futurerestore is a tool to downgrade, upgrade, and/or restore to unsigned versions of iOS, iPadOS, and tvOS. Contrary to popular belief, futurerestore in itself is not a restoring tool, rather a wrapper for idevicerestore that allows manually specifying the SEP and Baseband firmwares for restoring.
|Developer(s)||tihmstar, Cryptic, Adam (m1stadev)|
|Initial release||14 September 2016|
194 (macOS, Windows, Linux) / 2 March 2021
|Operating system||macOS / Windows / Linux|
FutureRestore most commonly uses the Prometheus method, which utilises a replay attack in Apple's APTicket restore verification system. Any APTicket depends on the following conditions to be consistent with the device the ticket is being used to restore:
If any of the following conditions are not met, the replay attack will fail and the AP will refuse to flash the firmware onto the device.
The following are requirements in order to use futurerestore:
- A valid APTicket for your device and firmware version you want to restore to.
- The IPSW of the target firmware that you want to restore to for your device
- A way to set your device's boot-nonce (see note below)
- A signed SEP and Baseband which is compatible [Archived 2022-03-16 at the Wayback Machine] with the target firmware for your device
- If your device uses an Apple A11 or older, you can use ipwndfu and libirecovery[dead link] to upload a pwned iBSS and set your boot nonce,
but all newer devices using an Apple A12 or newer must use a jailbreak to set their boot nonce, as it is entangled with the UID Key.
- The SEP and Baseband firmware MUST be compatible with the firmware version you are restoring to or the restore will fail.
futurerestore has several options, these include:
--update: This option keeps user data. It should generally not be used when downgrading as it may lead to various issues, including corrupted [/var] leading to a recovery mode loop.
--no-baseband: This option does not flash a baseband. It should only be used for iPods and WiFi-only iPads.
--exit-recovery: This option exits the device out of recovery mode.
--wait: This option Keeps rebooting the device until the ApNonce matches the APTicket. It's meant for legacy devices on older iOS versions. You have a practically zero chance of hitting a collision on modern devices and iOS versions.
--sep [PATH]: this option allows you to manually specify SEP. SEP files are usually named in this format:
sep-firmware.(boardconfig).RELEASE.im4pand can usually be found in the
/Firmware/all_flash/directory of an IPSW. after typing
-s /path/to/sep.im4p, you must also type
--baseband: this option allows you to manually specify Baseband. baseband files usually begin with MAV/ICE and end in .bbfw. They're usually found in the /Firmware/ directory in IPSW files. After using
-b /path/to/baseband.bbfw, you must also type
There are two main ways to use futurerestore, CLI and GUI.
Newer test builds are available from the test branch. This may be needed for some A14 devices and Wi-Fi only iPads. In order to get the newer builds, open the test branch link, press on the newest workflow run, scroll down to "artifacts" and choose the one appropriate for your OS.
Open a terminal or command prompt, then write in the following command:
/path/to/futurerestore -t /path/to/ticket.shsh2 --latest-sep --latest-baseband -d /path/to/firmware.ipsw
-dis optional, it may be harder to troubleshoot without it, as it gives more information on what's happening.
- Instead of
--latest-baseband, you can also specify the SEP and baseband you want to use, however it still needs to be signed, and you have to manually download the IPSW and extract it. This is rarely ever necessary, as iOS versions older than the latest are generally unsigned within a week nowadays. See the options section above to learn more about manually specifying SEP and BB
Download FutureRestore-GUI then select the IPSW and SHSH2 blobs. It's recommended to have "Extra logs" enabled so we can better help diagnose any issues. If you are upgrading or re-restoring, it's ok to turn on "Preserve Data", however make sure to restore rootfs before doing so.
|194||2 March 2021||
|193||1 March 2021||
|189||13 February 2021||