(I was able to hack this iPhone 3GS last summer. Only now I have the time to write a blog post about it. I hope I will not miss any steps. The whole investigation and the final process took nearly 2 months of work.)
Scenario
In your home there is a drawer that you dedicated to chaos.
In that drawer (usually in your bedroom or at the desk from which you work) we can find: old USB mini cables, CDs, pencils and markers, USB sticks, that old USB-to-Lan cable that you bought on Amazon and… your old phones.
We always say “let’s not throw it away, it might be useful one day”.
Then time fly. One day you reopen that drawer and you find yourself with an iPhone 3GS.
You charge it. It works!
And then you face Apple Security:
No passcode & iPhone disabled
You end up entering a few passcode and but you already know that you will not remember it.
The phone is now disabled.
You go online and you read plenty of guides. You embrace a community of sad people that try to jailbrake old iPhones without joy.
…but sometimes some of them are apparently successful. So you get puzzled!
In the order you try:
- To watch YouTube tutorials: but if your iPhone is already updated to the latest version of 2012 they will not work
- To connect your iPhone to your PC: Apple did a good job since the beginning of the very first iPhone. All data are encrypted and not accessible from a simple PC.
- To create a Lab in a VM: there are plenty of hacky *.exe files written by hackers from ex communist countries and you don’t want to install that shit on your main computer. So you create a Windows 10 Lab in Hyper-V. But accessing the phone from the VM is a mess and the *.exe seems not working.
Then you stumbled upon a Reddit post that leaves you with no hope:
Hackers are stubborn
Hackers are obstinate.
And I have always found that obstinacy familiar. I liked it. It talked to me.
If you want to get me very nervous you just have to say the phrase “You cannot do it, Francesco” or “It’s not doable”.
“It’s not possible”. “There is no way”.
That is the starting pistol that makes me want to work more. To prove that there must be a way around.
Starting form that point it doesn’t matter how much effort I’m going to put into it. Some are addicted to gambling or slot machines. I have this addiction.
And the sad Napoleon was appearing on the ceiling in my bedroom. He was telling me: “Come and save me”.
There must be a way around…
A logic approach
It is not possible that a solution that was working in 2012 couldn’t work in 2024.
What might have changed?
- The iPhone hasn’t changed: it has been stuck into a drawer for more than a decade without receiving any update. Nothing has changed there
- Hackers tools haven’t changed: I strongly doubt those tools are maintained. You can find them here and there on the internet. The most famous version is usually the lates one.
Let’s enumerate the software that hackers provided to jailbrake the iPhone 3GS:
- Gecko_iPhone_Toolkit
- p0sixspwn-v1.0.8-win
- redsn0w_win_0.9.15b3
- sn0wbreeze-v2.9.14
And none of those was working on my Windows 10 VM on Hyper-V. They could install but they were showing different errors.
When the iPhone 3GS was still on vogue it was 2012. This means that there was Windows 7. But today we are using Windows 10/11.
This is the only variable that really changed in the whole equation.
Tired of thinking I couldn’t sleep. I couldn’t have no rest. Because a fire was burning in me. Against all odds I now had to prove to myself that there was really no solution. And I already knew that I had to walk the long path.
The hard work
“Once you begin to discover who you are then you really realise how you have been given authority over your life.
But you can only do that through the struggle of life.
And most people want to avoid the struggle.
Most people go through life avoiding pain.When you are working on a dream at some point in time a transition takes place.
You learn how to leap higher.
You start challenging yourself to dig deeper.
Something in you, that you never activated in life, dormant in there.
Don’t try to take any shortcuts, do what you know it’s right.
You have been chosen for this great work.”The 15:17 to Paris – Clint Eastwood
The old iPhone 3GS needed a best friend. And its best friend was my best friend: the computer on which everything started for me.
The ACER Aspire S3 was the computer on which I learned how to code. It was running the Intel i7 1th Generation (1th Generation! The first i7 on the market! Today I’m rolling on a Intel NUC Hades Canyon VR NUC8i7HVK which has an i7 8th Generation.)
Many coders of my age have started coding on Windows 95. I was a late bloomer and I started mi passion later on in life.
In 2012 I was back to Italy after having spent many years abroad. I was jobless and my father bought me this beautiful laptop so I could study a 6 month course of web development at Ifoa in Bologna. On this PC I wrote my first Hello World. On this PC I installed nearly all Linux distro that I could put my hands on, from CentOS to… everything.
I wiped it for the umpteenth time and I put a shiny Windows 7.
A list of tools that you will need
If you want to proceed with the experiment you will have to provide yourself with the following list of items:
- An old laptop on which you have to install Windows 7
- Gecko iPhone Toolkit: Is the file that will make the trick
- Microsoft .NET Framework 4 (Standalone Installer): And you can download it here for the prosperity.
- Java SE Runtime Environment 8u391 (32bit, anything 64bit will fail for this experiment): You have to download the jre-8u391-windows-i586.exe . And you can download it here for the prosperity.
- PuTTY
- WinSCP
- iTunes 11.0.5: Cannot upload it here and god only knows for how long this will still be available.
- IPSW for iOS 5.0.1 (iPhone2,1_5.0.1_9A405_Restore.ipsw): choose the iOS 5.0.1 (9A405) for iPhone 3G[S]
You basically have to reproduce the 2012 on laptop.
Phones in scope
We are going to use Gecko iPhone Toolkit for hacking into the iPhone 3GS. The complete list of the iPhones in scope is this:
- iPhone 3G
- iPhone 3GS
- iPhone 4 GSM
- iPhone 4 CDMA
- iPad 1
- iPod 2G
- iPod 3G
- iPod 4G
Troubleshooting
As I said before you have to think like you were in the summer of 2012.
The radio is passing Kate Perry, Good Charlotte and Bruno Mars. Hackers in eastern Europe are maintaining hacking software written in .NET and JAVA but everything is in 32bit.
No 64bit is allowed here!
It was not mainstream yet!
This is one of the main problem that was stopping the sad Napoleon.
Exploit
Run Gecko iPhone Toolkit.
Select our phone version from the drop down menu and use the tab Bypass “iPhone disabled”.
Press Bypass and Gecko will take care of the rest.
You win if you see this message:
Access
The message is very clear: we have an SSH shell on localhost:2022.
It’s time to use PuTTY and connect to that address.
Once you are there you can connect using:
login: root
password: alpine
Once you are connected a message will prompt you this:
Use mount.sh script to mount the partitions
Use reboot_bak to reboot
So run mount.sh and you will see this message:
Mounting /dev/disk0s1s1 on /mnt1 ..
Mounting /dev/disk0s1s2 on /mnt2 ..
And this is the second success!
Gecko has created one partition for the system (/mnt1) and one for the files we are looking for (/mnt2).
Exfiltration
It’s time to use WinSCP to connect to /mnt2 and start downloading the bejesus.
Connect to localhost:2022 with the same login and password as before.
I just download the whole /mnt2
I suggest you to use something like FileLocator to inspect the whole directory and find out the files you are looking for.
Conclusion
Never, ever, ever, ever give up.
I will now go to Reddit and put a smile on that Napoleon face.
Nice to meet you, You can’t tell me how much hope this article gave me!
I followed your steps and tried to do this using a virtual machine Windows 7 on Windows 11, and It was successful halfway. Until I was able to remove the password restriction. However, I tried to decrypt the password more than what is written here and failed, and my iPod touch 4 stopped at a string of characters. I really want to get back my data from over 10 years ago, but what should I do? I don’t know why I couldn’t restore it because the password was complicated, but I want to restore it without initializing it. It’s a shame that I can’t attach a photo. I would appreciate your advice.
Don’t use a VM.
Wipe down an old computer and install Windows 7.
Hi Admin,
I really appreciate this post. I will try it out on my old Iphone 3g. I only really want the photos/videos on there. Alot of good memories I don’t want to go. Failing that, could I send it to you for a fee to have a look at?
I’m sure you will be able to do that alone. Let me know if you have any problem.
thank you so much for this article!
i followed all the instructions and everything worked up until the last step which was downloading the mnt2 file. it stopped downloading when it got to a .plist file and it said permission denied error code 3 on winscp. what should i do?
Yes, I faced that sometime. That file is probably corrupted. Do this:
1) Find where that file is located.
2) Import other folders but not that folder.
3) if you want import files one by one from that folder but skip the .plist
Basically try to import everything but not that file.
It’s a tedious task that requires time.
I’m stuck at the first achievement. The Putty part is not explained well. I’ve seen brute force attacks on reddit with reload pasword screen but despite w7, 32 bits and all the requirements it keeps stopping me from identifying the device after putting it in DFU mode. I don’t know what’s wrong.
“I’m stuck at the first achievement.” means that you succeeded with Gecko? Do you see root/password?
You don’t have to put the phone in DFU mode, keep it connected. Fire up Putty and connect with the same root/password
Hi, I’m stuck on this part as well!
I see the root/password in geckotoolkit.
I open putty and enter host name {localhost} and port {2022}
Then press “open”.
This opens the putty terminal with no additional popups/dialog, just a blank terminal which I’m unable to write in…
If I run {netstat -a} in commandline, I can see:
127.0.0.1:2022 Listening
127.0.0.1:2022 Established (this happens after opening with putty)
Not quite sure what I’m doing wrong!
Same issue here
Putty Log:
Event Log: Looking up host “localhost” for SSH connection
Event Log: Connecting to ::1 port 2022
Event Log: We claim version: SSH-2.0-PuTTY_Release_0.83
Outgoing raw data at 2025-07-24 14:36:23
00000000 53 53 48 2d 32 2e 30 2d 50 75 54 54 59 5f 52 65 SSH-2.0-PuTTY_Re
00000010 6c 65 61 73 65 5f 30 2e 38 33 0d 0a lease_0.83..
Event Log: Failed to connect to ::1: Network error: Connection refused
Event Log: Connecting to 127.0.0.1 port 2022
Event Log: Connected to 127.0.0.1 (from 127.0.0.1:49228)
But no window does appear
Because you are using a VM.
You have to do this procedure on a bare metal machine. Use a spare laptop that you have at home.
I have the same thing and I am NOT using a VM
i have the same issuse, using an old computer of mine with WIN 7
Try to give those logs to an AI: the problem is the IPv6 VS IPv4.
This worked beautifully on an iPod 4th Gen A1367 model. PIN forgotten so couldn’t access. Installed Win7 32-bit on AMD Phenom II PC (older hardware) w/ SP 1 and all the software listed in post… finally worked perfectly. Am an oldie stubborn hacker too… we are a dying breed!
Good to hear
i want to try this for my disabled ipod touch 4th gen but i have a question, i dont have a computer with windows 7, but i have a asus zenbook from 2017, can i install windows 7 onto it in order to try this method out?
Of course. It will work!
Admin ill pay you if I ship my ipod touch 4 gen to you so you can take off disable mode, Also I don’t know my password idk if there’s a way you can unlock it for me. let me know if you are able to do that!!
Alright, I will contact you in private
alright let me know when you sent me a email!
I will send you an e-mail
Hi, thank you so much for this in depth post. I am currently purchasing a Windows 7 laptop just to do this. Are there any other specifications the laptop needs? I also saw Reddit posts stating it needs to be Windows 8 to use the Gecko toolkit. Will either OS work? Thanks so much in advance.
Windows 7 is better.
I recently try to create a lab with Windows 10 and it doesn’t work because it brings a later version of .NET.
So I’m a bit scared that with Windows 8 you might encounter the same problems as with Windows 10.
Just wipe an old computer that you have a t home and install a Windows 7 .ISO that you can find on archive.org
Thank you, I actually don’t have any old computers in my house so I just purchased a cheap one on eBay. It has Windows 7 installed already so I think I’ll be good to go
Can you by chance make a video following this? I am more of a visual learner, but I understand if this is outdated and hard to recreate.
I was thinking about it. The reality is that I don’t have much time.
I will try but I cannot tell if it will be ready in 3 or 6 months.
Also the hard part is not the hacking itself.
The hard part is the lab: is reproducing 2012 on a Windows 7, now that we are in 2025.
PLEASEEE Make a video showing whole process, very confusing for someone like me who know nothing about hacking lol.
Does the windows 7 version have to be 32 bits too? I can’t even boot windows 7 32 bits on my Dell Latitude 5500. It seems that I have no legacy boot support it has to be UEFI compatible. Is there another way for it to work?
32 bit is better.
Dell Latitude 5500 should be OK.
Ask ChatGPT about the UEFI problem.
ChatGPT doesn’t help as it suggest using a different machine or booting it in a VM (which is what I’m currently trying).
However, I’m unsure about this working in a VM.
Looks like I can’t bypass the UEFI problem unless I can boot it in a different version of windows that is compatible.
What have you tried so far that worked or didn’t work?
Windows 7 32bit or Windows 7 Ultimate.
Admin ill pay you if I can ship out my iPhone 4 model A1332 GSM its disabled connect to iTunes and possibly a password recovery if you can help me out.
Contact me in the Contact page
Grazie mille Francesco ha funzionato, sei un mito!!!!!!!!!!!!!!!!
Non c’è di che
I am currently working on a iPod touch Gen3, somehow my “iPod disabled” turned into 1 password trail after putting it in DFU mode and out again…But I think this will work! wish me luck
I failed at the part where it wanted to download something and my win7 does not have a WiFi function it can only connect to the internet via cable which I don’t have at home…..
Buy a cable or a WiFi USB stick.
The software is doing a call to legacy URLs from 2010.
I will try to disable if I have time.
Is there a way to extract the pin from the files once they are downloaded?
This is what I’m trying to do right now.
There are two options:
1) The PIN is inside the “keychain-2.db” file. That file is a SQLite database and I see a few things in there.
2) The PIN is inside some *.plist files
I also have to make you notice that the Gecko Tool can bruteforce and find the PIN for you. Give it a try.
Should the IPSW version always be 5.0.1? Or does it have to be matched to the iOS version that you have installed on your device? I have an iPhone 4 for which I have long since forgotten the passcode. I can tell that it’s running a version of iOS that’s either 6 or earlier, but I can’t be sure exactly which one.
Is the Gecko Tool that suggest you what version you are supposed to use.
I have done all the steps and downloaded all the drivers for my new win 7 iso. Sadly my power button doesn’t work on my 3GS, do you know of any fixes to force it into DFU Mode without the power button?
I have tried redsn0w, 3uTools, etc…
But as you know the phone is pass locked!
I don’t get it: if the power button doesn’t works… how could you turn on the phone?
The power button: At the top of the phone
I turn on the phone by pressing the home button which works fine
Do you have any social media I can conversate with you on?
Let me know!
Thanks. Your blog was very helpful. I saved a lot of time trying to find the versions of the files I used, and I was able to access it via SSH. Now, what should I do to deactivate the disabled iPod? What file is responsible for this, and what are the steps to exit and restart it? I’m waiting for your response.
In the Gecko toolkit use the option “Read lockscreen password”. –> now you have the password
Find the file that keeps the lockscreen deactivated (I don’t remember the name, use ChatGPT for that) and rename it “*.old”.
Now restart the iPod and enter the password.
Thank you so much. You’ve helped me so much with your blog. You helped me recover my device after 12 years of being blocked and disabled. I hope I can share it to help more people in my situation. It’s a great help. Best regards.
So you have found the PIN code? What iPhone model was that?
Hello,
great job. I’m trying but it gets stuck with plink.exe windows no error and nothing runs.
Java windows last message is “Mobile device event: Recory connected 1590…
Any advice?
I don’t understand, “plink.exe windows”? Can you send me a screenshot?
I tried with real win7 laptop.
I’ll get stuck with “plink.exe” window.
I’m wondering if it’s because newer .net might be installed?
The guide skips a few steps.
1.
I assume that iTunes version needs to be installed before running Gecko?
2.
I also assume that GS3 needs to be in DFU mode?
3.
And finally I assume that before “Bypass “iphone disabled” tab, you don’t have go through the first tab “Read lockscreen password”. And then you don’t use that “IPSW for iOS 5.0.1” anywhere?
Surely the last is wrong?
Wondering that if I do the Boot & Launch from Gecko’s first page, will it erase the photos?
An how many minutes that Bypass (2nd tab) will take?
“Select our phone version from the drop down menu and use the tab Bypass “iPhone disabled”.”
Decypher: you must be on first tab to choose phone version before you use the Bypass tab?
“first page” = “first tab”
And noticed my mistake:
Recovery mode is not DFU mode.
When I got the phone to (real) DFU mode, the exploit was success.
This is nice to hear. I actually couldn’t reproduce your scenario.
Glad to know you found the problem.
Thank you very much, you re a savior 🙂 Everything works like charm. Used old laptop, win 7 home 32bit, downloaded and used programs you listed and its done. Thank you again my friend 🙂
Important question; are you using a ios 5 3gs ? My locked 3gs runs ios 6 so Im not sure it will work since gecko goes up to ios 5 for the 3gs …
You might be right.
I’m currently fighting with an iPad 1th Generation which should be supported by Gecko but is not giving me any joy.
But you know what… give it a try! Today finding an old laptop and a Windows 7 ISO comes with nearly zero cost.
Help! I have an iPhone 3 and iPhone 4 that has photos that are very important to me. I also have another phone that is locked for 50 years. Is there a way to retrieve those photos. (I did not back up to iTunes)
Yeah, well, reading the article and following the instructions?
Hello, I have an iPhone 4s which has a lot of important information. Does this work on this version?
Yes, it will work
Unbelievable, sir—it’s 2:30 in the morning, and I can hardly find words to describe what I’m feeling right now. This incredibly thorough guide has saved my iPhone 4, and the sense of accomplishment and redemption from solving the problem with my own hands hit me like a tidal wave. As a complete novice with computers, I actually managed to do it, all thanks to this foolproof tutorial. There’s no way I could leave without posting a comment to express my deepest gratitude!
Ah, tidal wave.
Imagine the tidal wave that hit me after 1 year of work. While every single one on the internet said it was impossible.
Me too I had that strong feeling of accomplishment.
Glad this helped you.
And now, back to your next problem…