Tethered iOS 13.5 boot fails on iPhone 7 (iOS 14.4)

[kushwavez]

I would like to tether-boot iOS 13.5 on my iPhone 7, but it fails to boot. First I tried everything with PyBoot, encountered several problems, but it is failing with the same error as well. Issue #67 After restart, it is booting the installed iOS 14.4

Then I used Divisé to download the IPSW and restore it, then boot it with PyBoot. Unfortunately the same problem happening.

This msg looping for about ten times in verbose boot, then the device restart itself. Tried several times.

[...]
unsupported apfs_incompatible_features
hfs_mountfs returned error=22
mount(x)

macOS 11.2.2 MBP15,2 iPhone 7 128 GB iOS 14.4

[kushwavez]

Also local ipsw extract doesn't work with Divisé:

I have a downloaded iOS 13.5 ipsw on Mac, I transferred that manually to "/var/mobile/Media/Divise". The App says "Local IPSW Found, Press OK to unzip" after that a popup says "Warning: Divise will crash after extracting the local IPSW...Relaunch the app, after crash, to continue the dualboot/tethered downgrade process."

After clicking OK, it crashes immediately, and does the same every time.

[MatthewPierson]

When Divise finished dualbooting, did it give a popup saying that you need to boot with AMFI patched out of the kernel? Normally when dualbooting 13.x with 14.2.x and higher main, I have it set to replace the second OS's APFS.fs with that of the main OS's to bypass that "unsupported apfs_incompatible_features" error

The local IPSW extraction not working is a known issue, will be taking a look at it today most likely.

[kushwavez]

When Divise finished dualbooting, did it give a popup saying that you need to boot with AMFI patched out of the kernel? Normally when dualbooting 13.x with 14.2.x and higher main, I have it set to replace the second OS's APFS.fs with that of the main OS's to bypass that "unsupported apfs_incompatible_features" error

Yes indeed I got AMFI patch popup... That completely slipped my mind, I think that is the issue. Now I am trying to do that with PyBoot, I need to compile liboffsetfinder64

Unfortunately there is an error which causing the build fail, namely: No matching constructor for initialization of 'tihmstar::OFexception' in OFexception.hpp

Do you have it compiled?

EDIT: tried amfi_get_out_of_my_way=1 as I remembered that it is doing exactly the same thing on macOS, but unfortunately it isn't working on iOS 😔

[kushwavez]

Okay I did patch the kernel with Kernel64Patcher

kushwavez@X1C6-Pro Kernel64Patcher-master % ./Kernel64Patcher /Users/kushwavez/Downloads/PyBoot/resources/kernel.raw patchedkernel -a
main: Starting...
main: Detected fat macho kernel
Kernel: Adding AMFI_get_out_of_my_way patch...
get_amfi_out_of_my_way_patch: Entering ...
get_amfi_out_of_my_way_patch: Kernel-6153 inputted
get_amfi_out_of_my_way_patch: Found entitlements too small str loc at 0x7cdce0
get_amfi_out_of_my_way_patch: Found entitlements too small str ref at 0x10b148c
get_amfi_out_of_my_way_patch: Patching AMFI at 0x10afe18
main: Writing out patched file to patchedkernel...
main: Quitting...

But how can I use the patched kernel with PyBoot?

[MatthewPierson]

If the bundled Kernel64Patcher binary isn't working you can swap it out for the one you compiled. Just replace the file in resources/bin/ and it should work

[kushwavez]

Yeah it did work, everything went okay after that, but it still fails to boot.

Now AMFI out of the picture, the new error in verbose is:

[...]
Emergency: Boot task failed: fsck
Emergency: Shutting down in 3 seconds

[MatthewPierson]

Can you show what comes before that in the log? Need to see exactly what's causing fsck to fail (Have an idea but need to confirm it).

[kushwavez]

Sorry for the late response, unfortunately I restored back to iOS 14.4. I took a photo of the verbose boot, but the quality is very bad.

Here what I got:

apfs_vfsop_mount: Prebooter has been locked for /dev/disk0s1 
apfs_vfsop_mount: failed to find boot-manifest-hash snapshot
boot-args: -v rd=disk0s1s0 (maybe not 0, I couldn't see it perfectly)
failed to get boot device = no such file or directory 
Emergency: Boot task failed: fsck
Emergency: Shutting down in 3 seconds

Here is the picture, but it's really really bad (sorry):

[MatthewPierson]

disk0s1s0 is 100% the wrong disk identifier. If you re-jailbreak then open Divise, it will inform you about what disk identifier you need to use to boot.