IPhone 3GS Hacking - Revision history

Ivc: /* Cydia - On-file system */

2009-10-28T22:01:31Z

Cydia - On-file system

← Older revision		Revision as of 22:01, 28 October 2009
Line 80:		Line 80:

	By storing them it will later be possible to downgrade to earlier firmware versions by reusing the valid stored hash keys (signed by Apple private key + device ECID). The keys are sent by the Cydia server to iTunes instead from Apple, which won't send the valid keys.		By storing them it will later be possible to downgrade to earlier firmware versions by reusing the valid stored hash keys (signed by Apple private key + device ECID). The keys are sent by the Cydia server to iTunes instead from Apple, which won't send the valid keys.

			Only change needed is to change to /etc/hosts or \Windows\system32\drivers\etc\hosts file and add:

			74.208.105.171 gs.apple.com

			Next time a restore is done, the current firmware (i.e v3.1) keys will be stored by Cydia.

Ivc: /* Fix halted boot */

2009-10-28T21:59:26Z

Fix halted boot

← Older revision		Revision as of 21:59, 28 October 2009
Line 71:		Line 71:
	# And now use shift/option-click the Restore button and select the custom package this time		# And now use shift/option-click the Restore button and select the custom package this time
	# Now the iPhone should be updated and jailbroken		# Now the iPhone should be updated and jailbroken

			== Cydia - On-file system ==
			The 3GS prohobits restore to previous system versions, i.e 3.1 to 3.0. This is because Apple check the version before signing a few essential update files with their private encryption key and the 3GS' unique ECID.

			But there is a 'relay attack' vector that make it possible to be a man-in-the-middle between the iTunes client and the Apple authentication servers. It's done by changing the locally resolved hostname ip address to a different one.

			Saurik, one of the developers behind Cydia, has created a server that is capturing the hash keys sent be Apple and stores them, or puts them on-file if you will.

			By storing them it will later be possible to downgrade to earlier firmware versions by reusing the valid stored hash keys (signed by Apple private key + device ECID). The keys are sent by the Cydia server to iTunes instead from Apple, which won't send the valid keys.

Ivc: /* Fix halted boot */

2009-10-28T20:43:30Z

Fix halted boot

← Older revision		Revision as of 20:43, 28 October 2009
Line 67:		Line 67:
	# Release the power button but keep pressing home for 10		# Release the power button but keep pressing home for 10
	# A message should pop up that a DFU device is found and iTunes will prompt that it found a device in recovery mode		# A message should pop up that a DFU device is found and iTunes will prompt that it found a device in recovery mode
	# Now, as the 3GS has a new firmware protection that prohibits restoring to previous versions, use Pwnagetool to create a ~~custome~~ firmware package, i.e. v3.1.2		# Now, as the 3GS has a new firmware protection that prohibits restoring to previous versions, use Pwnagetool to create a custom firmware package, i.e. v3.1.2
	# But first restore with a original v3.1.2 package then with the first restore is successful, wait for Pwnagetool to set the 3GS in ~~restore~~ mode~~, once again~~		# But first restore with a original v3.1.2 package then with the first restore is successful, wait for Pwnagetool to set the 3GS in Recovery (not DFU) mode
	# And now use shift/option-click the Restore button and select the custom package this time		# And now use shift/option-click the Restore button and select the custom package this time
	# Now the iPhone should be updated and jailbroken		# Now the iPhone should be updated and jailbroken

Ivc at 19:43, 28 October 2009

2009-10-28T19:43:15Z

@@ Line 55: / Line 55: @@
 == Enable tethering ==
 Take a look at the tips and tricks page:
-* [[IPhone_OS_Tips_and_Hacks#Enable_3G_tethering|Enable tethering]]
+# Connect a working USB cable to a computer with iTunes and the ipsw file you want to restore

Ivc: /* Enable tethering */

2009-08-28T15:34:34Z

Enable tethering

← Older revision		Revision as of 15:34, 28 August 2009
Line 56:		Line 56:
	Take a look at the tips and tricks page:		Take a look at the tips and tricks page:

	* [[IPhone_OS_Tips_and_Hacks#Enable_3G_tethering]]		* [[IPhone_OS_Tips_and_Hacks#Enable_3G_tethering\|Enable tethering]]

Ivc: /* Enable tethering */

2009-08-28T15:34:17Z

Enable tethering

← Older revision		Revision as of 15:34, 28 August 2009
Line 54:		Line 54:

	== Enable tethering ==		== Enable tethering ==
			Take a look at the tips and tricks page:

			* [[IPhone_OS_Tips_and_Hacks#Enable_3G_tethering]]

Ivc: /* Install Crackulous/Installous */

2009-08-28T15:33:19Z

Install Crackulous/Installous

← Older revision		Revision as of 15:33, 28 August 2009
Line 47:		Line 47:
	After this modification the electrical features inside the is still true and the edge of the bezel is smooth and not rough to the touch.		After this modification the electrical features inside the is still true and the edge of the bezel is smooth and not rough to the touch.

	== Install ~~Crackulous/~~Installous ==		== Install Installous ==
	Installous has a lot of cool utilities for the iPhone.		The Installous repository has a lot of cool utilities for the iPhone.

	# Open Cydia, go to Manage and Sources		# Open Cydia, go to Manage and Sources
	# Add ''http://cydia.hackulo.us'' to the list		# Add ''http://cydia.hackulo.us'' to the list

			== Enable tethering ==

Ivc at 14:29, 28 August 2009

2009-08-28T14:29:16Z

← Older revision		Revision as of 14:29, 28 August 2009
Line 29:		Line 29:
	* Reboot the 3GS and open 'Freeze' once again and 'Install Cydia' once more		* Reboot the 3GS and open 'Freeze' once again and 'Install Cydia' once more
	* Now Cydia should be properly installed and the 3GS is now jailbroken!		* Now Cydia should be properly installed and the 3GS is now jailbroken!

			If the iPhone has been updated to v3.0.1 software, purplera1n will fail. Try to use redsn0w v0.8 or later, same functionality and restore is not required. Remember to use the v3.0 ipws for v3.0.1 jailbreaking.

	=== References ===		=== References ===

Ivc at 13:54, 28 August 2009

2009-08-28T13:54:11Z

← Older revision		Revision as of 13:54, 28 August 2009
Line 44:		Line 44:

	After this modification the electrical features inside the is still true and the edge of the bezel is smooth and not rough to the touch.		After this modification the electrical features inside the is still true and the edge of the bezel is smooth and not rough to the touch.

			== Install Crackulous/Installous ==
			Installous has a lot of cool utilities for the iPhone.

			# Open Cydia, go to Manage and Sources
			# Add ''http://cydia.hackulo.us'' to the list

Ivc at 21:32, 15 August 2009

2009-08-15T21:32:13Z

← Older revision		Revision as of 21:32, 15 August 2009
Line 35:		Line 35:
	* [http://www.modmyi.com/forums/iphone-news/660901-iphone-3gs-jailbreak-purplera1n-released-windows.html Jailbreaking 3GS - Purplera1n for Windows]		* [http://www.modmyi.com/forums/iphone-news/660901-iphone-3gs-jailbreak-purplera1n-released-windows.html Jailbreaking 3GS - Purplera1n for Windows]
	* [http://www.ismashphone.com/2009/07/15-useful-iphone-hacks-that-will-make-your-life-easier-.html 15 Useful iPhone Hacks That Will Make Your Life Easier]		* [http://www.ismashphone.com/2009/07/15-useful-iphone-hacks-that-will-make-your-life-easier-.html 15 Useful iPhone Hacks That Will Make Your Life Easier]

			== Raising the display ==
			On my unit the display is a bit sunk into the body of the unit. When moving my finger across the edges I can feel the rough edge of the chrome bezel.

			A way to fix this would, obviously, to raise the display from behind. As I discovered, both the 3G and 3GS are really easy to open compared to the 2G. Place a suction cup on top of the screen near the home button and lift with a fair amount of pull.

			I cut 6 strips of 50.0x5.0 mm regular A4 paper and placed them on each side of the screen (long side). The reason for this is that the mid-point on the display will otherwise be pressing against the back of the touch-glass (pressure-rings can be seen then).

			After this modification the electrical features inside the is still true and the edge of the bezel is smooth and not rough to the touch.