iOS Guide

Using turdus merula (Linux)

For support in English, ask for help on the r/Jailbreak Discord Server.

turdus merula is a tool which utilizes a bootrom exploit and a SEP exploit to allow A9(X) and A10(X) devices to restore to older versions of iOS/iPadOS, including those that are not compatible with the latest signed SEP firmware.

DANGER

While turdus merula also supports tethered downgrades (which do not require blobs, but require a computer to boot your device every time), this guide page does not cover them, and they are not recommended for most people.

DANGER

If you are trying to use a Virtual Machine software of some sort from Windows (e.g. Virtualbox, VMWare, Windows Subsystem for Linux, etc) you will not succeed with following this guide.

WARNING

If you are using a computer with an AMD Ryzen CPU, you will likely run into issues. If you do run into issues, you should use a Mac or a computer with an Intel CPU to follow this guide.

Requirements

  • shsh2 blobs saved for the version you want to restore to
    • These blobs must be for your device only; you cannot use other people's blobs
    • If you are trying to restore to iPadOS 16.0 or later, you also need to have saved cryptex1 information for the version you want to restore to within your shsh2 blobs
  • An A9(X) or A10(X) device

DANGER

Cellular A10X iPad Pros, as well as some iPhone 7's, will run into issues or not be able to activate after restoring to iOS 10, this is due to turdus merula needing to use the latest baseband available for the device on restores, which is incompatible with iOS 10 on some A10(X) devices.

If you are using an A9(X) device, or are restoring to iOS 11 or later, you can ignore this warning.

WARNING

Depending on the version you are restoring to, you may need to tether downgrade to a different version before downgrading to your target version:

If you are restoring to iOS 11 or later, you can ignore this warning.

Downloads

Preparation

  1. Open a terminal window
  2. Run sudo systemctl stop usbmuxd
  3. Run sudo usbmuxd -f -p

Finding the generator

DANGER

Make sure you do not edit the blob file. Doing so will make it invalid and unusable with turdus merula.

TIP

If you already know the generator of the blob that you are using to restore, you can skip this section.

  1. Open a terminal window and navigate to the directory your blobs are located
  2. Run cat [shsh blob].shsh2 | grep -A 1 "generator"
    • Replace [shsh blob] with the name of your blob file

Take note of the output listed in the <string> field, as it will be needed in a later step.

Using turdus merula

The following steps will slightly vary depending on if the device you are restoring is an A9(X) or A10(X) device.

WARNING

A9(X) restores do have a small failure rate. If the restore fails, retry again from the start of this section.

Getting the shcblock

  1. Connect your device to your computer
  2. Make sure that your computer is trusted by your device
  3. Enter Recovery mode on your device
  4. Open a new terminal window and navigate to where you extracted the turdus merula folder to
  5. Run cd turdus_m3rula to navigate to the folder where turdus_merula is located
  6. Run sudo ./bin/turdusra1n -D
    • Follow the on-screen instructions to enter DFU mode when prompted
  7. Run sudo ./bin/turdus_merula --get-shcblock [ipsw file]
    • Replace [ipsw file] with the file path of the IPSW file for your version

The shcblock will be saved to the block folder in the turdus_m3rula folder, and your device will reboot after this step is completed.

Restoring the device

  1. Re-enter Recovery mode on your device
  2. Run sudo ./bin/turdusra1n -Db [generator]
    • Replace [generator] with the generator you obtained in the previous section
    • Follow the on-screen instructions to enter DFU mode when prompted
  3. Run sudo ./bin/turdus_merula -w --load-shsh [shsh blob] --load-shcblock [shcblock] [ipsw file]
    • Replace [shsh blob] with the file path of your shsh blob
    • Replace [shcblock] with the file path of the shcblock you obtained in the previous section
    • Replace [ipsw file] with the file path of the IPSW file for your version
  4. Follow any additional steps that are listed in the terminal window

Your device should now be restored to the targeted firmware version.

  1. Connect your device to your computer
  2. Make sure that your computer is trusted by your device
  3. Enter Recovery mode on your device
  4. Open a new terminal window and navigate to where you extracted the turdus merula folder to
  5. Run cd turdus_m3rula to navigate to the folder where turdus_merula is located
  6. Run sudo ./bin/turdusra1n -Db [generator]
    • Replace [generator] with the generator you obtained in the previous section
    • Follow the on-screen instructions to enter DFU mode when prompted
  7. Run sudo ./bin/turdus_merula -w --load-shsh [shsh blob] [ipsw file]
    • Replace [shsh blob] with the file path of your shsh blob
    • Replace [ipsw file] with the file path of the IPSW file for your version
  8. Follow any additional steps that are listed in the terminal window

Your device should now be restored to the targeted firmware version.