Redsn0w

redsn0w on OS X

redsn0w is an iDevice jailbreaking tool for OS X and Windows. Originally called QuickPwn, but due to exploitation of the name by www.quickpwn.com, version 0.7 was renamed to redsn0w and added unlocking of supported devices.

Version 0.8 added support for jailbreaking the iPhone 3GS.

Version 0.9 beta 3 was released for Windows and Mac OS X, and it allows iOS 3.0 through 3.1.2 to be jailbroken. It includes support for all devices except the iPod touch 3G, and supports a tethered jailbreak on iPhone 3GS units and iPod touch 2G units with new bootroms. In addition, this version supports custom boot and recovery mode logos, as well as verbose mode on bootup.

Version 0.9.2 supports jailbreaking of all iDevices (at the time) with iOS 3.0 through 3.1.2 on Windows and Mac OS X, as well as 3.1.3 on S5L8900 devices. Version 0.9.3 adds support of internet tethering IPCC hack on those devices and 0.9.4 allows jailbreaking of early iPod touch 2G with iOS 3.1.3.

Version 0.9.5b5-5 supports jailbreaking the iPhone 3G and iPod touch 2G (old bootrom) with iOS 4.0 on Windows and Mac OS X.

Version 0.9.6b6 supports jailbreaking iOS 3.2.2, 4.1, and 4.2.1 for every device that supports those versions (except Apple TV 2G), on Windows and Mac OS X.

Version 0.9.10b1 adds support for iOS 4.2.6 through 5.0.1 (though iOS 4.2.9, 4.2.10, 4.3.4, 4.3.5, and 5.0 are tethered on devices invulnerable to the 0x24000 Segment Overflow). The current build of redsn0w is not capable of jailbreaking S5L8940 devices.

Credit

iPhone Dev Team

Versions

Initial releases

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
Lite	Unknown	Yes		Tethered jailbreak for iPod touch 2G on iOS 2.1.1 with ARM7 Go
0.3				Untethered jailbreak for the iPod touch 2G on iOS 2.2.1 with ARM7 Go and 0x24000 Segment Overflow

0.7.x series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.7	Unknown	Yes		Untethered jailbreak for all devices but iPhone 3GS
0.7.1				Bug fixes for versions 0.7
0.7.2				More bug fixes for versions 0.7

0.8.x series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.8	July 2009	Yes		Performs an untethered jailbreak on iOS 3.0/3.0.1 (when pointed at 3.0) for all devices supported by those firmware.

0.9.0-0.9.4 releases

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.2	Unknown	Yes		Supports 3.0-3.1.2 on all iPhones and iPod touches (tethered for newer devices with 0x24000 Segment Overflow closed)
0.9.3				Contains the IPCC hack to enable tethering on the iPhone 3G and 3GS.
0.9.4				Supports jailbreaking iOS 3.1.3 on iPhone 2G, iPhone 3G, iPod touch 1G, iPod touch 2G (old bootrom)

0.9.5 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.5 beta 3	June 21, 2010	Yes	No	Supports jailbreaking iOS 4.0 on iPhone 3G and iPod touch 2G (old bootrom)
0.9.5 beta 4	Unknown			Resolved a problem with iBooks.
0.9.5 beta 5				Supposed to fix any APN or MMS issues that users were seeing.

0.9.6 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.6 beta 1	September 21, 2010	Yes		Supports jailbreaking iOS 4.0-4.1 on iPhone 3G and iPod touch 2G (tethered on new bootrom)
0.9.6 beta 2	October 31, 2010			Supports jailbreaking iOS 3.2.2 and 4.0-4.1 on every device that supports those firmwares (except iPod touch 2G with new bootrom) . The iPhone 3G, iPod touch 2G (old bootrom), and iPhone 3GS (old bootrom) can also have custom boot logos. The Windows version also includes a function that permits users to restore to a custom IPSW, akin to PwnageTool's DFU button.
0.9.6 beta 3	November 2010			Supports the installation of custom bundles
0.9.6 beta 4	November 23, 2010			Jailbreaks iOS 4.1-4.2.1 on all compatible devices. Tethered jailbreak on devices that are not vulnerable to Pwnage 2.0 or 0x24000 Segment Overflow.
0.9.6 beta 5	November 28, 2010			Can update the baseband on the X-Gold 608 to 06.15.00, allowing the reuse of the AT+XAPP Vulnerability
0.9.6 beta 6	December 1, 2010			Allows you to "deactivate" a hacktivated phone, so sbinger's Subscriber Artificial Module (SAM) can trick your iPhone and iTunes into creating legitimate activation tickets.
0.9.6 release candidate 7	January 2, 2011			Introduced command-line arguments to bypass some screens. -b <filename> to specify your own boot logo PNG -i <filename> to specify your reference IPSW -j to ask redsn0w to “Just boot now tethered for now” -o for iPhone 3GS and iPod touch 2G units vulnerable to 0x24000 Segment Overflow.
0.9.6 release candidate 8	January 5, 2011			Informs users if a boot logo PNG is invalid, and why. Introduced the "-a" command-line argument to eliminate clicking.
0.9.6 release candidate 9	April 3, 2011			Adds support for jailbreaking iOS 4.3.1 on all compatible devices except the iPad 2 and Apple TV 2. New command line parameters k and d [1]: -k --kernelcache=<str> use specified kernelcache (advanced) -d --devicetree=<str> use specified devicetree (advanced)
0.9.6 release candidate 10	April 7, 2011			Added boot animations Removed misleading Settings
0.9.6 release candidate 11				Makes the boot animation a bit more robust
0.9.6 release candidate 12	April 8, 2011			Fix any lingering issues with the boot animation
0.9.6 release candidate 13	April 19, 2011			Adds support for jailbreaking iOS 4.3.2 on all compatible devices except the iPad 2. A bug existed that prevented the iPhone 4 (GSM model) from being jailbroken on iOS 4.3.2.
0.9.6 release candidate 14				Fixes an issue that prevented the iPhone 4 (GSM model) from being jailbroken.
0.9.6 release candidate 15	May 06, 2011			Adds support for jailbreaking iOS 4.3.3 on all compatible devices except the iPad 2.
0.9.6 release candidate 16	May 16, 2011			Fixes the iPhone 3GS/iPhone 4 (GSM model) side switch vibration issue found in jailbroken installations of iOS 4.3.3.
0.9.6 release candidate 17	May 20, 2011			Adds advanced command line options for kernel hackers.
0.9.6 release candidate 18	June 14, 2011			Adds support for jailbreaking iOS 4.2.8 on the iPhone 4 (CDMA model).
0.9.6 release candidate 19	July 12, 2011			When a custom bundle is applied, most of the normal jailbreak steps (like stashing and untethering) are skipped.

0.9.7 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.7 beta 1	December 26, 2010	Yes	No	Jailbreaks iOS 4.1-4.2.1 on all compatible devices. Able to achieve an untethered jailbreak on 4.2.1, provided the user has 4.2b3 SHSHs and the 4.2b3 IPSW. This version of "Jailbreak Monte" has quite a number of bugs, particularly app switcher crashes and disabled Bluetooth.
0.9.7 beta 2				Fixes crashing bugs on GUI apps.
0.9.7 beta 3	December 27, 2010			Fixes crashing bugs completely.
0.9.7 beta 4	December 31, 2010			ubsmuxd integrated.
0.9.7 beta 5	January 8, 2011			Issues related to Bluetooth and the sandbox are resolved.
0.9.7 beta 6	January 10, 2011			fixes Skype

0.9.8 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.8 beta 1	June 10, 2011	Yes		Performs a tethered jailbreak of iOS 5.0 betas 1 and 2 (when pointed at the beta 1 IPSW) on all compatible devices except the iPad 2.
0.9.8 beta 2	July 11, 2011			Performs a tethered jailbreak of iOS 5.0 betas 1, 2, and 3 on all compatible device except the iPad 2. Fixes the iOS 5 beta 3 sandbox issues present in the previous version.
0.9.8 beta 3	July 16, 2011			Performs a tethered jailbreak of iOS 4.3.4 and iOS 5.0 betas 1, 2, and 3.
0.9.8 beta 4	July 23, 2011			Performs a tethered jailbreak of iOS 5.0 betas 1, 2, 3, and 4.
0.9.8 beta 5	August 9, 2011			Performs a tethered jailbreak of iOS 5.0 betas 1, 2, 3, 4 and 5.
0.9.8 beta 6	August 23, 2011			Performs a tethered jailbreak of iOS 5.0 betas 1, 2, 3, 4, 5, and 6.
0.9.8 beta 7	August 31, 2011			Performs a tethered jailbreak of iOS 5.0 betas 1, 2, 3, 4, 5 and 6. Performs a tethered jailbreak of iOS 4.3.5 and 4.2.10 without pointing at an older IPSW. Performs a tethered jailbreak of iOS 5.0 beta 6 on a new, silently changed (by Apple) iPad 1 IPSW. Fixes a bug in the 4.2.10 jailbreak on the iPhone 4 CDMA tethered jailbreak.
0.9.8 beta 7b	September 2, 2011			Performs a tethered jailbreak for iOS 4.3.4, 4.3.5, 4.2.9, 4.2.10 on all supported devices except the iPhone 3GS (old bootrom) and the iPad 2 Performs an untethered jailbreak on iOS 4.1-4.3.3 on all supported devices except the iPad 2 Performs a tethered jailbreak on iOS 5.0 beta 1-7 on all supported devices except the iPhone 3GS (old bootrom) and iPad 2 Performs an untethered jailbreak on Phone 3GS (old bootrom) on iOS 4.1-4.3.5 and 5.0 beta 7 Fixed lingering issues with the iPhone 4 (CDMA Model) 4.2.10 tethered jailbreak
0.9.8 beta 7c	September 6, 2011			Same as 0.9.8 beta 7b on all devices but iPhone 3GS with 06.15.00 baseband Fixes error 1015 when restoring to stock 4.3.5 on iPhone 3GS with 06.15.00 baseband.

0.9.9 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.9 beta 1	September 19, 2011	Yes		Complete rewrite. No longer requires IPSWs when jailbreaking public builds. When jailbreaking beta/Golden master firmwares, need to specify IPSW once, then auto-recognizes it. Redsn0w now fetches SHSH from device, querys Cydia about saved blobs, stitches IPSWs with SHSH blobs (not for iPhones) and able to submit SHSH to cydia Includes Terminal shell commands into the GUI.
0.9.9 beta 2	October 4, 2011			Fixes Verizon iPhone 4 firmware detection Fixes 'Fix Recovery' Fixes for Stitching Fixes for blob processing
0.9.9 beta 3	October 5, 2011			Auto-detects the iOS 5.0 GM firmware now. Allows a jailbreak (albeit still tethered apart from iPhone 3GS old bootrom) on iOS5 GM
0.9.9 beta 3a		No	Yes	Fixes a Windows-only caching bug Allows Windows users to rename the redsn0w exe to anything containing 'boot' to jump straight to the tethered boot stage on load (thus adding one-click tethered boot to Windows redsn0w) 0.9.9 beta 3 still works fine for Mac users except they don't have the new 'boot' rename feature that this version has
0.9.9 beta 4	October 12, 2011	Yes		Now auto-recognizes iOS 5 and no longer requires IPSW submission on iOS 5 jailbreak
0.9.9 beta 5	October 13, 2011	Yes	No	Custom IPSW feature (from PwnageTool) for Baseband preservation.
0.9.9 beta 6	October 18, 2011	Yes		Fixes location services issues for iPhone 3GS with 06.15.00 baseband
0.9.9 beta 7	October 21, 2011			You can now choose whether you want redsn0w or Cydia to Stash Applications (can shorten redsn0w session by 60%)
0.9.9 beta 8	November 3, 2011			Jailbreaks iOS 5.0.1 beta 1 (9A402) tethered on devices vulnerable to limera1n exploit. Untethered on iPhone 3GS (old bootrom).
0.9.9 beta 9	December 19, 2011			Jailbreaks iOS 5.0.1 tethered on devices vulnerable to limera1n exploit. Untethered on iPhone 3GS (old bootrom). iBooks fix. Allows custom IPSW creation for iPhone 3GS (old bootrom) without SHSH blobs. Supports the 8 GB iPhone 4. Allows stitched IPSW creation for iOS 5.x. Allows stitched IPSW creation for GSM iPad 2s running iOS 4.3.x. Built-in version check.
0.9.9 beta 9b				Enables the “Custom” button in Windows to allow baseband preservation. Warns against flashing baseband 06.15.00 on newer iPhone 3GS devices (2011 week 35) more explicitly.
0.9.9 beta 9c		No	Yes	Special build for Windows users encountering issues with the update check.
0.9.9 beta 9d	December 20, 2011	Yes		Addresses a problem with the untethered jailbreak on iPhone 3GS (old bootrom) devices.

0.9.10 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.10 beta 1	December 27, 2011	Yes		The jailbreak for iOS 5.0.1 is now untethered.
0.9.10 beta 2				Fixes an issue with launchctl that the untether caused.
0.9.10 beta 3	December 28, 2011			Fixes a problem where re-running redsn0w over an existing jailbreak would cause Mobile Substrate-based apps to stop running until Mobile Substrate was installed again.
0.9.10 beta 3 novcheck	December 29, 2011	No	Yes	?
0.9.10 beta 4	January 15, 2012	Yes		Includes a fix for iBooks on iOS 5.0.1. Addresses an issue where the launchctl fix didn't work sometimes.
0.9.10 beta 5	January 29, 2012			Circumvents jailbreak detection in iBooks that caused ~10% of images to display properly.
0.9.10 beta 5b	February 1, 2012			Fixes an issue with custom ramdisks on the iPhone 3G and iPod touch 2G.
0.9.10 beta 5c	February 12, 2012			Prevents redsn0w from crashing due to increasing ramdisk sizes.
0.9.10 beta 6	March 7, 2012			Jailbreaks iOS 5.1 tethered on devices vulnerable to limera1n Exploit. Untethered on iPhone 3GS (old bootrom). Automatically detects MC model iPod touch 2G with pod2g's steaks4uce exploit.
0.9.10 beta 6b	March 11, 2012	Yes	No	Fixes small issues for Mac OS X v10.5.8 and earlier.
0.9.10 beta 7	April 20, 2012	Yes		Implements the Corona A5 jailbreak for iPhone 4S and iPad 2 devices still at 5.0.1 Can also re-install that jailbreak for those who accidentally uninstalled the untether When stitching an IPSW, it can now grab your blobs directly from Cydia. Now shows a lot more info about your device, for instance, whether your iPhone 3G has the vulnerable baseband bootloader, or whether your iPhone 3GS has the old exploitable bootrom
0.9.10 beta 8	April 23, 2012			Can backup those priceless activation tickets many are grabbing today Adds ability to backup arbitrary directories or files from your device into a ZIP file on your Mac or PC
0.9.10 beta 8b				Makes the ZIP files compatible with the native Windows Explorer.

0.9.11 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.11 beta 1	May 11, 2012	Yes		Newer devices (iPad 2, iPad 3, and iPhone 4S) are able downgrade as well. In a radical departure from previous versions of redsn0w, it now directly supports restoring IPSWs to your device.
0.9.11 beta 2	May 12, 2012			Adds support for downgrading to iOS 5.0.1 build 9A406 for the iPhone 4S.
0.9.11 beta 3	May 14, 2012			This release should fix the "Restore failed" messages people were sometimes getting. Behaves better with nearby devices that have Wi-Fi syncing enabled.
0.9.11 beta 4				Completes the tethered jailbreak support for iOS 5.1.1 on A4 devices and earlier, including proper "Stitching" and "Custom" creation of NO_BB IPSWs

0.9.12 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.12 beta 1	June 4, 2012	Yes		Adds Rocky Racoon for all devices on iOS 5.1.1. On A4 devices and earlier, users can choose between the backup restore method (like Absinthe) or using a ramdisk-based jailbreak (how redsn0w usually works).
0.9.12 beta 2	June 8, 2012			Users on iOS 5.1.1 are now explicitly asked if they wish to use the backup/restore method or the DFU ramdisk method for jailbreaking. Fixes iBooks problems on the iPhone 3GS (old bootrom). Provides more helpful error messages.

0.9.13 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.13 developer-only 1	June 14, 2012	Yes		Jailbreaks iOS 6.0b1.
0.9.13 developer-only 2	June 15, 2012			Fix the various SSH problems and crashes with apps that some have been seeing.
0.9.13 developer-only 3	June 16, 2012			Covers 6.0beta3 release and also adds explicit support for 6.0beta2.
0.9.13 developer-only 4	September 13, 2012			???

0.9.14 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.14 beta 1	June 18, 2012	Yes		Add a baseband downgrade option in redsn0w for those who are using the iPad’s 06.15.00 baseband on the iPhone 3G or iPhone 3GS.
0.9.14 beta 2	July 4, 2012			Improves the iPad baseband downgrade and should cover anyone who couldn’t downgrade with 0.9.14b1. Also simplified the process and added logging to help diagnose any remaining stubborn iPhones.

0.9.15 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.15 beta 1	October 14, 2012	Yes		Tethered jailbreak for iOS 6.0 on the Apple TV 2G, iPhone 3GS, iPhone 4, and iPod touch 4G. Untethered for iPhone 3GS devices with the old bootrom. Allows devices with the A5 or newer to restore to iOS 5.x, as long as they have iOS 4.x or 5.x installed.
0.9.15 beta 2	October 15, 2012			After restoring an iPhone 3GS, redsn0w keeps track of its bootrom version while it's still open. Fixes support for upgrading to/downgrading baseband 06.15.00.
0.9.15 beta 3	November 1, 2012			Save iPad 4 and iPad Mini SHSH blobs. Fixes of error 14 when stitching blobs and error 2601 for windows users when restoring.

Exploits used

For iPhone, iPod touch, and iPhone 3G:

• Pwnage
• Pwnage 2.0

For iPod touch 2G:

• 0x24000 Segment Overflow
• ARM7 Go - used to upload the oversized LLB required to utilize the 0x24000 Segment Overflow.
• usb_control_msg(0xA1, 1) Exploit - used (in redsn0w 0.9.6 beta 1) to upload the oversized LLB to utilize the 0x24000 Segment Overflow, as well as a tethered jailbreak on units with the new bootrom.

For iPhone 3GS:

• 0x24000 Segment Overflow
• iBoot Environment Variable Overflow - Exploit has a different implementation from geohot's implementation in purplera1n.
• usb_control_msg(0x21, 2) Exploit
• limera1n exploit

For iPod touch 3G:

• usb_control_msg(0x21, 2) Exploit
• limera1n exploit

For iPhone 4, iPod touch 4G, iPad and Apple TV 2G:

• limera1n exploit

External Links

• iPhone Dev Team blog with redsn0w download information
• redsn0w beta infos (outdated)