Here’s a brief video demonstration by @planetbeing of the iPhone Dev Team’s ultrasn0w unlock for the new iPhone 3G S. Special thanks to @Oranav for the at+xlog crash — a gift to the community that has kept on giving

Our ultrasn0w program uses the at+xlog crash as an injection vector of our unlocking payload — and it does so on the 3GS in exactly the same way as on the 3G! But this injection vector will be lost if you update to 3.1 using the official Apple IPSW, which updates the baseband. So stay away from official 3.1 IPSWs until we release the tools that let you update the firmware without updating the baseband.

Original Post.

"Remember we warned you to stay away from any updates to 3.1 if you want to be able to jailbreak or unlock your 3GS.

Well this is an additional message to all you 3GS owners that would like to jailbreak your device sometime soon, but this advice comes with a warning! A warning that if you accidentally upgrade to 3.1, you will not be able to use Ultransn0w, so please re-read and double check this warning at the bottom of this post before proceeding.

You may have read or heard about techniques to capture files during the iTunes restore process. These will be required to jailbreak your phone in the near future, most of the methods involve icky USB snoops. Well, there is an even better and more reliable method to get your hands on those lovely files.

During the restore process iTunes nicely keeps these oh-so-top-secret-files in a lovely accessible place for us to copy out and backup, that place? /tmp on Mac OS X or %TEMP% on Windows. Thanks Apple — handy!

The downside to this approach is that you actually need to go through the restore process to get these signed files, which has risks if you are anywhere near 3.1 or 3.1 beta

If you are ready to proceed and you know the risks we’ll get down to the nitty-gritty -

So during a usual recovery with iTunes, your signed iBEC is written to /tmp and during a DFU mode restore the signed iBSS is written there also. To be sure, restore in both modes one after another to be able to grab them both. You’ll need to keep an eye on the temp directory and copy it before it is deleted again by iTunes. I’m sure some nice folks will create a tutorial about this, we’ll link to the first person who makes a good one.

Should you choose to accept this mission, act fast, this needs to be done quickly! But again, always, always double check here to see if 3.1 has been released, if is has, then don’t do this.

WARNING!! - DANGER, WILL ROBINSON! - NB! - REMEMBER!

IF YOU CARE ABOUT ULTRASN0W, BE VERY CAREFUL WITH THIS METHOD! Do not attempt this if you have downloaded the 3.1 beta. You do NOT WANT TO accidentally restore your device to 3.1 beta — you’ll lose ultrasn0w if you do! BE WARNED "

Summary:

We can jailbreak the 3GS right now. But making our jailbreak public at this point in time would benefit relatively few people. It would in fact be detrimental to many more people than it would help. So we feel it’s best to keep our version of the jailbreak out of Apple’s sights for the time being.

Details:

If you already have a 3GS phone and have already done a full USB dump or captured your img3’s signed with your ECID, then you’re in great shape. You will always be able to jailbreak. But many people who plan on getting a 3GS do not yet have one. For instance, many people are waiting for their existing contracts to mature to the point where they get a price break on the 3GS. Many people are trying to sell their 3G before they can buy the 3GS. There are parts of the globe where you can’t even buy a 3GS yet! The reasons are varied, but they are many.

The nature of the 3GS hardware allows Apple to stop IPSWs from being usable unless you’ve already gotten the signed chunks they send to you based on your ECID (a unique chip ID). You cannot get these signed chunks without knowing your ECID, and you don’t know your ECID until you’ve bought your 3GS.

The jailbreak requires at least one signed iBoot-family img3 for your device. And that iBoot needs to have an exploitable bug. It’s an all-or-nothing deal…you either have your signed exploitable iBoot ready to use, for now and forever — always jailbreakable — or you have nothing.

Here’s the critical point, the reason why we’re delaying our version of the jailbreak: Once the jailbreak is out, Apple will fix the iBoot-family bug we use to accomplish it. They will simply stop signing the old iBoots and only sign the fixed ones. If you bought your phone after Apple has done this, there’s nothing you can do…the jailbreak isn’t going to work for you.

It is possible that Apple will find the bug we use without our handing it to them on a silver platter (via a public jailbreak). In that case, we will have delayed our jailbreak for “nothing”. But we’d rather be safe than sorry!

Apple is surely coming out with a 3.0.1 firmware release shortly. They need to fix ultrasn0w. They need to fix some UI issues. 3.0 is buggy and 3.0.1 is coming. We’re going to wait and see what 3.0.1 brings before figuring out the release date for our version of the jailbreak.

In the meantime, we have some remaining 3.0 jailbreak issues to investigate, including push notification. Thanks for being patient with us while we took a 3GS “timeout”!

Check out the Dev-Team’s website HERE.

ultrasn0w for iPhone 3G is ready!

1. Ensure you have upgraded to iPhone OS 3.0
2. Jailbreak your iPhone 3G using redsn0w or PwnageTool (this will also install Cydia/Icy)
3. Run Cydia or Icy
4. Please add the repo repo666.ultrasn0w.com to Cydia or Icy. That last “o” is actually the number zero “0”! If you use the letter “o” you’ll get an error.
5. Search for ‘ultrasn0w’ in cydia or icy and install ultrasn0w
6. Reboot your iPhone 3G
7. T-Mobile USA users should disable 3G before using ultrasn0w
8. Enjoy

Dev-Team article HERE.

ScreenShots

“redsn0w is an easy to use, multi-platform, multi-device jailbreaking and unlocking (iPhone 2G only) tool for the iPhone 2G (original iPhone), the iPhone 3G (but not the 3GS) and also the iPod touch (first and second generation). Currently it is available for Windows and Mac OS X (there are some issues using redsn0w with OS X PPC, please use an Intel Mac until we have this problem resolved).

REDSN0W PROVIDES SIMILAR FUNCTIONALITY TO QUICKPWN.

If you want to build custom firmware files with more flexibility it is suggested that you use ‘PwnageTool’ on Mac OS X.

1.GOLDEN RULE: If you are using a 3G iPhone with yellowsn0w and rely on yellowsn0w to obtain cellular service, then you should NOT use redsn0w right now. Ultrasn0w (the 3G carrier unlock) is not included with this release and therefore your baseband will be locked and unable to use an operator other than the official one it was bought for. UltraSn0w will be released via APT (cydia and icy) soon. If you have an original iPhone (1st generation) then 3.0 carrier unlock works with this redsn0w release.

2.Yellowsn0w in its current form will NOT work with the baseband version that is present in the 3.0 update, you will need Ultrasn0w, which will be released sometime soon, Ultrasn0w will work with all iPhone 3G models (but not 3GS), even ones that were previously unlockable, Ultrasn0w (when available) will be released via APT (this means you will be able to get it via Cydia or Icy).

3.Please read all parts of this post before downloading and using these tools.
4.Read items 1, 2 and 3 again and again.
5.At the bottom of this post are the bittorrent files for the latest version of redsn0w.
6.This app is suitable for the recent 3.0 release
7.redsn0w will NOT work for the iPhone 3GS.
8.redsn0w WILL work for Original iPhone (1st Generation), Original iPod touch, iPod touch 2G and the iPhone 3G (not the iPhone 3GS).

To use redsn0w simply upgrade the device in iTunes to firmware version 3.0 and run redsn0w to activate and jailbreak the device (and if you are using an original iPhone 2G, it will unlock it too!)”

There still no updated info since yesterday about the jailbreak for the 3.0 firmware (or now, the iPhone 3GS) or ultrasn0w. Like usual, we will hang out and wait for more info from the Dev-Team. For more info about ultrasn0w check out THIS post.

Original Tweet:
“3GS is shipping with BB 04.26.08 (vulnerable to ultrasn0w). If (big “if”) it can also be jailbroken, that would be swell!”