Compare commits

..

1 commit

Author SHA1 Message Date
edwin
0a3b68513f CHECKRA1N 2023-06-18 23:44:02 -04:00
30 changed files with 481 additions and 807 deletions

11
.gitignore vendored
View file

@ -1,11 +0,0 @@
.DS_Store
*/.DS_Store
work
ramdisk
boot*
.irecovery
blobs
logs
.rd_in_progress
logs
.disclaimeragree

101
README.md
View file

@ -1,54 +1,46 @@
# downr1n
Downr1n enables tethered downgrades of checkm8 iOS devices to iOS 15, 14 and 13.4 upper.
there is dualra1n too, which is a dualboot for ios like having two different ios [dualra1n](https://github.com/dualra1n/dualra1n), i would recommend more dualra1n as it is very stable.
A MOD VERSION OF DOWNR1N TO TEST CHECKRA1N ON IT, CURRENTLY NOT WORKING.
downgrades are shit tbh xd, I mean dualboot is much better option if you have the storage needed.
# Usage
1: Download the IPSW file and place it in the ipsw/ directory.
2: execute: ./downr1n.sh --downgrade 14.3.
download the ipsw and put it into ipsw/ directory
Example: ./downr1n.sh --downgrade 14.3
on linux use this without sudo.
The various command-line options are as follows:
Example: ./downr1n.sh --downgrade 14.3
--downgrade : Downgrade your device to iOS 14 tethered.
--jailbreak : Jailbreak with dualra1n-loader. Usage: `./downr1n.sh --jailbreak 14.8`.
--taurine : Jailbreak with taurine. Usage: `./downr1n.sh --jailbreak 14.3 --taurine`.
--boot : Boot the device.
--keyServer use this option to downgrade when the keys server is in problem. only on MacOS. use ex: --downgrade 14.8 --keyServer
--dont-restore : Avoids using futurerestore, this can be used to only create boot files. Example: `--downgrade 14.3 --dont-restore`.
--debug : Debug the script.
--downgrade downgrade tethered your device to ios 14.
--dfuhelper A helper to help get A11 devices into DFU mode from recovery mode
--jailbreak jailbreak with pogo. usage ./downr1n --jailbreak 14.8
--taurine jailbreak with taurine. usage ./downr1n --jailbreak 14.3 --taurine
--boot this boot the device.
--dont-restore this will avoid the restore using futurerestore, this can be used if you wanted only create the boot files. example: --downgrade 14.3 --dont-restore
--fixBoot that will boot the device using fsboot
--debug Debug the scrip
---
# Dependencies
- unzip, python3, libimobiledevice-utils, libusbmuxd-tools, xz-utils, wget, curl, git, libssl-dev, usbmuxd.
- A disabled passcode on A10 and A11 devices.
- An .iPSW file containing iOS 15, 14, 13.4 upper.
- A device running macOS or a Linux distro. It is recommended to use macOS, as it is likely more stable and faster. and for linux it is recommended to use ubuntu or debian.
- A deactivated passcode on [A10](https://en.wikipedia.org/wiki/Apple_A10#Products_that_include_the_Apple_A10_Fusion) and [A11 devices](https://en.wikipedia.org/wiki/Apple_A11#Products_that_include_the_Apple_A11_Bionic)
- `unzip`, `python3`, `libimobiledevice-utils`, `libusbmuxd-tools`
- An `.iPSW` file containing [iOS 14](https://en.wikipedia.org/wiki/IOS_14) or [15](https://en.wikipedia.org/wiki/IOS_15)
- A device running macOS or a Linux distro (it's recommended to use macOS, as it's likely more stable and faster)
# Issues Putting Device in PwnDFU Mode
# problems putting the device on pwndfu mode
- A DFU mode exists where the device's screen is black. However, when downgrading the device, recovery mode also turns black. To put the device into PwnDFU mode, you need to put it into real DFU mode by pressing poweroff+(volume down or home button). Look for a tutorial on YouTube to understand how. Once in PwnDFU mode, execute ./binaries/$(uname)/gaster pwn to succeed. If the device is not in DFU mode, it will loop.
- there is a mode name dfu which the device is in black screen but when we downgrade the device recovery mode turn into black screen as well so to put the device into pwndfu mode you need to put it on the real dfu mode by pressing poweroff+(volumendown or homebutton) look at a tutorial on youtube to got it, when you are already pwndfu execute ./binaries/$(uname)/gaster pwn to pwdnfu but the device must be on dfu mode to success, if the device is not, it will loop.
# importants things
- A8/A8x devices downr1n is not recommended please instead use dualra1n with --downgrade option (if you don't have enough storage for a dualboot)
- you can't downgrade an iphone x if the device is on ios 16
- downgrading ios 16 to 14 or another version, you should have backup your activations file in order to after downgrade and boot sucessfully restore them, you can use https://github.com/edwin170/bypassr1n.
- on ios 13 the touch id doesn't work so the home button will not work sadly.
- you can't downgrade to ios 14.2 lower on a11 devices
- if you want to try fix the recovery mode. copying firmware/all_flash/* of a ipsw from the version that you are or you were before downgrade to the ipsw from the ios that you want to downgrade. that should come back the recovery mode.
# Warnings
- I am **NOT** responsible for any data loss. The user of this program accepts responsibility should something happen to their device.
@ -56,39 +48,40 @@ The various command-line options are as follows:
- futurerestore --exit-recovery
- irecovery -n
# fix some problems
# fix some problems to boot
- if it gives problem with server key please execute: 1: python3 -m pip install git+https://github.com/m1stadev/wikiproxy.git 2: wikiproxy &
- problems with futurerestore so execute manual ./binaries/$(uname)/futurerestore -t blobs/(oneoftheblobs) --use-pwndfu --skip-blob --rdsk work/rdsk.im4p --rkrn work/krnl.im4p --latest-sep (only if your device has baseband use it --latest-baseband if not use --no-baseband') ipsw/*.ipsw
- if the error still after above fix, if this happend to you when you are downgrading with futurerestore again please add this arg --keyServer for example ./downr1n.sh --downgrade 14.5 --keyServer.
- to improve the boot. rn not working at all but you can try it
sometimes we have problems like deep sleep or the ios doesnt boot so i add two option for that reason --localboot and --fsboot. both are patchers by palera1n team in order to fix some problems in the boot so you must use it when you will create boot files for example --downgrade () --dont-restore (--localboot) or (--fsboot), when that finish creating that you just have to boot for example --boot (--localboot) or (--fsboot), its not neccessary that you need to use them but if you had some problems you can
- remember if you will use the next command or will activate localboot it is better that you first downgrade and when you success you can use --jailbreak to jailbreak the device and it will ask you to activate localboot path. why do this because the localboot need to be executed after --jailbreak
# help with something join to discord server https://discord.gg/AjEHs5ug
# How do i jailbreak it ?
# Need Help?
- Join my discord server: [Dualra1nServer](https://discord.gg/Gjs2P7FBuk)
- jailbreak with dualra1n-loader: ./downr1n --jailbreak (YourVer = 14.3) # this is not a jailbreak. when i said jailbreak i mean the process to install sileo and boostrap the device therefore dualra1n-loader only install sileo and bootstrap with the kernelpatched
# How to Jailbreak?
- Jailbreak with dualra1n-loader: ./downr1n --jailbreak (YourVer = 14.3). Note: this does not actually jailbreak the device. When I say "jailbreak," I'm referring to the process of installing Sileo and bootstrapping the device. Dualra1n-loader only installs Sileo and bootstraps with the kpf kernel patch. (you will be able to use tweaks and most of things as normal).
- Taurine: ./downr1n --jailbreak (ex: 14.3 or YouVers) --taurine.
- taurine: ./downr1n --jailbreak (YourVer = 14.3) --taurine #not recommended
# Credits
- thanks to [uckermark](https://github.com/Uckermark/) for the amazing dualra1n-loader
# with love Edwin :)
- thanks to [sasa](https://github.com/sasa8810) for the code of download futurerestore ;|
<details><summary>thanks to</summary>
<p>
- [Edwin](https://github.com/edwin170) owner :)
</details>
<details><summary>Other credits for tools and codes used in downr1n</summary>
- [wikiproxy.py](https://github.com/afastaudir8/wikiproxy).
- [futurerestore](https://github.com/futurerestore/futurerestore) thank you for futurerestore.
- [futurerestore](https://github.com/futurerestore/futurerestore) without futurerestore it couldn't be downgraded.
- [palera1nLegacy](https://github.com/palera1n/palera1n/tree/legacy) some code based on palera1n legacy.
- [mineek](https://github.com/mineek/) because sunst0rm
- [exploit](https://github.com/exploit3dguy/) for asrpatcher
- [iSuns9](https://github.com/iSuns9/restored_external64patcher) thank you for restored_external64patcher
- [iSuns9](https://github.com/iSuns9/restored_external64patcher) thank you for restored_external64patche
- [Nathan](https://github.com/verygenericname) for the ramdisk
@ -102,7 +95,5 @@ The various command-line options are as follows:
- [Ralp0045](https://github.com/Ralph0045/Kernel64Patcher) amazing dtree_patcher and kernel64patcher ;)
- [mineek](https://github.com/mineek/sunst0rm) because the original idea.
</p>
</details>

Binary file not shown.

BIN
binaries/Darwin/futurerestore Normal file → Executable file

Binary file not shown.

BIN
binaries/Darwin/gaster Executable file → Normal file

Binary file not shown.

Binary file not shown.

Binary file not shown.

BIN
binaries/Linux/futurerestore Normal file → Executable file

Binary file not shown.

Binary file not shown.

0
binaries/Linux/iBootpatch2 Normal file → Executable file
View file

File diff suppressed because it is too large Load diff

View file

@ -2,4 +2,4 @@
sudo systemctl stop usbmuxd
sudo usbmuxd -p -f 1>/dev/null
sudo usbmuxd -p -f

82
linux_fix.sh Executable file
View file

@ -0,0 +1,82 @@
#!/usr/bin/env bash
# Futurerestore/irecovery linux fix script made by @Cryptiiiic
# Supported Distros: archlinux, ubuntu, debian
set -e
pacman=0
aptget=0
dnf=0
if [ "$EUID" -ne 0 ]
then
echo "-1: Please run as root"
exit -1
fi
if [[ -f "/etc/fedora-release" ]]
then
echo "Fedora detected installing ca-certs..."
echo "Done!"
fi
echo "Attemping linux usb fixes please wait..."
if [[ $(which pacman 2>/dev/null) ]]
then
pacman=1
elif [[ $(which apt-get 2>/dev/null) ]]
then
aptget=1
elif [[ $(which dnf 2>/dev/null) ]]
then
dnf=1
else
echo "-2: Linux Distro not supported!"
exit -2
fi
if [[ "$(expr $pacman)" -gt '0' ]]
then
if [[ -f "/etc/arch-release" ]]
then
echo "Arch Linux Detected!"
sudo pacman -Syy --needed --noconfirm >/dev/null 2>/dev/null
sudo pacman -S --needed --noconfirm udev usbmuxd >/dev/null 2>/dev/null
sudo systemctl enable systemd-udevd usbmuxd --now 2>/dev/null
echo "QUNUSU9OPT0iYWRkIiwgU1VCU1lTVEVNPT0idXNiIiwgQVRUUntpZFZlbmRvcn09PSIwNWFjIiwgQVRUUntpZFByb2R1Y3R9PT0iMTIyWzI3XXwxMjhbMC0zXSIsIE9XTkVSPSJyb290IiwgR1JPVVA9InN0b3JhZ2UiLCBNT0RFPSIwNjYwIgoKQUNUSU9OPT0iYWRkIiwgU1VCU1lTVEVNPT0idXNiIiwgQVRUUntpZFZlbmRvcn09PSIwNWFjIiwgQVRUUntpZFByb2R1Y3R9PT0iMTMzOCIsIE9XTkVSPSJyb290IiwgR1JPVVA9InN0b3JhZ2UiLCBNT0RFPSIwNjYwIgo=" | base64 -d | sudo tee /usr/lib/udev/rules.d/39-libirecovery.rules >/dev/null
else
echo "-3: Linux Distro not supported!"
exit -3
fi
elif [[ "$(expr $aptget)" -gt '0' ]]
then
if [[ -f "/etc/lsb-release" || -f "/etc/debian_version" ]]
then
echo "Ubuntu or Debian Detected!"
sudo apt-get update -qq >/dev/null 2>/dev/null
sudo apt-get install -yqq usbmuxd udev >/dev/null 2>/dev/null
sudo systemctl enable udev >/dev/null 2>/dev/null || true
sudo systemctl enable systemd-udevd >/dev/null 2>/dev/null || true
sudo systemctl enable usbmuxd >/dev/null 2>/dev/null || true
sudo systemctl restart udev >/dev/null 2>/dev/null
sudo systemctl restart systemd-udevd >/dev/null 2>/dev/null
sudo systemctl restart usbmuxd >/dev/null 2>/dev/null
echo "QUNUSU9OPT0iYWRkIiwgU1VCU1lTVEVNPT0idXNiIiwgQVRUUntpZFZlbmRvcn09PSIwNWFjIiwgQVRUUntpZFByb2R1Y3R9PT0iMTIyWzI3XXwxMjhbMC0zXSIsIE9XTkVSPSJ1c2JtdXgiLCBHUk9VUD0icGx1Z2RldiIsIE1PREU9IjA2NjAiCgpBQ1RJT049PSJhZGQiLCBTVUJTWVNURU09PSJ1c2IiLCBBVFRSe2lkVmVuZG9yfT09IjA1YWMiLCBBVFRSe2lkUHJvZHVjdH09PSIxMzM4IiwgT1dORVI9InVzYm11eCIsIEdST1VQPSJwbHVnZGV2IiwgTU9ERT0iMDY2MCIKCg==" | base64 -d | sudo tee /usr/lib/udev/rules.d/39-libirecovery.rules >/dev/null
else
echo "-4: Linux Distro not supported!"
exit -4
fi
else
if [[ -f "/etc/fedora-release" ]]
then
echo "Fedora Detected!"
sudo dnf install -y usbmuxd udev systemd ca-certificates >/dev/null 2>/dev/null
sudo ln -sf /etc/pki/tls/certs/ca-bundle.crt /etc/pki/tls/certs/ca-certificates.crt >/dev/null 2>/dev/null
sudo systemctl enable --now systemd-udevd usbmuxd >/dev/null 2>/dev/null
echo "QUNUSU9OPT0iYWRkIiwgU1VCU1lTVEVNPT0idXNiIiwgQVRUUntpZFZlbmRvcn09PSIwNWFjIiwgQVRUUntpZFByb2R1Y3R9PT0iMTIyWzI3XXwxMjhbMC0zXSIsIE9XTkVSPSJyb290IiwgR1JPVVA9InVzYm11eGQiLCBNT0RFPSIwNjYwIiwgVEFHKz0idWFjY2VzcyIKCkFDVElPTj09ImFkZCIsIFNVQlNZU1RFTT09InVzYiIsIEFUVFJ7aWRWZW5kb3J9PT0iMDVhYyIsIEFUVFJ7aWRQcm9kdWN0fT09IjEzMzgiLCBPV05FUj0icm9vdCIsIEdST1VQPSJ1c2JtdXhkIiwgTU9ERT0iMDY2MCIsIFRBRys9InVhY2Nlc3MiCgoK" | base64 -d | sudo tee /usr/lib/udev/rules.d/39-libirecovery.rules >/dev/null 2>/dev/null
fi
fi
sudo chown root:root /usr/lib/udev/rules.d/39-libirecovery.rules >/dev/null 2>/dev/null
sudo chmod 0644 /usr/lib/udev/rules.d/39-libirecovery.rules >/dev/null 2>/dev/null
sudo udevadm control --reload-rules >/dev/null 2>/dev/null
echo "Done!"
echo "Please unplug and replug your iDevice!"

BIN
other/binpack.zip Normal file

Binary file not shown.

BIN
other/checkra1n.dmg Normal file

Binary file not shown.

Binary file not shown.

Binary file not shown.

29
other/post.sh Executable file
View file

@ -0,0 +1,29 @@
#!/jbin/binpack/bin/bash
binpack=/jbin/binpack
# uicache loader app
$binpack/bin/rm -rf /var/.palera1n/loader.app
$binpack/usr/bin/uicache -p /Applications/Pogo.app/
$binpack/usr/bin/uicache -p /Applications/trollstore.app/
# remount r/w
/sbin/mount -uw /
/sbin/mount -uw /private/preboot/
# lauching daemon automatically
/usr/bin/launchctl load /Library/LaunchDaemons/
# update repo
if [ -f /usr/bin/apt ]; then
apt-get update
fi
# activating tweaks
/etc/rc.d/substitute-launcher
# respring
$binpack/usr/bin/uicache -a
$binpack/usr/bin/killall -9 SpringBoard
echo "[post.sh] done"
exit

Binary file not shown.

Binary file not shown.

28
other/rootfs/jbin/post.sh Executable file
View file

@ -0,0 +1,28 @@
#!/jbin/binpack/bin/bash
binpack=/jbin/binpack
# uicache loader app
$binpack/bin/rm -rf /var/.palera1n/loader.app
$binpack/usr/bin/uicache -p /Applications/Pogo.app/
# remount r/w
/sbin/mount -uw /
/sbin/mount -uw /private/preboot/
# lauching daemon automatically
/usr/bin/launchctl load /Library/LaunchDaemons/
# update repo
if [ -f /usr/bin/apt ]; then
apt-get update
fi
# activating tweaks
/etc/rc.d/substitute-launcher
# respring
$binpack/usr/bin/uicache -a
$binpack/usr/bin/killall -9 SpringBoard
echo "[post.sh] done"
exit

View file

@ -14,7 +14,7 @@
</data>
<key>Assets.car</key>
<data>
bXDbAeetZA/Y7De+N+wsak26mtw=
ofgS+mzZOF1wGSC2FQ5l55t/LA8=
</data>
<key>Base.lproj/LaunchScreen.storyboardc/01J-lp-oVM-view-Ze5-6b-2t3.nib</key>
<data>
@ -34,15 +34,15 @@
</data>
<key>Info.plist</key>
<data>
VgEA7vuKIoOkYkPb1kmre27zZUk=
eiDKe/D56un3zKhXp5SWKeutX08=
</data>
<key>Main.storyboardc/BYZ-38-t0r-view-8bC-Xf-vdC.nib</key>
<data>
kSWFEuGorMdBAOBexXoMyUukLAA=
ImV7XKTuTuuV6klwGLp+Mj9Xq9s=
</data>
<key>Main.storyboardc/DKI-Yp-loo-view-cPN-qX-cZW.nib</key>
<data>
CSJi64jwIUVX0OEntgwRd5B/WwQ=
M6GOu7LeSuY/ER6L38vSYFgCgUw=
</data>
<key>Main.storyboardc/Info.plist</key>
<data>
@ -62,16 +62,12 @@
</data>
<key>basebinaries.tar</key>
<data>
ExBQ7905hQq27b1OmZtQYb10SUA=
KJf7T46HZ+IyKHtg4fNSk7WKMfc=
</data>
<key>bootstrap.tar.gz</key>
<data>
rt9rjkuiQu3ovT9WyegG6Z9/ytw=
</data>
<key>ctbypass.gz</key>
<data>
JdQt3oVn0+ahtpB//zvjuxhaQoQ=
</data>
<key>essential_0-4_iphoneos-arm.deb</key>
<data>
1y7jqfU13qKUqU89y/9D46NdAX0=
@ -121,11 +117,11 @@
<dict>
<key>hash</key>
<data>
bXDbAeetZA/Y7De+N+wsak26mtw=
ofgS+mzZOF1wGSC2FQ5l55t/LA8=
</data>
<key>hash2</key>
<data>
Fg+jTlHFEyBWz8JQ15mDPZ566+4+xCB5G/jh721SwQg=
qcG05RgfuPUIxZSr+s93OIPoDq2Z5/s+jJvd74Fpoe4=
</data>
</dict>
<key>Base.lproj/LaunchScreen.storyboardc/01J-lp-oVM-view-Ze5-6b-2t3.nib</key>
@ -176,22 +172,22 @@
<dict>
<key>hash</key>
<data>
kSWFEuGorMdBAOBexXoMyUukLAA=
ImV7XKTuTuuV6klwGLp+Mj9Xq9s=
</data>
<key>hash2</key>
<data>
8gMBiRwfwaaCjixBxHpksVY+4VUml5gaXlGJYdRlZD8=
flB+gYCk4uXa2Ql9ot54QIOU4/siSnHvcj0cNRQiXzk=
</data>
</dict>
<key>Main.storyboardc/DKI-Yp-loo-view-cPN-qX-cZW.nib</key>
<dict>
<key>hash</key>
<data>
CSJi64jwIUVX0OEntgwRd5B/WwQ=
M6GOu7LeSuY/ER6L38vSYFgCgUw=
</data>
<key>hash2</key>
<data>
XZCnoxbK69pg1k+8mjeqecZYO3HlsHatLJZfHDbnvxg=
50zbkPXpRw51MqtsqNcP0+k4Pc+OtaR5yAHtevRDSkk=
</data>
</dict>
<key>Main.storyboardc/Info.plist</key>
@ -231,11 +227,11 @@
<dict>
<key>hash</key>
<data>
ExBQ7905hQq27b1OmZtQYb10SUA=
KJf7T46HZ+IyKHtg4fNSk7WKMfc=
</data>
<key>hash2</key>
<data>
CJLChPH47C+kyRUvM0WdOj890GPH9KOi6tDcZ5SWc90=
rZ/bEJqkZvuoeNLKN0CdxjPoEykk1fSvY3ajl+VTdsA=
</data>
</dict>
<key>bootstrap.tar.gz</key>
@ -249,17 +245,6 @@
oPDjxT618z33oRg9OzyDpiDLrILb//b8JERKt0c8Kbw=
</data>
</dict>
<key>ctbypass.gz</key>
<dict>
<key>hash</key>
<data>
JdQt3oVn0+ahtpB//zvjuxhaQoQ=
</data>
<key>hash2</key>
<data>
Xjb0unJ9d55XZiu3iii2FmlDbQD/67ZfEs6u02uWtgk=
</data>
</dict>
<key>essential_0-4_iphoneos-arm.deb</key>
<dict>
<key>hash</key>