libimobiledevice / idevicerestore

Restore/upgrade firmware of iOS devices
https://libimobiledevice.org
GNU Lesser General Public License v3.0
1.34k stars 395 forks source link

Custom Restore with checkm8-exploited 5C? #295

Open KaehLikeTheLetterK opened 5 years ago

KaehLikeTheLetterK commented 5 years ago

I recently managed to get this exploit to work on this device, and I immediately jumped to trying to flash 9.3.5. Currently in pwned DFU mode, I tried the erase restore and here's what I got:

[kaeh@kaeh-arch ~]$ sudo idevicerestore -e -c ~/Downloads/iPhone5,3_9.3.5_13G36_Restore.ipsw
Found device in DFU mode
Identified device as n48ap, iPhone5,3
Extracting Restore.plist from IPSW
Product Version: 9.3.5
Product Build: 13G36 Major: 13
Device supports Image4: false
Custom firmware requested. Disabled TSS request.
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
################################ [ WARNING ] #################################
# You are about to perform an *ERASE* restore. ALL DATA on the target device #
# will be IRREVERSIBLY DESTROYED. If you want to update your device without  #
# erasing the user data, hit CTRL+C now and restart without -e or --erase    #
# command line switch.                                                       #
# If you want to continue with the ERASE, please type YES and press ENTER.   #
##############################################################################
> YES
Checking IPSW for required components...
ERROR: iBSS file Firmware/dfu/iBSS.n48ap.RELEASE.dfu not found in IPSW
ERROR: iBEC file Firmware/dfu/iBEC.n48ap.RELEASE.dfu not found in IPSW
ERROR: Could not find all required components in IPSW /home/kaeh/Downloads/iPhone5,3_9.3.5_13G36_Restore.ipsw

I read on a few previous issues with similar topics that the "custom restore" option is only usable on the iPhone 4, but I figured that was due to the lack of a bootrom exploit for any newer devices. Is there anything that needs to be done on my end to resolve this and complete the restore, or is it simply a waiting game for this program to be updated to support checkm8 pwned dfu?

publicsite commented 1 month ago

Hi, I tried similar on Ipad2,1 using checkm8 and arduino.

Each time, I run checkm8 using the arduino then ...

( ERROR: Device did not reconnect in DFU or recovery mode. Possibly invalid iBSS. Reset device and try again. )

This means there is something different about 9.5.3 and 6.1.3, (probably in the plist of the ipsws) that is different and causes different errors.

A work around is to use an older ipsw, but when I tried this, as stated, I hit different error.

It would still be nice, however, if the iBSS/iBEC file names were handled correctly when using the 9.3.5 ipsw.

You can try using an older ipsw to see if you have any more success than me ... it may be that there are additional problems with my specific device that I don't know about.