This guide will help you downgrade to 15.x on an A12 with SHSH blobs.
This process relies on a small "loophole" in the way iOS activation works. Since 2022 it has long been documented that the SEP from iOS 16.x and newer have issues activating on iOS 14 and 15, making restoring to those versions largely impossible without playing with activation tickets (not to mention, it would not have been possible to get the tickets on versions newer than 17.0 due to the lack of a jailbreak, and restoring them would not have been possible because there is currently no usbliter8 based jailbreak). However, for some unknown (and frankly cursed) reason, iOS 14.0 Beta 4 seems to activate just fine with 18.x and 26.x SEP versions. We can take advantage of this and use it to update to 15.x since it does not need to go through the activation process again.
Note: This guide should work with 14.x blobs, but it has not been tested currently. iOS 12 and 13 will not work since they were already broken with iOS 15.x SEP.
Additionally, while I don't see why it wouldn't work, I have not tested this on an A13 device
- An A12 device
- As I said earlier, A13 could work, but is untested
- A12X and A12Z (1st and 2nd gen 11" iPad Pro, 3rd and 4th gen 12.9" iPad Pro) will not work.
- Decent command line knowledge
- macOS or Linux. Note: I have only tested this on macOS, Linux should work but YMMV. Windows will never be supported by this guide
- SHSH blobs for iOS 15.x (obviously). I did the downgrade with 15.6 but it should work with any version from 15.0-15.7.2 -Note: The blob needs to work for updates. If the blob was saved with blobsaver it should work.
- surrealra1n
- An RP2350 board with the usbliter8 uf2 firmware installed. This guide cannot be done without access to this hardware
- Python (should be included with macOS)
The rest of the requirements should be installed by surrealra1n:
- Futurerestore
- img4tool
If you haven't done so already, run:
git clone https://github.com/pwnderblu/surrealra1n && cd surrealra1n && ./surrealra1n.sh
This command will go through the installation of the basic requirements for this tutorial.
First of all, you will need to download the IPSW for iOS 14.0 Beta 4 for your device from ipsw.dev
Second, you will need to download the IPSW for the version you're downloading from ipsw.me
Third, you will also need to download the IPSW for the latest iOS version for your device. On the date of writing, this will be:
- iOS 18.7.9 on A12 iPhones (iPhone Xs, iPhone Xr)
- iOS 26.6 on A12 iPads (8th gen, Air 3, mini 5) and all A13 devices (iPhone 11, iPhone 11 Pro, iPhone SE 2020, iPad 9th gen)
- In the case of A13 devices, iOS 27 will be out by the Fall of 2026.
Lastly, you will need to download this program and this program from Spironolactone
It may seem counter-intuitive, but you will need to downgrade to this version using surrealra1n.
- Navigate to the surrealra1n directory
- Run
surrealra1n.sh - Select downgrade options
- Choose `Restore (tethered)
- Select the 14.0b4 IPSW as your Target
- Select the latest IPSW as the Base
- Start the restore and follow the instructions
The script will generate the files needed to restore and will start it. Once it is done restoring and on the Recovery Mode screen:
- Start
surrealra1n.sh - Go to downgrade options
- Select
Just Boot
Now you should let your device get to the Hello screen. Once there, you just need to set the device up normally and get to the Home Screen. This is pretty much it for step 2.
Heads up: I'm going to be working with a Wi-Fi iPad Air 3 (j217ap) in this section. You will need to change some file paths to accomodate for your device.
On ipsw.me, find the link for 14.0 for your device. One way to do this is by starting the download, canceling it, and copying the address for it.
Here, you will need to be cded into surrealra1n.
Run:
./bin/pzb -l [URL of 14.0 IPSW] | grep Firmware/dfu/iBSS
This will come back with all iBSS payloads inside of the IPSW. You will need to figure out which one is suited for your device and then run:
./bin/pzb -g Firmware/dfu/iBSS.[your board config].RELEASE.im4p [URL of 14.0 IPSW]
The file will now be in your surrealra1n directory. I highly recommend moving to another directory above surrealra1n at this step (mkdir ../work && cd ../work). The rest of this step will assume you're operating from that directory.
Find your firmware and device combo on this page
Decrypt the im4p using img4tool and the keys from the page earlier:
../surrealra1n/bin/img4tool -e -o ibss.dec --iv [iBSS IV] --key [iBSS Key] iBSS.[your board config].RELEASE.im4p
The output should look like this:
img4tool version: 0.190-e26f6e27c5fce7aff9e1ed5fe2b486b9989a5bec
Compiled with plist: YES
Compression detected, uncompressing (bvx2): ok
Extracted (and uncompressed bvx2) IM4P payload to ibss.dec
If you get an error that looks like: libc++abi: terminating due to uncaught exception of type tihmstar::exception: invalid magic it means you likely entered the wrong IV/Key combo or are operating on the wrong iBSS file.
Once ibss.dec is created, run:
/path/to/iBoot64Patcher_cryptic ibss.dec ibss.patch -n (iBoot64Patcher_cryptic is the program we downloaded earlier)
If you've already played with iOS related things before, you might be thinking of making an img4 file for the iBSS. This is not necessary with usbliter8.
- Reboot your device into DFU mode
- Enter pwned DFU mode using your RP2350 board
- Run
python3 /path/to/usbliter8ctl boot ibss.patch- You will need to install the usb module if Python errors out
- Wait a few seconds
- Run
cat /path/to/blob.shsh2 | grep -A1 generator - Run `../surrealra1n/bin/irecovery -c "setenv com.apple.System.boot-nonce [generator from SHSH blob]'
- Run `../surrealra1n/bin/irecovery -c "saveenv"
- Reboot to recovery mode
- Run
../surrealra1n/bin/irecovery -qand note the NONC value - Reboot the device to recovery mode
- Re run that command from earlier
If the NONC value didn't change, this step is successful.
You will need futurerestore for this step. The good news is that surrealra1n includes it.
The command to run will look something like this on an iPhone Xs or Xr:
futurerestore --apticket /path/to/blob.shsh2 --debug --update --latest-sep --latest-baseband /path/to/ipsw
It will look like this on an iPad (Air 3, 8th gen, mini 5)
futurerestore --apticket /path/to/blob.shsh2 --debug --update --latest-sep --no-baseband /path/to/ipsw
This will begin the restoration process on your device.
Note: futurerestore will display this line if your blob is valid for an update:
Verified APTicket to be valid for this restore
Variant: Customer Upgrade Install (IPSW)
On the off chance your blob is not valid for an update install, you will not be able to finish this guide unfortunately, sorry.
Once the restore is finished, you should now be booting to iOS 15 untethered! Enjoy! From here you will be able to install Dopamine and jailbreak your device with no issue.
Big thank you to pwnerblu for helping me with step 4 and for writing surrealra1n. This would not have been possible without their help.
Thanks to orangera1n for helping out when testing this
Thanks to Cryptiiiic for writing futurerestore and for the iBoot64Patcher binary used here
Thanks to tihmstar for img4tool and for pzb