Legacy iOS Kit
- (formerly iOS-OTA-Downgrader)
- A multi-purpose script to downgrade/restore, save SHSH blobs, and jailbreak legacy iOS devices
- Supported on Linux and macOS
- Read the "How to Use" wiki page for instructions
- Read the "Troubleshooting" wiki page for tips, frequent questions, and troubleshooting
Features
- Restore to iOS 8.4.1 or 6.1.3 on supported 32-bit devices (OTA signed)
- Restore iPhone 4 GSM and CDMA (iPhone3,1 and 3,3) to lower iOS versions (powdersn0w)
- Restore iPhone 3GS and iPod touch 2 to lower iOS versions (24Kpwn/alloc8)
- Restore 32-bit devices to lower iOS versions with SHSH blobs
- Restore 32-bit devices to lower iOS versions with iOS 7.1.x blobs (powdersn0w)
- For iPhone 5 (not 5C), 7.0.x blobs can also be used
- Device support is limited, see below
- Option to jailbreak all supported 32-bit devices
- Available on iOS versions 3.1.3, 3.2.2, 4.x, 5.x, 6.x, 7.x, 8.x
- Only unsupported version is jailbreaking iPad 2 on 4.3.x
- There are two methods of jailbreaking: Custom IPSW and SSH Ramdisk
- Restore to iOS 10.3.3 on supported A7 devices (OTA signed)
- Restore A7/A8 devices to lower iOS versions with SHSH blobs
- Limited compatibility due to SEP/BB, see below
- The latest baseband will be flashed for 32-bit devices if applicable
- Save onboard and Cydia SHSH blobs for 32-bit devices
- Place device to pwned iBSS/kDFU mode for supported devices
- Boot SSH Ramdisk on supported 32-bit devices
- Clear NVRAM for devices that support powdersn0w
- Device activation using ideviceactivation
- Dumping and stitching baseband to IPSW (requires
--disable-bbupdate) - Dumping and stitching activation records to IPSW (requires
--activation-records) - Hacktivation for iPhone 3GS (activate without valid SIM card)
Supported devices
- Identify your device here
- iPhone 5C and iPad mini 3 devices are NOT supported by OTA downgrades
- These devices still support restoring to other iOS versions with SHSH blobs, see below
- See the table below for OTA downgrading support:
| Target Version | Supported Devices |
|---|---|
| iOS 10.3.3 | A7 devices: |
| iPhone 5S | |
| iPad Air 1 | |
| iPad mini 2 (except iPad4,6) | |
| iOS 8.4.1 | 32-bit devices: |
| iPhone 4S | |
| iPhone 5 | |
| iPad 2, iPad 3, iPad 4 | |
| iPad mini 1 | |
| iPod touch 5 | |
| iOS 6.1.3 | iPhone 4S |
| iPad 2 (except iPad2,4) |
- Restoring with SHSH blobs and using SSH Ramdisks are supported on the following devices:
- Supports most 32-bit devices (iOS 3 to 10, version range depends on device)
- iPhone 3GS, 4, 4S, 5, 5C
- iPad 1, 2, 3, 4, mini 1
- iPod touch 2, 3, 4, 5
- S5L8900 devices are not (yet) supported
- Restoring with SHSH blobs is also supported on most A7/A8 devices:
- See SEP/BB Compatibility Chart for iOS versions
- iPhone 5S, 6, 6 Plus
- iPad Air 1, mini 2, mini 3
- iPod touch 6
- Restoring with powdersn0w is supported on the following devices:
- iPhone 4 GSM - targets iOS 4.3 to 6.1.3
- iPhone 4 CDMA - targets iOS 5.0 to 6.1.3
- iPhone 4S, 5, 5C, iPad 2 Rev A, iPod touch 5 - targets iOS 5.0 to 9.3.5 (not iOS 7)
- Using powdersn0w requires iOS 7.1.x blobs for your device (7.0.x can also be used for iPhone 5)
- Restoring with 24Kpwn/alloc8 is supported on the following devices:
- iPhone 3GS - targets iOS 3.1.3 to 5.1.1
- iPod touch 2 - targets iOS 3.1.3 to 4.0
- Restoring to latest iOS version with jailbreak for the following devices:
- iPhone 4 - iOS 7.1.2 with Pangu
- iPhone 3GS, iPod touch 4 - iOS 6.1.6 with p0sixspwn
- iPad 1, iPod touch 3 - iOS 5.1.1 with pris0nbarake
- iPod touch 2 - iOS 4.2.1 with greenpois0n
Supported OS versions/distros
Supported architectures: x86_64, arm64, armhf
- Ubuntu 22.04 and newer, and Ubuntu-based distros like Linux Mint
- Arch Linux and Arch-based distros like EndeavourOS
- Fedora 37 and newer
- Debian 12 Bookworm and newer, Sid, and Debian-based distros
- openSUSE Tumbleweed
- Gentoo and Gentoo-based distros
- macOS 10.13 and newer
Tools and other stuff used
- curl
- bspatch
- powdersn0w_pub - dora2ios; LukeZGD fork
- ipwndfu - axi0mX, Linus Henze, synackuk; LukeZGD fork
- ipwnder_lite - dora2ios (used on macOS)
- iPwnder32 - dora2ios (old version with libusb used on Linux)
- gaster - 0x7ff
- daibutsuCFW - dora2ios; LukeZGD fork
- daibutsu - dora/kok3shidoll, Clarity
- libimobiledevice - libimobiledevice
- libirecovery - libimobiledevice
- libideviceactivation - libimobiledevice
- tsschecker - tihmstar; 1Conan fork v413
- futurerestore - tihmstar;
- LukeZGD fork used on Linux for restoring 32-bit devices
- LukeeGD fork used on Linux for restoring A7/A8 devices
- iBoot32Patcher - dora2ios fork
- idevicerestore - libimobiledevice; LukeZGD fork
- idevicererestore from daibutsuCFW (used on custom IPSW restores for A5/A6 devices)
- kloader from Odysseus
- kloader from axi0mX (used on iOS 4 only)
- kloader for iOS 5
- kloader_hgsp from nyan_satan (used on h3lix only)
- jq
- partialZipBrowser
- zenity; macOS build
- 32-bit bundles from OdysseusOTA, OdysseusOTA2, alitek12, gjest (modified bundles for daibutsuCFW)
- A7 patches from MatthewPierson
- iPad 2 iOS 4.3.x bundles from selfisht, Ralph0045
- sshpass
- Bootstrap tar from SpiritNET
- Cydia HTTPatch for 3.1.3 downgrades/jailbreaks
- Pangu
- p0sixspwn
- unthredeh4il
- evasi0n
- pris0nbarake - LukeZGD fork
- Corona and Rocky Racoon
- greenpois0n
- Some patches from PwnageTool, sn0wbreeze, redsn0w
- SSH Ramdisk tar from SSH-Ramdisk-Maker-and-Loader and msftguy's ssh-rd