The iPhone Wiki - User contributions [en]

User:Sean

2015-07-09T03:31:46Z

Sean:

An individual who formerly took part in informing the incredibly discriminative and disastrous iPhone OS community of the latest in everything related to iOS Hacking. This included, but was not limited to: Jailbreaking, tools, and feuds, all of which are frequently produced, updated, and distributed.

Sean is known in any thing to do with iPhone as either "Sean" (Mainly IRC) and by "RawrSean" (Twitter, iOS Social networks (OpenFeint.. etc..)) he is known on GameCenter as "¥".

Sean also has a bird named Birdy.

JailbreakMe

2011-10-12T19:37:19Z

Sean: Online with Saffron, not Star. (Or both?)

JailbreakMe is a site that has been used multiple times to jailbreak iDevices. It is currently online with the [[Saffron]] Jailbreak by [[User:Comex|comex]].

== First Incarnation (AppSnapp) ==
Initially, [http://www.conceitedsoftware.com/ Conceited Software] utilized the [[LibTiff]] exploit with jailbreakme.com, which also went by the name "AppSnapp," to jailbreak iOS 1.1.1. Upon the release of iOS 2.0 and the debut of the App Store, Conceited Software closed JailbreakMe, when it remained dormant for a while.

== Second Incarnation (Star) ==
{{main|Star}}
[[User:Comex|comex]] has since repurposed the domain for [[Star]], his userland [[jailbreak]] for iOS 3.1.2 through 4.0.1. However, comex stated that the bug used for the untethered jailbreak was there until 4.3 as Apple did not patch the bug correctly. It was properly patched on 4.3.1 in order to prevent the jailbreak of the iPad 2. It's still possible the site could be repurposed to jailbreak iDevices up to 4.3, but this has not yet been done.

== Third Incarnation (Saffron) ==
{{main|Saffron}}
In June 2011, comex began to put up teasers on JailbreakMe. In early July 2011, someone Googled comex's other site and found a prerelease version of "Saffron," the third incarnation of JailbreakMe. Word about this "leak" inevitably spread. On July 6, 2011, "Saffron" made its official debut on JailbreakMe.

== Owner Problem ==
On October 7, [[MuscleNerd]] announced that the domain was sold and that the new owner was unknown, so that there is a big danger of the site hosting malware. It turned out that the new owner was friendly and sold it the next day to [[Saurik]] who hosted the site anyway. Problem solved.
=== References ===
*[http://twitter.com/#!/MuscleNerd/status/122266354173739010 sale announcement]
*[http://twitter.com/#!/MuscleNerd/status/122267822280814592 untrusted]
*[http://twitter.com/#!/MuscleNerd/status/122715500349374465 buyback announcement]

== External Link ==
*[http://jailbreakme.com/ jailbreakme.com]

ITunes Errors

2011-05-10T02:46:54Z

Sean: /* Error 37 */

{{DISPLAYTITLE:iTunes Errors}}
Most of the errors can be found [http://support.apple.com/kb/ts1275 here] or [http://raptortalks-tech.blogspot.com/2010/07/itunes-error-codes.html here].

Here is a list of [[iTunes]] errors that could appear during a restore or a USB connection via iTunes:

=Negative -98xx=
==Error -9843==
This error happens if you are logged out, try to download something from the iTunes store and if you click on "Download" and enter an account, which doesn't have this article, this error will occur.

==Error -9815==
Set exact date, restart computer. See also [http://support.apple.com/kb/TS1276 Apple's KB article].

==Error -9814==
Set exact date, restart computer. See also [http://support.apple.com/kb/TS1276 Apple's KB article].

==Error -9812==
Check system time, reset Internet connection, update root certificates. See also [http://support.apple.com/kb/TS3222 Apple's KB article].

==Error -9808==
Computer system time incorrect.

==Error -9800==
Set exact date, restart computer. See also [http://support.apple.com/kb/TS1276 Apple's KB article].

=Negative -1 ... -100=
==Error -50==
Delete Storm Video, QuickTime, iTunes, then reinstall iTunes. See also [http://support.apple.com/kb/TS1583?viewlocale=en_US Apple's KB article].

==Error -35==
Error when downloading songs purchased on iTunes. Also see [http://support.apple.com/kb/TS1475?viewlocale=en_US Apple's KB article].

==Error -1==
Error occurs when one uses the "last ditch" method for preventing baseband updates on the iPhone 4. The baseband does not get updated using this method. Simply use TinyUmbrella to kick it out of recovery mode.

=Below 100=
==Error 1==
Unable to downgrade. Try changing the USB port (the back one of chassis is better) and restart computer.

The installed version of [[iTunes]] may also be too old. Update iTunes.

==Error 2==
Sn0wbreeze 1.6 Custom Firmware has a [[ASR]] patch problem. Use [[sn0wbreeze]] 1.7 or [[PwnageTool]]. Device isn't bootable.

==Error 6==
Not enter the downgrading mode, change USB port (the back one of chassis is better) and restart computer.

==Error 9==
Seems to be a kernel panic. After patching kernel in PwnageTool with custom patches, restore failed with this. iRecovery then showed increased kernel panic count.

==Error 10==
[[LLB]] is missing from the [[IPSW File Format|IPSW]]. The device cannot be booted up. The trick to skip the baseband update no longer works.

==Error 11==
*Removed bbfw file in the firmware folder of an unzipped [[IPSW File Format|IPSW]]. Can also be used to prevent a baseband update. The device is bootable, if you set the auto-boot to true or use TinyUmbrella and use "Kick Device out of Recovery".
*You are trying to update to a custom firmware from Pwnage Tool 4.1+. You always have to go into DFU mode and restore from there.

==Error 13==
Occurs when you want to install a beta firmware with [[iTunes]] for Windows (actively blocked by Apple; beta users are developers and therefore must have a Mac).

Error 13 may also signify a USB problem. Check the USB connection and try other direct ports or maybe the USB cable is an older one. Device isn't bootable.

The installed version of [[iTunes]] may also be too old. For firmwares 4.0 and higher you need iTunes 9.2 or higher. Update iTunes.

==Error 14==
Custom firmware update fail ([[PwnageTool]] until 4.0.1). You have to restore the device with a custom firmware. Update to a custom firmware isn't working. Device isn't bootable. 2

USB Problem. Check the USB connection and try other direct ports or maybe the USB cable is an older one. Device isn't bootable.

You're trying to 'update' to a beta firmware instead of performing a restore. Device is still bootable if you kick it out of recovery mode.

==Error 17==
Device failed to display the applelogo img3 which results in this error.

Hacktivation bug in [[Sn0wbreeze]] 2.0.1, which was fixed in [[Sn0wbreeze]] 2.0.2.

==Error 18==
This occurs when the media library on the device is corrupt and cannot be modified or updated.

Updating to the latest version of iTunes and then restoring should resolve this issue

==Error 20==
Error when downgrading 2.0 to 1.1.1.

==Error 21==
Custom firmware restore fail ([[PwnageTool]] since 4.1). You have to put your device into the DFU mode and not into recovery mode. Device won't boot correctly an stuck at the Apple logo after the error. Press and hold power and home button until it reboots.

==Error 23==
Cannot restore or update due to hardware problems.
*In software you have to set default web browser.
*In hardware, it's a communication problem. Check all connections, also try to change battery.
*faulty baseband flash or processor
*Happens frequently after water damage. Remove and clean motherboard.

==Error 26==
False version of the [[NOR]] flash firmware. Use the correct [[sn0wbreeze]] version.

==Error 28==
Hardware error. Return your device to Apple if possible. The problem is a bad dock connector on the iPhone. Must change the connector.
If you have tried almost everything, reset the logic board (leave uncharged for five days or remove battery for half an hour), then pwn and restore.
if this doesn't work, the "hard disk" of your iPhone is damaged.

==Error 29==
See [http://discussions.apple.com/thread.jspa?threadID=2329795 Apple discussions thread] about this problem. You might need to change the battery.

==Error 34==
Hard disk is run out of space when trying to download TV show's or movie's Please clear space and then continue downloading.

==Error 37==
[[N72ap|iPod touch 2G]] [[LLB]] patched with the [[0x24000 Segment Overflow]] was used on an [[N88ap|iPhone 3GS]] custom firmware. Known on damaged bundles from unofficial [[PwnageTool]] distributions or bundles.

[[Sn0wbreeze]] 2.0.1 bug, which was fixed in [[Sn0wbreeze]] 2.0.2.

recent [[Sn0wbreeze]] can cause this issue. Deselect all custom boot logos, recreate IPSW. If received on an [[N88ap|iPhone 3GS]], select "new boot-rom" and deselect all custom bootlogos, then recreate the IPSW.

==Error 40==
Hacktivation bug in [[Sn0wbreeze]] 2.0.1, which was fixed in [[Sn0wbreeze]] 2.0.2.

==Error 46==
?

=Errors 10xx=
==Error 1002==
Error when restoring.

==Error 1004==
This is caused by a failure to match the [[AT+XNONCE|Baseband Nonce]] currently in memory to the [[AT+XNONCE|nonce]] returned in the [[Baseband Firmware]] [[SHSH]] blob. This happens if you edited the [[wikipedia:Hosts (file)|hosts file]] ([[Cydia Server|Saurik's Server]]) or you are using [[TinyUmbrella]]. Use [[TinyUmbrella]] and "Kick Device Out Of Recovery" to boot. 1

==Error 1011==
This is caused by recovery mode being in userland (1.1.1 firmware). The file iTunesMobileDevice.dll is damaged or updated.

==Error 1013==
'''iPhone 4'''

This means that the baseband did not get updated. Either remove the gs.apple.com entry from your hosts file and let the baseband upgrade or if you want to preserve the baseband just jailbreak at this point to boot it up.

'''Other Devices'''

Restart computer; change computer; reinstall system, if iPhone is always in restoring mode: XP users can jump from restoring mode with ibus; MAC users can use iNdependence. (usually on the iPhone with 1.0.2 firmware downgraded from 1.1.1)

==Error 1014==
This occurs when you try to downgrade your phone's baseband.

==Error 1015==
This error is common when downgrading [[iPhone]]s and 3G-enabled [[iPad]]s. The problem occurs when the device's [[Baseband Firmware|baseband]] has a higher version number than the baseband in the firmware you restored to. Just set auto-boot true in [[iRecovery]] or use [[iREB]]/[[TinyUmbrella]]/[[RecBoot]].1

=Errors 13xx=
==Error 1394==
When Spirit2Pwn flashes parts of the boot chain on [[iOS]] 4, the device may crash into [[DFU Mode]]. [http://ih8sn0wforums.com/viewtopic.php?f=8&t=3407]

=Errors 14xx=
==Error 1413==
Restart computer; change USB port; reinstall system. See also [http://support.apple.com/kb/TS1927?viewlocale=en_US Apple's KB article].

==Error 1415==
Restart computer; change USB port; reinstall system.

==Error 1417==
Restart computer; change USB port; reinstall system.

==Error 1418==
Restart computer; change USB port; reinstall system.

==Error 1428==
Restart computer; change USB port; reinstall system. (downgrade from www.iphonebus.com)

==Error 1050==
Bad response from gs.apple.com OR need iReb for preparing iPhone for restoring to custom ipsw

=Errors 16xx=
==Error 1600==
Custom firmware can't be restored on a device with [[DFU Mode]]. The software of the iPhone isn't patched. Go into Recovery Mode (Pwnage Tool up to 4.0.1) or start Pwnage Tool and click "DFU" at the top and go with this tutorial into the DFU mode. During that process the software gets patched and the custom firmware should run without any problems.

==Error 1601==
See also this [http://support.apple.com/kb/TA38633 old KB article from Apple].

==Error 1602==
Restart computer; change computer; reinstall system.

If this error occured during an Apple TV restore, then unplug the Apple TV from the power cable, after you entered the recovery or DFU mode, and then try it again.

==Error 1603==
False [[kernelcache]] patch. Known on damaged bundles from unofficial [[PwnageTool]] distributions or bundles. See also [http://support.apple.com/kb/TA38603?viewlocale=en_US Apple KB article]

==Error 1604==
Device was not pwned (signature checks were not blocked). Custom firmware can't be restored. Can also happen when there's a problem with the ipsw.

==Error 1611==
[[iTunes]] tried to enter the [[Restore Mode]], but the device turned back to the [[Recovery Mode]].

==Error 1618==
Missing system files or corrupt data in iTunes installation. Try to uninstall iTunes, restart computer, install again.

==Error 1619 ==
[[iTunes]] is too old and couldn't read the iPhone in Recovery or DFU Mode. Please update iTunes and try it again.

==Error 1644==
[[IPSW File Format|IPSW]] was moved during prepare with [[iTunes]]. Try it again and don't move the IPSW.

=Errors 20xx=
==Error 2001==
The Mac OS X kernel extension "IOUSBFamily" that was bundled with late 2008 / early 2009 MacBooks, as well as the 10.5.6 update, has a bug where it fails to properly recognize an iDevice in [[DFU Mode]]. It can be resolved by updating to 10.5.7 (or later), or using a USB hub.

Also if you have [[Limera1n]] opened during you try to restore the iOS device.

==Error 2002==
[[iTunes]] can't connect because another program is using it or it's disconnected during the Apple Server check.

==Error 2003==
Connection problem; change USB cable and check USB port.

==Error 2005==
Problem connecting. Probably a hardware failure.

=Errors 30xx=
==Error 3002==
*Update to an older firmware isn't working, because Apple is no longer handing out [[SHSH]]s for the device/firmware combination.
*Or a timeout checking Apple server - retry later.
*This error also happens if you try to ''Update'' with a local TSS server ([[TinyUmbrella|TinyUmbrella tool]]) and probably also when connecting to [[Cydia Server]]. Use ''Restore'' instead.

==Error 3004==
No internet connection during the firmware restore.
[[iTunes]] can't connect to gs.apple.com. Maybe Port 80 and Port 443 is blocked. Open it on your router.

==Error 3014==
False edited hosts. The SHSH request couldn't be completed. No connection to the Apple Server, Sauriks Server or localhost.
[[iTunes]] can't connect to gs.apple.com. Maybe Port 80 and Port 443 is blocked. Open it on your router.

=Errors 31xx=
==Error 3123==
Something dealing with movie rentals.

==Error 3191==
QuickTime corrupted must reinstall before iTunes will work or Turn off Compatibility Mode for QuickTime.

1. Right-click on the QuickTimePlayer application (located in C:Program FilesQuickTime) and choose Properties from the shortcut menu.

2. In the Properties window, click on the Compatibility tab Deselect the checkbox labeled “Run this program in compatibility mode for.”

3. Click Apply.

4. Close the Properties window

==Error 3194==
Occurs when trying to install an old firmware and Apple's server disallows the installation. The only solution is to have [[SHSH]] backup and modify the hosts file to point to [[Saurik]]'s [[Cydia Server]] where they are backed up (or localhost if you have it yourself).

==Error 3195==
"An internal error occurred." Missing SHSH for the firmware. Maybe the same as "This device isn't eligible for the request build." but with an cache error.

=Higher Errors=
==Error 11222==
A security software you have installed may be conflicting with iTunes.

==Error 13019==
?

==Error 20000==
Is caused by a custom theme pack on your Windows. Use default Theme.

This error can also be caused by the iDevice rebooting during the "Extracting Firmware" stage of restore.

==Error 20008==
?

This happened on a Mac with TinyUmbrella running before resotring a firmware to the Apple TV.

=Hex codes=
==0xE800001==
Device was suddenly unplugged. [[iTunes]] couldn't connect with the device. Try it again

==0xE8000022==
Error in your firmware files. Restore.

==0xE800003D==
False permissions in the Carrier Bundle folder. Restore, update or fix the permissions from the carrier bundle to update the carrier settings via iTunes.

==0xE800006B==
Device was suddenly unplugged. [[iTunes]] couldn't connect with the device. Try it again.

==0xE8000065==
[[sn0wbreeze]] custom firmware error on USB connection. Unplug the device, reboot it, and plug it in again.

==0xE8008001==
You are trying to install unsigned (cracked?) apps. Step away from this wiki.

=Error texts=
==This device isn't eligible for the requested build==
Apple doesn't sign the firmware anymore. See [[SHSH]].

==The iPhone "xxx" could not be restored because the firmware file is not compatible.==
You downloaded the wrong firmware file (or it is corrupt). Download the correct firmware file that matches your device. Here's an overview of file names (beginning) and devices:
*AppleTV2,1_ [[K66ap|Apple TV 2G]]
*iPad1,1_ [[K48ap|iPad (or 1G or first generation)]]
*iPad2,1_ [[K93ap|iPad 2 Wi-Fi model]]
*iPad2,2_ [[K94ap|iPad 2 GSM model]]
*iPad2,3_ [[K95ap|iPad 2 CDMA model]]
*iPhone1,1_ [[M68ap|iPhone (or 2G or first generation)]]
*iPhone1,2_ [[N82ap|iPhone 3G]]
*iPhone2,1_ [[N88ap|iPhone 3GS]]
*iPhone3,1_ [[N90ap|iPhone 4 GSM model]]
*iPhone3,3_ [[N92ap|iPhone 4 CDMA model]]
*iPod1,1_ [[N45ap|iPod touch (or 1G or first generation)]]
*iPod2,1_ [[N72ap|iPod touch 2G]]
*iPod3,1_ [[N18ap|iPod touch 3G]]
*iPod4,1_ [[N81ap|iPod touch 4G]]

==The iPhone "xxx" cannot be restored at this time because the iPhone software update server could not be contacted or is temporarily unavailable.==
If you want to upgrade or downgrade the baseband, make sure you didn't change the hosts file. The Cydia server cannot handle the requests for the baseband certificates.

== There was a problem downloading the software for the iPhone “XXXXXXX” the network connection was reset, make sure your network settings are correct and your network connection is active, or try again later.==
You need to disable both your antivirus ''and'' your windows/security firewall in order for the update/restore to go through.

----

1 Use [[TinyUmbrella]] (Kick Device out of Recovery), [[iRecovery]] or [[redsn0w Lite]] and enter "setenv auto-boot true", "saveenv", "reboot" to boot.

2 Device isn't bootable, but a custom firmware can be restored if it has a jailbreak and the requirements.

ITunes Errors

2011-05-10T02:35:08Z

Sean: /* Error 37 */

{{DISPLAYTITLE:iTunes Errors}}
Most of the errors can be found [http://support.apple.com/kb/ts1275 here] or [http://raptortalks-tech.blogspot.com/2010/07/itunes-error-codes.html here].

Here is a list of [[iTunes]] errors that could appear during a restore or a USB connection via iTunes:

=Negative -98xx=
==Error -9843==
This error happens if you are logged out, try to download something from the iTunes store and if you click on "Download" and enter an account, which doesn't have this article, this error will occur.

==Error -9815==
Set exact date, restart computer. See also [http://support.apple.com/kb/TS1276 Apple's KB article].

==Error -9814==
Set exact date, restart computer. See also [http://support.apple.com/kb/TS1276 Apple's KB article].

==Error -9812==
Check system time, reset Internet connection, update root certificates. See also [http://support.apple.com/kb/TS3222 Apple's KB article].

==Error -9808==
Computer system time incorrect.

==Error -9800==
Set exact date, restart computer. See also [http://support.apple.com/kb/TS1276 Apple's KB article].

=Negative -1 ... -100=
==Error -50==
Delete Storm Video, QuickTime, iTunes, then reinstall iTunes. See also [http://support.apple.com/kb/TS1583?viewlocale=en_US Apple's KB article].

==Error -35==
Error when downloading songs purchased on iTunes. Also see [http://support.apple.com/kb/TS1475?viewlocale=en_US Apple's KB article].

==Error -1==
Error occurs when one uses the "last ditch" method for preventing baseband updates on the iPhone 4. The baseband does not get updated using this method. Simply use TinyUmbrella to kick it out of recovery mode.

=Below 100=
==Error 1==
Unable to downgrade. Try changing the USB port (the back one of chassis is better) and restart computer.

The installed version of [[iTunes]] may also be too old. Update iTunes.

==Error 2==
Sn0wbreeze 1.6 Custom Firmware has a [[ASR]] patch problem. Use [[sn0wbreeze]] 1.7 or [[PwnageTool]]. Device isn't bootable.

==Error 6==
Not enter the downgrading mode, change USB port (the back one of chassis is better) and restart computer.

==Error 9==
Seems to be a kernel panic. After patching kernel in PwnageTool with custom patches, restore failed with this. iRecovery then showed increased kernel panic count.

==Error 10==
[[LLB]] is missing from the [[IPSW File Format|IPSW]]. The device cannot be booted up. The trick to skip the baseband update no longer works.

==Error 11==
*Removed bbfw file in the firmware folder of an unzipped [[IPSW File Format|IPSW]]. Can also be used to prevent a baseband update. The device is bootable, if you set the auto-boot to true or use TinyUmbrella and use "Kick Device out of Recovery".
*You are trying to update to a custom firmware from Pwnage Tool 4.1+. You always have to go into DFU mode and restore from there.

==Error 13==
Occurs when you want to install a beta firmware with [[iTunes]] for Windows (actively blocked by Apple; beta users are developers and therefore must have a Mac).

Error 13 may also signify a USB problem. Check the USB connection and try other direct ports or maybe the USB cable is an older one. Device isn't bootable.

The installed version of [[iTunes]] may also be too old. For firmwares 4.0 and higher you need iTunes 9.2 or higher. Update iTunes.

==Error 14==
Custom firmware update fail ([[PwnageTool]] until 4.0.1). You have to restore the device with a custom firmware. Update to a custom firmware isn't working. Device isn't bootable. 2

USB Problem. Check the USB connection and try other direct ports or maybe the USB cable is an older one. Device isn't bootable.

You're trying to 'update' to a beta firmware instead of performing a restore. Device is still bootable if you kick it out of recovery mode.

==Error 17==
Device failed to display the applelogo img3 which results in this error.

Hacktivation bug in [[Sn0wbreeze]] 2.0.1, which was fixed in [[Sn0wbreeze]] 2.0.2.

==Error 18==
This occurs when the media library on the device is corrupt and cannot be modified or updated.

Updating to the latest version of iTunes and then restoring should resolve this issue

==Error 20==
Error when downgrading 2.0 to 1.1.1.

==Error 21==
Custom firmware restore fail ([[PwnageTool]] since 4.1). You have to put your device into the DFU mode and not into recovery mode. Device won't boot correctly an stuck at the Apple logo after the error. Press and hold power and home button until it reboots.

==Error 23==
Cannot restore or update due to hardware problems.
*In software you have to set default web browser.
*In hardware, it's a communication problem. Check all connections, also try to change battery.
*faulty baseband flash or processor
*Happens frequently after water damage. Remove and clean motherboard.

==Error 26==
False version of the [[NOR]] flash firmware. Use the correct [[sn0wbreeze]] version.

==Error 28==
Hardware error. Return your device to Apple if possible. The problem is a bad dock connector on the iPhone. Must change the connector.
If you have tried almost everything, reset the logic board (leave uncharged for five days or remove battery for half an hour), then pwn and restore.
if this doesn't work, the "hard disk" of your iPhone is damaged.

==Error 29==
See [http://discussions.apple.com/thread.jspa?threadID=2329795 Apple discussions thread] about this problem. You might need to change the battery.

==Error 34==
Hard disk is run out of space when trying to download TV show's or movie's Please clear space and then continue downloading.

==Error 37==
[[N72ap|iPod touch 2G]] [[LLB]] patched with the [[0x24000 Segment Overflow]] was used on an [[N88ap|iPhone 3GS]] custom firmware. Known on damaged bundles from unofficial [[PwnageTool]] distributions or bundles.

[[Sn0wbreeze]] 2.0.1 bug, which was fixed in [[Sn0wbreeze]] 2.0.2.

recent [[Sn0wbreeze]] can cause this issue. Disable all custom boot logos. If received on an [[N88ap|iPhone 3GS]], select "new boot-rom" and disable all custom bootlogos.

==Error 40==
Hacktivation bug in [[Sn0wbreeze]] 2.0.1, which was fixed in [[Sn0wbreeze]] 2.0.2.

==Error 46==
?

=Errors 10xx=
==Error 1002==
Error when restoring.

==Error 1004==
This is caused by a failure to match the [[AT+XNONCE|Baseband Nonce]] currently in memory to the [[AT+XNONCE|nonce]] returned in the [[Baseband Firmware]] [[SHSH]] blob. This happens if you edited the [[wikipedia:Hosts (file)|hosts file]] ([[Cydia Server|Saurik's Server]]) or you are using [[TinyUmbrella]]. Use [[TinyUmbrella]] and "Kick Device Out Of Recovery" to boot. 1

==Error 1011==
This is caused by recovery mode being in userland (1.1.1 firmware). The file iTunesMobileDevice.dll is damaged or updated.

==Error 1013==
'''iPhone 4'''

This means that the baseband did not get updated. Either remove the gs.apple.com entry from your hosts file and let the baseband upgrade or if you want to preserve the baseband just jailbreak at this point to boot it up.

'''Other Devices'''

Restart computer; change computer; reinstall system, if iPhone is always in restoring mode: XP users can jump from restoring mode with ibus; MAC users can use iNdependence. (usually on the iPhone with 1.0.2 firmware downgraded from 1.1.1)

==Error 1014==
This occurs when you try to downgrade your phone's baseband.

==Error 1015==
This error is common when downgrading [[iPhone]]s and 3G-enabled [[iPad]]s. The problem occurs when the device's [[Baseband Firmware|baseband]] has a higher version number than the baseband in the firmware you restored to. Just set auto-boot true in [[iRecovery]] or use [[iREB]]/[[TinyUmbrella]]/[[RecBoot]].1

=Errors 13xx=
==Error 1394==
When Spirit2Pwn flashes parts of the boot chain on [[iOS]] 4, the device may crash into [[DFU Mode]]. [http://ih8sn0wforums.com/viewtopic.php?f=8&t=3407]

=Errors 14xx=
==Error 1413==
Restart computer; change USB port; reinstall system. See also [http://support.apple.com/kb/TS1927?viewlocale=en_US Apple's KB article].

==Error 1415==
Restart computer; change USB port; reinstall system.

==Error 1417==
Restart computer; change USB port; reinstall system.

==Error 1418==
Restart computer; change USB port; reinstall system.

==Error 1428==
Restart computer; change USB port; reinstall system. (downgrade from www.iphonebus.com)

==Error 1050==
Bad response from gs.apple.com OR need iReb for preparing iPhone for restoring to custom ipsw

=Errors 16xx=
==Error 1600==
Custom firmware can't be restored on a device with [[DFU Mode]]. The software of the iPhone isn't patched. Go into Recovery Mode (Pwnage Tool up to 4.0.1) or start Pwnage Tool and click "DFU" at the top and go with this tutorial into the DFU mode. During that process the software gets patched and the custom firmware should run without any problems.

==Error 1601==
See also this [http://support.apple.com/kb/TA38633 old KB article from Apple].

==Error 1602==
Restart computer; change computer; reinstall system.

If this error occured during an Apple TV restore, then unplug the Apple TV from the power cable, after you entered the recovery or DFU mode, and then try it again.

==Error 1603==
False [[kernelcache]] patch. Known on damaged bundles from unofficial [[PwnageTool]] distributions or bundles. See also [http://support.apple.com/kb/TA38603?viewlocale=en_US Apple KB article]

==Error 1604==
Device was not pwned (signature checks were not blocked). Custom firmware can't be restored. Can also happen when there's a problem with the ipsw.

==Error 1611==
[[iTunes]] tried to enter the [[Restore Mode]], but the device turned back to the [[Recovery Mode]].

==Error 1618==
Missing system files or corrupt data in iTunes installation. Try to uninstall iTunes, restart computer, install again.

==Error 1619 ==
[[iTunes]] is too old and couldn't read the iPhone in Recovery or DFU Mode. Please update iTunes and try it again.

==Error 1644==
[[IPSW File Format|IPSW]] was moved during prepare with [[iTunes]]. Try it again and don't move the IPSW.

=Errors 20xx=
==Error 2001==
The Mac OS X kernel extension "IOUSBFamily" that was bundled with late 2008 / early 2009 MacBooks, as well as the 10.5.6 update, has a bug where it fails to properly recognize an iDevice in [[DFU Mode]]. It can be resolved by updating to 10.5.7 (or later), or using a USB hub.

Also if you have [[Limera1n]] opened during you try to restore the iOS device.

==Error 2002==
[[iTunes]] can't connect because another program is using it or it's disconnected during the Apple Server check.

==Error 2003==
Connection problem; change USB cable and check USB port.

==Error 2005==
Problem connecting. Probably a hardware failure.

=Errors 30xx=
==Error 3002==
*Update to an older firmware isn't working, because Apple is no longer handing out [[SHSH]]s for the device/firmware combination.
*Or a timeout checking Apple server - retry later.
*This error also happens if you try to ''Update'' with a local TSS server ([[TinyUmbrella|TinyUmbrella tool]]) and probably also when connecting to [[Cydia Server]]. Use ''Restore'' instead.

==Error 3004==
No internet connection during the firmware restore.
[[iTunes]] can't connect to gs.apple.com. Maybe Port 80 and Port 443 is blocked. Open it on your router.

==Error 3014==
False edited hosts. The SHSH request couldn't be completed. No connection to the Apple Server, Sauriks Server or localhost.
[[iTunes]] can't connect to gs.apple.com. Maybe Port 80 and Port 443 is blocked. Open it on your router.

=Errors 31xx=
==Error 3123==
Something dealing with movie rentals.

==Error 3191==
QuickTime corrupted must reinstall before iTunes will work or Turn off Compatibility Mode for QuickTime.

1. Right-click on the QuickTimePlayer application (located in C:Program FilesQuickTime) and choose Properties from the shortcut menu.

2. In the Properties window, click on the Compatibility tab Deselect the checkbox labeled “Run this program in compatibility mode for.”

3. Click Apply.

4. Close the Properties window

==Error 3194==
Occurs when trying to install an old firmware and Apple's server disallows the installation. The only solution is to have [[SHSH]] backup and modify the hosts file to point to [[Saurik]]'s [[Cydia Server]] where they are backed up (or localhost if you have it yourself).

==Error 3195==
"An internal error occurred." Missing SHSH for the firmware. Maybe the same as "This device isn't eligible for the request build." but with an cache error.

=Higher Errors=
==Error 11222==
A security software you have installed may be conflicting with iTunes.

==Error 13019==
?

==Error 20000==
Is caused by a custom theme pack on your Windows. Use default Theme.

This error can also be caused by the iDevice rebooting during the "Extracting Firmware" stage of restore.

==Error 20008==
?

This happened on a Mac with TinyUmbrella running before resotring a firmware to the Apple TV.

=Hex codes=
==0xE800001==
Device was suddenly unplugged. [[iTunes]] couldn't connect with the device. Try it again

==0xE8000022==
Error in your firmware files. Restore.

==0xE800003D==
False permissions in the Carrier Bundle folder. Restore, update or fix the permissions from the carrier bundle to update the carrier settings via iTunes.

==0xE800006B==
Device was suddenly unplugged. [[iTunes]] couldn't connect with the device. Try it again.

==0xE8000065==
[[sn0wbreeze]] custom firmware error on USB connection. Unplug the device, reboot it, and plug it in again.

==0xE8008001==
You are trying to install unsigned (cracked?) apps. Step away from this wiki.

=Error texts=
==This device isn't eligible for the requested build==
Apple doesn't sign the firmware anymore. See [[SHSH]].

==The iPhone "xxx" could not be restored because the firmware file is not compatible.==
You downloaded the wrong firmware file (or it is corrupt). Download the correct firmware file that matches your device. Here's an overview of file names (beginning) and devices:
*AppleTV2,1_ [[K66ap|Apple TV 2G]]
*iPad1,1_ [[K48ap|iPad (or 1G or first generation)]]
*iPad2,1_ [[K93ap|iPad 2 Wi-Fi model]]
*iPad2,2_ [[K94ap|iPad 2 GSM model]]
*iPad2,3_ [[K95ap|iPad 2 CDMA model]]
*iPhone1,1_ [[M68ap|iPhone (or 2G or first generation)]]
*iPhone1,2_ [[N82ap|iPhone 3G]]
*iPhone2,1_ [[N88ap|iPhone 3GS]]
*iPhone3,1_ [[N90ap|iPhone 4 GSM model]]
*iPhone3,3_ [[N92ap|iPhone 4 CDMA model]]
*iPod1,1_ [[N45ap|iPod touch (or 1G or first generation)]]
*iPod2,1_ [[N72ap|iPod touch 2G]]
*iPod3,1_ [[N18ap|iPod touch 3G]]
*iPod4,1_ [[N81ap|iPod touch 4G]]

==The iPhone "xxx" cannot be restored at this time because the iPhone software update server could not be contacted or is temporarily unavailable.==
If you want to upgrade or downgrade the baseband, make sure you didn't change the hosts file. The Cydia server cannot handle the requests for the baseband certificates.

== There was a problem downloading the software for the iPhone “XXXXXXX” the network connection was reset, make sure your network settings are correct and your network connection is active, or try again later.==
You need to disable both your antivirus ''and'' your windows/security firewall in order for the update/restore to go through.

----

1 Use [[TinyUmbrella]] (Kick Device out of Recovery), [[iRecovery]] or [[redsn0w Lite]] and enter "setenv auto-boot true", "saveenv", "reboot" to boot.

2 Device isn't bootable, but a custom firmware can be restored if it has a jailbreak and the requirements.

Sn0wbreeze

2011-05-06T18:40:16Z

Sean: /* 4.X */

{{lowercase}}
{{float toc}}
== What is sn0wbreeze? ==
'''sn0wbreeze''' is a tool to create custom [[IPSW File Format|IPSW]]s to restore, similar to [[PwnageTool]]. It is a GUI of [[XPwn]] for Windows written in Visual Basic.Net and is developed by [[User:ih8sn0w|iH8sn0w]]. It is released under GPL v3 license, and its source is available on [https://github.com/iH8sn0w/sn0wbreeze GitHub].

== Versions ==
[[sn0wbreeze]] was first released January 13, 2010 as a beta version. The following versions that are shown here are official, and sorted by compatibility with iOS revisions.

=== 3.X ===
{| class="wikitable" width="100%" style="font-size:smaller;border-collapse:collapse;" border="1"
! style="background-color:#E9E9E9;text-align:center;width:50px;" | Version
! style="background-color:#E9E9E9;text-align:center;width:65px;" | Release date
! style="background-color:#E9E9E9;text-align:center;" | Changes
|-
! Public Beta
| style="text-align:center;" | 13-Jan-2010
|
* Initial release
* Jailbreaks iOS 3.1.2
* Only allows you to be able to select simple mode
* Taken down due to copyright issues with [[XPwn]]
|-
! 1.0
| style="text-align:center;" | 16-Jan-2010
|
* Official release of sn0wbreeze
|-
! 1.1
| style="text-align:center;" | 19-Jan-2010
|
* Fixes [[Cydia Application|Cydia]] problems
* Fixes problems with [[NOR]] on [[S5L8900]] devices
* Fixes custom packages not being installed
|-
! 1.2
| style="text-align:center;" | 21-Jan-2010
|
* GUI fixes
* Fixed even more [[Cydia Application|Cydia]] problems
|-
! 1.3
| style="text-align:center;" | 23-Jan-2010
|
* fixes bug where some [[Cydia Application|Cydia]] repositories could not be added and downloaded from
|-
! 1.4
| style="text-align:center;" | 26-Jan-2010
|
* Fixed vital bug where deb files may not be added to the right place
|-
! 1.5
| style="text-align:center;" | 05-Feb-2010
|
* Jailbreaks iOS 3.1.3
* Removed verbose mode support
|-
! 1.5.1
| style="text-align:center;" | 07-Feb-2010
|
* Removed [[blacksn0w]] due to CommCenter issues (fix being worked on)
|-
|}

=== 4.X ===
{| class="wikitable" width="100%" style="font-size:smaller;border-collapse:collapse;" border="1"
! style="background-color:#E9E9E9;text-align:center;width:50px;" | Version
! style="background-color:#E9E9E9;text-align:center;width:65px;" | Release date
! style="background-color:#E9E9E9;text-align:center;" | Changes
|-
! 1.6
| style="text-align:center;" | 24-Jun-2010
|
* Jailbreaks iOS 4.0 only.
* Removed [[ultrasn0w]] integration. (Due to MuscleNerd's request citing version management issues. Install it through the "custom packages" feature instead.)
* Removed "sn0wbreeze App" integration (discontinued)
|-
! 1.7
| style="text-align:center;" | 06-Jul-2010
|
* Added support for new bootroms in the form of a [[tethered jailbreak]] with [[iBooty]].
|-
! 1.8 Beta
| style="text-align:center;" | 16-Jul-2010
|
* Only for iOS 4.1 beta 1.
* Doesn't support [[hacktivation]].
|-
! 2.0
| style="text-align:center;" | 22-Sep-2010
|
* Added support for "MC model" [[N72ap|iPod touch 2G]] ([[Tethered jailbreak|tethered]] using [[usb_control_msg(0xA1, 1) Exploit]])
* Added Support for [[N18ap|iPod touch 3G]] and [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]]) on iOS 3.1.2
* GUI improvements
* Backwards compatible with 3.1.X
|-
! 2.0.1
| style="text-align:center;" | 22-Sep-2010
|
* Fix for Error 37
|-
! 2.0.2
| style="text-align:center;" | 25-Sep-2010
|
* Fixes for Error 37 and hacktivation.
|-
! 2.1
| style="text-align:center;" | 13-Nov-2010
|
* Jailbreaks iOS 3.2.2/4.1.
* Implemented [[usb_control_msg(0xA1, 1) Exploit|steaks4uce]] and [[limera1n]] exploits.
* Added support for all iOS devices (except [[M68ap|iPhone]] and [[N45ap|iPod touch]])
|-
! 2.2r1
| style="text-align:center;" | 15-Feb-2011
|
* Jailbreaks iOS 4.2.1.
* A new "Baseband Preservation Mode", which allows upgrade without updating the baseband (as usual), but without jailbreaking ([http://twitter.com/iH8sn0w/status/19249886721478656 announced on Dec 27])
|-
! 2.2r2
| style="text-align:center;" | 15-Feb-2011
|
* Includes a fix for iBooks.
|-
! 2.2r3
| style="text-align:center;" | 18-Feb-2011
|
* Fixes iBooks issues on devices still having issues.
|-
! 2.2.1
| style="text-align:center;" | 20-Feb-2011
|
* Fixes for the [[n92ap|iPhone 4 (CDMA model)]]
* Definitely fixes iBooks.
* Drag and drop [[IPSW File Format|IPSWs]].
* Fixes issues with Windows Classic.
|-
! 2.3b1
| style="text-align:center;" | 13-Mar-2011
|
* "For people that want to play around with 4.3 or preserve their baseband. It's BETA for a reason."
|-
! 2.3b2
| style="text-align:center;" | 17-Mar-2011
|
* Adds Multitasking Gestures option in Settings App.
* [[iBooty]] bug fixes (includes [[iBSS]] issues).
* [[iBooty]] is even faster.
* [[Mobile Substrate]] is now working.
* Sleep bug in [[IPod touch|iPod touches]] is fixed.
* Rare [[K48ap|iPad 1G]] issues resolved.
* Added [[iREB]] to top bar for future re-runs within [[sn0wbreeze]].
* [[ultrasn0w]] is still broken.
|-
! 2.3b3
| style="text-align:center;" | 18-Mar-2011
|
* Fixed [[N81ap|iPod touch 4]] [[iBooty]] issues.
|-
! 2.3b4
| style="text-align:center;" | 19-Mar-2011
|
* [[ultrasn0w]] now works for basebands ([[1.59.00]] / [[4.26.08]] / [[5.11.07]] / [[5.12.01]] / [[5.13.04]] / [[6.15.00]])
* Fixed minor GUI + [[iBooty]] bugs.
|-
|-
! 2.4b1
| style="text-align:center;" | 19-Mar-2011
|
* iOS 4.3.1 is now supported
|-
! 2.5
| style="text-align:center;" | 03-Apr-2011
|
* Jailbreaks all iOS 4.3.1 compatible device (except [[iPad 2]]).
|-
! 2.5.1
| style="text-align:center;" | 06-Apr-2011
|
* Cydia 1.1.1 is now pre-installed.
* iPhone 3GS users can now flash the iPad 06.15.00 baseband.
* Animate (Animated Boot Logos) by the Chronic Dev-Team is now supported.
* Added afc2 Apple TV 2 is now fully supported.
* Added Apple TV 2 DFU Instructions.
* YouTube issues resolved on hacktivated devices.
* iPhone 3GS old-bootrom issues fixed (Error 37).
|-
! 2.6
| style="text-align:center;" | 19-Apr-2011
|
* Jailbreaks all iOS 4.3.2/4.2.7 compatible device (except [[iPad 2]]).
* Updated to support i0n1c's 4.3.2/4.2.7 untether.
* Multitasking Gestures enabled as usual.
|-
! 2.7
| style="text-align:center;" | 6-May-2011
|
* Jailbreaks all iOS 4.3.3/4.2.8 compatible device (except [[iPad 2]]).
* Updated to support i0n1c's 4.3.3/4.2.8 untether.
|-
|}

== Resources ==
*[http://ih8sn0w.com/index.php/welcome.snow Download sn0wbreeze]

[[Category:Hacking Software]]
[[Category:GUI Tools]]

Sn0wbreeze

2011-05-06T18:39:41Z

Sean: /* 4.X */

{{lowercase}}
{{float toc}}
== What is sn0wbreeze? ==
'''sn0wbreeze''' is a tool to create custom [[IPSW File Format|IPSW]]s to restore, similar to [[PwnageTool]]. It is a GUI of [[XPwn]] for Windows written in Visual Basic.Net and is developed by [[User:ih8sn0w|iH8sn0w]]. It is released under GPL v3 license, and its source is available on [https://github.com/iH8sn0w/sn0wbreeze GitHub].

== Versions ==
[[sn0wbreeze]] was first released January 13, 2010 as a beta version. The following versions that are shown here are official, and sorted by compatibility with iOS revisions.

=== 3.X ===
{| class="wikitable" width="100%" style="font-size:smaller;border-collapse:collapse;" border="1"
! style="background-color:#E9E9E9;text-align:center;width:50px;" | Version
! style="background-color:#E9E9E9;text-align:center;width:65px;" | Release date
! style="background-color:#E9E9E9;text-align:center;" | Changes
|-
! Public Beta
| style="text-align:center;" | 13-Jan-2010
|
* Initial release
* Jailbreaks iOS 3.1.2
* Only allows you to be able to select simple mode
* Taken down due to copyright issues with [[XPwn]]
|-
! 1.0
| style="text-align:center;" | 16-Jan-2010
|
* Official release of sn0wbreeze
|-
! 1.1
| style="text-align:center;" | 19-Jan-2010
|
* Fixes [[Cydia Application|Cydia]] problems
* Fixes problems with [[NOR]] on [[S5L8900]] devices
* Fixes custom packages not being installed
|-
! 1.2
| style="text-align:center;" | 21-Jan-2010
|
* GUI fixes
* Fixed even more [[Cydia Application|Cydia]] problems
|-
! 1.3
| style="text-align:center;" | 23-Jan-2010
|
* fixes bug where some [[Cydia Application|Cydia]] repositories could not be added and downloaded from
|-
! 1.4
| style="text-align:center;" | 26-Jan-2010
|
* Fixed vital bug where deb files may not be added to the right place
|-
! 1.5
| style="text-align:center;" | 05-Feb-2010
|
* Jailbreaks iOS 3.1.3
* Removed verbose mode support
|-
! 1.5.1
| style="text-align:center;" | 07-Feb-2010
|
* Removed [[blacksn0w]] due to CommCenter issues (fix being worked on)
|-
|}

=== 4.X ===
{| class="wikitable" width="100%" style="font-size:smaller;border-collapse:collapse;" border="1"
! style="background-color:#E9E9E9;text-align:center;width:50px;" | Version
! style="background-color:#E9E9E9;text-align:center;width:65px;" | Release date
! style="background-color:#E9E9E9;text-align:center;" | Changes
|-
! 1.6
| style="text-align:center;" | 24-Jun-2010
|
* Jailbreaks iOS 4.0 only.
* Removed [[ultrasn0w]] integration. (Due to MuscleNerd's request citing version management issues. Install it through the "custom packages" feature instead.)
* Removed "sn0wbreeze App" integration (discontinued)
|-
! 1.7
| style="text-align:center;" | 06-Jul-2010
|
* Added support for new bootroms in the form of a [[tethered jailbreak]] with [[iBooty]].
|-
! 1.8 Beta
| style="text-align:center;" | 16-Jul-2010
|
* Only for iOS 4.1 beta 1.
* Doesn't support [[hacktivation]].
|-
! 2.0
| style="text-align:center;" | 22-Sep-2010
|
* Added support for "MC model" [[N72ap|iPod touch 2G]] ([[Tethered jailbreak|tethered]] using [[usb_control_msg(0xA1, 1) Exploit]])
* Added Support for [[N18ap|iPod touch 3G]] and [[N88ap|iPhone 3GS]] ([[iBoot-359.3.2|new bootrom]]) on iOS 3.1.2
* GUI improvements
* Backwards compatible with 3.1.X
|-
! 2.0.1
| style="text-align:center;" | 22-Sep-2010
|
* Fix for Error 37
|-
! 2.0.2
| style="text-align:center;" | 25-Sep-2010
|
* Fixes for Error 37 and hacktivation.
|-
! 2.1
| style="text-align:center;" | 13-Nov-2010
|
* Jailbreaks iOS 3.2.2/4.1.
* Implemented [[usb_control_msg(0xA1, 1) Exploit|steaks4uce]] and [[limera1n]] exploits.
* Added support for all iOS devices (except [[M68ap|iPhone]] and [[N45ap|iPod touch]])
|-
! 2.2r1
| style="text-align:center;" | 15-Feb-2011
|
* Jailbreaks iOS 4.2.1.
* A new "Baseband Preservation Mode", which allows upgrade without updating the baseband (as usual), but without jailbreaking ([http://twitter.com/iH8sn0w/status/19249886721478656 announced on Dec 27])
|-
! 2.2r2
| style="text-align:center;" | 15-Feb-2011
|
* Includes a fix for iBooks.
|-
! 2.2r3
| style="text-align:center;" | 18-Feb-2011
|
* Fixes iBooks issues on devices still having issues.
|-
! 2.2.1
| style="text-align:center;" | 20-Feb-2011
|
* Fixes for the [[n92ap|iPhone 4 (CDMA model)]]
* Definitely fixes iBooks.
* Drag and drop [[IPSW File Format|IPSWs]].
* Fixes issues with Windows Classic.
|-
! 2.3b1
| style="text-align:center;" | 13-Mar-2011
|
* "For people that want to play around with 4.3 or preserve their baseband. It's BETA for a reason."
|-
! 2.3b2
| style="text-align:center;" | 17-Mar-2011
|
* Adds Multitasking Gestures option in Settings App.
* [[iBooty]] bug fixes (includes [[iBSS]] issues).
* [[iBooty]] is even faster.
* [[Mobile Substrate]] is now working.
* Sleep bug in [[IPod touch|iPod touches]] is fixed.
* Rare [[K48ap|iPad 1G]] issues resolved.
* Added [[iREB]] to top bar for future re-runs within [[sn0wbreeze]].
* [[ultrasn0w]] is still broken.
|-
! 2.3b3
| style="text-align:center;" | 18-Mar-2011
|
* Fixed [[N81ap|iPod touch 4]] [[iBooty]] issues.
|-
! 2.3b4
| style="text-align:center;" | 19-Mar-2011
|
* [[ultrasn0w]] now works for basebands ([[1.59.00]] / [[4.26.08]] / [[5.11.07]] / [[5.12.01]] / [[5.13.04]] / [[6.15.00]])
* Fixed minor GUI + [[iBooty]] bugs.
|-
|-
! 2.4b1
| style="text-align:center;" | 19-Mar-2011
|
* iOS 4.3.1 is now supported
|-
! 2.5
| style="text-align:center;" | 03-Apr-2011
|
* Jailbreaks all iOS 4.3.1 compatible device (except [[iPad 2]]).
|-
! 2.5.1
| style="text-align:center;" | 06-Apr-2011
|
* Cydia 1.1.1 is now pre-installed.
* iPhone 3GS users can now flash the iPad 06.15.00 baseband.
* Animate (Animated Boot Logos) by the Chronic Dev-Team is now supported.
* Added afc2 Apple TV 2 is now fully supported.
* Added Apple TV 2 DFU Instructions.
* YouTube issues resolved on hacktivated devices.
* iPhone 3GS old-bootrom issues fixed (Error 37).
|-
! 2.6
| style="text-align:center;" | 19-Apr-2011
|
* Jailbreaks all iOS 4.3.2/4.2.7 compatible device (except [[iPad 2]]).
* Updated to support i0n1c's 4.3.2/4.2.7 untether.
* Multitasking Gestures enabled as usual.
|-
! 2.7
| style="text-align:center;" | 19-Apr-2011
|
* Jailbreaks all iOS 4.3.3/4.2.8 compatible device (except [[iPad 2]]).
* Updated to support i0n1c's 4.3.3/4.2.8 untether.
|-
|}

== Resources ==
*[http://ih8sn0w.com/index.php/welcome.snow Download sn0wbreeze]

[[Category:Hacking Software]]
[[Category:GUI Tools]]

User:Sean

2011-05-06T18:12:52Z

Sean:

An individual who takes an active part in accurately promoting proper grammar. Sean also takes part in informing the incredibly discriminative and disastrous iPhone OS community of the latest in everything related to iOS Hacking, including, but not limited to: Jailbreaking, tools, and feuds, all of which are frequently produced, updated, and distributed.

Sean is known in any thing to do with iPhone as either "Sean" (Mainly IRC) and by "RawrSean" (Twitter, iOS Social networks (OpenFeint.. etc..) he is known on GameCenter as "¥".

Sean also has a bird named Birdy.

Jailbreak (S5L8920+)

2011-05-06T18:10:13Z

Sean: /* iPad */

When the [[N88ap|iPhone 3GS]] was initially released, Apple did not have enough time to fix the [[0x24000 Segment Overflow]] in the [[S5L8920 (Bootrom)|S5L8920]]. However, in order to flash an exploited [[LLB]] and jailbreak the iPhone 3GS, '''one''' of the following needed to be done:
* Find a new [[iBoot]] exploit every time a new firmware is out.
* Find a way to bypass the [[ECID]] checks.
* Use a bootrom exploit that allows unsigned code execution via USB.

Newer devices (iPhone 3GS with [[iBoot-359.3.2|new bootrom]], [[N18ap|iPod touch 3G]], and subsequent devices) are no longer vulnerable to the [[0x24000 Segment Overflow]] exploit. Many of them are susceptible to geohot's bootrom exploit (originally found in [[limera1n]]), which allows unsigned code execution over USB. Even newer devices, starting with the [[iPad 2]], have no bootrom exploits to run unsigned code ''at all''.

==ECID==
Apple added a new tag to the [[IMG3 File Format]] called ECID. The ECID is ''unique'' to each phone, and its signature is being checked. With this method, Apple attempts to block downgrades once newer firmware becomes available, unless you have a dump of your old firmware's unique IMG3 or signed certificate. Therefore, [[iBoot (Bootloader)|iBoot]] exploits won't be so useful for [[tethered jailbreak]]s, because such exploits will be closed in new firmwares. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html].

The issue with this is that, even with the [[0x24000 Segment Overflow]] still in [[bootrom]], an iBoot exploit was still needed to actually flash the exploited [[LLB]]. Apple uses this ECID stuff to block downgrading iBoot to a vulnerable version. It was resolved when Geohot released his [[limera1n]] tool, which used a bootrom exploit to upload an unsigned iBoot. Still the problem remains with newer devices with the [[0x24000 Segment Overflow]] fixed - tampering with firmware makes such jailbreak tethered unless some other exploit is used.

There are methods to help keep your downgrading ability, though.

* If it receives your ECID, saurik's servers will actively cache the necessary files. [http://www.saurik.com/id/12#howto Instructions] to use the servers are available.
* The [[SHSH]] associated with an ECID can be also saved by running [[TinyUmbrella]]. [[TinyUmbrella]] allows the user to restore to whatever version is associated with that [[SHSH]] file permanently. This is based on the aforementioned service [[Saurik]] provides remotely from [[Cydia Server|his server(s)]].

==Jailbreak tools ==
===[[K66ap |Apple TV 2G]]===
'''NOTE:''' The version in parentheses is what the Apple TV reports on TV.
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="5"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (4.0)
|style="width:100px;"| 4.2 (4.1)
|style="width:100px;"| 4.2.1 (4.1.1)
|style="width:100px;"| 4.3 Build 8F191m (4.2)
|style="width:100px;"| 4.3 Build 8F202 (4.2.1)
|-
| [[limera1n]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.5}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{partial|no package management GUI}}
| {{no}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{partial|no package management GUI}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
|-
| [[Seas0nPass]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{yes|0.7.4 (Mac) 
0.3.7 (Windows)}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
|-
|}
1 [[Tethered jailbreak]].

===[[K48ap|iPad]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="8"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.2
|style="width:100px;"| 3.2.1
|style="width:100px;"| 3.2.2
|style="width:150px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[Spirit]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

=== [[iPad 2]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:90px;"| 4.3
|style="width:90px;"| 4.3.1
|style="width:90px;"| 4.3.2
|style="width:90px;"| 4.3.3
|-
|}

===[[N88ap|iPhone 3GS]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="14"| Works with [[firmware]]...
|-
|style="width:90px;"| 3.0
|style="width:90px;"| 3.0.1
|style="width:90px;"| 3.1
|style="width:90px;"| 3.1.2
|style="width:90px;"| 3.1.3
|style="width:90px;"| 4.0
|style="width:90px;"| 4.0.1
|style="width:90px;"| 4.0.2
|style="width:90px;"| 4.1
|style="width:90px;"| 4.2.1
|style="width:90px;"| 4.3
|style="width:90px;"| 4.3.1
|style="width:90px;"| 4.3.2
|style="width:90px;"| 4.3.3
|-
| [[purplera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.8}}
| {{yes|0.8}}
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[blackra1n]]
| {{no}}
| {{no}}
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Spirit]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{partial|Restore from a custom firmware2}}
| {{yes|3.1.42}}
|colspan="2" {{partial|Restore from a custom firmware2}}
|colspan="2" {{partial|Restore from a custom firmware with unofficial firmware bundle2}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{yes|4.213}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.0.21 2}}
| {{yes|2.0.21 2}}
| {{yes|2.0.21 2}}
|colspan="2" {{yes|2.0.21 2}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|}
1 [[Tethered jailbreak]] on devices with the [[iBoot-359.3.2|new bootrom]].

2 Only applicable for devices with the [[iBoot-359.3|old bootrom]]. Requires the device to have signature checks disabled (pwned).

3 Requires an unofficial firmware bundle.

===[[N90ap|iPhone 4 (GSM model)]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="9"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.1
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC5.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{yes|4.21 3}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

3 Requires an unofficial firmware bundle

===[[N92ap|iPhone 4 (CDMA model)]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.2.5
|style="width:100px;"| 4.2.6
|style="width:100px;"| 4.2.7
|style="width:100px;"| 4.2.8
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3.3}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.6rc14}}
| {{no}}
| {{yes|0.9.6rc15}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.2}}
| {{yes|2.6.1}}
| {{yes|2.7}}
|}

===[[N18ap|iPod touch 3G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="11"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.1.1
|style="width:100px;"| 3.1.2
|style="width:100px;"| 3.1.3
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[blackra1n]]
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.9.31}}
| {{yes|0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[Spirit]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|}
1 [[Tethered jailbreak]].

===[[N81ap |iPod touch 4G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="6"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (both builds)
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[limera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[redsn0w]]
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

Jailbreak (S5L8920+)

2011-05-06T18:09:58Z

Sean: /* iPhone 3GS */

When the [[N88ap|iPhone 3GS]] was initially released, Apple did not have enough time to fix the [[0x24000 Segment Overflow]] in the [[S5L8920 (Bootrom)|S5L8920]]. However, in order to flash an exploited [[LLB]] and jailbreak the iPhone 3GS, '''one''' of the following needed to be done:
* Find a new [[iBoot]] exploit every time a new firmware is out.
* Find a way to bypass the [[ECID]] checks.
* Use a bootrom exploit that allows unsigned code execution via USB.

Newer devices (iPhone 3GS with [[iBoot-359.3.2|new bootrom]], [[N18ap|iPod touch 3G]], and subsequent devices) are no longer vulnerable to the [[0x24000 Segment Overflow]] exploit. Many of them are susceptible to geohot's bootrom exploit (originally found in [[limera1n]]), which allows unsigned code execution over USB. Even newer devices, starting with the [[iPad 2]], have no bootrom exploits to run unsigned code ''at all''.

==ECID==
Apple added a new tag to the [[IMG3 File Format]] called ECID. The ECID is ''unique'' to each phone, and its signature is being checked. With this method, Apple attempts to block downgrades once newer firmware becomes available, unless you have a dump of your old firmware's unique IMG3 or signed certificate. Therefore, [[iBoot (Bootloader)|iBoot]] exploits won't be so useful for [[tethered jailbreak]]s, because such exploits will be closed in new firmwares. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html].

The issue with this is that, even with the [[0x24000 Segment Overflow]] still in [[bootrom]], an iBoot exploit was still needed to actually flash the exploited [[LLB]]. Apple uses this ECID stuff to block downgrading iBoot to a vulnerable version. It was resolved when Geohot released his [[limera1n]] tool, which used a bootrom exploit to upload an unsigned iBoot. Still the problem remains with newer devices with the [[0x24000 Segment Overflow]] fixed - tampering with firmware makes such jailbreak tethered unless some other exploit is used.

There are methods to help keep your downgrading ability, though.

* If it receives your ECID, saurik's servers will actively cache the necessary files. [http://www.saurik.com/id/12#howto Instructions] to use the servers are available.
* The [[SHSH]] associated with an ECID can be also saved by running [[TinyUmbrella]]. [[TinyUmbrella]] allows the user to restore to whatever version is associated with that [[SHSH]] file permanently. This is based on the aforementioned service [[Saurik]] provides remotely from [[Cydia Server|his server(s)]].

==Jailbreak tools ==
===[[K66ap |Apple TV 2G]]===
'''NOTE:''' The version in parentheses is what the Apple TV reports on TV.
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="5"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (4.0)
|style="width:100px;"| 4.2 (4.1)
|style="width:100px;"| 4.2.1 (4.1.1)
|style="width:100px;"| 4.3 Build 8F191m (4.2)
|style="width:100px;"| 4.3 Build 8F202 (4.2.1)
|-
| [[limera1n]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.5}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{partial|no package management GUI}}
| {{no}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{partial|no package management GUI}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
|-
| [[Seas0nPass]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{yes|0.7.4 (Mac) 
0.3.7 (Windows)}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
|-
|}
1 [[Tethered jailbreak]].

===[[K48ap|iPad]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="8"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.2
|style="width:100px;"| 3.2.1
|style="width:100px;"| 3.2.2
|style="width:150px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[Spirit]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

=== [[iPad 2]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:90px;"| 4.3
|style="width:90px;"| 4.3.1
|style="width:90px;"| 4.3.2
|style="width:90px;"| 4.3.3
|-
|}

===[[N88ap|iPhone 3GS]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="14"| Works with [[firmware]]...
|-
|style="width:90px;"| 3.0
|style="width:90px;"| 3.0.1
|style="width:90px;"| 3.1
|style="width:90px;"| 3.1.2
|style="width:90px;"| 3.1.3
|style="width:90px;"| 4.0
|style="width:90px;"| 4.0.1
|style="width:90px;"| 4.0.2
|style="width:90px;"| 4.1
|style="width:90px;"| 4.2.1
|style="width:90px;"| 4.3
|style="width:90px;"| 4.3.1
|style="width:90px;"| 4.3.2
|style="width:90px;"| 4.3.3
|-
| [[purplera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.8}}
| {{yes|0.8}}
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[blackra1n]]
| {{no}}
| {{no}}
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Spirit]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{partial|Restore from a custom firmware2}}
| {{yes|3.1.42}}
|colspan="2" {{partial|Restore from a custom firmware2}}
|colspan="2" {{partial|Restore from a custom firmware with unofficial firmware bundle2}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{yes|4.213}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.0.21 2}}
| {{yes|2.0.21 2}}
| {{yes|2.0.21 2}}
|colspan="2" {{yes|2.0.21 2}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|}
1 [[Tethered jailbreak]] on devices with the [[iBoot-359.3.2|new bootrom]].

2 Only applicable for devices with the [[iBoot-359.3|old bootrom]]. Requires the device to have signature checks disabled (pwned).

3 Requires an unofficial firmware bundle.

===[[N90ap|iPhone 4 (GSM model)]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="9"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.1
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC5.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{yes|4.21 3}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

3 Requires an unofficial firmware bundle

===[[N92ap|iPhone 4 (CDMA model)]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.2.5
|style="width:100px;"| 4.2.6
|style="width:100px;"| 4.2.7
|style="width:100px;"| 4.2.8
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3.3}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.6rc14}}
| {{no}}
| {{yes|0.9.6rc15}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.2}}
| {{yes|2.6.1}}
| {{yes|2.7}}
|}

===[[N18ap|iPod touch 3G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="11"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.1.1
|style="width:100px;"| 3.1.2
|style="width:100px;"| 3.1.3
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[blackra1n]]
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.9.31}}
| {{yes|0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[Spirit]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|}
1 [[Tethered jailbreak]].

===[[N81ap |iPod touch 4G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="6"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (both builds)
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[limera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[redsn0w]]
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

Jailbreak (S5L8920+)

2011-05-06T18:09:33Z

Sean: /* iPhone 4 (GSM model) */

When the [[N88ap|iPhone 3GS]] was initially released, Apple did not have enough time to fix the [[0x24000 Segment Overflow]] in the [[S5L8920 (Bootrom)|S5L8920]]. However, in order to flash an exploited [[LLB]] and jailbreak the iPhone 3GS, '''one''' of the following needed to be done:
* Find a new [[iBoot]] exploit every time a new firmware is out.
* Find a way to bypass the [[ECID]] checks.
* Use a bootrom exploit that allows unsigned code execution via USB.

Newer devices (iPhone 3GS with [[iBoot-359.3.2|new bootrom]], [[N18ap|iPod touch 3G]], and subsequent devices) are no longer vulnerable to the [[0x24000 Segment Overflow]] exploit. Many of them are susceptible to geohot's bootrom exploit (originally found in [[limera1n]]), which allows unsigned code execution over USB. Even newer devices, starting with the [[iPad 2]], have no bootrom exploits to run unsigned code ''at all''.

==ECID==
Apple added a new tag to the [[IMG3 File Format]] called ECID. The ECID is ''unique'' to each phone, and its signature is being checked. With this method, Apple attempts to block downgrades once newer firmware becomes available, unless you have a dump of your old firmware's unique IMG3 or signed certificate. Therefore, [[iBoot (Bootloader)|iBoot]] exploits won't be so useful for [[tethered jailbreak]]s, because such exploits will be closed in new firmwares. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html].

The issue with this is that, even with the [[0x24000 Segment Overflow]] still in [[bootrom]], an iBoot exploit was still needed to actually flash the exploited [[LLB]]. Apple uses this ECID stuff to block downgrading iBoot to a vulnerable version. It was resolved when Geohot released his [[limera1n]] tool, which used a bootrom exploit to upload an unsigned iBoot. Still the problem remains with newer devices with the [[0x24000 Segment Overflow]] fixed - tampering with firmware makes such jailbreak tethered unless some other exploit is used.

There are methods to help keep your downgrading ability, though.

* If it receives your ECID, saurik's servers will actively cache the necessary files. [http://www.saurik.com/id/12#howto Instructions] to use the servers are available.
* The [[SHSH]] associated with an ECID can be also saved by running [[TinyUmbrella]]. [[TinyUmbrella]] allows the user to restore to whatever version is associated with that [[SHSH]] file permanently. This is based on the aforementioned service [[Saurik]] provides remotely from [[Cydia Server|his server(s)]].

==Jailbreak tools ==
===[[K66ap |Apple TV 2G]]===
'''NOTE:''' The version in parentheses is what the Apple TV reports on TV.
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="5"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (4.0)
|style="width:100px;"| 4.2 (4.1)
|style="width:100px;"| 4.2.1 (4.1.1)
|style="width:100px;"| 4.3 Build 8F191m (4.2)
|style="width:100px;"| 4.3 Build 8F202 (4.2.1)
|-
| [[limera1n]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.5}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{partial|no package management GUI}}
| {{no}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{partial|no package management GUI}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
|-
| [[Seas0nPass]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{yes|0.7.4 (Mac) 
0.3.7 (Windows)}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
|-
|}
1 [[Tethered jailbreak]].

===[[K48ap|iPad]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="8"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.2
|style="width:100px;"| 3.2.1
|style="width:100px;"| 3.2.2
|style="width:150px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[Spirit]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

=== [[iPad 2]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:90px;"| 4.3
|style="width:90px;"| 4.3.1
|style="width:90px;"| 4.3.2
|style="width:90px;"| 4.3.3
|-
|}

===[[N88ap|iPhone 3GS]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="14"| Works with [[firmware]]...
|-
|style="width:90px;"| 3.0
|style="width:90px;"| 3.0.1
|style="width:90px;"| 3.1
|style="width:90px;"| 3.1.2
|style="width:90px;"| 3.1.3
|style="width:90px;"| 4.0
|style="width:90px;"| 4.0.1
|style="width:90px;"| 4.0.2
|style="width:90px;"| 4.1
|style="width:90px;"| 4.2.1
|style="width:90px;"| 4.3
|style="width:90px;"| 4.3.1
|style="width:90px;"| 4.3.2
|style="width:90px;"| 4.3.3
|-
| [[purplera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.8}}
| {{yes|0.8}}
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[blackra1n]]
| {{no}}
| {{no}}
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Spirit]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{partial|Restore from a custom firmware2}}
| {{yes|3.1.42}}
|colspan="2" {{partial|Restore from a custom firmware2}}
|colspan="2" {{partial|Restore from a custom firmware with unofficial firmware bundle2}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{yes|4.213}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.0.21 2}}
| {{yes|2.0.21 2}}
| {{yes|2.0.21 2}}
|colspan="2" {{yes|2.0.21 2}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|}
1 [[Tethered jailbreak]] on devices with the [[iBoot-359.3.2|new bootrom]].

2 Only applicable for devices with the [[iBoot-359.3|old bootrom]]. Requires the device to have signature checks disabled (pwned).

3 Requires an unofficial firmware bundle.

===[[N90ap|iPhone 4 (GSM model)]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="9"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.1
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC5.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{yes|4.21 3}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

3 Requires an unofficial firmware bundle

===[[N92ap|iPhone 4 (CDMA model)]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.2.5
|style="width:100px;"| 4.2.6
|style="width:100px;"| 4.2.7
|style="width:100px;"| 4.2.8
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3.3}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.6rc14}}
| {{no}}
| {{yes|0.9.6rc15}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.2}}
| {{yes|2.6.1}}
| {{yes|2.7}}
|}

===[[N18ap|iPod touch 3G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="11"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.1.1
|style="width:100px;"| 3.1.2
|style="width:100px;"| 3.1.3
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[blackra1n]]
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.9.31}}
| {{yes|0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[Spirit]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|}
1 [[Tethered jailbreak]].

===[[N81ap |iPod touch 4G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="6"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (both builds)
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[limera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[redsn0w]]
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

Jailbreak (S5L8920+)

2011-05-06T18:09:19Z

Sean: /* iPhone 4 (CDMA model) */

When the [[N88ap|iPhone 3GS]] was initially released, Apple did not have enough time to fix the [[0x24000 Segment Overflow]] in the [[S5L8920 (Bootrom)|S5L8920]]. However, in order to flash an exploited [[LLB]] and jailbreak the iPhone 3GS, '''one''' of the following needed to be done:
* Find a new [[iBoot]] exploit every time a new firmware is out.
* Find a way to bypass the [[ECID]] checks.
* Use a bootrom exploit that allows unsigned code execution via USB.

Newer devices (iPhone 3GS with [[iBoot-359.3.2|new bootrom]], [[N18ap|iPod touch 3G]], and subsequent devices) are no longer vulnerable to the [[0x24000 Segment Overflow]] exploit. Many of them are susceptible to geohot's bootrom exploit (originally found in [[limera1n]]), which allows unsigned code execution over USB. Even newer devices, starting with the [[iPad 2]], have no bootrom exploits to run unsigned code ''at all''.

==ECID==
Apple added a new tag to the [[IMG3 File Format]] called ECID. The ECID is ''unique'' to each phone, and its signature is being checked. With this method, Apple attempts to block downgrades once newer firmware becomes available, unless you have a dump of your old firmware's unique IMG3 or signed certificate. Therefore, [[iBoot (Bootloader)|iBoot]] exploits won't be so useful for [[tethered jailbreak]]s, because such exploits will be closed in new firmwares. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html].

The issue with this is that, even with the [[0x24000 Segment Overflow]] still in [[bootrom]], an iBoot exploit was still needed to actually flash the exploited [[LLB]]. Apple uses this ECID stuff to block downgrading iBoot to a vulnerable version. It was resolved when Geohot released his [[limera1n]] tool, which used a bootrom exploit to upload an unsigned iBoot. Still the problem remains with newer devices with the [[0x24000 Segment Overflow]] fixed - tampering with firmware makes such jailbreak tethered unless some other exploit is used.

There are methods to help keep your downgrading ability, though.

* If it receives your ECID, saurik's servers will actively cache the necessary files. [http://www.saurik.com/id/12#howto Instructions] to use the servers are available.
* The [[SHSH]] associated with an ECID can be also saved by running [[TinyUmbrella]]. [[TinyUmbrella]] allows the user to restore to whatever version is associated with that [[SHSH]] file permanently. This is based on the aforementioned service [[Saurik]] provides remotely from [[Cydia Server|his server(s)]].

==Jailbreak tools ==
===[[K66ap |Apple TV 2G]]===
'''NOTE:''' The version in parentheses is what the Apple TV reports on TV.
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="5"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (4.0)
|style="width:100px;"| 4.2 (4.1)
|style="width:100px;"| 4.2.1 (4.1.1)
|style="width:100px;"| 4.3 Build 8F191m (4.2)
|style="width:100px;"| 4.3 Build 8F202 (4.2.1)
|-
| [[limera1n]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.5}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{partial|no package management GUI}}
| {{no}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{partial|no package management GUI}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
|-
| [[Seas0nPass]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{yes|0.7.4 (Mac) 
0.3.7 (Windows)}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
|-
|}
1 [[Tethered jailbreak]].

===[[K48ap|iPad]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="8"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.2
|style="width:100px;"| 3.2.1
|style="width:100px;"| 3.2.2
|style="width:150px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[Spirit]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

=== [[iPad 2]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:90px;"| 4.3
|style="width:90px;"| 4.3.1
|style="width:90px;"| 4.3.2
|style="width:90px;"| 4.3.3
|-
|}

===[[N88ap|iPhone 3GS]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="14"| Works with [[firmware]]...
|-
|style="width:90px;"| 3.0
|style="width:90px;"| 3.0.1
|style="width:90px;"| 3.1
|style="width:90px;"| 3.1.2
|style="width:90px;"| 3.1.3
|style="width:90px;"| 4.0
|style="width:90px;"| 4.0.1
|style="width:90px;"| 4.0.2
|style="width:90px;"| 4.1
|style="width:90px;"| 4.2.1
|style="width:90px;"| 4.3
|style="width:90px;"| 4.3.1
|style="width:90px;"| 4.3.2
|style="width:90px;"| 4.3.3
|-
| [[purplera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.8}}
| {{yes|0.8}}
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[blackra1n]]
| {{no}}
| {{no}}
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Spirit]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{partial|Restore from a custom firmware2}}
| {{yes|3.1.42}}
|colspan="2" {{partial|Restore from a custom firmware2}}
|colspan="2" {{partial|Restore from a custom firmware with unofficial firmware bundle2}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{yes|4.213}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.0.21 2}}
| {{yes|2.0.21 2}}
| {{yes|2.0.21 2}}
|colspan="2" {{yes|2.0.21 2}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|}
1 [[Tethered jailbreak]] on devices with the [[iBoot-359.3.2|new bootrom]].

2 Only applicable for devices with the [[iBoot-359.3|old bootrom]]. Requires the device to have signature checks disabled (pwned).

3 Requires an unofficial firmware bundle.

===[[N90ap|iPhone 4 (GSM model)]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="9"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.1
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC5.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{yes|4.21 3}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

3 Requires an unofficial firmware bundle

===[[N92ap|iPhone 4 (CDMA model)]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.2.5
|style="width:100px;"| 4.2.6
|style="width:100px;"| 4.2.7
|style="width:100px;"| 4.2.8
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3.3}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.6rc14}}
| {{no}}
| {{yes|0.9.6rc15}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.2}}
| {{yes|2.6.1}}
| {{yes|2.7}}
|}

===[[N18ap|iPod touch 3G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="11"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.1.1
|style="width:100px;"| 3.1.2
|style="width:100px;"| 3.1.3
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[blackra1n]]
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.9.31}}
| {{yes|0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[Spirit]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|}
1 [[Tethered jailbreak]].

===[[N81ap |iPod touch 4G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="6"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (both builds)
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[limera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[redsn0w]]
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

Jailbreak (S5L8920+)

2011-05-06T18:07:20Z

Sean: /* iPod touch 3G */

When the [[N88ap|iPhone 3GS]] was initially released, Apple did not have enough time to fix the [[0x24000 Segment Overflow]] in the [[S5L8920 (Bootrom)|S5L8920]]. However, in order to flash an exploited [[LLB]] and jailbreak the iPhone 3GS, '''one''' of the following needed to be done:
* Find a new [[iBoot]] exploit every time a new firmware is out.
* Find a way to bypass the [[ECID]] checks.
* Use a bootrom exploit that allows unsigned code execution via USB.

Newer devices (iPhone 3GS with [[iBoot-359.3.2|new bootrom]], [[N18ap|iPod touch 3G]], and subsequent devices) are no longer vulnerable to the [[0x24000 Segment Overflow]] exploit. Many of them are susceptible to geohot's bootrom exploit (originally found in [[limera1n]]), which allows unsigned code execution over USB. Even newer devices, starting with the [[iPad 2]], have no bootrom exploits to run unsigned code ''at all''.

==ECID==
Apple added a new tag to the [[IMG3 File Format]] called ECID. The ECID is ''unique'' to each phone, and its signature is being checked. With this method, Apple attempts to block downgrades once newer firmware becomes available, unless you have a dump of your old firmware's unique IMG3 or signed certificate. Therefore, [[iBoot (Bootloader)|iBoot]] exploits won't be so useful for [[tethered jailbreak]]s, because such exploits will be closed in new firmwares. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html].

The issue with this is that, even with the [[0x24000 Segment Overflow]] still in [[bootrom]], an iBoot exploit was still needed to actually flash the exploited [[LLB]]. Apple uses this ECID stuff to block downgrading iBoot to a vulnerable version. It was resolved when Geohot released his [[limera1n]] tool, which used a bootrom exploit to upload an unsigned iBoot. Still the problem remains with newer devices with the [[0x24000 Segment Overflow]] fixed - tampering with firmware makes such jailbreak tethered unless some other exploit is used.

There are methods to help keep your downgrading ability, though.

* If it receives your ECID, saurik's servers will actively cache the necessary files. [http://www.saurik.com/id/12#howto Instructions] to use the servers are available.
* The [[SHSH]] associated with an ECID can be also saved by running [[TinyUmbrella]]. [[TinyUmbrella]] allows the user to restore to whatever version is associated with that [[SHSH]] file permanently. This is based on the aforementioned service [[Saurik]] provides remotely from [[Cydia Server|his server(s)]].

==Jailbreak tools ==
===[[K66ap |Apple TV 2G]]===
'''NOTE:''' The version in parentheses is what the Apple TV reports on TV.
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="5"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (4.0)
|style="width:100px;"| 4.2 (4.1)
|style="width:100px;"| 4.2.1 (4.1.1)
|style="width:100px;"| 4.3 Build 8F191m (4.2)
|style="width:100px;"| 4.3 Build 8F202 (4.2.1)
|-
| [[limera1n]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.5}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{partial|no package management GUI}}
| {{no}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{partial|no package management GUI}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
|-
| [[Seas0nPass]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{yes|0.7.4 (Mac) 
0.3.7 (Windows)}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
|-
|}
1 [[Tethered jailbreak]].

===[[K48ap|iPad]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="8"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.2
|style="width:100px;"| 3.2.1
|style="width:100px;"| 3.2.2
|style="width:150px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[Spirit]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

=== [[iPad 2]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:90px;"| 4.3
|style="width:90px;"| 4.3.1
|style="width:90px;"| 4.3.2
|style="width:90px;"| 4.3.3
|-
|}

===[[N88ap|iPhone 3GS]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="14"| Works with [[firmware]]...
|-
|style="width:90px;"| 3.0
|style="width:90px;"| 3.0.1
|style="width:90px;"| 3.1
|style="width:90px;"| 3.1.2
|style="width:90px;"| 3.1.3
|style="width:90px;"| 4.0
|style="width:90px;"| 4.0.1
|style="width:90px;"| 4.0.2
|style="width:90px;"| 4.1
|style="width:90px;"| 4.2.1
|style="width:90px;"| 4.3
|style="width:90px;"| 4.3.1
|style="width:90px;"| 4.3.2
|style="width:90px;"| 4.3.3
|-
| [[purplera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.8}}
| {{yes|0.8}}
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[blackra1n]]
| {{no}}
| {{no}}
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Spirit]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{partial|Restore from a custom firmware2}}
| {{yes|3.1.42}}
|colspan="2" {{partial|Restore from a custom firmware2}}
|colspan="2" {{partial|Restore from a custom firmware with unofficial firmware bundle2}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{yes|4.213}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.0.21 2}}
| {{yes|2.0.21 2}}
| {{yes|2.0.21 2}}
|colspan="2" {{yes|2.0.21 2}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|}
1 [[Tethered jailbreak]] on devices with the [[iBoot-359.3.2|new bootrom]].

2 Only applicable for devices with the [[iBoot-359.3|old bootrom]]. Requires the device to have signature checks disabled (pwned).

3 Requires an unofficial firmware bundle.

===[[N90ap|iPhone 4 (GSM model)]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="9"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.1
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC5.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{yes|4.21 3}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

3 Requires an unofficial firmware bundle

===[[N92ap|iPhone 4 (CDMA model)]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.2.5
|style="width:100px;"| 4.2.6
|style="width:100px;"| 4.2.7
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{yes|RC6.1}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{yes|4.2}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.6rc14}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.2}}
| {{yes|2.6.1}}
|}

===[[N18ap|iPod touch 3G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="11"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.1.1
|style="width:100px;"| 3.1.2
|style="width:100px;"| 3.1.3
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[blackra1n]]
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.9.31}}
| {{yes|0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[Spirit]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|}
1 [[Tethered jailbreak]].

===[[N81ap |iPod touch 4G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="6"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (both builds)
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[limera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[redsn0w]]
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

Jailbreak (S5L8920+)

2011-05-06T18:06:38Z

Sean: /* iPod touch 4G */

When the [[N88ap|iPhone 3GS]] was initially released, Apple did not have enough time to fix the [[0x24000 Segment Overflow]] in the [[S5L8920 (Bootrom)|S5L8920]]. However, in order to flash an exploited [[LLB]] and jailbreak the iPhone 3GS, '''one''' of the following needed to be done:
* Find a new [[iBoot]] exploit every time a new firmware is out.
* Find a way to bypass the [[ECID]] checks.
* Use a bootrom exploit that allows unsigned code execution via USB.

Newer devices (iPhone 3GS with [[iBoot-359.3.2|new bootrom]], [[N18ap|iPod touch 3G]], and subsequent devices) are no longer vulnerable to the [[0x24000 Segment Overflow]] exploit. Many of them are susceptible to geohot's bootrom exploit (originally found in [[limera1n]]), which allows unsigned code execution over USB. Even newer devices, starting with the [[iPad 2]], have no bootrom exploits to run unsigned code ''at all''.

==ECID==
Apple added a new tag to the [[IMG3 File Format]] called ECID. The ECID is ''unique'' to each phone, and its signature is being checked. With this method, Apple attempts to block downgrades once newer firmware becomes available, unless you have a dump of your old firmware's unique IMG3 or signed certificate. Therefore, [[iBoot (Bootloader)|iBoot]] exploits won't be so useful for [[tethered jailbreak]]s, because such exploits will be closed in new firmwares. [http://iphonejtag.blogspot.com/2009/06/ecid-field-downgrades-no-dice.html].

The issue with this is that, even with the [[0x24000 Segment Overflow]] still in [[bootrom]], an iBoot exploit was still needed to actually flash the exploited [[LLB]]. Apple uses this ECID stuff to block downgrading iBoot to a vulnerable version. It was resolved when Geohot released his [[limera1n]] tool, which used a bootrom exploit to upload an unsigned iBoot. Still the problem remains with newer devices with the [[0x24000 Segment Overflow]] fixed - tampering with firmware makes such jailbreak tethered unless some other exploit is used.

There are methods to help keep your downgrading ability, though.

* If it receives your ECID, saurik's servers will actively cache the necessary files. [http://www.saurik.com/id/12#howto Instructions] to use the servers are available.
* The [[SHSH]] associated with an ECID can be also saved by running [[TinyUmbrella]]. [[TinyUmbrella]] allows the user to restore to whatever version is associated with that [[SHSH]] file permanently. This is based on the aforementioned service [[Saurik]] provides remotely from [[Cydia Server|his server(s)]].

==Jailbreak tools ==
===[[K66ap |Apple TV 2G]]===
'''NOTE:''' The version in parentheses is what the Apple TV reports on TV.
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="5"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (4.0)
|style="width:100px;"| 4.2 (4.1)
|style="width:100px;"| 4.2.1 (4.1.1)
|style="width:100px;"| 4.3 Build 8F191m (4.2)
|style="width:100px;"| 4.3 Build 8F202 (4.2.1)
|-
| [[limera1n]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{partial|no package management GUI}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.5}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{partial|no package management GUI}}
| {{no}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{partial|no package management GUI}}
| {{partial|Restore from a custom firmware with unofficial bundle1}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
|-
| [[Seas0nPass]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{yes|0.7.4 (Mac) 
0.3.7 (Windows)}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
|-
|}
1 [[Tethered jailbreak]].

===[[K48ap|iPad]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="8"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.2
|style="width:100px;"| 3.2.1
|style="width:100px;"| 3.2.2
|style="width:150px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[Spirit]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

=== [[iPad 2]] ===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
! rowspan="2"| [[Jailbreak]] Tool
!colspan="4"| Works with [[firmware]]...
|-
|style="width:90px;"| 4.3
|style="width:90px;"| 4.3.1
|style="width:90px;"| 4.3.2
|style="width:90px;"| 4.3.3
|-
|}

===[[N88ap|iPhone 3GS]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="14"| Works with [[firmware]]...
|-
|style="width:90px;"| 3.0
|style="width:90px;"| 3.0.1
|style="width:90px;"| 3.1
|style="width:90px;"| 3.1.2
|style="width:90px;"| 3.1.3
|style="width:90px;"| 4.0
|style="width:90px;"| 4.0.1
|style="width:90px;"| 4.0.2
|style="width:90px;"| 4.1
|style="width:90px;"| 4.2.1
|style="width:90px;"| 4.3
|style="width:90px;"| 4.3.1
|style="width:90px;"| 4.3.2
|style="width:90px;"| 4.3.3
|-
| [[purplera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.8}}
| {{yes|0.8}}
| {{yes|0.9.21 or 0.9.31}}
| {{yes|0.9.21 or 0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[blackra1n]]
| {{no}}
| {{no}}
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Spirit]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{partial|Restore from a custom firmware2}}
| {{yes|3.1.42}}
|colspan="2" {{partial|Restore from a custom firmware2}}
|colspan="2" {{partial|Restore from a custom firmware with unofficial firmware bundle2}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{yes|4.213}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.0.21 2}}
| {{yes|2.0.21 2}}
| {{yes|2.0.21 2}}
|colspan="2" {{yes|2.0.21 2}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|}
1 [[Tethered jailbreak]] on devices with the [[iBoot-359.3.2|new bootrom]].

2 Only applicable for devices with the [[iBoot-359.3|old bootrom]]. Requires the device to have signature checks disabled (pwned).

3 Requires an unofficial firmware bundle.

===[[N90ap|iPhone 4 (GSM model)]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="9"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.1
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[Star]]
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[limera1n]]
| {{yes}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC5.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{yes|4.21 3}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{no}}
| {{no}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

3 Requires an unofficial firmware bundle

===[[N92ap|iPhone 4 (CDMA model)]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="3"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.2.5
|style="width:100px;"| 4.2.6
|style="width:100px;"| 4.2.7
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{yes|RC6.1}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{yes|4.2}}
| {{no}}
|-
| [[redsn0w]]
| {{no}}
| {{yes|0.9.6rc14}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.2}}
| {{yes|2.6.1}}
|}

===[[N18ap|iPod touch 3G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="11"| Works with [[firmware]]...
|-
|style="width:100px;"| 3.1.1
|style="width:100px;"| 3.1.2
|style="width:100px;"| 3.1.3
|style="width:100px;"| 4.0
|style="width:100px;"| 4.0.2
|style="width:100px;"| 4.1
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[blackra1n]]
| {{yes|Yes1}}
| {{yes|Yes1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[redsn0w]]
| {{yes|0.9.31}}
| {{yes|0.9.31}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|-
| [[Spirit]]
| {{no}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Star]]
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[sn0wbreeze]]
| {{no}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.0.21}}
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{no}}
|-
| [[limera1n]]
| {{no}}
| {{no}}
| {{no}}
| {{yes}}
| {{yes}}
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|}
1 [[Tethered jailbreak]].

===[[N81ap |iPod touch 4G]]===
{| class="wikitable" style="font-size: smaller; text-align: center; table-layout: fixed; border-collapse: collapse;" border="1"
|-
!rowspan="2"| [[Jailbreak]] Tool
!colspan="6"| Works with [[firmware]]...
|-
|style="width:100px;"| 4.1 (both builds)
|style="width:100px;"| 4.2.1
|style="width:100px;"| 4.3
|style="width:100px;"| 4.3.1
|style="width:100px;"| 4.3.2
|style="width:100px;"| 4.3.3
|-
| [[limera1n]]
| {{yes}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[Greenpois0n (jailbreak)|greenpois0n]]
| {{yes|RC4}}
| {{yes|RC6.1}}
| {{no}}
| {{no}}
| {{no}}
| {{no}}
|-
| [[PwnageTool]]
| {{yes|4.1.3}}
| {{yes|4.2}}
| {{no}}
| {{yes|4.3}}
| {{yes|4.3.2}}
| {{yes|4.3.3}}
|-
| [[sn0wbreeze]]
| {{yes|2.1}}
| {{yes|2.2}}
| {{yes|2.3b41}}
| {{yes|2.5}}
| {{yes|2.6}}
| {{yes|2.7}}
|-
| [[redsn0w]]
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15 or 0.9.7b61 2}}
| {{yes|0.9.6rc151}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
| {{yes|0.9.6rc15}}
|}
1 [[Tethered jailbreak]].

2 If [[SHSH]]s were saved for iOS 4.2b3 and if you have a developer access to its IPSW, [[Jailbreak Monte]] can be used.

List of iPhones

2010-11-03T02:14:58Z

Sean: /* Differences between iPhone Models */

{{DISPLAYTITLE:iPhone}}
There are many iterations of the iPhone.

== Differences between iPhone Models ==
{| class="wikitable" style="font-size: smaller; text-align: center; width: auto; table-layout: fixed; border-collapse: collapse;" border="1"
!Device
!Case Material
!Colours
!Dimensions
!Weight
!Capacity
!Processor Speed
!RAM
!Battery Life
!Initial Firmware
!Camera
!Voice Controls
!GPS
!Digital Compass
!Gyroscope
!Video Calls (FaceTime)
|-
|[[M68ap|iPhone 2G]]
|Aluminium
|Aluminium
|4.5x2.4x0.46 in.
|4.8oz.
|4*/8/16**GB
|412MHz
|128Mb
|24h (Music), 7h (Video)
|1.0 (1A543a)
|2MP
|{{no}}
|{{no}}
|{{no}}
|{{no}}
|{{no}}
|-
|[[N82ap|iPhone 3G]]
|Plastic
|Black/White***
|4.5x2.4x0.48 in.
|4.7oz.
|8/16GB
|412MHz
|128Mb
|24h (Music), 7h (Video)
|2.0 (5A345)
|2MP
|{{no}}
|{{yes}}
|{{no}}
|{{no}}
|{{no}}
|-
|[[N88ap|iPhone 3GS]]
|Plastic
|Black/White
|4.5x2.4x0.48 in.
|4.8oz.
|8/16/32GB
|620MHz
|256Mb
|30h (Music), 10h (Video)
|3.0 (7A341)
|3.2MP Auto Focus
|{{yes}}
|{{yes}}
|{{yes}}
|{{no}}
|{{no}}
|-
|[[N90ap|iPhone 4]]
|Steel/Glass
|Black
|4.5x2.31x0.37 in.
|4.8oz.
|16/32GB
|1GHz
|512Mb
|40h (Music), 10h (Video)
|4.0 (8A293)
|5.0MP Auto Focus with LED Flash
|{{yes}}
|{{yes}}
|{{yes}}
|{{yes}}
|{{yes}}
|}

(*) Discontinued on September 5, 2007

(**) Introduced on February 5, 2008

(***) 16GB version only

User:Sean

2010-11-03T01:47:28Z

Sean:

User:Sean

2010-11-03T01:46:48Z

Sean:

An individual who takes an active part in accurately promoting proper grammar. Sean also takes part in informing the incredibly discriminative and disastrous iPhone OS community of the latest in everything related to iOS Hacking, including, but not limited to: Jailbreaking, tools, and feuds, all of which are frequently produced, updated, and distributed.

I am known in any thing to do with iPhone as either "Sean" (Mainly IRC) and by "RawrSean" (Twitter, iOS Social networks (OpenFeint.. etc..) I am known on GameCenter as "¥".

User:Sean

2010-11-03T01:43:32Z

Sean: New page: An individual who takes an active part in accurately promoting proper grammar. Sean also takes part in informing the incredibly discriminative and disastrous iPhone OS community of the lat...

User talk:Sean

2010-11-03T01:36:39Z

Sean: New page: Rawr

Rawr

Sn0wbreeze

2010-09-23T19:15:54Z

Sean:

sn0wbreeze is a [[PwnageTool]] port to Windows, developed by [[User:ih8sn0w|iH8sn0w]], w3st05, srts, Little_Martian and LiLBush81.

== Models Supported ==
* [[M68ap|iPhone 2G]]
* [[N45ap|iPod touch 1G]]
* [[N82ap|iPhone 3G]]
* [[N72ap|iPod touch 2G]]
* [[N88ap|iPhone 3GS]]
* [[N18ap|iPod touch 3G]]

The [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]] need to be have the signature checks disabled beforehand. The [[S5L8900]] devices can enter [[DFU Mode]] and restore with [[iTunes]] without being jailbroken.

==Versions==

sn0wbreeze was first released January 13, 2010 as a beta version.
The following versions that are shown here are official.

=== 3.1.X ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9; text-align:center; width:150px;" |Version
! style="background-color:#E9E9E9; text-align:center;" |Release date
! style="background-color:#E9E9E9; text-align:center;" |Changes
|-
! style="white-space: nowrap;" |
==== Public Beta ====
| style="white-space: nowrap;" | January 13, 2010
| |
* Initial release
* Jailbreaks 3.1.2 firmware
* Only allows you to be able to select simple mode
* Taken down due to copyright issues with [[XPwn]]
|
|-
! style="white-space: nowrap;" |
==== 1.0 ====
| style="white-space: nowrap;" | January 16, 2010
| |
* Official release of sn0wbreeze
|-
! style="white-space: nowrap;" |
==== 1.1 ====
| style="white-space: nowrap;" | January 19, 2010
| |
* Fixes [[Cydia]] problems
* Fixes problems with [[NOR]] on [[S5L8900]] devices
* Fixes custom packages not being installed
|-
! style="white-space: nowrap;" |
==== 1.2 ====
| style="white-space: nowrap;" |January 21, 2010
| |
* GUI fixes
* Fixed even more [[Cydia]] problems
|-
! style="white-space: nowrap;" |
==== 1.3 ====
| style="white-space: nowrap;" | January 23, 2010
| |
* fixes bug where some [[Cydia]] repositories could not be added and downloaded from
|-
! style="white-space: nowrap;" |
==== 1.4 ====
| style="white-space: nowrap;" | January 26, 2010
| |
* Fixed vital bug where deb files may not be added to the right place
|-
! style="white-space: nowrap;" |
==== 1.5 ====
| style="white-space: nowrap;" | February 5, 2010
| |
* Jailbreaks 3.1.3
* removed verbose mode support
|-
! style="white-space: nowrap;" |

==== 1.5.1 ====
| style="white-space: nowrap;" | February 7, 2010
| |
* Removed blacksn0w due to com center issues (Fix being worked on)
|-
! style="white-space: nowrap;" |
|}

=== 4.0.X ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9; text-align:center; width:150px;" |Version
! style="background-color:#E9E9E9; text-align:center; width:175px;" |Release date
! style="background-color:#E9E9E9; text-align:center;" |Changes
|-
! style="white-space: nowrap;" |

==== 1.6 ====
| style="white-space: nowrap;" | June 24, 2010
| |
* Added Support for iOS 4.
* Deleted Ultrasn0w Unlock option.
* Removed the option Sn0wbreeze App
|-
! style="white-space: nowrap;" |

==== 1.7 ====
| style="white-space: nowrap;" | July 6, 2010
| |
* Added support for new bootrooms ([[tethered jailbreak]])
|-
! style="white-space: nowrap;" |

==== 1.8 Beta ====
| style="white-space: nowrap;" | July 16, 2010
| |
* Added Support for iOS 4.1 beta 1.
* Deleted Hacktivation.
|-
! style="white-space: nowrap;" |

==== 2.0 ====
| style="white-space: nowrap;" | September 22nd, 2010
| |
* Added support for iPod 2G MC (Tethered using usb_control_msg(0xA1, 1) Exploit)
* Added Support for [[N18ap|iPod touch 3G]] and [[N88ap|iPhone 3GS]] new bootrom on 3.1.2 firmware
* Simplified the GUI
|-
! style="white-space: nowrap;" |

==== 2.0.1 ====
| style="white-space: nowrap;" | September 22nd, 2010
| |
* Fixed Error 37
! style="white-space: nowrap;" |
|}

==Problems==
There are some problems with blacksn0w because it relies on the 3.1.2 CommCenter, and needs to be updated to the 3.1.3 version. If installed it will cause your iPhone to go into a boot loop.

== Use of xpwn ==
The backend of sn0wbreeze is [http://github.com/planetbeing/xpwn xpwn], an open-source custom IPSW generator created by planetbeing in parallel with [[iPhone Dev Team]] developments of techniques and tools. xpwn runs on Windows, Mac OS X, and Linux. Given a "bundle" of patches from either [[PwnageTool]] or sn0wbreeze, xpwn driven from the command line is able to create the same custom IPSW as either tool. All Fixes to xpwn made by iH8sn0w have been made available. [http://github.com/iH8sn0w/xpwn].

== License ==
sn0wbreeze is freeware.

== Download ==
[http://ih8sn0w.com/index.php/welcome.snow Download sn0wbreeze]

[[Category:Hacking Software]]

Sn0wbreeze

2010-09-23T01:52:00Z

Sean:

sn0wbreeze is a [[PwnageTool]] port to Windows, developed by [[User:ih8sn0w|iH8sn0w]], w3st05, srts, Little_Martian and LiLBush81.

== Models Supported ==
* [[M68ap|iPhone 2G]]
* [[N45ap|iPod touch 1G]]
* [[N82ap|iPhone 3G]]
* [[N72ap|iPod touch 2G]]
* [[N88ap|iPhone 3GS]]
* [[N18ap|iPod touch 3G]]

The [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]] need to be have the signature checks disabled beforehand. The [[S5L8900]] devices can enter [[DFU Mode]] and restore with [[iTunes]] without being jailbroken.

==Versions==

sn0wbreeze was first released January 13, 2010 as a beta version.
The following versions that are shown here are official.

=== 3.1.X ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9; text-align:center; width:150px;" |Version
! style="background-color:#E9E9E9; text-align:center;" |Release date
! style="background-color:#E9E9E9; text-align:center;" |Changes
|-
! style="white-space: nowrap;" |
==== Public Beta ====
| style="white-space: nowrap;" | January 13, 2010
| |
* Initial release
* Jailbreaks 3.1.2 firmware
* Only allows you to be able to select simple mode
* Taken down due to copyright issues with [[XPwn]]
|
|-
! style="white-space: nowrap;" |
==== 1.0 ====
| style="white-space: nowrap;" | January 16, 2010
| |
* Official release of sn0wbreeze
|-
! style="white-space: nowrap;" |
==== 1.1 ====
| style="white-space: nowrap;" | January 19, 2010
| |
* Fixes [[Cydia]] problems
* Fixes problems with [[NOR]] on [[S5L8900]] devices
* Fixes custom packages not being installed
|-
! style="white-space: nowrap;" |
==== 1.2 ====
| style="white-space: nowrap;" |January 21, 2010
| |
* GUI fixes
* Fixed even more [[Cydia]] problems
|-
! style="white-space: nowrap;" |
==== 1.3 ====
| style="white-space: nowrap;" | January 23, 2010
| |
* fixes bug where some [[Cydia]] repositories could not be added and downloaded from
|-
! style="white-space: nowrap;" |
==== 1.4 ====
| style="white-space: nowrap;" | January 26, 2010
| |
* Fixed vital bug where deb files may not be added to the right place
|-
! style="white-space: nowrap;" |
==== 1.5 ====
| style="white-space: nowrap;" | February 5, 2010
| |
* Jailbreaks 3.1.3
* removed verbose mode support
|-
! style="white-space: nowrap;" |

==== 1.5.1 ====
| style="white-space: nowrap;" | February 7, 2010
| |
* Removed blacksn0w due to com center issues (Fix being worked on)
|-
! style="white-space: nowrap;" |
|}

=== 4.0.X ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9; text-align:center; width:150px;" |Version
! style="background-color:#E9E9E9; text-align:center; width:175px;" |Release date
! style="background-color:#E9E9E9; text-align:center;" |Changes
|-
! style="white-space: nowrap;" |

==== 1.6 ====
| style="white-space: nowrap;" | June 24, 2010
| |
* Added Support for iOS 4.
* Deleted Ultrasn0w Unlock option.
* Removed the option Sn0wbreeze App
|-
! style="white-space: nowrap;" |

==== 1.7 ====
| style="white-space: nowrap;" | July 6, 2010
| |
* Added support for new bootrooms ([[tethered jailbreak]])
|-
! style="white-space: nowrap;" |

==== 1.8 Beta ====
| style="white-space: nowrap;" | July 16, 2010
| |
* Added Support for iOS 4.1 beta 1.
* Deleted Hacktivation.
|-
! style="white-space: nowrap;" |

==== 2.0 ====
| style="white-space: nowrap;" | September 22nd, 2010
| |
* Added support for iPod 2G MC (Tethered using usb_control_msg(0xA1, 1) Exploit)
* Added Support for [[N18ap|iPod touch 3G]] and iPhone 3gs on New bootrom on 3.1.2 FirmWare
* Simplified the GUI
|-
! style="white-space: nowrap;" |
|}

==Problems==
There are some problems with blacksn0w because it relies on the 3.1.2 CommCenter, and needs to be updated to the 3.1.3 version. If installed it will cause your iPhone to go into a boot loop.

== Use of xpwn ==
The backend of sn0wbreeze is [http://github.com/planetbeing/xpwn xpwn], an open-source custom IPSW generator created by planetbeing in parallel with [[iPhone Dev Team]] developments of techniques and tools. xpwn runs on Windows, Mac OS X, and Linux. Given a "bundle" of patches from either [[PwnageTool]] or sn0wbreeze, xpwn driven from the command line is able to create the same custom IPSW as either tool. All Fixes to xpwn made by iH8sn0w have been made available. [http://github.com/iH8sn0w/xpwn].

== License ==
sn0wbreeze is freeware.

== Download ==
[http://ih8sn0w.com/index.php/welcome.snow Download sn0wbreeze]

[[Category:Hacking Software]]

Sn0wbreeze

2010-09-23T01:51:32Z

Sean: Added Sn0wbreeze 2.0 information.

sn0wbreeze is a [[PwnageTool]] port to Windows, developed by [[User:ih8sn0w|iH8sn0w]], w3st05, srts, Little_Martian and LiLBush81.

== Models Supported ==
* [[M68ap|iPhone 2G]]
* [[N45ap|iPod touch 1G]]
* [[N82ap|iPhone 3G]]
* [[N72ap|iPod touch 2G]]
* [[N88ap|iPhone 3GS]]
* [[N18ap|iPod touch 3G]]

The [[N72ap|iPod touch 2G]] and [[N88ap|iPhone 3GS]] need to be have the signature checks disabled beforehand. The [[S5L8900]] devices can enter [[DFU Mode]] and restore with [[iTunes]] without being jailbroken.

==Versions==

sn0wbreeze was first released January 13, 2010 as a beta version.
The following versions that are shown here are official.

=== 3.1.X ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9; text-align:center; width:150px;" |Version
! style="background-color:#E9E9E9; text-align:center;" |Release date
! style="background-color:#E9E9E9; text-align:center;" |Changes
|-
! style="white-space: nowrap;" |
==== Public Beta ====
| style="white-space: nowrap;" | January 13, 2010
| |
* Initial release
* Jailbreaks 3.1.2 firmware
* Only allows you to be able to select simple mode
* Taken down due to copyright issues with [[XPwn]]
|
|-
! style="white-space: nowrap;" |
==== 1.0 ====
| style="white-space: nowrap;" | January 16, 2010
| |
* Official release of sn0wbreeze
|-
! style="white-space: nowrap;" |
==== 1.1 ====
| style="white-space: nowrap;" | January 19, 2010
| |
* Fixes [[Cydia]] problems
* Fixes problems with [[NOR]] on [[S5L8900]] devices
* Fixes custom packages not being installed
|-
! style="white-space: nowrap;" |
==== 1.2 ====
| style="white-space: nowrap;" |January 21, 2010
| |
* GUI fixes
* Fixed even more [[Cydia]] problems
|-
! style="white-space: nowrap;" |
==== 1.3 ====
| style="white-space: nowrap;" | January 23, 2010
| |
* fixes bug where some [[Cydia]] repositories could not be added and downloaded from
|-
! style="white-space: nowrap;" |
==== 1.4 ====
| style="white-space: nowrap;" | January 26, 2010
| |
* Fixed vital bug where deb files may not be added to the right place
|-
! style="white-space: nowrap;" |
==== 1.5 ====
| style="white-space: nowrap;" | February 5, 2010
| |
* Jailbreaks 3.1.3
* removed verbose mode support
|-
! style="white-space: nowrap;" |

==== 1.5.1 ====
| style="white-space: nowrap;" | February 7, 2010
| |
* Removed blacksn0w due to com center issues (Fix being worked on)
|-
! style="white-space: nowrap;" |
|}

=== 4.0.X ===
{| class="wikitable" width="100%" style="font-size: 90%"
! style="background-color:#E9E9E9; text-align:center; width:150px;" |Version
! style="background-color:#E9E9E9; text-align:center; width:175px;" |Release date
! style="background-color:#E9E9E9; text-align:center;" |Changes
|-
! style="white-space: nowrap;" |

==== 1.6 ====
| style="white-space: nowrap;" | June 24, 2010
| |
* Added Support for iOS 4.
* Deleted Ultrasn0w Unlock option.
* Removed the option Sn0wbreeze App
|-
! style="white-space: nowrap;" |

==== 1.7 ====
| style="white-space: nowrap;" | July 6, 2010
| |
* Added support for new bootrooms ([[tethered jailbreak]])
|-
! style="white-space: nowrap;" |

==== 1.8 Beta ====
| style="white-space: nowrap;" | July 16, 2010
| |
* Added Support for iOS 4.1 beta 1.
* Deleted Hacktivation.
|-
! style="white-space: nowrap;" |
|}

==== 2.0 ====
| style="white-space: nowrap;" | September 22nd, 2010
| |
* Added support for iPod 2G MC (Tethered using usb_control_msg(0xA1, 1) Exploit)
* Added Support for [[N18ap|iPod touch 3G]] and iPhone 3gs on New bootrom on 3.1.2 FirmWare
* Simplified the GUI
|-
! style="white-space: nowrap;" |
|}

==Problems==
There are some problems with blacksn0w because it relies on the 3.1.2 CommCenter, and needs to be updated to the 3.1.3 version. If installed it will cause your iPhone to go into a boot loop.

== Use of xpwn ==
The backend of sn0wbreeze is [http://github.com/planetbeing/xpwn xpwn], an open-source custom IPSW generator created by planetbeing in parallel with [[iPhone Dev Team]] developments of techniques and tools. xpwn runs on Windows, Mac OS X, and Linux. Given a "bundle" of patches from either [[PwnageTool]] or sn0wbreeze, xpwn driven from the command line is able to create the same custom IPSW as either tool. All Fixes to xpwn made by iH8sn0w have been made available. [http://github.com/iH8sn0w/xpwn].

== License ==
sn0wbreeze is freeware.

== Download ==
[http://ih8sn0w.com/index.php/welcome.snow Download sn0wbreeze]

[[Category:Hacking Software]]