AirSwitch

From The Apple Wiki
AirSwitch
Original author(s)Apple Inc.
Developer(s)Adham Hurani, Yaron Abramovich, Andrey Greenfield
Stable release
1.012 (19A224)
(latest known version)
Operating systemmacOS
Size3-8 MB
Available inEnglish
TypeFirmware flasher
LicenseClosed source

AirSwitch (stylized as airswitch) is a modern replacement of the iOS Restore Tool. The software requires use of a Kanzi cable to connect to Apple devices running internal firmware and will display an "unauthorized cable" error (an additionally an "incompatible device" error in v1.012 if used with production firmware) if the user attempts to use a standard lightning cable. AirSwitch does not use IPSWs to restore devices like PurpleRestore. Instead, it uses OTA bundles to upgrade and downgrade devices which can be manually downloaded or retrieved from AppleConnect as long as the user has access to the server. It also has a demo mode which will simulate connected devices, as seen in the screenshot to the right, which will allow one to try the software before using it on actual devices. Interestingly, this feature was removed, and as of v1.012 simulation mode is no longer present. The software was originally leaked to the public by YRH04E who tweeted a picture of it in July 2019.

It is important to note that unlike PurpleRestore, AirSwitch cannot restore a device that cannot boot. In fact, AirSwitch will tell you to use PurpleRestore (interestingly it's stylized as Purple Restore) to restore the device first. (See Gallery) This, among with the other device requirements can be found by hovering over "Can I use AirSwitch?", which is not present in versions before v1.012. The content of this popup can be found below, and a screenshot can be found in the Gallery.

To use AirSwitch please ensure:

  • Device is a dev-fused device
  • Device has an Apple Internal OS installed
  • Device has an active connection to Apple Internal network
  • Device is connected to the Mac with a valid Kanzi cable
  • Device boots properly

If you connect a device that is production fused rather than development fused, it will be marked with the P icon shown on the left.
(This is supported by the fact that this icon is named ProductionFuseIcon.tiff in AirSwitch.app/Content/Resources/)

Tracking

When opening AirSwitch's executable in Terminal, the logs show that it attempts to connect to a server with the URL https://hdc-appstat.euro.apple.com:9001/applications/AirSwitch/sessions[dead link] (inaccessible without AppleConnect VPN Access), and sends the following information about the computer:

  • AppleConect username
  • Country code and name
  • Timezone
  • Disk info (output of df -l -H)
  • Host name
  • Process Name ("AirSwitch")
  • Geolocation (Country name and timezone)
  • Model Identifier
  • OS version and build number
  • Screen size
  • Username

Gallery