iOS Downgrading

Futurerestore Windows:

Steps to follow:

FUTURERESTORING WITH WINDOWS:
0. You will need iTunes 12.4.3 from: Here
1. Download Zadig, Gaster and Futurerestore Windows
2. Get the device in DFU
3. Select device in DFU and replace the driver with LibUSBK
4. Use Gaster
5. Replace the driver to WINUSB again with Zadig
6. Go to device manager and delete the DFU driver
7. Scan for changes and now iTunes should detect your device. If not use Windows Update to get Apple USB driver.
8. Run Futurerestore with --use-pwndfu --set-nonce and all other flags and it will get stuck at red screen or in recovery mode with error to "unable to find device".
9. Again go to device manager and delete iBoot driver.
10. Again scan for new changes.
11. Now re-run Futurerestore without --use-pwndfu and --set-nonce but keep other flags. 
12. The restore will proceed and succeed. 

Futurerestore Linux/MacOS:

Turdus Merula Linux:

Step-by-Step Guide for Linux:

Downgrading iOS without SHSH Blobs

A10/A10X Downgrade Guide:


Installing Dependencies:
Open a new terminal and run:
  • sudo apt update -y
  • sudo apt install libusb-1.0-0-dev libusbmuxd-tools libimobiledevice-utils usbmuxd libimobiledevice6 -y
---
Preparing Files:
1. Extract the Turdus Merula archive.
2. Locate the following binaries in the extracted folder:
  • ra1n_libusb
  • idevicerestore
Now, make them executable by running the following commands in a terminal:
  • sudo chmod +x <drag ra1n_libusb binary here>
  • sudo chmod +x <drag idevicerestore binary here>
Tip: Just drag the binary files into the terminal window after typing the command.
---
Starting/Restarting USBMUXD:
In a new terminal type these commands one by one:
  • sudo systemctl stop usbmuxd
  • sudo usbmuxd -p -f
Leave this terminal minimized.
---
Prepare the Device:
1. Connect your device to your Linux PC.
2. Place the device into DFU mode.
3. In terminal, run:
  • sudo ./ra1n_libusb -ED
Wait for it to complete. This places the device into Pwned DFU mode.
---
Restoring the Device:
1. Once again, place the device into DFU mode.
2. Run the restore command:
  • sudo ./idevicerestore -o <path-to-your.ipsw>
> Replace `<path-to-your.ipsw>` with the path to your IPSW file.  
> You can drag the IPSW file into the terminal to automatically paste its path.
Wait for the restore to finish.
---
Booting the Device:
1. Re-enter DFU mode.
2. Run the boot command:
  • sudo ./ra1n_libusb -t <iBoot.img4> -i <signed-SEP.img4> -p <target-SEP.im4p>
>  These files are generated in the `img4` folder after restore in the same directory.  
> Open the folder and drag the appropriate `.img4` files into the terminal to complete the command easily.
---
Done! Your device should now boot the target iOS version.
-------------------------------------------------------------

A9/A9x Downgrade Guide:

(Install Deps, Restart USBMUXD & "Chmod" files as above)

Step 1: Enter Pwned DFU Mode
  • sudo ./ra1n_libusb -ED
> This will place your device into Pwned DFU mode.

Step 2: Generate the SHC block from your target IPSW
  • sudo ./idevicerestore --get-shcblock [path_to_ipsw]
> Replace [path_to_ipsw] with the full path to your downloaded IPSW file.
> A file will be created inside the "block" folder of Turdus Merula.

Step 3: Re-enter Pwned DFU Mode
  • sudo ./ra1n_libusb -ED
> Your device will be in recovery mode after the SHC block was generated, so you must re-enter Pwned DFU mode again before proceeding.

Step 4: Generate the PTE block using the SHC block
  • sudo ./idevicerestore --get-pteblock --load-shcblock [path_to_shcblock] [path_to_ipsw]
> This creates the PTE block required for restoring without SHSH blobs.
> Replace [path_to_shcblock] with the path to the SHC block file from the "block" folder, and [path_to_ipsw] with the IPSW again.

Step 5: Re-enter Pwned DFU Mode again
  • sudo ./ra1n_libusb -ED
> The device likely will be in recovery mode, you'll need to go back into Pwned DFU mode.

Step 6: Begin the downgrade using the PTE block
  • sudo ./idevicerestore -o --load-pteblock [path_to_pteblock] [path_to_ipsw]
> This initiates the actual restore process.
> Replace [path_to_pteblock] with the path to the PTE block file from "block" folder, and [path_to_ipsw] as before.

> After restoring, your device will go into recovery mode. Enter DFU mode again and run this tethered boot command using the PTE block.
Step 7: Perform the tethered boot after downgrade
  • sudo ./ra1n_libusb -TP [path_to_pteblock]
> PTEblock file should be in the "block" folder of Turdus Merula.
Done! Your device should now boot the target iOS version.

Disclaimer: The content available on this website is for educational and informational purposes only. This website does not provide, advise or cause any loss or damage to the viewer and all of the content is intended for educational purposes only under fair use. I do not intend to promote stealing or to promote illegal activities. Jailbreaking is 100% legal and is covered under the Digital Millennium Copyright Act (DMCA). Under this act, you can Jailbreak your device legally. On this website, nothing illicit is shown and does not promote piracy. In Copyright Disclaimer Under Section 107 of the Copyright Act 1976 allowance is made for "fair use" for purposes such as criticism, comment, news reporting, teaching, scholarship, and research. Fair use is a use permitted by copyright statute that might otherwise be infringing. Non-profit, educational or personal use tips the balance in favor of fair use.

8 comments:

  1. Bro iphone 8 hai os ko downgrade kerna hai ap ker k dey sakty hai keiya ???

    ReplyDelete
  2. Sending RestoreDeviceTree (189768 bytes)...
    Extracting sep-firmware.n69.RELEASE.im4p (Firmware/all_flash/all_flash.n69ap.production/sep-firmware.n69.RELEASE.im4p)...
    Personalizing IMG4 component RestoreSEP...
    Sending RestoreSEP (4655242 bytes)...
    Extracting kernelcache.release.n69 (kernelcache.release.n69)...
    Personalizing IMG4 component RestoreKernelCache...
    Sending RestoreKernelCache (13095717 bytes)...
    Waiting for device to enter restore mode...
    Found pongo mode
    sent sep_racer (758264 bytes)
    sent modload msg
    sent pte (128 bytes)
    sent pte msg
    sent pwn pte msg
    maybe SEPROM pwn fail?
    usb transfer error
    ERROR: Failed to execute pongo shell

    ReplyDelete
  3. Checkpoint started id: 0x642 (unknown)
    Checkpoint started id: 0x647 (unknown)
    Got status message
    Status: Restore Finished
    ReverseProxy[Conn]: (status=6) Disconnected (out: 10579 / in: 5254)
    ReverseProxy[Conn]: (status=2) Terminated
    ReverseProxy[Ctrl]: (status=2) Terminated
    DONE
    [==================================================] 100.0%
    ReverseProxy[Conn]: (status=6) Disconnected (out: 1086 / in: 2113)
    ReverseProxy[Conn]: (status=2) Terminated
    ReverseProxy[Conn]: (status=6) Disconnected (out: 10579 / in: 8403)
    ReverseProxy[Conn]: (status=2) Terminated
    ReverseProxy[Conn]: (status=6) Disconnected (out: 1067 / in: 2113)
    ReverseProxy[Conn]: (status=2) Terminated
    ReverseProxy[Conn]: (status=6) Disconnected (out: 10541 / in: 5179)
    ReverseProxy[Conn]: (status=2) Terminated
    ReverseProxy[Conn]: (status=6) Disconnected (out: 1086 / in: 2113)
    ReverseProxy[Conn]: (status=2) Terminated
    ReverseProxy[Conn]: (status=6) Disconnected (out: 10541 / in: 2028)
    ReverseProxy[Conn]: (status=2) Terminated
    ReverseProxy[Conn]: (status=6) Disconnected (out: 10541 / in: 158678)
    ReverseProxy[Conn]: (status=2) Terminated
    ReverseProxy[Conn]: (status=6) Disconnected (out: 10579 / in: 6218)
    ReverseProxy[Conn]: (status=2) Terminated
    ReverseProxy[Conn]: (status=6) Disconnected (out: 1067 / in: 2113)
    ReverseProxy[Conn]: (status=2) Terminated
    ReverseProxy[Conn]: (status=6) Disconnected (out: 1067 / in: 2113)
    ReverseProxy[Conn]: (status=2) Terminated
    ReverseProxy[Conn]: (status=6) Disconnected (out: 1086 / in: 2113)
    ReverseProxy[Conn]: (status=2) Terminated
    viper@viper-Aspire-F5-572G:~/Downloads/turdus_merula_v1.0.1-1_linux$ sudo ./ra1n_libusb -TP '/home/viper/Downloads/turdus_merula_v1.0.1-1_linux/block/404809399795878-iPhone8,4-11.0-pteblock.bin'
    - libusb! dfu Opened!
    - Found DFU mode device
    - checkm8 reset stage
    - libusb! dfu Opened!
    - Found DFU mode device
    - checkm8 setup stage
    - Entered initial checkm8 state after 1 steps
    - libusb! dfu Opened!
    - Found DFU mode device
    - checkm8 trigger stage
    - Checkmate?


    IT STUCK AT CHECKMATE I HAVE TRIED IOS 9 TO IOS 11 ALL VERSIONS ON MY IPHONE SE IT ALWAYS STUCK AT END

    ReplyDelete
    Replies
    1. Have you managed to solve it somehow, because I have the same issue

      Delete
    2. I always fail of recovery step

      Delete
  4. 12:38:09.053 Personalizing IMG4 component RestoreLogo...
    12:38:09.053 Sending RestoreLogo (20262 bytes)...
    12:38:09.103 ramdisk-size=0x10000000
    12:38:09.103 Extracting 058-74940-063.dmg (058-74940-063.dmg)...
    12:38:09.373 Personalizing IMG4 component RestoreRamDisk...
    12:38:09.399 Sending RestoreRamDisk (41577350 bytes)...
    12:38:14.376 Extracting DeviceTree.d111ap.im4p (Firmware/all_flash/DeviceTree.d111ap.im4p)...
    12:38:14.379 Personalizing IMG4 component RestoreDeviceTree...
    12:38:14.380 Sending RestoreDeviceTree (153103 bytes)...
    12:38:14.411 Extracting sep-firmware.d111.RELEASE.im4p (Firmware/all_flash/sep-firmware.d111.RELEASE.im4p)...
    12:38:14.425 Personalizing IMG4 component RestoreSEP...
    12:38:14.429 Sending RestoreSEP (5168121 bytes)...
    12:38:14.642 Extracting kernelcache.release.iphone9 (kernelcache.release.iphone9)...
    12:38:14.795 Personalizing IMG4 component RestoreKernelCache...
    12:38:14.805 Sending RestoreKernelCache (13872496 bytes)...
    12:38:16.851 Waiting for device to enter restore mode...
    img4 manifest hash: f199a58334d7ead5bad6a13ba3f3b4d9d21700b6d0fde11a9d0bf81eb28ca8c8136479516237fe67d517451d0255f5c6
    12:38:17.254 Device entered yolo (checkra1n) DFU mode.
    12:38:17.282 Sending Pongo data (131590 bytes)...
    12:38:18.392 Waiting for device to disconnect...
    12:38:18.392 Waiting for device to enter Pongo mode...
    12:38:18.594 Found PongoOS device
    12:38:18.599 Sending sep_racer (1211568 bytes)
    12:38:18.637 Loading module
    12:38:18.716 Sending ApImg4Ticket (7003 bytes)
    12:38:18.717 Loading ApImg4Ticket
    12:38:18.722 Sending ApImg4TicketHash (48 bytes)
    12:38:18.723 Loading ApImg4TicketHash
    12:38:18.727 Sending RestoreSEP (1408168 bytes)
    12:38:18.772 Loading RestoreSEP
    12:38:18.786 Sending SEP (5161103 bytes)
    12:38:18.946 Loading SEP
    12:38:19.012 Loading sep_flag
    12:38:19.019 Exploiting with SEPROM exploit
    12:38:19.021 Successfully obtained SEPROM code execution?
    12:38:42.336 Sending uploadKpfModule (92296 bytes)
    12:38:42.341 Loading module
    12:38:42.417 Loading setupKpfModule
    12:38:42.428 Sending union.dmg[iPhoneOS] (1048576 bytes)
    12:38:42.462 Loading overlay
    12:38:42.468 Loading kpf
    12:38:43.434 Booting
    12:38:43.435 Waiting for device to disconnect...
    12:38:43.443 Waiting for device to enter restore mode...

    Any ideas about this? I get stuck here every time unless I use global IPSW in which case it still fails but differently (restore bar appears then goes to the end and it goes to black screen forever with backlight on). iPhone 7 Plus A1784

    ReplyDelete