Why do I need SHSH blobs? Can I use them on iOS 5 and A5 devices?

What do the words "SHSH blobs" mean? SHSH blobs are digital signature files unique to your device.

Why are SHSH blobs important? Apple only allows you to restore to the iOS versions (firmwares) they "sign" (by providing SHSH blobs), in order to prevent you from restoring to earlier versions that may be easier to jailbreak. Apple's "signing" of each iOS version only lasts for a limited time, usually just for as long as that iOS version is the latest version available. Once Apple stops signing the SHSH for an iOS version, there is no way to restore that version again, unless you have SHSH blobs saved for that version. (If your device is currently on a version that Apple is no longer signing, restoring with iTunes will upgrade your device to the latest signed version.)

How do I save SHSH blobs? Cydia automatically tries to save any available SHSH from Apple each time you open Cydia. You can also manually save SHSH for a device (even a non-jailbroken device) using redsn0w or TinyUmbrella. The SHSH blobs that you can grab depends only on which versions Apple's servers are signing at the moment; it doesn't have anything to do with the version of iOS currently on your device. However, redsn0w and iFaith can dump "partial blobs" for the currently-installed iOS version off some devices (iPad 1, new-bootrom iPhone 3GS, iPhone 4, and iPod touch 3rd and 4th generation), which you can use to "stitch" a pre-signed IPSW, which is useful if your device is on an iOS version that Apple is no longer signing, but you want to be able to restore to that version later. A guide to using iFaith.

What do I need to know about using SHSH blobs on iOS 5? Since iOS 5, Apple has included an extra element in SHSH (called APTicket/APNonce) to try to defeat using saved SHSH to restore. However, jailbreakers have found a way to work around APTicket/APNonce. Cydia saves SHSH and APTicket starting with iOS 5.0.1 (not for iOS 5.0) and TinyUmbrella does too. You can use these blobs to restore to a 5.x version by using redsn0w to make a "stitched IPSW" which integrates the SHSH and APTicket into the custom firmware, and then putting your device in "pwned" DFU mode and restoring with the stitched IPSW (see here for a guide to restoring to iOS 5.0.1 using this process).

What do I need to know about using SHSH blobs on A5 devices (iPad 2 and iPhone 4S)? You can only use the normal SHSH blob process to downgrade/upgrade a Wi-Fi-only iPad 2 to 4.x. If you want to downgrade a GSM or CDMA iPad 2 to 4.3.3, you can try using TinyCFW. You can now use SHSH to downgrade or upgrade an iPad 2 or iPhone 4S between versions of iOS 5.x using the latest version of redsn0w (see here for a guide to restoring to iOS 5.0.1 using this process).

How do I restore using SHSH blobs? Check out JailbreakQA's guide to restoring to iOS 5.x using SHSH blobs or our guide to restoring to iOS 4.x using SHSH blobs.

What if I have more questions?

You can learn more about how SHSH works by opening up Cydia, tapping "Upgrading and Jailbreaking Help", and tapping "Can I upgrade/downgrade to the iOS version I want?"

For background on the SHSH system and some technical details, read saurik's explanation of the SHSH system.

To find out which versions are currently being signed, see the iPhone Wiki's explanation and chart of currently-signed versions.

To learn more about TinyUmbrella, visit its FAQ page.

Can I upgrade/downgrade from any version to any other version?

If you've never jailbroken your device before (or used TinyUmbrella): no, sorry, Apple has a system that tries to prevent each device from being restored to any firmware version except the latest version (it requires the firmware on the device to be "signed" with SHSH blobs; here's more about why you need SHSH blobs). (You may still be able to jailbreak your device on the latest version using the right tool. Also, if you use TinyUmbrella, make sure you have "set hosts to Cydia on exit" unchecked before trying to jailbreak with redsn0w -- or if you've previously manually edited your hosts file, place a # symbol in front of any entries for gs.apple.com to help ensure a successful restore process.)

If you have jailbroken your device before: you may be able to work around this system and restore to a specific version other than the latest version, especially if you've used Cydia within the past few months, because opening Cydia automatically saves currently-available firmware signature files (also called "SHSH blobs") from Apple. Exceptions: you have to use redsn0w blob stitching for iOS 5.0 and above, you can only downgrade a GSM or CDMA iPad 2 to iOS 4.x by trying TinyCFW, and downgrading an iPhone 4 from 5.x to 4.x may end up with poor signal reception on 4.x (since upgrading to iOS 5 with the normal iTunes process permanently upgrades the iPhone baseband).

To try downgrading/upgrading (a process that may bring up various mysterious errors, so be prepared to do further research):

1. Download and open TinyUmbrella (ignoring any start-up messages), plug your device into your computer (let iTunes make a full sync and backup just in case), click "Save SHSH" in TinyUmbrella, and see if you have SHSH blobs for the firmware version that you want — the listed blobs allow you to restore to their corresponding version numbers. (You can try going to the "Advanced" tab and checking or unchecking "Request SHSH from Cydia" to try to find more blobs.)

   Be sure to uncheck "Set hosts to Cydia on exit" and "Request SHSH from Cydia" before attempting the restore. If you are downgrading/upgrading an iPhone 4 and are not concerned with preserving your baseband (for example, do not check this if you rely on ultrasn0w unlock), check "Update iPhone 4 baseband". Now ensure that iTunes is shut down, and your device is plugged into your computer.

2. Click "Start TSS Server". Now you can minimize TinyUmbrella, turn your device off, and then put it into DFU mode: hold the power (lock) button and home button for 10 seconds, then release the power button but keep holding the home button for another 15 seconds.

3. Open iTunes. Your device should be recognized immediately as being in recovery - if not, and if iTunes prompts you to check with the iPhone server, click "Check", and then your device should be recognized as being in recovery.

4. Then hold down the Shift key (Windows) or Option key (Mac), and click "Restore".

5. iTunes will ask you for the firmware file (also called "IPSW file") for the version that you want. You may be able to find this firmware file, named something like iPhone3,1_4.3.3_8J2_Restore.ipsw"DeviceNameX,X_FirmwareVersion_XXX_Restore.ipsw") on your computer (see here for where to look), or you can just download a copy of the correct file using the links on The iPhone Wiki. Note: if you're preserving your device's baseband (to preserve the ability to do an unofficial carrier unlock), or if your device has the iPad baseband installed, you'll need to use custom firmware instead.

6. After the restore process finishes, you may get an error with the code "1015". This is expected - just go back to TinyUmbrella and click "Exit Recovery Mode". (If that does not work, you can put your device into DFU mode and try the "Fix Recovery" button in TinyUmbrella, and if you are still stuck in recovery, download the stand-alone "fixrecovery" tool from the TinyUmbrella website. You will get two files: one is 421 (for 4.2.1 firmware), and one is fixrecovery43 which you should use if you are downgrading/upgrading to 4.3.3. You may get an error mentioning that you need "zlib1.dll" - download it here and place it in the fixrecovery folder.)

7. Your device should now reboot and be normal. You can now jailbreak your device again! Or you may have run into various other errors during this process - try searching JailbreakQA, because somebody else has probably run into the same problem before you.

Troubleshooting tips: One common error message is 3194, which means that the restore failed because your device does not seem to have SHSH blobs available for the version you're trying to restore - are you sure you followed all these steps correctly? See this guide for fixing error 3194. Or if upgrading to 5.0, are you sure you're using the latest version of iTunes? Finding your device stuck with errors 1013, 1015, or 1600 (after trying "Exit Recovery Mode" and "Fix Recovery") may mean that you have one of a variety of problems: (a) you didn't put your device in DFU mode before pressing "Restore", (b) your device has a non-standard baseband for its firmware so you need to restore using a custom firmware (make one using PwnageTool or sn0wbreeze), (c) your device needs to be in "pwned" DFU mode (you can do this with redsn0w or iReb), (d) you need to manually remove any entries from your hosts file related to gs.apple.com, or (e) something different (you can ask for help; let us know which steps you've tried already).

Can I unlock my iPhone to use it on a different carrier?

Option A: Official unlock

Try calling your carrier and asking them if your iPhone is eligible for a free or paid official unlock. (In the US, AT&T now provides official unlocks for out-of-contract iPhones, and Sprint and Verizon may be willing to unlock your device as well.)

If you can get an official unlock, we recommend getting it even if you have to pay for it, since it'll be much more convenient than unofficial unlocking.

Option B: ultrasn0w unofficial unlock

Look at your baseband version first: Find out your iPhone's baseband version by opening up your Settings app, tapping General, tapping About, and scrolling down to "Modem Firmware". That number is your baseband version. (The "baseband" is the low-level part of the iPhone that handles everything related to antennas, such as calls and 3G.)

Your device's current version of iOS doesn't matter when you're trying to unofficially unlock it with ultrasn0w (with the exception that ultrasn0w is not yet officially compatible with iOS 5.1). The baseband version is the important part.

If you're lucky enough to have an ultrasn0w-compatible baseband, you might just need to install ultrasn0w (search for it in Cydia). After installing ultrasn0w, you may want to install SAM to fake proper activation for your device.

Basebands currently unlockable with ultrasn0w

iPhone 4

• 01.59.00 (which your device only has if you haven't upgraded iOS since 4.0.2 or have preserved the baseband since then)

iPhone 3G/3GS

• 04.26.08
• 05.11.07
• 05.12.01
• 05.13.04
• Special case: on any iPhone 3G, and on most iPhone 3GS except for newer ones (ones that are later than approximately 2011 week 28; you have a week 28 or later device if your serial number starts with xx128; you can use this web tool to check), you may be able to use redsn0w to flash your device to the iPad baseband (6.15.00), which permanently unlocks the device but will result in loss of GPS and warranty, and requires you to use custom firmware when restoring or upgrading your device (see here for more detailed warnings). If you put the iPad baseband on your device, this is permanent. You should read the Dev Team's blog post about this for additional useful warnings and explanations, although the version of PwnageTool they mention won't work for jailbreaking the latest iOS versions such as 5.0.1, so instead use the latest version of redsn0w (click "Jailbreak", select "Install iPad baseband", and after you're done install ultrasn0w from Cydia).

Basebands currently NOT unlockable with ultrasn0w

iPhone 4

• 02.10.04
• 03.10.01
• 04.10.01
• 04.11.08
• 04.12.01
• Note: iPhone 4 basebands earlier than 04.11.08 may be unlockable via Gevey, which is a SIM unlocking device, but JailbreakQA does not support SIM unlocks such as Gevey.
• Any CDMA iPhone

iPhone 3G/3GS

• 05.14.02
• 05.15.04
• 05.16.xx
• If your device has one of these basebands, see "Special case" above.

iPhone 4S

• Not supported by ultrasn0w. May be unlockable via Gevey, which is a SIM unlocking device, but JailbreakQA does not support SIM unlocks such as Gevey.

Can I downgrade my iPhone's baseband? You generally cannot downgrade a device's baseband. The main exception is if Apple is still signing the earlier baseband, which happens at the same time as when Apple is signing the earlier version of iOS. For example, when Apple was signing both iOS 4.3.5 and iOS 5.0 at the same time (which was true during a few hours right after they released 5.0), you could upgrade to iOS 5.0 and have the 04.11.08 baseband - and then downgrade to 4.3.5 and have the 04.10.01 baseband. Apple only signs the very latest version of iOS for each device except during brief iOS version transition periods like that, so you generally can't downgrade the baseband. There's no equivalent of saved SHSH for basebands.

What's a tethered jailbreak?

A tethered jailbreak is a jailbreak where the device requires a computer to assist booting up. If the device's battery dies, or you turn off the device, or you reboot it, you will either be (A) stuck at the Apple logo or (B) boot up into a seemingly "un-jailbroken" state where Cydia and Safari don't work - until you plug the device into a computer, open your tethered boot program (for example redsn0w), and follow its instructions. The situation in (B) is often called a semi-tethered jailbreak.

(Note: due to this requirement of booting your device with a computer, tethered jailbreaks are somewhat inconvenient. In general, people rarely need to reboot their devices unless they run out of battery, but a few popular Cydia packages also require a reboot after installing, including Winterboard and iFile. Most packages just require "restarting SpringBoard", which is not a reboot. So a lot of people don't mind having a tethered jailbreak, but you have to decide if this kind of jailbreak is OK with you.)

To boot tethered: if you're using redsn0w (supports up to iOS 5.1 on iPhone 4/3GS, iPad 1, and iPod Touch 3rd/4th gen, but tethered on iOS versions 5.1.1, 5.1, 5.0, 4.3.5, 4.3.4, 4.2.10, and 4.2.9): plug in your device, open up redsn0w, click "Extras", and then click "Just boot".

If you're having problems getting your device to be recognized by redsn0w, start this process in DFU mode. To enter DFU mode: with your device connected to your computer, hold the power (lock) button and home button for 10 seconds, then release the power button but keep holding the home button for another 15 seconds.

If redsn0w still isn't booting your device properly, follow this guide to using redsn0w - including setting compatibility modes, running it as administrator, and specifying the IPSW. These steps solve many redsn0w problems.

What is a semi-tethered jailbreak?

Depending on the packages installed on a device with a tethered jailbreak, you may actually have a "semi-tethered jailbreak", which means that when you reboot your device without plugging it in, your device boots up seemingly "un-jailbroken" and Cydia and Safari crash when you tap them. To fix that situation, boot tethered.

In more detail: tethered jailbreaks behave semi-tethered by default. If you install Mobile Substrate tweaks, your device will still be semi-tethered. But if you install Notification Center plugins that don't depend on WeeLoader, your device will no longer be semi-tethered - unless you also install the BigBoss semitether package.

I'm getting iTunes error 1013 or 3194 ("device not eligible for requested build") - what can I do?

For error 1013: this happens because iTunes is not getting authorization to update the baseband because your hosts file is changed to preserve baseband by pointing towards Cydia's server instead of Apple's. Note that at this stage the firmware has actually been flashed but not the baseband. If you are at 4.2.1 you can exit this using TinyUmbrella (version 4.21.xx) "Fix Recovery" button or run greenpois0n to jailbreak right there. If you have restored to 4.3.x, use fixrecovery43 Win / Mac. For the Windows version, you'll need to download and place this file in the same location as the fixrecovery program. If you want the baseband upgrade to continue without the 1013 error, remove the gs.apple.com line from your hosts file.

For error 3194 ("device not eligible for requested build"): this means that the restore failed because your device does not seem to have SHSH blobs available for the version you're trying to restore to. If you're trying to restore to a version you don't have SHSH for, you can't do that. (Here's more about how SHSH blobs work and why you need them.) If you're trying to restore to the latest version (a version that Apple is still signing), and this is happening, you probably have TinyUmbrella installed and it's set to edit your hosts file, so the restore is trying to use saurik's servers to verify the firmware instead of Apple's servers. To fix this, look under the Advanced tab in TinyUmbrella, uncheck "Set hosts to Cydia", and quit TinyUmbrella. If you've done that and visiting http://gs.apple.com shows the Cydia homepage instead of an Apple 404 page, you need to fix your hosts file by editing it directly.

To help solve both errors, remove gs.apple.com lines from your hosts file:

Mac OS X:

1. On your Mac, go to your “Applications” folder.
2. Now navigate to the “Utilities” folder.
3. Launch "Terminal".
4. Type "sudo nano /etc/hosts" (without quotes) and hit return.
5. Enter your password
6. Use the down arrow key to find the “gs.apple.com” entries. Once the cursor is in front, make sure you comment out the line(s) by entering “#” in front of the text.
7. Save the file by pressing CONTROL+O.
8. Exit the nano editor by pressing CONTROL+X.
9. If iTunes is open, close and re-open it so that it uses the changed hosts file.
10. Restore your device.
    

Windows:

1. Close iTunes
2. Start –> Programs –> Accessories
3. Run Notepad or WordPad (as administrator on windows 7)
4. Click “Open..” from File menu.
5. Browse to Windows/System32/drivers/etc
6. In "files of type:" select all documents
7. Open "hosts"
8. Either delete all line that has "gs.apple.com", or add a "#" sign at the beginning of the line to comment it out
9. Hit Save
10. Reboot computer for changes to take effect.
11. Visit http://gs.apple.com/ to verify that the hosts file is pointing to Apple and not Cydia.
12. Restore your device.

Why won't my device boot? Why is it stuck at the Apple logo?

Is it out of battery? Plug your device into your computer for a while and see if this helps. Make sure you've plugged it into a functioning USB port.

If your device is an iPhone 3GS, iPhone 4, iPod touch 3rd/4th generation, or iPad 1: Do you have a tethered jailbreak, such as the current jailbreak available for iOS 5.1 and 5.1.1? Plug your device into your computer and try using redsn0w to boot tethered - see these instructions for more details. This can also help on iOS 5.0.1 if Corona failed to work for some reason, which may happen on some small percent of reboots.

Try forcing a reboot: If that isn't applicable, try holding down the power and home buttons until you see the Apple logo, and let it finish booting up.

Maybe you installed a very incompatible tweak? Try Mobile Substrate's safety feature: If that doesn't help, it could be that a tweak you installed before rebooting (even days before rebooting) is very incompatible with your version of iOS, which could cause a "boot loop" (getting the Apple logo over and over).

Try forcing a reboot and then immediately holding down the Volume Up button as the device boots up. This will temporarily disable all extensions, as explained in the Mobile Substrate description:

As of version 0.9.3997, you can now disable Substrate entirely by holding down Volume Up as the device boots.

This feature allows you to bypass horribly broken extensions (ones that prevent the device from starting up at all) that you may have installed so you can open Cydia and uninstall them.

To support devices that do not have a Volume Up button (the first-generation iPod touch), you can alternatively hold down the "Clicker" (not Volume Up) button on your headset or earphones.

Try manually removing very incompatible tweaks: If that doesn't help, or if your device is using an old version of Mobile Substrate (a version without the safety feature), try plugging your device into your computer and using an application such as iExplorer, DiskAid, or Phone Disk to access the device - it may be difficult to access a device in this state, but force a reboot and try accessing it. Check in the folder /Library/MobileSubstrate/DynamicLibraries/ and delete any extensions that might not be properly compatible with iOS 5, and then try booting again. (If any of your extensions happen to be pirated, those are good candidates for removal because pirated software is often outdated and buggy.) Try this until it works, or until you run out of patience. :)

If your device is an iPhone 3GS, iPhone 4, iPod touch 3rd/4th generation, or iPad 1: You can try this custom redsn0w method (scroll down to the first answer starting with "For new people reading this thread") to disable all tweaks and hopefully allow the device to boot up.

If all else fails: If it still won't boot, you can try putting your device into DFU mode and using iTunes to restore it. Unfortunately you'll lose any un-synced data. Make sure to use custom firmware to restore if you need to preserve your device's baseband. But before restoring, you might want to ask a question so we can try answering it without the need to restore. (It's helpful if you list extensions you've installed, so that we can try to point out extensions that might be causing the problem.)

When will there be an untethered jailbreak for iOS x.x.x or an unlock for baseband xx.xx.xx?

Don't ask us, because we don't know!

To get news about new jailbreaks and unlocks as soon as they happen:

For official news, subscribe to the iPhone Dev Blog or follow dev teams and their members on Twitter: @iphone_dev, @MuscleNerd, @ultrasn0w, @pod2g, @saurik, @iH8sn0w, @greenpois0n.

For unofficial news reports, you can also read ModMyi and iDownloadBlog, among other blogs.

Why do these things take a long time?

If you're wondering why it took so long for the iPad 2 to get another jailbreak, thinking it should have been easy since there was a jailbreak for iOS 4.3.3, keep in mind that JailbreakMe is a "userland" jailbreak that takes advantage of a flaw in Mobile Safari in 4.3.3 to start the jailbreaking process. Apple easily fixed that Safari flaw with 4.3.4, so JailbreakMe is no longer useful for new versions of iOS.

There will always be at least tethered jailbreaks available for devices with the A4 processor and earlier (including iPhone 4, iPhone 3GS, iPad 1, and iPod touch 3rd and 4th generation), because they have bootrom flaws that can be used by redsn0w (with the help of an exploit called limera1n) for tethered jailbreaks of those devices on any version of iOS. These bootrom flaws can't be fixed by any update Apple sends out, because they're basically part of the hardware of the device. (But jailbreakers have to find additional exploits in order to provide untethered jailbreaks for these devices.) Jailbreakers do not yet have this ability to manipulate the bootroms of A5 devices or later (iPhone 4S, iPad 2, iPad 3rd generation).

There may not be more ultrasn0w software baseband unlocks anytime soon. There haven't been any new ones for a while, especially not for iPhone 4 basebands.

What's the difference between jailbreaking and unlocking?

Jailbreaking means removing restrictions in your device's default software so that it can run third-party apps and extensions (themes and tweaks) not approved by Apple.

Unlocking is the process that allows an iPhone to be used as a phone on other carriers that aren't supported, such as an AT&T iPhone being used for texting and calling on a T-Mobile plan with a T-Mobile SIM card.

I open Cydia and it says my TSS request is pending. What does this mean?

This means that Cydia hasn't yet been able to save SHSH blobs for your device. Whenever you open up Cydia, it tries to grab any available SHSH blobs that Apple is providing for your device, and if it hasn't grabbed any yet, you'll see the TSS request message.

(SHSH blobs are "signatures" that let you restore to the iOS version that the blobs have been saved for. Learn more about what SHSH blobs are and why they're useful.)

Cydia might not be able to grab SHSH for your device for various reasons. Apple generally only "signs" the very latest version of iOS for your device, and Cydia might not yet be saving SHSH for that version.

Generally you only have to be concerned about SHSH when you need to restore your device and want to restore to a version Apple isn't signing anymore, for example to retain an untethered jailbreak. It's nice to have SHSH saved for the future, but you shouldn't worry too much about the TSS request message.

You can also save SHSH manually by plugging your device into your computer and using TinyUmbrella. Another option is to install the iSHSHit package on your iOS device, which will let you generate and email SHSH blobs for an additional backup, but you should then get those emailed SHSHs and import them to TinyUmbrella, as SHSHs by themselves can't help you restore.

How can I install ultrasn0w on my iPhone without Wi-Fi?

Got yourself in a pickle, eh? No Wi-Fi available, and you can't connect to the data network because you need ultrasn0w?

First make sure you have the latest version of iTunes installed on your computer.

You have to install ultrasn0w using iExplorer or DiskAid. Here's the ultrasn0w.deb file.

Put the ultrasn0w.deb in var/root/Media/Cydia/AutoInstall

If the Cydia/AutoInstall directory is not there, then you create one.

Lastly, reboot your device.

Note: ultrasn0w has a dependency on Mobile Substrate, so if this is not installed on your device (if this is a fresh jailbreak it will not) then you need to download Mobile Substrate and Substrate Safe Mode and install them the same way explained for ultrasn0w. This should be done before installing ultrasn0w itself.

How do I restore (downgrade/upgrade) my device to iOS 5.0.1 or other non-latest iOS versions?

Since Apple has introduced an APTicket/APNonce check for restores to iOS 5, the TinyUmbrella TSS Server procedure does not work anymore when restoring to any version of iOS 5.x (you can still use that procedure for restoring to iOS 4.x if you want, but the following stitching procedure should work too). Instead, you need to create and restore to a custom IPSW (custom firmware file) with stitched SHSH blobs. (If you're lucky enough to have an old-bootrom iPhone 3GS, you don't need SHSH blobs and can go through this process without doing the stitching steps.)

To successfully restore to iOS 5.0.1, you must have iOS 5.0.1 SHSH blobs saved for this device in your computer (what are SHSH blobs and why are they necessary?). If your device was previously jailbroken, Cydia may have been able to automatically save iOS 5.0.1 SHSH blobs for your device. You can try retrieving SHSH from Cydia's servers by running TinyUmbrella, plugging your device into your computer, clicking the "Advanced" tab, checking "Request SHSH from Cydia", noting where the SHSH will be saved in "Save SHSH Folder", unchecking "Set Host File to Cydia on Exit", and then clicking "Save SHSH" at top right. Verify that your 5.0.1 SHSH blobs are saved (in the General tab) and close TinyUmbrella before proceeding. (If you're interested in restoring to a non-latest version of iOS other than 5.0.1, mentally replace 5.0.1 with your desired iOS version number and follow the same instructions.)

Instructions for iPhone 4S and iPad 2

Follow these steps to use SHSH blobs to restore your device to iOS 5.0.1 using redsn0w. If you have an iPhone, note that this method will upgrade your device's baseband to the latest baseband, which you probably do not want if you use a baseband-dependent unofficial carrier unlock.

• Grab the IPSW files (firmware files) for iOS 5.1.1 and 5.0.1 for your device - you can look for them on your computer or download them via these links.
• Open the latest version of redsn0w (redsn0w 0.9.11b4), click "Extras", click "Even more", and click "Restore".
• Click "IPSW", select your iOS 5.0.1 file, and then select your iOS 5.1.1 file.
• If you've already saved iOS 5.0.1 SHSH blobs to your computer with TinyUmbrella as described above, click "Local" and select your SHSH blobs. If your iOS 5.0.1 SHSH blobs are still saved on Cydia's servers, click "Remote" to grab them.
• redsn0w will install iOS 5.1.1 on your device and then downgrade it to iOS 5.0.1.

If your device gets stuck in "Connect to iTunes" mode, try opening redsn0w, clicking "Extras", and clicking "Recovery fix".

Instructions for iPhone 4 and 3GS, iPad 1, and iPod touch 3rd and 4th generation

After you have 5.0.1 SHSH blobs saved on your computer (as described above), follow these steps to stitch a "Custom IPSW with blobs" using redsn0w (compatible with Mac and Windows) and then restore with it via iTunes. If you have an iPhone, this method will preserve your device's baseband.

• Open the recommended current version of redsn0w: redsn0w 0.9.10b8b, available from the Dev Team Blog.
• If your device is an iPhone, first create a NO_BB ("no baseband") custom IPSW using redsn0w and then follow the rest of these steps. (To do this, open redsn0w, click "Extras", and click "Custom IPSW".) If your device is an iPad or iPod touch, ignore this step.
• Click "Extras".
• Click "SHSH blobs" and then click "Stitch".
• Locate the IPSW for the version of iOS you want to downgrade or upgrade to. If your device is an iPhone, select the NO_BB custom IPSW you made earlier. (You can also make a custom IPSW using sn0wbreeze if you prefer; see below for links.) If your device is an iPad or iPod touch, you can use a stock IPSW from Apple; this may be already on your computer.
• Click "Local" and select the saved 5.0.1 SHSH blob you saved in your computer earlier.
• redsn0w will now begin creating your signed IPSW. It will be saved in the same location the stock IPSW was located.
• Enter Pwned DFU mode with redsn0w or iREB. (In redsn0w, go back to the Extras menu and click "Pwned DFU".)
• Open iTunes and hold down the "Shift" key (on Windows) or "Option" key (on Mac) and click on Restore.
• Navigate to your iOS 5.0.1 signed custom IPSW and select it.
• The rest will be a normal restore process. You should now have successfully restored your device to iOS 5.0.1.

If you use Windows, an alternative to redsn0w is to use sn0wbreeze 2.9.3 in iFaith mode to create a custom IPSW with stitched blobs (which can also be useful for people who need to preserve an unlockable baseband since sn0wbreeze custom IPSWs always avoid baseband updates). sn0wbreeze is available to download here, along with the stand-alone tool iFaith that can stitch blobs: http://ih8sn0w.com/

You may also pull partial 5.0.1 SHSH blobs from your device (iPhone 4 or earlier) if it is currently on 5.0.1, using redsn0w's "Fetch" function or using iFaith.

If you get any iTunes errors while restoring, check this list of error solutions for some ideas on what might have gone wrong. If you're using the redsn0w process and you get iTunes error 1, try going through the process again but make sure to include the step of making a custom firmware that preserves your device's baseband - or try using sn0wbreeze/iFaith instead, which will also preserve your device's baseband.

What is DFU mode, and how do I put my device into DFU mode?

"DFU mode" means "Device Firmware Upgrade mode". It's built into iOS devices to allow you to restore iOS even if something has gone wrong on the software level of the device. We use DFU mode to get a jailbreakable device ready for applying a jailbreak like redsn0w, and to restore custom firmwares. If something goes wrong with a jailbroken device, you can always put the device into DFU mode and restore it with iTunes.

Instructions for putting your device into DFU mode:

First make sure you have the latest version of iTunes installed on your computer, and make sure you've plugged your device directly into your computer (using a USB hub may not work).

With your device connected to your computer, hold the power (lock) button and home button for 10 seconds, then release the power button but keep holding the home button for another 15 seconds.

If you've successfully entered DFU mode, the device screen will be black and iTunes will say it's in recovery.

If you'd rather see a video tutorial, you can go here or here.

What is SpringBoard?

SpringBoard is part of iOS that organizes the home screen and gives you all the options to actions your iDevice can do such as creating folders, changing home screen wallpapers, installing applications, and when you're jailbroken, Activator for SBSettings.

Restarting the user interface without rebooting the phone is referred to as a respring.

What is WinterBoard?

WinterBoard is a Cydia package that allows theming, and is required for 99% of the currently available themes.

What is SummerBoard?

SummerBoard was an earlier theming support package, mostly at this point replaced entirely by WinterBoard.

What is AutumnBoard?

Good question, nobody has invented that one yet.

I'm getting "Failed to get AppleS5L8920XARM7M" on my device when running greenpois0n. What does this mean?

This happens if you're on iOS 4.3.x and trying to use greenpois0n. greenpois0n is only compatible with iOS 4.1 and 4.2.1. It doesn't work on 4.3.x or above. Instead, use the correct jailbreaking tool for your device.

How to use SAM to get proper activation of my iPhone?

To find out why SAM is useful, see here: What is hacktivation? How do I hacktivate?

See also SAM's website for some basic info: "This will allow you to do official activation on an iPhone without a stock SIM - it MAY help with Battery Drain issues, but that is NOT the primary purpose of this."

First install SAM from this repository: http://repo.bingner.com/

You need to know what carrier is your phone locked to. (You'll want to enter into SAM the country and carrier that the phone is originally locked to, not the info of the sim you are going to be using.) In automatic mode SAM assumes your iPhone is locked to AT&T; if you don't know which carrier your phone is locked to, you'll need to do some guesswork until you get it right.

Open SAM. It will notify you that you are hactivated and need to first De-Activate before proceeding. Go to Utilities menu and select "De-Activate iPhone", a message will come up saying that stockifying succeeded, then go back to the SAM main menu.

You need to select the Method SAM should use to generate the simulated SIM ICCID and IMSI (this appears only after the De-Activation step above). The methods include:

• Auto Detect: will assume AT&T SIM
• By Bundle Name: you can select from the various bundles across the world, then select the SIM ID prefix.
• By Country and Carrier: you can select Country, then Carrier, then under SIM ID you can select any ID prefix.
• Manual: You need to enter the correct ICCID and IMSI numbers

Once the Method is selected, make sure Enabled is switched ON. Connect your iPhone to iTunes and you will see the status bar telling you that it is contacting apple server, and if you have selected the correct settings you will see the message that you have successfully activated your iPhone.

Other options in SAM include:

• Copying (Spoofing) ICCID and IMSI of an actual physical SIM card (perhaps you borrow it from a friend)
• Backing up activation in case you don't want to remember the settings.
• Restoring of activation from a back-up

Which third-party repositories are safe to add to Cydia, what do they contain, and how?

You generally do not need to add more sources. Cydia comes pre-installed with three default sources with thousands of packages: BigBoss (specializing in providing tweaks and modifications along with some themes), ModMyi (containing lots of themes and some tweaks), and ZodTTD/MacCiti (containing even more themes and some games). When anybody develops or designs a new package, he or she can submit it to one these sources and generally have it published and available to everybody who uses Cydia. (Cydia also comes with the ultrasn0w repository and also Telesphoreo Tangelo, which is saurik's source with tweaks he developed and some developer tools etc.)

Adding more sources beyond those is at your own risk and not recommended. You can do it, but you might find badly-written software, configuration errors, and who knows what else. You can find some suggestions by tapping "More Package Sources" on the Cydia homepage. (Tip: if you accidentally uninstall one of the default community sources, you can reinstall it by going to More Package Sources.) If you add a source and Cydia warns you about it containing pirated material, don't add it.

If you want to add a custom third-party repository, such as a developer's repository with beta packages, here's how: in Cydia, go to Manage and choose Sources. Then tap Edit and Add. Enter the URL of the repository in the popup, tap Add Source, and then wait while it updates. You may then tap on the newly added repository to see what packages it contains.

Here is a list of some additional third-party repositories that are known to not contain objectionable (pirated) material:

• http://aaron.ms/repo/ - very experimental tweaks (to install stuff, you need to provide your device's UDID)
• http://apps.iphoneislam.com/ - FaceTime hacktivator, also PhoneIt-iPad (iPhone functions on iPad 1 with 3G)
• http://coredev.nl/cydia/ - Perl-related development packages (can't be added directly to Cydia; see their website for how to add it)
• http://cydia.pushfix.info/ - pushfix MiTime
• http://cy.sosiphone.com/ - mostly French-language repository
• http://deb.danstaface.net/ - vWallpaper (animated background images)
• http://hitoriblog.com/apt/ - FakeClockUp (speeds up UI animations so that your device feels "faster")
• http://iphonedelivery.advinux.com/cydia/ - iPhoneDelivery (SMS delivery notifications)
• http://www.ijailbreak.com/repository/ - working version of MobileTerminal for iOS 4 and 5
• http://repo.benm.at/ - Frash, which only works on firmware versions up to 4.1
• http://repo.bingner.com/ - Subscriber Artificial Module (SAM)
• http://rpetri.ch/repo/ - experimental tweaks and beta versions of tweaks by Ryan Petrich, including TweakWeek packages

How do I remove my jailbreak?

Plug your device into your computer, open iTunes, let your device sync and back up (you may need to separately back up your contacts, photos, etc. if they aren't synced with your device), and then click Restore. After the restore your device will reboot, and then iTunes will give you the option to choose which backup to restore from. The first one is usually the one you want, unless you want to restore to an older backup. Click continue and then let your apps, music, and pictures sync.

If you have an iPhone 3G or 3GS with the iPad baseband (6.15.00), you need to restore using custom firmware. sn0wbreeze and redsn0w can create a custom firmware file that is not jailbroken in baseband preservation mode only. See here for more on building custom firmware.

If restoring your device doesn't seem to be working, such as iTunes giving you error messages, check this list for possible fixes.

Restoring your device completely replaces the firmware and removes all reasonable traces of the jailbreak. You can feel free to take the un-jailbroken device to an Apple Store if it needs repairs.

Redsn0w stuck on uploading ramdisk?

Don't run redsn0w from inside the zip file. Extract redsn0w.exe to your desktop.

Windows 7 and Vista (but not XP)

Right-click the redsn0w.exe on your desktop, choose "Properties," go to the "Compatibility" tab, and under "Compatibility mode" tick the "Run this program in compatibility mode for" box and choose Windows XP, with the highest Service Pack listed. At the bottom of the dialog tick the box under "Privilege Level" to "Run this program as an administrator." Click OK. It should look like this screenshot.

Double-click redsn0w.exe on your desktop.

Windows XP only

Click redsn0w.exe on your desktop once to select it, and then hold down the Shift key and right-click redsn0w.exe. You'll see a contextual menu from which you can select Run as... and then choose an administrator account.

How do I make sure greenpois0n runs successfully?

Note that redsn0w can successfully jailbreak and untether your device on iOS 4.2.1 (now on both MB and MC models). Using redsn0w lets you avoid common greenpois0n issues such as the Loader cannot install Cydia successfully issue, which may also make you run redsn0w either way.

Before running greenpois0n do the following:

• If jailbreaking iOS 4.2.1, the iPhone 3G is not supported.
• Make sure you download greenpois0n RC6.1 from here: http://greenpois0n.com/?page_id=18 (scroll down to find the link for RC6.1).
• greenpois0n RC6.1 supports device that are at iOS version 4.2.1 only. Older greenpois0n RC4 supports iOS version 4.1.
• Connect your device to your computer over USB. Make sure to use a USB 2.0 port (this is the most common kind), not USB 3.0.
• Once connected, be sure your device is powered off.
• Extract the greenpois0n.exe from the zip file to a folder on your computer.

In order for greenpois0n to run successfully the first time, you need the following:

• The latest iTunes should be installed, because this provides the required drivers for your device.
• The computer on which you are running greenpois0n needs to have a good, non-proxied broadband internet connection, which is needed because greenpois0n downloads a couple of payload files (the iBSS and kernelcache of your device firmware) from Apple.
• Run greenpois0n from the folder where you extracted it. This will help you in case you need to re-run it and need to delete the payload files.

If for some reason the first run didn't work and you are trying again, check the folder in which you ran greenpois0n for the two payload files iBSS and kernelcache, and delete those before trying again as they may be corrupted.

Also note that greenpois0n rc5, rc6, rc6.1 do not support iPhone 3G, and only support iOS 4.2.1. greenpois0n rc3 and rc4 support all devices at iOS 4.1.

If Loader/Cydia crashes or Cydia icon is missing, here's how to install Cydia:

Install Cydia via redsn0w. You will need a copy of your stock 4.2.1 firmware. If you don't have it, get it here. Choose only "Install Cydia," as seen in this screenshot.

NOTE: If you're on Windows, redsn0w must be run as administrator, in XP Service Pack 3 (2 in Vista) compatibility mode. Extract the redsn0w.exe to your desktop; don't run it from inside the zip archive. If you're using Windows XP, click redsn0w.exe once to select it, and then hold down the Shift key and right-click redsn0w.exe. You'll see a contextual menu from which you can select Run as... and then choose an administrator account.

This will not remove your greenpois0n untether and/or your jailbreak.

Where does iTunes store IPSW (firmware) files it downloads?

This depends on your operating system. The locations are as follows. Note that you may need to use "iPad Software Updates" or "AppleTV Software Updates" instead of "iPhone Software Updates" depending on your device type.

On Windows XP:

C:\Documents and Settings\<user>\Application Data\Apple Computer\iTunes\iPhone Software Updates\

On Windows Vista/Windows 7:

C:\Users\<user>\AppData\Roaming\Apple Computer\iTunes\iPhone Software Updates\

On Mac:

~/Library/iTunes/iPhone Software Updates

Notes:

After you find the IPSW file you need, you may want to copy it somewhere else. Whenever iTunes downloads a new IPSW, it will automatically delete any older ones for that device.

On Windows, you may have to enable the ability to see hidden files and folders. To do this, open the control panel, click folder options, click the view tab, check show hidden files, folders, and drives, click OK, and try again.

On Mac OS X Lion, the ~/Library folder is hidden by default. To re-enable it by default, open Terminal and type: chflags nohidden ~/Library/ (this prevents having to use the option-key from the Finder's Go menu).

If this guide doesn't work: if you can't find the IPSW file you need, you can download a new copy - just find the right link on this list of firmware downloads.

How do I fix errors and problems when trying to restore or upgrade my device?

A restore or upgrade may fail due to one or more of the following problems. Go through each one to make sure it doesn't apply to you (and fix it if it does):

• Having an older version of iTunes that doesn't support the firmware file version.
• You have TinyUmbrella installed and it's set to edit your hosts file, so the restore is trying to use saurik's servers to verify the firmware instead of Apple's servers. This can cause error 3194, 16xx, 21, "not eligible for requested build", and other errors. (To fix it: open TinyUmbrella, look under the Advanced tab, uncheck "Set hosts to Cydia", and quit TinyUmbrella. If you've done that and http://gs.apple.com/ still shows the Cydia homepage instead of an Apple 404 page, you need to fix your hosts file by editing it directly. See this guide for fixing error 3194 for more details.)
• Not having the required SHSH saved on TinyUmbrella or Cydia server for the iOS version you're trying to restore with. This usually gives you iTunes error 3914 or "not eligible for requested build". (If you want to restore to the latest version and don't need to preserve your baseband, try using iTunes to just do a plain "Restore and Update" to the latest version of iOS instead [make sure to close TinyUmbrella first if it's open]. If you do need to preserve your baseband, try building custom firmware for the latest version and restoring to it using iTunes.)
• Not having internet access for iTunes to authorize the firmware restore. (This will also likely show error 3194 or "not eligible for requested build".)
• Not successfully entering DFU mode before restoring. (Here's how to enter DFU mode.)
• Choosing "Update" instead of "Restore and Update". (It's best to choose "Restore and Update" so that your device has a fresh start. Usually just choosing "Update" will still work, but some space will be wasted on your device until you do a clean restore.)
• Using a custom firmware file without putting the device in Pwned DFU mode. (Usually tools for building custom firmware also include ways to put your device into pwned DFU mode.) If you're getting a 1600/1601/1602 error or other 16xx error, this is probably the reason. See these tips about using Pwned DFU mode.
• Having the iPad baseband (6.15.00) loaded on an iPhone 3G/3GS and trying to restore with stock firmware file (or otherwise needing to use custom firmware due to baseband mismatch).
• Using the wrong firmware file (keep in mind that the firmware filename isn't always helpful - for example, "iPhone3,1" means iPhone 4, not iPhone 3GS - so make sure to download the correct file).
• Using a corrupted firmware file.
• Connecting your device to a USB hub instead of directly to the computer.
• Stuck in recovery mode (error 2001 or other errors) - try TinyUmbrella's "Exit recovery mode" button.
• An antivirus or firewall program blocking connections to Apple (such as AVG or Little Snitch); temporarily disable these if you have any running.
• Having third-party software installed that interferes with USB function, such as WiFi-Sync.
• A hardware problem with your device, such as a non-functioning battery.

If you're getting a specific error number other than 3914 or 16xx (explained above), look up what the error code might mean or search for it on JailbreakQA.

If you're trying to restore your device to stock iOS and it's just not working, you could try building custom firmware and using that to restore.

If iTunes doesn't seem to recognize your device, put your device into DFU mode and plug it into the computer. iTunes should recognize it as being in recovery mode and you should be able to restore it.

If all else fails, you might want to take it to an Apple Store and find out whether there's a hardware problem with the device.

How do I build a custom firmware to upgrade while preserving my unlocked baseband?

Before upgrading, check that your target iOS version has a jailbreak available, and check to make sure ultrasn0w is compatible with your target iOS version. (ultrasn0w is currently compatible with iOS versions up to 5.0.1.)

Here's a basic guide:

1. First backup in iTunes and also make a list of your installed tweaks so you can reinstall them later. Also make sure you're using the latest version of iTunes.

2. Download your favorite jailbreaking tool that can preserve basebands:

   • redsn0w is for Mac and Windows, and can jailbreak iOS 4.1 through 5.1.1 (untethered on 4.1-4.3.3 and 5.0.1), but only iOS 5.0 and 5.0.1 on iPhone 4S and iOS 5.0.1 on iPad 2 (and you cannot put custom firmware on iPhone 4S or iPad 2).
   • PwnageTool is Mac only, and can jailbreak iOS 4.1 through 4.3.3 and 5.0.1 (untethered) except on iPad 2 and iPhone 4S.
   • sn0wbreeze is Windows only, and can jailbreak up to 5.0.1 (untethered on 4.1-4.3.3 and 5.0.1) except on iPad 2 and iPhone 4S.

3. Download a copy of the desired firmware for your device, or see if it is already saved on your computer. (Note that if you're trying to restore to a firmware other than the newest one available from iTunes, you'll need to have SHSH blobs for that version in order to restore to it. See here for an explanation of SHSH blobs, and see this guide to using SHSH blobs - the guide includes steps for making custom firmware to preserve your device's baseband if you have a device with this capability.)

4. Open the tool, select the firmware, then choose how you wish to go about it. (For example, in redsn0w, click "Extras", and then click "Custom IPSW".) You can preserve the baseband of the iPhone and/or hacktivate (unofficially activate). If you activate by official carrier SIM, deselect hacktivation. If you don't have official carrier SIM, you need to hacktivate. See here for an explanation of hacktivation.

5. The custom firmware will be built (which usually takes about 5 minutes) and will be placed on your desktop. The tool will then give you steps for entering "pwned DFU" mode. Then open iTunes, hold down the "Shift" key (on Windows) or "Option" key (on Mac), click on Restore, and select the firmware on your desktop. (If you're getting error 1600, see these tips for fixing it.)

6. Depending on the tool you used (and the options you selected), you may need to jailbreak your device.

7. If you need ultrasn0w for your unlock, don't forget to install it. Search Cydia to find it. And reinstall the rest of your tweaks!

Note: If you have a factory-unlocked iPhone, or if you don't need an unlock, you don't need to preserve your baseband. If your device has the iPad baseband (6.15.00), you need to use custom firmware every time you upgrade or restore.

What is activation? What is hacktivation, and how can I hacktivate my device?

What is activation?

When an iPhone is booted up for the first time or freshly after a full restore, the phone serial number and IMEI are checked against a database in Apple to make sure it's allowed to work with the SIM card inserted. This also activates push notifications to the iPhone.

iPhones that are locked will only activate when the official SIM card of the providing carrier is inserted. Apple can recognize this from the SIM ID (ICCID) and the SIM IMSI.

Therefore activation opens access to all functions of the iPhone except accepting another carrier SIM card, which is controlled by the baseband (this runs the low-level phone functions).

What is hacktivation, and how can I hacktivate my device?

If an official SIM card is not available, an iPhone can be hacktivated to allow access to the iPhone functions and Springboard. Hacktivation is supported when jailbreaking using redsn0w and/or creating custom firmware files using tools like sn0wbreeze or redsn0w on an iPhone 4, iPhone 3GS, or iPhone 3G. (Absinthe cannot hacktivate an iPhone 4S.)

If you can, you will want to un-hacktivate your device and properly activate it. If you do not properly activate the phone, push notifications will not work, and your device will drain battery and data while it continues to "hunt" for the correct certificates. iMessage and FaceTime may also not work.

You can either do this by "deactivating" in redsn0w and then reactivating using the original carrier SIM while connecting to iTunes, or if an original SIM is not available, you can try using Subscriber Artificial Module (SAM) to obtain correct activation certificates for your phone (SAM simulates an official SIM card ID [ICCID] and IMSI). See "How to use SAM to get proper activation of my iPhone?" for more help.

When do I not need SHSH blobs to downgrade my device?

You do not need SHSH blobs to downgrade if the device you are downgrading is an original iPhone, an iPhone 3G, an original iPod touch, or an iPod touch 2G (MB model only), and you are restoring it to a pre-iOS 4 firmware.

You also don't need SHSH blobs if you have an old-bootrom iPhone 3GS. Put it into "Pwned DFU" mode and use custom firmware, and you can restore it to any iOS version.

How do I use iFaith to create a signed custom IPSW for my currently installed version?

iFaith allows you to make a signed custom IPSW for your device's currently installed version (or to make a signed custom IPSW using already-saved SHSH blobs). This produces a signed custom IPSW so that someday in the future you still have the option of restoring back to your current version if your device requires a restore.

This is especially useful if you do not have normal SHSH blobs saved for your device's current version - and you want to be able to restore and return back to its current version.

iFaith is only available for Windows. It supports up to iOS 5.0.1 on iPad 1, iPhone 3GS (new bootrom), iPhone 4, and iPod touch 3rd and 4th generation. It does not support iPad 2, iPhone 4S, or older devices (iPhone 3GS with old bootrom, iPhone 3G, or iPod touch 2nd generation). As of April 2012, it may not work correctly if you have an 8 GB iPhone 4 (see here).

Step 1: Download iFaith

1. Download iFaith here: http://ih8sn0w.com/ (Note: iFaith may be detected as a Trojan by AVG and possibly other antivirus programs. This is a false positive and you may have to temporarily disable your antivirus program to use iFaith.)
2. Have your device plugged in and powered off.
   
3. Unzip the file and run the .exe file.

Step 2: Dump SHSH blobs onto your computer

1. You will see a welcome/warning screen. Click OK.
2. You are presented with 4 options. Select "Dump SHSH blobs" if you have not done so previously.
3. A screen will pop up telling you what devices are supported (Apple TV 2, iPad 1, iPhone 3GS, iPhone 4, iPod touch 3 and 4).
4. Click proceed then more credits, press let's go!
5. Another pop-up will ask if you are dumping an Apple TV 2, so click the appropriate button.
6. Now, making sure your device is plugged in AND powered off, you can press the START button and put your device into DFU mode. iFaith will dump your current iOS device's SHSH blobs onto your hard drive. The process takes about 10 minutes, and it may seem to hang on one part of the process, but be patient.
7. Once done, iFaith will ask you to save the blobs on your computer. I chose to make a new folder for this. Note that iFaith also stores your blobs on its own remote server.
8. iFaith will take you back to the main menu so you can build your signed IPSW.

Step 3: Build the signed IPSW

1. OK, now click on "Build signed IPSW".
2. Click the "Browse for SHSH blobs cache" button. An Explorer window will open. Navigate to the folder that you had saved your blobs into in the previous step - you should see a file that looks like this: iPhone_4-4.3.2_(8H7)-blobs.ifaith (here I am using 4.3.2 but yours will be whichever firmware you are using on your phone).
3. You will now be prompted to browse for the stock IPSW for this firmware. There is also the option to have iFaith download it for you if you do not have it on your computer.
4. Select the stock IPSW and iFaith will verify it.
5. iFaith will then build the signed custom IPSW for you and place it on your desktop.
6. You then can have iFaith put your device into PWN DFU for you if you want to restore your custom IPSW now, or just shut iFaith down if you are just building the IPSW for possible future use.
7. If you want to restore to your new custom firmware, just use iReb (included in the iFaith program) to get your phone into PWN DFU mode, close iFaith, open iTunes, press and hold the shift key and press restore, browse to the signed custom firmware you created with iFaith and press OK, then restore.

How to change my device's default password to make SSH safe?

Recommended: Cydia contains a handy guide to changing your root password using OpenSSH + a SSH client app. Just open up Cydia and scroll down on the homepage until you see "Root Password How-To" and read it.

Alternate method:

If you'd prefer to change the password using MobileTerminal instead, you'll first have to download MobileTerminal from its official site. Here are instructions:

1. Go to the Mobile Terminal downloads page and download the most recent version (currently MobileTerminal_520-1_iphoneos-arm.deb).
2. Transfer this file over to your device using SSH, SFTP, or a desktop application such as iExplorer, DiskAid, or Phone Disk. Put the file into /var/root/Media/Cydia/AutoInstall (you may have to create those directories in order to do this). Reboot your device. MobileTerminal should now be installed.
3. Open MobileTerminal. Type passwd and then tap return. It will ask you for a password. Enter alpine and tap return again. (alpine is the default password to be changed.) Type in a new password that only you know of and tap return. Retype the new password to confirm and then tap return one last time to change the password. Now your mobile password is changed!
4. Type su root and tap return. It will ask you for a password. Enter alpine and tap return again. (This is the default password to be changed.) Type passwd and then tap return. Type in a new password that only you know of and tap return. Retype the new password to confirm and then tap return one last time to change the password. Now your root password is changed!

Now nobody else can access your device over SSH. Yay!

What's "pwned" DFU mode?

"Pwned" DFU mode is a special form of DFU mode where the device's bootrom (a low-level part of the device) has been exploited to allow custom firmware to be restored to the device.

You can use redsn0w or iReb to put your device into pwned DFU mode. In redsn0w, look under the "Extras" menu for the pwned DFU button. iReb is part of sn0wbreeze.

You can do this to devices including A4 devices and earlier (including iPhone 3GS, iPhone 4, iPad 1, and iPod touch 3rd and 4th generation). There is not yet any way to put A5 (or later) devices (including iPad 2 and iPhone 4S) into pwned DFU mode since we don't yet have a bootrom exploit for them.

I'm adding a repo and I get a message about it being illegal. What do I do?

You're adding a repository that pirates software. Pay attention to the warning that you get:

This repository has been reported by the community to be illegally redistributing copyrighted works. We cannot stop you from using it, but we can (and do) recommend moral introspection and caution. Please also keep in mind that illegal packages from untrusted sources are often outdated and unstable.

What you do regarding adding those sources is your business – Cydia is an open platform that does not impose a point of view on you – but keep in mind you are taking on responsibility, risk, and potential guilt. Anything you download from pirate sources is much more likely to contain bugs and problems, causing Safe Mode and other issues.

Paying for your software means that developers and designers can continue to make new and interesting tweaks and themes for everyone, and that Cydia can continue to host SHSH servers and other services.

Is it possible to install Android on my iPhone or iPod touch?

Only on a few devices, and it's very experimental. See the iDroid Project.

The only devices supported are the iPhone 2G, iPhone 3G, and the 1st generation iPod touch. The device must be on an iOS version between 3.1.2 and 4.2.1, and it must be jailbroken via blackra1n, redsn0w, or PwnageTool.

It is also possible to install Android on the 2nd generation iPod touch, but this requires tweaking, and the device isn't supported by the maintainers of the iDroid project.

What do I need to know about installing the iPad baseband (06.15.00) to unlock my iPhone 3G/3GS?

It gives you the ability to unlock the phone to unofficially use it on a different carrier - but at a cost:

First, it's a permanent upgrade to the baseband, so every time you upgrade or restore the phone, you have to use custom firmware or else the upgrade/restore won't work.

Second, your device will lose its native GPS capability. It will still be able to use cellular and WiFi triangulation to enable applications to get approximate location information (see hybrid positioning system and WiFi positioning system for more explanation). You should consider whether or not you need accurate location information at all times.

Third, having the iPad baseband on your iPhone 3G/3GS means that its warranty is void, so Apple may refuse to service or replace it if you run into problems. (The iPad baseband is obvious to Apple if they look at your phone.)

Also, the iPad baseband will damage iPhone 3GSes that are later than approximately 2011 week 28 - you have a week 28 or later device if your serial number starts with xx128 (you can also use this web tool to check). During the span between 2011 week 28 and 2011 week 35, some devices are compatible with the iPad baseband and some aren't, so if you're feeling lucky you can take your chances. If you have an iPhone 3GS in this incompatible category, you can't unofficially unlock it.

For more detailed warnings about installing the iPad baseband, see the Dev Team's blog post about it. If you still want to do it, use the latest version of redsn0w (click "Jailbreak", select "Install iPad baseband", and after you're done install ultrasn0w from Cydia).

My battery life is bad after jailbreaking, what can I do about it?

First, make sure you're following all of Apple's official recommendations for maintaining battery life, including checking your Mail retrieval settings and turning off 3G and WiFi when you don't need them active (and keep in mind that SBSettings makes toggling these on and off very quick and easy).

There are various reasons that battery drain can increase after jailbreaking, with various fixes.

1. Personal Hotspot (such as MyWi, TetherMe, or PDANet): Sharing your 3G connection to other devices is a significant battery drain. Not recommended for long term use without a power source for your iPhone. At least it has an easy fix - just turn it off.

2. Increased usage: With all the new things you can do on a jailbroken device, combined with the time spent getting everything set up the way you want it, you may be using the device more than usual. The process of installing packages, reloading data, restarting Springboard, rebooting, etc. uses additional battery too. If this is the case, then after a few days, your battery life should come back a bit closer to normal.

3. Flawed packages: Most packages from default repositories (BigBoss, ModMyi, Telesphoreo, and ZodTTD/Cydia) are reliable, safe, and don't use significant additional battery power - but occasionally they can have bugs causing extra background processing or data usage, causing some additional battery drain. This is unusual but possible. Packages that haven't been updated for a long time, packages by inexperienced developers, rarely-downloaded packages, and cracked/pirated packages are more likely to have problems than popular packages by reliable developers. If you suspect a package is causing your battery problem, try disabling or uninstalling that package for a few hours or a day, then put the package back and compare the battery drain. This can be a slow process, but it can be helpful. If you manage to find something that's causing a problem, you can leave it disabled to stop the battery drain, and contact the developer to let them know you've noticed a problem.

4. Heavy-duty packages: There are some extensions and tweaks that simply use some additional battery power since they use extra processing power or network connections, including video wallpapers, weather widgets, animated lockscreens, and other extensions that fetch data from the internet or change the screen a lot.

5. Hacktivation: If you've unlocked your iPhone along with jailbreaking it, unofficial activation (aka "hacktivation") may cause your battery to drain faster than usual. SAM may help with that problem.

If you're noticing strangely fast battery drain (or strangely slow charging) between 100% and 95%, keep in mind that your device's battery charging process has special behavior when nearly full in order to help protect the battery - see this article about the iPad 3 battery for a detailed explanation (this information applies to earlier iOS devices as well).

A couple of extra tools that may help narrow down battery issues are BatteryLogger and BatteryDetective. BatteryLogger gives you a visual graph showing battery life over time, and BatteryDetective gives you lots of info about the current state of the battery. The Pro version also lets you analyse running apps to give an estimate of how much battery they're using in the background.

Another tool you can try is to see what top has to say - it's an old-school command-line process viewer that you can install on your device. First make sure your user type is set to "Hacker" or "Developer" (you can change this on an iPhone or iPod touch by going to the Manage page and tapping Settings in the top left, or on iPad by going to the Sources page and tapping Settings on the top left). Search for top (it's in the Telesphoreo repository) and install it. Install OpenSSH if you haven't already, and then check Cydia's homepage for the "OpenSSH Access How-To" guide. Follow the guide. When you have a command line, type top and see whether it indicates that any unusual processes are taking up a lot of CPU.

If you've tried the above investigation without success, and are still getting huge battery drain even in Safe Mode, no apps running, Mail disabled, and the phone sitting unused for hours, then you may consider restoring and jailbreaking again to start fresh. (Just make sure the latest iOS version available for your firmware is jailbreakable.)

How do I get my device out of "Safe Mode" (Springboard crashing)?

Safe mode is a feature of MobileSubstrate that prevents your device from entering a permanent crash cycle by giving you a chance to uninstall malfunctioning extensions without a complete device restore.

Usually a Springboard crash ("Safe Mode") is a temporary problem, where you can tap Restart and go back to normal mode.

If your device goes right back into Safe Mode with the same message, you'll need to do some investigation. If you just installed a new tweak, that tweak is probably causing the problem. While you're in Safe Mode, open up Cydia and uninstall the tweak.

If the Springboard crash keeps happening, one or more of your installed tweaks is probably incompatible with your device's version of iOS. Open up Cydia, go to Manage -> Packages, and check the descriptions of each of your installed tweaks to try to find out whether they're compatible with your version of iOS. If one isn't, it's probably the reason for your crash, so uninstall it using Cydia. (Also check your packages to make sure they're all from legitimate sources such as BigBoss, Cydia/Telesphoreo, ModMyi, and ZodTTD/MacCiti; pirated packages frequently cause problems.)

If Safe Mode shows up while you are doing an action that is related to a tweak's functionality, that tweak might be the cause of the crash. Try uninstalling it.

If you have SBSettings installed, you can tap the "More" button and use its "Mobile Substrate Add-ons" feature to temporarily disable some of your tweaks so that you can isolate which one is causing the problem. (Disable some of them, respring, and see if Springboard crashes. If Springboard still crashes, disable some more. If the problem seems fixed, enable some of them. Continue this process until you isolate which one is the cause of the problem.) This is a little faster than uninstalling and reinstalling tweaks using Cydia, but if you use this method, you must make sure to re-enable tweaks before uninstalling them.

If you still can't figure out what's wrong, feel free to post a question and we'll try to help. Make sure to tell us what you did before Safe Mode started happening, what you've tried so far, and a list of your installed packages, to help us guess at what might be wrong.

I keep getting error 1600 in iTunes when flashing the custom firmware, what can I do?

Error 1600 means that the device is rejecting the firmware because it is a custom firmware. You need to "Pwn" the bootrom to avoid this rejection by putting the device in Pwned DFU mode before restoring. This can be accomplished in a few ways:

1. Using iReb from http://ih8sn0w.com/
2. Using sn0wbreeze from http://ih8sn0w.com/
3. Using redsn0w, which can put a device in Pwned DFU mode if you click "Extras" and click the "Pwned DFU" option.

Note: With iOS 5.0.1, 1600 errors may also occur when gs.apple.com is redirected to Cydia. Verify http://gs.apple.com/ brings up an Apple 404 page, not a Cydia page. If it brings up a Cydia page, check your hosts file and that TinyUmbrella is not set to set the hosts file to Cydia on exit. Clear DNS cache and/or reboot to clear the cache. Try several times, really, try several times. See this answer for more help with editing your hosts file.

I'm getting Error 1015, what can I do?

This error appears when downgrading iOS versions on iPhones and 3G-capable iPads, since the baseband part rejects the downgrade. At this stage the firmware itself has been writen to the iPhone/iPad but not the baseband.

You can exit the recovery loop using TinyUmbrella's "Exit Recovery" button. Alternatives include using iReb, iRecovery or RecBoot to set the auto-boot true.

See our guide to downgrading/upgrading with TinyUmbrella for more details.

Why doesn't redsn0w recognize the IPSW (firmware) file I downloaded with Internet Explorer?

You need to change the filename of the file. Internet Explorer downloads it as .zip, but you need it to be .ipsw.

Open "My Computer" or any hard drive or folder. From the top menu, choose "Tools", choose "Folder", go to the "View" tab, and un-check "Hide extensions for known file types." Click OK. (If you don't have "Tools" or any menu at the top, click the "Organize" button, go to "Layout" and check "Menu Bar" and then follow those directions.)

Now browse to your downloaded firmware, which will undoubtedly end with ".zip" and change it to ".ipsw" and you should be good to go.

If you can't find the right options, try using a different browser (like Firefox or Chrome) to download the IPSW file.

Can I get some help with using Gevey SIM?

We don't have much support for Gevey here -- it's not free, and most of the mods don't have any experience with it anyway. Most importantly, using Gevey SIMs requires calling emergency numbers (and then hanging up), which is of questionable legality, which means we don't support doing that. See MuscleNerd's tweet about this.

If you jailbreak your phone and use FuriousMod along with Gevey Ultra, you don't have to manually dial emergency numbers, so you have a smaller chance of error. We recommend this option.

If you purchased from an official seller (Gevey, Applenberry, or another one from this list), your best option is really to get support directly from them.

We definitely don't support fake/copy/clone versions (such as Pro Plus, Supreme, Turbo SIM, Ultra Turbo, etc.) - get support from whoever sold it to you, and not from here. Threads about fake/copy/clone versions may be closed or deleted.

Notes about upgrading to iOS 5 while retaining the ability to use Gevey: the iPhone 4 iOS 5 baseband installed by iTunes (4.11.08) is not compatible with Gevey. If you want to keep your iOS 4 baseband (4.10.01 or lower) and upgrade to iOS 5, use custom firmware to preserve your baseband.

iTunes Error Codes with Solutions

The iPhone Wiki has a long list of error codes with troubleshooting steps.

Apple also provides a list of iTunes error codes with suggestions.

Where's all the free stuff?

If I jailbreak, does it make everything in the App Store and iTunes free?

Nope, jailbreaking does not remove the requirement to pay for things that cost money. (Jailbreaking adds the freedom to do more with your device; it does not take away anything!)

If you'd like to get a paid App Store app or iTunes song, you still have to go to the App Store or iTunes and buy it.

If I jailbreak my iPhone/iPod/iPad, does it give me WiFi anywhere?

No, unfortunately jailbreaking isn't magical. Find your local Starbucks. :)

I jailbroke my iPhone, so where do I get free apps that cost money on the App Store?

JailbreakQA does not support piracy, and these questions will be closed.

I thought everything on Cydia was supposed to be free, so why do some things cost money?

Cydia is a bit like the App Store in that it has both free and paid products.

Developers and designers can choose to distribute their products for free if they want to, or they can charge money for them (and Cydia gets a percentage of that payment in order to cover taxes, payment processing fees, hosting, and development costs).

Developers charge money so that they can spend a lot of time on making complex, interesting Cydia products and still pay their rent. :)

My device says Connect to iTunes. I keep trying to reboot, but it keeps going back to Connect to iTunes! (Recovery Mode)

Download TinyUmbrella, open it, click on your device after plugging it in, then on the top right corner click Exit Recovery. This will kick your device out of recovery mode and reboot into normal mode.

If this doesn't work, you'll probably have to restore, as iTunes suggests. (And then if you're trying to restore the device with iTunes and it isn't working, check this list of potential reasons and solutions.)

I installed Frash and it's not working.

Frash is not supported. It works, at your own risk and sometimes not very well, on firmware versions up to 4.1. Past that it does not work at all.

There are themes/tweaks/utilities available for purchase on Cydia. How do I make a purchase on Cydia?

To make a purchase on Cydia, you need at least 2 separate accounts. You first need either a Gmail account or a Facebook account and an Amazon account or PayPal account.

You need to go on the Cydia home page and click on Manage Account and sign in with either Facebook or Gmail. Then you could go to the page of the tweak and select "Purchase".

You then enter how you want to pay (through Amazon or PayPal), and how much money you wish to deposit.

"Why do you need Facebook or Gmail?", you may ask. This is used to link devices to your account with Cydia and used to identify you every time you sign in on a different device. You may have as many devices linked to your account as you please.

Why am I having so much trouble jailbreaking my 8-gig iPod Touch 3G?

There's no such animal; you have an iPod Touch 2G. Once you know what you actually have, it's easier to select the proper tool and firmware. See this info, or try f0recast to see your device model and also extra info about it.

Why am I having trouble jailbreaking my iPhone 3Gs, model A1241 (A1324 China)?

Because you have an iPhone 3G. Once you know what you actually have, it's easier to select the proper tool and firmware. See this info.

Does jailbreaking upgrade my firmware and/or delete my existing data?

Most jailbreaking tools (including Absinthe, redsn0w, greenpois0n, and JailbreakMe) require your device to already be at the supported firmware version. In other words, they do not upgrade your iOS (firmware) version.

When you jailbreak with one of these tools, it simply jailbreaks your device and adds one application (Cydia). It does not delete any existing data. For example, if you've never jailbroken your device and you want to jailbreak iOS 5.0.1, you have to upgrade to iOS 5.0.1 using iTunes and then jailbreak it using redsn0w.

(It's always a good idea to make a full iTunes backup before jailbreaking though just in case something goes wrong and you do have to restore.)

The exception is using custom firmware to jailbreak your device:

But jailbreaking with custom firmware (using tools including redsn0w's "Extras" menu, PwnageTool, and sn0wbreeze) puts your device on the jailbroken firmware version, so it is an upgrade + jailbreak if you started with a lower firmware version. It involves restoring to custom firmware, so it does remove existing data on your device. Make sure to use iTunes to backup your data so that you can put it back on your device after restoring. (See also: How do I build a custom firmware?)

How can I test if push notifications work on my iDevice?

Other than use an application that relies on push, you can use the AppStore application iPush Test. All three tests should pass.

There is also a Cydia App called MiTime that diagnoses both push notifications as well as FaceTime registeration (you need to have the repo http://cydia.pushfix.info/). Note that MiTime offers a paid service to activate FaceTime, the test part however requires no purchase.

How do I jailbreak my old-bootrom iPhone 3GS untethered?

Use the latest version of redsn0w to jailbreak it. It'll notice that your device is an old-bootrom device and will jailbreak it untethered on any version of iOS.

To check if your bootrom is new or old use:

• @iH8sn0w's iDetector for Windows
• f0recast for Mac (check Untethered line)

How do I save my installed Cydia apps for easy reinstall after restoring?

Here are a few solutions for saving your Cydia packages so that you can reinstall them later.

Note: be cautious with automatically restoring packages if you are upgrading your device from iOS 4 to iOS 5. Some iOS 4 packages aren't compatible with iOS 5 yet, so you should check each package to make sure it's compatible (by looking at package descriptions in Cydia and maybe checking this unofficial and possibly-outdated spreadsheet), or else you'll end up in Safe Mode.

The basic method is: backup your packages using one of these methods, upgrade, jailbreak again, and restore your packages using your chosen method. For complete details on all of those steps, see this FAQ answer. To pick a backup method, keep reading.

Solution One [Difficulty: Easy]

The simplest method is just to open up Cydia, go to Manage -> Packages, and write down your list of packages. To email yourself a list instead of writing them down, you can use AppInfo from Cydia (free). After restoring, go through your list and reinstall them.

For another easy method, you can install AptBackup from Cydia (free), which makes a backup list of your packages automatically for you. After installing AptBackup, opening AptBackup, and tapping "Backup", make sure to sync to iTunes (it saves your package list in your iTunes backup). Restore (or Upgrade + Restore) with iTunes (using custom firmware if you need to), load your iTunes backup onto your phone, jailbreak again, install AptBackup, open AptBackup, and tap Restore. It should automatically load your packages back onto your device, although you may need to adjust the configurations.

For a more complete backup solution, find and purchase PKGBackup in Cydia ($8). It makes backups of your packages and sources (and apps), and it includes the option to backup to Dropbox (recommended), which is especially useful if you're not planning to restore from an iTunes backup.

There are also a few more backup tools available from Cydia, but we haven't tested them: xBackup, iBye, OpenBackup.

Solution Two [Difficulty: Medium]

If you are familiar with SSH and terminal commands, you can make a backup list using dpkg. To make a backup list of your installed sources and packages:

1. Go into Cydia and install the APT 0.6 Transitional package.
   
2. Pull the /private/etc/apt/sources.list.d/cydia.list file, which contains all your custom sources.
3. SSH in to your device and run the following command: dpkg --get-selections> cydia-apps This will create a file called cydia-apps in your root folder /private/var/root/ (and you can then download this file to save your installed apps).

To restore your backup list of sources and packages:

1. Restore to your desired version, jailbreak, open Cydia, and install OpenSSH and APT 0.6 Transitional
2. SSH into your phone.
3. Copy the cydia.list file you saved in step 2 to /private/etc/apt/sources.list.d/ and copy the cydia-apps file to /private/var/root
   
4. Next you need to run these commands from the ssh terminal:

   apt-get update
   dpkg --set-selections < cydia-apps
   apt-get -y dselect-upgrade
   

And when prompted Do you want to continue [Y/n], hit Y. Watch all your packages get magically reinstalled.

Why have the apps on my screen "shrunk" to 1/4 size?

This issue, where apps seem to shrink to a quarter of the screen size, can happen if you're using iOS 5 and have certain packages installed that aren't compatible with iOS 5. You'll need to check your installed packages and read their descriptions carefully to make sure each one is compatible with iOS 5, and uninstall any of them that aren't. Also make sure you're using packages from legitimate repositories (such as BigBoss, Cydia/Telesphoreo, ModMyi, and ZodTTD/MacCiti) so that you know you have the best current versions available from the authors of your packages.

If you have SBSettings installed (a popular free package for changing settings quickly), you might be able to easily put your device into "Safe Mode" so that you can uninstall the problematic package:

1. On the home screen, where the screen is normal size, swipe across the top bar to drop down the SBSettings toggles.
   
2. Tap the little button labled "Power".
   
3. On the window that pops up, tap "Safe Mode".
   
4. Your device will restart Springboard ("respring") and go into Safe Mode.
   
5. Open up Cydia, check your installed packages (under Manage -> Packages) for compatibility, and uninstall any suspect packages.
   
6. Use SBSettings to restart Springboard and see if the problem still happens. If it does, repeat the process.

If you can't access the device directly (due to a passcode or some other problem), you can try accessing your device's filesystem to delete incompatible tweak or theme manually (tweaks are usually installed to /Library/MobileSubstrate/DynamicLibraries/ and themes are installed to /Library/Themes/). If you've already installed OpenSSH, you can use a terminal to delete the incompatible file, or use a graphical SFTP client like Cyberduck or WinSCP. If you don't have OpenSSH installed, you can usually delete files over USB using an application like DiskAid, iExplorer, PhoneDisk, or PhoneView.

Why is iTunes or redsn0w saying that my firmware file is incompatible?

If you're trying to restore to the latest iOS version, check to make sure that you're not running into hosts file issues. You'll know that your hosts file is correct if you visit http://gs.apple.com/ and it has an Apple 404 page instead of a Cydia page. You can find out more about hosts files by reading this: How do I fix errors and problems when trying to restore or upgrade my device?.

Also, make sure you're using the correct firmware file. For example, if you have the iPhone 3GS and you're trying to restore to a iPhone3,1_x.x.x_XXXX_Restore.ipsw file, that won't work. The name at the beginning of the file, iPhone3,1, is actually the name of the iPhone 4 for AT&T. The iPhone 3GS is iPhone2,1. You can download the correct file from the iPhone Wiki's firmware list.

And to restore with custom firmware, your device needs to be in pwned DFU mode.

A developer asked for my device's syslog. How do I send it?

(A syslog is a record of technical stuff happening on your device, including errors that can be useful to developers. It usually doesn't include personal information other than your device's name and the names of apps and packages you have running.)

1. Open Cydia and install this package: syslog > /var/log/syslog

2. Reboot your device.

3. Go into the filesystem. You have several options for doing this. You can use iFile (a Cydia app that runs on your device); or install OpenSSH from Cydia and then use Terminal or a graphical desktop SFTP application like Cyberduck (Mac) or WinSCP (Windows); or use a desktop application like iExplorer.

4. Using your chosen tool, navigate to /var/log/syslog and email it to the developer who asked for it. (For example: in iFile, go to /var/log/, tap "Edit" in the top right corner, tap the white bubble to the left of the syslog file, tap the envelope at the bottom of the screen, and send the email to the developer.)

Optional: If you want to be able to run the command-line program "tail" to watch the syslog, you may need to install coreutils.

After completing this task: if you don't need syslog anymore, you can uninstall syslog > /var/log/syslog or just turn it on and off easily by using the package Syslog Toggle (and it might be a good idea to turn it off if you don't have much disk space available).

Why isn't iBooks working on my device?

iBooks is currently broken on 5.1 jailbreak. No fix available yet.

Early versions of the 5.0.1 untethered jailbreak (included when jailbreaking your 5.0.1 device with redsn0w 0.9.10b1, b2, or b3, or when installing versions before 1.0-5 of the Corona 5.0.1 Untether package on a tethered 5.0.1 jailbreak) would give you a device where iBooks pops up an error saying you can't use it. You can now install Corona 5.0.1 Untether version 1.0-5 from Cydia to fix iBooks on your device. Also redsn0w 0.9.10b4 (and later versions of redsn0w) includes this updated version of the untether for 5.0.1.

Where do I begin learning about how jailbreaks are created?

It takes years of programming experience and specialized reverse-engineering skills to be able to find exploits in iOS, but to learn about the methods, here are some links:

• If you're just starting out, here are basic definitions of different kinds of jailbreaks. You can also read about general exploitation techniques on Wikipedia, starting with software vulnerabilities and privilege escalation.

• Stefan Esser (@i0n1c), a security researcher who made the iOS 4.3.1-4.3.3 untether, has given several presentations on iOS jailbreaking techniques, and there are PDFs of his slides available online, including: "iOS Kernel Exploitation", "iPhone Exploitation: One ROPe to bind them all?", and "iOS 5: An Exploitation Nightmare?". He has also recommended a couple of books: The Shellcoder's Handbook and The Art of Software Security Assessment.

• Read iOS Hacker's Handbook, published in May 2012: "The award-winning author team, experts in Mac and iOS security, examines the vulnerabilities and the internals of iOS to show how attacks can be mitigated. The book explains how the operating system works, its overall security architecture, and the security risks associated with it, as well as exploits, rootkits, and other payloads developed for it."

• The iPhone Wiki (started by geohot and maintained by volunteers) includes details on many jailbreaking tools and exploits. (If you're more interested in developing tweaks for jailbroken iOS instead of exploiting iOS, check out the iPhone Dev Wiki instead.)

• Check out this analysis of JailbreakMe 3.0 and the code for JailbreakMe 3.0.

Do I have to pay for any jailbreaking or unlocking software?

Do not believe websites that claim to be selling a jailbreak or unlock for any device, or to unlock devices that can't be unlocked using normal methods (such as ultrasn0w software, official carrier unlocks, or SIM interposers). They're just scamming you. If you end up paying for one of these, make sure to demand your money back by filing a PayPal or credit card dispute.

Real jailbreaking and unlocking software tools are available to download for free.

Can I put my device into DFU mode with a broken home button?

The simple answer is that you should get your device's home button repaired, and the same goes for a broken sleep button. You're probably going to need them again later.

If it's still under warranty you can take it to an Apple Store. If not, you can usually find a local iPhone repair shop to fix it for you for a reasonable price. If you're adventurous, you can buy a kit online for fixing it yourself.

If you really, really want to try

You may be able to force DFU mode (on most devices except iPad 2, iPad 3rd generation, iPhone 4S, iPhone 3G, iPhone 2G, or iPod touch 1st generation) - see this tip from MuscleNerd ("use an ipsw where you've copied applelogo*img3 over LLB*img3. You'll get bootrom dfu!") - but it's tricky to get working.

Here's an unofficial guide that may help. If you follow that guide, during the process you will get error 37 with your device going into DFU mode. To get past this: unplug the device before clicking OK on the error, then click OK for error 37, and then click OK for error 168x too. (This is necessary because iTunes doesn't like that it can't see the device — if you click OK while the device is plugged in, iTunes will put the device in a weird mode and putting it into "Pwned DFU" mode will not work). Then close iTunes, open redsn0w, click Extras, and click "Pwned DFU".

Keep in mind that this isn't a great idea if you're going to use a tethered jailbreak, since every time the device reboots, you'll need to put it into DFU mode in order to boot tethered.

It's best to just get your buttons repaired.

Can I put Siri on my iPhone or iPod touch? Can I get some help with Spire?

To put Siri on your jailbroken iPhone or iPod touch, you must install a package called Spire from Cydia (on the default BigBoss repository) and you must also have access to an iPhone 4S so that you can set up a Siri proxy. Without a Siri proxy, Spire will do nothing. Also keep in mind that Spire is not compatible with iOS 5.1.

Before asking questions about Siri or Spire, please first read these two posts from the developer of Spire: Introducing Spire and Spire Proxy "FAQ". This unofficial Spire tutorial and another unofficial Spire tutorial may also be helpful.

Please also read all the recent JailbreakQA threads tagged with "spire" to see if somebody has already asked your question. For example, having Spire installed may cause issues on your device including slowness and apps crashing; see those threads for some help with this.

Be cautious with public Siri proxies - they may be able to see any personal data you send through Siri (watch this video). Also, many sites offering paid Siri proxies are scams; if you run into one of those, make sure to file a dispute to get your money back (via the payment method you used, such as PayPal or your credit card). We don't know where to find reliable Siri proxy services, so don't ask us. :)

I'm considering jailbreaking, but what are any downsides I should know about, from legality to warranty to security?

Is jailbreaking legal?

We aren't lawyers, so we can't tell you for sure, but jailbreaking certainly seems to be legal. There is one law in the United States, the Digital Millenium Copyright Act (DMCA), which has an "anti-tampering" clause that states that if there is a protection mechanism on a piece of software, a user is not allowed to bypass that protection. Jailbreaking may fall under that clause, but the law is intended to prevent copyright violations, and jailbreaking itself is not a copyright violation. And the Library of Congress approved a DMCA exemption in 2010 for jailbreaking and unlocking cell phones, including the iPhone. Each DMCA exemption lasts for only three years, and people are advocating for getting this exemption renewed and expanded for another three years. If you are outside the United States, your country probably doesn't have any anti-tampering laws similar to the DMCA, so you may be fine too, but we don't have encyclopedic knowledge of international law. Keep in mind that if you are pirating things, that is copyright infringement, which is illegal in most places.

Does jailbreaking void my device's warranty?

Apple says that they "may deny service for an iPhone, iPad, or iPod touch that has installed any unauthorized software," but jailbreaking is easily reversible, so you can go back to authorized-software-only whenever you want to. In other words, when you jailbreak your device, it is no longer eligible for Apple support if something goes wrong - but you can always restore the device to remove the jailbreak and then take the device into Apple for support, since a restored device has no evidence that it was previously jailbroken. To restore a device, connect it to your computer, sync to make a full backup, press Restore in iTunes to wipe the device, and load your backup again when prompted. All your App Store apps and the information in them will be preserved as usual. In some cases trying to restore a device with iTunes can give you errors, but you can fix iTunes restore errors.

If you choose to take the extra step of unofficially unlocking your iPhone 3G or 3GS using the iPad baseband so that you can use the phone on a different carrier, this is a permanent upgrade that permanently voids the device's warranty. You can restore it using custom firmware to remove the jailbreak, but the altered baseband will be obvious to Apple if you take it into a store for support.

Can I still use the App Store after jailbreaking?

Yes, you can still use the App Store normally to purchase apps, install updates to purchased apps, reinstall purchased apps on a restored device, etc.

Can jailbreaking damage my device?

Jailbreaking cannot put your device into a permanently "bricked" state. Jailbreaking affects only the software level of your device, so if anything goes wrong, you can always connect your device to iTunes and "restore" from a recently-synced backup. Restoring completely wipes the device's software, including the jailbreak, and gives you a normal device again. In some cases trying to restore a device with iTunes can give you errors, but you can fix iTunes restore errors.

If you choose to take the extra step of unofficially unlocking your iPhone 3GS using the iPad baseband so that you can use the phone on a different carrier, this can cause permanent damage if your iPhone 3GS is too new to be compatible with the iPad baseband.

Does jailbreaking cause instability or battery drain?

Jailbreaking itself generally does not cause problems. But you have full access to your jailbroken device, which gives you the power to install software that can cause instability and battery drain. If you're careful to install well-reviewed, popularly-recommended packages by reputable developers from legitimate repositories, you probably won't run into much trouble with crashes or increased battery usage. You do have to be willing to do a bit of research and troubleshooting though, since you're taking control and responsibility for your device and can install things that cause issues. (We can also try to help you if something goes wrong that you can't figure out how to solve.) Here's a guide to concerns about post-jailbreaking battery usage.

Does jailbreaking make my device less secure?

comex wrote a good summary in this discussion:

Although a jailbreak theoretically weakens some of iOS's built in security measures, most of them are still in place, and I've never heard of a non-trivial iOS exploit ever being used maliciously. However, a lot of people install SSH and then just leave the default password - alpine. In that case, anyone who can open a TCP connection to your device can trivially pwn it.

When you have Cydia on your device, scroll down a bit on the Cydia homepage to find a guide to OpenSSH and changing your root password. If you don't want to install OpenSSH, you don't really have to change your root password, but it's not a bad idea to change it anyway.

Having a jailbroken device is similar to having administrator power on your desktop computer: you have full freedom to install bad stuff on your computer, but you already know to stay away from installing dubious browser toolbars and sketchy email attachments - instead, you choose to install legitimate software from reputable developers. Use the same reasonable caution when installing software on your jailbroken device. It's generally a good idea to stick to installing software from the default repositories in Cydia (BigBoss, Cydia/Telesphoreo, ModMyi, and ZodTTD/MacCiti), only adding additional repositories if you really trust those additional repositories.

Does jailbreaking upgrade my firmware and/or delete my existing data?

See this answer for details.

Can I use iTunes to update iOS on a jailbroken device?

Updating iOS on a jailbroken device will work just fine, but it will remove your jailbreak. Make sure the new iOS version has a jailbreak available for your device before you update (so that you can jailbreak it again), and follow these steps to update iOS, jailbreak again, and easily reinstall your Cydia packages.

Can jailbreaking a factory-unlocked iPhone cause the phone to get locked?

Factory-unlocked (officially-unlocked) iPhones are permanently unlocked. Jailbreaking won't affect the carrier lock status of the iPhone; you can jailbreak it normally.

How do I begin theming with Winterboard?

For background on what Winterboard is and how it works, read saurik's original article: iPhone Theming on WinterBoard.

To begin theming:

1. You will need a graphic manipulation program like GIMP (free) or Photoshop (paid). A lot of artists prefer Photoshop, and there's a free 30-day trial available on Adobe's website if you don't already have it.

2. You will need some skill with your program of choice and some creativity.

3. You will need Winterboard and OpenSSH from Cydia, and an SSH client for your computer.

4. You will need time and dedication.

5. You will need the default image files to use as reference material while building your theme.
   
   The main ones you'll need are under /System/Library/Frameworks/, /System/Library/PrivateFrameworks/, and /System/Library/CoreServices/SpringBoard.app/, and for non App Store icons (these aren't auto-skinned) you get the icons from /Applications/.
   
   These image files are usually optimized, which means they'll show up as invisible until you de-optimize them. The easy way: Download iPhonePNGApp for Mac or FixPNG for Windows. The hard way: If you have the iPhone SDK installed, you can use this command to de-optimize them: /Developer/Platforms/iPhoneOS.platform/Developer/usr/bin/pngcrush -revert-iphone-optimizations
   
   You can grab UIImages by opening up Winterboard, tapping "Advanced (For Themers)", and using the "Record UIImages" option.

Optional: Get a theme from Cydia to study a theme's file structure.

Theming basically involves changing images from the artworks, uploading them to your device via SSH, and using WinterBoard to theme them.

Also never steal images; being original is the best way to go. :)

The best method to use is trial and error to see if you like what you've done or not, also don't forget to save PSD's, as Photoshop loves to crash, and people may accuse you of stealing images so you'll need to be able to show your PSD's as proof.

Once you are done with your theme, you submit it to a repository in Cydia (such as MacCiti, ModMyi, or BigBoss) and hope for the best!

If you would like to sell your theme on Cydia, you must have a W9 form (USA residents) or a W8-BEN form (Non-USA residents).

Happy theming!

What are the correct steps for upgrading my jailbroken device and easily reinstalling my Cydia packages?

You have to restore and jailbreak again, so here's a series of steps for making this process as easy as possible. (OTA updates don't work on jailbroken devices.) Before restoring, always check first to make sure the new iOS version is jailbreakable on your device.

1. Do a full sync and backup of your device with iTunes, making sure you're saving all your contacts and photos, etc. (especially if you have iTunes set to not sync something). Most people have iTunes set up to automatically sync and backup their devices, but to make sure you have a backup, you can right-click (or control-click) your device in iTunes' Devices list and click "Back Up".

2. Make a list of your Cydia packages. You can write this down by hand, or use AppInfo to email yourself a list of your installed packages and sources so that you remember which ones to reinstall after restoring. (Technically you can use AptBackup, PkgBackup, or a similar tool to backup your tweaks, but this isn't a great idea if you're upgrading all the way from iOS 4 to iOS 5 due to potential package incompatibilities. See this guide to using Cydia backup tools.)

3. Restore with iTunes, which will update your device to the latest version of iOS available (or if you're interested in restoring to a version of iOS that isn't the latest version available, see this guide to using SHSH). If you're just doing a normal update, it's very recommended to click "Restore", not "Update", for best disk space results. If you need to preserve your unofficially unlocked or unlockable iPhone baseband (including 6.15.00), you need to use custom firmware instead of a normal iTunes restore (the guide to using SHSH also includes building custom firmware, so you're OK if you need to do both). If you have a factory-unlocked iPhone, you don't have to worry about preserving the baseband, but it's harmless to do so.

4. iTunes will ask if you want to load your backup onto your device or "set up as new". Most of the time, loading your backup will work just fine and is convenient. (Most of your jailbreak tweaks store settings in your iTunes backup, so loading a backup also reduces the amount of time it'll take you to configure your tweaks after reinstalling them.) But once in a while people end up with problems caused by bad settings from the old backup; if you use the backup option and end up with problems, you can always restore again and choose "set up as new" and then sync over your media and apps. (If the "restore from backup" option isn't available and you use Gevey SIM, see this thread for suggestions.)

5. Jailbreak and reinstall your Cydia packages using the method you selected in Step 2.

(If you use any tweaks/extensions that use IconSupport, such as Infinifolders or FolderEnhancer, your previous icon layout will be restored after reinstalling those extensions.)

Why aren't my Winterboard themes working on iOS 5?

Winterboard is compatible with iOS 5.0 and later (you don't need to install any "fix" packages and you shouldn't), but many themes aren't compatible with iOS 5 yet, so they'll seem to have no effect, or only a partial effect.

If you have a favorite iOS 4 theme that doesn't seem to be completely working on iOS 5, you might be interested in trying to edit it yourself to make it work. Here's one method for modifying an iOS 4 icon theme to work better with iOS 5:

Access the device's filesystem. I use a SFTP client (Transmit), but you can use iFile, SSH, iExplorer, Phone Disk, or another method.

Go to /Library/Themes, go to your theme's folder, and go to Bundles. Then:

• In "com.apple.mobilemail", rename "icon@2x.png" to "Icon@2x.png".
• In "com.apple.mobileipod", rename "icon-AudioPlayer@2x.png" to "icon@2x.png".
• In "com.atebits.Tweetie2", rename "Icon@2x.png" to "Icon-production@2x.png".

For other apps, you can find updated icon names by going to the app's folder (in /Applications/ or /User/Applications/) and rummaging around inside.

The Calendar icon also looked weird on iOS 5, so I edited Info.plist until it looked right (it's just CSS, which you probably already know if you've built or customized web pages before).

For interface file name updates, browse through this thread for tips.

To learn about how to create your own themes, see these tips for making Winterboard themes.

How can I purchase Cydia Store products without having a debit or credit card?

Amazon Payments options

If you're in the United States or Canada, you can buy a prepaid Visa gift card (such as Vanilla Visa) and link it to an Amazon account. On Vanilla Visa cards, there is a $5 activation fee and a minimum of $20 needed on the card at the time of activation, but you can add as much money as you'd like. Vanilla Visa cards can be found at most 7-11's and many convenience stores.

Unfortunately buying Amazon gift cards won't work for buying Cydia Store products - those gift cards are only good for buying things on Amazon, not for buying things using Amazon Payments.

PayPal options

You can add funds to a PayPal account using a bank account or through buying a prepaid card at a store. Similar to Vanilla Visa, prepaid MoneyPak cards have a $5 fee and let you put a minimum of $20 on them.

How can I find out whether a tweak is compatible with iOS 5?

For many tweaks, their pages in Cydia include compatibility notes. If a tweak page in Cydia doesn't seem to include information about compatibility, check to see if the page has a link to a "recent changes" or "recent updates" page that might give you clues about whether the package has been updated for iOS 5 or even updated recently at all.

If the tweak page contains no information about compatibility, you can try asking here to see if we know anything.

For unofficial user-reported information about tweak compatibility, you can also check this spreadsheet, although it's probably not quite up-to-date since developers release updates every day.