search

libimobiledevice / idevicerestore

Restore/upgrade firmware of iOS devices
https://libimobiledevice.org
GNU Lesser General Public License v3.0
1.34k stars 395 forks source link

iOS 18 beta6 restore failed #668

Open irainbw opened 2 months ago

irainbw commented 2 months ago

Hello I'm trying to update to iOS 18b6 with the latest build of idevicerestore. (iPhone 14) A loop problem occurred. last message： iPhone14_iOS18b6.txt

irainbw commented 2 months ago

Hello I'm trying to update to iOS 18b6 with the latest build of idevicerestore. (iPhone 14) A loop problem occurred. last message： iPhone14_iOS18b6.txt When I debugged the code I found ： image DataRequestMsg Continuously circulating

nikias commented 2 months ago

Are you using latest libtatsu (1.0.3)?

irainbw commented 2 months ago

Are you using latest libtatsu (1.0.3)?

Yes, I compiled libtatsu from the master branch （windows）

nikias commented 2 months ago

Ok, just making sure. Can you run idevicerestore with -d -d so we can see the TSS request (and the reply)?

nikias commented 1 month ago

You can try with this patch, but I think it won't have any effect on the current problem...

diff --git a/src/restore.c b/src/restore.c
index d3828f9..d836470 100644
--- a/src/restore.c
+++ b/src/restore.c
@@ -698,16 +698,22 @@ static int _restore_service_send(restore_service_client_t service, plist_t plist
    return -1;
 }

-static int _restore_service_recv(restore_service_client_t service, plist_t *plist)
+static int _restore_service_recv_timeout(restore_service_client_t service, plist_t *plist, unsigned int timeout)
 {
+   struct restored_client_private {
+       property_list_service_client_t parent;
+       char *udid;
+       char *label;
+       plist_t info;
+   };
    if (!service) {
        return -1;
    }
    switch (service->type) {
        case SERVICE_TYPE_RESTORED:
-           return restored_receive((restored_client_t)service->client, plist);
+           return property_list_service_receive_plist_with_timeout(((struct restored_client_private*)service->client)->parent, plist, timeout);
        case SERVICE_TYPE_PLIST:
-           return property_list_service_receive_plist((property_list_service_client_t)service->client, plist);
+           return property_list_service_receive_plist_with_timeout((property_list_service_client_t)service->client, plist, timeout);
        default:
            break;
    }
@@ -4090,8 +4096,12 @@ static int _restore_send_file_data(struct _restore_send_file_data_ctx* rctx, voi
    if (done == 0 && (memcmp(data, "AEA1", 4) == 0)) {
        info("Encountered First Chunk in AEA image\n");
        plist_t message = NULL;
-       _restore_service_recv(rctx->service, &message);
-       restore_send_url_asset(rctx->client, message);
+       property_list_service_error_t err = _restore_service_recv_timeout(rctx->service, &message, 3000);
+       if (err == PROPERTY_LIST_SERVICE_E_RECEIVE_TIMEOUT) {
+           info("NOTE: No URLAsset requested, assuming it is not necessary.");
+       } else if (err == PROPERTY_LIST_SERVICE_E_SUCCESS) {
+           restore_send_url_asset(rctx->client, message);
+       }
    }

    if (total_size > 0x1000000) {
irainbw commented 1 month ago

You can try with this patch, but I think it won't have any effect on the current problem...

diff --git a/src/restore.c b/src/restore.c
index d3828f9..d836470 100644
--- a/src/restore.c
+++ b/src/restore.c
@@ -698,16 +698,22 @@ static int _restore_service_send(restore_service_client_t service, plist_t plist
  return -1;
 }

-static int _restore_service_recv(restore_service_client_t service, plist_t *plist)
+static int _restore_service_recv_timeout(restore_service_client_t service, plist_t *plist, unsigned int timeout)
 {
+ struct restored_client_private {
+     property_list_service_client_t parent;
+     char *udid;
+     char *label;
+     plist_t info;
+ };
  if (!service) {
      return -1;
  }
  switch (service->type) {
      case SERVICE_TYPE_RESTORED:
-         return restored_receive((restored_client_t)service->client, plist);
+         return property_list_service_receive_plist_with_timeout(((struct restored_client_private*)service->client)->parent, plist, timeout);
      case SERVICE_TYPE_PLIST:
-         return property_list_service_receive_plist((property_list_service_client_t)service->client, plist);
+         return property_list_service_receive_plist_with_timeout((property_list_service_client_t)service->client, plist, timeout);
      default:
          break;
  }
@@ -4090,8 +4096,12 @@ static int _restore_send_file_data(struct _restore_send_file_data_ctx* rctx, voi
  if (done == 0 && (memcmp(data, "AEA1", 4) == 0)) {
      info("Encountered First Chunk in AEA image\n");
      plist_t message = NULL;
-     _restore_service_recv(rctx->service, &message);
-     restore_send_url_asset(rctx->client, message);
+     property_list_service_error_t err = _restore_service_recv_timeout(rctx->service, &message, 3000);
+     if (err == PROPERTY_LIST_SERVICE_E_RECEIVE_TIMEOUT) {
+         info("NOTE: No URLAsset requested, assuming it is not necessary.");
+     } else if (err == PROPERTY_LIST_SERVICE_E_SUCCESS) {
+         restore_send_url_asset(rctx->client, message);
+     }
  }

  if (total_size > 0x1000000) {

I tried the patch but it had no effect on the results

irainbw commented 1 month ago

Ok, just making sure. Can you run idevicerestore with -d -d so we can see the TSS request (and the reply)?

NOTE: Unable to find BbCalibrationManifestKeyHash node
NOTE: Unable to find BbFactoryActivationManifestKeyHash node
NOTE: Unable to find BbSkeyId node
DEBUG: restore_get_yonkers_firmware_data: using Yonkers,SysTopPatch1
Sending Yonkers TSS request...
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>@HostPlatformInfo</key>
        <string>windows</string>
        <key>@VersionInfo</key>
        <string>libauthinstall_Win-973.40.2</string>
        <key>@UUID</key>
        <string>7EA19967-C50F-E902-B189-4C88F5FDF539</string>
        <key>@BBTicket</key>
        <true/>
        <key>@Yonkers,Ticket</key>
        <true/>
        <key>SEP</key>
        <dict>
                <key>Digest</key>
                <data>
                Pl11/+lmV9clOP9sPvEi7nazcTd6El7Eg08iPPbjhZuYgnKKbBTqQrHfaG6a
                UBgt
                </data>
        </dict>
        <key>Yonkers,AllowOfflineBoot</key>
        <true/>
        <key>Yonkers,BoardID</key>
        <integer>0</integer>
        <key>Yonkers,ChipID</key>
        <integer>1300</integer>
        <key>Yonkers,ECID</key>
        <data>
        X9uJxOOLH9K5X9N0RCI+7A==
        </data>
        <key>Yonkers,Nonce</key>
        <data>
        iP/9vXMp9t26OLZWkF9DRQ==
        </data>
        <key>Yonkers,PatchEpoch</key>
        <integer>0</integer>
        <key>Yonkers,ProductionMode</key>
        <true/>
        <key>Yonkers,ReadECKey</key>
        <true/>
        <key>Yonkers,ReadFWKey</key>
        <true/>
        <key>Yonkers,SysTopPatch1</key>
        <dict>
                <key>Digest</key>
                <data>
                Gl4AYM/R9NiXFwxCy+oum8F5gzVkWtPC+ZKmc4Cu6PI=
                </data>
                <key>EPRO</key>
                <true/>
                <key>FabRevision</key>
                <integer>5377</integer>
        </dict>
</dict>
</plist>
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... *   Trying 17.137.162.1:443...
* Connected to gs.apple.com (17.137.162.1) port 443
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* schannel: connection hostname (gs.apple.com) did not match against certificate name (gs-mdn-nx.apple.com)
* schannel: connection hostname (gs.apple.com) did not match against certificate name (gs-prz.apple.com)
* schannel: connection hostname (gs.apple.com) did not match against certificate name (gs-mrn.apple.com)
* schannel: connection hostname (gs.apple.com) validated against certificate name (gs.apple.com)
* ALPN: server accepted http/1.1
* using HTTP/1.1
> POST /TSS/controller?action=2 HTTP/1.1
Host: gs.apple.com
User-Agent: InetURL/1.0
Accept: */*
Cache-Control: no-cache
Content-type: text/xml; charset="utf-8"
Content-Length: 1273

* schannel: failed to decrypt data, need more data
< HTTP/1.1 200
< Server: Apple
< Date: Tue, 10 Sep 2024 01:30:48 GMT
< Content-Type: text/html
< Content-Length: 1638
< Connection: keep-alive
< Host: gs.apple.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains
< X-Frame-Options: SAMEORIGIN
<
* Connection #0 to host gs.apple.com left intact
response successfully received
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>@ServerVersion</key>
        <string>2.1.0</string>
        <key>Yonkers,Ticket</key>
        <data>
        MIID8xYESU00TQIBADGCAYz/hOqFnEKCAYMwggF/FgRNQU5CMYIBdf+E6oWcUIIBBTCC
        AQEWBE1BTlAxgfj/hquN5GQLMAkWBGVjcmQBAf//hrOt5GQLMAkWBGZrcmQBAf//hvux
        xHQLMAkWBG9sYnQBAf//h4OV4G8LMAkWBHBlcG8CAQD/h5vJ7G4eMBwWBHNydm4EFN0n
        pbhWnlqW73j8Ae6otXyNnvH0/4fLieRkCzAJFgR5YnJkAgEA/4fLjdJkDDAKFgR5Y2lk
        AgIFFP+Hy5XSZBowGBYEeWVpZAQQX9uJxOOLH9K5X9N0RCI+7P+Hy5XgbwswCRYEeWVw
        bwIBAP+Hy7nebhowGBYEeW5vbgQQiP/9vXMp9t26OLZWkF9DRf+Hy8HkbwswCRYEeXBy
        bwEB//+Hy83yMWAwXhYEeXN5MTFW/4SinaZUKjAoFgRER1NUBCAaXgBgz9H02JcXDELL
        6i6bwXmDNWRa08L5kqZzgK7o8v+EqsGkTwswCRYERVBSTwEB//+Gs8nKdgwwChYEZnJl
        dgICFQEERzBFAiAbsl82y4YP5JVjMxZmPhNe6Sv0ygPebk0B0LCW6TEvQAIhAIsSiReL
        NybRkXX4V9LywSak/h8yvfX5ZDpFMl0ottGtMIICDTCCAgkWBElNNEMCAQAxggG0/4Sa
        yahQggFiMIIBXhYEQ1JUUDGCAVT/hOqFnFCCAQEwgf4WBE1BTlAxgfX/hovR3mYMMAoW
        BGF0b2ahAgUA/4arje5yDDAKFgRlY3dyoQIFAP+Gq6XIdwwwChYEZWlkd6ECBQD/hqvB
        7nIMMAoWBGVwd3KhAgUA/4azheBkDDAKFgRmYXBkoQIFAP+Hg5XgbwwwChYEcGVwb6AC
        BQD/h4PJ3nYMMAoWBHByb3ahAgUA/4fLieRkDDAKFgR5YnJkoAIFAP+Hy43SZAwwChYE
        eWNpZAICBRT/h8uV0mQMMAoWBHllaWSgAgUA/4fLleBvCzAJFgR5ZXBvAgEA/4fLud5u
        DDAKFgR5bm9uoAIFAP+Hy8HkbwswCRYEeXBybwEB//+E+omUUEMwQRYET0JKUDE5/4Si
        naZUDDAKFgRER1NUoAIFAP+EqsGkTwwwChYERVBST6ACBQD/hrPJynYMMAoWBGZyZXag
        AgUA/4WC1YRLQgRARfaS3BLye3VBm3BqVWYp1Vbflv0I5ujw6v30FUXUHczHbpRlhf56
        vWUEZ78sAUatYMhKV7b9bnSv3vr7lCU3TQRGMEQCIHp2Bn2gBNqMGXQnfhEV2s4JtaMa
        xq8LVqxMEYu24Q7cAiAGqScPGYvh/iSlOvL/PUP89I3ENAfpHPyRvdgYPusy6g==
        </data>
</dict>
</plist>
Received Yonkers ticket
Extracting Sumter.Ngsk_Prod.fw (Firmware/Sumter/Sumter.Ngsk_Prod.fw)...
Sending FirmwareResponse data now...
Done sending FirmwareUpdater data
restore_handle_data_request_msg: type = ReceiptManifest
Sending ReceiptManifest data now...
Done sending ReceiptManifest data
restore_handle_data_request_msg: type = BuildIdentityDict
About to send BuildIdentity Dict...
Sending BuildIdentityDict now...
Done sending BuildIdentityDict
restore_handle_data_request_msg: type = SourceBootObjectV4
DEBUG: restore_send_source_boot_object_v4: Got SourceBootObjectV4 request:
printing 421 bytes plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>MsgType</key>
        <string>DataRequestMsg</string>
        <key>DataType</key>
        <string>SourceBootObjectV4</string>
        <key>Arguments</key>
        <dict>
                <key>ImageName</key>
                <string>SEP</string>
                <key>IsRecoveryOS</key>
                <false/>
        </dict>
</dict>
</plist>
About to send SEP...
DEBUG: tss_response_get_path_by_entry: No entry 'SEP' in TSS response
NOTE: No path for component SEP in TSS, will fetch from build identity
Sending SEP now (6949144 bytes)
Done sending SEP
restore_handle_data_request_msg: type = SourceBootObjectV4
DEBUG: restore_send_source_boot_object_v4: Got SourceBootObjectV4 request:
printing 438 bytes plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>MsgType</key>
        <string>DataRequestMsg</string>
        <key>DataType</key>
        <string>SourceBootObjectV4</string>
        <key>Arguments</key>
        <dict>
                <key>ImageName</key>
                <string>Yonkers,SysTopPatch1</string>
                <key>IsRecoveryOS</key>
                <false/>
        </dict>
</dict>
</plist>
About to send Yonkers,SysTopPatch1...
DEBUG: tss_response_get_path_by_entry: No entry 'Yonkers,SysTopPatch1' in TSS response
NOTE: No path for component Yonkers,SysTopPatch1 in TSS, will fetch from build identity
Sending Yonkers,SysTopPatch1 now (776 bytes)
Done sending Yonkers,SysTopPatch1
restore_handle_data_request_msg: type = SourceBootObjectV4
DEBUG: restore_send_source_boot_object_v4: Got SourceBootObjectV4 request:
printing 438 bytes plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>MsgType</key>
        <string>DataRequestMsg</string>
        <key>DataType</key>
        <string>SourceBootObjectV4</string>
        <key>Arguments</key>
        <dict>
                <key>ImageName</key>
                <string>Yonkers,SysTopPatch9</string>
                <key>IsRecoveryOS</key>
                <false/>
        </dict>
</dict>
</plist>
About to send Yonkers,SysTopPatch9...
DEBUG: tss_response_get_path_by_entry: No entry 'Yonkers,SysTopPatch9' in TSS response
NOTE: No path for component Yonkers,SysTopPatch9 in TSS, will fetch from build identity
Sending Yonkers,SysTopPatch9 now (776 bytes)
Done sending Yonkers,SysTopPatch9
restore_handle_data_request_msg: type = FirmwareUpdaterData
DEBUG: restore_send_firmware_updater_data: Got FirmwareUpdaterData request:
printing 2557 bytes plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>MsgType</key>
        <string>DataRequestMsg</string>
        <key>DataType</key>
        <string>FirmwareUpdaterData</string>
        <key>Arguments</key>
        <dict>
                <key>MessageArgInfo</key>
                <dict>
                        <key>YonkersDeviceInfo</key>
                        <dict>
                                <key>Yonkers,ChipID</key>
                                <integer>1300</integer>
                                <key>YonkersIsProvisioned</key>
                                <true/>
                                <key>Yonkers,ProductionMode</key>
                                <true/>
                                <key>Yonkers,FabRevision</key>
                                <integer>5377</integer>
                                <key>Yonkers,ReadFWKey</key>
                                <true/>
                                <key>Yonkers,AllowOfflineBoot</key>
                                <true/>
                                <key>Yonkers,ReadECKey</key>
                                <true/>
                                <key>YonkersIsYmgt</key>
                                <false/>
                                <key>Yonkers,Nonce</key>
                                <data>
                                iP/9vXMp9t26OLZWkF9DRQ==
                                </data>
                                <key>Yonkers,ECID</key>
                                <data>
                                X9uJxOOLH9K5X9N0RCI+7A==
                                </data>
                        </dict>
                </dict>
                <key>MessageArgUpdaterLoopCount</key>
                <integer>365</integer>
                <key>DataChunkSize</key>
                <integer>262144</integer>
                <key>MessageForceRepersonalization</key>
                <true/>
                <key>MessageArgType</key>
                <string>FirmwareResponseData</string>
                <key>DeviceGeneratedTags</key>
                <dict>
                        <key>BuildIdentityTags</key>
                        <array>
                                <string>SEP</string>
                                <string>Yonkers,BoardID</string>
                                <string>Yonkers,ChipID</string>
                                <string>Yonkers,PatchEpoch</string>
                                <string>Yonkers,SysTopPatch1</string>
                                <string>Yonkers,SysTopPatch9</string>
                        </array>
                        <key>ResponseTags</key>
                        <array>
                                <string>Yonkers,Ticket</string>
                        </array>
                </dict>
                <key>DeviceGeneratedRequest</key>
                <dict>
                        <key>Yonkers,PatchEpoch</key>
                        <integer>0</integer>
                        <key>@Yonkers,Ticket</key>
                        <true/>
                        <key>Yonkers,ProductionMode</key>
                        <true/>
                        <key>Yonkers,BoardID</key>
                        <integer>0</integer>
                        <key>Yonkers,ChipID</key>
                        <integer>1300</integer>
                        <key>Yonkers,SysTopPatch1</key>
                        <dict>
                                <key>Digest</key>
                                <data>
                                Gl4AYM/R9NiXFwxCy+oum8F5gzVkWtPC+ZKmc4Cu6PI=
                                </data>
                                <key>EPRO</key>
                                <true/>
                                <key>FabRevision</key>
                                <integer>5377</integer>
                        </dict>
                        <key>Yonkers,ReadFWKey</key>
                        <true/>
                        <key>Yonkers,AllowOfflineBoot</key>
                        <true/>
                        <key>Yonkers,ReadECKey</key>
                        <true/>
                        <key>Yonkers,Nonce</key>
                        <data>
                        iP/9vXMp9t26OLZWkF9DRQ==
                        </data>
                        <key>Yonkers,ECID</key>
                        <data>
                        X9uJxOOLH9K5X9N0RCI+7A==
                        </data>
                </dict>
                <key>MessageArgUpdaterName</key>
                <string>Savage</string>
        </dict>
</dict>
</plist>
nikias commented 1 month ago

I can't find what is actually wrong with the TSS... again I don't believe this would fix it, but I have a small patch for libtatsu:

diff --git a/src/tss.c b/src/tss.c
index fcb683c..3ffba0f 100644
--- a/src/tss.c
+++ b/src/tss.c
@@ -37,7 +37,7 @@

 #define USER_AGENT_STRING "InetURL/1.0"

-#define AUTH_VERSION "973.40.2"
+#define AUTH_VERSION "1033.0.2"

 #ifdef WIN32
 #define TSS_CLIENT_VERSION_STRING "libauthinstall_Win-"AUTH_VERSION""

It seems you are running this on Windows, not sure if that might be causing some issue.

irainbw commented 1 month ago

I can't find what is actually wrong with the TSS... again I don't believe this would fix it, but I have a small patch for libtatsu:

diff --git a/src/tss.c b/src/tss.c
index fcb683c..3ffba0f 100644
--- a/src/tss.c
+++ b/src/tss.c
@@ -37,7 +37,7 @@

 #define USER_AGENT_STRING "InetURL/1.0"

-#define AUTH_VERSION "973.40.2"
+#define AUTH_VERSION "1033.0.2"

 #ifdef WIN32
 #define TSS_CLIENT_VERSION_STRING "libauthinstall_Win-"AUTH_VERSION""

It seems you are running this on Windows, not sure if that might be causing some issue.

running on windows, alse failed

rekyagis commented 1 month ago

Hello.

I'm facing the same issue. I'm trying to restore iPhone 15 with iOS 18 (released version) on Linux by the latest idevicerestore and libs. The process shown in the attachment log loops. idevicerestore_loop.log.txt

It receives following 4 requests repeatedly.

  1. SourceBootObjectV4 of SEP
  2. SourceBootObjectV4 of Yonkers,SysTopPatch9
  3. SourceBootObjectV4 of Yonkers,SysTopPatch1
  4. FirmwareUpdaterData of Yonkers

The progress-bar on iPhone shows about 95% or more. No error nor suspicious message are found on debug log. The TSS request is almost same as what iTunes does, no meaningful difference can be found. idevicerestore exits with "DONE" message if I send SYGINT (hit Ctrl-C).

All log is attached. idevicerestore.log

Thanks.

nikias commented 1 month ago

I see, because the TSS stuff can be quite tricky even with small differences, would you be able to post an iTunes created TSS request vs. the idevicerestore one?

rekyagis commented 1 month ago

Hi,

This is what iTunes on Windows does: tss04.txt

This is what idevicerestore/libtatsu (latest version) does: idevicerestore_tss_1.txt

I've modified libtatsu to send exactly same request as iTunes, modifying VersionInfo to 1033.0.6 (but not "win"), adding Locality, ApBoardID, ApChipID, ApProductionMode and ApSecurityMode keys, removing SEP key. But it still failed, looping. idevicerestore_tss_2.txt

Thanks.

nikias commented 1 month ago

Thanks for your help. Still investigating...

nikias commented 1 month ago

@rekyagis What method are you using to get the debug log on Windows?

rekyagis commented 1 month ago

@rekyagis What method are you using to get the debug log on Windows?

I'm running idevicerestore on Linux and macOS. I get its debug log with -d or -dd option.

I also have a Windows PC. I can get the log of iTunes on Windows, using mitmproxy for TSS requests, Wireshark/USBPcap for USB packets.

Now, I'm investigating its USB packets, but it's harder to understand than before. It seems there is some change recently, using asynchronous/parallel communicating?

Please let me know if there's anything I can help. Thanks.

nikias commented 1 month ago

Yes, now some stuff is happening in parallel... Early beta restores have been reported to be working though, it seemed to have started with beta 3.

nikias commented 1 month ago

@rekyagis if you manage to make a USB dump, we are currently looking into the FirmwareResponseData response that is sent to the device after the Savage TSS request. There seems to be a change there.

rekyagis commented 1 month ago

@rekyagis if you manage to make a USB dump, we are currently looking into the FirmwareResponseData response that is sent to the device after the Savage TSS request. There seems to be a change there.

Thank you. Good advice.

This is what idevicerestore sends for FirmwareResponseData response: log_idevicerestore.txt

This is the USB packet damp by Wireshark of iTunes: 51396.txt And decoded plist: itunes_firmwareresponsedata_xml.txt

You can find that there is no "FirmwareData" in response of iTunes.

The restore is success with idevicerestore when I remove FirmwareData from the FirmwareResponseData of Yonkers. (just comment out "plist_dict_set_item(response, "FirmwareData", firmware_data);" at the bottom of restore_get_yonkers_firmware_data)

I think FirmwareData is not necessary in FirmwareResponseData since it is sent as response of SourceBootObjectV4 of Yonkers,SysTopPatch9. iTunes seems not to send FirmwareData in any FirmwareResponseData (not only in Yonkers) since I can not find "FirmwareData" word in iTunes's USB packet dump.

Thanks.

rekyagis commented 1 month ago

iTunes seems not to send FirmwareData in any FirmwareResponseData (not only in Yonkers) since I can not find "FirmwareData" word in iTunes's USB packet dump.

I removed all "FirmwareData" from FirmwareResponseData (just comment out all plist_dict_set_item for "FirmwareData" in restore.c, I found 7 lines). And got success for restoring iPhone 15 with iOS 18.0. The success log is attached: idevicerestore.log

I'm not sure we can remove all "FirmwareData" for another model of iPhone or another version of iOS. But it went well with my case.

Thanks.

tudorcraciun commented 1 month ago

iTunes seems not to send FirmwareData in any FirmwareResponseData (not only in Yonkers) since I can not find "FirmwareData" word in iTunes's USB packet dump.

I removed all "FirmwareData" from FirmwareResponseData (just comment out all plist_dict_set_item for "FirmwareData" in restore.c, I found 7 lines). And got success for restoring iPhone 15 with iOS 18.0. The success log is attached: idevicerestore.log

I'm not sure we can remove all "FirmwareData" for another model of iPhone or another version of iOS. But it went well with my case.

Thanks.

Hello,

I have also found these lines of code in restore.c:

/* skip FirmwareData for newer versions */
if (client->build_major >= 20) {
    debug("DEBUG: Not adding FirmwareData.\n");
    return response;
}

Maybe this is a clue as to which versions are compatible with this fix?

nikias commented 1 month ago

I figured that if FirmwareData is not in ResponseTags, it is not required. I pushed commit 3faf292 that should fix it.

tudorcraciun commented 1 month ago

The fix seems to work (tested on XS and 15), but something happened between the commit on Jul 9 (the previous build I had tested with) and today, as it seems the restoration process takes 3-4 times longer.

irainbw commented 1 month ago

I figured that if FirmwareData is not in ResponseTags, it is not required. I pushed commit 3faf292 that should fix it.

There seems to be a difference in my performance, and now the error appears at the beginning on iphone14 iphone14_b6.txt

nikias commented 1 month ago

I can't see why the recent changes would result in slower performance. Any idea what commit you where using when it was still fine? Remember also that newer iOS versions are larger.

tudorcraciun commented 1 month ago

Initially, I built idevicerestore from f7e24ce. The difference in performance I was referring to was between that build and ad46e14.

That was yesterday. It is weird that today the slowness disappeared, even though the hardware is the same (same number of devices in parallel, same workstation). Maybe I am missing something.

The slowness was observed when sending the filesystem (after the log 'Sending filesystem now').

irainbw commented 1 month ago

I figured that if FirmwareData is not in ResponseTags, it is not required. I pushed commit 3faf292 that should fix it.

Now works in recovery mode, but fails in normal state(iphone14,ios18b1)

Failure returned 168 error

iphone14_18b1.txt

nikias commented 1 month ago

@irainbw does it work with 18.0 ?

irainbw commented 1 month ago

@irainbw does it work with 18.0 ?

It works in recovery mode, but not in normal mode.Test before

nikias commented 1 month ago

Can you capture a tss request from Windows/macOS with the device in normal mode? Since we are facing a TSS issue it must be with the request. In recovery mode it does not send the eUICC stuff since it's not available in that mode...