iPhoneInterest » Jailbreak

Secure your iDevice from jailbreakme exploit

Amit — Fri, 13 Aug 2010 18:41:45 +0000

Apple announces iOS 4.0.2, to fix PDF exploit discovered by Comex. This patch is available for the following iDevices

iPhone 4
iPhone 3GS
iPod Touch 2G/3G
iPad (OS 3.2.2)

If you own any other iDevice, Apple is probably not putting any efforts to make your device safer from this vulnerability.
If you want to make your iDevice safer, jail breaking could be the only way for such devices. Saurik, the creator of Cydia, has patched all the iDevice from this exploit. You must apply this patch after using jailbreakme.

Patch is available in cydia by the name “PDF Patch”. Open up cydia in your iDevice, and install this patch as you install any other software in Cydia.

Save iOS 4 SHSH using TinyUmbrella 4.00.54

Arvind — Fri, 09 Jul 2010 04:09:37 +0000

If you have jailbroken iOS 4, you must save your SHSH now. As there will be a software upgrade (iOS 4.0.1) very soon. In case if something goes wrong while upgrading to newer iOS, you can always come back to iOS 4. To save SHSH follow step by step guide
Step 1. Download TinyUmbrella 4.00.54 for Win
Step 2. Connect iDevice to PC
Step 3. Start Umbrella-4.00.54.exe
Step 4. You have connected your device properly, you will see Save My SHSH button enabled.
Step 5. Click on Save My SHSH
Step 6. It will save your SHSH to your local system and cydia by default. If you wish to change these default options, click on advance.
Step 7. You can find saved shsh in following folders. Now you don’t rely upon Cydia only.
Win Vista :

:\Users\\.shsh
ex: C:\Users\amit\.shsh

Win 7 :

:\Users\\.shsh
ex: C:\Users\amit\.shsh

Win XP :

:\Documents and Settings\\.shsh
ex: C:\Documents and Settings\amit\.shsh

TinyUmbrella is also available on Mac (4.00.54) and Linux (4.00.55)

Unlock iOS4 on any baseband using ultrasn0w 0.93

Amit — Thu, 08 Jul 2010 04:09:23 +0000

If you have iOS4 jailbroken iPhone irrespective of any baseband (including 05.13.04, 05.12.01), to have a carrier unlock, you can use ultrasn0w 0.93 available in cydia. ultrasn0w is available in cydia, so you need to jailbreak your iPhone before you can unlock it. here is step by step guide to unlock iOS4.

Step 1. Start Cydia on your iPhone and tap on Manage
Step 2. Tap on Sources
Step 3. Tap on Edit and then tap on Add
Step 4. You’ll see an input box, enter http://repo666.ultrasn0w.com url and touch Add Source
Step 5. Cydia will now update source list, Now touch Search
Step 6. Search for ultrasn0w 0.93, you’ll see ultrasn0w 0.93 listed down in the result.
Step 7. Install it and restart iPhone
Step 8. And here you have a fully unlocked iPhone. Enjoy !!!

If you have tethered jailbreak then rebooting iPhone may stuck iPhone on sn0w screen, to overcome this issue follow last section of this post.

Tethered iOS 4.0 Jailbreak for iDevices using sn0wbreeze1.7

iPhoneInterest — Tue, 06 Jul 2010 18:09:34 +0000

Sn0wbreeze 1.7 for iOS 4.0 has been released. This jailbreak supports following iDevices
1. iPhone 3GS (Old bootrom)
2. iPhone 3GS (New bootrom having SHSH stored on cydia for 3.1.2 or running jailbroken 3.1.2)
3. iPod touch 2G (non-MC models)
4. iPod Touch 2G (MC models having SHSH stored on cydia for 3.1.2 or running jailbroken 3.1.2)
5. iPod Tocuh 3G (having SHSH stored on cydia for 3.1.2 or running jailbroken 3.1.2)

2nd, 4th and 5th will be tethered jailbreak, means you need to re-connect to computer whenever you reboot iDevice.

I have jailbroken iPhone 3GS(New bootroom having jailbroken 3.1.2, SHSH not saved for 3.1.2) by following these instructions.
Step 1. Download following software

iTunes 9.2
Payload Pwner-r3 for the 3GS
iBooty V1.3
LibUSB Installer (Step 4)
iPhone 3.1.2 and iOS 4 for iPhone 3GS
Download 7-Zip or another un-archiver

Step 2. Install iTunes 9.2

Step 3. Connect iPhone to PC and take backup of iPhone using iTunes. You can remove iPhone after backup is over.

Step 4. (Installing LibUSB)
Windows XP Users download this installer — LibUSB Installer. Install it as you install any other program.
Windows Vista & Windows 7 (32 Bit)
I am running Windows Vista 32 bit, I downloaded LibUSB from here. Right click on LibUSB installer(libusb-win32-filter-bin-0.1.12.1.exe), Go to compatibility tab and check “Run this program in compatibility mode for Windows XP (Service Pack 2) “. Press ok. Again right click on LibUSB installer (libusb-win32-filter-bin-0.1.12.1.exe). Click on run as Administrator option and install it. Windows 7 (32 Bit) can follow above instructions.
Windows Vista & Windows 7 (64 Bit)
If you are on Windows Vista (64 bit) or Windows 7 (64 bit), read instructions carefully.

Step 5. Extract iBooty-V1.3, Extracted folder will contain following files

iBooty.exe
irecovery.exe
readline5.dll
sn0w.img
wait.img

Step 6. Click on Payload Pwner-r3. It will ask for 3G[S] 3.1.2.ispw. Locate "iPhone2,1_3.1.2_7D11_Restore.ispw" file on the disk (Downloaded earlier). This will create a payload + iBEC. Save them in a location where you saved all above download and give folder a name say “payload”.
This folder will contain two files ibec.40 and iboot.payload, move them to the folder where you extracted iBooty-V1.3 (Previous step).

Step 7. Click on sn0wbreeze-V1.7 to create a custom firmware

Connect iPhone to your PC
Select Expert Mode and click on Blue Arrow at right bottom, Installer will now ask for OS 4.ispw, after verifying ispw, it may show a waring in case if you are on jailbroken 3.1.2 and don’t have SHSH for 3.1.2. Ignore this warning
Select general option and click on Next. This will show you an option window and first option “Activate The iPhone” selected. Check “Disable NOR Flash” (This is must for new bootrom)
If you are jailbreaking iPhone 3GS then all other options are implicitly checked (UI doesn’t show checked)
Click next and again next and then select Cydia(need for carrier unlock) and Rock(If you need it)
Select any custom app if you want them part of custom firmware and move to next step
Uncheck Boot logo and Recovery Logo and click on next(Blue) button.
You’ll get the same screen as on 3rd step. Select “Build ISPW” option now and click Next button.
This will create a sn0wbreeze_iPhone 3GS-4.0.ispw file on your desktop.

Step 8. Extract sn0wbreeze_iPhone 3GS-4.0.ispw created by sn0wbreeze with 7-Zip or another un-archiver.

Step 9. Grab

kernelcache.release (In root directory where you extracted )
DeviceTree.n88ap (\Firmware\all_flash\all_flash.n88ap.production\)

move these files to the folder where you extracted iBooty-V1.3 (Step 5) and rename kernelcache.release to kernal.40 and DeviceTree.n88ap to devtree.40.

Step 10. iBooty-V1.3 extracted folder will contain following files

irecovery.exe <-- Comes with iBooty.
readline5.dll <-- Comes with iBooty.
iBooty.exe <-- Comes with iBooty.
sn0w.img3 <-- Comes with iBooty.
wait.img3 <-- Comes with iBooty.
iboot.payload <-- Created with Payload Pwner.
ibec.40 <-- Created with Payload Pwner.
devtree.40 <-- Grabbed from Custom IPSW made by sn0wbreeze.
kernel.40 <-- Grab from Custom IPSW made by sn0wbreeze.

Step 11. Connect iPhone if you disconnected and run iBooty.exe and Select “Prepare Device for Custom Firmware”. Run the Process and if you see the image, you can proceed!

Step 12. Now open iTunes 9.2 and restore to the sn0wbreeze_iPhone 3GS-4.0.ispw by using Shift + Restore option.

Step 13. Wait for iTunes to complete restore process. After the process is finished, your device WILL NOT BOOT. Close iTunes and check your process list if iTuneHelper.exe is running then kill this process too. Now re-run iBooty.exe (tethered) and now select on “Boot It”.

Step 14. If all goes well it will boot!

To unlock iOS 4, follow step by step guide posted here

Some more tips if you are stuck in show boot image logo

Close itunes and Kill iTunesHelper from task list.
hold Home + Power button until screen flashing and automatic go into recovery mode
Again close iTunes detect recovery mode.
Run ibooty wait until everything is done.
Stuck on logo snow now. Now run iTunes then finally you got log screen

Jailbreak iOS 4.0 on New Bootrom 3G[S] with 3.1.2 SHSH Blobs

Amit — Mon, 05 Jul 2010 04:11:50 +0000

As discussed in previous post, a guide for jailbreaking iOS 4 on iPhone 3GS having 3.1.2 SHSH saved, is posted by iH8Sn0w. Jailbreak is not straight forward. You need to know iPhone 3GS completely. If you don’t know scripting then stay away from this jailbreak. Wait for some more time, there will an easy tool for all.
Follow the link to read about jailbreak.

Tethered iOS 4.0 Jailbreak for iPhone 3GS With New Bootrom Coming Soon

Amit — Mon, 05 Jul 2010 03:54:01 +0000

Good news for those who have bought iPhone 3GS recently, No jailbreak available for such iPhone 3GS having new bootrom till now.
iH8Sn0w has developed a tool to jailbreak iPhone 3GS having new bootrom. Unfortunately jailbreak requires that you have your iPhone 3.1.2 SHSH blobs saved on cydia server. it is a tethered jailbreak so whenever you turn off your phone, you will need to re-connect it to a computer to be able to turn it back on. Originally this was not planned for release; however, iH8Sn0w has agreed to make it public.

Alright... If anyone has their 3.1.2 SHSH blobs, NOT 3.1.3. Then I'll see if I can produce a tool that will do this job... - iH8Sn0w

It may be possible that you are on 3.1.2 but your SHSHs are saved for 3.1.3. If this is the case then you are out of luck for now. I don’t know if anyone is working on that scenario.
A video posted by iH8Sn0w showing iOS 4 running on iPhone 3GS having new bootrom.

how to downgrade iPhone with shsh stored on file with cydia

Amit — Wed, 30 Jun 2010 04:04:03 +0000

In case if you need to restore older iPhone OS version for which you have stored SHSHs on cydia, you can proceed as described below
1. Download TinyUmbrella 4.0.0.26 from http://thefirmwareumbrella.blogspot.com/
2. Start TSS server
3. Click on Display SHSHs, It will display if your iPhone can be successfully restored on not.
4. Download the firmware you want to restore in case if you don’t have this.
5. Open iTunes, press Shift + Restore
6. Locate the firmware, you want to restore
7. Now iTunes will try to verify signature, TSS server will make sure that iTunes get these signature from cydia server.
8. After restore process is finished, you may get error 1014 or 1015. Specifically, iPhone 4 will give you a 1004 error, and if your baseband doesn’t match your firmware. If you get one of these errors, your device will be stuck in recovery mode. Simply click the “Kick Device Out of Recovery” and your device will reboot to the lockscreen, or activation screen, depending on the firmware you’re using for restore.

iPhone 4 has been jailbroken @comex

iPhoneInterest — Sun, 27 Jun 2010 13:49:20 +0000

iPhone 4 has been jailbroken by Comex, of popular jailbreaking tool, Spirit jailbreak for iPhone OS 3.1.3, iPhone OS 3.1.2 has discovered another userland jailbreak in iOS 4.

Think I’m the first one I know about to get a root shell (and SSH) on iPhone 4, using poor @comex’s code (since he has no iPhone 4) – Twitter status

This is now confirmed by MuscleNerd, member of iPhone-Dev Team.

Congrats to @comex for another userland JB http://is.gd/d5N6I <– hi-res Cydia via @planetbeing & @chpwn iPhone4s - Twitter status

You have old bootrom iPhone 3GS

iPhoneInterest — Thu, 24 Jun 2010 14:56:00 +0000

Own a hacktivated iPhone 3GS, to upgrade to iOS 4, you must proceed with caution. All the hacktivation tools available in the market doesn’t support newer bootrom iPhone 3GS. How to identify bootrom of your iPhone 3GS ?
1. Go to setting -> General -> About
2. Check your serial number and model number

If Model begin with MC, you have iPhone 3GS with new bootrom
Checkout 4th and 5th digit of serial number, if this value is lower than 40 then you have old bootrom.

Hope this helps.

Jailbreak iOS 4 on Win using Sn0wbreeze 1.6

Arvind — Wed, 23 Jun 2010 17:05:04 +0000

Sn0wbreeze 1.6 is almost ready for windows users. iH8sn0w will release it in 2-3 days. Sn0wbreeze supports:

iPhone 3G/3GS (old bootrom/already jailbroken–NOT INCLUDING Spirit)
iPod Touch 2G

Have a look on the video posted by iH8sn0w