You may recall the exciting news of the iOS 9.x re-restore bug for 32-bit devices, which iDB tested out and reported on during its infancy.

Provided you have blobs for the destination, it allows any 32-bit device to restore to any iOS 9.x firmware, from any starting firmware, without bundles, keys, or even a jailbreak.

As you can probably tell from that summary, this is a powerful bug, and may give a new lease of life to all 32-bit devices. In tandem with the Home Depot jailbreak for iOS 9.1-9.3.4, legacy devices may never be without a jailbreak again, able to forever return to iOS 9, without fear of updates or restores.

The good news is that the re-restore tool, dubbed iDeviceReRestore, is now complete and released to the public. Essentially a tweaked version of the time-honoured tool idevicerestore@alitek123@Thmitt, and @JonathanSeals have made the necessary additions to take advantage of the bug discovered by @alitek123, to bring us this finished product. Beta testing of the tool is credited to @Mirko_tweets@ee_csw and @DjSn0wfall, the latter two of which also helped me out with my own beta testing.

If you’d like to give the tool a test run, it can be found on the iDeviceReRestore website. It currently sits at version 1.0.1, resolving dependency issues that the initial release suffered from. There is currently no Windows edition of the tool, with Linux and macOS the two supported platforms, though I have seen success stories of using the tool via a VM.

For those of you who are interested in the tool’s properties and limitations, I’ll provide a brief overview here of what it can and can’t do.

Details

  • 32-bit devices only.
  • Destination firmware must be iOS 9.x.
  • Starting firmware can be any, iOS 6-10 have been tested.
  • Starting firmware does not require a jailbreak.
  • Process does not require keys, bundles, or nonces.
  • Process requires blobs for the destination firmware.
  • The blobs have specific requirements. They cannot be OTA blobs. They can be Erase or Update blobs, though not all of them will work. They must have been saved without a nonce. If they begin with the string MIIKkj, they are definitely fine. If they do not, they may also be fine, but will need checking to make sure.
  • The technique requires a signed baseband, like Prometheus. However, between the currently signed basebands for iOS 10 and the signed OTA basebands most, if not all, devices should be able to get a working baseband without issues.
  • iOS 9 -> iOS 9 restores can be done from Recovery mode, iOS ≠9 -> iOS 9 restores must be done from DFU.
  • The blobs must have a separate iBSS ticket to be used for DFU restores. If they don’t, they can only be used for iOS 9- iOS 9 restores.

When I last reported on this tool, it was thought it would be at least a couple of weeks in its completion, but thanks to the developers’ quick work, it’s out sooner than expected. If you’d like to check your blobs for compatibility with iDeviceReRestore, you can use this nonce-checker tool. Alternatively, open your blob up in a text editor, check it has an iBSS ticket, and check its starting string.

According to @DjSn0wfall, this technique can’t be patched by Apple, for the following reason. When in DFU mode, your device is waiting to verify a signed firmware component, which is iBSS. When a blob with an iBSS ticket is uploaded we are not technically evading any security mechanism, but it allows us to upload a signed iBEC next, and this has the necessary no-nonce bug. From there we can initiate a restore of the device, defeating any other software protections and verification checks. Interestingly, the bug is partially present in iOS 8 too, and up to iOS 10.2.1, but cannot be exploited.

I’ll be using this re-restore tool regularly going forward on my legacy devices, and I looking forward to hearing any success stories you have about it too.

  • Agneev

    I wish I retained my 5c!

    • Satyam Panchal

      same here 🙁 i deleted my 5c ios 9.2 blobs after 10.3 was released

      • Natalie

        The amount of times I’ve ben saved by my Time Machine backups is unreal. I’ve almost filled my 5TB HDD with backups but it’s better to be safe than sorry xD

      • Lipkiss

        5TB HDD full of backup.I already feel sorry for u.

      • Natalie

        In my defence, It has been running since 2010 when I first got my MacBook lol. I do let it delete old backups so it’s not toooooo bad xD

      • Never delete your blobs!

  • Mark S

    What a great program!

  • Arjan Vlek

    I, and I suppose 99% of all other people on earth too, don’t have blobs for iOS 9.x saved 🙁

    Any hope this still works some day or that a JB for 10.2.1+ (for which i do have blobs now) will come?

    • Joaquim Barbosa

      This should work indefinitely, but only to go to 9.x. As far as future jailbreaks go, we can’t really know unfortunately…

    • I’m in the 1% of people who actually saved them blobs 😉

  • Rahimo

    My iPad 3 was on 9.0.2 and jailbroken! but my little sister tampered with the passcode several times till it showed “iPad is disabled, Connect to iTunes” and then I’ve formatted it to 9.3.5 (non-jailbreakable). now, I’m very far from home and my iPad! I really want to give this tool a try! I don’t know if I have its blobs!! but I’m so excited and optimistic! haha

    • Joaquim Barbosa

      If you have blobs give it a try! I can do a tutorial if there’s enough interest, though it’s fairly easy to use.

      • mmht

        pls,explain me how to use it . i don’t know how to use linux and i just installed ubuntu right now.

      • Soccy Rivas

        Would love a tutorial!!! I’m on a Mac mini Please. Thank you

      • Joaquim Barbosa

        Tutorial will be posted today or tomorrow, watch out for it!

  • Rahimo

    @iDownloadBlog Please make a video tutorial for this tool! Plz

    • Joaquim Barbosa

      Tutorial will be posted today or tomorrow, keep an eye open!

      • Pew Pew

        Wheres the Video ? send me please 🙁

  • Sabhay Sardana

    I wish wise-versa would be there if you could go from iOS 9.x.x to iOS 6.x or iOS 10.x

    • Joaquim Barbosa

      You can sometimes go to iOS 6 with Odysseus, and you can go to iOS 10 by just updating in iTunes.

      • Sabhay Sardana

        For that you need to be jailbroken and you might be on 9.3.5

      • Joaquim Barbosa

        Use the re-restore bug to go to iOS 9.x, then jailbreak, then use Odysseus to go to iOS 6.

      • Joaquim Barbosa

        If you have blobs you could go from 9.3.5 to 9.x with re-restore, and then use Odysseus to go to 6.

  • HamptonWalley

    It is so useless if needs blobs. Seriously, who is saving it? I understand for Iphone restore needed, but Ipads without cellular also need?

  • Олег Петрович

    Is there similar re-restore bug for iOS 8.x as the same as existing for iOS 9.x? If not, how difficult is it to find?

    • Олег Петрович

      OK, 🙂 ” Interestingly, the bug is partially present in iOS 8 too, and up to iOS 10.2.1, but cannot be exploited.”

  • mmht

    pls,somebody explain me how to use it

    • Joaquim Barbosa

      A guide will be posted today or tomorrow, look for that!

  • Hernán

    I’m looking for this but sadly i don’t have blobs (i recently bought my used and wonderful Ipad)

  • Markus Le.

    Anyone looking for a usage explanation, contact me via Private Message on Twitter @Djsn0wfall

  • José Oniram Limaverde

    I never update my “ipad 03 Wifi” to IOS 9. More precisely, I’m on 8.1. Is it still possible to use iDeviceReRestore ? I’am asking because probably I will not able to get the blobs, am I correct?

    • Joaquim Barbosa

      You’re correct, you could get your 8.1 blobs off of the device (tricky but possible), and you could save blobs for iOS 9.3.5 because that is still signed for iPad 3. But you can’t save blobs for any other unsigned iOS 9 versions now unfortunately. Are you not happy with your jailbreak on iOS 8.1?

      • José Oniram Limaverde

        Yeah, I’m happy, but some noising bugs has been appeared lately on my ipad 03, for example, boot loops after restarting the device with low battery. I was think to restore the device, but still remaining on IOS 8.1 or another with an available jailbreak tool ^^. Thank you for promptly reply. =)

      • Joaquim Barbosa

        You can try Cydia Eraser. It will wipe your device and keep it on 8.1.

        http://cydia.saurik.com/package/com.saurik.impactor/

        Only use it if your device is too annoying, it is only to be used as a last resort. Do not use it if you manually deleted language packs or keyboards from your device. Leave your device plugged in all the time (it can take a day or more). Back up the device first, and remove all useless tweaks, apps and music from it to speed up the process. Turn off iCloud and passcode.

        If it works, you will have a completely restored iPad on iOS 8.1. Good luck!

      • José Oniram Limaverde

        Thank you very much for the support!! =)

  • Jay

    How do I do this any1 help me plz ty jay uk

    • Joaquim Barbosa

      There’s already a guide for this on the site that I’ve written. Please search the site before asking, thanks!