Categories
Popular posts

How to save your .shsh2 blobs online with TSS Saver

If you want to use futurerestore to restore your Apple devices to unsigned firmwares, you will need to have .shsh2 blobs saved for the firmware you want to restore to. Jailbreakers often want to move to an unsigned firmware in order to use a jailbreak there, when newer signed firmwares do not have one. All jailbreakers should save blobs for all their devices periodically, in order to have the option of using futurerestore in the future. This guide will go through how to use the online TSS Saver tool to get the .shsh2 blobs you need.

A quick note for users with A12 or newer devices (iPhone XS, iPhone XR, etc. and newer): these devices require extra steps to save valid blobs, and will also need a jailbreak on their current firmware to get the information they need, at least the first time. A guide on that is upcoming, but is not currently covered in the guide below. There are resources which cover it but they may not be accessible to all users. Look for our A12+ blob-saving guide in the near future.

TSS Saver’s source code can be consulted online if you want to examine it, and comes courtesy of 1Conan. It is essentially an online wrapper for tihmstar’s TSSChecker but runs from a website instead of from your computer, and is much easier to use.

How to use TSS Saver

1) Plug your device into your computer and open iTunes (on older versions of macOS, and Windows), or free-to-download Apple Configurator (macOS only).

2) Navigate to your connected device in iTunes or Apple Configurator, and locate the device information fields.

3) We need to make a note of our device’s ECID. In iTunes, this can be found by clicking repeatedly on the Serial Number field of your device until it appears. In Apple Configurator, the ECID is clearly listed under Tech Info.

iTunes ecid page

Note: Users who do not have access to either iTunes, or a Mac which can download Apple Configurator, must locate their ECID by other means. Jailbroken users can install the System Info tweak from this repo:

https://apt.arx8x.net/

They will then find their ECID under Settings, General, About…

Jailbroken users can also SSH into their device (or just open a Terminal on the device itself), and type ecid to reveal it. Non-jailbroken users without iTunes or a Apple Configurator must perform a more difficult process which is outside the scope of this article. If possible, use iTunes or Apple Configurator.

4) Copy your ECID somewhere safe, removing the two characters from the beginning of it:

0x0123456789ABC would become 0123456789ABC by removing the 0x from the start.

Keep a record of the ECIDs of all of your devices going forward, so you don’t have to repeat these steps in future.

5) Now, open a browser window and go to the following site:

https://tsssaver.1conan.com/v2/

6) On this page, fill in the ECID field that you noted from iTunes/Apple Configurator/Other. You should use the Hex option, not Dec. Then select your device type and model. Be careful when selecting your model: do not select iPad 2 (Cellular) if you have iPad 2 (WiFi). Do not select iPhone 6 Plus if you have iPhone 6.

Please note, some devices have multiple models; you must know which one you have. For example, the iPhone 7 has a GSM and a Global model, with different identifiers (iPhone9,1 vs. iPhone 9,3). If you save blobs for the wrong model, they will be invalid and cannot be used. You can find your device’s model identifier using most of the methods mentioned in Step 3), and also by viewing a connected device in a Finder window on newer versions of macOS, again clicking on the serial number section until the Model appears.

The model identifier is not necessarily the same number as your device’s “common marketing name”. For example, iPhone 8 has a model identifier of iPhone10,1 or iPhone10,4, not iPhone8,x (which is the iPhone 6s).

Keep a record of the exact model type of all of your devices going forward, so you don’t have to repeat these steps in future.

tsssaver form page

7) For some devices, such as the original iPhone SE, there is an additional property called Board Config which must be specified. You will know if you need to specify this property for your device because when you select your device type and model, a Board Config field will automatically appear on the page. If you see it, you must enter your board config.

If that box does not appear when you select your device type and model, you can skip on to the next step. If your device requires specifying a board config, the System Info tweak mentioned in Step 3) displays it under Platform, there are various free system information apps on the App Store which display it, search engine research may help, the iPhone Wiki lists the different variant names (but won’t tell you which one you have), and the more difficult process mentioned in Step 3) also displays it, under HardwareModel.

Keep a record of the board config of any of your devices which require it going forward, so you don’t have to repeat these steps in future.

8) Users with an A12 or higher chip (all devices starting with the iPhone XS (Max), iPhone XR, iPad Air 3, and newer) must specify an Apnonce next. This is unfortunately a bit complex to get, and requires a jailbreak, but is covered here, and will be in a future guide. Users with an A11 or lower chip (iPhone X or older) do not need to do this, and should skip to the next step, unless they really know what they’re doing and require blobs saved with a specific Apnonce for some reason.

9) If you skipped Step 8), skip this step too.

If you specified an Apnonce in Step 8), you must now specify a Generator too. It should be the same generator you set when jailbreaking your device during the process of finding your Apnonce. The generator you set on your device when finding your Apnonce dictates the Apnonce you found; they are paired together. To save valid blobs, always use the same generator, and make it the generator you used when finding the related Apnonce. When saving blobs on TSS Saver, make sure to enter the same generator, with the same paired Apnonce that you generated originally from that generator, or the blobs will not be valid.

Note your Apnonce and its matching generator and save them with your device’s ECID, model type, and board config (if required).

10) Ok, we’re ready! Submit the page to save your blobs. You may have to complete a CAPTCHA before proceeding. The next page that appears will give you a link to download the blobs, as you can see in the image below. I would recommend clicking through the link to save them immediately, though they should remain saved online for future retrieval as well.

tsssaver success

Make a note of your device’s URL (as shown in the picture above, masked for privacy) where your device’s blobs are saved so you can retrieve them later. Keep it in a safe place with your device’s ECID, model number, etc. which you have noted so far.

On occasion, some blobs will not save immediately if the site is under heavy load. Use the saved URL to revisit your blobs’ page later, and they should have appeared.

11) Return to the TSS Saver site periodically, whenever a new firmware version is released, to save blobs for it before it is unsigned by Apple. Future blobs are not automatically saved, so this process must be repeated for each new firmware version. It will be quicker and easier in future however, as you will already have the device details which we found in this guide noted down ready.

Wrap-up

The process outlined in this guide should continue to work for future iOS, iPadOS, and tvOS versions, though sometimes new device releases complicate the process. The guide will be amended if the information becomes outdated.

Once you have performed this process once for each device you own, it becomes much easier to repeat. You will have noted down the ECID, Model, board config (if required), Generator (if required), and Apnonce (if required) the first time round, and will not have to do so again. On future occasions you will simply paste them into the field on the TSS Saver site to save your .shsh2 blobs.

Remember, TSS Saver only saves currently signed blobs at the time you fill out the webpage. It does not automatically save new blobs for you as new firmwares are released. If iOS 14.4 and 14.5 are currently signed and I follow this guide, TSS Saver will save blobs for 14.4 and 14.5. When iOS 14.6 or iOS 15 are released, TSS Saver will not automatically save these for you. When a new iOS, iPadOS, or tvOS version is released, you must return to the page and re-submit the form to save the newer blobs, while they are signed.

All users who jailbreak and may want to use futurerestore in the future should start/continue saving blobs for all current and future firmwares periodically using TSS Saver, as new firmwares are released, and before old firmwares become unsigned. Blobs must be saved for a firmware while that firmware is signed by Apple. Blobs saved for unsigned firmwares are not valid (and TSS Saver will not do so). Once the blobs have been successfully saved, they can be used to move to other firmwares, even after they become unsigned by Apple.

It does not matter what firmware your device is currently on, nor what firmwares it has been on in the past. To save blobs, all that matters is that you save them for a firmware while it is still signed. You can then use it later to move to that firmware, whether it is still signed or not.

One more thing to note is that because this is done remotely it offers no readout or feedback. The TSS Saver site has a feature which lets you verify your blobs once you have saved them, to make sure they are valid. It can be found on the site under Blob Checker, and I recommend you use it. Lastly, double- and triple-check the details you enter into TSS Saver, such as ECID, Model, board config (if required), Generator (if required), and Apnonce (if required), as any errors will result in saving useless .shsh2 blobs.

Let me know how it goes!

Leave a Reply

Your email address will not be published. Required fields are marked *