sshrd32.sh

#!/bin/bash
script_dir=".."
tmp="."
saved="../saved"
ssh_port=2222
isoscheck=1
jelbrek=../resources/Jailbreak
script_path=$(dirname "$0")/$(basename "$0")
enable_latest_enter=0
ship_build_check=0

if [[ "$debug" == "1" ]]; then
    menu_old=1
    set -x
fi

log() {
    GREEN='\033[32m'
    RESET='\033[0m'
    echo -e "${GREEN}[Log]${RESET} ${GREEN}$@${RESET}" > /dev/tty
    eval "$@" >/dev/null 2>&1
}

error() {
    RED='\033[31m'
    RESET='\033[0m'
    echo -e "${RED}[ERROR]${RESET} ${RED}$@${RESET}" > /dev/tty
    eval "$@" >/dev/null 2>&1
}

warning() {
    YELLOW='\033[33m'
    RESET='\033[0m'
    echo -e "${YELLOW}[WARNING]${RESET} ${YELLOW}$@${RESET}" > /dev/tty
    eval "$@" >/dev/null 2>&1
}

debug() {
    local BLUE='\033[38;5;45m'
    RESET='\033[0m'
    echo -e "${BLUE}[DEBUG]${RESET} ${BLUE}$@${RESET}" > /dev/tty
    eval "$@" >/dev/null 2>&1
}

tip() {
    local PURPLE='\033[0;35m'
    local NC='\033[0m'
    echo -e "${PURPLE}$1${NC}"
}

print() {
    local PURPLE='\033[0;35m'
    local NC='\033[0m'
    echo -e "${PURPLE}$1${NC}"
}

input() {
    YELLOW='\033[33m'
    RESET='\033[0m'
    echo -e "${YELLOW}[Input]${RESET} ${YELLOW}$@${RESET}" > /dev/tty
    eval "$@" >/dev/null 2>&1
}

pause() {
    local i
    local arg="(or press Ctrl+C to cancel)"
    local filtered_args=""
    for i in "$@"; do
        if [[ $i == noctrlc ]]; then
            local arg=""
        else
            filtered_args="$filtered_args $i"
        fi
    done
    filtered_args=$(echo "$filtered_args" | sed 's/^ //')
    if [ -z "$filtered_args" ]; then
        input "Press Enter/Return to continue $arg"
    else
        input "$filtered_args $arg"
    fi
    read -s
}

oscheck() {
    if [[ -f ../resources/current_platform ]]; then
        local local_platform_message=$(cat ../resources/current_platform 2>/dev/null)
    else
        local local_platform_message=""
    fi
    arch_path=
    if [[ "$isoscheck" == "1" ]]; then
        platform_check=$(uname)
        arch_check=$(uname -m)
        if [[ "$platform_check" == "Darwin" ]]; then
            platform=macos
            if [[ "$arch_check" == "x86_64" ]]; then
                platform_arch=x86_64
            elif [[ "$arch_check" == "arm64" ]]; then
                platform_arch=arm64
            else
                error Unsupport platform,please use support platform
                exit
            fi
        elif [[ "$platform_check" == "Linux" ]]; then
            platform=linux
            if [[ "$arch_check" == "x86_64" ]]; then
                platform_arch=x86_64
            elif [[ "$arch_check" == "arm64" ]]; then
                platform_arch=arm64
            else
                error Unsupport platform,please use support platform
                exit
            fi
        else
            error Unsupport platform,please use support platform
            exit
        fi
        if [[ "$platform" == "macos" ]]; then
            if [[ "$platform_arch" == "arm64" ]]; then
                if [[ "$ship_platform_check" != "1" ]]; then
                    warning "Using M-series chips may cause compatibility issues; please use with caution."
                    pause Press Enter to ignore this issue.  
                fi
                dir="../bin/macos/arm64"
            else
                dir="../bin/macos"
            fi
            macos_ver="${1:-$(sw_vers -productVersion)}"
            macos_major_ver="${macos_ver:0:2}"
            if [[ $macos_major_ver == 10 ]]; then
                macos_minor_ver=${macos_ver:3}
                macos_minor_ver=${macos_minor_ver%.*}
                if (( macos_minor_ver < 11 )); then
                    if [[ "$ship_platform_check" != "1" ]]; then
                        error "Your macOS version is too old. Please upgrade to macOS High Sierra or later."
                        exit
                    fi
                fi
                case $macos_minor_ver in
                    #11 ) macos_name="El Capitan";; too old
                    #12 ) macos_name="Sierra";; too old
                    13 ) macos_name="High Sierra";;
                    14 ) macos_name="Mojave";;
                    15 ) macos_name="Catalina";;
                esac
            fi
            case $macos_major_ver in
                11 ) macos_name="Big Sur";;
                12 ) macos_name="Monterey";;
                13 ) macos_name="Ventura";;
                14 ) macos_name="Sonoma";;
                15 ) macos_name="Sequoia";;
                26 ) macos_name="Tahoe";;
            esac
            if (( macos_major_ver > 12 )); then
                warning "There may be compatibility issues when using devices running macOS Monterey or later. Do you want to continue?"
                yesno continue?
                 if [[ $? == 1 ]]; then
                    :
                else
                    exit
                fi
            fi
            platform_message="macOS ${macos_name}($platform_arch)"
        elif [[ "$platform" == "linux" ]]; then
            warning The Linux version is still being adapted, and some features have not yet been fixed. Should we continue using it?
            pause Press Enter to continue.
            check_sudo
            linux_part
            arch_path="linux/"
            linux_name=$(grep '^NAME=' /etc/os-release | cut -d'"' -f2)
            platform_message="${linux_name} ($platform_arch)"
            dir="../bin/linux"
            if [[ $linux_name != Ubuntu ]]; then
                error Support ubuntu only,change your distro to ubuntu
                exit
            fi
        fi
    fi
    if [[ $platform_message != $local_platform_message ]]; then
        install_depends
    fi

}

linux_part() {
    if [[ -n $UBUNTU_CODENAME ]]; then
        case $UBUNTU_CODENAME in
            "jammy" | "kinetic"   ) ubuntu_ver=22;;
            "lunar" | "mantic"    ) ubuntu_ver=23;;
            "noble" | "oracular"  ) ubuntu_ver=24;;
            "plucky" | "questing" ) ubuntu_ver=25;;
        esac
        if [[ -z $ubuntu_ver ]]; then
            source /etc/upstream-release/lsb-release 2>/dev/null
            ubuntu_ver="$(echo "$DISTRIB_RELEASE" | cut -c -2)"
        fi
        if [[ -z $ubuntu_ver ]]; then
            ubuntu_ver="$(echo "$VERSION_ID" | cut -c -2)"
        fi
    elif [[ -e /etc/debian_version ]]; then
        debian_ver=$(cat /etc/debian_version)
        case $debian_ver in
            *"sid" | "kali"* ) debian_ver="sid";;
            * ) debian_ver="$(echo "$debian_ver" | cut -c -2)";;
        esac
    elif [[ $ID == "fedora" || $ID_LIKE == "fedora" || $ID == "nobara" ]]; then
        fedora_ver=$VERSION_ID
    fi
    if [[ $ID == "arch" || $ID_LIKE == "arch" || $ID == "artix" ]]; then
        distro="arch"
    elif (( ubuntu_ver >= 22 )) || (( debian_ver >= 12 )) || [[ $debian_ver == "sid" ]]; then
        distro="debian"
    elif (( fedora_ver >= 40 )); then
        distro="fedora"
        if [[ $(command -v rpm-ostree) ]]; then
            distro="fedora-atomic"
        fi
    elif [[ $ID == "opensuse-tumbleweed" ]]; then
        distro="opensuse"
    elif [[ $ID == "gentoo" || $ID_LIKE == "gentoo" || $ID == "pentoo" ]]; then
        distro="gentoo"
    elif [[ $ID == "void" ]]; then
        distro="void"
    elif [[ -n $ubuntu_ver || -n $debian_ver || -n $fedora_ver ]]; then
        error "Your distro version ($platform_ver - $platform_arch) is not supported. See the repo README for supported OS versions/distros"
    else
        warning "Your distro ($platform_ver - $platform_arch) is not detected/supported. See the repo README for supported OS versions/distros"
        print "* You may still continue, but you will need to install required packages and libraries manually as needed."
        sleep 5
        pause
    fi
}

check_sudo() {
    if [ -z "$SUDO_USER" ]; then
        log "Please enter your password."
        if sudo -v >/dev/null 2>&1; then
            clear
            return 0
        else
            error "Unable to obtain sudo privileges"
            exit 1
        fi
    else
        clear
        return 0
    fi
}

set_path() {
    if [[ "$script_dir/" =~ [[:space:]] ]]; then
        error "Directory path contains whitespace characters！" >&2
        error "Current directory: '$script_dir'" >&2
        pause Press enter to exit
        exit 1
    fi
    chmod +x $dir/*
    if [[ "$platform" == "macos" ]]; then
        sshpass=""
        irecovery=""
        iproxy=""
        ipwnder=""
        idevicerestore=""
        futurerestore=""
        futurerestore_old=""
        ideviceinfo=""
        dmg=""
        zenity="$dir/zenity"
        ideviceactivation=""
        ideviceinstaller=""
        primepwn=""
        gaster=""
        iBoot32Patcher=""
        xpwntool=""
        hfsplus=""
        pzb=""
        jq=""
        ticket=""
        validate=""
        img4tool=""
        irecovery2=""
        aria2c=""
        tsschecker=""
        z7z=""
        sha1sum="$(command -v shasum) -a 1"
        bspatch="$(command -v bspatch)"
    elif [[ "$platform" == "linux" ]]; then
        export LD_LIBRARY_PATH="$dir/lib"
        sshpass="sudo "
        irecovery="sudo "
        iproxy="sudo "
        ipwnder="sudo "
        idevicerestore="sudo LD_LIBRARY_PATH=$dir/lib "
        futurerestore="sudo "
        futurerestore_old="sudo "
        ideviceinfo="sudo LD_LIBRARY_PATH=$dir/lib "
        dmg="sudo "
        zenity="sudo GSETTINGS_BACKEND=memory $(command -v zenity)"
        ideviceactivation="sudo LD_LIBRARY_PATH=$dir/lib "
        ideviceinstaller="sudo LD_LIBRARY_PATH=$dir/lib "
        primepwn="sudo "
        gaster="sudo "
        iBoot32Patcher="sudo "
        xpwntool="sudo "
        hfsplus="sudo "
        pzb="sudo "
        jq="sudo "
        ticket="sudo "
        validate="sudo "
        img4tool="sudo "
        irecovery2="sudo "
        aria2c="sudo "
        z7z="sudo "
        tsschecker="sudo "
        afc=”sudo“
        bspatch=$dir/bspatch
    fi
    sshpass+=$dir/sshpass
    irecovery+="$dir/irecovery"
    iproxy+=$dir/iproxy
    ipwnder+=$dir/ipwnder
    idevicerestore+=$dir/idevicerestore
    futurerestore+=$dir/futurerestore
    futurerestore_old+=$dir/futurerestore_old
    ideviceinfo+=$dir/ideviceinfo
    dmg+=$dir/dmg
    ideviceactivation+=$dir/ideviceactivation
    ideviceinstaller+=$dir/ideviceinstaller
    primepwn+=$dir/primepwn
    iBoot32Patcher+=$dir/iBoot32Patcher
    xpwntool+=$dir/xpwntool
    hfsplus+=$dir/hfsplus
    pzb+=$dir/pzb
    jq+=$dir/jq
    ticket+=$dir/ticket
    validate+=$dir/validate
    img4tool+=$dir/img4tool
    irecovery2+=$dir/irecovery2
    aria2c+=$dir/aria2c
    tsschecker+=$dir/tsschecker
    z7z+=$dir/7zz
    afc+=$dir/afc_tool
    sha1sum="$(command -v shasum) -a 1"
}

prepare_udev_rules() {
    local owner="$1"
    local group="$2"
    echo "ACTION==\"add\", SUBSYSTEM==\"usb\", ATTR{idVendor}==\"05ac\", ATTR{idProduct}==\"122[27]|128[0-3]|1338\", OWNER=\"$owner\", GROUP=\"$group\", MODE=\"0660\" TAG+=\"uaccess\"" > 39-libirecovery.rules
}

install_depends() {
    rm -f "../resources/current_platform"
    touch "../resources/current_platform"
    if [[ $platform == "linux" ]]; then
        print "Install depends now"
        print "* Enter your user password when prompted"
        pause
        prepare_udev_rules usbmux plugdev
        if [[ -n $ubuntu_ver ]]; then
            sudo add-apt-repository -y universe
        fi
        sudo apt update
        sudo apt install -y \
            aria2 \
            ca-certificates \
            curl \
            git \
            libimobiledevice6 \
            libimobiledevice-utils \
            libssl3 \
            libzstd1 \
            openssh-client \
            patch \
            python3 \
            python3-pip \
            sshfs \
            unzip \
            usbmuxd \
            usbutils \
            vim-common \
            xxd \
            zenity \
            zip \
            zlib1g
        

        pip3 install pyimg4 pylibfdt-iOS

        if [[ $(command -v systemctl 2>/dev/null) ]]; then
            sudo systemctl enable --now udev systemd-udevd usbmuxd 2>/dev/null
        fi

        echo "$platform_message" > "../resources/current_platform"

        if [[ $platform == "linux" ]]; then
            if [[ $(command -v systemctl) ]]; then
                sudo systemctl enable --now systemd-udevd usbmuxd 2>/dev/null
            fi
            sudo cp 39-libirecovery.rules /etc/udev/rules.d/39-libirecovery.rules
            sudo chown root:root /etc/udev/rules.d/39-libirecovery.rules
            sudo chmod 0644 /etc/udev/rules.d/39-libirecovery.rules
            sudo udevadm control --reload-rules
            sudo udevadm trigger -s usb
        fi

        log "Install depends done! Please run the script again to proceed"

        exit
    else
        echo "$platform_message" > "../resources/current_platform"
    fi
}

set_ssh_config() {
    if [ -z "$1" ]; then
        cp ../resources/ssh_config .
        if [[ $(ssh -V 2>&1 | grep -c SSH_8.8) == 1 || $(ssh -V 2>&1 | grep -c SSH_8.9) == 1 ||
            $(ssh -V 2>&1 | grep -c SSH_9.) == 1 || $(ssh -V 2>&1 | grep -c SSH_1) == 1 ]]; then
            echo "    PubkeyAcceptedAlgorithms +ssh-rsa" >> ./ssh_config
        elif [[ $(ssh -V 2>&1 | grep -c SSH_6) == 1 ]]; then
            cat $script_dir/bin/Others/ssh_config | sed "s,Add,#Add,g" | sed "s,HostKeyA,#HostKeyA,g" > ssh_config
        fi
    fi
    
    if [ -z "$1" ]; then
        ssh="$dir/sshpass -p alpine ssh -F ./ssh_config"
        scp="$dir/sshpass -p alpine scp -F ./ssh_config"
    fi
    
    if [[ "$1" == "pass" ]]; then
        ssh="$dir/sshpass -p $2 ssh -F ./ssh_config"
        scp="$dir/sshpass -p $2 scp -F ./ssh_config"
    fi
}


checkmode() {
    if [[ $2 != irec ]]; then
        if [ "$1" = "DFU" ]; then
            if ! (system_profiler SPUSBDataType 2> /dev/null | grep ' Apple Mobile Device (DFU Mode)' >> /dev/null); then
                if [[ "$2" != "none" ]]; then
                    log "[*] Waiting for the device to enter DFU mode"
                fi
            fi
            while ! (system_profiler SPUSBDataType 2> /dev/null | grep ' Apple Mobile Device (DFU Mode)' >> /dev/null); do
                sleep 1
            done
        elif [ "$1" = "rec" ]; then
            if ! (system_profiler SPUSBDataType 2> /dev/null | grep ' Apple Mobile Device (Recovery Mode)' >> /dev/null); then
                if [[ "$2" != "none" ]]; then
                    log "[*] Waiting for the device to enter Recovery mode"
                fi
            fi
            while ! (system_profiler SPUSBDataType 2> /dev/null | grep ' Apple Mobile Device (Recovery Mode)' >> /dev/null); do
                sleep 1
            done
        elif [ "$1" = "nor" ]; then
            if ! (system_profiler SPUSBDataType 2> /dev/null | grep -E ' (iPod|iPhone|iPad)' >> /dev/null); then
                if [[ "$2" != "none" ]]; then
                    log "[*] Waiting for the device to enter Normal mode"
                fi
            fi
            while ! (system_profiler SPUSBDataType 2> /dev/null | grep -E ' (iPod|iPhone|iPad)' >> /dev/null); do
                sleep 1
            done
        elif [ "$1" = "DFUreal" ]; then
            if ! (system_profiler SPUSBDataType 2> /dev/null | grep ' USB DFU Device' >> /dev/null); then
                if [[ "$2" != "none" ]]; then
                    log "[*] Waiting for the device to enter DFU mode"
                fi
            fi
            while ! (system_profiler SPUSBDataType 2> /dev/null | grep ' USB DFU Device' >> /dev/null); do
                sleep 1
            done
        elif [ "$1" = "DFUall" ]; then
            log "[*] Waiting for the device to enter DFU mode"
            while true;do
                if (system_profiler SPUSBDataType 2> /dev/null | grep ' Apple Mobile Device (DFU Mode)' >> /dev/null); then
                    break
                fi
                sleep 1
                if (system_profiler SPUSBDataType 2> /dev/null | grep ' USB DFU Device' >> /dev/null); then
                    break
                fi
            done
        fi
    else
        local mode
        case $1 in
            nor )
            log "[*] Waiting for the device to enter Normal mode"
            while true; do
                device_ver=$($ideviceinfo -s 2>/dev/null | grep "ProductVersion:" | cut -d' ' -f2)
                if [[ $device_ver =~ ^[0-9]+\.[0-9]+(\.[0-9]+)*$ ]]; then
                    break
                fi
                sleep 1
            done
            ;;
            rec | DFU | DFUall )
            if [[ $1 == rec ]]; then
                local mode="Recovery"
            elif [[ $1 == DFU ]]; then
                local mode="DFU"
            elif [[ $1 == DFUall ]]; then
                local mode="DFU"
            fi
            log "[*] Waiting for the device to enter $mode mode"
            while true; do
                device_mode="$($irecovery -q 2>/dev/null | grep -w "MODE" | cut -c 7-)"
                if [[ $device_mode == "$mode" ]]; then
                    break
                elif [[ $device_mode == "WTF" ]]; then
                    break
                fi
                sleep 1
            done
            ;;
        esac
    fi
}

device_info() {
    if [[ -z $device_type ]]; then
        device_type=$($irecovery -q | grep -i "product" | awk -F': ' '{print $2}')
    else
        if [[ $device_type =~ ^(iPhone|iPad|iPod)[1-9][0-9]*,[0-9]+$ ]]; then
            :
        else
            while true; do
                error Device type entered incorrectly,please please re-enter.
                read $device_type
                if [[ $device_type =~ ^(iPhone|iPad|iPod)[1-9][0-9]*,[0-9]+$ ]]; then
                    break
                fi
            done
        fi
    fi
    if [ ! -d "$saved/$device_type" ]; then
        mkdir $saved/$device_type
    fi
    case $device_type in
        iPhone1,* | iPod1,1 )
            device_proc=1;; # S5L8900
        iPad1,1 | iPhone[23],* | iPod[234],1 )
            device_proc=4;; # A4/S5L8720/8920/8922
        iPad2,* | iPad3,[123] | iPhone4,1 | iPod5,1 )
            device_proc=5;; # A5
        iPad3,* | iPhone5,* )
            device_proc=6;; # A6            
    esac
    case $device_type in
        iPad1,1  ) device_model="k48";;
        iPad2,1  ) device_model="k93";;
        iPad2,2  ) device_model="k94";;
        iPad2,3  ) device_model="k95";;
        iPad2,4  ) device_model="k93a";;
        iPad2,5  ) device_model="p105";;
        iPad2,6  ) device_model="p106";;
        iPad2,7  ) device_model="p107";;
        iPad3,1  ) device_model="j1";;
        iPad3,2  ) device_model="j2";;
        iPad3,3  ) device_model="j2a";;
        iPad3,4  ) device_model="p101";;
        iPad3,5  ) device_model="p102";;
        iPad3,6  ) device_model="p103";;
        iPhone1,1) device_model="m68";;
        iPhone1,2) device_model="n82";;
        iPhone2,1) device_model="n88";;
        iPhone3,1) device_model="n90";;
        iPhone3,2) device_model="n90b";;
        iPhone3,3) device_model="n92";;
        iPhone4,1) device_model="n94";;
        iPhone5,1) device_model="n41";;
        iPhone5,2) device_model="n42";;
        iPhone5,3) device_model="n48";;
        iPhone5,4) device_model="n49";;
        iPod1,1 ) device_model="n45";;
        iPod2,1 ) device_model="n72";;
        iPod3,1 ) device_model="n18";;
        iPod4,1 ) device_model="n81";;
        iPod5,1 ) device_model="n78";;
        * ) error "Unsupport for 64Bit device,try to use(https://github.com/verygenericname/SSHRD_Script)"; exit;;
    esac
    device_ecid=$($idevicerestore -l 2>/dev/null | grep -i "ECID" | awk '{print $3}')
    
}

update() {
    log Checking update
    local local_ver=$(git rev-parse --short HEAD)
    local commit_info=$(curl -s "https://api.github.com/repos/appleiPodTouch4/SSHRD_Script_32Bit/commits?per_page=1" | $jq -r '.[0]')
    local sha=$(echo "$commit_info" | $jq -r '.sha')
    local latest=${sha:0:7}
    if [[ -z $local_ver || -z $latest ]]; then
        error Unable get version message,please check internet connection
        return
    fi
    if [[ $local_ver == $latest ]]; then
        log It is already the latest commit,no upgrade required
    else
        yesno "Newest commit is $latest. Do you want to update?" 1
        if [[ $? == 1 ]]; then
            cd ../
            if [[ -z $(command -v git) ]]; then
                error Please install git first
                return
            fi
            git fetch origin
            git reset --hard origin/main
            if [[ $(git rev-parse --short HEAD) == $latest ]]; then
                log Update successfully,run ./sshrd.sh again
            else
                error Update failed,please check internet connection
                return
            fi
        else
            return
        fi
    fi
}

######pwn######
device_pwn() {
    local a5
    log Getting device info and pwning... this may take a second
    local device_pwnd="$($irecovery -q | grep "PWND" | cut -c 7-)"
    if [[ -z $device_pwnd ]]; then
        case $device_proc in
            1 ) device_s5l8900xall ;;
            4 ) 
            case $device_type in
                iPad1,1 | iPhone3,* | iPod[24],1 )
                if [[ $platform == linux ]]; then
                    $ipwnder -p
                else
                    $primepwn
                fi
                ;;
                * )
                log Pwn:ipwnder
                if [[ $platform == macos ]]; then
                    $ipwnder
                else
                    $ipwnder -p
                fi
                ;;
            esac
             ;;
            5 ) a5=1 ;;
            6 )
            log Pwn:ipwnder
            if [[ $platform == macos ]]; then
                $ipwnder
            else
                $ipwnder -p
            fi
            ;;
        esac
    fi
    if [[ $device_proc == 5 ]]; then
        if [[ $ship_send_pwnibss != 1 ]]; then 
            while true; do
                local device_pwnd2="$($irecovery -q | grep "PWND" | cut -c 7-)"
                if [ "$device_pwnd2" != "checkm8" ]; then
                    print "pwn a5 device needs Arduino+USB Host Shield or Pi Pico"
                    pause when you have been pwned,press enter to continue
                else
                    break
                fi
            done
            device_send_unpacked_ibss
        else
            warning make sure you have been sent pwnibss
            pause press enter to continue
        fi
    fi
    device_pwnd1="$($irecovery -q | grep "PWND" | cut -c 7-)"
    if [[ $device_proc != 1 ]]; then
        if [[ $device_proc != 5 && $device_proc != 6 ]]; then
            if [[ -n $device_pwnd1 ]]; then
                log Device has been pwned✅
            else
                error "Unable to pwn device❎(close i4/3u tools and try again)"
                exit 1
            fi
        else
            log "Device has been pwned✅(may be)"
            log "If the dumping gets stuck, you can press Ctrl+C to cancel, then retry."
        fi
    fi
}

device_send_unpacked_ibss() {
    local pwnrec="pwned iBSS"
    device_rd_build=
    patch_ibss
    log "Sending unpacked iBSS..."
    $primepwn pwnediBSS
    local tool_pwned=$?
    if [[ $tool_pwned != 0 ]]; then
        error "Failed to send iBSS. Your device has likely failed to enter PWNED DFU mode." \
        "* You might need to exit DFU and (re-)enter PWNED DFU mode before retrying."
    fi
    sleep 1
    log "Checking for device"
    local irec="$($irecovery -q 2>&1)"
    device_pwnd="$(echo "$irec" | grep "PWND" | cut -c 7-)"
    if [[ -z $device_pwnd && $irec != "ERROR"* ]]; then
        log "Device should now be in $pwnrec mode."
        log Device has been pwned✅
    else
        error "Device failed to enter $pwnrec mode."
        error "Unable to pwn device❎(close i4/3u tools and try again)"
        exit 1
    fi
}



#####main######
ramdisk() {
    local comps=("iBSS" "iBEC" "DeviceTree" "Kernelcache")
    local name
    local iv
    local key
    local path
    local url
    local decrypt
    local ramdisk_path
    local version
    local build_id
    local local_build_id
    local files
    local mode="$1"
    local rec=2
    all_flash="Firmware/all_flash/all_flash.${device_model}ap.production"
    if [[ no_ramdisk == 1 ]]; then
        return
    fi
    if [[ $1 == "setnvram" ]]; then
        rec=$2
    fi
    if [[ $1 != "justboot" ]]; then
        comps+=("RestoreRamdisk")
    fi
    case $device_type in
        iPhone1,[12] | iPod1,1 ) device_target_build="7E18"; device_target_vers="3.1.3";;
        iPod2,1 ) device_target_build="8C148";;
        iPod3,1 | iPad1,1 ) device_target_build="9B206";;
        iPhone2,1 | iPod4,1 ) device_target_build="10B500";;
        iPhone5,[34] ) device_target_build="11D257";;
        * ) device_target_build="10B329";;
    esac
    if [[ -n $device_rd_build_custom ]]; then
        if [[ $ship_build_check != 1 ]]; then
            if [[ "$device_rd_build_custom" =~ ^[0-9]+[A-Za-z][0-9]+[a-z]?$ ]]; then
                log Get version info
                get_firmware_info build $device_rd_build_custom
                if [ -z "$url" ]; then
                    error Unable get url of this version
                    exit 1
                fi
                device_rd_build=$device_rd_build_custom
            else
                log Get version info
                get_firmware_info ver $device_rd_build_custom
                if [ -z "$url" ]; then
                    error Unable get url of this version
                    pause
                    exit 1
                fi
                device_rd_build=$buildid
            fi
        else
            device_rd_build=$device_rd_build_custom
        fi
        tip "Use custom version:$device_rd_build"
    elif [[ -n $device_rd_build_custom ]]; then
        if [[ $ship_build_check != 1 ]]; then
            log Get version info
            get_firmware_info build $device_target_build
            if [ -z "$url" ]; then
                error Unable get url of this version
                pause
                exit 1
            fi
        fi
    fi
    if [[ -n $device_rd_build ]]; then
        device_target_build=$device_rd_build
        device_rd_build=
    fi
    version=$device_target_vers
    build_id=$device_target_build
    device_fw_key_check
    ipsw_get_url $build_id $version
    if [[ $arg_l != 1 ]]; then
        ramdisk_path="../saved/$device_type/ramdisk_$build_id"
    else
        ramdisk_path="../current_ramdisk"
        if [[ -f ../current_ramdisk/build_id ]]; then
            local_build_id=$(cat ../current_ramdisk/build_id)
            if [[ $local_build_id != $build_id ]]; then
                log Clean old ramdsk
                rm -f ../current_ramdisk
            fi
        fi
    fi
    if [[ -d $ramdisk_path ]]; then
        local ramdisk_files=("Ramdisk.dmg" "DeviceTree.dec" "Kernelcache.dec")
        for files in $ramdisk_files; do
            if [[ ! -f $ramdisk_path/$files ]]; then
                warning "$files missed,redownload"
                pause
                rm -rf $ramdisk_path
                break
            fi
        done
    fi
    mkdir $ramdisk_path 2>/dev/null
    if [[ $arg_l == 1 ]]; then
        touch ../current_ramdisk/build_id
        echo "$build_id" > "../current_ramdisk/build_id"
    fi
    for getcomp in "${comps[@]}"; do
        name=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .filename')
        iv=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .iv')
        key=$(echo $device_fw_key | $jq -j '.keys[] | select(.image == "'$getcomp'") | .key')
        case $getcomp in
            "iBSS" | "iBEC" ) path="Firmware/dfu/";;
            "DeviceTree" )
                path="Firmware/all_flash/"
                case $build_id in
                    14[EFG]* ) :;;
                    * ) path="$all_flash/";;
                esac
            ;;
            * ) path="";;
        esac
        if [[ -z $name ]]; then
            local hwmodel="$device_model"
            case $build_id in
                14[EFG]* )
                    case $device_type in
                        iPhone5,[12] ) hwmodel="iphone5";;
                        iPhone5,[34] ) hwmodel="iphone5b";;
                        iPad3,[456] )  hwmodel="ipad3b";;
                    esac
                ;;
                [789]* | 10* | 11* ) hwmodel+="ap";;
            esac
            case $getcomp in
                "iBSS" | "iBEC" ) name="$getcomp.$hwmodel.RELEASE.dfu";;
                "DeviceTree" )    name="$getcomp.${device_model}ap.img3";;
                "Kernelcache" )   name="kernelcache.release.$hwmodel";;
            esac
        fi

        log "$getcomp"
        if [[ -n $ipsw_justboot_path ]]; then
            file_extract_from_archive "$ipsw_justboot_path.ipsw" "${path}$name"
        elif [[ -s $ramdisk_path/$name ]]; then
            cp $ramdisk_path/$name .
        else
            "$dir/pzb" -g "${path}$name" -o "$name" "$ipsw_url"
        fi
        if [[ ! -s $name ]]; then
            error "Failed to get $name. Please run the script again."
        fi
        if [[ ! -s $ramdisk_path/$name ]]; then
            cp $name $ramdisk_path/
        fi
        mv $name $getcomp.orig
        if [[ $getcomp == "Kernelcache" || $getcomp == "iBSS" ]] && [[ $device_proc == 1 || $device_type == "iPod2,1" ]]; then
            decrypt="-iv $iv -k $key"
            "$dir/xpwntool" $getcomp.orig $getcomp.dec $decrypt
        elif [[ $build_id == "14"* ]]; then
            cp $getcomp.orig $getcomp.dec
        else
            "$dir/xpwntool" $getcomp.orig $getcomp.dec -iv $iv -k $key -decrypt
        fi
    done

    if [[ $1 != "justboot" ]]; then
        log "Make RestoreRamdisk"
        "$dir/xpwntool" RestoreRamdisk.dec Ramdisk.raw
        if [[ $device_proc != 1 ]]; then
            "$dir/hfsplus" Ramdisk.raw grow 30000000
            "$dir/hfsplus" Ramdisk.raw untar ../resources/sbplist.tar
        fi
    fi

    if [[ $device_proc == 1 ]]; then
        $bspatch Ramdisk.raw Ramdisk.patched ../resources/patch/018-6494-014.patch
        "$dir/xpwntool" Ramdisk.patched Ramdisk.dmg -t RestoreRamdisk.dec
        log "Make iBSS"
        $bspatch iBSS.orig iBSS ../resources/patch/iBSS.${device_model}ap.RELEASE.patch
        log "Make Kernelcache"
        mv Kernelcache.dec Kernelcache0.dec
        $bspatch Kernelcache0.dec Kernelcache.patched ../resources/patch/kernelcache.release.s5l8900x.patch
        "$dir/xpwntool" Kernelcache.patched Kernelcache.dec -t Kernelcache.orig $decrypt
        rm DeviceTree.dec
        mv DeviceTree.orig DeviceTree.dec
    elif [[ $device_type == "iPod2,1" ]]; then
        "$dir/hfsplus" Ramdisk.raw untar ../resources/ssh_old.tar
        "$dir/xpwntool" Ramdisk.raw Ramdisk.dmg -t RestoreRamdisk.dec
        log "Make iBSS"
        $bspatch iBSS.dec iBSS.patched ../resources/patch/iBSS.${device_model}ap.RELEASE.patch
        "$dir/xpwntool" iBSS.patched iBSS -t iBSS.orig
        log "Make Kernelcache"
        mv Kernelcache.dec Kernelcache0.dec
        $bspatch Kernelcache0.dec Kernelcache.patched ../resources/patch/kernelcache.release.${device_model}.patch
        "$dir/xpwntool" Kernelcache.patched Kernelcache.dec -t Kernelcache.orig $decrypt
        rm DeviceTree.dec
        mv DeviceTree.orig DeviceTree.dec
    else
        if [[ $1 != "justboot" ]]; then
            "$dir/hfsplus" Ramdisk.raw untar ../resources/ssh.tar
            if [[ $1 == "jailbreak" && $device_vers == "8"* ]]; then
                "$dir/hfsplus" Ramdisk.raw untar ../resources/jailbreak/daibutsu/bin.tar
            fi
            "$dir/hfsplus" Ramdisk.raw mv sbin/reboot sbin/reboot_bak
            "$dir/hfsplus" Ramdisk.raw mv sbin/halt sbin/halt_bak
            case $build_id in
                    "12"* | "13"* | "14"* )
                    echo '#!/bin/bash' > restored_external
                    echo "/sbin/sshd; exec /usr/local/bin/restored_external_o" >> restored_external
                    "$dir/hfsplus" Ramdisk.raw mv usr/local/bin/restored_external usr/local/bin/restored_external_o
                    "$dir/hfsplus" Ramdisk.raw add restored_external usr/local/bin/restored_external
                    "$dir/hfsplus" Ramdisk.raw chmod 755 usr/local/bin/restored_external
                    "$dir/hfsplus" Ramdisk.raw chown 0:0 usr/local/bin/restored_external
                ;;
            esac
            if [[ $just_password == 1 ]]; then
                if [[ $just_password_legacy != 1 ]]; then
                    case $build_id in
                            "12"* | "13"* | "14"* )
                            "$dir/hfsplus" Ramdisk.raw mv usr/local/bin/restored_external usr/local/bin/restored_external.real
                            cp ../resources/bruteforce/setup.sh ./restored_external
                            "$dir/hfsplus" Ramdisk.raw add restored_external usr/local/bin/restored_external
                            "$dir/hfsplus" Ramdisk.raw chmod 755 usr/local/bin/restored_external
                            "$dir/hfsplus" Ramdisk.raw chown 0:0 usr/local/bin/restored_external
                        ;;
                    esac
                    "$dir/hfsplus" Ramdisk.raw rm usr/local/bin/restored_external.real
                    cp ../resources/bruteforce/restored_external ./restored_external.sshrd
                    "$dir/hfsplus" Ramdisk.raw add restored_external.sshrd usr/local/bin/restored_external.sshrd
                    "$dir/hfsplus" Ramdisk.raw chmod 755 usr/local/bin/restored_external.sshrd
                    cp ../resources/bruteforce/bruteforce .
                    "$dir/hfsplus" Ramdisk.raw add bruteforce usr/bin/bruteforce
                    "$dir/hfsplus" Ramdisk.raw chmod 755 usr/bin/bruteforce
                    cp ../resources/bruteforce/setup.sh ./restored_external
                    "$dir/hfsplus" Ramdisk.raw add restored_external usr/local/bin/restored_external
                    "$dir/hfsplus" Ramdisk.raw chmod 755 usr/local/bin/restored_external
                    "$dir/hfsplus" Ramdisk.raw chown 0:0 usr/local/bin/restored_external
                fi
            fi
            "$dir/xpwntool" Ramdisk.raw Ramdisk.dmg -t RestoreRamdisk.dec
        fi
        log "Make iBSS"
        "$dir/xpwntool" iBSS.dec iBSS.raw
        if [[ $device_type == "iPad2,"* || $device_type == "iPhone3,3" ]]; then
            case $build_id in
                8[FGHJKL]* | 8E600 | 8E501 ) device_boot4=1;;
            esac
        fi
        if [[ $device_boot4 == 1 ]]; then
            "$dir/iBoot32Patcher" iBSS.raw iBSS.patched --rsa --debug -b "-v amfi=0xff cs_enforcement_disable=1"
        else
            "$dir/iBoot32Patcher" iBSS.raw iBSS.patched --rsa --debug -b "$device_bootargs"
        fi
        "$dir/xpwntool" iBSS.patched iBSS -t iBSS.dec
        if [[ $build_id == "7"* || $build_id == "8"* ]] && [[ $device_type != "iPad"* ]]; then
            :
        else
            log "Make iBEC"
            "$dir/xpwntool" iBEC.dec iBEC.raw
            if [[ $1 == "justboot" ]]; then
                "$dir/iBoot32Patcher" iBEC.raw iBEC.patched --rsa --debug -b "$device_bootargs"
            else
                local bootarg="rd=md0 -v amfi=0xff amfi_get_out_of_my_way=1 cs_enforcement_disable=1 pio-error=0"
                "$dir/iBoot32Patcher" iBEC.raw iBEC.patched --rsa --debug -b "$bootarg"
            fi
            "$dir/xpwntool" iBEC.patched iBEC -t iBEC.dec
        fi
    fi

    if [[ $device_boot4 == 1 ]]; then
        log "Make Kernelcache"
        mv Kernelcache.dec Kernelcache0.dec
        "$dir/xpwntool" Kernelcache0.dec Kernelcache.raw
        $bspatch Kernelcache.raw Kernelcache.patched ../resources/patch/kernelcache.release.${device_model}.${build_id}.patch
        "$dir/xpwntool" Kernelcache.patched Kernelcache.dec -t Kernelcache0.dec
    fi

    mv iBSS iBEC DeviceTree.dec Kernelcache.dec Ramdisk.dmg $ramdisk_path 2>/dev/null

    if [[ $device_argmode == "none" ]]; then
        log "Done creating SSH ramdisk files: saved/$device_type/ramdisk_$build_id"
            if [[ $arg_l == 1 ]]; then
                log "Use ./sshrd32 boot to boot device"
            fi
        return
    fi
    if [[ $ship_boot != 1 ]]; then
        device_pwn
        if [[ $device_type == "iPad1,1" && $build_id != "9"* ]]; then
            patch_ibss
            log "Sending iBSS..."
            $irecovery -f pwnediBSS.dfu
            sleep 2
            log "Sending iBEC..."
            $irecovery -f $ramdisk_path/iBEC
        elif (( device_proc < 5 )) && [[ $device_pwnrec != 1 ]]; then
            log "Sending iBSS..."
            $irecovery -f $ramdisk_path/iBSS
        fi
        sleep 2
        #if [[ $build_id != "7"* && $build_id != "8"* ]]; then #someting wrong here
        if [[ $device_proc != 1 ]]; then
            log "Sending iBEC..."
            $irecovery -f $ramdisk_path/iBEC
            if [[ $device_pwnrec == 1 ]]; then
                $irecovery -c "go"
            fi
        fi
        sleep 3
        checkmode rec
        if [[ $1 != "justboot" ]]; then
            log "Sending ramdisk..."
            $irecovery -f $ramdisk_path/Ramdisk.dmg
            log "Running ramdisk"
            $irecovery -c "getenv ramdisk-delay"
            $irecovery -c ramdisk
            sleep 2
        fi
        log "Sending DeviceTree..."
        $irecovery -f $ramdisk_path/DeviceTree.dec
        log "Running devicetree"
        $irecovery -c devicetree
        log "Sending KernelCache..."
        $irecovery -f $ramdisk_path/Kernelcache.dec
        $irecovery -c bootx

        if [[ $1 == "justboot" ]]; then
            log "Device should now boot."
            return
        fi
        log "Booting, please wait..."
        sleep 6
    fi
    if [[ $just_boot == 1 ]]; then
        log "Done,use ./sshrd32.sh ssh or ./sshrd32.sh --menu to connect device"
        return
    else
        if [[ -n $1 ]]; then
            device_iproxy
        else
            device_iproxy no-logging
        fi
        local found
        log "Waiting for device..."
        tip "* You may need to unplug and replug your device."
        local try=0
        while [[ $found != 1 ]]; do
            found=$($ssh -p $ssh_port root@127.0.0.1 "echo 1" 2>/dev/null)
            try=$((try + 1))
            if [[ $try == 10 ]]; then
                error "Unable to connect SSH, please try boot again"
                return 1
            fi
            sleep 2
        done
        if [[ $device_proc == 1 || $device_type == "iPod2,1" ]]; then
            log "Transferring some files"
            tar -xvf ../resources/ssh.tar ./bin/chmod ./bin/chown ./bin/cp ./bin/dd ./bin/mount.sh ./bin/tar ./usr/bin/date ./usr/bin/df ./usr/bin/du
            $ssh -p $ssh_port root@127.0.0.1 "rm -f /bin/mount.sh /usr/bin/date"
            $scp -P $ssh_port bin/* root@127.0.0.1:/bin
            $scp -P $ssh_port usr/bin/* root@127.0.0.1:/usr/bin
        fi
        
        if [[ $no_menu != "1" ]]; then
            ssh_menu
        fi
        if [[ $just_jailbreak == 1 ]]; then
            jailbreak_sshrd
        elif [[ $just_get_ios_ver == 1 ]]; then
            check_iosvers
        elif [[ $just_hacktivate == 1 ]]; then
            device_hacktivate
        elif [[ $just_part2 == 1 ]]; then
            device_hacktivate_part2
        elif [[ $just_password == 1 ]]; then
            if [[ $just_password_legacy != 1 ]]; then
                log "Device should show text on screen now."
                log "After passcode is found please use ./sshrd32.sh --reboot to reboot device"
            else
                device_bruteforce
            fi
        elif [[ $just_unblock_lock == 1 ]]; then
            device_unblock_lock
        fi
    fi
}



lastest_enter() {
    local options=()
    local selected
    if [[ $enable_latest_enter == 1 ]]; then
        options+=("Go to Menu")
        options+=("Reboot")
        log What do you want to do at latest?
        select_option "${options[@]}"
        selected="${options[$?]}"
        if [[ $selected == "Go to Menu" ]]; then
            ssh_menu
        else
            $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"; exit=1
        fi
    fi
}


main() {
    if [[ $debug_mode == 1 ]]; then
        debug_func
    fi
    if [[ "$just_make" != "1" ]] && [[ -z "$device_type" ]]; then
        if [[ "$ship_boot" != "1" ]]; then
            if [[ $just_irec == 1 ]]; then
                checkmode DFUall irec
            elif [[ $platform == linux ]]; then
                checkmode DFUall irec
            else
                checkmode DFUall
            fi
        fi
    fi
    device_info
    ramdisk
    if [[ $no_menu == 1 ]]; then
        lastest_enter
    fi
}

ssh_menu() {
    local options=()
    local selected
    if [[ "$ship_boot" == "1" ]]; then
        device_iproxy
        ship_boot=
    fi
    if [[ $debug_mode == 1 ]]; then
        pause
    fi
    clear
    tip  "*** SSHRD_Script_32Bit ***"
    tip  "- $platform_message -"
    tip  "- Script by MrY0000 -"
    tip  "- Thanks LuckZGD Setup.app -"
    tip  "- Forked from Legacy-iOS-Kit(https://github.com/LukeZGD/Legacy-iOS-Kit) -"
    input "Select option:"
    options+=("SSH Connection")
    options+=("Jailbreak")
    options+=("Check iOS Version")
    options+=("Bypass(iOS5-iOS10)")
    options+=("Brute-force password cracking")
    options+=("Fix Disable")
    options+=("Clear NVRAM")
    options+=("Reboot")
    options+=("Exit")
    select_option "${options[@]}"
    selected="${options[$?]}"
        case $selected in
            "SSH Connection")
                ssh_message ; $ssh -p $ssh_port root@127.0.0.1;;
            "Activate Device")
                activition; pause;;
            "Jailbreak")
                jailbreak_sshrd;;
            "Backup Activation Files")
                activition_backup; pause;;
            "Check iOS Version")
                check_iosvers ;;
            "Brute-force password cracking(iOS7 below)")
                device_bruteforce; pause;;
            "Fix Disable")
                device_unblock_lock
                ;;
            "Bypass(iOS5-iOS10)")
                device_hacktivate;;
            "Clear NVRAM")
                log Clear NVRAM
                $ssh -p $ssh_port root@127.0.0.1 "nvram -c" ; pause;;
            "Reboot")
                log Rebooting
                $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"; exit=1;;
            "Exit" )
                exit=1
                ;;
        esac
    if [[ "$exit" != "1" ]]; then
        ssh_menu
    fi
}

ssh_message() {
    print "* For accessing data, note the following:"
    print "* Host: sftp://127.0.0.1 | User: root | Password: alpine | Port: $ssh_port"
    echo
    print "* Other Useful SSH Ramdisk commands:"
    print "* Clear NVRAM with this command:"
    print "    nvram -c"
    print "* Erase All Content and Settings with this command (iOS 9+ only):"
    print "    nvram oblit-inprogress=5"
    print "* To reboot, use this command:"
    print "    reboot_bak"
    print "* Remove Setup.app:"
    print "    rm -rf /mnt1/Applications/Setup.app"
    echo

}

###functions###

check_iosvers() {
    local options
    local selected
    device_datetime_cmd nopause
    local mount_command="mount.sh root"
    device_vers=
    device_build=
    log "Mounting root filesystem"
    $ssh -p $ssh_port root@127.0.0.1 "$mount_command"
    sleep 1
    log "Getting iOS version"
    $scp -P $ssh_port root@127.0.0.1:/mnt1/System/Library/CoreServices/SystemVersion.plist .
    rm -f BuildVer Version
    if [[ $platform == "macos" ]]; then
        plutil -extract 'ProductVersion' xml1 SystemVersion.plist -o Version
        device_vers=$(cat Version | sed -ne '/<string>/,/<\/string>/p' | sed -e "s/<string>//" | sed "s/<\/string>//" | sed '2d')
        plutil -extract 'ProductBuildVersion' xml1 SystemVersion.plist -o BuildVer
        device_build=$(cat BuildVer | sed -ne '/<string>/,/<\/string>/p' | sed -e "s/<string>//" | sed "s/<\/string>//" | sed '2d')
    else
        device_vers=$(cat SystemVersion.plist | grep -i ProductVersion -A 1 | grep -oPm1 "(?<=<string>)[^<]+")
        device_build=$(cat SystemVersion.plist | grep -i ProductBuildVersion -A 1 | grep -oPm1 "(?<=<string>)[^<]+")
    fi
    if [[ -n $device_vers ]]; then
        log "Get iOS Version successfully"
        tip "* iOS Version: $device_vers ($device_build)"
        if [[ $1 != nopause ]]; then
            pause
            return
        fi
    else
        error "Unable get iOS Version"
        if [[ $1 != nopause ]]; then
            pause
            return
        fi
    fi
}

device_datetime_cmd() {
    log "Running command to Update DateTime"
    $ssh -p $ssh_port root@127.0.0.1 "date -s @$(date +%s)"
    if [[ $1 != "nopause" ]]; then
        log "Done"
        pause
    fi
}

jailbreak_sshrd() {
    local vers
    local build
    local untether
    jelbrek=../resources/Jailbreak
    device_jailbreak=1
    check_iosvers nopause
    vers=$device_vers
    build=$device_build

    if [[ -z $device_vers ]]; then
        error Unable get iOS version,please try again
        pause
        return
    fi

    if [[ -n $($ssh -p $ssh_port root@127.0.0.1 "ls /mnt1/bin/bash 2>/dev/null") ]]; then
        warning "Your device seems to be already jailbroken. Cannot continue."
        if [[ $just_jailbreak == 1 ]]; then
            $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
        else
            pause
            return
        fi
    fi

    case $vers in
        9.3.[4231] | 9.3 ) untether="untetherhomedepot.tar";;
        9.2* | 9.1 )       untether="untetherhomedepot921.tar";;
        9.0* )             untether="everuntether.tar";;
        8* )               untether="daibutsu/untether.tar";;
        7.1* )
            case $device_type in
                iPod* ) untether="panguaxe-ipod.tar";;
                * ) untether="panguaxe.tar";;
            esac
        ;;
        7.0* ) # remove for lyncis 7.0.x
            untether="evasi0n7-untether.tar"
            if [[ $device_type == "iPhone5,3" || $device_type == "iPhone5,4" ]] && [[ $vers == "7.0" ]]; then
                untether="evasi0n7-untether-70.tar"
            fi
            ;;
        6.1.[6543] )       untether="p0sixspwn.tar";;
        6* )               untether="evasi0n6-untether.tar";;
        5* )               untether="g1lbertJB/${device_type}_${build}.tar";;
        4.2.[8761] | 4.[10]* | 3.2* | 3.1.3 )
            untether="greenpois0n/${device_type}_${build}.tar"
        ;;
        4.[32]* )
            case $device_type in
                # untether=1 means no untether package, but the var still needs to be set
                iPad2,* | iPhone3,3 ) untether=1;;
                * ) untether="g1lbertJB/${device_type}_${build}.tar";;
            esac
        ;;
        3* ) [[ $device_type == "iPhone2,1" ]] && untether=1;;
        '' )
            warning "Something wrong happened. Failed to get iOS version."
            if [[ $just_jailbreak == 1 ]]; then
                $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
            else
                pause
                return
            fi
        ;;
    esac

    if [[ -z $untether ]]; then
        warning "iOS $vers is not supported for jailbreaking with SSHRD."
        if [[ $just_jailbreak == 1 ]]; then
            $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
        else
            pause
            return
        fi
    fi
    log "Nice, iOS $vers is compatible."
    log "Mounting data partition"
    $ssh -p $ssh_port root@127.0.0.1 "mount.sh pv"

    # do stuff
    case $vers in
        6* )    device_send_rdtar fstab_rw.tar;;
        4.2.[8761] )
            log "launchd to punchd"
            $ssh -p $ssh_port root@127.0.0.1 "[[ ! -e /mnt1/sbin/punchd ]] && mv /mnt1/sbin/launchd /mnt1/sbin/punchd"
        ;;
    esac
    case $vers in
        5* ) device_send_rdtar g1lbertJB.tar;;
        [43]* )
            log "fstab"
            local fstab="fstab_new" # disk0s2s1 data
            if [[ $device_proc == 1 || $device_type == "iPod2,1" ]]; then
                fstab="fstab_old" # disk0s2 data
            fi
            $scp -P $ssh_port $jelbrek/$fstab root@127.0.0.1:/mnt1/private/etc/fstab
            $ssh -p $ssh_port root@127.0.0.1 "rm /mnt1/private/var/mobile/Library/Caches/com.apple.mobile.installation.plist" # idk if this is really needed but ill keep it
        ;;
    esac

    log "Sending $untether"
    $scp -P $ssh_port $jelbrek/$untether root@127.0.0.1:/mnt1
    case $vers in
        [543]* ) untether="${device_type}_${build}.tar";; # remove folder name after sending tar
    esac
    # 3.1.3–4.1 untether must be extracted before data partition mount
    case $vers in
        4.[10]* | 3.2* | 3.1.3 )
            log "Extracting $untether"
            $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
        ;;
    esac
    # untether extraction
    case $vers in
        4.[10]* | 3* ) :;; # already extracted
        * )
            if [[ $untether != 1 ]]; then
                log "Extracting $untether"
                $ssh -p $ssh_port root@127.0.0.1 "tar -xvf /mnt1/$untether -C /mnt1; rm /mnt1/$untether"
            fi
        ;;
    esac
    device_send_rdtar freeze.tar data
    if [[ $vers == "9"* ]]; then
        # required stuff for everuntether and untetherhomedepot
        [[ $vers != "9.0"* ]] && device_send_rdtar daemonloader.tar
        device_send_rdtar launchctl.tar
    fi
    if [[ $ipsw_openssh == 1 ]]; then
        device_send_rdtar sshdeb.tar
    fi
    case $vers in
        [543]* ) device_send_rdtar cydiasubstrate.tar;;
    esac
    case $vers in
        3* ) device_send_rdtar cydiahttpatch.tar;;
    esac
    if [[ $1 != noreboot ]]; then
        log "Rebooting"
        $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
    fi

    log "Jailbreak successfully✅"
    exit=1
}

device_raw_dump() {
    device_pwn
    if [[ $device_proc == 4 && $device_pwnrec != 1 ]]; then
        patch_ibss
        log "Sending iBSS..."
        $irecovery -f pwnediBSS.dfu
    fi
    sleep 2
    patch_ibec
    log "Sending iBEC..."
    $irecovery -f pwnediBEC.dfu
    if [[ $device_pwnrec == 1 ]]; then
        $irecovery -c "go"
    fi
    sleep 3
    checkmode rec
    log "Dumping raw dump now"
    (echo -e "/send ../resources/payload\ngo blobs\n/exit") | $irecovery2 -s
    $irecovery2 -g dump.raw
    log "Rebooting device"
    $irecovery -n
    local raw
    local err
    device_shsh_dump $1
    err=$?
    mkdir ../saved/raws 2>/dev/null
    if [[ $1 == "dump" ]]; then
        raw="../saved/raws/rawdump_${device_ecid}-${device_type}_$(date +%Y-%m-%d-%H%M)_${shsh_onboard_iboot}.raw"
    else
        raw="../saved/raws/rawdump_${device_ecid}-${device_type}-${device_target_vers}-${device_target_build}_$(date +%Y-%m-%d-%H%M)_${shsh_onboard_iboot}.raw"
    fi
    if [[ $1 == "dump" ]] || [[ $err != 0 && -s dump.raw ]]; then
        mv dump.raw $raw
        log "Raw dump saved at: $raw"
        return
    fi
}

device_shsh_dump() {
    local shsh="../saved/shsh/${device_ecid}-${device_type}_$(date +%Y-%m-%d-%H%M).shsh"
    mkdir ../saved/shsh 2>/dev/null
    shsh="../saved/shsh/${device_ecid}-${device_type}-${device_target_vers}-${device_target_build}.shsh"
    # remove ibob for powdersn0w/dra downgraded devices. fixes unknown magic 69626f62
    local blob=$(xxd -p dump.raw | tr -d '\n')
    local bobi="626f6269"
    local blli="626c6c69"
    if [[ $blob == *"$bobi"* ]]; then
        log "Detected \"ibob\". Fixing... (This happens on DRA/powdersn0w downgraded devices)"
        rm -f dump.raw
        printf "%s" "${blob%"$bobi"*}${blli}${blob##*"$blli"}" | xxd -r -p > dump.raw
    fi
    shsh_onboard_iboot="$(cat dump.raw | strings | grep iBoot | head -1)"
    log "Raw dump iBoot version: $shsh_onboard_iboot"
    if [[ $1 == "dump" ]]; then
        return
    fi
    log "Converting raw dump to SHSH blob"
    "$dir/ticket" dump.raw dump.shsh "$ipsw_path.ipsw" -z
    if [[ $? != 0 ]]; then
        warning "Saved SHSH blobs might be invalid. Did you select the correct IPSW?"
        print "* If you selected the correct IPSW and the error is not APTicket and/or LLB, the blob is most likely usable."
    fi
    if [[ ! -s dump.shsh ]]; then
        warning "Converting onboard SHSH blobs failed."
        return 1
    fi
    mv dump.shsh $shsh
    log "Successfully saved $device_target_vers blobs: $shsh"
}

device_hacktivate() {
    local ver
    local build
    local 
    log Get iOS version
    check_iosvers
    cut_os_vers $device_vers
    log $device_rd_build_custom
    log Mount Filesystem
    $ssh -p $ssh_port root@127.0.0.1 "mount.sh"
    if (( major_ver > 9 )); then
        local message=$($ssh -p $ssh_port root@127.0.0.1 "ls /mnt2")
        if [[ $message == "" ]]; then
            warning "This version of ramdisk cannot mount /mnt2,please use “./sshrd32.sh --version=9.0.2 --bypass” and try again"
            pause
            return
        fi
    fi
    case $device_vers in
        [56]* )
            if [[ -n $($ssh -p $ssh_port root@127.0.0.1 "ls /mnt1/bin/bash 2>/dev/null") ]]; then
                log Great,this device has been jailbroken,continue
            else
                yesno "Since jailbreaking is required for hacktivate-activation in iOS 5-6, do you want jailbreak? (y > jailbreak) (n > go to ssh menu)"
                if [[ $? == 1 ]]; then
                    jailbreak_sshrd noreboot
                    if [[ -n $($ssh -p $ssh_port root@127.0.0.1 "ls /mnt1/bin/bash 2>/dev/null") ]]; then
                        log Great,this device has been jailbroken,continue
                    else
                        error "This device also hasn't jailbroken,press enter to go to ssh menu"
                        ssh_menu
                        return
                    fi
                else
                    ssh_menu
                    return
                fi
            fi
            log Rename orgin file
            $ssh -p $ssh_port root@127.0.0.1 "mv /mnt1/usr/libexec/lockdownd /mnt1/usr/libexec/lockdownd.bak"
            log Upload new file
            $scp -P $ssh_port ../resources/lockdownd root@127.0.0.1:/mnt1/usr/libexec
            log Set permissions
            $ssh -p $ssh_port root@127.0.0.1 "chmod 755 /mnt1/usr/libexec/lockdownd"
            yesno Do you want to rename Setup.app?
            if [[ $? == 1 ]]; then
                $ssh -p $ssh_port root@127.0.0.1 "mv /mnt1/Applications/Setup.app /mnt1/Applications/Setup.app.bak"
            fi
            log Rebooting
            $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
            exit=1
            ;;
        [78]* | 9.[012]* )
            log "Download files"
            $scp -P $ssh_port root@127.0.0.1:/mnt2/mobile/Library/Caches/com.apple.MobileGestalt.plist .
            if [[ ! -f "com.apple.MobileGestalt.plist" ]]; then
                error Download files failed
                pause
                return
            else
                log "Add key to files"
                $afc activation com.apple.MobileGestalt.plist
                if [[ ! -f "com.apple.MobileGestalt.plist.backup" ]]; then
                    error "Add key failed"
                    pause
                    return
                fi
                cp com.apple.MobileGestalt.plist.backup ../saved/$device_type
                mv ../saved/$device_type/com.apple.MobileGestalt.plist.backup ../saved/$device_type/com.apple.MobileGestalt.plist.$(date '+%Y-%m-%d-%H-%M-%S').backup

            fi
            log Replace original files
            $ssh -p $ssh_port root@127.0.0.1 "mv /mnt2/mobile/Library/Caches/com.apple.MobileGestalt.plist /mnt2/mobile/Library/Caches/com.apple.MobileGestalt.plist.bak"
            log Upload files
            $scp -P $ssh_port com.apple.MobileGestalt.plist root@127.0.0.1:/mnt2/mobile/Library/Caches
            log Rename Setup.app
            $ssh -p $ssh_port root@127.0.0.1 "mv /mnt1/Applications/Setup.app /mnt1/Applications/Setup.app.bak"
            log Rebooting
            $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
            log Done
            exit=1
            ;;
        9.3* | 10* )
            if [[ $platform == linux ]]; then
                warnning afc_tool is unsupport for linux,wait for commit
                return
            fi
            if [[ $major_ver == 10 ]]; then
                case $minor_ver in
                    [012] )
                    local path="/mnt2/mobile/Library/Caches"
                    ;;
                    * )
                    local path="/mnt2/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches"
                    ;;
                esac
            else
                local path="/mnt2/mobile/Library/Caches"
            fi
            log Download files
            $ssh -p $ssh_port root@127.0.0.1 "mv $path/com.apple.MobileGestalt.plist /mnt2/mobile/Media"
            local message=$($ssh -p $ssh_port root@127.0.0.1 "ls /mnt2/mobile/Media/com.apple.MobileGestalt.plist")
            if [[ $message != "/mnt2/mobile/Media/com.apple.MobileGestalt.plist" ]]; then
                error Download failed
                pause Press enter to go to ssh menu
                ssh_menu
                return
            else
                #part1
                log Rebooting
                pause
                $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
                sleep 5
                checkmode nor
                log Please trust the device and press Enter.
                pause
                $afc download /com.apple.MobileGestalt.plist .
                if [[ ! -f "com.apple.MobileGestalt.plist" ]]; then
                    error Download failed
                    pause Press enter to exit
                    return
                else
                    log "Add key to files"
                    $afc activation com.apple.MobileGestalt.plist
                    if [[ ! -f "com.apple.MobileGestalt.plist.backup" ]]; then
                        error "Add key failed"
                        pause
                        return
                    fi
                    log Upload files
                    $afc upload com.apple.MobileGestalt.plist /
                fi
            fi
            log "Done,part1 has been completed,use ./sshrd32.sh --bypass-part-2 to start part 2"
            exit=1
            ;;
        * )
            warning This iOS version is unsupport
            pause Press enter to enter ssh menu
            ssh_menu
            ;;
    esac
}

device_hacktivate_part2() {
    ##part2 ios9.3-ios10.3.4
    log Get ios version
    check_iosvers
    cut_os_vers $device_vers
    $ssh -p $ssh_port root@127.0.0.1 "umount /mnt1"
    $ssh -p $ssh_port root@127.0.0.1 "umount /mnt2"
    if [[ $major_ver == 10 ]]; then
        case $minor_ver in
            [012] )
            local path="/mnt2/mobile/Library/Caches"
            ;;
            * )
            local path="/mnt2/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches"
            ;;
        esac
    else
        local path="/mnt2/mobile/Library/Caches"
    fi
    log Mount Filesystem
    $ssh -p $ssh_port root@127.0.0.1 "mount.sh"
    #log Rename Setup.app #ios10 cannot mv setup.app
    #$ssh -p $ssh_port root@127.0.0.1 "mv /mnt1/Applications/Setup.app /mnt1/Applications/Setup.app.bak"
    log Replace original files
    $ssh -p $ssh_port root@127.0.0.1 "mv $path/com.apple.MobileGestalt.plist $path/com.apple.MobileGestalt.plist.bak"
    $ssh -p $ssh_port root@127.0.0.1 "mv /mnt2/mobile/Media/com.apple.MobileGestalt.plist $path"
    log Rebooting
    $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
    log Done
    exit=1
}

device_bruteforce() {
    log Mount Filesystem
    $ssh -p $ssh_port root@127.0.0.1 "mount.sh"
    log Upload files
    $scp -P $ssh_port ../resources/bruteforce/bruteforce root@127.0.0.1:/var/root
    $ssh -p $ssh_port root@127.0.0.1 "chmod +x bruteforce"
    $ssh -p $ssh_port root@127.0.0.1 "./bruteforce -u"
    log When it finished, the last one is the password.
    pause
    ssh_menu
}

device_unblock_lock() {
    log Mount Filesystem
    $ssh -p $ssh_port root@127.0.0.1 "mount.sh"
    log Del some files
    $ssh -p $ssh_port root@127.0.0.1 "rm -rf /mnt2/mobile/Library/Preferences/com.apple.springboard.plist"
    $ssh -p $ssh_port root@127.0.0.1 "rm -rf /mnt2/mobile/Library/SpringBoard/LockoutStateJournal.plist"
    log Rebooting
    $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
    exit=1
}


###tools###

cut_os_vers() {
    if [[ $1 != device ]]; then
        device_det=$(echo "$1" | cut -c 1)
        device_det2=$(echo "$1" | cut -c -2)
        device_det3=$(echo "$1" | cut -c 3)
        device_det4=$(echo "$1" | cut -c 4)
        device_det5=$(echo "$1" | cut -c 4-5)
        device_det6=$(echo "$1" | cut -c 5-6)
    else
        device_det=$(echo "$2" | cut -c 1)
        device_det2=$(echo "$2" | cut -c -2)
        device_det3=$(echo "$2" | cut -c 3)
        device_det4=$(echo "$2" | cut -c 4)
        device_det5=$(echo "$2" | cut -c 4-5)
        device_det6=$(echo "$2" | cut -c 5-6)
    fi
    if [[ $1 != device ]]; then
        if [[ $device_det == 1 ]]; then
            major_ver=$device_det2
            minor_ver=$device_det4
            nano_ver=$device_det6
            nano_ver_wtd=$(echo "$nano_ver" | cut -c 2)
        else
            major_ver=$device_det
            minor_ver=$device_det3
            nano_ver=$device_det5
            nano_ver_wtd=$(echo "$nano_ver" | cut -c 2)
        fi
    else
        if [[ $device_det == 1 ]]; then
            device_major_ver=$device_det2
            device_minor_ver=$device_det4
            device_nano_ver=$device_det6
            device_nano_ver_wtd=$(echo "$device_nano_ver" | cut -c 2)
        else
            device_major_ver=$device_det
            device_minor_ver=$device_det3
            device_nano_ver=$device_det5
            device_nano_ver_wtd=$(echo "$device_nano_ver" | cut -c 2)
        fi
    fi
}

get_ipsw_info() {
    local ipsw_file
    local manifest_file="BuildManifest.plist"
    if [[ $1 == "base" ]]; then
        ipsw_file="$ipsw_base_path"
    else
        if [[ $1 == "target" ]]; then
            ipsw_file="$2"
        else
            ipsw_file="$ipsw_path"
        fi
    fi    
    if [ -z "$ipsw_file" ]; then
        warning Unable to get ipsw path
        exit
    fi
    unzip -p "$ipsw_file" "BuildManifest.plist" > "$manifest_file" 2>/dev/null
    if [ $? -ne 0 ]; then
        error "Unable extract files from this ipsw"
        return 1
    fi
    if [[ $platform == "macos" ]]; then
        device_type_ipsw_temp=$(plutil -extract "SupportedProductTypes" xml1 -o - "$manifest_file" | sed -n 's/<string>\(.*\)<\/string>/\1/p')
        device_vers=$(plutil -extract "ProductVersion" xml1 -o - "$manifest_file" | sed -n 's/<string>\(.*\)<\/string>/\1/p')
        device_build=$(plutil -extract "ProductBuildVersion" xml1 -o - "$manifest_file" | sed -n 's/<string>\(.*\)<\/string>/\1/p')
        device_type_ipsw=$(echo "$device_type_ipsw_temp" | tr -d '\n\r' | xargs)
    else
        device_type_ipsw_temp=$(cat $manifest_file | grep -i SupportedProductTypes -A 1 | grep -oPm1 "(?<=<string>)[^<]+")
        device_vers=$(cat $manifest_file | grep -i ProductVersion -A 1 | grep -oPm1 "(?<=<string>)[^<]+")
        device_build=$(cat $manifest_file | grep -i ProductBuildVersion -A 1 | grep -oPm1 "(?<=<string>)[^<]+")
        device_type_ipsw=$(echo "$device_type_ipsw_temp" | tr -d '\n\r' | xargs)
    fi
    if [[ $1 == "base" ]]; then
        device_type_ipswbase="$device_type_ipsw"
        device_base_vers="$device_vers"
        device_base_build="$device_build"
        if [[ "$device_type" != "$device_type_ipswbase" ]]; then
            ipsw_base_select_wrong=1
            return 1
        else
            ipsw_base_select_wrong=0
        fi
    else
        device_type_ipsw="$device_type_ipsw"
        device_target_vers="$device_vers"
        device_target_build="$device_build"
        if [[ "$device_type" != "$device_type_ipsw" ]]; then
            ipsw_select_wrong=1
            return 1
        else
            ipsw_select_wrong=0
        fi
    fi
    
    rm -f "$manifest_file"
    return 0
}

get_firmware_info() {
    local version=
    local build=
    buildid=
    filesize=
    sha1=
    sha256=
    md5=
    signed=
    releasedate=
    uploaddate=
    curl -s -L "https://api.ipsw.me/v4/device/$device_type?type=ipsw" -o tmp.json
    JSON_FILE=tmp.json
    if [[ ! -f "tmp.json" ]]; then
        error Unable get json,please check internat connection
        exit
    fi
    if [[ $1 == "ver" ]]; then
        version=$2
        if [[ "$device_type" == "iPod4,1" && "$version" == "4.1" ]]; then
            log Select version
            options=("8B117" "8B118")
            select_option "${options[@]}"
            selected_index=$?
            selected="${options[$selected_index]}"
            
            case $selected in
                "8B117" ) 
                    get_firmware_info build 8B117
                    return $?
                    ;;
                "8B118" ) 
                    get_firmware_info build 8B118
                    return $?
                    ;;
            esac
        fi
    elif [[ $1 == "build" ]]; then
        build=$2
    fi
    if [[ $1 == "ver" ]]; then
        buildid=$($jq -r ".firmwares[] | select(.version == \"$version\") | .buildid" "$JSON_FILE")
        filesize=$($jq -r ".firmwares[] | select(.version == \"$version\") | .filesize" "$JSON_FILE")
        url=$($jq -r ".firmwares[] | select(.version == \"$version\") | .url" "$JSON_FILE")
        sha1=$($jq -r ".firmwares[] | select(.version == \"$version\") | .sha1sum" "$JSON_FILE")
        sha256=$($jq -r ".firmwares[] | select(.version == \"$version\") | .sha256sum" "$JSON_FILE")
        md5=$($jq -r ".firmwares[] | select(.version == \"$version\") | .md5sum" "$JSON_FILE")
        signed=$($jq -r ".firmwares[] | select(.version == \"$version\") | .signed" "$JSON_FILE")
        releasedate=$($jq -r ".firmwares[] | select(.version == \"$version\") | .releasedate" "$JSON_FILE")
        uploaddate=$($jq -r ".firmwares[] | select(.version == \"$version\") | .uploaddate" "$JSON_FILE")
    elif [[ $1 == "build" ]]; then
        buildid="$build"
        filesize=$($jq -r ".firmwares[] | select(.buildid == \"$build\") | .filesize" "$JSON_FILE")
        url=$($jq -r ".firmwares[] | select(.buildid == \"$build\") | .url" "$JSON_FILE")
        sha1=$($jq -r ".firmwares[] | select(.buildid == \"$build\") | .sha1sum" "$JSON_FILE")
        sha256=$($jq -r ".firmwares[] | select(.buildid == \"$build\") | .sha256sum" "$JSON_FILE")
        md5=$($jq -r ".firmwares[] | select(.buildid == \"$build\") | .md5sum" "$JSON_FILE")
        signed=$($jq -r ".firmwares[] | select(.buildid == \"$build\") | .signed" "$JSON_FILE")
        releasedate=$($jq -r ".firmwares[] | select(.buildid == \"$build\") | .releasedate" "$JSON_FILE")
        uploaddate=$($jq -r ".firmwares[] | select(.buildid == \"$build\") | .uploaddate" "$JSON_FILE")
    fi
}

device_send_rdtar() {
    local target="/mnt1"
    if [[ $2 == "data" ]]; then
        target+="/private/var"
    fi
    log "Sending $1"
    $scp -P $ssh_port $jelbrek/$1 root@127.0.0.1:$target
    log "Extracting $1"
    $ssh -p $ssh_port root@127.0.0.1 "tar -xvf $target/$1 -C /mnt1; rm $target/$1"
}

device_iproxy() {
    local port=22
    log "Running iproxy for SSH..."
    if [[ -n $2 ]]; then
        port=$2
    fi
    if [[ $1 == "no-logging" && $debug_mode != 1 ]]; then
        "$dir/iproxy" $ssh_port $port -s 127.0.0.1 >/dev/null &
        iproxy_pid=$!
    else
        "$dir/iproxy" $ssh_port $port -s 127.0.0.1 &
        iproxy_pid=$!
    fi
    log "iproxy PID: $iproxy_pid"
    sleep 1
}

device_s5l8900xall() {
    local wtf_sha="cb96954185a91712c47f20adb519db45a318c30f"
    local wtf_saved="../saved/patches/WTF.s5l8900xall.RELEASE.dfu"
    local wtf_patched="$wtf_saved.patched"
    local wtf_patch="../resources/patch/WTF.s5l8900xall.RELEASE.patch"
    local wtf_sha_local="$($sha1sum "$wtf_saved" 2>/dev/null | awk '{print $1}')"
    mkdir ../saved 2>/dev/null
    mkdir ../saved/patches 2>/dev/null
    if [[ $wtf_sha_local != "$wtf_sha" ]]; then
        log "Downloading WTF.s5l8900xall"
        "$dir/pzb" -g "Firmware/dfu/WTF.s5l8900xall.RELEASE.dfu" -o WTF.s5l8900xall.RELEASE.dfu "http://appldnld.apple.com/iPhone/061-7481.20100202.4orot/iPhone1,1_3.1.3_7E18_Restore.ipsw"
        rm -f "$wtf_saved"
        mv WTF.s5l8900xall.RELEASE.dfu $wtf_saved
    fi
    wtf_sha_local="$($sha1sum "$wtf_saved" | awk '{print $1}')"
    if [[ $wtf_sha_local != "$wtf_sha" ]]; then
        error "SHA1sum mismatch. Expected $wtf_sha, got $wtf_sha_local. Please run the script again"
    fi
    rm -f "$wtf_patched"
    log "Patching WTF.s5l8900xall"
    $bspatch $wtf_saved $wtf_patched $wtf_patch
    log "Sending patched WTF.s5l8900xall (Pwnage 2.0)"
    $irecovery -f "$wtf_patched"
    checkmode DFU
    sleep 1
    device_srtg="$($irecovery -q | grep "SRTG" | cut -c 7-)"
    log "SRTG: $device_srtg"
    if [[ $device_srtg == "iBoot-636.66.3x" ]]; then
        device_argmode=
        device_type=$($irecovery -q | grep "PRODUCT" | cut -c 10-)
        device_model=$($irecovery -q | grep "MODEL" | cut -c 8-)
        device_model="${device_model%??}"
        device_pwnd="Pwnage 2.0"
    fi
}

device_fw_key_check() {
    # check and download keys for device_target_build, then set the variable device_fw_key (or device_fw_key_base)
    #remove download part,replace use unzip
    local key
    local build="$device_target_build"
    if [[ $1 == "base" ]]; then
        build="$device_base_build"
    elif [[ $1 == "temp" ]]; then
        build="$2"
    fi
    device_fw_dir=../saved/$device_type/$build
    local keys_path="."

    log "Checking firmware keys"
    if [[ $(cat "$keys_path/index.html" 2>/dev/null | grep -c "$build") != 1 ]]; then
        rm -f "$keys_path/index.html"
    fi
    if [[ ! -e "$keys_path/index.html" ]]; then
        cp ../resources/keys.zip .
        unzip -p keys.zip "Legacy-iOS-Kit-Keys-master/$device_type/$build/index.html" > index.html
    fi
    if [[ $1 == "base" ]]; then
        device_fw_key_base="$(cat index.html)"
    elif [[ $1 == "temp" ]]; then
        device_fw_key_temp="$(cat index.html)"
    else
        device_fw_key="$(cat index.html)"
    fi
}

patch_ibss() {
    # creates file pwnediBSS to be sent to device
    local build_id
    case $device_type in
        iPad1,1 | iPod3,1 ) build_id="9B206";;
        iPhone2,1 | iPod4,1 ) build_id="10B500";;
        iPhone3,[123] ) build_id="11D257";;
        * ) build_id="12H321";;
    esac
    if [[ -n $device_rd_build ]]; then
        build_id="$device_rd_build"
    fi
    download_comp $build_id iBSS
    device_fw_key_check temp $build_id
    local iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "iBSS") | .iv')
    local key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "iBSS") | .key')
    log "Decrypting iBSS..."
    "$dir/xpwntool" iBSS iBSS.dec -iv $iv -k $key
    log "Patching iBSS..."
    "$dir/iBoot32Patcher" iBSS.dec pwnediBSS --rsa
    "$dir/xpwntool" pwnediBSS pwnediBSS.dfu -t iBSS
    cp pwnediBSS pwnediBSS.dfu ../saved/$device_type/
    log "Pwned iBSS saved at: saved/$device_type/pwnediBSS"
    log "Pwned iBSS img3 saved at: saved/$device_type/pwnediBSS.dfu"
}

patch_ibec() {
    # creates file pwnediBEC to be sent to device for blob dumping
    local build_id
    if [[ ! -f ../saved/$device_type/pwnediBEC.dfu ]]; then
        case $device_type in
            iPad1,1 | iPod3,1 )
                build_id="9B206";;
            iPhone2,1 | iPhone3,[123] | iPod4,1 | iPad3,1 )
                build_id="10A403";;
            iPad2,[367] | iPad3,[25] )
                build_id="12H321";;
            iPhone5,3 )
                build_id="11B511";;
            iPhone5,4 )
                build_id="11B651";;
            * )
                build_id="10B329";;
        esac
        if [[ -n $device_rd_build ]]; then
            build_id="$device_rd_build"
        fi
        download_comp $build_id iBEC
        device_fw_key_check temp $build_id
        local name="iBEC"
        local iv=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "iBEC") | .iv')
        local key=$(echo $device_fw_key_temp | $jq -j '.keys[] | select(.image == "iBEC") | .key')
        local address="0x80000000"
        if [[ $device_proc == 4 ]]; then
            address="0x40000000"
        fi
        mv iBEC $name.orig
        log "Decrypting iBEC..."
        "$dir/xpwntool" $name.orig $name.dec -iv $iv -k $key
        log "Patching iBEC..."
        if [[ $device_proc == 4 || -n $device_rd_build || $device_type == "iPad3,1" ]]; then
            "$dir/iBoot32Patcher" $name.dec $name.patched --rsa --ticket -b "rd=md0 -v amfi=0xff cs_enforcement_disable=1" -c "go" $address
        else
            $bspatch $name.dec $name.patched "../resources/patch/$download_targetfile.patch"
        fi
        "$dir/xpwntool" $name.patched pwnediBEC.dfu -t $name.orig
        rm $name.dec $name.orig $name.patched
        cp pwnediBEC.dfu ../saved/$device_type/
        log "Pwned iBEC img3 saved at: saved/$device_type/pwnediBEC.dfu"
    else
        log Found exist Pwned iBEC
        cp ../saved/$device_type/pwnediBEC.dfu .
    fi
}


download_comp() {
    # usage: download_comp [build_id] [comp]
    local build_id="$1"
    local comp="$2"
    ipsw_get_url $build_id
    download_targetfile="$comp.$device_model"
    if [[ $build_id != "12"* ]]; then
        download_targetfile+="ap"
    fi
    download_targetfile+=".RELEASE"

    if [[ -e "../saved/$device_type/${comp}_$build_id.dfu" ]]; then
        cp "../saved/$device_type/${comp}_$build_id.dfu" ${comp}
    else
        log "Downloading ${comp}..."
        "$dir/pzb" -g "Firmware/dfu/$download_targetfile.dfu" -o ${comp} "$ipsw_url"
        cp ${comp} "../saved/$device_type/${comp}_$build_id.dfu"
    fi
}

ipsw_get_url() {
    local device_fw_dir="../saved/${device_type}/urls"
    mkdir $device_fw_dir 2>/dev/null
    local build_id="$1"
    local version="$2"
    local url="$(cat "$device_fw_dir/$build_id/url" 2>/dev/null)"
    local url_local="$url"
    ipsw_url=
    log "Checking URL in $device_fw_dir/$build_id/url"
    if [[ $(echo "$url" | grep -c '<') != 0 || $url != *"$build_id"* ]]; then
        rm -f "$device_fw_dir/$build_id/url"
        url=
    fi
    if [[ $device_type == "iPod1,1" ]] && [[ $build_id == "5"* || $build_id == "7"* ]]; then
        url="https://invoxiplaygames.uk/ipsw/${device_type}_${version}_${build_id}_Restore.ipsw"
    elif [[ $device_type == "iPod2,1" && $build_id == "7"* ]]; then
        url="https://invoxiplaygames.uk/ipsw/${device_type}_${version}_${build_id}_Restore.ipsw"
    fi
    if [[ -z $url ]]; then
        log "Getting URL for $device_type-$build_id"
        local phone="OS" # iOS
        case $build_id in
            [23][0123456789]* | 7B405 | 7B500 ) :;;
            1[AC]* | [2345]* ) phone="Phone%20Software";; # iPhone Software
            7* ) phone="Phone%20OS";; # iPhone OS
        esac
        if [[ $device_type == "iPad"* ]]; then
            case $build_id in
                1[789]* | [23]* ) phone="PadOS";; # iPadOS
            esac
        fi
        rm -f tmp.json
        $aria2c "https://raw.githubusercontent.com/littlebyteorg/appledb/refs/heads/gh-pages/ios/i${phone};$build_id.json" -o tmp.json
        [[ $? != 0 ]] && $curl -L "https://raw.githubusercontent.com/littlebyteorg/appledb/refs/heads/gh-pages/ios/i${phone};$build_id.json" -o tmp.json
        url="$(cat tmp.json | $jq -r ".sources[] | select(.type == \"ipsw\" and any(.deviceMap[]; . == \"$device_type\")) | .links[0].url")"
        local url2="$(echo "$url" | tr '[:upper:]' '[:lower:]')"
        local build_id2="$(echo "$build_id" | tr '[:upper:]' '[:lower:]')"
        if [[ $(echo "$url" | grep -c '<') != 0 || $url2 != *"$build_id2"* ]]; then
            if [[ -n $url_local ]]; then
                url="$url_local"
                log "Using saved URL for this IPSW: $url"
                echo "$url" > $device_fw_dir/$build_id/url
                ipsw_url="$url"
                return
            fi
            if [[ $ipsw_isbeta != 1 ]]; then
                error "Unable to get URL for $device_type-$build_id"
            fi
        fi
        mkdir -p $device_fw_dir/$build_id 2>/dev/null
        echo "$url" > $device_fw_dir/$build_id/url
    fi
    ipsw_url="$url"
}

####others#####
clean() {
    kill $httpserver_pid $iproxy_pid $anisette_pid $sshfs_pid 2>/dev/null
    popd &>/dev/null
    rm -rf "$(dirname "$0")/tmp$$/"* "$(dirname "$0")/iP"*/ "$(dirname "$0")/tmp$$/" 2>/dev/null
    rm -rf $(dirname "$0")/tmp*
    if [[ $platform == "macos" && $(ls "$(dirname "$0")" | grep -v tmp$$ | grep -c tmp) == 0 &&
          $no_finder != 1 ]]; then
        killall -CONT AMPDevicesAgent AMPDeviceDiscoveryAgent MobileDeviceUpdater
    fi
}

display_help() {
    tip  "*** SSHRD_Script_32Bit ***"
    tip  "- Script by MrY0000 -"
    tip  "- Thanks LuckZGD Setup.app -"
    tip  "- Forked from Legacy-iOS-Kit(https://github.com/LukeZGD/Legacy-iOS-Kit) -"
    print "Run ./sshrd32.sh use default version"
    print "Simplify Args"
    print "1. ./sshrd32.sh "ios ver/build ver"  use custom version,only support ios verion and ios build version"
    print "2. ./sshrd32.sh boot  boot ramdisk after make"
    print "3. ./sshrd32.sh ssh  connect ssh"
    print Args
    print "./sshrd32.sh --version=“ramdisk build ver”/“ramdisk ver” use custom version,only support ios verion and ios build version"
    print "./sshrd32.sh --device="iPhone/iPad/iPodx,x" custom device_type,without device check"
    print "./sshrd32.sh --menu  directly access the menu"
    print "./sshrd32.sh --make make ssh ramdisk only, without boot"
    print "./sshrd32.sh --reboot reboot device in sshrd"
    print "./sshrd32.sh --password bruteforce password(only support 4-digit password)"
    print "./sshrd32.sh --bypass hacktivate device(support iOS7-9.2.X)"
    print "./sshrd32.sh --bypass-part-1 hacktivate device(support iOS9.3-10.3.4)"
    print "./sshrd32.sh --unblock-lock unblock screen lock limit"
    print "./sshrd32.sh --update update to newest commit"
}

function select_option() {
    if [[ $menu_old == 1 ]]; then
        select opt in "$@"; do
            selected=$((REPLY-1))
            break
        done
        return $selected
    fi

    # clear input buffer to prevent error
    if (( bash_ver > 3 )); then
        while read -s -t 0.01 -n 1; do :; done
    else
        local old=$(stty -g)
        stty -icanon -echo min 0 time 1
        dd bs=1 count=1000 if=/dev/tty of=/dev/null 2>/dev/null
        stty "$old"
    fi

    # little helpers for terminal print control and key input
    ESC=$( printf "\033")
    cursor_blink_on()  { printf "$ESC[?25h"; }
    cursor_blink_off() { printf "$ESC[?25l"; }
    cursor_to()        { printf "$ESC[$1;${2:-1}H"; }
    print_option()     { printf "   $1  "; }
    print_selected()   { printf " ->$ESC[7m $1 $ESC[27m"; }
    get_cursor_row()   { IFS=';' read -sdR -p $'\E[6n' ROW COL; echo ${ROW#*[}; }
    key_input()        { read -s -n3 key 2>/dev/null >&2
                         if [[ $key = $ESC[A ]]; then echo up;    fi
                         if [[ $key = $ESC[B ]]; then echo down;  fi
                         if [[ $key = ""     ]]; then echo enter; fi; }

    # initially print empty new lines (scroll down if at bottom of screen)
    for opt; do printf "\n"; done

    # determine current screen position for overwriting the options
    local lastrow=`get_cursor_row`
    local startrow=$(($lastrow - $#))

    # ensure cursor and input echoing back on upon a ctrl+c during read -s
    trap "cursor_blink_on; stty echo; printf '\n'; exit" 2
    cursor_blink_off

    local selected=0
    while true; do
        # print options by overwriting the last lines
        local idx=0
        for opt; do
            cursor_to $(($startrow + $idx))
            if [ $idx -eq $selected ]; then
                print_selected "$opt"
            else
                print_option "$opt"
            fi
            ((idx++))
        done

        # user key control
        case `key_input` in
            enter) break;;
            up)    ((selected--));
                   if [ $selected -lt 0 ]; then selected=$(($# - 1)); fi;;
            down)  ((selected++));
                   if [ $selected -ge $# ]; then selected=0; fi;;
        esac
    done

    # cursor position back to normal
    cursor_to $lastrow
    printf "\n"
    cursor_blink_on

    return $selected
}

function select_opt {
    select_option "$@" 1>&2
    local result=$?
    echo $result
    return $result
}

function yesno() {
    local msg="Do you want to continue?"
    if [[ -n $1 ]]; then
        msg="$1"
    fi
    if [[ $2 == 1 ]]; then
        msg+=" (Y/n): "
    else
        msg+=" (y/N): "
    fi
    local yesno=("No" "Yes") # default is "no" by default
    if [[ $2 == 1 ]]; then # default is "yes" if $2 is set to 1
        yesno=("Yes" "No")
    fi
    input "$msg"
    select_option "${yesno[@]}"
    local res=$?
    if [[ $2 == 1 ]]; then
        [[ $res == 0 ]] && return 1 || return 0
    fi
    return $res
}


debug_func() {
    log 1
    pause
}

trap clean EXIT
trap "exit 1" INT TERM
mkdir "$(dirname "$0")/tmp$$"
pushd "$(dirname "$0")/tmp$$" >/dev/null
mkdir ../saved 2>/dev/null
oscheck
set_ssh_config
set_path
for i in "$@"; do
    case "$i" in
        --irec )
            just_irec=1
            ;;
        --version=* )
            device_rd_build_custom="${i#--version=}"
            ;;
        --ship-ssh-check )
            ship_ssh_check=1
            ;;
        --ship-boot )
            device_argmode=none
            ;;
        --ship-build-check )
            warning Without check the build process may cause errors.
            yesno Do you want to continue?
            if [[ $? == 1 ]]; then
                exit 1
            else
                ship_build_check=1
            fi
            ;;
        --menu )
            device_iproxy
            without_boot=1
            ssh_menu
            exit
            ;;
        --debug )
            debug=1
            ;;
        --debug-mode )
            debug_mode=1
            ;;
        --make )
            just_make=1
            device_argmode=none
            ;;
        --device=* )
           device_type="${i#--device=}"
            ;;
        --jailbreak | --jb )
            no_menu=1
            just_jailbreak=1
            ;;
        --password )
            no_menu=1
            just_password=1
            log "Enter your iOS version(below iOS 6 will use simple way)"
            read bruteforce_ver
            cut_os_vers $bruteforce_ver
            if (( $major_ver < 7 )); then
                just_password_legacy=1
            else
                case $major_ver in
                    7 ) device_rd_build_custom="7.1.2" ;;
                    * ) device_rd_build_custom="9.0.2" ;;
                esac
                log Will use $device_rd_build_custom ramdisk
            fi
            ;;
        --hacktivate | --hac | --bypass )
            no_menu=1
            just_hacktivate=1
            ;;
        --get-ios-ver )
            just_get_ios_ver=1
            no_menu=1
            ;;
        --help | --h )
            display_help
            exit 1
            ;;
         --hac-part-1 | --bypass-part-1 )
            device_rd_build_custom=9.0.2
            no_menu=1
            just_part2=1
            ;;
         --hac-part-2 | --bypass-part-2 )
            device_rd_build_custom=9.0.2
            no_menu=1
            just_part2=1
            ;;
        --unblock-lock )
            no_menu=1
            just_unblock_lock=1
            ;;
        --reboot )
            device_iproxy
            log Rebooting
            $ssh -p $ssh_port root@127.0.0.1 "reboot_bak"
            exit 1
            ;;
        --ssh | ssh )
            device_iproxy
            ssh_message
            $ssh -p $ssh_port root@127.0.0.1
            exit 1
            ;;
        --dump-blobs | --dump-raws )
            log "[*] Waiting for the device to enter DFU mode"
            checkmode DFUall
            log "Select iPSW(Please select right ipsw,if you don't know ios version,use ./sshrd32.sh --get-ios-ver)"
            ipsw_try123=0
            while true; do
                ipsw_path1="$($zenity --file-selection --multiple --file-filter='IPSW | *.ipsw' --title="Select IPSW file(s)")"
                ((ipsw_try123++))
                if [[ -n "$ipsw_path1" ]]; then
                    break
                fi
                if [[ $ipsw_try123 == 10 ]]; then
                    error "Unable to select ipsw, please run the script again"
                    exit 1
                fi
            done
            get_ipsw_info target $ipsw_path1
            ipsw_path="${ipsw_path1%.ipsw}"
            device_info
            device_pwn
            if [[ $i == "--dump-raws" ]]; then
                device_raw_dump dump
            else
                device_raw_dump
            fi
            exit
            ;;
        --update )
            update
            exit
            ;;
        #legacy part,from SSHRD
        [0-9]*.[0-9]* )
            arg_l=1
            device_rd_build_custom="$i"
            device_argmode=none
            ;;
        [0-9]*[A-Za-z][0-9]* )
            arg_l=1
            device_rd_build_custom="$i"
            device_argmode=none
            ;;
        --boot | boot )
            if [[ $i == "--boot" ]]; then
                arg_l=0
            else
                arg_l=1
            fi
            just_boot=1
            nomenu=1
            ;;
        clean )
            if [[ -d ../current_ramdisk ]]; then
                rm -f ../current_ramdisk
                if [[ -d ../current_ramdisk ]]; then
                    error Unable to delete files
                else
                    log Delect files successfully
                fi
            else
                error "Cannot find current ramdisk,use ./sshrd32.sh [ios version/ios build version] to make ramdisk"
            fi
            exit
            ;;
        "" )
            :
            ;;
        * )
            warning Unknown command,use"./sshrd32.sh -h" to use right command
            exit
            ;;
    esac
done
main
if [[ $arg_l != 1 ]]; then
    pause "Press Enter/Return to exit this script" noctrlc
fi
popd >/dev/null