Knowing

Version 0.9.15b2 fixes a few issues for 3GS owners: old-bootrom awesomeness is no longer forgotten directly after a restore, and iPad baseband upgrade/downgrade support is fixed (same production date cutoffs apply!). If your 3GS is currently tethered at 6.0 even though you have an old bootrom, just re-run redsn0ws Jailbreak step (no need to restore). Dont forget you can add some pizzaz with your own boot logo or a nerdy verbose boot.

• redsn0w 0.9.15b2
• redsn0w 0.9.15b2

Redsn0w 0.9.9b2





Update #10: Version 0.9.9b2 has been released with fixes and enhancements related to: Verizon iPhone4 firmware detection, Fix Recovery, Stitching, and blob processing. If you encountered a problem with any of these in the b1 version, please try b2.



Here are the download links:

• redsn0w 0.9.9b2 for Mac
• redsn0w 0.9.9b2 for Windows

With todays official iOS5 release, redsn0w has been updated to 0.9.9b5 to include the public URLs for the IPSW files. This way, first-time iOS5 jailbreakers dont need to supply the IPSW file manually. Its still a tethered jailbreak on all except the old-bootrom iPhone3GS, and it doesnt apply to iPad2 or the upcoming iPhone4S.

Because the jailbreak is currently only tethered for most devices, were not going to release a new PwnageTool yet. Instead, weve decided to build some of PwnageTools functionality into redsn0w (since you need redsn0w to "Just boot tethered" on every power cycle anyway). The new "Custom IPSW" button on the Extras screen will create a custom IPSW without the baseband update for 4.3.3 or 5.0gm (iPhone3GS and iPhone4 only, for now). Remember not to accidentally restore to the stock IPSW after you create the custom one! The custom one begins with NO_BB_ (for "no baseband").

You must enter "Pwned DFU" mode before trying to use the NO_BB_ IPSW with iTunes (and your hosts file cannot be pointing to Cydias servers due to the new blob nonce mechanism theyre using in iOS5).

Version 0.9.9b5 only available for Mac for now, until we can do more testing on the Windows version of "Custom IPSW".

Were currently working on a normal compatibility update for existing ultrasn0w unlockers. After that well try to fix the iBooks issue on jailbroken iOS5.








Here are the download links:

• redsn0w 0.9.9b5 for Mac
• redsn0w 0.9.9b4 for Windows (version 0.9.9b5 after more testing)

---

Greetings, friends & jailbreakers!

It has now been several months since I (posixninja) took the stage at JailbreakCon (fka MyGreatFest) in London. Since then, I & other members of the Chronic Dev team have been keeping quietly busy on many fronts, so I thought it was about time to give you all a brief update.

Update on iOS5 Jailbreak
First & foremost: during my JailbreakCon talk in September, I was excited to announce that the Chronic Dev team had already discovered 5 different exploits for use in our upcoming jailbreak. Unfortunately, that announcement was a bit premature, because in the subsequent weeks, Apple found & patched a (critical) few of those exploits, between the beta versions we used for testing and the final release of iOS5 on October 12.

Sadly (and trust us, we are much more sad about this than any of you could possibly be), this has prevented us from being able to release a new jailbreak as quickly as we wanted to. As I hinted at earlier this week on Twitter, I was initially disheartened to think that so many of the countless hours we’ve worked on this jailbreak seemingly went right down the drain.

Not to mention, these are by no means the first exploits that have been “lost” by Chronic Dev (or any other iOS hacking teams) in this manner. In fact, these are just a few in a long-running series of exploits that were patched by Apple before we hackers could make use of them in a free jailbreak for you, our loyal fans.

Well, to be frank… this is bull****!!! And now, Chronic Dev is ready to turn this little information battle into an all-out, no-holds-barred information WAR. So we want to use this experience as an opportunity to explain the method Apple uses to find potential vulnerabilities, as well as to unveil our new master plan, which should not only prevent this from happening to us again in the future, but also allow us to use all of you to find more exploits, so we can ultimately get an untethered jailbreak into your hands as quickly as possible.

How Apple Finds Exploits
One of the primary challenges in working with userland exploits is that, every time any program crashes on your iPhone, a “crash report” is generated and instantly sent back to Apple. As you can imagine, while we’re working out all the kinks in the exploitation of a vulnerability, we may need to crash any particular program thousands & thousands of times.


It’s possible to change your iTunes settings to stop sending this diagnostic information back to Apple, and of course everyone in Chronic Dev has made this change on all our development machines. However, even this is not always 100% effective at preventing Apple from obtaining our data. For instance, if one of us is at a friend’s house and plugs our iPhone up to his or her computer (even just to charge it), it’s very likely that computer is set up to send all our valuable data & crash reports right back to Apple.


As a side note, this is also the primary reason we’re unable to perform or allow any public beta testing of our software before it’s released. Any potential beta tester could be unknowingly sending crash reports back to Apple, which would prematurely alert the company to our exploits & the discovery of their vulnerabilities before we even have the chance to release.

Help Us Help You: Send Us Your Crash Reports
Instead of allowing this vicious cycle to continue, we decided to write a new program to turn Apple’s own beast against its master, per se. All this program requires from you is to attach your iOS device to your computer and click a single button!

At this point, the program copies all the crash reports off your device (which, under normal circumstances, would be sent right back to Apple), and instead sends this data to a secure, private server hosted by your friendly Chronic Dev team. Next, our program proceeds to neuter your copy of iTunes, simply by changing your settings to prevent your computer from sending any further diagnostic information from your device to Apple.


Using this agglomeration of your crash reports and our ninja skills, Chronic Dev will be able to quickly pinpoint vulnerabilities in various programs by using the same techniques Apple currently employs. At the very least, your data will help point us in the direction of which applications are the most vulnerable, so we can focus our time & energy on these with laser-like intensity. And, of course, this will also prevent Apple from accessing all your valuable data, just so they can then turn around and use it against you.


Thank You!

Many thanks in advance for your prompt response & help in this effort, your continued support of GreenPois0n & the Chronic Dev team, and your patience while we continue our never-ending, diligent work on your (free!! coming soon!) untethered jailbreak for iOS5 and/or iPhone 4S.
One final THANKS! While I have spent many of my own hours on the development, design & programming of this tool, especially the back-end, I also owe a great debt of gratitude to:

• C-Dev hacker Nikias & his lovely wife Hanene – for the many tedious hours they spent programming the front-end & user-friendly interface;
• C-Dev member OPK – for his graphic design work & the brilliant logo for this app; and
• Chronic-Dev, LLC – for graciously hosting the servers where we will store the (fingers crossed) millions of crash reports and other data that you all are going to send us momentarily, via this link…

[CDevReporter_mac.zip]


[CDevReporter_win.zip]

NOTE : This link is to the Mac beta version of our software. An updated/final Mac version as well as a Windows version will be available in the next 24 hours.

Finally, we will be making a more concerted effort to keep you updated on our progress in the days & weeks to come, so keep checking back here on our blog!

First, the high-level new feature list:

• restore from any 5.x iOS to any other (up, down or the same) 5.x iOS on all devices as long as you have the correct blobs (see more below)
• Cydia now included in the tethered 6.0 jailbreak on A4 devices
• automatically “Just Boot” tethered when qualifying A4 device connects in DFU mode
• untethered 6.0 jailbreak on old-bootrom 3GS
• untethered 6.0 hactivation on any 3GS or iPhone4
• directly restore pre-A5 devices to earlier firmware — no more complicated 15-step how-to’s with stitching, iTunes errors, and “hosts file” concerns
• fetch new signed blobs for any IPSW (present or future — no redsn0w update required) using Extras->SHSH Blobs->New
• block the BB update for any 3GS or iPhone4 restore (past, present, or future — no redsn0w update required) using Extras->Even More->Restore
• deactivate any iPhone, useful for testing your “official” unlock status through iTunes. (Please only deactivate your own iPhone!)
• activation status shown on “Even more” page
• significantly more (very nerdy) info returned by “Identify” button when device is in Normal mode
• tethered jailbreak of ATV2 supported (but the only thing available for it is the SSH2 custom bundle available here — no Cydia yet. Must use “Select IPSW” for tethered boot of ATV2 for now).
• auto-exit WTF mode for older devices with broken buttons
• any time a set of blobs is fetched remotely (from Apple or Cydia), redsn0w also saves them locally (and will check there first if you click “Local”)
• for your future restoring convenience, you should also submit all of your past and present TinyUmbrella blobs to Cydia if you haven’t done so yet. Resubmitting is okay and won’t cause conflicts.

Here are more details on the iOS5-to-iOS5 restores for A5+ devices. (Note: pre-A5 devices don’t have these restrictions — just follow the redsn0w prompts during the restore).

1. redsn0w now lets you restore an A5+ device from any iOS5 to any other iOS5 as long as you have correct 5.x blobs for the starting (current) and ending points of the restore

• APtickets eliminated “higher-version only” comparison of firmware restores (just like BBtickets did for the baseband)
• example restores supported by redsn0w if you have the correct blobs: 5.1.1-to-5.0.1, 5.0.1-to-5.1.1, 5.1.1-to-5.1.1, 5.0.1-to-5.0.1
• if you don’t have the blobs locally, let redsn0w try to fetch them remotely (redsn0w always tries both Apple and Cydia). Any succesful remote fetch also saves a local copy too.

2. You DO NOT QUALIFY for iOS5-to-iOS5 restores if you got to your current 5.x via an OTA update

• the tickets saved by Cydia, redsn0w, and TinyUmbrella do not cover OTA update ramdisk images
• even if they did, it’s the “wrong kind” of ramdisk (you’d need to start at that earlier pre-OTA FW)
• devices fresh from factory or refurb may fall in the “does not qualify” category (your results will vary)
• it’s okay if you previously got to 5.x via an OTA update, as long as your current 5.x was installed via a normal iTunes restore. All that matters is how you got to your current 5.x most recently
• redsn0w detects an OTA/normal-restore APticket mismatch very early, so if you don’t know your status there should be no harm in trying. Any device in recovery mode after such a mismatch can boot normally again just by going back to “Even More” screen from the “Restore” screen (or use “Recovery Fix” if you quit redsn0w before doing that).

3. Unlike the A4 devices, redsn0w can’t (usefully) prevent the baseband updates of A5+ iPhones and iPads.

• and so, redsn0w automatically flashes the currently signed baseband when it does A5+ restores, even if those basebands didn’t come with the original firmware
• stay away from this if you have an unofficial unlock that isn’t supported by the newest baseband
• the least-tested baseband update code in redsn0w is for iPad2,3 and iPad3,2. Please give any feedback on those iOS5 restores in the comments section below.

4. iPad2 owners (all three models) with saved 4.x blobs can use those instead, even from 6.x

• if you have both 4.x and 5.x iPad2 blobs, you can always get to 5.x via the 4.x blobs, even if you’re currently on 6.x
• you cannot get to 5.x from 6.x without the 4.x blobs (but you may still qualify for the iOS5-to-iOS5 restore described above)
• if somehow you have 4.x blobs but no 5.x blobs, you can still go down to 4.x from 6.x
• this only applies to iPad2 owners (they’re the only A5+ devices that ever had a public 4.x FW)
• redsn0w still supports (but doesn’t require) jailbreaking A5+ devices at 5.0.1 and 5.1.1. Just head back to the first page after re-restoring to 5.x. It’s always much faster to jailbreak those FW versions with a freshly-restored device, before letting iTunes restore from a saved userland backup.

And finally, some random details:

5. ultrasn0w isn’t yet updated for 6.x

• by now you probably should be taking advantage of the extremely cheap IMEI-based unlocks of iPhones sold by established online retailers like http://cutyoursim.com
• still, IMEI-based unlocks don’t work in all cases. We’ll announce when ultrasn0w is ported up to 6.x
• redsn0w will still hactivate your 3GS or iPhone4 if you run it before the device is activated. Due to the current tethered 6.x JB status, redsn0w now hactivates 6.x without requiring subsequent tethered boots. If you accidentally hactivate with redsn0w, use the “Deactivate” checkbox available from the Jailbreak screen, not the normal one in “Even more”

6. As always, redsn0w lets you “Fetch” the SHSH blobs currently flashed onto your pre-A5 device

• use this if you’re at 5.x or 4.x but without having saved your blobs when the window was open
• this is only useful when Apple is no longer signing the firmware, otherwise Cydia/redsn0w “New”/TinyUmbrella blobs are superior (but you’re welcome to fetch your 6.0 blobs this way anyway)
• fetching blobs in this fashion will automatically forward them up to Cydia, as well as save a local copy

We realize there’s a lot of info in this post. If you’re at all confused about things remember to visit our comments section, with our very helpful user base and moderators like dhlizard, Frank55, 41willys, and slavakulikoff.

If you’re in the Melbourne, Australia area, MuscleNerd (and another anonymous long-time Dev Team member) will be giving some talks at the Breakpoint conference http://www.ruxconbreakpoint.com this week. And @mdowd’s iOS talk at the same conference should be quite interesting too! We’ll also all be attending Ruxcon a few days later, so say hi if you see us!

---

Update #1 (Oct 15): Version 0.9.15b2 fixes a few issues for 3GS owners: old-bootrom awesomeness is no longer forgotten directly after a restore, and iPad baseband upgrade/downgrade support is fixed (same production date cutoffs apply!). If your 3GS is currently tethered at 6.0 even though you have an old bootrom, just re-run redsn0w’s Jailbreak step (no need to restore). Don’t forget you can add some pizzaz with your own boot logo or a nerdy verbose boot.
Here are the download links. Enjoy!

• redsn0w 0.9.15b2 (OS X — use Ctrl-Click->Open if on Mountain Lion for now)
• redsn0w 0.9.15b2 (Windows — run in Adminstrator Mode)