iPod Touch 3 stuck in a bootloop after updating to 6.1.6 with Legacy-iOS-Kit

[ScorbunnyEar]

It worked for me before on the same iPod Touch 3 before iPad 1 support was added but now I can't get it to work anymore. I've tried restoring to 5.1.1 and clearing NVRAM multiple times with the same results.
https://github.com/user-attachments/assets/b293daff-b431-426b-b3f0-ff699b3693db

[NyanSatan]

Yea, looks like a panic in iBoot indeed

Can you try using some pre-iPad version to see if it works then?

[ScorbunnyEar]

I don't know how I could get a pre-iPad version working on linux since I can't downgrade Legacy-iOS-Kit to an older version.

[bronley]

Same issue on my iPad 1 here. I also tried to restore to 5.1.1 with nvram reset and then restore back to 6.1.3.
I use Sundance on my M2 MacBook Air with macOS 26.2. Restore is successful with no errors in the console.
Apple logo appears briefly, then my iPad reboots.

[NyanSatan]

Damn, this is bad. And the worst part is that I don't even know how to debug such issues remotely

iBoot panic log would be very handy for sure, but to capture it one would need a 30-pin UART cable, which is a pretty rare thing to have for most people

[bronley]

Can I purchase or make one?
I have one spare USB-A to 30pin cable, one raspberry pico and one soldering iron at home. Not sure if it's that simple, but let me know if it's realistic for me to do something.

[bronley]

nvm I ordered one. See you again in "10-30 days"

[NyanSatan]

Can I purchase or make one?
I have one spare USB-A to 30pin cable, one raspberry pico and one soldering iron at home. Not sure if it's that simple, but let me know if it's realistic for me to do something.

Making one is doable, yes. UART is just coming out of certain pins of the 30-pin port. You wire them to a FT232 or something and then you have it (your Raspberry Pi Pico should be able to do that as well)

The problem is to reach those pins. There are breakout boards, but I assume they are also not something too common to have

On the other hand, on some 3rd-party cables you can kinda detach plug's pins and put them in a different spot thus reaching arbitrary pins. I did exactly that at some point

[bronley]

I'm coming back to you if I figure it out, thanks for your explanation 🙏
I'm going to be glad if I could help to improve something in your project, so I hope I will be able to dump those logs.

[bronley]

Okay, I got the cable, spent 1 hour figuring out how to dump iBoot logs, I didn't know about debug-uarts env. I flashed the same 6.1.3 built with Sundance.
aaand.... Everything worked as it should this time. I have an iPad 1 on 6.1.3
I tried resetting NVRAM, flashing 5.1.1 again and 6.1.3 again, tried to rebuild with -j and without, it just works.
I'm going to try to do the same on an Apple M4 machine, but it's goint to be a bummer if I can't reproduce it again :(

[bronley]

The only things, that are different is the last update of macOS Tahoe and the newer version of Legacy-iOS-kit, which I use to enter pwndfu mode. I'm also going to try to revert the Legacy-iOS-kit.

Update: M4 machine with Legacy-iOS-kit v26.02.21 did the restore fine

[NyanSatan]

Damn, what an irony...

However there is something suspicious here. You say you had to set debug-uarts yourself. But IIRC my post-restore code already does it. Perhaps, it's something that fails in there sometimes...