GeoHot figures a way to downgrade baseband 02.30 to 02.28 on bootloader 5.8

Posted by:Aaron Besson
April 12th, 2009

: Image by rustybrick via Flickr

We have not heard anything from George Hotz for some time, but when he does chime in it’s usually of some significance.. He has posted some news for iPhone 3G owners who have bootlader 5.8 and modem firmware 02.30 and can’t run yellowsn0w to unlock the device.

In bootloader 5.8 on the 3G, the loader signature validator is broken. Someone botched an if statement checking the location and length of the loader in the cert. Because of this, you can pass the run cert for the firmware you currently have on the phone instead of the loader cert, and send whatever you want as a loader.

Here is a bspatch file to be applied to ICE2_02.28.00.fls allowing downgrades from 2.30.03 using BBUpdaterExtreme. By replacing the patched cert with your current run cert, you can downgrade from any other version.

This will really help people who have updated their iPhone 3G to 2.2.1 from 2.0, 2.1 or 2.2. Unfortunately this will not help those with 5.9 bootloader which makes up the majority of new iPhone 3G purchased in the last couple months.

I have not been able to find much info on this and I am not willing to sacrifice my 3G by updating to test. But as I get more info I will post, there are not real tutorials for this and must be run from terminal on the iPhone with all the required files. For anyone that is brave enough to try, let us know your outcome.