Downgrade and dualboot status of almost all iOS devices

ios-downgrade-dualboot.md

Downgrade and dualboot status of almost all iOS devices

UPDATED: 2024-12-01

• Reddit mirror: https://www.reddit.com/r/iOSDowngrade/comments/j1x7iv/downgrade_and_dualboot_status_of_almost_all_ios/
• GitHub Gist mirror: https://gist.github.com/LukeZGD/9d781f1b03a69fa46869384a9407a41a
• As of updating this post, there is a downgrade tool that utilizes a SEP exploit released. However its device support is currently limited: https://limefix.tech/?product=limefix-sep-utility-testing
  • There might be a better downgrade tool that uses a SEP exploit in the future, it may be better to wait for that instead
• Save SHSH blobs for signed iOS versions using TSS Saver or blobsaver
• GitHub repo for futurerestore nightly: https://github.com/futurerestore/futurerestore
• For Windows builds of futurerestore nightly, go to the Discord server linked in the readme
• Almost all 32-bit downgrades can be done by Legacy iOS Kit: https://github.com/LukeZGD/Legacy-iOS-Kit
• Tethered 64-bit downgrades are mostly covered by Semaphorin (discontinued): https://github.com/LukeZGD/Semaphorin
• Tethered 64-bit iOS 15 downgrade guide by dleovl: https://github.com/dleovl/ios15tether
• Tethered 64-bit downgrade guide by mineek: https://github.com/mineek/iostethereddowngrade
• Guide for downgrading iOS 16+ checkm8 devices to iOS 14-15: https://gist.github.com/pixdoet/2b58cce317a3bc7158dfe10c53e3dd32
• Delay OTA Guide (updating only): https://ios.cfw.guide/updating-blobless
• Even if there are Windows builds/versions for some of these tools, iOS downgrades should be done on macOS or Linux only

iOS 17/18 devices (A12 devices and newer, older A10 iPads)

• Devices that fall under here have the latest version 17.x/18.x.
• Delay OTA Guide (updating only): https://ios.cfw.guide/updating-blobless
• (A12 devices and newer) You cannot restore to any iOS versions other than signed ones. All SHSH blobs are currently useless.
• For A10 iPads only:
  • Tethered downgrade/dualboot: Semaphorin supports these devices for downgrading to lower iOS versions
  • See links above for other tethered 64-bit downgrade guides
  • It is technically possible to downgrade to iOS 14-15 with blobs. For advanced users only, see "Guide for downgrading iOS 16+ checkm8 devices to iOS 14-15" linked above

iOS 16 devices (A11 devices, older A9 iPads)

• Devices that fall under here have the latest iOS version 16.x.
• See the SEP/BB Compatibility Chart. iOS 16 SEP/baseband is incompatible with iOS 15 and below.
• These devices can be restored to iOS 16.6.x with SHSH blobs, you may use Legacy iOS Kit for this which utilizes the updated futurerestore nightly.
• For iPhone X, you cannot restore to any iOS versions other than signed ones or 16.6.x with blobs. All SHSH blobs for 16.5.x and lower are currently useless.
• Tethered downgrade/dualboot: Semaphorin supports these devices for downgrading to lower iOS versions
  • Downgrading from iOS 16 is supported on macOS only
• Tethered downgrade/dualboot is also an option with downr1n or dualra1n
• See links above for tethered 64-bit downgrade guides (likely not applicable to iPhone X)
• It is technically possible to downgrade to iOS 14-15 with blobs for all these devices except for iPhone X. For advanced users only. See "Guide for downgrading iOS 16+ checkm8 devices to iOS 14-15" linked above

iOS 14-15 devices (A9 and A10 devices, iPad Air 2 and mini 4)

• Devices that fall under here have the latest iOS version 15.x.
• These devices can be restored to iOS 14.x/15.x with SHSH blobs, you may use Legacy iOS Kit for this which utilizes the updated futurerestore nightly.
• For more details about SEP and baseband compatibility, see the SEP/BB Compatibility Chart
• For iOS 13 and lower, check for compatibility with Limefix
  • As of updating this post, Limefix supports A9 devices and iOS 10, check for updates for other devices and versions
• Tethered downgrade/dualboot: Semaphorin supports these devices for downgrading to lower iOS versions
• Tethered downgrade/dualboot is also an option with downr1n or dualra1n
• See links above for other tethered 64-bit downgrade guides

iOS 12 devices (A7 and A8 devices except iPad Air 2 and mini 4)

• Devices that fall under here have the latest iOS version 12.5.7.
• You can downgrade to as low as 11.3 with futurerestore if you have SHSH blobs
  • You can downgrade with SHSH blobs using Legacy iOS Kit
• Tethered downgrade/dualboot: Semaphorin supports these devices for downgrading to lower iOS versions

A7 devices (iPhone 5S, iPad Air 1, iPad mini 2)

• A7 devices (except iPad4,6 and all iPad mini 3 models) can downgrade to 10.3.3 without existing blobs, using Legacy iOS Kit or LeetDown
  • Unfortunately checkm8 is very unreliable on Linux, so using macOS may be the better option with iPwnder32/ipwnder_lite used for better success rates
  • iPwnder Lite for iOS can also be used to put device in pwned DFU
• You can also downgrade to 10.2-10.3.2 if you have SHSH blobs
  • You can go as low as 10.1.x but Touch ID will not work for 5S
  • You can downgrade with SHSH blobs using Legacy iOS Kit
• You can also downgrade/dualboot tethered with Semaphorin as mentioned above

A5, A5X, A6, and A6X devices

• Devices that fall under here have the latest iOS version 9.3.5, 9.3.6, 10.3.3, or 10.3.4.
• You can downgrade and jailbreak any of these devices (except for iPhone 5C) to iOS 8.4.1 using Legacy iOS Kit without existing blobs
  • For iPhone 4S and iPad 2 (except iPad2,4) devices, iOS 6.1.3 is also an option
• You can downgrade to any iOS version that you have SHSH blobs for using Legacy iOS Kit
• You can also save on-board SHSH blobs with Legacy iOS Kit's "Save Onboard Blobs" option
• If you have iOS 7 SHSH blobs, you can do untethered downgrades using Legacy iOS Kit (powdersn0w)
• You can also dualboot to any version using Coolbooter
• iPad 2 only: You can dualboot to iOS 4.3.x using FourThree-iPad2 or 4tify-iPad2
  • 4tify-iPad2 is for macOS only
• You can downgrade tethered without blobs using Legacy iOS Kit, n1ghtshade, or Deca5
  • Both n1ghtshade and Deca5 are for macOS only

iPhone 4

• You can downgrade to iOS 6, 5, or 4 untethered using Legacy iOS Kit (powdersn0w)
  • Only iPhone3,1 (GSM) and iPhone3,3 (CDMA) are supported
• You can also use Legacy iOS Kit to downgrade with saved SHSH blobs (see above)
• You can also use Legacy iOS Kit to do tethered downgrades
  • Downgrading tethered by going to: Restore/Downgrade -> Other (Tethered)
  • Do a tethered boot by going to: Other Utilities -> Just Boot
  • Tethered downgrade IPSWs option is also available in Legacy iOS Kit, see below notes
• You can dualboot to any version except 4.x using Coolbooter
• You can dualboot to 4.x using 4tify (macOS only)
  • 4tify for Linux (untested): https://github.com/LukeZGD/4tify-linux

iPod touch 4th gen

• There are no untethered downgrade options without blobs, unfortunately.
• iPod touch 4th gen can be tethered upgrade to iOS 7: https://albyvar.github.io/ipodtouchhax/
• You can do tethered downgrades without blobs using Legacy iOS Kit
  • Downgrading tethered by going to: Restore/Downgrade -> Other (Tethered)
  • Do a tethered boot by going to: Other Utilities -> Just Boot
  • There is also the option to use tethered downgrade IPSWs from these (Restore/Downgrade -> Other (Custom IPSW)):
  • https://www.reddit.com/r/LegacyJailbreak/comments/ji17zv/discussion_would_you_guys_be_interested_in/
  • https://github.com/lychitree/pr3lude
  • https://archives.legacyjailbreak.com

iPhone 3GS, iPad 1, iPod touch 2nd and 3rd gen

• You can also use Legacy iOS Kit to do untethered downgrades to other iOS versions without blobs (or with blobs also)
• iOS 4.1 is signed for the 3GS, touch 2nd gen and 3rd gen, use iTunes or Legacy iOS Kit to downgrade
  • Error 1015 will show up at the end of restore for iTunes. You can exit recovery mode using RecoveryModeTool
• Tethered downgrade option is also available in Legacy iOS Kit, see above notes
  • For the iPod touch 3rd gen, see tethered custom IPSWs in pr3lude
• For iPod touch 2nd gen (old bootrom model), there is no firmware signing for versions 3.0 and lower can be restored freely. 3.x IPSWs are available here: https://invoxiplaygames.uk/ipsw/ and https://archives.legacyjailbreak.com

iPhone 2G, 3G, and iPod touch 1st gen

• AFAIK, there is no firmware signing and they can be restored to any iOS version using an appropriate older iTunes version after placing the device in pwned DFU mode using redsn0w.
• Legacy iOS Kit also supports these devices for restoring custom IPSWs as well as restoring to any other iOS version
  • Jailbreak support is for iOS 4.2.1, 4.1 and 3.1.3 for these devices
  • Lowest working version is 2.0, 1.x does not work
  • This makes use of changes from tihmstar's idevicerestore fork (iOS 1 and 2 support): https://github.com/tihmstar/idevicerestore
• iPhone 3G devices can be easily downgraded to iOS 4.1 and 3.1.3 using Legacy iOS Kit, with the option to jailbreak and hacktivate
• For iPhone 2G and touch 1, here are 3.1.3 custom IPSWs that may be useful: https://github.com/LukeZGD/Legacy-iOS-Kit-Keys/releases/tag/jailbreak
• IPSWs for older iPod touch are not available in ipsw.me. They are available here: https://invoxiplaygames.uk/ipsw/ and https://archives.legacyjailbreak.com

Hi! If I restore my ipad air 3 with iOS 13.1.1 to the same iOS version (13.1.1) with Succession or by using the "Erase all content and settings" in Settings app, since these two are not an "upgrading", will the activation fail as well?

Hi! If I restore my ipad air 3 with iOS 13.1.1 to the same iOS version (13.1.1) with Succession or by using the "Erase all content and settings" in Settings app, since these two are not an "upgrading", will the activation fail as well?

Activation will work fine on your device since Succession and "Erase all content and settings" do not mess with SEP/baseband

Activation will work fine on your device since Succession and "Erase all content and settings" do not mess with SEP/baseband

Thanks a for the answer. I wasn't confident if I can do it or not because I got (kind of) mixed answer from many people 😅

very cool guide, I downgraded iPhone 4s and iPad 2 to iOS 6.1.3 and now they are fast. But could you correct the details about the iPhone 3G? It has firmware signing, because for a downgrade to iOS 2 you need to get it in pwnedDFU with redsn0w and then it will accept a custom iPhone OS 2 Firmware that I was successfully able to install

very cool guide, I downgraded iPhone 4s and iPad 2 to iOS 6.1.3 and now they are fast. But could you correct the details about the iPhone 3G? It has firmware signing, because for a downgrade to iOS 2 you need to get it in pwnedDFU with redsn0w and then it will accept a custom iPhone OS 2 Firmware that I was successfully able to install

Thanks, updated

I would like to get a test device (getting one of a 2g, 3g, or touch 1) so I can also add support for these devices in Legacy iOS Kit too, maybe sometime soon

Here is the link to the custom ipsw I used. Its already jailbreaked and activated:
https://web.archive.org/web/20201211142620/https://github-production-release-asset-2e65be.s3.amazonaws.com/124573555/5666f400-087e-11e9-8e07-972bcf24ea6c?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20201211%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20201211T142619Z&X-Amz-Expires=300&X-Amz-Signature=68daba605283a78bb7ea269410b436bcb69fbc9f80785f25ed4ac192e81125e2&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=124573555&response-content-disposition=attachment%3B%20filename%3DiPhone1.2_2.0_5A347_Custom_Restore.ipsw&response-content-type=application%2Foctet-stream

Whats the Untethered exploit for the ipod touch 3rd gen?

Whats the Untethered exploit for the ipod touch 3rd gen?

here's a writeup: https://nyansatan.github.io/exploiting-ios-5-iboot/

dora has released an exploit ramdisk, but currently no tools utilize it: https://github.com/kok3shidoll/untitled/tree/main/exploit/iBoot-1219.62.15/iPod3%2C1

How come is it possible to downgrade 5S and other A7 devices to 10.3.3, and to not 11 or 12.1-6?

As far as I know it’s because the 10.3.3 OTA-update is still signed for when you are still on iOS 9 or so. And this cool tool from LukeZGD could somehow use this signature to sign the whole iOS for the downgrade.

I have an iPhone 6S running iOS 12.2. Is it possible to upgrade to just iOS 12.5x with any of the method mentioned in the A9 chip instruction? Data loss doesn't matter though.

Whats the Untethered exploit for the ipod touch 3rd gen?

here's a writeup: https://nyansatan.github.io/exploiting-ios-5-iboot/

dora has released an exploit ramdisk, but currently no tools utilize it: https://github.com/kok3shidoll/untitled/tree/main/exploit/iBoot-1219.62.15/iPod3%2C1

Hi, do you know if a tool uses it now ?

Hi, do you know if a tool uses it now ?

Yes, Legacy iOS Kit

Is it not possible to dualboot iOS 4 as a secondary OS on an iPod Touch 4G using CoolBooterCLI? Saw a few resources that mentioned that it is

Is it not possible to dualboot iOS 4 as a secondary OS on an iPod Touch 4G using CoolBooterCLI? Saw a few resources that mentioned that it is

coolbooter does not support ios 4

coolbooter does not support ios 4

sorry, I meant ios 5, coolbootercli seems to support it (https://www.theiphonewiki.com/wiki/CoolBooter#CoolBooterCLI)

Semaphorin just got a new update yesterday that adds A10 support and it does support A7

not all 32 bit devices support powdersnow and definley not on all ios 7 verisons

should be
Restoring with powdersn0w is supported on the following devices and target version range:
iPhone 4 GSM - iOS 4.0 to 7.1.1 (all versions except 4.2.1)
iPhone 4 CDMA - iOS 5.0 to 7.1.1
iPhone 4S, 5, 5C, iPad 2 Rev A, iPod touch 5 - iOS 5.0 to 9.3.5
iPad 1 - iOS 4.3 to 5.1
iPod touch 3 - iOS 4.0 to 5.1
Using powdersn0w requires iOS 7.1.x blobs for your device
No blob requirement for iPhone 4, iPad 1, iPod touch 3 (7.1.2 and 5.1.1 are signed)
For iPhone 5 and 5C, both 7.0.x and 7.1.x blobs can be used

Semaphorin just got a new update yesterday that adds A10 support and it does support A7

should also note that sep will not work

Asked the creator of Semaphorin about dualbooting with the tool:

dualbooting to ios 10.3-10.3.3 on any ios 10.3 or later device=ok
dualbooting to ios 11.0 or later on any ios 13 or later device=explodes the main os
dualbooting to ios 7,8, or 9 on any a7 device running ios 10.3.3 with the help of --dualboot-hfs = ok
dualbooting to ios 8 or 9 on any a8 device running ios 10.3.3 with the help of --dualboot-hfs = ok
dualbooting to ios 9 on any a9 device running ios 10.3.3 with the help of --dualboot-hfs = baseband dead on ios 10 after hfs conversion, but ios 9 baseband works
dualbooting to ios 9 on any a9 device running ios 9.x with the help of --dualboot-hfs = ok

iphone x support added
https://github.com/y08wilm/Semaphorin/commit/cf8d52e845f8ac9a9ec79e80e965f2b3af24ba90

Is it possible to untethered downgrade iPad 1 without blobs to 3.2.x and iPhone 4 CDMA to iOS 4.x?

So right now it is not kinda possible to downgrade iPhone SE 2 with iOS 17.5.1 to any below iOS 17 versions?
And I also have an iPhone 7 plus with iOS 15.8.2 which I also want to downgrade as well

is a way to downgrade 6s to ios 11/10/9? i can use a hackintosh if this way only with mac

m4 ipad when

Hi Luke! I have created a dual system using Coolbooter. How do I mount the secondary system?

Hi Luke! Can I downgrade my iPhone 4S on iOS 7.0.4 using powdersn0w.

How to hacktivate iPhone 4 without SIM? I don't have the option in settings.

Can I tethered downgrade iPad Pro 10.5 (A10X)? After booted up to pongoos kernel isn’t loading, iPad will show kernel panic then reboot to system. Why?