Manually Jailbreak iPhone 3GS(New Bootrom) on iOS 4 Using Sn0wbreeze[Mac]

Sn0wbreeze 1.7 for 4.0 (for Windows) has been released. This release supports iPhone 3GS (old and new bootrom) iPod touch 2G (MC and non-MC models), and iPod touch 3G. Though iPhone 3GS (new bootrom), iPod Touch 2G (MC models) and iPod touch 3G will have to be either on 3.1.2 firmware, or will need to have their SHSH blobs saved for iOS 3.1.2 in order to successfully jailbreak these devices on iOS 4. Also the jailbreak for iPhone 3GS (new bootrom), iPod touch 2G (MC models) and iPod touch 3G on iOS 4 will be tethered, which means whenever you turn off your phone, you will need to re-connect it to a computer to be able to turn it back on.

The step by step guide to jailbreak these devices is almost exactly similar to the last release.Once you have created a custom firmware file, you can simply restore to it via iTunes 9.2. If there are any changes, we will redo the guide and post it again here.

Follow the original post here if anytime you feel that this is confusing.

You will need a iPhone 3GS (with new bootrom) on iOS 4, which has SHSH blobs saved for iPhone 3.1.2. Some other important notes about the jailbreak are as follows :

1) it is a tethered jailbreak (whenever you turn off your phone, you will need to re-connect it to a computer to be able to turn it back on) and

2) it will only work for those devices which have their SHSH blobs(ECID SHSH) files for 3.1.2 (NOT 3.1.3) saved on Cydia.

If you meet all the requirements, and have lots of patience, you can follow this tutorial

Windows users can follow here

Warning Note: All the standard warnings apply. This is for advanced users only. Only proceed if you think you know your iPhone inside out.

Pwning 4.0 on New Bootrom 3G[S] w/3.1.2 SHSH Blobs [Mac]

Credits to iH8sn0w. Thanks to lilstevie for help.



iOS 3.1.2, 4.0

iOS 3.1.2 SHSH blobs

Download this (

STEP 1 : Grabbing your 3.1.2 iBSS file.

Pointing your hosts :
I : If you have your shsh blobs saved on Cydia/ Saurik’s server then follow this tutorial. —
II : If you have it saved with TinyUmbrella, then download the GUI here. —
Restoring to grab the iBSS file.

I : Place your device in DFU.

II : Start up the iBSS/iBEC grabber.

III : Put the save folder on a new folder on your desktop.

IV : Hit "Start Monitoring".

V : Now go back to iTunes and do SHIFT + Restore. Then browse for your 3.1.2 IPSW. You will need to restore
to 3.1.2 in order to pwn 4.0.

STEP 2: Creating your custom firmware
Use Pwanage Tool ( to create a custom ipsw ignore the warnings about the new bootrom.


Extract the zip file we downloaded earlier and use terminal to enter it

Create a new folder inside this called 3.1.2 and extract your 3.1.2 ipsw here (unzip *.ipsw in terminal)

Use xpwntool to patch iBoot & iBSS (run this in terminal)

xpwntool Firmware/dfu/iBSS.n88ap.RELEASE.dfu ibss.d -iv 41639d34547ae3dd7921bf3539dba529 -k 9121de4a038675d92e1a28683b2138b7a3bdb80994273d090398051c7f5af53c; bspatch ibss.d ../exploitibss312 ../ibss.patch; xpwntool Firmware/all_flash/all_flash.n88ap.production/iBoot.n88ap.RELEASE.img3 iboot.d -iv 127aa60e77da219961ee70707f44cbd4 -k c72ab4aae971f3a9ec356dfe555e4aef72d8e96c480698445ac236904e6a3443; bspatch iboot.d ../iboot.payload ../iboot.patch; cd ..; rm -rf 3.1.2

Create a folder called 4.0_cust inside 4.0_pwn and enter it with terminal and copy your custom 4.0 ipsw here.

Extract your custom ipsw (unzip *.zip)

Run the following in terminal:

cp kernelcache.release.n88 ../kcache.40; cp Firmware/dfu/iBEC.n88ap.RELEASE.dfu ../iBEC.40; cd ..;

Copy your signed iBSS from earlier into 4.0_pwn

STEP 10:
Place your device in dfu mode (power home for 10 seconds, release power keep holding home (blank screen and itunes asking to restore).

STEP 11:
Run the following in terminal:

./irecovery -u ibss312.dfu; ./irecovery -r; sleep 10; ./irecovery -e exploitibss312; ./irecovery -u iBEC.40; ./irecovery -c go; sleep 10; ./irecovery -u sn0w.img3; ./irecovery -c "setpicture 0"; ./irecovery -c "bgcolor 1 1 1";

STEP 12:

Restore your custom 4.0 ipsw
Booting your device:
Run the following in terminal (once in the 4.0_pwn directory):

./irecovery -u ibss312.dfu; ./irecovery -r; sleep 10; ./irecovery -e exploitibss312; ./irecovery -u iBEC.40; ./irecovery -c go; sleep 10; ./irecovery -u sn0w.img3; ./irecovery -c "setpicture 0"; ./irecovery -c "bgcolor 1 1 1"; ./irecovery -u kcache.40; ./irecovery -c bootx;

iTunes will detect your device several times before it boots.
PS: When i wake up i will write a script to automate most of this.- iH8sn0w

Once you have jailbroken your phone, you can unlock it using ultrasn0w 0.93 (on any baseband)


 iPhone © 2012 | Designed by, in collaboration with Credit Card Machines, Corporate Headquarters and Motivational Quotes