Tweet
With this step-by-step guide you can now convert your iPhone into a functional Android device and upload your favourite apps and widgets that you wanted to try out for a long time. However, few bugs and performance issues remain, making your phone work a little slow, but if that’s okay with you, then read on.
Requirements:
Before starting the process, extract .ipsw file from the Marvell’s Website for multitouch and WLAN firmware for the iPhone.
Step 1: On the Linux machine, create a folder “Firmware” in home directory.
Step 2: Extract SD-8686-FEDORA26FC6-SYSKT-GPL-9.70.3.p24-26409.P45.tar from SD-8686-LINUX26-SYSKT-9.70.3.p24-26409.P45-GPL.zip to a temporary folder.
Step 3: Extract FwImage/helper_sd.bin and FwImage/sd8686.bin from SD-8686-FEDORA26FC6-SYSKT-GPL-9.70.3.p24-26409.P45.tar and move them to ‘firmware’ folder.
Step 4: Rename helper_sd.bin to sd8686_helper.bin. Now, you obtain WLAN firmware. Next we work over the multitouch firmware.
Step 5: On the Linux machine, create a folder “idroid” in home directory. Extract utils/dripwn from the prebuilt tarball (downloaded .tar archive).
Step 6: Copy 3.1.2 .ipsw file obtained from Apple’s Website into the ‘idroid’ folder as dripwn.
Step 7: Begin a command-line shell (Terminal under Ubuntu) and navigate to the ‘idroid’ folder. Type cd ~/idroid.
Step 8: Visit the page and copy the VFDecrypt key.
Step 9: For 1st generation iPhone, type the following in the shell
./dripwn iPhone1,1_3.1.2_7D11_Restore.ipsw [the VFDecrypt key you copied]
For iPhone 3G:
./dripwn iPhone1,2_3.1.2_7D11_Restore.ipsw [the VFDecrypt key you copied]
Step 10: Upon execution of the command, zephyr_main.bin, zephyr_aspeed.bin, and zephyr2.bin is obtained in ‘idroid’ folder. Move these files into the ‘firmware’ folder.
You now have all the files needed for Android, and you can begin installing it.
Step 11: If you haven’t already, install the OpenSSH tool on iPhone via Cydia.
Step 12: If you just installed OpenSSH, connect to your iPhone via SSH, log in as root with the password alpine, and change the password for root by typing passwd root. Then, enter passwd mobile to change the password for the mobile user.
Step 13: Extract prebuilt/android.img.gz, prebuilt/cache.img, prebuilt/ramdisk.img, prebuilt/system.img, prebuilt/userdata.img, and zImage from the prebuilt tarball.
Step 14: Use the ‘scp’ command or an SFTP client to upload all of these files into the /private/var folder on the iPhone.
You can use these commands on Linux, if you wish to use scp. Assuming you’re in the same folder as the files, enter:
scp android.img.gz root@[ip address of iPhone]:/private/var/
scp cache.img root@[ip address of iPhone]:/private/var/
scp ramdisk.img root@[ip address of iPhone]:/private/var/
scp system.img root@[ip address of iPhone]:/private/var/
scp userdata.img root@[ip address of iPhone]:/private/var/
scp zImage root@[ip address of iPhone]:/private/var/
Step 15: Using the SFTP client or scp, create a folder called firmware in the /private/var folder on the iPhone. Now, upload all the files from the ‘firmware’ folder.
If the ‘firmware’ folder is inside the home directory, use the following command:
scp -r ~/firmware/ root@[ip address of iPhone]:/private/var/firmware
Step 16: Reboot iPhone. Check to ensure the files are still present after the reboot and that they all have the right sizes. An incorrect file size will not exactly match the source file size.
Step 17: Extract utils/oibc, utils/loadibec, and prebuilt/openiboot.img3 from the prebuilt tarball into ‘idroid’ folder.
Step 18: Shut down the iPhone and place it into Recovery Mode: With the iPhone powered off and plugged into the computer via USB, push Hold and Home simultaneously, and then let go of Hold after the backlight turns on. Continue holding Home until the ‘Connect to iTunes’ image appears on the screen.
Step 19: Run the following commands in Terminal
cd ~/idroid
sudo ./loadibec openiboot.img3
The ‘openiboot’ boot menu should now appear!
Step 20: Use either the volume-control buttons or the Hold button to select the second menu option, Console. Tap the Home button to launch it. A text-mode console should start running on the screen, ending with a ‘Welcome to openiboot’ message.
Step 21: Type sudo ./oibc in Terminal.
The same messages that appeared on the iPhone screen should now appear in Terminal. Create a backup of the NOR, if something goes wrong, your iPhone is safe.
Step 22: Type nor_read 0×09000000 0×0 1048576 in Terminal/oibc. This will read the entire NOR into main memory.
Step 23: Type ~norbackup.bin@0×09000000:1048576 in Terminal/oibc. A file will appear in the ‘idroid’ folder> norbackup.bin. Save it. The command uploads the NOR to the computer. After you make this backup, you are now free to modify the NOR. The next step installs OpeniBoot onto the NOR, supplanting the existing Apple iBoot bootloader.
Step 24: Type install in Terminal/oibc. This process may take a few minutes. Wait until the installation-complete message appears.
Step 25: Type reboot in Terminal/oibc and then exit by pressing Ctrl-C. The OpeniBoot menu should now pop whenever you boot your iPhone. You can uninstall OpeniBoot from oibc with the ‘uninstall’ command. Type help for a list of all OpeniBoot commands.
You can still get into the iPhone OS’s recovery mode by holding down Home on the iPhone OS option in the menu until the ‘Connect to iTunes’ image appears.
Use the OpeniBoot menu to boot Android by selecting that OS from the menu whenever you wish.
With this step-by-step guide you can now convert your iPhone into a functional Android device and upload your favourite apps and widgets that you wanted to try out for a long time. However, few bugs and performance issues remain, making your phone work a little slow, but if that’s okay with you, then read on.
Requirements:
- First-generation iPhone/ iPhone 3G with firmware versions between 2.0 and 3.1.2, jailbroken with Redsn0w, Blacksn0w, or PwnageTool. If the software is already updated to 3.1.3/ 4.0 beta, use PwnageTool to create a jailbroken 3.1.2 .ipsw file to restore.
- A 32-bit Linux system (Unbuntu) or virtual machine depending on the type of handset you own.
- The iPhone OS 3.1.2 .ipsw file for your device, namely either iPhone1,1_3.1.2_7D11_Restore.ipsw or iPhone1,2_3.1.2_7D11_Restore.ipsw.
- The firmware for the Marvell WLAN chip inside the iPhone- Visit URL > Choose your platform > Select Linux 2.6 – Fedora>Click the Search button underneath> Download file SD-8686-LINUX26-SYSKT-9.70.3.p24-26409.P45-GPL. You’ll obtain a file called SD-8686-LINUX26-SYSKT-9.70.3.p24-26409.P45-GPL.zip.
Before starting the process, extract .ipsw file from the Marvell’s Website for multitouch and WLAN firmware for the iPhone.
Step 1: On the Linux machine, create a folder “Firmware” in home directory.
Step 2: Extract SD-8686-FEDORA26FC6-SYSKT-GPL-9.70.3.p24-26409.P45.tar from SD-8686-LINUX26-SYSKT-9.70.3.p24-26409.P45-GPL.zip to a temporary folder.
Step 3: Extract FwImage/helper_sd.bin and FwImage/sd8686.bin from SD-8686-FEDORA26FC6-SYSKT-GPL-9.70.3.p24-26409.P45.tar and move them to ‘firmware’ folder.
Step 4: Rename helper_sd.bin to sd8686_helper.bin. Now, you obtain WLAN firmware. Next we work over the multitouch firmware.
Step 5: On the Linux machine, create a folder “idroid” in home directory. Extract utils/dripwn from the prebuilt tarball (downloaded .tar archive).
Step 6: Copy 3.1.2 .ipsw file obtained from Apple’s Website into the ‘idroid’ folder as dripwn.
Step 7: Begin a command-line shell (Terminal under Ubuntu) and navigate to the ‘idroid’ folder. Type cd ~/idroid.
Step 8: Visit the page and copy the VFDecrypt key.
Step 9: For 1st generation iPhone, type the following in the shell
./dripwn iPhone1,1_3.1.2_7D11_Restore.ipsw [the VFDecrypt key you copied]
For iPhone 3G:
./dripwn iPhone1,2_3.1.2_7D11_Restore.ipsw [the VFDecrypt key you copied]
Step 10: Upon execution of the command, zephyr_main.bin, zephyr_aspeed.bin, and zephyr2.bin is obtained in ‘idroid’ folder. Move these files into the ‘firmware’ folder.
You now have all the files needed for Android, and you can begin installing it.
Step 11: If you haven’t already, install the OpenSSH tool on iPhone via Cydia.
Step 12: If you just installed OpenSSH, connect to your iPhone via SSH, log in as root with the password alpine, and change the password for root by typing passwd root. Then, enter passwd mobile to change the password for the mobile user.
Step 13: Extract prebuilt/android.img.gz, prebuilt/cache.img, prebuilt/ramdisk.img, prebuilt/system.img, prebuilt/userdata.img, and zImage from the prebuilt tarball.
Step 14: Use the ‘scp’ command or an SFTP client to upload all of these files into the /private/var folder on the iPhone.
You can use these commands on Linux, if you wish to use scp. Assuming you’re in the same folder as the files, enter:
scp android.img.gz root@[ip address of iPhone]:/private/var/
scp cache.img root@[ip address of iPhone]:/private/var/
scp ramdisk.img root@[ip address of iPhone]:/private/var/
scp system.img root@[ip address of iPhone]:/private/var/
scp userdata.img root@[ip address of iPhone]:/private/var/
scp zImage root@[ip address of iPhone]:/private/var/
Step 15: Using the SFTP client or scp, create a folder called firmware in the /private/var folder on the iPhone. Now, upload all the files from the ‘firmware’ folder.
If the ‘firmware’ folder is inside the home directory, use the following command:
scp -r ~/firmware/ root@[ip address of iPhone]:/private/var/firmware
Step 16: Reboot iPhone. Check to ensure the files are still present after the reboot and that they all have the right sizes. An incorrect file size will not exactly match the source file size.
Step 17: Extract utils/oibc, utils/loadibec, and prebuilt/openiboot.img3 from the prebuilt tarball into ‘idroid’ folder.
Step 18: Shut down the iPhone and place it into Recovery Mode: With the iPhone powered off and plugged into the computer via USB, push Hold and Home simultaneously, and then let go of Hold after the backlight turns on. Continue holding Home until the ‘Connect to iTunes’ image appears on the screen.
Step 19: Run the following commands in Terminal
cd ~/idroid
sudo ./loadibec openiboot.img3
The ‘openiboot’ boot menu should now appear!
Step 20: Use either the volume-control buttons or the Hold button to select the second menu option, Console. Tap the Home button to launch it. A text-mode console should start running on the screen, ending with a ‘Welcome to openiboot’ message.
Step 21: Type sudo ./oibc in Terminal.
The same messages that appeared on the iPhone screen should now appear in Terminal. Create a backup of the NOR, if something goes wrong, your iPhone is safe.
Step 22: Type nor_read 0×09000000 0×0 1048576 in Terminal/oibc. This will read the entire NOR into main memory.
Step 23: Type ~norbackup.bin@0×09000000:1048576 in Terminal/oibc. A file will appear in the ‘idroid’ folder> norbackup.bin. Save it. The command uploads the NOR to the computer. After you make this backup, you are now free to modify the NOR. The next step installs OpeniBoot onto the NOR, supplanting the existing Apple iBoot bootloader.
Step 24: Type install in Terminal/oibc. This process may take a few minutes. Wait until the installation-complete message appears.
Step 25: Type reboot in Terminal/oibc and then exit by pressing Ctrl-C. The OpeniBoot menu should now pop whenever you boot your iPhone. You can uninstall OpeniBoot from oibc with the ‘uninstall’ command. Type help for a list of all OpeniBoot commands.
You can still get into the iPhone OS’s recovery mode by holding down Home on the iPhone OS option in the menu until the ‘Connect to iTunes’ image appears.
Use the OpeniBoot menu to boot Android by selecting that OS from the menu whenever you wish.
