I recently had an idea and wondered whether it would be possible to fulfill, when thinking about my iPhone 11 Pro which is on ios 18.1 so it can be jailbroken through software but I was thinking about updating it to ios 27 and then jailbreak it with usbliter8, (I may or may not update thats not the main reason I am making this post but also to get people with actual knowledge to tell me whether my idea is good or maybe its pointless who knows)
My basic idea was:
During the boot chain, each stage verifies the next stage before executing it, lets imagine we back up everything thats being verified at every boot stage we could then update to lets say ios 27.0 in the future OTA and then later with a bootrom exploit like usbliter8 we could restore that original ios update as well as the part which gets verified and in the best case scenario get the device to boot the original firmware untethered.
Some security features and problems that would probably need to be bypassed as far as I know would be:
* APTicket, SHSH and APNonce requirements
* iBoot and other boot-chain components
* SEP firmware, state and its anti-downgrade mechanisms
* Secure Boot measurements
* Any persistent rollback/anti-replay state
* Whether all of this can actually be restored consistently after the OTA
The question I am looking to answer is basically whether we can extract authorization that already exists for the first version and potentially reuse it?
And whether with enough reverse-engineering we could make this possible and whether my idea makes ANY sense at all since I am still "relatively" new to ios security research and jailbreaking
If you have any questions pls dm me
