10.3 Beta5 降级记录

2017-3-11 21:31:09
进行到这一步未完成。网络成功案例多数为 iPhone 5s 中未修复的 BUG,也就是碰撞一定时间后出现一个固定值。

查阅了更多资料 6s 不越狱降级几乎不可能,虽然缩小了碰撞值范围,但碰撞出那个需要的值很难,这就是越狱后可以直接将 shsh2 里 G 值写入到手机 NVRAM 好处。而之前 6s 能降级到 10.2 是因为在验证未关闭时指定 ApNonce 值再备份 shsh2 才降级成功。目前也许只能等 10.3 越狱出来后才能再次测试降级。

下载

futurestore by tihmstar(平刷降级)
http://api.tihmstar.net/builds/futurerestore/futurerestorelatest.zip

noncestatistics by tihmstar
http://api.tihmstar.net/builds/noncestatistics/noncestatistics-latest.zip

6s 固件(CPU n71ap)

iPhone_4.7_10.2_14C92_Restore.ipsw
iPhone_4.7_10.2.1_14D27_Restore.ipsw
iPhone_4.7_10.3_14E5269a_Restore.ipsw

准备工作

1.先升级到 10.3beta5 固件。
2.再解压 10.2.1 固件获取文件:

10.2.1 固件\BuildManifest.plist
10.2.1 固件\Firmware\Mav13-2.41.00.Release.bbfw
10.2.1 固件\Firmware\all_flash\all_flash.n71ap.production\sep-firmware.n71.RELEASE.im4p

3.把以上八个文件夹以及文件放到同个文件夹。

Windows 获取 ApNonce 碰撞值
先开始碰撞 1000个 ApNonce 值,数值多碰撞范围缩小,成功率越大。

C:\Users\Administrator\Desktop\go\noncestatistics-latest>noncestatistics_windows Apnonce.txt
Version: 4d63pd472lcc5087d4443df207bc4e99leb25a89 - 37
Identified device as n71ap, iPhone8,1 in normal mode... Trying to get in recovery...
INFO: device serial number is FFMT1S5GHFLR

No ECID was specified. Checking if any device is connected.
Getting nonce statistics for device with ECID: 665x16x95x80
000001  ApNonce=fdb85f49d2f173811775391b0500ac8a2ced5878
000002  ApNonce=105340eb91d52995c504696c4dc6a8cf87f73aa7
000003  ApNonce=85522b0ac2e4282db0e693691063e25041209858
...
001000  ApNonce=5adf4983c726fb78bbcfab383a91030044ea1014

User cancelled nonce collection
Waiting for device to reboot...
Resetting autoboot...
Done
# 耗时 55 分钟

检查碰撞值概率

C:\Users\Administrator\Desktop\go\noncestatistics-latest>noncestatistics_windows -s Apnonce.txt
Version: 4d63cd472ecc4087d4443df208bc5e99eeb25e89 - 37
nonce                                     abs. frequency    rel. frequency
===========================================================================
1557edb6155b5ccdc1f2c05e5c878c05bc5504d2            2             0.200%
30c118fbc532aa09c709c2c3bfd4bb7c4efb6717            2             0.200%
===========================================================================
nonce                                     abs. frequency    rel. frequency

There is a total of 1000 nonces

视频:
https://www.youtube.com/watch?v=pqgW75SeX74
https://www.youtube.com/watch?v=BIMx2Y13Ukc

帖子:
https://www.reddit.com/r/jailbreak/comments/5v2ox8/newsdowngrade_to_102_from_103_promess_i_just/
http://bbs.feng.com/read-htm-tid-11076569.html
http://bbs.feng.com/read-htm-tid-11076580.html

2017-03-11 Toss快到碗里来