Update #2: Finally got to the bottom of this, thanks to Saurik who clarified it for me. It seems that more shsh are on file and even some of you that havent ever jailbroken and just got a new iphone may actually have an shsh on file. It’s definitely worth a try to set up Saurik’s signature server in your hosts file and try to restore that way. You may get lucky and get a downgrade even on a new device.
Update: It seems this method is very hit-and-miss. So far, only users with 3gs have claimed it works. Personally, I am still a bit skeptical. However, there is some compelling evidence to think that there is some level of success with this. Semaphore, author of Umbrella, has written a good post saying that this method is impossible. I also originally thought that, but there’s a point in Semaphore’s post that he does not address, and this very point is what made me write this blog entry last night.
Semaphore claims that the users must have had an SHSH on file. That when they used Saurik’s server, it responded with the SHSH on file and that’s why the restore works. When CodeBlue presented this method last night, I told him the same thing. But multiple users are presented with the “make my life easier” dialog in Cydia after doing this method. Make my life easier will never appear if you already have an SHSH on file for any firmware. What people don’t realize is that once you make an SHSH request in Cydia, it’s a one-time deal for life. You are requesting SHSH on file for every firmware starting with the current one being signed. It does not matter what firmware you are currently running. If your restore worked because, as Sempahore’s post indicates, you had an SHSH on file already, then when you loaded Cydia, you would see the SHSH on file for xxxxxxx screen and you would never see the “make my life easier” screen.
All that being said, I have not personally tried this. I cannot confirm personally that it has worked. I have talked with several people that claim it has worked and many that saw “make my life easier”. At this point, either this method does work sometimes, Apple is accidentally signing 4.0.1 for 3gs intermittently, or the people claiming success are lying and did not see make my life easier.
A user named CodeBlue has discovered an unconfirmed method that may allow you to downgrade your 4.0.2 iPhone to 4.0.1, jailbreak, patch the safari exploit with Saurik’s patch and be jailbroken safely. This may be your only option if you have an out of the box iPhone with 4.0.2 on it and no other way to jailbreak. Note that I did not try these steps. They sound good to me in theory and others are reporting some success. After all, you have nothing to lose if you are already stuck on 4.0.2 without an SHSH in Cydia. Here are the steps:
1. Download 4.0.1 ipsw
2. Extract it with winrar or winzip to a folder on the desktop. You may need to rename the firmware file from .ipsw to .zip to do this.
3. Open the buildmanifest.plist with the notepad. Search and replace all – 8A306 with 8A400. Save. Repeat the same with the file restore.plist
4. Download 4.0.2 ipsw and open this with winrar or winzip. Note: do not exact it. Just open it and leave it open. You must use this exact file and not create a new one. If you have to create a new one for reasons like you are on OSX, then use zip command line not explorer or finder to make the zip. I will assume you are using the original file opened in winrar for the rest of this guide.
5. Take all the files from the 4.0.1 and drag them over to the 4.0.2 zip archive that you have open.
6. Delete all the dmg files that have 002 at the end, leaving only the 001 files left.
7. Save the archive. And rename it back to .ipsw if you changed the name to get winrar/winzip to open it.
8. Optional: (this helps ensure you get an shsh file request for the future, but should not be necessary to just restore 4.0.1). Add the 18.104.22.168 gs.apple.com line to the host file. If you need help with this step, read this.
9. Put the device into dfu, open iTunes and restore the firmware you changed.
Check out the original post or give thanks to CodeBlue at his blog.
Note: this only works due to the similarities in 4.0.2 to 4.0.1 and 4.0. This will not be a way to downgrade to 3.1.x and may not work in future firmware updates.