Skip to content
Switch branches/tags


Failed to load latest commit information.
Latest commit message
Commit time


tsschecker is a powerful tool to check TSS signing status of various devices and iOS/iPadOS/tvOS/watchOS versions.


  • Allows you to get lists of all devices as well as all Firmwares and OTA versions for a specific device.
  • Can check signing status for any firmware version (by specifying a BuildManifest.plist).
  • Works without specifying any device relevant values to check signing status, but can be used to save blobs when given an ECID and the option --print-tss-response (although there are better tools to do this).

tsschecker is not only meant to be used to check firmware signing status, but also to explore Apple's TSS servers. By using all of its customization possibilities, you might discover a combination of devices and iOS versions that is now getting signed but wasn't getting signed before.

About nonces:

recommended generators for saving tickets:

  • 0xbd34a880be0b53f3 // used on Electra & Chimera jailbreaks
  • 0x1111111111111111 // used on unc0ver jailbreak

Nonce Entangling (Apple A12 and newer)

Newer devices, like the iPhone XR or the Apple Watch Series 4 have nonce-entangling enabled.

this means the nonces generated by your device is now also UID derived, and consequently device-specific.
to save usable tickets for a newer device, you need to get the nonce that your device actually generates from your generator.

for information on how to get your actual boot nonce, see this post on r/jailbreak.

Nonce Collisions:

the Nonce Collision method only works on a few firmwares and devices, and isn't reliable.
it's better to save a ticket with a generator and use the checkm8 bootrom exploit.

Recovery Nonce Collisions only occur on a few iOS versions, like iOS 9.3.3 and iOS 10.1-10.2 on the iPhone 5s
and is not reliable as once you update, nonces will either generate differently or not collide anymore.

DFU Nonce Collisions commonly occur on any device using A7 and A8 chipsets, regardless of iOS version.
and is much more reliable than using recovery collisions.


  • Bundled libs

Those don't need to be installed manually


Usage: tsschecker [OPTIONS]

Example: tsschecker -d iPhone10,1 -B D20AP -e <ecid> -i 13.4.1 --generator 0x1111111111111111 -s

option (short) option (long) description
-h --help prints usage information
-d --device MODEL specify device by its model (eg. iPhone4,1)
-i --ios VERSION specify firmware version (eg. 6.1.3)
-Z --buildid BUILD specific buildid instead of firmware version (eg. 13C75)
-B --boardconfig BOARD specific boardconfig instead of device model (eg. n61ap)
-o --ota check OTA signing status, instead of normal restore
-b --no-baseband don't check baseband signing status. Request a ticket without baseband
-m --build-manifest manually specify buildmanifest (can be used with -d)
-s --save save fetched shsh blobs (mostly makes sense with -e)
-u --update-install request update ticket instead of erase
-l --latest use latest public firmware version instead of manually specifying one
especially useful with -s and -e for saving signing tickets
-e --ecid ECID manually specify an ECID to be used for fetching blobs, instead of using random ones.
ECID must be either DEC or HEX eg. 5482657301265 or ab46efcbf71
-g --generator GEN manually specify generator in format 0x%%16llx
--apnonce NONCE manually specify ApNonce instead of using random one (not required for saving signing tickets)
--sepnonce NONCE manually specify SepNonce instead of using random one (not required for saving signing tickets)
--bbsnum SNUM manually specify BbSNUM in HEX for saving valid BBTicket (not required for saving blobs)
--save-path PATH specify path for saving blobs
--beta request ticket for beta instead of normal release (use with -o)
--list-devices list all known devices
--list-ios list all known firmware versions
--nocache ignore caches and re-download required files
--print-tss-request prints TSS request that will be sent to Apple
--print-tss-response prints TSS response that come from Apple
--raw send raw file to Apple's TSS server (useful for debugging)