iOS-OTA-Downgrader

(formerly 32bit-OTA-Downgrader)

Downgrade/restore and jailbreak iOS devices to signed OTA firmwares

• This downgrade script/tool supports both Linux and macOS
• iOS 8.4.1 and 6.1.3 downgrades have the option to jailbreak
  • For iOS 10.3.3, use TotallyNotSpyware
• You do NOT need blobs to use this, the script will get them for you
• Please see the "Other notes" section below to serve as answers/solutions for frequent questions and issues

Supported devices:

• You can identify your device here
• iOS 10.3.3 - A7 devices:
  • iPhone 5S
  • iPad Air 1
  • iPad mini 2 except iPad4,6
  • iPad mini 3 is NOT supported
• iOS 8.4.1 - 32-bit devices:
  • iPhone 4S, iPhone 5
  • iPad 2, iPad 3, iPad 4, iPad mini 1
  • iPod 5th gen
  • iPhone 5C is NOT Supported
• iOS 6.1.3:
  • iPhone 4S
  • iPad 2 except iPad2,4

Requirements:

• A supported device in any iOS version:
  • A 32-bit iOS device (jailbreak needed)
  • An A7 device (jailbreak not needed)
• An IPSW for the version you want to downgrade to
  • Links: iOS 10.3.3, iOS 8.4.1, iOS 6.1.3
  • The script can also download it for you
• A 64-bit Linux install/live USB or a supported macOS version
  • See supported OS versions and Linux distros below
  • A Linux live USB can be easily created with tools like balenaEtcher or Rufus
• All 32-bit users must install OpenSSH
  • Users in iOS 10 must install Dropbear (Cydia repo) as well

For Pangu 32-bit users:

• For 32-bit users using Pangu, install the latest untether for your iOS version here

How to use:

1. Download iOS-OTA-Downgrader here and extract the zip archive
2. Plug in your iOS device
3. Open a Terminal window
4. cd to where the zip archive is extracted, and run ./restore.sh
   • You can also drag restore.sh to the Terminal window and press ENTER
5. Select option to be used
6. Follow instructions

Supported OS versions/distros:

• Ubuntu 16.04, 18.04, 20.04, and 20.10 and Ubuntu-based distros like Linux Mint
• Arch Linux and Arch-based distros like Manjaro
• Fedora 32 to 33
• macOS 10.13 to 10.15

Other notes:

• If something in the process does not work for you, try switching USB ports and/or cables (using a USB 2.0 port is recommended)
• This script will verify the IPSW SHA1sum before restoring
• For users having issues related to missing libraries or tools, re-install dependencies with ./restore.sh Install
• For A7 devices:
  • Do not use USB-C to lightning cables as this can prevent a successful restore
  • checkm8 ipwndfu is unfortunately pretty unreliable, you may have to try multiple times (for Linux users I recommend trying in a live USB)
  • If the script can't find your device in pwnREC mode or gets stuck, you may have to start over
  • Other than the above there's not much else I can help regarding entering pwnDFU mode...
• For 32-bit devices:
  • To devices with baseband, this script will restore your device with the latest baseband (except when jailbreak is enabled)
  • This script has a workaround for the activation error on devices downgrading from iOS 10
  • This script can also be used to just enter kDFU mode for all supported devices
  • This script can also restore your device to other iOS versions with provided SHSH blobs
  • As alternatives to kloader/kDFU, checkm8 A5 or ipwndfu can also be used in DFU advanced menu
    • To enter DFU advanced menu, put your iOS device in DFU mode before running the script
  • This script can work on virtual machines, but I won't provide support for them
• If you have problems with Cydia, remove the ultrasn0w repo and force-close Cydia, then try opening Cydia again
• For jailbreak option on iOS 8 downgrades:
  • Stashing is already enabled and nosuid is removed from fstab, so no need to install "Stashing for #etasonJB" package
  • If you can't find Cydia in your home screen, try accessing Cydia through Safari with cydia:// and install "Jailbreak App Icons Fix" package (Cydia repo)
  • To fix LaunchDaemons not loading on startup, install "Infigo" package (Cydia repo)
  • Warning: If your device bootloops with EtasonJB, it may not work with the jailbreak option as well! (I think this applies to some but not all 8942/8945 users) If this happens, bootloop protection will trigger and you won't be able to open Cydia

Tools and other stuff used by this script:

• cURL
• bspatch
• ipwndfu
• iPwnder32
• irecovery
• libimobiledevice
• imobiledevice-net (macOS)
• idevicerestore
• ipsw tool from OdysseusOTA/2
• python2
• tsschecker
• futurerestore 152 (32-bit)
• futurerestore 251 (Linux) (A7)
• futurerestore 245 (macOS) (A7)
• kloader
• kloader5 for iOS 5
• kloader_hgsp for iOS 10
• partial-zip
• 32-bit iBSS patches are from OdysseusOTA, OdysseusOTA2, alitek12, gjest
• A7 iBSS and iBEC patches are from MatthewPierson