futurerestore-help

[pastel bluff]

after I jailbreak again

[zinc moon]

You can’t rn so just restore it

[pastel bluff]

oh no ik

[zinc moon]

Don’t worry

[celest basalt]

Well taurine sets a default nonce

[pastel bluff]

yea but I don't think my blob matches it

or whatever

[celest basalt]

Is it the same as the one tssaver sets?

That's what I want to know

[pastel bluff]

I think it's different on iPhone 11

like custom

not really sure ?

@zinc moon

[zinc moon]

?

[pastel bluff]

^

[celest basalt]

Ah you're right, I'm thinking before A12

[pastel bluff]

I also cracked my screen today

first crack

so it's a bad day

[celest basalt]

Yeah damn man

[pastel bluff]

1yr no cracks and on the day I lose my jb it cracks

with a case on too

seems like a sign I need that new iPhone 12 glass lol

[celest basalt]

Well since you have to update you could trade it in for a 12

You'll be on the latest either way

[pastel bluff]

true

[zealous bridge]

@celest basalt 0xbd34a880be0b53f3

[celest basalt]

Alright thank you

[low summit]

@zealous bridge ipwndfu is new tech?

[zealous bridge]

no

[green onyx]

yes

well new? no

[zealous bridge]

ipwndfu is checkm8

[green onyx]

pog? yes

[low summit]

what is the intented purpose? downgrading or just pwn dfu

[zealous bridge]

ipwndfu was released when checkm8 was announced

[low summit]

what does it do downgrade?

[zealous bridge]

its inital creation was nothing to do with downgrading

but from pwndfu you can remove sep signature checks

[low summit]

lol for the infamous bypass?

[zealous bridge]

which is why its required for downgrading with odysseus

[low summit]

does it work with onboard blobs

to downgrade

[zealous bridge]

yes

[low summit]

so it keeps the sep and bb in the firmware

?

[zealous bridge]

It loads the sep from the firnmware

But its not checked for signatures

—latest-baseband is used

[green onyx]

ah and ipwndfu literally slaps it and tells it to load?

[zealous bridge]

yup

[low summit]

so if anything goes wrong will it bootloop u?

[zealous bridge]

Yes

[green onyx]

ye but u have blobs lol and ur A11-

[low summit]

then sep and bb ignore is kinda scary then

[green onyx]

nah

[low summit]

what if the sep is not compatible with the ios lol

it just skips then it fks with stuff

[zealous bridge]

doesnt matter

it wont break anything

Sep is sep

[low summit]

so u can use latest sep on 13.5 lets say

if u have the blobs

[zealous bridge]

Not latest sep

[low summit]

sep from the ipsw?

[zealous bridge]

yes

13.5 sep

[low summit]

ok

[green onyx]

very pog

[low summit]

thats cool tech then

[green onyx]

i honestly might stay on 14.3 tbh

[low summit]

same lol just asking

[green onyx]

taurine is more stable than odyssey

[low summit]

it works for onboard too tho

[zealous bridge]

i will definitely use ipwndfu

[green onyx]

lol

A13

[low summit]

so in case ppl update accidentally

[green onyx]

mhm

true

but onboards is fucked rn

like img4tool sucks ass

[fathom fox]

i saved my shsh2 for 14.3 when I used odyssey on 13.7

[green onyx]

good

what device?

[zealous bridge]

no they arent

[fathom fox]

but it always shows an error

[zealous bridge]

onboards are fine

[fathom fox]

its correct

[green onyx]

screenshot

[zealous bridge]

they work perfectly

[fathom fox]

not rn

[green onyx]

hm

[green onyx]

why?

[zealous bridge]

you just need to have ipsw updated

[fathom fox]

i have 14.3

[zealous bridge]

to the version ur on

[fathom fox]

ipsw

it is valid

[green onyx]

ok?

and

whats the error

i need to know the error

[fathom fox]

when i do -wait it always shows the same nonce

in the ipsw

[green onyx]

dont use -w

[fathom fox]

but it doesnt restore

[zealous bridge]

why are you using wait

lol

[green onyx]

yes because its not working

@fathom fox what device and ios version is it on?

[fathom fox]

i saved generator and shsh2 properly

[zealous bridge]

dont use -w

[green onyx]

so?

[fathom fox]

its an a12 iphone xs

[green onyx]

what ios version?

[zealous bridge]

fr without -w

[fathom fox]

14.4

[zealous bridge]

you cant use fr

[green onyx]

^

[fathom fox]

teh blobs work

[green onyx]

so?

u cant set generator

[zealous bridge]

need a jailbreak to use futurerestore

[fathom fox]

i set generator

[green onyx]

no u cant

[fathom fox]

when i was jbed

[green onyx]

yes, when u jbed

doesnt mean shit

[zealous bridge]

@fathom fox you can’t use futurerestore

[green onyx]

u have to set the generator RIGHT NOW if u want to use the blobs

[fathom fox]

oh ok

so no fr

[green onyx]

yes

no fr

[zealous bridge]

no fr

[fathom fox]

i need jb for fr? i can just probably pwn it

[green onyx]

yes u need jb for it

[zealous bridge]

yeah gl pwning a12

[green onyx]

wtf

[low summit]

someone needs to make nonce for non jb

[green onyx]

u cant pwn it lol

[low summit]

is that possible

[zealous bridge]

no

[green onyx]

nope

[low summit]

well fk

lol

[fathom fox]

wen pwnd dfu a12

[green onyx]

no

never

[low summit]

it might

[green onyx]

wait like 10 years

[fathom fox]

iphone x vuln came out in just 2 years

[green onyx]

no

it didnt

lmao

[low summit]

but it would be device specific bootrom exploit lol

[green onyx]

it came out 2 years ago

but from limera1n to checkra1n

[low summit]

no more shit like checkm8

[fathom fox]

what if pwned dfu mode worked on a12

[green onyx]

it was like 6 years

[green onyx]

it wont

[fathom fox]

well shit

why does apple do this

im switching to android

[green onyx]

ok

[zealous bridge]

K bye

[fathom fox]

bai

[green onyx]

android

couldnt be me lol

[fathom fox]

jk

im gonna wait for next jb

probably 1000 years

im switching to iphone 7

i need a home button

[zealous bridge]

k

they dont even have real home buttons

[green onyx]

true

the last phone to have a real one is the 6s/6s+

also last ones to have headphone jack

[low summit]

Isn't that bad honestly

Learn to use airpods

[green onyx]

im broke

[low summit]

Lol

Same

Still use airpods 2

[green onyx]

everything i use is wired

i dont even have airpods

my mouse is wired

my charging is wired

[low summit]

Bruh

[green onyx]

my earbuds are wired

[low summit]

What's ur main

[green onyx]

relying on battery fucking sucks ass

[green onyx]

wdym, phone?

[low summit]

Yes

[green onyx]

my X

[low summit]

bruh same lmao

[green onyx]

i fucking hate batteries

i like outlet better

[radiant mountain]

Can someone explain me why it’s so complicated or even impossible to downgrade SEP when it’s done easily from beta version to signed version ?

[low summit]

its honestly not that bad tho

it lasts like 3 hrs on one charge

u just charge at night thats it

[zealous bridge]

you don’t downgrade via ota

[dusty root]

Maybe dumb question but what is futurerestore

[low summit]

downgrading with blobs

a tool

[zealous bridge]

a tool that lets you restore to unsigned versions with blobs

[dusty root]

Thanks

[radiant mountain]

So SEP can be easily downgraded but only from restore through Finder/iTunes ? And those have to be signed right ?

[zealous bridge]

sep doesn’t really change from stable to beta

[valid adder]

@green onyx @zealous bridge if you see that annoying guy asking about fdr again let me know

[low summit]

the 14.2 guy?

[zealous bridge]

but yes you are correct

[zealous bridge]

ok sure

[radiant mountain]

Hmm ok. Is there a particular reason for OTA to not be able to downgrade SEP ? I know there’s 2 type of OTA, delta and full. I understand that delta is just a patch, but shouldn’t the full OTA be able to achieve that ? I’m really wondering as I found this subject interesting

[valid adder]

@lilac wren u as well

[lilac wren]

👍

[zealous bridge]

@radiant mountain good question, i’m also wondering the same thing, but a lot of this is just guess work. my theory is that it may have been possible to downgrade sep via ota because it did work for one person, but apple patched ota to not downgrade sep as soon as they realised that that was possible

but again all of this is guess work

[radiant mountain]

Hmm ok ok thx for clarifying things out. Kinda odd that Apple would have patched that so quickly, and after only one reported successfully downgrade tho

[lilac wren]

There was an error that meant apple didn't sign it right?

[zealous bridge]

true, but i can’t think of anything else

[zealous bridge]

which error

[lilac wren]

Unable to personalize right

[radiant mountain]

And I’m not trying to see if that could work for me as I’m on A13 and it will require editing system.plist, just wondering, that’s interesting

[lilac wren]

Denied to personalize for this device

In console

On OTA it just says connect to internet or something

[zealous bridge]

that means unable to downgrade sep probably

[lilac wren]

Yeah but we spoofed device firmware

So why does apple refuse to sign?

It doesn't know we're downgrading

[valid adder]

Remember how apple isn’t signing 14.3 rose, etc for a13 a14 @lilac wren

[lilac wren]

Oh I didn't learn this lol

[valid adder]

This is the exact reason futurerestore was broken for so long

On a13

[lilac wren]

So A12 can downgrade through OTA?

[radiant mountain]

Maybe system.plist isn’t enough ? You should sniff all device request to see what apple get from the device and what apple’s servers sends back ?

[valid adder]

Yes a12 can unless sep is an issue

[lilac wren]

And how come they can still upgrade to 14.3 just not downgrade

[valid adder]

A13 a14 will need hacks to use 14.4.2 firmware updater components

[zealous bridge]

it wont work if sep is too high

[valid adder]

Yep

Correct

[lilac wren]

I can't find any info on what rose is, can you link anything

[valid adder]

No idea

[zealous bridge]

it’s a firmware

[lilac wren]

Oh

[zealous bridge]

don’t know much more than that

[valid adder]

It’s an a13/a14 and t2 Mac feature but SE2 does not have rose despite being a13

@lilac wren

[lilac wren]

Oh hm

[valid adder]

Just check my commits

I fixed it by falling back to latest if 14.3 tss fails

[green onyx]

aight

[low summit]

hes gonna come in the morning again

didnt u yell at him already @green onyx

[green onyx]

which

[low summit]

fdr

guy

[green onyx]

hes gone

for now

this morning? i think so

[low summit]

watch him come back tmr

[green onyx]

#futurerestore-help message

this guy?

[low summit]

yea lol

[green onyx]

there are multiple ppl that beg for fdr

[low summit]

tf he pinged cryptic

[green onyx]

ye lol

[low summit]

i think cryptic was talking about him

[green onyx]

probably lol

there was another dumbass on github like last week

begging for fdr smh

was pretty funny ngl

[low summit]

i remember it was the morning guy lol

he came 2 days in a row

[green onyx]

thats true

but what i said this morning shouldve been enough lol

ngl, nowdays, nobody is using fr

[low summit]

ull be surprised bro

ppl dont give up

[green onyx]

ppl who do are on 14.4+ A12 or dont have blobs

[low summit]

because ota is a thing

[green onyx]

lol

[low summit]

still cant believe im on 14.3

why couldnt they discover this sooner lol

[green onyx]

[low summit]

2 years late to dark mode lmao

[lilac wren]

Oh that's right

Wow why did you not go to iOS 13

[low summit]

activation error lol

i was afraid

now i feel like a dumbass lol

[lilac wren]

Maybe not in this channel but logs have been active as ever lol

And nowadays = past 2 days only? Lol

[green onyx]

99% are exit recovery

and like the 1% is like martin

[lilac wren]

They're really not

[green onyx]

lol ik

its an exaggeration

[lilac wren]

I'll do an audit if you want lol

[low summit]

lol froggy not even member pro

[lilac wren]

I'm 29 ok

[green onyx]

sad

[lilac wren]

Just gotta keep talking

[green onyx]

ur almost there

[lilac wren]

Fine you know what

I'll get developer

And be orange

:(

[zealous bridge]

wow betraying us like that

I see how it is

[lilac wren]

O_O

When was the last signed jb

13.4?

Or 13.5 right?

[zealous bridge]

13.5 was the last 0day yes

[lilac wren]

Untrue

I made a 0 day

0 day delay profile 😎

[low summit]

Froggy should just get promoted to dev or something

Lol

[lilac wren]

Lol in reality idc about the dev role

As long as I'm helping others

[zealous bridge]

[lilac wren]

What is the :fr: emote from

I thought it was Mike Wazowski face swap

[zealous bridge]

what

[lilac wren]

What is it

This ^

Is it a tennis ball with a face

Or a sesame street puppet

[green onyx]

froggy has a point

[zealous bridge]

Fr. noun [ before noun ] written abbreviation for Father when used as a title of a Christian priest, especially a Roman Catholic or Orthodox priest: Fr.

[green onyx]

[zealous bridge]

https://youtu.be/d_rongCrYOE @lilac wren its from here

[green onyx]

froggy has 400xp to go

[zealous bridge]

🐸

[lilac wren]

How many messages is that lol

[zealous bridge]

40

[lilac wren]

Oh ok

1

[zealous bridge]

40-400

[lilac wren]

2

[zealous bridge]

anywhere from there

[lilac wren]

3

Jk jk

[lilac wren]

Were you joking

I just watched the whole thing

And didn't see it

[zealous bridge]

yes

[lilac wren]

You were

Wow

I feel dumb lol

[zealous bridge]

[lilac wren]

[green onyx]

300xp for froggy

[low summit]

Froggy for dev

[green onyx]

true

[zealous bridge]

froggy ford ev

[green onyx]

froggy and tanbeer forge nius

[low summit]

Froggy Mustang Mach e

Tanbeer needs advanced dev tag

[zealous bridge]

Tf is an advanced dev

[green onyx]

idk but it exists

hayden has it

CS and uroboro have it

[low summit]

Tanbeer definitely advanced lol

[green onyx]

true

[low summit]

Binger has it too

[zealous bridge]

JTV too

[low summit]

Really?

Genius surpassed advanced?

[zealous bridge]

Prob

[low summit]

@void rapids should be owner

[green onyx]

TRUE

actually facts

@void rapids

whos this apple

[green onyx]

we both pinged the wrong guy

[low summit]

Idk lol

[green onyx]

@split torrent this is the real apple

[low summit]

Where the other one

[green onyx]

omg

the pfp isnt even centered

lol

[zealous bridge]

@split torrent lol

[split torrent]

Fr

[green onyx]

[zealous bridge]

Oh shit it isnt

[low summit]

Oh shit apple

[zealous bridge]

[green onyx]

apple really be slacking

yes

lol

LMAO

wait

JTV exposed

[split torrent]

I own ur mom

[green onyx]

[lilac wren]

Lol wait how

[green onyx]

wait what

apple deleted their msg

[lilac wren]

Wow

[green onyx]

what tag?

@lilac wren

[celest basalt]

!t fwjson

[mystic axle]

fwjson

download this file from a browser: https://api.ipsw.me/v2.1/firmwares.json/condensed (right-click, Save as), rename it from "condensed.json" to "firmwares.json", then put It in C:/Users/username/AppData/Local/ Temp
By: Tanbeer#4750

Added by Cryptic#6293 | Used 14 times · Apr 2, 2021, 5:11 AM

[green onyx]

oops

i thought u were froggy lol

[celest basalt]

what=getting keys failed with error: 13697039 (failed to get FirmwareJson from Server). Are keys publicly available?

I saved to /tmp/firmwares.json but it still says this

[green onyx]

dont use windows

[celest basalt]

bruh this is Linux

since when does Windows have /tmp

[zealous bridge]

/tmp/futurerestore/firmwares.json

[celest basalt]

ah

[green onyx]

fix tag lol

[zealous bridge]

yes because im a genius

also thats for windows

[green onyx]

lol u should be genius

[zealous bridge]

didnt add the linux one

[celest basalt]

is it just Temp on Windows or Temp\futurerestore

[green onyx]

just temp afaik

[zealous bridge]

^

blame futurerestore for the inconsistency

[lilac wren]

Yes

Quality of a tool always depends on the nature of the user

Does checkra1n work on this iPad

A5-A11 right?

Or is that really off

[zealous bridge]

right

[lilac wren]

I've never used it before

[zealous bridge]

but checkra1n is 12.3+

[lilac wren]

Oh ok it's good then

Any other checkm8 jailbreaks?

Not odysseyra1n

[zealous bridge]

Fugu?

[lilac wren]

Oh that's cool

I like open source

[zealous bridge]

Tf is the point

[karmic marten]

Anyone have success downgrading from 14.4.2 to 14.0.1 on A13 or a similar downgrade? Trying to rectify a shitty situation but I’m not looking to waste a few hours to just have to restore my iPhone if there’s no shot of it working

[celest basalt]

not possible, you would need a jailbreak to even modify the SystemVersion.plist but even then thr SEP seems to reject downgrades

has editing the systemversion.plist been confirmed working?

[zealous bridge]

not working

[celest basalt]

Is it possible to futurerestore from 14.4.2 to 14.0-14.4

[zealous bridge]

what device

[celest basalt]

11 pro

[zealous bridge]

you need a jailbreak to use futurerestore

so no

[celest basalt]

i lost my jailbreak due bootloop 😦 im dying here

[zealous bridge]

rip

[celest basalt]

now i need to wait again for new jailbreak

[zealous bridge]

just dont upgrade

[celest basalt]

no i will stick with 14.4.2

[zealous bridge]

ok good

[celest basalt]

who knows it can take along time for it to be released

14.14.3 is still new

[zealous bridge]

14.14.3 yes

[celest basalt]

14.4.2 maybe after summer

[green onyx]

what did i miss

ah

nvm

[green onyx]

what happened?

[radiant mountain]

Could it be possible to achieve that without editing SystemVersion.plist but rather modifying the request/response made when going on "Check for update" ?

Modifying the request had allow me to get the 14.5 beta 7 OTA to download, without having the Apple beta profile. I know downgrading is a step above tho', but those .xml you got could perhaps be manipulated to obtain some positive result

[radiant mountain]

Probably restore backup with a made while jailbroken one after the OTA update

afaik that one of the only case where you can bootloop after following the steps in annoucements

[celest basalt]

good question, the problem is if we can't even reliably downgrade A11 by modifying the plist then there's even less chance for A12+

[lilac wren]

You were able to modify the response? What proxy did you use (if any) and is there an XML format you have? I've tried to get the response myself but it seems that the phone recognizes that I'm sniffing and stops.

[radiant mountain]

Didn't managed to get the response, only switch the request url, yeah the response seems obfuscated, but I believe it just get all the mesu/assets/... then the device parse it to know what to do depending on the said .xml

[radiant mountain]

Im using Burp Suite to do that, that's the only sniffer i know lol probably not the best for iOS stuff idk

[radiant mountain]

Yeah ofc, was just saying.. Downgrading is indeed something else than just spoofing some strings. Do you know if any tests have been made on other proc than A11 for downgrading ? It may be A11 related only ? 🤷

[lilac wren]

you swapped out the XML file from this URL, right

https://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml

[green onyx]

14.3 devices on A11 have 14.4+ sep?

[radiant mountain]

From what I've understand, there's no "response" as the get seems to be 'as it is'. When you go on 'Check for update', a GET/ is made, retrieving a big ass XML containing all OTA possibilities for every device, then the device parse it to know if there something for itself. If thats the case, it does a 2nd GET/ to get OTA's files. So what I did is switching mesu/assets/... to mesu/assets/iOS14PublicSeed then my device (supposedly) parsed the xml, saw that there was indeed an upgarde available, then device made a 2nd GET/ request on http://updates-http.cdn-apple.com/..., that maybe could be modified to get whatever OTA files ?

[green onyx]

ye the xml is the index

the one froggy linked is the xml file it retrieves

[radiant mountain]

i know

Big ass xml

[green onyx]

true

[radiant mountain]

Made my browser load for 5 minutes

[green onyx]

lol

[radiant mountain]

What im saying is, there's probably no xml in the response bc it got the whole xml, then parse it on device

[lilac wren]

thanks so much! How did you know that iOS14PublicSeed was a valid URL?

[radiant mountain]

By installing the profile in the first place and did the same manipulation

[lilac wren]

ah makes sense

[radiant mountain]

I saw that instead of looking in assets it was doing in assets/iOSetc

[green onyx]

azzou big brain

[radiant mountain]

iOS13PublicSeed is a thing too

[lilac wren]

#Azzou forge nius

[radiant mountain]

And im curious to see where does it look for while being supervised with the differed profile 🤔

Didnt bother myself for another data wipe on my device to test it out...

What I want to try is:
1st request: tell device to look in iOS14PublicSeed -> it get a OK for update and proceed the 2nd request
2nd request would download the OTA files -> swap the orignal iOS14PublicSeed request by the one made when ur supervised with deferred profile to maybe got the 14.3 OTA ?

[lilac wren]

why not just change 1st request to an XML file with iOS 14.3 OTA

[radiant mountain]

And for the record im far from being a genius.. Im a dev, use to jailbreak my device since limera1n, and still managed to bootloop with the OTA method, while all kids in the world are enjoying Taurine

[lilac wren]

still smarter than 99% of the members of this server

[radiant mountain]

Because I believe (not sure) that the parsing is made on device. So it will compare that XML with the ios version (probably in SystemVersion.plist) and won't proceed in the 2nd request since it's not an upgarde

[celest basalt]

the managed/supervised update request includes a BCert generated by the SEP which is tied to the device and the version you're updating to

this is something that isn't needed with regular non-delayed updates

[radiant mountain]

Those request are probably made in different function or something ? Like version is checking if there's an update, 2nd one is get that update. I guess if you get/ on http://updates-http.cdn-apple.com (wheres ota files comes from) on the 1st request, you will end up with some error message like "Unable to retrieve update, try later". Didnt tried it tho

[radiant mountain]

How does Apple servers know if the BCert is valid or not ?

[lilac wren]

I'm trying right now and... it doesn't seem like mesu even comes up while supervised... maybe I'm doing something wrong

it's only gdmf

[radiant mountain]

Time to wipe my device, ill try too

[lilac wren]

👍

[radiant mountain]

Fresh install bc of the bootloop so np

[lilac wren]

ah lol

[celest basalt]

I don't know if the server verifies it against some Apple key, but the cert also includes a SepNonce which changes on every request so that basically prevents a full OTA replay attack

you can replay the request to save OTA blobs that can be used on A11 and lower in PwnDFU (useless on A12 and above), and pair it with a signed SEP in futurerestore, but the actual OTA process itself cannot be simply replayed on-device since we can't set the SepNonce

[radiant mountain]

Yeah, my thought are that, maybe just maybe if the .xml are manipulated correctly, there will be no need for blobs or whatever since Apple would allow the upgrade/downgrade

[lilac wren]

I can't get mesu software update xml url to retrigger, I'm unsupervised now as well...

[radiant mountain]

Cant sniff while being supervised ? That's weird..

[valid adder]

!t joe

[mystic axle]

joe

joemama

Added by Cryptic#6293 | Used 4 times · Apr 9, 2021, 5:10 AM

[lilac wren]

I can sniff just mesu not appearing in the list anymore

unsupervised myself as well

[valid adder]

Noob

[celest basalt]

yeah I think mesu is over HTTPS, actual OTA zip download and TSS is cleartext

[lilac wren]

love you too cryptic

[valid adder]

Ez fix

[radiant mountain]

Burp can sniff https

[celest basalt]

but clearly mesu is possible to MITM because people have done it on Apple TV

[lilac wren]

i managed to get that XML though even if it was over https?

oh because i did it from

nvm

im dumb

[celest basalt]

some of the requests cannot be decrypted even with SSL Kill Switch, but some can

[lilac wren]

i just saw the request url and did it on my computer, don't think I actually received the XML

but I can't see that request anymore

[radiant mountain]

Btw Froggy you are the one behind the discovery of that OTA method ?

[celest basalt]

if you see the full URL with HTTPS and not just the hostname then it is decrypted

[lilac wren]

eh one of the three, everyone who has 90 Day Delay profile installed doxxed me bc my computer name is on there -_-

[radiant mountain]

oh oops lol

[lilac wren]

Lol that was my fault

dont go looking

[celest basalt]

yeah I saw it

[lilac wren]

wow

[celest basalt]

anyway odysseyra1n gang until I get futurerestore pwndfu downgrade to 14.3 working

[radiant mountain]

Thats really cool to see new unconventional technics like that, you guys are true big brains to think different like this lol

[valid adder]

I’ve https sniffed every part of iOS some urls are ssl pinned by the kernel mesu is not pinned by kernel only daemon pinned @lilac wren

[celest basalt]

gonna sleep now though

[lilac wren]

Lol poor Apple

I actually see mesu again with a different client, but it's very empty

CONNECT mesu.apple.com:443 HTTP/1.1
Host: mesu.apple.com
User-Agent: nsurlsessiond/1209 CFNetwork/1209 Darwin/20.2.0
Connection: keep-alive
Proxy-Connection: keep-alive

and doing that request through cURL doesn't work

[celest basalt]

that's just the CONNECT, it's not decrypted

[lilac wren]

I can't simulate this request?

[celest basalt]

no because you don't have all the details, only the hostname

[valid adder]

It’s pinned by the daemon @lilac wren

[celest basalt]

you can try [[ios ssl kill switch]] I don't remember if it works for mesu

[mystic axle]

iOS SSL Kill Switch

Blackbox tool to disable SSL certificate validation - including certificate pinning - within iOS Apps.

Author

Alban Diquet

Version

0.6-1

Price

Free

Repo

Thireus Repo

Bundle ID

com.isecpartners.nabla.sslkillswitch

More Info

Click Here

Thireus Repo • Page 1/1 · Apr 10, 2021, 1:18 AM

[lilac wren]

oh wow

[celest basalt]

there is a v2 on julioverne's repo

[lilac wren]

how did I just get this url before though

[celest basalt]

unrelated: I tried to re-enable OTA updates on a Corellium device just for fun but no luck so far

[lilac wren]

Corellium devices have OTA default disabled or wdym

[celest basalt]

yes

[lilac wren]

are they real or just super well emulated?

[celest basalt]

the daemons are disabled and mesu etc are blocked in the hosts file

[lilac wren]

oh wow

[celest basalt]

the latter

[lilac wren]

I figured out how to get the mesu request again

enable ssl proxying for gdmf

sometimes it works sometimes it kicks you out it seems?

time to get the xml for supervised

also enabled ssl for mesu

it also gave me this url

https://mesu.apple.com/assets/com_apple_MobileAsset_SoftwareUpdateDocumentation/com_apple_MobileAsset_SoftwareUpdateDocumentation.xml

goes down as low as 13.1.2

ah I think I figured it out? maybe? Supervised = no seeing SSL; Non-supervised = able to see those requests?

[celest basalt]

doubt it

[lilac wren]

ok it's jank then

will try the kill switch

[valid adder]

@lilac wren disable ssl pinning in the daemon

yes kill switch should work fine with ssl proxy profile

[lilac wren]

idk how to do that manually? So i'll try this kill switch bc I'm dumb

[valid adder]

just use the tweak

I use charles proxy it lets me install a profile on my iPhone

then I trust it in general > about > certs

[lilac wren]

kill switch works fine

yep using charles

[radiant mountain]

There's a lot of URL like this requested just by looking for an update..
http://mesu.apple.com//assets/com_apple_MobileAsset_SecureElementServiceAssets/com_apple_MobileAsset_SecureElementServiceAssets.xml
http://mesu.apple.com/assets/com_apple_MobileAsset_EmbeddedSpeech/com_apple_MobileAsset_EmbeddedSpeech.xml
http://configuration.ls.apple.com/config/defaults?os=ios&os_version=14.3&hardware=iPhone12,3

No idea of what they are used for tho

OTA's file are then downloaded from there
~~http://updates-http.cdn-apple.com/2021WinterSeed/mobileassets/001-87156/EF769EC2-3A75-442D-9E58-3075CC35963B/com_apple_MobileAsset_SoftwareUpdateDocumentation/b28342f521dd6aca84791f77372a24c7e65f7666.zip~~ that one is not valid, ill get the valid one

That's the Beta 7 if im not wrong

Im wondering if they are tied to a device like does '001-87156' or 'EF769EC2-3A75-442D-9E58-3075CC35963B' are device specific or just general path

[valid adder]

Looks like just file udids

[radiant mountain]

the .zip name at the end are probably the same as the one on ipsw.me

[lilac wren]

mesu is gone again... on both proxies this time

I wonder if it caches the XML available updates or something?

[valid adder]

It’s probably cached lol @lilac wren

[lilac wren]

ok will reboot userspace

[radiant mountain]

Hmm thats weird... Without having the deffered profile, I can't sniff anything while being supervised...

Even tho all restrictions are disabled

[lilac wren]

if you have the deferring profile it lets you sniff SSL without the kill switch tweak?

[radiant mountain]

"Impossible to check for update", even without the proxy

[lilac wren]

I think it's just jank lol

[lilac wren]

this is probably the proxy though

and i still can't get mesu

what is this https://gdmf.apple.com/v2/assets

it's just a jumble of text

oh it's b64

[radiant mountain]

Look like a JWT

bc of the 2 dots

[royal flint]

it is base64 separated by dots

[royal flint]

and what you will end up decoding it to is invalid request method

what are you trying to do, maybe I can help

I've screwed with pallas a bit

[radiant mountain]

lmao what you got is just the JWT, saying acces denied

[lilac wren]

nothing specifically, I just want mesu back so I can see what a deferred request looks like and map that into an unsupervised

[royal flint]

deferred request for ota links?

[lilac wren]

well the mesu XML

ive got the regular one now just need the deferred

[royal flint]

because the mesu xml is not what gives ios the links to deltas

[lilac wren]

someone did it with a TV

so i'm just going to recreate it for iOS

gtg shower but I'll work on it after or tomorrow

[radiant mountain]

http://updates-http.cdn-apple.com/ is the link to the deltas right ?

[royal flint]

yes but the key link y'all are missing here is pallas

[radiant mountain]

pallas ?

[royal flint]

gdmf.apple.com

[lilac wren]

nah pallas unnecessary

I'm going to be happy if this works bc the last trace of it I see was from iOS 13

[royal flint]

so the mesu request is switching between http and https?

[lilac wren]

Currently have 2 different methods for getting iOS 14.3 after April 26th, this is the second. Will release then if it works

[lilac wren]

Nah mesu just doesn't request sometimes it seems lol

[royal flint]

ah

assuming it's https then

[lilac wren]

Ah ok found the mesu cache

This should work but I'll test after I shower, it's about to be 10 pm lol

HEY I'M PINK

YAy

[royal flint]

east coast gang

nice

[lilac wren]

Nice me you and phonerebel

[radiant mountain]

I cant manage to sniff any settings request while being supervised, even tho im doing the exact same thing that when i wasnt.. Safari request are sniffed as normal, but not the check for update..

[royal flint]

aight here we go again

[radiant mountain]

Now that you here, what do you think of this ? #futurerestore-help message

[valid adder]

what I miss

@lilac wren

[lilac wren]

Nothing I went to shower but did find the mesu cache

[lilac wren]

Apple services will fail any connection that uses HTTPS Interception (SSL Inspection). If the HTTPS traffic traverses a web proxy, disable HTTPS Interception for the hosts listed in this article.

If you jailbreak you can bypass this

[valid adder]

someone gave me a bizarre idea may fix fdr

[royal flint]

i forgot you could do this

[lilac wren]

Don't say it out loud O_o you never know what eta kids will be watching

[valid adder]

wasn't planning on saying how

[radiant mountain]

But why does that only applies to supervised and not unsupervised ?

[lilac wren]

I think it applies to all? Or can you confirm it's only supervised? Bc I think it's just being very janky sometimes

[royal flint]

my cable has the stupid, nice

[radiant mountain]

Yeah yeah, I was sniffing through https, thats how I found about iOS14Seeds etc

But after I wipe then supervise my device, i cant sniff shit

[royal flint]

what tweak to bypass cert pin again

[radiant mountain]

Im using a trusted certificat like DhinakG shown in his screenshot, that allow https sniffing. It works on every request made by safari, http and https, but not the one made in the settings app

[lilac wren]

Yes bc of what I just sent up above

Try unsupervising and sniffing, see if you can

[lilac wren]

This

mesu.apple.com is an apple service

[royal flint]

If you jailbreak you can bypass this
but how

also where is mesu cache

[radiant mountain]

I tried that, it worked fine. I wanted to sniff while being supervised, to see the get url

Guess i cant if not jailbroken ? Or maybe there a param i need to modify in the proxy

[lilac wren]

Ik same happened with my, I unsupervised and sniffed and it continued to not work. Which is why I'm saying it's jank and not based on supervision. You should try it though

[lilac wren]

Either try messing around with it or jailbreak and use kill switch

[radiant mountain]

A13 14.4.2

[royal flint]

found cache location

[lilac wren]

already was found lol

[royal flint]

i asked and you didn't tell smh

[lilac wren]

then you need to just see if you get lucky IG, do some more control tests

[lilac wren]

where did you ask

[royal flint]

^

[lilac wren]

oh i see here

[celest basalt]

Hi, can someone confirm that if I have my blobs saved that I can update my phone to 14.3 - i have an iphone 12

[lilac wren]

what version are you on rn

[celest basalt]

14.2.1

[lilac wren]

and you have valid blobs? I don't think you can

when did you save them

[celest basalt]

urgh

28/02/21

[lilac wren]

were you jailbroken when you saved blobs

[celest basalt]

yes i believe so

they are valid, i checked

[lilac wren]

with what

[celest basalt]

i think i was still on u0

at that time

[royal flint]

to confirm, it's located in /private/var/MobileSoftwareUpdate/MobileAsset/AssetsV2?

[lilac wren]

yes and then the one with the list is at com_apple_MobileAsset_SoftwareUpdate

[celest basalt]

i restore rootfs so that i could use the ota method and then realised it doesnt work on A14

[royal flint]

[lilac wren]

iOS 14.3 blobs you saved in February? Wasn't it unsigned

[celest basalt]

wait nvm

im actually gonna go and cry

[lilac wren]

Ok

:(

[celest basalt]

i realised what I was doing wrong

[lilac wren]

Finally I can change my nickname

[celest basalt]

IG im just stuck on 14.2.1

[lilac wren]

Lol how did you even get that blob

[celest basalt]

Could be worse IG

[lilac wren]

What tool

[celest basalt]

https://verify.shsh.host/

[lilac wren]

No to get the blob

[celest basalt]

This thing

[lilac wren]

Rip

[celest basalt]

blobsaver

[lilac wren]

Blobsaver needs some better warnings

[celest basalt]

14.4 works though

[royal flint]

@lilac wren the dir's being recreated but i see 0 requests in my mitm

oh assets are empty

[lilac wren]

yeah it still won't make a request to mesu for me :/

i wonder where it's getting the xml from then

[royal flint]

wait

could this just be a difference of supervision

[lilac wren]

we can try that

I'll unsupervise

[royal flint]

oop

remember kids, don't cat a binary

lol

[lilac wren]

lol

ok unsupervised

time to try

no mesu

[royal flint]

hmmmmmm

[lilac wren]

hit every mesu but the one we want

lol

[royal flint]

lol

[lilac wren]

@zealous bridge r u here

[valid adder]

I am

[lilac wren]

ok then cryptic

do you know how to get mesu to fetch a new xml

[valid adder]

Will look soon

Might take a nap

[lilac wren]

love you

[valid adder]

[royal flint]

probably stupid but has anyone thought about reversing

[valid adder]

Already have

Never looked at the actual request side tho

[lilac wren]

I should probably go to bed

I'll figure it out tomorrow I guess

[valid adder]

pussy

[lilac wren]

wow

[valid adder]

lmao

[lilac wren]

:P

lol why does rejailbreaking move my xcode previews outside a folder every time

it's literally just that app

no custom springboard layout or folder tweaks either

no icon layout or flashback or whatever

[radiant mountain]

Froggy do you believe that the host may be swaped while sniffing a request ?

Like... could a request be redirected to another host instead of mesu ?

If so, we could give to the device some bullshit .xml that will allow us to do whatever we want with it

[low summit]

Anything I miss

[lilac wren]

Doubt it

[lilac wren]

Oh wait I see what you mean

Yes this is exactly what we're trying to do... Lol

Like I said it's been done before with an Apple TV to some ios 13 version so I'm trying to replicate it on iOS

But we need the phone to fetch from mesu to get our own xml file

If it uses some cache then it's not going to ever fetch mesu / our xml

[low summit]

Are ppl future restoring again?

[lilac wren]

Eh kinda

[radiant mountain]

Lol shouldnt you go sleep or something ? U crazy madlad

[low summit]

I miss helping ppl with fr lol

[radiant mountain]

(its 5am for me tho)

[lilac wren]

I'm about to haha, in bed on Discord mobile :P

[low summit]

Ur in the UK?

[lilac wren]

Lol why are you awake, stayed up late or woke up early

[low summit]

Tanbeer lol

Same shit

[lilac wren]

@zealous bridge just so you're not confused I was gonna ask if you could ask that group chat / siguza if there's a way to force devices to fetch from mesu... But that's probably a dumb question for them lol so nvm

[radiant mountain]

late late

[lilac wren]

Rip

[radiant mountain]

About the supervised issue where you can't sniff, maybe it's related to https://support.apple.com/en-us/HT210176 ?

[low summit]

It's only 11 not too late

[lilac wren]

I just posted it twice remember

[lilac wren]

Here

[lilac wren]

Charles and proxyman both have fine certs

Idk what you're using but it's probably fine too

https://support.apple.com/en-us/HT210060

[radiant mountain]

Mine seems not valid in fact...

Above the 825 days limites

Nevermind, it should be good

[lilac wren]

Oh lol

I recommend proxyman btw if you have a mac

[radiant mountain]

Im use to Burp Suite, used it time by time in the past

Additionally, all TLS server certificates issued after July 1, 2019 (as indicated in the NotBefore
So mine is valid since it's have been issued before

[royal flint]

do we know what exactly is making the request to mesu

[radiant mountain]

What do you mean ? in iOS ?

[royal flint]

yes

[radiant mountain]

Entering the "Check for Update" View will make a call to mesu, fetch the whole .xml, then on device, proceed to some parsing to know if there is a valid .dict to upgrade to, and if so, create a request as specified in the parsed .xml to fetch OTA's patch/full

[royal flint]

nah that's not specific enough

[radiant mountain]

So I guess the request is creating somewhere here https://developer.limneos.net/index.php?ios=13.1.3&framework=SoftwareUpdateCore.framework&header=SoftwareUpdateCore.h

[royal flint]

i'm looking for frameworks in the dyld cache

o

haven't looked at that framework yet

[radiant mountain]

Worth a try 🤷 You can look at every headers with SoftwareUpdate or SU in the name

[royal flint]

nope nothing with mesu.apple.com nor MobileAsset_SoftwareUpdate in there

[radiant mountain]

I don't think that those value will be in plain text

[zealous bridge]

would that even work

[radiant mountain]

Just like the request for OTA files is not, it's created by fetching the XML

[zealous bridge]

since the firmware needs to be signed by tss

for the device to even load it

[radiant mountain]

Does it ? How can we upgrade to 14.3 then ? 🤔

[zealous bridge]

because apple is signing it

[radiant mountain]

Then if the firmware is signed, what the problem ?

[zealous bridge]

it’s only signed for supervised and managed devices

[royal flint]

in the extracted frameworks they would

[radiant mountain]

And every device could be supervised, no big deal

[radiant mountain]

Not if he got those value from a method like "parse_some_xml_in_cache()" ?

If those value are gotten at runtime, they wont appear in the framework right ? You the big brain you tell me

[royal flint]

yea, that's also why i've been grepping the fs

if they're in a plist or plain text file, even in a binary plist, it'll show up in grep

[radiant mountain]

Hmm... I guess those value aren't in this framework.. There's a lot with SU or SoftwareUpgrade tho, might check the others

[zealous bridge]

i really don’t get how this would work if we can’t get the firmware to be signed by tss

@royal flint can you explain

[radiant mountain]

SoftwareUpdateCore could only be the manipulation stuff

[royal flint]

blobs dont expire correct?

[zealous bridge]

they dont, theyre just backups of signatures

[lilac wren]

Because it is signed

[royal flint]

i dont know exactly either but i'm guessing you could use this as a replay - get tss response, fail the update, and then update at a later date

[zealous bridge]

then why would we need a bs .xml file

[lilac wren]

To specify 14.3

[zealous bridge]

we can do that normally can’t we

[royal flint]

i'm still not convinced mesu xml does stuff

[lilac wren]

April 26th

[zealous bridge]

ohhh i see

why dont you just backup the .xml that you get now instead

[lilac wren]

Like I said it worked for someone on apple TV so

[royal flint]

¯_(ツ)_/¯

[lilac wren]

Because I get only 14.4.2 non supervised

[royal flint]

bro what the hell is downloading this file

i cannot find it

[zealous bridge]

yet apple tv doesnt have bcert

[lilac wren]

There's no mention of bcert in the file

[royal flint]

i'm literally just extracting every framework at this point

[zealous bridge]

so supervise and spoof?

[zealous bridge]

bcert will tie the signature to that version so it becomes harder to manipulate

[lilac wren]

Yeah but issue is device isn't making any requests to mesu anymore, even unsupervised now. Super jank

[lilac wren]

This has nothing to do with signatures

It only works if it's signed

[radiant mountain]

Could be in no frameworks too... From sniffing earlier, I believe that I remember some GET/ on some .xml or whatever when device is booting and connected to wifi/network, could be in those ?

[zealous bridge]

Thats not my point, it does have to be signed, but you can’t manipulate the version without having some signature to even load it

which apple tv doesnt require iirc

what ur saying may be possible tho

[lilac wren]

I mean maybe but all we're doing is removing 14.4 14.4.1 and 14.4.2 from the xml

I don't see how that would mess with signatures

[zealous bridge]

So you also need your delayed OTA blobs for this?

[lilac wren]

No blobs

It's signed

[zealous bridge]

Not after 26th April

[lilac wren]

It's still signed after 26 April

[radiant mountain]

I don't believe you even need to do that, easier would be a fake .xml that would have key to a beta version or a fake ass 14.4.99 version, and then specify a 14.3 OTA's file urls in the correct key of the said .xml. Device will parse it, see that 14.4.2 < 14.4.99, then create a request to download the OTA files, that are signed if device is managed.

[lilac wren]

Just not accessible

[zealous bridge]

the DelayPeriod field inside pallas request will make sure that it’s not reaching tss

[lilac wren]

Ah that's a smart idea too

[lilac wren]

Don't think we need a delay period either

[zealous bridge]

yes you do

[royal flint]

don't need a delayperiod for what

[radiant mountain]

Like I said, most of the work is probably done on device, so manipulate the .xml could be very powerful

[royal flint]

getting stuff from pallas?

[zealous bridge]

pallas request

[royal flint]

you need a delayperiod

[lilac wren]

And what you're saying apple TV has no delay period

[zealous bridge]

you also cant have one above 90

[royal flint]

bruh idk anything about apple tv

[lilac wren]

Fine then no delay period, just supervised

[zealous bridge]

no apple tv doesn’t require the signature, you can just edit .xml

[zealous bridge]

again, how would you get 14.3?

without delayperiod

[lilac wren]

It's signed and would show up in the xml

Again we can't really test until mesu decides to work again

[zealous bridge]

we wouldn’t be able to get it signed without delayperiod lmao

[lilac wren]

DelayPeriod isn't necessary to do OTA

[zealous bridge]

^

[royal flint]

if you want to get the URLs from pallas you need a delayperiod

[lilac wren]

Idk maybe you do in Pallas but you don't for what I'm doing

Again 1/2 methods work, this is the second that I'm testing

[zealous bridge]

ok, but if you get the xml files, how tf are you gonna get it to sign without the response from pallas?

[lilac wren]

I'm pretty sure the XML just tells you what iOS versions are available that's literally it

[zealous bridge]

so how is this helpful to us?

[lilac wren]

After April 26

We can still go to 14.3

So long as it's signed

[royal flint]

ok so if the XML tells you what iOS versions are available
then what's done with this info
because it's certainly not sent to pallas

[zealous bridge]

no pallas = no tss

[valid adder]

isn't pallas watchos?

[zealous bridge]

it’s an ota api

[lilac wren]

I'm not deleting Pallas lol

[zealous bridge]

it might be watchos lol

[royal flint]

ios, tvos, watchos, audios, and big sur

[zealous bridge]

not deleting it, you’re just making it impossible to use

[lilac wren]

Let me just do my thing, we'll see if it works or not and if mesu will ever freaking show up

[zealous bridge]

alright no-one’s stopping you

just tryna get info as to how you think this is gonna work

lmao

[royal flint]

@valid adder what exactly is this mesu plist used for

[valid adder]

pallas

yeh ota script

[zealous bridge]

s1guza moment

[lilac wren]

It literally doesn't touch Pallas or signing

My modification

[royal flint]

if it leaves pallas be then how are you getting the OTA URLs after 90 days

[lilac wren]

The actual ota will use Pallas I think

[zealous bridge]

how are you gonna load a fimware without signing it tf, i understand what you’re saying as to ur gonna get the .xml files but wtf are you gonna do with them

[lilac wren]

It's going to sign lol

[zealous bridge]

source: trust me lol

[lilac wren]

Idk if I'm too tired or explaining it wrong but do you know what the XML does

Because you think it has to do with signing

It literally doesn't touch signing, all Pallas and signing is normal

It doesn't leave Pallas, it leaves Pallas alone. It's normal not modified

Not deleted

[zealous bridge]

No-one’s deleting pallas

[royal flint]

if you leave pallas alone. how are you getting 14.3 OTA URLs after 90 days

[zealous bridge]

it’s not gonna be in the .xml’s

if you don’t have a delayperiod

[radiant mountain]

We may need to save those URLs while they are public, but after 90 days, they will still be there, just not on the public .XML, but If we managed to inject whatever xml, then there's no problem

[lilac wren]

I gtg to sleep but we'll just see on April 26th... Can't really test anything for sure beforehand

[zealous bridge]

pallas rejects it after 90 days

so no

[lilac wren]

This doesn't use DelayPeriod either

[zealous bridge]

you can’t inject it because it’s all server-sided

[royal flint]

the files get deleted

[lilac wren]

This is where you don't get it

We are the server

We provide the xml

To the phone

[radiant mountain]

You can still download every OTA since ever, signed or not

[zealous bridge]

where are you gonna get the urls from

[lilac wren]

So long as 14.3 is still being signed, even after 90 days, we make it an option and do it like normal

[zealous bridge]

without pallas

[radiant mountain]

Those files are still up in http://updates-http.cdn-apple.com/ somewhere

[zealous bridge]

xml’s wont have them

[zealous bridge]

u want to bruteforce every folder and file in their cnn?

[zealous bridge]

ok, sure, but where tf are you getting the url

make it an option fine

the device will recognise that

but you gotta tell it where to download from

the device can’t do that by itself

hencewhy pallas is required

[radiant mountain]

y not ?

[zealous bridge]

lol

[royal flint]

ok now that's just stupid

[radiant mountain]

jk jk

[lilac wren]

The XML
<key>__BaseURL</key>
<string>http://updates-http.cdn-apple.com/2020WinterFCS/patches/001-77046/02866605-22CD-4B8C-9125-B096A8E20B10/</string>

[zealous bridge]

apple’s servers thought they were going through shit before

[radiant mountain]

The urls would be modified after 90 days

[zealous bridge]

^

cant reuse them

lol

[lilac wren]

Oh for real, how does ipsw me do it for old versions then

[radiant mountain]

But im pretty sure '001-77046/02866605-22CD-4B8C-9125-B096A8E20B10' part stay the same

[zealous bridge]

that link would just be deleted

[radiant mountain]

Only the 2020WinterFCS change

And looking to other old signed OTA, Apple have specific classification for that

[zealous bridge]

those arent modified

after 90 days

cause it doesnt need to be

since theres no reason

[zealous bridge]

it looks like an identifier of some sort so you may be right but can’t say for sure

[radiant mountain]

It does right ?

WinterFCS would be changed to 2019/ or something

[zealous bridge]

dont think apple would make it that easy

[lilac wren]

Why does the link change and how come ipsw ota links don't change

[zealous bridge]

another identifier has to change

[radiant mountain]

http://updates-http.cdn-apple.com/2019/ios/091-24535-20190722-93574A92-9931-11E9-B99A-60D0A77C2E40

they do

[lilac wren]

That can't be the same, ipsw me shows a link like
http://updates-http.cdn-apple.com/2021WinterFCS/patches/001-97944/D9809242-6B74-4DFA-87CF-CBD9507E3624/com_apple_MobileAsset_SoftwareUpdate/2b474c2579acc9bd3c5362766bb1b99d3ca24c3a.zip

Also a /patches

[zealous bridge]

so were you right

The identifer did change

oh is that for the same version or not?

[royal flint]

hold on

are we talking about deltas or full OTAs

[lilac wren]

A very old one as well still has /patches
http://updates-http.cdn-apple.com/2020WinterSeed/patches/001-06486/7152C253-6E0E-4C06-BE4F-F24C170E6430/com_apple_MobileAsset_SoftwareUpdate/5b3e67848ca247281967055afb417e89dca3902b.zip

[royal flint]

we're not talking about deltas right

only full

[lilac wren]

No

[royal flint]

ok

[zealous bridge]

dont think so

[lilac wren]

Any explanation as to what would change after 90 days, why it only changes after 90?

[zealous bridge]

the url would change, and the files would be deleted

as for why