an OTA Downgrade Tool for A7 Devices

LeetDown - an OTA Downgrade Tool for A7 devices

Information

Category: Swift / Utility
Watchers: 6
Star: 11
Fork: 3
Last update: Sep 12, 2020

Resource links

https://github.com/rA9stuff/LeetDown

README
Issues 12

LeetDown

an OTA Downgrade Tool for A7 devices.

made by @ra9_baris.

Latest compiled version can be found here.

How to Use?

Mount the LeetDown.dmg and drag the leetdown.app to your /Applications folder.

Follow the instructions shown in the app.

Huge Thanks To:

@axi0mX for the legendary checkm8 exploit.
@tihmstar for futurerestore and igetnonce.
@dora2ios for "pwnedDFU" which works ~100% on A7 :)
@mosk_i for ibxx patch files and letting me know that DispatchQueue and "pwnedDFU" is a thing :D
@pimskeks for libimobiledevice.
@ConsoleLogLuke for helping with the dependencies and scripts :)
@s0uthwes (RIP) for updated igetnonce.
@yebecekic for designing the LeetDown's beautiful icon.

2 Open More issues

Closed

iPad Air 4,1 - Restore Failed

My setup:

iPad Air 4,1, iOS 12.5.4 Macbook Air (Not Silicon): OS: Monterey 12.0 Beta (21A5506j) Leetdown: 2.1

Log here:

[+] Verifying iPSW [+] Successfully verified the iPSW [+] iPSW selected at /Users/xx/Desktop/xxx/iPad_64bit_10.3.3_14G60_Restore.ipsw and being extracted to /var/folders/gj/k59wx9c56lx5zyz7988gd9r80000gq/T/iPSW [+] Extracting the iPSW please wait... [+] Successfully extracted the iPSW [+] Device was already pwned, skipping exploitation [+] Fetching OTA blob [+] Skipped saving a copy of the blob [+] Sending bootchain [+] sendFile() is attempting to connect [+] Sucessfully sent /dev/null [+] 5 second cooldown, re-plug now if needed on Apple Silicon [+] sendFile() is attempting to connect [+] Sucessfully sent /var/folders/gj/k59wx9c56lx5zyz7988gd9r80000gq/T/iPSW/Firmware/DFU/iBSS.ipad4.RELEASE.im4p [+] 5 second cooldown, re-plug now if needed on Apple Silicon [+] sendFile() is attempting to connect [+] Sucessfully sent /var/folders/gj/k59wx9c56lx5zyz7988gd9r80000gq/T/iPSW/Firmware/DFU/iBEC.ipad4.RELEASE.im4p [+] 5 second cooldown, re-plug now if needed on Apple Silicon [+] Restore failed

opened Sep 24, 2021 by d3vdays 19

Closed

Help with 5s & MacBook M1

The Program can't recognise 5s in DFU mode, but I've put my iPhone in this mode and Finder has recognised it in this mode though. I do know the difference between DFU & Recovery mode.

I used:

Running on MacBookAir10,1 on Version 12.2 (Build 21D49)
I used USB-C to lighting and USB-C->USB-A to lighting in both cases
Model Name: iPhone 5s (GSM), Hardware Model: n51ap, Pwned: No
leet Down version - 2.1

---LDLog.txt here--- [+] Running on MacBookAir10,1 on Version 12.2 (Build 21D49) [+] Waiting for a device in DFU Mode [+] iPhone 5s (GSM) is supported

[+] Verifying iPSW [+] Successfully verified the iPSW [+] iPSW selected at /Users/vyacheslavgoryachkin/Downloads/Downgrade5s/1033-OTA-Downgrader-master/iPhone_4.0_64bit_10.3.3_14G60_Restore.ipsw and being extracted to /var/folders/fd/7lyb6zq93sz_2j_72nvj24g80000gn/T/iPSW [+] Extracting the iPSW please wait... [+] Successfully extracted the iPSW [+] Exploiting device... [+] Failed to exploit device, please re-enter DFU mode and try again.......

Please help me, I don't understand what's going on!

opened Feb 8, 2022 by goryachkinv 18

Closed

HELP!!!!MABOOK AIR M1.macOS Big Sur 11.4> Libusb missing > failed to install libusb

Last login: Sun Jul 25 22:44:24 on ttys000 [email protected] ~ % /Applications/LeetDown.app/Contents/MacOS/leetdown
rm: no_device: No such file or directory rm: no_dfu: No such file or directory rm: no_dfu: No such file or directory rm: no_device: No such file or directory rm: libusb_missing: No such file or directory rm: *.im4p: No such file or directory rm: *.stock: No such file or directory rm: *.patched: No such file or directory rm: *.shsh: No such file or directory rm: *.shsh2: No such file or directory rm: *.bbfw: No such file or directory rm: no_ipsw: No such file or directory rm: no_dfu: No such file or directory rm: no_device: No such file or directory Your current ApNonce is ee4b7f9b2d7d41bfde4c8390734a83d63c2fe997 6b70ab67ff0 Your device is an iPad4,4 Your boardconfig is j85ap rm: no_device: No such file or directory rm: no_dfu: No such file or directory rm: libusb_missing: No such file or directory

opened Jul 25, 2021 by 824566252 18

Closed

Not support macos 11.5

When I try to downgrade my ipad mini2 iOS 10.3.3 It fails with the message "Failed to restore device"

LeetDown Version: 2.0.1 OS: macOS 11.5 (Intel Mac) Also here is the Log:

[+] Sending /var/folders/bm/szds14m959dcfbkbcfsvj5pw0000gn/T/iPSW/Firmware/DFU/iBSS.iphone6.release.im4p [+] Waiting for the device to connect [+] Sending /var/folders/bm/szds14m959dcfbkbcfsvj5pw0000gn/T/iPSW/Firmware/DFU/iBEC.iphone6.release.im4p [+] Restoring... [+] Failed to restore device

============== DEVICE INFO ==============

Model Name: iPad Mini 2 (WiFi) Hardware Model: j85ap ECID: 1053051432676 APNonce:e7d4f08fd7a4887410511ead2342f6c45b667e9d SEPNonce:2924c73e86a9bf77bbccdb001a8e4c62c4b84ed0 CPID: 8960 Pwned: Yes

=======================================

======================================= [+] iPSW selected at /Users/zz/Downloads/i4ToolsDownloads/Firmware/iPad_64bit_10.3.3_14G60_Restore.ipsw.ipsw and being extracted to /var/folders/bm/szds14m959dcfbkbcfsvj5pw0000gn/T/iPSW [+] Extracting the iPSW please wait... [+] Successfully extracted the iPSW [+] Device was already pwned, skipping exploitation [+] Patching bootchain [+] Fetching iOS 10.3.3 OTA blob... [+] Waiting for the device to connect [+] Sending /dev/null [+] Waiting for the device to connect [+] Sending /var/folders/bm/szds14m959dcfbkbcfsvj5pw0000gn/T/iPSW/Firmware/DFU/iBSS.iphone6.release.im4p [+] Waiting for the device to connect [+] Sending /var/folders/bm/szds14m959dcfbkbcfsvj5pw0000gn/T/iPSW/Firmware/DFU/iBEC.iphone6.release.im4p [+] Restoring... [+] Failed to restore device

opened Aug 5, 2021 by noinlijin 16

Closed

ipad air. Restore failed. Press the killswitch to try again

Help me!

opened Nov 28, 2020 by zoomine 14

Closed

iPhone 5S failed restore

Sorry for my english... Always error this:

Your device is an iPhone6,2 Your boardconfig is n53ap [==================================================] 100.0% [==================================================] 100.0% [========================================= ] 80.9%Version: 81b98e0425e17250cc83d5badaf9a8cc6399f481 - 245 Libipatcher version: 3159a387584e352f690cca859e013c3a4683f3e8 - 69 Odysseus support: yes [INFO] 64-bit device detected futurerestore init done reading signing ticket shsh.shsh2 is done Found device iPhone6,2 n53ap [TSSC] opening BM/iPhone6,2.plist [TSSR] User specified not to request a baseband ticket. Request URL set to https://gs.apple.com/TSS/controller?action=2 Sending TSS request attempt 1... response successfully received [Error] failed to read baseband[Error] Fail code=-15 Failed with errorcode=-15 fail rm: libusb_missing: No such file or directory rm: no_device: No such file or directory rm: no_dfu: No such file or directory rm: *.patched: No such file or directory rm: *.shsh: No such file or directory rm: *.bbfw: No such file or directory rm: no_device: No such file or directory rm: no_dfu: No such file or directory

iPhone: A1457 OS: Hackintosh Mojave

opened Sep 8, 2020 by mtomi95 14

Open

stuck on exploiting device

Describe the bug A clear and concise description of what the bug is. stuck on exploiting device What is your macOS version? e.g. macOS 10.13

What is the device you're trying to downgrade? e.g. iPhone 5s

What is the LeetDown version you're using? e.g. 2.1 or 2.2

**Enable debugging in LeetDown's settings and copy and paste LDLog.txt here. **

Additional info (optional)

opened Jul 4, 2022 by safat999 0

Open

can't downgrade my iphone 5s

Describe the bug i get "failed to restore device"

What is your macOS version? macOS 11.6.5 (hackintosh)

What is the device you're trying to downgrade? iPhone 5s

What is the LeetDown version you're using? 2.2

**Enable debugging in LeetDown's settings and copy and paste LDLog.txt here. ** [+] Waiting for a device in DFU Mode [+] iPhone 5s (Global) is supported

============= DEVICE INFO =============

Model Name: iPhone 5s (Global) Hardware Model: n53ap ECID: 2701739413524 Serial Tag: iBoot-1704.10 APNonce:f5cce05e81a9be2ef66ec287f692ffdf20b13860 CPID: 8960 Destination Firmware: 10.3.3 Pwned: No

===================================== [+] Verifying iPSW [+] Checking md5 of the iPSW... [+] Successfully verified the iPSW [+] iPSW selected at /Users/stanislav/Downloads/iPhone_4.0_64bit_10.3.3_14G60_Restore.ipsw and being extracted to /var/folders/ld/yr3r2vt95l7_nj3xg_1rz6v40000gn/T/iPSW [+] Extracting the iPSW please wait... [+] Successfully extracted the iPSW [+] Exploiting device... [+] Exploit succeeded! [+] Fetching OTA blob [+] Failed to save 10.3.3 OTA blob. Is it being signed? [+] Sending /dev/null [+] Successfully booted /dev/null [+] 5 second cooldown, re-plug now if needed on Apple Silicon [+] Sending /var/folders/ld/yr3r2vt95l7_nj3xg_1rz6v40000gn/T/iPSW/Firmware/DFU/iBSS.iphone6.RELEASE.im4p [+] Successfully booted /var/folders/ld/yr3r2vt95l7_nj3xg_1rz6v40000gn/T/iPSW/Firmware/DFU/iBSS.iphone6.RELEASE.im4p [+] 5 second cooldown, re-plug now if needed on Apple Silicon [+] Sending /var/folders/ld/yr3r2vt95l7_nj3xg_1rz6v40000gn/T/iPSW/Firmware/DFU/iBEC.iphone6.RELEASE.im4p [+] Successfully booted /var/folders/ld/yr3r2vt95l7_nj3xg_1rz6v40000gn/T/iPSW/Firmware/DFU/iBEC.iphone6.RELEASE.im4p [+] 5 second cooldown, re-plug now if needed on Apple Silicon [+] Starting restore process [+] Failed to restore device

Additional info (optional) i dont know where is LDLog.txt

opened May 26, 2022 by amanito125 0

Open

Idea

As soon as the device is disconnected client will be NULL so before sending a file or a command, we just need to check if client is NULL or not. if client == NULL we will proceed reconnect, so i think sendFile() will be something like this:

int DFUDevice::sendFile(const char* filename) {
    if(!(this -> client)) {
        this -> freeDevice();
        usleep(500000);
        if (this -> openConnection(5) != 0) {
            printf("error connecting to device, stopping here\n");
            return 2;
        }
        usleep(500000);
        this -> setAllDeviceInfo();
        usleep(500000);
    }
    usleep(500000);
    irecv_error_t stat = irecv_send_file(this -> client, filename, 1);
    usleep(500000);
    /* for some reason it returns USB upload error even though it uploads
      the file just fine, so we're only worried about IRECV_E_UNABLE_TO_CONNECT here */
    if (stat == IRECV_E_SUCCESS) {
        return 0;
    } else if (stat == IRECV_E_USB_UPLOAD) {
        if (strcmp(filename, "/dev/null") == 0) return 0;
        else return 2;
    }
    return 1;
}

i'll open a PR if you agree

opened May 25, 2022 by Mini-Exploit 1

Open

2020 M1 MAC PRO

2020 款 M1 版本

macOS 12.3.1

IPad Mini2

Leetdownd 2.2

WARNING: user specified is not to flash a baseband. This can make the restore fail if the device needs a baseband! if you added this flag by mistake, you can press CTRL-C now to cancel continuing restore in 10 9 8 7 6 5 4 3 2 1 Downloading the latest firmware components... [TSSC] opening firmwares.json [DOWN] downloading file https://api.ipsw.me/v2.1/firmwares.json/condensed [Error] failed to download file from=https://api.ipsw.me/v2.1/firmwares.json/condensed to=/tmp/firmwares.json CURLcode=35 futurerestore: failed with exception: [exception]: what=[TSSC] parsing firmware.json failed

尝试使用浏览器，能够下载，但是通过leetdown 就会报错

opened May 9, 2022 by tomorrow-s 1

Open

Unable to downgrade — iPad mini 2 Wifi — MBAir M1 12.3.1

Hi there,

I tried to downgrade my iPad mini 2 ( j85ap ) back to iOS 10.3.3 but it failed. Did somebody can help me ? Thanks.

What is your macOS version? macOS 12.3.1

What is the device you're trying to downgrade? iPad mini 2 ( j85ap )

What is the LeetDown version you're using? 2.2

[+] Waiting for a device in DFU Mode [+] iPad Mini 2 (WiFi) is supported

============= DEVICE INFO =============

Model Name: iPad Mini 2 (WiFi) Hardware Model: j85ap ECID: 8305587209168 Serial Tag: iBoot-1704.10 APNonce:1dedf288afea588e803be0737af7ae5ca87d107f CPID: 8960 Destination Firmware: 10.3.3 Pwned: Yes

===================================== [+] Verifying iPSW [+] Checking md5 of the iPSW... [+] Successfully verified the iPSW [+] iPSW selected at /Users/enzo/Downloads/iPad_64bit_10.3.3_14G60_Restore.ipsw and being extracted to /var/folders/d5/4_mn5fwj09x_h5fs824cdkwm0000gn/T/iPSW [+] Extracting the iPSW please wait... [+] Successfully extracted the iPSW [+] Device was already pwned, skipping exploitation [+] Fetching OTA blob [+] Sending /dev/null [+] Successfully booted /dev/null [+] 5 second cooldown, re-plug now if needed on Apple Silicon [+] Sending /var/folders/d5/4_mn5fwj09x_h5fs824cdkwm0000gn/T/iPSW/Firmware/DFU/iBSS.ipad4b.RELEASE.im4p [+] Successfully booted /var/folders/d5/4_mn5fwj09x_h5fs824cdkwm0000gn/T/iPSW/Firmware/DFU/iBSS.ipad4b.RELEASE.im4p [+] 5 second cooldown, re-plug now if needed on Apple Silicon [+] Sending /var/folders/d5/4_mn5fwj09x_h5fs824cdkwm0000gn/T/iPSW/Firmware/DFU/iBEC.ipad4b.RELEASE.im4p [+] Failed to connect to device, reconnect the USB cable to your mac to try again [+] Sending /var/folders/d5/4_mn5fwj09x_h5fs824cdkwm0000gn/T/iPSW/Firmware/DFU/iBEC.ipad4b.RELEASE.im4p [+] Successfully booted /var/folders/d5/4_mn5fwj09x_h5fs824cdkwm0000gn/T/iPSW/Firmware/DFU/iBEC.ipad4b.RELEASE.im4p [+] 5 second cooldown, re-plug now if needed on Apple Silicon [+] Starting restore process [+] Failed to restore device

opened Apr 30, 2022 by enzovykm 6

Open

Restore successfully but the touch doesn’t work

Describe the bug A clear and concise description of what the bug is.

What is your macOS version? e.g. macOS 12.3

What is the device you're trying to downgrade? e.g. iPhone 5,2

What is the LeetDown version you're using? e.g. 2.2

**Enable debugging in LeetDown's settings and copy and paste LDLog.txt here. **

Additional info (optional)

https://user-images.githubusercontent.com/85810940/159826580-b1f476e2-6d0a-415f-b1c0-bb4604d21160.MOV

opened Mar 23, 2022 by alikaoshiro2555 3

Tethered Downgrade Your A5 Device Today. By @zzanehip.

Official implementation of our CVPR2021 paper "OTA: Optimal Transport Assignment for Object Detection" in Pytorch.

Vieux - A tool for 32/64 Bit iOS downgrades using OTA Blobs

Devices.css - Modern devices in pure CSS

blurify.js is a tiny(~2kb) library to blurred pictures, support graceful downgrade from `css` mode to `canvas` mode.

Framework for IoT projects implementing HTTPS requests, a React web interface, WiFi manager, configuration manager, file manager and OTA updates.

Alternative firmware for ESP8266 with easy configuration using webUI, OTA updates, automation using timers or rules, expandability and entirely local control over MQTT, HTTP, Serial or KNX. Full documentation at

Soletta Project is a framework for making IoT devices. With Soletta Project's libraries developers can easily write software for devices that control actuators/sensors and communicate using standard technologies. It enables adding smartness even on the smallest edge devices.

WIFI / LAN intruder detector. Check the devices connected and alert you with unknown devices.

A tool for in-depth analysis of USB HID devices communication

💤 Kick devices off your network by performing an ARP Spoof attack.

Gopher Interface Devices (USB HID)

Client and Server emulator for Marvel's Avengers

A tool to make quick screenshots for multiple mobile devices of your web app in a couple of minutes.

ESP32 + GitHub Actions + Husarnet. A boilerplate project for ESP32 allowing in-field firmware update using GitHub Actions workflow.

A Linux or OSX tool that uses psutil to monitor devices while your computer is locked. In the case it detects someone plugging in or unplugging devices it can be configured to send you an SMS or alert you via Slack or Pushover.

Manipulate Chromecast Devices in your Network

yubihsm - Pure Rust client for YubiHSM2 devices with support for HTTP and USB-based access to the device. Supports most HSM functionality including ECDSA, Ed25519, HMAC, and RSA.

A Go library for using U2F USB devices on the client

Vue.js Inspector for Mobile Devices

Share this repo

Related Repos

Utility

SwiftyStepper - iOS Framework

SwiftyStepper Examples Installation SwiftyStepper is available through CocoaPods. To install it, simply add the following line to your Podfile: pod 'S

Utility

A utility used to parse number strings

NumberParser is a Swift package used to parse number strings, e.g. "eight thousand four hundred seventy-three" Usage let input = "eight thousand four

Utility

My keyboard config

4×12 Ortholinear Keyboard This layout needs a clever name. Ideas? Why 4×12 Ortholinear? An ortholinear layout (e.g. a grid) aligns with how fingers mo

Utility

Parsing Simple HTTP Headers

Parsing simple HTTP headers using pre-defined header descriptions.

Utility

Math expression parser built with Point•Free's swift-parsing package

swift-math-parser Basic math expression parser built with Point•Free's swift-parsing package. NOTE: currently, this uses a fork of swift-parsing fixes

Utility

🧘🏽‍♂️ zenmode: don't let other apps distract you

🧘🏽‍♂️ zenmode: don't let other apps distract you When you activate zenmode you will not be able to open any new apps. You need to focus on the ones

Utility

A powerful and easy to use live mesh gradient renderer for iOS.

MeshKit A powerful and easy to use live mesh gradient renderer for iOS. This project wouldn't be possible without the awesome work from Moving Parts a

Utility

1.8k

A Swift package for parsing, building, editing, and analyzing Markdown documents.

Utility

Network debugging made easy，This network debugging tool is developed based on the swift ve...

Start debugging iOS network calls like a wizard, without extra code! Wormholy makes debugging quick and reliable.

Utility

🤹‍♀️ Fake data generation in Swift

Utility

Compute NeuralHash for the given image

Utility

312

PlayCover is a project that allows you to sideload iOS apps on macOS( currently arm, Intel...

Run iOS apps & games on M1 Mac with mouse, keyboard and controller support.

Utility

Use "Full Disk Access" permissions to read the contents of TCC.db and display it in human-...

SwiftParseTCC Description This tool leverages the research linked below to understand the contents of TCC.db. Uses "Full Disk Access" permissions to r

Utility

A library of data structures for working with collections of identifiable elements in an e...

A library of data structures for working with collections of identifiable elements in an ergonomic, performant way.

Utility

Backports the new @Invalidating property wrapper to older platforms

A property wrapper that backports the new @Invalidating property wrapper to older versions of iOS/tvOS/macOS