Abstract

You are using an iPhone 4 and you coincidentally updated to iOS 6.1.3, which cannot be jailbroken at the moment. Since you saved the SHSH blobs you think you can restore by doing a replay APTicket attack with TinyUmbrella or Cydia. Sadly iTunes shows errors like 1600, 1601, 1602, 1604 etc.

If you have an iPhone 4s or iPhone5 you can stop reading here. This article will not be able to help you. The iDevices with an A5 CPU or later cannot be downgraded with replay attacks at the moment.

What we got

• iPhone 4 with A4 CPU
• SHSH Blobs for iOS 6.0.1
• SHSH Blobs for iOS 6.1.2
• SHSH Blobs for iOS 5.1.1
• a Snow Leopard 10.6.8 driven old Mac Book Pro (first with iTunes 10.7 then with iTunes 11)
• a Windows 7 driven desktop (with iTunes 11 first and then with iTunes 10.6.3)
• TinyUmbrella 6.12.00 for Windows and Mac
• redsn0w 0.9.15b3 for Mac
• iFaith 1.5.5 for Windows
• evasi0n 1.5.3 for Windows and Mac (we never got to the point to use it)

What we tried

1.Restoring with replay attack

1.1. Restoring iOS 6.1.2 with SHSH blobs (replay attack)

1.1.1. using TinyUmbrella 6.12.00

=> no success neither on Windows nor on Mac

1.1.2. using Cydia‘s Blob repo (hosts file edit to 74.208.105.171 gs.apple.com)

=> no success neither on Windows nor on Mac

1.2. Restoring iOS 6.0.1 with SHSH blobs (replay attack)

1.2.1. using TinyUmbrella 6.12.00

=> no success neither on Windows nor on Mac

1.2.2. using Cydia‘s Blob repo (hosts file edit to 74.208.105.171 gs.apple.com)

=> no success neither on Windows nor on Mac

 

2. Creating custom firmware (CFW) 6.0.1 and 6.1.2. with integrated SHSH blobs (stitched CFW)

2.1. using iFaith

=> created stitched CFW successful
=> 9 in 10 times iTunes stopped w/ one of the errors mentioned above
=> 1 in 10 times successful restore on Windows with iTunes 10.6.3, but when it tried to reboot for the first time after installation, the device stuck in pwned DFU mode

2.2. using redsn0w

=> no success, redsn0w currently neither supports CFW for iOS 6 nor stitched CFW for iOS 6.x

 

3. Currently known Workarounds (March 23, 2013)

3.1. Go back to iOS 5.1.1

=> requires having the 5.1.1 blobs (!!!!)
=> easy going with redsn0w’s integrated restore function (which sadly not yet supports iOS 6)
=> easy going with redsn0w’s fully simplified jailbreak process

3.2. update to iOS 6.1.3

=> you will lose the jailbreak, but have the latest iOS version installed and your iDevice works as Apple wants it to function.
=> you’re only choice if you don’t have the iOS 5.1.1 blobs.

 

Conclusions

To make things short and save your precious life time: at this very moment it looks like you cannot go back to iOS 6.1.2 or 6.0.1 for instance. Although technically theoretically possible that iDevices with A4 CPU should be able to be downgraded we could not successfully downgrade to an iOS 6.x version. No matter what we tried.

[Tiny update march 23, 2013]
We were hinted at trying to edit the hosts file (74.208.105.171 gs.apple.com) directly. But as written above that doesn’t work either atm. All our hopes are with the iPhoneDevTeam to update redsn0w and integrate the restoring functionality for iOS 6 firmware so that we don’t need to temper with iTunes…

Picture is courtesy of NeoZone.org.