SUBMIT


  close
CydiaBlog.com FOR SALE
I posted this a couple days ago on /r/jailbreak after spending a long time learning about all of this and it got removed while I was helping people with no reason given -_- That’s not going to stop me from helping whoever I can with this complicated shit, though. I was planning on making this same post here anyways. I’ve decided to update parts of this with the intent of helping *anyone* learn how to save blobs, not just people with any prior experience with blob saving. First, **what are blobs?** Blobs are a .shsh2 file that is used to submit a request to Apple to restore/update to an iOS or iPadOS version. It’s basically Apple’s signature for iTunes or idevicerestore (a library for restoring Apple devices) to go ahead and install an update to your device. Normally this is just a thing that happens when your device is in recovery mode. This process can be faked and taken over, however. A computer program called futurerestore (https://github.com/marijuanARM/futurerestore) can use those .shsh2 blobs to fake that in ways that I can’t personally explain, but it does. You can also save these blobs if you’re a jailbroken user, which makes it possible to restore or upgrade to certain iOS/iPadOS versions after Apple has stopped giving those signatures itself. For example, if you have saved blobs for iOS 14.3 and you’re on iOS 13.7, you can update or restore to 14.3 today, even though the versions that are signed at the moment are iOS 14.4.2 and 14.5. Next: **why save blobs? Those versions can’t even be jailbroken for all devices!** Some exploits have been hinted at and made public that could lead to a new jailbreak. The public disclosure of security content for 14.5 has some interesting exploits that could turn into a jailbreak (https://support.apple.com/en-us/HT212317). Some exploits from Siguza (checkra1n developer and just an experienced developer for the core parts of any jailbreak) and pattern-f (dedicated exploit finder for Apple devices) are particularly exciting. Modernpwner, the team that found the iOS 14.3 and below exploits for jailbreaks (unc0ver and Taurine) has hinted at a possible bypass that could lead to a jailbreak for 14.5 (PAC bypass section of https://github.com/ModernPwner/cicuta_virosa). You could theoretically update to either one of these versions right now since they’re being signed, but given the time it takes for jailbreaks to become a thing, these versions might not be signed by Apple if or when a full jailbreak is released for them. You’d have to play the waiting game for a good while if you update now, and none of these exploits are guaranteed to be stable enough for a full fledged jailbreak anyways. That’s why blob saving is so powerful! **Why not use the OTA method?** The OTA method works great, but it doesn’t work on A14 chip devices (like the iPhone 12), and there’s a chance it doesn’t last long enough for a jailbreak to release. Blobs are a sure way to ensure that you can update to the latest jailbreakable version, unless Apple does something about it (which they can, unfortunately). If you want to learn about the OTA update, look here: https://t.me/jailbreak_announcement/17 Currently, the OTA update method is letting you go to 14.4, but it’ll go to 14.4.1 then 14.4.2 depending on the frequency of 14.5.x updates. NOTE: **There are currently no jailbreaks for both signed versions other than checkra1n for up to 14.5.1 at the moment. The lower your iOS/iPadOS version, the greater the chances of a jailbreak coming out for you**. The rule of thumb is to stay on the lowest version you can if you’re looking to jailbreak. **What can Apple do about it?** They can release a new SEP. The SEP is the touch/face id, passcode, and Apple pay on your device. If they update it, futurerestore will not work with earlier blobs that require the older SEP. The SEP can’t be fake signed like with the update itself. The change in SEP is generally between full iOS versions. For example, iOS 13 blobs don’t work today because a new SEP came with iOS 14. The same will likely happen with iOS 15, but if Apple wished, they could invalidate blobs by updating the SEP for the next iOS/iPadOS version. They’d have to put in some work for that, though! **How can I save blobs?** You can save blobs if you’re jailbroken, but the methods are different depending on your device’s interal chip. Saving blobs is really just making a request to Apple’s signing server (tss.apple.com) for update blobs for your device that you can then save for later. You will need your ECID, you will need to set your nonce generator, and (potentially) you will need to find your APNonce (this one is only for the newest devices, A12 bionic chips or newer). You can learn about each of these below. **What are all of these terms? (ECID, nonce generator, and APNonce)** Your ECID is a unique identifier stored in your device through hardware. It’s similar to a serial code or bar code number, but with more uses for your device. iTunes uses it to identify your device, no matter what’s going on with the software, like if it’s bricked. (The UDID is another unique identifier) Your nonce generator is a random 16 character string that is used when making a request for blobs. It’s formatted like this: 0x[16 characters] and if you’re jailbroken, it’s likely all 1’s. It resets to something random whenever you reboot to prevent us from using it to our advantage, although it obviously didn’t do enough because I’m writing this lmao To set your nonce generator, use dimentio. You can get it at https://repo.1conan.com/. Pull up a terminal like NewTerm 2 (from Chariz) and enter the command `dimentio [generator]` to set it. Your generator should be 0x[16 characters]. It doesn’t matter what those characters are, as long as your blobs match that generator and you are able to set/keep that same generator when you use futurerestore. I personally use all 1’s, and if you’re on unc0ver/Taurine it will likely already be all 1’s. Your APNonce is another attempt to make this whole thing harder. It’s an encryption of your nonce generator using a hash that’s also necessary for the full request for an update. On older devices, this hash is static, meaning futurerestore can get your APNonce using only your nonce generator. On newer devices.. it’s complicated. Now, how do we *actually* save blobs? **A12+ devices-** look below. The method I’ve listed for A11- chips doesn’t work because of this fun new thing called nonce entanglement. Hence why it’s complicated. I’ll explain there, but thankfully there’s a pretty simple way to save your blobs on-device that I came across. A12+ chips are on any iPhone XS/R or newer. I’m not sure what iPads have A12+ chips, but if you’re unsure, you can look up what bionic chip your iPad has online. I have no idea if any of this will apply to the upcoming M1 iPad Pro, but that’s a topic for when it actually releases. **A11- devices:** Save SHSH2 blobs using System Info or TSS Saver (from https://apt.arx8x.net/ or from https://repo.1conan.com/) for iOS/iPadOS 14.5 and 14.5.1. If you’re using System Info, go to Settings->About->swipe left on ECID->Save SHSH2. Either take note of what directory your saved blobs are in *or* press shsh.host to see where your blobs are saved online and download them to save somewhere else. If you’re using TSS Saver, just press “Save Blobs!” then press Open URL, then either go to whatever version you want to save and download those files by pressing on them *or* press Download ZIP to download all of them. Transfer those files to your PC in whatever way works for you. *The OTA updates can’t be used with futurerestore.* For both, you can save blobs for the version you’re on using APTickets, but I haven’t spent the time looking at that because there’s no reason to use them unless you’re stuck in recovery mode. If you’re at that point, you’ll probably be better off trying to use the futurerestore GUI by CoocooFroggy and first trying to exit recovery mode. If that doesn’t work, try the blob, but I can’t guarantee it’ll work. (https://github.com/CoocooFroggy/FutureRestore-GUI) You can also save blobs with two websites: TSS Saver (https://tsssaver.1conan.com/v2/) or shsh.host (https://shsh.host). You’ll need to specify your generator and ECID manually for both of the websites. **Note:** System Info lets you save blobs for the 14.5 betas, but TSS Saver does not. You can manually save blobs for the 14.5 release candidate or signed betas on either of the aforementioned websites, if you want to do that for whatever reason. **A12+ devices:** Apple introduced a new way to make saving blobs more difficult for you. It’s called nonce entanglement. Basically, on A12 devices and above, the hash used to encrypt your generator for the APNonce is dependent on some unique identifiers from your device (UDID and ECID) instead of it being static. The APNonce is still derived from your generator, but no one knows what the hash to get from generator to APNonce is and there’s no simple way to crack it. That means that you can’t use the method for A11- chip devices to save blobs easily. You will need to specify both your nonce generator and your APNonce when saving blobs. To manually find and specify this combination (called an nonce-generator pair), you have two options. (The easiest is honestly the second option) The first option is to use blobsaver (https://github.com/airsquared/blobsaver) on your computer to save blobs. You can either save them online or you can download them onto your computer. Blobsaver is able to detect both the generator and the APNonce with the button ‘read from device’. It can directly download and upload online, but I haven’t tried it myself (since I’m using an iPhone 8+, an A11 device) You can also try to do it on-device. Get NonceSet143 from https://cydia.ichitaso.com. You can get both your generator *and* your APNonce from this to manually put into shsh.host or TSS Saver. *This is probably the best method for A12+ devices since there’s no need for a computer*. The trade off is that you have to save blobs manually and you can’t do it with just a click/press. I’ve seen and heard good things about this method. System Info seems to have been updated since I first started learning about all of this, and it seems to work with A12+ devices now. Get it at https://apt.arx8x.net and try it, let me know how it works! **IMPORTANT for A12+ devices:** make sure you have your APNonce and generator saved somewhere you’ll be able to find it. If you don’t set that same generator before using futurerestore, the blob will not work and you’ll be forced to exit recovery mode. (Try iMazing on Windows/Mac if futurerestore doesn’t kick you out of recovery mode) Note (A12+): If NonceSet143 or System Info don’t work, you’ll need to install libKRW for unc0ver and checkra1n or libKernRW for Taurine/Odyssey/Odysseyra1n users. If you’re looking to actually use futurerestore, I would really recommend the futurerestore GUI by CoocooFroggy (https://github.com/CoocooFroggy/FutureRestore-GUI). It removes the process of learning about the commands for it on each computer operating system and just makes it simpler, with tips on what to do if some error happens. It’ll also pull the latest version of futurerestore from marijuanARM so you don’t accidentally get the wrong version! If you want to use -u (update) and use an iCloud backup instead of doing a full restore when you use futurerestore, I believe you have to restore rootFS. I didn’t restore rootFS when I went to 14.3 on my brother’s iPhone, and I couldn’t use his iCloud backup. It tried to make me update so that I could use the backup. People in the jb discord told me that it’s because I didn’t restore rootFS but didn’t explain why, but oh well. I believe it won’t reset your nonce generator? For some reason? Whatever honestly **Conclusion** Blobs are always great to save. Make a habit of saving them whenever a new version of iOS or iPadOS comes out. If you don’t, there’s the method to delay an OTA update that was used for 14.3, and will likely be used again, but there’s not really any guarantees that a jailbreak will come out before that 90 day delay expires. If you have any issues with any of the methods or if I missed something, feel free to let me know and I will do my best to help and respond. Have a good day everyone!