Hack the iPhone

How to add or delete ringtones with WinSCP

(Windows XP / Vista)

Thanks to the iPhone Elite Dev Team's new method, we can now easily add ringtones to the iPhone running 1.1.1 firmware. This tutorial is based on their published method.

Managing ringtones on the iPhone is very easy to do. You don't have to pay money to make your own ringtones from your favorite songs. I have a tutorial here that will teach you how to edit a ringtone with a free program. You can then use this tutorial to learn how to install them onto the iPhone and how to remove them. You can even remove all the preinstalled ringtones if you want (except Marimba).

Attention

I'm assuming you already know how to jailbreak an iPhone and how to use WinSCP. Follow my tutorials under the "Start here" button to learn how. Note: if you haven't already unlocked your iPhone using my Step 1 tutorial, I will be creating a simplified jailbreak guide.

This method involves patching an Apple system file. I will NOT provide this patched file to you, but I will show you how to edit it. If you go to the iPhone Elite Dev Team's site there is a link to an already patched file there.

Step 1.

Launch WinSCP and log into your iPhone. Navigate to the /System/Library/Frameworks/MeCCA.framework/ folder on the iPhone. You want to copy the file, oddly name MeCCA to your computer. You might want to get used to putting files into your phonedmg folder, but put it anywhere you can find it. You can just drag it to the folder. Click "Copy".




I put mine in my phonedmg folder, and then I made a copy of it.

Step 2.

Download a free copy of XVI32 here. This is a hex editing program. It allows you top open a program (kind of like you would a text document) and edit it. You need to be very careful with what you type, and where you type it or you will corrupt this file. Once you edit this file, you won't have to again. I highly recommend once you have finished that you save this modified file some place safe. If you ever restore your iPhone, this file will get replaced with a stock file which won't work with custom ringtones. Launch the program and click "File", "Open...", select your file and click "Open" again. Here is what the file looks like.




The first thing you want to do is click "Tools" and select "Overwrite".




These are the instructions for editing the offsets in the MeCCA file, published by the iPhone Elite Dev Team. They probably look like gibberish to you right now, but I'm going to explain what all these numbers and letters mean.

00014458: 05 06
0001445C: 6C 03
0001445D: 10 30
0001445E: 9F 43
0001445F: E5 E0
00014462: 8F 50
00014463: E0 E5
00014464: 6D 20
00014465: 28 00
00014466: 03 51
00014467: EB E3
00014468: 00 02
0001446A: 50 00
0001446B: E3 0A
0001446C: 01 03
0001446D: 30 10
0001446E: A0 90
0001446F: 03 E5
00014470: 00 72
00014472: 00 51
00014473: 0A E3
00014474: 00 01
00014477: E3 03

Let's look at the first line. It says: 00014458: 05 06. What this means is, go to offset 00014458 in the MeCCA file, and change the byte pair that is stored there from 05 to 06. Ok, so counting the lines above, you have 23 offsets to go to. And 23 byte pairs to change. Piece of cake.

Go to XVI32 and click "Address" then select "Go to...".




Click the "hexadecimal" button and the "absolute" button. Now enter the number 00014458 in the text box and click "OK".




You will now be taken to this offset. Notice the blue square on the 05? That is the offset for 00014458. How do I know that's the offset? I'll give you the simplest way of determing that without teaching you how to count in hex. Look at the bottom of the screen. It says "Adr. hex: 14458". So now you can use the arrow keys to move arround the screen to find the rest off the offsets. They all come after the offset you are at now. Every offset you need to edit for this hack are all contained in this screen shot so it will be easy to get them all. In fact, you only need to use the right arrow key to get to them.




Let's go back to that blue square now. The instructions say to change "05" to "06". So type 06 and it will overwrite the 05 that's there now. The blue cursor will automatically move to the next byte pair. Notice the "Adr. hex:" has incremented by one.




Now just use the right arrow key to move over to the next address: 0001445C. The blue cursor should now be on the "6C". Just type "03". Repeat until you are done. When you finish, click "File" and then "Save" and it will overwrite the existing file with all your changes.

Step 3.

Go back to WinSCP and overwrite the MeCCA file on the iPhone with the one you just edited. Click "Copy" at the prompt. Click "Yes at the next prompt.




Restart the iPhone.

Step 4.

Find a file you want to use as a ringtone. Make sure it is in m4a format. If your ringtone isn't in this format, you can use iTunes to convert it. Next rename the ringtone so that there is a space just before the period. Make sure it has m4r as the extension.




Go back to WinSCP and navigate to the /Library/Ringtones folder on the iPhone. Then copy your ringtone over.




Press "Settings", "Sounds" then press "Ringtone" and you'll see the file was added. Here's my before and after.




If you want to delete a ringtone, just right click the file and click the "F8 Delete" button in WinSCP. I got rid of all my stock ringtones because I don't like any of them. Marimba is on the ROM so you can't get rid of it, unfortunately.




I synced my iPhone and my ringtone survived.