This is Part 1 of a two-part guide on how to use futurerestore.

Before attempting this guide, everyone should read the introductory article, Guide to futurerestore: Introduction. It will explain whether these guides apply to you, and if they do, which ones you should follow, as well as making sure that you fulfil the requirements for them to work.

If you currently have a jailbreak, and have blobs saved with a generator and/or Apnonce, you must follow Parts 1 & 2 of the guide. This will apply to nearly all users.

If you currently have no jailbreak, and you want to move to a different firmware with futurerestore’s nonce collision method,¬†skip Part 1 and do¬†only¬†Part 2 of the guide. Please note, this method only applies to some older devices, and likely does not apply to you.

Before you begin following the instructions, read the entire guide (Parts 1 & 2) through once. This will save time and prevent errors. Make sure you have all the required files ready before you begin. These are listed in the introductory article. Be prepared to continue directly from Part 1 to Part 2 of the guide. Have both open, and leave enough time to follow them one after each other.

This guide uses an upgrade from iOS 9.3.3 to iOS 10.2 as an example, but it can be used to move between any firmwares in principle, if and only if you meet the requirements. If you are using this guide to move between newer firmwares, simply replace any mention of iOS 10.2 with your destination firmware, and mentions of iOS 10.2.1 with a currently signed firmware whose SEP and baseband are compatible with your destination firmware. Examples of other futurerestores which are possible at the time of writing include, but are in no way limited to, iOS 13.5 > 14.3, iPadOS 13.2 > 14.3, iOS 12.4 > 14.3, iOS 11.4.1 > 14.2, and tvOS 13.4.8 > 14.4.

Instructions

0)¬†Ensure your device has a jailbreak with tfp0, and that it is active. If on iOS 9.3.3, that means re-jailbreaking with Luca’s JailbreakMe website. Users on older firmwares must check that their jailbreak has tfp0, and possibly install a patch themselves if it does not.

1) Create a folder on your Desktop and name it nonceenabler.

2) Download the nonceEnabler tool, and place it into the folder on your desktop.

3) Copy the .shsh2 blob for the firmware you want to move to, and paste it into the folder on your desktop too.

4) Note down the generator from your .shsh2 blob.

a) If your blob was saved without a specific nonce, the generator can be found inside your blob file:

To get it, rename your blob from .shsh2 to .plist. Then open your .plist file in a text/plist editor of your choice (I use TextEdit or TextWrangler). Scroll to the very bottom of the file and find the generator field. Copy the generator value, and paste it somewhere safe for later. Afterwards, rename your .plist file back to .shsh2.

If your blob has no generator field in it, you may have saved it with a specific nonce, so try Step 4) b).

b) If your blob was saved with one of the five specific nonces which tihmstar provided on his blog:

In this case, tihmstar has provided the generators in the description section of his video guide, where you can find them.

5) Open the Terminal application from /Applications/Utilities, or via Spotlight.

6) Connect your device to your computer.

7) SSH into your device by typing:

ssh [email protected]_DEVICE_IP_ADDRESS_HERE

Replace YOUR_DEVICE_IP_ADDRESS_HERE with your iOS device’s IP address.

If you do not know how to SSH into your device, or do not know its IP address, follow my full guide on how to connect to your device using SSH.

8)¬†Enter your device’s root password if prompted. By default, the password is¬†alpine, but if you followed my SSH guide linked above you¬†should have changed it, and so should enter your new password instead.

9) Once your device is connected via SSH, leave the Terminal window with SSH open and running, and minimise it.

10) Open a second Terminal window.

11) At the Terminal prompt, type cd, then drag the nonceenabler folder from your desktop onto the Terminal window, and hit Enter.

12) Now type:

scp nonceEnabler [email protected]_DEVICE_IP_ADDRESS_HERE:

Replace YOUR_DEVICE_IP_ADDRESS_HERE¬†with the IP address of your device, which you used to connect to it in Step 6. Please remember the colon at the end of your device’s IP address.

13) Terminal should show the nonceEnabler file being transferred to the device.

14)¬†Enter your device’s root password if prompted.¬†By default, the password is¬†alpine, but if you followed the¬†guide linked in Step 6¬†you¬†should have changed it, and so should enter your new password instead.

15) Now return to your open SSH Terminal window, which you minimised in Step 8. The command prompt should read root#.

16) At the prompt enter the following command, to run nonceEnabler:

./nonceEnabler

17)¬†You should now see output as nonceEnabler attempts to patch the kernel. If it does not complete quickly, with only one line of “patching bytes at…”, then it likely has not worked. If many lines of patching appear, try rebooting your device and following Steps 4-15 again until it works. (Remember to re-jailbreak after rebooting if you are on a semi-untethered jailbreak, and use¬†a method with tfp0 enabled).

18)¬†Once the output of¬†Step 16¬†reads “done patching” without having printed too many lines of bytes, and without crashing, proceed to¬†Step 19.

19) At the prompt, type:

nvram com.apple.System.boot-nonce=YOUR_GENERATOR

Replace YOUR_GENERATOR with the generator from your own .shsh2 file, which you noted down in Step 4.

20) This should set the generator in nvram so that when we reboot, the device should generate the corresponding nonce. We can then use our saved blob, because the nonce saved in it will match the nonce on the device. To check that the generator is saved correctly in nvram, type the following command at the Terminal prompt:

nvram -p

Terminal will print out all the boot commands for your device. Make sure that you can see com.apple.System.boot-nonce in the list, and that it has your generator value set.

21) Now type the following command in Terminal:

nvram auto-boot=false

You can check this value is set correctly the same way we did in the previous step, with nvram -p. Look for the auto-boot flag to be listed, with the value false.

Do NOT close the Terminal windows, restart your iOS device, or disconnect your iOS device after Step 21!

Continue straight on to Part 2 of the guide and use futurerestore!

If you don’t want to use futurerestore right now, do NOT¬†stop here! Follow the section below to properly cancel¬†the procedure.

If you are not about to use futurerestore now, do this!

1) At the Terminal prompt, type:

nvram auto-boot=true

2) Type:

nvram -p

Make sure the auto-boot flag is set back to true, otherwise your device will not reboot back to iOS, it will keep booting back to recovery.

3) Type:

reboot

This will reboot your device back to iOS as normal. You will have to go through this guide again in future if you wish to use futurerestore with nonceEnabler.

If you’re¬†currently not jailbroken¬†and you want to move to a different firmware with futurerestore‘s nonce collision method,¬†skip Part 1¬†and go directly to¬†Part 2 of the guide.