How To Jailbreak iOS 4 For iPhone 3GS (New Bootrom) Users With SHSH Blobs (Windows)

[You must be registered and logged in to see this image.]

iH8sn0w, developer of popular
jailbreaking tools such as
Sn0wbreeze has just published a detailed guide on how to jailbreak iOS 4
for iPhone 3GS with new bootrom.

iH8sn0w was planning to release an updated
version of Sn0wbreeze to
make this possible but has decided to write the tutorial as he realized
it would take too long.
Some important points before we
proceed:

This guide is only for advanced users.
This guide is only for
Windows users. Mac users can checkout this step-by-step guide.
Please note that jailbreaking your iPhone or iPod Touch
may void
your warranty and hence proceed with caution.
Do not forget to backup
your iPhone before you proceed. You can refer to this post for
instructions on how to backup your iPhone 3GS.
This guide is only for iPhone 3GS users with new
bootrom. You can
use F0recast to find out if your iPhone 3GS has newer or older
bootrom.
It will be a tethered
jailbreak, which means that the jailbreak
needs to be reapplied every time you power down your iPhone 3GS. If you
let the battery run out or restart your iPhone 3GS then you will need
to reapply the jailbreak by connecting to your computer (tethering).
It will only work if you had saved your iPhone 3GS’s
SHSH blobs (or
ECID files) for iPhone OS 3.1.2. iH8sn0w
has clarified that it
won’t work with iPhone OS 3.1.3 SHSH blobs.
iPhone 3GS with older bootrom can use PwnageTool for
Mac or
Sn0wbreeze for Windows users.
iPhone
3G users can use Redsn0w to jailbreak iOS 4. You can
checkout our detailed step-by-step guide for Mac and Windows users.
Currently there is no tool available to jailbreak
iPhone 4.
After the jailbreaking
process is complete, do not forget to
checkout our article on tips to keep your iPhone secure. Also, remember
to change the password of your jailbroken iPhone.
This guide will NOT Unlock your
iPhone 3GS. You
can use Ultrasn0w to unlock it after you have
successfully jailbroken iOS 4.

If you gone through all the points mentioned
above and meet the
requirements then you can follow the step-by-step instructions given
below:
<blockquote>

Trích dẫn :: WHAT YOU WILL NEED:
* An iPhone 3G[S] — new bootrom
* 3.1.2 SHSH blobs.
* difrnt’s iBSS grabber
*
Payload Pwner-r2 for the 3GS.
*
sn0wbreeze V1.6.2
*
iBooty
* LibUSB (64-Bit users read
carefully!!!)
*
3.1.2/4.0 3GS firmware downloaded.
——-
STEP A : Grabbing your 3.1.2 iBSS file.
Pointing your hosts :
I : If you have your shsh blobs saved on Cydia/Saurik’s server then
follow this tutorial. —
[You must be registered and logged in to see this link.]
II : If you have it
saved with TinyUmbrella, then download the GUI
here. —
[You must be registered and logged in to see this link.]
——-
Restoring to grab the iBSS file.
I : Place your device in DFU.
II : Start up the iBSS/iBEC grabber.
III : Put the save folder on a new folder on your desktop.
IV : Hit “Start Monitoring”.
V : Now go back to iTunes
and do SHIFT + Restore. Then browse for your 3.1.2 IPSW. You will need
to restore
to 3.1.2 in order to pwn 4.0.
——-
Saving your iBSS
I : After Restoring, Go to the folder that you have specified to save
your iBSS file.
II : You will see folders like (Per**.tmp). Go into one of them, and
you’ll see a folder called “Firmware“.

Go there. Then go to the folder “dfu”.
III : Copy the iBSS file to a safe place, then you can remove the
folder created by the iBSS Grabber.
——
STEP B : Creating custom 4.0 firmware.
I : Download sn0wbreeze from
[You must be registered and logged in to see this link.] and create
your custom 4.0 ipsw.
*Ignore the warnings after browsing for the ipsw.*
——
STEP C : Installing LibUSB for iRecovery
Run this mini tool to detect your O/S + Arch. — Windows + Arch.
Detector
*********
WARNING : IF LIBUSB IS NOT INSTALLED PROPERLY, YOUR USB MIGHT NO LONGER
WORK!
*********
Windows XP Users download
this installer — LibUSB Installer

*********
Windows Vista/7 users RUNNING 32-Bit:
* Download the
installer and run it in compatibility
mode for Windows XP.
*********
If you are a 64-Bit user, follow this tutorial — LibUSB 64-Bit Tut
*********
Once LibUSB is installed iRecovery should be able to function now.
——-
STEP D : Pwning iBSS + iBoot
I : Download this easy tool here —
Payload Pwner-r2 for 3GS
// It will help you create the payloads.
**SAVE THE PAYLOADS WHERE iBooty is.**
——-
STEP E: iBooty Prep.
Most of you know of the utility “iBooty” that I made for Aki_nG.
It will work as long as you place all of the correct files there.
I : Download iBooty GUI here — iBooty for 3GS and Extract it.
II : Extract your Custom IPSW created by sn0wbreeze with 7-Zip or another un-archiver.
III : Grab the kernelcache and bring it into the same folder as ibooty.
Also grab the iBEC from the folder
“Firmware\dfu\iBEC.n88ap.RELEASE.dfu”
IV :
* Rename your iBSS 3.1.2 signed to “ibss312.dfu”
* Rename your Kernel 4.0-Custom to “kernel.40″
* Rename your iBEC 4.0-Custom to “ibec40.dfu”
======
Your folder should look like this :
- iboot.payload <– Created with Payload Pwner.
- exploitibss312 <– Created with Payload Pwner.
- ibec40.dfu <– Grabbed from Custom IPSW made by sn0wbreeze.
- irecovery.exe <– Comes with iBooty.
- readline5.dll <– Comes with iBooty.
- iBooty.exe <– Comes with iBooty.
- ibss312.dfu <– THIS NEEDS TO BE YOUR iBSS from the restore!
- kernel.40 <– Grab from Custom IPSW made by sn0wbreeze.
- sn0w.img3 <– Comes with iBooty.
======
——-
STEP F: Restoring to 4.0 + Booting
——-
*MAKE SURE YOU ARE ON 3.1.2 WHEN DOING THIS*
I : Run iBooty and Select “Prepare Device for Custom Firmware”. Run the
Process and if you see a snow flake, you can proceed!
II : Now open iTunes and restore to the custom ipsw.
***WHEN DONE, YOUR DEVICE WILL HAVE A BLACK SCREEN AND NOT BOOT! ITS IN
A DFU LOOP [THIS IS NORMAL!]***
——-
STEP G : Booting
I : Just Re-Run iBooty and select “Boot It”. If all goes well it will
boot!
——-
Enjoy!
——-

</blockquote>
As always, please don’t forget to drop us a line
to tell us how it
goes.
Thanks everyone for the tip!

[courtesy iH8sn0w]