Wow that was quick! The iOS 4.0 firmware was released barely half an hour ago and the Dev Team have already released an update to their Yellowsn0w unlock allowing iPhone users on iOS 4.0 to unlock their devices!

The iOS 4.0 firmware comes with 05.13.04 baseband which is now supported with Yellowsn0w.

How to get it:

You can get the Yellowsn0w unlock by adding the following source to Cydia:

repo666.ultrasn0w.com

How to use it:

Install it and then reboot and your iPhone will be unlocked.

MuscleNerd gives the following tips for unlocking your iPhone on iOS 4.0.

You might also need this if you are not already jailbroken.

How to Jailbreak iOS 4.0 PUBLIC RELEASE Firmware for iPhone & iPod Touch

The Dev Team have come to the rescue for all the iPhone developers who had to update to iOS 4.0 but want to update. They have released a new version of Yell0wsn0w (version 0.92.1) which supports 04.26.08 baseband and iOS 4.0.

Version 0.92.1 of the ultrasn0w unlock is meant for those with baseband 04.26.08 running on 4.0GM. It does not use any new exploits, it merely fixes a logfile permission problem.

A new ultrasn0w capable of unlocking 4.0′s baseband isn’t yet released because both the final 4.0 and iPhone 4 are coming out next week. Please be patient.

If you’re running baseband 04.26.08 on 4.0GM, you can install ultrasn0w by adding http://ios4.ultrasn0w.org to your Cydia source list (do not use the repo666.ultrasn0w.com repo because that still has the older version 0.92). Note: ultrasn0w is spelled with a zero, not the letter “o”.

Ultrasn0w….

• Works on both 3G and 3GS
• Works on hacktivated devices
• Works regardless of how you jailbroke your device
• Doesn’t patch any mach-o binary whatsoever.  (Doesn’t require a separate patch as each new firmware comes out).
• Doesn’t install any additional daemon
• Has no race conditions, no popups about “Missing SIM”, no network issues
• Is almost 7000 times smaller than its nearest competition
• Is available now via Cydia.  Source repo is http://repo666.ultrasn0w.com (that last “0” in ultrasn0w is a zero!)

Here is the Dev Teams long post explaining exactly why their unlock is better than GeoHot’s:

The day before yesterday, some fellow named geohot released a program called “purplesn0w” which claims to be a better unlock than our ultrasn0w unlock released last month, and our yellowsn0w unlock released 7 months ago. He was kind enough to provide source, which we naturally took apart to try to validate his claims.

We’ve found he had come up with two pretty neat ideas, one more pragmatic than the other for the iPhone.  The first is a way of patching the actual text of the baseband code by copying it over to RAM and then using the MMU and page tables to have the baseband pretend it is part of the original bootrom. Of course, like yellowsn0w and ultrasn0w, this code has to be reloaded with every reboot of the baseband. However, the advantage of this is that developing unlocking payloads is a lot simpler… in fact, geohot used the same payload in AnySim and BootNeuter. We kicked around this idea ourselves before, but eventually found a work-around for the same problem with the yellowsn0w/ultrasn0w payload. The two pieces of code have the exact same effect on the baseband… with the difference that geohot’s exploit overwrites an arbitrary block of memory one megabyte in size. The baseband has a total of eight megabytes of memory and every bit of it is earmarked for use (except for 485212 bytes of it which we haven’t accounted for yet, but that’s still less than 1 MB). This means that eventually the area of memory geohot is using will be corrupted and 1 MB of baseband code will be corrupted (until the next reboot). How soon will this happen? Will it even matter in day-to-day use? We don’t know, because we haven’t spent much time looking. However, why take the risk when the yellowsn0w/ultrasn0w payload accomplishes the same job with no corruption?

To put it into perspective, ultrasn0w uses 152 bytes of properly malloc’d baseband RAM, which is 0.015% of what purplesn0w uses.  Put another way, purplesn0w uses 6900 times more RAM than ultrasn0w (and doesn’t let the O/S know that it’s using it, so the O/S still thinks it’s free to use.  When it does use it, the baseband will crash).

Now, the second new idea he had was to patch CommCenter rather than use a daemon. At first, this idea seemed pretty distasteful to us. Binary patches are messy and difficult to maintain (we figure it’s partly why he only made a version for 3G S and not 3G as well). In addition, the stated reason of reduced battery life with a daemon is factually incorrect, since any computer science student who’s taken a course in operating systems will tell you that a sleeping task takes up exactly NO CPU resources and NO power (it’s merely skipped over during context switches). That’s right: not “only a little” power, but absolutely NO power. However, ultrasn0w 0.6 did have a problem where the STK refresh command it used crashed the baseband in 3G S. This caused the baseband to continually come up and then restart. That DOES take power and so may explain the issues that people have been seeing. ultrasn0w 0.8 was supposed to have fixed this issue, but perhaps not completely. This is because the STK refreshes we used are inherently unreliable… but we thought they were necessary to avoid people having to reinsert their SIM. Turns out we were wrong on that score. geohot’s method shows that we can perform the unlock before CommCenter polls for lock state. When we do it before (instead of after), the STK refreshs are no longer necessary! The only way to do it before the polling, however, is to modify CommCenter.

We’ve tried to make the best of a bad situation by using MobileSubstrate to perform the modification. This lets us modify the behavior of CommCenter without touching the actual binary. We also used a method to dynamically locate the patch location so that it should work on both 3G and 3G S (and should need to be updated less frequently). We also do it in a different way so that hactivated phones will work with the unlock (unlike purplesn0w). You’ll find that this update is now available through Cydia as ultrasn0w 0.9 We thank geohot for contributing to the scene once again. We don’t think purplesn0w is the right path, but it has certainly helped us improve ultrasn0w!

P.S. geohot, seriously, stop dicking around and look at the bootrom instead kthx. =P

Via

PoweryBase claim that when you use Push notifications, the iPhone contacts Apple’s servers to obtain a Unique ID to make the connection for Push notifications and the server are not giving the unique ID to 3rd party unlock phones.

When the Push based application such as NotifyMe requests an ID from APNS, the server responds within a second and identifies the device with the unique token. From that point, the connection between APNS and user’s device is successfully established,” said Pavel Serbajlo, PoweryBase’s lead developer. “However, on a unofficially activated device, APNS keeps the application wait forever and does not provide any respond at all, keeping user wait infinitely or time out the connection, if the target application is capable of timing out.

PoweryBase have recommended people with unlocked iPhones to not download any push enabled appilcation until a fix is found.

Dev Team have announced on their Twitter that they are working on a fix but for now, do not download push enabled app if you have a 3rd party unlocked iPhone.

We have a trial fix for push notification on hacktivated iPhones http://bit.ly/FxBtZ . We’ll polish it up but need feedback.

Source

This app only works with the iPhone 3GS and on legit-activate iPhone 3GS.

It’s not a daemon that takes any resources, and it doesn’t add a task to your baseband. It’s very close to a true unlock. All it does is patch three files, CommCenter, lockdownd, and your wildcard activation plist(which you need, activate w at&t sim first, no hacktivation support yet).

GeoHot says his payload for this unlock is radically different and much ‘cleaner’ than other sn0w products (Ultrasn0w) out there.

He also reminds as all that this is in BETA so backup first.

Here is how to do it. Remember you need an iPhone 3GS that is Legit-activated. Don’t forget to disable 3G if you are on T-Mobile

1. Add apt.geohot.com to Cydia
2. Install com.geohot.purplesn0w
3. Watch for success output in Cydia
4. Reboot, and enjoy your unlocked iPhone

You now have an unlocked iPhone 3GS.

Here is a copy of the demonstration if you missed it (start the video at 2 mins):

www.youtube.com/watch?v=kd5vOy2m5uY

More info:

• Only ultrasn0w is going to take til Friday to get pushed out.  All of our other tools should be out pretty soon after the official Apple release.
• If you apply our jailbreak when it comes out, you can install ultrasn0w anytime after that.  You obviously won’t have cell service in the meantime, though.
• This may in fact be directly applicable to the iPhone 3GS if it can be jailbroken, because it runs the same baseband version.  Whether or not it can be jailbroken is a big question right now!
• If you’re on Twitter, please give @Oranav a pat on the back.  He could have revealed the crash he found to Apple and maybe gotten quite an incentive in return. Instead, he told us about it so that we could work it into an injection vector for the soft unlock.

Source

Here is the full message from their website:

As anyone reading this blog must already know, this is the big week where Apple releases their official 3.0 FW to the public (Wednesday), and then the new iPhone2,1 hardware, aka the iPhone 3GS (Friday).

On Tuesday evening (just before the big Apple release) we’ll do a live demo of the yellowsn0w carrier unlock working on official 3.0 firmware. The actual link for the feed will be twittered by @MuscleNerd and also placed here when the feed starts.  The demo should answer everything you need to know about the new yellowsn0w.  But it’s good news for iPhone 3G unlockers everywhere.

Meanwhile, we’re in the middle of testing our PwnageTool and QuickPwn tools, which will work with iTunes 8.2. The jailbreak of course continues to work on 3.0 for all devices it ever worked on, thanks due the Pwnage 2.0 technique released last summer.   Our tools will be released no sooner than the Apple release (just in case!).

P.S. For the new iPhone 3GS, please don’t expect periodic updates about any progress we have or don’t have.  Nothing gives Apple the upper hand like someone tweeting or blogging partial hack results.  That’s not how cat & mouse is played  That’s how the cat gets fed.

From the Dev Team’s blog:

These are very exciting days ahead!  WWDC, the new 3.0 firmware, the new iPhone2,1 device.  All in the span of a month or two.  Nobody is more excited than we are

Unfortunately, there are predators out there that are counting on your over-exuberance.  Maybe we should call it yell0w fever.  One very recent example is a certain yellowsn0w221 page on wordpress.com.  Do not download anything from that page if you’re on a PC, else you’ll be infected with a virus.  The page talks and talks about a supposed Firmware 2.2.1 yellowsn0w exploit, but it’s all a ruse to get you to download and infect your PC.

We’re used to (though still aren’t happy about) less predatory websites, like quickpwn.com.  That site (1) is not us. We don’t consult with them in any way (2) makes money from their Google hits (they’re usually near the top) (3) sometimes gives very very bad advice (like tweeting yellowsn0w users to use QuickPwn on 3.0 betas.  Bad suggestion).  (4)  also owns yellowsn0w.net, another money making website.

The wordpress page, though, is at another level.  It’s out to 0wn your PC for spamming purposes.  Please be on the lookout for any pages that mention “dev team” news that you don’t actually see on this blog first.  We are very good at not leaking sensitive info (since that really wrecks this whole “cat&mouse” thing).  So no blog or forum or youtube page would have any “insider” dev team knowledge that you won’t see announced here first.

About the unlock (the real yellowsn0w): you all paid lots of money for your iPhones, and so we know that if you are depending on a software unlock, this is a sensitive issue.  It’s a very sensitive issue to us too, which is why we can’t say or release anything prematurely that could potentially compromise any 3.0 software unlock.  The commenters on this blog that have high ratings (20 or above) understand this intimately so please listen to them when they try to assist those waiting for any unlock

This downgrader was released by a certain pH and is called pHaseBanDowngrader. It allows you to downgrade your baseband from 02.30.03 to 02.28.00.

This will only work if you have Bootloader 5.8 on your iPhone. If your iPhone was manurfactured before September 2008 you have 5.8 so your OK but the ones who’s iPhones had 2.2.1 when they bought it will have 5.9 so this will NOT WORK FOR THEM.

Here is the instructions on how to work the downgrader:

1. Download the .zip in the end of the post.
2. SSH into your iPhone and put the downloaded folder (phasebandowngrader) inside the folder /Applications/.
3. In MobileTerminal.app, type “login” and enter “root” as user, the default password is “alpine”.
4. Now, type “cd /Applications/phasebandowngrader && ./phasebandowngrader”. Follow the screen instructions.
5. Enjoy!

Click to download: pHaseBanDowngrader (88)

ENTER OUR COMPETITION AND WIN FREE COPIES OF APPSTORE GAMES AND APPLICATIONS

The iPhone dev team’s 3g unlock, yellowsnow is out. There are some changes in how it works. The 3g unlock will require you to be on baseband 2.28.00 which comes with iPhone OS v2.2. This means that those of you that pwned your iPhone to 2.2 without a full restore will now need to restore to 2.2 directly in iTunes so that your baseband gets updated to 2.28. You can check your baseband version in settings, general, about menu. Look for modem firmware. This is beta. If you have a working SIM adapter solution, I recommend that you do not update your baseband and try this. Here is a brief set of steps for those that need a 3g unlock:

1) You must be on 2.2 with modem firmware 2.28.00. If you are on 2.2 firmware but used pwnage you probably have baseband modem firmware 2.11.07 (from 2.1) or something earlier. This will not work. SO first step is to check your modem firmware: settings, general, about, read modem firmware. If you are on 2.28.* then you are done and can skip to step 3.

2) Restore to 2.2 (download) in iTunes and jailbreak with Quickpwn (Mac or Windows). You cannot use pwnage for this. You must restore in iTunes stock. Pwnage disabled baseband update. It will not help you.

3) After you are jailbroken repeat step #1 to verify you are on 2.28.00 modem firmware. If so, fire up Cydia and go to sources and add the dev team’s cydia source. (Note: dev team asked for no one to link the source directly. You can get the link from their post here at the bottom under “Release Info” heading).

4) Install yellow snow app and reboot your iPhone with your new sim card installed. Wait 60 seconds or so for carrier lock. If it doesn’t connect, try pulling the sim and inserting again and waiting another 60 seconds.

Note this is an unobtrusive unlock. In the past, the baseband was flashed. There is no baseband flashing for this. It should be safer as nothing is being flashed so nothing can be bricked. The unlock installs an activate daemon that runs on boot. This actively injects necessary data to keep the device unlocked. If you uninstall the unlock you should be back to where you started without any harm.

This is still in beta stages and actively being developed. If it’s not working well for you check back in Cydia every few hours and see if there is an update.

Check the dev team blog here for details, news and updates on this.

Troubleshooting:
For those that cant get this to work, and don’t want to wait for dev team to stabilize it, you can try messing with it in the command line. Reboot iPhone with no sim card inserted. Pull up mobile term and type: yellowsn0w -s and then insert the sim card. Wait a bit and it should connect.

Also make sure your SIM PIN is disabled.

Quick question and answer:
Q: Will this risk ruining my baseband?
A: No, it does not flash your baseband. It is a program that stays running on your iPhone. It is safe.

Q: Does the daemon take up a lot of CPU or drain the battery?
A: Probably not. It seems to say 0% cpu and 600kb RAM used. I would not worry about it for now.

Q: How can I update my baseband to 2.2 without restoring in iTunes
A: Right now you cannot. Maybe later someone will release something with bbupdaterextreme and a fls image but no such package is available, has been developed or tested for you.

Q: Can I use pwnage instead of quickpwn?
A: No, pwnage disables baseband update. You must restore a stock firmware image.

Q: Where do I get the firmware image?
A: If you click restore in iTunes, iTunes will automatically download the latest firmware. Or you can get it from my firmware page.

Remember this is still beta software so if it is not working well, it is likely not something you did wrong. Check for updates.

Via BigBoss

How would you explain what the iPhone Dev Team is?

The iPhone Dev Team is an international group of technologists that like to hack (in the exploratory and problem solving sense) and modify the iPhone in order to perform functions that the iPhone was not designed to do on day 1.

In a vague sense (for the sake of anonymity), who is the iPhone Dev Team?

A bunch of geeks who love taking things apart and seeing how they work. When we work out how it works, we make tools and utilities for ourselves and share them with the rest of the world.

What would you say is the average age of the team?

About 32.

You guys are located all over the world – how do you manage to get anything done?

We communicate over IRC (Internet Relay Chat), which is great as it is a tried and tested collaborative working environment. This allows us to talk to each other and cut and paste ideas, code fragments or other information that is relevant to the projects that we are working on. Usually the IRC clients of each member are running in the background, rarely disconnecting. This ensures that we can all read what happened while we were asleep or at a meeting – we can scroll up the screen and see what is going on. We use a file transfer application on a fileserver so that any of the members can check on the status of a particular project or download any of the working files.

Is there any real “leader” or team hierarchy?

No, most definitely not. We vote on major changes of direction or something that is a big-deal and that could cause any drama or hassle. Members complete tasks that are within their expert field. This self-regulation works very well and allows the team members to work together efficiently, the workload is distributed and we can get tasks completed quickly. This was demonstrated in real life (and in person) when we took part in the Chaos Communication Congress Capture The Flag Competition in Berlin. We won the competition with a fairly large lead. For most of us this was the first time that we had taken part in such a competition.

It’s a ton of work split up amongst a number of people – is there much drama, internally?

We have had some drama in the past, but as I mentioned in the previous question, we work together very well. Arguments are rare as when you are communicating via IRC you have to think about what you type. This gives you a second or so more to analyze your statements than if you
just blurt them out of your mouth in an office

What sparked your interest in tearing apart the iPhone?

The same interest that I had with tearing apart my Speak & Spell as a kid, then my Tandy CoCo, then my Atari ST. I want to see what is inside and see if I can make it better. If I find something cool I tell other people about it.

Rough estimate – how many people would you say have jailbroken their iPhone using Dev Team tools?

It’s hard to say because over the last 5 months we’ve moved to distributing the applications using BitTorrent, and we don’t have any real download stats. We do know that there have been 3.6M Sparkle requests since the 16th of July (a Sparkle request is a check for an update from our server). Considering most people don’t use our tools very often (only when there is an update from Apple), that is a fairly large number.

It seems like a relatively thankless job – what’s the motivation?

It’s a hobby. It’s fun. Some people relax with a fishing rod or book, most of us enjoy using our spare time in front of a terminal, disassembler or soldering iron.

I’d assume that the majority of team members at least have an iPhone – but do most carry it as their primary handset? Are any other phones or devices popular amongst the team?

Yes, all of us have an iPhone, most of us have several handsets and lots of other PDAs and gadgets. Before the release of the iPhone I used to use Symbian devices (mainly Nokia) and I would always be
looking for the next device, the next upgrade, the next vendor. These devices held my attention for a couple of months and I’d be spending my money on a new handset to get the next gadget high. This all changed with the iPhone, for my needs it is an almost perfect device, my eyes have not wandered at all.

Does the team have a general opinion on the way Apple has handled the App Store and third-party development? If not, how do you feel personally?

The development environment is great. Apple supply tools for free that can be used straight away, and the tools are feature rich and very slick. It’s a great way to get people developing for the platform. For someone who wants an easy 1-click way of getting apps onto the iPhone, they’ve done a great job with that application delivery method. It is also fantastic for developers as they can code and deploy an application without investing in large server infrastructure, they can design something and release it (and as we’ve seen in the press recently) make lots of money. .

However, Apple places restrictions on what you can run on the device. They impose draconian restrictions on the type of application that you can run, they don’t allow applications to run in the background and they even restrict the applications by subject matter or if they compete with their own applications. If I buy a device I want to be able to do what I want with it, if that involves gambling or looking at an application that involves porn then so be it. The real estate agent who sold me my house doesn’t knock on my door every month to check what pictures I have hanging on the walls, so why should Apple have this right?

What do you think about Android?

Android is great. Some of our members are already working on the Android platform and they like it. It is great to have another UNIX-like operating system that is getting widespread adoption. I think it has quite a bit of catching up to do before it has the slick user experience of the iPhone, but I’m sure they’ll get there.

Outside of the unspoken game of cat-and-mouse with each firmware release, has Apple ever made any sort of official contact?

No, Apple leaves us alone. We expect them to fix the bugs that we use to install the software and manipulate the iPhone in the way we want, and as you say this is the only acknowledgment and response they’ve made. We love Apple, and we love their products (I have 4 expensive Apple
products on my desk right now). We link to them on our blog as a “friend” and we hope it stays that way

Have any Apple employees ever dropped any off-the-record insight?

No.

Is there currently any hope for a post-2.2 unlock?

We believe the internals of the iPhone 3G BaseBand will be vulnerable to our patches in the future. We need to find a way of injecting these patches into the BaseBand with newer releases as we expect the method we are using now to be fixed.

Is there a story behind the unlock’s nickname, “yellowsn0w”?

Apple likes snow and ski related codenames for parts of the iPhone software, they’ve used BigBear, LittleBear, SugarBowl, Timberline etc, so our little appname comes from “Don’t eat yellow snow!”

How many man hours would you say went into making yellowsn0w happen?

There has been constant work on the iPhone 3G device since they released it. This workload is hard to estimate, but lots and lots of hours.

After the original iPhone was unlocked, a gray market of international iPhone sales sprung up. A good number of people were making a fairly hefty chunk of change – didn’t that make anyone on the team feel ripped off?

Not really. We don’t care what people do with the devices they modify with our software, but we really do hate anyone passing off our software as their own and charging for it. We specifically forbid this but there are companies who just rip us off. They’ll have their comeuppance!

Toying with the baseband is serious stuff – have you guys ended up with many Apple-brand paperweights?

This happened in the early days, but we have a good understanding of the processors and architecture used in the devices, we are extra careful!

What’s next for the DevTeam?

Releasing yellowsn0w and then partying, we’ll see what 2009 brings us!

Interview from MobileCrunch.com