Mirrors/Legacy-iOS-Kit
2
0
Fork 0
mirror of https://github.com/LukeZGD/Legacy-iOS-Kit.git synced 2024-12-23 23:01:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

iPhone4Down is now a part of iOS-OTA-Downgrader

Browse Source
This commit is contained in:
LukeZGD 2022-05-28 18:56:10 +08:00
parent e74fe5f03b
commit 690f7e311c
65 changed files with 690 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.gitignore vendored
View File

@ -7,17 +7,16 @@
*.json
*.shsh
*.shsh2
*.so*
*.txt
Cydia*
iP*Custom*/
iP*Restore/
resources/FirmwareBundles/
resources/ch3rryflower/
resources/ipwndfu/
resources/jailbreak/bin.tar
resources/jailbreak/cydia.tar
resources/jailbreak/untether.tar
resources/libimobiledevice*/
resources/libirecovery/
resources/ramdisk/
saved/
tmp/

15
README.md
View File

@ -1,6 +1,7 @@
# iOS-OTA-Downgrader
- **Downgrade/restore and jailbreak supported iOS devices to signed OTA firmwares**
- **iPhone4Down: Downgrade your iPhone 4 on Linux (using ch3rryflower)**
- **Linux and macOS** are supported
- **Read the ["How to Use" wiki page](https://github.com/LukeZGD/iOS-OTA-Downgrader/wiki/How-to-Use) for a step-by-step tutorial**
- **Read the ["Troubleshooting" wiki page](https://github.com/LukeZGD/iOS-OTA-Downgrader/wiki/Troubleshooting) for tips, frequent questions, and troubleshooting**
@ -10,12 +11,15 @@
- For iOS 10.3.3, use [TotallyNotSpyware](https://totally-not.spyware.lol) or [sockH3lix](https://github.com/SongXiaoXi/sockH3lix) to jailbreak
- This script can also restore your device to other iOS versions that you have SHSH blobs for (32-bit devices only)
- This script can also be used to just enter kDFU mode (32-bit devices only)
- This script can also be used to restore your iPhone 4 back to iOS 7.1.2 with the option to jailbreak the install
## Supported devices
- [Identify your device here](https://ipsw.me/device-finder)
- **iPhone 5C and iPad mini 3 devices are NOT supported!**
- iPhone 5C can still be restored to versions that you have SHSH blobs for
- iPhone 4 devices also support restoring with SHSH blobs (iOS 5 and newer only)
- **iPhone4Down supports the iPhone 4 GSM (iPhone3,1) only**
- You are on your own if you attempt to restore to versions not within the supported range (except for iOS 7.1.2)
<table>
<thead>
@ -46,6 +50,11 @@
<td>iPhone 4S</td>
</tr>
<tr><td>iPad 2 (except iPad2,4)</td></tr>
<tr>
<td>iOS 7.1.2</td>
<td rowspan=2>iPhone 4 GSM (iPhone3,1)</td>
</tr>
<tr><td>iOS 5.0 to 6.1.3</td></tr></tr>
</tbody>
</table>
@ -65,6 +74,7 @@
## Tools and other stuff used
- cURL
- bspatch
- [ch3rryflower](https://web.archive.org/web/20200708040313/https://github.com/dora2-iOS/ch3rryflower) - dora2ios
- [ipwndfu](https://github.com/LukeZGD/ipwndfu) - LukeZGD fork
- [iPwnder32](https://github.com/dora2-iOS/iPwnder32) - dora2ios
- [ipwnder_lite](https://github.com/dora2-iOS/ipwnder_lite) - dora2ios
@ -72,6 +82,7 @@
- [libimobiledevice](https://github.com/libimobiledevice/libimobiledevice) - libimobiledevice
- [libirecovery](https://github.com/libimobiledevice/libirecovery) - libimobiledevice
- [imobiledevice-net](https://github.com/libimobiledevice-win32/imobiledevice-net) - libimobiledevice-win32 (macOS build)
- [idevicerestore](https://github.com/LukeeGD/idevicerestore) - LukeZGD fork
- ipsw tool from [xpwn](https://github.com/LukeZGD/xpwn) - LukeZGD fork
- Python 2 (for ipwndfu, rmsigchks, SimpleHTTPServer)
- Python 3 (http.server)
@ -86,4 +97,8 @@
- [zenity](https://github.com/ncruces/zenity) (macOS)
- 32-bit bundles are from [OdysseusOTA](https://www.youtube.com/watch?v=Wo7mGdMcjxw), [OdysseusOTA2](https://www.youtube.com/watch?v=fh0tB6fp0Sc), [alitek12](https://www.mediafire.com/folder/b1z64roy512wd/FirmwareBundles), [gjest](https://www.reddit.com/r/jailbreak/comments/6yrzzj/release_firmware_bundles_for_ios_841_ipad21234567/)
- [EtasonJB](https://www.theiphonewiki.com/wiki/EtasonJB)
- [evasi0n](https://www.theiphonewiki.com/wiki/Evasi0n)
- [evasi0n7](https://www.theiphonewiki.com/wiki/Evasi0n7)
- [Pangu](https://www.theiphonewiki.com/wiki/Pangu)
- [p0sixspwn](https://www.theiphonewiki.com/wiki/p0sixspwn)
- [unthredeh4il](https://www.theiphonewiki.com/wiki/Unthredera1n#unthredeh4il)

28
resources/blobs.sh
View File

@ -53,3 +53,31 @@ SaveOTABlobs() {
Log "Successfully saved $OSVer blobs."
fi
}
Save712Blobs() {
local SHSHChk
SHSH="${UniqueChipID}-${ProductType}-${OSVer}.shsh"
SHSH7="${UniqueChipID}-${ProductType}-7.1.2.shsh"
BuildManifest="BuildManifest_${ProductType}_7.1.2.plist"
if [[ ! -e resources/manifests/$BuildManifest ]]; then
Log "Extracting BuildManifest from 7.1.2 IPSW..."
unzip -o -j $IPSW7.ipsw BuildManifest.plist -d .
mv BuildManifest.plist resources/manifests/$BuildManifest
fi
if [[ -e saved/shsh/$SHSH7 ]]; then
Log "Found existing saved 7.1.2 blobs."
else
Log "Saving 7.1.2 blobs with tsschecker..."
$tsschecker -d $ProductType -i 7.1.2 -e $UniqueChipID -m resources/manifests/BuildManifest_${ProductType}_7.1.2.plist -s -b
SHSHChk=$(ls ${UniqueChipID}_${ProductType}_7.1.2-11D257_*.shsh2)
[[ ! $SHSHChk ]] && Error "Saving $OSVer blobs failed. Please run the script again"
mkdir saved/shsh 2>/dev/null
mv $SHSHChk saved/shsh/$SHSH7
Log "Successfully saved 7.1.2 blobs."
fi
mkdir shsh
cp saved/shsh/$SHSH7 shsh/$SHSH
}

23
resources/depends.sh
View File

@ -3,6 +3,7 @@
SetToolPaths() {
local Detect="Detected libimobiledevice and libirecovery installed from "
MPath="./resources/libimobiledevice_"
cherrymac="./resources/ch3rryflower/Tools/macos/UNTETHERED"
if [[ $OSTYPE == "linux"* ]]; then
. /etc/os-release 2>/dev/null
@ -10,8 +11,10 @@ SetToolPaths() {
platformver="$PRETTY_NAME"
MPath+="$platform"
bspatch="$(which bspatch)"
cherry="./resources/ch3rryflower/Tools/ubuntu/UNTETHERED"
futurerestore="./resources/tools/futurerestore_linux"
python="$(which python2)"
xmlstarlet="$(which xmlstarlet)"
zenity="$(which zenity)"
elif [[ $OSTYPE == "darwin"* ]]; then
@ -32,24 +35,30 @@ SetToolPaths() {
fi
[[ -n $Detect ]] && Log "$Detect"
bspatch="/usr/bin/bspatch"
cherry="$cherrymac"
futurerestore="./resources/tools/futurerestore_macos_$(uname -m)"
[[ ! -e $futurerestore ]] && futurerestore="./resources/tools/futurerestore_macos_arm64"
ipwnder32="./resources/tools/ipwnder32_macos"
ipwnder_lite="./resources/tools/ipwnder_macos"
python="/usr/bin/python"
xmlstarlet=/
zenity="./resources/tools/zenity_macos"
fi
expect="$(which expect)"
git="$(which git)"
ideviceenterrecovery="$MPath/ideviceenterrecovery"
ideviceinfo="$MPath/ideviceinfo"
idevicerestore="./resources/tools/idevicerestore_$platform"
iproxy="$MPath/iproxy"
ipsw="../resources/tools/ipsw_$platform"
ipwndfu="$python ipwndfu"
irecoverychk="$MPath/irecovery"
irecovery="$irecoverychk"
irecovery2="../tools/irecovery_$platform"
partialzip="./resources/tools/partialzip_$platform"
ping="ping -c1"
pwnedDFU="$cherry/pwnedDFU"
rmsigchks="$python rmsigchks.py"
SimpleHTTPServer="$python -m SimpleHTTPServer 8888"
SSH="-F ./resources/ssh_config"
@ -59,9 +68,13 @@ SetToolPaths() {
if [[ $platform == "linux" ]]; then
# these need to run as root for device detection
expect="sudo $expect"
futurerestore="sudo $futurerestore"
idevicerestore="sudo LD_LIBRARY_PATH=./resources/lib $idevicerestore"
ipwndfu="sudo $ipwndfu"
irecovery="sudo LD_LIBRARY_PATH=./resources/lib $irecovery"
irecovery2="sudo LD_LIBRARY_PATH=./resources/lib $irecovery2"
pwnedDFU="sudo $pwnedDFU"
rmsigchks="sudo $rmsigchks"
elif [[ $platform == "macos" ]]; then
# for macOS 12.3 and newer
@ -106,7 +119,9 @@ InstallDepends() {
mkdir resources/lib tmp 2>/dev/null
cd resources
cp lib/*.so.1.1 ../tmp
rm -rf ipwndfu lib/*
cp ../tmp/*.so.1.1 lib/
cd ../tmp
Log "Installing dependencies..."
@ -127,17 +142,17 @@ InstallDepends() {
fi
if [[ $ID == "arch" || $ID_LIKE == "arch" || $ID == "artix" ]]; then
sudo pacman -Sy --noconfirm --needed base-devel bsdiff curl libimobiledevice openssh python2 unzip usbutils zenity
sudo pacman -Sy --noconfirm --needed base-devel bsdiff curl expect libimobiledevice openssh python2 unzip usbutils vim xmlstarlet zenity
elif [[ -n $UBUNTU_CODENAME && $VERSION_ID == "2"* ]] ||
(( DebianVer >= 11 )) || [[ $DebianVer == "sid" ]]; then
[[ -n $UBUNTU_CODENAME ]] && sudo add-apt-repository -y universe
sudo apt update
sudo apt install -y bsdiff curl git libimobiledevice6 openssh-client python2 unzip usbmuxd usbutils zenity
sudo apt install -y bsdiff curl expect git libimobiledevice6 openssh-client python2 unzip usbmuxd usbutils xmlstarlet xxd zenity
elif [[ $ID == "fedora" ]] && (( VERSION_ID >= 33 )); then
ln -sf /usr/lib64/libbz2.so.1.* ../resources/lib/libbz2.so.1.0
sudo dnf install -y bsdiff git libimobiledevice perl-Digest-SHA python2 zenity
sudo dnf install -y bsdiff expect git libimobiledevice perl-Digest-SHA python2 vim-common xmlstarlet zenity
elif [[ $ID == "opensuse-tumbleweed" || $PRETTY_NAME == "openSUSE Leap 15.3" ]]; then
if [[ $ID == "opensuse-tumbleweed" ]]; then
@ -146,7 +161,7 @@ InstallDepends() {
libimobiledevice="libimobiledevice6"
ln -sf /lib64/libreadline.so.7 ../resources/lib/libreadline.so.8
fi
sudo zypper -n in bsdiff curl git $libimobiledevice python-base zenity
sudo zypper -n in bsdiff curl expect git $libimobiledevice python-base vim xmlstarlet zenity
elif [[ $platform == "macos" ]]; then
xcode-select --install

124
resources/device.sh
View File

@ -9,6 +9,8 @@ FindDevice() {
USB=1227
elif [[ $1 == "Recovery" ]]; then
USB=1281
elif [[ $1 == "Restore" ]]; then
USB=1297
fi
[[ -n $2 ]] && Timeout=5
@ -16,6 +18,9 @@ FindDevice() {
while (( i < Timeout )); do
if [[ $platform == "linux" ]]; then
DeviceIn=$(lsusb | grep -c "05ac:$USB")
elif [[ $1 == "Restore" ]]; then
ideviceinfo2=$($ideviceinfo -s)
[[ $? == 0 ]] && DeviceIn=1
else
[[ $($irecovery -q 2>/dev/null | grep -w "MODE" | cut -c 7-) == "$1" ]] && DeviceIn=1
fi
@ -133,6 +138,10 @@ GetDeviceValues() {
BasebandURL=$(cat $Firmware/11D257/url)
Baseband="ICE3_04.12.09_BOOT_02.13.Release.bbfw"
BasebandSHA1="007365a5655ac2f9fbd1e5b6dba8f4be0513e364"
if [[ $ProductType == "iPhone3,1" ]]; then
Log "iPhone 4 GSM detected. iPhone4Down functions enabled."
Echo "* This script uses ch3rryflower by dora2iOS"
fi
elif [[ $ProductType == "iPad2"* || $ProductType == "iPad3"* || $ProductType == "iPad4,1" ||
$ProductType == "iPad4,4" || $ProductType == "iPod5,1" ]]; then
@ -143,8 +152,10 @@ GetDeviceValues() {
if [[ $ProductType == "iPhone3"* ]]; then
DeviceProc=4
Log "$ProductType detected. Your device does not support OTA downgrades."
Echo "* Functions will be limited to entering kDFU and restoring with blobs."
if [[ $ProductType != "iPhone3,1" ]]; then
Log "$ProductType detected. Your device is not supported by ch3rryflower."
Echo "* Functions will be limited to entering kDFU and restoring with blobs."
fi
elif [[ $ProductType == "iPad2"* || $ProductType == "iPad3,1" || $ProductType == "iPad3,2" ||
$ProductType == "iPad3,3" || $ProductType == "iPhone4,1" || $ProductType == "iPod5,1" ]]; then
DeviceProc=5
@ -190,8 +201,9 @@ EnterPwnDFU() {
local pwnDFUDevice
local pwnD=1
if [[ $platform == "macos" ]]; then
if [[ $platform == "macos" || $ProductType == "iPhone3,1" ]]; then
Selection=("ipwnder_lite" "iPwnder32")
[[ $ProductType == "iPhone3,1" ]] && Selection=("pwnedDFU" "ipwndfu")
Input "PwnDFU Tool Option"
Echo "* This option selects what tool to use to put your device in pwnDFU mode."
Echo "* If unsure, select 1. Select 2 if 1 does not work."
@ -201,6 +213,8 @@ EnterPwnDFU() {
case $opt in
"ipwnder_lite" ) pwnDFUTool="$ipwnder_lite"; break;;
"iPwnder32" ) pwnDFUTool="$ipwnder32"; break;;
"ipwndfu" ) pwnDFUTool="ipwndfu"; break;;
"pwnedDFU" ) pwnDFUTool="$pwnedDFU"; break;;
esac
done
else
@ -360,3 +374,107 @@ kDFU() {
Echo "* Press TOP or HOME button when the device disconnects and its screen goes black"
FindDevice "DFU"
}
Remove4() {
Input "Select option:"
select opt in "Disable exploit" "Enable exploit" "(Any other key to exit)"; do
case $opt in
"Disable exploit" ) Rec=0; break;;
"Enable exploit" ) Rec=2; break;;
* ) exit 0;;
esac
done
if [[ ! -e saved/iPhone3,1/iBSS_8L1 ]]; then
Log "Downloading iBSS..."
$partialzip http://appldnld.apple.com/iPhone4/041-1966.20110721.V3Ufe/iPhone3,1_4.3.5_8L1_Restore.ipsw Firmware/dfu/iBSS.n90ap.RELEASE.dfu iBSS
mkdir -p saved/iPhone3,1 2>/dev/null
cp iBSS saved/iPhone3,1/iBSS_8L1
mv iBSS tmp
else
cp saved/iPhone3,1/iBSS_8L1 tmp/iBSS
fi
Log "Patching iBSS..."
$bspatch tmp/iBSS tmp/pwnediBSS resources/patches/iBSS.n90ap.8L1.patch
Log "Booting iBSS..."
$pwnedDFU -f tmp/pwnediBSS
sleep 2
Log "Running commands..."
$irecovery -c "setenv boot-partition $Rec"
$irecovery -c "saveenv"
$irecovery -c "setenv auto-boot true"
$irecovery -c "saveenv"
$irecovery -c "reset"
Log "Done!"
Echo "* If disabling the exploit did not work and the device is getting stuck after restore:"
Echo "* You may try another method for clearing NVRAM. See the \"Troubleshooting\" wiki page for more details"
}
Ramdisk4() {
Ramdisk=(
058-1056-002.dmg
DeviceTree.n90ap.img3
iBEC.n90ap.RELEASE.dfu
iBSS.n90ap.RELEASE.dfu
kernelcache.release.n90
)
Echo "Mode: Ramdisk"
Echo "* This uses files and script from 4tify by Zurac-Apps"
Echo "* Make sure that your device is already in DFU mode"
if [[ ! -d resources/ramdisk ]]; then
JailbreakLink=https://github.com/Zurac-Apps/4tify/raw/ad319e2774f54dc3a355812cc287f39f7c38cc66
cd tmp
mkdir ramdisk
cd ramdisk
Log "Downloading ramdisk files from 4tify repo..."
for file in "${Ramdisk[@]}"; do
curl -L $JailbreakLink/support_files/7.1.2/Ramdisk/$file -o $file
done
cd ..
cp -rf ramdisk ../resources
cd ..
fi
cd resources/ramdisk
Log "Sending iBSS..."
$irecovery2 -f iBSS.n90ap.RELEASE.dfu
sleep 2
Log "Sending iBEC..."
$irecovery2 -f iBEC.n90ap.RELEASE.dfu
FindDevice "Recovery" error
Log "Booting..."
$expect -c "
spawn $irecovery2 -s
expect \"iRecovery>\"
send \"/send DeviceTree.n90ap.img3\r\"
expect \"iRecovery>\"
send \"devicetree\r\"
expect \"iRecovery>\"
send \"/send 058-1056-002.dmg\r\"
expect \"iRecovery>\"
send \"ramdisk\r\"
expect \"iRecovery>\"
send \"/send kernelcache.release.n90\r\"
expect \"iRecovery>\"
send \"bootx\r\"
expect \"iRecovery>\"
send \"/exit\r\"
expect eof"
cd ../..
FindDevice "Restore" error
Log "Device should now be in SSH ramdisk mode."
echo
Echo "* To access SSH ramdisk, run iproxy first:"
Echo " iproxy 2022 22"
Echo "* Then SSH to 127.0.0.1:2022"
Echo " ssh -p 2022 -oHostKeyAlgorithms=+ssh-rsa root@127.0.0.1"
Echo "* Enter root password: alpine"
Echo "* Mount filesystems with these commands:"
Echo " mount_hfs /dev/disk0s1s1 /mnt1"
Echo " mount_hfs /dev/disk0s1s2 /mnt1/private/var"
}

34
resources/downgrade.sh
View File

@ -121,3 +121,37 @@ Downgrade() {
fi
DowngradeOTA
}
iDeviceRestore() {
Log "Proceeding to idevicerestore..."
Echo "* Enter your user password when prompted"
[[ $platform == "macos" ]] && sudo codesign --sign - --force --deep $idevicerestore
[[ $1 == "latest" ]] && ExtraArgs="-ey" || ExtraArgs="-ewy"
$idevicerestore $ExtraArgs "$IPSWRestore.ipsw"
if [[ $platform == "macos" && $? != 0 ]]; then
Log "An error seems to have occurred in idevicerestore."
Echo "* If this is the \"Killed: 9\" error or similar, try these steps:"
Echo "* Using Terminal, cd to where the script is located, then run"
Echo "* sudo codesign --sign - --force --deep resources/tools/idevicerestore_macos"
else
echo
Log "Restoring done!"
fi
Log "Downgrade script done!"
}
Downgrade4() {
JailbreakOption
IPSWFindVerify
Save712Blobs
if [[ $OSVer == "7.1.2" && $Jailbreak != 1 ]]; then
IPSWSetExtract
iDeviceRestore latest
return
else
IPSWFindVerify 712
fi
IPSW4
IPSWSetExtract
iDeviceRestore
}

143
resources/firmware/FirmwareBundles/Down_iPhone3,1_7.1.2_11D257.bundle/Info.plist Normal file
View File

@ -0,0 +1,143 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC -//Apple Computer//DTD PLIST 1.0//EN http://www.apple.com/DTDs/PropertyList-1.0.dtd>
<plist version="1.0">
<dict>
<key>FilesystemPatches</key>
<dict/>
<key>FirmwarePatches</key>
<dict>
<key>RestoreKernelCache</key>
<dict>
<key>File</key>
<string>kernelcache.release.n90</string>
<key>IV</key>
<string>a1aee41423e11a44135233dd345433ce</string>
<key>Key</key>
<string>9b05ef79c63c59e71f253219ffaa952f25f6810d3863aac2b49628e64f9f0869</string>
<!--key>Patch</key>
<string>kernelcache.release.patch</string-->
<key>DecryptPath</key>
<string>Downgrade/kernelcache.release.n90</string>
<key>TypeFlag</key>
<integer>4</integer>
</dict>
<!--key>Update Ramdisk</key>
<dict>
<key>File</key>
<string>058-4266-010.dmg</string>
<key>IV</key>
<string>6f634978ee1d464dd30d9b49c72d62d9</string>
<key>Key</key>
<string>276e895192154e7903711a9aaa3444177c92f1c79e6cc58051429ce52e2d1beb</string>
<key>TypeFlag</key>
<integer>8</integer>
</dict-->
<key>Restore Ramdisk</key>
<dict>
<key>File</key>
<string>058-4107-013.dmg</string>
<key>IV</key>
<string>4bd50f8abb89925f20793baac84ad76b</string>
<key>Key</key>
<string>23582ce84d0149c1819b72948c6a55a155c1fa4366678a9e51a6f66f5a77de10</string>
<key>Decrypt</key>
<true/>
<key>TypeFlag</key>
<integer>8</integer>
</dict>
<key>iBSS</key>
<dict>
<key>File</key>
<string>Firmware/dfu/iBSS.n90ap.RELEASE.dfu</string>
<key>IV</key>
<string>a5854328e525031dc205d6e476a8b1bb</string>
<key>Key</key>
<string>23dda7990807b4225d589dc11099a4a8bd122089b93759d6356e9525f986584c</string>
<key>Patch</key>
<string>iBSS.n90ap.RELEASE.patch</string>
<key>Decrypt</key>
<true/>
<key>TypeFlag</key>
<integer>8</integer>
</dict>
<key>iBEC</key>
<dict>
<key>File</key>
<string>Firmware/dfu/iBEC.n90ap.RELEASE.dfu</string>
<key>IV</key>
<string>ca528426065da305c19476477a39ed18</string>
<key>Key</key>
<string>3273904a1cfd111a20d6a53f2636902db1193dad5f0acf3837dd7c79fb3b795f</string>
<key>Patch</key>
<string>iBEC.n90ap.RELEASE.patch</string>
<key>Decrypt</key>
<true/>
<key>TypeFlag</key>
<integer>8</integer>
</dict>
<key>RestoreDeviceTree</key>
<dict>
<key>File</key>
<string>Firmware/all_flash/all_flash.n90ap.production/DeviceTree.n90ap.img3</string>
<key>IV</key>
<string>d2f224a2d7e04461ec12ac81f91d657a</string>
<key>Key</key>
<string>b93c3a564dc36e184871e246fa8df725ecebafb38c042b6302b333c39e7d1787</string>
<key>DecryptPath</key>
<string>Downgrade/DeviceTree.n90ap.img3</string>
</dict>
<key>RestoreLogo</key>
<dict>
<key>File</key>
<string>Firmware/all_flash/all_flash.n90ap.production/applelogo@2x~iphone.s5l8930x.img3</string>
<key>IV</key>
<string>2287b716b833ba84566cf365e3368d37</string>
<key>Key</key>
<string>73f0cef0f12ed5e43b53c87373a2be672481c4fc0f1f542c5e8da8b7d518611f</string>
<key>DecryptPath</key>
<string>Downgrade/applelogo@2x~iphone.s5l8930x.img3</string>
</dict>
</dict>
<key>RamdiskPatches</key>
<dict>
<key>asr</key>
<dict>
<key>File</key>
<string>usr/sbin/asr</string>
<key>Patch</key>
<string>asr.patch</string>
</dict>
<!--key>restored_external</key>
<dict>
<key>File</key>
<string>usr/local/bin/restored_external</string>
<key>Patch</key>
<string>restored.patch</string>
</dict-->
</dict>
<key>RamdiskMountVolume</key>
<string>ramdisk</string>
<key>RamdiskOptionsPath</key>
<string>/usr/local/share/restore/options.n90.plist</string>
<key>RootFilesystem</key>
<string>058-4520-010.dmg</string>
<key>RootFilesystemSize</key>
<integer>1531</integer>
<key>RootFilesystemKey</key>
<string>38d0320d099b9dd34ffb3308c53d397f14955b347d6a433fe173acc2ced1ae78756b3684</string>
<key>RootFilesystemMountVolume</key>
<string>Sochi11D257.N90OS</string>
<key>SHA1</key>
<string>81da17b3e893a61508fe203849b7e1f60e2127b1</string>
<key>Filename</key>
<string>iPhone3,1_7.1.2_11D257_Restore.ipsw</string>
<key>Name</key>
<string>iPhone3,1_7.1.2_11D257</string>
<key>DownloadUrl</key>
<string></string>
<key>Platform</key>
<integer>1</integer>
<key>SubPlatform</key>
<integer>6</integer>
</dict>
</plist>

BIN
resources/firmware/FirmwareBundles/Down_iPhone3,1_7.1.2_11D257.bundle/asr.patch Normal file
View File

Binary file not shown.

BIN
resources/firmware/FirmwareBundles/Down_iPhone3,1_7.1.2_11D257.bundle/iBEC.n90ap.RELEASE.patch Normal file
View File

Binary file not shown.

BIN
resources/firmware/FirmwareBundles/Down_iPhone3,1_7.1.2_11D257.bundle/iBSS.n90ap.RELEASE.patch Normal file
View File

Binary file not shown.

1
resources/firmware/iPhone3,1/10A403/sha1sum Normal file
View File

@ -0,0 +1 @@
c98ac468d86c4d8aaaf878c6ba97db79659d48cc

1
resources/firmware/iPhone3,1/10A403/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS6/Restore/041-7175.20120919.wvv7Y/iPhone3,1_6.0_10A403_Restore.ipsw

1
resources/firmware/iPhone3,1/10A523/sha1sum Normal file
View File

@ -0,0 +1 @@
04bba84a98b248400c159164a8ea247f12eeb5ea

1
resources/firmware/iPhone3,1/10A523/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS6/041-7950.20121101.Lmr45/iPhone3,1_6.0.1_10A523_Restore.ipsw

1
resources/firmware/iPhone3,1/10B144/sha1sum Normal file
View File

@ -0,0 +1 @@
2dcaae314ae8e0a353ad43010159cf15f7f6bd4e

1
resources/firmware/iPhone3,1/10B144/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS6.1/091-0682.20130128.mefc4/iPhone3,1_6.1_10B144_Restore.ipsw

1
resources/firmware/iPhone3,1/10B146/sha1sum Normal file
View File

@ -0,0 +1 @@
b62c043338898893c210bb81e608b4b099de7c5f

1
resources/firmware/iPhone3,1/10B146/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS6.1/091-0722.20130215.BzrgV/iPhone3,1_6.1.2_10B146_Restore.ipsw

1
resources/firmware/iPhone3,1/10B329/sha1sum Normal file
View File

@ -0,0 +1 @@
f8c53328656f2708e1d2bcb793f12ae46dd4eb23

1
resources/firmware/iPhone3,1/10B329/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS6.1/091-2610.20130319.Bedr4/iPhone3,1_6.1.3_10B329_Restore.ipsw

1
resources/firmware/iPhone3,1/11A465/sha1sum Normal file
View File

@ -0,0 +1 @@
c4e75b4c2be8480c1b61cd1f1a0c9c3291b03db7

1
resources/firmware/iPhone3,1/11A465/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS7/091-9485.20130918.Xa98u/iPhone3,1_7.0_11A465_Restore.ipsw

1
resources/firmware/iPhone3,1/11A501/sha1sum Normal file
View File

@ -0,0 +1 @@
d4d085097955b64a9c2722531282e708027dd263

1
resources/firmware/iPhone3,1/11A501/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS7/091-9871.20130924.7imYu/iPhone3,1_7.0.2_11A501_Restore.ipsw

1
resources/firmware/iPhone3,1/11B511/sha1sum Normal file
View File

@ -0,0 +1 @@
5fb262e82c64ca5ed0cf4773f283a83b1f8b4969

1
resources/firmware/iPhone3,1/11B511/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS7/031-1038.20131022.Llkit/iPhone3,1_7.0.3_11B511_Restore.ipsw

1
resources/firmware/iPhone3,1/11B554a/sha1sum Normal file
View File

@ -0,0 +1 @@
964c2e3e152cc4ca3efe4cedbc71aa7b06350555

1
resources/firmware/iPhone3,1/11B554a/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS7/031-1831.20131114.P3wE4/iPhone3,1_7.0.4_11B554a_Restore.ipsw

1
resources/firmware/iPhone3,1/11B651/sha1sum Normal file
View File

@ -0,0 +1 @@
7fee14771f451dbb5c64d536b521ff199f6c6cd9

1
resources/firmware/iPhone3,1/11B651/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS7/031-3020.20140221.8j5GW/iPhone3,1_7.0.6_11B651_Restore.ipsw

1
resources/firmware/iPhone3,1/11D169/sha1sum Normal file
View File

@ -0,0 +1 @@
c657505db208a73a5e27708816b87e8be3997d9a

1
resources/firmware/iPhone3,1/11D169/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS7.1/031-4639.20140310.Pvdbt/iPhone3,1_7.1_11D169_Restore.ipsw

1
resources/firmware/iPhone3,1/11D201/sha1sum Normal file
View File

@ -0,0 +1 @@
49469a01e7c3ffbbd0432610f4b44741623527a4

1
resources/firmware/iPhone3,1/11D201/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS7.1/031-00357.20140425.ZFJJw/iPhone3,1_7.1.1_11D201_Restore.ipsw

1
resources/firmware/iPhone3,1/11D257/sha1sum Normal file
View File

@ -0,0 +1 @@
81da17b3e893a61508fe203849b7e1f60e2127b1

1
resources/firmware/iPhone3,1/8F190/sha1sum Normal file
View File

@ -0,0 +1 @@
5bfffd6a3b4dedd093aa2fbc0c8e6048aaadac8a

1
resources/firmware/iPhone3,1/8F190/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iPhone4/041-0330.20110311.Cswe3/iPhone3,1_4.3_8F190_Restore.ipsw

1
resources/firmware/iPhone3,1/8J2/sha1sum Normal file
View File

@ -0,0 +1 @@
7dcfd428d08e089f41ceb984ad0ce57d374fde04

1
resources/firmware/iPhone3,1/8J2/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iPhone4/041-1011.20110503.q7fGc/iPhone3,1_4.3.3_8J2_Restore.ipsw

1
resources/firmware/iPhone3,1/8L1/sha1sum Normal file
View File

@ -0,0 +1 @@
7099307319c669356955e9aff11a3129d6b8d8b4

1
resources/firmware/iPhone3,1/8L1/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iPhone4/041-1966.20110721.V3Ufe/iPhone3,1_4.3.5_8L1_Restore.ipsw

1
resources/firmware/iPhone3,1/9A334/sha1sum Normal file
View File

@ -0,0 +1 @@
8f070dc74f5dae469d655d8795fbc7cd13466f01

1
resources/firmware/iPhone3,1/9A334/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iPhone4/041-8358.20111012.FFc34/iPhone3,1_5.0_9A334_Restore.ipsw

1
resources/firmware/iPhone3,1/9A405/sha1sum Normal file
View File

@ -0,0 +1 @@
b2e14e3bc98f41641455c8b6c23e484489604f87

1
resources/firmware/iPhone3,1/9A405/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iPhone4/041-3309.20111109.64rtg/iPhone3,1_5.0.1_9A405_Restore.ipsw

1
resources/firmware/iPhone3,1/9B176/sha1sum Normal file
View File

@ -0,0 +1 @@
ed0ffe5ad5e63fe3a977a1ffe49bedbe2dcffd89

1
resources/firmware/iPhone3,1/9B176/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS5/041-1537.20120307.EJrm4/iPhone3,1_5.1_9B176_Restore.ipsw

1
resources/firmware/iPhone3,1/9B206/sha1sum Normal file
View File

@ -0,0 +1 @@
ee79420677fd12d1f11181ddb1e775f64d426a7c

1
resources/firmware/iPhone3,1/9B206/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS5.1.1/041-4293.20120427.3DRyb/iPhone3,1_5.1.1_9B206_Restore.ipsw

1
resources/firmware/iPhone3,1/9B208/sha1sum Normal file
View File

@ -0,0 +1 @@
1209f57051f675d0328c08a894b073589f9eeb20

1
resources/firmware/iPhone3,1/9B208/url Normal file
View File

@ -0,0 +1 @@
http://appldnld.apple.com/iOS5.1.1/041-6051.2012.0525.Cvby7/iPhone3,1_5.1.1_9B208_Restore.ipsw

175
resources/ipsw.sh
View File

@ -27,8 +27,16 @@ JailbreakSet() {
elif [[ $OSVer == "8.4.1" ]]; then
JBName="EtasonJB"
IPSWCustom="${IPSWCustom}E"
elif [[ $OSVer == "7.1"* ]]; then
JBName="Pangu7"
elif [[ $OSVer == "7"* ]]; then
JBName="evasi0n7"
elif [[ $OSVer == "6.1.3" ]]; then
JBName="p0sixspwn"
elif [[ $OSVer == "6"* ]]; then
JBName="evasi0n"
else
JBName="unthredeh4il"
fi
Log "Using $JBName for the jailbreak"
}
@ -49,7 +57,22 @@ JailbreakOption() {
Log "Jailbreak option disabled by user."
fi
[[ -z $IPSWCustom ]] && IPSWCustom="${IPSWType}_${OSVer}_${BuildVer}_Custom"=
Echo "* This option is enabled by default (Y)."
read -p "$(Input 'Enable this option? (Y/n):')" Jailbreak
if [[ $Jailbreak != 'N' && $Jailbreak != 'n' ]]; then
JailbreakSet
Log "Jailbreak option enabled."
else
Log "Jailbreak option disabled by user."
fi
[[ -z $IPSWCustom ]] && IPSWCustom="${IPSWType}_${OSVer}_${BuildVer}_Custom"
if [[ $ProductType == "iPhone3"* ]]; then
[[ $Jailbreak == 1 ]] && Custom="Custom" || Custom="CustomN"
IPSWCustom="${ProductType}_${OSVer}_${BuildVer}_${Custom}"
[[ $OSVer == 4.3* ]] && IPSWCustom="$IPSWCustom-$UniqueChipID"
fi
echo
if [[ $Jailbreak != 1 ]]; then
@ -72,9 +95,15 @@ JailbreakOption() {
IPSWFindVerify() {
IPSW="${IPSWType}_${OSVer}_${BuildVer}_Restore"
IPSW7="${ProductType}_7.1.2_11D257_Restore"
local IPSWDL=$IPSW
local OSVerDL=$OSVer
local BuildVerDL=$BuildVer
if [[ $1 == 712 ]]; then
IPSWDL=$IPSW7
OSVerDL="7.1.2"
BuildVerDL="11D257"
fi
if [[ -e "$IPSWCustom.ipsw" ]]; then
Log "Found existing Custom IPSW. Skipping $OSVerDL IPSW verification."
@ -190,3 +219,149 @@ IPSW32() {
"You may try selecting N for memory option"
fi
}
IPSW4() {
if [[ -e $IPSWCustom.ipsw ]]; then
Log "Found existing Custom IPSW. Skipping IPSW creation."
return
fi
if [[ $OSVer == 7.1.1 ]]; then
IV=b110991061d76f74c1fc05ddd7cff540
Key=c6fbf428e0105ab22b2abaefd20ca22c2084e200f74e8a3b08298a54f8bfe28f
elif [[ $OSVer == 7.1 ]]; then
IV=9fe5b6785126c8fc5787582df9efcf94
Key=b68612f21e377bd1f685e9031be159a724e931eff162db245c63b7b692cefa7e
elif [[ $OSVer == 7.0.6 ]]; then
IV=12af3a975f0346e89d3a34e73b4e0ae1
Key=d7b5bb9b90f19493449ab17fda63afdb16069ad5b65026bb11b4db223fdd4be1
elif [[ $OSVer == 7.0.4 ]]; then
IV=67087ac7f28c77cdf9110356f476540b
Key=2a6940252b5cb19b86efb9005cdd5fd713290e573dc760f5a3e05df9e868bb89
elif [[ $OSVer == 7.0.3 ]]; then
IV=7cb97df787dcc6367816b03492b225f9
Key=bd56f0886e21f233f519d4db20fd044b9208882a6fb791553a75eb4e0c45bbc5
elif [[ $OSVer == 7.0.2 ]]; then
IV=65db9a4e4f64bb79a55d76d98ce1457b
Key=5cd910c268813cb4008e5b33e01f761c0794ed1437737b4d386727d17fac79d1
elif [[ $OSVer == 7.0 ]]; then
IV=5bf099d9db5cf1009329e527a378c8be
Key=e1fef31c8aabcdca2a3887ba21c0e2113c41a5617380657ab6a487993b39f9a8
elif [[ $OSVer == 6.1.3 ]]; then
IV=b559a2c7dae9b95643c6610b4cf26dbd
Key=3dbe8be17af793b043eed7af865f0b843936659550ad692db96865c00171959f
elif [[ $OSVer == 6.1.2 ]]; then
IV=c939629e3473fdb67deae0c45582506d
Key=cbcd007712618cb6ab3be147f0317e22e7cceadb344e99ea1a076ef235c2c534
elif [[ $OSVer == 6.1 ]]; then
IV=4d76b7e25893839cfca478b44ddef3dd
Key=891ed50315763dac51434daeb8543b5975a555fb8388cc578d0f421f833da04d
elif [[ $OSVer == 6.0.1 ]]; then
IV=44ffe675d6f31167369787a17725d06c
Key=8d539232c0e906a9f60caa462f189530f745c4abd81a742b4d1ec1cb8b9ca6c3
elif [[ $OSVer == 6.0 ]]; then
IV=7891928b9dd0dd919778743a2c8ec6b3
Key=838270f668a05a60ff352d8549c06d2f21c3e4f7617c72a78d82c92a3ad3a045
elif [[ $BuildVer == 9B206 ]]; then
IV=b1846de299191186ce3bbb22432eca12
Key=e8e26976984e83f967b16bdb3a65a3ec45003cdf2aaf8d541104c26797484138
elif [[ $BuildVer == 9B208 ]]; then
IV=71fe96da25812ff341181ba43546ea4f
Key=6377d34deddf26c9b464f927f18b222be75f1b5547e537742e7dfca305660fea
elif [[ $OSVer == 5.1 ]]; then
IV=b1846de299191186ce3bbb22432eca12
Key=e8e26976984e83f967b16bdb3a65a3ec45003cdf2aaf8d541104c26797484138
elif [[ $OSVer == 5.0.1 ]]; then
IV=49eb54980a0024f91b079faf0ee87f67
Key=c3a49f0059075e1453dacec4c3e4d89bd7a433ee19c8d48e4695d89b4c84a373
elif [[ $OSVer == 5.0 ]]; then
IV=15dd404efbb24a842d08dcde21e777a0
Key=71614af73814c3a8e6724d592ecfccdbace766dad5eb39b0b8313387e94d2964
elif [[ $OSVer == 4.3.5 ]]; then
IV=986032eecd861c37ca2a86b6496a3c0d
Key=b4e300c54a9dd2e648ead50794e9bf2205a489c310a1c70a9fae687368229468
ios4="-ios4"
elif [[ $OSVer == 4.3.3 ]]; then
IV=bb3fc29dd226fac56086790060d5c744
Key=c2ead1d3b228a05b665c91b4b1ab54b570a81dffaf06eaf1736767bcb86e50de
ios4="-ios433"
elif [[ $OSVer == 4.3 ]]; then
IV=9f11c07bde79bdac4abb3f9707c4b13c
Key=0958d70e1a292483d4e32ed1e911d2b16b6260856be67d00a33b6a1801711d32
ios4="-ios433"
fi
if [[ $Jailbreak == 1 ]]; then
if [[ $OSVer == 7.1* ]]; then
JBFiles=(Cydia7.tar panguaxe.tar fstab7.tar)
JBSHA1=bba5022d6749097f47da48b7bdeaa3dc67cbf2c4
elif [[ $OSVer == 7.* ]]; then
JBFiles=(Cydia7.tar evasi0n7-untether.tar fstab7.tar)
JBSHA1=bba5022d6749097f47da48b7bdeaa3dc67cbf2c4
elif [[ $OSVer == 6.1.3 ]]; then
JBFiles=(Cydia6.tar p0sixspwn.tar)
JBSHA1=1d5a351016d2546aa9558bc86ce39186054dc281
elif [[ $OSVer == 6.* ]]; then
JBFiles=(Cydia6.tar evasi0n6-untether.tar)
JBSHA1=1d5a351016d2546aa9558bc86ce39186054dc281
elif [[ $OSVer == 5.* || $OSVer == 4.3* ]]; then
JBFiles=(Cydia5.tar unthredeh4il.tar)
JBSHA1=f5b5565640f7e31289919c303efe44741e28543a
fi
[[ $OSVer != 7.* ]] && JBFiles+=(fstab_rw.tar)
if [[ ! -e resources/jailbreak/${JBFiles[0]} ]]; then
Log "Downloading ${JBFiles[0]}..."
cd tmp
SaveFile https://github.com/LukeZGD/iOS-OTA-Downgrader-Keys/releases/download/jailbreak/${JBFiles[0]} ${JBFiles[0]} $JBSHA1
cp ${JBFiles[0]} ../resources/jailbreak
cd ..
fi
for i in {0..2}; do
JBFiles[$i]=../resources/jailbreak/${JBFiles[$i]}
done
fi
cd tmp
if [[ $OSVer == "7.1.2" && ! -e $IPSWCustom.ipsw ]]; then
Log "Preparing custom IPSW..."
cp -rf ../resources/firmware/FirmwareBundles FirmwareBundles
$ipsw ../$IPSW.ipsw ../$IPSWCustom.ipsw $JBMemory -S 50 ${JBFiles[@]}
elif [[ ! -e $IPSWCustom.ipsw ]]; then
Log "Preparing custom IPSW with ch3rryflower..."
sed -z -i "s|\n../bin|\n../$cherry/bin|g" ../$cherry/make_iBoot.sh
env LD_LIBRARY_PATH=../resources/lib ../$cherry/make_iBoot.sh ../$IPSW.ipsw -iv $IV -k $Key $ios4
cp -rf ../$cherrymac/FirmwareBundles FirmwareBundles
cp -rf ../$cherrymac/src src
env LD_LIBRARY_PATH=../resources/lib ../$cherry/cherry ../$IPSW.ipsw ../$IPSWCustom.ipsw $JBMemory -derebusantiquis ../$IPSW7.ipsw iBoot ${JBFiles[@]}
fi
cd ..
if [[ $OSVer == 4.3* ]]; then
Log "iOS 4 Fix" # From ios4fix
zip -d $IPSWCustom.ipsw Firmware/all_flash/all_flash.n90ap.production/manifest
cd tmp/src/n90ap/Firmware/all_flash/all_flash.n90ap.production
unzip -j ../../../../../../$IPSW.ipsw Firmware/all_flash/all_flash*/applelogo*
mv -v applelogo-640x960.s5l8930x.img3 applelogo4-640x960.s5l8930x.img3
echo "0000010: 34" | xxd -r - applelogo4-640x960.s5l8930x.img3
echo "0000020: 34" | xxd -r - applelogo4-640x960.s5l8930x.img3
if [[ $platform == macos ]]; then
plutil -extract 'APTicket' xml1 ../../../../../../shsh/$UniqueChipID-iPhone3,1-$OSVer.shsh -o 'apticket.plist'
cat apticket.plist | sed -ne '/<data>/,/<\/data>/p' | sed -e "s/<data>//" | sed "s/<\/data>//" | awk '{printf "%s",$0}' | base64 --decode > apticket.der
else
$xmlstarlet sel -t -m "/plist/dict/key[.='APTicket']" -v "following-sibling::data[1]" ../../../../../../shsh/$UniqueChipID-iPhone3,1-$OSVer.shsh > apticket.plist
sed -i -e 's/[ \t]*//' apticket.plist
cat apticket.plist | base64 --decode > apticket.der
fi
env LD_LIBRARY_PATH=../../../../../../resources/lib ../../../../../../$cherry/bin/xpwntool apticket.der applelogoT-640x960.s5l8930x.img3 -t scab_template.img3
cd ../../..
zip -r0 ../../../$IPSWCustom.ipsw Firmware/all_flash/all_flash.n90ap.production/manifest
zip -r0 ../../../$IPSWCustom.ipsw Firmware/all_flash/all_flash.n90ap.production/applelogo4-640x960.s5l8930x.img3
zip -r0 ../../../$IPSWCustom.ipsw Firmware/all_flash/all_flash.n90ap.production/applelogoT-640x960.s5l8930x.img3
cd ../../..
fi
if [[ ! -e $IPSWCustom.ipsw ]]; then
Error "Failed to find custom IPSW. Please run the script again" \
"You may try selecting N for memory option"
fi
}

BIN
resources/jailbreak/evasi0n6-untether.tar Normal file
View File

Binary file not shown.

BIN
resources/jailbreak/evasi0n7-untether.tar Normal file
View File

Binary file not shown.

BIN
resources/jailbreak/fstab7.tar Normal file
View File

Binary file not shown.

BIN
resources/jailbreak/panguaxe.tar Normal file
View File

Binary file not shown.

BIN
resources/jailbreak/unthredeh4il.tar Normal file
View File

Binary file not shown.

BIN
resources/lib/libcrypto.so.1.1 Normal file
View File

Binary file not shown.

BIN
resources/lib/libssl.so.1.1 Normal file
View File

Binary file not shown.

BIN
resources/patches/iBSS.n90ap.8L1.patch Normal file
View File

Binary file not shown.

BIN
resources/tools/idevicerestore_linux Executable file
View File

Binary file not shown.

BIN
resources/tools/idevicerestore_macos Executable file
View File

Binary file not shown.

BIN
resources/tools/irecovery_linux Executable file
View File

Binary file not shown.

BIN
resources/tools/irecovery_macos Executable file
View File

Binary file not shown.

125
restore.sh
View File

@ -102,14 +102,28 @@ Main() {
Clean
mkdir tmp
if [[ $ProductType == "iPhone3,1" && ! -d ./resources/ch3rryflower ]]; then
cd tmp
Log "Downloading ch3rryflower..."
SaveFile https://web.archive.org/web/20210529174714if_/https://codeload.github.com/dora2-iOS/ch3rryflower/zip/316d2cdc5351c918e9db9650247b91632af3f11f ch3rryflower.zip 790d56db354151b9740c929e52c097ba57f2929d
cd ../resources
unzip -q ../tmp/ch3rryflower.zip -d .
mv ch3rryflower* ch3rryflower
cd ..
fi
if [[ -n $1 && $1 != "NoColor" && $1 != "NoDevice" && $1 != "PwnedDevice" ]]; then
Mode="$1"
else
[[ $1 != "NoDevice" ]] && Selection+=("Downgrade Device")
[[ $DeviceProc != 4 ]] && Selection+=("Save OTA Blobs")
if [[ $ProductType == "iPhone3,1" && $1 != "NoDevice" ]]; then
Selection+=("Disable/Enable Exploit" "Restore to 7.1.2" "SSH Ramdisk")
fi
if [[ $DeviceProc != 7 ]]; then
[[ $DeviceProc != 4 ]] && Selection+=("Create Custom IPSW")
Selection+=("Create Custom IPSW")
[[ $DeviceState == "Normal" ]] && Selection+=("Put Device in kDFU Mode")
fi
@ -122,6 +136,9 @@ Main() {
"Save OTA Blobs" ) Mode="SaveOTABlobs"; break;;
"Create Custom IPSW" ) Mode="IPSW32"; break;;
"Put Device in kDFU Mode" ) Mode="kDFU"; break;;
"Disable/Enable Exploit" ) Mode="Remove4"; break;;
"Restore to 7.1.2" ) Mode="Restore712"; break;;
"SSH Ramdisk" ) Mode="Ramdisk4"; break;;
"(Re-)Install Dependencies" ) InstallDepends;;
* ) exit 0;;
esac
@ -129,6 +146,7 @@ Main() {
fi
SelectVersion
[[ $OSVer == "Other" ]] && Mode="Downgrade"
if [[ $Mode == "IPSW32" ]]; then
echo
@ -138,24 +156,34 @@ Main() {
Echo "* If you want to re-create the custom IPSW, move/delete the existing one first."
exit 0
elif [[ $Jailbreak != 1 ]]; then
Log "Creating custom IPSW is not needed for non-jailbroken restores on your device."
exit 0
if [[ $DeviceProc == 4 && $OSVer == "7.1.2" ]]; then
Log "Creating custom IPSW is not needed for non-jailbroken 7.1.2 restores."
exit 0
else
Log "Creating custom IPSW is not needed for non-jailbroken restores on your device."
exit 0
fi
fi
IPSWFindVerify
IPSW32
if [[ $DeviceProc == 4 ]]; then
IPSWFindVerify 712
IPSW4
else
IPSW32
fi
Log "Custom IPSW has been created: $IPSWCustom.ipsw"
Echo "* This custom IPSW has a jailbreak built in ($JBName)"
[[ $Jailbreak == 1 ]] && Echo "* This custom IPSW has a jailbreak built in ($JBName)"
Echo "* Run the script again and select Downgrade Device to use the custom IPSW."
Echo "* You may also use futurerestore manually (make sure to use the latest beta)"
[[ $DeviceProc != 4 ]] && Echo "* You may also use futurerestore manually (make sure to use the latest beta)"
exit 0
elif [[ $Mode != "Downgrade" ]]; then
elif [[ $Mode != "Downgrade"* && $Mode != *"4" ]]; then
$Mode
exit 0
fi
if [[ $DeviceProc == 7 ]]; then
if [[ $Mode == *"4" || $DeviceProc == 7 ]]; then
if [[ $DeviceState == "Normal" ]]; then
Echo "* The device needs to be in recovery/DFU mode before proceeding."
read -p "$(Input 'Send device to recovery mode? (y/N):')" Selection
@ -165,6 +193,10 @@ Main() {
elif [[ $DeviceState == "DFU" ]]; then
EnterPwnDFU
fi
if [[ $Mode == *"4" ]]; then
$Mode
exit 0
fi
elif [[ $DeviceState == "DFU" ]]; then
if [[ $1 != "PwnedDevice" ]]; then
@ -181,15 +213,16 @@ Main() {
Echo "* If you do not know what you are doing, EXIT NOW by pressing Ctrl+C and restart your device in normal mode."
Input "Select the mode that your device is currently in:"
Selection=("kDFU mode")
[[ $DeviceProc == 5 ]] && Selection+=("pwnDFU mode (A5)") || Selection+=("DFU mode (A6)")
[[ $DeviceProc == 5 ]] && Selection+=("pwnDFU mode (A5)") || Selection+=("DFU mode (A4/A6)")
Selection+=("Any other key to exit")
select opt in "${Selection[@]}"; do
case $opt in
"kDFU mode" ) break;;
"DFU mode (A6)" ) EnterPwnDFU; break;;
"DFU mode (A4/A6)" ) EnterPwnDFU; break;;
"pwnDFU mode (A5)" )
Echo "* Make sure that your device is in pwnDFU mode using an Arduino+USB Host Shield!";
Echo "* This option will not work if your device is not in pwnDFU mode.";
Echo "* Sending pwned iBSS is not needed, futurerestore will handle that.";
Input "Press Enter/Return to continue (or press Ctrl+C to cancel)";
read -s;
SendiBSS=1; break;;
@ -215,7 +248,9 @@ Main() {
}
SelectVersion() {
if [[ $Mode == "kDFU" ]]; then
if [[ $Mode == "Downgrade"* ]]; then
:
elif [[ $Mode == "kDFU" || $Mode == *"4" ]]; then
return
elif [[ $ProductType == "iPad4"* || $ProductType == "iPhone6"* ]]; then
OSVer="10.3.3"
@ -233,8 +268,26 @@ SelectVersion() {
$ProductType == "iPad2,3" || $ProductType == "iPhone4,1" ]]; then
Selection+=("iOS 6.1.3")
fi
[[ $Mode == "Downgrade" ]] && Selection+=("Other (use SHSH blobs)")
if [[ $ProductType == "iPhone3,1" ]]; then
[[ $Mode == "IPSW32" ]] && Selection+=("7.1.2")
Selection+=("6.1.3" "5.1.1 (9B208)" "5.1.1 (9B206)" "More versions (5.0-6.1.2)" "4.3.x (not supported)" "7.x (not supported)")
Selection2=("6.1.2" "6.1" "6.0.1" "6.0" "5.1" "5.0.1" "5.0")
Selection3=("7.1.1" "7.1" "7.0.6" "7.0.4" "7.0.3" "7.0.2" "7.0")
if [[ $Mode == "Restore712" ]]; then
Echo "* Make sure to disable the exploit first! See the README for more details."
Input "Press Enter/Return to continue (or press Ctrl+C to cancel)"
read -s
OSVer="7.1.2"
BuildVer="11D257"
Mode="Downgrade4"
return
elif [[ $Mode == "Downgrade" ]]; then
Mode="Downgrade4"
fi
fi
[[ $Mode == "Downgrade"* ]] && Selection+=("Other (use SHSH blobs)")
Selection+=("(Any other key to exit)")
echo
@ -244,9 +297,55 @@ SelectVersion() {
"iOS 8.4.1" ) OSVer="8.4.1"; BuildVer="12H321"; break;;
"iOS 6.1.3" ) OSVer="6.1.3"; BuildVer="10B329"; break;;
"Other (use SHSH blobs)" ) OSVer="Other"; break;;
"7.1.2" ) OSVer="7.1.2"; BuildVer="11D257"; break;;
"6.1.3" ) OSVer="6.1.3"; BuildVer="10B329"; break;;
"5.1.1 (9B208)" ) OSVer="5.1.1"; BuildVer="9B208"; break;;
"5.1.1 (9B206)" ) OSVer="5.1.1"; BuildVer="9B206"; break;;
"More versions (5.0-6.1.2)" ) OSVer="More"; break;;
"4.3.x (not supported)" ) OSVer="4.3.x"; break;;
"7.x (not supported)" ) OSVer="7.x"; break;;
* ) exit 0;;
esac
done
if [[ $OSVer == "More" ]]; then
select opt in "${Selection2[@]}"; do
case $opt in
"6.1.2" ) OSVer="6.1.2"; BuildVer="10B146"; break;;
"6.1" ) OSVer="6.1"; BuildVer="10B144"; break;;
"6.0.1" ) OSVer="6.0.1"; BuildVer="10A523"; break;;
"6.0" ) OSVer="6.0"; BuildVer="10A403"; break;;
"5.1" ) OSVer="5.1"; BuildVer="9B176"; break;;
"5.0.1" ) OSVer="5.0.1"; BuildVer="9A405"; break;;
"5.0" ) OSVer="5.0"; BuildVer="9A334"; break;;
* ) exit 0;;
esac
done
elif [[ $OSVer == "4.3.x" ]]; then
Echo "* I can't verify if iOS 4.3.x works or not, let me know if it does work for you"
select opt in "4.3.5" "4.3.3" "4.3"; do
case $opt in
"4.3.5" ) OSVer="4.3.5"; BuildVer="8L1"; break;;
"4.3.3" ) OSVer="4.3.3"; BuildVer="8J2"; break;;
"4.3" ) OSVer="4.3"; BuildVer="8F190"; break;;
* ) exit 0;;
esac
done
elif [[ $OSVer == "7.x" ]]; then
Echo "* I don't think any iOS 7.x version works (gets stuck in recovery mode)"
select opt in "${Selection3[@]}"; do
case $opt in
"7.1.1" ) OSVer="7.1.1"; BuildVer="11D201"; break;;
"7.1" ) OSVer="7.1"; BuildVer="11D169"; break;;
"7.0.6" ) OSVer="7.0.6"; BuildVer="11B651"; break;;
"7.0.4" ) OSVer="7.0.4"; BuildVer="11B554a"; break;;
"7.0.3" ) OSVer="7.0.3"; BuildVer="11B511"; break;;
"7.0.2" ) OSVer="7.0.2"; BuildVer="11A501"; break;;
"7.0" ) OSVer="7.0"; BuildVer="11A465"; break;;
* ) exit 0;;
esac
done
fi
}
Main $1