search

MatthewPierson / 1033-OTA-Downgrader

First ever tool to downgrade ANY iPhone 5s, ANY iPad Air and (almost any) iPad Mini 2 to 10.3.3 with OTA blobs + checkm8!
494 stars 123 forks source link

ERROR: Unable to receive message from FDR 0x7fcaf6dd7920 (-2). 0/2 bytes #72

Open Netfliics opened 4 years ago

Netfliics commented 4 years ago

my device goes to recovery mode during the restore this is the log:

Air-di-Riccardo:~ riccardocardarelli$ cd /Users/riccardocardarelli/Desktop/1033-OTA-Downgrader-master Air-di-Riccardo:1033-OTA-Downgrader-master riccardocardarelli$ ./restore.sh iPhone_4.0_64bit_10.3.3_14G60_Restore.ipsw [+] Installing dependencies Updating Homebrew... Warning: libtool 2.4.6_1 is already installed and up-to-date To reinstall 2.4.6_1, run brew reinstall libtool Warning: automake 1.16.1_1 is already installed and up-to-date To reinstall 1.16.1_1, run brew reinstall automake Warning: lsusb 1.0 is already installed and up-to-date To reinstall 1.0, run brew reinstall lsusb Warning: openssl 1.0.2t is already installed and up-to-date To reinstall 1.0.2t, run brew reinstall openssl Warning: libzip 1.5.2 is already installed and up-to-date To reinstall 1.5.2, run brew reinstall libzip Warning: pkg-config 0.29.2 is already installed and up-to-date To reinstall 0.29.2, run brew reinstall pkg-config Updating Homebrew... Warning: libusbmuxd HEAD-1e7711d_1 is already installed and up-to-date To reinstall HEAD_1, run brew reinstall libusbmuxd Warning: Already linked: /usr/local/Cellar/libusbmuxd/HEAD-1e7711d_1 To relink: brew unlink libusbmuxd && brew link libusbmuxd Updating Homebrew... Warning: libimobiledevice HEAD-60823f9_4 is already installed and up-to-date To reinstall HEAD_5, run brew reinstall libimobiledevice Warning: Already linked: /usr/local/Cellar/libimobiledevice/HEAD-60823f9_4 To relink: brew unlink libimobiledevice && brew link libimobiledevice Updating Homebrew... Error: libplist 2.0.0_1 is already installed To install HEAD, first run brew unlink libplist. Warning: Already linked: /usr/local/Cellar/libplist/2.0.0_1 To relink: brew unlink libplist && brew link libplist From https://github.com/MatthewPierson/ipwndfu_public

iOS 10.3.3 for device iPhone6,2 IS being signed! shsh/3249923675412_iPhone6,2_10.3.3-14G60_552474d3fbef710b194b1fc72a01dc4406971d20.shsh2 -> shsh/stitch.shsh2 img4tool version: 0.163-c3df16cb998d5013aef092baeb71908475366182 Created IMG4 file at iBSS.img4 img4tool version: 0.163-c3df16cb998d5013aef092baeb71908475366182 Created IMG4 file at iBEC.img4 iBSS.img4 -> ipsw/Firmware/dfu/iBSS.iphone6.RELEASE.im4p iBEC.img4 -> ipsw/Firmware/dfu/iBEC.iphone6.RELEASE.im4p adding: 058-74917-062.dmg (deflated 1%) adding: 058-74940-063.dmg (deflated 17%) adding: 058-75381-062.dmg (deflated 17%) adding: BuildManifest.plist (deflated 95%) adding: Firmware/ (stored 0%) adding: Firmware/aopfw.im4p (deflated 45%) adding: Firmware/usr/ (stored 0%) adding: Firmware/usr/local/ (stored 0%) adding: Firmware/usr/local/standalone/ (stored 0%) adding: Firmware/dfu/ (stored 0%) adding: Firmware/dfu/iBEC.n69.RELEASE.im4p.plist (deflated 26%) adding: Firmware/dfu/iBSS.n69u.RELEASE.im4p.plist (deflated 26%) adding: Firmware/dfu/iBSS.iphone6.RELEASE.im4p (deflated 51%) adding: Firmware/dfu/iBEC.n69.RELEASE.im4p (deflated 0%) adding: Firmware/dfu/iBEC.n69u.RELEASE.im4p.plist (deflated 26%) adding: Firmware/dfu/iBEC.n69u.RELEASE.im4p (deflated 0%) adding: Firmware/dfu/iBSS.iphone6.RELEASE.im4p.plist (deflated 26%) adding: Firmware/dfu/iBEC.iphone6.RELEASE.im4p (deflated 49%) adding: Firmware/dfu/iBSS.n69.RELEASE.im4p.plist (deflated 26%) adding: Firmware/dfu/iBEC.iphone6.RELEASE.im4p.plist (deflated 28%) adding: Firmware/dfu/iBSS.n69u.RELEASE.im4p (deflated 0%) adding: Firmware/dfu/iBSS.n69.RELEASE.im4p (deflated 0%) adding: Firmware/all_flash/ (stored 0%) adding: Firmware/all_flash/DeviceTree.n51ap.im4p.plist (deflated 37%) adding: Firmware/all_flash/batterycharging0@2x~iphone.s8000.im4p.plist (deflated 26%) adding: Firmware/all_flash/glyphplugin@1136~iphone-lightning.s8000.im4p.plist (deflated 26%) adding: Firmware/all_flash/sep-firmware.n51.RELEASE.im4p (deflated 0%) adding: Firmware/all_flash/iBoot.n69u.RELEASE.im4p (deflated 0%) adding: Firmware/all_flash/sep-firmware.n51.RELEASE.im4p.plist (deflated 37%) adding: Firmware/all_flash/LLB.n69.RELEASE.im4p (deflated 0%) adding: Firmware/all_flash/batterylow0@2x~iphone.s5l8960x.im4p (deflated 69%) adding: Firmware/all_flash/applelogo@2x~iphone.s8000.im4p.plist (deflated 38%) adding: Firmware/all_flash/batterylow0@2x~iphone.s8000.im4p.plist (deflated 26%) adding: Firmware/all_flash/batteryfull@2x~iphone.s8003.im4p (deflated 77%) adding: Firmware/all_flash/batteryfull@2x~iphone.s8003.im4p.plist (deflated 26%) adding: Firmware/all_flash/recoverymode@1136~iphone-lightning.s5l8960x.im4p.plist (deflated 26%) adding: Firmware/all_flash/glyphplugin@1136~iphone-lightning.s8000.im4p (deflated 13%) adding: Firmware/all_flash/sep-firmware.n69u.RELEASE.im4p.plist (deflated 37%) adding: Firmware/all_flash/glyphplugin@1136~iphone-lightning.s5l8960x.im4p.plist (deflated 26%) adding: Firmware/all_flash/batterycharging0@2x~iphone.s8003.im4p (deflated 20%) adding: Firmware/all_flash/batteryfull@2x~iphone.s5l8960x.im4p (deflated 77%) adding: Firmware/all_flash/applelogo@2x~iphone.s5l8960x.im4p (deflated 9%) adding: Firmware/all_flash/batterylow0@2x~iphone.s8000.im4p (deflated 69%) adding: Firmware/all_flash/applelogo@2x~iphone.s8000.im4p (deflated 9%) adding: Firmware/all_flash/recoverymode@1136~iphone-lightning.s8000.im4p (deflated 72%) adding: Firmware/all_flash/applelogo@2x~iphone.s5l8960x.im4p.plist (deflated 38%) adding: Firmware/all_flash/batterycharging0@2x~iphone.s5l8960x.im4p.plist (deflated 26%) adding: Firmware/all_flash/batteryfull@2x~iphone.s5l8960x.im4p.plist (deflated 26%) adding: Firmware/all_flash/glyphplugin@1136~iphone-lightning.s5l8960x.im4p (deflated 13%) adding: Firmware/all_flash/sep-firmware.n69.RELEASE.im4p.plist (deflated 37%) adding: Firmware/all_flash/DeviceTree.n69uap.im4p.plist (deflated 37%) adding: Firmware/all_flash/LLB.iphone6.RELEASE.im4p.plist (deflated 26%) adding: Firmware/all_flash/DeviceTree.n69uap.im4p (deflated 82%) adding: Firmware/all_flash/recoverymode@1136~iphone-lightning.s8000.im4p.plist (deflated 26%) adding: Firmware/all_flash/batterycharging1@2x~iphone.s8000.im4p.plist (deflated 26%) adding: Firmware/all_flash/batterycharging1@2x~iphone.s5l8960x.im4p.plist (deflated 26%) adding: Firmware/all_flash/batterylow1@2x~iphone.s8000.im4p (deflated 12%) adding: Firmware/all_flash/recoverymode@1136~iphone-lightning.s5l8960x.im4p (deflated 72%) adding: Firmware/all_flash/LLB.n69u.RELEASE.im4p.plist (deflated 26%) adding: Firmware/all_flash/batterylow1@2x~iphone.s8000.im4p.plist (deflated 26%) adding: Firmware/all_flash/LLB.n69.RELEASE.im4p.plist (deflated 26%) adding: Firmware/all_flash/LLB.iphone6.RELEASE.im4p (deflated 0%) adding: Firmware/all_flash/batterycharging1@2x~iphone.s5l8960x.im4p (deflated 12%) adding: Firmware/all_flash/iBoot.n69u.RELEASE.im4p.plist (deflated 26%) adding: Firmware/all_flash/batterycharging1@2x~iphone.s8003.im4p (deflated 12%) adding: Firmware/all_flash/iBoot.iphone6.RELEASE.im4p.plist (deflated 26%) adding: Firmware/all_flash/batterycharging1@2x~iphone.s8003.im4p.plist (deflated 26%) adding: Firmware/all_flash/batterycharging1@2x~iphone.s8000.im4p (deflated 12%) adding: Firmware/all_flash/batterylow0@2x~iphone.s5l8960x.im4p.plist (deflated 26%) adding: Firmware/all_flash/batterylow1@2x~iphone.s8003.im4p (deflated 12%) adding: Firmware/all_flash/batterylow1@2x~iphone.s8003.im4p.plist (deflated 26%) adding: Firmware/all_flash/sep-firmware.n69.RELEASE.im4p (deflated 0%) adding: Firmware/all_flash/batterylow1@2x~iphone.s5l8960x.im4p (deflated 12%) adding: Firmware/all_flash/DeviceTree.n69ap.im4p.plist (deflated 37%) adding: Firmware/all_flash/iBoot.n69.RELEASE.im4p (deflated 0%) adding: Firmware/all_flash/recoverymode@1136~iphone-lightning.s8003.im4p.plist (deflated 26%) adding: Firmware/all_flash/sep-firmware.n53.RELEASE.im4p.plist (deflated 37%) adding: Firmware/all_flash/batterylow0@2x~iphone.s8003.im4p (deflated 69%) adding: Firmware/all_flash/applelogo@2x~iphone.s8003.im4p (deflated 9%) adding: Firmware/all_flash/DeviceTree.n69ap.im4p (deflated 82%) adding: Firmware/all_flash/batterycharging0@2x~iphone.s5l8960x.im4p (deflated 20%) adding: Firmware/all_flash/recoverymode@1136~iphone-lightning.s8003.im4p (deflated 72%) adding: Firmware/all_flash/iBoot.n69.RELEASE.im4p.plist (deflated 26%) adding: Firmware/all_flash/sep-firmware.n69u.RELEASE.im4p (deflated 0%) adding: Firmware/all_flash/batterylow1@2x~iphone.s5l8960x.im4p.plist (deflated 26%) adding: Firmware/all_flash/DeviceTree.n53ap.im4p (deflated 83%) adding: Firmware/all_flash/glyphplugin@1136~iphone-lightning.s8003.im4p (deflated 13%) adding: Firmware/all_flash/batterycharging0@2x~iphone.s8000.im4p (deflated 20%) adding: Firmware/all_flash/DeviceTree.n53ap.im4p.plist (deflated 37%) adding: Firmware/all_flash/batteryfull@2x~iphone.s8000.im4p (deflated 77%) adding: Firmware/all_flash/batterycharging0@2x~iphone.s8003.im4p.plist (deflated 26%) adding: Firmware/all_flash/iBoot.iphone6.RELEASE.im4p (deflated 0%) adding: Firmware/all_flash/glyphplugin@1136~iphone-lightning.s8003.im4p.plist (deflated 26%) adding: Firmware/all_flash/sep-firmware.n53.RELEASE.im4p (deflated 0%) adding: Firmware/all_flash/batteryfull@2x~iphone.s8000.im4p.plist (deflated 26%) adding: Firmware/all_flash/DeviceTree.n51ap.im4p (deflated 83%) adding: Firmware/all_flash/batterylow0@2x~iphone.s8003.im4p.plist (deflated 26%) adding: Firmware/all_flash/applelogo@2x~iphone.s8003.im4p.plist (deflated 38%) adding: Firmware/all_flash/LLB.n69u.RELEASE.im4p (deflated 0%) adding: Firmware/Mav10-5.62.00.Release.plist (deflated 23%) adding: Firmware/Mav7Mav8-7.60.00.Release.plist (deflated 29%) adding: Firmware/Mav10-5.62.00.Release.bbfw (deflated 0%) adding: Firmware/Mav7Mav8-7.60.00.Release.bbfw (deflated 0%) adding: Restore.plist (deflated 84%) adding: kernelcache.release.iphone6 (deflated 6%) adding: kernelcache.release.iphone8b (deflated 6%) [==================================================] 100.0% [==================================================] 100.0% [==================================================] 100.0% Version: 0a2348f540c0e9be4f50f26493105ceb3154d479 - 300 libfragmentzip version: 0.58-ffec726ea514d8b8f3f3e42d04ce1430f3889747 [TSSC] manually specified ECID to use, parsed "3249923675412" to dec:3249923675412 hex:2f4ae8bd514 [TSSC] manually specified apnonce to use, parsed "0f3b31015974dcc5ceb91c6883d6402621e5f1bb" to hex:0f3b31015974dcc5ceb91c6883d6402621e5f1bb [TSSC] opening manifests/BuildManifest_iPhone6,2_1033_OTA.plist [TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2 [TSSR] Sending TSS request attempt 1... success also requesting APTicket for installType=Update [Error] [TSSR] Error: could not get id0 for installType=Update [WARNING] [TSSR] failed to build tssrequest for alternative installType [TSSR] User specified doesn't to request a Baseband ticket. [TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2 [TSSR] Sending TSS request attempt 1... failure [Error] ERROR: TSS request failed (status=128, message=An internal error occurred.) Saved shsh blobs!

iOS 10.3.3 for device iPhone6,2 IS being signed! 3249923675412_iPhone6,2_10.3.3-14G60_0f3b31015974dcc5ceb91c6883d6402621e5f1bb.shsh -> shsh/apnonce.shsh2 Done prepping files! Time to downgrade!!! RESTORING! Waiting for device to reconnect... Version: 7e66824796f697ea54597dadbdba462382f004b9 - 247 Odysseus support: no INFO: device serial number is F19MJ2TWFFG8 [INFO] 64-bit device detected futurerestore init done reading signing ticket shsh/apnonce.shsh2 is done Found device iPhone6,2 n53ap [TSSC] opening manifests/BuildManifest_iPhone6,2_1033_OTA.plist [TSSR] User specified not to request a baseband ticket. Request URL set to https://gs.apple.com/TSS/controller?action=2 Sending TSS request attempt 1... response successfully received Did set SEP+baseband path and firmware [WARNING] Failed to read BasebandGoldCertID from device! Is it already in recovery? [WARNING] Using tsschecker's fallback BasebandGoldCertID. This might result in invalid baseband signing status information [WARNING] Failed to read BasebandSerialNumber from device! Is it already in recovery? [WARNING] Using tsschecker's fallback BasebandSerialNumber size. This might result in invalid baseband signing status information [TSSC] opening manifests/BuildManifest_iPhone6,2_1033_OTA.plist [TSSR] User specified to request only a baseband ticket. Request URL set to https://gs.apple.com/TSS/controller?action=2 Sending TSS request attempt 1... response successfully received Found device in Recovery mode Device already in Recovery mode Found device in Recovery mode Identified device as n53ap, iPhone6,2 Extracting BuildManifest from iPSW Product version: 10.3.3 Product build: 14G60 Major: 14 Device supports IMG4: true Got ApNonce from device: 0f 3b 31 01 59 74 dc c5 ce b9 1c 68 83 d6 40 26 21 e5 f1 bb checking APTicket to be valid for this restore... Verified ECID in APTicket matches device ECID checking APTicket to be valid for this restore... Verified ECID in APTicket matches device ECID [Error] im4m_buildidentity_check_cb: can't find any identity which matches all hashes inside IM4M [Error] getBuildIdentityForIM4M: found buildidentity, but can't read information [Error] BuildIdentity selected for restore doesn't match APTicket

BuildIdentity selected for restore: BuildNumber : 14G60 BuildTrain : Greensburg DeviceClass : n53ap FDRSupport : NO RestoreBehavior : Erase Variant : Customer Erase Install (IPSW)

BuildIdentiy valid for the APTicket: IM4M isn't valid for any restore with this BuildManifest This APTicket can't be used for restoring this firmware Variant: Customer Erase Install (IPSW) This restore will erase your device data. Extracting filesystem from iPSW [==================================================] 100.0% Extracting iBEC.iphone6.RELEASE.im4p... Personalizing IMG4 component iBEC... Sending iBEC (653349 bytes)... waiting for device to reconnect... Getting SepNonce in recovery mode... 42 23 98 43 b1 97 10 d9 5d ad ae 5c d7 7c 14 b4 20 46 56 57 Getting ApNonce in recovery mode... 0f 3b 31 01 59 74 dc c5 ce b9 1c 68 83 d6 40 26 21 e5 f1 bb [WARNING] Setting bgcolor to green! If you don't see a green screen, then your device didn't boot iBEC correctly Recovery Mode Environment: iBoot build-version=iBoot-3406.60.10 iBoot build-style=RELEASE Sending RestoreLogo... Extracting applelogo@2x~iphone.s5l8960x.im4p... Personalizing IMG4 component RestoreLogo... Sending RestoreLogo (11640 bytes)... ramdisk-size=0x10000000 Extracting 058-74940-063.dmg... Personalizing IMG4 component RestoreRamDisk... Sending RestoreRamDisk (41583638 bytes)... Extracting DeviceTree.n53ap.im4p... Personalizing IMG4 component RestoreDeviceTree... Sending RestoreDeviceTree (107919 bytes)... Extracting kernelcache.release.iphone6... Personalizing IMG4 component RestoreKernelCache... Sending RestoreKernelCache (12178427 bytes)... Trying to fetch new signing tickets Request URL set to https://gs.apple.com/TSS/controller?action=2 Sending TSS request attempt 1... response successfully received Received signing tickets About to restore device... Waiting for device... Device ca61da8ca7e577dae2fbeb724e2424591940f526 is now connected in restore mode... Connecting now... Connected to com.apple.mobile.restored, version 14 Device ca61da8ca7e577dae2fbeb724e2424591940f526 has successfully entered restore mode Hardware Information: BoardID: 2 ChipID: 35168 UniqueChipID: 3249923675412 ProductionMode: true Starting FDR listener thread About to send NORData... Found firmware path Firmware/all_flash Getting firmware manifest from build identity Extracting LLB.iphone6.RELEASE.im4p... Personalizing IMG4 component LLB... Extracting applelogo@2x~iphone.s5l8960x.im4p... Personalizing IMG4 component AppleLogo... Extracting batterycharging0@2x~iphone.s5l8960x.im4p... Personalizing IMG4 component BatteryCharging0... Extracting batterycharging1@2x~iphone.s5l8960x.im4p... Personalizing IMG4 component BatteryCharging1... Extracting batteryfull@2x~iphone.s5l8960x.im4p... Personalizing IMG4 component BatteryFull... Extracting batterylow0@2x~iphone.s5l8960x.im4p... Personalizing IMG4 component BatteryLow0... Extracting batterylow1@2x~iphone.s5l8960x.im4p... Personalizing IMG4 component BatteryLow1... Extracting glyphplugin@1136~iphone-lightning.s5l8960x.im4p... Personalizing IMG4 component BatteryPlugin... Extracting DeviceTree.n53ap.im4p... Personalizing IMG4 component DeviceTree... Extracting recoverymode@1136~iphone-lightning.s5l8960x.im4p... Personalizing IMG4 component RecoveryMode... Extracting iBoot.iphone6.RELEASE.im4p... Personalizing IMG4 component iBoot... Personalizing IMG4 component RestoreSEP... Personalizing IMG4 component SEP... Sending NORData now... Done sending NORData ERROR: Unable to receive message from FDR 0x7fcaf6dd7920 (-2). 0/2 bytes

gallus-x commented 4 years ago

I have same problem, did you on high sierra?

Netfliics commented 4 years ago

no I did it on Mojave

Merculous commented 4 years ago

Futurerestore will fail no matter what during restore process sometimes. Just retry again. If everything is fine and working, please close this issue.

Merculous commented 4 years ago

possible duplicate of #73