Updated your iPhone 3GS to iOS 5.1.1 with baseband 5.16.05 and need to unlock it? There’s still hope if you don’t mind using the dreaded iPad baseband 6.15.00.

There’s no unlock for modem firmware or baseband version 5.16.05. To be precise, there’s no ultrasn0w unlock since baseband 5.14.02 was first released. So if you really need to unlock your iPhone 3GS, it’s still possible to do so by flashing it with iPad’s baseband 6.15.00. However, it’s extremely important that you read and understand the following:

• This is an iPad baseband which will break your GPS.
• More risks here.
• If you have the new iPhone 3GS 8GB made after week 28 of 2011, you must read this or you will permanently break your iPhone.
• If you don’t fancy 6.15.00 consider downgrading your chip.
• This guide is for Windows only because sn0wbreeze is not supported on Mac. Mac users can download the ready made custom firmware below (step 9).

This tutorial will guide you on how to build a custom iOS 5.1.1 firmware with iPad baseband 6.15.00 embedded. This eliminates the step of manually flashing your iPhone using redsn0w.

Did you read and understand all the risks? Final warning: Proceed at your own risks!

IMPORTANT: Make sure that your iPhone 3GS is fully charged before you begin.

Steps:

1. Backup your contacts, photos, apps etc. Remove your SIM card. (FYI: If you made a backup on the latest iOS, you won’t be able to restore it if you’re running on an earlier iOS version.)

2. Download iOS 5.1.1 firmware for iPhone 3GS directly from Apple.

3. Download Snowbreeze 2.9.5 from ih8sn0w.com.

4. Launch sn0wbreeze and click on the blue arrow at the bottom right corner.

5. Browse for the firmware you just downloaded in step (2). Click next.

6. Select your Bootrom type. If you’re not sure, sn0wbreeze can detect it for you. IPSW is verified and click the blue arrow to continue.

7. Select Expert Mode. Click General and hit next. It’s very likely that you don’t have the official SIM card so check ‘Activate The iPhone [Hacktivate]‘. Hit next.

8. If you really sure of installing iPad baseband, check ‘Install 06.15.00 iPad  Baseband.’ (ARE YOU REALLY SURE?!)

9. Click Build IPSW and hit next. Wait until the custom firmware is ready. Once done, you should find it on your desktop with the file name:

sn0wbreeze_iPhone_3GS-5.1.1-9B206.ipsw [you can also download it here (filefactory premium membership required)]

10. Before restoring, ‘pawn’ DFU your iPhone to allow it to accept custom firmware. Otherwise, you will get error 16xx. Sn0wbreeze will guide you on how to pawn DFU (black screen) your iPhone using iREB. iREB will show up as soon as you’ve done building the custom fimrware.

11. Launch iTunes, press shift on your keyboard and then click Restore. Point it to the custom firmware on your desktop. Wait until the restore is complete. Your iPhone will boot up and you’re ready to unlock it once you’ve gone through the setup process. Just to be sure, go to Settings, General, About and check that your Modem Firmware (baseband) is 06.15.00.

At posting time, the latest ultrasn0w is not yet supported on iOS 5.1.1. Thus, you must intall an ultrasn0w fixer patch first.

12. If you’ve installed ultrasn0w, remove it now.

13. Launch Cydia.

14. Add the following to your source:

http://repo.iparelhos.com

15. Tap on the iParelhos repo to see Ultrasn0w Fixer for iOS 5.1.1 utility. Tap install to begin installation.

16. Once installation is complete, we need to install ultrasn0w. Launch Cydia.

17. Search for ultrasn0w on Packages in Cydia. If you cannot find it, add new sources by typing ultrasn0w repo:

repo666.ultrasn0w.com (with zero, not o).

18. Install Ultrasnow 1.2.5.

19. Reboot your iPhone.

20. Turn off 3G and insert your SIM card. It should pick up your carrier signal.

Common Issues:

• If you get an iTunes error 3194, read here on how to fix it.
• In any case if you get error 1015 and recovery loop on the iPhone, this can be resolved using the “Exit Recovery” button using TinyUmbrella.
• Phone isn’t activated? You missed step (7).

Any issue? Leave your comments below.

If you use ultrasn0w or Gevey SIM to unlock your iPhone, here’s the ultimate guide to safely update to iOS 5.1.1 while preserving your baseband.

You’ve probably read the following countless times, but if you’re new to using locked iPhone, it may be worthwhile to read and understand the points below:

• Custom firmware allows you to restore your iPhone without updating the baseband.
• By preserving the baseband, you can continue unlocking your iPhone; either with ultrasn0w or Gevey SIM depending on your iPhone or baseband version.
• There’s no known software method to downgrade your baseband, once it’s updated, there’s no turning back. However, we do offer chips replacement for iPhone 4 or 3G/3GS.
• With sn0wbreeze 2.9.5 (Windows only), it can untethered jailbreak iOS 5.1.1 and below.
• If you’ve downgraded your baseband chip with us, this guide will be useful for you. Under no circumstances you should restore using stock firmware.

What you need:

• iPhone 4 with baseband 01.59.00 (unlock with ultrasn0w) or 02.10.4, 03.10.01 and 04.10.01 (unlock with Gevey SIM). Baseband 04.11.08 or 04.12.01 cannot be unlocked or downgraded.
• iPhone 3GS with baseband 05.11.07, 05.12.01, 05.13.04 or iPad baseband 06.15.00
• Sn0wbreeze 2.9.5
• Ultrasn0w Fixer for iOS 5.1.1
• Ultrasn0w 1.2.5

Note: Currently, there’s still no way to preserve iPhone 4S’ baseband. You can still unlock baseband 2.0.12 and below using Gevey Ultra S.

Before you begin, always remember to backup your iPhone.

Part One: Building and Installing Custom iOS 5.1.1 Firmware (Baseband Preserved)

The first part involves the building and installing custom iOS 5.1.1 firmware. ‘Hacktivation’ is needed if you don’t have the official SIM card. The second part of this tutorial explains the steps to unlock your iPhone: Part 2(a) is using ultrasn0w for supported baseband only  or Part 2(b) is for Gevey SIM for iPhone 4.

1. Download original iOS 5.1.1 firmware (IPSW) for iPhone 4 or iPhone 3GS directly from Apple. It’s highly recommended that you save it locally for future use.

2. Download Sn0wbreeze 2.9.5 from ih8sn0w.com.

3. Start sn0wbreeze.

4. Click browse and locate the original iOS 5.1.1 that you just downloaded.

5. Sn0wbreeze will identify the IPSW file. Click Next.

6. Choose one of the modes below:

• iFaith Mode: Builds custom iOS and stitches it with your saved SHSH.
• Expert Mode: Preserves your baseband, will jailbreak and hacktivate (activate).
• Simple Mode (recommended): Preserves your baseband, will jailbreak and hacktivate.
• Baseband Preservation Mode: Preserves your baseband, but will not hacktivate or jailbreak. You will need your official SIM card to activate it after restore.

7. Now it will ask you whether you want to hacktivate or not. Select “Yes”. Now wait until sn0wbreeze completes the custom iOS 5.1.1 for you.

Once the custom iOS 5.1.1 is ready you will find it on your desktop. Before restoring your iPhone, you MUST put your iPhone into pwned DFU mode. This allows it to accept custom firmware. Otherwise, you’ll get an error message during restore. iREB will appear as soon as custom firmware is built. You can also access it on the menu bar of sn0wbreeze.

To begin restoring, be sure your iPhone is already in pwned DFU mode (black screen) then launch iTunes, press shift on your keyboard and click restore. Select the custom firmware that was just created. To be sure, the file name always begin with sn0wbreeze_iPhone_xxxxxxx.

If you get error 3194, use this guide to fix it. For other iTunes errors, refer to this.

Part Two (a): Unlock with ultrasn0w 1.2.5 from Cydia [for supported baseband only]

There’s no official ultrasn0w for iOS 5.1.1 yet, so we’ll need to install ultrasn0w fixer iOS 5.1.1 first.

1. Launch Cydia and add the following repo by going to Manage > Sources > Edit > Add:

http://repo.iparelhos.com/

2. Search for ultrasn0w fixer for iOS 5.1.1 and install it.

3. Finally, search for ultrasn0w (1.2.5) and install that too.

4. Reboot your device.

Part Two (b): Unlock with Gevey SIM [for iPhone 4 baseband 02.10.01, 03.10.01 or 04.10.01 only]

1. Eject your SIM tray and reboot your iPhone.

2. Once restarted, unlock your screen. Turn off 3G and cell data (you can turn these on later). Insert your SIM tray along with your SIM card and Gevey SIM.

3. Wait for Accept Screen. Tap Accept.

4. You will see No Service (in iOS 4.x, you will see one signal bar). Wait for 15-20 seconds and dial 112. Hang up after 1-2 seconds.

5. Turn on Airplane Mode and wait for ‘NO SIM CARD INSTALLED’ message. Turn off Airplane Mode and you will see ‘SIM FAILURE’ and tap OK. Your iPhone will connect to your network now.

That’s it! Your iPhone is now unlocked on iOS 5.1.1 along with untethered jailbreak.

If you find this post useful, please do us a small favor by clicking ‘LIKE’ or ‘Recommend on Google+’ below.

Already jailbroken your iPhone 4 or 3GS running iOS 5.1.1? Apply Rocky Racoon patch via Cydia for untethered jailbreak on iOS 5.1.1.

Note: this patch will only work for already jailbroken iOS 5.1.1 (tethered).

1. Connect your iPhone 4, iPhone 3GS, iPod touch 3G, iPod touch 4G or iPad 1 to your computer and do a backup.

2. Launch Cydia and wait for it to refresh completely.

3. Tap on Search button and type ‘Rocky Racoon 5.1.1 untether‘. Install the package.

4. Click Install and then Confirm, it will patch your current jailbreak for untethered jailbreak!

Your iDevice will reboot after the process is complete.

Other A5 based devices just download the latest Absinthe 2.0 from Greenpois0n.com and follow the steps here.

If you find this post useful, please do us a small favor by clicking ‘LIKE’ or ‘Recommend on Google+’ below.

Hackers gathered at the annual HITBSecConf2012 held at Amsterdam, The Netherlands this week. Famous iPhone baseband hacker MuscleNerd was there to present a topic on iPhone baseband unlock.

This conference has become the ‘must attend’ event in the calendars of security professionals from around the world. Having started as a small gathering of Malaysian security specialists in 2002, the event has since expanded out of its home base in Kuala Lumpur to Dubai and in 2010, The Netherlands.

Inspiring hackers should definitely read his presentation on ‘Evolution of The iPhone Baseband And Unlocks.’ It details the history of iPhone’s baseband and how hackers manage to find exploits and developed various types of unlocks for iPhones.

MuscleNerd admits that initially he was interested in hacking baseband but now focusing more of his time maintaining and extending redsn0w. Probably that’s because Apple had patched all potential exploits on newer iPhones which left him no choice but concentrating more on jailbreaking.

The presentation is rather technical and it would require some background knowledge on hardware and embedded software programming to fully appreciate the contents of his presentation.

Some of the interesting highlights are:

• General overview of iPhone baseband – how it works, exploits and and how Apple patched them
• How Dev Team monitored each baseband update – making exploits less possible each time
• Technical details of baseband codes
• Details of iPhone 2G software unlock – the earliest version of iPhone software unlock
• Details of iPhone 3G/3GS software unlock (ultrasn0w)
• Details of iPhone 4 unlock – ultrasn0w for baseband 1.59.00, how Apple added Data Execution Prevention (DEP) called “crossbar” which was eventually bypassed by MuscleNerd and hacker @planetbeing
• SIM interposer unlock e.g. Gevey SIM
• Activation ticket unlock method such as SAM unlock by loktar_sun
• 3G/3GS baseband downgrades, iPhone 4 baseband downgrade, BBTickets
• Details of iPhone 4S baseband architecture
• Baseband 6.15.00 unlock for 3G/3GS, why newer chip can’t take baseband 6.15.00 and will brick it

Go ahead and view his presentation here. It will give you ideas and probably some truths why software unlock might be a thing of a past.

If you find this post useful, please do us a small favor by clicking ‘LIKE’ or ‘Recommend on Google+’ below.

Guys – here’s the moment we’ve been waiting for! The free untethered jailbreak tool for iOS 5.1.1 by pod2g et al of Chronic Dev Team. Continue below on how to untether jailbreak your iDevice running iOS 5.1.1.

Before we begin, please be aware that this tutorial is based on the video produced by one the beta testers of Absinthe 2.0. The steps are subject to change. Anyhow, to those who are interested to know, read on!

1. Download the latest Absinthe v2.0 from http://greenpois0n.com/ (available now for Windows, Mac and Linux).

Note: Once you’ve downloaded the file, unzip it and extract the .exe file and copy it to your desktop. Double click on it and it will create a folder and extract all the required files into it. The actual absinthe 2.0 program is inside this folder.

2. Connect your iPhone to your computer and perform a full backup with iTunes. Disable the passcode lock.

3. Launch Abinsthe 2.0. The program will detect your iPhone model and its current build (firmware).

4. Click Jailbreak to begin. A status saying ‘Beginning jailbreak, this may take a while….‘ and a progress bar will be shown. This is followed by a status saying ‘Sending initial jailbreak data. This may also take a while…‘.

5. The third message will say ‘Sending final jailbreak data. Your device will appear to be restoring a backup. This may also take a while…’ Your iDevice will display ‘Restore in progress.’

6. Finally, you will see ‘Waiting for reboot. Not done yet, don’t unplug your device yet!‘ while a spinning wheel appears on your device.

7 . Last but not least, ‘Waiting for process to complete‘ will appear and an Apple logo with loading bar is shown on your device.

8. When all is said and done, you will see Cydia icon on your Home screen. Simply launch Cydia to install your favorite jailbreak apps!

That’s it folks! Please do note that the whole process may take up to 10 minutes so sit back and relax while the program does everything for you.

Enjoy!

If you find this post useful, please do us a small favor by clicking ‘LIKE’ or ‘Recommend on Google+’ below.

Some users have reported that the recent iOS 5.1.1 update is significantly affecting their iPhones’ battery life. Here’s a quick fix that you can try.

This issue seems to be affecting more to users who updated their iPhones using the OTA (on-the-air) update. This update can be done without connecting to iTunes and it will download all the necessary updates, patches and fixes without downloading the whole IPSW.

Before you begin, it’s highly recommended that you backup your iPhone.

WARNING: If you rely on any jailbreak or unlock, it’s best to avoid this fix. You may need your official activation SIM card once the steps below are performed.

1. Go to Settings > General > Reset > Reset All Settings.

2. Enter your Passcode (if you have it set), then tap Reset to confirm.

3. Your iPhone will Reboot. Once your iPhone is activated, set it up as new and then personalize it as per your requirements.

4. Finally, charge the battery until it reaches 100 %.

Hopefully that would fix your battery woes. Let us know if this helps!

The latest version of redsn0w now supports building custom iOS 5.1.1 firmware to preserve your baseband. Here’s how to build your own custom iOS 5.1.1 firmware.

Let’s get straight to business:

1. Download the latest version of redsn0w from Dev Team’s blog.

2. Download original iOS 5.1.1 IPSW for iPhone 4 (GSM) or iPhone 3GS directly from Apple.

3. Launch redsn0w and go to Extras > Custom IPSW.

4. Point to the IPSW you just downloaded in Step 2. If you have a 3GS, you will be prompted whether you have a 3GS with old or new bootrom. Select appropriately.

5. Redsn0w will start building custom iOS 5.1.1 while disposing the files that will update your baseband. Once completed, you will find this file on the same file path as the original IPSW with the prefix “NO_BB…” followed by the file name.

6. Be sure to pawn DFU your iPhone with redsn0w by going to Extras > Pwned DFU. Simply follow the on-screen instructions.

7. Once your iPhone is in DFU, launch iTunes and press Shift+Restore (Windows) or Option+Restore (Mac). Be careful not to select the wrong IPSW during restore! If you get error 3194, you need to edit your hosts file. See here.

8. Wait for it to finish. Your iPhone will attempt to reboot and may stuck on the Apple logo with empty progress bar due to tethered jailbreak.

9. Launch redsn0w again > Extras > Just Boot. Follow on screen instructions.

10 .Your iPhone will boot up normally and follow the instructions here to unlock with ultrasn0w.

That’s it! If you encounter any issue, leave your comments below.

If you find this post useful, please do us a small favor by clicking ‘LIKE’ or ‘Recommend on Google+’ below.

This is probably the best redsn0w version yet as it allows you to downgrade iOS on iPhone 4S or iPad 2/3 without using iTunes.

By downgrading your iOS to an earlier version such as iOS 5.0.1, you can enjoy an untethered jailbreak on your iPhone or iPad once more!

Release notes by MuscleNerd and some warnings:

• The new feature is at Extras->Even More->Restore

• You cannot downgrade without the personalized SHSH blobs for your device at that lower firmware.  You need to have fetched those blobs while the signing window was open, using either Cydia’s built-in TSS@Home feature, or with TinyUmbrella.  The new Restore screen of redsn0w lets you choose either the remote blobs or local ones (for the earlier firmware).  If you don’t know where TinyUmbrella put your blobs, TinyUmbrella has a button that will show you (copy them out of that folder and feed them to redsn0w).

• The A5 downgrade method actually updates to the latest firmware before downgrading to the earlier one.This process updates your baseband to whatever is newest.  DO NOT USE THIS METHOD IF YOU RELY ON UNOFFICIAL UNLOCKS of your iPhone4S.  Those who used the temporary SAM technique to unlock their iPhones to specific SIMs shouldn’t be affected by this baseband update.

This latest version of redsn0w is available for Mac and Windows.

iOS Downgrading Steps for iPhone 4S, iPad 2 or the new iPad (future):

Steps:

1. Start the new redsn0w 0.9.11b1 (Windows or Mac)

2. Connect your device and close iTunes if it launched itself automatically.

3. Go to Extras.

4. Click on Even More.

5. Click on Restore.

6. You will see IPSW, Local and Remote. Click on IPSW, and point redsn0w to the firmware file to which you want to downgrade to e.g. iOS 5.0.1. Redsn0w will now ask you for the stock iOS 5.1.1 firmware.

7. If you have your SHSH blobs saved:

• Locally on your computer – click Local and find the .plist file that has the SHSH blobs for your device. Click Next.

• Remotely on Cydia – redsn0w should automatically put your device into Recovery mode to fetch the files from Cydia server.

8. redsn0w will automatically stitch the SHSH blobs to the IPSW firmware file which you selected, and then it will automatically restore your device without having to launch iTunes.

Do note that this first release may contain some bugs so only use it if you’re desperate.

Share your experience and thoughts about this new tool by leaving your comments below!

Do you plan to update to iOS 5.1.1 but need to unlock your iPhone 4 or 3GS? Here’s the ultrasn0w fixer for iOS 5.1.1. Read below on how to install it.

Important Notes:

1. Your iPhone 4 or iPhone 3GS running on iOS 5.1.1 must already be jailbroken with its baseband preserved. You can jailbreak it with the latest redsn0w (download it from the Dev Team’s blog) or build a custom firmware using the same tool.

2. Supported basebands are listed below. Everything else is NOT supported.

• 01.59.00 (iPhone 4)
• 04.26.08 (iPhone 3GS)
• 05.11.07 (iPhone 3GS)
• 05.12.01 (iPhone 3GS)
• 05.13.04 (iPhone 3GS)
• 06.15.00 (iPhone 3GS)

Installation Steps:

1. Download i-FunBox for Windows or DiskAid for Mac.

2. Launch i-FunBox or DiskAid and go to /private/var/root/Media.

3. Inside Media folder create a folder called Cydia.

4. Now inside Cydia folder create an AutoInstall folder. Note: The folder name is case-sensitive so be sure to name it accurately. It should look like the following:

/private/var/root/Media/Cydia/AutoInstall

5. Now copy ultrasnow.deb [ultrasn0w_1.2.5.deb] file, MobileSubstrate [mobilesubstrate_0.9.3997_iphoneos-arm.deb] file and ultrasn0w fixer patch into the AutoInstall folder.

6. Reboot iPhone (remember it’s currently boot tethered! So start redsn0w > Extras > Just Boot).

What a surprise from Apple (as always) on a Monday! They’ve just released iOS 5.1.1 firmware for iPhone, iPad and iPod touch.

Here are the change logs – iOS 5.1.1 improvements and bug fixes:

• Improves the reliability of using HDR option for photos taken using the Lock Screen shortcut.
• Addresses bugs that could prevent the new iPad from switching between 2G and 3G networks.
• Fixes bugs that affected AirPlay video playback in some circumstances.
• Improved reliability for syncing Safari bookmarks and Reading List.
• Fixes an issue where ‘Unable to purchase’ alert could be displayed even after a successful purchase.
• Patches important URL spoofing vulnerability in Safari
• Baseband version for iPhone 4S (2.0.12), iPhone 4 (4.12.01), iPhone 3GS (5.16.05)

You should never install any new update if you rely on an unlock or untethered jailbreak, well not until proper tools or methods are available to unlock or jailbreak your iPhone.

MuscleNerd specifically warned A5 and A5x devices owners about updating to iOS 5.1.1, although hacker ion1c has already tweeted that the new iPad (3) has been successfully jailbroken.

Remember to save your SHSH as always!

Let’s hope the untethered jailbreak for iOS 5.1 and iOS 5.1.1 will be released soon!