We recently reported how some of the .shsh2 blobs saved with previous versions of tihmstar’s TSSChecker were faulty. One problem affected all iPhone 7 and iPhone 7 Plus blobs, rendering them useless. This issue has now been fixed going forward, though past blobs are invalid.

The other problem was more complex and affected only certain models of certain devices. It is also fixed for blobs saved from now on, but given these occurrences, it is important to be able to check whether the blobs you saved in the past are in fact valid and fit for use with Prometheus.

In this article, we’ll go through how to use another tool from tihmstar’s Prometheus suite, img4tool, to verify that your .shsh2 files are good. This method will clarify whether you are affected by the second problem mentioned above, but will also work in general, when checking the validity of your blobs in future.

Requirements

For this, you will need:

  • Your blobs saved with TSSChecker/TSSSaver, in .shsh2 format.
  • tihmstar’s img4tool, available for download in the description of this YouTube video.
  • The IPSW file for each device/iOS version combination that you want to verify your blobs for. Download the exact IPSW that matches the blob you want to verify. This means you have to download a different IPSW for each iOS version, and each different device you want to verify.
    This takes a while, so I recommend only verifying the iOS 10.1.1 (14B150) and iOS 10.2 blobs for your devices, to save time. These are the most important blobs. If you do not have (14B150), do (14B100) instead.

The tutorial will describe the process on a Mac, and uses the Terminal application, but there are Windows and Linux versions available too, for which the process is much the same. I will be verifying iOS 10.1.1 (14B150) and iOS 10.2 blobs for two iPhone 5s.

Before we begin working with img4tool there is a step we need to perform on our iOS devices, the ones whose blobs we want to verify.

iOS instructions

1) Open the App Store on your device, and search for “BMSSM”. Install the app which appears: “Battery Memory System Status Monitor”.

2) Open the downloaded app, and navigate to the “System” tab at the top.

3) Look for the entry on this page entitled “Device – Model”. It will be something like “N53AP”. Make a note of this value and which device you got it from.

4) Repeat this process for all your other devices.

img4tool instructions

1) Download the IPSW for the blobs you want to verify. For example, if you want to check your iOS 10.1.1 (14B150) iPhone 5s (GSM) blobs are good, download the iOS 10.1.1 (14B150) iPhone 5s (GSM) IPSW. Make sure you download the correct IPSW for the blobs, or img4tool will verify incorrectly. Remember there are two versions of iOS 10.1.1, and that some devices (e.g. iPhone 5s) have different models with different IPSWs.

2) Copy the blobs you want to verify and paste them into a folder on your Desktop. Call the folder TSS.

3) Take the img4tool_macos file from the img4tool folder (downloaded from the YouTube video description in the “Requirements” section), and place that into the TSS folder.

4) Place your downloaded IPSWs into the TSS folder too.

5) For every IPSW in the folder, click to rename, and change the file extension from .ipsw to .zip. Select “Use .zip” in the dialog box which appears.

6) Double click all the renamed .zips to unzip them. They will appear as folders once complete.

7) Launch Terminal via Spotlight, or from /Applications/Utilities.

8) At the Terminal prompt, type “cd”, followed by a space, and then drag your TSS folder onto the Terminal window.

9) Hit the “Enter” key to enter the command. Terminal will now be directed to your TSS folder.

10) Enter the following command in Terminal, and press “Enter”:

sudo chmod +x img4tool_macos

Enter your administrator password if requested.

11) We will now enter the following command into Terminal:

./img4tool_macos -v BuildManifest.plist -s YOUR_SAVED_BLOB.shsh2

However, we need to replace the phrase “BuildManifest.plist” with one from our unzipped IPSW folders, and “YOUR_SAVED_BLOB.shsh2”, with our blob. The easiest way to do this is to drag the files onto the Terminal window at the appropriate part of the command.

Here is an example for iOS 10.1.1 (14B150) on an iPhone 5s. First, in Terminal, type “./img4tool_macos -v”, followed by a space. Then, navigate to the IPSW folder for iOS 10.1.1 (14B150) iPhone 5s. You must have the correct IPSW folder for this step, do not use one of the other IPSW folders by mistake. Inside the folder is the correct “BuildManifest.plist”. Drag this file into the Terminal window after “./img4tool_macos -v” and it fills in the file path for you.

Then type “-s” followed by a space, and drag your .shsh2 blob which you want to verify, onto the Terminal window. Terminal will fill in the file path for you. You must have the .shsh2 blob corresponding to the BuildManifest.plist you just selected. Do not use one of the other blobs by mistake.

12) Now that the command is complete, hit “Enter” to run it. Terminal will output the result. The interesting part is at the bottom; you can see an example below:

As you can see from the image, this blob is valid, meaning it has all the correct hashes inside it, and the IPSW version (10.1.1) matches the iOS version that the blob was saved for.

However, there is one more thing we need to check to make sure the blob is REALLY correct. Remember the Device Model we noted from BMSSM earlier?

Look in the Terminal output for the line called “DeviceClass” (see the above image for an example). It will be something like “N53AP”. Now check it against the value you got from BMSSM on the corresponding iOS device (Step 3 of the iOS Instructions section). If the values are not the same, the blob is not valid, even if img4tool says “file is valid” at the bottom. This is because the blob is technically valid (has all the necessary components inside), but has the wrong BuildIdentity. Because img4tool doesn’t know what device you really have, it simply checks if the file has all the pieces it needs, and if it does, it says it is valid. It is possible therefore to have a “correct” blob, saved for the “wrong” device, which is therefore useless. So always check that:

  • img4tool says the blob is valid.
  • The “DeviceClass” value from img4tool’s Terminal output is the same as the “Device Model” field for that same iOS device in BMSSM.

If both are true, then you’re all good.

13) Repeat the command for your other devices, with a new matching set of BuildManifest.plist and .shsh2 blob each time. Always make sure you’re checking the right BMSSM “Device Model” each time too.

Examples

In this image, img4tool says that my blob for iOS 10.2, for an iPhone 5s I have, is valid. But it also says that the blob is valid for Model N53AP only. I checked BMSSM on that iPhone 5s, and good news! It says N53AP too, so this particular blob is really valid.

Now look at this example:

Here, img4tool reports that my blob for iOS 10.1.1 (14B150) for a different iPhone 5s, is also valid. And again it says that it is valid for Model N53AP only. However, when I check BMSSM on this iPhone 5s, I see that it is in fact Model N51AP, not N53AP. In this case, even though img4tool says that the blob is internally fine, I cannot use it as it has been saved with the wrong BuildIdentity, and so is invalid. This is the error which TSSChecker previously had, and the one you must be most careful to check for in your old blobs.

And finally:

This is what happens when you try to verify an iOS 10.2 blob against the wrong BuildManifest.plist (I accidentally selected one from iOS 10.1.1 instead). Here, img4tool immediately reports that the blob is invalid, as you have asked it if a 10.2 blob is valid for 10.1.1, which it obviously isn’t. Be careful to select identical iOS version pairs of BuildManifest.plist and .shsh2 file to avoid this error.

As you can see, the process is fairly in-depth, but should be a fool-proof way to check your old blobs without getting any false errors, which might make you think they’re valid when they’re not. Because downloading IPSWs takes time it may only be worth doing this on important blobs such as iOS 10.1.1 and iOS 10.2.

And remember, newer versions of TSSChecker/TSSSaver do not have this problem anymore, so for iOS 10.2 you may want to simply re-save your blobs, avoiding this verification process. This guide will be most useful for verifying blobs saved on now-unsigned firmwares, which cannot be re-saved.

As a side note, I spoke to the inestimable 1Conan, the creator of TSSSaver, whilst researching for this article. He confirmed what I suspected, that his Blobs Checker site does not yet check for this issue, and so may report your blobs as valid when they’re not, exactly as img4tool does. Without checking against your Device Model using this guide, you cannot tell for sure. 

However, he also said he is aware of the issue and is working with his customary speed on updating the Blobs Checker site, so that it can identify this issue in future.

Look out for that soon!

Update: 1Conan’s Blobs Checker Site is now updated to check the DeviceClass of the blobs against your selected device. This tool makes it easy to check your blobs, and has the advantage of not requiring you to download IPSWs!

Are your blobs good auld blobs or rotten to the core? Need any clarifications? Let me know, below.

  • Merman123

    You guys hired the right guy for the job. Nice work Joaquim.

    • Joaquim Barbosa

      Thanks! Hope you enjoyed the article!

  • Natalie

    So, if the Terminal windows states:
    [IMG4TOOL] File is valid!

    I can downgrade my iPhone 7?

    • Joaquim Barbosa

      I mention in the first paragraph of the article that unfortunately most iP7(+) blobs saved with old versions of the saver are invalid. Even if img4tool reports that they are valid, they might not be.

      Did you check BMSSM for the Device Model, and compare it to “DeviceClass” in the Terminal window? Are they the same?

      Cheers Natalie

      • Natalie
      • Joaquim Barbosa

        That’s as good as you can hope for then. However, the blobs might still not be good, it depends which version of TSSChecker/TSS Saver you saved them with, because there was a problem before where ALL iP7(+) blobs were no good, even when saved with correct Model.

        I’d re-save 10.2 just to be safe if you haven’t already. Thanks!

      • Natalie

        I’ve done that this week anyway. Would attempting to downgrade to 10.1.1 cause any blocking? Or could I just home+vol to enter DFU or something?

      • Joaquim Barbosa

        Downgrade an iP7 from 10.2 to 10.1.1, is that your situation? Do you have valid 10.1.1 blobs, I don’t think you do because TSSChecker was broken until after 10.1.1 was unsigned…

        If yes, you need to know two things.

        1) you must wait for an update to the futurerestore tool to downgrade iP7(+)

        2) After that, if you use the tool to downgrade, your Touch ID will not work on 10.1.1.

        Both of them are probably being worked on, but we don’t know for sure if/when they’ll be fixed completely.

        So short answer, no. Long answer, in future maybe yes, but probably no.

        If you have a different device let me know as it might be easier. Thanks!

  • Favna

    So weird.. I keep getting the latter error of “[IMG4TOOL] file is invalid!” but I’m 1000% sure I downloaded iPhone9,4 ipsw files and that I’m comparing the right blobs with it. https://uploads.disquscdn.com/images/5e47d5dbe986b2e4fb5c44ba41d65f27b4f5b1a7a8ffb3236488899239be24df.png

    • Natalie

      That’s what I’m worried about too

    • Joaquim Barbosa

      The only thing you may have done wrong is downloaded the IPSW for the wrong iP7+ model. What Device Class was reported by BMSSM for you?

      • Favna

        It reports D111AP and I downloaded IPSW for iP7+ GSM since that’s iPhone9,4 which iTunes reports as my model.

        Admittedly though this does appear weird to me because I always thought GSM phones were for carrier locked phones, which this is not. I bought it as unlocked from Apple Netherlands website.

      • Joaquim Barbosa

        I have a feeling all iP7(+) blobs saved with old versions of TSSChecker/TSS Saver were invalid, for a different reason to the BuildIdentity thing. So you’re right, you downloaded the correct IPSW for your Model after all, but the blobs are invalid because of a separate problem. (I mention the problem in the intro to the article). Sorry about your blobs being no good, I guess just re-save 10.2 blobs now…

    • Diego Milano

      How did you even manage to decompress the IPSW file anyway? I can’t even get to that screen, cause I can’t get the .plist file. 🙁

      • Andre Bongon

        Rename to zip

      • Diego Milano

        Thanks, dude!

      • Joaquim Barbosa

        Hi Diego, as Andre/article says, rename to .zip, then double-click to unzip. Let me know how the verifying goes. Cheers.

      • Diego Milano

        Damn, duh! I should have thought of that. I feel like an “end user.”

      • Joaquim Barbosa

        No problem sport!

      • Diego Milano

        I’m happy to say my blobs have been approved by the tool. Hopefully the next release of it with its corresponding fixes may still give consistent results— fingers crossed!

    • Dexter SherloConan

      I don’t think img4tool right now might be working for iPhone 7/7 Plus. Same thing with my iPhone 7 Plus.

  • Dexter SherloConan

    Quick question: Is the shsh2 file, which you wanna check, within apnonce or not? THX https://uploads.disquscdn.com/images/fb2863ba902062943fceeb29c62f317f1d591907c7acf980dd076097a3e0423f.png

    • Dexter SherloConan

      Pic shows the noapnonce shsh2 file of iPhone 7 Plus, iOS 10.2, which I saved via TSSChecker 1.0.6.1, is invalid.

      • Joaquim Barbosa

        You can check any .shsh2 file you like, with nonce or without nonce. Are you making sure you are using the iOS 10.2 iPhone 7 Plus IPSW for this, with the BuildManifest.plist from inside that? If you are, then it looks like your blobs are invalid, sorry. Check once more perhaps…

      • Joaquim Barbosa

        You can re-save your blobs as iOS 10.2 is still signed. Make sure to check them again afterwards though to make sure they work!

    • Dexter SherloConan

      Update: My iPhone 7 Plus, iOS 10.2 shsh2 files saved by TSSChecker v170 are also invalid. Life is too hard.

  • Dexter SherloConan

    When I use TSSChecker v170 (latest to date) in terminal as ./tsschecker_macos -d iPhone9,2 -e “ECID” -i 10.2 -s –apnonce “NONCE”, it returns “iOS 10.2 for device iPhone9,2 IS NOT being signed!”. How comes? It’s an iPhone 7 Plus.

    • Dexter SherloConan

      It seems that both TSSChecker v1.0.6.1 and TSSSaver took iPhone 6s, N71AP wrongly as N61AP (which is iPhone 6).

      • Dexter SherloConan

        When it comes to iPhone 5 (5,2), A1429, N42AP, and iPhone 5c (5,3), A1532, N48AP, img4tool returns “[Error] reading file failed”.

      • Joaquim Barbosa

        Haven’t tried with my iP5 blobs yet. What does the updated TSS Saver Blob Checker site report for those iP5 blobs?

      • Dexter SherloConan

        The updated TSSSaver Blob Checker says “Device Not Supported by img4tool!”.

      • Joaquim Barbosa

        Well, it is true that Prometheus does not support 32-bit devices, but I did not know that TSS Checker could not even save blobs for them. I thought you could save blobs with TSS Checker on 32-bit devices, but just not use them with Prometheus. Not sure what’s going on there, sorry…

      • Andre Bongon

        This is an issue with the old tsschecker. Update to the one linked on my other reply.

        TSS Saver is also updated to support the latest changes in tsschecker.

        Try resubmitting your ECID on TSS Saver to have it fixed.

      • Joaquim Barbosa

        This is good info, I had a feeling that it would always be specific devices that would have a problem (ones who are not the first BuildIdentity in the IPSW they share with other devices). Seems iP6, iP5s 6,2, SE are good, iP6s is bad. I’m not certain, but it seems that way from my own tests and others’ info (inc. yours). Cheers!

    • Dexter SherloConan

      Plus, it seems that both TSSChecker v1.0.6.1 and TSSSaver took iPhone 5s (6,1), N51AP wrongly as N53AP (which is iPhone 5s (6,2)).

      • Timonline

        yeah I had a similar thing with 6S and 6S+

      • Joaquim Barbosa

        I had the same exact problem with iP5s! N53AP must be the first BuildIdentity in the iP5s IPSW file then. So probably anyone with a 6,1 is in trouble, everyone with a 6,2 is fine. Not 100% sure, but seems likely.

    • Joaquim Barbosa

      Did you fix this? Not sure why it would report it as unsigned, I haven’t seen that error before…

  • Mark S

    Great job! You write tutorials as well as I do. Love the attention to detail! I used the 1Conan site and my blobs are valid.

    • Joaquim Barbosa

      Thanks Mark! Did you check them since its update yesterday? Before that it didn’t check for DeviceClass as this article advises to, so it might have reported valid when in fact they were invalid. The site has now been updated though so checking from now on will be solid.

  • Puba Cajhen

    I am little confused. Currently I am jailed on 9.3.5 iPadMini2, should I upgrade to 10.2 now, or wait till stable jailbreak is released? What if in meantime signing window closes?

    • Joaquim Barbosa

      This article is not particularly to do with this, however, I would advise you to wait to update. Until about 1 week after 10.2.1 is released, 10.2 will still be signed. So it is better to wait and see if a jailbreak is released in that time first. If it hasn’t, you’ll be safe on a lower firmware and might get a jailbreak for that. If it has, you can upgrade. To save time you can download the iOS 10.2 IPSW for your device now, and then wait to install it when a jailbreak is released. This will save time downloading it later.

      • Puba Cajhen

        Thank you very much, Joaquim, cheers.

  • Timonline

    Great tutorial, I have an iPhone 6S+ and the blobs I saved about 2 weeks ago on iOS 10.2 were invalid.

    It said the file was valid but the DeviceClass was n56ap while the BMSSM showed n66map which is weird because n56ap points to an iPhone 6+ not 6S+.

    When I went to the 1conan TSS Saver website, a new feature was added to support “board configuration” where I specified n66map and the resulting blob was valid on the two checks.

    Once again, great tutorial and good flow of instructions. Thanks

    • Andre Bongon

      This is an issue with tsschecker before

    • Joaquim Barbosa

      Glad you found it useful! Yep, those old blobs had the problem I explain in the article, with the wrong BuildIdentity being saved. Unlucky. However, the ones saved more recently have been fixed up, as you found with the updated TSS Saver site. At least you got good 10.2 blobs in the end!

      • Timonline

        Yeah, I’m glad I saw this post when I did. My iPhone 5S and iPad Air were already correct as they don’t run into the issue you highlighted

      • Joaquim Barbosa

        iP5s 6,2?

      • Timonline

        Yes iPhone 6,2

      • Joaquim Barbosa

        Cheers. Seems all of them are affected by this issue.

  • Andre Bongon

    When did you save those blobs? If it’s back in december, it will most likely be invalid.

    I updated my site to support the recent update for tsschecker last week so iPhone 7 should be working as of now.

  • Mio Kasic

    I keep getting a different “DeviceClass” value from img4tool’s Terminal output compared to the “Device Model” field for that same iOS device in BMSSM.
    Is there something I can do?

    • Joaquim Barbosa

      Sadly, no, there is nothing you can do. It means your blobs are invalid. Sorry about that. Which device do you have?

      I would save your 10.2 blobs again, so they will at least be valid, nothing you can do about <10.2 though…

      • Mio Kasic

        Thank you for your reply!
        I have tried both, 10.1.1 and 10.2 and I get the same error. My DeviceClass is j72ap while in output for both versions I get j71ap.
        It is the original iPad Air. Is my ECID 1B23C456789 in Hex mode?
        Regards

      • Joaquim Barbosa

        Yes, you’re doing everything right, it just means that your blobs are not good I’m afraid. All you can do now is save your 10.2 blobs again. The old ones you have are no good.

  • Dexter SherloConan

    The updated TSSSaver only saves noapnonce shsh2 files, and iPhone 7/7 Plus, iOS 10.2 shsh2 files are still invalid in img4tool.

  • Chris Mn

    I saved my 10.1.1 blobs back when they were signed but tsssaver and tsschecker both saved the wrong device class >:( talked to 1Conan and theres nothing he can do. RIP Prometheus for 10.1.1