cmw has released a beta version of Winpwn 2.5. The guide can be found here.

NOTE: The software is still beta, so use it at your own risk.

I have a package that enables Rogers WAP $7.00 package like the USA T-Zones package but I need a tester that is in Canada. Here are the requirements of such a tester:

1) Knows how to use SSH and can type in a command that I give them without questions.
2) Has Rogers and orders rogers WAP and can verify that it is actually active on the SIM card.
3) Has iPhone OS 2.0 or later on a jailbroken iPhone.

If you believe you fit these criteria and are interested in helping out, please drop me an email.

As we are working on categories for 2.0, I would like to replace all the icons I provide with some that make more sense. Therefore, I am asking for artists that wish to be part of the project to come forth and provide some icons that they would like included. For those that don’t know, categories is an app that provides folders on your springboard. Things like: games, apps, misc, settings, docs, internet, speed dial might make good categories. Here are my favorite icons to give you an example.

Notice the folder theme. Anyways, if anyone would like to contibute some icons please just make them around 60×60 png files (57×57 I think is standard size) and email me a zip of them here.

Planetbeing wrote an outstanding post on the simularities and differences on pwnage, quickpwn, and ziphone. It is a very interesting read. The original post was here but you can read it here as well (posted with permission).

Similarities
Jailbreak

Both utilities jailbreak.

Payload medium

Primary jailbreak payload is placed into iPhone memory for both jailbreaks

Differences
Technique

ZiPhone uses, as the root filesystem device, a pseudo-device that provides a window to an arbitrary section of memory. This memory is not allocated or otherwise reserved by the operating system and hence will be used by other random processes in other random ways and will become more and more corrupted with every CPU clock cycle. The only safe way to use this is to mlock all memory used by the jailbreak binary as soon as possible, and then use data previously uploaded to flash. Anything else will cause either the jailbreak binary to crash at random moments or cause random data to be written to flash. I am not sure why Zibri elected not to implement ZiPhone in a safer fashion.

QuickPwn uses the same mechanism that Apple uses to send its update ramdisk. This memory is both allocated and reserved. It will not crash at random moments, or give you repeating BSD root errors. This is the way the XNU kernel is designed to use ramdisks.

Longevity

ZiPhone hinges on a BUG in iBoot that was quickly fixed by Apple.

QuickPwn uses an iBoot FEATURE that Apple cannot remove without rewriting their own software and undergoing lengthy QA. Even if Apple did change the architecture, it would be straight-forward to simply mimic what they do and adapt to it. The reason QuickPwn can do this is because it relies on a hardware exploit to bootstrap into this phase. Apple cannot fix this problem without changing the manufactured hardware.

Elegance

ZiPhone modifies an existing Apple ramdisk and ships it as a complete set.

QuickPwn contains all-original code and features a very tiny bootstrapper that allows it to use libraries and code that’s already on the iPhone.

Not only does ZiPhone’s distribution of Apple’s binaries violate copyright laws, it also takes up a large portion of room on the ramdisk that could be used for the payload. Keeping its existing algorithm, ZiPhone would never have been able to install Cydia, for example. The maximum feasible ramdisk size is 32 MB; Cydia takes 13 and Apple’s library take up a significant amount. With some work, Zibri could possibly make it just under the 32 MB limit, but with the large number of files in Cydia, and the large size of the corruptible area of memory, corruption would be inevitable.

Some history / A personal note
Zibri claims to have “invented the ramdisk jailbreak”. Even if this were true, it would have as much relevance to QuickPwn as the 1.0.2 jailbreak does: The techniques used are entirely dissimilar. Not a single step in the process is the same.

However, this is not even true. Before Zibri left, we already had a prototype ramdisk jailbreak in our SVN (which Zibri later leaked parts of). It was written by myself and stored under the very obvious name of “ramdisk-jb” and it contained a modified version of a launchd written by Turbo (who should be considered the father of the ramdisk payload). It basically untarred a SSH installation onto the rootfs. It was rudimentary, and required a lot of work to get up to production standards.

While it’s obvious that Zibri has picked every bone of that SVN repository clean, I am puzzled why he did not learn from that example source code. It had mlock and it was written in proper C, unlike the rather make-do replacement of launchd with sh. Perhaps he did not understand the code.

A week before his release, we became aware that Zibri was going to write a ramdisk exploit. We considered racing him to it, but we were constrained by the fact that we had already publicized one working method of jailbreaking: The oft-loathed 1.1.3 soft-jailbreak, which we considered perfectly acceptable until the release of the SDK (we were not aware at the time the SDK release would take so long). In addition, 1.1.3 was a minor update and there was no reason people could not stay on 1.1.2 for awhile longer. The issue is that while a ramdisk jailbreak would certainly be easier and better, we would be burning this great exploit that allowed us to reliably decrypt ramdisks (which we had no other way of doing at the time).

Therefore, we chose not to build our own implementation and instead pursue Pwnage, a longer term project. It was ironic months later that Zibri came to flame us out about releasing the dual-boot method, accusing us of burning the exploit. It was amusing because it was so much lower value than the ramdisk exploit, which he was responsible for burning and really had no future prospects because of pwnagetool.

We are aware that the dual-boot method was the last remaining bit of non-public knowledge from our SVN that he had, and my belief was that the flame was caused by his soreness at losing his last chance at remaining relevant after the pmd (”ramdisk”) vulnerability was patched.

T-Mobile changed their T-Zones IP address causing everyone’s T-Zones to stop working. Thanks to help from DR03, I have fixed this and posted a new T-Zones hack for iPhone OS 2.0. All you T-Mobile users still on 1.1.x, It’s time to upgrade. I don’t plan to release a fix for iPhone 1.1.x at this time. You can update easily following one of our many guides.

For 1.1.x users that really don’t want to upgrade, you can fix proxy.pac yourself but editing the file /var/preferences/proxy.pac and changing “10.0.0.0″ to “25.0.0.0″. (The 2.0 version is a bit more flexible allowing addresses from both 10.* and 25.* to both be covered.

Quickpwn v1.50 is out. Download it here. The updates adds a youtube fix and bootneuter option to unlock the 2g.  I will test this late tomorrow when I get home from vacation. Refer to the quickpwn guide for assistance using the tool.

Pwnage v2.0.3 is out to support v2.0.2 firmwares on OSX. The guide is the same but the firmware support is expanded. You can download it via sparkle (the internal update system in pwnage). Or you can grab it off theiphoneproject.org here.

This version supports fw 2 .0.2, contains for installer 4 b6, and adds support for a bunch of .de language localizations. If you need a guide you can use our guide here.

Right. So everyone is plenty excited to update to 2.0.2 to fix all those nasty bugs in 2.0 and 2.0.1 right? Well don’t bother. As far as I can tell it fixes nothing… unless you are on a 3g.

Before I say any more, I will say that the 3g baseband update to 2.08 provided me with a significant increase in signal bars for EDGE. I still cannot get 3g in my office, but my EDGE went from 2 bars to 5. If you have a 3g device, I suspect this, alone, is worth the update. Note though, the baseband update will probably neuter your ability to unlock with the upcoming unlocker from the dev team. Other benefit noted is that 3g to EDGE fallback now can occur without losing service which is nice if you’re on a call and it switches during you call.

Now then. The official release notes for the 2.0.2 firmware says “bug fixes”. So what bugs are fixed?

Reports on the internet say these bugs are fixed:

Sync time: Sync time with appstore apps takes forever. And I mean in the range of 1-2 hours. Anyways, this is not changed on 2.0.  The sync time is stll horrible.

Stability: So far, 2.0.2 has crashed for me more times than 2.0 and 2.0.1 combined. In fact, the device managed to crash just sitting idle doing nothing! I mean literally the iPhone was in the dock and a few minutes later, apple logo and rebooting. App crashes have actually increased since the update. I have two devices updated and both exhibit the same behavior. If you are looking for increased stability, stay 2.0.2 does not provide it.

Contacts Lag: I never saw contacts lag in the first place and I still don’t see it now. Perhaps that is because I’m a hermit and don’t have enough contacts :)

Signal Bars: Ok significant gain due to 2.08 baseband for 3g. If you have a 2g, you do not get a baseband update and there will be no change here. This means if you were unlocked on 2g you will still be after the upgrade. When pwnage comes out, upgrading with pwnage will disable the baseband update (most likely) and you will not benefit from this.  I am not sure if I get 3g from more locations around town or not though. I will take my iPhone out for a drive and test it. Update: I actually do get 3g more than I did on 2.0.1, but the same as I got on 2.0. 2.0.1 really was horrible for the 3g baseband.

AppStore / Cydia Lag: This is the most ridiculous bug and it’s still not fixed. Want to reproduce it easily? Install “Platinum Sudoku” followed by “Super Monkey Ball” and good luck ever installing anything from Cydia or AppStore again. It’s not as bad if you avoid the above two app installs, but it still is a pain in the back side. This is still not fixed. Our only hope is that Saurik can neuter this in Winterboard/ Mobile Substrate.

Mail Sync: As always, my mail crashed after I restored my backup just like 2.0, 2.01 etc. I can’t believe Apple would allow this problem to continue. Anyways, BossPrefs ‘fix user dir permission’ solves the problem. I guess it’s another example how the hacking community managed to fix one of Apple’s bugs. For those that don’t jailbreak? Well, I guess you can’t restore your backup.

Good news for you windows users! Quickpwn for 2.0.2 is out. You can download it here. This is the GUI version. You can use my quickpwn GUI guide here for this.  Remember, this does not activate or unlock. So, you only want to use this if you are able to run 2.0.2 and already have phone service with your sim. For those that need more such as an unlock, you should wait for the full pwnage before moving to 2.0.2.

A few points to remind everyone:

1) This is for those that already updated to 2.0.2. It does not provide you with 2.0.2 as part of the process.

2) You can get 2.0.2 firmwares from my firmware page here.

3) If you’re having problems with the DFU steps, refer to my DFU page here.

4) Custom firmwares cannot be used with this process. It works differently. Where pwnage will allow you to create a firmware, pwn your device, then restore that firmware, this process will only pwn your phone and allow you to do so without a restore.

 While you can now always see the latest updates on the site using our latest apps WebApp, I’ll call out some highlights here.

New version of bitesms (v2.1) is out. With some decent features:

• As per the Apple SMS application, biteSMS now provides the [Add to Contacts] feature.
• Fixed up truncation of long SMS conversations when displayed in the conversation bubbles.
• Improved the rendering of conversation bubbles, such that text does not appear squashed.
• When composing, we now hide the keyboard if you tap above the compose text box. This lets you have a better look at the conversation.
• Fixed issue whereby some users would be presented with a white screen and biteSMS would not start properly.

AppBackup is out. This will backup your Appstore apps settings so that if you have to restore your apps you can. This is useful for reinstalling your apps on your iPhone. But if you restore, your backups, too will be gone unless you SSH them off of there.

Lockdown v3.0 is out with a lot of improvements. If you need to be able to lock certain apps with a password so you can hand your phone off to someone else for a bit, this is the app for you.

Scrobble is the first iPhone 2.0 Scrobbler app without the ridiculous restrictions Apple imposes on the SDK submitters. This app will sit in the background listening to what songs you listen to and scrobble them onto the last.fm servers.

For those of you that like quickpwn but want a GUI, there is one now. Here is a guide on how to use it. Before getting started, understand who this is for.

Who should use this tool? This is for those that are not planning to restore. It’s not clear what the activation state is after the process therefore, I only recommend this for those that have a contract carrier or an unlocked phone already. This is also perfect for those that pwned and did not install Cydia as it will result in Cydia being installed. If you are on a 2g and need to unlock, you can do so with bootneuter, but this will not activate for you. If you are on a stock device and using AT&T or a contract carrier, this is the perfect jailbreak for you. You will not lose your contacts or have to do any backups. Finally, if you are going to restore anyway, especially if you need to unlock a 2g, you may as well use winpwn or such.

Step 1: Download quickpwn gui and extract it. For this guide, we will use c:\quickpwn.

Step 2: Load iTunes and make sure it sees your phone. Leave iTunes running and do not touch it again.

Step 3: Download the proper firmware image (see firmwares page here for firmware of your choice). Save this image in the same folder with the quickpwn.exe file. For our example we will use c:\quickpwn. Your folder should now look like this:

Step 4: Launch quickpwn GUI.

Step 5: Select your device and hit the arrow at the bottom of the window.

Step 6: Click Browse

Get to your c:\quickpwn folder and select your firmware.

It should show you this when you are done:

Click the Blue arrow

Step 7: At the next screen, you are prompted to choose Cydia and Installer. Both are selected by default. You must select Cydia or your jailbreak will be useless. Installer is not a replacement for Cydia, is not ready, and has almost no packages. In addition, there is still a huge buglist in installer. In short, choose Cydia. This shouldn’t even be a choice. Select Cydia. Select installer if you want to but don’t forget Cydia. Note, you can also select to replace your bootlogos here if you wish.

Step 8: Click “Go”

Step 9: Wait. You will see some stuff go by on the screen:

Then you will be prompted to turn off your phone and press enter when you have done so:

Step 10) As it says on screen, turn off your phone by holding power, sliding to power off, and waiting for it to power off. Do not take the phone off the pc connection! If you do, you must start over.

Note: If you are being asked “Is your iPhone/iPod connected to your computer via USB” it is because you did not load iTunes and let it see your phone before starting. At this point it’s too late and you must start start back at step 8.

Step 11) In this next step we need to get our phone into DFU mode so it can be pwned. If you have any problems following the onscreen instructions, then refer to this DFU guide. The program will help you through the steps but it often takes multiple attempts to get into DFU mode. And, if you fail to get into DFU mode, the app quits and you must start over at step 8.

Therefore, I recommend that you get into DFU mode before hitting ENTER. Read the DFU guide link and press enter when you are in DFU mode. Then ignore the directions on the screen until it recognizes your phone is in DFU mode. When you are in DFU mode, the app should automatically take over and you will see this:

Wait a bit for the process to finish, and congratulations! You are done.

Step 12) Optional 2g phone only. If you need to unlock your phone, install bootneuter from Cydia and run it! Select “neuter, unlock, do not change bootloader settings, and then flash!”.

iPhone firmware 2.0.2 is out. But as always, do not update until we get word on a jailbreak. You can get the firmware files from our firmware links here.  The changelog officially only says “Bug Fixes”.

A nice little treat from the dev team tonight for Windows users. This app is called quick pwn. It’s in its beta stages. But it will allow you to pwn your device very quickly without restoring! This should eliminate many of those 160x errors many windows users are experiencing. Note: you do not need to do this if you already have a working, pwned 2.0.1 device. (Note: to see this guide in German, you can use this link).

Who should use this tool? This is for those that are not planning to restore. It’s not clear what the activation state is after the process therefore, I only recommend this for those that have a contract carrier or an unlocked phone already. This is also perfect for those that pwned and did not install Cydia as it will result in Cydia being installed. If you are on a 2g and need to unlock, you can do so with bootneuter, but this will not activate for you. If you are on a stock device and using AT&T or a contract carrier, this is the perfect jailbreak for you. You will not lose your contacts or have to do any backups. Finally, if you are going to restore anyway, especially if you need to unlock a 2g, you may as well use winpwn or such.

Here are the steps to using the tool:

Step 1) Download the tool here and extract it to a folder such as c:\quickpwn.

Step 2)  Download the proper firmware image such as 2.0.1 3g or 2.0.1 2g. Save this image in the same folder with the quickpwn.exe file. For our example we will use c:\quickpwn. Your folder should now look like this:

Step 3) Optional. semi-advanced, and can be skipped! You can replace your boot images now if you want to.  Make sure you get proper files and name them properly. You must use logo.png and recovery.png and put them in the same folder overwriting the ones that are there. Note that there are many boot logos that are not valid. If you have any problems try using the default images.

Step 4) While the command  prompt will say “kill all itunes processes”, you must ignore this step. In fact, before you get started start iTunes and make sure your phone is recognized by it. Now, leave iTunes running but don’t touch it again.

Step 5) Hook your phone up to your PC and double click either  “iPhone 2G.bat”, “iPod touch.bat”, or “iPhone 3g.bat” depending on which device you have.

Step 6) You will see some stuff go by the screen like this:

Then you will be prompted to turn off your phone and press enter when you have done so:

Step 7) As it says on screen, turn off your phone by holding power, sliding to power off, and waiting for it to power off. Do not take the phone off the pc connection! If you do, you must start over.

Step 8) In this next step we need to get our phone into DFU mode so it can be pwned. If you have any problems following the onscreen instructions, then refer to this DFU guide. The program will help you through the steps but it often takes multiple attempts to get into DFU mode. And, if you fail to get into DFU mode, the app quits and you must start over.

Therefore, I recommend that you get into DFU mode before hitting ENTER. Read the DFU guide link and press enter when you are in DFU mode. Then ignore the directions on the screen until it recognizes your phone is in DFU mode. When you are in DFU mode, the app should automatically take over and you will see this:

Wait a bit for the process to finish, and congratulations! You are done.

Step 9) Optional 2g phone only. If you need to unlock your phone, install bootneuter from Cydia and run it! Select “neuter, unlock, do not change bootloader settings, and then flash!”.

Troubleshooting:

1) If during the process you did not kill iTunes you will see these questions:

Is your device connected to your computer via USB? Type “Y” to continue.
Is your iPhone currently powering on? Type “Y” to continue.

If you see these questions it means that your phone is not being recognized by the PC. Remember you must have iTunes running and it must see your device. If you have to, close and reopen iTunes, disconnect and reconnect your device, or even reboot your PC. You should not see the above two message as part of the process.

2) When you turn on your iPhone, it does not have any display.  Man, is it bricked?

This is probably caused by using an invalid boot image (logo.png) in the process. If you wait long enough the thing should boot up to springboard normally. In this state, you do not have any logo showing you the device is booting. You can fix it by repeating the process with a valid png file.

I updated BossPrefs today to version 2.12b. The changelog can be viewed in the link but one feature that is worth calling out. I added an apple killswitch neuter button. This will allow you to turn off Apple’s killswitch.