futurerestore-help

[pseudo stump]

but i guess i have the blob on my ubuntu laptop

no i fr'ed yesterday to 14.3

w ipsw blob

[zealous bridge]

if it’s IPSW blob then yes

yes

[celest basalt]

hi may i ask your good assistance about downgrading iphone ios 14.4.2 to ios 14.3?

[zealous bridge]

which iPhone

[celest basalt]

iphone 11

[zealous bridge]

You need a jailbreak

[celest basalt]

yes if theres available

[zealous bridge]

You can’t do one now I’m afraid, but for future reference you could look at tis

!t fr

[mystic axle]

fr

futurerestore allows you to upgrade/downgrade/restore to unsigned iOS versions if you meet certain requirements.

Tutorial

Added by stkc#8018 | Used 67 times · May 12, 2021, 10:01 AM

[zealous bridge]

this tutorial

Yeah i seen it

[celest basalt]

its ok with me. atleast i tried

[lilac wren]

Bruh the amount of posts saying to use OTA delay

[zealous bridge]

ikr

I saw one saying

“It’s more clean than futurerestore because it uses an official Apple update”

[lilac wren]

LOL

[zealous bridge]

Lemme check the bootstrap

@zinc moon it aint in yet afaik

i don’t need to

i can inspect the bootstrap from the odysseyra1n script

[celest basalt]

how to use it?

[zealous bridge]

I just linked you a tutorial

[celest basalt]

thanks

[zealous bridge]

@zinc moon ok

it is

was doing some weird thing with essential

Lol

Very essential

So everyone using Taurine now has blobs for 14.6+

kinda shit timing since it’s past 14.5.1 and fr is gonna become useless by the time 14.6 jb comes out

But at least it’s good for iOS 15

[stiff hazel]

Wait is it finally included/installing by default on all Procursus jailbreaks or?

[zealous bridge]

Yeah it should be

[stiff hazel]

(shshd)

Odysseyra1n included or no?

[zealous bridge]

It’s strapped to procursus

So yes odysseyra1n

Yes or if they refresh sources in Sileo

And install it manually as an “update”

Huh

Weird it worked for me the first time

[stiff hazel]

If you lack blobs somehow yes OTA delay will be better (for obvious reasons) otherwise though yeah fr will definitely be better and easier once they actually you know use it

[hollow grail]

I’m planning on using this tool today, do I need to remove my jailbreak with unc0ver or no

[zealous bridge]

once you set your generator you should

[hollow grail]

Yeah I have my generator

[zealous bridge]

Set it on device?

[hollow grail]

Yes

[zealous bridge]

Then you can restore rootfs

[hollow grail]

Okay thanks

What’s the best way to backup tweaks?

Most of mine have been updated to iOS 14

[zealous bridge]

screenshot all of them and install them one by one

thats honestly the cleanest way

[hollow grail]

Thanks will do

[hollow grail]

what does this mean

My device is stuck in recovery mode not doing anything

[zealous bridge]

unplug and replug

[hollow grail]

alright

okay done

[zealous bridge]

try again

[hollow grail]

same message

[lilac wren]

get better cable

[zealous bridge]

what OS is it

[hollow grail]

Linux

[zealous bridge]

run checkra1n

and do the checkra1n-helper.sh

if you dont have it install it

[hollow grail]

alright, where can I get that file

[zealous bridge]

https://checkra.in

instructions here

[hollow grail]

also if this is too hard on linux or whatever I have a windows PC too so I'm not sure if that helps

and alright thanks

[zealous bridge]

this isnt rly a known issue, i got that same problem once and running checkra1n fixed it for me

so i'm just suggesting it

[hollow grail]

thx

[zealous bridge]

@hollow grail

actually

[hollow grail]

yeah

[zealous bridge]

i have the file for you

[hollow grail]

Oh okay

[hollow grail]

ah thanks

[zealous bridge]

download that and run it with sudo

np

[hollow grail]

kk

[zealous bridge]

after than unplug and replug and try fr again

[hollow grail]

just ran it, let me re-try unplugging

Seems to be working good so far

I'll keep you updated, thank you

Extracting ISPW file right now

[zealous bridge]

@hollow grail you went to 14.2?

Damn that’s pretty rare

[hollow grail]

restore successful it says

[zealous bridge]

Congrats

[hollow grail]

Its rebooting my device now

[zealous bridge]

yes

[hollow grail]

yeah, wow I'm shocked it went this far lol

thought this whole operation was gonna flop

[zealous bridge]

@hollow grail what version were you coming from

[hollow grail]

13.3.1

[zealous bridge]

Oh ok

[hollow grail]

yeah I wanted some of the new ios 14 stuff

[celest basalt]

yeah coming from 13.x or lower has a higher chance of working

something about secure storage apparently

[hollow grail]

"Attempting data recovery"

[celest basalt]

I still don't get how that works though

[hollow grail]

It says that on my screen

Is that normal

[celest basalt]

I think that's normal if you used -u

[hollow grail]

oh kk, sweet

yeah I wanted to save data

I'm just happy I saved my blobs lol

[celest basalt]

I still don't get how going from 13.x to 14.0-14.2 works but from 14.3+ it doesn't, like can't we just fully nuke the existing OS on the device somehow first?

[hollow grail]

Very odd yeah.

To be honest the only reason I use IOS is because of the jailbreak community

Or else I would be on android

[celest basalt]

maybe we need one of those InternalUI builds and wipe iBoot partition /s

although idk if you could set nonce after that on A12+

not sure if that messes with nvram

[lilac wren]

how about we put our own bootrom on our own processor

[celest basalt]

at that point it's just an Android phone

[lilac wren]

Lol true

[hollow grail]

yeah lol but with the apple ecosystem and stuff

iMessage, etc

I like those stuff

Seems to be going good so far, the loading bar is getting bigger for the data recovery stuff.

Almost half way there

[zealous bridge]

That or recfg checks

[celest basalt]

I'll recfg your mom

[zealous bridge]

Hopefully nothing like this happens in iOS 15

jinx me Apple

[celest basalt]

imagine if Apple adds actual downgrade prevention (regardless of signing status)

though that would only work in A15

because DFU exists

unless they shorten signing windows even more

[zealous bridge]

And nuke delayed ota

Tbh yeah all these problems could be fixed with a SEP exploit uno (delayed ota downgrades, fr to 14.0-14.2, A11 checkra1n)

maybe researchers should focus there

Masterlass by apple tho

Moving more and more shit to SEP because hardly anyone will look there, they’ll focus more on the AP

[valid adder]

Wtf it said this channel was at the beginning like it had just been created

[zealous bridge]

discord moment

[valid adder]

What I miss

@zealous bridge

[hollow grail]

Aye 👍

Successful, thanks a lot guys

[valid adder]

@hollow grail from what iOS

[hollow grail]

13.3.1

[valid adder]

Apple moment

[hollow grail]

Time to re-jailbreak and get some tweaks

Yeah for real

[pseudo stump]

yo another question

ive „saved“ blobs on tssaver website since last year

[valid adder]

@hollow grail apple broke downgrading to 14.2 and below when they released 14.3 so you can only upgrade to it from 13 😩

[hollow grail]

ah that sucks

[zealous bridge]

Nm, shshd is gonna become default soon

[pseudo stump]

and i was looking at my ios 14.0.1, 14.1, 14.2 blob folder yea

[zealous bridge]

so more ppl gonna have blobs

[valid adder]

I saw Hayden comment in proc server

He fixing linking c

[zealous bridge]

Yeah

[pseudo stump]

and all i find is „apnonce-(tons of numbers)“ with no other files

does that mean it didnt save

[hollow grail]

I honestly just wanted built in apple features without jailbreak as I don't want to be fully dependent on it, its just nice to have some more built in apple features. I just mostly use jail breaking to fix some things I don't like about IOS and skinning the device.

[zealous bridge]

Folders?

[soft turtle]

Oh nice

One thing I’m not sure though is how to only do it for betas that are signed

[zealous bridge]

Did you see the file

It has signing status

[soft turtle]

Wait I’m blind

Nvm

Oh yay this is awesome

@shy magnet does the API manually invoke tsschecker to check signing status?

[shy magnet]

yeah

it is a static API so you'll need to make sure the identifiers are capitalized correctly and such

and also there's a few *really* old devices that don't have anything and will just return a 404

but besides that should be good

[soft turtle]

Ok, thanks this will be pretty easy to implement

[shy magnet]

np

[soft turtle]

I was thinking, since it’s ok to have the API delayed by some time, what if you set it up as a cron schedule on GitHub actions to update a json file in the repository

This way u have zero server costs

[pseudo stump]

its like this

[zealous bridge]

Are there files inside the folder

[pseudo stump]

nope

thats for like 2-3 versions

[zealous bridge]

yeah then the blobs arent there for some reason

[pseudo stump]

nice

[zealous bridge]

the folders that do have files in them you have blobs for

[pseudo stump]

i thought i could restore to 14.0.1 sometime but ig tsssaver decided to not save them

welp

[soft turtle]

@shy magnet

[shy magnet]

for now won't bother as im already using my server for other stuff

but will consider if the future if i can't pay for it

[soft turtle]

ah, makes sense

[pseudo stump]

also is there any reason why some versions are blue here and others arent?

[shy magnet]

prob folders you've opened in the past

[pseudo stump]

oh makes sense

[celest basalt]

shshd is now default cc @zealous bridge

Using anything but sileo itll make u install it

Sileo should but doesnt

[zealous bridge]

Simple sudo apt upgrade works too right?

[celest basalt]

I suppose so

[zealous bridge]

alright

[pseudo stump]

is that for all devices?

[zealous bridge]

A11+ confusingly

[pseudo stump]

weird

[celest basalt]

its been a while since ive used futurerestore. is their a guide?

espicaly for the gui version

[zealous bridge]

Yes

!t fr

[mystic axle]

fr

futurerestore allows you to upgrade/downgrade/restore to unsigned iOS versions if you meet certain requirements.

Tutorial

Added by stkc#8018 | Used 69 times · May 12, 2021, 10:01 AM

[celest basalt]

thank you

[zealous bridge]

bruh again

k wait

[celest basalt]

this is weird. i cant download ios 14.5 from ipsw

[toxic lotus]

cause it’s not signed

[celest basalt]

dont i need the ipsw to downgrade using futurerestore?

or am i stupid

[zealous bridge]

wdym

[celest basalt]

@zealous bridge I get this. Im using chrome with a bunch of extensions. I could use Safari

[zealous bridge]

yeah you're getting cucked from somewhere

use a different web browser

[celest basalt]

I will thanks

[zealous bridge]

@zinc moon still not default

[celest basalt]

Yeah it is

[zealous bridge]

i'm using ora1n script and its not installed

[celest basalt]

Its not in a strap. Its marked essential.

Cydia zebra and installer will make you install it

[zealous bridge]

yeah thats what i thought idk why dabezt keeps saying its default

[celest basalt]

could someone see if this link works? I think I blocked it on my router by accident
https://updates-http.cdn-apple.com/2021SpringFCS/fullrestores/071-17716/B8F4C604-0526-4A46-83B3-B956078C574D/iPhone_4.7_P3_14.5_18E199_Restore.ipsw
just asking

yep

[zealous bridge]

weird

[celest basalt]

that happend to me

is that supposed to happen?

[zealous bridge]

nope

did apples ssl cert expire

[celest basalt]

im not sure. after going past that it wouldnt let me download anything

[zealous bridge]

huh it works for other ipsws

[celest basalt]

maybe they moved survers? for wwdc

ohhh oka

okay

[zealous bridge]

what phone is it @celest basalt

wait for a sileo fix

[celest basalt]

its an iPhone 8 GSM

i Think its affecting all of them cuz rhe iphone 12's are also down

[zealous bridge]

@celest basalt i know why

you're using https

[celest basalt]

ohhhhhh.

thank you!

[zealous bridge]

remove the https from this link and you should be able to dl it

[celest basalt]

it works thanks!

[zealous bridge]

np

[celest basalt]

yep it was hhtps everywhere

[zealous bridge]

what

Oh

Lmfaoo

You gonna get warned for off topic tho frfr

oh ok

lol i was rebooting every time to jump between snapshots when i couldve just userspaced

🤦‍♂️

[abstract briar]

Quick question - what's the lowest version I can downgrade to currently? (iPhone X, A11, saved blobs for all versions including betas)

iOS 14.6 SEP and baseband is still compatible with 14.3? I thought it isn't

[zealous bridge]

It is

[zealous bridge]

It’s compatible down to 13.4 in reality

But you can’t downgrade that far

[abstract briar]

Oh cool, thanks

[zealous bridge]

Faxx

[abstract briar]

isn't it that baseband is compatible, but SEP isn't or something like that?

[zealous bridge]

Among other things

Enjoying the eta kids

[zealous bridge]

Other way round

Big fr

!jumbo

[mystic axle]

https://cdn.discordapp.com/emojis/712506651520925698.png

https://cdn.discordapp.com/emojis/784338955759517696.png

[zealous bridge]

I’ll bet my second phone

[lilac wren]

As *stupid lol, so many people here are entitled to their "tweak machines" basically

[zealous bridge]

Yeah

If you don’t have one set then it won’t use apnonce and generator

which is fine for A11-

A12+ when will you ever not have a generator set

while jb

Yes

[celest basalt]

so i have a question. on the guide it dosent tell u to use sep or broadband. should i still use it? especially for the gui

[zealous bridge]

the gui auto selects the latest sep and baseband

you don’t need to do anything else regarding it

[celest basalt]

ah okay thank you!

@zealous bridge so my mac cant place my phone into recovery. what should i do?

[zealous bridge]

enter recovery mode manually

[celest basalt]

would that be the way checkra1n does it?

[zealous bridge]

!t dfu

[mystic axle]

dfu

How to enter DFU mode or enter Recovery Mode on each device

Added by eric#1997 | Used 265 times · Dec 21, 2020, 11:21 PM

[zealous bridge]

or yeah let checkra1n do it

[celest basalt]

hi i almost got the tutorial but my problem now is how disable TO FACTOR AUTHENTICATION KEY?? in order to boot my device from recovery over and over again

[zealous bridge]

Are you on Android or something

You don’t need 2FA to get into recovery mode

[celest basalt]

IOS

it wont let restore on unsigned ios 14.3 unless you dont provide a authentication code from country sim card

its about to restore to 14.3 but its keep on going to recovery mode due to asking for a authentication code from sim

[zealous bridge]

Screenshot?

[celest basalt]

i cant

[zealous bridge]

how are we supposed to help you then

take a screenshot with the device you’re talking from

[celest basalt]

my device stock on recory mode On and OFF all over again

[zealous bridge]

Can you find a picture that looks similar to it on google

[celest basalt]

wait

just like that and unplugged my device

[valid adder]

[celest basalt]

what to do so that i will complete the restore

[valid adder]

You get on your thinking cap

[zealous bridge]

These two images are completely unrelated

if you’re in recovery mode just use futurerestore

[celest basalt]

man everytime you restart my device it will ask a authentication code i set before on my icloud account

[celest basalt]

well, can't do two factor auth with the phone in recovery

unless you take out the SIM

and put it in another phone

or you have a Mac/iPad logged in to iCloud

[zealous bridge]

Put the authentication code in then

[celest basalt]

maybe i can takeout the sim and put it on another device and restore it again>

[lilac wren]

Does this have anything to do with FutureRestore

[valid adder]

This mf still failing to screw in a light bulb

[celest basalt]

is it normal for the gui to be waiting for a FDR message for a while?

[zealous bridge]

What device and what’s the target and origin iOS?

[celest basalt]

iPhone 8. iOS 14.5 and iOS 14.7

[zealous bridge]

It’s pretty common with A11 but not with 14.5 restores

I’d say wait for it to do it’s thing

If it’s more than like 10-15mins somethings wrong

[celest basalt]

ah okay. do you have an estiate for how long it usally takes?

ohhh

okay thanks

[celest basalt]

its been like 20 minutes. and its still at that stage. what should i do? a small line has appeared on the apple logo tho

[zealous bridge]

is that progress from when the line started happening?

The loop*

I think you should be ok to hard reboot and come out of it unscathed, if it’s only a little bit

[celest basalt]

https://www.google.com/search?q=apple+update+progress+bar&tbm=isch&source=iu&ictx=1&fir=QByoWyscqaJr-M%252CtQoGFOROjZHbwM%252C_&vet=1&usg=AI4_-kRJ-z3JuJnqh3OQfvg3M-2mJlEXaA&sa=X&ved=2ahUKEwjmtbPTzIHxAhXYW80KHbWuCXcQ9QF6BAgNEAE#imgrc=QByoWyscqaJr-M
like this. but much closer to the start

or should i stop futurerestore

[zealous bridge]

you should probably just attempt another restore

[celest basalt]

cuz theres button

alright

[zealous bridge]

yeah stop it, hard reboot and try again

[celest basalt]

alright thanks

[zealous bridge]

@celest basalt tell me if the device boots normally after you hard reboot

[celest basalt]

it dose not. its just stuck on the restore screen. the mac and the charging cable

[zealous bridge]

Press “Exit Recovery” in the GUI

[celest basalt]

i do. then it just goes right back to the restore screen

brifely shows the apple logo

[zealous bridge]

I think you can just press “Start futurerestore” again

just make sure -u is not ticked

[celest basalt]

yea I can.

i only have the extra logs on

is that ok?

[zealous bridge]

Yep

[celest basalt]

alright. ill let you know if it works. thank

thanks

[celest basalt]

so it says the apnonce dont match. i cant change it cuz the phone wont boot out of dfu mode

[zealous bridge]

Really?

That’s strange

[celest basalt]

yep

[zealous bridge]

It should still be matching

Yeah you gonna have to restore the phone

[celest basalt]

damn alright :/

thanks tho

[zealous bridge]

Yeah you can either have a crack at it again or just stay on 14.6

[celest basalt]

ill prob try again. i want to try that manticore thing out,

[zealous bridge]

Does it not support 14.6 too?

[celest basalt]

i dont think so?

[zealous bridge]

It does

[celest basalt]

really?

[zealous bridge]

https://twitter.com/rpwnage/status/1399467964076859408?s=21

rpwnage (@rpwnage)

Good news. This exploit can make pwnMy compatible with iOS 14.6. I‘ll include it to give support to both iOS 14.5 and 14.6. these are very good news for the safari jailbreak project. Keep in mind that while these are good news, a kernel exploit is still needed. https://t.co/49XpZXc82m

Likes

287

Twitter · May 31, 2021, 8:48 PM

It’s not a jb tho

It’s just a website

[celest basalt]

wow alrigth thank you

[zealous bridge]

With some JS fuckery

[celest basalt]

yep. pretty cool if you ask me. wonder how long its been since smt like that

[zealous bridge]

like 4 major iOS versions

[celest basalt]

thats pretty cool. i dont remeber any of that. prob too little

[lilac wren]

iOS 14.6 RC1 isn't signed though
#842197751316086804 message

unless they just never changed the name of the folder

[zealous bridge]

14.5

[lilac wren]

Can we save delayed OTA blobs and use them in pwndfu

[lilac wren]

idk the folder says 苹果14.6rc1手机sep

[green onyx]

LOL

[zealous bridge]

think so

as long as theres no bcert fuckery in response

[lilac wren]

bruh what I was expecting you to say "u r stupid"

does anyone with ≤A11 wanna try

[green onyx]

just do delay ota and save onboards

[zealous bridge]

why

[green onyx]

^

[lilac wren]

oh we can't get a tss response though

bc we can't generate bcert

if downgrading

[zealous bridge]

yes

[lilac wren]

aw

wait

[zealous bridge]

thats why you save it for upgrades

[lilac wren]

can we use someone else's bcert?

is the bcert really in the response as well?

[zealous bridge]

i’m like 95% sure it isn’t

but again the response would be tied to ApECID

so gl

[lilac wren]

yeah we just do our own tss request

with our own ecid

[zealous bridge]

with what BCert

[lilac wren]

the only thing we change is put a valid bcert

[zealous bridge]

yeah

ok

[lilac wren]

from someone else

[zealous bridge]

that’ll work

[zealous bridge]

ih

uh

[lilac wren]

idk I expect that from everyone

[zealous bridge]

BCert depends on

SEPNonce

First of all

So gl

[green onyx]

bruh

[zealous bridge]

I’m pretty sure

[lilac wren]

does tatsu check that SEP nonce matches bcert?

[zealous bridge]

BCert has a lot more situtation specific

[zealous bridge]

device sep nonce has to match

otherwise restore will not work

[lilac wren]

in pwndfu?

[zealous bridge]

like at all

[lilac wren]

We can use --latest

[zealous bridge]

no, just any OTA that uses that bcert

why are you talking about bcert like its gonna affect response

Lemme check what else bcert depends on

Not depends

[lilac wren]

If it doesn't affect response then we could use someone else's bcert to get blobs for our own ecid right

[zealous bridge]

no

because

In simple terms, each BCert is tied to the ChipID of the device, the ECID of the device, the target version and the Current SEPNonce. The BCert is also limited in the time that it can be used, each BCert only lasts for a period of three days.

Did you read the TSS part of the writeup

[lilac wren]

Yeah but why does this matter if none of this is in the response

Unless tatsu specially checks bcert sees that it doesn't match and says "no"

[zealous bridge]

I’m pretty sure ECID, ChipID is in the response…

bruh

otherwise blobs wouldnt be device specific

[lilac wren]

No I meant bcert

[zealous bridge]

The ECID isn’t in BCert

Just tied to it

[lilac wren]

Like we just make our own TSS request like normal

But add in bcert to get delayed ota signed

[zealous bridge]

Yeah

Well yeah if that BCert is generated by your own device then sure

[lilac wren]

Why not another though

[zealous bridge]

Because

Each BCert

Is tied

To a specific ECID

That’s literally just like saying “Let’s use blobs, but we’ll take the ApImg4Ticket part from someone else’s device”

[lilac wren]

Yeah but if bcert isn't in the response

[zealous bridge]

bcert isn’t, but ECID is

[lilac wren]

Ok then why can't we use these blobs with someone else's bcert in pwndfu

[zealous bridge]

Because the signature would be invalid?

If the BCert was used with your own ECID, it would generate one signature. If it was used with another ECID, then it would generate another signature

Remember that BCert has some SEP UID fuckery too

It’s all encrypted to that specific device

@valid adder could we not do some sort of reused key attack on the A12+ ApNonces to find the generator to an apnonce without knowing the key

[lilac wren]

But you said bcert isn't included in response

[zealous bridge]

I heard AES absolutely shits itself when it comes to reused key attacks, i watched a video where all someone did was xor them together and they got plaintext w/o key

[zealous bridge]

ok, look
My own BCert + My ECID = Specific ApImg4Ticket signature

Someone else’s BCERT + My ECID = A different ApImg4Ticket signature

BCert doesn’t have to be in response, if the signature is not valid it’ll refuse to restore the OS

[lilac wren]

So bcert is in response

[zealous bridge]

no

the signature is in response

not bcert

bcert =! ApImg4Ticket

[lilac wren]

I mean it kinda is in response

It's like saying ap nonce isn't on response

[zealous bridge]

it’s used to generate the signature if that’s what you’re saying

but how is that the same as “it’s in response”

that’s like saying generator = apnonce

[lilac wren]

Bruh what

[zealous bridge]

think of the bcert as the generator and the signature as the apnonce. yes the generator is used to create the apnonce but is it ever actually in the response? no, only the apnonce is in the response

[lilac wren]

Uh it's all in the response or it's all not

[zealous bridge]

what

the apnonce is in the response

The generator isn’t

[lilac wren]

Yeah so bcert is as well

[zealous bridge]

but bcert isnt “the apnonce”

its the generator

[lilac wren]

...

[zealous bridge]

what

Did i say something wrong

[lilac wren]

Bcert isn't ap nonce

[zealous bridge]

I know

[lilac wren]

So bcert is in the response

Then we can't use someone else's

[zealous bridge]

Did you even read this

[lilac wren]

That easy

[zealous bridge]

But it’s not…

[lilac wren]

It is

[zealous bridge]

how

[lilac wren]

Otherwise we could use someone else's

[zealous bridge]

no

bcert is tied to the device

and will generate a specific blob

[lilac wren]

You can test it if you want

[zealous bridge]

you want me to test if bcert is in the response? ok, easy ctrl + f

[lilac wren]

Idk how to "unzip" img4 lol so if you can that'd be good

Or you can just try the pwndfu restore

[zealous bridge]

If it was in the response

It’ll just be

@BCert

Same way as request

Now I need a valid BCert for the request

And I cannot be bothered to set up MITM at 2am

anyone gonna give up their OIK in the name of research?

[lilac wren]

Can we tell arx8x for shsh.host to use @shy magnet 's api

[valid adder]

@zealous bridge tf? I just saw a video on this lol

[green onyx]

on what?

[valid adder]

#futurerestore-help message thread

[green onyx]

ah

[valid adder]

definitetley not since its cbc mode

reused key is only really possible on CTR and ECB aes modes

[shy magnet]

doesn't really matter if he already has his own method

[lilac wren]

I'm 99% sure it's manual

14.6 RC and RC2 (and I guess 14.7 b1 and b2) haven't been added yet

14.6 RC is already unsigned so

This could really help

[shy magnet]

probably is then

[zealous bridge]

Isn’t CBC with no IV the same as ECB?

Anyways I think Apple were thinking ahead… the apnonce is a shasum so gl with reversing anything

[shy magnet]

apnonce is a checksum
its sha1

at least on a9 and below iirc

[valid adder]

a9 and lower sha1(nonce)
a10 and above sha384(nonce) -> 64 chars

[hushed charm]

How do I find a device Apnonce?

[hushed charm]

not yet no

thank u sm

[valid adder]

dead chat

10 pm

[celest basalt]

what I did was capture the request, change apnonce and save blobs that way

since apnonce isn't in the BCert, only sepnonce is

and sepnonce doesn't matter if you're gonna use pwndfu

[zealous bridge]

just so froggy can have peace of mind, it’s impossible to use someone else’s BCert and save valid OTA blobs for your own device right?

[celest basalt]

yes

[zealous bridge]

BCert isn’t in the response however

It just verifies the signature, different BCert, different signature

was very hard for Froggy to understand yesterday

[celest basalt]

yeah pretty sure the response doesn't have a BCert, only ApImg4Ticket and other stuff generated based on the value of it and the other keys, but TSS will verify that ApChipID/ApECID/ProductMarketingVersion/SepNonce matches the one in the BCert in the request

[zealous bridge]

@lilac wren

[celest basalt]

(by keys I mean the items in the plist not the crypto kind)

[zealous bridge]

You ain’t gonna bypass ApECID with pwndfu

otherwise you’re just tether upgrading/downgrading

[zealous bridge]

Is the ECID in the cert? I thought it was just used as seperate keys and then kinda merged together with the cert to generate the signature

I know it’s device specific because of SEP UID fuckery but i don’t think the ECID is in the cert

because there’s not supposed to be?

It saves with default generators

[celest basalt]

yeah it's both in the BCert and a separate key in the request

that's what makes you unable to reuse the BCert for another device

because you can change the request without invalidating the whole request but it will invalidate the BCert if you change the ECID etc.

[zealous bridge]

yeah ic

i thought just encrypting it with sep unique identifier was enough to make it device specific, apple had to go thru all this extreme

[zealous bridge]

Were you using Gui

gui or cli

@celest basalt are you sure

I don’t see your log

https://routinehub.co/shortcut/9065/

Still use this

For apnonce verification

Nothing you need to worry about

nonce collisions

for really old devices

yeah the nonce wasn’t that random befote

it would always generate some nonces more than others

A9

It’s called checkra1n

but

not on iP12

just manually enter recovery manually

yes

but

are you restoring iP12?

ok then

just enter recovery

and close the app

Alright

[rustic blaze]

iOS 15 on the way tonight

[lilac wren]

Isn't it the day after tomorrow

Oh just plain tomorrow

[celest basalt]

is the 14.0 sep compatible with 14.6

[lilac wren]

Only on A11 and lower

[celest basalt]

thank the lords

im on a11

[lilac wren]

Phew

Wait

I think it might be A10 and lower

@zealous bridge I'm brain farting

Which is it

[green onyx]

A10

A11+ isn't compat

@celest basalt

[celest basalt]

bruh

[green onyx]

what ios version is your A11 phone?

[celest basalt]

14.4.2

[green onyx]

ye

it wont work

[celest basalt]

well im trying it anyway

i have nothing to lose

[green onyx]

well

u can try

ye

[lilac wren]

Yeah

[green onyx]

it wont work because fdr

but good luck

[lilac wren]

What if they tether boot to 13.5 with divise or something then FR to 14.0

/14.2

[green onyx]

no

[lilac wren]

Does it not change sep

[green onyx]

just no

[celest basalt]

wait i can tether boot to 13.5

[green onyx]

yes

[celest basalt]

how

[green onyx]

but its tethered

[lilac wren]

Does it not change SEP firmware

[green onyx]

not untethered

[celest basalt]

idc

i wanna do it

im tired of not having sep

[lilac wren]

https://repo.dynastic.co/package/divise

[celest basalt]

how do i tether boot to 13

or even 12

[green onyx]

btw, if u tether boot to ios 13

[celest basalt]

what

[lilac wren]

Idk if you'll have SEP though

[celest basalt]

its a dual boot

[green onyx]

its 1. tethered

[green onyx]

yes

ofc

[celest basalt]

i dont want a dualboot i want an actual os

[green onyx]

2. its "jailbroken" in a way

[green onyx]

impossible

[celest basalt]

ok

well what does "tethered" mean

[lilac wren]

Divise can do actual os

[celest basalt]

like what happens if i reboot

[green onyx]

u have to boot with a computer

[celest basalt]

using what

[lilac wren]

But your phone won't turn on unless it's on a computer

[green onyx]

it wont boot without a computer

[celest basalt]

what do i boot it with

redsn0w

[green onyx]

pyboot i think

[lilac wren]

Ramiel or pyboot

Or checkra1n I think

[green onyx]

ur device is literally a bricked phone until u get a computer

super not practical, at all

[celest basalt]

devise can do actual os

[green onyx]

?

no it cant

[celest basalt]

^

[green onyx]

its tethered

[celest basalt]

im not talking about tethered or not

im talking about 1 operating system on my phone

[celest basalt]

fuck

[celest basalt]

if i tether boot it what will it boot into

[green onyx]

theres a second OS

[green onyx]

the second one

[celest basalt]

my primary os or 2nd

[green onyx]

pretty sure 2nd

[celest basalt]

how do i get back into primary

im gettin ios 12

fuck 13 and 14

[green onyx]

idfk

i recommend not doing this

[celest basalt]

doesnt matter

i wont use the primary os

i will do it anyway

[green onyx]

¯_(ツ)_/¯

[celest basalt]

as long as sep is functional on the 2nd os

[green onyx]

[celest basalt]

is it functional?

[green onyx]

if its disabled on primary, idk if its enabled on secondary

idk

[celest basalt]

i guess im trying it and finding out

this seems easy enough

im using devise

ios 12

[green onyx]

hes the JTV knockoff

[celest basalt]

im not a knockoff of anyone

[green onyx]

LOL FR?

LOL

[celest basalt]

thats fine

i'll tether boot 14.3 then

[green onyx]

ok and?

u wont be able to use u0 or taurine

[celest basalt]

14.2.2

[green onyx]

bruh

[celest basalt]

why not

i'll be on 14.3

[green onyx]

its not a real OS

[green onyx]

u already have tfp0

and 2.

u wont have sep

man thinks hes doing big brain moves but hes not

A11

lol

14.4.2

not 14.2.2

[celest basalt]

14.4.2*

sorry

[green onyx]

14.2.2 doesnt even exist

only 14.2.1 exists

this

[celest basalt]

so i guess i have to wait for this web jailbreak

unless it will cease to exist like manticore

stop fucking suggesting me to use ora1n on a11

i want security

[green onyx]

then dont jailbreak

[celest basalt]

i'll just wait for pwnmy

[green onyx]

ok

[celest basalt]

what version will pwnmy support?

[green onyx]

14.5+

14.5 and 14.6

[celest basalt]

what

14.6 to?

[green onyx]

14.5, 14.5.1, 14.6

thats it

[celest basalt]

why not 14.4.x support

[zealous bridge]

@lilac wren did you figure out BCert

[green onyx]

because it doesnt support it?

dont complain smh

[celest basalt]

im not complaining im asking a question

[green onyx]

tldr: if u want a jailbreak, dont complain about security

[green onyx]

webkit exploit is 14.5+?

thats it

[lilac wren]

No I don't have a device

Well the iPad on 12.4.9

[celest basalt]

im just wondering why backwards compatibility doesnt work

[green onyx]

thats the same as asking "why doesnt taurine support ios 14.6"

[green onyx]

it just doesnt

bruh

[celest basalt]

thats not the same thing at all but ok

[zealous bridge]

Because the exploit uses a feature that Apple added in 14.5

AudioWorklet

[celest basalt]

thank you for an answer

[green onyx]

apple reusing their shitty code

[zealous bridge]

It just doesn’t exist on 14.4.2-

[celest basalt]

someone whos actually useful and knows what they're talking about

[green onyx]

an exploit doesnt work on lower versions

and this guy asks why

smh

[zealous bridge]

Yeah so it’s like if the exploit used shit code in Widgets it wouldn’t work on 13 because there aren’t any Widgets in 13

[plain mist]

:OOO

[green onyx]

i mean, this isnt the first time an exploit doesnt have backwards compatibility

remember ios 9.x.x? for 64bit

[celest basalt]

instead of saying "it just doesn't" just give me a legit answer

[zealous bridge]

restoring program to unsigned versions

[green onyx]

cool tool to go to unsigned ios versions if u have blobs

[celest basalt]

yea there was a reason for that one to not just "it just doesn't"

[plain mist]

what that mean!!

what is unsign version

[green onyx]

aight fine mb

[green onyx]

this is a troll

time to block

[celest basalt]

hes asking a legit question

[green onyx]

hes not, if hes asking it like that

[celest basalt]

how in the world is he trolling

bruh

[green onyx]

!!!!!!

also, man is spelling things wrong-ish

[celest basalt]

so asking what an unsigned version is = trolling?

[green onyx]

also

white name

[lilac wren]

He might not be good at English

[green onyx]

gives me troll vibes

[zealous bridge]

!t unsigned

[mystic axle]

unsigned

When an iOS version is "unsigned", that means you can no longer upgrade/downgrade to that version & can no longer save blobs for that version. If you are already on that version, nothing changes for you. However, you can use futurerestore to upgrade/downgrade to unsigned versions if you previously saved blobs, and are currently jailbroken, and the latest version's SEP/baseband are compatible with the target version at the time of using futurerestore

Added by eric#1997 | Used 42 times · Dec 21, 2020, 11:18 PM

[zealous bridge]

@plain mist

[plain mist]

true!! I’m from Korea

한국어 말할 수 있어

[zealous bridge]

You can try and google translate that

[lilac wren]

Unsigned basically means Apple isn't giving you permission to go to that version anymore. You also can't get blobs for unsigned versions

[celest basalt]

this man thinks hes trolling lmao

[plain mist]

:OO

[green onyx]

aight fine, this guy probably not, but like 99% of trolls are like this

based on past experience with helping ppl

[celest basalt]

just help people man, dont auto assume they are trolls

[green onyx]

i didnt assume u were a troll

[celest basalt]

how am i different from this guy?

i asked questions just like him

i guess its cuz hes a white name or something

[green onyx]

eh no, just that he spells it a bit differently and uses a lot of !!!! gives me the vibes

LOL!!!!!!!

^this is so cringe and weird

just gives me troll vibes

[zealous bridge]

I mean there’s a Rule 14, but i don’t think folky would bash a whitename for no reason

he’s helped a lot of people before so he’s probably better fitted to know when someone’s trolling or not

but again you’re right he shouldn’t assume

[green onyx]

ye, the assumption was bad on my end

[lilac wren]

This, compassion 1st

[celest basalt]

helping people do be nice

[zealous bridge]

JTV boutta come in here…

[green onyx]

LOL

[celest basalt]

you guys sit in here for hours a day helping people

[green onyx]

hes offline tho

[celest basalt]

respect

[lilac wren]

Well used to, not many people FutureRestore nowadays

Maybe like 2 every 3 days lol

[green onyx]

^since delayed ota came out

[zealous bridge]

they will come soon

[celest basalt]

futurerestore isnt as useful as it used to be

[lilac wren]

Once the next jb comes out

[celest basalt]

its still nice tho

[lilac wren]

We'll get flooded again

[green onyx]

with delayed ota

not fr

lol

because theres plenty without blobs

[lilac wren]

Delayed ota is trash

[green onyx]

true

[lilac wren]

Only time it will ever be good

Is for incompatible SEP and bb

[green onyx]

@celest basalt start saving blobs btw

it doesnt hurt to save and pretty worth it in the future

[celest basalt]

i've been saving for years

i just took a large break from jailbreaking

[green onyx]

wait, how do u only have ios 14 blobs

[celest basalt]

and missed all the 14.0-14.3 blobs

[green onyx]

ah

rip

[celest basalt]

i have blobs for 14.0 b4 tho

thats why i was wondering

[green onyx]

b4 is worse

buggy af

[celest basalt]

ik

[green onyx]

betas aren't worth staying unless its a rc

[celest basalt]

[pseudo stump]

so i was reading this convo and i thought abt this devise thingy

couldnt i technically dual boot or tethered downgrade my ipad to like ios 13.7

it doesnt need baseband so

[zealous bridge]

divise requires compatible sep/bb

iirc

[lofty ginkgo]

No, SEP is incompatible

[pseudo stump]

sep is compat till 13.4 right

[lilac wren]

Yeah I think

[zealous bridge]

on A10- but there’s still that recovery loop problem

idk about wifi only ipads tho

[pseudo stump]

i could try dual booting it first

[zealous bridge]

do you have a Mac

[pseudo stump]

what program do i need to run this

does a hackintosh work

[zealous bridge]

Probably

With proper USB support

[pseudo stump]

well let me set that one up

[zealous bridge]

You need Divise/Succession, and Pyboot/Ramiel

[pseudo stump]

yeah alright

[lilac wren]

Happy 1,000 FutureRestore GUI successes!! 🥳 🎉

[pseudo stump]

nice

[zealous bridge]

🥳

[pseudo stump]

does devise erase the main os on both dual booting and tethered downgrade?

[zealous bridge]

no only tethered downgrade

[pseudo stump]

it shows „erase iPad“ on both things

weird

[zealous bridge]

weird

prob a bug

[pseudo stump]

imagine its gonna erase the main os

then gg

[weary ibex]

futurerestore gui says checking buildidentity and on terminal from bottom its says conected ecid : N/A

[zealous bridge]

yes theres not gonna be a dedicated progress bar for everythin

[weary ibex]

viYpIMiirecv_event_cb: device 00167038byhuoio,gykuogyiomgy uoy,guoyubi008bc326 (udid: N/A) connected in Recovery mode

like this

[zealous bridge]

nice ecid

[weary ibex]

swolved now help me

can you help me

[zealous bridge]

What’s wrong?

[weary ibex]

its stays for 20 mins like this

[zealous bridge]

What does the device look like

[weary ibex]

rec mode

[zealous bridge]

Ok then you can safely stop futurerestore and try again

Maybe reboot PC

Before trying again

Could be cable issue too

[weary ibex]

let me try again

its original one

[valid adder]

full non-system dependency list

[weary ibex]

same err

UBUNTU its the system

[zealous bridge]

@weary ibex do you get this error

[weary ibex]

yeah but i did by myself

[zealous bridge]

You entered recovery mode manually?

then you shouldn’t get that error

Try different port and cable

[weary ibex]

let me try a port from back

same

[zealous bridge]

Is it always this error?

[weary ibex]

i tryed manualy future restore its apnonce bug

[zealous bridge]

It’s not a bug

You didn’t set your generator

[weary ibex]

i did on ios 14.6

yeah but i did set allreaqdy

lets try again

let @lilac wren gui dosent say apnonce missmatch

[valid adder]

@lilac wren add case id system so we can just ask them for the id when it pops up

[lilac wren]

like an error code for the error code?

[valid adder]

No like id so we can find the correct log

If someone is asking here

[weary ibex]

[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
Finished downloading the latest firmware components!
Found device in Recovery mode
Device already in recovery mode
irecv_event_cb: device 00167038008bc326 (udid: N/A) connected in Recovery mode
Found device in Recovery mode
Identified device as d101ap, iPhone9,3
Extracting BuildManifest from iPSW
Product version: 14.3
Product build: 18C66 Major: 18
Device supports Image4: true
Got ApNonce from device: 8f 89 0b 23 a9 f7 d5 25 74 d1 bb 98 a4 a0 8c f5 70 77 66 9c 80 5c 5a 28 74 d3 e6 06 f5 80 e8 3d
Cleaning up...
[exception]:
what=Device ApNonce does not match APTicket nonce

i press 10 times

[zealous bridge]

Did you set 0x1111111111111111?

[weary ibex]

set nonce

[valid adder]

When restore finishes, popup id so they can post it here and we can more easily search logs @lilac wren

[zealous bridge]

What nonce did you set

[weary ibex]

ok lets try

0xbdxxxxxxx

[zealous bridge]

That’s not the right one

[weary ibex]

from tss

saver

[zealous bridge]

You didn’t set properly

you got some random apnonce

[weary ibex]

0xbd34a880be0b53f3

[zealous bridge]

@weary ibex what do you use to set nonce

[valid adder]

electra moment

[weary ibex]

this from ticket

viYpIMilbxh0EH+SbOdf3kHJ2C0jRhYlPEuwAtWzC+tMfBxka9Swj7ojrD2S
ahSIBcLl7d1Krp7ZhuepfqA1yb4rDkkxsrOpDgD0frB9UJGUl5Jz3MtY2lbx
ILgTolZNhVzXnpbAw20oK+6C69nuY/nmkIrZ7pCBGJzgQOah2Dc+8yKSJVke
wQTw8hZdjAe+pFEC2f4WJ7xccYsgE3yOqYm4pvxGrtADSYXD9T3o0Fh0oK9p
Bgg2RwoP60uzgKx5+wQOSl3UVQ8y5+V96MK0Z2k7HHH/2uqP8fSYYPoM60Q8
GQxwWfMfys2+AqoJ2FA=
</data>
<key>RestorePSI-PartialDigest</key>
<data>
hAAAAED5AQAzIWi1WPRsSUTGz8sCYhkjgGY929PyrVa5SdIm2PXNiw==
</data>
</dict>
<key>generator</key>
<string>0xbd34a880be0b53f3</string>
<key>updateInstall</key>
<dict>
<key>@ServerVersion</key>
<string>2.1.0</string>
<key>ApImg4Ticket</key>
<data>
MIIazhYESU00TQIBADGCEgv/hOqFnEKCEgIwghH+FgRNQU5CMYIR9P+E6oWc
UIIBDzCCAQsWBE1BTlAxggEB/4SSuYZIKjAoFgRCTkNIBCAVQAB2vEw1p8jK
79yuW9ppwUChG86HBUjwhiqsKMGUzP+Ekr2kRAswCRYEQk9SRAIBDP+EmpWg
TwswCRYEQ0VQTwIBAf+EmqGSUA0wCxYEQ0hJUAIDAIAQ/4SawaRPCzAJFgRD
UFJPAQH//4SazYpDCzAJFgRDU0VDAQH//4SqjZJEETAPFgRFQ0lEAgcWcDgA
i8Mm/4WakZ5NCzAJFgRTRE9NAgEB/4ebud5uHjAcFgRzbm9uBBQFOYVXHPmD
GflKmPH2YYs1W5E9RP+Hm8nsbh4wHBYEc3J2bgQU0AvpWjPawLWCQk4MaHQD
EQZxoLD/hou94GaBgTB/FgRhb3BmMXf/hKKdplQ6MDgWBERHU1QEMCi2nHoD
tS0LTU+WqnzCLgNBveaFBi20rX19t89Hc3aOwcorEM1ijR9RaOt0IjNLpv+E

[valid adder]

[zealous bridge]

pls answer my question

you want me to help you

[weary ibex]

no let me try first

[zealous bridge]

this guy complains that he doesn’t get any help and then doesn’t listen to advice

[valid adder]

popup is the only thing that makes sense otherwise you run in the same problem we created case ids for

redundant otherwise

[lilac wren]

oh that's big brain

but a popup after every error may be intrusive, I could just append to log after "FutureRestore process ended." a "Log uploaded. ID: 30293" or something

[weary ibex]

what the comand for manual set apnonce

[zealous bridge]

sudo dimentio 0xbd34a880be0b53f3

[valid adder]

@lilac wren lastLog.txt?

has the id

[lilac wren]

bruh even clicking exit recovery would give a popup

[zealous bridge]

maybe put it in the window title

like Futurerestore GUI - ID: 51719

its more noticeable

[lilac wren]

hm

not a bad idea

[zealous bridge]

but only when fr is running or something

[lilac wren]

I feel like the user shouldn't really notice the ID, but it should be super easy to access if we ask for it

[weary ibex]

command not found on phone

[green onyx]

whats happening

[zealous bridge]

install dimentio

[green onyx]

what are u running

dimentio?

[zealous bridge]

[[dimentio]]

[mystic axle]

dimentio

PoC tool for setting/getting nonce without triggering KPP/KTRR/PAC. (requires tfp0)

Author

0x7ff

Version

2.0.0-1

Price

Free

Repo

1Conan

Add Repo

Click Here

More Info

View on Parcility

com.0x7ff.dimentio • Page 1/5 · Jun 6, 2021, 3:49 PM

[lilac wren]

Remember users can put their Discord username in the Settings page so we can identify them easier

[zealous bridge]

No one does that

lol

[lilac wren]

one person did once

Lol

[green onyx]

honestly, tanbeer should merge his shortcut into frgui

yes

[lilac wren]

maybe

[green onyx]

his blob/nonce shortcut thing

localssh

[zealous bridge]

i can make a bash script

Probably

[green onyx]

pog

aight imma study now

ap test in 4 days

scared af

[zealous bridge]

but then again i don’t want to fix two different things at once - probably just linking the shortcut is good enough

[zealous bridge]

gp

gl

you got this

ez

[green onyx]

ty

im probably getting a 4 anyways

[zealous bridge]

at nonce lmfao

at once*

idk i cant spell

why does nyu keep lurking

you and jtv both man

dodgy

[green onyx]

@vivid nova why are u always the apple security team

at like every apple event

[vivid nova]

Same reason I'm always in your mom

[green onyx]

[celest basalt]

welp you were right

divise bootlooped me

:(

[zealous bridge]

rip

[celest basalt]

i tried 12.4 but uh no luck

ima try 13.3