About 5 hours ago (Thursday evening, less than a week after the 3GS launch), we were able to verify that the 24Kpwn exploit that the hybrid team used on the iPod Touch 2G is still applicable to the bootrom of the iPhone 3GS. That means we can use the same sort of technique used by our current redsn0w tool to jailbreak and unlock the iPhone 3GS.

This is great news, but how did it happen?  Why didn’t Apple fix this in their normal cat & mouse fashion?  Well it seems this bootrom was cut in about the August 2008 timeframe, so the unintended early reveal of 24Kpwn earlier this year didn’t affect the iPhone 3GS.

For our technical notes on where the 24Kpwn exploit is in the 3GS, see here (pastebin hash of it is here).    Our original blog post for when this exploit was first found is here.

And yes, ultrasn0w will be able to be used on the iPhone 3GS for you unlockers! (In fact, without any modifications whatsoever!)

Important: Apple has not given up on the cat & mouse game, and in fact there are challenging aspects of the 3GS jailbreak that aren’t in the other devices.  It’ll take some time to safely work these into our tools, but the fundamental weaknesses are there:  The bootrom is exploitable via 24Kpwn, and the baseband is exploitable via ultrasn0w.  (And just like with the 3G, ultrasn0w for 3GS requires that you not update your baseband when Apple comes out with new firmware.)

(via iPhone Dev Team Blog)

The following was taken from the iPhone Dev Team Blog where they have posted a summary of how they feel about the iPhone 3G Unlock and their plans for Yellowsn0w and a permanent iPhone 3G Unlock similar to the iPhone unlock.

“What a week it’s been for the 3G unlock!  Here’s where we’re at:

Past

• As predicted in our beta release post, expanding yellowsn0w from dev team testing to worldwide usage revealed some unexpected situations.
• Thanks to specific feedback from you on our reporting page, we’ve been able to tweak the method by which yellowsn0w injects the unlocking payload.  We believe we’re converging on a method that works
  for most cases.

Present

• The current beta version of yellowsn0w is 0.9.6, available via Cydia.  Please refer to our beta release post for more technical info about how to install and use it.
• Although ultimately the payload is the same as in the very first beta, we’ve changed the way that it’s injected into the baseband.
• Although some of you have invested time and energy in coming up with a very specific flow that works for you, the best way to first try 0.9.6 is as-provided, straight out of the box with no special usage
  around it.
• Please continue to provide feedback on our reporting page so that we can iron out wrinkles.

Future

• One major feature we have left to provide support for is PIN locking.  We have dabbled in this a bit and think we have a solution, but want to make that a separate effort from making yellowsn0w work
  with as many SIMs as possible.
• At that point, we can probably declare yellowsn0w out of “beta” status.
• The “permanent” unlock is still the ultimate goal for some of us.  We’d like to break the chain of trust a bit earlier in the boot process (if only for the fun in trying).“