[ZT][PwnageTool] FAQ and How To Guide [Mac 1.1][Windows 0.99 BETA]

lolo8

UPDATED tutorial for PwnageTool 1.1. on MAC and Windows BETAThe Pwnage Tool 1.1 is OUT NOW!

Mac Guide below!
3 d8 b: v/ L! n1 y
1 W* z9 `8 s, C3 [, }2 J# UWindows BETA IS OUT!
0 t8 o- {# u6 C/ Y# J5 l" N
includes FAQ now
This thread is updated multiple times every day with the latest information! Latest update: Monday 21st April BST
) P- h  D1 K4 k# {0 j  u; d! A7 u

- f1 D, _8 m9 z. g7 ?! A& sThis is a very simple process. Below is a detailed guideline with FAQ and solutions to possible problems.

( u3 b9 Q$ X" K3 A  D: IAt the most basic level all you have to do to make this work is:

% R* Y& y: e& p7 o. J1. Pwn your phone.
! R( |, ]' L- h* P2 Z1 b2. Make custom firmware.
3. Restore using custom firmware in iTunes.
' R2 p5 F6 z: z- P- z: Mhttp://www.youtube.com/watch?v=siuKQw6L6Rk&eurl=http://www.engadget.com/2008/03/29/video-of-the-iphone-pwned-project-in-action/
  o& W) d) E$ G; H) \% ]- @) Z  J/ yThis took unlocks ANY firmware and activates it.
+ P: h1 P& {% ?' g
It even allows us ALL to run the 2.0 beta (if we can find it online!).

This will replace all other tools such as iPlus/iLiberty+ and ZiPhone.

; m9 ~0 D) v0 A7 m3 a) @7 f-----------------------------------------------------------------------------------
6 k- K) Y) J1 ?% B7 t
9 i: [0 T: s/ JFAQ
% S& E8 U( M3 ~" k

3 Q! B9 L4 i, q5 w$ X5 u) T% _ITUNES ERROR MESSAGES - HOW TO FIX THEM - see below tutorial
0 T, `, q3 Z7 C+ ^, \
8 m/ j8 e7 |! n6 B; H/ |WINDOWS BETA USERS IMPORTANT READ HERE!
: h* _/ ?. w! B( m8 |3 |4 L
Windows BETA version is OUT!
* t/ S/ l: \7 chttp://www.winpwn.com/index.php/Main_Page
What does that mean?

! d/ u! |7 x# \8 ?& }Beta means that it may go wrong - it may crash - your iPhone/iPod may fail to restore or get stuck in a boot loop.
6 Z1 Z2 }, r5 v; g3 K) a
; ^* q) Z2 R0 M# j! m0 G  gRight now winpwn is MAINLY FOR JAILBREAKING and adding Installer.

It has disabled unlocking features to ensure further testing goes smoothly!

This means you CANNOT unlock the iPhone using the windows version - However adding the installer source for BootNeuter will let you do that.
* T; @5 r. T! X. u/ r+ t/ w# {EVERYTHING CAN BE FIXED BY RESTORING and recovery mode.

" D. W- b5 t; Q; o+ o' l- WAlthough it is for windows the buttons do the same and it works the same way.

) J* q" S( ?' Z2 `  X2 uFollow the same steps below as on Mac (except some options will NOT be available in the beta and greyed out!
# q: C$ S6 @3 {- W4 {" k$ M+ s

It takes approximately 10 minutes to build the ramdisk for the "ipwner" part on Windows
( l( X4 @+ e  `, R; A
It takes approximately 15 minutes or so to build the IPSW on Windows
4 d% D# z3 j- ~1 Q1 i0 q4 I, }
NOTE: Once you pwn your iphone/ipod using winpwn you CAN download already made custom firmwares to install but this is not recommended as you do not know if the source is reliable.

To select custom firmware on PC - press SHIFT and click on the restore button in iTunes.

2 f  P: u- y$ f, J1 K; `iLiberty+ is available for PC and can be used to put iPhone/iPod into recovery mode or kick it out of recovery mode should you need to.

, S% r0 G9 {, U" k( zYou will require the iTunesMobileDevice.dll in order for WinPwn to work and you will have to put it inside the winpwn program files directory - these can be downloaded from winpwn.com.
# r- y, S& r8 g' s! y' \
' e3 q3 x, W8 M' g. V* ~They would have to be put in "C:\Program Files\cmw\winpwn"

3 p6 P6 y# J! H/ `* {+ z( Z( d----

Should you use this if I already used ZiPhone/iPlus/iLiberty+?

If your phone is working at this time then there is NO need to use pwnage.
  p' F+ S4 i1 R  S
Pwnage is a safer method for jailbreaking/unlocking/activating but unless you like
messing with new firmware then there is no reason to use it.
* [0 i/ m' Z# u
However, none of the above apps will unlock/activate/JB 2.0 or any of its betas.

So for the next firmware you will have to use Pwnage.

( A( P+ m7 `# |6 Y3 s: hIf you wish to revert to your original bootloader you can using pwnage now!
5 c! j$ S' J; m/ ^
) j4 R, Y+ R% c! ]9 tiPhone or iPod Touch?
3 T- V% ~' Q4 O/ c- h' @$ t
3 F1 I3 k- h. y5 rBoth work with Pwnage - for iPod instructions just use iPod restore files instead of iPhone files I mention below!

9 V  k3 j( r' s  Q- x: @) E7 fPWNAGE does not add 1.1.4 apps or wiggly icons on iPod touch- you can get those through installer by adding the source: http://repo.ispazio.net or buy them through iTunes
Is it for Windows and Mac?
. m3 j9 @4 K) `5 o) ^
2 e- \' ~  T( D: E" n& `- \Right now a full version is available for Mac. Windows is currently available for Beta Testing!

& a. f2 P4 d. {! |: cIs it safer than ZiPhone/iLiberty+
/ }  G5 O9 l( \& V* @. Z4 C
! c* V3 K4 ]6 x% |$ O- z( [Yes as it changes your file system BEFORE you restore and therefore avoids all the possible problems you can have with other methods.

Will Installer be added automatically?

4 n" c( x: V% k% X$ r1 _: \: L& bIf you rebuild the firmware using pwnage then 1.1.4 will have installer added to the firmware. Installer is not added to 1.2 or 2.0 beta firmware as it would not work at this time.

3 u4 h9 Y8 S7 B- F" Z" SCan I just jailbreak ONLY?
$ p! ]  }" s1 @3 E9 ^
Yes - don't tick any boxes on the firmware options and it will ONLY jailbreak your phone.

- ]" U1 F8 H1 E! O  @2 dHow do I pwn my phone?
- B3 r( E, q+ ^( n! j0 E: M* @) I
. J& X/ I( k+ ?0 H' z$ K8 w' _Video of process courtesy of Engadget.com :http://www.viddler.com/explore/engadget/videos/5/
0 K( }) P1 Q4 d; Z7 qDownload the pwnage tool from the pirate bay! Do a search for "PwnageTool.app"

- |. ]. y" P, \5 R' Z! DYou can download from the iPhone DevTeam site but it does not have the bootloader files you need and so it is easier to download
a complete copy from torrents.

: p( t5 n, `4 q6 V7 b$ B& N6 uThe download without the bootloader files (which you WILL NEED to use pwnage) can be found here:
8 v* J1 B2 K" `. s. f$ D9 K
Bootloaders can be found at: http://www.hackint0sh.org/forum/show...t=36508&page=2

' W8 o3 B+ r$ r  Z  aApple Firmware files can be downloaded from:

+ W% z) @$ w+ O, ]iPhone:
6 Y3 C- F9 h' c6 i& L+ g- y5 ihttp://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPhone/061-4313.20080226.Sw39i/iPhone1,1_1.1.4_4A102_Restore.ipsw
% u0 D6 }5 c5 s& q: p: H) w1 N& R( ~iPod:
6 m$ v; {5 h. ?! d6 ahttp://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/bundles/061-4312.20080226.Btu45/iPod1,1_1.1.4_4A102_Restore.ipsw
4 g  A4 ?( E6 [1 |+ R2 w3 I7 ]8 {ONLY use iPwner on 1.1.4
9 C  Z8 V$ E& w# {% T
BEFORE YOU TRY ANY OF THE 2.0 BETA VERSIONS YOU MUST PWN AND UNLOCK/ACTIVATE WITH 1.1.4
, m/ @" P3 q$ [2 w6 R, U" ]
8 m" _9 `( X! c$ P2 P. f) fIf you do not have 1.1.4 then RESTORE to 1.1.4 using iTunes (also to familiarise yourself with the restore process) as normal then run the pwnage tool.
9 x! g8 k* [) \" D4 c, S
7 A6 k5 S- s! U' {6 PYou can pwn your phone without restoring first from 1.1.4
! S3 i) {0 `: ~! \3 W
% A7 N& v* g# J$ `1. Click the "Browse .ipsw" button.

2. Select the 1.1.4 restore - on mac it is in the

6 H$ ^( ?& `4 \, B9 j/ Q' KUser (ie your name on your mac)>Library>iTunes>iPhone Software upgrade
2 a' p8 v5 I- q
Then you just select the firmware. There is even an iPod folder so you don't get confused!
# Q2 }% o9 ^$ E1 ?( g/ m4 x
MAKE SURE YOU SELECT THE CORRECT FIRMWARE FOR YOUR IPHONE/IPOD.
' W# Q/ c- c& C# L
EXAMPLE: IF YOU HAVE A 1.1.4 IPHONE THEN PWN IT USING THE 1.1.4 IPHONE RESTORE FILE!
" ^% S9 N# f2 p; q1 M# Q' U" w
. z) e) h  J4 E3 RDO NOT USE A 1.1.4 IPOD RESTORE FILE ON YOUR IPHONE OR IPHONE ON YOUR IPOD
4 D7 Q: o6 Y" z1 H) U
If you do not have it then connect your iPhone and click on restore and it will start downloading in iTunes.
- w( H' d8 ?/ V$ r* h* Q
4 U, s1 B  a9 M5 g# j  ]UNPLUG your iPhone as soon as it starts downloading as we DO NOT WANT to restore yet!
) m* I5 z/ z" t) Y
# ~  [  L$ v& D: s( L) s4 t8 l* DOr download it directly from the above link.
; W. ]( m( h& ^2 S: `7 ~
3. Once the 1.1.4 file has been seen by the pwnage tool then click on "iPwner"... You have to put your phone in restore mode to do this.
$ Y7 Q9 d" f( ]2 Q
- j" I2 E; N) RWhilst connected to your computer turn off your phone. Hold down the home button and turn the phone back on - it will go into restore mode. You can tell this from the "connect to iTunes" logo that comes up. If you have problems getting into restore mode - then I suggest downloading iLiberty+ and looking at the advanced menu on the top left of the screen gives you the option of putting it into restore mode using that.
  B" I1 b/ q8 X% T
iTunes will open when the phone enters restore mode. PwnageTool will detect iTunes is open and ask you to close it.
; S0 m" q5 H& K. F( p- D& D
6 l5 v. R1 E1 j- X1 pJust close it anyway when it pops up by exiting it from the mac taskbar - no need to wait to be told to close it by the tool!
- Y- B4 z" U7 d( ]7 ]
Once in restore mode Pwnage tool will do its magic!

Your phone will restart with a pineapple instead of the apple logo and then boot back into normal mode.
- c+ o+ E: U" p9 g
" M% V7 e9 L  q% u* N. M" U4. Click on "IPSW builder" button. Make sure that Pwnage tool will rebuild the 1.1.4 file for you. Make sure that Enable baseband update, Neuter bootloader, unlock baseband and activate phone are selected. If you wish to keep the pineapple logo then click on use custom images if not the apple logo will come back!

0 I8 m7 z( I( _7 `1 SWhen you upgrade to 1.2/2.0 iPhone or iPod - pwnage automatically selects the correct settings so you don't have to do anything! But DON'T uncheck anything checked in that situation!
" c; `( Z7 K4 v) b
" O& i1 [8 U% u2 U( ~2 rPwnageTool 1.1 has added additional options for custom firmware creation.
# R' V1 S0 s( Z. D  \& n" B" b
"General" Tab
3 F; t, b; f+ U, a3 H5 z! Q
9 Y% P$ p; J9 T$ ~# y' }IMPORTANT: There are reports that BootNeuter CAN NOT unlock the phone unless BSD Subsystem part of your custom firmware. YOU MUST ADD IT TO THE CUSTOM FIRMWARE TO AVOID ANY ISSUES!

Now includes "Auto delete BootNeuter.app" - This deleted BootNeuter after it has been run once.
. A! V# W( I4 {! q: G
8 i3 w5 z4 j! p& A" I" `/ l/ \This avoids accidently or malicious fiddling of your phone settings by third partys as after your phone is unlocked it is deleted automatically. (Note: If you wish to re-lock your phone at a latter
) W. ~9 }; W) hdate you would have to restore again to a new custom firmware with auto-delete unchecked so you can reset the settings or download BootNeuter directly from Installer)
9 L4 ~3 j; @+ p2 f% Y9 s* t7 L* i
"Custom Packages" Tab
% x& }! @" m3 }5 V3 U! b6 H  {
  m5 G) E) G- b$ B0 uThis allows you to add applications you would have to download through Installer or chose whether set-up Installer on your phone in the first place.
1 f9 }5 Z* R) p0 x) A
BSD Subsystem: This package of tools is needed by MOST 3rd party apps so they can run correctly HOWEVER your Installer will not "see" it as installed so for your phone to see it as installed you need to add the big boss recommended and beta sources from the sources catagory. Then go into the system category and install "Fake BSD Subsystem" then exit installer and you can now install all apps without redownloading BSD again!

9 Q5 l! J5 @+ m, _( p9 [Installer: This is the application that lets you locate by category and download and install all 3rd party applications with the touch of one button - it MUST be selected if you want 3rd party applications on your iPhone.

' U: K- o4 `" x: }* \OpenSSH: This is a tool that allows you to wirelessly connect your iPhone to your PC/Mac and transfer files and run complicated command line applications. It is not required and not recommended unless you KNOW you need it for something first!

"Custom Logos" Tab
) [: g, s3 {  a/ V$ R  |
1 y% P( @/ o) pThis allows you to select your own custom logos for when your iPhone/iPod starts up and for recovery mode. If you do NOT check the boxes then the standard Apple logos will be used.

If you leave the boxes checked then the pineapple and Steve Jobs images will be used.

* i5 I$ n4 o& f& ~3 p9 {* |You can select your own image for the firmware by clicking on "browse" and selecting your own image however it must be a PNG gile in RGB or Grayscale format with alpha channel present. The dimensions must be below 320x480 pixels. The size of the compressed image is limited to 100 Kb.

IF it asks for bootloaders see bottom of page for how to select them!

, }5 t7 ^& ^4 R. C5 G8 s  a* UPwnage will then make a custom firmware file and save it to your iTunes directory.

5. Connect iPhone to Computer. Click on alt+ restore ON MAC or Shift + restore on PC and it should open up the file select box. If it doesn't then try the buttons next to it and restore as I always get confused on Mac what the equivalent of shift is! lol

& x3 z% x* p# Q3 J1 ~( x6. Select the firmware that says "custom restore" in the filename.
* ^9 ^8 t4 I+ L4 @( E3 K2 H
3 B9 e& B1 Y7 A* s- H, J7. Your iPhone will now restore and restart.
8 v3 \0 Q! w* R2 X# ~, n+ U  w
If you get a restore failed message then put the phone into recovery mode and try restoring again with the custom firmware before you do anything else and it should work!

8. When it restarts it will load BootNeuter automatically. DO NOT TOUCH THE PHONE
3 \* A% I1 x) q! }
) l* ]# w5 R" C/ eThe phone will reboot when BootNeuter has completed its process back to the home screen.
http://wikee.iphwn.org/_media/sgold_bootrom:mainscreen.png?w=&h=&cache=cache
  y* f4 a7 U6 ?# VYour Done - unlocked and activated!
: m  S" J  B3 u' j' p8 n------------------------------
" f$ t; h+ ?7 ?/ s% v5 p' k3 Q0 E9 q

7 H. U; f, k% ~/ e7 JBOOTLOADER INSTRUCTIONS!

1 F1 f. _* M2 g& s" R  J. }6 j
) X) W- {6 T8 U& q( H2 tIf IPSW Builder asks you for the bootloader images.

Download bootloaders.rar from the link onto your Desktop. Double click this to extract its contents.

5 {, {( f2 ?3 RClick the browse button for the bootloader 3.9 image and select BL-39.bin file from your Desktop.
2 S& F" d0 b# P- e
/ n+ l2 z# H( E! U4 F$ h; j4 z% z
Click the browse button for the bootloader 4.6 image and select BL-46.bin file from your Desktop.
) a7 l1 y8 Q, V. ^7 Z# f
1 f. O  i5 [  p% Y: T0 }2 MIt will look the same as the above photo BUT say 4.6 on the Bootloader file!

, \: b& V- @0 x; E1 _Click OK button!

5 A) p5 \) X9 I5 n
Can I go back to 4.6 from 3.9 that ZiPhone downgraded/ or 3.9FB that iLiberty/iPlus downgraded?

Yes! Just click on bootneuter on your home screen. It will "unload commcenter" DO NOT TOUCH while it is doing that!

The current settings will then be highlighted. Select what you want and click on Flash and WAIT UNTIL IT FINISHES.

ALWAYS LEAVE Baseband unlocked and bootloader "neutered". I changed my 3.9FB back to 4.6 original but STILL neutered without any issues.

DO NOT FLASH UNECCESSARILY! it is still possible to damage your phone if you go back and forth over and over. If you need to go back to your original bootloader for warranty reasons then do so otherwise leave it alone!

IF you load bootneuter and when you exit bootneuter it will take 15-20 seconds for your signal to return. just be patient!

Can I return it to Apple and they won't know?

When you click the "iPwner" button in PwnageTool, your main s5l8900 bootloader (OS bootloader) gets pwned. To undo this, use iTunes to restore to a Apple ipsw.

When you neuter using BootNeuter, your S-Gold radio bootloader (baseband bootloader) gets "pwned". To undo this, run BootNeuter again and turn off all options (and pick 3.9 or 4.6 depending on your preference).

" B% s& g  G. v. X( Q  E+ b+ j& NTwo different CPUs, two different tools. But both the s5l8900 pwnage and S-Gold pwnage are 100% reversible.

If you want to relock your phone - use bootneuter and click everything to off. Then restore with Apple firmware. And you are back to factory fresh.

If you restore with Apple firmware you will then have to use ipwner again to use custom firmware.

Can I update to 2.0 Beta?

Yes you can using pwnage. First use iPwner WITH 1.1.4. Then restore to 1.1.4 with the above mentioned settings. Then once your phone is at 1.1.4 close pwnage tool and reopen it and select the 2.0 beta.
1 u! @2 \; C: `( l; ~, V; W; R
You only need to pwn your phone once! do not do it again!
: `6 ]/ `5 D* l
Once the 2.0 beta custom firmware is built then you can select it and restore in iTunes.

THERE IS NO iTUNES/AppSTORE in the leaked 2.0 beta. Installer WILL NOT be added to 2.0 beta as it does not work yet.

; d. v1 ~- S' @% d; Q2.0 is very buggy and it is not worth updating at this time.
0 G* @6 E, ~# k4 ?7 D9 r
Can I restore back to 1.1.4 from the beta?
( s8 d3 C7 O( ?8 b: b- |
Yes you can - just restore using your custom unlocked/activated/jailbreaked firmware in iTunes. You will have to use restore mode. You may get an error at the end in which case use Independence to boot your phone normally.
5 c9 i) Q* J9 w0 z  k/ W
, R- D! Z8 l6 D
1 j  f/ B4 I3 g& F& @iTunes Error Messages - What they mean and how to fix them!

: S) z- J* I: r- x- }! d1 j
Error 1013/1014/1015 - This error message occurs when you downgrade or upgrade to a different baseband than the firmware your restoring to has. This message does NOT mean the restore failed - it simply means the phone firmware does not match the baseband. Use iLiberty/Independence to kick the phone into normal mode and out of recovery mode and it will work.

( o. G1 Z7 c* K( iError 6 and 10 - This error message is because of a problem with your firmware - this message will occur most often because of using unsuitable boot/recovery images. Make a new custom firmware to fix this and use suitable boot images or use the standard images that came with the pwnage software.
8 u4 N  n- a$ c1 X& A+ |
Error 1603/1604 - 160? something

IF YOU ARE RESTORING TO A STANDARD APPLE FIRMWARE *NOT CUSTOM FIRMWARE"

: M) E  }  w# c4 EThis error is down to itunes not liking your USB ports on your computer. Use a different USB slot or a different computer if possible. That is the easiest fix!
6 Q" U; \- ]+ q9 ^- p1 O
" N5 h# R; D# i: c* T. S$ R$ iIF YOU ARE RESTORING TO A CUSTOM FIRMWARE AFTER RESTORING FROM STANDARD APPLE FIRMWARE
( ]. [" Q8 T8 G6 f) g) m0 d1 J; _1 ^
IF you have pwned your phone once and then restored back to apple original firmware successfully and THEN tried to restore custom firmware you WILL get
( q& t5 A+ o: ^/ |an error in iTunes as the apple firmware "unpawned" your phone. You have to repwn it using iPwner and then you can restore using custom firmware.
; G8 J5 F. Q1 U) d* u9 Z: J
/ w: Z7 C: ?4 e6 Q' w: HIF YOU ARE RESTORING TO CUSTOM FIRMWARE AND YOUR PHONE IS STILL PWNED
0 n6 {$ b5 T6 a- _8 C
See "if your restoring to apple firmware" above as it is the same issue.
, R  I0 R9 G# J& ?7 J$ ?/ T1 E
3 {/ |2 W/ q# k) k1 |% \BootNeuter Error 5: This is because you upgraded to the 2.0 beta firmware without unlocking first in 1.1.4 like your supposed to. You will have to restore to 1.1.4 unlocked and then delete the 2.0 baseband. You can do this by adding iclarified to the installer sources (as explained in the localization part below) then select "Delete 1.2 Baseband" - install that and let it delete your baseband. You MUST then restore to 1.1.4 apple original firmware and then re-pwn your phone and restore to 1.1.4 custom unlocked before BootNeuter will work again.


I CAN'T BUILD MY CUSTOM FIRMWARE! WHAT CAN I DO?


- H) ?1 r- W3 W6 |Your problem is related to your Mac. It appears that for whatever reason your computer is
not mounting the image of the firmware and putting it back together so the process fails.

6 w6 s8 Y9 M( l. K) J) \# [  R6 SThere may be a solution in this thread:
0 A/ M$ |! I' Q
% p* b+ I& K$ Ghttp://www.hackint0sh.org/forum/showthread.php?t=36525

. v! Y$ e$ s; Y! ]$ CHowever if there is not you have 2 options: Try a different Mac OR Wait for the Windows version.

5 a$ b/ H/ M6 Z! A0 Q2 `# z5 C! K: HCan I customise my firmware to add certain applications etc?
: |; ?% B3 T- m

UPDATE: Video of new process available here:
' r: y2 d) k7 k5 ~9 O0 f  y6 Fhttp://www.youtube.com/swf/l.swf?video_id=JZN92GCdb_U&rel=1&eurl=&iurl=http%3A//i.ytimg.com/vi/JZN92GCdb_U/default.jpg&t=OEgsToPDskJQVpT8JErDGY3xcJ92Uxbf
# ~! Y; A: y! d0 G$ u( Z2 N8 |" @
4 R; C+ c/ k9 i3 O5 XYes you can but not with the devteam release.
( Y$ u6 [- ], i; h6 x( e& T. y, v
Another team of hackers have made an application that uses a interface which lets you select what apps etc you want in your custom firmware and then rebuilds it.
+ ]% h2 Q! ?& `9 P7 z$ @" ]
It works with the pwnage tool but is not out yet - the website is http://chronic-dev.org/pwnage:ipswtool:comingsoon

0 \( u. @7 w6 }7 YUPDATE: We have had a great success in making it, iLiberty+/X payloads even work with minimal changes! We have been able to successfully use the program to open the root dmg, mount it so that it is Pwnage compatible, patch it, put the files in it, unmount so that it is Pwnage compatible, scan with asr, and re-zip the archive. We will probably be revealing a proof-of-concept tomorrow, ether by releasing it, or showing a video. It is not being released yet because most things are done via command line for now, via the engine aviegas made. We are working as hard as possible on the GUI so we can get this out to everyone ASAP.

It should hopefully be out in the next few days.

Can I use pwnage with IPSF unlocked phones?

Yes you can. It will from my understanding it will not touch the IPSF unlock but will unlock the phone a different way and is fully compatible.  

lolo8

Can I use BootNeuter without pwning? Can I use Bootneuter without a Mac?
5 i8 E* R( ^; z7 W9 F9 N6 E9 l  |/ ~

Yes, details here: http://www.hackint0sh.org/forum/showthread.php?t=36528
, M3 Q0 W0 g" Y3 O: sI would however recommend using pwnage if you need to change your bootloader as it is the safest method as its fully automated and best for anyone who is not a hacker.
# {0 j; R: I  `
) L8 F  O! f. _- O8 a$ CI have no sound/My iPhone is acting strange after being pwned successfully? What is going on?
* Z4 \; F- [% ^# X5 l( q
First of all - ALWAYS set up your iPhone as a "new" phone - never restore from backup unless your phone was not previously jailbreaked!
/ @( F. H* U& S2 p
0 _5 m8 D% {  M2 `WARNING! Restoring a backup of a previously jailbreaked phone can cause a number of issues only fixable by another restore so don't restore from a back up of a previously jailbreaked phone!

If you have set up your phone as new and are still having issues then do a full settings reset from settings>general>reset>reset all settings and that should fix it!

I PWNED MY IPHONE/IPOD WITH THE WRONG FIRMWARE! ITUNES SAYS MY IPHONE IS AN IPOD (or vice versa) WHAT CAN I DO?
& w5 y! A; _9 h/ g
MY PHONE WON'T TURN ON! ITS REBOOTING CONSTANTLY! I HAVE CONSTANTLY SCROLLING TEXT! and ANY OTHER ISSUE WHERE PHONE IS NON RESPONSIVE
: y9 m4 X* h7 M. z" s0 }  g
You can fix this!

Put your phone into DFU mode. You can do this by pressing and holding the sleep and home button for 10 seconds WHILST THE USB CABLE IS CONNECTED AND ITUNES RUNNING from when the Apple logo appears until it dissapears and then KEEP holding the home button but let go of the sleep button - the screen will stay off but iTunes will recognise the phone.
0 F, u" N# K9 ]8 t  R( T
/ B  \8 q- y- [5 ?  ~( {8 DIf you have trouble getting DFU mode use Independence/ iLiberty+ to put your phone into DFU mode!

4 U# X( K( x3 h& _' LIf your phone is not recognised by Independence/ iLiberty+ you will have to manually put it in DFU - this CAN be tricky to time right but eventually you WILL get it!

Restore to apple original firmware and you can start over again!
1 U: W' Q8 E1 q7 t4 |
! ]( M- Z/ Z6 T
Can I remove BootNeuter once I have completed the process? its a dangerous application if someone doesn't know what they are doing!
, ]) N0 q+ ^1 ?8 @3 |( a/ r7 @4 S
If someone was to constantly flash your bootloader you could break your phone. So its best to remove the application. If you want it back just restore back from your custom firmware.

You can now select "auto delete BootNeuter" when you make the custom firmware so it is automatically removed
6 L$ {7 [& @) x* m  B6 q! `# b8 ?9 {
You can chose to "hide" BootNeuter by downloading "Poof" app from Installer - this will remove it from the phone screen without deleting it and you can get it back by clicking on it in the poof.app settings

7 T5 H* O5 P) @! \However if you have not selected that option you can manually remove it by following the steps below:
# z% `* s; e" o1 a% E
  ]$ Y2 I' q/ C$ uThe easiest way to do this is using "Term-vt100" which can be found on Installer in the "system" catagory.

+ T  w) M0 v- f! e8 b: }# a# GMake sure you install "Community Sources" from the sources catagory first.
' o- ~; `; p) i1 |
You will then need to download "BSD Subsystem" from the "system" catagory and then Term-vt100.

You will then need two fixes also from installer before it works (otherwise terminal won't login or work with backspaces)

. d* E+ z# ~# N. L9 k5 k4 N; I; ~SUID Lib Fix (from 1.1.3 tweaks section)
+ L* h: p$ f+ q5 R8 o
2 P4 E4 _# D( P7 [# P! f) t1 K0 fand

# h9 `9 ?1 q2 i" B: |. F6 U5 c  _BSD Subsystem Termfix (from tweaks section).
* V* _3 J& H  @) G7 [
' Z$ ^7 l/ _* o) b( m+ eIf you type the following command in through Term-vt100:
5 {$ V# f6 {# s4 U+ e8 |4 ^, ~
; c) Z# ?6 Q7 @4 V, @  k! i3 ^' Q. P9 {" {If you are asked for the password then type : alpine
You will not see the password appear - the cursor will just flash so when you have finished typing press enter then continue to the next stage.
$ J$ t: I+ D. {% q' Z% D3 ~- j
' B4 h1 |9 V. m1 @% a% gAfter the first line is typed then press enter, when you type the second line press enter again. This is Case sensative - and must have the correct spaces between words as well to work - if you mistype you WILL get an error - in which case retype the part you mistyped and press enter again!
5 J/ W& X4 C, U[quote]rm -rf /Applications/BootNeuter.app
- |8 I! q6 O" Ykillall -HUP SpringBoard

: Y3 Y% a1 {( o& u. Y* C% u9 ~Type it exactly like that and it will delete BootNeuter and restart your iPhone screen so it has vanished from your phone!

When you download an application from installer then click ok to install it if it asks. When you exit installer the icon for the vt-100 will appear on your phone screen. Click on the icon to access the application. The other downloads are not visible on the phone as they are tweaks to installer and the phone and vt-100.

) l% H! e. H1 y9 R( z8 ]( J+ \3 P- r1 CLocalization

Before Localizing

If you are outside one of the 'Official iPhone Countries' you will need to perform a localization of your iPhone in order for it to work. If not, SMS and Phone application will countinuously crash.
* A; |' \, g0 A4 K- u
Reason is Apple has designed the iPhone to work in the following countries:
, S% x; G) L  H# ?. p6 b- United States
) p& N% N! O% N, i4 I  ]- Canada (as the number formats are the same- but if you have any problems try localization!)
0 e! M& c: g2 g; l, m) c2 ?( k- United Kingdom
- France
- Germany
- Japan
' H" z. C0 J8 y) _6 Q- China
( l$ o6 ^: w+ c; B- Italy
) a) l$ P. g5 h% I2 S% K, N2 F" x1 |- Austria
" O& d# R& T% ?) a7 ~
. ~- x0 n1 T  K" w, ^; i3 ZSo in order to work elsewhere localization kicks in.

3 H3 {* J2 {9 [1 N* \Localizing your iPhone
3 ?9 V& i% _* V# g5 p8 g" T0 s
1. Go to Installer
! g& u3 K9 F( G6 A. j2. If you don't have the iClarified source do the following
i. Go to Sources
ii. Tap Edit
iii. Tap Add
3 }# b$ \& j6 |3 B/ l5 Biv. Type www.installer.iclarified.com
v. Refresh
8 ^0 P. R, K2 S2 A- S5 i; r% ~( ~0 G; mvi. Go back to Install Tab
3. Tap iClarified in the Install Tab
4. Scroll until you find the respective App Support.
9 Y5 _# v  W$ _1 o1 D7 a>>Important: Go with the respective version!!! (ei. Firmware 1.1.4 uses App Support (1.1.4)
7 Q! M1 V( J/ g5. Tap it
6. Tap Install.
2 v7 y1 k# b3 O/ e7. If any notice appears tap Install.
8. IPhone will download and run the package.
9 `* \1 W! L) X# j& a) ]& Z( V& ]9. Once finished, press Home botton.
& a7 U* m- {3 V; K10. Springboard will reboot.
3 L4 m: J/ b: c) e1 S7 o& X3 l! q11. Power down iPhone (off)
12. Power up iPhone (on) and enjoy!
* n/ q7 ^2 U# @6 T! l3 f% |' i& k
--------------------------------------------------------------------------------------------------------------

What do the custom firmware options mean? These explanations are from the help file on the pwnage tool
* Y; _5 ^4 x, s2 t. p4 I4 s- m

PwnageTool 1.1 has added additional options for custom firmware creation.

"General" Tab

6 I( m+ Q' g  j- P/ R! RNow includes "Auto delete BootNeuter.app" - This deleted BootNeuter after it has been run once.
7 v* N+ b! y9 E. n: ?
This avoids accidently or malicious fiddling of your phone settings by third partys as after your phone is unlocked it is deleted automatically. (Note: If you wish to re-lock your phone at a latter
* d4 M% }+ c2 k7 k+ i  w4 n5 wdate you would have to restore again to a new custom firmware with auto-delete unchecked so you can reset the settings or download BootNeuter directly from Installer)

"Custom Packages" Tab
* r# k9 i; R2 v5 D; w! L8 ~
This allows you to add applications you would have to download through Installer or chose whether set-up Installer on your phone in the first place.

9 b, g  ~. S6 ^# g: \BSD Subsystem: This package of tools is needed by MOST 3rd party apps so they can run
8 `7 W1 Z, P& h" dcorrectly HOWEVER it does not show as being set-up when you check the "uninstall" tab in Installer which means that Installer will make you download it again online before you can use any applications that require it.

Installer: This is the application that lets you locate by category and download and install all 3rd party applications with the touch of one button - it MUST be selected if you want 3rd party applications on your iPhone.

OpenSSH: This is a tool that allows you to wirelessly connect your iPhone to your PC/Mac and transfer files and run complicated command line applications. It is not required and not recommended unless you KNOW you need it for something first!

5 s. S# E7 o7 ^( l% f: u* w"Custom Logos" Tab
. s) Q1 v, H  Z4 q- H9 Q
This allows you to select your own custom logos for when your iPhone/iPod starts up and for recovery mode. If you do NOT check the boxes then the standard Apple logos will be used.
8 I; {; D" S- Z  b) N% q! j
. f% w6 G4 L$ @0 l5 c- W) KIf you leave the boxes checked then the pineapple and Steve Jobs images will be used.

- i8 o- P+ n" ^" OYou can select your own image for the firmware by clicking on "browse" and selecting your own image however it must be a PNG gile in RGB or Grayscale format with alpha channel present. The dimensions must be below 320x480 pixels. The size of the compressed image is limited to 100 Kb.

- E3 e3 x# v+ @- u1 R
; p' y3 f7 j$ L9 b5 @" cEnable baseband update - Determines if the baseband update should be enabled in the custom ipsw. Only check this button if you wish to update the baseband modem portion of your iPhone.
WARNING: This may remove previous baseband unlocks or other modifications that have been made previously. If in doubt leave it unchecked.
" D* g4 n3 Y& h4 p9 S" s- ^5 `
1 S, D1 E- @6 E1 d! l4 e+ Z; ENeuter bootloader - This will enable "Bootneutering" to the baseband firmware allowing custom firmware onto the iPhone baseband by convincing the iPhine that it is secure.

Upgrade to 4.6 - upgrades 3.9 and 3.9FB to 4.6
Downgrade to 3.9 - downgrades 4.6 and 4.6FB to 3.9

2 |- ?# _5 A! `' @6 N' h5 [- k9 }; N  mUnless you understand the above option you should avoid it
! ], B8 D* k; k2 U6 G
7 k+ N( K6 r/ f. t3 QThe only reason right now to change bootloader is because ZiPhone/iPlus etc downgraded a 1.1.2 OTB and newer phone from stock 4.6 to unlock it thus voiding the warranty. Returning it to 4.6 will mean that Apple will not know you ever changed it and you can still get that warranty (if your on an official contract).

6 H$ p6 q; I7 Z* d' L- fThese changes can be made using BootNeuter once your iPhone has booted up successfully after restoring from the custom firmware you selected
3 j+ G1 B* m3 f$ `0 X$ n$ J

Unlock Baseband - This will enable the unlocking of the baseband to all networks using a custom "software unlock" process. Use this if you wish to use your iPhone with a SIM from a carrier other than the one provided with your iPhone.

9 ?! I, _* \) ?+ P; EActivate Phone - This will activate the phone so that it can be used with iTunes. This will bypass the Apple activation process and set the iPhone to be in an Activated state allowing access to the device's functions.
3 o, p" X. b, D/ |. _7 p7 P
) w6 ?  z2 {: k5 J! @# ~Unless your unlocked phone is activated using this then it will not work with any other SIM card (other than an official SIM activated in that particular iPhone).

Use Custom Pictures - This options enables the DevTeam's funky pineapple and Steve Jobs graphics. If you wish to keep the original iPhone graphics then DO NOT select it.
' D4 [" G& _& N- j
Your iPhone will be jailbreaked with installer even if you DO NOT select any of the above options!
------------------------------------------------------------------------------------------------------
- r/ c' c2 |  N4 B
' u' M  k) e% _
I think the Hackthatphone guides are the best out there - have a look it may help you if your confused!

http://www.hackthatphone.com/114/iphone_pwnage_mac.html


& _7 u1 g3 r$ n+ I3 u" siLiberty+ - You can use this to get recovery mode if you have any problems doing it manually. Look at the advanced menu on the top left hand side of the screen for the option for restore mode/DFU. It can be downloaded from:

http://www.ipluspwns.com/


, u$ h& G+ Y; w5 B! fINDEPENDENCE: a MAC ONLY jailbreaking/activation/unlocking tool that can also do DFU mode (for serious problems where standard restore fails) can be downloaded from:

http://code.google.com/p/independence/
: i0 B5 U  A7 X! Z

* w6 z/ d7 Y/ E6 Q/ }6 LPhotos courtesy of iClarified! Thanks.
& h" j2 e: g- X  G! q* ~  c% |( E
% K% @9 q( [/ y! Q1 x4 h0 y0 A7 ZA more simple tutorial link can be found here:

http://iclarified.com/entry/index.php?enid=893

---------------------------------------------------------------------------
% z' p0 @6 o. N. x

4 H' T* E+ [3 \$ v- j6 i- xWindows Interface is SAME as Mac - Buttons do the same thing as well! So follow the mac steps above - also read important windows information above!


- I6 \  P6 h; h) B9 i7 @$ rif You Have Any Questions Add Them To The Thread And I Will Update This FAQ Asap. Thanks.
% V3 h% y; K, s& p
THANKS TO MEMBERS OF DEVTEAM AND OTHER POSTERS ON THESE FORUMS FOR HELP ANSWERING QUESTIONS
0 F* R0 Y/ ^5 ~3 ?3 L% }% qand for continuing to ask more questions![/quote]
原帖在这:http://hackint0sh.org/forum/showthread.php?t=36686

1 k# r  T' o3 z; c[ 本帖最后由 ursace 于 2008-4-23 00:56 编辑 ]