Iphone 4 restore fails

[apersonwhoexistssomehow]

Hello, i have an iphone 4 that im trying to downgrade to 4.3.5 with the powersn0w option on a linux mint machine, however upon my downgrade the restore fails and my iphone shows a black screen with white text (which seems to be the device info) and a spinning wheel that goes on until the device dies, here is the terminal log [Input] Jailbreak Option

• When this option is enabled, your device will be jailbroken on restore.
• I recommend to enable this option to have the jailbreak and Cydia pre-installed.
• This option is enabled by default (Y). Select this option if unsure. [Input] Enable this option? (Y/n): n [Log] Jailbreak option disabled by user.

[Input] Memory Option for creating custom IPSW

• When this option is enabled, system RAM will be used for the IPSW creation process.
• I recommend to enable this option to speed up creating the custom IPSW.
• However, if you have less than 8 GB of RAM, disable this option.
• This option is enabled by default (Y). Select this option if unsure. [Input] Enable this option? (Y/n): n [Log] Memory option disabled by user.

[Input] Verbose Boot Option

• When this option is enabled, the device will have verbose boot on restore.
• This option is enabled by default (Y). Select this option if unsure. [Input] Enable this option? (Y/n): n [Log] Verbose boot option disabled by user.

[Log] Extracting BuildManifest from 7.1.2 IPSW... Archive: /home/jailbreaker2/Downloads/iPhone3,1_7.1.2_11D257_Restore.ipsw inflating: ./BuildManifest.plist
[Log] Running tsschecker with command: ../bin/linux/x86_64/tsschecker -d iPhone3,1 -i 7.1.2 -e 3741186299215 -m ../saved/iPhone3,1/11D257.plist -o -s -B n90ap -b -g 0x1111111111111111 tsschecker version: 0.413-dd7e883adc94e2289e492b196bfbf67c7e18a544 libfragmentzip version: 0.Debug-Build: Nov 26 2022 09:41:43-RELEASE [TSSC] manually specified generator "0x1111111111111111" [TSSC] manually specified ECID to use, parsed "3741186299215" to dec:3741186299215 hex:3671014954f Request URL set to https://gs.apple.com/TSS/controller?action=2 Sending TSS request attempt 1... response successfully received also requesting APTicket for installType=Update Request URL set to https://gs.apple.com/TSS/controller?action=2 Sending TSS request attempt 1... response successfully received [Error] [TSSR] ERROR: Unable to add img3 tags to TSS request Saved shsh blobs!

iOS 7.1.2 for device iPhone3,1 IS being signed! [Log] Successfully saved 7.1.2 blobs: 3741186299215_iPhone3,1_n90ap_7.1.2-11D257_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2 [Log] Checking firmware keys in ../resources/firmware/iPhone3,1/8L1 [Log] Preparing config file <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

FilesystemJailbreak needPref iBootPatches debugEnabled bootArgsInjection bootArgsString -v

[Log] Generating firmware bundle for iPhone3,1-4.3.5 (8L1) target... Archive: /home/jailbreaker2/Downloads/iPhone3,1_4.3.5_8L1_Restore.ipsw inflating: manifest
Archive: /home/jailbreaker2/Downloads/iPhone3,1_4.3.5_8L1_Restore.ipsw inflating: 038-2265-002.dmg
No such file or directory <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Filename/home/jailbreaker2/Downloads/iPhone3,1_4.3.5_8L1_Restore.ipsw RootFilesystem038-2288-002.dmg RootFilesystemKeye5e061077217c4937e14d9c4ae1eeb8d69827aa4838168033dd5f1806ab485306a8aa3cf RootFilesystemSize1054 RamdiskOptionsPath/usr/local/share/restore/options.plist SHA17099307319c669356955e9aff11a3129d6b8d8b4 FilesystemPackagebootstrapfreeze.tar RamdiskPackagepackagesrc/bin.tariosios4 Firmware iBSSFileFirmware/dfu/iBSS.n90ap.RELEASE.dfuIV00ba61665022e97cacb71493f3e92533Key85d0388a2b1ce6b4fc68aebb3cb87014b6dd57fde5d9599381db4083a30c3803 Patch Decrypt Restore RamdiskFile038-2265-002.dmgIVnullKeynull Decrypt FirmwareReplace APTicketFileFirmware/all_flash/all_flash.n90ap.production/applelogoT-640x960.s5l8930x.img3 AppleLogoFileFirmware/all_flash/all_flash.n90ap.production/applelogo7-640x960.s5l8930x.img3 NewAppleLogoFileFirmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3 BatteryCharging0FileFirmware/all_flash/all_flash.n90ap.production/batterycharging0-640x960.s5l8930x.img3 BatteryCharging1FileFirmware/all_flash/all_flash.n90ap.production/batterycharging1-640x960.s5l8930x.img3 BatteryFullFileFirmware/all_flash/all_flash.n90ap.production/batteryfull-640x960.s5l8930x.img3 BatteryLow0FileFirmware/all_flash/all_flash.n90ap.production/batterylow0-640x960.s5l8930x.img3 BatteryLow1FileFirmware/all_flash/all_flash.n90ap.production/batterylow1-640x960.s5l8930x.img3 BatteryPluginFileFirmware/all_flash/all_flash.n90ap.production/glyphplugin-640x960.s5l8930x.img3 RecoveryModeFileFirmware/all_flash/all_flash.n90ap.production/recoverymode7-640x960.s5l8930x.img3 NewRecoveryModeFileFirmware/all_flash/all_flash.n90ap.production/recoverymode-640x960.s5l8930x.img3 LLBFileFirmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 iBootFileFirmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 NewiBootFileFirmware/all_flash/all_flash.n90ap.production/iBoot4.n90ap.RELEASE.img3IV986032eecd861c37ca2a86b6496a3c0dKeyb4e300c54a9dd2e648ead50794e9bf2205a489c310a1c70a9fae687368229468 manifestFileFirmware/all_flash/all_flash.n90ap.production/manifestmanifestmanifest [Log] Checking firmware keys in ../resources/firmware/iPhone3,1/11D257 [Log] Generating firmware bundle for iPhone3,1-7.1.2 (11D257) base... Archive: /home/jailbreaker2/Downloads/iPhone3,1_7.1.2_11D257_Restore.ipsw inflating: manifest Archive: /home/jailbreaker2/Downloads/iPhone3,1_7.1.2_11D257_Restore.ipsw inflating: 058-4107-013.dmg /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 8196f7a169a4dc0d728066fc5a2ac2e48255551bfe77448b12b193db45404104a9d999236099bda390cb4bc16ea760ce Filename/home/jailbreaker2/Downloads/iPhone3,1_7.1.2_11D257_Restore.ipsw RootFilesystem058-4520-010.dmg RootFilesystemKey38d0320d099b9dd34ffb3308c53d397f14955b347d6a433fe173acc2ced1ae78756b3684 RootFilesystemSize1561 RamdiskOptionsPath/usr/local/share/restore/options.plist SHA181da17b3e893a61508fe203849b7e1f60e2127b1 RamdiskExploit exploitsrc/target/n90/11D257/exploit injectsrc/target/n90/11D257/partition Firmware FirmwarePath AppleLogoFileFirmware/all_flash/all_flash.n90ap.production/applelogo@2x~iphone.s5l8930x.img3 BatteryCharging0FileFirmware/all_flash/all_flash.n90ap.production/batterycharging0@2x~iphone.s5l8930x.img3 BatteryCharging1FileFirmware/all_flash/all_flash.n90ap.production/batterycharging1@2x~iphone.s5l8930x.img3 BatteryFullFileFirmware/all_flash/all_flash.n90ap.production/batteryfull@2x~iphone.s5l8930x.img3 BatteryLow0FileFirmware/all_flash/all_flash.n90ap.production/batterylow0@2x~iphone.s5l8930x.img3 BatteryLow1FileFirmware/all_flash/all_flash.n90ap.production/batterylow1@2x~iphone.s5l8930x.img3 BatteryPluginFileFirmware/all_flash/all_flash.n90ap.production/glyphplugin@2x~iphone-30pin.s5l8930x.img3 RecoveryModeFileFirmware/all_flash/all_flash.n90ap.production/recoverymode@2x~iphone-30pin.s5l8930x.img3 LLBFileFirmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 iBootFileFirmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 [Log] Preparing config file FilesystemJailbreak needPref iBootPatches debugEnabled bootArgsInjection bootArgsString -v [Log] Checking firmware keys in ../resources/firmware/iPhone3,1/8L1 [Log] Patch iBoot: --boot-partition --boot-ramdisk --logo4 Archive: /home/jailbreaker2/Downloads/iPhone3,1_4.3.5_8L1_Restore.ipsw inflating: iBoot.n90ap.RELEASE.img3 /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802 main: Starting... main: iBoot-1072 inputted. patch_logo4: Entering... patch_logo4: Found main string: 0xeb4 patch_logo4: Patching logo -> log4 ... patch_logo4: Leaving... patch_rsa_check: Entering... find_rsa_check_4: Entering... find_rsa_check_4: Found RSA check at 0x1bd64 find_rsa_check_4: Leaving... patch_rsa_check: Patching RSA at 0x1bd64... find_ldr_ecid: Entering... find_ldr_ecid: Found LDR instruction at 0x1357c find_ldr_ecid: Found BL ECID at 0x1358c find_ldr_ecid: Leaving... patch_rsa_check: Patching BL ECID at 0x1358c... find_ldr_bord: Entering... find_ldr_bord: Found LDR BORD instruction at 0x13556 find_ldr_bord: Found BL BORD at 0x13568 find_ldr_bord: Leaving... patch_rsa_check: Patching BL BORD at 0x13568... find_ldr_prod: Entering... find_ldr_prod: Found LDR PROD instruction at 0x13482 find_ldr_prod: Found BL PROD at 0x13494 find_ldr_prod: Leaving... patch_rsa_check: Patching BL PROD at 0x13494... find_ldr_sepo: Entering... find_ldr_sepo: Found LDR SEPO instruction at 0x13524 find_ldr_sepo: Found BL SEPO at 0x13526 find_ldr_sepo: Leaving... patch_rsa_check: Patching BL SEPO at 0x13526... patch_boot_partition: Entering... find_boot_partition_ldr: Entering... find_boot_partition_ldr: Found boot-partition string: 0x5ff2adf8 find_boot_partition_ldr: Found boot-partition LDR: 0x5ff007d8 patch_boot_partition: Patching boot_partition BL at 0x7da... patch_boot_partition: Leaving... find_boot_ramdisk_ldr: Entering... find_boot_ramdisk_ldr: Found boot-ramdisk string: 0x5ff2ae44 find_boot_ramdisk_ldr: Found boot-ramdisk LDR: 0x5ff0086c patch_boot_ramdisk: Patching boot_ramdisk BL at 0x86e... patch_boot_ramdisk: Leaving... main: Writing out patched file to ibot.pwned... main: Quitting... /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802 /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802 iBoot [Log] Preparing custom IPSW: ../bin/linux/x86_64/powdersn0w /home/jailbreaker2/Downloads/iPhone3,1_4.3.5_8L1_Restore.ipsw temp.ipsw -base /home/jailbreaker2/Downloads/iPhone3,1_7.1.2_11D257_Restore.ipsw -apticket 3741186299215_iPhone3,1_n90ap_7.1.2-11D257_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2 Hashing IPSW... Matching IPSW in FirmwareBundles/... (70993073...) checking: FirmwareBundles//config.plist/Info.plist checking: FirmwareBundles//BASE_iPhone3,1_7.1.2_11D257.bundle/Info.plist checking: FirmwareBundles//iPhone3,1_4.3.5_8L1.bundle/Info.plist loading: 038-2265-002.dmg (23705796) loading: 038-2268-002.dmg (25024708) loading: 038-2288-002.dmg (630808576) loading: BuildManifest.plist (22691) loading: Firmware/ (0) loading: Firmware/all_flash/ (0) loading: Firmware/all_flash/all_flash.n90ap.production/ (0) loading: Firmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3 (15172) loading: Firmware/all_flash/all_flash.n90ap.production/batterycharging0-640x960.s5l8930x.img3 (11844) loading: Firmware/all_flash/all_flash.n90ap.production/batterycharging1-640x960.s5l8930x.img3 (37124) loading: Firmware/all_flash/all_flash.n90ap.production/batteryfull-640x960.s5l8930x.img3 (655300) loading: Firmware/all_flash/all_flash.n90ap.production/batterylow0-640x960.s5l8930x.img3 (170692) loading: Firmware/all_flash/all_flash.n90ap.production/batterylow1-640x960.s5l8930x.img3 (40004) loading: Firmware/all_flash/all_flash.n90ap.production/DeviceTree.n90ap.img3 (60612) loading: Firmware/all_flash/all_flash.n90ap.production/glyphcharging-640x960.s5l8930x.img3 (7364) loading: Firmware/all_flash/all_flash.n90ap.production/glyphplugin-640x960.s5l8930x.img3 (7044) loading: Firmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 (223620) loading: Firmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 (100740) loading: Firmware/all_flash/all_flash.n90ap.production/manifest (387) loading: Firmware/all_flash/all_flash.n90ap.production/recoverymode-640x960.s5l8930x.img3 (129604) loading: Firmware/dfu/ (0) loading: Firmware/dfu/iBEC.n90ap.RELEASE.dfu (223620) loading: Firmware/dfu/iBSS.n90ap.RELEASE.dfu (158084) loading: Firmware/ICE3_04.10.01_BOOT_02.13.Release.bbfw (3811912) loading: kernelcache.release.k48 (6179844) loading: kernelcache.release.n81 (6086340) loading: kernelcache.release.n90 (6204100) loading: Restore.plist (2076) Hashing IPSW... Matching IPSW in FirmwareBundles/... (81da17b3...) checking: FirmwareBundles//config.plist/Info.plist checking: FirmwareBundles//BASE_iPhone3,1_7.1.2_11D257.bundle/Info.plist loading: Firmware/all_flash/all_flash.n90ap.production/applelogo@2x~iphone.s5l8930x.img3 (6796) loading: Firmware/all_flash/all_flash.n90ap.production/batterycharging0@2x~iphone.s5l8930x.img3 (9740) loading: Firmware/all_flash/all_flash.n90ap.production/batterycharging1@2x~iphone.s5l8930x.img3 (35020) loading: Firmware/all_flash/all_flash.n90ap.production/batteryfull@2x~iphone.s5l8930x.img3 (84044) loading: Firmware/all_flash/all_flash.n90ap.production/batterylow0@2x~iphone.s5l8930x.img3 (43596) loading: Firmware/all_flash/all_flash.n90ap.production/batterylow1@2x~iphone.s5l8930x.img3 (2060) loading: Firmware/all_flash/all_flash.n90ap.production/DeviceTree.n90ap.img3 (74764) loading: Firmware/all_flash/all_flash.n90ap.production/glyphplugin@2x~iphone-30pin.s5l8930x.img3 (11852) loading: Firmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 (283020) loading: Firmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 (131468) loading: Firmware/all_flash/all_flash.n90ap.production/recoverymode@2x~iphone-30pin.s5l8930x.img3 (69452) checking: FirmwareBundles/config.plist [+] debugMode ? 0... [+] needPref ? 1... [+] jailbreak ? 0... [*] Found APTicket: Firmware/all_flash/all_flash.n90ap.production/applelogoT-640x960.s5l8930x.img3 [+] Added: Firmware/all_flash/all_flash.n90ap.production/applelogoT-640x960.s5l8930x.img3 [*] Found AppleLogo: Firmware/all_flash/all_flash.n90ap.production/applelogo7-640x960.s5l8930x.img3 [*] Found NewAppleLogo: Firmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3 [*] Found BatteryCharging0: Firmware/all_flash/all_flash.n90ap.production/batterycharging0-640x960.s5l8930x.img3 [*] Found BatteryCharging1: Firmware/all_flash/all_flash.n90ap.production/batterycharging1-640x960.s5l8930x.img3 [*] Found BatteryFull: Firmware/all_flash/all_flash.n90ap.production/batteryfull-640x960.s5l8930x.img3 [*] Found BatteryLow0: Firmware/all_flash/all_flash.n90ap.production/batterylow0-640x960.s5l8930x.img3 [*] Found BatteryLow1: Firmware/all_flash/all_flash.n90ap.production/batterylow1-640x960.s5l8930x.img3 [*] Found BatteryPlugin: Firmware/all_flash/all_flash.n90ap.production/glyphplugin-640x960.s5l8930x.img3 [*] Found RecoveryMode: Firmware/all_flash/all_flash.n90ap.production/recoverymode7-640x960.s5l8930x.img3 [*] Found NewRecoveryMode: Firmware/all_flash/all_flash.n90ap.production/recoverymode-640x960.s5l8930x.img3 [*] Found LLB: Firmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 [*] Found iBoot: Firmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 [*] Found NewiBoot: Firmware/all_flash/all_flash.n90ap.production/iBoot4.n90ap.RELEASE.img3 [*] Found manifestPath: Firmware/all_flash/all_flash.n90ap.production/manifest [+] Added: Firmware/all_flash/all_flash.n90ap.production/manifest [*] Replacing flash_nor... [+] Added: Firmware/all_flash/all_flash.n90ap.production/applelogo7-640x960.s5l8930x.img3 [*] Rewrite img3 TYPE tag: logo -> logb [+] Added: Firmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3 [*] Replacing flash_nor... [+] Added: Firmware/all_flash/all_flash.n90ap.production/batterycharging0-640x960.s5l8930x.img3 [*] Replacing flash_nor... [+] Added: Firmware/all_flash/all_flash.n90ap.production/batterycharging1-640x960.s5l8930x.img3 [*] Replacing flash_nor... [+] Added: Firmware/all_flash/all_flash.n90ap.production/batteryfull-640x960.s5l8930x.img3 [*] Replacing flash_nor... [+] Added: Firmware/all_flash/all_flash.n90ap.production/batterylow0-640x960.s5l8930x.img3 [*] Replacing flash_nor... [+] Added: Firmware/all_flash/all_flash.n90ap.production/batterylow1-640x960.s5l8930x.img3 [*] Replacing flash_nor... [+] Added: Firmware/all_flash/all_flash.n90ap.production/glyphplugin-640x960.s5l8930x.img3 [*] Replacing flash_nor... [+] Added: Firmware/all_flash/all_flash.n90ap.production/recoverymode7-640x960.s5l8930x.img3 [*] Rewrite img3 TYPE tag: recm -> recb [+] Added: Firmware/all_flash/all_flash.n90ap.production/recoverymode-640x960.s5l8930x.img3 [*] Replacing flash_nor... [+] Added: Firmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 [*] Replacing flash_nor... [*] Creating new iBoot... [*] Rewrite img3 TYPE tag: ibot -> ibob [+] Added: Firmware/all_flash/all_flash.n90ap.production/iBoot4.n90ap.RELEASE.img3 [*] Patching iBoot... iBoot: encrypted input... /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802 /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802 encrypted output... /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802 [patchiBoot] filesize: 36000 [patchiBoot] version: 1072 [patchiBoot] iboot_type: iBoot [patchiBoot] iboot_base: 5ff00000 [patchiBoot] verify_shsh: 00013414 [patchiBoot] boot_partition: 000007da [patchiBoot] boot_ramdisk: 0000086e [patchiBoot] boot_args_null: 000145a0 [patchiBoot] boot_args: 0001459c [patchiBoot] reliance_str: 00034800 [patchiBoot] writing buf writing... success iBoot: /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802 /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802 /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 0f40ed16cc6330db75cd368ce6c742dfe1b2f558d080178847a98d97a905e9c40cda2cc8bb827f5bf724d6a553f30802 writing... success [*] Done: Firmware/all_flash/all_flash.n90ap.production/iBoot4.n90ap.RELEASE.img3 [+] Added: Firmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 [*] restore bootArgs: cs_enforcement_disable=1 amfi_get_out_of_my_way=1 iBSS: encrypted input... /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7 /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7 encrypted output... /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7 [patchiBoot] filesize: 26000 [patchiBoot] version: 1072 [patchiBoot] iboot_type: iBSS [patchiBoot] iboot_base: 84000000 [patchiBoot] verify_shsh: 00012bd4 [patchiBoot] writing buf writing... success iBSS: /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7 /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7 /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:593: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7 writing... success Restore Ramdisk: writing... success [*] Found: ramdisk package: src/bin.tar /home/runner/work/powdersn0w_pub/powdersn0w_pub/xpwn/ipsw-patch/main.c:main:1129: using filesystem backed temporary storage Writing out data.. run 100: start=25952256 sectors=512, length=64272, fileOffset=0xa49eee run 200: start=52166656 sectors=512, length=262144, fileOffset=0x1de517c run 300: start=78381056 sectors=512, length=262144, fileOffset=0x36e2bcf run 400: start=104595456 sectors=512, length=25572, fileOffset=0x4c304d1 run 500: start=130809856 sectors=512, length=205227, fileOffset=0x56a6a6e run 600: start=157024256 sectors=512, length=262144, fileOffset=0x6a22eeb run 700: start=183238656 sectors=512, length=262144, fileOffset=0x82c114d run 800: start=209453056 sectors=512, length=253391, fileOffset=0x98fcfaa run 900: start=235667456 sectors=512, length=238467, fileOffset=0xb0b69b3 run 1000: start=261881856 sectors=512, length=115933, fileOffset=0xb8b2e45 run 1100: start=288096256 sectors=512, length=102485, fileOffset=0xbe9ca9d run 1200: start=314310656 sectors=512, length=229218, fileOffset=0xd10b499 run 1300: start=340525056 sectors=512, length=240371, fileOffset=0xe76f3aa run 1400: start=366739456 sectors=512, length=175364, fileOffset=0xfab1edc run 1500: start=392953856 sectors=512, length=138701, fileOffset=0x1085af27 run 1600: start=419168256 sectors=512, length=137128, fileOffset=0x11594fea run 1700: start=445382656 sectors=512, length=123666, fileOffset=0x1235fec3 run 1800: start=471597056 sectors=512, length=142147, fileOffset=0x1306bbc2 run 1900: start=497811456 sectors=512, length=98227, fileOffset=0x138ece2c run 2000: start=542375936 sectors=512, length=29890, fileOffset=0x140db07b run 2100: start=568590336 sectors=512, length=249563, fileOffset=0x1500beed run 2200: start=594804736 sectors=512, length=262144, fileOffset=0x168a5137 run 2300: start=621019136 sectors=512, length=262144, fileOffset=0x1800333e run 2400: start=647233536 sectors=512, length=262144, fileOffset=0x197073c5 run 2500: start=673447936 sectors=512, length=262144, fileOffset=0x1afdf962 run 2600: start=699662336 sectors=512, length=262144, fileOffset=0x1c8388d1 run 2700: start=725876736 sectors=512, length=147640, fileOffset=0x1dcda0fe run 2800: start=752091136 sectors=512, length=262144, fileOffset=0x1f049e6e run 2900: start=778305536 sectors=512, length=262144, fileOffset=0x20805f8a run 3000: start=804519936 sectors=512, length=243617, fileOffset=0x21f290aa run 3100: start=830734336 sectors=512, length=262144, fileOffset=0x23584572 run 3200: start=856948736 sectors=512, length=175958, fileOffset=0x24afc55b Growing root to minimum: 1054 [*] Executing needPref... unencrypted ramdisk growing ramdisk: 23703552 -> 25432064 retrieving...patching... [patchASR] sz: 2c260 [patchASR] magic: feedface [patchASR] text_vmaddr: 1000 [patchASR] cmdsize: 00000010 [patchASR] dataoff: 0002bdc0 [patchASR] datasize: 1184 [patchASR] text_base: 00001000 [patchASR] image_passed_signature: 00014210 [patchASR] image_failed_signature: 0001421a [patchASR] patched: 0001321a: bff9f7ff [patchASR] csdir_start: 0002bde4 [patchASR] hashOffset: 66 [patchASR] nSpecialSlots: 2 [patchASR] nCodeSlots: 2c [patchASR] codeLimit: 2bdc0 [patchASR] hashSize: 14 [patchASR] hashType: 1 [patchASR] pageSize: 1000 [patchASR] checking cs slots... [validateHash] 2a7997aa39319cfe61514924fea8dd81e61896e6 != edb76caad3afa0b490086d635146170b8a408dc4 [patchASR] writing buf writing... success [*] Installing Package merging src/bin.tar ignoring bin, type = 5 file: bin/dd (0755), size = 96080 ignoring sbin, type = 5 file: sbin/partition4 (0755), size = 62352 file: sbin/umount (0755), size = 22784 file: iBoot (0664), size = 223452 [+] ramdiskVolume ... Moved: /sbin/reboot -> /sbin/reboot_ [+] ramdiskVolume ... Added: /sbin/reboot [+] ramdiskVolume ... Added: /exploit [*] ramdiskVolume ... chmod: /sbin/reboot -rwx/-r-x/-r-x [*] ramdiskVolume ... chown: /sbin/reboot root:root got /usr/local/share/restore/options.plist from ramdisk start create restore options MinimumSystemPartition 1054 CreateFilesystemPartitions SystemPartitionSize 1054 UpdateBaseband Creating and writing DDM and partition map... run 0: sectors=1, left=1 run 0: sectors=60, left=60 malloc: 0x55c3b77b10a0 4096 run 0: sectors=4, left=4 Writing main data blkx... run 100: sectors=512, left=2107904 run 200: sectors=512, left=2056704 run 300: sectors=512, left=2005504 run 400: sectors=512, left=1954304 run 500: sectors=512, left=1903104 run 600: sectors=512, left=1851904 run 700: sectors=512, left=1800704 run 800: sectors=512, left=1749504 run 900: sectors=512, left=1698304 run 1000: sectors=512, left=1647104 run 1100: sectors=512, left=1595904 run 1200: sectors=512, left=1544704 run 1300: sectors=512, left=1493504 run 1400: sectors=512, left=1442304 run 1500: sectors=512, left=1391104 run 1600: sectors=512, left=1339904 run 1700: sectors=512, left=1288704 run 1800: sectors=512, left=1237504 run 1900: sectors=512, left=1186304 run 2000: sectors=512, left=1135104 run 2100: sectors=512, left=1083904 run 2200: sectors=512, left=1032704 run 2300: sectors=512, left=981504 run 2400: sectors=512, left=930304 run 2500: sectors=512, left=879104 run 2600: sectors=512, left=827904 run 2700: sectors=512, left=776704 run 2800: sectors=512, left=725504 run 2900: sectors=512, left=674304 run 3000: sectors=512, left=623104 run 3100: sectors=512, left=571904 run 3200: sectors=512, left=520704 run 3300: sectors=512, left=469504 run 3355: skipping sectors=441328, left=441344 run 3356: skipping sectors=14, left=16 Inserting main blkx... Inserting cSum data... Inserting nsiz data Writing free partition... Writing XML data... making size data we know to flip this size resource Generating UDIF metadata... Master checksum: 26986b9e Writing out UDIF resource file... Cleaning up... Done. packing: 038-2265-002.dmg (23705796) packing: 038-2268-002.dmg (25024708) packing: 038-2288-002.dmg (630808576) packing: BuildManifest.plist (22691) packing: Firmware/ (0) packing: Firmware/ICE3_04.10.01_BOOT_02.13.Release.bbfw (3811912) packing: Firmware/all_flash/ (0) packing: Firmware/all_flash/all_flash.n90ap.production/ (0) packing: Firmware/all_flash/all_flash.n90ap.production/DeviceTree.n90ap.img3 (60612) packing: Firmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 (131468) packing: Firmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3 (15172) packing: Firmware/all_flash/all_flash.n90ap.production/applelogo7-640x960.s5l8930x.img3 (6796) packing: Firmware/all_flash/all_flash.n90ap.production/applelogoT-640x960.s5l8930x.img3 (2816) packing: Firmware/all_flash/all_flash.n90ap.production/batterycharging0-640x960.s5l8930x.img3 (9740) packing: Firmware/all_flash/all_flash.n90ap.production/batterycharging1-640x960.s5l8930x.img3 (35020) packing: Firmware/all_flash/all_flash.n90ap.production/batteryfull-640x960.s5l8930x.img3 (84044) packing: Firmware/all_flash/all_flash.n90ap.production/batterylow0-640x960.s5l8930x.img3 (43596) packing: Firmware/all_flash/all_flash.n90ap.production/batterylow1-640x960.s5l8930x.img3 (2060) packing: Firmware/all_flash/all_flash.n90ap.production/glyphcharging-640x960.s5l8930x.img3 (7364) packing: Firmware/all_flash/all_flash.n90ap.production/glyphplugin-640x960.s5l8930x.img3 (11852) packing: Firmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 (283020) packing: Firmware/all_flash/all_flash.n90ap.production/iBoot4.n90ap.RELEASE.img3 (223452) packing: Firmware/all_flash/all_flash.n90ap.production/manifest (515) packing: Firmware/all_flash/all_flash.n90ap.production/recoverymode-640x960.s5l8930x.img3 (129604) packing: Firmware/all_flash/all_flash.n90ap.production/recoverymode7-640x960.s5l8930x.img3 (69452) packing: Firmware/dfu/ (0) packing: Firmware/dfu/iBEC.n90ap.RELEASE.dfu (223620) packing: Firmware/dfu/iBSS.n90ap.RELEASE.dfu (157916) packing: Restore.plist (2076) packing: kernelcache.release.k48 (6179844) packing: kernelcache.release.n81 (6086340) packing: kernelcache.release.n90 (6204100) [Log] Applying iOS 4 patches [Log] Patch iBSS Archive: /home/jailbreaker2/Downloads/iPhone3,1_4.3.5_8L1_Restore.ipsw inflating: iBSS.n90ap.RELEASE.dfu /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7 main: Starting... main: iBoot-1072 inputted. patch_boot_args: Entering... patch_boot_args: Default boot-args string is at 0x21664 patch_boot_args: boot-args xref is at 0x13d84 patch_boot_args: Relocating boot-args string... patch_boot_args: "Reliance on this certificate" string found at 0x2405c patch_boot_args: Pointing default boot-args xref to 0x8402405c... patch_boot_args: Applying custom boot-args "rd=md0 -v amfi=0xff cs_enforcement_disable=1" patch_boot_args: Found LDR R0, =boot_args at 0x135d0 patch_boot_args: Found CMP R1, #0 at 0x135e2 patch_boot_args: Found IT EQ/IT NE at 0x141fa patch_boot_args: Found MOV R6, R7 at 0x141fc patch_debug_enabled: Entering... find_dtre_get_value_bl_insn: Entering... find_dtre_get_value_bl_insn: debug-enabled string is at 0x217ec find_dtre_get_value_bl_insn: "debug-enabled" xref is at 0x13e20 find_dtre_get_value_bl_insn: Found LDR R0, ="debug-enabled" at 0x1391e find_dtre_get_value_bl_insn: Found BL instruction at 0x13934 find_dtre_get_value_bl_insn: Leaving... patch_debug_enabled: Patching BL insn at 0x13934... patch_debug_enabled: Leaving... patch_rsa_check: Entering... find_rsa_check_4: Entering... find_rsa_check_4: Found RSA check at 0x1ad40 find_rsa_check_4: Leaving... patch_rsa_check: Patching RSA at 0x1ad40... find_ldr_ecid: Entering... find_ldr_ecid: Found LDR instruction at 0x12d3c find_ldr_ecid: Found BL ECID at 0x12d4c find_ldr_ecid: Leaving... patch_rsa_check: Patching BL ECID at 0x12d4c... find_ldr_bord: Entering... find_ldr_bord: Found LDR BORD instruction at 0x12d16 find_ldr_bord: Found BL BORD at 0x12d28 find_ldr_bord: Leaving... patch_rsa_check: Patching BL BORD at 0x12d28... find_ldr_prod: Entering... find_ldr_prod: Found LDR PROD instruction at 0x12c42 find_ldr_prod: Found BL PROD at 0x12c54 find_ldr_prod: Leaving... patch_rsa_check: Patching BL PROD at 0x12c54... find_ldr_sepo: Entering... find_ldr_sepo: Found LDR SEPO instruction at 0x12ce4 find_ldr_sepo: Found BL SEPO at 0x12ce6 find_ldr_sepo: Leaving... patch_rsa_check: Patching BL SEPO at 0x12ce6... main: Writing out patched file to iBSS.patched... main: Quitting... /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7 /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: 02f552f7ea815fde7d175133706e7a1d9d75da7e34c54b2cb1e81fa4e99b7ab4ba720a04a86e28bdaa0a3fb55cd2f7b7 [Log] Patch iBEC Archive: /home/jailbreaker2/Downloads/iPhone3,1_4.3.5_8L1_Restore.ipsw inflating: iBEC.n90ap.RELEASE.dfu /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ed377ff5daa159d18b706bd598373872af3684afbbd59286a269c70a6c6bb463999549600aaa42b1a9576b52ed434770 main: Starting... main: iBoot-1072 inputted. patch_boot_args: Entering... patch_boot_args: Default boot-args string is at 0x2ef24 patch_boot_args: boot-args xref is at 0x143b4 patch_boot_args: Relocating boot-args string... patch_boot_args: "Reliance on this certificate" string found at 0x34340 patch_boot_args: Pointing default boot-args xref to 0x5ff34340... patch_boot_args: Applying custom boot-args "rd=md0 -v amfi=0xff cs_enforcement_disable=1" patch_boot_args: Found LDR R0, =boot_args at 0x13c04 patch_boot_args: Found CMP R1, #0 at 0x13c0c patch_boot_args: Found IT EQ/IT NE at 0x14826 patch_boot_args: Found MOV R5, R7 at 0x14828 patch_debug_enabled: Entering... find_dtre_get_value_bl_insn: Entering... find_dtre_get_value_bl_insn: debug-enabled string is at 0x2f0ac find_dtre_get_value_bl_insn: "debug-enabled" xref is at 0x1444c find_dtre_get_value_bl_insn: Found LDR R0, ="debug-enabled" at 0x13f4e find_dtre_get_value_bl_insn: Found BL instruction at 0x13f64 find_dtre_get_value_bl_insn: Leaving... patch_debug_enabled: Patching BL insn at 0x13f64... patch_debug_enabled: Leaving... patch_rsa_check: Entering... find_rsa_check_4: Entering... find_rsa_check_4: Found RSA check at 0x1b900 find_rsa_check_4: Leaving... patch_rsa_check: Patching RSA at 0x1b900... find_ldr_ecid: Entering... find_ldr_ecid: Found LDR instruction at 0x13394 find_ldr_ecid: Found BL ECID at 0x133a4 find_ldr_ecid: Leaving... patch_rsa_check: Patching BL ECID at 0x133a4... find_ldr_bord: Entering... find_ldr_bord: Found LDR BORD instruction at 0x1336e find_ldr_bord: Found BL BORD at 0x13380 find_ldr_bord: Leaving... patch_rsa_check: Patching BL BORD at 0x13380... find_ldr_prod: Entering... find_ldr_prod: Found LDR PROD instruction at 0x1329a find_ldr_prod: Found BL PROD at 0x132ac find_ldr_prod: Leaving... patch_rsa_check: Patching BL PROD at 0x132ac... find_ldr_sepo: Entering... find_ldr_sepo: Found LDR SEPO instruction at 0x1333c find_ldr_sepo: Found BL SEPO at 0x1333e find_ldr_sepo: Leaving... patch_rsa_check: Patching BL SEPO at 0x1333e... main: Writing out patched file to iBEC.patched... main: Quitting... /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ed377ff5daa159d18b706bd598373872af3684afbbd59286a269c70a6c6bb463999549600aaa42b1a9576b52ed434770 /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ed377ff5daa159d18b706bd598373872af3684afbbd59286a269c70a6c6bb463999549600aaa42b1a9576b52ed434770 [Log] Patch AppleLogo Archive: temp.ipsw inflating: applelogo-640x960.s5l8930x.img3 [Log] Add all to custom IPSW updating: Firmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3 (stored 0%) updating: Firmware/all_flash/all_flash.n90ap.production/iBoot4.n90ap.RELEASE.img3 (stored 0%) updating: Firmware/dfu/iBEC.n90ap.RELEASE.dfu (stored 0%) updating: Firmware/dfu/iBSS.n90ap.RELEASE.dfu (stored 0%) [Log] Found existing saved 7.1.2 blobs: ../saved/shsh/3741186299215_iPhone3,1_n90ap_7.1.2-11D257_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2 [Log] Placing device to pwnDFU Mode using ipwndfu *** based on SHAtter exploit (segment overflow) by posixninja and pod2g *** Found: CPID:8930 CPRV:20 CPFM:03 SCEP:01 BDID:00 ECID:000003671014954F IBFL:00 SRTG:[iBoot-574.4] Device is now in pwned DFU Mode. [Log] Device iPhone3,1 has no baseband/disabled baseband update [Log] Extracting IPSW: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215.ipsw Archive: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215.ipsw inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/038-2265-002.dmg inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/038-2268-002.dmg inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/038-2288-002.dmg inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/BuildManifest.plist creating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/ inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/ICE3_04.10.01_BOOT_02.13.Release.bbfw creating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/ creating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/ inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/DeviceTree.n90ap.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/LLB.n90ap.RELEASE.img3 extracting: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/applelogo-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/applelogo7-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/applelogoT-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/batterycharging0-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/batterycharging1-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/batteryfull-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/batterylow0-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/batterylow1-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/glyphcharging-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/glyphplugin-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/iBoot.n90ap.RELEASE.img3 extracting: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/iBoot4.n90ap.RELEASE.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/manifest inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/recoverymode-640x960.s5l8930x.img3 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/all_flash/all_flash.n90ap.production/recoverymode7-640x960.s5l8930x.img3 creating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/dfu/ extracting: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/dfu/iBEC.n90ap.RELEASE.dfu extracting: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Firmware/dfu/iBSS.n90ap.RELEASE.dfu inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/Restore.plist inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/kernelcache.release.k48 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/kernelcache.release.n81 inflating: ../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/kernelcache.release.n90 [Log] Running idevicerestore with command: sudo ../bin/linux/x86_64/idevicerestore -ew "../iPhone3,1_4.3.5_8L1_CustomP-3741186299215.ipsw" Found device in DFU mode Found ECID 3741186299215 Identified device as n90ap, iPhone3,1 Extracting BuildManifest from IPSW Product Version: 4.3.5 Product Build: 8L1 Major: 8 Device supports Image4: false Variant: Customer Erase Install (IPSW) This restore will erase your device data. checking for local shsh Using cached SHSH Using cached filesystem from '../iPhone3,1_4.3.5_8L1_CustomP-3741186299215/038-2288-002.dmg' Extracting iBSS.n90ap.RELEASE.dfu... Personalizing IMG3 component iBSS... reconstructed size: 157937 Sending iBSS (157937 bytes)... [==================================================] 100.0% Recovery Mode Environment: iBoot build-version=iBoot-1072.61 iBoot build-style=RELEASE ramdisk-size=RELEASE Extracting 038-2265-002.dmg... Not personalizing component RestoreRamDisk... Sending RestoreRamDisk (25434308 bytes)... Extracting DeviceTree.n90ap.img3... Not personalizing component RestoreDeviceTree... Sending RestoreDeviceTree (60612 bytes)... Extracting kernelcache.release.n90... Not personalizing component RestoreKernelCache... Sending RestoreKernelCache (6204100 bytes)... About to restore device... Waiting for device... Device 197d10e6fd0b2d4e9ae427b446743ba1f8653fd5 is now connected in restore mode... Connecting now... Connected to com.apple.mobile.restored, version 12 Device 197d10e6fd0b2d4e9ae427b446743ba1f8653fd5 has successfully entered restore mode Hardware Information: BoardID: 0 ChipID: 35120 UniqueChipID: 3741186299215 ProductionMode: true Got status message Unhandled status message (28) common.c:printing 9036 bytes plist: AMRError 28 Log enableDeviceClock(false,FULL_CLOCK_INDEX) = 0x0 AppleM2ScalerCSCDriver: Added framebuffer device: AppleRGBOUT id: c0a37000 + AppleM2ScalerCSCDriver[0x82dd9e00]: Register Service virtual bool AppleM2ScalerCSCDriver::start(IOService*): this=0x82dd9e00, Added Scaler Number = 0 AppleAP3GDL::probe found device with ID: 0xd3 AppleAP3GDL::handleStart _calibrationMatrix [0 0 0] [0 0 0] [0 0 0] _odr200HzSampleInterval = 0 AppleAP3GDL::handleStart The calibration matrix is singular. Something is wrong. IOFixed - Coeffs -[r,g,b] = [0, 0, 0], [gain=0] AppleCT700::handleStart -- Cal Gain = 100, Cal trigger = 0, Cal release=0, Cal power=0, Cal shortFilter=0, Cal longFilter=0 BSD root: md0, major 2, minor 0 com.apple.AppleFSCompressionTypeZlib kmod start com.apple.AppleFSCompressionTypeZlib load succeeded virtual bool AppleMobileFileIntegrity::start(IOService*): built Jul 20 2011 03:32:12 L2TP domain init L2TP domain init complete PPTP domain init AppleS5L8920XBasebandSPIController::loadConfiguration: NCLK Frequency 48857142, Prescaler 3 BasebandSPIDevice::exitLowPower: Invalid state inactive AppleSerialMultiplexer: adap::start: Frame size is 2048, Rx Buffer count is 16 AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart1 at 0x82600000(0xd204e000) AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart2 at 0x82700000(0xd21a6000) AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart3 at 0x82800000(0xd21b5000) AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart6 at 0x82b00000(0xd2da0000) AppleSerialMultiplexer: mux::start: created new mux (13) for spi-baseband with adapter BasebandSPIDevice AUD10::start: 0x82d72000, highland-park mIISNub: 0x832cec00, sampleRate = 44100, ol=10, oi=12 AppleSerialMultiplexer: debugparams::init: Parsed flags "" ( 0 ) AppleSerialMultiplexer: !! mux::setPowerStateGated: Skipping power state change AppleSynopsysOTGDevice::start : start finished AppleBaseband: inconsistent mux function setup (0 0 0 0 0 0) IOSDIOController::enumerateSlot(): Searching for SDIO device in slot: 0 IOSDIOController::enumerateSlot(): Found SDIO I/O device. Function count(1), memory(0) AppleMultitouchN1SPI: successfully started AppleRGBOUT: TVOUT device is detected virtual bool AppleCLCD::start_hardware(IOService*), clcdDitherCfg: 0x80000001 mIsDitherFor8Bits: 1 IOReturn AppleCLCD::set_ditherTable_state(bool), mIsDitherFor8Bits is true, no dynamic dither table. IOSurface: buffer allocation size is zero AppleM2ScalerCSCDriver: Added framebuffer device: AppleCLCD id: c7e0c000 IOSDIOIoCardDevice::parseFn0CISTuple(): Device manufacturer ID 0x2d0, Product ID 0x4329 IOSDIOIoCardDevice::parseFn0CISTuple(): Manufacturer: "" IOSDIOIoCardDevice::parseFn0CISTuple(): Product: "" IOSDIOIoCardDevice::parseFn0CISTuple(): ProductInfo0: "s=B1" IOSDIOIoCardDevice::parseFn0CISTuple(): ProductInfo1: "P=N90 m=3.1 V=u" AppleBCMWLAN::init(): AppleBCMWLAN-84 Jul 9 2011 01:10:00 AppleBCMWLAN::init(): Starting with debug level: 4, debug flags: 00000000 AppleBCMWLAN::init(): AppleBCMWLAN-84 Jul 9 2011 01:10:00 AppleBCMWLAN::init(): Starting with debug level: 4, debug flags: 00000000 AppleMultitouchN1SPI: detected HBPP. driver will be kept alive AppleD1815PMUPowerSource: AppleUSBCableDetect 1 AppleD1815PMUPowerSource: AppleUSBCableType USBHost AppleEmbeddedUSBArbitrator::handleUSBCableTypeChange : Connected to a USB host, entering device mode AppleSynopsysOTGDevice::handleUSBCableConnect cable connected, but don't have device configuration yet AUD10::start: 0x82d72000, highland-park mIICNub: 0x82b60e80, mIISNub: 0x832cec00, mSerialNub: 0x802ebc00, sampleRate = 44100, ol=10, oi=12 display-scale = 2 display-rotation = 0 found suitable IOMobileFramebuffer: AppleCLCD display: 640 x 960 found PTP interface AppleSynopsysOTGDevice - Configuration: PTP AppleSynopsysOTGDevice Interface: PTP AppleSynopsysOTGDevice - Configuration: iPod USB Interface AppleSynopsysOTGDevice Interface: USBAudioControl AppleSynopsysOTGDevice Interface: USBAudioStreaming AppleSynopsysOTGDevice Interface: IapOverUsbHid AppleSynopsysOTGDevice - Configuration: PTP + Apple Mobile Device AppleSynopsysOTGDevice Interface: PTP AppleSynopsysOTGDevice Interface: AppleUSBMux AppleSynopsysOTGDevice - Configuration: PTP + Apple Mobile Device + Apple USB Ethernet AppleSynopsysOTGDevice Interface: PTP AppleSynopsysOTGDevice Interface: AppleUSBMux AppleSynopsysOTGDevice Interface: AppleUSBEthernet AppleSynopsysOTGDevice::gated_registerFunction Register function USBAudioControl AppleSynopsysOTGDevice::gated_registerFunction Register function USBAudioStreaming IOAccessoryPortUSB::start AppleSynopsysOTGDevice::gated_registerFunction Register function IapOverUsbHid virtual bool AppleUSBDeviceMux::start(IOService*) build: Jul 9 2011 01:12:10 init_waste AppleSynopsysOTGDevice::gated_registerFunction Register function AppleUSBMux AppleSynopsysOTGDevice::gated_registerFunction Register function AppleUSBEthernet AppleUSBEthernetDevice::start: Host MAC address = aa:fa:d8:e2:83:2c AppleSynopsysOTGDevice::gated_registerFunction Register function PTP AppleSynopsysOTGDevice::gated_registerFunction all functions registered- we are ready to start usb stack AppleS5L8930XUSBPhy::powerUp : with_hsic: 0 AppleEmbeddedUSBArbitrator::enableDeviceClock : enable: 1, index: 0 AppleS5L8930XUSBPhy::enableDeviceMode : enable: 1 IOReturn AppleUSBDeviceMux::setPropertiesGated(OSObject*) setting debug level to 7 AppleSynopsysOTGDevice::handleUSBReset unrecognized request 'GetValue' close(caller = 0xae327): remote port = 49153 unrecognized request 'GetValue' AppleSynopsysOTGDevice::handleUSBReset AppleUSBDeviceMux::handleConnectResult new session 0x84ba4780 established 62078<-lo0->49152 62078<-usb->1 AppleUSBDeviceMux::handleConnectResult new session 0x83734f80 established 62078<-lo0->49153 62078<-usb->2 void AppleUSBDeviceMux::handleMuxTCPInput(__mbuf*) received reset, closing 0x83734f80 AppleUSBEthernetDevice::message: kIOUSBDeviceInterfaceMessageTypeSetAlternateSetting, new alt-setting 1 AppleUSBDeviceMux::handleConnectResult new session 0x84ba4680 established 62078<-lo0->49154 62078<-usb->3 client protocol version 12 unable to open /usr/local/share/restore//options.n90.plist: No such file or directory *** UUID DB28B03D-9B69-5C02-C6D1-979E59DB723A *** Restore options: UpdateBaseband => <CFBoolean 0x2b5fb0 [0x2b59f8]>{value = false} UUID => <CFString 0x1cd0a620 [0x2b59f8]>{contents = "DB28B03D-9B69-5C02-C6D1-979E59DB723A"} MinimumSystemPartition => <CFNumber 0x1cd0a2e0 [0x2b59f8]>{value = +1054, type = kCFNumberSInt64Type} SystemPartitionSize => <CFNumber 0x1cd0a5c0 [0x2b59f8]>{value = +1054, type = kCFNumberSInt64Type} CreateFilesystemPartitions => <CFBoolean 0x2b5fa8 [0x2b59f8]>{value = true} entering partition_nand_device device is not a boot-from-NAND device entering wait_for_storage_device waiting for matching IOKit service: <CFBasicHash 0x1cd0a290 [0x2b59f8]>{type = mutable dict, count = 1, entries => 2 : <CFString 0x3d0670 [0x2b59f8]>{contents = "IOProviderClass"} = <CFString 0x1cd0a4e0 [0x2b59f8]>{contents = "AppleNANDFTL"} } AppleUSBDeviceMux::handleConnectResult new session 0x84ba4200 established 62078<-lo0->49155 62078<-usb->4 recv(8, 4) failed: connection closed unable to read message size: -1 could not receive message close(caller = 0xae327): remote port = 49154 waiting for matching IOKit service: <CFBasicHash 0x1cd0a290 [0x2b59f8]>{type = mutable dict, count = 1, entries => 2 : <CFString 0x3d0670 [0x2b59f8]>{contents = "IOProviderClass"} = <CFString 0x1cd0a4e0 [0x2b59f8]>{contents = "AppleNANDFTL"} } void AppleUSBDeviceMux::handleMuxTCPInput(__mbuf*) received reset, closing 0x84ba4680 unrecognized request 'GetValue' AppleUSBDeviceMux::handleConnectResult new session 0x83734f80 established 62078<-lo0->49156 62078<-usb->5 waiting for matching IOKit service: <CFBasicHash 0x1cd0a290 [0x2b59f8]>{type = mutable dict, count = 1, entries => 2 : <CFString 0x3d0670 [0x2b59f8]>{contents = "IOProviderClass"} = <CFString 0x1cd0a4e0 [0x2b59f8]>{contents = "AppleNANDFTL"} } waiting for matching IOKit service: <CFBasicHash 0x1cd0a290 [0x2b59f8]>{type = mutable dict, count = 1, entries => 2 : <CFString 0x3d0670 [0x2b59f8]>{contents = "IOProviderClass"} = <CFString 0x1cd0a4e0 [0x2b59f8]>{contents = "AppleNANDFTL"} } unable to find AppleNANDFTL MsgType StatusMsg Status 28 Log is available: enableDeviceClock(false,FULL_CLOCK_INDEX) = 0x0 AppleM2ScalerCSCDriver: Added framebuffer device: AppleRGBOUT id: c0a37000 + AppleM2ScalerCSCDriver[0x82dd9e00]: Register Service virtual bool AppleM2ScalerCSCDriver::start(IOService*): this=0x82dd9e00, Added Scaler Number = 0 AppleAP3GDL::probe found device with ID: 0xd3 AppleAP3GDL::handleStart _calibrationMatrix [0 0 0] [0 0 0] [0 0 0] _odr200HzSampleInterval = 0 AppleAP3GDL::handleStart The calibration matrix is singular. Something is wrong. IOFixed - Coeffs -[r,g,b] = [0, 0, 0], [gain=0] AppleCT700::handleStart -- Cal Gain = 100, Cal trigger = 0, Cal release=0, Cal power=0, Cal shortFilter=0, Cal longFilter=0 BSD root: md0, major 2, minor 0 com.apple.AppleFSCompressionTypeZlib kmod start com.apple.AppleFSCompressionTypeZlib load succeeded virtual bool AppleMobileFileIntegrity::start(IOService*): built Jul 20 2011 03:32:12 L2TP domain init L2TP domain init complete PPTP domain init AppleS5L8920XBasebandSPIController::loadConfiguration: NCLK Frequency 48857142, Prescaler 3 BasebandSPIDevice::exitLowPower: Invalid state inactive AppleSerialMultiplexer: adap::start: Frame size is 2048, Rx Buffer count is 16 AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart1 at 0x82600000(0xd204e000) AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart2 at 0x82700000(0xd21a6000) AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart3 at 0x82800000(0xd21b5000) AppleS5L8900XSerial: Identified Serial Port on ARM Device=uart6 at 0x82b00000(0xd2da0000) AppleSerialMultiplexer: mux::start: created new mux (13) for spi-baseband with adapter BasebandSPIDevice AUD10::start: 0x82d72000, highland-park mIISNub: 0x832cec00, sampleRate = 44100, ol=10, oi=12 AppleSerialMultiplexer: debugparams::init: Parsed flags "" ( 0 ) AppleSerialMultiplexer: !! mux::setPowerStateGated: Skipping power state change AppleSynopsysOTGDevice::start : start finished AppleBaseband: inconsistent mux function setup (0 0 0 0 0 0) IOSDIOController::enumerateSlot(): Searching for SDIO device in slot: 0 IOSDIOController::enumerateSlot(): Found SDIO I/O device. Function count(1), memory(0) AppleMultitouchN1SPI: successfully started AppleRGBOUT: TVOUT device is detected virtual bool AppleCLCD::start_hardware(IOService*), clcdDitherCfg: 0x80000001 mIsDitherFor8Bits: 1 IOReturn AppleCLCD::set_ditherTable_state(bool), mIsDitherFor8Bits is true, no dynamic dither table. IOSurface: buffer allocation size is zero AppleM2ScalerCSCDriver: Added framebuffer device: AppleCLCD id: c7e0c000 IOSDIOIoCardDevice::parseFn0CISTuple(): Device manufacturer ID 0x2d0, Product ID 0x4329 IOSDIOIoCardDevice::parseFn0CISTuple(): Manufacturer: "" IOSDIOIoCardDevice::parseFn0CISTuple(): Product: "" IOSDIOIoCardDevice::parseFn0CISTuple(): ProductInfo0: "s=B1" IOSDIOIoCardDevice::parseFn0CISTuple(): ProductInfo1: "P=N90 m=3.1 V=u" AppleBCMWLAN::init(): AppleBCMWLAN-84 Jul 9 2011 01:10:00 AppleBCMWLAN::init(): Starting with debug level: 4, debug flags: 00000000 AppleBCMWLAN::init(): AppleBCMWLAN-84 Jul 9 2011 01:10:00 AppleBCMWLAN::init(): Starting with debug level: 4, debug flags: 00000000 AppleMultitouchN1SPI: detected HBPP. driver will be kept alive AppleD1815PMUPowerSource: AppleUSBCableDetect 1 AppleD1815PMUPowerSource: AppleUSBCableType USBHost AppleEmbeddedUSBArbitrator::handleUSBCableTypeChange : Connected to a USB host, entering device mode AppleSynopsysOTGDevice::handleUSBCableConnect cable connected, but don't have device configuration yet AUD10::start: 0x82d72000, highland-park mIICNub: 0x82b60e80, mIISNub: 0x832cec00, mSerialNub: 0x802ebc00, sampleRate = 44100, ol=10, oi=12 display-scale = 2 display-rotation = 0 found suitable IOMobileFramebuffer: AppleCLCD display: 640 x 960 found PTP interface AppleSynopsysOTGDevice - Configuration: PTP AppleSynopsysOTGDevice Interface: PTP AppleSynopsysOTGDevice - Configuration: iPod USB Interface AppleSynopsysOTGDevice Interface: USBAudioControl AppleSynopsysOTGDevice Interface: USBAudioStreaming AppleSynopsysOTGDevice Interface: IapOverUsbHid AppleSynopsysOTGDevice - Configuration: PTP + Apple Mobile Device AppleSynopsysOTGDevice Interface: PTP AppleSynopsysOTGDevice Interface: AppleUSBMux AppleSynopsysOTGDevice - Configuration: PTP + Apple Mobile Device + Apple USB Ethernet AppleSynopsysOTGDevice Interface: PTP AppleSynopsysOTGDevice Interface: AppleUSBMux AppleSynopsysOTGDevice Interface: AppleUSBEthernet AppleSynopsysOTGDevice::gated_registerFunction Register function USBAudioControl AppleSynopsysOTGDevice::gated_registerFunction Register function USBAudioStreaming IOAccessoryPortUSB::start AppleSynopsysOTGDevice::gated_registerFunction Register function IapOverUsbHid virtual bool AppleUSBDeviceMux::start(IOService*) build: Jul 9 2011 01:12:10 init_waste AppleSynopsysOTGDevice::gated_registerFunction Register function AppleUSBMux AppleSynopsysOTGDevice::gated_registerFunction Register function AppleUSBEthernet AppleUSBEthernetDevice::start: Host MAC address = aa:fa:d8:e2:83:2c AppleSynopsysOTGDevice::gated_registerFunction Register function PTP AppleSynopsysOTGDevice::gated_registerFunction all functions registered- we are ready to start usb stack AppleS5L8930XUSBPhy::powerUp : with_hsic: 0 AppleEmbeddedUSBArbitrator::enableDeviceClock : enable: 1, index: 0 AppleS5L8930XUSBPhy::enableDeviceMode : enable: 1 IOReturn AppleUSBDeviceMux::setPropertiesGated(OSObject*) setting debug level to 7 AppleSynopsysOTGDevice::handleUSBReset unrecognized request 'GetValue' close(caller = 0xae327): remote port = 49153 unrecognized request 'GetValue' AppleSynopsysOTGDevice::handleUSBReset AppleUSBDeviceMux::handleConnectResult new session 0x84ba4780 established 62078<-lo0->49152 62078<-usb->1 AppleUSBDeviceMux::handleConnectResult new session 0x83734f80 established 62078<-lo0->49153 62078<-usb->2 void AppleUSBDeviceMux::handleMuxTCPInput(__mbuf*) received reset, closing 0x83734f80 AppleUSBEthernetDevice::message: kIOUSBDeviceInterfaceMessageTypeSetAlternateSetting, new alt-setting 1 AppleUSBDeviceMux::handleConnectResult new session 0x84ba4680 established 62078<-lo0->49154 62078<-usb->3 client protocol version 12 unable to open /usr/local/share/restore//options.n90.plist: No such file or directory *** UUID DB28B03D-9B69-5C02-C6D1-979E59DB723A *** Restore options: UpdateBaseband => {value = false} UUID => {contents = "DB28B03D-9B69-5C02-C6D1-979E59DB723A"} MinimumSystemPartition => {value = +1054, type = kCFNumberSInt64Type} SystemPartitionSize => {value = +1054, type = kCFNumberSInt64Type} CreateFilesystemPartitions => {value = true} entering partition_nand_device device is not a boot-from-NAND device entering wait_for_storage_device waiting for matching IOKit service: {type = mutable dict, count = 1, entries => 2 : {contents = "IOProviderClass"} = {contents = "AppleNANDFTL"} } AppleUSBDeviceMux::handleConnectResult new session 0x84ba4200 established 62078<-lo0->49155 62078<-usb->4 recv(8, 4) failed: connection closed unable to read message size: -1 could not receive message close(caller = 0xae327): remote port = 49154 waiting for matching IOKit service: {type = mutable dict, count = 1, entries => 2 : {contents = "IOProviderClass"} = {contents = "AppleNANDFTL"} } void AppleUSBDeviceMux::handleMuxTCPInput(__mbuf*) received reset, closing 0x84ba4680 unrecognized request 'GetValue' AppleUSBDeviceMux::handleConnectResult new session 0x83734f80 established 62078<-lo0->49156 62078<-usb->5 waiting for matching IOKit service: {type = mutable dict, count = 1, entries => 2 : {contents = "IOProviderClass"} = {contents = "AppleNANDFTL"} } waiting for matching IOKit service: {type = mutable dict, count = 1, entries => 2 : {contents = "IOProviderClass"} = {contents = "AppleNANDFTL"} } unable to find AppleNANDFTL ERROR: Unable to successfully restore device ERROR: Unable to restore device

[LukeZGD]

hmm, unable to find applenandftl means that your device is not compatible with ios 4

[apersonwhoexistssomehow]

oh, legacy ios kit says its an iphone 3,1 however, how would it be uncompatible

[LukeZGD]

oh, legacy ios kit says its an iphone 3,1 however, how would it be uncompatible

manufacturing date matters. on the newer devices they lose hardware compatibility with older ios versions. this is also the case with the iphone 3gs

[LukeZGD]

yes, there are also more cases of this that i know of:

• white iphone 4's are not compatible with 4.0-4.2.1 since they were released with 4.3
• some iphone 4's are not compatible with 4.0.x, only 4.1 and newer works on them

[apersonwhoexistssomehow]

is there a way to see the manufacturing date and what date would be compatible with what?

[LukeZGD]

is there a way to see the manufacturing date and what date would be compatible with what?

IMEI/serial number checker sites like sickw or sndeep, not sure about their accuracy tho