Follow these simple steps:
1. Open the mfc software and log in
2. Put your device into DFU mode and connect to mfc software (Cable can be Lightning to USB, the DCSD not required)
3. Double-click to select the device in the detected list
4. Navigate to the ramdisk tab and press "connect" and wait for the process to complete
5. Press the "Backup Activation" button to do backup. You can manually check the backup files (usually the backup files is located in c:/mfc/iBackups/xxxx, and the path is also can find in the operation log)
6. Press "Exit & Reboot " button then do factory default reset for the device via mfc restore function and then back to ramdisk tab repeat above steps 1-4
7,At the end press the "Restore Activation" button, once finish Press "Exit & Reboot " , All Done
Ps. if device is already did factory default reset ("Hello" Screen), Go to Ramdisk tab, put device in normal mode and Do step 1 (Get Hello), then Go to Diag option tab change the serial number (FCHP606DG07R), once done go back to Ramdisk tab continue with Step 2 (Inject Hello), the last step is Normal Activation.
Here is a full logs for steps 1-4
[info] Connecting using DFU ...
[info] Installing USB driver for device: "Apple Mobile Device (DFU Mode)" (05AC:1227).
[info] Thread priority before boost is 0x2
[info] Current thread priority is 0xf
[info] stage 1, heap grooming ...
[info] Reset result: Success
[info] stage 2, aquired
[info] stage 3, exploit
[info] Uploading payload
[done] Device is now in pwned DFU Mode! :D
[info] Loading required files ...
[info] Finished loading required files ...
[info] Successfully patched signature checks!
[info] Heap repaired.
[info] Shsh sent (file size:63144 bytes)
[info] iBss sent (file size:1471378 bytes)
[info] iBec sent (file size:1471378 bytes)
[info] Devicetree sent (file size:40461 bytes)
[info] Ramdisk sent (file size:120590612 bytes)
[info] Adc sent (file size:13269959 bytes)
[info] Rdtrust sent (file size:12226 bytes)
[info] Kernel sent (file size:18721200 bytes)
[info] Connecting...
[info] Ramdisk ramdisk tool jun 29 2020 00:18:13 assigned to current device!
[info] Connecting to ramdisk!
[erro] ssh>connecting to 127.0.0.1: Socket error: disconnected
[info] Loading /mnt2
[info] Calling requested function!
[info] Starting sesison!
[info] Disconnecting ...
[info] Connecting ...
[info] ssh_userauth_password
[info] Ramdisk SCPConnection session init required ...
[info] Sending SSH command...
[info] Sending SSH command successfull!
[info] Ramdisk SCPConnection session init completed!
[info] Listing path /mnt2
[info] Disconnecting SSHSession
[info] Finished listing 1 files in 32 dirs
[info] New root loaded: /mnt2
[done] Current root dir: /mnt2
A: Restore Activation, this only restore the activation data
A: Restore Full Dir, restore the data you backuped by yourself
How is work ?
Restore Activation : This is through the software to automatically restore the backup data
Restore Full Dir : this you can holding down"shift" key and select related data folder to restore
Both functions are support manual data restore by holding down the "shift" key to select the relevant data folder
A: This is a data communication error, please put the idevice back into DFU mode again and repeat above steps
A: Usually displayed when Connecting to ramdisk, Generally the software will automatically retry the connection, and start load idevice data directory. by default is mnt2
A: If you can't understand what the data does, it's best not to do it
A: Regarding the backup of activation data, according to the state of the device, Generally, the data structure is as follows: (Data locate at c:/mfc)
A: You need manually update the driver in device manager (Apple Mobile Device(DFU Mode)(libusbK)), locate : C:/MFC/usb_driver , Do not apply wrong driver which can case blue screen
CAUTION:
This tool is only for personal study and research purposes, please do not used for commercial purposes, do not do anything illegal things, otherwise you need take all responsibility.
