2019-11-22 11:48:41 +01:00
#!/bin/bash
2020-07-23 02:47:36 +02:00
trap 'Clean; exit' INT TERM EXIT
2019-11-22 11:48:41 +01:00
2020-07-23 02:47:36 +02:00
function Clean {
rm -rf iP*/ tmp/ $( ls *_${ ProductType } _${ OSVer } -*.shsh2 2>/dev/null) $( ls *_${ ProductType } _${ OSVer } -*.shsh 2>/dev/null) $( ls *.im4p 2>/dev/null) $( ls *.bbfw 2>/dev/null) BuildManifest.plist
2020-03-09 02:30:19 +01:00
}
2020-07-23 02:47:36 +02:00
function Error {
echo " [Error] $1 "
[ [ ! -z $2 ] ] && echo " * $2 "
exit
2020-03-09 02:30:19 +01:00
}
2020-04-01 04:49:55 +02:00
function Log {
2020-04-16 12:29:11 +02:00
echo " [Log] $1 "
2020-04-01 04:49:55 +02:00
}
2020-07-23 02:47:36 +02:00
function Main {
clear
echo "******* iOS-OTA-Downgrader *******"
echo " Downgrader script by LukeZGD "
echo
if [ [ $OSTYPE = = "linux-gnu" ] ] ; then
platform = 'linux'
elif [ [ $OSTYPE = = "darwin" * ] ] ; then
platform = 'macos'
else
Error "OSTYPE unknown/not supported." "Supports Linux and macOS only"
fi
2020-07-27 15:42:41 +02:00
[ [ ! $( ping -c1 google.com 2>/dev/null) ] ] && Error "Please check your Internet connection before proceeding."
[ [ $( uname -m) != 'x86_64' ] ] && Error "Only x86_64 distributions are supported. Use a 64-bit distro and try again"
2020-07-27 13:27:46 +02:00
futurerestore152 = " sudo LD_PRELOAD=libcurl.so.3 resources/tools/futurerestore152_ $platform "
futurerestore249 = " sudo LD_LIBRARY_PATH=/usr/local/lib resources/tools/futurerestore249_ $platform "
irecovery = "sudo LD_LIBRARY_PATH=/usr/local/lib irecovery"
pzb = " resources/tools/pzb_ $platform "
tsschecker = " env LD_LIBRARY_PATH=/usr/local/lib resources/tools/tsschecker_ $platform "
chmod +x resources/tools/*
2020-07-30 13:31:55 +02:00
mkdir tmp
SaveExternal iOS-OTA-Downgrader-Keys
2020-07-27 13:27:46 +02:00
SaveExternal ipwndfu
2020-04-01 04:49:55 +02:00
2020-07-23 02:47:36 +02:00
DFUDevice = $( lsusb | grep -c '1227' )
RecoveryDevice = $( lsusb | grep -c '1281' )
2020-07-23 04:08:46 +02:00
if [ [ $1 = = InstallDependencies ] ] || [ ! $( which bspatch) ] || [ ! $( which ideviceinfo) ] ||
[ ! $( which lsusb) ] || [ ! $( which ssh) ] || [ ! $( which python3) ] ; then
2020-07-23 02:47:36 +02:00
InstallDependencies
elif [ $DFUDevice = = 1 ] || [ $RecoveryDevice = = 1 ] ; then
2020-07-26 08:08:00 +02:00
ProductType = $( sudo LD_LIBRARY_PATH = /usr/local/lib resources/tools/igetnonce_$platform 2>/dev/null)
2020-07-23 14:08:16 +02:00
[ ! $ProductType ] && read -p "[Input] Enter ProductType (eg. iPad2,1): " ProductType
2020-07-27 13:27:46 +02:00
UniqueChipID = $( $irecovery -q | grep 'ECID' | cut -c 7-)
2020-07-23 04:08:46 +02:00
ProductVer = 'Unknown'
2020-07-23 02:47:36 +02:00
else
2020-07-27 13:27:46 +02:00
ideviceinfo = $( ideviceinfo -s)
HWModel = $( echo " $ideviceinfo " | grep 'HardwareModel' | cut -c 16- | tr '[:upper:]' '[:lower:]' | sed 's/.\{2\}$//' )
ProductType = $( echo " $ideviceinfo " | grep 'ProductType' | cut -c 14-)
2020-07-23 02:47:36 +02:00
[ ! $ProductType ] && ProductType = $( ideviceinfo | grep 'ProductType' | cut -c 14-)
2020-07-27 13:27:46 +02:00
ProductVer = $( echo " $ideviceinfo " | grep 'ProductVer' | cut -c 17-)
2020-07-23 02:47:36 +02:00
VersionDetect = $( echo $ProductVer | cut -c 1)
2020-07-27 13:27:46 +02:00
UniqueChipID = $( echo " $ideviceinfo " | grep 'UniqueChipID' | cut -c 15-)
UniqueDeviceID = $( echo " $ideviceinfo " | grep 'UniqueDeviceID' | cut -c 17-)
2020-07-23 02:47:36 +02:00
fi
2020-07-27 15:42:41 +02:00
[ ! $ProductType ] && ProductType = 0
2020-07-23 04:08:46 +02:00
BasebandDetect
2020-07-27 15:42:41 +02:00
Clean
mkdir tmp
2020-07-23 02:47:36 +02:00
2020-07-27 15:42:41 +02:00
if [ $DFUDevice = = 1 ] && [ [ $A7Device != 1 ] ] ; then
2020-07-23 02:47:36 +02:00
Log "Device in DFU mode detected."
2020-07-27 15:42:41 +02:00
read -p "[Input] Is this a 32-bit device in kDFU mode? (y/N) " DFUManual
if [ [ $DFUManual = = y ] ] || [ [ $DFUManual = = Y ] ] ; then
Log " Downgrading device $ProductType in kDFU mode... "
Mode = 'Downgrade'
SelectVersion
else
Error "Please put the device in normal mode (and jailbroken for 32-bit) before proceeding." "Recovery or DFU mode is also applicable for A7 devices"
2020-07-23 02:47:36 +02:00
fi
2020-07-23 04:08:46 +02:00
elif [ $RecoveryDevice = = 1 ] && [ [ $A7Device != 1 ] ] ; then
Error "Non-A7 device detected in recovery mode. Please put the device in normal mode and jailbroken before proceeding"
2020-03-05 12:48:41 +01:00
fi
2020-03-10 03:55:04 +01:00
2020-07-23 02:47:36 +02:00
echo " * HardwareModel: ${ HWModel } ap "
echo " * ProductType: $ProductType "
echo " * ProductVersion: $ProductVer "
echo " * UniqueChipID (ECID): $UniqueChipID "
2020-03-05 12:48:41 +01:00
echo
2020-07-23 04:08:46 +02:00
if [ [ $1 ] ] ; then
Mode = " $1 "
else
Selection = ( "Downgrade device" )
[ [ $A7Device != 1 ] ] && Selection += ( "Save OTA blobs" "Just put device in kDFU mode" )
Selection += ( "(Re-)Install Dependencies" "(Any other key to exit)" )
echo "*** Main Menu ***"
echo "[Input] Select an option:"
select opt in " ${ Selection [@] } " ; do
case $opt in
"Downgrade device" ) Mode = 'Downgrade' ; break; ;
"Save OTA blobs" ) Mode = 'SaveOTABlobs' ; break; ;
"Just put device in kDFU mode" ) Mode = 'kDFU' ; break; ;
"(Re-)Install Dependencies" ) InstallDependencies; exit; ;
* ) exit; ;
esac
done
fi
2020-03-31 07:46:59 +02:00
SelectVersion
2020-03-05 12:48:41 +01:00
}
function SelectVersion {
2020-07-23 02:47:36 +02:00
if [ [ $ProductType = = iPad4* ] ] || [ [ $ProductType = = iPhone6* ] ] ; then
OSVer = '10.3.3'
BuildVer = '14G60'
2020-06-14 07:39:26 +02:00
Action
2020-07-27 14:07:21 +02:00
elif [ [ $Mode = = 'kDFU' ] ] ; then
Action
2020-07-23 02:47:36 +02:00
fi
Selection = ( "iOS 8.4.1" )
if [ $ProductType = = iPad2,1 ] || [ $ProductType = = iPad2,2 ] ||
[ $ProductType = = iPad2,3 ] || [ $ProductType = = iPhone4,1 ] ; then
2020-04-01 04:16:29 +02:00
Selection += ( "iOS 6.1.3" )
2020-03-05 12:48:41 +01:00
fi
2020-04-01 04:16:29 +02:00
[ [ $Mode = = 'Downgrade' ] ] && Selection += ( "Other" )
2020-07-27 13:27:46 +02:00
Selection += ( "(Any other key to exit)" )
2020-04-01 04:16:29 +02:00
echo "[Input] Select iOS version:"
select opt in " ${ Selection [@] } " ; do
case $opt in
2020-06-14 07:39:26 +02:00
"iOS 8.4.1" ) OSVer = '8.4.1' ; BuildVer = '12H321' ; break; ;
"iOS 6.1.3" ) OSVer = '6.1.3' ; BuildVer = '10B329' ; break; ;
"Other" ) OSVer = 'Other' ; break; ;
2020-07-23 02:47:36 +02:00
*) exit; ;
2020-04-01 04:16:29 +02:00
esac
done
2020-03-05 12:48:41 +01:00
Action
}
2020-06-14 07:39:26 +02:00
function Action {
2020-07-07 05:50:26 +02:00
Log " Option: $Mode "
if [ [ $OSVer = = 'Other' ] ] ; then
2020-07-23 02:47:36 +02:00
echo "* Move/copy the IPSW and SHSH to the directory where the script is located"
2020-07-27 15:42:41 +02:00
echo "* Reminder to create a backup of the SHSH"
2020-06-14 07:39:26 +02:00
read -p "[Input] Path to IPSW (drag IPSW to terminal window): " IPSW
2020-07-13 15:27:43 +02:00
IPSW = " $( basename $IPSW .ipsw) "
2020-06-14 07:39:26 +02:00
read -p "[Input] Path to SHSH (drag SHSH to terminal window): " SHSH
2020-07-23 04:08:46 +02:00
elif [ [ $A7Device = = 1 ] ] && [ [ $pwnDFUDevice != 1 ] ] ; then
if [ [ $DFUDevice = = 1 ] ] ; then
CheckM8
else
Recovery
fi
2020-06-14 07:39:26 +02:00
fi
2020-07-23 02:47:36 +02:00
if [ $ProductType = = iPod5,1 ] ; then
2020-07-30 13:31:55 +02:00
iBSS = " ${ HWModel } ap "
2020-07-06 14:19:35 +02:00
iBSSBuildVer = '10B329'
2020-07-23 02:47:36 +02:00
elif [ $ProductType = = iPad3,1 ] ; then
2020-07-30 13:31:55 +02:00
iBSS = " ${ HWModel } ap "
2020-07-06 14:19:35 +02:00
iBSSBuildVer = '11D257'
2020-07-23 02:47:36 +02:00
elif [ $ProductType = = iPhone6,1 ] || [ $ProductType = = iPhone6,2 ] ; then
2020-07-30 13:31:55 +02:00
iBSS = "iphone6"
2020-07-23 02:47:36 +02:00
elif [ $ProductType = = iPad4,1 ] || [ $ProductType = = iPad4,2 ] || [ $ProductType = = iPad4,3 ] ; then
2020-07-30 13:31:55 +02:00
iBSS = "ipad4"
2020-07-23 02:47:36 +02:00
elif [ $ProductType = = iPad4,4 ] || [ $ProductType = = iPad4,5 ] ; then
2020-07-30 13:31:55 +02:00
iBSS = "ipad4b"
2020-07-06 12:16:48 +02:00
else
2020-07-30 13:31:55 +02:00
iBSS = " $HWModel "
2020-07-06 14:19:35 +02:00
iBSSBuildVer = '12H321'
2020-07-06 12:16:48 +02:00
fi
2020-07-30 13:31:55 +02:00
iBEC = " iBEC. $iBSS .RELEASE "
iBSS = " iBSS. $iBSS .RELEASE "
2020-07-23 02:47:36 +02:00
IV = $( cat $Firmware /$iBSSBuildVer /iv 2>/dev/null)
Key = $( cat $Firmware /$iBSSBuildVer /key 2>/dev/null)
2020-07-06 12:16:48 +02:00
2020-07-27 15:42:41 +02:00
[ [ $Mode = = 'Downgrade' ] ] && Downgrade
[ [ $Mode = = 'SaveOTABlobs' ] ] && SaveOTABlobs
[ [ $Mode = = 'kDFU' ] ] && kDFU
2020-04-01 05:17:19 +02:00
exit
2019-11-22 11:48:41 +01:00
}
2019-11-23 05:15:35 +01:00
function SaveOTABlobs {
2020-05-05 09:05:49 +02:00
Log " Saving $OSVer blobs with tsschecker... "
2020-07-23 02:47:36 +02:00
BuildManifest = " resources/manifests/BuildManifest_ ${ ProductType } _ ${ OSVer } .plist "
2020-07-25 05:23:31 +02:00
if [ [ $A7Device = = 1 ] ] ; then
2020-07-27 13:27:46 +02:00
APNonce = $( $irecovery -q | grep 'NONC' | cut -c 7-)
2020-07-23 02:47:36 +02:00
echo " * APNonce: $APNonce "
2020-07-27 13:27:46 +02:00
$tsschecker -d $ProductType -B ${ HWModel } ap -i $OSVer -e $UniqueChipID -m $BuildManifest --apnonce $APNonce -o -s
2020-07-23 02:47:36 +02:00
else
2020-07-27 13:27:46 +02:00
$tsschecker -d $ProductType -i $OSVer -e $UniqueChipID -m $BuildManifest -o -s
2020-07-23 02:47:36 +02:00
SHSH = $( ls *_${ ProductType } _${ OSVer } -*.shsh2)
fi
[ ! $SHSH ] && SHSH = $( ls *_${ ProductType } _${ HWModel } ap_${ OSVer } -*.shsh)
[ ! $SHSH ] && Error " Saving $OSVer blobs failed. Please run the script again " " It is also possible that $OSVer for $ProductType is no longer signed "
2020-03-29 05:53:53 +02:00
mkdir -p saved/shsh 2>/dev/null
cp " $SHSH " saved/shsh
2020-05-05 09:05:49 +02:00
Log " Successfully saved $OSVer blobs. "
2019-11-23 05:15:35 +01:00
}
2020-03-05 12:48:41 +01:00
function kDFU {
2020-03-29 07:05:45 +02:00
if [ ! -e saved/$ProductType /$iBSS .dfu ] ; then
2020-04-01 04:49:55 +02:00
Log "Downloading iBSS..."
2020-07-27 13:27:46 +02:00
$pzb -g Firmware/dfu/$iBSS .dfu -o $iBSS .dfu $( cat $Firmware /$iBSSBuildVer /url)
2020-03-29 05:53:53 +02:00
mkdir -p saved/$ProductType 2>/dev/null
mv $iBSS .dfu saved/$ProductType
2020-03-10 03:55:04 +01:00
fi
2020-04-01 04:49:55 +02:00
Log "Decrypting iBSS..."
Log " IV = $IV "
Log " Key = $Key "
2020-07-07 05:50:26 +02:00
resources/tools/xpwntool_$platform saved/$ProductType /$iBSS .dfu tmp/iBSS.dec -k $Key -iv $IV
2020-04-01 04:49:55 +02:00
Log "Patching iBSS..."
2020-07-07 05:50:26 +02:00
bspatch tmp/iBSS.dec tmp/pwnediBSS resources/patches/$iBSS .patch
2020-03-13 05:12:49 +01:00
# Regular kloader only works on iOS 6 to 9, so other versions are provided for iOS 5 and 10
2019-12-15 04:52:10 +01:00
if [ [ $VersionDetect = = 1 ] ] ; then
2020-03-10 03:55:04 +01:00
kloader = 'kloader_hgsp'
2019-12-15 04:52:10 +01:00
elif [ [ $VersionDetect = = 5 ] ] ; then
2020-03-10 03:55:04 +01:00
kloader = 'kloader5'
2019-11-22 11:48:41 +01:00
else
2020-03-10 03:55:04 +01:00
kloader = 'kloader'
2019-11-22 11:48:41 +01:00
fi
2019-12-15 04:52:10 +01:00
if [ [ $VersionDetect = = 1 ] ] ; then
2020-04-16 12:29:11 +02:00
# ifuse+MTerminal is used instead of SSH for devices on iOS 10
2020-07-27 15:42:41 +02:00
[ ! $( which ifuse) ] && Error "One of the dependencies (ifuse) cannot be found. Please re-install dependencies and try again" "./restore.sh InstallDependencies"
2020-03-01 20:47:48 +01:00
WifiAddr = $( ideviceinfo -s | grep 'WiFiAddress' | cut -c 14-)
2019-11-22 11:48:41 +01:00
WifiAddrDecr = $( echo $( printf "%x\n" $( expr $( printf "%d\n" 0x$( echo " ${ WifiAddr } " | tr -d ':' ) ) - 1) ) | sed 's/\(..\)/\1:/g;s/:$//' )
2020-01-08 00:28:11 +01:00
echo '#!/bin/bash' > tmp/pwn.sh
echo " nvram wifiaddr= $WifiAddrDecr
chmod 755 kloader_hgsp
./kloader_hgsp pwnediBSS" >> tmp/pwn.sh
2020-04-01 04:49:55 +02:00
Log "Mounting device with ifuse..."
2020-03-13 05:12:49 +01:00
mkdir mount
2020-03-08 11:59:22 +01:00
ifuse mount
2020-07-27 15:42:41 +02:00
[ [ ! -d mount/DCIM ] ] && Error "Failed to mount device. Please run the script again" "Make sure to trust this computer before proceeding"
2020-04-01 04:49:55 +02:00
Log "Copying stuff to device..."
2020-07-27 15:42:41 +02:00
cp tmp/pwn.sh resources/tools/$kloader tmp/pwnediBSS mount/
2020-06-14 07:39:26 +02:00
Log "Unmounting device... (Enter root password of your PC/Mac when prompted)"
2020-07-27 15:42:41 +02:00
sudo umount mount 2>/dev/null
2019-11-22 11:48:41 +01:00
echo
2020-07-23 02:47:36 +02:00
echo "* Open MTerminal and run these commands:"
2019-11-22 11:48:41 +01:00
echo
2020-01-08 00:17:00 +01:00
echo '$ su'
2020-07-27 15:42:41 +02:00
echo "* (Enter root password of your iOS device, default is 'alpine')"
2020-01-08 00:17:00 +01:00
echo "# cd Media"
2020-01-08 00:28:11 +01:00
echo "# chmod +x pwn.sh"
echo "# ./pwn.sh"
2019-11-22 11:48:41 +01:00
else
2020-04-16 12:29:11 +02:00
# SSH kloader and pwnediBSS
2020-07-27 15:42:41 +02:00
echo "* Make sure OpenSSH is installed on the device!"
echo "* Also make sure that the PC/Mac and the iOS device are on the same network"
echo
echo "* Please enter Wi-Fi IP address of the device for SSH connection"
2020-03-10 16:07:11 +01:00
read -p "[Input] IP Address: " IPAddress
2020-07-27 15:42:41 +02:00
Log "Copying stuff to device via SSH..."
echo "* (Enter root password of your iOS device when prompted, default is 'alpine')"
2020-03-02 08:20:47 +01:00
scp resources/tools/$kloader tmp/pwnediBSS root@$IPAddress :/
2020-04-16 12:29:11 +02:00
[ $? = = 1 ] && Error "Cannot connect to device via SSH." "Please check your ~/.ssh/known_hosts file and try again"
2020-04-01 04:49:55 +02:00
Log "Entering kDFU mode..."
2020-03-02 08:20:47 +01:00
ssh root@$IPAddress " chmod 755 / $kloader && / $kloader /pwnediBSS " &
2019-11-22 11:48:41 +01:00
fi
2020-01-08 00:17:00 +01:00
echo
2020-07-27 15:42:41 +02:00
echo "* Press POWER or HOME button when screen goes black on the device"
2020-05-08 03:46:30 +02:00
2020-04-01 04:49:55 +02:00
Log "Finding device in DFU mode..."
2019-12-15 04:52:10 +01:00
while [ [ $DFUDevice != 1 ] ] ; do
2020-07-23 02:47:36 +02:00
DFUDevice = $( lsusb | grep -c '1227' )
2019-11-22 11:48:41 +01:00
sleep 2
done
2020-04-01 04:49:55 +02:00
Log "Found device in DFU mode."
2019-11-22 11:48:41 +01:00
}
2020-07-23 02:47:36 +02:00
function Recovery {
RecoveryDevice = $( lsusb | grep -c '1281' )
if [ [ $RecoveryDevice != 1 ] ] ; then
Log "Entering recovery mode..."
ideviceenterrecovery $UniqueDeviceID >/dev/null
while [ [ $RecoveryDevice != 1 ] ] ; do
RecoveryDevice = $( lsusb | grep -c '1281' )
sleep 2
done
fi
Log "A7 device in recovery mode detected. Get ready to enter DFU mode"
read -p "[Input] Select Y to continue, N to exit recovery (Y/n) " RecoveryDFU
if [ [ $RecoveryDFU = = n ] ] || [ [ $RecoveryDFU = = N ] ] ; then
Log "Exiting recovery mode."
2020-07-27 13:27:46 +02:00
$irecovery -n
2020-07-23 02:47:36 +02:00
exit
fi
echo "* Hold POWER and HOME button for 10 seconds."
for i in { 10..01} ; do
echo -n " $i "
sleep 1
done
echo -e "\n* Release POWER and hold HOME button for 10 seconds."
for i in { 10..01} ; do
echo -n " $i "
DFUDevice = $( lsusb | grep -c '1227' )
2020-07-27 15:42:41 +02:00
[ [ $DFUDevice = = 1 ] ] && CheckM8
2020-07-23 02:47:36 +02:00
sleep 1
done
echo -e "\n[Error] Failed to detect device in DFU mode. Please run the script again"
exit
}
function CheckM8 {
DFUManual = 0
2020-07-27 15:42:41 +02:00
echo -e "\n[Log] Device in DFU mode detected."
2020-07-23 02:47:36 +02:00
Log "Entering pwnDFU mode with ipwndfu..."
cd resources/ipwndfu
sudo python2 ipwndfu -p
pwnDFUDevice = $( sudo lsusb -v -d 05ac:1227 2>/dev/null | grep -c 'checkm8' )
if [ $pwnDFUDevice = = 1 ] ; then
Log "Detected device in pwnDFU mode. Running rmsigchks.py..."
sudo python2 rmsigchks.py
cd ../..
Log " Downgrading device $ProductType in pwnDFU mode... "
Mode = 'Downgrade'
SelectVersion
else
2020-07-27 15:42:41 +02:00
Error "Entering pwnDFU failed. Please run the script again" "./restore.sh Downgrade"
2020-07-23 02:47:36 +02:00
fi
}
2020-03-31 08:05:29 +02:00
function Downgrade {
2020-07-23 02:47:36 +02:00
if [ [ $OSVer != 'Other' ] ] ; then
if [ [ $ProductType = = iPad4* ] ] ; then
IPSW = "iPad_64bit"
elif [ [ $ProductType = = iPhone6* ] ] ; then
IPSW = "iPhone_64bit"
else
2020-07-27 15:42:41 +02:00
IPSW = " $ProductType "
2020-07-23 02:47:36 +02:00
SaveOTABlobs
fi
IPSW = " ${ IPSW } _ ${ OSVer } _ ${ BuildVer } _Restore "
IPSWCustom = " ${ ProductType } _ ${ OSVer } _ ${ BuildVer } _Custom "
if [ ! -e $IPSW .ipsw ] ; then
2020-05-08 03:46:30 +02:00
Log " iOS $OSVer IPSW cannot be found. Downloading IPSW... "
2020-05-05 09:05:49 +02:00
curl -L $( cat $Firmware /$BuildVer /url) -o tmp/$IPSW .ipsw
2020-03-13 05:12:49 +01:00
mv tmp/$IPSW .ipsw .
2020-03-05 12:48:41 +01:00
fi
2020-07-23 02:47:36 +02:00
if [ ! -e $IPSWCustom .ipsw ] ; then
Log "Verifying IPSW..."
IPSWSHA1 = $( cat $Firmware /$BuildVer /sha1sum)
2020-07-25 07:50:55 +02:00
IPSWSHA1L = $( shasum -a 1 $IPSW .ipsw | awk '{print $1}' )
2020-07-23 02:47:36 +02:00
[ [ $IPSWSHA1L != $IPSWSHA1 ] ] && Error "Verifying IPSW failed. Delete/replace the IPSW and run the script again"
else
IPSW = $IPSWCustom
fi
2020-07-25 05:23:31 +02:00
if [ ! $DFUManual ] && [ [ $iBSSBuildVer = = $BuildVer ] ] ; then
2020-04-08 14:01:21 +02:00
Log "Extracting iBSS from IPSW..."
mkdir -p saved/$ProductType 2>/dev/null
2020-07-23 02:47:36 +02:00
unzip -o -j $IPSW .ipsw Firmware/dfu/$iBSS .dfu -d saved/$ProductType
2020-04-08 14:01:21 +02:00
fi
2019-11-22 11:48:41 +01:00
fi
2020-03-05 12:48:41 +01:00
2020-07-23 02:47:36 +02:00
[ ! $DFUManual ] && kDFU
2020-03-05 12:48:41 +01:00
2020-04-01 04:49:55 +02:00
Log "Extracting IPSW..."
2020-07-23 02:47:36 +02:00
unzip -q $IPSW .ipsw -d $IPSW /
2020-07-25 05:23:31 +02:00
if [ [ $A7Device = = 1 ] ] ; then
2020-07-23 02:47:36 +02:00
if [ ! -e $IPSWCustom .ipsw ] ; then
Log "Preparing custom IPSW..."
cp $IPSW /Firmware/all_flash/$SEP .
bspatch $IPSW /Firmware/dfu/$iBSS .im4p $iBSS .im4p resources/patches/$iBSS .patch
bspatch $IPSW /Firmware/dfu/$iBEC .im4p $iBEC .im4p resources/patches/$iBEC .patch
cp -f $iBSS .im4p $iBEC .im4p $IPSW /Firmware/dfu
cd $IPSW
2020-07-27 13:27:46 +02:00
zip ../$IPSWCustom .ipsw -rq0 *
2020-07-23 02:47:36 +02:00
cd ..
mv $IPSW $IPSWCustom
IPSW = $IPSWCustom
else
cp $IPSW /Firmware/dfu/$iBSS .im4p .
cp $IPSW /Firmware/dfu/$iBEC .im4p .
cp $IPSW /Firmware/all_flash/$SEP .
fi
Log "Entering PWNREC mode..."
2020-07-27 13:27:46 +02:00
$irecovery -f $iBSS .im4p
$irecovery -f $iBEC .im4p
2020-07-23 02:47:36 +02:00
sleep 5
RecoveryDevice = $( lsusb | grep -c '1281' )
if [ [ $RecoveryDevice != 1 ] ] ; then
2020-07-27 15:42:41 +02:00
echo -e "\n[Error] Failed to detect device in PWNREC mode. Please try again"
2020-07-23 02:47:36 +02:00
exit
fi
SaveOTABlobs
fi
2020-03-10 03:55:04 +01:00
2020-06-14 07:39:26 +02:00
Log "Preparing for futurerestore... (Enter root password of your PC/Mac when prompted)"
2020-03-05 12:48:41 +01:00
cd resources
2020-03-29 07:05:45 +02:00
sudo bash -c "python3 -m http.server 80 &"
2020-03-05 12:48:41 +01:00
cd ..
2020-03-29 05:53:53 +02:00
if [ $Baseband = = 0 ] ; then
2020-04-01 04:49:55 +02:00
Log " Device $ProductType has no baseband "
Log "Proceeding to futurerestore..."
2020-07-25 05:23:31 +02:00
if [ [ $A7Device = = 1 ] ] ; then
2020-07-27 13:27:46 +02:00
$futurerestore249 -t $SHSH -s $SEP -m $BuildManifest --no-baseband $IPSW .ipsw
2020-07-23 02:47:36 +02:00
else
2020-07-27 13:27:46 +02:00
$futurerestore152 -t $SHSH --no-baseband --use-pwndfu $IPSW .ipsw
2020-07-23 02:47:36 +02:00
fi
2020-03-29 05:53:53 +02:00
else
2020-07-25 05:23:31 +02:00
if [ [ $A7Device = = 1 ] ] ; then
2020-07-23 02:47:36 +02:00
cp $IPSW /Firmware/$Baseband .
2020-07-25 07:19:19 +02:00
elif [ ! -e saved/$ProductType /*.bbfw ] ; then
2020-04-01 04:49:55 +02:00
Log "Downloading baseband..."
2020-07-27 13:27:46 +02:00
$pzb -g Firmware/$Baseband -o $Baseband $BasebandURL
$pzb -g BuildManifest.plist -o BuildManifest.plist $BasebandURL
2020-03-29 05:53:53 +02:00
mkdir -p saved/$ProductType 2>/dev/null
2020-07-23 02:47:36 +02:00
cp $Baseband BuildManifest.plist saved/$ProductType
2020-03-05 12:48:41 +01:00
else
2020-03-29 05:53:53 +02:00
cp saved/$ProductType /*.bbfw saved/$ProductType /BuildManifest.plist .
2020-03-05 12:48:41 +01:00
fi
2020-07-25 07:50:55 +02:00
BasebandSHA1L = $( shasum -a 1 $Baseband | awk '{print $1}' )
2020-07-27 13:27:46 +02:00
Log "Proceeding to futurerestore..."
2020-07-25 07:19:19 +02:00
if [ ! -e *.bbfw ] || [ [ $BasebandSHA1L != $BasebandSHA1 ] ] ; then
2020-07-23 02:47:36 +02:00
rm -f saved/$ProductType /*.bbfw saved/$ProductType /BuildManifest.plist
2020-05-08 03:46:30 +02:00
echo "[Error] Downloading/verifying baseband failed."
2020-07-23 02:47:36 +02:00
echo "* Your device is still in kDFU mode and you may run the script again"
echo "* You can also continue and futurerestore can attempt to download the baseband again"
echo "* Proceeding to futurerestore in 10 seconds (Press Ctrl+C to cancel)"
2020-06-14 07:39:26 +02:00
sleep 10
2020-07-25 05:23:31 +02:00
if [ [ $A7Device = = 1 ] ] ; then
2020-07-27 13:27:46 +02:00
$futurerestore249 -t $SHSH -s $SEP -m $BuildManifest --latest-baseband $IPSW .ipsw
2020-07-23 02:47:36 +02:00
else
2020-07-27 13:27:46 +02:00
$futurerestore152 -t $SHSH --latest-baseband --use-pwndfu $IPSW .ipsw
2020-07-23 02:47:36 +02:00
fi
2020-07-25 05:23:31 +02:00
elif [ [ $A7Device = = 1 ] ] ; then
2020-07-27 13:27:46 +02:00
$futurerestore249 -t $SHSH -s $SEP -m $BuildManifest -b $Baseband -p $BuildManifest $IPSW .ipsw
2020-06-14 07:39:26 +02:00
else
2020-07-27 13:27:46 +02:00
$futurerestore152 -t $SHSH -b $Baseband -p BuildManifest.plist --use-pwndfu $IPSW .ipsw
2020-03-29 05:53:53 +02:00
fi
fi
echo
2020-04-01 04:49:55 +02:00
Log "futurerestore done!"
2020-06-14 07:39:26 +02:00
Log "Stopping local server... (Enter root password of your PC/Mac when prompted)"
2020-03-29 07:05:45 +02:00
ps aux | awk '/python3/ {print "sudo kill -9 "$2" 2>/dev/null"}' | bash
2020-04-01 04:49:55 +02:00
Log "Downgrade script done!"
2020-03-05 12:48:41 +01:00
}
2020-01-08 00:17:00 +01:00
function InstallDependencies {
echo "Install Dependencies"
2020-03-09 02:30:19 +01:00
. /etc/os-release 2>/dev/null
2020-07-29 12:41:01 +02:00
mkdir tmp 2>/dev/null
2020-07-23 02:47:36 +02:00
cd tmp
2020-05-08 03:46:30 +02:00
2020-07-23 02:47:36 +02:00
Log "Installing dependencies..."
2020-07-23 16:35:52 +02:00
if [ [ $ID = = "arch" ] ] || [ [ $ID_LIKE = = "arch" ] ] ; then
2020-05-08 03:46:30 +02:00
# Arch Linux
2020-07-23 02:47:36 +02:00
sudo pacman -Sy --noconfirm --needed bsdiff curl libcurl-compat libpng12 libimobiledevice libzip openssh openssl-1.0 python2 python unzip usbmuxd usbutils
Compile libimobiledevice ifuse
2020-05-08 03:46:30 +02:00
sudo ln -sf /usr/lib/libzip.so.5 /usr/lib/libzip.so.4
2020-07-06 10:08:13 +02:00
2020-07-26 08:08:00 +02:00
elif [ [ $UBUNTU_CODENAME = = "focal" ] ] ; then
2020-07-23 04:52:17 +02:00
# Ubuntu Focal
2020-07-23 16:35:52 +02:00
sudo add-apt-repository universe
2020-05-08 03:46:30 +02:00
sudo apt update
2020-07-26 08:20:35 +02:00
sudo apt install -y autoconf automake binutils bsdiff build-essential checkinstall curl git ifuse libimobiledevice-utils libplist3 libreadline-dev libtool-bin libusb-1.0-0-dev libusbmuxd6 libzip5 openssh-client python2 python3 usbmuxd usbutils
2020-07-24 14:58:09 +02:00
SavePkg http://archive.ubuntu.com/ubuntu/pool/universe/c/curl3/libcurl3_7.58.0-2ubuntu2_amd64.deb libcurl3.deb
VerifyPkg libcurl3.deb f6ab4c77f7c4680e72f9dd754f706409c8598a9f
2020-06-29 03:31:06 +02:00
ar x libcurl3.deb data.tar.xz
tar xf data.tar.xz
sudo cp usr/lib/x86_64-linux-gnu/libcurl.so.4.* /usr/lib/libcurl.so.3
2020-07-24 14:58:09 +02:00
SavePkg http://ppa.launchpad.net/linuxuprising/libpng12/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.54-1ubuntu1.1+1~ppa0~focal_amd64.deb libpng12.deb
VerifyPkg libpng12.deb 4ceaaa02d2af09d0cdf1074372ed5df10b90b088
SavePkg http://archive.ubuntu.com/ubuntu/pool/main/o/openssl1.0/libssl1.0.0_1.0.2n-1ubuntu5.3_amd64.deb libssl1.0.0.deb
VerifyPkg libssl1.0.0.deb 573f3b5744c4121431179abee144543fc662e8b1
SavePkg http://archive.ubuntu.com/ubuntu/pool/universe/libz/libzip/libzip4_1.1.2-1.1_amd64.deb libzip4.deb
VerifyPkg libzip4.deb 449ce0b3de6772f6fab0ec680fde641fb3428a28
2020-07-23 04:08:46 +02:00
sudo dpkg -i libpng12.deb libssl1.0.0.deb libzip4.deb
2020-07-23 02:47:36 +02:00
sudo ln -sf /usr/lib/x86_64-linux-gnu/libimobiledevice.so.6 /usr/local/lib/libimobiledevice-1.0.so.6
sudo ln -sf /usr/lib/x86_64-linux-gnu/libplist.so.3 /usr/local/lib/libplist-2.0.so.3
sudo ln -sf /usr/lib/x86_64-linux-gnu/libusbmuxd.so.6 /usr/local/lib/libusbmuxd-2.0.so.6
2020-07-23 16:35:52 +02:00
elif [ [ $ID = = "fedora" ] ] ; then
2020-07-25 07:50:55 +02:00
sudo dnf install -y automake bsdiff git ifuse libimobiledevice-utils libpng12 libtool libusb-devel libzip make perl-Digest-SHA python2 readline-devel
2020-07-24 14:58:09 +02:00
SavePkg http://ftp.pbone.net/mirror/ftp.scientificlinux.org/linux/scientific/6.1/x86_64/os/Packages/openssl-1.0.0-10.el6.x86_64.rpm openssl-1.0.0.rpm
VerifyPkg openssl-1.0.0.rpm 10e7e37c0eac8e7ea8c0657596549d7fe9dac454
2020-07-06 10:08:13 +02:00
rpm2cpio openssl-1.0.0.rpm | cpio -idmv
sudo cp usr/lib64/libcrypto.so.1.0.0 usr/lib64/libssl.so.1.0.0 /usr/lib64
2020-07-23 02:47:36 +02:00
sudo ln -sf /usr/lib64/libimobiledevice.so.6 /usr/local/lib/libimobiledevice-1.0.so.6
sudo ln -sf /usr/lib64/libplist.so.3 /usr/local/lib/libplist-2.0.so.3
sudo ln -sf /usr/lib64/libusbmuxd.so.6 /usr/local/lib/libusbmuxd-2.0.so.6
sudo ln -sf /usr/lib64/libzip.so.5 /usr/lib64/libzip.so.4
2020-05-08 03:46:30 +02:00
elif [ [ $OSTYPE = = "darwin" * ] ] ; then
# macOS
if [ [ ! $( which brew) ] ] ; then
Log "Homebrew is not detected/installed, installing Homebrew..."
/bin/bash -c " $( curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh) "
fi
brew install --HEAD usbmuxd
brew install --HEAD libimobiledevice
2020-07-25 07:50:55 +02:00
brew install libzip lsusb python3
2020-07-23 02:47:36 +02:00
brew install make automake autoconf libtool pkg-config gcc
2020-05-08 03:46:30 +02:00
brew cask install osxfuse
brew install ifuse
2020-04-27 07:16:07 +02:00
else
2020-05-08 03:46:30 +02:00
Error "Distro not detected/supported by the install script." "See the repo README for OS versions/distros tested on"
2020-04-27 07:16:07 +02:00
fi
2020-07-23 02:47:36 +02:00
Compile libimobiledevice libirecovery
[ [ $platform = = linux ] ] && sudo cp ../resources/lib/* /usr/local/lib
2020-05-08 03:46:30 +02:00
Log "Install script done! Please run the script again to proceed"
2020-07-23 02:47:36 +02:00
exit
2020-01-08 00:17:00 +01:00
}
2020-07-23 02:47:36 +02:00
function Compile {
2020-07-23 16:35:52 +02:00
git clone --depth 1 https://github.com/$1 /$2 .git
2020-07-23 02:47:36 +02:00
cd $2
./autogen.sh
sudo make install
cd ..
sudo rm -rf $2
}
2020-02-04 16:33:45 +01:00
2020-07-23 02:47:36 +02:00
function SaveExternal {
2020-07-30 13:31:55 +02:00
ExternalURL = " https://github.com/LukeZGD/ $1 .git "
External = $1
[ [ $1 = = "iOS-OTA-Downgrader-Keys" ] ] && External = "firmware"
if [ [ ! -d resources/$External ] ] || [ [ ! -d resources/$External /.git ] ] ; then
Log " Downloading $External ... "
cd tmp
git clone $ExternalURL $External & >/dev/null
rm -rf ../resources/$External
cp -r $External / ../resources/
else
Log " Updating $External ... "
cd resources/$External
git pull & >/dev/null
cd ..
2020-07-23 02:47:36 +02:00
fi
2020-07-30 13:31:55 +02:00
cd ..
2020-07-23 02:47:36 +02:00
}
2020-03-04 16:19:01 +01:00
2020-07-24 14:58:09 +02:00
function SavePkg {
if [ [ ! -e ../saved/pkg/$2 ] ] ; then
mkdir -p ../saved/pkg 2>/dev/null
Log " Downloading $1 ... "
curl -L $1 -o $2
cp $2 ../saved/pkg
else
cp ../saved/pkg/$2 .
fi
}
function VerifyPkg {
2020-07-24 05:00:32 +02:00
Log " Verifying $1 ... "
2020-07-25 07:50:55 +02:00
if [ [ $( shasum -a 1 $1 | awk '{print $1}' ) != $2 ] ] ; then
2020-07-24 14:58:09 +02:00
rm -f ../saved/pkg/$1
2020-07-27 15:42:41 +02:00
Error " Verifying $1 failed. Please run the script again " "./restore.sh InstallDependencies"
2020-07-24 14:58:09 +02:00
fi
2020-07-24 05:00:32 +02:00
}
2020-07-23 02:47:36 +02:00
function BasebandDetect {
Firmware = resources/firmware/$ProductType
BasebandURL = $( cat $Firmware /13G37/url 2>/dev/null) # iOS 9.3.6
2020-07-23 14:08:16 +02:00
Baseband = 0
2020-07-23 02:47:36 +02:00
if [ $ProductType = = iPad2,2 ] ; then
BasebandURL = $( cat $Firmware /13G36/url) # iOS 9.3.5
Baseband = ICE3_04.12.09_BOOT_02.13.Release.bbfw
BasebandSHA1 = e6f54acc5d5652d39a0ef9af5589681df39e0aca
elif [ $ProductType = = iPad2,3 ] ; then
Baseband = Phoenix-3.6.03.Release.bbfw
BasebandSHA1 = 8d4efb2214344ea8e7c9305392068ab0a7168ba4
elif [ $ProductType = = iPad2,6 ] || [ $ProductType = = iPad2,7 ] ; then
Baseband = Mav5-11.80.00.Release.bbfw
BasebandSHA1 = aa52cf75b82fc686f94772e216008345b6a2a750
elif [ $ProductType = = iPad3,2 ] || [ $ProductType = = iPad3,3 ] ; then
Baseband = Mav4-6.7.00.Release.bbfw
BasebandSHA1 = a5d6978ecead8d9c056250ad4622db4d6c71d15e
elif [ $ProductType = = iPhone4,1 ] ; then
Baseband = Trek-6.7.00.Release.bbfw
BasebandSHA1 = 22a35425a3cdf8fa1458b5116cfb199448eecf49
elif [ $ProductType = = iPad3,5 ] || [ $ProductType = = iPad3,6 ] ||
[ $ProductType = = iPhone5,1 ] || [ $ProductType = = iPhone5,2 ] ; then
BasebandURL = $( cat $Firmware /14G61/url) # iOS 10.3.4
Baseband = Mav5-11.80.00.Release.bbfw
BasebandSHA1 = 8951cf09f16029c5c0533e951eb4c06609d0ba7f
elif [ $ProductType = = iPad4,2 ] || [ $ProductType = = iPad4,3 ] || [ $ProductType = = iPad4,5 ] ||
[ $ProductType = = iPhone6,1 ] || [ $ProductType = = iPhone6,2 ] ; then
BasebandURL = $( cat $Firmware /14G60/url)
Baseband = Mav7Mav8-7.60.00.Release.bbfw
BasebandSHA1 = f397724367f6bed459cf8f3d523553c13e8ae12c
A7Device = 1
2020-07-23 14:08:16 +02:00
elif [ $ProductType = = iPad4,1 ] || [ $ProductType = = iPad4,4 ] ; then
A7Device = 1
2020-07-27 15:42:41 +02:00
elif [ $ProductType = = 0 ] ; then
2020-07-23 14:08:16 +02:00
Error "Please put the device in normal mode (and jailbroken for 32-bit) before proceeding." "Recovery or DFU mode is also applicable for A7 devices"
elif [ $ProductType != iPad2,1 ] && [ $ProductType != iPad2,4 ] && [ $ProductType != iPad2,5 ] &&
[ $ProductType != iPad3,1 ] && [ $ProductType != iPad3,4 ] && [ $ProductType != iPod5,1 ] ; then
Error " Your device $ProductType is not supported. "
2020-07-23 02:47:36 +02:00
fi
[ $ProductType = = iPhone6,1 ] && HWModel = n51
[ $ProductType = = iPhone6,2 ] && HWModel = n53
[ $ProductType = = iPad4,1 ] && HWModel = j71
[ $ProductType = = iPad4,2 ] && HWModel = j72
[ $ProductType = = iPad4,3 ] && HWModel = j73
[ $ProductType = = iPad4,4 ] && HWModel = j85
[ $ProductType = = iPad4,5 ] && HWModel = j86
SEP = sep-firmware.$HWModel .RELEASE.im4p
}
2020-07-23 04:08:46 +02:00
Main $1