Tethered jailbreak with iRecovery

Hi,

Is it possible to boot(for tethered jailbreak) iPhone 3gs(359.3.2 boot rom) with iRecovery? Or some other tool that works on linux.

I'd need this for booting jailbroken iphone with new iBoot on linux after jailbraking with redsn0w or brackra1n.

Just the tethered boot not the whole jailbreak.


Cheers,
Kekec

There is a version of iRecovery that can send the USB mux exploit. I don't know if that is all that is required to kickstart the bootprocess.

Quote:

---

Originally Posted by Olethros

There is a version of iRecovery that can send the USB mux exploit. I don't know if that is all that is required to kickstart the bootprocess.

---

I had a look at iRecovery code and usb analyzer log for redsn0w.
Redsn0w does not do much(10-20calls), but i'm guessing i need an "exploit file" to send via irecovery?

Quote:

---

Originally Posted by kekec

I had a look at iRecovery code and usb analyzer log for redsn0w.
Redsn0w does not do much(10-20calls), but i'm guessing i need an "exploit file" to send via irecovery?

---

I assume you have looked at usb_control_msg(0x21, 2) Exploit - The iPhone Wiki

I would recommend you pop on IRC and ask around. There is a big "chat on irc" button at the top of this page.

Quote:

---

Originally Posted by Olethros

I assume you have looked at usb_control_msg(0x21, 2) Exploit - The iPhone Wiki

I would recommend you pop on IRC and ask around. There is a big "chat on irc" button at the top of this page.

---

Ok found it with a little RE.

$ irecovery -f payload.bin #payload.bin is the same as redsn0w uses
$ irecovery -k # the usb exploit
$ irecovery -c pwn
$ irecovery -c reboot.

Cross you fingers for 30s and it works.

I'm not sure if payload is dependant on phone serial etc. I'm guessing not, since the was not trafic on usb that would get any data from the phone except standard usb enumeration.

Note: irecovery was a posixninja fork from github
ps.: backra1n seems to send a lot of more data to boot ( but i guess this is to show Geohots photo durring bootup and is actualy not needed ).

Thanks for documenting this. Very useful to know for troubleshooting on any platform. I assume you can extracted payload.bin from within Redsn0w's application bundle.

Quote:

---

Originally Posted by Olethros

Thanks for documenting this. Very useful to know for troubleshooting on any platform. I assume you can extracted payload.bin from within Redsn0w's application bundle.

---

I got the payload from usb trace ( recorded with trial version of hhd usb monitor ).

I'm planing of making a keychainable dongle with this, so I can carry it with me. I'm just not sure if it's worth the trouble since there might be untenthered jailbreak coming along and 4.0 is also close.

Kekec

I am looking to fix an invalid node structure and need to run the the fsck command. Do you know how to send this command using iRecovery? If not is there another utility I can use?

Quote:

---

Originally Posted by redbullpower

I am looking to fix an invalid node structure and need to run the the fsck command. Do you know how to send this command using iRecovery? If not is there another utility I can use?

---

Sorry I can't help you with that. Is this a problem with iphone filesystem? iphone won't boot becouse of that?

Kekec

Yes it is a problem with the iPhone boot. I have so far only found iRecovery which can connect to the iphone in recovery mode. Apparently the fs commands in irecovery are locked until the exploit is run. I am not even sure if a fsck is available in the fs commands though. If I can use any tool while in recovery mode to send the command fsck_hfs -r /dev/diskr02s1 then it should fix the problem.