Closed Sparronator9999 closed 4 months ago
LukeZGD
commented
4 months ago Delete the existing custom IPSW and retry the Restore/Downgrade
If it still doesn't work, get the full terminal output that shows both the IPSW creation and restore process
Regarding the unrelated: any errors with restores done last year is irrelevant now, Legacy iOS Kit has changed significantly in 2024 alone
Something to check as well, there is also a chance that your 4S cannot run iOS 5: https://coolbooter.com/4Sid
Sparronator9999
commented
4 months ago I just checked my phone on Reincubate Lookup, and it says my phone was manufactured in February 2012:
(I think it’s safe to assume that the Shipped iOS is inaccurate, as 6.1.3 wasn’t shipped until March 2013)
I will retry restoring again tomorrow (hello from Australia) with full IPSW creation and restore.
Sparronator9999
commented
4 months ago @LukeZGD It is now the next day for me, and I have attempted another restore with powdersn0w.
Here's the log:
The same thing happened as in the original bug report, that is:
I am going to attempt another restore under macOS High Sierra (once I get it running again) to see if this issue is Linux-specific.
P.S.
I misclicked the Close issue button earlier. That's why the issue was closed, then re-opened immediately after.
LukeZGD
commented
4 months ago I can't seem to reproduce this issue, I used the same powdersn0w options on my 4S and the restore started successfully with Apple logo and progress bar (I exited it though since I don't have 7.1.x blobs for it)
Also tried it on "Other (Tethered)" to 5.1.1 and it also worked fine
Here's something you can try: Update to v24.07.01 first, delete the existing custom IPSW, then go to Other Options -> Enable Flags -> Enable gasgauge-patch flag, and redo the Restore/Downgrade (you should see the message "gasgauge-patch flag detected"). Not sure if this will make any difference though
Sparronator9999
commented
4 months ago After several hours of waiting for High Sierra to install and update (I do not miss the long update times of macOS), the script produced the same result as with Linux:
At least the issue doesn't seem to be OS-dependant.
Sparronator9999
commented
4 months ago @LukeZGD Oops, I just saw your comment. Will try that now.
Sparronator9999
commented
4 months ago After enabling the gasgauge-patch flag, the phone appears to have restored successfully, but appears to be stuck on a black screen (with backlight) and possibly bootlooping.
I haven't missed anything important, right?
Note that I have been able to successfully restore the phone to iOS 7.1.1 with the onboard SHSH blobs before.
LukeZGD
commented
4 months ago It seems that your device is just unable to boot iOS 5 for some reason, idk any other solution to this, sorry
There are some things that you can try to confirm:
Sparronator9999
commented
4 months ago Attempting to restore back to 9.3.6 now. I will report back once I get CoolBooter running (hopefully).
Sparronator9999
commented
4 months ago Well, that took much, much longer than I anticipated.
TL;DR:
CoolBooter (GUI) v1.5 didn't boot iOS 5 when running on iOS 8.4.1.
I tried iOS 9.3.6 first, but the installer appeared to hang during the "Preparing iOS image" stage.
Should I try again with CoolBooter 1.6 (or another version)?
Maybe I just have to accept that my iPhone with iOS 7.1 SHSH blobs can't run iOS 5 :'(
Sparronator9999
commented
4 months ago Yep, it looks like my iPhone (despite being made before iOS 6 released) is just not able to boot iOS 5(.1.1) for some reason.
I was able to successfully restore it using powdersn0w to iOS 6.0 (without enabling the gas-gauge patch flag, and using default settings: jailbreak with verbose boot).
Maybe the battery was replaced at some point before I got this phone and the new battery isn't compatible with the iOS 5 gas gauge software? I would try swapping the battery between this iPhone and another one that I have that has iOS 5.0.1 installed, but I don't have any pentalobe screwdriver bits.
Either way, I think it would be a good idea to add in the documentation somewhere that not all iPhone 4Ses are able to run iOS 5.
I think I'll try another build of iOS 5, but if that doesn't work, I'll probably just stick to OTA iOS 6.
Thanks for the quick replies, and for creating such an amazing downgrade tool! (I have already downgraded a couple of other devices I had lying around - my 5th gen iPod to iOS 8.4.1 (infinitely better than iOS 9), and my other iPhone 4S (my first phone!) to iOS 6.1.3).
Edit: accidentally clicked the Close issue button + typos.
LukeZGD
commented
4 months ago np, im thinking if your 4s might be a replacement unit or something like that.. but the manufacturing date seems to say otherwise, and either way, it seems to be unable to run ios 5, so yeah its a weird case
Sparronator9999
commented
4 months ago Yep, someone's been in here definitely done repair work on my iPhone before it came into my possession.
I checked the SN on the SIM tray and it's different to the one shown in Settings (and not one of my other two iPhone 4S's SNs). This probably means the motherboard has been swapped into another chassis, and the SIM tray wasn't swapped with it (the one from the "new" chassis was kept?)
That shouldn't change anything though, unless a new (possibly post-iOS 6) battery does have iOS 5 gas gauge incompatibilities?
This might be something I look at again in the future, when I actually have the tools to take apart my iPhones. But for now, I think I'm happy with a phone that can run quite literally (almost) every version of iOS released for it!
Bug description
I am trying to downgrade an iPhone4,1 (i.e. an iPhone 4S) on iOS 7.1.1 to 5.1.1 with powdersn0w, but the restore is failing while attempting to upload the iBSS/iBEC.
Legacy iOS Kit log (click to expand)
I am aware that the script is running from temporary storage. The laptop has 16 GB of RAM and nothing else open, so I don't think that was causing any issues. ``` *** Legacy iOS Kit *** - Script by LukeZGD - * Version: v24.06.44 (fb2cd6c) * Platform: linux (Linux Mint 21.2) Live session - Temporary storage * Device: iPhone 4S (iPhone4,1 - n94ap) in Normal mode * iOS Version: 7.1.1 (11D201) * ECID: ------------- * Only select unmodified IPSW for the selection. Do not select custom IPSWs * Selected Target IPSW: /home/mint/Downloads/iPhone4,1_5.1.1_9B206_Restore.ipsw * Target Version: 5.1.1-9B206 * Selected Base (iOS 7.1.x) IPSW: /home/mint/Downloads/iPhone4,1_7.1.1_11D201_Restore.ipsw * Base Version: 7.1.1-11D201 * Selected Base (iOS 7.1.x) SHSH: /home/mint/Desktop/Legacy-iOS-Kit-main/saved/shsh/1486731182890-iPhone4,1-7.1.1-11D201.shsh * Selected SHSH file is validated * You can select your own custom Apple logo image. This is optional and an experimental option * Note that the images must be in PNG format, and up to 320x480 resolution only * No custom Apple logo selected * This restore will use 9.3.6 baseband > Main Menu > Restore/Downgrade > Other (powdersn0w 7.x blobs) [Input] Select an option: 1) Select Target IPSW 3) Select Base SHSH 5) Select Apple Logo 2) Select Base IPSW 4) Start Restore 6) Go Back #? 4 [Input] Jailbreak Option * When this option is enabled, your device will be jailbroken on restore. * I recommend to enable this option to have the jailbreak and Cydia pre-installed. * This option is enabled by default (Y). Select this option if unsure. [Input] Enable this option? (Y/n): [Log] Jailbreak option enabled. [Input] Memory Option for creating custom IPSW * When this option is enabled, system RAM will be used for the IPSW creation process. * I recommend to enable this option to speed up creating the custom IPSW. * However, if your PC/Mac has less than 8 GB of RAM, disable this option. * This option is enabled by default (Y). Select this option if unsure. [Input] Enable this option? (Y/n): [Log] Memory option enabled. [Input] Verbose Boot Option * When this option is enabled, the device will have verbose boot on restore. * This option is enabled by default (Y). Select this option if unsure. [Input] Enable this option? (Y/n): [Log] Verbose boot option enabled. [Log] Found existing Custom IPSW. Skipping IPSW creation. [Log] Checking URL in ../resources/firmware/iPhone4,1/12H321/url [Log] Checking firmware keys in ../resources/firmware/iPhone4,1/12H321 [Log] Decrypting iBSS... /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ca0b54a96b22a813f562eb257cb02afb9518b73701007b43c5e8712146a3eb75482800d2ac9cecc643aac17f9132ff2f [Log] Patching iBSS... main: Starting... main: iBoot-2261 inputted. patch_rsa_check: Entering... find_bl_verify_shsh_generic: Entering... find_bl_verify_shsh_generic: Found LDR instruction at 0x60ac find_bl_verify_shsh_generic: Found BL verify_shsh at 0x6452 find_bl_verify_shsh_generic: Leaving... patch_rsa_check: Patching BL verify_shsh at 0x6452... patch_rsa_check: Leaving... main: Writing out patched file to pwnediBSS... main: Quitting... /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ca0b54a96b22a813f562eb257cb02afb9518b73701007b43c5e8712146a3eb75482800d2ac9cecc643aac17f9132ff2f /home/runner/work/daibutsuCFW/daibutsuCFW/src/xpwn/ipsw-patch/img3.c:createAbstractFileFromImg3:643: ca0b54a96b22a813f562eb257cb02afb9518b73701007b43c5e8712146a3eb75482800d2ac9cecc643aac17f9132ff2f [Log] Pwned iBSS saved at: saved/iPhone4,1/pwnediBSS [Log] Pwned iBSS img3 saved at: saved/iPhone4,1/pwnediBSS.dfu [Log] Running iproxy for SSH... [Log] Please read the message below: * Follow these instructions to enter kDFU mode. 1. Install "OpenSSH" and "Core Utilities" in Cydia or Zebra. - After installing these requirements, lock your device. 2. You will be prompted to enter the root password of your iOS device. - The default root password is: alpine - Your input will not be visible, but it is still being entered. 3. On entering kDFU mode, the device will disconnect. - Proceed to unplug and replug the device when prompted. - Alternatively, press the TOP or HOME button. [Input] Press Enter/Return to continue (or press Ctrl+C to cancel) [Input] Enter the root password of your iOS device: [Log] Entering kDFU mode... * This may take a while, but should not take longer than a minute. [Log] Sending files to device: ../resources/kloader/kloader kloaders pwnediBSS Warning: Permanently added '[127.0.0.1]:6414' (RSA) to the list of known hosts. [Log] Running kloader [Log] Finding device in kDFU mode... (Attempt 1 of 5) Warning: Permanently added '[127.0.0.1]:6414' (RSA) to the list of known hosts. Connection to 127.0.0.1 closed by remote host. * Unplug and replug your device now [Log] Finding device in kDFU mode... (Attempt 2 of 5) [Log] Found device in kDFU mode. [Log] Extracting IPSW: ../iPhone4,1_5.1.1_9B206_CustomJPV.ipsw Archive: ../iPhone4,1_5.1.1_9B206_CustomJPV.ipsw inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/038-4343-021.dmg inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/038-4352-023.dmg inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/038-4356-009.dmg extracting: ../iPhone4,1_5.1.1_9B206_CustomJPV/BuildManifest.plist creating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Downgrade/ inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Downgrade/RestoreDeviceTree inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Downgrade/RestoreKernelCache inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Downgrade/RestoreLogo creating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/ inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/Trek-2.0.12.Release.bbfw inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/Trek-2.0.12.Release.plist creating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/ creating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/ inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/DeviceTree.n94ap.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/LLB.n94ap.RELEASE.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/applelogo7@2x.s5l8940x.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/applelogo@2x.s5l8940x.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/batterycharging0@2x.s5l8940x.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/batterycharging1@2x.s5l8940x.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/batteryfull@2x.s5l8940x.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/batterylow0@2x.s5l8940x.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/batterylow1@2x.s5l8940x.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/glyphcharging@2x.s5l8940x.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/glyphplugin@2x.s5l8940x.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/iBoot.n94ap.RELEASE.img3 extracting: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/iBoot2.n94ap.RELEASE.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/manifest inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/recoverymode7@2x~iphone.s5l8940x.img3 inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/all_flash/all_flash.n94ap.production/recoverymode@2x~iphone.s5l8940x.img3 creating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/dfu/ inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/dfu/iBEC.n94ap.RELEASE.dfu inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/dfu/iBSS.n94ap.RELEASE.dfu creating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/usr/ creating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/usr/local/ creating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/usr/local/standalone/ creating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/usr/standalone/ inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/Restore.plist inflating: ../iPhone4,1_5.1.1_9B206_CustomJPV/kernelcache.release.n94 extracting: ../iPhone4,1_5.1.1_9B206_CustomJPV/Firmware/Trek-6.7.00.Release.bbfw [Log] Running idevicerestore with command: sudo ../bin/linux/x86_64/idevicerestore -ew "../iPhone4,1_5.1.1_9B206_CustomJPV.ipsw" Found device in DFU mode Found ECID ------------- Identified device as n94ap, iPhone4,1 Extracting BuildManifest from IPSW Product Version: 5.1.1 Product Build: 9B206 Major: 9 Device supports Image4: false Variant: Customer Erase Install (IPSW) This restore will erase your device data. Getting ApNonce in dfu mode... c4 09 49 9f a2 24 69 5e 15 26 df ba 8c 8b 70 15 1b 0c f6 b9 checking for local shsh Using cached SHSH Using cached filesystem from '../iPhone4,1_5.1.1_9B206_CustomJPV/038-4356-009.dmg' Extracting iBSS.n94ap.RELEASE.dfu... Not personalizing component iBSS... Sending iBSS (72016 bytes)... [==================================================] 100.0% Nonce: c4 09 49 9f a2 24 69 5e 15 26 df ba 8c 8b 70 15 1b 0c f6 b9 Extracting iBEC.n94ap.RELEASE.dfu... Not personalizing component iBEC... Sending iBEC (239952 bytes)... [==================================================] 100.0% ERROR: Unable to connect to device in recovery mode ERROR: Unable to connect to recovery device ERROR: Unable to place device into recovery mode from DFU mode [Log] Restoring done! Read the message below if any error has occurred: * If the restore failed on updating baseband: -> Try disabling baseband update: ./restore.sh --disable-bbupdate * Please read the "Troubleshooting" wiki page in GitHub before opening any issue! * Your problem may have already been addressed within the wiki page. * If opening an issue in GitHub, please provide a FULL log/output. Otherwise, your issue may be dismissed. * Save the terminal output now if needed. * Legacy iOS Kit v24.06.44 (fb2cd6c) * Platform: linux (Linux Mint 21.2) Live session - Temporary storage ``` After the `Sending iBEC` line, the iPhone started rebooting into iOS, and the script hung for about 2 minutes before producing the error following it.Additional notes
I do not have a USB Host Shield (and cannot purchase one currently) to use with checkm8-a5 to put the phone into pwned DFU mode that way, so I have not tested that.
I can try again on a MacBook running macOS (High Sierra) if needed, but I would need to set up macOS again as it doesn't currently have any macOS installed.
Somewhat unrelated, but I think still might be important: When I tried to OTA downgrade a different iPhone4,1 to iOS 6.1.3 last year, I was getting the same error unless I disabled jailbreaking before restore (after the restore completed, I was able to jailbreak using Legacy iOS Kit if I remember correctly).