[idevicerestore] ERROR: Unable to place device into restore mode

[lolllo1994]

Hello,
I am trying to restore a dead iPad 7th generation 10.2 using this tool because currently my iPad is locked into a bootloop showing Apple logo.

When I try to restore it using iTunes it shows error 4013.

I installed the necessary libraries and commands and they are all updated to the latest versions.

When I launch the command

sudo idevicerestore --latest --debug

I receive this output:

Accept: */*

* old SSL session ID is stale, removing
< HTTP/2 200 
< date: Sun, 12 Nov 2023 17:35:49 GMT
< content-type: application/json
< vary: Accept-Encoding
< vary: Origin
< access-control-allow-origin: *
< access-control-expose-headers: X-Data-Location, X-Server-Location
< cache-control: public, max-age=14400
< content-md5: TKDv3UnxlreFo32hK3r+Bg==
< content-security-policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'
< expires: Sun, 12 Nov 2023 17:51:24 GMT
< x-content-type-options: nosniff
< x-data-location: database
< x-frame-options: DENY
< x-frame-options: DENY
< x-server-location: 7d0155e454dd
< x-xss-protection: 1; mode=block
< strict-transport-security: max-age=15552000; preload
< last-modified: Sun, 12 Nov 2023 16:51:24 GMT
< cf-cache-status: HIT
< age: 1826
< report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s= {HIDDEN}"}],"group":"cf-nel","max_age":604800}
< nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
< server: cloudflare
< cf-ray: 825088a06964bb05-MXP
< alt-svc: h3=":443"; ma=86400
< 
* Connection #0 to host api.ipsw.me left intact
The following firmwares are currently being signed for iPad7,11:
  [1] 17.1.1 (build 21B91)
  [2] 17.1 (build 21B74)
Select the firmware you want to restore: 1
Selected firmware 17.1.1 (build 21B91)
Verifying 'iPad_10.2_17.1.1_21B91_Restore.ipsw'...
Checksum matches.
Extracting BuildManifest from IPSW
Product Version: 17.1.1
Product Build: 21B91 Major: 21
opening device 05ac:1281 @ 0x01100000...
Setting to configuration 1
Setting to interface 0:0
INFO: device serial number is {HIDDEN}
Device supports Image4: true
Variant: Customer Upgrade Install (IPSW)
This restore will update your device without erasing user data.
Checking IPSW for required components...
All required components found in IPSW
Using cached filesystem from 'iPad_10.2_17.1.1_21B91_Restore/087-51619-002.dmg'
Getting device's ECID for TSS request
Found ECID 93828822
Getting ApNonce in recovery mode...  {HIDDEN}
Trying to fetch new SHSH blob
Getting SepNonce in recovery mode...  {HIDDEN}
NOTE: Unable to find BbChipID node
NOTE: Unable to find BbProvisioningManifestKeyHash node
NOTE: Unable to find BbActivationManifestKeyHash node
NOTE: Unable to find BbCalibrationManifestKeyHash node
NOTE: Unable to find BbFactoryActivationManifestKeyHash node
NOTE: Unable to find BbFDRSecurityKeyHash node
NOTE: Unable to find BbSkeyId node
DEBUG: Applying restore request rules for entry AOP
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry AVE
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry Ap,SystemVolumeCanonicalMetadata
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry AppleLogo
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryCharging0
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryCharging1
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryFull
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryLow0
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryLow1
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry BatteryPlugin
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry Cryptex1,AppOS
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry Cryptex1,AppTrustCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry Cryptex1,AppVolume
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry Cryptex1,SystemOS
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry Cryptex1,SystemTrustCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry Cryptex1,SystemVolume
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry DeviceTree
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry KernelCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry LLB
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry Multitouch
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry OS
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RecoveryMode
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreDeviceTree
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreKernelCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreLogo
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreRamDisk
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreSEP
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Applying restore request rules for entry RestoreTrustCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry SEP
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Applying restore request rules for entry StaticTrustCache
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry SystemVolume
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry ftap
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: No Digest data, using empty value for entry ftap
DEBUG: Applying restore request rules for entry ftsp
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Adding EPRO=true to TSS entry
DEBUG: No Digest data, using empty value for entry ftsp
DEBUG: Applying restore request rules for entry iBEC
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry iBSS
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry iBoot
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Applying restore request rules for entry rfta
DEBUG: Adding EPRO=true to TSS entry
DEBUG: Adding ESEC=true to TSS entry
DEBUG: No Digest data, using empty value for entry rfta
DEBUG: Applying restore request rules for entry rfts
DEBUG: Adding ESEC=true to TSS entry
DEBUG: Adding EPRO=true to TSS entry
DEBUG: No Digest data, using empty value for entry rfts
common.c:printing 9971 bytes plist:
<plist version="1.0">
<dict>
	{PART OF THE RESPONSE}
	<key>iBEC</key>
	<dict>
		<key>BuildString</key>
		<string>iBoot-10151.42.2~50</string>
		<key>Digest</key>
		<data>
		 {HIDDEN}
		</data>
		<key>Trusted</key>
		<true/>
		<key>EPRO</key>
		<true/>
		<key>ESEC</key>
		<true/>
	</dict>
	<key>iBSS</key>
	<dict>
		<key>BuildString</key>
		<string>iBoot-10151.42.2~50</string>
		<key>Digest</key>
		<data>
		 {HIDDEN}
		</data>
		<key>Trusted</key>
		<true/>
		<key>EPRO</key>
		<true/>
		<key>ESEC</key>
		<true/>
	</dict>
	<key>iBoot</key>
	<dict>
		<key>Digest</key>
		<data>
		 {HIDDEN}
		</data>
		<key>Trusted</key>
		<true/>
		<key>EPRO</key>
		<true/>
		<key>ESEC</key>
		<true/>
	</dict>
	<key>rfta</key>
	<dict>
		<key>Trusted</key>
		<true/>
		<key>EPRO</key>
		<true/>
		<key>ESEC</key>
		<true/>
		<key>Digest</key>
		<data>
		</data>
	</dict>
	<key>rfts</key>
	<dict>
		<key>Trusted</key>
		<true/>
		<key>ESEC</key>
		<true/>
		<key>EPRO</key>
		<true/>
		<key>Digest</key>
		<data>
		</data>
	</dict>
	<key>ApNonce</key>
	<data>
	 {HIDDEN}
	</data>
	<key>@ApImg4Ticket</key>
	<true/>
	<key>ApSecurityMode</key>
	<true/>
	<key>ApProductionMode</key>
	<true/>
	<key>SepNonce</key>
	<data>
	 {HIDDEN}
	</data>
</dict>
</plist>
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
common.c:printing 9707 bytes plist:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>@ServerVersion</key>
	<string>2.1.0</string>
	<key>ApImg4Ticket</key>
	<data>
	 {HIDDEN}
	</data>
</dict>
</plist>
Received SHSH blobs
DEBUG: tss_response_get_path_by_entry: No entry 'iBEC' in TSS response
NOTE: No path for component iBEC in TSS, will fetch from build_identity
Extracting iBEC.ipad7c.RELEASE.im4p...
Personalizing IMG4 component iBEC...
Tag found
Sending iBEC (570239 bytes)...
**_Waiting for device to disconnect...
irecv_event_cb: device {HIDDEN} (udid: N/A) disconnected
Waiting for device to reconnect in recovery mode...
irecv_event_cb: device {HIDDEN} (udid: N/A) connected in Recovery mode_**
opening device 05ac:1281 @ 0x01100000...
Setting to configuration 1
Setting to interface 0:0
Recovery Mode Environment:
iBoot build-version=iBoot-10151.2.12
iBoot build-style=RELEASE
Sending RestoreLogo...
DEBUG: tss_response_get_path_by_entry: No entry 'RestoreLogo' in TSS response
NOTE: No path for component RestoreLogo in TSS, will fetch from build_identity
Extracting applelogo@2160~ipad.im4p...
Personalizing IMG4 component RestoreLogo...
Tag found
Sending RestoreLogo (28461 bytes)...
DEBUG: AVE is loaded by iBoot.
DEBUG: tss_response_get_path_by_entry: No entry 'AVE' in TSS response
NOTE: No path for component AVE in TSS, will fetch from build_identity
Extracting AppleAVE2FW_H9.im4p...
Personalizing IMG4 component AVE...
Tag found
Sending AVE (1100862 bytes)...
DEBUG: RestoreTrustCache is loaded by iBoot.
DEBUG: tss_response_get_path_by_entry: No entry 'RestoreTrustCache' in TSS response
NOTE: No path for component RestoreTrustCache in TSS, will fetch from build_identity
Extracting 087-51653-002.dmg.trustcache...
Personalizing IMG4 component RestoreTrustCache...
Tag found
Sending RestoreTrustCache (12911 bytes)...
ramdisk-size=0x20000000
DEBUG: tss_response_get_path_by_entry: No entry 'RestoreRamDisk' in TSS response
NOTE: No path for component RestoreRamDisk in TSS, will fetch from build_identity
Extracting 087-51653-002.dmg...
Personalizing IMG4 component RestoreRamDisk...
Tag found
Sending RestoreRamDisk (121641725 bytes)...
DEBUG: tss_response_get_path_by_entry: No entry 'RestoreDeviceTree' in TSS response
NOTE: No path for component RestoreDeviceTree in TSS, will fetch from build_identity
Extracting DeviceTree.j171ap.im4p...
Personalizing IMG4 component RestoreDeviceTree...
Tag found
Sending RestoreDeviceTree (40366 bytes)...
DEBUG: tss_response_get_path_by_entry: No entry 'RestoreKernelCache' in TSS response
NOTE: No path for component RestoreKernelCache in TSS, will fetch from build_identity
Extracting kernelcache.release.ipad7c...
Personalizing IMG4 component RestoreKernelCache...
Tag found
Sending RestoreKernelCache (15757074 bytes)...
_DEBUG: Waiting for device to disconnect...
ERROR: Failed to place device in restore mode
ERROR: Unable to place device into restore mode_

There are several problems into my executions:

• After Sending iBEC (570239 bytes)...) the tool waits for a restart of the iPad and then it waits for Recovery Mode. In my case, I have to manually reboot the iPad in order to go to recovery mode after restarting because of the timeout set in the executable; this is not a problem because I solved it by manually restarting in DFU before 10 seconds of timeout but I prefer to say to add details;
• In the last 4 rows of the output, it waits for the device to disconnect in order to send it in Restore mode. Unfortunately, I've not found any manual solution to this problem. Even if I restart manually the device, it restarts, shows the Apple Logo for 2 seconds and it turns back to DFU mode.

Do you have any suggestions on how to solve the problem?

My environment is this:
. MacOS Sonoma 14.0
. idevicerestore 1.0.0
. usbmuxd 1.1.1 (launched as service on startup)

Using irecovery, I can also set auto-boot flag to true to exit DFU mode and go back to the bootloop but only when idevicerestore is not running.

Thanks in advance for your answer!

[My1]

same issue here, Kubuntu 22.04