Dienstag, 10. Januar 2017

BasebandGoldCertID not found, please spam tihmstar!

Hello everyone,
i've been writing a few blogposts lately, which were really fun and i think i can get used to this :D

Today's topic is tsschecker's BasebandGoldCertID (or short bbgcid).
You might have see this warning in tsschecker already:
Version: 211220dfa58e15d9f15c08a9185b53acadc489de - 182
[TSSC] opening firmware.json
[JSON] counting elements
[JSON] parsing elements
[TSSC] selecting latest iOS: 10.2
[TSSC] using cached Buildmanifest for iPad3,5_10.2
[Error] [TSSC] ERROR: device "iPad3,5" is not in bbgcid.json, which means it's BasebandGoldCertID isn't documented yet.
If you own such a device please consider contacting @tihmstar to get instructions how to contribute to this project.
[WARNING] [TSSR] there was an error getting BasebandGoldCertID, continuing without requesting Baseband ticket
[TSSR] Request URL set to https://gs.apple.com/TSS/controller?action=2
[TSSR] Sending TSS request attempt 1... success

iOS 10.2 for device iPad3,5 IS being signed!

ERROR: device is not in bbgcid.json, it's BasebandGoldCertID isn't documented yet.
So what exactly does this mean?
Again, tsschecker started as a project to analyse apple's tss server. You can send customized requests and see what it responds. Beside APTickets for the main iOS system you also have the baseband.
The baseband is a seperate processor, which has it's own OS. One of it's main tasks is to handle cellular communication like GSM, LTE and stuff like that (note i'm not an expert about baseband).
So basically you have basebands in phone and also in iPads which have 3G or LTE or whatever.
When restoring such a device you also need to restore the baseband, which has it's own seperate restore process. It also uses stuff like APTickets which need to be requested from apple while restoring (i really haven't looked into how this exactly works, these are just general observations).
So we note here: when restoring we also need a ticket for the baseband.

Tsschecker is able to request such tickets even though there are not many customizations yet.

Does that mean i can save a basebandticket?
Yes, you can save a baseband ticket if you want.
So it works as following:
When requesting a baseband ticket you need to send a bunch of values for apple. I figured out that most of these values can either be random, or omitted completely. All except the BasebandGoldCertID. This one has to be a device specifiy value matching the devicemodel.
For example if you want to get a ticket for the iPhone6,2 baseband you need to send the BasebandGoldCertID 3554301762. This is the same for all iPhone6,2 models. If you don't send this exact value for the iPhone6,2 you don't get a ticket.
Normally when you restore a device using iTunes or idevicerestore that value is read from device while restoring, that's why a central database was never needed.
But tsschecker aims to send requests to apple's server without the need of having a real device connected (thus the name "tss checker").
So this is the reason i started to collect BasebandGoldCertIDs.

Cool, does that mean i can downgrade basebande?
No, unlike iOS a downgrade is not possible. This is because the baseband all this ticket and restoring and signing stuff and i don't know of anybody actively looking into it and especially actively working on a downgrade. In theory you can find bugs or something like prometheus in the baseband but right now there isn't any public tool able to downgrade the baseband (correct me if i'm wrong) and also i don't know anyone working on that.

So what are the tickets even used for if i can't downgrade?
Literally nothing. I don't even know if the tickets we are saving right now can be used for downgrades in future or if there's something important i left out/didn't notice. Again, i haven't really looked into baseband.

So why even requesting tickets?
Well the initial idea of this is just to see if the baseband of a specific iOS verison is signed or not (remember "tss checker"? :P).
Right now this feature is used in futurerestore to see if a baseband is really signed before attempting to restore a baseband which was not shipped with the version being restored. (That cool iOS/baseband mismatch thing allowing to downgrade with prometheus)

When i started tsschecker i didn't know this tool would be that popular. I thought i should ask everybody who even cared using this tool to help me collecting bbgcids, but right now i get spammed with emails. This is why i decided to write this blogpost to exaplain what this is all about.

Ok i see. I have a device, which you don't have in your list, how can i help?
Finally the good part :P
Ok so basically you need to take your device and read out the BasebandGoldCertID and send me an email containig the devicemodel and the bbgcid. Then i can put that to tsschecker. You can even make a pullrequest on github with your bbgcid. If you can, please test if you get a ticket before submitting the bbgcid. If you run tsschecker with --no-baseband=2 then it will try to request only a baseband ticket.

How to find BasebandGoldCertID?
There are two easy ways of finding it. The first one is with ideviceinfo:

The second is with latest redsn0w, which you can get here: http://blog.iphone-dev.org/tagged/redsn0w
Make sure to use the "normal" version, not the beta.
Then you click Extras->Even more->Identify

So let's go and collect all BasebandGoldCertIDs



  1. I sent my iPad5,4 bbgcid via email several days ago, but heard no reply.
    So I wrote it here:

    "iPad5,4" should be 3840149528.
    Also, I believe the iOS devices published in recent 2~3 years should have the same BasebandGoldCertID, because these devices have the same LTE/3G/2G hardware capabilities.

    By the way, besides bbgcid, I think the devices' "RegionInfo" (two or one character with /A in the end) should also affect the baseband ticket you received from apple.
    (Well it's a long story, so I will explain this if you want to listen)

  2. Thanks, added that to tsschecker.

    Finding out more about baseband would be cool, but unfortunatelly i'm flooded with other stuff atm :(
    Though if you want to contribute to tsschecker it'd be cool if you make some pull requests.
    I don't want to add stuff on my own if i haven't really looked into it, so as of right now i won't change RegionInfo.
    But thank you for this information :)

  3. iPhone9,3 - 1421084145
    iPad4,5 - 3554301762


  5. IPHONE 9,2 is 1421084145 THANK YOU VERY WELL

  6. ipad 4,2 BasebandCertId: 3554301762

  7. Tihmstar can you PLEASE add the iPad mini 4 (iPad5,2) to the database!!! I messaged you 2x a couple weeks ago, and now I am trying it again and still getting the BBGoldID error. BaseBandCertId: 3840149528

  8. tihm can u plz add iPad 5,2 A1550 Mini 4 cellular with BaseBandCertId: 3840149528 would really appreciate it!! Thanks!!

  9. Dieser Kommentar wurde vom Autor entfernt.

  10. Iphone 9,2 7plus 32gb baseband id 2315222105

  11. IPhone9,2 7+ 128gb cert I'd - 2315222105

  12. Dieser Kommentar wurde vom Autor entfernt.

  13. Tim can you please add iPhone 7 plus
    BasebandCertId: 2315222105

  14. Blue waffle Disease is a mythical sexually transmitted disease that is believed to have sprouted out of the female genitalia
    blue waffles

  15. iPhone9,2
    BasebandGoldCertId: 1421084145

  16. iPhone9,4 (iPhone 7 Plus): 1421084145
    iPhone5,1 (iPhone 5): 3255536192

  17. Dieser Kommentar wurde vom Autor entfernt.

  18. iPhone9,2(iPhone7PlusRED) - BasebandGoldCertId: 2315222105

  19. BasebandCertId: 2315222105
    ProductType: iPhone10,2

  20. Maybe a little late, but here is one more.
    BasebandCertId: 165673526
    ProductType: iPhone11,6

  21. Hi I sent you an email with my bbgcid, trying to save 12.1.1 b3 blobs before they stop signing it

  22. Nice blog..! I really loved reading through this article. Thanks for sharing such a amazing post with us and keep blogging... best angularjs training institute in chennai | angularjs training in omr | angular 4 training in chennai | angularjs training in omr

  23. Great post! This is very useful for me and gain more information, Thanks for sharing with us.


  24. nice post...

    Web Solution Centre is a creative digital agency working relentlessly to deliver unique and visually appealing experiences in the form of websites and web applications. We strive to deliver products that can bring value to the brands and exponentially help them bring positive ROIs. We build websites and apps that connect brands to their customers. Driving leads and business through our build websites is what we aim our clients to achieve. The web architects here at Web Solution Centre think no different and that’s what motivates us to always put forth an error free and stellar product.

  25. Are you facing a deadline for finishing the essay? Well, your anxieties end here. We have with us a team of essay writing services in australia and management assignment help for australia students who can solve all your writing issues so that you score high grades in your essay assignment.

  26. Thank You for providing us with such an insightful information related to water purifiers in india . If someone is still confused about which water purifier to choose from the top choicest options available in the market then go through the following blog https://bit.ly/2ZzKNdy by your mini Google Right Selects and get all your queries related to top water purifiers in India.

  27. Thank You Author!!! You are sharing the very informative and great post. If anyone out there is looking to book Delhi to Manali Package then don’t go beyond Indian Travel Store – “Your Trusted Partner in your Travel Journey.”


  28. Thanks for your sharing! The information your share is very useful to me and many people are looking for them just like me!if you are looking seo services then click here.
    seo company india
    seo services in india

  29. Thanks for the great article and post. Need a Industrial UPS? Don’t go beyond nexusups. 10 kva online ups which offers an extensive range of exceptional Industrial UPS, and Online UPS Free to contact.

  30. Wow!!! This was a well written article and helped me a lot in gaining information related to Silver Service Taxi.Silver Service Cabs is here to help people with their best in class silver service taxi. So, connect with us for booking the most secured & luxurious silver service cab melbourne.Great Content with Very Useful Information about Silver Service Taxi!!! Good Work Author…

  31. Wow!!! A great insightful & informative content on ACP Board. Virgo Group is the largest providers of best in class leading facade materials and more & having years of experience in manufacturing Premium ACP Sheets. We aim to deliver excellence and ensure maximum worth for our clients’ money and so we provide you with the best ACP Sheet Price.