Hack the iPhone

How to activate, jailbreak and unlock 1.1.4 firmware with PwnageTool
(3.9 / 4.6 bootloader)

intel Mac

Page 2 of 2

Step 5.

Click the IPSW Builder button. An options screen will appear. I checked the box "Enable baseband update" since I needed to unlock. Doing this auto checks the "Neuter bootloader" and "Unlock baseband" features. Click OK.




You can also click on the Custom Packages tab and select items to install. Here is a thread where people are compiling applications that can be added into PwnageTool to further expand what can be preinstalled on the iPhone with your custom firmware.




If you click the Custom Logos tab you can select to use the pictured images or use the stock images for the boot logo and the recovery logo (by unchecking the boxes), or you can supply your own custom graphics. When you've finished, click OK.




You will now be prompted to locate the 3.9 and 4.6 bootloader bin files. Download them here. Decompress the rar.









Click the Browse... buttons and navigate to each of the bootloader bin files, select them, and click Open.




When you've loaded both bootloaders you should get an OK confirmation. Click OK.




You can now name your custom firmware file. PwnageTool automatically adds the word "custom" to the original file name so you can tell it apart from your original ipsw. Click Save.




More text will appear in the status area of PwnageTool while your custom firmware is created.




During this process you will be prompted to enter your password.




The final bit of text will appear as the custom restore file is finalized. Close the PwnageTool once it has successfully completed. Your iPhone should still be in recovery mode (displaying the Steve Jobs graphic).

Step 6.

Launch iTunes and a pop up warning about recovery mode will appear.




iTunes will look like this. Hold down your Option key and click Restore.




Navigate to where you saved your custom firmware restore file. Select it, and click Open.




Various status messages will display while the process continues.




The pineapple will reappear with the progress wheel.




After iTunes finishes restoring, the iPhone will reboot. If you chose to install BootNeuter (necessary for unlocking), then it will automatically start and unload the CommCenter process.

In the future, should you run BootNeuter again it will automatically unload the CommCenter process (you will lose your cellular signal). All you have to do is press the Home button to exit BootNetuer. Wait about 20 seconds and CommCenter will restart on its own (and your cellular signal will be restored). You may have to reboot the iPhone as your system sounds may be very low.

Several messages will display at the bottom of the program while it runs. Don't touch anything. This process will take several minutes to complete.




The next messages to appear are: "Flashing bootloader - do not interrupt!", "The bootloader was successfully flashed. Now flashing baseband." and "The bootloader and baseband were successfully flashed."

This is the final configuration of my BootNeuter program before it rebooted the iPhone.




The iPhone will reboot. You will then be at the SpringBoard with the Edit Home Screen pop up. Notice that BootNeuter and Installer are both installed already.

So you want to run PwnageTool again on the same iPhone you just unlocked?

I unlocked my iPhone with PwnageTool version 1. When the new version (1.1) arrived and allowed you to use custom boot and recovery graphics, I had to have this. So what do you do when you are already Pwned and unlocked? Simple.

Step 7.

Put your iPhone in restore mode (not DFU) by plugging it in to your Mac, and holding the Sleep/Wake and Home buttons until the Apple logo (or the pineapple if you chose this image instead) appears (about 20 seconds). Release the Sleep/Wake button, and continue holding the Home button until the connect to iTunes graphic (or the Steve Jobs image if you chose this instead) is displayed.





Click the Browse .ipsw button.




A file browser window will open. Navigate to where your 1.1.4 ipsw file is. Select it, and click Open.




You should see similar output in a few seconds.




Click IPSW Builder. In the General tab I selected Activate phone only.




In the Custom Logos tab I added my two images. Click OK.




Here's my custom boot logo. Go ahead, take it. It's the correct size and format. If you'd like to see some other custom boot and recovery graphics check out this page, and this thread.




At this point, just follow through the same process as described earlier. When it's done, reflash this new custom firmware back to the iPhone and you are done. My iPhone was still unlocked. It still worked on T-Mobile just fine.