Legacy-iOS-Kit/restore.sh

#!/usr/bin/env bash

ipsw_openssh=1 # OpenSSH will be added to jailbreak/custom IPSW if set to 1.
device_rd_build="" # You can change the version of SSH Ramdisk and Pwned iBSS/iBEC here. (default is 10B329 for most devices)
jelbrek="../resources/jailbreak"
ssh_port=6414

bash_test=$(echo -n 0)
(( bash_test += 1 ))
if [ "$bash_test" != "1" ] || [ -z $BASH_VERSION ]; then
    echo "[Error] Detected that script is not running with bash on runtime. Please run the script properly using bash."
    exit 1
fi
bash_ver=$(/usr/bin/env bash -c 'echo ${BASH_VERSINFO[0]}')
if (( bash_ver > 3 )); then
    shopt -s compat32
fi

print() {
    echo "${color_B}${1}${color_N}"
}

input() {
    echo "${color_Y}[Input] ${1}${color_N}"
}

log() {
    echo "${color_G}[Log] ${1}${color_N}"
}

warn() {
    echo "${color_Y}[WARNING] ${1}${color_N}"
}

error() {
    echo -e "${color_R}[Error] ${1}\n${color_Y}${*:2}${color_N}"
    echo
    print "* Save the terminal output now if needed. (macOS: Cmd+S, Linux: Ctrl+Shift+S)"
    print "* Legacy iOS Kit $version_current ($git_hash)"
    print "* Platform: $platform ($platform_ver - $platform_arch) $live_cdusb_str"
    exit 1
}

pause() {
    input "Press Enter/Return to continue (or press Ctrl+C to cancel)"
    read -s
}

clean() {
    kill $httpserver_pid $iproxy_pid $anisette_pid 2>/dev/null
    popd &>/dev/null
    rm -rf "$(dirname "$0")/tmp$$/"* "$(dirname "$0")/iP"*/ "$(dirname "$0")/tmp$$/" 2>/dev/null
    if [[ $platform == "macos" && $(ls "$(dirname "$0")" | grep -v tmp$$ | grep -c tmp) == 0 ]]; then
        killall -CONT AMPDevicesAgent AMPDeviceDiscoveryAgent MobileDeviceUpdater
    fi
}

clean_sudo() {
    clean
    sudo rm -rf /tmp/futurerestore /tmp/*.json "$(dirname "$0")/tmp$$/"* "$(dirname "$0")/iP"*/ "$(dirname "$0")/tmp$$/"
    sudo kill $sudoloop_pid
}

clean_usbmuxd() {
    clean_sudo
    if [[ $(ls "$(dirname "$0")" | grep -v tmp$$ | grep -c tmp) != 0 ]]; then
        return
    fi
    sudo killall usbmuxd 2>/dev/null
    if [[ $(command -v systemctl 2>/dev/null) ]]; then
        sleep 1
        sudo systemctl restart usbmuxd
    fi
}

display_help() {
    echo ' *** Legacy iOS Kit ***
  - Script by LukeZGD -

Usage: ./restore.sh [Options]

List of options:
    --debug                   For script debugging (set -x and debug mode)
    --dfuhelper               Launch to DFU Mode Helper only
    --disable-sudoloop        Disable running tools as root for Linux
    --entry-device            Enable manual device and ECID entry
    --exit-recovery           Attempt to exit recovery mode
    --help                    Display this help message
    --no-color                Disable colors for script output
    --no-device               Enable no device mode
    --no-version-check        Disable script version checking

For 32-bit devices compatible with restores/downgrades (see README):
    --activation-records      Enable dumping/stitching activation records
    --dead-bb                 Disable bbupdate completely without dumping/stitching baseband
    --disable-bbupdate        Disable bbupdate and enable dumping/stitching baseband
    --gasgauge-patch          Enable multipatch to get past "gas gauge" error (aka error 29 in iTunes)
    --ipsw-hacktivate         Enable hacktivation for creating IPSW (iPhone 2G/3G/3GS only)
    --ipsw-verbose            Enable verbose boot option (3GS and powdersn0w only)
    --jailbreak               Enable jailbreak option
    --memory                  Enable memory option for creating IPSW
    --pwned-recovery          Assume that device is in pwned recovery mode (experimental)
    --skip-first              Skip first restore and flash NOR IPSW only for powdersn0w 4.2.x and lower
    --skip-ibss               Assume that pwned iBSS has already been sent to the device

For 64-bit checkm8 devices compatible with pwned restores:
    --skip-blob               Enable futurerestore skip blob option for OTA/onboard/factory blobs

    * Default IPSW path: <script location>/<name of IPSW file>.ipsw
    * Default SHSH path: <script location>/saved/shsh/<name of SHSH file>.shsh(2)
    '
}

unzip2="$(command -v unzip)"
zip2="$(command -v zip)"

unzip() {
    $unzip2 "$@" || error "An error occurred with the unzip operation: $*"
}

zip() {
    $zip2 "$@" || error "An error occurred with the zip operation: $*"
}

set_tool_paths() {
    : '
    sets variables: platform, platform_ver, dir
    also checks architecture (linux) and macos version
    also set distro, debian_ver, ubuntu_ver, fedora_ver variables for linux

    list of tools set here:
    bspatch, jq, scp, ssh, sha1sum (for macos: shasum -a 1), zenity

    these ones "need" sudo for linux arm, not for others:
    futurerestore, gaster, idevicerestore, ipwnder, irecovery

    tools set here will be executed using:
    $name_of_tool

    the rest of the tools not listed here will be executed using:
    "$dir/$name_of_tool"
    '

    if [[ $OSTYPE == "linux"* ]]; then
        source /etc/os-release
        platform="linux"
        platform_ver="$PRETTY_NAME"
        dir="../bin/linux/"

        # architecture check
        if [[ $(uname -m) == "a"* && $(getconf LONG_BIT) == 64 ]]; then
            platform_arch="arm64"
        elif [[ $(uname -m) == "a"* ]]; then
            platform_arch="armhf"
        elif [[ $(uname -m) == "x86_64" ]]; then
            platform_arch="x86_64"
        else
            error "Your architecture ($(uname -m)) is not supported."
        fi
        dir+="$platform_arch"

        # version check
        if [[ -n $UBUNTU_CODENAME ]]; then
            case $UBUNTU_CODENAME in
                "jammy" | "kinetic"  ) ubuntu_ver=22;;
                "lunar" | "mantic"   ) ubuntu_ver=23;;
                "noble" | "oracular" ) ubuntu_ver=24;;
                "plucky"             ) ubuntu_ver=25;;
            esac
            if [[ -z $ubuntu_ver ]]; then
                source /etc/upstream-release/lsb-release 2>/dev/null
                ubuntu_ver="$(echo "$DISTRIB_RELEASE" | cut -c -2)"
            fi
            if [[ -z $ubuntu_ver ]]; then
                ubuntu_ver="$(echo "$VERSION_ID" | cut -c -2)"
            fi
        elif [[ -e /etc/debian_version ]]; then
            debian_ver=$(cat /etc/debian_version)
            case $debian_ver in
                *"sid" | "kali"* ) debian_ver="sid";;
                * ) debian_ver="$(echo "$debian_ver" | cut -c -2)";;
            esac
        elif [[ $ID == "fedora" || $ID_LIKE == "fedora" || $ID == "nobara" ]]; then
            fedora_ver=$VERSION_ID
        fi

        # distro check
        if [[ $ID == "arch" || $ID_LIKE == "arch" || $ID == "artix" ]]; then
            distro="arch"
        elif (( ubuntu_ver >= 22 )) || (( debian_ver >= 12 )) || [[ $debian_ver == "sid" ]]; then
            distro="debian"
        elif (( fedora_ver >= 37 )); then
            distro="fedora"
            if [[ $(command -v rpm-ostree) ]]; then
                distro="fedora-atomic"
            fi
        elif [[ $ID == "opensuse-tumbleweed" ]]; then
            distro="opensuse"
        elif [[ $ID == "gentoo" || $ID_LIKE == "gentoo" || $ID == "pentoo" ]]; then
            distro="gentoo"
        elif [[ $ID == "void" ]]; then
            distro="void"
        elif [[ -n $ubuntu_ver || -n $debian_ver || -n $fedora_ver ]]; then
            error "Your distro version ($platform_ver - $platform_arch) is not supported. See the repo README for supported OS versions/distros"
        else
            warn "Your distro ($platform_ver - $platform_arch) is not detected/supported. See the repo README for supported OS versions/distros"
            print "* You may still continue, but you need to install required packages and libraries manually as needed."
            sleep 5
            pause
        fi
        bspatch="$dir/bspatch"
        if [[ $platform_arch != "armhf" ]]; then
            dir_env="env LD_LIBRARY_PATH=$dir/lib "
            ideviceactivation="$dir_env"
            idevicediagnostics="$dir_env"
            ideviceinstaller="$dir_env"
        fi
        PlistBuddy="$dir/PlistBuddy"
        sha1sum="$(command -v sha1sum)"
        tsschecker="$dir/tsschecker"
        zenity="$(command -v zenity)"
        scp2="$dir/scp"
        ssh2="$dir/ssh"
        cp $ssh2 .
        chmod +x ssh

        # live cd/usb check
        if [[ $(id -u $USER) == 999 || $USER == "liveuser" ]]; then
            live_cdusb=1
            live_cdusb_str="Live session"
            log "Linux Live session detected."
            if [[ $(pwd) == "/home"* ]]; then
                df . -h
                if [[ $(lsblk -o label | grep -c "casper-rw") == 1 || $(lsblk -o label | grep -c "persistence") == 1 ]]; then
                    log "Detected Legacy iOS Kit running on persistent storage."
                    live_cdusb_str+=" - Persistent storage"
                else
                    warn "Detected Legacy iOS Kit running on temporary storage."
                    print "* You may run out of space and get errors during the restore process."
                    print "* Please move Legacy iOS Kit to a drive that is NOT used for the live USB."
                    print "* This may mean using another external HDD/flash drive to store Legacy iOS Kit on."
                    print "* To use one USB drive only, create the live USB using Rufus with Persistent Storage enabled."
                    sleep 5
                    pause
                    live_cdusb_str+=" - Temporary storage"
                fi
            fi
        fi

        # if "/media" is detected in pwd, warn user of possible permission issues
        if [[ $(pwd) == *"/media"* ]]; then
            warn "You might get permission errors like \"Permission denied\" on getting device info."
            print "* If this is the case, try moving Legacy iOS Kit to the Desktop or Documents folder."
        fi

        if [[ -z $device_disable_sudoloop ]]; then
            device_sudoloop=1 # Run some tools as root for device detection if set to 1. (for Linux)
            trap "clean_sudo" EXIT
        fi
        if [[ $(uname -m) == "a"* || $device_sudoloop == 1 || $live_cdusb == 1 ]]; then
            if [[ $live_cdusb != 1 ]]; then
                print "* Enter your user password when prompted"
            fi
            sudo -v
            (while true; do sudo -v; sleep 60; done) &
            sudoloop_pid=$!
            futurerestore="sudo "
            gaster="sudo "
            idevicerestore="sudo "
            ipwnder="sudo "
            irecovery="sudo "
            irecovery2="sudo "
            irecovery3="sudo "
            if [[ ! -d $dir && $(ls ../bin/linux) ]]; then
                log "Running on platform: $platform ($platform_ver - $platform_arch)"
                error "Failed to find bin directory for $platform_arch, found $(ls -x ../bin/linux) instead." \
                "* Download the \"linux_$platform_arch\" or \"complete\" version to continue (or do a git clone)"
            fi
            trap "clean_usbmuxd" EXIT
            if [[ $othertmp == 0 ]]; then
                if [[ $(command -v systemctl 2>/dev/null) ]]; then
                    sudo systemctl stop usbmuxd
                fi
                #sudo killall usbmuxd 2>/dev/null
                #sleep 1
                if [[ $platform_arch == "armhf" ]]; then
                    log "Running usbmuxd"
                    sudo -b $dir/usbmuxd -pf &>../saved/usbmuxd.log
                else
                    log "Running usbmuxd2"
                    sudo -b $dir/usbmuxd2 &>../saved/usbmuxd.log
                fi
            elif [[ $othertmp != 0 ]]; then
                log "Detected existing tmp folder(s), there might be other Legacy iOS Kit instance(s) running"
                log "Not running usbmuxd"
            fi
        fi
        gaster+="$dir/gaster"

    elif [[ $(uname -m) == "iP"* ]]; then
        error "Running Legacy iOS Kit on iOS is not supported (yet)" "* Supported platforms: Linux, macOS"

    elif [[ $OSTYPE == "darwin"* ]]; then
        platform="macos"
        platform_ver="${1:-$(sw_vers -productVersion)}"
        dir="../bin/macos"

        platform_arch="$(uname -m)"
        if [[ $platform_arch == "arm64" ]]; then
            dir+="/arm64"
        fi

        # macos version check
        mac_majver="${platform_ver:0:2}"
        if [[ $mac_majver == 10 ]]; then
            mac_minver=${platform_ver:3}
            mac_minver=${mac_minver%.*}
            if (( mac_minver < 11 )); then
                warn "Your macOS version ($platform_ver - $platform_arch) is not supported. Expect features to not work properly."
                print "* Supported versions are macOS 10.11 and newer. (10.13/10.15 and newer recommended)"
                pause
            fi
            if (( mac_minver <= 11 )); then
                mac_cocoa=1
                if [[ -z $(command -v cocoadialog) ]]; then
                    local error_msg="* You need to install cocoadialog from MacPorts."
                    error_msg+=$'\n* Please read the wiki and install the requirements needed in MacPorts: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/How-to-Use'
                    error_msg+=$'\n* Also make sure that /opt/local/bin (or /usr/local/bin) is in your $PATH.'
                    error_msg+=$'\n* You may try running this command: export PATH="/opt/local/bin:$PATH"'
                    error "Cannot find cocoadialog, cannot continue." "$error_msg"
                fi
            fi
            if [[ $(command -v curl) == "/usr/bin/curl" ]] && (( mac_minver < 15 )); then
                local error_msg="* You need to install curl from MacPorts."
                error_msg+=$'\n* Please read the wiki and install the requirements needed in MacPorts: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/How-to-Use'
                error_msg+=$'\n* Also make sure that /opt/local/bin (or /usr/local/bin) is in your $PATH.'
                error_msg+=$'\n* You may try running this command: export PATH="/opt/local/bin:$PATH"'
                error "Outdated curl detected, cannot continue." "$error_msg"
            fi
        fi

        bspatch="$(command -v bspatch)"
        cocoadialog="$(command -v cocoadialog)"
        gaster+="../bin/macos/gaster"
        ipwnder32="$dir/ipwnder32"
        PlistBuddy="/usr/libexec/PlistBuddy"
        sha1sum="$(command -v shasum) -a 1"
        tsschecker="../bin/macos/tsschecker"
        zenity="../bin/macos/zenity"
        scp2="/usr/bin/scp"
        ssh2="/usr/bin/ssh"

        # kill macos daemons
        killall -STOP AMPDevicesAgent AMPDeviceDiscoveryAgent MobileDeviceUpdater

    else
        error "Your platform ($OSTYPE) is not supported." "* Supported platforms: Linux, macOS"
    fi
    log "Running on platform: $platform ($platform_ver - $platform_arch)"
    if [[ ! -d $dir ]]; then
        error "Failed to find bin directory ($dir), cannot continue." \
        "* Re-download Legacy iOS Kit from releases (or do a git clone/reset)"
    fi
    if [[ $device_sudoloop == 1 ]]; then
        sudo chmod +x $dir/*
        if [[ $? != 0 ]]; then
            error "Failed to set up execute permissions of binaries, cannot continue. Try to move Legacy iOS Kit somewhere else."
        fi
    else
        chmod +x $dir/*
    fi

    futurerestore+="$dir/futurerestore"
    ideviceactivation+="$dir/ideviceactivation"
    idevicediagnostics+="$dir/idevicediagnostics"
    ideviceinfo="$dir/ideviceinfo"
    ideviceinstaller+="$dir/ideviceinstaller"
    idevicerestore+="$dir/idevicerestore"
    ifuse="$(command -v ifuse)"
    ipwnder+="$dir/ipwnder"
    irecovery+="$dir/irecovery"
    irecovery2+="$dir/irecovery2"
    irecovery3+="../$dir/irecovery"
    jq="$dir/jq"

    cp ../resources/ssh_config .
    if [[ $(ssh -V 2>&1 | grep -c SSH_8.8) == 1 || $(ssh -V 2>&1 | grep -c SSH_8.9) == 1 ||
          $(ssh -V 2>&1 | grep -c SSH_9.) == 1 || $(ssh -V 2>&1 | grep -c SSH_1) == 1 ]]; then
        echo "    PubkeyAcceptedAlgorithms +ssh-rsa" >> ssh_config
    elif [[ $(ssh -V 2>&1 | grep -c SSH_6) == 1 ]]; then
        cat ../resources/ssh_config | sed "s,Add,#Add,g" | sed "s,HostKeyA,#HostKeyA,g" > ssh_config
    fi
    scp2+=" -F ./ssh_config"
    ssh2+=" -F ./ssh_config"
}

prepare_udev_rules() {
    local owner="$1"
    local group="$2"
    echo "ACTION==\"add\", SUBSYSTEM==\"usb\", ATTR{idVendor}==\"05ac\", ATTR{idProduct}==\"122[27]|128[0-3]|1338\", OWNER=\"$owner\", GROUP=\"$group\", MODE=\"0660\" TAG+=\"uaccess\"" > 39-libirecovery.rules
}

install_depends() {
    log "Installing dependencies..."
    rm -f "../resources/firstrun"

    if [[ $platform == "linux" ]]; then
        print "* Legacy iOS Kit will be installing dependencies from your distribution's package manager"
        print "* Enter your user password when prompted"
        if [[ $distro != "debian" && $distro != "fedora-atomic" ]]; then
            echo
            warn "Before continuing, make sure that your system is fully updated first!"
            echo "${color_Y}* This operation can result in a partial upgrade and may cause breakage if your system is not updated${color_N}"
            echo
        fi
        pause
        prepare_udev_rules usbmux plugdev
    fi

    if [[ $distro == "arch" ]]; then
        sudo pacman -Sy --noconfirm --needed base-devel ca-certificates ca-certificates-mozilla curl git ifuse libimobiledevice libxml2 openssh pyenv python udev unzip usbmuxd usbutils vim zenity zip zstd
        prepare_udev_rules root storage

    elif [[ $distro == "debian" ]]; then
        if [[ -n $ubuntu_ver ]]; then
            sudo add-apt-repository -y universe
        fi
        sudo apt update
        sudo apt install -m -y build-essential ca-certificates curl git ifuse libimobiledevice6 libssl3 libssl-dev libxml2 libzstd1 openssh-client patch python3 unzip usbmuxd usbutils xxd zenity zip zlib1g-dev
        if [[ $(command -v systemctl 2>/dev/null) ]]; then
            sudo systemctl enable --now udev systemd-udevd usbmuxd 2>/dev/null
        fi

    elif [[ $distro == "fedora" ]]; then
        sudo dnf install -y ca-certificates git ifuse libimobiledevice libxml2 libzstd openssl openssl-devel patch python3 systemd udev usbmuxd vim-common zenity zip zlib-devel
        sudo dnf group install -y c-development
        sudo ln -sf /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-certificates.crt
        prepare_udev_rules root usbmuxd

    elif [[ $distro == "fedora-atomic" ]]; then
        rpm-ostree install patch vim-common zenity
        print "* You may need to reboot to apply changes with rpm-ostree. Perform a reboot after this before running the script again."

    elif [[ $distro == "opensuse" ]]; then
        sudo zypper -n install ca-certificates curl git ifuse libimobiledevice-1_0-6 libopenssl-3-devel libxml2 libzstd1 openssl-3 patch pyenv python3 usbmuxd unzip vim zenity zip zlib-devel
        sudo zypper -n install -t pattern devel_basis
        prepare_udev_rules usbmux usbmux # idk if this is right

    elif [[ $distro == "gentoo" ]]; then
        sudo emerge -av --noreplace app-arch/zstd app-misc/ca-certificates app-pda/ifuse dev-libs/libxml2 libimobiledevice net-misc/curl openssh python udev unzip usbmuxd usbutils vim zenity zip

    elif [[ $distro == "void" ]]; then
        sudo xbps-install curl git patch openssh python3 unzip xxd zenity zip base-devel libffi-devel bzip2-devel openssl openssl-devel readline readline-devel sqlite-devel xz liblzma-devel zlib zlib-devel

    elif [[ $platform == "macos" ]]; then
        print "* Legacy iOS Kit will be installing dependencies and setting up permissions of tools"
        xattr -cr ../bin/macos
        log "Installing Xcode Command Line Tools"
        xcode-select --install
        print "* Make sure to install requirements from Homebrew/MacPorts: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/How-to-Use"
        pause
    fi

    echo "$platform_ver" > "../resources/firstrun"
    if [[ $platform == "linux" && $distro != "fedora-atomic" ]]; then
        # from linux_fix and libirecovery-rules by Cryptiiiic
        if [[ $(command -v systemctl 2>/dev/null) ]]; then
            sudo systemctl enable --now systemd-udevd usbmuxd 2>/dev/null
        fi
        sudo cp 39-libirecovery.rules /etc/udev/rules.d/39-libirecovery.rules
        sudo chown root:root /etc/udev/rules.d/39-libirecovery.rules
        sudo chmod 0644 /etc/udev/rules.d/39-libirecovery.rules
        sudo udevadm control --reload-rules
        sudo udevadm trigger -s usb
    fi

    log "Install script done! Please run the script again to proceed"
    log "If your iOS device is plugged in, unplug and replug your device"
    exit
}

version_update_check() {
    pushd "$(dirname "$0")/tmp$$" >/dev/null
    if [[ $platform == "macos" && ! -e ../resources/firstrun ]]; then
        xattr -cr ../bin/macos
    fi
    log "Checking for updates..."
    github_api=$(curl https://api.github.com/repos/LukeZGD/Legacy-iOS-Kit/releases/latest 2>/dev/null)
    version_latest=$(echo "$github_api" | $jq -r '.assets[] | select(.name|test("complete")) | .name' | cut -c 25- | cut -c -9)
    git_hash_latest=$(echo "$github_api" | $jq -r '.assets[] | select(.name|test("git-hash")) | .name' | cut -c 21- | cut -c -7)
    popd >/dev/null
}

version_update() {
    local url
    local req
    read -p "$(input 'Do you want to update now? (Y/n): ')" opt
    if [[ $opt == 'n' || $opt == 'N' ]]; then
        exit
    fi
    if [[ -d .git ]]; then
        log "Running git pull..."
        print "* If this fails for some reason, run: git reset --hard"
        print "* To clean more files if needed, run: git clean -df"
        git pull
        pushd "$(dirname "$0")/tmp$$" >/dev/null
        log "Done! Please run the script again"
        exit
    elif (( $(ls bin | wc -l) > 1 )); then
        req=".assets[] | select (.name|test(\"complete\")) | .browser_download_url"
    elif [[ $platform == "linux" ]]; then
        req=".assets[] | select (.name|test(\"${platform}_$platform_arch\")) | .browser_download_url"
    else
        req=".assets[] | select (.name|test(\"${platform}\")) | .browser_download_url"
    fi
    pushd "$(dirname "$0")/tmp$$" >/dev/null
    url="$(echo "$github_api" | $jq -r "$req")"
    log "Downloading: $url"
    curl -L $url -o latest.zip
    if [[ ! -s latest.zip ]]; then
        error "Download failed. Please run the script again"
    fi
    popd >/dev/null
    log "Updating..."
    cp resources/firstrun tmp$$ 2>/dev/null
    rm -r bin/ LICENSE README.md restore.sh
    if [[ $device_sudoloop == 1 ]]; then
        sudo rm -rf resources/
    fi
    rm -r resources/ saved/ipwndfu/ 2>/dev/null
    unzip -q tmp$$/latest.zip -d .
    cp tmp$$/firstrun resources 2>/dev/null
    pushd "$(dirname "$0")/tmp$$" >/dev/null
    log "Done! Please run the script again"
    exit
}

version_get() {
    pushd .. >/dev/null
    if [[ -d .git ]]; then
        if [[ -e .git/shallow ]]; then
            log "Shallow git repository detected. Unshallowing..."
            git fetch --unshallow
        fi
        git_hash=$(git rev-parse HEAD | cut -c -7)
        local dm=$(git log -1 --format=%ci | cut -c 3- | cut -c -5)
        version_current=v${dm//-/.}.
        dm="20$dm"
        if [[ $(uname) == "Darwin" ]]; then
            dm="$(date -j -f "%Y-%m-%d %H:%M:%S" "${dm}-01 00:00:00" +%s)"
        else
            dm="$(date --date="${dm}-01" +%s)"
        fi
        dm=$((dm-1))
        version_current+=$(git rev-list --count HEAD --since=$dm | xargs printf "%02d")
    elif [[ -e ./resources/git_hash ]]; then
        version_current="$(cat ./resources/version)"
        git_hash="$(cat ./resources/git_hash)"
    else
        log ".git directory and git_hash file not found, cannot determine version."
        if [[ $no_version_check != 1 ]]; then
            warn "Your copy of Legacy iOS Kit is downloaded incorrectly. Do not use the \"Code\" button in GitHub."
            print "* Please download Legacy iOS Kit using git clone or from GitHub releases: https://github.com/LukeZGD/Legacy-iOS-Kit/releases"
        fi
    fi
    if [[ -n $version_current ]]; then
        print "* Version: $version_current ($git_hash)"
    fi
    popd >/dev/null
}

version_check() {
    if [[ $no_version_check == 1 ]]; then
        warn "No version check flag detected, update check is disabled and no support will be provided."
        return
    fi
    pushd .. >/dev/null
    version_update_check
    if [[ -z $version_latest ]]; then
        warn "Failed to check for updates. GitHub may be down or blocked by your network."
    elif [[ $git_hash_latest != "$git_hash" ]]; then
        if [[ -z $version_current ]]; then
            print "* Latest version:  $version_latest ($git_hash_latest)"
            print "* Please download/pull the latest version before proceeding."
            version_update
        elif (( $(echo $version_current | cut -c 2- | sed -e 's/\.//g') >= $(echo $version_latest | cut -c 2- | sed -e 's/\.//g') )); then
            warn "Current version is newer/different than remote: $version_latest ($git_hash_latest)"
        else
            print "* A newer version of Legacy iOS Kit is available."
            print "* Current version: $version_current ($git_hash)"
            print "* Latest version:  $version_latest ($git_hash_latest)"
            print "* Please download/pull the latest version before proceeding."
            version_update
        fi
    fi
    popd >/dev/null
}

device_entry() {
    # enable manual entry
    log "Manual device/ECID entry is enabled."
    until [[ -n $device_type ]]; do
        read -p "$(input 'Enter device type (eg. iPad2,1): ')" device_type
    done
    if [[ $device_type != "iPhone1"* && $device_type != "iPod1,1" ]]; then
        until [[ -n $device_ecid ]] && [ "$device_ecid" -eq "$device_ecid" ]; do
            read -p "$(input 'Enter device ECID (must be decimal): ')" device_ecid
        done
    fi
}

device_get_name() {
    device_name=$device_type
    case $device_type in
        "iPhone1,1") device_name="iPhone 2G";;
        "iPhone1,2") device_name="iPhone 3G";;
        "iPhone2,1") device_name="iPhone 3GS";;
        "iPhone3,1") device_name="iPhone 4 (GSM)";;
        "iPhone3,2") device_name="iPhone 4 (GSM, Rev A)";;
        "iPhone3,3") device_name="iPhone 4 (CDMA)";;
        "iPhone4,1") device_name="iPhone 4S";;
        "iPhone5,1") device_name="iPhone 5 (GSM)";;
        "iPhone5,2") device_name="iPhone 5 (Global)";;
        "iPhone5,3") device_name="iPhone 5C (GSM)";;
        "iPhone5,4") device_name="iPhone 5C (Global)";;
        "iPhone6,1") device_name="iPhone 5S (GSM)";;
        "iPhone6,2") device_name="iPhone 5S (Global)";;
        "iPhone7,1") device_name="iPhone 6 Plus";;
        "iPhone7,2") device_name="iPhone 6";;
        "iPhone8,1") device_name="iPhone 6S";;
        "iPhone8,2") device_name="iPhone 6S Plus";;
        "iPhone8,4") device_name="iPhone SE 2016";;
        "iPhone9,1") device_name="iPhone 7 (Global)";;
        "iPhone9,2") device_name="iPhone 7 Plus (Global)";;
        "iPhone9,3") device_name="iPhone 7 (GSM)";;
        "iPhone9,4") device_name="iPhone 7 Plus (GSM)";;
        "iPhone10,1") device_name="iPhone 8 (Global)";;
        "iPhone10,2") device_name="iPhone 8 Plus (Global)";;
        "iPhone10,3") device_name="iPhone X (Global)";;
        "iPhone10,4") device_name="iPhone 8 (GSM)";;
        "iPhone10,5") device_name="iPhone 8 Plus (GSM)";;
        "iPhone10,6") device_name="iPhone X (GSM)";;
        "iPhone11,2") device_name="iPhone XS";;
        "iPhone11,4") device_name="iPhone XS Max (China)";;
        "iPhone11,6") device_name="iPhone XS Max";;
        "iPhone11,8") device_name="iPhone XR";;
        "iPhone12,1") device_name="iPhone 11";;
        "iPhone12,3") device_name="iPhone 11 Pro";;
        "iPhone12,5") device_name="iPhone 11 Pro Max";;
        "iPhone12,8") device_name="iPhone SE 2020";;
        "iPhone13,1") device_name="iPhone 12 mini";;
        "iPhone13,2") device_name="iPhone 12";;
        "iPhone13,3") device_name="iPhone 12 Pro";;
        "iPhone13,4") device_name="iPhone 12 Pro Max";;
        "iPhone14,2") device_name="iPhone 13 Pro";;
        "iPhone14,3") device_name="iPhone 13 Pro Max";;
        "iPhone14,4") device_name="iPhone 13 mini";;
        "iPhone14,5") device_name="iPhone 13";;
        "iPhone14,6") device_name="iPhone SE 2022";;
        "iPhone14,7") device_name="iPhone 14";;
        "iPhone14,8") device_name="iPhone 14 Plus";;
        "iPhone15,2") device_name="iPhone 14 Pro";;
        "iPhone15,3") device_name="iPhone 14 Pro Max";;
        "iPhone15,4") device_name="iPhone 15";;
        "iPhone15,5") device_name="iPhone 15 Plus";;
        "iPhone16,1") device_name="iPhone 15 Pro";;
        "iPhone16,2") device_name="iPhone 15 Pro Max";;
        "iPhone17,1") device_name="iPhone 16 Pro";;
        "iPhone17,2") device_name="iPhone 16 Pro Max";;
        "iPhone17,3") device_name="iPhone 16";;
        "iPhone17,4") device_name="iPhone 16 Plus";;
        "iPad1,1") device_name="iPad 1";;
        "iPad2,1") device_name="iPad 2 (Wi-Fi)";;
        "iPad2,2") device_name="iPad 2 (GSM)";;
        "iPad2,3") device_name="iPad 2 (CDMA)";;
        "iPad2,4") device_name="iPad 2 (Wi-Fi, Rev A)";;
        "iPad2,5") device_name="iPad mini 1 (Wi-Fi)";;
        "iPad2,6") device_name="iPad mini 1 (GSM)";;
        "iPad2,7") device_name="iPad mini 1 (Global)";;
        "iPad3,1") device_name="iPad 3 (Wi-Fi)";;
        "iPad3,2") device_name="iPad 3 (CDMA)";;
        "iPad3,3") device_name="iPad 3 (GSM)";;
        "iPad3,4") device_name="iPad 4 (Wi-Fi)";;
        "iPad3,5") device_name="iPad 4 (GSM)";;
        "iPad3,6") device_name="iPad 4 (Global)";;
        "iPad4,1") device_name="iPad Air 1 (Wi-Fi)";;
        "iPad4,2") device_name="iPad Air 1 (Cellular)";;
        "iPad4,3") device_name="iPad Air 1 (China)";;
        "iPad4,4") device_name="iPad mini 2 (Wi-Fi)";;
        "iPad4,5") device_name="iPad mini 2 (Cellular)";;
        "iPad4,6") device_name="iPad mini 2 (China)";;
        "iPad4,7") device_name="iPad mini 3 (Wi-Fi)";;
        "iPad4,8") device_name="iPad mini 3 (Cellular)";;
        "iPad4,9") device_name="iPad mini 3 (China)";;
        "iPad5,1") device_name="iPad mini 4 (Wi-Fi)";;
        "iPad5,2") device_name="iPad mini 4 (Cellular)";;
        "iPad5,3") device_name="iPad Air 2 (Wi-Fi)";;
        "iPad5,4") device_name="iPad Air 2 (Cellular)";;
        "iPad6,3") device_name="iPad Pro 9.7\" (Wi-Fi)";;
        "iPad6,4") device_name="iPad Pro 9.7\" (Cellular)";;
        "iPad6,7") device_name="iPad Pro 12.9\" (Wi-Fi)";;
        "iPad6,8") device_name="iPad Pro 12.9\" (Cellular)";;
        "iPad6,11") device_name="iPad 5 (Wi-Fi)";;
        "iPad6,12") device_name="iPad 5 (Cellular)";;
        "iPad7,1") device_name="iPad Pro 12.9\" (2nd gen, Wi-Fi)";;
        "iPad7,2") device_name="iPad Pro 12.9\" (2nd gen, Cellular)";;
        "iPad7,3") device_name="iPad Pro 10.5\" (Wi-Fi)";;
        "iPad7,4") device_name="iPad Pro 10.5\" (Cellular)";;
        "iPad7,5") device_name="iPad 6 (Wi-Fi)";;
        "iPad7,6") device_name="iPad 6 (Cellular)";;
        "iPad7,11") device_name="iPad 7 (Wi-Fi)";;
        "iPad7,12") device_name="iPad 7 (Cellular)";;
        "iPad8,1") device_name="iPad Pro 11\" (Wi-Fi)";;
        "iPad8,2") device_name="iPad Pro 11\" (Wi-Fi, 6GB RAM)";;
        "iPad8,3") device_name="iPad Pro 11\" (Cellular)";;
        "iPad8,4") device_name="iPad Pro 11\" (Cellular, 6GB RAM)";;
        "iPad8,5") device_name="iPad Pro 12.9\" (3rd gen, Wi-Fi)";;
        "iPad8,6") device_name="iPad Pro 12.9\" (3rd gen, Wi-Fi, 6GB RAM)";;
        "iPad8,7") device_name="iPad Pro 12.9\" (3rd gen, Cellular)";;
        "iPad8,8") device_name="iPad Pro 12.9\" (3rd gen, Cellular, 6GB RAM)";;
        "iPad8,9") device_name="iPad Pro 11\" (2nd gen, Wi-Fi)";;
        "iPad8,10") device_name="iPad Pro 11\" (2nd gen, Cellular)";;
        "iPad8,11") device_name="iPad Pro 12.9\" (4th gen, Wi-Fi)";;
        "iPad8,12") device_name="iPad Pro 12.9\" (4th gen, Cellular)";;
        "iPad11,1") device_name="iPad mini 5 (Wi-Fi)";;
        "iPad11,2") device_name="iPad mini 5 (Cellular)";;
        "iPad11,3") device_name="iPad Air 3 (Wi-Fi)";;
        "iPad11,4") device_name="iPad Air 3 (Cellular)";;
        "iPad11,6") device_name="iPad 8 (Wi-Fi)";;
        "iPad11,7") device_name="iPad 8 (Cellular)";;
        "iPad12,1") device_name="iPad 9 (Wi-Fi)";;
        "iPad12,2") device_name="iPad 9 (Cellular)";;
        "iPad13,1") device_name="iPad Air 4 (Wi-Fi)";;
        "iPad13,2") device_name="iPad Air 4 (Cellular)";;
        "iPad13,4") device_name="iPad Pro 11\" (3rd gen, Wi-Fi)";;
        "iPad13,5") device_name="iPad Pro 11\" (3rd gen, Wi-Fi, 16GB RAM)";;
        "iPad13,6") device_name="iPad Pro 11\" (3rd gen, Cellular)";;
        "iPad13,7") device_name="iPad Pro 11\" (3rd gen, Cellular, 16GB RAM)";;
        "iPad13,8") device_name="iPad Pro 12.9\" (5th gen, Wi-Fi)";;
        "iPad13,9") device_name="iPad Pro 12.9\" (5th gen, Wi-Fi, 16GB RAM)";;
        "iPad13,10") device_name="iPad Pro 12.9\" (5th gen, Cellular)";;
        "iPad13,11") device_name="iPad Pro 12.9\" (5th gen, Cellular, 16GB RAM)";;
        "iPad13,16") device_name="iPad Air 5 (Wi-Fi)";;
        "iPad13,17") device_name="iPad Air 5 (Cellular)";;
        "iPad13,18") device_name="iPad 10 (Wi-Fi)";;
        "iPad13,19") device_name="iPad 10 (Cellular)";;
        "iPad14,1") device_name="iPad mini 6 (Wi-Fi)";;
        "iPad14,2") device_name="iPad mini 6 (Cellular)";;
        "iPad14,3") device_name="iPad Pro 11\" (4th gen, Wi-Fi)";;
        "iPad14,4") device_name="iPad Pro 11\" (4th gen, Cellular)";;
        "iPad14,5") device_name="iPad Pro 12.9\" (6th gen, Wi-Fi)";;
        "iPad14,6") device_name="iPad Pro 12.9\" (6th gen, Cellular)";;
        "iPad14,8") device_name="iPad Air 11\" (M2, Wi-Fi)";;
        "iPad14,9") device_name="iPad Air 11\" (M2, Cellular)";;
        "iPad14,10") device_name="iPad Air 13\" (M2, Wi-Fi)";;
        "iPad14,11") device_name="iPad Air 13\" (M2, Cellular)";;
        "iPad16,1") device_name="iPad mini (A17 Pro, Wi-Fi)";;
        "iPad16,2") device_name="iPad mini (A17 Pro, Cellular)";;
        "iPad16,3") device_name="iPad Pro 11\" (M4, Wi-Fi)";;
        "iPad16,4") device_name="iPad Pro 11\" (M4, Cellular)";;
        "iPad16,5") device_name="iPad Pro 12.9\" (M4, Wi-Fi)";;
        "iPad16,6") device_name="iPad Pro 12.9\" (M4, Cellular)";;
        "iPod1,1") device_name="iPod touch";;
        "iPod2,1") device_name="iPod touch 2";;
        "iPod3,1") device_name="iPod touch 3";;
        "iPod4,1") device_name="iPod touch 4";;
        "iPod5,1") device_name="iPod touch 5";;
        "iPod7,1") device_name="iPod touch 6";;
        "iPod9,1") device_name="iPod touch 7";;
    esac
}

device_manufacturing() {
    if [[ $device_type != "iPhone2,1" && $device_type != "iPod2,1" ]] || [[ $device_argmode == "none" ]]; then
        return
    fi
    if [[ $device_type == "iPhone2,1" && $device_mode != "DFU" ]]; then
        local week=$(echo "$device_serial" | cut -c 2-)
        local year=$(echo "$device_serial" | cut -c 1)
        case $year in
            9 ) year="2009";;
            0 ) year="2010";;
            1 ) year="2011";;
            2 ) year="2012";;
        esac
        if [[ $year != "2009" ]] || (( week >= 46 )); then
            device_newbr=1
        elif [[ $year == "2009" ]] && (( week >= 40 )); then
            device_newbr=2 # gray area
        else
            device_newbr=0
        fi
    elif [[ $device_type == "iPod2,1" && $device_mode == "Recovery" ]]; then
        device_newbr=2
        return
    fi
    case $device_newbr in
        0 ) print "* This $device_name is an old bootrom model";;
        1 ) print "* This $device_name is a new bootrom model";;
        2 ) print "* This $device_name bootrom model cannot be determined. Enter DFU mode to get bootrom model";;
    esac
    if [[ $device_type == "iPhone2,1" && $device_mode == "DFU" ]]; then
        print "* Cannot check for manufacturing date in DFU mode"
    elif [[ $device_type == "iPhone2,1" ]]; then
        print "* Manufactured in Week $week $year"
    fi
}

device_s5l8900xall() {
    local wtf_sha="cb96954185a91712c47f20adb519db45a318c30f"
    local wtf_saved="../saved/WTF.s5l8900xall.RELEASE.dfu"
    local wtf_patched="$wtf_saved.patched"
    local wtf_patch="../resources/patch/WTF.s5l8900xall.RELEASE.patch"
    local wtf_sha_local="$($sha1sum "$wtf_saved" 2>/dev/null | awk '{print $1}')"
    mkdir ../saved 2>/dev/null
    if [[ $wtf_sha_local != "$wtf_sha" ]]; then
        log "Downloading WTF.s5l8900xall"
        "$dir/pzb" -g "Firmware/dfu/WTF.s5l8900xall.RELEASE.dfu" -o WTF.s5l8900xall.RELEASE.dfu "http://appldnld.apple.com/iPhone/061-7481.20100202.4orot/iPhone1,1_3.1.3_7E18_Restore.ipsw"
        rm -f "$wtf_saved"
        mv WTF.s5l8900xall.RELEASE.dfu $wtf_saved
    fi
    wtf_sha_local="$($sha1sum "$wtf_saved" | awk '{print $1}')"
    if [[ $wtf_sha_local != "$wtf_sha" ]]; then
        error "SHA1sum mismatch. Expected $wtf_sha, got $wtf_sha_local. Please run the script again"
    fi
    rm -f "$wtf_patched"
    log "Patching WTF.s5l8900xall"
    $bspatch $wtf_saved $wtf_patched $wtf_patch
    log "Sending patched WTF.s5l8900xall (Pwnage)"
    $irecovery -f "$wtf_patched"
    device_find_mode DFUreal
    sleep 1
}

device_get_info() {
    : '
    usage: device_get_info (no arguments)
    sets the variables: device_mode, device_type, device_ecid, device_vers, device_udid, device_model, device_fw_dir,
    device_use_vers, device_use_build, device_use_bb, device_use_bb_sha1, device_latest_vers, device_latest_build,
    device_latest_bb, device_latest_bb_sha1, device_proc
    '

    if [[ $device_argmode == "none" ]]; then
        log "No device mode is enabled."
        device_mode="none"
        device_vers="Unknown"
    else
        log "Finding device in Normal mode..."
        if [[ $platform == "linux" ]]; then
            print "* If it gets stuck here, try to restart your PC"
            if [[ $othertmp != 0 ]]; then
                print "* If it fails to detect devices, try to delete all \"tmp\" folders in your Legacy iOS Kit folder"
            fi
        fi
    fi

    $ideviceinfo -s >/dev/null
    if [[ $? == 0 ]]; then
        device_mode="Normal"
    else
        $ideviceinfo >/dev/null
        if [[ $? == 0 ]]; then
            device_mode="Normal"
        fi
    fi

    if [[ -z $device_mode ]]; then
        log "Finding device in Recovery/DFU mode..."
        device_mode="$($irecovery -q | grep -w "MODE" | cut -c 7-)"
    fi

    if [[ $device_mode == "Recovery" && $device_pwnrec == 1 ]]; then
        device_mode="DFU"
    fi

    if [[ -z $device_mode ]]; then
        local error_msg=$'* Make sure to trust this computer by selecting "Trust" at the pop-up.'
        if [[ $platform == "macos" ]]; then
            error_msg+=$'\n* Make sure to have the initial setup dependencies installed before retrying.'
            error_msg+=$'\n* Double-check if the device is being detected by iTunes/Finder.'
        else
            error_msg+=$'\n* If your device in normal mode is not being detected, this is likely a usbmuxd issue.'
            error_msg+=$'\n* You may also try again in a live USB.'
        fi
        error_msg+=$'\n* Try restarting your PC/Mac as well as using different USB ports/cables.'
        error_msg+=$'\n* For more details, read the "Troubleshooting" wiki page in GitHub.\n* Troubleshooting link: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Troubleshooting'
        error "No device found! Please connect the iOS device to proceed." "$error_msg"
    fi

    log "Getting device info..."
    if [[ $device_mode == "WTF" ]]; then
        device_proc=1
        device_wtfexit=1
        device_s5l8900xall
    fi
    case $device_mode in
        "DFU" | "Recovery" )
            if [[ -n $device_argmode ]]; then
                device_entry
            else
                device_type=$($irecovery -q | grep "PRODUCT" | cut -c 10-)
                device_ecid=$(printf "%d" $($irecovery -q | grep "ECID" | cut -c 7-)) # converts hex ecid to dec
            fi
            if [[ $device_type == "iPhone1,1" && -z $device_argmode ]]; then
                print "* Device Type Option"
                print "* Select Y if the device is an iPhone 2G, or N if it is an iPod touch 1"
                read -p "$(input 'Is this device an iPhone 2G? (Y/n): ')" opt
                if [[ $opt == 'n' || $opt == 'N' ]]; then
                    device_type="iPod1,1"
                fi
            fi
            device_model=$($irecovery -q | grep "MODEL" | cut -c 8-)
            device_vers=$(echo "/exit" | $irecovery -s | grep -a "iBoot-")
            if [[ -z $device_vers ]]; then
                device_vers="Unknown"
                if [[ $device_mode == "Recovery" ]]; then
                    device_vers+=". Re-enter recovery mode to get iBoot version"
                fi
            fi
            device_serial="$($irecovery -q | grep "SRNM" | cut -c 7- | cut -c 3- | cut -c -3)"
            device_get_name
            print "* Device: $device_name (${device_type} - ${device_model}) in $device_mode mode"
            print "* iOS Version: $device_vers"
            print "* ECID: $device_ecid"
            device_manufacturing
            if [[ $device_type == "iPod2,1" && $device_newbr != 2 ]]; then
                device_newbr="$($irecovery -q | grep -c '240.5.1')"
            elif [[ $device_type == "iPhone2,1" ]]; then
                device_newbr="$($irecovery -q | grep -c '359.3.2')"
            fi
            device_pwnd="$($irecovery -q | grep "PWND" | cut -c 7-)"
        ;;

        "Normal" )
            if [[ -n $device_argmode ]]; then
                device_entry
            else
                device_type=$($ideviceinfo -s -k ProductType)
                [[ -z $device_type ]] && device_type=$($ideviceinfo -k ProductType)
                device_ecid=$($ideviceinfo -s -k UniqueChipID)
            fi
            device_model=$($ideviceinfo -s -k HardwareModel)
            device_vers=$($ideviceinfo -s -k ProductVersion)
            device_det=$(echo "$device_vers" | cut -c 1)
            device_build=$($ideviceinfo -s -k BuildVersion)
            device_udid=$($ideviceinfo -s -k UniqueDeviceID)
            [[ -z $device_udid ]] && device_udid=$($ideviceinfo -k UniqueDeviceID)
            if [[ $device_type == "iPod2,1" ]]; then
                device_newbr="$($ideviceinfo -k ModelNumber | grep -c 'C')"
            elif [[ $device_type == "iPhone2,1" ]]; then
                device_serial="$($ideviceinfo -k SerialNumber | cut -c 3- | cut -c -3)"
            fi
            device_unactivated=$($ideviceactivation state | grep -c "Unactivated")
        ;;
    esac

    if [[ $device_argmode == "none" ]]; then
        device_entry
    fi

    device_model="$(echo $device_model | tr '[:upper:]' '[:lower:]')"
    device_model="${device_model%??}" # remove "ap" from the end
    if [[ -z $device_type && -n $device_model ]]; then
        # device_model fallback
        case $device_model in
            k48  ) device_type="iPad1,1";;
            k93  ) device_type="iPad2,1";;
            k94  ) device_type="iPad2,2";;
            k95  ) device_type="iPad2,3";;
            k93a ) device_type="iPad2,4";;
            p105 ) device_type="iPad2,5";;
            p106 ) device_type="iPad2,6";;
            p107 ) device_type="iPad2,7";;
            j1   ) device_type="iPad3,1";;
            j2   ) device_type="iPad3,2";;
            j2a  ) device_type="iPad3,3";;
            p101 ) device_type="iPad3,4";;
            p102 ) device_type="iPad3,5";;
            p103 ) device_type="iPad3,6";;
            j71  ) device_type="iPad4,1";;
            j72  ) device_type="iPad4,2";;
            j73  ) device_type="iPad4,3";;
            j85  ) device_type="iPad4,4";;
            j86  ) device_type="iPad4,5";;
            j87  ) device_type="iPad4,6";;
            j85m ) device_type="iPad4,7";;
            j86m ) device_type="iPad4,8";;
            j87m ) device_type="iPad4,9";;
            j96  ) device_type="iPad5,1";;
            j97  ) device_type="iPad5,2";;
            j81  ) device_type="iPad5,3";;
            j82  ) device_type="iPad5,4";;
            m68  ) device_type="iPhone1,1";;
            n82  ) device_type="iPhone1,2";;
            n88  ) device_type="iPhone2,1";;
            n90  ) device_type="iPhone3,1";;
            n90b ) device_type="iPhone3,2";;
            n92  ) device_type="iPhone3,3";;
            n94  ) device_type="iPhone4,1";;
            n41  ) device_type="iPhone5,1";;
            n42  ) device_type="iPhone5,2";;
            n48  ) device_type="iPhone5,3";;
            n49  ) device_type="iPhone5,4";;
            n51  ) device_type="iPhone6,1";;
            n53  ) device_type="iPhone6,2";;
            n56  ) device_type="iPhone7,1";;
            n61  ) device_type="iPhone7,2";;
            n71  ) device_type="iPhone8,1";;
            n71m ) device_type="iPhone8,1";;
            n66  ) device_type="iPhone8,2";;
            n66m ) device_type="iPhone8,2";;
            n69  ) device_type="iPhone8,4";;
            n69u ) device_type="iPhone8,4";;
            d10  ) device_type="iPhone9,1";;
            d11  ) device_type="iPhone9,2";;
            d101 ) device_type="iPhone9,3";;
            d111 ) device_type="iPhone9,4";;
            n45  ) device_type="iPod1,1";;
            n72  ) device_type="iPod2,1";;
            n18  ) device_type="iPod3,1";;
            n81  ) device_type="iPod4,1";;
            n78  ) device_type="iPod5,1";;
            n102 ) device_type="iPod7,1";;
            n112 ) device_type="iPod9,1";;
        esac
    fi

    device_fw_dir="../resources/firmware/$device_type"
    if [[ -s $device_fw_dir/hwmodel ]]; then
        device_model="$(cat $device_fw_dir/hwmodel)"
    fi
    all_flash="Firmware/all_flash/all_flash.${device_model}ap.production"
    device_use_bb=0
    device_latest_bb=0
    # set device_proc (what processor the device has)
    case $device_type in
        iPhone1,[12] | iPod1,1 )
            device_proc=1;; # S5L8900
        iPhone3,[123] | iPhone2,1 | iPad1,1 | iPod[234],1 )
            device_proc=4;; # A4/S5L8720/8920/8922
        iPad2,[1234567] | iPad3,[123] | iPhone4,1 | iPod5,1 )
            device_proc=5;; # A5
        iPad3,[456] | iPhone5,[1234] )
            device_proc=6;; # A6
        iPad4,[123456789] | iPhone6,[12] )
            device_proc=7;; # A7
        iPhone7,[12] | iPad5,[1234] | iPod7,1 )
            device_proc=8;; # A8
        iPhone8,[124] )
            device_proc=9;; # A9
        iPhone9,[1234] | iPhone10* | iPad[67]* | iPod9,1 )
            device_proc=10;; # A10 (or A9/A10 iPad/A11 device)
        iPhone* | iPad* )
            device_proc=11;; # Newer devices
    esac
    case $device_type in
        iPad7* ) device_checkm8ipad=1;;
    esac
    device_get_name
    if (( device_proc > 10 )); then
        print "* Device: $device_name (${device_type} - ${device_model}ap) in $device_mode mode"
        print "* iOS Version: $device_vers"
        print "* ECID: $device_ecid"
        echo
        warn "This device is not supported by Legacy iOS Kit."
        print "* You may still continue but features will be very limited."
        pause
    elif [[ -z $device_proc ]]; then
        error "Unrecognized device $device_type. Enter the device type properly."
    fi

    if [[ $device_mode == "DFU" && $device_proc == 1 && $device_wtfexit != 1 ]]; then
        log "Found an S5L8900 device in DFU mode. Please re-enter WTF mode for good measure."
        print "* Force restart your device and place it in normal or recovery mode, then run the script again."
        exit
    fi

    # set device_use_vers, device_use_build (where to get the baseband and manifest from for ota/other)
    # for a7/a8 other restores 11.3+, device_latest_vers and device_latest_build are used
    case $device_type in
        iPhone1,1 | iPod1,1 )
            device_use_vers="3.1.3"
            device_use_build="7E18"
        ;;
        iPhone1,2 | iPod2,1 )
            device_use_vers="4.2.1"
            device_use_build="8C148"
        ;;
        iPad1,1 | iPod3,1 )
            device_use_vers="5.1.1"
            device_use_build="9B206"
        ;;
        iPhone2,1 | iPod4,1 )
            device_use_vers="6.1.6"
            device_use_build="10B500"
        ;;
        iPhone3,[123] )
            device_use_vers="7.1.2"
            device_use_build="11D257"
        ;;
        iPad2,[1245] | iPad3,1 | iPod5,1 )
            device_use_vers="9.3.5"
            device_use_build="13G36"
        ;;
        iPad2,[367] | iPad3,[23] | iPhone4,1 )
            device_use_vers="9.3.6"
            device_use_build="13G37"
        ;;
        iPad3,[56] | iPhone5,[12] )
            device_use_vers="10.3.4"
            device_use_build="14G61"
        ;;
        iPad3,4 | iPad4,[12345] | iPhone5,[34] | iPhone6,[12] )
            device_use_vers="10.3.3"
            device_use_build="14G60"
        ;;
    esac
    case $device_type in
        iPad4,[123456789] | iPhone6,[12] | iPhone7,[12] | iPod7,1 )
            device_latest_vers="12.5.7"
            device_latest_build="16H81"
        ;;
        iPad5* | iPhone[89]* | iPod9,1 )
            device_latest_vers="15.8.3"
            device_latest_build="19H386"
        ;;
        iPad6* | iPhone10* )
            device_latest_vers="16.7.10"
            device_latest_build="20H350"
        ;;
        iPad7* )
            log "Getting latest iOS version for $device_type"
            local latestver="$(curl "https://api.ipsw.me/v4/device/$device_type?type=ipsw" | $jq -j ".firmwares[0]")"
            device_latest_vers="$(echo "$latestver" | $jq -j ".version")"
            device_latest_build="$(echo "$latestver" | $jq -j ".buildid")"
        ;;
    esac
    # set device_use_bb, device_use_bb_sha1 (what baseband to use for ota/other)
    # for a7/a8 other restores 11.3+, device_latest_bb and device_latest_bb_sha1 are used instead
    case $device_type in
        iPhone4,1 ) # MDM6610
            device_use_bb="Trek-6.7.00.Release.bbfw"
            device_use_bb_sha1="22a35425a3cdf8fa1458b5116cfb199448eecf49"
        ;;
        iPad2,[67] ) # MDM9615 9.3.6 (32bit)
            device_use_bb="Mav5-11.80.00.Release.bbfw"
            device_use_bb_sha1="aa52cf75b82fc686f94772e216008345b6a2a750"
        ;;
        iPhone5,[12] | iPad3,[56] ) # MDM9615 10.3.4 (32bit)
            device_use_bb="Mav5-11.80.00.Release.bbfw"
            device_use_bb_sha1="8951cf09f16029c5c0533e951eb4c06609d0ba7f"
        ;;
        iPad4,[235] | iPhone5,[34] | iPhone6,[12] ) # MDM9615 10.3.3 (5C, 5S, air, mini2)
            device_use_bb="Mav7Mav8-7.60.00.Release.bbfw"
            device_use_bb_sha1="f397724367f6bed459cf8f3d523553c13e8ae12c"
        ;;
        iPad1,1 | iPhone[123],* ) device_use_bb2=1;;
        iPad[23],[23] ) device_use_bb2=2;;
    esac
    case $device_type in
        iPad4,[235689] | iPhone6,[12] ) # MDM9615 12.4-latest
            device_latest_bb="Mav7Mav8-10.80.02.Release.bbfw"
            device_latest_bb_sha1="f5db17f72a78d807a791138cd5ca87d2f5e859f0"
        ;;
    esac
    # disable baseband update if var is set to 1 (manually disabled w/ --disable-bbupdate arg)
    if [[ $device_disable_bbupdate == 1 ]]; then
        device_disable_bbupdate="$device_type"
    fi
    # if latest vers is not set, copy use vers to latest
    if [[ -z $device_latest_vers || -z $device_latest_build ]]; then
        device_latest_vers=$device_use_vers
        device_latest_build=$device_use_build
        device_latest_bb=$device_use_bb
        device_latest_bb_sha1=$device_use_bb_sha1
    fi
}

device_find_mode() {
    # usage: device_find_mode {DFU,Recovery,Restore} {Timeout (default: 24 for linux, 4 for other)}
    # finds device in given mode, and sets the device_mode variable
    local usb
    local timeout=4
    local i=0
    local device_in
    local mode="$1"
    local wtfreal

    if [[ $mode == "Restore" ]]; then
        :
    elif [[ $mode == "Recovery" ]]; then
        usb=1281
    elif [[ $device_proc == 1 ]]; then
        usb=1222
        if [[ $mode == "DFUreal" ]]; then
            mode="DFU"
            usb=1227
        elif [[ $mode == "WTFreal" ]]; then
            mode="WTF"
            wtfreal=1
        elif [[ $mode == "DFU" ]]; then
            mode="WTF"
        fi
    else
        usb=1227
    fi

    if [[ -n $2 ]]; then
        timeout=$2
    elif [[ $platform == "linux" ]]; then
        timeout=24
    fi

    log "Finding device in $mode mode..."
    while (( i < timeout )); do
        if [[ $mode == "Restore" ]]; then
            if [[ $platform == "macos" ]]; then
                opt="$(system_profiler SPUSBDataType 2> /dev/null | grep -B1 'Vendor ID: 0x05ac' | grep 'Product ID:' | cut -dx -f2 | cut -d' ' -f1 | tail -r)"
            elif [[ $platform == "linux" ]]; then
                opt="$(lsusb | cut -d' ' -f6 | grep '05ac:' | cut -d: -f2)"
            fi
            case $opt in
                12[9a][0123456789abcdef] ) device_in=1;; # normal
            esac
        elif [[ $platform == "linux" ]]; then
            device_in=$(lsusb | grep -c "05ac:$usb")
        elif [[ $($irecovery -q 2>/dev/null | grep -w "MODE" | cut -c 7-) == "$mode" ]]; then
            device_in=1
        fi

        if [[ $device_in == 1 ]]; then
            log "Found device in $mode mode."
            device_mode="$mode"
            break
        fi
        sleep 1
        ((i++))
    done

    if [[ $device_in != 1 ]]; then
        if [[ $timeout != 1 && $timeout != 20 ]]; then
            error "Failed to find device in $mode mode (Timed out). Please run the script again."
        fi
        return 1
    elif [[ $mode == "WTF" && $wtfreal != 1 ]]; then
        device_s5l8900xall
    fi
}

device_sshpass() {
    # ask for device password and use sshpass for scp and ssh
    local pass=$1
    if [[ -z $pass ]]; then
        read -s -p "$(input 'Enter the root password of your iOS device: ')" pass
        echo
    fi
    if [[ -z $pass ]]; then
        pass="alpine"
    fi
    scp="$dir/sshpass -p $pass $scp2"
    ssh="$dir/sshpass -p $pass $ssh2"
}

device_iproxy() {
    local port=22
    log "Running iproxy for SSH..."
    if [[ -n $2 ]]; then
        port=$2
    fi
    if [[ $1 == "no-logging" && $debug_mode != 1 ]]; then
        "$dir/iproxy" $ssh_port $port >/dev/null &
        iproxy_pid=$!
    else
        "$dir/iproxy" $ssh_port $port &
        iproxy_pid=$!
    fi
    log "iproxy PID: $iproxy_pid"
    sleep 1
}

device_find_all() {
    # find device stuff from palera1n legacy
    local opt
    if [[ $1 == "norec" || $platform == "macos" ]]; then
        return
    fi
    if [[ $platform == "macos" ]]; then
        opt="$(system_profiler SPUSBDataType 2> /dev/null | grep -B1 'Vendor ID: 0x05ac' | grep 'Product ID:' | cut -dx -f2 | cut -d' ' -f1 | tail -r)"
    elif [[ $platform == "linux" ]]; then
        opt="$(lsusb | cut -d' ' -f6 | grep '05ac:' | cut -d: -f2)"
    fi
    case $opt in
        1227 ) return 1;; # dfu
        1281 ) return 2;; # recovery
        1222 ) return 3;; # wtf
        12[9a][0123456789abcdef] ) return 4;; # normal
    esac
}

device_dfuhelper2() {
    local top="SIDE"
    if [[ $device_type == "iPad"* ]]; then
        top="TOP"
    fi
    echo
    print "* Press the VOL UP button now."
    sleep 1
    print "* Press the VOL DOWN button now."
    sleep 1
    print "* Press and hold the $top button."
    for i in {10..01}; do
        echo -n "$i "
        sleep 1
    done
    echo -e "\n$(print "* Press and hold VOL DOWN and $top buttons.")"
    for i in {05..01}; do
        echo -n "$i "
        sleep 1
    done
    echo -e "\n$(print "* Release $top button and keep holding VOL DOWN button.")"
    for i in {08..01}; do
        echo -n "$i "
        device_find_all $1
        opt=$?
        if [[ $opt == 1 ]]; then
            echo -e "\n$(log 'Found device in DFU mode.')"
            device_mode="DFU"
            return
        fi
        sleep 1
    done
    echo
    device_find_mode DFU
}

device_dfuhelper() {
    local opt
    local rec="recovery mode "
    if [[ $1 == "norec" ]]; then
        rec=
    fi
    if [[ $device_mode == "DFU" ]]; then
        log "Device is already in DFU mode"
        return
    fi
    print "* DFU Mode Helper - Get ready to enter DFU mode."
    print "* If you already know how to enter DFU mode, you may do so right now before continuing."
    read -p "$(input "Select Y to continue, N to exit $rec(Y/n) ")" opt
    if [[ $opt == 'N' || $opt == 'n' ]]; then
        if [[ -z $1 ]]; then
            log "Attempting to exit Recovery mode."
            $irecovery -n
        fi
        exit
    fi
    device_find_all $1
    opt=$?
    if [[ $opt == 1 ]]; then
        log "Found device in DFU mode."
        device_mode="DFU"
        return
    fi
    print "* Get ready..."
    for i in {03..01}; do
        echo -n "$i "
        sleep 1
    done
    case $device_type in
        iPhone1,* | iPad1,1 | iPad1[12]* ) :;;
        iPhone1* | iPad[81]* ) device_dfuhelper2; return;;
    esac
    local top="TOP"
    local home="HOME"
    case $device_type in
        iPhone7* | iPhone8,[12] | iPhone9* ) top="SIDE";;
    esac
    if [[ $device_type == "iPhone9"* || $device_type == "iPod9,1" ]]; then
        home="VOL DOWN"
    fi
    echo -e "\n$(print "* Hold $top and $home buttons.")"
    if [[ $device_proc == 1 ]]; then
        for i in {10..01}; do
            echo -n "$i "
            sleep 1
        done
    else
        for i in {08..01}; do
            echo -n "$i "
            device_find_all $1
            opt=$?
            if [[ $opt == 1 ]]; then
                echo -e "\n$(log 'Found device in DFU mode.')"
                device_mode="DFU"
                return
            fi
            sleep 1
        done
    fi
    echo -e "\n$(print "* Release $top button and keep holding $home button.")"
    for i in {08..01}; do
        echo -n "$i "
        device_find_all $1
        opt=$?
        if [[ $opt == 1 ]]; then
            echo -e "\n$(log 'Found device in DFU mode.')"
            device_mode="DFU"
            return
        fi
        sleep 1
    done
    echo
    if [[ $2 == "WTFreal" ]]; then
        device_find_mode WTFreal
    else
        device_find_mode DFU
    fi
}

device_enter_mode() {
    # usage: device_enter_mode {Recovery, DFU, kDFU, pwnDFU}
    # attempt to enter given mode, and device_find_mode function will then set device_mode variable
    local opt
    case $1 in
        "WTFreal" )
            if [[ $device_mode == "WTF" ]]; then
                return
            elif [[ $device_mode == "Normal" ]]; then
                device_enter_mode Recovery
            fi
            if [[ $device_mode == "Recovery" ]]; then
                device_dfuhelper norec WTFreal
                return
            fi
            log "Found an S5L8900 device in $device_mode mode. Your device needs to be in WTF mode to continue."
            print "* Force restart your device and place it in normal or recovery mode, then re-enter WTF mode."
            print "* You can enter WTF mode by doing the DFU mode procedure."
            device_find_mode WTFreal 100
        ;;

        "Recovery" )
            if [[ $device_mode == "Normal" ]]; then
                print "* The device needs to be in recovery/DFU mode before proceeding."
                read -p "$(input 'Send device to recovery mode? (Y/n): ')" opt
                if [[ $opt == 'n' || $opt == 'N' ]]; then
                    exit
                fi
                log "Entering recovery mode..."
                print "* If the device does not enter recovery mode automatically:"
                print "* Press Ctrl+C to cancel for now and try putting the device in DFU/Recovery mode manually"
                "$dir/ideviceenterrecovery" "$device_udid" >/dev/null
                device_find_mode Recovery 50
            fi
        ;;

        "DFU" )
            if [[ $device_mode == "Normal" ]]; then
                device_enter_mode Recovery
            elif [[ $device_mode == "WTF" ]]; then
                device_s5l8900xall
                return
            elif [[ $device_mode == "DFU" ]]; then
                return
            fi
            device_dfuhelper
        ;;

        "kDFU" )
            local sendfiles=()
            local ip="127.0.0.1"

            if [[ $device_mode != "Normal" ]]; then
                device_enter_mode pwnDFU
                return
            fi

            patch_ibss
            device_iproxy

            log "Please read the message below:"
            print "* Follow these instructions to enter kDFU mode."
            print "1. Install \"OpenSSH\" in Cydia or Zebra."
            if [[ $device_det == 1 ]]; then
                print "  - Jailbreak with socket: https://github.com/staturnzz/socket"
                print "  - Also install \"Dropbear\" from my repo: https://lukezgd.github.io/repo"
            fi
            print "  - After installing these requirements, lock your device."
            print "2. You will be prompted to enter the root password of your iOS device."
            print "  - The default root password is: alpine"
            print "  - Your password input will not be visible, but it is still being entered."
            print "3. On entering kDFU mode, the device will disconnect."
            print "  - Proceed to unplug and replug the device when prompted."
            print "  - Alternatively, press the TOP or HOME button."
            pause

            echo "chmod +x /tmp/kloader*" > kloaders
            if [[ $device_det == 1 ]]; then
                echo '[[ $(uname -a | grep -c "MarijuanARM") == 1 ]] && /tmp/kloader_hgsp /tmp/pwnediBSS || \
                /tmp/kloader /tmp/pwnediBSS' >> kloaders
                sendfiles+=("../resources/kloader/kloader_hgsp" "../resources/kloader/kloader")
            elif (( device_det <= 5 )); then
                opt="kloader_axi0mX"
                case $device_type in
                    iPad2,4 | iPad3* ) opt="kloader5";; # needed for ipad 3 ios 5, unsure for ipad2,4
                esac
                log "Using $opt for $device_type iOS $device_det"
                echo "/tmp/$opt /tmp/pwnediBSS" >> kloaders
                sendfiles+=("../resources/kloader/$opt")
            else
                echo "/tmp/kloader /tmp/pwnediBSS" >> kloaders
                sendfiles+=("../resources/kloader/kloader")
            fi
            sendfiles+=("kloaders" "pwnediBSS")

            device_sshpass
            log "Entering kDFU mode..."
            print "* This may take a while, but should not take longer than a minute."
            log "Sending files to device: ${sendfiles[*]}"
            if [[ $device_det == 1 ]]; then
                for file in "${sendfiles[@]}"; do
                    cat $file | $ssh -p $ssh_port root@127.0.0.1 "cat > /tmp/$(basename $file)" &>scp.log &
                done
                sleep 3
                cat scp.log
                check="$(cat scp.log | grep -c "Connection reset")"
            else
                $scp -P $ssh_port ${sendfiles[@]} root@127.0.0.1:/tmp
                check=$?
            fi
            if [[ $check == 0 ]]; then
                log "Running kloader"
                $ssh -p $ssh_port root@127.0.0.1 "bash /tmp/kloaders" &
            else
                warn "Failed to connect to device via USB SSH."
                if [[ $device_det == 1 ]]; then
                    print "* Try to re-install both OpenSSH and Dropbear, reboot, re-jailbreak, and try again."
                    print "* Alternatively, place your device in DFU mode (see \"Troubleshooting\" wiki page for details)"
                    print "* Troubleshooting link: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Troubleshooting#dfu-advanced-menu-for-32-bit-devices"
                elif [[ $device_det == 5 ]]; then
                    print "* Try to re-install OpenSSH, reboot, and try again."
                else
                    print "* Try to re-install OpenSSH, reboot, re-jailbreak, and try again."
                    print "* Alternatively, you may use kDFUApp from my Cydia repo (see \"Troubleshooting\" wiki page for details)"
                    print "* Troubleshooting link: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Troubleshooting#dfu-advanced-menu-kdfu-mode"
                fi
                input "Press Enter/Return to try again with Wi-Fi SSH (or press Ctrl+C to cancel and try again)"
                read -s
                log "Trying again with Wi-Fi SSH..."
                print "* Make sure that your iOS device and PC/Mac are on the same network."
                print "* To get your iOS device's IP Address, go to: Settings -> Wi-Fi/WLAN -> tap the 'i' or '>' next to your network name"
                ip=
                until [[ -n $ip ]]; do
                    read -p "$(input 'Enter the IP Address of your device: ')" ip
                done
                log "Sending files to device: ${sendfiles[*]}"
                $scp ${sendfiles[@]} root@$ip:/tmp
                if [[ $? != 0 ]]; then
                    error "Failed to connect to device via SSH, cannot continue."
                fi
                log "Running kloader"
                $ssh root@$ip "bash /tmp/kloaders" &
            fi

            local attempt=1
            local device_in
            local port
            if [[ $ip == "127.0.0.1" ]]; then
                port="-p $ssh_port"
            fi
            while (( attempt <= 5 )); do
                log "Finding device in kDFU mode... (Attempt $attempt of 5)"
                if [[ $($irecovery -q 2>/dev/null | grep -w "MODE" | cut -c 7-) == "DFU" ]]; then
                    device_in=1
                fi
                if [[ $device_in == 1 ]]; then
                    log "Found device in kDFU mode."
                    device_mode="DFU"
                    break
                fi
                if [[ $opt == "kloader_axi0mX" ]]; then
                    print "* Keep the device plugged in"
                    $ssh $port root@$ip "bash /tmp/kloaders" &
                else
                    print "* Unplug and replug your device now"
                fi
                ((attempt++))
            done
            if (( attempt > 5 )); then
                error "Failed to find device in kDFU mode. Please run the script again"
            fi
            kill $iproxy_pid
        ;;

        "pwnDFU" )
            local irec_pwned
            local tool_pwned
            local tool_ipwndfu

            if [[ $device_skip_ibss == 1 ]]; then
                warn "Skip iBSS flag detected, skipping pwned DFU check. Proceed with caution"
                return
            elif [[ $device_pwnrec == 1 ]]; then
                warn "Pwned recovery flag detected, skipping pwned DFU check. Proceed with caution"
                return
            elif [[ $device_proc == 1 ]]; then
                device_enter_mode DFU
                return
            fi
            if [[ $device_mode == "DFU" ]]; then
                device_pwnd="$($irecovery -q | grep "PWND" | cut -c 7-)"
            fi
            if [[ $device_mode == "DFU" && $mode != "pwned-ibss" &&
                  $device_boot4 != 1 && $device_proc == 5 ]]; then
                print "* Select Y if your device is in pwned iBSS/kDFU mode."
                print "* Select N if this is not the case. (pwned using checkm8-a5)"
                print "* Failing to answer correctly will cause \"Sending iBEC\" to fail."
                read -p "$(input 'Is your device already in pwned iBSS/kDFU mode? (y/N): ')" opt
                if [[ $opt == "Y" || $opt == "y" ]]; then
                    log "Pwned iBSS/kDFU mode specified by user."
                    return
                fi
            elif [[ -n $device_pwnd ]]; then
                log "Device seems to be already in pwned DFU mode"
                print "* Pwned: $device_pwnd"
                case $device_proc in
                    4 ) return;;
                    7 )
                        if [[ $platform != "macos" ]]; then
                            device_ipwndfu rmsigchks
                        fi
                        return
                    ;;
                    [89] | 10 )
                        log "gaster reset"
                        $gaster reset
                        return
                    ;;
                esac
            fi

            if [[ $device_proc == 5 ]]; then
                print "* DFU mode for A5 device - Make sure that your device is in PWNED DFU mode."
                print "* You need to have an Arduino and USB Host Shield for checkm8-a5."
                print "* Use my fork of checkm8-a5: https://github.com/LukeZGD/checkm8-a5"
                print "* You may also use checkm8-a5 for the Pi Pico: https://www.reddit.com/r/LegacyJailbreak/comments/1djuprf/working_checkm8a5_on_the_raspberry_pi_pico/"
                print "* Also make sure that you have NOT sent a pwned iBSS yet."
                print "* If you do not know what you are doing, restart your device in normal mode."
                echo
                log "Checking for device"
                device_pwnd="$($irecovery -q | grep "PWND" | cut -c 7-)"
                if [[ -n $device_pwnd ]]; then
                    log "Found device in pwned DFU mode."
                    print "* Pwned: $device_pwnd"
                else
                    local error_msg=$'\n* If you have just used checkm8-a5, it may have just failed. Just re-enter DFU, and retry.'
                    if [[ $mode != "device_justboot" && $device_target_tethered != 1 ]]; then
                        echo
                        error_msg+=$'\n* As much as possible, use the jailbroken method instead: restart the device in normal mode and jailbreak it.'
                        error_msg+=$'\n* You just need to have OpenSSH installed from Cydia.'
                        error_msg+=$'\n    - https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Restore-32-bit-Device'
                        echo
                    fi
                    error_msg+=$'\n* Exit DFU mode first by holding the TOP and HOME buttons for about 10 seconds.'
                    error_msg+=$'\n* For more info about kDFU/pwnDFU, read the "Troubleshooting" wiki page in GitHub'
                    error_msg+=$'\n* Troubleshooting link: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Troubleshooting#dfu-advanced-menu-a5x-pwndfu-mode-with-arduino-and-usb-host-shield'
                    error "32-bit A5 device is NOT in PWNED DFU mode. Already pwned iBSS mode?" "$error_msg"
                fi
                device_ipwndfu send_ibss
                return
            fi

            device_enter_mode DFU

            if (( device_proc > 7 )); then
                # A8/A9/A10 uses gaster
                log "Placing device to pwnDFU mode using gaster"
                print "* If pwning fails and gets stuck, you can press Ctrl+C to cancel."
                $gaster pwn
                tool_pwned=$?
                log "gaster reset"
                $gaster reset
            elif [[ $device_type == "iPod2,1" || $mode == "device_alloc8" ]]; then
                # touch 2 uses ipwndfu
                # also installing alloc8 requires pwning with ipwndfu
                device_ipwndfu pwn
                tool_pwned=$?
            elif [[ $device_proc == 4 ]] || [[ $device_proc == 6 && $platform == "macos" && $platform_arch == "x86_64" ]]; then
                # A6 intel mac/A4/3gs/touch 3 uses ipwndfu/ipwnder
                local selection=("ipwnder" "ipwndfu")
                if [[ $platform == "linux" ]]; then
                    selection=("ipwndfu" "ipwnder (limera1n)")
                    if [[ $device_type != "iPhone2,1" && $device_type != "iPod3,1" ]]; then
                        selection+=("ipwnder (SHAtter)")
                    fi
                fi
                input "PwnDFU Tool Option"
                print "* Select tool to be used for entering pwned DFU mode."
                print "* This option is set to ${selection[0]} by default (1). Select this option if unsure."
                print "* If the first option does not work, try the other option(s)."
                input "Select your option:"
                select opt2 in "${selection[@]}"; do
                    log "Placing device to pwnDFU mode using $opt2"
                    case $opt2 in
                        "ipwndfu" ) device_ipwndfu pwn; tool_pwned=$?; tool_ipwndfu=1; break;;
                        "ipwnder (SHAtter)"  ) $ipwnder -s; tool_pwned=$?; break;;
                        "ipwnder (limera1n)" ) $ipwnder -p; tool_pwned=$?; break;;
                        "ipwnder"            ) $ipwnder -d; tool_pwned=$?; break;;
                    esac
                done
            elif [[ $platform == "linux" ]]; then
                # A6/A7 linux uses ipwndfu
                device_ipwndfu pwn
                tool_pwned=$?
            elif [[ $device_proc == 6 ]]; then
                # A6 asi mac uses ipwnder_lite
                log "Placing device to pwnDFU mode using ipwnder_lite"
                $ipwnder -d
                tool_pwned=$?
            elif [[ $platform_arch == "arm64" ]]; then
                # A7 asi mac uses ipwnder_lite
                log "Placing device to pwnDFU mode using ipwnder_lite"
                ${ipwnder}2 -p
                tool_pwned=$?
            else
                # A7 intel mac uses ipwnder32/ipwnder_lite
                local selection=("ipwnder32" "ipwnder_lite")
                input "PwnDFU Tool Option"
                print "* Select tool to be used for entering pwned DFU mode."
                print "* This option is set to ${selection[0]} by default (1). Select this option if unsure."
                print "* If the first option does not work, try many times and/or try the other option(s)."
                input "Select your option:"
                select opt2 in "${selection[@]}"; do
                    case $opt2 in
                        "ipwnder32" ) opt="$ipwnder32 -p"; break;;
                        * ) opt="${ipwnder}2 -p"; break;;
                    esac
                done
                echo
                log "Please read the message below:"
                warn "If you have an older Mac with Core 2 Duo, success rates for A7 checkm8 are very low."
                print "* Pwning using another Mac or iOS device using iPwnder Lite are better options if needed."
                print "* For more details, read the \"Troubleshooting\" wiki page in GitHub"
                print "* Troubleshooting links:"
                print "    - https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Troubleshooting"
                print "    - https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Pwning-Using-Another-iOS-Device"
                echo
                log "Placing device to pwnDFU mode using $opt"
                $opt
                tool_pwned=$?
            fi
            if [[ $tool_pwned == 2 ]]; then
                return
            fi
            log "Checking for device"
            irec_pwned=$($irecovery -q | grep -c "PWND")
            # irec_pwned is instances of "PWND" in serial, must be 1
            # tool_pwned is error code of pwning tool, must be 0
            if [[ $irec_pwned != 1 && $tool_pwned != 0 ]]; then
                device_pwnerror
            fi
            if [[ $device_proc == 6 && $platform == "macos" && $platform_arch == "x86_64" && $tool_ipwndfu == 1 ]]; then
                device_ipwndfu send_ibss
                return
            fi
            if [[ $platform == "macos" ]] || (( device_proc > 7 )); then
                return
            elif [[ $device_proc == 7 ]]; then
                device_ipwndfu rmsigchks
            elif [[ $device_proc != 4 ]]; then
                device_ipwndfu send_ibss
            fi
        ;;
    esac
}

device_pwnerror() {
    local error_msg=$'\n* Exit DFU mode first by holding the TOP and HOME buttons for about 10 seconds.'
    if [[ $platform == "linux" ]]; then
        error_msg+=$'\n* Unfortunately, pwning may have low success rates for PCs with an AMD desktop CPU if you have one.'
        error_msg+=$'\n* Also, success rates for A6 and A7 checkm8 are lower on Linux.'
        error_msg+=$'\n* Pwning using an Intel PC or another Mac or iOS device may be better options.'
        if [[ $device_proc == 6 && $mode != "device_justboot" && $device_target_tethered != 1 ]]; then
            echo
            error_msg+=$'\n* As much as possible, use the jailbroken method instead: restart the device in normal mode and jailbreak it.'
            error_msg+=$'\n* You just need to have OpenSSH (and Dropbear if on iOS 10) installed from Cydia/Zebra.'
            error_msg+=$'\n    - https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Restore-32-bit-Device'
            echo
        fi
    elif [[ $platform == "macos" && $device_proc == 4 ]]; then
        error_msg+=$'\n* If you get the error "No backend available" in ipwndfu, install libusb in Homebrew/MacPorts'
    fi
    error_msg+=$'\n* For more details, read the "Troubleshooting" wiki page in GitHub'
    error_msg+=$'\n* Troubleshooting links:
    - https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Troubleshooting
    - https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Pwning-Using-Another-iOS-Device'
    error "Failed to enter pwnDFU mode. Please run the script again." "$error_msg"
}

device_ipwndfu() {
    local tool_pwned=0
    local python2=$(command -v python2 2>/dev/null)
    local pyenv=$(command -v pyenv 2>/dev/null)
    local pyenv2=~/.pyenv/versions/2.7.18/bin/python2

    if [[ -z $pyenv && -e ~/.pyenv/bin/pyenv ]]; then
        pyenv=~/.pyenv/bin/pyenv
    fi
    if [[ $platform == "macos" ]] && (( mac_majver < 12 )); then
        python2="/usr/bin/python"
        log "Using macOS system python2"
        print "* You may also install python2 from pyenv if something is wrong with system python2"
        print "* Install pyenv by running: curl https://pyenv.run | bash"
        print "* Install python2 from pyenv by running: pyenv install 2.7.18"
    elif [[ -n $python2 && $device_sudoloop == 1 ]]; then
        python2="sudo $python2"
    elif [[ -z $python2 && ! -e $pyenv2 ]]; then
        warn "python2 is not installed. Attempting to install python2 before continuing"
        print "* Install python2 from pyenv by running: pyenv install 2.7.18"
        if [[ -z $pyenv ]]; then
            warn "pyenv is not installed. Attempting to install pyenv before continuing"
            print "* Install pyenv by running: curl https://pyenv.run | bash"
            log "Installing pyenv"
            curl https://pyenv.run | bash
            pyenv=~/.pyenv/bin/pyenv
            if [[ ! -e $pyenv ]]; then
                error "Cannot detect pyenv, its installation may have failed." \
                "* Try installing pyenv manually before retrying."
            fi
        fi
        log "Installing python2 using pyenv"
        print "* This may take a while, but should not take longer than a few minutes."
        $pyenv install 2.7.18
        if [[ ! -e $pyenv2 ]]; then
            warn "Cannot detect python2 from pyenv, its installation may have failed."
            print "* Try installing pyenv and/or python2 manually:"
            print "    pyenv:   > curl https://pyenv.run | bash"
            print "    python2: > $pyenv install 2.7.18"
            if [[ $distro == "fedora-atomic" ]]; then
                print "* For Fedora Atomic, you will also need to set up toolbox and build environment."
                print "* Follow the commands here under Fedora Silverblue: https://github.com/pyenv/pyenv/wiki#suggested-build-environment"
                print "* Run the pyenv install commands while in the toolbox container."
            fi
            error "Cannot detect python2 for ipwndfu, cannot continue."
        fi
    fi
    if [[ -e $pyenv2 ]]; then
        log "python2 from pyenv detected, this will be used"
        python2=
        if [[ $device_sudoloop == 1 ]]; then
            python2="sudo "
        fi
        python2+="$pyenv2"
    fi

    mkdir ../saved/ipwndfu 2>/dev/null
    rm -f ../saved/ipwndfu/pwnediBSS
    if [[ $1 == "send_ibss" && $device_boot4 == 1 ]]; then
        cp iBSS.patched ../saved/ipwndfu/pwnediBSS
    elif [[ $1 == "send_ibss" ]]; then
        device_rd_build=
        patch_ibss
        cp pwnediBSS ../saved/ipwndfu/
    fi

    device_enter_mode DFU
    local ipwndfu_comm="1d22fd01b0daf52bbcf1ce730022d4212d87f967"
    local ipwndfu_sha1="30f0802078ab6ff83d6b918e13f09a652a96d6dc"
    if [[ ! -s ../saved/ipwndfu/ipwndfu || $(cat ../saved/ipwndfu/sha1check) != "$ipwndfu_sha1" ]]; then
        rm -rf ../saved/ipwndfu-*
        download_file https://github.com/LukeZGD/ipwndfu/archive/$ipwndfu_comm.zip ipwndfu.zip $ipwndfu_sha1
        unzip -q ipwndfu.zip -d ../saved
        rm -rf ../saved/ipwndfu
        mv ../saved/ipwndfu-* ../saved/ipwndfu
        echo "$ipwndfu_sha1" > ../saved/ipwndfu/sha1check
        rm -rf ../saved/ipwndfu-*
    fi
    if [[ $platform == "macos" && ! -e ~/lib/libusb-1.0.dylib ]]; then
        if [[ -e ~/lib && -e ~/lib.bak ]]; then
            rm -rf ~/lib
        elif [[ -e ~/lib ]]; then
            mv ~/lib ~/lib.bak
        fi
        if [[ -e /opt/local/lib/libusb-1.0.dylib ]]; then
            ln -sf /opt/local/lib ~/lib
        elif [[ -e /opt/homebrew/lib/libusb-1.0.dylib ]]; then
            ln -sf /opt/homebrew/lib ~/lib
        fi
    fi

    pushd ../saved/ipwndfu/ >/dev/null
    case $1 in
        "send_ibss" )
            log "Sending iBSS using ipwndfu..."
            $python2 ipwndfu -l pwnediBSS
            tool_pwned=$?
            rm pwnediBSS
            if [[ $tool_pwned != 0 ]]; then
                popd >/dev/null
                local error_msg
                if [[ $platform == "macos" ]]; then
                    error_msg+=$'\n* If you get the error "No backend available," install libusb in Homebrew/MacPorts\n'
                fi
                error_msg+="* You might need to exit DFU and (re-)enter PWNED DFU mode before retrying."
                error "Failed to send iBSS. Your device has likely failed to enter PWNED DFU mode." "$error_msg"
            fi
            print "* ipwndfu should have \"done!\" as output. If not, sending iBEC will fail."
        ;;

        "pwn" )
            log "Placing device to pwnDFU Mode using ipwndfu"
            $python2 ipwndfu -p
            tool_pwned=$?
            if [[ $tool_pwned != 0 && $tool_pwned != 2 ]]; then
                if (( device_proc >= 6 )) && [[ $tool_pwned != 2 ]]; then
                    log "You may see the langid error above. This is normal, let's try to make it work"
                    print "* If it is any other error, it may have failed. Just continue, re-enter DFU, and retry"
                    log "Please read the message below:"
                    print "* Unplug and replug the device 2 times"
                    print "* After doing this, continue by pressing Enter/Return"
                    pause
                    log "Checking for device"
                    device_pwnd="$($irecovery3 -q | grep "PWND" | cut -c 7-)"
                    if [[ -n $device_pwnd ]]; then
                        log "Success!"
                        print "* Pwned: $device_pwnd"
                    else
                        popd >/dev/null
                        device_pwnerror
                    fi
                else
                    popd >/dev/null
                    device_pwnerror
                fi
            fi
        ;;

        "rmsigchks" )
            log "Running rmsigchks..."
            $python2 rmsigchks.py
        ;;

        "alloc8" )
            if [[ ! -s n88ap-iBSS-4.3.5.img3 ]]; then
                log "Downloading iOS 4.3.5 iBSS"
                "../$dir/pzb" -g "Firmware/dfu/iBSS.n88ap.RELEASE.dfu" -o n88ap-iBSS-4.3.5.img3 http://appldnld.apple.com/iPhone4/041-1965.20110721.gxUB5/iPhone2,1_4.3.5_8L1_Restore.ipsw
            fi
            log "Installing alloc8 to device"
            $python2 ipwndfu -x
            if [[ $platform == "macos" ]]; then
                print "* If you get the error \"No backend available,\" install libusb in Homebrew/MacPorts"
            fi
        ;;
    esac
    if [[ $device_sudoloop == 1 ]]; then
        sudo rm *.pyc libusbfinder/*.pyc usb/*.pyc usb/backend/*.pyc
    fi
    popd >/dev/null
    return $tool_pwned
}

download_file() {
    # usage: download_file {link} {target location} {sha1}
    local filename="$(basename $2)"
    log "Downloading $filename..."
    curl -L $1 -o $2
    if [[ ! -s $2 ]]; then
        error "Downloading $2 failed. Please run the script again"
    fi
    if [[ -z $3 ]]; then
        return
    fi
    local sha1=$($sha1sum $2 | awk '{print $1}')
    if [[ $sha1 != "$3" ]]; then
        error "Verifying $filename failed. The downloaded file may be corrupted or incomplete. Please run the script again" \
        "* SHA1sum mismatch. Expected $3, got $sha1"
    fi
}

device_fw_key_check() {
    # check and download keys for device_target_build, then set the variable device_fw_key (or device_fw_key_base)
    local key
    local build="$device_target_build"
    if [[ $1 == "base" ]]; then
        build="$device_base_build"
    elif [[ $1 == "temp" ]]; then
        build="$2"
    fi
    local keys_path="$device_fw_dir/$build"

    log "Checking firmware keys in $keys_path"
    if [[ -e "$keys_path/index.html" ]]; then
        if [[ $(cat "$keys_path/index.html" | grep -c "$build") != 1 ]]; then
            log "Existing firmware keys are not valid. Deleting"
            rm "$keys_path/index.html"
        fi
        case $build in
            1[23]* )
                if [[ $(cat "$keys_path/index.html" | sed "s|DeviceTree.${device_model}ap||g" | grep -c "${device_model}ap") != 0 ]]; then
                    log "Existing firmware keys seem to have incorrect filenames. Deleting"
                    rm "$keys_path/index.html"
                fi
            ;;
        esac
    fi

    if [[ ! -e "$keys_path/index.html" ]]; then
        log "Getting firmware keys for $device_type-$build"
        mkdir -p "$keys_path" 2>/dev/null
        local try=("https://github.com/LukeZGD/Legacy-iOS-Kit-Keys/raw/master/$device_type/$build/index.html"
                   "http://127.0.0.1:8888/firmware/$device_type/$build"
                   "https://api.m1sta.xyz/wikiproxy/$device_type/$build")
        for i in "${try[@]}"; do
            curl -L $i -o index.html
            if [[ $(cat index.html | grep -c "$build") == 1 ]]; then
                break
            fi
        done
        if [[ $(cat index.html | grep -c "$build") != 1 ]]; then
            local error_msg="* You may need to run wikiproxy to get firmware keys."
            error_msg+=$'\n* For more details, go to the "Troubleshooting" wiki page in GitHub.'
            error_msg+=$'\n* Troubleshooting link: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Troubleshooting#running-wikiproxy'
            error "Failed to download firmware keys." "$error_msg"
        fi
        mv index.html "$keys_path/"
    fi
    if [[ $1 == "base" ]]; then
        device_fw_key_base="$(cat $keys_path/index.html)"
    elif [[ $1 == "temp" ]]; then
        device_fw_key_temp="$(cat $keys_path/index.html)"
    else
        device_fw_key="$(cat $keys_path/index.html)"
    fi
}

ipsw_get_url() {
    local build_id="$1"
    local url="$(cat "$device_fw_dir/$build_id/url" 2>/dev/null)"
    ipsw_url=
    log "Checking URL in $device_fw_dir/$build_id/url"
    if [[ $(echo "$url" | grep -c '<') != 0 || $url != *"$build_id"* ]]; then
        rm -f "$device_fw_dir/$build_id/url"
        url=
    fi
    if [[ -z $url ]]; then
        log "Getting URL for $device_type-$build_id"
        url="$(curl "https://api.ipsw.me/v4/ipsw/$device_type/$build_id" | $jq -j ".url")"
        if [[ $(echo "$url" | grep -c '<') != 0 ]]; then
            url="$(curl "https://api.ipsw.me/v4/device/$device_type?type=ipsw" | $jq -j ".firmwares[] | select(.buildid == \"$build_id\") | .url")"
        fi
        mkdir -p $device_fw_dir/$build_id 2>/dev/null
        echo "$url" > $device_fw_dir/$build_id/url
    fi
    ipsw_url="$url"
}

download_comp() {
    # usage: download_comp [build_id] [comp]
    local build_id="$1"
    local comp="$2"
    ipsw_get_url $build_id
    download_targetfile="$comp.$device_model"
    if [[ $build_id != "12"* ]]; then
        download_targetfile+="ap"
    fi
    download_targetfile+=".RELEASE"

    if [[ -e "../saved/$device_type/${comp}_$build_id.dfu" ]]; then
        cp "../saved/$device_type/${comp}_$build_id.dfu" ${comp}
    else
        log "Downloading ${comp}..."
        "$dir/pzb" -g "Firmware/dfu/$download_targetfile.dfu" -o ${comp} "$ipsw_url"
        cp ${comp} "../saved/$device_type/${comp}_$build_id.dfu"
    fi
}

patch_ibss() {
    # creates file pwnediBSS to be sent to device
    local build_id
    case $device_type in
        iPad1,1 | iPod3,1 ) build_id="9B206";;
        iPhone2,1 | iPod4,1 ) build_id="10B500";;
        iPhone3,[123] ) build_id="11D257";;
        * ) build_id="12H321";;
    esac
    if [[ -n $device_rd_build ]]; then
        build_id="$device_rd_build"
    fi
    download_comp $build_id iBSS
    device_fw_key_check temp $build_id
    local iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "iBSS") | .iv')
    local key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "iBSS") | .key')
    log "Decrypting iBSS..."
    "$dir/xpwntool" iBSS iBSS.dec -iv $iv -k $key
    log "Patching iBSS..."
    "$dir/iBoot32Patcher" iBSS.dec pwnediBSS --rsa
    "$dir/xpwntool" pwnediBSS pwnediBSS.dfu -t iBSS
    cp pwnediBSS pwnediBSS.dfu ../saved/$device_type/
    log "Pwned iBSS saved at: saved/$device_type/pwnediBSS"
    log "Pwned iBSS img3 saved at: saved/$device_type/pwnediBSS.dfu"
}

patch_ibec() {
    # creates file pwnediBEC to be sent to device for blob dumping
    local build_id
    case $device_type in
        iPad1,1 | iPod3,1 )
            build_id="9B206";;
        iPhone2,1 | iPhone3,[123] | iPod4,1 )
            build_id="10A403";;
        iPad2,[367] | iPad3,[25] )
            build_id="12H321";;
        iPad3,1 )
            build_id="10B146";;
        iPhone5,3 )
            build_id="11B511";;
        iPhone5,4 )
            build_id="11B651";;
        * )
            build_id="10B329";;
    esac
    if [[ -n $device_rd_build ]]; then
        build_id="$device_rd_build"
    fi
    download_comp $build_id iBEC
    device_fw_key_check temp $build_id
    local name="iBEC"
    local iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "iBEC") | .iv')
    local key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "iBEC") | .key')
    local address="0x80000000"
    if [[ $device_proc == 4 ]]; then
        address="0x40000000"
    fi
    mv iBEC $name.orig
    log "Decrypting iBEC..."
    "$dir/xpwntool" $name.orig $name.dec -iv $iv -k $key
    log "Patching iBEC..."
    if [[ $device_proc == 4 || -n $device_rd_build ]]; then
        "$dir/iBoot32Patcher" $name.dec $name.patched --rsa --ticket -b "rd=md0 -v amfi=0xff cs_enforcement_disable=1" -c "go" $address
    else
        $bspatch $name.dec $name.patched "../resources/patch/$download_targetfile.patch"
    fi
    "$dir/xpwntool" $name.patched pwnediBEC.dfu -t $name.orig
    rm $name.dec $name.orig $name.patched
    cp pwnediBEC.dfu ../saved/$device_type/
    log "Pwned iBEC img3 saved at: saved/$device_type/pwnediBEC.dfu"
}

ipsw_nojailbreak_message() {
    local hac
    local tohac
    case $device_type in
        iPhone[23],1 ) hac=" (and hacktivate)"; tohac=1;;
    esac
    log "Jailbreak option is not available for this version. You may jailbreak$hac later after the restore"
    print "* To jailbreak, select \"Jailbreak Device\" in the main menu"
    if [[ $tohac == 1 ]]; then
        print "* To hacktivate, go to \"Other Utilities -> Hacktivate Device\" after jailbreaking"
    fi
}

ipsw_preference_set() {
    # sets ipsw variables: ipsw_jailbreak, ipsw_memory, ipsw_verbose

    if (( device_proc >= 7 )); then
        return
    fi

    case $device_latest_vers in
        [76543]* ) ipsw_canjailbreak=1;;
    esac
    if [[ $device_target_vers == "$device_latest_vers" && $ipsw_canjailbreak != 1 && $ipsw_gasgauge_patch != 1 ]]; then
        return
    elif [[ $device_target_vers != "$device_latest_vers" ]]; then
        ipsw_canjailbreak=
    fi

    case $device_target_vers in
        9.3.[4321] | 9.3 | 9.[21]* | [8765]* | 4.3* | 4.2.[8761] ) ipsw_canjailbreak=1;;
        3.1.3 )
            case $device_proc in
                1 ) ipsw_canjailbreak=1;;
                * ) ipsw_nojailbreak_message;;
            esac
        ;;
    esac

    if [[ $device_proc == 5 ]]; then
        case $device_target_vers in
            8.[210]* ) ipsw_canjailbreak=;;
        esac
    elif [[ $device_type == "iPhone1,2" || $device_type == "iPhone2,1" || $device_type == "iPod2,1" ]]; then
        case $device_target_vers in
            4* ) ipsw_canjailbreak=1;;
            3.1.3 ) :;;
            3.[10]* ) ipsw_nojailbreak_message;;
        esac
    else
        case $device_target_vers in
            4.[10]* ) ipsw_nojailbreak_message;;
        esac
    fi

    if [[ $device_target_powder == 1 ]]; then
        case $device_target_vers in
            [98]* ) ipsw_canjailbreak=1;;
        esac
    elif [[ $device_target_other == 1 && $ipsw_canjailbreak != 1 ]]; then
        return
    fi

    if [[ $ipsw_isbeta == 1 ]]; then
        case $device_target_vers in
            8* )
                if [[ $device_target_build == "12A4265u" || $device_target_build == "12A4297e" ]]; then
                    warn "iOS beta detected. Disabling jailbreak option"
                    ipsw_canjailbreak=
                fi
            ;;
            [76]* ) :;;
            * )
                warn "iOS beta detected. Disabling jailbreak option"
                ipsw_canjailbreak=
            ;;
        esac
        if [[ $ipsw_canjailbreak == 1 ]]; then
            warn "iOS beta detected. Jailbreak option might not work properly"
        fi
    fi

    if [[ $ipsw_fourthree == 1 ]]; then
        ipsw_jailbreak=1
    elif [[ $ipsw_jailbreak == 1 ]]; then
        warn "Jailbreak flag detected, jailbreak option enabled by user."
    elif [[ $ipsw_canjailbreak == 1 && -z $ipsw_jailbreak ]]; then
        input "Jailbreak Option"
        print "* When this option is enabled, your device will be jailbroken on restore."
        print "* I recommend to enable this option to have the jailbreak and Cydia pre-installed."
        print "* This option is enabled by default (Y). Select this option if unsure."
        if [[ $device_type == "iPad2"* && $device_target_vers == "4.3"* && $device_target_tethered != 1 ]]; then
            warn "This will be a semi-tethered jailbreak. checkm8-a5 is required to boot to a jailbroken state."
            print "* To boot jailbroken later, go to: Other Utilities -> Just Boot"
        fi
        read -p "$(input 'Enable this option? (Y/n): ')" ipsw_jailbreak
        if [[ $ipsw_jailbreak == 'N' || $ipsw_jailbreak == 'n' ]]; then
            ipsw_jailbreak=
            log "Jailbreak option disabled by user."
        else
            ipsw_jailbreak=1
            log "Jailbreak option enabled."
        fi
        echo
    fi

    if [[ $ipsw_jailbreak == 1 && -z $ipsw_hacktivate && $ipsw_canhacktivate == 1 ]]; then
        input "Hacktivate Option"
        print "* When this option is enabled, your device will be activated on restore."
        print "* Enable this option if you have no valid SIM card to activate the phone."
        print "* Disable this option if you have a working SIM card and want cellular data."
        print "* This option is disabled by default (N). Select this option if unsure."
        read -p "$(input 'Enable this option? (y/N): ')" ipsw_hacktivate
        if [[ $ipsw_hacktivate == 'Y' || $ipsw_hacktivate == 'y' ]]; then
            log "Hacktivate option enabled by user."
            ipsw_hacktivate=1
        else
            log "Hacktivate option disabled."
            ipsw_hacktivate=
        fi
        echo
    fi

    case $device_type in
        iPad[23],[23] | "$device_disable_bbupdate" ) ipsw_nskip=1;;
    esac
    if [[ $device_target_vers == "4.2"* || $device_target_vers == "4.3"* || $ipsw_gasgauge_patch == 1 ]] ||
       [[ $platform == "macos" && $platform_arch == "arm64" ]]; then
        ipsw_nskip=1
    fi

    case $device_type in
        iPhone2,1 | iPod2,1 ) ipsw_canmemory=1;;
        iPad[23],[23] ) ipsw_canmemory=1;;
        iPhone3,1 | iPad1,1 | iPad2* | iPod[34],1 )
            case $device_target_vers in
                [34]* ) ipsw_canmemory=1;;
            esac
        ;;
    esac

    if [[ $device_proc == 1 && $device_type != "iPhone1,2" ]]; then
        ipsw_canmemory=
    elif [[ $device_target_powder == 1 || $device_target_tethered == 1 ||
          $ipsw_jailbreak == 1 || $ipsw_gasgauge_patch == 1 || $ipsw_nskip == 1 ||
          $device_type == "$device_disable_bbupdate" ]]; then
        ipsw_canmemory=1
    fi

    if [[ $ipsw_canmemory == 1 && -z $ipsw_memory ]]; then
        input "Memory Option for creating custom IPSW"
        print "* When this option is enabled, system RAM will be used for the IPSW creation process."
        print "* I recommend to enable this option to speed up creating the custom IPSW."
        print "* However, if your PC/Mac has less than 8 GB of RAM, disable this option."
        print "* This option is enabled by default (Y). Select this option if unsure."
        read -p "$(input 'Enable this option? (Y/n): ')" ipsw_memory
        if [[ $ipsw_memory == 'N' || $ipsw_memory == 'n' ]]; then
            log "Memory option disabled by user."
            ipsw_memory=
        else
            log "Memory option enabled."
            ipsw_memory=1
        fi
        echo
    fi

    if [[ $device_target_powder == 1 ]]; then
        ipsw_canverbose=1
    elif [[ $device_type == "iPhone2,1" && $device_target_other != 1 ]]; then
        case $device_target_vers in
            6.1.6 | 4.1 ) log "3GS verbose boot is not supported on 6.1.6 and 4.1";;
            [65]* ) log "3GS verbose boot is currently supported on iOS 4 and lower only";;
            3.0* ) :;;
            * ) ipsw_canverbose=1;;
        esac
    fi

    if [[ $ipsw_canverbose == 1 && -z $ipsw_verbose ]]; then
        input "Verbose Boot Option"
        print "* When this option is enabled, the device will have verbose boot on restore."
        print "* This option is enabled by default (Y). Select this option if unsure."
        read -p "$(input 'Enable this option? (Y/n): ')" ipsw_verbose
        if [[ $ipsw_verbose == 'N' || $ipsw_verbose == 'n' ]]; then
            ipsw_verbose=
            log "Verbose boot option disabled by user."
        else
            ipsw_verbose=1
            log "Verbose boot option enabled."
        fi
        echo
    fi

    ipsw_custom_set
}

shsh_save() {
    # usage: shsh_save {apnonce (optional)}
    # sets variable shsh_path
    local version=$device_target_vers
    local build_id=$device_target_build
    local apnonce
    local shsh_check
    local buildmanifest="../resources/manifest/BuildManifest_${device_type}_${version}.plist"
    local ExtraArgs=

    if [[ $1 == "apnonce" ]]; then
        apnonce=$2
    elif [[ $1 == "version" ]]; then
        version=$2
    fi

    if [[ $version == "$device_latest_vers" || $version == "4.1" ]]; then
        if [[ $version != "4.1" ]]; then
            build_id="$device_latest_build"
        fi
        buildmanifest="../saved/$device_type/$build_id.plist"
        if [[ ! -e $buildmanifest ]]; then
            if [[ -e "$ipsw_base_path.ipsw" ]]; then
                log "Extracting BuildManifest from $version IPSW..."
                unzip -o -j "$ipsw_base_path.ipsw" BuildManifest.plist -d .
            else
                log "Downloading BuildManifest for $version..."
                "$dir/pzb" -g BuildManifest.plist -o BuildManifest.plist "$(cat "$device_fw_dir/$build_id/url")"
            fi
            mv BuildManifest.plist $buildmanifest
        fi
    fi
    shsh_check=${device_ecid}_${device_type}_${device_model}ap_${version}-${build_id}_${apnonce}*.shsh*

    if [[ $(ls ../saved/shsh/$shsh_check 2>/dev/null) && -z $apnonce ]]; then
        shsh_path="$(ls ../saved/shsh/$shsh_check)"
        log "Found existing saved $version blobs: $shsh_path"
        return
    fi
    rm -f *.shsh*

    ExtraArgs="-d $device_type -i $version -e $device_ecid -m $buildmanifest -o -s -B ${device_model}ap -b "
    if [[ -n $apnonce ]]; then
        ExtraArgs+="--apnonce $apnonce"
    else
        ExtraArgs+="-g 0x1111111111111111"
    fi
    log "Running tsschecker with command: $tsschecker $ExtraArgs"
    $tsschecker $ExtraArgs
    shsh_path="$(ls $shsh_check)"
    if [[ -z "$shsh_path" ]]; then
        error "Saving $version blobs failed. Please run the script again" \
        "* It is also possible that $version for $device_type is no longer signed"
    fi
    if [[ -z $apnonce ]]; then
        cp "$shsh_path" ../saved/shsh/
    fi
    log "Successfully saved $version blobs: $shsh_path"
}

ipsw_download() {
    local version="$device_target_vers"
    local build_id="$device_target_build"
    local ipsw_dl="$1"
    ipsw_get_url $build_id
    if [[ -z $ipsw_dl ]]; then
        ipsw_dl="../${ipsw_url##*/}"
        ipsw_dl="${ipsw_dl%?????}"
    fi
    if [[ ! -e "$ipsw_dl.ipsw" ]]; then
        if [[ -n $version ]]; then
            print "* The script will now proceed to download iOS $version IPSW."
        fi
        print "* If you want to download it yourself, here is the link: $ipsw_url"
        log "Downloading IPSW... (Press Ctrl+C to cancel)"
        curl -L "$ipsw_url" -o temp.ipsw
        mv temp.ipsw "$ipsw_dl.ipsw"
    fi
    ipsw_verify "$ipsw_dl" "$build_id"
}

ipsw_verify() {
    local ipsw_dl="$1"
    local build_id="$2"
    local cutver
    local device
    local type
    local IPSWSHA1
    local IPSWSHA1E=$(cat "$device_fw_dir/$build_id/sha1sum" 2>/dev/null)
    log "Getting SHA1 hash for $ipsw_dl.ipsw..."
    local IPSWSHA1L=$($sha1sum "${ipsw_dl//\\//}.ipsw" | awk '{print $1}')
    case $build_id in
        *[bcdefgkmpquv] )
            log "Beta IPSW detected, skip verification"
            if [[ $build_id == "$device_base_build" ]]; then
                device_base_sha1="$IPSWSHA1L"
            else
                ipsw_isbeta=1
                device_target_sha1="$IPSWSHA1L"
            fi
            return
        ;;
    esac
    case $build_id in
        7*  ) cutver=3;;
        8*  ) cutver=4;;
        9*  ) cutver=5;;
        10* ) cutver=6;;
        11* ) cutver=7;;
        12* ) cutver=8;;
        13* ) cutver=9;;
    esac
    if [[ -n $cutver ]]; then
        type="$device_type"
    else
        ipsw_latest_set
        type="$device_type2"
    fi
    case $build_id in
        14* ) cutver=10;;
        15* ) cutver=11;;
        16* ) cutver=12;;
        17* ) cutver=13;;
        18* ) cutver=14;;
        19* ) cutver=15;;
        20* ) cutver=16;;
    esac
    case $device_type in
        iPad4,[123] | iPad5,[34] ) device="iPad_Air";;
        iPad2,[567] | iPad[45],* ) device="iPad_mini";;
        iPad6,[3478] ) device="iPad_Pro";;
        iPad* ) device="iPad";;
        iPho* ) device="iPhone";;
        iPod* ) device="iPod_touch";;
    esac

    if [[ $(echo "$IPSWSHA1E" | grep -c '<') != 0 ]]; then
        rm "$device_fw_dir/$build_id/sha1sum"
    fi

    log "Getting SHA1 hash from The Apple Wiki..."
    IPSWSHA1="$(curl "https://theapplewiki.com/index.php?title=Firmware/${device}/${cutver}.x" | grep -A10 "${type}.*${build_id}" | sed -ne '/<code>/,/<\/code>/p' | sed '1!d' | sed -e "s/<code>//" | sed "s/<\/code>//" | cut -c 5-)"
    mkdir -p $device_fw_dir/$build_id 2>/dev/null

    if [[ -n $IPSWSHA1 && -n $IPSWSHA1E && $IPSWSHA1 == "$IPSWSHA1E" ]]; then
        log "Using saved SHA1 hash for this IPSW: $IPSWSHA1"
    elif [[ -z $IPSWSHA1 && -n $IPSWSHA1E ]]; then
        warn "No SHA1 hash from The Apple Wiki, using local hash"
        IPSWSHA1="$IPSWSHA1E"
    elif [[ -z $IPSWSHA1 && -z $IPSWSHA1E ]]; then
        warn "No SHA1 hash from either The Apple Wiki or local hash, cannot verify IPSW."
        pause
        return
    elif [[ -n $IPSWSHA1E ]]; then
        warn "Local SHA1 hash mismatch. Overwriting local hash."
        echo "$IPSWSHA1" > $device_fw_dir/$build_id/sha1sum
    elif [[ -z $IPSWSHA1E ]]; then
        warn "Local SHA1 hash does not exist. Creating local hash."
        echo "$IPSWSHA1" > $device_fw_dir/$build_id/sha1sum
    fi

    if [[ $IPSWSHA1L != "$IPSWSHA1" ]]; then
        rm "$device_fw_dir/$build_id/sha1sum"
        if [[ -z $3 ]]; then
            log "SHA1sum mismatch. Expected $IPSWSHA1, got $IPSWSHA1L"
            warn "Verifying IPSW failed. Your IPSW may be corrupted or incomplete. Make sure to download and select the correct IPSW."
            pause
        fi
        if [[ $build_id == "$device_base_build" ]]; then
            ipsw_base_validate=1
        else
            ipsw_validate=1
        fi
        return 1
    fi
    log "IPSW SHA1sum matches"
    if [[ $build_id == "$device_base_build" ]]; then
        device_base_sha1="$IPSWSHA1"
        ipsw_base_validate=0
    else
        ipsw_isbeta=
        device_target_sha1="$IPSWSHA1"
        ipsw_validate=0
    fi
}

ipsw_prepare_1033() {
    # patch iBSS, iBEC, iBSSb, iBECb and set variables
    iBSS="ipad4"
    if [[ $device_type == "iPhone6"* ]]; then
        iBSS="iphone6"
    fi
    iBEC="iBEC.${iBSS}.RELEASE"
    iBSSb="iBSS.${iBSS}b.RELEASE"
    iBECb="iBEC.${iBSS}b.RELEASE"
    iBSS="iBSS.$iBSS.RELEASE"

    log "Patching iBSS and iBEC..."
    unzip -o -j "$ipsw_path.ipsw" Firmware/dfu/$iBSS.im4p
    unzip -o -j "$ipsw_path.ipsw" Firmware/dfu/$iBEC.im4p
    mv $iBSS.im4p $iBSS.orig
    mv $iBEC.im4p $iBEC.orig
    $bspatch $iBSS.orig $iBSS.im4p ../resources/patch/$iBSS.patch
    $bspatch $iBEC.orig $iBEC.im4p ../resources/patch/$iBEC.patch
    if [[ $device_type == "iPad4"* ]]; then
        unzip -o -j "$ipsw_path.ipsw" Firmware/dfu/$iBSSb.im4p
        unzip -o -j "$ipsw_path.ipsw" Firmware/dfu/$iBECb.im4p
        mv $iBSSb.im4p $iBSSb.orig
        mv $iBECb.im4p $iBECb.orig
        $bspatch $iBSSb.orig $iBSSb.im4p ../resources/patch/$iBSSb.patch
        $bspatch $iBECb.orig $iBECb.im4p ../resources/patch/$iBECb.patch
    fi
    case $device_type in
        iPad4,[45] ) cp $iBSSb.im4p $iBECb.im4p ../saved/$device_type;;
        * ) cp $iBSS.im4p $iBEC.im4p ../saved/$device_type;;
    esac
    log "Pwned iBSS and iBEC saved at: saved/$device_type"
}

ipsw_prepare_rebootsh() {
    log "Generating reboot.sh"
    echo '#!/bin/bash' | tee reboot.sh
    echo "mount_hfs /dev/disk0s1s1 /mnt1; mount_hfs /dev/disk0s1s2 /mnt2" | tee -a reboot.sh
    echo "nvram -d boot-partition; nvram -d boot-ramdisk" | tee -a reboot.sh
    echo "/usr/bin/haxx_overwrite --${device_type}_${device_target_build}" | tee -a reboot.sh
}

ipsw_prepare_logos_convert() {
    local iv
    local key
    local name
    if [[ -n $ipsw_customlogo ]]; then
        iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "AppleLogo") | .iv')
        key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "AppleLogo") | .key')
        name=$(echo "$device_fw_key" | $jq -j '.keys[] | select(.image == "AppleLogo") | .filename')
        logoname="$name"
        log "Converting custom logo"
        unzip -o -j "$ipsw_path.ipsw" $all_flash/$name
        "$dir/xpwntool" $name logo-orig.img3 -iv $iv -k $key -decrypt
        "$dir/imagetool" inject "$ipsw_customlogo" logo.img3 logo-orig.img3
        if [[ ! -s logo.img3 ]]; then
            error "Converting custom logo failed. Check your image"
        fi
        if [[ $device_target_powder == 1 ]]; then
            if [[ $device_target_vers == "3"* || $device_target_vers == "4"* ]]; then
                log "log4"
                echo "0000010: 3467" | xxd -r - logo.img3
                echo "0000020: 3467" | xxd -r - logo.img3
            else
                log "logb"
                echo "0000010: 6267" | xxd -r - logo.img3
                echo "0000020: 6267" | xxd -r - logo.img3
            fi
        fi
        mkdir -p $all_flash 2>/dev/null
        mv logo.img3 $all_flash/$name
    fi
    if [[ -n $ipsw_customrecovery ]]; then
        iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "RecoveryMode") | .iv')
        key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "RecoveryMode") | .key')
        name=$(echo "$device_fw_key" | $jq -j '.keys[] | select(.image == "RecoveryMode") | .filename')
        recmname="$name"
        log "Converting custom recovery"
        unzip -o -j "$ipsw_path.ipsw" $all_flash/$name
        "$dir/xpwntool" $name recovery-orig.img3 -iv $iv -k $key -decrypt
        "$dir/imagetool" inject "$ipsw_customrecovery" recovery.img3 recovery-orig.img3
        if [[ ! -s recovery.img3 ]]; then
            error "Converting custom recovery failed. Check your image"
        fi
        mkdir -p $all_flash 2>/dev/null
        mv recovery.img3 $all_flash/$name
    fi
}

ipsw_prepare_logos_add() {
    if [[ -n $ipsw_customlogo ]]; then
        log "Adding custom logo to IPSW"
        zip -r0 temp.ipsw $all_flash/$logoname
    fi
    if [[ -n $ipsw_customrecovery ]]; then
        log "Adding custom recovery to IPSW"
        zip -r0 temp.ipsw $all_flash/$recmname
    fi
}

ipsw_prepare_jailbreak() {
    if [[ -e "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    fi
    local ExtraArgs=
    local JBFiles=()
    local JBFiles2=()
    local daibutsu=$1

    if [[ $ipsw_jailbreak == 1 ]]; then
        if [[ $device_target_vers == "8.4.1" ]]; then
            ipsw_prepare_rebootsh
            JBFiles+=("$jelbrek/fstab8.tar")
            JBFiles2=("daibutsu/bin.tar" "daibutsu/untether.tar" "freeze.tar")
            for i in {0..2}; do
                cp $jelbrek/${JBFiles2[$i]} .
            done
            ExtraArgs+="-daibutsu" # use daibutsuCFW
            daibutsu="daibutsu"
        else
            JBFiles+=("fstab_rw.tar" "freeze.tar")
            case $device_target_vers in
                6.1.[3456] ) JBFiles+=("p0sixspwn.tar");;
                6* ) JBFiles+=("evasi0n6-untether.tar");;
                4.1 | 4.0* | 3.1.3 ) JBFiles+=("greenpois0n/${device_type}_${device_target_build}.tar");;
                5* | 4.[32]* ) JBFiles+=("g1lbertJB/${device_type}_${device_target_build}.tar");;
            esac
            case $device_target_vers in
                [43]* ) JBFiles[0]="fstab_old.tar"
            esac
            for i in {0..1}; do
                JBFiles[i]=$jelbrek/${JBFiles[$i]}
            done
            case $device_target_vers in
                4.3* )
                    JBFiles[2]=$jelbrek/${JBFiles[2]}
                    if [[ $device_type == "iPad2"* ]]; then
                        JBFiles[2]=
                    fi
                ;;
                4.2.[8761] )
                    if [[ $device_type != "iPhone1,2" ]]; then
                        ExtraArgs+=" -punchd"
                        JBFiles[2]=$jelbrek/greenpois0n/${device_type}_${device_target_build}.tar
                    fi
                ;;
                3.0* | 3.1 | 3.1.[12] ) :;;
                * ) JBFiles[2]=$jelbrek/${JBFiles[2]};;
            esac
            case $device_target_vers in
                [543]* ) JBFiles+=("$jelbrek/cydiasubstrate.tar");;
            esac
            if [[ $device_target_vers == "3"* ]]; then
                JBFiles+=("$jelbrek/cydiahttpatch.tar")
            fi
            if [[ $device_target_vers == "5"* ]]; then
                JBFiles+=("$jelbrek/g1lbertJB.tar")
            fi
            if [[ $device_target_tethered == 1 && $device_type != "iPad2"* ]]; then
                case $device_target_vers in
                    4.2.[8761] ) :;;
                    5* | 4.[32]* ) JBFiles+=("$jelbrek/g1lbertJB/install.tar");;
                esac
            fi
        fi
        ExtraArgs+=" -S 30" # system partition add
        if [[ $ipsw_openssh == 1 ]]; then
            JBFiles+=("$jelbrek/sshdeb.tar")
        fi
    fi

    ipsw_prepare_bundle $daibutsu
    ipsw_prepare_logos_convert

    if [[ $ipsw_memory == 1 ]]; then
        ExtraArgs+=" -memory"
    fi
    ExtraArgs+=" -ramdiskgrow 10"
    if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]]; then
        ExtraArgs+=" -bbupdate"
    elif [[ $device_type == "$device_disable_bbupdate" && $device_deadbb != 1 ]]; then
        device_dump baseband
        ExtraArgs+=" ../saved/$device_type/baseband-$device_ecid.tar"
    fi
    if [[ $device_actrec == 1 ]]; then
        device_dump activation
        ExtraArgs+=" ../saved/$device_type/activation-$device_ecid.tar"
    fi
    if [[ $1 == "iboot" ]]; then
        ExtraArgs+=" iBoot.tar"
    fi
    if [[ $ipsw_isbeta == 1 ]]; then
        ipsw_prepare_systemversion
        ExtraArgs+=" systemversion.tar"
    fi

    log "Preparing custom IPSW: $dir/ipsw $ipsw_path.ipsw temp.ipsw $ExtraArgs ${JBFiles[*]}"
    "$dir/ipsw" "$ipsw_path.ipsw" temp.ipsw $ExtraArgs ${JBFiles[@]}

    if [[ ! -e temp.ipsw ]]; then
        error "Failed to find custom IPSW. Please run the script again" \
        "* You may try selecting N for memory option"
    fi

    ipsw_prepare_logos_add
    ipsw_prepare_fourthree
    ipsw_bbreplace

    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_prepare_fourthree() {
    local comps=("AppleLogo" "DeviceTree" "iBoot" "RecoveryMode")
    local saved_path="../saved/$device_type/8L1"
    local bpatch="../resources/patch/fourthree/$device_type/6.1.3"
    local name
    local iv
    local key
    if [[ $ipsw_fourthree != 1 ]]; then
        return
    fi
    ipsw_get_url 8L1
    url="$ipsw_url"
    device_fw_key_check
    device_fw_key_check temp 8L1
    mkdir -p $all_flash Downgrade $saved_path 2>/dev/null
    log "Extracting files"
    unzip -o -j "$ipsw_path.ipsw" $all_flash/manifest -d $all_flash
    unzip -o -j temp.ipsw Downgrade/RestoreDeviceTree
    log "RestoreDeviceTree"
    iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "DeviceTree") | .iv')
    key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "DeviceTree") | .key')
    "$dir/xpwntool" RestoreDeviceTree RestoreDeviceTree.dec -iv $iv -k $key -decrypt
    $bspatch RestoreDeviceTree.dec Downgrade/RestoreDeviceTree $bpatch/RestoreDeviceTree.patch
    for getcomp in "${comps[@]}"; do
        name=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
        iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        path="$all_flash/"
        log "$getcomp"
        if [[ $vers == "$device_base_vers" ]]; then
            unzip -o -j "$ipsw_base_path.ipsw" ${path}$name
        elif [[ -e $saved_path/$name ]]; then
            cp $saved_path/$name .
        else
            "$dir/pzb" -g "${path}$name" -o "$name" "$url"
            cp $name $saved_path/
        fi
        "$dir/xpwntool" $name $getcomp.dec -iv $iv -k $key -decrypt
        case $getcomp in
            "AppleLogo" )
                getcomp="applelogo"
                mv AppleLogo.dec applelogo.dec
                echo "0000010: 6267" | xxd -r - applelogo.dec
                echo "0000020: 6267" | xxd -r - applelogo.dec
            ;;
            "DeviceTree" )
                echo "0000010: 6272" | xxd -r - DeviceTree.dec
                echo "0000020: 6272" | xxd -r - DeviceTree.dec
            ;;
            "RecoveryMode" )
                getcomp="recoverymode"
                mv RecoveryMode.dec recoverymode.dec
                echo "0000010: 6263" | xxd -r - recoverymode.dec
                echo "0000020: 6263" | xxd -r - recoverymode.dec
            ;;
            "iBoot" )
                mv iBoot.dec iBoot.dec0
                $bspatch iBoot.dec0 iBoot.dec $bpatch/iBoot.${device_model}ap.RELEASE.patch
                #"$dir/xpwntool" iBoot.dec0 iBoot.dec2
                #"$dir/iBoot32Patcher" iBoot.dec2 iBoot.patched --rsa -b "rd=disk0s3 -v amfi=0xff cs_enforcement_disable=1 pio-error=0"
                #"$dir/xpwntool" iBoot.patched iBoot.dec -t iBoot.dec0
                #echo "0000010: 626F" | xxd -r - iBoot.dec
                #echo "0000020: 626F" | xxd -r - iBoot.dec
            ;;
        esac
        mv $getcomp.dec $path/${getcomp}B.img3
        echo "${getcomp}B.img3" >> $path/manifest
    done
    log "Add files to IPSW"
    zip -r0 temp.ipsw $all_flash/* Downgrade/*
}

ipsw_prepare_fourthree_part2() {
    device_fw_key_check base
    local saved_path="../saved/$device_type/$device_base_build"
    local bpatch="../resources/patch/fourthree/$device_type/$device_base_vers"
    local iv
    local key
    mkdir -p $saved_path 2>/dev/null
    if [[ ! -s $saved_path/Kernelcache ]]; then
        log "Kernelcache"
        iv=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "Kernelcache") | .iv')
        key=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "Kernelcache") | .key')
        unzip -o -j "$ipsw_base_path.ipsw" kernelcache.release.$device_model
        "$dir/xpwntool" kernelcache.release.$device_model kernelcache.dec -iv $iv -k $key
        $bspatch kernelcache.dec kernelcache.patched $bpatch/kernelcache.release.patch
        #$bspatch kernelcache.dec kernelcache.patched ../resources/patch/kernelcache.release.$device_model.$device_base_build.patch
        "$dir/xpwntool" kernelcache.patched kernelcachb -t kernelcache.release.$device_model -iv $iv -k $key
        "$dir/xpwntool" kernelcachb $saved_path/Kernelcache -iv $iv -k $key -decrypt
    fi
    if [[ ! -s $saved_path/LLB ]]; then
        log "LLB"
        iv=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "LLB") | .iv')
        key=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "LLB") | .key')
        unzip -o -j "$ipsw_base_path.ipsw" $all_flash/LLB.${device_model}ap.RELEASE.img3
        "$dir/xpwntool" LLB.${device_model}ap.RELEASE.img3 llb.dec -iv $iv -k $key
        $bspatch llb.dec $saved_path/LLB $bpatch/LLB.${device_model}ap.RELEASE.patch
    fi
    if [[ ! -s $saved_path/RootFS.dmg ]]; then
        log "RootFS"
        name=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "RootFS") | .filename')
        key=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "RootFS") | .key')
        unzip -o -j "$ipsw_base_path.ipsw" $name
        "$dir/dmg" extract $name rootfs.dec -k $key
        rm $name
        "$dir/dmg" build rootfs.dec $saved_path/RootFS.dmg
    fi
    echo "device_base_vers=$device_base_vers" > ../saved/$device_type/fourthree_$device_ecid
    echo "device_base_build=$device_base_build" >> ../saved/$device_type/fourthree_$device_ecid
}

ipsw_prepare_keys() {
    local comp="$1"
    local getcomp="$1"
    case $comp in
        "RestoreLogo" ) getcomp="AppleLogo";;
        *"KernelCache" ) getcomp="Kernelcache";;
        "RestoreDeviceTree" ) getcomp="DeviceTree";;
    esac
    local fw_key="$device_fw_key"
    if [[ $2 == "base" ]]; then
        fw_key="$device_fw_key_base"
    fi
    local name=$(echo $fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
    local iv=$(echo $fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
    local key=$(echo $fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
    if [[ $device_target_build == "14"* && $getcomp == "iBSS" ]]; then
        name="$(curl "https://www.theiphonewiki.com/wiki/${ipsw_codename}_${device_target_build}_(${device_type})" | grep "iBSS" -A1 | sed "s/^.*keypage-ibss\">//" | sed "s/^.*h2>//" | sed "s/<\/span>//" | sed "s/<\/p>//" | tr -d '\n')"
    elif [[ $device_target_build == "14"* && $getcomp == "iBEC" ]]; then
        name="$(curl "https://www.theiphonewiki.com/wiki/${ipsw_codename}_${device_target_build}_(${device_type})" | grep "iBEC" -A1 | sed "s/^.*keypage-ibec\">//" | sed "s/^.*h2>//" | sed "s/<\/span>//" | sed "s/<\/p>//" | tr -d '\n')"
    fi
    if [[ -z $name && $device_proc != 1 ]]; then
        error "Issue with firmware keys: Failed getting $getcomp. Check The Apple Wiki or your wikiproxy"
    fi

    case $comp in
        "iBSS" | "iBEC" )
            if [[ -z $name ]]; then
                name="$getcomp.${device_model}ap.RELEASE.dfu"
            fi
            echo "<key>$comp</key><dict><key>File</key><string>Firmware/dfu/$name</string><key>IV</key><string>$iv</string><key>Key</key><string>$key</string>" >> $NewPlist
            if [[ $ipsw_prepare_usepowder == 1 ]]; then
                echo "<key>Patch</key><true/>" >> $NewPlist
            elif [[ -s $FirmwareBundle/$comp.${device_model}ap.RELEASE.patch ]]; then
                echo "<key>Patch</key><string>$comp.${device_model}ap.RELEASE.patch</string>" >> $NewPlist
            elif [[ -s $FirmwareBundle/$comp.${device_model}.RELEASE.patch ]]; then
                echo "<key>Patch</key><string>$comp.${device_model}.RELEASE.patch</string>" >> $NewPlist
            fi
        ;;

        "iBoot" )
            echo "<key>$comp</key><dict><key>File</key><string>$all_flash/$name</string><key>IV</key><string>$iv</string><key>Key</key><string>$key</string>" >> $NewPlist
            echo "<key>Patch</key><string>$comp.${device_model}ap.RELEASE.patch</string>" >> $NewPlist
        ;;

        "RestoreRamdisk" )
            echo "<key>Restore Ramdisk</key><dict><key>File</key><string>$name</string><key>IV</key><string>$iv</string><key>Key</key><string>$key</string>" >> $NewPlist
        ;;

        "RestoreDeviceTree" | "RestoreLogo" )
            echo "<key>$comp</key><dict><key>File</key><string>$all_flash/$name</string><key>IV</key><string>$iv</string><key>Key</key><string>$key</string><key>DecryptPath</key><string>Downgrade/$comp</string>" >> $NewPlist
        ;;

        "RestoreKernelCache" )
            echo "<key>$comp</key><dict><key>File</key><string>$name</string><key>IV</key><string>$iv</string><key>Key</key><string>$key</string><key>DecryptPath</key><string>Downgrade/$comp</string>" >> $NewPlist
        ;;

        "KernelCache" )
            echo "<key>$comp</key><dict><key>File</key><string>$name</string><key>IV</key><string>$iv</string><key>Key</key><string>$key</string>" >> $NewPlist
            if [[ $ipsw_prepare_usepowder == 1 ]]; then
                echo "<key>Patch</key><true/>" >> $NewPlist
            elif [[ -e $FirmwareBundle/kernelcache.release.patch ]]; then
                echo "<key>Patch</key><string>kernelcache.release.patch</string>" >> $NewPlist
            fi
        ;;

        "WTF2" )
            echo "<key>WTF 2</key><dict><key>File</key><string>Firmware/dfu/WTF.s5l8900xall.RELEASE.dfu</string><key>Patch</key><string>WTF.s5l8900xall.RELEASE.patch</string>" >> $NewPlist
        ;;
    esac
    if [[ $2 != "old" ]]; then
        echo "<key>Decrypt</key><true/>" >> $NewPlist
    fi
    echo "</dict>" >> $NewPlist
}

ipsw_prepare_paths() {
    local comp="$1"
    local getcomp="$1"
    case $comp in
        "BatteryPlugin" ) getcomp="GlyphPlugin";;
        "NewAppleLogo" | "APTicket" ) getcomp="AppleLogo";;
        "NewRecoveryMode" ) getcomp="RecoveryMode";;
        "NewiBoot" ) getcomp="iBoot";;
    esac
    local fw_key="$device_fw_key"
    if [[ $2 == "base" ]]; then
        fw_key="$device_fw_key_base"
    fi
    local name=$(echo $fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
    if [[ -z $name && $getcomp != "manifest" ]]; then
        error "Issue with firmware keys: Failed getting $getcomp. Check The Apple Wiki or your wikiproxy"
    fi
    local str="<key>$comp</key><dict><key>File</key><string>$all_flash/"
    local str2
    local logostuff
    if [[ $2 == "target" ]]; then
        case $comp in
            *"AppleLogo" )
                if [[ $device_latest_vers == "5"* ]]; then
                    logostuff=1
                else
                    case $device_target_vers in
                        [789]* ) logostuff=1;;
                    esac
                fi
            ;;
        esac
        case $comp in
            "AppleLogo" ) str2="${name/applelogo/applelogo7}";;
            "APTicket" ) str2="${name/applelogo/applelogoT}";;
            "RecoveryMode" ) str2="${name/recoverymode/recoverymode7}";;
            "NewiBoot" ) str2="${name/iBoot/iBoot2}";;
        esac
        case $comp in
            "AppleLogo" )
                str+="$str2"
                if [[ $logostuff == 1 ]]; then
                    echo "$str2" >> $FirmwareBundle/manifest
                fi
            ;;
            "APTicket" | "RecoveryMode" )
                str+="$str2"
                echo "$str2" >> $FirmwareBundle/manifest
            ;;
            "NewiBoot" )
                if [[ $device_type != "iPad1,1" ]]; then
                    str+="$str2"
                    echo "$str2" >> $FirmwareBundle/manifest
                fi
            ;;
            "manifest" ) str+="manifest";;
            * ) str+="$name";;
        esac
    else
        str+="$name"
    fi
    str+="</string>"

    if [[ $comp == "NewiBoot" ]]; then
        local iv=$(echo $fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        local key=$(echo $fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        str+="<key>IV</key><string>$iv</string><key>Key</key><string>$key</string>"
    elif [[ $comp == "manifest" ]]; then
        str+="<key>manifest</key><string>manifest</string>"
    fi

    echo "$str</dict>" >> $NewPlist
}

ipsw_prepare_config() {
    # usage: ipsw_prepare_config [jailbreak (true/false)] [needpref (true/false)]
    # creates config file to FirmwareBundles/config.plist
    local verbose="false"
    if [[ $ipsw_verbose == 1 ]]; then
        verbose="true"
    fi
    log "Preparing config file"
    echo "<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">
<plist version=\"1.0\">
<dict>
    <key>FilesystemJailbreak</key>
    <$1/>
    <key>needPref</key>
    <$2/>
    <key>iBootPatches</key>
    <dict>
        <key>debugEnabled</key>
        <false/>
        <key>bootArgsInjection</key>
        <$verbose/>
        <key>bootArgsString</key>
        <string>-v</string>
    </dict>
</dict>
</plist>" | tee FirmwareBundles/config.plist
}

ipsw_prepare_systemversion() {
    local sysplist="SystemVersion.plist"
    log "Beta iOS detected, preparing modified $sysplist"
    echo '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict>' > $sysplist
    echo "<key>ProductBuildVersion</key><string>$device_target_build</string>" >> $sysplist
    local copyright="<key>ProductCopyright</key><string>1983-201"
    case $device_target_vers in
        3* ) copyright+="0";;
        4* ) copyright+="1";;
        5* ) copyright+="2";;
        6* ) copyright+="3";;
        7* ) copyright+="4";;
        8* ) copyright+="5";;
        9* ) copyright+="6";;
    esac
    copyright+=" Apple Inc.</string>"
    echo "$copyright" >> $sysplist # idk if the copyright key is actually needed but whatever
    echo "<key>ProductName</key><string>iPhone OS</string>" >> $sysplist
    echo "<key>ProductVersion</key><string>$device_target_vers</string>" >> $sysplist
    echo "</dict></plist>" >> $sysplist
    cat $sysplist
    mkdir -p System/Library/CoreServices
    mv SystemVersion.plist System/Library/CoreServices
    tar -cvf systemversion.tar System
}

ipsw_prepare_bundle() {
    device_fw_key_check $1
    local ipsw_p="$ipsw_path"
    local key="$device_fw_key"
    local vers="$device_target_vers"
    local build="$device_target_build"
    local hw="$device_model"
    local base_build="11D257"
    local RootSize
    local daibutsu
    FirmwareBundle="FirmwareBundles/"
    if [[ $1 == "daibutsu" ]]; then
        daibutsu=1
    fi

    mkdir FirmwareBundles 2>/dev/null
    if [[ $1 == "base" ]]; then
        ipsw_p="$ipsw_base_path"
        key="$device_fw_key_base"
        vers="$device_base_vers"
        build="$device_base_build"
        FirmwareBundle+="BASE_"
    elif [[ $1 == "target" ]]; then
        if [[ $ipsw_jailbreak == 1 ]]; then
            case $vers in
                [689]* ) ipsw_prepare_config true true;;
                * ) ipsw_prepare_config false true;;
            esac
        else
            ipsw_prepare_config false true
        fi
    elif [[ $ipsw_jailbreak == 1 ]]; then
        ipsw_prepare_config false true
    else
        ipsw_prepare_config false false
    fi
    local FirmwareBundle2="../resources/firmware/FirmwareBundles/Down_${device_type}_${vers}_${build}.bundle"
    if [[ $ipsw_prepare_usepowder == 1 ]]; then
        FirmwareBundle2=
    elif [[ -d $FirmwareBundle2 ]]; then
        FirmwareBundle+="Down_"
    fi
    FirmwareBundle+="${device_type}_${vers}_${build}.bundle"
    local NewPlist=$FirmwareBundle/Info.plist
    mkdir -p $FirmwareBundle

    log "Generating firmware bundle for $device_type-$vers ($build) $1..."
    unzip -o -j "$ipsw_p.ipsw" $all_flash/manifest
    mv manifest $FirmwareBundle/
    local ramdisk_name=$(echo "$key" | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .filename')
    local RamdiskIV=$(echo "$key" | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .iv')
    local RamdiskKey=$(echo "$key" | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .key')
    if [[ $device_target_build == "14"* ]]; then
        case $device_target_build in
            14A* ) ipsw_codename="Whitetail";;
            14B* ) ipsw_codename="Butler";;
            14C* ) ipsw_codename="Corry";;
            14D* ) ipsw_codename="Dubois";;
            14E* ) ipsw_codename="Erie";;
            14F* ) ipsw_codename="Franklin";;
            14G* ) ipsw_codename="Greensburg";;
        esac
        if [[ $ipsw_isbeta == 1 ]]; then
            ipsw_codename+="Seed"
        fi
        ramdisk_name="$(curl "https://www.theiphonewiki.com/wiki/${ipsw_codename}_${device_target_build}_(${device_type})" | grep "Restore Ramdisk" -A1 | sed "s/^.*keypage-restoreramdisk\">//" | sed "s/^.*h2>//" | sed "s/<\/span>//" | tr -d '\n')"
    fi
    if [[ -z $ramdisk_name ]]; then
        error "Issue with firmware keys: Failed getting RestoreRamdisk. Check The Apple Wiki or your wikiproxy"
    fi
    unzip -o -j "$ipsw_p.ipsw" $ramdisk_name
    "$dir/xpwntool" $ramdisk_name Ramdisk.raw -iv $RamdiskIV -k $RamdiskKey
    "$dir/hfsplus" Ramdisk.raw extract usr/local/share/restore/options.$device_model.plist
    if [[ ! -s options.$device_model.plist ]]; then
        rm options.$device_model.plist
        "$dir/hfsplus" Ramdisk.raw extract usr/local/share/restore/options.plist
        mv options.plist options.$device_model.plist
    fi
    if [[ $device_target_vers == "3.2"* ]]; then
        RootSize=1000
    elif [[ $device_target_vers == "3"* ]]; then
        case $device_type in
            iPhone1* | iPod1,1 ) RootSize=420;;
            iPod2,1 ) RootSize=450;;
            *       ) RootSize=750;;
        esac
    elif [[ $platform == "macos" ]]; then
        plutil -extract 'SystemPartitionSize' xml1 options.$device_model.plist -o size
        RootSize=$(cat size | sed -ne '/<integer>/,/<\/integer>/p' | sed -e "s/<integer>//" | sed "s/<\/integer>//" | sed '2d')
    else
        RootSize=$(cat options.$device_model.plist | grep -i SystemPartitionSize -A 1 | grep -oPm1 "(?<=<integer>)[^<]+")
    fi
    RootSize=$((RootSize+30))
    local rootfs_name="$(echo "$key" | $jq -j '.keys[] | select(.image == "RootFS") | .filename')"
    local rootfs_key="$(echo "$key" | $jq -j '.keys[] | select(.image == "RootFS") | .key')"
    if [[ $device_target_build == "14"* ]]; then
        rootfs_name="$(curl "https://www.theiphonewiki.com/wiki/${ipsw_codename}_${device_target_build}_(${device_type})" | grep "Root" -A1 | sed "s/^.*keypage-rootfs\">//" | sed "s/^.*h2>//" | sed "s/<\/span>//" | tr -d '\n')"
    fi
    if [[ -z $rootfs_name ]]; then
        error "Issue with firmware keys: Failed getting RootFS. Check The Apple Wiki or your wikiproxy"
    fi
    echo '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict>' > $NewPlist
    echo "<key>Filename</key><string>$ipsw_p.ipsw</string>" >> $NewPlist
    echo "<key>RootFilesystem</key><string>$rootfs_name</string>" >> $NewPlist
    echo "<key>RootFilesystemKey</key><string>$rootfs_key</string>" >> $NewPlist
    echo "<key>RootFilesystemSize</key><integer>$RootSize</integer>" >> $NewPlist
    printf "<key>RamdiskOptionsPath</key><string>/usr/local/share/restore/options" >> $NewPlist
    if [[ $device_target_vers != "3"* && $device_target_vers != "4"* ]] ||
       [[ $device_type == "iPad1,1" && $device_target_vers == "4"* ]]; then
        printf ".%s" "$device_model" >> $NewPlist
    fi
    echo ".plist</string>" >> $NewPlist
    if [[ $1 == "base" ]]; then
        echo "<key>SHA1</key><string>$device_base_sha1</string>" >> $NewPlist
    else
        echo "<key>SHA1</key><string>$device_target_sha1</string>" >> $NewPlist
    fi

    if [[ $1 == "base" ]]; then
        case $device_type in
            iPhone5,[12] ) hw="iphone5";;
            iPhone5,[34] ) hw="iphone5b";;
            iPad3,[456] )  hw="ipad3b";;
        esac
        case $device_base_build in
            "11A"* | "11B"* ) base_build="11B554a";;
            "9"* ) base_build="9B206";;
        esac
        echo "<key>RamdiskExploit</key><dict>" >> $NewPlist
        echo "<key>exploit</key><string>src/target/$hw/$base_build/exploit</string>" >> $NewPlist
        echo "<key>inject</key><string>src/target/$hw/$base_build/partition</string></dict>" >> $NewPlist
    elif [[ $1 == "target" ]]; then
        echo "<key>FilesystemPackage</key><dict><key>bootstrap</key><string>freeze.tar</string>" >> $NewPlist
        case $vers in
            8* | 9* ) echo "<key>package</key><string>src/ios9.tar</string>" >> $NewPlist;;
        esac
        printf "</dict><key>RamdiskPackage</key><dict><key>package</key><string>src/bin.tar</string><key>ios</key><string>ios" >> $NewPlist
        case $vers in
            3* ) printf "3" >> $NewPlist;;
            4* ) printf "4" >> $NewPlist;;
            5* ) printf "5" >> $NewPlist;;
            6* ) printf "6" >> $NewPlist;;
            7* ) printf "7" >> $NewPlist;;
            8* ) printf "8" >> $NewPlist;;
            9* ) printf "9" >> $NewPlist;;
        esac
        echo "</string></dict>" >> $NewPlist
    elif [[ $ipsw_prepare_usepowder == 1 ]]; then
        echo "<key>FilesystemPackage</key><dict/><key>RamdiskPackage</key><dict/>" >> $NewPlist
    elif [[ $ipsw_isbeta == 1 && $ipsw_prepare_usepowder != 1 ]]; then
        warn "iOS 4.1 beta or older detected. Attempting workarounds"
        cp $FirmwareBundle2/* $FirmwareBundle
        echo "<key>RamdiskPatches</key><dict/>" >> $NewPlist
        echo "<key>FilesystemPatches</key><dict/>" >> $NewPlist
        ipsw_isbeta_needspatch=1
    elif [[ -d $FirmwareBundle2 ]]; then
        cp $FirmwareBundle2/* $FirmwareBundle
        echo "<key>RamdiskPatches</key><dict>" >> $NewPlist
        echo "<key>asr</key><dict>" >> $NewPlist
        echo "<key>File</key><string>usr/sbin/asr</string><key>Patch</key><string>asr.patch</string></dict>" >> $NewPlist
        if [[ -s $FirmwareBundle/restoredexternal.patch ]]; then
            echo "<key>restoredexternal</key><dict>" >> $NewPlist
            echo "<key>File</key><string>usr/local/bin/restored_external</string><key>Patch</key><string>restoredexternal.patch</string></dict>" >> $NewPlist
        fi
        echo "</dict>" >> $NewPlist
        if [[ $ipsw_hacktivate == 1 ]]; then
            echo "<key>FilesystemPatches</key><dict>" >> $NewPlist
            echo "<key>Hacktivation</key><array><dict>" >> $NewPlist
            echo "<key>Action</key><string>Patch</string><key>File</key><string>usr/libexec/lockdownd</string>" >> $NewPlist
            echo "<key>Patch</key><string>lockdownd.patch</string></dict></array></dict>" >> $NewPlist
        else
            echo "<key>FilesystemPatches</key><dict/>" >> $NewPlist # ipsw segfaults if this is missing lol
        fi
    fi

    if [[ $1 == "base" ]]; then
        echo "<key>Firmware</key><dict/>" >> $NewPlist
    elif [[ $1 == "target" && $vers == "4"* ]]; then
        echo "<key>Firmware</key><dict>" >> $NewPlist
        ipsw_prepare_keys iBSS $1
        ipsw_prepare_keys RestoreRamdisk $1
        echo "</dict>" >> $NewPlist
    elif [[ $ipsw_isbeta_needspatch == 1 ]]; then
        echo "<key>FirmwarePatches</key><dict>" >> $NewPlist
        ipsw_prepare_keys RestoreDeviceTree $1
        ipsw_prepare_keys RestoreLogo $1
        ipsw_prepare_keys RestoreKernelCache $1
        ipsw_prepare_keys RestoreRamdisk $1
        echo "</dict>" >> $NewPlist
    elif [[ $device_target_build == "14"* ]]; then
        echo "<key>Firmware</key><dict>" >> $NewPlist
        ipsw_prepare_keys iBSS
        ipsw_prepare_keys iBEC
        ipsw_prepare_keys RestoreRamdisk
    else
        if [[ $ipsw_prepare_usepowder == 1 ]]; then
            echo "<key>Firmware</key><dict>" >> $NewPlist
        else
            echo "<key>FirmwarePatches</key><dict>" >> $NewPlist
        fi
        ipsw_prepare_keys iBSS $1
        # ios 4 and lower do not need ibec patches. the exception is the ipad lineup
        if [[ $vers != "3"* && $vers != "4"* ]] || [[ $device_type == "iPad1,1" || $device_type == "iPad2"* ]]; then
            ipsw_prepare_keys iBEC $1
        fi
        if [[ $device_proc != 1 ]]; then
            ipsw_prepare_keys RestoreDeviceTree $1
            ipsw_prepare_keys RestoreLogo $1
        fi
        if [[ $1 == "target" ]]; then
            case $vers in
                [457]* ) ipsw_prepare_keys RestoreKernelCache $1;;
                * ) ipsw_prepare_keys KernelCache $1;;
            esac
        elif [[ $device_proc != 1 && $device_target_vers != "3.0"* ]]; then
            ipsw_prepare_keys RestoreKernelCache $1
        fi
        ipsw_prepare_keys RestoreRamdisk $1
        if [[ $1 == "old" ]]; then
            if [[ $device_type == "iPod2,1" ]]; then
                case $device_target_vers in
                    4.2.1 | 4.1 | 3.1.3 ) :;;
                    * )
                        ipsw_prepare_keys iBoot $1
                        ipsw_prepare_keys KernelCache $1
                    ;;
                esac
            elif [[ $device_proc == 1 ]]; then
                ipsw_prepare_keys KernelCache $1
                ipsw_prepare_keys WTF2 $1
            else
                case $device_target_vers in
                    6.1.6 | 4.1 ) :;;
                    3.0* ) ipsw_prepare_keys iBoot $1;;
                    * )
                        ipsw_prepare_keys iBoot $1
                        ipsw_prepare_keys KernelCache $1
                    ;;
                esac
            fi
        fi
        echo "</dict>" >> $NewPlist
    fi

    if [[ $1 == "base" ]]; then
        echo "<key>FirmwarePath</key><dict>" >> $NewPlist
        ipsw_prepare_paths AppleLogo $1
        ipsw_prepare_paths BatteryCharging0 $1
        ipsw_prepare_paths BatteryCharging1 $1
        ipsw_prepare_paths BatteryFull $1
        ipsw_prepare_paths BatteryLow0 $1
        ipsw_prepare_paths BatteryLow1 $1
        ipsw_prepare_paths BatteryPlugin $1
        ipsw_prepare_paths RecoveryMode $1
        ipsw_prepare_paths LLB $1
        ipsw_prepare_paths iBoot $1
        echo "</dict>" >> $NewPlist
    elif [[ $1 == "target" ]]; then
        echo "<key>FirmwareReplace</key><dict>" >> $NewPlist
        if [[ $vers == "4"* ]]; then
            ipsw_prepare_paths APTicket $1
        fi
        ipsw_prepare_paths AppleLogo $1
        ipsw_prepare_paths NewAppleLogo $1
        ipsw_prepare_paths BatteryCharging0 $1
        ipsw_prepare_paths BatteryCharging1 $1
        ipsw_prepare_paths BatteryFull $1
        ipsw_prepare_paths BatteryLow0 $1
        ipsw_prepare_paths BatteryLow1 $1
        ipsw_prepare_paths BatteryPlugin $1
        ipsw_prepare_paths RecoveryMode $1
        ipsw_prepare_paths NewRecoveryMode $1
        ipsw_prepare_paths LLB $1
        ipsw_prepare_paths iBoot $1
        ipsw_prepare_paths NewiBoot $1
        ipsw_prepare_paths manifest $1
        echo "</dict>" >> $NewPlist
    fi

    if [[ $daibutsu == 1 ]]; then
        if [[ $ipsw_prepare_usepowder == 1 ]]; then
            echo "<key>RamdiskPackage2</key>" >> $NewPlist
        else
            echo "<key>PackagePath</key><string>./freeze.tar</string>" >> $NewPlist
            echo "<key>RamdiskPackage</key>" >> $NewPlist
        fi
        echo "<string>./bin.tar</string><key>RamdiskReboot</key><string>./reboot.sh</string><key>UntetherPath</key><string>./untether.tar</string>" >> $NewPlist
        local hwmodel="$(tr '[:lower:]' '[:upper:]' <<< ${device_model:0:1})${device_model:1}"
        echo "<key>hwmodel</key><string>$hwmodel</string>" >> $NewPlist
    fi

    echo "</dict></plist>" >> $NewPlist
    cat $NewPlist
}

ipsw_prepare_32bit() {
    local ExtraArgs
    local daibutsu
    local JBFiles=()
    if [[ $device_target_vers == "3"* || $device_target_vers == "4"* ]] && [[ $ipsw_nskip != 1 ]]; then
        ipsw_prepare_jailbreak
        return
    elif [[ -e "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    elif [[ $ipsw_nskip == 1 ]]; then
        :
    elif [[ $ipsw_jailbreak != 1 && $device_target_build != "9A406" && # 9a406 needs custom ipsw
            $device_proc != 4 && $device_actrec != 1 && $device_target_tethered != 1 ]]; then
        log "No need to create custom IPSW for non-jailbroken restores on $device_type-$device_target_build"
        return
    elif [[ $ipsw_jailbreak == 1 && $device_target_vers == "8"* ]]; then
        daibutsu="daibutsu"
        ExtraArgs+=" -daibutsu"
        cp $jelbrek/daibutsu/bin.tar $jelbrek/daibutsu/untether.tar .
        ipsw_prepare_rebootsh
    fi
    ipsw_prepare_usepowder=1

    ipsw_prepare_bundle $daibutsu

    if [[ $ipsw_memory == 1 ]]; then
        ExtraArgs+=" -memory"
    fi
    ExtraArgs+=" -ramdiskgrow 10"
    if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]]; then
        ExtraArgs+=" -bbupdate"
    elif [[ $device_type == "$device_disable_bbupdate" && $device_deadbb != 1 ]]; then
        device_dump baseband
        ExtraArgs+=" ../saved/$device_type/baseband-$device_ecid.tar"
    fi
    if [[ $device_actrec == 1 ]]; then
        device_dump activation
        ExtraArgs+=" ../saved/$device_type/activation-$device_ecid.tar"
    fi

    if [[ $ipsw_jailbreak == 1 ]]; then
        case $device_target_vers in
            9.3.[1234] | 9.3 ) JBFiles+=("untetherhomedepot.tar");;
            9.2* | 9.1 ) JBFiles+=("untetherhomedepot921.tar");;
            7.1* )       JBFiles+=("panguaxe.tar");;
            7* )         JBFiles+=("evasi0n7-untether.tar");;
            6.1.[3456] ) JBFiles+=("p0sixspwn.tar");;
            6* )         JBFiles+=("evasi0n6-untether.tar");;
            5* | 4.[32]* ) JBFiles+=("g1lbertJB/${device_type}_${device_target_build}.tar");;
        esac
        if [[ -n ${JBFiles[0]} ]]; then
            JBFiles[0]=$jelbrek/${JBFiles[0]}
        fi
        case $device_target_vers in
            9* | 8* ) JBFiles+=("$jelbrek/fstab8.tar");;
            7* ) JBFiles+=("$jelbrek/fstab7.tar");;
            4* ) JBFiles+=("$jelbrek/fstab_old.tar");;
            * )  JBFiles+=("$jelbrek/fstab_rw.tar");;
        esac
        case $device_target_vers in
            4.3* )
                if [[ $device_type == "iPad2"* ]]; then
                    JBFiles[0]=
                fi
            ;;
            4.2.1 )
                if [[ $device_type != "iPhone1,2" ]]; then
                    ExtraArgs+=" -punchd"
                    JBFiles[0]=$jelbrek/greenpois0n/${device_type}_${device_target_build}.tar
                fi
            ;;
        esac
        JBFiles+=("$jelbrek/freeze.tar")
        if [[ $device_target_vers == "5"* ]]; then
            JBFiles+=("$jelbrek/cydiasubstrate.tar" "$jelbrek/g1lbertJB.tar")
        fi
        if [[ $ipsw_openssh == 1 ]]; then
            JBFiles+=("$jelbrek/sshdeb.tar")
        fi
        if [[ $device_target_tethered == 1 ]]; then
            case $device_target_vers in
                4.2.[8761] ) :;;
                5* | 4.[32]* ) JBFiles+=("$jelbrek/g1lbertJB/install.tar");;
            esac
        fi
    fi
    if [[ $ipsw_isbeta == 1 ]]; then
        ipsw_prepare_systemversion
        ExtraArgs+=" systemversion.tar"
    fi
    if [[ $1 == "iboot" ]]; then
        ExtraArgs+=" iBoot.tar"
    fi

    log "Preparing custom IPSW: $dir/powdersn0w $ipsw_path.ipsw temp.ipsw $ExtraArgs ${JBFiles[*]}"
    "$dir/powdersn0w" "$ipsw_path.ipsw" temp.ipsw $ExtraArgs ${JBFiles[@]}

    if [[ ! -e temp.ipsw ]]; then
        error "Failed to find custom IPSW. Please run the script again" \
        "* You may try selecting N for memory option"
    fi

    ipsw_bbreplace
    if [[ $device_target_vers == "4"* ]]; then
        ipsw_prepare_ios4patches
        log "Add all to custom IPSW"
        zip -r0 temp.ipsw Firmware/dfu/*
    fi

    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_bbdigest() {
    local loc="BuildIdentities:0:"
    if [[ $2 != "UniqueBuildID" ]]; then
        loc+="Manifest:BasebandFirmware:"
    fi
    loc+="$2"
    local out="$1"
    if [[ $platform == "macos" ]]; then
        echo $out | base64 --decode > t
        log "Replacing $2"
        $PlistBuddy -c "Import $loc t" BuildManifest.plist
        rm t
        return
    fi
    in=$($PlistBuddy -c "Print $loc" BuildManifest.plist | tr -d "<>" | xxd -r -p | base64)
    echo "${in}<" > replace
    #sed -i'' "s,AAAAAAAAAAAAAAAAAAAAAAA<,==," replace
    #sed -i'' "s,AAAAAAAAAAAAA<,=," replace
    #sed -i'' "s,AAAAAAAAA<,=," replace
    cat replace | sed "s,AAAAAAAAAAAAAAAAAAAAAAA<,==," > t
    cat t  | sed "s,AAAAAAAAAAAAA<,=," > tt
    cat tt | sed "s,AAAAAAAAA<,=," > replace
    in="$(cat replace)"
    rm replace t tt
    case $2 in
        *"PartialDigest" )
            in="${in%????????????}"
            in=$(cat BuildManifest.plist | grep "$in" -m1)
            log "Replacing $2"
            #sed -i'' "s,$in,replace," BuildManifest.plist
            #sed -i'' "/replace/{n;d}" BuildManifest.plist
            cat BuildManifest.plist | sed "s,$in,replace," > t
            awk 'f{$0="";f=0}/replace/{f=1}1' t > tt
            awk '/replace$/{printf("%s",$0);next}1' tt > tmp.plist
            rm t tt
            in="replace"
        ;;
        * ) log "Replacing $2"; mv BuildManifest.plist tmp.plist;;
    esac
    #sed -i'' "s,$in,$out," BuildManifest.plist
    cat tmp.plist | sed "s,$in,$out," > BuildManifest.plist
    rm tmp.plist
}

ipsw_bbreplace() {
    local rsb1
    local sbl1
    local path
    local rsb_latest
    local sbl_latest
    local bbfw="Print BuildIdentities:0:Manifest:BasebandFirmware"
    local ubid
    if [[ $device_use_bb == 0 || $device_target_vers == "$device_latest_vers" ]] || (( device_proc < 5 )); then
        return
    fi

    log "Extracting BuildManifest from IPSW"
    unzip -o -j temp.ipsw BuildManifest.plist
    mkdir Firmware 2>/dev/null
    restore_download_bbsep
    cp $restore_baseband Firmware/$device_use_bb

    case $device_type in
        iPhone4,1 ) ubid="d9Xbp0xyiFOxDvUcKMsoNjIvhwQ=";;
        iPhone5,1 ) ubid="IcrFKRzWDvccKDfkfMNPOPYHEV0=";;
        iPhone5,2 ) ubid="lnU0rtBUK6gCyXhEtHuwbEz/IKY=";;
        iPhone5,3 ) ubid="dwrol4czV3ijtNHh3w1lWIdsNdA=";;
        iPhone5,4 ) ubid="Z4ST0TczwAhpfluQFQNBg7Y3BVE=";;
        iPad2,6 ) ubid="L73HfN42pH7qAzlWmsEuIZZg2oE=";;
        iPad2,7 ) ubid="z/vJsvnUovZ+RGyXKSFB6DOjt1k=";;
        iPad3,5 ) ubid="849RPGQ9kNXGMztIQBhVoU/l5lM=";;
        iPad3,6 ) ubid="cO+N+Eo8ynFf+0rnsIWIQHTo6rg=";;
    esac
    ipsw_bbdigest $ubid UniqueBuildID

    case $device_type in
        iPhone4,1 )
            rsb1=$($PlistBuddy -c "$bbfw:eDBL-Version" BuildManifest.plist)
            sbl1=$($PlistBuddy -c "$bbfw:RestoreDBL-Version" BuildManifest.plist)
            path=$($PlistBuddy -c "$bbfw:Info:Path" BuildManifest.plist | tr -d '"')
            rsb_latest="-1577031936"
            sbl_latest="-1575983360"
            ipsw_bbdigest XAAAAADHAQCqerR8d+PvcfusucizfQ4ECBI0TA== RestoreDBL-PartialDigest
            ipsw_bbdigest Q1TLjk+/PjayCzSJJo68FTtdhyE= AMSS-HashTableDigest
            ipsw_bbdigest KkJI7ufv5tfNoqHcrU7gqoycmXA= OSBL-DownloadDigest
            ipsw_bbdigest eAAAAADIAQDxcjzF1q5t+nvLBbvewn/arYVkLw== eDBL-PartialDigest
            ipsw_bbdigest 3CHVk7EmtGjL14ApDND81cqFqhM= AMSS-DownloadDigest
        ;;
        iPhone5,[12] | iPad2,[67] | iPad3,[56] )
            rsb1=$($PlistBuddy -c "$bbfw:RestoreSBL1-Version" BuildManifest.plist)
            sbl1=$($PlistBuddy -c "$bbfw:SBL1-Version" BuildManifest.plist)
            path=$($PlistBuddy -c "$bbfw:Info:Path" BuildManifest.plist | tr -d '"')
            rsb_latest="-1559114512"
            sbl_latest="-1560163088"
            ipsw_bbdigest 2bmJ7Vd+WAmogV+hjq1a86UlBvA= APPS-DownloadDigest
            ipsw_bbdigest oNmIZf39zd94CPiiKOpKvhGJbyg= APPS-HashTableDigest
            ipsw_bbdigest dFi5J+pSSqOfz31fIvmah2GJO+E= DSP1-DownloadDigest
            ipsw_bbdigest HXUnmGmwIHbVLxkT1rHLm5V6iDM= DSP1-HashTableDigest
            ipsw_bbdigest oA5eQ8OurrWrFpkUOhD/3sGR3y8= DSP2-DownloadDigest
            ipsw_bbdigest L7v8ulq1z1Pr7STR47RsNbxmjf0= DSP2-HashTableDigest
            ipsw_bbdigest MZ1ERfoeFcbe79pFAl/hbWUSYKc= DSP3-DownloadDigest
            ipsw_bbdigest sKmLhQcjfaOliydm+iwxucr9DGw= DSP3-HashTableDigest
            ipsw_bbdigest oiW/8qZhN0r9OaLdUHCT+MMGknY= RPM-DownloadDigest
            ipsw_bbdigest fAAAAEAQAgAH58t5X9KETIPrycULi8dg7b2rSw== RestoreSBL1-PartialDigest
            ipsw_bbdigest ZAAAAIC9AQAfgUcPMN/lMt+U8s6bxipdy6td6w== SBL1-PartialDigest
            ipsw_bbdigest kHLoJsT9APu4Xwu/aRjNK10Hx84= SBL2-DownloadDigest
        ;;
        iPhone5,[34] )
            rsb1=$($PlistBuddy -c "$bbfw:RestoreSBL1-Version" BuildManifest.plist)
            sbl1=$($PlistBuddy -c "$bbfw:SBL1-Version" BuildManifest.plist)
            path=$($PlistBuddy -c "$bbfw:Info:Path" BuildManifest.plist | tr -d '"')
            rsb_latest="-1542379296"
            sbl_latest="-1543427872"
            ipsw_bbdigest TSVi7eYY4FiAzXynDVik6TY2S1c= APPS-DownloadDigest
            ipsw_bbdigest xd/JBOTxYJWmLkTWqLWl8GeINgU= APPS-HashTableDigest
            ipsw_bbdigest RigCEz69gUymh2UdyJdwZVx74Ic= DSP1-DownloadDigest
            ipsw_bbdigest a3XhREtzynTWtyQGqi/RXorXSVE= DSP1-HashTableDigest
            ipsw_bbdigest 3JTgHWvC+XZYWa5U5MPvle+imj4= DSP2-DownloadDigest
            ipsw_bbdigest Hvppb92/1o/cWQbl8ftoiW5jOLg= DSP2-HashTableDigest
            ipsw_bbdigest R60ZfsOqZX+Pd/UnEaEhWfNvVlY= DSP3-DownloadDigest
            ipsw_bbdigest DFQWkktFWNh90G2hOfwO14oEbrI= DSP3-HashTableDigest
            ipsw_bbdigest Rsn+u2mOpYEmdrw98yA8EDT5LiE= RPM-DownloadDigest
            ipsw_bbdigest cAAAAIC9AQBLeCHzsjHo8Q7+IzELZTV/ri/Vow== RestoreSBL1-PartialDigest
            ipsw_bbdigest eAAAAEBsAQB9b44LqXjR3izAYl5gB4j3Iqegkg== SBL1-PartialDigest
            ipsw_bbdigest iog3IVe+8VqgQzP2QspgFRUNwn8= SBL2-DownloadDigest
        ;;
    esac

    log "Replacing $rsb1 with $rsb_latest"
    #sed -i'' "s,$rsb1,$rsb_latest," BuildManifest.plist
    cat BuildManifest.plist | sed "s,$rsb1,$rsb_latest," > t
    log "Replacing $sbl1 with $sbl_latest"
    #sed -i'' "s,$sbl1,$sbl_latest," BuildManifest.plist
    cat t | sed "s,$sbl1,$sbl_latest," > tt
    log "Replacing $path with Firmware/$device_use_bb"
    #sed -i'' "s,$path,Firmware/$device_use_bb," BuildManifest.plist
    cat tt | sed "s,$path,Firmware/$device_use_bb," > BuildManifest.plist
    rm t tt

    zip -r0 temp.ipsw Firmware/$device_use_bb BuildManifest.plist
}

patch_iboot() {
    device_fw_key_check
    local iboot_name=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "iBoot") | .filename')
    local iboot_iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "iBoot") | .iv')
    local iboot_key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "iBoot") | .key')
    if [[ -z $iboot_name ]]; then
        error "Issue with firmware keys: Failed getting iBoot. Check The Apple Wiki or your wikiproxy"
    fi
    local rsa="--rsa"
    log "Patch iBoot: $*"
    if [[ $1 == "--logo" ]]; then
        iboot_name="${iboot_name/iBoot/iBoot2}"
        rsa=
        unzip -o -j temp.ipsw $all_flash/$iboot_name
    else
        unzip -o -j "$ipsw_path.ipsw" $all_flash/$iboot_name
    fi
    mv $iboot_name iBoot.orig
    "$dir/xpwntool" iBoot.orig iBoot.dec -iv $iboot_iv -k $iboot_key
    "$dir/iBoot32Patcher" iBoot.dec iBoot.pwned $rsa "$@"
    "$dir/xpwntool" iBoot.pwned iBoot -t iBoot.orig
    if [[ $device_type == "iPad1,1" || $device_type == "iPhone5"* ]]; then
        echo "0000010: 6365" | xxd -r - iBoot
        echo "0000020: 6365" | xxd -r - iBoot
        return
    elif [[ $device_type != "iPhone2,1" ]]; then
        echo "0000010: 626F" | xxd -r - iBoot
        echo "0000020: 626F" | xxd -r - iBoot
    fi
    "$dir/xpwntool" iBoot.pwned $iboot_name -t iBoot -iv $iboot_iv -k $iboot_key
}

ipsw_patch_file() {
    # usage: ipsw_patch_file <ramdisk/fs> <location> <filename> <patchfile>
    "$dir/hfsplus" "$1" extract "$2"/"$3"
    "$dir/hfsplus" "$1" rm "$2"/"$3"
    $bspatch "$3" "$3".patched "$4"
    "$dir/hfsplus" "$1" add "$3".patched "$2"/"$3"
    "$dir/hfsplus" "$1" chmod 755 "$2"/"$3"
    "$dir/hfsplus" "$1" chown 0:0 "$2"/"$3"
}

ipsw_prepare_ios4multipart() {
    local JBFiles=()
    ipsw_custom_part2="${device_type}_${device_target_vers}_${device_target_build}_CustomNP-${device_ecid}"
    local all_flash2="$ipsw_custom_part2/$all_flash"
    local ExtraArgs2="--boot-partition --boot-ramdisk --logo4"
    local iboot
    case $device_target_vers in
        4.2.9 | 4.2.10 ) :;;
        * ) ExtraArgs2+=" --433";;
    esac
    ExtraArgs2+=" -b"

    if [[ -e "../$ipsw_custom_part2.ipsw" && -e "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSWs. Skipping IPSW creation."
        return
    elif [[ -e "../$ipsw_custom_part2.ipsw" || -e "$ipsw_custom.ipsw" ]]; then
        rm "../$ipsw_custom_part2.ipsw" "$ipsw_custom.ipsw" 2>/dev/null
    fi

    log "Preparing NOR flash IPSW..."
    mkdir -p $ipsw_custom_part2/Firmware/dfu $ipsw_custom_part2/Downgrade $all_flash2

    local comps=("iBSS" "iBEC" "DeviceTree" "Kernelcache" "RestoreRamdisk")
    local name
    local iv
    local key
    local path
    local vers="5.1.1"
    local build="9B206"
    local saved_path="../saved/$device_type/$build"
    local url="$(cat $device_fw_dir/$build/url)"
    device_fw_key_check temp $build

    mkdir -p $saved_path
    log "Getting $vers restore components"
    for getcomp in "${comps[@]}"; do
        name=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
        iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        case $getcomp in
            "iBSS" | "iBEC" ) path="Firmware/dfu/";;
            "DeviceTree" ) path="$all_flash/";;
            * ) path="";;
        esac
        log "$getcomp"
        if [[ $vers == "$device_base_vers" ]]; then
            unzip -o -j "$ipsw_base_path.ipsw" ${path}$name
        elif [[ -e $saved_path/$name ]]; then
            cp $saved_path/$name .
        else
            "$dir/pzb" -g "${path}$name" -o "$name" "$url"
            cp $name $saved_path/
        fi
        case $getcomp in
            "DeviceTree" )
                "$dir/xpwntool" $name $ipsw_custom_part2/Downgrade/RestoreDeviceTree -iv $iv -k $key -decrypt
            ;;
            "Kernelcache" )
                "$dir/xpwntool" $name $ipsw_custom_part2/Downgrade/RestoreKernelCache -iv $iv -k $key -decrypt
            ;;
            * )
                mv $name $getcomp.orig
                "$dir/xpwntool" $getcomp.orig $getcomp.dec -iv $iv -k $key
            ;;
        esac
    done

    log "Patch iBSS"
    "$dir/iBoot32Patcher" iBSS.dec iBSS.patched --rsa
    "$dir/xpwntool" iBSS.patched $ipsw_custom_part2/Firmware/dfu/iBSS.${device_model}ap.RELEASE.dfu -t iBSS.orig

    log "Patch iBEC"
    "$dir/iBoot32Patcher" iBEC.dec iBEC.patched --rsa --ticket -b "rd=md0 -v nand-enable-reformat=1 amfi=0xff cs_enforcement_disable=1"
    "$dir/xpwntool" iBEC.patched $ipsw_custom_part2/Firmware/dfu/iBEC.${device_model}ap.RELEASE.dfu -t iBEC.orig

    log "Manifest plist"
    if [[ $vers == "$device_base_vers" ]]; then
        unzip -o -j "$ipsw_base_path.ipsw" BuildManifest.plist
    elif [[ -e $saved_path/BuildManifest.plist ]]; then
        cp $saved_path/BuildManifest.plist .
    else
        "$dir/pzb" -g "${path}BuildManifest.plist" -o "BuildManifest.plist" "$url"
        cp BuildManifest.plist $saved_path/
    fi
    cp ../resources/patch/old/$device_type/$vers/* .
    $PlistBuddy -c "Set BuildIdentities:0:Manifest:RestoreDeviceTree:Info:Path Downgrade/RestoreDeviceTree" BuildManifest.plist
    $PlistBuddy -c "Set BuildIdentities:0:Manifest:RestoreKernelCache:Info:Path Downgrade/RestoreKernelCache" BuildManifest.plist
    $PlistBuddy -c "Set BuildIdentities:0:Manifest:RestoreLogo:Info:Path Downgrade/RestoreLogo" BuildManifest.plist
    cp BuildManifest.plist $ipsw_custom_part2/

    log "Restore Ramdisk"
    local ramdisk_name=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .filename')
    mv RestoreRamdisk.dec ramdisk.dec
    "$dir/hfsplus" ramdisk.dec grow 18000000

    local rootfs_name=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "RootFS") | .filename')
    touch $ipsw_custom_part2/$rootfs_name
    log "Dummy RootFS: $rootfs_name"

    log "Modify options.plist"
    local options_plist="options.$device_model.plist"
    echo '<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>CreateFilesystemPartitions</key>
    <false/>
    <key>UpdateBaseband</key>
    <false/>
    <key>SystemImage</key>
    <false/>
</dict>
</plist>' | tee $options_plist
    "$dir/hfsplus" ramdisk.dec rm usr/local/share/restore/$options_plist
    "$dir/hfsplus" ramdisk.dec add $options_plist usr/local/share/restore/$options_plist

    log "Patch ASR"
    ipsw_patch_file ramdisk.dec usr/sbin asr asr.patch

    log "Repack Restore Ramdisk"
    "$dir/xpwntool" ramdisk.dec $ipsw_custom_part2/$ramdisk_name -t RestoreRamdisk.orig

    log "Extract all_flash from $device_base_vers base"
    unzip -o -j "$ipsw_base_path.ipsw" Firmware/all_flash/\* -d $all_flash2

    log "Add $device_target_vers DeviceTree to all_flash"
    rm $all_flash2/DeviceTree.${device_model}ap.img3
    unzip -o -j "$ipsw_path.ipsw" $all_flash/DeviceTree.${device_model}ap.img3 -d $all_flash2

    local ExtraArgs3="pio-error=0"
    if [[ $ipsw_verbose == 1 ]]; then
        ExtraArgs3+=" -v"
    fi
    patch_iboot $ExtraArgs2 "$ExtraArgs3"
    if [[ $device_type == "iPad1,1" && $device_target_vers == "3"* ]]; then
        cp iBoot ../saved/iPad1,1/iBoot3_$device_ecid
    elif [[ $device_type == "iPad1,1" ]]; then
        cp iBoot iBEC
        tar -cvf iBoot.tar iBEC
        iboot="iboot"
    else
        log "Add $device_target_vers iBoot to all_flash"
        cp iBoot $all_flash2/iBoot2.img3
        echo "iBoot2.img3" >> $all_flash2/manifest
    fi

    log "Add APTicket to all_flash"
    cat "$shsh_path" | sed '64,$d' | sed -ne '/<data>/,/<\/data>/p' | sed -e "s/<data>//" | sed "s/<\/data>//" | tr -d '[:space:]' | base64 --decode > apticket.der
    "$dir/xpwntool" apticket.der $all_flash2/applelogoT.img3 -t ../resources/firmware/src/scab_template.img3
    echo "applelogoT.img3" >> $all_flash2/manifest

    log "AppleLogo"
    local logo_name="$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "AppleLogo") | .filename')"
    if [[ -n $ipsw_customlogo ]]; then
        ipsw_prepare_logos_convert
        mv $all_flash/$logoname $logo_name
    else
        unzip -o -j "$ipsw_path.ipsw" $all_flash/$logo_name
        echo "0000010: 3467" | xxd -r - $logo_name
        echo "0000020: 3467" | xxd -r - $logo_name
    fi
    log "Add AppleLogo to all_flash"
    if [[ $device_latest_vers == "5"* ]]; then
        mv $logo_name $all_flash2/applelogo4.img3
        echo "applelogo4.img3" >> $all_flash2/manifest
    else
        sed '/applelogo/d' $all_flash2/manifest > manifest
        rm $all_flash2/manifest
        echo "$logo_name" >> manifest
        mv $logo_name manifest $all_flash2/
    fi

    log "Creating $ipsw_custom_part2.ipsw..."
    pushd $ipsw_custom_part2 >/dev/null
    zip -r0 ../../$ipsw_custom_part2.ipsw *
    popd >/dev/null

    if [[ $ipsw_skip_first == 1 ]]; then
        return
    fi

    # ------ part 2 (nor flash) ends here. start creating part 1 ipsw ------
    case $device_target_vers in
        4.2* ) ipsw_prepare_32bit $iboot;;
        *    ) ipsw_prepare_jailbreak $iboot;;
    esac

    ipsw_prepare_ios4multipart_patch=1
    ipsw_prepare_multipatch
}

ipsw_prepare_multipatch() {
    local vers
    local build
    local options_plist
    local saved_path
    local url
    local ramdisk_name
    local name
    local iv
    local key
    local comps=("iBSS" "iBEC" "DeviceTree" "Kernelcache" "RestoreRamdisk")
    local use_ticket=1

    log "Starting multipatch"
    mv "$ipsw_custom.ipsw" temp.ipsw
    rm asr* iBSS* iBEC* ramdisk* *.dmg 2>/dev/null
    options_plist="options.$device_model.plist"
    if [[ $device_type == "iPad1,1" && $device_target_vers == "4"* ]]; then
        use_ticket=
    elif [[ $device_target_vers == "3"* || $device_target_vers == "4"* ]]; then
        options_plist="options.plist"
        use_ticket=
    fi

    vers="4.2.1"
    build="8C148"
    if [[ $ipsw_isbeta == 1 ]]; then
        :
    elif [[ $device_type == "iPad1,1" || $device_type == "iPhone3,3" ]] ||
         [[ $device_type == "iPod3,1" && $device_target_vers == "3"* ]]; then
        vers="$device_target_vers"
        build="$device_target_build"
    fi
    case $device_target_vers in
        4.3* ) vers="4.3.5"; build="8L1";;
        5.0* ) vers="5.0.1"; build="9A405";;
        5.1* ) vers="5.1.1"; build="9B206";;
        6* ) vers="6.1.3"; build="10B329";;
    esac
    if [[ $ipsw_gasgauge_patch == 1 ]]; then
        local ver2="${device_target_vers:0:1}"
        if (( ver2 >= 7 )); then
            vers="6.1.3"
            build="10B329"
        fi
    else
        case $device_target_vers in
            7* ) vers="7.1.2"; build="11D257";;
            8* ) vers="8.4.1"; build="12H321";;
            9* ) vers="9.3.5"; build="13G36";;
        esac
    fi
    saved_path="../saved/$device_type/$build"
    ipsw_get_url $build
    url="$ipsw_url"
    device_fw_key_check
    ramdisk_name=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .filename')
    rootfs_name=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "RootFS") | .filename')
    if [[ -z $ramdisk_name ]]; then
        error "Issue with firmware keys: Failed getting RestoreRamdisk. Check The Apple Wiki or your wikiproxy"
    fi

    mkdir -p $saved_path Downgrade Firmware/dfu 2>/dev/null
    device_fw_key_check temp $build
    log "Getting $vers restore components"
    for getcomp in "${comps[@]}"; do
        name=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
        iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        case $getcomp in
            "iBSS" | "iBEC" ) path="Firmware/dfu/";;
            "DeviceTree" ) path="$all_flash/";;
            * ) path="";;
        esac
        log "$getcomp"
        if [[ $vers == "$device_target_vers" ]]; then
            unzip -o -j "$ipsw_path.ipsw" ${path}$name
        elif [[ -e $saved_path/$name ]]; then
            cp $saved_path/$name .
        else
            "$dir/pzb" -g "${path}$name" -o "$name" "$url"
            cp $name $saved_path/
        fi
        case $getcomp in
            "DeviceTree" )
                "$dir/xpwntool" $name Downgrade/RestoreDeviceTree -iv $iv -k $key -decrypt
                zip -r0 temp.ipsw Downgrade/RestoreDeviceTree
            ;;
            "Kernelcache" )
                "$dir/xpwntool" $name Downgrade/RestoreKernelCache -iv $iv -k $key -decrypt
                zip -r0 temp.ipsw Downgrade/RestoreKernelCache
            ;;
            * )
                mv $name $getcomp.orig
                "$dir/xpwntool" $getcomp.orig $getcomp.dec -iv $iv -k $key
            ;;
        esac
        if [[ $getcomp == "iB"* ]]; then
            local ticket=
            if [[ $getcomp == "iBEC" && $use_ticket == 1 ]]; then
                ticket="--ticket"
            fi
            log "Patch $getcomp"
            "$dir/iBoot32Patcher" $getcomp.dec $getcomp.patched --rsa --debug $ticket -b "rd=md0 -v nand-enable-reformat=1 amfi=0xff amfi_get_out_of_my_way=1 cs_enforcement_disable=1 pio-error=0"
            "$dir/xpwntool" $getcomp.patched ${path}$name -t $getcomp.orig
            cp ${path}$name ${path}$getcomp.$device_model.RELEASE.dfu 2>/dev/null
            zip -r0 temp.ipsw ${path}$name ${path}$getcomp.$device_model.RELEASE.dfu
        fi
    done

    log "Extracting ramdisk from IPSW"
    unzip -o -j temp.ipsw $ramdisk_name
    mv $ramdisk_name ramdisk2.orig
    "$dir/xpwntool" ramdisk2.orig ramdisk2.dec

    log "Checking"
    "$dir/hfsplus" ramdisk2.dec extract multipatched
    if [[ -s multipatched ]]; then
        log "Already multipatched"
        mv temp.ipsw "$ipsw_custom.ipsw"
        return
    fi

    log "Grow ramdisk"
    "$dir/hfsplus" RestoreRamdisk.dec grow 30000000

    log "Patch ASR"
    if [[ $ipsw_prepare_usepowder == 1 ]]; then
        rm -f asr
        "$dir/hfsplus" ramdisk2.dec extract usr/sbin/asr
        "$dir/hfsplus" RestoreRamdisk.dec rm usr/sbin/asr
        "$dir/hfsplus" RestoreRamdisk.dec add asr usr/sbin/asr
        "$dir/hfsplus" RestoreRamdisk.dec chmod 755 usr/sbin/asr
        "$dir/hfsplus" RestoreRamdisk.dec chown 0:0 usr/sbin/asr
    else
        cp ../resources/firmware/FirmwareBundles/Down_${device_type}_${vers}_${build}.bundle/asr.patch .
        ipsw_patch_file RestoreRamdisk.dec usr/sbin asr asr.patch
    fi

    if [[ $device_target_vers == "3.2"* ]]; then
        log "3.2 options.plist"
        cp ../resources/firmware/src/target/k48/options.plist $options_plist
    else
        log "Extract options.plist from $device_target_vers IPSW"
        "$dir/hfsplus" ramdisk2.dec extract usr/local/share/restore/$options_plist
    fi

    log "Modify options.plist"
    "$dir/hfsplus" RestoreRamdisk.dec rm usr/local/share/restore/$options_plist
    if [[ $ipsw_prepare_ios4multipart_patch == 1 || $device_target_tethered == 1 ]]; then
        cat $options_plist | sed '$d' | sed '$d' > options2.plist
        printf "<key>FlashNOR</key><false/></dict>\n</plist>\n" >> options2.plist
        cat options2.plist
        "$dir/hfsplus" RestoreRamdisk.dec add options2.plist usr/local/share/restore/$options_plist
    else
        "$dir/hfsplus" RestoreRamdisk.dec add $options_plist usr/local/share/restore/$options_plist
    fi
    if [[ $device_target_vers == "3"* ]]; then
        :
    elif [[ $device_target_powder == 1 && $device_target_vers == "4"* ]]; then
        log "Adding exploit and partition stuff"
        cp -R ../resources/firmware/src .
        "$dir/hfsplus" RestoreRamdisk.dec untar src/bin4.tar
        "$dir/hfsplus" RestoreRamdisk.dec mv sbin/reboot sbin/reboot_
        "$dir/hfsplus" RestoreRamdisk.dec add src/target/$device_model/reboot4 sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec chmod 755 sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec chown 0:0 sbin/reboot
    elif [[ $device_target_powder == 1 ]]; then
        local hw="$device_model"
        local base_build="11D257"
        case $device_type in
            iPhone5,[12] ) hw="iphone5";;
            iPhone5,[34] ) hw="iphone5b";;
            iPad3,[456] )  hw="ipad3b";;
        esac
        case $device_base_build in
            "11A"* | "11B"* ) base_build="11B554a";;
            "9"* ) base_build="9B206";;
        esac
        local exploit="src/target/$hw/$base_build/exploit"
        local partition="src/target/$hw/$base_build/partition"
        log "Adding exploit and partition stuff"
        "$dir/hfsplus" RestoreRamdisk.dec untar src/bin.tar
        "$dir/hfsplus" RestoreRamdisk.dec mv sbin/reboot sbin/reboot_
        "$dir/hfsplus" RestoreRamdisk.dec add $partition sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec chmod 755 sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec chown 0:0 sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec add $exploit exploit
    elif [[ $ipsw_jailbreak == 1 && $device_target_vers == "8"* ]]; then
        "$dir/hfsplus" RestoreRamdisk.dec untar bin.tar
        "$dir/hfsplus" RestoreRamdisk.dec mv sbin/reboot sbin/reboot_
        "$dir/hfsplus" RestoreRamdisk.dec add reboot.sh sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec chmod 755 sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec chown 0:0 sbin/reboot
    fi

    echo "multipatched" > multipatched
    "$dir/hfsplus" RestoreRamdisk.dec add multipatched multipatched

    log "Repack Restore Ramdisk"
    "$dir/xpwntool" RestoreRamdisk.dec $ramdisk_name -t RestoreRamdisk.orig
    log "Add Restore Ramdisk to IPSW"
    zip -r0 temp.ipsw $ramdisk_name

    # 3.2 fs workaround
    if [[ $device_target_vers == "3.2"* ]]; then
        local ipsw_name="${device_type}_${device_target_vers}_${device_target_build}_FS"
        ipsw_url="https://github.com/LukeZGD/Legacy-iOS-Kit-Keys/releases/download/jailbreak/iPad1.1_${device_target_vers}_${device_target_build}_FS.ipsw"
        local sha1E="123d8717b1accbf43c03d2fbd6e82aa5ca3533c9"
        if [[ $device_target_vers == "3.2.1" ]]; then
            sha1E="e1b2652aee400115b0b83c97628f90c3953e7eaf"
        elif [[ $device_target_vers == "3.2" ]]; then
            sha1E="5763a6f9d5ead3675535c6f7037192e8611206bc"
        fi
        if [[ ! -s ../$ipsw_name.ipsw ]]; then
            log "Downloading FS IPSW..."
            curl -L "$ipsw_url" -o temp2.ipsw
            log "Getting SHA1 hash for FS IPSW..."
            local sha1L=$($sha1sum temp2.ipsw | awk '{print $1}')
            if [[ $sha1L != "$sha1E" ]]; then
                error "Verifying IPSW failed. The IPSW may be corrupted or incomplete. Please run the script again" \
                "* SHA1sum mismatch. Expected $sha1E, got $sha1L"
            fi
            mv temp2.ipsw ../$ipsw_name.ipsw
        fi
        log "Extract RootFS from FS IPSW"
        unzip -o -j ../$ipsw_name.ipsw $rootfs_name
        log "Add RootFS to IPSW"
        zip -r0 temp.ipsw $rootfs_name
    fi

    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_prepare_tethered() {
    local name
    local iv
    local key
    local options_plist="options.$device_model.plist"
    if [[ $device_type == "iPad1,1" && $device_target_vers == "4"* ]]; then
        :
    elif [[ $device_target_vers == "3"* || $device_target_vers == "4"* ]]; then
        options_plist="options.plist"
    fi

    if [[ -e "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    fi

    ipsw_prepare_32bit

    log "Extract RestoreRamdisk and options.plist"
    device_fw_key_check temp $device_target_build
    name=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .filename')
    iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .iv')
    key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .key')
    mv "$ipsw_custom.ipsw" temp.ipsw
    unzip -o -j temp.ipsw $name
    mv $name ramdisk.orig
    "$dir/xpwntool" ramdisk.orig ramdisk.dec -iv $iv -k $key
    "$dir/hfsplus" ramdisk.dec extract usr/local/share/restore/$options_plist

    log "Modify options.plist"
    "$dir/hfsplus" ramdisk.dec rm usr/local/share/restore/$options_plist
    cat $options_plist | sed '$d' | sed '$d' > options2.plist
    printf "<key>FlashNOR</key><false/></dict>\n</plist>\n" >> options2.plist
    cat options2.plist
    "$dir/hfsplus" ramdisk.dec add options2.plist usr/local/share/restore/$options_plist

    log "Repack Restore Ramdisk"
    "$dir/xpwntool" ramdisk.dec $name -t ramdisk.orig
    log "Add Restore Ramdisk to IPSW"
    zip -r0 temp.ipsw $name
    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_prepare_ios4patches() {
    local comps=("iBSS" "iBEC")
    local iv
    local key
    local name
    local path="Firmware/dfu/"
    log "Applying iOS 4 patches"
    mkdir -p $all_flash $path
    for getcomp in "${comps[@]}"; do
        iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        name="$getcomp.${device_model}ap.RELEASE.dfu"
        log "Patch $getcomp"
        unzip -o -j "$ipsw_path.ipsw" ${path}$name
        mv $name $getcomp.orig
        "$dir/xpwntool" $getcomp.orig $getcomp.dec -iv $iv -k $key
        "$dir/iBoot32Patcher" $getcomp.dec $getcomp.patched --rsa --debug -b "rd=md0 -v amfi=0xff cs_enforcement_disable=1 pio-error=0"
        "$dir/xpwntool" $getcomp.patched ${path}$name -t $getcomp.orig
    done
}

ipsw_prepare_ios4powder() {
    local ExtraArgs="-apticket $shsh_path"
    local ExtraArgs2="--boot-partition --boot-ramdisk --logo4 "
    local JBFiles=()
    ipsw_prepare_usepowder=1

    if [[ -e "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    fi

    if [[ $ipsw_jailbreak == 1 ]]; then
        JBFiles=("g1lbertJB/${device_type}_${device_target_build}.tar" "fstab_old.tar" "freeze.tar" "cydiasubstrate.tar")
        for i in {0..3}; do
            JBFiles[i]=$jelbrek/${JBFiles[$i]}
        done
        if [[ $ipsw_openssh == 1 ]]; then
            JBFiles+=("$jelbrek/sshdeb.tar")
        fi
        cp $jelbrek/freeze.tar .
    fi

    ipsw_prepare_bundle target
    ipsw_prepare_bundle base
    ipsw_prepare_logos_convert
    cp -R ../resources/firmware/src .
    rm src/target/$device_model/$device_base_build/partition
    mv src/target/$device_model/reboot4 src/target/$device_model/$device_base_build/partition
    rm src/bin.tar
    mv src/bin4.tar src/bin.tar
    ipsw_prepare_config false true
    if [[ $ipsw_memory == 1 ]]; then
        ExtraArgs+=" -memory"
    fi
    if [[ $device_actrec == 1 ]]; then
        device_dump activation
        ExtraArgs+=" ../saved/$device_type/activation-$device_ecid.tar"
    fi
    case $device_target_vers in
        4.3.[45] ) :;;
        * ) ExtraArgs2+="--433 ";;
    esac
    if [[ $ipsw_verbose == 1 ]]; then
        ExtraArgs2+="-b -v"
    fi
    patch_iboot $ExtraArgs2
    tar -rvf src/bin.tar iBoot
    if [[ $device_type == "iPad1,1" ]]; then
        cp iBoot iBEC
        tar -cvf iBoot.tar iBEC
        ExtraArgs+=" iBoot.tar"
    fi
    if [[ $ipsw_isbeta == 1 ]]; then
        ipsw_prepare_systemversion
        ExtraArgs+=" systemversion.tar"
    fi

    log "Preparing custom IPSW: $dir/powdersn0w $ipsw_path.ipsw temp.ipsw -base $ipsw_base_path.ipsw $ExtraArgs ${JBFiles[*]}"
    "$dir/powdersn0w" "$ipsw_path.ipsw" temp.ipsw -base "$ipsw_base_path.ipsw" $ExtraArgs ${JBFiles[@]}

    if [[ ! -e temp.ipsw ]]; then
        error "Failed to find custom IPSW. Please run the script again" \
        "* You may try selecting N for memory option"
    fi

    ipsw_prepare_ios4patches
    if [[ -n $ipsw_customlogo ]]; then
        ipsw_prepare_logos_add
    else
        log "Patch AppleLogo"
        local applelogo_name=$(echo "$device_fw_key" | $jq -j '.keys[] | select(.image == "AppleLogo") | .filename')
        unzip -o -j temp.ipsw $all_flash/$applelogo_name
        echo "0000010: 3467" | xxd -r - $applelogo_name
        echo "0000020: 3467" | xxd -r - $applelogo_name
        mv $applelogo_name $all_flash/$applelogo_name
    fi

    log "Add all to custom IPSW"
    if [[ $device_type != "iPad1,1" ]]; then
        cp iBoot $all_flash/iBoot2.${device_model}ap.RELEASE.img3
    fi
    zip -r0 temp.ipsw $all_flash/* Firmware/dfu/* $ramdisk_name

    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_prepare_powder() {
    local ExtraArgs
    if [[ -e "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    fi
    ipsw_prepare_usepowder=1

    ipsw_prepare_bundle target
    ipsw_prepare_bundle base
    ipsw_prepare_logos_convert
    cp -R ../resources/firmware/src .
    if [[ $ipsw_memory == 1 ]]; then
        ExtraArgs+=" -memory"
    fi
    if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]]; then
        ExtraArgs+=" -bbupdate"
    elif [[ $device_type == "$device_disable_bbupdate" && $device_deadbb != 1 ]]; then
        device_dump baseband
        ExtraArgs+=" ../saved/$device_type/baseband-$device_ecid.tar"
    fi
    if [[ $device_actrec == 1 ]]; then
        device_dump activation
        ExtraArgs+=" ../saved/$device_type/activation-$device_ecid.tar"
    fi

    if [[ $ipsw_jailbreak == 1 ]]; then
        cp $jelbrek/freeze.tar .
        case $device_target_vers in
            5*   ) ExtraArgs+=" $jelbrek/cydiasubstrate.tar $jelbrek/g1lbertJB.tar $jelbrek/g1lbertJB/${device_type}_${device_target_build}.tar";;
            7.0* ) ExtraArgs+=" $jelbrek/evasi0n7-untether.tar $jelbrek/fstab7.tar";;
            7.1* ) ExtraArgs+=" $jelbrek/panguaxe.tar $jelbrek/fstab7.tar";;
        esac
        case $device_target_vers in
            [689]* ) :;;
            * ) ExtraArgs+=" freeze.tar";;
        esac
        if [[ $ipsw_openssh == 1 ]]; then
            ExtraArgs+=" $jelbrek/sshdeb.tar"
        fi
    fi

    local ExtraArr=("--boot-partition" "--boot-ramdisk")
    case $device_target_vers in
        [789]* ) :;;
        * ) ExtraArr+=("--logo");;
    esac
    if [[ $device_type == "iPhone5,3" || $device_type == "iPhone5,4" ]] && [[ $device_base_vers == "7.0"* ]]; then
        ipsw_powder_5c70=1
    fi
    if [[ $device_type == "iPhone5"* && $ipsw_powder_5c70 != 1 ]]; then
        # do this stuff because these use ramdiskH (jump to /boot/iBEC) instead of jump ibot to ibob
        if [[ $device_target_vers == "9"* ]]; then
            ExtraArr[0]+="9"
        fi
        local bootargs
        if [[ $ipsw_jailbreak == 1 && $device_target_vers != "7"* ]]; then
            bootargs+="cs_enforcement_disable=1 amfi_get_out_of_my_way=1 amfi=0xff"
        fi
        if [[ $ipsw_verbose == 1 ]]; then
            bootargs+=" -v"
        fi
        ExtraArr+=("-b" "$bootargs")
        patch_iboot "${ExtraArr[@]}"
        tar -cvf iBoot.tar iBoot
        ExtraArgs+=" iBoot.tar"
    elif [[ $device_type == "iPad1,1" ]]; then
        # ipad 1 ramdiskH jumps to /iBEC instead
        if [[ $ipsw_verbose == 1 ]]; then
            ExtraArr+=("-b" "-v")
        fi
        patch_iboot "${ExtraArr[@]}"
        mv iBoot iBEC
        tar -cvf iBoot.tar iBEC
        ExtraArgs+=" iBoot.tar"
    fi
    if [[ $ipsw_isbeta == 1 ]]; then
        ipsw_prepare_systemversion
        ExtraArgs+=" systemversion.tar"
    fi

    log "Preparing custom IPSW: $dir/powdersn0w $ipsw_path.ipsw temp.ipsw -base $ipsw_base_path.ipsw $ExtraArgs"
    "$dir/powdersn0w" "$ipsw_path.ipsw" temp.ipsw -base "$ipsw_base_path.ipsw" $ExtraArgs

    if [[ ! -e temp.ipsw ]]; then
        error "Failed to find custom IPSW. Please run the script again" \
        "* You may try selecting N for memory option"
    fi

    if [[ $device_type != "iPhone5"* && $device_type != "iPad1,1" ]] || [[ $ipsw_powder_5c70 == 1 ]]; then
        case $device_target_vers in
            [789]* ) :;;
            * )
                patch_iboot --logo
                mkdir -p $all_flash
                mv iBoot*.img3 $all_flash
                zip -r0 temp.ipsw $all_flash/iBoot*.img3
            ;;
        esac
    fi
    ipsw_prepare_logos_add
    ipsw_bbreplace

    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_prepare_patchcomp() {
    local path="$all_flash"
    local name="LLB.${device_model}ap.RELEASE"
    local ext="img3"
    local patch
    local iv
    local key
    if [[ $1 == "WTF2" ]]; then
        path="Firmware/dfu"
        name="WTF.s5l8900xall.RELEASE"
        ext="dfu"
    elif [[ $1 == "iBEC" ]]; then
        path="Firmware/dfu"
        name="iBEC.${device_model}ap.RELEASE"
        ext="dfu"
    elif [[ $1 == "iBoot" ]]; then
        name="iBoot.${device_model}ap.RELEASE"
    elif [[ $1 == "Kernelcache" ]]; then
        path=
        name="kernelcache.release"
        ext="s5l8900x"
        if [[ $device_target_vers == "4"* ]]; then
            return
        fi
        patch="../resources/patch/$name.$ext.p2"
        log "Patch $1"
        unzip -o -j "$ipsw_custom.ipsw" $name.$ext
        mv $name.$ext kc.orig
        $bspatch kc.orig $name.$ext $patch.patch
        zip -r0 "$ipsw_custom.ipsw" $name.$ext
        return
    elif [[ $1 == "RestoreRamdisk" ]]; then
        path=
        name="018-6494-014"
        iv=25e713dd5663badebe046d0ffa164fee
        key=7029389c2dadaaa1d1e51bf579493824
        if [[ $device_target_vers == "4.1" ]]; then
            name="018-7079-079"
            iv=a0fc6ca4ef7ef305d975e7f881ddcc7f
            key=18eab1ba646ae018b013bc959001fbde
        elif [[ $device_target_vers == "4.2.1" ]]; then
            name="038-0029-002"
            iv=673d874f06e87e018adbe8a34425df19
            key=91fd0e11469cafd56cff8ac906e54b93
        fi
        ext="dmg"
    fi
    patch="../resources/firmware/FirmwareBundles/Down_${device_type}_${device_target_vers}_${device_target_build}.bundle/$name.patch"
    if [[ $1 == "RestoreRamdisk" ]]; then
        local ivkey
        if [[ $device_target_vers == "4"* || $device_type == *"1,1" ]]; then
            ivkey="-iv $iv -k $key"
        fi
        log "Patch $1"
        unzip -o -j "$ipsw_path.ipsw" $name.$ext
        mv $name.$ext rd.orig
        "$dir/xpwntool" rd.orig rd.dec -iv $iv -k $key
        $bspatch rd.dec rd.patched "$patch"
        "$dir/xpwntool" rd.patched $name.$ext -t rd.orig $ivkey
        zip -r0 "$ipsw_custom.ipsw" $name.$ext
        return
    fi
    log "Patch $1"
    unzip -o -j "$ipsw_path.ipsw" $path/$name.$ext
    $bspatch $name.$ext $name.patched $patch
    mkdir -p $path
    mv $name.patched $path/$name.$ext
    zip -r0 "$ipsw_custom.ipsw" $path/$name.$ext
}

ipsw_prepare_s5l8900() {
    local rname="018-6494-014.dmg"
    local sha1E="4f6539d2032a1c7e1a068c667e393e62d8912700"
    local sha1L
    ipsw_url="https://github.com/LukeZGD/Legacy-iOS-Kit-Keys/releases/download/jailbreak/"
    if [[ $device_target_vers == "4.1" ]]; then
        rname="018-7079-079.dmg"
        sha1E="9a64eea9949b720f1033d41adc85254e6dbf9525"
    elif [[ $device_target_vers == "4.2.1" ]]; then
        rname="038-0029-002.dmg"
        sha1E="a8914d2f7f0dddc41eb17f197d0633d7bcb9f6b4"
    elif [[ $device_type == "iPhone1,1" && $ipsw_hacktivate == 1 ]]; then
        ipsw_url+="iPhone1.1_3.1.3_7E18_Custom_Hacktivate.ipsw"
        sha1E="f642829875ce632cd071e62169a1acbdcffcf0c8"
    elif [[ $device_type == "iPhone1,1" ]]; then
        ipsw_url+="iPhone1.1_3.1.3_7E18_Custom.ipsw"
        sha1E="7b3dd17c48c139dc827696284736d3c37d8fb7ac"
    elif [[ $device_type == "iPod1,1" ]]; then
        ipsw_url+="iPod1.1_3.1.3_7E18_Custom.ipsw"
        sha1E="f76cd3d4deaf82587dc758c6fbe724c31c9b6de2"
    fi

    if [[ $device_type == "iPhone1,2" && -e "$ipsw_custom.ipsw" ]]; then
        log "Checking RestoreRamdisk hash of custom IPSW"
        unzip -o -j "$ipsw_custom.ipsw" $rname
        sha1L="$($sha1sum $rname | awk '{print $1}')"
    elif [[ -e "$ipsw_custom2.ipsw" ]]; then
        log "Getting SHA1 hash for $ipsw_custom2.ipsw..."
        sha1L=$($sha1sum "$ipsw_custom2.ipsw" | awk '{print $1}')
    fi
    if [[ $sha1L == "$sha1E" && $ipsw_customlogo2 == 1 ]]; then
        log "Verified existing Custom IPSW. Preparing custom logo images and IPSW"
        rm -f "$ipsw_custom.ipsw"
        cp "$ipsw_custom2.ipsw" temp.ipsw
        device_fw_key_check
        ipsw_prepare_logos_convert
        ipsw_prepare_logos_add
        mv temp.ipsw "$ipsw_custom.ipsw"
        return
    elif [[ $sha1L == "$sha1E" ]]; then
        log "Verified existing Custom IPSW. Skipping IPSW creation."
        return
    else
        log "Verifying IPSW failed. Expected $sha1E, got $sha1L"
    fi

    if [[ -e "$ipsw_custom.ipsw" ]]; then
        log "Deleting existing custom IPSW"
        rm "$ipsw_custom.ipsw"
    fi

    if [[ $device_type != "iPhone1,2" ]]; then
        log "Downloading IPSW: $ipsw_url"
        curl -L "$ipsw_url" -o temp.ipsw
        log "Getting SHA1 hash for IPSW..."
        sha1L=$($sha1sum temp.ipsw | awk '{print $1}')
        if [[ $sha1L != "$sha1E" ]]; then
            error "Verifying IPSW failed. The IPSW may be corrupted or incomplete. Please run the script again" \
            "* SHA1sum mismatch. Expected $sha1E, got $sha1L"
        fi
        if [[ $ipsw_customlogo2 == 1 ]]; then
            cp temp.ipsw "$ipsw_custom2.ipsw"
            device_fw_key_check
            ipsw_prepare_logos_convert
            ipsw_prepare_logos_add
        fi
        mv temp.ipsw "$ipsw_custom.ipsw"
        return
    fi

    ipsw_prepare_jailbreak old

    ipsw_prepare_patchcomp LLB
    ipsw_prepare_patchcomp iBoot
    ipsw_prepare_patchcomp RestoreRamdisk
    if [[ $device_target_vers != "4.1" ]]; then
        ipsw_prepare_patchcomp Kernelcache
    fi
    if [[ $device_target_vers == "4"* ]]; then
        ipsw_prepare_patchcomp WTF2
        ipsw_prepare_patchcomp iBEC
    fi
}

ipsw_prepare_custom() {
    if [[ -e "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    elif [[ $device_target_vers == "4.1" && $ipsw_jailbreak != 1 ]]; then
        log "No need to create custom IPSW for non-jailbroken restores on $device_type-$device_target_build"
        return
    fi

    ipsw_prepare_jailbreak old

    if [[ $device_type == "iPod2,1" ]]; then
        case $device_target_vers in
            4.2.1 | 4.1 | 3.1.3 ) :;;
            * ) ipsw_prepare_patchcomp LLB;;
        esac
    else # 3GS
        case $device_target_vers in
            6.1.6 | 4.1 ) :;;
            3.0* )
                ipsw_prepare_patchcomp LLB
                log "Patch Kernelcache"
                unzip -o -j "$ipsw_path.ipsw" kernelcache.release.s5l8920x
                mv kernelcache.release.s5l8920x kernelcache.orig
                $bspatch kernelcache.orig kernelcache.release.s5l8920x ../resources/firmware/FirmwareBundles/Down_iPhone2,1_${device_target_vers}_${device_target_build}.bundle/kernelcache.release.patch
                zip -r0 "$ipsw_custom.ipsw" kernelcache.release.s5l8920x
            ;;
            * )
                ipsw_prepare_patchcomp LLB
                local ExtraArgs3="pio-error=0"
                if [[ $device_target_vers == "3"* ]]; then
                    ExtraArgs3+=" amfi=0xff cs_enforcement_disable=1"
                fi
                if [[ $ipsw_verbose == 1 ]]; then
                    ExtraArgs3+=" -v"
                fi
                local path="Firmware/all_flash/all_flash.${device_model}ap.production"
                local name="iBoot.${device_model}ap.RELEASE.img3"
                patch_iboot -b "$ExtraArgs3"
                mkdir -p $path
                mv $name $path/$name
                zip -r0 "$ipsw_custom.ipsw" $path/$name
            ;;
        esac
    fi
}

ipsw_extract() {
    local ExtraArgs
    local ipsw="$ipsw_path"
    if [[ $1 == "custom" ]]; then
        ipsw="$ipsw_custom"
    fi
    if [[ ! -d "$ipsw" ]]; then
        mkdir "$ipsw"
        log "Extracting IPSW: $ipsw.ipsw"
        unzip -o "$ipsw.ipsw" -d "$ipsw/" $ExtraArgs
    fi
}

restore_download_bbsep() {
    # download and check manifest, baseband, and sep to be used for restoring
    # sets variables: restore_manifest, restore_baseband, restore_sep
    local build_id
    local baseband_sha1
    local restore_baseband_check
    if [[ $device_proc == 8 || $device_latest_vers == "15"* || $device_latest_vers == "16"* || $device_checkm8ipad == 1 ]]; then
        return
    elif [[ $device_latest_vers == "$device_use_vers" || $device_target_vers == "10"* ]]; then
        build_id="$device_use_build"
        restore_baseband="$device_use_bb"
        baseband_sha1="$device_use_bb_sha1"
    else
        build_id="$device_latest_build"
        restore_baseband="$device_latest_bb"
        baseband_sha1="$device_latest_bb_sha1"
    fi

    mkdir tmp
    # BuildManifest
    if [[ ! -e ../saved/$device_type/$build_id.plist ]]; then
        if [[ $device_proc == 7 && $device_target_vers == "10"* ]]; then
            cp ../resources/manifest/BuildManifest_${device_type}_10.3.3.plist $build_id.plist
        else
            log "Downloading $build_id BuildManifest"
            "$dir/pzb" -g BuildManifest.plist -o $build_id.plist "$(cat $device_fw_dir/$build_id/url)"
        fi
        mv $build_id.plist ../saved/$device_type
    fi
    cp ../saved/$device_type/$build_id.plist tmp/BuildManifest.plist
    if [[ $? != 0 ]]; then
        rm ../saved/$device_type/$build_id.plist
        error "An error occurred copying manifest. Please run the script again"
    fi
    log "Manifest: ../saved/$device_type/$build_id.plist"
    restore_manifest="tmp/BuildManifest.plist"

    # Baseband
    if [[ $restore_baseband != 0 ]]; then
        restore_baseband_check="../saved/baseband/$restore_baseband"
        if [[ -e $restore_baseband_check ]]; then
            if [[ $baseband_sha1 != "$($sha1sum $restore_baseband_check | awk '{print $1}')" ]]; then
                rm $restore_baseband_check
            fi
        fi
        if [[ ! -e $restore_baseband_check ]]; then
            log "Downloading $build_id Baseband"
            "$dir/pzb" -g Firmware/$restore_baseband -o $restore_baseband "$(cat $device_fw_dir/$build_id/url)"
            if [[ $baseband_sha1 != "$($sha1sum $restore_baseband | awk '{print $1}')" ]]; then
                error "Downloading/verifying baseband failed. Please run the script again"
            fi
            mv $restore_baseband $restore_baseband_check
        fi
        cp $restore_baseband_check tmp/bbfw.tmp
        if [[ $? != 0 ]]; then
            rm $restore_baseband_check
            error "An error occurred copying baseband. Please run the script again"
        fi
        log "Baseband: $restore_baseband_check"
        restore_baseband="tmp/bbfw.tmp"
    fi

    # SEP
    if (( device_proc >= 7 )); then
        restore_sep="sep-firmware.$device_model.RELEASE"
        if [[ ! -e ../saved/$device_type/$restore_sep-$build_id.im4p ]]; then
            log "Downloading $build_id SEP"
            "$dir/pzb" -g Firmware/all_flash/$restore_sep.im4p -o $restore_sep.im4p "$(cat $device_fw_dir/$build_id/url)"
            mv $restore_sep.im4p ../saved/$device_type/$restore_sep-$build_id.im4p
        fi
        restore_sep="$restore_sep-$build_id.im4p"
        cp ../saved/$device_type/$restore_sep .
        if [[ $? != 0 ]]; then
            rm ../saved/$device_type/$restore_sep
            error "An error occurred copying SEP. Please run the script again"
        fi
        log "SEP: ../saved/$device_type/$restore_sep"
    fi
}

restore_idevicerestore() {
    local ExtraArgs="-ew"
    local idevicerestore2="$idevicerestore"
    local re

    mkdir shsh 2>/dev/null
    cp "$shsh_path" shsh/$device_ecid-$device_type-$device_target_vers.shsh
    if [[ $device_use_bb == 0 || -n $device_disable_bbupdate ]]; then
        log "Device $device_type has no baseband/disabled baseband update"
    fi
    ipsw_extract custom
    if [[ $1 == "norflash" ]]; then
        cp "$shsh_path" shsh/$device_ecid-$device_type-5.1.1.shsh
    elif [[ $device_type == "iPad"* && $device_pwnrec != 1 ]] &&
         [[ $device_target_vers == "3"* || $device_target_vers == "4"* ]]; then
        if [[ $device_type == "iPad1,1" ]]; then
            patch_ibss
            log "Sending iBSS..."
            $irecovery -f pwnediBSS.dfu
            sleep 1
        fi
        log "Sending iBEC..."
        $irecovery -f "$ipsw_custom/Firmware/dfu/iBEC.${device_model}ap.RELEASE.dfu"
        device_find_mode Recovery
    fi
    if [[ $debug_mode == 1 ]]; then
        ExtraArgs+="d"
    fi

    log "Running idevicere${re}store with command: $idevicerestore2 $ExtraArgs \"$ipsw_custom.ipsw\""
    $idevicerestore2 $ExtraArgs "$ipsw_custom.ipsw"
    opt=$?
    if [[ $1 == "first" ]]; then
        return $opt
    fi
    echo
    log "Restoring done! Read the message below if any error has occurred:"
    case $device_target_vers in
        [1234]* ) print "* For device activation, go to: Other Utilities -> Attempt Activation";;
    esac
    if [[ $opt != 0 ]]; then
        print "* If the restore failed on updating baseband:"
        print " -> Try disabling baseband update: ./restore.sh --disable-bbupdate"
        echo
    fi
    print "* Please read the \"Troubleshooting\" wiki page in GitHub before opening any issue!"
    print "* Your problem may have already been addressed within the wiki page."
    print "* If opening an issue in GitHub, please provide a FULL log/output. Otherwise, your issue may be dismissed."
    if [[ $ipsw_jailbreak == 1 ]]; then
        case $device_target_vers in
            4* | 3* ) warn "Do not uninstall Cydia Substrate and Substrate Safe Mode in Cydia!";;
        esac
    fi
}

restore_futurerestore() {
    local ExtraArr=()
    local futurerestore2="$futurerestore"
    local port=8888
    local opt

    if [[ $1 == "--use-pwndfu" ]]; then
        device_fw_key_check
        pushd ../resources >/dev/null
        if [[ $platform == "macos" ]]; then
            if (( mac_majver >= 12 )); then
                opt="/usr/bin/python3 -m http.server -b 127.0.0.1 $port"
            else
                opt="/usr/bin/python -m SimpleHTTPServer $port"
            fi
        else
            if [[ -z $(command -v python3) ]]; then
                error "Python 3 is not installed, cannot continue. Make sure to have python3 installed."
            fi
            opt="$(command -v python3) -m http.server -b 127.0.0.1 $port"
        fi
        log "Starting local server for firmware keys: $opt"
        $opt &
        httpserver_pid=$!
        log "httpserver PID: $httpserver_pid"
        popd >/dev/null
        log "Waiting for local server"
        until [[ $(curl http://127.0.0.1:$port 2>/dev/null) ]]; do
            sleep 1
        done
    fi

    restore_download_bbsep
    # baseband args
    if [[ $restore_baseband == 0 ]]; then
        ExtraArr+=("--no-baseband")
    else
        ExtraArr+=("-b" "$restore_baseband" "-p" "$restore_manifest")
    fi
    if [[ -n $restore_sep ]]; then
        # sep args for 64bit
        ExtraArr+=("-s" "$restore_sep" "-m" "$restore_manifest")
    fi
    if (( device_proc < 7 )); then
        futurerestore2+="_old"
    elif [[ $device_proc == 7 && $device_target_other != 1 &&
            $device_target_vers == "10.3.3" && $restore_usepwndfu64 != 1 ]]; then
        futurerestore2+="_new"
    else
        futurerestore2="../saved/futurerestore_$platform"
        if [[ $device_target_vers == "10"* ]]; then
            export FUTURERESTORE_I_SOLEMNLY_SWEAR_THAT_I_AM_UP_TO_NO_GOOD=1 # required since custom-latest-ota is broken
        else
            ExtraArr=("--latest-sep")
            case $device_type in
                iPhone* | iPad5,[24] | iPad6,[48] | iPad6,12 | iPad7,[46] | iPad7,12 ) ExtraArr+=("--latest-baseband");;
                * ) ExtraArr+=("--no-baseband");;
            esac
        fi
        ExtraArr+=("--no-rsep")
        if [[ $device_target_setnonce == 1 ]]; then
            ExtraArr+=("--set-nonce")
        fi
        log "futurerestore nightly will be used for this restore: https://github.com/futurerestore/futurerestore"
        if [[ $platform == "linux" && $platform_arch != "x86_64" ]]; then
            warn "futurerestore nightly is not supported on $platform_arch, cannot continue. x86_64 only."
            return
        fi
        log "Checking for futurerestore updates..."
        #local fr_latest="$(curl https://api.github.com/repos/futurerestore/futurerestore/commits | $jq -r '.[0].sha')"
        local fr_latest="1a5317ce543e6f6c583b31e379775e36b0ac0916--"
        local fr_current="$(cat ${futurerestore2}_version 2>/dev/null)"
        if [[ $fr_latest != "$fr_current" ]]; then
            log "futurerestore nightly update detected, downloading."
            rm $futurerestore2
        fi
        if [[ ! -e $futurerestore2 ]]; then
            local url="https://github.com/LukeZGD/Legacy-iOS-Kit-Keys/releases/download/jailbreak/"
            local file="futurerestore-"
            case $platform in
                "macos" ) file+="macOS-RELEASE.zip";;
                "linux" ) file+="Linux-x86_64-RELEASE.zip";;
            esac
            url+="$file"
            download_file $url $file
            unzip -q "$file" -d .
            tar -xJvf futurerestore*.xz
            mv futurerestore $futurerestore2
            perl -pi -e 's/nightly/nightlo/' $futurerestore2 # disable update check for now since it segfaults
            chmod +x $futurerestore2
            if [[ $platform == "macos" ]]; then
                ldid="../saved/ldid_${platform}_${platform_arch}"
                if [[ ! -e $ldid ]]; then
                    download_file https://github.com/ProcursusTeam/ldid/releases/download/v2.1.5-procursus7/ldid_macosx_$platform_arch ldid
                    chmod +x ldid
                    mv ldid $ldid
                fi
                $ldid -S $futurerestore2
            fi
            echo "$fr_latest" > ${futurerestore2}_version
        fi
    fi
    if [[ -n "$1" ]]; then
        # custom arg, either --use-pwndfu or --skip-blob
        ExtraArr+=("$1")
    fi
    if [[ -n "$2" ]]; then
        ExtraArr+=("$2")
    fi
    if [[ $debug_mode == 1 ]]; then
        ExtraArr+=("-d")
    fi
    ExtraArr+=("-t" "$shsh_path" "$ipsw_path.ipsw")
    ipsw_extract

    log "Running futurerestore with command: $futurerestore2 ${ExtraArr[*]}"
    $futurerestore2 "${ExtraArr[@]}"
    opt=$?
    log "Restoring done! Read the message below if any error has occurred:"
    if [[ $opt != 0 ]] && (( device_proc < 7 )); then
        print "* If you are getting the error: \"could not retrieve device serial number\","
        print " -> Try restoring with the jailbreak option enabled"
    fi
    print "* Please read the \"Troubleshooting\" wiki page in GitHub before opening any issue!"
    print "* Your problem may have already been addressed within the wiki page."
    print "* If opening an issue in GitHub, please provide a FULL log/output. Otherwise, your issue may be dismissed."
    kill $httpserver_pid
}

restore_latest() {
    local idevicerestore2="$idevicerestore"
    local ExtraArgs="-e"
    if [[ $device_latest_vers == "12"* || $device_latest_vers == "15"* || $device_latest_vers == "16"* || $device_checkm8ipad == 1 ]]; then
        idevicerestore2+="2"
        ExtraArgs+="y"
    fi
    if [[ $1 == "custom" ]]; then
        ExtraArgs+="c"
        ipsw_path="$ipsw_custom"
        ipsw_extract custom
    else
        device_enter_mode Recovery
        ipsw_extract
    fi
    if [[ $device_type == "iPhone1,2" && $device_target_vers == "4"* ]]; then
        if [[ $1 == "custom" ]]; then
            log "Sending s5l8900xall..."
            $irecovery -f "$ipsw_custom/Firmware/dfu/WTF.s5l8900xall.RELEASE.dfu"
            device_find_mode DFUreal
            log "Sending iBSS..."
            $irecovery -f "$ipsw_custom/Firmware/dfu/iBSS.${device_model}ap.RELEASE.dfu"
            device_find_mode Recovery
        else
            ExtraArgs="-e"
        fi
    fi
    if [[ $debug_mode == 1 ]]; then
        ExtraArgs+="d"
    fi
    log "Running idevicerestore with command: $idevicerestore2 $ExtraArgs \"$ipsw_path.ipsw\""
    $idevicerestore2 $ExtraArgs "$ipsw_path.ipsw"
    opt=$?
    if [[ $2 == "first" ]]; then
        return $opt
    fi
    if [[ $1 == "custom" ]]; then
        log "Restoring done! Read the message below if any error has occurred:"
        print "* Please read the \"Troubleshooting\" wiki page in GitHub before opening any issue!"
        print "* Your problem may have already been addressed within the wiki page."
        print "* If opening an issue in GitHub, please provide a FULL log/output. Otherwise, your issue may be dismissed."
    fi
    case $device_target_vers in
        [1234]* ) print "* For device activation, go to: Other Utilities -> Attempt Activation";;
    esac
    if [[ $ipsw_jailbreak == 1 ]]; then
        case $device_target_vers in
            [34]* ) warn "Do not uninstall Cydia Substrate and Substrate Safe Mode in Cydia!";;
        esac
    fi
}

restore_prepare_pwnrec64() {
    local attempt=1
    if [[ $device_pwnrec == 1 ]]; then
        warn "Pwned recovery flag detected, skipping pwnREC mode procedure. Proceed with caution"
        return
    fi

    device_enter_mode pwnDFU
    if [[ $device_proc == 7 ]]; then
        log "gaster reset"
        $gaster reset
    fi
    sleep 1
    while (( attempt <= 5 )); do
        log "Entering pwnREC mode... (Attempt $attempt of 5)"
        log "Sending iBSS..."
        $irecovery -f $iBSS.im4p
        sleep 1
        log "Sending iBEC..."
        $irecovery -f $iBEC.im4p
        sleep 3
        device_find_mode Recovery 1
        if [[ $? == 0 ]]; then
            break
        fi
        print "* You may also try to unplug and replug your device"
        ((attempt++))
    done
    if [[ $device_proc == 10 ]]; then
        log "irecovery -c go"
        $irecovery -c "go"
        sleep 3
    fi

    if (( attempt > 5 )); then
        error "Failed to enter pwnREC mode. You might have to force restart your device and start over entering pwnDFU mode again"
    fi
}

device_buttons() {
    local opt
    if [[ $device_mode != "Normal" ]]; then
        device_enter_mode pwnDFU
        return
    fi
    print "* This device needs to be in pwnDFU/kDFU mode before proceeding."
    print "* Select Y for pwnDFU mode, N for kDFU mode. Select Y if unsure."
    read -p "$(input 'Are both your home and power buttons working properly? (Y/n): ')" opt
    if [[ $opt != 'N' && $opt != 'n' ]]; then
        device_enter_mode pwnDFU
    else
        device_enter_mode kDFU
    fi
}

restore_prepare() {
    case $device_proc in
        1 )
            if [[ $device_target_vers == "4"* && $ipsw_jailbreak != 1 ]]; then
                restore_latest
                return
            elif [[ $device_target_vers == "3.1.3" ]]; then
                device_enter_mode DFU
            else
                device_enter_mode WTFreal
            fi
            if [[ $ipsw_jailbreak != 1 ]]; then
                ipsw_custom="$ipsw_path"
            fi
            restore_latest custom
        ;;

        4 )
            if [[ $device_target_tethered == 1 ]]; then
                shsh_save version $device_latest_vers
                device_enter_mode pwnDFU
                restore_idevicerestore
            elif [[ $device_target_vers == "4.1" && $ipsw_jailbreak == 1 ]]; then
                case $device_type in
                    iPhone2,1 | iPod[23],1 ) shsh_save version 4.1;;
                esac
                device_enter_mode pwnDFU
                restore_idevicerestore
            elif [[ $device_target_powder == 1 ]]; then
                shsh_save version $device_latest_vers
                case $device_target_vers in
                    [34]* ) device_enter_mode pwnDFU;;
                    * ) device_buttons;;
                esac
                case $device_target_vers in
                    "3"* | "4.0"* | "4.1" | "4.2"* )
                        if [[ $ipsw_skip_first != 1 ]]; then
                            restore_idevicerestore first
                            log "Do not disconnect your device, not done yet"
                            print "* Please put the device in DFU mode after it reboots!"
                            sleep 10
                            device_mode=
                        fi
                        log "Finding device in Recovery/DFU mode..."
                        until [[ -n $device_mode ]]; do
                            device_mode="$($irecovery -q 2>/dev/null | grep -w "MODE" | cut -c 7-)"
                        done
                        ipsw_custom="../$ipsw_custom_part2"
                        device_enter_mode pwnDFU
                        restore_idevicerestore norflash
                    ;;
                    * ) restore_idevicerestore;;
                esac
                if [[ $device_target_vers == "3"* || $device_target_vers == "4"* ]] && [[ $device_target_powder == 1 ]]; then
                    echo
                    log "The device may enter recovery mode after the restore"
                    print "* To fix this, go to: Other Utilities -> Disable/Enable Exploit -> Enable Exploit"
                fi
            elif [[ $device_target_other == 1 ]]; then
                case $device_target_vers in
                    [34]* ) device_enter_mode pwnDFU;;
                    * ) device_buttons;;
                esac
                restore_idevicerestore
            elif [[ $device_target_vers == "4.1" ]]; then
                shsh_save version 4.1
                device_enter_mode DFU
                restore_latest
                if [[ $device_type == "iPhone2,1" ]]; then
                    log "Ignore the baseband error and do not disconnect your device yet"
                    device_find_mode Recovery 50
                    log "Attempting to exit recovery mode"
                    $irecovery -n
                    log "Done, your device should boot now"
                fi
            elif [[ $device_target_vers == "$device_latest_vers" ]]; then
                if [[ $ipsw_jailbreak == 1 ]]; then
                    shsh_save version $device_latest_vers
                    device_buttons
                    restore_idevicerestore
                else
                    restore_latest
                fi
            else
                device_enter_mode pwnDFU
                if [[ $device_type == "iPhone2,1" && $device_newbr != 0 ]]; then
                    restore_latest custom first
                    print "* Proceed to install the alloc8 exploit for the device to boot:"
                    print " -> Go to: Other Utilities -> Install alloc8 Exploit"
                    log "Do not disconnect your device, not done yet"
                    device_find_mode DFU 50
                    device_alloc8
                else
                    restore_latest custom
                fi
            fi
        ;;

        [56] )
            # 32-bit devices A5/A6
            if [[ $device_target_tethered == 1 ]]; then
                shsh_save version $device_latest_vers
                device_enter_mode pwnDFU
                restore_idevicerestore
                return
            elif [[ $device_target_other != 1 && $device_target_powder != 1 ]]; then
                shsh_save
            fi
            if [[ $device_target_vers == "$device_latest_vers" && $ipsw_gasgauge_patch != 1 ]]; then
                restore_latest
            else
                if [[ $device_proc == 6 && $platform == "macos" ]]; then
                    device_buttons
                else
                    device_enter_mode kDFU
                fi
                if [[ $ipsw_jailbreak == 1 || -e "$ipsw_custom.ipsw" ]]; then
                    restore_idevicerestore
                else
                    restore_futurerestore --use-pwndfu
                fi
            fi
        ;;

        7 )
            if [[ $device_target_other != 1 && $device_target_vers == "10.3.3" ]]; then
                shsh_save
            fi
            if [[ $restore_usepwndfu64 == 1 ]]; then
                restore_pwned64
            elif [[ $device_target_other != 1 && $device_target_vers == "10.3.3" ]]; then
                if [[ $device_type == "iPad4,4" || $device_type == "iPad4,5" ]]; then
                    iBSS=$iBSSb
                    iBEC=$iBECb
                fi
                restore_prepare_pwnrec64
                shsh_save apnonce $($irecovery -q | grep "NONC" | cut -c 7-)
                restore_futurerestore --skip-blob
            elif [[ $device_target_vers == "$device_latest_vers" ]]; then
                restore_latest
            else
                restore_notpwned64
            fi
        ;;

        [89] | 10 )
            if [[ $restore_usepwndfu64 == 1 ]]; then
                restore_pwned64
            elif [[ $device_target_vers == "$device_latest_vers" ]]; then
                restore_latest
            else
                restore_notpwned64
            fi
        ;;
    esac
}

restore_pwned64() {
    device_enter_mode pwnDFU
    if [[ ! -s ../saved/firmwares.json ]]; then
        download_file https://api.ipsw.me/v2.1/firmwares.json/condensed firmwares.json
        cp firmwares.json ../saved
    fi
    rm -f /tmp/firmwares.json
    cp ../saved/firmwares.json /tmp
    if [[ $device_proc == 7 ]]; then
        log "gaster reset"
        $gaster reset
    fi
    local opt
    if [[ $device_proc == 7 && $device_target_other != 1 &&
          $device_target_vers == "10.3.3" ]] || [[ $restore_useskipblob == 1 ]]; then
        opt="--skip-blob"
    fi
    restore_futurerestore --use-pwndfu $opt
}

restore_notpwned64() {
    log "The generator for your SHSH blob is: $shsh_generator"
    print "* Before continuing, make sure to set the nonce generator of your device!"
    print "* For iOS 10 and older: https://github.com/tihmstar/futurerestore#how-to-use"
    print "* For iOS 11 and newer: https://github.com/futurerestore/futurerestore/#using-dimentio"
    print "* Using \"Set Nonce Only\" in the Restore/Downgrade menu is also an option"
    pause
    if [[ $device_mode == "Normal" ]]; then
        device_enter_mode Recovery
    fi
    restore_futurerestore
}

ipsw_prepare() {
    case $device_proc in
        1 )
            if [[ $ipsw_jailbreak == 1 ]]; then
                ipsw_prepare_s5l8900
            elif [[ $device_target_vers == "$device_latest_vers" && ! -s "../$ipsw_latest_path.ipsw" ]]; then
                ipsw_path="../$ipsw_latest_path"
                ipsw_download "$ipsw_path"
            fi
        ;;

        4 )
            if [[ $device_target_tethered == 1 ]]; then
                ipsw_prepare_tethered
            elif [[ $device_target_other == 1 ]] || [[ $device_target_vers == "$device_latest_vers" && $ipsw_jailbreak == 1 ]]; then
                case $device_type in
                    iPhone2,1 ) ipsw_prepare_jailbreak;;
                    iPod2,1 ) ipsw_prepare_custom;;
                    * ) ipsw_prepare_32bit;;
                esac
            elif [[ $device_target_powder == 1 ]] && [[ $device_target_vers == "3"* || $device_target_vers == "4"* ]]; then
                shsh_save version $device_latest_vers
                case $device_target_vers in
                    "4.3"* ) ipsw_prepare_ios4powder;;
                    * ) ipsw_prepare_ios4multipart;;
                esac
            elif [[ $device_target_powder == 1 ]]; then
                ipsw_prepare_powder
            elif [[ $device_target_vers != "$device_latest_vers" ]]; then
                ipsw_prepare_custom
            fi
            if [[ $ipsw_isbeta == 1 && $ipsw_prepare_ios4multipart_patch != 1 ]] ||
               [[ $device_target_vers == "3.2"* && $ipsw_prepare_ios4multipart_patch != 1 ]] ||
               [[ $ipsw_gasgauge_patch == 1 ]]; then
                ipsw_prepare_multipatch
            fi
        ;;

        [56] )
            # 32-bit devices A5/A6
            if [[ $device_target_tethered == 1 ]]; then
                ipsw_prepare_tethered
            elif [[ $device_target_powder == 1 ]]; then
                ipsw_prepare_powder
            elif [[ $ipsw_jailbreak == 1 && $device_target_other != 1 ]]; then
                ipsw_prepare_jailbreak
            elif [[ $device_target_vers != "$device_latest_vers" || $ipsw_gasgauge_patch == 1 ]]; then
                ipsw_prepare_32bit
            fi
            if [[ $ipsw_fourthree == 1 ]]; then
                ipsw_prepare_fourthree_part2
            elif [[ $ipsw_isbeta == 1 || $ipsw_gasgauge_patch == 1 ]]; then
                case $device_target_vers in
                    [59] ) :;;
                    * ) ipsw_prepare_multipatch;;
                esac
            fi
        ;;

        [789] | 10 )
            restore_usepwndfu64_option
            if [[ $device_target_other != 1 && $device_target_vers == "10.3.3" && $restore_usepwndfu64 != 1 ]]; then
                 ipsw_prepare_1033
            fi
        ;;
    esac
}

restore_usepwndfu64_option() {
    if [[ $device_target_vers == "$device_latest_vers" ]]; then
        return
    elif [[ $restore_useskipblob == 1 ]]; then
        log "skip-blob flag detected, Pwned Restore Option enabled."
        restore_usepwndfu64=1
        return
    elif [[ $device_mode == "DFU" && $device_target_other == 1 ]]; then
        log "Device is in DFU mode, Pwned Restore Option enabled."
        print "* If you want to disable Pwned Restore Option, place the device in Normal/Recovery mode"
        restore_usepwndfu64=1
        return
    elif [[ $device_target_vers == "10.3.3" && $device_target_other != 1 &&
            $platform == "macos" && $platform_arch == "arm64" ]] ||
         [[ $device_target_setnonce == 1 ]]; then
        restore_usepwndfu64=1
        return
    fi
    local opt
    input "Pwned Restore Option"
    print "* When this option is enabled, use-pwndfu will be enabled for restoring."
    if [[ $device_target_other == 1 ]]; then
        print "* When disabled, user must set the device generator manually before the restore."
    fi
    if [[ $device_proc == 7 ]]; then
        print "* This option is disabled by default (N). Select this option if unsure."
        read -p "$(input 'Enable this option? (y/N): ')" opt
        if [[ $opt == 'Y' || $opt == 'y' ]]; then
            log "Pwned restore option enabled by user."
            restore_usepwndfu64=1
        else
            log "Pwned restore option disabled."
        fi
    else
        print "* This option is enabled by default (Y). Select this option if unsure."
        read -p "$(input 'Enable this option? (Y/n): ')" opt
        if [[ $opt == 'N' || $opt == 'n' ]]; then
            log "Pwned restore option disabled by user."
        else
            log "Pwned restore option enabled."
            restore_usepwndfu64=1
        fi
    fi
}

menu_remove4() {
    local menu_items
    local selected
    local back

    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Disable Exploit" "Enable Exploit" "Go Back")
        menu_print_info
        print " > Main Menu > Other Utilities > Disable/Enable Exploit"
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Disable Exploit" ) rec=0;;
            "Enable Exploit" ) rec=2;;
        esac
        case $selected in
            "Go Back" ) back=1;;
            * ) mode="remove4";;
        esac
    done
}

device_send_rdtar() {
    local target="/mnt1"
    if [[ $2 == "data" ]]; then
        target+="/private/var"
    fi
    log "Sending $1"
    $scp -P $ssh_port $jelbrek/$1 root@127.0.0.1:$target
    log "Extracting $1"
    $ssh -p $ssh_port root@127.0.0.1 "tar -xvf $target/$1 -C /mnt1; rm $target/$1"
}

device_ramdisk64() {
    local sshtar="../saved/ssh64.tar"
    local comps=("iBSS" "iBEC" "DeviceTree" "Kernelcache" "RestoreRamdisk")
    local name
    local iv
    local key
    local path
    local url
    local decrypt
    local ios8
    local opt
    local build_id="16A366"
    if (( device_proc >= 9 )) || [[ $device_type == "iPad5"* ]]; then
        build_id="18C66"
    fi

    if [[ $1 == "jailbreak" ]]; then
        ios8=1
    elif (( device_proc <= 8 )) && [[ $device_type != "iPad5,1" && $device_type != "iPad5,2" ]]; then
        local ver="12"
        if [[ $device_type == "iPad5"* ]]; then
            ver="14"
        fi
        device_ramdiskver="$ver"
        input "Version Select Option"
        print "* The version of the SSH Ramdisk is set to iOS $ver by default. This is the recommended option."
        print "* There is also an option to use iOS 8 ramdisk. This can be used to fix devices on iOS 7 not booting after using iOS $ver ramdisk."
        print "* If not sure, just press Enter/Return. This will select the default version."
        read -p "$(input "Select Y to use iOS $ver, select N to use iOS 8 (Y/n) ")" opt
        if [[ $opt == 'n' || $opt == 'N' ]]; then
            ios8=1
        fi
    fi

    if [[ $ios8 == 1 ]]; then
        build_id="12B410"
        if [[ $device_type == "iPhone"* ]]; then
            build_id="12B411"
        elif [[ $device_type == "iPod7,1" ]]; then
            build_id="12H321"
        fi
        sshtar="../saved/iram.tar"
        if [[ ! -e $sshtar ]]; then
            log "Downloading iram.tar from iarchive.app..."
            download_file https://github.com/LukeZGD/Legacy-iOS-Kit/files/14952123/iram.zip iram.zip
            unzip iram.zip
            mv iram.tar $sshtar
        fi
        cp $sshtar ssh.tar
    else
        comps+=("Trustcache")
        if [[ $($sha1sum $sshtar.gz 2>/dev/null | awk '{print $1}') != "61975423c096d5f21fd9f8a48042fffd3828708b" ]]; then
            rm -f $sshtar $sshtar.gz
        fi
        if [[ ! -e $sshtar.gz ]]; then
            log "Downloading ssh.tar from SSHRD_Script..."
            download_file https://github.com/LukeZGD/sshtars/raw/eed9dcb6aa7562c185eb8b3b66c6035c0b026d47/ssh.tar.gz ssh.tar.gz
            mv ssh.tar.gz $sshtar.gz
        fi
        cp $sshtar.gz ssh.tar.gz
        gzip -d ssh.tar.gz
    fi

    local ramdisk_path="../saved/$device_type/ramdisk_$build_id"
    device_target_build="$build_id"
    device_fw_key_check
    ipsw_get_url $build_id

    mkdir $ramdisk_path 2>/dev/null
    for getcomp in "${comps[@]}"; do
        name=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
        iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        if [[ $device_type == "iPhone8"* && $getcomp == "iB"* ]]; then
            name=$(echo $device_fw_key | $jq -j '.keys[] | select(.image | startswith("'$getcomp'")) | select(.filename | startswith("'$getcomp'.'$device_model'.")) | .filename')
            iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image | startswith("'$getcomp'")) | select(.filename | startswith("'$getcomp'.'$device_model'.")) | .iv')
            key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image | startswith ("'$getcomp'")) | select(.filename | startswith("'$getcomp'.'$device_model'.")) | .key')
        fi
        case $getcomp in
            "iBSS" | "iBEC" ) path="Firmware/dfu/";;
            "DeviceTree" ) path="Firmware/all_flash/";;
            "Trustcache" ) path="Firmware/";;
            * ) path="";;
        esac
        if [[ $ios8 == 1 && $getcomp == "DeviceTree" ]]; then
            path="$all_flash/"
        fi
        if [[ -z $name ]]; then
            local hwmodel
            ipsw_hwmodel_set
            hwmodel="$ipsw_hwmodel"
            case $getcomp in
                "iBSS" | "iBEC"  ) name="$getcomp.$hwmodel.RELEASE.im4p";;
                "DeviceTree"     ) name="$getcomp.${device_model}ap.im4p";;
                "Kernelcache"    ) name="kernelcache.release.$hwmodel";;
                "Trustcache"     ) name="048-08497-242.dmg.trustcache";;
                "RestoreRamdisk" ) name="048-08497-242.dmg";;
            esac
            if [[ $device_type == "iPhone8,1" || $device_type == "iPhone8,2" ]] && [[ $getcomp == "Kernelcache" ]]; then
                name="kernelcache.release.${device_model:0:3}"
            fi
            if [[ $build_id == "18C66" ]]; then
                case $getcomp in
                    "Trustcache"     ) name="038-83284-083.dmg.trustcache";;
                    "RestoreRamdisk" ) name="038-83284-083.dmg";;
                esac
            fi
        fi

        log "$getcomp"
        if [[ -e $ramdisk_path/$name ]]; then
            cp $ramdisk_path/$name .
        else
            "$dir/pzb" -g "${path}$name" -o "$name" "$ipsw_url"
            cp $name $ramdisk_path/
        fi
        mv $name $getcomp.orig
        local reco="-i $getcomp.orig -o $getcomp.img4 -M ../resources/sshrd/IM4M$device_proc -T "
        case $getcomp in
            "iBSS" | "iBEC" )
                reco+="$(echo $getcomp | tr '[:upper:]' '[:lower:]') -A"
                "$dir/img4" -i $getcomp.orig -o $getcomp.dec -k ${iv}${key}
                mv $getcomp.orig $getcomp.orig0
                if [[ $ios8 == 1 ]]; then
                    $bspatch $getcomp.dec $getcomp.orig ../resources/sshrd/ios8/$name.patch
                else
                    $bspatch $getcomp.dec $getcomp.orig ../resources/sshrd/$name.patch
                fi
            ;;
            "Kernelcache" )
                reco+="rkrn"
                if [[ $ios8 == 1 ]]; then
                    mv $getcomp.orig $getcomp.orig0
                    "$dir/img4" -i $getcomp.orig0 -o $getcomp.orig -k ${iv}${key} -D
                else
                    reco+=" -P ../resources/sshrd/$name.bpatch"
                    if [[ $platform == "linux" && $build_id == "18"* ]] || [[ $device_proc == 10 ]]; then
                        reco+=" -J"
                    fi
                fi
            ;;
            "DeviceTree" )
                reco+="rdtr"
                if [[ $ios8 == 1 ]]; then
                    reco+=" -A"
                    mv $getcomp.orig $getcomp.orig0
                    "$dir/img4" -i $getcomp.orig0 -o $getcomp.orig -k ${iv}${key}
                fi
            ;;
            "Trustcache" ) reco+="rtsc";;
            "RestoreRamdisk" )
                reco+="rdsk -A"
                mv $getcomp.orig $getcomp.orig0
                if [[ $ios8 == 1 ]]; then
                    "$dir/img4" -i $getcomp.orig0 -o $getcomp.orig -k ${iv}${key}
                    "$dir/hfsplus" $getcomp.orig grow 50000000
                else
                    "$dir/img4" -i $getcomp.orig0 -o $getcomp.orig
                    "$dir/hfsplus" $getcomp.orig grow 210000000
                fi
                "$dir/hfsplus" $getcomp.orig untar ssh.tar
                "$dir/hfsplus" $getcomp.orig untar ../resources/sshrd/sbplist.tar
            ;;
        esac
        "$dir/img4" $reco
        cp $getcomp.img4 $ramdisk_path
    done

    mv $ramdisk_path/iBSS.img4 $ramdisk_path/iBSS.im4p
    mv $ramdisk_path/iBEC.img4 $ramdisk_path/iBEC.im4p
    iBSS="$ramdisk_path/iBSS"
    iBEC="$ramdisk_path/iBEC"
    restore_prepare_pwnrec64

    log "Booting, please wait..."
    $irecovery -f $ramdisk_path/RestoreRamdisk.img4
    $irecovery -c ramdisk
    $irecovery -f $ramdisk_path/DeviceTree.img4
    $irecovery -c devicetree
    if [[ $ios8 != 1 ]]; then
        $irecovery -f $ramdisk_path/Trustcache.img4
        $irecovery -c firmware
    fi
    $irecovery -f $ramdisk_path/Kernelcache.img4
    $irecovery -c bootx
    device_find_mode Restore 20

    if [[ $ios8 == 1 ]]; then
        device_iproxy no-logging 44
        print "* Booted SSH ramdisk is based on: https://ios7.iarchive.app/downgrade/making-ramdisk.html"
    else
        device_iproxy no-logging
        print "* Booted SSH ramdisk is based on: https://github.com/verygenericname/SSHRD_Script"
    fi
    device_sshpass alpine

    print "* Mount filesystems with this command (for iOS 11.3 and newer):"
    print "    /usr/bin/mount_filesystems"
    print "* Mount filesystems with this command (for iOS 10.3.x):"
    print "    /sbin/mount_apfs /dev/disk0s1s1 /mnt1; /sbin/mount_apfs /dev/disk0s1s2 /mnt2"
    print "* Mount filesystems with this command (for iOS 10.2.1 and older):"
    print "    /sbin/mount_hfs /dev/disk0s1s1 /mnt1; /sbin/mount_hfs /dev/disk0s1s2 /mnt2"
    warn "Mounting and/or modifying data (/mnt2) might not work for 64-bit iOS"

    menu_ramdisk $build_id
}

device_ramdisk() {
    local comps=("iBSS" "iBEC" "DeviceTree" "Kernelcache")
    local name
    local iv
    local key
    local path
    local url
    local decrypt
    local ramdisk_path
    local build_id
    local mode="$1"
    local rec=2

    if [[ $1 == "setnvram" ]]; then
        rec=$2
    fi
    if [[ $1 != "justboot" ]]; then
        comps+=("RestoreRamdisk")
    fi
    case $device_type in
        iPhone1,[12] | iPod1,1 ) device_target_build="7E18";;
        iPod2,1 ) device_target_build="8C148";;
        iPod3,1 | iPad1,1 ) device_target_build="9B206";;
        iPhone2,1 | iPod4,1 ) device_target_build="10B500";;
        iPhone5,[34] ) device_target_build="11D257";;
        * ) device_target_build="10B329";;
    esac
    if [[ -n $device_rd_build ]]; then
        device_target_build=$device_rd_build
        device_rd_build=
    fi
    build_id=$device_target_build
    device_fw_key_check
    ipsw_get_url $build_id
    ramdisk_path="../saved/$device_type/ramdisk_$build_id"
    mkdir $ramdisk_path 2>/dev/null
    for getcomp in "${comps[@]}"; do
        name=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
        iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        case $getcomp in
            "iBSS" | "iBEC" ) path="Firmware/dfu/";;
            "DeviceTree" )
                path="Firmware/all_flash/"
                case $build_id in
                    14[EFG]* ) :;;
                    * ) path="$all_flash/";;
                esac
            ;;
            * ) path="";;
        esac
        if [[ -z $name ]]; then
            local hwmodel="$device_model"
            case $build_id in
                14[EFG]* )
                    case $device_type in
                        iPhone5,[12] ) hwmodel="iphone5";;
                        iPhone5,[34] ) hwmodel="iphone5b";;
                        iPad3,[456] )  hwmodel="ipad3b";;
                    esac
                ;;
                [789]* | 10* | 11* ) hwmodel+="ap";;
            esac
            case $getcomp in
                "iBSS" | "iBEC" ) name="$getcomp.$hwmodel.RELEASE.dfu";;
                "DeviceTree" )    name="$getcomp.${device_model}ap.img3";;
                "Kernelcache" )   name="kernelcache.release.$hwmodel";;
            esac
        fi

        log "$getcomp"
        if [[ -n $ipsw_justboot_path ]]; then
            unzip -o -j "$ipsw_justboot_path.ipsw" "${path}$name" -d .
        elif [[ -e $ramdisk_path/$name ]]; then
            cp $ramdisk_path/$name .
        else
            "$dir/pzb" -g "${path}$name" -o "$name" "$ipsw_url"
            cp $name $ramdisk_path/
        fi
        mv $name $getcomp.orig
        if [[ $getcomp == "Kernelcache" || $getcomp == "iBSS" ]] && [[ $device_type == "iPod2,1" ]]; then
            decrypt="-iv $iv -k $key"
            "$dir/xpwntool" $getcomp.orig $getcomp.dec $decrypt
        elif [[ $build_id == "14"* ]]; then
            cp $getcomp.orig $getcomp.dec
        else
            "$dir/xpwntool" $getcomp.orig $getcomp.dec -iv $iv -k $key -decrypt
        fi
    done

    if [[ $1 != "justboot" ]]; then
        log "Patch RestoreRamdisk"
        "$dir/xpwntool" RestoreRamdisk.dec Ramdisk.raw
        "$dir/hfsplus" Ramdisk.raw grow 30000000
        "$dir/hfsplus" Ramdisk.raw untar ../resources/sshrd/sbplist.tar
    fi

    if [[ $device_type == "iPod2,1" ]]; then
        "$dir/hfsplus" Ramdisk.raw untar ../resources/sshrd/ssh_old.tar
        "$dir/xpwntool" Ramdisk.raw Ramdisk.dmg -t RestoreRamdisk.dec
        log "Patch iBSS"
        $bspatch iBSS.dec iBSS.patched ../resources/patch/iBSS.${device_model}ap.RELEASE.patch
        "$dir/xpwntool" iBSS.patched iBSS -t iBSS.orig
        log "Patch Kernelcache"
        mv Kernelcache.dec Kernelcache0.dec
        if [[ $device_proc == 1 ]]; then
            $bspatch Kernelcache0.dec Kernelcache.patched ../resources/patch/kernelcache.release.s5l8900x.patch
        else
            $bspatch Kernelcache0.dec Kernelcache.patched ../resources/patch/kernelcache.release.${device_model}.patch
        fi
        "$dir/xpwntool" Kernelcache.patched Kernelcache.dec -t Kernelcache.orig $decrypt
        rm DeviceTree.dec
        mv DeviceTree.orig DeviceTree.dec
    else
        if [[ $1 != "justboot" ]]; then
            "$dir/hfsplus" Ramdisk.raw untar ../resources/sshrd/ssh.tar
            if [[ $1 == "jailbreak" && $device_vers == "8"* ]]; then
                "$dir/hfsplus" Ramdisk.raw untar ../resources/jailbreak/daibutsu/bin.tar
            fi
            "$dir/hfsplus" Ramdisk.raw mv sbin/reboot sbin/reboot_bak
            "$dir/hfsplus" Ramdisk.raw mv sbin/halt sbin/halt_bak
            case $build_id in
                 "12"* | "13"* | "14"* )
                    echo '#!/bin/bash' > restored_external
                    echo "/sbin/sshd; exec /usr/local/bin/restored_external_o" >> restored_external
                    "$dir/hfsplus" Ramdisk.raw mv usr/local/bin/restored_external usr/local/bin/restored_external_o
                    "$dir/hfsplus" Ramdisk.raw add restored_external usr/local/bin/restored_external
                    "$dir/hfsplus" Ramdisk.raw chmod 755 usr/local/bin/restored_external
                    "$dir/hfsplus" Ramdisk.raw chown 0:0 usr/local/bin/restored_external
                ;;
            esac
            "$dir/xpwntool" Ramdisk.raw Ramdisk.dmg -t RestoreRamdisk.dec
        fi
        log "Patch iBSS"
        "$dir/xpwntool" iBSS.dec iBSS.raw
        if [[ $build_id == "8"* && $device_type == "iPad2"* ]]; then
            "$dir/iBoot32Patcher" iBSS.raw iBSS.patched --rsa -b "-v amfi=0xff cs_enforcement_disable=1"
            device_boot4=1
        else
            "$dir/iBoot32Patcher" iBSS.raw iBSS.patched --rsa -b "$device_justboot_bootargs"
        fi
        "$dir/xpwntool" iBSS.patched iBSS -t iBSS.dec
        if [[ $build_id == "7"* || $build_id == "8"* ]] && [[ $device_type != "iPad"* ]]; then
            :
        else
            log "Patch iBEC"
            "$dir/xpwntool" iBEC.dec iBEC.raw
            if [[ $1 == "justboot" ]]; then
                "$dir/iBoot32Patcher" iBEC.raw iBEC.patched --rsa -b "$device_justboot_bootargs"
            else
                "$dir/iBoot32Patcher" iBEC.raw iBEC.patched --rsa --debug -b "rd=md0 -v amfi=0xff amfi_get_out_of_my_way=1 cs_enforcement_disable=1 pio-error=0"
            fi
            "$dir/xpwntool" iBEC.patched iBEC -t iBEC.dec
        fi
    fi

    if [[ $device_type == "iPad2"* && $build_id == "8"* ]]; then
        log "Patch Kernelcache"
        mv Kernelcache.dec Kernelcache0.dec
        "$dir/xpwntool" Kernelcache0.dec Kernelcache.raw
        $bspatch Kernelcache.raw Kernelcache.patched ../resources/patch/kernelcache.release.${device_model}.${build_id}.patch
        "$dir/xpwntool" Kernelcache.patched Kernelcache.dec -t Kernelcache0.dec
    fi

    mv iBSS iBEC DeviceTree.dec Kernelcache.dec Ramdisk.dmg $ramdisk_path 2>/dev/null

    if [[ $1 == "jailbreak" || $1 == "justboot" ]]; then
        device_enter_mode pwnDFU
    elif [[ $device_proc == 4 ]] || [[ $device_proc == 6 && $platform == "macos" ]]; then
        device_buttons
    elif [[ $device_proc == 1 ]]; then
        device_enter_mode DFU
    else
        device_enter_mode kDFU
    fi

    if [[ $device_type == "iPad1,1" && $build_id != "9"* ]]; then
        patch_ibss
        log "Sending iBSS..."
        $irecovery -f pwnediBSS.dfu
        log "Sending iBEC..."
        $irecovery -f $ramdisk_path/iBEC
    elif (( device_proc < 5 )) && [[ $device_pwnrec != 1 ]]; then
        log "Sending iBSS..."
        $irecovery -f $ramdisk_path/iBSS
    fi
    sleep 2
    if [[ $build_id != "7"* && $build_id != "8"* ]]; then
        log "Sending iBEC..."
        $irecovery -f $ramdisk_path/iBEC
        if [[ $device_pwnrec == 1 ]]; then
            $irecovery -c "go"
        fi
    fi
    sleep 3
    device_find_mode Recovery
    if [[ $1 != "justboot" ]]; then
        log "Sending ramdisk..."
        $irecovery -f $ramdisk_path/Ramdisk.dmg
        log "Running ramdisk"
        $irecovery -c "getenv ramdisk-delay"
        $irecovery -c ramdisk
        sleep 2
    fi
    log "Sending DeviceTree..."
    $irecovery -f $ramdisk_path/DeviceTree.dec
    log "Running devicetree"
    $irecovery -c devicetree
    log "Sending KernelCache..."
    $irecovery -f $ramdisk_path/Kernelcache.dec
    $irecovery -c bootx

    if [[ $1 == "justboot" ]]; then
        log "Device should now boot."
        return
    elif [[ -n $1 ]]; then
        log "Booting, please wait..."
        device_find_mode Restore 20
        device_iproxy
    else
        log "Booting, please wait..."
        device_find_mode Restore 20
        device_iproxy no-logging
    fi
    device_sshpass alpine

    case $mode in
        "activation" | "baseband" )
            return
        ;;

        "TwistedMind2" )
            log "Sending dd command for TwistedMind2"
            $scp -P $ssh_port TwistedMind2 root@127.0.0.1:/
            $ssh -p $ssh_port root@127.0.0.1 "dd if=/TwistedMind2 of=/dev/rdisk0 bs=8192; reboot_bak"
            return
        ;;

        "jailbreak" | "getversion" )
            local vers
            local build
            local untether
            device_ramdisk_iosvers
            vers=$device_vers
            build=$device_build
            if [[ $1 == "getversion" && -n $vers ]]; then
                log "Retrieved the current iOS version, rebooting device"
                print "* iOS Version: $vers ($build)"
                $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
                return
            fi
            case $vers in
                9.3.[4231] | 9.3 ) untether="untetherhomedepot.tar";;
                9.2* | 9.1 ) untether="untetherhomedepot921.tar";;
                8* )         untether="daibutsu/untether.tar";;
                7.1* )       untether="panguaxe.tar";;
                7* )         untether="evasi0n7-untether.tar";;
                6.1.[6543] ) untether="p0sixspwn.tar";;
                6* )         untether="evasi0n6-untether.tar";;
                4.2.[8761] | 4.[10]* | 3.2* | 3.1.3 ) untether="greenpois0n/${device_type}_${build}.tar";;
                5* | 4.[32]* ) untether="g1lbertJB/${device_type}_${build}.tar";;
                '' )
                    warn "Something wrong happened. Failed to get iOS version."
                    print "* Please reboot the device into normal operating mode, then perform a clean \"slide to power off\", then try again."
                    $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
                    return
                ;;
                * )
                    warn "iOS $vers is not supported for jailbreaking with SSHRD."
                    $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
                    return
                ;;
            esac
            log "Nice, iOS $vers is compatible."
            log "Sending $untether"
            $scp -P $ssh_port $jelbrek/$untether root@127.0.0.1:/mnt1
            # 3.1.3-4.1 untether needs to be extracted early (before data partition is mounted)
            case $vers in
                4.[10]* | 3.2* )
                    untether="${device_type}_${build}.tar"
                    log "Extracting $untether"
                    $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
                ;;
            esac
            # Do not extract untether for 3GS 3.1.x
            if [[ $vers == "3.1"* && $device_type != "iPhone2,1" ]]; then
                untether="${device_type}_${build}.tar"
                log "Extracting $untether"
                $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
            fi
            log "Mounting data partition"
            $ssh -p $ssh_port root@127.0.0.1 "mount.sh pv"
            case $vers in
                9* | 8* ) device_send_rdtar fstab8.tar;;
                7* ) device_send_rdtar fstab7.tar;;
                6* ) device_send_rdtar fstab_rw.tar;;
                4.2.[8761] ) $ssh -p $ssh_port root@127.0.0.1 "[[ ! -e /mnt1/sbin/punchd ]] && mv /mnt1/sbin/launchd /mnt1/sbin/punchd";;
                5* | 4.[32]* ) untether="${device_type}_${build}.tar";;
            esac
            case $vers in
                5* ) device_send_rdtar g1lbertJB.tar;;
                4.2.[8761] | 4.[10]* | 3* )
                    untether="${device_type}_${build}.tar"
                    log "fstab"
                    if [[ $device_proc == 1 || $device_type == "iPod2,1" ]]; then
                        $scp -P $ssh_port $jelbrek/fstab_old root@127.0.0.1:/mnt1/private/etc/fstab
                    else
                        $scp -P $ssh_port $jelbrek/fstab_new root@127.0.0.1:/mnt1/private/etc/fstab
                    fi
                    $ssh -p $ssh_port root@127.0.0.1 "rm /mnt1/private/var/mobile/Library/Caches/com.apple.mobile.installation.plist"
                ;;
            esac
            case $vers in
                8* | 4.[10]* | 3* ) :;;
                * )
                    log "Extracting $untether"
                    $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
                ;;
            esac
            case $vers in
                [543]* ) device_send_rdtar cydiasubstrate.tar;;
            esac
            case $vers in
                3* ) device_send_rdtar cydiahttpatch.tar;;
            esac
            if [[ $device_type == "iPhone2,1" && $vers == "4.3"* ]]; then
                # 4.3.x 3gs'es have little free space in rootfs. workaround: extract an older strap that takes less space
                device_send_rdtar freeze5.tar data
            else
                device_send_rdtar freeze.tar data
            fi
            if [[ $ipsw_openssh == 1 ]]; then
                device_send_rdtar sshdeb.tar
            fi
            if [[ $vers == "8"* ]]; then
                log "Sending daibutsu/move.sh"
                $scp -P $ssh_port $jelbrek/daibutsu/move.sh root@127.0.0.1:/mnt1
                log "Moving files"
                $ssh -p $ssh_port root@127.0.0.1 "bash /mnt1/move.sh; rm /mnt1/move.sh"
                untether="untether.tar"
                log "Extracting $untether"
                $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
                log "Running haxx_overwrite --${device_type}_${build}"
                $ssh -p $ssh_port root@127.0.0.1 "/usr/bin/haxx_overwrite --${device_type}_${build}"
            else
                log "Rebooting"
                $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
            fi
            log "Cool, done and jailbroken (hopefully)"
            case $vers in
                4* | 3* ) warn "Do not uninstall Cydia Substrate and Substrate Safe Mode in Cydia!";;
            esac
            return
        ;;

        "clearnvram" )
            log "Sending command for clearing NVRAM..."
            $ssh -p $ssh_port root@127.0.0.1 "nvram -c; reboot_bak"
            log "Done, your device should reboot now"
            return
        ;;

        "setnvram" )
            device_ramdisk_setnvram
            log "Rebooting device"
            $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
            return
        ;;

        * ) log "Device should now boot to SSH ramdisk mode.";;
    esac
    echo
    print "* Mount filesystems with this command:"
    print "    mount.sh"
    menu_ramdisk
}

device_ramdisk_setnvram() {
    log "Sending commands for setting NVRAM variables..."
    $ssh -p $ssh_port root@127.0.0.1 "nvram -c; nvram boot-partition=$rec"
    if [[ $rec == 2 ]]; then
        case $device_type in
            iPhone3,3 ) $ssh -p $ssh_port root@127.0.0.1 "nvram boot-ramdisk=/a/b/c/d/e/f/g/h/i/disk.dmg";;
            iPad2,4   ) $ssh -p $ssh_port root@127.0.0.1 "nvram boot-ramdisk=/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/disk.dmg";;
            iPhone4,1 ) $ssh -p $ssh_port root@127.0.0.1 "nvram boot-ramdisk=/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/disk.dmg";;
            iPod5,1   ) $ssh -p $ssh_port root@127.0.0.1 "nvram boot-ramdisk=/a/b/c/d/e/f/g/h/i/j/k/l/m/disk.dmg";;
            iPhone5*  )
                read -p "$(input "Select base version: Y for iOS 7.1.x, N for iOS 7.0.x (Y/n) ")" opt
                if [[ $opt != 'N' && $opt != 'n' ]]; then
                    $ssh -p $ssh_port root@127.0.0.1 "nvram boot-ramdisk=/a/b/c/d/e/f/g/h/i/j/k/l/m/disk.dmg"
                else
                    $ssh -p $ssh_port root@127.0.0.1 "nvram boot-ramdisk=/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/disk.dmg"
                fi
            ;;
            iPad1,1 | iPod3,1 )
                device_ramdisk_iosvers
                if [[ $device_vers == "3"* ]]; then
                    device_ramdisk_ios3exploit
                fi
            ;;
        esac
    fi
    log "Done"
}

device_ramdisk_ios3exploit() {
    log "iOS 3.x detected, running exploit commands"
    local offset="$($ssh -p $ssh_port root@127.0.0.1 "echo -e 'p\nq\n' | fdisk -e /dev/rdisk0" | grep AF | head -1)"
    offset="${offset##*-}"
    offset="$(echo ${offset%]*} | tr -d ' ')"
    offset=$((offset+64))
    log "Got offset $offset"
    $ssh -p $ssh_port root@127.0.0.1 "echo -e 'e 3\nAF\n\n${offset}\n8\nw\ny\nq\n' | fdisk -e /dev/rdisk0"
    echo
    log "Writing exploit ramdisk"
    $scp -P $ssh_port ../resources/firmware/src/target/$device_model/9B206/exploit root@127.0.0.1:/
    $ssh -p $ssh_port root@127.0.0.1 "dd of=/dev/rdisk0s3 if=/exploit bs=64k count=1"
    if [[ $device_type == "iPad1,1" ]]; then
        $scp -P $ssh_port ../saved/iPad1,1/iBoot3_$device_ecid root@127.0.0.1:/mnt1/iBEC
    fi
    log "fstab"
    $scp -P $ssh_port $jelbrek/fstab_new root@127.0.0.1:/mnt1/private/etc/fstab
    case $device_vers in
        3.1.3 | 3.2* ) opt='y';;
    esac
    if [[ $opt == 'y' ]]; then
        untether="${device_type}_${device_build}.tar"
        log "Sending $untether"
        $scp -P $ssh_port $jelbrek/greenpois0n/$untether root@127.0.0.1:/mnt1
        log "Extracting $untether"
        $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
        log "Mounting data partition"
        $ssh -p $ssh_port root@127.0.0.1 "mount.sh pv"
        device_send_rdtar cydiasubstrate.tar
        device_send_rdtar cydiahttpatch.tar
        if [[ $device_vers == "3.1.3" || $device_vers == "3.2" ]]; then
            device_send_rdtar freeze.tar data
        fi
        if [[ $ipsw_openssh == 1 ]]; then
            device_send_rdtar sshdeb.tar
        fi
    fi
}

device_ramdisk_iosvers() {
    device_vers=
    device_build=
    if (( device_proc < 7 )); then
        log "Mounting root filesystem"
        $ssh -p $ssh_port root@127.0.0.1 "mount.sh root"
        sleep 1
    fi
    log "Getting iOS version"
    $scp -P $ssh_port root@127.0.0.1:/mnt1/System/Library/CoreServices/SystemVersion.plist .
    if [[ $platform == "macos" ]]; then
        rm -f BuildVer Version
        plutil -extract 'ProductVersion' xml1 SystemVersion.plist -o Version
        device_vers=$(cat Version | sed -ne '/<string>/,/<\/string>/p' | sed -e "s/<string>//" | sed "s/<\/string>//" | sed '2d')
        plutil -extract 'ProductBuildVersion' xml1 SystemVersion.plist -o BuildVer
        device_build=$(cat BuildVer | sed -ne '/<string>/,/<\/string>/p' | sed -e "s/<string>//" | sed "s/<\/string>//" | sed '2d')
    else
        device_vers=$(cat SystemVersion.plist | grep -i ProductVersion -A 1 | grep -oPm1 "(?<=<string>)[^<]+")
        device_build=$(cat SystemVersion.plist | grep -i ProductBuildVersion -A 1 | grep -oPm1 "(?<=<string>)[^<]+")
    fi
}

menu_ramdisk() {
    local loop
    local menu_items=("Connect to SSH" "Dump Blobs")
    local reboot="reboot_bak"
    if (( device_proc >= 7 )); then
        menu_items+=("Dump SEP Firmware")
        reboot="/sbin/reboot"
    else
        menu_items+=("Dump Baseband/Activation")
    fi
    if [[ $1 == "18C66" ]]; then
        menu_items+=("Install TrollStore")
    elif [[ $device_proc == 7 && $1 == "12"* ]]; then
        log "Ramdisk should now boot and fix iOS 7 not booting."
    elif (( device_proc <= 8 )); then
        menu_items+=("Erase All (iOS 7 and 8)")
    fi
    if (( device_proc >= 5 )); then
        menu_items+=("Erase All (iOS 9+)")
    fi
    case $device_type in
        iPhone3,[13] | iPhone[45]* | iPad1,1 | iPad2,4 | iPod[35],1 ) menu_items+=("Disable/Enable Exploit");;
    esac
    menu_items+=("Clear NVRAM" "Get iOS Version" "Update DateTime" "Reboot Device" "Exit")

    print "* For accessing data, note the following:"
    print "* Host: sftp://127.0.0.1 | User: root | Password: alpine | Port: $ssh_port"
    echo
    print "* Other Useful SSH Ramdisk commands:"
    print "* Clear NVRAM with this command:"
    print "    nvram -c"
    print "* Erase All Content and Settings with this command (iOS 9+ only):"
    print "    nvram oblit-inprogress=5"
    print "* To reboot, use this command:"
    print "    $reboot"
    echo

    while [[ $loop != 1 ]]; do
        mode=
        print "* SSH Ramdisk Menu"
        while [[ -z $mode ]]; do
            input "Select an option:"
            select opt in "${menu_items[@]}"; do
                selected="$opt"
                break
            done
            case $selected in
                "Connect to SSH" ) mode="ssh";;
                "Reboot Device" ) mode="reboot";;
                "Dump Blobs" ) mode="dump-blobs";;
                "Get iOS Version" ) mode="iosvers";;
                "Dump Baseband/Activation" ) mode="dump-bbactrec";;
                "Install TrollStore" ) mode="trollstore";;
                "Erase All (iOS 7 and 8)" ) mode="erase78";;
                "Erase All (iOS 9+)" ) mode="erase9";;
                "Clear NVRAM" ) mode="clearnvram";;
                "Dump SEP Firmware" ) mode="dump-sep";;
                "Disable/Enable Exploit" ) menu_remove4;;
                "Update DateTime" ) mode="datetime";;
                "Exit" ) mode="exit";;
            esac
        done

        case $mode in
            "ssh" )
                log "Use the \"exit\" command to go back to SSH Ramdisk Menu"
                if (( device_proc >= 7 )) && [[ $1 == "12"* ]]; then
                    $ssh -p $ssh_port root@127.0.0.1 &
                    ssh_pid=$!
                    sleep 1
                    kill $ssh_pid
                fi
                $ssh -p $ssh_port root@127.0.0.1
            ;;
            "reboot" ) $ssh -p $ssh_port root@127.0.0.1 "$reboot"; loop=1;;
            "exit" ) loop=1;;
            "dump-blobs" )
                local shsh="../saved/shsh/$device_ecid-$device_type-$(date +%Y-%m-%d-%H%M).shsh"
                if [[ $1 == "12"* ]]; then
                    warn "Dumping blobs may fail on iOS 8 ramdisk."
                    print "* It is recommended to do this on iOS $device_ramdiskver ramdisk instead."
                    read -p "$(input "Select Y to continue, N to go back (y/N) ")" opt
                    if [[ $opt != 'Y' && $opt != 'y' ]]; then
                        continue
                    fi
                elif (( device_proc < 7 )); then
                    warn "This is the wrong place to dump onboard blobs for 32-bit devices."
                    print "* Reboot your device, run the script again and go to Save SHSH Blobs -> Onboard Blobs"
                    print "* For more details, go to: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Saving-onboard-SHSH-blobs-of-current-iOS-version"
                    pause
                    continue
                fi
                log "Attempting to dump blobs"
                $ssh -p $ssh_port root@127.0.0.1 "cat /dev/rdisk1" | dd of=dump.raw bs=256 count=$((0x4000))
                if [[ ! -s dump.raw ]]; then
                    log "Failed with rdisk1, trying again with rdisk2..."
                    $ssh -p $ssh_port root@127.0.0.1 "cat /dev/rdisk2" | dd of=dump.raw bs=256 count=$((0x4000))
                    if [[ ! -s dump.raw ]]; then
                        warn "Failed with rdisk2, cannot continue."
                        continue
                    fi
                fi
                "$dir/img4tool" --convert -s $shsh dump.raw
                if [[ -s $shsh ]]; then
                    log "Onboard blobs should be dumped to $shsh"
                    continue
                fi
                warn "Failed to convert raw dump to SHSH."
                local raw="../saved/shsh/rawdump_${device_ecid}-${device_type}_$(date +%Y-%m-%d-%H%M).raw"
                mv dump.raw $raw
                log "Raw dump saved at: $raw"
                warn "This raw dump is not usable for restoring, you need to convert it first."
                print "* If unable to be converted, this dump is likely not usable for restoring."
            ;;
            "iosvers" )
                if (( device_proc >= 7 )); then
                    print "* Unfortunately the mount command needs to be done manually for 64-bit devices."
                    print "* The mount command also changes depending on the iOS version (which is what we're trying to get here in the first place)"
                    print "* You need to mount filesystems using the appropriate command before continuing (scroll up to see the commands)"
                    warn "Make sure that you know what you are doing when using this option on 64-bit devices."
                    read -p "$(input "Select Y to continue, N to go back (y/N) ")" opt
                    if [[ $opt != 'Y' && $opt != 'y' ]]; then
                        continue
                    fi
                fi
                device_ramdisk_iosvers
                if [[ -n $device_vers ]]; then
                    log "Retrieved the current iOS version"
                    print "* iOS Version: $device_vers ($device_build)"
                else
                    warn "Something wrong happened. Failed to get iOS version."
                fi
            ;;
            "dump-bbactrec" ) device_dumprd;;
            "trollstore" )
                print "* Make sure that your device is on iOS 14 or 15 before continuing."
                print "* If your device is on iOS 13 or below, TrollStore will NOT work."
                read -p "$(input "Select Y to continue, N to go back (y/N) ")" opt
                if [[ $opt != 'Y' && $opt != 'y' ]]; then
                    continue
                fi
                log "Checking for latest TrollStore"
                local latest="$(curl https://api.github.com/repos/opa334/TrollStore/releases/latest | $jq -r ".tag_name")"
                local current="$(cat ../saved/TrollStore_version 2>/dev/null || echo "none")"
                log "Latest version: $latest, current version: $current"
                if [[ $current != "$latest" ]]; then
                    rm -f ../saved/TrollStore.tar ../saved/PersistenceHelper_Embedded
                fi
                if [[ -s ../saved/TrollStore.tar && -s ../saved/PersistenceHelper_Embedded ]]; then
                    cp ../saved/TrollStore.tar ../saved/PersistenceHelper_Embedded .
                else
                    rm ../saved/TrollStore.tar ../saved/PersistenceHelper_Embedded 2>/dev/null
                    log "Downloading files for latest TrollStore"
                    download_file https://github.com/opa334/TrollStore/releases/download/$latest/PersistenceHelper_Embedded PersistenceHelper_Embedded
                    download_file https://github.com/opa334/TrollStore/releases/download/$latest/TrollStore.tar TrollStore.tar
                    cp TrollStore.tar PersistenceHelper_Embedded ../saved
                    echo "$latest" > ../saved/TrollStore_version
                fi
                tar -xf TrollStore.tar
                log "Installing TrollStore to Tips"
                $ssh -p $ssh_port root@127.0.0.1 "mount_filesystems"
                local tips="$($ssh -p $ssh_port root@127.0.0.1 "find /mnt2/containers/Bundle/Application/ -name \"Tips.app\"")"
                $scp -P $ssh_port PersistenceHelper_Embedded TrollStore.app/trollstorehelper ../resources/sshrd/trollstore.sh root@127.0.0.1:$tips
                rm -r PersistenceHelper_Embedded TrollStore*
                $ssh -p $ssh_port root@127.0.0.1 "bash $tips/trollstore.sh; rm $tips/trollstore.sh"
                log "Done!"
            ;;
            "erase78" )
                log "Please read the message below:"
                warn "This will do a \"Erase All Content and Settings\" procedure for iOS 7 and 8 devices."
                warn "Do NOT do this if your device is jailbroken untethered!!!"
                print "* This procedure will do step 6 of this tutorial: https://reddit.com/r/LegacyJailbreak/comments/13of20g/tutorial_new_restoringerasingwipingrescuing_a/"
                print "* Note that it may also be better to do this process manually instead by following the commands in the tutorial."
                print "* For iOS 8 devices, also remove this file if you will be doing it manually: /mnt2/mobile/Library/SpringBoard/LockoutStateJournal.plist"
                if (( device_proc >= 7 )); then
                    print "* If your device is on iOS 7, make sure to boot an iOS 8 ramdisk afterwards to fix booting."
                fi
                print "* When the device boots back up, trigger a restore by entering wrong passwords 10 times."
                read -p "$(input "Select Y to continue, N to go back (y/N) ")" opt
                if [[ $opt != 'Y' && $opt != 'y' ]]; then
                    continue
                fi
                $ssh -p $ssh_port root@127.0.0.1 "/sbin/mount_hfs /dev/disk0s1s1 /mnt1; /sbin/mount_hfs /dev/disk0s1s2 /mnt2; cp /com.apple.springboard.plist /mnt1/"
                $ssh -p $ssh_port root@127.0.0.1 "cd /mnt2/mobile/Library/Preferences; mv com.apple.springboard.plist com.apple.springboard.plist.bak; ln -s /com.apple.springboard.plist ./com.apple.springboard.plist"
                $ssh -p $ssh_port root@127.0.0.1 "rm /mnt2/mobile/Library/SpringBoard/LockoutStateJournal.plist"
                $ssh -p $ssh_port root@127.0.0.1 "sync; cd /; /sbin/umount /mnt2; /sbin/umount /mnt1; sync; /sbin/reboot"
                log "Done, your device should reboot now"
                print "* Proceed to trigger a restore by entering wrong passwords 10 times."
                loop=1
            ;;
            "dump-sep" )
                log "Please read the message below:"
                print "* To dump SEP Firmware, do the following:"
                print "    - Mount filesystems using the appropriate command for your iOS version (scroll up to see the commands)"
                print "    - Grab the file sep-firmware.img4 from /mnt1/usr/standalone or /mnt1/usr/standalone/firmware"
                print "* Better do this process manually since Legacy iOS Kit does not know your iOS version"
                pause
            ;;
            "clearnvram" )
                log "Sending command for clearing NVRAM..."
                $ssh -p $ssh_port root@127.0.0.1 "/usr/sbin/nvram -c"
                log "Done"
            ;;
            "erase9" )
                warn "This will do a \"Erase All Content and Settings\" procedure for iOS 9+ devices."
                warn "Do NOT do this if your device is jailbroken untethered!!! (mostly iOS 9.3.4/9.1 and lower)"
                read -p "$(input "Select Y to continue, N to go back (y/N) ")" opt
                if [[ $opt != 'Y' && $opt != 'y' ]]; then
                    continue
                fi
                log "Sending command for erasing all content and settings..."
                $ssh -p $ssh_port root@127.0.0.1 "nvram oblit-inprogress=5"
                log "Done. Reboot to apply changes, or clear NVRAM now to cancel erase"
            ;;
            "remove4" ) device_ramdisk_setnvram;;
            "datetime" ) $ssh -p $ssh_port root@127.0.0.1 "date -s @$(date +%s)";;
        esac
    done
}

shsh_save_onboard64() {
    print "* There are other ways for dumping onboard blobs for 64-bit devices as listed below:"
    print "* It is recommended to use SSH Ramdisk option to dump onboard blobs instead: Other Utilities -> SSH Ramdisk"
    print "* For A8 and newer, you can also use SSHRD_Script: https://github.com/verygenericname/SSHRD_Script"
    echo
    if [[ $device_mode != "Normal" ]]; then
        warn "Device must be in normal mode and jailbroken, cannot continue."
        print "* Use the SSH Ramdisk option instead."
        return
    fi
    log "Proceeding to dump onboard blobs on normal mode"
    device_ssh_message
    device_iproxy
    device_sshpass
    local shsh="../saved/shsh/$device_ecid-$device_type-$device_vers-$device_build.shsh"
    $ssh -p $ssh_port root@127.0.0.1 "cat /dev/disk1" | dd of=dump.raw bs=256 count=$((0x4000))
    "$dir/img4tool" --convert -s $shsh dump.raw
    if [[ ! -s $shsh ]]; then
        warn "Failed to convert raw dump to SHSH."
        if [[ -s dump.raw ]]; then
            local raw="../saved/shsh/rawdump_${device_ecid}-${device_type}-${device_vers}-${device_build}_$(date +%Y-%m-%d-%H%M).raw"
            mv dump.raw $raw
            log "Raw dump saved at: $raw"
            warn "This raw dump is not usable for restoring, you need to convert it first."
            print "* If unable to be converted, this dump is likely not usable for restoring."
        fi
        error "Saving onboard SHSH blobs failed." "It is recommended to dump onboard SHSH blobs on SSH Ramdisk instead."
    fi
    log "Successfully saved $device_vers blobs: $shsh"
}

shsh_save_onboard() {
    if (( device_proc >= 7 )); then
        shsh_save_onboard64
        return
    elif [[ $device_proc == 4 ]] || [[ $device_proc == 6 && $platform == "macos" ]]; then
        device_buttons
    else
        device_enter_mode kDFU
    fi
    if [[ $device_proc == 4 && $device_pwnrec != 1 ]]; then
        patch_ibss
        log "Sending iBSS..."
        $irecovery -f pwnediBSS.dfu
    fi
    sleep 1
    patch_ibec
    log "Sending iBEC..."
    $irecovery -f pwnediBEC.dfu
    if [[ $device_pwnrec == 1 ]]; then
        $irecovery -c "go"
    fi
    sleep 3
    device_find_mode Recovery
    log "Dumping raw dump now"
    (echo -e "/send ../resources/payload\ngo blobs\n/exit") | $irecovery2 -s
    $irecovery2 -g dump.raw
    log "Rebooting device"
    $irecovery -n
    local raw
    local err
    shsh_convert_onboard $1
    err=$?
    if [[ $1 == "dump" ]]; then
        raw="../saved/shsh/rawdump_${device_ecid}-${device_type}_$(date +%Y-%m-%d-%H%M)_${shsh_onboard_iboot}.raw"
    else
        raw="../saved/shsh/rawdump_${device_ecid}-${device_type}-${device_target_vers}-${device_target_build}_$(date +%Y-%m-%d-%H%M)_${shsh_onboard_iboot}.raw"
    fi
    if [[ $1 == "dump" ]] || [[ $err != 0 && -s dump.raw ]]; then
        mv dump.raw $raw
        log "Raw dump saved at: $raw"
        warn "This raw dump is not usable for restoring, you need to convert it first."
        print "* If unable to be converted, this dump is likely not usable for restoring."
        print "* For the IPSW to download and use, see the raw dump iBoot version above"
        print "* Then go here to find the matching iOS version: https://theapplewiki.com/wiki/IBoot_(Bootloader)"
    fi
}

shsh_convert_onboard() {
    local shsh="../saved/shsh/${device_ecid}-${device_type}_$(date +%Y-%m-%d-%H%M).shsh"
    if (( device_proc < 7 )); then
        shsh="../saved/shsh/${device_ecid}-${device_type}-${device_target_vers}-${device_target_build}.shsh"
        # remove ibob for powdersn0w/dra downgraded devices. fixes unknown magic 69626f62
        local blob=$(xxd -p dump.raw | tr -d '\n')
        local bobi="626f6269"
        local blli="626c6c69"
        if [[ $blob == *"$bobi"* ]]; then
            log "Detected \"ibob\". Fixing... (This happens on DRA/powdersn0w downgraded devices)"
            rm -f dump.raw
            printf "%s" "${blob%"$bobi"*}${blli}${blob##*"$blli"}" | xxd -r -p > dump.raw
        fi
        shsh_onboard_iboot="$(cat dump.raw | strings | grep iBoot | head -1)"
        log "Raw dump iBoot version: $shsh_onboard_iboot"
        if [[ $1 == "dump" ]]; then
            return
        fi
        log "Converting raw dump to SHSH blob"
        "$dir/ticket" dump.raw dump.shsh "$ipsw_path.ipsw" -z
        log "Attempting to validate SHSH blob"
        "$dir/validate" dump.shsh "$ipsw_path.ipsw" -z
        if [[ $? != 0 ]]; then
            warn "Saved SHSH blobs might be invalid. Did you select the correct IPSW?"
        fi
    else
        "$dir/img4tool" --convert -s dump.shsh dump.raw
    fi
    if [[ ! -s dump.shsh ]]; then
        warn "Converting onboard SHSH blobs failed."
        return 1
    fi
    mv dump.shsh $shsh
    log "Successfully saved $device_target_vers blobs: $shsh"
}

shsh_save_cydia() {
    local json=$(curl "https://api.ipsw.me/v4/device/${device_type}?type=ipsw")
    local len=$(echo "$json" | $jq -r ".firmwares | length")
    local builds=()
    local i=0
    while (( i < len )); do
        builds+=($(echo "$json" | $jq -r ".firmwares[$i].buildid"))
        ((i++))
    done
    for build in ${builds[@]}; do
        if [[ $build == "10"* && $build != "10B329" && $build != "10B350" ]]; then
            continue
        fi
        printf "\n%s " "$build"
        $tsschecker -d $device_type -e $device_ecid --server-url "http://cydia.saurik.com/TSS/controller?action=2/" -s -g 0x1111111111111111 --buildid $build >/dev/null
        if [[ $(ls *$build* 2>/dev/null) ]]; then
            printf "saved"
            mv $(ls *$build*) ../saved/shsh/$device_ecid-$device_type-$build.shsh
        else
            printf "failed"
        fi
    done
    echo
}

menu_print_info() {
    if [[ $debug_mode != 1 ]]; then
        clear
    fi
    print " *** Legacy iOS Kit ***"
    print " - Script by LukeZGD -"
    echo
    if [[ -n $version_current ]]; then
        print "* Version: $version_current ($git_hash)"
    fi
    if [[ $no_version_check == 1 ]]; then
        warn "No version check flag detected, update check is disabled and no support will be provided."
    fi
    if [[ $git_hash_latest != "$git_hash" ]]; then
        warn "Current version is newer/different than remote: $version_latest ($git_hash_latest)"
    fi
    print "* Platform: $platform ($platform_ver - $platform_arch) $live_cdusb_str"
    echo
    print "* Device: $device_name (${device_type} - ${device_model}ap) in $device_mode mode"
    device_manufacturing
    if [[ $device_unactivated == 1 ]]; then
        print "* Device is not activated, select Attempt Activation to activate."
    fi
    if [[ -n $device_disable_bbupdate && $device_use_bb != 0 ]] && (( device_proc < 7 )); then
        warn "Disable bbupdate flag detected, baseband update is disabled. Proceed with caution"
        if [[ $device_deadbb == 1 ]]; then
            warn "dead-bb flag detected, baseband dump/stitching is disabled. Your device will not activate"
        else
            print "* Current device baseband will be dumped and stitched to custom IPSW"
            print "* Stitching is supported in these restores/downgrades: 8.4.1/6.1.3, Other (tethered or with SHSH), powdersn0w"
            warn "Note that stitching baseband does not always work! There is a chance of non-working baseband after the restore"
        fi
    elif [[ -n $device_disable_bbupdate ]]; then
        warn "Disable bbupdate flag detected, but this flag is not supported for this device"
    fi
    if [[ $device_actrec == 1 ]]; then
        warn "Activation records flag detected. Proceed with caution"
        print "* Stitching is supported in these restores/downgrades: 8.4.1/6.1.3, Other with SHSH, powdersn0w"
    fi
    if [[ $device_pwnrec == 1 ]]; then
        warn "Pwned recovery flag detected. Assuming device is in pwned recovery mode."
    elif [[ $device_skip_ibss == 1 ]]; then
        warn "Skip iBSS flag detected. Assuming device is in pwned iBSS mode."
    fi
    if [[ $ipsw_jailbreak == 1 ]]; then
        warn "Jailbreak flag detected. Jailbreak option enabled."
    fi
    if [[ $ipsw_gasgauge_patch ]]; then
        warn "gasgauge-patch flag detected. multipatch enabled."
        print "* This supports up to iOS 8.4.1 only. iOS 9 will not work"
    fi
    if [[ $ipsw_skip_first ]]; then
        warn "skip-first flag detected. Skipping first restore and flashing NOR IPSW only for powdersn0w 4.2.x and lower"
    fi
    if [[ -n $device_build ]]; then
        print "* iOS Version: $device_vers ($device_build)"
    else
        print "* iOS Version: $device_vers"
    fi
    if [[ $device_proc != 1 && $device_mode == "DFU" ]] && (( device_proc < 7 )); then
        print "* To get iOS version, go to: Other Utilities -> Get iOS Version"
    fi
    if [[ $device_proc != 1 ]]; then
        print "* ECID: $device_ecid"
    fi
    if [[ -n $device_pwnd ]]; then
        print "* Pwned: $device_pwnd"
    fi
    echo
}

menu_main() {
    local menu_items
    local selected
    local back
    while [[ -z "$mode" ]]; do
        menu_items=()
        menu_print_info
        print " > Main Menu"
        input "Select an option:"
        if [[ $device_mode != "none" ]]; then
            menu_items+=("Restore/Downgrade")
            if (( device_proc < 7 )); then
                menu_items+=("Jailbreak Device")
            fi
            if [[ $device_unactivated == 1 ]]; then
                menu_items+=("Attempt Activation")
            elif [[ $device_mode == "Recovery" ]]; then
                menu_items+=("Exit Recovery Mode")
            fi
            case $device_type in
                iPad2,[123] ) menu_items+=("FourThree Utility");;
            esac
        fi
        if [[ $device_proc != 1 && $device_type != "iPod2,1" ]]; then
            menu_items+=("Save SHSH Blobs")
        fi
        if [[ $device_mode == "Normal" ]]; then
            case $device_vers in
                [12].*  ) :;;
                [1289]* ) menu_items+=("Sideload IPA");;
            esac
            menu_items+=("App Management" "Data Management")
        fi
        menu_items+=("Other Utilities" "Exit")
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Restore/Downgrade" ) menu_restore;;
            "Jailbreak Device" ) mode="device_jailbreak";;
            "Save SHSH Blobs" ) menu_shsh;;
            "Sideload IPA" ) menu_ipa "$selected";;
            "App Management" ) menu_appmanage;;
            "Data Management" ) menu_datamanage;;
            "Other Utilities" ) menu_other;;
            "FourThree Utility" ) menu_fourthree;;
            "Attempt Activation" ) device_activate;;
            "Exit Recovery Mode" ) mode="exitrecovery";;
            "Exit" ) mode="exit";;
        esac
    done
}

menu_appmanage() {
    local menu_items
    local selected
    local back

    menu_print_info
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Install IPA (AppSync)" "List User Apps" "List System Apps" "List All Apps" "Go Back")
        print " > Main Menu > App Management"
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Install IPA (AppSync)" ) menu_ipa "$selected";;
            "List User Apps"   ) $ideviceinstaller list --user;;
            "List System Apps" ) $ideviceinstaller list --system;;
            "List All Apps"    ) $ideviceinstaller list --all;;
            "Go Back" ) back=1;;
        esac
    done
}

menu_datamanage() {
    local menu_items
    local selected
    local back

    menu_print_info
    print "* Note: For \"Raw File System\" your device must be jailbroken and have AFC2"
    print "*       For most jailbreaks, install \"Apple File Conduit 2\" in Cydia/Zebra/Sileo"
    print "* Note 2: The \"Erase All Content and Settings\" option works on iOS 9+ only"
    print "* Note 3: Limited support for backups. Better use iCloud Backups instead"
    print "* Note 4: Backups do not include apps. Only some app data and settings"
    print "* For dumping apps, go to: https://www.reddit.com/r/LegacyJailbreak/wiki/guides/crackingapps"
    if [[ -z $ifuse ]]; then
        warn "ifuse not installed. Mount Device will not work. Install ifuse in Homebrew/MacPorts or your package manager to fix this"
    fi
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Backup" "Restore" "Mount Device" "Mount Device (Raw File System)" "Unmount Device" "Connect to SSH" "Erase All Content and Settings" "Go Back")
        echo
        print " > Main Menu > Data Management"
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Go Back" ) back=1;;
            *"ount"*  ) :;;
            * ) device_pair;;
        esac
        case $selected in
            "Backup"  ) mode="device_backup_create";;
            "Restore" ) menu_backup_restore;;
            "Erase All Content and Settings" ) mode="device_erase";;
            "Mount Device" ) mkdir ../mount 2>/dev/null; $ifuse ../mount; log "Device (Media) should now be mounted on mount folder";;
            "Mount Device (Raw File System)" ) mkdir ../mount 2>/dev/null; $ifuse --root ../mount; log "Device (root) should now be mounted on mount folder";;
            "Unmount Device" ) log "Attempting to umount device from mount folder"; umount ../mount;;
            "Connect to SSH" ) mode="device_ssh";;
        esac
    done
}

menu_backup_restore() {
    local menu_items
    local selected
    local back

    while [[ -z "$mode" && -z "$back" ]]; do
        menu_print_info
        local backupdir="../saved/backups/${device_ecid}_${device_type}"
        if [[ ! -d $backupdir ]]; then
            mkdir -p $backupdir
        fi
        local backups=($(ls $backupdir 2>/dev/null))
        if [[ -z "${backups[*]}" ]]; then
            print "* No backups (saved/backups)"
        else
            print "* Backups list (saved/backups):"
            for b in "${backups[@]}"; do
                menu_items+=("$(basename $b)")
            done
        fi
        menu_items+=("Go Back")
        echo
        print " > Main Menu > Data Management > Restore"
        input "Select option to restore:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Go Back" ) back=1;;
            * ) device_backup="$selected"; mode="device_backup_restore";;
        esac
    done
}

menu_fourthree() {
    local menu_items
    local selected
    local back

    ipa_path=
    ipsw_fourthree=
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Step 1: Restore" "Step 2: Partition" "Step 3: OS Install")
        if [[ $device_mode == "Normal" ]]; then
            menu_items+=("Reinstall App" "Boot iOS 4.3.x")
        fi
        menu_items+=("Go Back")
        menu_print_info
        print "* FourThree Utility: Dualboot iPad 2 to iOS 4.3.x"
        print "* This is a 3 step process for the device. Follow through the steps to successfully set up a dualboot."
        print "* Read the README here: https://github.com/LukeZGD/FourThree-iPad2"
        if [[ $device_type != "iPad2,1" ]]; then
            warn "FourThree is known to have issues with cellular iPad 2 devices."
        fi
        echo
        print " > Main Menu > FourThree Utility"
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Step 1: Restore" ) ipsw_fourthree=1; menu_ipsw "iOS 6.1.3" "fourthree";;
            "Step 2: Partition" ) mode="device_fourthree_step2";;
            "Step 3: OS Install" ) mode="device_fourthree_step3";;
            "Reinstall App" ) mode="device_fourthree_app";;
            "Boot iOS 4.3.x" ) mode="device_fourthree_boot";;
            "Go Back" ) back=1;;
        esac
    done
}

menu_ipa() {
    local menu_items
    local selected
    local back

    ipa_path=
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Select IPA")
        menu_print_info
        if [[ $1 == "Install"* ]]; then
            print "* Make sure that AppSync Unified (iOS 5+) is installed on your device."
        else
            print "* Sideload IPA is for iOS 9 and newer only. Sideloading will require an Apple ID."
            print "* Your Apple ID and password will only be sent to Apple servers."
            print "* Make sure that the device is activated and connected to the Internet."
            print "* There is also the option to use Dadoum Sideloader: https://github.com/Dadoum/Sideloader"
            print "* If you have AppSync installed, go to App Management -> Install IPA (AppSync) instead."
            if [[ $platform == "macos" ]]; then
                echo
                warn "\"Sideload IPA\" is currently not supported on macOS."
                print "* Use Sideloadly or AltServer instead for this."
                print "* You also might be looking for the \"Install IPA (AppSync)\" option instead."
                pause
                break
            fi
        fi
        echo
        if [[ -n $ipa_path ]]; then
            print "* Selected IPA: $ipa_path"
            menu_items+=("Install IPA")
        elif [[ $1 == "Install"* ]]; then
            print "* Select IPA files to install (multiple selection)"
        else
            print "* Select IPA file to install (or select Use Dadoum Sideloader)"
            menu_items+=("Use Dadoum Sideloader")
        fi
        menu_items+=("Go Back")
        echo
        print " > Main Menu > $1"
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Select IPA" ) menu_ipa_browse;;
            "Install IPA" )
                if [[ $1 == "Install"* ]]; then
                    mode="device_ideviceinstaller"
                else
                    mode="device_altserver"
                fi
            ;;
            "Use Dadoum Sideloader" )
                local arch="$platform_arch"
                local sideloader="sideloader-gtk-"
                case $arch in
                    "armhf" )
                        warn "Dadoum Sideloader does not support armhf/armv7. arm64 or x86_64 only."
                        pause
                        continue
                    ;;
                    "arm64" ) arch="aarch64";;
                esac
                sideloader+="$arch-linux-gnu"
                log "Checking for latest Sideloader"
                local latest="$(curl https://api.github.com/repos/Dadoum/Sideloader/releases | $jq -r ".[0].tag_name")"
                local current="$(cat ../saved/Sideloader_version 2>/dev/null || echo "none")"
                log "Latest version: $latest, current version: $current"
                if [[ $current != "$latest" ]]; then
                    rm -f ../saved/$sideloader
                fi
                if [[ ! -e ../saved/$sideloader ]]; then
                    download_file https://github.com/Dadoum/Sideloader/releases/download/$latest/$sideloader.zip $sideloader.zip
                    unzip -o -j $sideloader.zip $sideloader -d ../saved
                fi
                echo "$latest" > ../saved/Sideloader_version
                device_pair
                log "Launching Dadoum Sideloader"
                chmod +x ../saved/$sideloader
                ../saved/$sideloader
            ;;
            "Go Back" ) back=1;;
        esac
    done
}

menu_zenity_check() {
    if [[ $platform == "linux" && ! $(command -v zenity) ]]; then
        warn "zenity not found in PATH. Install zenity to have a working file picker."
    fi
}

menu_ipa_browse() {
    local newpath
    input "Select your IPA file(s) in the file selection window."
    if [[ $mac_cocoa == 1 ]]; then
        newpath="$($cocoadialog fileselect --with-extensions ipa)"
    else
        menu_zenity_check
        newpath="$($zenity --file-selection --multiple --file-filter='IPA | *.ipa' --title="Select IPA file(s)")"
    fi
    [[ -z "$newpath" ]] && read -p "$(input "Enter path to IPA file (or press Ctrl+C to cancel): ")" newpath
    ipa_path="$newpath"
}

menu_shsh() {
    local menu_items
    local selected
    local back

    device_target_vers=
    device_target_build=
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=()
        case $device_type in
            iPad4,[12345] | iPhone6,[12] )
                menu_items+=("iOS 10.3.3");;
            iPad[23]* | iPhone4,1 | iPhone5,[12] | iPod5,1 )
                menu_items+=("iOS 8.4.1");;
        esac
        case $device_type in
            iPad2,[123] | iPhone4,1 )
                menu_items+=("iOS 6.1.3");;
        esac
        if (( device_proc < 7 )); then
            menu_items+=("Cydia Blobs")
        fi
        if [[ $device_mode != "none" ]]; then
            menu_items+=("Onboard Blobs")
            if (( device_proc < 7 )); then
                menu_items+=("Onboard Blobs (Raw Dump)")
            fi
        fi
        menu_items+=("Convert Raw Dump" "Go Back")
        menu_print_info
        if [[ $device_mode != "none" && $device_proc == 4 ]]; then
            warn "Dumping onboard blobs might not work for this device, proceed with caution"
            print "* Legacy iOS Kit only fully supports dumping onboard blobs for A5(X) and A6(X) devices and newer"
            echo
        fi
        print " > Main Menu > Save SHSH Blobs"
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "iOS 10.3.3" )
                device_target_vers="10.3.3"
                device_target_build="14G60"
            ;;
            "iOS 8.4.1" )
                device_target_vers="8.4.1"
                device_target_build="12H321"
            ;;
            "iOS 6.1.3" )
                device_target_vers="6.1.3"
                device_target_build="10B329"
            ;;
        esac
        case $selected in
            "iOS"* ) mode="save-ota-blobs";;
            "Onboard Blobs" ) menu_shsh_onboard;;
            "Onboard Blobs (Raw Dump)" ) mode="save-onboard-dump";;
            "Cydia Blobs" ) mode="save-cydia-blobs";;
            "Convert Raw Dump" ) menu_shsh_convert;;
            "Go Back" ) back=1;;
        esac
    done
}

menu_shsh_onboard() {
    local menu_items
    local selected
    local back

    ipsw_path=
    if (( device_proc >= 7 )); then
        mode="save-onboard-blobs"
    fi
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Select IPSW")
        menu_print_info
        if [[ $device_mode != "none" && $device_proc == 4 ]]; then
            warn "Dumping onboard blobs might not work for this device, proceed with caution"
            print "* Legacy iOS Kit only fully supports dumping onboard blobs for A5(X) and A6(X) devices and newer"
            echo
        fi
        if [[ -n $ipsw_path ]]; then
            print "* Selected IPSW: $ipsw_path.ipsw"
            print "* IPSW Version: $device_target_vers-$device_target_build"
            if [[ $device_mode == "Normal" && $device_target_vers != "$device_vers" ]]; then
                warn "Selected IPSW does not seem to match the current version."
                if (( device_proc < 7 )); then
                    print "* Ignore this warning if this is a DRA/powdersn0w downgraded device."
                fi
            fi
            menu_items+=("Save Onboard Blobs")
        else
            print "* Select IPSW of your current iOS version to continue"
        fi
        menu_items+=("Go Back")
        echo
        print " > Main Menu > Save SHSH Blobs > Onboard Blobs"
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Select IPSW" ) menu_ipsw_browse;;
            "Save Onboard Blobs" ) mode="save-onboard-blobs";;
            "Go Back" ) back=1;;
        esac
    done
}

menu_shsh_convert() {
    local menu_items
    local selected
    local back

    ipsw_path=
    shsh_path=
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Select Raw Dump")
        menu_print_info
        if [[ -n $shsh_path ]]; then
            print "* Selected dump: $shsh_path"
            if (( device_proc < 7 )); then
                shsh_onboard_iboot="$(cat "$shsh_path" | strings | grep iBoot | head -1)"
                print "* Raw dump iBoot version: $shsh_onboard_iboot"
                print "* Go here to find the matching iOS version: https://theapplewiki.com/wiki/IBoot_(Bootloader)"
                menu_items+=("Select IPSW")
            else
                menu_items+=("Convert Raw Dump")
            fi
        else
            print "* Select raw dump file to continue"
        fi
        if [[ -n $ipsw_path ]]; then
            echo
            print "* Selected IPSW: $ipsw_path.ipsw"
            print "* IPSW Version: $device_target_vers-$device_target_build"
            menu_items+=("Convert Raw Dump")
        elif (( device_proc < 7 )); then
            echo
            print "* Select IPSW of the raw dump's iOS version to continue"
        fi
        menu_items+=("Go Back")
        echo
        print " > Main Menu > Save SHSH Blobs > Convert Raw Dump"
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Select IPSW" ) menu_ipsw_browse;;
            "Select Raw Dump" ) menu_shshdump_browse;;
            "Convert Raw Dump" ) mode="convert-onboard-blobs";;
            "Go Back" ) back=1;;
        esac
    done
}

menu_restore() {
    local menu_items
    local selected
    local back

    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=()
        case $device_type in
            iPad4,[12345] | iPhone6,[12] )
                menu_items+=("iOS 10.3.3");;
            iPad2,[1234567] | iPad3,[123456] | iPhone4,1 | iPhone5,[12] | iPod5,1 )
                menu_items+=("iOS 8.4.1");;
        esac
        case $device_type in
            iPad2,[123] | iPhone4,1 )
                menu_items+=("iOS 6.1.3");;
            iPhone2,1 )
                menu_items+=("5.1.1" "4.3.3" "4.1" "3.1.3" "More versions");;
            iPod3,1 )
                menu_items+=("4.1");;
            iPhone1,2 | iPod2,1 )
                menu_items+=("4.1" "3.1.3");;
        esac
        case $device_type in
            iPhone3,[13] | iPad1,1 | iPod3,1 )
                menu_items+=("powdersn0w (any iOS)");;
        esac
        if [[ $device_type == "iPhone1,2" ]]; then
            : # dont show 4.2.1 option for 3g
        elif (( device_proc < 7 )); then
            menu_items+=("Latest iOS ($device_latest_vers)")
        elif [[ $platform == "linux" ]]; then
            if (( device_proc > 10 )); then
                menu_items+=("Latest iOS")
            else
                menu_items+=("Latest iOS ($device_latest_vers)")
            fi
        fi
        case $device_type in
            iPhone4,1 | iPhone5,[1234] | iPad2,4 | iPod5,1 )
                local text2="7.1.x"
                case $device_type in
                    iPhone5,[1234] ) text2="7.x";;
                esac
                menu_items+=("Other (powdersn0w $text2 blobs)")
            ;;
            iPhone1,[12] | iPhone2,1 | iPhone3,[23] | iPad1,1 | iPod[1234],1 )
                if [[ -z $1 ]]; then
                    menu_items+=("Other (Custom IPSW)")
                fi
            ;;
        esac
        if [[ $device_proc != 1 ]]; then
            if [[ $device_type != "iPod2,1" ]] && (( device_proc <= 10 )); then
                menu_items+=("Other (Use SHSH Blobs)")
            fi
            if (( device_proc >= 7 )) && (( device_proc <= 10 )); then
                menu_items+=("Set Nonce Only")
            elif [[ $device_proc == 5 || $device_proc == 6 ]]; then
                menu_items+=("Other (Tethered)")
            fi
            case $device_type in
                iPhone3,[23] | iPod[34],1 ) menu_items+=("Other (Tethered)");;
            esac
            if (( device_proc < 7 )); then
                menu_items+=("DFU IPSW")
            fi
        fi
        menu_items+=("IPSW Downloader" "Go Back")
        menu_print_info
        if [[ $1 == "ipsw" ]]; then
            print " > Main Menu > Other Utilities > Create Custom IPSW"
        else
            print " > Main Menu > Restore/Downgrade"
        fi
        if [[ -z $1 ]]; then
            if [[ $device_proc == 1 ]]; then
                print "* Select \"Other (Custom IPSW)\" to restore to other iOS versions (2.0 to 3.1.2)"
                echo
            fi
            if [[ $device_type == "iPod2,1" ]]; then
                print "* Select \"Other (Custom IPSW)\" to restore to other iOS versions (2.1.1 to 3.0)"
                echo
            fi
            if [[ $device_type == "iPod2,1" || $device_type == "iPhone2,1" ]] && [[ $device_newbr != 0 ]]; then
                print "* New bootrom devices might be incompatible with older iOS versions"
                echo
            fi
        fi
        case $device_type in
            iPad2,4      ) print "* iPad2,4 does not support 6.1.3 downgrades, you need blobs for 6.1.3 or 7.1.x"; echo;;
            iPhone5,[34] ) print "* iPhone 5C does not support 8.4.1 downgrades, you need blobs for 8.4.1 or 7.x"; echo;;
            iPhone3,2    ) print "* iPhone3,2 does not support downgrades with powdersn0w"; echo;;
            iPod4,1      ) print "* iPod touch 4 does not support any untethered downgrades without blobs"; echo;;
        esac
        if [[ $platform == "macos" ]] && (( device_proc >= 7 )); then
            print "* Note: Restoring to latest iOS for 64-bit devices is not supported on macOS, use iTunes/Finder instead for that"
            if [[ $mac_cocoa == 1 ]]; then
                warn "Restoring 64-bit devices is broken on OS X 10.11 El Capitan. Use macOS 10.12 Sierra or newer for this."
                pause
                break
            fi
            echo
        fi
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "" ) :;;
            "Go Back" ) back=1;;
            "Other (Custom IPSW)" ) mode="customipsw";;
            "DFU IPSW" ) mode="dfuipsw${1}";;
            "More versions" ) menu_restore_more "$1";;
            "Latest iOS" ) mode="restore-latest";;
            "IPSW Downloader" ) menu_ipsw_downloader "$1";;
            * ) menu_ipsw "$selected" "$1";;
        esac
    done
}

menu_ipsw_downloader() {
    local menu_items
    local selected
    local back
    local vers

    while [[ -z "$back" ]]; do
        menu_items=("Enter Build Version")
        if [[ -n $vers ]]; then
            menu_items+=("Start Download")
        fi
        menu_items+=("Go Back")
        menu_print_info
        if [[ $1 == "ipsw" ]]; then
            print " > Main Menu > Other Utilities > Create Custom IPSW > IPSW Downloader"
        else
            print " > Main Menu > Restore/Downgrade > IPSW Downloader"
        fi
        print "* To know more about build version, go here: https://theapplewiki.com/wiki/Firmware"
        if [[ -n $vers ]]; then
            print "* Build Version entered: $vers"
        else
            print "* Enter build version to continue"
        fi
        echo
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Enter Build Version" )
                print "* Enter the build version of the IPSW you want to download."
                device_enter_build
                vers="$device_rd_build"
            ;;
            "Start Download" )
                device_target_build="$vers"
                ipsw_download
                log "IPSW downloading is done"
                pause
            ;;
            "Go Back" ) back=1;;
        esac
    done
}

menu_restore_more() {
    local menu_items
    local selected
    local back

    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=()
        case $device_type in
            iPhone2,1 )
                menu_items+=("6.1.3" "6.1.2" "6.1" "6.0.1" "6.0" "5.1" "5.0.1" "5.0")
                menu_items+=("4.3.5" "4.3.4" "4.3.2" "4.3.1" "4.3" "4.2.1")
                menu_items+=("4.0.2" "4.0.1" "4.0" "3.1.2" "3.1" "3.0.1" "3.0")
            ;;
            iPod2,1 ) menu_items+=("4.0.2" "4.0" "3.1.2" "3.1.1");;
        esac
        menu_items+=("Go Back")
        menu_print_info
        if [[ $1 == "ipsw" ]]; then
            print " > Main Menu > Other Utilities > Create Custom IPSW"
        else
            print " > Main Menu > Restore/Downgrade"
        fi
        if [[ -z $1 && $device_type == "iPod2,1" && $device_newbr != 0 ]]; then
            warn "These versions are for old bootrom devices only. They may not work on your device"
            echo
        elif [[ $device_type == "iPod2,1" ]]; then
            warn "These versions might not restore/boot properly"
            echo
        fi
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "" ) :;;
            "Go Back" ) back=1;;
            * ) menu_ipsw "$selected" "$1";;
        esac
    done
}

ipsw_latest_set() {
    local newpath
    case $device_type in
        iPad3,[456]    ) newpath="iPad_32bit";;
        iPad4,[123456] ) newpath="iPad_64bit";;
        iPad6,[34]     ) newpath="iPadPro_9.7";;
        iPad6,[78]     ) newpath="iPadPro_12.9";;
        iPad6,1[12]    ) newpath="iPad_64bit_TouchID_ASTC";;
        iPhone5,[1234] ) newpath="iPhone_4.0_32bit";;
        iPhone10,[36]  ) newpath="iPhone10,3,iPhone10,6";;
        iPod[79],1     ) newpath="iPodtouch";;
        iPad4,[789] | iPad5*     ) newpath="iPad_64bit_TouchID";;
        iPhone6,[12] | iPhone8,4 ) newpath="iPhone_4.0_64bit";;
        iPhone7,1 | iPhone8,2    ) newpath="iPhone_5.5";;
        iPhone7,2 | iPhone8,1    ) newpath="iPhone_4.7";;
        iPhone9,[13] | iPhone10,[14] ) newpath="iPhone_4.7_P3";;
        iPhone9,[24] | iPhone10,[25] ) newpath="iPhone_5.5_P3";;
        * ) newpath="${device_type}";;
    esac
    device_type2="$newpath"
    newpath+="_${device_target_vers}_${device_target_build}"
    ipsw_custom_set $newpath
    ipsw_dfuipsw="../${newpath}_DFUIPSW"
    newpath+="_Restore"
    ipsw_latest_path="$newpath"
}

ipsw_hwmodel_set() {
    local hwmodel
    case $device_type in
        iPhone5,[12] ) hwmodel="iphone5";;
        iPhone5,[34] ) hwmodel="iphone5b";;
        iPad3,[456] ) hwmodel="ipad3b";;
        iPhone6*    ) hwmodel="iphone6";;
        iPhone7*    ) hwmodel="iphone7";;
        iPhone8,4   ) hwmodel="iphone8b";;
        iPhone8*    ) hwmodel="iphone8";;
        iPhone9*    ) hwmodel="iphone9";;
        iPad4,[123] ) hwmodel="ipad4";;
        iPad4,[456] ) hwmodel="ipad4b";;
        iPad4,[789] ) hwmodel="ipad4bm";;
        iPad5,[12]  ) hwmodel="ipad5";;
        iPad5,[34]  ) hwmodel="ipad5b";;
        iPad6,[34]  ) hwmodel="ipad6b";;
        iPad6,[78]  ) hwmodel="ipad6d";;
        *           ) hwmodel="$device_model";;
    esac
    ipsw_hwmodel="$hwmodel"
}

menu_ipsw() {
    local menu_items
    local selected
    local back
    local newpath
    local nav
    local start

    if [[ $2 == "ipsw" ]]; then
        nav=" > Main Menu > Other Utilities > Create Custom IPSW > $1"
        start="Create IPSW"
    elif [[ $2 == "fourthree" ]]; then
        nav=" > Main Menu > FourThree Utility > Step 1: Restore"
        start="Start Restore"
    elif [[ $1 == "Set Nonce Only" ]]; then
        nav=" > Main Menu > Restore/Downgrade > $1"
        start="Set Nonce"
        device_target_setnonce=1
    else
        nav=" > Main Menu > Restore/Downgrade > $1"
        start="Start Restore"
    fi

    ipsw_cancustomlogo=
    ipsw_cancustomlogo2=
    ipsw_customlogo=
    ipsw_customrecovery=
    ipsw_path=
    ipsw_base_path=
    shsh_path=
    device_target_vers=
    device_target_build=
    device_base_vers=
    device_base_build=
    device_target_other=
    device_target_powder=
    device_target_tethered=

    while [[ -z "$mode" && -z "$back" ]]; do
        case $1 in
            "iOS 10.3.3" )
                device_target_vers="10.3.3"
                device_target_build="14G60"
            ;;
            "iOS 8.4.1" )
                device_target_vers="8.4.1"
                device_target_build="12H321"
            ;;
            "iOS 6.1.3" )
                device_target_vers="6.1.3"
                device_target_build="10B329"
            ;;
            "Latest iOS"* )
                device_target_vers="$device_latest_vers"
                device_target_build="$device_latest_build"
                case $device_latest_vers in
                    [643]* ) ipsw_canhacktivate=1;;
                esac
            ;;
            [6543]* )
                device_target_vers="$1"
                if [[ $device_target_vers != "3.0"* ]]; then
                    ipsw_canhacktivate=1
                fi
                if [[ $device_type == "iPhone2,1" && $1 != "4.1" ]]; then
                    ipsw_cancustomlogo=1
                fi
            ;;
        esac
        if [[ $device_type != "iPhone"* ]]; then
            ipsw_canhacktivate=
        fi
        if [[ $device_proc == 1 ]]; then
            ipsw_cancustomlogo=1
        fi
        case $1 in
            "6.1.3" ) device_target_build="10B329";;
            "6.1.2" ) device_target_build="10B146";;
            "6.1"   ) device_target_build="10B141";;
            "6.0.1" ) device_target_build="10A523";;
            "6.0"   ) device_target_build="10A403";;
            "5.1.1" ) device_target_build="9B206";;
            "5.1"   ) device_target_build="9B176";;
            "5.0.1" ) device_target_build="9A405";;
            "5.0"   ) device_target_build="9A334";;
            "4.3.5" ) device_target_build="8L1";;
            "4.3.4" ) device_target_build="8K2";;
            "4.3.3" ) device_target_build="8J2";;
            "4.3.2" ) device_target_build="8H7";;
            "4.3.1" ) device_target_build="8G4";;
            "4.3"   ) device_target_build="8F190";;
            "4.2.1" )
                device_target_build="8C148"
                if [[ $device_type == "iPhone2,1" ]]; then
                    device_target_build+="a"
                fi
            ;;
            "4.1"   ) device_target_build="8B117";;
            "4.0.2" ) device_target_build="8A400";;
            "4.0.1" ) device_target_build="8A306";;
            "4.0"   ) device_target_build="8A293";;
            "3.1.3" ) device_target_build="7E18";;
            "3.1.2" ) device_target_build="7D11";;
            "3.1.1" ) device_target_build="7C145";;
            "3.1"   ) device_target_build="7C144";;
            "3.0.1" ) device_target_build="7A400";;
            "3.0"   ) device_target_build="7A341";;
        esac
        if [[ $device_target_vers == "$device_latest_vers" ]]; then
            ipsw_latest_set
            newpath="$ipsw_latest_path"
        else
            case $device_type in
                iPad4,[12345] ) newpath="iPad_64bit";;
                iPhone6,[12]  ) newpath="iPhone_4.0_64bit";;
                * ) newpath="${device_type}";;
            esac
            newpath+="_${device_target_vers}_${device_target_build}"
            ipsw_custom_set $newpath
            newpath+="_Restore"
        fi
        if [[ $1 == "Other (Use SHSH Blobs)" || $1 == "Set Nonce Only" ]]; then
            device_target_other=1
            if [[ $device_type == "iPhone2,1" ]]; then
                ipsw_canhacktivate=1
            fi
        elif [[ $1 == *"powdersn0w"* ]]; then
            device_target_powder=1
        elif [[ $1 == *"Tethered"* ]]; then
            device_target_tethered=1
        elif [[ -n $device_target_vers && -e "../$newpath.ipsw" ]]; then
            ipsw_verify "../$newpath" "$device_target_build" nopause
            if [[ $? == 0 ]]; then
                ipsw_path="../$newpath"
            fi
        fi

        menu_items=("Select Target IPSW")
        menu_print_info
        print "* Only select unmodified IPSW for the selection. Do not select custom IPSWs"
        echo
        if [[ $1 == *"powdersn0w"* ]]; then
            menu_items+=("Select Base IPSW")
            if [[ -n $ipsw_path ]]; then
                print "* Selected Target IPSW: $ipsw_path.ipsw"
                print "* Target Version: $device_target_vers-$device_target_build"
                ipsw_print_warnings powder
                ipsw_cancustomlogo2=
                case $device_target_vers in
                    [456]* ) ipsw_cancustomlogo2=1;;
                esac
            else
                print "* Select Target IPSW to continue"
                local lo
                local hi
                case $device_type in
                    iPhone3,1 ) lo=4.0; hi=7.1.1;;
                    iPhone3,3 ) lo=5.0; hi=7.1.1;;
                    iPhone4,1 | iPad2,[123]    ) lo=5.0; hi=9.3.5;;
                    iPad2,4 | iPad3,[123]      ) lo=5.1; hi=9.3.5;;
                    iPhone5,[12] | iPad3,[456] ) lo=6.0; hi=9.3.5;;
                    iPhone5,[34] ) lo=7.0; hi=9.3.5;;
                    iPad1,1 ) lo=3.2; hi=5.1;;
                    iPod3,1 ) lo=4.0; hi=5.1;;
                esac
                print "* Any iOS version from $lo to $hi is supported"
            fi
            echo
            local text2="(iOS 7.1.x)"
            case $device_type in
                iPhone3,[13] ) text2="(iOS 7.1.2)";;
                iPhone5,[1234] ) text2="(iOS 7.x)";;
                iPad3,[456] ) text2="(iOS 7.0.x)";;
                iPad1,1 | iPod3,1 ) text2="(iOS 5.1.1)";;
            esac
            if [[ -n $ipsw_base_path ]]; then
                print "* Selected Base $text2 IPSW: $ipsw_base_path.ipsw"
                print "* Base Version: $device_base_vers-$device_base_build"
                if [[ $ipsw_base_validate == 0 ]]; then
                    print "* Selected Base IPSW is validated"
                else
                    warn "Selected Base IPSW failed validation, proceed with caution"
                fi
                if [[ $device_proc != 4 ]]; then
                    menu_items+=("Select Base SHSH")
                fi
                echo
            else
                print "* Select Base $text2 IPSW to continue"
                echo
            fi
            if [[ $device_proc == 4 ]]; then
                shsh_path=1
            else
                if [[ -n $shsh_path ]]; then
                    print "* Selected Base $text2 SHSH: $shsh_path"
                    if [[ $shsh_validate == 0 ]]; then
                        print "* Selected SHSH file is validated"
                    else
                        warn "Selected SHSH file failed validation, proceed with caution"
                        if (( device_proc < 5 )); then
                            warn "Validation might be a false negative for A4 and older devices."
                        fi
                        echo
                    fi
                elif [[ $2 != "ipsw" ]]; then
                    print "* Select Base $text2 SHSH to continue"
                    echo
                fi
            fi
            if [[ -n $ipsw_path && -n $ipsw_base_path ]] && [[ -n $shsh_path || $2 == "ipsw" ]]; then
                menu_items+=("$start")
            fi

        elif [[ $2 == "fourthree" ]]; then
            menu_items+=("Download Target IPSW" "Select Base IPSW")
            if [[ -n $ipsw_path ]]; then
                print "* Selected Target (iOS 6.1.3) IPSW: $ipsw_path.ipsw"
                ipsw_print_warnings
            else
                print "* Select Target (iOS 6.1.3) IPSW to continue"
            fi
            echo
            if [[ -n $ipsw_base_path ]]; then
                print "* Selected Base (iOS 4.3.x) IPSW: $ipsw_base_path.ipsw"
                print "* Base Version: $device_base_vers-$device_base_build"
                if [[ $ipsw_base_validate == 0 ]]; then
                    print "* Selected Base IPSW is validated"
                else
                    warn "Selected Base IPSW failed validation, proceed with caution"
                fi
                echo
            else
                print "* Select Base (iOS 4.3.x) IPSW to continue"
                echo
            fi
            if [[ -n $ipsw_path && -n $ipsw_base_path ]]; then
                menu_items+=("$start")
            fi

        elif [[ $1 == *"Tethered"* ]]; then
            if [[ -n $ipsw_path ]]; then
                print "* Selected Target IPSW: $ipsw_path.ipsw"
                print "* Target Version: $device_target_vers-$device_target_build"
                ipsw_print_warnings
            else
                print "* Select Target IPSW to continue"
            fi
            warn "This is a tethered downgrade. Not recommended unless you know what you are doing."
            print "* For more info, go to: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Restore-Downgrade and read the \"Other (Tethered)\" section"
            if [[ -n $ipsw_path ]]; then
                menu_items+=("$start")
            fi
            echo

        elif [[ $1 == "Other"* || $1 == "Set Nonce Only" ]]; then
            # menu for other (shsh) restores
            if [[ -n $ipsw_path ]]; then
                print "* Selected Target IPSW: $ipsw_path.ipsw"
                print "* Target Version: $device_target_vers-$device_target_build"
                ipsw_print_warnings
                menu_items+=("Select Target SHSH")
            else
                print "* Select Target IPSW to continue"
            fi
            if (( device_proc > 6 )); then
                print "* Check the SEP/BB compatibility chart: https://docs.google.com/spreadsheets/d/1Mb1UNm6g3yvdQD67M413GYSaJ4uoNhLgpkc7YKi3LBs"
            fi
            echo
            if [[ -n $shsh_path ]]; then
                print "* Selected Target SHSH: $shsh_path"
                if (( device_proc > 6 )); then
                    shsh_generator=$(cat "$shsh_path" | grep "<string>0x" | cut -c10-27)
                    print "* Generator: $shsh_generator"
                fi
                if [[ $shsh_validate == 0 ]]; then
                    print "* Selected SHSH file is validated"
                else
                    warn "Selected SHSH file failed validation, proceed with caution"
                    if (( device_proc >= 7 )); then
                        print "* If this is an OTA/onboard/factory blob, it may be fine to use for restoring"
                    elif (( device_proc < 5 )); then
                        warn "Validation might be a false negative for A4 and older devices."
                    fi
                    echo
                fi
                if (( device_proc >= 7 )); then
                    print "* Note: For OTA/onboard/factory blobs, try enabling the skip-blob flag"
                fi
                echo

            elif [[ $2 != "ipsw" ]]; then
                print "* Select Target SHSH to continue"
                echo
            fi
            if [[ -n $ipsw_path ]] && [[ -n $shsh_path || $2 == "ipsw" ]]; then
                menu_items+=("$start")
            fi

        else
            # menu for ota/latest versions
            menu_items+=("Download Target IPSW")
            if [[ -n $ipsw_path ]]; then
                print "* Selected Target IPSW: $ipsw_path.ipsw"
                ipsw_print_warnings
                menu_items+=("$start")
            elif [[ $device_proc == 1 && $device_type != "iPhone1,2" ]]; then
                menu_items+=("$start")
            else
                print "* Select $1 IPSW to continue"
            fi
            if [[ $ipsw_canhacktivate == 1 ]] && [[ $device_type == "iPhone2,1" || $device_proc == 1 ]]; then
                print "* Hacktivation is supported for this restore"
            fi
            if [[ $device_latest_vers == "18"* ]]; then
                warn "Restoring to iOS 18 or newer is not supported. Try using pymobiledevice3 instead for that"
                pause
                return
            fi
            echo
        fi

        if [[ $ipsw_cancustomlogo2 == 1 ]]; then
            print "* You can select your own custom Apple logo image. This is optional and an experimental option"
            print "* Note: The images must be in PNG format, and up to 320x480 resolution only"
            print "* Note 2: The custom images might not work, current support is spotty"
            if [[ -n $ipsw_customlogo ]]; then
                print "* Custom Apple logo: $ipsw_customlogo"
            else
                print "* No custom Apple logo selected"
            fi
            menu_items+=("Select Apple Logo")
            echo
        elif [[ $ipsw_cancustomlogo == 1 ]]; then
            print "* You can select your own custom logo and recovery image. This is optional and an experimental option"
            print "* Note: The images must be in PNG format, and up to 320x480 resolution only"
            print "* Note 2: The custom images might not work, current support is spotty"
            if [[ -n $ipsw_customlogo ]]; then
                print "* Custom Apple logo: $ipsw_customlogo"
            else
                print "* No custom Apple logo selected"
            fi
            if [[ -n $ipsw_customrecovery ]]; then
                print "* Custom recovery logo: $ipsw_customrecovery"
            else
                print "* No custom recovery logo selected"
            fi
            menu_items+=("Select Apple Logo" "Select Recovery Logo")
            echo
        fi
        menu_items+=("Go Back")

        if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]] &&
           (( device_proc > 4 )) && (( device_proc < 7 )); then
            print "* This restore will use $device_use_vers baseband"
            echo
        elif [[ $device_use_bb2 == 1 ]]; then
            if [[ $device_target_vers == "$device_latest_vers" ]]; then
                print "* This restore will use $device_use_vers baseband if the jailbreak option is disabled"
                echo
            elif [[ $device_proc == 1 || $device_target_vers == "4.1" ]] && [[ $device_type != "iPhone3"* ]]; then
                print "* This restore will have baseband update disabled if the jailbreak option is enabled"
                echo
            else
                print "* This restore will have baseband update disabled"
                echo
            fi
        elif [[ $device_use_bb2 == 2 ]]; then
            if [[ $device_target_vers == "$device_latest_vers" ]]; then
                print "* This restore will use $device_use_vers baseband"
                echo
            else
                print "* This restore will have baseband update disabled"
                echo
            fi
        fi

        print "$nav"
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Create IPSW" ) mode="custom-ipsw";;
            "$start" ) mode="downgrade";;
            "Select Target IPSW" ) menu_ipsw_browse "$1";;
            "Select Base IPSW" ) menu_ipsw_browse "base";;
            "Select Target SHSH" ) menu_shsh_browse "$1";;
            "Select Base SHSH" ) menu_shsh_browse "base";;
            "Download Target IPSW" ) ipsw_download "../$newpath";;
            "Select Apple Logo" ) menu_logo_browse "boot";;
            "Select Recovery Logo" ) menu_logo_browse "recovery";;
            "Go Back" ) back=1;;
        esac
    done
}

ipsw_print_warnings() {
    if [[ $ipsw_validate == 0 ]]; then
        print "* Selected Target IPSW is validated"
    else
        warn "Selected Target IPSW failed validation, proceed with caution"
    fi
    if [[ $1 == "powder" ]]; then
        case $device_target_build in
            8[ABC]* ) warn "iOS 4.2.1 and lower are hit or miss. It may not restore/boot properly";;
            #7[CD]*  ) warn "Jailbreak option is not supported for this version. It is recommended to select 3.1.3 instead";;
            8E* ) warn "iOS 4.2.x for the CDMA 4 is not supported. It may not restore/boot properly";;
            8*  ) warn "Not all devices support iOS 4. It may not restore/boot properly";;
            7B* ) warn "Not all 3.2.x versions will work. It may not restore/boot properly";;
            7*  ) warn "iOS 3.1.x for the touch 3 is not supported. It will get stuck at the activation screen";;
        esac
        return
    fi
    case $device_type in
        "iPhone3"* )
            if [[ $device_target_vers == "4.2"* ]]; then
                warn "iOS 4.2.x for $device_type might fail to boot after the restore/jailbreak."
                print "* It is recommended to select another version instead."
            fi
        ;;
        "iPod4,1" )
            if [[ $device_target_vers == "4.2.1" ]]; then
                warn "iOS 4.2.1 for iPod4,1 might fail to boot after the restore/jailbreak."
                print "* It is recommended to select another version instead."
            elif [[ $device_target_build == "8B118" ]]; then
                warn "iOS 4.1 (8B118) for iPod4,1 might fail to boot after the restore/jailbreak."
                print "* It is recommended to select 8B117 or another version instead."
            fi
        ;;
        "iPhone2,1" )
            if [[ $device_target_vers == "3.0"* && $device_newbr != 0 ]]; then
                warn "3.0.x versions are for old bootrom devices only. It will fail to restore/boot if your device is not compatible."
                print "* It is recommended to select 3.1 or newer instead."
            fi
        ;;
        "iPhone1,2" )
            if [[ $device_type == "iPhone1,2" && $device_target_vers == "4.2.1" ]]; then
                warn "iOS 4.2.1 for iPhone1,2 will fail to restore with the jailbreak/hacktivate option."
                print "* It is recommended to select 4.1 or 3.1.3 instead."
            fi
        ;;
    esac
}

ipsw_version_set() {
    local newpath="$1"
    local vers
    local build

    log "Getting version from IPSW"
    unzip -o -j "$newpath.ipsw" Restore.plist -d .
    if [[ $platform == "macos" ]]; then
        rm -f BuildVer Version
        plutil -extract 'ProductVersion' xml1 Restore.plist -o Version
        vers=$(cat Version | sed -ne '/<string>/,/<\/string>/p' | sed -e "s/<string>//" | sed "s/<\/string>//" | sed '2d')
        plutil -extract 'ProductBuildVersion' xml1 Restore.plist -o BuildVer
        build=$(cat BuildVer | sed -ne '/<string>/,/<\/string>/p' | sed -e "s/<string>//" | sed "s/<\/string>//" | sed '2d')
    else
        vers=$(cat Restore.plist | grep -i ProductVersion -A 1 | grep -oPm1 "(?<=<string>)[^<]+")
        build=$(cat Restore.plist | grep -i ProductBuildVersion -A 1 | grep -oPm1 "(?<=<string>)[^<]+")
    fi

    if [[ $2 == "base" ]]; then
        device_base_vers="$vers"
        device_base_build="$build"
    else
        device_target_vers="$vers"
        device_target_build="$build"
    fi
}

ipsw_custom_set() {
    if [[ $ipsw_fourthree == 1 ]]; then
        ipsw_custom="../${device_type}_${device_target_vers}_${device_target_build}_FourThree"
        return
    fi

    ipsw_custom="../${device_type}_${device_target_vers}_${device_target_build}_Custom"
    if [[ -n $1 ]]; then
        ipsw_custom="../$1_Custom"
    fi

    if [[ $device_actrec == 1 ]]; then
        ipsw_custom+="A"
    fi
    if [[ $device_type == "$device_disable_bbupdate" && $device_use_bb != 0 ]] && (( device_proc > 4 )); then
        ipsw_custom+="B"
        if [[ $device_deadbb == 1 ]]; then
            ipsw_custom+="D"
        fi
    fi
    if [[ $ipsw_gasgauge_patch == 1 ]]; then
        ipsw_custom+="G"
    fi
    if [[ $ipsw_hacktivate == 1 ]]; then
        ipsw_custom+="H"
    fi
    if [[ $ipsw_jailbreak == 1 ]]; then
        ipsw_custom+="J"
    fi
    if [[ $device_proc == 1 && $device_type != "iPhone1,2" ]]; then
        ipsw_custom2="$ipsw_custom"
    fi
    if [[ -n $ipsw_customlogo || -n $ipsw_customrecovery ]]; then
        ipsw_custom+="L"
        if [[ $device_proc == 1 && $device_type != "iPhone1,2" ]]; then
            ipsw_customlogo2=1
        fi
    fi
    if [[ $device_target_powder == 1 ]]; then
        ipsw_custom+="P"
        if [[ $device_base_vers == "7.0"* ]]; then
            ipsw_custom+="0"
        fi
    fi
    if [[ $device_target_tethered == 1 ]]; then
        ipsw_custom+="T"
    fi
    if [[ $ipsw_verbose == 1 ]]; then
        ipsw_custom+="V"
    fi
    if [[ $device_target_powder == 1 && $device_target_vers == "4.3"* ]]; then
        ipsw_custom+="-$device_ecid"
    fi
}

menu_logo_browse() {
    local newpath
    input "Select your $1 image file in the file selection window."
    if [[ $mac_cocoa == 1 ]]; then
        newpath="$($cocoadialog fileselect --with-extensions png)"
    else
        menu_zenity_check
        newpath="$($zenity --file-selection --file-filter='PNG | *.png' --title="Select $1 image file")"
    fi
    [[ ! -s "$newpath" ]] && read -p "$(input "Enter path to $1 image file (or press Ctrl+C to cancel): ")" newpath
    [[ ! -s "$newpath" ]] && return
    log "Selected $1 image file: $newpath"
    case $1 in
        "boot" ) ipsw_customlogo="$newpath";;
        "recovery" ) ipsw_customrecovery="$newpath";;
    esac
}

menu_ipsw_browse() {
    local versionc
    local newpath
    local text="Target"
    local picker

    local menu_items=($(ls ../$device_type*Restore.ipsw 2>/dev/null))
    if [[ $1 == "base" ]]; then
         text="Base"
         menu_items=()
         case $device_type in
            iPhone3,[13] ) menu_items=($(ls ../${device_type}_7.1.2*Restore.ipsw 2>/dev/null));;
            iPad1,1 | iPod3,1 ) menu_items=($(ls ../${device_type}_5.1.1*Restore.ipsw 2>/dev/null));;
            iPhone5* ) menu_items=($(ls ../${device_type}_7*Restore.ipsw 2>/dev/null));;
            * ) menu_items=($(ls ../${device_type}_7.1*Restore.ipsw 2>/dev/null));;
        esac
    fi
    case $1 in
        "iOS 10.3.3" ) versionc="10.3.3";;
        "iOS 8.4.1" ) versionc="8.4.1";;
        "iOS 6.1.3" ) versionc="6.1.3";;
        "Latest iOS"* ) versionc="$device_latest_vers";;
        [6543]* ) versionc="$1";;
    esac
    if [[ $versionc == "$device_latest_vers" ]]; then
        menu_items=()
    elif [[ -n $versionc ]]; then
        menu_items=($(ls ../${device_type}_${versionc}*Restore.ipsw 2>/dev/null))
    fi
    menu_items+=("Open File Picker" "Enter Path" "Go Back")

    if [[ "${menu_items[0]}" == *".ipsw" ]]; then
        print "* Select $text IPSW Menu"
        while true; do
            input "Select an option:"
            select opt in "${menu_items[@]}"; do
                selected="$opt"
                break
            done
            case $selected in
                "Open File Picker" ) picker=1; break;;
                "Enter Path" ) break;;
                *.ipsw ) newpath="$selected"; break;;
                "Go Back" ) return;;
            esac
        done
    else
        picker=1
    fi

    if [[ $picker == 1 ]]; then
        input "Select your $text IPSW file in the file selection window."
        if [[ $mac_cocoa == 1 ]]; then
            newpath="$($cocoadialog fileselect --with-extensions ipsw)"
        else
            menu_zenity_check
            newpath="$($zenity --file-selection --file-filter='IPSW | *Restore.ipsw' --title="Select $text IPSW file")"
        fi
    fi
    if [[ ! -s "$newpath" ]]; then
        print "* Enter the full path to the IPSW file to be used."
        print "* You may also drag and drop the IPSW file to the Terminal window."
        read -p "$(input "Path to $text IPSW file (or press Enter/Return or Ctrl+C to cancel): ")" newpath
    fi
    [[ ! -s "$newpath" ]] && return
    newpath="${newpath%?????}"
    log "Selected IPSW file: $newpath.ipsw"
    ipsw_version_set "$newpath" "$1"

    if [[ $(cat Restore.plist | grep -c $device_type) == 0 ]]; then
        log "Selected IPSW is not for your device $device_type."
        pause
        return
    elif [[ $device_proc == 8 && $device_latest_vers == "12"* ]] || [[ $device_type == "iPad4,6" ]]; then
        # SEP/BB check for iPhone 6/6+, iPad mini 2 China, iPod touch 6
        case $device_target_build in
            1[1234]* | 15[ABCD]* )
                log "Selected IPSW ($device_target_vers) is not supported as target version."
                print "* Latest SEP/BB is not compatible."
                pause
                return
            ;;
        esac
    elif [[ $device_proc == 7 ]]; then
        # SEP/BB check for iPhone 5S, iPad Air 1/mini 2
        case $device_target_build in
            1[123]* | 14A* | 15[ABCD]* )
                log "Selected IPSW ($device_target_vers) is not supported as target version."
                print "* Latest SEP/BB is not compatible."
                pause
                return
            ;;
        esac
    elif [[ $device_latest_vers == "15"* ]]; then
        # SEP/BB check for iPhone 6S/6S+/SE 2016/7/7+, iPad Air 2/mini 4, iPod touch 7
        case $device_target_build in
            1[234567]* )
                log "Selected IPSW ($device_target_vers) is not supported as target version."
                print "* Latest SEP/BB is not compatible."
                pause
                return
            ;;
        esac
    elif [[ $device_latest_vers == "16"* ]]; then
        case $device_target_build in
            20[GH]* ) :;; # 16.6 and newer only
            18[CDEFGH]* | 19* )
                if [[ $device_type == "iPhone10,3" || $device_type == "iPhone10,6" ]]; then
                    log "Selected IPSW ($device_target_vers) is not supported as target version."
                    print "* Latest SEP/BB is not compatible."
                    pause
                    return
                else
                    warn "Please read: You will need to follow a guide regarding activation files before and after the restore."
                    print "* You will encounter issues activating if you do not follow this."
                    print "* Link to guide: https://gist.github.com/pixdoet/2b58cce317a3bc7158dfe10c53e3dd32"
                    pause
                fi
            ;;
            * )
                log "Selected IPSW ($device_target_vers) is not supported as target version."
                print "* Latest SEP/BB is not compatible."
                pause
                return
            ;;
        esac
    elif [[ $device_checkm8ipad == 1 ]]; then
        case $device_target_build in
            1[89]* )
                warn "Please read: You will need to follow a guide regarding activation files before and after the restore."
                print "* You will encounter issues activating if you do not follow this."
                print "* Link to guide: https://gist.github.com/pixdoet/2b58cce317a3bc7158dfe10c53e3dd32"
                pause
            ;;
            * )
                log "Selected IPSW ($device_target_vers) is not supported as target version."
                print "* Latest SEP/BB is not compatible."
                pause
                return
            ;;
        esac
    fi

    case $1 in
        "base" )
            local check_vers="7.1"
            local base_vers="7.1.x"
            case $device_type in
                iPhone5,[1234] )
                    check_vers="7"
                    base_vers="7.x"
                ;;
                iPad3* )
                    check_vers="7.0"
                    base_vers="7.0.x"
                ;;
                iPhone3* )
                    check_vers="7.1.2"
                    base_vers="$check_vers"
                ;;
                iPad1,1 | iPod3,1 )
                    check_vers="5.1.1"
                    base_vers="$check_vers"
                ;;
                iPad2,[123] )
                    # fourthree
                    check_vers="4.3"
                    base_vers="4.3.x"
                ;;
            esac
            if [[ $device_base_vers != "$check_vers"* ]]; then
                log "Selected IPSW is not for iOS $base_vers."
                if [[ $device_proc == 4 ]]; then
                    print "* You need to select iOS $base_vers IPSW for the base to use powdersn0w."
                elif [[ $ipsw_fourthree == 1 ]]; then
                    print "* You need to select iOS $base_vers IPSW for the base to use FourThree."
                else
                    print "* You need iOS $base_vers IPSW and SHSH blobs for your device to use powdersn0w."
                fi
                pause
                return
            elif [[ $device_target_build == "$device_base_build" ]]; then
                log "The base version and the target version cannot be the same."
                pause
                return
            fi
            ipsw_verify "$newpath" "$device_base_build"
            if [[ $? != 0 ]]; then
                return
            fi
            ipsw_base_path="$newpath"
            return
        ;;
        *"powdersn0w"* )
            if [[ $device_target_build == "14"* ]]; then
                log "Selected IPSW ($device_target_vers) is not supported as target version."
                case $device_type in
                    iPhone5,[12] ) print "* If you want untethered iOS 10, use p0insettia plus: https://github.com/LukeZGD/p0insettia-plus";;
                esac
                pause
                return
            elif [[ $device_target_build == "11D257" && $device_type == "iPhone3"* ]] ||
                 [[ $device_target_build == "9B206" && $device_proc == 4 ]]; then
                log "Selected IPSW ($device_target_vers) is not supported as target version. You need to select it as base IPSW."
                pause
                return
            elif [[ $device_target_build == "$device_base_build" ]]; then
                log "The base version and the target version cannot be the same."
                pause
                return
            fi
            versionc="powder"
        ;;
    esac
    if [[ $versionc == "powder" ]]; then
        :
    elif [[ -n $versionc && $device_target_vers != "$versionc" ]]; then
        log "Selected IPSW ($device_target_vers) does not match target version ($versionc)."
        pause
        return
    fi
    if [[ $1 != "custom" ]]; then
        ipsw_verify "$newpath" "$device_target_build"
        if [[ -n $versionc && $? != 0 ]]; then
            return
        fi
    fi
    ipsw_path="$newpath"
}

menu_shsh_browse() {
    local newpath
    local text="Target"
    local val="$ipsw_path.ipsw"
    [[ $1 == "base" ]] && text="Base"

    input "Select your $text SHSH file in the file selection window."
    if [[ $mac_cocoa == 1 ]]; then
        newpath="$($cocoadialog fileselect)"
    else
        menu_zenity_check
        newpath="$($zenity --file-selection --file-filter='SHSH | *.bshsh2 *.shsh *.shsh2' --title="Select $text SHSH file")"
    fi
    if [[ ! -s "$newpath" ]]; then
        print "* Enter the full path to the SHSH file to be used."
        print "* You may also drag and drop the SHSH file to the Terminal window."
        read -p "$(input "Path to $text SHSH file (or press Enter/Return or Ctrl+C to cancel): ")" newpath
    fi
    [[ ! -s "$newpath" ]] && return
    log "Selected SHSH file: $newpath"
    log "Validating..."
    if (( device_proc >= 7 )); then
        unzip -o -j "$val" BuildManifest.plist
        shsh_validate=$("$dir/img4tool" -s "$newpath" --verify BuildManifest.plist | tee /dev/tty | grep -c "APTicket is BAD!")
    else
        if [[ $1 == "base" ]]; then
            val="$ipsw_base_path.ipsw"
        fi
        "$dir/validate" "$newpath" "$val" -z
        shsh_validate=$?
    fi
    if [[ $shsh_validate != 0 ]]; then
        warn "Validation failed. Did you select the correct IPSW/SHSH?"
        if (( device_proc < 5 )); then
            warn "Validation might be a false negative for A4 and older devices."
        fi
        pause
    fi
    shsh_path="$newpath"
}

menu_shshdump_browse() {
    local newpath
    input "Select your raw dump file in the file selection window."
    if [[ $mac_cocoa == 1 ]]; then
        newpath="$($cocoadialog fileselect --with-extensions raw)"
    else
        menu_zenity_check
        newpath="$($zenity --file-selection --file-filter='Raw Dump | *.dump *.raw' --title="Select Raw Dump")"
    fi
    [[ ! -s "$newpath" ]] && read -p "$(input "Enter path to raw dump file (or press Ctrl+C to cancel): ")" newpath
    [[ ! -s "$newpath" ]] && return
    log "Selected raw dump file: $newpath"
    shsh_path="$newpath"
}

menu_flags() {
    local menu_items
    local selected
    local back

    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=()
        case $device_type in
            iPhone[45]* | iPad2,[67] | iPad3,[56] ) menu_items+=("Enable disable-bbupdate flag");;
        esac
        if (( device_proc >= 7 )); then
            menu_items+=("Enable skip-blob flag")
        else
            menu_items+=("Enable activation-records flag" "Enable jailbreak flag")
            if (( device_proc >= 5 )); then
                menu_items+=("Enable skip-ibss flag")
            fi
        fi
        case $device_type in
            iPhone4,1 ) menu_items+=("Enable gasgauge-patch flag");;
            iPhone3,[13] | iPad1,1 | iPod3,1 ) menu_items+=("Enable skip-first flag");;
        esac
        menu_items+=("Go Back")
        menu_print_info
        print " > Main Menu > Other Utilities > Enable Flags"
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Enable disable-bbupdate flag" )
                warn "This will enable the --disable-bbupdate flag."
                print "* This will disable baseband update for custom IPSWs."
                print "* This will enable usage of dumped baseband and stitch to IPSW."
                print "* This applies to the following: iPhone 4S, 5, 5C, iPad 4, mini 1"
                print "* Do not enable this if you do not know what you are doing."
                local opt
                read -p "$(input 'Do you want to enable the disable-bbupdate flag? (y/N): ')" opt
                if [[ $opt == 'y' || $opt == 'Y' ]]; then
                    device_disable_bbupdate="$device_type"
                    back=1
                fi
            ;;
            "Enable activation-records flag" )
                warn "This will enable the --activation-records flag."
                print "* This will enable usage of dumped activation records and stitch to IPSW."
                print "* Do not enable this if you do not know what you are doing."
                local opt
                read -p "$(input 'Do you want to enable the activation-records flag? (y/N): ')" opt
                if [[ $opt == 'y' || $opt == 'Y' ]]; then
                    device_actrec=1
                    back=1
                fi
            ;;
            "Enable skip-ibss flag" )
                warn "This will enable the --skip-ibss flag."
                print "* This will assume that a pwned iBSS has already been sent to the device."
                print "* Do not enable this if you do not know what you are doing."
                local opt
                read -p "$(input 'Do you want to enable the skip-ibss flag? (y/N): ')" opt
                if [[ $opt == 'y' || $opt == 'Y' ]]; then
                    device_skip_ibss=1
                    back=1
                fi
            ;;
            "Enable jailbreak flag" )
                warn "This will enable the --jailbreak flag."
                print "* This will enable the jailbreak option for the custom IPSW."
                print "* This is only useful for 4.1 and lower, where jailbreak option is disabled in most cases."
                print "* It is disabled for those versions by default because of issues with the custom IPSW jailbreak."
                print "* The recommended method is to jailbreak after the restore instead."
                print "* Do not enable this if you do not know what you are doing."
                local opt
                read -p "$(input 'Do you want to enable the jailbreak flag? (y/N): ')" opt
                if [[ $opt == 'y' || $opt == 'Y' ]]; then
                    ipsw_jailbreak=1
                    back=1
                fi
            ;;
            "Enable gasgauge-patch flag" )
                warn "This will enable the --gasgauge-patch flag."
                print "* This will enable \"multipatch\" for the custom IPSW."
                print "* This is especially useful for iPhone 4S devices that have issues restoring due to battery replacement."
                print "* This issue is called \"gas gauge\" error, also known as error 29 in iTunes."
                print "* By enabling this, firmware components for 6.1.3 or lower will be used for restoring to get past the error."
                local opt
                read -p "$(input 'Do you want to enable the gasgauge-patch flag? (y/N): ')" opt
                if [[ $opt == 'y' || $opt == 'Y' ]]; then
                    ipsw_gasgauge_patch=1
                    back=1
                fi
            ;;
            "Enable skip-first flag" )
                warn "This will enable the --skip-first flag."
                print "* This will skip first restore and flash NOR IPSW only for powdersn0w 4.2.x and lower."
                print "* Do not enable this if you do not know what you are doing."
                local opt
                read -p "$(input 'Do you want to enable the skip-ibss flag? (y/N): ')" opt
                if [[ $opt == 'y' || $opt == 'Y' ]]; then
                    ipsw_skip_first=1
                    back=1
                fi
            ;;
            "Enable skip-blob flag" )
                warn "This will enable the --skip-blob flag."
                print "* This will enable the skip blob flag of futurerestore."
                print "* This can be used to skip blob verification for OTA/onboard/factory SHSH blobs."
                print "* Do not enable this if you do not know what you are doing."
                local opt
                read -p "$(input 'Do you want to enable the skip-blob flag? (y/N): ')" opt
                if [[ $opt == 'y' || $opt == 'Y' ]]; then
                    restore_useskipblob=1
                    back=1
                fi
            ;;
            "Go Back" ) back=1;;
        esac
    done
}

menu_power() {
    local menu_items
    local selected
    local back

    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Shutdown Device" "Restart Device" "Enter Recovery Mode" "Go Back")
        menu_print_info
        print " > Main Menu > Other Utilities > Power Options"
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Shutdown Device" ) mode="shutdown";;
            "Restart Device" ) mode="restart";;
            "Enter Recovery Mode" ) mode="enterrecovery";;
            "Go Back" ) back=1;;
        esac
    done
}

menu_other() {
    local menu_items
    local selected
    local back

    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=()
        if [[ $device_mode != "none" && $device_proc != 1 ]] && (( device_proc < 7 )); then
            case $device_mode in
                "Normal" ) menu_items+=("Enter kDFU Mode");;
                * ) menu_items+=("Get iOS Version");;
            esac
            case $device_proc in
                [56] ) menu_items+=("Send Pwned iBSS");;
                *    ) menu_items+=("Enter pwnDFU Mode");;
            esac
            menu_items+=("Clear NVRAM" "Activation Records")
            case $device_type in
                iPhone* | iPad2,[67] | iPad3,[56] ) menu_items+=("Dump Baseband");;
            esac
            if [[ $device_type != "iPod2,1" ]]; then
                menu_items+=("Just Boot")
            fi
            case $device_type in
                iPhone3,[13] | iPhone[45]* | iPad1,1 | iPad2,4 | iPod[35],1 ) menu_items+=("Disable/Enable Exploit");;
                iPhone2,1 ) menu_items+=("Install alloc8 Exploit");;
            esac
        fi
        if [[ $device_mode != "none" ]]; then
            if (( device_proc >= 7 )) && (( device_proc <= 10 )); then
                menu_items+=("Enter pwnDFU Mode")
            fi
            if (( device_proc <= 10 )) && [[ $device_latest_vers != "16"* && $device_checkm8ipad != 1 && $device_proc != 1 ]]; then
                menu_items+=("SSH Ramdisk")
            fi
            case $device_mode in
                "Normal" )
                    menu_items+=("Attempt Activation")
                    case $device_vers in
                        3.1* | [456]* )
                            case $device_type in
                                iPhone1* )
                                    case $device_vers in
                                        3.1.3 | 4.[12]* ) menu_items+=("Hacktivate Device" "Revert Hacktivation");;
                                    esac
                                ;;
                                iPhone[23],1 ) menu_items+=("Hacktivate Device" "Revert Hacktivation");;
                                iPad2* )
                                    case $device_vers in
                                        4.3* ) menu_items+=("Hacktivate Device" "Revert Hacktivation");;
                                    esac
                                ;;
                            esac
                        ;;
                    esac
                    menu_items+=("Pair Device" "Power Options")
                ;;
                "Recovery" ) menu_items+=("Exit Recovery Mode");;
            esac
            if [[ $device_mode != "DFU" ]]; then
                menu_items+=("DFU Mode Helper")
            fi
        fi
        if (( device_proc < 7 )); then
            menu_items+=("Create Custom IPSW")
        fi
        if [[ $device_proc != 1 ]] && (( device_proc < 11 )); then
            menu_items+=("Enable Flags")
        fi
        menu_items+=("(Re-)Install Dependencies" "Go Back")
        menu_print_info
        print " > Main Menu > Other Utilities"
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Hacktivate Device" ) mode="device_hacktivate";;
            "Revert Hacktivation" ) mode="device_reverthacktivate";;
            "Create Custom IPSW" ) menu_restore ipsw;;
            "Enter kDFU Mode" ) mode="kdfu";;
            "Disable/Enable Exploit" ) menu_remove4;;
            "SSH Ramdisk" ) mode="device_enter_ramdisk";;
            "Clear NVRAM" ) mode="ramdisknvram";;
            "Send Pwned iBSS" | "Enter pwnDFU Mode" ) mode="pwned-ibss";;
            "(Re-)Install Dependencies" ) install_depends;;
            "Attempt Activation" ) device_activate;;
            "Install alloc8 Exploit" ) mode="device_alloc8";;
            "Dump Baseband" ) mode="baseband";;
            "Activation Records" ) mode="actrec";;
            "Exit Recovery Mode" ) mode="exitrecovery";;
            "DFU Mode Helper" ) mode="enterdfu";;
            "Just Boot" ) menu_justboot;;
            "Get iOS Version" ) mode="getversion";;
            "Pair Device" ) device_pair;;
            "Power Options" ) menu_power;;
            "Enable Flags" ) menu_flags;;
            "Go Back" ) back=1;;
        esac
    done
}

device_pair() {
    log "Attempting idevicepair"
    "$dir/idevicepair" pair
    if [[ $? != 0 ]]; then
        log "Press \"Trust\" on the device before pressing Enter/Return."
        pause
        log "Attempting idevicepair"
    fi
    "$dir/idevicepair" pair
}

device_ssh() {
    print "* Note: This is for connecting via SSH to devices that are already jailbroken and have OpenSSH installed."
    print "* If this is not what you want, you might be looking for the \"SSH Ramdisk\" option instead."
    echo
    device_ssh_message
    device_iproxy no-logging
    device_sshpass
    log "Connecting to device SSH..."
    print "* For accessing data, note the following:"
    print "* Host: sftp://127.0.0.1 | User: root | Password: <your password> (default is alpine) | Port: $ssh_port"
    $ssh -p $ssh_port root@127.0.0.1
    if [[ $? != 0 ]]; then
        log "Failed to connect to SSH as root. Connecting to device SSH as mobile..."
        print "* Host: sftp://127.0.0.1 | User: mobile | Password: <your password> | Port: $ssh_port"
        $ssh -p $ssh_port mobile@127.0.0.1
    fi
}

device_alloc8() {
    device_enter_mode pwnDFU
    device_ipwndfu alloc8
    log "Done!"
    print "* This may take several tries. It can fail a lot with \"Operation timed out\" error."
    print "* If it fails, try to unplug and replug your device then run the script again."
    print "* You may also need to force restart the device and re-enter DFU mode before retrying."
    print "* To retry, just go back to: Other Utilities -> Install alloc8 Exploit"
}

device_jailbreak() {
    if [[ $device_proc == 1 ]]; then
        print "* The \"Jailbreak Device\" option is not supported for this device."
        print "* To jailbreak, go to \"Restore/Downgrade\" instead, select 4.1 or 3.1.3, then enable the jailbreak option."
        return
    elif [[ $device_vers == *"iBoot"* || $device_vers == "Unknown"* ]]; then
        device_vers=
        while [[ -z $device_vers ]]; do
            read -p "$(input 'Enter current iOS version (eg. 6.1.3): ')" device_vers
        done
    else
        case $device_vers in
            5* | 6.0* | 6.1 | 6.1.[12] )
                print "* Your device on iOS $device_vers will be jailbroken using g1lbertJB."
                print "* No data will be lost, but please back up your data just in case."
                print "* Ignore the \"Error Code 1\" and \"Error Code 102\" errors, this is normal and part of the jailbreaking process."
                if [[ $device_proc == 4 ]]; then
                    print "* Note: If the process fails somewhere, you can just enter DFU mode and attempt jailbreaking again from there."
                fi
                pause
                pushd ../resources/jailbreak/g1lbertJB >/dev/null
                log "Copying freeze.tar to Cydia.tar"
                cp ../freeze.tar payload/common/Cydia.tar
                log "Running g1lbertJB..."
                "../../$dir/gilbertjb"
                rm payload/common/Cydia.tar
                popd >/dev/null
                return
            ;;
        esac
    fi
    log "Checking if your device and version is supported..."
    if [[ $device_type == "iPad2"* && $device_vers == "4"* ]]; then
        warn "This will be a semi-tethered jailbreak. checkm8-a5 is required to boot to a jailbroken state."
        print "* To boot jailbroken later, go to: Other Utilities -> Just Boot"
        pause
    elif [[ $device_proc == 5 ]]; then
        print "* Note: It would be better to jailbreak using sideload or custom IPSW methods for A5 devices."
        print "* Especially since this method may require the usage of checkm8-a5."
    elif [[ $device_proc == 6 && $platform == "linux" ]]; then
        print "* Note: It would be better to jailbreak using sideload or custom IPSW methods for A6 devices on Linux."
    fi
    if [[ $device_proc == 5 ]] || [[ $device_proc == 6 && $platform == "linux" ]]; then
        case $device_vers in
            7.1* )
                print "* For this version, Pangu on Windows/Mac can also be used instead of this option."
                print "* https://ios.cfw.guide/installing-pangu7/"
            ;;
            7.0* )
                print "* For this version, evasi0n7 on Windows/Mac can also be used instead of this option."
                print "* https://ios.cfw.guide/installing-evasi0n7/"
            ;;
            6.1.[3456] )
                print "* For this version, p0sixspwn on Windows/Mac can also be used instead of this option."
                print "* https://ios.cfw.guide/installing-p0sixspwn/"
            ;;
            10* | 9* )
                print "* Note: If you need to sideload, you can use Legacy iOS Kit's \"Sideload IPA\" option."
            ;;
        esac
    fi
    print "* For more details, go to: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Jailbreaking"
    echo
    case $device_vers in
        8.2 | 8.[10]* )
            if [[ $device_proc == 5 ]]; then
                warn "This version ($device_vers) is broken for daibutsu A5(X)."
                print "* Supported iOS 8 versions for A5(X) are 8.3 to 8.4.1 only for now."
                print "* For this version, use Home Depot patched with ohd and sideload it to your device."
                print "* https://github.com/LukeZGD/ohd"
                return
            fi
        ;;
        9.0* )
            print "* For this version, use Pangu9 on older macOS to jailbreak your device."
            print "* https://ios.cfw.guide/installing-pangu9/"
            return
        ;;
        9.3.[56] )
            print "* For this version, download kok3shi9 and sideload it to your device."
            print "* https://kok3shidoll.web.app/kok3shi9_32.html"
            return
        ;;
        10* )
            print "* For this version, download socket and sideload it to your device."
            print "* https://github.com/staturnzz/socket"
            return
        ;;
        9.3.[1234] | 9.3 | 9.2* | 9.1 | [8765]* | 4.3* | 4.2.[8761] | 4.[10]* | 3.2* | 3.1.3 ) :;;
        3.[10]* )
            if [[ $device_type != "iPhone2,1" ]]; then
                warn "This version ($device_vers) is not supported for jailbreaking with SSHRD."
                print "* Supported versions are: 3.1.3 to 9.3.4 (excluding 9.0.x)"
                return
            fi
        ;;
        * )
            warn "This version ($device_vers) is not supported for jailbreaking with SSHRD."
            print "* Supported versions are: 3.1.3 to 9.3.4 (excluding 9.0.x)"
            return
        ;;
    esac
    if [[ $device_type == "iPhone2,1" && $device_vers == "3"* ]]; then
        warn "For 3.x versions on the 3GS, the \"Jailbreak Device\" option will only work on devices restored with Legacy iOS Kit."
        print "* This applies to all 3.x versions on the 3GS only. They require usage of the \"Restore/Downgrade\" option first."
        echo
    fi
    print "* By selecting Jailbreak Device, your device will be jailbroken using Ramdisk Method."
    print "* Before continuing, make sure that your device does not have a jailbreak yet."
    print "* No data will be lost, but please back up your data just in case."
    pause
    device_ramdisk jailbreak
}

device_ssh_message() {
    print "* Make sure to have OpenSSH installed on your iOS device."
    if [[ $device_det == 1 ]] && (( device_proc < 7 )); then
        print "* Install all updates in Cydia/Zebra."
        print "* Make sure to also have Dropbear installed from my repo."
        print "* Repo: https://lukezgd.github.io/repo"
    fi
    print "* Only proceed if you have these requirements installed using Cydia/Zebra/Sileo."
    print "* You will be prompted to enter the root/mobile password of your iOS device."
    print "* The default password is: alpine"
}

device_dump() {
    local arg="$1"
    local dump="../saved/$device_type/$arg-$device_ecid.tar"
    local dmps
    local dmp2
    case $arg in
        "baseband" ) dmps="/usr/local/standalone";;
        "activation" )
            dmp2="private/var/root/Library/Lockdown"
            case $device_vers in
                [34567]* ) dmps="/$dmp2";;
                8* ) dmps="/private/var/mobile/Library/mad";;
                * )
                    dmps="/private/var/containers/Data/System/*/Library/activation_records"
                    dmp2+="/activation_records"
                ;;
            esac
        ;;
    esac

    log "Dumping files for $arg: $dmps"
    if [[ -s $dump ]]; then
        log "Found existing dumped $arg: $dump"
        print "* Select Y to overwrite, or N to use existing dump"
        print "* Make sure to keep a backup of the dump if needed"
        read -p "$(input 'Overwrite this existing dump? (y/N) ')" opt
        if [[ $opt != 'Y' && $opt != 'y' ]]; then
            return
        fi
        log "Deleting existing dumped $arg"
        rm $dump
    fi
    if [[ $device_mode == "Recovery" ]]; then
        device_enter_mode pwnDFU
    fi
    if [[ $device_mode == "Normal" ]]; then
        device_ssh_message
        device_iproxy
        device_sshpass
        if [[ $arg == "activation" ]]; then
            log "Creating $arg.tar"
            $ssh -p $ssh_port root@127.0.0.1 "mkdir -p /tmp/$dmp2; cp -R $dmps/* /tmp/$dmp2"
            $ssh -p $ssh_port root@127.0.0.1 "cd /tmp; tar -cvf $arg.tar $dmp2"
            log "Copying $arg.tar"
            $scp -P $ssh_port root@127.0.0.1:/tmp/$arg.tar .
            mv $arg.tar $arg-$device_ecid.tar
        else
            device_dumpbb
        fi
        cp $arg-$device_ecid.tar $dump
    elif [[ $device_mode == "DFU" ]]; then
        log "This operation requires an SSH ramdisk, proceeding"
        print "* I recommend dumping baseband/activation on Normal mode instead of Recovery/DFU mode if possible"
        device_enter_ramdisk $arg
        device_dumprd
        $ssh -p $ssh_port root@127.0.0.1 "nvram auto-boot=0; reboot_bak"
        log "Done, device should reboot to recovery mode now"
        log "Just exit recovery mode if needed: Other Utilities -> Exit Recovery Mode"
        if [[ $mode != "baseband" && $mode != "actrec" ]]; then
            log "Put your device back in kDFU/pwnDFU mode to proceed"
            device_find_mode Recovery
            device_enter_mode DFU
            device_enter_mode pwnDFU
        fi
    fi
    kill $iproxy_pid
    if [[ ! -e $dump ]]; then
        error "Failed to dump $arg from device. Please run the script again"
    fi
    log "Dumping $arg done: $dump"
}

device_dumpbb() {
    local bb2="Mav5"
    local root="/"
    local root2="/"
    local tmp="/tmp"
    case $device_type in
        iPhone4,1 ) bb2="Trek";;
        iPhone5,[34] ) bb2="Mav7Mav8";;
    esac
    if [[ $1 == "rd" ]]; then
        root="/mnt1/"
        root2=
        tmp="/mnt2/tmp"
    fi
    log "Creating baseband.tar"
    case $device_vers in
        5* ) $scp -P $ssh_port root@127.0.0.1:${root}usr/standalone/firmware/$bb2-personalized.zip .;;
        6* ) $scp -P $ssh_port root@127.0.0.1:${root}usr/local/standalone/firmware/Baseband/$bb2/$bb2-personalized.zip .;;
    esac
    case $device_vers in
        [56]* )
            mkdir -p usr/local/standalone/firmware/Baseband/$bb2
            unzip $bb2-personalized.zip -d usr/local/standalone/firmware/Baseband/$bb2
            cp $bb2-personalized.zip usr/local/standalone/firmware/Baseband/$bb2
        ;;
        * )
            $ssh -p $ssh_port root@127.0.0.1 "cd $root; tar -cvf $tmp/baseband.tar ${root2}usr/local/standalone/firmware"
            $scp -P $ssh_port root@127.0.0.1:$tmp/baseband.tar .
            if [[ ! -s baseband.tar ]]; then
                error "Dumping baseband tar failed. Please run the script again" \
                "* If your device is on iOS 9 or newer, make sure to set the version of the SSH ramdisk correctly."
            fi
            tar -xvf baseband.tar -C .
            rm baseband.tar
            pushd usr/local/standalone/firmware/Baseband/$bb2 >/dev/null
            zip -r0 $bb2-personalized.zip *
            unzip -o $bb2-personalized.zip -d .
            popd >/dev/null
        ;;
    esac
    if [[ $device_type == "iPhone4,1" ]]; then
        mkdir -p usr/standalone/firmware
        cp usr/local/standalone/firmware/Baseband/$bb2/$bb2-personalized.zip usr/standalone/firmware
    fi
    tar -cvf baseband-$device_ecid.tar usr
}

device_dumprd() {
    local dump="../saved/$device_type"
    local dmps
    local dmp2
    local vers
    local tmp="/mnt2/tmp"

    device_ramdisk_iosvers
    vers=$device_vers
    if [[ -z $vers ]]; then
        warn "Something wrong happened. Failed to get iOS version."
        print "* Please reboot the device into normal operating mode, then perform a clean \"slide to power off\", then try again."
        $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
        return
    fi
    log "Mounting filesystems"
    $ssh -p $ssh_port root@127.0.0.1 "mount.sh"
    sleep 1

    case $device_type in
        iPhone[45]* | iPad2,[67] | iPad3,[56] )
            log "Dumping both baseband and activation tars"
            device_dumpbb rd
            print "* Reminder to backup dump tars if needed"
            if [[ -s $dump/baseband-$device_ecid.tar ]]; then
                read -p "$(input "Baseband dump exists in $dump/baseband-$device_ecid.tar. Overwrite? (y/N) ")" opt
                if [[ $opt == 'Y' || $opt == 'y' ]]; then
                    log "Deleting existing dumped baseband"
                    rm $dump/baseband-$device_ecid.tar
                fi
            fi
            cp baseband-$device_ecid.tar $dump
        ;;
    esac

    dmp2="root/Library/Lockdown"
    case $vers in
        [34567]* ) dmps="$dmp2";;
        8* ) dmps="mobile/Library/mad";;
        * )
            dmps="containers/Data/System/*/Library/activation_records"
            dmp2+="/activation_records"
        ;;
    esac
    log "Creating activation.tar"
    $ssh -p $ssh_port root@127.0.0.1 "mkdir -p $tmp/private/var/$dmp2; cp -R /mnt2/$dmps/* $tmp/private/var/$dmp2"
    $ssh -p $ssh_port root@127.0.0.1 "cd $tmp; tar -cvf $tmp/activation.tar private/var/$dmp2"
    log "Copying activation.tar"
    print "* Reminder to backup dump tars if needed"
    $scp -P $ssh_port root@127.0.0.1:$tmp/activation.tar .
    if [[ ! -s activation.tar ]]; then
        error "Dumping activation record tar failed. Please run the script again" \
        "If your device is on iOS 9 or newer, make sure to set the version of the SSH ramdisk correctly."
    fi
    mv activation.tar activation-$device_ecid.tar
    if [[ -s $dump/activation-$device_ecid.tar ]]; then
        read -p "$(input "Activation records dump exists in $dump/activation-$device_ecid.tar. Overwrite? (y/N) ")" opt
        if [[ $opt == 'Y' || $opt == 'y' ]]; then
            log "Deleting existing dumped activation"
            rm $dump/activation-$device_ecid.tar
        fi
    fi
    cp activation-$device_ecid.tar $dump
    $ssh -p $ssh_port root@127.0.0.1 "rm -f $tmp/*.tar"
}

device_activate() {
    log "Attempting to activate device with ideviceactivation"
    if [[ $device_type == "iPhone"* ]] && (( device_proc <= 4 )); then
        print "* For iPhone 4 and older devices, make sure to have a valid SIM card."
        case $device_type in
            iPhone2,1 ) print "* For hacktivation, go to \"Restore/Downgrade\" or \"Hacktivate Device\" instead.";;
            iPhone1*  ) print "* For hacktivation, go to \"Restore/Downgrade\" instead.";;
        esac
    fi
    $ideviceactivation activate
    if [[ $device_type == "iPod"* ]] && (( device_det <= 3 )); then
        $ideviceactivation itunes
    fi
    print "* If it returns an error, just try again."
    device_unactivated=$($ideviceactivation state | grep -c "Unactivated")
    pause
}

device_hacktivate() {
    local type="$device_type"
    local build="$device_build"
    if [[ $device_type == "iPhone3,1" ]]; then
        type="iPhone2,1"
        case $device_vers in
            4.2.1 ) build="8C148a";;
            5.1.1 ) build="9B206";;
            6.1   ) build="10B141";;
        esac
        log "Checking ideviceactivation status..."
        $ideviceactivation activate
    fi
    local patch="../resources/firmware/FirmwareBundles/Down_${type}_${device_vers}_${build}.bundle/lockdownd.patch"
    print "* Note: This is for hacktivating devices that are already restored, jailbroken, and have OpenSSH installed."
    print "* If this is not what you want, you might be looking for the \"Restore/Downgrade\" option instead."
    print "* From there, enable both \"Jailbreak Option\" and \"Hacktivate Option.\""
    echo
    print "* Hacktivate Device: This will use SSH to patch lockdownd on your device."
    print "* Hacktivation is for iOS versions 3.1 to 6.1.6."
    pause
    device_iproxy
    device_sshpass
    log "Getting lockdownd"
    $scp -P $ssh_port root@127.0.0.1:/usr/libexec/lockdownd .
    log "Patching lockdownd"
    $bspatch lockdownd lockdownd.patched "$patch"
    log "Renaming original lockdownd"
    $ssh -p $ssh_port root@127.0.0.1 "[[ ! -e /usr/libexec/lockdownd.orig ]] && mv /usr/libexec/lockdownd /usr/libexec/lockdownd.orig"
    log "Copying patched lockdownd to device"
    $scp -P $ssh_port lockdownd.patched root@127.0.0.1:/usr/libexec/lockdownd
    $ssh -p $ssh_port root@127.0.0.1 "chmod +x /usr/libexec/lockdownd; reboot"
    log "Done. Your device should reboot now"
}

device_reverthacktivate() {
    print "* This will use revert hacktivation for this device."
    print "* This option can only be used if the hacktivation is done using Legacy iOS Kit's \"Hacktivate Device\" option."
    pause
    device_iproxy
    print "* The default root password is: alpine"
    device_sshpass
    log "Reverting lockdownd"
    $ssh -p $ssh_port root@127.0.0.1 "[[ -e /usr/libexec/lockdownd.orig ]] && rm /usr/libexec/lockdownd && mv /usr/libexec/lockdownd.orig /usr/libexec/lockdownd"
    $ssh -p $ssh_port root@127.0.0.1 "chmod +x /usr/libexec/lockdownd; reboot"
    log "Done. Your device should reboot now"
}

restore_customipsw() {
    print "* You are about to restore with a custom IPSW."
    print "* This option is only for restoring with IPSWs NOT made with Legacy iOS Kit, like whited00r or GeekGrade."
    if [[ $device_newbr == 1 ]]; then
        warn "Your device is a new bootrom model and some custom IPSWs might not be compatible."
        print "* For iPhone 3GS, after restoring you will need to go to Other Utilities -> Install alloc8 Exploit"
    else
        warn "Do NOT use this option for powdersn0w or jailbreak IPSWs with Legacy iOS Kit!"
    fi
    if [[ $platform == "macos" ]] && [[ $device_type == "iPod2,1" || $device_proc == 1 ]]; then
        echo
        warn "Restoring to 2.x might not work on newer macOS versions."
        print "* Try installing usbmuxd from MacPorts, and run 'sudo usbmuxd -pf' in another Terminal window"
        print "* Another option is to just do 2.x restores on Linux instead."
        print "* For more info, go to: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Troubleshooting#restoring-to-iphoneosios-2x-on-macos"
    fi
    if [[ $device_proc == 1 ]]; then
        echo
        print "* Note that you might need to restore twice, due to NOR flash."
        print "* For iPhone 2G/3G, the second restore may fail due to baseband."
        print "* You can exit recovery mode after by going to: Other Utilities -> Exit Recovery Mode"
    fi
    pause
    menu_ipsw_browse custom
    if [[ -z $ipsw_path ]]; then
        error "No IPSW selected, cannot continue."
    fi
    if [[ $device_proc == 1 ]]; then
        device_enter_mode WTFreal
    else
        device_enter_mode pwnDFU
    fi
    ipsw_custom="$ipsw_path"
    restore_latest custom
}

restore_dfuipsw() {
    # the only change done to the "dfu ipsw" is just applelogo copied and renamed to llb
    # replacing llb with an invalid img3/im4p to make the restore fail, the device will then fallback to true dfu mode
    # https://theapplewiki.com/wiki/DFU_Mode#Enter_True_Hardware_DFU_Mode_Automatically
    # this function theoretically works on 64-bit devices, but restoring the dfu ipsw requires entering dfu for pwned restore
    # which defeats the point of doing a dfu ipsw in the first place, so dfu ipsw is available for 32-bit devices only
    print "* You are about to restore with a DFU IPSW."
    print "* This will force the device to enter DFU mode, which is useful for devices with broken buttons."
    print "* All device data will be wiped! Only proceed if you have backed up your data."
    print "* Expect the restore to fail and the device to be stuck in DFU mode."
    pause
    device_target_vers="$device_latest_vers"
    device_target_build="$device_latest_build"
    ipsw_latest_set
    ipsw_path="../$ipsw_latest_path"
    if [[ -s "$ipsw_path.ipsw" && ! -e "$ipsw_dfuipsw.ipsw" ]]; then
        ipsw_verify "$ipsw_path" "$device_target_build"
    elif [[ ! -e "$ipsw_path.ipsw" ]]; then
        ipsw_download "$ipsw_path"
    fi
    if [[ -s "$ipsw_dfuipsw.ipsw" ]]; then
        log "Found existing DFU IPSW. Skipping IPSW creation."
    else
        cp $ipsw_path.ipsw temp.ipsw
        local llb="${device_model}ap"
        local all="Firmware/all_flash"
        local applelogo
        if (( device_proc >= 6 )); then
            ipsw_hwmodel_set
            case $device_type in
                iPhone9,[13] ) llb="d10";;
                iPhone9,[24] ) llb="d11";;
                iPhone[78]* | iPad6,1* ) llb="$device_model";;
                * ) llb="$ipsw_hwmodel"
            esac
            case $device_type in
                iPhone5,[1234] ) applelogo="applelogo@2x~iphone.s5l8950x.img3";;
                iPad3,[456] ) applelogo="applelogo@2x~ipad.s5l8955x.img3";;
                iPhone* ) applelogo="applelogo@2x~iphone.im4p";;
                iPad* ) applelogo="applelogo@2x~ipad.im4p";;
            esac
        else
            all="$all_flash"
            device_fw_key_check
            applelogo=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "AppleLogo") | .filename')
        fi
        llb="LLB.$llb.RELEASE"
        if (( device_proc >= 7 )); then
            llb+=".im4p"
        else
            llb+=".img3"
        fi
        mkdir -p $all
        unzip -o -j temp.ipsw $all/$applelogo -d .
        mv $applelogo $all/$llb
        zip -r0 temp.ipsw $all/*
        mv temp.ipsw $ipsw_dfuipsw.ipsw
    fi
    if [[ $1 == "ipsw" ]]; then
        return
    fi
    ipsw_path="$ipsw_dfuipsw"
    device_enter_mode Recovery
    ipsw_extract
    log "Running idevicerestore with command: $idevicerestore -e \"$ipsw_path.ipsw\""
    $idevicerestore -e "$ipsw_path.ipsw"
    log "Restoring done! Device should now be in DFU mode"
}

device_enter_build() {
    while true; do
        device_rd_build=
        read -p "$(input 'Enter build version (eg. 10B329): ')" device_rd_build
        case $device_rd_build in
            *[A-Z]* )
                if [[ $device_rd_build != *.* ]]; then
                    break
                fi
            ;;
            "" )
                if [[ $1 != "required" ]]; then
                    break
                fi
            ;;
        esac
        log "Build version input is not valid. Please try again"
    done
}

menu_justboot() {
    local menu_items
    local selected
    local back
    local vers

    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Enter Build Version" "Select IPSW" "Custom Bootargs")
        if [[ -n $vers ]]; then
            menu_items+=("Just Boot")
        fi
        menu_items+=("Go Back")
        menu_print_info
        print " > Main Menu > Other Utilities > Just Boot"
        print "* You are about to do a tethered boot."
        print "* To know more about build version, go here: https://theapplewiki.com/wiki/Firmware"
        echo
        if [[ -n $ipsw_justboot_path ]]; then
            print "* Selected IPSW: $ipsw_justboot_path"
            print "* IPSW Version: $device_target_vers-$device_target_build"
        elif [[ -n $vers ]]; then
            print "* Build Version entered: $vers"
        else
            print "* Enter build version or select IPSW to continue"
        fi
        echo
        if [[ -n $device_justboot_bootargs ]]; then
            print "* Custom Bootargs: $device_justboot_bootargs"
        else
            print "* You may enter custom bootargs (optional, experimental option)"
            print "* Default Bootargs: -v pio-error=0"
        fi
        echo
        input "Select an option:"
        select opt in "${menu_items[@]}"; do
            selected="$opt"
            break
        done
        case $selected in
            "Enter Build Version" )
                print "* Enter the build version of your device's current iOS version to boot."
                device_enter_build
                case $device_rd_build in
                    *[bcdefgkmpquv] )
                        log "iOS beta detected. Entering build version is not supported. Select the IPSW instead."
                        pause
                        continue
                    ;;
                esac
                ipsw_justboot_path=
                vers="$device_rd_build"
            ;;
            "Select IPSW" )
                menu_ipsw_browse
                ipsw_justboot_path="$ipsw_path"
                vers="$device_target_build"
            ;;
            "Custom Bootargs" ) read -p "$(input 'Enter custom bootargs: ')" device_justboot_bootargs;;
            "Just Boot" ) mode="device_justboot";;
            "Go Back" ) back=1;;
        esac
    done
}

device_justboot() {
    if [[ -z $device_justboot_bootargs ]]; then
        device_justboot_bootargs="-v pio-error=0"
    fi
    device_ramdisk justboot
}

device_enter_ramdisk() {
    if (( device_proc >= 7 )); then
        device_ramdisk64
        return
    elif (( device_proc >= 5 )) && [[ $device_vers == "9"* || $device_vers == "10"* ]]; then
        device_rd_build="13A452"
    elif (( device_proc >= 5 )) && (( device_det <= 8 )) && [[ $device_mode == "Normal" ]]; then
        :
    elif (( device_proc >= 5 )); then
        print "* To mount /var (/mnt2) for iOS 9-10, I recommend using 9.0.2 (13A452)."
        print "* If not sure, just press Enter/Return. This will select the default version."
        device_enter_build
    fi
    device_ramdisk $1
}

device_ideviceinstaller() {
    log "Installing selected IPA(s) to device using ideviceinstaller..."
    IFS='|' read -r -a ipa_files <<< "$ipa_path"
    for i in "${ipa_files[@]}"; do
        log "Installing: $i"
        $ideviceinstaller install "$i"
    done
}

device_altserver() {
    local altserver="../saved/AltServer-$platform"
    local sha1="4bca48e9cda0517cc965250a797f97d5e8cc2de6"
    local anisette="../saved/anisette-server-$platform"
    local arch="$platform_arch"
    case $arch in
        "armhf" ) arch="armv7"; sha1="20e9ea770dbedb5c3c20f8b966be977efa2fa4cc";;
        "arm64" ) arch="aarch64"; sha1="535926e5a14dc8f59f3f99197ca4122c7af8dfaf";;
    esac
    altserver+="_$arch"
    anisette+="_$arch"
    if [[ $($sha1sum $altserver 2>/dev/null | awk '{print $1}') != "$sha1" ]]; then
        rm -f $altserver
    fi
    if [[ ! -e $altserver ]]; then
        download_file https://github.com/NyaMisty/AltServer-Linux/releases/download/v0.0.5/AltServer-$arch AltServer-$arch
        mv AltServer-$arch $altserver
    fi
    log "Checking for latest anisette-server"
    local latest="$(curl https://api.github.com/repos/LukeZGD/Provision/releases/latest | $jq -r ".tag_name")"
    local current="$(cat ../saved/anisette-server_version 2>/dev/null || echo "none")"
    log "Latest version: $latest, current version: $current"
    if [[ $current != "$latest" ]]; then
        rm -f $anisette
    fi
    if [[ ! -e $anisette ]]; then
        download_file https://github.com/LukeZGD/Provision/releases/download/$latest/anisette-server-$arch anisette-server-$arch
        mv anisette-server-$arch $anisette
        echo "$latest" > ../saved/anisette-server_version
    fi
    chmod +x $altserver $anisette
    log "Running Anisette"
    $anisette &
    anisette_pid=$!
    log "Anisette PID: $anisette_pid"
    local ready=0
    log "Waiting for Anisette"
    while [[ $ready != 1 ]]; do
        [[ $(curl 127.0.0.1:6969 2>/dev/null) ]] && ready=1
        sleep 1
    done
    export ALTSERVER_ANISETTE_SERVER=http://127.0.0.1:6969
    altserver="env ALTSERVER_ANISETTE_SERVER=$ALTSERVER_ANISETTE_SERVER $altserver"
    device_pair
    log "Enter Apple ID details to continue."
    print "* Your Apple ID and password will only be sent to Apple servers."
    local apple_id
    local apple_pass
    while [[ -z $apple_id ]]; do
        read -p "$(input 'Apple ID: ')" apple_id
    done
    print "* Your password input will not be visible, but it is still being entered."
    while [[ -z $apple_pass ]]; do
        read -s -p "$(input 'Password: ')" apple_pass
    done
    echo
    log "Running AltServer-Linux with given Apple ID details..."
    pushd ../saved >/dev/null
    $altserver -u $device_udid -a "$apple_id" -p "$apple_pass" "$ipa_path"
    popd >/dev/null
}

restore_latest64() {
    local idevicerestore2="${idevicerestore}2"
    local opt="-l"
    local opt2
    warn "Restoring to iOS 18 or newer is not supported. Try using pymobiledevice3 instead for that"
    input "Restore/Update Select Option"
    print "* Restore will do factory reset and update the device, all data will be cleared"
    print "* Update will only update the device to the latest version"
    print "* Or press Ctrl+C to cancel"
    read -p "$(input "Select Y to Restore, select N to Update (Y/n) ")" opt2
    if [[ $opt2 != 'n' && $opt2 != 'N' ]]; then
        opt+="e"
    fi
    $idevicerestore2 $opt
    mv *.ipsw ..
}

device_fourthree_step2() {
    if [[ $device_mode != "Normal" ]]; then
        error "Device is not in normal mode. Place the device in normal mode to proceed." \
        "The device must also be restored already with Step 1: Restore."
    fi
    print "* Make sure that the device is already restored with Step 1: Restore before proceeding."
    pause
    device_iproxy
    device_sshpass alpine
    device_fourthree_check 2
    if [[ $? == 2 ]]; then
        warn "Step 2 has already been completed. Cannot continue."
        return
    fi
    print "* How much GB do you want to allocate/leave to the 6.1.3 data partition?"
    print "* The rest of the space will be allocated to the 4.3.x system."
    print "* If unsure, set it to 3 (this means 3 GB for 6.1.3, the rest for 4.3.x)."
    local size
    until [[ -n $size ]] && [ "$size" -eq "$size" ]; do
        read -p "$(input 'iOS 6.1.3 Data Partition Size (in GB): ')" size
    done
    log "iOS 6.1.3 Data Partition Size: $size GB"
    size=$((size*1024*1024*1024))
    log "Sending package files"
    $scp -P $ssh_port $jelbrek/dualbootstuff.tar root@127.0.0.1:/tmp
    log "Installing packages"
    $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /tmp/dualbootstuff.tar -C /; dpkg -i /tmp/dualbootstuff/*.deb"
    log "Running TwistedMind2"
    $ssh -p $ssh_port root@127.0.0.1 "rm /TwistedMind2*; TwistedMind2 -d1 $size -s2 879124480 -d2 max"
    local tm2="$($ssh -p $ssh_port root@127.0.0.1 "ls /TwistedMind2*")"
    $scp -P $ssh_port root@127.0.0.1:$tm2 TwistedMind2
    kill $iproxy_pid
    log "Rebooting to SSH ramdisk for the next procedure"
    device_ramdisk TwistedMind2
    log "Done, proceed to Step 3 after the device boots"
}

device_fourthree_step3() {
    if [[ $device_mode != "Normal" ]]; then
        error "Device is not in normal mode. Place the device in normal mode to proceed." \
        "The device must also be set up already with Step 2: Partition."
    fi
    print "* Make sure that the device is set up with Step 2: Partition before proceeding."
    pause
    source ../saved/$device_type/fourthree_$device_ecid
    log "4.3.x version: $device_base_vers-$device_base_build"
    local saved_path="../saved/$device_type/$device_base_build"
    device_iproxy
    device_sshpass alpine
    device_fourthree_check 3
    if [[ $? == 0 ]]; then
        warn "Step 3 has already been completed. Cannot continue."
        return
    fi
    log "Creating filesystems"
    $ssh -p $ssh_port root@127.0.0.1 "mkdir /mnt1 /mnt2"
    $ssh -p $ssh_port root@127.0.0.1 "/sbin/newfs_hfs -s -v System -J -b 8192 -n a=8192,c=8192,e=8192 /dev/disk0s3"
    $ssh -p $ssh_port root@127.0.0.1 "/sbin/newfs_hfs -s -v Data -J -b 8192 -n a=8192,c=8192,e=8192 /dev/disk0s4"
    $ssh -p $ssh_port root@127.0.0.1 "mount_hfs /dev/disk0s4 /mnt2"
    log "Sending root filesystem, this will take a while."
    $scp -P $ssh_port $saved_path/RootFS.dmg root@127.0.0.1:/var
    log "Restoring root filesystem"
    $ssh -p $ssh_port root@127.0.0.1 "echo 'y' | asr restore --source /var/RootFS.dmg --target /dev/disk0s3 --erase"
    log "Checking root filesystem"
    $ssh -p $ssh_port root@127.0.0.1 "rm /var/RootFS.dmg; fsck_hfs -f /dev/disk0s3"
    log "Restoring data partition"
    $ssh -p $ssh_port root@127.0.0.1 "umount /mnt2; mount_hfs /dev/disk0s3 /mnt1; mount_hfs /dev/disk0s4 /mnt2; mv /mnt1/private/var/* /mnt2"
    log "Fixing fstab"
    $ssh -p $ssh_port root@127.0.0.1 "echo '/dev/disk0s3 / hfs rw 0 1' | tee /mnt1/private/etc/fstab; echo '/dev/disk0s4 /private/var hfs rw 0 2' | tee -a /mnt1/private/etc/fstab"
    log "Getting lockdownd"
    $scp -P $ssh_port root@127.0.0.1:/mnt1/usr/libexec/lockdownd .
    local patch="../resources/firmware/FirmwareBundles/Down_iPhone2,1_${device_base_vers}_${device_base_build}.bundle/lockdownd.patch"
    log "Patching lockdownd"
    $bspatch lockdownd lockdownd.patched "$patch"
    log "Renaming original lockdownd"
    $ssh -p $ssh_port root@127.0.0.1 "mv /mnt1/usr/libexec/lockdownd /mnt1/usr/libexec/lockdownd.orig"
    log "Copying patched lockdownd to device"
    $scp -P $ssh_port lockdownd.patched root@127.0.0.1:/mnt1/usr/libexec/lockdownd
    $ssh -p $ssh_port root@127.0.0.1 "chmod +x /mnt1/usr/libexec/lockdownd"
    log "Fixing system keybag"
    $ssh -p $ssh_port root@127.0.0.1 "mkdir /mnt2/keybags; ttbthingy; fixkeybag -v2; cp /tmp/systembag.kb /mnt2/keybags"
    log "Remounting data partition"
    $ssh -p $ssh_port root@127.0.0.1 "umount /mnt2; mount_hfs /dev/disk0s4 /mnt1/private/var"
    # idk if copying activation records actually works, probably not
    log "Copying activation records"
    local dmp="private/var/root/Library/Lockdown"
    $ssh -p $ssh_port root@127.0.0.1 "mkdir -p /mnt1/$dmp; cp -Rv /$dmp/* /mnt1/$dmp"
    log "Installing jailbreak"
    $scp -P $ssh_port $jelbrek/freeze.tar root@127.0.0.1:/tmp
    $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /tmp/freeze.tar -C /mnt1"
    if [[ $ipsw_openssh == 1 ]]; then
        log "Installing OpenSSH"
        $scp -P $ssh_port $jelbrek/sshdeb.tar root@127.0.0.1:/tmp
        $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /tmp/sshdeb.tar -C /mnt1"
    fi
    log "Unmounting filesystems"
    $ssh -p $ssh_port root@127.0.0.1 "umount /mnt1/private/var; umount /mnt1"
    log "Sending Kernelcache and LLB"
    $scp -P $ssh_port $saved_path/Kernelcache root@127.0.0.1:/System/Library/Caches/com.apple.kernelcaches/kernelcachb
    $scp -P $ssh_port $saved_path/LLB root@127.0.0.1:/LLB
    device_fourthree_app install
    log "Done!"
}

device_fourthree_app() {
    if [[ $1 != "install" ]]; then
        device_iproxy
        print "* The default root password is: alpine"
        device_sshpass
    fi
    device_fourthree_check
    log "Installing FourThree app"
    $scp -P $ssh_port $jelbrek/fourthree.tar root@127.0.0.1:/tmp
    $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /tmp/fourthree.tar -C /; cd /Applications/FourThree.app; chmod 6755 FourThree boot.sh /usr/bin/runasroot"
    log "Running uicache"
    $ssh -p $ssh_port mobile@127.0.0.1 "uicache"
}

device_fourthree_boot() {
    device_iproxy
    print "* The default root password is: alpine"
    device_sshpass
    device_fourthree_check
    log "Running FourThree Boot"
    $ssh -p $ssh_port root@127.0.0.1 "/Applications/FourThree.app/FourThree"
}

device_fourthree_check() {
    local opt=$1
    local check
    log "Checking if Step 1 is complete"
    check="$($ssh -p $ssh_port root@127.0.0.1 "ls /dev/disk0s2s1")"
    if [[ $check != "/dev/disk0s2s1" ]]; then
        error "Cannot find /dev/disk0s2s1. Something went wrong with Step 1" \
        "* Redo the FourThree process from Step 1"
    fi
    if [[ $opt == 1 ]]; then
        return 1
    fi
    log "Checking if Step 2 is complete"
    check="$($ssh -p $ssh_port root@127.0.0.1 "ls /dev/disk0s3")"
    if [[ $check != "/dev/disk0s3" ]]; then
        if [[ $opt == 2 ]]; then
            return 1
        fi
        error "Cannot find /dev/disk0s3. Something went wrong with Step 2" \
        "* Redo the FourThree process from Step 2"
    fi
    if [[ $opt == 2 ]]; then
        return 2
    fi
    log "Checking if Step 3 is complete"
    local kcb="/System/Library/Caches/com.apple.kernelcaches/kernelcachb"
    local kc="$($ssh -p $ssh_port root@127.0.0.1 "ls $kcb")"
    local llb="$($ssh -p $ssh_port root@127.0.0.1 "ls /LLB")"
    if [[ $kc != "$kcb" || $llb != "/LLB" ]]; then
        if [[ $opt == 3 ]]; then
            return 2
        fi
        error "Cannot find Kernelcache/LLB. Something went wrong with Step 3" \
        "* Redo the FourThree process from Step 3"
    fi
    return 0
}

device_backup_create() {
    device_backup="../saved/backups/${device_ecid}_${device_type}/$(date +%Y-%m-%d-%H%M)"
    mkdir -p $device_backup
    print "* A backup of your device will be created using idevicebackup2. Please see the notes above."
    pause
    pushd "$(dirname $device_backup)"
    dir="../../$dir"
    if [[ -n $dir_env ]]; then
        dir_env="env LD_LIBRARY_PATH=$dir/lib "
    fi
    $dir_env "$dir/idevicebackup2" backup --full "$(basename $device_backup)"
    popd
}

device_backup_restore() {
    print "* The selected backup $device_backup will be restored to the device."
    pause
    device_backup="../saved/backups/${device_ecid}_${device_type}/$device_backup"
    pushd "$(dirname $device_backup)"
    dir="../../$dir"
    if [[ -n $dir_env ]]; then
        dir_env="env LD_LIBRARY_PATH=$dir/lib "
    fi
    $dir_env "$dir/idevicebackup2" restore --system --settings "$(basename $device_backup)"
    popd
}

device_erase() {
    print "* You have selected the option to Erase All Content and Settings."
    print "* As the option says, it will erase all data on the device and reset it to factory settings."
    print "* By the end of the operation, the device will be back on the setup screen."
    print "* If you want to proceed, please type the following: Yes, do as I say"
    read -p "$(input 'Do you want to proceed? ')" opt
    if [[ $opt != "Yes, do as I say" ]]; then
        error "Not proceeding."
    fi
    log "Proceeding."
    $dir_env "$dir/idevicebackup2" erase
}

main() {
    clear
    print " *** Legacy iOS Kit ***"
    print " - Script by LukeZGD -"
    echo
    version_get

    if [[ $EUID == 0 ]]; then
        error "Running the script as root is not allowed."
    fi

    if [[ ! -d "../resources" ]]; then
        error "The resources folder cannot be found. Replace resources folder and try again." \
        "* If resources folder is present try removing spaces from path/folder name"
    fi

    set_tool_paths

    log "Checking Internet connection..."
    local try=("google.com" "www.apple.com" "208.67.222.222")
    local check
    for i in "${try[@]}"; do
        ping -c1 $i >/dev/null
        check=$?
        if [[ $check == 0 ]]; then
            break
        fi
    done
    if [[ $check != 0 ]]; then
        error "Please check your Internet connection before proceeding."
    fi

    version_check

    local checks=(curl git patch unzip xxd zip)
    local check_fail
    for check in "${checks[@]}"; do
        if [[ $debug_mode == 1 ]]; then
            log "Checking for $check in PATH"
        fi
        if [[ ! $(command -v $check) ]]; then
            warn "$check not found in PATH"
            check_fail=1
        fi
    done

    if [[ ! -e "../resources/firstrun" || $(cat "../resources/firstrun") != "$platform_ver" || $check_fail == 1 ]]; then
        install_depends
    fi

    device_get_info
    mkdir -p ../saved/baseband ../saved/$device_type ../saved/shsh

    mode=
    if [[ -n $main_argmode ]]; then
        mode="$main_argmode"
    else
        menu_main
    fi

    case $mode in
        "custom-ipsw" )
            ipsw_preference_set
            ipsw_prepare
            log "Done creating custom IPSW"
        ;;
        "downgrade" )
            ipsw_preference_set
            ipsw_prepare
            restore_prepare
        ;;
        "baseband" )
            device_dump baseband
            log "Baseband dumping is done"
            print "* To stitch baseband to IPSW, run Legacy iOS Kit with --disable-bbupdate argument:"
            print "    > ./restore.sh --disable-bbupdate"
        ;;
        "actrec" )
            device_dump activation
            log "Activation records dumping is done"
            if (( device_proc < 7 )); then
                print "* To stitch records to IPSW, run Legacy iOS Kit with --activation-records argument:"
                print "    > ./restore.sh --activation-records"
            fi
        ;;
        "save-ota-blobs" ) shsh_save;;
        "kdfu" ) device_enter_mode kDFU;;
        "ramdisknvram" ) device_ramdisk clearnvram;;
        "pwned-ibss" ) device_enter_mode pwnDFU;;
        "save-onboard-blobs" ) shsh_save_onboard;;
        "save-onboard-dump" ) shsh_save_onboard dump;;
        "save-cydia-blobs" ) shsh_save_cydia;;
        "enterrecovery" ) device_enter_mode Recovery;;
        "exitrecovery" ) log "Attempting to exit Recovery mode."; $irecovery -n;;
        "enterdfu" ) device_enter_mode DFU;;
        "dfuipsw" ) restore_dfuipsw;;
        "dfuipswipsw" ) restore_dfuipsw ipsw;;
        "customipsw" ) restore_customipsw;;
        "getversion" ) device_ramdisk getversion;;
        "shutdown" ) $idevicediagnostics shutdown;;
        "restart" ) $idevicediagnostics restart;;
        "restore-latest" ) restore_latest64;;
        "convert-onboard-blobs" ) cp "$shsh_path" dump.raw; shsh_convert_onboard;;
        "remove4" ) device_ramdisk setnvram $rec;;
        "device"* ) $mode;;
        * ) :;;
    esac

    echo
    print "* Save the terminal output now if needed. (macOS: Cmd+S, Linux: Ctrl+Shift+S)"
    print "* Legacy iOS Kit $version_current ($git_hash)"
    print "* Platform: $platform ($platform_ver - $platform_arch) $live_cdusb_str"
    echo
}

for i in "$@"; do
    case $i in
        "--no-color" ) no_color=1;;
        "--no-device" ) device_argmode="none";;
        "--entry-device" ) device_argmode="entry";;
        "--no-version-check" ) no_version_check=1;;
        "--debug" ) set -x; debug_mode=1;;
        "--help" ) display_help; exit;;
        "--ipsw-verbose" ) ipsw_verbose=1;;
        "--jailbreak" ) ipsw_jailbreak=1;;
        "--memory" ) ipsw_memory=1;;
        "--disable-bbupdate" ) device_disable_bbupdate=1;;
        "--disable-sudoloop" ) device_disable_sudoloop=1;;
        "--activation-records" ) device_actrec=1;;
        "--ipsw-hacktivate" ) ipsw_hacktivate=1;;
        "--skip-ibss" ) device_skip_ibss=1;;
        "--pwned-recovery" ) device_pwnrec=1;;
        "--gasgauge-patch" ) ipsw_gasgauge_patch=1;;
        "--dead-bb" ) device_deadbb=1; device_disable_bbupdate=1;;
        "--skip-first" ) ipsw_skip_first=1;;
        "--skip-blob" ) restore_useskipblob=1;;
        "--dfuhelper" ) main_argmode="device_dfuhelper";;
        "--exit-recovery" ) main_argmode="exitrecovery";;
    esac
done

trap "clean" EXIT
trap "exit 1" INT TERM

clean
othertmp=$(ls "$(dirname "$0")" | grep -c tmp)

if [[ $no_color != 1 ]]; then
    TERM=xterm-256color # fix colors for msys2 terminal
    color_R=$(tput setaf 9)
    color_G=$(tput setaf 10)
    color_B=$(tput setaf 12)
    color_Y=$(tput setaf 208)
    color_N=$(tput sgr0)
fi

if [[ $othertmp != 0 ]]; then
    log "Detected existing tmp folder(s)."
    print "* There might be other Legacy iOS Kit instance(s) running, or residual tmp folder(s) not deleted."
    print "* Running multiple instances is not fully supported and can cause unexpected behavior."
    print "* It is recommended to only use a single instance and/or delete all existing \"tmp\" folders in your Legacy iOS Kit folder before continuing."
    pause
fi

othertmp=$(ls "$(dirname "$0")" | grep -c tmp)
mkdir "$(dirname "$0")/tmp$$"
pushd "$(dirname "$0")/tmp$$" >/dev/null
mkdir ../saved 2>/dev/null

main

popd >/dev/null