apple-data 1.0.628 → 1.0.648

data/share/img4.yaml

@@ -12,23 +12,94 @@ metadata:
   - core
   - types
   - cryptex_properties
+property_collections:
+- lpol_properties
+- cryptex_objects
+- cryptex_properties
+- manifest_properties
+- img4_tags
+- objects
+- der
+- core
+unmapped:
+- ApRelaxedImageVerification
+- "@BCert"
+- "@Managed"
+- "@AlternateSU"
+- Ap,UseGlobalSigning
+- AllowNeRDBoot
+- NeRDEpoch
+- PermitNeRDPivot
+- Ap,OSEnvironment
+- Ap,CurrentOSSecurityVersion
+- Ap,MinimumOSSecurityVersion
+- Ap,EnableGroundhog
+- Ap,SoftwareUpdateDeviceID
+- ApCertificateEpoch
+- ApLeafCertStatus
+- BuildString
+- Name
+- UID_MODE
+- "@Cryptex1,Ticket"
+- Cryptex1,Ticket
+- Cryptex1,ChipID
+- Cryptex1,ProductClass
+- Cryptex1,UseProductClass
+- Cryptex1,Nonce
+- Cryptex1,NonceDomain
+- Cryptex1,ProductionMode
+- Cryptex1,UseGlobalSigning
+- Cryptex1,Version
+- Cryptex1,FakeRoot
+- PearlCertificationRootPub
+- x86,ProductionMode
+- x86,SecurityMode
+- x86,Nonce
+- x86,UseGlobalSigning
+- x86,AllowMixAndMatch
+- x86,OSLongVersion
+- x86,Ticket
+- "@x86,Ticket"
+- "@Locality"
+- "@BBTicket"
+- BbSNUM
+- BbGoldCertId
+- BbSkeyId
+- BbNonce
+- BpApBindingDigest
+- BbServerNonce
+- BbVendorData
+- BbFieldDiagsEnable
+- "@EUICCTicket"
+- EuiccMainTicket
+- EuiccGoldTicket
+- EUICCSignedProfileMain
+- EUICCSignedProfileGold
+- BbAntennaType
+- BbBehavior
 core:
   IM4M:
+    title: IMG4 Manifest
     description: Image4 Manifest Object (No payload, only manifest).  IM4M, verion,
   IM4P:
+    title: IMG4 Payload
     description: Image4 Payload (No Manifest, Only Data).  Contains IM4P, type, description,
       data and optional keybags
   IM4R:
     description: Image4 Recovery
   IMG4:
+    title: IMG4 File
     description: Wrapper for all Image4 Objects (Payload, Manifest, Recovery)
   MANB:
+    title: Manifest Body
     description: Manifest Body
   MANP:
+    title: Manifest Proeprties
     description: Manifest Properties
   OBJP:
     description: Object Properties - Values that may be assigned per "object" (firmwares)
       that contain a `DGST`
+    name: ObjectPayloadPropertyDigest
     type: sequence
 types:
   digest-object:
@@ -38,7 +109,9 @@ types:
       additional properties per object, some of which are standard and others that
       are object specific.
     common_properties:
-      DGST: The cryptographic digest of the object
+      DGST:
+        description: The cryptographic digest of the object
+        name: Digest
       EKEY:
         description: Effective Key Access - The effective access to teh SEP, used
           to protect data during demotion.  Effective chip promoted
@@ -76,8 +149,6 @@ types:
           and validate on read.
       firmware:
         object_properties:
-          oppd:
-            description: Unknown, used by `stg1`/`sepi` - sha384 hash sized
           tbms:
             description: Trusted Boot Measurement (Signature?)
             notes: Likely encrypted by the SEP and opaque to the AP
@@ -94,6 +165,7 @@ types:
       rvok:
         description: Trust object revocation list
       inst:
+        title: Key Instance
         description: The key or file to install
       secb:
         description: Sets a security value such as `trst` or the FDR signing trust
@@ -101,6 +173,24 @@ types:
           with a `secb` object with a `trst` object), `rssl` (Factory SSL root CA),
           `rvok` (Revocation list) and `trpk` (trusted public keys?)
 lpol_properties:
+  AMNM:
+  BNCH:
+  BORD:
+  CEPO:
+  CHIP:
+  CPRO:
+  CSEC:
+  DGST:
+    title: Hash Digest
+  DPRO:
+  DSEC:
+  ECID:
+  EPRO:
+  ESEC:
+  LCST:
+  LNCH:
+  RNCH:
+  SDOM:
   auxi:
     title: Auxiliary Image4 Manifest Hash (`auxi`)
     description: After the system verifies that the UAKL hash matches what’s found
@@ -151,6 +241,11 @@ lpol_properties:
     access:
       write:
       - macOS
+  bat0:
+  bat1:
+  batf:
+  chg0:
+  chg1:
   coih:
     title: CustomOS Image4 Manifest Hash (coih)
     description: The `coih` is an SHA384 hash of CustomOS Image4 manifest. The payload
@@ -162,10 +257,14 @@ lpol_properties:
     access:
       write:
       - 1TR
+  diag:
+  dtre:
   gaid:
     description: Gaia Authentication ID (Apple Internal)
+  glyc:
+  glyp:
   hrlp:
-    title: Has Secure Enclave Signed recoveryOS Local Policy (hrlp)
+    title: Has recoveryOS Local Policy
     description: The `hrlp` indicates whether or not the `prot` value is the measurement
       of a Secure Enclave–signed recoveryOS LocalPolicy. If not, then the recoveryOS
       LocalPolicy is signed by the Apple online signing server, which signs things
@@ -176,8 +275,11 @@ lpol_properties:
       - 1TR
       - recoveryOS
       - macOS
+  ibot:
+  illb:
+  krnl:
   kuid:
-    title: Key encryption key (KEK) Group UUID (kuid)
+    title: Key Encryption Key
     description: The kuid indicates the volume that was booted. The key encryption
       key has typically been used for Data Protection. For each LocalPolicy, it’s
       used to protect the LocalPolicy signing key. The kuid is set by the user implicitly
@@ -190,11 +292,13 @@ lpol_properties:
       - recoveryOS
       - macOS
   lobo:
+    title: Local Boot Object
     description: Local Boot Object.  Indicates that the object is to be used as the
       target of a local boot only and not provided by the server for remote / DFU
       boots.
+  logo:
   lpnh:
-    title: LocalPolicy Nonce Hash (lpnh)
+    title: LocalPolicy Nonce Hash
     description: The lpnh is used for anti-replay of the LocalPolicy. This is an SHA384
       hash of the LocalPolicy Nonce (LPN), which is stored in the Secure Storage Component
       and accessible using the Secure Enclave Boot ROM or Secure Enclave. The raw
@@ -217,7 +321,7 @@ lpol_properties:
       - recoveryOS
       - macOS
   nish:
-    title: Next Stage Image4 Manifest Hash (nsih)
+    title: Next Stage Image4 Manifest Hash
     description: The nsih field represents an SHA384 hash of the Image4 manifest data
       structure that describes the booted macOS. The macOS Image4 manifest contains
       measurements for all the boot objects—such as iBoot, the static trust cache,
@@ -228,6 +332,7 @@ lpol_properties:
       intention of what operating system the user has created a LocalPolicy for. Users
       change the nsih value implicitly when they perform a software update.
     type: binary
+    name: Ap,NextStageCryptex1IM4MHash
     subtype: sha2-384
     context:
       lpol:
@@ -236,8 +341,9 @@ lpol_properties:
       - 1TR
       - recoveryOS
       - macOS
+  nsrv:
   prot:
-    title: Paired recoveryOS Trusted Boot Policy Measurement (prot)
+    title: Paired recoveryOS Trusted Boot Policy Measurement
     description: A paired recoveryOS Trusted Boot Policy Measurement (TBPM) is a special
       iterative SHA384 hash calculation over the Image4 manifest of a LocalPolicy,
       excluding nonces, in order to give a consistent measurement over time (because
@@ -251,6 +357,7 @@ lpol_properties:
       - 1TR
       - recoveryOS
       - macOS
+  recm:
   rolp:
     description: recoveryOS local policy
     type: boolean
@@ -285,6 +392,8 @@ lpol_properties:
       - 1TR
       - recoveryOS
       - macOS
+  rsep:
+  sepi:
   sip0:
     title: System Integrity Protection (SIP) 0 Status - Overall
     description: The sip0 holds the existing System Integrity Protection (SIP) policy
@@ -324,12 +433,17 @@ lpol_properties:
     description: Secure Multi-Boot 3 - DEP-allowed MDM Control
   smb5:
     description: Unknown - but known to exist in Factory signing
+  snon:
   snuf:
-    description: Software Nonce For Update Freshness
+    description: Staged Nonce For Update Firmware
   spih:
-    description: Cryptex1 Image4 Hash
+    title: Supplimental Image Hash
+    description: Cryptex1 Image4 Hash (supplimental image hash)
+  tbmr:
+  tbms:
+    title: Trusted Boot Measurement
   vuid:
-    title: APFS volume group UUID (vuid)
+    title: Volume Group ID
     description: The vuid indicates the volume group the kernel should use as root.
       This field is primarily informational and isn’t used for security constraints.
       This vuid is set by the user implicitly when creating a new operating system
@@ -341,7 +455,12 @@ lpol_properties:
     - recoveryOS
     - macOS
 cryptex_properties:
+  UDID:
+    title: Universal Device Identifier
+    name: Cryptex1,UDID
+    description: universal device identifier
   augs:
+    title: Augment System
     description: Auxiliary System Image Included in APTicket CA extensions, as well
       as factory manifests.  All cryptex manifests, and APTickets other then the root
       APTicket (the one that is used directly from NOR) have this set to 1, indicating
@@ -354,15 +473,17 @@ cryptex_properties:
     description: User Authorized Kext List Hash
     context:
   clas:
+    title: SEP Extension Command ID
     description: Class for Key / Object - Found in FDR objects
     examples:
     roots:
     - ExtraContent
   cnch:
+    title: Cryptex Nonce Hash
     roots:
     - ExtraContent
   fchp:
-    description: Family of the CHIP - Cryptex1,ChipID - Mask
+    description: Chip Family Mask
     roots:
     - ExtraContent
   ndom:
@@ -371,14 +492,19 @@ cryptex_properties:
     - ExtraContent
     - ExtraContent
   pave:
+    title: Pre-Authorized Version Extension
     description: Pre-authorization Version (XNU) The version of a pre-authorized Cryptex.
     type: string
+    name: Cryptex1,PreauthorizationVersion
     roots:
     - ExtraContent
   snuf:
+    title: Software Nonce for Update Firmware
     description: SoftwareNonceForUpdateFreshness
   styp:
+    title: Cryptex Subtype
     description: Crytpex Subtype
+    name: Cryptex1,SubType
     type: u32
     alias:
     - cryptex subtype
@@ -386,18 +512,19 @@ cryptex_properties:
     - ExtraContent
   type:
     description: Cryptex Type
+    name: Cryptex1,Type
     type: integer
     roots:
     - ExtraContent
-  UDID:
-    description: universal device identifier
   vnum:
+    title: Version Number
     description: Version Number - Update Maximum
     type: string
     roots:
     - ExtraContent
 cryptex_objects:
   caos:
+    title: Cryptex Application Signature
     description:
     type: digest-object
     root:
@@ -409,6 +536,7 @@ cryptex_objects:
     roots:
     - ExtraContents
   csos:
+    title: Cryptex System Signature
     description:
     type: digest-object
     roots:
@@ -420,22 +548,20 @@ cryptex_objects:
     roots:
     - ExtraContent
   trcs:
+    title: Trust Cache System
     description:
     type: digest-object
     roots:
     - ExtraContent
   trca:
+    title: Trust Cache Application
     description:
     type: digest-object
     roots:
     - ExtraContent
 manifest_properties:
-  acdc:
-    description: Apple Connect Developer Certificate
-  acid:
-    description: Apple Connect ID (AppleInternal)
-    type: integer
   AMNM:
+    title: Allow Mix-and-Match
     description: allow mix-n-match When set to true, img4s can be any valid signed
       version, allowing for unusual AP tickets where some components may be from a
       prior version
@@ -444,7 +570,7 @@ manifest_properties:
     description: Bluetooth MAC Address
     manifest: true
   BNCH:
-    title: Boot Nonce Cryptographic Hash
+    title: Board Nonce Cryptographic Hash
     description: Based on the values of com.apple.System.boot-nonces, this is either
       the true APNonce (in the case of SFR or the root APTicket where no scope or
       tweak is applied) or a shadowed BNCH in the case of macOS. If it is a root boot
@@ -479,6 +605,7 @@ manifest_properties:
     type: nonce
     subtype:
   BORD:
+    title: Board Identifier
     description: |-
       The board the chip is attached to.  With iPhones/iPads this is the variation between
       device sizes (occasionally also used for low cost devices like the SE/XR).  This is
@@ -490,6 +617,7 @@ manifest_properties:
     alias:
     - board-id
   CEPO:
+    title: Chip Epoch
     description: |-
       Chip Epoch.  This is a unit of roll-forward time (monotonic) that
       allows for any security issues in the prior epoch to be fixed by a anti-rollback scheme.
@@ -498,6 +626,7 @@ manifest_properties:
     alias:
     - chip-epoch
   CHIP:
+    title: Chip Identifier
     description: Unique identifier for a single Apple designed application processor
       sharing the same GID key
     type: integer
@@ -519,17 +648,70 @@ manifest_properties:
     alias:
     - certificate-security-mode
   ECID:
+    title: Exclusive Chip Identifier
     description: Exclusive chip identifier.  This is burned into an eFuse at time
       of manufacture and unique across all devices sharing the same CHIP
     width: 8
+  LNCH:
+    description: Local Policy Next Cryptographic Hash
+    name: ApLocalNonceHash
+  Mod#:
+  RNCH:
+    description: Remote Nonce Cryptographic Hash
+  RSCH:
+    description: Research mode
+  Regn:
+    description: Region Code
+    example: LL/A
+    type: string
+    manifest: true
+  SDOM:
+    title: Security Domain
+    description: |-
+      Security domain, or which set of certificates govern device security.
+
+      Known values:
+        0x01 - Main Production certificates
+    width: 2
+    alias:
+    - security-domain
+  SECM:
+    description: Security Mode
+  SNON:
+    description: SEP Nonce
+  SrNm:
+    description: Unit Serial Number
+    manifest: true
+  TMac:
+    description: Thunderbolt MAC Address
+    manifest: true
+  UID_MODE:
+    title: UID as GID Key Mode
+    type: boolean
+    request: true
+    description: Used to create keybags for the UID instead of the GID key, such as
+      the use of `sepi` or booted SEP image firmware (as SEP hibernation data is crypted
+      with the devices UID rather then the GID).
+    see:
+    - uidm
+  WMac:
+    description: Wireless MAC Address
+  WSKU:
+    description: Wireless SKU
+  acdc:
+    description: Apple Connect Developer Certificate
+  acid:
+    description: Apple Connect ID (AppleInternal)
+    type: integer
   esdm:
-    description: Extended Security Domain fuses
+    description: Extended Security Domain Mode
     type: integer
     alias:
     - esdm-fuses
   euou:
     description: engineering use-only unit
   faic:
+    title: Factory Authentication Identity Certificate
     description:
     type: integer
     default: 0
@@ -539,15 +721,15 @@ manifest_properties:
     description: Internal Use Only Software
   iuou:
     description: Internal Use Only Unit
-  LNCH:
-    description: Local Policy Next Cryptographic Hash
+    name: Ap,InternalUseOnlyUnit
   love:
-    title: Long Operating System Version (love)
+    title: Long Operating System Version
     description: The love indicates the OS version that the LocalPolicy is created
       for. The version is obtained from the next state manifest during LocalPolicy
       creation and is used to enforce recoveryOS pairing restrictions.
     type: string
     example: 21.3.66.0.0,0
+    name: Ap,OSLongVersion
     access:
       write:
       - 1TR
@@ -557,16 +739,19 @@ manifest_properties:
     - ManifestKey-DataCenter
   lpol:
     description: Local Policy
+  manx:
   mmap:
     description: Memory Map
-  Mod#:
   nsih:
     description: Next Stage Image4 Hash
   nsph:
     description: Next Stage pre-boot splat manifest hash
+  oppd:
+    title: Owner Password Permission Delegation
   prtp:
     description: Product Type String
     type: string
+    name: Ap,ProductType
     example: iPhone16,2
     roots:
     - ManifestKey-DataCenter
@@ -576,51 +761,36 @@ manifest_properties:
     description: Appears in certificates issues by factory such as `T6031-SDOM1-TssLive-ManifestKey-RevA-Factory`.
       Potentially indicates that the policy is for a recovery boot only.
     type: boolean
-  Regn:
-    description: Region Code
-    example: LL/A
-    type: string
-    manifest: true
   rfcg:
     type: boolean
-  RNCH:
-    description: Remote Nonce Cryptographic Hash
-  RSCH:
-    description: Research mode
   rsch:
     description: research mode
+  rso0:
+    name: Ap,RestoreSecurityOverrides0
+  rso1:
+    name: Ap,RestoreSecurityOverrides1
+  rso2:
+    name: Ap,RestoreSecurityOverrides2
+  rso3:
+    name: Ap,RestoreSecurityOverrides3
   sdkp:
     description: SDK Platform
     type: string
+    name: Ap,SDKPlatform
     roots:
     - ManifestKey-DataCenter
     values:
     - iphoneos
     - macos
-  SDOM:
-    description: |-
-      Security domain, or which set of certificates govern device security.
-
-      Known values:
-        0x01 - Main Production certificates
-    width: 2
-    alias:
-    - security-domain
-  SECM:
-    description: Security Mode
   sei3:
     description: Secure Enclave ID for EL3 Appears to have a value identical to `seid`.
   seid:
     description: Secure Enclave ID - Root Domain
   sika:
-    description: System Identity Key Access
-  SNON:
-    description: SEP Nonce
+    description: System Identity Key Access/Attestation?
+    name: Ap,SikaFuse
   snon:
     description: SEP Nonce
-  SrNm:
-    description: Unit Serial Number
-    manifest: true
   sski:
     description: SHA2 os some kind - sep/system subject key identifier?
     type: binary
@@ -629,42 +799,47 @@ manifest_properties:
   svrn:
     description: Server nonce
   tatp:
-    description: Target Type (board name)
+    description: Target Board Name
+    name: Ap,TargetType
     roots:
     - ManifestKey-DataCenter
-  TMac:
-    description: Thunderbolt MAC Address
-    manifest: true
-  UID_MODE:
-    title: UID as GID Key Mode
-    type: boolean
-    request: true
-    description: Used to create keybags for the UID instead of the GID key, such as
-      the use of `sepi` or booted SEP image firmware (as SEP hibernation data is crypted
-      with the devices UID rather then the GID).
-    see:
-    - uidm
   uidm:
     description: UID Mode (Enabled)
     type: boolean
     roots:
     - ManifestKey-DataCenter
-  WMac:
-    description: Wireless MAC Address
-  WSKU:
-    description: Wireless SKU
 objects:
+  FSC2:
+    title: Factory SysConfig
+  IM4M:
+    title: IMG4 Manifest
+  MANB:
+    title: Manifest Body
+  MANP:
+    title: Manifest Proeprties
+  SPAY:
+    title: SysCfg Payload
+  WCHF:
+    description: Wireless Charging Firmware
   acfw:
     description:
   almo:
     description: Some internal iBootable image.  Unknown purpose
+  ane1:
+    title: Apple Neural Engine (Gen1)
+  ane2:
+    title: Apple Neural Engine (Gen2)
+  ane3:
+    title: Apple Neural Engine (Gen3)
   anef:
     description: Apple Neural Engine Firmware
     type: digest-object
     roots:
     - ManifestKey-DataCenter
   ansf:
-    description: Apple NAND Storage Firmware
+    description: NAND Storage Firmware
+  aop2:
+    title: Always-On Processor (Gen2)
   aopf:
     description: Always on processor firmware
     type: digest-object
@@ -677,6 +852,7 @@ objects:
   auxk:
     description: Auxiliary Kernel Cache
   avef:
+    title: AV Encryption (DRM) Firmware
     description: AV Encryption (DRM) Firmware
     type: digest-object
     roots:
@@ -712,18 +888,21 @@ objects:
   ciof:
     description: TypeC IO Firmware
   csys:
-    description: Install / Restore SSV Root Hash
+    description: Cannonical SSV System
     type: digest-object
     subtype: ssv-root-hash
   dcp2:
+    title: DisplayPort Controller Firmware 2
   dcpf:
+    title: DisplayPort Controller Firmware
   dtre:
+    title: Device Tree
     description: device tree
     type: digest-object
     subtype: device-tree
     firmware_name: DeviceTree
   dtrs:
-    description: device tree for recovery
+    description: Device Tree for Recovery
     type: digest-object
     subtype: device-tree
     recovery: true
@@ -731,6 +910,10 @@ objects:
     description: Display Vendor Data
   esca:
     description: Effective Software CA
+  excl:
+    title: exclaveOS
+  fdrd:
+    title: Factory Diagnostic Ramdisk
   fsca:
     description: Factory Software CA
   ftab:
@@ -742,16 +925,17 @@ objects:
       files are fully ready to run blobs often including RTKit OS based memory images.
     ghost_object: true
   ftap:
-    description: Factory Trust/FIPS Test? - Application Processor
+    description: Factory Trust APNonce
     type: hash
     ghost_object: true
   ftsp:
-    description: Factory Trust/FIPS Test? - SEP
+    description: Factory Trust SEPNonce
     type: hash
     ghost_object: true
   gfxf:
     description: Graphics Firmware
   glyP:
+    title: Glyphs
   ibd1:
     description: iBoot Data Stage 1
   ibdt:
@@ -772,11 +956,12 @@ objects:
     firmware_name: LLB
     symbol:
   ipdf:
+    title: Input Device
     description:
   ispf:
     description: Image Signal Processor Firmware
   isys:
-    description: Install System SSV Root Hash
+    description: Integrity of System Volume
   krnl:
     description: Kernel
     firmware_name: KernelCache
@@ -787,12 +972,13 @@ objects:
     firmware_name: AppleLogo
     firmware: true
   lpol:
-    description: Local Policy Payload
+    description: Local Policy
   magg:
     description: Maggie Firmware
   mefi:
     description: MacEFI (T2 firmware for Intel chip)
   msys:
+    title: System Volume Canonical Metadata
     description: System Volume Canonical Metadata Contains a Merkle Tree of the System
       Volume.  The Merkle-Tree is used to verify Signed System Volume, in a similar
       way to a Git repository, where every file is included in the tree of the folder
@@ -803,15 +989,18 @@ objects:
   mtfw:
     description: MultiTouch Firmware
   mtpf:
+    title: Multi-Thread Power Firmware
   nefw:
   pdmg:
     description: Personalized Disk Image
+  pmcf:
+    title: Power Management (PMC)
   pmpf:
-    description: Power Management Processor Firmware
+    description: Power Management (PMP)
     type: digest-object
     subtype:
   rans:
-    description: Restore Apple NAND Storage Firmware
+    description: Restore NAND Storage Firmware
     type: digest-object
     subtype: firmware
     firmware: apple-nand-storage
@@ -819,58 +1008,75 @@ objects:
   rcio:
     description: Restore TypeC IO
     restore: true
+  rdc2:
+    title: Recovery DisplayPort Controller
   rdcp:
     description: Recovery DCP Firmware
     restore: true
   rdsk:
-    description: Restore Disk Image / ramdisk
+    description: Restore Ramdisk
     firmware_name: RestoreRamDisk
   rdtr:
+    title: Restore Device Tree
     description:
       firmware_name: RestoreDeviceTree
   recm:
-    description: Recovery/Refurbish Mode
+    description: Recovery Mode
     firmware_name: RecoveryMode
   rfta:
-    description: Recovery/Refurbish Factory Trust AP
+    description: Recovery Factory Trust APNonce
   rfts:
-    description: Recovery/Refurbish Factory Trust SEP
+    description: Recovery Factory Trust SEPNonce
   rkrn:
     description: Restore Kernel
     restore: true
     firmware_name: RestoreKernelCache
   rlg1:
+    title: Restore Logo 1
   rlg2:
+    title: Restore Logo 2
   rlgo:
     description: Restore Logo
     restore: true
     firmware_name: RestoreLogo
   rosi:
+    title: recoveryOS Image
     description:
   rsep:
+    title: Restore SEP Image
     description: Restore SEP Image, paired with oppd/tbms
     type: string
     firmware_name: RestoreSEP
     encoding: sha2-384
+  rssl:
+    title: Recovery SSL
   rtmu:
     description: Restore TMU for AP
     type: digest-object
     firmware: true
     recovery: true
   rtsc:
-    description: Recovery
+    description: Recovery Trust Cache
+  rvok:
+    title: Revocation List
   scef:
     description: SEP Firmware (Boot Firmware without RAM Image)
+  sePk:
+    title: Secure Element Public Key
+  secb:
+    title: Security Body
   sepi:
+    title: Secure Enclave Processor Image
     description: SEP Image (Booted RAM Image / Hibernation Data)
     type: string
     encoding: sha2-384
     firmware_name: SEP
     metadata:
-      oppd: Original Processed Parameter Data
       tbms: Trusted Boot Measurement Strings
   siof:
     description: Smart IO Firmware
+  srvn:
+    title: Server Nonce
   tmuf:
     description: Trusted MultiUpdater Firmware
   trbb:
@@ -882,47 +1088,113 @@ objects:
         chip: 65286
         board: 240
         security_domain: 1
+  trpk:
+    title: Trusted Public Keys
   trst:
     description: Trust Object
     type: digest-object
     subtype: trust-object
+  trxm:
+    title: Trusted Execution Monitor
   tsys:
     description: Test System Volume
-  WCHF:
-    description: Wireless Charging Firmware
   wchf:
     description: Wireless Charging Framework
   xbtc:
     description: x86 Boot Trust Cache
+  xhcf:
+    title: USB xHCI Firmware
   xsys:
     description: x86 System Root Hash
 img4_tags:
+  ADCL:
+    description: Apple Display Calibration
+  BCAL:
+    title: Bluetooth Calibration
+  BLDS:
+    description: Boot LocalPolicy Digest String?
+  BNCN:
+    title: Board Nonce
+  BTBF:
+    title: Bluetooth Taurus Calibration Data
+  CBAT:
+    title: Charger Input Limit Calibration
+  CLHS:
+    description: Chained LocalPolicy Hash String
+  Coor:
+    title: Country of Origin
+  DPCl:
+    title: Primary Calibration Matrix
+  DPRO:
+    title: Demote Production
+    description: Demote from Production Request Value is used by TSS sever to issue
+      EPRO values, or effective AP production state.
+  DSEC:
+    title: Demote Security
+    description: Demote from Secure Request Value is used by TSS server to issue ESEC
+      values, or effective AP Security Mode should the requester be authorized.  These
+      requests are not available to consumers, only to Apple Internal.
+  DTCl:
+    title: Display Temperature Calibration
+  EKEY:
+    title: Effective Key Type
+  EPRO:
+    title: Effective Promotion Value
+  ESEC:
+    title: Effective Security
+  GLCl:
+    title: Gamma Tables Calibration
+  GYTT:
+    title: Gyroscope Temperature Calibration
+  MLB#:
+    title: Main Logic Board Serial Number
+  MdlC:
+    title: Model Configuration
+  PAYP:
+    description:
+  PRTT:
+    title: Pressure Temperature Compensation Table
+  PxCL:
+    title: Proximity Calibration Data
+  RMd#:
+    title: Regional Model Number
+  SPTM:
+    description: Secure Page Table Monitor
+  SpTS:
+    title: Speaker Thiele-Small Parameters
+  SwBh:
+    title: Software Behaviour (GreenTea)
+  WCAL:
+    title: Wireless Calibration
   ache:
     description:
   acib:
     description:
   aciw:
     description:
-  ADCL:
-    description: Apple Display Calibration
+  adba:
   ader:
     description:
   agfi:
     description:
+  anid:
   anrd:
     description: Apple Notarized Ram Disk
   aofi:
     description: Always on Firmware Image
   apmv:
+    title: OS Version
     description:
+  arms:
+    title: ARM Size
   ater:
     description:
   atkh:
     description:
   auac:
     description:
-  BLDS:
-    description: Boot LocalPolicy Digest String?
+  batf:
+  berb:
   bles:
     description:
   cfel:
@@ -933,12 +1205,14 @@ img4_tags:
     recovery: true
   ckih:
     description: Chained Kernel Image4 Hash
-  CLHS:
-    description: Chained LocalPolicy Hash String
   clid:
     description: Class Identifier
   cmsv:
     description:
+  cphy:
+    title: USB-C Physical Controller
+  dCfg:
+    title: Device Configuration
   dali:
     description:
   data:
@@ -948,13 +1222,6 @@ img4_tags:
     firmware_name: Diags
   disk:
     description:
-  DPRO:
-    description: Demote from Production Request Value is used by TSS sever to issue
-      EPRO values, or effective AP production state.
-  DSEC:
-    description: Demote from Secure Request Value is used by TSS server to issue ESEC
-      values, or effective AP Security Mode should the requester be authorized.  These
-      requests are not available to consumers, only to Apple Internal.
   efib:
     description: EFI Bootloader
   eg0n:
@@ -969,6 +1236,7 @@ img4_tags:
     description: Emulated GID3 Nonce
   eg3t:
     description: Emulated GID3 Type
+  eply:
   esca:
     description: Emulated System Certificate Authority
   fdrs:
@@ -982,11 +1250,18 @@ img4_tags:
   fpgt:
     description:
   ftot:
-    description: Factory Trust/FIPS Test? - Other / Original Trust
+    description: Factory Trust Operations Test
+  fuos:
+  gdmg:
+  gf1f:
+    title: Apple Graphics Stage1 Firmware
+  ginf:
   ging:
     description:
   glyc:
     description: Gyroscope Calibration
+  gtcd:
+  gtgv:
   hash:
     description:
   hclo:
@@ -1002,8 +1277,12 @@ img4_tags:
     description: Hypervisor OS Partition 0 (`dom0`)
   hypr:
     description: Hypervisor Related
+  iCCl:
+    title: iCloud Activation Lock Clear
   ienv:
     description: Install Environment?
+  inst:
+    title: Key Instance
   isor:
     description:
   itst:
@@ -1014,8 +1293,11 @@ img4_tags:
     description:
   lckr:
     description: Locker - Used for Effaceable Storage end Obliteration
+  lcrt:
+    title: Lynx Certificate
   lphp:
     description: Local Policy Hash Protection?
+  lpol:
   ltrs:
     description: Local TrustStore Recovery System?
   manx:
@@ -1032,6 +1314,8 @@ img4_tags:
   msec:
     description: Memory/Modem? Security
   mspr:
+  msrf:
+    title: Machine Specific Register Filter
   name:
     description:
   nrde:
@@ -1044,15 +1328,14 @@ img4_tags:
   ooth:
     description: Other OS Translator (Rosetta) Hash?
   osev:
-    description: Other System (Rosetta) Environment?
+    description: Operating System Environment
+    name: Ap,OSEnvironment
   osrd:
     description: Other System (Rosetta) Ramdisk?
   otes:
     description:
   owns:
     description:
-  PAYP:
-    description:
   pcrp:
     description: Production certificate root
   pert:
@@ -1068,27 +1351,32 @@ img4_tags:
   pndp:
     description:
   prid:
+    title: Private Data
     description: Encrypted Private Key / Private Key Info / Private Recovery Identity?
+  prot:
   ptrp:
   rbmt:
     description: Restore Boot Monitor?
     firmware_name: RBM
   rddg:
     description: Ramdisk for Debugging
-  rso0:
-    description:
-  rso1:
-    description:
-  rso2:
-    description:
-  rso3:
-    description:
+  refk:
+  rspt:
+    title: Restore Secure Page Table Monitor
   rtpf:
     description:
+  rtrx:
+    title: Restore TrustCache Extensions
+  scrt:
+    title: Silicon Certificate (SIK)
   slvn:
     description:
-  SPTM:
-    description: Secure Page Table Monitor
+  sm3f:
+    title: Secure M3 Firmware
+  snid:
+  sptm:
+    title: Secure Page Table Monitor
+  srvn:
   ssca:
     description: SEP Subject Certificate Authority?
   ster:
@@ -1097,6 +1385,10 @@ img4_tags:
     description: Stage 1 Bootloader
     type: string
     encoding: sha2-384
+  strc:
+    title: Apple Firmware Kit??
+  tagt:
+    title: Target Board Name (Processor)
   tbmr:
     description: Trusted Boot Measurement (Recovery/Root?)
   tery:
@@ -1105,10 +1397,16 @@ img4_tags:
     description:
   tics:
     description:
+  tstp:
+    title: Testing Product
+  tz0s:
+    title: TrustZone EL0 Size
   ucer:
     description: User Cert
   ucon:
     description: User Console Connection
+  ucrt:
+    title: User Certificate
   vice:
     description:
   vkdl:
@@ -1117,3 +1415,54 @@ img4_tags:
     description: VMWare?
   xugs:
     description: x64 User System Disk
+der:
+  uikp:
+    description: UIK Public
+  kid:
+    description: Key UUID
+  aonm:
+    description: AON Mask
+  rkm:
+    description: Ref Key Mask / Key Ref MAC (message authentication code)
+  bid:
+    description: Key BID
+  cpo:
+    description: Key ACL Constraint Policy
+  ckon:
+    description: Key ACL Constraint K of N (Shamir Key Split)
+  cup:
+    description: Key ACL Constraint User Passcode
+  kv:
+    description: Key Version
+  kt:
+    description: Key Type
+  pub:
+    description: Public Key
+  id:
+    description: Key ID
+  ag:
+    description: Access Groups
+  p:
+    description: Passcode
+  iter:
+    description: Iterations (Hash Rounds)
+  acmh:
+    description: ACM (Apple Credential Manager) Handle
+  wk:
+    description: Wrapped Key
+  pad:
+    description: Key Padding (Block alignment bytes)
+  tag:
+    description: Key Tag
+  ed:
+    description: External Data
+  pd:
+    description: Protected Data
+  ad:
+    description: Authentication Data
+  d:
+    description: Data
+  bc:
+    description: Keybag Class
+  rk:
+    description: Key Ref Key