← Back

Dualboot NonUI (32 bit)

You need to have:

NonUI Dump (InternalUI would also do) or decrypted RootFS from any Restore Bundle (can be found on our website).
Mac, Linux or even Windows with WSL or MINGW. Try to do that on your own risk! If you will make something wrong, it might just bootloop forever. Restore will fix everything as well.

Follow the steps below:

  1. 1. Patch iBSS and iBEC:
    bash
    ./xpwntool iBSS.orig iBSS.dec -iv iv -k key
./xpwntool iBEC.orig iBEC.dec -iv iv -k key
./iBoot32Patcher iBSS.dec iBSS.patched --rsa --dualboot
./iBoot32Patcher iBEC.dec iBEC.patched --rsa --setenv --debug --dualboot -b \
"-v amfi=0xff cs_enforcement_disable=1 amfi_get_out_of_my_way=1 debug=0x14e keepsyms=1 rd=disk0s1s3"
./image3maker -t ibss -f iBSS.patched -o iBSS.img3
./image3maker -t ibec -f iBEC.patched -o iBEC.img3
  2. 2. Patch DeviceTree:
    bash
    ./xpwntool devicetree.orig devicetree.dec -iv iv -k key
./perl -0777 -pe '
  s/([\x00-\xff])\x00\x00\x00\x00\x00\x00\x00AAPL,phandle/
    chr(ord($1)+1)."\x00\x00\x00\x00\x00\x00\x00AAPL,phandle"/e;
  s/use-lwvm/
    \x6e\x6f\x2d\x65\x66\x66\x61\x63\x65\x61\x62\x6c\x65\x2d
    \x73\x74\x6f\x72\x61\x67\x65\x00\x00\x00\x00\x00\x00\x00
    \x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x18\x00\x75\x73
    \x65\x2d\x6c\x77\x76\x6d/x;
' devicetree.dec > devicetree.patched
./image3maker -t dtre -f devicetree.patched -o devicetree
  3. 3. Decrypt Kernelcache, Ramdisk and Applelogo.
  4. 4. After patching bootchain, do this: Partitioning, Restoring and Modifying Filesystems.
  5. OTA cleaning is not unnessasary, but still can be peformed.
  6. If you are dualbooting NonUI that is higher than iOS 7+, use this guide. And if you are dualbooting iOS 5.X, use this.
  7. Also, if you wanna clean a bit more space on iOS 7+, you can use it:
    bash
    rm -rf /mnt3/Developer/*
rm -rf /mnt3/.Trashes/*
  8. Or if Kernelcache is presented:
    bash
    rm -rf /mnt3/System/Library/Caches/com.apple.kernelcaches/*
  9. 5. Then, unplug the device if it was connected and reboot.
  10. 6. Upload the bootchain to /mnt3 (devicetree, kernelcache, ramdisk and applelogo).
    Keep the iBSS and iBEC somewhere in /root, not including /private/var.
  11. 7. Boot it:
    bash
    ./multi_kloader /path/to/iBSS /path/to/iBEC

8. ENJOY!

Thanks to Stonneph for original guide and to Mokquad for reimagined guide.

Tutorial for installing 7D11 build

  1. 1. First, download the restore bundle and tools from here: link for a build
  2. 2. After, unzip it and open 018-4658-200.dmg and 018-6135-014.dmg and install the packages.
  3. 3. Then, open the application FactoryRestore, select Internal in the Restore Settings dropdown and plug your device in.
  4. 4. Next, press the little square next to restore bundle on the right side and guide it to the path for the Restore folder inside the restore bundle.
  5. 5. After, click on the device and then click restore, choose Internal (for an InternalUI and NonUI merged install) or if you want you can select NonUI internal (unsure if the other images work), and then select Development for the kernel type and firmware type, Debug does not work, then restore the device
  6. 6. If the device fails the restore but the bar on the device’s screen is full, reboot it and then use Legacy iOS Kit to kick it out of recovery mode. If the bar is not full then you’ll have to restore iOS with iTunes 10.7 since on reboot the device will be forced into DFU mode.
  7. 7. ENJOY!

Thanks to MWR (Fit_Mycologist_8247).

How to change InternalUI on NonUI or NonUI on InternalUI (FullInternal!)

How to change InternalUI on NonUI:

bash
launchctl unload -w /System/Library/LaunchDaemons/com.apple.SpringBoard.plist
launchctl load -w /AppleInternal/Applications/SwitchBoard.app/com.apple.SwitchBoard.plist

How to change NonUI on Internal:

bash
launchctl unload -w /AppleInternal/Applications/SwitchBoard.app/com.apple.SwitchBoard.plist
launchctl load -w /System/Library/LaunchDaemons/com.apple.SpringBoard.plist

Thanks to FujiExpo.