Unlocking 1st generation iPhones (with 2.1 firmware)

intel Mac & PPC

Page 1 of 2

Updated: September 28, 2008





Who is this guide for?

• 1st generation iPhones (3.9 or 4.6 bootloaders)
Official contract, or not
• Pwned or not
• Any firmware version
• I used iTunes 8.0
• Make sure to Sync your iPhone prior to using this tutorial. This way your personal information, and any App Store applications will be preserved.

Thanks again go out to the iPhone Dev Team for providing this amazing, and FREE program for jailbreaking, activating, unlocking, and customizing the 1st generation iPhones. You can visit their website here.

I was already Pwned on 2.0.2 firmware. If you are not currently Pwned, you can still use this tutorial, just pay attention to the information in the bordered area, that will contain additional instructions for you. Also note, my iPhone was already unlocked as well.

BigBoss has compiled a FAQ for issues with firmwares 2.x here.

Step 1.

Download PwnageTool 2.1 from me here, or via the iPhone Dev Team's download link list here. You could also update PwnageTool to the latest version from within the program itself - once the iPhone Dev Team has added this to their servers for download.

Download the 3.9 and 4.6 bootloaders from the Internet. You'll have to find them yourself, I won't provide them.

If you haven't already downloaded 2.1 firmware from Apple, then you can download it here.

Step 2.

Install PwnageTool. Make sure to drag the program icon from the disk image into your Applications folder! Do not attempt to run the program from the disk image window, it will cause problems.

Step 3.

Launch PwnageTool. Make sure the Expert mode button in the top left corner is selected. Click the iPhone on the left.




You should get a green check mark on the iPhone you selected. Click the blue arrow button in the lower right corner.





PwnageTool will search for the 2.1 firmware on your computer first, then from the Internet. When it displays the firmware file, click on it, then click the blue arrow in the lower right corner.




You will be at this screen and have many choices you can make. Click on General. Then click the blue arrow at the bottom.




At the General Settings screen, if you are not using an authorized carrier, then check the box for Activate the phone. If it is not greyed out, then check the box for Enable baseband update. Check the box for Disable partition wipe-out. Click the blue arrow in the lower right corner.




At the Bootneuter settings screen, check Neuter bootloader, check Unlock baseband (only if you want to unlock - I checked this and I was already unlocked), then check Auto delete BootNeuter.app. Click the blue arrow in the lower right corner.




Based on Saurik's advice (the creator of Cydia), I ignore the the Cydia settings screen in PwnageTool. It is better to install any applications you need from Cydia directly. I've found problems when using this screen to automatically install programs. Just click the blue arrow in the lower right corner, to continue to the next screen.





At this screen click the blue arrow in the lower right corner.




At the Custom logos settings screen, you can choose to use the suggested images by leaving their boxes checked, or uncheck them and use the stock images. If you click on Browse... you can add your own images in their place. Click the blue arrow in the lower right corner when done.




Here is a template image you can use. It is 320 by 480 in size. It has a one pixel, transparent border on all sides. All you have to do is paste in your 318 by 478 image onto it and center it. Then just save the image with the transparency intact and your image will work. Make sure your saved image is 100kb or less.




Finally, click the Build button and the blue arrow in the lower right corner.

Note: Since I was already Pwned, the following instructions (within this bordered area) did not apply to me. They may apply to you, however. You will receive a pop up warning if the 3.9 version bootloader is not found. Answer No to this question. You will then be asked if you would like to browse for the bootloader. Answer Yes. Now navigate to where you saved the two bootloader files from Step 1. Select the BL-39.bin file and click Open. You will receive a pop up warning if the 4.6 version bootloader is not found. Answer No to this question. You will then be asked if you would like to browse for the bootloader. Answer Yes. Now navigate to where you saved the two bootloader files from Step 1. Select the BL-46.bin file and click Open.

Name your custom firmware file, and select where to save it.




You will now see this screen while your custom .ipsw is assembled. This stage is about four minutes long.




You will be prompted to enter your system password. There is nothing nefarious in this request, the reason it is asking is because it is creating your firmware and running commands as the root account (or superuser) on your computer. There are various processes where unmounting and mounting of a file systems is necessary. This is performed while using a system UID of 0 which causes the prompt for a system password. The root access is only for the creation of the ipsw file. So it's completely harmless.




You are then asked if your iPhone is CURRENTLY Pwned. I clicked Yes.




If you weren't already Pwned before, then you will receive instructions to put the iPhone into recovery (also referred to as restore) mode. This is NOT the same thing as DFU mode! At this point iTunes may launch, along with a pop up mesage, just move them out of the way at this point. This did not happen to me. Instead, I received this message.