you cannot retrieve the onboard blob
#Retrieve Delayed OTA Blobs
hallow iron
no you have the blob stitched to iBoot; it’s just that you can’t save it
since you need a jailbreak to save onboards
yes
hallow iron
well
twilit linden
It shouldn’t be that hard
finite flower
finite flower
cat /dev/rdisk1 | dd of=/var/mobile/Documents/dump.raw bs=256 count=$((0x4000))
then img4tool --convert -s dumped.shsh dump.raw to actually get a blob
stone basin
`cat /dev/rdisk1 | dd of=/var/mobile/Documents/dump.raw bs=256 count=$((0x4000))...
unless they’ve gone through the annoying process of mounting /var won’t it make more sense to cat to PC
@amber fable your script is broken
Nathan made the script
let’s see what he says
amber fable
Add ipad7c
So it would be like
./sshrd.sh ipswlink boardcfg shshblob ipad7c
not like that
j171
replace that argument
With that
j171
What ipad
./bootA10+.sh
Gtg
amber fable
alright
testing rn
copy fail
happened to me too
lets see if
rmeoving my change fixes it
soo weird
it's not wanting to decrypt
odd
it's either:
github actions being ass
or:
cryptics fix is fucked up
cuz i compiled original, and it worked
@wide wyvern lets see if this fix works
@solid ermine cryptics image thing broke decrypting on a10+ 
@wide wyvern
fixed it
solid ermine
<@893650678432550942> cryptics image thing broke decrypting on a10+ <:troll:7943...
no jt didn’t
solid ermine
yes it did
how did i decrypt an image then?
amber fable
reverting it fixed it
solid ermine
amber fable
@wide wyvern do rm macos/gaster and run the script again
solid ermine
why are you speaking for A11 tho?
amber fable
o then do
rm linux/gaster
@solid ermine cryptics image thing broke decrypting on a10+
WTF
solid ermine
still applies to a10
ok
amber fable
@wide wyvern did you reboot and go back to dfu from last time
ok
@solid ermine see
now
cd sshramdisk
./bootA10+.sh
solid ermine
<@893650678432550942> see
what am i ment to be seeing?
amber fable
what am i ment to be seeing?
it works now
solid ermine
Do you see "OK, Running Server"
amber fable
ipad should sart verbosing
solid ermine
yeqh
amber fable
what blobs did you use
were they from the same ecid
irecovery -f iBSS.img4
irecovery -f iBSS.img4
irecovery -f iBEC.img4
irecovery -c go
irecovery -f ramdisk.img4
irecovery -c ramdisk
irecovery -f devicetree.img4
irecovery -c devicetree
irecovery -f trustcache.img4
irecovery -c firmware
irecovery -f kernelcache.img4
irecovery -c bootx
run those
rn
just run rn
no reboots or anyting
@wide wyvern lmk if the ipad backlight turns on when you send ibss
run
irecovery -f iBSS.img4
multiple times
amber fable
ok now run
irecovery -f iBEC.img4
irecovery -c go
irecovery -f ramdisk.img4
irecovery -c ramdisk
irecovery -f devicetree.img4
irecovery -c devicetree
irecovery -f trustcache.img4
irecovery -c firmware
irecovery -f kernelcache.img4
irecovery -c bootx
solid ermine
You could use any blob
amber fable
ye good
keep going
no????
irecovery -f ramdisk.img4
irecovery -c ramdisk
irecovery -f devicetree.img4
irecovery -c devicetree
irecovery -f trustcache.img4
irecovery -c firmware
irecovery -f kernelcache.img4
irecovery -c bootx
run these now
good
does it say OK
running server
solid ermine
yeah
solid ermine
i did say to use 14 a bit earlier
i could tell it was iOS 15 from the start because i saw kernel64patcher
amber fable
put the ipad back into dfu
and run the script again, but this time use a link to ios 14.8 @wide wyvern
solid ermine
it would say "entitlements to small" if it was a 14 kernel but if it’s a 15 kernel then it would say "internal error: no cdhash found"
solid ermine
oh and kernel 80xx is iOS 15 kernel and kernel 70xxx is iOS 14
amber fable
i am gonna add a reset script
well add it to the boot script
that resets iphone
./boot.sh reset
basically
solid ermine
nvram oblit-inprogress 5
solid ermine
amber fable
did you
let the script run
atleast
like did it finish
wheres it at rn
ok after
run git pull
solid ermine
to be fair they could just boot the ssh ramdisk and then ssh into the ramdisk and run nvram oblit-inprogress=5 and then reboot
amber fable
and try the boot script again
yes
./bootA10+.sh
after git pull
unplug and plug in
and see if it says ok
it might have just stopped there
and didn't finish printing
solid ermine
this is for an iOS 15 IPSW?
amber fable
yeah? does te ipad say ok
solid ermine
oh
amber fable
does the ipad say ok
ok
lsusb
does it show in there
the ipad
ok then it worked
solid ermine
run iproxy 2222 44 then ssh [email protected] -p2222
amber fable
yeah by 20 seconds
bro
@wide wyvern if it says connection reset im yelling at the libimobiledevice guy
amber fable
Does it say no device found
Whats it say
iproxy 2222 44
Ok
Bro what the fuck
does it say no device found
FUCK
My
Message
Are
Delayed
amber fable
It is
Iproxys fault
@wide wyvern let me guess
This shit happens to me on linux
And
Its
So
Damn
Annoyinf
Am about to close discord on my mac mini
solid ermine
so could you send a picture of the full verbose output?
solid ermine
@wide wyvern press a button like your side button or anything and see if it says anything
amber fable
<@304978432230424588> press a button like your side button or anything and see i...
Ur dumb
Its usbmuxd’s fault
solid ermine
amber fable
Btw
solid ermine
are you sure?
amber fable
Just a hint
solid ermine
like
amber fable
Yes bro
solid ermine
1000% sure
amber fable
It happens to me
1000000000000%
It happens to me
And i switch to macos without revooting device
And it works there
solid ermine
then use tcprelay
amber fable
@wide wyvern do you have a mac to switch to or nah
I might just fuckin
Add a working thing
Oh wait!
I remember!
Tcp relay doesnt work either
Its something to do with the device id being different @solid ermine
solid ermine
amber fable
What
Is
Happening
Bro
Its not the ipad, nor the scripts fault
Its bs with linux and usbmuxd
Yeah
That would work
solid ermine
Just use libveet
libvert
libvirt
imo libvirt is just a virtual machine manager
i mean that’s what it is lol
it still uses QEMU tho
amber fable
@solid ermine i added the reset option lol
if you want to reset do
./boot.sh reset
solid ermine
<@893650678432550942> i added the reset option lol
Ok
solid ermine
@amber fable does the SSH RD have img4tool 
yeah you could but how would you SCP it over
on an sshrd
finite flower
dont need to specify /var probably, i just sent that because its the command you use on-device
amber fable
yeah thats normal
cat doesn’t have the disk entitlement
i do not know how you would use cat on windows
solid ermine
mount_apfs -o rw /dev/disk0s1s6 /mnt6
cat /dev/rdisk1 | dd of=/mnt6/dump.raw bs=256 count=$((0x4000))
``` then not sshed in to the ramdisk run:
```ssh root@localhost -p 2222 cat "/mnt6/dump.raw" > dump.raw
wait
private var
what
no
amber fable
@wide wyvern try this
solid ermine
would that work or nah?
amber fable
mount_apfs /dev/disk0s1s1 /mnt1
solid ermine
iirc preboot would work for this
amber fable
cd /mnt1
dd if=/dev/rdisk1 of=dump.raw bs=256 count=$((0x4000))
amber fable
Hey, it might work
solid ermine
thats what i said
cat /dev/rdisk1 | dd of=/mnt6/dump.raw bs=256 count=$((0x4000))```we will use preboot for this
amber fable
Disk0s1s1 will revert
solid ermine
True but just go with this
amber fable
cd /mnt1
dd if=/dev/rdisk1 of=dump.raw bs=256 count=$((0x4000))
@wide wyvern do this
solid ermine
@amber fable fix sftp
amber fable
<@456226577798135808> fix sftp
Its fixed
amber fable
Do
amber fable
@wide wyvern umount it
solid ermine
mount_apfs -o rw /dev/disk0s1s1 /mnt1```mistake in the command
accidently added /mnt1 to the command sorry
solid ermine
just run mount_apfs -o rw /dev/disk0s1s1 /mnt1
amber fable
My air 2 absolutely fucking refused to mount system as rw
dd if=/dev/rdisk1 of=dump.raw bs=256 count=$((0x4000))
solid ermine
My air 2 absolutely fucking refused to mount system as rw
if it still doesn't work then fallback to preboot
amber fable
Ye
amber fable
cat /dev/rdisk1 | dd of=/mnt1/dump.raw bs=256 count=$((0x4000))```noooo
wtf
Oh
Ok
Might have to
add disk entitlement
but i have it on dd so
weird
cat /dev/rdisk2 | dd of=/mnt1/dump.raw bs=256 count=$((0x4000))```Try this
i did it on my air 2
And that worked
amber fable
Oh yeah
Its rdisk1 then
cat /dev/disk1 | dd of=/mnt1/dump.raw bs=256 count=$((0x4000))```I doubt this will work
But try it
weird that dd doesn’t work
ill try my touch 7, am almost home
solid ermine
testing it out now
amber fable
Ye, but dd has the entitlements
solid ermine
Ye, but dd has the entitlements
ima extract the cat ents then add the disk entitlement
solid ermine
i need a cat binary
wheres the cat binary
bro wtf?
this looks different
is it just me or this is different
solid ermine
it needs entitlements
what entitlements>
amber fable
solid ermine
just extract cat's orig entitlements with ldid and then steal the required entitlements from dd-ents.xml
what?
twilit linden
isnt ldid in the ramdisk
solid ermine
you would grab the cat binary from the ramdisk lol and then use ldid to extract the entitlements from cat
solid ermine
cat is in the restore ramdisk
yes
solid ermine
cat has literally no entitlements lmao
lol
yeah then just give cat the disk access entitlement
amber fable
@wide wyvern ok i have a cat bin, gonna test and push if it works
solid ermine
@amber fable how to load sep fw without panic
solid ermine
<@304978432230424588>
find a cli way of transfering the binary
amber fable
yeah
@wide wyvern done uploadingm
ssh in and run these
after creating ramdisk
again
mount_apfs -o rw /dev/disk0s1s1 /mnt1
cat /dev/rdisk1 | dd of=/mnt1/dump.raw bs=256 count=$((0x4000))```yes
with the same stuff u did last
k
ok
once its done, should be in /mnt1/dump.raw
go grab it
you know what else to do to convert right
nice!
transfer to your pc, as it will be deleted when you turn on your ipad
solid ermine
that's because SSV gonna be like "wtf is this shit" and removes it