iOS 4.3 Beta 1 jailbreak is possible without PwnageTool

So iOS 4.3 beta 1 has been released to iPhone developers. And the claimed PwnageTool jailbreak came with it. BUT! The PwnageTool jailbreak does not work (at least not for me), and I've confirmed this with numerous restores, consistently receiving 'Error 1600'.

But that's not the end.


I have just found out that redsn0w 0.9.7b4 is perfectly capable of jailbreaking the new iOS version (albeit Cydia cannot be installed) on the iPhone 4. I can confirm this only on a Mac (I'm using OS X 10.6.6). There is a baseband update (04.08.00), so unlockers don't you dare continue reading.

I have a guide on how I did it (remember, Mac-only, I cannot confirm this method on Windows). But before you carry out these steps, remind yourself that, unless you are a geek, don't try this. I am not responsible for your brand new, shiny iPhone 4 exploding, setting your house on fire, or turning off gravity. PROCEED AT YOUR OWN RISK! 

Prerequisites:
1. Download iOS 4.3 beta 1 for iPhone 4 (I'm sorry, I cannot provide a download link as I am not authorized to redistribute Apple's beta firmwares, but google is your friend).

2. Download redsn0w version 0.9.7b4 (I have only confirmed this with 0.9.7b4, nothing else) here.

3. Download iOS 4.2.1 for iPhone 4 (as this is what redsn0w recognizes and retrieves the files to patch) here.

4. Make sure iTunes is up to date with version 10.1.1 (just go to  --> Software Update).

5. You'll need PhoneDisk to do this (I couldn't get it to work with iPhone Explorer, but someone may be able to do it).


The process (if the terms DFU mode and root filesystem mean nothing to you, you're not a geek, leave now, because you aren't ready to do this :P):

1. Fire up iTunes, plug in your iPhone 4, put it in DFU mode (you better know what this means if you are attempting this tutorial).

2. Do a custom option-click restore and restore the device to the iOS 4.3 beta 1 firmware that you somehow obtained.

3. Wait for the restore to complete.

4. When the phone reboots, you'll see the usual 'Slide for Emergency call screen'. This is normal.

5. If you aren't a registered developer, iTunes will reject your device as 'unregistered' and your device is officially bricked (JUST KIDDING). Here's where the actual jailbreak to bypass this locked screen comes in.

6. If you have ever jailbroken a beta firmware to bypass UDID registration, you may recall chaning the SystemVersion.plist file to achieve this hack. We will be performing this hack on this firmware as well.

THE JAILBREAK (the scary part)

7. Launch redsn0w and browse for the 4.2.1 firmware. This is the firmware that redsn0w uses to extract and patch the boot files.

8. Click 'next' and uncheck everything (including Cydia because installing Cydia does not work, I have found out from experience.) Make sure your device is off and click 'next'.

9. Click 'next' again and follow redsn0w's directions on getting into DFU mode. Then wait patiently as it exploits the device.

10. Wait for the scrolling machine output on the iPhone. You will eventually get to a blank screen, the device will freeze. Don't panic. Hold down the home and power buttons to reboot the device.

11. Launch PhoneDisk (or iPhone Explorer, whichever you are using). Wait for the device to finish booting. It will get to the 'Slide for Emergency Call' screen again. Don't worry about it now. Go to PhoneDisk (or iPE) and navigate to '/System/Library/CoreServices/' and in here you will find a file named SystemVersion.plist. Open that file in a text-editing program and delete the following strings:

<key>ReleaseType</key>

<string>beta</string>

Deleting these strings will trick iTunes into thinking that this is an official firmware release, and not a beta.

12. This part is what got me stuck at first, but this was because I checked 'install Cydia'. Reboot the device now. iTunes should let you access it now without bothering you about UDID registration.
You can now hit 'restore from backup' and enjoy using the device as usual.

So there you go, jailbroken iOS 4.3 using a 4.2.1 firmware bundle. It's kind of useless right since you cannot install Cydia, but the proof-of-concept is there: iOS 4.3 beta 1 is still vulnerable to the same exploit that jailbreaks 4.2.1. The root file system is accessible to the user now. And you have 4.3 beta 1 without UDID registration. And it's untethered. This is the process that worked for me, but it may not work for everyone. And again, this is ONLY on a Mac.

Go ahead and post comments, corrections, rants about how this didn't work for you :P and success stories. Go discover new features in 4.3 that weren't in 4.2.1. I'd love to post screenshots, but at the time of writing this post, my iOS 4.3-powered iPhone 4 is syncing with iTunes (re-syncing everything back from the restore).

Cheers! (and please don't burn your house down or anything)

Thanks to iPhone Dev-Team for their super-awesome redsn0w program :)