Redsn0w

redsn0w on Mac OS X

redsn0w was originally called QuickPwn but due to the theft and exploitation of the name, QuickPWN by quickpwn.com, as of iOS 3.0, QuickPwn was discontinued and redsn0w (at the time, version 0.7) was converted into a jailbreaking tool for all current devices as well as providing unlock support the iPhone 2G. As of version 0.8, the iPhone 3GS can also be jailbroken through redsn0w.

Version 0.9 beta 3 was released for Windows and Mac OS X, and it allows iOS 3.0 through 3.1.2 to be jailbroken. It includes support for all devices except the iPod touch 3G, and supports a tethered jailbreak on iPhone 3GS units and iPod touch 2G units with new bootroms. In addition, this version supports custom boot and recovery mode logos, as well as verbose mode on bootup.

Version 0.9.2 supports jailbreaking of all iDevices (at the time) with iOS 3.0 through 3.1.2 on Windows and Mac OS X, as well as 3.1.3 on S5L8900 devices. Version 0.9.3 adds support of internet tethering IPCC hack on those devices and 0.9.4 allows jailbreaking of early iPod touch 2G with iOS 3.1.3.

Version 0.9.5b5-5 supports jailbreaking the iPhone 3G and iPod touch 2G (old bootrom) with iOS 4.0 on Windows and Mac OS X.

Version 0.9.6b6 supports jailbreaking iOS 3.2.2, 4.1, and 4.2.1 for every device that supports those versions (except Apple TV 2G), on Windows and Mac OS X.

Version 0.9.10b1 adds support for iOS 4.2.6 through 5.0.1 (though iOS 4.2.9, 4.2.10, 4.3.4, 4.3.5, and 5.0 are tethered on devices invulnerable to the 0x24000 Segment Overflow). The current build of redsn0w is not capable of jailbreaking S5L8940 devices.

Credit

iPhone Dev Team

Versions

Initial Release and updates until 0.8

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
Lite	Unknown	Yes	Yes	Tethered jailbreak for iPod touch 2G on iOS 2.1.1 with ARM7 Go
0.3	Unknown	Yes	Yes	Untethered Jailbreak for the iPod touch 2G on iOS 2.2.1 with ARM7 Go and 0x24000 Segment Overflow
0.7	Unknown	Yes	Yes	Untethered jailbreak for all devices but iPhone 3GS
0.7.1-0.7.2	Unknown	Yes	Yes	Bug fixes for versions 0.7
0.8	July 2009	Yes	Yes	Performs an untethered jailbreak on iOS 3.0/3.0.1 (when pointed at 3.0) for all devices supported by those firmware.

First 0.9.x releases

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.2	Unknown	Yes	Yes	Supports 3.0-3.1.2 on all iPhones and iPod touches (tethered for newer devices with 0x24000 Segment Overflow closed)
0.9.3	Unknown	Yes	Yes	Contains the IPCC hack to enable tethering on the iPhone 3G and 3GS.
0.9.4	Unknown	Yes	Yes	Supports jailbreaking iOS 3.1.3 on iPhone 2G, iPhone 3G, iPod touch 1G, iPod touch 2G (old bootrom)

0.9.5 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.5 beta 3	June 21, 2010	Yes	No	Supports jailbreaking iOS 4.0 on iPhone 3G and iPod touch 2G (old bootrom)
0.9.5 beta 4	Unknown	Yes	No	Resolved a problem with iBooks.
0.9.5 beta 5	Unknown	Yes	No	Supposed to fix any APN or MMS issues that users were seeing.

0.9.6 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.6 beta 1	September 21, 2010	Yes	Yes	Supports jailbreaking iOS 4.0-4.1 on iPhone 3G and iPod touch 2G (tethered on new bootrom)
0.9.6 beta 2	October 31, 2010	Yes	Yes	Supports jailbreaking iOS 3.2.2 and 4.0-4.1 on every device that supports those firmwares (except iPod touch 2G with new bootrom) . The iPhone 3G, iPod touch 2G (old bootrom), and iPhone 3GS (old bootrom) can also have custom boot logos. The Windows version also includes a function that permits users to restore to a custom IPSW, akin to PwnageTool's DFU button.
0.9.6 beta 3	November 2010	Yes	Yes	Supports the installation of custom bundles
0.9.6 beta 4	November 23, 2010	Yes	Yes	Jailbreaks iOS 4.1-4.2.1 on all compatible devices. Tethered jailbreak on devices that are not vulnerable to Pwnage 2.0 or 0x24000 Segment Overflow.
0.9.6 beta 5	November 28, 2010	Yes	Yes	Can update the baseband on the X-Gold 608 to 6.15.00, allowing the reuse of the AT+XAPP Vulnerability
0.9.6 beta 6	December 1, 2010	Yes	Yes	Allows you to "deactivate" a hacktivated phone, so sbinger's Subscriber Artificial Module (SAM) can trick your iPhone and iTunes into creating legitimate activation tickets.
0.9.6 release candidate 7	January 2, 2011	Yes	Yes	Introduced command-line arguments to bypass some screens. -b <filename> to specify your own boot logo PNG -i <filename> to specify your reference IPSW -j to ask redsn0w to “Just boot now tethered for now” -o for iPhone 3GS and iPod touch 2G units vulnerable to 0x24000 Segment Overflow.
0.9.6 release candidate 8	January 5, 2011	Yes	Yes	Informs users if a boot logo PNG is invalid, and why. Introduced the "-a" command-line argument to eliminate clicking.
0.9.6 release candidate 9	April 3, 2011	Yes	Yes	Adds support for jailbreaking iOS 4.3.1 on all compatible devices except the iPad 2 and Apple TV 2. New command line parameters k and d [1]: -k --kernelcache=<str> use specified kernelcache (advanced) -d --devicetree=<str> use specified devicetree (advanced)
0.9.6 release candidate 10	April 7, 2011	Yes	Yes	Added boot animations Removed misleading Settings
0.9.6 release candidate 11	April 7, 2011	Yes	Yes	Makes the boot animation a bit more robust
0.9.6 release candidate 12	April 8, 2011	Yes	Yes	Fix any lingering issues with the boot animation
0.9.6 release candidate 13	April 19, 2011	Yes	Yes	Adds support for jailbreaking iOS 4.3.2 on all compatible devices except the iPad 2. A bug existed that prevented the iPhone 4 (GSM model) from being jailbroken on iOS 4.3.2.
0.9.6 release candidate 14	April 19, 2011	Yes	Yes	Fixes an issue that prevented the iPhone 4 (GSM model) from being jailbroken.
0.9.6 release candidate 15	May 06, 2011	Yes	Yes	Adds support for jailbreaking iOS 4.3.3 on all compatible devices except the iPad 2.
0.9.6 release candidate 16	May 16, 2011	Yes	Yes	Fixes the iPhone 3GS/iPhone 4 (GSM model) side switch vibration issue found in jailbroken installations of iOS 4.3.3.
0.9.6 release candidate 17	May 20, 2011	Yes	Yes	Adds advanced command line options for kernel hackers.
0.9.6 release candidate 18	June 14, 2011	Yes	Yes	Adds support for jailbreaking iOS 4.2.8 on the iPhone 4 (CDMA model).
0.9.6 release candidate 19	July 12, 2011	Yes	Yes	When a custom bundle is applied, most of the normal jailbreak steps (like stashing and untethering) are skipped.

0.9.7 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.7 beta 1	December 26, 2010	Yes	No	Jailbreaks iOS 4.1-4.2.1 on all compatible devices. Able to achieve an untethered jailbreak on 4.2.1, provided the user has 4.2b3 SHSHs and the 4.2b3 IPSW. This version of "Jailbreak Monte" has quite a number of bugs, particularly app switcher crashes and disabled Bluetooth.
0.9.7 beta 2	December 26, 2010	Yes	No	Fixes crashing bugs on GUI apps.
0.9.7 beta 3	December 27, 2010	Yes	No	Fixes crashing bugs completely.
0.9.7 beta 4	December 31, 2010	Yes	No	ubsmuxd integrated.
0.9.7 beta 5	January 8, 2011	Yes	No	Issues related to Bluetooth and the sandbox are resolved.
0.9.7 beta 6	January 10, 2011	Yes	No	fixes Skype

0.9.8 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.8 beta 1	June 10, 2011	Yes	Yes	Performs a tethered jailbreak of iOS 5.0 betas 1 and 2 (when pointed at the beta 1 IPSW) on all compatible devices except the iPad 2.
0.9.8 beta 2	July 11, 2011	Yes	Yes	Performs a tethered jailbreak of iOS 5.0 betas 1, 2, and 3 on all compatible device except the iPad 2. Fixes the iOS 5 beta 3 sandbox issues present in the previous version.
0.9.8 beta 3	July 16, 2011	Yes	Yes	Performs a tethered jailbreak of iOS 4.3.4 and iOS 5.0 betas 1, 2, and 3.
0.9.8 beta 4	July 23, 2011	Yes	Yes	Performs a tethered jailbreak of iOS 5.0 betas 1, 2, 3, and 4.
0.9.8 beta 5	August 9, 2011	Yes	Yes	Performs a tethered jailbreak of iOS 5.0 betas 1, 2, 3, 4 and 5.
0.9.8 beta 6	August 23, 2011	Yes	Yes	Performs a tethered jailbreak of iOS 5.0 betas 1, 2, 3, 4, 5, and 6.
0.9.8 beta 7	August 31, 2011	Yes	Yes	Performs a tethered jailbreak of iOS 5.0 betas 1, 2, 3, 4, 5 and 6. Performs a tethered jailbreak of iOS 4.3.5 and 4.2.10 without pointing at an older IPSW. Performs a tethered jailbreak of iOS 5.0 beta 6 on a new, silently changed (by Apple) iPad 1 IPSW. Fixes a bug in the 4.2.10 jailbreak on the iPhone 4 CDMA tethered jailbreak.
0.9.8 beta 7b	September 2, 2011	Yes	Yes	Performs a tethered jailbreak for iOS 4.3.4, 4.3.5, 4.2.9, 4.2.10 on all supported devices except the iPhone 3GS (old bootrom) and the iPad 2 Performs an untethered jailbreak on iOS 4.1-4.3.3 on all supported devices except the iPad 2 Performs a tethered jailbreak on iOS 5.0 beta 1-7 on all supported devices except the iPhone 3GS (old bootrom) and iPad 2 Performs an untethered jailbreak on Phone 3GS (old bootrom) on iOS 4.1-4.3.5 and 5.0 beta 7 Fixed lingering issues with the iPhone 4 (CDMA Model) 4.2.10 tethered jailbreak
0.9.8 beta 7c	September 6, 2011	Yes	Yes	Same as 0.9.8 beta 7b on all devices but iPhone 3GS with 06.15.00 baseband Fixes error 1015 when restoring to stock 4.3.5 on iPhone 3GS with 06.15.00 baseband.

0.9.9 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.9 beta 1	September 19, 2011	Yes	Yes	Complete rewrite. No longer requires IPSWs when jailbreaking public builds. When jailbreaking beta/Golden master firmwares, need to specify IPSW once, then auto-recognizes it. Redsn0w now fetches SHSH from device, querys Cydia about saved blobs, stitches IPSWs with SHSH blobs (not for iPhones) and able to submit SHSH to cydia Includes Terminal shell commands into the GUI.
0.9.9 beta 2	October 4, 2011	Yes	Yes	Fixes Verizon iPhone 4 firmware detection Fixes 'Fix Recovery' Fixes for Stitching Fixes for blob processing
0.9.9 beta 3	October 5, 2011	Yes	Yes	Auto-detects the iOS 5.0 GM firmware now. Allows a jailbreak (albeit still tethered apart from iPhone 3GS old bootrom) on iOS5 GM
0.9.9 beta 3a	October 5, 2011	No	Yes	Fixes a Windows-only caching bug Allows Windows users to rename the redsn0w exe to anything containing 'boot' to jump straight to the tethered boot stage on load (thus adding one-click tethered boot to Windows redsn0w) 0.9.9 beta 3 still works fine for Mac users except they don't have the new 'boot' rename feature that this version has
0.9.9 beta 4	October 12, 2011	Yes	Yes	Now auto-recognizes iOS 5 and no longer requires IPSW submission on iOS 5 jailbreak
0.9.9 beta 5	October 13, 2011	Yes	No	Custom IPSW feature (from PwnageTool) for Baseband preservation.
0.9.9 beta 6	October 18, 2011	Yes	Yes	Fixes location services issues for iPhone 3GS with 06.15.00 baseband
0.9.9 beta 7	October 21, 2011	Yes	Yes	You can now choose whether you want redsn0w or Cydia to Stash Applications (can shorten redsn0w session by 60%)
0.9.9 beta 8	November 3, 2011	Yes	Yes	Jailbreaks iOS 5.0.1 beta 1 (9A402) tethered on devices vulnerable to limera1n exploit. Untethered on iPhone 3GS (old bootrom).
0.9.9 beta 9	December 19, 2011	Yes	Yes	Jailbreaks iOS 5.0.1 tethered on devices vulnerable to limera1n exploit. Untethered on iPhone 3GS (old bootrom). iBooks fix. Allows custom IPSW creation for iPhone 3GS (old bootrom) without SHSH blobs. Supports the 8 GB iPhone 4. Allows stitched IPSW creation for iOS 5.x. Allows stitched IPSW creation for GSM iPad 2s running iOS 4.3.x. Built-in version check.
0.9.9 beta 9b	December 19, 2011	Yes	Yes	Enables the “Custom” button in Windows to allow baseband preservation. Warns against flashing baseband 06.15.00 on newer iPhone 3GS devices (2011 week 35) more explicitly.
0.9.9 beta 9c	December 19, 2011	No	Yes	Special build for Windows users encountering issues with the update check.
0.9.9 beta 9d	December 20, 2011	Yes	Yes	Addresses a problem with the untethered jailbreak on iPhone 3GS (old bootrom) devices.

0.9.10 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.10 beta 1	December 27, 2011	Yes	Yes	The jailbreak for iOS 5.0.1 is now untethered.
0.9.10 beta 2	December 28, 2011	Yes	Yes	Fixes an issue with launchctl that the untether caused.
0.9.10 beta 3	?	Yes	Yes	Fixes a problem where re-running redsn0w over an existing jailbreak would cause Mobile Substrate-based apps to stop running until Mobile Substrate was installed again.
0.9.10 beta 3 novcheck	?	No	Yes	?
0.9.10 beta 4	January 15, 2012	Yes	Yes	Includes a fix for iBooks on iOS 5.0.1. Addresses an issue where the launchctl fix didn't work sometimes.
0.9.10 beta 5	January 29, 2012	Yes	Yes	Circumvents jailbreak detection in iBooks that caused ~10% of images to display properly.
0.9.10 beta 5b	February 1, 2012	Yes	Yes	Fixes an issue with custom ramdisks on the iPhone 3G and iPod touch 2G.
0.9.10 beta 5c	February 12, 2012	Yes	Yes	Prevents redsn0w from crashing due to increasing ramdisk sizes.
0.9.10 beta 6	March 7, 2012	Yes	Yes	Jailbreaks iOS 5.1 tethered on devices vulnerable to limera1n Exploit. Untethered on iPhone 3GS (old bootrom). Automatically detects MC model iPod touch 2G with pod2g's steaks4uce exploit.
0.9.10 beta 6b	March 11, 2012	Yes	No	Fixes small issues for Mac OS X v10.5.8 and earlier.
0.9.10 beta 7	April 20, 2012	Yes	Yes	Implements the Corona A5 jailbreak for iPhone 4S and iPad 2 devices still at 5.0.1 Can also re-install that jailbreak for those who accidentally uninstalled the untether When stitching an IPSW, it can now grab your blobs directly from Cydia. Now shows a lot more info about your device, for instance, whether your iPhone 3G has the vulnerable baseband bootloader, or whether your iPhone 3GS has the old exploitable bootrom
0.9.10 beta 8	April 23, 2012	Yes	Yes	Can backup those priceless activation tickets many are grabbing today Adds ability to backup arbitrary directories or files from your device into a ZIP file on your Mac or PC
0.9.10 beta 8b	April 23, 2012	Yes	Yes	Makes the ZIP files compatible with the native Windows Explorer.

0.9.11 series

Version	Release date	Mac OS X-compatible?	Windows-compatible?	Changes
0.9.11 beta 1	May 11, 2012	Yes	Yes	Starting with this version, those with newer devices (iPad 2, iPad 3, and iPhone 4S) can join the downgrade fun too. In a radical departure from previous versions of redsn0w, it now directly supports restoring IPSWs to your device. The first use of this new feature implements a hack that allows A5 downgrades without a bootrom-level exploit. We accidentally left out one of the two flavors ("9A406") of 5.0.1 for the iPhone 4S. It'll be in the next update.
0.9.11 beta 2	May 12, 2012	Yes	Yes	Adds support for that second "9A406" flavor of 5.0.1 for the iPhone 4S.
0.9.11 beta 3	May 14, 2012	Yes	Yes	should fix the spurious "Restore failed" messages people were sometimes getting, and it behaves better with nearby devices that have Wi-Fi syncing enabled
0.9.11 beta 4	May 14, 2012	Yes	Yes	completes the tethered JB support for 5.1.1 on A4 devices and earlier, including proper "Stitching" and "Custom" creation of NO_BB IPSWs

Exploits used

For iPhone, iPod touch, and iPhone 3G:

• Pwnage
• Pwnage 2.0

For iPod touch 2G:

• 0x24000 Segment Overflow
• ARM7 Go - used to upload the oversized LLB required to utilize the 0x24000 Segment Overflow.
• usb_control_msg(0xA1, 1) Exploit - used (in redsn0w 0.9.6 beta 1) to upload the oversized LLB to utilize the 0x24000 Segment Overflow, as well as a tethered jailbreak on units with the new bootrom.

For iPhone 3GS:

• 0x24000 Segment Overflow
• iBoot Environment Variable Overflow - Exploit has a different implementation from geohot's implementation in purplera1n.
• usb_control_msg(0x21, 2) Exploit
• limera1n exploit

For iPod touch 3G:

• usb_control_msg(0x21, 2) Exploit
• limera1n exploit

For iPhone 4, iPod touch 4G, iPad and Apple TV 2G:

• limera1n exploit

External Links

• iPhone Dev Team blog with redsn0w download information
• redsn0w beta infos (outdated)