Odysseus Tutorial: Downgrade iPhone 4S, 5. Requires SHSH Blobs! + How to dump on device blobs
This requires Mac OSX or Linux. The windows port of odysseus is broken for now.
In this video I'm going to show you how to use the Odysseus tool to downgrade your 32Bit Apple devices (iPhone 4S, 5, 5c and 32bit iPads) to firmwares that are not being signed by Apple anymore, if you have saved your SHSH blobs.
However, if you just want to restore to the firmware you currently are, then you can dump the blobs from the device and restore to the firmware. This is what I will be doing in the video for my iPhone 4s on iOS 7.1.2. Restoring it to the same firmmware even when Apple is not signing it anymore.
There is also a way to downgrade the iPhone 4S and iPad 2 to iOS 6.1.3 even without blobs. If you are interested in that, you will need to use a different (but similar) tool called OdysseusOTA. There are many tutorials on that tool here on YouTube.
1) Go to the Odysseus website and download it: http://dayt0n.com/articles/Odysseus/
2) Download the firmware you want to restore to from http://ipsw.me
3) Open up a Terminal and navigate to the odysseus folder using:
cd Desktop/User/odysseus-0.999.0
where User should be your username
4) Dump your baseband:
./sshtool -s baseband.tar -p 22 deviceIP
where deviceIP should be your device's wifi IP that can be found in the wifi settings
5) Create a custom firmware out of your original firmware:
./ipsw Downloaded_Firmware_file.ipsw custom.ipsw -memory baseband.tar
6) Extract the iBSS:
./xpwntool `unzip -j custom.ipsw 'Firmware/dfu/iBSS*' | awk '/inflating/{print $2}'` pwnediBSS
Now if you already have the SHS blobs of thefirmware you want to restore to, skip to {time}
Otherwise to dump the blobs from your device use:
7) Extract the iBEC:
mv `unzip -j custom.ipsw 'Firmware/dfu/iBEC*' | awk '/inflating/{print $2}'` pwnediBEC
8) Boot into PWNed mode:
./sshtool -k ../kloader -b pwnediBSS -p 22 deviceIP
9) Boot into PWNed recovery mode:
./irecovery -f pwnediBEC
10) Exit out of iTunes completely using (capitalisation matters):
killall iTunesHelper
11) Time to grab the blobs... Connect to the device with irecovery and run some commands:
./irecovery -s
Now from irecovery type:
/send ../payload
Press Enter and then type:
go blobs
Press Enter and then type:
/exit
Dump the blobs:
./irecovery -g myblob.dump
And then reconnect with irecovery to reboot:
./irecovery -s
Just type:
reboot
12) Validate your blobs using the following commands:
./ticket myblob.dump myblob.plist custom.ipsw -z
WARNING: If you see ANY errors here, STOP and dump your blobs again. Otherwise, run:
./validate myblob.plist custom.ipsw -z
Again: If you see ANY errors, STOP and dump your blobs again.
If the blobs seem usable, you are good to go!
12) Rename your blob.plist file to "ECID-iDeviceModel-Version.shsh" (not .plist) and put it in the shsh folder.
13) Time to restore! (Finally....) Boot into PWNed DFU:
./sshtool -k ../kloader -b pwnediBSS -p 22 deviceIP
14) Wait for iTunes to recognise your phone into DFU mode and then kill itunes:
killall iTunesHelper
15) Restore!
./idevicerestore -d -w custom.ipsw
16) Wait for it to finish (it will ~10 minutes) and your phone should reboot and be on the setup screen of your fresh firmware. Congratulations!
Keep your SHSH blobs in case you need to restore again in the future. Without them it's not possible.
If you have any questions let me know in the comments and I'll try my best to answer. I hope this video helped ou a little bit on using Odysseus. The process seems complex, but if you follow the steps one by one everything will be fine. In the video it was also my first time doing this, so there is nothing to worry about. Cheers!