I figured making a tool would take a bit too long. So, i'm going to write up this tutorial. It isn't recommended for regular users.
**BEFORE PROCEEDING, ENSURE THAT YOU HAVE YOUR iPod/PHONE BACKED UP!**
THIS TUTORIAL ASSUMES YOU ARE ALREADY ON 3.1.2!
Q: Why not 3.1.3???
A: The exploit used is closed in 3.1.3 and beyond.
WHAT YOU WILL NEED:
* An iPhone 3G[S] or iPod Touch 2G MC or iPod Touch 3-- new bootrom
* 3.1.2 already installed or 3.1.2 installed via SHStarget="_blank"H blobs. <-- Broken blackra1n'd devices will work. (Especially if Spirit messed you up!).
* Payload Pwner-r5
* sn0wbreeze V1.7
* iBooty V1.5
* 3.1.2/4.0 firmware downloaded.
* iTunes 9.2 Installed
STEP A : Pwning iBoot
I : Download this easy tool here -- Payload Pwner-r5
// It will help you create the payload.
II : Extract it to a directory and run Pwner.exe
**SAVE THE PAYLOAD WHERE iBooty is.**
STEP B : Making a Custom IPSW
I : Download sn0wbreeze V1.7 from here -- sn0wbreeze V1.7
II : USE EXPERT MODE!
III : In General, Checkmark "Disable NOR Flash" <-- THIS IS ESSENTIAL!!!!
IV : Build it. It will be on your Desktop.
**CUSTOM BOOT LOGOS THAT ARE MADE IN sn0wbreeze WILL NOT WORK ON NEW BOOTROMS!**
*Mac Users : PwnageTool does not have this option. I don't think it will ever be in there. Use a Windows Virtual Machine or friends PC to create your firmware.*
STEP C: iBooty Prep.
Most of you know of the utility "iBooty" that I made for Aki_nG
It will work as long as you place all of the correct files there.
I : Download iBooty GUI here -- iBooty V1.4
and Extract it.
II : Extract your Custom IPSW created by sn0wbreeze with 7-Zip or another un-archiver.
III : Grab the kernelcache and bring it into the same folder as ibooty.
Also grab iBEC from the folder "Firmware\dfu".
Aswell as DeviceTree from the folder "Firmware\all_flash\all_flash.n88ap.production\Dev iceTree.n88ap".
* Rename your Kernel 4.0-Custom to "kernel.40"
* Rename your iBEC 4.0-Custom to "ibec.40"
* Rename your DeviceTree 4.0-Custom to "devtree.40"
***MAKE SURE YOU REMOVE THE .img3/.dfu/etc extensions!***
Your folder should look like this :
- iboot.payload <-- Created with Payload Pwner.
- devtree.40 <-- Grabbed from Custom IPSW made by sn0wbreeze.
- ibec.40 <-- Created with Payload Pwner.
- bspatch.exe <-- Comes with iBooty.
- iBooty.exe <-- Comes with iBooty.
- kernel.40 <-- Grab from Custom IPSW made by sn0wbreeze.
- sn0w.img3 <-- Comes with iBooty.
- wait.img3 <-- Comes with iBooty.
STEP D: Restoring to 4.0 + Booting
*MAKE SURE YOU ARE ON 3.1.2 WHEN DOING THIS*
I : Run iBooty and Select "Prepare Device for Custom Firmware". Run the Process and if you see the image, you can proceed!
II : Now open iTunes and restore to the custom ipsw.
***WHEN DONE, YOUR DEVICE WILL GO INTO RECOVERY MODE. IT WONT BOOT.***
STEP E : Booting
I : Just Re-Run iBooty and select "Boot It". If all goes well it will boot!