Skip to content

Instantly share code, notes, and snippets.

@pwnerblu
Last active June 6, 2026 22:20
Show Gist options
  • Select an option

  • Save pwnerblu/6a480efdc0788deed68401339848b4a4 to your computer and use it in GitHub Desktop.

Select an option

Save pwnerblu/6a480efdc0788deed68401339848b4a4 to your computer and use it in GitHub Desktop.
iPad mini 4 hax

iPad mini 4 hax for 11.3-12.4.1 restores with blobs

Here's how to restore to 11.3-12.4.1 with blobs on an iPad mini 4

THIS WILL NOT WORK ON IPAD AIR 2, DO NOT ASK

Guide is not fully complete (can be rough in some parts), and may not be fully user-friendly

This has NOT been tested yet, my mini 4 does not have blobs for 11.3 through 12.4.1. If you have any issues, please do inform me about it

Remember that the stuff in brackets [] are placeholders and should be replaced with actual path to the things listed

Baseband will be updated to latest signed baseband as part of this, but iPadOS 15 baseband should work with iOS 11.3-12.x

Touch ID will not work afterwards, but unlike tvOS 10 SEP on iOS 10, the device will function as normal without any issues besides Touch ID not working

Requirements

Terminal knowledge. You should not proceed with this guide if you don't know how to use a terminal on Linux/macOS

Required tools (there will also be a command you can use to fetch such tools)

The IPSW for the version you have blobs for (example: 11.3)

Valid SHSH blobs for 11.3-12.4.1. If you have iOS 10 blobs, follow tvOS 10 SEP guide instead

Custom hax buildmanifest (you can get it here). Download the manifest for your specific device. Also check README.md there for the manifest to download

Linux (assuming x86_64), iPad mini 4:

Open a terminal, make a working directory and cd into it:

mkdir hax

cd hax

Now, fetch the following binaries:

curl -L -o img4 https://github.com/LukeZGD/Semaphorin/raw/refs/heads/main/Linux/img4 && curl -L -o pzb https://github.com/LukeZGD/Semaphorin/raw/refs/heads/main/Linux/pzb && curl -L -o kerneldiff https://github.com/LukeZGD/Semaphorin/raw/refs/heads/main/Linux/kerneldiff && curl -L -o Kernel64Patcher https://github.com/LukeZGD/Semaphorin/raw/refs/heads/main/Linux/Kernel64Patcher && curl -L -o gaster https://github.com/LukeZGD/Legacy-iOS-Kit/raw/refs/heads/main/bin/linux/x86_64/gaster && curl -L -o futurerestore.zip https://github.com/LukeeGD/futurerestore/releases/download/latest/futurerestore-Linux-x86_64-RELEASE-main.zip && unzip -o futurerestore.zip && tar -xf futurerestore-Linux-x86_64-v2.0.0-Build_329-RELEASE.tar.xz && cp futurerestore-Linux-x86_64-v2.0.0-Build_329-RELEASE/* .

And set permissions: chmod +x *

Put the device into DFU mode, then pwn with gaster

./gaster pwn && ./gaster reset

Now, download iOS 12.5.8 SEP firmware:

sudo ./pzb -g Firmware/all_flash/sep-firmware.n61.RELEASE.im4p https://updates.cdn-apple.com/2026WinterFCS/fullrestores/047-28352/B80B4A86-C206-4C4F-8D35-65579694AEE9/iPhone_4.7_12.5.8_16H88_Restore.ipsw

Afterwards, start restoring the device!

If you have an iPad mini 4 Wi-Fi only model, run this:

sudo FUTURERESTORE_I_SOLEMNLY_SWEAR_THAT_I_AM_UP_TO_NO_GOOD=1 ./futurerestore -t [SHSH blob] --use-pwndfu --sep sep-firmware.n61.RELEASE.im4p --sep-manifest [the custom buildmanifest for your device from the cursed sep resources repo] --no-baseband --no-rsep [IPSW]

If you have an iPad mini 4 Cellular model, run this:

sudo FUTURERESTORE_I_SOLEMNLY_SWEAR_THAT_I_AM_UP_TO_NO_GOOD=1 ./futurerestore -t [SHSH blob] --use-pwndfu --sep sep-firmware.n61.RELEASE.im4p --sep-manifest [the custom buildmanifest for your device from the cursed sep resources repo] --latest-baseband --no-rsep [IPSW]

If the restore succeeds, wait for the Device to reach the Setup screen, then set up the device as normal

macOS, iPad mini 4:

Open a terminal, make a working directory and cd into it:

mkdir hax

cd hax

On Apple Silicon Macs, install Rosetta 2 before continuing to fetch binaries:

softwareupdate --install-rosetta

Now, fetch the following binaries:

curl -L -o img4 https://github.com/LukeZGD/Semaphorin/raw/refs/heads/main/Darwin/img4 && curl -L -o pzb https://github.com/LukeZGD/Semaphorin/raw/refs/heads/main/Darwin/pzb && curl -L -o kerneldiff https://github.com/LukeZGD/Semaphorin/raw/refs/heads/main/Darwin/kerneldiff && curl -L -o Kernel64Patcher https://github.com/LukeZGD/Semaphorin/raw/refs/heads/main/Darwin/Kernel64Patcher && curl -L -o gaster https://github.com/LukeZGD/Legacy-iOS-Kit/raw/refs/heads/main/bin/macos/gaster && curl -L -o futurerestore.zip https://github.com/LukeeGD/futurerestore/releases/download/latest/futurerestore-macOS-RELEASE-main.zip && unzip -o futurerestore.zip && tar -xf futurerestore-macOS-v2.0.0-Build_329-RELEASE.tar.xz && cp futurerestore-macOS-v2.0.0-Build_329-RELEASE/* .

And set permissions: chmod +x * && xattr -cr *

Put the device into DFU mode, then pwn with gaster

./gaster pwn && ./gaster reset

Now, download iOS 12.5.8 SEP firmware:

sudo ./pzb -g Firmware/all_flash/sep-firmware.n61.RELEASE.im4p https://updates.cdn-apple.com/2026WinterFCS/fullrestores/047-28352/B80B4A86-C206-4C4F-8D35-65579694AEE9/iPhone_4.7_12.5.8_16H88_Restore.ipsw

Afterwards, start restoring the device!

If you have an iPad mini 4 Wi-Fi only model, run this:

sudo FUTURERESTORE_I_SOLEMNLY_SWEAR_THAT_I_AM_UP_TO_NO_GOOD=1 ./futurerestore -t [SHSH blob] --use-pwndfu --sep sep-firmware.n61.RELEASE.im4p --sep-manifest [the custom buildmanifest for your device from the cursed sep resources repo] --no-baseband --no-rsep [IPSW]

If you have an iPad mini 4 Cellular model, run this:

sudo FUTURERESTORE_I_SOLEMNLY_SWEAR_THAT_I_AM_UP_TO_NO_GOOD=1 ./futurerestore -t [SHSH blob] --use-pwndfu --sep sep-firmware.n61.RELEASE.im4p --sep-manifest [the custom buildmanifest for your device from the cursed sep resources repo] --latest-baseband --no-rsep [IPSW]

If the restore succeeds, wait for the Device to reach the Setup screen, then set up the device as normal

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment