futurerestore-help

[low summit]

I was sleepy af

[lilac wren]

i dont wanna leak my ECID or whatever ill dm you and tb

[royal flint]

hi what did I miss

[green onyx]

nothing honestly

nothing new

[low summit]

Testing if 90 days can be bypass

[royal flint]

it cannot

pallas refuses

[low summit]

They trying lol

[royal flint]

i tried it already lol

[low summit]

Froggy wants to make a tweak

[royal flint]

anyways not sure if yall know yet but we found out a few things

tss server is confirmed the same

it's just a bunch of added properties in the request

[zealous bridge]

a14 is a server side issue

[royal flint]

target ios version, ECID, sep nonce, managed, and bcert

[royal flint]

ye

[lilac wren]

what are the added properties

and how come 14.3 is still signed then

[zealous bridge]

write up

check the write up

[lilac wren]

oh ok

that gist?

[zealous bridge]

for supervised devices

[zealous bridge]

yes

it’s signed so enterprises can check the software out before actually installing it on employees managed devices

[royal flint]

I didn't update the gist yet with what we learned about the tss stuff

[royal flint]

these are the added properties

@zealous bridge can explain more

[lilac wren]

oh ok

[low summit]

So apple can shit this down?

[zealous bridge]

ok

[low summit]

After 90 days

[zealous bridge]

well how it goes is

a request is made to pallas

with the added fields

“supervised” “delayperiod” and “delayenabled”

supervised should be true

[low summit]

Lol tanbeer why are you not genius

[zealous bridge]

delayperiod should be an int between 1-90

and anything inbetween

delayenabled should also be true

once is this request is made

the tss request goes out

with the added fields mentioned above

sadly it looks like BCert is specific to the version and device

maybe some SEP UID key idk

so thats why we cant save ota blobs for other versions

or check the signing status of other versions

[royal flint]

well once you get the response from pallas you get the available ota and then you download etc, fast forward to tss

[zealous bridge]

oh yeah

that happens

[low summit]

That's interesting. So that's why Ota is still signed

[zealous bridge]

yes

[low summit]

Tanbeer for genius

[lilac wren]

what's bcert?

[royal flint]

we had siguza's help lol

[lilac wren]

^ was gonna say

I spent the whole day trying to sniff and tanbeer does it in 5 minutes? lol

[zealous bridge]

bcert is required for @Managed = 1

[low summit]

Froggy genius too

[zealous bridge]

which is another key required

[royal flint]

bcert is asn1

[zealous bridge]

type of cryptography signature

uhh

what can i compare it to

[lilac wren]

or you can reply here

[royal flint]

contains sepnonce, productmarketingversion, ecid, and something called SKS, which may be SEP Key Service

[zealous bridge]

@royal flint what can i compare asn1 to

that people acc know

[royal flint]

same structure as x509 website ssl certificates

[zealous bridge]

like ssl certificates yeah

[royal flint]

anyways

since bcert is cryptographically signed

we have an issue

[valid adder]

am back

what yall speaking of

[lilac wren]

pwn has a secret club

[royal flint]

Siguza is trying to see if we can create BCerts with the pwned A10 SEP, but as bcert includes the chip ID, unless they used the same key it might not work for A11+

now @zealous bridge can explain blobs i still know about jack shit about it

need to read up when I have the time

[valid adder]

the way iOS codesigning works is there is a public key which is embedded in bootrom, tatsu(tss) is the private key which signs the bootchain, bootrom matches the signed bootchain with the public cert

[lilac wren]

I don't think they're talking about signing

[zealous bridge]

lol

[valid adder]

I know

[green onyx]

we were talking about how it requests ota updates

at least i interpreted it that way

[zealous bridge]

how it signs delayed ota updates*

[green onyx]

ah

[silent tusk]

@lilac wren 14.3 ended up showing but

[zealous bridge]

Yes because spoofing

[silent tusk]

nah

i only got the mdm from earlier installed

so yes spoofing

but mdm

[low summit]

Still won't install lol

Verify error

[silent tusk]

yeah :/

[zealous bridge]

the difference is?

[lilac wren]

yeah I dont think it'll work

[low summit]

I changed version back still doesn't work

[lilac wren]

MDM is 3 hours late lmho

[zealous bridge]

lol

true

[low summit]

Lol no I got 14.3

[lilac wren]

you have it too?

or before

[low summit]

Before

When u left

[lilac wren]

I thought you both got 14.4 before

oh wow

I mean that's good I guess

[low summit]

Changed to 14.3 like instantly lol

But still won't install so

It's useless

[lilac wren]

yep

[low summit]

But from how tanbeer explained signed deny firmwares then it should work lol

Why it have verify error

[zealous bridge]

because sep

[silent tusk]

?

[low summit]

It's compatible bro lol

14.4.2 to 14.3

[lilac wren]

yeah I don't really understand the SEP argument

[zealous bridge]

thats ipsw

[low summit]

I don't either

[zealous bridge]

not compatible with ota

[low summit]

Oh I get it

Ota has sep lol

It doesn't work backwards

Only update works

[zealous bridge]

ipsw sep compatibility and ota sep compat is different

[lilac wren]

OTA does or doesn't have a SEP

[zealous bridge]

it does

[low summit]

It does

[lilac wren]

if it has a SEP then it will just downgrade it then?

just like an iOS update?

[zealous bridge]

ota’s are unable to downgrade sep

[royal flint]

^^

[lilac wren]

ah

[zealous bridge]

they physically can’t

[lilac wren]

ok that actually makes sense

[silent tusk]

which is why you can’t downgrade

[low summit]

U can't downgrade sep u could only update sep

[silent tusk]

okay

[lilac wren]

yeah im dumb

[silent tusk]

then i’m back to fdr waiting room

[zealous bridge]

rip

thats hell on earth

[silent tusk]

unless you guys can make magic with pwndfu and ota blobs

[low summit]

That's y there's verify error it can't read the sep @zealous bridge

[zealous bridge]

pwndfu is hype lol

[zealous bridge]

if you connect it to console

[green onyx]

True

[zealous bridge]

you’ll see exactly what goes wrong

[low summit]

U can't Ota with dfu tho

Lol

[zealous bridge]

no ofc not

[lilac wren]

and I assume no incrementals exist for downgrades lol

[zealous bridge]

you would assume correctly

[low summit]

Pwn dfu the return of cfw?

[silent tusk]

i mean

i’d be down for tethered cfw

which is possible atm right ?

[low summit]

Yea

[green onyx]

@zealous bridge did cryptic get ipwndfu working with v195?

[silent tusk]

and i think there’s stuff in the works for it

[zealous bridge]

yes but none exist neither the tools for it exist

[green onyx]

i dont see any new commits

[zealous bridge]

he said he got it working but deleted it

[green onyx]

[zealous bridge]

and that its not hard to fix

[green onyx]

true

[low summit]

Pwn dfu allow old sep to downgrade?

[silent tusk]

there’s stuff for tethered downgrades

[green onyx]

no, patches sep

[zealous bridge]

no

[lilac wren]

Declined to authorize this image on this device for this user
This means TSS got your request, but denied to sign it, right?

[green onyx]

and gets iboot to ignore it

[low summit]

Patches sep like for Checkm8?

[zealous bridge]

yes, or you requested something impossible

[lilac wren]

oh ok

[green onyx]

patches sep using checkm8 i think

correct me if im wrong

[low summit]

So a11 sep fix coming or nah?

[green onyx]

nope

[low summit]

Then how does it patch sep lol

[green onyx]

i plan on using ipwndfu to 13.7 for checkra1n

[green onyx]

magic hax

this uses checkm8

checkra1n uses seprom exploit which is blackbird

[zealous bridge]

not sep itself

[low summit]

Checkm8 can be used for so much shady stuff lol

[zealous bridge]

sep verification

it basically tells sep

[green onyx]

to lie low?

[zealous bridge]

“idc what you are, or if ur supposed to be here, just load”

[green onyx]

lol

ah

[low summit]

To fk off lol

[green onyx]

lmao

[low summit]

So any sep from the firmware will work?

[green onyx]

yes

[low summit]

That's cool for fr

[green onyx]

so as long as u have blobs, u can use em

for A11-

[low summit]

But bb still a problem

[royal flint]

which reminds me

[green onyx]

@zealous bridge bb isnt an issue right?

[royal flint]

how save OTA blobs

[low summit]

It is

[low summit]

Onboard?

[royal flint]

ig

[low summit]

System info

[royal flint]

taurine time

[low summit]

I tho u already jb

Been 2 days

[zealous bridge]

just copy the tss response, put it into a file with the extension .shsh2

bam saved blobs

[green onyx]

with delayed? u cant unless u dump

[royal flint]

nah i basically havent touched the se since upgrading lol

[low summit]

Lol

[zealous bridge]

.shsh2 is a tss response backup

thats all it is

[royal flint]

i wasnt running mitmproxy back then 😦

[green onyx]

[zealous bridge]

restore.log should have it

[low summit]

So onboard lol?

[royal flint]

shit ur right

[zealous bridge]

no

yep

just look for tss-response

[royal flint]

why did taurine break

bruh

it got unsigned

lmfao

[low summit]

Sign it again

[green onyx]

[low summit]

At least mybloxx gave u 2 credit

Unlike sileo

[royal flint]

i'm keeping this for as long as i can

[green onyx]

lol

yes

[low summit]

And tanbeer saying Mac only my ass

That was funny

[royal flint]

lol

is a ssh server already installed with taurine

i'm guessing no

[zealous bridge]

no

install openssh on sileo

[royal flint]

aight

jailbreak on a modern phone is so much nicer than the fucking 6 plus

[low summit]

Lol

Wasn't it 6s?

[royal flint]

nope 6+

so stuck on 12 too

[low summit]

Like me LMAOOO

[oblique nova]

Hi quick question

[low summit]

OK

[oblique nova]

I'm getting blob doesnt match

What I do ;0 ;-;

[royal flint]

@zealous bridge it's not in restore.log

[zealous bridge]

?

you sure

[royal flint]

tss response

yea

[zealous bridge]

lemme look for the exact line

ohh

you got the wrong restore.log

whats the path to urs

[royal flint]

/var/MobileSoftwareUpdate/restore.log

[zealous bridge]

path

why is it tiny

[royal flint]

idk

[zealous bridge]

mine is 500kb

tss_submit_job: ----Begin response

hmm

thats been shortened

double check the path

you’re using the one in /var/mobile/MobileSoftwareUpdate

its just /var/MSU

[zealous bridge]

cd ..

oh wait

hm

did you even successfully OTA restore @royal flint

[royal flint]

the fuck

its in settings

the privacy thing

but its not in the restore.log

[zealous bridge]

oh true

[royal flint]

yes

bro ios logging jank

[low summit]

He was the first one lol

To restore

[zealous bridge]

OTAUpdate.ips is the same as restore.log

[lilac wren]

he was the first...

[low summit]

...

[zealous bridge]

oh this isnt ur 6+

Lmao

[lilac wren]

it's literally named "froggy said to change name" lol

[low summit]

But he used the wipe method lol

[zealous bridge]

I thought it was for some reason

[royal flint]

beautiful

[zealous bridge]

ye

everything from <plist to </plist>

[royal flint]

plist has been saved as a new file

[low summit]

U could get shsh blobs from ssh now?

[zealous bridge]

it’s called cat

[royal flint]

beautiful

[low summit]

Is it fr usable?

[zealous bridge]

no

[low summit]

Then why u need it lol

[zealous bridge]

maybe it will be soon

if cryptic fixes pwn64bit

[low summit]

So it's like onboard?

[zealous bridge]

but only A11-

No not onboard

[low summit]

But similar concept?

Fr usable

Soon

[zealous bridge]

onboards were never broken

they always worked

for all devices

[low summit]

Lol but whats the issue

[zealous bridge]

but most people OTA’d so the onboards were also OTA

which dont work with fr

If they IPSW upgraded

then they wouldve worked

[low summit]

Oh

[royal flint]

hmm how do you get onboards. installed system info but don't see it

[low summit]

Apticket

Swipe on ecid

[zealous bridge]

swipe left on the ecid value

if you dont see anything

get it from the right repo

[valid adder]

@low summit apticket is useless

[royal flint]

looks like i got it from the wrong repo then

[low summit]

Is that not onboard?

[valid adder]

disk1 files are are onboard @royal flint

eg dumping LLB from disk1 we can extract the im4m

its the full blob

img4tool is just buggy

[zealous bridge]

https://apt.arx8x.net

[royal flint]

thank

[valid adder]

img4tool seems to be broken

I know where it fails

[zealous bridge]

restore behaviour is inherited from the previous restore right

with onboards

[valid adder]

wym

[zealous bridge]

restore behaviour of onboards depends if you updated/restored to that version

if you updated the onboards would be update blovs

if you restored it would be restore blobs

[valid adder]

I believe blobs are just the hashes of each component encrypted with tatsu private key

the public key decrypts

[zealous bridge]

what encryption algorithm?

[valid adder]

its signed

theres is a POC tatsu server

in python

[zealous bridge]

oh

so no encryption method

where is restore behaviour / ecid / board config / build id / apnonce stored then

should be in the blob too

[valid adder]

its rsa

[zealous bridge]

oh im dumb

[valid adder]

its encrypted with rsa

[zealous bridge]

yeah im dumb how could it not be

[valid adder]

the private keys are the holy grail

or a9 sha1 oracle hack

[lilac wren]

just hack apple servers for key ez

[low summit]

If u could do that then u could just restore to any firmware

[lilac wren]

yeah haha

today, I wanna sign iOS 10

[low summit]

And break icloud

[zealous bridge]

@valid adder how does the public key decrypt then?

you need private key to decrypt in rsa i swear

[valid adder]

its a key pair, thats how cryptography works

only the private key can encrypt, but the public key can decrypt

[zealous bridge]

that only applies to messages encrypted with the private key right?

[zealous bridge]

what if you were to encrypt with the public key, would you have to decrypt with the private?

[valid adder]

theres 3 versions, sha1, sha384 3k and sha384 4k

sha1 is a9 and lower, 4k is a10 and later idk when 3k comes into play

[royal flint]

yes

[zealous bridge]

A11 is 3k by itself

[valid adder]

no

a10 and a11 are the same

[zealous bridge]

oh

[valid adder]

I belive a13 is 3k

idk tho

[zealous bridge]

true

[valid adder]

4k is definitely a10-a12

the only thing this project needs to work is official tatsu private key

[zealous bridge]

tbh even if we did manage to get the private key and sign every version, wouldnt sep and bb hold us back?

[valid adder]

right now if we patch bootrom to use the fake sham public key and sign with the fake sham priv key, we can boot to stage1 without sigpatch @zealous bridge

[zealous bridge]

thats how rmvsigchecks.py works?

[valid adder]

no because we made our own blob using the current separt and sepnonce

same with bbnonce

its godmode

with the privkey

[zealous bridge]

surely there must be some incompatibility or smth

[valid adder]

rmsigchks has nothing to do with certs

I was giving an example of how to do it by only patching in our own public key

[zealous bridge]

oh

yeah that makes sense

i was wondering how it relates to the tools we have available to us today

[valid adder]

doesn't this just make you love how insecure and secure iOS is at the same time

[zealous bridge]

true, it’s like they’ve locked every door down with the hardest lock you can find, but all with the same key

[valid adder]

we have poc tatsu available for us today

it has shamkeys

not the real tatsu

but if we insert the real tatsu private key it will be actual tatsu

the thing is there is a different keypair per bootrom

[zealous bridge]

oh so it’s everything that we could copy basically

[zealous bridge]

is that what they post on theiphonewiki

firmware keys

[valid adder]

firmwarekeys aren't related to signing at all

apple is slowly moving to an unencrypted firmware model

[zealous bridge]

ohh

different rsa keys

[lilac wren]

Why unencrypted

[valid adder]

idk we should ask them

apple

[lilac wren]

Ok I'll call tomorrow

[zealous bridge]

same

[valid adder]

first with iOS 10 beta the kernel was no longer encrypted

[zealous bridge]

@split torrent oi

[valid adder]

then later came rootfs and logos and devicetree etc

[lilac wren]

Wait can you give me examples for this so I can ask apple

Oh you are rn

[valid adder]

bruh

[lilac wren]

Lol sorru

[zealous bridge]

sepos has to be encrypted tho right

[valid adder]

is there an actual question right now all this is theoretical and hypothetical

[low summit]

Jtv lmao

[lilac wren]

Lol

[zealous bridge]

this is educational

[lilac wren]

@vivid nova you ask them then, ur the spy

[valid adder]

AP Bootrom decrypts all firmware components
SEPROM Bootrom decrypts sepos

[vivid nova]

huh?

[lilac wren]

We need the spy

[valid adder]

thats why its such a pain, it has its own bootrom

[vivid nova]

[lilac wren]

LOL

[valid adder]

thats why checkm8 gives us no control over sep

[zealous bridge]

fucking sep

[valid adder]

until blackbird came along

[vivid nova]

I got control when your mom came along

[lilac wren]

Stupid Extra Processor

[zealous bridge]

The baseband has it’s own processor as well lmaooo

[valid adder]

Fucking Device Restore

[lilac wren]

Oh mine was Future Damn Restore

[zealous bridge]

Imagine locking down a fucking thing that allows you to call people and literally nothing else

[valid adder]

we need to figureout how to modify bbnonce

but first is FDR sep panic

[lilac wren]

^ that please, Apple doesn't like teaching-learning. Can't everything just be open source

[vivid nova]

i'm going to guess that "unable to personalize boot" is a sep issue too?

[lilac wren]

There's usually another error? Saying why

[valid adder]

@vivid nova I blame user error

not my problem

[zealous bridge]

true

or apple just fucked up

[valid adder]

have any other tss questions

[lilac wren]

Does personalize = sign

[valid adder]

no

[lilac wren]

Oh

[zealous bridge]

what is personalize then

encrypt?

[vivid nova]

wen eta tss on-device be great again

[valid adder]

personalize means convert the component to im4p then add the blob IM4M to it then convert to img4 @lilac wren

[lilac wren]

Oh ok

So sign + extra conversion steps?

[valid adder]

theres nothing to sign

the blob is the sign

[lilac wren]

So it's signing the component

[zealous bridge]

signature*

[valid adder]

the blob is the tss response

[zealous bridge]

the blob is the sign

lol

[lilac wren]

Yeah

[zealous bridge]

blobs are just tss responses backed up

literally

[lilac wren]

Oh ok I see what you mean, it's not *being signed* it's just attaching the signature

[zealous bridge]

.shsh2 is no different than .bak

[valid adder]

luckily onboard img4 has BNCH(apnonce) and BNCN(generator) so we can reuse the blob

[lilac wren]

Neat

[valid adder]

BNCH is im4m, BNCN is im4r

[lilac wren]

How does it verify signatures on boot? Using that public key? And is this readonly? So if private key got leaked, Apple couldn't patch?

Ok nice, that's what I thought

[zealous bridge]

i have the public key, i could leak it rn

[lilac wren]

Lol

[zealous bridge]

lol

[valid adder]

it uses the public key to decrypt the blob im4m values, I assume the hash is what's encrypted. if the hashes don't match it fails @lilac wren

[zealous bridge]

ikik

just a joke

[lilac wren]

Ty

[valid adder]

yes game over if private key leaks

exactly

[zealous bridge]

they use different pairs for each bootroms

[valid adder]

but the sad thing is there is a difference keypair for every bootrom @sacred estuary

[zealous bridge]

so thats more added frustration

[valid adder]

yep

cfw

[lilac wren]

Not too knowledgeable, what's a key pair and why does that make things worse?

[valid adder]

for life

untethered

cfw

we can sign our own fw

[zealous bridge]

public keys is what you give people to encrypt messages, private keys is what decrypts those messages

[lilac wren]

Oh there's a different public key per chip is that what you mean?

[zealous bridge]

public and private key

[lilac wren]

I know that but what do you mean different per bootrom

Per unique device?

[zealous bridge]

per each bootrom revision

[valid adder]

https://en.wikipedia.org/wiki/RSA_(cryptosystem) time to read @lilac wren

[lilac wren]

Ty

[zealous bridge]

bootroms arent all the same

[lilac wren]

Yep, got it now ty

[zealous bridge]

Not hard to find

[valid adder]

the bootrom version = the iOS iBoot version of launch iOS

eg: a9 6s bootrom is the same iBoot version as 9.0 iBoot

[zealous bridge]

https://www.google.co.uk/search?q=apple+tss+public+key&ie=UTF-8&oe=UTF-8&hl=en-gb&client=safari

[valid adder]

the funny thing is I've been doing this since 2016 but I didn't really learn tatsu/brom until 2019/2020

@zealous bridge bri'ish

[zealous bridge]

tatsu sounds japanese

[valid adder]

it does

tss means tatsu signing server

[zealous bridge]

Ik

But it was “designed by apple in california”

[valid adder]

FDR means fucking device restore
SEP means Super Extra Pussyshit

[royal flint]

lmao

[zealous bridge]

the pub key would be the same

[zealous bridge]

Can confirm

Well they are RSA 256

[valid adder]

I believe auth keys are used for baseband and friends

theres no 256, just 384 shortented to 64 chars @zealous bridge

[zealous bridge]

I meant this

It’s RSA-256

[gilded jolt]

I was told that since i have no blobs to go from ios 14.4.2 to ios 14.3, i have to use the no blob method, i just jailbroke with checkra1n, what do i do next?

[valid adder]

tatsu doesn't use 256

other stuff may use 256

[zealous bridge]

these auth keys do

you said for baseband

[valid adder]

@gilded jolt not possible

you need blobs

[zealous bridge]

How do people even find bootrom exploits

[tulip yew]

they work backwards?

[gilded jolt]

Isn't there a no blobs method

[zealous bridge]

and i work forwards

[tulip yew]

you see something weird in the code so u work backwards

then something something hooray

[zealous bridge]

how do they view the code

[valid adder]

@gilded jolt that requires 14.2.x or lower

you can't be on 14.3 or later to use noblob @gilded jolt

[lilac wren]

You can be on 14.3

Tanbeer did 14.3 -> 14.3 editing systemversion.plist I think

[zealous bridge]

^

[lilac wren]

On his main lmho

[zealous bridge]

That was stupid

[lilac wren]

It was

[zealous bridge]

idk how i still have a jb

[royal flint]

although is there any point in 14.3 -> 14.3

[zealous bridge]

true

literally no point

[low summit]

Tanbeer would do that

[zealous bridge]

Except flexing that your preparing update takes 3 seconds

[gilded jolt]

Ohh ok, there was something else involved with it though, i think someone said mybloxx and tricking the phone into thinking it was on a lower version, ill reply to what they said

[zealous bridge]

that requires 14.2.1 or lower

[valid adder]

@gilded jolt that requires 14.2.1 or lower lol

[gilded jolt]

This is what I was told yesterday

[royal flint]

although if you have a jailbreak you can edit SystemVersion.plist, you will be on too high of an SEP for the OTA method to work

[valid adder]

@gilded jolt that person didn't know your context

or they don't have any idea what they are talking about

[gilded jolt]

Ah ok

Thank you anyways!

Have a great day!

[valid adder]

@zealous bridge @lilac wren any other questions

[lilac wren]

I don't think I have any more!! Thanks for sharing your knowledge ❤️

[zealous bridge]

this man is a literal sql database

lol

[lilac wren]

#Cryptic best genius

Lol true

[zealous bridge]

imma ping u if i have anymore tho

im still looking into a14

but i think it’s server side

so nothing we can do

[lilac wren]

14.2 XS

#818879231772983357 message

[zealous bridge]

on a mac... hmmm

[lilac wren]

No access 4 u

[zealous bridge]

true

[lilac wren]

!​t noECID4u

Let's go, took 10m but Microsoft finally did it all automatically

I had to just change my name

[vivid nova]

from froggy to Toad

[low summit]

Lol froggy what now

[lilac wren]

Did you just call me a to@d

[low summit]

Toad to ur mom @vivid nova

[lilac wren]

^

[vivid nova]

Tv's don't have 'rents

A for effort tho

[zealous bridge]

your mum pays me rent

[low summit]

^

[lilac wren]

Lol

[vivid nova]

my 'mum' wouldn't be english

[zealous bridge]

i can make her english

[vivid nova]

your mom would

[lilac wren]

You can be my mom

[low summit]

Eww

[zealous bridge]

Cute

[low summit]

Lol

[vivid nova]

how? I'm yo daddy

[lilac wren]

No

You are now Ms. JTV

[zealous bridge]

Giving birth to a frog

[low summit]

Lol u walk into that one

[vivid nova]

that'd hurt

[low summit]

Daddy toad jtv

[zealous bridge]

you’d know from experience

frogTV

[lilac wren]

O_o

[vivid nova]

the only experience your mum had with me...

[zealous bridge]

better love story than twilight

[lilac wren]

Wow

[low summit]

JToad

[lilac wren]

.>

[vivid nova]

JToadVision

[zealous bridge]

yeah she complains about it everyday

[low summit]

Froggy turned toaddy

[vivid nova]

well you gotta put batteries in it

[zealous bridge]

batteries in a tv

[vivid nova]

in the remote dumbass

[low summit]

I'll put batteries into ur mom

[lilac wren]

JTV is a nice TV, looks good from 8ft away but is awful up close

/s Ily

❤️

[low summit]

Jtv ain't even 4k

[vivid nova]

You're a delicacy where I'm manufacturered

[zealous bridge]

true

[lilac wren]

A swamp?

[vivid nova]

tvOS 15 😉

[lilac wren]

Matches up

[vivid nova]

thailand

[zealous bridge]

tail and

what?

[lilac wren]

Tail and frog legs

[zealous bridge]

tail and head

[vivid nova]

love autocorrect

love y'all moms too

😉

[lilac wren]

Only tadpoles have tails, and I don't think that's humane if they're that young...

[vivid nova]

tf you talkin' about.. they eat frogs there

[lilac wren]

Tail land

They eat tails

[vivid nova]

https://tenor.com/view/nope-stupid-slap-in-the-face-phone-gif-15151334

[zealous bridge]

can i remind yall that this is #futurerestore-help

[zealous bridge]

i do that to your mum

[vivid nova]

can i remind y'all that I'll be calling your mom later on tonight

[lilac wren]

Oops ur right

[lilac wren]

We're calling apple tomorrow

[vivid nova]

Imma spy

[lilac wren]

Oh no

[vivid nova]

Only Apple Peach knows

[lilac wren]

Lol

[valid adder]

what are we trying to do now

[zealous bridge]

no idea

whats the tss ssh password @valid adder

asking for a friend

[valid adder]

🙂

[shy magnet]

hey apple

need tatsu ssh keys

reason isn't relevant

[zealous bridge]

@split torrent

[vivid nova]

need your mom

[shy magnet]

#jailbreak message

[vivid nova]

cringe when you gotta relay a message

[valid adder]

@zealous bridge if sepnonce, separt, and bbnonce all match the blob we can basically just install that iOS version without latest anything

[lilac wren]

Eta sep nonce setter

[valid adder]

soon

[zealous bridge]

wait i thought the reason sep had to be compatible was hardware-related

[vivid nova]

that moment when idevicerestore detects DFU but iTunes doesn't...

[valid adder]

yes SEPROM controls sepnonce

hardware

[lilac wren]

@low summit @silent tusk I'm an idiot so sorry, had 50 day delay profile enabled when you guys got the MDM... That's why it always showed 14.4

[low summit]

Lmao but I got 14.3 anyways

[lilac wren]

Oh yeah lol

Ok good at least

[low summit]

So didn't matter

[zealous bridge]

@valid adder when you say the latest sep is incompatible with say 13.3... do you mean the sepnonce is different

[lilac wren]

Seems like the firmware push overrode the restriction

[silent tusk]

nah but

you had it to 50

[zealous bridge]

lol tryna teach me bs about how it has to upgrade to 14.0 then 14.4 then 14.4.2

[silent tusk]

and i saw 50

but then u changed it to 90 or something

[lilac wren]

It's always different

[low summit]

Still don't work tho

[lilac wren]

We can't upgrade or downgrade sep

[low summit]

Rip

[silent tusk]

because ti changed in the mdm profile

when i was looking earlier

[lilac wren]

Oh then maybe that's how Microsoft does it idk

[silent tusk]

yeah maybe

anyway

[low summit]

How did that one guy succeed

I really want to know

[lilac wren]

I believed it ok

[silent tusk]

nah but

[lilac wren]

I think 14.4.2 has a full OTA ipsw

[vivid nova]

we can, just dunno how

[silent tusk]

wasnt the proven ?

didnt someone post pic earlier

[zealous bridge]

literally no-one

[low summit]

Ur mom does tho

[lilac wren]

We can also make your mom fly, just dunno how

[valid adder]

thats not how it works

[silent tusk]

that said like "minimum 14.4.2 partial version: 14.4"

and then full was null

[vivid nova]

your mom can swallow

[zealous bridge]

so?

[vivid nova]

your mom.. dunno 'bout that

[lilac wren]

Ty

[zealous bridge]

incremental means incremental software update

[silent tusk]

yes but maybe incremental is incremental from latest base 14.x version?

idk

[zealous bridge]

It is

[silent tusk]

but ig its been a long ass time

since that has been needed

[zealous bridge]

But that doesnt mean you have to upgrade to the base version

[low summit]

Froggy where the link to fr gui

[lilac wren]

http://FRGUI.cf

[low summit]

Go check out genius bar lol

[lilac wren]

It's in my name lol

Oh ok

[low summit]

They stuck in recovery

After ota

[lilac wren]

Azure pushed update erroring out immediately... Is it just me?

As soon as I click download

[zealous bridge]

Reboot

[lilac wren]

True lol

[low summit]

Won't work bro

[lilac wren]

Ok rebooted and 14.4.2 works ota

Time to try 14.4 again

Worked!! Tysm tanbeer

[zealous bridge]

np

[lilac wren]

Ok question, I quit it before it was going to finish downloading, but is there a way to cancel before it updates?

Force reboot when it says verifying update or something?

I think that'll be too late imo

Or maybe I just don't test it rn lol

[low summit]

Don't do it froggy

[royal flint]

you dont have to install immediately after download

[low summit]

U can't stop the jb

Restore I mean

[lilac wren]

Yeah but this is pushed from Azure, not sure if it instantly installs or not

Jamf pro has that option I think but idk if azure does

[royal flint]

i think its dependent on whether you have a passcode actually

[low summit]

Instant install imagine

[lilac wren]

Does anyone have a test device where 14.3 can show up? Don't need you to update, just try something simple

AKA this

[royal flint]

lol that's not gonna work

[lilac wren]

I know I just want to see if it blocks all updates

[royal flint]

that is good question

[lilac wren]

Bc console told me it was a zero day delay

[royal flint]

i can try on my 6+

[lilac wren]

Which isn't supposed to be possible either

[lilac wren]

Tysm

[royal flint]

send prof

[lilac wren]

Of what

[royal flint]

the 200 day delay profile

[lilac wren]

I just showed it

[lilac wren]

^

[royal flint]

yea i need the profile to be able to see if it works lol

[lilac wren]

Oh I'll DM you

[low summit]

What ur doing?

[lilac wren]

A test

[low summit]

Explain lol

[valid adder]

!t joe

[mystic axle]

joe

joemama

Added by Cryptic#6293 | Used 2 times · Apr 9, 2021, 5:10 AM

[lilac wren]

-_-

[low summit]

How the experiment go

[lilac wren]

Unsure results

Will work on it tomorrow

[vivid nova]

i do

[lilac wren]

Mind if you try tomorrow haha, about to go to bed

[vivid nova]

sure

[marble yacht]

im trying to save blobs using the non jailbroken method and shsh host says apnounce invalid format on my iphone 12 pro max

even tss saver conan says its invalid so you can't save blobs on a non jailbroken iPhone 12 Pro Max?

im on 14.4.1 on the pro max

does that change anything?

after trying for a few times i was finally able to save blobs

for some reason ApNounce keeps changing when i restart is this normal?

[vivid nova]

can't save @marble yacht

[marble yacht]

i did i was able to save my blobs

[zinc moon]

although it doesnt update, it DOES show up! send me the profile

[lilac wren]

I’ll DM you

Hm that may be interesting, are you willing to try spoofing version around in SystemVersion.plist?

Or you mean 14.4.2 sep because of FutureRestore?

Yes to which lol

Ah ok

Once I see the results of dabezt I'll lyk

[zinc moon]

@low summit hey man you online?

Doesn’t seem like it

[royal flint]

gm folks

whats new

[low summit]

What's up

[lilac wren]

Still testing the 200 day profile

[royal flint]

ah

yea i think my device may have been broken

even with a SystemVersion edit i still get 12.5.1

[low summit]

200 days goes to what firmware?

[lilac wren]

Oh lol weird

[low summit]

13?

[lilac wren]

That's what we wanna test with you one sec I'll make a gc

[green onyx]

gm

[lilac wren]

Gm!!

[green onyx]

WHAT

200 DAYS?

oh

[lilac wren]

Lol

Testing in progress rn lol

Lyk results later

[green onyx]

alright!

[unreal isle]

When fix this fdr error a11 device from 14.2 to down @valid adder

[green onyx]

u cant

just stop

1. dont beg for fixes, only report issues

2. it will never be fixed, i told u yesterday

[low summit]

Back from testing

[green onyx]

pog

what happened

[low summit]

Some profile to stop updates lol

[green onyx]

ye ik

@lilac wren did anything new happen?

other than update blocking

[low summit]

From what I gather u could change the delay to anytime lol

U could probably get any firmware

[green onyx]

hm

im mainly waiting on ipwndfu

but this is also exciting

[low summit]

Same

Ipwndfu uses what files?

Cat?

[green onyx]

uh, it can downgrade to any firmware if u have to blobs for it

i have 13.7 blobs ready to be used

[low summit]

Any blobs?

Including onboard and other stuff?

[green onyx]

well, onboards kinda broken

[lilac wren]

This is wrong lol

I'll lyk in a bit about to get vaccine

[low summit]

What happens when it's 200 days

[lilac wren]

It does 0 day

[green onyx]

YO POGGERS

this is pog

my parents still have yet to get theirs

[low summit]

I want mine

About to work soon

[lilac wren]

Yep I'm so excited lol

Hope it doesn't hurt

[low summit]

U might get fked up lol

The second one

[lilac wren]

Yeah I'm about to do first rn

Is the second a lot worse lol

[low summit]

Like a day it hurts or something

Might get a bit sick

[green onyx]

oh

wtf

that probably sucks

but its worth it

[low summit]

That's what prof said lol

Don't take it during finals LMAOOO

[green onyx]

LOL

[lilac wren]

Lol

[zealous bridge]

JAMF keeps tryna call me LMAOOO

[royal flint]

Lmfao

Apparently Jamf Now is free

[zealous bridge]

Should i pick up and say i’m switching to Intune

[royal flint]

does not look as featured as meraki tho

Lmao

nah

[zealous bridge]

jamf now is free

[royal flint]

yea

[zealous bridge]

did u sleep @royal flint

[royal flint]

ye

i don't feel like shit anymore

amazing

[zealous bridge]

oh nice

thats always good

[royal flint]

ye

[low summit]

Did you sleep @zealous bridge

[zealous bridge]

nah i just started doing my history essay at like 7

so i can get it out of the way

[low summit]

Damn school and testing?

[zealous bridge]

yeah im on break rn anyway

my school starts on Monday

fkin hate it man have to be at school for 12 hours a day

imma be fasting as well cause its Ramadan

[low summit]

12 hrs a day tf?

[zealous bridge]

yeah my skl is from 6am to 6pm

[low summit]

Uk sucks then

[zealous bridge]

Its private school

[zinc moon]

I love Ramadan

[zealous bridge]

Normal schools are like 7 hrs

[low summit]

Oh

[zinc moon]

Tanbeer did coocoo tell you

[low summit]

Private school sucks then

[zinc moon]

Abt the new OTA block

[zealous bridge]

Ye i just tested it

[zinc moon]

He made

It works?

[zealous bridge]

it works

[low summit]

Doesn't work without supervision tho

[zealous bridge]

but you have to have a jb to install it

[low summit]

That's kinda pointless

[zealous bridge]

or wipe device

[zinc moon]

@zealous bridge let’s test it on like 2 or more people

[low summit]

I already tested it

Works

[zinc moon]

But so far it looks like it works

[low summit]

Doesn't Ota disabler do the same thing lol

[zealous bridge]

and a lot better

[low summit]

Without supervision

[zealous bridge]

yeah

[green onyx]

wait what

jamf is free?

what

LMAO

[zealous bridge]

jamf now is

jamf pro isnt

[lilac wren]

Jamf now doesn't let you choose version

[green onyx]

ah

[lilac wren]

Already tried it

[green onyx]

rip

[lilac wren]

Before intune

[low summit]

What's jamf

[green onyx]

mdm

[zealous bridge]

mdm

[green onyx]

lol

[lilac wren]

Btw just got vaccine first dose

I don't like shots

[green onyx]

poggers

[lilac wren]

Waiting period now

[green onyx]

ur immune

[low summit]

Lol

[green onyx]

well semi-immune

[low summit]

Not yet

U need 2nd

[green onyx]

ah

[royal flint]

damn it why is storage always full on this thing

[green onyx]

6+?

16gb?

[low summit]

Se

[green onyx]

ah

[royal flint]

yup

[green onyx]

oof

my 6+ was 16gb

nearly impossible to use

[low summit]

16 fb was ass lol

[lilac wren]

Can't remove it if you forgot to get rid of it after updating

[green onyx]

i literally ran icleaner every hour

[low summit]

I had 32 since 4s i think

[green onyx]

this, and it also screws ppl over if they did

[royal flint]

i literally had to play app shuffle
uninstall one app to install another

[green onyx]

ota disabler doesnt even enable ota if u restore root fs, u have to manually delete the tweak with apt

[low summit]

But u need supervision for his profile lol

[green onyx]

yes but u dont need supervision to remove it?

[low summit]

And if u update without removing that then ur stuck to

[green onyx]

but it doesnt work without supervision

[low summit]

Supervision stays with updates

Lol

[green onyx]

yes but the profile doesnt work if u unsupervise

[low summit]

It will continues to work when you update

[lilac wren]

Remove supervision right after getting the profile

Still works

[low summit]

Since supervision doesn't go away

So u need to have a function to spoof supervision in ur tweak

[lilac wren]

Get rid of supervision then

[lilac wren]

It does

[green onyx]

wait it does

[lilac wren]

At least I think so, it worked for 90 day

[green onyx]

what if u reboot

[lilac wren]

Good question

I'll try rn

[low summit]

Lol

[zealous bridge]

it should work

as long as the profile is installed

but reliability in the long term hasnt rly been tested

like what if it randomly unblocks it

[green onyx]

does audioos or tvos beta profiles work?

https://betaprofiles.com/ios13/iOS_iPadOS_13_Beta_Profile.mobileconfig）#tvos14

[lilac wren]

Unsupervised, still works

[low summit]

Good

[pastel bluff]

Can I futurerestore an iPhone 11PM on iOS 14.3 while it's password locked?

I checked my blobs and apparently they're valid but I have never futurerestored before

will there be issues w apnonce or whatever

[zealous bridge]

you need to set generator

So no

[pastel bluff]

it's still jailbroken and it has ssh

could I do it like that maybe

[zealous bridge]

oh if you can ssh