pymobiledevice3 restore¶
Restore/erase IPSWs, fetch blobs, and manage devices in Recovery/DFU.
enter-dfu¶
Guide you, step by step, through the buttons that put the device into DFU mode.
Options:
| Option | Description |
|---|---|
--ecid <str> |
Target device ECID; defaults to the first connected USB device or waits for Recovery/DFU. |
--manual |
Do the whole DFU button sequence yourself, instead of having a booted device restarted from here. |
shell¶
Open an IPython shell for talking to iBoot of a device in Recovery/DFU mode.
Options:
| Option | Description |
|---|---|
--ecid <str> |
Target device ECID; defaults to the first connected USB device or waits for Recovery/DFU. |
enter¶
Reboot a device in normal mode into Recovery mode (does nothing otherwise).
Options:
| Option | Description |
|---|---|
--ecid <str> |
Target device ECID; defaults to the first connected USB device or waits for Recovery/DFU. |
exit¶
Leave Recovery mode: enable auto-boot and reboot the device into iOS.
restart¶
Restart the device (also works from Recovery mode).
Options:
| Option | Description |
|---|---|
--ecid <str> |
Target device ECID; defaults to the first connected USB device or waits for Recovery/DFU. |
--vdm |
macOS, needs root: restart through the USB-C port controller with Apple's USB Power Delivery reboot message. Needs no pairing and works in Recovery mode; the device must be directly on a Thunderbolt/USB4 port. |
tss¶
Request SHSH blobs (TSS signing tickets) for the device from Apple and print them.
Options:
| Option | Description |
|---|---|
--ecid <str> |
Target device ECID; defaults to the first connected USB device or waits for Recovery/DFU. |
-i, --ipsw <str> |
Path or URL to an IPSW. If omitted, choose a signed build interactively. |
--ipsw-dir <path> |
Directory of downloaded IPSWs: reuse a build already there, and download new ones into it. [env var: PYMOBILEDEVICE3_IPSW_DIR] |
--beta |
Choose among the newest beta builds (listed by AppleDB) instead of signed releases (ipsw.me). |
--out <path> |
Also save the SHSH blob (TSS response) to this plist file. |
--behavior <Update\|Erase> |
Restore behavior to use when selecting the BuildIdentity. [default: Update] |
preflight¶
Show the preflight data lockdown reports before a restore (normal mode only).
Prints PreflightInfo (each peripheral updater's identity fields and current nonce), FirmwarePreflightInfo (baseband) and ApParameters (AP and SEP nonces).
Options:
| Option | Description |
|---|---|
--ecid <str> |
Target device ECID; defaults to the first connected USB device or waits for Recovery/DFU. |
preflight-requests¶
Ask the device to build each peripheral updater's TSS request for an IPSW.
Does what restored does during a restore (restoreserviced getdevicesidepreflightinfo; needs a tunnel and uploads each updater's firmware to the device). Prints the requests, their ticket and manifest tags, and the updaters that failed.
Options:
| Option | Description |
|---|---|
--ecid <str> |
Target device ECID; defaults to the first connected USB device or waits for Recovery/DFU. |
-i, --ipsw <str> |
Path or URL to an IPSW. If omitted, choose a signed build interactively. |
--ipsw-dir <path> |
Directory of downloaded IPSWs: reuse a build already there, and download new ones into it. [env var: PYMOBILEDEVICE3_IPSW_DIR] |
--beta |
Choose among the newest beta builds (listed by AppleDB) instead of signed releases (ipsw.me). |
--native |
macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE] |
--updater <str> |
Updater to query (repeatable); default: all of T200, Rose, SE, Vinyl, Savage, Centauri, Baseband except Baseband. |
Accepts the connection options: --rsd, --tunnel, --userspace.
ramdisk¶
Boot only the update ramdisk without performing a restore (IPSW path or URL accepted).
Options:
| Option | Description |
|---|---|
--ecid <str> |
Target device ECID; defaults to the first connected USB device or waits for Recovery/DFU. |
-i, --ipsw <str> |
Path or URL to an IPSW. If omitted, choose a signed build interactively. |
--ipsw-dir <path> |
Directory of downloaded IPSWs: reuse a build already there, and download new ones into it. [env var: PYMOBILEDEVICE3_IPSW_DIR] |
--beta |
Choose among the newest beta builds (listed by AppleDB) instead of signed releases (ipsw.me). |
update¶
Update or restore the device's iOS from an IPSW (local path or URL).
Without --erase this updates in place and keeps user data; with --erase the device is wiped. Needs Internet for Apple's signing server. Keep the device connected until it finishes.
Options:
| Option | Description |
|---|---|
--ecid <str> |
Target device ECID; defaults to the first connected USB device or waits for Recovery/DFU. |
-i, --ipsw <str> |
Path or URL to an IPSW. If omitted, choose a signed build interactively. |
--ipsw-dir <path> |
Directory of downloaded IPSWs: reuse a build already there, and download new ones into it. [env var: PYMOBILEDEVICE3_IPSW_DIR] |
--beta |
Choose among the newest beta builds (listed by AppleDB) instead of signed releases (ipsw.me). |
--tss <path> |
Path to SHSH blob plist to use for signing requests. |
--erase / --no-erase |
Erase and restore (factory reset, DELETES ALL DATA) instead of updating in place. [default: no-erase] |
--ignore-fdr / --no-ignore-fdr |
Connect to the FDR service only (debug mode; no traffic proxying). [default: no-ignore-fdr] |
--tss-batch |
Opt-in: request the prefetchable peripheral tickets (SE/SE2, Rose, Savage, T200, Centauri, eUICC, Baseband) together with the AP ticket, in the same TSS request, and serve them during the restore whenever the device asks with the identical request (iOS 18+). Adds no request; chips whose nonce changed are signed live as usual. |
--exclusive-usb |
Experimental, macOS only: keep deviceinterfaced from claiming the USB device during the restore (it can win the race while the device re-enumerates). Boots the daemon out, or keeps killing it where that is refused, and restores it afterwards; the launchctl calls run through sudo, which may prompt for your password. |
--dfu |
Restore from DFU mode: first guide you, step by step, through the buttons that put the device into it. |
--manual |
Do the whole DFU button sequence yourself, instead of having a booted device restarted from here. |