Downgrade and dualboot status of almost all iOS devices

ios-downgrade-dualboot.md

Downgrade and dualboot status of almost all iOS devices

UPDATED: 2023-12-02

• Reddit mirror: https://www.reddit.com/r/iOSDowngrade/comments/j1x7iv/downgrade_and_dualboot_status_of_almost_all_ios/
• GitHub Gist mirror: https://gist.github.com/LukeZGD/9d781f1b03a69fa46869384a9407a41a
• As of updating this post, there is now a downgrade tool that utilizes a SEP exploit released: https://limefix.tech/?product=limefix-sep-utility-testing
• Here is a futurerestore guide for downgrading with SHSH blobs for 64-bit devices
• How to downgrade checkm8 devices
• Save SHSH blobs for signed versions using blobsaver
• GitHub repo for futurerestore: https://github.com/futurerestore/futurerestore
• Latest futurerestore can be downloaded here: https://nightly.link/futurerestore/futurerestore/workflows/ci/main
• FutureRestore GUI: https://github.com/CoocooFroggy/FutureRestore-GUI
• For latest Windows builds, join the FutureRestore Discord linked in the GitHub repo's README
• While there is a Windows version, futurerestore should be used macOS or Linux only

iOS 17 devices (A12 devices and newer, older A10 iPads)

• Devices that fall under here have the latest version 17.x.
• Delay OTA Guide (updating only): https://ios.cfw.guide/updating-blobless
• Restoring to iOS 16 and lower is not possible.
• You cannot restore to any iOS versions other than signed ones. All SHSH blobs are useless.
• For A10 iPads only:
  • Tethered downgrade/dualboot is an option with sunst0rm and seprmvr64
  • It is technically possible to downgrade to iOS 14-15 with blobs. For advanced users only, see guide linked in compatibility chart
  • Limefix is not yet compatible with A10 devices, wait for updates

iOS 16 devices (A11 devices, older A9 iPads)

• Devices that fall under here have the latest iOS version 16.x.
• Delay OTA Guide (updating only): https://ios.cfw.guide/updating-blobless
• See the SEP/BB Compatibility Chart. iOS 16 SEP/baseband is incompatible with iOS 15 and below.
• For iPhone X, you cannot restore to any iOS versions other than signed ones. All SHSH blobs are useless.
• Tethered downgrade/dualboot is an option with sunst0rm and seprmvr64
• It is technically possible to downgrade to iOS 14-15 with blobs for all these devices except for iPhone X. For advanced users only, see guide linked in compatibility chart

iOS 14-15 devices (A9 and A10 devices, iPad Air 2 and mini 4)

• Devices that fall under here have the latest iOS version 15.x.
• All devices that fall under here are checkm8 devices, they can do pwnDFU restores. See the guide "Downgrade checkm8 devices" above.
• *You may restore to iOS 14.x and 15.x only with futurerestore
• For iOS 13 and lower, check for compatibility with Limefix
  • As of updating this post, Limefix only supports A9 devices and iOS 10, wait for updates for other devices and versions
• For more details about SEP and baseband compatibility, see the SEP/BB Compatibility Chart
• For restoring to unsigned versions of 14.x/15.x with SHSH blobs, use the updated futurerestore beta and/or FutureRestore GUI by CoocooFroggy (links above).
• Tethered downgrade/dualboot is also an option with sunst0rm and seprmvr64

iOS 12 devices (A7 and A8 devices except iPad Air 2 and mini 4)

• Devices that fall under here have the latest iOS version 12.5.7.
• You can downgrade to as low as 11.3 with futurerestore if you have SHSH blobs - You can downgrade with SHSH blobs using Legacy iOS Kit's "Other" option
• Tethered downgrade is also an option with sunst0rm
• Limefix is not yet compatible with these devices, wait for updates

A7 devices (iPhone 5S, iPad Air 1, iPad mini 2)

• A7 devices (except iPad4,6 and all iPad mini 3 models) can downgrade to 10.3.3 without blobs, using Legacy iOS Kit or LeetDown
  • Unfortunately checkm8 is very unreliable on Linux, so using macOS may be the better option with iPwnder32/ipwnder_lite used for better success rates
  • iPwnder Lite for iOS can also be used to put device in pwned DFU
• You can also downgrade to 10.2-10.3.2 with futurerestore if you have SHSH blobs
  • You can go as low as 10.1.x but Touch ID will not work
  • You can downgrade with SHSH blobs using Legacy iOS Kit's "Other" option
• You can also downgrade tethered to iOS 7: https://ios7.iarchive.app

A5, A5X, A6, and A6X devices

• Devices that fall under here have the latest iOS version 9.3.5, 9.3.6, 10.3.3, or 10.3.4.
• You can downgrade and jailbreak any of these devices (except for iPhone 5C) to iOS 8.4.1 using Legacy iOS Kit without blobs
  • For iPhone 4S and iPad 2 (except iPad2,4) devices, iOS 6.1.3 is also an option
• You can downgrade to any iOS version that you have SHSH blobs for using Legacy iOS Kit's "Other" option
• You can also save on-board SHSH blobs with Legacy iOS Kit's "Save Onboard Blobs" option
• If you have iOS 7 SHSH blobs, you can do untethered downgrades using Legacy iOS Kit
• You can also dualboot to any version using Coolbooter
• You can dualboot to iOS 4.3.x using 4tify-iPad2 (iPad 2 only, macOS only)
• You can downgrade tethered without blobs using Legacy iOS Kit, n1ghtshade, or Deca5
  • Both n1ghtshade and Deca5 are for macOS only

iPhone 4

• You can downgrade to iOS 6, 5, or 4 untethered using Legacy iOS Kit
  • Only iPhone3,1 (GSM) and iPhone3,3 (CDMA) are supported
• You can also use Legacy iOS Kit to downgrade with saved SHSH blobs (see above)
• You can also use GeekGrade to do tethered downgrades
  • Legacy iOS Kit supports restoring GeekGrade IPSW for iPhone3,2. Get the IPSW at: https://archives.legacyjailbreak.com
  • Restoring GeekGrade IPSW by going to: Restore/Downgrade -> Other (Custom IPSW)
  • Do a tethered boot by going to: Other Utilities -> Just Boot
• You can dualboot to any version except 4.x using Coolbooter
• You can dualboot to 4.x using 4tify (macOS only)
  • 4tify for Linux (untested): https://github.com/LukeZGD/4tify-linux

iPod touch 4th gen

• There are no untethered downgrade options without blobs, unfortunately.
• iPod touch 4th gen can be tethered upgrade to iOS 7: https://albyvar.github.io/ipodtouchhax/
• You can downgrade tethered without blobs using Legacy iOS Kit

iPhone 3GS, iPad 1, iPod touch 2nd and 3rd gen

• You can also use Legacy iOS Kit to do untethered downgrades to other iOS versions without blobs (or with blobs also)
• iOS 4.1 is signed for the 3GS, touch 2nd gen and 3rd gen, use iTunes or Legacy iOS Kit to downgrade
  • Error 1015 will show up at the end of restore for iTunes. You can exit recovery mode using RecoveryModeTool
• For iPod touch 2nd gen (old bootrom model), there is no firmware signing for versions 3.0 and lower can be restored freely. 3.x IPSWs are available here: https://invoxiplaygames.uk/ipsw/ and https://archives.legacyjailbreak.com

iPhone 2G and 3G, iPod touch 1st gen

• AFAIK, there is no firmware signing and they can be restored to any iOS version using older iTunes after placing the device in pwned DFU mode using redsn0w.
• Legacy iOS Kit also supports these devices, but only for restoring/hacktivating to 3.1.3 (also 4.1 and 4.2.1 for iPhone 3G)
• IPSWs for older iPod touch are not available in ipsw.me. They are available here: https://invoxiplaygames.uk/ipsw/ and https://archives.legacyjailbreak.com