About 5 hours ago (Thursday evening, less than a week after the 3GS launch), we were able to verify that the 24Kpwn exploit that the hybrid team used on the iPod Touch 2G is still applicable to the bootrom of the iPhone 3GS. That means we can use the same sort of technique used by our current redsn0w tool to jailbreak and unlock the iPhone 3GS. 

This is great news, but how did it happen?  Why didn’t Apple fix this in their normal cat&mouse fashion?  Well it seems this bootrom was cut in about the August 2008 timeframe, so the unintended early reveal of 24Kpwn earlier this year didn’t affect the iPhone 3GS.

For our technical notes on where the 24Kpwn exploit is in the 3GS, see here (pastebin hash of it is here).    Our original blog post for when this exploit was first found is here.

And yes, ultrasn0w will be able to be used on the iPhone 3GS for you unlockers!  (In fact, without any modifications whatsoever!)

Important: Apple has not given up on the cat&mouse game, and in fact there are challenging aspects of the 3GS jailbreak that aren’t in the other devices.  It’ll take some time to safely work these into our tools, but the fundamental weaknesses are there:  The bootrom is exploitable via 24Kpwn, and the baseband is exploitable via ultrasn0w.  (And just like with the 3G, ultrasn0w for 3GS requires that you not update your baseband when Apple comes out with new firmware.)