Script for tether booting Checkm8 vulnerable iOS devices by Matty (moski)
MACOS ONLY - Don't ask for Windows support
Don't use this on a main device, expect issues, bugs and other problems that will make this a bad experience. In saying that, it should work without any major issues, but I'd rather have this disclaimer so I have an excuse to ignore wen eta kids.
PyBoot is a simple alternative to ra1nsn0w for tether booting Checkm8 vulnerable iOS devices. It downloads and patches iBSS/iBEC, downloads the Kernel, DeviceTree and TrustCache for the downgraded version, patches the type to the restore type (E.G krnl -> rkrn, etc) and signs them with SHSH, then sends the images to the device and boots them! PyBoot also doesn't rely on keys being available on theiphonewiki, if there are no keys online then it will place your device into PWNDFU mode and retrieve them automatically!
PyBoot is most likely extremely broken, expect issues and bugs. I just made this for fun, and to have an alternative to ra1nsn0w for booting tethered downgraded devices with SuccessionDown (my Succession fork for tethered downgrades on-device).
How do I tether downgrade my device you might be asking? Simply add my repo (matthewpierson.github.io) to Cydia/Zebra/Sileo and install "SuccessionDown" =)
Feel free to create a pull request if you want to help improve this, or create an issue if you find one!
If you wish to donate to me, feel free to do so, but donations are in no way required or expected. My paypal account is [email protected] (I can't create a paypal.me link in New Zealand sadly, so you'd need to send donations manually). I make these things for fun and to be useful to the jailbreak community, not for profit, but money is still nice =)
- iPhone 5s
- iPhone 6/6+
- iPhone 6s/6s+
- iPhone SE (First Gen)
- iPhone 7/7+
Currently Unsupported -
- iPhone 8/8+
- iPhone X
All iPads and iPods are untested, but they should work fine with the corresponding iPhone CPU. Please try and let me know if they work or not.
A11 support will be fixed/added at a later date as Kairos is currently broken on A11 devices.
Usage: ./pyboot.py [OPTIONS]
E.G "./pyboot.py -i iPhone8,1 13.2.3 -b ~/Downloads/bootlogo.png"
Options:
-i, --ios DEVICE IOS Device model and downgraded iOS version to boot
-q, --ipsw IPSW DEVICE Path to downloaded IPSW
-b, --bootlogo LOGO Path to .PNG to use as boot logo
-p, --pwn Enter PWNDFU mode, which will also apply sig patches
-d, --dualboot PARTITION Name of system partition you wish to boot (e.g disk0s1s3 or disk0s1s6)
-a, --bootargs Custom boot-args, will prompt user to enter, don't enter a value upon running PyBoot (Default is '-v')
-c, --credits Show credits
-v, --version List the version of PyBoot
--debug Add 'serial=3' to boot-args to enable the usage of serial cables for debugging
--amfi Apply AMFI patches to kernel
- cd into the PyBoot directory
- Run pip3 install -r requirements.txt
- Connect your device in DFU mode to your computer
- Run PyBoot with your desiered options - E.G './pyboot.py -i iPhone8,1 13.1.1 -b ~/Downloads/customBootLogo.png'
- Run PyBoot whenever you want to boot the device
- Enjoy!
-
Very high storage usage after downgrading. Can be partially mitigated with a "Reset content and settings" (mobile_obliterator is called after the downgrade by successiondown but sometimes it doesn't run) You could also try this but I haven't tested this so you'd be on your own.
-
Some IPSW's won't download from Apple's servers. Can be avoided by either picking a different iOS version or by providing an IPSW
-
Jailbreak's don't work after downgrading. No current method to jailbreak devices downgraded by this method. Checkra1n will give OTA error when installing Cydia (Might be possible to fix) and Unc0ver fails when attempting to find kernel offsets (Probably can't fix)Unc0ver 4.1.0 and higher should work fine for jailbreaking 13.x - 13.3, you still can't use Checkra1n however as that will cause broken WiFi on boot, plus other issues. Electra does work for jailbreaking 11.x, but has some issues that you can fix by following this tweet from coolstar after jailbreaking. 12.x jailbreaks are untested, will edit README with info later.
-
First make sure you have ran "pip3 install -r requirements.txt" before doing anything
-
If you are getting irecovery related errors, download this bash script and run it
Me - For writing this whole thing :)
Thimstar - img4tool, tsschecker
realnp - ibootim
Merculous - ios-python-tools (iphonewiki.py for keys)
0x7ff - Eclipsa
libimobiledevice team - irecovery
Ralph0045 - dtree_patcher/Kernel64Patcher
mcg29_ - amfi patching stuff