If you are into jailbreaking your iOS devices such as iPhone, iPad, Apple TV and iPod touch, you are often asked to save the SHSH blob or SHSH2 blob (on iOS 10 onwards) of the iOS devices for the purpose of allowing future downgrading of iOS software. This is because once Apple stops signing and issuing signatures for old iOS firmware, which effectively disallows installation of older iOS versions except the most current iOS version.
SHSH blob is a 1024-bit (0x80 bytes) RSA signature that is part of Apple’s digital signature protocol for iOS restores and updates, designed to control the iOS versions that can be installed on iOS devices such as iPhones, iPads, iPod touches, and Apple TVs. SHSH blob is generated by Apple based on hardware keys of the device and the hash of the firmware. While Apple not issues digital signature for old iOS firmware software, but if you have saved the signature for the old iOS version, you may be able to use a replay attack to restore that officially unsigned version.
Thus, many jailbreakers save the SHSH blob and/or SHSH2 blob for iOS versions that have jailbreak tools available, allowing them to downgrade (or upgrade) to jailbreak-friendly iOS software in future.
This tutorial shows you how to save and backup the SHSH2 blob of iOS device, including iPhone, iPad, iPod touch and Apple TV.
Get the ECID of iPhone, iPad, Apple TV and iPod touch
- Connect the device to the computer.
- Run iTunes on the computer.
- Navigate to the Summary tab for the iOS device in iTunes.
- Click on the serial number until it changes to show the ECID.
- Right click on the ECID number and select Copy, or hit the Edit in the menu bar, and then select Copy ECID.
Get the Model Identifier of iPhone, iPad, Apple TV and iPod touch
Depending on the tool you used to save SHSH blob, you may not need to know the model identifier (where you just need to know the model of iOS device – the same model of iOS device has the same model identifier).
To know the model identifier of iOS device, repeat steps above for ECID, but keep clicking until the Model Identifier is shown.
Get the Board Configuration / Internal Name / Internal Model of iPhone, iPad, Apple TV and iPod touch
Note: This step is required only for iPhone 6S, iPhone 6S Plus and iPhone SE
- Download and install Battery Memory System Status Monitor (BMSSM) from the App Store onto the device that you want to save the SHSH2 blob.
- Open the BMSSM.
- Tap on the System tab.
- Record the value for Model under the “System”.
Save SHSH2 Blobs With Online TSS Saver
TSS Saver is a online SHSH2 Blobs Saver based on tsschecker developed by Tihmstar., a tool to check TSS signing status of various devices and firmware.
- Visit the following URL:
- Enter the ECID (Hex format by default if copied from iTunes, Dec format if you used UDID Calculator), Identifier (the iOS device model), and optionally Internal Name/Model | Board Configuration (only for iPhone 6S, iPhone 6S Plus and iPhone SE).
- Confirm that you are not a robot by ticking the I’m not a robot checkbox and complete the verification required.
- Click or tap on Submit button.
- Wait for a few seconds, and the website will redirect you to a page with message “Done saving ECID!”, and a link to download and save the .shsh2 blob files of the device.
- Following the links to download the saved .shsh2 blobs.
TSS Saver will also automatically save the .shsh2 blob for any new iOS version Apple releases in the future, saving you all the hassle to re-entering all the details.