[MAC or WIN] SSH Into Your Phone While In DFU Mode!!!

[cdguy707]

If this has been posted already in the tuts section, go ahead and just delete it. I did a search for it but only found multipazz's guide which works for Mac only. This method is a little easier and works for both windows and mac.

Im sure alot of people have had their iphone crash on them and either got stuck in a boot loop or recovery loop. Most people have the cydia package af2cd installed on their phone and can use ifunbox or iphone explorer to get into their phone. And there is also usually a 30-60 second window where u can even use WinSCP to SSH into your phone as well. But i recently had a problem where i couldn't even get WinSCP to recognize my phone and i did not have af2cd to use ifunbox or iphone explorer. I have never backed up my phone and had alot of pictures, videos, contacts, important text messages and notepad notes that i refused to loose. After much of everyone telling me that it was impossible to retrieve the data on my phone and i would have to just restore and lose everything, i learned a neat little trick and i would like to share with everyone.

This guide will show you how to access your phone via SSH while in DFU mode! This way you will never lose your data again!!! I hope this helps everyone and shoot me a thanks if you like it!!!

Big thanks to Camilo Rodrigues @Allpluscomputer, iPhone Dev Team, @planetbeing, Chronic-Dev, @posixninja, @pod2g, geohot and iH8sn0w who made this method possible!!!

First i downloaded these two files

SSH_RD_Rev03B.jar

https://github.com/downloads/msftguy/ssh-rd/ssh_rd_rev03b.jar

and
JRE-7-Windows-i586-iftw.exe (For those using windows platform not needed on mac)

http://download.oracle.com/otn-pub/java/jdk/7/jre-7-windows-i586-iftw.exe

You then need to install the JRE-7 file because in order for the program to work you need to have a 32-Bit JRE for Windows. On Mac OSX, you can skip this whole step.

Once JRE-7 file is installed, then you need to open ssh_rd_rev03b.jar file that you downloaded earlier. Upon opening it, it will ask you to connect a device in DFU mode. Plug your iPhone in and put it in DFU mode. Once successfully in DFU mode, the .jar program will do the rest. Let it complete its process until it says "success" and you see the login and password at the bottom.

Now for the next step, you can use terminal for mac or for windows, you should use Putty.

Open up the ssh client:
For Mac: u need to type in terminal ssh -p 2022 root@localhost and hit enter. it will prompt you for password... type "alpine" (without the " obviously).
Fow Windows: open Putty and connect to "localhost" and port "2022"
once connected it will prompt you for user name (type "root") and then it will prompt you for password (type "alpine").

Next you will type "mount.sh" and hit enter. Let it do it's thing and if it was successful, you should see these two lines:

(For devices on iOS4)
Mounting dev/disk0s1 on /mnt1 .,
Mounting dev/disk0s2 on /mnt2 .,

or

(For devices on iOS5)
Mounting dev/disk0s1s1 on /mnt1 .,
Mounting dev/disk0s1s2 on /mnt2 .,

At this point, you can use cyberduck for Mac or WinSCP for Windows.

For Cyberduck you need to make a new SFTP connection to localhost, port 2022
For WinSCP you need to make a new SFTP connection to:
Host Name: 127.0.0.1 Port Number: 2022 User Name: root Pass: alpine

Once connected, you would navigate to / and find the mnt1 and mnt2 folders.

Inside /mnt2/mobile/ you should find all your address book, pictures, notepad notes, SMS folder, etc. Just copy them to your desktop.

Inside /mnt1/Library/MobileSubstrate/ you will find your dynamic libraries which you can set all the .dylib extensions to .disabled (if you want to try and boot into your phone)

If you want to try to boot into your phone after disabling all of your mobilesubstrate addons, just hole the power button and home button on your phone until it restarts. It will most likely go into recovery mode, in which you will just open up TinyUmbrella or which ever program u prefer and kick it out of recovery. At that point you should be able to boot into your phone.

Here is a YouTube video showing how this works!



I hope this helps you guys out there. It sure helped me.... at first i was able to go through WinSCP but after i had thought i fixed it and restarted my phone, winSCP was no longer able to access my phone through wifi... but this method works beautifully!

[Slimshouki]

thnx man but this one wont work on iphone 4s
it says device unsupported

[cdguy707]

sorry bud, i dont have an iphone 4s to test... but i have tested on an iphone 3 iphone 3gs and iphone 4... i was successful on all of those... that tells me that this will only work for idevices with the a4 processory not the a5...

[LouWeegie]

well, just my luck, (ssh_rd_rev03b.jar ) can only get to
" Exploit sent!
Preparing to load the ramdisk..
Ramdisk load started!
MobileDevice event: DfuDisconnect, 1227, 8920
MobileDevice event: DfuConnect, 1227, 8920
DFU device 'iPhone 3GS' connected
Ignoring same device iPhone 3GS
MobileDevice event: DfuDisconnect, 1227, 8920
MobileDevice event: RecoveryConnect, 1281, 8920 "
doesnt seem to want to finish

My loop occured after updating Cydia

Any HELP would be Greatly appreciated...with wonderful praise and admiration

---------- EDIT ----------

well, just my luck, (ssh_rd_rev03b.jar ) can only get to
" Exploit sent!
Preparing to load the ramdisk..
Ramdisk load started!
MobileDevice event: DfuDisconnect, 1227, 8920
MobileDevice event: DfuConnect, 1227, 8920
DFU device 'iPhone 3GS' connected
Ignoring same device iPhone 3GS
MobileDevice event: DfuDisconnect, 1227, 8920
MobileDevice event: RecoveryConnect, 1281, 8920 "
doesnt seem to want to finish

My loop occured after updating Cydia

Any HELP would be Greatly appreciated...with wonderful praise and admiration

[DrUmtux]

Oh, man u've saved my ass! I messed up 'overclocking' of my iDevice. I've tried a lot of tuts to save reboot problem a THIS was the only one witch worked.

Again, thanks. Daniel Born

[sreknob]

Fantastic information.
Most recent ssh-rd can always be found here

[Skidz]

how do u open the jar file and which program do u use?? i messed my fstab file and i need to fix that in order to get it fixed..... plz help!!

[willy1560]

Do you need to be jailbroken?

[auhm]

When I try to open the ssh_rd I get this error: INIT FAILED (mux thread)!
Possible causes:
iTunes 9 or newer is NOT installed.
Could not bind to the port 2202 (make sure only one instance is running!

I have iTunes 10 installed, any suggestions?

[AgentCoffee]

Does this not work with A5+ devices?

[cercelsorin]

and yaaa......working my idevice again whitout restore,but with this SSH_RD_Rev03B.jar not work,get a error same @auhm user but find a russian executable recovery_tool_apple_device.exe a tutorial with pics and video Recovery Tool Apple Device i hope not delete this post because is verry useful. i search for this tutorial a 1 hour ago...succes all and never restore and loose data for a wrong tweak installed and some files edited for a faster idevice.