How To Downgrade section!
In this section you will learn how to downgrade your iPhone, iPod
Touch, iPad and Apple TV to a lower firmware version (e.g. iOS 6, iOS 5, iOS 4) than the one you are currently running. Additionally, you will also learn the best way to save your SHSH blobs
which will allow you to downgrade your iPhone, iPad, iPod Touch and
Apple TV firmware version in the future. Simply scroll through our How To Downgrade
section for the firmware version you are trying to downgrade to, and
read one of our easy to follow how to guides on downgrading your iPhone,
iPod Touch, iPad, Apple TV or even PlayStation.
Note #1: We will be updating this page with the
latest how to downgrade guides when new firmware versions are released,
so make sure you come back soon!
Note #2: This is not some magical section of guides
that will allow you to downgrade your iPhone, iPod Touch, iPad or Apple
TV 2G without having your SHSH blobs saved for prior firmware versions.
Meaning you had to have saved your SHSH blobs for the firmware version
you are trying to downgrade to, or downgrading will not work.
How Apple Prevents Downgrading
Downgrading your iPhone, iPod Touch or iPad to a lower firmware
version is indeed possible, but unfortunately has become harder and
harder over the years. In the early days you could downgrade your
iOS device to any firmware version you wanted to and not run into many
troubles. This is because firmware restores never had to be approved by
Apple, but starting from iOS 3.0 onwards Apple implemented a technology
called
SHSH blob.
What Is An SHSH Blob?
You see, when you restore your iPhone, iPod Touch or iPad through
iTunes your device phones home and ensures that it is allowed to be
restored to a specific firmware version. In order to enforce this
limitation
SHSH blobs were introduced,
which is a hash signature system. Although this is getting technical,
an SHSH is created by an SHSH formula with 3 or 4 TSS keys (say with
me).
- The device model (example: iPhone 4 GSM)
- The firmware version being signed (example: 6.0.1)
- The device’s ECID, a unique identifier for every Apple device.
On every device shipped by Apple a Plist file is present, this file contains
SHSH blobs
for different parts of the firmware. These blobs are essentially
gatekeepers and control whether or not a firmware is restorable.
Whenever you upgrade or downgrade your iPhone, iPod Touch or iPad, new
SHSH blobs have to be generated because one of the parts to the SHSH
formula is the firmware version.
In order to prevent firmware restores Apple only signs one firmware
version at a time, which is obviously the latest firmware version
available. If you try to restore to a lower firmware version, you will
get an error because Apple is not signing that specific firmware version
anymore. What is happening is Apple refuses to generate the new hash
during the downgrade, meaning the new SHSH blobs cannot be generated.
What Is An APTicket?
In case this wasn’t a big enough limitation to downgrading iOS devices, in the iOS 5 firmware generation
Apple introduced yet another technology to prevent downgrading called APTickets.
What APTickets are
is essentially the next generation of SHSH blobs. APTickets are much
more secure however, because when you try to restore or upgrade your
iPhone, iPod Touch or iPad a request is sent to Apple’s servers to
confirm the APTicket. Unlike SHSH blobs which would submit the same one
already stored on the server, a brand new APTicket is generated using a
random string. In the future APTickets will completely replace SHSH
blobs, this will happen once the iPhone 4S stops being supported.
How To Go About Downgrading
The good thing is there is indeed still a way to downgrade your iPhone, iPod Touch, iPad or even Apple TV, but it relies on you
saving SHSH blobs.
You see, when Apple is still signing a firmware version you can save
the SHSH signature so that in the future if you wish to downgrade back
to that firmware version it is indeed possible. This is essentially
performing a replay attack, in the fact that data is being fraudulently
retransmitted.
If you are Jailbroken then most of the times your SHSH blobs are
already saved on Cydia’s server automatically and you shouldn’t have to
back them up manually. Sometimes Cydia doesn’t back up your SHSH blobs
on your Jailbroken device however, and you might even prefer to do a
local backup of your SHSH blobs. To do this you can use tools like
TinyUmbrella (
download here) and iFaith (
download here). It is important to keep in mind that these tools can even save the SHSH blobs of non-Jailbroken devices.
Once you have your SHSH blobs signed, as stated previously, if you
upgrade to a new firmware version and decide you don’t like it you can
downgrade back to the firmware version which you have saved SHSH blobs
for. There is unfortunately some restrictions that need to be kept in
mind though.
iOS Downgrading Restrictions
For the most part, older iOS devices with an A4 chip can be
downgraded to any firmware version as long as you have saved SHSH blobs
and APTickets. This includes the iPhone 2G, iPhone 3G, iPhone 3GS,
iPhone 4, iPad 1G, iPod Touch 1G, iPod Touch 2G, iPod Touch 3G and the
iPod Touch 4G.
Newer devices like the iPad 2, iPad 3, iPhone 4S, iPhone 5 and iPod
Touch 5G has different restrictions however, because they are not
vulnerable to the limera1n exploit and are governed more-so by
APTickets. These devices can only be downgraded on the iOS 5 firmware
generation and require saved SHSH blobs and APTickets for the iOS 5
firmware version you are currently running and are trying to get to. The
only exception to this is that iPad 2 owners with any saved iOS 4
firmware generation SHSH blobs can downgrade to to any firmware that
they also have saved SHSH blobs for. Downgrading devices with the A5,
A5X and A6 chip on the iOS 6 firmware generation is not possible at this
time.
Just like how Jailbreaking is becoming more and more difficult on
newer Apple devices, so is downgrading. As new exploits are constantly
being found however, keep an eye on our list of how to guides shown
below that will give you step-by-step instructions on how to downgrade
your iPhone, iPod Touch, iPad or Apple TV to a lower firmware version.
If you are looking for more information on how to save SHSH blobs and
APTickets you will want to visit our
How To Save SHSH Blobs section.
Note: Keep in mind that if you find a guide for a
previous firmware version and don’t see one for your current situation,
most of the time these guides are all-purpose. This means that the
instructions are the same for all firmware versions, so you can usually
just follow the instructions and just use the firmware versions for your
current situation.
Downgrade iOS 6.0.1 To iOS 5.1.1
Downgrade iOS 6.0 To iOS 5.1.1
Re-Restore A5 Devices On iOS 5.x
Downgrade iOS 5.1 To iOS 5.0.1 / iOS 5.0
Downgrade iOS 5.1 To iOS 4.3.5 / iOS 4.3.3 / iOS 4.x
Downgrade iOS 5.0.1 To iOS 5.0
Downgrade iOS 5 To iOS 4.3.3
Downgrade iOS 4.3.5 To iOS 4.3.3
Downgrade iOS 4.3.4 To iOS 4.3.3
Downgrade iOS 4.3.3 To iOS 4.3.2
Downgrade iOS 4.3.3 To iOS 4.3.1
Downgrade iOS 4.3.3 To iOS 4.3.0
Downgrade iOS 4.3.3 To iOS 4.1
Downgrade iOS 4.0.2 To iOS 4.0.1
Downgrade iOS 4.0 To iOS 3.1.3
Downgrade iOS 3.1.3 To iOS 3.1.2
