futurerestore-help

[lilac wren]

and not much else

[royal flint]

no i mean you should be able to build one from pallas info

[leaden quarry]

I'm A11 😉

[zealous bridge]

alr then

use v194 next time

[lilac wren]

you can't I don't think, the old XML's are updated on apple's servers and deleted from public view

[leaden quarry]

ok I'll do that

[royal flint]

no like the content

the content should be mostly the same as gdmf

did you ever compare the two

the asset info is almost identical

[lilac wren]

no actually

but I'll have to rebuild it from scratch?

that's awful lol

it's 25k lines long

[royal flint]

just make one with just 14.3

[green onyx]

wtf did i miss LOL

300+ msgs

[lilac wren]

Remember I deleted literally only one asset from 14.4.2 latest XML and iOS refused it

[green onyx]

YO

FROGGY IS MEMPRO

POGGERS

[lilac wren]

yay ❤️

[royal flint]

well in that case we have to figure out how it's being validated

there's no sig in the response itself so even if you find a 14.3 xml it wouldnt work

[lilac wren]

Found a way to request a specific version of iOS without delayperiod, found a way to show a specific version of iOS unsupervised without delayperiod, found a way to possibly edit what OTA is shown without jailbreak. But we're in the middle of that rn

[green onyx]

WTF

[zealous bridge]

bruh why is u0 so broken

literally wont let me

everything else works

[green onyx]

HOLY

[zealous bridge]

just gdmf is broken

whyy

[green onyx]

THIS IS BIG STUFF

aight

[lilac wren]

and by specific I mean 14.2 literally shows up as well, we just don't have a device <14.2 to test if it's signed (probably not though lol)

[green onyx]

WAIT WHAT

[low summit]

u0 is shit what u expect

[green onyx]

HOW ABOUT 13.7

YOOOOOOOOOOOOO

[lilac wren]

I'll try it rn

[zealous bridge]

yeah

[low summit]

why???

lol

[zealous bridge]

sadly if you upgraded you cant downgrade

BUT

[royal flint]

i mean it requires mitm tho

[lilac wren]

and also Dhinak found a way to make a mini server tool to do it for you

[zealous bridge]

it may be possible to tether downgrade

[green onyx]

13.7 is good

[zealous bridge]

and then untether upgrade

[low summit]

wait for ipwndfu

prob safer

[green onyx]

true

[royal flint]

i mean its literally just like 50 lines of python lmfao

[lilac wren]

yeah it requires a MITM, so you need to get a jailbreak tweak + computer (rn, probably no computer is def possible)

[zealous bridge]

@green onyx dont get too ahead of yourself, we still need to find a way to deal with tss and whatever issues arise from there

[low summit]

bruh u guys are definitely devs

[green onyx]

ah i see

[royal flint]

yea the big question here is

[green onyx]

ngl, u guys are geniuses

[royal flint]

is it signed

[green onyx]

like real geniuses

[low summit]

does it matter?

[zealous bridge]

man i cant get this shit to work

[royal flint]

tss

@low summit

[low summit]

14.2 is signed or nah?

[royal flint]

don't know

[zealous bridge]

everything is signed

it should be

[lilac wren]

we don't know until dabezt can test it

[green onyx]

11.3+ is signed?

[lilac wren]

no way, you fr?

[low summit]

nah not 12.4 i dont think

[green onyx]

11.2 isnt signed i think

unless it is?

[royal flint]

forget 11.2

[zealous bridge]

if we find a way to get 14.2 installing

then 100% everything is signed

[green onyx]

this is by ota right?

[lilac wren]

imagine

[low summit]

delayed software is only signed when its within 90 days lol

[lilac wren]

yes

ota

[green onyx]

huh

[lilac wren]

not true

[zealous bridge]

@lilac wren u get where im coming from right

[lilac wren]

signing ≠ accessible

[royal flint]

we can get 14.2 from pallas

[low summit]

unless u could force it with ur own server

[green onyx]

@zealous bridge does ur A9 have like 14.1 blobs?

[zealous bridge]

if we somehow manage to get tss to sign 14.2

then it can sign every version

[lilac wren]

yep makes sense I think

[zealous bridge]

if we get it to mdm

[low summit]

even if he test on 14.0.1 he cant update tho

[lilac wren]

we should have dabezt try lowest version though

[low summit]

so how u know if it works

because fr lol

[lilac wren]

@green onyx we're not going to officially release until April 26th I think so apple doesn't patch

[green onyx]

ah i see

[low summit]

apple cant even patch upgrades i dont think

[green onyx]

but keep me updated

[low summit]

because they allow mdms

[zealous bridge]

yet you do this on #futurerestore-help which everyone can see lmao

[royal flint]

That one trick Apple doesn't like!

[lilac wren]

lol

[low summit]

this is good we could aways update via ota

even if jb comes for 14.4

[zealous bridge]

man i wish we could downgrade i miss 13

[royal flint]

aight taurine time

[zealous bridge]

theoretically charles can sniff out the tss request + response without doing anything extra if it were to download right @royal flint

[green onyx]

lol

[royal flint]

ya

as it's just http

[zealous bridge]

ok well imma try 14.3 to 14.3 soon as well to save valid ota blobs

[lilac wren]

Just tried 13.7

[royal flint]

lmfao

hi

[zealous bridge]

hi

[green onyx]

hi

nice nonce

[zealous bridge]

wow it gave the url

doubt this would work on device tho

[lilac wren]

it's not even a real ap nonce, just a random one for this request

[green onyx]

alright gtg

[green onyx]

ah i see

[zealous bridge]

cya

[lilac wren]

ok cya

[royal flint]

cya

[low summit]

cya

[royal flint]

you gonna mitm and check if it shows on device @lilac wren ?

[lilac wren]

I'm not changing my systemversion.plist, I'm A12 14.3 lol

[zealous bridge]

how are you gonna spoof

im a13 bitch

and i did

like

[lilac wren]

let's wait for dabezt

[zealous bridge]

6 times

lol

[lilac wren]

you are insane

Lol

[zealous bridge]

true

it doesnt work anyway

[low summit]

u scared?

[lilac wren]

yes

[zealous bridge]

u0 just doesnt let you check for updates with a ssl proxy

and taurine wont let you spoof at all

[royal flint]

wait could my ios 12 issues be checkra1n and ssl killer not playing nice

bruh

[lilac wren]

wat I'm on Taurine doing it rn

[zealous bridge]

i thought u werent spoofing

[royal flint]

spoofing sysver

[lilac wren]

spoofing systemversion or what

[zealous bridge]

yes

[lilac wren]

no i'm not

[zealous bridge]

then

[low summit]

spoofing doesnt work anyways

[lilac wren]

it kp loops if you edit sysver.plist?

[low summit]

like it wont update

[royal flint]

yea spoofing sysver ends up in kernel panic after a while, and then every time you rejb -> kp

[lilac wren]

on taurine?

[zealous bridge]

yes

[lilac wren]

oh wow

[zealous bridge]

have to restore rootfs

mind you

[lilac wren]

with a wrong system version O_O

[zealous bridge]

i did manage to spoof on 1.0.2

actually

[low summit]

why lol

[zealous bridge]

imma downgrade taurine

[lilac wren]

to ios 1 lol

[zealous bridge]

nah

[lilac wren]

oh

nvm i see

[zealous bridge]

i remember being able to spoof

14.3rc

maybe new update

but maybe its just im spoofin it too low

ig i can check

[royal flint]

how can i restart sb from ssh

[zealous bridge]

sbreload

[royal flint]

sileo button broken

wait did i forget to install ssh

[zealous bridge]

fak

[low summit]

just get new term

[royal flint]

installed

[zealous bridge]

if u get connection refused u did

[royal flint]

there we go

oh i need to reboot anyway

also forgot prefloader

[low summit]

wait u guys got the profile for 14.2?

i have ipad on 13

[royal flint]

why doesnt ssl kill have a dependency on prefloader

[lilac wren]

no profiles

[royal flint]

it's not a profile, it's mitm

[zealous bridge]

ooh he can test cant he

[low summit]

then i dont wanna risk lol

[zealous bridge]

oh ok

[lilac wren]

Lol

[zealous bridge]

openssh should rly be default

[lilac wren]

ikr!

I asked this like 3 weeks ago when I wanted to make another GUI tool

[zealous bridge]

ok now procursus is downloading at 10KB/s

[split torrent]

Haha get DDOSed back

[lilac wren]

Lmho

[zealous bridge]

true

[lilac wren]

petty

[zealous bridge]

k i spoofed to 14.3RC which 100% worked before

so if kps then i can just downgrade

[lilac wren]

do you have 14.3 blobs

real ones

[zealous bridge]

downgrade taurine

no

[lilac wren]

how did you get to 14.3

waiting?

[zealous bridge]

yes

[lilac wren]

ah lucky

[zealous bridge]

i got this phone on 14.2

[lilac wren]

Lol why did you update

[zealous bridge]

updated to 14.3 cause i thought jb was dead

[lilac wren]

LOL

[royal flint]

lol

[zealous bridge]

(when 14.1 jb news was coming out)

[lilac wren]

When I got XR on 12.1.2 i downgraded immediately to 12.1.1

[zealous bridge]

so i was just like fuck this

[lilac wren]

and jb came out for 12- 12.1.2

[low summit]

fail

[lilac wren]

Which stinks because I always love latest jb-able

[zealous bridge]

i still couldve updated to 14.4 but i cba

[low summit]

i got this X on ios 11

[lilac wren]

what's cba again

[zealous bridge]

ok now i want taurine to kp

[lilac wren]

A cost-benefit analysis (CBA) is the process used to measure the benefits of a decision or taking action minus the costs associated with taking that action.

[royal flint]

cant be assed

[zealous bridge]

asked

[lilac wren]

how would I have known that lol

[royal flint]

typo

[zealous bridge]

gosh darn it

[zealous bridge]

literally everyone does

[lilac wren]

why

[low summit]

i have a 14.1 6s but my mom took it

[royal flint]

oh blocking gdmf might not work but maybe making it return no assets does

[lilac wren]

reboot userspace?

[zealous bridge]

so i was spoofing too low

rip

guess i cant test shit

[lilac wren]

6s?

[low summit]

ye

[lilac wren]

ok trade with your mom

/s

[royal flint]

fuk that didnt work

[low summit]

nah its just a spare phone for her to play games

[royal flint]

how do you actually get it to fall back @lilac wren

[low summit]

she has X lol

[royal flint]

i cannot get it to fall back

[zealous bridge]

bro procursus is being ddosed rn

[lilac wren]

it doesn't even fall back, gdmf seems to be like optional. Just unsupervise and it'll use mesu

[royal flint]

im unsupervised

[lilac wren]

turn off SSL Killer

otherwise you won't see mesu

[zealous bridge]

oh my proxy

[royal flint]

yea i did but it still died if i blocked gdmf

[lilac wren]

it errors out on the phone?

[royal flint]

yea

[lilac wren]

hm

For me it lets me ssl on gdmf without error... it's so jank

[royal flint]

hmpf

[lilac wren]

but I don't actually see gdmf requests

like I enable SSL on gdmf, without kill switch it looks the same, but it makes mesu come up

and then you can turn on ssl on mesu to see the XMLs

[royal flint]

so you have proxy on for gdmf?

[lilac wren]

by it looks the same I mean I cant see request or response

[lilac wren]

yes but it doesn't actually let me see anything in gdmf/pallas. Only see mesu

[royal flint]

yea ik

lemme retry that

ok
jbed
unsupervised
ssl killer off
proxy on for gdmf and mesu but off for everything else

unable to check

[low summit]

damn we need @zinc moon to test and hes gone

[lilac wren]

we'll wait for him, nw

[royal flint]

keeps dying

[lilac wren]

that's normal, but now you should see mesu

and it should show you the update to 14.4.2

[royal flint]

i do see mesu but it errors out on device

[lilac wren]

:/ you see mesu and the XML?

[royal flint]

yup

[low summit]

where he go lol dinner?

[lilac wren]

the actual software_update xml or random ones

[royal flint]

softwareupdate

ok i had redirect to beta one on

[zealous bridge]

@royal flint @lilac wren would a device on 14.0-14.1 be helpful to your testing

[lilac wren]

try disabling / enabling ssl for mesu / gdmf

[royal flint]

let me disable that and retry

[royal flint]

yes

[lilac wren]

yes

[low summit]

if only froggy had ipad air 2

like he tho

[zealous bridge]

like replacing dabezt helpful?

[royal flint]

very yes

[zealous bridge]

because i think i can provide that

[lilac wren]

definitely to see if 14.2 is signed

[zealous bridge]

yeah i can provide that

[lilac wren]

you don't have to update either

YAY

[zealous bridge]

its my sisters 6s

[low summit]

i honestly think ota is always signed

[zealous bridge]

i can fr to 14.0-14.1

have the blobs

[low summit]

as long as u could get the download

[lilac wren]

lol your poor sister

[zealous bridge]

same device i used to test gui

[royal flint]

oh

[lilac wren]

ik that's why

[royal flint]

@lilac wren i fixed it

[zealous bridge]

i just need to appease her somehow

[low summit]

money

lol

[zealous bridge]

true

[royal flint]

ok so the issue was that it was returning 304

[zealous bridge]

pls paypal me so i can gib

[royal flint]

not modified

[lilac wren]

how for research

[royal flint]

right click and enable no caching

[lilac wren]

oh wow

[royal flint]

ok now i try remap

[low summit]

if only spoofing works

then we dont have to go thru trouble

[royal flint]

oh shit

@lilac wren

azzou right

it works

[lilac wren]

yes

[royal flint]

it really does work

[lilac wren]

YES

[royal flint]

i see public beta 7

[lilac wren]

what did you swap with

[leaden quarry]

Restore successful 14.4.2 > 14.3 on A11 😄 Thank you for your help @zealous bridge !

[zealous bridge]

np! congrats

[lilac wren]

ah wow

[royal flint]

just make sure to enable no caching

[low summit]

lol i tho he meant ota

[lilac wren]

congrats

[zealous bridge]

wow

so what does this prove

we can just swap xmls

[low summit]

nothing much u could change firmwares

[lilac wren]

well we need xml mods to work first but this is a great first step

[zealous bridge]

and w/o jailbreaking or supervision

[royal flint]

i am testing xml mods now

lets hope it works

[zealous bridge]

we can just upgrade like that

🤞

[low summit]

so ota without supervision?

[zealous bridge]

cmon no xml nonce bs

[low summit]

🤞

[celest basalt]

[lilac wren]

FutureRestore lol

[low summit]

fr yes

[celest basalt]

oh

[zealous bridge]

lmao

[low summit]

i got confused too

[zealous bridge]

this is #futurerestore-help

[lilac wren]

ikr this channel is basically #ota-research

[zealous bridge]

true

[low summit]

should call it just ota and fr

[lilac wren]

i got map local beta to work, another step forward

[green onyx]

true lol

its literally ota research

[low summit]

that was a quick return

[green onyx]

eh

not really

[zealous bridge]

what was the issue

[green onyx]

i have to do a bunch of stuff rn lol

[lilac wren]

idek lol

<key>Signature</key>
    <data>
    a7iR/hN6j9NC2QxVFhEK8sSRqVsDdIbW1o2uaVemuLulPU0qB0H3fE1Q5ma57LYPKz1K
    fvzZE0OfBPF/k7whuFAhGQuDalwuQS7zknxZ251IbK6B/Myo7xQ4w5+6dF6dG7XRHKK9
    P1kduiZLTCHZY7kBS1R5V2KsJGJ9vxDcQzWg15xwTGte/PvUnFU5veSF8YLh2b6/joNJ
    7VJclsohFTR8RfYYon9C6jp8/ElTXa3TB7Cxm6Y2RCUumN2ABrGwhotjj6xfH7xPTsBp
    owFGPgkyuH8+Q0ku7vAgD7okw6fTsG7NlAnxiNhHimS0iV8YKZFDPGP6D0WaAwkIx7IU
    Eg==
    </data>

:/

[low summit]

are u going back to 13.7 when ipwndfu comes?

[lilac wren]

We'll have to sign our own XML's

[zealous bridge]

in the xml?

[lilac wren]

which I don't think we can

[zealous bridge]

oh fuck

noooooo

[lilac wren]

ik

[royal flint]

fuk

[lilac wren]

that's a dead end I think

[zealous bridge]

who tf signs xmls

[lilac wren]

that's why beta worked bc it's also signed

[green onyx]

tss?

[lilac wren]

nah

[royal flint]

fuck this shit

ghidra time

[zealous bridge]

can we not just find a way to connect to mesu

[green onyx]

lol

[zealous bridge]

and backup an xml

[lilac wren]

dang

[lilac wren]

this!! If we were able to fetch one from 14.3

[royal flint]

i am probably going to crash and burn in 2 minutes but hey

[lilac wren]

it's deleted now though we need someone who has it cached

[royal flint]

no one has it cached lmao

[lilac wren]

I'll start today

[royal flint]

no one has thought of this

same

i already have a bot caching stuff for macOS otas and normal updates

[zealous bridge]

but even then

[royal flint]

i can just download this too

[zealous bridge]

would the signatures be device specific?

[royal flint]

no, the sig is for the file

[zealous bridge]

oh ok

[lilac wren]

^

again the only ones I could find online were 13.4.5 and ios 6

[royal flint]

does anyone have a class dump for mobileasset

[lilac wren]

https://www.theiphonewiki.com/wiki/Talk:OTA_Updates#Tracker

[tight locust]

can i downgrade with any tool without jailbroken ?

[zealous bridge]

no

can we still use the 6s @lilac wren

[lilac wren]

yes

to try 14.2

[zealous bridge]

alr

[lilac wren]

jailbroken only though

[zealous bridge]

yes

[tight locust]

futurerestore need to be jailbroken right ?

[zealous bridge]

yes

[tight locust]

and there are other tools ?

[low summit]

unless u could set nonce another way

[zealous bridge]

no

[zealous bridge]

there isnt

this whole time we were allowing non-jb upgrades but i just realised wtf is the point of that

every single ios below 14.4 is jailbreakable

[lilac wren]

exactly lol

[low summit]

exactly

complete L

[zealous bridge]

literally no reason

most people are jailbroken too

if it was for downgrades thatd be one thing

[low summit]

downgrades dont work we already established

so its not useful

maybe there are some uses we havent discovered yet

[zealous bridge]

In other news got 14.3 to work

[lilac wren]

spoofed 14.3 RC?

[zealous bridge]

Yep

[lilac wren]

and MITM change preferredversion or whatever it was called?

[celest basalt]

tbf 14.0-14.3RC all have known bugs

[low summit]

someone wants to go from rc to stable lol

14.3

[zealous bridge]

yep

[zealous bridge]

fair point

but doesnt rly matter for some ppl

[royal flint]

@lilac wren @zealous bridge

now where the fuck is this DownloadManager

[zealous bridge]

one sec

i think its an ios daemon

[lilac wren]

it's not giving you a very clear error

[zealous bridge]

where tf are ios daemons again

[royal flint]

i'm a dumbass

[low summit]

icleaner

[zealous bridge]

oh true

[low summit]

[[icleaner pro]]

[mystic axle]

iCleaner Pro

The first real iOS system cleaner & optimizer

Author

Ivano Bilenchi

Version

7.8.3

Price

Free

Repo

Ivano Bilenchi's Beta Repo

Bundle ID

com.exile90.icleanerpro

More Info

Click Here

Ivano Bilenchi's Beta Repo • Page 1/3 · Apr 10, 2021, 9:26 PM

[zealous bridge]

well it aint there

rip

[lilac wren]

/System/Library/Daemons or something

[zealous bridge]

no

[royal flint]

ayyyyy

[lilac wren]

/System/Library/LaunchDaemons?

[royal flint]

mobileassetd from ios is useless

but mobileassetd from big sur is not

[zealous bridge]

pref files

[royal flint]

also

mobileassetd is located in /usr/libexec

btw

[zealous bridge]

ofc it is

damn

[unreal isle]

Can I tetheret downgrade my 14.4 device with Divisé to 14.3?

[zealous bridge]

what device

[unreal isle]

A11

[zealous bridge]

i think so

but

it'll be a dualboot config

not an actual downgrade

[celest basalt]

yeah it would be a dualboot, and pretty useless for jailbreaking purposes since it would be tethered

you would still need a computer to JB and still unable to use SEP features

[unreal isle]

Ok i try dualboot

[celest basalt]

only time it's useful is if you're a developer who needs to test something specifically on 14.3 that's different on 14.4 tbh

[zealous bridge]

@celest basalt what about this

[celest basalt]

yeah you can do that, but then it won't boot without a computer at all

so that's basically a lose-lose situation unless you really need some specific 14.3 thing that doesn't work on 14.4

[zealous bridge]

[celest basalt]

with dualboot, the main 14.4 OS would boot without a computer (but no semi-untethered JB for 14.4), and 14.3 would boot with a computer

[zealous bridge]

@royal flint @lilac wren just realised, if i futurerestore on the 6s imma have latest sep, so can’t use that

[lilac wren]

We could still try getting 14.2 to appear

[zealous bridge]

True

[lilac wren]

Wait have you FRed on it or no

[zealous bridge]

yes

[lilac wren]

Ah ok

[zealous bridge]

well

Obv

[low summit]

he tested gui on it

[zealous bridge]

You saw me do it

Lol

[low summit]

froggy ur an L

[lilac wren]

I thought ota upgrades worked with latest sep, or no?

[low summit]

no

lol

[zealous bridge]

no...

[lilac wren]

Wasn't it just downgrades

[zealous bridge]

lmao

no

it was upgrades too

[lilac wren]

Wow I'm ootl

[low summit]

u cant downgrade sep

[zealous bridge]

yeah

like at all

[low summit]

because ur on latest sep

froggy L

[zealous bridge]

i could still try pwning sep with blackbird but idk how to do that

[lilac wren]

Is it the same error for upgrade OTA / downgrade attempt

[low summit]

ota 14.3 still has 14.3 sep

[zealous bridge]

Yes

[low summit]

and latest cant go back to 14.3 sep

thats why @zinc moon cant ota

[celest basalt]

the thing I don't get is that 14.4 and 14.4.2 SEP supposedly is the same, but 14.4->14.4 OTA also failed

I already said this but yeah

this is confusing

[low summit]

fails also?

i guess theyre not the same lol

[zealous bridge]

how sep functions might be different in ota vs ipsw

[low summit]

^^true

[royal flint]

im bad at ida

[low summit]

Probably apple can't verify sep from ipsw

If u fr

[valid adder]

I can log ota via debug serial if u guys want

[zealous bridge]

yes please

that’d be very very helpful

[valid adder]

I have a 6s on 14.2

[zealous bridge]

thanks!

you have like a million other test devices as well tbh

havent u used fr on that tho

or is that the whole point

[valid adder]

And DEV iBoots

[zealous bridge]

oh

well debug error of failed to verify would be nice

[low summit]

Any type of debug would give some answers to how Ota works

[zealous bridge]

I mean we already have console ota

But maybe debug can tell us more

[valid adder]

Ota works via obliteration flag + bootnonce var

[zealous bridge]

bootnonce var?

what’s that

[valid adder]

that’s how we setnonce

We stole the idea from ota

[zealous bridge]

oh i thought you meant var as in /private/var

nvm

[valid adder]

Var variable lol

[zealous bridge]

Yeah lol

[celest basalt]

I also have a DCSD if that helps, though at this point I can probably only record failed attempts

[zealous bridge]

any debug is useful at this point

[radiant mountain]

Back for good this time

Whats new ?

[celest basalt]

idk but I tried the downgrade from 14.4.2 OTA, 14.4.2 IPSW (iTunes) and 14.4 IPSW with 14.4.2 SEP (FR)

[zealous bridge]

I think dhinak got it

So ur all good

[radiant mountain]

Restore successful 14.4.2 > 14.3 on A11 😄 Thank you for your help
Thats real ?

Amazing

[zealous bridge]

Futurerestore

Not OTA

[radiant mountain]

Oh ok, with blobs then ?

[zealous bridge]

yes

[radiant mountain]

Still cool

[celest basalt]

I still don't fully understand how the 14.3->14.3 OTA only worked when spoofing 18C65, because even when I spoof to 14.0 or 14.2 it fails to verify the delta (checksum, not TSS) so it downloads full OTA anyway

[zealous bridge]

Damn we rly forgot what fr was

[zealous bridge]

oh i had that too

it must have been some filesystem check

once it realised it couldnt install deltas it just went why not lets install full ota

[royal flint]

yea i am now crashing and burning

[zealous bridge]

restore.log should tell you more

[royal flint]

can someone who actually knows how to reverse engineer do this pls

[celest basalt]

yep, the logs definitely show a FS mismatch in the delta

but I don't fully understand it still

supposedly others had success with it when their delta failed but then full OTA went through

[zealous bridge]

Need logs to know for sure

[celest basalt]

I don't think I have those logs anymore, but I know they said "Failed to enable managed request"

for me, 14.3->14.3 only worked if I forced a full OTA from the beginning with 18C65 (successfully did it twice)

but 14.4/14.4.2 to 14.3/14.4 doesn't want to work no matter what

[zealous bridge]

14.3RC doesnt have a delta to 14.3

[celest basalt]

yes, I know

[zealous bridge]

So it will always get a full OTA

[celest basalt]

but like I said it always falls backs to full OTA anyway so I don't understand why only that worked

[royal flint]

@lilac wren @zealous bridge what if we could bypass pallas verification

[zealous bridge]

How

[royal flint]

tweak

[zealous bridge]

Also TSS would give us problems im pretty sure

Hm

[celest basalt]

someone said that the delta failing and forcing a full OTA was usually a good sign and the update succeeded for other people with that

[zealous bridge]

Thats def possible ig

[celest basalt]

but that should only happen if you are downgrading or if you didn't restore rootfs

the delta should not mismatch for a legit clean rootfs update

[zealous bridge]

Yeah true

I only got the delta thing when i was spoofing sysversion

so yeah

[radiant mountain]

Told ya im a genius

[royal flint]

however we can't edit mesu

that is also signed

[celest basalt]

btw, I'm keeping my eyes on this thing, I have a saved TSS request that I replay once in a while with tsschecker to make sure it still returns a successful response

[radiant mountain]

Now, what if, instead of hitting iOS14Seeds, we could just modify the response, add some bullshit .XML with a fake <key>version</key><string>14.9</string>, then add the payload we want ?

[celest basalt]

in case Apple unsigns the managed 14.3 update early

[radiant mountain]

Oh...

[zealous bridge]

We may have a way to get around that

Stay tuned

[lilac wren]

What does pallas verify? Doesn't it just device what ios version is available + to show in the OTA menu for supervised?

[zealous bridge]

It sends the URL too

[lilac wren]

Also @zealous bridge have we saved these new supervised (like 14.3 OTA) blobs

[proper helm]

Hey, for sonething not ota related. Do any of you know if problems with using —upgrade while downgrading from 14.4 to 14.3 on a10 could be resolved.

[zealous bridge]

(For supervised)

[zealous bridge]

we need to actually update to save these ota blobs

[radiant mountain]

I believe it does that, so intercepting the response, adding a fake <dict> to a fake <version> like 14.9 will gave us a valid signature from Pallas, and allows in this <dict> to put the URL we want

[royal flint]

verifying the signed response from pallas

[zealous bridge]

all of them can

[celest basalt]

I've done it for Sloopie, but that was only necessary because they hacked together a 14.2 tether boot and it successfully verified but failed to install

[lilac wren]

Awesome I'm sure there are a lot of people updating? We can just ask someone to plug into a MITM and enable ssl?

[zealous bridge]

Uh

[celest basalt]

if you successfully updated just dump onboard blobs with System Info

[zealous bridge]

Blobs are device specific remember

[lilac wren]

Yeah but the request

Oh something about a bcert right

[celest basalt]

the BCert is tied to a device too

[zealous bridge]

request will also be device specific

BCert

[lilac wren]

We don't know how to create the bcert?

[zealous bridge]

No

[lilac wren]

Oh ok

[celest basalt]

nope, probably SEP does it

[zealous bridge]

It’s prob from the UID key

Which you know

is unobtainable

[lilac wren]

Why? We can already access all iOS versions right? I tried 13.7

[celest basalt]

the other way is to MITM the TSS request and get the BCert and SepNonce and plug that in to a tsschecker request with a manually specified apnonce so you know the generator and can reuse the blobs later

[zealous bridge]

SepNonce would change wont it

[lilac wren]

Is BCert specific to the ios version you're going to as well + specific to a nonce/ that restore?

[zealous bridge]

Version specific to

SEPNonce specific too

[lilac wren]

Ah hm

[celest basalt]

yes, that prevents you from replaying it on-device to update but doesn't prevent you from replaying the request to save blobs and pair up the SepNonce inside the BCert with the one outside

but again these OTA blobs are only useful for A11- in pwndfu mode

[zealous bridge]

The blobs would be useless tho wouldnt they

[lilac wren]

Why don't they work for A12+

[celest basalt]

for A12+ they're useless

[zealous bridge]

Since SEPNonce would have to match

Or is that just for BCert

[proper helm]

Good, because I only have enough time to let futurerestore do it’s thing. But not enough to restore from a backup aftwerwards. Do you know if they’re being worked on currently?

[celest basalt]

it doesn't have to, because you would not be downgrading the SEP

you would use signed SEP

[zealous bridge]

Oh SEPNonce doesnt work like APnonce does it

[zealous bridge]

If whats being worked on currently

[celest basalt]

well, futurerestore can ignore BB/SEP nonces beacuse we always just use a signed SEP instead

[zealous bridge]

True

[proper helm]

—upgrade flag while downgrading.

[zealous bridge]

It’s a bad idea

[celest basalt]

because it won't accept OTA tickets in regular recovery mode, it will fail at entering restore mode

[lilac wren]

Yeah just use the --downgrade flag

Jk

[zealous bridge]

And no I don’t think it’s being worked on since theres no issue

[celest basalt]

need to get into pwndfu and then pwnrecovery which requires a bootrom exploit

and from there you can use OTA blobs as well

[zealous bridge]

@celest basalt any luck with ipwndfu btw

[celest basalt]

not yet

waiting for Cryptic at this point bc I tried a few things but it keeps failing

[zealous bridge]

is it always langid?

[celest basalt]

no, ipwndfu itself succeeds (even if it shows the langid error), the problem is with futurerestore

also doesn't always show langid

sometimes it just says successfully exploited

[zealous bridge]

Oh so you can enter pwndfu

[celest basalt]

yeah

[zealous bridge]

thats fine then ig

[celest basalt]

problem so far is: checkm8-nonce-setter goes from pwndfu -> pwnrecovery -> recovery, but normal recovery won't accept OTA tickets

if I make it stop at pwnrecovery, FR says "device APNonce does not match APTicket nonce"

[zealous bridge]

Have you tried rmvsigchecks.py?

[celest basalt]

checkm8-nonce-setter uses that for older devices but it uses ipwndfu for A11

[zealous bridge]

i think u still need it to use fr

on any chip

[proper helm]

https://mobile.twitter.com/opa334dev/status/1379041130411606017

opa334 (@opa334dev)

turns out downgrading with -u may not be the best idea 😅 now healthd is heating up the phone

Twitter · Apr 5, 2021, 12:00 PM

[celest basalt]

well, if I'm reading the script right then ipwndfu is the sigcheck patch but idk

[zealous bridge]

@proper helm it’s not supposed to be used in that way

so it’s not an issue

[celest basalt]

I mean you can probably just erase the device to fix it but then you lose data

[royal flint]

ok

i figured out where mesu is verified

[royal flint]

the question is how to hook it

[zealous bridge]

pwndfu is a device state where you can remove the signature checks

the sigchecks are a different .py

[low summit]

why does it still need blobs to downgrade then on pwndfu

[zealous bridge]

to verify the restore?

[royal flint]

@lilac wren well i figured out where to bypass mesu sig checks at least

[zealous bridge]

so we can swap xmls now?

[low summit]

still need tss to verify?

[lilac wren]

Ooh that's actually great , how'd you do it

[royal flint]

ida

the question is

how

[zealous bridge]

ye

[royal flint]

i don't know tweak dev

[lilac wren]

...do you need to be jailbroken

[celest basalt]

¯_(ツ)_/¯

[lilac wren]

Then there's no point

The point of xml was that you could be unjben

[low summit]

whats the point tho if 14.3 and below all have jbs

[zealous bridge]

thats broken and prolly no longer updated

[lilac wren]

I mean it'd be fun to do nonetheless, another method of getting 14.2 to appear

Or 14.3 after April 26th

[celest basalt]

updated 8 days ago

[royal flint]

yea rip

[zealous bridge]

tf

[low summit]

unless we could do downgrade we're not actually helping ppl lol

[celest basalt]

well that's just a binary update

last "real" update was Oct 2020

[low summit]

this is literally just research purposes

[royal flint]

do you know how to hook it tho

[celest basalt]

https://github.com/MatthewPierson/ipwndfuA11

[zealous bridge]

oh the fork thats linked on fr is different

so idk

[low summit]

ipwndfu still needs fr to restore or itunes?

[zealous bridge]

fr

[low summit]

ok

[lilac wren]

What do you want to hook? I could try it later

[low summit]

itunes restore is never gonna be possible with blobs?

[celest basalt]

it used to be possible years ago on older devices

saurik ran his own TSS server

[royal flint]

-[DownloadManager massageXmlAndPersist:from:to:with:postedDate:]
it calls a function to verify the response, i don't know its name

bypassing pallas verfification is easier, just make -[PallasResponseVerifier verifyResponse:signature:error:] and -[PallasResponseVerifier verifyCerts:error:] return true

[celest basalt]

Cydia used to save blobs for you too

[low summit]

yea i remember those good old days

sep wasnt a thing back then

[radiant mountain]

If what you said is correct, then I still have hope that those verification method can be abused with a rightly formatted fake .xml... Just need to find a way to "inject" that in the response

just

[royal flint]

wat

how are you gonna inject a signature

without being able to sign it

[zealous bridge]

Gonna steal apple’s private key

[royal flint]

aight we breaking into apple's pki room lets go

[low summit]

work for apple tanbeer

and hack tss

[zealous bridge]

True

[radiant mountain]

How does the 14.3 do then ? It have to be signed too...

[celest basalt]

why does copying a 1 MB file into an ipsw take forever

[zealous bridge]

Needs to rebuild the ipsw

[celest basalt]

14.3 is signed but only for supervised devices that make a special managed request to Apple's servers

[zealous bridge]

Yes, but the beta XML was available publicly, no-one can find the 14.3 XML

[celest basalt]

has anyone tried actually using am MDM for the delayed updates yet?

[zealous bridge]

Therefore no-one can find the right signature

[zealous bridge]

I tried that the day after the method got found out

lmao

[radiant mountain]

I thought that DhinakG managed to sniff mesu on supervised device, you could get the .xml from there

[celest basalt]

I did try adding an MDM profile but Jamf Now can at most push the delayed OTA profile to the device and not force a specific update

[zealous bridge]

For 14.4.2

[zealous bridge]

I got access to a Jamf Pro account

[celest basalt]

nice

[zealous bridge]

they work

but only for the delayed versions

[celest basalt]

have you tried it for a downgrade

[zealous bridge]

yes

doesnt work

[celest basalt]

what does the log say, same thing?

[zealous bridge]

Carbon copy

[radiant mountain]

Ive a friend on 13.5 A13, ill try to sniff every request while he does the OTA technic to go to 14.3 and see if there's something useful

[zealous bridge]

alright, remember we just need the one .xml then it will work

[radiant mountain]

Sound like a plan

[zealous bridge]

All we need is that annoying ass signature

[celest basalt]

damn Ubuntu 21.04 has not only irecovery but idevicerestore too

[zealous bridge]

makes things a lot easier

[royal flint]

that won't work

supervised devices do not allow mesu as a fallback

that's why we never saw mesu

[radiant mountain]

13.5 can be jailbroken and install the SSL tweak isnt ?

[royal flint]

and we have already validated that mesu doesn't change

so there's no way to get mesu from 14.3 was latest unless someone saved it back then

[radiant mountain]

Hmm...

If we consider that, without the beta profile, you can still go to 14.5 beta 7, then maybe, without supervised, we can go to 14.3 ? There, the mesu request could be intercepted and modified the same way ?

[zealous bridge]

14.3 isnt signed

[lilac wren]

If going to 14.2 works

That means that we can literally ota upgrade to all versions without blobs right?

[royal flint]

all available OTA versions

and only if you are on 11.3 and up

[lilac wren]

Awesome

[royal flint]

well the 11.3 and up might be different if we do mitm

but let's just assume 11.3 and up for now

nvm it would still be 11.3 and up as you need support on iOS

[radiant mountain]

For supervised, it is. But hear me out, with modifying the mesu response on unsupervised, we could simulate that maybe

[royal flint]

again

you cannot modify the mesu response

all you can do is replace it with another mesu response

we don't have a mesu response from when 14.3 was latest

[radiant mountain]

ooh you mean xml cant be swapped/modified bc of this ?

<key>Certificate</key>
<data> MIID7TCCAtWgAwIBAgIBLTANBgkqhkiG9w0BAQUFADB5MQswCQYDVQQGEwJVUzETMBEG A1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRo b3JpdHkxLTArBgNVBAMTJEFwcGxlIGlQaG9uZSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 eTAeFw0xMTA3MTQyMjMyNDhaFw0xODA3MTQyMjMyNDhaMGYxCzAJBgNVBAYTAlVTMRMw EQYDVQQKEwpBcHBsZSBJbmMuMSEwHwYDVQQLExhBcHBsZSBpT1MgQXNzZXQgTWFuaWZl c3QxHzAdBgNVBAMTFkFzc2V0IE1hbmlmZXN0IFNpZ25pbmcwggEiMA0GCSqGSIb3DQEB AQUAA4IBDwAwggEKAoIBAQC1y4D4VYBPHLwnHk1qfi1F49E3Ml675ElYYAFghqpAiKOq eagLVZU8zKuPw650NHACvNJbjKBjMsWdWaFMj/7c2TB5IkJwi61Y6B+uVK78W9u9I/hF AK0pWcM9Y5KbKMvz4wEwt64EXfS8eVBRmqh/29ygxN9NtBbHEiGiGQ8vxIV3U6FomNdm xKPM7VZmsyFIxQ5HsxgHb0skxlDIdePtYsHLmpK9PX43K3sBT3lHN0Uxtit8HTrdwiNq 13cI0TINT+lsbXKLp3/gPJVpfxkQ3MTt40KG/DTMsqKOygDombsFSqA+RPSv68YtJ/kA aGaoH6gZfRrwX7GJozzQ8KTZAgMBAAGjgZIwgY8wDgYDVR0PAQH/BAQDAgeAMAkGA1Ud EwQCMAAwHQYDVR0OBBYEFGNQxP6y1Ao4Hrhid6BcMLwcrB3BMDgGA1UdHwQxMC8wLaAr oCmGJ2h0dHA6Ly93d3cuYXBwbGUuY29tL2FwcGxlY2EvaXBob25lLmNybDAZBgNVHSAB Af8EDzANMAsGCSqGSIb3Y2QFCDANBgkqhkiG9w0BAQUFAAOCAQEAn6Cj4XjlScRIh1wP F8BLCz/dl6CskbTsJXz24tCDm3gcvb1Ovc+sBeg1JyvHiy2C4NxEGDYsVYHvUbucXrGd ul6kKauOYcEzpogk56BIRenKHivAqQQtNJpVmqrElgqDntI/az2Gsw32TLWyDXVw8rWi vchZE+VOv1mT4a7LHsdxMWbEOIrkvkZUOoxZlQhjPCc22mp0Yy5rwcf+3/IwJGOhJSXO VrcxuOwmweNrK1Eajn+HS2IlnMBwQDkH/d74KUXGvuNX0LsXv9cCQMB8tcjFlr1u+Szo XCHD1SJkU4ex3auhnukYSoiag78twmDRk726aYmxNIfYYpDs0hS7Mw== </data>
<key>FormatVersion</key>
<integer>1</integer>
<key>Signature</key>
<data> aBeolCS5aM72aTPyxMK7McakOkZmKfSdwfAAr33oxliqOScZjrQI6Q2FzoPoQ0VO+hiY oIlC8T93ZMD1uXRGTXt9ad7iCkpuPC3JvdFueQn0oLm1ftAKuRR2egghtKYJBAcy4nLw xKkA8O3GZ3St6hrXrugif/QHuudsASyzxO//9pgK0pv7gKARNWfWrJHbehgDO6t0ekfA cJzh5oKL2GR5bSunI4eYi6WNqB5MyBTtRU+K8UsD+5V24nWPQT6xco+MGz1Qx1nRMuic HvcljOtxqWr6/pzctxD00tZ3wHD+lnosisa4Ak8DLcxBCUA/YuIjuODfMCJb8fsE/yFD vw== </data>
<key>SigningKey</key>

[royal flint]

yes

[radiant mountain]

break the encryption pls eta wen ?

[zealous bridge]

literally never

[lilac wren]

What's certificate vs signature?

[radiant mountain]

🤷

[zealous bridge]

certificate allows a connection, a signature verifies it

[lilac wren]

Connection to what, this is an XML file

[radiant mountain]

tf is <data> ?

[zealous bridge]

you can substitute connection for whatever the target is

[lilac wren]

Yeah but for this XML, what is it used for

[zealous bridge]

but most commonly its used for connection

[lilac wren]

It's the signature/cert itself

It's like saying
[Key: Signature, Value: XXXXXX]

[zealous bridge]

look up X. 509 ig

[royal flint]

uhhhh

so the code removed the cert and signature part

then

[radiant mountain]

From what ive understand it is used in some device frameworks to see if the xml is valid, so a tweak could bypass it, that why it need to be jailbroken only

[royal flint]

uh calls SecKeyRawVerify on it using an extracted public key from the certificate

[lilac wren]

What verifies the signature? Is there only one ios private key from bootrom, and that's what it uses?

[royal flint]

no

the xml is signed using the public key from the certificate

the certificate is validated to be connected to some Apple iPhone CA certificate

[lilac wren]

It's signed using the certificate already in the file?

[royal flint]

ok
so you have the XML without the sig and cert and stuff
you take the public key from the cert
and then you get a signature for the XML
then you put the signature and the cert into XML

the verification code will make sure the cert is trusted

and then get the public key from the cert, strip the cert and sig from xml, and then check the sig

[zealous bridge]

the signature is encrypted using public keys and decrypted using private keys, im guessing the private keys on the servers

[lilac wren]

"Take the public key from the cert" where is this cert? Apple's servers?

[royal flint]

the cert embedded in the XML

idk where it comes from

[lilac wren]

Then why can't we just sign our own with any cert we create

[royal flint]

because

the cert is validated to be trusted

any random cert we create is not going to be signed by Apple iPhone CA

[lilac wren]

Does this require an internet connection

[royal flint]

no it appears to be local

[lilac wren]

But it's signed by the cert in the file? So how does it know Apple iPhone CA create it

[royal flint]

chain of trust

same as how website SSL certs work

[radiant mountain]

So if we modify the response, not entierly but just change some value in it, replacing a dict by another one lets say, the cert/sign value would still be valid and the .xml would be accepted ?

[lilac wren]

So is any part of this certificate on device or is it all downloaded at the time of getting the XML

[zealous bridge]

if you changed some parts of it the signature would be invalid and it would fail to verify

[lilac wren]

No if you change anything at all I'm pretty sure the signature is invalid

Like a hash

[zealous bridge]

‘tis the magic of encryption

[zealous bridge]

it should be all download at the time of dling the xml if I understand how SSL works

[royal flint]

no, the entire xml is sigchecked

[royal flint]

The cert used for the signature is not on device
However the direct CA is

[lilac wren]

I don't understand how it knows it's from Apple then (sorry I'm dumb with this). Can't you fake it from the root part of the chain all the way to the XML?

[royal flint]

it looks embedded in mobileasset

[lilac wren]

Ah ok makes more sense

[royal flint]

The direct CA is used to verify the cert that comes in the XML

the cert in the XML

[zealous bridge]

time to hijack mobileasset

[radiant mountain]

Isnt that cert expired ?

Idk shit about cert

[royal flint]

yea idk about that lol

[radiant mountain]

[royal flint]

intermediary cert

managed to extract it

yup

@lilac wren this cert: #futurerestore-help message
verifies against this cert: #futurerestore-help message, which is hardcoded into mobileassetd

the child cert is generated with the root cert's private key and stuff

[radiant mountain]

Seems unbypassable to me.. You have an idea ?

[royal flint]

you need a jailbreak to bypass

at that point just mitm, install ssl killer, and use the pallas method

[radiant mountain]

No jailbreak would require a valid apple signed xml right ? But those for 14.3 are unfindable ?

[lilac wren]

Now that makes a lot more sense, thanks so much for teaching me

[royal flint]

np

@lilac wren @zealous bridge so how many currently (looking) viable methods do we have rn? i believe 1?

[zealous bridge]

yeah just the one, we can’t rule out the xml thing out completely but the outlook isn’t too good

[royal flint]

aight

imma go play some games then

lmao

[zealous bridge]

alright

have fun

if i can test 14.2 tonight then i will

feel a bit tired tho

[radiant mountain]

Do you guys know what ess stand for ?

[zealous bridge]

In what context

[radiant mountain]

init.ess.apple.com

What can this be used for

[zealous bridge]

thats the facetime server

lmao

[radiant mountain]

On booting, device make a request there then get that in response

[radiant mountain]

Oh ok nevermind then

[green onyx]

on ur main?

[zealous bridge]

6s

[green onyx]

ah

makes sense

[zealous bridge]

it wont work bc latest sep

but hopefully i can get 14.2 to at least show up

then get a real tester to test it

[green onyx]

hm

sad that otas cant downgrade sep and bb

[royal flint]

@zealous bridge found a potential tester

14.1 although a14, but that shouldn't matter this early

[lilac wren]

we had 3, and now only 1 :(

[royal flint]

f in peace

[zealous bridge]

apple man

clickbaiting us

[lilac wren]

why can't you download OTA from JB'en state

[zealous bridge]

the a8-a10 pwned sep downgrade is still gonna be possible

[zealous bridge]

its the jailbreak tools themselves

they just block it

[lilac wren]

oh wow

[lilac wren]

luckily we will have another for iOS 14.4.2+

[royal flint]

yup

[zealous bridge]

whats that

[lilac wren]

let's DM?

[zealous bridge]

ok...

[split torrent]

You sure about that?

[lilac wren]

-_-

[zealous bridge]

pls halp

[lilac wren]

@radiant mountain pls accept FR

Lol FR = For real, FutureRestore, Friend Request

[zealous bridge]

true

[radiant mountain]

Done

Ima go play some rocket league tho

Will be back in 1 hour

[lilac wren]

ok

[radiant mountain]

Ping me if I can help tho

[lilac wren]

👍

[zealous bridge]

boi-

[tight locust]

what is wrong ?

[zealous bridge]

redownload ipsw

Put it on your C: Drive

[tight locust]

even it's unsigned ?

i'm on A13

14.4.1

[zealous bridge]

You need a jailbreak to use futurerestore

[tight locust]

huh

[zealous bridge]

did you not understand what i said

you need to be jailbroken to use futurerestore

[tight locust]

yesss i understood don't worry 🙂

it need to be jailbroken for what ?

[zealous bridge]

Set nonce

[tight locust]

oohh thanks

i'll wait for a jailbreak

will it be released closer ?

[zealous bridge]

no idea

going to sleep y’all, gn @lilac wren @royal flint

[lilac wren]

good night!

[vivid nova]

no eta

[royal flint]

gn

[lilac wren]

Wow the hate on u0 is real https://reddit.com/r/jailbreak/comments/mocfu6/_/gu2vj59/?context=1

[abstract rain]

Hi, need a little bit of help

My nonce value has string characters in it and the nonce generator let’s me only type in values

[vivid nova]

@lilac wren if you're gunna install geosn0w sh!t...

[lilac wren]

I've installed it once bc folky recommended it, deleted it immediately lol and don't plan to get it again

[abstract rain]

which repo should i add to set nonce value?

[lilac wren]

[[dimentio]]

[mystic axle]

dimentio

PoC tool for setting/getting nonce without triggering KPP/KTRR/PAC. (requires tfp0)

Author

0x7ff

Version

2.0.0-1

Price

Free

Repo

1Conan

Bundle ID

com.0x7ff.dimentio

More Info

Click Here

1Conan • Page 1/5 · Apr 11, 2021, 3:23 AM

[lilac wren]

1Conan repo here ^

[abstract rain]

thanks, I will try it out

I can’t really change the value there

[low summit]

OK I'm back any break thru?

[radiant mountain]

dimentio's also available on Procurus

[fickle kettle]

hope 14.3 insde

[valid adder]

goodluck @fickle kettle

[fickle kettle]

wtf

all 14.3

lol

@valid adder thx

[valid adder]

yoooooo

W

[fickle kettle]

but is serial base lookup

open it rn

kk

[versed egret]

[[futurerestore]]

[mystic axle]

futurerestore

A hacked up idevicerestore wrapper, which allows specifying SEP and Baseband for restoring

Author

Hayden Seay

Version

195

Price

Free

Repo

Procursus

Bundle ID

futurerestore

More Info

Click Here

Procursus • Page 1/1 · Apr 11, 2021, 8:40 AM

[valid adder]

its not a package really lol

[fickle kettle]

true 14.3 lol

[versed egret]

How do install future restore?

[fickle kettle]

how restore 14.5 backup to 14.3?

[valid adder]

!t frgui

[mystic axle]

frgui

https://github.com/CoocooFroggy/FutureRestore-GUI

Added by stkc#8018 | Used 1 times · Apr 10, 2021, 7:02 AM

[valid adder]

@versed egret

[celest basalt]

you don't, 14.5 fucked with the backup system

[zealous bridge]

@lilac wren wake up

[sharp zephyr]

Anyone know a rough estimate of how long an iPhone X on 12.1.1 takes to update to 14.3? After I download 14.3 it is stuck on "Preparing Update" for a long time and I don't know it is just slow or actually stuck.

[zealous bridge]

Can take anywhere from 15mins to 1 and a half hours

[sharp zephyr]

After I have already downloaded the file itself?

[zealous bridge]

Yep

[sharp zephyr]

Ok fingers crossed it works, thank you

[zealous bridge]

@royal flint can you check if a 14.2 ota exists for iPhone9,3, d101ap on current version 14.1 18A8395

[celest basalt]

https://updates.cdn-apple.com/2020FallFCS/patches/001-73648/8C212A40-A0B4-4B98-9285-A37602E344C0/com_apple_MobileAsset_SoftwareUpdate/9d06af2fefdffa166ce43f4a51bf502cbaef053e.zip

https://www.theiphonewiki.com/wiki/OTA_Updates/iPhone/14.2#iPhone9.2C3

[zealous bridge]

@celest basalt not signed

i need a signed one

so one with RequestedProductVersion

ah rip need to use latest sep

[celest basalt]

oh

isn't it the same zip though just different request

[zealous bridge]

i mean that wouldn’t make sense

since anyone could just use it

ok futurerestoring to 14.1