How could the ipsw be patched to support downgrading on my iPhone 4? iOS 5.0 downgrades just fine!

[panteruta52-coder]

` *** Legacy iOS Kit ***

• Script by LukeZGD -

• Version: v26.05.23 (7ab4e06)

• Platform: linux (Arch Linux - x86_64)

• Device: iPhone 4 (GSM) (iPhone3,1 - n90ap) in Normal mode

• Manufactured in 2nd half 2012

• iOS Version: 6.1.3 (10B329)

• ECID: 2672744926705

• Only select unmodified IPSW for the selection. Do not select custom IPSWs

• Selected Target IPSW: ../iPhone3,1_4.3.5_8L1_Restore.ipsw

• Target Version: 4.3.5-8L1

• Selected Target IPSW is validated
  [WARNING] Not all devices support iOS 4 versions. It may not restore/boot properly

• Selected Base IPSW (iOS 7.1.2): ../iPhone3,1_7.1.2_11D257_Restore.ipsw

• Base Version: 7.1.2-11D257

• Selected Base IPSW is validated

• You may enter custom bootargs (optional, experimental option)

• Default Bootargs: pio-error=0 debug=0x2014e serial=3

• You can select your own custom Apple logo image. This is optional and an experimental option

• Note: The images must be in PNG format, and up to your device resolution

• Note 2: The custom images might not work, current support is spotty

• No custom Apple logo selected

• This restore will have baseband update disabled

Main Menu > Restore/Downgrade > powdersn0w (any iOS)
[Input] Select an option:
Select Target IPSW
Select Base IPSW
Download Base IPSW
Custom Bootargs
Select Apple Logo
-> (*) Start Restore
Go Back

[Input] Jailbreak Option

• When this option is enabled, your device will be jailbroken on restore.
• I recommend to enable this option to have the jailbreak and Cydia pre-installed.
• This option is enabled by default (Y). Select this option if unsure.
  [Input] Enable this option? (Y/n):
  Yes
  -> No

[Log] Jailbreak option disabled by user.

[Input] Memory Option for creating custom IPSW

• When this option is enabled, system RAM will be used for the IPSW creation process.
• I recommend to enable this option to speed up creating the custom IPSW.
• However, if your PC/Mac has less than 8 GB of RAM, disable this option.
• This option is enabled by default (Y). Select this option if unsure.
  [Input] Enable this option? (Y/n):
  -> Yes
  No

[Log] Memory option enabled.

[Input] Verbose Boot Option

• When this option is enabled, the device will have verbose boot on restore.
• This option is enabled by default (Y). Select this option if unsure.
  [Input] Enable this option? (Y/n):
  Yes
  -> No

[Log] Verbose boot option disabled by user.

[Log] Found existing saved 7.1.2 blobs: ../saved/shsh/2672744926705_iPhone3,1_n90ap_7.1.2-11D257_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2
[Log] Attempting idevicepair
ERROR: Could not validate with device e8a70b0fd74d2d0a327c99653df9502cecaf955c because a passcode is set. Please enter the passcode on the device and retry.
[Log] Unlock and press "Trust" on the device before pressing Enter/Return.

• If you denied the trust dialog, unplug and replug the device.
  [Input] Press Enter/Return to continue (or press Ctrl+C to cancel)
  [Log] Attempting idevicepair
  ERROR: Could not validate with device e8a70b0fd74d2d0a327c99653df9502cecaf955c because a passcode is set. Please enter the passcode on the device and retry.
  [WARNING] Unable to pair with device.
• The device needs to be in Recovery/DFU mode before proceeding.
  [Input] Send device to recovery mode? (Y/n):
  -> Yes
  No

[Log] Entering recovery mode...

• If the device does not enter recovery mode automatically, try putting the device in Recovery/DFU mode manually. You may also press Ctrl+C to cancel
  [Log] Finding device in Recovery mode...
  [Log] Found device in Recovery mode.

• DFU Mode Helper - Get ready to enter DFU mode.

• If you already know how to enter DFU mode, you may do so right now before continuing.
  [Input] Select Y to continue, N to exit recovery mode (Y/n):
  -> Yes
  No

• Get ready...
  3 2 1

• Hold TOP and HOME buttons.
  8 7 6 5 4 3 2 1

• Release TOP button and keep holding HOME button.
  8 7 6 5 4 3 2 1
  [Log] Found device in DFU mode.
  [Log] CPU: AMD Ryzen 3 3250U with Radeon Graphics

• Include this in your log/screenshot for pwning assistance if needed.
  [Log] Placing device to pwnDFU mode using primepwn

• If pwning fails and gets stuck, you can press Ctrl+C to cancel, then re-enter DFU and retry.
  *** primepwn by LukeZGD ***
  Acquiring device handle.
  *** based on SHAtter exploit (segment overflow) by posixninja and pod2g ***
  Resetting USB counters.
  Getting 0x40 bytes of data from device.
  Performing USB port reset.
  Releasing device handle.
  Acquiring device handle.
  Requesting image validation.
  Performing USB port reset.
  Releasing device handle.
  Acquiring device handle.
  Getting 0x2c000 bytes of data from device.
  Releasing device handle.
  Acquiring device handle.
  Resetting USB counters.
  Getting 0x140 bytes of data from device.
  Performing USB port reset.
  Releasing device handle.
  Acquiring device handle.
  Requesting image validation.
  Performing USB port reset.
  Releasing device handle.
  Acquiring device handle.
  Sending 0x1cc bytes of data to device.
  Getting 0x2c000 bytes of data from device.
  Releasing device handle.
  Acquiring device handle.
  Releasing device handle.
  Device is now in pwned DFU mode.
  [Log] Checking for device
  [Log] Found device in pwned DFU mode.

• Pwned: SHAtter
  [Log] Found existing saved 7.1.2 blobs: ../saved/shsh/2672744926705_iPhone3,1_n90ap_7.1.2-11D257_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2
  [Log] Checking firmware keys in ../saved/firmware/iPhone3,1/8L1
  [Log] Preparing config file

FilesystemJailbreak needPref iBootPatches debugEnabled bootArgsInjection bootArgsString pio-error=0 debug=0x2014e serial=3 [Log] Generating firmware bundle for iPhone3,1-4.3.5 (8L1) target... Archive: ../iPhone3,1_4.3.5_8L1_Restore.ipsw inflating: ./manifest Archive: ../iPhone3,1_4.3.5_8L1_Restore.ipsw inflating: ./038-2265-002.dmg No such file or directory Filename../iPhone3,1_4.3.5_8L1_Restore.ipsw RootFilesystem038-2288-002.dmg RootFilesystemKeye5e061077217c4937e14d9c4ae1eeb8d69827aa4838168033dd5f1806ab485306a8aa3cf RootFilesystemSize1054 RamdiskOptionsPath/usr/local/share/restore/options.plist SHA17099307319c669356955e9aff11a3129d6b8d8b4 FilesystemPackagebootstrapfreeze.tar RamdiskPackagepackagesrc/bin.tariosios Firmware iBSSFileFirmware/dfu/iBSS.n90ap.RELEASE.dfu IV00ba61665022e97cacb71493f3e92533Key85d0388a2b1ce6b4fc68aebb3cb87014b6dd57fde5d9599381db4083a30c3803 Patch Decrypt Restore RamdiskFile038-2265-002.dmgIVnullKeynull Decrypt FirmwareReplace APTicketFileFirmware/all_flash/all_flash.n90ap.production/applelogoT-640x960.s5l8930x.img3 AppleLogoFileFirmware/all_flash/all_flash.n90ap.production/applelogo7-640x960.s5l8930x.img3 NewAppleLogoFileFirmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3 BatteryCharging0FileFirmware/all_flash/all_flash.n90ap.production/batterycharging0-640x960.s5l8930x.img3 BatteryCharging1FileFirmware/all_flash/all_flash.n90ap.production/batterycharging1-640x960.s5l8930x.img3 BatteryFullFileFirmware/all_flash/all_flash.n90ap.production/batteryfull-640x960.s5l8930x.img3 BatteryLow0FileFirmware/all_flash/all_flash.n90ap.production/batterylow0-640x960.s5l8930x.img3 BatteryLow1FileFirmware/all_flash/all_flash.n90ap.production/batterylow1-640x960.s5l8930x.img3 BatteryPluginFileFirmware/all_flash/all_flash.n90ap.production/glyphplugin-640x960.s5l8930x.img3 RecoveryModeFileFirmware/all_flash/all_flash.n90ap.production/recoverymode7-640x960.s5l8930x.img3 NewRecoveryModeFileFirmware/all_flash/all_flash.n90ap.production/recoverymode-640x960.s5l8930x.img3 LLBFileFirmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 iBootFileFirmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 NewiBootFileFirmware/all_flash/all_flash.n90ap.production/iBoot2.n90ap.RELEASE.img3IV986032eecd861c37ca2a86b6496a3c0dKeyb4e300c54a9dd2e648ead50794e9bf2205a489c310a1c70a9fae687368229468 manifestFileFirmware/all_flash/all_flash.n90ap.production/manifestmanifestmanifest [Log] Checking firmware keys in ../saved/firmware/iPhone3,1/11D257 [Log] Getting firmware keys for iPhone3,1-11D257: https://raw.githubusercontent.com/LukeZGD/Legacy-iOS-Kit-Keys/master/iPhone3,1/11D257/index.html

06/06 22:02:37 [NOTICE] Downloading 1 item(s)

06/06 22:02:38 [NOTICE] Download complete: /home/razvan/Documents/Legacy-iOS-Kit/tmp5114/index.html
[Log] Generating firmware bundle for iPhone3,1-7.1.2 (11D257) base...
Archive: ../iPhone3,1_7.1.2_11D257_Restore.ipsw
inflating: ./manifest
Archive: ../iPhone3,1_7.1.2_11D257_Restore.ipsw
inflating: ./058-4107-013.dmg
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 8196f7a169a4dc0d728066fc5a2ac2e48255551bfe77448b12b193db45404104a9d999236099bda390cb4bc16ea760ce

Filename../iPhone3,1_7.1.2_11D257_Restore.ipsw
RootFilesystem058-4520-010.dmg
RootFilesystemKey38d0320d099b9dd34ffb3308c53d397f14955b347d6a433fe173acc2ced1ae78756b3684
RootFilesystemSize1561
RamdiskOptionsPath/usr/local/share/restore/options.plist
SHA181da17b3e893a61508fe203849b7e1f60e2127b1
RamdiskExploit
exploitsrc/target/n90/11D257/exploit
injectpartition
Firmware
FirmwarePath
AppleLogoFileFirmware/all_flash/all_flash.n90ap.production/applelogo@2xiphone.s5l8930x.img3
BatteryCharging0FileFirmware/all_flash/all_flash.n90ap.production/batterycharging0@2xiphone.s5l8930x.img3
BatteryCharging1FileFirmware/all_flash/all_flash.n90ap.production/batterycharging1@2xiphone.s5l8930x.img3
BatteryFullFileFirmware/all_flash/all_flash.n90ap.production/batteryfull@2xiphone.s5l8930x.img3
BatteryLow0FileFirmware/all_flash/all_flash.n90ap.production/batterylow0@2xiphone.s5l8930x.img3
BatteryLow1FileFirmware/all_flash/all_flash.n90ap.production/batterylow1@2xiphone.s5l8930x.img3
BatteryPluginFileFirmware/all_flash/all_flash.n90ap.production/glyphplugin@2xiphone-30pin.s5l8930x.img3
RecoveryModeFileFirmware/all_flash/all_flash.n90ap.production/recoverymode@2xiphone-30pin.s5l8930x.img3
LLBFileFirmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3
iBootFileFirmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3


[Log] Preparing config file


FilesystemJailbreak

needPref

iBootPatches

debugEnabled

bootArgsInjection

bootArgsString
pio-error=0 debug=0x2014e serial=3



[Log] Checking firmware keys in ../saved/firmware/iPhone3,1/8L1
[Log] Patch iBoot: --boot-partition --boot-ramdisk --logo4 -b pio-error=0 debug=0x2014e serial=3
Archive: ../iPhone3,1_4.3.5_8L1_Restore.ipsw
inflating: ./iBoot.n90ap.RELEASE.img3
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802
main: Starting...
main: iBoot-1072 inputted.
patch_boot_args: Entering...
patch_boot_args: Default boot-args string is at 0x2f188
patch_boot_args: boot-args xref is at 0x1459c
patch_boot_args: Applying custom boot-args "pio-error=0 debug=0x2014e serial=3"
patch_boot_args: Found LDR R0, =boot_args at 0x13dec
patch_boot_args: Found IT instruction at 0x13df6
patch_boot_args: Found CMP Rx, #0 at 0x13df4
patch_logo4: Entering...
patch_logo4: Found main string: 0xeb4
patch_logo4: Patching logo -> log4 ...
patch_logo4: Leaving...
patch_rsa_check: Entering...
find_rsa_check_3_4: Entering...
find_rsa_check_3_4: Found LDR Rx, CERT at 0x12e60
find_rsa_check_3_4: Found MOVS R1, #0x14 at 0x12ef8
find_rsa_check_3_4: Found BL 1 instruction at 0x12f06
find_rsa_check_3_4: Found BL 1 instruction xref at 0x13049
find_rsa_check_3_4: Found BL 2 instruction at 0x1305e
find_rsa_check_3_4: Found BL 2 instruction xref at 0x1bd91
find_rsa_check_3_4: Found CMP Rx, 0x14 at 0x1c1da
find_rsa_check_3_4: Found BL 3 instruction at 0x1c20a
find_rsa_check_3_4: Found BL 3 instruction xref at 0x1bc1d
find_rsa_check_3_4: Found MOV.W R0, #0xFFFFFFFF! at 0x1bd64
find_rsa_check_3_4: Leaving...
patch_rsa_check: Patching RSA at 0x1bd64...
find_ldr_ecid: Entering...
find_ldr_ecid: Found LDR instruction at 0x1357c
find_ldr_ecid: Found BL ECID at 0x1358c
find_ldr_ecid: Leaving...
patch_rsa_check: Patching BL ECID at 0x1358c...
find_ldr_bord: Entering...
find_ldr_bord: Found LDR BORD instruction at 0x13556
find_ldr_bord: Found BL BORD at 0x13568
find_ldr_bord: Leaving...
patch_rsa_check: Patching BL BORD at 0x13568...
find_ldr_prod: Entering...
find_ldr_prod: Found LDR PROD instruction at 0x13482
find_ldr_prod: Found BL PROD at 0x13494
find_ldr_prod: Leaving...
patch_rsa_check: Patching BL PROD at 0x13494...
find_ldr_sepo: Entering...
find_ldr_sepo: Found LDR SEPO instruction at 0x13524
find_ldr_sepo: Found BL SEPO at 0x13526
find_ldr_sepo: Leaving...
patch_rsa_check: Patching BL SEPO at 0x13526...
patch_boot_partition: Entering...
find_boot_partition_ldr: Entering...
find_boot_partition_ldr: Found boot-partition string: 0x5ff2adf8
find_boot_partition_ldr: Found boot-partition LDR: 0x5ff007d8
patch_boot_partition: Patching boot_partition BL at 0x7da...
patch_boot_partition: Leaving...
find_boot_ramdisk_ldr: Entering...
find_boot_ramdisk_ldr: Found boot-ramdisk string: 0x5ff2ae44
find_boot_ramdisk_ldr: Found boot-ramdisk LDR: 0x5ff0086c
patch_boot_ramdisk: Patching boot_ramdisk BL at 0x86e...
patch_boot_ramdisk: Leaving...
main: Writing out patched file to iBoot.pwned...
main: Quitting...
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802
/home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802
iBoot
[Log] Preparing custom IPSW: ../bin/linux/x86_64/powdersn0w ../iPhone3,1_4.3.5_8L1_Restore.ipsw temp.ipsw -base ../iPhone3,1_7.1.2_11D257_Restore.ipsw -apticket ../saved/shsh/2672744926705_iPhone3,1_n90ap_7.1.2-11D257_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2 -memory
Hashing IPSW...
Matching IPSW in FirmwareBundles/... (70993073...)
checking: FirmwareBundles//iPhone3,1_4.3.5_8L1.bundle/Info.plist
loading: 038-2265-002.dmg (23705796)
loading: 038-2268-002.dmg (25024708)
loading: 038-2288-002.dmg (630808576)
loading: BuildManifest.plist (22691)
loading: Firmware/ (0)
loading: Firmware/all_flash/ (0)
loading: Firmware/all_flash/all_flash.n90ap.production/ (0)
loading: Firmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3 (15172)
loading: Firmware/all_flash/all_flash.n90ap.production/batterycharging0-640x960.s5l8930x.img3 (11844)
loading: Firmware/all_flash/all_flash.n90ap.production/batterycharging1-640x960.s5l8930x.img3 (37124)
loading: Firmware/all_flash/all_flash.n90ap.production/batteryfull-640x960.s5l8930x.img3 (655300)
loading: Firmware/all_flash/all_flash.n90ap.production/batterylow0-640x960.s5l8930x.img3 (170692)
loading: Firmware/all_flash/all_flash.n90ap.production/batterylow1-640x960.s5l8930x.img3 (40004)
loading: Firmware/all_flash/all_flash.n90ap.production/DeviceTree.n90ap.img3 (60612)
loading: Firmware/all_flash/all_flash.n90ap.production/glyphcharging-640x960.s5l8930x.img3 (7364)
loading: Firmware/all_flash/all_flash.n90ap.production/glyphplugin-640x960.s5l8930x.img3 (7044)
loading: Firmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 (223620)
loading: Firmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 (100740)
loading: Firmware/all_flash/all_flash.n90ap.production/manifest (387)
loading: Firmware/all_flash/all_flash.n90ap.production/recoverymode-640x960.s5l8930x.img3 (129604)
loading: Firmware/dfu/ (0)
loading: Firmware/dfu/iBEC.n90ap.RELEASE.dfu (223620)
loading: Firmware/dfu/iBSS.n90ap.RELEASE.dfu (158084)
loading: Firmware/ICE3_04.10.01_BOOT_02.13.Release.bbfw (3811912)
loading: kernelcache.release.k48 (6179844)
loading: kernelcache.release.n81 (6086340)
loading: kernelcache.release.n90 (6204100)
loading: Restore.plist (2076)
Hashing IPSW...
Matching IPSW in FirmwareBundles/... (81da17b3...)
checking: FirmwareBundles//iPhone3,1_4.3.5_8L1.bundle/Info.plist
checking: FirmwareBundles//config.plist/Info.plist
checking: FirmwareBundles//BASE_iPhone3,1_7.1.2_11D257.bundle/Info.plist
loading: Firmware/all_flash/all_flash.n90ap.production/applelogo@2xiphone.s5l8930x.img3 (6796)
loading: Firmware/all_flash/all_flash.n90ap.production/batterycharging0@2xiphone.s5l8930x.img3 (9740)
loading: Firmware/all_flash/all_flash.n90ap.production/batterycharging1@2xiphone.s5l8930x.img3 (35020)
loading: Firmware/all_flash/all_flash.n90ap.production/batteryfull@2xiphone.s5l8930x.img3 (84044)
loading: Firmware/all_flash/all_flash.n90ap.production/batterylow0@2xiphone.s5l8930x.img3 (43596)
loading: Firmware/all_flash/all_flash.n90ap.production/batterylow1@2xiphone.s5l8930x.img3 (2060)
loading: Firmware/all_flash/all_flash.n90ap.production/DeviceTree.n90ap.img3 (74764)
loading: Firmware/all_flash/all_flash.n90ap.production/glyphplugin@2xiphone-30pin.s5l8930x.img3 (11852)
loading: Firmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 (283020)
loading: Firmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 (131468)
loading: Firmware/all_flash/all_flash.n90ap.production/recoverymode@2xiphone-30pin.s5l8930x.img3 (69452)
checking: FirmwareBundles/config.plist
[+] debugMode ? 0...
[+] needPref ? 1...
[+] jailbreak ? 0...
[] Found APTicket: Firmware/all_flash/all_flash.n90ap.production/applelogoT-640x960.s5l8930x.img3
[+] Added: Firmware/all_flash/all_flash.n90ap.production/applelogoT-640x960.s5l8930x.img3
[] Found AppleLogo: Firmware/all_flash/all_flash.n90ap.production/applelogo7-640x960.s5l8930x.img3
[] Found NewAppleLogo: Firmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3
[] Found BatteryCharging0: Firmware/all_flash/all_flash.n90ap.production/batterycharging0-640x960.s5l8930x.img3
[] Found BatteryCharging1: Firmware/all_flash/all_flash.n90ap.production/batterycharging1-640x960.s5l8930x.img3
[] Found BatteryFull: Firmware/all_flash/all_flash.n90ap.production/batteryfull-640x960.s5l8930x.img3
[] Found BatteryLow0: Firmware/all_flash/all_flash.n90ap.production/batterylow0-640x960.s5l8930x.img3
[] Found BatteryLow1: Firmware/all_flash/all_flash.n90ap.production/batterylow1-640x960.s5l8930x.img3
[] Found BatteryPlugin: Firmware/all_flash/all_flash.n90ap.production/glyphplugin-640x960.s5l8930x.img3
[] Found RecoveryMode: Firmware/all_flash/all_flash.n90ap.production/recoverymode7-640x960.s5l8930x.img3
[] Found NewRecoveryMode: Firmware/all_flash/all_flash.n90ap.production/recoverymode-640x960.s5l8930x.img3
[] Found LLB: Firmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3
[] Found iBoot: Firmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3
[] Found NewiBoot: Firmware/all_flash/all_flash.n90ap.production/iBoot2.n90ap.RELEASE.img3
[] Found manifestPath: Firmware/all_flash/all_flash.n90ap.production/manifest
[+] Added: Firmware/all_flash/all_flash.n90ap.production/manifest
[] Replacing flash_nor...
[+] Added: Firmware/all_flash/all_flash.n90ap.production/applelogo7-640x960.s5l8930x.img3
[] Rewrite img3 TYPE tag: logo -> logb
[+] Added: Firmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3
[] Replacing flash_nor...
[+] Added: Firmware/all_flash/all_flash.n90ap.production/batterycharging0-640x960.s5l8930x.img3
[] Replacing flash_nor...
[+] Added: Firmware/all_flash/all_flash.n90ap.production/batterycharging1-640x960.s5l8930x.img3
[] Replacing flash_nor...
[+] Added: Firmware/all_flash/all_flash.n90ap.production/batteryfull-640x960.s5l8930x.img3
[] Replacing flash_nor...
[+] Added: Firmware/all_flash/all_flash.n90ap.production/batterylow0-640x960.s5l8930x.img3
[] Replacing flash_nor...
[+] Added: Firmware/all_flash/all_flash.n90ap.production/batterylow1-640x960.s5l8930x.img3
[] Replacing flash_nor...
[+] Added: Firmware/all_flash/all_flash.n90ap.production/glyphplugin-640x960.s5l8930x.img3
[] Replacing flash_nor...
[+] Added: Firmware/all_flash/all_flash.n90ap.production/recoverymode7-640x960.s5l8930x.img3
[] Rewrite img3 TYPE tag: recm -> recb
[+] Added: Firmware/all_flash/all_flash.n90ap.production/recoverymode-640x960.s5l8930x.img3
[] Replacing flash_nor...
[+] Added: Firmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3
[] Replacing flash_nor...
[] Creating new iBoot...
[] Rewrite img3 TYPE tag: ibot -> ibob
[+] Added: Firmware/all_flash/all_flash.n90ap.production/iBoot2.n90ap.RELEASE.img3
[] Patching iBoot...
iBoot: encrypted input... /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802
/home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802
encrypted output... /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802
[patchiBoot] filesize: 36000
[patchiBoot] version: 1072
[patchiBoot] iboot_type: iBoot
[patchiBoot] iboot_base: 5ff00000
[patchiBoot] verify_shsh: 00013414
[patchiBoot] boot_partition: 000007da
[patchiBoot] boot_ramdisk: 0000086e
[patchiBoot] boot_args_null: 000145a0
[patchiBoot] boot_args: 0001459c
[patchiBoot] reliance_str: 00034800
[patchiBoot] writing buf
writing... success
iBoot: /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802
/home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802
/home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802
writing... success
[] Done: Firmware/all_flash/all_flash.n90ap.production/iBoot2.n90ap.RELEASE.img3
[+] Added: Firmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3
[] restore bootArgs: cs_enforcement_disable=1 amfi_get_out_of_my_way=1 amfi=0xff
iBSS: encrypted input... /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7
/home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7
encrypted output... /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7
[patchiBoot] filesize: 26000
[patchiBoot] version: 1072
[patchiBoot] iboot_type: iBSS
[patchiBoot] iboot_base: 84000000
[patchiBoot] verify_shsh: 00012bd4
[patchiBoot] writing buf
writing... success
iBSS: /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7
/home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7
/home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7
writing... success
Restore Ramdisk: writing... success
[] Found: ramdisk package: src/bin.tar
Writing out data..
run 100: start=25952256 sectors=512, length=64272, fileOffset=0xa49eee
run 200: start=52166656 sectors=512, length=262144, fileOffset=0x1de517c
run 300: start=78381056 sectors=512, length=262144, fileOffset=0x36e2bcf
run 400: start=104595456 sectors=512, length=25572, fileOffset=0x4c304d1
run 500: start=130809856 sectors=512, length=205227, fileOffset=0x56a6a6e
run 600: start=157024256 sectors=512, length=262144, fileOffset=0x6a22eeb
run 700: start=183238656 sectors=512, length=262144, fileOffset=0x82c114d
run 800: start=209453056 sectors=512, length=253391, fileOffset=0x98fcfaa
run 900: start=235667456 sectors=512, length=238467, fileOffset=0xb0b69b3
run 1000: start=261881856 sectors=512, length=115933, fileOffset=0xb8b2e45
run 1100: start=288096256 sectors=512, length=102485, fileOffset=0xbe9ca9d
run 1200: start=314310656 sectors=512, length=229218, fileOffset=0xd10b499
run 1300: start=340525056 sectors=512, length=240371, fileOffset=0xe76f3aa
run 1400: start=366739456 sectors=512, length=175364, fileOffset=0xfab1edc
run 1500: start=392953856 sectors=512, length=138701, fileOffset=0x1085af27
run 1600: start=419168256 sectors=512, length=137128, fileOffset=0x11594fea
run 1700: start=445382656 sectors=512, length=123666, fileOffset=0x1235fec3
run 1800: start=471597056 sectors=512, length=142147, fileOffset=0x1306bbc2
run 1900: start=497811456 sectors=512, length=98227, fileOffset=0x138ece2c
run 2000: start=542375936 sectors=512, length=29890, fileOffset=0x140db07b
run 2100: start=568590336 sectors=512, length=249563, fileOffset=0x1500beed
run 2200: start=594804736 sectors=512, length=262144, fileOffset=0x168a5137
run 2300: start=621019136 sectors=512, length=262144, fileOffset=0x1800333e
run 2400: start=647233536 sectors=512, length=262144, fileOffset=0x197073c5
run 2500: start=673447936 sectors=512, length=262144, fileOffset=0x1afdf962
run 2600: start=699662336 sectors=512, length=262144, fileOffset=0x1c8388d1
run 2700: start=725876736 sectors=512, length=147640, fileOffset=0x1dcda0fe
run 2800: start=752091136 sectors=512, length=262144, fileOffset=0x1f049e6e
run 2900: start=778305536 sectors=512, length=262144, fileOffset=0x20805f8a
run 3000: start=804519936 sectors=512, length=243617, fileOffset=0x21f290aa
run 3100: start=830734336 sectors=512, length=262144, fileOffset=0x23584572
run 3200: start=856948736 sectors=512, length=175958, fileOffset=0x24afc55b
Growing root to minimum: 1054
[] Executing needPref...
unencrypted ramdisk
growing ramdisk: 23703552 -> 25432064
retrieving...patching...
[patchASR] sz: 2c260
[patchASR] magic: feedface
[patchASR] text_vmaddr: 1000
[patchASR] cmdsize: 00000010
[patchASR] dataoff: 0002bdc0
[patchASR] datasize: 1184
[patchASR] text_base: 00001000
[patchASR] image_passed_signature: 00014210
[patchASR] image_failed_signature: 0001421a
[patchASR] patched: 0001321a: bff9f7ff
[patchASR] csdir_start: 0002bde4
[patchASR] hashOffset: 66
[patchASR] nSpecialSlots: 2
[patchASR] nCodeSlots: 2c
[patchASR] codeLimit: 2bdc0
[patchASR] hashSize: 14
[patchASR] hashType: 1
[patchASR] pageSize: 1000
[patchASR] checking cs slots...
[validateHash] 2a7997aa39319cfe61514924fea8dd81e61896e6 != edb76caad3afa0b490086d635146170b8a408dc4
[patchASR] writing buf
writing... success
[] Installing Package
merging src/bin.tar
ignoring bin, type = 5
file: bin/dd (0755), size = 96080
ignoring sbin, type = 5
file: sbin/partition4 (0755), size = 62352
file: sbin/umount (0755), size = 22784
file: iBoot (0644), size = 223452
[+] ramdiskVolume ... Moved: /sbin/reboot -> /sbin/reboot_
[+] ramdiskVolume ... Added: /sbin/reboot
[+] ramdiskVolume ... Added: /exploit
[] ramdiskVolume ... chmod: /sbin/reboot -rwx/-r-x/-r-x
[*] ramdiskVolume ... chown: /sbin/reboot root:root
[+] ramdiskVolume ... Added dummyFile
got /usr/local/share/restore/options.plist from ramdisk
start create restore options

MinimumSystemPartition 1054 CreateFilesystemPartitions SystemPartitionSize 1054 UpdateBaseband Creating and writing DDM and partition map... run 0: sectors=1, left=1 run 0: sectors=60, left=60 malloc: 0x55f354cbe950 4096 run 0: sectors=4, left=4 Writing main data blkx... run 2: skipping sectors=15904, left=2158080 run 56: skipping sectors=5600, left=2115040 run 100: sectors=512, left=2087424 run 200: sectors=512, left=2036224 run 300: sectors=512, left=1985024 run 393: skipping sectors=8016, left=1937408 run 400: sectors=512, left=1926320 run 500: sectors=512, left=1875120 run 600: sectors=512, left=1823920 run 700: sectors=512, left=1772720 run 800: sectors=512, left=1721520 run 900: sectors=512, left=1670320 run 1000: sectors=512, left=1619120 run 1100: sectors=512, left=1567920 run 1200: sectors=512, left=1516720 run 1300: sectors=512, left=1465520 run 1400: sectors=512, left=1414320 run 1500: sectors=512, left=1363120 run 1600: sectors=512, left=1311920 run 1700: sectors=512, left=1260720 run 1753: skipping sectors=4792, left=1233584 run 1800: sectors=512, left=1205240 run 1900: sectors=512, left=1154040 run 1915: skipping sectors=36344, left=1146360 run 2000: sectors=512, left=1067008 run 2100: sectors=512, left=1015808 run 2200: sectors=512, left=964608 run 2300: sectors=512, left=913408 run 2400: sectors=512, left=862208 run 2500: sectors=512, left=811008 run 2600: sectors=512, left=759808 run 2700: sectors=512, left=708608 run 2800: sectors=512, left=657408 run 2900: sectors=512, left=606208 run 3000: sectors=512, left=555008 run 3100: sectors=512, left=503808 run 3200: sectors=512, left=452608 run 3222: skipping sectors=441342, left=441344 Inserting main blkx... Inserting cSum data... Inserting nsiz data Writing free partition... Writing XML data... making size data we know to flip this size resource Generating UDIF metadata... Master checksum: f157c9a Writing out UDIF resource file... Cleaning up... Done. packing: 038-2265-002.dmg (25434308) packing: 038-2268-002.dmg (25024708) packing: 038-2288-002.dmg (630527530) packing: BuildManifest.plist (22691) packing: Firmware/ (0) packing: Firmware/ICE3_04.10.01_BOOT_02.13.Release.bbfw (3811912) packing: Firmware/all_flash/ (0) packing: Firmware/all_flash/all_flash.n90ap.production/ (0) packing: Firmware/all_flash/all_flash.n90ap.production/DeviceTree.n90ap.img3 (60612) packing: Firmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 (131468) packing: Firmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3 (15172) packing: Firmware/all_flash/all_flash.n90ap.production/applelogo7-640x960.s5l8930x.img3 (6796) packing: Firmware/all_flash/all_flash.n90ap.production/applelogoT-640x960.s5l8930x.img3 (2816) packing: Firmware/all_flash/all_flash.n90ap.production/batterycharging0-640x960.s5l8930x.img3 (9740) packing: Firmware/all_flash/all_flash.n90ap.production/batterycharging1-640x960.s5l8930x.img3 (35020) packing: Firmware/all_flash/all_flash.n90ap.production/batteryfull-640x960.s5l8930x.img3 (84044) packing: Firmware/all_flash/all_flash.n90ap.production/batterylow0-640x960.s5l8930x.img3 (43596) packing: Firmware/all_flash/all_flash.n90ap.production/batterylow1-640x960.s5l8930x.img3 (2060) packing: Firmware/all_flash/all_flash.n90ap.production/glyphcharging-640x960.s5l8930x.img3 (7364) packing: Firmware/all_flash/all_flash.n90ap.production/glyphplugin-640x960.s5l8930x.img3 (11852) packing: Firmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 (283020) packing: Firmware/all_flash/all_flash.n90ap.production/iBoot2.n90ap.RELEASE.img3 (223452) packing: Firmware/all_flash/all_flash.n90ap.production/manifest (482) packing: Firmware/all_flash/all_flash.n90ap.production/recoverymode-640x960.s5l8930x.img3 (129604) packing: Firmware/all_flash/all_flash.n90ap.production/recoverymode7-640x960.s5l8930x.img3 (69452) packing: Firmware/dfu/ (0) packing: Firmware/dfu/iBEC.n90ap.RELEASE.dfu (223620) packing: Firmware/dfu/iBSS.n90ap.RELEASE.dfu (157916) packing: Restore.plist (2076) packing: kernelcache.release.k48 (6179844) packing: kernelcache.release.n81 (6086340) packing: kernelcache.release.n90 (6204100) [Log] Checking firmware keys in ../saved/firmware/iPhone3,1/8L1 [Log] Applying iBSS/iBEC patches [Log] Patch iBSS Archive: ../iPhone3,1_4.3.5_8L1_Restore.ipsw inflating: ./iBSS.n90ap.RELEASE.dfu /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7 main: Starting... main: iBoot-1072 inputted. patch_boot_args: Entering... patch_boot_args: Default boot-args string is at 0x21664 patch_boot_args: boot-args xref is at 0x13d84 patch_boot_args: Relocating boot-args string... patch_boot_args: "Reliance on this certificate" string found at 0x2405c patch_boot_args: Pointing default boot-args xref to 0x8402405c... patch_boot_args: Applying custom boot-args "rd=md0 -v amfi=0xff cs_enforcement_disable=1 pio-error=0" patch_boot_args: Found LDR R0, =boot_args at 0x135d0 patch_boot_args: Found IT instruction at 0x135e4 patch_boot_args: Found CMP Rx, #0 at 0x135e2 patch_debug_enabled: Entering... find_dtre_get_value_bl_insn: Entering... find_dtre_get_value_bl_insn: debug-enabled string is at 0x217ec find_dtre_get_value_bl_insn: "debug-enabled" xref is at 0x13e20 find_dtre_get_value_bl_insn: Found LDR R0, ="debug-enabled" at 0x1391e find_dtre_get_value_bl_insn: Found BL instruction at 0x13934 find_dtre_get_value_bl_insn: Leaving... patch_debug_enabled: Patching BL insn at 0x13934... patch_debug_enabled: Leaving... patch_rsa_check: Entering... find_rsa_check_3_4: Entering... find_rsa_check_3_4: Found LDR Rx, CERT at 0x12620 find_rsa_check_3_4: Found MOVS R1, #0x14 at 0x126b8 find_rsa_check_3_4: Found BL 1 instruction at 0x126c6 find_rsa_check_3_4: Found BL 1 instruction xref at 0x12809 find_rsa_check_3_4: Found BL 2 instruction at 0x1281e find_rsa_check_3_4: Found BL 2 instruction xref at 0x1ad6d find_rsa_check_3_4: Found CMP Rx, 0x14 at 0x1b1b6 find_rsa_check_3_4: Found BL 3 instruction at 0x1b1e6 find_rsa_check_3_4: Found BL 3 instruction xref at 0x1abf9 find_rsa_check_3_4: Found MOV.W R0, #0xFFFFFFFF! at 0x1ad40 find_rsa_check_3_4: Leaving... patch_rsa_check: Patching RSA at 0x1ad40... find_ldr_ecid: Entering... find_ldr_ecid: Found LDR instruction at 0x12d3c find_ldr_ecid: Found BL ECID at 0x12d4c find_ldr_ecid: Leaving... patch_rsa_check: Patching BL ECID at 0x12d4c... find_ldr_bord: Entering... find_ldr_bord: Found LDR BORD instruction at 0x12d16 find_ldr_bord: Found BL BORD at 0x12d28 find_ldr_bord: Leaving... patch_rsa_check: Patching BL BORD at 0x12d28... find_ldr_prod: Entering... find_ldr_prod: Found LDR PROD instruction at 0x12c42 find_ldr_prod: Found BL PROD at 0x12c54 find_ldr_prod: Leaving... patch_rsa_check: Patching BL PROD at 0x12c54... find_ldr_sepo: Entering... find_ldr_sepo: Found LDR SEPO instruction at 0x12ce4 find_ldr_sepo: Found BL SEPO at 0x12ce6 find_ldr_sepo: Leaving... patch_rsa_check: Patching BL SEPO at 0x12ce6... main: Writing out patched file to iBSS.patched... main: Quitting... /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7 /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7 [Log] Patch iBEC Archive: ../iPhone3,1_4.3.5_8L1_Restore.ipsw inflating: ./iBEC.n90ap.RELEASE.dfu /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ed377ff5daa159d18b706bd598373872af3684afbbd59286a269c70a6c6bb463999549600aaa42b1a9576b52ed434770 main: Starting... main: iBoot-1072 inputted. patch_boot_args: Entering... patch_boot_args: Default boot-args string is at 0x2ef24 patch_boot_args: boot-args xref is at 0x143b4 patch_boot_args: Relocating boot-args string... patch_boot_args: "Reliance on this certificate" string found at 0x34340 patch_boot_args: Pointing default boot-args xref to 0x5ff34340... patch_boot_args: Applying custom boot-args "rd=md0 -v amfi=0xff cs_enforcement_disable=1 pio-error=0" patch_boot_args: Found LDR R0, =boot_args at 0x13c04 patch_boot_args: Found IT instruction at 0x13c0e patch_boot_args: Found CMP Rx, #0 at 0x13c0c patch_debug_enabled: Entering... find_dtre_get_value_bl_insn: Entering... find_dtre_get_value_bl_insn: debug-enabled string is at 0x2f0ac find_dtre_get_value_bl_insn: "debug-enabled" xref is at 0x1444c find_dtre_get_value_bl_insn: Found LDR R0, ="debug-enabled" at 0x13f4e find_dtre_get_value_bl_insn: Found BL instruction at 0x13f64 find_dtre_get_value_bl_insn: Leaving... patch_debug_enabled: Patching BL insn at 0x13f64... patch_debug_enabled: Leaving... patch_rsa_check: Entering... find_rsa_check_3_4: Entering... find_rsa_check_3_4: Found LDR Rx, CERT at 0x12c78 find_rsa_check_3_4: Found MOVS R1, #0x14 at 0x12d10 find_rsa_check_3_4: Found BL 1 instruction at 0x12d1e find_rsa_check_3_4: Found BL 1 instruction xref at 0x12e61 find_rsa_check_3_4: Found BL 2 instruction at 0x12e76 find_rsa_check_3_4: Found BL 2 instruction xref at 0x1b92d find_rsa_check_3_4: Found CMP Rx, 0x14 at 0x1bd76 find_rsa_check_3_4: Found BL 3 instruction at 0x1bda6 find_rsa_check_3_4: Found BL 3 instruction xref at 0x1b7b9 find_rsa_check_3_4: Found MOV.W R0, #0xFFFFFFFF! at 0x1b900 find_rsa_check_3_4: Leaving... patch_rsa_check: Patching RSA at 0x1b900... find_ldr_ecid: Entering... find_ldr_ecid: Found LDR instruction at 0x13394 find_ldr_ecid: Found BL ECID at 0x133a4 find_ldr_ecid: Leaving... patch_rsa_check: Patching BL ECID at 0x133a4... find_ldr_bord: Entering... find_ldr_bord: Found LDR BORD instruction at 0x1336e find_ldr_bord: Found BL BORD at 0x13380 find_ldr_bord: Leaving... patch_rsa_check: Patching BL BORD at 0x13380... find_ldr_prod: Entering... find_ldr_prod: Found LDR PROD instruction at 0x1329a find_ldr_prod: Found BL PROD at 0x132ac find_ldr_prod: Leaving... patch_rsa_check: Patching BL PROD at 0x132ac... find_ldr_sepo: Entering... find_ldr_sepo: Found LDR SEPO instruction at 0x1333c find_ldr_sepo: Found BL SEPO at 0x1333e find_ldr_sepo: Leaving... patch_rsa_check: Patching BL SEPO at 0x1333e... main: Writing out patched file to iBEC.patched... main: Quitting... /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ed377ff5daa159d18b706bd598373872af3684afbbd59286a269c70a6c6bb463999549600aaa42b1a9576b52ed434770 /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ed377ff5daa159d18b706bd598373872af3684afbbd59286a269c70a6c6bb463999549600aaa42b1a9576b52ed434770 [Log] Patch AppleLogo Archive: temp.ipsw inflating: ./applelogo-640x960.s5l8930x.img3 [Log] Add all to custom IPSW updating: Firmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3 (stored 0%) updating: Firmware/all_flash/all_flash.n90ap.production/iBoot2.n90ap.RELEASE.img3 (stored 0%) updating: Firmware/dfu/iBEC.n90ap.RELEASE.dfu (stored 0%) updating: Firmware/dfu/iBSS.n90ap.RELEASE.dfu (stored 0%) [Log] Device iPhone3,1 has no baseband/disabled baseband update [Log] Extracting IPSW: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705.ipsw Archive: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705.ipsw inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/038-2265-002.dmg inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/038-2268-002.dmg inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/038-2288-002.dmg inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/BuildManifest.plist creating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/ inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/ICE3_04.10.01_BOOT_02.13.Release.bbfw creating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/ creating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/ inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/DeviceTree.n90ap.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 extracting: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/applelogo7-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/applelogoT-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/batterycharging0-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/batterycharging1-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/batteryfull-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/batterylow0-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/batterylow1-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/glyphcharging-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/glyphplugin-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 extracting: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/iBoot2.n90ap.RELEASE.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/manifest inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/recoverymode-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/all_flash/all_flash.n90ap.production/recoverymode7-640x960.s5l8930x.img3 creating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/dfu/ extracting: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/dfu/iBEC.n90ap.RELEASE.dfu extracting: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Firmware/dfu/iBSS.n90ap.RELEASE.dfu inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/Restore.plist inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/kernelcache.release.k48 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/kernelcache.release.n81 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/kernelcache.release.n90 [Log] Running idevicerestore with command: ../bin/linux/x86_64/idevicerestore -ew "../iPhone3,1_4.3.5_8L1_CustomP-2672744926705.ipsw" Found device in DFU mode Found ECID 2672744926705 Identified device as n90ap, iPhone3,1 Extracting BuildManifest from IPSW Product Version: 4.3.5 Product Build: 8L1 Major: 8 Device supports Image4: false Variant: Customer Erase Install (IPSW) This restore will erase your device data. checking for local shsh Using cached SHSH Using cached filesystem from '../iPhone3,1_4.3.5_8L1_CustomP-2672744926705/038-2288-002.dmg' Extracting iBSS.n90ap.RELEASE.dfu... Personalizing IMG3 component iBSS... reconstructed size: 157937 Sending iBSS (157937 bytes)... [==================================================] 100.0% Recovery Mode Environment: iBoot build-version=iBoot-1072.61 iBoot build-style=RELEASE ramdisk-size=RELEASE Extracting 038-2265-002.dmg... Not personalizing component RestoreRamDisk... Sending RestoreRamDisk (25434308 bytes)... Extracting DeviceTree.n90ap.img3... Not personalizing component RestoreDeviceTree... Sending RestoreDeviceTree (60612 bytes)... Extracting kernelcache.release.n90... Not personalizing component RestoreKernelCache... Sending RestoreKernelCache (6204100 bytes)... About to restore device... Waiting for device... Device d6f151f0cbbbc47aafb9332b7c5b6ff7cc4a44bb is now connected in restore mode... Connecting now... Connected to com.apple.mobile.restored, version 12 Device d6f151f0cbbbc47aafb9332b7c5b6ff7cc4a44bb has successfully entered restore mode Hardware Information: BoardID: 0 ChipID: 35120 UniqueChipID: 2672744926705 ProductionMode: true Got status message Unhandled status message (28) common.c:printing 8677 bytes plist: AMRError 28 Log Register Service virtual bool AppleM2ScalerCSCDriver::start(IOService*): this=0x82dd9e00, Added Scaler Number = 0 AppleAP3GDL::probe found device with ID: 0xd3 AppleAP3GDL::handleStart _calibrationMatrix [0 0 0] [0 0 0] [0 0 0] _odr200HzSampleInterval = 0 AppleAP3GDL::handleStart The calibration matrix is singular. Something is wrong. IOFixed - Coeffs -[r,g,b] = [0, 0, 0], [gain=0] AppleMPU3100::probe -- Not the right part AppleEmbeddedI2CGyro::free .. why is someone calling free on me AppleCT700::handleStart -- Cal Gain = 100, Cal trigger = 0, Cal release=0, Cal power=0, Cal shortFilter=0, Cal longFilter=0 BSD root: md0, major 2, minor 0 com.apple.AppleFSCompressionTypeZlib kmod start com.apple.AppleFSCompressionTypeZlib load succeeded virtual bool AppleMobileFileIntegrity::start(IOService*): built Jul 20 2011 03:32:12 L2TP domain init L2TP domain init complete PPTP domain init AppleS5L8920XBasebandSPIController::loadConfiguration: NCLK Frequency 48857142, Prescaler 3 BasebandSPIDevice::exitLowPower: Invalid state inactive AppleSerialMultiplexer: adap::start: Frame size is 2048, Rx Buffer count is 16 AppleSerialMultiplexer: mux::start: created new mux (13) for spi-baseband with adapter BasebandSPIDevice AppleSerialMultiplexer: debugparams::init: Parsed flags "" ( 0 ) AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart1 at 0x82600000(0xd204d000) AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart2 at 0x82700000(0xd21a5000) AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart3 at 0x82800000(0xd21ae000) AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart6 at 0x82b00000(0xd21b6000) AppleSerialMultiplexer: !! mux::setPowerStateGated: Skipping power state change AUD10::start: 0x82d72000, highland-park mIISNub: 0x832cfa00, sampleRate = 44100, ol=10, oi=12 AppleSynopsysOTGDevice::start : start finished AppleBaseband: inconsistent mux function setup (0 0 0 0 0 0) virtual bool AppleCLCD::start_hardware(IOService*), clcdDitherCfg: 0x80000001 mIsDitherFor8Bits: 1 IOReturn AppleCLCD::set_ditherTable_state(bool), mIsDitherFor8Bits is true, no dynamic dither table. IOSDIOController::enumerateSlot(): Searching for SDIO device in slot: 0 IOSurface: buffer allocation size is zero AppleM2ScalerCSCDriver: Added framebuffer device: AppleCLCD id: c7e0c000 IOSDIOController::enumerateSlot(): Found SDIO I/O device. Function count(1), memory(0) AppleRGBOUT: TVOUT device is detected AppleMultitouchN1SPI: successfully started IOSDIOIoCardDevice::parseFn0CISTuple(): Device manufacturer ID 0x2d0, Product ID 0x4329 IOSDIOIoCardDevice::parseFn0CISTuple(): Manufacturer: "" IOSDIOIoCardDevice::parseFn0CISTuple(): Product: "" IOSDIOIoCardDevice::parseFn0CISTuple(): ProductInfo0: "s=B1" IOSDIOIoCardDevice::parseFn0CISTuple(): ProductInfo1: "P=N90 m=3.1 V=u" AppleBCMWLAN::init(): AppleBCMWLAN-84 Jul 9 2011 01:10:00 AppleBCMWLAN::init(): Starting with debug level: 4, debug flags: 00000000 AppleBCMWLAN::init(): AppleBCMWLAN-84 Jul 9 2011 01:10:00 AppleBCMWLAN::init(): Starting with debug level: 4, debug flags: 00000000 AUD10::start: 0x82d72000, highland-park mIICNub: 0x82b60e80, mIISNub: 0x832cfa00, mSerialNub: 0x802ecc00, sampleRate = 44100, ol=10, oi=12 AppleD1815PMUPowerSource: AppleUSBCableDetect 1 AppleD1815PMUPowerSource: AppleUSBCableType USBHost AppleEmbeddedUSBArbitrator::handleUSBCableTypeChange : Connected to a USB host, entering device mode AppleSynopsysOTGDevice::handleUSBCableConnect cable connected, but don't have device configuration yet AppleMultitouchN1SPI: detected HBPP. driver will be kept alive display-scale = 2 display-rotation = 0 found suitable IOMobileFramebuffer: AppleCLCD display: 640 x 960 found PTP interface AppleSynopsysOTGDevice - Configuration: PTP AppleSynopsysOTGDevice Interface: PTP AppleSynopsysOTGDevice - Configuration: iPod USB Interface AppleSynopsysOTGDevice Interface: USBAudioControl AppleSynopsysOTGDevice Interface: USBAudioStreaming AppleSynopsysOTGDevice Interface: IapOverUsbHid AppleSynopsysOTGDevice - Configuration: PTP + Apple Mobile Device AppleSynopsysOTGDevice Interface: PTP AppleSynopsysOTGDevice Interface: AppleUSBMux AppleSynopsysOTGDevice - Configuration: PTP + Apple Mobile Device + Apple USB Ethernet AppleSynopsysOTGDevice Interface: PTP AppleSynopsysOTGDevice Interface: AppleUSBMux AppleSynopsysOTGDevice Interface: AppleUSBEthernet AppleSynopsysOTGDevice::gated_registerFunction Register function USBAudioControl AppleSynopsysOTGDevice::gated_registerFunction Register function USBAudioStreaming IOAccessoryPortUSB::start AppleSynopsysOTGDevice::gated_registerFunction Register function IapOverUsbHid virtual bool AppleUSBDeviceMux::start(IOService*) build: Jul 9 2011 01:12:10 init_waste AppleSynopsysOTGDevice::gated_registerFunction Register function AppleUSBMux AppleSynopsysOTGDevice::gated_registerFunction Register function AppleUSBEthernet AppleUSBEthernetDevice::start: Host MAC address = 56:26:96:c1:62:fc AppleSynopsysOTGDevice::gated_registerFunction Register function PTP AppleSynopsysOTGDevice::gated_registerFunction all functions registered- we are ready to start usb stack AppleS5L8930XUSBPhy::powerUp : with_hsic: 0 AppleEmbeddedUSBArbitrator::enableDeviceClock : enable: 1, index: 0 AppleS5L8930XUSBPhy::enableDeviceMode : enable: 1 IOReturn AppleUSBDeviceMux::setPropertiesGated(OSObject*) setting debug level to 7 AppleSynopsysOTGDevice::handleUSBReset AppleSynopsysOTGDevice::handleUSBReset unrecognized request 'GetValue' close(caller = 0x28327): remote port = 49153 client protocol version 12 unable to open /usr/local/share/restore//options.n90.plist: No such file or directory *** UUID 8CCFB8F7-6DB7-712E-E48B-964E55F961C5 *** Restore options: UpdateBaseband => <CFBoolean 0x230fb0 [0x2309f8]>{value = false} UUID => <CFString 0x1c571700 [0x2309f8]>{contents = "8CCFB8F7-6DB7-712E-E48B-964E55F961C5"} MinimumSystemPartition => <CFNumber 0x1c5713e0 [0x2309f8]>{value = +1054, type = kCFNumberSInt64Type} SystemPartitionSize => <CFNumber 0x1c5716a0 [0x2309f8]>{value = +1054, type = kCFNumberSInt64Type} CreateFilesystemPartitions => <CFBoolean 0x230fa8 [0x2309f8]>{value = true} entering partition_nand_device device is not a boot-from-NAND device entering wait_for_storage_device waiting for matching IOKit service: <CFBasicHash 0x1c571390 [0x2309f8]>{type = mutable dict, count = 1, entries => 2 : <CFString 0x34b670 [0x2309f8]>{contents = "IOProviderClass"} = <CFString 0x1c5715c0 [0x2309f8]>{contents = "AppleNANDFTL"} }

AppleSynopsysOTGDevice::stallBadSetupRequest request: 41 04 0000 0002 0000
AppleUSBDeviceMux::handleConnectResult new session 0x84a7e700 established 62078<-lo0->49152 62078<-usb->1
AppleUSBDeviceMux::handleConnectResult new session 0x83853c80 established 62078<-lo0->49153 62078<-usb->2
void AppleUSBDeviceMux::handleMuxTCPInput(__mbuf*) received reset, closing 0x83853c80
AppleUSBEthernetDevice::message: kIOUSBDeviceInterfaceMessageTypeSetAlternateSetting, new alt-setting 1
AppleUSBDeviceMux::handleConnectResult new session 0x84a7e500 established 62078<-lo0->49154 62078<-usb->3
unrecognized request 'GetValue'
AppleUSBDeviceMux::handleConnectResult new session 0x84a7e200 established 62078<-lo0->49155 62078<-usb->4
waiting for matching IOKit service: <CFBasicHash 0x1c571390 [0x2309f8]>{type = mutable dict, count = 1,
entries =>
2 : <CFString 0x34b670 [0x2309f8]>{contents = "IOProviderClass"} = <CFString 0x1c5715c0 [0x2309f8]>{contents = "AppleNANDFTL"}
}

waiting for matching IOKit service: <CFBasicHash 0x1c571390 [0x2309f8]>{type = mutable dict, count = 1,
entries =>
2 : <CFString 0x34b670 [0x2309f8]>{contents = "IOProviderClass"} = <CFString 0x1c5715c0 [0x2309f8]>{contents = "AppleNANDFTL"}
}

waiting for matching IOKit service: <CFBasicHash 0x1c571390 [0x2309f8]>{type = mutable dict, count = 1,
entries =>
2 : <CFString 0x34b670 [0x2309f8]>{contents = "IOProviderClass"} = <CFString 0x1c5715c0 [0x2309f8]>{contents = "AppleNANDFTL"}
}

unable to find AppleNANDFTL

MsgType
StatusMsg
Status
28


Log is available:
Register Service
virtual bool AppleM2ScalerCSCDriver::start(IOService*): this=0x82dd9e00, Added Scaler Number = 0
AppleAP3GDL::probe found device with ID: 0xd3
AppleAP3GDL::handleStart _calibrationMatrix [0 0 0] [0 0 0] [0 0 0]
_odr200HzSampleInterval = 0
AppleAP3GDL::handleStart The calibration matrix is singular. Something is wrong.
IOFixed - Coeffs -[r,g,b] = [0, 0, 0], [gain=0]
AppleMPU3100::probe -- Not the right part
AppleEmbeddedI2CGyro::free .. why is someone calling free on me
AppleCT700::handleStart -- Cal Gain = 100, Cal trigger = 0, Cal release=0, Cal power=0, Cal shortFilter=0, Cal longFilter=0
BSD root: md0, major 2, minor 0
com.apple.AppleFSCompressionTypeZlib kmod start
com.apple.AppleFSCompressionTypeZlib load succeeded
virtual bool AppleMobileFileIntegrity::start(IOService*): built Jul 20 2011 03:32:12
L2TP domain init
L2TP domain init complete
PPTP domain init
AppleS5L8920XBasebandSPIController::loadConfiguration: NCLK Frequency 48857142, Prescaler 3
BasebandSPIDevice::exitLowPower: Invalid state inactive
AppleSerialMultiplexer: adap::start: Frame size is 2048, Rx Buffer count is 16
AppleSerialMultiplexer: mux::start: created new mux (13) for spi-baseband with adapter BasebandSPIDevice
AppleSerialMultiplexer: debugparams::init: Parsed flags "" ( 0 )
AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart1 at 0x82600000(0xd204d000)
AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart2 at 0x82700000(0xd21a5000)
AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart3 at 0x82800000(0xd21ae000)
AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart6 at 0x82b00000(0xd21b6000)
AppleSerialMultiplexer: !! mux::setPowerStateGated: Skipping power state change
AUD10::start: 0x82d72000, highland-park mIISNub: 0x832cfa00, sampleRate = 44100, ol=10, oi=12
AppleSynopsysOTGDevice::start : start finished
AppleBaseband: inconsistent mux function setup (0 0 0 0 0 0)
virtual bool AppleCLCD::start_hardware(IOService*), clcdDitherCfg: 0x80000001 mIsDitherFor8Bits: 1
IOReturn AppleCLCD::set_ditherTable_state(bool), mIsDitherFor8Bits is true, no dynamic dither table.
IOSDIOController::enumerateSlot(): Searching for SDIO device in slot: 0
IOSurface: buffer allocation size is zero
AppleM2ScalerCSCDriver: Added framebuffer device: AppleCLCD id: c7e0c000
IOSDIOController::enumerateSlot(): Found SDIO I/O device. Function count(1), memory(0)
AppleRGBOUT: TVOUT device is detected
AppleMultitouchN1SPI: successfully started
IOSDIOIoCardDevice::parseFn0CISTuple(): Device manufacturer ID 0x2d0, Product ID 0x4329
IOSDIOIoCardDevice::parseFn0CISTuple(): Manufacturer: ""
IOSDIOIoCardDevice::parseFn0CISTuple(): Product: ""
IOSDIOIoCardDevice::parseFn0CISTuple(): ProductInfo0: "s=B1"
IOSDIOIoCardDevice::parseFn0CISTuple(): ProductInfo1: "P=N90 m=3.1 V=u"
AppleBCMWLAN::init(): AppleBCMWLAN-84 Jul 9 2011 01:10:00
AppleBCMWLAN::init(): Starting with debug level: 4, debug flags: 00000000
AppleBCMWLAN::init(): AppleBCMWLAN-84 Jul 9 2011 01:10:00
AppleBCMWLAN::init(): Starting with debug level: 4, debug flags: 00000000
AUD10::start: 0x82d72000, highland-park mIICNub: 0x82b60e80, mIISNub: 0x832cfa00, mSerialNub: 0x802ecc00, sampleRate = 44100, ol=10, oi=12
AppleD1815PMUPowerSource: AppleUSBCableDetect 1
AppleD1815PMUPowerSource: AppleUSBCableType USBHost
AppleEmbeddedUSBArbitrator::handleUSBCableTypeChange : Connected to a USB host, entering device mode
AppleSynopsysOTGDevice::handleUSBCableConnect cable connected, but don't have device configuration yet
AppleMultitouchN1SPI: detected HBPP. driver will be kept alive
display-scale = 2
display-rotation = 0
found suitable IOMobileFramebuffer: AppleCLCD
display: 640 x 960
found PTP interface
AppleSynopsysOTGDevice - Configuration: PTP
AppleSynopsysOTGDevice Interface: PTP
AppleSynopsysOTGDevice - Configuration: iPod USB Interface
AppleSynopsysOTGDevice Interface: USBAudioControl
AppleSynopsysOTGDevice Interface: USBAudioStreaming
AppleSynopsysOTGDevice Interface: IapOverUsbHid
AppleSynopsysOTGDevice - Configuration: PTP + Apple Mobile Device
AppleSynopsysOTGDevice Interface: PTP
AppleSynopsysOTGDevice Interface: AppleUSBMux
AppleSynopsysOTGDevice - Configuration: PTP + Apple Mobile Device + Apple USB Ethernet
AppleSynopsysOTGDevice Interface: PTP
AppleSynopsysOTGDevice Interface: AppleUSBMux
AppleSynopsysOTGDevice Interface: AppleUSBEthernet
AppleSynopsysOTGDevice::gated_registerFunction Register function USBAudioControl
AppleSynopsysOTGDevice::gated_registerFunction Register function USBAudioStreaming
IOAccessoryPortUSB::start
AppleSynopsysOTGDevice::gated_registerFunction Register function IapOverUsbHid
virtual bool AppleUSBDeviceMux::start(IOService*) build: Jul 9 2011 01:12:10
init_waste
AppleSynopsysOTGDevice::gated_registerFunction Register function AppleUSBMux
AppleSynopsysOTGDevice::gated_registerFunction Register function AppleUSBEthernet
AppleUSBEthernetDevice::start: Host MAC address = 56:26:96:c1:62:fc
AppleSynopsysOTGDevice::gated_registerFunction Register function PTP
AppleSynopsysOTGDevice::gated_registerFunction all functions registered- we are ready to start usb stack
AppleS5L8930XUSBPhy::powerUp : with_hsic: 0
AppleEmbeddedUSBArbitrator::enableDeviceClock : enable: 1, index: 0
AppleS5L8930XUSBPhy::enableDeviceMode : enable: 1
IOReturn AppleUSBDeviceMux::setPropertiesGated(OSObject*) setting debug level to 7
AppleSynopsysOTGDevice::handleUSBReset
AppleSynopsysOTGDevice::handleUSBReset
unrecognized request 'GetValue'
close(caller = 0x28327): remote port = 49153
client protocol version 12
unable to open /usr/local/share/restore//options.n90.plist: No such file or directory
*** UUID 8CCFB8F7-6DB7-712E-E48B-964E55F961C5 ***
Restore options:
UpdateBaseband => <CFBoolean 0x230fb0 [0x2309f8]>{value = false}
UUID => <CFString 0x1c571700 [0x2309f8]>{contents = "8CCFB8F7-6DB7-712E-E48B-964E55F961C5"}
MinimumSystemPartition => <CFNumber 0x1c5713e0 [0x2309f8]>{value = +1054, type = kCFNumberSInt64Type}
SystemPartitionSize => <CFNumber 0x1c5716a0 [0x2309f8]>{value = +1054, type = kCFNumberSInt64Type}
CreateFilesystemPartitions => <CFBoolean 0x230fa8 [0x2309f8]>{value = true}
entering partition_nand_device
device is not a boot-from-NAND device
entering wait_for_storage_device
waiting for matching IOKit service: <CFBasicHash 0x1c571390 [0x2309f8]>{type = mutable dict, count = 1,
entries =>
2 : <CFString 0x34b670 [0x2309f8]>{contents = "IOProviderClass"} = <CFString 0x1c5715c0 [0x2309f8]>{contents = "AppleNANDFTL"}
}

AppleSynopsysOTGDevice::stallBadSetupRequest request: 41 04 0000 0002 0000
AppleUSBDeviceMux::handleConnectResult new session 0x84a7e700 established 62078<-lo0->49152 62078<-usb->1
AppleUSBDeviceMux::handleConnectResult new session 0x83853c80 established 62078<-lo0->49153 62078<-usb->2
void AppleUSBDeviceMux::handleMuxTCPInput(__mbuf*) received reset, closing 0x83853c80
AppleUSBEthernetDevice::message: kIOUSBDeviceInterfaceMessageTypeSetAlternateSetting, new alt-setting 1
AppleUSBDeviceMux::handleConnectResult new session 0x84a7e500 established 62078<-lo0->49154 62078<-usb->3
unrecognized request 'GetValue'
AppleUSBDeviceMux::handleConnectResult new session 0x84a7e200 established 62078<-lo0->49155 62078<-usb->4
waiting for matching IOKit service: <CFBasicHash 0x1c571390 [0x2309f8]>{type = mutable dict, count = 1,
entries =>
2 : <CFString 0x34b670 [0x2309f8]>{contents = "IOProviderClass"} = <CFString 0x1c5715c0 [0x2309f8]>{contents = "AppleNANDFTL"}
}

waiting for matching IOKit service: <CFBasicHash 0x1c571390 [0x2309f8]>{type = mutable dict, count = 1,
entries =>
2 : <CFString 0x34b670 [0x2309f8]>{contents = "IOProviderClass"} = <CFString 0x1c5715c0 [0x2309f8]>{contents = "AppleNANDFTL"}
}

waiting for matching IOKit service: <CFBasicHash 0x1c571390 [0x2309f8]>{type = mutable dict, count = 1,
entries =>
2 : <CFString 0x34b670 [0x2309f8]>{contents = "IOProviderClass"} = <CFString 0x1c5715c0 [0x2309f8]>{contents = "AppleNANDFTL"}
}

unable to find AppleNANDFTL

ERROR: Unable to successfully restore device
ERROR: Unable to restore device

[Log] Restoring done! Read the message below if any error has occurred:

• For device activation, go to: Main Menu -> Attempt Activation
• Please read the "Troubleshooting" wiki page in GitHub before opening any issue!
• Your problem may have already been addressed within the wiki page.
• If opening an issue in GitHub, please provide a FULL log/output. Otherwise, your issue may be dismissed.

[Log] The device may enter recovery mode after the restore

• To fix this, go to: Useful Utilities -> Disable/Enable Exploit -> Enable Exploit

[Log] Terminating own usbmuxd instance(s)

• Enter your user password when prompted
• Your password input may not be visible, but it is still being entered.
  `