iOS 4.3 b3 Jailbreak on iPhone 4, iPod Touch 4G and Apple TV 2G Using PwnageTool and Ramdisk Fixer

DjayB6 has just released custom Pwnagetool bundles to jailbreak iOS 4.3 b3 on iPhone 4, iPod Touch 4G and Apple TV 2G. Universal Ramdisk Fixer also gets an update to support iOS 4.3 beta 3 build 8F5166B.

Although the steps to jailbreak iOS 4.3 b3 are almost same as mentioned in this post, but we are re-writing them here just for ease while skipping and removing the uncessary details.

Part 1: Download the Required Tools:

Download the following tools before you start the actual jailbreak process:

  • Download latest iTunes 10.1.2 and install it on your Mac machine.
  • Download PwnageTool (official link)
  • Download PwnageTool bundles for your idevice (Bundles for more devices will be added later)
  • Download Universal Ramdisk Fixer
  • Download iOS 4.3 beta 3 (devs only)

Disclaimer: This guide is for testing and educational purposes only. Please don’t follow the steps mentioned below if you don’t know what you are going to do. We won’t be responsible for any damage to your anything.

Note: Those users who rely on unlock should not try this guide.

Part 2: Patching / Modifying PwnageTool using custom bundles

Since official Pwnagetool doesn’t support iOS 4.3, we have to modify it using the custom PwnageTool bundles.

Step 1: Right click on the PwnageTool which you have already download and then click on “Show Package Contents”.

Step 2: Navigate to this path /Contents/Resources/FirmwareBundles and put the bundle folder download for your device in Part 1 in this location.

Step 3: Close the folder.

Part 3: Patching Ramdisk

Now we have to fix the broken PwnageTool ramdisk process to support iOS 4.3 beta 1, beta 2 and beta 3.

Step 1: Launch Universal Ramdisk Fixer.

Step 2: Follow the simple on-screen instruction to fix the ramdisk.

Part 3: Creating Custom iOS 4.3

Step 1: Launch the updated iTunes.

Step 2: Back up your device before starting the actual jailbreak process.

Step 3: Launch modified PwnageTool bundle.

Step 4: Now select your iPhone and click the blue arrow to continue.

Jailbreak iOS 4.3 on iPad, iPod Touch 4G and iPhone 4 with PwnageTool Bundles [Guide] 12

Step 5: Browse for iPSW file (iOS 4.3 b3) which you have already downloaded in Part 1. (Make it sure that iPSW file is placed on desktop)

Jailbreak iOS 4.3 on iPad, iPod Touch 4G and iPhone 4 with PwnageTool Bundles [Guide] 22

Step 6. Now hit the Build button to cook the custom firmware and save it on your PC.

Jailbreak iOS 4.3 on iPad, iPod Touch 4G and iPhone 4 with PwnageTool Bundles [Guide] 73

Part 5: Restoring iOS 4.3 Custom Firmware

Put your iPhone into DFU mode. PwnageTool will help you in this process. Follow the onscreen instructions for this purpose.

Jailbreak iOS 4.3 on iPad, iPod Touch 4G and iPhone 4 with PwnageTool Bundles [Guide] 0

  • Hold Power and Home buttons for 10 seconds
  • Now release the Power button but continue holding the Home button for 10 more seconds
  • You device should now be in DFU mode

After the iPhone is in DFU mode, launch iTunes and it will tell you it has found an iPhone in recovery mode. Press OK to continue.

Jailbreak iOS 4.3 on iPad, iPod Touch 4G and iPhone 4 with PwnageTool Bundles [Guide] iTunes iPhone in Recovery M

To install the custom cooked firmware, press the Alt/Option key and click on “Restore” in iTunes.

Now wait for few minutes until iTunes does its job. The iPhone will reboot after it has been restored successfully.

Part 6: Booting the Device in Tethered Boot

Since iOS 4.3 jailbreak is tethered, we will have to connect the device with PC and use a software “tetheredboot” to boot it into a tethered jailbroken state.

Tetheredboot utility requires three files from iOS 4.3 to do its jobs. The names of those files are

  • kernelcache.release.n90
  • iBEC.n90ap.RELEASE.dfu,
  • and iBSS.n90ap.RELEASE.dfu.

To get these files, change the extension of iOS 4.3 from .ipsw to .zip and extract it. You will find them under /Firmware/dfu/ folder.

Put all these three files and tetheredboot utility into a new folder on desktop and name it “tetheredboot”.

Now connect your device with your computer and boot it into Recovery Mode by holding power and home button until “Connect to iTunes” screen appears on iPhone.

Start terminal and run the following commands:

sudo sh

type your admin password and run:

cd desktop/tetheredboot

./tetheredboot iBSS kernel

When you are asked to put your device into DFU mode, follow the same method you used in Part 5. After a short while you will see “Exiting libpois0n” in the terminal windows which indicates your iPhone, iPad, iPod Touch will be booted within few moments.

Want automatic updates? Subscribe to our RSS feed or
Get Email Updates sent directly to your inbox!

11 Comments

    • Please try to be more specific next time. Which iOS version, which idevice, custom iOS or fresh stock, unlocker or not, if unlocker whats baseband??

      Reply
      • i have an iphone 4 on 4.2.1 and i am trying to upgrade to 4.3b3 custom FM. and i do not require a unlock

        Reply
  1. when trying to boot tethered on 4.3b3 iphone 4 i get this far but it never reboots

    sh-3.2# cd desktop/tetheredboot
    sh-3.2# ./tetheredboot iBSS kernel
    Initializing libpois0n
    No matching processes were found
    Waiting for device to enter DFU mode
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    Device must be in DFU mode to continue
    opening device 05ac:1227…
    Found device in DFU mode
    Checking if device is compatible with this jailbreak
    Checking the device type
    Identified device as iPhone3,1
    Preparing to upload limera1n exploit
    Resetting device counters
    Sending chunk headers
    Sending exploit payload
    Sending fake data
    libusb:error [darwin_transfer_status] transfer error: timed out
    Exploit sent
    Reconnecting to device
    Waiting 2 seconds for the device to pop up…
    opening device 05ac:1227…
    sh-3.2#

    Reply
  2. I get either error 21 or 1600m or 1611 when restoring the customer firmware. HELP!!!!!!
    btw, I’ve donw everything I can google to resolve the issue.
    Thnkas!!

    Reply
    • Make it sure that you have put your device into pwned DFU mode before restoring to custom iOS firmware. You can use Redsn0w for this purpose.

      Reply
  3. Thiis guide sucks, because it’s a copy from beta 1 jailbreak, and it’ll never work on beta 3, the DFU files *n90ap*.dfu only exist in beta 1, for beta 3, they are *k48ap*.dfu.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.