PwnStrap

Required files:

• Your PwnageTool cooked 4.1 firmware.

  If you don't have one, don't ask us for one. It's not our fault when you die a slow and painful death.

• My unofficial Linux iRecovery for new Devices.
• GreenPois0n for Linux.

Automatic Procedure:

1. Place your device into Recovery Mode.

   While the phone is off, hold down the Home button and immediatly plug it into your computer. Or else.

2. In a command prompt, run ./irecovery -p Path/To/Firmware.ipsw
3. Follow the instructions.

   If you don't read the actual output from greenpois0n may the fleas of a thousand camels infest your private parts.

4. Restore your PwnageTool cooked firmware from iTunes.

Required files:

• Your PwnageTool cooked 4.1 firmware.

  If you don't have one, don't ask us for one. It's not our fault when you die a slow and painful death.

• My unofficial Windows iRecovery for new Devices.
• GreenPois0n for Windows.

Automatic Procedure:

1. Place your device into Recovery Mode.

   While the phone is off, hold down the Home button and immediatly plug it into your computer. Or else.

2. In a command prompt, run irecovery.exe -p Path\To\Firmware.ipsw
3. Follow the instructions.

   If you don't read the actual output from greenpois0n may the fleas of a thousand camels infest your private parts.

4. Restore your PwnageTool cooked firmware from iTunes.

Manual Procedure:

1. Put phone into Recovery mode (NOT DFU)

   While the phone is off, hold down the Home button and immediatly plug it into your computer. Or else.

2. From a command prompt (Start>Run>"cmd"), change to the directory where you extracted irecovery, and enter irecovery -s followed by:
   1. setenv boot-args 2
   2. setenv auto-boot false
   3. saveenv
   4. /exit

   Keep this window open for use later on!

3. Run greenpois0n - it will guide you to enter DFU mode, then it will stop on a white screen after you click "Jailbreak".

   It should say "Jailbreak Complete!" and NOT "Jailbreak Failed!" next to the progressbar at the bottom.

4. Extract the iBSS from your custom PwnageTool image (firmware.ispw/Firmware /dfu/iBSS.BoardID.RELEASE.dfu) into your irecovery folder.

   You can use WinRAR or another ZIP extractor to do this. IPSW files are really just ZIP files!

5. At a command prompt: irecovery -f iBSS

   iBSS should be replaced with the name of the iBSS that you just extracted from the pwnagetool image - ie iBSS.n88ap.RELEASE.dfu

6. At a command prompt: irecovery -s
   1. setenv boot-args 0
   2. saveenv
   3. go image decrypt 0x41000000
   4. go jump 0x41000040
   5. /exit

   At the "go jump" point your device should appear to reboot. Whether it goes back to a white screen or shows the Connect to iTunes screen depends on the firmware image used.

7. Restore your PwnageTool cooked firmware from iTunes.