Downgrade and dualboot status of almost all iOS devices

ios-downgrade-dualboot.md

Downgrade and dualboot status of almost all iOS devices

UPDATED: 2024-04-09

• Reddit mirror: https://www.reddit.com/r/iOSDowngrade/comments/j1x7iv/downgrade_and_dualboot_status_of_almost_all_ios/
• GitHub Gist mirror: https://gist.github.com/LukeZGD/9d781f1b03a69fa46869384a9407a41a
• As of updating this post, there is a downgrade tool that utilizes a SEP exploit released. However its device support is currently limited: https://limefix.tech/?product=limefix-sep-utility-testing
• Save SHSH blobs for signed iOS versions using TSS Saver or blobsaver
• GitHub repo for futurerestore nightly: https://github.com/futurerestore/futurerestore
• Delay OTA Guide (updating only): https://ios.cfw.guide/updating-blobless
• futurerestore and other downgrade utilities should be used on macOS or Linux only

iOS 17 devices (A12 devices and newer, older A10 iPads)

• Devices that fall under here have the latest version 17.x.
• Delay OTA Guide (updating only): https://ios.cfw.guide/updating-blobless
• Restoring to iOS 16 and lower is not possible.
• (A12 devices and newer) You cannot restore to any iOS versions other than signed ones. All SHSH blobs are currently useless.
• For A10 iPads only:
  • Tethered downgrade/dualboot is an option with downr1n, dualra1n, and seprmvr64
  • It is technically possible to downgrade to iOS 14-15 with blobs. For advanced users only, see guide linked in compatibility chart
  • Limefix is not yet compatible with A10 devices, wait for updates

iOS 16 devices (A11 devices, older A9 iPads)

• Devices that fall under here have the latest iOS version 16.x.
• See the SEP/BB Compatibility Chart. iOS 16 SEP/baseband is incompatible with iOS 15 and below.
• These devices can be restored to iOS 16.6.x with SHSH blobs, you may use Legacy iOS Kit for this which utilizes the updated futurerestore nightly.
• For iPhone X, you cannot restore to any iOS versions other than signed ones or 16.6.x with blobs. All SHSH blobs for 16.5.x and lower are useless.
• Tethered downgrade/dualboot is an option with downr1n, dualra1n, and seprmvr64
• It is technically possible to downgrade to iOS 14-15 with blobs for all these devices except for iPhone X. For advanced users only. See the guide linked in compatibility chart
• For A9 iPads, check for Limefix compatibility

iOS 14-15 devices (A9 and A10 devices, iPad Air 2 and mini 4)

• Devices that fall under here have the latest iOS version 15.x.
• These devices can be restored to iOS 14.x/15.x with SHSH blobs, you may use Legacy iOS Kit for this which utilizes the updated futurerestore nightly.
• For more details about SEP and baseband compatibility, see the SEP/BB Compatibility Chart
• For iOS 13 and lower, check for compatibility with Limefix
  • As of updating this post, Limefix only supports A9 devices and iOS 10, wait for updates for other devices and versions
• Tethered downgrade/dualboot is also an option with downr1n, dualra1n, and seprmvr64
• Tethered downgrade: Semaphorin supports these devices for downgrading to lower iOS versions

iOS 12 devices (A7 and A8 devices except iPad Air 2 and mini 4)

• Devices that fall under here have the latest iOS version 12.5.7.
• You can downgrade to as low as 11.3 with futurerestore if you have SHSH blobs - You can downgrade with SHSH blobs using Legacy iOS Kit
• Tethered downgrade is also an option with sunst0rm
• Limefix is not yet compatible with these devices, wait for updates
• Tethered downgrade: Semaphorin supports these devices for downgrading to lower iOS versions

A7 devices (iPhone 5S, iPad Air 1, iPad mini 2)

• A7 devices (except iPad4,6 and all iPad mini 3 models) can downgrade to 10.3.3 without existing blobs, using Legacy iOS Kit or LeetDown
  • Unfortunately checkm8 is very unreliable on Linux, so using macOS may be the better option with iPwnder32/ipwnder_lite used for better success rates
  • iPwnder Lite for iOS can also be used to put device in pwned DFU
• You can also downgrade to 10.2-10.3.2 if you have SHSH blobs
  • You can go as low as 10.1.x but Touch ID will not work
  • You can downgrade with SHSH blobs using Legacy iOS Kit
• You can also downgrade tethered to iOS 7 manually: https://ios7.iarchive.app

A5, A5X, A6, and A6X devices

• Devices that fall under here have the latest iOS version 9.3.5, 9.3.6, 10.3.3, or 10.3.4.
• You can downgrade and jailbreak any of these devices (except for iPhone 5C) to iOS 8.4.1 using Legacy iOS Kit without existing blobs
  • For iPhone 4S and iPad 2 (except iPad2,4) devices, iOS 6.1.3 is also an option
• You can downgrade to any iOS version that you have SHSH blobs for using Legacy iOS Kit
• You can also save on-board SHSH blobs with Legacy iOS Kit's "Save Onboard Blobs" option
• If you have iOS 7 SHSH blobs, you can do untethered downgrades using Legacy iOS Kit (powdersn0w)
• You can also dualboot to any version using Coolbooter
• You can dualboot to iOS 4.3.x using 4tify-iPad2 (iPad 2 only, macOS only)
• You can downgrade tethered without blobs using Legacy iOS Kit, n1ghtshade, or Deca5
  • Both n1ghtshade and Deca5 are for macOS only

iPhone 4

• You can downgrade to iOS 6, 5, or 4 untethered using Legacy iOS Kit (powdersn0w)
  • Only iPhone3,1 (GSM) and iPhone3,3 (CDMA) are supported
• You can also use Legacy iOS Kit to downgrade with saved SHSH blobs (see above)
• You can also use Legacy iOS Kit to do tethered downgrades
  • Downgrading tethered by going to: Restore/Downgrade -> Other (Tethered)
  • Do a tethered boot by going to: Other Utilities -> Just Boot
  • Tethered downgrade IPSWs option is also available in Legacy iOS Kit, see below notes
• You can dualboot to any version except 4.x using Coolbooter
• You can dualboot to 4.x using 4tify (macOS only)
  • 4tify for Linux (untested): https://github.com/LukeZGD/4tify-linux

iPod touch 4th gen

• There are no untethered downgrade options without blobs, unfortunately.
• iPod touch 4th gen can be tethered upgrade to iOS 7: https://albyvar.github.io/ipodtouchhax/
• You can do tethered downgrades without blobs using Legacy iOS Kit
  • Downgrading tethered by going to: Restore/Downgrade -> Other (Tethered)
  • Do a tethered boot by going to: Other Utilities -> Just Boot
  • There is also the option to use tethered downgrade IPSWs from these (Restore/Downgrade -> Other (Custom IPSW)):
  • https://www.reddit.com/r/LegacyJailbreak/comments/ji17zv/discussion_would_you_guys_be_interested_in/
  • https://github.com/lychitree/pr3lude
  • https://archives.legacyjailbreak.com

iPhone 3GS, iPad 1, iPod touch 2nd and 3rd gen

• You can also use Legacy iOS Kit to do untethered downgrades to other iOS versions without blobs (or with blobs also)
• iOS 4.1 is signed for the 3GS, touch 2nd gen and 3rd gen, use iTunes or Legacy iOS Kit to downgrade
  • Error 1015 will show up at the end of restore for iTunes. You can exit recovery mode using RecoveryModeTool
• Tethered downgrade option is also available in Legacy iOS Kit, see above notes
  • For the iPod touch 3rd gen, see tethered custom IPSWs in pr3lude
• For iPod touch 2nd gen (old bootrom model), there is no firmware signing for versions 3.0 and lower can be restored freely. 3.x IPSWs are available here: https://invoxiplaygames.uk/ipsw/ and https://archives.legacyjailbreak.com

iPhone 2G, 3G, and iPod touch 1st gen

• AFAIK, there is no firmware signing and they can be restored to any iOS version using an appropriate older iTunes version after placing the device in pwned DFU mode using redsn0w.
• Legacy iOS Kit also supports these devices for restoring custom IPSWs as well as restoring to any other iOS version
  • Lowest working version is 2.0, 1.x does not work
  • This makes use of changes from tihmstar's idevicerestore fork (iOS 1 and 2 support): https://github.com/tihmstar/idevicerestore
• iPhone 3G devices can be easily downgraded to iOS 4.1 and 3.1.3 using Legacy iOS Kit, with the option to jailbreak and hacktivate
• For iPhone 2G and touch 1, here are 3.1.3 custom IPSWs that may be useful: https://github.com/LukeZGD/Legacy-iOS-Kit-Keys/releases/tag/jailbreak
• IPSWs for older iPod touch are not available in ipsw.me. They are available here: https://invoxiplaygames.uk/ipsw/ and https://archives.legacyjailbreak.com

Hi Luke!

First, this post is very informative, thank you for that.

I have a friend who upgrade his IPAD (A1822, Chip A9) to 16.4.1 and one of his app is working with many errors so he asked me if there is a possibility to downgrade it to 15.7.

If I understood your post, there is no possibility of carrying out this downgrade. am i correct?

thank you for your reply,

Best regards,

there is no possibility of carrying out this downgrade. am i correct?

Yes that's correct

hi! Am I correct that I can't update my iphone 8 with ios 13.3 to ios 15.4 even despite I have saved shsh blobs for every ios including 15.4?
Is it because current signed SEP is incompatible with any ios lower than ios 16, thus my iphone will be inactivated and useless after such upgrade?

hi! Am I correct that I can't update my iphone 8 with ios 13.3 to ios 15.4 even despite I have saved shsh blobs for every ios including 15.4? Is it because current signed SEP is incompatible with any ios lower than ios 16, thus my iphone will be inactivated and useless after such upgrade?

Yes all your blobs are useless if your device supports iOS 16

Hi! If I restore my ipad air 3 with iOS 13.1.1 to the same iOS version (13.1.1) with Succession or by using the "Erase all content and settings" in Settings app, since these two are not an "upgrading", will the activation fail as well?

Hi! If I restore my ipad air 3 with iOS 13.1.1 to the same iOS version (13.1.1) with Succession or by using the "Erase all content and settings" in Settings app, since these two are not an "upgrading", will the activation fail as well?

Activation will work fine on your device since Succession and "Erase all content and settings" do not mess with SEP/baseband

Activation will work fine on your device since Succession and "Erase all content and settings" do not mess with SEP/baseband

Thanks a for the answer. I wasn't confident if I can do it or not because I got (kind of) mixed answer from many people 😅

very cool guide, I downgraded iPhone 4s and iPad 2 to iOS 6.1.3 and now they are fast. But could you correct the details about the iPhone 3G? It has firmware signing, because for a downgrade to iOS 2 you need to get it in pwnedDFU with redsn0w and then it will accept a custom iPhone OS 2 Firmware that I was successfully able to install

very cool guide, I downgraded iPhone 4s and iPad 2 to iOS 6.1.3 and now they are fast. But could you correct the details about the iPhone 3G? It has firmware signing, because for a downgrade to iOS 2 you need to get it in pwnedDFU with redsn0w and then it will accept a custom iPhone OS 2 Firmware that I was successfully able to install

Thanks, updated

I would like to get a test device (getting one of a 2g, 3g, or touch 1) so I can also add support for these devices in Legacy iOS Kit too, maybe sometime soon

Here is the link to the custom ipsw I used. Its already jailbreaked and activated:
https://web.archive.org/web/20201211142620/https://github-production-release-asset-2e65be.s3.amazonaws.com/124573555/5666f400-087e-11e9-8e07-972bcf24ea6c?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20201211%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20201211T142619Z&X-Amz-Expires=300&X-Amz-Signature=68daba605283a78bb7ea269410b436bcb69fbc9f80785f25ed4ac192e81125e2&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=124573555&response-content-disposition=attachment%3B%20filename%3DiPhone1.2_2.0_5A347_Custom_Restore.ipsw&response-content-type=application%2Foctet-stream

Whats the Untethered exploit for the ipod touch 3rd gen?

Whats the Untethered exploit for the ipod touch 3rd gen?

here's a writeup: https://nyansatan.github.io/exploiting-ios-5-iboot/

dora has released an exploit ramdisk, but currently no tools utilize it: https://github.com/kok3shidoll/untitled/tree/main/exploit/iBoot-1219.62.15/iPod3%2C1

How come is it possible to downgrade 5S and other A7 devices to 10.3.3, and to not 11 or 12.1-6?

As far as I know it’s because the 10.3.3 OTA-update is still signed for when you are still on iOS 9 or so. And this cool tool from LukeZGD could somehow use this signature to sign the whole iOS for the downgrade.

I have an iPhone 6S running iOS 12.2. Is it possible to upgrade to just iOS 12.5x with any of the method mentioned in the A9 chip instruction? Data loss doesn't matter though.

Whats the Untethered exploit for the ipod touch 3rd gen?

here's a writeup: https://nyansatan.github.io/exploiting-ios-5-iboot/

dora has released an exploit ramdisk, but currently no tools utilize it: https://github.com/kok3shidoll/untitled/tree/main/exploit/iBoot-1219.62.15/iPod3%2C1

Hi, do you know if a tool uses it now ?

Hi, do you know if a tool uses it now ?

Yes, Legacy iOS Kit

Is it not possible to dualboot iOS 4 as a secondary OS on an iPod Touch 4G using CoolBooterCLI? Saw a few resources that mentioned that it is

Is it not possible to dualboot iOS 4 as a secondary OS on an iPod Touch 4G using CoolBooterCLI? Saw a few resources that mentioned that it is

coolbooter does not support ios 4

coolbooter does not support ios 4

sorry, I meant ios 5, coolbootercli seems to support it (https://www.theiphonewiki.com/wiki/CoolBooter#CoolBooterCLI)