[TUT] Running unsigned code on the iPod Touch 2G

Discussion in 'Apple iOS' started by nickcas, Jan 25, 2009 with 11 replies and 2,047 views.

  1. nickcas

    nickcas Member

    Messages:
    1,688
    Ratings:
    805
    This method uses the 0wnboot payload by Chronic Dev to allow for running unsigned code. All credits go to him.


    This is for windows.

    You'll need the 0wnboot.bin payload for this, found here: You'll need the 0wnboot.bin payload for this, found here: [Click here to view the link]

    You'll also need a copy of the 2.1.1 firmware for this, to extract the ibss.dfu and iboot.img3 Open the entire firmware file in winrar, and extract the firmware folder and you'll find those files.

    Download the compiled version of irecovery for windows here: [Click here to view the link]

    (I couldn't get this irecovery to work in vista, maybe someone else can?)

    Code:
     
    
    [LIST=1]
    [*] Put device into DFU
    [*] Upload ibss.dfu (2.1.1 ibss.dfu - command: irecovery -f ibss.dfu)
    [*] Unplug device/replug (screen goes white)
    [*] Spawn a shell (irecovery -s)
    [*] Upload iboot.img3 (2.1.1 iboot  -  command: /sendfile iboot.img3)
    [*] Type 'go'
    [*] Type '/exit' then spawn another shell (command: irecovery -s)
    [*] Upload payload (command: /sendfile 0wnboot.bin)
    [*] Type 'arm7_go'
    [*] Type 'image list'
    [*]If you do not get a 'permission denied', and get an image list, payload succeeded.
    [/LIST]
    
    If your screen doesn't go white after step 3 then you did something wrong.



    I take NO liability if you mess up your ipod. If something does go wrong just restore it.


    Hopefully a jailbreak can come from this...


    EDIT: If you don't know what you're doing, just wait until a real jailbreak comes out.
     
    • Like Like x 1
  2. Hovi

    Hovi Aaron is forever my ***** Retired

    Messages:
    6,875
    Ratings:
    4,436
    This is technically a jailbreak, just much harder.
     
  3. OP
    nickcas

    nickcas Member

    Messages:
    1,688
    Ratings:
    805

    Well, almost. You'd still need to upload a patched ramdisk to the ipod, but I'm sure that will come out soon, because now the ramdisk can be unsigned.
     
  4. Hovi

    Hovi Aaron is forever my ***** Retired

    Messages:
    6,875
    Ratings:
    4,436
    Well i don't care how I jailbreak it, I just want it done
     
  5. Forgoten Dynasty

    Forgoten Dynasty Free Sosa #bangbang Premium

    Messages:
    5,901
    Ratings:
    2,476
    Id love to wright a detailed tutorial on this unfortunately im running on 2.2 so downgrading to 2.1.1 would require me to restore my ipod and all my songs/stuff is on a computer with a blown power supply so i dont really want to loose all my stuff.
    so i either need to fix my computer or they need to come out with a 2.2 patch both of witch i see to be highly unlikely:tongue:
    EDIT nvm i just found out it works on 2.2 should have a tut up tonight :smile:
    having some problems running the iRecovery on my windows version give me some time
     
  6. II WaStEdPrO II

    II WaStEdPrO II Member

    Messages:
    726
    Ratings:
    48
    After I do this...how would I run an unsigned code?? And an unsigned code can be like an app right??:?
     
  7. OP
    nickcas

    nickcas Member

    Messages:
    1,688
    Ratings:
    805
    I found another method for doing this, and it doesn't involve disconnecting the ipod. If you need help ask.

    @WastedPro: You can use all of the dev commands, which usually would say "Permission Denied", but you cannot run apps yet on your ipod unless you have patched a ramdisk and uploaded it to your ipod. That would techinally be a jailbreak, and it is possible.

    Don't try anything that you're not 100% sure won't brick your ipod. You can actually brick your ipod, to where a restore won't even fix it, so make sure you know what you're doing.


    @Forgoten: Try this if you get irecovery to work:
    Put device into DFU
    1. Upload ibss.dfu (2.1.1 ibss.dfu - command: irecovery -f ibss.dfu)
    2. Spawn a shell (irecovery -s)
    3. Upload iboot.img3 (2.1.1 iboot - command: /sendfile iboot.img3)
    4. Type '/exit' then spawn another shell (command: irecovery -s)
    5. Upload payload (command: /sendfile 0wnboot.bin)
    6. Type 'arm7_go'
    7. Type 'image list'
    If you don't get a "permissions denied" message than it worked.

    ^^By me I guess? lol I've never seen anyone do it this way but you'll get the same result.
     
  8. II WaStEdPrO II

    II WaStEdPrO II Member

    Messages:
    726
    Ratings:
    48
    So if i do this then i put an app on my ipod, i can play it?
    Im used to modding halo...not ipods:tongue:Also What is an DFU
     
  9. Forgoten Dynasty

    Forgoten Dynasty Free Sosa #bangbang Premium

    Messages:
    5,901
    Ratings:
    2,476
    DFU is basically recovery mode if you break your ipod beyond repair you put it in DFU mode to restore it
    what you want to do is plug your ipod in to your computer reboot it (home+sleep)
    then hold home while its rebooting and it will go in to DFU mode
     
  10. UKmonkey

    UKmonkey Getting There

    Messages:
    639
    Ratings:
    32
    Where can I get 2.1.1 and how would I make that the firmware instead of 2.2? Sorry first attempt eva
     
  11. OP
    nickcas

    nickcas Member

    Messages:
    1,688
    Ratings:
    805
  12. UKmonkey

    UKmonkey Getting There

    Messages:
    639
    Ratings:
    32