Fix issue with baseband restore (#295) & (#296)

tihmstar · Jan 3, 2020 · 98a4aa1 · 98a4aa1
1 parent f8f2e79
commit 98a4aa1
Show file tree

Hide file tree

Showing 4 changed files with 40 additions and 44 deletions.
diff --git a/README.md b/README.md
@@ -10,12 +10,12 @@ __Only use if you are sure what you're doing.__
 # Features  
 * Supports the following downgrade methods:
   * Prometheus 64-bit devices (generator and ApNonce collision mode)
-  * Odysseus for 32-bit / 64-bit devices
+  * Odysseus for 32-bit & 64-bit (A7-A11) devices
   * Re-restoring 32-bit devices to iOS 9.x with [alitek123](https://github.com/alitek12)'s no-ApNonce method (alternative — [idevicererestore](https://downgrade.party)).
 * Allows restoring to non-matching firmware with custom SEP+baseband
 
 # Dependencies
-* ## External Libs
+* ## External libs
   Make sure these are installed
   * [libzip](https://github.com/nih-at/libzip);
   * [libcurl](https://github.com/curl/curl);
@@ -25,7 +25,7 @@ __Only use if you are sure what you're doing.__
   * [libirecovery](https://github.com/libimobiledevice/libirecovery);
   * [libimobiledevice](https://github.com/libimobiledevice/libimobiledevice);
   * [img4tool](https://github.com/tihmstar/img4tool);
-  * [liboffsetfinder64](https://github.com/tihmstar/liboffsetfinder64)
+  * [liboffsetfinder64](https://github.com/tihmstar/liboffsetfinder64);
   * [libipatcher](https://github.com/tihmstar/libipatcher)
 
 * ## Submodules
@@ -67,15 +67,15 @@ Usage: `futurerestore [OPTIONS] iPSW`
 |                       |                                                           | DO NOT use this parameter, if you update from jailbroken firmware! |
 |  ` -w `           | ` --wait `                                        | Keep rebooting until ApNonce matches APTicket (ApNonce collision, unreliable) |
 |  ` -d `           | ` --debug `                                      | Show all code, use to save a log for debug testing |
-|                       | ` --exit-recovery `                       | Exit recovery mode and quit |
+|  ` -e `           | ` --exit-recovery `                       | Exit recovery mode and quit |
 |                       | ` --use-pwndfu `                           | Restoring devices with Odysseus method. Device needs to be in pwned DFU mode already |
 |                       | ` --just-boot "-v" `                     | Tethered booting the device from pwned DFU mode. You can optionally set ` boot-args ` |
-|                       | ` --latest-sep `                             | Use latest signed sep instead of manually specifying one (may cause bad restore) |
+|                       | ` --latest-sep `                             | Use latest signed SEP instead of manually specifying one (may cause bad restore) |
 |  ` -s `           | ` --sep PATH `                                 | SEP to be flashed |
 |  ` -m `           | ` --sep-manifest PATH `              | BuildManifest for requesting SEP ticket |
 |                       | ` --latest-baseband `                | Use latest signed baseband instead of manually specifying one (may cause bad restore) |
 |  ` -b `           | ` --baseband PATH	`                     | Baseband to be flashed |
-|  ` -p `           | ` --baseband-manifest PATH `  | Buildmanifest for requesting baseband ticket |
+|  ` -p `           | ` --baseband-manifest PATH `  | BuildManifest for requesting baseband ticket |
 |                       | ` --no-baseband `                         | Skip checks and don't flash baseband |
 |                       |                                                           | Only use this for device without a baseband (eg. iPod touch or some Wi-Fi only iPads) |
 
@@ -109,13 +109,13 @@ You can downgrade, if the destination firmware version is compatible with the **
 
 ### Youtube
 <a href="http://www.youtube.com/watch?feature=player_embedded&v=BIMx2Y13Ukc" target="_blank"><img src="http://img.youtube.com/vi/BIMx2Y13Ukc/0.jpg" alt="Prometheus" width="240" height="180"/></a>
-*Prometheus*
+  *Prometheus*
 
 <a href="http://www.youtube.com/watch?feature=player_embedded&v=UXxpUH71-s4" target="_blank"><img src="http://img.youtube.com/vi/UXxpUH71-s4/0.jpg" alt="Prometheus" width="240" height="180"/></a>
-*nonceEnabler*
+  *nonceEnabler*
 
 ### Recommended methods to activate nonceEnabler patch
-#### Method 1: ios-kern-utils (iOS 7.x-10.x):
+#### Method 1: ios-kern-utils (iOS 7.x-10.x)
 1. Install DEB-file of [ios-kern-utils](https://github.com/Siguza/ios-kern-utils/releases/) on device;
 2. Run on the device `nvpatch com.apple.System.boot-nonce`.
 
@@ -125,7 +125,8 @@ Use utilities for setting boot-nonce generator:
 2. [v0rtexnonce](https://github.com/arx8x/v0rtexnonce) for iOS 10.x;
 3. [Nonceset1112](https://github.com/julioverne/NonceSet112) for iOS 11.0-11.1.2;
 4. [noncereboot1131UI](https://github.com/s0uthwest/noncereboot1131UI) for iOS 11.0-11.4b3;
-5. [NonceReboot12xx](https://github.com/ur0/NonceReboot12XX) for iOS 12.0-12.1.2.
+5. [NonceReboot12xx](https://github.com/ur0/NonceReboot12XX) for iOS 12.0-12.1.2;
+6. [GeneratorAutoSetter](https://github.com/Halo-Michael/GeneratorAutoSetter) for checkra1n jailbreak on iOS / iPadOS 13.x. install it from [Cydia's developer repo](https://halo-michael.github.io/repo/) on device.
 
 #### Method 3: Using jailbreak tools
 Use jailbreak tools for setting boot-nonce generator:
@@ -135,7 +136,7 @@ Use jailbreak tools for setting boot-nonce generator:
 4. [unc0ver](https://unc0ver.dev) for iOS 11.0-12.2, 12.4.x;
 5. [Chimera and ChimeraTV](https://chimera.sh) for iOS 12.0-12.2, 12.4 and tvOS 12.0-12.2, 12.4.
 
-### Activate tfp0 if jailbreak doesn't allow it
+### Activate tfp0, if jailbreak doesn't allow it
 #### Method 1 (if jailbroken on iOS 9.2-9.3.x)
   * reboot;
   * reactivate jailbreak with [Luca Todesco](https://github.com/kpwn)'s [JailbreakMe](https://jbme.qwertyoruiop.com/);
@@ -152,10 +153,10 @@ Use jailbreak tools for setting boot-nonce generator:
 
 ---
 
-## 2) Prometheus (64-bit device) - ApNonce collision method (Recovery mode);
+## 2) Prometheus (64-bit device) - ApNonce collision method (Recovery mode)
 
 ### Requirements
-- Device with A7 chip on iOS 9.1 - 10.2 or iOS 10.3 beta 1;
+- **Device with A7 chip on iOS 9.1 - 10.2 or iOS 10.3 beta 1**;
 - Jailbreak doesn't required;
 - Signing ticket files (`.shsh`, `.shsh2`, `.plist`) with a customly chosen APNonce;
 - Signing ticket files needs to have one of the ApNonces, which the device generates a lot;
@@ -165,13 +166,13 @@ You can downgrade if the destination firmware version, if it is compatible with
 
 ### How to use
 1. Connect your device in normal or recovery mode;
-2. On the computer run `futurerestore -w -t ticket.shsh --latest-baseband --latest-sep ios.ipsw`
+2. On the computer run `futurerestore -w -t ticket.shsh --latest-baseband --latest-sep firmware.ipsw`
 * If you have saved multiple signing tickets with different nonces you can specify more than
-one to speed up the process: `futurerestore -w -t t1.shsh -t t2.shsh -t t3.shsh -t t4.shsh --latest-baseband --latest-sep ios.ipsw`
+one to speed up the process: `futurerestore -w -t t1.shsh -t t2.shsh -t t3.shsh -t t4.shsh --latest-baseband --latest-sep firmware.ipsw`
 
 ---
 
-## 3) Prometheus (64-bit device) - ApNonce collision method (DFU mode);
+## 3) Prometheus (64-bit device) - ApNonce collision method (DFU mode)
 
 ### Requirements
 - __Devices with A7 (iPhone 5s, iPad Air, iPad mini 2), A8 (iPhone 6 [+], iPad mini [2,3,4], iPod touch [6th generation]) and A8X (iPad Air 2) chips on all firmwares;__
@@ -198,12 +199,12 @@ You can downgrade if the destination firmware version, if it is compatible with
    `img4tool -s ticket.shsh -c iBSS.signed -p <original_iBSS>`;
 6. Use img4tool for sign iBEC:
    `img4tool -s ticket.shsh -c iBEC.signed -p <original_iBEC>`;
-   7. So, after signing we can boot into Recovery with irecovery.
+7. So, after signing we can boot into Recovery with irecovery.
 
    `irecovery -f iBSS.signed` - loading iBSS;
 
    `irecovery -f iBEC.signed` - loading iBEC;
-8. So good! On the computer run `futurerestore -t ticket.shsh --latest-baseband --latest-sep -w ios.ipsw`.
+8. So good! On the computer run `futurerestore -t ticket.shsh --latest-baseband --latest-sep -w firmware.ipsw`.
 
 ---
 
@@ -223,26 +224,23 @@ If you have a jailbroken device, you can downgrade to **any** firmware version y
 1. Get device into kDFU/pwnDFU
   * Pre-iPhone4s (limera1n devices):
     * Enter to pwnDFU mode with redsn0w or any other tool
-  * iPhone 4s and later:
-    * Enter to kDFU mode with kDFU app (cydia: repo.tihmstar.net) or by loading a pwniBSS from any existing odysseus bundle
-         or
-    * Enter to pwnDFU mode with [ipwndfu](https://github.com/axi0mx/ipwndfu) or use futurerestore for it;
+  * iPhone 4s and later 32-bit devices:
+    * Enter to kDFU mode with kDFU app (cydia: repo.tihmstar.net) or by loading a pwnediBSS from any existing odysseus bundle
+  * Any 64-bit device
+    * Enter to pwnDFU mode and patch signature check with special fork of [ipwndfu](https://github.com/LinusHenze/ipwndfu_public)
 2. Connect your device to computer in kDFU mode (or pwnDFU mode)
-3. On the computer run `futurerestore --use-pwndfu -t ticket.shsh --latest-baseband ios.ipsw`
+3. On the computer run `futurerestore --use-pwndfu -t ticket.shsh --latest-baseband firmware.ipsw`
 
 ### Youtube
-<a href="http://www.youtube.com/watch?feature=player_embedded&v=FQfcybsEWmM" target="_blank"><img src="http://img.youtube.com/vi/FQfcybsEWmM/0.jpg" alt="Odysseus" width="240" height="180"/></a>
-*Futurerestore + libipatcher*
+<a href="http://www.youtube.com/watch?feature=player_embedded&v=FQfcybsEWmM" target="_blank"><img src="http://img.youtube.com/vi/FQfcybsEWmM/0.jpg" alt="Odysseus" width="240" height="180"/></a>   *futurerestore + libipatcher*
 
-<a href="http://www.youtube.com/watch?feature=player_embedded&v=8Ro4g6StPeI" target="_blank"><img src="http://img.youtube.com/vi/8Ro4g6StPeI/0.jpg" alt="Odysseus" width="240" height="180"/></a>
-*kDFU app*
+<a href="http://www.youtube.com/watch?feature=player_embedded&v=8Ro4g6StPeI" target="_blank"><img src="http://img.youtube.com/vi/8Ro4g6StPeI/0.jpg" alt="Odysseus" width="240" height="180"/></a>  *kDFU app*
 
-<a href="http://www.youtube.com/watch?feature=player_embedded&v=Wo7mGdMcjxw" target="_blank"><img src="http://img.youtube.com/vi/Wo7mGdMcjxw/0.jpg" alt="Odysseus" width="240" height="180"/></a>
-*Enter kDFU mode (watch up to the point where the screen goes black)*  
+<a href="http://www.youtube.com/watch?feature=player_embedded&v=Wo7mGdMcjxw" target="_blank"><img src="http://img.youtube.com/vi/Wo7mGdMcjxw/0.jpg" alt="Odysseus" width="240" height="180"/></a>  *Enter kDFU mode (watch up to the point where the screen goes black)*  
 
-*You can use **any** odysseus bundle for this*
+You can use **any** odysseus bundle for this.
 
-## 5) iOS 9.x Re-restore bug (found by @alitek123) (only for 32-bit devices):
+## 5) iOS 9.x re-restore bug by @alitek123 (only for 32-bit devices)
 ### Requirements
 - Jailbreak doesn't required;
 - Signing ticket files (`.shsh`, `.shsh2`, `.plist`) from by iOS 9.x without ApNonce (noNonce APTickets)

diff --git a/external/idevicerestore b/external/idevicerestore
diff --git a/futurerestore/futurerestore.cpp b/futurerestore/futurerestore.cpp
@@ -7,7 +7,6 @@
 //
 
 #include <libgeneral/macros.h>
-
 #include <iostream>
 #include <stdlib.h>
 #include <string.h>
@@ -137,7 +136,7 @@ void futurerestore::putDeviceIntoRecovery(){
         info("Entering recovery mode...\n");
         retassure(!normal_enter_recovery(_client),"Unable to place device into recovery mode from %s mode\n", _client->mode->string);
     }else if (_client->mode->index == MODE_RECOVERY){
-        info("Device already in Recovery mode\n");
+        info("Device already in recovery mode\n");
     }else if (_client->mode->index == MODE_DFU && _isPwnDfu &&
 #ifdef HAVE_LIBIPATCHER
               true
@@ -178,7 +177,7 @@ plist_t futurerestore::nonceMatchesApTickets(){
 
     if (getDeviceMode(true) != MODE_RECOVERY){
         if (getDeviceMode(false) != MODE_DFU || *_client->version != '9')
-            reterror("Device is not in recovery mode, can't check apnonce\n");
+            reterror("Device is not in recovery mode, can't check ApNonce\n");
         else
             _rerestoreiOS9 = (info("Detected iOS 9.x 32-bit re-restore, proceeding in DFU mode\n"),true);
     }
@@ -291,7 +290,7 @@ void futurerestore::waitForNonce(vector<const char *>nonces, size_t nonceSize){
             usleep(1*USEC_PER_SEC);
         }
         while (getDeviceMode(true) != MODE_RECOVERY) usleep(USEC_PER_SEC*0.5);
-        retassure(!recovery_client_new(_client), "Could not connect to device in recovery mode.\n");
+        retassure(!recovery_client_new(_client), "Could not connect to device in recovery mode\n");
 
         recovery_get_ap_nonce(_client, &realnonce, &realNonceSize);
         info("Got ApNonce from device: ");
@@ -1078,11 +1077,9 @@ int futurerestore::doJustBoot(const char *ipsw, string bootargs){
 //
 //    retassure(build_identity = getBuildidentityWithBoardconfig(buildmanifest, client->device->hardware_model, 0),"ERROR: Unable to find any build identities for IPSW\n");
 //
-//
 //    /* print information about current build identity */
 //    build_identity_print_information(build_identity);
 //
-//
 //    //check for enterpwnrecovery, because we could be in DFU mode
 //    retassure(_enterPwnRecoveryRequested, "enterPwnRecoveryRequested is not set, but required");
 //

diff --git a/futurerestore/main.cpp b/futurerestore/main.cpp
@@ -40,14 +40,14 @@ static struct option longopts[] = {
     { "wait",               no_argument,            NULL, 'w' },
     { "update",             no_argument,            NULL, 'u' },
     { "debug",              no_argument,            NULL, 'd' },
+    { "exit-recovery",      no_argument,            NULL, 'e' },
     { "latest-sep",         no_argument,            NULL, '0' },
     { "latest-baseband",    no_argument,            NULL, '1' },
     { "no-baseband",        no_argument,            NULL, '2' },
 #ifdef HAVE_LIBIPATCHER
     { "use-pwndfu",         no_argument,            NULL, '3' },
     { "just-boot",          optional_argument,      NULL, '4' },
 #endif
-    { "exit-recovery",      no_argument,            NULL, '5' },
     { NULL, 0, NULL, 0 }
 };
 
@@ -67,7 +67,7 @@ void cmd_help(){
     printf("              \t\t\tDO NOT use this parameter, if you update from jailbroken firmware!\n");
     printf("  -w, --wait\t\t\tKeep rebooting until ApNonce matches APTicket (ApNonce collision, unreliable)\n");
     printf("  -d, --debug\t\t\tShow all code, use to save a log for debug testing\n");
-    printf("      --exit-recovery\t\tExit recovery mode and quit\n");
+    printf("  -e, --exit-recovery\t\tExit recovery mode and quit\n");
 
 #ifdef HAVE_LIBIPATCHER
     printf("\nOptions for downgrading with Odysseus:\n");
@@ -86,7 +86,7 @@ void cmd_help(){
     printf("  -p, --baseband-manifest PATH\tBuildManifest for requesting baseband ticket\n");
     printf("      --no-baseband\t\tSkip checks and don't flash baseband\n");
     printf("                   \t\tOnly use this for device without a baseband (eg. iPod touch or some Wi-Fi only iPads)\n\n");
-    }
+}
 
 #ifdef WIN32
     DWORD termFlags;
@@ -133,15 +133,15 @@ int main_r(int argc, const char * argv[]) {
         return -1;
     }
 
-    while ((opt = getopt_long(argc, (char* const *)argv, "ht:b:p:s:m:wud0123", longopts, &optindex)) > 0) {
+    while ((opt = getopt_long(argc, (char* const *)argv, "ht:b:p:s:m:wude0123", longopts, &optindex)) > 0) {
         switch (opt) {
             case 't': // long option: "apticket"; can be called as short option
                 apticketPaths.push_back(optarg);
                 break;
             case 'b': // long option: "baseband"; can be called as short option
                 basebandPath = optarg;
                 break;
-            case 'p': // long option: "baseband-plist"; can be called as short option
+            case 'p': // long option: "baseband-manifest"; can be called as short option
                 basebandManifestPath = optarg;
                 break;
             case 's': // long option: "sep"; can be called as short option
@@ -174,7 +174,7 @@ int main_r(int argc, const char * argv[]) {
                 break;
             break;
 #endif
-            case '5': // long option: "exit-recovery";
+            case 'e': // long option: "exit-recovery"; can be called as short option
                 exitRecovery = true;
                 break;
             case 'd': // long option: "debug"; can be called as short option
@@ -185,6 +185,7 @@ int main_r(int argc, const char * argv[]) {
                 return -1;
         }
     }
+
     if (argc-optind == 1) {
         argc -= optind;
         argv += optind;