tihmstar / futurerestore

A hacked up idevicerestore wrapper, which allows specifying SEP and Baseband for restoring
GNU Lesser General Public License v3.0
865 stars 272 forks source link

iPad 2,1 APTicket can't be used for restoring this device #300

Closed gekowa closed 4 years ago

gekowa commented 4 years ago

I have an iPad 2,1 running 9.3.5, and I'm downgrading it to 8.4.1.

I use tsschecker to download the shsh2 blob with command:

./tsschecker -d iPad2,1 -e 628023214926  -i 8.4.1 -o -s -b

the process was successful, when I use the generated shsh2 blob with futurerestore:

./futurerestore -t ticket.shsh --no-baseband ./iPad2,1_8.4.1_12H321_Restore.ipsw

I got "APTicket can't be used for restoring this device". I tried both kDFU mode and the recovery mode, both same issue.

Detail log:

Version: 38b168002bca318c91068fc194abd36e2d54f155 - 180
Libipatcher Version: 18cf8be6788f7e7ad96dac805724b8db7afcb9b0 - 69
Odysseus for 32-bit support: yes
Odysseus for 64-bit support: yes
INFO: device serial number is DQTFXKYYDFHW
[INFO] 32-bit device detected
futurerestore init done
reading signing ticket 628023214926_iPad2,1_8.4.1-12H321_9067c9264b921c46e82c269d7a65fc85ea61c311.shsh is done

WARNING: user specified is not to flash a baseband. This can make the restore fail if the device needs a baseband!
if you added this flag by mistake, you can press CTRL-C now to cancel
continuing restore in 10 9 8 7 6 5 4 3 2 1
Found device in Recovery mode
Device already in recovery mode
Found device in Recovery mode
Identified device as k93ap, iPad2,1
Extracting BuildManifest from iPSW
Product version: 8.4.1
Product build: 12H321 Major: 12
Device supports Image4: false
Got ApNonce from device: 90 67 c9 26 4b 92 1c 46 e8 2c 26 9d 7a 65 fc 85 ea 61 c3 11
checking APTicket to be valid for this restore...
[Error] ECID inside APTicket does not match device ECID
APTicket is valid for 5675407690470260736 (dec) but device is     628023214926 (dec)
Cleaning up...
[exception]:
what=APTicket can't be used for restoring this device

code=46858257
line=715
file=futurerestore.cpp
commit count=29:
commit sha  =2994651a10d8176a298b31e7706b4b6af97975d1:
Done: restoring failed!

Notice that the ECID from the generated shsh blob - 5675407690470260736 is making no sense. I guess this is not an HEX <-> DEC issue.

Please help, thank you in advance.

s0uthwest commented 4 years ago

Save blobs with correctly ECID…

gekowa commented 4 years ago

@s0uthwest Thank you for your response. But I have no idea where I did wrong on getting ECID, please let me know what is the most accurate way of getting the ECID.

Btw, I used i4 assistant to retrieve ECID from the device.

gekowa commented 4 years ago

After some research, I finally found the issue.

The 5675407690470260736 is the reversed HEX of ECID of my device. 5675407690470260736 in DEC is 4EC3193992000000 in HEX, while my correct ECID is 628023214926 in DEC and 923919C34E in HEX. Notice: 00 00 00 92 39 19 C3 4E is reversed as 4E C3 19 39 92 00 00 00

So the work round is to invoke tsschecker with the 5675407690470260736