Thread: Pwning 4.0 on New Bootrom 3G[S] w/3.1.2 SHSH Blobs

**BEFORE PROCEEDING, ENSURE THAT YOU HAVE YOUR PHONE BACKED UP!**
-------
WHAT YOU WILL NEED:

* An iPhone 3G[S] -- new bootrom
* 3.1.2 SHSH blobs.
* difrnt's iBSS grabber difrnt
* Payload Pwner for the 3GS. Free File Hosting Made Simple - MediaFire
* sn0wbreeze V1.6.2 Or 1.7 sn0wbreeze-V1.6.2.exe
* iBooty Free File Hosting Made Simple - MediaFire
* LibUSB (64-Bit users read carefully!!!)
* 3.1.2/4.0 3GS firmware downloaded. http://www.felixbrun.../iPod/firmware/
-------
STEP A : Grabbing your 3.1.2 iBSS file.

Pointing your hosts :

I : If you have your shsh blobs saved on Cydia/Saurik's server then follow this tutorial. -- Caching Apple's Signature Server - Jay Freeman (saurik)

II : If you have it saved with TinyUmbrella, then download the GUI here. -- http://thefirmwareum...a.blogspot.com/
-------
Restoring to grab the iBSS file.

I : Place your device in DFU.

II : Start up the iBSS/iBEC grabber.

III : Put the save folder on a new folder on your desktop.

IV : Hit "Start Monitoring".

V : Now go back to iTunes and do SHIFT + Restore. Then browse for your 3.1.2 IPSW. You will need to restore
to 3.1.2 in order to pwn 4.0.
-------
Saving your iBSS

I : After Restoring, Go to the folder that you have specified to save your iBSS file.

II : You will see folders like (Per**.tmp). Go into one of them, and you'll see a folder called "Firmware". Go there. Then go to the folder "dfu".

III : Copy the iBSS file to a safe place, then you can remove the folder created by the iBSS Grabber.
------
STEP B : Creating custom 4.0 firmware.

I : Download sn0wbreeze from http://ih8sn0w.com and create your custom 4.0 ipsw.

*Ignore the warnings after browsing for the ipsw.*
------
STEP C : Installing LibUSB for iRecovery

Run this mini tool to detect your O/S + Arch. -- Windows + Arch. Detector Windows Detector 1.0.exe

*********
WARNING : IF LIBUSB IS NOT INSTALLED PROPERLY, YOUR USB MIGHT NO LONGER WORK!
*********
Windows XP Users download this installer -- LibUSB Installer libusb-win32-filter-bin-0.1.12.1.exe
*********
Windows Vista/7 users RUNNING 32-Bit:

* Download the installer and run it in compatibility mode for Windows XP. libusb-win32-filter-bin-0.1.12.1.exe

*********
If you are a 64-Bit user, follow this tutorial -- LibUSB 64-Bit Tut http://www.ipodtouch...ad.php?t=148985
*********

Once LibUSB is installed iRecovery should be able to function now.
-------
STEP D : Pwning iBSS + iBoot

I : Download this easy tool here -- Payload Pwner for 3GS // It will help you create the payloads. Free File Hosting Made Simple - MediaFire

**SAVE THE PAYLOADS WHERE iBooty is.**
-------
STEP E: iBooty Prep.

Most of you know of the utility "iBooty" that I made for Aki_nG.

It will work as long as you place all of the correct files there.

I : Download iBooty GUI here -- iBooty for 3GS and Extract it. Free File Hosting Made Simple - MediaFire

II : Extract your Custom IPSW created by sn0wbreeze with 7-Zip or another un-archiver.

III : Grab the kernelcache and bring it into the same folder as ibooty.
Also grab the iBEC from the folder "Firmware\dfu\iBEC.n88ap.RELEASE.dfu"

IV :
* Rename your iBSS 3.1.2 signed to "ibss312.dfu"
* Rename your Kernel 4.0-Custom to "kernel.40"
* Rename your iBEC 4.0-Custom to "ibec40.dfu"
======
Your folder should look like this :

- iboot.payload

already posted .

u cant backup shsh blobs in new boot rom's.

wrong..you can if FW 3.1.3