futurerestore is a hacked up idevicerestore wrapper, which allows manually specifying SEP and Baseband for restoring
- Supports the following downgrade methods
- Prometheus 64bit devices (generator and nonce collision mode)
- Odysseus for 32bit devices
- Re-restoring 32bit devices to iOS 9 with @alitek123's no-nonce method
- Allows restoring any nonmatching signed iOS/Sep/Baseband
(might become outdated):
Usage: futurerestore [OPTIONS] /path/to/ipsw
Options:
-t, --apticket PATH APTicket used for restoring
-u, --update Update instead of erase install (requires appropriate APTicket)
-w, --wait Keep rebooting until nonce matches APTicket (nonce collision, unreliable)
-d, --debug Verbose debug output (useful for error logs)
--latest-sep Use latest signed sep instead of manually specifying one (may cause bad restore)
--latest-baseband Use latest signed baseband instead of manually specifying one (may cause bad restore)
--no-baseband Skip checks and don't flash baseband
WARNING: only use this for device without a baseband (eg. iPod or some wifi only iPads)
To extract baseband/SEP automatically from IPSW:
-i, --source-ipsw PATH Source IPSW to extract baseband/SEP from
To manually specify baseband/SEP:
-b, --baseband PATH Baseband to be flashed
-p, --baseband-manifest PATH BuildManifest for requesting baseband ticket
-s, --sep PATH SEP to be flashed
-m, --sep-manifest PATH BuildManifest for requesting sep ticket
-
- On macOS and Windows, futurerestore requires no runtime dependencies, the following are only for compiling.
- On Linux, usbmuxd is required at runtime.
-
Make sure these are installed
- libzip
- libcurl
- openssl (or CommonCrypto on OSX)
- libplist
- Make sure these projects compile on your system (install their dependencies)
Downgrade/Upgrade/Re-restore same iOS. Whenever you read "downgrade" nowadays it means you can also upgrade and re-restore if you're on the same iOS. Basically this allows restoring an iOS and the installed iOS doesn't matter.
- Jailbreak
- SHSH2 files with a generator
- nonceEnabler patch enabled
You can downgrade if the destination iOS is compatible with the latest signed SEP and if you have shsh2 files with a generator for that iOS.
- Device must be jailbroken and nonceEnabler patch must be active
- Open shsh file and look up the generator
- Looks like this:
<key>generator</key><string>0xde3318d224cf14a1</string>
- Write the generator to device's NVRAM
- SSH into the device and run
nvram com.apple.System.boot-nonce=0xde3318d224cf14a1to set the generator 0xde3318d224cf14a1 - verify with
nvram -p
- Connect your device in normal mode to computer
- On the computer run
futurerestore -t ticket.shsh --latest-baseband --latest-sep ios.ipsw
- Get nvpatch https://github.com/Siguza/ios-kern-utils/releases/
- Run on the device
nvpatch com.apple.System.boot-nonce
- reboot
- reactivate jailbreak with https://jbme.qwertyoruiop.com/
- done
- Use cl0ver (https://github.com/Siguza/cl0ver)
- iPhone5s or iPad Air on iOS 9.1 - 10.2
- No Jailbreak required
- SHSH files with customly chosen APNonce
- The shsh file needs to have one of the nonces, which the device generates a lot
You can downgrade if the destination iOS is compatible with the latest signed SEP. You also need to have special shsh files. If you don't know what this is, you probably can NOT use this method!
- Connect your device in normal mode or recovery mode
- On the computer run
futurerestore -w -t ticket.shsh --latest-baseband --latest-sep ios.ipsw
- If you have saved multiple tickets with different nonces you can specify more than
one to speed up the process:
futurerestore -w -t t1.shsh -t t2.shsh -t t3.shsh -t t4.shsh --latest-baseband --latest-sep ios.ipsw
- futurerestore compiled with libipatcher (odysseus support)
- Jailbreak or bootrom exploit (limera1n)
- Firmware keys for the device/destination iOS must be public (check ipsw.me)
- SHSH files for the destination iOS (OTA blobs work too!)
If you have a jailbroken 32bit device you can downgrade to any iOS you have blobs for. You can still get OTA blobs for iOS 6.1.3 and 8.4.1 for some devices and use those.
- Get device into kDFU/pwnDFU
- Pre-iPhone4s (limera1n devices):
- Enter pwndfu mode with redsn0w or any other tool
- iPhone4s and later:
- Jailbreak required!
- Enter kDFU mode with kDFU app (cydia: repo.tihmstar.net) or by loading a pwniBSS from any existing odysseus bundle.
- Connect your device to computer in kDFU mode (or pwnDFU mode)
- On the computer run
futurerestore --use-pwndfu -t ticket.shsh --latest-baseband ios.ipsw
You can use any odysseus bundle for this
- No Jailbreak required
- SHSH files without a nonce (noNonce APTickets)
If you have shsh files for iOS9 which do not contain a nonce, you can restore to that firmware.
- Connect your device in DFU mode
- On the computer run
futurerestore -t ticket.shsh --latest-baseband ios9.ipsw