Preventing Baseband Update

Edit options.plist

1. Unpack custom IPSW
2. Decrypt Restore Ramdisk using xpwntool and mount it
3. Navigate to /usr/local/share/restore
4. Edit options.plist on the restore ramdisk

(Ignore any other settings specified in the plist, don't edit them)

	<key>UpdateBaseband</key>
        <false/>

5. Reencrypt the restore ramdisk
6. Repack the IPSW
7. Prepare device for custom firmware using redsn0w
8. Restore IPSW to iTunes in pwned DFU Mode using the appropriate method(Look at Restoring The Modified IPSW Section)

You must load a patched iBSS/iBEC for this to work. Using an original IPSW will not work, because redsn0w's pwned DFU Mode doesn't patch sigchecks in iBSS (which is loaded from the IPSW).

Restoring The Modified IPSW

Firmwares like 4.2.1 and above have baseband checks on the Restore Ramdisk.If the modified IPSW is restored, iTunes will give a Error 1015 and iPhone will be in a recovery mode loop which cannot be exited by TinyUmbrella or the 'setenv auto-boot true' command
Fortunately, the Update Ramdisk does not contain that baseband check so if the Update Method is used which is mentioned below,iTunes will give error 1013 and it can be exited by TinyUmbrella and the irecovery command.

Update Method

• Windows Users, Open iTunes. hold the Shift button and click Update then select the modified IPSW
• Mac Users, Open iTunes, hold the Alt button and click Update then select the modified IPSW

Restore Method

• Windows Users, Open iTunes. hold the Shift button and click Restore then select the modified IPSW
• Mac Users, Open iTunes, hold the Alt button and click Restore then select the modified IPSW

TinyUmbrella/Cydia Method (iPhone 4)

The iPhone 4 requires a AT+XNONCE key signature from Apple in order to update the baseband. Pointing the hosts file to Cydia Server or running TinyUmbrella will allow this request for signature to be ignored, thus preventing a baseband update.

• This only works if Cydia/TinyUmbrella accepts the firmware's SHSH.
• This method 'works' with iOS 4.2.1, but in the restore ramdisk there is a baseband version check. If it doesn't match, it will crash before the Apple logo with the loading bar (the 2nd one, not the restore one) appears. It will boot and crash again. The usual 'Kick out of recovery mode' methods or "setenv auto-boot true" won't work, because it's not the problem that the auto-boot is false. So this method is actually not useful for iOS 4.2.1.

1. Edit the hosts file and add the line "74.208.10.249 gs.apple.com" without the quotes, or run TinyUmbrella after saving the firmware's SHSH. If Cydia Server hasn't got your SHSH, but you have it locally, use TSS Server method in TinyUmbrella.
2. Use the "Restore" button in iTunes to update if your firmware version is below 4.2 else use the "Update" button in iTunes to update.
3. You will get Error 1013 and it can be easily bypassed by using the Exit Recovery Mode button in TinyUmbrella or typing 'setenv auto-boot true' and 'saveenv' in iRecovery

iH8Sn0w's Method

User IH8sn0w mentioned a new method in this tweet (an upgrade-only option in Sn0wbreeze). He confirmed that his method is not the same as the above mentioned methods. To get more details, someone would have to compare the generated ipsw content.

This method can also be used on the iPhone 3GS and the iPhone 4 to downgrade from the 4.3 betas back to 4.2.1, as long as the device can be restored (and activated) to iOS 4.1 or an earlier version.