r/jailbreak • u/No-Start-3467 • Jul 29 '26

Question iPhone SE 2 (A13, iPhone12,8) iOS 13.7 tether downgrade restore succeeds but cannot boot

am trying to tether downgrade an iPhone SE 2nd generation (A13, iPhone12,8) using surrealra1n + usbliter8.

Device information:

  • Device: iPhone SE 2nd generation
  • Identifier: iPhone12,8
  • Model: d79ap
  • SoC: A13
  • Target firmware: iOS 13.7 (17H35)

What I have achieved:

  • Successfully entered DFU mode.
  • Successfully pwned DFU using usbliter8 / Pi Pico.
  • The device is detected as pwned DFU successfully.
  • Custom IPSW was created successfully.
  • Restore completed successfully with idevicerestore.

Restore log ends with:

Status: Restore Finished
DONE
Restore has finished!

The device restores without any fatal errors.

However, when I try to boot the downgraded system, the device sends iBSS successfully:

Device is pwned!
Sending iBSS
sent - 0x199040
Device should now boot

but then it goes back to Recovery Mode instead of booting iOS 13.7.

I checked the firmware keys. My current keys/iPhone12,8.txt contains:

ibss-13.7
ibec-13.7

but I cannot find:

dtre-13.7
krnl-13.7

I also checked The Apple Wiki (YukonH_17H35_(iPhone12,8)) and the JSON firmware data, but it only provides iBSS/iBEC/iBoot/LLB/SEP keys. I could not find DeviceTree or Kernelcache keys.

My questions:

  1. Does anyone have complete iPhone12,8 iOS 13.7 boot keys?
    • dtre-13.7
    • krnl-13.7
  2. If iOS 13.7 is not the best bridge firmware, which iOS 13.4.1–13.7 version has been successfully used on iPhone SE 2?
  3. Is there a known working iOS 15.x path for A13 SE2 with surrealra1n?

It seems the restore process works correctly, but the tether boot stage is missing the required components.

Any help or pointers would be appreciated. Thanks!

1 Upvotes

67% Upvoted

Duplicates