LukeZGD

Downgrade and dualboot status of almost all iOS devices

UPDATED: 2026-02-08

• Reddit mirror: https://www.reddit.com/r/iOSDowngrade/comments/j1x7iv/downgrade_and_dualboot_status_of_almost_all_ios/
• GitHub Gist mirror: https://gist.github.com/LukeZGD/9d781f1b03a69fa46869384a9407a41a
• As of updating this post, there is now a free downgrade tool that utilizes a SEP exploit released for A9-A10X devices, turdus merula: https://sep.lol/
  • Untethered with blobs guide: https://ios.cfw.guide/turdusmerula/
  • Tethered guide: https://ios.cfw.guide/turdusmerula-tethered/
• Save SHSH blobs for signed iOS versions using TSS Saver or blobsaver

LukeZGD

Installing TrollStore (TrollRestore Python Method, Windows)

1. Download and install Python (3.13 and newer, this tutorial is tested on 3.14.3): https://python.org
2. Download and install iTunes: https://www.apple.com/itunes/download/win64
3. Download and install Visual Studio Build Tools: https://visualstudio.microsoft.com/visual-cpp-build-tools/
   • In the installer, make sure to check "Desktop Development with C++" before clicking Install.
4. Download TrollRestore_Linux.zip: https://github.com/JJTech0130/TrollRestore/releases/latest
5. Extract TrollRestore_Linux.zip
6. In the TrollRestore_Linux folder, open requirements.txt and change the first line (don't forget to save it): pymobiledevice3<=6.2.0
7. While holding the Shift button, right-click the TrollRestore_Linux folder, and select "Open PowerShell window here"

LukeZGD

#!/bin/bash

# If you like this script and my work on libimobiledevice, please
# consider becoming a patron at https://patreon.com/nikias - Thanks <3

REV=1.0.17
export MACOSX_DEPLOYMENT_TARGET=10.11

if test "`echo -e Test`" != "Test" 2>&1; then
  echo Please run this with zsh or bash.

LukeZGD

Nekopara Data Extraction for Vol. 1, 0, 2, 3, 4, and Extra

• This guide can also be used in other VNs that have the Kirikiri/CatSystem2 engine

Tools Needed:

• KrkrExtract (for extraction of .xp3 files)
• AlphaMovieDecoder (for .amv files)
• FreeMote (for E-mote .psb files)
• KrKrZSceneManager (for .scn files)
• GARbro (for extraction of .int files, Vol. 3 only)
• CatSceneEditor (for .cstl files, Vol. 3 only)

LukeZGD

// from https://github.com/verygenericname/SSHRD_Script/commit/708ce254fea08e442ecb4cd20c3fdbfe6ce9ab66

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define MAX_DIFFS 16384

void print_usage(const char *prog_name) {
    printf("Usage: %s kernelcache_original kernelcache_patched output.bpatch\n", prog_name);

LukeZGD

#!/usr/bin/env bash
# diff between theapplewiki and fwkeydb ivkeys

types=(iPhone1,1 iPhone1,2 iPhone2,1 iPhone3,1 iPhone3,2 iPhone3,3 iPhone4,1 iPhone5,1 iPhone5,2 iPhone5,3 iPhone5,4
       iPad1,1 iPad2,1 iPad2,2 iPad2,3 iPad2,4 iPad2,5 iPad2,6 iPad2,7 iPad3,1 iPad3,2 iPad3,3 iPad3,4 iPad3,5 iPad3,6
       iPod1,1 iPod2,1 iPod3,1 iPod4,1 iPod5,1)

#types=(iPhone2,1)

comps=(AppleLogo BatteryCharging BatteryCharging0 BatteryCharging1 BatteryFull BatteryLow0 BatteryLow1 BatteryPlugin DeviceTree KernelCache LLB RecoveryMode EraseRamdisk iBEC iBSS iBoot UpgradeRamdisk)

LukeZGD

#include <stdlib.h>

int main() {
system("nvram -c");
system("nvram boot-partition=2");
system("nvram auto-boot=1");
//system("nvram auto-boot=0"); // for 4.2.x and lower, to send device to recovery after restore
system("umount /mnt1");
system("mount_hfs /dev/disk0s1 /mnt1");
system("dd if=/iBoot of=/mnt1/iBEC bs=512k");

LukeZGD

• Patch: https://github.com/LukeZGD/iOS-OTA-Downgrader-Keys/releases/download/jailbreak/untether.patch
• Commands:

# Patch
bspatch untether.bin untethermod.bin untether.patch
# Get diff
xxd untether.bin u1.hex
xxd untethermod.bin u2.hex
diff u1.hex u2.hex

LukeZGD

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>SectionsEnabledIdentifiers</key>
	<array>
		<string>com.apple.controlcenter.settings</string>
		<string>com.apple.controlcenter.brightness</string>
		<string>com.atwiiks.controlcenterx.volume-slider</string>
		<string>com.atwiiks.controlcenterx.air-night</string>

LukeZGD

Home Depot Offsets iOS 8.x.
Found with the help of https://github.com/Merculous/OF32
bufattr_cpx and bx_lr offsets: first result of searching hex 00687047
A5 offsets should work. tested working: 8.0, 8.3, 8.4.1
A6 does not seem to work at all on Home Depot, possibly because of something to do with the Trident exploit.

A5 8.0-8.0.2
0x2c5308
0x2c73e8
0x1ba80