Grupa iH8Sn0w upubliczniła solucję na Jailbreak w iPhone 3GS z nowym bootromem

Znana grupa hackerska iH8sn0w, która ma na swoim koncie takie narzędzia jak Sn0wBreez, iReb, czy iDetect, opublikowała metodę na wprowadzenie telefonu iPhone 3GS z nowym bootromem w tryb Jailbrek. Aktualnie jest to jedyna metoda i najprawdopodobniej pierwsza na świecie, umożliwiająca takie zabieg. Niestety by z niej skorzystać, należy najpierw spełnić szereg wymagań, a następnie przeprowadzić dość skomplikowany proces jailbreakowania. By móc w ogolę się zabrać za zabawę należy posiadać:

BACKUP własnego iPhone wykonanego przez iTunes

Telefon iPhone 3Gs z new bootrom
Wykonaną na nim kopię pliku autoryzacyjnego SHSH
Aplikacji iBSS grabber
Payload Pwner-r2 for the 3Gs
sn0wbreeze V1.6.2
iBooty
Biblioteki LibUSB
Oprogramowanie 3.1.2 i 4.0 dla 3GS

Samo posiadanie telefonu iPhone 3GS z nowym bootromem, na którym wykonano SHSH z oprogramowania 3.1.2, to już wielki wyczyn. Większość tego typu urządzeń dostępnych w naszym kraju, mając nowy bootrom, posiadała już fabrycznie wgrane oprogramowanie 3.1.3. Raczej nikt nie myslał, by downgradować oprogramowanie na niższe, by móc sobie stworzyć SHSH…

Mimo to, jest to jakiś krok w przód. Dla zainteresowanych, wklejamy poniżej opis w wersji angielskiej.

————————————————————————————–
STEP 1 : Grabbing your 3.1.2 iBSS file

1. Pointing your hosts
If you have your SHSH blobs saved on Cydia/Saurik?s server then follow this tutorial
If you have your SHSH blobs saved locally, use TinyUmbrlla

2. Restoring to grab the iBSS file.
Place your device in DFU.
Start up the iBSS/iBEC grabber.
Put the save folder on a new folder on your desktop.
Hit ?Start Monitoring?.
Now go back to iTunes and do SHIFT + Restore. Then browse for your 3.1.2 IPSW. You will need to restore
to 3.1.2 in order to pwn 4.0.

3. Saving your iBSS
After Restoring, Go to the folder that you have specified to save your iBSS file.
You will see folders like (Per**.tmp). Go into one of them, and you?ll see a folder called ?Firmware?. Go there. Then go to the folder ?dfu?.
Copy the iBSS file to a safe place, then you can remove the folder created by the iBSS Grabber.

STEP 2 : Creating a custom 4.0 firmware
Using Sn0wbreeze 1.6.2 create a custom firmware. If you don?t know how, check this tutorial

NOTE: Ignore the warnings after browsing for the ipsw

STEP 3 : Installing LibUSB for iRecovery
NOTE: If libUSB is not installed properly, your USB might no longer work!

NOTE: If you are not sure what?s running under the ?hood? , you can run this mini tool to detect your O/S + Architecture – Windows + Arch. Detector

Download libUSB:

Windows XP
Windows Vista/7 users RUNNING 32-Bit ( run the installer in compatibility mode for Windows XP )
Windows Vista/7 users RUNNING 64-Bit
How to install libUSB for Vista/7 64-Bit:

Once LibUSB is installed iRecovery should be able to function now.

STEP 4 : Pwning iBSS + iBoot
Download this easy tool here. The tool will help you create the payloads.

NOTE: save the payloads in the same place you got iBooty ( i.e. desktop )

STEP 5 : iBooty Prep
NOTE: It will work as long as you place all of the correct files there

1. Download iBooty GUI, and extract it

2. Extract your Custom IPSW created by sn0wbreeze with 7-Zip or another un-archiver.

3. Grab the kernelcache and bring it into the same folder as iBooty. Also grab the iBEC from the folder FirmwaredfuiBEC.n88ap.RELEASE.dfu

4.

Rename your iBSS 3.1.2 signed to ?ibss312.dfu?
Rename your Kernel 4.0-Custom to ?kernel.40?
Rename your iBEC 4.0-Custom to ?ibec40.dfu?
Your folder should look like this:

iboot.payload <? Created with Payload Pwner.
exploitibss312 <? Created with Payload Pwner.
ibec40.dfu <? Grabbed from Custom IPSW made by sn0wbreeze.
irecovery.exe <? Comes with iBooty.
readline5.dll <? Comes with iBooty.
iBooty.exe <? Comes with iBooty.
ibss312.dfu <? THIS NEEDS TO BE YOUR iBSS from the restore!
kernel.40 <? Grab from Custom IPSW made by sn0wbreeze.
sn0w.img3 <? Comes with iBooty.

STEP 6 : Restoring to 4.0 + Booting
NOTE: MAKE SURE you are running 3.1.2

1. Run iBooty and Select ?Prepare Device for Custom Firmware?. Run the Process and if you see a snow flake, you can proceed!

2. Now open iTunes and restore to the custom ipsw

NOTE: when you?re done, your device will have a black screen and will not boot ( DFU loop ) . This is normal.

STEP 7 : Booting
Just Re-Run iBooty and select ?Boot It?. If all goes well it will boot!