i can confirm that this works. i successfully downgraded from apple 3.1 to 3.0 using my blob created with this tool, along with tinytss as my itunes server. i did NOT have a 3.0 shsh blob on file with saurik, only 3.1
i initially installed 3.1 firmware because my iphone had crashed on 3.0 before i had a chance to store my 3.0 blobs with saurik. so i was forced to upgrade to 3.1 if i wanted my phone in a working condition. dev team jb'd 3.1 but to my dismay, not for people in my situation (on apple's 3.1 with no blobs on file)
i just installed cydia and downloaded winterboard
my hat goes off to TheHeadFL. i wasnt sure if or when i'd ever be back on a jailbroken firmware.
my downgrade process
iphone 3Gs 32gb, apple firmware 3.1
windows 7 64-bit running itunes 9.0.1.8 (lastest version) (this did not work. see below)
windows xp-32 bit running itunes 8.2.023 (this did work. see below)
my results may have been due to an isolated problem, not necessarily my os or itunes version.
background: my 3GS iphone was on 3.1 firmware official. not jailbroken. attempts to downgrade to 3.0 were unsuccessful because i did not have a 3.0 shsh blob on file with cydia. what i did have were my ibec and ibss files saved, which i captured during my 3.0 install when i monitored my temp files and did some quick copy/pastes. everyone said these files would be useful, but unfortunately they were just taking up space because "no one has written a tool to impliment these files yet". that is, until today.
so my goal was to downgrade to 3.0 so that i could apply a jailbreak. to do this i needed my 3.0 shsh blob. this will be used when i redirect itunes, using tinytss, to look to my local machine for authorization for the downgrade.
the only applies to the iphone 3GS models with owners that do not have the 3.0 SHSH blobs stored anywhere and need itunes to authorize a downgrade to 3.0 firmware
1) generate 3.0 blob using theheadfl's shsh tool.
download the files, unzip to a directory
copy all of my .tmp directories
that were created during my initial 3.0 jb restore (process outlined here
iClarified - iPhone - How to Capture Your iPhone 3GS iBEC and iBSS (Windows)). i hear you can use other tools to grab these files during a restore such as
difrnt Blog Archive ECID Grabber & iBEC and iBSS Grabber but i personally did not use these tools. i just quickly copy/pasted to another dir all of the .tmp folders quickly as they popped up because they disappeared quickly.
if you did not do this during the initial time period when apple was still signing 3.0 (pre 9/9/09 about), there is no way to get them now.
opened up a command prompt (run as administrator just incase, if in vista or win7) and ran the following command line from the working directory of c
users\eddie\downloads\shsh_tool):
SHSH_Tool.exe -tmpfiles C
Users\Eddie\Downloads\SHSH_Tool -output C
Users\Eddie\Downloads\SHSH_Tool\30.shsh
this generated my 30.shsh blob in the defined location within the command line. when i ran the command it scrolled a lot of data but the end is the important part:
Code:
Verifying BLOB Data...
Creating custom SHSH file...
Success! SHSH File stored at C:UsersEddieDownloadsSHSH_Tool30.shsh
Complete.
2) set up tinytss to run as a webserver with the 3.0 shsh blob loaded
you can skip to step "Part 3 - Using TinyTSS to Restore" on
http://modmyi.com/forums/3g-s-downgr...ecid-shsh.html
in essence, you copy the 30.shsh to the tinytss directory and rename it 00.shsh. then open a command prompt (run as administrator again) and type "tinytss". be sure that your host file is edited to have the line 127.0.0.1 gs.apple.com .. to test, go to dos and type: ping gs.apple.com and it should reply back from 127.0.0.1
when you run tinytss, you should see the following:
Code:
Code:
Oct 4, 2009 8:43:53 PM com.semaphore.TinyTSS cacheFiles
INFO: Caching blobs...
Oct 4, 2009 8:43:53 PM com.semaphore.TinyTSS cacheFiles
INFO: Cached 00.shsh
Oct 4, 2009 8:43:54 PM com.semaphore.TinyTSS verifyCache
INFO: Verifying ecid shsh blobs...
Oct 4, 2009 8:43:54 PM com.semaphore.TinyTSS verifyCache
INFO: Detected 3.0 shsh blobs!
Oct 4, 2009 8:43:54 PM com.semaphore.TinyTSS cacheFiles
INFO: Finished caching blobs
Oct 4, 2009 8:43:54 PM com.semaphore.TinyTSS run
INFO: Starting TinyTSS service on port 80
notice how it says it detected 3.0 shsh blobs
i had some trouble getting tinytss up and running. kept getting an error saying something was using port 80. i narrowed it down to the Skype app. exited the app and all was good.
now leave this window open and proceed to part 4 of the instructions linked above, "using itunes to downgrade"
3) downgrading in itunes to 3.0
now this is where i went to itunes to initiate the downgrade process. previous attempts in doing this output messages that apple won't authorize my downgrade (obviously)
in part 4 of the instructions of how to use tinytss, it tells you exactly what to do. i had some issues which i will detail. (
EDIT: the instructions are incorrect because they say to use recovery mode. Saurik's guide says to use DFU mode which ultimately worked for me)
the instructions state to put your phone in recovery mode wehre the display shows a dock cable being plugged into an itunes logo, follwed by hitting shift+restore and loading up a custom 3.0 firmware. my attempts to do this yielded an error: "the iphone "iphone" could not be restored. an unknown error occured (20)" immediately after itunes told me that it was contacting apple servers to verify the restore .. not good. tried a few more times and no luck.
so i tried the same thing in DFU mode. (when you have the iphone plugged into to the computer and you press home+power+ for 10 seconds, then keep home pressed for a few more seconds. pc beeps like it recognized a usb device. screen is blank). this failed as well but not with an error 20. i looked at my tinytss command prompt and i showed:
Code:
Oct 4, 2009 8:44:27 PM com.semaphore.TinyTSS run
INFO: Received Handshake request...
Exception in thread "TinyTSS-RequestHandler" java.lang.NoClassDefFoundError: com
/semaphore/UmbrellaData
at com.semaphore.TinyTSS.writeHandshake(TinyTSS.java:378)
at com.semaphore.TinyTSS.run(TinyTSS.java:307)
Caused by: java.lang.ClassNotFoundException: com.semaphore.UmbrellaData
at java.net.URLClassLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.misc.Launcher.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClassInternal(Unknown Source)
... 2 more
so i thought i was screwed. i was in windows 7 64-bit running itunes 9.0.1.8 (lastest version) so i figured i would try booting into my windows XP os, instead of troubleshooting whatever that problem was. long story short, booting into windows xp, 32 bit, running itunes 8.2.023, i got the error 20 (again) trying the downgrade in Recovery mode. in DFU mode, instead of giving me the strange java errors, it actually worked. itunes reported that apple verified my iphone restore and the process was under way. at this point my phone had rebooted into a chrome apple logo with the progress bar underneath.
i received the error (that is detailed in part 4 of the tinytss instructions), error 1015. the phone booted back to the Recovery mode screen. at that point i restored the phone again by restarting itunes and shift-clicking Restore. NOTE: this second restore was initiated with the iphone at the Recovery mode screen, not the DFU screen like the 1st restore HAD to be initiated at). the process was repeated with another 1015 error which again booted me back to the iphone Recovery mode screen. i followed the instructions and assumed i was good, so at this point i unplugged/replugged the phone and...
4) jailbreak
..ran purplera1n. before running purplera1n, i tried rebooting the phone a couple of times and it kept booting right into the Recovery mode screen, so i figured i'd just run the jb right from that screen. phone booted into emergency call only. opened itunes. phone activated (i'm on a legit sim with legit at&t service.)
entered springboard, installed cydia via freeze. tested a few apps.
so i am not sure what, if any version of windows or itunes is required to do this. it may have been some other problem isolated to my machine that prevented me from restoring exactly as outlined in the tinytss instructions. i technically should have been able to restore in Recovery Mode, in windows 7, but tinytss failed. this may be something with windows 7, java, 64 bit, or something else. i can't be sure. but what i can be sure of is that using windows xp 32-bit, java 1.6.0_14, and itunes 8.2.023 will work.
good luck to all. let me know if you have any questions and i'll do my best to answer them based off my experience here. forgive any typos or repeats. not editing this.
Eddie
10-04-2009, 10:04 PM
Linear Mode
LinkBacks (?)
