How to Capture Your iPhone 3GS iBEC and iBSS on Mac

**ameerkhan** · 07-02-2009, 05:44 AM

i have one question, i did the process as "Melech518" and i got both of the files with me, but i just wanted to ask that the files that i have are Modified on "21st May" where as the screen shot that iClearified posted it shows that the file is Modified today (whenever they did the restore and got the files), are all my iPhone's iBEC and iBSS files the same whenever i do the restore or the ones we need for the JB should be modified as its shown there? thanks.

**eballesq** · 07-02-2009, 06:26 AM

Originally Posted by swpelchat

iClarified - iPhone - How to Capture Your iPhone 3GS iBEC and iBSS (Windows)

There you go bud.

This is great, but the process involves two restores rather than one like the Mac method described in this thread. Is there a way to do this on Windows only once?

**Melech518** · 07-02-2009, 06:41 AM

Originally Posted by realiti2000

Hello,
what I found a bit strange:

At first I've tried the guide posted on the iPhone Dev Team blog (guide by iClarified). I succeeded in getting the iBEC. Getting iBSS was not so successful so I used the guide here.

What's a bit strange:
When you look at the file date (created / modified) for the iBEC I got using the iClarified guide then the date is today (at the time of the procedure).

When you look at the file date for the iBEC / iBSS received via method mentioned here on modmyi then the date shows 21 of May 2009 for me.
Could this be an issue? Are those files really the correct files signed by Apple?

Originally Posted by ameerkhan

i have one question, i did the process as "Melech518" and i got both of the files with me, but i just wanted to ask that the files that i have are Modified on "21st May" where as the screen shot that iClearified posted it shows that the file is Modified today (whenever they did the restore and got the files), are all my iPhone's iBEC and iBSS files the same whenever i do the restore or the ones we need for the JB should be modified as its shown there? thanks.

Okay, It is not a coincidence we ALL have the May 21st creation date. But also dont forget, we did not create these files, these are the files apple put on the phones when they were created, when the software was written, when the iBSS and iBEC were assigned. I believe that with the iClarified method, the files you are taking off the phone are a copy of the "iPhone Temporary Files.noindex", hence being created whenever you do the restore. With the method I provided we are copying the actual files from the phone. If you noticed when doing the iClarified method, the files you are copying are all "shortcuts" to an original. I traced these shortcuts to the "iPhone Temporary Files.noindex" to find the originals more or less and came up with this method. I hope this made a little sense and cleared up some concerns.

**johnrs** · 07-02-2009, 07:04 AM

Just wanted to check that I have done this right.

I have followed the guide on page 1 of this thread.

I have a folder called "iPhone Temporary Files.noindex" & in there are 3 DMG files, BuildManifest.plist, Firmware Folder, Kernelcache.release and a restore.plist

Do I need to do anything else?

Thanks

**Melech518** · 07-02-2009, 07:05 AM

Thats it!

**johnrs** · 07-02-2009, 07:09 AM

Cool. Thanks

**ameerkhan** · 07-02-2009, 07:21 AM

Cleared everything!

thanks!

**lilskaterpunk** · 07-02-2009, 07:26 AM

Wicked! Im gonna have to try the Windows way (iClarified). Ill see how it goes...

**reeko** · 07-02-2009, 07:31 AM

Originally Posted by sayam

Reeko, both Geohot and DevTeam has made all the 'stuff' possible so please don't say that either one of them is lying as both deserves EQUAL respect though some believe either of the two is superior . . .

Forget that long assed post. We would have no Dev team if it wasnt for GeoHots initial work. DevTeam are fame hungry whether you like them or not.

I just hate how this makes the front page news whereas GeoHots purplera1n doesn't get a mention. And i hate how even the dev team say you don't need this if you have been to purplera1n.com. The only benefit is being able to stock restore to 3.0.

Dev team havent even showed proof of their jailbreak yet on the 3GS, and they ALWAYS release pictures/ a video.

**Zwayne** · 07-02-2009, 07:44 AM

I have all my files....Bring on the J/B tool!!

**ryan christopher** · 07-02-2009, 07:55 AM

Wonder if today is going to be a jailbreak kind of day

**bmp06gti** · 07-02-2009, 08:00 AM

omg hurry the **** up with the jail break already

laaaaaaaaaaaaaaaaag

**ajmi982** · 07-02-2009, 08:36 AM

Hey everyone,

Is there a guide to do this on windows? I got my ECID and created the file through PurpleRa1n but think it is best i follow the dev teams method and get BOTH files. As mentioned, they will end up implementing the files into the jailbreak.

Thanks.

**Azzo** · 07-02-2009, 08:39 AM

Hi! I think this method does not work!!
I compared both.. I think the files you get with this method are the same for everyone! They both have the same size like in the original firmware.
After capturing them in the tmp folder they have a few more bytes..

On Mac I just typed that in terminal before the dfu restore and I got both files: "while sleep 1; do cp -R /tmp/PersonalizedRestoreBundle.* ~/Desktop; done"

All IMHO

Bye Azzo

**billchase2** · 07-02-2009, 08:47 AM

Thanks for the guide. I don't think I'll bother with it though until the jailbreak is released.

**Melech518** · 07-02-2009, 08:51 AM

Originally Posted by Azzo

Hi! I think this method does not work!!
I compared both.. I think the files you get with this method are the same for everyone! They both have the same size like in the original firmware.
After capturing them in the tmp folder they have a few more bytes..

On Mac I just typed that in terminal before the dfu restore and I got both files: "while sleep 1; do cp -R /tmp/PersonalizedRestoreBundle.* ~/Desktop; done"

All IMHO

Bye Azzo

Like I told you on the Dev Blog, these are ALL the same exact files whether you do it with the command line, the iClarified /tmp method, or the Cleanup At Startup method here. In the end you will get the same results. There is no wrong or right way to do this, it is very simple and each method works the same. Each way is unique in its simplicity and that alone.

**meagain** · 07-02-2009, 08:52 AM

Originally Posted by Melech518

Then do this process for each phone

Yes I know - But i have a 2 iPhone family here. I did husband's last night with this method and I need to do mine now. I'm referring to different file names, etc. to distinguish.

Cleanup At Starup & iPhone Temporary Files.noindex would be the same names for my stuff on my Mac as his. So to keep our phones seperate in my iMac, I have to rename something but I think it won't work if I rename the files?

**HDClown** · 07-02-2009, 08:52 AM

The method posted in the first post of this thread will net get you the correct files. The IBSS and IBEC obtained in the "Cached At Logon" folder is the unsigned one that is inside the firmware bundle. That's why EVERYONE's has the same date.

If you've read dev-team blog or twitter posts from dev-team members, you'll know that the IBSS is custom signed by apple, over the internet, when you do a restore, which means the modified date will be the same date/time you do your restore. This is why the ones people are grabbing from the Cached At Logon folder are wrong! Also, consider the fact that the dev-team blog is linking to iClarified's guide as their recommended steps.

The only way to get your signed one is to get them from /tmp (Mac) or %temp% (PC) via method posted in iClarified or other methods. Grabbing the IBSS this way is HARD though, but it only shows up for about 3 seconds.

If you are on a PC, diffrnt setup a grabber that watched all files going through the %temp% path and grabs the files for you. difrnt.com ECID Grabber & iBEC and iBSS Grabber

If you are on a Mac, do the following:
-open terminal
-type: mkdir Pwnage_save
-hit enter.
-type: while [ 1 ]; do cp -R /tmp/* /Users/your_username/Pwnage_save/; done
-Hit enter
-Start a DFU mode restore

Both IBEC and IBSS are made during DFU mode, but to be safe, I suggest you also use the above method during a REGULAR restore, which dumps IBEC only. I haven't run md5's against the IBEC's from the 2 different modes though. They may indeed be the same.

If you look at MuscleNerd's twitter stream, he comments that it's important to get your IBEC and your IBSS. The ECID grab w/purplera1n gets you your signed IBSS (which you also get through the restore method from temp location), but not your IBEC. So you want to do these steps to get your IBEC as well.

At the end of the day, better safe then sorry if you want to JB 3GS. Do every method that pops up IMO.

**eballesq** · 07-02-2009, 08:57 AM

Quick question for the experts -- I ran the "iBEC and iBSS Grabber" program and performed a DFU restore. The resulting files captured are named:

iBEC.n88ap.RELEASE.dfu (103 KB)
iBSS.n88ap.RELEASE.dfu (103 KB)

Were my efforts successful?

**pcmartinez** · 07-02-2009, 09:00 AM

what about if you have 3.1 beta install already can you get the IBEC and IBSS.

Thread: How to Capture Your iPhone 3GS iBEC and iBSS on Mac

LinkBack

Thread Tools

Display

The Following 3 Users Say Thank You to Melech518 For This Useful Post:

The Following User Says Thank You to Melech518 For This Useful Post:

Guide for Windows on its way?

Posting Permissions