Difference between revisions of "DFU Mode"

From The iPhone Wiki
Jump to: navigation, search
(Entering DFU Mode on iPhone, iPad or iPod touch)
(GPIO pin information; creating GPIO soon...)
(7 intermediate revisions by 6 users not shown)
Line 1: Line 1:
'''DFU''' or '''Device Firmware Upgrade''' mode allows all devices to be restored from any state. It is essentially a mode where the BootROM can accept iBSS. DFU is burned into the hardware, so it cannot be removed. On A7+ devices, it generates an ApNonce and recognizes APTickets as well, so even in DFU, it can accept an APTicket.
+
'''DFU''' or '''Device Firmware Upgrade''' mode allows all devices to be restored from any state. It is essentially a mode where the BootROM can accept iBSS. DFU is part of the [[Bootrom|SecureROM]] which is burned into the hardware, so it cannot be removed. On A7+ devices, it generates an ApNonce and recognizes APTickets as well, so even in DFU, it can accept an APTicket.
   
==DFU Mode==
+
== Entering DFU Mode ==
  +
NOTE: If you are using a USB-C cable to enter DFU mode, it might not work. If this happens, you need to use the normal USB cable. You can use a normal USB cable and a USB to USB-C adaptor.
===Entering DFU Mode on iPhone, iPad or iPod touch===
 
  +
=== Apple TV ===
# Plug your device into your computer with a USB cable.
 
# Hold the Power button for 3 seconds.
+
# Force the device to reboot by holding down the "Menu" and "Down" buttons simultaneously for 6-7 seconds.
  +
# Press "Menu" and "Play" simultaneously right after reboot, until a message pops up in [[iTunes]], saying that it has detected an Apple TV in Recovery Mode.
# Hold the Home and Power buttons for 10 seconds.
 
# Turn off the device.
+
# Plug the device into your computer using a Micro-USB cable.
# Release the Power button but keep holding the Home button.
 
# After about 15 seconds you will be alerted by iTunes saying that it has detected a device in Recovery Mode.
 
   
  +
=== A9 and older devices (iPad other than the ones listed below, iPhone 6s and below, iPhone SE and iPod touch 6 and below) ===
'''Make sure the device screen is blank and no logos are present'''
 
  +
# Connect the device to a computer using a USB cable.
  +
# Hold down both the Home button and Lock button.
  +
# After 8 seconds, release the Lock button while continuing to hold down the Home button.
  +
#* If the Apple logo appears, the Lock button was held down for too long.
  +
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
  +
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.
   
  +
=== A10 devices (iPhone 7 and iPhone 7 Plus, iPad 2018, iPod touch 7) ===
Alternative way:
 
  +
# Connect the device to a computer using a USB cable.
  +
# Hold down both the Side button and Volume Down button.
  +
# After 8 seconds, release the Side button while continuing to hold down the Volume Down button.
  +
#* If the Apple logo appears, the Side button was held down for too long.
  +
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
  +
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.
   
  +
=== A11 and newer devices (iPhone 8 and above, iPad Pro 2018, iPad Air 2019, iPad Mini 2019) ===
# Plug in your device to your computer via a USB cable.
 
  +
# Connect the device to a computer using a USB cable.
# Hold both the Power and Home button.
 
  +
# Quick-press the Volume Up button
# Wait 1 second after the screen flickers off.
 
  +
# Quick-press the Volume Down button
# Let go of Power but keep holding Home.
 
  +
# Hold down the Side button until the screen goes black, then hold down both the Side button and Volume Down button.
# iTunes will prompt you that your device has entered Recovery and needs to be restored.
 
  +
# After 5 seconds, release the Side button while continuing to hold down the Volume Down button.
  +
#* If the Apple logo appears, the Side button was held down for too long.
  +
# Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
  +
#* If your device shows a screen telling you to connect the device to iTunes, retry these steps.
   
  +
=== GPIO Pins ===
'''If you see a connect to iTunes logo on your device; You failed. Try again'''
 
  +
If you have access to the SoC, you can either perform the above methods for your device by utilizing the <code>GPIO_REQUEST_DFU1</code> and <code>GPIO_REQUEST_DFU2</code> GPIO pins (previously <code>HOLD_KEY</code> and <code>MENU_KEY</code> and corresponding to Power and Home/Vol-, respectively) or by setting your board's <code>GPIO_FORCE_DFU</code> pin to 1 at SecureROM startup (unless you are using an [[iFPGA]], where Force DFU mode is the default).
   
  +
The corresponding GPIO pins for each SoC varies, and the most important ones (including the DFU pins) are listed on the [[GPIO]] page.
===Exiting DFU Mode on iPhone, iPad or iPod touch===
 
# Hold the Home and Power buttons until the Apple Logo appears.
 
   
===Entering DFU Mode on Apple TV===
+
== Exiting DFU Mode ==
  +
To exit DFU Mode, simply force restart your device.
# Plug the device into your computer using a microUSB cable.
 
# Force the device to reboot by holding down the "Menu" and "Down" buttons simultaneously for 6-7 seconds.
 
# Press "Menu" and "Play" simultaneously right after reboot, until a message pops up in [[iTunes]], saying that it has detected an Apple TV in Recovery Mode.
 
   
  +
* For Apple TV, hold down the "Menu" and "Down" buttons on your remote until the Apple TV reboots.
===Exiting DFU Mode on Apple TV===
 
  +
* For iPad, iPhone 6s and below, iPhone SE and iPod touch, hold the Home button and the Lock button until the device reboots.
# Hold down the "Menu" and "Down" buttons. The Apple TV will reboot.
 
  +
* For iPhone 7 and iPhone 7 Plus, hold down the Side button and Volume Down button until the device reboots.
  +
* For iPhone 8, iPhone 8 Plus, and iPhone X, quick-press the Volume Up button, then quick-press the Volume Down button, then hold down the Side button until the device reboots.
   
 
==Enter True Hardware DFU Mode Automatically==
 
==Enter True Hardware DFU Mode Automatically==

Revision as of 18:35, 18 April 2020

DFU or Device Firmware Upgrade mode allows all devices to be restored from any state. It is essentially a mode where the BootROM can accept iBSS. DFU is part of the SecureROM which is burned into the hardware, so it cannot be removed. On A7+ devices, it generates an ApNonce and recognizes APTickets as well, so even in DFU, it can accept an APTicket.

Entering DFU Mode

NOTE: If you are using a USB-C cable to enter DFU mode, it might not work. If this happens, you need to use the normal USB cable. You can use a normal USB cable and a USB to USB-C adaptor.

Apple TV

  1. Plug the device into your computer using a Micro-USB cable.
  2. Force the device to reboot by holding down the "Menu" and "Down" buttons simultaneously for 6-7 seconds.
  3. Press "Menu" and "Play" simultaneously right after reboot, until a message pops up in iTunes, saying that it has detected an Apple TV in Recovery Mode.

A9 and older devices (iPad other than the ones listed below, iPhone 6s and below, iPhone SE and iPod touch 6 and below)

  1. Connect the device to a computer using a USB cable.
  2. Hold down both the Home button and Lock button.
  3. After 8 seconds, release the Lock button while continuing to hold down the Home button.
    • If the Apple logo appears, the Lock button was held down for too long.
  4. Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
    • If your device shows a screen telling you to connect the device to iTunes, retry these steps.

A10 devices (iPhone 7 and iPhone 7 Plus, iPad 2018, iPod touch 7)

  1. Connect the device to a computer using a USB cable.
  2. Hold down both the Side button and Volume Down button.
  3. After 8 seconds, release the Side button while continuing to hold down the Volume Down button.
    • If the Apple logo appears, the Side button was held down for too long.
  4. Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
    • If your device shows a screen telling you to connect the device to iTunes, retry these steps.

A11 and newer devices (iPhone 8 and above, iPad Pro 2018, iPad Air 2019, iPad Mini 2019)

  1. Connect the device to a computer using a USB cable.
  2. Quick-press the Volume Up button
  3. Quick-press the Volume Down button
  4. Hold down the Side button until the screen goes black, then hold down both the Side button and Volume Down button.
  5. After 5 seconds, release the Side button while continuing to hold down the Volume Down button.
    • If the Apple logo appears, the Side button was held down for too long.
  6. Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
    • If your device shows a screen telling you to connect the device to iTunes, retry these steps.

GPIO Pins

If you have access to the SoC, you can either perform the above methods for your device by utilizing the GPIO_REQUEST_DFU1 and GPIO_REQUEST_DFU2 GPIO pins (previously HOLD_KEY and MENU_KEY and corresponding to Power and Home/Vol-, respectively) or by setting your board's GPIO_FORCE_DFU pin to 1 at SecureROM startup (unless you are using an iFPGA, where Force DFU mode is the default).

The corresponding GPIO pins for each SoC varies, and the most important ones (including the DFU pins) are listed on the GPIO page.

Exiting DFU Mode

To exit DFU Mode, simply force restart your device.

  • For Apple TV, hold down the "Menu" and "Down" buttons on your remote until the Apple TV reboots.
  • For iPad, iPhone 6s and below, iPhone SE and iPod touch, hold the Home button and the Lock button until the device reboots.
  • For iPhone 7 and iPhone 7 Plus, hold down the Side button and Volume Down button until the device reboots.
  • For iPhone 8, iPhone 8 Plus, and iPhone X, quick-press the Volume Up button, then quick-press the Volume Down button, then hold down the Side button until the device reboots.

Enter True Hardware DFU Mode Automatically

The EnterDFU function in the MobileDevice Library does not enter the true DFU Mode in the hardware. It's possible to enter the true DFU Mode without doing it manually, but it cannot be exited unless a restore is performed, as it creates a DFU Loop. This doesn't work with S5L8900 devices.

Steps

  1. Make a copy of a fresh IPSW file.
  2. Open the IPSW as a zip folder and browse to /firmware/all_flash/all_flash.xxxxx.production/
  3. Extract LLB.*****.RELEASE.img3/im4p and open it in a hex editor.
  4. Change some random bit or bits, it doesn't matter which or what you write.
  5. Add the edited file back to the zip, rename zip to ipsw and restore it to your device using iTunes.
  6. The restore will error out and your device will be in DFU Mode.

Alternative Method

If the previous method does not work for you, try this one.

  1. Do steps 1 and 2 from above.
  2. Delete LLB.*****.RELEASE.img3.
  3. Copy applelogo.********.img3 to temporary directory.
  4. Rename the copy of applelogo.********.img3/im4p to LLB.*****.RELEASE.img3/im4p. (If you forget the name of the LLB file, you can find it again in the file named manifest.)
  5. Copy the renamed applelogo file back to the all_flash.xxxxx.production directory.
  6. Rename the zip.
  7. Restore the file using iTunes. (If every thing goes well, you should receive an error 31 from iTunes.)

DFU Mode Output to the computer

iProduct: "Apple Mobile Device (DFU Mode)"
iSerialNumber: "CPID:XXXX CPRV:15 CPFM:03 SCEP:03 BDID:00 ECID:XXXXXXXXXXXXXXXX SRTG:[iBoot-XXX.X.X]"

Revisions

S5L8900 (0x1222)

This is the device ID in the iPod touch, the iPhone, and the iPhone 3G. For more information about the protocol, see DFU 0x1222.

S5L8720, S5L8920, and WTF mode post-2.0 (0x1227)

This is the device ID in the iPod touch (2nd generation), the iPhone 3GS, the iPhone 4, subsequent 32 bit devices, all 64 bit devices, and WTF mode. For more information on the protocol, see DFU 0x1227.