10.3 Beta5 降级记录

update 2017-3-11 21:31:09
进行到这一步未完成。网络成功案例多数为 iPhone 5s 中未修复的 BUG，也就是碰撞一定时间后出现一个固定值。

查阅了更多资料 6s 不越狱降级几乎不可能，虽然缩小了碰撞值范围，但碰撞出那个需要的值很难，这就是越狱后可以直接将 shsh2 里 G 值写入到手机 NVRAM 好处。而之前 6s 能降级到 10.2 是因为在验证未关闭时指定 ApNonce 值再备份 shsh2 才降级成功。目前也许只能等 10.3 越狱出来后才能再次测试降级。

下载

降级工具

futurestore by tihmstar（平刷降级）
http://api.tihmstar.net/builds/futurerestore/futurerestorelatest.zip

noncestatistics by tihmstar
http://api.tihmstar.net/builds/noncestatistics/noncestatistics-latest.zip

6s 固件（CPU n71ap）

iPhone\_4.7\_10.2\_14C92\_Restore.ipsw
iPhone\_4.7\_10.2.1\_14D27\_Restore.ipsw
iPhone\_4.7\_10.3\_14E5269a\_Restore.ipsw

具体过程

1.先升级到 10.3beta5 固件。
2.再解压 10.2.1 固件获取文件：

10.2.1 固件\BuildManifest.plist
10.2.1 固件\Firmware\Mav13-2.41.00.Release.bbfw
10.2.1 固件\Firmware\all_flash\all_flash.n71ap.production\sep-firmware.n71.RELEASE.im4p

3.把以上八个文件夹以及文件放到同个文件夹。

Windows 获取 ApNonce 碰撞值
先开始碰撞 1000个 ApNonce 值，数值多碰撞范围缩小，成功率越大。

C:\Users\Administrator\Desktop\go\noncestatistics-latest>noncestatistics_windows Apnonce.txt
Version: 4d63pd472lcc5087d4443df207bc4e99leb25a89 - 37
Identified device as n71ap, iPhone8,1 in normal mode... Trying to get in recovery...
INFO: device serial number is FFMT1S5GHFLR

No ECID was specified. Checking if any device is connected.
Getting nonce statistics for device with ECID: 665x16x95x80
000001  ApNonce=fdb85f49d2f173811775391b0500ac8a2ced5878
000002  ApNonce=105340eb91d52995c504696c4dc6a8cf87f73aa7
000003  ApNonce=85522b0ac2e4282db0e693691063e25041209858
...
001000  ApNonce=5adf4983c726fb78bbcfab383a91030044ea1014

User cancelled nonce collection
Waiting for device to reboot...
Resetting autoboot...
Done
# 耗时 55 分钟

检查碰撞值概率

C:\Users\Administrator\Desktop\go\noncestatistics-latest>noncestatistics_windows -s Apnonce.txt
Version: 4d63cd472ecc4087d4443df208bc5e99eeb25e89 - 37
nonce             abs. frequency    rel. frequency
===========================================================================
1557edb6155b5ccdc1f2c05e5c878c05bc5504d2    2     0.200%
30c118fbc532aa09c709c2c3bfd4bb7c4efb6717    2     0.200%
===========================================================================
nonce             abs. frequency    rel. frequency

There is a total of 1000 nonces

视频：
https://www.youtube.com/watch?v=pqgW75SeX74
https://www.youtube.com/watch?v=BIMx2Y13Ukc

帖子：
https://www.reddit.com/r/jailbreak/comments/5v2ox8/newsdowngrade\_to\_102\_from\_103\_promess\_i\_just/
http://bbs.feng.com/read-htm-tid-11076569.html
http://bbs.feng.com/read-htm-tid-11076580.html