As far as i know, ios restore firmware following these steps transfer ios ipsw firmware into iphone. iphone calculate firmware hash, and generate a random number itunes transfer this hash and random number to apple server if this firmware is legal, then return signature. iphone then verify the signature, if OK, flash it into emmc. But i have an question, how does iphone be able to calculate the hash of firmware? since most ios devices only have 1GB memory, and firmware is bigger then 1GB, i think it's impossible for iphone to calculate the whole hash of firmware, right? And another question may be off topic, The lowest level restore method i know is DFU, but DFU is still a software which is in emmc right? what if emmc is erased and empty? Is there any method to flash ios if emmc have nothing?