futurerestore / futurerestore Goto Github PK

View Code? Open in Web Editor NEW

560.0 22.0 149.0 52.44 MB

A hacked up idevicerestore wrapper, which allows specifying SEP and Baseband for restoring

Home Page: https://nightly.link/futurerestore/futurerestore/workflows/ci/main

License: GNU Lesser General Public License v3.0

Shell 1.06% C++ 94.24% CMake 4.69%

futurerestore's Introduction

futurerestore

Make sure to read this page before continuing.

Latest stable compiled version can be found here.

For devices that support iOS 15, and WiFi-only iPad restores - use the latest beta build for your platform here.

There are currently no pre-compiled beta builds for Windows.

Only use if you are sure what you're doing.

What is FutureRestore?

FutureRestore is a modified idevicerestore wrapper, which allows manually specifying SEP and Baseband for restoring. This allows unsigned firmwares to be restored onto devices, providing you have a backup of the APTicket (SHSH Blobs), and can recreate all the specific conditions of the APTicket e.g. ECID, APNonce, Board ID.

Support

For support, join the FutureRestore Support server on Discord.

Features

Supports the following downgrade methods:
- Prometheus for 64-bit devices:
  - Prometheus via APNonce recreation with the APNonce generator
  - Prometheus via APNonce collision
- Odysseus for 32-bit & 64-bit (A7-A11) devices
- Re-restoring 32-bit devices to iOS 9.x with alitek123's no-ApNonce method (alternative — idevicererestore).

Compiling

See COMPILING

Futurerestore Usage

Usage: futurerestore [OPTIONS] iPSW

option (short)	option (long)	description
`-t`	`--apticket PATH`	Signing tickets used for restoring, commonly known as blobs
`-u`	`--update`	Update instead of erase install (requires appropriate APTicket)
		This parameter is recommended to not be used for downgrading. If you are jailbroken, make sure to have your orig-fs snapshot restored (Restore RootFS).
`-w`	`--wait`	Keep rebooting until ApNonce matches APTicket (ApNonce collision, unreliable)
`-d`	`--debug`	Show all code, use to save a log for debug testing
`-e`	`--exit-recovery`	Exit recovery mode and quit
`-c`	`--custom-latest VERSION`	Specify custom latest version to use for SEP, Baseband and other FirmwareUpdater components
`-g`	`--custom-latest-buildid BUILDID`	Specify custom latest buildid to use for SEP, Baseband and other FirmwareUpdater components
`-i`	`--custom-latest-beta`	Get custom url from list of beta firmwares
`-k`	`--custom-latest-ota`	Get custom url from list of OTA firmwares
`-3`	`--use-pwndfu`	Restoring devices with Odysseus method. Device needs to be in pwned DFU mode already
`-4`	`--no-ibss`	Restoring devices with Odysseus method. For checkm8/iPwnder32 specifically, bootrom needs to be patched already with unless iPwnder.
`-5`	`--rdsk PATH`	Set custom restore ramdisk for entering restoremode(requires use-pwndfu)
`-6`	`--rkrn PATH`	Set custom restore kernelcache for entering restoremode(requires use-pwndfu)
`-7`	`--set-nonce`	Set custom nonce from your blob then exit recovery(requires use-pwndfu)
`-7`	`--set-nonce=0xNONCE`	Set custom nonce then exit recovery(requires use-pwndfu)
`-8`	`--serial`	Enable serial during boot(requires serial cable and use-pwndfu)
`-9`	`--boot-args "BOOTARGS"`	Set custom restore boot-args(PROCEED WITH CAUTION)(requires use-pwndfu)
`-a`	`--no-cache`	Disable cached patched iBSS/iBEC(requires use-pwndfu)
`-f`	`--skip-blob`	Skip SHSH blob validation(PROCEED WITH CAUTION)(requires use-pwndfu)
`-0`	`--latest-sep`	Use latest signed SEP instead of manually specifying one
`-j`	`--no-rsep`	Choose not to send Restore Mode SEP firmware command
`-1`	`--latest-baseband`	Use latest signed baseband instead of manually specifying one
`-2`	`--no-baseband`	Skip checks and don't flash baseband
		Only use this for device without a baseband (eg. iPod touch or Wi-Fi only iPads)
Deprecated/Legacy Options:

option (short)	option (long)	description
`-s`	`--sep PATH`	Manually specify SEP to be flashed
`-m`	`--sep-manifest PATH`	BuildManifest for requesting SEP ticket
`-b`	`--baseband PATH`	Manually specify baseband to be flashed
`-p`	`--baseband-manifest PATH`	BuildManifest for requesting baseband ticket

1) Prometheus (64-bit device) - APNonce recreation with generator method

You can only downgrade if:

the destination firmware version is compatible with a currently signed SEP and baseband. Check whether your version is compatible here.
if you have a signing tickets files with a generator for that specific firmware version.

Requirements

A jailbreak or an exploit that allows nonce setting.
Signing ticket files (.shsh, .shsh2, .plist) with a generator
- A12+ users must also have a valid APNonce / generator pair due to nonce entanglement. Only having an APNonce without a generator is not sufficient.
A computer with a minimum of 8 gigabytes of free space + IPSW of the target version downloaded. You can find the IPSW for your device at IPSW.me.
On Windows machines, make sure to have this version of iTunes installed. Using the Microsoft Store version will cause issues.

Method:

Jailbreak your device if it isn't jailbroken already.
Open your blob in any text editor and search for the word "generator". In most text editors you can use CTRL + F / CMD + F to look for it.

This should be a 0x followed by 16 characters, which will be a combination of letters and numbers.

Note that value down. This is your generator.
- NOTE: If there is no generator value, try to remember which jailbreak you were using at the time of saving blobs. If you were using unc0ver, your generator is most likely 0x1111111111111111, and if you were using Chimera/Odyssey/Taurine, your generator is most likely 0xbd34a880be0b53f3.
Set your device's APNonce generator. You can use your jailbreak tool to set your generator in its native settings. However, setting your generator with dimentio is recommended.
Connect your device in normal mode to computer - make sure the trust dialog is accepted.
Recommended: Make a full backup of your device before running futurerestore.
On the computer run:

futurerestore -t blob.shsh2 --latest-sep --latest-baseband -d target.ipsw

If you are upgrading and want to preserve user data you may run:

futurerestore -u -t blob.shsh2 --latest-sep --latest-baseband -d target.ipsw

Using dimentio

To set generator with dimentio:

Open your package manager on your jailbroken iDevice
Add https://repo.1conan.com to your sources.
Add https://repo.chariz.com to your sources.
Download and install dimentio
Download and install NewTerm2
If you're on iOS 14.0 or above:
- Install libkernrw if you're using Taurine
- Install libkrw if you're using unc0ver
- checkra1n/odysseyra1n users don't need to install anything extra
Open NewTerm 2 on your iDevice and type the following command:

su root -c 'dimentio [generator]'
- [generator] should be the APNonce generator you just grabbed.
Example: su root -c 'dimentio 0x1111111111111111'
When asked for a password, enter your root password
- By default, this is set to alpine
Near the end of the text, you should see the line Set nonce to [generator]. This indicates that your generator has been set successfully.

Using jailbreak tools:

Use jailbreak tools for setting boot-nonce generator:

Meridian for iOS 10.x;
backr00m or greeng0blin for tvOS 10.2-11.1;
Electra and ElectraTV for iOS and tvOS 11.x;
Chimera and ChimeraTV for iOS 12.0-12.5.4 (Nonce setter only supports on 12.1.2 - 12.4.1 on A12, and 12.1.3 - 12.5.4 is only supported on A7 - A11 devices.)
Odyssey for iOS 13.0-13.7
- Note that there are some reported issues with Odyssey's generator setter. Using it is not recommended.
Taurine for iOS 14.0-14.3
unc0ver for iOS 11.0-14.3

Firmware Signing Info

Currently you can restore to the following versions with the latest SEP and baseband for your device:

Devices that only support up to iOS 12 (most A7 and A8 devices excluding iPad5,1 - iPad5,4): 11.3-12.5.4

A9 and A10: 14.0-14.7

A11 devices: 14.3-14.7

A12 devices and newer: 14.0-14.7

Common Issues

SEP Firmware is not being signed

This problem occurs when the user tries to manually specify SEP from the target version, instead of from the latest available version. To fix this problem, either choose the latest-sep argument or manually specify a SEP from the latest available iOS version.

Could not connect to device in recovery mode / Failed to place device in recovery mode

NOTE: if the error is similarly named, follow these steps too.

If your device is in recovery mode:

Run FutureRestore again while your device is in recovery mode.

If your device is not in recovery mode:

Enter recovery mode manually, then run FutureRestore again.

Device ApNonce doesn't match APTicket nonce

This error means that you have not set your generator on your device to that of the blob. In order to solve this problem, you must set your generator with dimentio or any jailbreak tool.

If after following the steps you still cannot resolve this issue, your generator may not correspond to its respective APNonce.
If you saved blobs while unjailbroken on A12+ without getnonce or blobsaver v3, your APNonce/generator pair is invalid. This cannot be resolved.

Unable to send iBEC (error -8)

Leave the device plugged in, it'll stay on the Recovery screen;
Head over to Device Manager under Control Panel in Windows;
Locate "Apple Recovery (iBoot) USB Composite Device" (at the bottom);
Right click and choose "Uninstall device". You may see a tick box that allows you to uninstall the driver software as well, tick that (all the three Apple mobile device entries under USB devices will disappear);
Unplug the device and re-plug it in;
Go back to futurerestore and send the restore command again (just press the up arrow to get it back, then enter).
Error -8 should now be fixed.

Error: Unable to receive message from FDR...

The fix for this is either waiting (it can take a very long time) or just re-trying the process. This is an error that has been diagnosed but no fix for it is available as of the time of writing this.

2) Prometheus (64-bit device) - ApNonce collision method (Recovery mode)

Requirements

Device with A7 chip on iOS 9.1 - 10.2 or iOS 10.3 beta 1;
Jailbreak isn't required;
Signing ticket files (.shsh, .shsh2, .plist) with a custom ApNonce;
Signing ticket files needs to have one of the APNonces which the device generates a lot;

Info

You can downgrade if the destination firmware version, if it is compatible with the latest sep and baseband!. You also need to have special signing ticket files. If you don't know what this is, you probably can NOT use this method!

How to use

Connect your device in normal or recovery mode;
On the computer run futurerestore -w -t ticket.shsh --latest-baseband --latest-sep firmware.ipsw

If you have saved multiple signing tickets with different nonces you can specify more than one to speed up the process: futurerestore -w -t t1.shsh -t t2.shsh -t t3.shsh -t t4.shsh --latest-baseband --latest-sep firmware.ipsw

3) Prometheus (64-bit device) - ApNonce collision method (DFU mode)

Requirements

A device with an A7 SoC:
- (iPhone 5s, iPad Air, iPad mini 2), A8 (iPhone 6 [+], iPad mini [2,3,4], iPod touch [6th generation]) and A8X (iPad Air 2) chips on all firmwares
Devices that have been released after ~ September, 2015 {PROBABLY};
Jailbreak isn't required;
Signing ticket files (.shsh, .shsh2, .plist) with a customly chosen APNonce;
Signing ticket files needs to have one of the ApNonces, which the device generates a lot;
img4tool can't be used for Windows [problem with signing iBSS/iBEC], now it's TO-DO;

Info

You can downgrade if the destination firmware version, if it is compatible with the latest SEP and baseband. You also need to have special signing ticket files. If you don't know what this is, you probably can NOT use this method!

How to use

Connect your device in DFU mode;
Use irecovery for checking ApNonce, which booted in DFU;
Extract iBSS/iBEC from target firmware for downgrade (unsigned);
Check DFU-collisioned ApNonces with irecovery, which booted in DFU. You can't automatically collision DFU ApNonces.

If ApNonce is not collisioned, "use hands" for DFU booting.

If ApNonce is successfully collisioned, use this SHSH2 to sign iBSS/iBEC.
Use img4tool for sign iBSS: img4tool -s ticket.shsh -c iBSS.signed -p <original_iBSS>;
Use img4tool for sign iBEC: img4tool -s ticket.shsh -c iBEC.signed -p <original_iBEC>;
So, after signing we can boot into Recovery with irecovery.

irecovery -f iBSS.signed - loading iBSS;

irecovery -f iBEC.signed - loading iBEC;
So good! On the computer run futurerestore -t ticket.shsh --latest-baseband --latest-sep -w firmware.ipsw.

4) Odysseus (32-bit / 64-bit devices)

Requirements

futurerestore compiled with libipatcher;
Jailbreak or bootrom exploit (limera1n, checkm8);
32-bit: firmware keys for the device/destination firmware version must be public (check ipsw.me)
64-bit: Signing ticket files (.shsh, .shsh2, .plist) for the destination firmware (OTA blobs work too!).

Info

If you have a jailbroken device, you can downgrade to any firmware version you have blobs for, as long as the baseband is compatible, SEP does not have to be compatible.

You can still get OTA blobs for iOS 6.1.3, 8.4.1 or 10.3.3 for some devices and use those.

How to use

Get device into kDFU/pwnDFU

Pre-iPhone4s (limera1n devices):
- Enter to pwnDFU mode with redsn0w or any other tool
iPhone 4s and later 32-bit devices:
- Enter to kDFU mode with kDFU app (cydia: repo.tihmstar.net) or by loading a pwnediBSS from any existing odysseus bundle
Any 64-bit device:
- Enter to pwnDFU mode and patch signature check with special fork of ipwndfu

Connect your device to computer in kDFU mode (or pwnDFU mode)
On the computer run futurerestore --use-pwndfu -t ticket.shsh --latest-baseband -d firmware.ipsw

You can use any odysseus bundle for this.

5) iOS 9.x re-restore bug by @alitek123 (only for 32-bit devices)

Requirements

Jailbreak isn't required;
Signing ticket files (.shsh, .shsh2, .plist) from by iOS 9.x without ApNonce (noNonce APTickets)

Info

If you have signing ticket files for iOS 9.x, which do not contain a ApNonce, you can restore to that firmware.

How to use

Connect your device in DFU mode
On the computer run futurerestore -t ticket.shsh --latest-baseband ios9.ipsw

Report an issue

Before you report an issue, please check that it is not mentioned in the Common Issues section. If it is not, you can report your issue here.

futurerestore's People

Contributors

Stargazers

Watchers

Forkers

houdylan bansdude hoahuynhlira saddam1999 opa334 tolikes dihaohappy ay44en livefrommin idwpan ageelhalawi namlee135 geekonion xlsn0wkit joshblah555 dpinse diatrus djsousuo h0ahuynh qtlunya tanbeer191 shen-xianpeng lirateam coocoofroggy anyways-gif yesimole guytoru blaineguggenmos conrad-mo davidbkr03 shark-stuff lwlsw lukeegd tomay3000 bryton90 admin-elvistrujanovic johnsloven chizzup drink121 realimuseum dezroch mmshivesh varnika41 deadnikmmaster sanderkees kjhggd richiegigabit dhinakg ncg33 tiltshiftfocus ckiosprocjet eclipse445 pavelekpl sadatt123 sewminat25 wayzer107 jarvis-ai viccy5022 aholicknight chris09boyd growtopiajaw mostm uityo jerjer1223 unnamed124 ray0189 streemline nabsat2525 josekay derrtijarist jieunboy0516 sanjex nabilbkfa40 mineek omaralsh sawl1n avatararts aspenmayer neoncloud xaesalvaje vuong07 travisbeer leitianya laimao520 zerishpho lennon1997 guinnessshep dacadla miticollo mitchk344 capy4u palera1n-high-sierra hyk090307 dargn3k ra9labs mattasyahoo2 chelaxian nanii17 primeplatypus nick-botticelli

futurerestore's Issues

device "can't enter recovery mode"

my iphone is definitely in recovery mode

but the command failed because...

Unable to compile futurerestore due to color's

I'm unable to compile via Ubuntu. Apparently, this is an idevicerestore issue and it is fixed with this issue page libimobiledevice/idevicerestore#489

Here's my error log https://pastebin.com/rHZCQ89X

external/idevicerestore won't build with new versions of libimobiledevice-glue

it needs this commit:
libimobiledevice/idevicerestore@f80a876

error Device did not disconnect. Possibly invalid iBSS. Reset device and try again

why this error? ipwndfu entered

Unknown data request 'FirmwareUpdaterPreflight' received

15.3 -> 15.2 SE1. What's wrong? No further downgrade. futurerestore v194 for Windows

Error while downgrading from iOS 15 to 14.5

Variant: Customer Erase Install (IPSW) This restore will erase your device data. irecv_event_cb: device 001869dc0006002e (udid: N/A) connected in DFU mode Device found in DFU Mode. Getting firmware keys for: d20ap irecv_event_cb: device 001869dc0006002e (udid: N/A) disconnected Repacking patched bootloaders as IMG4 Cleaning up... [exception]: what=Device did not reconnect. Possibly invalid iBSS. Reset device and try again code=40960017 line=625 file=futurerestore.cpp commit count=268: commit sha =b013fff1e54f896fd2fb2834ea02615ee99314d8: Done: restoring failed!

Any idea what is causing this and how to fix it?

[Maintainer] Issues with release v194

Fix Failed to enter recovery mode
Remove device should turn green warning message shows up on non bgcolor devices
Rewrite firmware updater components to not use zip ipsw
Fix 32bit restores(and pwned 64bit) aka pwned dfu restores
Improve CI
Current tsschecker is outdated, so merge a new updated fork

Bug: random race conditions leading to crashing on multiple os's

Most likely related to usbmuxd subscribe(so the host os is locking the rights and fr accidently tries to locked rights as well leading to crash?) Need DEBUG build crash logs. This doesn't happen all the time but annoying when it does.

Looking for people to use the DEBUG build to get me a crash log.

Can macOS-arm64-RELEASE run on linux/android arm64?

I have a rooted android, which can run things like checkra1n. I need to use futurerestore, though, and I'm afraid to use a bootable linux drive on my PC b/c I've had safemode bootloop issues in the past with it. Creating windows recovery media now just in case, but I'd rather not have to go the USB route anyway.

Does the macOS ARM64 version work on linux or other arm64 systems too? If not, could you make a build that does? Would really, REALLY help me out 😬

Request: Add Windows build to actions

Not sure if there are technical complications preventing this or not, but if there aren't this would be a huge time saver.

FDR Panic on A12

Downgrading to iOS 14.5.1 using iOS 15.1 beta 1 SEP + Baseband (3.50.9 Baseband which should be compatible theoretically and is still signed) on iPhone XR with Blobs but panics with FDR timeout. Using Nightly Build (Oct 8, 2021)

Sending NORData now...
Done sending NORData
FDR 0x7fdb4f0f1170 timeout waiting for command
FDR 0x7fdb4f0f1170 waiting for message...
idevice_event_cb: device 00027d800a32002e (udid: 00008020-00027D800A32002E) disconnected
ERROR: Unable to receive message from FDR 0x7fdb4f0f1170 (-2). 0/2 bytes
FDR 0x7fdb4f0f1170 terminating...
ERROR: Could not read data (-256). Aborting.
Cleaning up...
[exception]:
what=ERROR: Unable to restore device

code=101384209
line=1547
file=futurerestore.cpp
commit count=253:
commit sha  =b49aad07f19b0b17d4ae97ab89675c971747b989:
Done: restoring failed!
httpwemel@Wemels-MacBook-Pro futurerestore %

Device did not reconnect. Possibly invalid iBEC. Reset device and try again when trying to downgrade iOS 15.5 to 14.8 on a iPhone 6s

I am trying to downgrade my iPhone 6s from iOS 15.5 to 14.8. I can enter pwned DFU mode fine:

But when I try to downgrade iOS 15.5 to 14.8 with the command:
sudo ./futurerestore -t 15.5-19F77_.shsh2 --use-pwndfu --skip-blob --no-ibss --debug --latest-baseband --latest-sep /Users/aholicknight/Documents/iPhoneFirmwares/iPhone_4.7_14.8_18H17_Restore.ipsw

this is the output:

aholicknight@MacBookPro futurerestorebeta % sudo ./futurerestore -t 15.5-19F77_.shsh2 --use-pwndfu --skip-blob --no-ibss --debug --latest-baseband --latest-sep /Users/aholicknight/Documents/iPhoneFirmwares/iPhone_4.7_14.8_18H17_Restore.ipsw
Version: v2.0.0-test(3bfba667cce95a85ec918210f8b05d2aed6c3d91-281)
img4tool version: 0.197-aca6cf005c94caf135023263cbb5c61a0081804f-DEBUG
libipatcher version: 0.88-1e855d70c84419014e363bdbcaead7b145fe3e1f-DEBUG
Odysseus for 32-bit support: yes
Odysseus for 64-bit support: yes
[INFO] 64-bit device detected
futurerestore init done
reading signing ticket 15.5-19F77_.shsh2 is done
user specified to use latest signed SEP

[TSSC] opening firmwares.json
[DOWN] downloading file https://api.ipsw.me/v2.1/firmwares.json/condensed
[TSSC] opening /tmp/betas_iPhone8,1.json
[DOWN] downloading file https://api.m1sta.xyz/betas/iPhone8,1
[TSSC] selecting latest firmware version: 15.5
[TSSC] got firmwareurl for iOS 15.5 build 19F77
[TSSC] opening Buildmanifest for iPhone8,1_15.5
[DOWN] downloading file https://updates.cdn-apple.com/2022SpringFCS/fullrestores/012-07449/CC1C0468-8FEE-468B-9574-6998C7B0683D/BuildManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Selected BuildIdentity for request
downloading SEP
100 [===================================================================================================>]
[TSSC] opening /tmp/futurerestore/sepManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Selected BuildIdentity for request
[TSSR] ecid=5689117860967772
[TSSR] ApNonce=V???AYYQ
?ީ
[TSSR] SepNonce=?Q95p????'????H?
NOTE: Unable to find BbCalibrationManifestKeyHash node
NOTE: Unable to find BbFactoryActivationManifestKeyHash node
NOTE: Unable to find BbSkeyId node
DEBUG: Applying restore request rules for entry AOP
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry Ap,SystemVolumeCanonicalMetadata
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry AppleLogo
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryCharging0
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryCharging1
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryFull
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryLow0
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryLow1
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryPlugin
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry DeviceTree
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry KernelCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry LLB
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry OS
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RecoveryMode
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreDeviceTree
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreKernelCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreLogo
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreRamDisk
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreSEP
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreTrustCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry SEP
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Applying restore request rules for entry StaticTrustCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry SystemVolume
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry ftap
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: No Digest data, using empty value for entry ftap
DEBUG: Applying restore request rules for entry ftsp
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Adding EPRO=true to TSS entry
DEBUG: No Digest data, using empty value for entry ftsp
DEBUG: Applying restore request rules for entry iBEC
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry iBSS
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry iBoot
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry rfta
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: No Digest data, using empty value for entry rfta
DEBUG: Applying restore request rules for entry rfts
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Adding EPRO=true to TSS entry
DEBUG: No Digest data, using empty value for entry rfts
[TSSR] User specified to not request a baseband ticket.
/Users/runner/work/futurerestore/futurerestore/external/idevicerestore/src/common.c:supressed printing 6926 bytes plist...
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
/Users/runner/work/futurerestore/futurerestore/external/idevicerestore/src/common.c:supressed printing 8691 bytes plist...
user specified to use latest signed baseband

[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Selected BuildIdentity for request
downloading Baseband
100 [===================================================================================================>]
ERROR: Unable to connect to device?!
DEBUG: Device does not have TelephonyCapability, no FirmwarePreflightInfo
[Error] Unable to find required BbGoldCertId in parameters
[WARNING] using tsschecker's fallback to get BasebandGoldCertID. This might result in invalid baseband signing status information
[TSSC] opening /tmp/futurerestore/basebandManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Selected BuildIdentity for request
[TSSR] ecid=5689117860967772
[TSSR] ApNonce=V???AYYQ
?ީ
[TSSR] SepNonce=?Q95p????'????H?
NOTE: Unable to find BbCalibrationManifestKeyHash node
NOTE: Unable to find BbFactoryActivationManifestKeyHash node
NOTE: Unable to find BbSkeyId node
DEBUG: Applying restore request rules for entry AOP
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry Ap,SystemVolumeCanonicalMetadata
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry AppleLogo
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryCharging0
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryCharging1
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryFull
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryLow0
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryLow1
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryPlugin
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry DeviceTree
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry KernelCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry LLB
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry OS
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RecoveryMode
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreDeviceTree
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreKernelCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreLogo
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreRamDisk
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreSEP
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreTrustCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry SEP
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Applying restore request rules for entry StaticTrustCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry SystemVolume
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry ftap
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: No Digest data, using empty value for entry ftap
DEBUG: Applying restore request rules for entry ftsp
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Adding EPRO=true to TSS entry
DEBUG: No Digest data, using empty value for entry ftsp
DEBUG: Applying restore request rules for entry iBEC
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry iBSS
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry iBoot
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry rfta
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: No Digest data, using empty value for entry rfta
DEBUG: Applying restore request rules for entry rfts
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Adding EPRO=true to TSS entry
DEBUG: No Digest data, using empty value for entry rfts
[TSSR] User specified to request only a Baseband ticket.
/Users/runner/work/futurerestore/futurerestore/external/idevicerestore/src/common.c:supressed printing 9322 bytes plist...
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
/Users/runner/work/futurerestore/futurerestore/external/idevicerestore/src/common.c:supressed printing 20725 bytes plist...
Downloading the latest firmware components...
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Selected BuildIdentity for request
Finished downloading the latest firmware components!
Found device in DFU mode
requesting to get into pwnRecovery later
irecv_event_cb: device 000c614a10XXXXXX (udid: N/A) connected in DFU mode
Found device in DFU mode
Identified device as n71map, iPhone8,1
Extracting BuildManifest from iPSW
Product version: 14.8
Product build: 18H17 Major: 18
Device supports Image4: true
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Selected BuildIdentity for request
checking if the APTicket is valid for this restore...
Verified ECID in APTicket matches the device's ECID
checking if the APTicket is valid for this restore...
Verified ECID in APTicket matches the device's ECID
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AOP"                     OK (untrusted)
[IMG4TOOL] checking hash for "Ap,SystemVolumeCanonicalMetadata"BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "AppleLogo"               BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BasebandFirmware"        IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "BatteryCharging0"        BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryCharging1"        BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryFull"             BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow0"             BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow1"             BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryPlugin"           BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "DeviceTree"              BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "KernelCache"             BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "LLB"                     BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "OS"                      BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RecoveryMode"            BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreKernelCache"      BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreLogo"             BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP"              BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreTrustCache"       BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SEP"                     BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "StaticTrustCache"        BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SystemVolume"            BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "ftap"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "ftsp"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "iBEC"                    BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBSS"                    BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBoot"                   BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "rfta"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "rfts"                    IGN (no digest in BuildManifest)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197:
commit sha  =aca6cf005c94caf135023263cbb5c61a0081804f:
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 3:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AOP"                     OK (untrusted)
[IMG4TOOL] checking hash for "Ap,SystemVolumeCanonicalMetadata"BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "AppleLogo"               BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BasebandFirmware"        IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "BatteryCharging0"        BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryCharging1"        BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryFull"             BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow0"             BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow1"             BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryPlugin"           BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "DeviceTree"              BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "KernelCache"             BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "LLB"                     BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "OS"                      BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RecoveryMode"            BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreKernelCache"      BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreLogo"             BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP"              BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreTrustCache"       BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SEP"                     BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "StaticTrustCache"        BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SystemVolume"            BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "ftap"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "ftsp"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "iBEC"                    BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBSS"                    BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBoot"                   BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "rfta"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "rfts"                    IGN (no digest in BuildManifest)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197:
commit sha  =aca6cf005c94caf135023263cbb5c61a0081804f:
[WARNING] NOT VALIDATING SHSH BLOBS IM4M!
[Error] BuildIdentity selected for restore does not match APTicket

BuildIdentity selected for restore:
BuildNumber : 18H17
BuildTrain : AzulSecuritySky
DeviceClass : n71map
FDRSupport : YES
MobileDeviceMinVersion : 1253.100.1
RestoreBehavior : Erase
Variant : Customer Erase Install (IPSW)

BuildIdentity is valid for the APTicket:
IM4M is not valid for any restore within the Buildmanifest
This APTicket can't be used for restoring this firmware
[WARNING] NOT VALIDATING SHSH BLOBS!
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Selected BuildIdentity for request
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
irecv_event_cb: device 000c614a10XXXXXX (udid: N/A) connected in DFU mode
Device found in DFU Mode.
Sending iBEC (436387 bytes)...
[==================================================] 100.0%
Booting iBEC, waiting for device to disconnect...
irecv_event_cb: device 000c614a10XXXXXX (udid: N/A) disconnected
Booting iBEC, waiting for device to reconnect...
irecv_event_cb: device 000c614a10XXXXXX (udid: N/A) connected in DFU mode
Cleaning up...
[exception]:
what=Device did not reconnect. Possibly invalid iBEC. Reset device and try again
code=45613124
line=696
file=/Users/runner/work/futurerestore/futurerestore/src/futurerestore.cpp
commit count=281:
commit sha  =3bfba667cce95a85ec918210f8b05d2aed6c3d91:
Done: restoring failed!

If anyone can tell me what the problem is, that would be great as I am stuck until I can get this issue resolved. Thank you!

Before you say that the ECID is wrong or the device 000c614a10XXXXXX is incorrect, I changed some information to remove private information. If you want the un-edited information, please tell me and I will send it to you directly.

Test

FDR unable to connect on A9. iOS 15.0.1, latest BB and SEP

restore_is_current_device: Connected to com.apple.mobile.restored, version 15 Connecting to FDR client at port 1082 About to do ctrl handshake FDR sending 89 bytes: FDR Sent 89 bytes FDR Received 105 bytes Ctrl handshake done (ConnPort = 49159) FDR 0000000003c0aaf0 waiting for message... DEBUG: tss_response_get_path_by_entry: No entry 'LLB' in TSS response NOTE: Could not get LLB path from TSS data, will fetch from build identity Tag found Tag found Tag found Tag found Tag found Tag found Tag found Tag found Tag found Tag found Tag found Tag found Tag found idevice_event_cb: device (udid: ffffffffffffffffffffffffffffffff00000004) disconnected ERROR: Unable to receive message from FDR 0000000003c0aaf0 (-2). 0/2 bytes FDR 0000000003c0aaf0 terminating... ERROR: Could not read data (-256). Aborting. irecv_event_cb: device (udid: ffffffffffffffffffffffffffffffff00000004) connected in Recovery mode

Windows 11
Tried all three usb ports on my laptop. 2x USBA and 1x USBC

Use SEP from delayed OTA

is it possible to implement this while 14.8 is out there?

Error while upgrading iPhone 12

Hello, I encountered an error on the latest futureRestore trying to upgrade an iPhone 12 on iOS 14.2.1 to 15.1.

Personalizing IMG4 component iBoot...
Personalizing IMG4 component RestoreSEP...
Personalizing IMG4 component SEP...
common.c:supressed printing 27854450 bytes plist...
Sending NORData now...
Done sending NORData
Cleaning up...
[exception]:
what=ERROR: Unable to restore device

code=82182161
line=1254
file=futurerestore.cpp
commit count=266:
commit sha  =06137f3ba489b5ad89fa0f2a8930305e6ce7ee92:
Done: restoring failed!

I tried it serveral times, but it always gets stuck here. I am able to kick it out of recovery though. Is there any fix?
Thanks

FDR SEP panic on a12-a14 sometimes

macOS bigsur

./futurerestore-x86_64-v2.0.0-test -t blob.shsh2 -u --latest-sep --no-baseband iPad_Spring_2019_14.3_18C66_Restore.ipsw

Version: v2.0.0-test(1c99b080922de9b2b05a5a4c8aee9d24ee702c63-234)
img4tool version: 0.197+git20210129-aca6cf005c94caf135023263cbb5c61a0081804f-RELEASE
libipatcher version: 0.86+git20210810-6a3b358b673e74c2be9f9b8a74a63b80dd94abf1-RELEASE
Odysseus for 32-bit support: yes
Odysseus for 64-bit support: yes
[INFO] 64-bit device detected
futurerestore init done
reading signing ticket blob.shsh2 is done
user specified to use latest signed SEP
[TSSC] opening firmwares.json
[DOWN] downloading file https://api.ipsw.me/v2.1/firmwares.json/condensed
[TSSC] selecting latest firmware version: 14.7.1
[TSSC] got firmwareurl for iOS 14.7.1 build 18G82
[TSSC] opening Buildmanifest for iPad11,3_14.7.1
[DOWN] downloading file https://updates.cdn-apple.com/2021SummerFCS/fullrestores/071-73991/70E438C9-94E8-4CDB-9F28-B6E9E36A379F/BuildManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
downloading SEP
100 [===================================================================================================>]
[TSSC] opening /tmp/futurerestore/sepManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to not request a baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received

WARNING: user specified is not to flash a baseband. This can make the restore fail if the device needs a baseband!
if you added this flag by mistake, you can press CTRL-C now to cancel
continuing restore in 10 9 8 7 6 5 4 3 2 1 
Downloading the latest firmware components...
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
downloading SE firmware
100 [===================================================================================================>]
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
Finished downloading the latest firmware components!
Found device in Normal mode
Entering recovery mode...
INFO: device serial number is XXXXXX
Found device in Recovery mode
Identified device as j217ap, iPad11,3
Extracting BuildManifest from iPSW
Product version: 14.3
Product build: 18C66 Major: 18
Device supports Image4: true
Got ApNonce from device: 9d 69 0a 21 1e d2 4b 39 80 be 81 1e 6e 88 dc 46 80 20 9d 39 4f 7c a2 8b de 3d 7e de 46 9c 9d b7 
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Checking BuildIdentity 4
[TSSR] Checking BuildIdentity 5
[TSSR] Checking BuildIdentity 6
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Checking BuildIdentity 4
[TSSR] Checking BuildIdentity 5
[TSSR] Checking BuildIdentity 6
[TSSR] Selected BuildIdentity for request
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "ANE"                     OK (found "anef" with matching hash)
[IMG4TOOL] checking hash for "AOP"                     OK (found "aopf" with matching hash)
[IMG4TOOL] checking hash for "AVE"                     OK (found "avef" with matching hash)
[IMG4TOOL] checking hash for "Ap,SystemVolumeCanonicalMetadata"OK (found "msys" with matching hash)
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "GFX"                     OK (found "gfxf" with matching hash)
[IMG4TOOL] checking hash for "ISP"                     OK (found "ispf" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "Multitouch"              OK (untrusted)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "RestoreTrustCache"       BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SE,UpdatePayload"        IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "SIO"                     OK (found "siof" with matching hash)
[IMG4TOOL] checking hash for "StaticTrustCache"        OK (found "trst" with matching hash)
[IMG4TOOL] checking hash for "SystemVolume"            OK (found "isys" with matching hash)
[IMG4TOOL] checking hash for "ftap"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "ftsp"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)
[IMG4TOOL] checking hash for "rfta"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "rfts"                    IGN (no digest in BuildManifest)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197+git20210129:
commit sha  =aca6cf005c94caf135023263cbb5c61a0081804f:
[IMG4TOOL] checking buildidentity 3:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 4:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 5:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 6:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "ANE"                     OK (found "anef" with matching hash)
[IMG4TOOL] checking hash for "AOP"                     OK (found "aopf" with matching hash)
[IMG4TOOL] checking hash for "AVE"                     OK (found "avef" with matching hash)
[IMG4TOOL] checking hash for "Ap,SystemVolumeCanonicalMetadata"OK (found "msys" with matching hash)
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "GFX"                     OK (found "gfxf" with matching hash)
[IMG4TOOL] checking hash for "ISP"                     OK (found "ispf" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "Multitouch"              OK (untrusted)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          OK (found "rdsk" with matching hash)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "RestoreTrustCache"       OK (found "rtsc" with matching hash)
[IMG4TOOL] checking hash for "SE,UpdatePayload"        IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "SIO"                     OK (found "siof" with matching hash)
[IMG4TOOL] checking hash for "StaticTrustCache"        OK (found "trst" with matching hash)
[IMG4TOOL] checking hash for "SystemVolume"            OK (found "isys" with matching hash)
[IMG4TOOL] checking hash for "ftap"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "ftsp"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)
[IMG4TOOL] checking hash for "rfta"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "rfts"                    IGN (no digest in BuildManifest)
Verified APTicket to be valid for this restore
Variant: Customer Upgrade Install (IPSW)
This restore will update your device without erasing user data.
Extracting filesystem from iPSW
[==================================================] 100.0%
Extracting iBEC.j217.RELEASE.im4p (Firmware/dfu/iBEC.j217.RELEASE.im4p)...
Personalizing IMG4 component iBEC...
Sending iBEC (1171292 bytes)...
waiting for device to reconnect... Getting SepNonce in recovery mode... fe f7 ed 2e 35 4f 00 f5 e4 48 97 66 3e 2e cb d7 a0 03 33 9f 
Getting ApNonce in recovery mode... 9d 69 0a 21 1e d2 4b 39 80 be 81 1e 6e 88 dc 46 80 20 9d 39 4f 7c a2 8b de 3d 7e de 46 9c 9d b7 
Recovery Mode Environment:
iBoot build-version=iBoot-6723.62.3
iBoot build-style=RELEASE
Sending RestoreLogo...
Extracting applelogo@2224~ipad.im4p (Firmware/all_flash/applelogo@2224~ipad.im4p)...
Personalizing IMG4 component RestoreLogo...
Sending RestoreLogo (29014 bytes)...
ramdisk-size=0x20000000
Extracting 038-83019-083.dmg (038-83019-083.dmg)...
Personalizing IMG4 component RestoreRamDisk...
Sending RestoreRamDisk (109477665 bytes)...
Extracting h11_ane_fw_quin.im4p (Firmware/ane/h11_ane_fw_quin.im4p)...
Personalizing IMG4 component ANE...
Sending ANE (2867542 bytes)...
Extracting aopfw-ipad11aop.im4p (Firmware/AOP/aopfw-ipad11aop.im4p)...
Personalizing IMG4 component AOP...
Sending AOP (1469726 bytes)...
Extracting AppleAVE2FW_H11.im4p (Firmware/ave/AppleAVE2FW_H11.im4p)...
Personalizing IMG4 component AVE...
Sending AVE (1131022 bytes)...
Extracting armfw_g11p.im4p (Firmware/agx/armfw_g11p.im4p)...
Personalizing IMG4 component GFX...
Sending GFX (864622 bytes)...
Extracting adc-petra-j2x.im4p (Firmware/isp_bni/adc-petra-j2x.im4p)...
Personalizing IMG4 component ISP...
Sending ISP (6832150 bytes)...
Extracting 038-83019-083.dmg.trustcache (Firmware/038-83019-083.dmg.trustcache)...
Personalizing IMG4 component RestoreTrustCache...
Sending RestoreTrustCache (12535 bytes)...
Extracting SmartIOFirmware_ASCv2.im4p (Firmware/SmartIOFirmware_ASCv2.im4p)...
Personalizing IMG4 component SIO...
Sending SIO (1160282 bytes)...
Extracting DeviceTree.j217ap.im4p (Firmware/all_flash/DeviceTree.j217ap.im4p)...
Personalizing IMG4 component RestoreDeviceTree...
Sending RestoreDeviceTree (40850 bytes)...
Extracting sep-firmware.j217.RELEASE.im4p (Firmware/all_flash/sep-firmware.j217.RELEASE.im4p)...
Personalizing IMG4 component RestoreSEP...
Sending RestoreSEP (6004233 bytes)...
Extracting kernelcache.release.ipad11 (kernelcache.release.ipad11)...
Personalizing IMG4 component RestoreKernelCache...
Sending RestoreKernelCache (15674014 bytes)...
getting SEP ticket
Trying to fetch new SHSH blob
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Received SHSH blobs
About to restore device... 
Connecting now...
Connected to com.apple.mobile.restored, version 15
Device XXXXX has successfully entered restore mode
Hardware Information:
BoardID: 28
ChipID: 32800
UniqueChipID: XXXXXX
ProductionMode: true
Starting FDR listener thread
About to send RootTicket...
Sending RootTicket now...
Done sending RootTicket
Waiting for NAND (28)
Updating NAND Firmware (58)
About to send NORData...
Found firmware path Firmware/all_flash
Getting firmware manifest from build identity
Extracting LLB.j217.RELEASE.im4p (Firmware/all_flash/LLB.j217.RELEASE.im4p)...
Personalizing IMG4 component LLB...
Extracting applelogo@2224~ipad.im4p (Firmware/all_flash/applelogo@2224~ipad.im4p)...
Personalizing IMG4 component AppleLogo...
Extracting batterycharging0@2224~ipad.im4p (Firmware/all_flash/batterycharging0@2224~ipad.im4p)...
Personalizing IMG4 component BatteryCharging0...
Extracting batterycharging1@2224~ipad.im4p (Firmware/all_flash/batterycharging1@2224~ipad.im4p)...
Personalizing IMG4 component BatteryCharging1...
Extracting batteryfull@2224~ipad.im4p (Firmware/all_flash/batteryfull@2224~ipad.im4p)...
Personalizing IMG4 component BatteryFull...
Extracting batterylow0@2224~ipad.im4p (Firmware/all_flash/batterylow0@2224~ipad.im4p)...
Personalizing IMG4 component BatteryLow0...
Extracting batterylow1@2224~ipad.im4p (Firmware/all_flash/batterylow1@2224~ipad.im4p)...
Personalizing IMG4 component BatteryLow1...
Extracting glyphplugin@2224~ipad-lightning.im4p (Firmware/all_flash/glyphplugin@2224~ipad-lightning.im4p)...
Personalizing IMG4 component BatteryPlugin...
Extracting DeviceTree.j217ap.im4p (Firmware/all_flash/DeviceTree.j217ap.im4p)...
Personalizing IMG4 component DeviceTree...
Extracting recoverymode@2224~ipad-lightning.im4p (Firmware/all_flash/recoverymode@2224~ipad-lightning.im4p)...
Personalizing IMG4 component RecoveryMode...
Extracting iBoot.j217.RELEASE.im4p (Firmware/all_flash/iBoot.j217.RELEASE.im4p)...
Personalizing IMG4 component iBoot...
Personalizing IMG4 component RestoreSEP...
Personalizing IMG4 component SEP...
Sending NORData now...
Done sending NORData
ERROR: Unable to receive message from FDR 0x7f917f64b6c0 (-2). 0/2 bytes
ERROR: Could not read data (-256). Aborting.
Cleaning up...
[exception]:
what=ERROR: Unable to restore device

code=99549201
line=1519
file=futurerestore.cpp
commit count=234:
commit sha  =1c99b080922de9b2b05a5a4c8aee9d24ee702c63:
Done: restoring failed!

Failed to restore devices from iOS 15.4 to iOS 14.6

Unable to restore devices from iOS 15.4 to iOS 14.6
Using pwndfu mode with set nonced
iPhone 6s , N71AP
Logs attached :
FRLog_2022-04-01T12.09.55.932632.txt
FRLog_2022-04-01T12.10.42.034181.txt

Link for beta build is broken

Hi,
https://nightly.link/m1stadev/futurerestore/workflows/ci/test is broken
Can you fix it please?

Failed restore iPhone 11 to iOS 14.2 from iOS 14.2

Here log file, I lost the jailbreak this is sad lol

i hope this log help you
Terminal.log

Stuck at "Waiting for message from FDR..."

I've tried to use the program to update my iPhone 7 GSM/ iPhone 9.3 from iOS 12.4 to iOS 14.3 and its stuck at the message "FDR 00000000044964c0 waiting for message..." and after that "FDR 00000000044964c0 timeout waiting for command". Even after restartig the restoring process or after letting it do its thing for 10 minutes hoping that it would eventually just work. I couldn't find anything on the internet to fix this.

Can't downgrading iPhone 8 from 15.0.1 to 14.4.2

I followed this tutorial: https://gist.github.com/nyuszika7h/aac55c97f7925cddcf5ec3167f85dfe8
I'm downgrading from 15.0.1 to 14.4.2 on device iPhone 8. SEP checker said it's compatible. I checked latest SEP and baseband, using futurerestore 2.0.0-test on MacOS 10.13.6 (Hackintosh) . But I received this:
ERROR: Unable to receive message from FDR 0x7fe334f01110 (-2). 0/2 bytes
Here is full logs: https://pastebin.com/aNCym1b1
Thank you very much!

iPad6,3 fails to restore to iOS 14.3

Wi-Fi only device (iPad6,3) attempting to restore with no baseband & latest SEP

Edit: Not my log, but it was similar to this:

futurerestore-a13/a14-v189.zip

Is there an issue with futurerestore-a13/a14-v189.zip? Just wondering if it was pulled or something kuz it’s not in the downloads section, I was able to get a copy somewhere else but just making sure there’s no problems.

Edit: scratch that the zip file is corrupted from where I got it from.

Bug: usbmuxd subscribe seems to not properly update the device's state on m1 usb-c mac's

Not sure why but yeh, iBEC fails :(

Adding Windows Feature to auto handle errors 8,

hello,
on windows 10 there is : pnputil over cli to removing driver, if you can add this to windows version will be helpful for us(windows user)

`C:\Users\BH11040>pnputil
Microsoft PnP Utility

Commands:

/add-driver <filename.inf | *.inf> [/subdirs] [/install] [/reboot]

Add driver package(s) into the driver store.
  /subdirs - traverse sub directories for driver packages.
  /install - install/update drivers on any matching devices.
  /reboot - reboot system if needed to complete the operation.

Examples:
  Add driver package:
    pnputil /add-driver x:\driver.inf
  Add multiple driver packages:
    pnputil /add-driver c:\oem\*.inf
  Add and install driver package:
    pnputil /add-driver device.inf /install

/delete-driver <oem#.inf> [/uninstall] [/force] [/reboot]

Delete driver package from the driver store.
  /uninstall - uninstall driver package from any devices using it.
  /force - delete driver package even when it is in use by devices.
  /reboot - reboot system if needed to complete the operation.

Examples:
  Delete driver package:
    pnputil /delete-driver oem0.inf
  Force delete driver package:
    pnputil /delete-driver oem1.inf /force

/export-driver <oem#.inf | *>

Export driver package(s) from the driver store into a target directory.

Examples:
  Export driver package:
    pnputil /export-driver oem6.inf .
  Export all driver packages:
    pnputil /export-driver * c:\backup

/enum-drivers

Enumerate all 3rd party driver packages in the driver store.

Examples:
  Enumerate all OEM driver packages:
    pnputil /enum-drivers

/disable-device [/reboot]

Disable devices on the system.
  /reboot - reboot system if needed to complete the operation.

Examples:
  Disable device:
    pnputil /disable-device "USB\VID_045E&PID_00DB\6&870CE29&0&1"

/enable-device [/reboot]

Enable devices on the system.
  /reboot - reboot system if needed to complete the operation.

Examples:
  Enable device:
    pnputil /enable-device "USB\VID_045E&PID_00DB\6&870CE29&0&1"

/restart-device [/reboot]

Restart devices on the system.
  /reboot - reboot system if needed to complete the operation.

Examples:
  Restart device:
    pnputil /restart-device "USB\VID_045E&PID_00DB\6&870CE29&0&1"

/remove-device [/subtree] [/reboot]

Attempt to remove a device from the system.
  /subtree - remove entire device subtree, including any child devices.
  /reboot - reboot system if needed to complete the operation.

Examples:
  Remove device:
    pnputil /remove-device "USB\VID_045E&PID_00DB\6&870CE29&0&1"

/scan-devices [/instanceid ] [/async]

Scan the system for any device hardware changes.
  /instanceid <instance ID> - scan device subtree for changes.
  /async - scan for changes asynchronously.

Examples:
  Scan devices:
    pnputil /scan-devices

/enum-devices [/connected | /disconnected] [/instanceid ]
[/class <name | GUID>] [/problem []] [/ids] [/relations] [/drivers]


Enumerate all devices on the system.
  /connected | /disconnected - filter by connected devices or
                               filter by disconnected devices.
  /instanceid <instance ID> - filter by device instance ID.
  /class <name | GUID> - filter by device class name or GUID.
  /problem [<code>] - filter by devices with problems or
                      filter by specific problem code.
  /ids - display hardware IDs and compatible IDs.
  /relations - display parent and child device relations.
  /drivers - display matching and installed drivers.

Examples:
  Enumerate only connected devices on the system:
    pnputil /enum-devices /connected
  Enumerate device with specific instance ID:
    pnputil /enum-devices /instanceid "ACPI\PNP0A08\1"
  Enumerate all devices with specific class:
    pnputil /enum-devices /class Display
    pnputil /enum-devices /class {4d36e97d-e325-11ce-bfc1-08002be10318}
  Enumerate all devices with specific problem code:
    pnputil /enum-devices /problem 28
    pnputil /enum-devices /problem 0xA
  Enumerate all devices with problems and display hardware/compatible IDs:
    pnputil /enum-devices /problem /ids

/enum-interfaces [/enabled | /disabled] [/class ]
Enumerate all device interfaces on the system.
  /enabled | /disabled - filter by enabled interfaces or
                         filter by disabled interfaces.
  /class <GUID> - filter by interface class GUID.

Examples:
  Enumerate only enabled interfaces on the system:
    pnputil /enum-interfaces /enabled
  Enumerate all interfaces with specific interface class GUID:
    pnputil /enum-interfaces /class {884b96c3-56ef-11d1-bc8c-00a0c91405dd}

/?
Show usage screen.`

IBSS ERROR

After setting nonce with Checkm8 nonce seter in futurerestore beta 2.0 I have error Device did not reconnect. Possibly invalid IBSS. Restart device and try again.
I'm using Mac OS mojave hackintosh

h

Bug: Not all linux distro's use 999 uid so maybe check uname so fwrite doesn't crash

Arch/Debian use 1000:1000?
Ubuntu is 999:999?
iirc
tsschecker download crashes on fwrite because ubuntu couldn't write to the 1000:1000 folder.

Make error: error: use of undeclared identifier 'PLIST_ERR_SUCCESS'

Mac M1 Big Sur v11.6.1

Broke downgrade to iOS 14

The latest beta futurestore broke downgrade 6s from ios 15 to 14. The previous beta restores successfully. Recovery log ios 14.3 from 15.4:
15.4 to 14.3 FR log.txt

Downgrade to ios 14.5.1 Apple chip A13

What is the probability of a downgrade from ios 14.6 to 14.5.1 on an iphone 11?

I have bad experience with futrerestore and I don't want to have ios 14.8
(The goal is to downgrade for an untethered jailbreak)

At the moment there is no jailbreak for ios 14.4+ but it is good to know and if someone has already done any downgrade with A13 processor I would like you to share information here.

I apologize for opening an issue that is not related to improvements etc.

I am really worried and I have no chance of failing, I only have one life

Can't donwgrade iPhone 7 14.8->14.3

command: ./futurerestore -u -t 3458793270340902_iPhone9,3_d101ap_14.3-18C66_27325c8258be46e69d9ee57fa9a8fbc28b873df434e5e702a8b27999551138ae.shsh2 -s sepbb15.1/sep-firmware.d101.RELEASE.im4p -b sepbb15.1/ICE16-6.00.00.Release.bbfw -p sepbb15.1/BuildManifest.plist -m sepbb15.1/BuildManifest.plist iPhone_4.7_P3_14.3_18C66_Restore.ipsw

Log

`Version: v2.0.0-test(50a6375-263)
img4tool version: 0.197-aca6cf005c94caf135023263cbb5c61a0081804f-RELEASE
libipatcher version: 0.88-1e855d70c84419014e363bdbcaead7b145fe3e1f-RELEASE
Odysseus for 32-bit support: yes
Odysseus for 64-bit support: yes
INFO: device serial number is F4GSX8ZLHG7K
[INFO] 64-bit device detected
futurerestore init done
reading signing ticket 3458793270340902_iPhone9,3_d101ap_14.3-18C66_27325c8258be46e69d9ee57fa9a8fbc28b873df434e5e702a8b27999551138ae.shsh2 is done
[TSSC] opening sepbb15.1/BuildManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to not request a baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Did set SEP+baseband path and firmware
ERROR: Unable to connect to device?!
ERROR: Unable to get FirmwarePreflightInfo
[WARNING] failed to read BasebandGoldCertID from device! Is it already in recovery?
[WARNING] using tsschecker's fallback to get BasebandGoldCertID. This might result in invalid baseband signing status information
[TSSC] opening sepbb15.1/BuildManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to request only a Baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Downloading the latest firmware components...
[TSSC] opening firmwares.json
[DOWN] downloading file https://api.ipsw.me/v2.1/firmwares.json/condensed
[TSSC] selecting latest firmware version: 15.1
[TSSC] got firmwareurl for iOS 15.1 build 19B74
[TSSC] opening Buildmanifest for iPhone9,3_15.1
[DOWN] downloading file https://updates.cdn-apple.com/2021FallFCS/fullrestores/071-64002/C820E7E5-0168-462E-923A-5C86E217D5B5/BuildManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
Finished downloading the latest firmware components!
Found device in Recovery mode
Device already in recovery mode
Found device in Recovery mode
Identified device as d101ap, iPhone9,3
Extracting BuildManifest from iPSW
Product version: 14.3
Product build: 18C66 Major: 18
Device supports Image4: true
Got ApNonce from device: 27 32 5c 82 58 be 46 e6 9d 9e e5 7f a9 a8 fb c2 8b 87 3d f4 34 e5 e7 02 a8 b2 79 99 55 11 38 ae
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Checking BuildIdentity 4
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Checking BuildIdentity 4
[TSSR] Selected BuildIdentity for request
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AOP" OK (untrusted)
[IMG4TOOL] checking hash for "Ap,SystemVolumeCanonicalMetadata"OK (found "msys" with matching hash)
[IMG4TOOL] checking hash for "AppleLogo" OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BasebandFirmware" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "BatteryCharging0" OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1" OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull" OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0" OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1" OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin" OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree" OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "Homer" OK (untrusted)
[IMG4TOOL] checking hash for "KernelCache" OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB" OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "Liquid" OK (found "liqd" with matching hash)
[IMG4TOOL] checking hash for "OS" OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode" OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree" OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache" OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo" OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP" OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "RestoreTrustCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SEP" OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "StaticTrustCache" OK (found "trst" with matching hash)
[IMG4TOOL] checking hash for "SystemVolume" OK (found "isys" with matching hash)
[IMG4TOOL] checking hash for "ftap" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "ftsp" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "iBEC" OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS" OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot" OK (found "ibot" with matching hash)
[IMG4TOOL] checking hash for "rfta" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "rfts" IGN (no digest in BuildManifest)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197:
commit sha =aca6cf005c94caf135023263cbb5c61a0081804f:
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 3:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 4:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AOP" OK (untrusted)
[IMG4TOOL] checking hash for "Ap,SystemVolumeCanonicalMetadata"OK (found "msys" with matching hash)
[IMG4TOOL] checking hash for "AppleLogo" OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BasebandFirmware" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "BatteryCharging0" OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1" OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull" OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0" OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1" OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin" OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree" OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "Homer" OK (untrusted)
[IMG4TOOL] checking hash for "KernelCache" OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB" OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "Liquid" OK (found "liqd" with matching hash)
[IMG4TOOL] checking hash for "OS" OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode" OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree" OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache" OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo" OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk" OK (found "rdsk" with matching hash)
[IMG4TOOL] checking hash for "RestoreSEP" OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "RestoreTrustCache" OK (found "rtsc" with matching hash)
[IMG4TOOL] checking hash for "SEP" OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "StaticTrustCache" OK (found "trst" with matching hash)
[IMG4TOOL] checking hash for "SystemVolume" OK (found "isys" with matching hash)
[IMG4TOOL] checking hash for "ftap" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "ftsp" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "iBEC" OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS" OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot" OK (found "ibot" with matching hash)
[IMG4TOOL] checking hash for "rfta" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "rfts" IGN (no digest in BuildManifest)
Verified APTicket to be valid for this restore
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Checking BuildIdentity 4
[TSSR] Selected BuildIdentity for request
Variant: Customer Upgrade Install (IPSW)
This restore will update your device without erasing user data.
Using cached filesystem from 'iPhone_4.7_P3_14.3_18C66_Restore/038-83137-079.dmg'
Extracting iBEC.d10.RELEASE.im4p (Firmware/dfu/iBEC.d10.RELEASE.im4p)...
Personalizing IMG4 component iBEC...
Sending iBEC (522494 bytes)...
waiting for device to reconnect... Getting SepNonce in recovery mode... e3 43 75 ef db b2 f3 9f a0 94 b5 9b ad 3e 13 0d 07 28 32 98
Getting ApNonce in recovery mode... 27 32 5c 82 58 be 46 e6 9d 9e e5 7f a9 a8 fb c2 8b 87 3d f4 34 e5 e7 02 a8 b2 79 99 55 11 38 ae
[WARNING] Setting bgcolor to green! If you don't see a green screen, then your device didn't boot iBEC correctly
Recovery Mode Environment:
iBoot build-version=iBoot-6723.62.3
iBoot build-style=RELEASE
Sending RestoreLogo...
Extracting applelogo@2x~~iphone.im4p (Firmware/all_flash/applelogo@2x~~iphone.im4p)...
Personalizing IMG4 component RestoreLogo...
Sending RestoreLogo (13408 bytes)...
ramdisk-size=0x20000000
Extracting 038-82966-083.dmg (038-82966-083.dmg)...
Personalizing IMG4 component RestoreRamDisk...
Sending RestoreRamDisk (107209469 bytes)...
Extracting 038-82966-083.dmg.trustcache (Firmware/038-82966-083.dmg.trustcache)...
Personalizing IMG4 component RestoreTrustCache...
Sending RestoreTrustCache (11877 bytes)...
Extracting DeviceTree.d101ap.im4p (Firmware/all_flash/DeviceTree.d101ap.im4p)...
Personalizing IMG4 component RestoreDeviceTree...
Sending RestoreDeviceTree (36422 bytes)...
Extracting sep-firmware.d101.RELEASE.im4p (Firmware/all_flash/sep-firmware.d101.RELEASE.im4p)...
Personalizing IMG4 component RestoreSEP...
Sending RestoreSEP (1353243 bytes)...
Extracting kernelcache.release.iphone9 (kernelcache.release.iphone9)...
Personalizing IMG4 component RestoreKernelCache...
Sending RestoreKernelCache (14838373 bytes)...
getting SEP ticket
Trying to fetch new SHSH blob
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Received SHSH blobs
Cleaning up...
[exception]:
what=Device can't enter to restore mode
code=105447441
line=1609
file=futurerestore.cpp
commit count=263:
commit sha =50a6375391c94624fbe1b2b060d46117de2bc4fc:
Done: restoring failed!
`

Unable to place device into recovery mode from Normal mode

Iphone xr 13.5 going to 14.3

windows 10
the device visibly goes into recovery mode and itunes sees that my phone is in recovery mode but future restore canno't. I am using future restore with these commands. -t, --latest-sep, --latest-baseband

Can flash the specified rootfs dmg with the latest firmware?

A：Can flash the specified rootfs dmg with the latest firmware?
B：To flash a custom rootfs you need to have a checkm8 or 32bit device. And it will be tethered on and above 14.2.

A：You can use APTicket and APNonce to flash into the specified rootfs dmg through futurerestore.
Then why can't I use the latest firmware as the carrier to flash the specified rootfs dmg?

failed to restore 14.3 custom ipsw

I get this in the terminal window when I run the command

platform: macOS, latest
device: iPad Air 2, a8x currently on 15.1 beta 3
goal: tether boot 14.3

Can't compile futurerestore

I use Linux.
I have tried to compile along the lines of compiling.md, but due to errors I am unable to compile.

$ RELEASE=1 ./build.sh -DARCH=arm

[*] Building futurerestore
-- Configuring done
-- Generating done
CMake Warning:
  Manually-specified variables were not used by the project:

    ARCH


-- Build files have been written to: /home/manjaro/tmp/futurerestore/cmake-build-release
[  3%] Building C object external/tsschecker/CMakeFiles/tsschecker.dir/tsschecker/tss.c.o
clang-13: warning: -Wl,--allow-multiple-definition: 'linker' input unused [-Wunused-command-line-argument]
[  6%] Building C object external/tsschecker/CMakeFiles/tsschecker.dir/tsschecker/tsschecker.c.o
clang-13: warning: -Wl,--allow-multiple-definition: 'linker' input unused [-Wunused-command-line-argument]

…(omission)…

/usr/include/libgeneral/macros.h:52:16: note: previous definition is here
#       define debug(a ...)
               ^
In file included from /home/manjaro/tmp/futurerestore/src/futurerestore.cpp:31:
In file included from /home/manjaro/tmp/futurerestore/external/tsschecker/tsschecker/tsschecker.h:20:
In file included from /home/manjaro/tmp/futurerestore/external/tsschecker/tsschecker/tss.h:33:
/home/manjaro/tmp/futurerestore/external/tsschecker/tsschecker/debug.h:18:9: warning: 'error' macro redefined [-Wmacro-redefined]
#define error(a ...) printf("[Error] "),printf(a)
        ^
/usr/include/libgeneral/macros.h:48:12: note: previous definition is here
#   define error(a ...) ({printf("[Error] "),printf(a),printf("\n");})
           ^
/home/manjaro/tmp/futurerestore/src/futurerestore.cpp:589:60: error: too many arguments to function call, expected 3, have 4
                                                           board);
                                                           ^~~~~
/usr/include/libipatcher/libipatcher.hpp:28:16: note: 'getFirmwareKey' declared here
        fw_key getFirmwareKey(std::string device, std::string buildnum, std::string file);
               ^
/home/manjaro/tmp/futurerestore/src/futurerestore.cpp:593:60: error: too many arguments to function call, expected 3, have 4
                                                           board);
                                                           ^~~~~
/usr/include/libipatcher/libipatcher.hpp:28:16: note: 'getFirmwareKey' declared here
        fw_key getFirmwareKey(std::string device, std::string buildnum, std::string file);

…(omission)…

/home/manjaro/tmp/futurerestore/src/futurerestore.cpp:1002:97: warning: format specifies type 'unsigned long long' but the argument has type 'uint64_t' (aka 'unsigned long') [-Wformat]
            printf("APTicket is valid for %16llu (dec) but device is %16llu (dec)\n", im4mEcid, deviceEcid);
                                                                     ~~~~~~                     ^~~~~~~~~~
                                                                     %16lu
8 warnings and 2 errors generated.
make[2]: *** [src/CMakeFiles/futurerestore.dir/build.make:90: src/CMakeFiles/futurerestore.dir/futurerestore.cpp.o] error 1
make[1]: *** [CMakeFiles/Makefile2:230: src/CMakeFiles/futurerestore.dir/all] error 2
make: *** [Makefile:136: all] error 2
[!] Failed to build futurerestore!

How can I resolve this error?

malloc errors when trying to downgrade to iOS 14

A new tutorial for downgrading from iOS 15 to 14 (I am doing it on an iPhone 8) through checkm8 tethered downgrades has released. https://www.reddit.com/r/jailbreak/comments/vqcqol/tutorial_how_to_tethered_downgrade_from_ios_15_to/?utm_source=share&utm_medium=ios_app&utm_name=iossmf

I have followed it successfully up until the restoring part. On both my devices (latest Monterey and other is on 10.13) I have the same setup (debug future restore, all the forks listed in PATH) and I have a different error on both but I get farther on macOS 12 so I will share that log, if you want the other log I can provide it.

My command is:
futurerestore -t /Users/bogo/Desktop/2380048545021998_iPhone10\,4_d201ap_15.5-19F77_27325c8258be46e69d9ee57fa9a8fbc28b873df434e5e702a8b27999551138ae.shsh2 --use-pwndfu --skip-blob --rdsk /Users/bogo/downgrade/ramdisk.im4p --rkrn /Users/bogo/downgrade/krnl.im4p --latest-sep --latest-baseband /Users/bogo/downgrade/iPhone_4.7_P3_14.3_18C66_Restore.ipsw

Log:
Version: v2.0.0-test(3bfba66-281)
img4tool version: 0.197-aca6cf005c94caf135023263cbb5c61a0081804f-DEBUG
libipatcher version: 0.88-1e855d70c84419014e363bdbcaead7b145fe3e1f-DEBUG
Odysseus for 32-bit support: yes
Odysseus for 64-bit support: yes
[INFO] 64-bit device detected
futurerestore init done
reading signing ticket /Users/bogo/Desktop/2380048545021998_iPhone10,4_d201ap_15.5-19F77_27325c8258be46e69d9ee57fa9a8fbc28b873df434e5e702a8b27999551138ae.shsh2 is done
user specified to use latest signed SEP

[TSSC] opening firmwares.json
[DOWN] downloading file https://api.ipsw.me/v2.1/firmwares.json/condensed
[TSSC] opening /tmp/betas_iPhone10,4.json
[DOWN] downloading file https://api.m1sta.xyz/betas/iPhone10,4
[TSSC] selecting latest firmware version: 15.5
[TSSC] got firmwareurl for iOS 15.5 build 19F77
[TSSC] opening Buildmanifest for iPhone10,4_15.5
[DOWN] downloading file https://updates.cdn-apple.com/2022SpringFCS/fullrestores/012-07905/09AAD219-D436-40F0-B49B-E7C009FF5668/BuildManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
downloading SEP

[TSSC] opening /tmp/futurerestore/sepManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to not request a baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
user specified to use latest signed baseband

[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
downloading Baseband

ERROR: Unable to connect to device?!
[Error] Unable to find required BbGoldCertId in parameters
[WARNING] using tsschecker's fallback to get BasebandGoldCertID. This might result in invalid baseband signing status information
[TSSC] opening /tmp/futurerestore/basebandManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to request only a Baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Downloading the latest firmware components...
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
downloading SE firmware

[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
Finished downloading the latest firmware components!
Found device in DFU mode
requesting to get into pwnRecovery later
Found device in DFU mode
Identified device as d201ap, iPhone10,4
Extracting BuildManifest from iPSW
Product version: 14.3
Product build: 18C66 Major: 18
Device supports Image4: true
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
checking if the APTicket is valid for this restore...
Verified ECID in APTicket matches the device's ECID
checking if the APTicket is valid for this restore...
Verified ECID in APTicket matches the device's ECID
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AOP" OK (untrusted)
[IMG4TOOL] checking hash for "Ap,SystemVolumeCanonicalMetadata"BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "AppleLogo" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "AudioCodecFirmware" OK (untrusted)
[IMG4TOOL] checking hash for "BasebandFirmware" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "BatteryCharging0" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryCharging1" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryFull" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow0" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow1" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryPlugin" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "DeviceTree" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "ISP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "KernelCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "LLB" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "Liquid" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "Multitouch" OK (untrusted)
[IMG4TOOL] checking hash for "OS" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RecoveryMode" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreDeviceTree" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreKernelCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreLogo" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreRamDisk" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreTrustCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SE,UpdatePayload" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "SEP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "StaticTrustCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SystemVolume" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "ftap" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "ftsp" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "iBEC" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBSS" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBoot" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "rfta" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "rfts" IGN (no digest in BuildManifest)

BuildIdentity selected for restore:
BuildNumber : 18C66
BuildTrain : AzulC
DeviceClass : d201ap
FDRSupport : YES
MobileDeviceMinVersion : 1253
RestoreBehavior : Erase
Variant : Customer Erase Install (IPSW)

BuildIdentity is valid for the APTicket:
IM4M is not valid for any restore within the Buildmanifest
This APTicket can't be used for restoring this firmware
[WARNING] NOT VALIDATING SHSH BLOBS!
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Device found in DFU Mode.
Getting firmware keys for: d201ap
Patching iBSS
Extracting iBSS.d20.RELEASE.im4p (Firmware/dfu/iBSS.d20.RELEASE.im4p)...
payload decrypted
Compression detected, uncompressing (bvx2): ok
iBoot64Patch: Staring iBoot64Patch!
[DEBUG] iBoot-6723 inputted

iOS 14 iBoot detected!
[DEBUG] iBoot base at=0x00000001800d0d98

[DEBUG] iBoot-6723 inputted

[DEBUG] platform_name_str_loc: 0x180147d07

[DEBUG] platform_name_str_xref: 0x1800e91b8

[DEBUG] iBoot chipid = 8015

[DEBUG] iBoot base at=0x000000018001c000

iBoot64Patch: Inited ibootpatchfinder64!
[DEBUG] img4decodemanifestexists=0x18008342c
[DEBUG] img4decodemanifestexistsref=0x180032bec
[DEBUG] img4interposercallbackptr=0x1800969b8
[DEBUG] img4interposercallback=0x180031d9c
[DEBUG] img4interposercallbackret=0x180032580
[DEBUG] img4interposercallbackmov=0x180032568
[DEBUG] img4interposercallbackret2=0x1800325b8
iBoot64Patch: Added sigpatches!
[DEBUG] check stage
[DEBUG] stage not iBootStage1, continuing patch
[DEBUG] debug_uarts_str=0x180090bd3

[DEBUG] debug_uarts_ref=0x180095998

[DEBUG] chipid != a8x/a9

[DEBUG] setenv_whitelist=0x180095988

[DEBUG] blacklist1_func=0x18001f924

[DEBUG] blacklist1_func_top=0x18001f908

[DEBUG] env_whitelist=0x1800959b8

[DEBUG] blacklist2_func=0x18001f970

[DEBUG] blacklist2_func_top=0x18001f958

[DEBUG] com_apple_system=0x180094ceb

[DEBUG] com_apple_system_xref=0x180069f4c

[DEBUG] func3top=0x180069f44

iBoot64Patch: Added unlock nvram patch!
[DEBUG] check stage
[DEBUG] stage not iBootStage1, continuing patch
[DEBUG] noncevar_str=0x180090c32

[DEBUG] noncevar_ref=0x18006fe40

[DEBUG] noncefun1=0x18006fe28

[DEBUG] noncefun1_blref=0x180053f1c

[DEBUG] noncefun2=0x180053ef4

[DEBUG] noncefun2_blref=0x180038864

[DEBUG] branchloc=0x18003885c

iBoot64Patch: Added freshnonce patch!
iBoot64Patch: has_kernel_load is false!
iBoot64Patch: Applying patch=0x180032568 : 000080d2
iBoot64Patch: Applying patch=0x1800325b4 : 000080d2
iBoot64Patch: Applying patch=0x18001f908 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x18001f958 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x180069f44 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x18003885c : 1f2003d5
iBoot64Patch: Patches applied!
[WARNING] BUG WORKAROUND recompressing images with bvx2 makes them not boot for some reason. Skipping compression
Patching iBEC
Extracting iBEC.d20.RELEASE.im4p (Firmware/dfu/iBEC.d20.RELEASE.im4p)...
payload decrypted
Compression detected, uncompressing (bvx2): ok
iBoot64Patch: Staring iBoot64Patch!
[DEBUG] iBoot-6723 inputted

iOS 14 iBoot detected!
[DEBUG] iBoot base at=0x00000001800d0d98

[DEBUG] iBoot-6723 inputted

[DEBUG] platform_name_str_loc: 0x180147d07

[DEBUG] platform_name_str_xref: 0x1800e91b8

[DEBUG] iBoot chipid = 8015

[DEBUG] iBoot base at=0x000000018001c000

[DEBUG] debug_uarts_ref=0x180095998

[DEBUG] chipid != a8x/a9

[DEBUG] setenv_whitelist=0x180095988

[DEBUG] blacklist1_func=0x18001f924

[DEBUG] blacklist1_func_top=0x18001f908

[DEBUG] env_whitelist=0x1800959b8

[DEBUG] blacklist2_func=0x18001f970

[DEBUG] blacklist2_func_top=0x18001f958

[DEBUG] com_apple_system=0x180094ceb

[DEBUG] com_apple_system_xref=0x180069f4c

[DEBUG] func3top=0x180069f44

iBoot64Patch: Added unlock nvram patch!
[DEBUG] check stage
[DEBUG] stage not iBootStage1, continuing patch
[DEBUG] noncevar_str=0x180090c32

[DEBUG] noncevar_ref=0x18006fe40

[DEBUG] noncefun1=0x18006fe28

[DEBUG] noncefun1_blref=0x180053f1c

[DEBUG] noncefun2=0x180053ef4

[DEBUG] noncefun2_blref=0x180038864

[DEBUG] branchloc=0x18003885c

iBoot64Patch: Added freshnonce patch!
iBoot64Patch: has_kernel_load is true!
[DEBUG] debug_enabled=0x180092c9e

[DEBUG] xref=0x180033eec

iBoot64Patch: Added debugenabled patch!
[DEBUG] DEFAULT_BOOTARGS_STR not found, trying fallback to DEFAULT_BOOTARGS_STR_13

[DEBUG] default_boot_args_str_loc=0x1800931fb

[DEBUG] default_boot_args_xref=0x18003539c

[DEBUG] Relocating boot-args string...

[DEBUG] bootarg_loc1=0x1800a5aa8

[DEBUG] bootarg_loc=0x1800a5ab9

[DEBUG] Pointing default boot-args xref to 0x1800a5ab8...

[DEBUG] Applying custom boot-args "rd=md0 nand-enable-reformat=0x1 -v -restore debug=0x2014e keepsyms=0x1 amfi=0xff amfi_allow_any_signature=0x1 amfi_get_out_of_my_way=0x1 cs_enforcement_disable=0x1"

[DEBUG] xrefRD=9

[DEBUG] csel=0x1800353a8

[DEBUG] cselrd=19

[DEBUG] (0x1800353a8)patching: "mov x19, x9"

[DEBUG] branch loc=0x18003538c

[DEBUG] branch dst=0x180035498

[DEBUG] (0x180035498)patching: "adr x19, 0x1800a5ab8"

iBoot64Patch: Added bootarg patch!
iBoot64Patch: Applying patch=0x180032568 : 000080d2
iBoot64Patch: Applying patch=0x1800325b4 : 000080d2
iBoot64Patch: Applying patch=0x18001f908 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x18001f958 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x180069f44 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x18003885c : 1f2003d5
iBoot64Patch: Applying patch=0x180033f00 : 200080d2
iBoot64Patch: Applying patch=0x18003539c : e9383810
iBoot64Patch: Applying patch=0x1800a5ab8 : 72643d6d6430206e616e642d656e61626c652d7265666f726d61743d307831202d76202d726573746f72652064656275673d30783230313465206b65657073796d733d30783120616d66693d3078666620616d66695f616c6c6f775f616e795f7369676e61747572653d30783120616d66695f6765745f6f75745f6f665f6d795f7761793d3078312063735f656e666f7263656d656e745f64697361626c653d30783100
iBoot64Patch: Applying patch=0x1800353a8 : f30309aa
iBoot64Patch: Applying patch=0x180035498 : 13313810
iBoot64Patch: Patches applied!
[WARNING] BUG WORKAROUND recompressing images with bvx2 makes them not boot for some reason. Skipping compression
Repacking patched iBSS as IMG4
Repacking patched iBEC as IMG4
Sending iBSS (1438499 bytes)...
Cleaning up...
[exception]:
what=ERROR: Unable to send iBSS component: Unable to upload data to device

code=42664004
line=651
file=/Users/runner/work/futurerestore/futurerestore/src/futurerestore.cpp
commit count=281:
commit sha =3bfba667cce95a85ec918210f8b05d2aed6c3d91:
Done: restoring failed!
^C
bogo@bogotesrs-MacBook-Pro sunst0rm % git clone https://github.com/axi0mX/ipwndfu
Cloning into 'ipwndfu'...
remote: Enumerating objects: 407, done.
remote: Counting objects: 100% (148/148), done.
remote: Compressing objects: 100% (93/93), done.
remote: Total 407 (delta 60), reused 55 (delta 55), pack-reused 259
Receiving objects: 100% (407/407), 1.86 MiB | 3.78 MiB/s, done.
Resolving deltas: 100% (206/206), done.
bogo@bogotesrs-MacBook-Pro sunst0rm % cd ipwndfu
bogo@bogotesrs-MacBook-Pro ipwndfu % ./ipwndfu
zsh: ./ipwndfu: bad interpreter: /usr/bin/python: no such file or directory
bogo@bogotesrs-MacBook-Pro ipwndfu % chmod +x ./ipwndfu
bogo@bogotesrs-MacBook-Pro ipwndfu % ./ipwndfu
zsh: ./ipwndfu: bad interpreter: /usr/bin/python: no such file or directory
bogo@bogotesrs-MacBook-Pro ipwndfu % ./ipwndfu
zsh: ./ipwndfu: bad interpreter: /usr/bin/python: no such file or directory
bogo@bogotesrs-MacBook-Pro ipwndfu % python
Python 2.7.18 (v2.7.18:8d21aa21f2, Apr 19 2020, 20:48:48)
[GCC 4.2.1 Compatible Apple LLVM 6.0 (clang-600.0.57)] on darwin
Type "help", "copyright", "credits" or "license" for more information.

KeyboardInterrupt

^D
bogo@bogotesrs-MacBook-Pro ipwndfu % ./ipwndfu
zsh: ./ipwndfu: bad interpreter: /usr/bin/python: no such file or directory
bogo@bogotesrs-MacBook-Pro ipwndfu % python3 ipwndfu
File "/Users/bogo/downgrade/sunst0rm/ipwndfu/ipwndfu", line 11
print 'USAGE: ipwndfu [options]'
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print(...)?
bogo@bogotesrs-MacBook-Pro ipwndfu % python3 ipwndfu -p
File "/Users/bogo/downgrade/sunst0rm/ipwndfu/ipwndfu", line 11
print 'USAGE: ipwndfu [options]'
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print(...)?
bogo@bogotesrs-MacBook-Pro ipwndfu % ipwndfu
zsh: command not found: ipwndfu
bogo@bogotesrs-MacBook-Pro ipwndfu % ./ipwndfu
zsh: ./ipwndfu: bad interpreter: /usr/bin/python: no such file or directory
bogo@bogotesrs-MacBook-Pro ipwndfu % chmod +x ./ipwndfu
bogo@bogotesrs-MacBook-Pro ipwndfu % ./ipwndfu
zsh: ./ipwndfu: bad interpreter: /usr/bin/python: no such file or directory
bogo@bogotesrs-MacBook-Pro ipwndfu % futurerestore -t /Users/bogo/Desktop/2380048545021998_iPhone10,4_d201ap_15.5-19F77_27325c8258be46e69d9ee57fa9a8fbc28b873df434e5e702a8b27999551138ae.shsh2 --use-pwndfu --skip-blob --rdsk /Users/bogo/downgrade/ramdisk.im4p --rkrn /Users/bogo/downgrade/krnl.im4p --latest-sep --latest-baseband /Users/bogo/downgrade/iPhone_4.7_P3_14.3_18C66_Restore.ipsw
Version: v2.0.0-test(3bfba66-281)
img4tool version: 0.197-aca6cf005c94caf135023263cbb5c61a0081804f-DEBUG
libipatcher version: 0.88-1e855d70c84419014e363bdbcaead7b145fe3e1f-DEBUG
Odysseus for 32-bit support: yes
Odysseus for 64-bit support: yes
libc++abi: terminating with uncaught exception of type tihmstar::exception: can't init, no device found

zsh: abort futurerestore -t --use-pwndfu --skip-blob --rdsk --rkrn --latest-sep
bogo@bogotesrs-MacBook-Pro ipwndfu % cd ..
bogo@bogotesrs-MacBook-Pro sunst0rm % cd ..
bogo@bogotesrs-MacBook-Pro downgrade % python3 -m pip install --user --force-reinstall https://github.com/hack-different/ipwndfu/archive/main.zip
Collecting https://github.com/hack-different/ipwndfu/archive/main.zip
Using cached https://github.com/hack-different/ipwndfu/archive/main.zip
Installing build dependencies ... done
Getting requirements to build wheel ... done
Preparing metadata (pyproject.toml) ... done
Collecting cryptography<37.0.0,>=36.0.1
Using cached cryptography-36.0.2-cp36-abi3-macosx_10_10_x86_64.whl (2.5 MB)
Collecting pyusb<2.0.0,>=1.2.1
Using cached pyusb-1.2.1-py3-none-any.whl (58 kB)
Collecting cffi>=1.12
Downloading cffi-1.15.1-cp310-cp310-macosx_10_9_x86_64.whl (179 kB)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 179.2/179.2 kB 3.1 MB/s eta 0:00:00
Collecting pycparser
Using cached pycparser-2.21-py2.py3-none-any.whl (118 kB)
Building wheels for collected packages: ipwndfu
Building wheel for ipwndfu (pyproject.toml) ... done
Created wheel for ipwndfu: filename=ipwndfu-2.0.0b5-py3-none-any.whl size=1183379 sha256=851e6aaf248ce24f1270bb71e263c4ef130f5c13e0b4de33b52bdbbfdd814d5b
Stored in directory: /private/var/folders/b9/144jc0h57_5bbhvv_k_jk7b40000gn/T/pip-ephem-wheel-cache-6gawurf_/wheels/2f/17/55/c6750601b8a4da2893837d9226039487a919a4779186dd51ea
Successfully built ipwndfu
Installing collected packages: pyusb, pycparser, cffi, cryptography, ipwndfu
Attempting uninstall: pyusb
Found existing installation: pyusb 1.2.1
Uninstalling pyusb-1.2.1:
Successfully uninstalled pyusb-1.2.1
Attempting uninstall: pycparser
Found existing installation: pycparser 2.21
Uninstalling pycparser-2.21:
Successfully uninstalled pycparser-2.21
Attempting uninstall: cffi
Found existing installation: cffi 1.15.0
Uninstalling cffi-1.15.0:
Successfully uninstalled cffi-1.15.0
Attempting uninstall: cryptography
Found existing installation: cryptography 36.0.2
Uninstalling cryptography-36.0.2:
Successfully uninstalled cryptography-36.0.2
Attempting uninstall: ipwndfu
Found existing installation: ipwndfu 2.0.0b5
Uninstalling ipwndfu-2.0.0b5:
Successfully uninstalled ipwndfu-2.0.0b5
WARNING: The script ipwndfu is installed in '/Users/bogo/Library/Python/3.10/bin' which is not on PATH.
Consider adding this directory to PATH or, if you prefer to suppress this warning, use --no-warn-script-location.
Successfully installed cffi-1.15.1 cryptography-36.0.2 ipwndfu-2.0.0b5 pycparser-2.21 pyusb-1.2.1
bogo@bogotesrs-MacBook-Pro downgrade % (cd "$(python3 -m site --user-base)/bin"; ./ipwndfu -p; ./ipwndfu --patch-sigchecks; ./ipwndfu --repair-heap)
*** checkm8 exploit by axi0mX ***
Found: CPID:8015 CPRV:11 CPFM:03 SCEP:01 BDID:0A ECID:000874A43C13002E IBFL:3C SRTG:[iBoot-3332.0.0.1.23]
Device is now in pwned DFU Mode.
(1.77 seconds)
Successfully patched signature checks!
Heap repaired.
bogo@bogotesrs-MacBook-Pro downgrade % futurerestore -t /Users/bogo/Desktop/2380048545021998_iPhone10,4_d201ap_15.5-19F77_27325c8258be46e69d9ee57fa9a8fbc28b873df434e5e702a8b27999551138ae.shsh2 --use-pwndfu --skip-blob --rdsk /Users/bogo/downgrade/ramdisk.im4p --rkrn /Users/bogo/downgrade/krnl.im4p --latest-sep --latest-baseband /Users/bogo/downgrade/iPhone_4.7_P3_14.3_18C66_Restore.ipsw
Version: v2.0.0-test(3bfba66-281)
img4tool version: 0.197-aca6cf005c94caf135023263cbb5c61a0081804f-DEBUG
libipatcher version: 0.88-1e855d70c84419014e363bdbcaead7b145fe3e1f-DEBUG
Odysseus for 32-bit support: yes
Odysseus for 64-bit support: yes
[INFO] 64-bit device detected
futurerestore init done
reading signing ticket /Users/bogo/Desktop/2380048545021998_iPhone10,4_d201ap_15.5-19F77_27325c8258be46e69d9ee57fa9a8fbc28b873df434e5e702a8b27999551138ae.shsh2 is done
user specified to use latest signed SEP

[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
downloading Baseband

BuildIdentity is valid for the APTicket:
IM4M is not valid for any restore within the Buildmanifest
This APTicket can't be used for restoring this firmware
[WARNING] NOT VALIDATING SHSH BLOBS!
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Selected BuildIdentity for request
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Device found in DFU Mode.
Sending iBSS (1438499 bytes)...
[==================================================] 100.0%
Booting iBSS, waiting for device to disconnect...
Booting iBSS, waiting for device to reconnect...
ApNonce pre-hax:
INFO: device serial number is C8PYR2QAJC69
Getting ApNonce in recovery mode... 27 32 5c 82 58 be 46 e6 9d 9e e5 7f a9 a8 fb c2 8b 87 3d f4 34 e5 e7 02 a8 b2 79 99 55 11 38 ae
Sending iBEC (1438499 bytes)...
[==================================================] 100.0%
Booting iBEC, waiting for device to disconnect...
Booting iBEC, waiting for device to reconnect...
APNonce from device already matches IM4M nonce, no need for extra hax...
Successfully set nonce generator: 0x1111111111111111
Extracting filesystem from iPSW
futurerestore(36581,0x10a48f600) malloc: Heap corruption detected, free list is damaged at 0x600000dcc6c0
*** Incorrect guard value: 16629806333025528536
futurerestore(36581,0x10a48f600) malloc: *** set a breakpoint in malloc_error_break to debug
zsh: abort futurerestore -t --use-pwndfu --skip-blob --rdsk --rkrn --latest-sep

Device can't enter to restore mode

`[TSSC] opening /tmp/futurerestore/sepManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to not request a baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
user specified to use latest signed baseband
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
downloading Baseband
100
ERROR: Unable to connect to device?!
ERROR: Unable to get FirmwarePreflightInfo
[WARNING] failed to read BasebandGoldCertID from device! Is it already in recovery?
[WARNING] using tsschecker's fallback to get BasebandGoldCertID. This might result in invalid baseband signing status information
[TSSC] opening /tmp/futurerestore/basebandManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to request only a Baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Downloading the latest firmware components...
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
Finished downloading the latest firmware components!
Found device in DFU mode
requesting to get into pwnRecovery later
Found device in DFU mode
Identified device as d101ap, iPhone9,3
Extracting BuildManifest from iPSW
Product version: 14.3
Product build: 18C66 Major: 18
Device supports Image4: true
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
checking APTicket to be valid for this restore...
[Error] ECID inside APTicket does not match device ECID
APTicket is valid for 2112104390326 (dec) but device is 581783455859494 (dec)
[WARNING] NOT VALIDATING SHSH BLOBS ECID!
checking APTicket to be valid for this restore...
[Error] ECID inside APTicket does not match device ECID
APTicket is valid for 2112104390326 (dec) but device is 581783455859494 (dec)
[WARNING] NOT VALIDATING SHSH BLOBS ECID!
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AOP" OK (untrusted)
[IMG4TOOL] checking hash for "Ap,SystemVolumeCanonicalMetadata"BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "AppleLogo" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BasebandFirmware" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "BatteryCharging0" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryCharging1" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryFull" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow0" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow1" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryPlugin" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "DeviceTree" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "Homer" OK (untrusted)
[IMG4TOOL] checking hash for "KernelCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "LLB" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "Liquid" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "OS" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RecoveryMode" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreDeviceTree" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreKernelCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreLogo" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreRamDisk" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreTrustCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SEP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "StaticTrustCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SystemVolume" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "ftap" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "ftsp" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "iBEC" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBSS" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBoot" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "rfta" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "rfts" IGN (no digest in BuildManifest)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197
commit sha =aca6cf005c94caf135023263cbb5c61a0081804f
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 3:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 4:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AOP" OK (untrusted)
[IMG4TOOL] checking hash for "Ap,SystemVolumeCanonicalMetadata"BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "AppleLogo" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BasebandFirmware" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "BatteryCharging0" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryCharging1" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryFull" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow0" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow1" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryPlugin" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "DeviceTree" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "Homer" OK (untrusted)
[IMG4TOOL] checking hash for "KernelCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "LLB" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "Liquid" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "OS" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RecoveryMode" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreDeviceTree" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreKernelCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreLogo" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreRamDisk" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreTrustCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SEP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "StaticTrustCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SystemVolume" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "ftap" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "ftsp" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "iBEC" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBSS" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBoot" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "rfta" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "rfts" IGN (no digest in BuildManifest)

BuildIdentity selected for restore:
BuildNumber : 18C66
BuildTrain : AzulC
DeviceClass : d101ap
FDRSupport : YES
MobileDeviceMinVersion : 1253
RestoreBehavior : Erase
Variant : Customer Erase Install (IPSW)

BuildIdentity is valid for the APTicket:
IM4M is not valid for any restore within the Buildmanifest
This APTicket can't be used for restoring this firmware
[WARNING] NOT VALIDATING SHSH BLOBS!
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Entering PwnRecovery
(_ota = false)Device found in DFU Mode.
Sending iBSS (522504 bytes)...
NOTE: Using custom iBSS: /tmp/tmp_l73ffga/ibss.d101ap.patched.img4
[==================================================] 100.0%
Booting iBSS, waiting for device to disconnect...
Booting iBSS, waiting for device to reconnect...
ApNonce pre-hax:
Getting ApNonce in recovery mode... INFO: device serial number is DNPT7EQ2HG7F
a8 30 e5 6e 92 be ff 53 58 a4 d5 51 2e c0 5b 10 1b 1f 7a 58 8f 96 d3 04 94 42 9c eb 05 3e bd b5
ApNonce from device doesn't match IM4M nonce, applying hax...
Writing generator=0x081acb4cc32f0f65 to nvram!
Sending iBEC (522504 bytes)...
NOTE: Using custom iBEC: /tmp/tmp_l73ffga/ibec.d101ap.patched.img4
[==================================================] 100.0%
Booting iBEC, waiting for device to disconnect...
Booting iBEC, waiting for device to reconnect...
APnonce post-hax:
Getting ApNonce in recovery mode... a8 30 e5 6e 92 be ff 53 58 a4 d5 51 2e c0 5b 10 1b 1f 7a 58 8f 96 d3 04 94 42 9c eb 05 3e bd b5
Successfully set nonce generator: 0x081acb4cc32f0f65
Using cached filesystem from '/Users/macbook/Downloads/iPhone_4.7_P3_14.3_18C66_Restore/038-83137-079.dmg'
Getting SepNonce in recovery mode... e0 0e 56 43 d5 c0 d6 69 46 ce f4 aa 74 a2 f3 f5 d9 09 4b 17
Getting ApNonce in recovery mode... a8 30 e5 6e 92 be ff 53 58 a4 d5 51 2e c0 5b 10 1b 1f 7a 58 8f 96 d3 04 94 42 9c eb 05 3e bd b5
[WARNING] Setting bgcolor to green! If you don't see a green screen, then your device didn't boot iBEC correctly
Recovery Mode Environment:
iBoot build-version=iBoot-6723.62.3
iBoot build-style=RELEASE
Sending RestoreLogo...
Extracting [email protected] (Firmware/all_flash/[email protected])...
Personalizing IMG4 component RestoreLogo...
Sending RestoreLogo (13544 bytes)...
ramdisk-size=0x20000000
1337 CUSTOM RAMDISK!
Personalizing IMG4 component RestoreRamDisk...
Sending RestoreRamDisk (104124299 bytes)...
Extracting 038-83284-083.dmg.trustcache (Firmware/038-83284-083.dmg.trustcache)...
Personalizing IMG4 component RestoreTrustCache...
Sending RestoreTrustCache (11837 bytes)...
Extracting DeviceTree.d101ap.im4p (Firmware/all_flash/DeviceTree.d101ap.im4p)...
Personalizing IMG4 component RestoreDeviceTree...
Sending RestoreDeviceTree (36558 bytes)...
Extracting sep-firmware.d101.RELEASE.im4p (Firmware/all_flash/sep-firmware.d101.RELEASE.im4p)...
Personalizing IMG4 component RestoreSEP...
Sending RestoreSEP (1353379 bytes)...
1337 CUSTOM KERNEL!
Personalizing IMG4 component RestoreKernelCache...
Sending RestoreKernelCache (14838511 bytes)...
getting SEP ticket
Trying to fetch new SHSH blob
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Received SHSH blobs
Cleaning up...
[exception]:
what=Device can't enter to restore mode
code=87949329
line=1342
file=futurerestore.cpp
commit count=288
commit sha =8936ddbed3a0c120330773aab03d4260b53527a9
Done: restoring failed!
Restore succeeded!``

about the send NOR data for ever.

Furturerestoring from 15.0.1 to 14.5 iPhone 6s , latest BB and SEP. I am using the latest test release from GitHub action and the same happens with official release. It says about to send NOR Data for ever. Is this normal?

Use pkgutil to find dependencies with cmake

currently cmake based build configs don't use pkgconfig and just assume all libraries are always available at system paths

please use pkg_check_modules, as with autotools based builds

SEP not signed even using latest SEP

futurerestore v194.
https://pastebin.com/UGtGLrGk

custom sep option does not work

Hi! version 194 always tries to use the latest sep firmware even when custom sep has been specified by means of -s and -m

iPhone 12 what=Device did not disconnect. Possibly invalid iBEC. Reset device and try again

iPhone 12 iOS 14.2.1
futurerestore v267
macOS arm64(M1) Monterey(12.2.1)

futurerestore from iOS 14.2.1 to iOS 15.1.1

./futurerestore-release -t iOS15.1.1.shsh2 --latest-baseband --latest-sep iOS15.1.1.ipsw

Log

Extracting iBEC.d53g.RELEASE.im4p (Firmware/dfu/iBEC.d53g.RELEASE.im4p)...
Personalizing IMG4 component iBEC...
Sending iBEC (853327 bytes)...
waiting for device to reconnect... Cleaning up...
[exception]:
what=Device did not disconnect. Possibly invalid iBEC. Reset device and try again
code=83558417
line=1275
file=futurerestore.cpp
commit count=267:
commit sha  =6406f5165001c8dcfde30467be2c792ef126dc05:
Done: restoring failed!

Feature: include libirecovery udev rule + script in linux build archive

Not all distro's come with irecovery on apt or pacman and its a pain to get the user to build from source.
Instead lets add a script to install the udev rule solving the device issue's

I also don't think usbmuxd is installed by default but is on apt/pacman so that just needs to be installed.
usbmuxd is only needed for entering into recovery from normal mode. The irecovery udev rule is required so futurerestore doesn't need to be run as root.

FDR ERROR

### Fix the notorious SEP panic FDR error when restoring to 14.2 or lower sometimes please fixxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

can you make a branch with your fork of img4tool

it would make users of inferius's life(and mine) a lot easier

Trying to restore iOS 10.3.3 on iPad Air (WiFi) always getting: Device did not reconnect. Possibly invalid iBEC.

Hello

I'm trying to downgrade an iPad Air 1, WiFi-only model, to iOS 10.3.3 using https://github.com/LukeZGD/iOS-OTA-Downgrader, but no matter what I do, it always fails to reconnect after iBEC is sent.

I tried several versions and forks of futurerestore, to no avail.

Here is a --debug log using the latest test build:

fr-log.txt

Does anybody have any idea how to solve this issue?

I noticed that as soon as fr quits, Finder pops up asking to restore the iPad. Is this expected? Maybe the timeout for "waiting for device to reconnect" is too strict?

Unable to downgrade when device current iOS is 15.3

Part of output from 198

sending nordata now... done
sending nordata
unmounting filesystems (29)
unmounting filesystems (29)
unmounting filesystems (29)
unmounting filesystems (29)
unmounting filesystems (29)
unmounting filesystems (29)
about to send fdr trust data...
sending fdr trust data now... done
sending fdr trust data checking for uncollected logs (44)
checking for uncollected logs (44)
error: unable to receive message from fdr 0x600001c582e0 (-2). 0/2 bytes
error: could not read data (-256). aborting.
cleaning up...
[exception]: what=error: unable to restore device

Part of output from 265

checkpoint 1558 complete with code 0
checkpoint 1559 complete with code 0
checkpoint 1560 complete with code 0
checking for uncollected logs (44)
checkpoint 1561 complete with code 0
checking for uncollected logs (44)
cleaning up...
[exception]: what=error: unable to restore device

I already deleted full log so I have to remaking problem after reinstall iOS
Device I used
iPhoneSE1 n69ap
MBA late 2018 Monterey 12.2 21D49 (also happened in 12.3 beta)

I used a9-checkm8-nonce-setter-script to set nonce
Here is futurerestore198 output when used on same device but iOS 15.2.1 installed

futurerestore(1349,0x70000595f000) malloc: Heap corruption detected, free list is damaged at 0x6000021581a0 *** Incorrect guard value: 15004962840888255118

trying to downgrade iphone x and keep facing this issue with any ipsw i use.
my computer is 2017 Macbook Pro Intel version running Monterey.

future restore log below

[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
downloading Savage,B0-Prod-Patch
100 [===========================================================================100 [===================================================================================================>]
downloading Savage,B0-Dev-Patch
100 [===========================================================================100 [===================================================================================================>]
downloading Savage,B2-Prod-Patch
100 [===========================================================================100 [===================================================================================================>]
downloading Savage,B2-Dev-Patch
100 [===========================================================================100 [===================================================================================================>]
downloading Savage,BA-Prod-Patch
100 [===========================================================================100 [===================================================================================================>]
downloading Savage,BA-Dev-Patch
100 [===========================================================================100 [===================================================================================================>]
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
Finished downloading the latest firmware components!
Found device in DFU mode
requesting to get into pwnRecovery later
irecv_event_cb: device 00117946008bc02e (udid: N/A) connected in DFU mode
Found device in DFU mode
Identified device as d221ap, iPhone10,6
Extracting BuildManifest from iPSW
Product version: 14.8
Product build: 18H17 Major: 18
Device supports Image4: true
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AOP" OK (untrusted)
[IMG4TOOL] checking hash for "Ap,SystemVolumeCanonicalMetadata"BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "AppleLogo" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "AudioCodecFirmware" OK (untrusted)
[IMG4TOOL] checking hash for "BasebandFirmware" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "BatteryCharging0" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryCharging1" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryFull" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow0" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow1" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryPlugin" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "DeviceTree" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "ISP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "KernelCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "LLB" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "Liquid" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "Multitouch" OK (untrusted)
[IMG4TOOL] checking hash for "OS" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RecoveryMode" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreDeviceTree" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreKernelCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreLogo" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreRamDisk" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreTrustCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SE,UpdatePayload" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "SEP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "Savage,B0-Dev-Patch" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B0-Dev-PatchVT" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B0-Prod-Patch" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B0-Prod-PatchVT" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B2-Dev-Patch" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B2-Dev-PatchVT" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B2-Prod-Patch" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B2-Prod-PatchVT" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,BA-Dev-Patch" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,BA-Prod-Patch" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "StaticTrustCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SystemVolume" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "ftap" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "ftsp" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "iBEC" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBSS" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBoot" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "rfta" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "rfts" IGN (no digest in BuildManifest)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197:
commit sha =aca6cf005c94caf135023263cbb5c61a0081804f:
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AOP" OK (untrusted)
[IMG4TOOL] checking hash for "Ap,SystemVolumeCanonicalMetadata"BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "AppleLogo" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "AudioCodecFirmware" OK (untrusted)
[IMG4TOOL] checking hash for "BasebandFirmware" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "BatteryCharging0" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryCharging1" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryFull" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow0" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryLow1" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "BatteryPlugin" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "DeviceTree" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "ISP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "KernelCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "LLB" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "Liquid" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "Multitouch" OK (untrusted)
[IMG4TOOL] checking hash for "OS" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RecoveryMode" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreDeviceTree" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreKernelCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreLogo" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreRamDisk" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreTrustCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SE,UpdatePayload" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "SEP" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "Savage,B0-Dev-Patch" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B0-Dev-PatchVT" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B0-Prod-Patch" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B0-Prod-PatchVT" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B2-Dev-Patch" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B2-Dev-PatchVT" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B2-Prod-Patch" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B2-Prod-PatchVT" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,BA-Dev-Patch" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,BA-Prod-Patch" IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "StaticTrustCache" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "SystemVolume" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "ftap" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "ftsp" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "iBEC" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBSS" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "iBoot" BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "rfta" IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "rfts" IGN (no digest in BuildManifest)

BuildIdentity selected for restore:
BuildNumber : 18H17
BuildTrain : AzulSecuritySky
DeviceClass : d221ap
FDRSupport : YES
MobileDeviceMinVersion : 1253.100.1
RestoreBehavior : Erase
Variant : Customer Erase Install (IPSW)

BuildIdentity is valid for the APTicket:
IM4M is not valid for any restore within the Buildmanifest
This APTicket can't be used for restoring this firmware
[WARNING] NOT VALIDATING SHSH BLOBS!
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
irecv_event_cb: device 00117946008bc02e (udid: N/A) connected in DFU mode
Device found in DFU Mode.
Getting firmware keys for: d221ap
Patching iBSS
Extracting iBSS.d22.RELEASE.im4p (Firmware/dfu/iBSS.d22.RELEASE.im4p)...
payload decrypted
Compression detected, uncompressing (bvx2): ok
iBoot64Patch: Staring iBoot64Patch!
iOS 14 iBoot detected!
iBoot64Patch: Inited ibootpatchfinder64!
iBoot64Patch: Added sigpatches!
iBoot64Patch: Added unlock nvram patch!
iBoot64Patch: Added freshnonce patch!
iBoot64Patch: has_kernel_load is false!
iBoot64Patch: Applying patch=0x180032bf0 : 000080d2
iBoot64Patch: Applying patch=0x180032c44 : 000080d2
iBoot64Patch: Applying patch=0x18001f8a8 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x18001f8f8 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x18006be6c : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x180039060 : 1f2003d5
iBoot64Patch: Patches applied!
[WARNING] BUG WORKAROUND recompressing images with bvx2 makes them not boot for some reason. Skipping compression
Patching iBEC
Extracting iBEC.d22.RELEASE.im4p (Firmware/dfu/iBEC.d22.RELEASE.im4p)...
payload decrypted
Compression detected, uncompressing (bvx2): ok
iBoot64Patch: Staring iBoot64Patch!
iOS 14 iBoot detected!
iBoot64Patch: Inited ibootpatchfinder64!
iBoot64Patch: Added sigpatches!
iBoot64Patch: Added unlock nvram patch!
iBoot64Patch: Added freshnonce patch!
iBoot64Patch: has_kernel_load is true!
iBoot64Patch: Added debugenabled patch!
iBoot64Patch: Added bootarg patch!
iBoot64Patch: Applying patch=0x180032bf0 : 000080d2
iBoot64Patch: Applying patch=0x180032c44 : 000080d2
iBoot64Patch: Applying patch=0x18001f8a8 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x18001f8f8 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x18006be6c : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x180039060 : 1f2003d5
iBoot64Patch: Applying patch=0x180034750 : 200080d2
iBoot64Patch: Applying patch=0x180035cac : 183e5430
iBoot64Patch: Applying patch=0x1800de46d : 72643d6d6430206e616e642d656e61626c652d7265666f726d61743d307831202d76202d726573746f72652064656275673d30783230313465206b65657073796d733d30783120616d66693d3078666620616d66695f616c6c6f775f616e795f7369676e61747572653d30783120616d66695f6765745f6f75745f6f665f6d795f7761793d3078312063735f656e666f7263656d656e745f64697361626c653d30783100
iBoot64Patch: Patches applied!
[WARNING] BUG WORKAROUND recompressing images with bvx2 makes them not boot for some reason. Skipping compression
Repacking patched iBSS as IMG4
Repacking patched iBEC as IMG4
Sending iBSS (1489110 bytes)...
[==================================================] 100.0%
Booting iBSS, waiting for device to disconnect...
irecv_event_cb: device 00117946008bc02e (udid: N/A) disconnected
Booting iBSS, waiting for device to reconnect...
irecv_event_cb: device 00117946008bc02e (udid: N/A) connected in Recovery mode
ApNonce pre-hax:
Getting ApNonce in recovery mode... INFO: device serial number is C39W14SJJCLH
25 85 3a 10 ca db 45 c5 9c a3 4c ce 33 c1 8d 54 43 48 2f 61 09 8f ac c5 06 03 c0 1e d3 76 c0 f2
Sending iBEC (1489110 bytes)...
[==================================================] 100.0%
Booting iBEC, waiting for device to disconnect...
irecv_event_cb: device 00117946008bc02e (udid: N/A) disconnected
Booting iBEC, waiting for device to reconnect...
irecv_event_cb: device 00117946008bc02e (udid: N/A) connected in Recovery mode
APNonce from device already matches IM4M nonce, no need for extra hax...
Successfully set nonce generator: 0x5eb130175429e76d
futurerestore(1349,0x70000595f000) malloc: Heap corruption detected, free list is damaged at 0x6000021581a0
*** Incorrect guard value: 15004962840888255118
futurerestore(1349,0x70000595f000) malloc: *** set a breakpoint in malloc_error_break to debug
[1] 1349 abort futurerestore -t --use-pwndfu --debug --no-cache --skip-blob --latest-sep

Fails to enter restore mode

Hi,

I have tried multiple times trying to restore my iPhone 7 Plus to iOS 14.2 using multiple versions of futurerestore on macOS. I have even tried that latest version of futurerestore. It fails to enter restore mode when sending RestoreKernelCache. Below is the log of the error.

Sending RestoreKernelCache (14803444 bytes)...
ERROR: Failed to place device in restore mode
Cleaning up...
[exception]:
what=ERROR: Unable to place device into restore mode

code=66584593
line=1016
file=futurerestore.cpp
commit count=189:
commit sha =3786d4cd230b93f4b7ade7d0fdebd56b48fbf7a6:
Done: restoring failed!

Please help

Many thanks
Andrew Seaman

futurerestore / futurerestore Goto Github PK

futurerestore's Introduction

futurerestore

What is FutureRestore?

Support

Features

Compiling

Futurerestore Usage

1) Prometheus (64-bit device) - APNonce recreation with generator method

You can only downgrade if:

Requirements

Method:

Using dimentio

Using jailbreak tools:

Firmware Signing Info

Common Issues

SEP Firmware is not being signed

Could not connect to device in recovery mode / Failed to place device in recovery mode

Device ApNonce doesn't match APTicket nonce

Unable to send iBEC (error -8)

Error: Unable to receive message from FDR...

2) Prometheus (64-bit device) - ApNonce collision method (Recovery mode)

Requirements

Info

How to use

3) Prometheus (64-bit device) - ApNonce collision method (DFU mode)

Requirements

Info

How to use

4) Odysseus (32-bit / 64-bit devices)

Requirements

Info

How to use

5) iOS 9.x re-restore bug by @alitek123 (only for 32-bit devices)

Requirements

Info

How to use

Report an issue

futurerestore's People

Contributors

Stargazers

Watchers

Forkers

futurerestore's Issues

Log

Recommend Projects

Recommend Topics

Recommend Org