Tool
img4tool
tihmstar's command-line tool and C++ library for Apple's IMG4 firmware container format. It prints the ASN.1 contents of IMG4 files, IM4P payload containers and IM4M signing manifests, including payload types, descriptions and key bags, and extracts IM4P or IM4M parts from IMG4 or SHSH files and payloads from IM4P files, decompressing LZSS or BVX2 (LZFSE) data and decrypting it when given an IV and key. It can also check an IM4M ticket or a signed IMG4 against a BuildManifest, convert IM4M files to SHSH, and build or rename containers for restore tooling.
- Targets
- Firmware
- Category
- Firmware tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Latest release at review: build 218, published 2026-01-29, which provides the CI's macOS and Ubuntu buildroot archives rather than packaged installers. The reviewed master commit (merged 2026-08-20) is two commits ahead of it, merging a fix to the generator argument. The version number is the repository's commit count.
- Source builds use autoconf, automake, libtool and pkg-config with a C++11 compiler and require tihmstar's libgeneral. libplist-2.0 (for SHSH reading, verification and conversion) and a crypto backend (OpenSSL, or CommonCrypto on macOS) for decryption and payload hash checks are optional; without one, decryption fails and verification warns that it cannot check payload hashes. BVX2 support needs Apple's libcompression or liblzfse, and an optional libfwkeyfetch build adds a key-lookup option that this entry does not cover.
- Input files are the user's own IMG4, IM4P, IM4M or SHSH files and BuildManifests. The repository is source only and commits no Apple firmware, tickets or keys, and decrypting a payload requires an IV and key that the user supplies. The bundled LZSS decoder (lzssdec.c) is adapted, per its header, from Jonathan Levin's joker code.
- LGPL-3.0 license. Container creation, renaming and the IM4R generator option exist for restore workflows and are not described further here. No firmware file was parsed and nothing was built.
About this entry
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- README.md GitHub · tihmstar/img4tool · Revision bb2d634
- img4tool/main.cpp#L44-L199 GitHub · tihmstar/img4tool · Revision bb2d634
- img4tool/img4tool.cpp GitHub · tihmstar/img4tool · Revision bb2d634
- img4tool/lzssdec.c#L1-L8 GitHub · tihmstar/img4tool · Revision bb2d634
- configure.ac GitHub · tihmstar/img4tool · Revision bb2d634
- .github/workflows/main.yml GitHub · tihmstar/img4tool · Revision bb2d634
- LICENSE GitHub · tihmstar/img4tool · Revision bb2d634
- https://github.com/tihmstar/img4tool/releases/tag/218
More in Firmware and hardware
- ThinkPad IMX471: recovering camera tuning for Linux · Case study
- MXQ PRO RK3229: an Android firmware investigation and Linux repurposing · Case study
- iCSee LocalMod: a stock-firmware camera control extension · Case study
- flipper-telink: replacement firmware for Tuya Zigbee remotes · Case study
- Supermodel: initial Real3D Pro-1000 image-generator emulation · Case study
- OpenDMCUFirm: a reimplemented Wii U DMCU display firmware · Case study