PDA

View Full Version : HOW TO: Manually Jailbreak iPhone 3Gs With New Bootrom Running iOS 4 With Sn0wBreez



Ureyesonly
04-07-2010, 03:30 PM
YouTube - iPhone 3Gs New Bootrom Pwned on 4.0 (sn0wbreeze) (To view links or images in this forum your post count must be 1 or greater. You currently have 0 posts. A few days ago, iH8sn0w released a new video where he demos the jailbreak of iOS 4.0 running on a iPhone 3Gs with the new bootrom and we told you that a new sn0wbreeze update is coming soon. Well, is seems that ‘soon’ is not soon enough, and today we will show you how to jailbreak your 3Gs manually.
NOTE: read the tutorial twice before you attempt this, and make sure you understand everything. The tutorial was written by iH8sn0w and we modified it to make it as simple as possible , so everybody can understand it. But still, the stuff you are about to read is pretty advanced and not accessible to everybody so, if you still don’t understand it, well… wait for the update.
NOTE: this is a tethered jailbreak. That means that everytime the iPhone reboots, you need to connect it to a computer in order to turn it on.
Requirements:
* BACKUP YOUR iPhone via iTunes or you can manually backup (To view links or images in this forum your post count must be 1 or greater. You currently have 0 posts. iPhone 3Gs with new bootrom ( use iDetector to check if you got an old or new bootrom )
* 3.1.2 SHSH blobs saved ( if you don’t have them, you can stop here… there’s nothing you can do )
* difrnt’s iBSS grabber (http://difrnt.com/blog/?p=25)
* Payload Pwner-r2 for the 3Gs (To view links or images in this forum your post count must be 1 or greater. You currently have 0 posts. sn0wbreeze V1.6.2 (To view links or images in this forum your post count must be 1 or greater. You currently have 0 posts. iBooty (To view links or images in this forum your post count must be 1 or greater. You currently have 0 posts. LibUSB ( details in the post ; 64-Bit users read carefully!!!)
* 3.1.2/4.0 3GS firmware downloaded on your desktop (To view links or images in this forum your post count must be 1 or greater. You currently have 0 posts. STEP 1 : Grabbing your 3.1.2 iBSS file
1. Pointing your hosts
* If you have your SHSH blobs saved on Cydia/Saurik’s server then follow this tutorial
* If you have your SHSH blobs saved locally, use TinyUmbrlla
2. Restoring to grab the iBSS file.
* Place your device in DFU.
* Start up the iBSS/iBEC grabber.
* Put the save folder on a new folder on your desktop.
* Hit “Start Monitoring”.
* Now go back to iTunes and do SHIFT + Restore. Then browse for your 3.1.2 IPSW. You will need to restore
* to 3.1.2 in order to pwn 4.0.
3. Saving your iBSS
* After Restoring, Go to the folder that you have specified to save your iBSS file.
* You will see folders like (Per**.tmp). Go into one of them, and you’ll see a folder called “Firmware”. Go there. Then go to the folder “dfu”.
* Copy the iBSS file to a safe place, then you can remove the folder created by the iBSS Grabber.
STEP 2 : Creating a custom 4.0 firmware
Using Sn0wbreeze 1.6.2 create a custom firmware. If you don’t know how, check this tutorial
NOTE: Ignore the warnings after browsing for the ipsw
STEP 3 : Installing LibUSB for iRecovery
NOTE: If libUSB is not installed properly, your USB might no longer work!
NOTE: If you are not sure what’s running under the ‘hood’ , you can run this mini tool to detect your O/S + Architecture — Windows + Arch. Detector
Download libUSB:
* Windows XP (To view links or images in this forum your post count must be 1 or greater. You currently have 0 posts. Windows Vista/7 users RUNNING 32-Bit (To view links or images in this forum your post count must be 1 or greater. You currently have 0 posts. run the installer in compatibility mode for Windows XP )
* Windows Vista/7 users RUNNING 64-Bit (To view links or images in this forum your post count must be 1 or greater. You currently have 0 posts. How to install libUSB for Vista/7 64-Bit:
Once LibUSB is installed iRecovery should be able to function now.
STEP 4 : Pwning iBSS + iBoot
Download this easy tool here (To view links or images in this forum your post count must be 1 or greater. You currently have 0 posts. The tool will help you create the payloads.
NOTE: save the payloads in the same place you got iBooty ( i.e. desktop )
STEP 5 : iBooty Prep
NOTE: It will work as long as you place all of the correct files there
1. Download iBooty GUI (To view links or images in this forum your post count must be 1 or greater. You currently have 0 posts. and extract it
2. Extract your Custom IPSW created by sn0wbreeze with 7-Zip or another un-archiver.
3. Grab the kernelcache and bring it into the same folder as iBooty. Also grab the iBEC from the folder Firmware\dfu\iBEC.n88ap.RELEASE.dfu
4.
* Rename your iBSS 3.1.2 signed to “ibss312.dfu”
* Rename your Kernel 4.0-Custom to “kernel.40″
* Rename your iBEC 4.0-Custom to “ibec40.dfu”
Your folder should look like this:
* iboot.payload <– Created with Payload Pwner.
* exploitibss312 <– Created with Payload Pwner.
* ibec40.dfu <– Grabbed from Custom IPSW made by sn0wbreeze.
* irecovery.exe <– Comes with iBooty.
* readline5.dll <– Comes with iBooty.
* iBooty.exe <– Comes with iBooty.
* ibss312.dfu <– THIS NEEDS TO BE YOUR iBSS from the restore!
* kernel.40 <– Grab from Custom IPSW made by sn0wbreeze.
* sn0w.img3 <– Comes with iBooty.
STEP 6 : Restoring to 4.0 + Booting
NOTE: MAKE SURE you are running 3.1.2
1. Run iBooty and Select “Prepare Device for Custom Firmware”. Run the Process and if you see a snow flake, you can proceed!
2. Now open iTunes and restore to the custom ipsw
NOTE: when you’re done, your device will have a black screen and will not boot ( DFU loop ) . This is normal.
STEP 7 : Booting
Just Re-Run iBooty and select “Boot It”. If all goes well it will boot!