2Klasic

firmware key downgrade

Jul 22nd, 2017
277
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.75 KB | None | 0 0
  1. https://i.imgur.com/9D3ygue.jpg
  2. https://i.imgur.com/GnJltiv.jpg
  3. So... I did these:
  4. 1) Compiled and installed Futurerestore following this writeup at https://pastebin.com/LGPv0zbS, except before compiling libipatcher, replace FIRMWARE_JSON_URL_START to "http://127.0.0.1/firmware/" and DEVICE_JSON_URL_START to "http://127.0.0.1/device/" in libipatcher.cpp. For this reason, you can't use the pre-compiled version yet and you'll encounter/have fun with a ton of dependencies... Note: If libzip version dependency check fails, use "brew install --overwrite libzip". Thanks, /u/shrubbity.
  5. 2) Decrypt and patch iBSS. You only need to patch iBSS, and thanks to tihmstar's automated libipatcher patcher, you don't need to manually patch iBEC or kernel cache. You can read about how to decrypt and to patch iBSS by going to https://www.theiphonewiki.com/wiki/Tutorial:Odysseus_Bundles If the patching guide is too hard to follow or if you don't have a copy of IDA Pro, first decrypt the iBSS file, then follow this easier tutorial at https://www.reddit.com/r/jailbreak/comments/5zuvvx/tutorialpatch_ibss_on_ios_9x/. To use the easier hex edit way, patch iBSS from iOS 9.x firmware. The iBSS doesn't need to come from the firmware you wish to downgrade to. As long as it matches your device model, it should work. You can still downgrade to iOS 6 with a patched iOS 9 iBSS and kloader. Ignore all the bspatch stuff in the post. You just need to modify the iBSS file and save it.
  6. 3) Jailbreak iPad2,4 with Home Depot. Copy the kloader binary and your patched iBSS binary to your iPad with iFunbox. Mark kloader as executable on Terminal with "chmod +x kloader". Load the patched iBSS on MTerminal with "su", "alpine(or your modified root password)", "./kloader patchediBSSFile" on your iPad to enter pwnedDFU mode. Thanks for the corrections, /u/BSDIsShit and /u/FNCxPro.
  7. 4) At your home folder, create a folder named "firmware". In that folder, create a folder named "iPad2,4". In that folder, create a subfolder named "10B329". (Change hardware identifier and software build number to the one you wish to downgrade to). In that folder, create a file named "index.html" that includes all keys, IVs and their corresponding names/filepaths in this JSON format (https://pastebin.com/aUvDPvFq). Do not put in standard HTML boilerplate. Just plain JSON but with extension name of .html. If you're using another hardware/firmware combo, replace all folder paths, file names, key and IVs. You don't need to worry about not having kbag entries, you can leave them as they are since they are not used during the restore process.
  8. 5) Start a local server with "sudo python -m SimpleHTTPServer 80".
  9. 6) Run "futurerestore --use-pwndfu -t ticket.shsh --no-baseband ios.ipsw" in Terminal.
  10. 7) The restore should succeed :)
  11. Profit!
Add Comment
Please, Sign In to add comment