This article discusses software internally used by Apple.
Acquiring a copy without Apple's consent is illegal and may result in being scammed.
|Adham Hurani, Yaron Abramovich, Andrey Greenfield
(latest known version)
AirSwitch (stylized as
airswitch) is a modern replacement of the iOS Restore Tool.
The software requires use of a Kanzi cable to connect to Apple devices running internal firmware and will display an "unauthorized cable" error (an additionally an "incompatible device" error in v1.012 if used with production firmware) if the user attempts to use a standard lightning cable.
AirSwitch does not use IPSWs to restore devices like PurpleRestore. Instead, it uses OTA bundles to upgrade and downgrade devices which can be manually downloaded or retrieved from AppleConnect as long as the user has access to the server. It also has a demo mode which will simulate connected devices, as seen in the screenshot to the right, which will allow one to try the software before using it on actual devices. Interestingly, this feature was removed, and as of v1.012 simulation mode is no longer present. The software was originally leaked to the public by YRH04E who tweeted a picture of it in July 2019.
It is important to note that unlike PurpleRestore, AirSwitch cannot restore a device that cannot boot. In fact, AirSwitch will tell you to use PurpleRestore (interestingly it's stylized as Purple Restore) to restore the device first. (See Gallery) This, among with the other device requirements can be found by hovering over "Can I use AirSwitch?", which is not present in versions before v1.012. The content of this popup can be found below, and a screenshot can be found in the Gallery.
To use AirSwitch please ensure:
- Device is a dev-fused device
- Device has an Apple Internal OS installed
- Device has an active connection to Apple Internal network
- Device is connected to the Mac with a valid Kanzi cable
- Device boots properly
If you connect a device that is production fused rather than development fused, it will be marked with the P icon shown on the left.
(This is supported by the fact that this icon is named
When opening AirSwitch's executable in Terminal, the logs show that it attempts to connect to a server with the URL https://hdc-appstat.euro.apple.com:9001/applications/AirSwitch/sessions[dead link] (inaccessible without AppleConnect VPN Access), and sends the following information about the computer:
- AppleConect username
- Country code and name
- Disk info (output of
df -l -H)
- Host name
- Process Name ("AirSwitch")
- Geolocation (Country name and timezone)
- Model Identifier
- OS version and build number
- Screen size
The main screen shown when no device is connected
A message showing the requirements for using AirSwitch
The message shown for a device connected in DFU mode
The message shown when a device not running internal firmware is connected