The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "Redsn0w"
(Wip) |
m (link fixes) |
||
Line 8: | Line 8: | ||
Version 0.9 beta 3 was released for Windows and Mac OS X, and it allows iOS 3.0 through 3.1.2 to be jailbroken. It includes support for all devices except the [[n18ap|iPod touch 3G]], and supports a [[tethered jailbreak]] on [[n88ap|iPhone 3GS]] units and [[n72ap|iPod touch 2G]] units with new bootroms. In addition, this version supports custom boot and recovery mode logos, as well as verbose mode on bootup. |
Version 0.9 beta 3 was released for Windows and Mac OS X, and it allows iOS 3.0 through 3.1.2 to be jailbroken. It includes support for all devices except the [[n18ap|iPod touch 3G]], and supports a [[tethered jailbreak]] on [[n88ap|iPhone 3GS]] units and [[n72ap|iPod touch 2G]] units with new bootroms. In addition, this version supports custom boot and recovery mode logos, as well as verbose mode on bootup. |
||
− | Version [http://wikee.iphwn.org/howto:rs9 0.9.2] supports jailbreaking of all iDevices (at the time) with iOS 3.0 through 3.1.2 on Windows and Mac OS X, as well as 3.1.3 on [[S5L8900]] devices. Version 0.9.3 adds support of internet tethering IPCC hack on those devices and 0.9.4 allows jailbreaking of early [[ |
+ | Version [http://wikee.iphwn.org/howto:rs9 0.9.2] supports jailbreaking of all iDevices (at the time) with iOS 3.0 through 3.1.2 on Windows and Mac OS X, as well as 3.1.3 on [[S5L8900]] devices. Version 0.9.3 adds support of internet tethering IPCC hack on those devices and 0.9.4 allows jailbreaking of early [[n72ap|iPod touch 2G]] with iOS 3.1.3. |
Version [http://wikee.iphwn.org/howto:rsbeta 0.9.5b5-5] supports jailbreaking the [[n82ap|iPhone 3G]] and [[n72ap|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]]) with iOS 4.0 on Windows and Mac OS X. |
Version [http://wikee.iphwn.org/howto:rsbeta 0.9.5b5-5] supports jailbreaking the [[n82ap|iPhone 3G]] and [[n72ap|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]]) with iOS 4.0 on Windows and Mac OS X. |
||
Line 86: | Line 86: | ||
|} |
|} |
||
− | ===0.9.0-0.9.4 releases== |
+ | ===0.9.0-0.9.4 releases=== |
{| class="wikitable" width="100%" style="font-size:smaller;border-collapse:collapse;" border="1" |
{| class="wikitable" width="100%" style="font-size:smaller;border-collapse:collapse;" border="1" |
||
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Version |
! style="background-color:#E9E9E9;text-align:center;width:150px;" | Version |
||
Line 113: | Line 113: | ||
| {{yes}} |
| {{yes}} |
||
| |
| |
||
− | * Supports jailbreaking iOS 3.1.3 on [[ |
+ | * Supports jailbreaking iOS 3.1.3 on [[m68ap|iPhone 2G]], [[n82ap|iPhone 3G]], [[n45ap|iPod touch 1G]], [[n72ap|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]]) |
|- |
|- |
||
|} |
|} |
||
Line 129: | Line 129: | ||
| {{no}} |
| {{no}} |
||
| |
| |
||
− | * Supports jailbreaking iOS 4.0 on [[ |
+ | * Supports jailbreaking iOS 4.0 on [[n82ap|iPhone 3G]] and [[n72ap|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]]) |
|- |
|- |
||
! 0.9.5 beta 4 |
! 0.9.5 beta 4 |
||
Line 160: | Line 160: | ||
| {{yes}} |
| {{yes}} |
||
| |
| |
||
− | * Supports jailbreaking iOS 4.0-4.1 on [[ |
+ | * Supports jailbreaking iOS 4.0-4.1 on [[n82ap|iPhone 3G]] and [[n72ap|iPod touch 2G]] ([[tethered jailbreak|tethered]] on [[Bootrom 240.5.1|new bootrom]]) |
|- |
|- |
||
! 0.9.6 beta 2 |
! 0.9.6 beta 2 |
||
Line 167: | Line 167: | ||
| {{yes}} |
| {{yes}} |
||
| |
| |
||
− | * Supports jailbreaking iOS 3.2.2 and 4.0-4.1 on every device that supports those firmwares (except [[ |
+ | * Supports jailbreaking iOS 3.2.2 and 4.0-4.1 on every device that supports those firmwares (except [[n72ap|iPod touch 2G]] with [[Bootrom 240.5.1|new bootrom]]) . |
− | ** The [[ |
+ | ** The [[n82ap|iPhone 3G]], [[n72ap|iPod touch 2G]] ([[Bootrom 240.4|old bootrom]]), and [[n88ap|iPhone 3GS]] ([[Bootrom 359.3|old bootrom]]) can also have custom boot logos. |
* The Windows version also includes a function that permits users to restore to a custom [[IPSW File Format|IPSW]], akin to [[PwnageTool]]'s DFU button. |
* The Windows version also includes a function that permits users to restore to a custom [[IPSW File Format|IPSW]], akin to [[PwnageTool]]'s DFU button. |
||
|- |
|- |
||
Line 209: | Line 209: | ||
** -i <filename> to specify your reference IPSW |
** -i <filename> to specify your reference IPSW |
||
** -j to ask redsn0w to “Just boot now tethered for now” |
** -j to ask redsn0w to “Just boot now tethered for now” |
||
− | ** -o for [[ |
+ | ** -o for [[n88ap|iPhone 3GS]] and [[n72ap|iPod touch 2G]] units vulnerable to [[0x24000 Segment Overflow]]. |
|- |
|- |
||
! 0.9.6 release candidate 8 |
! 0.9.6 release candidate 8 |
||
Line 257: | Line 257: | ||
| |
| |
||
* Adds support for jailbreaking iOS 4.3.2 on all compatible devices except the [[iPad 2]]. |
* Adds support for jailbreaking iOS 4.3.2 on all compatible devices except the [[iPad 2]]. |
||
− | ** A bug existed that prevented the [[ |
+ | ** A bug existed that prevented the [[n90ap|iPhone 4 (GSM model)]] from being jailbroken on iOS 4.3.2. |
|- |
|- |
||
! 0.9.6 release candidate 14 |
! 0.9.6 release candidate 14 |
||
Line 264: | Line 264: | ||
| {{yes}} |
| {{yes}} |
||
| |
| |
||
− | * Fixes an issue that prevented the [[ |
+ | * Fixes an issue that prevented the [[n90ap|iPhone 4 (GSM model)]] from being jailbroken. |
|- |
|- |
||
! 0.9.6 release candidate 15 |
! 0.9.6 release candidate 15 |
||
Line 278: | Line 278: | ||
| {{yes}} |
| {{yes}} |
||
| |
| |
||
− | * Fixes the [[ |
+ | * Fixes the [[n88ap|iPhone 3GS]]/[[n90ap|iPhone 4 (GSM model)]] side switch vibration issue found in jailbroken installations of iOS 4.3.3. |
|- |
|- |
||
! 0.9.6 release candidate 17 |
! 0.9.6 release candidate 17 |
||
Line 292: | Line 292: | ||
| {{yes}} |
| {{yes}} |
||
| |
| |
||
− | * Adds support for jailbreaking iOS 4.2.8 on the [[ |
+ | * Adds support for jailbreaking iOS 4.2.8 on the [[n92ap|iPhone 4 (CDMA model)]]. |
|- |
|- |
||
! 0.9.6 release candidate 19 |
! 0.9.6 release candidate 19 |
||
Line 413: | Line 413: | ||
* Performs a [[tethered jailbreak]] of iOS 5.0 betas 1, 2, 3, 4, 5 and 6. |
* Performs a [[tethered jailbreak]] of iOS 5.0 betas 1, 2, 3, 4, 5 and 6. |
||
* Performs a [[tethered jailbreak]] of iOS 4.3.5 and 4.2.10 without pointing at an older IPSW. |
* Performs a [[tethered jailbreak]] of iOS 4.3.5 and 4.2.10 without pointing at an older IPSW. |
||
− | * Performs a [[tethered jailbreak]] of iOS 5.0 beta 6 on a new, silently changed (by Apple) [[ |
+ | * Performs a [[tethered jailbreak]] of iOS 5.0 beta 6 on a new, silently changed (by Apple) [[k48ap|iPad 1]] IPSW. |
− | * Fixes a bug in the 4.2.10 jailbreak on the [[ |
+ | * Fixes a bug in the 4.2.10 jailbreak on the [[n92ap|iPhone 4 CDMA]] [[tethered jailbreak]]. |
|- |
|- |
||
! 0.9.8 beta 7b |
! 0.9.8 beta 7b |
||
Line 425: | Line 425: | ||
* Performs a [[tethered jailbreak]] on [[iOS]] 5.0 beta 1-7 on all supported devices except the [[n88ap|iPhone 3GS]] (old bootrom) and [[iPad 2]] |
* Performs a [[tethered jailbreak]] on [[iOS]] 5.0 beta 1-7 on all supported devices except the [[n88ap|iPhone 3GS]] (old bootrom) and [[iPad 2]] |
||
* Performs an [[untethered jailbreak]] on [[n88ap|Phone 3GS]] (old bootrom) on [[iOS]] 4.1-4.3.5 and 5.0 beta 7 |
* Performs an [[untethered jailbreak]] on [[n88ap|Phone 3GS]] (old bootrom) on [[iOS]] 4.1-4.3.5 and 5.0 beta 7 |
||
− | * Fixed lingering issues with the [[ |
+ | * Fixed lingering issues with the [[n92ap|iPhone 4]] (CDMA Model) 4.2.10 [[tethered jailbreak]] |
|- |
|- |
||
! 0.9.8 beta 7c |
! 0.9.8 beta 7c |
||
Line 470: | Line 470: | ||
| |
| |
||
*Auto-detects the iOS 5.0 GM firmware now. |
*Auto-detects the iOS 5.0 GM firmware now. |
||
− | *Allows a jailbreak (albeit still tethered apart from [[iPhone 3GS]] [[Bootrom 359.3|old bootrom]]) on iOS5 GM |
+ | *Allows a jailbreak (albeit still tethered apart from [[n88ap|iPhone 3GS]] [[Bootrom 359.3|old bootrom]]) on iOS5 GM |
|- |
|- |
||
!0.9.9 beta 3a |
!0.9.9 beta 3a |
||
Line 676: | Line 676: | ||
| {{yes}} |
| {{yes}} |
||
| |
| |
||
− | * Newer devices ([[iPad 2]], [[iPad 3]], and [[ |
+ | * Newer devices ([[iPad 2]], [[iPad 3]], and [[n94ap|iPhone 4S]]) are able downgrade as well. In a radical departure from previous versions of [[redsn0w]], it now directly supports restoring [[IPSW File Format|IPSW]]s to your device. |
|- |
|- |
||
! 0.9.11 beta 2 |
! 0.9.11 beta 2 |
||
Line 683: | Line 683: | ||
| {{yes}} |
| {{yes}} |
||
| |
| |
||
− | * Adds support for downgrading to [[Telluride 9A406 (iPhone 4S)|iOS 5.0.1 build 9A406]] for the [[ |
+ | * Adds support for downgrading to [[Telluride 9A406 (iPhone 4S)|iOS 5.0.1 build 9A406]] for the [[n94ap|iPhone 4S]]. |
|- |
|- |
||
! 0.9.11 beta 3 |
! 0.9.11 beta 3 |
||
Line 823: | Line 823: | ||
== Exploits used == |
== Exploits used == |
||
− | For [[ |
+ | For [[m68ap|iPhone]], [[n45ap|iPod touch]], and [[n82ap|iPhone 3G]]: |
*[[Pwnage]] |
*[[Pwnage]] |
||
*[[Pwnage 2.0]] |
*[[Pwnage 2.0]] |
||
− | For [[ |
+ | For [[n72ap|iPod touch 2G]]: |
*[[0x24000 Segment Overflow]] |
*[[0x24000 Segment Overflow]] |
||
*[[ARM7 Go]] - used to upload the oversized [[LLB]] required to utilize the 0x24000 Segment Overflow. |
*[[ARM7 Go]] - used to upload the oversized [[LLB]] required to utilize the 0x24000 Segment Overflow. |
||
*[[usb_control_msg(0xA1, 1) Exploit]] - used (in redsn0w 0.9.6 beta 1) to upload the oversized [[LLB]] to utilize the 0x24000 Segment Overflow, as well as a [[tethered jailbreak]] on units with the [[Bootrom 240.5.1|new bootrom]]. |
*[[usb_control_msg(0xA1, 1) Exploit]] - used (in redsn0w 0.9.6 beta 1) to upload the oversized [[LLB]] to utilize the 0x24000 Segment Overflow, as well as a [[tethered jailbreak]] on units with the [[Bootrom 240.5.1|new bootrom]]. |
||
− | For [[ |
+ | For [[n88ap|iPhone 3GS]]: |
*[[0x24000 Segment Overflow]] |
*[[0x24000 Segment Overflow]] |
||
*[[iBoot Environment Variable Overflow]] - Exploit has a different implementation from [[User:geohot|geohot]]'s implementation in [[purplera1n]]. |
*[[iBoot Environment Variable Overflow]] - Exploit has a different implementation from [[User:geohot|geohot]]'s implementation in [[purplera1n]]. |
||
Line 838: | Line 838: | ||
*[[limera1n]] exploit |
*[[limera1n]] exploit |
||
− | For [[ |
+ | For [[n18ap|iPod touch 3G]]: |
*[[usb_control_msg(0x21, 2) Exploit]] |
*[[usb_control_msg(0x21, 2) Exploit]] |
||
*[[limera1n]] exploit |
*[[limera1n]] exploit |
||
− | For [[iPhone 4]], [[ |
+ | For [[iPhone 4]], [[n81ap|iPod touch 4G]], [[k48ap|iPad]] and [[k66ap|Apple TV 2G]]: |
*[[limera1n]] exploit |
*[[limera1n]] exploit |
||
<!-- |
<!-- |
Revision as of 18:34, 27 November 2012
redsn0w is an iDevice jailbreaking tool for OS X and Windows. Originally called QuickPwn, but due to exploitation of the name by www.quickpwn.com
, version 0.7 was renamed to redsn0w and added unlocking of supported devices.
Version 0.8 added support for jailbreaking the iPhone 3GS.
Version 0.9 beta 3 was released for Windows and Mac OS X, and it allows iOS 3.0 through 3.1.2 to be jailbroken. It includes support for all devices except the iPod touch 3G, and supports a tethered jailbreak on iPhone 3GS units and iPod touch 2G units with new bootroms. In addition, this version supports custom boot and recovery mode logos, as well as verbose mode on bootup.
Version 0.9.2 supports jailbreaking of all iDevices (at the time) with iOS 3.0 through 3.1.2 on Windows and Mac OS X, as well as 3.1.3 on S5L8900 devices. Version 0.9.3 adds support of internet tethering IPCC hack on those devices and 0.9.4 allows jailbreaking of early iPod touch 2G with iOS 3.1.3.
Version 0.9.5b5-5 supports jailbreaking the iPhone 3G and iPod touch 2G (old bootrom) with iOS 4.0 on Windows and Mac OS X.
Version 0.9.6b6 supports jailbreaking iOS 3.2.2, 4.1, and 4.2.1 for every device that supports those versions (except Apple TV 2G), on Windows and Mac OS X.
Version 0.9.10b1 adds support for iOS 4.2.6 through 5.0.1 (though iOS 4.2.9, 4.2.10, 4.3.4, 4.3.5, and 5.0 are tethered on devices invulnerable to the 0x24000 Segment Overflow). The current build of redsn0w is not capable of jailbreaking S5L8940 devices.
Credit
Versions
Initial releases
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
Lite | Unknown | Yes | Yes |
|
0.3 | Unknown | Yes | Yes |
|
0.7.x series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.7 | Unknown | Yes | Yes |
|
0.7.1 | Unknown | Yes | Yes | Bug fixes for versions 0.7 |
0.7.2 | Unknown | Yes | Yes |
0.8.x series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.8 | July 2009 | Yes | Yes |
|
0.9.0-0.9.4 releases
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.9.2 | Unknown | Yes | Yes |
|
0.9.3 | Unknown | Yes | Yes |
|
0.9.4 | Unknown | Yes | Yes |
|
0.9.5 series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.9.5 beta 3 | June 21, 2010 | Yes | No |
|
0.9.5 beta 4 | Unknown | Yes | No |
|
0.9.5 beta 5 | Unknown | Yes | No |
|
0.9.6 series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.9.6 beta 1 | September 21, 2010 | Yes | Yes |
|
0.9.6 beta 2 | October 31, 2010 | Yes | Yes |
|
0.9.6 beta 3 | November 2010 | Yes | Yes |
|
0.9.6 beta 4 | November 23, 2010 | Yes | Yes |
|
0.9.6 beta 5 | November 28, 2010 | Yes | Yes |
|
0.9.6 beta 6 | December 1, 2010 | Yes | Yes |
|
0.9.6 release candidate 7 | January 2, 2011 | Yes | Yes |
|
0.9.6 release candidate 8 | January 5, 2011 | Yes | Yes |
|
0.9.6 release candidate 9 | April 3, 2011 | Yes | Yes |
|
0.9.6 release candidate 10 | April 7, 2011 | Yes | Yes |
|
0.9.6 release candidate 11 | April 7, 2011 | Yes | Yes |
|
0.9.6 release candidate 12 | April 8, 2011 | Yes | Yes |
|
0.9.6 release candidate 13 | April 19, 2011 | Yes | Yes |
|
0.9.6 release candidate 14 | April 19, 2011 | Yes | Yes |
|
0.9.6 release candidate 15 | May 06, 2011 | Yes | Yes |
|
0.9.6 release candidate 16 | May 16, 2011 | Yes | Yes |
|
0.9.6 release candidate 17 | May 20, 2011 | Yes | Yes |
|
0.9.6 release candidate 18 | June 14, 2011 | Yes | Yes |
|
0.9.6 release candidate 19 | July 12, 2011 | Yes | Yes |
|
0.9.7 series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.9.7 beta 1 | December 26, 2010 | Yes | No |
|
0.9.7 beta 2 | December 26, 2010 | Yes | No |
|
0.9.7 beta 3 | December 27, 2010 | Yes | No |
|
0.9.7 beta 4 | December 31, 2010 | Yes | No |
|
0.9.7 beta 5 | January 8, 2011 | Yes | No |
|
0.9.7 beta 6 | January 10, 2011 | Yes | No |
|
0.9.8 series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.9.8 beta 1 | June 10, 2011 | Yes | Yes |
|
0.9.8 beta 2 | July 11, 2011 | Yes | Yes |
|
0.9.8 beta 3 | July 16, 2011 | Yes | Yes |
|
0.9.8 beta 4 | July 23, 2011 | Yes | Yes |
|
0.9.8 beta 5 | August 9, 2011 | Yes | Yes |
|
0.9.8 beta 6 | August 23, 2011 | Yes | Yes |
|
0.9.8 beta 7 | August 31, 2011 | Yes | Yes |
|
0.9.8 beta 7b | September 2, 2011 | Yes | Yes |
|
0.9.8 beta 7c | September 6, 2011 | Yes | Yes |
|
0.9.9 series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.9.9 beta 1 | September 19, 2011 | Yes | Yes |
|
0.9.9 beta 2 | October 4, 2011 | Yes | Yes |
|
0.9.9 beta 3 | October 5, 2011 | Yes | Yes |
|
0.9.9 beta 3a | October 5, 2011 | No | Yes |
|
0.9.9 beta 4 | October 12, 2011 | Yes | Yes |
|
0.9.9 beta 5 | October 13, 2011 | Yes | No |
|
0.9.9 beta 6 | October 18, 2011 | Yes | Yes |
|
0.9.9 beta 7 | October 21, 2011 | Yes | Yes |
|
0.9.9 beta 8 | November 3, 2011 | Yes | Yes |
|
0.9.9 beta 9 | December 19, 2011 | Yes | Yes |
|
0.9.9 beta 9b | December 19, 2011 | Yes | Yes |
|
0.9.9 beta 9c | December 19, 2011 | No | Yes |
|
0.9.9 beta 9d | December 20, 2011 | Yes | Yes |
|
0.9.10 series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.9.10 beta 1 | December 27, 2011 | Yes | Yes |
|
0.9.10 beta 2 | December 27, 2011 | Yes | Yes |
|
0.9.10 beta 3 | December 28, 2011 | Yes | Yes |
|
0.9.10 beta 3 novcheck | December 29, 2011 | No | Yes |
|
0.9.10 beta 4 | January 15, 2012 | Yes | Yes |
|
0.9.10 beta 5 | January 29, 2012 | Yes | Yes |
|
0.9.10 beta 5b | February 1, 2012 | Yes | Yes |
|
0.9.10 beta 5c | February 12, 2012 | Yes | Yes |
|
0.9.10 beta 6 | March 7, 2012 | Yes | Yes |
|
0.9.10 beta 6b | March 11, 2012 | Yes | No |
|
0.9.10 beta 7 | April 20, 2012 | Yes | Yes |
|
0.9.10 beta 8 | April 23, 2012 | Yes | Yes |
|
0.9.10 beta 8b | April 23, 2012 | Yes | Yes |
|
0.9.11 series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.9.11 beta 1 | May 11, 2012 | Yes | Yes | |
0.9.11 beta 2 | May 12, 2012 | Yes | Yes |
|
0.9.11 beta 3 | May 14, 2012 | Yes | Yes |
|
0.9.11 beta 4 | May 14, 2012 | Yes | Yes |
|
0.9.12 series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.9.12 beta 1 | June 4, 2012 | Yes | Yes |
|
0.9.12 beta 2 | June 8, 2012 | Yes | Yes |
|
0.9.13 series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.9.13 developer-only 1 | 2012/06/14 | Yes | Yes |
|
0.9.13 developer-only 2 | 2012/06/15 | Yes | Yes |
|
0.9.13 developer-only 3 | 2012/06/16 | Yes | Yes |
|
0.9.13 developer-only 4 | 2012/??/?? | Yes | Yes |
|
0.9.14 series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes |
---|---|---|---|---|
0.9.14 beta 1 | 2012/06/18 | Yes | Yes |
|
0.9.14 beta 2 | 2012/07/04 | Yes | Yes |
|
0.9.15 series
Version | Release date | Mac OS X-compatible? | Windows-compatible? | Changes | |
---|---|---|---|---|---|
0.9.15 beta 1 | 2012/10/14 | Yes | Yes |
| |
0.9.15 beta 2 | 2012/10/15 | Yes | Yes |
| |
0.9.15 beta 3 | 2012/11/01 | Yes | Yes |
|
Exploits used
For iPhone, iPod touch, and iPhone 3G:
For iPod touch 2G:
- 0x24000 Segment Overflow
- ARM7 Go - used to upload the oversized LLB required to utilize the 0x24000 Segment Overflow.
- usb_control_msg(0xA1, 1) Exploit - used (in redsn0w 0.9.6 beta 1) to upload the oversized LLB to utilize the 0x24000 Segment Overflow, as well as a tethered jailbreak on units with the new bootrom.
For iPhone 3GS:
- 0x24000 Segment Overflow
- iBoot Environment Variable Overflow - Exploit has a different implementation from geohot's implementation in purplera1n.
- usb_control_msg(0x21, 2) Exploit
- limera1n exploit
For iPod touch 3G:
For iPhone 4, iPod touch 4G, iPad and Apple TV 2G:
- limera1n exploit