iphone update packages

where to find the updater files

itunes gets its current version list here: http://itunes.com/version
this file is a .plist ( which you can make more readable using xml2pl )
in that list search for FirmwareURL items.
these urls point to .ipsw files, named as follows:

<producttype>_<osversion>_<buildversion>_Restore.ipsw
<producttype>_<osversion>_<buildversion>_to_<buildversion>_Update.ipsw
x<hex-dfu-id>{_4|_5|}_Recovery.ipsw
<decimal-dfu-id>{_4|_5|}_Recovery.ipsw

producttypes: iPod1,2 iPod2,1 iPod3,1 iPhone1,1=original iPhone1,2=3G iPhone2,1=3GS
buildversions: 7c144=iphoneOS3.1, 7c145=ipodOS3.1.1, 5h11a=ipodOS2.2.1, etc...

the url's are formatted as follows:

http://appldnld.apple.com.edgesuite.net/content.info.apple.com/ { iPhone | iPod/SBML/osx/bundles } / 061-<4digits>.<yyyymmdd>.<5chars> / <ipsw filename>

contents of the .ipsw file

1 OS dmg file, this is the largest
2 ramdisk files ( one 'restore' and one 'updater' )
several bitmaps
the kernel ( kernelcache.release.<CPUNAME>
the devicetree ( you can decode this using decodedevtree.pl
4 bootloaders:
- LLB - the lowlevel bootloader
- iBoot - the main bootloader
- iBSS - used to boot iBEC during dfu restore
- iBEC - used to restore in dfu mode
some bookkeeping files: manifest, Restore.plist, BuildManifest.plist

note: the difference between the updater and restore .dmg file is only one file: restored_external, or restored_update, the first does an 'erase install', while the second does a 'upgrade install'

most of these files are 'img3' files, which can be decoded using decodeimg3.pl. for most files you need a iv/key pair to be able to decrypt them, however not all files are encrypted.
after decrypting, some files also need to be decompressed, using lzssdec

example decrypting files

7a341-3gs

NOTE: the last block of the DATA sections in the img3 files was NOT encrypted.

perl decodeimg3.pl -l LLB.n88ap.RELEASE.img3    -o llb.img   -k 783970ed70d151e65cdd0f52019f026cbc0ece5c604603117d677b6a85ea4d95 -iv fc4efef9fd245dc038ecb26f25f795c7
perl decodeimg3.pl -l iBoot.n88ap.RELEASE.img3  -o iboot.img -k c160ff26cf0cdb1c0b5d821e4102cab8a3e62687f39ab8c456907694e3c4834e -iv 948a3d82419c9d4dde404cb4a788da70
perl decodeimg3.pl -l kernelcache.release.s5l8920x -o kernel.lzss -k f49e50a630397ed72592f5c9874b33ca1e0e5a499d2a6a0f2746c8e7f1dbf470 -iv cd41286890df601bfcd87f8a09b009c8
lzssdec -o 0x180 < kernel.lzss > kernel.img

7c144-3g

NOTE: the LLB,iBEC and iBSS files were not encrypted

perl decodeimg3.pl LLB.m68ap.RELEASE.img3    -o llb.img
perl decodeimg3.pl iBoot.n82ap.RELEASE.img3  -o iboot.img  -k 1ebc381cd5ad04343ca0b08e9beab8ac -iv a5ee452933ada902193420e3956b7559
perl decodeimg3.pl kernelcache.release.s5l8900x  -o kernel.lzss  -k 258303b6d261e6476de63bc9f185b9f0 -iv 612726fff1a589a3a8906dd6b1129e86
lzssdec -o 0x180 < kernel.lzss > kernel.img

7c144-3gs

perl decodeimg3.pl LLB.n88ap.RELEASE.img3    -o llb.img      -k 23958c7975d357c09d5ae13d5824ecd7ba311d48e66e495cd9482bf541c23e17 -iv f6c407732804fde7baa6c18f4e9219b3
perl decodeimg3.pl iBoot.n88ap.RELEASE.img3  -o iboot.img    -k a4360eed53aa2d69857148e047cc52d585b88736885cff4a3c48038b4202e303 -iv 7018fa05ee1b3154bf9acb775c0a4ede
perl decodeimg3.pl kernelcache.release.s5l8920x  -o kernel.lzss  -k e4cc0a7a463008395192bd364d3ef882dbf77120f92a9d26db96f694dddc8d6b -iv 7b08e696f4ce3ff66c0f03614cb43843
lzssdec -o 0x180 < kernel.lzss > kernel.img