Jailbreak your iPhone

How to Downgrade iPhone 3GS OS 3.1 to 3.0 With Cydia SHSH


As promised earlier, Saurik made iPhone 3GS Downgrade/Restore to 3.0 possible. Today Saurik posted on his blog in a more detail about this hack, for Saurik post click here. The hack is useful for only those peoples who submitted their SHSH to Cydia Server before the release of OS 3.1 via Cydia’s “make my life easier” button. According to Saurik “over 50,000 3G[S] devices got their ECID SHSHs “on file”, and are now prepared to continue to restore to iPhone OS 3.0 indefinitely.” The process is very simple all you have to do is to add Saurik’s Server address to your system hosts file. This trick make iTunes thinks it is talking to Apple, it is talking to Cydia instead while the restoring process. Doing this will allow iTunes to access signatures already stored by Cydia’s “on file” feature. In simple words this duplicates the functionality exposed by Apple’s signature server, except using “on file” results rather than live requests.

If you aren’t aware of ECID, Cydia SHSH then read the following to understand what ECID is and why you need to dump your Signature files.


ECID : This is a unique chip ID and will be different for every iPhone. When iTunes starts the restore process, they contact Apple servers to generate signatures just for your device. It’s important you get these signatures for your phone before a new version of the software comes out.

Why i need ECID SHSH Dump : Apple added a new piece of security called ECID, The nature of the 3GS hardware allows Apple to stop IPSWs from being usable unless you’ve already gotten the signed chunks they send to you based on your ECID (a unique chip ID). Actually Apple applies ECID so the iPhone will refuse to accept the ipsw file while downgrading because of a bad signature. It will treat it as a custom ipsw without having the apple server sign the ipsw specifically for your phone id before flashing.



  1. This process is only for those who saved their SHSH to Cydia Server already.
  2. Don’t use this procedure for 3.0.1, because Saurik Server do not have signatures for 3.0.1
  3. Read the process and Saurik post two-three times before starting the process.
  4. If you upgraded to 3.1 then wait for Pwnage tool for Jailbreaking 3.1, though your baseband is updated so chances of Soft Unlocking or UltraSn0wing your phone again are very less.


How to Edit and Save Hosts file in Windows

  • Open Notepad with Administrative privileges by clicking Start, All Programs,Accessories, and then right-click Notepad and select to open as Administrator.


  • Now that Notepad is open with Administrative privileges browse to (C:\Windows\System32\drivers\etc) in Notepad and open the hosts file, and add the following entry to the bottom of the file. gs.apple.com

Host in Notepad

Now you navigate to files menu and save the hosts file. By doing this you changed the communication server, and then we will ensure that iTunes checks the firmware on the server rather than opens Saurik to Apple! Because your ECID is on that server, the verification will fail and restore the previous version will be done without too many problems!


How to Edit and Save Hosts file in Mac OS X

  • Navigate to /etc and look for hosts file, right click on hosts file and open with Text Edit, and add the following entry to the bottom of the file.   gs.apple.com

Picture 1

  • Now save the file and click on Save As.Picture 2
  • Because Text Editor can’t save your system files, here comes the tricky part, in save as windows use the following settings. Or take a close look at the following image.
  1. In Where locate to Desktop
  2. Uncheck the “ If no extension is provide, use .txt “ and then press the save button.

Picture 3

  • A host file will be appear on your Desktop, just drag and drop to /etc and follow the onscreen instructions.Picture 4
  • Press the Replace and enter your PasswordPicture 5

By doing this you changed the communication server, and then we will ensure that iTunes checks the firmware on the server rather than opens Saurik to Apple! Because your ECID is on that server, the verification will fail and restore the previous version will be done without too many problems!


Now you can do your Normal Restore to 3.0 (with Recovery Mode) and Downgrading from 3.1 to 3.0 (with DFU Mode) as usual. For more details on Recovery Mode and DFU Mode read our previous article here.


To Downgrade iPhone 3GS from 3.1 to 3.0 :

Step 1: Put your iPhone in DFU mode with following instructions.

  • Connect your iPhone to your computer.
  • Turn iPhone off.
  • Hold power and home together for 10 seconds (exactly).
  • Release power but keep holding home until the computers beeps (observed on a PC) as a USB device is recognized.
  • A few seconds later iTunes should detect your iPhone.
  • If the Restore Logo is present on the screen, you are in Recovery Mode, not DFU.

Step 2: Once your iPhone is in DFU mode following message will be appeared in iTunes. Click on “OK” , Now hold Option key while clicking Restore in iTunes and browse the OS 3.0 firmware for your iPhone 3GS. Now the restore process will take 10 – 15 minutes.

If you get error message like 1011, 1013, 1015, just ignore them(Actually the firmware 3.0 is already successfully installed). For error  (1015) “Instead, we should accept the message and run a new restore exactly as you have just done. In short will: Re-Put the iPhone into DFU, re-select the Firmware 3.0, and wait. The process will fail again and iTunes will return the same message as before “The iPhone” iPhone “could not be restored. An unknown error occurred (1015). Do not panic because it’s completely normal. To resolve this situation can proceed as, Simply launch RedSn0w and do the Jailbreaking Unlocking process again.

But if you encountered with error message like 1601, 1602, 1600 or anything else then try putting the iPhone into DFU mode and try again.


Tags: , , , ,

Comments ( 58 )

Have Something To Say ?

  1. Prince September 17, 2010 Reply

    Please I have an Iphone 3G and currently on OS 3.1.2… I want to upgrade to 4.0.1 OR 4.0.2, but each time i try to it gives me the ERROR 3194 and when I tried the ITUNES bypass trick of redirecting itunes to a different server it gives me the 3014 error….. Please HELP with a solution as soon as u can… Thanks.

  2. gabriel May 17, 2010 Reply

    pls man can you explain step by step how to do it. I don´t get how do put my ecid file on cydia or on ur server.
    helps pls

  3. Pablo Mogatusi March 31, 2010 Reply

    I have an I-Phone 3GS tried to jailbreak it so that I can use it on orange network botswana but it was bought for me from USA. After I did the jailbreak it just writes that it can only call emergency numbers and does this while changing text language and there is no signal either. Please help.

  4. iriverclix March 28, 2010 Reply

    i have same problem any body find somethings!`?

  5. DaN igger March 27, 2010 Reply

    hey all i really really need some help
    i have 32gb iphone 3g s on 3.1.2 the phone will not boot apple screen for 10 min then just power off so i tryed the stpes above
    i have done all steps to the t.
    all i get is it cannot be restored divice not egilibe for this build.
    I am almost positive that I hit the make my life easier button. not sure what to do.
    some 1 plz help me out this isnt even my iphone i was using it b4 it got stuck in apple boot screen !!!!!!!!!!!!!!!!!

  6. rallis March 23, 2010 Reply

    i saved my shsh on cydia and have changed host file name but it still will not work? helpppppppppp plzzz

  7. stevo March 16, 2010 Reply

    you cannot downgrade 3.1.3 to 3.1.2 if you have not previously logged into Cydia to upload your SHSH.

    once more. If you just bought an iphone 3.1.3 your shit out of luck.

  8. annrhy March 15, 2010 Reply

    i did 10 times (DFU) but still 1600 error again and again! need help thnx.

  9. Vidit March 11, 2010 Reply

    Hi Vidit here,
    I have Purchased New iphone 3gs & updated with 3.1.3,pls help me to unlock this….
    it’s urgent pls…

  10. stevo March 8, 2010 Reply

    Old thread, but just saved my Iphone 3Gs 3.1.3’s ass.

    This procedure works fine still for downgrading 3.1.3 back to 3.1.2
    I used an IPHONE 3GS with 3.1.3.

    If your having issues with 160x errors, make sure your using official firmware from http://www.felixbruns.de/iPod/firmware/

    If you keep getting 1501 errors and are stuck in recovery loop after 2 restores (ie USB LOGO keeps showing after you restore) use ireb from http://ih8sn0w.com/index.php/welcome.snow (worked to get my 3gs out of recovery loop) to break this loop allowing you to JB.

    If you have no service or bars after this, i would suggest talking to your phone carrier and paying $20 to unlock the phone properly.

    FYI: this method failed for me the first time, tried it again and it worked, did nothing different.

    REMEMBER none of this will work if you didnt backup your SHSH via Cydia.

  11. Madr January 27, 2010 Reply

    I got someone to help me to jailbreak & unlock phone.I’m just abit concerened cause i’ve waited 2 weeks now & when i phone to collect, he says he has to connect to a wifi hotspot. I’ve been reading up on your site & u dont mention anything about this. Is this guy taking me for a ride? I’m thinking of getting my phone back & doing this whole thing myself. Not sure what firmware his put on now, but he did say its been jailbroken, etc…. Please help as his waisting my time of enjoy my new phone.

  12. Phyr December 17, 2009 Reply

    are all itunes compatible to run this restore?
    mine running on itunes

    i try and it doesnt work..

  13. rahul December 16, 2009 Reply

    hey guys … i just got a brand new 3gs with firmware 3.1.2 … purchased the iphone from hong kong and hence it was already ‘unlocked’ … was wondering if theres still any risk in jailbreaking … i also went through all the posts above and m really confused regarding the procedure for unlocking the 3.1.2 firmware … i need advice n help desperately !!!

  14. Kory November 22, 2009 Reply

    Hey murph, just wanted to let you know that you have to have appsync 3.1 downloaded from cydia to get cracked apps to instal onto your device. So, you will have to jailbreak.

  15. murph October 31, 2009 Reply

    halo, i got an ipod touch 2nd Generation.
    i have installed the Cydia and i can download as many application as i want to…

    now i just recently bought an iphone 3GS version 3.1 …
    i’ve been thinking, without jailbreaking my iphone, i try to get cracked application from my ipod touch and transfer it to itunes..
    everything works well..

    but then, when i try to to transfer all the application to my iphone 3GS 3.1, after the sync, then the error occur, saying that my application couldnt sync.. and not appear in my iphone..

    pls anyone. help me..
    and im also waiting for the jailbreak for iphone 3gs 3.1


  16. Viral October 26, 2009 Reply

    i am from india
    i have iphone 3gs by accidently its upgraded to 3.1 from itunes and iphone’s modem firmware is 05.11.07 … my phone is already jailbroken
    but i cant use my sim card in this phone
    it shows no sim thats it
    plz tell me how to unlock my iphone and when will i use my phone ?
    plz reply me

  17. efragon October 25, 2009 Reply

    I’ve tried this about 25 times, IT DOES NOT WORK!
    “phone not elegible for this build” thats all i can get from this procedure.

  18. raik October 18, 2009 Reply

    I got a 3GS and Cydia said I have a file on server. When I try to restore my phone it tells me that my phone is not eligible for build. I tried this in the DFU mode. in regular restore mode i get error 23, 1600, 3014. Mind you I have never updated to firmware 3.1X. Im was still running under 3.0.1. Reason why I want to restore my phone. I got a message which said that I have to restore. No wifi worked anymore, no GPS, no phone, no software.

    Any ideas here? PLZ????

    Oh it is a german phone as well…..

    Thank you lot’s
    Raik (the German)

  19. mohe October 15, 2009 Reply

    heeyz i have 3gs locked at 3.1 i did the blackrain Jailbroken and i go to cydia and it writes this device has a 3.0 ECID SHSH on file on the home screen actully i bought it from a guy who was havin it at 3.0 JB and so i never know coz the day i bought it it’s stuck while i do format for the media n i updated to 3.1 as i was new to iphone world . so :

    so am i good to go with this method ?? and doesn’t unlock the phone if it’s back to 3.0 or jst JB as long as my baseband is updated ?? and as u see i have that 3.0 SHSH in cydia

  20. vankoo October 7, 2009 Reply

    guys i have a iphone 3gs 32gb officially unlocked handset.. it’s firmware was 3.0.1.. accidently i updated it to 3.1,i just wants to install cydia (jailbreak) as though its already unlocked. how could i do that?

  21. tuky October 7, 2009 Reply

    @ David – Can u tell/show the procedure for iRecovey on windows please.

  22. antimonious October 6, 2009 Reply

    I still keep getting the same problem…
    Here is a picture with my ‘hosts’ file, as well as the error message I get in iTunes:

    Thanks to anyone that helps =D

  23. DavidN October 6, 2009 Reply

    Hey all,

    After many, many, many, many attempts, finally got it resolved. Here’s a recap of the solution.

    1. Changed host file. If you’re having problems and you’re getting the error message that you’re ineligible for that version of the software, try changing your host file to look something like this (note the first two lines were kept from the original hosts file to show context):
    # localhost name resolution is handled within DNS itself. localhost gs.apple.com

    2. Make sure you have the right IPSW file. This site has the files you’ll need http://www.felixbruns.de/iPod/firmware/

    3. Once the device has downgraded, I experienced the “1015” error. I followed the recommended instructions, however, the device got stuck in the Recovery mode. Use the iRecovery tool to fix this (http://www.ihackintosh.com/2009/07/irecovery-iphone-recovery-mode-loop-restart/). It’s important to get the device out of the Recovery loop before jailbreaking. What happened to me is that I downgraded, then jailbroke device, and my device wasn’t able to be activated on my carrier’s network. So before jailbreaking, make sure to get your device out of the Recovery loop, and verify you have network connectivity.

    4. Jailbreak with your tool of choice (I used redsn0w version .8).

  24. Mike October 6, 2009 Reply

    Guide worked like a charm with no error codes. But it did take a while to find hoe to access the hidden ETC files but after much online searching, I found that you simply have to open Terminal and paste the following text defaults write com.apple.finder AppleShowAllFiles TRUE
    hit enter then reboot and viola all hidden files appear. to reverse effects simply replace TRUE with FALSE

  25. Chris October 6, 2009 Reply

    DavidN, I did the same but for some reason osx (10.6.1) isn’t resolving the gs.apple.com ip from the hosts file. However if I ping gs.apple.com Saurik’s IP comes up? Strange.. I’ve flushed the caches etc.

  26. antimonious October 6, 2009 Reply

    I seem to be having the same problem as David above me. Every time I try this, before it actually starts the restore process, I get a message which states “The iPhone “iPhone” could not be restored. This device isn’t eligible for the requested build.”

    Is anybody else having this problem?

  27. tuky October 6, 2009 Reply

    @ David – Try editing the host.. single, double or triples spacing it.. then try again.

  28. Natasha October 6, 2009 Reply

    I have a 3G iphone running on 3.1 software.
    I downgraded to 3.0.
    Jailbroke using redsn0w.
    Downloaded 3.1 restore bundle.
    Pressed shift key+restore on itunes and selected the 3.1 software.
    After the restore process was complete, it was unjailbroken.
    Is this the right way?
    I’ve seen this method work before, but doesnt seem to want to work on mine.
    I even tried leaving the phone running on 3.1 software and doing the shift+restore method and using the 3.1 restore bundle.
    I guess I just don’t really understand & I’m usually pretty good at this stuff.
    This 3.1 stuff has got be at a hault…

  29. DavidN October 5, 2009 Reply

    Ok, so I was able to downgrade, got the expected 1015 error twice, and was able to jailbreak with redsn0w, however, the phone keeps going back to Restore mode. What next?

  30. jeffreyj October 5, 2009 Reply

    Same error for me and my 3 Pc’s. Why wont this work for some people?

  31. DavidN October 5, 2009 Reply

    I am currently running 3.1 on my 3GS. I submitted my SHSH file to Saurik prior to the September 15 deadline. I’ve changed the “hosts” file to add the gs.apple.com as instructed. After placing the phone in DFU mode, I follow the instructions to restore to 3.0 but after “Verifying iPhone restore with Apple,” iTunes is telling me “The iPhone “iPhone” could not be restored. This device isn’t eligible for the requested build.”

    Any ideas?

  32. David October 5, 2009 Reply

    Changed the hostfile, then tried to downgrade to 3.0 but getting message after contacting Apple servers Not eligible for the particular version of iphone. Any advice?

  33. Chuckydoll October 5, 2009 Reply

    OK, I’m following the directions and get all the way to the second error 1015 error on iTunes. For some reason, the iphone keeps coming back to the itunes and usb logo…what am I doing wrong?

  34. anthoiphone October 5, 2009 Reply

    How do I navigate or where do I find the (etc) folder on a Mac.
    Thanks for your help.

  35. saw October 4, 2009 Reply

    I have been waiting for more then 3 weeks now still the new unlock or jailbreak is not out. Dev team has asked for a week. My iphone is also 3gs 3.1 OS and i dont want to take risk. Can you tell when will it be out. How are people unlocking it paying money and sending the iphone to them.

  36. kinikiblue October 3, 2009 Reply

    I keep getting a message that my iphone isn’t eligible for the requested build, and I’ve tried many numerous ways of downgrading. My files are saved on the Cydia server and my host file has been edited. So if anyone knows why this error pops up, I’d be greatful to know what I’m doing wrong.

  37. tentacle October 3, 2009 Reply

    Frikkio – you can’t downgrade to 3.0.1 you needed to save your ECID with cydia before apple stopped allowing 3.0.1 restores(before september 15th I believe). the ECID you saved with CYDIA was for 3.1(even though you are running 3.0.1, it doesn’t matter which firmware you have as your ECID is sent to apple’s servers and it returns a ECID SHSH for whatever is the current firmware available, not what is on your phone)
    After september 15th, you can only get a 3.1 ECID SHSH saved in cydia.

  38. Frikkio October 2, 2009 Reply

    Hi, it’s very strange…
    3GS with fw 3.0.1:
    on september 24, i’ve saved ECID with CYDIA (it told me that ECID was saved…).
    Then i would like to remove jailbreak and i’ve restored with 3.1 (itunes doesn’t let me restore to 3.0.1).
    Now i’m trying to downgrade to 3.0.1, with file host modified, but i always get error 3002 (just like i hadn’t saved ECID with CYDIA)…
    I really don’t know why 🙁

  39. tentacle October 2, 2009 Reply

    Hi I have a 3GS running 3.0 and I manually saved my ECID/IBESS/IBEC files but did NOT happen open cydia those couple days when you could save your ecid with cydia.
    The battery life on my phone is awful so I wanted to restore it to a clean not jailbroken 3.0 state, is this not possible for me?
    can a jailbroken 3.0 phone still accept a 3.0 ipsw even if apple is not signing them anymore?

    I know you can’t go back from 3.1 to 3.0, but can you go from a jb 3.0 to 3.0 using itunes?

  40. Charliewonder7 October 1, 2009 Reply

    Am I correct in saying I cannot downgrade from 3.1 on a 3gs because when my numbers (3.0.1) were stored in cydia,  around the 25th of sept, Apple had already stopped signing the firmware? 
    These numbers will onlyhelp when downgrading TO 3.1 from next update?

    So I have to wait correct? Or does it just mean I restore to 3.0 not 3.0.1 – even though my numbers were taken from cydia on 3.0.1???

  41. madmaxpro September 28, 2009 Reply

    downgraded but would not activate and am stuck with no bars or service??? Any suggestions???

  42. Zack September 23, 2009 Reply

    Vinay, what do u mean by “This means you haven’t submitted your ECID SHSH to Cydia Server earlier”?

  43. stathis169 September 23, 2009 Reply

    hi i had shsh on file on cydia a my 3gs 3.0.1,,, after needed restore at 3.1 i tried to downgrade but always error 3002,, which means that i dont have ecid shsh, file error!!????? whats wrong????do i need a reply from ih8snow first???

  44. lee September 21, 2009 Reply

    @ Vinay – you seem to know quite a bit, is there any way at all to get the ECID SHSH, iBSS if my 3GS is still on OS 3.O or 3.O.1 so i cant store the file with cydia and use it to downgrade back to 3.0 in the future?


    • Vinay September 21, 2009 Reply

      @ lee Nope you can’t submit your 3.0 or 3.0.1 SHSH to cydia, now all you can do is to wait for 3.1 jailbreak and them immediately submit your SHSH to Cydia servers via make my life easier button on Cydia homepage..

  45. Carl September 20, 2009 Reply

    I really need some help. I have tried downgrading my iPhone 3G from 3.1 to 3.0. I have downloaded iTunes 8.1 – 8.2 – 9.0. I have tried downgrading with all of iTunes versions mentioned above. I have downloaded the 3_0.ipsw firmware from 3 different sites now. Keep getting the same error 1600, 1602, 1604 with older versions of iTunes, eith 9.0 I get error 14.

    Someone, please help…

  46. hariadi September 18, 2009 Reply


    I jailbroke my iphone 3GS 3.0.1. but i have a problem, not following the step “how to install cracked aplication” carefully, i replace accidentally the file “mobileinstallation” with others (patch), n i dont have the backup. n now,my iphone wont boot n stuck in apple logo looping. my question is : is it restoring the original file will bring back my iphone to live? if it yes, can anyone please kindly send/copy to me “mobileinstallation” that is in your iphone 3GS, please i really need it. thanks in a bunch for your help.:)

    using iFunbox or iphonebrowser or DiskAid, browse to
    /System/Library/PrivateFrameworks/MobileInstallation.framework, copy the file mobileinstallation and send to me. sentosa.hariadi[at]gmail.com

  47. j2innet September 18, 2009 Reply


    can anyone tell me ECID is only applicable to 3gs?

    i see all over the web is saying Apple has stop signing for 3.0 and 3.0.1, and ECID is needed to register into saurik’s signing server.
    Does this mean iphone all model need ECID or just the 3GS ?

    if ECID is only for 3GS, then can i say that i can downgrade 3G without any problem by normal restore method without Cydia SHSH method.

    even if i successfully downgraded, the phone is still in locked condition rite? is this because of the baseband is non-downgradable atm..?

    btw, i also see DevTeam has cooked some Custom Firmware which restore 3.1 which is pre-jailbreaked in ipsw file. can i say this solution is the most complete so far?

    anyone please let me know…
    thanks in advance…

    • Vinay September 18, 2009 Reply

      @ j2innet Yes ECID security bypass hack is for iPhone 3GS user only, iPhone 2G, 3G users are unaffected..

  48. Marty September 17, 2009 Reply

    Thanks Vinay, in did try it on a different pc and also reset my host file to default, but no luck. I just reset phone back to 3.1 and i will wait for jailbreak.

  49. Jag September 17, 2009 Reply

    I keep getting the error 1015: I did the restore and did it again, 3rd time used redsnow and tried jailbreak and it got stuck near the end. Any ideas?

  50. LS September 16, 2009 Reply

    I try to downgrade my 3gs locked iphone 3.1 to 3.0 but it does not work. All were done according to your instruction using window. The message shows “The iPhone cannot be restored at this moment because the iPhone software update server could not be contacted or is temporarily unavailable” 🙁

    • Vinay September 16, 2009 Reply

      @ LS Try again Cydia servers was down for a while now they are up again..

  51. Marty September 16, 2009 Reply

    Couldn’t activate the 3gs after downgrading??????
    have legit iphone on at&t but couldn’t re-activate it after the jailbreak and installing cydia and all appz again, but didn’t have any carrier or service, itunes could see my phone but wouldn’t activate it again. ?????
    any suggestions???


    • Vinay September 16, 2009 Reply

      @ Marty Edit your hosts file to default and try again, or possible try on different computer..

  52. Chris Lowe September 16, 2009 Reply

    Ok tried this today and got an error message that is not listed, 3200. Any idea what that is?

    • Vinay September 16, 2009 Reply

      @ Chris This means you haven’t submitted your ECID SHSH to Cydia Server earlier, now wait for 3.1 jailbreak.

  53. Chris Lowe September 15, 2009 Reply

    Ok, so I just purchased a new 3GS last week and while trying to jailbreak, got an error and then restored and it restored to 3.1. So from what all I have seen and read, I am SOL basically. What I want to know is if this process will help me. I know my ECID, and tried to use the purplerain site to get some sort of ident tag for the phone, but it did not work. I also email sn0w sn0w to see if he could help, and he replied;A 3.1 iBSS/iBEC file will be fine. Noe I have read so many different posts on so many different sites, and I am now so confused. I use your site quite a bit, and I feel that I always get the best information from you. Please point me in the right direction of what I need to do, so that when the 3.1 for 3GS jailbreak is released, I won’t have any problems. I greatly appreciate your help in this matter.

    Lowes Mobile