Ultrasn0w 1.2 offline packages in iPhoneBrowser

To use, simply navigate to var/root/media/Cydia/AutoInstall and drop the two files inside. If there is no Cydia or AutoInstall folder you must manually create these folders. (Case sensitive). Start up cydia and let it initialise the filesystem, then reboot the phone 2 times. The phone will now be unlocked

Screenshot of interface

UPDATE: the newest 0.9.6.B2 redsn0w is now out which supports loading custom IPSW from DFU mode, which means you can upgrade a 3GS that has been JB’ed with Limera1n or Greenpois0n to custom 4.1 firmware cooked with pwnagetool for example, or downloaded from *ahem* third party sources.. and keep your old baseband and unlock safe, Please try that method before this, which should be used as a last resort  (http://blog.iphone-dev.org/)

The program simply searches for a text string inside the current iphone restore log, the particular string it looks for in the restore log is an indication of where a user would have previously uplugged the device manually, Upon detection of the string the program kills the itunes restore process and helper app.

Now your handset should be stuck in recovery mode. Use tinyumbrella or your tool of choice to kick out of recovery mode, and 30s- 1min later you should be presented with an activation screen, either hacktivate the handset, use programmable onesim or genuine card to get past this stage and check the baseband. With some luck your old baseband version should have been retained and you are still OK for an ultrasn0w shower!

IPHONE 3G USERS SHOULD NOT USE THIS TOOL- USE REDSNOW -> CUSTOM FIRMWARE INSTEAD

3GS USERS FIRST TRY LIMERA1N PWNED DFU MODE FROM REDSNOW 0.9.6B2

IPHONE 4 USERS SHOULD USE SAFER TINYUMBRELLA METHOD TO PRESERVE BASEBAND

THIS TOOL HAS ONLY BEEN TESTED CURRENTLY ON IPHONE 3Gs 16GB. PLEASE NOT THAT 32GB TIMING DIFFERS SLIGHTLY AND AS SUCH HAS NOT BEEN TESTED, ATTEMPT AT YOUR OWN RISK

Supported OS: win 7 (x86 x64) /  XP (x86 /x64)

To use:

1. Start restoring your iPhone in  Itunes
2. Launch the program
3. An explorer window will open showing you a list of log files
4. drag the log file into the window (one with highest number) this is the logfile that itunes is currently writing to as it restores your handset
5. Click the cmd window first to make it active, then press Enter, followed by F6, followed by Enter again
6. now wait. when the correct point is reached, itunes will automatically close, you can now close the command window

Startup message

While it is possible to put together a script to boot custom ramdisk, and execute this through irecovery similar to the method jonathan zdziarski (aka Nervegas) demonstrates http://www.youtube.com/user/MrNerveGas#p/u/5/kHdNoKIZUCw using a variation of greenpois0n by chronic-dev team to re-enable the device or simply remove the user passcode we are going to use an easier method- a quick and dirty modified implementation of Redsn0w. We will simply alter the packages that get sent over inside the cydia payload to overwrite the springboard prefs with a default version that enables the device if it is disabled and to also remove passcode prompt by simply overwriting a fresh keychain file with the passcode lock record removed

The first step is to copy over a fresh springboards pref file from an iPhone that is already in an unlocked state, a fresh preferences file can be found in the following directory /private/var/mobile/Library/Preferences.

Browsing preferences folder of iphone using iPhoneBrowser

The file is named com.apple.springboard.plist. Copy this file to a safe location. Now we need to copy the keychain database over, which is where the passcode would be stored. We browse to /private/var/Keychains  and copy over the keychain-2.db file- again storing in a safe location for future use, It is wise to copy these files from a OTB iphone that has fresh FW on, no password present or safari downloads saved, if not you could open with an SQlite browser and delete the individual records

//