Closed jailhousej closed 4 years ago
Not sure what's going on there.. what macOS version?
Also please try again with latest commit
Not sure if it will help though
Catalina, this time it got a different error and now my device is without any firmware :( (have to restore + rejailbreak)
iOS-OTA-Downgrader Downgrader script by LukeZGD
[Log] Updating firmware... Already up to date. [Log] Updating ipwndfu... Already up to date. [Log] Finding device in normal mode...
Main Menu [Input] Select an option: 1) Downgrade device 4) (Re-)Install Dependencies 2) Save OTA blobs 5) (Any other key to exit) 3) Just put device in kDFU mode
[Input] Select iOS version: 1) iOS 8.4.1 3) (Any other key to exit) 2) Other
[Log] Option: Downgrade [Input] Jailbreak the selected iOS version? (y/N): y [Log] Saving 8.4.1 blobs with tsschecker... Version: b9d193aa6e6d24421094873c830692d02d8b32f5 - 304 libfragmentzip version: 0.59-542a470d7be248681dba71d0f04e7dc8c2718b73 [TSSC] manually specified ECID to use, parsed "468538166670" to dec:468538166670 hex:6d170d0d8e [TSSC] opening resources/manifests/BuildManifest_iPhone5,2_8.4.1.plist [WARNING] [TSSC] could not get id0 for installType=Erase. Using fallback installType=Update since user did not specify installType manually [TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2 [TSSR] Sending TSS request attempt 1... success [Error] [TSSR] Error: could not get id0 for installType=Erase Saved shsh blobs!
iOS 8.4.1 for device iPhone5,2 IS being signed!
[Log] Successfully saved 8.4.1 blobs.
[Log] Extracting iBSS from IPSW...
Archive: iPhone5,2_8.4.1_12H321_Custom.ipsw
inflating: saved/iPhone5,2/iBSS.n42.RELEASE.dfu
[Log] Patching iBSS...
bind(): Address already in use
Error creating socket: Address already in use
[Log] Copying stuff to device via SSH...
Make sure OpenSSH/Dropbear is installed on the device!
Enter root password of your iOS device when prompted, default is 'alpine'
root@127.0.0.1's password:
kloader_hgsp 100% 52KB 5.1MB/s 00:00
pwnediBSS 100% 76KB 6.9MB/s 00:00
pwn.sh 100% 45 14.5KB/s 00:00
[Log] Entering kDFU mode...
Press POWER or HOME button when screen goes black on the device
[Log] Finding device in DFU mode...
root@127.0.0.1's password:
Connection to 127.0.0.1 closed by remote host.
[Log] Found device in DFU mode.
./restore.sh: line 295: kill: (3891) - No such process
[Log] Extracting IPSW...
[Log] Proceeding to idevicerestore...
NOTE: Updated version data.
Found device in DFU mode
Identified device as n42ap, iPhone5,2
Extracting BuildManifest from IPSW
Product Version: 8.4.1
Product Build: 12H321 Major: 12
Device supports Image4: false
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Found ECID 468538166670
Getting ApNonce in dfu mode... 01 d5 1a 42 78 de 0b 95 07 da 38 d2 91 81 16 fc b6 78 2c 5b
checking for local shsh
Using cached SHSH
Using cached filesystem from 'iPhone5,2_8.4.1_12H321_Custom/058-24110-023.dmg'
Extracting iBSS.n42.RELEASE.dfu...
Personalizing IMG3 component iBSS...
reconstructed size: 80234
Sending iBSS (80234 bytes)...
[==================================================] 100.0%
Nonce: 01 d5 1a 42 78 de 0b 95 07 da 38 d2 91 81 16 fc b6 78 2c 5b
Extracting iBEC.n42.RELEASE.dfu...
Not personalizing component iBEC...
Sending iBEC (286940 bytes)...
[==================================================] 100.0%
INFO: device serial number is F2LJR440F39C
Getting ApNonce in recovery mode... 01 d5 1a 42 78 de 0b 95 07 da 38 d2 91 81 16 fc b6 78 2c 5b
Sending APTicket (2738 bytes)
Recovery Mode Environment:
iBoot build-version=iBoot-2261.30.37
iBoot build-style=RELEASE
Sending RestoreLogo...
Extracting applelogo@2x~iphone.s5l8950x.img3...
Not personalizing component RestoreLogo...
Sending RestoreLogo (6632 bytes)...
ramdisk-size=0x4000000
Extracting 058-23947-023.dmg...
Not personalizing component RestoreRamDisk...
Sending RestoreRamDisk (16535644 bytes)...
Extracting DeviceTree.n42ap.img3...
Not personalizing component RestoreDeviceTree...
Sending RestoreDeviceTree (88368 bytes)...
Extracting kernelcache.release.n42...
Not personalizing component RestoreKernelCache...
Sending RestoreKernelCache (9415484 bytes)...
About to restore device...
Waiting for device...
Device 552923c3c878ff66f2e090381b7bc8d91e3d2457 is now connected in restore mode...
Connecting now...
Connected to com.apple.mobile.restored, version 13
Device 552923c3c878ff66f2e090381b7bc8d91e3d2457 has successfully entered restore mode
Hardware Information:
BoardID: 2
ChipID: 35152
UniqueChipID: 468538166670
ProductionMode: true
Starting FDR listener thread
ERROR: Unable to connect to FDR client (-2)
ERROR: Failed to start FDR Ctrl channel
About to send RootTicket...
Sending RootTicket now...
Done sending RootTicket
Waiting for NAND (28)
Unmounting filesystems (29)
Unmounting filesystems (29)
Creating partition map (11)
Creating filesystem (12)
Creating filesystem (12)
Mounting filesystems (16)
Mounting filesystems (16)
Unmounting filesystems (29)
Unmounting filesystems (29)
About to send filesystem...
Connected to ASR
Validating the filesystem
Filesystem validated
Sending filesystem now...
[==================================================] 100.0%
Done sending filesystem
Verifying restore (14)
[==================================================] 100.0%
Mounting filesystems (16)
Mounting filesystems (16)
About to send KernelCache...
Extracting kernelcache.release.n42...
Not personalizing component KernelCache...
Sending KernelCache now...
Done sending KernelCache
Installing kernelcache (27)
About to send NORData...
Found firmware path Firmware/all_flash/all_flash.n42ap.production
Getting firmware manifest Firmware/all_flash/all_flash.n42ap.production/manifest
Extracting LLB.n42.RELEASE.img3...
Personalizing IMG3 component LLB...
reconstructed size: 154138
Extracting DeviceTree.n42ap.img3...
Not personalizing component DeviceTree...
Extracting applelogo@2x~iphone.s5l8950x.img3...
Not personalizing component AppleLogo...
Extracting batterycharging0@2x~iphone.s5l8950x.img3...
Not personalizing component BatteryCharging0...
Extracting batterycharging1@2x~iphone.s5l8950x.img3...
Not personalizing component BatteryCharging1...
Extracting batteryfull@2x~iphone.s5l8950x.img3...
Not personalizing component BatteryFull...
Extracting batterylow0@2x~iphone.s5l8950x.img3...
Not personalizing component BatteryLow0...
Extracting batterylow1@2x~iphone.s5l8950x.img3...
Not personalizing component BatteryLow1...
Extracting glyphplugin@1136~iphone-lightning.s5l8950x.img3...
Not personalizing component BatteryPlugin...
Extracting iBoot.n42.RELEASE.img3...
Not personalizing component iBoot...
Extracting recoverymode@1136~iphone-lightning.s5l8950x.img3...
Not personalizing component RecoveryMode...
Sending NORData now...
Done sending NORData
Flashing firmware (18)
[==================================================] 100.0%
Updating gas gauge software (46)
Updating gas gauge software (46)
Updating baseband (19)
About to send BasebandData...
WARNING: Unable to find BbSkeyId node
Sending Baseband TSS request...
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Received Baseband SHSH blobs
Sending BasebandData now...
Done sending BasebandData
Updating baseband (19)
Updating baseband (19)
Updating baseband (19)
Updating baseband (19)
Updating baseband (19)
Updating Baseband in progress...
ERROR: device didn't accept BasebandData
ERROR: Unable to successfully restore device
Got status message
Status: Verification Error
Log is available:
SYSLOG: Sep 23 06:12:02 localhost bootlog[0]
SYSLOG: Sep 23 06:12:04 localhost kernel[0]
_baseband_update_requires_filesystems_once: querying baseband to determine if it requires system filesystem bbupdater: cmdCopyRequirePartitionMount: supports flashless 1
bbupdater: cmdCopyRequirePartitionMount: supports REFS 0
bbupdater: cmdCopyRequirePartitionMount: need data partition for coredumps
_baseband_update_requires_filesystems_once: query returned <CFBasicHash 0x17d2c520 [0x68a8c0]>{type = mutable dict, count = 3, entries => 0 : <CFString 0xdf5c08 [0x68a8c0]>{contents = "requireSystemPartitionMount"} = <CFBoolean 0x68aac0 [0x68a8c0]>{value = true} 1 : <CFString 0xdf5c28 [0x68a8c0]>{contents = "requireUserPartitionMount"} = <CFBoolean 0x68aac0 [0x68a8c0]>{value = true} 2 : <CFString 0xdf5c38 [0x68a8c0]>{contents = "requestedBasebandFSPartitionMountSize"} = <CFNumber 0x17d1cc90 [0x68a8c0]>{value = +0, type = kCFNumberSInt32Type} }
bbupdater: cmdCopyBasebandMigrationData: copying migration data
entering check_for_restore_log
restore log does not exist
executing /sbin/fsck_hfs
/dev/rdisk0s1s2
Executing fsck_hfs (version hfs-286.30.1).
Checking Journaled HFS Plus volume.
Detected a case-sensitive volume.
The volume name is Data
Checking extents overflow file.
Checking catalog file.
Checking multi-linked files.
Checking catalog hierarchy.
Checking extended attributes file.
Checking volume bitmap.
Checking volume information.
Trimming unused blocks.
The volume Data appears to be OK.
executing /sbin/mount_hfs
mount_hfs: Could not create property for re-key environment check: No such file or directory
/dev/disk0s1s2 mounted on /mnt2
entering dump_panic_logs
executing /System/Library/CoreServices/DumpPanic
entering check_for_ota_logs_with_mount_point
restore log does not exist
skipping log submission, failed to read user settings from: /mnt2/mobile/Library/ConfigurationProfiles/EffectiveUserSettings.plist
Diagnostic log submission disabled
Searching /mnt2/mobile/Library/Logs/CrashReporter/
Found match. panic-2020-08-17-133735.ips to prefix panic len = 5
preserving log file.
SYSLOG: Sep 23 06:13:04 localhost kernel[0]
update_baseband: querying baseband info bbupdater: BEGIN: Querying info at stage first bbupdater: BEGIN: Preparing first stage bbupdater: Requested boot mode: kBBUBootModeNone bbupdater: Creating transport, attempts remaining 5...bbupdater: OK bbupdater: END: Preparing first stage bbupdater: Connecting to Loader...bbupdater: OK bbupdater: Getting Version...bbupdater: OK bbupdater: Loader version: PBL-DloadVER2.0 bbupdater: Fusing disallowed, will treat as fused bbupdater: END: Querying info at stage first update_baseband: query returned <CFBasicHash 0x17d30d30 [0x68a8c0]>{type = mutable dict, count = 6, entries => 0 : <CFString 0xdf5ff8 [0x68a8c0]>{contents = "CertHash"} = <CFData 0x17d334e0 [0x68a8c0]>{length = 32, capacity = 32, bytes = 0xc20b8a40ea0c16cac22ed32b82ed9830 ... 6bd60b21db759f2d} 2 : <CFString 0xdf6178 [0x68a8c0]>{contents = "VendorID"} = <CFNumber 0x17d2b770 [0x68a8c0]>{value = +3, type = kCFNumberSInt32Type} 3 : <CFString 0xdf5fc8 [0x68a8c0]>{contents = "ChipID"} = <CFNumber 0x17d32870 [0x68a8c0]>{value = +7278817, type = kCFNumberSInt64Type} 4 : <CFString 0xdf61c8 [0x68a8c0]>{contents = "FusingStatus"} = <CFNumber 0x17d2b770 [0x68a8c0]>{value = +3, type = kCFNumberSInt32Type} 5 : <CFString 0xdf6168 [0x68a8c0]>{contents = "CertID"} = <CFNumber 0x17d32880 [0x68a8c0]>{value = +3255536192, type = kCFNumberSInt64Type} 6 : <CFString 0xdf5fb8 [0x68a8c0]>{contents = "ChipSerialNo"} = <CFData 0x17e1bc80 [0x68a8c0]>{length = 4, capacity = 4, bytes = 0x05f366e6} }
update_baseband: requesting baseband firmware data update_baseband: received data from host (135037 bytes) update_baseband: performing next update stage bbupdater: BEGIN: Perform stage at first bbupdater: Loading... bbupdater: 0x2a008400 of 0x2a0229bc (23 percent) bbupdater: 0x2a010800 of 0x2a0229bc (47 percent) bbupdater: 0x2a018c00 of 0x2a0229bc (71 percent) bbupdater: 0x2a021000 of 0x2a0229bc (95 percent) bbupdater: 0x2a0229bc of 0x2a0229bc (100 percent) bbupdater: bbupdater: Launching...bbupdater: OK bbupdater: END: Perform stage at first send_bbupdate_status: sending baseband update status to host update_baseband: querying baseband info bbupdater: BEGIN: Querying info at stage second bbupdater: BEGIN: Preparing Second stage bbupdater: Re-configure transport for second stage. bbupdater: END: Preparing Second stage bbupdater: BEGIN: Gathering Personalization parameters... bbupdater: Waiting for Hello...bbupdater: FAILED(kBBUReturnIOError) bbupdater: END(kBBUReturnNAKHello): Gathering Personalization parameters... bbupdater: END(kBBUReturnNAKHello): Querying info at stage second bbupdater: core dump collection disabled send_bbupdate_status: sending baseband update status to host update_baseband: calling CFNotificationCenterRemoveEveryObserver update_baseband: bbupdater error: The operation couldn\U2019t be completed. (BBUpdater error 47 - Failed gatherPersonalizationParameters in second stage) Update[Baseband] error - The operation couldn\U2019t be completed. (RamrodErrorDomain error 1004 - update_baseband: failed querying baseband info) Update[Baseband] failed - 0 retries remaining... 0: RamrodErrorDomain/3ec: update_baseband: failed querying baseband info 1: BBUpdater/2f: Failed gatherPersonalizationParameters in second stage unable to convert ramrod error 1004
ERROR: Unable to restore device
That's an error I haven't seen before
You may want to delete the custom IPSW and start over
Also I updated the included idevicerestore for macOS so hopefully that helps as well
Followed your advice and still same error
Not sure what's going wrong then, I just tested on iPhone5,2 and Mojave and worked fine for me
Alright, I got it working. For those on Catalina, navigate to the resources folder in the root directory of this program, and open and allow every single executable through gatekeeper!
@jailhousej More precisely, all the executables are in the tools
subdirectory of resources
.
P.S. If it doesn't work after a re-spring, try a restart!
iPhone 5 10.3.4 downgrading to 8.4.1
iOS-OTA-Downgrader Downgrader script by LukeZGD
[Log] Updating firmware... Already up to date. [Log] Updating ipwndfu... Already up to date. [Log] Finding device in normal mode...
Main Menu [Input] Select an option: 1) Downgrade device 4) (Re-)Install Dependencies 2) Save OTA blobs 5) (Any other key to exit) 3) Just put device in kDFU mode
? 1
[Input] Select iOS version: 1) iOS 8.4.1 3) (Any other key to exit) 2) Other
? 1
[Log] Option: Downgrade [Input] Jailbreak the selected iOS version? (y/N): y [Log] Saving 8.4.1 blobs with tsschecker... Version: b9d193aa6e6d24421094873c830692d02d8b32f5 - 304 libfragmentzip version: 0.59-542a470d7be248681dba71d0f04e7dc8c2718b73 [TSSC] manually specified ECID to use, parsed "468538166670" to dec:468538166670 hex:6d170d0d8e [TSSC] opening resources/manifests/BuildManifest_iPhone5,2_8.4.1.plist [WARNING] [TSSC] could not get id0 for installType=Erase. Using fallback installType=Update since user did not specify installType manually [TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2 [TSSR] Sending TSS request attempt 1... success [Error] [TSSR] Error: could not get id0 for installType=Erase Saved shsh blobs!
iOS 8.4.1 for device iPhone5,2 IS being signed! [Log] Successfully saved 8.4.1 blobs. [Log] Verifying IPSW... [Log] Extracting iBSS from IPSW... Archive: iPhone5,2_8.4.1_12H321_Restore.ipsw inflating: saved/iPhone5,2/iBSS.n42.RELEASE.dfu
[Log] Patching iBSS... waiting for connection [Log] Copying stuff to device via SSH...