Those who have been working with iOS, specifically jailbreaking, for a long time will probably remember the now dead method of downgrade to unsigned firmware version using SHSH blobs. These are essentially files from Apple’s verification server that tell iTunes the iOS version that are for is still being signed and that you can install it. A program called TinyUmbrella was used in order to save these SHSH blobs for use to downgrade in the future.
This method of downgrading hasn’t worked for quite a few years now, but it seems to be making somewhat of a comeback. A new method of backing up the newer SHSH blob files (SHSH2) has now been released. A tool named Prometheus made by iOS developer tihmstar has been released. This tool is able to restore 64-bit iOS devices that are jailbroken, to unsigned iOS versions (provided you have SHSH2 blobs for that version).
The developer of the downgrade tool has released a second tool called tsschecker which allows you to save .shsh2 blob files for your iOS devices. This tool can be quite complicated to use, so it is easier for most people to use TSSSaver. TSSSaver runs on tsschecker, except it is a web based version of the tool. This means you not only don’t need to download any files and play around with commands, but you also don’t even need to use a computer to do it if you have your device’s ECID.
Requirements & Notes
- This will only backup SHSH blobs for iOS versions which are still being signed by Apple.
- .shsh2 blob files are unique to each device, meaning you cannot simply use the blobs of another device with your own.
- You do not need to be jailbroken in order to backup .shsh2 blobs.
- You do not need to have iOS 10.3 installed on your device to save SHSH2 blobs for it.
- You will need the ECID number of your device.
- If you are using an iPhone 6s or iPhone SE you will need the board configuration of your device (see instructions below to find it). If you are using any other device, you can skip step 5.
The first thing you will need to backup your .shsh2 blobs is the ECID number of your device. This can be found in one of two ways:
- Plug your device into your computer using a lightning cable.
- Open iTunes on the computer.
- Navigate to the summary page for the device within iTunes.
- Click on the serial number until it changes to ECID.
- To copy the number click the Edit tab in the top tab bar and then click Copy ECID.
Using Cydia (no computer required):
- Open Cydia on your jailbroken iOS device.
- Search for and install UDID Calculator.
- Open the newly installed app and copy the ECID value within.
- Download and install the Battery Memory System Status Monitor app from the App Store onto the device you want to save SHSH2 blobs for.
- Once installed, open the app and tap on the System tab at the top of the screen.
- In here you should see the devices Model on the first line. This is what you need to use for the board configuration. It will be something like ‘N71mAP’.
Saving SHSH2 Blobs With TSSSaver
- Open your browser of choice and navigate to tsssaver.1conan.com.
- In the ECID box, select either Hex or Dec for the ECID type. If you used iTunes to find the ECID number select Hex, and if you used UDID Calculator select Dec.
- Paste the ECID number you copied for your device into the ECID text box.
- Select your device type and model under the Identifier section.
- This step is only for iPhone 6s and iPhone SE users: A box should appear under the device selection box asking for the Board Configuration (see instructions above to find it). Type the board configuration of your device into this box.
- Confirm you are not a robot by ticking the I’m not a robot checkbox.
- Click submit, wait a few second, and the page should give you a link to the .shsh2 blobs for your device.
- Click the link and ensure there the folders within contain .shsh2 files. If they do, download them by either clicking the Download ZIP, save to Google Drive, save to Dropbox, or save to OneDrive options. Keep these files safe as you may need them for future downgrades.