futurerestore v189 (by marijuanARM); trying to FR from 13.5 (checkra1n) to 14.2 (valid blobs) on iPX

❯ /Users/macOS/Desktop/FutureRestore/futurerestore -t /Users/macOS/Desktop/FutureRestore/5710021589925934_iPhone10,6_d221ap_14.2-18B92_2ad8dc228ee5b63f5896596707cb6a1e43c15a517f6258040fe6afd75499aaae.shsh2 --latest-sep --latest-baseband /Users/macOS/Desktop/FutureRestore/iPhone10,3,iPhone10,6_14.2_18B92_Restore.ipsw
Version: 6ccc68162ba452d37a456648699d4d397fdc1084 - 192
img4tool version: 0.197-aca6cf005c94caf135023263cbb5c61a0081804f
libipatcher version: 0.82-0b2f79ff0917ef9b8a92475d93d9466b23fc2322
Odysseus for 32-bit support: yes
Odysseus for 64-bit support: yes
INFO: device serial number is G6TVQ6KRJCL8
[INFO] 64-bit device detected
futurerestore init done
reading signing ticket /Users/macOS/Desktop/FutureRestore/5710021589925934_iPhone10,6_d221ap_14.2-18B92_2ad8dc228ee5b63f5896596707cb6a1e43c15a517f6258040fe6afd75499aaae.shsh2 is done
user specified to use latest signed SEP (WARNING, THIS CAN CAUSE A NON-WORKING RESTORE)
[TSSC] opening firmwares.json
[DOWN] downloading file https://api.ipsw.me/v2.1/firmwares.json/condensed
[TSSC] selecting latest firmware version: 14.4
[TSSC] got firmwareurl for iOS 14.4 build 18D52
100 [===================================================================================================>]
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
downloading SEP
100 [===================================================================================================>]
[TSSC] opening /tmp/futurerestore/sepManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to not request a baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Downloading the latest firmware components...
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
downloading SE firmware
100 [===================================================================================================>]
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
downloading Savage,B0-Dev-Patch
100 [===================================================================================================>]
downloading Savage,B0-Dev-PatchVT
100 [===================================================================================================>]
downloading Savage,B0-Prod-Patch
100 [===================================================================================================>]
downloading Savage,B0-Prod-PatchVT
100 [===================================================================================================>]
downloading Savage,B2-Dev-Patch
100 [===================================================================================================>]
downloading Savage,B2-Dev-PatchV
100 [===================================================================================================>]
downloading Savage,B2-Prod-Patch
100 [===================================================================================================>]
downloading Savage,B2-Prod-PatchVT
100 [===================================================================================================>]
downloading Savage,BA-Dev-Patch
100 [===================================================================================================>]
downloading Savage,BA-Prod-Patch
100 [===================================================================================================>]
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
Finished downloading the latest firmware components!
user specified to use latest signed baseband (WARNING, THIS CAN CAUSE A NON-WORKING RESTORE)
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
downloading Baseband
100 [===================================================================================================>]
ERROR: Unable to connect to device?!
ERROR: Unable to get FirmwarePreflightInfo
[WARNING] failed to read BasebandGoldCertID from device! Is it already in recovery?
[WARNING] using tsschecker's fallback to get BasebandGoldCertID. This might result in invalid baseband signing status information
[TSSC] opening /tmp/futurerestore/basebandManifest.plist
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] User specified to request only a Baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Found device in Recovery mode
Device already in recovery mode
Found device in Recovery mode
Identified device as d221ap, iPhone10,6
Extracting BuildManifest from iPSW
Product version: 14.2
Product build: 18B92 Major: 18
Device supports Image4: true
Got ApNonce from device: 2a d8 dc 22 8e e5 b6 3f 58 96 59 67 07 cb 6a 1e 43 c1 5a 51 7f 62 58 04 0f e6 af d7 54 99 aa ae
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
[IMG4TOOL] checking buildidentity 0:
[IMG4TOOL] checking buildidentity matches board ... YES
[IMG4TOOL] checking buildidentity has all required hashes:
[IMG4TOOL] checking hash for "AOP"                     OK (untrusted)
[IMG4TOOL] checking hash for "Ap,SystemVolumeCanonicalMetadata"OK (found "msys" with matching hash)
[IMG4TOOL] checking hash for "AppleLogo"               OK (found "logo" with matching hash)
[IMG4TOOL] checking hash for "AudioCodecFirmware"      OK (untrusted)
[IMG4TOOL] checking hash for "BasebandFirmware"        IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "BatteryCharging0"        OK (found "chg0" with matching hash)
[IMG4TOOL] checking hash for "BatteryCharging1"        OK (found "chg1" with matching hash)
[IMG4TOOL] checking hash for "BatteryFull"             OK (found "batF" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow0"             OK (found "bat0" with matching hash)
[IMG4TOOL] checking hash for "BatteryLow1"             OK (found "bat1" with matching hash)
[IMG4TOOL] checking hash for "BatteryPlugin"           OK (found "glyP" with matching hash)
[IMG4TOOL] checking hash for "DeviceTree"              OK (found "dtre" with matching hash)
[IMG4TOOL] checking hash for "ISP"                     OK (found "ispf" with matching hash)
[IMG4TOOL] checking hash for "KernelCache"             OK (found "krnl" with matching hash)
[IMG4TOOL] checking hash for "LLB"                     OK (found "illb" with matching hash)
[IMG4TOOL] checking hash for "Liquid"                  OK (found "liqd" with matching hash)
[IMG4TOOL] checking hash for "Multitouch"              OK (untrusted)
[IMG4TOOL] checking hash for "OS"                      OK (found "rosi" with matching hash)
[IMG4TOOL] checking hash for "RecoveryMode"            OK (found "recm" with matching hash)
[IMG4TOOL] checking hash for "RestoreDeviceTree"       OK (found "rdtr" with matching hash)
[IMG4TOOL] checking hash for "RestoreKernelCache"      OK (found "rkrn" with matching hash)
[IMG4TOOL] checking hash for "RestoreLogo"             OK (found "rlgo" with matching hash)
[IMG4TOOL] checking hash for "RestoreRamDisk"          OK (found "rdsk" with matching hash)
[IMG4TOOL] checking hash for "RestoreSEP"              OK (found "rsep" with matching hash)
[IMG4TOOL] checking hash for "RestoreTrustCache"       OK (found "rtsc" with matching hash)
[IMG4TOOL] checking hash for "SE,UpdatePayload"        IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "SEP"                     OK (found "sepi" with matching hash)
[IMG4TOOL] checking hash for "Savage,B0-Dev-Patch"     IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B0-Dev-PatchVT"   IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B0-Prod-Patch"    IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B0-Prod-PatchVT"  IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B2-Dev-Patch"     IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B2-Dev-PatchVT"   IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B2-Prod-Patch"    IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,B2-Prod-PatchVT"  IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,BA-Dev-Patch"     IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "Savage,BA-Prod-Patch"    IGN (hash not found in im4m, but ignoring since not explicitly enforced through "Trusted"="YES" tag)
[IMG4TOOL] checking hash for "StaticTrustCache"        OK (found "trst" with matching hash)
[IMG4TOOL] checking hash for "SystemVolume"            OK (found "isys" with matching hash)
[IMG4TOOL] checking hash for "ftap"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "ftsp"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "iBEC"                    OK (found "ibec" with matching hash)
[IMG4TOOL] checking hash for "iBSS"                    OK (found "ibss" with matching hash)
[IMG4TOOL] checking hash for "iBoot"                   OK (found "ibot" with matching hash)
[IMG4TOOL] checking hash for "rfta"                    IGN (no digest in BuildManifest)
[IMG4TOOL] checking hash for "rfts"                    IGN (no digest in BuildManifest)
Verified APTicket to be valid for this restore
[TSSR] Checking BuildIdentity 0
[TSSR] Selected BuildIdentity for request
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Extracting filesystem from iPSW
[==================================================] 100.0%
Extracting iBEC.d22.RELEASE.im4p...
Personalizing IMG4 component iBEC...
Sending iBEC (1094156 bytes)...
waiting for device to reconnect... Getting SepNonce in recovery mode... 15 b5 7c 4f ea eb c6 78 e3 c7 98 3f 5e e9 07 24 fc 04 6c 98
Getting ApNonce in recovery mode... 2a d8 dc 22 8e e5 b6 3f 58 96 59 67 07 cb 6a 1e 43 c1 5a 51 7f 62 58 04 0f e6 af d7 54 99 aa ae
[WARNING] Setting bgcolor to green! If you don't see a green screen, then your device didn't boot iBEC correctly
Recovery Mode Environment:
iBoot build-version=iBoot-6723.42.3
iBoot build-style=RELEASE
Sending RestoreLogo...
Extracting applelogo@3x~iphone.im4p...
Personalizing IMG4 component RestoreLogo...
Sending RestoreLogo (20514 bytes)...
ramdisk-size=0x20000000
Extracting 018-01042-004.dmg...
Personalizing IMG4 component RestoreRamDisk...
Sending RestoreRamDisk (103846017 bytes)...
Extracting adc-nike-d22.im4p...
Personalizing IMG4 component ISP...
Sending ISP (13269822 bytes)...
Extracting 018-01042-004.dmg.trustcache...
Personalizing IMG4 component RestoreTrustCache...
Sending RestoreTrustCache (12089 bytes)...
Extracting DeviceTree.d221ap.im4p...
Personalizing IMG4 component RestoreDeviceTree...
Sending RestoreDeviceTree (40526 bytes)...
Extracting sep-firmware.d221.RELEASE.im4p...
Personalizing IMG4 component RestoreSEP...
Sending RestoreSEP (1455273 bytes)...
Extracting kernelcache.release.iphone10b...
Personalizing IMG4 component RestoreKernelCache...
Sending RestoreKernelCache (14209006 bytes)...
getting SEP ticket
Trying to fetch new SHSH blob
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Received SHSH blobs
About to restore device...
Connecting now...
Connected to com.apple.mobile.restored, version 15
Device ffffffffffffffffffffffffffffffff0000000d has successfully entered restore mode
Hardware Information:
BoardID: 14
ChipID: 32789
UniqueChipID: 5710021589925934
ProductionMode: true
Starting FDR listener thread
About to send RootTicket...
Sending RootTicket now...
Done sending RootTicket
Waiting for NAND (28)
Updating NAND Firmware (58)
About to send NORData...
Found firmware path Firmware/all_flash
Getting firmware manifest from build identity
Extracting LLB.d22.RELEASE.im4p...
Personalizing IMG4 component LLB...
Extracting applelogo@3x~iphone.im4p...
Personalizing IMG4 component AppleLogo...
Extracting batterycharging0@3x~iphone.im4p...
Personalizing IMG4 component BatteryCharging0...
Extracting batterycharging1@3x~iphone.im4p...
Personalizing IMG4 component BatteryCharging1...
Extracting batteryfull@3x~iphone.im4p...
Personalizing IMG4 component BatteryFull...
Extracting batterylow0@3x~iphone.im4p...
Personalizing IMG4 component BatteryLow0...
Extracting batterylow1@3x~iphone.im4p...
Personalizing IMG4 component BatteryLow1...
Extracting glyphplugin@2436~iphone-lightning.im4p...
Personalizing IMG4 component BatteryPlugin...
Extracting DeviceTree.d221ap.im4p...
Personalizing IMG4 component DeviceTree...
Extracting liquiddetect@2436~iphone-lightning.im4p...
Personalizing IMG4 component Liquid...
Extracting recoverymode@2436~iphone-lightning.im4p...
Personalizing IMG4 component RecoveryMode...
Extracting iBoot.d22.RELEASE.im4p...
Personalizing IMG4 component iBoot...
Personalizing IMG4 component RestoreSEP...
Personalizing IMG4 component SEP...
Sending NORData now...
Done sending NORData
ERROR: Unable to receive message from FDR 0x7f86477f2180 (-2). 0/2 bytes
ERROR: Could not read data (-256). Aborting.
Cleaning up...
[exception]:
what=ERROR: Unable to restore device

code=67895313
line=1036
file=futurerestore.cpp
commit count=192:
commit sha  =6ccc68162ba452d37a456648699d4d397fdc1084:
Done: restoring failed!
❯ irecovery -n // this kicked the iPhone X (currently on 13.5 / checkra1n) out of recovery mode back to normal state