How to downgrade from iOS 15 to iOS 14

ios_14_downgrade.md

How to downgrade from iOS 15 to iOS 14

The latest SEP/BB as of right now is iOS 15.1, and is partially or fully compatible with iOS 14 depending on your device. See the appropriate section for exact compatibility info.

Prequisites

• SHSH blobs for the version you want to downgrade to (e.g. from https://tsssaver.1conan.com/, https://shsh.host/)
• macOS or Linux (Ubuntu 20.04 or newer recommended). Windows or a VM will NOT work.

Notes

• If the exploit fails even after multiple attempts or your device reboots out of DFU mode, you'll have to start over from the beginning and be quicker next time. (You don't have to redownload anything though.) You may have to force restart your device if it's stuck in DFU.

Instructions

Table of Contents
A12 and newer
A11
A10(X)
A9X
A9
A8(X)

A12 and newer

Nope, you can't. At least not until a jailbreak for iOS 15 comes out, but SEP/BB will probably be fully incompatible by then.

A11

IMPORTANT: On the iPhone X, downgrading to iOS 14 will break Face ID and cause other issues (broken RootFS snapshot and OTA updates). The only way to fix it is by restoring to iOS 15.

This very likely also affects A12 and above, but you can't downgrade those devices from iOS 15 currently anyway. It does also apply to upgrading from an earlier version with FutureRestore, though.

There are no issues with iPhone 8(+), Touch ID will work fine.

Compatible versions: 14.3-14.8

Part 1/4: Entering pwned DFU

1. Put your device in DFU mode.
2. Download and extract Cryptic's fork of ipwndfu for A11.
3. Open the extracted folder in a terminal.
4. Run python2 ipwndfu -p --patch. (On newer Linux distros, you may have to explicitly install Python 2 from your package manager, e.g. sudo apt install python2.)

Part 2/4: Setting nonce

1. Download and open FutureRestore GUI.
2. Click "Settings", enable "FutureRestore Beta", then click "Save".
3. Click "Download FutureRestore".
4. Download the desired version's IPSW from https://ipsw.me/ and select it along with your blobs.
5. Click "Next", enable "Pwned Restore" and "Set Nonce", and leave SEP and Baseband on latest. (If you see a "64 Bit Checkm8" option, update FRGUI. You should not use that option.)
6. Click "Next", and then "Start FutureRestore".

Part 3/4: Restoring

1. Put your device in recovery mode.
2. Go back to the previous tab in FutureRestore GUI and uncheck both "Pwned Restore" and "Set Nonce".
3. Click "Next", and "Start FutureRestore" again.

Part 4/4: Fixup (iPhone X only)

1. Once the restore starts looping at "No data to read (timeout)", force restart your device.
2. When you see the recovery mode screen, press "Exit Recovery".
3. Go through with setup as usual.
4. Jailbreak your device with checkra1n.
5. Open the checkra1n loader app and press "Install Cydia". If it complains about a missing RootFS snapshot, tap "Create".
6. If you want to use Odysseyra1n, after this finishes tap "Restore System" in the loader (or just force close it when it says "Downloading Base System").

Note that this is not a complete fix, as Face ID will still be broken. Taurine may also have issues jailbreaking with the manually fixed up snapshot, but hopefully that will be fixed in the future.

A10(X)

Compatible versions: 14.0-14.8

Part 1/3: Entering pwned DFU

macOS

1. Put your device in DFU mode.
2. Download and extract ipwndfu.
3. Open the extracted folder in a terminal.
4. Run ./ipwndfu -p.
5. Download and extract Fugu.
6. Open the extracted folder in a terminal.
7. Run ./Fugu rmsigchks.

Linux

1. Put your device in DFU mode.
2. Download and extract Cryptic's patched ipwndfu for A10.
3. Open the extracted folder in a terminal.
4. Run python2 ipwndfu -p.
5. Run python2 rmsigchks.py.

Part 2/3: Setting nonce

1. Download and open FutureRestore GUI.
2. Click "Settings", enable "FutureRestore Beta", then click "Save".
3. Click "Download FutureRestore".
4. Download the desired version's IPSW from https://ipsw.me/ and select it along with your blobs.
5. Click "Next", enable "Pwned Restore" and "Set Nonce", and leave SEP and Baseband on latest. (If you see a "64 Bit Checkm8" option, update FRGUI. You should not use that option.)
6. Click "Next", and then "Start FutureRestore".

Part 3/3: Restoring

1. Put your device in recovery mode.
2. Go back to the previous tab in FutureRestore GUI and uncheck both "Pwned Restore" and "Set Nonce".
3. Click "Next", and "Start FutureRestore" again.

A9(X)

Coming soon...

A8(X)-A9

Requires macOS.

Compatible versions: 14.0-14.8

Part 1/3: Entering pwned DFU

1. Put your device in DFU mode.
2. Download Eclipsa.
3. Open the folder in a terminal.
4. Run killall -STOP AMPDevicesAgent AMPDeviceDiscoveryAgent MobileDeviceUpdater.
5. Run make and wait for it to compile. (You need to have Xcode installed.) If you cannot compile Eclipsa for some reason, download and extract this zip instead (only compatible with Intel Macs).
6. If compiled manually, run ./eclipsa. Otherwise, you will need to run the appropriate version for your SoC:
   • A8: ./eclipsa7000
   • A8X: ./eclipsa7001
   • A9: ./eclipsa8000 or ./eclipsa8003
7. Run killall -CONT AMPDevicesAgent AMPDeviceDiscoveryAgent MobileDeviceUpdater.

Part 2/3: Setting nonce

1. Download and open FutureRestore GUI.
2. Click "Settings", enable "FutureRestore Beta", then click "Save".
3. Click "Download FutureRestore".
4. Download the desired version's IPSW from https://ipsw.me/ and select it along with your blobs.
5. Click "Next", enable "Pwned Restore" and "Set Nonce", and leave SEP and Baseband on latest. (If you see a "64 Bit Checkm8" option, update FRGUI. You should not use that option.)
6. Click "Next", and then "Start FutureRestore".

Part 3/3: Restoring

1. Put your device in recovery mode.
2. Go back to the previous tab in FutureRestore GUI and uncheck both "Pwned Restore" and "Set Nonce".
3. Click "Next", and "Start FutureRestore" again.

Can someone create a video tutorial for this

What worked for me using an A9 device was:

Part 1/3: Entering pwned DFU

• Downloaded the file from step 5.
• Then ran ./eclipsa8000. Waited a while, nothing happened. I terminated the command and then ran ./eclipsa8003. That did the trick. I tried this several times. What ended up working was using both commands in that order.

Part 2/3: Setting nonce

• I used the latest SEP and Baseband (15.7.3) to restore to 14.3. I used the generator inside my blob file (0x1111111111111111).

Part 3/3: Restoring

• Everything went just fine, no issues.

When everything was done, I used Taurine to jailbreak my 6s on 14.3. Thank you!

What worked for me using an A9 device was:

Part 1/3: Entering pwned DFU

• Downloaded the file from step 5.
• Then ran ./eclipsa8000. Waited a while, nothing happened. I terminated the command and then ran ./eclipsa8003. That did the trick. I tried this several times. What ended up working was using both commands in that order.

Part 2/3: Setting nonce

• I used the latest SEP and Baseband (15.7.3) to restore to 14.3. I used the generator inside my blob file (0x1111111111111111).

Part 3/3: Restoring

• Everything went just fine, no issues.

When everything was done, I used Taurine to jailbreak my 6s on 14.3. Thank you!

while its not mentioned, any data loss involved?!

What worked for me using an A9 device was:
Part 1/3: Entering pwned DFU

• Downloaded the file from step 5.
• Then ran ./eclipsa8000. Waited a while, nothing happened. I terminated the command and then ran ./eclipsa8003. That did the trick. I tried this several times. What ended up working was using both commands in that order.

Part 2/3: Setting nonce

• I used the latest SEP and Baseband (15.7.3) to restore to 14.3. I used the generator inside my blob file (0x1111111111111111).

Part 3/3: Restoring

• Everything went just fine, no issues.

When everything was done, I used Taurine to jailbreak my 6s on 14.3. Thank you!

while its not mentioned, any data loss involved?!

All data was lost. I created a backup, then restored everything.

Trying to use this on an iPad mini 4 (A8) running iOS 15.8 but getting Failed to set nonce generator. I have been troubleshooting trying to downgrade to to 14.8 for the past hour to no avail. Does anyone have any insight?

Ever make any progress on that iPad mini 4? I am in the same boat.

@chrisrcooper
I'm sorry to report that I gave up soon after that. I tried some other tools but nothing managed to actually downgrade the thing. I even participated in some issues but the support I got wasn't exactly the most helpful. I'll link some things, I hope they can be useful to you.

https://github.com/edwin170/downr1n (This was the first one I tried, I think for the iPad mini 4's CPU this will never work)
edwin170/downr1n#61
edwin170/downr1n#69

https://github.com/dualra1n/dualra1n (This one is by the same author, who said this one would work for the A8/A8X)
dualra1n/dualra1n#93