George Zhu’s BLOG

I often need to do some experiments with my iPhone, but downgrade with DFU mode is very inconvenient because I have to restore all my data files after the downgrade and I have too much data on the phone and don’t wanna re-sync each time the experiment is over. After some tests, I’ve managed to downgrade without data loss.

Downgrade Without Wiping User Data

Since the upgrade will not touch the user data, I’m thinking if I can use the Update button to do the downgrade thing. So I did an experiment on Mac:

1. Restore the firmware to 1.1.2
2. Jailbreak and activate 1.1.2
3. In iTunes, Option-Click the Update button, select a previous version firmware, I select 1.1.1
4. iTunes updates firmware, report an error at the end

After the downgrade, as usual, the iPhone is stuck at the restoration screen, I fire up iNdependence to jump out, when this is done, iNdependence reports the firmware version is now 1.1.1. Then I use iNdependece to jailbreak it, works flawlessly. The user data is still there after the downgrade.

So with the above trick, I can easily downgrade firmware without destroying my user data.

But there’s a possible issue, what if the current firmware is the latest version? When the iphone firmware is the latest version, iTunes will not allow to update firmware (button is labeled Check Updates).

Fake Firmware Version

There’s a trick here: change the firmware version on iPhone, set it to an earlier version then reboot, iTunes will happily display the Update button. The firmware version is stored in a plist file:

/System/Library/CoreServices/SystemVersion.plist

The version info contains 3 fields: BasedOn, ProductVersionBuild, and ProductVersion, as shown below:

<key>BasedOn</key>
<string>Tahoe3A37</string>
<key>ProductBuildVersion</key>
<string>1C25</string>
<key>ProductVersion</key>
<string>1.0.1</string>

Modify these 3 fields can fake the firmware version. I change the 1.1.3 version to 1.1.2 and make iTunes iTunes thought that the firmware is not the latest, hence displays the Update button. NOTICE: changes in version requires reboot to make it active. I have tested on a 1.1.3, and have successfully downgraded it to 1.1.1.

The following is a list of the field values for firmwares:

1.0.1
BasedOn: Tahoe3A37
ProductBuildVersion: 1C25
ProductionVersion: 1.0.1

1.0.2
BasedOn: Tahoe3A67
ProductBuildVersion: 1C28
ProductVersion: 1.0.2

1.1.1
BasedOn: Tahoe3A100
ProductBuildeVersion: 3A109a
ProductVersion: 1.1.1

1.1.2
BasedOn: Tahoe3B46
ProductBuildVersion: 3B48b
ProductVersion: 1.1.2

1.1.3
BasedOn: Tahoe4A86
ProductBuildVersion: 4A93
ProductVersion: 1.1.3

NOTICE: The method introduced in this article only works when downgrading from 1.1.x to 1.1.y. I tried to downgrade from a 1.1.1 to 1.0.2 but failed with “Unknown error 1″, so I assume it only allows to upgrade/downgrade in the same series, e.g.

1.1.x <-> 1.1.y (confirmed)
1.0.x <-> 1.0.y (unconfirmed)

UPDATE: BTW, changing the firmware version to the latest (regardless of the actual version) will effectively disable the iTunes from updating the firmware until a new version is out.