设备越狱后添加repo:halo-michale.github.io/repo/,安装插件Generator Auto Setter，默认会写入G值0x1111111111111111,我需要降到12.4，找到自己的shsh2文件里的G值为0xadcedaa4dc76c6f8,于是ssh root到越狱手机
➜ Downgrade ./futurerestore -t 2375331941521446_iPhone7,2_12.4-16G77_31decc9d1a18ca4192f886be692e2b6d5b6118d7.shsh2 --latest-sep --latest-baseband iPhone_4.7_12.4_16G77_Restore.ipsw Version: 81b98e0425e17250cc83d5badaf9a8cc6399f481 - 245 Libipatcher version: 3159a387584e352f690cca859e013c3a4683f3e8 - 69 Odysseus support: yes [INFO] 64-bit device detected futurerestore init done reading signing ticket 2375331941521446_iPhone7,2_12.4-16G77_31decc9d1a18ca4192f886be692e2b6d5b6118d7.shsh2 is done Found device iPhone7,2 n61ap user specified to use latest signed SEP (WARNING, THIS CAN CAUSE A NON-WORKING RESTORE) [TSSC] opening firmware.json [DOWN] downloading file https://api.ipsw.me/v2.1/firmwares.json/condensed [TSSC] selecting latest iOS: 12.4.4 [TSSC] got firmware URL for iOS 12.4.4 build 16G140 [TSSC] opening Buildmanifest for iPhone7,2_12.4.4 100 [===================================================================================================>] downloading SEP
100 [===================================================================================================>] [TSSC] opening /tmp/futurerestore/sepManifest.plist [TSSR] User specified not to request a baseband ticket. Request URL set to https://gs.apple.com/TSS/controller?action=2 Sending TSS request attempt 1... response successfully received user specified to use latest signed baseband (WARNING, THIS CAN CAUSE A NON-WORKING RESTORE) downloading baseband
100 [===================================================================================================>] [TSSC] opening /tmp/futurerestore/basebandManifest.plist [TSSR] User specified to request only a baseband ticket. Request URL set to https://gs.apple.com/TSS/controller?action=2 Sending TSS request attempt 1... response successfully received Found device in Normal mode Entering recovery mode... INFO: device serial number is F78PGK5UG5MT Found device in Recovery mode Identified device as n61ap, iPhone7,2 Extracting BuildManifest from iPSW Product version: 12.4 Product build: 16G77 Major: 16 Device supports IMG4: true Got ApNonce from device: 31 de cc 9d 1a 18 ca 41 92 f8 86 be 69 2e 2b 6d 5b 61 18 d7 checking APTicket to be valid for this restore... Verified ECID in APTicket matches device ECID checking APTicket to be valid for this restore... Verified ECID in APTicket matches device ECID Verified APTicket to be valid for this restore Variant: Customer Erase Install (IPSW) This restore will erase your device data. Extracting filesystem from iPSW [==================================================] 100.0% Extracting iBEC.n61.RELEASE.im4p... Personalizing IMG4 component iBEC... Sending iBEC (731534 bytes)... waiting for device to reconnect... Getting SepNonce in recovery mode... ea 37 e5 69 22 48 c6 ac 9f f8 1d 3e 78 67 97 87 e9 f9 ce aa Getting ApNonce in recovery mode... 31 de cc 9d 1a 18 ca 41 92 f8 86 be 69 2e 2b 6d 5b 61 18 d7 [WARNING] Setting bgcolor to green! If you don't see a green screen, then your device didn't boot iBEC correctly Recovery Mode Environment: iBoot build-version=iBoot-4513.270.14 iBoot build-style=RELEASE Sending RestoreLogo... Extracting applelogo@2x~iphone.im4p... Personalizing IMG4 component RestoreLogo... Sending RestoreLogo (12334 bytes)... Extracting 048-78047-092.dmg.trustcache... Personalizing IMG4 component RestoreTrustCache... Sending RestoreTrustCache (9681 bytes)... ramdisk-size=0x10000000 Extracting 048-78047-092.dmg... Personalizing IMG4 component RestoreRamDisk... Sending RestoreRamDisk (91608779 bytes)... Extracting DeviceTree.n61ap.im4p... Personalizing IMG4 component RestoreDeviceTree... Sending RestoreDeviceTree (125713 bytes)... Extracting kernelcache.release.iphone7... Personalizing IMG4 component RestoreKernelCache... Sending RestoreKernelCache (14069235 bytes)... Trying to fetch new signing tickets Request URL set to https://gs.apple.com/TSS/controller?action=2 Sending TSS request attempt 1... response successfully received Received signing tickets About to restore device... Waiting for device... Device fa7290e4f299aff884b5eb6febce2643d11d092d is now connected in restore mode... Connecting now... Connected to com.apple.mobile.restored, version 15 Device fa7290e4f299aff884b5eb6febce2643d11d092d has successfully entered restore mode Hardware Information: BoardID: 6 ChipID: 28672 UniqueChipID: 2375331941521446 ProductionMode: true Starting FDR listener thread About to send RootTicket... Sending RootTicket now... Done sending RootTicket Waiting for NAND (28) About to send NORData... Found firmware path Firmware/all_flash Getting firmware manifest from build identity Extracting LLB.n61.RELEASE.im4p... Personalizing IMG4 component LLB... Extracting applelogo@2x~iphone.im4p... Personalizing IMG4 component AppleLogo... Extracting batterycharging0@2x~iphone.im4p... Personalizing IMG4 component BatteryCharging0... Extracting batterycharging1@2x~iphone.im4p... Personalizing IMG4 component BatteryCharging1... Extracting batteryfull@2x~iphone.im4p... Personalizing IMG4 component BatteryFull... Extracting batterylow0@2x~iphone.im4p... Personalizing IMG4 component BatteryLow0... Extracting batterylow1@2x~iphone.im4p... Personalizing IMG4 component BatteryLow1... Extracting glyphplugin@1334~iphone-lightning.im4p... Personalizing IMG4 component BatteryPlugin... Extracting DeviceTree.n61ap.im4p... Personalizing IMG4 component DeviceTree... Extracting recoverymode@1334~iphone-lightning.im4p... Personalizing IMG4 component RecoveryMode... Extracting iBoot.n61.RELEASE.im4p... Personalizing IMG4 component iBoot... Personalizing IMG4 component RestoreSEP... Personalizing IMG4 component SEP... Sending NORData now... Done sending NORData Checking filesystems (15) Checking filesystems (15) About to send FDR Trust data... Sending FDR Trust data now... Done sending FDR Trust Data Unmounting filesystems (29) Unmounting filesystems (29) Unmounting filesystems (29) Unmounting filesystems (29) Creating partition map (11) Creating filesystem (12) About to send filesystem... Connected to ASR Validating the filesystem Filesystem validated Sending filesystem now... [==================================================] 100.0% Done sending filesystem Verifying restore (14) [==================================================] 100.0% Checking filesystems (15) Checking filesystems (15) Checking filesystems (15) Checking filesystems (15) Mounting filesystems (16) Mounting filesystems (16) Mounting filesystems (16) About to send KernelCache... Extracting kernelcache.release.iphone7... Personalizing IMG4 component KernelCache... Sending KernelCache now... Done sending KernelCache Installing kernelcache (27) About to send DeviceTree... Extracting DeviceTree.n61ap.im4p... Personalizing IMG4 component DeviceTree... Sending DeviceTree now... Done sending DeviceTree Certifying Savage (61) Flashing firmware (18) [==================================================] 100.0% Unknown operation (36) About to send FUD data... Found FUD component 'RestoreTrustCache' Extracting 048-78047-092.dmg.trustcache... Personalizing IMG4 component RestoreTrustCache... Found FUD component 'StaticTrustCache' Extracting 048-76490-092.dmg.trustcache... Personalizing IMG4 component StaticTrustCache... Sending FUD data now... Done sending FUD data Updating gas gauge software (47) Updating gas gauge software (47) Updating Stockholm (55) Unknown operation (36) About to send FUD data... Found FUD component 'RestoreTrustCache' Extracting 048-78047-092.dmg.trustcache... Personalizing IMG4 component RestoreTrustCache... Found FUD component 'StaticTrustCache' Extracting 048-76490-092.dmg.trustcache... Personalizing IMG4 component StaticTrustCache... Sending FUD data now... Done sending FUD data Updating baseband (19) About to send BasebandData... Sending Baseband TSS request... Request URL set to https://gs.apple.com/TSS/controller?action=2 Sending TSS request attempt 1... response successfully received Received Baseband SHSH blobs Sending BasebandData now... Done sending BasebandData Updating Baseband in progress... About to send BasebandData... Sending BasebandData now... Done sending BasebandData Updating Baseband completed. Updating SE Firmware (59) Fixing up /var (17) Creating system key bag (50) Modifying persistent boot-args (25) Unmounting filesystems (29) Unmounting filesystems (29) Unmounting filesystems (29) Unmounting filesystems (29) Got status message Status: Restore Finished Cleaning up... DONE Done: restoring succeeded.