If you’ve ever wanted to downgrade your legacy devices but didn’t have the tools for the job, then this one may be for you. Tihmstar has released an addition to his well-known futurerestore tool (sometimes called Prometheus), entitled libipatcher. What does libipatcher do? In a nutshell, it will allow you to downgrade any jailbroken 32-bit device to any firmware for which you have blobs.

Until now, futurerestore has predominantly been of use to 64-bit devices, which it allows to restore to unsigned firmwares, provided the user has .shsh2 blobs saved. It was subsequently updated to take advantage of the iOS 9 re-restore bug, bringing some level of 32-bit support. The addition of libipatcher completes the 32-bit game, bringing functionality on par with that of futurerestore on 64-bit devices.

This new functionality is similar to that of the Odysseus downgrade tool, which some of you may have heard of. That also allowed you to downgrade 32-bit devices with blobs, but with one major difference: it required a bundle to complete the restore. The bundles were device+firmware specific, so many were required, and not all of them were ever made.

With libipatcher this requirement is removed, effectively rendering Odysseus obsolete. Libipatcher requires no bundles and makes all adjustments on the fly, meaning the user only needs their destination firmware’s blobs to use the tool.

Here’s a brief run-down of everything you need to know about libipatcher.

What is it?

An additional module for tihmstar’s futurerestore, which allows moving to unsigned firmware for 32-bit devices.

What do I need?

  • A jailbreak.
  • futurerestore.
  • libipatcher.
  • A 32-bit device.
  • .shsh blobs for your destination firmware.
  • The IPSW for the destination firmware.
  • Public keys must be available for your device (most are, but if not, you’re out of luck until someone dumps them).

How do I use it?

In a very similar manner to futurerestore, though you’ll have to compile a new version of both libipatcher and futurerestore yourself for the time being, as release versions are not yet available. Compiling them is by far the hardest part, as using them is straightforward. You may want to wait until fully holistic versions are available to save yourself the headache, though I will be putting together a guide on how to assemble it if you’re feeling brave.

How is it different from Odysseus and other 32-bit downgrade tools?

  • It does not require bundles.
  • It does not preserve the original baseband, instead using either the currently signed baseband, or a previous baseband which is still signed for legacy purposes (such as iOS 8.4.1).

How is it similar?

  • Both upgrade/downgrade/restore to unsigned firmwares.
  • Both require blobs.
  • Both require keys available.

Who can use it?

Anyone with blobs saved for their destination firmware, and a device with a jailbreak. If you don’t have a jailbreak, check if you can use the iOS 9 re-restore bug to first move to iOS 9 without needing a jailbreak, then jailbreak and use futurerestore+libipatcher.

As I mentioned on Twitter, I have already given this new utility a go, and it worked perfectly. Having used Odysseus in the past I found this tool a little simpler, because I didn’t have to hunt down a bundle for my device, and because it works the same as futurerestore. I restored an iPad 2 (WiFi) from iOS 9.3.4 to iOS 8.3 when Odysseus couldn’t help me, as there was no bundle for that device+firmware combination.

To see futurerestore+libipatcher in action, check out tihmstar’s release video, which demonstrates its usage. If you’re comfortable building from source code, you can find and make both futurerestore and libipatcher on GitHub.

I’ll post a guide on how to use the tool when I have worked out a foolproof way to build all the dependencies which is accessible for the average user, or once tihmstar has released a pre-built version with them included. Until then, feel free to have a go yourself and let me know your experiences in the comments.

  • dkas2_oa1

    So far still no luck for iPad2,4, iPad minis, and iPod touch 5:(

  • Wait for iPad mini 🙁

  • Ben

    What about an iPhone 4 with no shsh blobs saved for ios 6, I want to downgrade from ios 7 to ios 6.

  • Pavel Kalyugin

    I wonder is it possible to use firstly CoolBooter (side loading ios 6.1.3 and saving shsh blobs for it) with further fully downgrading to 6.1.3 afterwards?

    • Joaquim Barbosa

      I don’t think it would be possible, but try asking the dev on Twitter.

      • Pavel Kalyugin

        Yea, I’ ll do this. Anyway, just curious whether it’s gonna work.

      • Pavel Kalyugin

        No, that’s not possible anyway, because CoolBooter simply skips shsh blobs phase as I understand.

    • Mecatrônicos Salê

      You can only get shsh blobs from currently signed firmwares. If you own an iphone 4S or ipad2, 6.1.3 OTA is currently signed and you can go back to this specific firmware with OdysseusOTA tool

      • Pavel Kalyugin

        Well, currently I have iPad 4 ‘dual booted (ios 9 and 6) without any shsh blobs saved 🙁

        Anyway, I’ll try to reach dev via his twitter.

  • Mecatrônicos Salê

    I have an iPhone 4S and I’m extremely anxious that this tool is being released … But I have a question … I’ve been saving some signatures shsh blobs (not shsh2). I have watched the video and noticed that it is necessary to have the shsh2 file, the baseband file (extracted from ipsw) and BuildManifest file … Does it work with a simple shsh file? Can I complete the downgrade on a Windows? I have MacOS 10.12 in a VM but the USB does not work very well …. 🙁 (

    • Joaquim Barbosa

      You don’t need .shsh2 as far as I know, .shsh is fine. The baseband file and build manifest are also not needed unless using a specific baseband. It is possible to just use the currently signed baseband which removes this part of the process and makes it easier. You will however need either Linux or Mac (or VM) to do this, as there are no Windows versions of tihmstar’s tools. Thanks for reading!

      • Mecatrônicos Salê

        Thanks for the reply! Currently I’m on iOS 9.1 with homedepot and I intend to go back to 8.4. So, are you saying that I can only go back using my 8.4 shsh? Isn’t it necessary to have the 8.4 baseband and the BuildManifest file? Thanks!

      • Joaquim Barbosa

        Yes, I don’t think you need the 8.4 baseband or manifest at all, libipatcher will use the current baseband (9.3.5), which is still compatible. Using the current baseband needs no manifests or other files. You would simply use libipatcher with the –current-baseband option. However, you might want to wait to try until the tools have been compiled. At present you have to build them yourself and it is tricky…

      • Mecatrônicos Salê

        Thanks again… Yes, I will wait the tools to be compiled 😉 Please let us know and, if possible, post a video tutorial when it’s ready! Only one more question… If I do not need the baseband and buildmanifest to restore my iphone 4S to version 8.4, but I need only my shsh file that I already have saved, how should I write the last command of the video in the link on this article? Should I delete everything in parentheses in the following command???

        futurerestore -p ( BuldManifest.plist -b Trek-5.5.00.Release.bbfw ) –use-pwndfu -t ECID-iPhone4,1-8.4.shsh ~/ipsw/iPhone4,1_8.4_12H143_Restore.ipsw

      • Joaquim Barbosa

        futurerestore -t SHSH.shsh –latest-baseband –use-pwndfu IPSW.ipsw. You will need to have put the device into kDFU mode first with tihmstar’s app from Cydia. My guide on the topic will be up in a few days time, so watch out for that!

      • Mecatrônicos Salê

        Thank you!

  • Blank Dayr

    My iphone 5 in 8.4 jailbroken,, i want upgrade to 9.3, how to get 9.3 .shsh blobs?