Jailbreak iPhone, iPod Touch, iPad

iPhone Dev Team have just released a new version of RedSn0w 0.9.10b4. It includes a fixes for iBooks and launchctl. As always, you can simply run the new redns0w over your current jailbreak, just make sure to uncheck Cydia. To fix iBooks and launchctl errors you can also simply install new version of Corona from Cydia.

Update #4: The b4 version of redsn0w incorporates the 5.0.1 fix for iBooks, and also for sporadic problems with launchctl. Thanks to @xvolks for merging the iBooks (sandbox) fix from @comex’s github into the overall corona untether from @pod2g! As usual, you can choose to install the fix either by re-running redsn0w over your existing jailbreak (de-select Cydia if you do that), or by installing the corona package from Cydia (it’s the same set of files no matter which way you choose).

You can download the new version of RedSn0w from here.

It looks like iPad 2 and iPhone 4S untethered jailbreak will truly be a team effort. Recently another hacker Saurik joined the team and made “some major contributions” yesterday.

Last week Pod2g announced that Planetbeing, MuscleNerd, and P0sixninja joined his effort to release an untethered iOS 5.0.1 jailbreak of the iPhone 4S and iPad 2 (A5 CPU devices).

Today, MuscleNerd noted that the team has received some major contributions from saurik:

props to @saurik for major contributions to the A5 version of @pod2g’s untether yesterday! (still no ETA, but moving forward)

Pod2g also thanked planetbeing for his help in escaping from the sandbox.

And greetings to @planetbeing for the coding + research. Really great stuff to escape from the sandbox.

Good news, that means that there is progress and we might see utility sometime this month.

UPDATE:
Pod2g has also addressed the request that the untethered jailbreak be released to developers. He previously revealed that there is a working jailbreak that requires a developer account.

Sorry, we can’t release the A5 for the developers, the exploit used have to be kept secret. I know this is unfair.

Pod2g has recently announced that Planetbeing, MuscleNerd, and P0sixninja have joined his effort to release an iOS 5.0.1 untethered jailbreak for the iPhone 4S and iPad 2.

@planetbeing, the legendary hacker behind iPhone Linux and lot of jailbreaks has joined the A5 research! The famous @MuscleNerd, the leader of the iPhone Dev Team, who did a lot of tests for Corona and whom integrated it and made it simple in redsn0w is willing to help also. And last, but not least @p0sixninja, the leader of the Chronic Dev Team, and my partner for years on iPhone security research has started to code and fuzz the Apple sandbox.

That means that we now have a dream team to create a public release of the A5 jailbreak.

Several day ago pod2g posted information why the A5 jailbreak had not been released yet. The key reason being that the exploit used for A4 devices (called limera1n) doesn’t work on A5 devices. The untethered iPhone 4S and iPad 2 jailbreak that we have seen on videos and photos was created relying on having a developer account.

We are sure that planetbeing, MuscleNerd, p0sixninja and pod2g is just a great team. Hopefully they will find necessary exploit and implement it fast, because Apple might release 5.0.2 or 5.1 and fix untathered.

Apple has recently released iOS 5.0.1. It is still tethered jailbreakable. However if you want untethered jailbreak or unlock – you should stay away from 5.0.1

Earlier this week pod2g reported that a code signing bug found in iOS 5.0 will make it easier for hackers to develop a full jailbreak for iOS 5 firmware version. That bug might have been closed in iOS 5.0.1. UPDATE: According to pod2g the bug is still present, but harder to exploit because another exploit found by Charlie Miller is fixed in iOS 5.0.1.

Also, MuscleNerd via twitter has warned iOS users that there is no downgrade from iOS 5.0.1 to iOS 5.0 yet and he recommends to wait until downgrade mechanism is available.

Jailbreakers and unlockers should avoid today’s 5.0.1 until a flow for downgrading to 5.0 is developed.

Downgrade flow needs to be modified for AP “nonce” http://is.gd/b3G0io … saved SHSH blobs are not enough to downgrade to 5.0

Right after the announcement earlier today that DevTeam has successfully made first steps towards iPhone 4S jailbreak, here is more news.

iPad 2 iOS 5 jailbreak is possible and done and to prove it MuscleNerd published a quick video:

As with iPhone 4S, do not expect utility to be released anytime soon. There’s a lot of work to finish before that.

iPhone DevTeam member MuscleNerd recently tweeted that iPhone 4S jailbreak was finally made:

MuscleNerd
VERY preliminary 4S JB: http://twitpic.com/76vcp4 http://twitpic.com/76vct2 (Huge missing pieces prevent public release. LOTS of work left)

This is just a first step, and as MuscleNerd said there’s a lot of work left to do. So don’t expect to see new utility anytime soon. But this is still great news.

Take a look at the screenshots with terminal and Cydia running on iPhone 4S:

UPDATE: iPad 2 iOS 5 jailbreak video

MuscleNerd has announced via Twitter that jailbreak utility RedSn0w 0.9.9b1 is released with major update and numerous new features:

Major improvements and features added to redsn0w 0.9.9b1! See update #9 at http://is.gd/6eek4Y Feedback: @redsn0w_testers

Indeed the list of new features is quite high. There are two main ones:

• There is no need to download firmware any more. There is no need to push Browse IPWS button any more (but you still can).
• Developers added lots of functionality to work with SHSH keys (extract, submit, download, verify, stitch etc)

However this new version does not bring features like untethered jailbreak for iOS 4.3.5 or iOS 5.

Due to some possible bugs we still recommend to use the old RedSn0w 0.9.8b7b, but the new 0.9.9b1 is worth seeing and playing with.

Here are links to our RedSn0w 0.9.8b7b iOS 4.3.5 jailbreak tutorials:

• Mac OS: iPhone 4, iPhone 3GS, iPad 1, iPod Touch 3G, iPod Touch 4G
• Windows: iPhone 4, iPhone 3GS, iPad 1, iPod Touch 3G, iPod Touch 4G

You can download RedSn0w 0.9.9b1 here:

Here is the full list of features from DevTeam:

Update #9: A bunch of new features!

• uses DFU mode to try to automatically determine which device and FW you have
• fetches pieces of public IPSWs from Apple (once).  Non-public IPSWs must be provided manually (once).  It then caches those pieces for future use.
• “Just boot” is a tethered boot.  Uses whatever “Preferences” you’ve set for boot logo and kernel boot-args
• “Pwned DFU” puts your device in a pwned DFU state for some of the iTunes stuff detailed below
• “Recovery fix” gets past 1015 types of errors (when baseband portion of restore fails).  Should work on iOS5 beta too
• “Select IPSW” is for picking non-public IPSWs, or overriding auto-detection
• “SHSH blobs” has a bunch of options…
  • “Fetch” – fetch current PARTIAL blobs on device.  Should complete in under 10 or 15 seconds.  Puts the set of PARTIAL of blobs on your computer as a plist.  Checks if Cydia already has a full set for this device and build.  If not, it submits this PARTIAL set and returns Cydia’s acknowledgement or rejection
  • “Verify”  – cryptographically verifies existing blob files from either redsn0w, TinyUmbrella, or Cydia server.  You can select a whole bunch of blobs to verify at once if you want (like the TinyUmbrella directory)
  • “Submit”  – both verifies and submits one or more blob files to Cydia.  This lets you copy your entire TinyUmbrella cache of blobs up to the Cydia server
  • “Query” - queries the Cydia server for all available FULL or PARTIAL blobs for a given set of ECIDs
  • “Stitch” – stitches either FULL or PARTIAL blobs to a STOCK or CUSTOM IPSW

1. Stitching is NOT yet supported on iPhones! Need to work out the baseband part of the restore process.
2. FULL blobs stitched to a STOCK IPSW gives you a completely self-contained signed IPSW that iTunes will accept without any tricks (no need to go into pwned DFU mode, no need to start TinyUmbrella TSS server, no need to redirect to Cydia server for blobs)
3. PARTIAL blobs stitched to any IPSW requires you to go into pwned DFU mode before running iTunes.  No need to start TU or use Cydia though.
4. Stitching either FULL or PARTIAL blobs to a CUSTOM IPSW also requires a pwned DFU start before iTunes restores.  No need to start TU or use Cydia though./li>
5. Will eventually support fetching the blobs directly from Cydia instead of a file on your computer

MuscleNerd, hacker from DevTeam, has announced via Twitter that a major update to RedSn0w is coming soon.

There will be no need to select an IPSW. Rather than requiring ipsw selection, RedSn0w will now automatically fetch the important pieces directly from Apple (and caches them so that it never needs to re-fetch them again). New version also brings the ability to save and submit SHSH Blobs to Cydia.

Will be pushing out a major redsn0w feature upgrade before my trip to Korea: http://is.gd/PMAdT1 (and look, no IPSW selection button!)

The new version of RedSn0w is expected to be released on Monday.

Check out the screenshots below:

The iPhone Dev-Team has released RedSn0w 0.9.8b7b to bring two new main features:

• explicit tethered jailbreak support for iOS 5 Beta 7
• untethered jailbreak for iPhone 3GS with old bootrom (iOS 4.3.5 or iOS 5 Beta 7)

Musclenerd posted via twitter:

New redsn0w is.gd/6eek4Y explicitly supports iOS5b7 (no need to point at b6 IPSW). Also brings back old-bootrom 3GS goodies.

This is great news for both developers and owners of old bootrom iPhone 3GS’s who accidentally updated to iOS 4.3.5.

DevTeam posted:

About 12 hours after we released redsn0w 0.9.8b7 with some improvements for iOS5b6, Apple went and released iOS5b7 (what are the odds of that?!?). Even though that redsn0w could still jailbreak iOS5b7, you needed to point it at the iOS5b6 IPSW to do so. Today’s redsn0w 0.9.8b7b lets you point redsn0w directly at the iOS5b7 IPSW instead.

We’ve also added some overall improvements for old-bootrom 3GS owners (where the 24kpwn exploit applies): on those devices, you can tell redsn0w to untether 4.3.5 and lower, or iOS5b7. Old-bootrom 3GS owners can once again choose custom logos, and/or verbose booting (for the really nerdy iPhone3GS fans out there!). And it allows 4.3.4 or 4.3.5 users to use ultrasn0w again (if they have a compatible baseband).

Last but not least, we fixed some lingering Verizon iPhone4 4.2.10 JB issues.

We will update our tutorials shortly.

You can download RedSn0w 0.9.8b7b here.

Here are links to our RedSn0w 0.9.8b7b iOS 4.3.5 jailbreak tutorials:

• Mac OS: iPhone 4, iPhone 3GS, iPad 1, iPod Touch 3G, iPod Touch 4G
• Windows: iPhone 4, iPhone 3GS, iPad 1, iPod Touch 3G, iPod Touch 4G

MuscleNerd, the iPhone Dev-Team member, has announced via Twitter that developers can use RedSn0w 0.9.8b7 to jailbreak iOS 5 Beta 7.

MuscleNerd: Today’s iOS5b7 can be JB with last night’s redsn0w b7 http://is.gd/6eek4Y but point it at b6 IPSW…annoying off-by-1 now

You can download RedSn0w 0.9.8b7 here. iOS 5 Beta 7 is available here for developers and here for everybody else.