DFU Mode

DFU or Device Firmware Upgrade mode allows all devices to be restored from any state. It is essentially a mode where the BootROM can accept iBSS. DFU is burned into the hardware, so it cannot be removed. On A7+ devices, it generates an ApNonce and recognizes APTickets as well, so even in DFU, it can accept an APTicket.

Entering DFU Mode

Apple TV

1. Plug the device into your computer using a Micro-USB cable.
2. Force the device to reboot by holding down the "Menu" and "Down" buttons simultaneously for 6-7 seconds.
3. Press "Menu" and "Play" simultaneously right after reboot, until a message pops up in iTunes, saying that it has detected an Apple TV in Recovery Mode.

iPad/iPhone/iPod touch

These instructions are adapted from Apple's iOS Security Guide:

1. Connect the device to a computer using a USB cable.
2. Hold down both the Home and Sleep/Wake buttons.
   • If your device does not have a physical Home button, use the Volume Down button instead.
3. After 8 seconds, release the Sleep/Wake button while continuing to hold down the Home button.
   • If the Apple logo appears, the Sleep/Wake button was held down too long.
4. Nothing will be displayed on the screen when the device is in DFU mode. If open, iTunes will alert you that a device was detected in recovery mode.
   • If your device shows a screen telling you to connect the device to iTunes, retry these steps.

Exiting DFU Mode

To exit DFU Mode, simply reboot your device.

• For Apple TV, hold down the "Menu" and "Down" buttons on your remote until the Apple TV reboots.
• For iPad/iPhone/iPod touch, hold the Home and Sleep/Wake buttons until the device reboots.
  • If your device does not have a physical Home button, use the Volume Down button instead.

Enter True Hardware DFU Mode Automatically

The EnterDFU function in the MobileDevice Library does not enter the true DFU Mode in the hardware. It's possible to enter the true DFU Mode without doing it manually, but it cannot be exited unless a restore is performed, as it creates a DFU Loop. This doesn't work with S5L8900 devices.

Steps

1. Make a copy of a fresh IPSW file.
2. Open the IPSW as a zip folder and browse to /firmware/all_flash/all_flash.xxxxx.production/
3. Extract LLB.*****.RELEASE.img3/im4p and open it in a hex editor.
4. Change some random bit or bits, it doesn't matter which or what you write.
5. Add the edited file back to the zip, rename zip to ipsw and restore it to your device using iTunes.
6. The restore will error out and your device will be in DFU Mode.

Alternative Method

If the previous method does not work for you, try this one.

1. Do steps 1 and 2 from above.
2. Delete LLB.*****.RELEASE.img3.
3. Copy applelogo.********.img3 to temporary directory.
4. Rename the copy of applelogo.********.img3/im4p to LLB.*****.RELEASE.img3/im4p. (If you forget the name of the LLB file, you can find it again in the file named manifest.)
5. Copy the renamed applelogo file back to the all_flash.xxxxx.production directory.
6. Rename the zip.
7. Restore the file using iTunes. (If every thing goes well, you should receive an error 31 from iTunes.)

DFU Mode Output to the computer

iProduct: "Apple Mobile Device (DFU Mode)"

iSerialNumber: "CPID:XXXX CPRV:15 CPFM:03 SCEP:03 BDID:00 ECID:XXXXXXXXXXXXXXXX SRTG:[iBoot-XXX.X.X]"

Revisions

S5L8900 (0x1222)

This is the device ID in the iPod touch, the iPhone, and the iPhone 3G. For more information about the protocol, see DFU 0x1222.

S5L8720, S5L8920, and WTF mode post-2.0 (0x1227)

This is the device ID in the iPod touch (2nd generation), the iPhone 3GS, the iPhone 4, subsequent 32 bit devices, all 64 bit devices, and WTF mode. For more information on the protocol, see DFU 0x1227.