This step-by-step guide and tutorial will show you how to jailbreak your iPhone 3G or 3GS OS 3.1.2 using PwnageTool 3.1.4 for Mac OS X. PwnageTool is a Mac and Mac only tool. There is no equivalent for Windows and no one knows yet when such a tool for Windows will be released.

If you updated your iPhone via iTunes to 3.1.2 or if you bought your iPhone with 3.1.2 pre-installed, you will be able to jailbreak it, however, you will not be able to unlock it. On the other hand. if you are still on 3.0 or if you have updated to 3.1 using PwnageTool, you preserved your baseband and you will be able to unlock using UltraSn0w.

This tutorial is written for both the iPhone 3G and 3GS. The steps are identical. The only thing that changes is the file you have to download in order to create your custom IPSW.

How to jailbreak iPhone 3G/3GS 3.1.2:

Step 1: Make sure you have downloaded and installed the latest version of iTunes.

Step 2: Create a folder called “jailbreak” on your desktop. Download and save the following files to this “jailbreak” folder (all these files can be downloaded here):

  • PwnageTool 3.1.4 for Mac OS X
  • If your iPhone is a 3GS: 3.1.2 for iPhone 3GS (iPhone2,1_3.1.2_7D11_Restore.ipsw)
  • If your iPhone is a 3G: firmware 3.1.2 for iPhone 3G (iPhone1,2_3.1.2_7D11_Restore.ipsw)

Note that I highly suggest downloading these files with FireFox as Safari usually creates issues.

Step 3: Launch PwnageTool. It should give you a warning message. Click OK.

Step 4: Select “Expert Mode”.

expert mode

Step 5: Select your device then click the blue arrow to continue.

select device

Step 6: If PwnageTool doesn’t automatically find the correct IPSW file, click “Browse for IPSW” and locate it (it should be in your “jailbreak folder”).


Click the blue arrow to continue.

Step 7: You will now have several options. Choose “General” and click the blue arrow to continue.


Step 8: Under “General Settings”, you have the option to activate the phone or not. This is a very important step and I’m pretty sure that we’re going to have a bunch of comments related to this setting, so please read carefully.

If you have a contract with an official carrier (such as AT&T in the US, or Orange in France, etc…), do not activate.

If you do not have a contract with an official carrier (ie. you want to unlock for another carrier), you have to activate. Then you will have to install UltraSn0w from Cydia in order to fully unlock the phone.

You will know you didn’t choose the right option if you don’t have signal after jailbreaking.

general settings

You don’t have to, but I suggest increasing the root partition size to somewhere around 700MB, just to be on the safe side. When you’re done, click the blue arrow to continue.

Step 9: You are now taken to the “Bootneuter settings”. All of them should be greyed out. Click the blue arrow to continue.


Step 10: You are now taken to the “Cydia settings”. From here, you may download packages so you don’t have to manually do it later. For example, you may download WinterBoard, which would be installed during the pwnage process. Let’s keep things simple and skip this step which is not necessary. Click the blue arrow to continue.

cydia settings

Step 10: You are now taken to the “Custom packages settings”. I highly suggest only selecting Cydia as Icy can be very buggy sometimes. Click the blue arrow to continue.

custom settings

Step 11: You are now taken to the”Custom logos settings”. You can choose to add the default logos (see below) or you can add your own logos. If you choose to add your own, make sure the images are not larger than 320 x 480. I personally don’t like these custom logos so I uncheck them all and keep my stock logos. Click the blue arrow to continue.

custom logos

Step 12: We’re almost done! You now have to build the custom IPSW. Click “Build” and click the blue arrow to continue.


Step 13: Save your custom IPSW to the “jailbreak” folder we created in step 2.


Step 14: PwnageTool will now start building your custom IPSW. Be patient… It can take up to 15 minutes.

Step 15: PwnageTool will ask you if your iPhone has been pwned before. If you’re not sure, just click NO.


Step 16: If your iPhone was previously jailbroken, you can skip to step 19. If your iPhone wasn’t already jailbroken, follow the following directions.

If your iPhone isn’t plugged to your computer yet, plug it. Don’t open iTunes. If iTunes launches automatically, close it. PwnageTool will now deliver the payload.


Step 17: After successfully delivering the payload, PwnageTool will put your iPhone in recovery mode and you should get the following message. Click OK.


Step 18: iTunes should pop up saying it has detected an iPhone in recovery mode and that you must restore. Click OK.

itunes recovery

Step 19: We are going to restore your iPhone using the custom IPSW you built. In iTunes, hold the “Alt/Option” key and click “Restore” at the same time. DO NOT click “Restore” without holding the “Alt/Option” key! A dialog box will pop up and you’ll be able to choose the custom IPSW file you created that was saved to your “jailbreak” folder.

Step 20: Navigate to the “jailbreak” folder and select the custom IPSW we created:

  • iPhone2,1_3.1.2_7D11_Custom_Restore.ipsw for iPhone 3GS, or
  • iPhone1,2_3.1.2_7D11_Custom_Restore.ipsw for iPhone 3G

Step 21: iTunes will now restore your iPhone using the custom firmware which could take a while, so relax. When done, your iPhone will reboot and you will now have a jailbroken iPhone.

You may now unlock your iPhone. For more information about unlocking your iPhone, please read our iPhone 3.1.2 unlock page.

If you have any question, please leave a comment below.

  • omar

    I need your help
    my 32 g 3gs was gailborken using blackra1n.exe everything was ok (firmware is 3.1.2)
    the only thing was not correct is i have to uses blackra1n.exe every time cause it awlays comes in recovery mood loop

    I used your guide in mac with pwnagetool 3,1.4 and after buliding the custom file from 3.1.2 file i used itune to restore using this custom file i did answer no when it ask if was pawned or jailed braknem i need ur help cause i end up with a phone only black screen i only can put it in dfu mood and nothing else
    plz help

  • Vaultergrl

    Perhaps this is an odd question: After jailbreaking my 3gs (3.1.2) on a Windows and eventually running into some issues (Pineapple logo freeze and 1600 error among others) – can I try to use PwnageTool 3.1.4 and Blacksn0w on a friend’s Mac and then try to restore again on my PC using Blackra1n/other? I want to also know in the hopes that the quirks are gone. Thanks!

  • adam

    Hey guys i follow everything to the word but when it pops up with connect iphone it never ever finds the iphone… any ideas? i am on a mac with a 3gs

  • nick

    I have a 3gs with 3.1.2 firmware. I followed all the steps to the letter, tried restoring with custom ispw but when it finally finished, itunes said phone is still in recovery mode. phone looked like it was off and the only thing i could do was restore factory settings and install 3.1.3 firmware. Did I do something wrong??

  • Ankur

    I have 32GB iPhone 3GS, Version 3.1.2 (7D11), Modem Firmware 05.11.07

    I have successfully unlocked my iPhone 3 months before and it was working perfectly.

    Last week for some reason I was asked to reboot the device as I had already done many times previously I did reboot.

    Now whenever I turn it on, the screen gets stuck at “Connect to iTunes with USB cable”

    And when I run blackra1n it goes well until it says jailbreak successfully done, wait for reboot. And I am not seeing anything after that just only geoface and it says “done, wait for reboot”

    After a while it restarts and again same process and message comes, “jailbreak successfully done” and then “done, wait for reboot” and same geoface appears but after a couple of minutes apple logo appears and back to restore mode (iTunes USB cable) then again geohot face appears and then again few minutes later apple logo appears and back to restore mode (iTunes USB cable). And so on … every time

    I tried like 15 times but no result, What should I do? Any suggestions?

    Thanks in Advance 🙂

  • Jean Yves

    Hi, I have exactly the same iPhone specifications as Ankur, and had the same problem after doing a reset network settings as iPhone became “unstable” (short loss of wifi).
    So I kept it blocked over a week, and then followed kaubut0 tuto how to downgrade 3.1.3. to 3.1.2. (but wasn’t in 3.1.3.): strangely it worked, restatrted and I noticed I had saved my ECID on Saurik’s files, (which I didn’t remember having done so…).
    Now I still have a problem, leaving in Thailand, True is the official carrier, I have a True simcard but didn’t buy the phone by their service, I have full signal, wi-fi etc….
    I can send textos (sms), I can receive calls, but I cannot pass any call !?!?!?
    Been trying for 3 days, but still cannot make a call, wonder what’s wrong….
    Beside this, after having successfully installed Cydia and install0us, I’m experiencing download issues in install0us, loose the connection for unknown reason, but the wi-fi signal is very good and the icon doesn’t disappear…
    Any help would be very welcome…
    Many thanks

  • khawla

    whenever i chose the ipsw file it says that its a wrong firmware… what can i do?? i downloaded another one but its not working too


  • Thomas

    Hi, I just followed all instructions….when iphone rebooted, theres no cydia etc? its just a rebooted iphone? any help please?

  • Obviously

    260 posts, all bad and you idiots are still trying this method? Take this site down. IT DOESN’T WORK! Geez!

  • Ruff ryda

    Fukin wankaz!!!

  • hi every one…….. i did every thing with my iphone 3g 3.1.2 but no signal at alllll i install ultraSnOw but it is searching after some min………… service……….what a fucking phone is iphone….u give u guys advice don’t buy anymore this fucking iphone and use other phones……please go and broke it some where then pepe…..fuck offf iphone i did same,……….!!!!!!!!!!!!!11111

  • betsy

    PLEASE HELP ME!! thank you very much for taking the time to read through my problem.. I have an iphone 3G which got frozen on the apple & wouldn’t turn on.. I was able to (holding down the home button & then plugging into itunes) restore my phone so that it was able to move forward….. now, i did not press the alt key when pressing the restore button – unfortunately i was not aware of this little tidbit until a later search (hopefully i have not completely buggered this!!) And so – here’s my problem.. using the pwnage tool 4.1.2 and the iphone1,2_4.1_8B117_Restore.ipsw – i was able to get the process started UNTIL – a lovely red box appeared stating “You do not have enough free space” – how do i free up space if i can not open my phone!?! there was a lot of space left, too… its a 32GB… i have searched online for days trying to find a solution! Pleaese Please Please help me!! I’ve run out of options 🙁 Thank you again for taking the time to read this and help me 🙂 xXx

    • Rachel

      Hey, please im having the same problem, let me know if you have found a solution, ;(

      thank you.

  • Viking

    Alright guys, I jailbroke my iphone and am trying to unlock it. I have the cydia and Icy logo on my phone, but when I attempt to open cydia it says loading data…then after a minute it closes. I also have no phone service. Will someone please tell me how to get pass this. Thank you

  • Javi

    Hey guys! Just a quick question. From what I can tell, if I have an iphone 3G running on iOS 3.1.2, and baseband 5.14.02, I may be able to jailbreak it, but will NOT be able to unlock it. Correct? Thanks for your help.