search

LukeZGD / Legacy-iOS-Kit

An all-in-one tool to restore/downgrade, save SHSH blobs, and jailbreak legacy iOS devices
GNU General Public License v3.0
1.25k stars 118 forks source link

Unable to downgrade iPad Mini 2 WiFi to 10.3.3 #188

Closed nickygoh322 closed 2 years ago

nickygoh322 commented 2 years ago

Had encountered failed verification error, hereby is the log:

[Log] Device in pwnDFU mode detected.
[Log] Select your options when asked. If unsure, go for the defaults (press Enter/Return).

[Log] Saving iOS 10.3.3 blobs with tsschecker...
Version: b9d193aa6e6d24421094873c830692d02d8b32f5 - 304
libfragmentzip version: 0.59-542a470d7be248681dba71d0f04e7dc8c2718b73
[TSSC] manually specified generator "0x1111111111111111"
[TSSC] manually specified ECID to use, parsed "4731104146544" to dec:4731104146544 hex:44d8bc83470
[TSSC] opening resources/manifests/BuildManifest_iPad4,4_10.3.3.plist
[TSSR] User specified doesn't to request a baseband ticket.
[TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2
[TSSR] Sending TSS request attempt 1... success
also requesting APTicket for installType=Update
[Error] [TSSR] Error: could not get id0 for installType=Update
[WARNING] [TSSR] failed to build tssrequest for alternative installType
[TSSR] User specified doesn't to request a baseband ticket.
[TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2
[TSSR] Sending TSS request attempt 1... failure
[Error] ERROR: TSS request failed (status=128, message=An internal error occurred.)
Saved shsh blobs!

iOS 10.3.3 for device iPad4,4 IS being signed!
[Log] Successfully saved 10.3.3 blobs.
[Log] Verifying iPad_64bit_10.3.3_14G60_Restore.ipsw...
[Log] Expected SHA1sum: 2da347b2e544d122bf30417048fafeaa66f9faa1
[Log] Actual SHA1sum:   2da347b2e544d122bf30417048fafeaa66f9faa1
[Log] IPSW SHA1sum matches.
[Log] Device is already in DFU mode
[Log] Setting restore IPSW to: iPad_64bit_10.3.3_14G60_Restore.ipsw
[Log] Extracting IPSW: iPad_64bit_10.3.3_14G60_Restore.ipsw
[Log] Proceeding to futurerestore...
./resources/downgrade.sh: line 43: /usr/bin/python: No such file or directory
[==================================================] 100.0%
[Log] Device iPad4,4 has no baseband
[Log] Running futurerestore with command: ./resources/tools/futurerestore_macos_x86_64 -t "4731104146544_iPad4,4_j85ap_10.3.3-14G60_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2" --use-pwndfu -s iPad_64bit_10.3.3_14G60_Restore/Firmware/all_flash/sep-firmware.j85.RELEASE.im4p -m resources/manifests/BuildManifest_iPad4,4_10.3.3.plist --no-baseband "iPad_64bit_10.3.3_14G60_Restore.ipsw"
Version: v2.0.0-test(a58821b95f6417ad649ed7a5460337dcd82e200e-259)
img4tool version: 0.197+git20210129-aca6cf005c94caf135023263cbb5c61a0081804f-RELEASE
libipatcher version: 0.86+git20210810-6a3b358b673e74c2be9f9b8a74a63b80dd94abf1-RELEASE
Odysseus for 32-bit support: yes
Odysseus for 64-bit support: yes
[INFO] 64-bit device detected
futurerestore init done
reading signing ticket 4731104146544_iPad4,4_j85ap_10.3.3-14G60_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2 is done
[TSSC] opening resources/manifests/BuildManifest_iPad4,4_10.3.3.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to not request a baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received

WARNING: user specified is not to flash a baseband. This can make the restore fail if the device needs a baseband!
if you added this flag by mistake, you can press CTRL-C now to cancel
continuing restore in 10 9 8 7 6 5 4 3 2 1
Downloading the latest firmware components...
[TSSC] opening firmwares.json
[DOWN] downloading file https://api.ipsw.me/v2.1/firmwares.json/condensed
[TSSC] selecting latest firmware version: 12.5.5
[TSSC] got firmwareurl for iOS 12.5.5 build 16H62
[TSSC] opening Buildmanifest for iPad4,4_12.5.5
[DOWN] downloading file https://updates.cdn-apple.com/2021WinterFCS/fullrestores/002-05567/E126BCC0-1C6A-4792-9115-9D8CE6388BE3/BuildManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
Finished downloading the latest firmware components!
Found device in DFU mode
requesting to get into pwnRecovery later
Found device in DFU mode
Identified device as j85ap, iPad4,4
Extracting BuildManifest from iPSW
Product version: 10.3.3
Product build: 14G60 Major: 14
Device supports Image4: true
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Checking BuildIdentity 4
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 3:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 4:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197+git20210129:
commit sha  =aca6cf005c94caf135023263cbb5c61a0081804f:
[IMG4TOOL] checking buildidentity 5:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197+git20210129:
commit sha  =aca6cf005c94caf135023263cbb5c61a0081804f:
[IMG4TOOL] checking buildidentity 6:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 7:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 8:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 9:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 10:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 11:
[IMG4TOOL] checking buildidentity matches board ... NO
Failed to get exact match for build identity, using fallback to ignore certain values
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 3:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 4:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (but ignoring due to whitelist)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)
Verified APTicket to be valid for this restore
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Device found in DFU Mode.
Getting firmware keys for: j85ap
Patching iBSS
Extracting iBSS.ipad4b.RELEASE.im4p (Firmware/dfu/iBSS.ipad4b.RELEASE.im4p)...
Cleaning up...
[exception]:
what=assure failed
code=24903695
line=380
file=libipatcher.cpp
commit count=86+git20210810:
commit sha  =6a3b358b673e74c2be9f9b8a74a63b80dd94abf1:
Done: restoring failed!

[Log] Restoring done!
[Log] Downgrade script done!
LukeZGD commented 2 years ago

What macOS version?

LukeZGD commented 2 years ago

Please try again with the latest 5f3ccb2

nickygoh322 commented 2 years ago

What macOS version?

Monterey 12.3

nickygoh322 commented 2 years ago

Tried on the latest pull, but doesn't work : (

Logs:

[Log] Warning - Failed to detect device in pwnDFU mode.
* If the device entered pwnDFU mode successfully, you may continue
* If entering pwnDFU failed, you may have to force restart your device and start over
[Log] Select your options when asked. If unsure, go for the defaults (press Enter/Return).

[Log] Saving iOS 10.3.3 blobs with tsschecker...
Version: b9d193aa6e6d24421094873c830692d02d8b32f5 - 304
libfragmentzip version: 0.59-542a470d7be248681dba71d0f04e7dc8c2718b73
[TSSC] manually specified generator "0x1111111111111111"
[TSSC] manually specified ECID to use, parsed "4731104146544" to dec:4731104146544 hex:44d8bc83470
[TSSC] opening resources/manifests/BuildManifest_iPad4,4_10.3.3.plist
[TSSR] User specified doesn't to request a baseband ticket.
[TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2
[TSSR] Sending TSS request attempt 1... success
also requesting APTicket for installType=Update
[Error] [TSSR] Error: could not get id0 for installType=Update
[WARNING] [TSSR] failed to build tssrequest for alternative installType
[TSSR] User specified doesn't to request a baseband ticket.
[TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2
[TSSR] Sending TSS request attempt 1... failure
[Error] ERROR: TSS request failed (status=128, message=An internal error occurred.)
Saved shsh blobs!

iOS 10.3.3 for device iPad4,4 IS being signed!
[Log] Successfully saved 10.3.3 blobs.
[Log] Verifying iPad_64bit_10.3.3_14G60_Restore.ipsw...
[Log] Expected SHA1sum: 2da347b2e544d122bf30417048fafeaa66f9faa1
[Log] Actual SHA1sum:   2da347b2e544d122bf30417048fafeaa66f9faa1
[Log] IPSW SHA1sum matches.
[Log] Device is already in DFU mode
[Log] Setting restore IPSW to: iPad_64bit_10.3.3_14G60_Restore.ipsw
[Log] Extracting IPSW: iPad_64bit_10.3.3_14G60_Restore.ipsw
[Log] Proceeding to futurerestore...
Serving HTTP on :: port 8888 (http://[::]:8888/) ...
[Log] Device iPad4,4 has no baseband
[Log] Running futurerestore with command: ./resources/tools/futurerestore_macos_x86_64 -t "4731104146544_iPad4,4_j85ap_10.3.3-14G60_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2" --use-pwndfu -s iPad_64bit_10.3.3_14G60_Restore/Firmware/all_flash/sep-firmware.j85.RELEASE.im4p -m resources/manifests/BuildManifest_iPad4,4_10.3.3.plist --no-baseband "iPad_64bit_10.3.3_14G60_Restore.ipsw"
Version: v2.0.0-test(a58821b95f6417ad649ed7a5460337dcd82e200e-259)
img4tool version: 0.197+git20210129-aca6cf005c94caf135023263cbb5c61a0081804f-RELEASE
libipatcher version: 0.86+git20210810-6a3b358b673e74c2be9f9b8a74a63b80dd94abf1-RELEASE
Odysseus for 32-bit support: yes
Odysseus for 64-bit support: yes
[INFO] 64-bit device detected
futurerestore init done
reading signing ticket 4731104146544_iPad4,4_j85ap_10.3.3-14G60_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2 is done
[TSSC] opening resources/manifests/BuildManifest_iPad4,4_10.3.3.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to not request a baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received

WARNING: user specified is not to flash a baseband. This can make the restore fail if the device needs a baseband!
if you added this flag by mistake, you can press CTRL-C now to cancel
continuing restore in 10 9 8 7 6 5 4 3 2 1
Downloading the latest firmware components...
[TSSC] opening firmwares.json
[DOWN] downloading file https://api.ipsw.me/v2.1/firmwares.json/condensed
[TSSC] selecting latest firmware version: 12.5.5
[TSSC] got firmwareurl for iOS 12.5.5 build 16H62
[TSSC] opening Buildmanifest for iPad4,4_12.5.5
[DOWN] downloading file https://updates.cdn-apple.com/2021WinterFCS/fullrestores/002-05567/E126BCC0-1C6A-4792-9115-9D8CE6388BE3/BuildManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
Finished downloading the latest firmware components!
Found device in DFU mode
requesting to get into pwnRecovery later
Found device in DFU mode
Identified device as j85ap, iPad4,4
Extracting BuildManifest from iPSW
Product version: 10.3.3
Product build: 14G60 Major: 14
Device supports Image4: true
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Checking BuildIdentity 4
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 3:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 4:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197+git20210129:
commit sha  =aca6cf005c94caf135023263cbb5c61a0081804f:
[IMG4TOOL] checking buildidentity 5:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197+git20210129:
commit sha  =aca6cf005c94caf135023263cbb5c61a0081804f:
[IMG4TOOL] checking buildidentity 6:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 7:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 8:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 9:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 10:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 11:
[IMG4TOOL] checking buildidentity matches board ... NO
Failed to get exact match for build identity, using fallback to ignore certain values
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 3:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 4:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (but ignoring due to whitelist)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)
Verified APTicket to be valid for this restore
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Device found in DFU Mode.
Getting firmware keys for: j85ap
::ffff:127.0.0.1 - - [01/Jul/2022 20:38:13] "GET /firmware/iPad4,4/14G60 HTTP/1.1" 301 -
::ffff:127.0.0.1 - - [01/Jul/2022 20:38:13] "GET /firmware/iPad4,4/14G60/ HTTP/1.0" 200 -
::ffff:127.0.0.1 - - [01/Jul/2022 20:38:13] "GET /firmware/iPad4,4/14G60 HTTP/1.1" 301 -
::ffff:127.0.0.1 - - [01/Jul/2022 20:38:13] "GET /firmware/iPad4,4/14G60/ HTTP/1.0" 200 -
Patching iBSS
Extracting iBSS.ipad4b.RELEASE.im4p (Firmware/dfu/iBSS.ipad4b.RELEASE.im4p)...
payload decrypted
iBoot64Patch: Staring iBoot64Patch!
iBoot64Patch: Inited ibootpatchfinder64!
iBoot64Patch: Added sigpatches!
iBoot64Patch: Added unlock nvram patch!
iBoot64Patch: Added freshnonce patch!
iBoot64Patch: has_kernel_load is false!
iBoot64Patch: Applying patch=0x18038b7b8 : 000080d2
iBoot64Patch: Applying patch=0x18038b7bc : c0035fd6
iBoot64Patch: Patches applied!
Patching iBEC
Extracting iBEC.ipad4b.RELEASE.im4p (Firmware/dfu/iBEC.ipad4b.RELEASE.im4p)...
payload decrypted
iBoot64Patch: Staring iBoot64Patch!
iBoot64Patch: Inited ibootpatchfinder64!
iBoot64Patch: Added sigpatches!
iBoot64Patch: Added unlock nvram patch!
iBoot64Patch: Added freshnonce patch!
iBoot64Patch: has_kernel_load is true!
iBoot64Patch: Added debugenabled patch!
iBoot64Patch: Added bootarg patch!
iBoot64Patch: Applying patch=0x83000c66c : 000080d2
iBoot64Patch: Applying patch=0x83000c670 : c0035fd6
iBoot64Patch: Applying patch=0x8300025d8 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x830002638 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x830028b44 : 000080d2c0035fd6
iBoot64Patch: Applying patch=0x830010ca0 : 1f2003d5
iBoot64Patch: Applying patch=0x83000de38 : 200080d2
iBoot64Patch: Applying patch=0x83000f100 : c99d1770
iBoot64Patch: Applying patch=0x83003e4bb : 72643d6d6430202d726573746f7265202d70726f6772657373206e616e642d656e61626c652d7265666f726d61743d307831202d762064656275673d30783230313465206b65657073796d733d30783120616d66693d3078666620616d66695f616c6c6f775f616e795f7369676e61747572653d30783120616d66695f6765745f6f75745f6f665f6d795f7761793d3078312063735f656e666f7263656d656e745f64697361626c653d30783100
iBoot64Patch: Applying patch=0x83000f10c : fb0309aa
iBoot64Patch: Applying patch=0x83000f20c : 7b951770
iBoot64Patch: Patches applied!
Repacking patched bootloaders as IMG4
Sending iBSS (173090 bytes)...
[==================================================] 100.0%
Booting iBSS, waiting for device to disconnect...
Booting iBSS, waiting for device to reconnect...
Cleaning up...
[exception]:
what=Device did not reconnect. Possibly invalid iBSS. Reset device and try again
code=39190545
line=598
file=futurerestore.cpp
commit count=259:
commit sha  =a58821b95f6417ad649ed7a5460337dcd82e200e:
Done: restoring failed!

[Log] Restoring done!
[Log] Downgrade script done!
LukeZGD commented 2 years ago

Is your device successfully in pwnDFU mode? I can't tell in the log since it's incomplete, from what I can tell it seems to have failed

LukeZGD commented 2 years ago

Please try again with the latest c4571d3

nickygoh322 commented 2 years ago

Doesn't work : ( Sorry for missed out the exploit part in previous log.

Full log message:

[Log] Entering pwnDFU mode with: ./resources/tools/ipwnder_macos...
[main] Waiting for device in DFU mode...
[io_get_serial] Found serial number!
[main] CONNECTED
[main] CPID: 0x8960, BDID: 0x0a, STRG: [iBoot-1704.10]
** exploiting with checkm8
[checkm8_s5l8960x] reconnecting
[io_reset] ResetDevice: 0
[io_reset] USBDeviceReEnumerate: 0
[checkm8_s5l8960x] running set_global_state()
[set_global_state] (1/3) sent: 0, val: 5c0
[set_global_state] (2/3) e000404f
[set_global_state] running heap_spray()
[heap_spray] (1/3) e000404f
[heap_spray] (2/3) 0
[heap_spray] (3/3) e0004051
[set_global_state] (3/3) e00002ed
[checkm8_s5l8960x] reconnecting
[checkm8_s5l8960x] USBDeviceReEnumerate: 0
[checkm8_s5l8960x] running heap_occupation()
[heap_occupation] (1/3) e000404f
[heap_occupation] (2/3) e0004051
[heap_occupation] (3/3) e000404f
[checkm8_s5l8960x] reconnecting
[checkm8_s5l8960x] USBDeviceReEnumerate: 0
[io_get_serial] Found serial number!
[checkm8_s5l8960x] pwned!
[Log] Warning - Failed to detect device in pwnDFU mode.
* If the device entered pwnDFU mode successfully, you may continue
* If entering pwnDFU failed, you may have to force restart your device and start over
[Log] Select your options when asked. If unsure, go for the defaults (press Enter/Return).

[Log] Saving iOS 10.3.3 blobs with tsschecker...
Version: b9d193aa6e6d24421094873c830692d02d8b32f5 - 304
libfragmentzip version: 0.59-542a470d7be248681dba71d0f04e7dc8c2718b73
[TSSC] manually specified generator "0x1111111111111111"
[TSSC] manually specified ECID to use, parsed "4731104146544" to dec:4731104146544 hex:44d8bc83470
[TSSC] opening resources/manifests/BuildManifest_iPad4,4_10.3.3.plist
[TSSR] User specified doesn't to request a baseband ticket.
[TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2
[TSSR] Sending TSS request attempt 1... success
also requesting APTicket for installType=Update
[Error] [TSSR] Error: could not get id0 for installType=Update
[WARNING] [TSSR] failed to build tssrequest for alternative installType
[TSSR] User specified doesn't to request a baseband ticket.
[TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2
[TSSR] Sending TSS request attempt 1... failure
[Error] ERROR: TSS request failed (status=128, message=An internal error occurred.)
Saved shsh blobs!

iOS 10.3.3 for device iPad4,4 IS being signed!
[Log] Successfully saved 10.3.3 blobs.
[Log] Verifying iPad_64bit_10.3.3_14G60_Restore.ipsw...
[Log] Expected SHA1sum: 2da347b2e544d122bf30417048fafeaa66f9faa1
[Log] Actual SHA1sum:   2da347b2e544d122bf30417048fafeaa66f9faa1
[Log] IPSW SHA1sum matches.
[Log] Device is already in DFU mode
[Log] Setting restore IPSW to: iPad_64bit_10.3.3_14G60_Restore.ipsw
[Log] Extracting IPSW: iPad_64bit_10.3.3_14G60_Restore.ipsw
[Log] Proceeding to futurerestore...
Serving HTTP on :: port 8888 (http://[::]:8888/) ...
[Log] Device iPad4,4 has no baseband
[Log] Running futurerestore with command: ./resources/tools/futurerestore_macos_x86_64 -t "4731104146544_iPad4,4_j85ap_10.3.3-14G60_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2" --use-pwndfu -s iPad_64bit_10.3.3_14G60_Restore/Firmware/all_flash/sep-firmware.j85.RELEASE.im4p -m resources/manifests/BuildManifest_iPad4,4_10.3.3.plist --no-baseband "iPad_64bit_10.3.3_14G60_Restore.ipsw"
Version: v2.0.0-test(3bfba667cce95a85ec918210f8b05d2aed6c3d91-281)
img4tool version: 0.197-aca6cf005c94caf135023263cbb5c61a0081804f-RELEASE
libipatcher version: 0.88-1e855d70c84419014e363bdbcaead7b145fe3e1f-RELEASE
Odysseus for 32-bit support: yes
Odysseus for 64-bit support: yes
[INFO] 64-bit device detected
futurerestore init done
reading signing ticket 4731104146544_iPad4,4_j85ap_10.3.3-14G60_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2 is done
[TSSC] opening resources/manifests/BuildManifest_iPad4,4_10.3.3.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to not request a baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received

WARNING: user specified is not to flash a baseband. This can make the restore fail if the device needs a baseband!
if you added this flag by mistake, you can press CTRL-C now to cancel
continuing restore in 10 9 8 7 6 5 4 3 2 1
Downloading the latest firmware components...
[TSSC] opening firmwares.json
[DOWN] downloading file https://api.ipsw.me/v2.1/firmwares.json/condensed
[TSSC] opening /tmp/betas_iPad4,4.json
[DOWN] downloading file https://api.m1sta.xyz/betas/iPad4,4
[TSSC] selecting latest firmware version: 12.5.5
[TSSC] got firmwareurl for iOS 12.5.5 build 16H62
[TSSC] opening Buildmanifest for iPad4,4_12.5.5
[DOWN] downloading file https://updates.cdn-apple.com/2021WinterFCS/fullrestores/002-05567/E126BCC0-1C6A-4792-9115-9D8CE6388BE3/BuildManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
Finished downloading the latest firmware components!
Found device in DFU mode
requesting to get into pwnRecovery later
Found device in DFU mode
Identified device as j85ap, iPad4,4
Extracting BuildManifest from iPSW
Product version: 10.3.3
Product build: 14G60 Major: 14
Device supports Image4: true
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Checking BuildIdentity 4
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
checking if the APTicket is valid for this restore...
Verified ECID in APTicket matches the device's ECID
checking if the APTicket is valid for this restore...
Verified ECID in APTicket matches the device's ECID
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 3:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 4:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197:
commit sha  =aca6cf005c94caf135023263cbb5c61a0081804f:
[IMG4TOOL] checking buildidentity 5:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197:
commit sha  =aca6cf005c94caf135023263cbb5c61a0081804f:
[IMG4TOOL] checking buildidentity 6:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 7:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 8:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 9:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 10:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 11:
[IMG4TOOL] checking buildidentity matches board ... NO
Failed to get exact match for build identity, using fallback to ignore certain values
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 3:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 4:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (but ignoring due to whitelist)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)
Verified APTicket to be valid for this restore
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Device found in DFU Mode.
Sending iBSS (173090 bytes)...
[==================================================] 100.0%
Booting iBSS, waiting for device to disconnect...
Booting iBSS, waiting for device to reconnect...
Cleaning up...
[exception]:
what=Device did not reconnect. Possibly invalid iBSS. Reset device and try again
code=43581508
line=665
file=/Users/runner/work/futurerestore/futurerestore/src/futurerestore.cpp
commit count=281:
commit sha  =3bfba667cce95a85ec918210f8b05d2aed6c3d91:
Done: restoring failed!

[Log] Restoring done!
[Log] Downgrade script done!
nickygoh322 commented 2 years ago

I had tried to use the second PwnDFU tool, seems like able to get into pwned DFU mode. Unfortunately, still having some error messages.

DFU device infomation iPad Mini 2 (WiFi) [iPad4,4]
CPID:0x8960 CPRV:0x11 BDID:0x0A ECID:0x0000044D8BC83470 CPFM:0x03 SCEP:0x01 IBFL:0x1C
SRTG:[iBoot-1704.10]
exploiting with checkm8
Device is now in pwned DFU mode!
[Log] Device in pwnDFU mode detected.
[Log] Select your options when asked. If unsure, go for the defaults (press Enter/Return).

[Log] Saving iOS 10.3.3 blobs with tsschecker...
Version: b9d193aa6e6d24421094873c830692d02d8b32f5 - 304
libfragmentzip version: 0.59-542a470d7be248681dba71d0f04e7dc8c2718b73
[TSSC] manually specified generator "0x1111111111111111"
[TSSC] manually specified ECID to use, parsed "4731104146544" to dec:4731104146544 hex:44d8bc83470
[TSSC] opening resources/manifests/BuildManifest_iPad4,4_10.3.3.plist
[TSSR] User specified doesn't to request a baseband ticket.
[TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2
[TSSR] Sending TSS request attempt 1... success
also requesting APTicket for installType=Update
[Error] [TSSR] Error: could not get id0 for installType=Update
[WARNING] [TSSR] failed to build tssrequest for alternative installType
[TSSR] User specified doesn't to request a baseband ticket.
[TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2
[TSSR] Sending TSS request attempt 1... failure
[Error] ERROR: TSS request failed (status=128, message=An internal error occurred.)
Saved shsh blobs!

iOS 10.3.3 for device iPad4,4 IS being signed!
[Log] Successfully saved 10.3.3 blobs.
[Log] Verifying iPad_64bit_10.3.3_14G60_Restore.ipsw...
[Log] Expected SHA1sum: 2da347b2e544d122bf30417048fafeaa66f9faa1
[Log] Actual SHA1sum:   2da347b2e544d122bf30417048fafeaa66f9faa1
[Log] IPSW SHA1sum matches.
[Log] Device is already in DFU mode
[Log] Setting restore IPSW to: iPad_64bit_10.3.3_14G60_Restore.ipsw
[Log] Extracting IPSW: iPad_64bit_10.3.3_14G60_Restore.ipsw
[Log] Proceeding to futurerestore...
Serving HTTP on :: port 8888 (http://[::]:8888/) ...
[Log] Device iPad4,4 has no baseband
[Log] Running futurerestore with command: ./resources/tools/futurerestore_macos_x86_64 -t "4731104146544_iPad4,4_j85ap_10.3.3-14G60_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2" --use-pwndfu -s iPad_64bit_10.3.3_14G60_Restore/Firmware/all_flash/sep-firmware.j85.RELEASE.im4p -m resources/manifests/BuildManifest_iPad4,4_10.3.3.plist --no-baseband "iPad_64bit_10.3.3_14G60_Restore.ipsw"
Version: v2.0.0-test(3bfba667cce95a85ec918210f8b05d2aed6c3d91-281)
img4tool version: 0.197-aca6cf005c94caf135023263cbb5c61a0081804f-RELEASE
libipatcher version: 0.88-1e855d70c84419014e363bdbcaead7b145fe3e1f-RELEASE
Odysseus for 32-bit support: yes
Odysseus for 64-bit support: yes
[INFO] 64-bit device detected
futurerestore init done
reading signing ticket 4731104146544_iPad4,4_j85ap_10.3.3-14G60_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2 is done
[TSSC] opening resources/manifests/BuildManifest_iPad4,4_10.3.3.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to not request a baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received

WARNING: user specified is not to flash a baseband. This can make the restore fail if the device needs a baseband!
if you added this flag by mistake, you can press CTRL-C now to cancel
continuing restore in 10 9 8 7 6 5 4 3 2 1
Downloading the latest firmware components...
[TSSC] opening firmwares.json
[DOWN] downloading file https://api.ipsw.me/v2.1/firmwares.json/condensed
[TSSC] opening /tmp/betas_iPad4,4.json
[DOWN] downloading file https://api.m1sta.xyz/betas/iPad4,4
[TSSC] selecting latest firmware version: 12.5.5
[TSSC] got firmwareurl for iOS 12.5.5 build 16H62
[TSSC] opening Buildmanifest for iPad4,4_12.5.5
[DOWN] downloading file https://updates.cdn-apple.com/2021WinterFCS/fullrestores/002-05567/E126BCC0-1C6A-4792-9115-9D8CE6388BE3/BuildManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Selected BuildIdentity for request
Finished downloading the latest firmware components!
Found device in DFU mode
requesting to get into pwnRecovery later
Found device in DFU mode
Identified device as j85ap, iPad4,4
Extracting BuildManifest from iPSW
Product version: 10.3.3
Product build: 14G60 Major: 14
Device supports Image4: true
[TSSR] Checking BuildIdentity 0
[TSSR] Checking BuildIdentity 1
[TSSR] Checking BuildIdentity 2
[TSSR] Checking BuildIdentity 3
[TSSR] Checking BuildIdentity 4
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
checking if the APTicket is valid for this restore...
Verified ECID in APTicket matches the device's ECID
checking if the APTicket is valid for this restore...
Verified ECID in APTicket matches the device's ECID
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 3:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 4:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197:
commit sha  =aca6cf005c94caf135023263cbb5c61a0081804f:
[IMG4TOOL] checking buildidentity 5:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (hash not found in im4m)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)

failed verification with error:
[exception]:
what=verification failed!
code=84279308
line=1286
file=img4tool.cpp
commit count=197:
commit sha  =aca6cf005c94caf135023263cbb5c61a0081804f:
[IMG4TOOL] checking buildidentity 6:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 7:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 8:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 9:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 10:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 11:
[IMG4TOOL] checking buildidentity matches board ... NO
Failed to get exact match for build identity, using fallback to ignore certain values
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 1:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 2:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 3:
[IMG4TOOL] checking buildidentity matches board ... NO
[IMG4TOOL] checking buildidentity 4:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          BAD! (but ignoring due to whitelist)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)
Verified APTicket to be valid for this restore
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Device found in DFU Mode.
Sending iBSS (173090 bytes)...
[==================================================] 100.0%
Booting iBSS, waiting for device to disconnect...
Booting iBSS, waiting for device to reconnect...
Cleaning up...
[exception]:
what=Device did not reconnect. Possibly invalid iBSS. Reset device and try again
code=43581508
line=665
file=/Users/runner/work/futurerestore/futurerestore/src/futurerestore.cpp
commit count=281:
commit sha  =3bfba667cce95a85ec918210f8b05d2aed6c3d91:
Done: restoring failed!

[Log] Restoring done!
[Log] Downgrade script done!
LukeZGD commented 2 years ago

Seems similar to #168 and #171. Anyways I already updated what I can, and the assured failed error is now solved

Please see the linked issues above for solving the iBSS problem since that one is out of my control, sorry

You may also try again selecting iPwnder32 since you are on an Intel Mac

LukeZGD commented 2 years ago

You may also try again in the latest commit ffc3926 with the custom IPSW option enabled