固定
- 先用 noncereboot1131UI 固定 Generator 值。
- 一定记得验证 Generator 值注入是否成功，平刷成功进系统立刻固定。
提取
从未关闭验证固件 iPhone\_4.7\_11.4\_15F79\_Restore.ipsw 提取：
iPhone_4.7_11.4_15F79_Restore.ipsw/BuildManifest.plist
iPhone_4.7_11.4_15F79_Restore.ipsw/Firmware/Mav13-4.60.00.Release.bbfw
iPhone_4.7_11.4_15F79_Restore.ipsw/all_flash/all_flash.n71ap.production/sep-firmware.n71.RELEASE.im4p
平刷
把提取文件放到 futurerestore\_win64\_v173 文件夹里面。
包括固件和 SHSH2：
iPhone\_4.7\_11.3.1\_15E302\_Restore.ipsw
39xx4a16xx0eaab6xx185aba9cc6a8d8xxe543xx.shsh2
开刷
C:\Users\Administrator\Desktop\futurerestore_win64_v173>futurerestore.exe -t 39xx4a16xx0eaab6xx185aba9cc6a8d8xxe543xx.shsh2 -b Mav13-4.60.00.Release.bbfw -p BuildManifest.plist -s sep-firmware.n71.RELEASE.im4p -m BuildManifest.plist -w iPhone_4.7_11.3.1_15E302_Restore.ipsw
绿屏后看到Done: restoring succeeded.即可。C:\Users\Administrator\Desktop\futurerestore_win64_v173>futurerestore.exe -t 39xx4a16xx0eaab6xx185aba9cc6a8d8xxe543xx.shsh2 -b Mav13-4.60.00.Release.bbfw -p BuildManifest.plist -s sep-firmware.n71.RELEASE.im4p -m BuildManifest.plist -w iPhone_4.7_11.3.1_15E302_Restore.ipsw
Version: a0113a4e46bfd00xxxxxxxxxxf548fc8b0bd21fd - 173
Odysseus Support: no
[INFO] 64bit device detected
futurerestore init done
reading ticket 39xx4a16xx0eaab6xx185aba9cc6a8d8xxe543xx.shsh2 done
Found device iPhone8,1 n71ap
[TSSC] opening BuildManifest.plist
[TSSR] User specified not to request a Baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Did set sep+baseband path and firmware
[TSSC] opening BuildManifest.plist
[TSSR] User specified to request only a Baseband ticket.
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Found device in Normal mode
Entering recovery mode...
INFO: device serial number is xxxxxxxxxxxx
waiting for nonce: 39 xx 4a 16 xx 0e aa b6 xx 18 5a ba 9c c6 a8 d8 xx e5 43 xx
Got ApNonce from device: 39 xx 4a 16 xx 0e aa b6 xx 18 5a ba 9c c6 a8 d8 xx e5 43 xx
Device has requested ApNonce now
Found device in Recovery mode
Identified device as n71ap, iPhone8,1
Extracting BuildManifest from IPSW
Product Version: 11.3.1
Product Build: 15E302 Major: 15
Device supports Image4: true
Got APNonce from device: 39 xx 4a 16 xx 0e aa b6 xx 18 5a ba 9c c6 a8 d8 xx e5 43 xx
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
checking APTicket to be valid for this restore...
Verified ECID in APTicket matches device ECID
Verified APTicket to be valid for this restore
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
Extracting filesystem from IPSW
Extracting iBEC.n71.RELEASE.im4p...
Personalizing IMG4 component iBEC...
Sending iBEC (372101 bytes)...
waiting for device to reconnect...
Getting SepNonce in recovery mode... 99 87 cc 15 77 6c 1f 1a 92 be e0 c5 e7 fa cf 1d ca 51 f5 2c
Getting ApNonce in recovery mode... 39 xx 4a 16 xx 0e aa b6 xx 18 5a ba 9c c6 a8 d8 xx e5 43 xx
[WARNING] Setting bgcolor to green! If you don't see a green screen, then your device didn't boot iBEC correctly
Recovery Mode Environment:
iBoot build-version=iBoot-4076.50.126
iBoot build-style=RELEASE
Sending RestoreLogo...
Extracting applelogo@2x~iphone.im4p...
Personalizing IMG4 component RestoreLogo...
Sending RestoreLogo (12195 bytes)...
ramdisk-size=0x20000000
Extracting 058-97541-138.dmg...
Personalizing IMG4 component RestoreRamDisk...
Sending RestoreRamDisk (79287362 bytes)...
Extracting DeviceTree.n71ap.im4p...
Personalizing IMG4 component RestoreDeviceTree...
Sending RestoreDeviceTree (133605 bytes)...
Extracting kernelcache.release.n71...
Personalizing IMG4 component RestoreKernelCache...
Sending RestoreKernelCache (14531132 bytes)...
Trying to fetch new SHSH blob
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Received SHSH blobs
About to restore device...
Waiting for device...
Device ffffffffffffffffffffffffffffffff00000021 is now connected in restore mode...
Connecting now...
Connected to com.apple.mobile.restored, version 15
Device ffffffffffffffffffffffffffffffff00000021 has successfully entered restore mode
Hardware Information:
BoardID: 4
ChipID: 32768
UniqueChipID: 6654165959806
ProductionMode: true
Starting FDR listener thread
About to send NORData...
Found firmware path Firmware/all_flash
Getting firmware manifest from build identity
Extracting LLB.n71.RELEASE.im4p...
Personalizing IMG4 component LLB...
Extracting applelogo@2x~iphone.im4p...
Personalizing IMG4 component AppleLogo...
Extracting batterycharging0@2x~iphone.im4p...
Personalizing IMG4 component BatteryCharging0...
Extracting batterycharging1@2x~iphone.im4p...
Personalizing IMG4 component BatteryCharging1...
Extracting batteryfull@2x~iphone.im4p...
Personalizing IMG4 component BatteryFull...
Extracting batterylow0@2x~iphone.im4p...
Personalizing IMG4 component BatteryLow0...
Extracting batterylow1@2x~iphone.im4p...
Personalizing IMG4 component BatteryLow1...
Extracting glyphplugin@1334~iphone-lightning.im4p...
Personalizing IMG4 component BatteryPlugin...
Extracting DeviceTree.n71ap.im4p...
Personalizing IMG4 component DeviceTree...
Extracting recoverymode@1334~iphone-lightning.im4p...
Personalizing IMG4 component RecoveryMode...
Extracting iBoot.n71.RELEASE.im4p...
Personalizing IMG4 component iBoot...
Personalizing IMG4 component RestoreSEP...
Personalizing IMG4 component SEP...
Sending NORData now...
Done sending NORData
About to send RootTicket...
Sending RootTicket now...
Done sending RootTicket
Waiting for NAND (28)
Updating S3E Firmware (58)
Checking filesystems (15)
Checking filesystems (15)
About to send FDR Trust data...
Sending FDR Trust data now...
Done sending FDR Trust Data
Unmounting filesystems (29)
Unmounting filesystems (29)
Unmounting filesystems (29)
Creating partition map (11)
Creating filesystem (12)
About to send filesystem...
Connected to ASR
Validating the filesystem
Filesystem validated
Sending filesystem now...
Done sending filesystem
Verifying restore (14)
Checking filesystems (15)
Checking filesystems (15)
Checking filesystems (15)
Mounting filesystems (16)
Mounting filesystems (16)
Mounting filesystems (16)
About to send KernelCache...
Extracting kernelcache.release.n71...
Personalizing IMG4 component KernelCache...
Sending KernelCache now...
Done sending KernelCache
Installing kernelcache (27)
About to send DeviceTree...
Extracting DeviceTree.n71ap.im4p...
Personalizing IMG4 component DeviceTree...
Sending DeviceTree now...
Done sending DeviceTree
Certifying Savage (61)
Flashing firmware (18)
Updating gas gauge software (47)
Updating gas gauge software (47)
Updating Stockholm (55)
About to send FUD data...
Found FUD component 'AOP'
Extracting aopfw-s8000aop.im4p...
Personalizing IMG4 component AOP...
Sending FUD data now...
Done sending FUD data
About to send FUD data...
Found FUD component 'AOP'
Extracting aopfw-s8000aop.im4p...
Personalizing IMG4 component AOP...
Sending FUD data now...
Done sending FUD data
Updating baseband (19)
About to send BasebandData...
Sending Baseband TSS request...
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Received Baseband SHSH blobs
Sending BasebandData now...
Done sending BasebandData
Updating Baseband in progress...
About to send BasebandData...
Sending BasebandData now...
Done sending BasebandData
Updating Baseband completed.
Updating SE Firmware (59)
Fixing up /var (17)
Creating system key bag (50)
Modifying persistent boot-args (25)
Unmounting filesystems (29)
Unmounting filesystems (29)
Unmounting filesystems (29)
Got status message
Status: Restore Finished
Cleaning up...
DONE
Done: restoring succeeded.更新 2018-07-07