Uploaded December 2013 | Updated September 2026, 2 hours ago
IMPORTANT!!! Please note that this video is for educational purpose only. By watching this video, you agree that I'm not responsible of what might happen with the use of informations provided. If you manage to find this software, I don't take responsibility of damages that could happen to your hardware. Use this software at your own risks. Also, please don't ask me or comment this video about download links or how to find this software.
PurpleRestore is a tool used by Apple to restore iOS devices, especially for engineering tests.
It is made to do almost everything related to iOS restoring, including restore to every hardware-compatible iOS version, make root filesystem writable, system partition size, adding/removing boot & restore args, activation bypass, break between restore stages and more. Instead of regular .IPSW files to restore iOS devices, PurpleRestore uses "restore bundles". They can be made by unzipping a regular .IPSW file.
Using this tool at home will do nothing more than iTunes already does. Release type firmwares will be restored without considering additional options (boot-args, activation bypass, etc.). It is also not possible to restore to a firmware unsigned by Apple (no downgrades). The only différences with iTunes' iOS restore process are the Apple's logo in purple background and the possibility to see restore steps, in PurpleRestore.
IMPORTANT!!! Please note that this video is for educational purpose only. By watching this video, you agree that I'm not responsible of what might happen with the use of informations provided. If you manage to find this software, I don't take responsibility of damages that could happen to your hardware. Use this software at your own risks. Also, please don't ask me or comment this video about download links or how to find this software.
PurpleRestore is a tool used by Apple to restore iOS devices, especially for engineering tests.
It is made to do almost everything related to iOS restoring, including restore to every hardware-compatible iOS version, make root filesystem writable, system partition size, adding/removing boot & restore args, activation bypass, break between restore stages and more. Instead of regular .IPSW files to restore iOS devices, PurpleRestore uses "restore bundles". They can be made by unzipping a regular .IPSW file.
Using this tool at home will do nothing more than iTunes already does. Release type firmwares will be restored without considering additional options (boot-args, activation bypass, etc.). It is also not possible to restore to a firmware unsigned by Apple (no downgrades). The only différences with iTunes' iOS restore process are the Apple's logo in purple background and the possibility to see restore steps, in PurpleRestore.
![De Rebus Antiquis - iPad 4 (P102AP) iOS 7.x iBoot Exploit [Demo]](https://i.ytimg.com/vi/d6b_G1gxu-Q/mqdefault.jpg "De Rebus Antiquis - iPad 4 (P102AP) iOS 7.x iBoot Exploit [Demo]
This is a demo of a complete De Rebus Antiquis iBoot exploit setup running on iPad 4 (P102AP). Once iBoot re-runs after the exploitation, it mounts a secondary HFS+ volume that contains a new bootloader image and executes it. In this demo, I simply used the same iBoot as the signed one, except running unsigned with custom patches and verbose boot enabled.
Im currently working on a complete write-up about De Rebus Antiquis iBoot exploit. Once it will be released, you should get most of the necessary knowledge to implement what you see in this video. See my personal blog here, https://www.pmbonneau.com/ for more details.
Many thanks to @dora2ios (Twitter) for help with some issues I had while debugging.")
![HFS+ Heap Buffer Overflow - iPad 2 (K94AP) iOS 5.x iBoot Exploit [Demo]](https://i.ytimg.com/vi/dJbakxWSy18/mqdefault.jpg "HFS+ Heap Buffer Overflow - iPad 2 (K94AP) iOS 5.x iBoot Exploit [Demo]
This is a post-exploitation demo of an HFS+ heap buffer overflow in iOS 5.x iBoot, running on iPad 2nd (K94AP). One particular use case of an iBoot exploit such as this one is the ability to downgrade or upgrade the device to any iOS version as long as it can run on it. This iPad 2nd is downgraded to iOS 5.x using previously saved SHSH blobs, so when powered-on, the signed iOS 5.x iBoot is executed. An HFS+ volume is specifically crafted to trigger an heap buffer overflow when iBoot attempts to mount it. Then, we get control over the PC register and eventually execute a custom payload which jumps to a completely new patched iBoot image. From there, additional unsigned bootchain images are executed and so, to fully boot iOS. In this video, iPad start up with the iOS 5.0.1 signed bootchain, exploit is triggered, then jumps to an iOS 7.1.2 bootchain.
See the complete write-up I did about this iBoot exploit on my personal blog here, https://www.pmbonneau.com/ios5-iboot-hfs-hbo/
This video was originally posted on X (Twitter) here, https://x.com/ShadowLee19/status/1074533504610918400?s=20")
