How to Downgrade iOS 9.3.5-10.3 to iOS 9 with iDeviceReRestore

iOS hacker alitek123 has just released his highly anticipated iDeviceReRestore downgrade tool. It lets you downgrade iOS 9.3.5-10.3 to 9 without requiring a jailbreak.

Follow the complete step by step tutorial below.

How the Restore Process Works

iDeviceReRestore downgrade tool is a fork of iDeviceRestore downgrade tool modified to utilize the use of the iOS 9.x 32-bit Re-Restore bug.

This tool is much more better than Future Restore because of the safety it offers to the users. If the downgrade fails for some reason, you can easily update to iOS 10 and then re-downgrade to iOS 9.

  • You can go back to iOS 9 provided your device is running iOS 9.3.5 or iOS 10-10.3 firmware.
  • You can also upgrade to iOS 9 from iOS 5,6,7,8 if you have blobs for your target iOS 9 firmware.

downgrade

Before you proceed, keep the following things in mind –

  • If local SHSH blobs are not present, iDeviceReRestore will try to retrieve blobs from Cydia’s server.
  • If your SHSH blob is not working, try fetching it from Cydia instead.
  • If your device is stuck in Recovery mode (iTunes and USB cable logo), your blobs are invalid. Hence, you will not be able to downgrade.
  • This tool is still in beta development stage. Minor errors are to be expected.
  • This tool doesn’t have a proper GUI so you need to use Terminal commands.
  • If you are on Windows, you can still use this tool. Just use VirtualBox to set up an Ubuntu or macOS Virtual Machine.

Which SHSH Blobs work with iDeviceReRestore?

Now, this is the tricky part. This tool requires specific SHSH blobs to work properly.

ios firmware

To verify your SHSH blob, open your SHSH blob file and look for a string starting from MII below <data>. If it matches the string given below, you can go ahead.

  • If your APTicket starts with MIIKkjAL, MIIKmDAL or MIIKlTAL, your SHSH blob is valid.
  • If your APTicket starts with MIIKqDAL, your SHSH blob is invalid.

If you haven’t saved your blobs correctly, it will not work. Generally, your blob should be fine if it doesn’t contain a nonce.

Which Devices are Compatible with iDeviceReRestore?

Here’s the complete list of supported 32-bit devices –

  • iPhone 4s
  • iPhone 5
  • iPhone 5c
  • iPad 2G
  • iPad 3G
  • iPad 4G
  • iPad mini
  • iPod touch 5G

64-bit devices are not compatible with this tool.

Requirements

  • Download iDeviceReRestore
  • Valid SHSH blobs for your destination firmware
  • A compatible 32-bit iOS device
  • A computer running Windows/macOS/Linux
  • A USB cable

How to Downgrade iOS 9.3.5-10.3 to Jailbreak-able iOS 9 Firmware

Step 1 Download iDeviceReRestore downgrade utility tool from the link given above. Extract its contents in a folder to your desktop.

Step 2 Put your .shsh blob file in the shsh folder.

Step 3 Download your correct destination iOS version from ipsw.me. Transfer the downloaded IPSW file to the iDeviceReRestore folder.

Step 4 Connect your device to the computer with a USB cable.

Step 5 Since this tool is based on DFU Restore method, put your device in DFU mode. Keep these buttons pressed until you get a black screen.

  • Turn off your iPhone, iPad or iPod.
  • Press Power button for 3 seconds.
  • Press Home button (or Volume button for iPhone 7/7 plus) and Power buttons together for 10 seconds.
  • Release the Power button while still keeping Home button (or Volume button) pressed.

Step 6 Now you need to execute the tool. Go to Applications and Open Terminal.

Step 7 Type cd followed by a space and drag the iDeviceReRestore folder on your desktop into the Terminal window and press enter. Now, execute the following command –

./idevicererestore -r <file name of destination firmware>.ipsw

To downgrade iPad 2 to iOS 9.3.1 firmware, this command will look something like this  –

./idevicererestore -r iPad2,2_9.3.1_13E238_Restore.ipsw

Step 8 It will now perform a lot of steps automatically. Wait and let it do its thing.

Step 9 If you have performed the steps given above correctly, you will get this message –

Got status message
Status: Restore Finished
Cleaning up…
DONE

idevicererestore 2

Step 10 Your device will now be successfully downgraded to a jailbreak-able iOS 9 firmware version.

iDeviceReRestore1

Step 11 Use Home Depot IPA to jailbreak your device running iOS 9. Follow the tutorial given below –

Step 12 (Optional) You can also downgrade you device to iOS 8 after going back to iOS 9. You need to follow the iOS spoofing tutorial given below –

How to Fix “dyld: Library not loaded” Error in Terminal

Many users are reporting this error – dyld: Library not loaded: /usr/local/lib/libirecovery.2.dylib. To fix this error, enter the following commands in Terminal –

Step 1 Install brew using the command given below.

/usr/bin/ruby -e “$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)”

Step 2 Enter this command to install libimobiledevice 

brew install libimobiledevice

With libimobiledevice installed, the error will be gone.

Did you Downgrade/Upgrade your Device?

That’s all there’s to it! Your device will now be downgraded/upgraded to jailbreak-able iOS 9 firmware. You can even go back to iOS 8 altogether.

Enjoy your blazing fast device while still having a jailbreak. This is a dream come true for all 32-bit device owners. If you own a 32-bit device, don’t waste time and use it asap. Apple might decide to close the Re-Restore bug anytime soon.

Always save your blobs!

If you are facing errors, please leave a comment below. I will be happy to help.

As always, don’t forget to follow us on Facebook and Twitter.

  • Daniel Yankovich

    Is there any way to use someone else’s shsh blob to downgrade? or does it have to be your own… and also why does it?

    • Hello, Daniel. SHSH Blobs must be of your own device else it won’t work.

  • Gerben Zomer

    Hello,

    When i try this app on my Mac
    And give this command:
    ./idevicererestore -r filename.ipsw

    IT says can’t find image file

    • Hello, Gerben. Please try installing libirecovery as shown above.

      • Gerben Zomer

        Thanks

  • Gerben Zomer

    please can u help me?
    i have iPhone 4s and I’m stuck with this:

    NOTE: using cached version data

    Found device in DFU mode

    Identified device as n94ap, iPhone4,1

    Extracting BuildManifest from IPSW

    Product Version: 6.1.3

    Product Build: 10B329 Major: 10

    Device supports Image4: false

    Variant: Customer Erase Install (IPSW)

    This restore will erase your device data.

    Found ECID 46976639816

    Getting ApNonce in dfu mode…

    checking for local shsh

    Using local SHSH

    Extracting filesystem from IPSW

    [==================================================] 100.0%

    Extracting iBSS.n94ap.RELEASE.dfu…

    Not personalizing component iBSS…

    Sending iBSS (76056 bytes)…

    [==================================================] 100.0%

    Nonce:

    checking for local shsh

    Using local SHSH

    Extracting iBEC.n94ap.RELEASE.dfu…

    Not personalizing component iBEC…

    ERROR: Unable to get ApTicket from TSS request

    ERROR: Unable to send iBEC to device

    ERROR: Unable to place device into recovery mode from DFU mode

    • Hey, Gerber. Are your blobs compatible and in the correct format? The tool seems to be having an issue with your blobs.

  • Yeah sure, I will help you install it, no problem. Did you get the command to work?

  • Hello, you need to install libirecovery. Doing this will fix your issue –

    brew install libusb readline automake autoconf libtool pkg-config
    cd /tmp
    git clone https://github.com/libimobiledevice/libirecovery.git
    cd libirecovery
    ./autogen.sh
    make
    sudo make install

  • thomashoo

    Hi,
    HELP PLEASE !
    My SHSH blog starts with “MIIKqzAL”, is this still downgrade-able ?

    • Hello, Thomas. Unfortunately, this type of blobs doesn’t work with this tool.

  • Doris Anguiano

    I want to downgrade my iPhone 5c from 10.3.1 to 9.0.2 (and yes… I have
    the blobs)…. So, when I try to do this I get this message:

    About to restore device…
    Waiting for device…
    ERROR: Unable to connect to device in restore mode
    ERROR: Unable to open device in restore mode
    ERROR: Unable to restore device

    What can I do?

    Also… I did in DFU mode and get same Error, plz help!

    • Hello, Doris. Please send me a screenshot, if possible. This error is related to your iPhone. Check your connection. Is it connected properly?

  • Sylvie Khor

    Is it possible that use 9.3.5 shsh blob to downgrade to 9.3.3?

    • Hello, Sylvie. No, that’s not possible. You must have blobs for your destination firmware.

  • Ayaz Younis

    Hi all. This might seem like a basic question. In Step 3, where do you exactly place the ripsaw file? Because I ran the tool, with blobs in sh folder and the ripsaw in root of idevicererestore folder. But when I run the tool it says:

    /Users/ayaz/Desktop/ipad/iDeviceReRestore-1.0.2-macOS/idevicererestore -r iPad2,1_9.3.3_13G34_Restore.ipsw

    NOTE: using cached version data

    Found device in DFU mode

    Identified device as k****, iPad2,1

    ERROR: Firmware file iPad2,1_9.3.3_13G34_Restore.ipsw does not exist.

  • Finch Brian

    my iphone 4s stuck on 9.3.5 and i have shsh blob 6.1.3 can this bring back to 6.1.3 ?
    https://uploads.disquscdn.com/images/1801f666d98d10b11d9fd5731bd0406846fbfdd68fc7131f78ecf4c2cf838348.jpg

    • Hello, Finch. Unfortunately, this tool only works for upgrading/downgrading to iOS 9.

  • Which error? Please send me a screenshot.

    • Okan

      Its appears success until make here is make’s output:

      /Applications/Xcode .app/Contents/Developer/usr/bin/make all-recursive
      Making all in src
      make[2]: Nothing to be done for `all’.
      Making all in include
      make[2]: Nothing to be done for `all’.
      Making all in tools
      make[2]: Nothing to be done for `all’.

      • What?

        • Okan

          type
          make clean
          and make && make install again.

          I am getting the above output when script finishes. Do you know why? I am trying to downgrade from 9.3.5 to 8.4.1

          ERROR: Unable to get ApTicket from TSS request
          WARNING: Unable to send APTicket
          Extracting iBEC.n94.RELEASE.dfu…
          Not personalizing component iBEC…
          Sending iBEC (283020 bytes)…
          Device: iPhone4,1
          Getting ApNonce in recovery mode… 4e bd 39 c3 35 aa a5 69 f8 51 e0 19 12 76 97 35 7a b5 43 6b
          ERROR: Unable to get ApTicket from TSS request
          ERROR: Unable to send APTicket
          ERROR: Unable to place device into restore mode

          • Hello, Okan. This tool only works for iOS 9 upgrade/downgrade. It won’t work for iOS 8.4.1 downgrade. Do you have blobs saved up for iOS 9?

  • huhuhuhu

    hello, how can i find out wether i have saved blobs on cydia server?

    • huhuhuhu

      on windows, idevicerestore wont open. it says application is not valid

      • Which version of Windows are you running? Try extracting the contents of the ZIP archive in another folder.

        • huhuhuhu

          Tried that. I’m on Windows 7. The error says “The application is invalid! Load library failed!”

    • Hello, hu. There’s no need to do anything. The tool will automatically attempt to check if the blobs are stashed.