The iPhone Wiki - User contributions [en]

YukonPre 17A577 (iPhone9,4)

2020-08-07T18:00:20Z

JonathanSeals: add sepfw key

{{keys
| Version = 13.0 [[Golden Master|GM]] and 13.0
| Build = 17A577
| Device = iPhone9,4
| Codename = YukonPre
| Baseband = 4.00.00
| DownloadURL = https://updates.cdn-apple.com/2019FallFCS/fullrestores/061-08528/B905EA00-C875-11E9-9950-A2C527C5EC74/iPhone_5.5_P3_13.0_17A577_Restore.ipsw

| RootFS = 048-96415-001
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-96454-001
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-96245-001
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d111ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D111.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = b66f186432e5ae904b386b41e092b18e
| iBECKey = 675bef71e602683c6e837caf49d575d3611f64e50be8311c0b74d3ce3f271fc0

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = 925dd56fc387cb1d92f329dc679879c4
| iBootKey = 1273d0cb211d7c8584018c253cdd89ac2fca0e4833e25d54cf17858171709e68

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = b7fd3aa19752a7e03c2ec57a516cbaf5
| iBSSKey = 411aa76e6a87aabf3b604752611ea6aa82361eae2de782edfbeb3ba28f97372f

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = bb46ec4cda3da3ab486345ce7dccf604
| LLBKey = 5f4036944744ad8c3a10eddd149a2f34e3c7a1e15ff09cad5bd7c450886e4ec4

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d111.RELEASE.im4p
| SEPFirmwareIV = a55ab323c08c8bc0feee11572bbf5c57
| SEPFirmwareKey = 95389e08beb01cb2c7af7887470063463ac214aaba1b6f9a41de25c8b95ad3f3
}}

YukonPre 17A577 (iPhone9,2)

2020-08-07T17:56:30Z

JonathanSeals: add sepfw key

{{keys
| Version = 13.0 [[Golden Master|GM]] and 13.0
| Build = 17A577
| Device = iPhone9,2
| Codename = YukonPre
| Baseband = 7.00.01
| DownloadURL = https://updates.cdn-apple.com/2019FallFCS/fullrestores/061-08528/B905EA00-C875-11E9-9950-A2C527C5EC74/iPhone_5.5_P3_13.0_17A577_Restore.ipsw

| RootFS = 048-96415-001.dmg
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-96454-001.dmg
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-96245-001.dmg
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d11ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D11.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = b66f186432e5ae904b386b41e092b18e
| iBECKey = 675bef71e602683c6e837caf49d575d3611f64e50be8311c0b74d3ce3f271fc0

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = 925dd56fc387cb1d92f329dc679879c4
| iBootKey = 1273d0cb211d7c8584018c253cdd89ac2fca0e4833e25d54cf17858171709e68

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = b7fd3aa19752a7e03c2ec57a516cbaf5
| iBSSKey = 411aa76e6a87aabf3b604752611ea6aa82361eae2de782edfbeb3ba28f97372f

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = bb46ec4cda3da3ab486345ce7dccf604
| LLBKey = 5f4036944744ad8c3a10eddd149a2f34e3c7a1e15ff09cad5bd7c450886e4ec4

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d11.RELEASE.im4p
| SEPFirmwareIV = 2f8d20e0b51a1ca695ded6cbdfd09c38
| SEPFirmwareKey = 29db5c667355cdeafb02fcbab8f494d6bf2e55988c85bec0b27c3dad3c5d5763
}}

PeaceG 16G102 (iPhone9,4)

2020-08-07T17:48:26Z

JonathanSeals: add sepfw key

{{keys
| Version = 12.4.1
| Build = 16G102
| Device = iPhone9,4
| Codename = PeaceG
| Baseband = 3.03.04
| DownloadURL = https://updates.cdn-apple.com/2019SummerFCS/fullrestores/061-04923/A4159C76-C4E7-11E9-9B0E-FB600AD8B7A1/iPhone_5.5_P3_12.4.1_16G102_Restore.ipsw

| RootFS = 048-76533-095
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-76167-096
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-78047-096
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d111ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D111.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = 54fd22988e845956adcfda0a50ee3fc4
| iBECKey = 92a370e8be5abe71dc1fa73085841c0c2f75eb46ff192b369a83e98816463547

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = edf85b11e97b1be37d9910cb2e93d42b
| iBootKey = 76073371637e6c2a49fb907d80f9cdde932cfac50e09ea0963ecaa47b787feda

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = c007b2216021dab631609600950a4e58
| iBSSKey = 70f93d3029140e59ee592d0950bef721323b550b864f4fab0662643f46c622f0

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = ded97f33b5836d134f9585133dbea850
| LLBKey = 398452108389d16d5e9b64a83dfe4d2449ed0278bd063c9aef1a7b6c7f0374ab

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d111.RELEASE.im4p
| SEPFirmwareIV = edd74c98647c3921430de06bbf608a28
| SEPFirmwareKey = 01efa20fd019d1b8841216d04fc6d2d3bbfbef2bffc9a7e4467489c6e8c9bb72
}}

PeaceG 16G102 (iPhone9,2)

2020-08-07T17:47:23Z

JonathanSeals: add sepfw key

{{keys
| Version = 12.4.1
| Build = 16G102
| Device = iPhone9,2
| Codename = PeaceG
| Baseband = 5.70.01
| DownloadURL = https://updates.cdn-apple.com/2019SummerFCS/fullrestores/061-04923/A4159C76-C4E7-11E9-9B0E-FB600AD8B7A1/iPhone_5.5_P3_12.4.1_16G102_Restore.ipsw

| RootFS = 048-76533-095
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-76167-096
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-78047-096
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d11ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D11.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = 54fd22988e845956adcfda0a50ee3fc4
| iBECKey = 92a370e8be5abe71dc1fa73085841c0c2f75eb46ff192b369a83e98816463547

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = edf85b11e97b1be37d9910cb2e93d42b
| iBootKey = 76073371637e6c2a49fb907d80f9cdde932cfac50e09ea0963ecaa47b787feda

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = c007b2216021dab631609600950a4e58
| iBSSKey = 70f93d3029140e59ee592d0950bef721323b550b864f4fab0662643f46c622f0

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = ded97f33b5836d134f9585133dbea850
| LLBKey = 398452108389d16d5e9b64a83dfe4d2449ed0278bd063c9aef1a7b6c7f0374ab

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d11.RELEASE.im4p
| SEPFirmwareIV = c27da0598ce80dd61bfd352c53c2c285
| SEPFirmwareKey = 0c4eab8f0fc33c4e8aa32d2e1f4f8f95204ab3038554ec200022ccc837ef4a97
}}

Peace 16A366 (iPhone9,4)

2020-08-07T17:45:28Z

JonathanSeals: add sepfw key

{{keys
| Version = 12.0 [[Golden Master|GM]] and 12.0
| Build = 16A366
| Device = iPhone9,4
| Codename = Peace
| Baseband = 3.00.01
| DownloadURL = https://updates.cdn-apple.com/2018FallFCS/fullrestores/091-62838/11998604-AC8E-11E8-907D-813265B0C5AC/iPhone_5.5_P3_12.0_16A366_Restore.ipsw

| RootFS = 048-08759-231
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-08422-242
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-08497-242
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d111ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D111.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = 20936cbb4e8044ca1c421f37f362d509
| iBECKey = a2a594a69004693280d7e06b6d527c7eb762d852c5ee447de2efb769db6b330a

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = 2ace7f09de69cbd187337dfeb52ff7f1
| iBootKey = 6c491677015daec1f2ac7525e5e6c079510a0a4ce29430c1d48a385b7690b09e

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = 31e8cd1ca28c71438001462334381806
| iBSSKey = 6af297280aa0f6d7fee73e4b84036da89bde90d463b28a49b19d8ce260f01424

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = 3c45b02cc7162c5f2438dec3c11c5896
| LLBKey = 0ab1aa963d0e2213773a1d1426d2684c8d38a4994eb3fbd565bf049bd90736ad

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d111.RELEASE.im4p
| SEPFirmwareIV = a9c37fe6c2d98258fb57c5cfb4b37196
| SEPFirmwareKey = a4396d97e7fa6fac09012bae44c950125c2e7e7dc0441cba0aa5376934577de4
}}

Peace 16A366 (iPhone9,2)

2020-08-07T17:44:32Z

JonathanSeals: add sepfw key

{{keys
| Version = 12.0 [[Golden Master|GM]] and 12.0
| Build = 16A366
| Device = iPhone9,2
| Codename = Peace
| Baseband = 5.00.00
| DownloadURL = https://updates.cdn-apple.com/2018FallFCS/fullrestores/091-62838/11998604-AC8E-11E8-907D-813265B0C5AC/iPhone_5.5_P3_12.0_16A366_Restore.ipsw

| RootFS = 048-08759-231
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-08422-242
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-08497-242
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d11ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D11.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = 20936cbb4e8044ca1c421f37f362d509
| iBECKey = a2a594a69004693280d7e06b6d527c7eb762d852c5ee447de2efb769db6b330a

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = 2ace7f09de69cbd187337dfeb52ff7f1
| iBootKey = 6c491677015daec1f2ac7525e5e6c079510a0a4ce29430c1d48a385b7690b09e

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = 31e8cd1ca28c71438001462334381806
| iBSSKey = 6af297280aa0f6d7fee73e4b84036da89bde90d463b28a49b19d8ce260f01424

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = 3c45b02cc7162c5f2438dec3c11c5896
| LLBKey = 0ab1aa963d0e2213773a1d1426d2684c8d38a4994eb3fbd565bf049bd90736ad

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d11.RELEASE.im4p
| SEPFirmwareIV = ee1fa7d205c7585328c969c4387ea165
| SEPFirmwareKey = 7721ef000f09ffc46d3862f0af695dfff9e6d60298050849f30de3bd841dfdb7
}}

Gebze 15G77 (iPhone9,4)

2020-08-07T17:40:01Z

JonathanSeals: add sepfw key

{{keys
| Version = 11.4.1
| Build = 15G77
| Device = iPhone9,4
| Codename = Gebze
| Baseband = 2.03.12
| DownloadURL = https://updates.cdn-apple.com/2018/ios/091-75022-20180709-813A3154-7C1C-11E8-A28C-AE5B544C24EB/iPhone_5.5_P3_11.0_11.4.1_15G77_Restore.ipsw

| RootFS = 048-19851-075
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-19829-076
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-20313-076
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d111ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D111.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = 2ba69143d46e2c7cc57f7df231e5e692
| iBECKey = c19582d1fc66d006a3bc54ee631eac5de7452d13d5d8b85d1956e4ab25109fcf

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = 892805c5607c0736ca43a167b8f83aff
| iBootKey = 4f6ef51733018217e05d0d13fb0b9e271b45467424a53d9cb56ee2f055722f93

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = cc80b34046aabece358d0232f1b8bbb2
| iBSSKey = c05686efd14214a3c9cfb362ee251ea709013e8e53efa2d28d24995a33ef5e89

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = e15cb380d9d1d7b7a73072e8303fa984
| LLBKey = 1fb310f343f672a390ab08d653e55d33177159e4b458c8120a729b63b8d5896d

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d111.RELEASE.im4p
| SEPFirmwareIV = 9fef42da38890fad343f49b2f36ed676
| SEPFirmwareKey = 4a79f6237b6bdf7ece194fe27ba14f296173c359644519bd6c15879b2b7cf778
}}

Gebze 15G77 (iPhone9,2)

2020-08-07T17:38:43Z

JonathanSeals: add sepfw key

{{keys
| Version = 11.4.1
| Build = 15G77
| Device = iPhone9,2
| Codename = Gebze
| Baseband = 3.70.00
| DownloadURL = https://updates.cdn-apple.com/2018/ios/091-75022-20180709-813A3154-7C1C-11E8-A28C-AE5B544C24EB/iPhone_5.5_P3_11.0_11.4.1_15G77_Restore.ipsw

| RootFS = 048-19851-075
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-19829-076
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-20313-076
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d11ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D11.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = 2ba69143d46e2c7cc57f7df231e5e692
| iBECKey = c19582d1fc66d006a3bc54ee631eac5de7452d13d5d8b85d1956e4ab25109fcf

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = 892805c5607c0736ca43a167b8f83aff
| iBootKey = 4f6ef51733018217e05d0d13fb0b9e271b45467424a53d9cb56ee2f055722f93

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = cc80b34046aabece358d0232f1b8bbb2
| iBSSKey = c05686efd14214a3c9cfb362ee251ea709013e8e53efa2d28d24995a33ef5e89

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = e15cb380d9d1d7b7a73072e8303fa984
| LLBKey = 1fb310f343f672a390ab08d653e55d33177159e4b458c8120a729b63b8d5896d

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d11.RELEASE.im4p
| SEPFirmwareIV = 9471443096896d6c39944615b7507118
| SEPFirmwareKey = f4b1dcdeb0480c57a9231278355302fdece9ea8a929378f91d06f3398e43fdce
}}

Tigris 15A372 (iPhone9,4)

2020-08-07T17:36:37Z

JonathanSeals: add sepfw key

{{keys
| Version = 11.0 [[Golden Master|GM]] and 11.0
| Build = 15A372
| Device = iPhone9,4
| Codename = Tigris
| Baseband = 2.00.01
| DownloadURL = http://appldnld.apple.com/ios11.0/091-31712-201700919-35AFA8AE-9027-11E7-9A28-2D35B64D2808/iPhone_7Plus_11.0_15A372_Restore.ipsw

| RootFS = 058-59994-349
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-59988-347
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-59982-349
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d111ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D111.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = 2275bc9756f80cd612488a686db0fd57
| iBECKey = fc5dbd2869800f7df7e3992f59c2f7d859dbf1ce701e3da3efe1e961a79854e0

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = 37c24731f2623fcb0c5a89f0fb70ef64
| iBootKey = 32f6e9e5afc7cc9b5368b48b719ef71a714f6258e16ab7b6bd1ab798a327b96b

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = aae0e6c3b9ec41dba987e763b30b883f
| iBSSKey = a13fae5e50e441ae7c2969a91e1fe56db67148711d3a597cfde72b58939bf623

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = 98a5bbfc52af9bbddfe4237586961d48
| LLBKey = 4c412c8570067d93486fd7199b8922372aee738621ba17de60d1ccacc01a3130

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d111.RELEASE.im4p
| SEPFirmwareIV = bfb5896f22e656657628e3049a873624
| SEPFirmwareKey = d176861619b3d12c60790d622eb229c173e21e4b4fc904f799d2d3eb00409eb0
}}

Tigris 15A372 (iPhone9,2)

2020-08-07T17:35:33Z

JonathanSeals: add sepfw key

{{keys
| Version = 11.0 [[Golden Master|GM]] and 11.0
| Build = 15A372
| Device = iPhone9,2
| Codename = Tigris
| Baseband = 3.00.00
| DownloadURL = http://appldnld.apple.com/ios11.0/091-31712-201700919-35AFA8AE-9027-11E7-9A28-2D35B64D2808/iPhone_7Plus_11.0_15A372_Restore.ipsw

| RootFS = 058-59994-349
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-59988-347
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-59982-349
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d11ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D11.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = 2275bc9756f80cd612488a686db0fd57
| iBECKey = fc5dbd2869800f7df7e3992f59c2f7d859dbf1ce701e3da3efe1e961a79854e0

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = 37c24731f2623fcb0c5a89f0fb70ef64
| iBootKey = 32f6e9e5afc7cc9b5368b48b719ef71a714f6258e16ab7b6bd1ab798a327b96b

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = aae0e6c3b9ec41dba987e763b30b883f
| iBSSKey = a13fae5e50e441ae7c2969a91e1fe56db67148711d3a597cfde72b58939bf623

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = 98a5bbfc52af9bbddfe4237586961d48
| LLBKey = 4c412c8570067d93486fd7199b8922372aee738621ba17de60d1ccacc01a3130

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d11.RELEASE.im4p
| SEPFirmwareIV = 960e384bf2269475a8f0f24564ab3ba4
| SEPFirmwareKey = c9803fe73272ed9586c82828921841df2294a13f9a3adde2fd4cd754d20179f0
}}

Greensburg 14G60 (iPhone9,4)

2020-08-07T17:31:46Z

JonathanSeals: add sepfw key

{{keys
| Version = 10.3.3
| Build = 14G60
| Device = iPhone9,4
| Codename = Greensburg
| Baseband = 1.03.60
| DownloadURL = http://appldnld.apple.com/ios10.3.3/091-23119-20170719-CA92905C-6977-11E7-AB61-299100BA0AE3/iPhone_7Plus_10.3.3_14G60_Restore.ipsw

| RootFS = 058-75528-062
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-75381-062
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-74940-063
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.t8010.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.t8010.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.t8010.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.t8010.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.t8010.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.t8010.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d111ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.t8010.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D111.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = a7892334ba4b47ab3ffff71f52d4e499
| iBECKey = c79ec2ab493464093fcda4da960c314637193a4b88d5858ed5207d2270e8a986

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = c43ae0d62c1f12b3616fd60acdd17d0c
| iBootKey = f38ef25bed92cf9d478e4b0a40cef71cca0035fc83e8c44f6052071d1de970b9

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = 33b8b3f94332558dca226dc78ad6f460
| iBSSKey = 22efa20ba94fb5a0cc8cc273c585bc011fad5781759026594507dac38059deab

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = 8f09b21e6a2c0cd0b7a6f26b229efaf2
| LLBKey = edf2939d8b503de2b30b8bb6ef199517fbb818b8c31638c2ebff81d8f5fe1294

| RecoveryMode = recoverymode@1920~iphone-lightning.t8010.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d111.RELEASE.im4p
| SEPFirmwareIV = 67715a5b90f8b82a53befbf6db8f14d1
| SEPFirmwareKey = 06dec028b9cf18b031ded54321cf6550a1fc751e25ba9c0c64bbab0dac1e54a7
}}

Greensburg 14G60 (iPhone9,2)

2020-08-07T17:30:48Z

JonathanSeals: add sepfw key

{{keys
| Version = 10.3.3
| Build = 14G60
| Device = iPhone9,2
| Codename = Greensburg
| Baseband = 1.91.00
| DownloadURL = http://appldnld.apple.com/ios10.3.3/091-23119-20170719-CA92905C-6977-11E7-AB61-299100BA0AE3/iPhone_7Plus_10.3.3_14G60_Restore.ipsw

| RootFS = 058-75528-062
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-75381-062
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-74940-063
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.t8010.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.t8010.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.t8010.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.t8010.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.t8010.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.t8010.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d11ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.t8010.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D11.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = a7892334ba4b47ab3ffff71f52d4e499
| iBECKey = c79ec2ab493464093fcda4da960c314637193a4b88d5858ed5207d2270e8a986

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = c43ae0d62c1f12b3616fd60acdd17d0c
| iBootKey = f38ef25bed92cf9d478e4b0a40cef71cca0035fc83e8c44f6052071d1de970b9

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = 33b8b3f94332558dca226dc78ad6f460
| iBSSKey = 22efa20ba94fb5a0cc8cc273c585bc011fad5781759026594507dac38059deab

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = 8f09b21e6a2c0cd0b7a6f26b229efaf2
| LLBKey = edf2939d8b503de2b30b8bb6ef199517fbb818b8c31638c2ebff81d8f5fe1294

| RecoveryMode = recoverymode@1920~iphone-lightning.t8010.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d11.RELEASE.im4p
| SEPFirmwareIV = 0728ec9142f96027552d1baf91c59063
| SEPFirmwareKey = dd1c7168edd4ebc4f64f26d4ffc3655a89265f675863dee41fa065fc8419e777
}}

Whitetail 14A403 (iPhone9,2)

2020-08-07T17:28:59Z

JonathanSeals: add sepfw key

{{keys
| Version = 10.0.1
| Build = 14A403
| Device = iPhone9,2
| Codename = Whitetail
| Baseband = 1.00.02
| DownloadURL = http://appldnld.apple.com/ios10.0/031-76519-20160907-1703BE42-71FE-11E6-AE6D-1AB934D2D062/iPhone9,2_10.0.1_14A403_Restore.ipsw

| RootFS = 058-52738-043
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-50460-069
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-50463-070
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.t8010.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.t8010.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.t8010.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.t8010.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.t8010.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.t8010.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d11ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.t8010.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D11.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = cbbdf03e31f6c389ddf5804e058e1627
| iBECKey = b175f054c6f299c6b4b8f2ffb21fa5bf5eb287731e45b4ada42c67aaab1cfb20

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = 2783b55434ee6209817b8f225c57c8a1
| iBootKey = e571056ff0f129802c85c373fe454cda28ccbb4ef6d58e1dfd1521e362e47b9b

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = 5e8d90d918e8f1c7a49ed7cd42185128
| iBSSKey = 1eda6e7078a6021fbb18503dc1248f20df33b2487b3ce58a98306cc9e430ae7a

| Kernelcache = kernelcache.release.d11
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = 12354ebd632041000f83355404df4fb3
| LLBKey = f1d59d0065826189a4e7794220549570891104f9254fb4b9246e7e16801c0f78

| RecoveryMode = recoverymode@1920~iphone-lightning.t8010.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d11.RELEASE.im4p
| SEPFirmwareIV = 766926ce937061f53efd80bc2b191300
| SEPFirmwareKey = 06eba266cf7949a83a8bea36a690b9766a0a8f9a6366ce820f0a6178763e664d
}}

Whitetail 14A403 (iPhone9,4)

2020-08-07T17:27:24Z

JonathanSeals: add sepfw key

{{keys
| Version = 10.0.1
| Build = 14A403
| Device = iPhone9,4
| Codename = Whitetail
| Baseband = 1.00.03
| DownloadURL = http://appldnld.apple.com/ios10.0/031-76519-20160907-1703BE42-71FE-11E6-AE6D-1AB934D2D062/iPhone9,2_10.0.1_14A403_Restore.ipsw

| RootFS = 058-52738-043
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-50460-069
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-50463-070
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.t8010.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.t8010.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.t8010.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.t8010.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.t8010.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.t8010.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d111ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.t8010.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D111.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d111.RELEASE.im4p
| iBECIV = ec8e19d9bee6d5b5d2ad83b949b4e829
| iBECKey = 1aa960eb8fa44e06d02ae6899f7b7edf88cfd0159e1136415c3aca7ae6244406

| iBoot = iBoot.d111.RELEASE.im4p
| iBootIV = 11753383d9d4b4fa7d880d0b1b9e5b88
| iBootKey = 0e4a65e7ebeb6858d67dd3f1e0a802a2ecc44b8044c40f0019f0fb6538c1198c

| iBSS = iBSS.d111.RELEASE.im4p
| iBSSIV = dc79c2e69abb1b58bee70e5a439f84dc
| iBSSKey = 7a1f425d94dfb4ded3ff81cd17260583199973f2219fb3ddef54aeacdc525a92

| Kernelcache = kernelcache.release.d111
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d111.RELEASE.im4p
| LLBIV = 9ba3d9419375b66fea7a22d141ca57fd
| LLBKey = 837f18a50ad29f5548dd90e8f99ae278b9d677c2ae08e88a4a6d5a50bbf10c1a

| RecoveryMode = recoverymode@1920~iphone-lightning.t8010.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d111.RELEASE.im4p
| SEPFirmwareIV = 5955f74cbe95d037e5cb9503b738d93f
| SEPFirmwareKey = 5b5cab13e6defca957e146c3c5ba99a65e30f82776e894a17f4348cccb2a2a83
}}

YukonG 17G68 (iPhone9,2)

2020-08-07T17:23:20Z

JonathanSeals: add sepfw key

{{keys
| Version = 13.6 [[Golden Master|GM]] and 13.6
| Build = 17G68
| Device = iPhone9,2
| Codename = YukonG
| Baseband = 7.70.01
| DownloadURL = https://updates.cdn-apple.com/2020SummerSeed/fullrestores/061-92804/59652012-B56D-4941-A196-CE9212669972/iPhone_5.5_P3_13.6_17G68_Restore.ipsw

| RootFS = 038-51241-078
| RootFSKey = Not Encrypted

| UpdateRamdisk = 038-52032-078
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 038-51098-078
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d11ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D11.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = d2c0fd264ec7b9a0876fccf68f657d0b
| iBECKey = 098b6bd8830e7110d0c9335d577167d3340b27239e0f2f62c6bf559ee4dc79f8

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = 9ce42cffd8c9811b8ea29a14ca8584db
| iBootKey = 93ba863dbfc582689280c55c67890a4c128ffb7f4fe136cdf6b1f2b2bb6ed547

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = e850a5ec23fb3e07493b43db3a450408
| iBSSKey = 5f1e2838049e599fe5e4c78fbd5c530dc226cfc3817596c54516344d604f92b2

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = 0bf28d525fa2f02f33728053af808d3f
| LLBKey = 36b343b658d5e7ab6f0e1c319d96248d3c0a2fe02ac1a8207dfae01ab177cfb6

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d11.RELEASE.im4p
| SEPFirmwareIV = 0faccedf1310d475cdb6d5eb524d9eca
| SEPFirmwareKey = 8487111fb4234be90fbd0bf46ee86945b4b3277715dd95bab718027815bd2de5
}}

YukonG 17G68 (iPhone9,4)

2020-08-07T17:19:38Z

JonathanSeals: add sepfw key

{{keys
| Version = 13.6 [[Golden Master|GM]] and 13.6
| Build = 17G68
| Device = iPhone9,4
| Codename = YukonG
| Baseband = 4.03.00
| DownloadURL = https://updates.cdn-apple.com/2020SummerSeed/fullrestores/061-92804/59652012-B56D-4941-A196-CE9212669972/iPhone_5.5_P3_13.6_17G68_Restore.ipsw

| RootFS = 038-51241-078
| RootFSKey = Not Encrypted

| UpdateRamdisk = 038-52032-078
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 038-51098-078
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d111ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D111.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = d2c0fd264ec7b9a0876fccf68f657d0b
| iBECKey = 098b6bd8830e7110d0c9335d577167d3340b27239e0f2f62c6bf559ee4dc79f8

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = 9ce42cffd8c9811b8ea29a14ca8584db
| iBootKey = 93ba863dbfc582689280c55c67890a4c128ffb7f4fe136cdf6b1f2b2bb6ed547

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = e850a5ec23fb3e07493b43db3a450408
| iBSSKey = 5f1e2838049e599fe5e4c78fbd5c530dc226cfc3817596c54516344d604f92b2

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = 0bf28d525fa2f02f33728053af808d3f
| LLBKey = 36b343b658d5e7ab6f0e1c319d96248d3c0a2fe02ac1a8207dfae01ab177cfb6

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d111.RELEASE.im4p
| SEPFirmwareIV = d5659e5fb0f6106f8017e90fd509a146
| SEPFirmwareKey = 814395ba1aec60d6796424d9c68cc7f361e952077cd9b9cea81622101c1ef87a
}}

PeaceSecYukonF 16G192 (iPhone6,1)

2020-07-01T03:39:53Z

JonathanSeals: corrected rootfs/ramdisk filenames

{{keys
| Version = 12.4.7
| Build = 16G192
| Device = iPhone6,1
| Codename = PeaceSecYukonF
| Baseband = 10.80.02
| DownloadURL = https://updates.cdn-apple.com/2020SpringFCS/fullrestores/061-94832/B6D93224-1059-4DF0-9438-78CD3BED57FE/iPhone_4.0_64bit_12.4.7_16G192_Restore.ipsw

| RootFS = 038-53232-004
| RootFSKey = Not Encrypted

| UpdateRamdisk = 038-53416-004
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 038-53453-004
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n51ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1136~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.iphone6.RELEASE.im4p
| iBECIV = 088afe27bfa9779872f8d330f3fbbb52
| iBECKey = 8ca68771fcdd3747735aad5d2b6db4dddc892f28a6b0d520e688a5f231beff8b

| iBoot = iBoot.iphone6.RELEASE.im4p
| iBootIV = 6be782a6c3aad500b225fcd072d40520
| iBootKey = cbadd40f89cfee2611b62916a02c3b7edcba739315361afef84231a60ee6d9b8

| iBSS = iBSS.iphone6.RELEASE.im4p
| iBSSIV = d9197bb2cb3fd9efac3c673306295010
| iBSSKey = cd1a46c49189ea96f97a07bb2ef2b82b491bb6a809844732a1091f2e61c03d3d

| Kernelcache = kernelcache.release.iphone6
| KernelcacheIV = Not Encrypted

| LLB = LLB.iphone6.RELEASE.im4p
| LLBIV = 8ec129c52653ea022068321d53e4a011
| LLBKey = f312e0f5b27edec26999536a1bdd87a43a967b1926e64097579c4f64c682c38d

| RecoveryMode = recoverymode@1136~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n51.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = ab7d3370ea4cf31000e2c816809689b199b967d33bffa0cde427601353cc7ec023785cf8c167fc207aea191a83127efa
}}

YagerD 17K795 (AppleTV5,3)

2020-02-27T01:25:59Z

JonathanSeals: Created page with "{{keys | Version = 13.3.1 | Build = 17K795 | Device = AppleTV5,3 | Codename = YagerD | DownloadURL = https://upd..."

{{keys
| Version = 13.3.1
| Build = 17K795
| Device = AppleTV5,3
| Codename = YagerD
| DownloadURL = https://updates.cdn-apple.com/2020WinterFCS/fullrestores/061-39522/5CDC4844-C561-4A9D-88AC-3A531287CF06/AppleTV5,3_13.3.1_17K795_Restore.ipsw

| RootFS = 038-13375-047
| RootFSKey = Not Encrypted

| UpdateRamdisk = 038-13392-049
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 038-13365-049
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo~appletv.im4p
| AppleLogoIV = Not Encrypted

| DeviceTree = DeviceTree.j42dap.im4p
| DeviceTreeIV = Not Encrypted

| iBEC = iBEC.j42d.RELEASE.im4p
| iBECIV = 2439e7d27f803bec6bb1ffea4d46cb8b
| iBECKey = aa98f995dee47922f385c27314e9fdfdb180f28fe92126b4a030161acf5fa6b4

| iBoot = iBoot.j42d.RELEASE.im4p
| iBootIV = e3f590759649bda1e10d26ecac0b6e77
| iBootKey = bff7ab9d47648d5f96f10c59cef9217034274662e7e118357447fd39ac82e7f9

| iBSS = iBSS.j42d.RELEASE.im4p
| iBSSIV = ab36080a64f4163e53522ab22d3dbe4b
| iBSSKey = ec3262c737b55c1c936d548af924eaff89060c01cc57fddce9273b472800b66a

| Kernelcache = kernelcache.release.j42d
| KernelcacheIV = Not Encrypted

| LLB = LLB.j42d.RELEASE.im4p
| LLBIV = 56fdc52660e4ff38d87d680d5474e949
| LLBKey = b7ae8ae134ddddbf9c442615f46ccaf831ff184b4a1f0b60f9f6e4469ddefa24

| RecoveryMode = recoverymode@1080~appletv5.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.j42d.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = abfe7cf23c83cba3f025409ddc62fd3358cca45fe1f1613ac5b72c3b3a28938193e77f7488dd87314ad48c8b14da52c1
}}

YukonD 17D50 (iPhone9,2)

2020-02-07T03:02:08Z

JonathanSeals: fixed filename display

{{keys
| Version = 13.3.1
| Build = 17D50
| Device = iPhone9,2
| Codename = YukonD
| Baseband = 7.30.01
| DownloadURL = http://updates-http.cdn-apple.com/2020WinterFCS/fullrestores/061-39907/B4CE4664-0CAF-4AA3-A299-F67D447870EB/iPhone_5.5_P3_13.3.1_17D50_Restore.ipsw

| RootFS = 038-14983-056
| RootFSKey = Not Encrypted

| UpdateRamdisk = 038-14866-058
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 038-13993-058
| RestoreRamdiskIV = Not Encrypted

| AOPFirmware = aopfw-t8010aop.im4p
| AOPFirmwareIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| AppleMaggie = AppleMaggieFirmwareImage.im4p
| AppleMaggieIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.d11ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| Homer = homer_D11.im4p
| HomerIV = Not Encrypted

| iBEC = iBEC.d11.RELEASE.im4p
| iBECIV = c14334a1a221b72888a05ad4f7e1e8dc
| iBECKey = 4780a4bd6356580462816b144431e0c51cf452a018228245f623880e20626d03

| iBoot = iBoot.d11.RELEASE.im4p
| iBootIV = 7bb5c57a2e01e627c99d5573c6f88a2f
| iBootKey = 5739e5d1420b632be40ff65ade98ec8a7520f37daa2d132787ea1e0eb035eb14

| iBSS = iBSS.d11.RELEASE.im4p
| iBSSIV = aa664cf7da9664b6d35f8e6bef836e30
| iBSSKey = 6a2723121e1a6d808e8582b0527ac8871b7808d382d91b7976644ebb48cf602a

| Kernelcache = kernelcache.release.iphone9
| KernelcacheIV = Not Encrypted

| LiquidDetect = liquiddetect@1920~iphone-lightning.im4p
| LiquidDetectIV = Not Encrypted

| LLB = LLB.d11.RELEASE.im4p
| LLBIV = 24161ab5a892814664bb80d8f16e982e
| LLBKey = baa9f3f78ed97942c3bf23504213bb6517c08023611f00526efe971d1e77123c

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.d11.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 828765f4f15bd62a88ba2b4e61b1f4529d4d4186e70116f2908277d61e44d1887b34789ecbb256c90d3b7433d5d6050b
}}

YukonC 17C54 (iPad5,3)

2020-01-01T00:04:56Z

JonathanSeals: Created page with "{{keys | Version = 13.3 | Build = 17C54 | Device = iPad5,4 | Codename = YukonC | Baseband = 9.30.02 | Downlo..."

{{keys
| Version = 13.3
| Build = 17C54
| Device = iPad5,4
| Codename = YukonC
| Baseband = 9.30.02
| DownloadURL = https://updates.cdn-apple.com/2019FallFCS/fullrestores/061-61308/1F0021B4-179E-11EA-B5BB-D4BE390A62FC/iPad_64bit_TouchID_13.3_17C54_Restore.ipsw

| RootFS = 038-02810-069
| RootFSKey = Not Encrypted

| UpdateRamdisk = 038-03238-072
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 038-02406-072
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@2x~ipad.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@2x~ipad.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@2x~ipad.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@2x~ipad.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@2x~ipad.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@2x~ipad.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.j82ap.im4p
| DeviceTreeIV = Not Encrypted

| GlyphPlugin = glyphplugin@2x~ipad-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.ipad5b.RELEASE.im4p
| iBECIV = 533ad80adec87b44da0b1d76add98427
| iBECKey = b58447a59eca434f252224b01be34b71323a586167c31f048dfe4294d939dfd1

| iBoot = iBoot.ipad5b.RELEASE.im4p
| iBootIV = efb2ac1433e9df8f0ff29320212c108f
| iBootKey = 53b91179035a62a0c490e450f743e9cd1c60ef0e231f749b96b4c63350f0b6da

| iBSS = iBSS.ipad5b.RELEASE.im4p
| iBSSIV = e37568c0c10cc94af0cb003d5c3d8dcd
| iBSSKey = 6e33ee046feb0d9e18ea9611e2bf643cb8229eaa58dc5510890118e3f2870b4f

| Kernelcache = kernelcache.release.ipad5b
| KernelcacheIV = Not Encrypted

| LLB = LLB.ipad5b.RELEASE.im4p
| LLBIV = 0a6941ef8d6d81a8383033fc0bc31a5d
| LLBKey = 30c868a0a58296da54260bfd757d28ec196bb7e0d60507d7374aec3d041f971d

| RecoveryMode = recoverymode@2x~ipad-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.j82.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 539c5e5c8774513505961fcea91fe0470790950c00d31a1b090295505d445836802d5e53d24eb97a4b792134d1df33ad
}}

Butler 14B150 (iPhone8,2)

2019-10-18T01:42:38Z

JonathanSeals: Created page with "{{keys | Version = 10.1.1 | Build = 14B150 | Device = iPhone8,2 | Codename = Butler | Baseband = 2.36.00 | D..."

{{keys
| Version = 10.1.1
| Build = 14B150
| Device = iPhone8,2
| Codename = Butler
| Baseband = 2.36.00
| DownloadURL = http://appldnld.apple.com/ios10.1.1/031-88376-20161109-4C552D82-A503-11E6-8AAD-4CAEF9858D7F/iPhone_5.5_10.1.1_14B150_Restore.ipsw

| Model = N66AP
| Model2 = N66mAP

| RootFS = 058-51105-079
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-52518-082
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 058-52511-082
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.s8000.im4p
| AppleLogoIV = Not Encrypted

| AppleLogo2 = applelogo@3x~iphone.s8003.im4p
| AppleLogo2IV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.s8000.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging02 = batterycharging0@3x~iphone.s8003.im4p
| BatteryCharging02IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.s8000.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryCharging12 = batterycharging1@3x~iphone.s8003.im4p
| BatteryCharging12IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.s8000.im4p
| BatteryFullIV = Not Encrypted

| BatteryFull2 = batteryfull@3x~iphone.s8003.im4p
| BatteryFull2IV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.s8000.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow02 = batterylow0@3x~iphone.s8003.im4p
| BatteryLow02IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.s8000.im4p
| BatteryLow1IV = Not Encrypted

| BatteryLow12 = batterylow1@3x~iphone.s8003.im4p
| BatteryLow12IV = Not Encrypted

| DeviceTree = DeviceTree.n66ap.im4p
| DeviceTreeIV = Not Encrypted

| DeviceTree2 = DeviceTree.n66map.im4p
| DeviceTree2IV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.s8000.im4p
| GlyphPluginIV = Not Encrypted

| GlyphPlugin2 = glyphplugin@1920~iphone-lightning.s8003.im4p
| GlyphPlugin2IV = Not Encrypted

| iBEC = iBEC.n66.RELEASE.im4p
| iBECIV = 0553ed7b87ff74b77d45ad06267ba961
| iBECKey = fa3c4ada662b80fd586a733475d2846dbe9d4b1083a97ca514b685b05095fca9

| iBEC2 = iBEC.n66m.RELEASE.im4p
| iBEC2IV = Unknown
| iBEC2Key = Unknown
| iBEC2KBAG = 38584bb833e1e392e78e38048fd78c8e166ccb66b17fb3f76cb56894f844237938bf739bbcf211ad9d4e231709b1b89f

| iBoot = iBoot.n66.RELEASE.im4p
| iBootIV = bffc80e0d63ff5a450f3299364cf4c87
| iBootKey = 84cea88acecb5f9cd5c1a36327fec277aa7bdf763729006ee1da8f281225713f

| iBoot2 = iBoot.n66m.RELEASE.im4p
| iBoot2IV = Unknown
| iBoot2Key = Unknown
| iBoot2KBAG = b81ffbf5004ac2a8709021a83677c2342c5010d06bedbe3a44b2d7408cf5a083dd31e4672b852fb4aa3f0b09cf8112dc

| iBSS = iBSS.n66.RELEASE.im4p
| iBSSIV = 13907cc7068234cd0989063793a0d8a5
| iBSSKey = 62b054b17d4176783aee1f818bdaf937d6b467ef30b88453d761692a6439ebfc

| iBSS2 = iBSS.n66m.RELEASE.im4p
| iBSS2IV = Unknown
| iBSS2Key = Unknown
| iBSS2KBAG = 620ba2234e0edddbecec718e25e96e6db0cb74f2b50673256ff0a55b6c8e5df97b0dc4b2ac692c8736cf46887566665b

| Kernelcache = kernelcache.release.n66
| KernelcacheIV = Not Encrypted

| LLB = LLB.n66.RELEASE.im4p
| LLBIV = 247e0fa5392bf5f5f8a973451f1bba7d
| LLBKey = d0fdc49c6c489b8bb5534affb79ce1a8ffe898bfabe202a30b1a8220eb2892c5

| LLB2 = LLB.n66m.RELEASE.im4p
| LLB2IV = Unknown
| LLB2Key = Unknown
| LLB2KBAG = 7206f4e205ce082b9e77b6a041c9ae0a0332ca822617c88d1571f0ae5fe821a94da846b4aa72d0ef1342e2738883ed73

| RecoveryMode = recoverymode@1920~iphone-lightning.s8000.im4p
| RecoveryModeIV = Not Encrypted

| RecoveryMode2 = recoverymode@1920~iphone-lightning.s8003.im4p
| RecoveryMode2IV = Not Encrypted

| SEPFirmware = sep-firmware.n66.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 4da362acdcab1d3318a34ffe8c455553d8bf7e15f99c1dd975144842037ca817162088d878c3a562f978c8febbf4ccbb

| SEPFirmware2 = sep-firmware.n66m.RELEASE.im4p
| SEPFirmware2IV = Unknown
| SEPFirmware2Key = Unknown
| SEPFirmware2KBAG = 0423d904ff0e3dc60ba35bf6668be20012e27c1d6eb87ad799148d448be2463c8fcee242b9eb76ef6dbc4d0e4b8567a1
}}

Yukon 17A878 (iPhone8,2)

2019-10-15T18:45:42Z

JonathanSeals: Created page with "{{keys | Version = 13.1.3 | Build = 17A878 | Device = iPhone8,2 | Codename = Yukon | Baseband = 7.00.01 | Do..."

{{keys
| Version = 13.1.3
| Build = 17A878
| Device = iPhone8,2
| Codename = Yukon
| Baseband = 7.00.01
| DownloadURL = http://updates-http.cdn-apple.com/2019FallFCS/fullrestores/061-30575/29DDD716-EB7A-11E9-85ED-C610329334FA/iPhone_5.5_13.1.3_17A878_Restore.ipsw

| Model = N66AP
| Model2 = N66mAP

| RootFS = 048-95817-036
| RootFSKey = Not Encrypted

| UpdateRamdisk = 048-95940-037
| UpdateRamdiskIV = Not Encrypted

| RestoreRamdisk = 048-95747-037
| RestoreRamdiskIV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.im4p
| AppleLogoIV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.im4p
| BatteryFullIV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.im4p
| BatteryLow1IV = Not Encrypted

| DeviceTree = DeviceTree.n66ap.im4p
| DeviceTreeIV = Not Encrypted

| DeviceTree2 = DeviceTree.n66map.im4p
| DeviceTree2IV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.im4p
| GlyphPluginIV = Not Encrypted

| iBEC = iBEC.n66.RELEASE.im4p
| iBECIV = efbe04aa52adbc9463410c23a9d50f9c
| iBECKey = a026b77caca69923963a1dbc1504ce7b626c1fca4a6a839d2bd3064901c8aa70

| iBEC2 = iBEC.n66m.RELEASE.im4p
| iBEC2IV = Unknown
| iBEC2Key = Unknown
| iBEC2KBAG = 91200c351a38356efc8e6b84fdb3c63cdc992e6d42bc5f81738a683396c6d73ab62a66ebbfc0495221fbd2114c9a2e76

| iBoot = iBoot.n66.RELEASE.im4p
| iBootIV = b236a0b7077e58be03f19e81bd455e2f
| iBootKey = 6c630631b03bc97dc9542087dc7d7ca673f6f2924b5ba6747d97e225b4fe9a1d

| iBoot2 = iBoot.n66m.RELEASE.im4p
| iBoot2IV = Unknown
| iBoot2Key = Unknown
| iBoot2KBAG = 64454d6d5881daa406ce829284c443e351515383717c08cdf5bead7fed2f3488f848fb64d4e810cec57afa70b00cbcef

| iBSS = iBSS.n66.RELEASE.im4p
| iBSSIV = 7ff409317b7d4e24ba2c37159c3c0a62
| iBSSKey = d3179108553596d20550b11659cbbf734c22f1aac6ec4e06a6c6111b2303b4ec

| iBSS2 = iBSS.n66m.RELEASE.im4p
| iBSS2IV = Unknown
| iBSS2Key = Unknown
| iBSS2KBAG = b982ef14ae40d6853064ad194e46c53707d5f65bb93e7fc0c564186de280fb5ee1719dc90b3b777eee1042da563b019f

| Kernelcache = kernelcache.release.n66
| KernelcacheIV = Not Encrypted

| LLB = LLB.n66.RELEASE.im4p
| LLBIV = 696fe0e95d026a2d425a2f3bb7d5a419
| LLBKey = 7879f520f30ab5b87631f5f663869f4665b934e56785fe530c00b5f9d83c7559

| LLB2 = LLB.n66m.RELEASE.im4p
| LLB2IV = Unknown
| LLB2Key = Unknown
| LLB2KBAG = 2d1e9a279f0b7c7a67dacf759fc08b80b3c570b8146fa7061ce8c3f5e6817b25eea6deeb50a0ebda9725ec9de2ee6f99

| RecoveryMode = recoverymode@1920~iphone-lightning.im4p
| RecoveryModeIV = Not Encrypted

| SEPFirmware = sep-firmware.n66.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = f991a81e059c57c8f1ae2e5c3212fca819543e06bbc12a3197e9fe400e02febd6743d23cfe7c413797ba77455be807be

| SEPFirmware2 = sep-firmware.n66m.RELEASE.im4p
| SEPFirmware2IV = Unknown
| SEPFirmware2Key = Unknown
| SEPFirmware2KBAG = 6d0c22fc1e56b5a32c9b9dde654b4df15d6d1d136da2566135b69e51b3550a614c14ba818457396c5822cff8d4981a52
}}

Greensburg 14G60 (iPhone8,2)

2019-10-15T13:51:22Z

JonathanSeals:

{{keys
| Version = 10.3.3
| Build = 14G60
| Device = iPhone8,2
| Codename = Greensburg
| Baseband = 2.61.00
| DownloadURL = http://appldnld.apple.com/ios10.3.3/091-23338-20170719-CA990FD6-6977-11E7-AE41-3B9100BA0AE3/iPhone_5.5_10.3.3_14G60_Restore.ipsw

| Model = N66AP
| Model2 = N66mAP

| RootFS = 058-75287-062
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-75381-062
| UpdateRamdiskIV = Not Encrypted

| UpdateRamdisk2 = 058-75381-062
| UpdateRamdisk2IV = Not Encrypted

| RestoreRamdisk = 058-74940-063
| RestoreRamdiskIV = Not Encrypted

| RestoreRamdisk2 = 058-74940-063
| RestoreRamdisk2IV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.s8000.im4p
| AppleLogoIV = Not Encrypted

| AppleLogo2 = applelogo@3x~iphone.s8003.im4p
| AppleLogo2IV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.s8000.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging02 = batterycharging0@3x~iphone.s8003.im4p
| BatteryCharging02IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.s8000.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryCharging12 = batterycharging1@3x~iphone.s8003.im4p
| BatteryCharging12IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.s8000.im4p
| BatteryFullIV = Not Encrypted

| BatteryFull2 = batteryfull@3x~iphone.s8003.im4p
| BatteryFull2IV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.s8000.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow02 = batterylow0@3x~iphone.s8003.im4p
| BatteryLow02IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.s8000.im4p
| BatteryLow1IV = Not Encrypted

| BatteryLow12 = batterylow1@3x~iphone.s8003.im4p
| BatteryLow12IV = Not Encrypted

| DeviceTree = DeviceTree.n66ap.im4p
| DeviceTreeIV = Not Encrypted

| DeviceTree2 = DeviceTree.n66map.im4p
| DeviceTree2IV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.s8000.im4p
| GlyphPluginIV = Not Encrypted

| GlyphPlugin2 = glyphplugin@1920~iphone-lightning.s8003.im4p
| GlyphPlugin2IV = Not Encrypted

| iBEC = iBEC.n66.RELEASE.im4p
| iBECIV = 6861c974b653a6f5faa1dacf51ca080d
| iBECKey = 500f14f202701c59a575d5df2f872068d98a750e3056b65372c6e7190a74b58c

| iBEC2 = iBEC.n66m.RELEASE.im4p
| iBEC2IV = Unknown
| iBEC2Key = Unknown
| iBEC2KBAG = 809ce2ceb952a0dddac7617bdce080dc13b015a6bb9b78d1d0910776e59f72da15880d341120e5c670069732fedbbdb5

| iBoot = iBoot.n66.RELEASE.im4p
| iBootIV = f049aa26ae85abee603f5b61ebdb96be
| iBootKey = 435b5fef34a7c831cf8c30e037bb8a03a916ff8f1c9774fea44351bc758a5256

| iBoot2 = iBoot.n66m.RELEASE.im4p
| iBoot2IV = Unknown
| iBoot2Key = Unknown
| iBoot2KBAG = b11c691ec8659df35de3ce37bafab9337711ccb1424a1143a34da48c7ce4337e23e8c1a52aba42e8a1bd2c281ed5a332

| iBSS = iBSS.n66.RELEASE.im4p
| iBSSIV = eba8ec81c88d79e684d8235a32d1ceec
| iBSSKey = 90cbf9bd16a0d4caee124f0841548eafd5ec9eede3fbf3570dd47da4460cfa70

| iBSS2 = iBSS.n66m.RELEASE.im4p
| iBSS2IV = Unknown
| iBSS2Key = Unknown
| iBSS2KBAG = 2a970d298e4bfa98a1dfa479e1244ab117a5dd42509c13b6dfd52d3f0e6e3ded12127049359c25281e4624580258759e

| Kernelcache = kernelcache.release.n66
| KernelcacheIV = Not Encrypted

| LLB = LLB.n66.RELEASE.im4p
| LLBIV = acfb6b5427053571f0915c12a1dd589c
| LLBKey = fbae60658232fd842cf1418983147b9742892c5b9e77a42d108e48834f7ec8f9

| LLB2 = LLB.n66m.RELEASE.im4p
| LLB2IV = Unknown
| LLB2Key = Unknown
| LLB2KBAG = a2d6ebb3c1c1852f47aeaf72698d0eced65125bf4cf92059dfadef68c9fb8606cf6f2705604aafc56e130c1777f782ca

| RecoveryMode = recoverymode@1920~iphone-lightning.s8000.im4p
| RecoveryModeIV = Not Encrypted

| RecoveryMode2 = recoverymode@1920~iphone-lightning.s8003.im4p
| RecoveryMode2IV = Not Encrypted

| SEPFirmware = sep-firmware.n66.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 30318fb61dae9a4ca92321a249d1f7f9c361c95135f02748ac37dcf3641b7e5e37275b5b773f2d30dd09c9fbc526c491

| SEPFirmware2 = sep-firmware.n66m.RELEASE.im4p
| SEPFirmware2IV = Unknown
| SEPFirmware2Key = Unknown
| SEPFirmware2KBAG = daa580f85d85de63e5b33e15948297889ffe028f55a2469985cc12c418364552111ebb2ce575d5525674ad19a22209d0
}}

Greensburg 14G60 (iPhone8,2)

2019-10-15T13:49:33Z

JonathanSeals: Created page with "{{keys | Version = 10.3.3 | Build = 14G60 | Device = iPhone8,2 | Codename = Greensburg | Baseband = 2.61.00..."

{{keys
| Version = 10.3.3
| Build = 14G60
| Device = iPhone8,2
| Codename = Greensburg
| Baseband = 2.61.00
| DownloadURL = http://appldnld.apple.com/ios10.3.3/091-23338-20170719-CA990FD6-6977-11E7-AE41-3B9100BA0AE3/iPhone_5.5_10.3.3_14G60_Restore.ipsw

| Model = N66AP
| Model2 = N66mAP

| RootFS = 058-75287-062
| RootFSKey = Not Encrypted

| UpdateRamdisk = 058-75381-062
| UpdateRamdiskIV = Not Encrypted

| UpdateRamdisk2 = 058-75381-062
| UpdateRamdisk2IV = Not Encrypted

| RestoreRamdisk = 058-74940-063
| RestoreRamdiskIV = Not Encrypted

| RestoreRamdisk2 = 058-74940-063
| RestoreRamdisk2IV = Not Encrypted

| AppleLogo = applelogo@3x~iphone.s8000.im4p
| AppleLogoIV = Not Encrypted

| AppleLogo2 = applelogo@3x~iphone.s8003.im4p
| AppleLogo2IV = Not Encrypted

| BatteryCharging0 = batterycharging0@3x~iphone.s8000.im4p
| BatteryCharging0IV = Not Encrypted

| BatteryCharging02 = batterycharging0@3x~iphone.s8003.im4p
| BatteryCharging02IV = Not Encrypted

| BatteryCharging1 = batterycharging1@3x~iphone.s8000.im4p
| BatteryCharging1IV = Not Encrypted

| BatteryCharging12 = batterycharging1@3x~iphone.s8003.im4p
| BatteryCharging12IV = Not Encrypted

| BatteryFull = batteryfull@3x~iphone.s8000.im4p
| BatteryFullIV = Not Encrypted

| BatteryFull2 = batteryfull@3x~iphone.s8003.im4p
| BatteryFull2IV = Not Encrypted

| BatteryLow0 = batterylow0@3x~iphone.s8000.im4p
| BatteryLow0IV = Not Encrypted

| BatteryLow02 = batterylow0@3x~iphone.s8003.im4p
| BatteryLow02IV = Not Encrypted

| BatteryLow1 = batterylow1@3x~iphone.s8000.im4p
| BatteryLow1IV = Not Encrypted

| BatteryLow12 = batterylow1@3x~iphone.s8003.im4p
| BatteryLow12IV = Not Encrypted

| DeviceTree = DeviceTree.n66ap.im4p
| DeviceTreeIV = Not Encrypted

| DeviceTree2 = DeviceTree.n66map.im4p
| DeviceTree2IV = Not Encrypted

| GlyphPlugin = glyphplugin@1920~iphone-lightning.s8000.im4p
| GlyphPluginIV = Not Encrypted

| GlyphPlugin2 = glyphplugin@1920~iphone-lightning.s8003.im4p
| GlyphPlugin2IV = Not Encrypted

| iBEC = iBEC.n66.RELEASE.im4p
| iBECIV = 6861c974b653a6f5faa1dacf51ca080d
| iBECKey = 500f14f202701c59a575d5df2f872068d98a750e3056b65372c6e7190a74b58c

| iBEC2 = iBEC.n66m.RELEASE.im4p
| iBEC2IV = Unknown
| iBEC2Key = Unknown
| iBEC2KBAG = 809ce2ceb952a0dddac7617bdce080dc13b015a6bb9b78d1d0910776e59f72da15880d341120e5c670069732fedbbdb5

| iBoot = iBoot.n66.RELEASE.im4p
| iBootIV = f049aa26ae85abee603f5b61ebdb96be
| iBootKey = 435b5fef34a7c831cf8c30e037bb8a03a916ff8f1c9774fea44351bc758a5256

| iBoot2 = iBoot.n66m.RELEASE.im4p
| iBoot2IV = Unknown
| iBoot2Key = Unknown
| iBoot2KBAG = b11c691ec8659df35de3ce37bafab9337711ccb1424a1143a34da48c7ce4337e23e8c1a52aba42e8a1bd2c281ed5a332

| iBSS = iBSS.n66.RELEASE.im4p
| iBSSIV = eba8ec81c88d79e684d8235a32d1ceec
| iBSSKey = 90cbf9bd16a0d4caee124f0841548eafd5ec9eede3fbf3570dd47da4460cfa70

| iBSS2 = iBSS.n66m.RELEASE.im4p
| iBSS2IV = Unknown
| iBSS2Key = Unknown
| iBSS2KBAG = 2a970d298e4bfa98a1dfa479e1244ab117a5dd42509c13b6dfd52d3f0e6e3ded12127049359c25281e4624580258759e

| Kernelcache = kernelcache.release.iphone8
| KernelcacheIV = Not Encrypted

| LLB = LLB.n66.RELEASE.im4p
| LLBIV = acfb6b5427053571f0915c12a1dd589c
| LLBKey = fbae60658232fd842cf1418983147b9742892c5b9e77a42d108e48834f7ec8f9

| LLB2 = LLB.n66m.RELEASE.im4p
| LLB2IV = Unknown
| LLB2Key = Unknown
| LLB2KBAG = a2d6ebb3c1c1852f47aeaf72698d0eced65125bf4cf92059dfadef68c9fb8606cf6f2705604aafc56e130c1777f782ca

| RecoveryMode = recoverymode@1920~iphone-lightning.s8000.im4p
| RecoveryModeIV = Not Encrypted

| RecoveryMode2 = recoverymode@1920~iphone-lightning.s8003.im4p
| RecoveryMode2IV = Not Encrypted

| SEPFirmware = sep-firmware.n66.RELEASE.im4p
| SEPFirmwareIV = Unknown
| SEPFirmwareKey = Unknown
| SEPFirmwareKBAG = 30318fb61dae9a4ca92321a249d1f7f9c361c95135f02748ac37dcf3641b7e5e37275b5b773f2d30dd09c9fbc526c491

| SEPFirmware2 = sep-firmware.n66m.RELEASE.im4p
| SEPFirmware2IV = Unknown
| SEPFirmware2Key = Unknown
| SEPFirmware2KBAG = daa580f85d85de63e5b33e15948297889ffe028f55a2469985cc12c418364552111ebb2ce575d5525674ad19a22209d0
}}

Tfp0 patch

2017-12-29T16:02:12Z

JonathanSeals: Yalu enables tfp0 on A9 and earlier devices, not sure if extra_recipe enables it there for those devices.

{{DISPLAYTITLE:tfp0 patch}}
In the XNU kernel, <code>task_for_pid</code> is a function that allows a (privileged) process to get the task port of another process on the same host, except the kernel task (process ID 0). A '''tfp0 patch''' (or '''task_for_pid(0) patch''') removes this restriction, allowing any executable running as root to call '''task_for_pid''' for pid '''0''' (hence the name) and then use <code>vm_read</code> and <code>vm_write</code> to modify the kernel VM region. The entitlements ''get-task-allow'' and ''task_for_pid-allow'' are required to make [[AMFI]] happy.

== Example code ==
The following C program calls <code>task_for_pid</code> and returns the error code:

#include <mach/mach.h>

// Compile and fakesign with entitlements (on-device; LLVM+Clang and ldid must be installed):
// cc -o tfp0 tfp0.c && ldid -Stfp0.plist tfp0

int main(void) {
mach_port_t kernel_task = 0;
return task_for_pid(mach_task_self(), 0, &kernel_task);
}

The returned error code, which can be checked using <code>echo $?</code> in bash after running the test program, will be 0 if the call succeeded. If it did not, a positive number, e.g. 5 (KERN_FAILURE), is returned instead (see <code>kern_return.h</code> for possible values). The entitlements plist (named <code>tfp0.plist</code> in this example) for [[ldid]] can look like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<nowiki>http://www.apple.com/DTDs/PropertyList-1.0.dtd</nowiki>">
<plist version="1.0">
<dict>
<key>get-task-allow</key>
<true/>
<key>run-unsigned-code</key>
<true/>
<key>task_for_pid-allow</key>
<true/>
</dict>
</plist>

== tfp0 enabled jailbreaks ==
Jailbreaks known to enable tfp0 include:
* [[Absinthe]] (5.1.1)
* [[evasi0n]] (6.0–6.1.2)
* [[p0sixspwn]] (6.1.3–6.1.6)
* [[evasi0n7]] (7.0–7.0.6)
* [[Pangu]] v0.3 (7.1–7.1.2)
* [[Pangu8]] v0.5 (8.0–8.1)
* [[TaiG]] (8.0–8.4)
* [[Pangu9]] (9.0–9.0.2) on 32-bit
* [[Home Depot]] (9.1–9.3.4) on 32-bit
* [[jbme]] (9.2–9.3.3) on 64-bit
* [[extra_recipe+yaluX]] (10.0–10.1.1) on 64-bit
* [[yalu102]] (10.2) on 64-bit (excluding iPhone 7)

=== Jailbreaks lacking tfp0 ===
The following jailbreaks do ''not'' have tfp0 enabled:
* [[Pangu]] v0.1–0.2 (7.1–7.1.2)
:* Solution: Update to version 0.3 (filename: <code>io.pangu.axe7_0.3_iphoneos-arm.deb</code>)
* [[Pangu8]] v0.1–0.4 (8.0–8.1)
:* Solution: Update to version 0.5 (filename: <code>io.pangu.xuanyuansword8_0.5_iphoneos-arm.deb</code>)
* [[PPJailbreak]] (8.0–8.4)
:* Solution: replace PPJailbreak with TaiG
* [[Pangu9]] (9.0–9.3.3) on 64-bit
:* Solution: use cl0ver by Siguza, or re-jailbreak using jbme (uses the trident exploit chain instead)
* [[yalu + mach_portal]] (10.0–10.1.1) on iPhone 7/iPhone 7 Plus
:* Solution: use extra_recipe+yaluX instead
* [[h3lix]] (10.0–10.3.3) on 32-bit
:* No solution for compiled code, replace <code>task_for_pid(mach_task_self(), 0, &ktask)</code> calls with <code>host_get_special_port(mach_host_self(), HOST_LOCAL_NODE, 4, &ktask)</code> if source is available

== See also ==
* [[hgsp4 patch]]

[[Category:Kernel Patches]]

User talk:JonathanSeals

2017-12-29T15:57:49Z

JonathanSeals:

== Regarding the [[CoolBooter]] article ==
Hi!

In [https://www.theiphonewiki.com/w/index.php?title=CoolBooter&diff=65847&oldid=65846 this edit] you changed ''«'''The secondary OS''' will kernel panic during boot»'' to ''«'''iOS 6 as a secondary OS''' will kernel panic during boot''». IIRC, you told me on Reddit that you don’t have any iPhone 5 test devices, so I wonder: Is iOS 6 the only secondary OS to which you have confirmed that this happens, or is this something that was fixed in a recent update? I have installed various iOS 7.x and 8.x versions as secondary versions using CoolBooterCLI on my i5 running iOS 6, and they have all kernel panicked if the Lightning cable has been attached since I booted the host OS. I must stress that the last time I installed anything was back in October, so later updates could of course have fixed this issue for newer target versions.

[[User:Gjest|Gjest]] ([[User talk:Gjest|talk]]) 03:08, 28 December 2017 (UTC)

I have no clue how proper responses work with this, so sorry for probably not doing this the correct way. I don't currently have an iPhone 5 test device as I am currently loaning mine to a friend. When I did still have it, I confirmed that, at least as of iOS 9.0.2 as a main OS, only iOS 6 will panic upon booting if lightning was attached prior without rebooting. There were some issues with kernel patches in some older versions that caused a panic on boot for some devices (I refactored the patchfinder quite a few times over the updates), however those should now be fixed. I will ask some friends with a 5 to double check this though.

--[[User:JonathanSeals|JonathanSeals]] ([[User talk:JonathanSeals|talk]]) 15:57, 29 December 2017 (UTC)

CoolBooter

2017-12-27T07:56:10Z

JonathanSeals: Revised info about lightning, removed "the app doesn't work with a jailbreak that was released *three* days ago" information, more info about why passcodes are the same across OS installs, revised info about spawning the cli via an app

{{infobox software
| name = CoolBooter
| title = CoolBooter
| author = [[User:JonathanSeals|Jonathan Seals]]
| developer = [[User:JonathanSeals|Jonathan Seals]]
| discontinued =
| released = {{start date and age|2016|12|25}}
| latest release version = 1.2.4
| latest release date = {{Start date and age|2017|10|25|df=yes}}
| operating system = [[wikipedia:IOS|iOS]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Utilities
| license = [[wikipedia:Freeware|Freeware]]
| website = [https://coolbooter.com CoolBooter]
}}
'''CoolBooter''' is a tool for dual booting jailbroken 32-bit iOS devices with another copy of iOS via winocm's [[ios-kexec-utils]]. It supports hosts running iOS 7.0 or higher and can boot versions ranging from 5.0 to 8.4.1. Hosts on lower versions can install the [[#CoolBooterCLI|CLI version]] instead.

== Usage notes ==

* During setup, the user can choose to jailbreak the secondary operating system and/or activate verbose boot. iOS 8.x will automatically be jailbroken, as there will be issues if it is not.<ref>[https://twitter.com/Thmitt/status/941474872261214208 @Thmitt: there were some issues with 8.x if it wasn’t jailbroken]</ref>

* Hosts running iOS 9.0 or higher experienced issues with data protection, meaning that apps such as YouTube, WhatsApp and Mail would not work on the secondary OS. Experimental protected volume support was added later to work around these issues.

* Like regular installations of iOS, dual booted systems must be activated. [[A6]] devices that have ever been on iOS 10 and then downgraded have failed activation since July, 2017, first randomly, then consistently. To activate the dual booted partition on these devices, activation records can be copied to <code>/var/root/Library/Lockdown</code> from the host OS. Another option is to delete <code>/Applications/Setup.app</code>, also done from the host OS.

* iOS 6 as a secondary OS will kernel panic during boot on Lightning adapter devices if the USB cable is attached, or has been since the device was booted into the host OS. To fix the issue, unplug the cable and reboot before launching CoolBooter.

* The secondary OS uses the same lock screen passcode as the host OS, and is protected under the same data-protection scheme as the main OS.

== Version Change Log ==
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| 1.0b1
| 25 December, 2017
| initial release
|-
| 1.0b2
| 25 December, 2017
| fixed a small mistake in the booting process
|-
| 1.0b3
| 26 December, 2017
| 7.x support temporarily dropped due to activation issues
|-
| 1.0b4
| 27 December, 2017
| Solved partitioning issues
|-
| 1.0b5
| 28 December, 2017
| Adds a warning to reboot after installation
|-
| 1.0b6
| 18 April, 2017
| Includes fixes for low capacities as well as many performance improvements
|-
| 1.0b7
| 9 May, 2017
| Adds backup and restore and improves reliability on older firmwares
|-
| 1.0b8
| 4 June, 2017
| Fewer bootloops, maybe no more bootloops?
|-
| 1.0b9
| 5 June, 2017
| Including better iOS 7 support
|-
| 1.0b10
| 14 June, 2017
| iPhone 4s is now fully supported
|-
| 1.0b11
| 20 June, 2017
| Adds a custom data partition size option
|-
| 1.0b12
| 21 July, 2017
| Added S5L8942 device (iPadMini 1, iPod5, iPad2,4) support (thanks to @axi0mX)
|-
| 1.0.1
| 9 August, 2017
| Fixes for the iPad2,4, iPod5,1, as well as bootlogo support (thanks to @nyan_satan)
|-
| 1.0.2
| 27 August, 2017
| Experimental protected volume support for iOS 9+ main OS users
|-
| 1.1
| 11 September, 2017
| iOS 8.0–8.4.1 target OS support
|-
| 1.1.1
| 12 September, 2017
| Bug fixes for iPad mini 1 as well as for iOS 9 main OS users
|-
| 1.2
| 24 September, 2017
| iOS 5.x support, and stability improvements for A5 devices
|-
| 1.2.2
| 29 September, 2017
| iOS 8.x bootlogo support, fixed 5.1 targets for iPhone 4S, fixed issues with devices not continuing past Apple logo (iOS 7 and lower) or booting back into host OS
|-
| 1.2.3
| 3 October, 2017
| Fixes iPhone 4S and iPod Touch 5G iOS 6 support, iPhone 4S iOS 5.1.x support (including baseband), inability to allocate more than 6 GB of space to iOS 5.x
|-
| 1.2.4
| 25 October, 2017
| General performance improvements, automatic detection of iPhone 4S units that cannot run iOS 5
|}

== CoolBooterCLI ==
{{infobox software
| name = CoolBooterCLI
| title = CoolBooterCLI
| author = [[User:JonathanSeals|Jonathan Seals]]
| developer = [[User:JonathanSeals|Jonathan Seals]]
| discontinued =
| released = {{start date and age|2017|03|09}}
| latest release version = 0.8.4
| latest release date = {{Start date and age|2017|10|25|df=yes}}
| operating system = [[wikipedia:IOS|iOS]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Utilities
| license = [[wikipedia:Freeware|Freeware]]
| website = [https://coolbooter.com CoolBooter]
}}
A command line interface version called '''CoolBooterCLI''' is offered as a separate package in Cydia. Originally requiring iOS 6.0 or higher, it now runs on iOS 5.x as well.

Starting CoolBooterCLI from MTerminal using the command <code>coolbootercli -b</code> fails on devices running older iOS versions. This issue can be solved by starting CoolBooterCLI via SSH instead (<code>ssh root@localhost</code>) or by using an app that spawns "coolbootercli -b".

=== Version Change Log ===
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| 0.1.4
| 9 March, 2017
| Initial release, supports hosts on 6.0 and higher, targets 6.0–7.1.2 on same devices as before
|-
| 0.3
| 18 April, 2017
| Adds support for iOS 5 hosts and targets, iPod 4G, iPhone 3GS, iPad 1, low capacity improvements
|-
| 0.6
| 17 June, 2017
| iPhone 4S support, more stability, and a custom data partition size option
|-
| 0.8.2
| 29 September, 2017
| Added support for S5L8942 devices, support for 5.x and 8.x targets, experimental protected volume support for hosts on iOS 9 or later going to iOS 7 or lower (use option --use-dpw), protected volume support for all devices running iOS 8 or lower, bootlogo support for all target versions
|-
| 0.8.3
| 3 October, 2017
| Fixes iPhone 4S and iPod Touch 5G iOS 6 support, iPhone 4S iOS 5.1.x support (including baseband), inability to allocate more than 6 GB of space to iOS 5.x
|-
| 0.8.4
| 25 October, 2017
| General performance improvements, automatic detection of iPhone 4S units that cannot run iOS 5
|}

== External Links ==
* [https://coolbooter.com/ Official website and Cydia repository]
* @[https://twitter.com/coolbooter CoolBooter] on Twitter

== References ==
<references />

SochiVail 11D5127c (iPhone5,4)

2017-12-13T17:12:36Z

JonathanSeals: corrected applelogo key

{{keys
| Version = 7.1 beta 3
| Build = 11D5127c
| Device = iPhone5,4
| Codename = SochiVail
| Baseband = 2.13.01

| RootFS = 058-1942-004
| RootFSKey = 0184ca48237e3a61ec4486b348859687dfbfdaab27764a546469de14fe0e23bcbc639a16

| UpdateRamdisk = 058-1975-004
| UpdateRamdiskIV = 226a0cebd9c71bb9c9ec2c9edfaf0c4b
| UpdateRamdiskKey = baa7971b3bf8c0ef8150595c5bf3b03524580411485a0597eb7e5e2783f303f3

| RestoreRamdisk = 058-1953-004
| RestoreRamdiskIV = 10f7c0704c963bfc7707481eba83d6b7
| RestoreRamdiskKey = 5fcc7b49e6721ca497df234d78ca15053b225a6a326150a0e1ba788a2922d137

| AppleLogo = applelogo@2x~iphone.s5l8950x.img3
| AppleLogoIV = 079f8eb856ac43f3383c75263dfe2513
| AppleLogoKey = 86ed9d7967362dc9d153f791ec42c9ba41e6d9f4a9ed7558f81470d99590a2a4

| BatteryCharging0 = batterycharging0@2x~iphone.s5l8950x.img3
| BatteryCharging0IV = 16239ae2f82e0ecafa57674a155e490a
| BatteryCharging0Key = 1152687c7fb517e6e6efac15c135ea766a6a760eab286ef0ee59a2062b5e3211

| BatteryCharging1 = batterycharging1@2x~iphone.s5l8950x.img3
| BatteryCharging1IV = b255268e4a1885f0d5cc33abeccf9a29
| BatteryCharging1Key = ff1e87df9bb5e6825a1718592f8a8586112a2864745271a139328bbb86ddee6a

| BatteryFull = batteryfull@2x~iphone.s5l8950x.img3
| BatteryFullIV = a8ed7b6b9f45b190a53122960c3cad19
| BatteryFullKey = 7f012423370eece13fead907e87b4cc8a3f69d3c09eb28b03fee71196c12370a

| BatteryLow0 = batterylow0@2x~iphone.s5l8950x.img3
| BatteryLow0IV = 9a89a7909bd50aaf9c2622c172aab682
| BatteryLow0Key = 89f814aec2ba38b1d633308ac992844fe6ac01741aa733396768c3418c62c98a

| BatteryLow1 = batterylow1@2x~iphone.s5l8950x.img3
| BatteryLow1IV = 01bb2e977e56310139e2ff000d3b002c
| BatteryLow1Key = d0b25c0eb86710f12cd325252b65d9cc616f15903a257d6fabe8301151ae3747

| DeviceTree = DeviceTree.n49ap.img3
| DeviceTreeIV = 4c3f1325538b0876f251b69acde1ed52
| DeviceTreeKey = 9f19dfefcb7b9920b456095fe71d4f1e33c88c7ca870be82726be90304716f4e

| GlyphPlugin = glyphplugin@1136~iphone-lightning.s5l8950x.img3
| GlyphPluginIV = fe60d8579eeac622e19ec94ce17875bb
| GlyphPluginKey = df4e4b1939b7ec96c73f8cb5915d5d0301db596b1dcab0f065f484b158f645e6

| iBEC = iBEC.n49ap.RELEASE.dfu
| iBECIV = a5f6847f1706b903a8045af735163dc6
| iBECKey = 3ae7de0acb8fb58ddb7da670149b455b04037374e818bc1bcc7fe602ba975192

| iBoot = iBoot.n49ap.RELEASE.img3
| iBootIV = b2d48d66f25d538ca1702421f1aacfc0
| iBootKey = 6b211295f94807febf5e55d62946d9e835a6de541463b59cdbff1e0636136f89

| iBSS = iBSS.n49ap.RELEASE.dfu
| iBSSIV = d287387906785b36ef7a31427606e7cc
| iBSSKey = eb157cad66d72fd24eb15b98123e70d6f75451e49c0507985e1287ed609b0fa2

| Kernelcache = kernelcache.release.n49
| KernelcacheIV = b6b57fe4b31f5fe09cb451a4bdeaf0db
| KernelcacheKey = 4f72f6188f2dec39470cf65354fd0f68d62b4f26b3bd0ffdd29ea5a95129bfcc

| LLB = LLB.n49ap.RELEASE.img3
| LLBIV = eac9a5b0786e6be6a1267c6f8cf49ec5
| LLBKey = c4aaa75d046279f01fe33aa7f12184a13f248edb9dfd9ffbd530ee3441b585c6

| RecoveryMode = recoverymode@1136~iphone-lightning.s5l8950x.img3
| RecoveryModeIV = 13f17845a75826712e8499d64526671c
| RecoveryModeKey = 132c852318bf28e60ae2a45e6dd9dca9f6971ce17278f7f19d762fc093527b42
}}

CoolBooter

2017-10-13T09:03:38Z

JonathanSeals:

CoolBooter is a tool for dual booting jailbroken 32-bit iOS devices with another copy of iOS via winocm's ios-kexec-utils.

{{infobox software
| name = CoolBooter
| title = CoolBooter
| author = [[User:JonathanSeals|Jonathan Seals]]
| developer = [[User:JonathanSeals|Jonathan Seals]]
| discontinued =
| released = {{start date and age|2016|12|25}}
| operating system = [[wikipedia:IOS|iOS]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Utilities
| license = [[wikipedia:Freeware|Freeware]]
| website = [https://coolbooter.com CoolBooter]
}}

== External Links ==
* [https://coolbooter.com/ Official website and Cydia repository]
* @[https://twitter.com/coolbooter CoolBooter] on Twitter

{{stub}}

Firmware Keys

2017-10-13T09:00:09Z

JonathanSeals: better explanation.

__NOTOC__
'''Firmware Keys''' are keys which decrypt the [[:/|root filesystem]] of certain ([[Beta Firmware|beta]]) [[firmware]]s. Apple uses a to ensure the safety of their files. Over time Apple has changed the way to encrypt firmware files, thus the way to decrypt files as well as the way to get the keys has also.

== History ==
With the release of the iPhone came the [[S5L File Formats#IMG2|IMG2]] file format. They were used on all known [[iOS|iPhone OS]] [[#1.x|1.x]] firmwares. For the 1.1.x series, they were encrypted with the [[AES Keys#Key 0x837|0x837 key]]. The discovery of the 0x837 key led to the ability to decrypt ''any'' 1.x firmware.

Following IMG2 came the [[IMG3 File Format|IMG3]] file format. They were introduced with iPhone OS [[#1.x.2F2.x|2.0 beta 4]], and have been in use ever since. In order to maintain their integrity, they use multiple layers of encryption. Apple took encryption seriously with IMG3 by utilizing [[wikipedia:Advanced Encryption Standard|AES]] (based on the [[wikipedia:Rijndael key schedule|Rinjndael key schedule]]). In terms of the pre-iPhone OS 3 [[VFDecrypt]] key, it is stored as plain-text in the "__restore" segment of the ASR image within the [[ramdisk]]s.

The ramdisk keys can ''only'' be retrieved with the processor specific [[GID Key]]. The GID key is currently unretrievable and can only be utilized through the built-in [[AES Keys|AES engine]]. To complicate things ''even more'', the engine is only accessible through a special [[bootrom]] or [[iBoot]] exploit ([[jailbreak]]s typically expose it with [[:/dev/aes_0]]). This makes usage of the key nearly impossible.

However, once you have access to the AES engine, the entire system falls apart. You are able to upload an encrypted ramdisk and grab the decryption keys for it. Once you manage to decrypt the ramdisk, you can run it through [[GenPass]] to decrypt the Firmware key.

Beginning with iOS 6.0 beta, Apple tweaked their disk images so they no longer work with VFDecrypt. VFDecrypt will report that the filesystem is decrypted, but you will be unable to mount it. The current workaround is to use [[dmg]] from [[Xpwn]] to decrypt them. What has changed to break VFDecrypt is currently unknown. Decryption will take slightly longer due to dmg writing its progress to the terminal, but can be avoided (on Unix-like operating systems) by piping <code>stdout</code> to <code>/dev/null</code>. The difference writing to the terminal versus not, however, is negligible.

To find the keys, you can either use the methods on [[AES Keys]] or the easier option for OS X, [[keylimepie]].

== Decrypting ==
{{main|Decrypting Firmwares}}
== Notes ==
{| class="wikitable" style="float: right;"
|-
! Application Processor
! [[iDevice]]
|-
| [[S5L8900]]
| [[M68AP|iPhone]] [[N82AP|iPhone 3G]] [[N45AP|iPod touch]]
|-
| [[S5L8720]]
| [[N72AP|iPod touch (2nd generation)]]
|-
| [[S5L8920]]
| [[N88AP|iPhone 3GS]]
|-
| [[S5L8922]]
| [[N18AP|iPod touch (3rd generation)]]
|-
| [[S5L8930]] (A4)
| [[K48AP|iPad]] [[iPhone 4]] [[N81AP|iPod touch (4th generation)]] [[K66AP|Apple TV (2nd generation)]]
|-
| [[S5L8940]] (A5)
| [[K93AP|iPad 2 (iPad2,1)]] [[K94AP|iPad 2 (iPad2,2)]] [[K95AP|iPad 2 (iPad2,3)]] [[N94AP|iPhone 4S]]
|-
| [[S5L8942]] (A5 Rev A)
| [[K93AAP|iPad 2 (iPad2,4)]] [[J33AP|Apple TV (3rd generation) (AppleTV3,1)]] [[iPod touch (5th generation)]] [[iPad mini]]
|-
| [[S5L8945]] (A5X)
| [[iPad (3rd generation)]]
|-
| [[S5L8947]] (A5 Rev B)
| [[J33IAP|Apple TV (3rd generation) (AppleTV3,2)]]
|-
| [[S5L8950]] (A6)
| [[iPhone 5]] [[iPhone 5c]]
|-
| [[S5L8955]] (A6X)
| [[iPad (4th generation)]]
|-
| [[S5L8960]] (A7)
| [[iPhone 5s]] [[iPad mini 2]] [[iPad mini 3]]
|-
| [[S5L8965]] (A7 Variant)
| [[iPad Air]]
|-
| [[T7000]] (A8)
| [[J42dAP|Apple TV (4th generation)]] [[HomePod]] [[iPad mini 4]] [[N61AP|iPhone 6]] [[N56AP|iPhone 6 Plus]] [[N102AP|iPod touch (6th generation)]]
|-
| [[T7001]] (A8X)
| [[iPad Air 2]]
|-
| [[S7002]] (S1)
| [[Apple Watch (1st generation)]]
|-
| [[S8000]] (A9 [[wikipedia:Samsung Electronics|Samsung]])
| [[iPad (5th generation)]] [[N69uAP|iPhone SE]] [[N71AP|iPhone 6s]] [[N66AP|iPhone 6s Plus]]
|-
| [[S8003]] (A9 [[wikipedia:TSMC|TSMC]])
| [[N69AP|iPhone SE]] [[N71mAP|iPhone 6s]] [[N66mAP|iPhone 6s Plus]]
|-
| [[S8001]] (A9X)
| [[iPad Pro (12.9-inch)]] [[iPad Pro (9.7-inch)]]
|-
| [[T8011]] (A10X)
| [[iPad Pro (12.9-inch, 2nd generation)]] [[iPad Pro (10.5-inch)]]
|}

Certain files share the same key and IV per [[Application Processor|application processor]] (per build) provided the devices have the same pixel resolution:
* [[Update Ramdisk]]
* [[Restore Ramdisk]]
* [[AppleLogo]]
* [[BatteryCharging0]]
* [[BatteryCharging1]]
* [[BatteryFull]]
* [[BatteryLow0]]
* [[BatteryLow1]]
* [[GlyphCharging]]
* [[GlyphPlugin]]
* [[Kernelcache]]
* [[NeedService]]
* [[RecoveryMode]]
* [[SEP-Firmware]]
* [[WTF]]

The table on the right lists the application processors and their corresponding devices. This list is also accessible from the [[Main Page|main page]].

You can use [[img3decrypt]] or [[xpwntool]] to decrypt these files as described in [[Decrypting Firmwares]]. Once done, mount or extract using the tool of your choice.

The firmware version number for the [[List of Apple TVs|Apple TV]] builds are the ones that the Apple TV reports (also known as the "marketing version").

All dates are relative to [[wikipedia:Coordinated Universal Time|UTC]].

GID AES is used by iBoot to decrypt firmware images. When iBoot loads the kernelcache, GID AES is disabled. This means in order to get firmware keys, you must gain code execution in a setting where GID AES is still enabled. In most cases, this means exploiting iBoot itself, before the kernelcache is loaded.

==Firmware Versions==
{{see also|Prototypes}}
This is a full and comprehensive list of all firmwares Apple Inc. has made available to the public in some way, be it the [[Apple Developer|dev center]] or [[iTunes]]. This list also contains a few firmwares for which there never was an IPSW (as far as can be told) such as 4.2.5 for the [[N92AP|CDMA iPhone 4]] (iPhone3,3). These few builds came preinstalled on the device, but are not available for download.

* [[Firmware Keys/1.x|1.x]]
* [[Firmware Keys/2.x|2.x]]
* [[Firmware Keys/3.x|3.x]]
* [[Firmware Keys/4.x|4.x]]
* [[Firmware Keys/5.x|5.x]]
* [[Firmware Keys/6.x|6.x]]
* [[Firmware Keys/7.x|7.x]]
* [[Firmware Keys/8.x|8.x]]
* [[Firmware Keys/9.x|9.x]]
* [[Firmware Keys/10.x|10.x]]
* [[Firmware Keys/11.x|11.x]]

[[Category:Decryption]]

EtasonJB

2017-09-28T13:13:53Z

JonathanSeals:

{{Infobox software
| name = EtasonJB
| title = EtasonJB
| developer = [http://www.twitter.com/tihmstar @tihmstar]
| released = {{Start date|2017|09|19|df=yes}}
| latest release version = RC2
| latest release date = {{Start date and age|2017|09|19|df=yes}}
| programming language =
| operating system = iOS
| language = English
| genre = Jailbreaking
| website = http://tihmstar.net/etasonjb/
}}
'''EtasonJB''' (also spelt '''etasonJB''' and '''#EtasonJB''') is an [[untethered jailbreak]] for all 32-bit devices (except [[Apple TV]]), running iOS 8.4.1. It was developed by [https://twitter.com/tihmstar tihmstar] and exploits the same vulnerabilities as [[Home Depot]]. The first public version, RC2, was released on September 19, 2017 and is installed by sideloading an IPA with [[Cydia Impactor]]. It is, for reasons not yet known, incompatible with the [[iPhone 5]].<ref>[https://twitter.com/tihmstar/status/910119986718560256 @tihmstar on Twitter]: “Seems like #etasonJB doesn't work on iPhone5. Please email me paniclogs and the output of ideviceconsole while jailbreaking”</ref>

== History ==

The development started after [[Phœnix]] was released, and on 6 September, 2017 tihmstar announced that he had ported the Trident exploits to iOS 8.4.1.<ref>[https://twitter.com/tihmstar/status/905417209111080960 @tihmstar on Twitter]: “I ported the Trident exploits to 8.4.1, however as expected HomeDepots kernelpatches/patchfinder needs quite a few changes.”</ref> Regular updates on the development were published, and the name and imminent release were announced eleven days later, on the 17th. The first public release coincided with the release of iOS 11, on the 19th.

The name is a pun on ''eta son'', a phrase commonly used to mock uncivilized “[https://www.reddit.com/r/JelBrek/ jelbrekers]” who beg for an ETA.

=== Version Change Log ===
{| class="wikitable"
|-
! Version
! Date
! Changes
|-
| RC1
| –
|
* Initial release
|-
| RC2
| September 19, 2017
|
* First public release
* Fixes patcyh stuff (thanks to @JonathanSeals)
|}

== External Links ==
* [http://tihmstar.net/etasonjb/ Homepage]

== References ==
<references />

[[Category:Jailbreaks]]
[[Category:Jailbreaking]]

CoolBooter

2017-09-15T04:26:18Z

JonathanSeals:

CoolBooter is a tool for dual booting jailbroken 32-bit iOS devices with another copy of iOS.

{{infobox software
| name = CoolBooter
| title = CoolBooter
| author = [[User:JonathanSeals|Jonathan Seals]]
| developer = [[User:JonathanSeals|Jonathan Seals]]
| discontinued =
| released = {{start date and age|2016|12|25}}
| operating system = [[wikipedia:IOS|iOS]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Utilities
| license = [[wikipedia:Freeware|Freeware]]
| website = [https://coolbooter.com CoolBooter]
}}

== External Links ==
* [https://coolbooter.com/ Official website and Cydia repository]
* @[https://twitter.com/coolbooter CoolBooter] on Twitter

{{stub}}

CoolBooter

2017-09-15T04:22:18Z

JonathanSeals:

CoolBooter is a tool for dual booting jailbroken 32-bit iOS devices with another copy of iOS.

{{infobox software
| name = CoolBooter
| title = CoolBooter
| author = [[User:JonathanSeals|JonathanSeals]]
| developer = [[User:JonathanSeals|JonathanSeals]]
| discontinued =
| released = {{start date and age|2016|12|25}}
| operating system = [[wikipedia:IOS|iOS]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Utilities
| license = [[wikipedia:Freeware|Freeware]]
| website = [https://coolbooter.com CoolBooter]
}}

== External Links ==
* [https://coolbooter.com/ Official website and Cydia repository]
* @[https://twitter.com/coolbooter CoolBooter] on Twitter

{{stub}}

CoolBooter

2017-09-15T04:12:15Z

JonathanSeals: more info

CoolBooter is a tool for dual booting jailbroken 32-bit iOS devices with another copy of iOS.

== External Links ==
* [https://coolbooter.com/ Official website and Cydia repository]

{{stub}}

Ipwndfu

2017-09-15T04:08:47Z

JonathanSeals: more info

{{lowercase}}
{{infobox software
| name = ipwndfu
| title = ipwndfu
| author = [[User:axi0mX|axi0mX]]
| developer = [[User:axi0mX|axi0mX]]
| discontinued =
| released = {{start date and age|2017|04|11}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Jailbreaking
| license = [[wikipedia:Freeware|Freeware]]
| website = [https://github.com/axi0mX/ipwndfu/ GitHub]
}}
'''ipwndfu''' is a [[jailbreak]] utility from [[User:axi0mX|axi0mX]], released on April 11, 2017. It uses the [[alloc8 Exploit]] to achieve an [[untethered jailbreak]] or downgrade on all variants of the [[N88AP|iPhone 3GS]]. It also contains many useful, cross-platform tools for researchers.

==Dependencies==
* [[wikipedia:libusb|libusb]]
* pyusb

==Credit==
* [[User:Geohot|geohot]] - [[limera1n Exploit|limera1n exploit]]

== External Links ==
* [https://github.com/axi0mX/ipwndfu/ Official GitHub repository]

[[Category:Hacking Software]]
[[Category:Jailbreaks]]
[[Category:Jailbreaking]]
[[Category:Downgrading]]

Okemo 12A405 (iPhone5,4)

2017-09-10T23:39:03Z

JonathanSeals: corrected iBEC key

{{keys
| Version = 8.0.2
| Build = 12A405
| Device = iPhone5,4
| Codename = Okemo
| Baseband = 3.09.01
| DownloadURL = http://appldnld.apple.com/iOS8/031-08083.20140925.13BUr/iPhone5,4_8.0.2_12A405_Restore.ipsw

| RootFS = 058-04730-039
| RootFSKey = e16acf43ecf742d400ecc312dd19ca65462850687754fdd7f7414e33994707b0c20782d3

| UpdateRamdisk = 058-04719-039
| UpdateRamdiskIV = dbe6576059c26ed2943434f0620bc4c9
| UpdateRamdiskKey = 7ce50097ae0d517875ab30a2ac0464510cd9bf57517489603c9dac02e1482990

| RestoreRamdisk = 058-04628-039
| RestoreRamdiskIV = 000040d64c24d41fc06f7ad371e62354
| RestoreRamdiskKey = a43a0b1a0690a94e266516a0f964fc3e8b1d2ab10a1765be99656a84a1ea89cc

| AppleLogo = applelogo@2x~iphone.s5l8950x.img3
| AppleLogoIV = 3f21235489e5c5e6092f65c4b63e054e
| AppleLogoKey = 6f175ccf6e6c980ab6d6eb7a80622fde81464a65632b5c1b289e66c52ecec567

| BatteryCharging0 = batterycharging0@2x~iphone.s5l8950x.img3
| BatteryCharging0IV = 5c5ed07d75e56102fea8576ac139eee7
| BatteryCharging0Key = 826d846c57a54ffef170966068f710c02247b72fc7b5e16b6cd2f592b72c23e7

| BatteryCharging1 = batterycharging1@2x~iphone.s5l8950x.img3
| BatteryCharging1IV = eb88c863ed92d4b43afdbb90a44f552c
| BatteryCharging1Key = 7281fead490bd2c262f60b9d9ccdbee964b60e127ad9e513bcf61a020da2857c

| BatteryFull = batteryfull@2x~iphone.s5l8950x.img3
| BatteryFullIV = 933400ada3afbee673e01118b16831f7
| BatteryFullKey = cc62578e3ea833dab8c754e370a1e8ee4898f55d21f30e1e78b68ebc21497ff1

| BatteryLow0 = batterylow0@2x~iphone.s5l8950x.img3
| BatteryLow0IV = 4c6787848b5522e30637eec064d34b09
| BatteryLow0Key = 4c39703ca26565e5f58214c5c0e0825f070102330072698973fec462d5cc83dc

| BatteryLow1 = batterylow1@2x~iphone.s5l8950x.img3
| BatteryLow1IV = cee995763e5ba1d517e2113ae71cad38
| BatteryLow1Key = 2c51c138e700086c26d671cbf4b1190712fec5a3ac5189d9c1604a42f647ccfb

| DeviceTree = DeviceTree.n49ap.img3
| DeviceTreeIV = 6c683611a5b60d2c2fb10524b7887bb7
| DeviceTreeKey = 65460cb6b4b7ad1b30a26bc53707119835a705644910d1d38cba3c2047559ef9

| GlyphPlugin = glyphplugin@2x~iphone-lightning.s5l8950x.img3
| GlyphPluginIV = 69bfa628da78321ca326f488428ccf02
| GlyphPluginKey = f697c804e5191ec57c7c57b872aa5801dbc6bb25f6a4e726a250f58bb6eef5ff

| iBEC = iBEC.n49ap.RELEASE.dfu
| iBECIV = 10d2f66b8c8c782bac9f223039cd6f4e
| iBECKey = a7eae07c7d668c432d8eef22c84d264c62409becdd6cedd5377315d45e746679

| iBoot = iBoot.n49ap.RELEASE.img3
| iBootIV = 11bab8bb4b6ae0c73026e0d13351d694
| iBootKey = 45d3256ba0c80e542fac1e7542cde958d2e626e85a5b61bd9111e452296416f5

| iBSS = iBSS.n49ap.RELEASE.dfu
| iBSSIV = 7a83df0f4a07a83fc9057442e8b68bf3
| iBSSKey = 56bc092d675cb76e40130163781de024a9d3ed8d0d8f6423b50b2f77568cb23a

| Kernelcache = kernelcache.release.n49
| KernelcacheIV = aed30d92102d0f96e285d817fb1af3a8
| KernelcacheKey = c85aba63ca0b3fcd8c218051ab65ed64c2ba385cdcf08c4edec29b7838b098d6

| LLB = LLB.n49ap.RELEASE.img3
| LLBIV = 4dc550fe8704b004773dc210075e5978
| LLBKey = 470dd5f90a2667e6d84e74155467b9d70ceb18d9fb6e9de0a8f213ccc8273f96

| RecoveryMode = recoverymode@1136~iphone-lightning.s5l8950x.img3
| RecoveryModeIV = 72c3908b598ce6379f8b14cfb757877e
| RecoveryModeKey = 4f95b271e28f22625eb303357d792bf2e62c12a546d7e3d258af0df982d0a003
}}

InnsbruckTaos 11B554a (iPhone5,1)

2017-08-13T17:39:23Z

JonathanSeals: Fixed KernelCache key.

{{keys
| Version = 7.0.4
| Build = 11B554a
| Device = iPhone5,1
| Codename = InnsbruckTaos
| Baseband = 5.02.00
| DownloadURL = http://appldnld.apple.com/iOS7/031-1700.20131114.P3wE4/iPhone5,1_7.0.4_11B554a_Restore.ipsw

| RootFS = 058-1123-002
| RootFSKey = c22c513d281dcaecbbcae2308baf29eb00fc750a1aa0d0bcf840d3cb4422f920ae99f14c

| UpdateRamdisk = 058-1106-002
| UpdateRamdiskIV = 3605825868830869dc11ee8946ea8afd
| UpdateRamdiskKey = b378c3f0655084942aa10aa4b4715e2fa4dc1565882916512bb181a415ea8364

| RestoreRamdisk = 058-1089-002
| RestoreRamdiskIV = 8940ebeec479495d909153be0bdbc5e6
| RestoreRamdiskKey = 6fc6e536725f33b5709a1007c20a368edae3bf04727568e2c5453e6e302403c2

| AppleLogo = applelogo@2x~iphone.s5l8950x.img3
| AppleLogoIV = b2f669b628697fb0adaac1fcf457a743
| AppleLogoKey = 3c1057501b2ef53d0c396c3dca0ad48eaa209ae101accf4ec1d54159351837ef

| BatteryCharging0 = batterycharging0@2x~iphone.s5l8950x.img3
| BatteryCharging0IV = 95bfa5124d0c4c6d70218f95fe125664
| BatteryCharging0Key = 6d9b96092b8f2de03bd83c926881e4e9ab7b498dad92678c4ea06010f3857f18

| BatteryCharging1 = batterycharging1@2x~iphone.s5l8950x.img3
| BatteryCharging1IV = 33337657626e9c614624889a1c208f12
| BatteryCharging1Key = 2e5a4f62827cc3f6086d3cfd7850d2e919de5859d84384e3993b959f4b865153

| BatteryFull = batteryfull@2x~iphone.s5l8950x.img3
| BatteryFullIV = dab9b11c6ee38a8a37075ffffcec77bf
| BatteryFullKey = a8825bc42ea427e1f3b13b95875d66589fa91131a44ab2f0bd7dc0c3e7cc57f1

| BatteryLow0 = batterylow0@2x~iphone.s5l8950x.img3
| BatteryLow0IV = 8456f9ecc378c857f88d28d7b19ad13b
| BatteryLow0Key = 81a25c905cc8c1e139f34c7beccd483b032be8537eb90202389948f4b9cae4b2

| BatteryLow1 = batterylow1@2x~iphone.s5l8950x.img3
| BatteryLow1IV = bd97713eb2f58b5810db8cfb73daf4c0
| BatteryLow1Key = b4022ce89e8b307da1c8394395711a604cde984ca039f6d3f8498e1a787aae33

| DeviceTree = DeviceTree.n41ap.img3
| DeviceTreeIV = d99aa06ace855bebb2fc9c0a6c087e5c
| DeviceTreeKey = d6b0d5ca19e08eac1325e7a87eb6d6509f5ac46724adbd3785e2d515cafaa4c8

| GlyphPlugin = glyphplugin@1136~iphone-lightning.s5l8950x.img3
| GlyphPluginIV = 2b0cc68490f21685b780e63119fea1f1
| GlyphPluginKey = edf17df994cc5485e2421239aead0caf6fb51e471f50833a1ec4f1e1d68fef5c

| iBEC = iBEC.n41ap.RELEASE.dfu
| iBECIV = 7ca6012f2c16ee62879e5476aec76621
| iBECKey = bea85da6bb61305bf8843f80a2e114a18e062492bd5976722414fd98721b515e

| iBoot = iBoot.n41ap.RELEASE.img3
| iBootIV = 142d8a234d7449eb2bc5644ed7377134
| iBootKey = 633dfc256adde0069d4373082890f585268c3c1fc5d55ee6aa4f819684ccf4fa

| iBSS = iBSS.n41ap.RELEASE.dfu
| iBSSIV = b76f278a5f6b24937b071460c234bcde
| iBSSKey = b55a091e39f79eba5f90fd8300923fe17d02bb91eff4f97a8a3887909100e42a

| Kernelcache = kernelcache.release.n41
| KernelcacheIV = 4f1dcfe7933ad13736ee2ff0ad2dafe6
| KernelcacheKey = 516037f37d47f25c85bfa9a83db2ae298a64552ed6ebcfb311754a83be7f7a33

| LLB = LLB.n41ap.RELEASE.img3
| LLBIV = f5a6c26a33a6c461db4767b1dde7d02d
| LLBKey = e325f7a99a3c6e9d24f81b3b8ec4463579197d7254c922f40fe50047a377f3da

| RecoveryMode = recoverymode@1136~iphone-lightning.s5l8950x.img3
| RecoveryModeIV = 976b7610d1f4a6d16970f10b9773752a
| RecoveryModeKey = 14918ba534d4de541e9b4d08cfb8169db45c4327baddf751cc89f721d22859cb
}}

IDeviceReRestore

2017-05-02T01:36:56Z

JonathanSeals:

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0.1 (Windows) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Windows|Windows]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:GNU Lesser General Public License|GNU LGPL 2.1]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool based off of [https://cgit.sukimashita.com/idevicerestore.git/ idevicerestore] that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. It uses a bug discovered in 32-bit versions of iOS 9.x [[iBoot (Bootloader)|iBoot]]'s APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce.

The bug only exists in iOS 9, but it does not require you to currently run iOS 9 to use it. The reasoning being, due to the fact that all 32-bit bootroms (other than [[Apple Watch]]) verify the next bootloader, [[iBSS]], based on SHSH when in [[DFU Mode]] rather than with APTicket, with no enforcement of APNonce, you can always boot into your iBSS you have cached blobs for, via DFU mode, regardless of your current APNonce. Furthermore, 9.x iBSS has the same bug as all other 9.x 32-bit iBoot, and so you can continue a restore straight from there. On a firmware without the bug, or when using an iOS 9.x APTicket with an APNonce, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

== Notes ==
* iDeviceReRestore works for 32-bit iOS devices only. (Apple Watch is not included.)
* The initial firmware does not matter.
* The initial firmware does not require a [[jailbreak]].
* The destination firmware must be iOS 9.x. [[SHSH]] blobs for the destination firmware are required.
* The process does not require [[Firmware Keys|keys]], bundles, or nonces.
** The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
** They must have been saved without a nonce.
** Restores from DFU require a cached iBSS SHSH blob (dumped blobs will not include this).
** Most tickets saved by [[Cydia]] seem to be usable for this, and include iBSS SHSH blobs.
* The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 9 and 10, most devices (if not all) should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
* iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]]. Devices on other firmwares must be restored from [[DFU Mode]].

[[Category:Hacking Software]]
[[Category:Downgrading]]

IDeviceReRestore

2017-05-02T01:36:09Z

JonathanSeals:

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Windows|Windows]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:GNU Lesser General Public License|GNU LGPL 2.1]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool based off of [https://cgit.sukimashita.com/idevicerestore.git/ idevicerestore] that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. It uses a bug discovered in 32-bit versions of iOS 9.x [[iBoot (Bootloader)|iBoot]]'s APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce.

The bug only exists in iOS 9, but it does not require you to currently run iOS 9 to use it. The reasoning being, due to the fact that all 32-bit bootroms (other than [[Apple Watch]]) verify the next bootloader, [[iBSS]], based on SHSH when in [[DFU Mode]] rather than with APTicket, with no enforcement of APNonce, you can always boot into your iBSS you have cached blobs for, via DFU mode, regardless of your current APNonce. Furthermore, 9.x iBSS has the same bug as all other 9.x 32-bit iBoot, and so you can continue a restore straight from there. On a firmware without the bug, or when using an iOS 9.x APTicket with an APNonce, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

== Notes ==
* iDeviceReRestore works for 32-bit iOS devices only. (Apple Watch is not included.)
* The initial firmware does not matter.
* The initial firmware does not require a [[jailbreak]].
* The destination firmware must be iOS 9.x. [[SHSH]] blobs for the destination firmware are required.
* The process does not require [[Firmware Keys|keys]], bundles, or nonces.
** The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
** They must have been saved without a nonce.
** Restores from DFU require a cached iBSS SHSH blob (dumped blobs will not include this).
** Most tickets saved by [[Cydia]] seem to be usable for this, and include iBSS SHSH blobs.
* The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 9 and 10, most devices (if not all) should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
* iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]]. Devices on other firmwares must be restored from [[DFU Mode]].

[[Category:Hacking Software]]
[[Category:Downgrading]]

IDeviceReRestore

2017-04-18T21:34:37Z

JonathanSeals:

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:GNU Lesser General Public License|GNU LGPL 2.1]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool based off of [https://cgit.sukimashita.com/idevicerestore.git/ idevicerestore] that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. It uses a bug discovered in 32-bit versions of iOS 9.x [[iBoot (Bootloader)|iBoot]]'s APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce.

The bug only exists on iOS 9.x, however does not require you to currently run iOS 9 to use it. The reasoning being, due to the fact that all 32-bit bootroms (other than [[Apple Watch]]) verify the next bootloader, [[iBSS]], based on SHSH when in [[DFU Mode]] rather than with APTicket, with no enforcement of APNonce, you can always boot into your iBSS you have cached blobs for, via DFU mode, regardless of your current APNonce. Furthermore, 9.x iBSS has the same bug as all other 9.x 32 bit iBoot, and so you can continue a restore straight from there, whereas on a firmware without the bug, or when using an iOS 9.x APTicket with an APNonce, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

== Notes ==
* iDeviceReRestore works for 32-bit iOS devices only. (Apple Watch is not included.)
* The initial firmware does not matter.
* The initial firmware does not require a [[jailbreak]].
* The destination firmware must be iOS 9.x. [[SHSH]] blobs for the destination firmware are required.
* The process does not require [[Firmware Keys|keys]], bundles, or nonces.
** The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
** They must have been saved without a nonce.
** Restores from DFU require a cached iBSS SHSH blob (dumped blobs will not include this).
** Most tickets saved by [[Cydia]] seem to be usable for this, and include iBSS SHSH blobs.
* The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 9 and 10, most devices (if not all) should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
* iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]]. Devices on other firmwares must be restored from [[DFU Mode]].

[[Category:Hacking Software]]
[[Category:Downgrading]]

IDeviceReRestore

2017-04-18T02:16:15Z

JonathanSeals: No OTA basebands are used by iDeviceReRestore, only latest.

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:GNU Lesser General Public License|GNU LGPL 2.1]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool based off of [https://cgit.sukimashita.com/idevicerestore.git/ idevicerestore] that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. It uses a bug discovered in 32-bit versions of iOS 9.x [[iBoot (Bootloader)|iBoot]]'s APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce.

The bug only exists on iOS 9.x, however does not require you to currently run iOS 9 to use. The reasoning being, due to the fact that all 32-bit bootroms (other than [[Apple Watch]]) verify the next bootloader, [[iBSS]], based on SHSH when in [[DFU Mode]] rather than with APTicket, with no enforcement of APNonce, you can always boot into your iBSS you have cached blobs for, via DFU mode, regardless of your current APNonce. Furthermore, 9.x iBSS has the same bug as all other 9.x 32 bit iBoot, and so you can continue a restore straight from there, whereas on a firmware without the bug, or when using an iOS 9.x APTicket with an APNonce, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

== Notes ==
* iDeviceReRestore works for 32-bit iOS devices only. (Apple Watch is not included.)
* The initial firmware does not matter.
* The initial firmware does not require a [[jailbreak]].
* The destination firmware must be iOS 9.x. [[SHSH]] blobs for the destination firmware are required.
* The process does not require [[Firmware Keys|keys]], bundles, or nonces.
** The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
** They must have been saved without a nonce.
** Restores from DFU require a cached iBSS SHSH blob (dumped blobs will not include this).
** Most tickets saved by [[Cydia]] seem to be usable for this, and include iBSS SHSH blobs.
* The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 9 and 10, most devices (if not all) should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
* iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]]. Devices on other firmwares must be restored from [[DFU Mode]].

[[Category:Hacking Software]]
[[Category:Downgrading]]

IDeviceReRestore

2017-04-18T02:14:00Z

JonathanSeals:

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:GNU Lesser General Public License|GNU LGPL 2.1]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool based off of [https://cgit.sukimashita.com/idevicerestore.git/ idevicerestore] that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. It uses a bug discovered in 32-bit versions of iOS 9.x [[iBoot (Bootloader)|iBoot]]'s APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce.

The bug only exists on iOS 9.x, however does not require you to currently run iOS 9 to use. The reasoning being, due to the fact that all 32-bit bootroms (other than [[Apple Watch]]) verify the next bootloader, [[iBSS]], based on SHSH when in [[DFU Mode]] rather than with APTicket, with no enforcement of APNonce, you can always boot into your iBSS you have cached blobs for, via DFU mode, regardless of your current APNonce. Furthermore, 9.x iBSS has the same bug as all other 9.x 32 bit iBoot, and so you can continue a restore straight from there, whereas on a firmware without the bug, or when using an iOS 9.x APTicket with an APNonce, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

== Notes ==
* iDeviceReRestore works for 32-bit iOS devices only. (Apple Watch is not included.)
* The initial firmware does not matter.
* The initial firmware does not require a [[jailbreak]].
* The destination firmware must be iOS 9.x. [[SHSH]] blobs for the destination firmware are required.
* The process does not require [[Firmware Keys|keys]], bundles, or nonces.
** The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
** They must have been saved without a nonce.
** Restores from DFU require a cached iBSS SHSH blob (dumped blobs will not include this).
** Most tickets saved by [[Cydia]] seem to be usable for this, and include iBSS SHSH blobs.
* The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 10 and the signed OTA basebands, most devices (if not all) should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
* iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]]. Devices on other firmwares must be restored from [[DFU Mode]].

[[Category:Hacking Software]]
[[Category:Downgrading]]

IDeviceReRestore

2017-04-18T02:12:25Z

JonathanSeals:

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:GNU Lesser General Public License|GNU LGPL 2.1]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool based off of [https://cgit.sukimashita.com/idevicerestore.git/ idevicerestore] that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. It uses a bug discovered in 32-bit versions of iOS 9.x [[iBoot (Bootloader)|iBoot]]'s APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce.

The bug only exists on iOS 9.x, however does not require you to currently run iOS 9 to use. The reasoning being, due to the fact that all 32-bit bootroms (other than [[Apple Watch]]) verify the next bootloader, [[iBSS]], based on SHSH when in [[DFU Mode]] rather than with APTicket, with no enforcement of APNonce, you can always boot into your iBSS you have cached blobs for, via DFU mode, regardless of your current APNonce. Furthermore, 9.x iBSS has the same bug as all other 9.x 32 bit iBoot, and so you can continue a restore straight from there, whereas on a firmware without the bug, or when using an iOS 9.x APTicket with an APNonce, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

== Notes ==
* iDeviceReRestore works for 32-bit iOS devices only. (Apple Watch is not included.)
* The initial firmware does not matter.
* The initial firmware does not require a [[jailbreak]].
* The destination firmware must be iOS 9.x. [[SHSH]] blobs for the destination firmware are required.
* The process does not require [[Firmware Keys|keys]], bundles, or nonces.
** The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
** They must have been saved without a nonce.
** If they begin with the string ''MIIKkj'', they are definitely fine. If they do not, they may also be fine, but will need checking to make sure.
** Restores from DFU require a cached iBSS SHSH blob (dumped blobs will not include this).
** Most tickets saved by [[Cydia]] seem to be usable for this, and include iBSS SHSH blobs.
* The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 10 and the signed OTA basebands, most devices (if not all) should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
* iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]]. Devices on other firmwares must be restored from [[DFU Mode]].

[[Category:Hacking Software]]
[[Category:Downgrading]]

IDeviceReRestore

2017-04-18T02:11:28Z

JonathanSeals: There is no separate ticket requirement for DFU restores. iBSS SHSH blobs are needed, however.

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:GNU Lesser General Public License|GNU LGPL 2.1]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool based off of [https://cgit.sukimashita.com/idevicerestore.git/ idevicerestore] that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. It uses a bug discovered in 32-bit versions of iOS 9.x [[iBoot (Bootloader)|iBoot]]'s APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce.

The bug only exists on iOS 9.x, however does not require you to currently run iOS 9 to use. The reasoning being, due to the fact that all 32-bit bootroms (other than [[Apple Watch]]) verify the next bootloader, [[iBSS]], based on SHSH when in [[DFU Mode]] rather than with APTicket, with no enforcement of APNonce, you can always boot into your iBSS you have cached blobs for, via DFU mode, regardless of your current APNonce. Furthermore, 9.x iBSS has the same bug as all other 9.x 32 bit iBoot, and so you can continue a restore straight from there, whereas on a firmware without the bug, or when using an iOS 9.x APTicket with an APNonce, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

== Notes ==
* iDeviceReRestore works for 32-bit iOS devices only. (Apple Watch is not included.)
* The initial firmware does not matter.
* The initial firmware does not require a [[jailbreak]].
* The destination firmware must be iOS 9.x. [[SHSH]] blobs for the destination firmware are required.
* The process does not require [[Firmware Keys|keys]], bundles, or nonces.
** The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
** They must have been saved without a nonce.
** If they begin with the string ''MIIKkj'', they are definitely fine. If they do not, they may also be fine, but will need checking to make sure.
** Restores from DFU require a cached iBSS SHSH blob (dumped blobs will not include this).
** Most tickets saved by [[Cydia]] seem to be usable for this.
* The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 10 and the signed OTA basebands, most devices (if not all) should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
* iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]]. Devices on other firmwares must be restored from [[DFU Mode]].

[[Category:Hacking Software]]
[[Category:Downgrading]]

IDeviceReRestore

2017-04-17T22:04:46Z

JonathanSeals:

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:GNU Lesser General Public License|GNU LGPL 2.1]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool based off of [https://cgit.sukimashita.com/idevicerestore.git/ idevicerestore] that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. It uses a bug discovered in 32-bit versions of iOS 9.x [[iBoot (Bootloader)|iBoot]]'s APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce.

The bug only exists on iOS 9.x, however does not require you to currently run iOS 9 to use. The reasoning being, due to the fact that all 32-bit bootroms (other than [[Apple Watch]]) verify the next bootloader, [[iBSS]], based on SHSH when in [[DFU Mode]] rather than with APTicket, with no enforcement of APNonce, you can always boot into your iBSS you have cached blobs for, via DFU mode, regardless of your current APNonce. Furthermore, 9.x iBSS has the same bug as all other 9.x 32 bit iBoot, and so you can continue a restore straight from there, whereas on a firmware without the bug, or when using an iOS 9.x APTicket with an APNonce, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

== Notes ==
* iDeviceReRestore works for 32-bit iOS devices only. (Apple Watch is not included.)
* The initial firmware does not matter.
* The initial firmware does not require a [[jailbreak]].
* The destination firmware must be iOS 9.x. [[SHSH]] blobs for the destination firmware are required.
* The process does not require [[Firmware Keys|keys]], bundles, or nonces.
** The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
** They must have been saved without a nonce.
** If they begin with the string ''MIIKkj'', they are definitely fine. If they do not, they may also be fine, but will need checking to make sure.
** The blobs must have a separate [[iBSS]] ticket to be used for DFU restores. If they don’t, they can only be used for iOS 9 -> iOS 9 restores.
** Most tickets saved by [[Cydia]] seem to be usable for this.
* The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 10 and the signed OTA basebands, most devices (if not all) should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
* iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]]. Devices on other firmwares must be restored from [[DFU Mode]].

[[Category:Hacking Software]]
[[Category:Downgrading]]

IDeviceReRestore

2017-04-17T22:03:44Z

JonathanSeals: Clarifications.

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:GNU Lesser General Public License|GNU LGPL 2.1]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool based off of [https://cgit.sukimashita.com/idevicerestore.git/ idevicerestore] that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. It uses a bug discovered in 32-bit versions of iOS 9.x [[iBoot (Bootloader)|iBoot]]'s APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce.

The bug only exists on iOS 9.x, however does not require you to currently run iOS 9 to use. The reasoning being, due to the fact that all 32-bit bootroms (other than [[Apple Watch]]) verify the next bootloader, [[iBSS]], based on SHSH when in [[DFU Mode]] rather than with APTicket, with no enforcement of APNonce, you can always boot into your iBSS you have cached blobs for, via DFU mode. Furthermore, 9.x iBSS has the same bug as all other 9.x 32 bit iBoot, and so you can continue a restore straight from there, whereas on a firmware without the bug, or when using an iOS 9.x APTicket with an APNonce, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

== Notes ==
* iDeviceReRestore works for 32-bit iOS devices only. (Apple Watch is not included.)
* The initial firmware does not matter.
* The initial firmware does not require a [[jailbreak]].
* The destination firmware must be iOS 9.x. [[SHSH]] blobs for the destination firmware are required.
* The process does not require [[Firmware Keys|keys]], bundles, or nonces.
** The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
** They must have been saved without a nonce.
** If they begin with the string ''MIIKkj'', they are definitely fine. If they do not, they may also be fine, but will need checking to make sure.
** The blobs must have a separate [[iBSS]] ticket to be used for DFU restores. If they don’t, they can only be used for iOS 9 -> iOS 9 restores.
** Most tickets saved by [[Cydia]] seem to be usable for this.
* The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 10 and the signed OTA basebands, most devices (if not all) should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
* iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]]. Devices on other firmwares must be restored from [[DFU Mode]].

[[Category:Hacking Software]]
[[Category:Downgrading]]

IDeviceReRestore

2017-04-17T21:52:57Z

JonathanSeals:

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:GNU Lesser General Public License|GNU LGPL 2.1]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool based off of [https://cgit.sukimashita.com/idevicerestore.git/ idevicerestore] that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. It uses a bug discovered in 32-bit versions of iOS 9.x [[iBoot (Bootloader)|iBoot]]'s APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce. The bug only exists on iOS 9.x.

Due to the fact that when in [[DFU Mode]], the device is waiting to verify a signed firmware component, which is [[iBSS]]. When a signed iBSS is uploaded, we are not technically evading any security mechanism at this point, as all 32 bit iOS bootroms (other than [[Apple Watch]]) only verify based on SHSH and never care about APNonce. Furthermore, 9.x iBSS has the same bug as all other 9.x 32 bit iBoot, and so you can continue a restore straight from there, whereas on a firmware without the bug, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

== Notes ==
* iDeviceReRestore works for 32-bit iOS devices only. (Apple Watch is not included.)
* The initial firmware does not matter.
* The initial firmware does not require a [[jailbreak]].
* The destination firmware must be iOS 9.x. [[SHSH]] blobs for the destination firmware are required.
* The process does not require [[Firmware Keys|keys]], bundles, or nonces.
** The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
** They must have been saved without a nonce.
** If they begin with the string ''MIIKkj'', they are definitely fine. If they do not, they may also be fine, but will need checking to make sure.
** The blobs must have a separate [[iBSS]] ticket to be used for DFU restores. If they don’t, they can only be used for iOS 9 -> iOS 9 restores.
** Most tickets saved by [[Cydia]] seem to be usable for this.
* The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 10 and the signed OTA basebands, most devices (if not all) should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
* iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]]. Devices on other firmwares must be restored from [[DFU Mode]].

[[Category:Hacking Software]]
[[Category:Downgrading]]

IDeviceReRestore

2017-04-17T21:52:04Z

JonathanSeals:

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:GNU Lesser General Public License|GNU LGPL 2.1]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool based off of [https://cgit.sukimashita.com/idevicerestore.git/ idevicerestore] that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. It uses a bug discovered in 32-bit versions of iOS 9.x [[iBoot (Bootloader)|iBoot]]'s APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce. The bug was patched in iOS 10, and does not exist in iOS 8 or lower.

Due to the fact that when in [[DFU Mode]], the device is waiting to verify a signed firmware component, which is [[iBSS]]. When a signed iBSS is uploaded, we are not technically evading any security mechanism at this point, as all 32 bit iOS bootroms (other than [[Apple Watch]]) only verify based on SHSH and never care about APNonce. Furthermore, 9.x iBSS has the same bug as all other 9.x 32 bit iBoot, and so you can continue a restore straight from there, whereas on a firmware without the bug, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

== Notes ==
* iDeviceReRestore works for 32-bit iOS devices only. (Apple Watch is not included.)
* The initial firmware does not matter.
* The initial firmware does not require a [[jailbreak]].
* The destination firmware must be iOS 9.x. [[SHSH]] blobs for the destination firmware are required.
* The process does not require [[Firmware Keys|keys]], bundles, or nonces.
** The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
** They must have been saved without a nonce.
** If they begin with the string ''MIIKkj'', they are definitely fine. If they do not, they may also be fine, but will need checking to make sure.
** The blobs must have a separate [[iBSS]] ticket to be used for DFU restores. If they don’t, they can only be used for iOS 9 -> iOS 9 restores.
** Most tickets saved by [[Cydia]] seem to be usable for this.
* The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 10 and the signed OTA basebands, most devices (if not all) should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
* iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]]. Devices on other firmwares must be restored from [[DFU Mode]].

[[Category:Hacking Software]]
[[Category:Downgrading]]

IDeviceReRestore

2017-04-17T05:08:01Z

JonathanSeals:

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:Freeware|Freeware]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. The tool is based off [http://libimobiledevice.org/ iDeviceRestore by libimobiledevice].

iDeviceReRestore uses a bug discovered in 32 bit iOS 9.x iBoot's APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce. The bug has been patched as of iOS 10, however due to the fact that when in [[DFU Mode]], the device is waiting to verify a signed firmware component, which is [[iBSS]]. When a signed iBSS is uploaded, we are not technically evading any security mechanism at this point, as all 32 bit iOS bootroms (other than Apple Watch) only verify based on SHSH and never care about APNonce. Furthermore, 9.x iBSS has the same bug as all other 9.x 32 bit iBoot, and so you can continue a restore straight from there, whereas on a firmware without the bug, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

==Details==
*iDeviceReRestore works for 32-bit devices only (excluding the Apple Watch).
*The destination firmware must be iOS 9.x.
*The starting firmware does not matter.
*The starting firmware does not require a [[jailbreak]].
*The process does not require [[Firmware Keys|keys]], bundles, or nonces.
*The process requires [[SHSH]] blobs for the destination firmware.
**The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
**They must have been saved without a nonce.
**If they begin with the string ''MIIKkj'', they are definitely fine. If they do not, they may also be fine, but will need checking to make sure.
**Most tickets saved by Cydia seem to be usable for this.
*The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 10 and the signed OTA basebands most, if not all, devices should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
*iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]], iOS ≠9 -> iOS 9 restores must be done from [[DFU Mode]].
*The blobs must have a separate [[iBSS]] ticket to be used for DFU restores. If they don’t, they can only be used for iOS 9 -> iOS 9 restores.

[[Category:Hacking Software]]
[[Category:Downgrading]]

IDeviceReRestore

2017-04-17T05:06:16Z

JonathanSeals:

{{lowercase}}
{{infobox software
| name = iDeviceReRestore
| title = iDeviceReRestore
| author = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| developer = [https://twitter.com/alitek123 alitek123], [https://twitter.com/Thmitt Trevor], [https://twitter.com/JonathanSeals Jonathan Seals]
| discontinued =
| released = {{start date and age|2017|04|02}}
| latest release version = 1.0.2 (macOS) / 1.0 (Linux)
| latest release date = {{Start date and age|2017|04|10}}
| operating system = [[wikipedia:macOS|macOS]] / [[wikipedia:Linux|Linux]]
| language = [[wikipedia:English|English]]
| status = Active
| genre = Downgrading
| license = [[wikipedia:Freeware|Freeware]]
| website = [https://downgrade.party iDeviceReRestore]
}}
'''iDeviceReRestore''' is a tool that can be used to downgrade 32-bit devices to any iOS 9 version, provided the user has [[SHSH]] blobs for the version. The tool is based off [http://libimobiledevice.org/ iDeviceRestore by libimobiledevice].

iDeviceReRestore uses a bug discovered in 32 bit iOS 9.x iBoot's APTicket verification routines which allows valid cached tickets with a missing APNonce, regardless of the current nonce. The bug has been patched as of iOS 10, however due to the fact that when in [[DFU Mode]], the device is waiting to verify a signed firmware component, which is [[iBSS]]. When a signed iBSS is uploaded, we are not technically evading any security mechanism at this point, as all 32 bit iOS bootroms (other than Apple Watch) only verify based on SHSH and never care about APNonce, however, 9.x iBSS has the same bug as all other 9.x 32 bit iBoot, and so you can continue a restore straight from there, whereas on a firmware without the bug, iBSS will not accept your APTicket, and will not continue into the rest of the restore chain.

==Details==
*iDeviceReRestore works for 32-bit devices only (excluding the Apple Watch).
*The destination firmware must be iOS 9.x.
*The starting firmware does not matter.
*The starting firmware does not require a [[jailbreak]].
*The process does not require [[Firmware Keys|keys]], bundles, or nonces.
*The process requires [[SHSH]] blobs for the destination firmware.
**The SHSH blobs cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work.
**They must have been saved without a nonce.
**If they begin with the string ''MIIKkj'', they are definitely fine. If they do not, they may also be fine, but will need checking to make sure.
**Most tickets saved by Cydia seem to be usable for this.
*The technique requires a signed [[baseband]], like [[Prometheus]]. However, between the currently signed basebands for iOS 10 and the signed OTA basebands most, if not all, devices should be able to get a working baseband without issues. The tool automatically downloads the latest baseband available per device.
*iOS 9 -> iOS 9 restores can be done from [[Recovery Mode]], iOS ≠9 -> iOS 9 restores must be done from [[DFU Mode]].
*The blobs must have a separate [[iBSS]] ticket to be used for DFU restores. If they don’t, they can only be used for iOS 9 -> iOS 9 restores.

[[Category:Hacking Software]]
[[Category:Downgrading]]