iPhone Firmware Beta Expired

 
 
 
 

iPhone / iPod Firmware Link

http://ax.phobos.apple.com.edgesuite.net/WebObjects/MZStore.woa/wa/com.apple.jingle.appserver.client.MZITunesClientCheck/version?touchUpdate=true

Shell script: Select all


#!/bin/sh
curl -s -L http://ax.phobos.apple.com.edgesuite.net/WebObjects/MZStore.woa/wa/com.apple.jingle.appserver.client.MZITunesClientCheck/version?touchUpdate=true | gunzip | grep appldnld | grep "iP*.*Restore" | awk '{print $1;}' | uniq


iPhone1,1_2.0_5A258f_Restore.ipsw decrypt method

Steps to decrypt the iPhone firmware 2.0 beta 4 (build 5A258f) and extract the files from ramdisk and rootfs
1. Decompress firmware (using unzip command)
2. Decrypt ramdisk (using dd command)
3. Extract rootfs decryption key (using strings command)
4. Decrypt rootfs (using vfdecrypt utility)
5. Extract important files (for Mac just double click the decrypted dmg file, for windows use PowerISO to open)

$ md5 iPhone1,1_2.0_5A258f_Restore.ipsw
MD5 (iPhone1,1_2.0_5A258f_Restore.ipsw) = f7a2937c32615545ba339c330356d9ad

Run these commands to get the ramdisk of iPhone firmware 2.0 beta 4 (build 5A258f)

$ unzip -o iPhone1,1_2.0_5A258f_Restore.ipsw 018-3587-8.dmg
$ echo `hexdump -s12 -n4 -e '"%d\n"' 018-3587-8.dmg ` / 32 | bc

The output is 610816 which will be used for the next command

strip off the first 32 bytes (0x20) and remove the trailing certificate information

$ dd if=018-3587-8.dmg of=018-3587-8.ramdisk.dmg bs=32 skip=1 count=610816 conv=sync

The baseband is in the following folder of the converted ramdisk (018-3587-8.ramdisk.dmg) mounted image
/Volumes/ramdisk/usr/local/standalone/firmware

Run these commands to get the decrypt key of iPhone firmware 2.0 beta 4 (build 5A258f)

$ unzip -o iPhone1,1_2.0_5A258f_Restore.ipsw 018-3587-8.dmg
$ strings 018-3587-8.dmg | egrep "^[0-9a-fA-F]{72}$"

The decrypt key is

198d6602ba2ad2d427adf7058045fff5f20d05846622c186cca3d423ad03b5bc3f43c61c

Run these commands to decrypt the rootfs of iPhone firmware 2.0 beta 4 (build 5A258f)

$ unzip -o iPhone1,1_2.0_5A258f_Restore.ipsw 018-3585-6.dmg

$ ./vfdecrypt -i 018-3585-6.dmg -o decrypted20b4.dmg -k 198d6602ba2ad2d427adf7058045fff5f20d05846622c186cca3d423ad03b5bc3f43c61c

For Mac OS, you need this (universal binary for PPC and Intel)
http://rapidshare.com/files/40981513/vfdecrypt.zip.html

For windows OS, you need these
http://rapidshare.com/files/41004473/vfdecrypt.exe.html
http://pecl4win.php.net/download.php/dll/061dae89b309a98382dedc04942bd8a2/libeay32.dll
http://www.poweriso.com/

Here is the shell script to implement the above procedure and support the previous 8900 decrypt method in Mac OS X

#!/bin/sh
#v0.3
if [ $# -lt 1 ]
then
  echo "usage : $0 iPhone1,1_2.0_5A274d_Restore.ipsw"
  exit 0
else
  IPSWNAMES=$@
fi
DDONE=0
for IPSWNAME in $IPSWNAMES
do
if [ -f "$IPSWNAME" ]
then
PWD=`pwd`
rm -f Restore.plist
unzip -o $IPSWNAME Restore.plist > /dev/null 2>/dev/null
if [ -f Restore.plist ]; then
DEVICECLASS=`defaults read $PWD/Restore DeviceClass`
PRODUCTVERSION=`defaults read $PWD/Restore ProductVersion`
BUILDVERSION=`defaults read $PWD/Restore ProductBuildVersion`
RESTORERAMDISK=`defaults read $PWD/Restore RestoreRamDisks | awk '/User/ { split($0, line, "\""); printf("%s\n", line[2]); }'`
SYSTEMRESTOREIMAGE=`defaults read $PWD/Restore SystemRestoreImages | awk '/User/ { split($0, line, "\""); printf("%s\n", line[2]); }'`
unzip -o $IPSWNAME $RESTORERAMDISK  > /dev/null 2>/dev/null
FILEFORMAT=`hexdump -n4 -e '"%c%c%c%c\n"' $RESTORERAMDISK`
if [ "$FILEFORMAT" == "8900" ]
then
  DECRYPTKEY=`strings $RESTORERAMDISK | egrep "^[0-9a-fA-F]{72}\$"`
  if [ "$DECRYPTKEY" == "" ]; then
    RAMDISKLENGTH=`hexdump -s12 -n4 -e '"%d\n"' $RESTORERAMDISK`
    RAMDISKCOUNT=`echo $RAMDISKLENGTH / 512 | bc`
    dd if=$RESTORERAMDISK of=$DEVICECLASS$PRODUCTVERSION$BUILDVERSION.stripped.dmg bs=512 skip=4 count=$RAMDISKCOUNT conv=sync  > /dev/null 2>/dev/null
    openssl enc -d -in $DEVICECLASS$PRODUCTVERSION$BUILDVERSION.stripped.dmg -out $DEVICECLASS$PRODUCTVERSION$BUILDVERSION.ramdisk.dmg  -aes-128-cbc -K 188458A6D15034DFE386F23B61D43774 -iv 0  > /dev/null 2>/dev/null
    rm -f $DEVICECLASS$PRODUCTVERSION$BUILDVERSION.stripped.dmg
  else
    dd if=$RESTORERAMDISK of=$DEVICECLASS$PRODUCTVERSION$BUILDVERSION.ramdisk.dmg bs=512 skip=4 conv=sync  > /dev/null 2>/dev/null
  fi
else
  RAMDISKLENGTH=`hexdump -s12 -n4 -e '"%d\n"' $RESTORERAMDISK`
  RAMDISKCOUNT=`echo $RAMDISKLENGTH / 32 | bc`
  dd if=$RESTORERAMDISK of=$DEVICECLASS$PRODUCTVERSION$BUILDVERSION.ramdisk.dmg bs=32 skip=1 count=$RAMDISKCOUNT conv=sync  > /dev/null 2>/dev/null
fi
rm -f $RESTORERAMDISK
DECRYPTKEY=`strings $DEVICECLASS$PRODUCTVERSION$BUILDVERSION.ramdisk.dmg | egrep "^[0-9a-fA-F]{72}\$"`
if [ "$DECRYPTKEY" == "" ]; then
  echo "Decrypt failed : $IPSWNAME"
else
unzip -o $IPSWNAME $SYSTEMRESTOREIMAGE  > /dev/null 2>/dev/null
./vfdecrypt -i $SYSTEMRESTOREIMAGE -o $DEVICECLASS$PRODUCTVERSION$BUILDVERSION.decrypted.dmg -k $DECRYPTKEY  > /dev/null 2>/dev/null
rm -f $SYSTEMRESTOREIMAGE
echo 
md5 $IPSWNAME
echo "RAMDISK = $DEVICECLASS$PRODUCTVERSION$BUILDVERSION.ramdisk.dmg"
echo "FILESYSTEM = $DEVICECLASS$PRODUCTVERSION$BUILDVERSION.decrypted.dmg"
echo "DECRYPTKEY = $DECRYPTKEY"
DDONE=1
fi
else
  echo "Invalid ipsw file $IPSWNAME"
fi
else
echo "$IPSWNAME NOT FOUND"
fi
done
if [ "$DDONE" == "1" ]; then
  echo "Job Completed!!!"
fi

If you find this info useful, please consider to $1 by clicking the Donate button.

Convert apple encrypted img2 file to png

(1) get the source code from
http://pastebin.ca/977711
and name to it img2png.c

(2) get the libpng file from http://www.libpng.org/pub/png/libpng.html

(3) compile with

gcc img2png.c -lcrypto -lpng -o img2png

(4) Run

./img2png applelogo.img2 applelogo.png

Find iPhone secret ramdisk decrypt key

This is one of the methods using Mac OS to find the ramdisk secret key of iPhone IPSW file

The method is stated in
http://iphonejtag.blogspot.com/2008/01/iphone-secret-key.html

After finding the decrypt key, you can use vfdecrypt (from my previous posts) to decrypt the iphone filesystem

Read this for Mac OSX / Linux decrypt method

For example, iPhone 2.0 beta firmware file (build 5A225c) is iPhone1,1_2.0_5A225c_Restore.ipsw

#!/bin/bash

# first extract the ramdisk image file from the ipsw file
unzip -o iPhone1,1_2.0_5A225c_Restore.ipsw 018-3476-4.dmg -d .

# print out the size of the file (dump the 13th to 16th byte of the file) using
echo `hexdump -s12 -n4 -e '"%d\n"' 018-3476-4.dmg` / 512 | bc

# the output will be 37464 for this case

# strip off the first 0x800 bytes and the trailing certificate
dd if=018-3476-4.dmg of=018-3476-4.stripped.dmg bs=512 skip=4 count=37464 conv=sync

# use the method of GEORGE HOTZ
openssl enc -d -in 018-3476-4.stripped.dmg -out ramdisk-018-3476-4.dmg  -aes-128-cbc -K 188458A6D15034DFE386F23B61D43774 -iv 0

# print out the ramdisk key from the image
strings ramdisk-018-3476-4.dmg | egrep "^[0-9a-fA-F]{72}$"

The output of the script is below and the ramdisk key is at the last line of the output

Archive:  iPhone1,1_2.0_5A225c_Restore.ipsw
inflating: ./018-3473-4.dmg      
37464+0 records in
37464+0 records out
19181568 bytes transferred in 0.770523 secs (24894216 bytes/sec)
ea14f3ec624c7fdbd52e108aa92d13b16f6b0b940c841f7bbc7792099dae45da928d13e7

The ramdisk key is in the /usr/sbin/asr after mounted the ramdisk image.

strings /Volumes/ramdisk/usr/sbin/asr

The second method is to get the 8900decryptor.c from http://code.google.com/p/iphone-elite/wiki/8900decryptercode

and compile it using

gcc 8900decryptor.c -lcrypto -o 8900decryptor

using this command, you can get the decrypted image and the key as well

./8900decryptor 018-3476-4.dmg 018-3476-4.8900decrypted.dmg
strings 018-3476-4.8900decrypted.dmg | egrep "^[0-9a-fA-F]{72}$"

Moreover, you can mount the ramdisk 018-3476-4.8900decrypted.dmg directly
The ramdisk key is in the /usr/sbin/asr of this mounted ramdisk image.

If you find this info useful, please consider to $1 by clicking the Donate button.

iPhone Firmware Key 1.1.4

Decrypt method is here

iPhone upgrade to 1.1.3 firmware step by step guide using ziPhone 2.2

see my step by step guide with (Windows XP) diagram posted here
http://www.iphone.org.hk/cgi-bin/ch/topic_show.cgi?id=4920&pg=1&age=0&bpg=1#22257


Mac OS Step by step guide
http://www.iphone.org.hk/cgi-bin/ch/topic_show.cgi?id=5121&h=1&bpg=1&age=0

P.S.

(1) Install Mobile Terminal version 207 for iPhone 1.1.3

(it preserves TERM environment and logs in as mobile user)

http://code.google.com/p/mobileterminal/downloads/list

Decrypt iPhone filesystem Firmware using Mac OS or Linux

If you use Mac OS and want to extract the iPhone Firmware in your computer, you can follow the instructions below. If you use Windows PC, please refer to another post here

(1) get the vfdecrypt binary for Mac (Universal Binary)

Get vfdecrypt for Mac (Intel & PPC) Unverisal Binary here

If you use linux, you can get the source code from here and compile with

gcc vfdecrypt.c -o vfdecrypt -lcrypto

For this linux version, line 357 should be changed to

  while((c = getopt(argc, argv, "hvi:o:p:k:")) != -1) {

(2) Run the shell script below to download the firmware and get the decrypted dmg

#!/bin/bash
key100=28c909fc6d322fa18940f03279d70880e59a4507998347c70d5b8ca7ef090ecccc15e82d
key101=7d5962d0b582ec2557c2cade50de90f4353a1c1de07b74212513fef9cc71fb890574bfe5
key102=7d5962d0b582ec2557c2cade50de90f4353a1c1de07b74212513fef9cc71fb890574bfe5
key111=f45de7637a62b200950e550f4144696d7ff3dc5f0b19c8efdf194c88f3bc2fa808fea3b3
key112=70e11d7209602ada5b15fbecc1709ad4910d0ad010bb9a9125b78f9f50e25f3e05c595e2
key113=11070c11d93b9be5069b643204451ed95aad37df7b332d10e48fd3d23c62fca517055816
key114=d0a0c0977bd4b6350b256d6650ec9eca419b6f961f593e74b7e5b93e010b698ca6cca1fe
key120=ea14f3ec624c7fdbd52e108aa92d13b16f6b0b940c841f7bbc7792099dae45da928d13e7

ipswurl100=http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3538.20070629.B7vXa/iPhone1,1_1.0_1A543a_Restore.ipsw
ipswurl101=http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3614.20070731.Nt6Y7/iPhone1,1_1.0.1_1C25_Restore.ipsw
ipswurl102=http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3823.20070821.vormd/iPhone1,1_1.0.2_1C28_Restore.ipsw
ipswurl111=http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-3883.20070927.In76t/iPhone1,1_1.1.1_3A109a_Restore.ipsw
ipswurl112=http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4037.20071107.5Bghn/iPhone1,1_1.1.2_3B48b_Restore.ipsw
ipswurl113=http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4061.20080115.4Fvn7/iPhone1,1_1.1.3_4A93_Restore.ipsw
ipswurl114=http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw
ipswurl120=http://appldnld.apple.com.edgesuite.net/

ipswname100=iPhone1,1_1.0_1A543a_Restore.ipsw
ipswname101=iPhone1,1_1.0.1_1C25_Restore.ipsw
ipswname102=iPhone1,1_1.0.2_1C28_Restore.ipsw
ipswname111=iPhone1,1_1.1.1_3A109a_Restore.ipsw
ipswname112=iPhone1,1_1.1.2_3B48b_Restore.ipsw
ipswname113=iPhone1,1_1.1.3_4A93_Restore.ipsw
ipswname114=iPhone1,1_1.1.4_4A102_Restore.ipsw
ipswname120=iPhone1,1_2.0_5A225c_Restore.ipsw

dmgname100=694-5262-39.dmg
dmgname101=694-5281-6.dmg
dmgname102=694-5298-5.dmg
dmgname111=022-3602-17.dmg
dmgname112=022-3725-1.dmg
dmgname113=022-3743-100.dmg
dmgname114=022-3894-4.dmg
dmgname120=018-3473-4.dmg

decrypted100=decrypted100.dmg
decrypted101=decrypted101.dmg
decrypted102=decrypted102.dmg
decrypted111=decrypted111.dmg
decrypted112=decrypted112.dmg
decrypted113=decrypted113.dmg
decrypted114=decrypted114.dmg
decrypted120=decrypted120.dmg


# default is to get the latest firmware
# you can pass multiple arguments
# in command line to get more than one
if [ $# -lt 1 ]
then
getipsw=120
else
getipsw=$@
fi

for ipsw_ver in $getipsw
do
ipswname=$(eval "echo \$$(echo ipswname${ipsw_ver})")
ipswurl=$(eval "echo \$$(echo ipswurl${ipsw_ver})")
ipswpath=`pwd`/$ipswname
decryptedname=$(eval "echo \$$(echo decrypted${ipsw_ver})")
dmgname=$(eval "echo \$$(echo dmgname${ipsw_ver})")
key=$(eval "echo \$$(echo key${ipsw_ver})")
decryptpath=`pwd`/$decryptedname
if [ -f "$ipswpath" ]
then
echo Firmware $ipsw_ver "$ipswname" found
else
echo Downloading firmware $ipsw_ver $ipswname
curl "$ipswurl" > $ipswpath
fi

if [ -f "$decryptpath" ]
then
echo Firmware $ipsw_ver "$decryptedname" found
else
if [ -f "$ipswpath" ]
then
  echo Extracting firmware $ipsw_ver $dmgname
  unzip -o $ipswname $dmgname -d .
fi
if [ -f "$dmgname" ]
then
  echo Decrypting firmware $ipsw_ver $ipswname
  ./vfdecrypt -i $dmgname -o $decryptedname -k $key
fi
fi
done
echo Jobs Completed!!!

(3) Mount the decrypted dmg in Mac OS by double click the filename

(4) For Firmware key for 1.0.1 you can run

strings 009-7662-6.dmg | egrep "^[0-9a-fA-F]{72}$"

and This is how you find the key.

(5) This is where you can find the Firmware download link from Apple
http://itunes.com/version

If you find this info useful, please consider to $1 by clicking the Donate button.

Decrypt iPhone filesystem Firmware

This shows how to extract the iphone filesystem software (firmware files) from Apple iphone software download using PC (source from iPhone Dev wiki)

(1) For Firmware 1.0.1
(i) get the vfdecrypt101.exe from Rapid share
(ii) get the Apple's iPhone firmware 1.0.1 and rename it with extension .zip and unzip it
(run) vfdecrypt101 main_dmg_of_101.dmg decrypted101.dmg

(2) For Firmware 1.0.2
(i) get the vfdecrypt102.exe from Rapid share
(ii) get the Apple's iPhone firmware 1.0.2 and rename it with extension .zip and unzip it
(run) vfdecrypt102.exe 694-5298-5.dmg decrypted102.dmg

(3) For Firmware 1.1.1
(i) get the vfdecrypt111.exe from Rapid share
(ii) get the Apple's iPhone firmware 1.1.1 and rename it with extension .zip and unzip it
(run) vfdecrypt111.exe 022-3602-17.dmg decrypted111.dmg

(4) For Firmware 1.1.2
(i) get the vfdecrypt112.exe from Rapid share
(ii) get the Apple's iPhone firmware 1.1.2 and rename it with extension .zip and unzip it
(run) vfdecrypt112.exe 022-3725-1.dmg decrypted112.dmg

(5) For Firmware 1.1.3
(i) get the vfdecrypt.exe from Rapid Share
(ii) get the Apple's iPhone firmware 1.1.3 and rename it with extension .zip and unzip it
(run) vfdecrypt -i 022-3743-100.dmg -o decrypted113.dmg -k 11070c11d93b9be5069b643204451ed95aad37df7b332d10e48fd3d23c62fca517055816

(6) For Firmware 1.1.4
(i) get the vfdecrypt.exe from Rapid Share
(ii) get the Apple's iPhone firmware 1.1.4 and rename it with extension .zip and unzip it
(run) vfdecrypt -i 022-3894-4.dmg -o decrypted114.dmg -k d0a0c0977bd4b6350b256d6650ec9eca419b6f961f593e74b7e5b93e010b698ca6cca1fe

(7) For Firmware 2.0 beta (Build 5A225c) (MD5 8254ccf38735bc74b38fb432ce982081) (expired 8 April 2008)
(i) Google Search iPhone1,1_2.0_5A225c_Restore.ipsw
(ii) Rename it with extension .zip and unzip it
(run) vfdecrypt -i 018-3473-4.dmg -o decrypted20b2.dmg -k ea14f3ec624c7fdbd52e108aa92d13b16f6b0b940c841f7bbc7792099dae45da928d13e7

(8) For Firmware 2.0 beta (Build 5A240d) (MD5 429142d57db7cf94d4c29ee4da7f21cc) (to be expired 15 May 2008)
(i) Google Search iPhone1_1_2.0_5A240d_Restore.ipsw
(ii) Rename it with extension .zip and unzip it
(run) vfdecrypt -i 018-3553-6.dmg -o decrypted20b3.dmg -k e24bfab40a2e5d3dc25e089291846e5615b640897ae8b424946c587bcf53b201a1041d36


(9) For Firmware 2.0 beta (Build 5A258f) (MD5 f7a2937c32615545ba339c330356d9ad) (to be expired 4 June 2008)
(i) Google Search iPhone 2.0 Beta 4 (5a258f)
(ii) Rename it with extension .zip and unzip it (unzip -o iPhone1,1_2.0_5A258f_Restore.ipsw 018-3585-6.dmg)
(run) ./vfdecrypt -i 018-3585-6.dmg -o decrypted20b4.dmg -k 198d6602ba2ad2d427adf7058045fff5f20d05846622c186cca3d423ad03b5bc3f43c61c

Read detail steps for decrypt iPhone firmware 1.1.3 here

Get vfdecrypt for Mac (Intel & PPC) Unverisal Binary here

Read this for Mac OSX / Linux decrypt method

Notice
-------
(a)To run the vfdecrypt in PC you need libeay32.dll as well
(b)To extract the contents in the dmg image in PC you need hfsexplorer or dmg2img.exe
You need Java Runtime if you use hfsexplorer

You can also use PowerISO 4.0 in Windows to examine and extract contents of Mac OS X *.dmg file
http://www.poweriso.com/

(c)you can mount the decrypted image directly in Mac OS or Linux. To mount DMG
dd if=694-5259-38.dmg of=ramdisk.dmg bs=512 skip=4 conv=sync
mount -o loop decrpyted112.img /mnt/decrypted112

Keys
-----
The key for the 1.01 revision is : 28c909fc6d322fa18940f03279d70880e59a4507998347c70d5b8ca7ef090ecccc15e82d

The key for the 1.02 revision is : 7d5962d0b582ec2557c2cade50de90f4353a1c1de07b74212513fef9cc71fb890574bfe5

The key for the 1.1.1 revision is : f45de7637a62b200950e550f4144696d7ff3dc5f0b19c8efdf194c88f3bc2fa808fea3b3

The key for the 1.1.2 revision is :
70e11d7209602ada5b15fbecc1709ad4910d0ad010bb9a9125b78f9f50e25f3e05c595e2

The key for the 1.1.3 revision is :
11070c11d93b9be5069b643204451ed95aad37df7b332d10e48fd3d23c62fca517055816

The key for the 1.1.4 revision is : d0a0c0977bd4b6350b256d6650ec9eca419b6f961f593e74b7e5b93e010b698ca6cca1fe

The key for the 1.2.0 beta (Build 5A147p) (md5 iPhone1,1_1.2_5A147p_Restore.ipsw = 3539f0b912812fd56ac1019d8fce4fc2 ) is: 86bec353ddfbe3fb750e9d7905801f79791e69acf65d16930d288e697644c76f16c4f16d

The key for the 2.0 beta (Build 5A225c) (md5 iPhone1,1_2.0_5A225c_Restore.ipsw = 8254ccf38735bc74b38fb432ce982081 ) is: ea14f3ec624c7fdbd52e108aa92d13b16f6b0b940c841f7bbc7792099dae45da928d13e7

The key for the 2.0 beta (Build 5A240d) (md5 iPhone1_1_2.0_5A240d_Restore.ipsw = 429142d57db7cf94d4c29ee4da7f21cc) is: e24bfab40a2e5d3dc25e089291846e5615b640897ae8b424946c587bcf53b201a1041d36

The key for the 2.0 beta (Build 5A258f) (md5 iPhone1,1_2.0_5A258f_Restore.ipsw = f7a2937c32615545ba339c330356d9ad) is: 198d6602ba2ad2d427adf7058045fff5f20d05846622c186cca3d423ad03b5bc3f43c61c

read this http://tungchingkai.blogspot.com/2008/05/iphone11205a258frestoreipsw-decrypt.html for the decrypt method

The key for the 2.0 beta (Build 5A274d) (md5 iPhone1,1_2.0_5A274d_Restore.ipsw = 1e671faa31d876602161d9bb463e15da) is: 589df25eaa4ff0a5e29e1425fb99bf50957888ff098ba2fcb72cf130f40e15e00bcf2fc7

Read this on how to find the key for firmware 1.1.1 or above

For example, firmware 1.1.4, you can find the decrypt key by running this in Mac OS X Terminal

#!/bin/bash
# first extract the ramdisk image file from the ipsw file
unzip -o iPhone1,1_1.1.4_4A102_Restore.ipsw 022-3896-4.dmg -d .

# strip off the first 0x800 bytes and the trailing certificate
dd if=022-3896-4.dmg of=022-3896-4.stripped.dmg bs=512 skip=4 count=36640 conv=sync

# use the method of GEORGE HOTZ and ignore the error
openssl enc -d -in 022-3896-4.stripped.dmg -out ramdisk-022-3896-4.dmg  -aes-128-cbc -K 188458A6D15034DFE386F23B61D43774 -iv 0

# print out the ramdisk key from the image
strings ramdisk-022-3896-4.dmg | egrep "^[0-9a-fA-F]{72}$"

If you have the 8900decryptor binary, you can get the same decrypted image file and key from

#!/bin/bash
./8900decryptor 022-3896-4.dmg 022-3896-4.8900decrypted.dmg
strings 022-3896-4.8900decrypted.dmg | egrep "^[0-9a-fA-F]{72}$"

If you find this info useful, please consider to $1 by clicking the Donate button.