Add how to use and troubleshooting

This commit is contained in:
LukeZGD 2021-10-03 23:26:19 +08:00
parent c8e4822fdb
commit 74a5776e33
4 changed files with 147 additions and 83 deletions

65
HOW-TO-USE.md Normal file
View File

@ -0,0 +1,65 @@
# SECTION 0 - Things to note before you begin
- Some of the sections and steps will be separated depending on your platform and device.
- Make sure that your OS version/distro and your iOS device are compatible before proceeding.
- Make sure to have at least 10 GB of free space.
- **For A7 devices, Windows support is limited.** Read [TROUBLESHOOTING.md](https://github.com/LukeZGD/iOS-OTA-Downgrader/blob/master/TROUBLESHOOTING.md) for more details.
- **Restoring to other versions with SHSH blobs is not supported on Windows.**
# SECTION 1.1 - Setup for PC/Mac
## Windows
1. Your installation of Windows must be **64-bit**. Windows 8.1 and 10 are supported, but Windows 7 may also work.
1. Install [iTunes](https://www.apple.com/itunes/download/win64), version 12.10.11 or newer. Make sure to not install the Microsoft Store version.
1. Install [MSYS2](https://www.msys2.org/#installation), follow steps 1 to 4 only. In step 4, untick "Run MSYS2 64-bit now" before clicking Finish.
1. [Download iOS-OTA-Downgrader](https://api.github.com/repos/LukeZGD/iOS-OTA-Downgrader/zipball) and extract the zip archive.
1. Go to where the extracted files are located, and run `restore.cmd`
- It may only show up as `restore`. If this is the case, run the one that has the gears icon. I recommend to [make Windows show file extensions](https://www.howtogeek.com/205086/beginner-how-to-make-windows-show-file-extensions/) to avoid confusion.
1. On its first run, it will download and install dependencies. This will take some time depending on your Internet connection. When it's done, proceed to the next section.
## macOS/Linux
1. [Download iOS-OTA-Downgrader](https://api.github.com/repos/LukeZGD/iOS-OTA-Downgrader/zipball) and extract the zip archive. (it will be extracted automatically if downloaded from Safari)
1. Open a Terminal window. (for macOS, [here's how](https://support.apple.com/guide/terminal/apd5265185d-f365-44cb-8b09-71a064a42125/mac))
1. Go to where the extracted files are located, and drag `restore.sh` to the Terminal window, and press Enter.
1. On its first run, it will download and install dependencies. This will take some time depending on your Internet connection. When it's done, proceed to the next section.
# SECTION 1.2 - Setup for iOS device
## 32-bit devices
1. [Jailbreak your device.](https://www.reddit.com/r/LegacyJailbreak/comments/jhjam8/tutorial_how_to_sideload_apps_ipas_used_for/)
- For alternatives, the DFU advanced menu can also be used. Read [TROUBLESHOOTING.md](https://github.com/LukeZGD/iOS-OTA-Downgrader/blob/master/TROUBLESHOOTING.md) for more details
1. Open Cydia, and wait for sources to refresh. When it asks to upgrade, tap Ignore.
1. Go to Search, and search for OpenSSH.
1. When OpenSSH shows up, tap and install it.
- If you have an iPhone 5 or an iPad 4 on iOS 10, do the additional steps below. Otherwise, proceed to the next section.
1. Go to Sources, tap Edit at the top right, then tap Add at the top left.
1. Add this repository: https://lukezgd.github.io/repo/
1. After the repo is added, go to Search, and search for Dropbear.
1. When Dropbear shows up, tap and install it. When it's done, proceed to the next section.
## A7 devices
1. No prior setup is needed. Proceed to the next section.
# SECTION 2 - Downgrading the device
## 32-bit devices
1. Connect your iOS device to your PC/Mac. Make sure to also trust the computer by selecting "Trust" at the pop-up.
- **Windows/macOS**: Double-check if the device is being detected by iTunes/Finder.
1. Run the script.
- **Windows**: Go to where the extracted files are located, and run `restore.cmd` (the one that has the gears icon)
- **macOS/Linux**: Go to where the extracted files are located, and drag `restore.sh` to the Terminal window, and press Enter/Return.
1. When the main menu shows up, type '1' and press Enter/Return.
1. Select your target version and options, and follow the instructions that the script will give you.
1. After the downgrade process, your device will be successfully in your selected target version.
- **Windows**: The restore process may give out an error on your first try. If this happens, follow the steps in [TROUBLESHOOTING.md](https://github.com/LukeZGD/iOS-OTA-Downgrader/blob/master/TROUBLESHOOTING.md)
## A7 devices
- Connect your iOS device to your PC/Mac.
- Run the script.
- **Windows**: Take note of the limited support on Windows before proceeding. More details in [TROUBLESHOOTING.md](https://github.com/LukeZGD/iOS-OTA-Downgrader/blob/master/TROUBLESHOOTING.md)
- **macOS/Linux**: Go to where the extracted files are located, and drag `restore.sh` to the Terminal window, and press Enter/Return.
- Let the script put the device to recovery mode, and follow the steps to enter DFU mode.
- When in DFU mode, wait for the script will put the device to pwnDFU mode.
- **Linux**: Entering pwnDFU mode can fail a lot on Linux. Read [TROUBLESHOOTING.md](https://github.com/LukeZGD/iOS-OTA-Downgrader/blob/master/TROUBLESHOOTING.md) for more details
- When the main menu shows up, type '1' and press Enter/Return.
- Select your target version and options, and follow the instructions that the script will give you.
- After the downgrade process, your device will be successfully in iOS 10.3.3.

View File

@ -1,20 +1,19 @@
# iOS-OTA-Downgrader
### Downgrade/restore and jailbreak iOS devices to signed OTA firmwares
- iOS-OTA-Downgrader can **downgrade/restore and jailbreak supported iOS devices to signed OTA firmwares**.
- **Linux, macOS, and Windows** are supported
- Windows users can also create a Linux live USB (see Requirements)
- iOS 6.1.3 and 8.4.1 downgrades have the option to **jailbreak** the install
- For iOS 10.3.3, use [TotallyNotSpyware](https://totally-not.spyware.lol) or [sockH3lix](https://github.com/SongXiaoXi/sockH3lix) to jailbreak
- For iOS 10.3.3, use [TotallyNotSpyware](https://totally-not.spyware.lol) or [sockH3lix](https://github.com/SongXiaoXi/sockH3lix) to jailbreak
- **You do NOT need blobs to use this**, the script will get them for you
- This script can also restore your device to other iOS versions that you have SHSH blobs for (32-bit devices only, listed under Supported devices)
- **Please read the "Other notes" section for tips, frequent questions, and troubleshooting**
- This script can also restore your device to other iOS versions that you have SHSH blobs for
- 32-bit devices only, iOS 10 blobs/versions are not supported
- **Please read [TROUBLESHOOTING.md](https://github.com/LukeZGD/iOS-OTA-Downgrader/blob/master/TROUBLESHOOTING.md) for tips, frequent questions, and troubleshooting!**
## Supported devices:
## Supported devices
- You can identify your device [here](https://ipsw.me/device-finder)
- **iPhone 5C and iPad mini 3 devices are NOT supported** (OTA versions for them are not signed)
- iPhone 5C can still be restored to versions that you have SHSH blobs for
- **A7 devices are not fully supported on Windows.**
- **Restoring to other versions with SHSH blobs is not supported on Windows.**
- [Identify your device here](https://ipsw.me/device-finder)
- **iPhone 5C and iPad mini 3 devices are NOT supported!**
- iPhone 5C can still be restored to versions that you have SHSH blobs for
<table>
<thead>
@ -48,89 +47,29 @@
</tbody>
</table>
## Requirements:
## Requirements
- **Read [HOW-TO-USE.md](https://github.com/LukeZGD/iOS-OTA-Downgrader/blob/master/HOW-TO-USE.md) for a step-by-step tutorial**
- **A supported device in any iOS version (listed above)**
- The IPSW firmware for the version you want to downgrade to
- Links: [iOS 10.3.3](https://ipsw.me/10.3.3), [iOS 8.4.1](https://ipsw.me/8.4.1), [iOS 6.1.3](https://ipsw.me/6.1.3) (ignore the signing statuses in the site)
- The script can also download it for you
- A **64-bit Linux install/live USB** or a supported **macOS/Windows** version
- See supported OS versions and Linux distros below
- A Linux live USB can be easily created with tools like [Ventoy](https://www.ventoy.net/en/index.html)
- **Windows** users need to install [MSYS2](https://www.msys2.org/#installation) and [iTunes](https://support.apple.com/kb/DL2065) (12.10.11 or newer, and not the Microsoft Store version)
- **32-bit devices** - The device needs to be put in kDFU/pwnDFU mode as part of the process. There are a few options:
- Normal method - **Jailbreak is required**. Users must install [OpenSSH](https://cydia.saurik.com/package/openssh/). Users in iOS 10 (A6/A6X) must also install Dropbear from my Cydia repo: https://lukezgd.github.io/repo/
- DFU method - For alternatives, the DFU advanced menu can also be used. See "Other notes" for more details
- **A7 devices** - Jailbreak is not required. The script will assist in helping the user put the device to pwnDFU mode
- Note that entering pwnDFU mode is not supported on Windows. See "Other notes" for more details
- The IPSW firmware for the version you want to downgrade to
- Links: [iOS 10.3.3](https://ipsw.me/10.3.3), [iOS 8.4.1](https://ipsw.me/8.4.1), [iOS 6.1.3](https://ipsw.me/6.1.3) (ignore the signing statuses in the site)
- The script can also download it for you
<details>
<summary>For Pangu 32-bit users:</summary>
<ul><li>For 32-bit users using Pangu and normal method, install the latest untether for your iOS version <a href="https://github.com/LukeZGD/iOS-OTA-Downgrader-Keys/releases/tag/untether">here</a></li></ul>
</details>
## Usage:
1. [Download iOS-OTA-Downgrader here](https://api.github.com/repos/LukeZGD/iOS-OTA-Downgrader/zipball) and extract the zip archive
2. Plug in your iOS device
3. Open a Terminal window
4. `cd` to where the extracted files are located, and run `./restore.sh`
- You can also drag `restore.sh` to the Terminal window and press Enter/Return
- For Windows users, click `restore.cmd` to run the script
5. Select options to be used
6. Follow instructions
## Supported OS versions/distros:
## Supported OS versions/distros
- [**Ubuntu**](https://ubuntu.com/) 20.04 and newer, and Ubuntu-based distros like [Linux Mint](https://www.linuxmint.com/)
- [**Arch Linux**](https://www.archlinux.org/) and Arch-based distros like [EndeavourOS](https://endeavouros.com/)
- [**Fedora**](https://getfedora.org/) 33 and newer
- [**Debian**](https://www.debian.org/) 11 Bullseye, Testing and Unstable
- [**openSUSE**](https://www.opensuse.org/) Tumbleweed and Leap 15.3
- **macOS** 10.13 and newer
- Windows 10 (8.1 and lower may also work but this is untested)
- Windows 10 or 8.1 (7 may also work)
## Other notes:
- **If something in the process does not work for you:** try unplugging/replugging the device, switching between different USB ports/cables, also try USB 2.0 ports
- **IPSW file integrity** will be verified before restoring and/or creating custom IPSW (if custom IPSW is already created, this will be skipped)
- **For users having issues with missing libraries/tools:** To re-install dependencies, run `./restore.sh Install`
- Alternatively, delete the `libimobiledevice` folder in `resources` then run the script again
- If your device is not being detected in normal mode, make sure to also trust the computer by selecting "Trust" at the pop-up. For Windows/macOS users, double-check if the device is being detected by iTunes/Finder.
- macOS users may have to install libimobiledevice and libirecovery from [Homebrew](https://brew.sh/) or [MacPorts](https://www.macports.org/) (this is optional, but recommended)
- For Homebrew: `brew install libimobiledevice libirecovery`
- For MacPorts: `sudo port install libimobiledevice libirecovery`
- The script will detect this automatically and will use the Homebrew/MacPorts versions of the tools
- Windows users may encounter errors like `Unable to send APTicket` or `Unable to send iBEC` in the restore process. To fix this, [follow steps 1 to 5 here](https://github.com/m1stadev/futurerestore/tree/test#unable-to-send-ibec-error--8) then run the script again
- **For A7 devices:**
- If you want to restore your A7 device on Windows, you need to first put the device in pwnDFU mode with signature checks disabled. Since entering pwnDFU mode is not supported on Windows, you need to use a Mac/Linux machine or another iOS device to do so. If your device is not in pwnDFU mode, the restore will NOT proceed! For entering pwnDFU mode, use ipwndfu, iPwnder32, or iPwnder Lite ([Tutorial](https://www.reddit.com/r/LegacyJailbreak/comments/pyzyc2/tutorial_short_tutorial_to_downgrade_most_a7_to/))
- Do not use USB-C to lightning cables as this can prevent a successful restore
- ipwndfu is unfortunately very unreliable on Linux, you may have to try multiple times (Linux users may also try in a live USB)
- If the script cannot find your device in pwnREC mode or gets stuck, you may have to start over by [force restarting](https://support.apple.com/guide/iphone/iph8903c3ee6/ios) and re-entering recovery/DFU mode
- Use an Intel or Apple Silicon PC/Mac as entering pwnDFU (checkm8) may be a lot more unreliable on AMD devices
- Apple Silicon Mac users running macOS 11.3 and newer may encounter issues entering pwnDFU mode (see [issue #114](https://github.com/LukeZGD/iOS-OTA-Downgrader/issues/114))
- For more troubleshooting steps for entering pwnDFU mode, see [issue #126](https://github.com/LukeZGD/iOS-OTA-Downgrader/issues/126)
- Other than the above, unfortunately there is not much else I can do to help regarding entering pwnDFU mode.
- **For 32-bit devices:**
- To make sure that SSH is successful, try these steps: Reinstall OpenSSH/Dropbear, reboot and rejailbreak, then reinstall them again
- To devices with baseband, this script will restore your device with the latest baseband (except when jailbreak is enabled, and on iPhone5,1 where there were reported issues)
- This script can also be used to just enter kDFU mode for all supported devices
- This script can work on virtual machines, but I will not provide support for them
- If you want to use other manually saved blobs for 6.1.3/8.4.1, create a folder named `saved`, then within it create another folder named `shsh`. You can then put your blob inside that folder.
- The naming of the blob should be: `(ECID in Decimal)_(ProductType)_(Version)-(BuildVer).shsh(2)`
- Example with path: `saved/shsh/123456789012_iPad2,1_8.4.1-12H321.shsh`
- **For DFU advanced menu:**
- To enter DFU advanced menu, put your iOS device in recovery (A6 only), normal DFU (also A6 only), kDFU, or pwnDFU mode before running the script
- There are two options that can be used in the DFU advanced menu
- Select the "kDFU mode" option if your device is already in kDFU mode beforehand. Example of this is using kDFUApp by tihmstar; kDFUApp can also be installed from my repo
- For A6/A6X devices, "DFU mode (A6)" option can be used. This will use ipwndfu (or iPwnder32 for Mac) to put your device in pwnDFU mode, send pwned iBSS, and proceed with the downgrade/restore
- For A5/A5X devices, "pwnDFU mode (A5)" option can be used, BUT ONLY IF the device is put in pwnDFU mode beforehand, with [checkm8-a5](https://github.com/synackuk/checkm8-a5) using an Arduino and USB Host Shield
- **For the jailbreak option:**
- If you have problems with Cydia, remove the ultrasn0w repo and close Cydia using the app switcher, then try opening Cydia again
- p0sixspwn will be used for iOS 6.1.3, and EtasonJB or daibutsu for iOS 8.4.1
- For some devices, EtasonJB untether is unstable and not working properly, so daibutsu jailbreak will be used. See [PR #129](https://github.com/LukeZGD/iOS-OTA-Downgrader/pull/129) for more details
- For devices jailbroken with EtasonJB, there is no need to install "Stashing for #etasonJB" package, as stashing is already enabled
- For devices jailbroken with daibutsu, add the system repo for future updates to the untether: https://dora2ios.github.io/repo/
- For devices jailbroken with daibutsu and want to use Coolbooter Untetherer, [apply this fix/workaround](https://github.com/LukeZGD/iOS-OTA-Downgrader/issues/131#issuecomment-920022171) using Terminal (the commands need to be run as root)
- **My Cydia repo**: https://lukezgd.github.io/repo/ - for installing Dropbear and kDFUApp if needed
## Tools and other stuff used by this script:
## Tools and other stuff used by this script
- cURL
- bspatch
- [ipwndfu](https://github.com/LukeZGD/ipwndfu) - LukeZGD fork

60
TROUBLESHOOTING.md Normal file
View File

@ -0,0 +1,60 @@
# TROUBLESHOOTING
## Common issues
- **If something in the process does not work for you:** try unplugging/replugging the device, switching between different USB ports/cables, also try USB 2.0 or 3.0 ports
- **IPSW file integrity** will be verified before restoring and/or creating custom IPSW (if custom IPSW is already created, this will be skipped) This is done to make sure that the IPSW is not corrupt or incomplete.
- **For users having issues with missing libraries/tools:** re-install dependencies by deleting the `libimobiledevice` folder in `resources`, then run the script again.
- If your device is not being detected in normal mode, make sure to also trust the computer by selecting "Trust" at the pop-up.
- For Windows and macOS users, double-check if the device is being detected by iTunes/Finder.
## Windows
- Windows users may encounter errors like `Unable to send APTicket` or `Unable to send iBEC` in the restore process.
- To fix this, [follow steps 1 to 5 here](https://github.com/m1stadev/futurerestore/tree/test#unable-to-send-ibec-error--8).
- Run the script again and let the device exit recovery mode.
- When the device boots up, jailbreak the device and run the script again. This time, it will get past the previous errors mentioned.
- If you want to restore your A7 device on Windows, you need to first put the device in pwnDFU mode with signature checks disabled. Since entering pwnDFU mode is not supported on Windows, you need to use a Mac/Linux machine or another iOS device to do so. If your device is not in pwnDFU mode, the restore will NOT proceed!
- Windows users may create a Linux live USB. This can easily be done with tools like [Ventoy](https://www.ventoy.net/)
- For entering pwnDFU mode, use ipwndfu, iPwnder32, or iPwnder Lite ([Tutorial](https://www.reddit.com/r/LegacyJailbreak/comments/pyzyc2/tutorial_short_tutorial_to_downgrade_most_a7_to/))
## macOS
- macOS users may have to install libimobiledevice and libirecovery from [Homebrew](https://brew.sh/) or [MacPorts](https://www.macports.org/). This is optional, but recommended.
- For Homebrew: `brew install libimobiledevice libirecovery`
- For MacPorts: `sudo port install libimobiledevice libirecovery`
- The script will detect this automatically and will use the Homebrew/MacPorts versions of the tools
## Linux
- ipwndfu is unfortunately very unreliable on Linux, you may have to try multiple times.
- You may also try in a live USB.
## A7 devices
- Do not use USB-C to lightning cables as this can prevent a successful restore
- If the script cannot find your device in pwnREC mode or gets stuck, you may have to start over by [force restarting](https://support.apple.com/guide/iphone/iph8903c3ee6/ios) and re-entering recovery/DFU mode
- Use an Intel or Apple Silicon PC/Mac as entering pwnDFU (checkm8) may be a lot more unreliable on AMD devices
- Apple Silicon Mac users running macOS 11.3 and newer may encounter issues entering pwnDFU mode (see [issue #114](https://github.com/LukeZGD/iOS-OTA-Downgrader/issues/114))
- For more troubleshooting steps for entering pwnDFU mode, see [issue #126](https://github.com/LukeZGD/iOS-OTA-Downgrader/issues/126)
- Other than the above, unfortunately there is not much else I can do to help regarding entering pwnDFU mode.
## 32-bit devices
- To make sure that SSH is successful, try these steps: Reinstall OpenSSH/Dropbear, reboot and rejailbreak, then reinstall them again
- To devices with baseband, this script will restore your device with the latest baseband (except when jailbreak is enabled, and on iPhone5,1 where there were reported issues)
- This script can also be used to just enter kDFU mode for all supported devices
- This script can work on virtual machines, but I will not provide support for them
- If you want to use other manually saved blobs for 6.1.3/8.4.1, create a folder named `saved`, then within it create another folder named `shsh`. You can then put your blob inside that folder.
- The naming of the blob should be: `(ECID in Decimal)_(ProductType)_(Version)-(BuildVer).shsh(2)`
- Example with path: `saved/shsh/123456789012_iPad2,1_8.4.1-12H321.shsh`
## Jailbreak Option for 32-bit devices
- If you have problems with Cydia, remove the ultrasn0w repo and close Cydia using the app switcher, then try opening Cydia again
- If you cannot find Cydia in your home screen, try accessing Cydia through Safari with `cydia://` and install "Jailbreak App Icons Fix" package from my Cydia repo
- p0sixspwn will be used for iOS 6.1.3, and EtasonJB or daibutsu for iOS 8.4.1
- For some devices, EtasonJB untether is unstable and not working properly, so daibutsu jailbreak will be used. See [PR #129](https://github.com/LukeZGD/iOS-OTA-Downgrader/pull/129) for more details
- For devices jailbroken with EtasonJB, there is no need to install "Stashing for #etasonJB" package, as stashing is already enabled
- For devices jailbroken with daibutsu, add the system repo for future updates to the untether: https://dora2ios.github.io/repo/
- For devices jailbroken with daibutsu and want to use Coolbooter Untetherer, [apply this fix/workaround](https://github.com/LukeZGD/iOS-OTA-Downgrader/issues/131#issuecomment-920022171) using Terminal (the commands need to be run as root)
## DFU Advanced Menu for 32-bit devices
- To enter DFU advanced menu, put your iOS device in recovery (A6 only), normal DFU (also A6 only), kDFU, or pwnDFU mode before running the script
- There are two options that can be used in the DFU advanced menu
- Select the "kDFU mode" option if your device is already in kDFU mode beforehand. Example of this is using kDFUApp by tihmstar; kDFUApp can also be installed from my repo: https://lukezgd.github.io/repo/
- For A6/A6X devices, "DFU mode (A6)" option can be used. This will use ipwndfu (or iPwnder32 for Mac) to put your device in pwnDFU mode, send pwned iBSS, and proceed with the downgrade/restore
- For A5/A5X devices, "pwnDFU mode (A5)" option can be used, BUT ONLY IF the device is put in pwnDFU mode beforehand, with [checkm8-a5](https://github.com/synackuk/checkm8-a5) using an Arduino and USB Host Shield

View File

@ -68,7 +68,7 @@ GetDeviceValues() {
if [[ ! $DeviceState ]]; then
echo -e "\n${Color_R}[Error] No device detected. Please put the device in normal mode before proceeding. ${Color_N}"
echo "${Color_Y}* Make sure to also trust this computer by selecting \"Trust\" at the pop-up. For Windows/macOS users, double-check if the device is being detected by iTunes/Finder. ${Color_N}"
echo "${Color_Y}* Recovery or DFU mode is also applicable. For more details regarding alternative methods, read the \"Other Notes\" section of the README ${Color_N}"
echo "${Color_Y}* Recovery or DFU mode is also applicable. For more details regarding alternative methods, read TROUBLESHOOTING.md ${Color_N}"
exit 1
fi
@ -129,7 +129,7 @@ GetDeviceValues() {
if [[ ! $BasebandURL || ! $HWModel ]]; then
Error "Missing BasebandURL and/or HWModel values. Is the firmware folder missing?" \
"Reinstall dependencies and try again. For more details, read the \"Other Notes\" section of the README"
"Reinstall dependencies and try again. For more details, read TROUBLESHOOTING.md"
fi
if [[ $ProductType == "iPod5,1" ]]; then
@ -203,7 +203,7 @@ CheckM8() {
echo -e "\n${Color_R}[Error] Failed to enter pwnDFU mode. Please run the script again: ./restore.sh Downgrade ${Color_N}"
echo "${Color_Y}* This step may fail a lot, especially on Linux, and unfortunately there is nothing I can do about the low success rates. ${Color_N}"
echo "${Color_Y}* The only option is to make sure you are using an Intel or Apple Silicon device, and to try multiple times ${Color_N}"
Echo "* For more details, read the \"Other Notes\" section of the README"
Echo "* For more details, read TROUBLESHOOTING.md"
exit 1
elif [[ $pwnDFUDevice == 0 ]]; then
Log "Device in pwnDFU mode detected."
@ -349,6 +349,6 @@ pwnREC() {
if (( $Attempt == 4 )); then
Error "Failed to enter pwnREC mode. You may have to force restart your device and start over entering pwnDFU mode again" \
"macOS users may have to install libimobiledevice and libirecovery from Homebrew. For more details, read the \"Other Notes\" section of the README"
"macOS users may have to install libimobiledevice and libirecovery from Homebrew. For more details, read TROUBLESHOOTING.md"
fi
}