- iboot patch
./img4 -i iBoot.im4p -o iBoot -k <ivkey>
./iBoot64Patcher iBoot iBoot_p1 -b "serial=3"
./iBootpatch2 [--t8015/--t8010] iBoot_p1 iBoot_p2
./img4 -i iBoot_p2 -o iBoot.img4 -M IM4M -A -T ibss
- boot
./gaster pwn
./irecovery -f iBoot.img4
./irecovery -s
> dorwx
> /upload [payload_t8015.bin/payload_t8010.bin]
> go
> go boot