futurerestore-help

[royal flint]

wait a second

i might be wrong

damn i'm wrong, it is signed @lilac wren

[radiant mountain]

Could we just use a 14.2 or lower version, install the profile, don't track mesu but instead track the http://updates-http.cdn-apple.com/ one, to see where it gets those 14.3 OTA's files ? Then on 14.4 device, we could modify the request to hit this http://updates-http.cdn-apple.com/ URL, and thats it ?

[royal flint]

it looks like it's HS256

[royal flint]

we already know what the URLs are

[radiant mountain]

mind sharing ?

[royal flint]

you can get it from pallas

the problem is there are sigs in the pallas response

[lilac wren]

Oh rip

[royal flint]

so you can't just run your own server and call it a day

and you can't edit the pallas request because that is also signed

[zealous bridge]

why tf is pallas signed

who fucking signs apis

[royal flint]

well for exactly this reason ig lmfao

[zealous bridge]

so annoying

[radiant mountain]

Can you share that url ? I wanna try on my own, would probably better understand what you mean

[royal flint]

ok

[zealous bridge]

Pog Member+

[royal flint]

nice

so say you make your own HTTP server correct

and pretend to be updates-http.apple.com?

now you can serve your own files sure

but the device also has a checksum and/or signature for those files

and it won't match

[lilac wren]

So just ask Pallas for the response with the extra param for 14.2 added, right? With our nonce as well. Just have to do it fast so it doesn't time out

[royal flint]

well gotta change current version too but yea

[radiant mountain]

Why should I make my own HTTP server ? For example, I could just swap any OTA files request from updates-http.apple.com by another one ? Like how I did to get 14.5 beta 7 without the beta profile

[royal flint]

You can't edit the URL in the response because the response is signed

[radiant mountain]

I dont edit the response, but the request

[royal flint]

@lilac wren thing is though, if you want to dive in that route, you could always just defeat MobileAsset's sig checks with a tweak lol

[radiant mountain]

You got me confused here

[royal flint]

request to which server are we talking about

mesu is useless it doesn't have supervised versions

[lilac wren]

That'd still be progress

[royal flint]

tanbeer said you managed to get the pallas request & response on device

how'd you do that?

i've never done tweak dev but i've dabbled slightly in dylib swizzling on macOS

wondering if it's similar

[radiant mountain]

I know that.

For example, on 14.4.2, I got to "check for update" view, it make a request to mesu. I modify this request, and tell device to request on mesu/iOS14Seeds, mesu send back a useless xml, saying theres an update to do. So device proceed to a 2nd request on updates-http.apple.com/iOS14Seed that I could swap with the good updates-http.apple.com/ url with the 14.3 OTA files (Thats the url im looking for). So device will download 14.3 OTA files. Then I install the delay profile, and start the upgrade from settings. It will downlaod the full OTA, verify it with the delay profile, and Apple will allow that in theory

[royal flint]

where is pallas in that flow?

the URLs are grabbed from pallas

not mesu

[zealous bridge]

you’re forgetting about tss btw

like completely

[royal flint]

well yea we can't check TSS rn lol

[radiant mountain]

tss would be apple side, shouldnt be a problem ?

[royal flint]

gotta get device to download 14.2 first

[radiant mountain]

Like you do for 14.2 to 14.3, no tss stuff

[zealous bridge]

doesnt tss get something from pallas too

to verify

[radiant mountain]

So the 14.3 OTA files are not downloaded on a updates-http.apple.com request but pallas one ?

[zealous bridge]

Oh yeah

TSS has to confirm that they were downloaded the url pallas would’ve given

[zinc moon]

@zealous bridge what updates were signed 2 months ago

[zealous bridge]

so you can’t just “swap it out”

[zinc moon]

My dad said his old ip8 was used only 2 months ago

[zealous bridge]

uh check ipsw.me

[zinc moon]

14.4 was def signed

[royal flint]

it goes like this
mesu request -> pallas request -> download OTA from URL given in pallas -> blah blah blah -> TSS
(idk what this is used for) (get OTAs)

[radiant mountain]

pallas is gfmd right ?

[royal flint]

yes

gdmf

[radiant mountain]

So there are 0 request made to updates-http.apple.com when supervised ?

[royal flint]

the URL given in pallas is to some file on updates-http

[low summit]

Is there restrictions for supervision for ios?

[royal flint]

wdym

[low summit]

Can ios 10 spoof supervision?

[royal flint]

uhhhh

i think it's been a thing since at least ios 9

maybe earlier

[low summit]

Oh OK

[royal flint]

however delayed software updates have only been a thing since 11.3

[low summit]

So 11.1 can't use Ota?

[radiant mountain]

Oh I see what you mean.. There an additonnaly layer of request made when supervised... Bc when not supervised, it only do mesu -> update, no pallas

[royal flint]

they can't do deferred yes

[royal flint]

no

pallas is always done

[low summit]

Mybloxx is only 11 and 12 minimum I believe

[royal flint]

i just do proper supervision so ¯_(ツ)_/¯

lol

[low summit]

What's the issue for A14

And ota

[royal flint]

TSS says no

[zealous bridge]

Personalised requests fail

[radiant mountain]

When i was sniffing, it was mesu -> update directly

[royal flint]

did you disable cert pinning properly

[zealous bridge]

gdmf is pinned by the kernel

so need to get rid of the pin

[royal flint]

the fuck

@lilac wren so i can intercept gdmf on ios 14 but not 12

lmfao

ok then

[leaden quarry]

I'm having trouble using FR with my phone. I'm trying to go from 14.4.2 -> 14.2 with A11. Does that sound good ? I was able to change my nonce gen with checkra1n JB

it said bad nonce and i have to restore in 14.4.2 my phone

[zealous bridge]

trouble is very vague

[leaden quarry]

yeah ^^'

[zealous bridge]

you didnt set generator properly if it says bad nonce

make sure its the right one and make sure you’re not rebooting in between setting nonce and using fr

[leaden quarry]

yeah so it's supposed to be doable

ok

If I use the "no-appnonce" shsh and set my own gen to 0x0000000000000000 it's ok ?

[zealous bridge]

what

no

your generator is in the blob

[leaden quarry]

oh fuck it's 0x1111111111111111

[radiant mountain]

plus I don't see the problem here...

download OTA from URL given in pallas
Once we have that URL, it could be swap from the original one isn't ?

[zealous bridge]

yes

[zealous bridge]

technically yes, but since tss will check the validity of the firmware before signing it won’t install

[leaden quarry]

thanks, looks like I messed up 😆

[radiant mountain]

Y ? The firmware is valid, thats the whole point of the OTA method used with delay profile

[zealous bridge]

but you ignored what pallas responded with

which is what tss will probably check against

changing the url = changing the firmware since the certs arent the same

[radiant mountain]

Hmm so Pallas would send the URL + other stuff that will be checked when validating the upgrade ?

[zealous bridge]

yes that’s what will probably happen

[radiant mountain]

probably share that URL, let me confirm this lol

[zealous bridge]

it’s kinda like nonces but with actually firmware components

yeah someone can confirm this lol

[radiant mountain]

I would love to, but I don't know what URL pallas send back

[zealous bridge]

need to intercept the response with charles

[radiant mountain]

Cant as i cant jailbreak. But the URL should be the same for everyone with the same device as me

[royal flint]

how are you going to swap it.

you can't spin up your own server and swap it there because the checksum won't match

you can't edit the pallas request because that is signed too

[zealous bridge]

^ that too

[royal flint]

this is even before tss

[cedar onyx]

K thanks

[zealous bridge]

why is this in #futurerestore-help

[lilac wren]

^

[celest basalt]

Lol

[cedar onyx]

Pffff got confused sorry @zealous bridge

[royal flint]

anyways froggy, i'm writing a fake relay server rn

[celest basalt]

Ill look when you submit. Weird that its doing that

[zealous bridge]

nah ur good lmao

[lilac wren]

iOS checks the signature of the response from pallas, if you swap a URL in the response the signature doesn't match anymore

[cedar onyx]

We just talked in another channel and now I use my phone so it got into this channel 😑

Love this channel btw

[zealous bridge]

...thanks?

lmao

[cedar onyx]

:p

[lilac wren]

Does he just lurk at our conversations or... Lol

[zealous bridge]

i think a lot of people do

[royal flint]

What was the key called again?

to specify 14.2

[cedar onyx]

Nah I advice when I can but mostly ask questions

[zealous bridge]

RequestedProductVersion or smth wait

[royal flint]

ah RequestedProductVersion yea

[zealous bridge]

the same one

[lilac wren]

Past that, now we're trying to fake(?) it

[zealous bridge]

it’s the same tss server

[tall siren]

bad tweak

[zealous bridge]

request keys

you can save ota blobs

but those are useless for A12+

and you need to wait for futurerestore to be updated

[royal flint]

as you need bootrom exploit

[zealous bridge]

and i think ipwndfu might be so buggy that its basicaly broken

not randomly generated

for example

if i wanted to get a delay requested update

in my request i’d put

[low summit]

Like?

[zealous bridge]

delayrequested = true
delayperiod = [delayperiod

[low summit]

Do they have a separate tss server?

[zealous bridge]

when the server looks at that

no

the requests are signed

[low summit]

So how's the infinite profile testing going

[zealous bridge]

but you can kinda request ur own thing from pc

but it’d be useless on device

[lilac wren]

Yeah I tried editing the request with charles (just the nonce to something else) and iOS rejected Apple's response

[zealous bridge]

yes

apple saw mfs like us coming from a mile away

anyways once tss sees those keys it knows that it’s a special case scenario and will sign them

provided everything else is fine

but ultimately it’s the same server

[lilac wren]

Wait this concerns me

Because if the device remembers what request it sent out, even though it got a perfectly valid signed response, it didn't accept it

So if we get a perfectly valid signed 14.2 response from gdmf, ios won't accept it maybe?

Or maybe it stores the nonce, sends the request, and since the response had a different nonce it rejected it

[royal flint]

it stores the nonce yea

and also the sessionid

[lilac wren]

So it should be as simple as changing the request to add 14.2

[royal flint]

or at least we should keep those two the same as they change all the time

[royal flint]

• change current build version, and change delayrequested to false, and remove delayperiod

[lilac wren]

Yeah

[lilac wren]

Wait I can literally do that rn though

Let me finish lunch and I'll do it

However I'm on 14.3 so I'll do that but with 14.4

[radiant mountain]

mesu request -> pallas request -> download OTA from URL given in pallas -> blah blah blah -> TSS (idk what this is used for) -> get OTAs

Ok so, when not supervised, you can sniff anything right ?
So why not swap the orginal mesu request with the 14.3 mesu -> pallas request would get a valid sign for 14.3 -> swap the URL given by pallas to the 14.3 OTA -> blah blah blah... ?

If I've managed to get 14.5 OTA files by swapping the mesu + url given by pallas without the beta profile, i dont see why this woundnt work

[lilac wren]

What is "get OTAs", and TSS signs the firmware right before it installs

Whether supervised or not, you can't sniff unless you disable ios ssl pinning so you need the tweak

[lilac wren]

Because the XML seems to be the same whether supervised/delayed or not, Pallas is the one that chooses the specific version

[radiant mountain]

Whether supervised or not, you can't sniff unless you disable ios ssl pinning so you need the tweak
Do i need to sniff pallas tho ? Like how did it work for 14.5 without the beta profile then ?

[lilac wren]

@royal flint can you confirm this

[royal flint]

ignore the get OTAs part, formatting got messed up

#futurerestore-help message

they were quoting this

[royal flint]

yes

exact same to if i opened the URL in my browser rn and downloaded

[lilac wren]

I'm not really sure, you need to enable ssl proxying on gdmf to even see the mesu requests supposedly. Maybe you can get lucky and iOS will let you sniff, it seems like it happened to me earlier as well

[royal flint]

i got my fake server working, neat

time to test with charles

[lilac wren]

Gl

[radiant mountain]

I didnt sniffed pallas, just swap mesu to iOS14Seed, then pallas got me the right URL from that XML

XML seems to be the same whether supervised/delayed or not, Pallas is the one that chooses the specific version

So Pallas give an URL for OTA files that aren't in the XML since there's no 14.3 one in the regular .XML ?

[lilac wren]

What are you doing with your fake server, adding the ios 14.2 Param to the request, gdmf'ing it, and returning that to the phone?

[royal flint]

hmmm

looks like it errored somewhere

getting up to date

let me try requesting 14.4

still didn't work 🤔

let's check logs

oh i'm dumb

[zealous bridge]

what are you trying rn

[lilac wren]

I don't think you can be on the same version as you're requestinf

[royal flint]

i forgot to restart server lmfao

[lilac wren]

Oh you're spoofing to be on 14.0?

[royal flint]

well spoofing in the request

[lilac wren]

Oh I see

And you don't think the device will reject the response since it believes it's on a higher version?

[royal flint]

it looks like it is, but i wanna make sure its all working first

so changing to not spoof, and changing requested to 14.4

[lilac wren]

Do a completely normal request first as control

Where it uses your server

But you don't change any keys

[royal flint]

yea good idea

[zealous bridge]

^

[royal flint]

it works!

14.4.1 (i have a delay period of 30 rn)

[lilac wren]

Awesome

[royal flint]

alright now let's try RequestedProductVersion 14.4

[lilac wren]

Customizing the pallas request

[royal flint]

exception in my code, hmm

Uh

it's making a request with a DelayPeriod

and then another without

weird

[zealous bridge]

to do what exactly

Get versions beyond the 90 day delay

[royal flint]

14.4 shows!

[royal flint]

yes

[zealous bridge]

oh wow

[lilac wren]

One of the request's is for documentation probably

[royal flint]

because apparently you can get 14.2 using the MDM method

[zealous bridge]

if you guys pull this off lol

[lilac wren]

That's good

[zealous bridge]

?

according to whom

[royal flint]

RequestedProductVersion

[zealous bridge]

Oh

[royal flint]

i tried it with my script, with a product and build of 14.0 and a requested version of 14.2

and i get a delta and a full

[zealous bridge]

RequestedProductVersion = 13.5 eta wen

[royal flint]

lol

[lilac wren]

What version are you really on

[royal flint]

14.3

[lilac wren]

Oh ok

[royal flint]

Uhh what's a beta that wouldn't have an delta

14.1 beta should work

[zealous bridge]

14.3RC

I’ve tried that myself

[royal flint]

Hmm yea it seems to be checking that the OTA is not older than itself

which makes sense

[lilac wren]

i got 14.4 as well

no server needed

just breakpoint and edit in charles

[zealous bridge]

literally?

bruh

[lilac wren]

yes I add one line

it's hilarious

[zealous bridge]

RequestedProductVersion

[lilac wren]

yep

[royal flint]

i'm too lazy for this lol

[zealous bridge]

Bro imma try this rn lol

[lilac wren]

Let's keep this between us until April 26

so that apple doesn't patch beforehand

[royal flint]

I mean it useless until we can patch out the check on device or something, but yea

[lilac wren]

it won't let you download? wdym

[royal flint]

Won't let you go to a lower version

[lilac wren]

for 14.3 when 14.4 deferral is over

[royal flint]

Ahhhhh so you mean still jumping from lower -> 14.3

i was thinking about trying 14.3 -> 14.2

[lilac wren]

@zinc moon @low summit do you have a phone that's actually lower than iOS 14.2

[lilac wren]

yeah haha

[lilac wren]

this would be cool if we could get that to work

[royal flint]

see we could test on iOS 12 tomorrow because 12.5 expires tomorrow and i have something on <12.5, but intercepting Pallas isn't working

[low summit]

No

[lilac wren]

ah ok nw

[low summit]

@zinc moon does

[lilac wren]

I still have something else for you to test though

if you have that device you're ok with erasing, when you have the time

[zealous bridge]

sep?

lol

cant downgrade at all

[royal flint]

true

just wondering if i can get it to show on device tho

completely forgot about SEP lmao

[low summit]

14.3 to 14.2 is impossible

Tried it multiple times already

Even 14.0.1 with latest sep can't Ota to 14.3

U just get verified error

[royal flint]

ye ye ik

just want to see if it will even show on device for shits and giggles at this point

[low summit]

If it works then it be broken lol

Big Apple L

[royal flint]

lol

[low summit]

If somehow we could bypass sep check

Latest sep should work with 14.3

[zealous bridge]

uh

i got a 400 bad request

lmfao

[royal flint]

what'd you do

[zealous bridge]

i just added RequestedProductVersion:14.4

[royal flint]

do you have delayperiod

[zealous bridge]

no

[royal flint]

delayrequested is false?

[zealous bridge]

yes

[royal flint]

uhh send request i guess

[zealous bridge]

400

[royal flint]

no i mean send your edited request here lol

[zealous bridge]

    "TrainName": "AzulC",
    "SessionId": "6A4E3091-A44D-4523-96CA-653B7F6FB3FD",
    "ProductType": "iPhone12,1",
    "AssetType": "com.apple.MobileAsset.SoftwareUpdate",
    "ProductVersion": "14.3",
    "DeviceClass": 1,
    "DeviceVariant": "B",
    "SigningFuse": "true",
    "ClientData": {
        "AllowXmlFallback": "false",
        "DeviceAccessClient": "softwareupdateservicesd"
    },
    "Nonce": "F59F0109-774D-4BFE-A08E-68B7A9196021",
    "Supervised": "true",
    "ProductName": "iPhone OS",
    "NoFallback": "true",
    "BaseUrl": "https://mesu.apple.com/assets/",
    "AssetAudience": "01c1d682-6e8f-4908-b724-5501fe3f5e5c",
    "BuildVersion": "18C66",
    "ClientVersion": 2,
    "InternalBuild": "false",
  "RequestedProductVersion: 14.4",
    "AllowSameBuildVersion": "false",
    "BuildID": "238D3D4C-3940-11EB-8D33-A61B81E77CB1",
    "IsUIBuild": "true",
    "HWModelStr": "N104AP",
    "DeviceOSData": {
        "SystemImageID": "5AD8BD31-B8BD-4FD6-9C4C-90645CA26AE1",
        "BuildVersion": "18C66",
        "DeviceVariant": "B",
        "ProductType": "iPhone12,1",
        "BuildID": "238D3D4C-3940-11EB-8D33-A61B81E77CB1",
        "HWModelStr": "N104AP",
        "DeviceName": "iPhone",
        "ProductName": "iPhone OS",
        "ProductVersion": "14.3"
    },
    "SystemImageID": "5AD8BD31-B8BD-4FD6-9C4C-90645CA26AE1",
    "DelayRequested": "false",
    "DeviceCheck": "Foreground",
    "CertIssuanceDay": "2020-09-29",
    "DeviceName": "iPhone"
}```

oh shit does it have to align

[royal flint]

no

hmm weird

[zealous bridge]

oh waut

fucking quotes

[royal flint]

lmfao

[zealous bridge]

200 OK

nothing on device

tf

[leaden quarry]

is 14.4.2>14.2 possible with A11 ?

[royal flint]

no updates available?

[zealous bridge]

no it just keeps checking for update

then timeout

oh i have to execute the response too

[leaden quarry]

guys I have this error when trying to downgrade my iPhone8 plus

[zealous bridge]

no

[leaden quarry]

ah

[zealous bridge]

ok now its just saying unable to check for updates

ffs

[leaden quarry]

14.4.2 > 14.3 then ?

[lilac wren]

yes

[zealous bridge]

@lilac wren how did you do it

i just added that line

executed request + response

[lilac wren]

that's all you do, add that 1 line to the request

make sure you're supervised too

[zealous bridge]

and it says unable to check for update

i am

[royal flint]

if you're having issues you can try my script

you just need python and 2 modules from pip (flask and hammock)

[zealous bridge]

i dont see any requestedproductversion in the response tho

[royal flint]

yea its not gonna be in the response

[zealous bridge]

oh wait

does the nonce change

every time

[royal flint]

yes

[lilac wren]

yes

[zealous bridge]

oh fuck

[royal flint]

and the sessionid

[lilac wren]

GUYS

[zealous bridge]

ok no that still doesnt work

[lilac wren]

I unsupervised

and it shows 14.4

if you change pallas supervised to true

[zealous bridge]

rebooted?

WTF

[lilac wren]

yes

LOL

[zealous bridge]

LMAOOOOOOO

[royal flint]

i mean yea

that would work

[zealous bridge]

apple make it so easy wtf

[lilac wren]

this is amazing lol, ppl can do this without wiping their device unjailbroken now

[royal flint]

wdym

[lilac wren]

you're supposed to be supervised, otherwise it's not supposed to let you get anything except 14.4.2

to supervise, without jb'ing and spoofing, you need to wipe your phone

now you can be in like any state and get 14.3

no more mybloxx

[royal flint]

yea but either way you have to jb

[lilac wren]

no more supervisedenabler

oh true

[zealous bridge]

true

[royal flint]

mitm lol

[lilac wren]

yeah rip

[zealous bridge]

but no wiping

[royal flint]

well you never had to wipe if you were jbed

[zealous bridge]

oh ye

@lilac wren were u spoofing with mybloxx before

[lilac wren]

no I only used RoCordvise and now SupervisedEnabler

[royal flint]

im just permanently on supervision lmao

[zealous bridge]

still spoofing

why doesnt it work ffs

am i being too slow

[royal flint]

could be

you sure you don't wanna try my trash code

[zealous bridge]

does this work for on device

[royal flint]

yea

[zealous bridge]

how

[royal flint]

basically

code runs a server

use charles to redirect request to server

server edits it, send to pallas, and returns what pallas responds with

charles makes it all look like it went to pallas directly

[lilac wren]

that feels so unnecessary, is there a way to make it more efficient if you don't want to just breakpoint

[zealous bridge]

im getting 400 again?

[lilac wren]

is map local request a thing maybe

[royal flint]

yea but nonce

[zinc moon]

Turns out my dad updated the 8

So no lol

[lilac wren]

hey mesu came up again unsupervised

[zealous bridge]

i still havent got mesu

lma

14.4

YESSSS

[lilac wren]

this is the weirdest thing ever... unsupervised mesu requests every single time

[zealous bridge]

BRO ITS DOWNLOADING IT TOO LMAOO

[royal flint]

lol

[zealous bridge]

this is so jank wtf

how low can i go

[royal flint]

cant go below curr version

[loud tusk]

is there anyway for me to downgrade to 14.3 from 14.4 i was on ios 13 but i bricked my phone and had to restore (i have a blob)

[zealous bridge]

systemversion.plist?

[royal flint]

i wonder if you can go to curr version

[royal flint]

tried

[zealous bridge]

what happens

[royal flint]

up to date

[zealous bridge]

did you edit the version in the request too?

[royal flint]

yes

[zealous bridge]

fuck

did you reboot to apply changes

or just straight out

[lilac wren]

^

[zealous bridge]

curr version shows up to date

[lilac wren]

same for me

and I even switched allowCurrentVersion or something to on

[royal flint]

reboot

[royal flint]

i just did this lmao

same for me

[zealous bridge]

14.2 shows up to date

fuck

[zealous bridge]

what

[lilac wren]

wait we can't modify mesu if we don't have a mesu file for 14.3

that's an issue

[royal flint]

i rebooted

[zealous bridge]

oh

fuck

[lilac wren]

I'll try to manually make one

[royal flint]

wtf do we need mesu for

[zealous bridge]

how does it know wtf

[lilac wren]

unjailbroken, no kill switch

[royal flint]

it still asks pallas and that fails tho

[zealous bridge]

first thing it does is ask pallas

if that fails no xml will save you

[lilac wren]

then how did it work for the apple tv + this guy to 14.5 beta

lol

[royal flint]

i don't get the 14.5 beta thing

[lilac wren]

he just swapped the XML file with the 14.5 beta one and it worked

[royal flint]

i need more info

[lilac wren]

map local

with beta xml

didn't touch pallas

[royal flint]

and he got 14.5 beta without the config?

[lilac wren]

I'll do it rn

yes

[royal flint]

aight yea see if you can do it

[lilac wren]

What's their name again

[royal flint]

azzou

so we gotta wait til 26th and then test huh?

[lilac wren]

@radiant mountain could you send the URL for beta xml here again

[lilac wren]

yes pretty much

[zealous bridge]

(18A8395)

[royal flint]

https://mesu.apple.com/assets/iOS14PublicSeed/com_apple_MobileAsset_SoftwareUpdate/com_apple_MobileAsset_SoftwareUpdate.xml

[lilac wren]

oh ty

[royal flint]

oh yea

you dont need to map local

just map remote and change the path

[lilac wren]

that works too

but I wanna map local to edit specifically

[royal flint]

¯_(ツ)_/¯

[lilac wren]

omg the XML is 26k lines long

[zealous bridge]

lmao

[royal flint]

the normal one is 140k lmfao

[lilac wren]

wow lol

[royal flint]

or we find someone < 14.2?

[lilac wren]

that would work for seeing if 14.2 is signed

[zealous bridge]

error

[lilac wren]

i can't map the beta :/

[zealous bridge]

sus

[lilac wren]

get unable to check for update error

[low summit]

Someone has less than 14.2

@zinc moon

[lilac wren]

It tried to access another part of mesu as well but got 403

I assume because the profile isn't installed but idk

[lilac wren]

awesome when they come back we can test

[zealous bridge]

taurine failing exploits

[low summit]

But it's his main and fr

Fr matter or not?

[lilac wren]

we won't update it

we will just see if 14.2 appears

and maybe try to download it

[low summit]

Oh OK

[lilac wren]

btw, mesu seems to be hit before gdmf

I think after it decides what version it wants from mesu, it asks gdmf for it?

[zealous bridge]

taurine has failed 6 exploits in a row

tf did i do

[lilac wren]

LOL

[zealous bridge]

it kps every time it finishes

i edited the systemplist to 14.1

does that affect it

lmao

[lilac wren]

that happened to me twice yesterday

first time ever

also first time kp on reboot userspace with taurine yesterday as well

so it's not just you

[zealous bridge]

but 6 times in a row

[lilac wren]

hard reboot phone on airplane mode maybe?

[zealous bridge]

it says jailbreak finished sucessfully

[low summit]

GG @zealous bridge

[zealous bridge]

goes to the splash screen

[lilac wren]

if svplist messed it up you'd be bootlooped i think

[low summit]

Taurine is just buggy lol

[zealous bridge]

then kps

wow

[low summit]

Took like 7 tries

For my xs

[zealous bridge]

the exploit is completing successfully

istg

[low summit]

@void rapids how do we fix taurine

[zealous bridge]

in the middle of the first splash screen it just kps

whats the bundle identifier of Jailbreak Updater btw

[split torrent]

Update to 14.4.2

[zealous bridge]

com.julioverne.sslkillswitch2 was killswitch right

[lilac wren]

probably

[zealous bridge]

need to add it to my script

[lilac wren]

this is weird, with killswitch I can't see mesu anymore?

[zealous bridge]

k guess imma restore rootfs

[split torrent]

Happy birthday.

[low summit]

What's kps

[lilac wren]

???

[low summit]

@split torrent

[zealous bridge]

kernel panics

[lilac wren]

lol why happy birthday

[low summit]

Bday to taurine fail

[zealous bridge]

i said it was my birthday to get apple to give me a free apple watch

[lilac wren]

Lol what

[low summit]

Finally froggy member pro

[lilac wren]

❤️

[lilac wren]

lol pay the fee to jtv

[low summit]

Nice nick

[zealous bridge]

THATS WORRYING

TF

[lilac wren]

what

[zealous bridge]

WHY AM I SEEING PREBOARD WHEN I RESTORED ROOTFS

[low summit]

Jtv steal Joe money and mama

[lilac wren]

lol this happened to me after getting microsoft mdm

[zealous bridge]

oh im on 14.3

[low summit]

Tanbeer finally fked up with his main lol

[zealous bridge]

nice

ok

[lilac wren]

@vivid nova where is apple located that you want a $400 shipping fee

[zealous bridge]

time to jb with unc0ver

jk

[low summit]

Lol tf why

[lilac wren]

Lol

[low summit]

Do it

Who cares

[vivid nova]

huh

[zealous bridge]

taurine just gave up on me

[lilac wren]

#futurerestore-help message

[zealous bridge]

for some reason

acc imma use u0 for now

[lilac wren]

wow ok

[zealous bridge]

cba to go thru that again

[low summit]

Surprised jtv isn't giving out bday atv presents

[vivid nova]

go ahead and paypal that

[lilac wren]

@zealous bridge want the watch ^

[zealous bridge]

no

:>(

[lilac wren]

but it's free

[low summit]

Prob fake ass watch

[lilac wren]

lol wth is this

[vivid nova]

surprised your mom is giving out bday presents

[zealous bridge]

k why is u0 failing exploits too

wtf did i do

[low summit]

Stfu @split torrent

[split torrent]

No you

[zealous bridge]

oh wait you have to jb twice

[lilac wren]

oh

[zealous bridge]

makes sense

[low summit]

Lol

[vivid nova]

imagine @split torrent secretly being saurik

[low summit]

Oh

[zealous bridge]

sus

[lilac wren]

lol

[zealous bridge]

imagine tim cook is sauriks dad

[low summit]

Or Steve Jobs is

[vivid nova]

imagine your mom loves TV

[zealous bridge]

she dont

[vivid nova]

sorry.. your 'mum'

[low summit]

Imagine jtv is sauriks mom

[lilac wren]

TV is getting outdated

[vivid nova]

as is your mada

[split torrent]

Announcement: The Apple TV device known as "JTV's Mom" is now obsolete

[royal flint]

how dis work tho

because mdm sends the version

[low summit]

How many mdm are there

[royal flint]

a bunch

[lilac wren]

i'll get beta profile and sniff

[royal flint]

aight

oh yea

did you try the beta xml thing

[lilac wren]

yes didn't work

[royal flint]

i went out for a bit

ah rip

[lilac wren]

unable to check for update

[royal flint]

ah

[lilac wren]

maybe @radiant mountain can replicate it?

[royal flint]

if this works tho
going to 14.3

its gonna be crazy

[lilac wren]

from which version

[royal flint]

<

after 26th

[lilac wren]

ah ok

[royal flint]

the stuff we've been doing

[vivid nova]

I'd be flattered if you named your device that, unfortunately TVs don't have 'rents

[royal flint]

bruh this would be so much easier if i could just mitm ios 12 lmao

[split torrent]

You told us that 3 times before we evicted you from your Apple apartment

[zealous bridge]

jtv talking to himself

[lilac wren]

lol pay rent jtv

[lilac wren]

it's entertaining ngl

[vivid nova]

this comment would only make sense if they thought that "'rents" wasn't short for parents

[royal flint]

yg don't have device on ios 13 either right @zealous bridge @lilac wren

[zealous bridge]

no

[royal flint]

rip

[zealous bridge]

unfortunately

[lilac wren]

I have one on iOS 12.4.something

but yeah no ios 13

[royal flint]

well, maybe you can see if you can mitm gdmf

[zealous bridge]

im tryna get 14.2 to show up

while spoofing 14.1

[royal flint]

ios 12 didnt work for me but idk if it's user error

[vivid nova]

I'm trying to get your mom to show up while spoofing as yo daddy

[royal flint]

gl

check console

ig

[zealous bridge]

oh ye

taurine was being an asshole tho

so had to switch

[royal flint]

although ac2 seems better than console tho

[split torrent]

You can enable smart quotes in Settings > General > Keyboard > Smart Punctuation

[zealous bridge]

successfully spoofed

[zealous bridge]

no

[royal flint]

yea after i modded systemversion trying to jb just ended up rebooting for some reason

[zealous bridge]

oh rly

how did you jb then

[vivid nova]

I can also enable your mom in Settings > General > Siri

[zealous bridge]

wtf

how did i reboot in 4 seconds

no wtf

im jailbroken as well

thats creepy

[royal flint]

pcie20 nvme /s

[zealous bridge]

this is how you install tweak via ssh

[lilac wren]

allow xml fallback is true for non supervised

[royal flint]

hmmmmmmmm

any other diffs?

[lilac wren]

guys I got it

If you block gdmf while unsupervised (well rn I'm doing beta profiles but should work for regular) it only uses mesu

gdmf was blocked and it still shows 14.5b7

[royal flint]

that makes sense now

Oh shit

[lilac wren]

so pallas is skipped or something? mesu xml is the one that matters

[royal flint]

Oh shit

[lilac wren]

which makes this so much more interesting

[royal flint]

We can block gdmf

[zealous bridge]

oh wow

[royal flint]

Mod xml

[zealous bridge]

oh wow

[lilac wren]

if we could create an xml for 14.3

[royal flint]

Bro

[zealous bridge]

i never thought of that

[royal flint]

Just when I was about to eat

[zealous bridge]

pallas isnt required is it

[lilac wren]

Lol

[zealous bridge]

surely

its required at some point

[lilac wren]

just when I was about to get bored and do HW

[zealous bridge]

nah but surely

[lilac wren]

maybe only for MDM/supervised

[zealous bridge]

pallas plays a part somewhere

wow

[lilac wren]

doubt it

seeing as apple tv worked

[royal flint]

I mean allow xml fallback means just that

Fallback

[zealous bridge]

apple bro you make this so easy

well

[lilac wren]

lol

[royal flint]

wait

[zealous bridge]

the request wouldnt be sent to pallas anyway

so

[lilac wren]

going to try and construct a 14.3 xml now

[royal flint]

how much would this help us tho

[zealous bridge]

how does that work

[royal flint]

because we still need to be jbed and shit

[lilac wren]

this is all done without the kill switch tweak

unsupervised as well

so this could be fully unjben

[royal flint]

wait no pinning for mesu?

[celest basalt]

how are you gonna make it work unsupervised, TSS will reject non-managed requests

[royal flint]

^^

[lilac wren]

mesu lets me see if without kill switch, gdmf is the one I need it for

[zealous bridge]

oh

we havent even thought about tss

tss is gonna check pallas i think

since we blocked it its gonna get a firmware mismatch

[lilac wren]

I mean let's just try it

[zealous bridge]

true

we've come this far

[celest basalt]

I was thinking of replaying the successful TSS response I had before on 14.3->14.3 but it would probably fail due to SepNonce mismatch

[royal flint]

damn I gotta wipe to unsupervise

eh

i got nothing on it anyway

[zealous bridge]

uh

why

[royal flint]

i didn't spoof

[zealous bridge]

i had disable auto updates off

why is it still saying

[royal flint]

it glitches out like that for me sometimes

restart

[zealous bridge]

ok

it shows up on charles tho

thats what i was saying

[royal flint]

What shows up

[zealous bridge]

gdmf

pallas

[royal flint]

ah

[zealous bridge]

but on device

no dice

same thing

tf unc0ver

[royal flint]

ota enabler time ig

[split torrent]

Using the tweak "Perseus"? Apple has implemented this in a much smoother, more native way. Check out iOS 14.5 beta today.

[zealous bridge]

whats the device identiier

pls someone

[lilac wren]

for what

[zealous bridge]

i am not waiting for cydia

[lilac wren]

what device

[zealous bridge]

otaenabler

idk why i said device identifer

bundle id

whateve

[lilac wren]

net.cadoth.otaenabler

[zealous bridge]

CFNetwork SSLHandshake failed (-9807)

oh it might be the proxy

oh i need the charles root certifcate

[lilac wren]

I'm getting error checking for update mapping XML to a smaller version with only 14.4.2 for my device :/

let me try mapping local to the same file

no error mapping local to the original xml

going to remove one asset and see

[zealous bridge]

oh 172 not 127

[lilac wren]

removed one random asset for apple tv and it doesn't work

does it check the hash of the xml or something?

[royal flint]

hm

you are blocking gdmf right

and xml fallback is true

[zealous bridge]

xml nonce

[royal flint]

no nonce

[zealous bridge]

where is xml fallback sent to?

[lilac wren]

not blocking gdmf actually

let me do that

same issue

[lilac wren]

I can't tell because I disabled SSL Kill, but it's default yes I think

[zealous bridge]

ok so apparently ssl kill switch doesnt work on u0

fml

[royal flint]

oof

[lilac wren]

rip

[royal flint]

why you on u0?

[zealous bridge]

idk

uh

bc taurine is being dog shit for some reason

keeps kernel panicking after exploit successful

so device reboots and jailbreak is lost

[royal flint]

did you mod sysver.plist

[zealous bridge]

also the charles proxy didnt work

[zealous bridge]

yes

[royal flint]

yea thats why

[zealous bridge]

but it works fine on u0?

[royal flint]

idk why but it happened to me too

idk

[zealous bridge]

what did you end up doing then

[royal flint]

finished everything before it panik and taurine died

[zealous bridge]

hm

[royal flint]

i did ldrestart after editing plist

not sure if that actually works tho

[zealous bridge]

prob doesnt

cause kernel_task is not killed

[royal flint]

i mean settings did say 14.1

ah

rip

[zealous bridge]

well

ik the fix for this

but

i cant get charles proxy to work on device

[lilac wren]

I really should do HW but if Azzou comes back try to get him to recreate the beta thing

[royal flint]

yea go do it

[zealous bridge]

it says this

but the proxy dont work

[lilac wren]

wow leaking ip

jk it's internal IP

[zealous bridge]

ye

[royal flint]

that's a weird ip range to use

¯_(ツ)_/¯

[lilac wren]

lol was gonna say

[zealous bridge]

can someone try this on their device

[lilac wren]

I love 10.0.0

[zealous bridge]

and see if works

[lilac wren]

sure what do you want me to do

[zealous bridge]

just need to change the proxy

[lilac wren]

i have charles working so I can do what you want

[zealous bridge]

set proxy to 172.29.192.1:8888

on device

and try load a website

[lilac wren]

mine is my computer IP though

[royal flint]

^

make sure the ip it shows is right

[zealous bridge]

just change it for now

?

[lilac wren]

it won't work for yours lol

[royal flint]

^

[zealous bridge]

is it supposed to be different

[lilac wren]

unless I fly to your house

[zealous bridge]

my internal ip is 192.168.1.165

[royal flint]

run ipconfig and send a ss

[zealous bridge]

not that

lmaoi

ik what my internal ip is

[lilac wren]

mine is just my computer IP that I see in settings and can ssh to

[zealous bridge]

i thought that was charles's ip

[royal flint]

and how is your phone getting internet

[lilac wren]

charles should be the same tbh

[zealous bridge]

it isnt

[royal flint]

charles stop proxying my mac

[zealous bridge]

hold on

maybe if i change

[royal flint]

wdym, you have to be connected to wifi or something

[lilac wren]

settings icon, proxy settings, http proxy mac > off

[royal flint]

how to make it default

[zealous bridge]

yeah but the proxy isnt working

[lilac wren]

you have to do it every restart

[royal flint]

bruh moment]

[zealous bridge]

so network traffic isnt coming

[lilac wren]

pls lol

[royal flint]

go to wifi settings on your iphone

what ip does it show

[zealous bridge]

oh wow

oh wow

it was showing the wrong ip

fucking charles man

[lilac wren]

lol

[royal flint]

lmfao

[zealous bridge]

OH

MY HYPER V ETHERNET ADAPTOR

LMAOOO

it detected that

[lilac wren]

oh wow

[royal flint]

rofl

[zealous bridge]

and was telling me to try connect to that

[royal flint]

its probably attached to all interfaces anyway yea

[zealous bridge]

ye the right one is the middle one

[royal flint]

hmm so we're testing screwing with xml right

[zealous bridge]

yes

[royal flint]

welp

time to wipe

[zealous bridge]

i can also do this

but no wiping

[royal flint]

¯_(ツ)_/¯

more the better

are we still gonna find someone on <14.2 to test

or are we just gonna wait til 26

[low summit]

Ur back jb @zealous bridge?

[zealous bridge]

this shit still doesnt work

why is u0 so ass man

restoring rootfs now

[low summit]

Back to taurine

Lol

[zealous bridge]

gonna try again with red bull

[low summit]

Red bull?

Sleepy?

[zealous bridge]

second ingredient

[low summit]

Lght back to red bull bois

[zealous bridge]

why is my os corrupted

[royal flint]

rootfs restored

wipe time

[zealous bridge]

bruh im hallucinating every time i look at my phone i see recovery mode screen

when its just apple logo

[royal flint]

o

[low summit]

Succession time?

Lol

Do you even have access to cydia or sileo?

[zealous bridge]

i jailbroke with u0

worked fine

but i couldnt do what i needed to do

[low summit]

Which is what?

Spoof?

[zealous bridge]

sniff

k no kp

[royal flint]

y'know we should all thank t-mobile for this actually, without t-mobile i wouldn't have a SE to find this on /s

[low summit]

U need sleep lol. Hallucinations

[low summit]

Tell tmobile I said thx

[royal flint]

lol

[low summit]

Been waiting like half a year for 14.3

[radiant mountain]

Ey

Im back

[royal flint]

alright

[radiant mountain]

What did i miss ?

[royal flint]

so we could not reproduce your beta thing

was hoping you could retry

[radiant mountain]

What did you try ?

[royal flint]

use beta xml

without beta profile

[radiant mountain]

My beta thing was just to install 14.5beta7 without the profile

Yeah

I could try again in 1 hour, ive to prepare dinner rn

[royal flint]

aight

[radiant mountain]

cya

[zealous bridge]

bruh taurine kp'ed again

[royal flint]

oof

[zealous bridge]

@royal flint how did you ssh

[royal flint]

to do what

[zealous bridge]

you said that it happened to you

kp

[royal flint]

oh yea

just restore rootfs

[zealous bridge]

how do u ssh after restoring rootfs

lol

[royal flint]

once you restore rootfs it should stop kp

[zealous bridge]

oh

[royal flint]

wonder if debug=0x100 works on iphones

anyways, unsupervised, what did i want to do again

right xml time

[zealous bridge]

i have one level left

need 10,000XP

[low summit]

For what?

Edition?

[zealous bridge]

mem edition

[royal flint]

damn i cant use my proxy profile

rip

[low summit]

Just ask for dev lol

Cause ur a dev

[zealous bridge]

tf did i develop

[low summit]

Ota

[zealous bridge]

that was

@royal flint

[low summit]

@royal flint for dev

Lol

[zealous bridge]

true

i just switched from taurine to unc0ver to taurine to unc0ver

[royal flint]

@lilac wren proxy > proxy settings

[low summit]

u0 6.1.2?

[zealous bridge]

ye

[lilac wren]

Yes that's what I said

But you wanted it default

[royal flint]

yea that's default off

[lilac wren]

Oh I see what you mean

Ty!

[low summit]

Make a new jb call red bull

[royal flint]

why is proxy not working

oh

cant proxy over usb without supervise

oof

[vivid nova]

imagine red bull actually giving you wings

[royal flint]

yea i cant get xml fallback working

[leaden quarry]

hey guys, my restore seems frozen with that in the cmd prompt : unknown data request 'personalized data' received

[zealous bridge]

oh i cannot read

[zealous bridge]

what version of futurerestore

[leaden quarry]

I just got the mac version on github, I think it's 180

[lilac wren]

ugh I literally cannot find a 14.3 mesu backup anywhere on the internet

[zealous bridge]

well thats very old

[leaden quarry]

oh

[zealous bridge]

what do you see on your device

[royal flint]

y tho

[leaden quarry]

the white apple and a progress bar at 50%

[zealous bridge]

oh rip

you're in a bootloop rn

[royal flint]

mesu info is almost identical to gdmf

[zealous bridge]

you have to restore to latest

[leaden quarry]

ok np

[zealous bridge]

if you're not on A11 and lower you can't fr again

[royal flint]

i forgot which keys were missing

[lilac wren]

find a full 14.3 XML one on the internet lol, I literally cannot find one

I see iOS 6 and 13.4.5