What is this all about?
This post implies for most iPod Touch 3Gen, iPhone 3GS and iPad models. Even though some of you maybe using lower models of iPhones or iPod Touch models, this is a very good read so you actually know how Apple’s security chip works and how the jailbreak community has worked around it.
During the release of the iPT 3Gen, iPhone 3GS and iPad, Apple has put a new security feature on these new devices. These chips are actually called ECID, Exclusive Chip ID. Each of these chips, like our finger prints are unique and it’s main purpose is to contact an Apple server which generates a signature telling your device what iOS version it should be using. The signature is actually called a Signature HaSH and it will tell iTunes that Makiav3lli’s iPod Touch 3Gen is allowed to run iOS 3.1.2. Now when a new iOS is released, for example iOS4, when your device connects to iTunes, iTunes will be contacting Apple’s signature server and update Makiav3lli’s iPod Touch to use iOS4 if the device needs to be restored (including Shift + Restore) or is running in DFU mode. During this period, iTunes play an important part as most Apple devices need to activate with the use of iTunes, however, it does NOT force the device to update. There is no such thing as an accidental upgrade as iTunes ALWAYS prompts the user of an update whether on iTunes or on the device. Once it does, iTunes contacts the signature server, a signature is generated and iTunes will enforce the firmware that it is allowed to use. Now because the ECID has a matching signature on the Apple server, regardless of what iTunes 9.1 version (lower versions of iTunes will not work with 4Q Apple devices) from your PC or anywhere else, iTunes will always force you to use the firmware matching with their signature. Remember, even if you are using a lower iOS version and you attempt to update your SHSH blobs, it will only obtain signatures with the current firmware being served by Apple’s Signature server. If you are iOS3.1.3 and haven’t backed your SHSH, if you attempt to back it up using Umbrella or Cydia when a new iOS has been published, you will not be able to back up your current SHSH for a previous iOS.
What’s its use and why does it look bad for us?
The ECID’s purpose was to actually stop jailbreaking of future firmware. How that is done is a good question because the only I thing I see this do is to stop people from going back to jailbreakable firmwares and not actually protecting future firmware. When a new firmware is released which cannot be jailbroken, users who upgrade carelessly won’t have an option to go back to their previous firmware which was jailbroken. This isn’t necessarily bad news for us because everything still relies on us, if we want to use new firmware or not. For us who own jailbroken units we simply know better. Imagine having an application which only works on iOS3.1.3 and the developer decided to leave the Apple scene, you may end up with an incompatible version of the application in iOS4. What if you simply did not like the new version of your firmware? What if the new firmware caused security issues in your corporate environment and you have 400 users that moved up the new firmware? This facility is great for Apple but for the end users, it put people up in a tight corner. It’s like the saying in the movie White Chicks… “Once you go Black, You gonna need a wheelchair.”
So what have the jailbroken community done about it?
Thanks to Saurik, he was able to create a way to cache Apple’s signature, replicate the server and basically store a copy of our ECID which a matching signatures which will actually allow us to downgrade to previous firmware. Saurik was able to implement a small procedure in Cydia which a device connecting to Cydia for the first time is prompted is asked if the user would like to upload their existing ECID so that Saurik’s server could retrieve the signature for the firmware that Apple is allowing. If I understand correctly, when your device communicates with Cydia, it communicates with Saurik’s Apple Signature server and his server retrieves and stores the signature granting you the ability to downgrade.
This is what Saurik had to say: Caching Apple’s Signature Server
How do I upload my ECID SHSH blobs?
There are two ways to which this procedure is done and at best, both procedures are idiot proof.
If you run Cydia for the first time, you should encounter this message below:
Once you have hit Make My Life Easier, you will be given an indicator on the home page of Cydia that is it being processed.
It may take time to process your signature so it would be best to return to Cydia after 24 hours to make sure that the signatures are cached.
A second method of uploading your signature is described below using the TinyUmbrella tool.
How do I know if my ECID SHSH blob has been stored?
If your iPhone has been jailbroken, the first way to see if your ECID SHSH has been stored is through Cydia. On the home page it should indicate which firmwares you are allowed to go back to.
The second method is applicable to non jailbroken phones as well and that is to use an application called TinyUmbrella.
- Launch TinyUmbrella
- Click on Save My SHSH.
- Check the log and check how many files it has cached.
- Click on Display SHSHs to view what downgrades you are eligible for.
Again, this tool is very useful not just for jailbreakers but also for people who just want to downgrade to lower version. Using this tool ensures that you can go back just in case you don’t like the existing firmwares.
How do you do I downgrade my iOS?
The key to this whole thing is iTunes. iTunes communicates with the signature server and enforces the allowed firmware on your device. Saurik actually found a way to trick iTunes to communicate with his server instead instead of the Apple signature server. The steps are quite easy.
- Disconnect your device and make sure that iTunes is closed.
- Open Windows Explorer and unhide files.
- Go to C:\Windows\System32\drivers\etc\ and locate a file called hosts
- Right click and open the file with Notepad.
- Add this entry : 74.208.10.249 gs.apple.com , save and close the file.
- Open iTunes and proceed with the firmware restore that you have been allowed to use
iTunes is being tricked that it is communicating with an Apple Signature Server and this server is telling iTunes to allow the device to downgrade because in it’s signature listing, that firmware has been approved.
I upgraded to iOS4.0 but now decided to move back to iOS3.1.3, what am I to do?
If you are using iPod Touch 2Gen model
You will need the following:
- iOS3.1.3 firmware (IPSW file)
- iTunes 9.1
- Spirit Jailbreak Tool
- Verified that ECID SHSH is applicable for downgrade
- Revo Uninstaller
- Using TinyUmbrella to make sure that you can downgrade to iOS3.1.3. It is absolutely necessary to do this step before anything else so that you don’t waste your time.
- Once verified, proceed to uninstall iTunes 9.2 with Revo Uninstaller, you may use Windows Add/Remove Programs, Revo Uninstaller removes all traces of the programs including the registry, restart if required.
- Install iTunes 9.1. We are reinstalling iTunes 9.1 because as of this moment, the Spirit jailbreak has been patched on iTunes 9.2.
- After installation of iTunes 9.1, configure your iTunes account.
- DFU your unit or use Shift + Restore to downgrade your unit with the corresponding firmware you have selected.
- Cofigure and sync your device. Run your Spirit jailbreak.
If you are using iPod Touch 3Gen model
- Using TinyUmbrella to make sure that you can downgrade to iOS3.1.3. It is absolutely necessary to do this step before anything else so that you don’t waste your time.
- Once verified, proceed to uninstall iTunes 9.2 with Revo Uninstaller, you may use Windows Add/Remove Programs, Revo Uninstaller removes all traces of the programs including the registry, restart if required.
- Install iTunes 9.1. We are reinstalling iTunes 9.1 because as of this moment, the Spirit jailbreak has been patched on iTunes 9.2.
- After installation of iTunes 9.1 and configure your iTunes account.
- Trick iTunes to connect to Saurik’s Apple Cache Signature server
- Disconnect your device and make sure that iTunes is closed.
- Change host file to trick iTunes
- Open Windows Explorer and unhide files.
- Go to C:\Windows\System32\drivers\etc\ and locate a file called hosts
- Right click and open the file with Notepad.
- Add this entry : 74.208.10.249 gs.apple.com , save and close the file.
- DFU your unit or use Shift + Restore to downgrade your unit with the corresponding firmware you have selected. Note that it will be contacting the “dummy server” which will allow you to downgrade. If it doesn’t you either have made a mistake in verifying firmwares you can downgrade to, check step 1, or your host configuration file is wrong, step 5.
- After downgrading, undo the 74.208.10.249 gs.apple.com entry you put on the host file.
Configure and sync your device, run your Spirit jailbreak.
Is my MC 8GB model affected?
Your device is actually a rebranded 2Gen device with an MCXXXX marking and installed with iOS3.1, it will never be able to run anything lower than 3.1 as the device has a crippled bootrom of running 3.1 and above only. According to reports it doesn’t have ECID on it which basically means, you are not affected. Unfortunately, I cannot verify these reports and the best way to determine this is by using the TinyUmbrella application.
Go back to the iPod Support Index
Disclaimer