Preface
Jason Chen over at Gizmodo, 2+ years ago threw down the gauntlet and started the iPhone Hacker Challenge: Make the Nike+ iPhone Work With Nike+ Sport Kit. To my knowledge no one yet has successfully met this challenge until now.
At first I kept watching and hoping Apple/Nike would support the iPhone 3G. With each new firmware update the rumour mill would start and people would say finally Nike+ would be available on the iPhone 3G. Sadly it still isn’t and the rumours are getting quieter and fewer with each passing update.
This is nothing more than a proof of concept – to say that the iPhone 3G has no technical limitations to being able to run Nike+. It might not have the built in hardware like its big sister, the 3GS, but neither does the Nano and it at least gets a receiver. Maybe the battery will drain faster, maybe there are incompatibly issues with other accessories and it is a necessary trade-off, or maybe tethering won’t work, but whatever the reason(s) is, my hope for releasing this proof of concept is to get Apple/Nike to reconsider their decision and support the iPhone 3G. I believe there are a group of consumers that would gladly spend money on the Nike+ Sport Kit if they are able to use it with their iPhone 3G.
Warning
I take no responsibility for the method described below. I am simply describing the method I used and what I found to have worked. This may or may not brick or otherwise damage your iPhone since this is something your iPhone wasn’t intended to do. And remember: this is the internet.
Other accessories, such as bluetooth handsfree headsets may or may not work. I don’t have any so I’m unable to confirm or deny.
If you still brave and willing to continue then please: Backup, Backup, Backup.
Requirements
Software
A method to decrypt the firmware - vfdecrypt
A method to extract the files from the firmware: I used Acute System’s Transmac
A method to copy files to your iPhone and ssh: I used winscp and putty
A method to edit plist files: I used plist Editor for Windows
ldid from Cydia for pseudo-signing – see here
iTunes v9 (I am running 9.0.2.25)
Additional Files
Firmware for the iPod Touch 2G v3.0 (7A341) – here
The firmware key
Patched iapd file – here or here
Hardware
A jailbroken iPhone 3G running v3.1.2 firmware (7D11) with SSH access
And obviously the all important Nike+ sensor and receiver kit
Setting up the Nike+ Application on the iPhone
The first thing we will need to do is get the Nike+ app working on the iPhone. Simply, we will extract the necessary files from the firmware and copy them over and make sure everything is working. If you have an iPod Touch running v3.0 (7A341) firmware then you can copy the files from it rather than extracting them from the firmware.
A special thanks to JorgiBob for pointing me in this direction
Extracting the required files
- Rename iPod2,1_3.0_7A341_Restore.ipsw to iPod2,1_3.0_7A341_Restore.ipsw.zip and extract it’s contents
- Decrypt the root file system, ie:
C:\Temp\Nike+>vfdecrypt.exe -i "iPod2,1_3.0_7A341_Restore\018-5300-002.dmg" -k 415225778E1BEBF8EEFF2A9050B04CE429DE9680E4ACBA50820A3FA453897BC4A4B307E2 -o "iPod2,1_3.0_7A341_Restore\decrypted 018-5300-002.dmg"
- Open the decrypted root file system with Transmac
- Extract the following folders and file
/Applications/Nike.app
/System/Library/PreferenceBundles/VictoriaSettings.bundle
/System/Library/PrivateFramworks/SportsTrainer.framework
/System/Library/PrivateFrameworks/IAP.framework/Voices
/System/Library/PrivateFrameworks/IAP.framework/Templates
/System/Library/PrivateFrameworks/IAP.framework/IAP(just the file)
/System/Library/SpringBoardPlugins/NikeLockScreen.bundle
Copying the files to the iPhone
Copy all the folders and file to your iPhone using winscp to the same location you found them in the root filesystem of the decrypted firmware.
Open a ssh termial to your iPhone and login as root. You will need to reset the permissions, psuedo-sign each application or library and correct the CodeResources link.
The Nike application
iPhone:~ root#: cd /Applications/Nike.app
iPhone:/Applications/Nike.app root#: rm –f CodeResources
iPhone:/Applications/Nike.app root#: ln –s _CodeSignature/CodeResource CodeResources
iPhone:/Applications/Nike.app root#: chmod 755 Nike
iPhone:/Applications/Nike.app root#: ldid –S Nike
The VictoriaSettings library
iPhone:/Applications/Nike.app root#: cd /System/Library/PreferenceBundles/VictoriaSettings.bundle
iPhone:/System/Library/PreferenceBundles/VictoriaSettings.bundle root#: chmod 755 VictoriaSettings
iPhone:/System/Library/PreferenceBundles/VictoriaSettings.bundle root#: ldid –S VictoriaSettings
The SportsTrainer library
iPhone:/System/Library/PreferenceBundles/VictoriaSettings.bundle root#: cd /System/Library/PrivateFrameworks/SportsTrainer.framework
iPhone:/System/Library/PrivateFrameworks/SportsTrainer.framework root#: chmod 755 SportsTrainer
iPhone:/System/Library/PrivateFrameworks/SportsTrainer.framework root#: ldid –S SportsTrainer
The IAP library
iPhone:/System/Library/PreferenceBundles/VictoriaSettings.bundle root#: cd /System/Library/PrivateFrameworks/IAP.framework
iPhone:/System/Library/PrivateFrameworks/IAP.framework root#: chmod 755 IAP
iPhone:/System/Library/PrivateFrameworks/IAP.framework root#: ldid –S IAP
The NikeLockScreen library
iPhone:/System/Library/PrivateFrameworks/IAP.framework root#: cd /System/Library/SpringBoardPlugins/NikeLockScreen.bundle
iPhone:/System/Library/SpringBoardPlugins/NikeLockScreen.bundle root#: chmod 755 NikeLockScreen
iPhone:/System/Library/SpringBoardPlugins/NikeLockScreen.bundle root#: ldid -S NikeLockScreen
Making the iPhone Nike+ aware
Backup the M68AP.plist file
iPhone:/System/Library/PrivateFrameworks/IAP.framewrok root#: cd /System/Library/CoreServices/SpringBoard.app
iPhone:/System/Library/CoreServices/SpringBoard.app root#: cp M68AP.plist M68AP.plist.backup
Copy the M68AP.plist file to your computer, leaving the backup alone
Open the local M68AP.plist with the plist Editor and add the following key:
and close to the bottom of the same file, add the following key:
Copy the modified M68AP.plist back to your iPhone, overwriting the original file.
Respring or reboot your iPhone
Sanity Check Point
Once your iPhone has resprung or rebooted, the Nike+ iPod application should be available.
You should be able to open the Nike+ iPod and see the following:
If the application closes immediately then you have missed a step above.
Go into Settings and at the bottom, you will find:
with the following settings if you select Nike + iPod
Again, if the Settings application closes or doesn’t look like the above, you have missed a step above.
The sensor will still not be detected and if you plug in the receiver then you will still simply get “The Nike + iPod reciever is not required for this iPhone because it has the built-in receiver.” Go ahead, try, I’ll wait.
Using the Receiver and Sensor with the iPhone 3G
So far the above hasn’t been anything new. Many people have figured this part out and it was all necessary groundwork. In order to “trick” the iPhone into accepting the receiver, we will need to add a preference key and update the iapd daemon (the application that handles accessories as well as a lot of the lower level Nike+ operations). The iapd service is what prevents the iPhone from using the receiver but allows other devices.
Support A45, you will
Backup the .GlobalPreferences.plist file. Note: this is a hidden file (notice the ‘.’ at the beginning)
iPhone::/System/Library/CoreServices/SpringBoard.app root#: cd /private/var/mobile/Library/Preferences
iPhone:/private/var/mobile/Library/Preferences root#: cp .GlobalPreferences.plist .GlobalPreferences.plist.backup
Copy the .GlobalPreferences.plist file to your computer, leaving the backup alone
Open the local .GlobalPreferences.plist with the plist Editor and add the following key:
Copy the modified .GlobalPreferences.plist file back to your iPhone, overwriting the original file.
iapd
Up until this point we really haven’t changed anything on the iPhone, sure a setting here or there and added files. This change will mean you are changing core system files. If you feel uneasy about doing so, then look away now.
Backup the iapd file
iPhone:/private/var/mobile/Library/Preferences root#: cd /System/Library/PrivateFrameworks/IAP.framework/Support
iPhone:/System/Library/PrivateFrameworks/IAP.framework/Support root#: cp iapd iapd.backup
Copy the modified iapd (linked above) to your iPhone using winscp.
And now we will setup the iapd like we did with the apps & libraries above and copy it over the original iapd file.
iPhone:/System/Library/PrivateFrameworks/IAP.framework/Support root#: chmod 755 iapd.nikeplus
iPhone:/System/Library/PrivateFrameworks/IAP.framework/Support root#: ldid -S iapd.nikeplus
iPhone:/System/Library/PrivateFrameworks/IAP.framework/Support root#: cp iapd.nikeplus iapd
iPhone:/System/Library/PrivateFrameworks/IAP.framework/Support root#: ps aux
iPhone:/System/Library/PrivateFrameworks/IAP.framework/Support root#: kill <pid of iapd>
Deep breath, it is the moment of truth.
Pairing the sensor
Open the Settings app and got the Nike + iPod screen.
Plug in the receiver. There should be no message.
Click on sensor to begin the search.
Squeeze hard on the sensor between your index finger and thumb over the Apple logo and/or shake. That is simulate walking around.
If all goes well, and your sensor should be linked. Once it is linked you then use it with the Nike+ application. If you plug in the receiver after the sensor search has started, simply cancel and start the search again leaving the receiver in.
Nike+ Workouts and Calibration
This is pretty much the same procedure as above. Again if you plug in the receiver after the sensor search started, simply cancel and start the workout/calibration again with the receiver still plugged in. You won’t see the pace or distance change until you have started the workout/calibration.
iTunes
Once the sensor has been linked with the iPhone, it will create the necessary files for iTunes to detect and display the Nike+ tab.
Conclusion
The patch iapd is not perfect but works. So far I have not experienced any negative pact but since this is still new, please leave feedback. I will post again about the method used and hopefully someone with much more ARM assembly knowledge than me can pick it up.
I hopefully have got everything, if I missed a step or something is unclear, I’ll try to be prompt to revise it.
And Apple/Nike: please support Nike+ in the 3.1.3 firmware, please, please, pretty please, with a cherry on top.
Tired of writing, off to run.
Nike + iPhone 3G. Done.
Tags: iPhone Hacking, Nike+
You want to be able to use the kit right? If thats the case. What I did when it first failed on me. I started from the beginning. Delete all files that you added to phone and start from step 1. Making sure you did EVERYTHING correctly.
If you just want to control the music from the Nike Amp+ watch, all you have to do is download the Music Controls from Cydia and you don’t need to have the sensor. Just make sure dongle is attached.
Did this tonight, everything works on my phone great but the Nike+ tab on itunes won’t sho for some reason. going to reinstall and we’ll see what happens. Great tutorial!
After a while iTunes asked me if I wanted nikeplus to sync and the tab appeared! Great tutorial again. Flawless so far! Add me on nikeplus (dboulay89) thx again
I was screwing around with trying to get voice control working on my 3g and things got screwed up really bad with M68AP file and i had to re-jailbreak with redsn0w 0.9.4 but i jb-ed 3.1.2 and somehow it says i’m running 3.1.3 but nike still works /
I pretty much had this last year. I took the necessary files from the iPod Touch second gen firmware and only needed the receiver/sensor. I tried this on 2.x and it worked. Good to see that someone finally tested it and updated it for 3.x.
Hello,
I Did it 3 times, no error messages but no icon on my 3G (3.1.3 – 7E18). Any Idea?
Thank yo so much for this great job.
Happy to say to you that I’m a stupid guy. I’m respecting your picture and no activate Nike+ipod. Great Job!
Why go through the hassle to hook up with nike+? Nike has a great community, but you get better accuracy, mapping, etc. with apps like (shameless plug) http://roadbud.com
[...] and a Nike+ today and just realized I can’t use the Nike+ on my iPhone 3G. Need to do some haxxing this weekend. After that you’ll see me hitting the streets in these [...]
Great write up, very easy to follow. I got this working on my iPhone 2G 3.0.1. Thanks heaps.
awesome tutorial! I can’t understand why Apple decided to exclude the 3G from this feature.
i’m also having problem with my Iphone 3G (3.1.3). Cant seem to get the icon. Thanks for this nice write up!
This is awesome
I bought Nike+ Kit long time ago and when I figured out it won’t work with my iPhone 2G i was really frustrated …
Works great now
iPhone 2G (3.1.3)
I had problem with Nike+ icon appearing, but the solution was:
1) Hide Nike+ icon via SBsettings
2) Respring
3) Show Nike+ icon via SBsettings
4) Respirng
And icon was there
Brilliant! Thank you so much!
Wow, it really works, amazing!!!! I have been waiting for this for a long time, the guide looks a little bit complicated for a noob like me but at the end in a couple of hours I was able to make it work on my mac, thanks!!!
Voices don’t work, neither does selecting a custo playlist to workout. Any ideas? Help!!!
For the voices, try rebooting the iPhone. I would find Nike+ would drop them every once in a while. Judging from the forums on nikeplus.com this seems to happen with the iPod touch as well.
The only work around I have found for the playlists is to select it in iPod so it starts playing, pause it and close the iPod app and then start Nike+ and select Now Playing.
Hope that helps
Anyone tried this with 4.0 golden master? If yes, could you please send notification to my mail found on http://r-s.lv. Thanks!
[...] 3g z nike+ tylko apple wie co dla nas dobre i nie udostepnilo tej funkcji. szczegoly w linku: Weekend Project: Nike+ and iPhone 3G – Part 1 | myMojo osobiscie jeszcze nie probowalem ale widze ze ma to szanse dzialac…trzeba troche sie pobawic [...]
Hi, i have problems finding the ldid on the cydia store can anyone help me with that?
@Acid Cydia->Manage->Settings->Developer
Could you tell me if it’s gonna work with IOS4 firmware? If you update to the new firmware, will the NikePlus application be removed? If so, is it possible to reinstall it with IOS4 firmware?
Man is everything working fine, the sensor Nike.com tracking with the iTunes synching well, but i CANT see the Nike + on the Settings Tab, tried couple times and every time i respring the icon disapear and i have to go to SBSettings to get the icon back.
Guys i have a problem at the last passage: i am at iPhone:/System/Library/PrivateFrameworks/IAP.framework/Support root#:
when i tipe “kill ” i receive this message: “-sh: syntax error near unexpeted token ‘newline’. What i must to do now? It’s the last passage!
edit: when i type “kill “
i am a newbie, couldn’t figure how to use ldid, every time i try in WInSCP it’s giving me some command line error. i also have a mac here but terminal couldn’t do it either. i tried on winxp sp3 with winscp on an iPhone 3G (3.1.2 firmware)
@nova: Frist of all sorry for my english but i’m italian and I can’t speak english very well… you can’t use ldid from a pc or a mac by ssh…you must use mobile terminal on your iphone. You can download “MobileTerminal” and “Link Identity Editor” (that contain ldid command) from cydia…
Just start cydia on your Iphone, switch to developer mode, then under sections, development you’ll find Link Identity Editor, just download that
nike plus+iphone 3g+ios4 = impossible?
I hope it’s possible!!! I’m still waiting for anyone to try it
It is for sure possible, but Apple guys have changed the Nike.app as well as frameworks, so we need first to study them before new tutorial
Using the files from Ipod2G Firmware4.0 instead of 3.0 won’t be enough?
I try this way but is not enough…frameworks are different and i can’t find exec files…
Ho letto che sei italiano come me
Per caso hai la chiave per decifrare il firmware 4.0 (versione ufficiale) dell’ipod2G con vdecrypt? Cosi’ almeno faccio qualche tentativo anche io…
Ok guys, whenever who’ll be first to try decrypting 4.0 framework, have a good luck with that! I’ll be watching this thread as often as possible.
Scusami ma ieri ero fuori sede cmq la key per il decrypt del touch 2g è: 8811ded8264fff60660128f0c29f3d7e25f1293bc6290f62c2ce28480df778b2ff1426e9
Buona Fortuna ma ho dato già un’ occhiata io e la apple ha cambiato di molto la struttura e il funzionamento dei programmi nativi…sicuramente per il “Multitasking”… cmq una volta individuati i exec o il exec perchè credo sia stato unificato non credo che ci siano problemi…
Cmq ora la Apple ha fatto tre framework differenti:
uno per gli allenamenti, che già c’era, uno per le voci e uno per gli esercizi????? e in più ha rimosso gli exec file dalle cartelle dei framework per metterli non si sà dove… però nei file .plist rimangono le stringhe con i collegamenti agli exec quindi da qualche parte devono pur stare…
Confused, has someone tried this on iOS 4.0? I was ready to go through this process again, but are the frameworks involved definitely confirmed to be different/incompatible with what we can do with this tutorial?
What i did so far:
copied:
\Applications\Nike.app
\system\Library\PreferenceBundles\VictoriaSettings.bundle
\system\Library\PrivateFrameworks\SportsTrainer.framework
\system\Library\PrivateFrameworks\SportsVoices.framework
\system\Library\PrivateFrameworks\SportsWorkout.framework
\system\Library\SpringBoardPlugins\NikeLockScreen.bundle
There is no longer M68AP.plist in \system\Library\CoreServices\SpringBoard.app , but there is N82AP.plist and after changing it Nike+iPod appeared in settings but returns an error that it can not load preference bundle.
So u am stuck at this point, if someone have more creative ideas i will be gald to hear them.
One more thing, there are no executables in the frameworks and bundles but there are aditional plusts inside. Probably Apple changed a lot in this new firmware.
Xplode I did the same as you before, but I am stuck at that point too, I tried psuedo sign for the bundles but I cant load the preferencesbundle. Accessabilitybundle or somthing should be the cause…
I mean: I can’t load preferencesbundle on my iPhone.
lets home mymojo owner watch us and make it for this weekend project
For now I use runkeeper pro, but I don’t trust the GPS tracking.
Nike+ is better, thats my opinion.
And yes, lets hope that they will make a new tutorial for the 4.0 software.
Don’t forget about the iPhone 3G users! =)
One more thing which i will try these days is to follow exact same tutorial, with exact same files, but insead in m68 plist to add nike-ipod in n82 plist, i theory the software which was writen for OS3 should work on OS4 without multitasking of course
I tried the same thing. I couldn’t get anything to happen. No icon, nothing. I noticed an N88 plist file and noticed that it had the nike stuff already in there. I tried to modify it and renamed a copy N82 then copied it to my phone. this didn’t work at all. In fact it somehow got rid of the phone application on my phone and I had to restore my phone to get it back. Wouldn’t the files from an iPod running iOS 4 work for a 3G using this method?
guys with iPhone 2G or with iPod Touch 1G:
how does it work for you anyway? for me the sensor is not detected regardless how i try it. with an iPhone 3G it is detected almost instantly.
i followed the guide correctly, checked everything again, but it is not working for me on 3.1.3 – any suggestions..? :/
(i got the file from an iPod Touch 2G 4.0, so i was trying to check this with an iPhone 3G 4.0, but under 4.0 everything is different now, like there are 3 different SportsTrainer releated frameworks, the PreferenceBundle does not work, etc.)
Do you think this would work on iPhone 3G, Modem Firmware 05.13.04, Version 4.0 (8A293)?
@Jadeye – I’m using an iPhone 2G with 3.1.2
I’ve gotten the program to run and the settings to show, but when I plug in the dongle, I get the accessory not supported error.
Do you even get that far?
Luke & Martin above got it working on their 2Gs, so it should be possible.
Any suggestions from anyone?
Ken: on 4.0 everything is different. I have tried it with the files from 3.1.3, did not work. they use different frameworks, but I bet someone will solve it soon.
Conan: if you got that error, the patching of the iapd file was not successful – you did not overwrote it, or did not set the correct rights, did not restart the device or so. try to get through that part of the tutorial again. for me it does not display any error (so i was correctly patching the iapd), it just does not connect to the sensor. on a 3G it was working okay.
i will try to re-do all the steps again, maybe i did miss something.
Someone had been installed Nike + on iPhone 3G 4.0 IOS?
No, but I’m dying to know if someone succedeed… Note that it doesn’t work with this tutorial: I have an error message when I try to reach the nike+ parameters, and I can’t find the M68ap.plist file in the iOS4.0.
My first guess wouls be to decrypt the OS4.0 firmware for 3GS, and take the files from here first…
Hope to see a solution soon, otherwise I may come back to OS3…
I own a iPhone 3g and i’m interested in Nike+, i was thinking of the sportsband because i think buying an extra Nano would be idiotic. But i do like music so may be this is my solution!
I don’t own a Nike+ kit yet, and i’m a bit worried that it all won’t work when i do buy it..
Btw, my iPhone is prepaid at this moment (my contract just ended and i want to wait a while getting a new one), does this use an internet connection when running?
Thank you all! great work!!! I have a iPhone 3G 3.1.2 and the procedure worked fine: now I have the Nike + iPod app installed and functioning! tomorrow I will buy the sensor + receiver
For iPhone 3G with 3.1.2, I can use Nike+ with sensor and without receiver?
I think it works only with sensor, like ipod touch 2G and 3G.
When I type “kill ” I receive the following message: ” -sh: syntax error near unexpeted token ‘newline’ “.
Anyone got this message? It’s the last step and I wouldn’t buy the sensor if I’m not sure it will work with my iPhone 3G…
@Anonymous: You have to write the PID of the iapd process next to the kill command!
@ALL: I have an iPhone 2G running 3.1.3. I did everthing step-by-step and everything works fine up to the last step where i plug in the sensor. It keeps saying: “Accessory not supported by this iPhone”. Nike+ seems to search for the sender but wont find him. I redid the last step with the patched iapd file a dozen times always with the same result:( anyone who has the same problem? Can someone help me out with this?
Guys, the Sensor works perfectly on my 3G with 3.1.3, now I got me the Remote Control Watch by Nike and it wanted to confirm that the remote works as well. You just need to reboot the device.
Guys, the Sensor works perfectly on my 3G with 3.1.3, now I got me the Remote Control Watch by Nike and it wanted to confirm that the remote works as well. You just need to reboot the device.
And honestly I would sacrifice iOS 4 to keep my Hack alive.
@Levico: thank you (I wrote “kill pid of iapd”… ahaha)!
However, after “ps aux”, I don’t see a process named “iapd”. Perhaps, is it named “accessoryd” ( /usr/sbin/accessoryd )?
Are you doing this with your iphone or with your terminal over SSH? I would suggest that you establish a ssh connection between your pc/mac and your iphone and enter the commands with your computer! WinSCP –> Windows, Terminal OSX!
Then you can see the whole line of text! Because on the iphone it gets cut off 