$ git clone https://github.com/axi0mX/ipwndfu
$ cd ipwndfu

$ ./ipwndfu
USAGE: ipwndfu [options]
Interact with an iOS device in DFU Mode.

Basic options:
  -p                            USB exploit for pwned DFU Mode
  -x                            install alloc8 exploit to NOR
  -f file                       send file to device in DFU Mode
Advanced options:
  --demote                      demote device to enable JTAG
  --dump=address,length         dump memory to stdout
  --hexdump=address,length      hexdump memory to stdout
  --dump-rom                    dump SecureROM
  --dump-nor=file               dump NOR to file
  --flash-nor=file              flash NOR (header and firmware only) from file
  --24kpwn                      install 24Kpwn exploit to NOR
  --remove-24kpwn               remove 24Kpwn exploit from NOR
  --remove-alloc8               remove alloc8 exploit from NOR
  --decrypt-gid=hexdata         AES decrypt with GID key
  --encrypt-gid=hexdata         AES encrypt with GID key
  --decrypt-uid=hexdata         AES decrypt with UID key
  --encrypt-uid=hexdata         AES encrypt with UID key

$ ./ipwndfu -p
Found: CPID:8960 CPRV:11 CPFM:03 SCEP:01 BDID:00 ECID:XXXXXXXXX IBFL:1C SRTG:[iBoot-1704.10] PWND:[checkm8]
Device is now in pwned DFU Mode.

$ ./ipwndfu --dump-rom
Saved: SecureROM-XXXXXXX-XXXXXXX-RELEASE.dump
# ここでdumpしたものはネットにuploadしないように大切に保管しましょう

$ ./ipwndfu --decrypt-gid KEYBAG
Decrypting with XXXXXXX GID key.

$ ./ipwndfu --demote
Demotion register: 0xXXXXXXXX
Attempting to demote device.
Demotion register: 0xXXXXXXXX
Success!