Rust adaptations of the libimobiledevice stack, aimed at a pure-Rust
idevicerestore that also handles Apple silicon Macs (lpolrestore).
| Path | Crate | Adapts |
|---|---|---|
vendor/idevice |
idevice |
usbmuxd, lockdown, services, libirecovery, idevicerestore's restore loop (jkcoxson/idevice, MIT) |
crates/img4 |
imd-img4 (img4 bin) |
img4tool / idevicerestore img4.c: IMG4, IM4P, IM4M, IM4R, LocalPolicy |
crates/tatsu |
imd-tatsu |
libtatsu: TSS endpoints, .shsh2 ticket store, Ap,LocalPolicy requests |
crates/idevicerestore |
idevicerestore (bin) |
idevicerestore's CLI and DFU/recovery flow |
idevice already reimplements most of
libimobiledevice in Rust, including a restore stack (IPSW, TSS, IMG4
stitching, recovery/DFU over USB, restored, ASR, FDR). It has no Apple
silicon Mac support: no lpolrestore, and restored's RecoveryOSLocalPolicy
requests were advertised but dropped. Rewriting it would duplicate a lot of
working code, so it is vendored at a pinned revision and the gaps are filled
here.
Local changes to vendor/idevice are kept as small, separate commits
(git log -- vendor/idevice) so they can go upstream:
TSSRequest::send_to(url)and friends, for a TSS endpoint other than gs.apple.com (idevicerestore's-s).- A
LocalPolicySignerhook onRestoreContext, used forRecoveryOSLocalPolicy/RestoreLocalPolicy.
idevicerestore [-e] [-i ECID] [-s URL] [-t] [-C DIR] [--offline] IPSW
Flags follow the C tool where they overlap. -C DIR saves every TSS
response to DIR/shsh/*.shsh2 with the request that produced it;
--offline answers only from that store. For recoverypi's ticket shuttle,
point -s at the local proxy.
Flow:
- Find a device in DFU/recovery, or put a normal-mode device into recovery (reading ApNonce/SEPNonce via lockdown).
- Select the build identity; a manifest with a
macOS Customeridentity for the board marks a Mac restore. - Get the AP ticket.
- From DFU: send iBSS and reconnect, re-ticket if the nonce changed. On a
Mac, sign the empty LocalPolicy, send it, run
lpolrestore, then send the iBoot stage 1 components. Send iBEC. - Boot the restore ramdisk, then run the restored loop with FDR and, on a Mac, the LocalPolicy signer.
See docs/lpolrestore.md for the Mac details.
img4 dump FILE # IMG4/IM4P/IM4M/IM4R, LocalPolicy tags annotated
img4 empty-local-policy OUT # the IM4P a DFU restore signs
Builds and passes unit tests; not yet run against hardware. Known gaps:
RecoveryOSRootTicketData(Mac) is advertised by idevice but not answered yet; idevicerestore gets it from a separate recoveryOS TSS request.- Device disconnect/reconnect is detected by polling, not hotplug events.
- The DFU path (iBSS, then iBEC) is new relative to idevice's tool, which only started from recovery mode.
MIT. vendor/idevice is Copyright Jackson Coxson (MIT).