Skip to content

Instantly share code, notes, and snippets.

@Duy-Thanh
Created March 24, 2023 16:14
Show Gist options
  • Save Duy-Thanh/cafb478e3f2da4cc959058479c87ff50 to your computer and use it in GitHub Desktop.
Save Duy-Thanh/cafb478e3f2da4cc959058479c87ff50 to your computer and use it in GitHub Desktop.
cyberday@cyberday-Standard-PC-i440FX-PIIX-1996:~$ idevicerestore -P -d --erase --restore-mode -i 0x1122334455667788 iPhone11,8,iPhone12,1_14.0_18A5351d_Restore.ipsw -T root_ticket.der
Using ApTicket found at root_ticket.der length 8931
idevicerestore 1.0.0-113-g3947045
progress: 0 0.000000
idevice_event_cb: device 1122334455667788 (udid: 00008030-1122334455667788) connected in restore mode
progress: 0 0.100000
Found device in Restore mode
INFO: device serial number is C39ZRMDEN72J
Found DEV model: N104DEV
ECID: 1234605616436508552
progress: 0 0.200000
Identified device as n104ap, iPhone12,1
progress: 0 0.600000
Extracting BuildManifest from IPSW
progress: 0 0.800000
Product Version: 14.0
Product Build: 18A5351d Major: 18
Device supports Image4: true
Variant: Developer Erase Install (IPSW)
This restore will erase all device data.
################################ [ WARNING ] #################################
# You are about to perform an *ERASE* restore. ALL DATA on the target device #
# will be IRREVERSIBLY DESTROYED. If you want to update your device without #
# erasing the user data, hit CTRL+C now and restart without -e or --erase #
# command line switch. #
# If you want to continue with the ERASE, please type YES and press ENTER. #
##############################################################################
> YES
progress: 1 0.000000
Checking IPSW for required components...
All required components found in IPSW
Using cached filesystem from 'iPhone11,8,iPhone12,1_14.0_18A5351d_Restore/038-44337-083.dmg'
progress: 1 0.200000
progress: 1 0.250000
progress: 1 0.300000
progress: 1 0.500000
progress: 1 0.700000
progress: 1 0.900000
About to restore device...
restore_is_current_device: Connected to com.apple.mobile.restored, version 15
Connecting now...
Connected to com.apple.mobile.restored, version 15
Device 00008030-1122334455667788 has successfully entered restore mode
Hardware Information:
BoardID: 4
ChipID: 32816
UniqueChipID: 1234605616436508552
ProductionMode: true
Starting FDR listener thread
Connecting to FDR client at port 1082
About to do ctrl handshake
FDR sending 89 bytes:
common.c:printing 287 bytes plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Command</key>
<string>BeginCtrl</string>
<key>CtrlProtoVersion</key>
<integer>2</integer>
</dict>
</plist>
FDR Sent 89 bytes
FDR Received 105 bytes
common.c:printing 334 bytes plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Command</key>
<string>BeginCtrl</string>
<key>CtrlProtoVersion</key>
<integer>2</integer>
<key>ConnPort</key>
<integer>49164</integer>
</dict>
</plist>
Ctrl handshake done (ConnPort = 49164)
progress: 1 1.000000
FDR 0x55c13191fca0 waiting for message...
Checkpoint 1621 complete with code 0
Checkpoint 1540 complete with code 0
Checkpoint 1679 complete with code 0
Checkpoint 1544 complete with code 0
About to send RootTicket...
Sending RootTicket now...
Done sending RootTicket
Checkpoint 1547 complete with code 18446744073709551615
Checkpoint 1660 complete with code 0
Checkpoint 5651 complete with code 0
Checkpoint 1607 complete with code 0
Got status message
Status: Verification Error
Log is available:
[15:59:07.0252-GMT]{4>7} CHECKPOINT NOTICE: Image4 device: AP nonce clearable
entering ramrod_clear_ap_nonce
[15:59:07.0285-GMT]{4>7} CHECKPOINT NOTICE: AP nonce consumed
[15:59:07.0303-GMT]{4>7} CHECKPOINT NOTICE: Pre-existing NVRAM variable: restore-outcome=initial_monitor_no_return
[15:59:07.0319-GMT]{4>7} CHECKPOINT ANOMALY: [check_collection]auto-boot(does_not_exist)
[15:59:07.0321-GMT]{4>7} CHECKPOINT PROGRESS: START (unknown) -> (initial_engine_no_return)
[15:59:07.0322-GMT]{4>7} CHECKPOINT NOTICE: NVRAM access available on initial check
restore-anomalies = {0x00000000:[check_collection]auto-boot(does_not_exist)}
restore-outcome = initial_engine_no_return
executing /usr/sbin/nvram restore-outcome=initial_engine_no_return
[15:59:07.0864-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0400] umask
restore-step-ids = {0x11030400:1}
restore-step-names = {0x11030400:umask}
restore-step-uptime = 8
restore-step-user-progress = -1
[15:59:07.0876-GMT]{4>7} CHECKPOINT END: MAIN:[0x0400] umask
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 8
restore-step-user-progress = -1
[15:59:07.0884-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0402] setvbuf
restore-step-ids = {0x11030402:2}
restore-step-names = {0x11030402:setvbuf}
restore-step-uptime = 8
restore-step-user-progress = -1
[15:59:07.0891-GMT]{4>7} CHECKPOINT END: MAIN:[0x0402] setvbuf
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 8
restore-step-user-progress = -1
[15:59:07.0897-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0403] kernel_logger_thread
restore-step-ids = {0x11030403:3}
restore-step-names = {0x11030403:kernel_logger_thread}
restore-step-uptime = 8
restore-step-user-progress = -1
[15:59:07.0906-GMT]{4>7} CHECKPOINT END: MAIN:[0x0403] kernel_logger_thread
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 8
restore-step-user-progress = -1
[15:59:07.0913-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0406] set_progress_0
restore-step-ids = {0x11030406:4}
restore-step-names = {0x11030406:set_progress_0}
restore-step-uptime = 8
restore-step-user-progress = -1
unable to get display list
unable to get framebuffer
No framebuffer but an internal display. Ok on bridge but weird anywhere else.
ramrod_display_set_granular_progress_forced: 0.000000
[15:59:13.0563-GMT]{4>7} CHECKPOINT END: MAIN:[0x0406] set_progress_0
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 14
restore-step-user-progress = 0
[15:59:13.0568-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0407] start_gasgauge_thread
restore-step-ids = {0x11030407:5}
restore-step-names = {0x11030407:start_gasgauge_thread}
restore-step-uptime = 14
restore-step-user-progress = 0
[15:59:13.0579-GMT]{4>7} CHECKPOINT WARNING: MAIN:[0x0407] gasgauge_start_update_thread failed: -1
[15:59:13.0581-GMT]{4>7} CHECKPOINT END: MAIN:[0x0407] start_gasgauge_thread
restore-step-ids = {}
restore-step-names = {}
restore-step-warnings = {0x11060407:{0:"gasgauge_start_update_thread failed: -1"}}
restore-step-uptime = 14
restore-step-user-progress = 0
[15:59:13.0588-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0408] listen_for_log_client
restore-step-ids = {0x11030408:6}
restore-step-names = {0x11030408:listen_for_log_client}
restore-step-uptime = 14
restore-step-user-progress = 0
[15:59:13.0603-GMT]{4>7} CHECKPOINT END: MAIN:[0x0408] listen_for_log_client
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 14
restore-step-user-progress = 0
[15:59:13.0610-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x040D] create_listen_socket
restore-step-ids = {0x1103040D:7}
restore-step-names = {0x1103040D:create_listen_socket}
restore-step-uptime = 14
restore-step-user-progress = 0
[15:59:13.0617-GMT]{4>7} CHECKPOINT END: MAIN:[0x040D] create_listen_socket
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 14
restore-step-user-progress = 0
[15:59:13.0624-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0404] update_root_mount
restore-step-ids = {0x11030404:8}
restore-step-names = {0x11030404:update_root_mount}
restore-step-uptime = 14
restore-step-user-progress = 0
[15:59:13.0674-GMT]{4>7} CHECKPOINT END: MAIN:[0x0404] update_root_mount
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 14
restore-step-user-progress = 0
[15:59:13.0681-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x0405] disable_watchdog
restore-step-ids = {0x11030405:9}
restore-step-names = {0x11030405:disable_watchdog}
restore-step-uptime = 14
restore-step-user-progress = 0
[15:59:13.0693-GMT]{4>7} CHECKPOINT END: MAIN:[0x0405] disable_watchdog
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 14
restore-step-user-progress = 0
[15:59:13.0699-GMT]{4>7} CHECKPOINT BEGIN: MAIN:[0x040E] enable_usb
restore-step-ids = {0x1103040E:10}
restore-step-names = {0x1103040E:enable_usb}
restore-step-uptime = 14
restore-step-user-progress = 0
waiting for matching IOKit service: {
IOProviderClass = AppleUSBDeviceMux;
}
[15:59:16.0838-GMT]{4>7} CHECKPOINT END: MAIN:[0x040E] enable_usb
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 17
restore-step-user-progress = 0
waiting for host to trigger start of restore [timeout of 120 seconds]
recv(9, 4) failed: connection closed
unable to read message size: -1
could not receive message
unrecognized request 'GetValue'
unrecognized request 'GetValue'
recv(9, 4) failed: connection closed
unable to read message size: -1
could not receive message
unrecognized request 'GetValue'
[15:59:24.0690-GMT]{4>7} CHECKPOINT BEGIN: RESTORED:[0x0600] client_protocol_version
restore-step-ids = {0x11030600:11}
restore-step-names = {0x11030600:client_protocol_version}
restore-step-uptime = 25
restore-step-user-progress = 0
client protocol version 15
[15:59:24.0700-GMT]{4>7} CHECKPOINT END: RESTORED:[0x0600] client_protocol_version
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 25
restore-step-user-progress = 0
[15:59:24.0710-GMT]{4>7} CHECKPOINT BEGIN: RESTORED:[0x0601] copy_restore_options
restore-step-ids = {0x11030601:12}
restore-step-names = {0x11030601:copy_restore_options}
restore-step-uptime = 25
restore-step-user-progress = 0
unable to open /usr/local/share/restore//options.n104.plist: No such file or directory
0: NSPOSIXErrorDomain/2: create_dictionary_from_plist: unable to open plist
unable to open /usr/local/share/restore//options.plist: No such file or directory
0: NSPOSIXErrorDomain/2: create_dictionary_from_plist: unable to open plist
*** UUID ECCB7027-3720-9C13-FB23-77951033C1F1 ***
Restore options:
UUID => <CFString 0x109117fc0 [0x105bc41b8]>{contents = "ECCB7027-3720-9C13-FB23-77951033C1F1"}
PersonalizedDuringPreflight => <CFBoolean 0x105bc5c00 [0x105bc41b8]>{value = true}
CreateFilesystemPartitions => <CFBoolean 0x105bc5c00 [0x105bc41b8]>{value = true}
[15:59:24.0743-GMT]{4>7} CHECKPOINT END: RESTORED:[0x0601] copy_restore_options
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 25
restore-step-user-progress = 0
[15:59:24.0749-GMT]{4>7} CHECKPOINT BEGIN: RESTORED:[0x0655] is_host_compatible
restore-step-ids = {0x11030655:13}
restore-step-names = {0x11030655:is_host_compatible}
restore-step-uptime = 25
restore-step-user-progress = 0
Checkpoint engine recorder path set to /mnt5
[15:59:24.0758-GMT]{4>7} CHECKPOINT END: RESTORED:[0x0655] is_host_compatible
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 25
restore-step-user-progress = 0
[15:59:24.0768-GMT]{4>7} CHECKPOINT BEGIN: RESTORED:[0x0604] set_weight_from_options
restore-step-ids = {0x11030604:14}
restore-step-names = {0x11030604:set_weight_from_options}
restore-step-uptime = 25
restore-step-user-progress = 0
[15:59:24.0787-GMT]{4>7} CHECKPOINT END: RESTORED:[0x0604] set_weight_from_options
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 25
restore-step-user-progress = 0
[15:59:24.0797-GMT]{4>7} CHECKPOINT BEGIN: RESTORED:[0x068F] libauthinstall_callback
restore-step-ids = {0x1103068F:15}
restore-step-names = {0x1103068F:libauthinstall_callback}
restore-step-uptime = 25
restore-step-user-progress = 0
[15:59:24.0816-GMT]{4>7} CHECKPOINT END: RESTORED:[0x068F] libauthinstall_callback
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 25
restore-step-user-progress = 0
[15:59:24.0825-GMT]{4>7} CHECKPOINT BEGIN: RESTORED:[0x0608] device_has_hoover
restore-step-ids = {0x11030608:16}
restore-step-names = {0x11030608:device_has_hoover}
restore-step-uptime = 25
restore-step-user-progress = 0
[15:59:24.0842-GMT]{4>7} CHECKPOINT END: RESTORED:[0x0608] device_has_hoover
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 25
restore-step-user-progress = 0
[15:59:24.0850-GMT]{4>7} CHECKPOINT BEGIN: RESTORED:[0x060B] update_ticket
restore-step-ids = {0x1103060B:17}
restore-step-names = {0x1103060B:update_ticket}
restore-step-uptime = 25
restore-step-user-progress = 0
entering ramrod_ticket_update_verify
looking up boot manifest hash
device tree ticket_hash: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
crypto-hash-method found. Using SHA2-384
computed ticket_hash : 5118EA8F39FF61D152BA7E1F92591910CDE7A2B09B867D8D58DC37E2CDC0B7C98DD296D4BF57862D143413DD17012D70
failed to update ticket: 3
0: RamrodErrorDomain/3: ramrod_ticket_update_verify: invalid ticket
unable to convert ramrod error 3
[15:59:24.0902-GMT]{4>7} CHECKPOINT FAILURE:(FAILURE:-1) RESTORED:[0x060B] update_ticket [0]D(failed to request root ticket)
restore-step-results = {0x1107060B:{0:-1}}
restore-step-codes = {0x1107060B:{0:-1}}
restore-step-domains = {0x1107060B:{0:"AMRestoreErrorDomain"}}
restore-step-error = {0x1107060B:"[0]D(failed to request root ticket)"}
restore-step-uptime = 25
restore-step-user-progress = 0
[15:59:24.0913-GMT]{4>7} CHECKPOINT NOTICE: (NVRAM set) restore-step-user-progress=0 [sync=true] (first failure)
[15:59:24.0916-GMT]{4>7} CHECKPOINT BEGIN: RESTORED:[0x067C] cleanup_boot_command
restore-step-ids = {0x1103060B:17;0x1103067C:18}
restore-step-names = {0x1103060B:update_ticket;0x1103067C:cleanup_boot_command}
restore-step-uptime = 25
restore-step-user-progress = 0
entering reset_boot_command_if_value
executing /usr/sbin/nvram -d recovery-boot-mode
recovery-boot-mode
[15:59:25.0462-GMT]{4>7} CHECKPOINT END: RESTORED:[0x067C] cleanup_boot_command
restore-step-ids = {0x1103060B:17}
restore-step-names = {0x1103060B:update_ticket}
restore-step-uptime = 26
restore-step-user-progress = 0
[15:59:25.0470-GMT]{4>7} CHECKPOINT BEGIN: RESTORED:[0x1613] cleanup_recovery_os_volume
restore-step-ids = {0x1103060B:17;0x11031613:19}
restore-step-names = {0x1103060B:update_ticket;0x11031613:cleanup_recovery_os_volume}
restore-step-uptime = 26
restore-step-user-progress = 0
[15:59:25.0481-GMT]{4>7} CHECKPOINT END: RESTORED:[0x1613] cleanup_recovery_os_volume
restore-step-ids = {0x1103060B:17}
restore-step-names = {0x1103060B:update_ticket}
restore-step-uptime = 26
restore-step-user-progress = 0
[15:59:25.0496-GMT]{4>7} CHECKPOINT BEGIN: RESTORED:[0x0647] cleanup_check_result
restore-step-ids = {0x1103060B:17;0x11030647:20}
restore-step-names = {0x1103060B:update_ticket;0x11030647:cleanup_check_result}
restore-step-uptime = 26
restore-step-user-progress = 0
[15:59:25.0509-GMT]{4>7} CHECKPOINT END: RESTORED:[0x0647] cleanup_check_result
restore-step-ids = {0x1103060B:17}
restore-step-names = {0x1103060B:update_ticket}
restore-step-uptime = 26
restore-step-user-progress = 0
[15:59:25.0520-GMT]{4>7} CHECKPOINT BEGIN: RESTORED:[0x0648] cleanup_send_final_status
restore-step-ids = {0x1103060B:17;0x11030648:21}
restore-step-names = {0x1103060B:update_ticket;0x11030648:cleanup_send_final_status}
restore-step-uptime = 26
restore-step-user-progress = 0
ERROR: Unable to successfully restore device
Checkpoint 1608 complete with code 0
FDR 0x55c13191fca0 terminating...
ERROR: Unable to restore device
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment