Jailbreaks are generally a safe process that can be reversed very easily by simply doing a restore via iTunes most of the time. However, this article has a purely informational purpose and doesn’t, in any way, suggest that you should hack your Apple device. Using hacks may render your device unusable, or may reduce the quality of your experience employing the respective device. If you choose to download and install jailbreak tools, you will do so at your own risk. Jailbreaking your iPad may violate your warranty or the EULA with Apple and / or your cellular-service provider.

Notes

As of the time of this article, this is not a 100% jailbreak that most users are used to. Most notably, Cydia, the graphical frontend application that most users are used to using with their Jailbreak, does not work at this time. There is an commit to the latest SVN that supposedly fixes these issues, but it is not public yet. You will still be able to install applications, but until Cydia is fixed, you will have to use the command line interface commands ‘apt-get’ and ‘dpkg’ (see below). Furthermore, be sure to use the latest bundles or you may have issues getting applications to show in the SpringBoard.  Eventually, the main issues will be resolved, but the tether process may still be a necessity until an untethered process can be identified.

Dependencies

• Apple’s iPad 4.2 Gold Master Firmware (Build 8C134) [iPad1,1_4.2_8C134_Restore.ipsw]
• Apple iTunes v10 or later
• Dev-Team’s PwnageTool 4.1.2 (http://blog.iphone-dev.org/post/1359246784/20102010-event)
• Msft_Guy’s latest firmware bundle (https://sites.google.com/site/msftguy/file)
• ‘tetheredboot’ from Msft_Guy Syringe (https://github.com/msftguy/syringe/downloads)
• iPhone Tunnel (http://code.google.com/p/iphonetunnel-usbmuxconnectbyport/downloads/list) [optional]

Build custom firmware with PwnageTool Procedure

1. Right-click PwnageTool.app and select ‘Show Package Contents’
2. Expand ‘Resources’
3. Copy @Msft_Guy’s ‘iPad1,1_4.2_8C134.bundle ‘ to ‘FirmwareBundles’
4. Copy @Msft_Guy’s ‘atvBundlePatcher.sh’ & ‘Info.plist.patch’ to folder housing PwnageTool.app
5. Run ‘atvBundlePatcher.sh’ (IMPORTANT, otherwise MobileSafari will crash)
6. Run PwnageToold.app
7. Click ‘Expert Mode’, Click AppleTV & iPad icon, click the right arrow to continue
8. Double-click ‘Browse for IPSW…’ box.
9. Select your official ‘iPad1,1_4.2_8C134_Restore.ipsw’ & click Open
10. Click Build and then click the right arrow again
11. Save the custom firmware and then authenticate as necessary
12. The DFU process will automatically begin after the custom firmware is completed

Custom Firmware Installation Procedure

1. Open PwnageTool.app
2. Select AppleTV & iPad icon
3. Click DFU button
4. Follow procedures as directed on the screen.
5. Once you see the You’re In success screen, close PwnageTool and open iTunes.
6. Accept the check notification from iTunes and hold your “Shift-Alt” (Windows)/”Option” (Mac) key while clicking the “Restore” button.
7. Browse to the custom firmware and open it.
8. iTunes will install the custom firmware and reboot the iPad.

Tethered Boot Procedure

• Extract iBSS & Kernelcache from custom restore image (Skip if files are already available).

i.     Rename ‘iPad1,1_4.2_8C134_Custom_Restore.ipsw’ to ‘iPad1,1_4.2_8C134_Custom_Restore.zip’.

ii.     Extract ‘iPad1,1_4.2_8C134_Custom_Restore.zip’.

iii.     Browse into ‘iPad1,1_4.2_8C134_Custom_Restore’ folder.

iv.     Copy ‘kernelcache.release.k48’ to the TetheredBoot folder.

v.     Browse into ‘Firmware’ folder.

vi.     Browse into ‘dfu’ folder.

vii.     Copy ‘iBSS.k48ap.RELEASE.dfu’ to the TetheredBoot folder.

• Manually enter DFU mode

i.      Connect USB cable

ii.     Pressing Sleep & Home for 10 seconds.

iii.    Release Sleep button (continue holding Home button) for 10 seconds.

• Prepare boot

i.     Run ‘tetheredboot iBSS.k48p.RELEASE.dfu kernelcache.release.k48’.

ii.     This will inject LimeRa1n exploit, load iBSS & Kernelcache and start SpringBoard.Assuming the lockscreen appears on the iPad, you should be done and able to run unsigned code. However, if you are stuck at a white screen see the next step.

iii.    The author had issues running the ‘tetheredboot’ command from MacOSX. The exploit and iBSS loaded without issue, however at that point iRecovery stops communicating to the USB device. If this happens, try uploading the kernelcache from iTunnel-Mux instead by running ‘itnl –kernelcache kernelcache.release.k48‘.

iv.    The iPad should now be at the lockscreen while running OpenSSH.

Verify OpenSSH

i.       Connect to Wifi and note the IP address obtained.

ii.      SSH to the IP, ‘ssh root@192.168.1.100’.

iii.     When prompted for a password, enter ‘alpine’.

[You are highly suggested to change the root & mobile passwords immediately with the command 'passwd' & 'passwd mobile']

Basic usage outside Cydia

i.      Once connected with SSH, run ‘apt-get update’ and verify the iPad updates the repositories.

ii.     You should now be able to install any packages available from Cydia by running the command ‘apt-get install %packageID%’

iii.    For examples to install ‘afc2add’ you’d run ‘apt-get install us.scw.afctwoadd’.

iv.     If unsure about package ID’s you can get them from the package details in Cydia on another device.

Old Example Script (for informational purposes this is an extended example of what ‘tetheredboot’ does)

#!/bin/sh

cd /usr/local/mule/bin

enterrecovery

cd /usr/local/irecovery

irecovery/irecovery -v -c “setenv boot-args 2″

irecovery/irecovery -v -c “saveenv”

echo “Enter DFU Manually Now…”

sleep 30

cd /usr/local/syringe

injectpois0n

cd /usr/local/irecovery

irecovery -v -f iBSS.k48ap.RELEASE.dfu

irecovery -v -c “setenv boot-args 0″

irecovery -v -c “saveenv”

irecovery -v -c “go image decrypt 0×41000000″

irecovery -v -c “go jump 0×41000040″

sleep 15

cd /usr/local/itnl

/usr/local/itnl/itnl –kernelcache kernelcache.release.k48