Your favorite Apple, iPhone, iPad, iOS, Jailbreak, and Cydia site.
02-13-2008, 07:20 PM #1
[Tutorial] Software Bootloader Downgrade
Works on all iPhone models, 4GB, 8GB, 16GB.
Works on OTB 1.1.3 iPhones.
As always possibility of bricking, im not responsable for anything you do.
Read the entire thing first, if you don't understand even one thing, make sure you understand it before you begin.
Download the bootloader downgrade kit here
Verify, verify, verify.
To do this you will MD5 hash the downloaded file and compare the resulting MD5 sum to the MD5 sum of the original, unmodified file. On Mac OS X and most Linux distributions, a tool called md5sum is included that will do this. On Windows, there are several tools you can use, such as this
The MD5 hash of the SoftwareBLKit.zip file is 32d98d38d87707b1675bb3aef81d398e.
To check the MD5 sum of your downloaded file on a Mac, go into Applications, then Utilities, and open Terminal. cd into the location your SoftwareBLKit.zip file is at; on OS X 10.5, this is probably your Downloads folder (in your home folder). Then, run the following command:
The MD5 hash of SoftwareBLKit.zip will be outputted. It should match the MD5 hash above. If it does not, then your SoftwareBLKit.zip file is corrupted and you should follow step 1 and step 2 again.
Using the Archive Utility included with Mac OS X 10.5, or if you do not have Mac OS X 10.5 (or do not have a Mac at all), any ZIP extraction tool such as Stuffit extract the SoftwareBLKit.zip archive. The contents should be extracted into a new folder.
Step 4: Preparation.
The software bootloader downgrade process is risky on the 1.1.2 or 1.1.3 firmware. As such, it is not recommended that you use 1.1.2; use 1.1.1 or older.
If you have the 1.1.1 OS (or older) on your iPhone, then you are good to go. If you have the 1.1.2 software on your iPhone, then you will need to put your iPhone in DFU mode (by holding the power and sleep buttons, and releasing the power button after 10 seconds, while having the iPhone plugged into your computer with USB) and restore it to 1.1.1 (if you can use AppSnapp to jailbreak) or 1.0.2 (if you are unable to use AppSnapp for some reason). Once you’re at 1.1.1 or 1.0.2, jailbreak your phone as normal. (Jailbreaking your phone is out of the scope of this guide.)
Once you’re finished, if Auto-Lock is not already set to Never, set it to Never. This is important - if your phone shuts off in the middle of the downgrade process, you could permanently brick your phone and then you’d have a pretty iPod Touch.
Using Transmit or Fugu (on a Mac), or WinSCP (on Windows), create a folder in /usr/bin called unlock. Upload the contents of the ZIP you extracted in step 3, to that folder.
Installing Mobile Terminal.
This procedure should not be performed with Wi-Fi. If, for some reason, your Wi-Fi connection fails in the middle of the process, you could permanently brick your phone. You should install MobileTerminal on your phone using AppTapp. The simplest way to install this is by using the Installer - and this is the method I will be using.
In the Installer, touch the Install tab, then go into the System category and install the Term-vt100 package. (If you do not see this package, then you most likely do not have the Community Sources installed. To install this, go into the Sources category and install the Community Sources package.)
SSH into your iPhone and type the following command:
chmod 755 /usr/bin/unlock/*
Step 8 - Unload CommCenter
Using the SSH session from step 8, type the following command:
launchctl unload /System/Library/LaunchDaemons/com.apple.CommCenter.plist
Close the SSH session now.
Step 9 - Open MobileTerminal
On your SpringBoard, touch the vt100-Terminal icon. MobileTerminal will open.
Step 10 - Change Your Folder
cd into the /usr/bin/unlock folder. To do this, type:
Step 11 - Downgrade Your Bootloader
Before you do this, verify that you set auto-lock to never. Also, you should have a battery with a good charge - it doesn’t have to be full, but it should be fairly high. I like to keep the phone plugged in - that way, there will be no battery problems.
In MobileTerminal, type:
./gbootloader secpack bleraser bldl 3.9_M3S2.nor
Once this is completed, you will have a phone with the 3.9 bootloader!
Step 12 - Reflash Your Baseband
In MobileTerminal, type:
./bbupdater -f ICE03.14.08_G.fls -e ICE03.14.08_G.eep
Once this is completed, your baseband firmware will be 03.14.08 - which is the 1.0.2 baseband firmware.
Step 13 - Restore Your iPhone
Using iTunes, restore your iPhone to whichever firmware version you’d like. Provided that the firmware version is 1.0.2 or higher, you should not receive any error from iTunes.
Congratulations! You now have a phone with the 3.9 bootloader. Run anySIM or any other unlocking tool that works on 3.9, as normal.
Kudos to acujo.com for coming up with this!
Bump cause people might want to use this.
Last edited by DoerrFan; 02-13-2008 at 07:20 PM. Reason: Automerged Doublepost