#futurerestore-help

1 messages · Page 186 of 1

green onyx
stiff hazel
#

now that is genius-like

zealous bridge
#

dw i’ll give the credit to the owners by adding @ Geniuses to the end of every message

valid adder
#

Dead chat

lilac wren
lilac wren
#

I have the perfect amount of blobs that just fit on one page

green onyx
#

u have ios 13 blobs?

#

damn

lilac wren
#

Yeah but this is A12

#

So pwndfu won't work

green onyx
#

r/jb telegram bot?

lilac wren
#

Yeah

#

Well it's just jb telegram bot

#

Shsh host basically

shy magnet
#

gm hotties

shy magnet
lilac wren
#

Yeah arx8x Incorporated

valid adder
#

Good evening chaps

#

Wow dead chat

valid adder
#

@lilac wren wake up mf

lilac wren
lilac wren
valid adder
#

wym

lilac wren
#

Wow that emoji is

#

Something else

valid adder
#

its a classic

#

sad it died

lilac wren
#

Lol

#

I'm just happy you're here

valid adder
lilac wren
#

I appreciate you ❤️

valid adder
#

ty ig

#

@rustic blaze just let me know if 204 works or fails

#

I want to fix 32bit

rustic blaze
#

I found v 194 om m1sta github

#

cant find 204

#

sharing the log

#

this iphone 5 is a gsm model

#

for sure'

valid adder
#

Takes 3 seconds

rustic blaze
#

????

#

Sorry but a dumb question

#

How do we find the model number of a iPhone

#

Settings about tapping the model number doesn’t do anything

valid adder
#

settings > about > Model Name, Model Number

#

@rustic blaze

rustic blaze
#

@valid adder did u happen to check the log

#

It’s saying invalid ap ticket

ebon mirage
#

posible downgrade ios 14.5.1 to 12.1 with shshblob? iphone 6S?

valid adder
#

What log?

#

@ebon mirage you can’t go below 13.4

ebon mirage
valid adder
#

@rustic blaze what log

#

doubt it

#

14.2 sep allowed me to go to 13.7

#

even on a11

#

but since 14.3 we have the sep panic

#

yes

#

X

#

baseband was incompatible and I think I used the wrong savagefw accidently

lilac wren
#

This movie all I remember is everyone saying "he's gone savage!!"

#

Lmho

valid adder
#

@zinc moon savage is the faceid firmware

lilac wren
#

ō = long o sound

#

Otherwise o = "aww"

#

Like in octopus

rustic blaze
#

I shared a log

#

Trying to downgrade with v194

valid adder
#

no because I used the wrong savage @zinc moon

rustic blaze
#

It stopped at invalid ap ticket

#

@valid adder

valid adder
#

@rustic blaze 32bit is still broken idk how to fix that but Ill try

lilac wren
#

I meant like in phonetics... ō = long o, any vowel with a line on top = long sound

zealous bridge
#

gm

lilac wren
#

Oh lol

rustic blaze
#

But u said u will fix it

lilac wren
rustic blaze
#

Any way to downgrade

#

32 bit

zealous bridge
#

5am lol

rustic blaze
#

With valid blobs

zealous bridge
lilac wren
#

Why is apple signing those random firmwares ota lol

valid adder
#

its wildly known

rustic blaze
#

Let me try iOS ota downgrade

zealous bridge
#

Something about the millennium bug iirc

#

For 32-bit

lilac wren
#

I thought it was because the jump was too big

#

I remember my aunt's ipad I upgraded from ios 7 to 10 like 3 years ago and it had to OTA to 8 first

#

Something like that

#

Maybe it was 8 -> 9 first before 10

zealous bridge
#

yeah everyone has to

lilac wren
#

iTunes showed the correct one though

zealous bridge
lilac wren
#

I'm hopefully getting 8 hours if I go to bed right right now so gn everyone!!

zealous bridge
#

gn

lilac wren
#

Good night Cryptic we love you

zealous bridge
#

This came up in my feed and I think this is fitting

#

not really

#

for A14 maybe

#

Delayed OTA: Am I a joke to you?

lilac wren
#

Delayed ipsw eta when :(

zealous bridge
#

😭

#

oddly specific

#

technically the device doesn’t boot when it’s at 0% so is that a bootloop

#

literally no energy is required for the low battery screen to be displayed

#

but phones do shut down with a tiny bit of charge left at least

#

After there’s no more charge to turn on it won’t

#

well unless you’re on a blackberry

#

shared cellular network

lilac wren
#

No sim card can call 911 so long as it's cellular capable right

zealous bridge
#

At least in the UK

#

you can call from any WiFi/Cellular device

lilac wren
#

What's 911 in the uk

zealous bridge
#

999

lilac wren
#

333 or something right

#

Oh ok

zealous bridge
#

My sister works there

lilac wren
#

Ooh that's cool but a bit scary

zealous bridge
#

Stressful lol

#

And a bit chilling

lilac wren
#

Yeah I could never do that

#

Respect

zealous bridge
#

makes about 23£ an hour tho

#

good pay especially on a low level

foggy hull
#

Did i brick my iphone? It bootlooped and I tried to futurerestore (no success), tried dfu restoring through itunes (no success) also checked for all windows updates, tried using a macbook to restore (10.15.7). the phone always reboots itself to recovery during first seconds of restore. The last thing i did it with my phone was restoring rootfs with taurine

valid adder
#

tf

zealous bridge
#

You’re using OTA blobs for an IPSW restore

#

Use idevicerestore from DFU mode

lilac wren
#

With --erase and --latest

zealous bridge
#

dont wake him up

#

lol

valid adder
#

joes mother

zealous bridge
#

still awake?

valid adder
#

me?

zealous bridge
#

yes

valid adder
#

its 1230am

#

not that late

zealous bridge
#

Oh

#

Keep forgetting America has dimensionally different time zones

valid adder
#

I guess thats how they thought the sun works

#

aparrently the sun also changes up on you

stiff hazel
#

It’s 2:35 AM for me

valid adder
#

they change their clocks every so often

#

I didn't know the sun magically jumps

zealous bridge
#

lol ikr

outer junco
#

i tried to restore but its giving me an unable to place device in restore mode and crashes

#

after "restorekernelcache"

#

now the device wont boot anymore and default goes into recovery mode

#

this is on a mac

zealous bridge
#

what version of futurerestore

outer junco
#

180

zealous bridge
#

why so old

outer junco
#

dunno

zealous bridge
#

use the updated one

outer junco
#

its the one at the root of github repo

zealous bridge
#

no

outer junco
#

hmm

#

guess im on the wrong one

#

wheres the right place to download

zealous bridge
#

who hasnt

outer junco
#

im on this one

zealous bridge
#

old

outer junco
#

ah ok

zealous bridge
#

You boutta bootloop everyone

#

How is clicking on “Update iPhone” gonna restore the phone?

#

downgrading sometimes bootloops especially if it’s from 14.5+ down to 14.5-

#

never know when apple bricks their /var compatibility

#

the point is the fact that it happened means it could happen again

#

this tutorial isn’t only for now

#

If you’re gonna make them do a backup

#

Just tell them to restore

#

no tell them to click restore instead of update

#

Also

#

It isn’t Alt + Click

#

You have a mac and you still don’t know

#

It’s Option + Click

#

yes

outer junco
#

hmm

#

i updated and its suck in waiting for device to disconnect

zealous bridge
#

Ys

#

Yes

#

You’ll get an error in about 5 seconds

#

Just run futurerestore again

#

@zinc moon ys

#

that button is option

#

Idk

outer junco
#

is it supposed to be like that

zealous bridge
#

Whats the futurerestore output

outer junco
#

waiting to reconnect?

#

and its stuck on failed to put in restore mode

zealous bridge
#

what device is this

zealous bridge
outer junco
#

the 8

zealous bridge
#

what version

#

hmm

mystic axleBOT
#
dimentio

PoC tool for setting/getting nonce without triggering KPP/KTRR/PAC. (requires tfp0)

Author

0x7ff

Version

2.0.0-1

Price

Free

Repo
Add Repo
More Info
zealous bridge
#

2.0.0-1

#

lol

#

lol

#

what is nonce_d

#

fucked up the output

#

!t libimobiledevice

mystic axleBOT
valid adder
#

I’m assuming digest

celest basalt
#

btw Siguza said that nvram/dimentio working on checkra1n as mobile is probably a bug

valid adder
#

Inb4 policy update

green onyx
#

tf is happening

#

also

#

pog ios 15 coming in 1 week

lilac wren
#

If you hold fn and press it it's alt I think

#

Gm

zealous bridge
#

you slept for

lilac wren
#

I think

#

How long uh

zealous bridge
#

6?

#

7?

#

idk

lilac wren
#

7 + 30 min

#

Time to read everything in the gc

green onyx
#

lol

rustic blaze
#

Downgraded using iOS ota downgraded script

#

Fantastic work

zealous bridge
#

Congrats

rustic blaze
#

By luke

zealous bridge
#

Nice to know that still works

rustic blaze
#

Yep

green onyx
#

pog

lilac wren
#

Can we do OTA downgrader manually

#

By just getting OTA blobs with a tss request

#

And then using pwndfu in FR

#

Oh but SEP and BB

#

Does pwndfu use the SEP from blob or how does that work

zealous bridge
celest basalt
lilac wren
#

How does OTA downgrader work then

celest basalt
#

you could save the OTA blobs if you want to reuse them with pwndfu, but at that point why not just use tsssaver or tsschecker to get them

zealous bridge
celest basalt
lilac wren
#

Oh ok

celest basalt
#

I think that might be it, or maybe it's just compatible

zealous bridge
#

to make it untethered

lilac wren
#

Yeah that makes sense

celest basalt
#

well, actually yeah since it's still being signed, it can just request fresh SEP/BB ticket with whatever nonce

lilac wren
#

So you probably couldn't use FR then

celest basalt
#

but I think it may work even without that because people were saying to save 10.3.3 OTA blobs

zealous bridge
#

Do you think 15 will support A9?

lilac wren
#

Is that 6s

celest basalt
#

probably not but idk

#

some of the legacy devices/iOS versions didn't even have regular OTA downgrade prevention, but I think 10.3.3 already needs a specialized tool... not 100% familiar with legacy stuff

lilac wren
#

iPhone 6s had ios 9? Lol wow

celest basalt
#

you used to be able to quite literally spoof systemversion and downgrade with OTA

zealous bridge
#

Lol

#

Well Deon did that on 14

celest basalt
#

I think iOS 10 or 11 blocked that, and maybe the introduction of SEP also had a part in breaking that

zealous bridge
#

Might be more recent than we think

#

If deon is to be believed

celest basalt
#

not sure but I've seen multiple threads on reddit

#

saying OTA downgrade (from settings) doesn't work anymore, from years ago

#

and people mentioned iOS updates and SEP breaking it

zealous bridge
#

Something doesnt match up then

lilac wren
#

Nooo not intune lol

#

My boy Scott from Airwatch has me covered

zealous bridge
#

Rip

zealous bridge
brazen thicket
#

when that 14.5.1 jb comes out can i just futurerestore with my blobs or do i have to downgrade normally

celest basalt
brazen thicket
#

okay. i’m on a10 so i’ll just wait for it to come out and maybe i’ll futurerestore.

lavish pulsar
#

Hi! Can i ask how to get jb on iphone 11 ios 14.5.1?

zealous bridge
#

And don’t ask here

keen bay
#

Hey can someone help me please? I'm on iPhone XS on Chimera. I have 14.3 blobs saved from a while ago and I've finally decided to upgrade/Futurerestore from iOS 12.0 to 14.3 before jailbreaking again.

I followed this guide: https://www.reddit.com/r/jailbreak/comments/m0r24m/free_release_futurerestore_gui_a_userfriendly/ but got "Device ApNonce does not match APTicket nonce" error once I started the Futurerestore.

I then following this guide: https://ios.cfw.guide/futurerestore#getting-started and got to step 3 "Once the command executes, a lot of text should appear" which didn't happen.

zealous bridge
#

try login as root

#

run su

#

the password should be alpine

#

then just run dimentio 0x111111111111111 or whatever it is

valid adder
#

probably have the wrong or outdated dimentio

keen bay
#

yup have tried that

#

do you guys know the best dimentio repo?

#

the one mentioned on that guide seems to have been taken down

zealous bridge
keen bay
#

so i installed a random one on reddit

zealous bridge
#

it hasnt

keen bay
#

weird, let me check again

#

yeah its not there for me 😫

zealous bridge
#

Remove the one you already have

keen bay
#

yep have done so. let me try refresh sileo app

zealous bridge
#

Do you want a link to the deb

keen bay
#

ahhh still not there

#

yes please (although i may need some help from there)

valid adder
#

this is why you refresh sources

#

also use the search in the bottom right

keen bay
#

i refreshed, removed source, re-added, searched, everything haha. its very strange

#

thanks!

#

do i download/open that on phone?

zealous bridge
#

Yeah you can just import it to sileo

#

what

#

didnt know root was called dimentio

valid adder
#

why hasn't this mf responded to my github reply yet...

#

this pissed me off

green onyx
#

lol

zealous bridge
#

lol

#

told you

valid adder
#

mf's post an issue on github then leave never to return

green onyx
#

reaching back to ppl on discord is easier imo

valid adder
#

hey can you fix my stereo? then they leave and never pick up the fixed stereo

valid adder
#

@zealous bridge fixing it was murder because the brand doesn't let the manufacturer hand out schematics or parts so it ended up costing double the original msrp to begin with

#

#righttorepair

#

I can't believe I just got mad at a hypothetical situation

#

lmao

zealous bridge
zealous bridge
keen bay
zealous bridge
valid adder
#

Im saying I can't believe I went on a rant complaining about something that never happened

zealous bridge
#

Just a mildly aggressive speech

zealous bridge
#

rip

soft turtle
#

iPod Hi-Fi was a speaker system that was developed and manufactured by Apple Inc. and was released on February 28, 2006, for use with any iPod digital music player. The iPod Hi-Fi retailed at the Apple Store for US$349 until its discontinuation on September 5, 2007.

zealous bridge
#

Lmfao

#

Just dont get caught

soft turtle
#

Ew where’s the ublock origin

valid adder
#

theres the problem

#

you aren't using firefox

zealous bridge
valid adder
green onyx
soft turtle
#

An actually good adblocker

green onyx
#

the best adblocker

#

doesnt have outdated shit

zealous bridge
#

i dont get it whats wrong with macos safari

green onyx
#

always updated

valid adder
#

these are the addons yall should get

soft turtle
#

Instead of the garbage Adblock [plus]

green onyx
#

also open source

zealous bridge
#

bro how do you not know ublock origin

soft turtle
#

I like Safari

green onyx
zealous bridge
#

i made all my teachers dl that straight away lol

valid adder
#

@soft turtle do u have these yet

green onyx
green onyx
zealous bridge
#

imagine using the internet

zealous bridge
#

Open source >>

soft turtle
valid adder
#

@green onyx lastpass family, I don't pay for it

#

same with spotify

green onyx
#

and its open source

valid adder
#

@green onyx but lastpass does what I need it too

zealous bridge
#

on the internet

green onyx
#

oh, its manifest v3 KEKW chrome is dogshit

green onyx
#

switched to firefox when manifest v3 came out

soft turtle
#

I still use LastPass without paying also

valid adder
#

@soft turtle you will get buttfucked soon

soft turtle
#

I just never updated the LastPass app on my phone so I don’t have to deal with the device restrictions

valid adder
#

lastpass will eventually kick in the trial end

green onyx
soft turtle
#

I’ve been using LastPass for years

valid adder
#

it will let you transfer between mobile and desktop a maximum of 5 times

#

when the end trial kicks in

#

then you are stuck on that platform until u pay

soft turtle
#

Yeah it doesn’t know that I’m transferring because I haven’t updated the app

celest basalt
#

see that's why you use bitwarden, it's free and unlimited

celest basalt
#

only paid thing in it is the option to store 2FA codes in bitwarden too, for $10/year

soft turtle
#

It probably is better but im too lazy to switch

celest basalt
#

no it doesn't

zealous bridge
#

BitWarden has migration from LastPass lol

celest basalt
#

<@&557588738881093648>

zealous bridge
#

I’m pretty sure I’ve seen it

soft turtle
#

That would make it much easier

green onyx
celest basalt
#

yeah bc that's pingable

celest basalt
#

I used to use an online password manager called Mibbit, then another one called Passpack, then I went to LastPass, 1Password and now Bitwarden

#

well and KeePass too at some point (local)

soft turtle
#

I wish there was a native app for bitwarden, don’t want to add yet another electron app

soft turtle
#

It’s electron

green onyx
#

damn fr?

celest basalt
#

they use Xamarin for iOS, for desktop I just use the Chrome addon

zealous bridge
#

better than UWP

green onyx
#

uhh chrome

zealous bridge
#

I think the english language did

green onyx
#

^

soft turtle
zealous bridge
#

Count your lucky stars JTV hasn’t seen this yet

soft turtle
zealous bridge
#

I think it’s been used before in security research before iOS jailbreaking was a thing

green onyx
zealous bridge
#

I’d rather Electron than UWP on Windows

green onyx
#

true

#

UWP is trash

#

its slow af

zealous bridge
#

And you need to download it from the Microsoft Store

green onyx
#

swiftui > uwp

soft turtle
#

yup

#

wait actually we can get a native bitwarden app

#

since the xamarin mobile app is open source, we can compile it for desktop or catalyst i think

zealous bridge
#

@green onyx have you ever tried gaining permissions of a file in a UWP app

#

shits a nightmare

green onyx
zealous bridge
#

you have to takeown the entire WindowsApps folder

green onyx
zealous bridge
#

Even elevevated users cant del files inside uwp apps

#

I had to go to Linux and mount it that way

green onyx
#

isnt it stored in system32 or smthn?

#

idk

zealous bridge
#

ProgramFiles lol

green onyx
zealous bridge
#

for minecraft it's C:\Program Files\WindowsApps\Microsoft.MinecraftUWP_1.16.10004.0_x64__8wekyb3d8bbwe\data, gl tryna get into that tho

green onyx
soft turtle
#

wonder how hard it would be to port that to macos then

green onyx
soft turtle
keen bay
#

i got all of the dimentio/newterm terminal to work as expected (ran scripts etc). im running futurerestore again but still get this error. im using chimera so i used "0xbd34a880be0b53f3". any ideas? 😩

green onyx
#

hide ecid

keen bay
#

okay cool, do i select my current ios version or my blob ios version

green onyx
keen bay
green onyx
#

uh

#

what device is this?

zealous bridge
#

yeah uh im guessing you saved with blobsaver v2.X or the tss saver website without a generator?

#

@keen bay try doing 0x1111111111111111

keen bay
green onyx
#

gg

#

@keen bay what ios version are u on?

keen bay
keen bay
zealous bridge
green onyx
#

when u saved those blobs

zealous bridge
#

If 0x1111… gives you the same error you’re probably screwed

keen bay
green onyx
keen bay
zealous bridge
#

you can use this to do it faster

green onyx
#

chimera might not have set nonce properly during jb

zealous bridge
#

it’ll prompt you to choose a generator then it’ll check if it matches

#

just make sure you have openssh

lilac wren
#

(optional) Use a jailbreak tool or nonce setter on your device to set the generator; this will allow you to use the blobs even if your device's nonce changes.

zealous bridge
#

if neither of the defaults work you’re probably screwed

lilac wren
#

The nonce changes every reboot unjailbroken...

#

This was not optional lol

zealous bridge
#

I hated blobsaver before lol

green onyx
lilac wren
#

I almost did blobsaver lol bc I was too lazy to get a generator nonce pair

#

Before I realized what it was

zealous bridge
#

when 14.3 jb first came out

#

at least 50 people got their nonces fucked up (in this channel)

keen bay
#

okay cool thanks! ill look into it, im a noob at this 😫 already sounds like headache

green onyx
#

the chimera app?

keen bay
#

yep

zealous bridge
#

yeah probably not the best idea

#

if you use the shortcut i gave you it’ll do it properly

soft turtle
keen bay
lilac wren
#

Probably bc they set generator

soft turtle
zealous bridge
#

lol that makes no sense, nonce means to use only once, apnonce was designed to change every reboot

lilac wren
#

I'm so lucky I used tss saver and got valid 14.3, getting ap nonce generator pair was a nightmare back then

keen bay
#

okay thanks guys. have to head out for a bit but ill try again later

zealous bridge
#

maybe tomorrow

#

Tuesday is sometimes unsigning day

soft turtle
#

For some people at least

zealous bridge
#

yeah if we did a controlled experiment right now i would back what i said to win lol

#

probably circumstantial

stiff hazel
#

They might not be unsigning it because it’s Memorial Day

zealous bridge
#

also maybe most of them were using checkra1n and had generator set in nvram, persists even when unjb

celest basalt
#

I mean getting nonce in normal mode sets a random generator which causes it to freeze until one of the following:

  • device is rebooted AND another apnonce request is made in normal mode (iTunes/OTA update check, or manual igetnonce/etc.)
  • device is restored or updated
zealous bridge
#

blobsaver used nonce from recovery

celest basalt
#

generator persists when unjailbroken regardless of the jailbreak, just might reset in the above cases

zealous bridge
#

which doesn’t cause a freeze

celest basalt
#

that alone doesn't if they used v2.x, but if it was already frozen before for some reason then...

celest basalt
#

it's possible that even just downloading an OTA update freezes your nonce 🤔

soft turtle
#

Yeah I never did a large amount of testing on it so idk

celest basalt
#

idk if there's anything in place to clear it if the user doesn't actually end up updating, or maybe it's only set when you press install

soft turtle
#

It worked fine for my friends who had a12 and a lot of other people who messaged

zealous bridge
#

they would’ve been one time use blobs anyway

soft turtle
#

So I posted that hoping there would be a chance it would be usable

zealous bridge
#

so that’s probably why

soft turtle
#

Better than no blobs at least is what I was thinking when I posted

green onyx
#

ppl save blobs for long term tho

#

for "future"restore

zealous bridge
#

well still a very different impression you gave out tho

green onyx
#

doesnt matter, blobsaver 2.0 was a mess and thats it

#

blobsaver 3.0 is good imo

soft turtle
#

I agree though I should have been clearer about what exactly it was, that was a mistake

#

Already on homebrew

green onyx
#

its there

#

lol

zealous bridge
#

Thats how nonces work

lilac wren
#

Not even one use

#

0 use

#

Unless you stay in recovery until 14.3 comes out

soft turtle
green onyx
#

guys

#

we should stop arguing

#

and let it pass for airsquared imo

#

its fine

zealous bridge
#

yeah that’s probably because they had a generator set somehow, i can’t think of any other way lol

zealous bridge
#

I’m just explaining how nonces work and why that method of saving blobs was kinda wack

soft turtle
#

They never jailbroke before so idk how they had a generator set but idk

green onyx
#

idk

#

i felt like everyone was attacking airsquared

#

mb

zealous bridge
#

all good lol

soft turtle
zealous bridge
#

Nah the specification is either GSM or Global

celest basalt
#

just use read from device

zealous bridge
#

which is done with device identifiers

#

so you don’t rly need board config

soft turtle
#

Here is the map

celest basalt
#

don't some of them have multiple boardconfigs

zealous bridge
#

yeah they’re commented out

#

like 6s

soft turtle
#

Yeah if it’s not in the boardconfigs file it will ask for a boardconfig

zealous bridge
#

yes

#

It doesn’t use OTA manifest that’s why

valid adder
green onyx
valid adder
#

inside joke

green onyx
#

how did he get it to 5.1.1

#

with blobs?

valid adder
#

the joke isn't related to the downgrade at all

green onyx
#

yes ik

#

oh wait

zealous bridge
celest basalt
#

lockdownd_get_value("HardwareModel")

#
❯ ideviceinfo -k HardwareModel
D221AP
valid adder
#

wen Advanced Comedian role

zealous bridge
#

TSSchecker doesn’t need the board config unless it’s for devices with multiple ones

#

Just the device ID does it

valid adder
#

tsschecker is trash

#

kinda but hasn't even got off the ground

green onyx
#

ios for ATV?

zealous bridge
#

lol

celest basalt
#

yeah Apple TV 3rd gen wasn't tvOS yet

#

officially iOS 8.x for Apple TV is called "Apple TV Software 7.x"

vivid nova
#

because it's Apple

#

not really

#

there's still the + services..

#

atv2 eol

zealous bridge
#

Another webkit exploit for 14.6

#

tf

#

14.6 is vulnerable

#

don’t know about 14.7 beta

#

probably might

green onyx
#

ios 14 is ripe for webkit based jailbreaks

zealous bridge
#

there’s a couple that can be used for 8.00 to 8.03 jbs iirc

#

dk about the latest version

#

still needs a kernel exploit

celest basalt
#

just different exploit method

green onyx
#

weird enough that webkits dont work on ios 14.5- but work 14.5+

zealous bridge
zealous bridge
celest basalt
#

that's because the feature that introduced the bug was added in Safari 14.1 (iOS 14.5)

#

iOS 14.6 has 14.1.1 but still vulnerable

green onyx
#

help

#

how do i upgrade my safari

#

without updating my ios /s

zealous bridge
#

safari blobs eta wen

green onyx
#

yo what

zealous bridge
#

told you

#

geosn0w boutta be like NEW EXPLOIT JAILBREAK

#

14.6 RIGHT NOW

green onyx
#

lol

zealous bridge
#

(Safari Jailbreak)

#

Yeah maybe it won’t be unsigned today

#

One more day bois

soft turtle
celest basalt
#

oh nice

#

was too lazy to check the code and my iPX doesn't have multiple boardconfigs for the same device code so

soft turtle
#

Oh lol

soft turtle
#

I only then have to update the properties file

valid adder
#

dead chat

lilac wren
#

At least you're alive

valid adder
#

Lmao my dog licked my phone and she hit the home button which switch apps because swipe right

green onyx
lilac wren
#

Lol my dog paws the keyboard on my laptop and either writes junk or presses enter, sending a half written email or something lol

soft turtle
#

i want a dog that can code for me

lilac wren
#

At that point you just hire someone lol

outer junco
#

how can i put a iphone 8 into dfu mode from off state

lilac wren
#

!t dfu

mystic axleBOT
outer junco
lilac wren
#

Take it to an Apple store

outer junco
#

nnono like

outer junco
#

shows apple logo for a few seconds

#

goes black

#

turns off

#

repeat

lilac wren
#

Then go to dfu

outer junco
#

yea thats what im asking lol

lilac wren
#

Lol then do it

outer junco
#

the instructions said to do it and i saw a video for it but the demo was when the phone was on

#

and when i try that when its off it doesnt workk

#

just gets into the same loop

lilac wren
#

Dfu always works

#

You just need to get the timing right

#

Try it when the phone is in the bootloop instead if you want

solemn dome
# outer junco shows apple logo for a few seconds

your bootloop describes a problem I had with my 8 plus about a year ago, for me restoring in iTunes fixed it
sure, I lost the data that was on it at the time, but at least I had a working phone again after that

#

you don't have to restore if you don't want, but restoring is what fixed it for me

valid adder
#

That’s why you have auto backup

outer junco
#

the boot is completely broken on it lol

outer junco
#

and the error codes list says nothing about it

solemn dome
valid adder
#

Why didn’t you recommend idevicerestore

#

iTunes is useless software

solemn dome
celest basalt
#

hello

#

I am getting this error

#

ERROR: tss_send_request: Unhandled status code 162

solemn dome
valid adder
#

Never use iTunes after a restore fail

toxic lotus
#

idevicerestore ofc

lofty ginkgo
#

Use idevicerestore

toxic lotus
#

also never use idevicerestore on windows

celest basalt
#

I am getting this error when it is downloading baseband ERROR: tss_send_request: Unhandled status code 162

lofty ginkgo
#

That way if it does end up failing you can see what happened/where it failed which could be of some help, instead of a random error code

celest basalt
#

TSS server returned: STATUS=162&MESSAGE=An internal error occurred.

outer junco
#

did brew install openssl and it worked

#

but autogen still says missing

#

is there a place to download a compiled version

rich shell
#

i have blobs saved for 14.4, how would i go from 13.3 to 14.4? would i need to update normally to 14.6 and then go to 14.4 with blobs?

#

really?

#

i am on a12

#

i am waiting for the webkit jailbreak

#

and i have no other blobs

#

i already saved blobs for 14.5.1

#

is there a way to update with blobs without restoring

#

yeah ok then

celest basalt
#

Hey man I am upgrading to 14.4 from 14.2 using future restore but it’s giving me this error TSS server returned: STATUS=162&MESSAGE=An internal error occurred.

zealous bridge
#

Also what futurerestore version

celest basalt
#

I’m on v194 and network is good

zealous bridge
#

Lol googling futurerestore first result is tihm

celest basalt
#

Yes I’m on iPhone 12

zealous bridge
#

@celest basalt A14 doesn’t work rn

celest basalt
#

Ah fuck well thanks

#

I know jailbreaking just isn’t really for me and I want to be able to play nvidia gforce now

#

But I did wanna be able to try that WebKit jb so yeah

zealous bridge
#

@celest basalt Mac or Windows?

celest basalt
#

Mac

zealous bridge
#

Try the futurerestore in pins

celest basalt
#

Wdym?

zealous bridge
#

v204

#

the futurerestore in the pins

#

ripbozo

vivid nova
#

what generator do you set when there's no generator?

#

actually.. yes. Given the apnonce is saved and the device is set on that nonce

zealous bridge
vivid nova
#

indeed, hopefully the user(s) didn't

#

I don't think succession resets it...

zealous bridge
#

it shouldn’t

#

doesn’t really touch nvram

vivid nova
#

then in that case.. my point above is still valid

zealous bridge
#

could’ve at least explained the apnonce error but eh

vivid nova
#

I didn't want to make it a 5-minute read

#

just keep it simple

zealous bridge
#

theres a difference between keeping it simple and omitting inportant info

vivid nova
#

there's also a difference between getting to the point and elaborating on every "what do you mean.."

zealous bridge
#

wdym

vivid nova
zealous bridge
#

Pretty random

vivid nova
#

i've never used an apnonce blob

#

generators always worked

zealous bridge
#

uh

#

wot

#

you realise a blob isn’t valid without an apnonxe

vivid nova
#

indeed

#

there's two kinds

zealous bridge
#

noapnonce blobs have an apnonce lol

#

they’re just stupidly named

#

because noapnonce is almost always 0x1111….

vivid nova
#

and funny enough.. ATV refuses to use the apnonce ones

#

it /needs/ the generator

zealous bridge
#

The generator list for the apnonce blobs is in the pins

vivid nova
zealous bridge
#

btw conan recently nuked noapnonce blobs so you’re stuck

#

ofc

vivid nova
zealous bridge
#

True

vivid nova
#

yes

#

I've made a tweak that saves them

#

have yet to update it...

full osprey
#

No, that’s for Aaron

#

I could actually but that question is more for Aaron

#

Or Eric

lilac wren
#

@zealous bridge question nonce stayed the same after restore from recovery mode even in iTunes right

zealous bridge
#

yes if it was in nvram before

lilac wren
zealous bridge
#

No

lilac wren
#

Lol gonna try dfu on my A12 rn guys

#

/a

zealous bridge
#

.

lilac wren
#

Wait why can’t FutureRestore work from DFU

zealous bridge
#

DFU nonce is different to normal nonce

#

(The normal nonce is what we save APTickets for)

lilac wren
#

For real?

#

It just ignores generator or what

zealous bridge
#

Don’t believe me try irecovery -q

#

in recovery + DFU

lilac wren
#

Oh ok will do

#

Will it reset generator

zealous bridge
#

Test it

#

You won’t update anyway

lilac wren
#

Ok

zealous bridge
#

Recovery won’t

#

DFU not tested but i’m sure it won’t

#

Wen eta DFU nonce setter

#

That’d be something for Cryptic to reverse engineer

#

Don’t believe anyone’s looked at it before

#

At least not on modern devices

celest basalt
#

"DFU nonce setters" just kick you into recovery so yeah

zealous bridge
#

Yeah it’s not really the “DFU nonce”

celest basalt
#

actually I think checkm8-nonce-setter doesn't even modify the normal apnonce, it just boots up a patched iBEC/iBSS with changed nonce

#

because IIRC if I reboot after checkm8-nonce-setter the nonce resets

zealous bridge
#

it loads a ibss without the generator blacklist in nvram

#

so we can just setenv

#

pwndfu exists

#

Hopefully someone updates pwndfu with checkra1n’s implementation of checkm8 so it becomes much more reliable

#

they are very different

#

axi0mx’s implementation is so old and finnicky

#

checkra1n team improved it a lot but it’s closed source lol

lilac wren
zealous bridge
#

yeah theres like 4 nvram variables blacklisted from recovery mode

#

boot-nonce being one of them

lilac wren
#

On VMWare I had to set sip nvram variable, but misspelled by 1 letter and then edit it in some weird mode to make it right

zealous bridge
#

Oh it’s a whitelist

#

Lmfao

#

yeah how would only 4 variables be blacklisted

#

👏

#

lol wot

lilac wren
#

What are the 4 then

#

Auto boot is 1 right

zealous bridge
#

Yes

#

Bootdelay is another

lilac wren
#

Breadcrumbs or something as well right

zealous bridge
#

need to look on iboot

#

yes

lilac wren
#

iboot wouldn’t tell me

zealous bridge
#

and probably backlight

lilac wren
#

Printenv doesn’t work

zealous bridge
#

breadcrumbs, backlight, auto-boot and boot-nonce

#

info about what’s happening in the bootloader

#

normally thats what it means

lilac wren
celest basalt
#

well, the thing is

zealous bridge
#

oh yeah

#

i mean

#

boot-breadcrumbs, backlight-nits, auto-boot and backlight-level

celest basalt
#

I 100% remember updating my XR via an IPSW to the same version and it definitely cleared my generator

#

but that generator was set by requesting apnonce in normal mode

#

idk if that makes any difference

zealous bridge
#

lol we need nvram unlocked to know for sure

lilac wren
#

Yeah tb said it only happened in recovery

zealous bridge
#

Ofc

#

Normal mode would overwrite

celest basalt
#

the way I know it cleared my generator is I ran noncestatistics in recovery before and after - before it was generating a constant nonce, after it was random on every reboot

zealous bridge
#

we need someone to test dimentio then recovery mode restore

#

It makes sense for the apnonce requested in normal mode to be cleared after a restore, the way apple implemented it however shit it is it’s meant to be cleared after a restore

lilac wren
#

@green onyx do you have an A12+ device on latest you can just restore to latest to test something

#

or an A12+ you can FutureRestore with

zealous bridge
#

He finally stopped going thru time

#

(uwu)

lilac wren
#

YAY

#

lol

zealous bridge
#

A12+?

zealous bridge
#

if you can get him ¯_(ツ)_/¯

#

oh yeah

lilac wren
#

yay

green onyx
#

whats happening

#

why do u need a latest guy

zealous bridge
#

Yeah, if you have 14.3 blobs (and this works) you can go back

#

Who said anything about latest

#

I just said recovery mode restore

green onyx
#

guys

#

actually

#

someone fill me in

#

why do u need a latest guy

#

ah

lilac wren
green onyx
#

ah

#

ok

#

thank you for informing me

lilac wren
#

but we don't want to FutureRestore bc that's risky for no reason

#

wait

zealous bridge
#

wot

lilac wren
#

we could use getnonce to set generator nvm this will work

zealous bridge
#

Nyu said it didnt

#

Like 5 minutes ago

lilac wren
#

nyu did from normal mode they said

zealous bridge
#

ok

#

?

#

what does getnonce do

lilac wren
#

you just said it didnt work from normal mode lol

lilac wren
zealous bridge
#

no it doesnt, it freezes nonce by requesting one from normal mode

#

literally all itunes restores use getnonce, but without grabbing the generator

lilac wren
#

yeah by setting random generator

#

lol

zealous bridge
#

no lol, it doesn’t set anything

lilac wren
#

it does and even returns the generator it set

#

in mobilegestalt

zealous bridge
#

the boot-nonce is never set directly

#

lol he’s having a moment

lilac wren
zealous bridge
#

ok so how does getnonce set it

lilac wren
#

like OTA

#

OTA sets a random generator

zealous bridge
#

all it does is idevicediagnostics mobilegestalt ApNonce from normal mode

#

which requests a random apnonxe

#

which is exactly what happens in every restore from normal mode

lilac wren
#

and sets a random generator at the same time

#

guys is this not how it works

#

@celest basalt

#

please lol

#

I'm like 90% sure that it sets a random generator

#

otherwise how would nonce stay the same after reboots

zealous bridge
#

the nonce is frozen

#

That’s why

lilac wren
#

there's no 'frozen' nonce as far as I'm aware

celest basalt
#

what

lilac wren
zealous bridge
#

froggy’s having a moment understanding getnonce lol

lilac wren
#

when you request apnonce in normal mode

#

it sets a random generator

celest basalt
#

yes, if you request an apnonce in normal mode, it sets a random generator in nvram

if you request it again in normal mode without rebooting, it won't change the apnonce/generator, but if you do it again after a reboot it will

lilac wren
#

LOL

#

guys

#

see

#

🧠

celest basalt
#

how would getnonce get a generator if there was no generator fr

zealous bridge
#

nvram is never directly touched lol

lilac wren
zealous bridge
#

dimentio does

lilac wren
#

it sets a random generator in nvram

zealous bridge
lilac wren
celest basalt
#

well yeah, of course the OS handles the "set random generator" part and you can't control what the value will be but...

lilac wren
#

Nyu just proved exactly what I said lol

#

yeah

celest basalt
#

it does have an effect of freezing the nonce but that's because of the generator

lilac wren
#

^^

#

like I said, there's no "freezing" nonce just setting a generator

#

Lol

#

oh lol

#

Thanks nyu

#

guys you're being like JTV, confidently incorrect lol

zealous bridge
#

lmao

#

there’s a difference which is proven

#

that’s my point lol

lilac wren
#

and that's besides the point lol

zealous bridge
#

lol

lilac wren
#

says the guy saying 'froggy see a doctor' lol

lilac wren
celest basalt
#

requesting one from normal mode resets it
that's because the normal mode request overwrites the existing generator

lilac wren
#

guys I gotta do my theology final let's talk later

lilac wren
#

like the weird apple oversight thing in iOS 14

zealous bridge
#

yeah

celest basalt
#

another interesting thing I just found: requesting apnonce in normal mode overwrites dimentio generator but not the generator that was set by requesting apnonce during the same boot

zealous bridge
#

which means its the same as getnonce

#

requesting an apnonce from normal mode

#

forget generator for now

celest basalt
#
  • sudo dimentio 0x1111111111111111 -> 27325C8258BE46E69D9EE57FA9A8FBC28B873DF434E5E702A8B27999551138AE
  • ideviceinfo -k ApNonce -> 47b4ecb8a1a7b2a413ac6e8c9a257256687b6d13f71024acb3f136f39a8d733f
  • ideviceinfo -k ApNonce -> 47b4ecb8a1a7b2a413ac6e8c9a257256687b6d13f71024acb3f136f39a8d733f
  • reboot
  • ideviceinfo -k ApNonce ->
    f8b983c53bbb1a748f6efe536c06934b857394fff9bc69a1f054d651f125123d
  • ideviceinfo -k ApNonce -> f8b983c53bbb1a748f6efe536c06934b857394fff9bc69a1f054d651f125123d
zealous bridge
#

lol

#

well it’s probably because iTunes requests it multiple times during the same boot

#

so it can’t change

#

otherwise restore is invalid

lilac wren
#

it's weird

celest basalt
#

wait

#

I fucked it up

#

there

#

it probably checks "was apnonce already requested" rather than "is generator set" before overwriting

zealous bridge
#

lol this whole time i was trying to say that maybe dimentio isn’t the same as requesting apnonce from normal mode

lilac wren
zealous bridge
#

which would be tested by the restore

#

soo

lilac wren
#

it was already set to 0x111 supposedly

zealous bridge
#

yeah reading out what’s in nvram probably isn’t gonna affect anything

lilac wren
#

but again, it doesn't seem like it's actually doing; this can be proven by running dimentio no args, the output stays the same

celest basalt
#

you can use nvram -p instead of dimentio if you don't trust it

#

on checkra1n at least

#

not on u0/Taurine iOS 14

lilac wren
#

ah at the time of testing I couldn't bc A12

zealous bridge
#

not on A12+ TrollFront

celest basalt
#

makes no difference though

zealous bridge
#

dimentio probably uses nvram directly

lilac wren
zealous bridge
#

if it can

#

otherwise it does that whole KPAC bypass

celest basalt
#

ok now this is funny

#

looks like requesting apnonce in normal mode won't touch the actual generator at all if it was already set during the current boot

lilac wren
#

yeah that's what I said

celest basalt
#

ideviceinfo and dimentio now disagree on what the nonce is

zealous bridge
#

nvram is probably right

celest basalt
#
❯ ideviceinfo -k ApNonce | base64 -d | xxd -p -c256
6368d701c4cc189430ea6804ef916293cd8c4186996e3b0eb4477236c743bbb9
iPhone-X:~ mobile% dimentio
nvram_entry: 0x1307
Current nonce is 0x1111111111111111
nonce_d: 27325C8258BE46E69D9EE57FA9A8FBC28B873DF434E5E702A8B27999551138AE
iPhone-X:~ mobile% nvram -p
boot-args
auto-boot       true
com.apple.System.boot-nonce     0x1111111111111111
[...]
lilac wren
#

ideviceinfo seemed to be just spewing a random nonce

#

but the question is

celest basalt
#

I think lockdownd just caches the apnonce value after the first request on each boot

lilac wren
#

what triggers with dimentio when you do 0x1111 again that allows apnonce key to be triggered again

celest basalt
zealous bridge
#

yeah it’s not like there’s any “generator_set” variable

celest basalt
#

so it doesn't really trigger anything again

#

it just doesn't check the nvram after the first request

zealous bridge
#

doesn’t that mean that apple know when the generator is set

celest basalt
#

and uses the cached value

zealous bridge
#

meaning getnonce was on purpose

lilac wren
#

i was planning on spamming that thousands of times to see if collision exists lol

celest basalt
#

you can't spam it in normal mode to collide

zealous bridge
#

Collision only worked because the device tended to generate different apnonces more than others

lilac wren
#

i mean not to collide

#

spam apnonce

celest basalt
#

well, what you're saying doesn't work for me

lilac wren
#

idk why

#

ill try later today

celest basalt
#

normally the only way to collide is to clear generator and keep rebooting in recovery

zealous bridge
#

lemme try that