UnboundGodz
Local Celebrity
Retired Staff
CC Dev Team
Local Celebrity
Community Elite
Community Veteran
Determined Poster
Active Member
Console ID Poster
So, you probably are looking to downgrade/restore to a unsigned version on your iDevice. And you have your .shsh2 blobs, which is good because your generated nonce should be within the one you plan to downgrade/restore to.
In order to locate your generated nonce, you can either change the .shsh2 extension of your blob to .plist, maybe even .txt and open the document to read it. Or, you can leave it as .shsh2 and use Ultra Edit application to read it. Scroll about halfway through the document, or search for the word "generator", the string underneath or next to it will be your generated nonce. You can also take your blob and upload it to this site, http://jailbreakstatus.com/downgrade/gen_finder/ it will also show you your generated nonce to.
(My generated nonce is 0x911f9..... Make sure to save it.)
Now that you have your nonce, we need to be able to set it on your iDevice. Being that this is most likely your first time attempting this, you probably dont have your permissions patched to allow this change, lets fix that. First we will want to download these files (), then use Terminal to remotely connect to your iDevice through SSH. To be able to SSH to your iDevice, you will need OpenSSH, so in Cydia on your iDevice search for OpenSSH and install it. After that, go into Settings>General>Wifi and write down your iDevice IP Address. Now that you have OpenSSH installed and your iDevice IP Address, we can now connect to your iDevice to install the "nvpatch" file.
First, open a Terminal window, now type "cd" and then drag the folder that has your 'nvpatch' file into Terminal, so the Terminal will open in that directory. Now that your Terminal is active in that directory, you can send the file to the root of your iDevice. In order to first push the file or scp file to your iDevice, you will need to type this: "scp nvpatch root@iDevice_IP_Address:"
(Remember the colons after the IP address). It will then ask for a password, and if you didnt change it, it should be "alpine" by default. The file should begin basically an instant transfer, once done. We can gain root access of the iDevice by typing, "ssh root@iDevice_IP_Address", it will ask for a password, by default its "alpine" unless you changed it.
Pushing of 'nvpatch' To iDevice: http://prntscr.com/k44t8e
Now that you have installed the 'nvpatch' file onto your device, you can run it remotely to patch your permissions. Make sure your still connected to your iDevice with root access, and type: "./nvpatch" this will show a list of commands you can run with it (Available 'nvpatch' Commands: http://prntscr.com/k44ssh). When you do use Terminal or MTerminal to check your iDevice's nonce, it may not show up and might even be blank (Before Patch: http://prntscr.com/k44s6a). Today, we want to run "com.apple.System.boot-nonce" to unveil it or give it permissions, type "./nvpatch com.apple.System.boot-nonce" and hit enter. It should then succeed and patch your permissions to allow the nonce to be set/changed (After Patch: http://prntscr.com/k44rw7).
Hope this little tutorial helped you in getting your iDevice 1-step closer to downgrading/restoring to an unsigned version.
Binaries Download: https://github.com/Siguza/ios-kern-utils/releases
DISCLAIMER: YOU ARE MESSING WITH NVRAM AT YOUR OWN RISK, WE ARE NOT RELIABLE!
In order to locate your generated nonce, you can either change the .shsh2 extension of your blob to .plist, maybe even .txt and open the document to read it. Or, you can leave it as .shsh2 and use Ultra Edit application to read it. Scroll about halfway through the document, or search for the word "generator", the string underneath or next to it will be your generated nonce. You can also take your blob and upload it to this site, http://jailbreakstatus.com/downgrade/gen_finder/ it will also show you your generated nonce to.
(My generated nonce is 0x911f9..... Make sure to save it.)
Now that you have your nonce, we need to be able to set it on your iDevice. Being that this is most likely your first time attempting this, you probably dont have your permissions patched to allow this change, lets fix that. First we will want to download these files (), then use Terminal to remotely connect to your iDevice through SSH. To be able to SSH to your iDevice, you will need OpenSSH, so in Cydia on your iDevice search for OpenSSH and install it. After that, go into Settings>General>Wifi and write down your iDevice IP Address. Now that you have OpenSSH installed and your iDevice IP Address, we can now connect to your iDevice to install the "nvpatch" file.
First, open a Terminal window, now type "cd" and then drag the folder that has your 'nvpatch' file into Terminal, so the Terminal will open in that directory. Now that your Terminal is active in that directory, you can send the file to the root of your iDevice. In order to first push the file or scp file to your iDevice, you will need to type this: "scp nvpatch root@iDevice_IP_Address:"
(Remember the colons after the IP address). It will then ask for a password, and if you didnt change it, it should be "alpine" by default. The file should begin basically an instant transfer, once done. We can gain root access of the iDevice by typing, "ssh root@iDevice_IP_Address", it will ask for a password, by default its "alpine" unless you changed it.
Pushing of 'nvpatch' To iDevice: http://prntscr.com/k44t8e
Now that you have installed the 'nvpatch' file onto your device, you can run it remotely to patch your permissions. Make sure your still connected to your iDevice with root access, and type: "./nvpatch" this will show a list of commands you can run with it (Available 'nvpatch' Commands: http://prntscr.com/k44ssh). When you do use Terminal or MTerminal to check your iDevice's nonce, it may not show up and might even be blank (Before Patch: http://prntscr.com/k44s6a). Today, we want to run "com.apple.System.boot-nonce" to unveil it or give it permissions, type "./nvpatch com.apple.System.boot-nonce" and hit enter. It should then succeed and patch your permissions to allow the nonce to be set/changed (After Patch: http://prntscr.com/k44rw7).
Hope this little tutorial helped you in getting your iDevice 1-step closer to downgrading/restoring to an unsigned version.
Binaries Download: https://github.com/Siguza/ios-kern-utils/releases
DISCLAIMER: YOU ARE MESSING WITH NVRAM AT YOUR OWN RISK, WE ARE NOT RELIABLE!
Last edited:
