-
-
[原创]使用TSSChecker保存SHSH
-
发表于: 2017-9-20 16:44
-
iOS 11正式推送了，不少人蠢蠢欲动了，但是请做好安全措施，请保存好SHSH，万一不如意的时候，还有后悔药可以吃。
使用TSSChecker保存SHSH
首先使用本地的方法——TSSChecker
首先在开发者tihmstar的github主页下载release版本tsschecker_v212_mac_win_linux.zip压缩包，下载完成之后可以看到是全桌面平台通用的，在这里介绍Mac下的使用方法。
首先可以看到tsschecker_macos文件是没有可执行的权限的。
$ ls -alit total 21248 11530938 drwx------@ 10 jialinchen staff 340 9 20 14:53 . 632346 drwx------+ 81 jialinchen staff 2754 9 20 14:53 .. 11530943 -rw-r--r--@ 1 jialinchen staff 895 3 20 2017 signature.txt 11530940 -rw-r--r--@ 1 jialinchen staff 41 3 20 2017 latest-sha-tsschecker.txt 11530946 -rw-r--r--@ 1 jialinchen staff 9871022 3 20 2017 tsschecker_windows.exe 11530945 -rw-r--r--@ 1 jialinchen staff 159384 3 20 2017 tsschecker_macos 11530944 -rw-r--r--@ 1 jialinchen staff 559655 3 20 2017 tsschecker_linux 11530941 -rw-r--r--@ 1 jialinchen staff 7651 12 21 2016 LICENSE 11530942 -rw-r--r--@ 1 jialinchen staff 106 12 20 2016 README-windows.txt 11530939 -rw-r--r--@ 1 jialinchen staff 263596 12 20 2016 cacert.pem
我们给它加上可执行权限后执行。
$ chmod +x tsschecker_macos
$ ./tsschecker_macos
Version: 7d267698cb16ab4699fa9cba20783ee041ac999e - 212
Usage: tsschecker [OPTIONS]
Checks (real) signing status of device/firmware
-d, --device MODEL specific device by its MODEL (eg. iPhone4,1)
-i, --ios VERSION specific iOS version (eg. 6.1.3)
--buildid BUILDID specific buildid instead of iOS version (eg. 13C75)
--boardconfig BOARD specific boardconfig instead of iPhone model (eg. n61ap)
-h, --help prints usage information
-o, --ota check OTA signing status, instead of normal restore
-b, --no-baseband don't check baseband signing status. Request a ticket without baseband
-m, --build-manifest manually specify buildmanifest. (can be used with -d)
-s, --save save fetched shsh blobs (mostly makes sense with -e)
-u, --update-install request update ticket instead of erase
-l, --latest use latest public iOS version instead of manually specifying one
especially useful with -s and -e for saving blobs
-e, --ecid ECID manually specify ECID to be used for fetching blobs, instead of using random ones
ECID must be either dec or hex eg. 5482657301265 or ab46efcbf71
--apnonce NONCE manually specify APNONCE instead of using random one (not required for saving blobs)
--sepnonce NONCE manually specify SEPNONCE instead of using random one (not required for saving blobs)
--save-path PATH specify path for saving blobs
-h, --help prints usage information
--beta request ticket for beta instead of normal relase (use with -o)
--list-devices list all known devices
--list-ios list all known ios versions
--nocache ignore caches and redownload required files
--print-tss-request
--print-tss-response
然后将手机插上电脑，打开iTunes，在手机界面首页看到型号标识符：iPhone8，4，点击三下后，出现ECID：1B6F714B51C，这是所需要准备的最基本的信息，有了这些TSSChecker就可以去联系苹果的gs服务器抽取信息了。
有时候按照设备信号iPhone8，4来抽取经常会失败，这时候要求提供--boardconfig信息，这个boardconfig信息很多地方要求安装App来抽取，其实没有那么麻烦，在ipsw这个网站即可找到自己设备的boardconfig。
在首页这里点击Identify my iOS Device：
在Which Device do I have？这里点击iPhone。
输入设备背面的型号，笔者这里是A1723。
向下拉，点击browse all iOS release
这时有关这款设备的详细信息就会显示出来，甚至最新的可以获得SHSH的系统这边也给出来了，分别是11.0和10.3.3。
现在我们就来获取这两款系统的SHSH。
首先是获取10.3.3，
$ ./tsschecker_macos --boardconfig n69ap -i 10.3.3 -e 1B6F714B51C -s Version: 7d267698cb16ab4699fa9cba20783ee041ac999e - 212 [TSSC] manually specified ecid to use, parsed "1B6F714B51C" to dec:1885341005084 hex:1b6f714b51c [TSSC] opening firmware.json [JSON] counting elements [JSON] parsing elements [TSSC] got firmwareurl for iOS 10.3.3 build 14G60 [TSSC] opening Buildmanifest for iPhone8,4_10.3.3_14G60 [TSSR] Request URL set to 804K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4M7#2)9J5k6h3q4H3M7r3I4W2i4K6u0W2j5$3!0E0i4K6u0r3g2q4y4e0i4K6u0r3j5$3!0F1N6s2u0G2L8r3I4W2M7W2)9K6c8X3q4U0N6r3W2G2L8W2)9K6c8o6t1`. [TSSR] Sending TSS request attempt 1... success also requesting APTicket for installType=Update [TSSR] Request URL set to 03dK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4M7#2)9J5k6h3q4H3M7r3I4W2i4K6u0W2j5$3!0E0i4K6u0r3g2q4y4e0i4K6u0r3j5$3!0F1N6s2u0G2L8r3I4W2M7W2)9K6c8X3q4U0N6r3W2G2L8W2)9K6c8o6t1`. [TSSR] Sending TSS request attempt 1... success Saved shsh blobs! iOS 10.3.3 14G60 IS signed! iOS 10.3.3 for device iPhone8,4 IS being signed!
然后是最新版系统的签名。
$ ./tsschecker_macos --boardconfig n69ap -l -e 1B6F714B51C -s Version: 7d267698cb16ab4699fa9cba20783ee041ac999e - 212 [TSSC] manually specified ecid to use, parsed "1B6F714B51C" to dec:1885341005084 hex:1b6f714b51c [TSSC] opening firmware.json [JSON] counting elements [JSON] parsing elements [TSSC] selecting latest iOS: 11.0 [TSSC] got firmwareurl for iOS 11.0 build 15A372 [TSSC] opening Buildmanifest for iPhone8,4_11.0_15A372 [LFZP] downloading BuildManifest.plist from fc8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3q4H3M7r3I4V1L8X3I4V1i4K6u0W2j5i4m8H3L8r3g2Q4x3X3g2U0L8$3#2Q4x3V1k6A6L8%4x3I4x3g2)9J5k6e0m8Q4x3V1j5H3z5e0q4Q4x3X3b7K6x3e0R3#2x3#2)9J5k6o6t1H3x3e0M7H3x3o6V1I4z5g2)9J5k6o6x3#2b7U0g2m8x3V1t1^5i4K6u0V1z5e0l9J5y4#2)9J5k6o6p5I4c8e0N6Q4x3X3c8n7z5o6g2m8i4K6u0V1x3K6b7K6y4f1t1$3y4p5b7J5z5o6l9^5i4K6u0r3K9g2m8Z5L8$3&6W2i4K6g2X3y4q4)9J5k6e0m8Q4y4h3j5$3y4r3u0A6N6q4)9#2k6U0p5I4i4K6u0W2x3q4)9#2k6U0p5#2b7e0x3%4x3W2)9#2k6W2u0W2M7%4c8G2M7X3g2Q4x3X3g2A6M7s2y4%4 100 [===================================================================================================>] [TSSR] Request URL set to 162K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4M7#2)9J5k6h3q4H3M7r3I4W2i4K6u0W2j5$3!0E0i4K6u0r3g2q4y4e0i4K6u0r3j5$3!0F1N6s2u0G2L8r3I4W2M7W2)9K6c8X3q4U0N6r3W2G2L8W2)9K6c8o6t1`. [TSSR] Sending TSS request attempt 1... success also requesting APTicket for installType=Update [TSSR] Request URL set to 711K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4M7#2)9J5k6h3q4H3M7r3I4W2i4K6u0W2j5$3!0E0i4K6u0r3g2q4y4e0i4K6u0r3j5$3!0F1N6s2u0G2L8r3I4W2M7W2)9K6c8X3q4U0N6r3W2G2L8W2)9K6c8o6t1`. [TSSR] Sending TSS request attempt 1... success Saved shsh blobs! iOS 11.0 15A372 IS signed! iOS 11.0 for device iPhone8,4 IS being signed!
这时候在当前文件夹下，就会出现这两个shsh2结尾的文件。
$ ls 1885341005084_iPhone8,4_n69ap_10.3.3-14G60_806ad0d4924260cd1377598e29479fed39cb971e.shsh2 1885341005084_iPhone8,4_n69ap_11.0-15A372_7e6938b4c98d29906565189507cda7980952ca5e.shsh2
在线抽取SHSH
该款软件并不是万能的，例如笔者最新版iPad 5（Wifi）就无法识别和使用。最后还是使用在线版成功提取了SHSH。网址是这里：cc0K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6@1M7%4y4K6j5i4k6W2M7W2)9J5k6e0q4U0L8$3&6S2L8W2)9J5k6h3y4G2L8g2)9J5c8R3`.`.。界面简洁大方，在黑客界属于“花哨”的范畴了。
在ECID填入之后，在identifier选择iPad和正确的型号之后，做人机身份验证，然后submit。服务器开始自动抽取苹果gs服务器的验证信息，然后帮你保存在他们的服务器上，请见下图。
一次性抽取了所有可以签名的的版本，bingo！如果不放心网站是不是会倒闭，那就Download ZIP下载下来。笔者比对了TSSChecker和该网站的抽取结果，前者抽取的信息更加全面一些，当然网站也应该不会错，毕竟使用的用户那么多。
有了相应的SHSH之后，就可以升级到最新系统进行尝鲜，而不用再担心回不去旧系统了。后续可以继续使用Prometheus进行降级了。
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
