Ο Saurik δημοσίευσε έναν αναλυτικό οδηγό στον οποίο μας εξηγεί τον τρόπο με τον οποίο μπορεί να γίνει Restore και Downgrade στην v3.0 σε ένα iPhone 3GS με v3.1.
Ο παρακάτω οδηγός αναφέρεται ΜΟΝΟ σε όσους χρήστες iPhone 3GS είχαν προνοήσει και είχαν δημιουργήσει το “on file” ECID SHSH στο Cydia (σύμφωνα με τον Saurik παραπάνω από 50.000 χρήστες 3G[S] το επέλεξαν!) .
Η μέθοδος του Saurik παρακάπτει τον έλεγχο της Apple αφού χρησιμοποιεί τους servers του Cydia, για να πραγματοποιήσει την πιστοποίηση του εκάστοτε firmware:
Bypassing the Overlord
To this end, I have constructed a server that duplicates the functionality exposed by Apple’s signature server, except using “on file” results rather than live requests.
All we need, then, is to make iTunes use it. Luckily, most operating systems also have the ability to locally define bypasses on specific hostnames through a file called hosts. Using this, we can redirect requests to Apple’s signature server to Cydia.
So, open the file C:\Windows\System32\drivers\etc\hosts (Windows) or /etc/hosts (Mac OS X) and add the following entry to the bottom of the file.
74.208.105.171 gs.apple.com
Now, when iTunes thinks it is talking to Apple, it is talking to Cydia instead. Doing this will allow iTunes to access signatures already stored by Cydia’s “on file” feature.
This server will also act as a cache for any SHSH blobs it hasn’t seen, acting as an intermediary to Apple’s server. This effectively registers your device with the “on file” mechanism, which means you can now enjoy the protections of being able to downgrade your firmware in the future even if you aren’t jailbroken.
This point should be stressed: even if you don’t jailbreak, and even if you never intend to jailbreak, you should consider using the new “on file” service.
Let’s say that Apple releases an OS upgrade in the future, you take it, and they break something important. Maybe they break your e-mail account, or your todo list. Your business is now crippled.
If only you could downgrade, right? Alas, Apple won’t let you anymore. That’s where the new signature cache server comes in: by doing your restores through this server you secure your ability to not accept upgrades from Apple if the need is dire.
Performing the Restore
Now, one would have hoped that the process would be as easy as “restore using the 3.0 IPSW”. If only we were that lucky. The first problem is that a downgrade from 3.1 to 3.0 must be initiated in DFU mode.
So, we begin: hold down the lock and menu buttons (some call these the power and home buttons) for 10 seconds, letting go of the lock button but continuing to hold menu until iTunes recognizes the device with the message: “iTunes has detected an iPhone in recovery mode. You must restore this iPhone before it can be used with iTunes.”.
Note that, at this point, your iPhone’s screen should be entirely black. Many people confuse “DFU” with “recovery” (and in fact, iTunes itself glosses over this), but they are quite different. If you see anything on your screen, such as the iTunes logo and a sync cable, or a cartoon of Steve Jobs swearing in Cyrillic, you are in recovery mode and need to try again. One can find videos online that may help.
At this point, you should do a “normal” restore to the 3.0 software. When doing this, remember to hold down the option key (on Mac OS X) or the shift key (Windows) while clicking the Restore button in iTunes. Select the firmware (which is probably named iPhone2,1_3.0_7A341_Restore.ipsw), and things should be on their way.
Please note that I do not have signatures for 3.0.1, only for 3.0. For some very small number of users I also have a signature for 3.0.1, but I ran out of time hitting the Wednesday deadline getting the code for this working and generalized.
If you would like to try restoring to 3.0.1 with my server, therefore, to see if you have 3.0.1 keys on file you can try, but it may fail late in the process with a very weird error. All users “on file”, however, have 3.0 ready to go.
Upcoming 3.1 Exploit
If you encouter “unknown error (3002)”, you probably do not have your ECID SHSH’s for 3.0 “on file” with Cydia. Unfortunately, as Apple is no longer allowing users to sign the 3.0 firmware, it is no longer possible to register your device with Cydia.
Luckily, it has been reported that iPhoneOS 3.1 is vulnerable to another exploit. This means that, once a jailbreak is released for 3.1, users will be able to prepare themselves for future jailbreaks even if they missed the first round of signature storage (which I unfortunately was only able to start very late in the 3.0 game).
Once you even attempt to use this service (or if you tell Cydia to “make your life easier”) you will be signed up for the signature tracker, and Cydia HQ will do its best to manage your ability to restore.
NAND Format Invalid
OK, if you were already using 3.0 then this process should “just work”. However, if you had already upgraded to 3.1 you will encounted a nasty error: “The iPhone “iPhone” could not be restored. An unknown error occured (1015).”. This is expected behavior.
For people who are curious, what has happened is that a section of the NAND storage has been slightly reorganized in 3.1, and the 3.0 iBoot can no longer parse it. If we pulled out iRecovery and checked the iBoot logs over USB we’d see the following messages (the typos are Apple’s).
[WMR:ERR] NAND format invalid (mismatch, corrupt, read error or blank NAND device) [WMR:ERR] boolSignatureFound false boolProductionFormatVerified true nSig 0x0 ****************************************************************************** ****************************************************************************** AND: NAND initialisaton failed due to format mismatch or uninitialised NAND. AND: Please reboot with reformatting enabled. ****************************************************************************** ****************************************************************************** NAND FTL failed initialisation
The first time this happened to me I actually spent a while with MuscleNerd working out how to do what it asked: “reboot with reformatting enabled”. That was a severe waste of time: after you fix this, it still won’t boot, and you will need to go through a second restore to finish the process.
However, it turns out a second restore also formats the NAND correctly by itself. So, without bothering to do anything else to the device (leaving it in the recovery mode it is now in: DFU is no longer required), just start the restore over again in the same manner as before, once again selecting the 3.0 firmware.
Stuck in Restore
Unfortuntaely, this second restore is also going to fail (*sigh*), and irritatingly enough it is going to cause the exact same error message: “The iPhone “iPhone” could not be restored. An unknown error occured (1015).”. This is still expected behavior.
For those who are again curious, what has happened is that when the device turns on it has to decide what it is going to do: wait for instructions over USB, or continue into the boot process. This is determined by an NVRAM variable named auto-boot, which is currently set to “false”.
Normally this is set at the end of the restore process, but technically we were unable to finish the restore: it is my understanding that this is because upgrading to 3.1 installed the 3.1 baseband (which is currently not unlockable, btw), and the baseband upgrade in the 3.0 release then fails, stopping the restore.
However, that seems to be the last and least important part of the restore, so we technically won: we are never, though, going to be able to restore back to 3.0 without hitting this 1015 again, though.
Jailbreak with redsn0w or purplera1n
You have two. The first is to use iRecovery to manually set auto-boot to “true”, and the second is to just go ahead and jailbreak your device.
We will go ahead and do option #2 (jailbreak), as even just getting iRecovery working on your computer is something that I don’t look forward to trying to describe. ;P (In fact, it still isn’t working on my Windows computer.)
At this point, you can just run your jailbreak tool of choice, which should jailbreak the device and boot it into the normal operating system. Congratualations, you just overthrew your orwellian overlord, and have taken back control of your device.
At least today, we will prevail!
[Thanks to thanasis, iWizard]
Πργματικά αξίζει να διαβάσετε ολόκληρο το άρθρο του Saurik και να ενημερωθείτε για την iPhone-Jailbreak σκηνή: Saurik.com
Συζήτηση στο forum: [How To] Downgrade iPhone 3G[S] from 3.1 using Saurik’s Cydia Signature Server
You might also like
More from Cydia
Ο Ηλίας Λιμναίος ξεκλειδώνει το NFC του iPhone! Σύντομα το tweak στο Cydia!
Ο δημοφιλής Έλληνας developer Ηλίας Λιμναίος κατάφερε να ξεκλειδώσει τη δυνατότητα επικοινωνίας του iPhone με NFC συσκευές! Η επικοινωνία κοντινού πεδίου (Near Field Communication, NFC) αποτελεί μια πρότυπη τεχνολογία συνδεσιμότητας, η οποία διαδίδεται και εξελίσσεται ραγδαία με κύριο σκοπό τη λύση αρκετών …
PickPocket: Κορυφαίο “Anti-Theft Tweak” στο Cydia
Ο nikosgnr μας ενημερώνει σχετικά με το PickPocket, ένα νέο Cydia Tweak το οποίο υπόσχεται να προστατέψει την iOS συσκευή σας με τρόπους που η Apple δεν έχει ακόμη (;) προσθέσει στο λειτουργικό της σύστημα: Το PickPocket είναι πλέον ο βασιλιάς των …
Traverse: Το απόλυτο 3D-Touch menu στο iPhone / iPad σας!
Ο mod vrachamis του iPhoneHellas forum μας ενημερώνει σχετικά το Traverse, ένα πολλά υποσχόμενο tweak που επιτρέπει στον χρήστη να εμπλουτίσει τα αναδυόμενα μενού των εφαρμογών της iOS συσκευής του, με εκατοντάδες επιπλέον επιλογές. Το 3D Touch hardware engine έχει κάνει την εμφάνιση του …
App Admin: Downgrade των εφαρμογών απευθείας απο το App store της συσκευής [Cydia tweak]
Ο mod nikosgnr του iPhoneHellas forum μας ενημερώνει σχετικά με το App Admin, ένα νέο Cydia tweak που μας επιτρέπει να κατεβάσουμε μία πρότερη έκδοση εφαρμογής από αυτήν που διατίθεται αυτή τη στιγμή στο App store... απευθείας από την iOS συσκευή …
To WinterBoard είναι πλέον συμβατό και με το iOS 9
Ευχάριστα νέα για όσους χρήστες Jailbroken συσκευών αρέσκονται στο παραμετροποιούν την εμφάνιση της συσκευής τους, καθώς το WinterBoard αναβαθμίστηκε και πλέον είναι συμβατό και με το iOS 9. Σύμφωνα με τον Saurik, η αναβάθμιση του WinterBoard (v0.9.3919) δοκιμάστηκε από τον ίδιο τον Surenix (γνωστό από …
