Legacy IOS Part2

        return
    fi
    rm -f *.shsh*

    ExtraArgs="-d $device_type -i $version -e $device_ecid -m $buildmanifest -o -s -B ${device_model}ap -b "
    if [[ -n $apnonce ]]; then
        ExtraArgs+="--apnonce $apnonce"
    else
        ExtraArgs+="-g 0x1111111111111111"
    fi
    log "Running tsschecker with command: $tsschecker $ExtraArgs"
    $tsschecker $ExtraArgs
    shsh_path="$(ls $shsh_check)"
    if [[ -z "$shsh_path" ]]; then
        error "Saving $version blobs failed. Please run the script again"
    fi
    if [[ -z $apnonce ]]; then
        cp "$shsh_path" ../saved/shsh/
    fi
    log "Successfully saved $version blobs: $shsh_path"
}

ipsw_download() {
    local version="$device_target_vers"
    local build_id="$device_target_build"
    local type="$device_type"
    local special
    if [[ -n $2 && -n $3 ]]; then
        version="$2"
        build_id="$3"
    elif [[ $2 == "latest" ]]; then
        version="$device_latest_vers"
        build_id="$device_latest_build"
    elif [[ $2 == "special" ]]; then
        type="$device_type_special"
        special="special"
    fi
    local ipsw_dl="$1"
    ipsw_get_url $build_id $type $version
    if [[ -z $ipsw_dl ]]; then
        ipsw_dl="../${ipsw_url##*/}"
        ipsw_dl="${ipsw_dl%?????}"
    fi
    if [[ ! -e "$ipsw_dl.ipsw" ]]; then
        if [[ -n $version ]]; then
            print "* The script will now proceed to download iOS $version IPSW."
        fi
        print "* If you want to download it yourself, here is the link: $ipsw_url"
        log "Downloading IPSW... (Press Ctrl+C to cancel)"
        download_from_url "$ipsw_url" temp.ipsw
        mv temp.ipsw "$ipsw_dl.ipsw"
    fi
    ipsw_verify "$ipsw_dl" "$build_id" $special
}

ipsw_verify() {
    local ipsw_dl="$1"
    local build_id="$2"
    local IPSWSHA1
    local IPSWSHA1E=$(cat "$device_fw_dir/$build_id/sha1sum" 2>/dev/null)
    local IPSWSHA1L
    local type="$device_type"
    [[ $3 == "special" ]] && type="$device_type_special"

    log "Getting SHA1 hash for $ipsw_dl.ipsw..."
    IPSWSHA1L=$($sha1sum "${ipsw_dl//\\//}.ipsw" | awk '{print $1}')
    case $build_id in
        *[bcdefgkmpquv] )
            log "Beta IPSW detected, skip verification"
            if [[ $build_id == "$device_base_build" ]]; then
                device_base_sha1="$IPSWSHA1L"
            else
                ipsw_isbeta=1
                device_target_sha1="$IPSWSHA1L"
            fi
            return
        ;;
    esac

    if [[ $(echo "$IPSWSHA1E" | grep -c '<') != 0 ]]; then
        rm "$device_fw_dir/$build_id/sha1sum"
    fi

    log "Getting SHA1 hash from AppleDB..."
    download_appledb ios $build_id
    IPSWSHA1="$(cat tmp.json | $jq -r ".sources[] | select(.type == \"ipsw\" and any(.deviceMap[]; . == \"$type\")) | .hashes.sha1")"
    mkdir -p $device_fw_dir/$build_id

    if [[ -n $IPSWSHA1 && -n $IPSWSHA1E && $IPSWSHA1 == "$IPSWSHA1E" ]]; then
        log "Using saved SHA1 hash for this IPSW: $IPSWSHA1"
    elif [[ -z $IPSWSHA1 && -n $IPSWSHA1E ]]; then
        warn "No SHA1 hash from AppleDB, using local hash"
        IPSWSHA1="$IPSWSHA1E"
    elif [[ -z $IPSWSHA1 && -z $IPSWSHA1E ]]; then
        warn "No SHA1 hash from either AppleDB or local hash, cannot verify IPSW."
        pause
        if [[ $build_id == "$device_base_build" ]]; then
            device_base_sha1="$IPSWSHA1L"
        else
            device_target_sha1="$IPSWSHA1L"
        fi
        return
    elif [[ -n $IPSWSHA1E ]]; then
        warn "Local SHA1 hash mismatch. Overwriting local hash."
        echo "$IPSWSHA1" > $device_fw_dir/$build_id/sha1sum
    elif [[ -z $IPSWSHA1E ]]; then
        log "Local SHA1 hash does not exist. Saving local hash."
        echo "$IPSWSHA1" > $device_fw_dir/$build_id/sha1sum
    fi

    if [[ $IPSWSHA1L != "$IPSWSHA1" ]]; then
        rm "$device_fw_dir/$build_id/sha1sum"
        if [[ $3 != "nopause" ]]; then
            log "SHA1sum mismatch. Expected $IPSWSHA1, got $IPSWSHA1L"
            warn "Verifying IPSW failed. Your IPSW may be corrupted or incomplete. Make sure to download and select the correct IPSW."
            pause
        fi
        if [[ $build_id == "$device_base_build" ]]; then
            ipsw_base_validate=1
        else
            ipsw_validate=1
        fi
        return 1
    fi
    log "IPSW SHA1sum matches"
    if [[ $build_id == "$device_base_build" ]]; then
        device_base_sha1="$IPSWSHA1"
        ipsw_base_validate=0
    else
        ipsw_isbeta=
        device_target_sha1="$IPSWSHA1"
        ipsw_validate=0
    fi
}

ipsw_prepare_1033() {
    # patch iBSS, iBEC, iBSSb, iBECb and set variables
    iBSS="ipad4"
    if [[ $device_type == "iPhone6"* ]]; then
        iBSS="iphone6"
    fi
    iBEC="iBEC.${iBSS}.RELEASE"
    iBSSb="iBSS.${iBSS}b.RELEASE"
    iBECb="iBEC.${iBSS}b.RELEASE"
    iBSS="iBSS.$iBSS.RELEASE"

    log "Patching iBSS and iBEC..."
    file_extract_from_archive "$ipsw_path.ipsw" Firmware/dfu/$iBSS.im4p
    file_extract_from_archive "$ipsw_path.ipsw" Firmware/dfu/$iBEC.im4p
    mv $iBSS.im4p $iBSS.orig
    mv $iBEC.im4p $iBEC.orig
    $bspatch $iBSS.orig $iBSS.im4p ../resources/patch/1033/$iBSS.patch
    $bspatch $iBEC.orig $iBEC.im4p ../resources/patch/1033/$iBEC.patch
    if [[ $device_type == "iPad4,"* ]]; then
        file_extract_from_archive "$ipsw_path.ipsw" Firmware/dfu/$iBSSb.im4p
        file_extract_from_archive "$ipsw_path.ipsw" Firmware/dfu/$iBECb.im4p
        mv $iBSSb.im4p $iBSSb.orig
        mv $iBECb.im4p $iBECb.orig
        $bspatch $iBSSb.orig $iBSSb.im4p ../resources/patch/1033/$iBSSb.patch
        $bspatch $iBECb.orig $iBECb.im4p ../resources/patch/1033/$iBECb.patch
    fi
    case $device_type in
        iPad4,[45] ) cp $iBSSb.im4p $iBECb.im4p ../saved/$device_type;;
        * ) cp $iBSS.im4p $iBEC.im4p ../saved/$device_type;;
    esac
    log "Pwned iBSS and iBEC saved at: saved/$device_type"
}

ipsw_prepare_openssh_plist() {
    [[ $ipsw_openssh != 1 ]] && return
    echo "echo '<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">
<plist version=\"1.0\">

<dict>
    <key>Label</key>
    <string>com.openssh.sshd</string>

    <key>Program</key>
    <string>/usr/libexec/sshd-keygen-wrapper</string>

    <key>ProgramArguments</key>
    <array>
        <string>/usr/sbin/sshd</string>
        <string>-i</string>
    </array>

    <key>SessionCreate</key>
    <true/>

    <key>Sockets</key>
    <dict>
        <key>Listeners</key>
        <dict>
            <key>SockServiceName</key>
            <string>ssh</string>
        </dict>
    </dict>

    <key>StandardErrorPath</key>
    <string>/dev/null</string>

    <key>inetdCompatibility</key>
    <dict>
        <key>Wait</key>
        <false/>
    </dict>
</dict>

</plist>' > /mnt1/Library/LaunchDaemons/com.openssh.sshd.plist" | tee -a reboot.sh
}

ipsw_prepare_rebootsh() {
    log "Generating reboot.sh"
    echo '#!/bin/bash' | tee reboot.sh
    echo "mount_hfs /dev/disk0s1s1 /mnt1; mount_hfs /dev/disk0s1s2 /mnt2" | tee -a reboot.sh
    [[ $1 != "aquila2" ]] && echo "nvram -d boot-partition; nvram -d boot-ramdisk" | tee -a reboot.sh
    if [[ $1 == "aquila"* ]]; then
        echo "mv /mnt1/System/Library/LaunchDaemons/com.apple.mDNSResponder.plist_ /mnt1/Library/LaunchDaemons/com.apple.mDNSResponder.plist" | tee -a reboot.sh
        echo "mv /mnt1/Library/LaunchDaemons/com.apple.sandboxd.plist /mnt1/System/Library/LaunchDaemons/" | tee -a reboot.sh
        echo "mv /mnt1/Library/LaunchDaemons/com.saurik.Cydia.Startup.plist /mnt1/System/Library/LaunchDaemons/" | tee -a reboot.sh
        local crash
        [[ $1 == "aquila" ]] && crash+="_o"
        echo "mv /mnt1/usr/libexec/CrashHousekeeping$crash /mnt1/usr/libexec/CrashHousekeeping.backup" | tee -a reboot.sh
        echo "ln -sf /aquila /mnt1/usr/libexec/CrashHousekeeping" | tee -a reboot.sh
        ipsw_prepare_openssh_plist
        echo "/sbin/reboot_" | tee -a reboot.sh
    else
        echo "/usr/bin/haxx_overwrite --${device_type}_${device_target_build}" | tee -a reboot.sh
    fi
}

ipsw_prepare_logos_convert() {
    local fourcc="logo"
    if [[ -n $ipsw_customlogo ]]; then
        log "Converting custom logo"
        logoname=$(echo "$device_fw_key" | $jq -j '.keys[] | select(.image == "AppleLogo") | .filename')
        if [[ $device_target_powder == 1 ]]; then
            fourcc="logb"
            case $target_vers_maj in
                [34] ) fourcc="log4";;
            esac
        fi
        "$dir/ibootim" "$ipsw_customlogo" logo.raw
        "$dir/img3maker" -f logo.raw -o logo.img3 -t $fourcc
        if [[ ! -s logo.img3 ]]; then
            error "Converting custom logo failed. Check your image"
        fi
        mkdir -p $all_flash
        mv logo.img3 $all_flash/$logoname
    fi
    if [[ -n $ipsw_customrecovery ]]; then
        log "Converting custom recovery"
        recmname=$(echo "$device_fw_key" | $jq -j '.keys[] | select(.image == "RecoveryMode") | .filename')
        "$dir/ibootim" "$ipsw_customlogo" recovery.raw
        "$dir/img3maker" -f recovery.raw -o recovery.img3 -t recm
        if [[ ! -s recovery.img3 ]]; then
            error "Converting custom recovery failed. Check your image"
        fi
        mkdir -p $all_flash
        mv recovery.img3 $all_flash/$recmname
    fi
}

ipsw_prepare_logos_add() {
    if [[ -n $ipsw_customlogo ]]; then
        log "Adding custom logo to IPSW"
        zip -r0 temp.ipsw $all_flash/$logoname
    fi
    if [[ -n $ipsw_customrecovery ]]; then
        log "Adding custom recovery to IPSW"
        zip -r0 temp.ipsw $all_flash/$recmname
    fi
}

ipsw_prepare_jailbreak() {
    if [[ -s "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    fi
    local ExtraArgs=
    local JBFiles=()
    local daibutsu=$1

    if [[ $ipsw_jailbreak == 1 ]]; then
        case $device_target_vers in
            6.*  ) JBFiles=("aquila_6.tar");;
            5.*  ) JBFiles=("aquila_5.tar");;
            4.3* ) JBFiles=("aquila_4.tar");;
            4.[10]* | 3.2* ) JBFiles=("greenpois0n/${device_type}_${device_target_build}.tar");;
        esac
        if [[ -n ${JBFiles[0]} ]]; then
            JBFiles[0]=$jelbrek/${JBFiles[0]}
        fi
        case $device_target_vers in
            [43].* ) JBFiles+=("$jelbrek/fstab_old.tar");;
            *      ) JBFiles+=("$jelbrek/fstab_rw.tar");;
        esac
        JBFiles+=("freeze.tar")
        case $device_target_vers in
            4.2.[8761] )
                if [[ $device_type != "iPhone1,2" ]]; then
                    ExtraArgs+=" -punchd"
                    JBFiles+=("$jelbrek/greenpois0n/${device_type}_${device_target_build}.tar")
                fi
            ;;
            3.1* )
                if [[ $device_type != "iPhone1,2" && $device_type != "iPhone2,1" && $ipsw_24o != 1 ]]; then
                    JBFiles+=("$jelbrek/greenpois0n/${device_type}_${device_target_build}.tar")
                fi
            ;;
        esac
        case $device_target_vers in
            [543].* ) JBFiles+=("$jelbrek/cydiasubstrate.tar");;
        esac
        if [[ $device_target_vers == "3."* ]]; then
            JBFiles+=("$jelbrek/cydiahttpatch.tar")
        fi
        ExtraArgs+=" -S 30" # system partition add
        if [[ $ipsw_openssh == 1 ]]; then
            JBFiles+=("$jelbrek/sshdeb.tar")
            if (( target_vers_maj >= 4 )); then
                cp $jelbrek/openssh.tar.gz $jelbrek/openssl.tar.gz .
                gzip -d openssh.tar.gz
                gzip -d openssl.tar.gz
                JBFiles+=("openssh.tar" "openssl.tar")
            fi
        fi
        case $device_target_vers in
            [43]* ) :;;
            * ) JBFiles+=("$jelbrek/LukeZGD.tar");;
        esac
        cp $jelbrek/freeze.tar.gz .
        gzip -d freeze.tar.gz
    fi

    ipsw_prepare_bundle $daibutsu
    ipsw_prepare_logos_convert

    if [[ $ipsw_memory == 1 ]]; then
        ExtraArgs+=" -memory"
    fi
    ExtraArgs+=" -ramdiskgrow 10"
    if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]]; then
        ExtraArgs+=" -bbupdate"
    elif [[ $device_type == "$device_disable_bbupdate" && $device_deadbb != 1 ]]; then
        ExtraArgs+=" ../saved/$device_type/baseband-$device_ecid.tar"
    fi
    if [[ $device_actrec == 1 ]]; then
        ExtraArgs+=" ../saved/$device_type/activation-$device_ecid.tar"
    fi
    if [[ $1 == "iboot" ]]; then
        ExtraArgs+=" iBoot.tar"
    fi
    if [[ $ipsw_isbeta == 1 ]]; then
        ipsw_prepare_systemversion
        ExtraArgs+=" systemversion.tar"
    fi

    log "Preparing custom IPSW: $dir/ipsw $ipsw_path.ipsw temp.ipsw $ExtraArgs ${JBFiles[*]}"
    "$dir/ipsw" "$ipsw_path.ipsw" temp.ipsw $ExtraArgs ${JBFiles[@]}

    if [[ ! -e temp.ipsw ]]; then
        error "Failed to find custom IPSW. Please run the script again" \
              "* You may try selecting N for memory option"
    fi

    ipsw_prepare_logos_add
    ipsw_bbreplace
    if [[ $device_type == "iPhone2,1" ]] && (( target_vers_maj >= 5 )); then
        ipsw_prepare_ios4patches
        log "Add all to custom IPSW"
        zip -r0 temp.ipsw Firmware/dfu/*
    fi

    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_prepare_fourthree() {
    local comps=("AppleLogo" "DeviceTree" "iBoot" "RecoveryMode")
    local saved_path="../saved/$device_type/8L1"
    local bpatch="../resources/patch/fourthree/$device_type/6.1.3"
    local name
    local iv
    local key
    if [[ $ipsw_fourthree != 1 ]]; then
        return
    fi
    log "Preparing IPSW for FourThree"
    ipsw_get_url 8L1
    url="$ipsw_url"
    device_fw_key_check
    device_fw_key_check temp 8L1
    mkdir -p $all_flash Downgrade $saved_path
    log "Extracting files"
    file_extract_from_archive "$ipsw_path.ipsw" $all_flash/manifest
    mv manifest $all_flash
    file_extract_from_archive temp.ipsw Downgrade/RestoreDeviceTree
    log "RestoreDeviceTree"
    iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "DeviceTree") | .iv')
    key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "DeviceTree") | .key')
    "$dir/xpwntool" RestoreDeviceTree RestoreDeviceTree.dec -iv $iv -k $key -decrypt
    $bspatch RestoreDeviceTree.dec Downgrade/RestoreDeviceTree $bpatch/RestoreDeviceTree.patch
    for getcomp in "${comps[@]}"; do
        name=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
        iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        path="$all_flash/"
        log "$getcomp"
        if [[ $vers == "$device_base_vers" ]]; then
            file_extract_from_archive "$ipsw_base_path.ipsw" ${path}$name
        elif [[ -e $saved_path/$name ]]; then
            cp $saved_path/$name .
        else
            "$dir/pzb" -g "${path}$name" -o "$name" "$url"
            cp $name $saved_path/
        fi
        "$dir/xpwntool" $name $getcomp.dec -iv $iv -k $key -decrypt
        case $getcomp in
            "AppleLogo" )
                getcomp="applelogo"
                mv AppleLogo.dec applelogo.dec
                echo "0000010: 6267" | xxd -r - applelogo.dec
                echo "0000020: 6267" | xxd -r - applelogo.dec
            ;;
            "DeviceTree" )
                echo "0000010: 6272" | xxd -r - DeviceTree.dec
                echo "0000020: 6272" | xxd -r - DeviceTree.dec
            ;;
            "RecoveryMode" )
                getcomp="recoverymode"
                mv RecoveryMode.dec recoverymode.dec
                echo "0000010: 6263" | xxd -r - recoverymode.dec
                echo "0000020: 6263" | xxd -r - recoverymode.dec
            ;;
            "iBoot" )
                mv iBoot.dec iBoot.dec0
                $bspatch iBoot.dec0 iBoot.dec $bpatch/iBoot.${device_model}ap.RELEASE.patch
                #"$dir/xpwntool" iBoot.dec0 iBoot.dec2
                #"$dir/iBoot32Patcher" iBoot.dec2 iBoot.patched --rsa -b "rd=disk0s3 -v amfi=0xff cs_enforcement_disable=1 pio-error=0"
                #"$dir/xpwntool" iBoot.patched iBoot.dec -t iBoot.dec0
                #echo "0000010: 626F" | xxd -r - iBoot.dec
                #echo "0000020: 626F" | xxd -r - iBoot.dec
            ;;
        esac
        mv $getcomp.dec $path/${getcomp}B.img3
        echo "${getcomp}B.img3" >> $path/manifest
    done
    log "Add files to IPSW"
    zip -r0 temp.ipsw $all_flash/* Downgrade/*
}

ipsw_prepare_fourthree_part2() {
    device_fw_key_check base
    local saved_path="../saved/$device_type/$device_base_build"
    local bpatch="../resources/patch/fourthree/$device_type/$device_base_vers"
    local iv
    local key
    mkdir -p $saved_path
    log "Preparing components for FourThree dualboot"
    if [[ ! -s $saved_path/Kernelcache ]]; then
        log "Kernelcache"
        iv=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "Kernelcache") | .iv')
        key=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "Kernelcache") | .key')
        file_extract_from_archive "$ipsw_base_path.ipsw" kernelcache.release.$device_model
        "$dir/xpwntool" kernelcache.release.$device_model kernelcache.dec -iv $iv -k $key
        $bspatch kernelcache.dec kernelcache.patched $bpatch/kernelcache.release.patch
        "$dir/xpwntool" kernelcache.patched kernelcachb -t kernelcache.release.$device_model -iv $iv -k $key
        "$dir/xpwntool" kernelcachb $saved_path/Kernelcache -iv $iv -k $key -decrypt
    fi
    if [[ ! -s $saved_path/LLB ]]; then
        log "LLB"
        iv=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "LLB") | .iv')
        key=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "LLB") | .key')
        file_extract_from_archive "$ipsw_base_path.ipsw" $all_flash/LLB.${device_model}ap.RELEASE.img3
        "$dir/xpwntool" LLB.${device_model}ap.RELEASE.img3 llb.dec -iv $iv -k $key
        $bspatch llb.dec $saved_path/LLB $bpatch/LLB.${device_model}ap.RELEASE.patch
    fi
    if [[ ! -s $saved_path/RootFS.dmg ]]; then
        log "RootFS"
        name=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "RootFS") | .filename')
        key=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "RootFS") | .key')
        file_extract_from_archive "$ipsw_base_path.ipsw" $name
        "$dir/dmg" extract $name rootfs.dec -k $key
        rm $name
        "$dir/dmg" build rootfs.dec $saved_path/RootFS.dmg
    fi
    echo "device_base_vers=$device_base_vers" > ../saved/$device_type/fourthree_$device_ecid
    echo "device_base_build=$device_base_build" >> ../saved/$device_type/fourthree_$device_ecid
}

ipsw_prepare_keys() {
    local comp="$1"
    local getcomp="$1"
    case $comp in
        "RestoreLogo" ) getcomp="AppleLogo";;
        *"KernelCache" ) getcomp="Kernelcache";;
        "RestoreDeviceTree" ) getcomp="DeviceTree";;
    esac
    local fw_key="$device_fw_key"
    if [[ $2 == "base" ]]; then
        fw_key="$device_fw_key_base"
    fi
    local name=$(echo $fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
    [[ $name == *".dmg" ]] && name="${name%%.dmg*}.dmg"
    local iv=$(echo $fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
    local key=$(echo $fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
    if [[ -z $name && $device_proc != 1 ]]; then
        error "Issue with firmware keys: Failed getting $getcomp. Check The Apple Wiki or your wikiproxy"
    fi

    case $comp in
        "iBSS" | "iBEC" )
            if [[ -z $name ]]; then
                name="$getcomp.${device_model}ap.RELEASE.dfu"
            fi
            echo "<key>$comp</key><dict><key>File</key><string>Firmware/dfu/$name</string>" >> $NewPlist
            if [[ -n $iv && -n $key ]]; then
                echo "<key>IV</key><string>$iv</string><key>Key</key><string>$key</string>" >> $NewPlist
            fi
            if [[ $ipsw_prepare_usepowder == 1 ]]; then
                echo "<key>Patch</key><true/>" >> $NewPlist
            elif [[ -s $FirmwareBundle/$comp.${device_model}ap.RELEASE.patch ]]; then
                echo "<key>Patch</key><string>$comp.${device_model}ap.RELEASE.patch</string>" >> $NewPlist
            elif [[ -s $FirmwareBundle/$comp.${device_model}.RELEASE.patch ]]; then
                echo "<key>Patch</key><string>$comp.${device_model}.RELEASE.patch</string>" >> $NewPlist
            fi
        ;;

        "iBoot" )
            echo "<key>$comp</key><dict><key>File</key><string>$all_flash/$name</string><key>IV</key><string>$iv</string><key>Key</key><string>$key</string>" >> $NewPlist
            echo "<key>Patch</key><string>$comp.${device_model}ap.RELEASE.patch</string>" >> $NewPlist
        ;;

        "RestoreRamdisk" )
            echo "<key>Restore Ramdisk</key><dict><key>File</key><string>$name</string><key>IV</key><string>$iv</string><key>Key</key><string>$key</string>" >> $NewPlist
        ;;

        "RestoreDeviceTree" | "RestoreLogo" )
            echo "<key>$comp</key><dict><key>File</key><string>$all_flash/$name</string><key>IV</key><string>$iv</string><key>Key</key><string>$key</string><key>DecryptPath</key><string>Downgrade/$comp</string>" >> $NewPlist
        ;;

        "RestoreKernelCache" )
            echo "<key>$comp</key><dict><key>File</key><string>$name</string><key>IV</key><string>$iv</string><key>Key</key><string>$key</string><key>DecryptPath</key><string>Downgrade/$comp</string>" >> $NewPlist
        ;;

        "KernelCache" )
            echo "<key>$comp</key><dict><key>File</key><string>$name</string><key>IV</key><string>$iv</string><key>Key</key><string>$key</string>" >> $NewPlist
            if [[ $ipsw_prepare_usepowder == 1 ]]; then
                echo "<key>Patch</key><true/>" >> $NewPlist
            elif [[ -e $FirmwareBundle/kernelcache.release.patch ]]; then
                echo "<key>Patch</key><string>kernelcache.release.patch</string>" >> $NewPlist
            fi
        ;;

        "WTF2" )
            echo "<key>WTF 2</key><dict><key>File</key><string>Firmware/dfu/WTF.s5l8900xall.RELEASE.dfu</string><key>Patch</key><string>WTF.s5l8900xall.RELEASE.patch</string>" >> $NewPlist
        ;;
    esac
    if [[ $2 != "old" ]]; then
        echo "<key>Decrypt</key><true/>" >> $NewPlist
    fi
    echo "</dict>" >> $NewPlist
}

ipsw_prepare_paths() {
    local comp="$1"
    local getcomp="$1"
    case $comp in
        "BatteryPlugin" ) getcomp="GlyphPlugin";;
        "NewAppleLogo" | "APTicket" ) getcomp="AppleLogo";;
        "NewRecoveryMode" ) getcomp="RecoveryMode";;
        "NewiBoot" ) getcomp="iBoot";;
    esac
    local fw_key="$device_fw_key"
    if [[ $2 == "base" ]]; then
        fw_key="$device_fw_key_base"
    fi
    local name=$(echo $fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
    if [[ -z $name && $getcomp != "manifest" ]]; then
        error "Issue with firmware keys: Failed getting $getcomp. Check The Apple Wiki or your wikiproxy"
    fi
    local str="<key>$comp</key><dict><key>File</key><string>$all_flash/"
    local str2
    local logostuff
    if [[ $2 == "target" ]]; then
        case $comp in
            *"AppleLogo" )
                if [[ $device_latest_vers == "5"* ]]; then
                    logostuff=1
                else
                    case $device_target_vers in
                        [789]* ) logostuff=1;;
                    esac
                fi
            ;;
        esac
        case $comp in
            "AppleLogo" ) str2="${name/applelogo/applelogo7}";;
            "APTicket" ) str2="${name/applelogo/applelogoT}";;
            "RecoveryMode" ) str2="${name/recoverymode/recoverymode7}";;
            "NewiBoot" ) str2="${name/iBoot/iBoot2}";;
        esac
        case $comp in
            "AppleLogo" )
                str+="$str2"
                if [[ $logostuff == 1 ]]; then
                    echo "$str2" >> $FirmwareBundle/manifest
                fi
            ;;
            "APTicket" | "RecoveryMode" )
                str+="$str2"
                echo "$str2" >> $FirmwareBundle/manifest
            ;;
            "NewiBoot" )
                if [[ $device_type != "iPad1,1" ]]; then
                    str+="$str2"
                    echo "$str2" >> $FirmwareBundle/manifest
                fi
            ;;
            "manifest" ) str+="manifest";;
            * ) str+="$name";;
        esac
    else
        str+="$name"
    fi
    str+="</string>"

    if [[ $comp == "NewiBoot" ]]; then
        local iv=$(echo $fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        local key=$(echo $fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        str+="<key>IV</key><string>$iv</string><key>Key</key><string>$key</string>"
    elif [[ $comp == "manifest" ]]; then
        str+="<key>manifest</key><string>manifest</string>"
    fi

    echo "$str</dict>" >> $NewPlist
}

ipsw_prepare_config() {
    # usage: ipsw_prepare_config [jailbreak (true/false)] [needpref (true/false)]
    # creates config file to FirmwareBundles/config.plist
    local bootargs_enabled="false"
    local bootargs="$device_bootargs_default"
    if [[ $ipsw_verbose == 1 ]]; then
        bootargs_enabled="true"
        bootargs="pio-error=0 -v"
    fi
    if [[ -n $device_bootargs ]]; then
        bootargs_enabled="true"
        bootargs+=" $device_bootargs"
    fi
    log "Preparing config file"
    echo "<plist>
<dict>
    <key>FilesystemJailbreak</key>
    <$1/>
    <key>needPref</key>
    <$2/>
    <key>iBootPatches</key>
    <dict>
        <key>debugEnabled</key>
        <false/>
        <key>bootArgsInjection</key>
        <$bootargs_enabled/>
        <key>bootArgsString</key>
        <string>$bootargs</string>
    </dict>
</dict>
</plist>" | tee FirmwareBundles/config.plist
}

ipsw_prepare_systemversion() {
    local sysplist="SystemVersion.plist"
    log "Beta iOS detected, preparing modified $sysplist"
    echo '<plist><dict>' > $sysplist
    echo "<key>ProductBuildVersion</key><string>$device_target_build</string>" >> $sysplist
    local copyright="<key>ProductCopyright</key><string>1983-201"
    case $device_target_vers in
        3* ) copyright+="0";;
        4* ) copyright+="1";;
        5* ) copyright+="2";;
        6* ) copyright+="3";;
        7* ) copyright+="4";;
        8* ) copyright+="5";;
        9* ) copyright+="6";;
    esac
    copyright+=" Apple Inc.</string>"
    echo "$copyright" >> $sysplist # idk if the copyright key is actually needed but whatever
    echo "<key>ProductName</key><string>iPhone OS</string>" >> $sysplist
    echo "<key>ProductVersion</key><string>$device_target_vers</string>" >> $sysplist
    echo "</dict></plist>" >> $sysplist
    cat $sysplist
    mkdir -p System/Library/CoreServices
    mv SystemVersion.plist System/Library/CoreServices
    tar -cvf systemversion.tar System
}

ipsw_prepare_bundle() {
    device_fw_key_check $1
    local ipsw_p="$ipsw_path"
    local key="$device_fw_key"
    local vers="$device_target_vers"
    local build="$device_target_build"
    local hw="$device_model"
    local base_build="11D257"
    local RootSize
    local daibutsu
    FirmwareBundle="FirmwareBundles/"
    if [[ $1 == "daibutsu" ]]; then
        daibutsu=1
    fi

    mkdir -p FirmwareBundles
    if [[ $1 == "base" ]]; then
        ipsw_p="$ipsw_base_path"
        key="$device_fw_key_base"
        vers="$device_base_vers"
        build="$device_base_build"
        FirmwareBundle+="BASE_"
    elif [[ $1 == "target" ]]; then
        if [[ $ipsw_jailbreak == 1 ]]; then
            case $vers in
                [689]* ) ipsw_prepare_config true true;;
                * ) ipsw_prepare_config false true;;
            esac
        else
            ipsw_prepare_config false true
        fi
    elif [[ $ipsw_jailbreak == 1 ]]; then
        ipsw_prepare_config false true
    else
        ipsw_prepare_config false false
    fi
    local FirmwareBundle2="../resources/firmware/FirmwareBundles/Down_${device_type}_${vers}_${build}.bundle"
    if [[ $ipsw_prepare_usepowder == 1 ]]; then
        FirmwareBundle2=
    elif [[ -d $FirmwareBundle2 ]]; then
        FirmwareBundle+="Down_"
    fi
    FirmwareBundle+="${device_type}_${vers}_${build}.bundle"
    local NewPlist=$FirmwareBundle/Info.plist
    mkdir -p $FirmwareBundle

    log "Generating firmware bundle for $device_type-$vers ($build) $1..."
    file_extract_from_archive "$ipsw_p.ipsw" $all_flash/manifest
    mv manifest $FirmwareBundle/
    local ramdisk_name=$(echo "$key" | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .filename')
    ramdisk_name="${ramdisk_name%%.dmg*}.dmg"
    local RamdiskIV=$(echo "$key" | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .iv')
    local RamdiskKey=$(echo "$key" | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .key')
    if [[ -z $ramdisk_name ]]; then
        error "Issue with firmware keys: Failed getting RestoreRamdisk. Check The Apple Wiki or your wikiproxy"
    fi
    file_extract_from_archive "$ipsw_p.ipsw" $ramdisk_name
    "$dir/xpwntool" $ramdisk_name Ramdisk.raw -iv $RamdiskIV -k $RamdiskKey
    "$dir/hfsplus" Ramdisk.raw extract usr/local/share/restore/options.$device_model.plist
    if [[ ! -s options.$device_model.plist ]]; then
        rm options.$device_model.plist
        "$dir/hfsplus" Ramdisk.raw extract usr/local/share/restore/options.plist
        mv options.plist options.$device_model.plist
    fi
    local ver2="${device_target_vers:0:1}"
    if [[ ! -s options.$device_model.plist ]] && (( ver2 >= 4 )); then
        error "Failed to extract options plist from restore ramdisk. Probably an issue with firmware keys."
    fi
    if [[ $device_target_vers == "3.2"* ]]; then
        RootSize=1000
    elif [[ $ver2 == 3 ]]; then
        case $device_type in
            iPhone1,* | iPod1,1 ) RootSize=420;;
            iPod2,1 ) RootSize=450;;
            *       ) RootSize=750;;
        esac
    elif [[ $platform == "macos" ]]; then
        plutil -extract 'SystemPartitionSize' xml1 options.$device_model.plist -o size
        RootSize=$(cat size | sed -ne '/<integer>/,/<\/integer>/p' | sed -e "s/<integer>//" | sed "s/<\/integer>//" | sed '2d')
    else
        RootSize=$(cat options.$device_model.plist | grep -i SystemPartitionSize -A 1 | grep -oPm1 "(?<=<integer>)[^<]+")
    fi
    RootSize=$((RootSize+30))
    local rootfs_name="$(echo "$key" | $jq -j '.keys[] | select(.image == "RootFS") | .filename')"
    rootfs_name="${rootfs_name%%.dmg*}.dmg"
    local rootfs_key="$(echo "$key" | $jq -j '.keys[] | select(.image == "RootFS") | .key')"
    if [[ -z $rootfs_name ]]; then
        error "Issue with firmware keys: Failed getting RootFS. Check The Apple Wiki or your wikiproxy"
    fi
    echo '<plist><dict>' > $NewPlist
    echo "<key>Filename</key><string>$ipsw_p.ipsw</string>" >> $NewPlist
    echo "<key>RootFilesystem</key><string>$rootfs_name</string>" >> $NewPlist
    echo "<key>RootFilesystemKey</key><string>$rootfs_key</string>" >> $NewPlist
    echo "<key>RootFilesystemSize</key><integer>$RootSize</integer>" >> $NewPlist
    printf "<key>RamdiskOptionsPath</key><string>/usr/local/share/restore/options" >> $NewPlist
    if [[ $device_target_vers != "3"* && $device_target_vers != "4"* ]] ||
       [[ $device_type == "iPad1,1" && $device_target_vers == "4"* ]]; then
        printf ".%s" "$device_model" >> $NewPlist
    fi
    echo ".plist</string>" >> $NewPlist
    if [[ $1 == "base" ]]; then
        echo "<key>SHA1</key><string>$device_base_sha1</string>" >> $NewPlist
    else
        echo "<key>SHA1</key><string>$device_target_sha1</string>" >> $NewPlist
    fi

    if [[ $1 == "base" ]]; then
        case $device_type in
            iPhone5,[12] ) hw="iphone5";;
            iPhone5,[34] ) hw="iphone5b";;
            iPad2,[123]  ) hw="ipad2";;
            iPad2,[567]  ) hw="ipad2b";;
            iPad3,[123]  ) hw="ipad3";;
            iPad3,[456]  ) hw="ipad3b";;
        esac
        case $device_base_build in
            11[AB]* ) base_build="11B554a";;
            9B*     ) base_build="9B206";;
            9A*     ) base_build="9A405";;
        esac
        echo "<key>RamdiskExploit</key><dict>" >> $NewPlist
        echo "<key>exploit</key><string>src/target/$hw/$base_build/exploit</string>" >> $NewPlist
        echo "<key>inject</key><string>partition</string></dict>" >> $NewPlist
    elif [[ $1 == "target" ]]; then
        echo "<key>FilesystemPackage</key><dict><key>bootstrap</key><string>freeze.tar</string>" >> $NewPlist
        case $vers in
            8* | 9* ) echo "<key>package</key><string>src/ios9.tar</string>" >> $NewPlist;;
        esac
        printf "</dict><key>RamdiskPackage</key><dict><key>package</key><string>src/bin.tar</string><key>ios</key><string>ios" >> $NewPlist
        [[ $ipsw_jailbreak == 1 ]] && printf "%s" "${vers:0:1}" >> "$NewPlist"
        echo "</string></dict>" >> $NewPlist
    elif [[ $ipsw_prepare_usepowder == 1 ]]; then
        echo "<key>FilesystemPackage</key><dict/><key>RamdiskPackage</key><dict/>" >> $NewPlist
    elif [[ $ipsw_isbeta == 1 && $ipsw_prepare_usepowder != 1 ]]; then
        warn "iOS 4.1 beta or older detected. Attempting workarounds"
        cp $FirmwareBundle2/* $FirmwareBundle
        echo "<key>RamdiskPatches</key><dict/>" >> $NewPlist
        echo "<key>FilesystemPatches</key><dict/>" >> $NewPlist
        ipsw_isbeta_needspatch=1
    elif [[ -d $FirmwareBundle2 ]]; then
        cp $FirmwareBundle2/* $FirmwareBundle
        echo "<key>RamdiskPatches</key><dict>" >> $NewPlist
        echo "<key>asr</key><dict>" >> $NewPlist
        echo "<key>File</key><string>usr/sbin/asr</string><key>Patch</key><string>asr.patch</string></dict>" >> $NewPlist
        if [[ -s $FirmwareBundle/restoredexternal.patch ]]; then
            echo "<key>restoredexternal</key><dict>" >> $NewPlist
            echo "<key>File</key><string>usr/local/bin/restored_external</string><key>Patch</key><string>restoredexternal.patch</string></dict>" >> $NewPlist
        fi
        echo "</dict>" >> $NewPlist
        if [[ $ipsw_hacktivate == 1 ]]; then
            echo "<key>FilesystemPatches</key><dict>" >> $NewPlist
            echo "<key>Hacktivation</key><array><dict>" >> $NewPlist
            echo "<key>Action</key><string>Patch</string><key>File</key><string>usr/libexec/lockdownd</string>" >> $NewPlist
            echo "<key>Patch</key><string>lockdownd.patch</string></dict></array></dict>" >> $NewPlist
        else
            echo "<key>FilesystemPatches</key><dict/>" >> $NewPlist # ipsw segfaults if this is missing lol
        fi
    fi

    if [[ $1 == "base" ]]; then
        echo "<key>Firmware</key><dict/>" >> $NewPlist
    elif [[ $1 == "target" && $vers == "4"* ]]; then
        echo "<key>Firmware</key><dict>" >> $NewPlist
        ipsw_prepare_keys iBSS $1
        ipsw_prepare_keys RestoreRamdisk $1
        echo "</dict>" >> $NewPlist
    elif [[ $ipsw_isbeta_needspatch == 1 ]]; then
        echo "<key>FirmwarePatches</key><dict>" >> $NewPlist
        ipsw_prepare_keys RestoreDeviceTree $1
        ipsw_prepare_keys RestoreLogo $1
        ipsw_prepare_keys RestoreKernelCache $1
        ipsw_prepare_keys RestoreRamdisk $1
        echo "</dict>" >> $NewPlist
    elif [[ $device_target_build == "14"* ]]; then
        echo "<key>Firmware</key><dict>" >> $NewPlist
        ipsw_prepare_keys iBSS
        ipsw_prepare_keys iBEC
        ipsw_prepare_keys RestoreRamdisk
    else
        if [[ $ipsw_prepare_usepowder == 1 ]]; then
            echo "<key>Firmware</key><dict>" >> $NewPlist
        else
            echo "<key>FirmwarePatches</key><dict>" >> $NewPlist
        fi
        ipsw_prepare_keys iBSS $1
        # ios 4 and lower do not need ibec patches. the exception is the ipad lineup
        if [[ $vers != "3"* && $vers != "4"* ]] || [[ $device_type == "iPad1,1" || $device_type == "iPad2"* ]]; then
            ipsw_prepare_keys iBEC $1
        fi
        if [[ $device_proc == 1 && $device_target_vers != "4.2.1" ]]; then
            :
        else
            ipsw_prepare_keys RestoreDeviceTree $1
            ipsw_prepare_keys RestoreLogo $1
        fi
        if [[ $1 == "target" ]]; then
            case $vers in
                [457]* ) ipsw_prepare_keys RestoreKernelCache $1;;
                * ) ipsw_prepare_keys KernelCache $1;;
            esac
        elif [[ $device_proc == 1 && $device_target_vers == "4.2.1" ]]; then
            ipsw_prepare_keys RestoreKernelCache $1
        elif [[ $device_proc != 1 && $device_target_vers != "3.0"* ]]; then
            ipsw_prepare_keys RestoreKernelCache $1
        fi
        ipsw_prepare_keys RestoreRamdisk $1
        if [[ $1 == "old" ]]; then
            if [[ $ipsw_24o == 1 ]]; then # old bootrom ipod2,1 3.1.3
                ipsw_prepare_keys iBoot $1
                ipsw_prepare_keys KernelCache $1
            elif [[ $device_type == "iPod2,1" && $device_target_vers == "3.1.3" ]]; then
                : # dont patch iboot/kcache for new bootrom ipod2,1 3.1.3
            elif [[ $device_proc == 1 ]]; then
                ipsw_prepare_keys KernelCache $1
                ipsw_prepare_keys WTF2 $1
            else
                case $device_target_vers in
                    $device_latest_vers | 4.1 ) :;;
                    3.0* ) ipsw_prepare_keys iBoot $1;;
                    * )
                        ipsw_prepare_keys iBoot $1
                        ipsw_prepare_keys KernelCache $1
                    ;;
                esac
            fi
        fi
        echo "</dict>" >> $NewPlist
    fi

    if [[ $1 == "base" ]]; then
        echo "<key>FirmwarePath</key><dict>" >> $NewPlist
        ipsw_prepare_paths AppleLogo $1
        ipsw_prepare_paths BatteryCharging0 $1
        ipsw_prepare_paths BatteryCharging1 $1
        ipsw_prepare_paths BatteryFull $1
        ipsw_prepare_paths BatteryLow0 $1
        ipsw_prepare_paths BatteryLow1 $1
        ipsw_prepare_paths BatteryPlugin $1
        ipsw_prepare_paths RecoveryMode $1
        ipsw_prepare_paths LLB $1
        ipsw_prepare_paths iBoot $1
        echo "</dict>" >> $NewPlist
    elif [[ $1 == "target" ]]; then
        echo "<key>FirmwareReplace</key><dict>" >> $NewPlist
        if [[ $vers == "4"* ]]; then
            ipsw_prepare_paths APTicket $1
        fi
        ipsw_prepare_paths AppleLogo $1
        ipsw_prepare_paths NewAppleLogo $1
        ipsw_prepare_paths BatteryCharging0 $1
        ipsw_prepare_paths BatteryCharging1 $1
        ipsw_prepare_paths BatteryFull $1
        ipsw_prepare_paths BatteryLow0 $1
        ipsw_prepare_paths BatteryLow1 $1
        ipsw_prepare_paths BatteryPlugin $1
        ipsw_prepare_paths RecoveryMode $1
        ipsw_prepare_paths NewRecoveryMode $1
        ipsw_prepare_paths LLB $1
        ipsw_prepare_paths iBoot $1
        ipsw_prepare_paths NewiBoot $1
        ipsw_prepare_paths manifest $1
        echo "</dict>" >> $NewPlist
    fi

    if [[ $daibutsu == 1 ]]; then
        if [[ $ipsw_prepare_usepowder == 1 ]]; then
            echo "<key>RamdiskPackage2</key>" >> $NewPlist
        else
            echo "<key>PackagePath</key><string>./freeze.tar</string>" >> $NewPlist
            echo "<key>RamdiskPackage</key>" >> $NewPlist
        fi
        echo "<string>./bin.tar</string><key>RamdiskReboot</key><string>./reboot.sh</string><key>UntetherPath</key><string>./untether.tar</string>" >> $NewPlist
        local hwmodel="$(tr '[:lower:]' '[:upper:]' <<< ${device_model:0:1})${device_model:1}"
        echo "<key>hwmodel</key><string>$hwmodel</string>" >> $NewPlist
    fi

    echo "</dict></plist>" >> $NewPlist
    cat $NewPlist
}

ipsw_prepare_32bit() {
    local ExtraArgs
    local daibutsu
    local JBFiles=()
    # redirect to ipsw_prepare_jailbreak for 4.1 and lower
    case $device_target_vers in
        [23]* | 4.[01]* ) ipsw_prepare_jailbreak $1; return;;
        10* )
            if [[ ! -s "$ipsw_custom.ipsw" && $ipsw_gasgauge_patch == 1 ]]; then
                log "Copying custom IPSW..."
                cp "$ipsw_path.ipsw" "$ipsw_custom.ipsw"
            fi
            return
        ;;
    esac
    # use everuntether+jsc_untether instead of everuntether+dsc haxx for a5(x) 8.0-8.2
    if [[ $device_proc == 5 && $ipsw_jailbreak == 1 ]]; then
        case $device_target_vers in
            8.[012]* )
                ipsw_everuntether=1
                JBFiles=("everuntether.tar")
            ;;
        esac
    fi
    if [[ -s "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    elif [[ $ipsw_jailbreak == 1 && $ipsw_everuntether != 1 ]]; then
        if [[ $device_target_vers == "8."* ]]; then
            daibutsu="daibutsu"
            ExtraArgs+=" -daibutsu"
            cp $jelbrek/daibutsu/bin.tar $jelbrek/daibutsu/untether.tar .
            ipsw_prepare_rebootsh
        elif [[ $device_target_vers == "7."* ]]; then
            daibutsu="daibutsu"
            ExtraArgs+=" -daibutsu"
            cp $jelbrek/daibutsu/bin.tar .
            cp $jelbrek/aquila_7.tar untether.tar
            ipsw_prepare_rebootsh aquila
        fi
    elif [[ $ipsw_nskip == 1 ]]; then
        :
    elif [[ $ipsw_jailbreak != 1 && $device_target_build != "9A406" && # 9a406 needs custom ipsw
            $device_proc != 4 && $device_actrec != 1 && $device_target_tethered != 1 && $ipsw_isbeta != 1 ]]; then
        log "No need to create custom IPSW for non-jailbroken restores on $device_type-$device_target_build"
        return
    fi
    ipsw_prepare_usepowder=1

    ipsw_prepare_bundle $daibutsu

    if [[ $ipsw_memory == 1 ]]; then
        ExtraArgs+=" -memory"
    fi
    ExtraArgs+=" -ramdiskgrow 10"
    if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]]; then
        ExtraArgs+=" -bbupdate"
    fi

    if [[ $ipsw_jailbreak == 1 ]]; then
        case $device_target_vers in
            9.3.[56] ) :;;
            9.*  ) JBFiles=("everuntether.tar");;
            6.*  ) JBFiles=("aquila_6.tar");;
            5.*  ) JBFiles=("aquila_5.tar");;
            4.3* ) JBFiles=("aquila_4.tar");;
            4.2.[8761] )
                ExtraArgs+=" -punchd"
                JBFiles=("greenpois0n/${device_type}_${device_target_build}.tar")
            ;;
        esac

        # temporary measure for a6 ios 6
        if [[ $device_proc == 6 ]]; then
            case $device_target_vers in
                6.1.[34] ) JBFiles=("p0sixspwn.tar");;
                6.*      ) JBFiles=("evasi0n6-untether.tar");;
            esac
        fi
        # temporary measure for a5 ios 5
        if [[ $device_proc == 5 && $device_target_vers == "5."* ]]; then
            JBFiles=("g1lbertJB/${device_type}_${device_target_build}.tar")
        fi

        if [[ -n ${JBFiles[0]} ]]; then
            JBFiles[0]=$jelbrek/${JBFiles[0]}
        fi
        case $device_target_vers in
            [98].* ) JBFiles+=("$jelbrek/fstab8.tar");;
            7.*    ) JBFiles+=("$jelbrek/fstab7.tar");;
            4.*    ) JBFiles+=("$jelbrek/fstab_old.tar");;
            *      ) JBFiles+=("$jelbrek/fstab_rw.tar");;
        esac
        JBFiles+=("freeze.tar")
        case $device_target_vers in
            9.* ) JBFiles+=("$jelbrek/launchctl.tar" "$jelbrek/zebra.tar");;
            5.* ) JBFiles+=("$jelbrek/cydiasubstrate.tar");;
        esac
        if [[ $ipsw_openssh == 1 ]]; then
            cp $jelbrek/openssh.tar.gz $jelbrek/openssl.tar.gz .
            gzip -d openssh.tar.gz
            gzip -d openssl.tar.gz
            JBFiles+=("$jelbrek/sshdeb.tar" "openssh.tar" "openssl.tar")
        fi

        # temporary measure for a5 ios 5
        if [[ $device_proc == 5 && $device_target_vers == "5."* && $device_target_tethered == 1 ]]; then
            JBFiles+=("$jelbrek/g1lbertJB/install.tar")
        fi

        case $device_target_vers in
            [43]* ) :;;
            * ) JBFiles+=("$jelbrek/LukeZGD.tar");;
        esac
        cp $jelbrek/freeze.tar.gz .
        gzip -d freeze.tar.gz
    fi

    if [[ $ipsw_isbeta == 1 ]]; then
        ipsw_prepare_systemversion
        ExtraArgs+=" systemversion.tar"
    fi
    if [[ $1 == "iboot" ]]; then
        ExtraArgs+=" iBoot.tar"
    fi
    if [[ $device_type == "$device_disable_bbupdate" && $device_deadbb != 1 ]]; then
        ExtraArgs+=" ../saved/$device_type/baseband-$device_ecid.tar"
    fi
    if [[ $device_actrec == 1 ]]; then
        ExtraArgs+=" ../saved/$device_type/activation-$device_ecid.tar"
    fi

    log "Preparing custom IPSW: $dir/powdersn0w $ipsw_path.ipsw temp.ipsw $ExtraArgs ${JBFiles[*]}"
    "$dir/powdersn0w" "$ipsw_path.ipsw" temp.ipsw $ExtraArgs ${JBFiles[@]}

    if [[ ! -e temp.ipsw ]]; then
        if [[ $platform == "macos" && $platform_arch == "arm64" ]]; then
            warn "Updating to macOS 12.6 or newer is recommended for Apple Silicon Macs to resolve issues."
        fi
        error "Failed to find custom IPSW. Please run the script again" \
              "* You may try selecting N for memory option"
    fi

    ipsw_prepare_fourthree
    ipsw_bbreplace
    if [[ $target_vers_maj == 4 ]]; then
        ipsw_prepare_ios4patches
        log "Add all to custom IPSW"
        zip -r0 temp.ipsw Firmware/dfu/*
    fi

    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_bbdigest() {
    local loc="BuildIdentities:0:"
    if [[ $2 != "UniqueBuildID" ]]; then
        loc+="Manifest:BasebandFirmware:"
    fi
    loc+="$2"
    local out="$1"
    log "Replacing $2"
    if [[ $platform == "macos" ]]; then
        echo $out | base64 --decode > t
        $PlistBuddy -c "Import $loc t" BuildManifest.plist
        rm t
        return
    fi
    in=$($PlistBuddy -c "Print $loc" BuildManifest.plist | tr -d "<>" | xxd -r -p | base64)
    in="${in}<"
    in="$(echo "$in" | sed -e 's,AAAAAAAAAAAAAAAAAAAAAAA<,==,' \
                           -e 's,AAAAAAAAAAAAA<,=,' \
                           -e 's,AAAAAAAAA<,=,')"
    case $2 in
        *"PartialDigest" )
            in="${in%????????????}"
            in=$(grep -m1 "$in" BuildManifest.plist)
            sed "s,$in,replace," BuildManifest.plist | \
            awk 'f{f=0; next} /replace/{f=1} 1' | \
            awk '/replace$/{printf "%s", $0; next} 1' > tmp.plist
            in="replace"
        ;;
        * ) mv BuildManifest.plist tmp.plist;;
    esac
    sed "s,$in,$out," tmp.plist > BuildManifest.plist
    rm tmp.plist
}

ipsw_bbreplace() {
    local rsb1
    local sbl1
    local path
    local rsb_latest
    local sbl_latest
    local bbfw="Print BuildIdentities:0:Manifest:BasebandFirmware"
    local ubid
    if [[ $device_use_bb == 0 || $device_target_vers == "$device_latest_vers" ||
          $device_type == "$device_disable_bbupdate" ]] || (( device_proc < 5 )); then
        return
    fi

    if [[ $1 != "exist" ]]; then
        log "Extracting BuildManifest from IPSW"
        file_extract_from_archive temp.ipsw BuildManifest.plist
    fi
    mkdir -p Firmware
    restore_download_bbsep
    cp $restore_baseband Firmware/$device_use_bb

    case $device_type in
        iPhone4,1 ) ubid="d9Xbp0xyiFOxDvUcKMsoNjIvhwQ=";;
        iPhone5,1 ) ubid="IcrFKRzWDvccKDfkfMNPOPYHEV0=";;
        iPhone5,2 ) ubid="lnU0rtBUK6gCyXhEtHuwbEz/IKY=";;
        iPhone5,3 ) ubid="dwrol4czV3ijtNHh3w1lWIdsNdA=";;
        iPhone5,4 ) ubid="Z4ST0TczwAhpfluQFQNBg7Y3BVE=";;
        iPad2,6 ) ubid="L73HfN42pH7qAzlWmsEuIZZg2oE=";;
        iPad2,7 ) ubid="z/vJsvnUovZ+RGyXKSFB6DOjt1k=";;
        iPad3,5 ) ubid="849RPGQ9kNXGMztIQBhVoU/l5lM=";;
        iPad3,6 ) ubid="cO+N+Eo8ynFf+0rnsIWIQHTo6rg=";;
    esac
    ipsw_bbdigest $ubid UniqueBuildID

    case $device_type in
        iPhone4,1 )
            rsb1=$($PlistBuddy -c "$bbfw:eDBL-Version" BuildManifest.plist)
            sbl1=$($PlistBuddy -c "$bbfw:RestoreDBL-Version" BuildManifest.plist)
            path=$($PlistBuddy -c "$bbfw:Info:Path" BuildManifest.plist | tr -d '"')
            rsb_latest="-1577031936"
            sbl_latest="-1575983360"
            ipsw_bbdigest XAAAAADHAQCqerR8d+PvcfusucizfQ4ECBI0TA== RestoreDBL-PartialDigest
            ipsw_bbdigest Q1TLjk+/PjayCzSJJo68FTtdhyE= AMSS-HashTableDigest
            ipsw_bbdigest KkJI7ufv5tfNoqHcrU7gqoycmXA= OSBL-DownloadDigest
            ipsw_bbdigest eAAAAADIAQDxcjzF1q5t+nvLBbvewn/arYVkLw== eDBL-PartialDigest
            ipsw_bbdigest 3CHVk7EmtGjL14ApDND81cqFqhM= AMSS-DownloadDigest
        ;;
        iPhone5,[12] | iPad2,[67] | iPad3,[56] )
            rsb1=$($PlistBuddy -c "$bbfw:RestoreSBL1-Version" BuildManifest.plist)
            sbl1=$($PlistBuddy -c "$bbfw:SBL1-Version" BuildManifest.plist)
            path=$($PlistBuddy -c "$bbfw:Info:Path" BuildManifest.plist | tr -d '"')
            rsb_latest="-1559114512"
            sbl_latest="-1560163088"
            ipsw_bbdigest 2bmJ7Vd+WAmogV+hjq1a86UlBvA= APPS-DownloadDigest
            ipsw_bbdigest oNmIZf39zd94CPiiKOpKvhGJbyg= APPS-HashTableDigest
            ipsw_bbdigest dFi5J+pSSqOfz31fIvmah2GJO+E= DSP1-DownloadDigest
            ipsw_bbdigest HXUnmGmwIHbVLxkT1rHLm5V6iDM= DSP1-HashTableDigest
            ipsw_bbdigest oA5eQ8OurrWrFpkUOhD/3sGR3y8= DSP2-DownloadDigest
            ipsw_bbdigest L7v8ulq1z1Pr7STR47RsNbxmjf0= DSP2-HashTableDigest
            ipsw_bbdigest MZ1ERfoeFcbe79pFAl/hbWUSYKc= DSP3-DownloadDigest
            ipsw_bbdigest sKmLhQcjfaOliydm+iwxucr9DGw= DSP3-HashTableDigest
            ipsw_bbdigest oiW/8qZhN0r9OaLdUHCT+MMGknY= RPM-DownloadDigest
            ipsw_bbdigest fAAAAEAQAgAH58t5X9KETIPrycULi8dg7b2rSw== RestoreSBL1-PartialDigest
            ipsw_bbdigest ZAAAAIC9AQAfgUcPMN/lMt+U8s6bxipdy6td6w== SBL1-PartialDigest
            ipsw_bbdigest kHLoJsT9APu4Xwu/aRjNK10Hx84= SBL2-DownloadDigest
        ;;
        iPhone5,[34] )
            rsb1=$($PlistBuddy -c "$bbfw:RestoreSBL1-Version" BuildManifest.plist)
            sbl1=$($PlistBuddy -c "$bbfw:SBL1-Version" BuildManifest.plist)
            path=$($PlistBuddy -c "$bbfw:Info:Path" BuildManifest.plist | tr -d '"')
            rsb_latest="-1542379296"
            sbl_latest="-1543427872"
            ipsw_bbdigest TSVi7eYY4FiAzXynDVik6TY2S1c= APPS-DownloadDigest
            ipsw_bbdigest xd/JBOTxYJWmLkTWqLWl8GeINgU= APPS-HashTableDigest
            ipsw_bbdigest RigCEz69gUymh2UdyJdwZVx74Ic= DSP1-DownloadDigest
            ipsw_bbdigest a3XhREtzynTWtyQGqi/RXorXSVE= DSP1-HashTableDigest
            ipsw_bbdigest 3JTgHWvC+XZYWa5U5MPvle+imj4= DSP2-DownloadDigest
            ipsw_bbdigest Hvppb92/1o/cWQbl8ftoiW5jOLg= DSP2-HashTableDigest
            ipsw_bbdigest R60ZfsOqZX+Pd/UnEaEhWfNvVlY= DSP3-DownloadDigest
            ipsw_bbdigest DFQWkktFWNh90G2hOfwO14oEbrI= DSP3-HashTableDigest
            ipsw_bbdigest Rsn+u2mOpYEmdrw98yA8EDT5LiE= RPM-DownloadDigest
            ipsw_bbdigest cAAAAIC9AQBLeCHzsjHo8Q7+IzELZTV/ri/Vow== RestoreSBL1-PartialDigest
            ipsw_bbdigest eAAAAEBsAQB9b44LqXjR3izAYl5gB4j3Iqegkg== SBL1-PartialDigest
            ipsw_bbdigest iog3IVe+8VqgQzP2QspgFRUNwn8= SBL2-DownloadDigest
        ;;
    esac

    log "Replacing $rsb1 with $rsb_latest"
    log "Replacing $sbl1 with $sbl_latest"
    log "Replacing $path with Firmware/$device_use_bb"
    sed -e "s,$rsb1,$rsb_latest," \
        -e "s,$sbl1,$sbl_latest," \
        -e "s,$path,Firmware/$device_use_bb," BuildManifest.plist > tmp.plist
    mv tmp.plist BuildManifest.plist

    zip -r0 temp.ipsw Firmware/$device_use_bb BuildManifest.plist
}

patch_iboot() {
    device_fw_key_check
    local iboot_name=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "iBoot") | .filename')
    local iboot_iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "iBoot") | .iv')
    local iboot_key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "iBoot") | .key')
    if [[ -z $iboot_name ]]; then
        error "Issue with firmware keys: Failed getting iBoot. Check The Apple Wiki or your wikiproxy"
    fi
    local rsa="--rsa"
    log "Patch iBoot: $*"
    if [[ $1 == "--logo" ]]; then
        iboot_name="${iboot_name/iBoot/iBoot2}"
        rsa=
        file_extract_from_archive temp.ipsw $all_flash/$iboot_name
    else
        file_extract_from_archive "$ipsw_path.ipsw" $all_flash/$iboot_name
    fi
    mv $iboot_name iBoot.orig
    "$dir/xpwntool" iBoot.orig iBoot.dec -iv $iboot_iv -k $iboot_key
    "$dir/iBoot32Patcher" iBoot.dec iBoot.pwned $rsa "$@"
    "$dir/xpwntool" iBoot.pwned iBoot -t iBoot.orig
    if [[ $device_type == "iPad1,1" || $device_type == "iPhone5,"* ]]; then
        echo "0000010: 6365" | xxd -r - iBoot
        echo "0000020: 6365" | xxd -r - iBoot
        return
    elif [[ $device_type != "iPhone2,1" ]]; then
        echo "0000010: 626F" | xxd -r - iBoot
        echo "0000020: 626F" | xxd -r - iBoot
    fi
    "$dir/xpwntool" iBoot.pwned $iboot_name -t iBoot -iv $iboot_iv -k $iboot_key
}

ipsw_patch_file() {
    # usage: ipsw_patch_file <ramdisk/fs> <location> <filename> <patchfile>
    "$dir/hfsplus" "$1" extract "$2"/"$3"
    "$dir/hfsplus" "$1" rm "$2"/"$3"
    $bspatch "$3" "$3".patched "$4"
    "$dir/hfsplus" "$1" add "$3".patched "$2"/"$3"
    "$dir/hfsplus" "$1" chmod 755 "$2"/"$3"
    "$dir/hfsplus" "$1" chown 0:0 "$2"/"$3"
}

ipsw_prepare_ios4multipart() {
    local JBFiles=()
    ipsw_custom_part1="../${device_type}_${device_target_vers}_${device_target_build}_CustomNP-${device_ecid}"
    local all_flash2="$ipsw_custom_part1/$all_flash"
    local iboot

    if [[ -e "$ipsw_custom_part1.ipsw" && -e "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSWs. Skipping IPSW creation."
        return
    elif [[ -e "$ipsw_custom_part1.ipsw" ]]; then
        rm -f "$ipsw_custom_part1.ipsw"
    fi

    log "Preparing NOR flash IPSW..."
    mkdir -p $ipsw_custom_part1/Firmware/dfu $ipsw_custom_part1/Downgrade $all_flash2

    local comps=("iBSS" "iBEC" "DeviceTree" "Kernelcache" "RestoreRamdisk")
    local name
    local iv
    local key
    local path
    local vers="5.1.1"
    local build="9B206"
    local saved_path="../saved/$device_type/$build"
    ipsw_get_url $build
    local url="$ipsw_url"
    device_fw_key_check temp $build

    mkdir -p $saved_path
    log "Getting $vers restore components"
    for getcomp in "${comps[@]}"; do
        name=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
        iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        case $getcomp in
            "iBSS" | "iBEC" ) path="Firmware/dfu/";;
            "DeviceTree" ) path="$all_flash/";;
            * ) path="";;
        esac
        log "$getcomp"
        if [[ $vers == "$device_base_vers" ]]; then
            file_extract_from_archive "$ipsw_base_path.ipsw" ${path}$name
        elif [[ -e $saved_path/$name ]]; then
            cp $saved_path/$name .
        else
            "$dir/pzb" -g "${path}$name" -o "$name" "$url"
            cp $name $saved_path/
        fi
        case $getcomp in
            "DeviceTree" )
                "$dir/xpwntool" $name $ipsw_custom_part1/Downgrade/RestoreDeviceTree -iv $iv -k $key -decrypt
            ;;
            "Kernelcache" )
                "$dir/xpwntool" $name $ipsw_custom_part1/Downgrade/RestoreKernelCache -iv $iv -k $key -decrypt
            ;;
            * )
                mv $name $getcomp.orig
                "$dir/xpwntool" $getcomp.orig $getcomp.dec -iv $iv -k $key
            ;;
        esac
    done

    log "Patch iBSS"
    "$dir/iBoot32Patcher" iBSS.dec iBSS.patched --rsa
    "$dir/xpwntool" iBSS.patched $ipsw_custom_part1/Firmware/dfu/iBSS.${device_model}ap.RELEASE.dfu -t iBSS.orig

    log "Patch iBEC"
    "$dir/iBoot32Patcher" iBEC.dec iBEC.patched --rsa --ticket -b "rd=md0 -v nand-enable-reformat=1 amfi=0xff cs_enforcement_disable=1"
    "$dir/xpwntool" iBEC.patched $ipsw_custom_part1/Firmware/dfu/iBEC.${device_model}ap.RELEASE.dfu -t iBEC.orig

    log "Manifest plist"
    if [[ $vers == "$device_base_vers" ]]; then
        file_extract_from_archive "$ipsw_base_path.ipsw" BuildManifest.plist
    elif [[ -e $saved_path/BuildManifest.plist ]]; then
        cp $saved_path/BuildManifest.plist .
    else
        "$dir/pzb" -g "${path}BuildManifest.plist" -o "BuildManifest.plist" "$url"
        cp BuildManifest.plist $saved_path/
    fi
    $PlistBuddy -c "Set BuildIdentities:0:Manifest:RestoreDeviceTree:Info:Path Downgrade/RestoreDeviceTree" BuildManifest.plist
    $PlistBuddy -c "Set BuildIdentities:0:Manifest:RestoreKernelCache:Info:Path Downgrade/RestoreKernelCache" BuildManifest.plist
    cp BuildManifest.plist $ipsw_custom_part1/

    log "Restore Ramdisk"
    local ramdisk_name=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .filename')
    mv RestoreRamdisk.dec ramdisk.dec
    "$dir/hfsplus" ramdisk.dec grow 18000000

    local rootfs_name=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "RootFS") | .filename')
    touch $ipsw_custom_part1/$rootfs_name
    log "Dummy RootFS: $rootfs_name"

    log "Modify options.plist"
    local options_plist="options.$device_model.plist"
    echo '<plist>
<dict>
    <key>CreateFilesystemPartitions</key>
    <false/>
    <key>UpdateBaseband</key>
    <false/>
    <key>SystemImage</key>
    <false/>
</dict>
</plist>' | tee $options_plist
    "$dir/hfsplus" ramdisk.dec rm usr/local/share/restore/$options_plist
    "$dir/hfsplus" ramdisk.dec add $options_plist usr/local/share/restore/$options_plist

    log "Patch ASR"
    cp ../resources/patch/old/$device_type/$vers/* .
    ipsw_patch_file ramdisk.dec usr/sbin asr asr.patch

    log "Repack Restore Ramdisk"
    "$dir/xpwntool" ramdisk.dec $ipsw_custom_part1/$ramdisk_name -t RestoreRamdisk.orig

    log "Extract all_flash from $device_base_vers base"
    file_extract_from_archive "$ipsw_base_path.ipsw" Firmware/all_flash/\* $all_flash2

    log "Add $device_target_vers DeviceTree to all_flash"
    rm -f $all_flash2/DeviceTree.${device_model}ap.img3
    file_extract_from_archive "$ipsw_path.ipsw" $all_flash/DeviceTree.${device_model}ap.img3 $all_flash2

    local ExtraArr=("--boot-partition" "--boot-ramdisk" "--logo4")
    case $device_target_vers in
        4.2.9 | 4.2.10 ) :;;
        * ) ExtraArr+=("--433");;
    esac
    local bootargs="$device_bootargs_default"
    if [[ $ipsw_verbose == 1 ]]; then
        bootargs="pio-error=0 -v"
    fi
    [[ -n $device_bootargs ]] && bootargs+=" $device_bootargs"
    ExtraArr+=("-b" "$bootargs")
    patch_iboot "${ExtraArr[@]}"

    if [[ $device_type == "iPad1,1" && $device_target_vers == "3"* ]]; then
        cp iBoot ../saved/iPad1,1/iBoot3_$device_ecid
    elif [[ $device_type == "iPad1,1" ]]; then
        cp iBoot iBEC
        tar -cvf iBoot.tar iBEC
        iboot="iboot"
    else
        log "Add $device_target_vers iBoot to all_flash"
        cp iBoot $all_flash2/iBoot2.img3
        echo "iBoot2.img3" >> $all_flash2/manifest
    fi

    log "Add APTicket to all_flash"
    cat "$shsh_path" | sed '64,$d' | sed -ne '/<data>/,/<\/data>/p' | sed -e "s/<data>//" | sed "s/<\/data>//" | tr -d '[:space:]' | base64 --decode > apticket.der
    "$dir/xpwntool" apticket.der $all_flash2/applelogoT.img3 -t ../resources/firmware/src/scab_template.img3
    echo "applelogoT.img3" >> $all_flash2/manifest

    log "AppleLogo"
    local logo_name="$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "AppleLogo") | .filename')"
    if [[ -n $ipsw_customlogo ]]; then
        ipsw_prepare_logos_convert
        mv $all_flash/$logoname $logo_name
    else
        file_extract_from_archive "$ipsw_path.ipsw" $all_flash/$logo_name
        echo "0000010: 3467" | xxd -r - $logo_name
        echo "0000020: 3467" | xxd -r - $logo_name
    fi
    log "Add AppleLogo to all_flash"
    if [[ $device_latest_vers == "5"* ]]; then
        mv $logo_name $all_flash2/applelogo4.img3
        echo "applelogo4.img3" >> $all_flash2/manifest
    else
        sed '/applelogo/d' $all_flash2/manifest > manifest
        rm $all_flash2/manifest
        echo "$logo_name" >> manifest
        mv $logo_name manifest $all_flash2/
    fi

    log "Creating $ipsw_custom_part1.ipsw..."
    pushd $ipsw_custom_part1 >/dev/null
    zip -r0 $ipsw_custom_part1.ipsw *
    popd >/dev/null

    if [[ $ipsw_skip_first == 1 ]]; then
        return
    fi

    # ------ part 1 (nor flash) ends here. start creating part 2 ipsw ------
    ipsw_prepare_32bit $iboot

    ipsw_prepare_ios4multipart_patch=1
    ipsw_prepare_multipatch
}

download_with_pzb() {
    local url="$1"
    local file="$2"
    local file_out="$3"
    local sha="$4"
    log "Downloading $file from: $url"
    "$dir/pzb" -g "$file" -o "$file_out" "$url"
    if [[ -n $sha ]]; then
        local sha_local="$($sha1sum "$file_out" | awk '{print $1}')"
        if [[ $sha_local != "$sha" ]]; then
            error "SHA1sum mismatch. Expected $sha, got $sha_local. Please run the script again"
        fi
    fi
}

ipsw_prepare_specialios7() {
    local all_flash2="$ipsw_custom/$all_flash"
    local patches="../resources/patch/touch4-ios7"
    local saves="../saved/touch4-ios7"
    local ipad1ios7="../saved/ipad1-ios7/repo"
    local kc="../saved/ipad1-ios7/kernelcache.release.n90" # iPhone3,1 7.1.2
    local ramdisk6="../saved/ipad1-ios7/048-2516-005.dmg" # iPad2,1 6.1.3

    if [[ -e "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    fi

    if [[ $device_type == "iPad1,1" ]]; then
        log "Preparing files"
        mkdir -p $ipad1ios7
        if [[ ! -s $kc ]]; then
            local sha="b7b8771c6b54f472b1342f5cb92e3cf730ac9ef7"
            log "Downloading iPhone3,1 7.1.2 kernelcache"
            download_with_pzb "https://secure-appldnld.apple.com/iOS7.1/031-4812.20140627.cq6y8/iPhone3,1_7.1.2_11D257_Restore.ipsw" $(basename $kc) kc $sha
            mv kc $kc
        fi
        if [[ ! -s $ramdisk6 ]]; then
            local sha="dcb5760e02a2abc4cfec610cca8c359179c3eebc"
            log "Downloading iPad2,1 6.1.3 ramdisk"
            download_with_pzb "https://secure-appldnld.apple.com/iOS6.1/091-2397.20130319.EEae9/iPad2,1_6.1.3_10B329_Restore.ipsw" $(basename $ramdisk6) ramdisk6 $sha
            mv ramdisk6 $ramdisk6
        fi

        log "Preparing ipad-1-ios-7"
        if [[ ! -s $ipad1ios7/run.tool ]]; then
            local repo="https://github.com/amy-and-nicole/ipad-1-ios-7"
            rm -rf $ipad1ios7
            log "git clone: $repo"
            git clone $repo $ipad1ios7
        fi
        download_sundancerepo

    else # iPod4,1
        mkdir -p $saves/$device_target_build
    fi

    log "Preparing custom IPSW..."
    mkdir -p $ipsw_custom/Firmware/dfu $ipsw_custom/Downgrade $all_flash2

    local comps=("iBSS" "iBEC" "DeviceTree" "Kernelcache" "RestoreRamdisk"
        "AppleLogo" "BatteryCharging0" "BatteryCharging1" "BatteryFull" "BatteryLow0" "BatteryLow1"
        "GlyphCharging" "GlyphPlugin" "iBoot" "LLB" "RecoveryMode")
    local name
    local iv
    local key
    local path
    device_fw_key_check base

    log "Getting base ($device_base_vers) restore components"
    for getcomp in "${comps[@]}"; do
        name=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
        iv=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        case $getcomp in
            "iBSS" | "iBEC" ) path="Firmware/dfu/";;
            "Kernelcache" | "RestoreRamdisk" ) path="";;
            * ) path="$all_flash/";;
        esac
        log "$getcomp"
        file_extract_from_archive "$ipsw_base_path.ipsw" ${path}$name
        case $getcomp in
            "DeviceTree" )
                cp $name $all_flash2/
                "$dir/xpwntool" $name $ipsw_custom/Downgrade/RestoreDeviceTree -iv $iv -k $key -decrypt
            ;;
            "Kernelcache" )
                "$dir/xpwntool" $name $ipsw_custom/Downgrade/RestoreKernelCache -iv $iv -k $key -decrypt
            ;;
            "AppleLogo" )
                cp $name $all_flash2/
                "$dir/xpwntool" $name $ipsw_custom/Downgrade/RestoreLogo -iv $iv -k $key -decrypt
            ;;
            "iBSS" | "iBEC" | "RestoreRamdisk" )
                mv $name $getcomp.orig
                "$dir/xpwntool" $getcomp.orig $getcomp.dec -iv $iv -k $key
            ;;
            * ) mv $name $all_flash2/;;
        esac
    done

    log "Patch iBSS"
    "$dir/iBoot32Patcher" iBSS.dec iBSS.patched --rsa
    "$dir/xpwntool" iBSS.patched $ipsw_custom/Firmware/dfu/iBSS.${device_model}ap.RELEASE.dfu -t iBSS.orig

    log "Patch iBEC"
    if [[ $device_type == "iPad1,1" ]]; then
        $bspatch iBEC.dec iBEC.patched $patches/iBEC.k48ap.RELEASE.patch
        "$dir/xpwntool" iBEC.patched $ipsw_custom/Firmware/dfu/iBEC.${device_model}ap.RELEASE.dfu -t iBEC.orig
    else # iPod4,1
        "$dir/iBoot32Patcher" iBEC.dec iBEC.patched --rsa --debug --ticket -b "rd=md0 -v amfi=0xff cs_enforcement_disable=1"
        "$dir/xpwntool" iBEC.patched $ipsw_custom/Firmware/dfu/iBEC.${device_model}ap.RELEASE.dfu -t iBEC.orig # restore ibec
        "$dir/iBoot32Patcher" iBEC.dec iBEC.patched --rsa --debug --ticket -b "-v amfi=0xff cs_enforcement_disable=1"
        "$dir/xpwntool" iBEC.patched $saves/pwnediBEC.dfu -t iBEC.orig # boot ibec
    fi

    log "Base manifest plist"
    file_extract_from_archive "$ipsw_base_path.ipsw" BuildManifest.plist
    $PlistBuddy -c "Set BuildIdentities:0:Manifest:RestoreDeviceTree:Info:Path Downgrade/RestoreDeviceTree" BuildManifest.plist
    $PlistBuddy -c "Set BuildIdentities:0:Manifest:RestoreKernelCache:Info:Path Downgrade/RestoreKernelCache" BuildManifest.plist
    $PlistBuddy -c "Set BuildIdentities:0:Manifest:RestoreLogo:Info:Path Downgrade/RestoreLogo" BuildManifest.plist
    $PlistBuddy -c "Set ProductBuildVersion $device_target_build" BuildManifest.plist
    $PlistBuddy -c "Set ProductVersion $device_target_vers" BuildManifest.plist
    cp BuildManifest.plist $ipsw_custom/

    local ramdisk_name=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .filename')
    log "Restore Ramdisk: $ramdisk_name"
    if [[ $device_type == "iPad1,1" ]]; then
        # iPad2,1 6.1.3
        "$dir/xpwntool" $ramdisk6 ramdisk.dec -iv 8775b711d2e09e332f8ebfbebe63cce7 -k d406dc4343eedf9d6567e8303ba39a21f81f99bf701840c888963af58a84fb8f
    else # iPod4,1
        mv RestoreRamdisk.dec ramdisk.dec
    fi
    "$dir/hfsplus" ramdisk.dec grow 13000000

    log "Patch ASR"
    ipsw_patch_file ramdisk.dec usr/sbin asr $patches/asr.${device_model}.patch

    log "Modify options.plist"
    [[ $device_type == "iPod4,1" ]] && "$dir/hfsplus" ramdisk.dec rm usr/local/share/restore/options.${device_model}.plist
    "$dir/hfsplus" ramdisk.dec add $patches/options.plist usr/local/share/restore/options.${device_model}.plist

    if [[ $device_type == "iPad1,1" ]]; then # NyanSatan rc.boot and exploit
        log "Add exploit stuff from SundanceInH2A"
        "$dir/hfsplus" ramdisk.dec rm private/etc/rc.boot
        "$dir/hfsplus" ramdisk.dec add $sundance/rc_boot/rc.boot private/etc/rc.boot
        "$dir/hfsplus" ramdisk.dec chmod 755 private/etc/rc.boot
        "$dir/hfsplus" ramdisk.dec chown 0:0 private/etc/rc.boot
        "$dir/hfsplus" ramdisk.dec add $sundance/exploit/exploit-k48.dmg exploit.dmg
    elif [[ $ipsw_jailbreak == 1 ]]; then # touch 4 only
        ipsw_prepare_rebootsh aquila2
        log "Jailbreak stuff in ramdisk"
        "$dir/hfsplus" ramdisk.dec untar $jelbrek/daibutsu/bin.tar
        "$dir/hfsplus" ramdisk.dec mv sbin/reboot sbin/reboot_
        "$dir/hfsplus" ramdisk.dec add reboot.sh sbin/reboot
        "$dir/hfsplus" ramdisk.dec chmod 755 sbin/reboot
        "$dir/hfsplus" ramdisk.dec chown 0:0 sbin/reboot
    fi

    log "Repack Restore Ramdisk"
    "$dir/xpwntool" ramdisk.dec $ipsw_custom/$ramdisk_name -t RestoreRamdisk.orig

    local rootfs_name=$(echo $device_fw_key_base | $jq -j '.keys[] | select(.image == "RootFS") | .filename')
    log "Base RootFS: $rootfs_name"

    log "Target manifest plist"
    rm BuildManifest.plist
    file_extract_from_archive "$ipsw_path.ipsw" BuildManifest.plist
    local rootfs_target_name=$($PlistBuddy -c "Print BuildIdentities:0:Manifest:OS:Info:Path" BuildManifest.plist | tr -d '"')
    local rootfs_target_key
    local kc_iv
    local kc_key
    case $device_type_special in
        iPad2,1 )
            # iPad2,1 7.1.2
            rootfs_target_key="2ce48d3e6cbd6fd68c775f2f0261e205f27c78280035bb6bffadccfbec44f4d890bd34b9"
            # iPad1,1 5.1.1
            kc_iv="140984858e5c7fe245a43596f5370a0e"
            kc_key="fc6733108c9bd4b2179257102f81998089437c2c58cbdb8752fd40a442bd9434"
        ;;
        iPhone3,3 )
            # iPhone3,3 7.1.2
            rootfs_target_key="423b3503689b7058d1398d1b5d56a7b1ccf4d79e1c3e6ba853122b4f86820a9e3bc911f6"
            kc_iv="b84212f017d5ffd962db0bbe050581dc"
            kc_key="92e5720cadf724cdf428d44119b634ab3346aef1ab4e3e20abc8ecb73f7f8642"
        ;;
    esac
    local rootfs_target_size=1589
    rootfs_target_size=$((rootfs_target_size*1024*1024))

    if [[ $device_type == "iPad1,1" ]]; then
        log "Target kernelcache"
        cp $kc $ipsw_custom/kernelcache.release.k48
        log "Restore kernelcache"
        file_extract_from_archive "$ipsw_base_path.ipsw" kernelcache.release.k48
        "$dir/xpwntool" $sundance/artifacts/kernelcache.k48ap.bin $ipsw_custom/Downgrade/RestoreKernelCache -t kernelcache.release.k48 -iv $kc_iv -k $kc_key
        log "Target devicetree"
        cp $ipad1ios7/artifacts/DeviceTree.k48ap.img3 $all_flash2/
        log "Restore devicetree"
        "$dir/img3maker" -f $sundance/artifacts/DeviceTree.k48ap.bin -o $ipsw_custom/Downgrade/RestoreDeviceTree -t dtre

    else # iPod4,1
        log "Target kernelcache"
        file_extract_from_archive "$ipsw_path.ipsw" kernelcache.release.$device_model_special
        mv kernelcache.release.$device_model_special kc
        "$dir/xpwntool" kc kc.new -iv $kc_iv -k $kc_key -decrypt
        cp kc.new $saves/$device_target_build/kernelcache
        cp kc.new $ipsw_custom/kernelcache.release.$device_model # wont be used, but needed for restore
    fi

    log "Target RootFS: extracting dmg from ipsw"
    file_extract_from_archive "$ipsw_path.ipsw" $rootfs_target_name
    log "Target RootFS: extracting dmg with key $rootfs_target_key"
    "$dir/dmg" extract $rootfs_target_name rootfs.dec -k $rootfs_target_key
    if [[ $? != 0 || ! -s rootfs.dec ]]; then
        error "Failed to extract dmg. Please run the script again"
    fi
    rm $rootfs_target_name
    log "Target RootFS: growing $rootfs_target_size"
    "$dir/hfsplus" rootfs.dec grow $rootfs_target_size

    log "Target RootFS: untar firmwares"
    "$dir/hfsplus" rootfs.dec untar $patches/wifi.$device_model.tar

    local gestalt="private/var/mobile/Library/Caches/com.apple.MobileGestalt.plist"
    log "Target RootFS: adding gestalt"
    "$dir/hfsplus" rootfs.dec add $patches/gestalt.$device_model.plist $gestalt

    if [[ $device_type == "iPad1,1" ]]; then
        local compass="System/Library/HIDPlugins/CompassPlugIn.plugin"
        log "Target RootFS: remove CompassPlugIn"
        "$dir/hfsplus" rootfs.dec rm $compass/CompassPlugIn

        local dsc="System/Library/Caches/com.apple.dyld/dyld_shared_cache_armv7"
        log "Target RootFS: extracting dsc, this will take a while"
        "$dir/hfsplus" rootfs.dec extract $dsc
        log "Patching dsc, this will take a while"
        xxd dyld_shared_cache_armv7 > dyld_shared_cache_armv7.hex
        if [[ $(head -n1 dyld_shared_cache_armv7.hex | grep 00000000) ]]; then
            git apply $patches/dyld_shared_cache_armv7.patch
        else
            git apply $patches/dyld_shared_cache_armv7-oldxxd.patch
        fi
        xxd -r dyld_shared_cache_armv7.hex > dyld_shared_cache_armv7.patched
        log "Target RootFS: replacing dsc, this will take a while"
        "$dir/hfsplus" rootfs.dec rm $dsc
        "$dir/hfsplus" rootfs.dec add dyld_shared_cache_armv7.patched $dsc
        "$dir/hfsplus" rootfs.dec chmod 755 $dsc
        "$dir/hfsplus" rootfs.dec chown 0:0 $dsc
        rm dyld_shared_cache_armv7*

        local db="System/Library/Extensions/IMGSGX535GLDriver.bundle"
        log "Target RootFS: adding iphone graphics drivers"
        "$dir/hfsplus" rootfs.dec mkdir $db
        "$dir/hfsplus" rootfs.dec add $ipad1ios7/artifacts/IMGSGX535GLDriver $db/IMGSGX535GLDriver
        "$dir/hfsplus" rootfs.dec add $ipad1ios7/artifacts/H264H2.videodecoder System/Library/VideoDecoders/H264H2.videodecoder
        "$dir/hfsplus" rootfs.dec add $ipad1ios7/artifacts/MP4VH2.videodecoder System/Library/VideoDecoders/MP4VH2.videodecoder
    fi

    if [[ $ipsw_jailbreak == 1 ]]; then
        log "Target RootFS: untar jailbreak bootstrap"
        cp $jelbrek/freeze.tar.gz .
        gzip -d freeze.tar.gz
        "$dir/hfsplus" rootfs.dec untar freeze.tar
        "$dir/hfsplus" rootfs.dec untar $jelbrek/LukeZGD.tar
        touch .cydia_no_stash
        "$dir/hfsplus" rootfs.dec add .cydia_no_stash .cydia_no_stash

        log "Target RootFS: untar jailbreak untether"
        "$dir/hfsplus" rootfs.dec untar $jelbrek/aquila_7.tar
        if [[ $device_type == "iPad1,1" ]]; then
            "$dir/hfsplus" rootfs.dec rm usr/lib/libmis.dylib
            "$dir/hfsplus" rootfs.dec mv aquila usr/libexec/dirhelper
        fi

        if [[ $ipsw_openssh == 1 ]]; then
            log "Target RootFS: untar jailbreak openssh"
            cp $jelbrek/openssh.tar.gz $jelbrek/openssl.tar.gz .
            gzip -d openssh.tar.gz
            gzip -d openssl.tar.gz
            "$dir/hfsplus" rootfs.dec untar $jelbrek/sshdeb.tar
            "$dir/hfsplus" rootfs.dec untar openssh.tar
            "$dir/hfsplus" rootfs.dec untar openssl.tar
        fi
    fi

    log "Target RootFS: building dmg as $rootfs_name"
    "$dir/dmg" build rootfs.dec $ipsw_custom/$rootfs_name
    if [[ $? != 0 || ! -s $ipsw_custom/$rootfs_name ]]; then
        error "Failed to build dmg. Please run the script again"
    fi

    log "Creating $ipsw_custom.ipsw..."
    pushd $ipsw_custom >/dev/null
    zip -r0 $ipsw_custom.ipsw *
    popd >/dev/null

    if [[ $device_type == "iPod4,1" ]]; then
        echo "device_target_build=$device_target_build" > $saves/$device_ecid
    fi
}

download_sundancerepo() {
    local sr="../saved/SundanceResources.b64"
    local sr_sha1="ebf508aff198fa80204bf3d6df0114e9b645f1c0"
    local sr_url="https://gist.githubusercontent.com/NyanSatan/1cf6921821484a2f8f788e567b654999/raw/54c6ad7554710af454c87ec2d99f869e6e669c99/SundanceResources.b64"

    log "Preparing SundanceInH2A"

    # handle older sundance folders/repos
    [[ -d ${sundance}_macos ]] && mv ${sundance}_macos/ ${sundance}/
    [[ -d ${sundance}_linux ]] && rm -rf ${sundance}_linux/

    if [[ -s $sundance/Sundancer ]]; then
        pushd $sundance >/dev/null
        git reset --hard
        git checkout master
        git pull
        popd >/dev/null
    else
        local repo="https://github.com/NyanSatan/SundanceInH2A"
        rm -rf $sundance
        log "git clone: $repo"
        git clone $repo $sundance
    fi

    if [[ -s $sr ]]; then
        if [[ $($sha1sum $sr 2>/dev/null | awk '{print $1}') != "$sr_sha1" ]]; then
            rm $sr
        fi
    fi

    if [[ ! -s $sr ]]; then
        log "Downloading resources: $(basename $sr)"
        download_from_url "$sr_url" "$sr"
    fi

    if [[ $($sha1sum $sr 2>/dev/null | awk '{print $1}') != "$sr_sha1" ]]; then
        rm $sr
        error "Downloading/verifying resources failed. Please run the script again"
    fi

    log "Preparing resources"
    if [[ $platform == "macos" ]]; then
        cat $sr | base64 --decode | tar -xvf -
    else
        base64 --decode $sr | xz -d | tar -xvf -
    fi
    mv artifacts/* $sundance/artifacts/
    mv resources/* $sundance/resources/
}

ipsw_prepare_sundanceinh2a() {
    local ipsw_path2="${device_type_special}_${device_target_vers}_${device_target_build}_Restore"
    local ipsw_base_path2="${device_type}_${device_base_vers}_${device_base_build}_Restore"
    local ipsw_custom2="${device_type}_${device_target_vers}_${device_target_build}_Custom"
    local jb
    [[ $ipsw_jailbreak == 1 ]] && jb="-j"

    if [[ -e "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    fi

    download_sundancerepo

    log "Copying freeze.tar to Cydia.tar"
    cp $jelbrek/freeze.tar.gz .
    gzip -d freeze.tar.gz
    mv freeze.tar $sundance/resources/Cydia.tar

    log "Copying IPSWs..."
    cp "$ipsw_path.ipsw" "$sundance/$ipsw_path2.ipsw"
    cp "$ipsw_base_path.ipsw" "$sundance/$ipsw_base_path2.ipsw"
    log "Preparing custom IPSW..."
    pushd $sundance >/dev/null
    rm -rf "$ipsw_custom2"
    ./Sundancer $jb "$ipsw_base_path2.ipsw" "$ipsw_path2.ipsw" "$ipsw_custom2"
    rm "$ipsw_path2.ipsw" "$ipsw_base_path2.ipsw"
    if [[ ! -d "$ipsw_custom2" ]]; then
        error "Custom IPSW creation seems to have failed. Please run the script again" \
              "* If you do not have Python 3 installed, install it since SundanceInH2A requires it."
    fi
    pushd "$ipsw_custom2" >/dev/null
    zip -r0 ../../$ipsw_custom.ipsw *
    popd >/dev/null
    rm -rf "$ipsw_custom2"
    popd >/dev/null

    # ibec ticket patch
    log "Starting iBEC ticket patch"
    mv "$ipsw_custom.ipsw" temp.ipsw
    device_fw_key_check temp $device_base_build
    mkdir -p Firmware/dfu
    local iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "iBEC") | .iv')
    local key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "iBEC") | .key')
    local name="iBEC.${device_model}ap.RELEASE.dfu"
    file_extract_from_archive temp.ipsw Firmware/dfu/$name
    "$dir/xpwntool" $name ibec -iv $iv -k $key
    "$dir/iBoot32Patcher" ibec ibec.patched --ticket
    "$dir/img3maker" -f ibec.patched -o Firmware/dfu/$name -t ibec
    log "Add all to custom IPSW"
    zip -r0 temp.ipsw Firmware/dfu/*
    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_prepare_partition_script() {
    local file="partition"
    log "Preparing partition script"
    if [[ $ipsw_powder_ramdiskH == 1 ]]; then
        log "Using ramdiskH partition script"
        cp ../resources/firmware/src/target/iphone5/partition .
        return
    fi
    cp ../resources/firmware/src/partition .

    if [[ $device_base_vers == "5."* ]]; then
        local new_bs=64
        local new_value=$((new_bs*1024))
        new_bs="${new_bs}k"
        log "Changing exploit size to $new_bs for iOS 5"
        sed -i.bak 's|^Exploit_LastSector=.*|Exploit_LastSector="$(('"$new_value"'/$LogicalSector))"|' "$file"
        sed -i.bak 's|^dd of=\$exploitDisk if=/exploit bs=.* count=1$|dd of=\$exploitDisk if=/exploit bs='"$new_bs"' count=1|' "$file"
    fi

    if [[ $device_base_vers == "5."* || $device_type == "iPhone3,1" ]]; then
        log "Removing nvram boot-ramdisk"
        sed -i.bak '/^nvram boot-ramdisk/d' "$file"
        rm "$file.bak"
    fi
}

ipsw_prepare_multipatch() {
    local vers
    local build
    local options_plist
    local saved_path
    local url
    local ramdisk_name
    local rootfs_name
    local name
    local iv
    local key
    local comps=("iBSS" "iBEC" "DeviceTree" "Kernelcache" "RestoreRamdisk")
    local use_ticket=1

    log "Starting multipatch"
    mv "$ipsw_custom.ipsw" temp.ipsw
    rm -f asr* iBSS* iBEC* ramdisk* *.dmg
    options_plist="options.$device_model.plist"
    if [[ $device_type == "iPad1,1" && $device_target_vers == "4"* ]]; then
        use_ticket=
    elif [[ $device_target_vers == "3"* || $device_target_vers == "4"* ]]; then
        options_plist="options.plist"
        use_ticket=
    fi

    # for 4.2.1 and lower powdersn0w multipatch
    vers="$device_target_vers"
    build="$device_target_build"
    if [[ $ipsw_isbeta == 1 ]]; then
        vers="4.2.1"
        build="8C148"
    fi
    # for betas multipatch
    case $device_target_vers in
        4.3* ) vers="4.3.5"; build="8L1";;
        5* ) vers="5.1.1"; build="9B206";;
        6* ) vers="6.1.3"; build="10B329";;
        7* ) vers="7.1.2"; build="11D257";;
        8* ) vers="8.4.1"; build="12H321";;
        9* ) vers="9.3.5"; build="13G36";;
    esac
    # for gasgauge multipatch
    if [[ $ipsw_gasgauge_patch == 1 ]]; then
        vers="6.1.3"
        build="10B329"
        if [[ $device_type == "iPhone5,3" || $device_type == "iPhone5,4" ]]; then
            vers="7.1.2"
            build="11D257"
        fi
    fi

    saved_path="../saved/$device_type/$build"
    ipsw_get_url $build
    url="$ipsw_url"
    log "Extracting BuildManifest..."
    file_extract_from_archive temp.ipsw BuildManifest.plist
    ramdisk_name=$($PlistBuddy -c "Print BuildIdentities:0:Manifest:RestoreRamDisk:Info:Path" BuildManifest.plist | tr -d '"')
    rootfs_name=$($PlistBuddy -c "Print BuildIdentities:0:Manifest:OS:Info:Path" BuildManifest.plist | tr -d '"')
    log "ramdisk_name: $ramdisk_name"
    log "rootfs_name: $rootfs_name"

    log "Extracting ramdisk from IPSW"
    file_extract_from_archive temp.ipsw $ramdisk_name
    mv $ramdisk_name ramdisk2.orig
    "$dir/xpwntool" ramdisk2.orig ramdisk2.dec

    log "Checking multipatch"
    "$dir/hfsplus" ramdisk2.dec extract multipatched
    if [[ -s multipatched ]]; then
        log "Already multipatched"
        mv temp.ipsw "$ipsw_custom.ipsw"
        return
    fi

    if [[ $(cat BuildManifest.plist | grep -c "Downgrade") == 0 ]]; then
        local ind=(0)
        if [[ $device_proc == 6 && $target_vers_maj == 10 ]]; then
            ind+=(2 4)
            [[ $device_type == "iPhone5,"* ]] && ind+=(6)
        fi
        log "Modifying BuildManifest..."
        if [[ $platform == "macos" ]]; then
            for i in "${ind[@]}"; do
                $PlistBuddy -c "Set BuildIdentities:$i:Manifest:RestoreDeviceTree:Info:Path Downgrade/RestoreDeviceTree" BuildManifest.plist
                $PlistBuddy -c "Set BuildIdentities:$i:Manifest:RestoreKernelCache:Info:Path Downgrade/RestoreKernelCache" BuildManifest.plist
            done
        else
            awk -i inplace '
                /^[[:space:]]*<key>RestoreDeviceTree<\/key>/ { mode = "rdt" }
                /^[[:space:]]*<key>RestoreKernelCache<\/key>/ { mode = "rkc" }
                /^[[:space:]]*<key>Path<\/key>/ && mode {
                    print
                    getline
                    match($0, /^[[:space:]]*/)
                    indent = substr($0, RSTART, RLENGTH)
                    if (mode == "rdt") {
                        sub(/^[[:space:]]*.*/, indent "<string>Downgrade/RestoreDeviceTree</string>")
                    } else if (mode == "rkc" && $0 ~ /<string>.*kernelcache.*<\/string>/) {
                        sub(/^[[:space:]]*.*/, indent "<string>Downgrade/RestoreKernelCache</string>")
                    }
                    mode = ""
                }
                { print }
            ' BuildManifest.plist
        fi
        if [[ $device_proc == 6 && $target_vers_maj == 10 && $device_target_vers != "$device_latest_vers" ]]; then
            ipsw_bbreplace exist
        else
            zip -r0 temp.ipsw BuildManifest.plist
        fi
    fi

    mkdir -p $saved_path Downgrade Firmware/dfu
    device_fw_key_check temp $build
    log "Getting $vers restore components"
    for getcomp in "${comps[@]}"; do
        name=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
        iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        case $getcomp in
            "iBSS" | "iBEC" ) path="Firmware/dfu/";;
            "DeviceTree" ) path="$all_flash/";;
            * ) path="";;
        esac
        log "$getcomp"
        if [[ $vers == "$device_target_vers" ]]; then
            file_extract_from_archive "$ipsw_path.ipsw" ${path}$name
        elif [[ -e $saved_path/$name ]]; then
            cp $saved_path/$name .
        else
            "$dir/pzb" -g "${path}$name" -o "$name" "$url"
            cp $name $saved_path/
        fi
        case $getcomp in
            "DeviceTree" )
                "$dir/xpwntool" $name Downgrade/RestoreDeviceTree -iv $iv -k $key -decrypt
                zip -r0 temp.ipsw Downgrade/RestoreDeviceTree
            ;;
            "Kernelcache" )
                "$dir/xpwntool" $name Downgrade/RestoreKernelCache -iv $iv -k $key -decrypt
                zip -r0 temp.ipsw Downgrade/RestoreKernelCache
            ;;
            * )
                mv $name $getcomp.orig
                "$dir/xpwntool" $getcomp.orig $getcomp.dec -iv $iv -k $key
            ;;
        esac
        if [[ $getcomp == "iB"* ]]; then
            local ticket=
            if [[ $getcomp == "iBEC" && $use_ticket == 1 ]]; then
                ticket="--ticket"
            fi
            log "Patch $getcomp"
            "$dir/iBoot32Patcher" $getcomp.dec $getcomp.patched --rsa --debug $ticket -b "rd=md0 -v nand-enable-reformat=1 amfi=0xff amfi_get_out_of_my_way=1 cs_enforcement_disable=1 pio-error=0"
            "$dir/xpwntool" $getcomp.patched ${path}$name -t $getcomp.orig
            if [[ $target_vers_maj == 10 ]]; then
                cp ${path}$name ${path}$getcomp.iphone5.RELEASE.dfu
                cp ${path}$name ${path}$getcomp.iphone5b.RELEASE.dfu
                cp ${path}$name ${path}$getcomp.ipad3b.RELEASE.dfu
            fi
            if (( target_vers_maj >= 8 )); then
                cp ${path}$name ${path}$getcomp.$device_model.RELEASE.dfu
            fi
            zip -r0 temp.ipsw ${path}$getcomp*
        fi
    done

    log "Grow ramdisk"
    "$dir/hfsplus" RestoreRamdisk.dec grow 30000000

    log "Patch ASR"
    local asrpatch="../resources/firmware/FirmwareBundles/Down_${device_type}_${vers}_${build}.bundle/asr.patch"
    if [[ -s "$asrpatch" ]]; then
        cp "$asrpatch" .
        ipsw_patch_file RestoreRamdisk.dec usr/sbin asr asr.patch
    elif [[ $ipsw_gasgauge_patch == 1 ]]; then
        "$dir/hfsplus" RestoreRamdisk.dec rm usr/sbin/asr
        "$dir/hfsplus" RestoreRamdisk.dec add ../resources/patch/asr usr/sbin/asr
        "$dir/hfsplus" RestoreRamdisk.dec chmod 755 usr/sbin/asr
        if [[ $vers == "6.1.3" ]]; then
            log "Patch restored_external"
            "$dir/hfsplus" RestoreRamdisk.dec rm usr/local/bin/restored_external
            "$dir/hfsplus" RestoreRamdisk.dec add ../resources/patch/re usr/local/bin/restored_external
            "$dir/hfsplus" RestoreRamdisk.dec chmod 755 usr/local/bin/restored_external
        fi
    else
        "$dir/hfsplus" ramdisk2.dec extract usr/sbin/asr
        "$dir/hfsplus" RestoreRamdisk.dec add asr usr/sbin/asr
        "$dir/hfsplus" RestoreRamdisk.dec chmod 755 usr/sbin/asr
    fi

    if [[ $device_target_vers == "3."* ]]; then
        log "3.x options.plist"
        cp ../resources/firmware/src/target/${device_model}/options.plist $options_plist
    else
        log "Extract options.plist from $device_target_vers IPSW"
        "$dir/hfsplus" ramdisk2.dec extract usr/local/share/restore/$options_plist
    fi

    log "Modify options.plist"
    cat $options_plist | sed '$d' | sed '$d' > options2.plist # remove </dict> and </plist>
    if [[ $ipsw_prepare_ios4multipart_patch == 1 || $device_target_tethered == 1 ]]; then
        printf "<key>FlashNOR</key><false/>\n" >> options2.plist
    fi
    if [[ $device_type == "$device_disable_bbupdate" && $(cat options2.plist | grep -c "UpdateBaseband") == 0 ]]; then
        printf "<key>UpdateBaseband</key><false/>\n" >> options2.plist
    fi
    printf "</dict>\n</plist>\n" >> options2.plist
    cat options2.plist # print result
    "$dir/hfsplus" RestoreRamdisk.dec rm usr/local/share/restore/$options_plist
    "$dir/hfsplus" RestoreRamdisk.dec add options2.plist usr/local/share/restore/$options_plist

    if [[ $device_target_vers == "3"* ]]; then
        :
    elif [[ $device_target_powder == 1 && $device_target_vers == "4"* ]]; then
        log "Adding exploit and partition stuff"
        cp -R ../resources/firmware/src .
        "$dir/hfsplus" RestoreRamdisk.dec untar src/bin4.tar
        "$dir/hfsplus" RestoreRamdisk.dec mv sbin/reboot sbin/reboot_
        "$dir/hfsplus" RestoreRamdisk.dec add src/target/$device_model/reboot4 sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec chmod 755 sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec chown 0:0 sbin/reboot
    elif [[ $device_target_powder == 1 ]]; then
        local hw="$device_model"
        local base_build="11D257"
        case $device_type in
            iPhone5,[12] ) hw="iphone5";;
            iPhone5,[34] ) hw="iphone5b";;
            iPad2,[123]  ) hw="ipad2";;
            iPad2,[567]  ) hw="ipad2b";;
            iPad3,[123]  ) hw="ipad3";;
            iPad3,[456]  ) hw="ipad3b";;
        esac
        case $device_base_build in
            "11A"* | "11B"* ) base_build="11B554a";;
            "9"* ) base_build="9B206";;
        esac
        local exploit="src/target/$hw/$base_build/exploit"
        ipsw_prepare_partition_script
        log "Adding exploit and partition stuff"
        "$dir/hfsplus" RestoreRamdisk.dec untar src/bin.tar
        "$dir/hfsplus" RestoreRamdisk.dec mv sbin/reboot sbin/reboot_
        "$dir/hfsplus" RestoreRamdisk.dec add partition sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec chmod 755 sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec chown 0:0 sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec add $exploit exploit
    elif [[ $ipsw_jailbreak == 1 && $device_target_vers == "8."* && $ipsw_everuntether != 1 ]] ||
         [[ $ipsw_jailbreak == 1 && $device_target_vers == "7."* ]]; then
        # daibutsu/everpwnage haxx overwrite and aquila reboot.sh
        "$dir/hfsplus" RestoreRamdisk.dec untar bin.tar
        "$dir/hfsplus" RestoreRamdisk.dec mv sbin/reboot sbin/reboot_
        "$dir/hfsplus" RestoreRamdisk.dec add reboot.sh sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec chmod 755 sbin/reboot
        "$dir/hfsplus" RestoreRamdisk.dec chown 0:0 sbin/reboot
    fi

    echo "multipatched" > multipatched
    "$dir/hfsplus" RestoreRamdisk.dec add multipatched multipatched

    log "Repack Restore Ramdisk"
    "$dir/xpwntool" RestoreRamdisk.dec $ramdisk_name -t RestoreRamdisk.orig
    log "Add Restore Ramdisk to IPSW"
    zip -r0 temp.ipsw $ramdisk_name

    # 3.2.x ipad/4.2.x cdma fs workaround
    # removed back in fcdc9ec, added back for now
    case $device_target_vers in
    4.2.10 | 4.2.9 | 4.2.[876] | 3.2* | 3.1.3 )
        local ipsw_name="../${device_type}_${device_target_vers}_${device_target_build}_FS"
        local type="iPad1.1"
        [[ $device_type == "iPhone3,3" ]] && type="iPhone3.3"
        [[ $device_type == "iPod3,1" ]] && type="iPod3.1"
        local build="$device_target_build"
        local vers="$device_target_vers"
        local rootfs_name_fs="$rootfs_name"
        case $device_target_vers in
        4.2.10 | 4.2.9 )
            build="8E401"
            vers="4.2.8"
            device_fw_key_check temp $build
            rootfs_name_fs=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "RootFS") | .filename')
        esac
        local ipsw_url="https://github.com/LukeZGD/Legacy-iOS-Kit-Keys/releases/download/jailbreak/${type}_${vers}_${build}_FS2.ipsw"
        local sha1E="f4660666ce9d7bd9312d761c850fa3a1615899e9" # 3.2.2
        local sha1L="none"
        case $vers in
            4.2.10 | 4.2.[98] ) sha1E="b78fc4aba52bbf652c71cc633eccfba6d659698f";;
            4.2.7 ) sha1E="d07c841bbedae42f9ff98fa9160fc1298e6fffb2";;
            4.2.6 ) sha1E="671cbbb3964e5e5c38078577f5c2844bbe16699c";;
            3.2.1 ) sha1E="896c0344435615aee7f52fc75739241022e38fe7";;
            3.2   ) sha1E="47fdfe04ad9b65da009c834902eda3f141feac28";;
            3.1.3 ) sha1E="5500f63ff36ddf3379c66fcff26f0a6837ad522d";;
        esac
        if [[ -s "$ipsw_name.ipsw" ]]; then
            log "Verifying FS IPSW..."
            sha1L=$($sha1sum "$ipsw_name.ipsw" | awk '{print $1}')
            if [[ $sha1L != "$sha1E" ]]; then
                log "Verifying IPSW failed. Expected $sha1E, got $sha1L"
                log "Deleting existing custom IPSW"
                rm "$ipsw_name.ipsw"
            fi
        fi
        if [[ ! -s "$ipsw_name.ipsw" ]]; then
            log "Downloading FS IPSW..."
            download_from_url "$ipsw_url" temp2.ipsw
            log "Getting SHA1 hash for FS IPSW..."
            sha1L=$($sha1sum temp2.ipsw | awk '{print $1}')
            if [[ $sha1L != "$sha1E" ]]; then
                error "Verifying IPSW failed. The IPSW may be corrupted or incomplete. Please run the script again" \
                "* SHA1sum mismatch. Expected $sha1E, got $sha1L"
            fi
            mv temp2.ipsw "$ipsw_name.ipsw"
        fi
        log "Extract RootFS from FS IPSW"
        file_extract_from_archive "$ipsw_name.ipsw" $rootfs_name_fs
        [[ $rootfs_name_fs != "$rootfs_name" ]] && mv $rootfs_name_fs $rootfs_name
        log "Add RootFS to IPSW"
        zip -r0 temp.ipsw $rootfs_name
    ;;
    esac

    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_prepare_tethered() {
    local name
    local iv
    local key
    local options_plist="options.$device_model.plist"
    if [[ $device_type == "iPad1,1" && $device_target_vers == "4"* ]]; then
        :
    elif [[ $device_target_vers == "3"* || $device_target_vers == "4"* ]]; then
        options_plist="options.plist"
    fi

    if [[ -s "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    fi

    ipsw_prepare_32bit

    log "Extract RestoreRamdisk and options.plist"
    mv "$ipsw_custom.ipsw" temp.ipsw
    file_extract_from_archive temp.ipsw BuildManifest.plist
    name=$($PlistBuddy -c "Print BuildIdentities:0:Manifest:RestoreRamDisk:Info:Path" BuildManifest.plist | tr -d '"')
    file_extract_from_archive temp.ipsw $name
    device_fw_key_check temp $device_target_build
    iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .iv')
    key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "RestoreRamdisk") | .key')
    mv $name ramdisk.orig
    "$dir/xpwntool" ramdisk.orig ramdisk.dec -iv $iv -k $key
    "$dir/hfsplus" ramdisk.dec extract usr/local/share/restore/$options_plist

    log "Modify options.plist"
    "$dir/hfsplus" ramdisk.dec rm usr/local/share/restore/$options_plist
    cat $options_plist | sed '$d' | sed '$d' > options2.plist
    printf "<key>FlashNOR</key><false/></dict>\n</plist>\n" >> options2.plist
    cat options2.plist
    "$dir/hfsplus" ramdisk.dec add options2.plist usr/local/share/restore/$options_plist

    log "Repack Restore Ramdisk"
    "$dir/xpwntool" ramdisk.dec $name -t ramdisk.orig
    log "Add Restore Ramdisk to IPSW"
    zip -r0 temp.ipsw $name
    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_prepare_ios4patches() {
    local comps=("iBSS" "iBEC")
    local iv
    local key
    local name
    local path="Firmware/dfu/"
    local build_id="$device_target_build"
    local ipsw_path="$ipsw_path"
    local ticket
    if [[ -n $device_type_special ]]; then
        build_id="$device_base_build"
        ipsw_path="$ipsw_base_path"
    fi
    device_fw_key_check temp $build_id
    log "Applying iBSS/iBEC patches"
    mkdir -p $all_flash $path
    for getcomp in "${comps[@]}"; do
        iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        name="$getcomp.${device_model}ap.RELEASE.dfu"
        log "Patch $getcomp"
        file_extract_from_archive "$ipsw_path.ipsw" ${path}$name
        mv $name $getcomp.orig
        "$dir/xpwntool" $getcomp.orig $getcomp.dec -iv $iv -k $key
        ticket=
        if [[ $getcomp == "iBEC" ]] && (( target_vers_maj >= 5 )); then
            ticket="--ticket"
        fi
        "$dir/iBoot32Patcher" $getcomp.dec $getcomp.patched --rsa --debug $ticket -b "rd=md0 -v amfi=0xff cs_enforcement_disable=1 pio-error=0"
        "$dir/xpwntool" $getcomp.patched ${path}$name -t $getcomp.orig
    done
}

ipsw_prepare_ios4powder() {
    local ExtraArgs="-apticket $shsh_path"
    local JBFiles=()
    ipsw_prepare_usepowder=1

    if [[ -s "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    fi

    if [[ $ipsw_jailbreak == 1 ]]; then
        JBFiles=("aquila_4.tar" "fstab_old.tar" "cydiasubstrate.tar" "freeze.tar")
        for i in {0..2}; do
            JBFiles[i]=$jelbrek/${JBFiles[$i]}
        done
        if [[ $ipsw_openssh == 1 ]]; then
            cp $jelbrek/openssh.tar.gz $jelbrek/openssl.tar.gz .
            gzip -d openssh.tar.gz
            gzip -d openssl.tar.gz
            JBFiles+=("$jelbrek/sshdeb.tar" "openssh.tar" "openssl.tar")
        fi
        cp $jelbrek/freeze.tar.gz .
        gzip -d freeze.tar.gz
    fi

    ipsw_prepare_bundle target
    ipsw_prepare_bundle base
    ipsw_prepare_logos_convert
    cp -R ../resources/firmware/src .
    mv src/target/$device_model/reboot4 partition
    rm src/bin.tar
    mv src/bin4.tar src/bin.tar
    ipsw_prepare_config false true
    if [[ $ipsw_memory == 1 ]]; then
        ExtraArgs+=" -memory"
    fi
    if [[ $device_actrec == 1 ]]; then
        ExtraArgs+=" ../saved/$device_type/activation-$device_ecid.tar"
    fi

    local ExtraArr=("--boot-partition" "--boot-ramdisk" "--logo4")
    case $device_target_vers in
        4.3.[45] ) :;;
        * ) ExtraArr+=("--433");;
    esac
    local bootargs="$device_bootargs_default"
    if [[ $ipsw_verbose == 1 ]]; then
        bootargs="pio-error=0 -v"
    fi
    [[ -n $device_bootargs ]] && bootargs+=" $device_bootargs"
    ExtraArr+=("-b" "$bootargs")
    patch_iboot "${ExtraArr[@]}"

    tar -rvf src/bin.tar iBoot
    if [[ $device_type == "iPad1,1" ]]; then
        cp iBoot iBEC
        tar -cvf iBoot.tar iBEC
        ExtraArgs+=" iBoot.tar"
    fi
    if [[ $ipsw_isbeta == 1 ]]; then
        ipsw_prepare_systemversion
        ExtraArgs+=" systemversion.tar"
    fi

    log "Preparing custom IPSW: $dir/powdersn0w $ipsw_path.ipsw temp.ipsw -base $ipsw_base_path.ipsw $ExtraArgs ${JBFiles[*]}"
    "$dir/powdersn0w" "$ipsw_path.ipsw" temp.ipsw -base "$ipsw_base_path.ipsw" $ExtraArgs ${JBFiles[@]}

    if [[ ! -e temp.ipsw ]]; then
        if [[ $platform == "macos" && $platform_arch == "arm64" ]]; then
            warn "Updating to macOS 12.6 or newer is recommended for Apple Silicon Macs to resolve issues."
        fi
        error "Failed to find custom IPSW. Please run the script again" \
              "* You may try selecting N for memory option"
    fi

    ipsw_prepare_ios4patches
    if [[ -n $ipsw_customlogo ]]; then
        ipsw_prepare_logos_add
    else
        log "Patch AppleLogo"
        local applelogo_name=$(echo "$device_fw_key" | $jq -j '.keys[] | select(.image == "AppleLogo") | .filename')
        file_extract_from_archive temp.ipsw $all_flash/$applelogo_name
        echo "0000010: 3467" | xxd -r - $applelogo_name
        echo "0000020: 3467" | xxd -r - $applelogo_name
        mv $applelogo_name $all_flash/$applelogo_name
    fi

    log "Add all to custom IPSW"
    if [[ $device_type != "iPad1,1" ]]; then
        cp iBoot $all_flash/iBoot2.${device_model}ap.RELEASE.img3
    fi
    zip -r0 temp.ipsw $all_flash/* Firmware/dfu/* $ramdisk_name

    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_prepare_powder() {
    local ExtraArgs
    local JBFiles=()

    if [[ -s "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    fi
    ipsw_prepare_usepowder=1

    ipsw_prepare_bundle target
    ipsw_prepare_bundle base
    ipsw_prepare_logos_convert
    cp -R ../resources/firmware/src .
    if [[ $ipsw_memory == 1 ]]; then
        ExtraArgs+=" -memory"
    fi
    if [[ $device_use_bb != 0 && $device_type != "$device_disable_bbupdate" ]]; then
        ExtraArgs+=" -bbupdate"
    fi

    if [[ $ipsw_jailbreak == 1 ]]; then
        case $device_target_vers in
            7.* ) JBFiles=("aquila_7.tar");;
            5.* ) JBFiles=("aquila_5.tar");;
        esac

        # temporary measure for a5 ios 5
        if [[ $device_proc == 5 && $device_target_vers == "5."* ]]; then
            JBFiles=("g1lbertJB/${device_type}_${device_target_build}.tar")
        fi

        if [[ -n ${JBFiles[0]} ]]; then
            JBFiles[0]=$jelbrek/${JBFiles[0]}
        fi
        case $device_target_vers in
            9.* ) JBFiles+=("$jelbrek/zebra.tar");;
            5.* ) JBFiles+=("$jelbrek/cydiasubstrate.tar");;
        esac
        case $device_target_vers in
            [689].* ) :;;
            * ) JBFiles+=("freeze.tar");;
        esac
        if [[ $ipsw_openssh == 1 ]]; then
            cp $jelbrek/openssh.tar.gz $jelbrek/openssl.tar.gz .
            gzip -d openssh.tar.gz
            gzip -d openssl.tar.gz
            JBFiles+=("$jelbrek/sshdeb.tar" "openssh.tar" "openssl.tar")
        fi
        JBFiles+=("$jelbrek/LukeZGD.tar")
        cp $jelbrek/freeze.tar.gz .
        gzip -d freeze.tar.gz
    fi

    local ExtraArr=("--boot-partition" "--boot-ramdisk")
    local bootargs="$device_bootargs_default"
    if [[ $ipsw_verbose == 1 ]]; then
        bootargs="pio-error=0 -v"
    fi
    case $device_target_vers in
        [789]* ) :;;
        * ) ExtraArr+=("--logo");;
    esac
    if [[ $device_type == "iPhone5,3" || $device_type == "iPhone5,4" ]] && [[ $device_base_vers == "7.0"* ]]; then
        ipsw_powder_5c70=1
    fi
    if [[ $device_type == "iPhone5"* && $ipsw_powder_5c70 != 1 ]]; then
        # do this stuff because these use ramdiskH (jump to /boot/iBEC) instead of ramdiskI (jump ibot to ibob)
        ipsw_powder_ramdiskH=1
        if [[ $device_target_vers == "9"* ]]; then
            ExtraArr[0]+="9"
        fi
        if [[ $ipsw_jailbreak == 1 && $device_target_vers != "7"* ]]; then
            bootargs+=" cs_enforcement_disable=1 amfi_get_out_of_my_way=1 amfi=0xff"
        fi
        ExtraArr+=("-b" "$bootargs")
        patch_iboot "${ExtraArr[@]}"
        tar -cvf iBoot.tar iBoot
        ExtraArgs+=" iBoot.tar"
    elif [[ $device_type == "iPad1,1" ]]; then
        # ipad 1 ramdiskH jumps to /iBEC instead
        ExtraArr+=("-b" "$bootargs")
        patch_iboot "${ExtraArr[@]}"
        mv iBoot iBEC
        tar -cvf iBoot.tar iBEC
        ExtraArgs+=" iBoot.tar"
    fi

    if [[ $ipsw_isbeta == 1 ]]; then
        ipsw_prepare_systemversion
        ExtraArgs+=" systemversion.tar"
    fi
    if [[ $device_type == "$device_disable_bbupdate" && $device_deadbb != 1 ]]; then
        ExtraArgs+=" ../saved/$device_type/baseband-$device_ecid.tar"
    fi
    if [[ $device_actrec == 1 ]]; then
        ExtraArgs+=" ../saved/$device_type/activation-$device_ecid.tar"
    fi
    ipsw_prepare_partition_script

    log "Preparing custom IPSW: $dir/powdersn0w $ipsw_path.ipsw temp.ipsw -base $ipsw_base_path.ipsw $ExtraArgs ${JBFiles[*]}"
    "$dir/powdersn0w" "$ipsw_path.ipsw" temp.ipsw -base "$ipsw_base_path.ipsw" $ExtraArgs ${JBFiles[@]}

    if [[ ! -e temp.ipsw ]]; then
        if [[ $platform == "macos" && $platform_arch == "arm64" ]]; then
            warn "Updating to macOS 12.6 or newer is recommended for Apple Silicon Macs to resolve issues."
        fi
        error "Failed to find custom IPSW. Please run the script again" \
              "* You may try selecting N for memory option"
    fi

    if [[ $device_type != "iPhone5"* && $device_type != "iPad1,1" ]] || [[ $ipsw_powder_5c70 == 1 ]]; then
        case $device_target_vers in
            [789]* ) :;;
            * )
                patch_iboot --logo
                mkdir -p $all_flash
                mv iBoot*.img3 $all_flash
                zip -r0 temp.ipsw $all_flash/iBoot*.img3
            ;;
        esac
    fi
    ipsw_prepare_logos_add
    ipsw_bbreplace

    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_prepare_patchcomp() {
    local path="$all_flash/"
    local name="LLB.${device_model}ap.RELEASE"
    local name41
    local ext="img3"
    local patch
    local iv
    local key

    if [[ $1 == "WTF2" ]]; then
        path="Firmware/dfu/"
        name="WTF.s5l8900xall.RELEASE"
        ext="dfu"
    elif [[ $1 == "iBoot" ]]; then
        name="iBoot.${device_model}ap.RELEASE"
    elif [[ $1 == "iB"* ]]; then
        path="Firmware/dfu/"
        name="$1.${device_model}ap.RELEASE"
        ext="dfu"
    elif [[ $1 == "RestoreRamdisk" ]]; then
        path=
        name="018-6494-014"
        ext="dmg"
        iv=25e713dd5663badebe046d0ffa164fee
        key=7029389c2dadaaa1d1e51bf579493824
        if [[ $device_target_vers == "4"* ]]; then
            name="018-7079-079"
            iv=a0fc6ca4ef7ef305d975e7f881ddcc7f
            key=18eab1ba646ae018b013bc959001fbde
            if [[ $device_target_vers == "4.2.1" ]]; then
                name41="$name"
                name="038-0029-002"
            fi
        fi
    elif [[ $1 == "RestoreDeviceTree" ]]; then
        name="DeviceTree.${device_model}ap"
    elif [[ $1 == "RestoreKernelCache" ]]; then
        path=
        name="kernelcache.release"
        ext="$device_model"
    fi
    patch="../resources/firmware/FirmwareBundles/Down_${device_type}_${device_target_vers}_${device_target_build}.bundle/$name.patch"
    local saved_path="../saved/$device_type/8B117"
    if [[ $1 == "RestoreRamdisk" ]]; then
        local ivkey
        if [[ $device_target_vers == "4"* || $device_type == *"1,1" ]]; then
            ivkey="-iv $iv -k $key"
        fi
        log "Patch $1"
        if [[ $device_target_vers == "4.2.1" ]]; then
            mkdir -p $saved_path
            if [[ -s $saved_path/$name41.$ext ]]; then
                cp $saved_path/$name41.$ext $name.$ext
            else
                ipsw_get_url 8B117
                "$dir/pzb" -g $name41.$ext -o $name.$ext "$ipsw_url"
                cp $name.$ext $saved_path/$name41.$ext
            fi
        else
            file_extract_from_archive "$ipsw_path.ipsw" $name.$ext
        fi
        mv $name.$ext rd.orig
        "$dir/xpwntool" rd.orig rd.dec -iv $iv -k $key
        $bspatch rd.dec rd.patched "$patch"
        "$dir/xpwntool" rd.patched $name.$ext -t rd.orig $ivkey
        zip -r0 temp.ipsw $name.$ext
        return
    fi
    log "Patch $1"
    if [[ $device_target_vers == "4.2.1" ]] && [[ $1 == "RestoreDeviceTree" || $1 == "RestoreKernelCache" ]]; then
        mkdir -p $saved_path
        if [[ -s $saved_path/$name.$ext ]]; then
            cp $saved_path/$name.$ext $name.$ext
        else
            ipsw_get_url 8B117
            "$dir/pzb" -g ${path}$name.$ext -o $name.$ext "$ipsw_url"
            cp $name.$ext $saved_path/$name.$ext
        fi
        mkdir -p Downgrade
        if [[ $1 == "RestoreKernelCache" ]]; then
            local ivkey="-iv 7238dcea75bf213eff209825a03add51 -k 0295d4ef87b9db687b44f54c8585d2b6"
            "$dir/xpwntool" $name.$ext kernelcache $ivkey
            $bspatch kernelcache kc.patched ../resources/firmware/FirmwareBundles/Down_iPhone1,2_4.1_8B117.bundle/kernelcache.release.patch
            "$dir/xpwntool" kc.patched Downgrade/$1 -t $name.$ext $ivkey
        else
            mv $name.$ext Downgrade/$1
        fi
        zip -r0 temp.ipsw Downgrade/$1
        return
    else
        file_extract_from_archive "$ipsw_path.ipsw" ${path}$name.$ext
    fi
    $bspatch $name.$ext $name.patched $patch
    mkdir -p $path
    mv $name.patched ${path}$name.$ext
    zip -r0 temp.ipsw ${path}$name.$ext
}

ipsw_prepare_s5l8900() {
    local rname="018-6494-014.dmg"
    local sha1E="4f6539d2032a1c7e1a068c667e393e62d8912700"
    local sha1L="none"
    ipsw_url="https://github.com/LukeZGD/Legacy-iOS-Kit-Keys/releases/download/jailbreak/"
    if [[ $device_target_vers == "4.1" ]]; then
        rname="018-7079-079.dmg"
        sha1E="9a64eea9949b720f1033d41adc85254e6dbf9525"
    elif [[ $device_target_vers == "4.2.1" ]]; then
        rname="038-0029-002.dmg"
        sha1E="9a64eea9949b720f1033d41adc85254e6dbf9525"
    elif [[ $device_type == "iPhone1,1" && $ipsw_hacktivate == 1 ]]; then
        ipsw_url+="iPhone1.1_3.1.3_7E18_CustomHJ.ipsw"
        sha1E="8140ed162c6712a6e8d1608d3a36257998253d82"
    elif [[ $device_type == "iPhone1,1" ]]; then
        ipsw_url+="iPhone1.1_3.1.3_7E18_CustomJ.ipsw"
        sha1E="4aa139672835d95bebdd2945f713321dcc4965b5"
    elif [[ $device_type == "iPod1,1" ]]; then
        ipsw_url+="iPod1.1_3.1.3_7E18_CustomJ.ipsw"
        sha1E="39d0e16536c281c3f98db91923e3d53b6fad6c6c"
    fi

    if [[ $device_type == "iPhone1,2" && -e "$ipsw_custom.ipsw" ]]; then
        log "Checking RestoreRamdisk hash of custom IPSW"
        file_extract_from_archive "$ipsw_custom.ipsw" $rname
        sha1L="$($sha1sum $rname | awk '{print $1}')"
    elif [[ -e "$ipsw_custom2.ipsw" ]]; then
        log "Getting SHA1 hash for $ipsw_custom2.ipsw..."
        sha1L=$($sha1sum "$ipsw_custom2.ipsw" | awk '{print $1}')
    fi
    if [[ $sha1L == "$sha1E" && $ipsw_customlogo2 == 1 ]]; then
        log "Verified existing Custom IPSW. Preparing custom logo images and IPSW"
        rm -f "$ipsw_custom.ipsw"
        cp "$ipsw_custom2.ipsw" temp.ipsw
        device_fw_key_check
        ipsw_prepare_logos_convert
        ipsw_prepare_logos_add
        mv temp.ipsw "$ipsw_custom.ipsw"
        return
    elif [[ $sha1L == "$sha1E" ]]; then
        log "Verified existing Custom IPSW. Skipping IPSW creation."
        return
    else
        log "Verifying IPSW failed. Expected $sha1E, got $sha1L"
    fi

    if [[ -s "$ipsw_custom.ipsw" ]]; then
        log "Deleting existing custom IPSW"
        rm "$ipsw_custom.ipsw"
    fi

    if [[ $device_type != "iPhone1,2" ]]; then
        log "Downloading IPSW: $ipsw_url"
        download_from_url "$ipsw_url" temp.ipsw
        log "Getting SHA1 hash for IPSW..."
        sha1L=$($sha1sum temp.ipsw | awk '{print $1}')
        if [[ $sha1L != "$sha1E" ]]; then
            error "Verifying IPSW failed. The IPSW may be corrupted or incomplete. Please run the script again" \
                  "* SHA1sum mismatch. Expected $sha1E, got $sha1L"
        fi
        if [[ $ipsw_customlogo2 == 1 ]]; then
            cp temp.ipsw "$ipsw_custom2.ipsw"
            device_fw_key_check
            ipsw_prepare_logos_convert
            ipsw_prepare_logos_add
        fi
        mv temp.ipsw "$ipsw_custom.ipsw"
        return
    fi

    ipsw_prepare_jailbreak old

    mv "$ipsw_custom.ipsw" temp.ipsw
    ipsw_prepare_patchcomp LLB
    ipsw_prepare_patchcomp iBoot
    ipsw_prepare_patchcomp RestoreRamdisk
    if [[ $device_target_vers == "4"* ]]; then
        ipsw_prepare_patchcomp WTF2
        ipsw_prepare_patchcomp iBEC
    fi
    if [[ $device_target_vers == "4.2.1" ]]; then
        ipsw_prepare_patchcomp iBSS
        ipsw_prepare_patchcomp RestoreDeviceTree
        ipsw_prepare_patchcomp RestoreKernelCache
    fi
    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_prepare_custom() {
    if [[ -s "$ipsw_custom.ipsw" ]]; then
        log "Found existing Custom IPSW. Skipping IPSW creation."
        return
    elif [[ $device_target_vers == "4.1" && $ipsw_jailbreak != 1 ]]; then
        log "No need to create custom IPSW for non-jailbroken restores on $device_type-$device_target_build"
        return
    fi

    ipsw_prepare_jailbreak old

    mv "$ipsw_custom.ipsw" temp.ipsw
    if [[ $ipsw_24o == 1 ]]; then # old bootrom ipod2,1
        ipsw_prepare_patchcomp LLB
        mv temp.ipsw "$ipsw_custom.ipsw"
        return
    elif [[ $device_type == "iPod2,1" && $device_target_vers == "3.1.3" ]]; then # new bootrom ipod2,1 3.1.3
        mv temp.ipsw "$ipsw_custom.ipsw"
        return
    fi

    case $device_target_vers in
        $device_latest_vers | 4.1 ) :;;
        3.0* )
            ipsw_prepare_patchcomp LLB
            log "Patch Kernelcache"
            file_extract_from_archive "$ipsw_path.ipsw" kernelcache.release.s5l8920x
            mv kernelcache.release.s5l8920x kernelcache.orig
            $bspatch kernelcache.orig kernelcache.release.s5l8920x ../resources/firmware/FirmwareBundles/Down_iPhone2,1_${device_target_vers}_${device_target_build}.bundle/kernelcache.release.patch
            zip -r0 temp.ipsw kernelcache.release.s5l8920x
        ;;
        * )
            ipsw_prepare_patchcomp LLB
            local bootargs="$device_bootargs_default"
            if [[ $ipsw_verbose == 1 ]]; then
                bootargs="pio-error=0 -v"
            fi
            if [[ $device_target_vers == "3"* ]]; then
                bootargs+=" amfi=0xff cs_enforcement_disable=1"
            fi
            local path="Firmware/all_flash/all_flash.${device_model}ap.production"
            local name="iBoot.${device_model}ap.RELEASE.img3"
            patch_iboot -b "$bootargs"
            mkdir -p $path
            mv $name $path/$name
            zip -r0 temp.ipsw $path/$name
        ;;
    esac
    mv temp.ipsw "$ipsw_custom.ipsw"
}

ipsw_extract() {
    local ipsw="$ipsw_path"
    if [[ $1 == "custom" ]]; then
        ipsw="$ipsw_custom"
    fi
    if [[ ! -d "$ipsw" ]]; then
        mkdir -p "$ipsw"
        log "Extracting IPSW: $ipsw.ipsw"
        file_extract "$ipsw.ipsw" "$ipsw/"
    fi
}

restore_download_bbsep() {
    # download and check manifest, baseband, and sep to be used for restoring
    # sets variables: restore_manifest, restore_baseband, restore_sep
    local build_id
    local baseband_sha1
    local restore_baseband_check
    if [[ $device_proc == 8 || $device_latest_vers == "15"* || $device_latest_vers == "16"* || $device_checkm8ipad == 1 ]]; then
        return
    elif [[ $device_latest_vers == "$device_use_vers" || $device_target_vers == "10"* ]]; then
        build_id="$device_use_build"
        restore_baseband="$device_use_bb"
        baseband_sha1="$device_use_bb_sha1"
    else
        build_id="$device_latest_build"
        restore_baseband="$device_latest_bb"
        baseband_sha1="$device_latest_bb_sha1"
    fi
    ipsw_get_url $build_id

    mkdir -p tmp
    # BuildManifest
    if [[ ! -e ../saved/$device_type/$build_id.plist ]]; then
        if [[ $device_proc == 7 && $device_target_vers == "10"* ]]; then
            cp ../resources/manifest/BuildManifest_${device_type}_10.3.3.plist $build_id.plist
        else
            log "Downloading $build_id BuildManifest"
            "$dir/pzb" -g BuildManifest.plist -o $build_id.plist "$ipsw_url"
        fi
        mv $build_id.plist ../saved/$device_type
    fi
    cp ../saved/$device_type/$build_id.plist tmp/BuildManifest.plist
    if [[ $? != 0 ]]; then
        rm ../saved/$device_type/$build_id.plist
        error "An error occurred copying manifest. Please run the script again"
    fi
    log "Manifest: ../saved/$device_type/$build_id.plist"
    restore_manifest="tmp/BuildManifest.plist"

    # Baseband
    if [[ $restore_baseband != 0 ]]; then
        restore_baseband_check="../saved/baseband/$restore_baseband"
        if [[ -e $restore_baseband_check ]]; then
            if [[ $baseband_sha1 != "$($sha1sum $restore_baseband_check | awk '{print $1}')" ]]; then
                rm $restore_baseband_check
            fi
        fi
        if [[ ! -e $restore_baseband_check ]]; then
            log "Downloading $build_id Baseband"
            "$dir/pzb" -g Firmware/$restore_baseband -o $restore_baseband "$ipsw_url"
            if [[ $baseband_sha1 != "$($sha1sum $restore_baseband | awk '{print $1}')" ]]; then
                error "Downloading/verifying baseband failed. Please run the script again"
            fi
            mv $restore_baseband $restore_baseband_check
        fi
        cp $restore_baseband_check tmp/bbfw.tmp
        if [[ $? != 0 ]]; then
            rm $restore_baseband_check
            error "An error occurred copying baseband. Please run the script again"
        fi
        log "Baseband: $restore_baseband_check"
        restore_baseband="tmp/bbfw.tmp"
    fi

    # SEP
    if (( device_proc >= 7 )); then
        restore_sep="sep-firmware.$device_model.RELEASE"
        if [[ ! -e ../saved/$device_type/$restore_sep-$build_id.im4p ]]; then
            log "Downloading $build_id SEP"
            "$dir/pzb" -g Firmware/all_flash/$restore_sep.im4p -o $restore_sep.im4p "$ipsw_url"
            mv $restore_sep.im4p ../saved/$device_type/$restore_sep-$build_id.im4p
        fi
        restore_sep="$restore_sep-$build_id.im4p"
        cp ../saved/$device_type/$restore_sep .
        if [[ $? != 0 ]]; then
            rm ../saved/$device_type/$restore_sep
            error "An error occurred copying SEP. Please run the script again"
        fi
        log "SEP: ../saved/$device_type/$restore_sep"
    fi
}

restore_idevicerestore() {
    local ExtraArgs="-ew"
    local idevicerestore2="$idevicerestore"

    mkdir -p shsh
    cp "$shsh_path" shsh/$device_ecid-$device_type-$device_target_vers.shsh
    if [[ $device_use_bb == 0 || $device_type == "$device_disable_bbupdate" ]]; then
        log "Device $device_type has no baseband/disabled baseband update"
    fi
    ipsw_extract custom
    case $1 in
        first   ) cp "$shsh_path" shsh/$device_ecid-$device_type-5.1.1.shsh;;
        special ) cp "$shsh_path" shsh/$device_ecid-$device_type-$device_base_vers.shsh;;
    esac
    device_rd_build=
    if [[ $device_type == "iPad"* && $device_pwnrec != 1 ]] &&
       [[ $device_target_vers == "3"* || $device_target_vers == "4"* ]]; then
        if [[ $device_type == "iPad1,1" ]]; then
            patch_ibss
            log "Sending iBSS..."
            $irecovery -f pwnediBSS.dfu
            sleep 1
        fi
        log "Sending iBEC..."
        $irecovery -f "$ipsw_custom/Firmware/dfu/iBEC.${device_model}ap.RELEASE.dfu"
        device_find_mode Recovery
    fi
    if [[ $debug_mode == 1 ]]; then
        ExtraArgs+="d"
    fi

    log "Running idevicerestore with command: $idevicerestore2 $ExtraArgs \"$ipsw_custom.ipsw\""
    $idevicerestore2 $ExtraArgs "$ipsw_custom.ipsw"
    opt=$?
    if [[ $1 == "first" ]]; then
        return $opt
    fi
    echo
    log "Restoring done! Read the message below if any error has occurred:"
    print "* For device activation, go to: Main Menu -> Attempt Activation"
    if [[ $platform == "macos" && $platform_arch == "arm64" ]]; then
        print "* Make sure that you are using a USB dock or hub to connect your device. Do not use USB dongles."
        echo
    fi
    if [[ $device_target_vers == "3.2"* && $device_target_powder != 1 ]]; then
        log "Note: Make sure to do the following below to fix the jailbreak."
        print "* To fix this, go to: Useful Utilities -> Disable/Enable Exploit -> Disable Exploit"
    fi
    print "* Please read the \"Troubleshooting\" wiki page in GitHub before opening any issue!"
    print "* Your problem may have already been addressed within the wiki page."
    print "* If opening an issue in GitHub, please provide a FULL log/output. Otherwise, your issue may be dismissed."
}

restore_futurerestore() {
    local ExtraArr=()
    local futurerestore2="$futurerestore"
    local port=8888
    local opt

    if [[ $1 == "--use-pwndfu" ]]; then
        device_fw_key_check
        pushd ../saved >/dev/null
        log "Starting local server for firmware keys"
        "$dir/darkhttpd" . --port $port &
        httpserver_pid=$!
        log "httpserver PID: $httpserver_pid"
        popd >/dev/null
        log "Waiting for local server"
        until [[ $($curl http://127.0.0.1:$port 2>/dev/null) ]]; do
            sleep 1
        done
    fi

    restore_download_bbsep
    # baseband args
    if [[ $restore_baseband == 0 ]]; then
        ExtraArr+=("--no-baseband")
    else
        ExtraArr+=("-b" "$restore_baseband" "-p" "$restore_manifest")
    fi
    # sep args for 64bit
    if [[ -n $restore_sep ]]; then
        ExtraArr+=("-s" "$restore_sep" "-m" "$restore_manifest")
    fi
    if (( device_proc < 7 )); then
        futurerestore2+="_old"
    elif [[ $device_proc == 7 && $device_target_other != 1 && $device_target_vers == "10.3.3" &&
            $restore_usepwndfu64 != 1 && $platform == "linux" && $platform_arch == "arm64" ]]; then
        futurerestore2+="_new" # no futurerestore nightly build for linux arm64
    else
        futurerestore2="../saved/futurerestore_$platform"
        if [[ $target_vers_maj == 10 ]]; then
            export FUTURERESTORE_I_SOLEMNLY_SWEAR_THAT_I_AM_UP_TO_NO_GOOD=1 # required since custom-latest-ota is broken
        else
            ExtraArr=("--latest-sep")
            case $device_type in
                iPhone* | iPad4,[235689] | iPad5,[24] | iPad6,[48] | iPad[67],12 | iPad7,[46] ) ExtraArr+=("--latest-baseband");;
                * ) ExtraArr+=("--no-baseband");;
            esac
        fi
        if (( target_vers_maj < 16 )) && [[ $ipsw_ipx != 1 ]]; then
            ExtraArr+=("--no-rsep")
        fi
        if [[ $device_target_setnonce == 1 ]]; then
            ExtraArr+=("--set-nonce")
        elif [[ $ipsw_ipx == 1 ]]; then
            ExtraArr+=("--rdsk" "rdsk.im4p" "--rkrn" "kcache.im4p")
        fi
        log "futurerestore nightly will be used for this restore: https://github.com/futurerestore/futurerestore"
        print "* Builds from here: https://github.com/LukeeGD/futurerestore"
        if [[ $platform == "linux" && $platform_arch != "x86_64" ]]; then
            warn "futurerestore nightly is not supported on Linux $platform_arch, cannot continue. x86_64 only."
            return
        fi
        log "Checking for futurerestore updates..."
        #download_from_url "https://api.github.com/repos/futurerestore/futurerestore/commits" commits
        #local fr_latest="$(cat commits | $jq -r '.[0].sha')"
        local fr_latest="45d0267ee24854d8bb9f5dbef29c3226af0d48db"
        local fr_branch="main"