SILICON GREMLIN™
SYSTEMS / RESTORE RESEARCH JEFFERY KIMBROW · 2026-10-03

Im-mutable State

Im-mutable State title artwork showing the Silicon Gremlin beside a series of illuminated state diagrams.

Two restores using the modified cache failed at checkpoint 0x6B4 with status 1109. A restore using the preserved known-good cache streamed ASR progress through 100 and completed with status 0. The observed outcomes are strongly associated with cache condition; the mechanism remains unresolved.

01 / CONTROLLED RESULT

Two modified-cache failures. One known-good success.

This investigation followed repeated Apple Devices restore attempts ending in error 1109 / 06B4.0000. Earlier event captures had coverage or decoding limitations. This comparison uses updater logs for two modified-cache failures and the later successful restore using the preserved known-good cache.

The selected Erase BuildIdentity SystemVolume member 043-69111-662.dmg.aea was deliberately modified by one bit for Runs 10 and 11; Run 12 used the preserved known-good cache. Both modified-cache restores failed at 0x6B4 with status 1109. The known-good-cache restore logged ASR progress through 100 and completed with status 0. The outcomes are strongly associated with cache condition, while the mechanism remains unresolved.

MODIFIED CACHE · RUNS 10 AND 11
  1. Completed baseband_postseal and fdr_verify_sealed_manifest checkpoints
  2. Entered 0x6B4; operation 13 was logged at progress 0
  3. synchronous CFNetwork requests timed out; retries were exhausted
  4. Updater reported no WKMS authorization token and a decryption-key retrieval error
  5. Restore ended with status 1109 and fingerprint 06B4.0000
PRESERVED KNOWN-GOOD CACHE · RUN 12
  1. Completed the same named baseband and FDR checkpoint receipts
  2. Entered 0x6B4 and logged ASR payload activity
  3. Operation 13 progress was logged through 100
  4. Restore completed with status 0

02 / MATCHED RUNS

The repeated outcome localizes the split.

Runs 10 and 11 used the modified cache. Both reached checkpoint 0x6B4, where operation 13 was logged at progress 0. Their updater logs record synchronous CFNetwork request timeouts, retry exhaustion, no WKMS authorization token, a WKMS decryption-key retrieval error, restore status 1109, and checkpoint fingerprint 06B4.0000.

Run 12 used the preserved known-good cache. The updater logged ASR payload activity and operation 13 progress through 100, then recorded restore completion with status 0. These records establish successful completion of the restore path observed in Run 12.

RUN 10

Modified cache

Entered 0x6B4 at operation 13 progress 0. WKMS token/key path failed after request timeouts. Restore status: 1109; fingerprint: 06B4.0000.

RUN 11

Modified cache

Entered 0x6B4 at operation 13 progress 0. WKMS token/key path failed after request timeouts. Restore status: 1109; fingerprint: 06B4.0000.

RUN 12

Preserved known-good cache

The updater logged ASR payload activity and operation 13 progress through 100. Restore status: 0.

SHARED CHECKPOINT RECEIPTS

Each run records completion of 0x1505 (baseband_postseal) and 0x63D (fdr_verify_sealed_manifest) before entering 0x6B4.

eUICC CHECKS

Parameters 0–2 were reported unchanged in Runs 10 and 11. These lines do not indicate a separate eUICC firmware update.

OUTCOME REPLICATION

The modified cache produced the same reported failure boundary, restore status, and fingerprint in two runs. The preserved known-good cache completed successfully in Run 12.

03 / FIRST OBSERVED DIVERGENCE

ASR payload progress splits before 0x6B4

All three runs log ASR initialization and “Starting to send payload” before checkpoint 0x6B4. In Run 12, the updater logs “Sending payload” and operation 13 progress before 0x6B4 begins; progress continues through 100. In Runs 10 and 11, the selected logs show no subsequent ASR payload-progress entries before 0x6B4 begins at operation 13 progress 0. CFNetwork timeouts occur on both sides of that boundary: Run 11’s first logged timeout precedes 0x6B4, while later timeouts and retry exhaustion follow it; Run 10’s first shown timeout follows entry into 0x6B4. Both modified-cache runs then report no WKMS authorization token and a key-retrieval error. The logs show a different ASR-progress pattern and a repeated WKMS failure, but do not establish which event caused the other or identify the internal mechanism.

MODIFIED CACHE · RUNS 10 AND 11 0x6B4 begins; no progress is logged past 0

Request timeouts precede retry exhaustion, the no-token message, and the WKMS key-retrieval error.

1109
KNOWN-GOOD CACHE · RUN 12 ASR payload streams to completion

The updater logs ASR progress through 100 and restore completion with status 0.

0

The modified-cache logs record synchronous CFNetwork request timeouts, retry exhaustion, “No authorization token available,” and a WKMS decryption-key retrieval error. They establish that sequence but do not show why token acquisition failed or whether the modified representation caused the timeout. The WKMS request schema and token-acquisition mechanism remain unobserved.

04 / LOG EXCERPTS

Selected receipts from the updater logs.

The excerpts preserve the updater’s wording and timestamps. Compare the completed baseband_postseal and fdr_verify_sealed_manifest receipts, entry into 0x6B4, and the two recorded outcomes: timeout and token/key errors in the modified-cache runs, versus ASR payload activity and progress through 100 before status 0 in Run 12. These are selected excerpts, not complete restore transcripts.

RUN 10 / MODIFIED CACHE 
[14:48:02.0798] amai: _AMAuthInstallBasebandCheckForParameterChange: eUICC Param 0 unchanged
[14:48:02.0798] amai: _AMAuthInstallBasebandCheckForParameterChange: eUICC Param 1 unchanged
[14:48:02.0798] amai: _AMAuthInstallBasebandCheckForParameterChange: eUICC Param 2 unchanged
[14:48:56.0964] Completed checkpoint id: 0x1505 (baseband_postseal)
[14:48:56.0965] Completed checkpoint id: 0x63D (fdr_verify_sealed_manifest)
[14:49:00.0552]   Started checkpoint id: 0x6B4 (await_system_image_invert_retry)
[14:49:00.0552] <Restore Device 000001DB083D23F0>: operation 13 progress 0
[14:49:22.0176] amai: _AMSupportHttpMessageSendSyncNoRetry: CFURLConnectionSendSynchronousRequest() error: The request timed out. (kCFErrorDomainCFNetwork -1001)
[14:50:53.0559] amai: _AMSupportHttpMessageSendSyncNoRetry: CFURLConnectionSendSynchronousRequest() error: The request timed out. (kCFErrorDomainCFNetwork -1001)
[14:52:25.0922] amai: _AMSupportHttpMessageSendSyncNoRetry: CFURLConnectionSendSynchronousRequest() error: The request timed out. (kCFErrorDomainCFNetwork -1001)
[14:52:25.0922] amai: _AMSupportHttpMessageSendSyncRetry: !!!!!!!!!!!!!!!!!!!!!!!!!! Retries exhausted on attempt 3 !!!!!!!!!!!!!!!!!!!!!!!!!!
[14:52:25.0948] WKMS: No authorization token available for wkms.sd.apple.com; failing
[14:52:25.0948] CFError domain:AMRestoreErrorDomain code:1109 description:Error retrieving WKMS decryption key
[14:52:30.0961] Restore completed, status: 1109
[14:52:30.0961] Restore Checkpoint Fingerprint: 06B4.0000
RUN 11 / MODIFIED CACHE 
[15:03:03.0543] amai: _AMAuthInstallBasebandCheckForParameterChange: eUICC Param 0 unchanged
[15:03:03.0543] amai: _AMAuthInstallBasebandCheckForParameterChange: eUICC Param 1 unchanged
[15:03:03.0543] amai: _AMAuthInstallBasebandCheckForParameterChange: eUICC Param 2 unchanged
[15:03:52.0620] amai: _AMSupportHttpMessageSendSyncNoRetry: CFURLConnectionSendSynchronousRequest() error: The request timed out. (kCFErrorDomainCFNetwork -1001)
[15:03:57.0694] Completed checkpoint id: 0x1505 (baseband_postseal)
[15:03:57.0696] Completed checkpoint id: 0x63D (fdr_verify_sealed_manifest)
[15:04:01.0282]   Started checkpoint id: 0x6B4 (await_system_image_invert_retry)
[15:04:01.0282] <Restore Device 000001925D4AFDD0>: operation 13 progress 0
[15:05:24.0055] amai: _AMSupportHttpMessageSendSyncNoRetry: CFURLConnectionSendSynchronousRequest() error: The request timed out. (kCFErrorDomainCFNetwork -1001)
[15:06:26.0426] amai: _AMSupportHttpMessageSendSyncNoRetry: CFURLConnectionSendSynchronousRequest() error: The request timed out. (kCFErrorDomainCFNetwork -1001)
[15:06:26.0426] amai: _AMSupportHttpMessageSendSyncRetry: !!!!!!!!!!!!!!!!!!!!!!!!!! Retries exhausted on attempt 3 !!!!!!!!!!!!!!!!!!!!!!!!!!
[15:06:26.0453] WKMS: No authorization token available for wkms.sd.apple.com; failing
[15:06:26.0453] CFError domain:AMRestoreErrorDomain code:1109 description:Error retrieving WKMS decryption key
[15:06:31.0456] Restore completed, status: 1109
[15:06:31.0456] Restore Checkpoint Fingerprint: 06B4.0000
RUN 12 / PRESERVED KNOWN-GOOD CACHE 
[15:32:02.0602] Completed checkpoint id: 0x1505 (baseband_postseal)
[15:32:02.0603] Completed checkpoint id: 0x63D (fdr_verify_sealed_manifest)
[15:32:06.0144]   Started checkpoint id: 0x6B4 (await_system_image_invert_retry)
[15:32:06.0144] <Restore Device 0000017E728215E0>: operation 13 progress 26
[15:32:08.0245] ASR progress: Sending payload
[15:32:09.0105] <Restore Device 0000017E728215E0>: operation 13 progress 28
[15:32:33.0863] <Restore Device 0000017E728215E0>: operation 13 progress 38
[15:35:04.0850] <Restore Device 0000017E728215E0>: operation 13 progress 99
[15:35:07.0376] <Restore Device 0000017E728215E0>: operation 13 progress 100
[15:35:07.0490] ASR progress: Finished
[15:35:11.0456] Completed checkpoint id: 0x6B4 (await_system_image_invert_retry)
[15:35:17.0057] Completed checkpoint id: 0x674 (create_protected_filesystems)
[15:37:40.0139] <Restore Device 0000017E728215E0>: Restore succeeded
[15:37:40.0139] Finished RestoreOS Restore Phase: Successful
[15:37:40.0139] Restore completed, status: 0
WKMS / TOKEN / KEY PATH · RUN 10 
[14:49:22.0176] amai: _AMSupportHttpMessageSendSyncNoRetry: CFURLConnectionSendSynchronousRequest() error: The request timed out. (kCFErrorDomainCFNetwork -1001)
[14:50:53.0559] amai: _AMSupportHttpMessageSendSyncNoRetry: CFURLConnectionSendSynchronousRequest() error: The request timed out. (kCFErrorDomainCFNetwork -1001)
[14:52:25.0922] amai: _AMSupportHttpMessageSendSyncNoRetry: CFURLConnectionSendSynchronousRequest() error: The request timed out. (kCFErrorDomainCFNetwork -1001)
[14:52:25.0922] amai: _AMSupportHttpMessageSendSyncRetry: !!!!!!!!!!!!!!!!!!!!!!!!!! Retries exhausted on attempt 3 !!!!!!!!!!!!!!!!!!!!!!!!!!
[14:52:25.0948] WKMS: No authorization token available for wkms.sd.apple.com; failing
[14:52:25.0948] CFError domain:AMRestoreErrorDomain code:1109 description:Error retrieving WKMS decryption key
[14:52:30.0961] Restore completed, status: 1109
ASR STREAMING / STATUS 0 · RUN 12 
[15:30:56.0070] ASR progress: Sending payload
[15:30:57.0544] <Restore Device 0000017E728215E0>: operation 13 progress 1
[15:32:03.0002] ASR progress: Sending payload
[15:32:04.0166] <Restore Device 0000017E728215E0>: operation 13 progress 26
[15:33:03.0518] ASR progress: Sending payload
[15:33:03.0528] <Restore Device 0000017E728215E0>: operation 13 progress 50
[15:34:06.0683] ASR progress: Sending payload
[15:34:07.0847] <Restore Device 0000017E728215E0>: operation 13 progress 76
[15:35:04.0685] ASR progress: Sending payload
[15:35:04.0850] <Restore Device 0000017E728215E0>: operation 13 progress 99
[15:35:07.0490] ASR progress: Finished
[15:35:11.0456] Completed checkpoint id: 0x6B4 (await_system_image_invert_retry)
[15:37:40.0139] Restore completed, status: 0