futurerestore-help

[old coral]

okay

i got scared for a sec there

third time attempting to activate

fingers crossed

what is it activating anyway?

[zealous bridge]

your device

[low summit]

Easy

[zealous bridge]

activation lock and such

[low summit]

Activation lock?

[old coral]

lets gooo

i'm so hyped right now

I'm in

finally

I'm so greateful to all of you here, i wish I had the means to show my gratitude to all of you but unfortunately I'm not doing that great financially

so THANK YOU

ALL OF YOU

It's a very helpful community

I appriciate it very much.

[green onyx]

only a small portion of this community is good imo

[spiral bane]

[green onyx]

#futurerestore-help is always a good community

only consistent one imo

[lilac wren]

Yay

[old coral]

my interaction with every one here today was positive

[green onyx]

pog

[old coral]

i don't know about other parts of this server but futurerestore help is great

[green onyx]

its pretty good

[old coral]

i'm going to get some rest while my phone restores all it's data and apps

goodnight everyone

[green onyx]

gn

[zealous bridge]

gn

[green onyx]

btw

can i downgrade an ipad mini 1 to ios 8.4.1 without blobs?

ota is signed

latest is 9.3.5 for ipad mini 1

[zealous bridge]

i believe so

[green onyx]

how do i do this

[zealous bridge]

with pwndfu

[green onyx]

bruh

https://ipsw.me/otas/iPad2,5

hm

why is it like 1kb

wait nvm

why are there multiple of the same thing

oh wait

im dumb

oops

fuck i want an untethered for this ipad mini

idk how

u cant use itunes to downgrade ota lmao

link?

YO

wtf

poggers

[zealous bridge]

Ooh nice

[green onyx]

ye

[celest basalt]

yeah it may give you errors if you don't wait for the device to turn back on and unlock and pair

[green onyx]

what are u doing

doesnt getnonce do that

[spiral bane]

@zinc moon i found the ipod

on the fucking floor

after i eat lunch

ok i ate

its dead

charging it rn

its bootlooping

spent like 2 minutes trying to turn on then screen shut off

and its trying again

[low summit]

This second dose is killing me

[spiral bane]

how tf do i put this piece of shit into dfu

[low summit]

!t dfu

[mystic axle]

dfu

How to enter DFU mode or enter Recovery Mode on each device

Added by eric#1997 | Used 161 times · Dec 21, 2020, 11:21 PM

[spiral bane]

yeah but it doesnt work

[green onyx]

how

[spiral bane]

bc it isn’t booting

[green onyx]

is it actually painful?

[spiral bane]

its still turning on

[low summit]

Headache and like slight fever

[green onyx]

damn

[low summit]

Don't wanna eat anything either lol

[green onyx]

bruh

i just ordered food lmao

[low summit]

Lol

Enjoy it

[green onyx]

true

[spiral bane]

what food?

[low summit]

Asian?

Bro keep trying dfu lol

[green onyx]

2 wraps

[spiral bane]

i diD

[green onyx]

from tims

[spiral bane]

ic

[green onyx]

idk if u guys know what tims are

[low summit]

If you keep talking ull never be able to

[green onyx]

but ye

[spiral bane]

tim hortons wraps are good

[green onyx]

true

[low summit]

I think I do

Heard of Tim's

[green onyx]

@spiral bane are u canadian?

[spiral bane]

yes

[green onyx]

POG

[spiral bane]

[green onyx]

which province?

ontario?

[low summit]

Yo when we went to Canada for vacation the bus got a flat tire

[spiral bane]

yes

[low summit]

And we ate Tim's

[green onyx]

[green onyx]

YOOOOOOOOOOOO

toronto?

[low summit]

Lol

[spiral bane]

no

[green onyx]

damn

[low summit]

L

[green onyx]

bruh

[spiral bane]

i live in the shit stained little brother of toronto

[green onyx]

brampton?

lmao

winsor?

[spiral bane]

no

[low summit]

Niagara lol

[green onyx]

fr?

[spiral bane]

niagara is good wtf

[green onyx]

^

[low summit]

Oh fr?

[green onyx]

niagara is chill af

[low summit]

Isn't it all gambling?

[spiral bane]

no theres also a shit ton of water parks

[green onyx]

eh, niagara is fun

[spiral bane]

[green onyx]

THIS

[spiral bane]

and i think canadas wonderland is in niagara

[green onyx]

nah it isnt

[spiral bane]

or is it toronto or something? Idk

[low summit]

I remember Niagara mad casinos

[green onyx]

its in vaughan

[spiral bane]

oh

so basically toronto 2

[low summit]

Toronto got better food tho

[green onyx]

toronto is chill

i live in the suburbs of it tho

[low summit]

Mad Asians lol

[spiral bane]

i dont go to toronto often

[low summit]

In the city

[green onyx]

@spiral bane u in north york?

[spiral bane]

yeah half the restaurants i see are asian when i go to toronto

no

[low summit]

Aye

Restaurants are good tho

[green onyx]

true

[low summit]

The Asian ones

[spiral bane]

tbh whenever i go to toronto i usually end up eating at 7 eleven

[low summit]

Bruh

[green onyx]

[spiral bane]

dont judge their food is good

[low summit]

What kind of food

[spiral bane]

the roll things idk the names of those but they’re good

the ones filled with like beef

and shit

theyre good

[low summit]

Us 7 11 only got hotdogs and pizza

[green onyx]

@spiral bane u asian?

[spiral bane]

oof

[green onyx]

damn

[low summit]

Course not lol

[spiral bane]

whiter than a sheet of paper

[low summit]

Ahhh

Of course u don't like Asian food then

[spiral bane]

i never eat asian food

[green onyx]

asian food is pretty good imo

[spiral bane]

so i dont know how it tastes

[green onyx]

what do u eat normally

[spiral bane]

and i cant buy my own food

[low summit]

Try it tho

It might be good

[spiral bane]

uhh whatever my parents cook

or fast food

[low summit]

Wait how old lol

[spiral bane]

or canned/boxed food

[spiral bane]

13

[low summit]

Damn

Rip

Another 5 years b4 work

[spiral bane]

what

you can work at 14

[low summit]

Really

[spiral bane]

but nobody will hire you

[low summit]

Not in the US

[green onyx]

lmao

[spiral bane]

[green onyx]

i think 14 is newspapers

idk

[low summit]

Us is like 15

[zealous bridge]

tf is irecovery -cs

[toxic lotus]

@zinc moon what are you making?

[celest basalt]

does it

[zealous bridge]

u good

dabezt are you ok

[celest basalt]

I use ideviceenterrecovery $(idevice_id -l)

[zealous bridge]

irecovery -c is reset

irecovery -cs isnt a command

[celest basalt]

...I just tried plugging in both ends of the USB cable to my computer

[zealous bridge]

because its not in recovery

[celest basalt]

irecovery -cs doesn't do anything btw

because s is not a valid command

[zealous bridge]

it isnt a comand

dabezt is having a moment

[celest basalt]

hmm, irecovery understands both reset and reboot to mean the same thing

[zealous bridge]

you mean the shell?

[celest basalt]

yeah or with -c

[zealous bridge]

maybe reboot is an actual reboot but since auto-boot is true it goes back to recovery

[green onyx]

nah if auto-boot is false, it goes back to recovery

if auto-boot is true, it exits recovery

[zealous bridge]

oh yeah

mb

[celest basalt]

tf, I did ideviceenterrecovery a and it said no device found with UDID but entered recovery anyway

[zealous bridge]

wha

[celest basalt]

it boots back to normal mode a few seconds later though

oh wait

nvm I'm dumb

[zealous bridge]

mine doesnt do that

oh

[celest basalt]

it's looping between recovery and normal mode bc I had checkra1n open

[zealous bridge]

is this a cmd thing

[celest basalt]

yeah

[zealous bridge]

you need to put the wait command in

[celest basalt]

you can't really do command substitution like that in cmd

just do idevice_id -l separately to get the UDID

[zealous bridge]

sleep 5

[celest basalt]

and then ideviceenterrecovery UDID

[celest basalt]

that's kinda hacky, may be necessary for the reset part but for the initial enter recovery it can just poll irecovery -m

checks the current device mode

[zealous bridge]

oh true

[celest basalt]

if it's not in recovery or DFU it times out after like 5 seconds

no it does, you just have to check if the output says Recovery Mode

[green onyx]

nice udid

[celest basalt]

you just have to keep checking it until it says Recovery Mode

[zealous bridge]

lol

i leaked my ECID before

[celest basalt]

tbh using libimobiledevice binaries is a hacky solution for anything but a shell script

can't you just call C code from Swift? afaik you can from ObjC at least

[zealous bridge]

why is irecovery -c something different

[celest basalt]

then it would make more sense to call libimobiledevice functions directly

[lilac wren]

Yes and it's fairly easy

Xcode does a lot automatically

Using circuta_virosa and libdimentio in Swift was easy, yes those are C, but objc is even easier bc it will prompt to create the bridge automatically

[stiff hazel]

tell sanj to join back

sanj is neat I guess

[celest basalt]

huh, this is interesting

tried reading ApNonceRetrieve and got ERROR: Get value prohibited (-13)

ApNonce/BootNonce still works

[green onyx]

@lilac wren @zinc moon do u guys have macos 11.1 iso

im need it for vm

[lilac wren]

Do you need 11.1 specifically

I don't think you can specify a version like that in specific

At least not officially

[green onyx]

nvm i found it on archive.org

[lilac wren]

Nice from Apple itself? Usually it's only available through the Mac app store I thought

[zealous bridge]

pirated mac isos

[green onyx]

do u have the link to the one from the mac app store?

vmware only has up to 11.1

11.3.1 should work

[lilac wren]

You can only get the latest one which is 11.3.1

Oh ok I'll get it for you

[lilac wren]

Unless there's an AppStore++ for Mac lol

[green onyx]

hopefully 11.3.1 works

also archive.org throttles my connection to 0.5MB/s

and its 20gb

mhm, yep archive.org is shit

[valid adder]

At least it’s not mega, pay for premium still throttle you...

[vivid nova]

imagine paying for file hosting

[valid adder]

@vivid nova where else am I gonna distribute apple internal

[vivid nova]

[valid adder]

[lilac wren]

@green onyx can you torrent

[green onyx]

yes

@lilac wren its fine tho

imma grab catalina isos

from gibMACOS

[lilac wren]

oh ok

should I just delete it then

[green onyx]

ye, sorry about the hassle

[lilac wren]

ok nw

[green onyx]

do u still have the iso?

sorry about this

[lilac wren]

LOL

In the trash bin yes

But I have to be afk for an hour sorry

gtg

leaving computer on

[vivid nova]

isn't it against TOS to re-distribute apple's software?

[green onyx]

torrenting rn

huh

0 seeds

[lilac wren]

Drag the whole.app into vmware

[lilac wren]

Isn't it against tos to jailbreak?

[vivid nova]

bruh

[celest basalt]

C

[vivid nova]

@lilac wren i'd stop if I were you

[zealous bridge]

as long as you get it from a real mac it's fine

[lilac wren]

Ok rootfsing rn

[vivid nova]

there's other ways of getting it legit without such sketchy/unofficial methods

[vivid nova]

that logic makes zero sense

[tall siren]

no what you sent was literally illegal instead

[zealous bridge]

if you obtain the iso from the mac app store it's legal

idk about redistributing it

but thats the only legit way to "get" it afaik

[tall siren]

you can’t

it’s alright reserved

[tall siren]

yeah they have python scripts to grab it legitimately

[vivid nova]

imagine arguing about piracy, yet redistributing code is 'ok'

[tall siren]

gibmacOS or whatever

[lilac wren]

@green onyx let me know when you're done

[zealous bridge]

apple provide this service lol

[green onyx]

screw it

theres no seed

i can live

[lilac wren]

Oh ok

[green onyx]

once i have the files from gibmacos, how tf do i compile this into an iso

[lilac wren]

Yes

99% sure it can

I don't think so lol

Just have the swift call c

[green onyx]

ngl, trying to make a macos iso is more difficult than i thought

mainly bc nothing on google has this

[lilac wren]

Yes

[lilac wren]

On Mac I can just drag in the .app

[celest basalt]

wtf

❯ ideviceinfo -q com.apple.mobile.software_behavior
ChinaBrick: false
GoogleMail: false
NTSC: false
NoVOIP: false
NoWiFi: false
ShutterClick: false
Valid: true
VolumeLimit: true

ChinaBrick

huh I just realized

using ideviceinfo is much simpler than idevicediagnostics

no need to parse a plist

e.g. ideviceinfo -k ApNonce

this is interesting

SEPNonce is SHA-1 even on A10+

[lilac wren]

You really shouldn't have to

[celest basalt]

I mean yes you can cd, but for running an executable it's pointless, just specify the full path or assume it's in the default search path like /usr/bin or /usr/local/bin

oh this is very nice

if I use ideviceinfo the device doesn't even have to be unlocked

it works on BFU

chdir("/foo/bar");

but like I said you probably won't need it

tbh just start off by calling the libimobiledevice binaries first like you planned to

interfacing with libimobiledevice in native code isn't that trivial

you can port that to your thing once I figure out how to do it all properly myself for getnonce

I do have some partially working code but it's WIP

[lilac wren]

Does this set generator to random + freeze nonce then?

[celest basalt]

yes

[zealous bridge]

can ideviceinfo do BootNonce?

[celest basalt]

yes

now I get why I didn't have to pair the device when I was trying with C

there are two ways to obtain these values

ask lockdownd directly, which doesn't require pairing

[zealous bridge]

oh wow

[celest basalt]

or start the diagnostics relay which requires pairing, and then use MobileGestalt

[zealous bridge]

thats way easier then

is it in b64?

with ideviceinfo

[celest basalt]

yes

well values like ECID are returned as normal decimal numbers, but nonces are in base64

I wonder if you can access ApNonce/BootNonce from a sandboxed app on the device itself

I don't have a Mac to build an app

but it's basically like MGCopyAnswer(@"ApNonce")

@zealous bridge ok nvm I was kinda wrong, lockdownd does require pairing, it just works on BFU if the device was already paired before

while diagnostics_relay/mobilegestalt requires unlocking first every time

[zealous bridge]

oh that makes more sense

[celest basalt]

❯ idevicepair unpair
SUCCESS: Unpaired with device [REDACTED]
❯ ideviceinfo -k ApNonce
ERROR: Could not connect to lockdownd: Password protected (-17)

[zealous bridge]

still that’s easier than gestalt

[celest basalt]

ERROR: Could not connect to lockdownd: Pairing dialog response pending (-19)

still requires unlock and pairing

but somewhat better

actually no wait

ideviceinfo -s might be able to avoid it

yep

unpaired device and rebooted, works on BFU

❯ ideviceinfo -s -k ApNonce
3V5aKWobGKAMZkY+YSjq9G/TiFgIgsEU2DXmyBe2tJg=
❯ ideviceinfo -s -k BootNonce
wTSRBLJCJbU=

rebooting the device still requires pairing though

[zealous bridge]

and if you try dimentio those values match up?

[celest basalt]

and entering recovery on 14.5+

values seem to match up still

I need some A12+ jailbroken testers to see if ApNonceRetrieve actually works properly, that would make the script even quicker if it doesn't have to reboot

[zealous bridge]

well i have my AES key but don’t know how to encrypt it properly :(

[celest basalt]

you can just use dimentio

[zealous bridge]

i’m on 14.4 sadly

[celest basalt]

oh rip

[zealous bridge]

actually i forgot to save literally any of the screenshots i took of it

[zealous bridge]

ik the steps

but idk how to do it with openssl

[celest basalt]

update: iOS is annoying

sometimes ideviceinfo -s won't work on BFU

[lilac wren]

That's literally my post copy pasted with no credit

[celest basalt]

because it suddenly decides the lightning cable is an "USB accessory"

[lilac wren]

-_-

[celest basalt]

and it says "Unlock iPhone to use accessories"

[zealous bridge]

that always happens to me?

i cant use a usb cable without unlocking

like ever

[lilac wren]

@celest basalt trying it with an app right now.. can only read things like HardwarePlatform but ApNonce, BootNonce is all just nil. On computer I can still get ApNonce and stuff

[celest basalt]

hmm

[celest basalt]

good to know

[lilac wren]

Obfuscated keys work as well, ApNonce still no luck

[valid adder]

@celest basalt how should we go about fixing pwned on mac

properly this time

[vivid nova]

dylibs = .dlls

there's no ext afaik, it operates as a unix executable

[valid adder]

apple is Darwin-XNU

iOS macOS TVOS WatchOS all use darwin

Darwin executable format is Mach-O

Windows uses Portable Executable

Aka PE

@zinc moon

Yw

Yes of course

If you don’t want an external library eg dylib or dll, use static lib

Don’t call commands from executables

Posix static lib is .a file

Windows static lib is .Lib

So just build libirecovery

And link against it

[zealous bridge]

@valid adder are you familiar with the nonce entanglement process on A12+

[valid adder]

all I know is that it can be accessed via AES engine

[zealous bridge]

ok so say theoretically if i have the AES key

could i use something like openssl to encrypt the generator

[valid adder]

yes but stuff like this takes years

for example, we didn't get the hardware a4 key, yes a4 until 2021

[zealous bridge]

what if i had the one specific to my device (encrypting 0x568241656551e0cdf56ff84cc11a79ef with the UID key)

i could theoretically use that to encrypt any generator right

like it says here

[valid adder]

Im almost certain the hash is the one being "entangled"

let me lay out the nonce info

[zealous bridge]

this explains it well

[valid adder]

apple file
wrapped by IM4P header containing name and desc
IM4M is the shsh blob file containing firmware signatures, the IM4M also contains the BNCH which is the apnonce meaning hash of the nonce. The nonce itself is BNCN which is basically a generator value. However BNCN is stored in IM4R

Now IM4P, IM4M, and IM4R are all stored together and wrapped in ASN1 DER format in the IMG4 header

so then what siguza said, you take the bytes(BNCH) apnonce and encrypt it with UID
then take BNCN nonce and pad it then do another encrypt then the final result is the hash

[zealous bridge]

yeah ok

so what am i doing wrong here

[valid adder]

paste that here

[zealous bridge]

echo 00000000000000001111111111111111 | xxd -r -p | openssl enc -aes-128-cbc -nopad -nosalt -K 72deca3fb43507da4882a5a46a991c37 -iv 0 | sha384sum | head -c 64

[valid adder]

xxd is the issue

failing before u even left the ground lol

dont use echo either

because you are adding a newline

[zealous bridge]

i mean

[vivid nova]

too many pipes imo

[zealous bridge]

this works

so idk why it wouldnt work for openssl

[vivid nova]

-nosalt -nopepper

[zealous bridge]

but i could try with a file

[valid adder]

dude

shasum384 is being ran on newline

because xxd has no output

[zealous bridge]

ok lemme try with a file then

[vivid nova]

do you really need to state iv as '0' when there's no key?

[zealous bridge]

there is a key

[vivid nova]

no.. i mean there's no iv key

[zealous bridge]

@valid adder this newline?

[zealous bridge]

if i try exclude it it says "iv is required"

[vivid nova]

or just -iv

'cause -iv 0 is telling it the key is 0

[zealous bridge]

the iv is supposed to be NULL

which is the same as 0

[vivid nova]

i don't think that works in an arg statement

[zealous bridge]

well this works

@valid adder the result is the same

even if i'm encrypting from a file

oh shit

i forgot about endianness

oh wait

[valid adder]

why are you reversing

[zealous bridge]

that shouldnt matter for this generator

[valid adder]

why -r

@zealous bridge

[zealous bridge]

you need to

[valid adder]

why tho

[zealous bridge]

no idea but the output isnt the same if you don't

@celest basalt can probably tell you why

same shit

[zealous bridge]

if you build it then sure

how what

make

and make install

why would you download a zip file

just git clone it

you need ./autogen.sh first

you may need sudo for make install

why don’t you just package a static binary

@zinc moon it might already be in the blobsaver beta

idk i’m just saying

making something for fun is one thing ig but why recommend it to other people when there’s easier options

because it’s not in blobsaver yet? you probably have to manually compile to get the feature

but if you read the thing i said in the guide anyway

i already said once this is in mainline blobsaver this method is useless

@zinc moon oh bruh it’s been a month and it still isn’t in the beta

carry on doing what ur doing lmfao

are you open sourcing the code

[celest basalt]

damn, I bootlooped my phone

[zealous bridge]

how?

[celest basalt]

Devise

the tweak

[zealous bridge]

Dualboot?

[mystic axle]

Divisé

arm64 Dualboots/Tethered Downgrades on device! — Divisé is a Coolbooter-esque app which is capable of arm64 Dualboots and Tethered Downgrades, all from within the app! Checkm8 is used to tether boot the second OS, after dualbooting/tether d

Author

moski

Version

1.1.1

Price

Free

Repo

Dynastic Repo

Add Repo

Click Here

More Info

View on Parcility

com.moski.Divise • Page 1/1 · May 9, 2021, 8:16 AM

[celest basalt]

well technically dualboot

yeah

I have a mac

well an old mac but still

yeah

I already tried

as soon as the duelboot finished everything froze and it looked like it was respringing but then I get a constant apple logo

[zealous bridge]

join the bootloop club

[celest basalt]

yeah..... thankfully I saved onboard blobs so I'm fine

[zealous bridge]

ota or ipsw?

[celest basalt]

ipsw

[zealous bridge]

are you sure

how did you tell anyway

[celest basalt]

yup, the last time I updated was from another bootloop

[zealous bridge]

oh

does img4tool say theyre valid with a ipsw buildmanifest?

[celest basalt]

They were when I checked them

uh

WTF

I just plugged it up to my mac and the checkra1n exploit initiated

the app isn't even open

nope

[zealous bridge]

lol

[celest basalt]

but Ramiel will allow me to do that

yeah

checkm8 nonce setter is made by the same guy

so he included it

yeah it can also dump blobs for the version your at... I wonder if that would work rn

ah alright

[zealous bridge]

it probably would

onboard blobs are on a different partition

/dev/rdisk1

[celest basalt]

hmm

damn checkm8 keeps failing

[valid adder]

@zealous bridge literally impossible just use python at this point

[zealous bridge]

oh how would i do that

is there commoncrypto for python

[celest basalt]

yk Ramiel and devise are kinda weird because it makes you download the ipsw on both

[zealous bridge]

https://pypi.org/project/CommonCryptoLite/

this should work

[valid adder]

no

[zealous bridge]

huh why not

there's already one

!t libimobiledevice

[mystic axle]

libimobiledevice

Windows: https://github.com/libimobiledevice-win32/imobiledevice-net/releases
macOS: brew install --HEAD libimobiledevice libirecovery
Linux: https://cadoth.net/~nyuszika7h/libimobiledevice-static-linux/

Added by nyuszika7h#0001 | Used 17 times · Apr 6, 2021, 11:27 PM

[zealous bridge]

https://github.com/libimobiledevice-win32/imobiledevice-net/releases/download/v1.3.17/libimobiledevice.1.2.1-r1122-osx-x64.zip

its in there

not really

you don't need brew install

yes it does

i wonder what "libimobiledevice" means here

[celest basalt]

-r is for reverse (convert hex to binary)

[celest basalt]

idk I don't have a Mac so can't really mess around with it...

also isn't technically possible to downgrade to 13.7 on A11 without blobs using devise since it doesn't need the baseband and only needs the SEP and its compatible all the way down to 13.5?

[mystic axle]

libimobiledevice

Windows: https://github.com/libimobiledevice-win32/imobiledevice-net/releases
macOS: brew install --HEAD libimobiledevice libirecovery
Linux: https://cadoth.net/~nyuszika7h/libimobiledevice-static-linux/

Added by nyuszika7h#0001 | Used 18 times · Apr 6, 2021, 11:27 PM

[celest basalt]

idk

maybe if you do it without --HEAD it won't need it but idk if that version can enter recovery on 14.5

ah, but ofc it would be possible to dualboot as it is with any checkm8 device

[celest basalt]

not really, Apple fucked with some things

iOS 14.1 was the last version that was able to dualboot 13.7

[celest basalt]

Oh I didn't know that

would it be possible to dualboot 14.3 and 14.5? @celest basalt

probably, haven't tried

[zealous bridge]

fuck python guess imma have to do it in swift

trying to use commoncrypto and failing

[celest basalt]

you could probably use pycryptodome

[valid adder]

@zealous bridge

@celest basalt ez

[valid adder]

at least get it working properly on linux with no issues or slowdowns

[celest basalt]

well, we do need to fix the iBoot nonce patch kinda

after it sends pwned iBEC the device just reboots and doesn't reconnect

iBoot panic

when you re-enter pwndfu and try again the nonce matches though

[valid adder]

we already have nonce patch

[celest basalt]

yeah the patch works just need to run it twice

[valid adder]

demotion patch only works on 14 for a11 atm

[celest basalt]

oh also DFU times out while it's extracting the IPSW

running again once extracted works for that too

but it was pain at first

[valid adder]

it shouldn't need to be run twice

[celest basalt]

I wouldn't even care if the actual restore worked

[zealous bridge]

I got that as well

But taking a shasum of it doesn’t give me the right BNCH

[valid adder]

where is UID from

[zealous bridge]

got aes key from dimentio

i was literally working on that lol

[valid adder]

lol

mine is just cli

[celest basalt]

smh just use mystring.hex() and bytes.fromhex()

makes no difference just one less import

[zealous bridge]

exact same result

as openssl

[valid adder]

wym from dimentio

[zealous bridge]

dimentio grabs AES 0x8A3

to hash the nonce

[valid adder]

what value did you use for UID

[zealous bridge]

i think it just runs through the aes engine

i didnt grab the UID

i dont think you even can

[valid adder]

then how is this going to work

[zealous bridge]

you don't need the UID key specifcially

[valid adder]

true

[zealous bridge]

you just need the UID encrypted with that random constant

which i have

[valid adder]

we dont have uid

but we have the step 2 grabbed via dimentio?

[zealous bridge]

yeah

which gives you a correct result if you use CCCrypt

[valid adder]

can you send the correct apnonce

[zealous bridge]

sure

0x1111111111111111 - 0337b781d620fb77f55ad47dedff79346c4fca231bc833f61b79beb1dd8b3c1b

i have a thought

do we substring the result we get from AES before we shasum?

judging by this we dont

[valid adder]

@zealous bridge even openssl doesn't work

meaning the key is wrong

can you send full dimentio output

[zealous bridge]

i’m not jailbroken anymore

[celest basalt]

plistlib is actually pretty pog btw

automatically parses values into the correct type

[zealous bridge]

i need to try commoncrypto since thats what dimentio uses anymore

but idk how to

[celest basalt]

not related to the encryption stuff just saying

[valid adder]

this literally makes zero sense

[zealous bridge]

can you write something in swift/C to use CCCrypt instead of openssl?

i really thing it’s to do with the NULL iv

https://stackoverflow.com/questions/27014292/cccrypt-decrypting-in-aes-cbc-works-even-without-iv

the IV is probably wrong

so we need a NULL iv which you can only do with CC

[lilac wren]

Gm

[zealous bridge]

gm

[lilac wren]

@zealous bridge Conan has a program to take AES 0x8A3 and generator into AP nonce

You could ask him for the sample

[zealous bridge]

ooh does he

@topaz solar pls?

wait is it on his github

[lilac wren]

Not sure

Lowest I've seen, 12.1.4 O_o
#818879231772983357 message

[zealous bridge]

wow

https://github.com/0x7ff/golb

might be this

this is to dump keys n shit

[valid adder]

the key must be wrong then lol

@zealous bridge

[zealous bridge]

rip

thats weird

can someone confirm that the third key in dimentio output is 0x8A3?

cant even try this cause i'm on 14.4 now

[valid adder]

dude

the key is way larger

its a struct

[zealous bridge]

did i shorten it

[valid adder]

prob not

[zealous bridge]

lemme check autofill since i dont even have it saved

isnt AES-128-CBC key supposed to be 0x20 tho?

that should be right

[valid adder]

fixed it gg

[zealous bridge]

wait what

[zealous bridge]

yooo

tf did you do

[valid adder]

made it a uint32_t array

[zealous bridge]

oh lmfao

see i knew i wasnt buggin lol

tysm tho

[valid adder]

that was way to complicated lol

garbage code

@zealous bridge what now lol

[zealous bridge]

nonces are substringed to 64 btw

[valid adder]

yep

[celest basalt]

The guide says do not enable the “Update (-u)” checkbox in the GUI when downgrading from 14.5 or later. Why can’t I?

[zealous bridge]

because you'll be in a recovery loop

[zealous bridge]

can you do that with openssl

then

or nah

auto pads nice

[zealous bridge]

btw

[valid adder]

64 now

[zealous bridge]

this is only gonna work for symmetrical generators

because of endianness

[valid adder]

no u cant do it with openssl its uses byteswap

[zealous bridge]

rip

[valid adder]

so basically we need to get the proper key from the device

because dimentio prints it out wrong

[celest basalt]

14.6 to 14.5 is probably fine (not tested), but going to 14.4.2 or lower is not

[valid adder]

just need a dimentio patch

to fix it for openssl

[zealous bridge]

oh

can you not convert the key that it gives now into something that can be used with openssl

[valid adder]

3FCADE72DA0735B4A4A58248371C996A

[zealous bridge]

what did you do to it

oh

[valid adder]

every 8 characters byteswap

[zealous bridge]

got asymmetrical generators working

[valid adder]

I think im done for now

wym

[zealous bridge]

if you do echo with a generator that isnt symmetrical

[valid adder]

why is the key different

[zealous bridge]

it'll mess up the endianness

and give you a wrong hash

[zealous bridge]

?

[valid adder]

nvm

why didn u pu 00000

lol

[zealous bridge]

cba

same output anyway

[valid adder]

openssl enc -aes-128-cbc -nopad -nosalt -K 3FCADE72DA0735B4A4A58248371C996A -iv 00000000000000000000000000000000 -in decrypted.txt -out encrypted.txt

is harder to pipe with that error

[zealous bridge]

-iv 0 is the same as -iv 0000000000000000000000000

yeah true

i think we can suppress errors tho

[valid adder]

00000000000000000000000000000000 fixes it

@zealous bridge which tool gives the wrong hash for that

[zealous bridge]

lemme show you

[valid adder]

remove newline from echo

[zealous bridge]

same thing

even if you hexedit a file with those bytes

if it's big endianness it'll give you wrong hash

this is how you fix it

[zealous bridge]

yep thats wrong

[valid adder]

just use the converter

yes

[zealous bridge]

@valid adder wrong again

i dont think your script converts endianness

well it does but it converts it to UINT32 - Little Endian (e.g. DCBA)

i need something like CD AB

[valid adder]

my script is for uint32[4] flipping only

so nonce wont work

only 128 key

[zealous bridge]

thought so

like this but with the zeroes in front of the number

[zealous bridge]

works but not for already padded ones

[valid adder]

intentional

idc

its 16 char max

[zealous bridge]

oh fair

[valid adder]

if it had padding it would put the padding on the end lol

[zealous bridge]

true

finding a12+ apnonces without jb

yes but you can use any generator

instead of whatever is randomised

[lilac wren]

I mean you still need jb

[zealous bridge]

yeah to get AES key

after that its fine

[celest basalt]

you only need the AES key if you want to get the apnonce for a specific generator

and you need a JB to set the generator to a specific value, but not to just get a valid apnonce/generator pair now

unless Apple patches it in a future version

ApNonceRetrieve already says "Get value prohibited" on A11, so they might as well end up patching it ¯_(ツ)_/¯

[zealous bridge]

true

but as long as you have the AES key you can always save blobs

[celest basalt]

not sure if iTunes ever needs to get the BootNonce from lockdownd

[celest basalt]

that or just one valid apnonce/generator pair

[zealous bridge]

you can also use it to confirm pairs you get from getnonce

i think

[lilac wren]

This ^ lol

[zealous bridge]

huh

with the aes key you could get the apnonce for any generator

[lilac wren]

Yeah what's the point

[zealous bridge]

there isn’t any

[lilac wren]

exactly

[zealous bridge]

but nyu said it was only one pair?

or did he mean in practice

[lilac wren]

Nyu said you really only need one pair to save blobs. Responding to this

[zealous bridge]

ik that

lol

[lilac wren]

exactly

[zealous bridge]

i just said this matter-of-factly, i didn’t say it was practical

just that you could

[lilac wren]

oh ok, that was known though... thought you were figuring something out idk

[zealous bridge]

yeah we figured out how to do it with openssl

Well cryptic did

and whatever he said about dimentio not displaying it properly

pretty cool

[low summit]

Gm

[lilac wren]

gm

[low summit]

Finally recovered

[lilac wren]

of covid vaccine?

[low summit]

Yea

Thx God

[lilac wren]

1st or 2nd dose lol

[low summit]

2nd

[lilac wren]

yikes

my 2nd was awful

[low summit]

Basically body was hurt all over

[zealous bridge]

in?

Oh we had to reverse endinanness

[low summit]

How many fr help yesterday?

[green onyx]

gm

oh

theres a new r/jb banner

[zealous bridge]

wonder what thats abt

[green onyx]

damn

macos vm on vmware kinda laggy lmao

probably bc its unsupported amd hardware

[zealous bridge]

need a kvm for stability

[green onyx]

too much work

way to much work

for a kvm

[low summit]

Kvm?

[green onyx]

ye

im using vmware rn

ngl, i wish i had intel hardware

like fr

i had a choice between 60hz display and intel or 120hz display and amd

i picked the amd one

i didnt think too far

[low summit]

lol intel

[old coral]

why do i have 2 files in my blobs for 14.4.2?

How do I know which one to pick?

[zealous bridge]

Use the one on the left

[old coral]

okay, but why are there two?

[zealous bridge]

different generators

just how tss saver does it

[old coral]

right

so the one on the right doesn't work?

or is it more complicated than that

[zealous bridge]

it does

but the left one is just easier to use

[old coral]

okay, thanks

[valid adder]

@zealous bridge did I miss anything

[zealous bridge]

nah you’re good

[valid adder]

Coolio

That was pretty fun ngl

[zealous bridge]

lol

ive been working on that for like weeks

didnt know it was a key issue

[mystic axle]

libimobiledevice

Windows: https://github.com/libimobiledevice-win32/imobiledevice-net/releases
macOS: brew install --HEAD libimobiledevice libirecovery
Linux: https://cadoth.net/~nyuszika7h/libimobiledevice-static-linux/

Added by nyuszika7h#0001 | Used 20 times · Apr 6, 2021, 11:27 PM

[zealous bridge]

on what platform

git clone the repository, configure it then run make and make install

rip

statically yes

but if you want static just download the binary from libimobiledevice-net

no

just package the binary

what no

[zealous bridge]

its not a .bin lol

it doesnt have a file extension

it’s just a binary

it’s in /usr/bin but you can’t use that

[green onyx]

nice nickname lmao

[zealous bridge]

irecovery

🤦‍♂️

bruh

just run ls /usr/bin | grep irecovery

then idk where tf ur path is

try just run ls /usr/local/bin | grep irecovery

Can you run irecovery normally?

then it’s compiled fine

you can’t use that binary tho

because it’s not static

If you compile it from source then it’ll put some files in /usr/include and /usr/src which it depends on

from libirecovery?

then it’s dynamically compiled

not static

you have to configure gcc to compile it statically

which is confusing and long

well on windows it’s long asf

[celest basalt]

you may have to use clang instead of gcc

some deps compile fine with gcc but others need clang

[zealous bridge]

There’s already a working static binary why do you need another one

in libimobiledevice-net, i think i’ve said that about 4 times now

on the github

I’ve linked it like what 3 times now

yes

on linux just put it in cron

¯_(ツ)_/¯

Releases

yes

👏

🏅 this is for you

finally he found it

call it in your program

[green onyx]

lol

pog

i got a catalina vm and realized i couldnt use it to get xcode

ye but i deleted it and tryna get big sur rn

apple dumb

ngl, i wish i had a macbook

or an intel cpu

unsupported hardware

which is why i need an intel cpu

yes

ryzen laptop

with nvidia gpu

and intel wifi

all my hardware is unsupported

[spiral bane]

[royal flint]

intel wifi is supported

well

newish

[valid adder]

Ryzen laptops aren’t supported afaik

[zealous bridge]

@valid adder btw if you change byte order to little and add 16 zeroes at the end instead of the beginning then it works for all generators

[valid adder]

Wtf I clicked this channel right as your message sent lmao

[zealous bridge]

lmaoo

[valid adder]

Smart

Yeh I was already doing little

For the other one

[zealous bridge]

oh ok

there should be a way to pad it to the start instead of the end tho

[valid adder]

I’ll fix stuff later

[zealous bridge]

cool i'll see what i can do in the meantime

[green onyx]

@zealous bridge can u setup a macos kvm with a ryzen cpu and a turing gpu?

[zealous bridge]

you should be able to yes

[green onyx]

vmware is taking a shit with macos

[zealous bridge]

idk abt gpu passthrough tho

[green onyx]

hm

[zealous bridge]

ik it works with nvidia gpus

havent tried it with turings tho

i dont see why they shouldnt

[green onyx]

well

turing isnt supported on macos

[zealous bridge]

neither is nvidia

[green onyx]

pascal is, up to high sierra

[zealous bridge]

lol wen eta vega support

[green onyx]

it is supported

vega 10

i think

[zealous bridge]

Oh

I have Vega 8

but iGPU

[green onyx]

i have vega 10

but iGPU

[zealous bridge]

you can get nvidia drivers on macos

[green onyx]

i cant

i have a gtx 1650

turing, not pascal

pascal doesnt even support big sur

and ryzen cpus for laptops arent supported

[zealous bridge]

Turing GPUs (GTX 20xx, 16xx) Highest Supported OS:NONE

Unfortunately no support in any version of MacOs as no drivers were ever written even for High Sierra. Not much else to add.

sad

But wait

How tf did Linus get a 1080 working

on kvm

[green onyx]

thats pascal

not turing

[zealous bridge]

Oh

1070s too ig

[green onyx]

yep

i regret so much

for buying this laptop

[trail parrot]

Hi.

[zealous bridge]

Hello

[trail parrot]

Yo buddy @zealous bridge