Redsn0w

redsn0w on OS X

redsn0w is an iDevice jailbreaking tool for OS X and Windows. Originally called QuickPwn, but due to exploitation of the name by www.quickpwn.com, version 0.7 was renamed to redsn0w and added unlocking of supported devices.

Version 0.8 added support for jailbreaking the iPhone 3GS.

Version 0.9b3 was released for Windows and Mac OS X, and it allows iOS 3.0 through 3.1.2 to be jailbroken. It includes support for all devices except the iPod touch 3G, and supports a tethered jailbreak on iPhone 3GS units and iPod touch 2G units with new bootroms. In addition, this version supports custom boot and recovery mode logos, as well as verbose mode on bootup.

Version 0.9.2 supports jailbreaking of all iDevices (at the time) with iOS 3.0 through 3.1.2 on Windows and Mac OS X, as well as 3.1.3 on S5L8900 devices. Version 0.9.3 adds support of internet tethering IPCC hack on those devices and 0.9.4 allows jailbreaking of early iPod touch 2G with iOS 3.1.3.

Version 0.9.5b5-5 supports jailbreaking the iPhone 3G and iPod touch 2G (old bootrom) with iOS 4.0 on Windows and Mac OS X.

Version 0.9.6b6 supports jailbreaking iOS 3.2.2, 4.1, and 4.2.1 for every device that supports those versions (except Apple TV 2G), on Windows and Mac OS X.

Version 0.9.10b1 adds support for iOS 4.2.6 through 5.0.1 (though iOS 4.2.9, 4.2.10, 4.3.4, 4.3.5, and 5.0 are tethered on devices invulnerable to the 0x24000 Segment Overflow). This build of redsn0w is not capable of jailbreaking S5L8940 devices.

Credit

iPhone Dev Team

Versions

Initial releases

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
Lite	Unknown	Yes	Yes	Tethered jailbreak for iPod touch 2G on iOS 2.1.1 with ARM7 Go
0.3	Unknown	Yes	Yes	Untethered jailbreak for the iPod touch 2G on iOS 2.2.1 with ARM7 Go and 0x24000 Segment Overflow

0.7.x series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.7	Unknown	Yes	Yes	Untethered jailbreak for all devices but iPhone 3GS
0.7.1	Unknown	Yes	Yes	Bug fixes for versions 0.7
0.7.2	Unknown	Yes	Yes	Bug fixes for versions 0.7

0.8.x series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.8	?? Jul 2009	Yes	Yes	Performs an untethered jailbreak on iOS 3.0/3.0.1 (when pointed at 3.0) for all devices supported by those firmware.

0.9.0-0.9.4 releases

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.9.2	Unknown	Yes	Yes	Supports 3.0-3.1.2 on all iPhones and iPod touches (tethered for newer devices with 0x24000 Segment Overflow closed)
0.9.3	Unknown	Yes	Yes	Contains the IPCC hack to enable tethering on the iPhone 3G and 3GS.
0.9.4	Unknown	Yes	Yes	Supports jailbreaking iOS 3.1.3 on iPhone, iPhone 3G, iPod touch 1G, iPod touch 2G (old bootrom)

0.9.5 series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.9.5b3	21 Jun 2010	Yes	No	Supports jailbreaking iOS 4.0 on iPhone 3G and iPod touch 2G (old bootrom)
0.9.5b4	Unknown	Yes	No	Resolved a problem with iBooks.
0.9.5b5	Unknown	Yes	No	Supposed to fix any APN or MMS issues that users were seeing.

0.9.6 series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.9.6b1	21 Sep 2010	Yes	Yes	Supports jailbreaking iOS 4.0-4.1 on iPhone 3G and iPod touch 2G (tethered on new bootrom)
0.9.6b2	31 Oct 2010	Yes	Yes	Supports jailbreaking iOS 3.2.2 and 4.0-4.1 on every device that supports those firmwares (except iPod touch 2G with new bootrom) . The iPhone 3G, iPod touch 2G (old bootrom), and iPhone 3GS (old bootrom) can also have custom boot logos. The Windows version also includes a function that permits users to restore to a custom IPSW, akin to PwnageTool's DFU button.
0.9.6b3	?? Nov 2010	Yes	Yes	Supports the installation of custom bundles
0.9.6b4	23 Nov 2010	Yes	Yes	Jailbreaks iOS 4.1-4.2.1 on all compatible devices. Tethered jailbreak on devices that are not vulnerable to Pwnage 2.0 or 0x24000 Segment Overflow.
0.9.6b5	28 Nov 2010	Yes	Yes	Can update the baseband on the X-Gold 608 to 06.15.00, allowing the reuse of the AT+XAPP Vulnerability
0.9.6b6	1 Dec 2010	Yes	Yes	Allows you to "deactivate" a hacktivated phone, so sbinger's Subscriber Artificial Module (SAM) can trick your iPhone and iTunes into creating legitimate activation tickets.
0.9.6 release candidate 7	2 Jan 2011	Yes	Yes	Introduced command-line arguments to bypass some screens. -b <filename> to specify your own boot logo PNG -i <filename> to specify your reference IPSW -j to ask redsn0w to “Just boot now tethered for now” -o for iPhone 3GS and iPod touch 2G units vulnerable to 0x24000 Segment Overflow.
0.9.6 release candidate 8	5 Jan 2011	Yes	Yes	Informs users if a boot logo PNG is invalid, and why. Introduced the "-a" command-line argument to eliminate clicking.
0.9.6 release candidate 9	3 Apr 2011	Yes	Yes	Adds support for jailbreaking iOS 4.3.1 on all compatible devices except the iPad 2 and Apple TV 2. New command line parameters k and d [1]: -k --kernelcache=<str> use specified kernelcache (advanced) -d --devicetree=<str> use specified devicetree (advanced)
0.9.6 release candidate 10	7 Apr 2011	Yes	Yes	Added boot animations Removed misleading Settings
0.9.6 release candidate 11	7 Apr 2011	Yes	Yes	Makes the boot animation a bit more robust
0.9.6 release candidate 12	8 Apr 2011	Yes	Yes	Fix any lingering issues with the boot animation
0.9.6 release candidate 13	19 Apr 2011	Yes	Yes	Adds support for jailbreaking iOS 4.3.2 on all compatible devices except the iPad 2. A bug existed that prevented the iPhone 4 (iPhone3,1) from being jailbroken on iOS 4.3.2.
0.9.6 release candidate 14	19 Apr 2011	Yes	Yes	Fixes an issue that prevented the iPhone 4 (iPhone3,1) from being jailbroken.
0.9.6 release candidate 15	6 May 2011	Yes	Yes	Adds support for jailbreaking iOS 4.3.3 on all compatible devices except the iPad 2.
0.9.6 release candidate 16	16 May 2011	Yes	Yes	Fixes the iPhone 3GS/iPhone 4 (iPhone3,1) side switch vibration issue found in jailbroken installations of iOS 4.3.3.
0.9.6 release candidate 17	20 May 2011	Yes	Yes	Adds advanced command line options for kernel hackers.
0.9.6 release candidate 18	14 Jun 2011	Yes	Yes	Adds support for jailbreaking iOS 4.2.8 on the iPhone 4 (iPhone3,3).
0.9.6 release candidate 19	12 Jul 2011	Yes	Yes	When a custom bundle is applied, most of the normal jailbreak steps (like stashing and untethering) are skipped.

0.9.7 series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.9.7b1	26 Dec 2010	Yes	No	Jailbreaks iOS 4.1-4.2.1 on all compatible devices. Able to achieve an untethered jailbreak on 4.2.1, provided the user has 4.2b3 SHSHs and the 4.2b3 IPSW. This version of "Jailbreak Monte" has quite a number of bugs, particularly app switcher crashes and disabled Bluetooth.
0.9.7b2	26 Dec 2010	Yes	No	Fixes crashing bugs on GUI apps.
0.9.7b3	27 Dec 2010	Yes	No	Fixes crashing bugs completely.
0.9.7b4	31 Dec 2010	Yes	No	ubsmuxd integrated.
0.9.7b5	8 Jan 2011	Yes	No	Issues related to Bluetooth and the sandbox are resolved.
0.9.7b6	10 Jan 2011	Yes	No	fixes Skype

0.9.8 series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.9.8b1	10 Jun 2011	Yes	Yes	Performs a tethered jailbreak of iOS 5.0b and 5.0b2 (when pointed at the beta IPSW) on all compatible devices except the iPad 2.
0.9.8b2	11 Jul 2011	Yes	Yes	Performs a tethered jailbreak of iOS 5.0b, 5.0b2, and 5.0b3 on all compatible device except the iPad 2. Fixes the iOS 5.0b3 sandbox issues present in the previous version.
0.9.8b3	16 Jul 2011	Yes	Yes	Performs a tethered jailbreak of iOS 4.3.4 and iOS 5.0b, 5.0b2, and 5.0b3.
0.9.8b4	23 Jul 2011	Yes	Yes	Performs a tethered jailbreak of iOS 5.0b, 5.0b2, 5.0b3, and 5.0b4.
0.9.8b5	9 Aug 2011	Yes	Yes	Performs a tethered jailbreak of iOS 5.0b, 5.0b2, 5.0b3, 5.0b4 and 5.0b5.
0.9.8b6	23 Aug 2011	Yes	Yes	Performs a tethered jailbreak of iOS 5.0b, 5.0b2, 5.0b3, 5.0b4, 5.0b5, and 5.0b6.
0.9.8b7	31 Aug 2011	Yes	Yes	Performs a tethered jailbreak of iOS 5.0b, 5.0b2, 5.0b3, 5.0b4, 5.0b5 and 5.0b6. Performs a tethered jailbreak of iOS 4.3.5 and 4.2.10 without pointing at an older IPSW. Performs a tethered jailbreak of iOS 5.0b6 on a new, silently changed (by Apple) iPad 1G IPSW. Fixes a bug in the 4.2.10 jailbreak on the iPhone 4 (iPhone3,3) tethered jailbreak.
0.9.8b7b	2 Sep 2011	Yes	Yes	Performs a tethered jailbreak for iOS 4.3.4, 4.3.5, 4.2.9, 4.2.10 on all supported devices except the iPhone 3GS (old bootrom) and the iPad 2 Performs an untethered jailbreak on iOS 4.1-4.3.3 on all supported devices except the iPad 2 Performs a tethered jailbreak on iOS 5.0b - 5.0b7 on all supported devices except the iPhone 3GS (old bootrom) and iPad 2 Performs an untethered jailbreak on Phone 3GS (old bootrom) on iOS 4.1-4.3.5 and 5.0b7 Fixed lingering issues with the iPhone 4 (iPhone3,3) 4.2.10 tethered jailbreak
0.9.8b7c	6 Sep 2011	Yes	Yes	Same as 0.9.8b7b on all devices but iPhone 3GS with 06.15.00 baseband Fixes error 1015 when restoring to stock 4.3.5 on iPhone 3GS with 06.15.00 baseband.

0.9.9 series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.9.9b1	19 Sep 2011	Yes	Yes	Complete rewrite. No longer requires IPSWs when jailbreaking public builds. When jailbreaking beta/Golden master firmwares, need to specify IPSW once, then auto-recognizes it. Redsn0w now fetches SHSH from device, querys Cydia about saved blobs, stitches IPSWs with SHSH blobs (not for iPhones) and able to submit SHSH to cydia Includes Terminal shell commands into the GUI.
0.9.9b2	4 Oct 2011	Yes	Yes	Fixes Verizon iPhone 4 firmware detection Fixes 'Fix Recovery' Fixes for Stitching Fixes for blob processing
0.9.9b3	5 Oct 2011	Yes	Yes	Auto-detects the iOS 5.0 GM firmware now. Allows a jailbreak (albeit still tethered apart from iPhone 3GS old bootrom) on iOS5 GM
0.9.9b3a	5 Oct 2011	No	Yes	Fixes a Windows-only caching bug Allows Windows users to rename the redsn0w exe to anything containing 'boot' to jump straight to the tethered boot stage on load (thus adding one-click tethered boot to Windows redsn0w) 0.9.9b3 still works fine for Mac users except they don't have the new 'boot' rename feature that this version has
0.9.9b4	12 Oct 2011	Yes	Yes	Now auto-recognizes iOS 5 and no longer requires IPSW submission on iOS 5 jailbreak
0.9.9b5	13 Oct 2011	Yes	No	Custom IPSW feature (from PwnageTool) for Baseband preservation.
0.9.9b6	18 Oct 2011	Yes	Yes	Fixes location services issues for iPhone 3GS with 06.15.00 baseband
0.9.9b7	21 Oct 2011	Yes	Yes	You can now choose whether you want redsn0w or Cydia to Stash Applications (can shorten redsn0w session by 60%)
0.9.9b8	3 Nov 2011	Yes	Yes	Jailbreaks iOS 5.0.1b (9A402) tethered on devices vulnerable to limera1n exploit. Untethered on iPhone 3GS (old bootrom).
0.9.9b9	19 Dec 2011	Yes	Yes	Jailbreaks iOS 5.0.1 tethered on devices vulnerable to limera1n exploit. Untethered on iPhone 3GS (old bootrom). iBooks fix. Allows custom IPSW creation for iPhone 3GS (old bootrom) without SHSH blobs. Supports the 8 GB iPhone 4. Allows stitched IPSW creation for iOS 5.x. Allows stitched IPSW creation for iPad 2 (iPad2,2)s running iOS 4.3.x. Built-in version check.
0.9.9b9b	19 Dec 2011	Yes	Yes	Enables the “Custom” button in Windows to allow baseband preservation. Warns against flashing baseband 06.15.00 on newer iPhone 3GS devices (2011 week 35) more explicitly.
0.9.9b9c	19 Dec 2011	No	Yes	Special build for Windows users encountering issues with the update check.
0.9.9b9d	20 Dec 2011	Yes	Yes	Addresses a problem with the untethered jailbreak on iPhone 3GS (old bootrom) devices.

0.9.10 series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.9.10b	27 Dec 2011	Yes	Yes	The jailbreak for iOS 5.0.1 is now untethered.
0.9.10b2	27 Dec 2011	Yes	Yes	Fixes an issue with launchctl that the untether caused.
0.9.10b3	28 Dec 2011	Yes	Yes	Fixes a problem where re-running redsn0w over an existing jailbreak would cause Mobile Substrate-based apps to stop running until Mobile Substrate was installed again.
0.9.10b3 novcheck	29 Dec 2011	No	Yes	?
0.9.10b4	15 Jan 2012	Yes	Yes	Includes a fix for iBooks on iOS 5.0.1. Addresses an issue where the launchctl fix didn't work sometimes.
0.9.10b5	29 Jan 2012	Yes	Yes	Circumvents jailbreak detection in iBooks that caused ~10% of images to display properly.
0.9.10b5b	1 Feb 2012	Yes	Yes	Fixes an issue with custom ramdisks on the iPhone 3G and iPod touch 2G.
0.9.10b5c	12 Feb 2012	Yes	Yes	Prevents redsn0w from crashing due to increasing ramdisk sizes.
0.9.10b6	7 Mar 2012	Yes	Yes	Jailbreaks iOS 5.1 tethered on devices vulnerable to limera1n Exploit. Untethered on iPhone 3GS (old bootrom). Automatically detects MC model iPod touch 2G with pod2g's steaks4uce exploit.
0.9.10b6b	11 Mar 2012	Yes	No	Fixes small issues for Mac OS X v10.5.8 and earlier.
0.9.10b7	20 Apr 2012	Yes	Yes	Implements the Corona A5 jailbreak for iPhone 4S and iPad 2 devices still at 5.0.1 Can also re-install that jailbreak for those who accidentally uninstalled the untether When stitching an IPSW, it can now grab your blobs directly from Cydia. Now shows a lot more info about your device, for instance, whether your iPhone 3G has the vulnerable baseband bootloader, or whether your iPhone 3GS has the old exploitable bootrom
0.9.10b8	23 Apr 2012	Yes	Yes	Can backup those priceless activation tickets many are grabbing today Adds ability to backup arbitrary directories or files from your device into a ZIP file on your Mac or PC
0.9.10b8b	23 Apr 2012	Yes	Yes	Makes the ZIP files compatible with the native Windows Explorer.

0.9.11 series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.9.11b1	11 May 2012	Yes	Yes	Newer devices (iPad 2, iPad 3, and iPhone 4S) are able downgrade as well. In a radical departure from previous versions of redsn0w, it now directly supports restoring IPSWs to your device.
0.9.11b2	12 May 2012	Yes	Yes	Adds support for downgrading to iOS 5.0.1 build 9A406 for the iPhone 4S.
0.9.11b3	14 May 2012	Yes	Yes	This release should fix the "Restore failed" messages people were sometimes getting. Behaves better with nearby devices that have Wi-Fi syncing enabled.
0.9.11b4	14 May 2012	Yes	Yes	Completes the tethered jailbreak support for iOS 5.1.1 on A4 devices and earlier, including proper "Stitching" and "Custom" creation of NO_BB IPSWs

0.9.12 series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.9.12b	4 Jun 2012	Yes	Yes	Adds Rocky Racoon for all devices on iOS 5.1.1. On A4 devices and earlier, users can choose between the backup restore method (like Absinthe) or using a ramdisk-based jailbreak (how redsn0w usually works).
0.9.12b2	8 Jun 2012	Yes	Yes	Users on iOS 5.1.1 are now explicitly asked if they wish to use the backup/restore method or the DFU ramdisk method for jailbreaking. Fixes iBooks problems on the iPhone 3GS (old bootrom). Provides more helpful error messages.

0.9.13 series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.9.13 developer-only 1	?? ?? 2012	Yes	Yes	Jailbreaks iOS 6.0b.
0.9.13 developer-only 2	15 Jun 2012	Yes	Yes	Fix the various SSH problems and crashes with apps that some have been seeing.
0.9.13 developer-only 3	16 Jul 2012	Yes	Yes	Covers 6.0b3 release and also adds explicit support for 6.0b2.
0.9.13 developer-only 4	13 Sep 2012	Yes	Yes	???

0.9.14 series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.9.14b1	18 May 2012	Yes	Yes	Add a baseband downgrade option in redsn0w for those who are using the iPad’s 06.15.00 baseband on the iPhone 3G or iPhone 3GS.
0.9.14b2	4 Jul 2012	Yes	Yes	Improves the iPad baseband downgrade and should cover anyone who couldn’t downgrade with 0.9.14b1. Also simplified the process and added logging to help diagnose any remaining stubborn iPhones.

0.9.15 series

Version	Release date	OS X-compatible?	Windows-compatible?	Changes
0.9.15b1	14 Oct 2012	Yes	Yes	Tethered jailbreak for iOS 6.0 on the Apple TV 2G, iPhone 3GS, iPhone 4, and iPod touch 4G. Untethered for iPhone 3GS devices with the old bootrom. Allows devices with the A5 or newer to restore to iOS 5.x, as long as they have iOS 4.x or 5.x installed.
0.9.15b2	15 Oct 2012	Yes	Yes	After restoring an iPhone 3GS, redsn0w keeps track of its bootrom version while it's still open. Fixes support for upgrading to/downgrading baseband 06.15.00.
0.9.15b3	1 Nov 2012	Yes	Yes	Save iPad 4 and iPad Mini SHSH blobs. Fixes of error 14 when stitching blobs and error 2601 for windows users when restoring.

Exploits used

For iPhone, iPod touch, and iPhone 3G:

• Pwnage
• Pwnage 2.0

For iPod touch 2G:

• 0x24000 Segment Overflow
• ARM7 Go - used to upload the oversized LLB required to utilize the 0x24000 Segment Overflow.
• usb_control_msg(0xA1, 1) Exploit - used (in redsn0w 0.9.6b) to upload the oversized LLB to utilize the 0x24000 Segment Overflow, as well as a tethered jailbreak on units with the new bootrom.

For iPhone 3GS:

• 0x24000 Segment Overflow
• iBoot Environment Variable Overflow - Exploit has a different implementation from geohot's implementation in purplera1n.
• usb_control_msg(0x21, 2) Exploit
• limera1n exploit

For iPod touch 3G:

• usb_control_msg(0x21, 2) Exploit
• limera1n exploit

For iPhone 4, iPod touch 4G, iPad and Apple TV 2G:

• limera1n exploit

For iPad, iPad 2, iPad 3, iPhone 3GS, iPhone 4, iPhone 4S, iPod touch 3G and iPod touch 4G:

• Corona
• Racoon String Format Overflow Exploit
• HFS Heap Overflow
• BackupAgent

External Links

• iPhone Dev Team blog with redsn0w download information
• redsn0w beta infos (outdated)