If you have a legacy iPhone or iPad with an A9-A10(X) chip inside, then you might be excited to hear about a new and free firmware downgrading tool called terdus merula for macOS that allows you to downgrade your device’s firmware back to any version you want, in either a tethered or an untethered fashion.
In an unexpected turn of events, iOS & iPadOS 17.3.1 appears to be re-signed again despite Apple’s original un-signing of the firmware on March 12th.
Firmware downgrades are something that jailbreakers have used over the years to thwart Apple’s attempts to stop jailbreaking. Even when Apple stopped signing firmware, jailbreakers found a way around that by saying .shsh blobs and using them to restore to unsigned firmware. But more recently, changes made on Apple’s end appear to have made even this process less than usable.
Apple has stopped signing iOS 16.0.3 on Monday following the official public release of iOS & iPadOS 16.1 just over a week ago.
A couple of Mondays ago, Apple officially released iOS & iPadOS 15 to the general public with a slew of new features for Apple’s mobile device lineup following an extensive beta period throughout the Summer months.
Perhaps unsurprisingly, Apple’s move to launch a new firmware version for its platforms has now been complemented with the unsigning of the previously current firmware — iOS & iPadOS 14.8.
Following a lengthy beta testing period involving developers and volunteer participants, Apple officially released iOS & iPadOS 14.7 to the public last week with a long list of new features and improvements for iPhones and iPads alike. But no software update from Apple comes without the bitter aftertaste.
Just as Apple always does after releasing a major software update, the company closed the signing window for iOS & iPadOS 14.6, which makes it substantially more difficult for iPhone and iPad users to downgrade to the older firmware version if they’ve already updated the device(s) to iOS or iPadOS 14.7, or perhaps the newer yet iOS or iPadOS 14.7.1.
With the introduction of the A12 chip, Apple strengthened the security around generating nonces, saving blobs, and restoring in general. The basic process remains the same, but due to a feature called nonce-entanglement (yes, really), there are a few extra hoops we need to jump through to save valid blobs. This tutorial will show you how to do so.
If you want to use futurerestore to restore your Apple devices to unsigned firmwares, you will need to have .shsh2 blobs saved for the firmware you want to restore to. Jailbreakers often want to move to an unsigned firmware in order to use a jailbreak there, when newer signed firmwares do not have one. All jailbreakers should save blobs for all their devices periodically in order to have the option of using futurerestore in the future. This guide will go through how to use the online TSS Saver tool to get the .shsh2 blobs you need.
The Electra Team has dropped an updated version of the iOS 12-centric Chimera jailbreak tool on Tuesday, bringing the public release up to version 1.3.7.
Citing the official announcement, which was shared early this morning via the Electra Team’s official Twitter account, this update implements support for getting and setting nonce generator on A12(X) devices running iOS 12.1.3-12.2 and 12.4:
Update: This guide is now outdated, and simpler methods are available. We recommend that Apple TV 4K users now do Step 2) of this guide to find their ECID, and then use our simpler guide on saving blobs with TSS Saver instead. This guide will remain up for advanced users, who may still want to use it to save beta blobs, or incremental blobs which are not saved by TSS Saver.
The jailbreak community has been anything but quiet lately. We’ve seen things ranging from jailbreaking the new flagship iPhone XS Max, to updating untethered bootrom exploits for the legacy iPhone 3GS, to releasing a new jailbreak tool for firmware 1.1 on the original iPod touch; and now, something else of interest has surfaced.
In a curious video shared by YouTube user doras2 over the weekend, we discern what appears to be a fully-untethered jailbreak running on a 32-bit iPhone 5 handset with iOS 10.2.1 installed on it:
Good practice for any jailbreaker is to save your handset’s SHSH blobs regularly. Doing so opens you up to the possibility of firmware downgrades and other fruitful benefits concerning jailbreaking.
A whole host of SHSH blob-saving tools exist today, including blobsaver. The latter is a cross-platform GUI app that promises ease of use across common operating systems like macOS, Windows, and even Linux.