1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
|
.TH "idevicerestore" 1
.SH NAME
idevicerestore \- Restore IPSW firmware at PATH to an iOS device
.SH SYNOPSIS
.B idevicerestore
[OPTIONS] PATH
.SH DESCRIPTION
Restore firmware files to iOS devices while either erasing the device or
updating to preserve content and settings.
\f[B]PATH\f[] can be a compressed .ipsw file or a directory containing all files extracted from an IPSW.
.SH OPTIONS
.TP
.B \-i, \-\-ecid ECID
Target specific device by its ECID, e.g. 0xaabb123456 (hex) or 1234567890 (decimal).
.TP
.B \-u, \-\-udid UDID
Target specific device by its device UDID.
\f[B]NOTE\f[]: only works with devices in normal mode.
.TP
.B \-l, \-\-latest
Use latest available firmware (with download on demand).
Before performing any action it will interactively ask
to select one of the currently signed firmware versions,
unless \f[B]\-y\f[] has been given too.
The PATH argument is ignored when using this option.
\f[B]DO NOT USE\f[] if you need to preserve the baseband/unlock!
\f[B]USE WITH CARE\f[] if you want to keep a jailbreakable firmware!
.TP
.B \-e, \-\-erase
Perform full restore instead of update, erasing all data
\f[B]DO NOT USE\f[] if you want to preserve user data on the device!
.TP
.B \-y, \-\-no\-input
Non-interactive mode, do not ask for any input.
\f[B]WARNING\f[]: This will disable certain checks/prompts that are supposed
to prevent DATA LOSS. \f[B]Use with caution\f[].
.TP
.B \-n, \-\-no\-action
Do not perform any restore action. If combined with \f[B]\-l\f[] option
the on-demand ipsw download is performed before exiting.
.TP
.B \-\-ipsw\-info
Print information about the IPSW at PATH and exit.
.TP
.B \-h, \-\-help
Prints usage information.
.TP
.B \-C, \-\-cache\-path DIR
Use specified directory for caching extracted or other reused files.
.TP
.B \-\-logfile PATH
Write logging output to file at PATH. If PATH equals \f[B]NULL\f[] or \f[B]NONE\f[],
no log file will be written. This disables automatic log file creation.
.TP
.B \-d, \-\-debug
Enable communication debugging.
.TP
.B \-v, \-\-version
Prints version information.
.SH ADVANCED/EXPERIMENTAL OPTIONS
.TP
.B \-c, \-\-custom
Restore with a custom firmware (requires bootrom exploit)
.TP
.B \-s, \-\-server URL
Override the default signing server request URL. If the URL doesn't contain
a path component, the default path \f[B]/TSS/controller?action=2\f[] will be added.
.TP
.B \-x, \-\-exclude
Exclude nor/baseband upgrade.
\f[B]NOTE\f[]: This option only works with legacy devices and/or custom firmware.
.TP
.B \-t, \-\-shsh
Fetch TSS record and save to .shsh file, then exit.
.TP
.B \-z, \-\-no\-restore
Do not restore and end after booting to the ramdisk.
.TP
.B \-k, \-\-keep\-pers
Write personalized components to files for debugging.
.TP
.B \-p, \-\-pwn
Put device in pwned DFU mode and exit (limera1n devices only).
.TP
.B \-P, --plain-progress
Print progress as plain step and progress
.TP
.B \-R, \-\-restore\-mode
Allow restoring from Restore mode
.TP
.B \-T, \-\-ticket PATH
Use file at PATH to send as AP ticket
.TP
.B \-\-variant VARIANT
Use given VARIANT to match the build identity to use, e.g. 'Customer Erase Install (IPSW)'
.TP
.B \-\-ignore\-errors
Try to continue the restore process after certain errors (like a failed baseband update).
\f[B]WARNING\f[]: This might render the device unable to boot or only partially functioning. \f[B]Use with caution\f[].
.TP
.B \-\-exclusive\-usb
\f[B](macOS only)\f[] Keep the \f[B]deviceinterfaced\f[] system daemon from claiming the
USB device during Port DFU-to-DFU re-enumeration, which can otherwise cause
idevicerestore to time out waiting for the device to reconnect.
idevicerestore itself does not need to run as root for this option. The few
\f[B]launchctl\f[](1) subcommands that manage the system-domain
\f[B]com.apple.deviceinterfaced\f[] daemon (\f[B]bootout\f[], \f[B]bootstrap\f[],
\f[B]kickstart\f[], \f[B]kill\f[]) are elevated individually via \f[B]sudo\f[](8), which
may prompt for your password (or Touch ID, if configured) on the controlling
terminal. See the \f[B]NOTES\f[] section below for unattended use.
\f[B]EXPERIMENTAL\f[]: only use if you are hitting DFU reconnection timeouts.
.SH NOTES
.SS Passwordless \-\-exclusive\-usb
By default, using \f[B]\-\-exclusive\-usb\f[] will prompt for your
password via \f[B]sudo\f[](8) whenever idevicerestore needs to boot out,
kickstart, or forcibly terminate the \f[B]com.apple.deviceinterfaced\f[]
daemon. For unattended/scripted use, you can allow just those specific
commands to run without a password by adding a narrowly-scoped rule to
\f[B]sudoers\f[](5), e.g. via \f[B]visudo \-f /etc/sudoers.d/idevicerestore\f[]:
.nf
.RS
Cmnd_Alias DEVICEINTERFACED_CTL = \\
/bin/launchctl bootout system/com.apple.deviceinterfaced, \\
/bin/launchctl bootstrap system /Library/Apple/System/Library/PrivateFrameworks/DeviceInterface.framework/Support/com.apple.deviceinterfaced.plist, \\
/bin/launchctl kickstart system/com.apple.deviceinterfaced, \\
/bin/launchctl kill SIGKILL system/com.apple.deviceinterfaced
%admin ALL=(root) NOPASSWD: DEVICEINTERFACED_CTL
.RE
.fi
Replace \f[B]%admin\f[] with the specific user or group that should be
allowed to run these commands without a password. This grants no broader
privileges: only these exact \f[B]launchctl\f[] invocations, against this
one system daemon, may be run as root without authentication.
.SH AUTHORS
Martin Szulecki
Nikias Bassen
Joshua Hill
.SH ON THE WEB
https://libimobiledevice.org
https://github.com/libimobiledevice/idevicerestore
|
