Skip to content

cfw_install: handle pre-decrypted DMGs from restore_offline#334

Open
renegadelink wants to merge 1 commit into
Lakr233:mainfrom
renegadelink:fix/cfw-install-aea-magic-check
Open

cfw_install: handle pre-decrypted DMGs from restore_offline#334
renegadelink wants to merge 1 commit into
Lakr233:mainfrom
renegadelink:fix/cfw-install-aea-magic-check

Conversation

@renegadelink
Copy link
Copy Markdown
Contributor

Summary

make restore_offline (added in #311) decrypts .dmg.aea cryptex
images in place — it mvs the decrypted DMG back over the original
.aea filename so the BuildManifest path keeps working. However,
cfw_install.sh and cfw_install_dev.sh then unconditionally call
ipsw fw aea --key on that same path, which fails because the file
no longer has the AEA1 magic:

⨯ failed to parse AEA: invalid AEA header: found '...' expected 'AEA1'

This patch checks the first 4 bytes for the AEA1 magic before
invoking ipsw fw aea / aea decrypt. When the file is already a
raw DMG (post-restore_offline), it's copied straight to the cached
CryptexSystemOS.dmg instead.

Repro

  1. make restore_offline (decrypts AEA images in place)
  2. make cfw_install_jb (or cfw_install / cfw_install_dev)
  3. Fails at the "Extracting AEA key..." step

🤖 Generated with Claude Code

restore_offline (Makefile) decrypts .dmg.aea files in place and mv's
the decrypted DMG back over the original .aea path. Subsequent runs of
cfw_install.sh / cfw_install_dev.sh then call `ipsw fw aea --key` on a
file that no longer has the AEA1 magic and abort with:

    failed to parse AEA: invalid AEA header: found '...' expected 'AEA1'

Check for the AEA1 magic first; copy the file straight to the cached
CryptexSystemOS.dmg when it's already a raw DMG.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@zqxwce
Copy link
Copy Markdown
Collaborator

zqxwce commented May 18, 2026

nice!, once I get some time to test it and verify it works and there are no regressions I will merge this

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adjusts Cryptex SystemOS handling in the CFW install scripts to support make restore_offline, which may leave the BuildManifest cryptex path pointing at an already-decrypted raw DMG (still named *.aea) rather than an AEA container.

Changes:

  • Detects whether the SystemOS image starts with the AEA1 magic before running ipsw fw aea --key / aea decrypt.
  • If the image is not AEA1, treats it as already-decrypted and copies it directly to the cached CryptexSystemOS.dmg.
  • Applies the same logic to both cfw_install.sh and cfw_install_dev.sh.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
scripts/cfw_install.sh Gate AEA key extraction/decryption on AEA1 header; copy-through when the image is already a DMG.
scripts/cfw_install_dev.sh Mirrors the same AEA1 header check and DMG copy-through behavior for the dev installer flow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread scripts/cfw_install.sh
echo " key: $AEA_KEY"
echo " Decrypting SystemOS..."
aea decrypt -i "$RESTORE_DIR/$CRYPTEX_SYSOS" -o "$SYSOS_DMG" -key-value "$AEA_KEY"
if [[ "$(xxd -l 4 -p "$RESTORE_DIR/$CRYPTEX_SYSOS")" == "41454131" ]]; then
Comment on lines 248 to +251
if [[ ! -f "$SYSOS_DMG" ]]; then
echo " Extracting AEA key..."
AEA_KEY=$(ipsw fw aea --key "$RESTORE_DIR/$CRYPTEX_SYSOS")
echo " key: $AEA_KEY"
echo " Decrypting SystemOS..."
aea decrypt -i "$RESTORE_DIR/$CRYPTEX_SYSOS" -o "$SYSOS_DMG" -key-value "$AEA_KEY"
if [[ "$(xxd -l 4 -p "$RESTORE_DIR/$CRYPTEX_SYSOS")" == "41454131" ]]; then
echo " Extracting AEA key..."
AEA_KEY=$(ipsw fw aea --key "$RESTORE_DIR/$CRYPTEX_SYSOS")
@zqxwce
Copy link
Copy Markdown
Collaborator

zqxwce commented May 24, 2026

sorry for taking a long time to review and test this, I am still working on the 26.4 fix, so I didn't have time to yet

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants