How to Update/Restore iPhone 3Gs to iOS 4.1 While Preserving Baseband Using CFW

PwnStrap

This procedure should work to bootstrap the restore of any 3GS or later PwnageTool 4.1+ image
(3GS, i4, iPad, AppleTV2)

 

 

Windows

Required files:

• Your PwnageTool cooked 4.1 firmware.
  If you don't have one, don't ask us for one. It's not our fault when you die a slow and painful death.
• My unofficial Windows iRecovery for new Devices.
• GreenPois0n for Windows.

Automatic Procedure:

1. Place your device into Recovery Mode.
   While the phone is off, hold down the Home button and immediatly plug it into your computer. Or else.
2. In a command prompt, run irecovery.exe -p Path\To\Firmware.ipsw
3. Follow the instructions.
   If you don't read the actual output from greenpois0n may the fleas of a thousand camels infest your private parts.

---

Common

Manual Procedure:

1. Put phone into Recovery mode (NOT DFU)
   While the phone is off, hold down the Home button and immediatly plug it into your computer. Or else.
2. From a command prompt (Start>Run>"cmd"), change to the directory where you extracted irecovery, and enter irecovery -s followed by:
   1. setenv boot-args 2
   2. setenv auto-boot false
   3. saveenv
   4. /exit
   Keep this window open for use later on!
3. Run greenpois0n - it will guide you to enter DFU mode, then it will stop on a white screen after you click "Jailbreak".
   It should say "Jailbreak Complete!" and NOT "Jailbreak Failed!" next to the progressbar at the bottom.
4. Extract the iBSS from your custom PwnageTool image (firmware.ispw/Firmware /dfu/iBSS.BoardID.RELEASE.dfu) into your irecovery folder.
   You can use WinRAR or another ZIP extractor to do this. IPSW files are really just ZIP files!
5. At a command prompt: irecovery -f iBSS
   iBSS should be replaced with the name of the iBSS that you just extracted from the pwnagetool image - ie iBSS.n88ap.RELEASE.dfu
6. At a command prompt: irecovery -s
   1. setenv boot-args 0
   2. saveenv
   3. go image decrypt 0x41000000
   4. go jump 0x41000040
   5. /exit
   At the "go jump" point your device should appear to reboot. Whether it goes back to a white screen or shows the Connect to iTunes screen depends on the firmware image used.
7. Restore your PwnageTool cooked firmware from iTunes.

Source Link