use vfdecrypt instead of img4tool
open iphone4sKEYS and copy the key for the rootfs now open vfdecrypt in terminal and type -
./vfdecrypt -i (encrypted DMG file) -k (677d05afbb9a1eaa5f5e353829df15c4a5a6a2f7c2f354dadbff11e4aad7e97bf8f9275d) -o (output DMG to location and make sure to name decryted file)
keys are also posted at https://theiphonewifi.com
DIRECT LINK for iPhone4S 9.3.5 keys here - https://www.theiphonewiki.com/wiki/Genoa_13G36_(iPhone4,1)
(if using windows u can install idecryptit or Firmware Manager*CREATED BY GEOSN0W here) i prefer using (firmware manager) -
https://sourceforge.net/projects/idecryptit/files/9.x/iDecryptIt_9.31.0.2G86.zip/download
ENJOY :)