How to Downgrade iPhone 4s from iOS 9 to iOS 6.1.3 (Without SHSH Blobs)

23

Anyone who has or is currently using an iPhone 4s running iOS 9 will tell you that it runs painfully slow compared to all over iPhone models. Even the iPhone 4 is faster on iOS 7.1.2 (latest compatible version) than the iPhone 4s is on iOS 9.3. Most people would agree that iOS 9 should never have been released for the iPhone 4s in the first place, as once you update there wouldn’t normally be a way to downgrade. This tutorial aims to help those who have that slow iPhone 4s’ stuck on iOS 9, but allowing you to downgrade it back to iOS 6.1.3!

While this tutorial doesn’t require you to have SHSH blobs saved for iOS 6.1.3, it will require you to have an iPhone 4s that is running iOS 9.3 – 9.3.4. This will unfortunately not work for those who are running iOS 9.3.5, as the Trident jailbreak exploit that is used for this tutorial is patched in that version. The reason this downgrade works at all without SHSH blobs is because iOS 6.1.3 is still being signed as an OTA update.

Requirements & Notes:

  • This will only work on the iPhone 4s (there is a different version that may also work on the iPad 2 but I have not tested this).
  • Your device needs to be running iOS 9.3 – 9.3.4.
  • This will NOT work if your iPhone 4s is running iOS 9.3.5.
  • You will need a Windows computer to use this method.
  • Using this method may result in baseband issues, meaning you may not be able to use cellular service on the device after downgrading. This should only be done on spare devices that are not used anymore.
  • This method will restore and erase all data on the iPhone, so make sure there is nothing important on the device before attempting this.
  • Once you have done this make sure not to restore and update your phone again, as once your device is back on iOS 9.3.5 you will not be able to do this again (unless a root access exploit is released for that version).

Download Links: 

Written Guide: 

  1. Download all of the files above and save them anywhere you want them, then extract all of the .zip files.
  2. Open the Beehind.exe file by right clicking on it and clicking Run as Administrator. It is important to run it as an administrator as it will not run properly without doing so. If you accidentally open the file normally, make sure to close it completely using Task Manager. If when you open it as an administrator you get any errors or warnings, just click OK.
  3. Once Beehind is open, click the Choose button located on the left in the Browse for the IPSW section. When the selector window opens, select the iOS 6.1.3 IPSW file you downloaded before.
  4. A pop-up should appear asking you if you want to use SHSH blobs. Click the Yes button to indicate that you want to continue without using SHSH blobs. Another pop-up should appear asking you to enter the ECID of your iPhone 4s (you may not see this if you already have the device plugged in). To continue, simply plug your iPhone 4s into your computer and a blue button should appear saying New Apple device found! Click here to get its ECID. Click the blue button and then click Yes.
  5. You can now choose if you would like to jailbreak the downgraded operating system by ticking the Jailbreak checkbox. You can do this if you want, however I would recommend not doing this now as it can be down using p0sixspwn at a later date. Once you have chosen, click the Build IPSW! button in the bottom right. This will create a brand new IPSW file in a folder on your desktop. You can now close Beehind.
  6. Make sure that your iPhone 4s is plugged into your computer. Open the Cydia Impactor tool normally (don’t open as an administrator). Once open you should see your device in the first drop down menu. Make sure it is selected. Find the Trident-kloder IPA file you downloaded earlier and drag it on top of Cydia Impactor. You will be prompted to enter your Apple ID and password. You can use any Apple ID for this (don’t worry, this goes straight to Apple’s servers and isn’t saved). Once you have entered the data correctly and clicked OK, the Trident jailbreak app should begin to install.
  7. Once installed you will not be able to open the Trident app straight away, as you will get an Untrusted Enterprise Developer error. To fix this simply open the Settings app on your device and navigate to General>Profiles>Your Apple ID (Profiles could also be Device Management instead). In here click Trust twice and you should be able to open the app.
  8. Open the Trident app and click the Start button. After a few seconds the text should change (don’t worry if the screen flickers). At this point you need to put the device into DFU mode with libimobiledevice.
  9. Open the libimobiledevice folder you extracted earlier and click File in the top left corner. Click the Open command prompt option and command prompt should open in the libimobiledevice directory.
  10. To put the device into DFU mode, make sure the iPhone 4s is the only iOS device plugged into the computer and type this command:

    idevicediagnostics sleep

    This should make the screen go black and put the device into sleep mode. Hold the power button on the device until it is detected by your computer. At this point the device should be in DFU mode.

  11. Open the new folder on your desktop and move the IPSW file within into the libimobiledevice folder. Rename the new IPSW file to downgrade.ipsw so it is easier to refer to in the next step.
  12. Now we are going to restore the iPhone 4s to iOS 6.1.3 using the newly created IPSW file. To do this, using the same command prompt window, type the command below (make sure to replace downgrade.ipsw with whatever it is called if you didn’t rename it):

    idevicerestore -e downgrade.ipsw

  13. At this point, provided everything was done correctly, your device should now begin to restore to the custom IPSW file. Make sure not to close command prompt or unplug the device while this process is happening. If there are any errors that appear during the command prompt you can just ignore them, as they shouldn’t have an effect on the restore. Don’t worry if command prompt appears to be stuck at any point. Just allow it to run and it should eventually finish. This process can take anywhere between 5 and 15 minutes depending on the speed of your computer.
  14. When the restore is complete your device should now be running iOS 6!

Video Guide: 

ALSO SEE: How to Dual-Boot 2 Versions of iOS on a Jailbroken iPhone Using CoolBooter

23 COMMENTS

  1. Would this work with a lower iOS version than iOS 9?
    In my case: Could I upgrade from iOS 6.0 to iOS 7.1.3 using that method ??? (I still have an iPhone 4s with iOS 6.0 and I can officially only upgrade to 8.4.1).
    Thanks for any help!

    • Is this forum still active??
      in the meantime I can answer the two questions above myself:
      in the video josh says, it works with any jailbroken iOS below 9.3.5. But I guess it only works to upgrade my iOS 6 to iOS 6.1.3 (because it’s still signed)…?!
      Another question is still:
      what happens to my lower baseband version from iOS 6.0, would it work with a higher firmware?? I don’t want to loose cellular service. If something goes wrong – can I avoid going up to 9.3.5?

  2. guys its working if you getting unable to connect device in dfu mod after you go sleep press home botton to make the phone visible.

  3. my device isn’t downgrade.
    File version.xml not found
    ERROR: Could not load ‘version.xml’
    ERROR: Unable to discover device mode. Please make sure a device is attached.

  4. When i try to put second command which is ‘custom.ipsw’ then an error occured firmware file custom.ipsw does not exist.

    Please help me to downgrade my device

  5. when i run this cmd idevicerestore -e downgrade.ipsw i give some error!!!!!

    C:\Users\Hadii\Desktop\iphone\libimobiledevice MinGW build\libimobiledevice upda
    ted (Compiled by GeoSn0w)> idevicerestore -e downgrade.ipsw
    NOTE: Updated version data.
    Found device in DFU mode
    Identified device as n94ap, iPhone4,1
    Extracting BuildManifest from IPSW
    Product Version: 6.1.3
    Product Build: 10B329 Major: 10
    Device supports Image4: false
    Variant: Customer Erase Install (IPSW)
    This restore will erase your device data.
    Found ECID 4341407892269
    Getting ApNonce in dfu mode… 6c 8c db 85 12 c2 a9 ce ab 2b cf 88 30 fd 56 1d 7
    7 f1 6f 29
    Trying to fetch new SHSH blob
    Getting SepNonce in dfu mode…
    WARNING: Unable to find BbSkeyId node
    Request URL set to https://gs.apple.com/TSS/controller?action=2
    Sending TSS request attempt 1… response successfully received
    Received SHSH blobs
    Extracting filesystem from IPSW
    Extracting iBSS.n94ap.RELEASE.dfu…
    Personalizing IMG3 component iBSS…
    reconstructed size: 76110
    Sending iBSS (76110 bytes)…
    Nonce: 6c 8c db 85 12 c2 a9 ce ab 2b cf 88 30 fd 56 1d 77 f1 6f 29
    Extracting iBEC.n94ap.RELEASE.dfu…
    Not personalizing component iBEC…
    Sending iBEC (279576 bytes)…
    ERROR: Unable to connect to device in recovery mode
    ERROR: Unable to connect to recovery device
    ERROR: Unable to place device into recovery mode from DFU mode

    help me please

    • Make sure you have done step 10 correctly. I know it is a bit unclear, but you know it is in DFU mode if the device doesn’t come on when you press the home button.

      • tanks very much i think my trident kloader is not very good can you send me trident kloader link for iphone 4s ios 9.2 ipa file download link????

Leave a Reply to Josh Cancel reply

Please enter your comment!
Please enter your name here