Waiting for nand 3utools ошибка

Moderators: Lily Lee, jc_3u, Moderators

Return to “Help & Support”

MacBook Pro
Found device in Recovery mode
Identified device as j680ap, iBridge2,3
Extracting BuildManifest from IPSW
Product Version: 5.3
Product Build: 18P4556 Major: 18
INFO: device serial number is
Device supports Image4: true
Variant: Customer Upgrade Install (IPSW)
This restore will update your device without erasing user data.
Checking IPSW for required components…
All required components found in IPSW
Using cached filesystem from ‘/Users/macbookpro/Desktop/iBridge2,1,iBridge2,10,iBridge2,12,iBridge2,14,iBridge2,15,iBridge2,16,iBridge2,19,iBridge2,20,iBridge2,21,iBridge2,22,iBridge2,3,iBridge2,4,iBridge2,5,iBridge2,6,iBridge2,7,iBridge2,8_5.3_18P4556_Restore/038-69925-193.dmg’
Found ECID 5928812160352294
Getting ApNonce in recovery mode… 69 18 92 4d e1 13 f2 14 51 64 44 b9 c9 b8 92 a4 57 ac d6 62 54 3c 62 ef e8 b4 42 1b a6 c6 21 25
Trying to fetch new SHSH blob
Getting SepNonce in recovery mode… 4a 77 13 e1 3d a6 01 62 ae 37 e5 7d 0d 38 f4 2d d1 a0 77 05
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1… response successfully received
Received SHSH blobs
Extracting iBEC.j680.RELEASE.im4p…
Personalizing IMG4 component iBEC…
Sending iBEC (1189528 bytes)…
Recovery Mode Environment:
iBoot build-version=iBoot-6723.101.4
iBoot build-style=RELEASE
Extracting 038-69900-193.dmg.trustcache…
Personalizing IMG4 component RestoreTrustCache…
Sending RestoreTrustCache (10182 bytes)…
ramdisk-size=0x8000000
Extracting 038-69900-193.dmg…
Personalizing IMG4 component RestoreRamDisk…
Sending RestoreRamDisk (98285100 bytes)…
Extracting DeviceTree.j680ap.im4p…
Personalizing IMG4 component RestoreDeviceTree…
Sending RestoreDeviceTree (35665 bytes)…
Extracting sep-firmware.j680.RELEASE.im4p…
Personalizing IMG4 component RestoreSEP…
Sending RestoreSEP (4114154 bytes)…
Extracting kernelcache.release.ibridge2p…
Personalizing IMG4 component RestoreKernelCache…
Sending RestoreKernelCache (10026706 bytes)…
Waiting for device to enter restore mode…
About to restore device…
Connecting now…
Connected to com.apple.mobile.restored, version 15
Device 00008012-0015103926C20026 has successfully entered restore mode
Hardware Information:
BoardID: 11
ChipID: 32786
UniqueChipID: 5928812160352294
ProductionMode: true
Previous restore exit status: 0x100
Starting FDR listener thread
About to send RootTicket…
Sending RootTicket now…
Done sending RootTicket
Waiting for NAND (28)
Updating NAND Firmware (58)
Got status message
Status: Disk Failure
Log is available:
[01:21:23.0095-GMT]{3>8} CHECKPOINT NOTICE: Image4 device: AP nonce clearable
entering ramrod_clear_ap_nonce
[01:21:23.0348-GMT]{3>8} CHECKPOINT NOTICE: AP nonce consumed
[01:21:23.0348-GMT]{3>8} CHECKPOINT NOTICE: Pre-existing NVRAM variable: auto-boot=false
[01:21:23.0348-GMT]{3>8} CHECKPOINT NOTICE: Pre-existing NVRAM variable: restore-outcome=initial_monitor_no_return
[01:21:23.0349-GMT]{3>8} CHECKPOINT PROGRESS: START (unknown) -> (initial_engine_no_return)
[01:21:23.0349-GMT]{3>8} CHECKPOINT NOTICE: NVRAM access available on initial check
restore-outcome = initial_engine_no_return
executing /usr/sbin/nvram restore-outcome=initial_engine_no_return
[01:21:23.0598-GMT]{3>8} CHECKPOINT BEGIN: MAIN:[0x0400] umask
restore-step-ids = {0x11030400:1}
restore-step-names = {0x11030400:umask}
restore-step-uptime = 1
restore-step-user-progress = -1
[01:21:23.0598-GMT]{3>8} CHECKPOINT END: MAIN:[0x0400] umask
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = -1
[01:21:23.0598-GMT]{3>8} CHECKPOINT BEGIN: MAIN:[0x0402] setvbuf
restore-step-ids = {0x11030402:2}
restore-step-names = {0x11030402:setvbuf}
restore-step-uptime = 1
restore-step-user-progress = -1
[01:21:23.0599-GMT]{3>8} CHECKPOINT END: MAIN:[0x0402] setvbuf
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = -1
[01:21:23.0599-GMT]{3>8} CHECKPOINT BEGIN: MAIN:[0x0403] kernel_logger_thread
restore-step-ids = {0x11030403:3}
restore-step-names = {0x11030403:kernel_logger_thread}
restore-step-uptime = 1
restore-step-user-progress = -1
[01:21:23.0599-GMT]{3>8} CHECKPOINT END: MAIN:[0x0403] kernel_logger_thread
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = -1
[01:21:23.0599-GMT]{3>8} CHECKPOINT BEGIN: MAIN:[0x0406] set_progress_0
restore-step-ids = {0x11030406:4}
restore-step-names = {0x11030406:set_progress_0}
restore-step-uptime = 1
restore-step-user-progress = -1
[01:21:23.0599-GMT]{3>8} CHECKPOINT END: MAIN:[0x0406] set_progress_0
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = 0
[01:21:23.0599-GMT]{3>8} CHECKPOINT BEGIN: MAIN:[0x0408] listen_for_log_client
restore-step-ids = {0x11030408:5}
restore-step-names = {0x11030408:listen_for_log_client}
restore-step-uptime = 1
restore-step-user-progress = 0
[01:21:23.0600-GMT]{3>8} CHECKPOINT END: MAIN:[0x0408] listen_for_log_client
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = 0
[01:21:23.0600-GMT]{3>8} CHECKPOINT BEGIN: MAIN:[0x040D] create_listen_socket
restore-step-ids = {0x1103040D:6}
restore-step-names = {0x1103040D:create_listen_socket}
restore-step-uptime = 1
restore-step-user-progress = 0
[01:21:23.0600-GMT]{3>8} CHECKPOINT END: MAIN:[0x040D] create_listen_socket
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = 0
[01:21:23.0600-GMT]{3>8} CHECKPOINT BEGIN: MAIN:[0x0404] update_root_mount
restore-step-ids = {0x11030404:7}
restore-step-names = {0x11030404:update_root_mount}
restore-step-uptime = 1
restore-step-user-progress = 0
[01:21:23.0602-GMT]{3>8} CHECKPOINT END: MAIN:[0x0404] update_root_mount
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = 0
[01:21:23.0602-GMT]{3>8} CHECKPOINT BEGIN: MAIN:[0x0405] disable_watchdog
restore-step-ids = {0x11030405:8}
restore-step-names = {0x11030405:disable_watchdog}
restore-step-uptime = 1
restore-step-user-progress = 0
[01:21:23.0602-GMT]{3>8} CHECKPOINT END: MAIN:[0x0405] disable_watchdog
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 1
restore-step-user-progress = 0
[01:21:23.0602-GMT]{3>8} CHECKPOINT BEGIN: MAIN:[0x040E] enable_usb
restore-step-ids = {0x1103040E:9}
restore-step-names = {0x1103040E:enable_usb}
restore-step-uptime = 1
restore-step-user-progress = 0
waiting for matching IOKit service: {
IOProviderClass = AppleUSBDeviceMux;
}
[01:21:26.0612-GMT]{3>8} CHECKPOINT END: MAIN:[0x040E] enable_usb
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
waiting for host to trigger start of restore [timeout of 120 seconds]
recv(9, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(10, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(11, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(13, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(10, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(14, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(11, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(13, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(14, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(12, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(13, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(12, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(13, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(12, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(15, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(12, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(13, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(12, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(13, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(12, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(12, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(13, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(13, 4) failed: connection closed
recv(12, 4) failed: connection closed
unable to read message size: -1
could not receive message
unable to read message size: -1
could not receive message
recv(13, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(12, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(12, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(13, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(12, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(13, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(12, 4) failed: connection closed
unable to read message size: -1
could not receive message
[01:21:26.0659-GMT]{3>8} CHECKPOINT BEGIN: RESTORED:[0x0600] client_protocol_version
restore-step-ids = {0x11030600:10}
restore-step-names = {0x11030600:client_protocol_version}
restore-step-uptime = 4
restore-step-user-progress = 0
client protocol version 15
[01:21:26.0659-GMT]{3>8} CHECKPOINT END: RESTORED:[0x0600] client_protocol_version
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
[01:21:26.0659-GMT]{3>8} CHECKPOINT BEGIN: RESTORED:[0x0601] copy_restore_options
restore-step-ids = {0x11030601:11}
restore-step-names = {0x11030601:copy_restore_options}
restore-step-uptime = 4
restore-step-user-progress = 0
unable to open /usr/local/share/restore//options.j680.plist: No such file or directory
0: NSPOSIXErrorDomain/2: create_dictionary_from_plist: unable to open plist
unable to open /usr/local/share/restore//options.plist: No such file or directory
0: NSPOSIXErrorDomain/2: create_dictionary_from_plist: unable to open plist
*** UUID 2D277D58-E482-D53B-28BD-FDB56123C6FD ***
Restore options:
PersonalizedDuringPreflight => <CFBoolean 0x10621a038 [0x106051a10]>{value = true}
CreateFilesystemPartitions => <CFBoolean 0x10621a050 [0x106051a10]>{value = false}
UUID => <CFString 0x108d11390 [0x106051a10]>{contents = «2D277D58-E482-D53B-28BD-FDB56123C6FD»}
[01:21:26.0660-GMT]{3>8} CHECKPOINT END: RESTORED:[0x0601] copy_restore_options
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
[01:21:26.0660-GMT]{3>8} CHECKPOINT BEGIN: RESTORED:[0x0655] is_host_compatible
restore-step-ids = {0x11030655:12}
restore-step-names = {0x11030655:is_host_compatible}
restore-step-uptime = 4
restore-step-user-progress = 0
Checkpoint engine recorder path set to /mnt5
[01:21:26.0661-GMT]{3>8} CHECKPOINT END: RESTORED:[0x0655] is_host_compatible
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
[01:21:26.0661-GMT]{3>8} CHECKPOINT BEGIN: RESTORED:[0x0604] set_weight_from_options
restore-step-ids = {0x11030604:13}
restore-step-names = {0x11030604:set_weight_from_options}
restore-step-uptime = 4
restore-step-user-progress = 0
[01:21:26.0661-GMT]{3>8} CHECKPOINT END: RESTORED:[0x0604] set_weight_from_options
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
[01:21:26.0661-GMT]{3>8} CHECKPOINT BEGIN: RESTORED:[0x068F] libauthinstall_callback
restore-step-ids = {0x1103068F:14}
restore-step-names = {0x1103068F:libauthinstall_callback}
restore-step-uptime = 4
restore-step-user-progress = 0
[01:21:26.0662-GMT]{3>8} CHECKPOINT END: RESTORED:[0x068F] libauthinstall_callback
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
[01:21:26.0662-GMT]{3>8} CHECKPOINT BEGIN: RESTORED:[0x060B] update_ticket
restore-step-ids = {0x1103060B:15}
restore-step-names = {0x1103060B:update_ticket}
restore-step-uptime = 4
restore-step-user-progress = 0
entering ramrod_ticket_update_verify
looking up boot manifest hash
device tree ticket_hash: 7212DD6C4CA7FAB3C806C5EB30A5A0D2DFCE3C9F92BDC089120B6F2E419654A50CAC9B8E75F286929C5542FCCCD19C4A
crypto-hash-method found. Using SHA2-384
computed ticket_hash : 7212DD6C4CA7FAB3C806C5EB30A5A0D2DFCE3C9F92BDC089120B6F2E419654A50CAC9B8E75F286929C5542FCCCD19C4A
received valid ticket (5633 bytes)
[01:21:26.0664-GMT]{3>8} CHECKPOINT END: RESTORED:[0x060B] update_ticket
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
[01:21:26.0664-GMT]{3>8} CHECKPOINT BEGIN: RESTORED:[0x060D] wait_for_storage
restore-step-ids = {0x1103060D:16}
restore-step-names = {0x1103060D:wait_for_storage}
restore-step-uptime = 4
restore-step-user-progress = 0
entering wait_for_storage_device
entering ramrod_nudge_SMC_progress
Nudging SMC progress percentage by 6
Read (0x7) for key EFBP
Searching for NAND service
Searching for NAND service
Found NAND service: AppleANS2NVMeController
NAND initialized. Waiting for devnode.
entering wait_for_device: ‘EmbeddedDeviceTypeRoot’
Using device path /dev/disk0 for EmbeddedDeviceTypeRoot
entering ramrod_probe_media_internal
entering wait_for_device: ‘EmbeddedDeviceTypeRoot’
Using device path /dev/disk0 for EmbeddedDeviceTypeRoot
[01:21:26.0669-GMT]{3>8} CHECKPOINT END: RESTORED:[0x060D] wait_for_storage
restore-step-ids = {}
restore-step-names = {}
restore-step-uptime = 4
restore-step-user-progress = 0
[01:21:26.0669-GMT]{3>8} CHECKPOINT BEGIN: RESTORED:[0x060E] update_NAND_firmware
restore-step-ids = {0x1103060E:17}
restore-step-names = {0x1103060E:update_NAND_firmware}
restore-step-uptime = 4
restore-step-user-progress = 0
entering ramrod_nudge_SMC_progress
Nudging SMC progress percentage by 6
Read (0xD) for key EFBP
entering update_NAND
executing /usr/bin/nvmefwupdater —query
recv(15, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(15, 4) failed: connection closed
unable to read message size: -1
could not receive message
recv(15, 4) failed: connection closed
unable to read message size: -1
could not receive message
S4E/0000001602019395.pak
NAND update file: «/usr/standalone/firmware/S4E/0000001602019395.pak»
executing /usr/bin/nvmefwupdater —validate /usr/standalone/firmware/S4E/0000001602019395.pak
s4e-bfh-params: 50555746 00040001 004880E6 00060002 100008A8
Performing BFH OFW stage…
set_pci_port_state: result=0
set_pci_port_state: result=0
returning Regular Update Required
executing /usr/bin/nvmefwupdater —update /usr/standalone/firmware/S4E/0000001602019395.pak
Downloading FW…
Activating FW…
Successfully updated FW…
Clog Mismatch found…
Update NAND — FTL version mismatch. Erase install required
failed to update NAND
0: RamrodErrorDomain/7: update_NAND: Update NAND — FTL version mismatch. Erase install required
unable to convert ramrod error 7
[01:21:32.0601-GMT]{3>8} CHECKPOINT FAILURE:(FAILURE:6) RESTORED:[0x060E] update_NAND_firmware [0]D(failed to update NAND firmware)[1]D(update_NAND: Update NAND — FTL version mismatch. Erase install required)
restore-step-results = {0x1107060E:{0:6}}
restore-step-codes = {0x1107060E:{0:6}}
restore-step-domains = {0x1107060E:{0:»AMRestoreErrorDomain»}}
restore-step-error = {0x1107060E:»[0]D(failed to update NAND firmware)[1]D(update_NAND: Update NAND — FTL version mismatch. Erase install required)»}
restore-step-uptime = 10
restore-step-user-progress = 0
[01:21:32.0601-GMT]{3>8} CHECKPOINT NOTICE: (NVRAM set) restore-step-user-progress=0 [sync=true] (first failure)
[01:21:32.0601-GMT]{3>8} CHECKPOINT BEGIN: RESTORED:[0x067C] cleanup_boot_command
restore-step-ids = {0x1103060E:17;0x1103067C:18}
restore-step-names = {0x1103060E:update_NAND_firmware;0x1103067C:cleanup_boot_command}
restore-step-uptime = 10
restore-step-user-progress = 0
entering reset_boot_command_if_value
executing /usr/sbin/nvram -d recovery-boot-mode
Successfully deleted recovery-boot-moderecovery-boot-mode
executing /usr/sbin/nvram -d iboot-failure-reason
Successfully deleted iboot-failure-reasoniboot-failure-reason
[01:21:32.0617-GMT]{3>8} CHECKPOINT END: RESTORED:[0x067C] cleanup_boot_command
restore-step-ids = {0x1103060E:17}
restore-step-names = {0x1103060E:update_NAND_firmware}
restore-step-uptime = 10
restore-step-user-progress = 0
[01:21:32.0617-GMT]{3>8} CHECKPOINT BEGIN: RESTORED:[0x1613] cleanup_recovery_os_volume
restore-step-ids = {0x1103060E:17;0x11031613:19}
restore-step-names = {0x1103060E:update_NAND_firmware;0x11031613:cleanup_recovery_os_volume}
restore-step-uptime = 10
restore-step-user-progress = 0
[01:21:32.0617-GMT]{3>8} CHECKPOINT END: RESTORED:[0x1613] cleanup_recovery_os_volume
restore-step-ids = {0x1103060E:17}
restore-step-names = {0x1103060E:update_NAND_firmware}
restore-step-uptime = 10
restore-step-user-progress = 0
[01:21:32.0617-GMT]{3>8} CHECKPOINT BEGIN: RESTORED:[0x0647] cleanup_check_result
restore-step-ids = {0x1103060E:17;0x11030647:20}
restore-step-names = {0x1103060E:update_NAND_firmware;0x11030647:cleanup_check_result}
restore-step-uptime = 10
restore-step-user-progress = 0
[01:21:32.0618-GMT]{3>8} CHECKPOINT END: RESTORED:[0x0647] cleanup_check_result
restore-step-ids = {0x1103060E:17}
restore-step-names = {0x1103060E:update_NAND_firmware}
restore-step-uptime = 10
restore-step-user-progress = 0
[01:21:32.0618-GMT]{3>8} CHECKPOINT BEGIN: RESTORED:[0x0648] cleanup_send_final_status
restore-step-ids = {0x1103060E:17;0x11030648:21}
restore-step-names = {0x1103060E:update_NAND_firmware;0x11030648:cleanup_send_final_status}
restore-step-uptime = 10
restore-step-user-progress = 0

ERROR: Unable to successfully restore device
ERROR: Unable to restore device
macbookpro@MacBook-Pro-2 ~ %

Разработчики 3uTools постарались и создали софт подходящий и для обычного пользователя устройства на платформе iOS, и для мастеров по ремонту телефонов и пайке motherboard. Для обучения пайке плат в Bgacenter, 3uTools применяется на постоянной основе. Давайте узнаем о преимуществах и применимости этой программы.

Для начала использования, необходимо скачать 3uTools. Рекомендуем скачивать с сайта разработчика: 3u.com. Следующий шаг, установка на свой ПК. Сразу же необходимо сделать пометку, что этот софт разработан для операционной системы Windows. Если Вы владелец iMac или MacBook, необходимо чуть больше усилий для установки. Один из вариантов, сначала установить виртуальную машину на Mac.

Как пользоваться 3uTools

После установки программы, подключаем айфон через кабель Lightning/USB. Из опыта выполненных прошивок более 1000 айфонов, рекомендуем использовать оригинальный кабель. Как говорят мастера “из коробки”. При подключении возможны два варианта:

• Устройство не определяется ноутбуком, посмотрите материал на тему неисправности телефона по ссылке далее – Неисправность телефона.
• Если всё хорошо и айфон определился, перед нами главное меню. В статье рассматривается клиентский iPhone 7, imei и серийный номер заретуширован в Фотошоп.

Подключая телефон впервые необходимо ввести пароль от экрана и нажать на “Доверять этому устройству”, для того чтобы 3uTools определил подключаемое устройство. При последующих подключениях, определение происходит автоматически.

Обзор программы

Первый экран. На нем размещены:

1. Главное меню.
2. Боковое меню.
3. Кнопка с информацией об аккумуляторной батарее.
4. Кнопка “Отчет подтверждения”.
5. Блок с кнопками для управления устройством (можно выключить телефон).
6. Кнопка “Закрыть iTunes”. Закрывает открытую программу iTunes.
7. Кнопка “Инструменты”.

Состояние батареи

Нажав эту кнопку открывается следующее информационное окно.

В этом разделе для нас будет информативным:

• Количество раз зарядки АКБ. Можно понять, батарейка находящаяся по факту в телефоне установлена на заводе или была заменена.
• Состояние батареи. Предупреждает о необходимости замены АКБ. Если менее 80%, аккумуляторную батарею рекомендуется заменить.

Отчет подтверждения

При нажатии на кнопку “Показать отчет подтверждения”, открывается следующий отчет:

В столбце Test Result, компоненты замены которых не было, обозначены надписью Normal, зеленого цвета. Тест осуществляется на основании сравнения серийных номеров

Если же была замена, то программа выделит красным цветом и сделает соответствующую запись. В моем случае, была заменена батарея. Если Вы сравните серийные номера в столбцах Ex-factory Value и Read Value, то они разные.   

Инструменты

Нажимая на кнопку “Инструменты” открывается следующее окно:

1. Резерв./Восстан.
2. Прошивка.
3. В режим восстан.
4. Перезагрузить. Здесь всё понятно.Перезагружает телефон или планшет.
5. Выключить. Позволяет выключать устройство не используя кнопку Power. Это удобно, когда прошиваете только материнскую плату, с отключенным шлейфом кнопки включения.
6. Не обновлять iOS. Устанавливается запрет на обновление версии прошивки.
7. Удобный доступ. Выводит или убирает с экрана AssistiveTouch.
8. Обновить. Всегда старайтесь обновлять версию 3uTools до последней, актуальной. Хотя среди некоторых мастеров и бытует мнение, что лучше не обновлять. Это не так.

Как самостоятельно прошить телефон

Для того чтобы прошить устройство самостоятельно, необходимо следовать простой инструкции:

1. Обновить 3uTools.
2. Подключить смартфон или планшет по USB кабелю к ноутбуку.
3. Сделать резервную копию данных, в iCloud или на ПК.
4. Нажать на кнопку “Прошивка и JB”, затем выбрать необходимую версию прошивки и нажать кнопку “Прошивка”. Примерно через 3 – 5 минут ваш телефон прошьется и перезагрузится. 
5. Активировать телефон.

Рекомендованный материал в блоге Bgacenter на тему прошивок айфон по ссылке далее – Как прошить айфон.

Если при обновлении (режим Recovery), программа выдает ошибку, возможно недостаточно объема памяти телефона (NAND Flash). И в этом случае единственный вариант – прошить в режиме dfu, с полной потерей данных. DFU – это режим восстановления (Device Firmware Update) актуальной версии iOS подписываемой на серверах Apple.

Один из вариантов, как ввести телефон в режим восстановления (не нажимая кнопок), подключить к компьютеру через кабель MAGIC.

Прошивка и JB

Диалоговое окно “Прошивка” содержит дополнительные возможности. Вот некоторые из них:

• Позволяет загрузить версию прошивки, начать прошивать устройство, восстановить из резервной копии.

• Множественная прошивка. Используя эту опцию можно прошивать несколько устройств одновременно. В Bgacenter большой объем выполняемых ремонтов, и мы часто пользуемся этим разделом.

• Прошивки. Это раздел программы для скачивания разных версий прошивок, доступных для определенной модели устройства.

3uTools ошибки

Коды часто встречающихся при ремонтах ошибок:

• 11% ERROR: Unable to switch DFU Mode to Recovery Mode. Невозможно переключить режим DFU в режим восстановления.
• 20%. Чаще всего это неисправность памяти телефона. Как вариант большое количество bad block. В этом случае необходимо память заменить используя программатор. Рекомендованный материал в блоге Bgacenter на тему замены памяти по ссылке далее – Айфон 8 не включается.
• 80% ERROR: Unable to restore device (-1). Не удается восстановить устройство. Довольно часто программа выдает ошибку на восьмидесяти процентах при неисправном Baseband. Рекомендованная статья на тему ремонта сети – Айфон 7 нет сети. 

Преимущества 3uTools

Программа имеет следующие преимущества (среди похожих софтов: iTunes, i4Tools, Test & Check for iPhone (устанавливается из App Store), iTools, Tongbu, PPHelper):

• Самый важный плюс программы, это возможность прошивать все устройства iOS. И ещё одна особенность, 3uTools может докачать прошивку, после временного отсутствия интернета. В iTunes такая возможность не предусмотрена. Актуально при скачивании ПО например на iPhone SE (2020), которая весит 3,83 Gb, и не очень высокой скорости загрузки. 
• Абсолютно бесплатная.
• Для работы не требуется регистрация. Нужен лишь код пароль от экрана или сохраненный отпечаток пальца, для разблокировки устройства. 
• Быстрая установка.
• На русском языке, с 2017 года.
• Перенос файлов на компьютер, особенно видео в высоком качестве, быстро и просто.
• Есть возможность сделать полный дамп прошивки, для этого необходимо знать учетную запись и пароль от iCloud.
• Осуществляется поддержка от разработчика по email.
• Возможность запретить обновление устройства.
• Удобный и понятный интерфейс.

Недостатки 3uTools:

• Разработан для операционной системы Windows.
• Если плата менялась, с перекидкой микросхем, то 3uTools этого не покажет. В этом случае нельзя доверять на 100% при проверке. Рекомендованный материал в блоге Bgacenter по ссылке далее – iPhone 7 замена платы.
• больше не нашел

Crash Analysis

Анализ аварий (Crash Analysis) – полезный функционал, позволяет определить причину перезагрузки устройства. Рассмотрим на примере iPhone 12 Pro Max. После перезагрузки смартфона, подключаем телефон к ноутбуку с установленным заранее 3uTools.

Crash Analysis

Затем нажимая на кнопку Crash Details, открывается следующее диалоговое окно, где уже можно выбрать последний отчет. В котором будет указана причина перезагрузки.

Выбор последнего отчета

В открывшемся окне “Анализ сбоев” ищем причину перезагрузки телефона.

Анализ сбоев iPhone 12 Pro Max

Выводы

• 3uTools, это бесплатный профессиональный софт для диагностики и ремонта телефонов и планшетов на платформе iOS.
• Применяется мастерами по ремонту телефонов, для диагностики и прошивки устройств.
• Подробнее, как пользоваться на практике 3uTools, вы можете научиться на курсах пайки BGA.

Moderators: Lily Lee, jc_3u, Moderators

Return to “Help & Support”

[Question] iPad 2,4 Restore Waiting for NAND

I tried doing a regular restore to 9.3.5 on my iPad 2,4 using iTunes, but it kept hanging on waiting for device. I then decided to use libimobiledevice so I could get some verbosity, but it got stuck waiting for NAND as shown below. Fortunately, I was able exit recovery and continue using 7.1.2 (I have blobs too, but that’s irrelevant here). I’ve tried on another computer, and I get the same issue. I can restore other idevices with no problems. Everything works fine on the iPad on a daily basis, but I can’t restore (I am perfectly fine with 7.1.2). Could this be internal hardware problem with the iPad?

idevicerestore -e iPad2,4_9.3.5_13G36_Restore.ipsw

NOTE: Updated version data. Found device in Normal mode Identified device as k93aap, iPad2,4 Extracting BuildManifest from IPSW Product Version: 9.3.5 Product Build: 13G36 Major: 13 Device supports Image4: false Variant: Customer Erase Install (IPSW) This restore will erase your device data. Found ECID XXXXXXXXXXXX Getting ApNonce in normal mode… xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx Trying to fetch new SHSH blob Getting SepNonce in normal mode… Unable to get SEPNonce from lockdownd failed WARNING: Unable to find BbChipID node WARNING: Unable to find BbSkeyId node Request URL set to https://gs.apple.com/TSS/controller?action=2 Sending TSS request attempt 1… response successfully received Received SHSH blobs Extracting filesystem from IPSW Entering recovery mode… INFO: device serial number is XXXXXXXXXXXX Sending APTicket (2732 bytes) Extracting iBEC.k93a.RELEASE.dfu… Not personalizing component iBEC… Sending iBEC (283020 bytes)… Getting ApNonce in recovery mode… xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx Sending APTicket (2732 bytes) Recovery Mode Environment: iBoot build-version=iBoot-2817.60.2 iBoot build-style=RELEASE Sending AppleLogo… Extracting applelogo.s5l8942x.img3… Not personalizing component AppleLogo… Sending AppleLogo (5388 bytes)… ramdisk-size=0x4000000 Extracting 058-49111-036.dmg… Not personalizing component RestoreRamDisk… Sending RestoreRamDisk (20775180 bytes)… Extracting DeviceTree.k93aap.img3… Not personalizing component RestoreDeviceTree… Sending RestoreDeviceTree (75532 bytes)… Extracting kernelcache.release.k93a… Not personalizing component RestoreKernelCache… Sending RestoreKernelCache (10618828 bytes)… About to restore device… Waiting for device… Device xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx is now connected in restore mode… Connecting now… Connected to com.apple.mobile.restored, version 13 Device xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx has successfully entered restore mode Hardware Information: BoardID: 6 ChipID: 35138 UniqueChipID: XXXXXXXXXXXX ProductionMode: true Starting FDR listener thread ERROR: Unable to connect to FDR client (-2) ERROR: Failed to start FDR Ctrl channel About to send RootTicket… Sending RootTicket now… Done sending RootTicket Waiting for NAND (28)

(Note that FDR errors don’t seem to be a problem because other successful restores show this too.)

As a few people had this issue, I decided to dig a little into it and get to see what cause the error «Waiting for device» in libimobiledevice app during a CFW restore.
The issue: Incorrect usage of patches for iBEC and iBSS, ASR. If you use the patches without having an iBOOT exploit, your device would likely fail with that error.

The NAND ATTACK:
The NAND attack consists in using cached files in the phone’s memory from a failed attempt. By using them, your device has chances to skip ASR as the verification went to 100% already.
For that you need to skip patching part (iBEc and iBSS and ASR).

In the video I show the concept of NAND Attack and also how to fix Waiting for Device issue.
As a bonus, I show you where to find the correct Base Addr for iBOOT in IDA so you can start researching if you have Assembly knowledge.

The NAND (NOT AND GATE) is a non-volatile memory chip that is used in all iDevices. This is the chip who stores anything from the system (including USER DATA and SYSTEM FILES). The main DMGs are being monted on this chip and it defines the storage of the device (from 4GB up to 128GB depending on the model).

If you want to attack the ROOT File System, this is where you will start.

What only a few people know is that although this chip shows only two visible File Systems, it actually has more, such as NVRAM, BOOT Files, SCFG (System Configuration) and so on, so it is a valuable piece for Jailbreakers too.

iCloud Bypass in it’s standard concept is not very hard. You have to remove (by some way) the Setup.app inside the ROOT FS, in the Applications folder. By doing so, your device will start but the «Hello Screen» which is in fact this Setup.app, won’t appear as it was removed.

In a normal case, during the BOOT, the Springboard (containing all apps) loads first, and on top of it, the Setup.app. That’s why if you overload the Setup.app (with emojis) you will make it crash, and for a second you can see the springboard. It is under Setup.app.

If we remove the Setup.app entirely, there would be nothing to start on top of Springboard and also there would be no lock in process to make Springboard freeze, therefore you will be able to use iPhone’s apps.

On iPhone 4 and all A4 processor devices from Apple, limera1n exploit made it easy to SSH into the System via Power Cord and SSH Ramdisk file, and you can use a SCP client like WinSCP in order to remove this Setup.app.

The lack of such exploit for A6 devices and A5 ones (iPhone 4S, 5, 5C etc.) makes it impossible to SSH into it, therefore, we use CFW already patched.

Although this tutorial is provided as «iOS 9.2.1», it works for all versions for which you can grab ROOT KEYS (AES) to decrypt the DMGs.

You can find such keys on The iPhone Wiki (a link was added at the links section down bellow, check it out).

Libimobiledevice: http://quamotion.mobi/iMobileDevice/download
Keys: https://www.theiphonewiki.com/wiki/Firmware

CFW making tutorial: https://www.youtube.com/watch?v=KQNYkp64oL4
(Just skip the patching part)

Tested on iPhone 4S, but works on all devices that have keys published.

I made a dissembled iBOOT for n42 and n49 available on the forum.
http://forum.fce365.info

//WORK IN PROGRESS