[iGuru]

For anyone interested, i've just written a 710 word article about how the iTunes restore verification system works. You can access it via iGuru's Articles and you will need a PDF viewer to read it, until I get round to making a HTML version too.

---

This guide explains how to use Umbrella and TinyTSS by Semaphore to create your own 3GS restore verification server.

First of all, let's get something straight.

It is not possible to downgrade/restore your iPhone 3GS to 3.0/3.0.1 unless you backed up your 3.0/3.0.1 ECID SHSH via Cydia.

So unless it says "This device has a 3.0 ECID SHSH on file." when you open Cydia (or 3.0.1) at the top of the web page above "Welcome to Cydia" you will only be able to back up your 3.1 ECID SHSH

The random blog/website article/whatever that you happened to find on Google will not work. Sure, it might have when Apple were still allowing you to restore to 3.0/3.0.1, but they are not any more. There is currently no known way around this. Sorry.

Background

Ok, no doubt you guys have heard that Saurik recently started collecting ECID SHSH's via Cydia.

All well and good, but what happens if it's down when you need to restore? That's where two tools by semaphore (known as xsemaphorex on this forum) come in. Combined you can not only get your ECID SHSH files, but setup a server on your computer that will allow iTunes to verify restores to previous versions.

The majority of people will use this to back up their ECID SHSH for 3.1, to be able to go back to it if they update to 3.1.2/3.2 when 3.1 restores stop getting signed by Apple.

However the lucky few that backed up their 3.0/3.0.1 SHSH using Cydia will be able to restore back to 3.0/3.0.1 - if you have, when you start Cydia it will say "This devices has a 3.0 ECID SHSH on file." (or 3.0.1 instead of 3.0) at the top of the Cydia webpage on start up.

Prerequisites:

Mac users will already have Java 1.5 or later on their system, and do not need to download anything extra.

Windows users will need to download and install Java Runtime Environment 5 or higher if you do not already have it installed on your system.

You can check this by: Start -> Run -> cmd.exe and then typing: java -version
If it is Java Version 1.5 or higher, you're good to go - if not, download and install Java from the link above.

Howto:

Ok, so first things first, you will need your iPhone 3GS ECID.
If you already have this, skip to Part 2.

Part 1 - Getting your ECID:

Put your iPhone 3GS into Recovery mode - switch it off, hold down the Home button, and plug the USB cable in. When it shows a picture of the iTunes logo and a USB cable, stop holding down home.

Windows:

1) Download USBView
2) Start USBView on your PC.
3) In “options”, check off ”config descriptors” (enable).
4) Hit F5 on your keyboard to refresh.
5) Scroll down until you see ”Apple Recovery (iBoot) USB drive”, and click on it.
6) Look for ECID in right navigation pane.
7) Copy the 16 digits that follow the ECID.

Mac:

1) Open System Profiler.app (In Applications -> Utilities)
2) Click USB and select the iPhone from the list, it will show the ECID there.

To get out of recovery mode, simply hold down Home + Power until your phone reboots.

Part 2 - Getting your ECID SHSH

Windows Users: Make sure you have Java Runtime Environment 5 or higher installed.

Download Umbrella and extract to desktop.

1) Double click umbrella.jar
2) Enter your ECID in the box provided
3) Select Device Version from the list
4) Select SHSH Repository from the list
5) Click Submit

A file ending in ".shsh" should appear in the folder.

Check your shsh file is approx 64-66 KB, if it is not, it is not a valid ECID SHSH file.

Note: If you wish to get your 3.0/3.0.1 SHSH file from Saurik's server, make sure to select "Saurik - Cydia" from the SHSH Repository list.


======== You have now backed up your ECID SHSH, you can stop now unless you need to restore ========


Part 3 - Using TinyTSS to Restore

Windows:

1) Find the shsh file you want to use (e.g. 1111111111111-iphone-3.0.shsh for 3.0)

2) Open cmd.exe and cd to the fw-umbrella-semaphore directory (cd Desktop/fw-umbrella-semaphore)

3) Important! Disable any other servers using port 80 (usually webservers). TinyTSS needs to use it to create it's mini-webserver.

4) If you installed 32bit Java type: tinytss.exe -f 1111111111111-iphone-3.0.shsh
If you installed 64bit Java type: tinytss64.exe -f 1111111111111-iphone-3.0.shsh
Where 1111111111111-iphone-3.0.shsh is the name of the shsh file you want to use.

Now you need to edit your etc/hosts:

1) Start -> Run -> C:\Windows\System32\drivers\etc
2) Right click "hosts" and click "Open" when the Open With box appears, select Notepad
3) Comment out 74.208.105.171 gs.apple.com if it exists by putting a # in front so it looks like:
#74.208.105.171 gs.apple.com
4) Add this to a new line at the bottom: 127.0.0.1 gs.apple.com
5) Save the file

Open cmd.exe, and run ping gs.apple.com
It should respond:

Pinging gs.apple.com [127.0.0.1] with 32 bytes of data

If it does not say [127.0.0.1] you've not set hosts correctly, if it does, you can go ahead and restore to the version that matches your SHSH files using iTunes (See Part 4) :)

Mac:

1) Find the shsh file you want to use (e.g. 1111111111111-iphone-3.0.shsh for 3.0)

2) In Terminal.app type: cd Desktop/fw-umbrella-semaphore

3) Important! Disable any other servers using port 80 (usually webservers). TinyTSS needs to use it to create it's mini-webserver.

4) Run: sudo java -jar tinytss.jar -f 1111111111111-iphone-3.0.shsh
Where 1111111111111-iphone-3.0.shsh is the name of the shsh file you want to use.

Now you need to edit your etc/hosts:

1) Open Terminal.app (In Applications -> Utilities) and do: sudo nano /etc/hosts
2) Comment out 74.208.105.171 gs.apple.com if it exists by pressing the down arrow until you get to it, then by putting a # in front so it looks like: #74.208.105.171 gs.apple.com
3) Press the down arrow until you get to the bottom (empty) line
4) Type: 127.0.0.1 gs.apple.com
5) Press Ctrl + O, press enter, then Ctrl + X.

In terminal run ping gs.apple.com
It should respond:

Pinging gs.apple.com (127.0.0.1) with 56 bytes of data.

If it does not say (127.0.0.1) you've not set hosts correctly, if it does, you can go ahead and restore to the version that matches your SHSH files using iTunes (See Part 4) :)

Part 4 - Using iTunes to downgrade

Please Note: The downgrade process currently seems to fail if you are running Windows 7. Please try using a different machine/operating system to downgrade.

After checking the server is running, and gs.apple.com resolves to 127.0.0.1 as explained above, open iTunes 9
Note: 9.0.1 works fine, and I would recommend updating to 9.0.1 if you have not already.

Now we need to enter DFU Mode to downgrade.

1) Plug up iPhone to computer.
2) Switch your iPhone off.
3) Hold power and home together for *exactly* 10 seconds
4) Release power but keep holding home until the pc beeps as a USB device is recognized.
Note: At this point nothing should be showing on the screen - if you see a picture of the iTunes logo and a USB cable, you did it wrong so try again.
5) When iTunes opens and tells you your phone is in Recovery mode, hold down shift (Windows) option (Mac) then click Restore.
6) Now browse to the firmware you need to restore.
7) After selecting it, click Open.

If you are restoring from 3.1 with the 04.26.08 baseband the restore should complete successfully and you can ignore the bit about the error (1015) you do not need to restore twice, just go ahead and jailbreak as explained below.

If you are downloading from 3.1 with the updated (05.11.07) baseband, you need to use the above method to restore your phone twice.

The first time it should fail with "An unknown error occurred (1015)", basically, what has happened is that some of the NAND storage has been slightly reorganized in 3.1, and the 3.0 iBoot can no longer parse it.

Now, try again, this second restore is also going to fail with "An unknown error occurred (1015)", this is normal behaviour, don't worry. However, this second restore re-formats the NAND fixing the previous problem.

Important (the last step) - Now, you need to re-jailbreak 3.0 and you're done:

If you are using an official carrier (Such as o2 in the UK, AT&T in the US, etc.) and have activated the firmware version you are restoring to previously you can use RedSn0w, as MuscleNerd kindly mentioned that if it has been officially activated before for that firmware version it will not hacktivate the phone.

However, if you are going to be using the official carrier and have not done so on that version before, you will need to use Purplera1n.

Anyone using unofficial carriers should use RedSn0w instead (though if you updated to 3.1, your baseband will have been updated and you will have lost the ability to use ultrasn0w to unlock).

Part 5 - Troubleshooting Errors

I get error 1604 when trying to downgrade, what should I do?
Try a different computer or operating system. I found that I was unable to downgrade due to this error on Windows 7, where as it worked fine on Vista + my Mac.

I get error 3002, what gives?
If you get error 3002 the ECID SHSH for that version does not exist/is malformed, this means you will not be able to downgrade to this version. Sorry!

I get some error not listed here!
First, try using the Search This Thread feature and type in the error number (e.g. 3002), if there are no results try googleing it e.g. iPhone restore error 3002

I have a question that hasn't been answered anywhere in this post!
Go ahead and ask it, either myself or someone else will answer it if we can.

That's all folks. Hope this clears up some of your questions!

[reverser]

Great job iGuru! This should help quell the questions.

[Supra98st]

so all were doing is adding a # to suriks add on, then another line at the bottom? Mine will not let me restore after that like you say?

I pinged and all worked fine, just cant restore............tells me that it can not contact APPLE ITUNES

Can you just post what the bottom should look like?
Thanks

[one1]

I'm not getting 00.shsh for some reason. but the program says "done wait a few seconds and check the folder"

~ 10.6 snow leo aluminum iMac
~ GUI for umbrella

Program operates properly but never delivers file.

[reverser]

Originally Posted by one1

I'm not getting 00.shsh for some reason. but the program says "done wait a few seconds and check the folder"

~ 10.6 snow leo aluminum iMac
~ GUI for umbrella

Program operates properly but never delivers file.

Do you have the umbrella.jar file in the same directory? My assumption is that perhaps while the GUI is functioning as expected, it cannot find the actual jar to execute the routine.

[one1]

It's twitchy about where it wants to be placed on the MAC to work, but a little finagle and it fired up

Then my LS started pinging.

[xpate]

Thank you so much IGuru and Semaphore! And it should be noted that some of us are not using Cydia, for example anyone with a stock 3GS with 3.1 FW, so this restore option is fantastic! And as for ID storage and all other storage, redundancy always rules.

Thank you iGuru for making an easy process absolutely painless!

[nappyreddz]

when i choose the firmware in umbrella do i choose the one i want to restore to or the one that i am on now

[hafa]

i do it but i have error 3004. please help

[ncruise]

Hello
I followed your process step by step for MAC. But I am still getting errors like 'Server not available or could not be contacted'.

[nappyreddz]

I followed the steps to the T to obtain the 3.0 firmware using sauriks server, i get the blob but when i run tinytss, it comes up real fast then closes, i screenshot it and it says something about the blob being malformed. that happens for the 3.0 and the 3.0.1 blob. the 3.1 is good, any thoughts to this problem< maybe we can figure it out. just brought 3gs and 3.1 was already installed on it.

this is a screenshot of tinytss that i had to do a printscreen on to catch it. this is what comes up when i try to use tinytss with the 3.0 or the 3.0.1 blob

[fobmatik]

if i get my ecid from my 3.0.1 will i be able to restore to 3.0.1 or 3.0?

[tampabuc2004]

Hey this is awesome. this was so quick to setup, now i just cant wait to go home and fix my phone. I really think this should be stickied.

[jaytrixz]

I did the methods posted above and I get stuck at the prompt that says Verifying iPhone restore with Apple. Here's some screenshot I get.

[swasey1982]

Very nice work indeed, but my Iphone 3gs is currently stuck were its been for the past 5 days on the apple bootup logo with the wheel of death, I got my ecid but I guess umbrella cant read my shsh cause its not booted up, any ideas guys. I never updated to 3.1 or 3.0.1, it was running on 3.0.

Richard