futurerestore-help

[lilac wren]

yeah but wanted to see if collisions existed in request normal mode ap nonce

[celest basalt]

hmm, the nvram_entry dimentio prints is not always the same

[zealous bridge]

this happens to me too

[celest basalt]

I wonder what happens if I killall -9 lockdownd

[zealous bridge]

dimentio now says 0x1111... but ideviceinfo is now giving me the pre-dimentio apnonce

[lilac wren]

reminds me that someone said to delete lockdownd in r/jailbreak

because their friend was wiping their phone every day

:|

[celest basalt]

the answer is nothing

same nonce being returned still

but isn't overwritten

[zealous bridge]

what happens if we delete nvram

would it still be cached

[lilac wren]

guys

dimentio keeps saying it's only 0x1111

but yeah works for me

[zealous bridge]

A12+ moment probably

[lilac wren]

this was

1. apnonce key
   1a. dimentio plain, showed that it was still set to 0x111
2. dimentio 0x1111
3. apnonce ley

dimentio says it's still 0x111

[zealous bridge]

@lilac wren doesnt this prove

that setting in nvram

is not the same as requesting normal mode apnonce

[lilac wren]

nah I think they're the same

it's just setting generator either way

[zealous bridge]

how is this explained then

[celest basalt]

lol dimentio output is still spammy if you have no nonce set

anyway, lockdownd still happily returns the cached apnonce even with no generator set

[lilac wren]

just with apnonce key it checks if a generator already existed or something so it doesn't overwrite

what nyu said

[lilac wren]

I don't think the phone was expecting generator to magically disappear before it rebooted lol

[zealous bridge]

and this doesn't work on A12+ because again nvram is still not directly accessed by us

[celest basalt]

❯ ideviceinfo -k ApNonce | base64 -d | xxd -p -c256
6368d701c4cc189430ea6804ef916293cd8c4186996e3b0eb4477236c743bbb9
❯ ssh iphonex dimentio
nvram_entry: 0xA07
Current nonce is 0x1111111111111111                                              
nonce_d: 27325C8258BE46E69D9EE57FA9A8FBC28B873DF434E5E702A8B27999551138AE
❯ ideviceinfo -k ApNonce | base64 -d | xxd -p -c256
6368d701c4cc189430ea6804ef916293cd8c4186996e3b0eb4477236c743bbb9
❯ ssh iphonex nvram -d com.apple.System.boot-nonce
❯ ssh iphonex dimentio
[...]
You have to set nonce first.
❯ ideviceinfo -k ApNonce | base64 -d | xxd -p -c256             
6368d701c4cc189430ea6804ef916293cd8c4186996e3b0eb4477236c743bbb9

[lilac wren]

what lol

[...]
You have to set nonce first.
Lol I wanna see all the ... just for dimentio to come to that conclusion

[zealous bridge]

dimentio on cra1n is basically just nvram com.apple.System.boot-nonce=whatever

[celest basalt]

https://termbin.com/8bc57

[zealous bridge]

when that happens ideviceinfo doesnt give us the correct nonce anymore

wait

so does this mean

if we set it in nvram

then do itunes from normal mode

it won't reset

🤔

[lilac wren]

Like I said above, I believe that setting generator in normal mode is different from restoring from normal mode

so I don't think this will make a difference

but you can try

[zealous bridge]

alr

[celest basalt]

I think you have to request apnonce at least once before running dimentio to avoid it resetting to something else

[zealous bridge]

lets try

[zealous bridge]

maybe

[celest basalt]

I would totally expect iTunes to fail there though

requests an apticket with the wrong nonce and the device is like lolnope

[lilac wren]

oh yeah true

[zealous bridge]

why am i doing this on A11 smg

did you try DFU nonce btw @lilac wren

[lilac wren]

no lemme finish my theology final lol

[zealous bridge]

so early

[lilac wren]

I literally stayed here just to prove you two (@zinc moon) wrong >:(

but hopefully you get how getnonce works now lol

[zealous bridge]

lol idk why you care about the generator so much, my main point was dimentio =! requesting apnonce (A11- at least)

[lilac wren]

no lol, it doesn’t set anything

:|

[zealous bridge]

well

the python script doesnt

the device does

[lilac wren]

...

lol

we're all still learning but IM NOT I NEED TO TAKE A TEST

cya

[zealous bridge]

gl

i will test this when my A9 wakes up from slumber

[lilac wren]

no

just for you to not be a JTV lol

...

always trust the frog

why doesn't apple just make all nonces like bcert

so that they expire

[split torrent]

👀

[zealous bridge]

bruh

[lilac wren]

when you accidentally update to latest (i wish)

[zealous bridge]

Lol

Why are you still here do your finals

[lilac wren]

yes

[zealous bridge]

rip i broke my charger

wot

[lilac wren]

well yes, thanks google

[zealous bridge]

lol is my time wrong

oh wait

I thought 19:00 was 9pm

[lilac wren]

this is the most satisfying thing ever
http://cubictime.ru

ok ok ok

finally it's not CooCoo lol

[zealous bridge]

i forgot ideviceinfo can read out nvram

[lilac wren]

can it read com.apple.boot nonce though

[zealous bridge]

yes

[celest basalt]

hmmmm

let me do some tests

it cannot read boot-nonce from nvram unjailbroken

[zealous bridge]

well what did you expect

[celest basalt]

actually this could still be useful though

as a way to detect jailbroken devices

[zealous bridge]

yep

[lilac wren]

only if they set generator

and i assume this doesn't work in ios 14 jbs non checkra1n

[celest basalt]

yeah, that's the idea

someone confirm if it shows boot-nonce on A12+ iOS 14 or not pls

[lilac wren]

ill do it

from recovery mode or what

[celest basalt]

no

normal mode

[zealous bridge]

just query ideviceinfo

[celest basalt]

ideviceinfo -k NonVolatileRAM

[zealous bridge]

or that

[lilac wren]

no I have auto boot, backlight, boot args, boot breadcrumbs, com.apple.System.tz0-size, and usbcfwflasherResult

[celest basalt]

and dimentio shows nonce set?

[lilac wren]

lemme check

[celest basalt]

boot-nonce reappeared after rejbing with checkra1n btw

[lilac wren]

yes

[celest basalt]

hmm so this is actually useless for getnonce/blobsaver, rip

because A11 and below can just use 0x1111111111111111

[zealous bridge]

how does 3u detect if a device is jailbroken or not?

[celest basalt]

good question

anyway checking BootNonce first for a known generator still works, but has the potential to fail if it's your first time jailbreaking and haven't rebooted yet after the jailbreak first set nonce

but anyway it will just fall back to getting a random pair then, no big deal

only an issue if you bootloop

[zealous bridge]

we can just do ideviceinfo and then check nvram

[celest basalt]

we just established it only works with checkra1n

[zealous bridge]

[lilac wren]

is he referring to frgui or irestore bc both show output

idk

[celest basalt]

ApNonceRetrieve might solve this problem actually

I just don't want to tell airsquared to change it without testing on multiple devices/SoCs first to see if it really works well

because the BootNonce thing seems more established to work on all devices, even A11- (where it is irrelevant, but good for testing)

[lilac wren]

oh is this cached on boot or something

[celest basalt]

yeah BootNonce means the generator that was used when the device booted

[lilac wren]

ooh ok

[lilac wren]

does this even do anything or exist lol, I messed with this key and didn't get it to do anything

[celest basalt]

ApNonceRetrieve on A11- returns nothing (or sometimes returns a totally wrong value), on A12+ it seems to be up to date generator value without rebooting

if I use libimobiledevice directly from C, lockdownd_get_value("ApNonceRetrieve") returns an error saying Get value prohibited on A11

ideviceinfo just outputs nothing, and idevicediagnostics just says success

[zealous bridge]

gonna see if iTunes fails

[lilac wren]

yeah I get no value from it

ideviceinfo -k ApNonceRetrieve right

[celest basalt]

yeah

[zealous bridge]

@lilac wren just tried an iTunes restore, irecovery -q still shows the dimentio output

[lilac wren]

from dfu or what

[celest basalt]

what device

[zealous bridge]

from Recovery

[lilac wren]

A12 XR

[celest basalt]

hmm weird

what if you request ApNonce first and then try again

[lilac wren]

ok you set generator with dimentio, restored from recovery, and nonce is still set

didnt we know that

[zealous bridge]

I can safely assume this is false

[lilac wren]

oh is this A12+?

[zealous bridge]

no

[lilac wren]

then what are you saying

[zealous bridge]

that dimentio =! requesting apnonce in normal mode

You said it’s not different

[lilac wren]

yeah they both set generator

so what are you saying

[zealous bridge]

well

look at this then

if iTunes used that cached ideviceinfo apnonce, and dimentio got the generator right, wouldn’t you say it’s different

[lilac wren]

huh

just list your steps

[zealous bridge]

ideviceinfo -k ApNonce, dimentio, ideviceinfo -k ApNonce (same result), dimentio 0x111111…., ideviceinfo -k ApNonce (same result), initiated iTunes restore (which is the first part of getnonce), rebooted me to recovery and now irecovery -q shows dimentio nonce instead of ideviceinfo nonce

[lilac wren]

ideviceinfo -k ApNonce (same result)
which is a wrong ap nonce right

[zealous bridge]

yes

[lilac wren]

rebooted me to recovery
:|

it's going to show the correct nonce then lol

the test proves nothing

[zealous bridge]

i was just showing that they’re not the same

[lilac wren]

other than ideviceinfo spews out junk when generator is already set

[lilac wren]

they both set generator, and both generators work the same lol

[zealous bridge]

I mean you told me to try

[celest basalt]

hmm true if iTunes requests the nonce again in recovery it won't fail I guess

[lilac wren]

I told you to try an itunes restore to see if an ideviceinfo nonce resets where a dimentio one doesnt

what is your point lol, wdym "not the same"

[zealous bridge]

This

[lilac wren]

so you're saying if we set a nvram nonce in normal mode, do itunes restore from normal mode, nonce won't reset?

i thought you already tried that

[celest basalt]

well, it's supposed to clear at the end of the restore regardless

[zealous bridge]

i tried it just now lol

[lilac wren]

supposed to lol

[zealous bridge]

you were saying this whole time that it would reset it

but it didnt

lol

[lilac wren]

bruh bc that's what you said

you told me that restores from recovery kept nonce, from normal mode didnt

so inconclusive results? which is it

[zealous bridge]

when did i say it would reset

[lilac wren]

ok so what does this have to do with ideviceinfo nonce and it being different than dimentio

[zealous bridge]

shows that ideviceinfo is shit

Dimentio >>>>

[lilac wren]

so they're still the same :|

[zealous bridge]

bruh

lol you still don’t get it

We’ll see when an A12+ tester comes along

If they manage to do it with dimentio that means it’s different

Since nyu already proved it doesn’t work with ideviceinfo

[lilac wren]

here

[lilac wren]

bruh you still don't have a point

[zealous bridge]

“from recovery mode”

[lilac wren]

"from normal mode"

[zealous bridge]

ideviceinfo was from normal mode

[lilac wren]

if your point is that ideviceinfo spews out garbage

than that was already known

since like 2 weeks ago

when I tested it lol

[zealous bridge]

🤦‍♂️

[lilac wren]

are you turning on JTV mode again lol

[zealous bridge]

the one before reset my nonce

but it wasnt set in nvram

[lilac wren]

wut

if there was no nonce set

then there's not going to be one set

•-•

[zealous bridge]

no because ideviceinfo overrode the dimentio one lol

dimentio was from the previous boot

this is from the same boot

[lilac wren]

oh so there was a generator set

from ideviceinfo

[zealous bridge]

yes it appeared that way

[lilac wren]

and you're saying it got cleared when you restored from normal mode

[zealous bridge]

the one from the previous boot yes

well i didnt even restore

i just went to recovery

[lilac wren]

uh

what

[zealous bridge]

But it probably would’ve kept the nonce

[lilac wren]

wyd lol

[lilac wren]

you set nonce with dimentio, rebooted, set nonce with ideviceinfo, went to recovery, and it was gone?

i honestly have no clue what you're even saying now

[zealous bridge]

dimentio was the one from the previous boot for the second time

[lilac wren]

you restored twice?

[zealous bridge]

the one from ideviceinfo was still there

basically

i set with dimentio > rebooted > restored with itunes from normal mode and the nonce was NOT the dimentio one

[lilac wren]

oh but there was a nonce?

[zealous bridge]

yes

[lilac wren]

randomized nonce though?

[zealous bridge]

which means that either ideviceinfo failed or dimentio one got cleared from a reboot

[lilac wren]

but you used ideviceinfo?

[zealous bridge]

what i just did now proves that it wasnt dimentio’s fault

[zealous bridge]

yes

ideviceinfo and then itunes

[lilac wren]

where does it fit here

[zealous bridge]

before itunes

sorry

[lilac wren]

ok

so ideviceinfo overwrites dimentio if you didn't set it on the same boot maybe

[zealous bridge]

probably, but why didn’t it do so here

[lilac wren]

but how does this make ideviceinfo generator any different from dimentios

[zealous bridge]

same boot?

[lilac wren]

yeah like whatever goes first

let me test something rn

[zealous bridge]

that means itunes restores would just fail

after the reboot

so how does that make sense

[lilac wren]

itunes restores just read from apnonce in recovery

[zealous bridge]

do they?

[lilac wren]

they don't read ideviceinfo junk

[zealous bridge]

i thought it was from normal mode

[lilac wren]

doubt it

[zealous bridge]

what are you gonna test

[zealous bridge]

I can test that actually

If the restore fails that means it read ideviceinfo junk

if it succeeds then it didnt touch normal mode

but nyu said he was sure it would fail

[lilac wren]

didnt you try it already

[zealous bridge]

nah i just rebooted to recovery

I’m trying it now

[lilac wren]

im doing a test on overwriting

in recovery i see dimentio nonce

going to jb

[zealous bridge]

Yeah so if I didn’t fuck up next time you do ideviceinfo and then dimentio it should overwrite

[lilac wren]

yeah I think dimentio will always overwrite

just ideviceinfo that's finnicky

[zealous bridge]

so maybe both have an equal chance

but they still are slightly different

if i wanted to take my chances for my nonce not to change i would still use dimentio instead of ideviceinfo

[lilac wren]

bruh how

they're both generators

that's all

[zealous bridge]

dimentio will always overwrite thi

ideviceinfo sometimes doesn’t, especially on the same boot

[lilac wren]

yeah who cares if it overwrites though

it's a generator and it'll stay through a restore bc of apple's bug

[zealous bridge]

people who want to keep the same nonce

[lilac wren]

^

the way you set it shouldn't matter

[zealous bridge]

you say shouldnt but didnt we prove it just did

[lilac wren]

no lol

you never set generator with ideviceinfo

it just spewed junk, dimentio was the true generator

and then dimentio's stayed

[zealous bridge]

ideviceinfo failed

Like i said

[lilac wren]

?

ideviceinfo just did what it was programmed to do

generator was already set on that session so it didn't do anything

ok just jailbroke, generator is still set to 0x1111, dimentio's

[zealous bridge]

by session you mean ‘boot’ right

[lilac wren]

doing ideviceinfo now

now it's set to 0x5C438FA0F220B2DC

so it overwrote

going into recovery now to see if it's true

[zealous bridge]

iTunes isn’t failing but it definitely isn’t working either

[lilac wren]

(which it should be if that's what dimentio no args shows)

it shows the wacky nonce

[zealous bridge]

it’s stuck on Preparing iPhone

[lilac wren]

so ideviceinfo succeeded in overwriting dimentio's

[zealous bridge]

oh it’s going

I got error 2009

[lilac wren]

now I'm going to set generator with dimentio to 0x1111, then try ideviceinfo

[zealous bridge]

Yep

2009 is invalid response from TSS

imagine it ignored that and carried on restoring

that would be an ultimate bug

[lilac wren]

the device wouldn't boot it even if it restored though

but yeah would still be cool

to do tethered without succession or divise

[zealous bridge]

we could still mess around with signatures after that

[lilac wren]

ok jailbreaking again

[zealous bridge]

Ok so theoretically the next iTunes restore should work

If it doesn’t then it don’t read apnonce from recovery

[zealous bridge]

So it does read from normal mode

[lilac wren]

oh what did you do

[zealous bridge]

got ideviceinfo and dimentio to disagree on nonce

[lilac wren]

ok

[zealous bridge]

then tried itunes restore to see if it would look at both of them

looks like iTunes did ideviceinfo, got the wrong nonce, rebooted to recovery, got a different nonce than ideviceinfo and just failed

[lilac wren]

taurine set it to 0x1111, so doing ideviceinfo rn would overwrite it; instead im going to set it to 0x1111 again (even though it's already 0x111)

ok set

[zealous bridge]

so iTunes is as wack as ideviceinfo

smh

i want a more verbose answer

[lilac wren]

got some garbage ApNonce from ideviceinfo

[zealous bridge]

lemme try idevicerestore

[lilac wren]

and dimentio shows 0x1111

so it was NOT overwritten because we set nonce on this session

[zealous bridge]

@lilac wren did you at least understand this experiment

[lilac wren]

mine or yours

[zealous bridge]

mine

ofc

[lilac wren]

ofc

[zealous bridge]

you would understand your own experiment lol

[lilac wren]

yeah so from yours it looks like itunes just reads mobilegestalt key which recovery doesn't like

bc it's garbage key

[zealous bridge]

yeah

looks like subsequent iTunes restores dont work either

[lilac wren]

but what does this add to the "ideviceinfo generator is different" argument

[zealous bridge]

Does it cache the APTicket?

[lilac wren]

nah bc nonce

[zealous bridge]

but from recovery

Whats the garbage nonce

There’s only 1

[lilac wren]

garbage nonce is mobilegestalt ApNonce key after nonce was already set this session

because it's not the true nonce

it's just something made up

[zealous bridge]

yes

but from recovery mode

ideviceinfo would give the correct nonce

[lilac wren]

from recovery should work bc you can't set generator there I think

[zealous bridge]

it doesn’t

Which makes me think iTunes caches something

[lilac wren]

but this

[zealous bridge]

not much other than dimentio takes priority in the same boot, but we still need an A12+ dimentio tester to settle it

if dimentio works and ideviceinfo doesn’t, do you accept you’re in the wrong

[lilac wren]

yeah but aside from ideviceinfo wack programming, the generators are not any different

[zealous bridge]

A12+ restore

[lilac wren]

huh lol, the way I'll accept that I'm wrong is if
a restore with dimentio generator keeps that nonce after restore
a restore with ideviceinfo derived generator (must be true, put aside the wack garbage programming nonce) clears the nonce

[zealous bridge]

the latter has already been proven

just the former

[lilac wren]

fr? what were the setps, when did it clear, and from what mode \

[zealous bridge]

nyu did it

i just proved iTunes uses ideviceinfo right?

[lilac wren]

Lol ooc here

[zealous bridge]

Well looks like an iTunes restore to latest doesn’t keep the same generator

on XR

[lilac wren]

from normal mode yes, because it's lazy

[zealous bridge]

yup

[lilac wren]

how was generator set

[lilac wren]

send link

[zealous bridge]

ideviceinfo

[lilac wren]

dang so A12 might be dead for this

[zealous bridge]

#futurerestore-help message

ideviceinfo = iTunes remember

[lilac wren]

oh but that's A12

so doesn't actually "prove the latter"

[zealous bridge]

yes

oh

you never specified

[lilac wren]

-_-

bruh

[zealous bridge]

but

but

I tested on A9 remember

[lilac wren]

I assume A12 clears dimentio too so we accomplish nothing with that test for our argument

[zealous bridge]

Set dimentio from previous boot, used ideviceinfo on the next, nonce was overwritten, initatied iTunes restore, and when i rebooted into recovery the nonce was cleared

[lilac wren]

Here's what we need to do:

dimentio forever

1. Get a A11 or lower device
2. Set generator with dimentio
3. idevicerestore to latest
4. See if generator is set

idevicesetnonce

1. Get the same device
2. As soon as it's jailbroken, set generator with ideviceinfo (make sure it actually sets, doesn't spew trash)
3. idevicerestore to latest
4. See if generator is set

if idevicesetnonce is cleared, while dimentio forever is set, then I will admit that yes, the two generators are indeed different

[zealous bridge]

You mean A12 or higher

[lilac wren]

no a11 lower

[zealous bridge]

We already test dimentio forever on A9 + A11

lol

[lilac wren]

yeah but not idevicesetnonce

[zealous bridge]

I did a live restore fgs

ok

so the former is good

[lilac wren]

yes ik

[zealous bridge]

where does A12 and higher come into this

[lilac wren]

A12 higher, if Nyu was correct that the generator was cleared with idevicesetnonce, then yeah I think dimentio will also be cleared—again my point that the generators are the same

[zealous bridge]

ok but if it isn’t cleared

[lilac wren]

but we need it to be done on the same device

bc my device does some weird stuff with idevicesetnonce while nyu's won't

[zealous bridge]

and with idevicesetnonce

[celest basalt]

what the fuck is idevicesetnonce

[zealous bridge]

instead of dimentio generator

[zealous bridge]

random name froggy made up

[lilac wren]

Lol what we call mobilegestalt ApNonce as soon as it boots

so that it sets true generator not just spews out garbage

but im getting tired of saying spews out garbage

[zealous bridge]

If a random generator is set (a.k.a nonce cleared) does that count

cause technically if dimentio stayed and idevicesetnonce was cleared then they aren’t the same

[lilac wren]

That should be a separate test, bc if iTunes really does use idevicesetnonce, then with a cleared nvram it might set and keep a nonce after the restore

[zealous bridge]

that wasnt my question tho

lol

would it still count

because dimentio —> stayed and idevicesetnonce —> cleared

which proves that they’re not the same

which is my point

and i have 1%

[lilac wren]

Just follow the steps I put above

[zealous bridge]

i'll take that as a yes

[lilac wren]

Otherwise the test is probably not done right, remember

Remember that my ideviceinfo is different from Nyu's

So anything can change

[zealous bridge]

how does that make a difference

[lilac wren]

Sure so long as you follow those steps

[zealous bridge]

if the nonce is cleared it's cleared

[lilac wren]

Yeah but the nonce wasn't set with idevicesetnonce beforehand

[zealous bridge]

bruh idevicerestore doesn't even work for normal mode restores

needs an update for entering recovery

[lilac wren]

Oh fr?

Then iTunes is fine

Just use iTunes for both

[zealous bridge]

i'll follow the steps but i'm just saying if the nonce post-restore is a single character different than pre-restore i'm counting it as a fail

and why is the discord mention sign bright blue

[lilac wren]

Nonce or generator

[zealous bridge]

bruh

if one is different ofc the other is going to be different

but nonce

[lilac wren]

Why nonce

The test was if generator was cleared after restore

Not if nonce changes

[zealous bridge]

if it's different then the generator was cleared

i wont test it from normal mode ofc because that would overwrite

but i'll just reboot

[lilac wren]

Sure but it's a checkra1n device

[zealous bridge]

to recovery

[lilac wren]

You could just jailbreak and print nvram

[zealous bridge]

that works as well - but it's literally the same thing

ok im gonna do this

[lilac wren]

Ok

Are we restoring from normal mode or revovery

Shouldn't make a difference

[zealous bridge]

1. Set generator with dimentio (has the same effect of a dimentio forever post-restore
2. Reboot and use iTunes from normal mode (same effect of ideviceinfo like i just proved)
3. Check if the nonce is cleared

any objections?

[lilac wren]

Yes

Why reboot after setting generator with dimentio

[zealous bridge]

you don't want me to

?

[lilac wren]

Just go into revovery

And restore from there

[zealous bridge]

but then how would i use ideviceinfo

that only works from normal mode

[lilac wren]

Same place you use dimentio

[lilac wren]

^

Jailbreak, set generator, go to recovery, restore

I think that makes sense

[zealous bridge]

wait i don't understand

[lilac wren]

Otherwise if what you say is true that iTunes does ideviceinfo as well we might get tss error

[zealous bridge]

"See if generator is set" which generator is this referring to

ideviceinfo?

[lilac wren]

Any generator

The same one that we set

[zealous bridge]

with ideviceinfo?

brb

[lilac wren]

Actually lemme rewrite the steps otherwise we'll get tss I think

dimentio forever

1. Get a A11 or lower device
2. Jailbreak
3. Set generator with dimentio
4. Go into revovery
5. idevicerestore to latest
6. See if generator is set

idevicesetnonce

1. Get the same device
2. Jailbreak
3. As soon as it's jailbroken, set generator with ideviceinfo (make sure it actually sets, doesn't spew trash)
4. Enter recovery
5. idevicerestore to latest
6. See if generator is set

That way the 2nd iTunes ideviceinfo doesn't mess up anything

And it should only be our ideviceinfo

If you want you can livestream too

[zealous bridge]

yeah this doesnt make sense because the point of the dimentio test was to make sure the same generator persisted

otherwise it's uselss

[lilac wren]

Sorry I meant the same

[zealous bridge]

so it should be exactly the same

yeah

[lilac wren]

By any I meant either dimentio or idevicesetnonce

Like either test

But yeah the same as initial

[zealous bridge]

instead of ideviceinfo tho i'm gonna do iTunes from normal tho, if we get TSS i'll try the original way

once it's in recovery i'll show the nonce

[lilac wren]

But why lol, that just adds another layer of uncertainty

Wait

We won't even know what the initial generator is if we do that

Lol

[zealous bridge]

ideviceinfo is kinda long

[zealous bridge]

when it reboots to recovery i'll do irecovery -q

before it restores

[lilac wren]

Hm maybe you can but idk feels uncertain to me

Besides people will set generator with getnonce not with an iTunes restore like this lol

[zealous bridge]

it should be the exact same thing

literally

cool if your test fails i'll do it the original way too

lemme jailbreak and reboot to windows

[lilac wren]

Ok

[zealous bridge]

rebooting now

@lilac wren join

[lilac wren]

Okie 1 sec

[zealous bridge]

boutta get serial leaked

[lilac wren]

i wonder if anyone uses itunes for music

[zealous bridge]

just to prove i'm jailbrojen

cool story bro

[lilac wren]

i see why though

[zealous bridge]

lol i dont like to waste data on spotify

so i just download locally

[lilac wren]

LOL

yay party

[zealous bridge]

my phone is on 1%

[lilac wren]

lol will it even let you restore

[zealous bridge]

otherwise i would be using discord on the phone

sad

[lilac wren]

aww

[zealous bridge]

froggy ur still here right

[lilac wren]

yeah

[zealous bridge]

ok time to gooo

[lilac wren]

is this dimentio

[zealous bridge]

idevicesetnonce

[lilac wren]

ok but lazy method

[zealous bridge]

random nonce

that same nonce must be retained

no TSS

[lilac wren]

yeah so itunes is setting generator

[zealous bridge]

yes

[lilac wren]

ok

[zealous bridge]

ideviceinfo

restore mode entered

[lilac wren]

nice

lol

[zealous bridge]

wot

[lilac wren]

no clue

[zealous bridge]

ok well

[lilac wren]

you could retry

[zealous bridge]

why does sepnonce change so often

[lilac wren]

so idevicerestore just goes into recovery and does a restore there right

[zealous bridge]

yeah this is basically the original method now

because ideviceinfo, rebooted to recovery, and now we initiate

[lilac wren]

oh ok

[zealous bridge]

inb4 4K

[lilac wren]

but we don't know what the generator is do we

[zealous bridge]

we do

well

we know nonce

if the same nonce is there that means same generator

[lilac wren]

double check that it set

go to recovery get nonce, reboot and do it again

[zealous bridge]

ok

[balmy bough]

what's news for downgrading from iOS 14.4 to 14.3?

[lilac wren]

it works

just have blobs

[zealous bridge]

entering it manually

[lilac wren]

oh ok lol

[zealous bridge]

and A11-

[lilac wren]

but yeah sep and bb is compatible

[balmy bough]

Sorry from 14.4 to 14.3

14.2

[zealous bridge]

same nonce

[balmy bough]

I have iOS 14.2 blobs

[lilac wren]

oh idk if it will ever be fixed

[balmy bough]

A11

[lilac wren]

nice

[zealous bridge]

we going

[lilac wren]

bro

@zealous bridge

you shared a photo of yourself

look

🍓

[zealous bridge]

knew it

[lilac wren]

:P

[zealous bridge]

lol

[lilac wren]

lol

[zealous bridge]

i actually dont mind anyone seeing how i look as long as theyre quiet abt it

[lilac wren]

TANBERRY IS RED AND HAS WHITE SEEDS AND A GREEN TUFT OF HAIR

[zealous bridge]

green

just like

a frog

L

[lilac wren]

well frogs are cute and green and squishy

[zealous bridge]

14.2 from 14.x doesnt work at all

nice temp

[balmy bough]

I tried about 70 days ago to downgrade from 14.4 to 14.2 ... I wanted to know if it was fixed

[zealous bridge]

nah

[balmy bough]

I guess it would be better to wait for the next jailbreak, as it looks like it will be out soon

I hate fdr

[zealous bridge]

fuck fdr

[balmy bough]

Yeah

[zealous bridge]

@lilac wren inb4 4K error

[lilac wren]

lets hope not

[balmy bough]

Greetings from Italy, thanks bro

[lilac wren]

bruh fix ur cable

[balmy bough]

[zealous bridge]

bruh

irecovery worked

itunes is ass

i think recovery timeout

[lilac wren]

idevicerestore then

LOL

your tool is bugging out bc of the cable

[zealous bridge]

one sec

changing ports

[lilac wren]

ok

[zealous bridge]

is this good?

[lilac wren]

what is this

so idevicerestore?

[zealous bridge]

2+1u restore

yes

it uses idevicerestore

actually it uses iTunes

[lilac wren]

this is the most scuffed experiment

let's just do it

[zealous bridge]

lemme try one more time

i think changing ports fixed cable

[lilac wren]

ok then itunes might work

[zealous bridge]

same

we back to square one

why doesnt itunes use cached dmgs smh

also we can check with /var/MobileSoftwareUpdate/restore.log

or whatver

[lilac wren]

oh yeah

[zealous bridge]

uses like a tenth of my disk speed

yup

here we go

[lilac wren]

nice

[zealous bridge]

gonna sleep wake me up when it finishes

nm

[vivid nova]

The f*cks that supposed to mean..?

[zealous bridge]

[lilac wren]

Lol

[vivid nova]

I'm done.

[zealous bridge]

you never are truly 'done'

[vivid nova]

I honestly can't believe you...

[lilac wren]

who wants to play pong

——————————
|

oops

hold on

[zealous bridge]

.

[vivid nova]

Stfu. Leave me alone.

[lilac wren]

There ok pong is ready
——————————
| |
| |
| > • < |
| |
| |
——————————

me lol

[zealous bridge]

moment of truth froggy

need to wait for the 2nd progress bar

smh

[lilac wren]

lol

[zealous bridge]

i'm def wearing out the NAND flashes lol

this thing is so slow

[lilac wren]

what is a nand

[zealous bridge]

ssd chips

like the internal name

[lilac wren]

oh

phone storage is flash right

like sd cards

[zealous bridge]

NAND = flash

yes

[lilac wren]

oh ok

[zealous bridge]

they all use the same thing

ok

rebooted

[lilac wren]

yay

gg

[zealous bridge]

same nonce

gg

[lilac wren]

now to test A12 in the future

[zealous bridge]

yeah low hopes now

[lilac wren]

yeah

[zealous bridge]

ig apple literally does not know what nonce means

we can literally just reboot to recovery and used the cached APTicket from iTunes again

[lilac wren]

Lol wait you're right

Apple is literally creating our infinonce

[zealous bridge]

literally

[lilac wren]

by setting generator

Lmho

[zealous bridge]

disappointed @split torrent

[lilac wren]

mt

[zealous bridge]

eta wen BCerts in all requests

[lilac wren]

like I said just do bcert thing

yeah

i imagine that somewhere in Apple there's a high up dev who's keeping things as easy as he can for us

[zealous bridge]

Maybe

But whoever created nonce entanglement i don’t like you very much

[lilac wren]

Oh bcerts probably can't be created in dfu or recovery or something

[zealous bridge]

why not

also i had this weird glitch where the low battery sign went on top of the recovery mode sign and created this weird image

[lilac wren]

Idk dfu doesn't know current time, maybe there need to be files to sign it which exist on the filesystem but don't if you wipe everything, etc

Generating a random number works though

[lilac wren]

Yoo that's actually pretty cool

I wish we could easily change those images

[zealous bridge]

Ikr

But ofc each and every one of them are separately signed

[zealous bridge]

Oh i forgot about dfu time

lol

Okg

Omg

1PM EDT

[lilac wren]

Yes

[zealous bridge]

Whens that

[lilac wren]

2 hrs

Or 1 hr 45 min

[zealous bridge]

18:00

Oof

I have to rush home after school

If i wanna catch that

[lilac wren]

Why what happened

[zealous bridge]

My school is 6-6

lol

EDT?

Oh no

It’s 7am

lol

Cupertino is PDT

[low summit]

gm

[lilac wren]

gm

[lilac wren]

What would normal mode ap nonce collisions even do for us if it worked

Oh it would be possible to set generator unjailbroken

[zealous bridge]

@lilac wren ??

how is nvram unavailable after ideviceinfo

[lilac wren]

Wdym

We just proved it today remember

[zealous bridge]

ik

but like

[lilac wren]

That dimentio and idevicesetnonce both don't clear

[zealous bridge]

why

thats stupid

[lilac wren]

Lol yeah

[zealous bridge]

it's like

[lilac wren]

Apple pls don't fix

[zealous bridge]

we just locked nvram

lol

[lilac wren]

Wait

Have you tried dfu?

[zealous bridge]

no...

[lilac wren]

That would be cool if it persisted

You should try

[zealous bridge]

sure

[lilac wren]

Yay

[zealous bridge]

what are the steps again

[lilac wren]

Also yeah dfu nonce was not affected by generator

Is it entangled as well?

[zealous bridge]

got a better cable too

[lilac wren]

Set generator with dimentio, go to dfu and restore

[zealous bridge]

ok

Reading package lists... Done
Building dependency tree... Done
Package org.coolstar.libkernrw is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

E: Package 'org.coolstar.libkernrw' has no installation candidate```

[lilac wren]

Apt update maybe

[zealous bridge]

lol i tried that ofc

[[libkernrw]]

what repo

not in procursus

oh in odyssey repo

[lilac wren]

https://repo.theodyssey.dev/

[zealous bridge]

N: Updating from such a repository can't be done securely, and is therefore disabled by default.```

rip

allow unauthenticated time

[lilac wren]

Can you not just open Sileo lol

[zealous bridge]

too long

do you know how slow a 6s is

[lilac wren]

I had a 6 until iOS 13 and a XR is so speedy

Actually ios 12

[zealous bridge]

6 doesnt even support 13

after setting nonce to 0x111111 with nvram

tanbeer@ZenBook-UX434DA-UM433DA:~/Desktop$ ./irecovery -q
CPID: 0x8000
CPRV: 0x20
BDID: 0x04
ECID: 0x00000[REDACTED]
CPFM: 0x03
SCEP: 0x01
IBFL: 0x1c
SRTG: iBoot-2234.0.0.3.3
SRNM: N/A
IMEI: N/A
NONC: 9be0c3610976ea89dbb5618255e95dd0f392fd72
SNON: 7ab127b57ea6018b611632eb38b1259cab8f45be
MODE: DFU```

yeah no that is not the right nonce

lets see tho

nah

so long as you use the right generator

which generated that apnonce

instead of 0x11111….

If you tell me you forgot

I will personally come to Jordan

and smack you

lol

quick before 14.5.1 is yeeted

i said like 3 times in my getnonce guide to remember the generator lmfao

yes break SHA-384 for me and get your AES key

i love how you tell everyone that they're stupid and save blobs wrong and then karma hits you like that

lol

@lilac wren what happens if i force reboot after the first progress bar and don't wait for the second

[lilac wren]

I think it would just start the second again

[zealous bridge]

maybe

[lilac wren]

I mean maybe it would bootloop

[zealous bridge]

what if i do it in the middle of it

[lilac wren]

If I had to guess I'd think it'd just restart

[zealous bridge]

lemme test-

[lilac wren]

Ehh same

[zealous bridge]

yes

[lilac wren]

Yeah lol why I corrected to 12, also because chimera first A12 jb

[zealous bridge]

CPID: 0x8000
CPRV: 0x20
BDID: 0x04
ECID: 0x00000[REDACTED]
CPFM: 0x03
SCEP: 0x01
IBFL: 0x1d
SRTG: N/A
SRNM: [REDACTED]
IMEI: N/A
NONC: 3a88b7c3802f2f0510abc432104a15ebd8bd7154
SNON: 77b305e1087566d88dd216ed586ffbd0ddaa2d5b
MODE: Recovery```

[lilac wren]

Ugh that kinda stinks, with phone security becoming greater it's harder for people to get started in jb dev scene

[zealous bridge]

i feel like maiming and hugging someone at Apple HQ at the same time

[lilac wren]

Is the nonce the same

[zealous bridge]

3a88b7c3802f2f0510abc432104a15ebd8bd7154```

[lilac wren]

Nice

Now we gotta hope this happens on A12+

Otherwise no point

[zealous bridge]

correct

[lilac wren]

Ooh nice

[zealous bridge]

makes my life a bit easier

[zealous bridge]

also correct

[lilac wren]

Wow I am smort

[zealous bridge]

i would agree if you were literally any animal other than a frog

ugh you cant even skip setup anymore on 14+

so even from DFU iBEC still can't access the nvram

that makes no sense but whatever

yes just inshallah this one

i think i finally got it

pwndfu only works when the CPU is cool

otherwise shit's claimed

:smort:

lol cant think of any other reason

apparently all the way up to the progress bar is known as "recovery mode"

even when the connect to iTunes logo isn't shown

@lilac wren what if the ideviceinfo part was the nonce reset

lol

thats flawed asf tho

cause recovery mode

but imagine that's apples game plan

[celest basalt]

well, it depends... the generator is just a comment, so as long as you KNOW what the real generator was... they would be valid

but I bet you didn't write it down anywhere, it's a random string with getnonce, no way to guess it

[zealous bridge]

bruh

even normal itunes restores dont clear it

from normal mode

lol i think once you set it ios can never get access to the nvram again without nvram -c

i wonder what would happen if we do that junk ideviceinfo thing with OTA

WebKit

[celest basalt]

two webkit vulns yeah

[zealous bridge]

"An error occurred while downloading iOS 14.6"

i think it's because i'm jb

yes

get the phone off her

lol wot

wheres my delta gone

have to wait one hour for the whole thing ugh

rip

lemme chec

yes

[lilac wren]

TSS saver is usually always valid so long as you press the save blobs button

You know what I think I'll write a post on nonces

[zealous bridge]

non-jb

[lilac wren]

Oh yeah

Rookie mistake

You basically pulled a blobsaver 2.x

LOL

ur right

[celest basalt]

it's not really much worse because like I said the generator is just a comment

so it's equivalent to not having a generator in the blob

[lilac wren]

ik but a wrong generator is worse than no generator

because you think you're safe until it's time to use it

[celest basalt]

true

[lilac wren]

wut

that's a subreddit

how are there 4 online

with 2 members

oh the join button

i forgot you can subscribe to a sub

that doesn't make sense though

bc this is private

[zealous bridge]

its reddit being late

probably

do "/usr/local/bin/tsschecker" -d iPhone10,3 -i 14.5.1 | grep -q 'IS being signed!'
if [ $? == 0 ]; then
   echo "signed"
else
  echo "unsigned"
fi
done```

i cant believe i have come to this level

[lilac wren]

bruh

what's my script lemme see

[zealous bridge]

idk i just looked up some basic syntax online and put it together

[lilac wren]

#!/bin/bash

# Needed for linux for some reason? TSSChecker doesn't work without
LD_LIBRARY_PATH=/usr/local/lib
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/libfragmentzip.so.0
export LD_LIBRARY_PATH

version=14.5.1

while tsschecker -d iPhone11,8 -i $version | grep 'IS being signed' > /dev/null; do
    echo $version' is being signed'
    sleep 60
done
echo $version' is not being signed'
curl -X POST -H "Content-Type: application/json" -d '{ "value1" : "'$version'" }' https://maker.ifttt.com/trigger/tss_change/with/key/[key]

[zealous bridge]

.....

oh

its IFTTT

[lilac wren]

you could use this

ifttt is for phone notification

[zealous bridge]

ty

[lilac wren]

np

just change $version whenever new iOS is out

or make tss live

and then never do it

[zealous bridge]

lol

[lilac wren]

and leave it unfinished

O_O

[zealous bridge]

naughty

what do i choose in ifttt

[lilac wren]

webhook

[zealous bridge]

interesting, it gets all the way to verifying update and reboot but just reboots back to normal mode

[lilac wren]

LOL what

[zealous bridge]

doesnt inititate

might sniff the tss request

[lilac wren]

oh restore mode must reject it then

[zealous bridge]

prob

[lilac wren]

like it gets tss for the garbage nonce

then restore mode is like "wth is this shsh, it's for the wrong nonce. nope"

and kicks you back

[zealous bridge]

yeah probably will sniff in a bit

[lilac wren]

why does pwndfu need generator again

[zealous bridge]

to set generator in pwnrecovery

[lilac wren]

yeah but why can't you set it normally

[zealous bridge]

idk it just does it because it can

[lilac wren]

oh bc dfu nonce is different or something

[zealous bridge]

dfu nonce has nothing to do with it

[lilac wren]

ok

[zealous bridge]

you restore from pwnrecovery

[lilac wren]

@celest basalt do you know why pwndfu needs generator

[celest basalt]

it needs that to set nonce

because you can't just set nonce the normal way for pwndfu

[lilac wren]

oh why not

[celest basalt]

because DFU has a different nonce I guess, although it goes to iBEC/iBSS but it still stays in pwnrecovery rather than normal afaik

[lilac wren]

pwnrecovery can't just read the set generator and do its stuff?

the restore takes place from recovery not dfu right

[zealous bridge]

it can

it's just irecovery -c "setenv com.apple.System.boot-nonce=$generator"

[lilac wren]

nice key

[zealous bridge]

lol

pls no spam

[celest basalt]

technically a restore ramdisk is loaded from both recovery and DFU so I guess at that point it's kinda the same, except for the way the nonce is set initially for the image to be accepted

[zealous bridge]

like i said, it probably could ignore this step if it's already set in nvram

but it just does it anyway

doesn't hurt

[celest basalt]

no the freshnonce patch checks if it's already set or not

[zealous bridge]

oh lol

[lilac wren]

bruh bad practice, it should do that in regular FR then as well

[zealous bridge]

couldnt fr detect a bad apnonce/generator match before the device goes into recovery

[lilac wren]

only if it

it's jailbroken

[zealous bridge]

like take the generator from the blob then hash it and compare it with an asn1parse

nah not really

it only needs the blob

just decode the apimg4ticket part and check if the hashes match

[lilac wren]

no i mean how will FR get ap nonce from non recovery mode

[zealous bridge]

it doesnt need to, it already has the apnonce in the blob

14.5.1 unsigned

[lilac wren]

r u sure

i didnt get a notif

[zealous bridge]

nvm

why did it trigger

bruh

[lilac wren]

bro

[zealous bridge]

why did mine trigger

blame froggy's script

bruh

[lilac wren]

did you do something wrong where's the value1

[zealous bridge]

it was working perfectly lol

then after 8 tries it failed

[lilac wren]

I will fire this webhook until you see the message >:(

[zealous bridge]

bruh it keepds doing it

[lilac wren]

where's value1 >:(

[zealous bridge]

its there

[lilac wren]

did you hardcode that

in ifttt

are you sure in ifttt it's taking value1

[zealous bridge]

isnt it default

[lilac wren]

when you made the webhook

bro i thought fr

lol

[celest basalt]

wtf

oh

I was like why is my script being slow

[zealous bridge]

i think it was because the request got timed out

i should do a check that searches for “IS NOT being signed!”

[lilac wren]

Yeah I just changed it to that

[zealous bridge]

how do you send a notification over ssh

you could change it to that instead of IFTTT

[lilac wren]

activator

[lilac wren]

it's running on a remote server

[zealous bridge]

Oh