Step 2. Get the disk image of your iPhone file system.

A. Downgrade your iPhone to 1.1.1 and Jailbreak.

Start Activity Monitor and kill the iTunes Helper process.

Download iNdependence.

Download the iPhone 1.1.1 firmware. When it downloaded for me, Leopard automatically unzips the file. You will need to select the 5 files in the folder it extracts and compress them again. Name the zip file iPhone1,1_1.1.1_3A109a_Restore.ipsw.

Connect your iPhone to iTunes. Press and hold the Home button and the Sleep/Lock button at the same time. The phone will eventually show the Slide to Power Off slider. Keep holding the buttons down until the phone shuts off, at this point count 3 seconds in the 1 1000, 2 1000, etc fashion. Once you hit 3 seconds, release the Sleep/Lock button and keep holding the Home button. iTunes will eventually pop a dialog that states it has detected an iPhone in recovery mode. You can dismiss this dialog. You now want to Option+Click the Restore button. You can not navigate to the iPhone1,1_1.1.1_3A109a_Restore.ipsw file and start the restore. Kick back and wait about 5 minutes. Pet your Lemur and give him a sip of your energy drink. The restore process will error out toward the end. Dismiss the error dialog and exit iTunes.

Okay. Now you have a screen on your iPhone telling you to connect to iTunes. Launch iNdependence. Watch the status bar area of iNdependence. It will say connected to iTunes in recovery mode and then switch to a disconnected state and say it is waiting for the iPhone. You can now close iNdependence. Your iPhone will eventually reboot and show you the familiar Activation screen where it wants you to connect to iTunes again.

Go ahead and Slide for Emergency. You are now going to dial *#301# and tap Call. Your iPhone will start to ring. Now use the backspace key to delete the *#301# and dial 0 and tap Call again. This time you will restart to receive a call. Put that call on Hold and Decline the next call. This will drop you into the area of the phone where you can access your Contacts. You will need to create a new contact. In the new contact screen you are going to add two URLs. The first one will be prefs: and the second one will be jailbreak.toc2rta.com. Save your contact and click on the prefs: URL. Go into your Wi-Fi settings and connect to your network. Note your IP address for later. Now go into your General settings and turn off Auto-Lock. You can tap the top to return to call. This will return you back to the home Activation screen.

Go ahead and Slide for Emergency. You are now going to dial 0 and tap Call. You will restart to receive a call. Put that call on Hold and Decline the next call. This will drop you into the area of the phone where you can access your Contacts. This time tap the contact No Name and choose the jailbreak.toc2rta.com URL. It will send you back to the home Activation screen, except now you have root access to /. You are jail broken!

B. Install iphuc and start phucing around.

Now go download and install MacPorts. If you need any help with MacPorts, there is plenty of documentation at www.macports.org. Once you have MacPorts all set to go. Go ahead and install readline (sudo port install readline). Go have some more fun with your Lemur.

Now you can download my patched version of iphuc, which also includes an XCode project.

You will need to go into the project setting and make sure its set to the proper architecture for building. I had to set it to i386 from ppc. Go ahead and build iphuc. You can now copy the final built iphuc to where ever your staging area is set up. In the same directory as iphuc, create a new directory called iphonefs.

svn co http://iphone-elite.googlecode.com/svn/trunk/iphucsf iphucsf

Execute iphuc. Once you are at the iphuc prompt, you will need to execute the following command:

getfile /dev/rdisk0s1 iphonefs/rdisk0s1 314572800

This will take about 5 minutes. Yay! More Lemur time

Once this is done, you will have an rdisk0s1 file in your iphonefs folder. Append an .dmg extension on the end of it and you have a mountable iPhone file system. You have completed step 1. Get up and do a victory dance with your Lemur. Once you have finished this step, I recommend restoring your iPhone to 1.1.1 and following one of the many guides on Jailbreaking your iPhone, upgrading to 1.1.2 and Jailbreaking 1.1.2.

Step 3. Installing the iPhone Dev Toolchain.

Drudge and Lupinglade created a nice document on how to install the tool chain here. I followed this and ran into some issues with some stuff that seemed to be missing, at least for me. So I am going to use there guide as a base and add in the things I did to get it to work. This should all be done in your staging area directory. If you run into any permission issues, just use sudo and perform the same command.

Check out a copy of LLVM SVN, and build a release build (as opposed to a debug one). Currently, due
to Issue 70, we are limited to revision 42498.

svn co http://llvm.org/svn/llvm-project/llvm/trunk llvm-svn -r 42498
pushd llvm-svn
sudo bash ./configure –enable-optimized
sudo make ENABLE_OPTIMIZED=1
sudo make install
export LLVMOBJDIR=`pwd`
popd

Check out a copy of the iphone-dev SVN repository.

svn checkout http://iphone-dev.googlecode.com/svn/trunk/ iphone-dev
pushd iphone-dev

Make a directory to hold the toolchain.

sudo mkdir -p /usr/local/arm-apple-darwin

Build odcctools. Note: The /Devloper/ path might be different if you installed the developer tools somewhere else besides default.

mkdir -p build/odcctools
pushd build/odcctools
../../odcctools/configure –target=arm-apple-darwin –disable-ld64
export INCPRIVEXT=”-isysroot /Developer/SDKs/MacOSX10.4u.sdk”
sudo make
sudo make install
popd

Mount the rdisk0s1.dmg you created in Step 2. Open terminal and run

sudo mkdir -p /usr/local/share/iphone-filesystem
sudo cp -Rp /Volumes/Snowbird3A110a.N45Bundle/* /usr/local/share/iphone-filesystem/

Note that the above Volume could be different. On my machine it was Snowbird3A109a.UserBundle.

Now, set the environment variable $HEAVENLY to its path:

export HEAVENLY=/usr/local/share/iphone-filesystem

Patch the system headers

pushd include
sudo bash ./configure –with-macosx-sdk=/Developer/SDKs/MacOSX10.4u.sdk
sudo bash install-headers.sh
popd

Install csu, which includes crt1.o, dylib1.o, and bundle1.o. Don’t rebuild them from source, as this
requires a working cross-GCC, which you don’t have yet (and the build-from-source process for csu is
broken right now anyway). Binaries are provided for this reason.
mkdir -p build/csu
pushd build/csu
../../csu/configure –host=arm-apple-darwin
sudo make install
popd

Configure and make LLVM-GCC. Make sure that $LLVMOBJDIR and $HEAVENLY are set per the instructions
above.

mv llvm-gcc-4.0-iphone/configure llvm-gcc-4.0-iphone/configure.old
sed ’s/^FLAGS_FOR_TARGET=$/FLAGS_FOR_TARGET=${FLAGS_FOR_TARGET-}/g’ llvm-gcc-4.0-iphone/configure.old > llvm-gcc-4.0-iphone/configure
sudo ln -s /usr/local/arm-apple-darwin/lib/crt1.o \/usr/local/arm-apple-darwin/lib/crt1.10.5.o
sudo ln -s /usr/local/arm-apple-darwin/lib/dylib1.o \/usr/local/arm-apple-darwin/lib/dylib1.10.5.o
mkdir -p build/llvm-gcc-4.0-iphone
pushd build/llvm-gcc-4.0-iphone
export FLAGS_FOR_TARGET=”-mmacosx-version-min=10.1″
../../llvm-gcc-4.0-iphone/configure –enable-llvm=`llvm-config –obj-root` \
–enable-languages=c,c++,objc,obj-c++ –target=arm-apple-darwin –enable-sjlj-exceptions \
–with-heavenly=$HEAVENLY –with-as=/usr/local/bin/arm-apple-darwin-as \
–with-ld=/usr/local/bin/arm-apple-darwin-ld
make LLVM_VERSION_INFO=2.0-svn-iphone-dev-0.3-svn
sudo make install
popd
popd
You have completed Step 3.

Step 4. Setup XCode.

Lucas Newman has a nice XCode template he created to do iPhone development. It does not work with this tool chain setup. I patched it to work with this new set of instructions, you can get it here. View the README for instructions on how to install.

Launch XCode. Choose File->New Project. Choose “iPhone UIKit Application”. You should be able to build without errors.

One last major note. If you download any iPhone apps from code.google.com or from any of the numerous sites dedicated to teaching native iPhone development, you might run into an issue trying to use the Makefile’s included. You will need to modify them to work with this tool chain setup. An example would be:

Change “CC=/usr/local/arm-apple-darwin/bin/gcc” to “CC=/usr/local/bin/arm-apple-darwin-gcc -v”
Change “CC=/usr/local/arm-apple-darwin/bin/g++” to “CXX=/usr/local/bin/arm-apple-darwin-g++”

Remove “-Wl,-syslibroot,/usr/local/arm-apple-darwin/heavenly” from the LDFLAGS to avoid the
“-syslibroot: multiply specified” error.