blobsaver-newdevice-gui

Save SHSH2 blobs with blobsaver 3.6.0 for devices that are missing from its model dropdown — M4 iPad Pro, M3/M2 iPad Air, and anything else newer than October 2022.

中文说明见下方

---

The problem

blobsaver is the standard cross-platform tool for saving SHSH2 blobs. Its last release, v3.6.0 (26 Oct 2024), ships a device table that stops at iPad14,6 — the M2 iPad Pro from October 2022.

That means the GUI dropdown has no entry for:

Device	Identifier	In v3.6.0?	In master?
iPhone 16 / Plus / Pro / Pro Max / 16e	iPhone17,1 – iPhone17,5	no	yes
iPhone 17 / Pro / Pro Max / Air / 17e	iPhone18,1 – iPhone18,5	no	no
iPad Air 11" / 13" (M2)	iPad14,8 – iPad14,11	no	yes
iPad Air 11" / 13" (M3), iPad (A16)	iPad15,3 – iPad15,8	no	yes
iPad mini (A17 Pro)	iPad16,1 – iPad16,2	no	yes
iPad Pro 11" / 13" (M4)	iPad16,3 – iPad16,6	no	yes
iPad Pro 11" / 13" (M5)	iPad17,1 – iPad17,4	no	no

The released iPhone table stops at iPhone16,2 (iPhone 15 Pro Max) and the iPad table at iPad14,6 (M2 iPad Pro, October 2022). If you own anything newer, the dropdown gives you nothing to select.

Note the last column: iPhone 17 and M5 iPad Pro are not in master either, so building blobsaver from source does not help those devices. The approach in this repository does, because it never consults that table at all.

Is this your problem?

If any of these match, you are in the right place:

• Your iPhone or iPad is not in blobsaver's Device Model dropdown
• blobsaver has no entry for iPhone 16, iPhone 17, iPhone Air, M4 / M5 iPad Pro, M2 / M3 iPad Air, iPad mini (A17 Pro), or iPad (A16)
• You ran the CLI and got "iPadXX,X" is not a valid identifier
• You ran the CLI and got A board configuration is required for this device.
• The output says Device Name: null and you are not sure whether that broke something (it did not — see below)
• You are on Windows and blobsaver.exe prints nothing at all when run from a console

The finding

The device table only feeds the dropdown. It is not used to validate anything.

The only device check performed before saving is in TSS.java:

Devices.getDeviceType(deviceIdentifier);   // prefix only: iPhone / iPad / iPod / AppleTV / iBridge

getDeviceType("iPad16,3") returns "iPad" and passes. The properties file is only read by identifierToModel(), which supplies a display name and the ${Name} path variable.

So blobsaver 3.6.0's CLI already works for these devices today — you just cannot reach it through the dropdown.

Verified, not assumed

Run against the real v3.6.0 binary:

Command	Result
--identifier Foo9,9	"Foo9,9" is not a valid identifier — rejected at validation
--identifier iPad16,3 (no boardconfig)	A board configuration is required for this device. — device accepted, only the board is missing
--identifier iPad16,3 --boardconfig j717ap	reaches the network stage
--identifier iPad13,1 (an officially listed device)	identical result

The last two behave the same, which means an "unsupported" identifier travels the same code path as a supported one.

What this is

A single PowerShell script that puts a small window in front of blobsaver's CLI.

It does not modify blobsaver. No patching, no file replacement, nothing written to its install directory. It launches the stock blobsaver.exe with command-line arguments and reads the output back. Delete the script and blobsaver is untouched; reinstall blobsaver and the script still works. The blobs produced are byte-for-byte equivalent to the official GUI's, because the same binary saves them.

Usage

Requirements

1. blobsaver 3.6.0 installed
2. Apple device drivers — the Apple Devices app from the Microsoft Store, or iTunes
3. Windows with PowerShell 5.1 or later (built into Windows 10/11)

Steps

Put blobsaver-gui.ps1 and run-gui.bat in the same folder, double-click run-gui.bat, then work through the buttons in order:

1. Read device info — fills in ECID, identifier and board config straight from the device
2. Read ApNonce / Generator — the device reboots into recovery mode several times; do not unplug. A12+ and M-series devices need this pair, and a blob saved without it is useless. Write both values down and store them somewhere other than next to the blobs.
3. Save blobs — saves every currently signed version. Tick the beta box to include betas and RCs as well; there are usually far more of those than release versions, and they stop being signed much sooner.
4. Add to background auto-save (optional) — registers a scheduled task. Later runs do not need the device connected, since the ECID / ApNonce / Generator are stored in the entry.

Device Name: null in the output is expected — 3.6.0 has no display name for these models. It changes nothing.

Notes

• Saving blobs is not the same as being able to downgrade. For A12+ and M-series devices there is currently no public downgrade path at all; see LukeZGD's status table. Blobs can only be requested while Apple is still signing a version, so saving them now preserves an option that cannot be recreated later — whether that option ever becomes usable is a separate question.
• The beta list comes from the third-party betahub.cn, not from Apple. blobsaver queries it for beta firmwares and keeps entries whose signing field equals 1. If saving fails with a betahub-related error, untick the box and save release versions only.
• Saving is slow, and that is normal. blobsaver loops over versions sequentially, passes --nocache to tsschecker, downloads a BuildManifest per version, and each version costs 2–4 separate round trips to Apple's signing server gs.apple.com, which is a single slow endpoint rather than a CDN. Already-saved versions are skipped on later runs unless "Always save new blobs" is enabled.
• This is a stopgap. The real fix is four lines of text in a properties file, and it is already in blobsaver's master. When a new release ships, use the official GUI instead.

Credits

All the actual work is done by airsquared/blobsaver and tsschecker. This repository is not affiliated with either project.

MIT licensed. See LICENSE.

---

中文

给 blobsaver 3.6.0 下拉框里没有的设备保存 SHSH2 blob —— M4 iPad Pro、M3/M2 iPad Air，以及任何 2022 年 10 月之后的新机型。

问题

blobsaver 是保存 SHSH2 blob 的主流跨平台工具。它最后一个版本 v3.6.0（2024-10-26） 内置的设备表停在 iPad14,6，也就是 2022 年 10 月的 M2 iPad Pro。

设备	标识符	v3.6.0 有吗	master 有吗
iPhone 16 / Plus / Pro / Pro Max / 16e	iPhone17,1 – iPhone17,5	无	有
iPhone 17 / Pro / Pro Max / Air / 17e	iPhone18,1 – iPhone18,5	无	无
iPad Air 11" / 13" (M2)	iPad14,8 – iPad14,11	无	有
iPad Air 11" / 13" (M3)、iPad (A16)	iPad15,3 – iPad15,8	无	有
iPad mini (A17 Pro)	iPad16,1 – iPad16,2	无	有
iPad Pro 11" / 13" (M4)	iPad16,3 – iPad16,6	无	有
iPad Pro 11" / 13" (M5)	iPad17,1 – iPad17,4	无	无

已发布版本的 iPhone 表停在 iPhone16,2（iPhone 15 Pro Max），iPad 表停在 iPad14,6（2022 年 10 月的 M2 iPad Pro）。比这更新的机器，下拉框里一个都没有。

注意最后一列：iPhone 17 和 M5 iPad Pro 连 master 分支都没有，所以自己从源码编译对这两类设备也没用。本仓库的办法可以，因为它压根不看那张表。

你是不是遇到了这个问题

以下任意一条对得上，就是这里：

• 你的 iPhone 或 iPad 不在 blobsaver 的 Device Model 下拉框里
• blobsaver 里找不到 iPhone 16、iPhone 17、iPhone Air、M4 / M5 iPad Pro、M2 / M3 iPad Air、iPad mini (A17 Pro)、iPad (A16)
• 命令行报 "iPadXX,X" is not a valid identifier
• 命令行报 A board configuration is required for this device.
• 输出里出现 Device Name: null，不确定是不是出错了（没出错，见下文）
• Windows 上从控制台运行 blobsaver.exe 完全没有任何输出

发现

那张设备表只喂给下拉框，不参与任何校验。

保存前唯一的设备检查在 TSS.java 里：

Devices.getDeviceType(deviceIdentifier);   // 只看前缀：iPhone / iPad / iPod / AppleTV / iBridge

getDeviceType("iPad16,3") 返回 "iPad"，顺利通过。那个 properties 文件只被 identifierToModel() 用来显示型号名和填 ${Name} 路径变量。

也就是说，blobsaver 3.6.0 的命令行本来就支持这些设备，只是下拉框够不着。

实测，不是推测

拿真实的 v3.6.0 二进制跑：

命令	结果
--identifier Foo9,9	"Foo9,9" is not a valid identifier —— 卡在校验
--identifier iPad16,3（不给 boardconfig）	A board configuration is required for this device. —— 设备本身已通过，只缺板型
--identifier iPad16,3 --boardconfig j717ap	进入联网阶段
--identifier iPad13,1（官方支持的设备）	结果完全相同

后两条一模一样，说明"不支持"的标识符和官方支持的走的是同一条代码路径。

这是什么

一个 PowerShell 脚本，在 blobsaver 的命令行前面套了个窗口。

它不修改 blobsaver。 不打补丁、不替换文件、不往安装目录写任何东西，只是带参数启动原版 blobsaver.exe 再把输出读回来。删掉脚本，blobsaver 完全回到原样；blobsaver 卸载重装，脚本照样能用。存出来的 blob 和官方界面存的完全等价，因为本来就是同一个程序存的。

用法

前置条件

1. 装好 blobsaver 3.6.0
2. 苹果驱动 —— Microsoft Store 里的 Apple Devices 应用，或者 iTunes
3. Windows，PowerShell 5.1 及以上（Win10/11 自带）

步骤

把 blobsaver-gui.ps1 和 run-gui.bat 放同一个文件夹，双击 run-gui.bat，按顺序点：

1. 读取设备信息 —— 直接从设备读出 ECID、标识符、Board Config
2. 读取 ApNonce / Generator —— 设备会反复重启进恢复模式，别拔线。A12+ 和 M 系列必须有这对值，没有 ApNonce 的 blob 是废的。 把两个值抄下来，存到 blob 之外的地方。
3. 保存 blob —— 保存所有当前正在签名的版本。勾上 beta 会连 beta / RC 一起存；beta 通常比正式版多得多，而且停签快得多。
4. 加入后台自动保存（可选）—— 注册一个计划任务。以后自动保存不需要再连设备，ECID / ApNonce / Generator 已经存进条目里了。

输出里 Device Name: null 是正常的 —— 3.6.0 没有这些型号的显示名，不影响功能。

几点说明

• 存下 blob 不等于能降级。 A12+ 和 M 系列目前完全没有公开的降级路径，见 LukeZGD 的现状表。但 blob 只能趁苹果还在签名时索取，所以现在存下来保住的是一个过后无法重建的选项 —— 至于这个选项将来会不会变得可用，是另一个问题。
• beta 列表来自第三方 betahub.cn，不是苹果。 blobsaver 从那里取 beta 固件列表，只保留 signing 字段等于 1 的条目。如果保存时报 betahub 相关错误，取消勾选、只存正式版。
• 保存很慢，这是正常的。 blobsaver 串行遍历版本，给 tsschecker 传了 --nocache，每个版本单独下一次 BuildManifest，而且每个版本要向苹果签名服务器 gs.apple.com 发 2～4 次独立请求 —— 那是单一慢速端点，不是 CDN。已存过的版本在后续运行中会被跳过（除非开了 "Always save new blobs"）。
• 这是权宜之计。 真正的修复只是 properties 文件里的四行文本，而且 master 分支早就有了。等官方发新版，就用官方界面。

致谢

真正干活的是 airsquared/blobsaver 和 tsschecker。本仓库与这两个项目均无隶属关系。

MIT 许可证，见 LICENSE。

---

_{Keywords / 关键词: blobsaver, SHSH, SHSH2, blob, save blobs, futurerestore, tsschecker, APNonce, generator, nonce entanglement, ECID, board config, downgrade iOS, downgrade iPadOS, device not in list, unsupported device, iPhone 16, iPhone 17, iPhone Air, iPad Pro M4, iPad Pro M5, iPad Air M2, iPad Air M3, iPad mini A17 Pro, iPhone17,1, iPhone18,1, iPad16,3, iPad17,1, 保存 SHSH, 备份 SHSH2, 降级, 设备不支持, 下拉框没有我的设备}