If you’re like me and enjoy tinkering and playing with the latest iOS betas simply for the ‘fun of it’, chances are you’re pretty ‘cluey’ about iOS and how the iPad, iPhone and so on work.
As of the iPhone 3GS and iOS 3.x, Apple now signs every single firmware with a signature, unique to every single device and firmware called a ‘SHSH blob’. This means that usually once Apple releases an update, you can’t go back down, you’re forced to go up. Presumably in an attempt to prevent jailbreaking, to enforce security and to make sure everyone has the latest version.
Usually it’s pretty easy to downgrade if you’ve got the SHSH blob for your device for the firmware you’re trying to downgrade to. Unfortunately, as of iOS 4.2.1, Apple is making things somewhat trickier.
For 3G devices, when you update or restore to a new version of iOS, the baseband is also upgraded. Usually, this is pretty easy to bypass using a tool such as TinyUmbrella. From iOS 4.2.1 however, a check is performed at first boot after restoring to the firmware version to check the baseband version. If the baseband doesn’t match the baseband in the firmware you just restored to, it’ll simply error out (usually with an error like 1015) and you’ll be stuck with an unbootable device, stuck in a recovery loop. In iOS 4.1 and earlier, you could simply use TinyUmbrella to kick it out of recovery mode, but Apple have stopped this in 4.2.1. This is an issue when you upgrade to 4.3 and want to go back down, as you…. can’t! Even if you have the SHSH blobs saved, you’ll get stuck in a recovery mode loop. Luckily, this can be bypassed as of today.
To start off, throw your iPad 3G or iPhone into DFU mode, and downgrade to 4.2.1 (I shouldn’t need to tell you how to do this). From here, when you’re stuck in the recovery mode loop (with error 1015 or similar), now download GreenPois0n and follow the steps.
Bam! You now have a happily downgraded iPad (or iPhone) running jailbroken 4.2.1. If you’ve run into any other problems, drop me a line below and I’ll try and help out.
Insert standard disclaimer here; I’m not responsible for any damage to anything, or if your computer blows up. I have only tested this on an iPad 3G.