Downgrading iPhone 4 without blobs

[shuky]

Ok well as the title says it all let me show what I have been playing with.

First up the tools and the platform I used.

Windows 7 Ultimate 64bit

Redsn0w 0.9.6rc15

Snw0breeze v2.6.1 for 4.3.2
Sn0wbreeze v2.1 for 4.1

Tiny Umbrella v5.00.11

Fixrecovery for Windows

USB View

iTunes 10.2.2.14

iPhone 4 32GB -> only blobs are 4.2.1, 4.3.3, 4.3.5, 4.3b1, and all iOS 5 betas.

So you might be asking yourself "why the hell would I want to downgrade?" well I don't really know myself, I was just playing with a theory I had and decided to test it out and here are my results, with lots of pretty pictures.... lol


Ok so lets check out the phone and the blobs saved in Tiny Umbrella, be assured I have checked to see if there were any other blobs saved on cydia and there were none.



So as we can see I don't have any blobs for 4.1 or 4.3.2

At this point I like to open USB View just so I can be sure of the phone's status before I do anything



What you do next is make a custom firmware with the appropriate sn0wbreeze, I'm not going to go through that as there are many tuts on that just search and you will find them.


You can at this point if you want use the DFU helper at the end of sn0wbreeze to put your phone into pwned DFU mode.

If you don't want to use sn0wbreeze then you will need to use redsn0w to achieve the same thing, the only difference is it doesn't matter what firmware you select to put it into pwned DFU mode.








Right so once you have the phone prepped and your custom firmware ready you need to open Tiny Umbrella and run the TSS server, you need to do this as if you don't then itunes will spit an error out at you and you won't be able to load the custom firmware on.



Remember to check in USB View that the phone does say DFU mode.



Ok the big part, open iTunes and it will detect the phone in recovery mode.... lol we know it's not because of USB View, guess that is Apple just dumbing it down for the masses.
Click the ok



NOW VERY IMPORTANT, you will need to hold the shift key down when you click restore, this will give you the option to select your custom firmware.
Go ahead and select your custom firmware.



iTunes will give you a message about contacting servers to verify the restore, pfft don't worry cause you got Tiny Umbrella going..... don't you?



Ok at this point you are now a passenger, let iTunes do it's thing and if all goes well you should recieve a message at the end telling you that your phone has been restored and will restart.











Well guess what? The phone will restart alright, but in a permenant DFU loop. You can confirm this with USB View.



This is what got me stumped at first and took me a little while to find a solution.

So what you need to do now is close iTunes and start redsn0w.

Pretty much follow the on screen instructions at the start until you get to the options screen.

From here select "Just boot tethered"



Now have a little patience here as it seems to take a little longer than usual. You should at first see the Apple logo with the progress bar then it should change to the famous pineapple logo.



Then hey presto it should boot up.

Now depending on what you selected in sn0wbreeze (activated or not) will depend on what screen you are greeted with, i.e. the activation screen or the battery charging screen.







IMPORTANT

Although this method works (I have now successfully done it over 8 times) it is a permanent tethered downgrade. So far I have not been able to figure out how to make it untethered.
So if you are not sure what tethered is, it means it WILL go into DFU mode loop if either you turn the phone off or it runs out of battery. I didn't test respring though so not sure on that.



Ok so you may still be wondering why the hell would you downgrade, well my theory was that if you could get a custom firmware on there that you didn't have SHSH blobs for you might be able to downgrade and
use iFaith to then get the blobs of a firmware you didn't have or wanted.

So I guess you want to know if that worked right?

Well have a look at the pics below first then I'll tell you.







So sadly I think the pics really say it all. iFaith will run, the phone will start dumping, but everytime I tried there is a "sequence of bytes" missing. I can only
assume that either the custom firmware omits that part, or the tethered boot is the problem. Either way that's where I got stuck and just have not made any progress.

Anyway I thought it might be worth sharing with you all as you never know, someone else might have the tools or the know how to finish this....


N.B. The firmwares I have tried are
4.0.2 unsuccessful to boot
4.1 tethered boot ok
4.3 tethered boot ok
4.3.2 tethered boot ok

[AppleHacker]

WELL nice guide
But still its tethered jailbreak also you may experience some crashes so do it at your own risk!!!

[shuky]

yeah possible about the crashes, I didn't thoroughly test the stability of the tethered boot, I was really aiming to try and get the blobs with iFaith....

[AppleHacker]

Originally Posted by shuky

yeah possible about the crashes, I didn't thoroughly test the stability of the tethered boot, I was really aiming to try and get the blobs with iFaith....

Well i'd rather prefer to have a tethered jb on IOS 5 beta8 then on IOS 4

Also its not stable at all i remember i did this on my iphone 4 and it crashes some timesl

[eXe]

does gevey sim work with ios5 beta 8 ?

or is ios5 beta 8 unlockable at all ?

[l8ter]

MuscleNerd confirmed on Twitter that the Gevey is indeed blocked in iOS Beta 2, after numerous tips and reports surfaced about the issue. Apple most likely received pressure from carriers to block Gevey’s exploit.

It’s assumed that Gevey will aggressively update its unlock while it still can. For now, iPhone 4 users with a preserved baseband who want an unlock with the Gevey SIM will need to stay on iOS 4, or remain on iOS 5 Beta 1.

[eXe]

ok.. damn that sux for users who want to update to iOS5

but by the time, all apps and tweaks gets supported by the new iOS, there will be an software unlock.

so i guess im im good with ios4, until then..

[ZildjianNathan]

Hi there! I'm a newbie here. I hope that there will be an untethered version of this soon. more power!

[xxxrichievxxx]

This is similar to what I did to downgrade my iPhone 4. I upgraded my iPhone 4 from 4.3.3 to 4.3.4, without saving my blobs. I downloaded tinyumbrella and attempted to downgrade 4.3.3, downgrade installed fine, then at the end of the downgrade, it gave me an error 1014 or something like that. Well seems like tinyumbrella was able to detect my iPhone 4 with firmware 4.3.3 installed. I decided to click on get saved blobs from cydia, and presto! It found the blobs even though my phone was in recovery mode ("connect to iTunes") I was still able to get my blobs. After I downloaded and saved my blobs I used an activated ipsw 4.3.3 and I installed via iTunes and it worked! I was back to 4.3.3 and I still am! Lol

[joecef]

yea hopefully this info could help @ih8sn0w make ifaith work properly under these circumstances.
if he even reads this..lol

then anyone could downgrade to firmware of choice!

nice work!!

[tripmonk]

nice work!

[St3ven]

Great work! but what i wonder is what if you are on 4.3.5 and you have a real shsh of 4.1 before, and when you did downgrade normally cause you saved your shsh would it downgrade your baseband too? Also if it does maybe you could find a way to make Sn0wbreeze not preserve your current baseband so it can finally downgrade the bb…. This only intrigued me cause of unlocking… I might be wrong on the theory im not sure if downgrading to something lower downgrades your baseband too.

[xmrsam]

er. i was able to get my 4.3.3 blobs saved... try using ifaith v 1.2.1.

but they were saved under .faith ...

cant restore to custom signed ipsw also. error 29 . =.=

[PoEtikly]

I really want somebody to find a true complete working fix for this. Great work though on getting most of it figured out. I wish I knew that much about how this $h!¥ works.

[Shonnayy]

Whats the difference between an Iphone and an Ipod Touch?
I know that the iphone is a phone and the touch is not, but are there any other differences or is that it. Also does the iphone have free wifi or do you have to pay for it like a regular cell phone?

[l0k0]

First pic of TU shows iphone4 blobs.......2nd pic of TU (going into TSS server) shows blobs for 3G and 3GS. Does not show the blobs of the same iPhone4 that was in the first pic......Is there a reason behind all of this?

Im trying to understand WHERE (in what mode, or at what time), did the 4.1 and 4.3.2 blobs come from. And WHY are u running TSS server, if in fact there is no blobs for 4.1 and 4.3.2........IF they were there, how come they are not showing.

[shuky]

L0k0, when making this guide having to go back and forth between programs and screen capture I imagine that I inadvertently must have clicked on one of the other phones when I took that screen shot. Really though does that matter? I showed the blobs of the phone on the first pic of TU with the scroll bar all the way at the top so there are no previous blobs to be seen.

Secondly I explained to get the custom firmware on the phone you need to have TU's TSS Server running, just like you do on any device to get a custom firmware on them (iOS 4 & up that is).

So just to clarify for you, the guide, theory went like this. Device with no SHSH blobs below 4.2.1, wanted to install 4.1 custom firmware to try and extract SHSH blobs with ifaith. Procedure, put device into owned DFU mode, run TSS Server, install custom firmware. Problem after was a DFU loop. Ran redsn0w and selected just boot now (tethered boot), device booted into custom 4.1 firmware. Now to extract blobs with ifaith, ran ifaith, device starts process but fails to find the required bit of data to complete task to get official 4.1 blobs. Hence theory has come to a grinding halt as I am unsure of how to fix that. So what this means is that you can downgrade a iPhone 4 without saved blobs but it will be like a tethered jailbreak, which for some if not most people is not an option. I was only sharing my data/experience in the hope that there may be someone out there who could see this through to the end and actually devise a tool or method to get a proper downgrade so that if people "accidentally" upgrade they would have a path back to get to a firmware where there was a stable and untethered jailbreak.

So did you manage to follow my crazy convoluted mind in all that? Lol. Don't be put off with the screen shot of the 3G blobs, remember I have to look after all the iPhones in my family so my tiny umbrella has our current 5 phones plus all the previous phones that I have owned and sold on, not to mention that most of my work mates give their phone to jailbreak and or fix, so I have had loads of blobs TU and I am just slow in deleting the ones that I don't need anymore.

[l0k0]

Gotcha........makes a little more sense to me now. Gonna give this a looking into over the weekend and see whats going on with it. Looks like it could be fun.

[xanhxanh]

Anyone know if it's possible to downgrade iOS 5(baseband 04.11.08) to 4.3.3 if you have SHSH saved on Cydia?

[susi_san26]

I'm trying to use this to downgrade an iphone 4 from 5 gm. What i hope is to find a way to go unthetered on 4.3.x and ulock. Using this, baseband is downgraded, or at least make gevey work???


Wonderfull this apples as soon as you get them working and don't die in the process. )