#iPhone 8 (Global) futurerestore to iOS 14.3 failing

98 messages · Page 1 of 1 (latest)

zenith quail
#

Message deleted Wazowski

broken shell
#

Can't post

#

OMG I can now?

#

Posting message again:

#

In summary, because It might get deleted again; tried posting it two times already

#

iPhone 8 (Global) futurerestore to iOS 14.3 failing, BaseBand error apparently
Command ran:
futurerestore --apticket "./14.3.shsh2" --debug --latest-sep --latest-baseband "./14.3.ipsw" --custom-latest-beta --custom-latest-buildid 19G69 --no-rsep

#

Followed a previous tutorial found in here (genius-bar) for someone that had the same problem with an iPhone 8 Plus on a similar context

#

I've been trying different build id's (such as 19G71, 19H12), however they all fail, with a message saying that the SEP is not signed

zenith quail
#

Firmware needs to be signed to use sep from it

broken shell
#

If I use latest bb and sep I get stuck at "No data to read"

quick bramble
broken shell
quick bramble
#

macos?

broken shell
#

Yes, Intel on Ventura 13.0

quick bramble
#

can’t say i know then, haven’t ever encountered that doing future restore for my devices

#

you following the GH gist?

broken shell
#

Tried with a few with no luck, is there a specific "good" one?

quick bramble
#

this is the one i use and have seen recommended around the discord and on ios.cfw.guide

#

but

#

instead of using what it says in part 1/4

#

i found using gaster to be way more reliable

broken shell
#

I actually tried gaster but for some reason futurerestore doesn't seem to work? I'll try again in a bit just to be sure whenever my iPhone finishes getting restored again

quick bramble
#

aight bet

#

are you using a USBC to lightning cable while using gaster?

broken shell
#

I've tried using one before but found it usually failed when I used checkra1n a while ago, so I've been trying with USB-A lately just to be on the safe side

#

The exploit has been working and all with gaster, it's just that futurerestore doesn't seem to detect it? I think, don't really remember; will check in a bit

quick bramble
#

yeah USBC cables have something about them that makes checkm8 not work with them

#

i know there was a /tag about it in the futurerestore support discord

#

but i don’t think there’s one in here

broken shell
#

Ah, so it's not working with gaster pwn because, when setting the nonce:
Device found in DFU Mode.
Sending iBSS (1438362 bytes)...
Cleaning up...
[exception]:
what=ERROR: Unable to send iBSS component: Unable to upload data to device
And it exits dfu mode shortly afterwards

zenith quail
#

gaster needs to actually succeed for iBSS to load

broken shell
#

It always says the same output, it retries until it finds a device and it ends with this:
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8015
Found the USB handle.
Stage: PATCH
ret: true
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
CPID: 0x8015
Found the USB handle.
Now you can boot untrusted images.

broken shell
zenith quail
#

you need to run futurerestore twice because gaster doesn't fix usb loop...

#

don't reboot in between each run

broken shell
zenith quail
#

why the fuck are you restoring

broken shell
zenith quail
#

that's the entire point of futurerestore pwndfu, so you can restore from a bootloop/recovery loop...

#

you had one job man

broken shell
#

I know almost nothing about this tbh, I just enjoy the jb; tried to go to 14.3, messed up somehow and stuck in this

zenith quail
#

@graceful coral fuck off gir

broken shell
zenith quail
#

enter dfu, run gaster, run futurerestore set nonce twice

broken shell
#

I think I either mess up getting into DFU or something because I get sent back to recovery mode

zenith quail
#

yes you are

broken shell
#

So up, down, hold sleep button until screen goes black, hold it together with down for 5 secs, release sleep button; am I missing something?

zenith quail
#

nope

#

recovery mode to dfu is 3 seconds

#

use futurerestore -e to exit recovery then immediately hold button combo

#

don't use buttons to hard reset out of recovery

#

that's what is bad

broken shell
#

Good to know! That saves me tons of time; finally made it happen thank you!

#

Okay so, did that, gaster pwn'ed, ran futurerestore two times, the last one with --use-pwndfu, --custom-latest-buildid 19H12, and --custom-latest-beta.
The device showed a quick stream of text before disappearing back into the apple logo with the progress bar, and was left with the message on futurerestore of "No data to read", and the device is back on DFU I think? Doesn't show on Finder, but the screen is black like DFU so it's weird

#

Last debug messages from log:

DEBUG: tss_response_get_path_by_entry: No entry 'LLB' in TSS response
NOTE: Could not get LLB path from TSS data, will fetch from build identity
Tag found
...
Tag found
idevice_event_cb: device 000a0229208ba02e (udid: ffffffffffffffffffffffffffffffff00000040) disconnected
ERROR: Unable to receive message from FDR 0x600001b98240 (-2). 0/2 bytes
FDR 0x600001b98240 terminating...
No data to read
No data to read
No data to read

zenith quail
#

you need no-rsep checked

broken shell
#

New error this time with no-rsep:

[07:02:06.0253-GMT]{4>8} CHECKPOINT BEGIN: RESTORED:[0x0648] cleanup_send_final_status
restore-step-ids = {0x1103067B:60;0x11030634:64;0x11030648:68}
restore-step-names = {0x1103067B:perform_restore_installing;0x11030634:fdr_recover;0x11030648:cleanup_send_final_status}
restore-step-uptime = 157
restore-step-user-progress = 51

Checkpoint 1608 complete with code 0
Cleaning up...
[exception]:
what=ERROR: Unable to restore device

code=92864580
line=1417
file=/Users/runner/work/futurerestore/futurerestore/src/futurerestore.cpp
commit count=301:
commit sha =66cdef43f10567b76b5ef95726d92641a5dfbd6f:
Done: restoring failed!

#

Okay, there are some important parts that talk about permissions, so will post it to pastebin to show at least that part of the log

zenith quail
#

send full log

broken shell
zenith quail
#

try without pwndfu restore

broken shell
#

No --use-pwndfu:

futurerestore: failed with exception:
[exception]:
what=unsupported device mode, please put device in recovery or normal mode

code=15794244
line=241
file=/Users/runner/work/futurerestore/futurerestore/src/futurerestore.cpp
commit count=301:
commit sha =66cdef43f10567b76b5ef95726d92641a5dfbd6f:

zenith quail
#

common sense

#

it tells you what to do

broken shell
#

Thought getting out of dfu after "gaster pwn" wouldn't work

#

Yep, indeed:
what=Device ApNonce does not match APTicket nonce
It must be because I exited forcing hard reset since nothing let me change mode, will try to pwn, exit and run futurerestore again

zenith quail
#

you are supposed to use setnonce and not pwndfu to restore

winged tulip
#

It's funny, I have the same problem

broken shell
broken shell
winged tulip
#

I always thought it was the baseband that kept it from going

#

In the same way, I have no problem with the iPhone 7 flashing

broken shell
#

No --use-pwndfu:

[08:30:30.0546-GMT]{4>8} CHECKPOINT BEGIN: RESTORED:[0x0648] cleanup_send_final_status
restore-step-ids = {0x1103067B:60;0x11030634:64;0x11030648:68}
restore-step-names = {0x1103067B:perform_restore_installing;0x11030634:fdr_recover;0x11030648:cleanup_send_final_status}
restore-step-uptime = 157
restore-step-user-progress = 51

Checkpoint 1608 complete with code 0
Cleaning up...
[exception]:
what=ERROR: Unable to restore device

code=92864580
line=1417
file=/Users/runner/work/futurerestore/futurerestore/src/futurerestore.cpp
commit count=301:
commit sha =66cdef43f10567b76b5ef95726d92641a5dfbd6f:
Done: restoring failed!
FutureRestore process ended
Full log, after the filesystem validation here: https://ghostbin.me/63622bb0a23a9

zenith quail
#

you are in limbo then

#

so you need to non-futurerestore restore before futurerestore can work

broken shell
#

Will do, be back in a bit.
To reiterate, will:

  • Restore as normal
  • Enter DFU
  • gaster pwn
  • futurerestore (for error)
  • futurerestore set nonce
  • futurerestore with the rest of the options
zenith quail
#

for the last step non-pwndfu

broken shell
#

Got it, be back in a hot minute then

zenith quail
#

I really wish I could fix this

#

but honestly I have no clue why it happens

broken shell
# broken shell Will do, be back in a bit. To reiterate, will: - Restore as normal - Enter DFU -...

Result:
Command ran: futurerestore --apticket "/Users/temp/restore/14.3.shsh2" --debug --no-rsep --custom-latest-buildid "19H12" --custom-latest-beta --latest-sep --latest-baseband "/Users/temp/restore/14.3.ipsw"

Reading data from /var/tmp/ffffffffffffffffffffffffffffffff00000064MIPA5G
ERROR: device didn't accept BasebandData
ERROR: Unable to successfully restore device
///////////
////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
...
/////////////w==
</data>
</dict>
</dict>
</plist>
Sending BasebandData now...
Done sending BasebandData
Checkpoint 4867 complete with code 0
Cleaning up...
[exception]:
what=ERROR: Unable to restore device

code=92864580
line=1417
file=/Users/runner/work/futurerestore/futurerestore/src/futurerestore.cpp
commit count=302:
commit sha =c17e6687b4ff13664a704dc6d0e8fa743be76178:
Done: restoring failed!

#

So this time it's the baseband, but isn't 19H12 signed? So uhm..?

zenith quail
#

rm -rf $TMPDIR/futurerestore

broken shell
#

So remove, redownload, restore normally again and retry once more?

zenith quail
#

there is nothing to redownload

#

run the command

broken shell
#

Done

broken shell
zenith quail
#

it's signed tho

broken shell
#

Will try again then

#

no f'ing way, it worked? It succeeded at least. Will see if I get past the "Activation Error"

#

IT WORKED OMG

#

So, to reiterate:

  • pwn the device on DFU mode with gaster pwn or ipwndfu -p; ipwndfu --patch-sigchecks; ipwndfu --repair-heap (had trouble with my latest attempts with gaster, whenever I tried to set the nonce I would get booted back to normal mode)

  • Set blobs with futurerestore (--debug just to see what's going on, --no-rsep, --custom-latest-buildid "19H12", --custom-latest-beta, --use-pwndfu, --set-nonce)
    (Command I used to set blobs: futurerestore --debug --no-rsep --custom-latest-buildid "19H12" --custom-latest-beta --use-pwndfu --set-nonce --latest-sep --latest-baseband )

  • Actually futurerestore (--debug just to see what's going on, --no-rsep, --custom-latest-buildid "19H12", --custom-latest-beta)
    (Command I used to restore: futurerestore --apticket "/Users/temp/restore/14.3.shsh2" --debug --no-rsep --custom-latest-buildid "19H12" --custom-latest-beta --latest-sep --latest-baseband "/Users/temp/restore/14.3.ipsw" )

If stuck at ERROR: device didn't accept BasebandData, check if signed and compatible with your device (in this case, 19H12 is the latest signed and compatible version), rm -rf $TMPDIR/futurerestore and run the command again (so pwn the device, set blobs and futurerestore; all the steps outlined above).

Can use FutureRestore GUI by CoocooFroggy (in this case, v1.98.2 was used) to make the writing of commands (and execution if you'd like) easier

#

Thank you very much, Cryptic! This was weird, sometimes things didn't work, other times they did, even though they were the same. I really appreciate your continued support and assistance.
And now, I can finally go to bed.
Have a great rest of your day!