Download: spirit2pwn iPhone hack /

OLD BOOTROM + Spirit => 4.0 JB
Updated for FW 4.0/4.0.1 + ‘Star’ jailbreak. You’ll need NOR files from a custom 4.0 ipsw made with PwnageTool 4.0.1.
You still obviously need to have an old bootrom 3GS, however you don’t currently need any SHSH while Apple still signs 4.0.1
The fact that Star jailbreak uses Safari, however, means it will be patched in weeks, so back up those hashes while you can..
Now that 4.0 is jailbroken, potential uses of this method include installing 4.1 betas, rolling back to 3.x and similar fun activities.
STOP if you have a new bootrom (week 40+, tethered only 3.1.2 JB etc). Here’s how to check bootrom ver
- your hardware is iPhone 3GS with OLD BOOTROM
- you HAVE 3.1.3 SHSH (**)
- you DON’T have 3.1.2 SHSH (otherwise, just use blackra1n/redsn0w).
- you WANT iOS4/JB
Update: thanks to movie for those awesome step by step instructions!
Update2: someone made a Cydia package. Looking at type of questions people ask in the comments, that might be the only option for 80% of them. Apple’s license terms, of course, don’t allow to redistribute their binaries, so I just link to it. Their description also says it works with 3.1.2/Spirit – I very much doubt that.
This tool can be used to flash pwned nor files (containing LLB exploit) on the phone running Spirit JB (script has hardcoded offsets for 3.1.3 3GS).
*Now flasher checks that all files exist before flashing them.
http://code.google.com/p/iphone-img3-flasher/downloads/detail?name=spirit2pwn_r2.zip
1. Unpack pwned(!) 3.1.3 firmware, copy all the files from iPhone2,1_3.1.3_7E18_Custom_Restore\Firmware\all_flash\all_flash.n88ap.production folder to /tmp directory your phone. You can use CyberDuck or WinSCP to do that. Copy those files directly to the /tmp, not to a subfolder: LLB should be at /tmp/LLB.n88ap.RELEASE.img3, etc.!
2. Extract the contents of the spirit2pwn_r2.zip archive to /tmp directory on the phone.
3. Run the following commands on the iPhone: (Use ssh or PuTTY).
cd /tmp
chmod 755 pwn_old_boot_r2.sh
./pwn_old_boot_r2.sh
* Now reboot and your iboot and llb should be pwned, and you can restore to a custom FW now.
Thanks Gojohnnyboi for code, ZeRoLiMiT for testing
(**) Technically, you can still do that if you don’t have 3.1.3 SHSH, but then if you don’t really have old bootrom or if you use wrong ipsw files, your only option will be to upgrade to 4.0 and stay without jailbreak or unlock until a new exploit is made public.
***INSTRUCTIONS FOR THE LAYMEN***
It worked for me on my 3Gs (Jailbroken with Spirit, 3.1.3, old bootrom) and I’m a total noob.
NOTE: When flashing using the iphone app: mobile terminal, you must first go into the root directory by typing: su root
So here are the STEP by STEP instructions for someone slow like myself.
1.) Download a custom firmware for 3.1.3 3Gs (you can get it here: http://www.iphoneheat.com/2010/02/download-iphone-custom-firmware-3-1-3-ipsw/
must download all the files and then join them using something like “Split and Concat” software.
2a.) Download a custom firmware for 4.0 3Gs (you can get it here:
http://www.iphoneheat.com/2010/06/download-custom-ios-40-firmware-ipsw/
must download all the files and then join them using something like “Split and Concat” software
OR
2b.) Download both Pwnage Tool 4.01 and the official apple version of 4.0 called iPhone2,1_4.0_8A293_Restore.ipsw
Then make your own custom 4.0 which will be named: iPhone2,1_4.0_8A293_Custom_Restore.ipsw
3.) Download spirit2pwn_r2
from here:
http://code.google.com/p/iphone-img3-flasher/downloads/detail?name=spirit2pwn_r2.zip
4.) Download Cyberduck on your Mac OS X
5.) Download MobileTerminal on your iPhone
6.) Download OpenSSH on your iPhone
NOW YOU HAVE ALL THE FILES YOU NEED!
7.) Open up Cyberduck and connect your Mac to your
iPhone. To use this you need:
a.) IP address of iPhone
b.) username which is: root
c.) password which is alpine (unless you changed it)
d.) Connect Cyberduck to your iPhone
d.) Navigate to the /tmp folder
8.) Go to your files in STEP 1.) (custom firmware for 3.1.3 3Gs that you downloaded) and navigate to the subfolder called: all_flash.n88ap.production folder.
Take all the files in that folder and copy into the /tmp folder using Cyberduck. Should be 14 files total.
9.) Go to your files in STEP 3.) (spirit2pwn_r2 you downloaded). Take all the files in that folder and copy into the /tmp folder using Cyberduck. Should be 2 files total.
NOW YOUR SET TO FLASH!!!
10.) Now go to your iPhone and open up MobileTerminal.
a.) TYPE: su root
(may ask for password)
HIT RETURN
b.) TYPE: cd /tmp
HIT RETURN
c.) TYPE: chmod 755 pwn_old_boot_r2.sh
HIT RETURN
d.) TYPE: ./pwn_old_boot_r2.sh
HIT RETURN
It will start flashing the files on your iPhone. It will pause a few times. WAIT! don’t do anything. WAIT until it’s completely done and says [SUCCESS] as the bottom.
11.) REBOOT your iPhone.
12.) plug your iPhone into iTunes. press the OPTION key as you click on RESTORE in iTunes. Make sure you are connected to the internet.
13.) Navigate to the file: iPhone2,1_4.0_8A293_Custom_Restore.ipsw
You created in STEP 2a.) or STEP 2b.)
14.) iTunes will RESTORE your iPhone using iPhone2,1_4.0_8A293_Custom_Restore.ipsw
(Does not take that long)
15.) iPhone will REBOOT and then iTunes will prompt you to RESTORE your files from a BACKUP or as a NEW Phone.
There you go! Whew!
Related posts:
Download: PwnageTool for iPhone OS 3.1.3 jailbreak / unlock (Mac/Hack)
Download: iPhone 2G / 3G / 3GS OS / firmware: from 1.0 to 3.1.2
Download: iPhone 2G / 3G / 3GS OS / firmware: from 1.0 to 3.1.3
Download: Pwnage tool 3.1.4 (Mac) for iPhone / iTouch firmware v3.1.2
Download: Sn0wbreeze 2.01 (Windows) jailbreak hack for iPhone 3G / 3GS and iTouch 2G / 3G
Posted by mohsin ali at 10/14/2010 05:00:00 AM Email ThisBlogThis!Share to TwitterShare to FacebookShare to Google Buzz
0 comments: