LukeZGD

Downgrade and dualboot status of almost all iOS devices

UPDATED: 2025-04-04

• Reddit mirror: https://www.reddit.com/r/iOSDowngrade/comments/j1x7iv/downgrade_and_dualboot_status_of_almost_all_ios/
• GitHub Gist mirror: https://gist.github.com/LukeZGD/9d781f1b03a69fa46869384a9407a41a
• As of updating this post, there is now a free downgrade tool that utilizes a SEP exploit released for A9-A10X devices, turdus merula: https://sep.lol/
  • Untethered with blobs guide: https://ios.cfw.guide/turdusmerula/
  • Tethered guide: https://ios.cfw.guide/turdusmerula-tethered/
• Save SHSH blobs for signed iOS versions using TSS Saver or blobsaver

LukeZGD

Nekopara Data Extraction for Vol. 1, 0, 2, 3, 4, and Extra

• This guide can also be used in other VNs that have the Kirikiri/CatSystem2 engine

Tools Needed:

• KrkrExtract (for extraction of .xp3 files)
• AlphaMovieDecoder (for .amv files)
• FreeMote (for E-mote .psb files)
• KrKrZSceneManager (for .scn files)
• GARbro (for extraction of .int files, Vol. 3 only)
• CatSceneEditor (for .cstl files, Vol. 3 only)

LukeZGD

#!/bin/bash

# If you like this script and my work on libimobiledevice, please
# consider becoming a patron at https://patreon.com/nikias - Thanks <3

REV=1.0.17
export MACOSX_DEPLOYMENT_TARGET=10.11

if test "`echo -e Test`" != "Test" 2>&1; then
  echo Please run this with zsh or bash.

LukeZGD

#!/usr/bin/env bash
# diff between theapplewiki and fwkeydb ivkeys

types=(iPhone1,1 iPhone1,2 iPhone2,1 iPhone3,1 iPhone3,2 iPhone3,3 iPhone4,1 iPhone5,1 iPhone5,2 iPhone5,3 iPhone5,4
       iPad1,1 iPad2,1 iPad2,2 iPad2,3 iPad2,4 iPad2,5 iPad2,6 iPad2,7 iPad3,1 iPad3,2 iPad3,3 iPad3,4 iPad3,5 iPad3,6
       iPod1,1 iPod2,1 iPod3,1 iPod4,1 iPod5,1)

#types=(iPhone2,1)

comps=(AppleLogo BatteryCharging BatteryCharging0 BatteryCharging1 BatteryFull BatteryLow0 BatteryLow1 BatteryPlugin DeviceTree KernelCache LLB RecoveryMode EraseRamdisk iBEC iBSS iBoot UpgradeRamdisk)

LukeZGD

#include <stdlib.h>

int main() {
system("nvram -c");
system("nvram boot-partition=2");
system("nvram auto-boot=1");
//system("nvram auto-boot=0"); // for 4.2.x and lower, to send device to recovery after restore
system("umount /mnt1");
system("mount_hfs /dev/disk0s1 /mnt1");
system("dd if=/iBoot of=/mnt1/iBEC bs=512k");

LukeZGD

• Patch: https://github.com/LukeZGD/iOS-OTA-Downgrader-Keys/releases/download/jailbreak/untether.patch
• Commands:

# Patch
bspatch untether.bin untethermod.bin untether.patch
# Get diff
xxd untether.bin u1.hex
xxd untethermod.bin u2.hex
diff u1.hex u2.hex

LukeZGD

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>SectionsEnabledIdentifiers</key>
	<array>
		<string>com.apple.controlcenter.settings</string>
		<string>com.apple.controlcenter.brightness</string>
		<string>com.atwiiks.controlcenterx.volume-slider</string>
		<string>com.atwiiks.controlcenterx.air-night</string>

LukeZGD

Home Depot Offsets iOS 8.x.
Found with the help of https://github.com/Merculous/OF32
bufattr_cpx and bx_lr offsets: first result of searching hex 00687047
A5 offsets should work. tested working: 8.0, 8.3, 8.4.1
A6 does not seem to work at all on Home Depot, possibly because of something to do with the Trident exploit.

A5 8.0-8.0.2
0x2c5308
0x2c73e8
0x1ba80

LukeZGD

Home Depot Offsets iOS 9.x.
Found with the help of https://github.com/stek29/awful-offset-finder
offset finder gives wrong clock_ops offsets for 9.0-9.1, so those are found manually.
allproc offsets are likely wrong for 9.0-9.0.2.
I can't get the 9.0-9.0.2 offsets to work anyway when I tried testing on my iPhone 5.

A5 9.0-9.0.2
0x317de4
0x31a5d0
0x1daec

LukeZGD

#!/bin/bash

# Script for QuadtreeAmogufier
# https://github.com/snailcon/QuadtreeAmogufier

cd "$(dirname $0)"

if [[ $1 == clean ]]; then
    rm -f audio.ogg in/*.png out/*.png
    exit