Tutorial:Mounting the Ramdisk of IPSW in Betas 4-7

How to decrypt beta 4-7 ramdisks

First unzip your ipsw, and take out the ramdisk file (it will be around 18mb). Then put it on your desktop In Terminal...

Launch /Applications/Utilities/Terminal.app

Then type the following:

 * cd Desktop
 * echo `hexdump -s12 -n4 -e '"%d\n"' ramdisks-hould-just-be-a-bunch-of-numbers.dmg ` / 32 | bc

A number should appear. For example, in the case of beta 5, it would be 604800.

So you will type the following command now:

 * dd if=ramdisk-name-aka-a-bunch-of-numbers.dmg of=ramdiskb5.dmg bs=32 skip=1 count=**NUMBERS-GO-HERE** conv=sync

After this, you will have a file called ramdiskb5.dmg on your desktop. Just double click this file and it should mount fine. Example: Beta 5 Ramdisk

Last login: Tue May 6 21:37:15 on ttys000

 Macintosh:~ xxxxxxxxx$ cd /Users/xxxxxxx/Desktop/iPhone1,1_2.0_5A274d_Resto (THIS IS WHERE I UNZIPPED MY IPSW. I was a bit sloppy and did it the quick but annoying way, and accidently deleted some letters. But my point is that this is a folder name. You'd probably be better off just unzipping the ramdisk to your desktop rather than to a folder)
 * Macintosh:iPhone1,1_2.0_5A274d_Resto xxxxxxx$ echo `hexdump -s12 -n4 -e '"%d\n"' 018-3615-6.dmg ` / 32 | bc (**THIS GETS ME THE NUMBER I NEED FOR THE NEXT STETP**)
 * 604800 (**THIS IS THE NUMBER I NEED FOR THE NEXT COMMAND**)
 * Macintosh:iPhone1,1_2.0_5A274d_Resto xxxxxxxx$ dd if=018-3615-6.dmg of=ramdiskb5.dmg bs=32 skip=1 count=604800 conv=sync
 * 604800+0 records in
 * 604800+0 records out
 * 19353600 bytes transferred in 5.721840 secs (3382408 bytes/sec) (**THIS MADE MY RAMDISK MOUNTABLE**)
 * (**AT THIS POINT, THE DECRYPTED RAMDISK WAS ON MY DESKTOP, READY FOR USE**)

source: ChronicDev User Wiki