iOS hacker alitek123 has just released his highly anticipated iDeviceReRestore downgrade tool. It lets you downgrade iOS 9.3.5-10.3 to 9 without requiring a jailbreak.
Follow the complete step by step tutorial below.
Table of Contents
How the Restore Process Works
iDeviceReRestore downgrade tool is a fork of iDeviceRestore downgrade tool modified to utilize the use of the iOS 9.x 32-bit Re-Restore bug.
This tool is much more better than Future Restore because of the safety it offers to the users. If the downgrade fails for some reason, you can easily update to iOS 10 and then re-downgrade to iOS 9.
- You can go back to iOS 9 provided your device is running iOS 9.3.5 or iOS 10-10.3 firmware.
- You can also upgrade to iOS 9 from iOS 5,6,7,8 if you have blobs for your target iOS 9 firmware.
Before you proceed, keep the following things in mind –
- If local SHSH blobs are not present, iDeviceReRestore will try to retrieve blobs from Cydia’s server.
- If your SHSH blob is not working, try fetching it from Cydia instead.
- If your device is stuck in Recovery mode (iTunes and USB cable logo), your blobs are invalid. Hence, you will not be able to downgrade.
- This tool is still in beta development stage. Minor errors are to be expected.
- This tool doesn’t have a proper GUI so you need to use Terminal commands.
- If you are on Windows, you can still use this tool. Just use VirtualBox to set up an Ubuntu or macOS Virtual Machine.
Which SHSH Blobs work with iDeviceReRestore?
Now, this is the tricky part. This tool requires specific SHSH blobs to work properly.
To verify your SHSH blob, open your SHSH blob file and look for a string starting from MII below <data>. If it matches the string given below, you can go ahead.
- If your APTicket starts with MIIKkjAL, MIIKmDAL or MIIKlTAL, your SHSH blob is valid.
- If your APTicket starts with MIIKqDAL, your SHSH blob is invalid.
If you haven’t saved your blobs correctly, it will not work. Generally, your blob should be fine if it doesn’t contain a nonce.
Which Devices are Compatible with iDeviceReRestore?
Here’s the complete list of supported 32-bit devices –
- iPhone 4s
- iPhone 5
- iPhone 5c
- iPad 2G
- iPad 3G
- iPad 4G
- iPad mini
- iPod touch 5G
64-bit devices are not compatible with this tool.
Requirements
- Download iDeviceReRestore
- Valid SHSH blobs for your destination firmware
- A compatible 32-bit iOS device
- A computer running Windows/macOS/Linux
- A USB cable
How to Downgrade iOS 9.3.5-10.3 to Jailbreak-able iOS 9 Firmware
Step 1 Download iDeviceReRestore downgrade utility tool from the link given above. Extract its contents in a folder to your desktop.
Step 2 Put your .shsh blob file in the shsh folder.
Step 3 Download your correct destination iOS version from ipsw.me. Transfer the downloaded IPSW file to the iDeviceReRestore folder.
Step 4 Connect your device to the computer with a USB cable.
Step 5 Since this tool is based on DFU Restore method, put your device in DFU mode. Keep these buttons pressed until you get a black screen.
- Turn off your iPhone, iPad or iPod.
- Press Power button for 3 seconds.
- Press Home button (or Volume button for iPhone 7/7 plus) and Power buttons together for 10 seconds.
- Release the Power button while still keeping Home button (or Volume button) pressed.
Step 6 Now you need to execute the tool. Go to Applications and Open Terminal.
Step 7 Type cd followed by a space and drag the iDeviceReRestore folder on your desktop into the Terminal window and press enter. Now, execute the following command –
./idevicererestore -r <file name of destination firmware>.ipsw
To downgrade iPad 2 to iOS 9.3.1 firmware, this command will look something like this –
./idevicererestore -r iPad2,2_9.3.1_13E238_Restore.ipsw
Step 8 It will now perform a lot of steps automatically. Wait and let it do its thing.
Step 9 If you have performed the steps given above correctly, you will get this message –
Got status message
Status: Restore Finished
Cleaning up…
DONE
Step 10 Your device will now be successfully downgraded to a jailbreak-able iOS 9 firmware version.
Step 11 Use Home Depot IPA to jailbreak your device running iOS 9. Follow the tutorial given below –
Step 12 (Optional) You can also downgrade you device to iOS 8 after going back to iOS 9. You need to follow the iOS spoofing tutorial given below –
How to Fix “dyld: Library not loaded” Error in Terminal
Many users are reporting this error – dyld: Library not loaded: /usr/local/lib/libirecovery.2.dylib. To fix this error, enter the following commands in Terminal –
Step 1 Install brew using the command given below.
/usr/bin/ruby -e “$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)”
Step 2 Enter this command to install libimobiledevice
brew install libimobiledevice
With libimobiledevice installed, the error will be gone.
Did you Downgrade/Upgrade your Device?
That’s all there’s to it! Your device will now be downgraded/upgraded to jailbreak-able iOS 9 firmware. You can even go back to iOS 8 altogether.
Enjoy your blazing fast device while still having a jailbreak. This is a dream come true for all 32-bit device owners. If you own a 32-bit device, don’t waste time and use it asap. Apple might decide to close the Re-Restore bug anytime soon.
Always save your blobs!
If you are facing errors, please leave a comment below. I will be happy to help.
As always, don’t forget to follow us on Facebook and Twitter.
You will need to first install git for windows.
I get this error and the steps below don’t solve it
dyld: Library not loaded: /usr/local/opt/libzip/lib/libzip.4.dylib
Hello, Marcus. You need to have all the requisite libraries before you install it. I have already told how to do this in my comments above.
I did all that and even went as far as reinstalling homebrew. I still get the same error
Try running this command – brew install libzip
Hi Luca R,
Thank you very much for such a wonderful article. I got the same issue as Marcus even following the steps you have specified. Commands “brew install libzip” install’s libzip version 1.2.0 where as when we run ./idevicererestore its searching libzip.4.dylib file where as libzip version 1.2.0 install’s libzip.5.dylib file in location “/usr/local/opt/libzip/lib/”. Request you to help me out.
Thanks for the kind words, Mohith. Are you running this on a Mac or Windows? What’s your device/firmware version and what’s your destination firmware?
hello, Criss. The target firmware with this method is always iOS 9. This means you can go from 8.4.1 to 9 if you have SHSH blobs.
https://uploads.disquscdn.com/images/cf9218c891bb737986ecba13602bd3f2304a21eba7deaa7453d95f2220ff3a69.png
I always get this error whenever I try use the code: ./idevicererestore -r iPad2,2_9.3.1_13E238_Restore.ipsw
I am using windows
Hello, Boltic. What’s your device/firmware versions and which version are you trying to downgrade to?
hello, how can i find out wether i have saved blobs on cydia server?
on windows, idevicerestore wont open. it says application is not valid
Which version of Windows are you running? Try extracting the contents of the ZIP archive in another folder.
Tried that. I’m on Windows 7. The error says “The application is invalid! Load library failed!”
Hello, hu. There’s no need to do anything. The tool will automatically attempt to check if the blobs are stashed.
Which error? Please send me a screenshot.
Its appears success until make here is make’s output:
/Applications/Xcode .app/Contents/Developer/usr/bin/make all-recursive
Making all in src
make[2]: Nothing to be done for `all’.
Making all in include
make[2]: Nothing to be done for `all’.
Making all in tools
make[2]: Nothing to be done for `all’.
What?
type
make clean
and make && make install again.
I am getting the above output when script finishes. Do you know why? I am trying to downgrade from 9.3.5 to 8.4.1
ERROR: Unable to get ApTicket from TSS request
WARNING: Unable to send APTicket
Extracting iBEC.n94.RELEASE.dfu…
Not personalizing component iBEC…
Sending iBEC (283020 bytes)…
Device: iPhone4,1
Getting ApNonce in recovery mode… 4e bd 39 c3 35 aa a5 69 f8 51 e0 19 12 76 97 35 7a b5 43 6b
ERROR: Unable to get ApTicket from TSS request
ERROR: Unable to send APTicket
ERROR: Unable to place device into restore mode
Hello, Okan. This tool only works for iOS 9 upgrade/downgrade. It won’t work for iOS 8.4.1 downgrade. Do you have blobs saved up for iOS 9?
my iphone 4s stuck on 9.3.5 and i have shsh blob 6.1.3 can this bring back to 6.1.3 ?
https://uploads.disquscdn.com/images/1801f666d98d10b11d9fd5731bd0406846fbfdd68fc7131f78ecf4c2cf838348.jpg
Hello, Finch. Unfortunately, this tool only works for upgrading/downgrading to iOS 9.
Hi all. This might seem like a basic question. In Step 3, where do you exactly place the ripsaw file? Because I ran the tool, with blobs in sh folder and the ripsaw in root of idevicererestore folder. But when I run the tool it says:
/Users/ayaz/Desktop/ipad/iDeviceReRestore-1.0.2-macOS/idevicererestore -r iPad2,1_9.3.3_13G34_Restore.ipsw
NOTE: using cached version data
Found device in DFU mode
Identified device as k****, iPad2,1
ERROR: Firmware file iPad2,1_9.3.3_13G34_Restore.ipsw does not exist.
Hello, Ayaz. You should place the IPSW firmware file in iDeviceReRestore folder. Post a screenshot, if possible.
HI Thanks.
This is my screenshot. Looks ok? https://uploads.disquscdn.com/images/b7dfee0d57278f2d07e2980d667c1828fd0d940266e7d14693981cc9b30f27ff.png
Oh I managed to get bit further now.
Now stuck on:
ERROR: TSS request failed (status=94, message=This device isn’t eligible for the requested build)
Sending TSS request attempt 1… ERROR: Unable to send TSS request
ERROR: Unable to get SHSH blobs for this device
I had to rename my blobs file. Now I am stuck at 60 percent. https://uploads.disquscdn.com/images/cc887710b67ec867e3f80f5acb64ff5c3c33424e6f595f5b3285abf3a89a0b50.png
Hey, Ayaz. iBEC errors are related to your firmware. I will update the tutorial shortly.
You must create a modified IPSW file with pypack tool – https://github .com/matteyeux/pypack
Yes, it looks fine.
Is it possible that use 9.3.5 shsh blob to downgrade to 9.3.3?
Hello, Sylvie. No, that’s not possible. You must have blobs for your destination firmware.
I want to downgrade my iPhone 5c from 10.3.1 to 9.0.2 (and yes… I have
the blobs)…. So, when I try to do this I get this message:
About to restore device…
Waiting for device…
ERROR: Unable to connect to device in restore mode
ERROR: Unable to open device in restore mode
ERROR: Unable to restore device
What can I do?
Also… I did in DFU mode and get same Error, plz help!
Hello, Doris. Please send me a screenshot, if possible. This error is related to your iPhone. Check your connection. Is it connected properly?
Hi,
HELP PLEASE !
My SHSH blog starts with “MIIKqzAL”, is this still downgrade-able ?
Hello, Thomas. Unfortunately, this type of blobs doesn’t work with this tool.
Hello, you need to install libirecovery. Doing this will fix your issue –
brew install libusb readline automake autoconf libtool pkg-config
cd /tmp
git clone https://github.com/libimobiledevice/libirecovery.git
cd libirecovery
./autogen.sh
make
sudo make install
Yeah sure, I will help you install it, no problem. Did you get the command to work?
please can u help me?
i have iPhone 4s and I’m stuck with this:
NOTE: using cached version data
Found device in DFU mode
Identified device as n94ap, iPhone4,1
Extracting BuildManifest from IPSW
Product Version: 6.1.3
Product Build: 10B329 Major: 10
Device supports Image4: false
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Found ECID 46976639816
Getting ApNonce in dfu mode…
checking for local shsh
Using local SHSH
Extracting filesystem from IPSW
[==================================================] 100.0%
Extracting iBSS.n94ap.RELEASE.dfu…
Not personalizing component iBSS…
Sending iBSS (76056 bytes)…
[==================================================] 100.0%
Nonce:
checking for local shsh
Using local SHSH
Extracting iBEC.n94ap.RELEASE.dfu…
Not personalizing component iBEC…
ERROR: Unable to get ApTicket from TSS request
ERROR: Unable to send iBEC to device
ERROR: Unable to place device into recovery mode from DFU mode
Hey, Gerber. Are your blobs compatible and in the correct format? The tool seems to be having an issue with your blobs.
Plat but how van i download shsh in correct format?
I downloaded shsh with tinyumbrella
Please check your blob file, look for the characters in the beginning and match them with the strings above.
can u explain me step by step?
the program starts but stuck on 64%
https://uploads.disquscdn.com/images/9dd11d18db658b6fdec77e105161a2cec9ccc309c37247c80aa84e670f797167.png
I have messaged the developer about this and waiting for an answer from him. Please wait. Thank you.
You should also try doing it again once more.
Hello,
When i try this app on my Mac
And give this command:
./idevicererestore -r filename.ipsw
IT says can’t find image file
Hello, Gerben. Please try installing libirecovery as shown above.
Thanks
Welcome
Is there any way to use someone else’s shsh blob to downgrade? or does it have to be your own… and also why does it?
Hello, Daniel. SHSH Blobs must be of your own device else it won’t work.