libimobiledevice
Device fails to enter restore mode, goes back to recovery mode instead
I'm trying to restore my iphone 7 using Ubuntu 20.04.4 LTS
This is the log when running
idevicerestore --latest
Checksum matches.
Extracting BuildManifest from IPSW
Product Version: 15.4.1
Product Build: 19E258 Major: 19
INFO: device serial number is -------------
Device supports Image4: true
Variant: Customer Upgrade Install (IPSW)
This restore will update your device without erasing user data.
Checking IPSW for required components...
All required components found in IPSW
Extracting filesystem from IPSW: 078-28933-013.dmg
[==================================================] 100.0%
Found ECID ----------
Getting ApNonce in recovery mode... d2 b6 dc d4 85 42 29 b3 50 3e e0 4f 88 95 8b f2 04 f0 10 c4 fc 7d e5 7e 11 35 fd e8 b1 55 23 d2
Trying to fetch new SHSH blob
Getting SepNonce in recovery mode... 84 df 88 f3 62 20 39 ef c4 4b ca c5 5f 74 57 8a 02 04 82 77
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Received SHSH blobs
Extracting iBEC.d10.RELEASE.im4p (Firmware/dfu/iBEC.d10.RELEASE.im4p)...
Personalizing IMG4 component iBEC...
Sending iBEC (555160 bytes)...
Recovery Mode Environment:
iBoot build-version=iBoot-7459.102.5
iBoot build-style=RELEASE
Sending RestoreLogo...
Extracting applelogo@2x~iphone.im4p (Firmware/all_flash/applelogo@2x~iphone.im4p)...
Personalizing IMG4 component RestoreLogo...
Sending RestoreLogo (13547 bytes)...
Extracting AppleAVE2FW_H9.im4p (Firmware/ave/AppleAVE2FW_H9.im4p)...
Personalizing IMG4 component AVE...
Sending AVE (1064499 bytes)...
Extracting 078-28761-016.dmg.trustcache (Firmware/078-28761-016.dmg.trustcache)...
Personalizing IMG4 component RestoreTrustCache...
Sending RestoreTrustCache (12300 bytes)...
ramdisk-size=0x20000000
Extracting 078-28761-016.dmg (078-28761-016.dmg)...
Personalizing IMG4 component RestoreRamDisk...
Sending RestoreRamDisk (115984774 bytes)...
Extracting DeviceTree.d101ap.im4p (Firmware/all_flash/DeviceTree.d101ap.im4p)...
Personalizing IMG4 component RestoreDeviceTree...
Sending RestoreDeviceTree (36740 bytes)...
Extracting sep-firmware.d101.RELEASE.im4p (Firmware/all_flash/sep-firmware.d101.RELEASE.im4p)...
Personalizing IMG4 component RestoreSEP...
Sending RestoreSEP (1476216 bytes)...
Extracting kernelcache.release.iphone9 (kernelcache.release.iphone9)...
Personalizing IMG4 component RestoreKernelCache...
Sending RestoreKernelCache (16107740 bytes)...
Waiting for device to enter restore mode...
ERROR: Device failed to enter restore mode.
Please make sure that usbmuxd is running.
But the device does boot in recovery mode, I tried running it as root and starting but saw this
sudo usbmuxd -f -U root
[23:12:27.342][3] usbmuxd v1.1.2 starting up
[23:12:27.342][3] Using libusb 1.0.23
[23:12:27.345][3] Initialization complete
libusb: error [udev_hotplug_event] ignoring udev action bind
libusb: error [udev_hotplug_event] ignoring udev action bind
Can you try to build libusb, libplist, libimobiledevice-glue, libusbmuxd, usbmuxd, libimobiledebice, libirecovery and idevicerestore from source and try again
You are Using libusb 1.0.23 however your issue is fixed by mor recent version
Oops didn't notice that
I'm now using libusb 1.0.26
Still the same now the command was
sudo idevicerestore --latest --erase -d
The log
Received SHSH blobs
DEBUG: tss_response_get_path_by_entry: No entry 'iBEC' in TSS response
NOTE: No path for component iBEC in TSS, will fetch from build_identity
Extracting iBEC.d10.RELEASE.im4p (Firmware/dfu/iBEC.d10.RELEASE.im4p)...
Personalizing IMG4 component iBEC...
Tag found
Sending iBEC (555160 bytes)...
Waiting for device to disconnect...
irecv_event_cb: device 001665dc38f020a6 (udid: N/A) disconnected
Waiting for device to reconnect in recovery mode...
irecv_event_cb: device 001665dc38f020a6 (udid: N/A) connected in Recovery mode
opening device 05ac:1281...
found device with ECID ---------------
Setting to configuration 1
Setting to interface 0:0
Recovery Mode Environment:
iBoot build-version=iBoot-7459.102.5
iBoot build-style=RELEASE
Sending RestoreLogo...
DEBUG: tss_response_get_path_by_entry: No entry 'RestoreLogo' in TSS response
NOTE: No path for component RestoreLogo in TSS, will fetch from build_identity
Extracting applelogo@2x~iphone.im4p (Firmware/all_flash/applelogo@2x~iphone.im4p)...
Personalizing IMG4 component RestoreLogo...
Tag found
Sending RestoreLogo (13547 bytes)...
DEBUG: AVE is loaded by iBoot.
DEBUG: tss_response_get_path_by_entry: No entry 'AVE' in TSS response
NOTE: No path for component AVE in TSS, will fetch from build_identity
Extracting AppleAVE2FW_H9.im4p (Firmware/ave/AppleAVE2FW_H9.im4p)...
Personalizing IMG4 component AVE...
Tag found
Sending AVE (1064499 bytes)...
DEBUG: RestoreTrustCache is loaded by iBoot.
DEBUG: tss_response_get_path_by_entry: No entry 'RestoreTrustCache' in TSS response
NOTE: No path for component RestoreTrustCache in TSS, will fetch from build_identity
Extracting 078-28753-016.dmg.trustcache (Firmware/078-28753-016.dmg.trustcache)...
Personalizing IMG4 component RestoreTrustCache...
Tag found
Sending RestoreTrustCache (12190 bytes)...
ramdisk-size=0x20000000
DEBUG: tss_response_get_path_by_entry: No entry 'RestoreRamDisk' in TSS response
NOTE: No path for component RestoreRamDisk in TSS, will fetch from build_identity
Extracting 078-28753-016.dmg (078-28753-016.dmg)...
Personalizing IMG4 component RestoreRamDisk...
Tag found
Sending RestoreRamDisk (113832326 bytes)...
DEBUG: tss_response_get_path_by_entry: No entry 'RestoreDeviceTree' in TSS response
NOTE: No path for component RestoreDeviceTree in TSS, will fetch from build_identity
Extracting DeviceTree.d101ap.im4p (Firmware/all_flash/DeviceTree.d101ap.im4p)...
Personalizing IMG4 component RestoreDeviceTree...
Tag found
Sending RestoreDeviceTree (36740 bytes)...
DEBUG: tss_response_get_path_by_entry: No entry 'RestoreSEP' in TSS response
NOTE: No path for component RestoreSEP in TSS, will fetch from build_identity
Extracting sep-firmware.d101.RELEASE.im4p (Firmware/all_flash/sep-firmware.d101.RELEASE.im4p)...
Personalizing IMG4 component RestoreSEP...
Tag found
Sending RestoreSEP (1476216 bytes)...
DEBUG: tss_response_get_path_by_entry: No entry 'RestoreKernelCache' in TSS response
NOTE: No path for component RestoreKernelCache in TSS, will fetch from build_identity
Extracting kernelcache.release.iphone9 (kernelcache.release.iphone9)...
Personalizing IMG4 component RestoreKernelCache...
Tag found
Sending RestoreKernelCache (16107740 bytes)...
DEBUG: Waiting for device to disconnect...
irecv_event_cb: device 001665dc38f020a6 (udid: N/A) disconnected
Waiting for device to enter restore mode...
irecv_event_cb: device 001665dc38f020a6 (udid: N/A) connected in Recovery mode
ERROR: Device failed to enter restore mode.
Please make sure that usbmuxd is running
Started usbmuxd as
sudo usbmuxd -f -U root
[12:34:40.240][3] usbmuxd v1.1.2 starting up
[12:34:40.242][3] Using libusb 1.0.26
[12:34:40.246][3] Initialization complete
Now that you ran with -d we can see that the restore mode problem actually seems to be something else: the device doesn't even reach restore mode but goes back to recovery mode. Does the device show the Apple logo with an empty progress bar? How long is the delay between
Waiting for device to enter restore mode...
and
irecv_event_cb: device 001665dc38f020a6 (udid: N/A) connected in Recovery mode
?
Its almost instant, I see an apple logo, a very fast loading spinner and bam Back in recovery mode, and the error
Ok now we know it's not a problem with usbmuxd at least. It also doesn't show up in usbmuxd log output. However since it has a spinner showing it is definitely past recovery mode, so the component signing/stitching seems ok. Unfortunately this is really hard to figure out, since we don't know what it is the device isn't happy about...
Same issue as https://github.com/libimobiledevice/idevicerestore/issues/415 there was a patch which increased the time idevicerestore waits for the device to enter restore mode, but I can't find it
Oh right, I remember. I don't recall a patch though. idevicerestore waits 120 seconds for the device to enter restore mode, but the device re-enters recovery mode so this won't have any effect changing that. I updated the title of this ticket reflecting the actual problem. Maybe we can find out what's wrong with a serial cable to see some log output from the device, but I assume you don't have something like that at hand...
Also can you try a restore on macOS or Windows via iTunes? If that also fails the device is to blame for some weird reason...
Uhhh that's one of those "unknown errors" which no obvious solution, but it might be either the device or the usb cable. Could also be the lightning port. Seems like there's nothing else we can do from the software side unfortunately 😕
Can idevicerestore produce more debug data (does it have a --enable-debug) option with configur
No it's already printing all it can with -d. Only difference is if you build libimobiledevice with --enable-debug it will print libimobiledevice communication debugging too, but at the point of failure this is all in recovery mode so that won't help.
encountered this same exact issue.
While compiling from source and installing the dependencies, i installed usbmuxd 1.1.1 which was the latest from my package manager.
even though I did compile usbmuxd, which is currently at version 1.1.2 from source, it was being shadowed by the older version 1.1.1
so the fix for me was ensuring usbmuxd was verion 1.1.2
Glad you're issue is fixed @nikias as a package maintainer, can every libimobiledevice tool be built statically Would you mind a pr which made the version flag show what commit each tool was linked against
encountered this same exact issue. While compiling from source and installing the dependencies, i installed
usbmuxd 1.1.1which was the latest from my package manager. even though I did compileusbmuxd, which is currently at version1.1.2from source, it was being shadowed by the older version1.1.1so the fix for me was ensuringusbmuxdwas verion1.1.2
Where can I get this version 1.1.2 ? The libimobiledevice version is at 1.1.1 only.
If you are on archlinux, you need to install all tools from AUR using the -git versions, and ensure you are installing the libraries first, then usbmuxd-git and finally idevicerestore-git, the order is important because otherwise it will use older version to build.
I have the same error, and I installed it from the AUR with the git packages, installed in that order, with clean builds.sudo usbmuxd -v -f -U root does not detect the device.
I tried sudo idevicerestore --erase --latest --debug. It is worth noting I also downloaded the latest firmware and tried that to no avail. The older versions of firmware aren't signed and thus don't work.
I am using an Apple TV 2, version A1378. On macOS Catalina and Windows 11, I get the error code 1603 consistently. To my knowledge, this cable supports data transfer, so I don't quite know what that error is on about...
It is worth noting - this is detected in lsusb, but not lsblk, which might have to do with why usbmuxd doesn't work. I also tried usbmuxd as my username and got nothing.
I did try sudo irecovery --shell and typed in the commands on the README to see if I could get it out of recovery mode. I ended up getting no output the first time, and upon restarting the shell I got this right above the shell:
loaded ramdisk at 0x48000000 of size 0x87b000, from image at 0x40000000
loaded device tree at 0x47f00000 of size 0xc070, from image at 0x40000000
Attempting to validate kernelcache @ 0x40000000
Loading kernel cache at 0x44000000
Adler32 mismatch
error loading kernelcache
This output from the shell is not consistent, and no commands that I run within it work.
If it's relevant, the iBoot version is BUILD_TAG: iBoot-1219.62.15 which tells me it is Build 9B176 and iOS 5.1. The closest build I can get to that is 9B179b, but what matters is that it's iOS 5.1 and it'd be restoring to 7.1.2 or 6.1.4, if this is relevant of course.
Between it being listed in lsusb but not lsblk, an inability to get the kernel even though RAM, device tree (which iirc is in the firmware for apple devices? might be wrong) etc. work, and the 1603 error suggesting that USB doesn't work even though these USB cables are indeed functional, I have a strong suspicion it is the internal storage that is dead. I do want to try and see if this is indeed the case though, or if it is possible to restore it still.
