iOS upgrade and downgrade tool utilizing SHSH blobs
Clone or download
Pull request Compare This branch is 25 commits ahead of encounter:master.
Latest commit 0366135 Jan 13, 2019

ReadMe.md

futurerestore

futurerestore is a hacked up idevicerestore wrapper, which allows manually specifying SEP and Baseband for restoring

Only use if you are sure what you're doing.

Latest release available here for Windows, macOS & Linux.

Features

  • Supports the following downgrade methods
    • Prometheus 64-bit devices (generator and APNonce collision mode);
    • Odysseus for 32-bit devices;
    • Re-restoring 32-bit devices to iOS 9 with @alitek123's no-nonce method (alternative — idevicererestore).
  • Allows restoring any non-matching signed iOS/SEP/Baseband.

NOT recommended 'u' parameter, if you update from jailbroken firmware!

Dependencies

Report an issue

You can do it here.

Compiling

Simple use bash autogen.sh && make or use Xcode project.

Some about curl for ubuntu

Follow this guide to use tsschecker on Ubuntu 18.04 (Bionic) as it requires libcurl3 which cannot co-exist with libcurl4 on this OS.


0) What futurerestore can do

Downgrade/Upgrade/Re-restore same iOS. Whenever you read "downgrade" nowadays it means you can also upgrade and re-restore if you're on the same iOS. Basically this allows restoring an iOS and the installed iOS doesn't matter.


1) Prometheus (64-bit device) - generator method

Requirements

  • Jailbreak
  • SHSH2 files with a generator
  • nonceEnabler patch enabled

Info

You can downgrade if the destination iOS is compatible with the latest signed SEP and if you have shsh2 files with a generator for that iOS.

How to use

  1. Device must be jailbroken and nonceEnabler patch must be active
  2. Open shsh file and look up the generator
  • Looks like this: <key>generator</key><string>0xde3318d224cf14a1</string>
  1. Write the generator to device's nvram
  • SSH into the device and run nvram com.apple.System.boot-nonce=0xde3318d224cf14a1 to set the generator 0xde3318d224cf14a1
  • verify with nvram -p
  1. Connect your device in normal mode to computer
  2. On the computer run futurerestore -t ticket.shsh --latest-baseband --latest-sep ios.ipsw

Youtube

Prometheus Prometheus

Recommended method to active nonceEnabler patch

Method 1: ios-kern-utils (iOS 7.x-10.x)

  1. Install DEB-file of ios-kern-utils on device
  2. Run on the device nvpatch com.apple.System.boot-nonce

Method 2: Using special applications

Use utilities for setting boot-nonce — PhœnixNonce for iOS 9.x, v0rtexnonce for iOS 10.x, nonceset1112 for iOS 11.0-11.1.2 and noncereboot1131UI for iOS 11.0-11.4b3.

Method 3: noncereboot11 for iOS 11.x.

This CLI tool available at pwn20wnd's Cydia repo. Install it and set boot-nonce with help on the binary.

Activate tfp0 if jailbreak doesn't allow it

Method 1 (if jailbroken on 9.3.x)

Method 2 (if jailbroken on iOS 8.0-8.1 with Pangu8)

Method 3 (if jailbroken on iOS 7.x with Pangu7)

Method 4


2) Prometheus (64-bit device) - ApNonce collision method (Recovery)

Requirements

  • iPhone 5s, iPad Air, iPad mini 2 on iOS 9.1 - 10.2
  • No Jailbreak required
  • SHSH files with customly chosen ApNonce
  • The shsh file needs to have one of the ApNonces, which the device generates a lot
  • collisioned ApNonces available in file 'nonces.txt'

Info

You can downgrade if the destination iOS is compatible with the latest signed SEP. You also need to have special shsh files. If you don't know what this is, you probably can NOT use this method!

How to use

  1. Connect your device in normal mode or recovery mode
  2. On the computer run futurerestore -w -t ticket.shsh --latest-baseband --latest-sep ios.ipsw
  • If you have saved multiple tickets with different nonces you can specify more than one to speed up the process: futurerestore -w -t t1.shsh -t t2.shsh -t t3.shsh -t t4.shsh --latest-baseband --latest-sep ios.ipsw

3) Prometheus (64-bit device) - ApNonce collision method (DFU)

Requirements

  • Devices for A7 chip (iPhone 5s, iPad Air, iPad mini 2) and some devices with A8 chip (iPod touch [6th gen]) on all iOS firmwares
  • No Jailbreak required
  • SHSH files with customly chosen ApNonce
  • The shsh file needs to have one of the ApNonces, which the device generates a lot
  • img4tool can't be used for Windows [problem with signing iBSS/iBEC], now it's TO-DO
  • collisioned ApNonces available in file 'nonces.txt' in TSSChecker.

Info

You can downgrade if the destination iOS is compatible with the latest signed SEP. You also need to have special shsh files. If you don't know what this is, you probably can NOT use this method!

How to use

  1. Connect your device in DFU mode

  2. Use irecovery for check nonce booted with DFU

  3. Extract iBSS/iBEC from target firmware for downgrade (unsigned)

  4. Check DFU ApNonces with irecovery with DFU booting. You can't automatically collision DFU ApNonces.

    If ApNonce is not collisioned, "use hands" for DFU booting.

    If ApNonce is successfully coliisioned, use this SHSH2 for sign iBSS/iBEC.

  5. Use img4tool for sign iBSS: img4tool -s ticket.shsh -c iBSS.signed -p <original_iBSS>

  6. Use img4tool for sign iBEC: img4tool -s ticket.shsh -c iBEC.signed -p <original_iBEC>

  7. So, after signing we can boot into Recovery with irecovery:

    irecovery -f iBSS.signed - loading iBSS

    irecovery -f iBEC.signed - loading iBEC

  8. So good! On the computer run futurerestore -w -t ticket.shsh --latest-baseband --latest-sep ios.ipsw


4) Odysseus (32-bit devices)

Requirements

  • futurerestore compiled with libipatcher (Odysseus support)
  • Jailbreak or bootrom exploit (limera1n)
  • Firmware keys for the device/destination iOS must be public
  • SHSH files for the destination iOS (OTA blobs work too!)

Info

If you have a jailbroken 32-bit device you can downgrade to any iOS you have blobs for. You can still get OTA blobs for iOS 6.1.3 and 8.4.1 for some devices and use those.

How to use

  1. Get device into kDFU/pwnDFU
  • Pre-iPhone 4s (limera1n devices):
    • Enter pwndfu mode with redsn0w or any other tool
  • iPhone 4s and later:
    • Jailbreak required!
    • Enter kDFU mode by loading a pwnediBSS from any existing odysseus bundle.
  1. Connect your device to computer in kDFU mode (or pwnDFU mode)
  2. On the computer run futurerestore --use-pwndfu -t ticket.shsh --latest-baseband ios.ipsw

Youtube

Odysseus Futurerestore + Libipatcher

You can use any successfully created odysseus bundle for this

5) iOS 9 Re-restore bug (found by @alitek123, 32-bit devices only):

Requirements

  • No Jailbreak required
  • SHSH files without a ApNonce (noNonce APTickets)

Info

If you have shsh files for iOS9 which do not contain an APNonce, you can restore to that firmware.

How to use

  1. Connect your device in DFU mode
  2. On the computer run futurerestore -t ticket.shsh --latest-baseband ios9.ipsw

Credits

Creator of original project - tihmstar.

ReadMe updated on: 2019-01-06