Prometheus Conduct Role 1: How To Gear Upward A Nonce Alongside Nonceenabler?
This is Part 1 of a two-part guide on how to role Prometheus.
Before attempting this guide, everyone should read the introductory article, Prometheus Guide: Introduction. This volition explicate whether the guides apply to you, in addition to if they do, which ones yous should follow, equally good as making certain that yous fulfil the requirements for it to work.
If you currently bring a jailbreak and yous desire to motion to a unlike firmware amongst Prometheus’ nonceEnabler method, you must follow Parts 1 & 2 of the guide.
If you currently bring no jailbreak, and yous desire to motion to a unlike firmware amongst Prometheus’ nonce collision method, skip Part 1 and do only Part 2 of the guide.
Before yous laid about next the instructions, read the entire guide (Parts 1 & 2) through once, in addition to sentry tihmstar’s two videos which outline the process visually. This volition relieve fourth dimension in addition to errors inwards the long run. Make certain yous bring all the required files ready earlier yous begin. These are listed inwards the introductory article. Be prepared to proceed conduct from Part 1 to Part 2 of the guide. Have both open, in addition to move out plenty fourth dimension to follow them i after each other.
This guide uses an upgrade from iOS 9.3.3 to iOS 10.2 equally an example, but it tin dismiss hold upwards used to motion betwixt whatsoever firmwares in principle, if in addition to solely if you view the requirements. If yous are using this guide to motion betwixt unlike firmwares, exactly supersede whatsoever mention of iOS 10.2 amongst the finish firmware yous want, in addition to mentions of iOS 10.2.1 amongst a currently signed firmware. Some examples of other possible Prometheus restores would be iOS 10.2 > iOS 10.2, iOS 10.3 b1 > iOS 10.2, in addition to iOS 9.1 > iOS 10.2.
Instructions
0) Ensure your device has a jailbreak amongst tfp0, in addition to that it is active. If on iOS 9.3.3, that way re-jailbreaking with Luca’s JailbreakMe website. Users on older firmwares must depository fiscal establishment check that their jailbreak has tfp0, in addition to mayhap install a piece themselves if it does not.
1) Create a folder on your Desktop and scream it nonceenabler.
2) Download the nonceEnabler tool, in addition to house it into the folder on your desktop.
3) Copy the .shsh2 blob for the firmware yous desire to motion to, in addition to glue it into the folder on your desktop too.
4) Note downwardly the generator from your .shsh2 blob.
a) If your blob was saved without a specific nonce, the generator tin dismiss hold upwards industrial plant life within your blob file:
To get it, rename your blob from .shsh2 to .plist. Then opened upwards your .plist file inwards a text/plist editor of your selection (I role TextEdit or TextWrangler). Scroll to the real bottom of the file in addition to respect the generator field. Copy the generator value, in addition to glue it somewhere prophylactic for later. Afterwards, rename your .plist file back to .shsh2.
If your blob has no generator plain inwards it, yous may bring saved it amongst a specific nonce, therefore try Step 4) b).
b) If your blob was saved amongst i of the 5 specific nonces which tihmstar provided on his blog:
In this case, tihmstar has provided the generators inwards the description department of his video guide, where yous tin dismiss respect them.
5) Open the Terminal application from /Applications/Utilities, or via Spotlight.
6) Connect your device to your computer.
7) SSH into your device past times typing:
ssh root@YOUR_DEVICE_IP_ADDRESS_HERE Replace YOUR_DEVICE_IP_ADDRESS_HERE amongst your iOS device’s IP address.
If yous create non know how to SSH into your device, or create non know its IP address, follow my total guide on how to connect to your device using SSH.
8) Enter your device’s rootage password if prompted. By default, the password is alpine, but if yous followed my SSH guide linked higher upwards you should bring changed it, in addition to therefore should larn inwards your novel password instead.
9) Once your device is connected via SSH, move out the Terminal window amongst SSHopen in addition to running, in addition to minimise it.
10) Open a second Terminal window.
11) At the Terminal prompt, type cd, then drag the nonceenabler folder from your desktop onto the Terminal window, in addition to hit Enter.
12) Now type:
scp nonceEnabler root@YOUR_DEVICE_IP_ADDRESS_HERE: Replace YOUR_DEVICE_IP_ADDRESS_HERE with the IP address of your device, which yous used to connect to it inwards Step 6. Please remember the colon at the halt of your device’s IP address.
13) Terminal should present the nonceEnabler file beingness transferred to the device.
14) Enter your device’s rootage password if prompted. By default, the password is alpine, but if yous followed the guide linked in Step 6 you should bring changed it, in addition to therefore should larn inwards your novel password instead.
15) Now render to your opened upwards SSH Terminal window, which yous minimised in Step 8. The ascendancy prompt should read root#.
16) At the prompt larn inwards the next command, to run nonceEnabler:
./nonceEnabler 17) You should immediately view output equally nonceEnabler attempts to piece the kernel. If it does non consummate quickly, amongst solely i work of “patching bytes at…”, therefore it probable has non worked. If many lines of patching appear, essay rebooting your device in addition to following Steps 4-15 again until it works. (Remember to re-jailbreak after rebooting if yous are on a semi-untethered jailbreak, in addition to use a method amongst tfp0 enabled).
18) Once the output of Step 16 reads “done patching” without having printed besides many lines of bytes, in addition to without crashing, proceed to Step 19.
19) At the prompt, type:
nvram com.apple.System.boot-nonce=YOUR_GENERATOR Replace YOUR_GENERATOR with the generator from your ain .shsh2 file, which yous noted downwardly in Step 4.
20) This should laid the generator in nvram so that when nosotros reboot, the device should generate the corresponding nonce. We tin dismiss therefore role our saved blob, because the nonce saved in it volition match the nonce on the device. To depository fiscal establishment check that the generator is saved correctly inwards nvram, type the next ascendancy at the Terminal prompt:
nvram -p Terminal volition impress out all the kick commands for your device. Make certain that yous tin dismiss see com.apple.System.boot-nonce in the list, in addition to that it has your generator value set.
21) Now type the next ascendancy inwards Terminal:
nvram auto-boot=false You tin dismiss depository fiscal establishment check this value is laid correctly the same way nosotros did inwards the previous step, with nvram -p. Look for the auto-boot flag to hold upwards listed, amongst the value false.
Do NOT close the Terminal windows, restart your iOS device, or disconnect your iOS device after Step 21!
Continue straight on to Part 2 of the guide and use futurerestore!
If yous don’t desire to role futurerestore right now, create NOT stop here! Follow the department below to properly cancel the procedure.
If yous are non nearly to role futurerestore now, create this!
1) At the Terminal prompt, type:
nvram auto-boot=true 2) Type:
nvram -p Make certain the auto-boot flag is laid dorsum to true, otherwise your device will non reboot dorsum to iOS, it will maintain booting dorsum to recovery.
3) Type:
reboot This volition reboot your device dorsum to iOS equally normal. You volition bring to larn through this guide i time to a greater extent than inwards hereafter if yous want to use futurerestore with nonceEnabler.
If you’re currently non jailbroken and yous desire to motion to a unlike firmware amongst Prometheus’ nonce collision method, skip Part 1 and larn conduct to Part 2 of the guide.
