Replies: 36 comments
-
|
Enabling the exploit after the restores doesn't work either |
Beta Was this translation helpful? Give feedback.
-
|
not sure what the issue is tbh, just restored to 6.1.5 and it works fine for me |
Beta Was this translation helpful? Give feedback.
-
|
*** Legacy iOS Kit ***
*** Legacy iOS Kit ***
[Log] Checking firmware keys in ../saved/firmware/iPod4,1/10B500
this is the enabling exploit log, just tried restoring to 6.1.5 again same issue |
Beta Was this translation helpful? Give feedback.
-
|
The 8GB Models are the ones that aren't working, it works on the 16GB/32GB models just fine to 5.x and 4.3.x, it was the 8GB models to any version iOS 4, iOS 5 etc |
Beta Was this translation helpful? Give feedback.
-
|
No iPod Touch 4 Restores to iOS 4.1/4.2.1 work regardless of the model being 8GB or 32GB - they send device to recovery mode after restore and even after enabling the exploit it still doesn't work i had tested it |
Beta Was this translation helpful? Give feedback.
-
|
Got the same issue on same model, iPod Touch 4th gen, black, 8GB, tried iOS 4.3.5 and 5.1.1. Noticed that booting in tethered boot (or Just Boot) works and boots to iOS while untethered doesn't work. |
Beta Was this translation helpful? Give feedback.
-
|
my test touch 4 is 8gb and i was able to restore to 4.3.5, 5.1.1, and 6.1.5 just fine. not sure about 4.1 and 4.2.1 i think those are just broken right now |
Beta Was this translation helpful? Give feedback.
-
|
its every time i restore to iOS 6.1.5 on a 8GB iPod Touch 4 manufactured 2nd half 2012, it goes into recovery mode after the restore and then i enable the exploit and then it enters recovery mode after that |
Beta Was this translation helpful? Give feedback.
-
|
mine is a 1st half 2012 and it works fine so yea idk if it has something to do with manufacture date or capacity or whatever. there might be something else that prevents it from working and right now i dont really know how to help anyone having this issue |
Beta Was this translation helpful? Give feedback.
-
|
mine is like on July 2011 so should support 4.3.5? also, tried the ios 7 thing also and it also can't boot untethered (with/without the exploit enabled) so unsure what happened. |
Beta Was this translation helpful? Give feedback.
-
|
@LukeZGD I changed reboot4 for iPod4,1 in my fork of kit. Now it can directly get into system. |
Beta Was this translation helpful? Give feedback.
-
what changes did you make? |
Beta Was this translation helpful? Give feedback.
-
Directly write iPod4,1 exploit into nand. The old reboot4 writes iPhone3,1 11D257 exploit. |
Beta Was this translation helpful? Give feedback.
-
|
yeah the base reboot4 does that, but the script modifies the reboot4 with the correct exploit |
Beta Was this translation helpful? Give feedback.
-
That's good. |
Beta Was this translation helpful? Give feedback.
-
ok yeah looks like i messed up and now touch 4 ios 7 doesnt use aquila for the correct jailbreak patches. yes you will need to restore to fix this after i push the fix out, will let you know in a bit |
Beta Was this translation helpful? Give feedback.
-
dumb question but isn't it possible to integrate certificates when creating custom ipsw? so people don't forget to install them or whatever |
Beta Was this translation helpful? Give feedback.
-
theyre already integrated |
Beta Was this translation helpful? Give feedback.
-
|
wait so i don't need to install them from tlsroot? im lost |
Beta Was this translation helpful? Give feedback.
-
pushed the fix. delete the existing 7.1.2 custom ipsw before retrying the restore 4.1/4.2.1 should also be fixed now for dra v6 |
Beta Was this translation helpful? Give feedback.
-
|
ok touch 4 ios 7 is still having some weird issues. will try something to fix this |
Beta Was this translation helpful? Give feedback.
-
|
so my 32gb ipod touch 4 (early 2011 mfg date) won't untether boot. i tried 4.1 (8B117), 4.2.1, 4.3.5, and 5.0. they flash white for a split second, and boot to recovery mode instead. they do in fact tether boot using lik's just boot option |
Beta Was this translation helpful? Give feedback.
-
|
The 8GB iPod touch 4 (early 2012) flashed white for a moment at 4.0, 5.1.1, and then switched to recovery mode instead. |
Beta Was this translation helpful? Give feedback.
-
fixed. will just need another redo of the custom ipsw (delete before retry) |
Beta Was this translation helpful? Give feedback.
-
|
I seem to still be having issues with my touch 4 restoring to ios 4 or 5
[Log] Selected IPSW file: /Users/user/Downloads/iPod4,1_5.1.1_9B206_Restore.ipsw 07/12 15:11:16 [NOTICE] Downloading 1 item(s) *** Legacy iOS Kit ***
[Input] Jailbreak Option
[Log] Jailbreak option enabled. [Input] Memory Option for creating custom IPSW
[Log] Memory option enabled. [Input] Verbose Boot Option
[Log] Verbose boot option enabled. [Log] Found existing saved 6.1.6 blobs: ../saved/shsh/1818197859791_iPod4,1_n81ap_6.1.6-10B500_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2
07/12 15:11:38 [NOTICE] Downloading 1 item(s) [Log] Restoring done! Read the message below if any error has occurred:
|
Beta Was this translation helpful? Give feedback.
-
|
let me just mention again that right now i dont really know how to help anyone having the issue booting. for those that dont have this issue tho, the previous issues with ios 4.1/4.2.1 and ios 7 are now fixed. |
Beta Was this translation helpful? Give feedback.
-
|
Still Same Problem with iOS 4.1/4.2.1 on iPod Touch 4 manufactured 2nd half of 2010, it enters recovery mode after restore to both versions and enabling exploit |
Beta Was this translation helpful? Give feedback.
-
|
iOS 4.3.5 used to work and now it doesn't work anymore it sends the device into recovery mode after restoring -> Select Base IPSW [Input] Select your Base IPSW file in the file selection window. [Log] Selected IPSW file: /Users/apple/Desktop/iPod4,1_6.1.6_10B500_Restore.ipsw 07/12 09:32:08 [NOTICE] Downloading 1 item(s) 07/12 09:32:08 [NOTICE] Download complete: /Users/apple/Downloads/Downgrade Tools/Legacy iOS Kit/Legacy-iOS-Kit_macos_v23.07.15/tmp93585/tmp.json *** Legacy iOS Kit ***
[Input] Jailbreak Option
[Log] Jailbreak option enabled. [Input] Memory Option for creating custom IPSW
[Log] Memory option enabled. [Input] Verbose Boot Option
[Log] Verbose boot option enabled. [Log] Found existing saved 6.1.6 blobs: ../saved/shsh/3792741496310_iPod4,1_n81ap_6.1.6-10B500_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2
[Log] Restoring done! Read the message below if any error has occurred:
[Log] The device may enter recovery mode after the restore
|
Beta Was this translation helpful? Give feedback.
-
|
*** Legacy iOS Kit ***
*** Legacy iOS Kit ***
[Log] Checking firmware keys in ../saved/firmware/iPod4,1/10B500
even after enabling exploit also with iOS 4.3.5 |
Beta Was this translation helpful? Give feedback.
-
|
I was able to get a succesful untethered install using a copy of debian linux on x86, seems to be a mac os issue |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
-> Select Base IPSW
Download Base IPSW
Custom Bootargs
Select Apple Logo
Go Back
[Input] Select your Base IPSW file in the file selection window.
[Log] Selected IPSW file: /Users/apple/Desktop/iPod4,1_6.1.6_10B500_Restore.ipsw
[Log] Getting version from IPSW
x Restore.plist
[Log] Getting SHA1 hash for /Users/apple/Desktop/iPod4,1_6.1.6_10B500_Restore.ipsw...
[Log] Getting SHA1 hash from AppleDB...
[Log] AppleDB request: https://api.appledb.dev/ios/iOS;10B500.json
07/11 13:05:24 [NOTICE] Downloading 1 item(s)
07/11 13:05:24 [NOTICE] Download complete: /Users/apple/Downloads/Downgrade Tools/Legacy iOS Kit/Legacy-iOS-Kit_macos_v23.07.15/tmp28630/tmp.json
[Log] Using saved SHA1 hash for this IPSW: 693bb78c8f6baf4186f7797bf3a0ef7d3b18255e
[Log] IPSW SHA1sum matches
*** Legacy iOS Kit ***
Version: v26.07.17 (c237736)
Platform: macos (iMac21,1 - Tahoe 26.3.1 - arm64)
Device: iPod touch 4 (iPod4,1 - n81ap) in Recovery mode
Manufactured in 2nd half 2012
iOS Version: :: BUILD_TAG: iBoot-1537.9.55
ECID: 4167192372239
Only select unmodified IPSW for the selection. Do not select custom IPSWs
Selected Target IPSW: /Users/apple/Desktop/iPod4,1_6.1.5_10B400_Restore.ipsw
Target Version: 6.1.5-10B400
Selected Target IPSW is validated
Selected Base IPSW (iOS 6.1.6): /Users/apple/Desktop/iPod4,1_6.1.6_10B500_Restore.ipsw
Base Version: 6.1.6-10B500
Selected Base IPSW is validated
You may enter custom bootargs (optional, experimental option)
Default Bootargs: pio-error=0 debug=0x2014e serial=3
You can select your own custom Apple logo image. This is optional and an experimental option
Note: The images must be in PNG format, and up to your device resolution
Note 2: The custom images might not work, current support is spotty
No custom Apple logo selected
[Input] Jailbreak Option
[Input] Enable this option? (Y/n):
-> Yes
No
[Log] Jailbreak option enabled.
[Input] Memory Option for creating custom IPSW
[Input] Enable this option? (Y/n):
-> Yes
No
[Log] Memory option enabled.
[Input] Verbose Boot Option
[Input] Enable this option? (Y/n):
-> Yes
No
[Log] Verbose boot option enabled.
[Log] Found existing saved 6.1.6 blobs: ../saved/shsh/4167192372239_iPod4,1_n81ap_6.1.6-10B500_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2
DFU Mode Helper - Get ready to enter DFU mode.
If you already know how to enter DFU mode, you may do so right now before continuing.
[Input] Select Y to continue, N to exit recovery mode (Y/n):
-> Yes
No
Get ready...
3 2 1
Hold TOP and HOME buttons.
8 7 6 5 4 3 2 1
Release TOP button and keep holding HOME button.
8 7 6 5 4 3 2 1
[Log] Finding device in DFU mode...
[Log] Found device in DFU mode.
[Log] Placing device to pwnDFU mode using ipwnder_lite
If pwning fails and gets stuck, you can press Ctrl+C to cancel, then re-enter DFU and retry.
[main] enabled: verbose log
[main] Waiting for device in DFU mode...
[io_get_serial] Found serial number!
[main] CONNECTED
[main] CPID: 0x8930, BDID: 0x08, STRG: [iBoot-574.4]
** exploiting with limera1n
[limera1n] reconnecting
[io_reset] ResetDevice: 0
[io_reset] USBDeviceReEnumerate: 0
[limera1n] sending exploit payload
[limera1n] 0, 1392
[limera1n] sending fake data
[limera1n] 0, 1
[limera1n] e0004051, 0
[limera1n] executing exploit
[limera1n] e0004051, 0
[limera1n] reconnecting
[io_reset] ResetDevice: 0
[io_reset] USBDeviceReEnumerate: 0
[limera1n] 0, 0
[limera1n] 0, 6
[limera1n] 0, 6
[limera1n] 0, 6
[limera1n] exploit sent
[limera1n] reconnecting
[io_reset] ResetDevice: 0
[io_reset] USBDeviceReEnumerate: 0
[io_get_serial] Found serial number!
[limera1n] pwned!
[Log] gaster reset
usb_timeout: 5
usb_abort_timeout_min: 0
[IOKit] Waiting for the USB handle with VID: 0x5AC, PID: 0x1227
Found the USB handle.
[Log] Checking for device
[Log] Found device in pwned DFU mode.
Pwned: limera1n
[Log] Found existing Custom IPSW. Skipping IPSW creation.
[Log] Device iPod4,1 has no baseband/disabled baseband update
[Log] Extracting IPSW: ../iPod4,1_6.1.5_10B400_CustomJP6V.ipsw
x 048-2914-001.dmg
x 048-2918-001.dmg
x 048-5280-001.dmg
x BuildManifest.plist
x Downgrade/
x Downgrade/RestoreDeviceTree
x Downgrade/RestoreLogo
x Firmware/
x Firmware/all_flash/
x Firmware/all_flash/all_flash.n81ap.production/
x Firmware/all_flash/all_flash.n81ap.production/DeviceTree.n81ap.img3
x Firmware/all_flash/all_flash.n81ap.production/LLB.n81ap.RELEASE.img3
x Firmware/all_flash/all_flash.n81ap.production/applelogo7@2x.s5l8930x.img3
x Firmware/all_flash/all_flash.n81ap.production/applelogo@2x.s5l8930x.img3
x Firmware/all_flash/all_flash.n81ap.production/batterycharging0@2x.s5l8930x.img3
x Firmware/all_flash/all_flash.n81ap.production/batterycharging1@2x.s5l8930x.img3
x Firmware/all_flash/all_flash.n81ap.production/batteryfull@2x.s5l8930x.img3
x Firmware/all_flash/all_flash.n81ap.production/batterylow0@2x.s5l8930x.img3
x Firmware/all_flash/all_flash.n81ap.production/batterylow1@2x.s5l8930x.img3
x Firmware/all_flash/all_flash.n81ap.production/glyphcharging@2x.s5l8930x.img3
x Firmware/all_flash/all_flash.n81ap.production/glyphplugin@2x.s5l8930x.img3
x Firmware/all_flash/all_flash.n81ap.production/iBoot.n81ap.RELEASE.img3
x Firmware/all_flash/all_flash.n81ap.production/iBoot2.n81ap.RELEASE.img3
x Firmware/all_flash/all_flash.n81ap.production/manifest
x Firmware/all_flash/all_flash.n81ap.production/recoverymode7@2x
iphone.s5l8930x.img3iphone.s5l8930x.img3x Firmware/all_flash/all_flash.n81ap.production/recoverymode@2x
x Firmware/dfu/
x Firmware/dfu/iBEC.n81ap.RELEASE.dfu
x Firmware/dfu/iBSS.n81ap.RELEASE.dfu
x Firmware/usr/
x Firmware/usr/local/
x Firmware/usr/local/standalone/
x Restore.plist
x kernelcache.release.n81
[Log] Running idevicerestore with command: ../bin/macos/arm64/idevicerestore -ew "../iPod4,1_6.1.5_10B400_CustomJP6V.ipsw"
Found device in DFU mode
Found ECID 4167192372239
Identified device as n81ap, iPod4,1
Extracting BuildManifest from IPSW
Product Version: 6.1.5
Product Build: 10B400 Major: 10
Device supports Image4: false
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Getting ApNonce in dfu mode...
checking for local shsh
Using cached SHSH
Using cached filesystem from '../iPod4,1_6.1.5_10B400_CustomJP6V/048-2914-001.dmg'
Extracting iBSS.n81ap.RELEASE.dfu...
Personalizing IMG3 component iBSS...
reconstructed size: 67853
Sending iBSS (67853 bytes)...
[==================================================] 100.0%
Nonce: 36 ee 84 89 4e 2f dd 22 bf ef 18 ea 5b 35 1b 93 11 8a 23 34
checking for local shsh
Using cached SHSH
Extracting iBEC.n81ap.RELEASE.dfu...
Personalizing IMG3 component iBEC...
reconstructed size: 272653
Sending iBEC (272653 bytes)...
[==================================================] 100.0%
INFO: device serial number is CCQJ54YMDNQW
Getting ApNonce in recovery mode... 36 ee 84 89 4e 2f dd 22 bf ef 18 ea 5b 35 1b 93 11 8a 23 34
Sending APTicket (2764 bytes)
Recovery Mode Environment:
iBoot build-version=iBoot-1537.9.55
iBoot build-style=RELEASE
ramdisk-size=RELEASE
Extracting 048-5280-001.dmg...
Personalizing IMG3 component RestoreRamDisk...
reconstructed size: 14624937
Sending RestoreRamDisk (14624937 bytes)...
Extracting RestoreDeviceTree...
Not personalizing component RestoreDeviceTree...
Sending RestoreDeviceTree (64872 bytes)...
Extracting kernelcache.release.n81...
Personalizing IMG3 component RestoreKernelCache...
reconstructed size: 7271369
Sending RestoreKernelCache (7271369 bytes)...
About to restore device...
Waiting for device...
Device 75e876e63feb08c99cae0bbd07099a05bdea242a is now connected in restore mode...
Connecting now...
Connected to com.apple.mobile.restored, version 12
Device 75e876e63feb08c99cae0bbd07099a05bdea242a has successfully entered restore mode
Hardware Information:
BoardID: 8
ChipID: 35120
UniqueChipID: 4167192372239
ProductionMode: true
Waiting for NAND (28)
Creating partition map (11)
Creating filesystem (12)
Creating filesystem (12)
Checking filesystems (15)
Mounting filesystems (16)
Checking filesystems (15)
Mounting filesystems (16)
Unmounting filesystems (29)
Unmounting filesystems (29)
About to send RootTicket...
Sending RootTicket now...
Done sending RootTicket
About to send filesystem...
Connected to ASR
Validating the filesystem
Filesystem validated
Sending filesystem now...
[==================================================] 100.0%
Done sending filesystem
Verifying restore (14)
[==================================================] 100.0%
Checking filesystems (15)
Mounting filesystems (16)
Checking filesystems (15)
Mounting filesystems (16)
About to send KernelCache...
Extracting kernelcache.release.n81...
Personalizing IMG3 component KernelCache...
reconstructed size: 7271369
Sending KernelCache now...
Done sending KernelCache
Installing kernelcache (27)
Fixing up /var (17)
Modifying persistent boot-args (25)
About to send NORData...
Found firmware path Firmware/all_flash/all_flash.n81ap.production
Getting firmware manifest from Firmware/all_flash/all_flash.n81ap.production/manifest
Extracting LLB.n81ap.RELEASE.img3...
Personalizing IMG3 component LLB...
reconstructed size: 133593
Extracting iBoot.n81ap.RELEASE.img3...
Not personalizing component iBoot...
Extracting DeviceTree.n81ap.img3...
Not personalizing component DeviceTree...
Extracting applelogo@2x.s5l8930x.img3...
Not personalizing component AppleLogo...
Extracting batterylow0@2x.s5l8930x.img3...
Not personalizing component BatteryLow0...
Extracting batterylow1@2x.s5l8930x.img3...
Not personalizing component BatteryLow1...
Extracting glyphcharging@2x.s5l8930x.img3...
Not personalizing component BatteryCharging...
Extracting batterycharging0@2x.s5l8930x.img3...
Not personalizing component BatteryCharging...
Extracting batterycharging1@2x.s5l8930x.img3...
Not personalizing component BatteryCharging...
Extracting glyphplugin@2x.s5l8930x.img3...
Not personalizing component BatteryPlugin...
Extracting batteryfull@2x.s5l8930x.img3...
Not personalizing component BatteryFull...
Extracting recoverymode@2x
iphone.s5l8930x.img3...iphone.s5l8930x.img3...Not personalizing component RecoveryMode...
Extracting recoverymode7@2x
Not personalizing component RecoveryMode...
Extracting iBoot2.n81ap.RELEASE.img3...
Not personalizing component iBoot...
Sending NORData now...
Done sending NORData
Flashing firmware (18)
[==================================================] 100.0%
Updating gas gauge software (46)
Updating gas gauge software (46)
Creating system key bag (49)
Resizing system partition (51)
Unmounting filesystems (29)
Unmounting filesystems (29)
Got status message
Status: Restore Finished
Cleaning up...
DONE
[Log] Restoring done! Read the message below if any error has occurred:
For device activation, go to: Main Menu -> Attempt Activation
Make sure that you are using a USB dock or hub to connect your device. Do not use USB dongles.
Please read the "Troubleshooting" wiki page in GitHub before opening any issue!
Your problem may have already been addressed within the wiki page.
If opening an issue in GitHub, please provide a FULL log/output. Otherwise, your issue may be dismissed.
Save the terminal output now if needed. (macOS: Cmd+S, Linux: Ctrl+Shift+S)
Legacy iOS Kit v26.07.17 (c237736)
Platform: macos (iMac21,1 - Tahoe 26.3.1 - arm64)
Beta Was this translation helpful? Give feedback.
All reactions