Legacy IOS Part3

        if (( target_vers_maj >= 16 )) || [[ $restore_usedev == 1 || $device_type == "iPhone10,"* ]]; then
            fr_latest="c473a1748559b4673e0c43fa73cfa4421857be12"
            fr_branch="dev"
        fi
        local fr_current="$(cat ${futurerestore2}-${fr_branch}_version 2>/dev/null)"
        log "futurerestore $fr_branch branch will be used for this restore"
        if [[ $fr_latest != "$fr_current" ]]; then
            log "futurerestore nightly update detected, downloading."
            rm -f ${futurerestore2}-${fr_branch}*
        fi
        if [[ ! -e ${futurerestore2}-${fr_branch} ]]; then
            local url="https://github.com/LukeeGD/futurerestore/releases/download/latest/"
            local file="futurerestore-"
            case $platform in
                "macos" ) file+="macOS-RELEASE-${fr_branch}.zip";;
                "linux" ) file+="Linux-x86_64-RELEASE-${fr_branch}.zip";;
            esac
            url+="$file"
            file_download $url $file
            file_extract "$file"
            tar -xJvf futurerestore*.xz
            mv futurerestore ${futurerestore2}-${fr_branch}
            chmod +x ${futurerestore2}-${fr_branch}
            [[ $platform == "macos" ]] && /usr/bin/xattr -cr ${futurerestore2}-${fr_branch}
            echo "$fr_latest" > ${futurerestore2}-${fr_branch}_version
        fi
        futurerestore2+="-${fr_branch}"
    fi
    # custom arg(s), either --use-pwndfu or --skip-blob, or both
    for arg in "$@"; do
        if [[ $device_proc == 7 && $device_target_other != 1 && $device_target_vers == "10.3.3" &&
              $restore_usepwndfu64 != 1 && $arg == "--skip-blob" &&
              $FUTURERESTORE_I_SOLEMNLY_SWEAR_THAT_I_AM_UP_TO_NO_GOOD == 1 ]]; then
            arg+="2" # --skip-blob2
        fi
        [[ -n "$arg" ]] && ExtraArr+=("$arg")
    done
    if [[ $debug_mode == 1 ]]; then
        ExtraArr+=("-d")
    fi
    ExtraArr+=("-t" "$shsh_path" "$ipsw_path.ipsw")
    ipsw_extract

    log "Running futurerestore with command: $futurerestore2 ${ExtraArr[*]}"
    $futurerestore2 "${ExtraArr[@]}"
    opt=$?
    log "Restoring done! Read the message below if any error has occurred:"
    print "* For device activation, go to: Main Menu -> Attempt Activation"
    if [[ $platform == "macos" && $platform_arch == "arm64" ]]; then
        print "* Make sure that you are using a USB dock or hub to connect your device. Do not use USB dongles."
        echo
    fi
    if [[ $opt != 0 ]] && (( device_proc < 7 )); then
        print "* If you are getting the error: \"could not retrieve device serial number\","
        print " -> Try restoring with the jailbreak option enabled"
    fi
    print "* Please read the \"Troubleshooting\" wiki page in GitHub before opening any issue!"
    print "* Your problem may have already been addressed within the wiki page."
    print "* If opening an issue in GitHub, please provide a FULL log/output. Otherwise, your issue may be dismissed."
    kill $httpserver_pid 2>/dev/null
}

restore_latest() {
    local idevicerestore2="$idevicerestore"
    local ExtraArgs="-e"
    local noextract
    local newidr

    # remove erase arg if update
    [[ $1 == "update" ]] && ExtraArgs=

    # use newer idr for newer ios
    local major=$(echo "$device_latest_vers" | cut -d. -f1)
    if (( major >= 12 )); then
        newidr=1
    fi
    if [[ $newidr == 1 ]]; then
        idevicerestore2+="2"
        ExtraArgs+=" -y"
        noextract=1
    fi

    if [[ $1 == "custom" ]]; then
        ExtraArgs+=" -c"
        ipsw_path="$ipsw_custom"
        ipsw_extract custom
    else
        device_enter_mode Recovery
        [[ $noextract != 1 ]] && ipsw_extract
    fi
    if [[ $device_type == "iPhone1,2" && $device_target_vers == "4"* ]]; then
        if [[ $1 == "custom" ]]; then
            log "Sending s5l8900xall..."
            $irecovery -f "$ipsw_custom/Firmware/dfu/WTF.s5l8900xall.RELEASE.dfu"
            device_find_mode DFUreal
            log "Sending iBSS..."
            $irecovery -f "$ipsw_custom/Firmware/dfu/iBSS.${device_model}ap.RELEASE.dfu"
            device_find_mode Recovery
        fi
    elif [[ $device_proc == 1 && $device_target_vers == "3.1.3" && $mode == "customipsw" ]]; then
        log "Sending iBSS..."
        $irecovery -f "$ipsw_custom/Firmware/dfu/iBSS.${device_model}ap.RELEASE.dfu"
        device_find_mode Recovery
    fi
    if [[ $debug_mode == 1 ]]; then
        ExtraArgs+=" -d"
    fi
    log "Running idevicerestore with command: $idevicerestore2 $ExtraArgs \"$ipsw_path.ipsw\""
    $idevicerestore2 $ExtraArgs "$ipsw_path.ipsw"
    local opt=$?
    if [[ $platform == "macos" && $platform_arch == "arm64" ]]; then
        print "* Make sure that you are using a USB dock or hub to connect your device. Do not use USB dongles."
        echo
    fi
    if [[ $2 == "first" ]]; then
        return $opt
    fi
    if [[ $1 == "custom" ]]; then
        log "Restoring done! Read the message below if any error has occurred:"
        print "* Please read the \"Troubleshooting\" wiki page in GitHub before opening any issue!"
        print "* Your problem may have already been addressed within the wiki page."
        print "* If opening an issue in GitHub, please provide a FULL log/output. Otherwise, your issue may be dismissed."
    fi
    print "* For device activation, go to: Main Menu -> Attempt Activation"
}

restore_prepare_pwnrec64() {
    local attempt=1
    if [[ $device_pwnrec == 1 ]]; then
        warn "Pwned recovery flag detected, skipping pwned recovery mode procedure. Proceed with caution"
        return
    fi

    device_enter_mode pwnDFU
    sleep 1
    while (( attempt <= 5 )); do
        log "Entering pwned recovery mode... (Attempt $attempt of 5)"
        log "Sending iBSS..."
        $irecovery -f $iBSS.im4p
        sleep 1
        log "Sending iBEC..."
        $irecovery -f $iBEC.im4p
        sleep 3
        device_find_mode Recovery 1
        if [[ $? == 0 ]]; then
            break
        fi
        print "* You may also try to unplug and replug your device"
        ((attempt++))
    done
    if [[ $device_proc == 10 ]]; then
        log "irecovery -c go"
        $irecovery -c "go"
        sleep 3
    fi

    if (( attempt > 5 )); then
        error "Failed to enter pwned recovery mode. You might have to force restart your device and start over entering pwnDFU mode again"
    fi
}

device_buttons() {
    local selection=("kDFU" "pwnDFU")
    if [[ $device_jailbrokenselected == 1 ]]; then
        device_enter_mode kDFU
        return
    elif [[ $device_mode != "Normal" ]]; then
        device_enter_mode pwnDFU
        return
    fi
    input "pwnDFU/kDFU Mode Option"
    print "* This device needs to be in pwnDFU/kDFU mode before proceeding."
    if [[ $device_proc == 5 ]]; then
        print "* Selecting kDFU is recommended. Your device must be jailbroken and have OpenSSH installed for this option."
        print "* Selecting pwnDFU is only for those that have the option to use checkm8-a5 (needs Arduino+USB Host Shield or Pi Pico)."
        warn "Selecting pwnDFU will require usage of checkm8-a5. For more info, go here: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/checkm8-a5"
    elif [[ $device_proc == 6 && $platform != "macos" ]] || [[ $platform_cpu == "AMD"* ]]; then
        print "* Selecting kDFU is recommended. Your device must be jailbroken and have OpenSSH installed for this option."
        print "* Selecting pwnDFU is only for those that do not want to/cannot jailbreak their device."
        [[ $device_proc == 6 ]] && warn "Selecting pwnDFU will use checkm8 which has lower success rates on Linux for A6 devices."
        if [[ $platform_cpu == "AMD"* ]]; then
            case $device_type in
                iPhone3,* | iPad1,1 | iPod4,1 ) :;;
                * ) warn "Selecting pwnDFU will use checkm8 which has low success rates on AMD desktop CPUs if you have one.";;
            esac
        fi
    else
        selection=("pwnDFU" "kDFU")
        print "* Selecting pwnDFU is recommended. Both your home and power buttons must be working properly for entering DFU mode."
        print "* Selecting kDFU is for those that prefer the jailbroken method instead (have OpenSSH installed)."
    fi
    input "Select your option:"
    local opt2
    select_option "${selection[@]}"
    opt2="${selection[$?]}"
    if [[ $opt2 == *"DFU" ]]; then
        device_enter_mode $opt2
    fi
}

device_buttons2() {
    local selection=("Jailbroken" "pwnDFU")
    if [[ $device_mode != "Normal" ]]; then
        device_enter_mode pwnDFU
        return
    elif [[ $device_jailbrokenselected == 1 ]]; then
        return
    fi
    input "Jailbroken/pwnDFU Mode Option"
    print "* This device needs to be jailbroken/in pwnDFU mode before proceeding."
    print "* Selecting Jailbroken is recommended. Your device must be jailbroken and have OpenSSH installed for this option."
    print "* Selecting pwnDFU is for those that prefer the ramdisk method instead."
    if [[ $device_proc == 5 ]]; then
        warn "Selecting pwnDFU will require usage of checkm8-a5."
        print "* For more info about checkm8-a5, go here: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/checkm8-a5"
    fi
    input "Select your option:"
    local opt2
    select_option "${selection[@]}"
    opt2="${selection[$?]}"
    case $opt2 in
        "Jailbroken" ) device_jailbrokenselected=1;;
        "pwnDFU"     ) device_enter_mode pwnDFU;;
    esac
}

restore_deviceprepare() {
    if [[ $device_type == "$device_disable_bbupdate" && $device_deadbb != 1 ]]; then
        device_dump baseband
    fi
    if [[ $device_actrec == 1 ]]; then
        device_dump activation
    fi
    if [[ $mode == "custom-ipsw" ]]; then
        return
    fi
    case $device_proc in
        1 )
            if [[ $device_target_vers == "4"* && $ipsw_jailbreak == 1 ]]; then
                device_enter_mode WTFreal
            elif [[ $ipsw_jailbreak == 1 ]]; then
                device_enter_mode DFU
            fi
        ;;

        4 )
            if [[ -n $device_type_special ]]; then
                shsh_save version $device_latest_vers
                device_buttons
            elif [[ $device_target_tethered == 1 ]]; then
                shsh_save version $device_latest_vers
                device_enter_mode pwnDFU
            elif [[ $device_target_vers == "$device_latest_vers" ]]; then
                if [[ $ipsw_jailbreak == 1 || $ipsw_gasgauge_patch == 1 ]]; then
                    shsh_save version $device_latest_vers
                    device_buttons
                fi
            elif [[ $device_target_vers == "4.1" ]]; then
                case $device_type in
                    iPhone2,1 | iPod[23],1 )
                        shsh_save version 4.1
                        if [[ $ipsw_jailbreak == 1 ]]; then
                            device_enter_mode pwnDFU
                        else
                            device_enter_mode DFU
                        fi
                    ;;
                    * ) device_enter_mode pwnDFU;;
                esac
            else
                if [[ $device_target_powder == 1 ]]; then
                    shsh_save version $device_latest_vers
                fi
                case $device_target_vers in
                    [34]* ) device_enter_mode pwnDFU;;
                    * ) device_buttons;;
                esac
            fi
        ;;

        [56] )
            # 32-bit devices A5/A6
            if [[ $target_vers_maj == 10 && $device_target_tethered == 1 ]]; then
                return # do nothing, use kuroutadori
            elif [[ $device_target_tethered == 1 ]]; then
                shsh_save version $device_latest_vers
                device_enter_mode pwnDFU
                return
            elif [[ $device_target_other != 1 && $device_target_powder != 1 ]]; then
                shsh_save
            fi
            if [[ $device_target_vers == "$device_latest_vers" && $ipsw_gasgauge_patch != 1 ]]; then
                device_enter_mode Recovery
            else
                device_buttons
            fi
        ;;
    esac
}

restore_prepare() {
    case $device_proc in
        1 )
            if [[ $ipsw_jailbreak != 1 ]]; then
                if [[ $target_vers_maj == 4 ]]; then
                    restore_latest
                    return
                fi
                device_enter_mode Recovery
                ipsw_custom="$ipsw_path"
            fi
            restore_latest custom
        ;;

        4 )
            if [[ -n $device_type_special ]]; then
                restore_idevicerestore special
            elif [[ $device_target_tethered == 1 || $device_target_other == 1 ]] ||
                 [[ $device_target_vers == "4.1" && $ipsw_jailbreak == 1 && $device_target_powder != 1 ]]; then
                restore_idevicerestore
            elif [[ $device_target_powder == 1 ]]; then
                case $device_target_vers in
                    3* | 4.[012]* )
                        local ipsw_custom_part2="$ipsw_custom"
                        ipsw_custom="$ipsw_custom_part1"
                        if [[ $ipsw_skip_first != 1 ]]; then
                            restore_idevicerestore first
                            log "Do not disconnect your device, not done yet"
                            print "* Please put the device in DFU mode after it reboots!"
                            sleep 5
                            device_mode=
                            log "Press Enter/Return when the device reboots and is on black screen, Apple logo, or iTunes logo."
                            device_enter_mode DFU
                        fi
                        log "Finding device in Recovery/DFU mode..."
                        until [[ -n $device_mode ]]; do
                            device_mode="$($irecovery -q 2>/dev/null | grep -w "MODE" | cut -c 7-)"
                        done
                        ipsw_custom="$ipsw_custom_part2"
                        print "* If pwning fails here, re-enter DFU and run the script again with --skip-first flag enabled to continue the process."
                        device_enter_mode pwnDFU
                        restore_idevicerestore
                    ;;
                    * ) restore_idevicerestore;;
                esac
                if [[ $device_target_vers == "3"* || $device_target_vers == "4"* ]]; then
                    echo
                    log "The device may enter recovery mode after the restore"
                    print "* To fix this, go to: Useful Utilities -> Disable/Enable Exploit -> Enable Exploit"
                fi
            elif [[ $device_target_vers == "4.1" ]]; then
                restore_latest
                if [[ $device_type == "iPhone2,1" ]]; then
                    log "Ignore the baseband error and do not disconnect your device yet"
                    device_find_mode Recovery 50
                    log "Attempting to exit recovery mode"
                    $irecovery -n
                    log "Done. Your device should reboot now"
                fi
            elif [[ $device_target_vers == "$device_latest_vers" ]]; then
                if [[ $ipsw_jailbreak == 1 || $ipsw_gasgauge_patch == 1 ]]; then
                    restore_idevicerestore
                else
                    restore_latest
                fi
            else
                if [[ $device_type == "iPhone2,1" && $device_newbr != 0 ]]; then
                    restore_latest custom first
                    local opt=$?
                    print "* Proceed to install the alloc8 exploit for the device to boot:"
                    print " -> Go to: Useful Utilities -> Install alloc8 Exploit"
                    if [[ $opt != 0 ]]; then
                        warn "The restore seems to have failed. Will not continue with alloc8 install."
                        print "* Do not attempt alloc8 install manually either. It will not work without a successful restore."
                        return
                    fi
                    log "Do not disconnect your device, not done yet"
                    device_find_mode DFU 50
                    device_alloc8
                else
                    restore_latest custom
                fi
            fi
        ;;

        [56] )
            # 32-bit devices A5/A6
            if [[ $device_target_vers == "$device_latest_vers" && $ipsw_gasgauge_patch != 1 ]]; then
                restore_latest
            elif [[ $ipsw_jailbreak == 1 || -e "$ipsw_custom.ipsw" ]]; then
                restore_idevicerestore
            elif [[ $target_vers_maj == 10 ]]; then
                restore_kuroutadori
            else
                restore_futurerestore --use-pwndfu
            fi
        ;;

        7 )
            if [[ $device_target_other != 1 && $device_target_vers == "10.3.3" ]]; then
                shsh_save
            fi
            if [[ $restore_usepwndfu64 == 1 ]]; then
                restore_pwned64
            elif [[ $device_target_other != 1 && $device_target_vers == "10.3.3" ]]; then
                if [[ $device_type == "iPad4,4" || $device_type == "iPad4,5" ]]; then
                    iBSS=$iBSSb
                    iBEC=$iBECb
                fi
                restore_prepare_pwnrec64
                shsh_save apnonce $($irecovery -q | grep "NONC" | cut -c 7-)
                restore_futurerestore --skip-blob
            elif [[ $device_target_vers == "$device_latest_vers" ]]; then
                restore_latest
            else
                restore_notpwned64
            fi
        ;;

        [89] | 10 )
            if [[ $restore_usepwndfu64 == 1 ]]; then
                restore_pwned64
            elif [[ $device_target_vers == "$device_latest_vers" ]]; then
                restore_latest
            else
                restore_notpwned64
            fi
        ;;

        11 ) restore_latest;;
    esac
}

restore_kuroutadori() {
    local args=("-w" "--load-shsh" "$shsh_path")
    if [[ $device_target_tethered == 1 ]]; then
        args=("-o")
    fi
    args+=("-y" "$ipsw_path.ipsw")
    device_enter_mode DFU
    kuroutadori_init
    kuroutadori_litera1n -D
    device_pwnd="$($irecovery -q | grep "PWND" | cut -c 7-)"
    if [[ $device_pwnd != "yolo" ]]; then
        device_pwnerror
    fi
    log "Running turdus_merula: $kuroutadori/turdus_merula ${args[*]}"
    $kuroutadori/turdus_merula "${args[@]}"
}

# Function to get iOS version from build number using firmwares.json
get_ios_version_from_build() {
    local build="$1"

    # Ensure firmwares.json exists
    if [[ ! -s ../saved/firmwares.json ]]; then
        log "Downloading firmwares.json for build lookup..."
        file_download https://api.ipsw.me/v2.1/firmwares.json/condensed firmwares.json
        mv firmwares.json ../saved
    fi

    # Use firmwares.json to find version
    local version=$(cat ../saved/firmwares.json | $jq -r --arg build "$build" '
        [.. | objects | select(.buildid == $build) | .version] |
        if length > 0 then .[0] else empty end' 2>/dev/null)

    if [[ -n "$version" && "$version" != "null" ]]; then
        echo "$version"
    else
        echo ""
    fi
}

restore_pwned64() {
    device_enter_mode pwnDFU
    if [[ ! -s ../saved/firmwares.json ]]; then
        file_download https://api.ipsw.me/v2.1/firmwares.json/condensed firmwares.json
        mv firmwares.json ../saved
    fi
    rm -f /tmp/firmwares.json
    cp ../saved/firmwares.json /tmp
    local opt
    if [[ $device_proc == 7 && $device_target_other != 1 &&
          $device_target_vers == "10.3.3" ]] || [[ $restore_useskipblob == 1 ]]; then
        opt="--skip-blob"
    fi
    restore_futurerestore --use-pwndfu $opt
}

restore_notpwned64() {
    log "The generator for your SHSH blob is: $shsh_generator"
    print "* Before continuing, make sure to set the nonce generator of your device!"
    print "* For more details, go to: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/futurerestore"
    print "* Using \"Set Nonce Only\" in the Restore/Downgrade menu is also an option"
    pause
    if [[ $device_mode == "Normal" ]]; then
        device_enter_mode Recovery
    fi
    restore_futurerestore
}

ipsw_prepare() {
    case $device_proc in
        1 )
            if [[ $ipsw_jailbreak == 1 ]]; then
                ipsw_prepare_s5l8900
            elif [[ $device_target_vers == "$device_latest_vers" && ! -s "../$ipsw_latest_path.ipsw" ]]; then
                ipsw_path="../$ipsw_latest_path"
                ipsw_download "$ipsw_path"
            fi
        ;;

        4 )
            if [[ $device_type == "iPod4,1" || $device_type == "iPad1,1" ]] && [[ $device_target_vers == "7."* ]]; then
                ipsw_prepare_specialios7
            elif [[ -n $device_type_special ]]; then
                ipsw_prepare_sundanceinh2a
            elif [[ $device_target_tethered == 1 ]]; then
                ipsw_prepare_tethered
            elif [[ $device_target_other == 1 || $ipsw_gasgauge_patch == 1 ]] ||
                 [[ $device_target_vers == "$device_latest_vers" && $ipsw_jailbreak == 1 ]]; then
                case $device_type in
                    iPhone2,1 ) ipsw_prepare_jailbreak;;
                    iPod2,1 ) ipsw_prepare_custom;;
                    * ) ipsw_prepare_32bit;;
                esac
            elif [[ $device_target_powder == 1 ]] && [[ $device_target_vers == "3"* || $device_target_vers == "4"* ]]; then
                shsh_save version $device_latest_vers
                case $device_target_vers in
                    4.3* ) ipsw_prepare_ios4powder;;
                    * ) ipsw_prepare_ios4multipart;;
                esac
            elif [[ $device_target_powder == 1 ]]; then
                ipsw_prepare_powder
            elif [[ $device_target_vers != "$device_latest_vers" ]]; then
                ipsw_prepare_custom
            fi
            if [[ $ipsw_isbeta == 1 && $ipsw_prepare_ios4multipart_patch != 1 ]] ||
               [[ $device_target_vers == "3.2"* && $ipsw_prepare_ios4multipart_patch != 1 ]] ||
               [[ $ipsw_gasgauge_patch == 1 ]]; then
                ipsw_prepare_multipatch
            fi
        ;;

        [56] )
            # 32-bit devices A5/A6
            if [[ $target_vers_maj == 10 && $device_target_tethered == 1 ]]; then
                return # do nothing, use kuroutadori
            elif [[ $device_target_tethered == 1 ]]; then
                ipsw_prepare_tethered
            elif [[ $device_target_powder == 1 ]]; then
                ipsw_prepare_powder
            elif [[ $device_target_vers != "$device_latest_vers" || $ipsw_gasgauge_patch == 1 ]]; then
                ipsw_prepare_32bit
            fi
            if [[ $ipsw_fourthree == 1 ]]; then
                ipsw_prepare_fourthree_part2
            elif [[ $ipsw_isbeta == 1 || $ipsw_gasgauge_patch == 1 ]]; then
                ipsw_prepare_multipatch
            fi
        ;;

        [789] | 10 )
            if [[ $device_type == "iPhone10,3" || $device_type == "iPhone10,6" ]] && (( target_vers_maj <= 15 )); then
                # patch restored_external for iPhone X downgrades to 14.3-15.x
                ipsw_ipx=1
                ipsw_prepare_ipx
            else
                ipsw_ipx=
            fi
            restore_usepwndfu64_option
            if [[ $device_target_other != 1 && $device_target_vers == "10.3.3" && $restore_usepwndfu64 != 1 ]]; then
                ipsw_prepare_1033
            fi
        ;;
    esac
}

restore_usepwndfu64_option() {
    if [[ $device_target_vers == "$device_latest_vers" ]]; then
        return
    elif [[ $restore_usepwndfu64 == 1 ]]; then
        log "use-pwndfu flag detected, Pwned Restore Option enabled."
        restore_usepwndfu64=1
        return
    elif [[ $restore_useskipblob == 1 ]]; then
        log "skip-blob flag detected, Pwned Restore Option enabled."
        restore_usepwndfu64=1
        return
    elif [[ $device_mode == "DFU" && $device_target_other == 1 ]]; then
        log "Device is in DFU mode, Pwned Restore Option enabled."
        print "* If you want to disable Pwned Restore Option, place the device in Normal/Recovery mode"
        restore_usepwndfu64=1
        return
    elif [[ $device_target_setnonce == 1 ]]; then
        log "Set Nonce Only mode detected, Pwned Restore Option enabled."
        restore_usepwndfu64=1
        return
    fi
    local opt
    input "Pwned Restore Option"
    print "* When this option is enabled, use-pwndfu will be enabled for restoring."
    if [[ $device_target_other == 1 ]]; then
        print "* When disabled, user must set the device generator manually before the restore."
    fi
    if [[ $device_proc == 7 && $device_target_vers == "10.3.3" && $device_target_other != 1 ]] ||
       [[ $device_proc == 7 && $platform == "linux" ]]; then
        if [[ $device_target_vers == "10.3.3" && $device_target_other != 1 ]]; then
            print "* It is recommended to disable this option for A7 10.3.3 restores."
        fi
        print "* This option is disabled by default (N). Select this option if unsure."
        select_yesno "Enable this option?" 0
        if [[ $? != 0 ]]; then
            log "Pwned restore option enabled by user."
            restore_usepwndfu64=1
        else
            log "Pwned restore option disabled."
        fi
    else
        print "* This option is enabled by default (Y). Select this option if unsure."
        select_yesno "Enable this option?" 1
        if [[ $? != 1 ]]; then
            log "Pwned restore option disabled by user."
        else
            log "Pwned restore option enabled."
            restore_usepwndfu64=1
        fi
    fi
}

ipsw_prepare_ipx() {
    restore_usepwndfu64=1
    log "Extracting BuildManifest.plist from IPSW"
    file_extract_from_archive "$ipsw_path.ipsw" BuildManifest.plist
    log "Get paths"
    local kernelcache=$($PlistBuddy2 -c "Print BuildIdentities:0:Manifest:KernelCache:Info:Path" BuildManifest.plist | tr -d '"')
    local restoreramdisk=$($PlistBuddy2 -c "Print BuildIdentities:0:Manifest:RestoreRamDisk:Info:Path" BuildManifest.plist | tr -d '"')
    log "KernelCache: $kernelcache"
    log "RestoreRamDisk: $restoreramdisk"

    # patch kernelcache amfi (required when using custom ramdisk)
    log "Extracting KernelCache from IPSW"
    file_extract_from_archive "$ipsw_path.ipsw" $kernelcache
    log "Processing KernelCache"
    "$dir/img4" -i $kernelcache -o kcache.raw
    log "Patching KernelCache"
    "$dir/KPlooshFinder" kcache.raw kcache.patched
    "$dir/kerneldiff" kcache.raw kcache.patched kcache.bpatch
    log "Repacking KernelCache"
    "$dir/img4" -i $kernelcache -o kcache.im4p -T rkrn -P kcache.bpatch -J

    log "Extracting RestoreRamDisk from IPSW"
    file_extract_from_archive "$ipsw_path.ipsw" $restoreramdisk

    local platform2="$platform"
    [[ $platform2 == "macos" ]] && platform2+="x"
    ldid="../saved/ldid_${platform2}_$(uname -m)"
    if [[ ! -s $ldid ]]; then
        file_download https://github.com/ProcursusTeam/ldid/releases/download/v2.1.5-procursus7/$(basename $ldid) ldid
        mv ldid $ldid
    fi
    if [[ ! -s $ldid ]]; then
        error "Failed to download ldid. Please run the script again"
    fi
    chmod +x $ldid

    # patch restored_external for iPhone X downgrades to 14.3-15.x
    log "Processing RestoreRamDisk"
    "$dir/img4" -i $restoreramdisk -o ramdisk.raw
    log "Extracting restored_external"
    "$dir/hfsplus" ramdisk.raw extract usr/local/bin/restored_external
    log "Patching restored_external"
    mv restored_external restored_external.orig
    "$dir/ipx_restored_patcher" restored_external.orig restored_external
    $ldid -e restored_external.orig > ent.xml
    $ldid -Sent.xml restored_external
    if [[ ! -s restored_external ]]; then
        error "Failed to patch restored_external (???) Please run the script again."
    fi
    log "Replacing restored_external"
    "$dir/hfsplus" ramdisk.raw rm usr/local/bin/restored_external
    "$dir/hfsplus" ramdisk.raw add restored_external usr/local/bin/restored_external
    "$dir/hfsplus" ramdisk.raw chmod 755 usr/local/bin/restored_external
    log "Repacking RestoreRamDisk"
    "$dir/img4" -i ramdisk.raw -o rdsk.im4p -T rdsk -A
}

menu_remove4() {
    local menu_items
    local selected
    local back

    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Disable Exploit" "Enable Exploit" "Go Back")
        menu_print_info
        print " > Main Menu > Useful Utilities > Disable/Enable Exploit"
        input "Select an option:"
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "Disable Exploit" ) rec=0;;
            "Enable Exploit" ) rec=2;;
        esac
        case $selected in
            "Go Back" ) back=1;;
            * ) mode="remove4";;
        esac
    done
}

device_send_rdtar() {
    log "Sending and extracting $1"
    if [[ $2 == "gz" ]]; then
        cp $jelbrek/$1.gz .
        gzip -d $1.gz
        cat $1 | $ssh -p $ssh_port root@127.0.0.1 "tar -xvf - -C /mnt1"
        return
    fi
    cat $jelbrek/$1 | $ssh -p $ssh_port root@127.0.0.1 "tar -xvf - -C /mnt1"
}

device_ramdisk64() {
    local sshtar="../saved/ssh64.tar"
    local comps=("iBSS" "iBEC" "DeviceTree" "Kernelcache" "RestoreRamdisk")
    local name
    local iv
    local key
    local path
    local url
    local decrypt
    local opt
    local build_id="16A366"
    if (( device_proc >= 9 )) || [[ $device_type == "iPad5"* ]]; then
        build_id="18C66"
    fi

    if [[ $device_ramdisk_ios8 == 1 ]]; then
        build_id="12B410"
        if [[ $device_type == "iPhone"* ]]; then
            build_id="12B411"
        elif [[ $device_type == "iPod7,1" ]]; then
            build_id="12H321"
        fi
        sshtar="../saved/iram.tar"
        if [[ ! -e $sshtar ]]; then
            log "Downloading iram.tar from iarchive.app..."
            file_download https://github.com/LukeZGD/Legacy-iOS-Kit/files/14952123/iram.zip iram.zip
            file_extract iram.zip
            mv iram.tar $sshtar
        fi
        cp $sshtar ssh.tar
    else
        comps+=("Trustcache")
        if [[ $($sha1sum $sshtar.gz 2>/dev/null | awk '{print $1}') != "61975423c096d5f21fd9f8a48042fffd3828708b" ]]; then
            rm -f $sshtar $sshtar.gz
        fi
        if [[ ! -e $sshtar.gz ]]; then
            log "Downloading ssh.tar from SSHRD_Script..."
            file_download https://raw.githubusercontent.com/LukeZGD/sshtars/eed9dcb6aa7562c185eb8b3b66c6035c0b026d47/ssh.tar.gz ssh.tar.gz
            mv ssh.tar.gz $sshtar.gz
        fi
        cp $sshtar.gz ssh.tar.gz
        gzip -d ssh.tar.gz
    fi

    local ramdisk_path="../saved/$device_type/ramdisk_$build_id"
    device_target_build="$build_id"
    device_fw_key_check
    ipsw_get_url $build_id
    mkdir -p $ramdisk_path
    rm -f $ramdisk_path/*.img4 $ramdisk_path/iBEC.im4p $ramdisk_path/iBSS.im4p

    for getcomp in "${comps[@]}"; do
        name=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
        iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        if [[ $device_type == "iPhone8,"* && $getcomp == "iB"* ]]; then
            name=$(echo $device_fw_key | $jq -j '.keys[] | select(.image | startswith("'$getcomp'")) | select(.filename | startswith("'$getcomp'.'$device_model'.")) | .filename')
            iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image | startswith("'$getcomp'")) | select(.filename | startswith("'$getcomp'.'$device_model'.")) | .iv')
            key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image | startswith ("'$getcomp'")) | select(.filename | startswith("'$getcomp'.'$device_model'.")) | .key')
        fi
        case $getcomp in
            "iBSS" | "iBEC" ) path="Firmware/dfu/";;
            "DeviceTree" ) path="Firmware/all_flash/";;
            "Trustcache" ) path="Firmware/";;
            * ) path="";;
        esac
        if [[ $device_ramdisk_ios8 == 1 && $getcomp == "DeviceTree" ]]; then
            path="$all_flash/"
        fi
        if [[ -z $name ]]; then
            local hwmodel
            ipsw_hwmodel_set
            hwmodel="$ipsw_hwmodel"
            case $getcomp in
                "iBSS" | "iBEC"  ) name="$getcomp.$hwmodel.RELEASE.im4p";;
                "DeviceTree"     ) name="$getcomp.${device_model}ap.im4p";;
                "Kernelcache"    ) name="kernelcache.release.$hwmodel";;
                "Trustcache"     ) name="048-08497-242.dmg.trustcache";;
                "RestoreRamdisk" ) name="048-08497-242.dmg";;
            esac
            if [[ $device_type == "iPhone8,1" || $device_type == "iPhone8,2" ]] && [[ $getcomp == "Kernelcache" ]]; then
                name="kernelcache.release.${device_model:0:3}"
            fi
            if [[ $build_id == "18C66" ]]; then
                case $getcomp in
                    "Trustcache"     ) name="038-83284-083.dmg.trustcache";;
                    "RestoreRamdisk" ) name="038-83284-083.dmg";;
                esac
            fi
        fi

        log "$getcomp"
        if [[ -e $ramdisk_path/$name ]]; then
            cp $ramdisk_path/$name .
        else
            "$dir/pzb" -g "${path}$name" -o "$name" "$ipsw_url"
            cp $name $ramdisk_path/
        fi
        mv $name $getcomp.orig
        local reco="-i $getcomp.orig -o $getcomp.img4 -M ../resources/sshrd/IM4M$device_proc -T "
        case $getcomp in
            "iBSS" | "iBEC" )
                reco+="$(echo $getcomp | tr '[:upper:]' '[:lower:]') -A"
                "$dir/img4" -i $getcomp.orig -o $getcomp.dec -k ${iv}${key}
                mv $getcomp.orig $getcomp.orig0
                if [[ $device_ramdisk_ios8 == 1 ]]; then
                    $bspatch $getcomp.dec $getcomp.orig ../resources/sshrd/ios8/$name.patch
                else
                    $bspatch $getcomp.dec $getcomp.orig ../resources/sshrd/$name.patch
                fi
            ;;
            "Kernelcache" )
                reco+="rkrn"
                if [[ $device_ramdisk_ios8 == 1 ]]; then
                    mv $getcomp.orig $getcomp.orig0
                    "$dir/img4" -i $getcomp.orig0 -o $getcomp.orig -k ${iv}${key} -D
                else
                    reco+=" -P ../resources/sshrd/$name.bpatch"
                    if [[ $platform == "linux" && $build_id == "18"* ]] || [[ $device_proc == 10 ]]; then
                        reco+=" -J"
                    fi
                fi
            ;;
            "DeviceTree" )
                reco+="rdtr"
                if [[ $device_ramdisk_ios8 == 1 ]]; then
                    reco+=" -A"
                    mv $getcomp.orig $getcomp.orig0
                    "$dir/img4" -i $getcomp.orig0 -o $getcomp.orig -k ${iv}${key}
                fi
            ;;
            "Trustcache" ) reco+="rtsc";;
            "RestoreRamdisk" )
                reco+="rdsk -A"
                mv $getcomp.orig $getcomp.orig0
                if [[ $device_ramdisk_ios8 == 1 ]]; then
                    "$dir/img4" -i $getcomp.orig0 -o $getcomp.orig -k ${iv}${key}
                    "$dir/hfsplus" $getcomp.orig grow 50000000
                else
                    "$dir/img4" -i $getcomp.orig0 -o $getcomp.orig
                    "$dir/hfsplus" $getcomp.orig grow 130000000
                fi
                "$dir/hfsplus" $getcomp.orig untar ssh.tar
                "$dir/hfsplus" $getcomp.orig untar ../resources/sshrd/sbplist.tar
            ;;
        esac
        "$dir/img4" $reco
    done

    mv iBSS.img4 iBSS.im4p
    mv iBEC.img4 iBEC.im4p
    iBSS="iBSS"
    iBEC="iBEC"

    if [[ $device_argmode == "none" ]]; then
        mkdir -p $ramdisk_path/saved
        cp *.img4 iBEC.im4p iBSS.im4p $ramdisk_path/saved/
        log "Done creating SSH ramdisk files: saved/$device_type/ramdisk_$build_id/saved"
        return
    fi
    restore_prepare_pwnrec64

    log "Booting, please wait..."
    $irecovery -f RestoreRamdisk.img4
    $irecovery -c ramdisk
    $irecovery -f DeviceTree.img4
    $irecovery -c devicetree
    if [[ $device_ramdisk_ios8 != 1 ]]; then
        $irecovery -f Trustcache.img4
        $irecovery -c firmware
    fi
    $irecovery -f Kernelcache.img4
    $irecovery -c bootx
    sleep 6

    if [[ $device_ramdisk_ios8 == 1 ]]; then
        device_iproxy no-logging 44
        print "* Booted SSH ramdisk is based on: https://ios7.iarchive.app/downgrade/making-ramdisk.html"
    else
        device_iproxy no-logging
        print "* Booted SSH ramdisk is based on: https://github.com/verygenericname/SSHRD_Script"
    fi
    device_sshpass alpine

    local found
    log "Waiting for device..."
    print "* You may need to unplug and replug your device."
    while [[ $found != 1 ]]; do
        found=$($ssh -p $ssh_port root@127.0.0.1 "echo 1")
        sleep 2
    done

    case $1 in
        "getversion" ) device_datetime_cmd;;
    esac

    echo
    print "* Mount filesystems with this command (for iOS 11.3 and newer):"
    print "    mount_filesystems"
    print "* Mount root filesystem with this command (for iOS 10.3.x/11.x):"
    print "    mount_apfs /dev/disk0s1s1 /mnt1"
    print "* Mount root filesystem with this command (for iOS 10.2.1 and older):"
    print "    mount_hfs /dev/disk0s1s1 /mnt1"
    warn "Mounting and/or modifying data partition (/mnt2) might not work for 64-bit iOS"
    warn "Mount filesystems at your own risk: there is a chance of bootlooping! Especially on versions older than iOS 11.3."
    print "* For more details, go to: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/SSH-Ramdisk"

    menu_ramdisk $build_id
}

device_ramdisk() {
    local comps=("iBSS" "iBEC" "DeviceTree" "Kernelcache")
    local name
    local iv
    local key
    local path
    local url
    local decrypt
    local ramdisk_path
    local version
    local build_id
    local mode="$1"
    local rec=2
    local bundle="../resources/firmware/FirmwareBundles/Down_"

    if [[ $1 == "setnvram" ]]; then
        rec=$2
    fi
    if [[ $1 != "justboot" ]]; then
        comps+=("RestoreRamdisk")
    fi
    case $device_type in
        iPhone1,[12] | iPod1,1 ) device_target_build="7E18"; device_target_vers="3.1.3";;
        iPod2,1 ) device_target_build="8C148"; device_target_vers="4.2.1";;
        iPod3,1 | iPad1,1 ) device_target_build="9B206";;
        iPhone2,1 | iPod4,1 ) device_target_build="10B500";;
        iPhone5,[34] ) device_target_build="11D257";;
        * ) device_target_build="10B329";;
    esac
    if [[ -n $device_rd_build ]]; then
        device_target_build=$device_rd_build
        device_rd_build=
    fi
    version=$device_target_vers
    build_id=$device_target_build
    bundle+="${device_type}_${version}_${build_id}.bundle"
    if [[ -z $ipsw_justboot_path ]]; then
        local ipsw_path=$(ls ../${device_type}*${build_id}_Restore.ipsw 2>/dev/null)
        if [[ -s "$ipsw_path" ]]; then
            ipsw_justboot_path="${ipsw_path%%.ipsw*}"
        else
            local build_id2="$(echo "$build_id" | tr '[:upper:]' '[:lower:]')"
            ipsw_path=$(ls ../${device_type_lower}*${build_id2}_restore.ipsw 2>/dev/null)
            [[ -s "$ipsw_path" ]] && ipsw_justboot_path="${ipsw_path%%.ipsw*}"
        fi
        [[ -n $ipsw_justboot_path ]] && log "Found IPSW to use: $ipsw_justboot_path.ipsw"
    fi

    device_fw_key_check
    ipsw_get_url $build_id $device_type $version
    ramdisk_path="../saved/$device_type/ramdisk_$build_id"
    mkdir -p $ramdisk_path
    rm -f $ramdisk_path/*.dec $ramdisk_path/iBEC $ramdisk_path/iBSS $ramdisk_path/Ramdisk.dmg

    for getcomp in "${comps[@]}"; do
        name=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
        iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        case $getcomp in
            "iBSS" | "iBEC" ) path="Firmware/dfu/";;
            "DeviceTree" )
                path="Firmware/all_flash/"
                case $build_id in
                    14[EFG]* ) :;;
                    * ) path="$all_flash/";;
                esac
            ;;
            * ) path="";;
        esac
        if [[ -z $name ]]; then
            local hwmodel="$device_model"
            case $build_id in
                14[EFG]* )
                    case $device_type in
                        iPhone5,[12] ) hwmodel="iphone5";;
                        iPhone5,[34] ) hwmodel="iphone5b";;
                        iPad3,[456] )  hwmodel="ipad3b";;
                    esac
                ;;
                [789]* | 10* | 11* ) hwmodel+="ap";;
            esac
            case $getcomp in
                "iBSS" | "iBEC" ) name="$getcomp.$hwmodel.RELEASE.dfu";;
                "DeviceTree" )    name="$getcomp.${device_model}ap.img3";;
                "Kernelcache" )   name="kernelcache.release.$hwmodel";;
            esac
        fi
        [[ $name == *".dmg" ]] && name="${name%%.dmg*}.dmg"

        log "$getcomp"
        if [[ -n $ipsw_justboot_path ]]; then
            file_extract_from_archive "$ipsw_justboot_path.ipsw" "${path}$name"
        elif [[ -s $ramdisk_path/$name ]]; then
            cp $ramdisk_path/$name .
        else
            "$dir/pzb" -g "${path}$name" -o "$name" "$ipsw_url"
        fi
        if [[ ! -s $name ]]; then
            error "Failed to get $name. Please run the script again."
        fi
        if [[ ! -s $ramdisk_path/$name ]]; then
            cp $name $ramdisk_path/
        fi
        mv $name $getcomp.orig
        if [[ $getcomp == "Kernelcache" || $getcomp == "iBSS" ]] && [[ $device_proc == 1 || $device_type == "iPod2,1" ]]; then
            decrypt="-iv $iv -k $key"
            "$dir/xpwntool" $getcomp.orig $getcomp.dec $decrypt
        elif [[ $build_id == "14"* ]]; then
            cp $getcomp.orig $getcomp.dec
        else
            "$dir/xpwntool" $getcomp.orig $getcomp.dec -iv $iv -k $key -decrypt
        fi
    done

    if [[ $1 != "justboot" ]]; then
        log "Patch RestoreRamdisk"
        "$dir/xpwntool" RestoreRamdisk.dec Ramdisk.raw
        "$dir/hfsplus" Ramdisk.raw grow 32000000
        "$dir/hfsplus" Ramdisk.raw untar ../resources/sshrd/sbplist.tar
    fi

    if [[ $device_proc == 1 || $device_type == "iPod2,1" ]]; then
        cp ../resources/sshrd/ssh_old.tar.gz .
        gzip -d ssh_old.tar.gz
        "$dir/hfsplus" Ramdisk.raw untar ssh_old.tar
        "$dir/xpwntool" Ramdisk.raw Ramdisk.dmg -t RestoreRamdisk.dec
        log "Patch iBSS"
        $bspatch iBSS.dec iBSS.patched $bundle/iBSS.${device_model}ap.RELEASE.patch
        "$dir/xpwntool" iBSS.patched iBSS -t iBSS.orig
        log "Patch Kernelcache"
        mv Kernelcache.dec Kernelcache0.dec
        $bspatch Kernelcache0.dec Kernelcache.patched $bundle/kernelcache.release.patch
        "$dir/xpwntool" Kernelcache.patched Kernelcache.dec -t Kernelcache.orig $decrypt
        rm DeviceTree.dec
        mv DeviceTree.orig DeviceTree.dec
    else
        if [[ $1 != "justboot" ]]; then
            cp ../resources/sshrd/ssh.tar.gz .
            gzip -d ssh.tar.gz
            "$dir/hfsplus" Ramdisk.raw untar ssh.tar
            if [[ $1 == "jailbreak" && $device_vers == "8"* ]]; then
                "$dir/hfsplus" Ramdisk.raw untar ../resources/jailbreak/daibutsu/bin.tar
            fi
            "$dir/hfsplus" Ramdisk.raw mv sbin/reboot sbin/reboot_bak
            "$dir/hfsplus" Ramdisk.raw mv sbin/halt sbin/halt_bak
            case $build_id in
                 "12"* | "13"* | "14"* )
                    echo '#!/bin/bash' > restored_external
                    echo "/sbin/sshd; exec /usr/local/bin/restored_external_o" >> restored_external
                    "$dir/hfsplus" Ramdisk.raw mv usr/local/bin/restored_external usr/local/bin/restored_external_o
                    "$dir/hfsplus" Ramdisk.raw add restored_external usr/local/bin/restored_external
                    "$dir/hfsplus" Ramdisk.raw chmod 755 usr/local/bin/restored_external
                    "$dir/hfsplus" Ramdisk.raw chown 0:0 usr/local/bin/restored_external
                ;;
            esac
            "$dir/xpwntool" Ramdisk.raw Ramdisk.dmg -t RestoreRamdisk.dec
        fi
        log "Patch iBSS"
        "$dir/xpwntool" iBSS.dec iBSS.raw
        if [[ $device_type == "iPad2,"* || $device_type == "iPhone3,3" ]]; then
            case $build_id in
                8[FGHJKL]* | 8E600 | 8E501 ) device_boot4=1;;
            esac
        fi
        if [[ $device_boot4 == 1 && $build_id == "8E"* ]]; then
            "$dir/iBoot32Patcher" iBSS.raw iBSS.patched --rsa --debug -b "-v amfi=0xff cs_enforcement_disable=1"
        else
            "$dir/iBoot32Patcher" iBSS.raw iBSS.patched --rsa --debug -b "$device_bootargs"
        fi
        "$dir/xpwntool" iBSS.patched iBSS -t iBSS.dec
        if [[ $build_id == "7"* || $build_id == "8"* ]] && [[ $device_type != "iPad"* ]]; then
            :
        else
            log "Patch iBEC"
            "$dir/xpwntool" iBEC.dec iBEC.raw
            if [[ $1 == "justboot" ]]; then
                "$dir/iBoot32Patcher" iBEC.raw iBEC.patched --rsa -b "$device_bootargs"
            else
                "$dir/iBoot32Patcher" iBEC.raw iBEC.patched --rsa --debug -b "rd=md0 -v amfi=0xff amfi_get_out_of_my_way=1 cs_enforcement_disable=1 pio-error=0"
            fi
            "$dir/xpwntool" iBEC.patched iBEC -t iBEC.dec
        fi
    fi

    if [[ $device_boot4 == 1 && $build_id == "8E"* ]]; then
        log "Patch Kernelcache"
        mv Kernelcache.dec Kernelcache0.dec
        "$dir/xpwntool" Kernelcache0.dec Kernelcache.raw
        $bspatch Kernelcache.raw Kernelcache.patched ../resources/patch/kernelcache.release.${device_model}.${build_id}.patch
        "$dir/xpwntool" Kernelcache.patched Kernelcache.dec -t Kernelcache0.dec
    fi

    if [[ $device_argmode == "none" ]]; then
        mkdir -p $ramdisk_path/saved
        cp *.dec iBEC iBSS Ramdisk.dmg $ramdisk_path/saved/
        log "Done creating SSH ramdisk files: saved/$device_type/ramdisk_$build_id/saved"
        return
    fi

    if [[ $1 == "jailbreak" || $1 == "justboot" || $device_type == "iPod2,1" ]]; then
        device_enter_mode pwnDFU
    elif [[ $device_proc == 1 ]]; then
        device_enter_mode DFU
    else
        device_buttons
    fi

    if [[ $device_type == "iPad1,1" && $build_id != "9"* ]]; then
        patch_ibss
        log "Sending iBSS..."
        $irecovery -f pwnediBSS.dfu
        sleep 1
        log "Sending iBEC..."
        $irecovery -f iBEC
    elif (( device_proc < 5 )) && [[ $device_pwnrec != 1 ]]; then
        log "Sending iBSS..."
        $irecovery -f iBSS
    fi
    sleep 1
    if [[ $build_id != "7"* && $build_id != "8"* ]]; then
        log "Sending iBEC..."
        $irecovery -f iBEC
        if [[ $device_pwnrec == 1 ]]; then
            $irecovery -c "go"
        fi
    fi
    device_find_mode Recovery
    if [[ $1 != "justboot" ]]; then
        log "Sending ramdisk..."
        $irecovery -f Ramdisk.dmg
        log "Running ramdisk"
        $irecovery -c "getenv ramdisk-delay" # required for s5l8900
        $irecovery -c ramdisk
    fi
    log "Sending DeviceTree..."
    $irecovery -f DeviceTree.dec
    log "Running devicetree"
    $irecovery -c devicetree
    log "Sending KernelCache..."
    $irecovery -f Kernelcache.dec
    $irecovery -c bootx

    if [[ $1 == "justboot" ]]; then
        log "Device should now boot."
        return
    fi
    log "Booting, please wait..."
    sleep 6

    if [[ -n $1 ]]; then
        device_iproxy
    else
        device_iproxy no-logging
    fi
    device_sshpass alpine

    local found
    log "Waiting for device..."
    print "* You may need to unplug and replug your device."
    while [[ $found != 1 ]]; do
        found=$($ssh -p $ssh_port root@127.0.0.1 "echo 1")
        sleep 2
    done

    case $mode in
        "activation" | "baseband" )
            return
        ;;

        "TwistedMind2" )
            log "Sending TwistedMind2"
            $scp -P $ssh_port TwistedMind2 root@127.0.0.1:/
            log "Waiting for disks..."
            $ssh -p $ssh_port root@127.0.0.1 'while [[ ! $(ls /dev/rdisk* 2>/dev/null) ]]; do :; done'
            log "Sending dd command for TwistedMind2"
            $ssh -p $ssh_port root@127.0.0.1 "dd if=/TwistedMind2 of=/dev/rdisk0 bs=8192; reboot_bak"
            return
        ;;

        "getversion" )
            device_ramdisk_iosvers
            log "Done. Proceeding to SSH Ramdisk Menu. You may reboot from there or do other stuff if needed."
            pause
        ;;

        "jailbreak" )
            local vers
            local build
            local untether
            device_ramdisk_iosvers
            vers=$device_vers
            build=$device_build
            log "$device_type is on iOS $vers-$build"

            if [[ -n $($ssh -p $ssh_port root@127.0.0.1 "ls /mnt1/bin/bash 2>/dev/null") ]]; then
                case $vers in
                    4.[10]* | 3.[21]* ) $ssh -p $ssh_port root@127.0.0.1 "mkdir -p /mnt1/private/var/db; echo '' > /mnt1/private/var/db/.launchd_use_gmalloc";;
                esac
                log "Mounting data partition"
                $ssh -p $ssh_port root@127.0.0.1 "mount.sh pv"
                warn "Your device seems to be already jailbroken. Cannot continue jailbreaking."
                if [[ $ipsw_openssh == 1 ]]; then
                    log "Will try installing OpenSSH anyway..."
                    device_send_rdtar sshdeb.tar
                    device_send_rdtar openssh.tar gz
                    device_send_rdtar openssl.tar gz
                fi
                log "Rebooting"
                $ssh -p "$ssh_port" root@127.0.0.1 "reboot_bak"
                return
            fi

            case $vers in
                9.3.[56] ) :;;
                9.*  ) untether="everuntether.tar";;
                8.*  ) untether="daibutsu/untether.tar";;
                7.*  ) untether="aquila_7.tar";;
                6.*  ) untether="aquila_6.tar";;
                5.*  ) untether="aquila_5.tar";;
                4.3* ) untether="aquila_4.tar";;
                4.2.[8761] | 4.[10]* | 3.2* | 3.1.3 )
                    untether="greenpois0n/${device_type}_${build}.tar"
                ;;
                4.2* )
                    case $device_type in
                        # untether=1 means no untether package, but the var still needs to be set
                        iPhone3,3 ) untether=1;;
                    esac
                ;;
                3.* ) [[ $device_type == "iPhone2,1" ]] && untether=1;;
                '' )
                    warn "Something wrong happened. Failed to get iOS version."
                    print "* Please reboot the device into normal operating mode, then perform a clean \"slide to power off\", then try again."
                    $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
                    return
                ;;
            esac

            # temporary measure for a6 ios 6
            if [[ $device_proc == 6 ]]; then
                case $vers in
                    6.1.[34] ) untether="p0sixspwn.tar";;
                    6.*      ) untether="evasi0n6-untether.tar";;
                esac
            fi
            # temporary measure for a5 ios 5
            if [[ $device_proc == 5 && $vers == "5."* ]]; then
                untether="g1lbertJB/${device_type}_${build}.tar"
            fi

            # use everuntether+jsc_untether instead of everuntether+dsc haxx for a5(x) 8.0-8.2
            if [[ $device_proc == 5 ]]; then
                case $vers in
                    8.[012]* )
                        ipsw_everuntether=1
                        untether="everuntether.tar"
                    ;;
                esac
            fi

            # untether var must be set by now
            if [[ -z $untether ]]; then
                warn "iOS $vers is not supported for jailbreaking with SSHRD."
                $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
                return
            fi
            log "Nice, iOS $vers is compatible."

            local otherfreeze
            if [[ $device_type == "iPhone2,1" && $vers == "4.3"* ]]; then
                otherfreeze=1
            fi

            if [[ $otherfreeze == 1 && ! -s ../saved/freeze5.tar.gz ]]; then
                file_download https://github.com/LukeZGD/Legacy-iOS-Kit-Keys/releases/download/a/freeze5.tar.gz freeze5.tar.gz 15c92613d4f7e6bbabd9bd3521db8e4baf032265
                mv freeze5.tar.gz ../saved/
            fi

            # skip untether stuff for 3gs 3.x, kernel is patched for those
            if [[ $device_type == "iPhone2,1" && $vers == "3."* ]]; then
                :
            elif [[ $untether != 1 ]]; then
                log "Sending $untether"
                $scp -P $ssh_port $jelbrek/$untether root@127.0.0.1:/mnt1
                case $vers in
                    4.2.[8761] | 4.[10]* | 3.* ) untether="${device_type}_${build}.tar";; # remove folder name after sending tar
                esac

                # temporary measure for a5 ios 5
                if [[ $device_proc == 5 && $vers == "5."* ]]; then
                    untether="${device_type}_${build}.tar"
                fi

                # 3.1.3–4.1 untether must be extracted before data partition mount
                case $vers in
                    4.[10]* | 3.2* | 3.1.3 )
                        log "Extracting $untether"
                        $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
                    ;;
                esac
            fi

            log "Mounting data partition"
            $ssh -p $ssh_port root@127.0.0.1 "mount.sh pv"

            # do stuff
            case $vers in
                [98].* ) device_send_rdtar fstab8.tar;;
                7.*    ) device_send_rdtar fstab7.tar;;
                6.*    ) device_send_rdtar fstab_rw.tar;;
                4.2.[8761] )
                    log "launchd to punchd"
                    $ssh -p $ssh_port root@127.0.0.1 "[[ ! -e /mnt1/sbin/punchd ]] && mv /mnt1/sbin/launchd /mnt1/sbin/punchd"
                ;;
            esac
            case $vers in
                [43].* )
                    log "fstab"
                    local fstab="fstab_new" # disk0s2s1 data
                    if [[ $device_proc == 1 || $device_type == "iPod2,1" ]]; then
                        fstab="fstab_old" # disk0s2 data
                    fi
                    $scp -P $ssh_port $jelbrek/$fstab root@127.0.0.1:/mnt1/private/etc/fstab
                ;;
            esac

            # untether extraction
            case $vers in
                8.* ) # extract now if everuntether, later if daibutsu+dsc haxx
                    if [[ $ipsw_everuntether == 1 ]]; then
                        log "Extracting $untether"
                        $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
                    fi
                ;;
                4.[10]* | 3.* ) :;; # already extracted
                * )
                    if [[ $untether != 1 ]]; then
                        log "Extracting $untether"
                        $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
                    fi
                ;;
            esac

            # bootstrap extraction
            if [[ $otherfreeze == 1 ]]; then
                # 4.3.x 3gs'es have little free space in rootfs. workaround: extract an older strap that takes less space
                cp ../saved/freeze5.tar.gz $jelbrek/
                device_send_rdtar freeze5.tar gz
                rm $jelbrek/freeze5.tar.gz
            else
                device_send_rdtar freeze.tar gz
            fi

            # extras extraction
            if [[ $ipsw_openssh == 1 ]]; then
                device_send_rdtar sshdeb.tar
                device_send_rdtar openssh.tar gz
                device_send_rdtar openssl.tar gz
            fi
            case $vers in
                [543]* ) device_send_rdtar cydiasubstrate.tar;;
            esac
            case $vers in
                9.* ) device_send_rdtar launchctl.tar; device_send_rdtar zebra.tar;;
                3.* ) device_send_rdtar cydiahttpatch.tar;;
            esac
            case $vers in
                [43].* ) :;;
                * ) device_send_rdtar LukeZGD.tar;;
            esac

            # remove patcyh except for ios 8.3+ where it's required
            case $vers in
                9.* | 8.[43]* ) :;;
                * )
                    $ssh -p $ssh_port root@127.0.0.1 "cd /mnt1; rm Library/MobileSubstrate/DynamicLibraries/patcyh* private/lib/dpkg/info/com.saurik.patcyh* usr/lib/libpatcyh.dylib"
                    device_send_rdtar nopatcyh.tar
                ;;
            esac

            # final setup for ios 8.x daibutsu, and/or reboot
            if [[ $vers == "8."* && $ipsw_everuntether != 1 ]] || [[ $vers == "7."* ]]; then
                log "Sending daibutsu/move.sh"
                $scp -P $ssh_port $jelbrek/daibutsu/move.sh root@127.0.0.1:/mnt1
                log "Moving files"
                $ssh -p $ssh_port root@127.0.0.1 "bash /mnt1/move.sh $vers; rm /mnt1/move.sh"

                if [[ $vers == "7."* ]]; then
                    log "Rebooting"
                    $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
                else
                    untether="untether.tar"
                    log "Extracting $untether"
                    $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
                    log "Running haxx_overwrite --${device_type}_${build}"
                    $ssh -p $ssh_port root@127.0.0.1 "/usr/bin/haxx_overwrite --${device_type}_${build}"
                fi

            else
                log "Rebooting"
                $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
            fi

            log "Cool, done and jailbroken (hopefully)"
            return
        ;;

        "clearnvram" )
            log "Sending commands for clearing NVRAM..."
            $ssh -p $ssh_port root@127.0.0.1 "nvram -c; reboot_bak"
            log "Done. Your device should reboot now"
            return
        ;;

        "setnvram" )
            device_ramdisk_setnvram
            $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
            log "Done. Your device should reboot now"
            return
        ;;

        * ) log "Device should now boot to SSH ramdisk mode.";;
    esac

    echo
    print "* Mount filesystems with this command:"
    print "    mount.sh"
    print "* For more details, go to: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/SSH-Ramdisk"

    menu_ramdisk
}

device_ramdisk_setnvram() {
    log "Sending commands for setting NVRAM variables..."
    $ssh -p $ssh_port root@127.0.0.1 "nvram -c; nvram boot-partition=$rec"
    if [[ $rec == 2 ]]; then
        case $device_type in
            iPad1,1 | iPhone3,1 | iPod3,1 )
                if [[ $device_type != "iPhone3,1" ]]; then
                    device_ramdisk_iosvers
                    if [[ $device_vers == "3"* ]]; then
                        device_ramdisk_ios3exploit
                    fi
                fi
            ;;
            * ) $ssh -p $ssh_port root@127.0.0.1 "nvram boot-ramdisk=/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/0/1/2/3/4/5/6/7/8/9/A/B/C/disk.dmg";;
        esac
    elif [[ $device_type == "iPad1,1" ]]; then
        device_ramdisk_iosvers
        if [[ $device_vers == "3"* && -n $($ssh -p $ssh_port root@127.0.0.1 "ls /mnt1/bin/bash 2>/dev/null") ]]; then
            untether="${device_type}_${device_build}.tar"
            log "Sending $untether"
            $scp -P $ssh_port $jelbrek/greenpois0n/$untether root@127.0.0.1:/mnt1
            log "Extracting $untether"
            $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
        fi
    fi
    log "Done"
}

device_ramdisk_ios3exploit() {
    log "iOS 3.x detected, running exploit commands"
    local fdisk_out="$($ssh -p $ssh_port [email protected] "fdisk /dev/rdisk0")"
    echo "$fdisk_out"
    local offset="$(echo "$fdisk_out" | grep AF | head -1)"
    offset="${offset##*-}"
    offset="$(echo ${offset%]*} | tr -d ' ')"
    offset=$((offset+63))
    local sector_size="$(echo "$fdisk_out" | grep "Sector size" | awk '{print $3}')"
    local partition_size=$((65536/sector_size))
    log "Got offset $offset"
    log "Got sector size $sector_size. Partition size will be $partition_size"
    $ssh -p $ssh_port root@127.0.0.1 "echo -e 'e 3\nAF\n\n${offset}\n${partition_size}\nw\ny\nq\n' | fdisk -e /dev/rdisk0"
    echo
    log "Writing exploit ramdisk"
    $scp -P $ssh_port ../resources/firmware/src/target/$device_model/9B206/exploit root@127.0.0.1:/
    $ssh -p $ssh_port root@127.0.0.1 "dd of=/dev/rdisk0s3 if=/exploit bs=64k count=1"
    if [[ $device_type == "iPad1,1" ]]; then
        $scp -P $ssh_port ../saved/iPad1,1/iBoot3_$device_ecid root@127.0.0.1:/mnt1/iBEC
    fi
    if [[ -n $($ssh -p $ssh_port root@127.0.0.1 "ls /mnt1/bin/bash 2>/dev/null") ]]; then
        log "fstab"
        $scp -P $ssh_port $jelbrek/fstab_new root@127.0.0.1:/mnt1/private/etc/fstab
        untether="${device_type}_${device_build}.tar"
        log "Sending $untether"
        $scp -P $ssh_port $jelbrek/greenpois0n/$untether root@127.0.0.1:/mnt1
        log "Extracting $untether"
        $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
    fi
    log "Fixing autoboot"
    $ssh -p $ssh_port root@127.0.0.1 "nvram auto-boot=1"
}

device_datetime_cmd() {
    log "Running command to Update DateTime"
    $ssh -p $ssh_port root@127.0.0.1 "date -s @$(date +%s)"
    if [[ $1 != "nopause" ]]; then
        log "Done"
        pause
    fi
}

device_ramdisk_iosvers() {
    device_vers=
    device_build=
    device_datetime_cmd nopause
    if (( device_proc < 7 )); then
        log "Mounting root filesystem"
        $ssh -p $ssh_port root@127.0.0.1 "mount.sh root"
        sleep 1
    fi
    log "Getting iOS version"
    $scp -P $ssh_port root@127.0.0.1:/mnt1/System/Library/CoreServices/SystemVersion.plist .
    if [[ $platform == "macos" ]]; then
        rm -f BuildVer Version
        plutil -extract 'ProductVersion' xml1 SystemVersion.plist -o Version
        device_vers=$(cat Version | sed -ne '/<string>/,/<\/string>/p' | sed -e "s/<string>//" | sed "s/<\/string>//" | sed '2d')
        plutil -extract 'ProductBuildVersion' xml1 SystemVersion.plist -o BuildVer
        device_build=$(cat BuildVer | sed -ne '/<string>/,/<\/string>/p' | sed -e "s/<string>//" | sed "s/<\/string>//" | sed '2d')
    else
        device_vers=$(cat SystemVersion.plist | grep -i ProductVersion -A 1 | grep -oPm1 "(?<=<string>)[^<]+")
        device_build=$(cat SystemVersion.plist | grep -i ProductBuildVersion -A 1 | grep -oPm1 "(?<=<string>)[^<]+")
    fi
    if [[ -n $device_vers ]]; then
        log "Retrieved the current iOS version"
        print "* iOS Version: $device_vers ($device_build)"
    else
        warn "Something wrong happened. Failed to get iOS version."
    fi
}

menu_ramdisk() {
    local loop
    local menu_items=("Connect to SSH")
    local reboot="reboot_bak"
    if (( device_proc >= 7 )); then
        reboot="/sbin/reboot"
    else
        menu_items+=("Dump Baseband/Activation")
    fi
    if [[ $1 == "18C66" ]]; then
        menu_items+=("Install TrollStore")
    elif [[ $device_proc == 7 && $device_ramdisk_ios8 == 1 ]]; then
        log "Ramdisk should now boot and fix iOS 7 not booting."
    fi
    if [[ $device_ramdisk_ios8 != 1 ]]; then
        menu_items+=("Dump Blobs")
        if (( device_proc <= 8 )); then
            menu_items+=("Erase All (iOS 7 and 8)")
        fi
        if (( device_proc >= 5 )); then
            menu_items+=("Erase All (iOS 9+)")
        fi
        if [[ $device_canpowder == 1 ]]; then
            menu_items+=("Disable/Enable Exploit")
        fi
        if (( device_proc >= 7 )) && [[ $device_proc != 10 ]]; then
            menu_items+=("Install Bootstrap (iOS 7/8/9)")
        fi
        if [[ $device_proc == 7 ]]; then
            menu_items+=("Install Untether (iOS 7)")
        fi
        menu_items+=("Install OpenSSH (iOS 10 and lower)" "Clear NVRAM" "Get iOS Version" "Update DateTime")
    fi
    menu_items+=("Reboot Device" "Exit")

    print "* For accessing data, note the following:"
    print "* Host: sftp://127.0.0.1 | User: root | Password: alpine | Port: $ssh_port"
    echo
    print "* Other Useful SSH Ramdisk commands:"
    print "* Clear NVRAM with this command:"
    print "    nvram -c"
    print "* Erase All Content and Settings with this command (iOS 9+ only):"
    print "    nvram oblit-inprogress=5"
    print "* To reboot, use this command:"
    print "    $reboot"
    echo

    while [[ $loop != 1 ]]; do
        mode=
        print "* SSH Ramdisk Menu"
        while [[ -z $mode ]]; do
            input "Select an option:"
            select_option "${menu_items[@]}"
            selected="${menu_items[$?]}"
            case $selected in
                "Connect to SSH" ) mode="ssh";;
                "Reboot Device" ) mode="reboot";;
                "Dump Blobs" ) mode="dump-blobs";;
                "Get iOS Version" ) mode="iosvers";;
                "Dump Baseband/Activation" ) mode="dump-bbactrec";;
                "Install TrollStore" ) mode="trollstore";;
                "Erase All (iOS 7 and 8)" ) mode="erase78";;
                "Erase All (iOS 9+)" ) mode="erase9";;
                "Clear NVRAM" ) mode="clearnvram";;
                "Disable/Enable Exploit" ) menu_remove4;;
                "Update DateTime" ) mode="datetime";;
                "Install Bootstrap (iOS 7/8/9)" ) mode="bootstrap";;
                "Install Untether (iOS 7)" ) mode="untether7";;
                "Install OpenSSH (iOS 10 and lower)" ) mode="openssh";;
                "Exit" ) mode="exit";;
            esac
        done

        case $mode in
            "ssh" )
                log "Use the \"exit\" command to go back to SSH Ramdisk Menu"
                if [[ $device_ramdisk_ios8 == 1 ]]; then
                    $ssh -p $ssh_port root@127.0.0.1 &
                    ssh_pid=$!
                    sleep 1
                    kill $ssh_pid
                fi
                $ssh -p $ssh_port root@127.0.0.1
            ;;
            "reboot" ) $ssh -p $ssh_port root@127.0.0.1 "$reboot"; loop=1;;
            "exit" ) loop=1;;
            "dump-blobs" )
                local shsh="../saved/shsh/$device_ecid-$device_type-$(date +%Y-%m-%d-%H%M).shsh2"
                if (( device_proc < 7 )); then
                    warn "This is the wrong place to dump onboard blobs for 32-bit devices."
                    print "* Reboot your device, run the script again and go to Save SHSH Blobs -> Onboard Blobs"
                    print "* For more details, go to: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Saving-onboard-SHSH-blobs-of-current-iOS-version"
                    pause
                    continue
                fi
                log "Attempting to dump blobs"
                $ssh -p $ssh_port root@127.0.0.1 "cat /dev/rdisk1" | dd of=dump.raw bs=256 count=$((0x4000))
                if [[ ! -s dump.raw ]]; then
                    warn "Dumping rdisk1 failed, cannot continue."
                    continue
                fi
                "$dir/img4tool" --convert -s $shsh dump.raw
                if [[ -s $shsh ]]; then
                    log "Onboard blobs should be dumped to $shsh"
                    continue
                fi
                warn "Failed to convert raw dump to SHSH."
                local raw="../saved/shsh/rawdump_${device_ecid}-${device_type}_$(date +%Y-%m-%d-%H%M).raw"
                mv dump.raw $raw
                log "Raw dump saved at: $raw"
                warn "This raw dump is not usable for restoring, you need to convert it first."
                print "* If unable to be converted, this dump is likely not usable for restoring."
            ;;
            "iosvers" )
                if (( device_proc >= 7 )); then
                    print "* Unfortunately the mount command needs to be done manually for 64-bit devices."
                    print "* The mount command also changes depending on the iOS version (which is what we're trying to get here in the first place)"
                    print "* You need to mount filesystems using the appropriate command before continuing (scroll up to see the commands)"
                    warn "Make sure that you know what you are doing when using this option on 64-bit devices."
                    select_yesno
                    if [[ $? != 1 ]]; then
                        continue
                    fi
                fi
                device_ramdisk_iosvers
            ;;
            "dump-bbactrec" ) device_dumprd;;
            "trollstore" )
                print "* Make sure that your device is on iOS 14 or 15 before continuing, and have the Tips app installed."
                print "* If your device is on iOS 13 or below, TrollStore will NOT work."
                select_yesno
                if [[ $? != 1 ]]; then
                    continue
                fi
                log "Checking for latest TrollStore"
                download_from_url "https://api.github.com/repos/opa334/TrollStore/releases/latest" latest
                local latest="$(cat latest | $jq -r ".tag_name")"
                local current="$(cat ../saved/TrollStore_version 2>/dev/null || echo "none")"
                log "Latest version: $latest, current version: $current"
                if [[ $current != "$latest" ]]; then
                    rm -f ../saved/TrollStore.tar ../saved/PersistenceHelper_Embedded
                fi
                if [[ -s ../saved/TrollStore.tar && -s ../saved/PersistenceHelper_Embedded ]]; then
                    cp ../saved/TrollStore.tar ../saved/PersistenceHelper_Embedded .
                else
                    rm -f ../saved/TrollStore.tar ../saved/PersistenceHelper_Embedded
                    log "Downloading files for latest TrollStore"
                    file_download https://github.com/opa334/TrollStore/releases/download/$latest/PersistenceHelper_Embedded PersistenceHelper_Embedded
                    file_download https://github.com/opa334/TrollStore/releases/download/$latest/TrollStore.tar TrollStore.tar
                    mv TrollStore.tar PersistenceHelper_Embedded ../saved
                    echo "$latest" > ../saved/TrollStore_version
                fi
                tar -xf TrollStore.tar
                log "Installing TrollStore to Tips"
                $ssh -p $ssh_port root@127.0.0.1 "mount_filesystems"
                local tips="$($ssh -p $ssh_port [email protected] "find /mnt2/containers/Bundle/Application/ -name \"Tips.app\"")"
                $scp -P $ssh_port PersistenceHelper_Embedded TrollStore.app/trollstorehelper ../resources/sshrd/trollstore.sh root@127.0.0.1:$tips
                rm -r PersistenceHelper_Embedded TrollStore*
                $ssh -p $ssh_port root@127.0.0.1 "bash $tips/trollstore.sh; rm $tips/trollstore.sh"
                log "Done!"
            ;;
            "erase78" )
                log "Please read the message below:"
                warn "This will do a \"Erase All Content and Settings\" procedure for iOS 7 and 8 devices."
                warn "Do NOT do this if your device is jailbroken untethered!!!"
                print "* This procedure will do step 6 of this tutorial: https://reddit.com/r/LegacyJailbreak/comments/13of20g/tutorial_new_restoringerasingwipingrescuing_a/"
                print "* Note that it may also be better to do this process manually instead by following the commands in the tutorial."
                print "* For iOS 8 devices, also remove this file if you will be doing it manually: /mnt2/mobile/Library/SpringBoard/LockoutStateJournal.plist"
                if (( device_proc >= 7 )); then
                    print "* If your device is on iOS 7, make sure to boot an iOS 8 ramdisk afterwards to fix booting."
                fi
                print "* When the device boots back up, trigger a restore by entering wrong passwords 10 times."
                select_yesno
                if [[ $? != 1 ]]; then
                    continue
                fi
                $ssh -p $ssh_port root@127.0.0.1 "/sbin/mount_hfs /dev/disk0s1s1 /mnt1; /sbin/mount_hfs /dev/disk0s1s2 /mnt2; cp /com.apple.springboard.plist /mnt1/"
                $ssh -p $ssh_port root@127.0.0.1 "cd /mnt2/mobile/Library/Preferences; mv com.apple.springboard.plist com.apple.springboard.plist.bak; ln -s /com.apple.springboard.plist ./com.apple.springboard.plist"
                $ssh -p $ssh_port root@127.0.0.1 "rm /mnt2/mobile/Library/SpringBoard/LockoutStateJournal.plist"
                $ssh -p $ssh_port root@127.0.0.1 "sync; cd /; /sbin/umount /mnt2; /sbin/umount /mnt1; sync; /sbin/reboot"
                log "Done. Your device should reboot now"
                print "* Proceed to trigger a restore by entering wrong passwords 10 times."
                loop=1
            ;;
            "clearnvram" )
                log "Sending command for clearing NVRAM..."
                $ssh -p $ssh_port root@127.0.0.1 "/usr/sbin/nvram -c"
                log "Done"
            ;;
            "erase9" )
                warn "This will do a \"Erase All Content and Settings\" procedure for iOS 9+ devices."
                warn "Do NOT do this if your device is jailbroken untethered!!! (mostly iOS 9.3.4/9.1 and lower)"
                select_yesno
                if [[ $? != 1 ]]; then
                    continue
                fi
                log "Sending command for erasing all content and settings..."
                $ssh -p $ssh_port root@127.0.0.1 "/usr/sbin/nvram oblit-inprogress=5"
                log "Done. Reboot to apply changes, or clear NVRAM now to cancel erase"
            ;;
            "remove4" ) device_ramdisk_setnvram;;
            "datetime" ) device_datetime_cmd;;
            "bootstrap" )
                log "Please read the message below:"
                warn "This will install the jailbreak bootstrap with Cydia installed to your device."
                warn "Do NOT continue if your device is not a 64-bit device on iOS 7/8/9! Also do this at your own risk."
                warn "You might also need your device to be freshly restored/erased and never booted for this to work."
                print "* This procedure will do the commands in this post: https://www.reddit.com/r/LegacyJailbreak/comments/1jwo0gr/tutorial_manually_install_bootstrap_to_64bit/"
                select_yesno
                if [[ $? != 1 ]]; then
                    continue
                fi
                $ssh -p $ssh_port root@127.0.0.1 "/sbin/mount_hfs /dev/disk0s1s1 /mnt1; /sbin/mount_hfs /dev/disk0s1s2 /mnt2"
                device_ramdisk_iosvers
                case $device_vers in
                    [789].* ) :;;
                    * )
                        log "iOS version does not seem to be in the supported range. Cannot continue."
                        continue
                    ;;
                esac
                cp $jelbrek/freeze.tar.gz .
                gzip -d freeze.tar.gz
                cat freeze.tar | $ssh -p $ssh_port root@127.0.0.1 "cd /mnt1; tar -xvf - -C .; mv private/var/lib private"
                if [[ $device_vers == "9"* ]]; then
                    cat $jelbrek/launchctl.tar | $ssh -p $ssh_port root@127.0.0.1 "tar -xvf - -C /mnt1"
                fi
                cp $jelbrek/openssh.tar.gz $jelbrek/openssl.tar.gz .
                gzip -d openssh.tar.gz
                gzip -d openssl.tar.gz
                cat openssh.tar | $ssh -p $ssh_port root@127.0.0.1 "tar -xf - -C /mnt1"
                cat openssl.tar | $ssh -p $ssh_port root@127.0.0.1 "tar -xf - -C /mnt1"
                case $device_vers in
                    9.3.[45] ) :;;
                    9.[23]*  ) $scp -P $ssh_port $jelbrek/io.pangu93.loader.plist root@127.0.0.1:/mnt1/Library/LaunchDaemons;;
                    7.* | 8.[012]* ) # remove patcyh
                        $ssh -p $ssh_port root@127.0.0.1 "cd /mnt1; rm Library/MobileSubstrate/DynamicLibraries/patcyh* private/lib/dpkg/info/com.saurik.patcyh* usr/lib/libpatcyh.dylib"
                        cat $jelbrek/nopatcyh.tar | $ssh -p $ssh_port root@127.0.0.1 "cd /mnt1; tar -xvf - -C .; mv private/var/lib/dpkg/* private/lib/dpkg"
                    ;;
                esac
                $ssh -p $ssh_port root@127.0.0.1 "cd /mnt1; mv private/var/mobile/Library/Preferences/com.apple.springboard.plist private; rm -r private/var/*; touch .cydia_no_stash"
                $ssh -p $ssh_port root@127.0.0.1 "cd /mnt2; ln -s /private/lib; cd mobile/Library/Preferences; rm -f com.apple.springboard.plist; ln -s /private/com.apple.springboard.plist; /usr/sbin/chown 501:501 com.apple.springboard.plist"
                log "Installing bootstrap done."
                if [[ $device_proc == 7 ]]; then
                    print "* If your device is on iOS 7, proceed to Install Untether next."
                fi
            ;;
            "untether7" )
                log "Please read the message below:"
                warn "This will install the iOS 7 untether for your device and iOS version. Make sure that bootstrap is already installed."
                warn "Do NOT continue if your device is not on iOS 7! Also do this at your own risk."
                select_yesno
                if [[ $? != 1 ]]; then
                    continue
                fi
                $ssh -p $ssh_port root@127.0.0.1 "/sbin/mount_hfs /dev/disk0s1s1 /mnt1"
                device_ramdisk_iosvers
                if [[ $device_vers != "7."* ]]; then
                    log "iOS version does not seem to be in the supported range. Cannot continue."
                    continue
                fi
                local untether
                case $device_vers in
                    "7.1"* ) untether="panguaxe.tar";;
                    "7.0"  ) untether="evasi0n7-untether-70.tar";;
                    "7.0"* ) untether="evasi0n7-untether.tar";;
                esac
                cat $jelbrek/$untether | $ssh -p $ssh_port root@127.0.0.1 "tar -xf - -C /mnt1"
                input "Stashing to free up space on system partition"
                print "* When enabled, Cydia will move some components to the data partition on its first run."
                print "* This frees up more space for installing tweaks."
                print "* However, this option can be unstable and lead to bootloop issues."
                print "* This option is disabled by default (N). Disable this option if unsure."
                select_yesno "Enable this option?" 0
                if [[ $? != 0 ]]; then
                    log "Stashing option enabled by user."
                    $ssh -p $ssh_port root@127.0.0.1 "cd /mnt1; rm .cydia_no_stash"
                else
                    log "Stashing disabled."
                fi
            ;;
            "openssh" )
                log "Please read the message below:"
                warn "This will install files for OpenSSH to your device. Make sure that your device is jailbroken, and filesystems are already mounted."
                warn "Do NOT continue if your device is not jailbroken. Also do this at your own risk."
                select_yesno
                if [[ $? != 1 ]]; then
                    continue
                fi
                if (( device_proc < 7 )); then
                    device_ramdisk_iosvers
                    $ssh -p $ssh_port root@127.0.0.1 "mount.sh pv"
                fi
                cp $jelbrek/openssh.tar.gz $jelbrek/openssl.tar.gz .
                gzip -d openssh.tar.gz
                gzip -d openssl.tar.gz
                cat openssh.tar | $ssh -p $ssh_port root@127.0.0.1 "tar -xf - -C /mnt1"
                cat openssl.tar | $ssh -p $ssh_port root@127.0.0.1 "tar -xf - -C /mnt1"
                if (( device_proc < 7 )); then
                    cat $jelbrek/sshdeb.tar | $ssh -p $ssh_port root@127.0.0.1 "tar -xf - -C /mnt1"
                fi
                log "Done."
            ;;
        esac
    done
}

shsh_save_onboard64() {
    if [[ $device_latest_vers != "16"* && $device_checkm8ipad != 1 ]]; then
        print "* There are other ways for dumping onboard blobs for 64-bit devices as listed below:"
        print "* It is recommended to use SSH Ramdisk option to dump onboard blobs instead: Useful Utilities -> SSH Ramdisk"
        print "* For A8 and newer, you can also use SSHRD_Script: https://github.com/verygenericname/SSHRD_Script"
        select_yesno
        if [[ $? != 1 ]]; then
            return 1
        fi
    elif (( device_vers_maj >= 16 )); then
        print "* Make sure to have the following installed for Cryptex:"
        print "    libkrw0 1.1.2, libkrw0-tfp0 1.1.2, libx8a4-1, x8A4"
        print "* You may install these from this repo: https://lukezgd.github.io/x8a4"
        print "* You may also install debs from here: https://github.com/Cryptiiiic/x8A4/releases"
    fi
    echo
    if [[ $device_mode != "Normal" ]]; then
        warn "Device must be in normal mode and jailbroken, cannot continue."
        print "* Use the SSH Ramdisk option instead: Useful Utilities -> SSH Ramdisk"
        print "* For A8 and newer, you can also use SSHRD_Script: https://github.com/verygenericname/SSHRD_Script"
        return
    fi
    log "Proceeding to dump onboard blobs on normal mode"
    device_iproxy
    device_ssh_message
    device_sshpass
    local shsh="../saved/shsh/$device_ecid-$device_type-$device_vers-$device_build.shsh2"
    local shsh2
    local disk
    if [[ $ssh_user == "mobile" ]]; then
        disk="echo '$SSHPASS' | sudo -S "
    fi
    if (( device_vers_maj >= 16 )); then
        shsh2="$shsh"
        shsh="temp.shsh2"
        disk+="cat /dev/disk2"
    else
        disk+="cat /dev/disk1"
    fi
    $ssh -p $ssh_port ${ssh_user}@127.0.0.1 "$disk" | dd of=dump.raw bs=256 count=$((0x4000))
    "$dir/img4tool" --convert -s $shsh dump.raw
    if [[ -s $shsh && -n $shsh2 ]]; then
        log "Grabbing Cryptex APTicket"
        $ssh -p $ssh_port ${ssh_user}@127.0.0.1 "cat /private/preboot/cryptex1/current/apticket*" > apticket.im4m
        log "Getting Cryptex seed using x8A4"
        local seed="$($ssh -p $ssh_port ${ssh_user}@127.0.0.1 "echo '$SSHPASS' | sudo -S x8A4 -x | grep 0x | cut -c 19- | cut -c -34")"
        echo
        if [[ -z $seed ]]; then
            error "Failed to get Cryptex seed. Make sure x8A4 and dependencies are installed."
        fi
        cat $shsh | sed '$d' | sed '$d' > temp2.shsh2
        echo -e "<key>cryptexTicket</key><dict>\n<key>Cryptex1,Ticket</key><data>" >> temp2.shsh2
        cat apticket.im4m | base64 >> temp2.shsh2
        echo -e "</data></dict>\n<key>cryptexSeed</key>\n<string>$seed</string>\n</dict></plist>" >> temp2.shsh2
        shsh="$shsh2"
        mv temp2.shsh2 $shsh
    elif [[ ! -s $shsh ]]; then
        warn "Failed to convert raw dump to SHSH."
        if [[ -s dump.raw ]]; then
            local raw="../saved/shsh/rawdump_${device_ecid}-${device_type}-${device_vers}-${device_build}_$(date +%Y-%m-%d-%H%M).raw"
            mv dump.raw $raw
            log "Raw dump saved at: $raw"
            warn "This raw dump is not usable for restoring, you need to convert it first."
            print "* If unable to be converted, this dump is likely not usable for restoring."
        fi
        if [[ $device_latest_vers == "16"* || $device_checkm8ipad == 1 ]]; then
            error "Saving onboard SHSH blobs failed. Make sure to have OpenSSH installed."
        else
            error "Saving onboard SHSH blobs failed. Make sure to have OpenSSH installed." \
                  "* It is recommended to dump onboard SHSH blobs on SSH Ramdisk instead."
        fi
    fi
    log "Successfully saved $device_vers blobs: $shsh"
    kill $iproxy_pid
}

shsh_save_onboard() {
    if (( device_proc >= 7 )); then
        shsh_save_onboard64
        [[ $? == 0 ]] && pause
        return
    else
        device_buttons
    fi
    if [[ $device_proc == 4 && $device_pwnrec != 1 ]]; then
        patch_ibss
        log "Sending iBSS..."
        $irecovery -f pwnediBSS.dfu
    fi
    sleep 1
    patch_ibec
    log "Sending iBEC..."
    $irecovery -f pwnediBEC.dfu
    if [[ $device_pwnrec == 1 ]]; then
        $irecovery -c "go"
    fi
    device_find_mode Recovery
    log "Dumping raw dump now"
    (echo -e "/send ../resources/payload\ngo blobs\n/exit") | $irecovery2 -s
    $irecovery2 -g dump.raw
    log "Rebooting device"
    $irecovery -n
    local raw
    local err
    shsh_convert_onboard $1
    err=$?
    if [[ $1 == "dump" ]]; then
        raw="../saved/shsh/rawdump_${device_ecid}-${device_type}_$(date +%Y-%m-%d-%H%M)_${shsh_onboard_iboot}.raw"
    else
        raw="../saved/shsh/rawdump_${device_ecid}-${device_type}-${device_target_vers}-${device_target_build}_$(date +%Y-%m-%d-%H%M)_${shsh_onboard_iboot}.raw"
    fi
    if [[ $1 == "dump" ]] || [[ $err != 0 && -s dump.raw ]]; then
        mv dump.raw $raw
        log "Raw dump saved at: $raw"
        warn "This raw dump is not usable for restoring, you need to convert it first."
        print "* If unable to be converted, this dump is likely not usable for restoring."
        print "* For the IPSW to download and use, see the raw dump iBoot version above"
        print "* Then go here to find the matching iOS version: https://theapplewiki.com/wiki/IBoot_(Bootloader)"
    fi
}

shsh_convert_onboard() {
    local shsh="../saved/shsh/${device_ecid}-${device_type}_$(date +%Y-%m-%d-%H%M).shsh"
    if (( device_proc < 7 )); then
        shsh="../saved/shsh/${device_ecid}-${device_type}-${device_target_vers}-${device_target_build}.shsh"
        # remove ibob for powdersn0w/dra downgraded devices. fixes unknown magic 69626f62
        local blob=$(xxd -p dump.raw | tr -d '\n')
        local bobi="626f6269"
        local blli="626c6c69"
        if [[ $blob == *"$bobi"* ]]; then
            log "Detected \"ibob\". Fixing... (This happens on DRA/powdersn0w downgraded devices)"
            rm -f dump.raw
            printf "%s" "${blob%"$bobi"*}${blli}${blob##*"$blli"}" | xxd -r -p > dump.raw
        fi
        shsh_onboard_iboot="$(cat dump.raw | strings | grep iBoot | head -1)"
        log "Raw dump iBoot version: $shsh_onboard_iboot"
        if [[ $1 == "dump" ]]; then
            return
        fi
        log "Converting raw dump to SHSH blob"
        "$dir/ticket" dump.raw dump.shsh "$ipsw_path.ipsw" -z
        log "Attempting to validate SHSH blob"
        "$dir/validate" dump.shsh "$ipsw_path.ipsw" -z
        if [[ $? != 0 ]]; then
            warn "Saved SHSH blobs might be invalid. Did you select the correct IPSW?"
            print "* If you selected the correct IPSW and the error is not APTicket and/or LLB, the blob is most likely usable."
        fi
    else
        "$dir/img4tool" --convert -s dump.shsh dump.raw
    fi
    if [[ ! -s dump.shsh ]]; then
        warn "Converting onboard SHSH blobs failed."
        return 1
    fi
    mv dump.shsh $shsh
    log "Successfully saved $device_target_vers blobs: $shsh"
}

shsh_save_cydia() {
    download_from_url "https://api.ipsw.me/v4/device/${device_type}?type=ipsw" tmp.json
    local json=$(cat tmp.json)
    local len=$(echo "$json" | $jq -r ".firmwares | length")
    local builds=()
    local i=0
    while (( i < len )); do
        builds+=($(echo "$json" | $jq -r ".firmwares[$i].buildid"))
        ((i++))
    done
    for build in ${builds[@]}; do
        if [[ $build == "10"* && $build != "10B329" && $build != "10B350" ]]; then
            continue
        fi
        printf "\n%s " "$build"
        $tsschecker -d $device_type -e $device_ecid --server-url "http://cydia.saurik.com/TSS/controller?action=2/" -s -g 0x1111111111111111 --buildid $build >/dev/null
        if [[ $(ls *$build* 2>/dev/null) ]]; then
            printf "saved"
            mv $(ls *$build*) ../saved/shsh/$device_ecid-$device_type-$build.shsh
        else
            printf "failed"
        fi
    done
    echo
}

menu_print_info() {
    if [[ $debug_mode != 1 ]]; then
        clear
    fi
    print " *** Legacy iOS Kit ***"
    print " - Script by LukeZGD -"
    echo
    if [[ -n $version_current ]]; then
        print "* Version: $version_current ($git_hash)"
    fi
    if [[ $no_internet_check == 1 ]]; then
        warn "No internet check flag detected, check is disabled and no support will be provided."
    fi
    if [[ $no_version_check == 1 ]]; then
        warn "No version check flag detected, check is disabled and no support will be provided."
    fi
    if [[ $EUID == 0 && $run_as_root == 1 ]]; then
        warn "Script is running as root. This is not supported, proceed with caution."
    fi
    if [[ $git_hash_latest != "$git_hash" ]]; then
        warn "Current version is newer/different than remote: $version_latest ($git_hash_latest)"
    fi
    print "* Platform: $platform ($platform_ver - $platform_arch) $live_session_str"
    if [[ $platform == "macos" && $platform_arch == "arm64" ]]; then
        if (( mac_majver == 12 && mac_minver < 6 )) || (( mac_majver < 12 )); then
            warn "Updating to macOS 12.6 or newer is recommended for Apple Silicon Macs."
        fi
    fi
    echo
    if [[ $device_argmode == "entry" ]]; then
        warn "Device type and/or ECID manually specified"
    fi
    print "* Device: $device_name (${device_type} - ${device_model}ap) in $device_mode mode"
    device_manufacturing
    if [[ $device_unactivated == 1 ]]; then
        print "* Device is not activated, select Attempt Activation to activate."
    fi
    if [[ $device_disable_actrec == 1 ]]; then
        warn "disable-actrec flag detected, activation dumping/stitching disabled. Proceed with caution"
    fi
    if [[ $device_type == "$device_disable_bbupdate" && $device_use_bb != 0 ]] && (( device_proc < 7 )); then
        if [[ $device_deadbb == 1 ]]; then
            warn "dead-bb flag detected, baseband flashing disabled. Your device will not activate after restore"
        else
            warn "disable-bbupdate flag detected, baseband stitching enabled. Proceed with caution"
            print "* Current device baseband will be dumped and stitched to custom IPSW"
            warn "Note that stitching baseband does not always work! There is a chance of non-working baseband after the restore"
        fi
    elif [[ -n $device_disable_bbupdate ]]; then
        warn "disable-bbupdate flag detected, but this flag is not supported for this device"
    fi
    if [[ -n $device_disable_bbupdate ]]; then
        print "* For more details, go to: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Baseband-Update"
    fi
    if [[ $ipsw_jailbreak == 1 ]] && (( device_proc < 7 )); then
        warn "Jailbreak flag detected. Jailbreak option enabled."
    fi
    if [[ $device_proc != 1 ]] && (( device_proc < 7 )); then
        case $device_proc in
            [56] )
                if [[ $device_imei == "9900"* ]]; then
                    warn "Your device's IMEI starts with 9900. These devices are affected by an activation issue."
                elif [[ $device_9900candidate == 1 && $device_mode == "Normal" && -n $device_imei ]]; then
                    print "* Your device's IMEI does not start with 9900. Your device should be safe from the activation issue."
                elif [[ $device_9900candidate == 1 && $device_mode != "Normal" ]]; then
                    warn "Your device is possibly affected by an activation issue. Please check your device's IMEI."
                    print "* If it starts with 9900, enable Activation Records stitching in Misc Utilities"
                elif [[ $device_type == "iPad3,3" ]]; then
                    warn "Your device is an iPad3,3. These devices are affected by an activation issue."
                    [[ $device_unactivated != 2 ]] && print "* If you haven't already, dump activation by selecting Activation Records in Misc Utilities"
                fi
            ;;
        esac
        if [[ $device_auto_actrec == 1 ]]; then
            print "* Activated A${device_proc}(X) device with 9900 IMEI detected. Activation Records stitching enabled."
        elif [[ $device_auto_actrec == 2 ]]; then
            print "* Existing activation records detected. Activation Records stitching enabled."
        elif [[ $device_auto_actrec == 3 ]]; then
            print "* Activated iPad3,3 detected. Activation Records stitching enabled."
        elif [[ $device_actrec == 1 ]]; then
            warn "activation-records flag detected. Activation Records stitching enabled."
        fi
        if [[ $device_pwnrec == 1 ]]; then
            warn "Pwned recovery flag detected. Assuming device is in pwned recovery mode."
        elif [[ $device_skip_ibss == 1 ]]; then
            warn "Skip iBSS flag detected. Assuming device is in pwned iBSS mode."
        fi
        if [[ $ipsw_gasgauge_patch == 1 ]]; then
            warn "gasgauge-patch/multipatch flag detected. multipatch enabled."
        fi
        if [[ $ipsw_skip_first == 1 ]]; then
            warn "skip-first flag detected. Skipping first restore and flashing part 2 IPSW only for powdersn0w 4.2.x and lower"
        fi
    elif (( device_proc >= 7 )) && (( device_proc <= 10 )); then
        if [[ $restore_useskipblob == 1 ]]; then
            warn "skip-blob flag detected. futurerestore will have --skip-blob enabled."
        fi
        if [[ $restore_usedev == 1 ]]; then
            warn "use-dev flag detected. futurerestore dev branch will be used."
        fi
        if [[ $restore_usepwndfu64 == 1 ]]; then
            warn "use-pwndfu flag detected. futurerestore will have --use-pwndfu enabled."
        fi
    fi
    if [[ -n $device_build ]]; then
        print "* iOS Version: $device_vers ($device_build)"
    else
        print "* iOS Version: $device_vers"
    fi
    if [[ $device_proc != 1 && $device_mode == "DFU" ]] && (( device_proc < 7 )); then
        print "* To get iOS version, go to: Misc Utilities -> Get iOS Version"
    fi
    if [[ $device_proc != 1 || $device_type == "iPhone1,2" ]]; then
        print "* ECID: $device_ecid"
    fi
    if [[ -n $device_pwnd ]]; then
        print "* Pwned: $device_pwnd"
    fi
    echo
}

menu_main() {
    local menu_items
    local selected
    local back
    while [[ -z "$mode" ]]; do
        menu_items=()
        menu_print_info
        print " > Main Menu"
        input "Select an option:"
        if [[ $device_mode != "none" ]]; then
            menu_items+=("Restore/Downgrade")
            if (( device_proc < 7 )); then
                menu_items+=("Jailbreak Device")
                if [[ $device_proc != 1 && $device_type != "iPod2,1" ]]; then
                    case $device_mode in
                        "Recovery" | "DFU" ) menu_items+=("Just Boot");;
                    esac
                fi
            fi
            if [[ $device_unactivated == 1 ]]; then
                menu_items+=("Attempt Activation")
            elif [[ $device_mode == "Recovery" ]]; then
                menu_items+=("Exit Recovery Mode")
            elif [[ $device_mode == "WTF" && $debug_mode == 1 ]]; then
                menu_items+=("Enter pwnDFU Mode")
            elif [[ $device_mode == "Normal" ]] && (( device_proc >= 8 )); then
                if (( device_vers_maj == 15 && device_vers_min >= 2 )) || # ios 15.2+
                   (( device_vers_maj == 16 && device_vers_min <= 6 )) || # ios 16.0-16.6.1
                   [[ $device_vers == "17.0" || $device_build == "20H18" ]]; then # ios 17.0 and 16.7 20h18
                    menu_items+=("Install TrollStore")
                fi
            fi
        fi
        if [[ $device_proc != 1 && $device_type != "iPod2,1" ]] && (( device_proc < 11 )); then
            menu_items+=("Save SHSH Blobs")
        fi
        if [[ $device_mode == "Normal" ]]; then
            case $device_vers in
                [12].*  ) :;;
                [126789]* ) menu_items+=("Sideload IPA");;
            esac
            menu_items+=("App Management" "Data Management")
        fi
        if [[ $device_mode != "none" ]]; then
            menu_items+=("Useful Utilities")
        fi
        menu_items+=("Misc Utilities")
        if [[ $device_mode == "Normal" ]] && (( device_vers_maj >= 7 )); then
            menu_items+=("Pair Device")
        fi
        menu_items+=("Exit")
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "Restore/Downgrade" ) menu_restore;;
            "Jailbreak Device" ) device_jailbreak_confirm;;
            "Save SHSH Blobs" ) menu_shsh;;
            "Sideload IPA" ) menu_ipa "$selected";;
            "App Management" ) menu_appmanage;;
            "Data Management" ) menu_datamanage;;
            "Misc Utilities" ) menu_miscutilities;;
            "Useful Utilities" ) menu_usefulutilities;;
            "Attempt Activation" ) device_activate;;
            "Exit Recovery Mode" ) mode="exitrecovery";;
            "Just Boot" ) menu_justboot;;
            "Pair Device" ) device_pair;;
            "Install TrollStore" )
                print "* This option will install TrollStore to your device using TrollRestore."
                print "* This method of installing TrollStore is compatible with iOS 15.2-15.8.x, 16.0-16.6.1, 16.7 RC, and 17.0."
                select_yesno
                if [[ $? != 1 ]]; then
                    continue
                fi
                mode="device_trollrestore"
            ;;
            "Exit" ) mode="exit";;
        esac
    done
}

menu_appmanage() {
    local menu_items
    local selected
    local back

    menu_print_info
    print "* For more info about App Management options, go here: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/App-Management"
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=()
        if [[ $device_unactivated == 1 ]]; then
            warn "Device is not activated. Most App Management options are not available."
        fi
        if (( device_vers_maj >= 5 )); then
            if [[ $device_vers_maj == 10 ]]; then
                [[ $device_unactivated != 1 ]] && menu_items+=("Install IPA (ideviceinstaller)")
                menu_items+=("Install IPA (appinst)")
            else
                menu_items+=("Install IPA (appinst)")
                [[ $device_unactivated != 1 ]] && menu_items+=("Install IPA (ideviceinstaller)")
            fi
        else
            [[ $device_unactivated != 1 ]] && menu_items+=("Install IPA (ideviceinstaller)")
        fi
        if (( device_vers_maj >= 4 )); then
            menu_items+=("Dump App as IPA" "Dump All Apps as IPA")
        fi
        [[ $device_unactivated != 1 ]] && menu_items+=("List User Apps" "List System Apps" "List All Apps")
        menu_items+=("Go Back")
        print " > Main Menu > App Management"
        input "Select an option:"
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "Install IPA"*          ) menu_ipa "$selected";;
            "Dump App as IPA"       ) device_dumpapp;;
            "Dump All Apps as IPA"  ) device_dumpapp all;;
            "List User Apps"        ) device_pair; $ideviceinstaller list --user;;
            "List System Apps"      ) device_pair; $ideviceinstaller list --system;;
            "List All Apps"         ) device_pair; $ideviceinstaller list --all;;
            "Go Back" ) back=1;;
        esac
    done
}

menu_datamanage() {
    local menu_items=("Connect to SSH")
    local selected
    local back

    menu_print_info
    print "* For more info about Data Management options, go here: https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/Data-Management"
    if [[ -z $sshfs ]]; then
        warn "sshfs not installed. Mount Device options are not available. Install sshfs from your package manager to fix this"
        [[ $platform == "macos" ]] && print "* On macOS, install fuse-t-sshfs"
    else
        menu_items+=("Mount Device" "Mount Device (Raw File System)" "Cydia App Install")
    fi
    if (( device_vers_maj < 4 )); then
        warn "Device is on lower than iOS 4. Backup and Restore options are not available."
    else
        menu_items+=("Backup" "Restore" "Encryption")
    fi
    if (( device_vers_maj >= 9 )); then
        menu_items+=("Erase All Content and Settings")
    fi
    menu_items+=("Go Back")
    while [[ -z "$mode" && -z "$back" ]]; do
        echo
        print " > Main Menu > Data Management"
        input "Select an option:"
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "Go Back" ) back=1;;
            "Backup"  )
                print "* A backup of your device will be created. Please see the notes above."
                select_yesno
                if [[ $? != 1 ]]; then
                    continue
                fi
                mode="device_backup_create"
            ;;
            "Restore" ) menu_backup_restore;;
            "Erase All Content and Settings" ) mode="device_erase";;
            "Mount Device"* | "Cydia App Install" )
                local path="/var/mobile/Media"
                case $selected in
                    *"Raw"*   ) path="/";;
                    *"Cydia"* ) path="/var/root/Media/Cydia/AutoInstall";;
                esac
                device_iproxy no-logging
                device_ssh_message
                device_sshpass
                if [[ $selected == *"Cydia"* ]]; then
                    $ssh -p $ssh_port ${ssh_user}@127.0.0.1 "mkdir -p $path"
                    print "* Place the .deb files you want to install to the mount folder, then reboot the device afterwards."
                fi
                mkdir -p ../mount
                if [[ $platform == "linux" ]]; then
                    $sshfs -o ssh_command="$(cd .. && pwd)/bin/linux/$platform_arch/sshpass -p$SSHPASS $(pwd)/ssh -F $(pwd)/ssh_config -p $ssh_port" -d ${ssh_user}@127.0.0.1:$path ../mount &>../saved/sshfs.log &
                    sshfs_pid=$!
                else
                    $dir/sshpass -p$SSHPASS $sshfs -d -F $(pwd)/ssh_config -p $ssh_port ${ssh_user}@127.0.0.1:$path ../mount &>../saved/sshfs.log &
                    sshfs_pid=$!
                fi
                log "Device's \"$path\" should now be mounted on mount folder."
                print "* If the mount folder is empty, make sure to have run \"Connect to SSH\" at least once."
                print "* Press Enter/Return to unmount the device."
                pause
                umount ../mount 2>/dev/null
                kill $iproxy_pid $sshfs_pid
            ;;
            "Connect to SSH" ) device_ssh;;
            "Encryption" ) menu_backup_encryption;;
        esac
    done
}

menu_backup_restore() {
    local menu_items
    local selected
    local back

    while [[ -z "$mode" && -z "$back" ]]; do
        menu_print_info
        local backupdir="../saved/backups/${device_ecid}_${device_type}"
        if [[ ! -d $backupdir ]]; then
            mkdir -p $backupdir
        fi
        local backups=($(ls $backupdir 2>/dev/null))
        if [[ -z "${backups[*]}" ]]; then
            print "* No backups (saved/backups)"
        else
            print "* Backups list (saved/backups):"
            for b in "${backups[@]}"; do
                menu_items+=("$(basename $b)")
            done
        fi
        menu_items+=("Go Back")
        echo
        print " > Main Menu > Data Management > Restore"
        input "Select option to restore:"
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "Go Back" ) back=1;;
            * )
                device_backup="$selected"
                print "* The selected backup $device_backup will be restored to the device."
                select_yesno
                if [[ $? != 1 ]]; then
                    device_backup=
                    continue
                fi
                mode="device_backup_restore"
            ;;
        esac
    done
}

menu_backup_encryption() {
    local menu_items
    local selected
    local back

    while [[ -z "$mode" && -z "$back" ]]; do
        menu_print_info
        menu_items=("Encryption On" "Encryption Off" "Change Password" "Go Back")
        echo
        print " > Main Menu > Data Management > Encryption"
        input "Select an option:"
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "Encryption On"   ) "$dir/idevicebackup2" -i encryption on; pause;;
            "Encryption Off"  ) "$dir/idevicebackup2" -i encryption off; pause;;
            "Change Password" ) "$dir/idevicebackup2" -i changepw; pause;;
            "Go Back" ) back=1;;
        esac
    done
}

menu_fourthree() {
    local menu_items
    local selected
    local back

    ipa_path=
    ipsw_fourthree=
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Step 1: Restore" "Step 2: Partition" "Step 3: OS Install")
        if [[ $device_mode == "Normal" ]]; then
            menu_items+=("Reinstall App" "Boot iOS 4.3.x")
        fi
        menu_items+=("Go Back")
        menu_print_info
        print "* FourThree Utility: Dualboot iPad 2 to iOS 4.3.x"
        print "* This is a 3 step process for the device. Follow through the steps to successfully set up a dualboot."
        print "* Please read the README here: https://github.com/LukeZGD/FourThree-iPad2"
        warn "Support for FourThree Utility is no longer provided. Any issues will not be entertained nor fixed."
        echo
        print " > Main Menu > FourThree Utility"
        input "Select an option:"
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "Step 1: Restore" ) ipsw_fourthree=1; menu_ipsw "iOS 6.1.3" "fourthree";;
            "Step 2: Partition" ) mode="device_fourthree_step2";;
            "Step 3: OS Install" ) mode="device_fourthree_step3";;
            "Reinstall App" ) mode="device_fourthree_app";;
            "Boot iOS 4.3.x" ) mode="device_fourthree_boot";;
            "Go Back" ) back=1;;
        esac
    done
}

menu_ipa() {
    local menu_items
    local selected
    local back

    ipa_path=
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Select IPA")
        menu_print_info
        if [[ $1 == "Install IPA (appinst)" ]]; then
            print "* Make sure that appinst and OpenSSH are installed on your device."
        elif [[ $1 == "Install IPA (ideviceinstaller)" ]]; then
            print "* Make sure that AppSync is installed on your device, if the IPA you are installing is cracked."
        else
            print "* Sideload IPA is for iOS 6 and newer. Sideloading will require an Apple ID."
            print "* Your Apple ID and password will only be sent to Apple servers."
            print "* Make sure that your iOS device is connected to the Internet."
            if [[ $platform == "linux" ]] && (( device_vers_maj >= 9 )); then
                print "* There are 2 options for sideloading, \"using Sideloader\" is recommended."
            fi
            print "* If you have AppSync installed, or are installing an app with a valid"
            print "  signature, go to App Management -> Install IPA (ideviceinstaller) or (appinst) instead."
            if [[ $device_unactivated == 1 ]]; then
                echo
                warn "Device is not activated. Sideload IPA option is not available."
                pause
                break
            fi
        fi
        echo
        if [[ -n $ipa_path ]]; then
            print "* Selected IPA: $ipa_path"
            if [[ $1 == "Sideload"* ]]; then
                if [[ $platform == "linux" ]]; then
                    menu_items+=("Install IPA using Sideloader")
                    if (( device_vers_maj >= 9 )); then
                        menu_items+=("Install IPA using AltServer")
                    fi
                fi
            else
                menu_items+=("Install IPA")
            fi
        elif [[ $1 == "Install"* ]]; then
            print "* Select IPA file(s) to install (multiple selection)"
        else
            print "* Select IPA file to install"
        fi
        if [[ $1 == "Sideload"* ]]; then
            menu_items+=("List and Revoke Certificate")
        fi
        menu_items+=("Go Back")
        echo
        print " > Main Menu > $1"
        input "Select an option:"
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "Select IPA" ) menu_ipa_browse;;
            "Install IPA" )
                if [[ $1 == "Install IPA (ideviceinstaller)" ]]; then
                    device_ideviceinstaller
                else
                    device_appinst
                fi
                pause
            ;;
            "Install IPA using AltServer" )
                device_altserver
                pause
            ;;
            "Install IPA using Sideloader" )
                device_sideloader
                log "Checking for any existing certificates..."
                local temp=$(mktemp)
                $sideloader cert list | tee /dev/tty > "$temp"
                local check=${PIPESTATUS[0]}
                local revoke=$(grep -m1 "serial number" "$temp" | sed -E 's/.*number `//' | cut -c -32 | tr -dc '[:alnum:]')
                if [[ $check != 0 ]]; then
                    warn "Sideloader returned an error. Incorrect Apple ID credentials?"
                    pause
                    continue
                fi
                if [[ -n $revoke ]]; then
                    log "Revoking existing certificate: $revoke"
                    $sideloader cert revoke $revoke
                fi
                log "Installing IPA using Sideloader..."
                $sideloader install "$ipa_path"
                local ret=$?
                local ipa_base="$(basename "$ipa_path")"
                local ipa_check="$(ls "/tmp/$ipa_base/Payload/"*".app/embedded.mobileprovision" 2>/dev/null)"
                if [[ -s "$ipa_check" && $platform == "linux" && $ret != 0 ]]; then
                    log "Attempting Linux workaround..."
                    pushd "/tmp/$ipa_base"
                    zip -r0 Payload.ipa Payload
                    popd
                    device_pair
                    $ideviceinstaller install "/tmp/$ipa_base/Payload.ipa"
                fi
                print "* If you see an error but the app is in the home screen, the installation is most likely successful and the error can be safely ignored."
                print "* If you see an error regarding certificate, you may need to revoke an existing certificate in your account."
                print "* If you see an error regarding verification, make sure that your iOS device is connected to the Internet."
                pause
            ;;
            "List and Revoke Certificate" )
                device_sideloader
                log "Checking for any existing certificates..."
                $sideloader cert list
                if [[ $? != 0 ]]; then
                    warn "Sideloader returned an error. Incorrect Apple ID credentials?"
                    pause
                    continue
                fi
                print "* Take note of the certificate serial number that you want to revoke."
                local revoke
                revoke=
                while [[ -z $revoke ]]; do
                    read -p "$(input 'Certificate Serial Number: ')" revoke
                done
                $sideloader cert revoke $revoke
                print "* If you see no error, the certificate should be revoked successfully."
                pause
            ;;
            "Go Back" ) back=1;;
        esac
    done
}

device_sideloader() {
    local arch="$platform_arch"
    sideloader="sideloader-cli-"
    if [[ $platform == "macos" && $arch == "arm64" ]]; then
        arch="arm64-apple-macos"
    elif [[ $platform == "macos" ]]; then
        arch="x86_64-apple-darwin"
    elif [[ $arch == "arm64" ]]; then
        arch="aarch64-linux-gnu"
    else
        arch="x86_64-linux-gnu"
    fi
    sideloader+="$arch"
    log "Checking for latest Sideloader"
    download_from_url "https://api.github.com/repos/LukeZGD/Sideloader/releases/latest" latest
    local latest="$(cat latest | $jq -r ".tag_name")"
    local current="$(cat ../saved/Sideloader_version 2>/dev/null || echo "none")"
    log "Latest version: $latest, current version: $current"
    if [[ $current != "$latest" ]]; then
        rm -f ../saved/$sideloader
    fi
    if [[ ! -e ../saved/$sideloader ]]; then
        file_download https://github.com/LukeZGD/Sideloader/releases/download/$latest/$sideloader.zip $sideloader.zip
        file_extract_from_archive $sideloader.zip $sideloader
        mv $sideloader ../saved
    fi
    echo "$latest" > ../saved/Sideloader_version
    device_pair
    log "Launching Dadoum Sideloader"
    local apple_id="$APPLE_ID_USER"
    local apple_pass="$APPLE_ID_PWD"
    if [[ -z $apple_id || -z $apple_pass ]]; then
        log "Enter Apple ID details to continue."
        print "* Your Apple ID and password will only be sent to Apple servers."
    fi
    while [[ -z $apple_id ]]; do
        read -p "$(input 'Apple ID: ')" apple_id
    done
    export APPLE_ID_USER="$apple_id"
    print "* Your password input may not be visible, but it is still being entered."
    while [[ -z $apple_pass ]]; do
        read -s -p "$(input 'Password: ')" apple_pass
    done
    echo
    export APPLE_ID_PWD="$apple_pass"
    chmod +x ../saved/$sideloader
    sideloader="../saved/$sideloader"
}

menu_zenity_check() {
    if [[ $platform == "linux" && ! $(command -v zenity) ]]; then
        warn "zenity not found in PATH. Install zenity to have a working file picker."
    fi
}

menu_ipa_browse() {
    local newpath
    input "Select your IPA file(s) in the file selection window."
    menu_zenity_check
    newpath="$($zenity --file-selection --multiple --file-filter='IPA | *.ipa' --title="Select IPA file(s)")"
    [[ -z "$newpath" ]] && read -p "$(input "Enter path to IPA file (or press Enter/Return or Ctrl+C to cancel): ")" newpath
    ipa_path="$newpath"
}

menu_shsh() {
    local menu_items
    local selected
    local back

    device_target_vers=
    device_target_build=
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Latest iOS ($device_latest_vers)")
        case $device_type in
            iPad4,[12345] | iPhone6,[12] )
                menu_items+=("iOS 10.3.3");;
            iPad[23]* | iPhone4,1 | iPhone5,[12] | iPod5,1 )
                menu_items+=("iOS 8.4.1");;
        esac
        case $device_type in
            iPad2,[123] | iPhone4,1 )
                menu_items+=("iOS 6.1.3");;
            iPhone1,2 | iPhone2,1 | iPod[23],1 )
                menu_items+=("iOS 4.1");;
        esac
        if (( device_proc < 7 )); then
            menu_items+=("Cydia Blobs")
        fi
        if [[ $device_type != "iPhone2,1" && $device_type != "iPod3,1" && $device_type != "iPad1,1" ]]; then
            if [[ $device_mode != "none" ]]; then
                menu_items+=("Onboard Blobs")
                if (( device_proc < 7 )); then
                    menu_items+=("Onboard Blobs (Raw Dump)")
                fi
            fi
            menu_items+=("Convert Raw Dump")
        fi
        menu_items+=("Go Back")
        menu_print_info
        print " > Main Menu > Save SHSH Blobs"
        input "Select an option:"
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "Latest iOS"* )
                device_target_vers="$device_latest_vers"
                device_target_build="$device_latset_build"
            ;;
            "iOS 10.3.3" )
                device_target_vers="10.3.3"
                device_target_build="14G60"
            ;;
            "iOS 8.4.1" )
                device_target_vers="8.4.1"
                device_target_build="12H321"
            ;;
            "iOS 6.1.3" )
                device_target_vers="6.1.3"
                device_target_build="10B329"
            ;;
            "iOS 4.1" )
                device_target_vers="4.1"
                device_target_build="8B117"
            ;;
        esac
        target_vers_maj=$(echo "$device_target_vers" | cut -d. -f1)
        target_vers_min=$(echo "$device_target_vers" | cut -d. -f2)
        case $selected in
            *"iOS"* ) shsh_save; pause;;
            "Onboard Blobs" ) menu_shsh_onboard;;
            "Onboard Blobs (Raw Dump)" )
                print "* This option will save onboard blobs of your device, but only as a raw dump. You will need to convert them to be usable."
                print "* This option is useful for determining the iBoot version of your device first, to get the correct IPSW for conversion."
                print "* Use the Convert Raw Dump option for converting raw dumps to usable SHSH blobs."
                select_yesno
                if [[ $? != 1 ]]; then
                    continue
                fi
                shsh_save_onboard dump
                pause
            ;;

            "Cydia Blobs" )
                print "* This option will check if this device has saved blobs in Cydia servers, and proceed to save them if there are any."
                select_yesno
                if [[ $? != 1 ]]; then
                    continue
                fi
                shsh_save_cydia
                pause
            ;;
            "Convert Raw Dump" ) menu_shsh_convert;;
            "Go Back" ) back=1;;
        esac
    done
}

menu_shsh_onboard() {
    local menu_items
    local selected
    local back

    ipsw_path=
    if (( device_proc >= 7 )); then
        shsh_save_onboard
        return
    fi
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Select IPSW")
        menu_print_info
        if [[ -n $ipsw_path ]]; then
            print "* Selected IPSW: $ipsw_path.ipsw"
            print "* IPSW Version: $device_target_vers-$device_target_build"
            if [[ $device_mode == "Normal" && $device_target_vers != "$device_vers" ]]; then
                warn "Selected IPSW does not seem to match the current version."
                print "* Ignore this warning if this is a DRA/powdersn0w downgraded device."
            fi
            menu_items+=("(*) Save Onboard Blobs")
        else
            print "* Select IPSW of your current iOS version to continue"
        fi
        menu_items+=("Go Back")
        echo
        print " > Main Menu > Save SHSH Blobs > Onboard Blobs"
        input "Select an option:"
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "Select IPSW" ) menu_ipsw_browse onboard;;
            "(*) Save Onboard Blobs" ) mode="shsh_save_onboard";;
            "Go Back" ) back=1;;
        esac
    done
}

menu_shsh_convert() {
    local menu_items
    local selected
    local back

    ipsw_path=
    shsh_path=
    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=("Select Raw Dump")
        menu_print_info
        if [[ -n $shsh_path ]]; then
            print "* Selected dump: $shsh_path"
            if (( device_proc < 7 )); then
                shsh_onboard_iboot="$(cat "$shsh_path" | strings | grep iBoot | head -1)"
                print "* Raw dump iBoot version: $shsh_onboard_iboot"
                print "* Go here to find the matching iOS version: https://theapplewiki.com/wiki/IBoot_(Bootloader)"
                menu_items+=("Select IPSW")
            else
                menu_items+=("(*) Convert Raw Dump")
            fi
        else
            print "* Select raw dump file to continue"
        fi
        if [[ -n $ipsw_path ]]; then
            echo
            print "* Selected IPSW: $ipsw_path.ipsw"
            print "* IPSW Version: $device_target_vers-$device_target_build"
            if [[ $device_target_vers == "10"* ]]; then
                warn "Saving iOS 10 blobs is not supported, converting raw dump to SHSH blob will fail."
            fi
            menu_items+=("(*) Convert Raw Dump")
        elif (( device_proc < 7 )); then
            echo
            print "* Select IPSW of the raw dump's iOS version to continue"
        fi
        menu_items+=("Go Back")
        echo
        print " > Main Menu > Save SHSH Blobs > Convert Raw Dump"
        input "Select an option:"
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "Select IPSW" ) menu_ipsw_browse;;
            "Select Raw Dump" ) menu_shshdump_browse;;
            "(*) Convert Raw Dump" )
                rm -f dump.raw
                cp "$shsh_path" dump.raw
                shsh_convert_onboard
                pause
            ;;
            "Go Back" ) back=1;;
        esac
    done
}

menu_restore() {
    local menu_items
    local selected
    local back

    while [[ -z "$mode" && -z "$back" ]]; do
        menu_items=()
        case $device_type in
            iPad4,[12345] | iPhone6,[12] )
                menu_items+=("iOS 10.3.3");;
            iPad2,[1234567] | iPad3,[123456] | iPhone4,1 | iPhone5,[12] | iPod5,1 )
                menu_items+=("iOS 8.4.1");;
        esac
        case $device_type in
            iPad2,[123] | iPhone4,1 )
                menu_items+=("iOS 6.1.3");;
            iPhone2,1 )
                menu_items+=("5.1.1" "4.3.5" "4.1" "3.1.3" "More versions");;
            iPod3,1 )
                menu_items+=("4.1");;
            iPhone1,2 | iPod2,1 )
                menu_items+=("4.1" "3.1.3")
                if [[ $device_type == "iPod2,1" ]] && [[ $device_newbr == 0 || $device_mode == "none" ]]; then
                    menu_items+=("More versions")
                fi
            ;;
        esac
        case $device_type in
            iPhone3,* | iPad1,1 | iPod3,1 )
                menu_items+=("powdersn0w (any iOS)");;
        esac
        if (( device_proc < 7 )) || [[ $platform == "linux" ]]; then
            menu_items+=("Latest iOS ($device_latest_vers)")
        fi
        case $device_type in
            iPod4,1 ) menu_items+=("7.1.2");;
            iPod3,1 ) menu_items+=("6.0" "6.1.3" "6.1.6");;
            iPad1,1 ) menu_items+=("6.1.3" "7.1.2");;
        esac
        if [[ $device_canpowder == 1 && $device_proc != 4 ]]; then
            menu_items+=("Other (powdersn0w $base_vers blobs)")
        fi
        if [[ $device_proc != 1 && $device_type != "iPod2,1" ]] && (( device_proc <= 10 )); then
            menu_items+=("Other (Use SHSH Blobs)")
            if (( device_proc < 7 )); then
                menu_items+=("Other (Tethered)")
            fi
        fi
        if [[ $1 != "ipsw" ]] && (( device_proc < 5 )); then
            menu_items+=("Other (Custom IPSW)")
        fi
        if (( device_proc < 7 )); then
            menu_items+=("DFU IPSW")
        elif (( device_proc >= 7 )) && (( device_proc <= 10 )); then
            menu_items+=("Set Nonce Only")
        fi
        menu_items+=("IPSW Downloader" "Go Back")
        menu_print_info
        if [[ $1 == "ipsw" ]]; then
            print " > Main Menu > Misc Utilities > Create Custom IPSW"
        else
            print " > Main Menu > Restore/Downgrade"
            if [[ $device_proc == 1 ]]; then
                print "* Select \"Other (Custom IPSW)\" to restore to other iOS versions (2.0 to 3.1.2) (1.x will not work)"
                echo
            elif [[ $device_type == "iPod2,1" && $device_newbr == 0 ]]; then
                print "* Select \"Other (Custom IPSW)\" to restore to other iOS versions (2.1.1 to 3.0)"
                echo
            elif [[ $device_type == "iPhone2,1" && $device_newbr != 0 ]]; then
                print "* Some new bootrom devices might be incompatible with older iOS versions"
                echo
            fi
        fi
        case $device_type in
            iPad2,4      ) print "* iPad2,4 does not support 6.1.3 downgrades, you need blobs for 6.1.3 or 7.1.x"; echo;;
            iPhone5,[34] ) print "* iPhone 5C does not support 8.4.1 downgrades, you need blobs for 8.4.1 or 7.x"; echo;;
            iPod4,1      ) print "* iPod touch 4 does not support any untethered downgrades without blobs"; echo;;
        esac
        if [[ $platform == "macos" ]] && (( device_proc >= 7 )); then
            print "* Note: Restoring to latest iOS for 64-bit devices is not supported on macOS, use iTunes/Finder instead for that"
            echo
        fi
        input "Select an option:"
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "" ) :;;
            "Go Back" ) back=1;;
            "Other (Custom IPSW)" ) restore_customipsw_confirm;;
            "DFU IPSW" ) device_dfuipsw_confirm $1;;
            "More versions" ) menu_restore_more "$1";;
            "IPSW Downloader" ) menu_ipsw_downloader "$1";;
            7.* )
                case $device_type in
                    iPod4,1 | iPad1,1 ) menu_ipsw_special "$selected" "$1";;
                    * ) menu_ipsw "$selected" "$1";;
                esac
            ;;
            6.* )
                case $device_type in
                    iPod3,1 | iPad1,1 ) menu_ipsw_special "$selected" "$1";;
                    * ) menu_ipsw "$selected" "$1";;
                esac
            ;;
            * ) menu_ipsw "$selected" "$1";;
        esac
    done
}

menu_ipsw_downloader() {
    local menu_items
    local selected
    local back
    local build

    while [[ -z "$back" ]]; do
        menu_items=("Enter Build Version")
        if [[ -n $build ]]; then
            menu_items+=("(*) Start Download")
        fi
        menu_items+=("Go Back")
        menu_print_info
        if [[ $1 == "ipsw" ]]; then
            print " > Main Menu > Misc Utilities > Create Custom IPSW > IPSW Downloader"
        else
            print " > Main Menu > Restore/Downgrade > IPSW Downloader"
        fi
        print "* To know more about build version, go here: https://theapplewiki.com/wiki/Firmware"
        if [[ -n $build ]]; then
            print "* Build Version entered: $build"
        else
            print "* Enter build version to continue"
        fi
        echo
        input "Select an option:"
        select_option "${menu_items[@]}"
        selected="${menu_items[$?]}"
        case $selected in
            "Enter Build Version" )
                print "* Enter the build version of the IPSW you want to download."
                device_enter_build
                build="$device_rd_build"
            ;;
            "(*) Start Download" )
                device_target_build="$build"
                ipsw_download
                log "IPSW downloading is done"
                pause
            ;;
            "Go Back" ) device_rd_build=; back=1;;
        esac
    done