFM value 00. Such change is done in the hardware, persists across reboots and does not require exploits.

1. Remove the previous CPU with a CNC milling machine

iPhone 7 A10: remove CPU (1/2)

The iPhone 7 board is placed in the CNC milling machine to remove the CPU A10.

iPhone 7 A10: remove CPU (2/2)

The iPhone 7 board is placed in the CNC milling machine to remove the CPU A10.

The CPU is removed !

2. Prepare the board for soldering

iPhone CPU: prepare for soldering

After removing the old CPU, we apply solder flux on the PCB before placing the new CPU.

3. Program and unfuse the new CPU with CPFM 00

The CPU is placed in a JIG for programming.

4. Place the new CPU

The new CPU is placed in its slot:

5. Solder with hot gun

iPhone CPU: soldering with hot air gun

9 Items

Specific References

1 other product in the same category: