iOS Guide

Restoring with blobs using turdus merula

For support in English, ask for help on the r/Jailbreak Discord Server.

turdus merula is a tool which utilizes a bootrom exploit and a SEP exploit to allow A9(X) and A10(X) devices to restore to older versions of iOS/iPadOS, including those that are not compatible with the latest signed SEP firmware.

DANGER

While turdus merula also supports tethered downgrades (which do not require blobs, but require a computer to boot your device every time), this guide page does not cover them, and they are not recommended for most people.

Requirements

  • shsh2 blobs saved for the version you want to restore to
    • These blobs must be for your device only; you cannot use other people's blobs
    • If you are trying to restore to iPadOS 16.0 or later, you also need to have saved cryptex1 information for the version you want to restore to within your shsh2 blobs
  • An A9(X) or A10(X) device
  • macOS 10.12 or later

DANGER

Cellular A10X iPad Pros, as well as some iPhone 7's, will run into issues or not be able to activate after restoring to iOS 10, this is due to turdus merula needing to use the latest baseband available for the device on restores, which is incompatible with iOS 10 on some A10(X) devices.

If you are using an A9(X) device, or are restoring to iOS 11 or later, you can ignore this warning.

Downloads

Finding the generator

DANGER

Make sure you do not edit the blob file. Doing so will make it invalid and unusable with turdus merula.

TIP

If you already know the generator of the blob that you are using to restore, you can skip this section.

  1. Open a terminal window and navigate to the directory your blobs are located
  2. Run cat [shsh blob].shsh2 | grep -A 1 "generator"
    • Replace [shsh blob] with the name of your blob file

Take note of the output listed in the <string> field, as it will be needed in a later step.

Using turdus merula

The following steps will slightly vary depending on if the device you are restoring is an A9(X) or A10(X) device.

WARNING

A9(X) restores do have a small failure rate. If the restore fails, retry again from the start of this section.

Getting the shcblock

  1. Connect your device to your Mac
  2. Make sure that your Mac is trusted by your device
  3. Enter DFU mode on your device
  4. Open a new terminal window and navigate to where you extracted the turdus merula folder to
  5. Run cd turdus_m3rula to navigate to the folder where turdus_merula is located
  6. Run /usr/bin/xattr -c ./bin/turdusra1n && /usr/bin/xattr -c ./bin/turdus_merula
  7. Run ./bin/turdusra1n -ED
  8. Run ./bin/turdus_merula --get-shcblock [ipsw file]
    • Replace [ipsw file] with the file path of the IPSW file for your version

The shcblock will be saved to the blocks folder in the turdus_m3rula folder, and your device will reboot after this step is completed.

Restoring the device

  1. Re-enter DFU mode on your device
  2. Run ./bin/turdusra1n -EDb [generator]
    • Replace [generator] with the generator you obtained in the previous section
  3. Run ./bin/turdus_merula -w --load-shsh [shsh blob] --load-shcblock [shcblock] [ipsw file]
    • Replace [shsh blob] with the file path of your shsh blob
    • Replace [shcblock] with the file path of the shcblock you obtained in the previous section
    • Replace [ipsw file] with the file path of the IPSW file for your version
  4. Follow any additional steps that are listed in the terminal window

Your device should now be restored to the targeted firmware version.

  1. Connect your device to your Mac
  2. Make sure that your Mac is trusted by your device
  3. Enter DFU mode on your device
  4. Open a new terminal window and navigate to where you extracted the turdus merula folder to
  5. Run cd turdus_m3rula to navigate to the folder where turdus_merula is located
  6. Run /usr/bin/xattr -c ./bin/turdusra1n && /usr/bin/xattr -c ./bin/turdus_merula && /usr/bin/xattr -c ./bin/lib/libirecv.dylib
  7. Run ./bin/turdusra1n -EDb [generator]
    • Replace [generator] with the generator you obtained in the previous section
  8. Run ./bin/turdus_merula -w --load-shsh [shsh blob] [ipsw file]
    • Replace [shsh blob] with the file path of your shsh blob
    • Replace [ipsw file] with the file path of the IPSW file for your version
  9. Follow any additional steps that are listed in the terminal window

Your device should now be restored to the targeted firmware version.