Downgrade iOS 4.0.2 to iOS 4.0.1 without SHSH Blobs

If you are already stuck on iOS 4.0.2 without having saved SHSH Blobs in Cydia and still want to jailbreak (say, your iPhone 3GS), then don’t you worry. A user named CodeBlue has discovered a method that will downgrade iOS 4.0.2 iPhone to iOS 4.0.1, jailbreak, patch the safari exploit with PDF Fix. Just follow the simple steps listed below:

How to Downgrade iPhone 3GS iOS 4.0.2 to iOS 4.0.1 without SHSH Blobs

Step 1: Download 4.0.1 ipsw

Step 2: Extract it with winrar or winzip to a folder on the desktop. You may need to rename the firmware file from .ipsw to .zip to do this.

Step 3: Open the buildmanifest.plist with the notepad. Search and replace all – 8A306 with 8A400.  Save. Repeat the same with the file restore.plist

Step 4: Download 4.0.2 ipsw and open this with winrar or winzip.

Step 5: Take all the files from the 4.0.1 and drag them over to the 4.0.2 zip archive that you have open.

Step 6: Delete all the dmg files that have 002 at the end, leaving only the 001 files left.

Step 7: Save the archive. And rename it back to .ipsw if you changed the name to get winrar/winzip to open it.

Step 8: Optional: (this helps ensure you get an SHSH file request for the future, but should not be necessary to just restore 4.0.1).  Add the 74.208.10.249 gs.apple.com line to the host file (you may follow our previous post on how to do this).

Step 9: Put the device into DFU mode, open iTunes and restore the firmware you changed. Wait for a while and it will restore your iPhone to iOS 4.0.1

Note: this only works due to the similarities in 4.0.2 to 4.0.1 and 4.0. This will not be a way to downgrade to 3.1.x and may not work in future firmware updates.

Voila! The downgrade from iOS 4.0.2 to iPhone iOS 4.0.1 is successfully completed. You can now jailbreak your iPhone 3GS with jailbreakMe and carrier unlock with ultrasn0w easily.

The methods works! CodeBlue himself tested it on his iPhone 3GS and iPod Touch 3G MC.

iPhone 3GS (32 gig) WHITE running 4.0.2:

I managed to downgrade a fresh iPhone 3GS running 4.0.2 back down to 4.0. How you may ask? honestly, I do not know. Apple, as we all know, stopped signing the 4.0 firmwares which forced you to update your firmware to a higher version. We all know the infamous SHSH or Blobs. Cydia managed to make “your life easier” and backup your blobs along the way through your jailbreaking life. And TinyUmbrella, helps you store your blobs locally or remotely request to store or to receive your blobs.

Story is, I used TinyUmbrella (umbrella-4.01.01) and downgraded WITH NO LOCALLY STORED BLOBS ON MY COMPUTER AND NO BLOBS ON CYDIA FOR THIS DEVICE. And somehow, I managed to get back down to 4.0. Using iTunes Shift and Restore feature.

I have had another beta tester to test his iPhone 3GS with new bootrom and his iPhone was never jailbroken before and he was running 4.0.2. I gave him my steps and at first attempt failed, yet he tried once more and it was successful. He successfully jailbroke his phone also.

iPod Touch 3G MC (32 gig) running 3.1.3:

I was curious and tried my method again for this ipod touch. now this one is my best proof of all in my honest opinion. This iPod never had been jailbroken before nor has it ever seen 4.0. THIS IPOD WAS FRESH. I knew that if I wanted 4.0 firmware, Apple won’t allow me because they stopped signing this, instead they will force me to 4.0.2. So I tried my method again, and first attempt failed again. So i closed iTunes, disconnected iPod Touch, turned off TSS server and rebooted the TSS server and brought up iTunes with my iPod once again plugged in.

Tried my method, and guess what…. it worked….. I avoided the signing rejection from Apple and I’m at 4.0 and jailbroken.

That being said, I want to remind you again that my desktop computer never touched an iPod or iPhone before meaning TinyUmbrella is completely new to this computer and I have no Blobs/SHSH stored on this computer or anywhere else such as Cydia AT ALL.

While downgrading iOS 4.0.2 to iOS 4.0.1 firmware you might stuck with error 1015 in iTunes. To fix or troubleshoot error you may try the following guides:

• Fix iPhone Restore Error Code 3194, 1015 from iOS 4 to iOS 3.1.3
• Error 1015 Fix: Solving the iTunes error 1015
• Put iPhone and iPod Touch in Recovery Mode with RecBoot

You might also Like to check out more on iOS 4.x, 3.1.3 Jailbreak and baseband unlock:

• iDetector: Find Bootrom Version for iPhone 3G/3GS iOS 4 Jailbreak
• iPhone Jailbreak and Unlock Legally Permitted by United States
• How to Unlock 05.12.01, 04.26.08 to 05.13.04 Baseband on iPhone 3GS/iOS 4 with ultrasn0w 0.93

Via – pwnmyi

[Update: 1] Why the method is not working for All?

There is much discussion on many blogs about a potential means of downgrading iOS 4.0.2 to 4.0.1 by simply changing a couple values in the buildmanifest.plist and copying all of the images from 4.0.1 into 4.0.2 and then deleting the files ending with 002. Following all of this, perform a DFU restore and somehow you will be on 4.0.1.

There is a perfectly logical explanation for all of this and I will lay out exactly what is happening and explain why it is working for the folks that are the lucky ones.

Let me get this out first.

• This is not a miracle, at least not in the sense you all hope for
• SHSHs are STILL required for any iPhone 4, iPhone 3GS, iPad, iPod Touch 3G, and iPod Touch 2G (MC Model)
• There is NO way around this… unfortunately this method included.

Let me start by explaining something very important. The buildmanifest is used by iTunes to build much of the TSS request that is used to obtain your SHSH for any given firmware revision. Unfortunately, the BuildNumber has no part to play in the request for SHSH. All that you ended up doing in following these directions is request 4.0.1 SHSH blobs.THAT IS ALL. Since every single one of you that got this to work changed your hosts file to point to Cydia, Cydia responded to the TSS request with an SHSH blob that wasALREADY ”on-file”. There was no magic. There was no miracle, apart from the lucky break that your device had been put on Cydia’s SHSH request list at some time in the distant past.

That’s it in a nutshell folks. There was no amazing technique for bypassing Apple’s TSS. There was no amazing exploit that exists in DFU mode allowing for 4.0.2 -> 4.0.1 downgrading. It’s simple; Cydia had your SHSH because at sometime in the past either:

• Someone saved your SHSH with that device using TinyUmbrella and the default options
• Someone restored that device with Cydia in the hosts pointing to gs.apple.com
• Someone jailbroke the device and pressed ‘Make my life easier’

That’s it folks. Sorry to be a buzzkill but there was much confusion about this issue and many blog posts that simply didn’t give the full story of what exactly were going on.

Thanks - notcon

Follow our previous guides on how to downgrade iOS firmware.

• Downgrade iOS 4.0.2 to iOS 4.0.1 Firmware on Windows & Mac
• Downgrade iOS 4.0 to 3.1.3 iPhone Firmware
• How To:  Downgrade iOS 4.0 to iOS 3.1.3 iPhone Firmware [Windows/Mac]