LukeZGD / Legacy-iOS-Kit

An all-in-one tool to restore/downgrade, save SHSH blobs, and jailbreak legacy iOS devices
GNU General Public License v3.0
1.2k stars 111 forks source link

ASR Error Restoring iPhone 4 to iOS 4.2.10 with powdersn0w #513

Closed Jefferyat closed 2 months ago

Jefferyat commented 3 months ago

Legacy iOS Kit

[Log] Selected IPSW file: /Users/apple/Desktop/iPhone3,3_4.2.10_8E600_Restore.ipsw [Log] Getting version from IPSW Archive: /Users/apple/Desktop/iPhone3,3_4.2.10_8E600_Restore.ipsw inflating: ./Restore.plist
[Log] Getting SHA1 hash for /Users/apple/Desktop/iPhone3,3_4.2.10_8E600_Restore.ipsw... [Log] Getting SHA1 hash from The Apple Wiki... % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 65756 100 65756 0 0 178k 0 --:--:-- --:--:-- --:--:-- 177k [Log] Using saved SHA1 hash for this IPSW: 789ee18ee9659c87cfff304f69fd7ea4c205693b [Log] IPSW SHA1sum matches

Legacy iOS Kit

[Log] Selected IPSW file: /Users/apple/Downloads/iPSW/iPhone 4 iPSW/iPhone 4 CDMA/iPhone3,3_7.1.2_11D257_Restore.ipsw [Log] Getting version from IPSW Archive: /Users/apple/Downloads/iPSW/iPhone 4 iPSW/iPhone 4 CDMA/iPhone3,3_7.1.2_11D257_Restore.ipsw inflating: ./Restore.plist
[Log] Getting SHA1 hash for /Users/apple/Downloads/iPSW/iPhone 4 iPSW/iPhone 4 CDMA/iPhone3,3_7.1.2_11D257_Restore.ipsw... [Log] Getting SHA1 hash from The Apple Wiki... % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 130k 100 130k 0 0 475k 0 --:--:-- --:--:-- --:--:-- 475k [Log] Using saved SHA1 hash for this IPSW: aaeda3c8e1979189faa153cdf43e817a3f81f74c [Log] IPSW SHA1sum matches

Legacy iOS Kit

[Input] Memory Option for creating custom IPSW

[Input] Verbose Boot Option

[Log] Found existing saved 7.1.2 blobs: ../saved/shsh/2728127595308_iPhone3,3_n92ap_7.1.2-11D257_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2 [Log] Found existing Custom IPSWs. Skipping IPSW creation. [Log] Found existing saved 7.1.2 blobs: ../saved/shsh/2728127595308_iPhone3,3_n92ap_7.1.2-11D257_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2 [Input] PwnDFU Tool Option

AUD10::start: 0x8310b000, highland-park mIISNub: 0x835a9900, sampleRate = 44100, ol=10, oi=12 AppleSerialMultiplexer: debugparams::init: Parsed flags "" ( 0 ) AppleSerialMultiplexer: !! mux::setPowerStateGated: Skipping power state change

AppleBaseband: inconsistent mux function setup (0 0 0 0 0 0) virtual bool AppleCLCD::start_hardware(IOService*), ditherCfg: 0x80000001 mIsDitherFor8Bits: 1 IOReturn AppleCLCD::set_ditherTable_state(bool), mIsDitherFor8Bits is true, no dynamic dither table. IOSurface: buffer allocation size is zero AppleM2ScalerCSCDriver: Added framebuffer device: AppleCLCD id: c7ce5000IOSDIOController::enumerateSlot(): Searching for SDIO device in slot: 0

IOSDIOController::enumerateSlot(): Found SDIO I/O device. Function count(1), memory(0) AppleRGBOUT: TVOUT device is detected AppleS5L8920XIOPFMI: Found Chip ID 0x7294D7EC on FMI0:CE0 AppleS5L8920XIOPFMI: Found Chip ID 0x7294D7EC on FMI0:CE1 AppleS5L8920XIOPFMI: Found Chip ID 0x7294D7EC on FMI1:CE8 AppleS5L8920XIOPFMI: Found Chip ID 0x7294D7EC on FMI1:CE9 AppleMultitouchN1SPI: successfully started IOSDIOIoCardDevice::parseFn0CISTuple(): Device manufacturer ID 0x2d0, Product ID 0x4329 IOSDIOIoCardDevice::parseFn0CISTuple(): Manufacturer: "" IOSDIOIoCardDevice::parseFn0CISTuple(): Product: "" IOSDIOIoCardDevice::parseFn0CISTuple(): ProductInfo0: "s=C0" IOSDIOIoCardDevice::parseFn0CISTuple(): ProductInfo1: "P=N92 m=2.2 V=m" AppleBCMWLAN::init(): AppleBCMWLAN-76.3 Jul 8 2011 18:43:18 AppleBCMWLAN::init(): Starting with debug level: 4, debug flags: 00000000 AppleBCMWLAN::init(): AppleBCMWLAN-76.3 Jul 8 2011 18:43:18 AppleBCMWLAN::init(): Starting with debug level: 4, debug flags: 00000000 AppleD1815PMUPowerSource: AppleUSBCableDetect 1 AppleD1815PMUPowerSource: AppleUSBCableType USBHost AppleEmbeddedUSBArbitrator::handleUSBCableTypeChange : Connected to a USB host, entering device mode AppleEmbeddedUSBNub::withProvider : allocated new nub 0x83691900 AppleEmbeddedUSBNub::initWithProvider : finished nub init AppleEmbeddedUSBArbitrator::_publishNubs : nub published AppleSynopsysOTGDevice::init : Logging Buffer Length = 4K AppleSynopsysOTGDevice::start : object is 0x83a7c000, registers at 0xd367c000, 0x86100000 physical AppleSynopsysOTGDevice::findMaxEndpoints: in EPs: 7, out EPs: 7, max_endpoint: 8, num_endpoints: 14 AppleSynopsysOTGDevice::handleUSBCableConnect cable connected, but don't have device configuration yet AppleSynopsysOTGDevice::start : start finished AUD10::start: 0x8310b000, highland-park mIICNub: 0x82ebef00, mIISNub: 0x835a9900, mSerialNub: 0x8358ba00, sampleRate = 44100, ol=10, oi=12 AppleMultitouchN1SPI: detected HBPP. driver will be kept alive AppleNANDLegacyFTL started with IOFlashStoragePartition provider AppleNANDLegacyFTL located at physical nand block offset 16 metadata-whitening was found and it's set to 1 default-ftl-version was found and it's set to 1 diag-bits is supplied by AppleNANDFTL [FTL:MSG] Apple NAND Driver (AND) RW [FTL:MSG] FIL_Init [OK] [FTL:MSG] BUF_Init [OK] [FTL:MSG] FPart Init [OK] display-scale = 2 display-rotation = 0 found suitable IOMobileFramebuffer: AppleCLCD display: 640 x 960 found PTP interface AppleSynopsysOTGDevice - Configuration: PTP AppleSynopsysOTGDevice Interface: PTP AppleSynopsysOTGDevice - Configuration: iPod USB Interface AppleSynopsysOTGDevice Interface: USBAudioControl AppleSynopsysOTGDevice Interface: USBAudioStreaming AppleSynopsysOTGDevice Interface: IapOverUsbHid AppleSynopsysOTGDevice - Configuration: PTP + Apple Mobile Device AppleSynopsysOTGDevice Interface: PTP AppleSynopsysOTGDevice Interface: AppleUSBMux AppleSynopsysOTGDevice - Configuration: PTP + Apple Mobile Device + Apple USB Ethernet AppleSynopsysOTGDevice Interface: PTP AppleSynopsysOTGDevice Interface: AppleUSBMux AppleSynopsysOTGDevice Interface: AppleUSBEthernet AppleSynopsysOTGDevice::gated_registerFunction Register function USBAudioControl AppleSynopsysOTGDevice::gated_registerFunction Register function USBAudioStreaming IOAccessoryPortUSB::start AppleSynopsysOTGDevice::gated_registerFunction Register function IapOverUsbHid virtual bool AppleUSBDeviceMux::start(IOService) build: Jul 8 2011 18:45:58 init_waste AppleSynopsysOTGDevice::gated_registerFunction Register function AppleUSBMux AppleSynopsysOTGDevice::gated_registerFunction Register function AppleUSBEthernet AppleUSBEthernetDevice::start: Host MAC address = 26:ab:81:ac:e9:49 AppleSynopsysOTGDevice::gated_registerFunction Register function PTP AppleSynopsysOTGDevice::gated_registerFunction all functions registered- we are ready to start usb stack AppleS5L8930XUSBPhy::powerUp : with_hsic: 0 AppleEmbeddedUSBArbitrator::enableDeviceClock : enable: 1, index: 0 AppleS5L8930XUSBPhy::enableDeviceMode : enable: 1 IOReturn AppleUSBDeviceMux::setPropertiesGated(OSObject) setting debug level to 7 AppleSynopsysOTGDevice::handleUSBReset recv(10, 4) failed: connection closed unable to read message size: -1 could not receive message close(caller = 0x5d2f): remote port = 49152 close(caller = 0x5d2f): remote port = 49153 unrecognized request 'GetValue' client protocol version 12 unable to open /usr/local/share/restore//options.n92.plist: No such file or directory UUID A852CC5E-F320-BC08-B444-9B410238B3DC Restore options: UpdateBaseband => <CFBoolean 0x20a460 [0x2099fc]>{value = false} UUID => <CFString 0xc1e2e0 [0x2099fc]>{contents = "A852CC5E-F320-BC08-B444-9B410238B3DC"} MinimumSystemPartition => <CFNumber 0xc1dfc0 [0x2099fc]>{value = +1054, type = kCFNumberSInt64Type} SystemPartitionSize => <CFNumber 0xc1e280 [0x2099fc]>{value = +1054, type = kCFNumberSInt64Type} FlashNOR => <CFBoolean 0x20a460 [0x2099fc]>{value = false} CreateFilesystemPartitions => <CFBoolean 0x20a458 [0x2099fc]>{value = true} entering partition_nand_device device supports boot-from-NAND AppleSynopsysOTGDevice::stallBadSetupRequest request: 80 06 0f00 0000 0005 AppleUSBDeviceMux::handleConnectResult new session 0x8518ad00 established 62078<-lo0->49152 62078<-usb->33799 void AppleUSBDeviceMux::handleMuxTCPInput(mbuf*) received reset, closing 0x8518ad00 AppleUSBDeviceMux::handleConnectResult new session 0x84f25000 established 62078<-lo0->49153 62078<-usb->34055 AppleUSBDeviceMux::handleConnectResult new session 0x8518ad00 established 62078<-lo0->49154 62078<-usb->34311 void AppleUSBDeviceMux::handleMuxTCPInput(mbuf*) received reset, closing 0x84f25000 AppleUSBDeviceMux::handleConnectResult new session 0x8518ac80 established 62078<-lo0->49155 62078<-usb->34567 irst Failing CE: 0

AppleS5L8920XIOPFMI: ERROR: First Failing CE: 0

AppleS5L8920XIOPFMI: ERROR: First Failing CE: 0

AppleS5L8920XIOPFMI: ERROR: First Failing CE: 0

AppleS5L8920XIOPFMI: ERROR: First Failing CE: 0

AppleS5L8920XIOPFMI: ERROR: First Failing CE: 0

[FTL:MSG] VSVFL Register [OK] [FTL:MSG] VFL Init [OK] [WMR:INF] Formatting with metadata whitening [FTL:MSG] Calling VFL_FactoryReformat() irst Failing CE: 0

AppleS5L8920XIOPFMI: ERROR: First Failing CE: 0

AppleS5L8920XIOPFMI: ERROR: First Failing CE: 0

AppleS5L8920XIOPFMI: ERROR: First Failing CE: 0

AppleS5L8920XIOPFMI: ERROR: First Failing CE: 0

AppleS5L8920XIOPFMI: ERROR: First Failing CE: 0

[VFL:INF] BBT found for CS 0 [VFL:INF] BBT found for CS 1 [VFL:INF] BBT found for CS 2 [VFL:INF] BBT found for CS 3 [FTL:MSG] VFL_Format [OK] [FTL:MSG] YAFTL Register [OK] [FTL:MSG] FTL Init [OK] [FTL:MSG] FTL Format [OK] [FTL:MSG] Write Signature OK 0x43313132 [FTL:MSG] Read back Signature OK [FTL:MSG] VFL_Open [OK] yaFTL::YAFTL_Open(l:2988): CXT is not valid . Performing full NAND R/O restore ...
[FTL:MSG] FTL_Open [OK] [NAND] _borrowSpareBlocks:325 found 0 previously allocated [NAND] _stressBlock:842 CE 3 Block 4149 PASSED [NAND] _stressBlock:842 CE 3 Block 4143 PASSED [NAND] _stressBlock:842 CE 3 Block 4141 PASSED unrecognized request 'GetValue' AppleUSBDeviceMux::handleConnectResult new session 0x84f25000 established 62078<-lo0->49156 62078<-usb->34823 [NAND] _stressBlock:842 CE 3 Block 4139 PASSED [NAND] _stressBlock:842 CE 3 Block 4137 PASSED [NAND] _stressBlock:842 CE 3 Block 4135 PASSED AppleS5L8930XUSBArbitrator::handleUSBCableTypeChange : no change in cable-type recv(13, 4) failed: connection closed unable to read message size: -1 could not receive message close(caller = 0x5d2f): remote port = 49154 unable to check is-bfn-partitioned property nand device is already partitioned entering wait_for_storage_device entering format_effaceable_storage void AppleUSBDeviceMux::handleMuxTCPInput(__mbuf*) received reset, closing 0x8518ad00 AppleImage3NORAccess::start imageVersion: 3 effaceable storage formatted successfully entering ramrod_probe_media find_filesystem_partitions: storage=/dev/disk0 system= data= update= entering check_for_restore_log partition path has not been populated (partition may not exist) entering clean_NAND NAND format complete entering ramrod_probe_media find_filesystem_partitions: storage=/dev/disk0 system= data= update= entering format_storage_for_LwVM use-lwvm property not found entering create_filesystem_partitions unable to open : No such file or directory creating 2 partitions creating encrypted data partition entering ramrod_probe_media device partitioning scheme is GPT find_filesystem_partitions: storage=/dev/disk0 system=/dev/disk0s1 data=/dev/disk0s2s1 update= wipe entire partition: 1 (old = 0 new = 1054) block size for /dev/disk0s1: 8192 /sbin/newfs_hfs -s -v System -b 8192 -n a=8192,c=8192,e=8192 /dev/disk0s1 executing /sbin/newfs_hfs -s -v System -b 8192 -n a=8192,c=8192,e=8192 /dev/disk0s1 Initialized /dev/rdisk0s1 as a 1 GB HFS Plus volume block size for /dev/disk0s2s1: 8192 /sbin/newfs_hfs -s -v Data -J -P -b 8192 -n a=8192,c=8192,e=8192 /dev/disk0s2s1 executing /sbin/newfs_hfs -s -v Data -J -P -b 8192 -n a=8192,c=8192,e=8192 /dev/disk0s2s1 Initialized /dev/rdisk0s2s1 as a 14 GB HFS Plus volume with a 8192k journal entering restore_images executing /usr/sbin/asr -source asr://localhost:12345 -target /dev/disk0s1 -erase -noprompt --chunkchecksum --puppetstrings ASR: execv: /usr/sbin/asr: Permission denied

ERROR: Unable to restore device [Log] Do not disconnect your device, not done yet

LukeZGD commented 3 months ago

oops mb, try this again in v24.06.28 (delete the existing custom ipsw first before retyring)

LukeZGD commented 3 months ago

also, after the restore succeeds, the device might boot loop on apple logo, to attempt fixing this, enter dfu mode and got to other utilities -> disable/enable exploit -> enable exploit

edit: most likely no need to do this anymore as of latest update

LukeZGD commented 3 months ago

update: just re-do it in v24.06.30, delete the custom ipsws as usual, no need to manually enable exploit anymore hopefully

Jefferyat commented 3 months ago

Tried Downgrading iPhone3,3 to iOS 4.2.10 with v24.06.30 it restores successfully on the first restore but on the second restore it errors out, i also tried enabling exploit after second restore and then after that it sent the phone into DFU Mode Jailbreak option was enabled

Jefferyat commented 3 months ago

Legacy iOS Kit

[Log] Selected IPSW file: /Users/theapplepie/Desktop/iPhone3,3_4.2.10_8E600_Restore.ipsw [Log] Getting version from IPSW Archive: /Users/theapplepie/Desktop/iPhone3,3_4.2.10_8E600_Restore.ipsw inflating: ./Restore.plist
[Log] Getting SHA1 hash for /Users/theapplepie/Desktop/iPhone3,3_4.2.10_8E600_Restore.ipsw... [Log] Getting SHA1 hash from The Apple Wiki... % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 65756 100 65756 0 0 181k 0 --:--:-- --:--:-- --:--:-- 182k [Log] Using saved SHA1 hash for this IPSW: 789ee18ee9659c87cfff304f69fd7ea4c205693b [Log] IPSW SHA1sum matches

Legacy iOS Kit

[Log] Selected IPSW file: /Users/theapplepie/Desktop/iPhone3,3_7.1.2_11D257_Restore.ipsw [Log] Getting version from IPSW Archive: /Users/theapplepie/Desktop/iPhone3,3_7.1.2_11D257_Restore.ipsw inflating: ./Restore.plist
[Log] Getting SHA1 hash for /Users/theapplepie/Desktop/iPhone3,3_7.1.2_11D257_Restore.ipsw... [Log] Getting SHA1 hash from The Apple Wiki... % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 130k 100 130k 0 0 588k 0 --:--:-- --:--:-- --:--:-- 597k [Log] Using saved SHA1 hash for this IPSW: aaeda3c8e1979189faa153cdf43e817a3f81f74c [Log] IPSW SHA1sum matches

Legacy iOS Kit

[Input] Memory Option for creating custom IPSW

[Input] Verbose Boot Option

[Log] Found existing saved 7.1.2 blobs: ../saved/shsh/2728127595308_iPhone3,3_n92ap_7.1.2-11D257_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2 [Log] Found existing Custom IPSWs. Skipping IPSW creation. [Log] Found existing saved 7.1.2 blobs: ../saved/shsh/2728127595308_iPhone3,3_n92ap_7.1.2-11D257_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2

ERROR: Unable to successfully restore device ERROR: Unable to restore device

[Log] Restoring done! Read the message below if any error has occurred:

LukeZGD commented 3 months ago

ok, maybe v24.06.34 will fix this, hopefully

Jefferyat commented 3 months ago

Tested restoring iPhone3,3 to iOS 4.2.10 with Legacy iOS Kit, after the second restore instead of entering recovery mode, it entered DFU Mode and after enabling the exploit it entered dfu mode

LukeZGD commented 3 months ago

Found the issue, sorry about all this.. Hopefully everything is fixed now in v24.06.35 I just pushed.

Jefferyat commented 3 months ago

Legacy iOS Kit

[Log] Selected IPSW file: /Users/theapplepie/Desktop/iPhone3,3_4.2.10_8E600_Restore.ipsw [Log] Getting version from IPSW Archive: /Users/theapplepie/Desktop/iPhone3,3_4.2.10_8E600_Restore.ipsw inflating: ./Restore.plist
[Log] Getting SHA1 hash for /Users/theapplepie/Desktop/iPhone3,3_4.2.10_8E600_Restore.ipsw... [Log] Getting SHA1 hash from The Apple Wiki... % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 65756 100 65756 0 0 166k 0 --:--:-- --:--:-- --:--:-- 167k [Log] Using saved SHA1 hash for this IPSW: 789ee18ee9659c87cfff304f69fd7ea4c205693b [Log] IPSW SHA1sum matches

Legacy iOS Kit

[Log] Selected IPSW file: /Users/theapplepie/Desktop/iPhone3,3_7.1.2_11D257_Restore.ipsw [Log] Getting version from IPSW Archive: /Users/theapplepie/Desktop/iPhone3,3_7.1.2_11D257_Restore.ipsw inflating: ./Restore.plist
[Log] Getting SHA1 hash for /Users/theapplepie/Desktop/iPhone3,3_7.1.2_11D257_Restore.ipsw... [Log] Getting SHA1 hash from The Apple Wiki... % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 130k 100 130k 0 0 448k 0 --:--:-- --:--:-- --:--:-- 454k [Log] Using saved SHA1 hash for this IPSW: aaeda3c8e1979189faa153cdf43e817a3f81f74c [Log] IPSW SHA1sum matches

Legacy iOS Kit

[Input] Memory Option for creating custom IPSW

[Input] Verbose Boot Option

[Log] Found existing saved 7.1.2 blobs: ../saved/shsh/2728127595308_iPhone3,3_n92ap_7.1.2-11D257_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2 [Log] Found existing Custom IPSWs. Skipping IPSW creation. [Log] Found existing saved 7.1.2 blobs: ../saved/shsh/2728127595308_iPhone3,3_n92ap_7.1.2-11D257_3a88b7c3802f2f0510abc432104a15ebd8bd7154.shsh2

Jefferyat commented 3 months ago

Tried Restoring to iOS 4.2.10 on iPhone3,3 and comes with this on the log above

LukeZGD commented 3 months ago

Hmm I'm not sure what happened there, try restoring to 7.1.2, clear NVRAM, and re-do the downgrade, along with deleting the custom IPSWs before doing so

LukeZGD commented 2 months ago

I pushed an update (v24.06.41) that hopefully addresses the issue of getting stuck at the first restore, let me know if it works

Delete the existing custom IPSWs before the re-attempt

If it doesn't succeed on first restore, do not continue since it's a failed attempt, let me know when this happens and send terminal output if you can

If it succeeds though, the device may get stuck at recovery mode after the second restore, but it should hopefully boot after going to Other Utilities -> Disable/Enable Exploit -> Enable Exploit

Jefferyat commented 2 months ago

iPhone 4 Restored to iOS 4.2.10 both successfully and enabled exploit successfully but now it is stuck in a verbose boot loop

LukeZGD commented 2 months ago

oof, that sucks.. i really thought that since ipad 1 4.2.1 is fixed, 4.2.x for the 3,3 will be fixed as well, but apparently not.. do you have a video of the verbose boot loop? although it might be something that i cant fix, since 4.2.x will be unusable anyway due to activation issue

LukeZGD commented 2 months ago

ill close the issue for now since the asr and stuck restore issues are fixed, and the current issue now might be unfixable