Questions about how to use iRecovery

[CuriousGMan]

Hello everyone,

I've been searching for a few hours on here and on Google, but I can't seem to find ANYTHING.

I've read up about the irecovery tool and I'd like to play around with it. The problem is, I can't get it to work!

I have an iPhone 3Gs (new bootrom) on 4.1 and an iPad1 3G on 4.2.1. I've tried both devices with the same result.

I have a Mac on OSX 10.6.7. I compiled irecovery from the Chronic-Dev github.

I put the device in a pwned DFU mode using the RedSnow. That works fine, or so it seems. Then I go to terminal and run

./irecovery -v -s

This is what I see:

# ./irecovery -v -s
Attempting to connect... 
opening device 05ac:1227...
Setting to configuration 1
Setting to interface 0:0
libusb:error [submit_bulk_transfer] endpoint not found on any open interface
libusb:error [darwin_clear_halt] endpoint not found on any open interface
> bgcolor 255 255 255
libusb:error [darwin_control_callback] control error = transaction timed out
libusb:error [submit_bulk_transfer] endpoint not found on any open interface
libusb:error [darwin_clear_halt] endpoint not found on any open interface
> /exit

I've even tried disconnecting all other USB devices with no luck. Am I missing something? Your help is greatly appreciated here.

George

[CuriousGMan]

Well, after further research, I've solved this question myself.

As I suspected, it is not enough to just put the phone into a pwned DFU mode and expect a shell in iRecovery. Various docs allude to this, but it is never explicitly stated.

What one needs to do is extract the iBSS from a modded IPSW for that specific device and firmware and upload it to the device FIRST, before using irecovery -s to get a shell. So basically:

irecovery -f <IBSS file for device/firmware>
irecovery -s

Then you can do things like:

bgcolor 255 0 0

From what I can tell, most of the time people use iRecovery is when they need to get out of recovery mode after a restore. At that point, an iBSS has already been uploaded to the device.

I found that the documentation about PwnStrap from the iPhone wiki to be helpful in making this determination.

George