[X]Assistant

[T0ugh]

Rollback with futurerestore (Odysseus)
\ iPhone (4S, 5, 5C), iPod touch 5G, iPad (2, 3, 4), iPad mini 1 /

IOS firmware | [FAQ] The relevance of the firmware | Apple Device Model IDs | futurerestore | kDFUApp

What is a rollback (downgrade)?

• Rollback (downgrade) - install the old version of iOS, which is officially no longer relevant on the Apple server and is not signed by the SHSH certificate. Officially, you can only flash on the latest, current firmware.
• For informativeness ->Wikipedia

You need to understand the following:

• For rollback usingfuturerestoreneed a jailbreak.
• For rollback usingfuturerestorepreviously saved SHSH required.
• futurerestoresupports ->iPhone (4S, 5, 5C), iPod touch 5G, iPad (2, 3, 4), iPad mini 1
• futurerestoresupports ->Linux and macOS, does not support Windows.

To roll back / restore iOS, we need:

• macOS (10.10 Yosemite, 10.11 El Capitan, 10.12 Sierra).
• Firmware for our device on which we roll back ->IOS firmware
• Previously saved SHSH from the firmware on which we roll back.
• futurerestorefor rollback.
• kDFUApp from repository ->http://repo.tihmstar.net

For example, takefuturerestorefor macOS, iPhone 4S (A1387, A1431) (onboard iOS 9.3.5) with an identifier ->iPhone4,1 (n94ap) and SHSH ->******** 44587-iPhone4,1-7.1.2-11D257.shsh to roll back to iOS 7.1.2
Create a folder on your desktop ->Downgrade
From the archive ->futurerestoreportable ->futurerestore_macosin the folder on your desktop ->Downgrade
SHSH ->******** 44587-iPhone4,1-7.1.2-11D257.shshcopy to the folder on your desktop ->Downgrade
Firmware (iOS 7.1.2, to which we roll back) ->iPhone4,1_7.1.2_11D257_Restore.ipswcopy to the folder on your desktop ->Downgrade

In folder ->Downgrademust be3a file.

******** 44587-iPhone4,1-7.1.2-11D257.shsh ->certificate from the firmware for which we roll back / restore (iOS 7.1.2).
futurerestore_macos ->executable file futurerestore for macOS.
iPhone4,1_7.1.2_11D257_Restore.ipsw ->The firmware for which we roll back / restore (iOS 7.1.2).

For normal operationfuturerestoreadditional packages are needed, we open the terminal and enter commands.
🢃🢃🢃

Open a terminal and enter commands one by one

1. xcode-select --install
   
   
2. / usr / bin / ruby ​​-e "$ (curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
   
   
3. brew install automake autoconf libtool pkg-config libplist openssl libzip
   git clone https://github.com/tihmstar/libirecovery && cd ./libirecovery && bash autogen.sh && make install
   cd
   git clone https://github.com/tihmstar/libcrippy && cd ./libcrippy && bash autogen.sh && make install
   cd
   git clone https://github.com/tihmstar/libfragmentzip && cd ./libfragmentzip && bash autogen.sh && make install
   cd
   git clone https://github.com/tihmstar/libpartialzip && cd ./libpartialzip && bash autogen.sh && make install
   
   
4. cd / usr / local
   sudo mkdir ssl
   sudo chmod 777 / usr / local / ssl
   cd
   git clone https://github.com/openssl/openssl.git
   cd openssl
   ./config
   make
   make install
   
   
5. brew install curl
   
   
6. ln -s /usr/local/opt/openssl/lib/libcrypto.1.0.0.dylib / usr / local / lib /
   ln -s /usr/local/opt/openssl/lib/libssl.1.0.0.dylib / usr / local / lib /
   ln -s /usr/local/Cellar/openssl/1.0.2j/bin/openssl openssl

After preparing the necessary files and system, go to the main, preparing the device for rollback / recovery.

1.Open Cydia on your device and add a repository ->http://repo.tihmstar.net
2.Install from repository ->kDFUApp.
3.We connect the device to the computer and runkDFUAppfrom the main screen.

4.Activate all switches so that they becomegreenatkDFUApp.

5.It does not matter which version is listed in the Bundle.
6.Pushenter kDFUThe device will go into DFU mode (black screen).

7.Open the terminal.
8.We entercd, press the spacebar and drag the folder to the terminal ->Downgrade



9.Hit Enter

10.To be sure that we are in the right folder, enterlsand hit enter



11.We enterchmod + x futurerestore_macosand hit enter



The next step will be final, after which the rollback / restore will begin. The core team looks like this:

./futurerestore_macos -t **. shsh --latest-baseband --use-pwndfu **. ipsw

Where**the names of the main files in the folder ->Downgrade
My team, with my data looks like this:

./futurerestore_macos -t ******** 44587-iPhone4,1-7.1.2-11D257.shsh --latest-baseband - use-pwndfu iPhone4,1_7.1.2_11D257_Restore.ipsw

If your device is without a SIM, the command will be

./futurerestore_macos -t **. shsh --no-baseband --use-pwndfu **. ipsw

Data example

./futurerestore_macos -t ******** 84401-iPad3,4-7.1.2-11D257.shsh --no-baseband --use-pwndfu iPad3,4_7.1.2_11D257_Restore.ipsw

12.We enter./futurerestore_macos -t ******** 44587-iPhone4,1-7.1.2-11D257.shsh --latest-baseband - use-pwndfu iPhone4,1_7.1.2_11D257_Restore.ipswand hit enter
Do not close the terminal window, do not disconnect the device from the Mac, check everything several times.




Done: restoring succeeded. Congratulations, after successful recovery, block iOS update ->How to disable automatic iOS update

Post has been editedT0ugh - 18.08.17, 12:25

[T0ugh]

bodybuilding
There may be problems with 8gigs, maximum on iOS 8.4.1

[Tolbas]

bodybuilding
Only those released through October 2014 are inclusive. All that later - only on 8.4.1.

[bodybuilding]

Tolbas
Ie at least I can roll back any 4s without ssh to 8.4.1?

[T0ugh]

bodybuilding
Yes

[MrRomezzz]

It turned out this method ipad2 roll back from 9.3.5 to 6.1.3. There was no other method (without SHSH), but it turned out that SHSH was downloaded there. I tried several times, and then I realized that I now have SHSH! And tried this method. And the first time everything went well.

[sverccosh]

Just today came across a topic. I haven’t got it yet, but I’ll ask the question: the first and mini 4s are set 7.1.2. Certificates not saved. I want to use 6.1.3 on them, but return later. Is it possible now to save certificates from 7.1.2, pass 6.1.3, and then return to 7.1.2?

[T0ugh]

sverccosh
Remove the certificate and go ahead ->Save SHSH for all devices
Minic on 6.1.3 do not roll back.

Post has been editedT0ugh - 09.11.17, 12:33

[Danfrid]

sverccosh
Google how to use odysseus to dump apticket.der

[Noisia1]

Guys when rolling back 4s gives-11 error, why?

[mal__]

Something I'm confused, it seems that for a rollback, you need SHSH from a specific firmware, on the other hand they write that for rollback 4s there are no problems and you can roll back without saved shsh.
Tell me, there is an ipad mini 1, there is no firmware 9.3.5 on it.
If I put the jail on the minicar, can I roll it back to 7.1.2, if so, then for this I need to save apticket.der and convert it to shsh from firmware 7.1.2?
If I do not understand correctly, poke how to roll back the minicar from 9.3.5 to 7.1.2 without saved shsh

[T0ugh]

mal__ @ 11.11.17, 10:47

If I do not understand correctly, poke how to roll back the minicar from 9.3.5 to 7.1.2 without saved shsh

It's impossible.

[mal__]

T0ugh @ 11.11.17, 13:50

It's impossible.

Can I roll back iPad mini to 8.4.1 without SHSH?
Will I be able to install jail on 8.4.1 after rollback?

[T0ugh]

mal__ @ 11.11.17, 18:55

Can I roll back iPad mini to 8.4.1 without SHSH?

You can
Save OTA SHSH from iOS 8.4.1 ->Rollback using futurerestore (Odysseus) (Post T0ugh # 66398748)
Further, as described here ->Rollback with futurerestore (Odysseus) (Post earth.lukas # 64329393)
Additional bundles here ->Rollback using futurerestore (Odysseus) (Post adober # 65988502)

iPhone4.1 / iPad2.1 / iPad2.2 / iPad2.3 - can be rolled back to iOS 6.1.3
iPad2.1 / iPad2.2 / iPad2.3 / iPad2.4 / iPad2.5 / iPad2.6 / iPad2.7 / iPad3.1 / iPad3.2 / iPad3.3 / iPad3.4 / iPad3.5 / iPad3, 6 / iPhone4.1 / iPhone5.1 / iPhone5.2 / iPod5.1 - can be rolled back to iOS 8.1.4

[mal__]

Earth.lukas @ 08.23.17, 14:18

5. Decrypt and patch iBSS. Yes, only iBSS without iBEC, which makes it easy. To do this, look for the bundle for your iDevice here, download, and take from it the file "iBSS.identifier_your_models.RELEASE.patch" (I had "iBSS.p105.RELEASE.patch") - it will be needed for the patch, but for now let's go to Windows, run FCE 365 Firmware Manager (here it is). First iBSS is decrypted with the help of keys (and they are here), and then patched with the help of that file "iBSS.your_mobile_ identifier.RELEASE.patch" and save the file with * .patched extension (let's call it ibss.patched), we will need it later. If you have, like me, iPad2.5 - take my ibss.patched.zip (48.62 KB)

A harsh item in 1 line.
If this is the first time to do this, it is not at all clear:
1 - Tell me, in which menu and on which button do I need to “decrypt iBSS using keys” can I screen?
2 - "using the keys (and they are here)" on the page a bunch of text, tell me, for iPad 2.7 (1455) what to download? more precisely, it’s not even clear where to download this button, there are a lot of information on the page in English.
3 - "and then patch using that file" tell me, what button should I click in the software?

sort of found where to do the decrypt and patch, but at least beat the forehead, the patched file is not saved. Maybe the software version is a curve? and from the admin I ran and danced with a tambourine, help make this fucking patch for iPad models 1455 and 1454

Post has been editedT0ugh - 12.11.17, 14:09

Reason for editing: Extra spaces

[Danfrid]

mal__,
the patched file is in the folder with fce itself
look

[mal__]

Danfrid,
And there I also looked, well, there is none, there is nowhere, even stupidly search on all disks started on this file.

The decrypt works, the file is created, but patched is not.

Running with admin rights and everything else checked, even a virtual machine on Win 7 set for this

[mal__]

private void iTalk_Button_213_Click (object sender, EventArgs e)
{
{
ProcessStartInfo psi2 = default (ProcessStartInfo);
Process proc = new Process ();
string pat1 = Application.StartupPath;
dynamic process3 = pat1 + "/Data/bspatch.exe";
dynamic asrorigi = OriginalDFU.Text;
dynamic asrpatch = PatchFilePf.Text;
dynamic finalpatch = PatchedFilePf.Text;
dynamic args3 = string.Format ("{0} {1} {2}", asrorigi, finalpatch, asrpatch);
psi2 = new ProcessStartInfo (process3, args3);
proc.StartInfo = psi2;
proc.Start ();
MessageBox.Show ("Done creating PATCHED File!", "F.C.E. 365 Firmware Manager X", MessageBoxButtons.OK, MessageBoxIcon.Information);
}
}

It turns out that F.C.E. 365 Firmware Manager is not the case here, it’s just a shell, and accordingly bspatch.exe doesn’t work, but this crap can only be done with the advanced telepathy skill.
Who did it at least once to do it yourself, and did not take the finished one, do a good deed, collect the .patched file for my device, the files and keys in the attachment.
Down_iPad2,7_8.4.1_12H321.bundle.zip(85.1 KB)


Post has been editedT0ugh - 13.11.17, 16:28

[mal__]

mal__ @ 12.11.17, 16:38

It turns out that F.C.E. 365 Firmware Manager is not the case here, it’s just a shell, and accordingly bspatch.exe doesn’t work, but this crap can only be done with the advanced telepathy skill.

Found a problem, everything was as usual trite ...
When downloading a patch file from a githab, I did not use the download button, but clicked on the file with the right mouse button and save, in this case the file was saved with the correct name, but inside there was information that it was downloaded from the github, and not the file itself.
It turned out this is also really simple, as I wrote earlierF.C.E. 365 Firmware Managerby itself, it does not crypt or patch anything, but simply launches an application from the Data folder with file paths in the console, here’s how, for example, an error looks at the patch file if the file with which the patch is “crooked”

E: \ temp \ apple>bspatch.exe iBSS.dfu iBSS.patched iBSS.p107.RELEASE.patch
Corrupt patch

those. For the patch, the full utility is not needed, put the file that is patched and the patch file next to bspatch.exe and run from the console in this format: bspatch.exe old_file new_file_patch
also for the decrypt, you can use the xpwntool.exe utility with the following parameters from the console:

xpwntool.exe "filename" "newfile" -k "key" -iv "iv key"

If there is a desire, then it is possible to put both files into the instruction and with what parameters to run them, otherwise if the links to the compiled F.C.E. 365 Firmware Manager does translate into a network.

Post has been editedT0ugh - 13.11.17, 16:29

Reason for editing: Extra spaces

[mal__]

AirShark,

The only thing when I started ./kloader through the iPad itself was not how kDFU did not start, connected via ssh and executed all the same commands except su, and immediately iTunes found the body in recovery mode.

Tell me, through ssh, do you mean just put openssh and enter the same commands but connecting from the computer?
Already through mterminal I tried it, and from the computer through putty I connected, I do not want everything, it goes into the black screen and in this way is lost from the devices at all.
But I have a Mac through a virtual machine, I already tried to wait for the transition to recovery mode on tuna in Windows. He still does not want to, even in Windows, the tuna loses it and nothing happens, he waited about 3-5 minutes.
Maybe there is a sense of a file in another directory to shift and run from there, or something else to do? Who else won the reluctance to go to kDFU?

[Airshark]

mal__,via putty connected to iPad
Want to roll back to 8.4.1? Did not try in plist to change the version on iOS 6 and reboot the device?
I managed on iPad2.5 changed the version in plist and update 8.4.1 itself started to swing and the norms were established

Post has been editedAirshark - 14.11.17, 14:54