encounter / futurerestore

(unmaintained) iOS upgrade and downgrade tool utilizing SHSH blobs (unofficial fork supporting iOS 11 and newer devices)
GNU Lesser General Public License v3.0
176 stars 40 forks source link

Restore Failure (Error -11) #18

Open NotAlexNoyle opened 6 years ago

NotAlexNoyle commented 6 years ago

Device: Apple TV 4 on iOS 10.2.2

Target: iOS 11.1

Zephyr-HighSierra:futurerestore-latest NotAlexNoyle$ ./futurerestore_macos -t ../AppleTV5,3_4601817761114150_15J582.shsh2 --latest-sep -m BuildManifest.plist ../AppleTV5,3_11.1_15J582_Restore.ipsw --no-baseband -w
Version: a0113a4e46bfd00962cd25e3af548fc8b0bd21fd - 173
Odysseus Support: no
[INFO] 64bit device detected
futurerestore init done
reading ticket ../AppleTV5,3_4601817761114150_15J582.shsh2 done
Found device AppleTV5,3 j42dap
user specified to use latest signed sep
[TSSC] opening firmware.json
[DOWN] downloading file https://api.ipsw.me/v2.1/firmwares.json/condensed
[TSSC] selecting latest iOS: 11.2.5
[TSSC] got firmwareurl for iOS 11.2.5 build 15K552
100 [================================================================================================100 [===================================================================================================>]
downloading SEP [================================================================================================100
opening /tmp/futurerestore/sepManifest.plist
WARNING: Unable to find BbChipID node
[TSSR] User specified not to request a Baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received

WARNING: user specified not to flash a baseband. This can make the restore fail if the device needs a baseband!
if you added this flag by mistake you can press CTRL-C now to cancel
continuing restore in 5 4 3 2 1 
Found device in Normal mode
Entering recovery mode...
INFO: device serial number is DY4QG48SGXH8
waiting for nonce: 6e ca bf 8c 9d ec fb 00 ff bd b4 17 ff 2c bc f4 92 f0 b1 0f 
Got ApNonce from device: 6e ca bf 8c 9d ec fb 00 ff bd b4 17 ff 2c bc f4 92 f0 b1 0f 
Device has requested ApNonce now
Found device in Recovery mode
Identified device as j42dap, AppleTV5,3
Extracting BuildManifest from IPSW
Product Version: 11.1
Product Build: 15J582 Major: 15
Device supports Image4: true
Got APNonce from device: 6e ca bf 8c 9d ec fb 00 ff bd b4 17 ff 2c bc f4 92 f0 b1 0f 
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
Verified APTicket to be valid for this restore
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Extracting filesystem from IPSW
[==================================================] 100.0%
Extracting iBEC.j42d.RELEASE.im4p...
Personalizing IMG4 component iBEC...
Sending iBEC (705613 bytes)...
waiting for device to reconnect... 
Getting SepNonce in recovery mode... 82 b1 3d 58 20 fb 6e fd 16 39 cf d5 d0 a4 5c a4 72 d9 bc 49 
Getting ApNonce in recovery mode... 6e ca bf 8c 9d ec fb 00 ff bd b4 17 ff 2c bc f4 92 f0 b1 0f 
[WARNING] Setting bgcolor to green! If you don't see a green screen, then your device didn't boot iBEC correctly
Recovery Mode Environment:
iBoot build-version=iBoot-4076.20.48
iBoot build-style=RELEASE
Sending RestoreLogo...
Extracting applelogo~appletv.im4p...
Personalizing IMG4 component RestoreLogo...
Sending RestoreLogo (9228 bytes)...
ramdisk-size=0x20000000
Extracting 058-86523-084.dmg...
Personalizing IMG4 component RestoreRamDisk...
Sending RestoreRamDisk (42942859 bytes)...
Extracting DeviceTree.j42dap.im4p...
Personalizing IMG4 component RestoreDeviceTree...
Sending RestoreDeviceTree (88437 bytes)...
Extracting kernelcache.release.j42d...
Personalizing IMG4 component RestoreKernelCache...
Sending RestoreKernelCache (12548470 bytes)...
Trying to fetch new SHSH blob
WARNING: Unable to find BbChipID node
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Received SHSH blobs
About to restore device... 
Waiting for device...
Device c873375cfa5e6aa9ba04414a3d109c06e5a66de9 is now connected in restore mode...
Connecting now...
Connected to com.apple.mobile.restored, version 15
Device c873375cfa5e6aa9ba04414a3d109c06e5a66de9 has successfully entered restore mode
Hardware Information:
BoardID: 52
ChipID: 28672
UniqueChipID: 4601817761114150
ProductionMode: true
Starting FDR listener thread
About to send NORData...
Found firmware path Firmware/all_flash
Getting firmware manifest from build identity
Extracting LLB.j42d.RELEASE.im4p...
Personalizing IMG4 component LLB...
Extracting applelogo~appletv.im4p...
Personalizing IMG4 component AppleLogo...
Extracting DeviceTree.j42dap.im4p...
Personalizing IMG4 component DeviceTree...
Extracting recoverymode@1080~appletv5.im4p...
Personalizing IMG4 component RecoveryMode...
Extracting iBoot.j42d.RELEASE.im4p...
Personalizing IMG4 component iBoot...
Personalizing IMG4 component RestoreSEP...
Personalizing IMG4 component SEP...
Sending NORData now...
Done sending NORData
About to send RootTicket...
Sending RootTicket now...
Done sending RootTicket
Waiting for NAND (28)
Checking filesystems (15)
Checking filesystems (15)
About to send FDR Trust data...
Sending FDR Trust data now...
Done sending FDR Trust Data
Got status message
Status: Disk Failure
Log is available:
SYSLOG: Feb 11 05:35:02 localhost bootlog[0] <Notice>: BOOT_TIME 1518327302 534606
[05:35:03.0069-GMT]{5>7} CHECKPOINT NOTICE: Image4 device: AP nonce clearable
entering ramrod_clear_ap_nonce
[05:35:03.0083-GMT]{5>7} CHECKPOINT NOTICE: AP nonce consumed
[05:35:03.0084-GMT]{5>7} CHECKPOINT NOTICE: Pre-existing NVRAM variable: auto-boot=false
[05:35:03.0085-GMT]{5>7} CHECKPOINT NOTICE: Pre-existing NVRAM variable: restore-outcome=initial_monitor_no_return
[05:35:03.0087-GMT]{5>7} CHECKPOINT PROGRESS: START (unknown) -> (initial_engine_no_return)
[05:35:03.0087-GMT]{5>7} CHECKPOINT NOTICE: NVRAM access available on initial check
restore-outcome = initial_engine_no_return
executing /usr/sbin/nvram restore-outcome=initial_engine_no_return
[05:35:03.0105-GMT]{5>7} CHECKPOINT BEGIN: MAIN:[0x0400] umask
restore-step-ids = {0x11030400:1}
restore-step-names = {0x11030400:umask}
restore-step-uptime = 1
restore-step-user-progress = -1
[05:35:03.0108-GMT]{5>7} CHECKPOINT END: MAIN:[0x0400] umask
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = -1
[05:35:03.0110-GMT]{5>7} CHECKPOINT BEGIN: MAIN:[0x0402] setvbuf
restore-step-ids = {0x11030402:2}
restore-step-names = {0x11030402:setvbuf}
restore-step-uptime = 1
restore-step-user-progress = -1
[05:35:03.0112-GMT]{5>7} CHECKPOINT END: MAIN:[0x0402] setvbuf
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = -1
[05:35:03.0114-GMT]{5>7} CHECKPOINT BEGIN: MAIN:[0x0403] kernel_logger_thread
restore-step-ids = {0x11030403:3}
restore-step-names = {0x11030403:kernel_logger_thread}
restore-step-uptime = 1
restore-step-user-progress = -1
[05:35:03.0116-GMT]{5>7} CHECKPOINT END: MAIN:[0x0403] kernel_logger_thread
unable to open /dev/klog: Resource busy
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = -1
[05:35:03.0119-GMT]{5>7} CHECKPOINT BEGIN: MAIN:[0x0406] set_progress_0
restore-step-ids = {0x11030406:4}
restore-step-names = {0x11030406:set_progress_0}
restore-step-uptime = 1
restore-step-user-progress = -1
found display: external
attempting to power on display port
starting display hot plug thread
ramrod_display_set_granular_progress_forced: 0.000000
[05:35:03.0137-GMT]{5>7} CHECKPOINT END: MAIN:[0x0406] set_progress_0
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = 0
[05:35:03.0139-GMT]{5>7} CHECKPOINT BEGIN: MAIN:[0x0408] listen_for_log_client
restore-step-ids = {0x11030408:5}
restore-step-names = {0x11030408:listen_for_log_client}
restore-step-uptime = 1
restore-step-user-progress = 0
[05:35:03.0142-GMT]{5>7} CHECKPOINT END: MAIN:[0x0408] listen_for_log_client
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = 0
[05:35:03.0144-GMT]{5>7} CHECKPOINT BEGIN: MAIN:[0x040D] create_listen_socket
restore-step-ids = {0x1103040D:6}
restore-step-names = {0x1103040D:create_listen_socket}
restore-step-uptime = 1
restore-step-user-progress = 0
[05:35:03.0146-GMT]{5>7} CHECKPOINT END: MAIN:[0x040D] create_listen_socket
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = 0
[05:35:03.0148-GMT]{5>7} CHECKPOINT BEGIN: MAIN:[0x0404] update_root_mount
restore-step-ids = {0x11030404:7}
restore-step-names = {0x11030404:update_root_mount}
restore-step-uptime = 1
restore-step-user-progress = 0
[05:35:03.0152-GMT]{5>7} CHECKPOINT END: MAIN:[0x0404] update_root_mount
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = 0
[05:35:03.0155-GMT]{5>7} CHECKPOINT BEGIN: MAIN:[0x0405] disable_watchdog
restore-step-ids = {0x11030405:8}
restore-step-names = {0x11030405:disable_watchdog}
restore-step-uptime = 1
restore-step-user-progress = 0
[05:35:03.0159-GMT]{5>7} CHECKPOINT END: MAIN:[0x0405] disable_watchdog
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = 0
[05:35:03.0161-GMT]{5>7} CHECKPOINT BEGIN: MAIN:[0x040E] enable_usb
restore-step-ids = {0x1103040E:9}
restore-step-names = {0x1103040E:enable_usb}
restore-step-uptime = 1
restore-step-user-progress = 0
waiting for matching IOKit service: <CFBasicHash 0x104605790 [0x101bc2d70]>{type = mutable dict, count = 1,
entries =>
    0 : <CFString 0x101e73e00 [0x101bc2d70]>{contents = "IOProviderClass"} = <CFString 0x104603b00 [0x101bc2d70]>{contents = "AppleUSBDeviceMux"}
}

[05:35:06.0175-GMT]{5>7} CHECKPOINT END: MAIN:[0x040E] enable_usb
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
waiting for host to trigger start of restore [timeout of 120 seconds]
recv(8, 4) failed: connection closed
unable to read message size: -1
recv(9, 4) failed: connection closed
could not receive message
recv(11, 4) failed: connection closed
unable to read message size: -1
unable to read message size: -1
could not receive message
could not receive message
[05:35:06.0446-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0600] client_protocol_version
restore-step-ids = {0x11030600:10}
restore-step-names = {0x11030600:client_protocol_version}
restore-step-uptime = 4
restore-step-user-progress = 0
client protocol version 15
[05:35:06.0457-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0600] client_protocol_version
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
[05:35:06.0463-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0601] copy_restore_options
restore-step-ids = {0x11030601:11}
restore-step-names = {0x11030601:copy_restore_options}
restore-step-uptime = 4
restore-step-user-progress = 0
*** UUID AB5929FA-1E68-11CB-42EC-263C1BCE8A2E ***
Restore options:
    CreateFilesystemPartitions     => <CFBoolean 0x101bc32c8 [0x101bc2d70]>{value = true}
    MinimumSystemPartition         => <CFNumber 0xb0000000000094a3 [0x101bc2d70]>{value = +2378, type = kCFNumberSInt64Type}
    UUID                           => <CFString 0x104606b00 [0x101bc2d70]>{contents = "AB5929FA-1E68-11CB-42EC-263C1BCE8A2E"}
    SystemPartitionSize            => <CFNumber 0xb0000000000094a3 [0x101bc2d70]>{value = +2378, type = kCFNumberSInt64Type}
    SystemPartitionPadding         => <CFBasicHash 0x104606db0 [0x101bc2d70]>{type = mutable dict, count = 9,
entries =>
    0 : 512 = <CFNumber 0xb000000000005003 [0x101bc2d70]>{value = +1280, type = kCFNumberSInt64Type}
    2 : 128 = <CFNumber 0xb000000000005003 [0x101bc2d70]>{value = +1280, type = kCFNumberSInt64Type}
    3 : 16 = <CFNumber 0xb000000000000a03 [0x101bc2d70]>{value = +160, type = kCFNumberSInt64Type}
    4 : 1024 = <CFNumber 0xb000000000005003 [0x101bc2d70]>{value = +1280, type = kCFNumberSInt64Type}
    5 : 32 = <CFNumber 0xb000000000001403 [0x101bc2d70]>{value = +320, type = kCFNumberSInt64Type}
    6 : 768 = <CFNumber 0xb000000000005003 [0x101bc2d70]>{value = +1280, type = kCFNumberSInt64Type}
    7 : 8 = <CFNumber 0xb000000000000503 [0x101bc2d70]>{value = +80, type = kCFNumberSInt64Type}
    8 : 64 = <CFNumber 0xb000000000002803 [0x101bc2d70]>{value = +640, type = kCFNumberSInt64Type}
    10 : 256 = <CFNumber 0xb000000000005003 [0x101bc2d70]>{value = +1280, type = kCFNumberSInt64Type}
}

    PersonalizedDuringPreflight    => <CFBoolean 0x101bc32c8 [0x101bc2d70]>{value = true}
[05:35:06.0480-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0601] copy_restore_options
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
[05:35:06.0486-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0655] is_host_compatible
restore-step-ids = {0x11030655:12}
restore-step-names = {0x11030655:is_host_compatible}
restore-step-uptime = 4
restore-step-user-progress = 0
[05:35:06.0492-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0655] is_host_compatible
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
[05:35:06.0498-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0604] set_weight_from_options
restore-step-ids = {0x11030604:13}
restore-step-names = {0x11030604:set_weight_from_options}
restore-step-uptime = 4
restore-step-user-progress = 0
[05:35:06.0506-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0604] set_weight_from_options
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
[05:35:06.0512-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0608] device_has_hoover
restore-step-ids = {0x11030608:14}
restore-step-names = {0x11030608:device_has_hoover}
restore-step-uptime = 4
restore-step-user-progress = 0
entering bootstrap_hoover
bootstrap_hoover: using customer firmware
bootstrap_hoover: hoover successfully bootstrapped
[05:35:07.0746-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0608] device_has_hoover
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 5
restore-step-user-progress = 0
[05:35:07.0755-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0609] load_sep_os
restore-step-ids = {0x11030609:15}
restore-step-names = {0x11030609:load_sep_os}
restore-step-uptime = 5
restore-step-user-progress = 0
entering load_sep_os
device has sep - getting firmware
entering copy_restore_sep
display attached
0: 720 x 480 @ 60 (score = 0)
1: 1280 x 720 @ 60 (score = 0)
2: 720 x 576 @ 50 (score = 0)
3: 1280 x 720 @ 50 (score = 0)
4: 1920 x 1080 @ 60 (score = 0)
5: 1920 x 1080 @ 50 (score = 0)
6: 800 x 600 @ 60 (score = 1029)
7: 640 x 480 @ 75 (score = 98)
8: 640 x 480 @ 72 (score = 94)
9: 640 x 480 @ 60 (score = 1018)
10: 1280 x 1024 @ 75 (score = 173)
11: 1024 x 768 @ 75 (score = 134)
12: 1024 x 768 @ 70 (score = 125)
13: 1024 x 768 @ 60 (score = 1047)
14: 800 x 600 @ 75 (score = 111)
15: 800 x 600 @ 72 (score = 107)
16: 1152 x 864 @ 75 (score = 150)
17: 1280 x 800 @ 60 (score = 6061)
18: 1280 x 960 @ 60 (score = 1074)
19: 1280 x 1024 @ 60 (score = 1079)
20: 1440 x 900 @ 60 (score = 6078)
21: 1440 x 900 @ 75 (score = 5172)
22: 1680 x 1050 @ 60 (score = 6106)
23: 1600 x 1200 @ 60 (score = 1115)
24: 1920 x 1080 @ 60 (score = 16224)
25: 1360 x 768 @ 60 (score = 6063)
26: 1280 x 720 @ 60 (score = 16155)
27: 720 x 480 @ 60 (score = 16121)
28: 1920 x 1080 @ 24 (score = 15174)
29: 1920 x 1080 @ 30 (score = 15192)
using 1920 x 1080 @ 60 (score = 16224)
timing_data_struct
 activeVerticalAxis: 1080
 activeHorizontalAxis: 1920
 interlaced: 0
 pixelClock: 148351648
 ratioType: 3
 scanInformation: 0
cea_id = 16
Setting Digital out mode - ColorID: 66 timingID: 49got sep firmware - making call to load it
entering ramrod_load_sep_os
entering ramrod_execute_command_with_input_data: /usr/libexec/seputil (0x105380000 - 1835998)
executing /usr/libexec/seputil --restore+art -
waiting for child to exit
display: 1920 x 1080
powering on display
child exited
exit status: 0
[05:35:08.0935-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0609] load_sep_os
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 6
restore-step-user-progress = 0
[05:35:08.0945-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x060B] update_ticket
restore-step-ids = {0x1103060B:16}
restore-step-names = {0x1103060B:update_ticket}
restore-step-uptime = 6
restore-step-user-progress = 0
entering ramrod_ticket_update_verify
looking up boot manifest hash
device tree ticket_hash: DA812641CCF40125B53D9468BD963755EF2C4012
crypto-hash-method found. Using SHA1
computed ticket_hash   : DA812641CCF40125B53D9468BD963755EF2C4012
received valid ticket (4448 bytes)
[05:35:08.0968-GMT]{5>7} CHECKPOINT END: RESTORED:[0x060B] update_ticket
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 6
restore-step-user-progress = 0
[05:35:08.0977-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x060D] wait_for_storage
restore-step-ids = {0x1103060D:17}
restore-step-names = {0x1103060D:wait_for_storage}
restore-step-uptime = 6
restore-step-user-progress = 0
entering wait_for_storage_device
ramrod_display_set_granular_progress_forced: 0.000000
Searching for NAND service
Found NAND service: ASPStorage
NAND initialized. Waiting for devnode.
[05:35:08.0999-GMT]{5>7} CHECKPOINT END: RESTORED:[0x060D] wait_for_storage
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 6
restore-step-user-progress = 0
[05:35:09.0008-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x060E] update_NAND_firmware
restore-step-ids = {0x1103060E:18}
restore-step-names = {0x1103060E:update_NAND_firmware}
restore-step-uptime = 7
restore-step-user-progress = 0
[05:35:09.0018-GMT]{5>7} CHECKPOINT END: RESTORED:[0x060E] update_NAND_firmware
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 7
restore-step-user-progress = 0
[05:35:09.0027-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x060F] clear_remap_variable
restore-step-ids = {0x1103060F:19}
restore-step-names = {0x1103060F:clear_remap_variable}
restore-step-uptime = 7
restore-step-user-progress = 0
entering clear_remap_variable
executing /usr/sbin/nvram -d enable-remap-mode
enable-remap-mode
[05:35:09.0079-GMT]{5>7} CHECKPOINT END: RESTORED:[0x060F] clear_remap_variable
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 7
restore-step-user-progress = 0
[05:35:09.0085-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x065C] print_nvram_variables
restore-step-ids = {0x1103065C:20}
restore-step-names = {0x1103065C:print_nvram_variables}
restore-step-uptime = 7
restore-step-user-progress = 0
ramrod_print_NVRAM_variables
executing /usr/sbin/nvram -xp
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>auto-boot</key>
    <data>
    ZmFsc2U=
    </data>
    <key>boot-args</key>
    <string></string>
    <key>com.apple.System.tz0-size</key>
    <data>
    MHg4MDAwMDA=
    </data>
    <key>restore-outcome</key>
    <data>
    aW5pdGlhbF9lbmdpbmVfbm9fcmV0dXJu
    </data>
</dict>
</plist>
[05:35:09.0125-GMT]{5>7} CHECKPOINT END: RESTORED:[0x065C] print_nvram_variables
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 7
restore-step-user-progress = 0
[05:35:09.0131-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0610] asp_nand_set_writable
restore-step-ids = {0x11030610:21}
restore-step-names = {0x11030610:asp_nand_set_writable}
restore-step-uptime = 7
restore-step-user-progress = 0
Service name : ASPStorage
Set ASP writable successfully
[05:35:09.0143-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0610] asp_nand_set_writable
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 7
restore-step-user-progress = 0
[05:35:09.0149-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0611] reprobe_storage
restore-step-ids = {0x11030611:22}
restore-step-names = {0x11030611:reprobe_storage}
restore-step-uptime = 7
restore-step-user-progress = 0
entering ramrod_reprobe_device_path
entering ramrod_probe_media
device partitioning scheme is GPT
APFS Container /dev/disk0s1
device is APFS formatted
find_filesystem_partitions: storage=/dev/disk0 container=/dev/disk0s1 system=/dev/disk0s1s1 data=/dev/disk0s1s2 baseband data= log= update= xart= hardware= scratch=
[05:35:09.0185-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0611] reprobe_storage
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 7
restore-step-user-progress = 0
[05:35:09.0191-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0612] reprobe_firmware
restore-step-ids = {0x11030612:23}
restore-step-names = {0x11030612:reprobe_firmware}
restore-step-uptime = 7
restore-step-user-progress = 0
entering ramrod_reprobe_device_path
entering ramrod_probe_media
device partitioning scheme is GPT
APFS Container /dev/disk0s1
device is APFS formatted
find_filesystem_partitions: storage=/dev/disk0 container=/dev/disk0s1 system=/dev/disk0s1s1 data=/dev/disk0s1s2 baseband data= log= update= xart= hardware= scratch=
[05:35:09.0207-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0612] reprobe_firmware
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 7
restore-step-user-progress = 0
[05:35:09.0211-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0613] find_filesystem_partitions
restore-step-ids = {0x11030613:24}
restore-step-names = {0x11030613:find_filesystem_partitions}
restore-step-uptime = 7
restore-step-user-progress = 0
entering ramrod_probe_media
device partitioning scheme is GPT
APFS Container /dev/disk0s1
device is APFS formatted
find_filesystem_partitions: storage=/dev/disk0 container=/dev/disk0s1 system=/dev/disk0s1s1 data=/dev/disk0s1s2 baseband data= log= update= xart= hardware= scratch=
[05:35:09.0219-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0613] find_filesystem_partitions
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 7
restore-step-user-progress = 0
[05:35:09.0222-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0665] fsck_filesystems
restore-step-ids = {0x11030665:25}
restore-step-names = {0x11030665:fsck_filesystems}
restore-step-uptime = 7
restore-step-user-progress = 0
entering fsck_apfs_container
ramrod_display_set_granular_progress_forced: 0.000000
executing /System/Library/Filesystems/apfs.fs/fsck_apfs -dy /dev/disk0s1
** Checking volume.
** Checking the container superblock.
** Checking the space manager.
** Checking the object map.
** Checking the APFS volume superblock.
** Checking the object map.
** Checking the fsroot tree.
** Checking the snapshot metadata tree.
** Checking the extent ref tree.
** Checking the snapshots.
** Checking the APFS volume superblock.
** Checking the object map.
dev_init:453: Using /private/var/apfs and /private/var/nx for device-io.
** Checking the fsroot tree.
** Checking the snapshot metadata tree.
** Checking the extent ref tree.
** Checking the snapshots.
** Verifying allocated space.
error: Overallocation Detected on Main device: (15362904+1) bitmap address (28287)
   Space Verification failed.
** The volume /dev/disk0s1 could not be verified completely.
fsck succeeded on /dev/disk0s1
[05:35:10.0970-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0665] fsck_filesystems
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 8
restore-step-user-progress = 0
[05:35:10.0974-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0614] mount_system_partition
restore-step-ids = {0x11030614:26}
restore-step-names = {0x11030614:mount_system_partition}
restore-step-uptime = 8
restore-step-user-progress = 0
ramrod_display_set_granular_progress_forced: 0.000000
entering mount_partition
executing /System/Library/Filesystems/apfs.fs/mount_apfs -o rdonly /dev/disk0s1s1 /mnt1
/dev/disk0s1s1 mounted on /mnt1
System mounted read-only
[05:35:11.0015-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0614] mount_system_partition
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 9
restore-step-user-progress = 0
[05:35:11.0020-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0654] read_previous_os_build_version
restore-step-ids = {0x11030654:27}
restore-step-names = {0x11030654:read_previous_os_build_version}
restore-step-uptime = 9
restore-step-user-progress = 0
ramrod_read_previous_os_build_version: previous OS version: (null)
[05:35:11.0027-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0654] read_previous_os_build_version
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 9
restore-step-user-progress = 0
[05:35:11.0031-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0615] copy_hardware_info
restore-step-ids = {0x11030615:28}
restore-step-names = {0x11030615:copy_hardware_info}
restore-step-uptime = 9
restore-step-user-progress = 0
[05:35:11.0034-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0615] copy_hardware_info
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 9
restore-step-user-progress = 0
[05:35:11.0038-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0616] fdr_create
restore-step-ids = {0x11030616:29}
restore-step-names = {0x11030616:fdr_create}
restore-step-uptime = 9
restore-step-user-progress = 0
restored_fdr_initialize: FDR is supported
CryptoAcceleratorEncrypt: perform aes => 0 (kIOReturnSuccess)
pseudo_ccrng_allocate: ccdrbg_init() -> 0
CryptoGenerateRSAKeys: ccrsa_generate_key() -> 0
CryptoGenerateRSAKeys: [RSA Public Key SHA1: 20 bytes]
: 09 e7 94 4d 41 44 d5 b3 ec 11 f6 33 87 4e 24 1a 
: be 89 8c 50 
: -----------------------------------------------
CryptoGenerateRSAKeys: SecKeyCreateRSAPrivateKey -> 0x100e96500
CryptoGenerateRSAKeys: SecKeyCreateRSAPublicKey -> 0x100e964f8
_copyDataInstanceForSealingMapEntry: Using value 28672 for key ChipID from query cache
_copyDataInstanceForSealingMapEntry: Using value 4601817761114150 for key UniqueChipID from query cache
created HTTP FDR client 0x10440ce00
_copyDataInstanceForSealingMapEntry: Using value 28672 for key ChipID from query cache
_copyDataInstanceForSealingMapEntry: Using value 4601817761114150 for key UniqueChipID from query cache
created local FDR client 0x10440d760
Received response without expected RESTORED_FDR_TRUST_DATA
ramrod_ticket_copy_data_object_property: failed to get data property from Img4 manifest
failed to set trust object digest
RestoredFDRCreate() returned 6
FDR is not supported on this device
[05:35:13.0226-GMT]{5>7} CHECKPOINT FAILURE:(FAILURE:6) RESTORED:[0x0616] fdr_create [0]D(fatal FDR Error returned from RestoredFDRCreate())
restore-step-results = {0x11070616:{0:6}}
restore-step-codes = {0x11070616:{0:6}}
restore-step-domains = {0x11070616:{0:"AMRestoreErrorDomain"}}
restore-step-error = {0x11070616:"[0]D(fatal FDR Error returned from RestoredFDRCreate())"}
restore-step-uptime = 11
restore-step-user-progress = 0
[05:35:13.0230-GMT]{5>7} CHECKPOINT NOTICE: (NVRAM set) restore-step-user-progress=0 [sync=true] (first failure)
[05:35:13.0230-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0647] cleanup_check_result
restore-step-ids = {0x11030616:29;0x11030647:30}
restore-step-names = {0x11030616:fdr_create;0x11030647:cleanup_check_result}
restore-step-uptime = 11
restore-step-user-progress = 0
[05:35:13.0232-GMT]{5>7} CHECKPOINT END: RESTORED:[0x0647] cleanup_check_result
restore-step-ids = {0x11030616:29}
restore-step-names = {0x11030616:fdr_create}
restore-step-uptime = 11
restore-step-user-progress = 0
[05:35:13.0234-GMT]{5>7} CHECKPOINT BEGIN: RESTORED:[0x0648] cleanup_send_final_status
restore-step-ids = {0x11030616:29;0x11030648:31}
restore-step-names = {0x11030616:fdr_create;0x11030648:cleanup_send_final_status}
restore-step-uptime = 11
restore-step-user-progress = 0

ERROR: Unable to successfully restore device
[Error] ERROR: Unable to restore device
Done: restoring failed.
Failed with errorcode=-11`
goodboydheeraj commented 6 years ago

https://github.com/tihmstar/futurerestore/issues/55

NotAlexNoyle commented 6 years ago

@goodboydheeraj I've contributed to that issue with previous logs. Today is the first time I've reproduced it in months (and on a new device with an iOS 11 target).

Also, that branch is inactive.

encounter commented 6 years ago

I see

restored_fdr_initialize: FDR is supported

then

RestoredFDRCreate() returned 6 FDR is not supported on this device

which doesn't quite make sense. Could you check the IPSW hash against the hash listed on ipsw.me?

NotAlexNoyle commented 6 years ago

They match.

4a7da6b449f3fe29d1d7ba882594f6a5b94b5b83

https://i.imgur.com/HE6nvjD.jpg

https://i.imgur.com/MqxfQHL.jpg

NotAlexNoyle commented 6 years ago

@encounter FYI, I have a test device that I can use for as long as you want me to, until Apple stops signing 10.2.2. If there's anything I can do to help you figure out what's happening here , let me know.

encounter commented 6 years ago

I'm looking into it. I think one way you could help is restoring the device with iTunes, while running some kind of USB packet capture (possibly Wireshark?). I'll also be looking into doing this with my own test device.

idevicerestore apparently doesn't know what to send during the FDR data step, which could be the root cause.

NotAlexNoyle commented 6 years ago

If idevicerestore is the root of the problem, it's odd that futurerestore would work on any devices at all.

I'll try to run wireshark on a restore when I get home and post logs.

Thank you for looking into this! This is a really important restore path to have working, because it will allow Apple TV 4 owners to switch from a tvos10 jailbreak to a future tvos11 jailbreak.

NotAlexNoyle commented 6 years ago

Wireshark seems to only support USB packet capture on Windows and Linux. I guess I will try a windows VM? We'll see how it goes. Otherwise I'll need alternative software.

EDIT: It actually only supports it on windows if it's a windows virtual machine with a linux host. Which I can do. But inconvenient.

encounter commented 6 years ago

There does appear to be a way to capture using Wireshark on macOS: https://stackoverflow.com/a/47530380

I haven't tried it yet though.