109 lines
5.0 KiB
Markdown
109 lines
5.0 KiB
Markdown
|
+++
|
|||
|
|
date = "2019-10-14"
|
|||
|
|
tags = ["ipad"]
|
|||
|
|
title = "ipad4のios10.3.3を8.4.1にdowngradeするための情報をまとめてみる"
|
|||
|
|
slug = "ipad"
|
|||
|
|
+++
|
|||
|
|
|
|||
|
|
iosのjailbreakは、はじめてなこともあり自分なりに情報をまとめてみることにします。全ては推測であり、冒頭に「おそらく」が付きますが省略します。
|
|||
|
|
|
|||
|
|
ipad4(ipad3,4)を[downgrade](https://github.com/s0uthwest/futurerestore)するには、kDFUでなければならず、なぜなら、復元するとき、ibssを端末にuploadしなければならないからで、当該ファイルをuploadするにはjailbreakしてる必要があります(厳密にはsshできる状態)。つまり、現時点では、checkm8を使ったpwnDFUでは脱獄状態でもない限り、downgradeするのは難しいと思われます。
|
|||
|
|
|
|||
|
|
もしかしたら、iphone5sのdowngrade例に似てますが、bootloader作成して、それをcfwに乗せて復元みたいな[方法](https://diosra2.hatenadiary.jp/entry/20191010/1570700538)でいけるかもしれません。
|
|||
|
|
|
|||
|
|
また、pwnDFU+[OpenOCD](http://blog.lambdaconcept.com/doku.php?id=products:bonobo:iphone_bootrom_debug)+特殊ケーブルを使えば、いけるかも。これは現実的ではないのでパス。
|
|||
|
|
|
|||
|
|
## リンク集
|
|||
|
|
|
|||
|
|
[https://ipsw.me/iPad3,4](https://ipsw.me/iPad3,4)
|
|||
|
|
|
|||
|
|
[https://www.theiphonewiki.com/wiki/Donner_12H321_(iPad3,4)](https://www.theiphonewiki.com/wiki/Donner_12H321_(iPad3,4))
|
|||
|
|
|
|||
|
|
https://github.com/axi0mX/ipwndfu
|
|||
|
|
|
|||
|
|
https://github.com/s0uthwest/futurerestore
|
|||
|
|
|
|||
|
|
https://www.reddit.com/r/jailbreak/comments/dddp8j/tutorial_untethered_downgrade_compatible_a7/
|
|||
|
|
|
|||
|
|
https://github.com/iH8sn0w/iBoot32Patcher
|
|||
|
|
|
|||
|
|
https://www.theiphonewiki.com/wiki/OdysseusOTA2
|
|||
|
|
|
|||
|
|
https://github.com/tihmstar/igetnonce
|
|||
|
|
|
|||
|
|
https://github.com/xerub/img4lib/
|
|||
|
|
|
|||
|
|
```sh
|
|||
|
|
## Donner 12H321 (iPad3,4) 8.4.1
|
|||
|
|
iBEC.p101.RELEASE.dfu
|
|||
|
|
IV: add7db95ab270c16ddd632cdc9a4ebac
|
|||
|
|
Key: 77b7990cbb88f3d091aaff10b424ab19c5263f100eb1ee642771500510b0dd42
|
|||
|
|
iBoot.p101.RELEASE.img3
|
|||
|
|
IV: 07d85cc140e348b4d66d2b6d1b88b139
|
|||
|
|
Key: 29f94825bf6e6b0660037bba1a20dd804eb037888b14260f204ee8e54c2e6db3
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
`odysseus-ipad3,4-8.4.1-bundle`が存在します。
|
|||
|
|
|
|||
|
|
`odysseus`より`futurerestore`のほうが良いと思われます。
|
|||
|
|
|
|||
|
|
## jailbreak,downgrade関連ツールのコマンド例です
|
|||
|
|
|
|||
|
|
検索などの取っ掛かりとして。
|
|||
|
|
|
|||
|
|
```sh
|
|||
|
|
$ ipwndfu -p
|
|||
|
|
$ idevicerestore -t iPad_32bit_10.3.3_14G60_Restore.ipsw
|
|||
|
|
$ unzip -j iPad3,4_10.3.3_Restore.ipsw Firmware/all_flash/all_flash*/iBoot*
|
|||
|
|
$ iBoot32Patcher iBoot.n101ap.RELEASE.dec PwnediBoot --rsa --boot-partition
|
|||
|
|
$ iBoot64patcher ibss.raw ibss.pwn
|
|||
|
|
$ xpwntool iBoot.n101ap.RELEASE.img3 iBoot.n101ap.RELEASE.dec -iv
|
|||
|
|
$ tsschecker -d {did} -e {eid} -i 8.4.1 -o -s
|
|||
|
|
$ futurerestore -t xxx-iPad3,4-10.3.3.shsh --no-baseband --use-pwndfu iPad3,4_8.4.1_12H321_Restore.ipsw
|
|||
|
|
$ img4 -i iBSS.iphone6.RELEASE.im4p -o ibss.decrypt -k "ivkey" -D
|
|||
|
|
$ img4tool -e -o ibss.raw ibss.decrypt
|
|||
|
|
$ irecovery -f ibss.img4
|
|||
|
|
$ bspatch iBSS.iphone6.RELEASE.im4p ibss.patched ibss.verbose.patch
|
|||
|
|
$ bspatch futurerestore futurerestore_patched futurerestore.patch
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 気になる引用
|
|||
|
|
|
|||
|
|
iBSS,iBEC関連のirecoveryが失敗または停止した場合、代わりに詳細なファイルを使用するらしいので、futurerestoreにpatchを当てて使う必要があるという記述
|
|||
|
|
|
|||
|
|
> Note: I found that for switching from pwndfu to pwnrecovery later on only the verbose iBSS and iBEC worked so if irecovery fails or stops when sending iBEC then trying using the verbose files instead.
|
|||
|
|
> Now you need a modified version of futurerestore (currently, tihmstar is updating the official version but for now we have to make do).
|
|||
|
|
>
|
|||
|
|
> I used s0uthwest’s fork at latest version, 246, and modified it. You will need to download the latest release (245) and apply this patch to the futurerestore binary. You can also git clone the latest version, 246, and build from source then patch but either works I have tested both.
|
|||
|
|
>
|
|||
|
|
> bspatch futurerestore futurerestore_patched futurerestore.patch
|
|||
|
|
> Now delete the old fututrerestore binary file and rename the new patched one to “futurerestore”
|
|||
|
|
|
|||
|
|
https://www.reddit.com/r/jailbreak/comments/dddp8j/tutorial_untethered_downgrade_compatible_a7/
|
|||
|
|
|
|||
|
|
`limera1n`以外のデバイスでは、kDFUが必要という記述
|
|||
|
|
|
|||
|
|
> Odysseus (32-bit devices)
|
|||
|
|
> Get device into kDFU/pwnDFU mode:
|
|||
|
|
> limera1n devices:
|
|||
|
|
> Enter pwnDFU mode with redsn0w or any other tool;
|
|||
|
|
> Other 32-bit devices:
|
|||
|
|
> Jailbreak required;
|
|||
|
|
> Enter kDFU mode by loading a pwnediBSS from any existing Odysseus bundle.
|
|||
|
|
> Connect your device to computer in kDFU / pwnDFU mode;
|
|||
|
|
> On the computer run futurerestore --use-pwndfu -t ticket.shsh --latest-baseband ios.ipsw
|
|||
|
|
|
|||
|
|
https://github.com/s0uthwest/futurerestore
|
|||
|
|
|
|||
|
|
## checkm8の成功率
|
|||
|
|
|
|||
|
|
自分の場合、以下の手順でやればほぼ確実に成功します。これ以外の単純な繰り返しだと、ほぼ失敗します。
|
|||
|
|
|
|||
|
|
```sh
|
|||
|
|
# macの再起動が必要
|
|||
|
|
1. dfuにしてipadをパソコンに接続した後、usbを抜く
|
|||
|
|
2. macを再起動する
|
|||
|
|
3. usbでipadとパソコンを繋ぐ、ipadをunmountする
|
|||
|
|
4. `ipwndfu -p`(checkm8)を実行する
|
|||
|
|
```
|