axi0mX / ipwndfu

open-source jailbreaking tool for many iOS devices
GNU General Public License v3.0
7.04k stars 1.7k forks source link

ipwndfu appears to succeed in patching and uploading iPhone 3GS NOR with alloc8, but iPhone 3GS stays stuck in DFU mode #312

Open Cameron12533439 opened 1 year ago

Cameron12533439 commented 1 year ago

I have been trying to use ipwndfu to downgrade my new bootrom iPhone 3GS to iOS 3.1.3. I have followed the steps in the guide for creating and restoring to the custom IPSW, then putting the device in pwned DFU mode and installing the alloc8 exploit to NOR, but the iPhone just re-enters DFU mode when trying to boot. My iPhone is a 2009 Week 40 model and I was able to downgrade it to iOS 3.1.3 a year ago using this tool, so I know it's possible, but for some reason it no longer works. I read online this could be caused by a restore error or a faulty IPSW, so I tried remaking the IPSW with pwnagetool and sn0wbreeze multiple times with different settings, but it gives the same result. Since ipwndfu hasn't been updated recently, I tried running it on different versions of macOS and on linux, but nothing has helped. I though maybe it had to do with iOS 3.1.3, so I tried restoring to iOS 5.1.1 instead. However, I still have the same problem where the alloc8 exploit installs just fine but the iPhone still doesn't boot. Is anyone else experiencing this? If so, were you able to fix it?

Cameron12533439 commented 1 year ago

After installing alloc8 and the iPhone fails to boot for the first time, if I try to reinstall the exploit I get this error:

./ipwndfu -x Installing alloc8 exploit to NOR. Dumping NOR, part 1/8. Dumping NOR, part 2/8. Dumping NOR, part 3/8. Dumping NOR, part 4/8. Dumping NOR, part 5/8. Dumping NOR, part 6/8. Dumping NOR, part 7/8. Dumping NOR, part 8/8. NOR backed up to file: nor-backups/nor-00000266DA1AB58E-20220817-110558.dump Traceback (most recent call last): File "./ipwndfu", line 97, in nor = nor.NorData(dump) File "/Users/cameron/Downloads/ipwndfu/nor.py", line 11, in init assert img2_crc == binascii.crc32(dump[:48]) & 0xffffffff AssertionError