can't restore 6s from 15.8.3 to 14.3 with futurerestore - bad blobs?

[worldly nimbus]

Not signed anymore

[thin sigil]

sometime its smarter to not reply

especially when saying something completely unrelated

[slow mica]

no shit

dont reply if you dont know what you're talking about

are u fine with sending the blob here so i can verify it's valid

[keen spindle]

sry for the late reply but sure

[slow mica]

np

[keen spindle]

technically this was saved for rc2 of 14.3, but the build string is identical and it should work from what ive heard

[slow mica]

yup

it should work indeed

[keen spindle]

rc1 was 18C65

rc2/retail was 18C66

[keen spindle]

does it validate?

[slow mica]

im extracting the ipsw rn

after it finishes ill be able to check

[keen spindle]

you can check using the ipsw? fascinating

[slow mica]

yeah with img4tool

its on github

https://github.com/tihmstar/img4tool

[keen spindle]

im very experienced with jailbreaking and whatnot, particularly legacy devices, but this is the first time ive ever tried to use futurerestore

[slow mica]

the syntax is img4tool -v BuildManifest.plist -s yourblobhere.shsh

iirc

the buildmanifest is stored in the ipsw

[keen spindle]

yeah ik i extracted 18.1 a few weeks ago

[slow mica]

it's perfectly good

weird

[keen spindle]

the blob itself?

[slow mica]

yup

[keen spindle]

thought so

it’s been sitting there in my onedrive for 4 years lol

[slow mica]

are you doing this on mac or linux

[keen spindle]

mac

[slow mica]

also what options did u choose in futurerestore/futurerestore gui

and did you set your generator?

[keen spindle]

i did

[slow mica]

through pwndfu or dimentio?

[keen spindle]

pwned restore and set nonce, because i can’t find a way to use dimentio on dopamine

dimentio requires rootful right?

[slow mica]

after it reboots into recovery you're supposed to go back and unselect pwned restore, also you did use gaster or ipwndfu to pwn ur device beforehand right

[keen spindle]

gaster yea

wait can i use trollnonce?

[slow mica]

what ios version is the 6s on

[keen spindle]

15.8.3

latest

[slow mica]

then no

but pwned restore + set nonce work fine

[keen spindle]

can i use dimentio under rootful palera1n?

[slow mica]

after you rebooted into recovery did you go back and removed the pwned restore and set nonce arguments

[slow mica]

you can but there's no reason to

[keen spindle]

the procedure was

• enter dfu
• pwn with gaster
• attempt to use pwned restore + set nonce in fr gui
• it threw that error

am i doing things incorrectly?

atm the device itself is on stock 15.8.3, not jailbroken, freshly restored

[slow mica]

hm that's not supposed to happen it's supposed to boot into recovery

are u using the absolute latest version of futurerestore

[keen spindle]

yeah it didn’t even get to recovery

[keen spindle]

yeah from the latest github action run

it auto builds whenever they make a commit

i can go to my mac and we can start from the top if you’d like

i can redownload everything

[keen spindle]

it’s an intel machine if that matters btw

2017 imac pro specifically

[slow mica]

my advice:

1. redownload futurerestore (latest macOS build: https://github.com/futurerestore/futurerestore/actions/runs/10756811250/artifacts/1905398262)
2. first, go into dfu obviously and gaster pwn it
3. go into futurerestore gui tick pwned restore, tick set device nonce as well, put in 0x1111111111111111
4. see if the same exact thing happens

[keen spindle]

it’s gaster pwn then gaster reset right?

[slow mica]

no that undos the pwning

[keen spindle]

well that would explain it

[slow mica]

hopefully that was it

see if everything works alright

[keen spindle]

in that case, ios.cfw.guide is wrong

[slow mica]

i doubt that maybe im wrong

ill double check

[keen spindle]

the guide it links to recommends gaster pwn, then gaster reset, then the futurerestore restore

[slow mica]

i dont think im wrong because literally every time i used gaster pwn i never gaster reset afterwards and futurerestore worked just fine and this is the description of it when running ./gaster help

no idea if im just an idiot or the guide is somehow wrong

[keen spindle]

https://ios.cfw.guide/futurerestore/

the guide links to a 404 but if you look it up on the wayback machine, https://web.archive.org/web/20230505231139/https://gist.github.com/0xallie/aac55c97f7925cddcf5ec3167f85dfe8

[slow mica]

try it without gaster reset and see if it works at all

[slow mica]

i see

try it like that

if it goes into recovery it should mean everything is fine

[keen spindle]

alright

be back in like

10 minutes?

tysm for the help

also @slow mica out of curiosity can you deduce my ecid from the blob

i should probably write it down

[slow mica]

nope, impossible, all blobs are is an encrypted response from apple, it contains literally no info about your device because it's all encrypted

nvm lmfao

[keen spindle]

i see

[slow mica]

i think there is a way to get the ecid out of it

[keen spindle]

ill just open checkra1n

[slow mica]

yeah that would be a LOT easier

[keen spindle]

it literally displays the ecid

[slow mica]

some parts of the blob are in base64 but i have absolutely no idea where i could find the ecid

[keen spindle]

sry for the long wait before i can try your solution, im disabled so im waiting on my brother to help me out with the buttons on the device lmao

[slow mica]

its ok dw about it

[keen spindle]

i upgraded to the 16 last week

crazy

it’s funny how you get so used to using old hardware

[slow mica]

😭

so true lol

[keen spindle]

I DIDN’T JUMP STRAIGHT FROM THE 6S

that would’ve been even crazier

[slow mica]

what did you jump from

[keen spindle]

i had the 6s until 2022

then i got a 12 mini

[slow mica]

12 mini to 16 is still a pretty big jump ngl

[keen spindle]

then i traded that in for the base 16

[slow mica]

i upgraded from the 13 to the 16 and it felt like a huge jump

even though it was really just 3 years

[keen spindle]

this thing is ol fucking reliable

three battery replacements, one screen replacement

still works great

well

as great as an a9 can on 15 lol

[slow mica]

old apple things are surprisingly reliable tbh, i could see myself maining an iPhone 7 if it was really necessary

[keen spindle]

i mained a 5 on 6.1.4 for a month

no problems at all

a few tweaks and everything works just fine

[slow mica]

wait hold on im getting the same error as you did in the futurerestore log

[keen spindle]

are you trying to downgrade?

what device and ios

[slow mica]

no im not, im just trying to print stuff from the blob

[keen spindle]

i think it might be a bad blob

somehow

which is very strange because i haven’t modified it at all

[slow mica]

maybe im just an idiot and didnt check it properly

i would still just try restoring again

nvm im just doing something wrong because i tried printing stuff from my own valid blobs and it didnt work so

im still 100% sure it was the gaster thing

[keen spindle]

i have blobs for 7.1.2 for a 5 if you could benefit from that

[slow mica]

nah i have like i think hundreds of blobs

so im 100% sure im just an idiot

[keen spindle]

i have quite a few too

had*

i didn’t save all of them since shsh.host shut down

[slow mica]

damn that's unfortunate

[keen spindle]

literally only the 14.3 one

[slow mica]

this is why saving blobs on your own machine is the best thing ever

[keen spindle]

true

but 14.3 is a really nice version so

i can’t complain

isn’t taurine untethered now?

[slow mica]

it's not untethered but there's an untethered jb coming for 14 soon

a separate one

[keen spindle]

14 was the last good version to jb

imo

[slow mica]

15 and 16 are good too but true rootful>>>rootless>>>fake rootful imo

[keen spindle]

i remember using checkra1n the day it came out

on this same 6s

13.1.3

[keen spindle]

this

what’s the first device you ever jbd?

[slow mica]

iphone 7 on 13.5, i think it was june this year, im very new i'd say

i just learned things fast

[keen spindle]

mine was an ipod touch 6

on 11.1.2

with a leaked beta build of electra lol

[keen spindle]

same thing

im fairly sure it’s a broken build of fr

[slow mica]

im out of ideas, maybe wait and see if somebody else can help

sorry

[keen spindle]

this is very strange

[keen spindle]

dw not your fault

[slow mica]

something else you could try and do is jailbreak with dopamine and run nvram com.apple.System.boot-nonce=0x1111111111111111 (either through ssh or just newterm), then go into recovery, and dont tick pwndfu at all and try to restore that way, and after you're done with the restore and you install taurine you can get newterm (or ssh into the device) and run nvram -d com.apple.System.boot-nonce to delete that nvram variable the earlier command set (or if you prefer to you could just leave it like that and your nonce will be that forever since restores dont wipe nvram)

anyways i have to go for a bit ill brb

[keen spindle]

update: can confirm it’s definitely a bad blob somehow

managed to set the nonce

img4tools fails to verify the im4m signature

[slow mica]

rip