I wrote about reparinig the “Apple screen of death” in this post. Unfortunately I did not have SSH access to my phone this time since the upgrade from 2.1 to 2.2 rendered (Cydia OpenSSH server installation not working.

Still, I knew I had to prevent “mobilewatchdog.bundle” to load (read the other post to understand why.) So this time I just deleted the files by connecting via cable. By doing this I managed to get my SpringBoard preferences working again and I quickly installed OpenSSH to get regular Terminal access to the phone and restoring the “mobilewatchdog.bundle” again.

Here are the instructions:

WARNING: If this repair fails you will have a device that will reboot every 10 to 12 minutes – until you restore the full device from scratch. So try this repair as a last chance to recover from a “endless boot” device.

Read all steps before you begin. Step 1 and 2 (and step 3 and 4 later on) have to be completed in a few minutes since your phone will probably reboot after some time.

1.) First connect your phone to the Computer via cable and switch it on. Open up the free application DiskAid and make sure your phone is found. Then quickly change the small selector at the bottom left to “Root Folder”. Use “Copy to folder” to save the folder “mobilewatchdog.bundle” at “/System/Library/SystemConfiguration/” to you Computer. You will need this folder later again!

2.) Now delete the folder “mobilewatchdog.bundle” on the device by using the “Delete from Device” button.

Basically you delete the startup of a system daemon that will check every 2-3 minutes if Springboard could be loaded. If Springboard is not loaded “mobilewatchdog” would reboot your phone. Deleting this process will prevent the system from rebooting every 2-3 minutes. Still, every 10 minutes or so the system will still reboot by another process that cannot be deleted. But this 10 minutes should be enough to get your Springboard preferences restored

3.) Reboot. Wait. If you get to your SpringBoard again (or to the PIN screen) everything went fine. If your phone reboots again after 10-12 minutes without showing anything except your Apple or Pineapple logo then this repair failed and you have to fully restore your phone. But this never happened to me so far.

4.) Hurry! On SpringBoard you should open up Cydia and install “OpenSSH” as quick as possible! The phone will certainly reboot within 10-12 minutes and you want the installation do be finished by then!

Extra: If you do not see your Cydia logo on SpringBoard but you are sure it is installed – then you quickly go to the “Settings” panel, choose “General”, “Restrictions” and enable them. Then disable them again. This should bring you all your applications back to the SpringBoard!

5.) Installation done? Check if you can login via SSH to your phone.

6.) Reboot again and copy the “mobilewatchdog.bundle” files back to their location (/System/Library/SystemConfiguration/) by using DiskAid again or by using an SFTP client and the SSH login.

7.) Make sure you login via SSH and set the correct permissions of the files! If you do not do so the phone will still reboot every 10-12 minute since “mobilewatchdog.bundle” cannot be loaded at startup of the phone! enter these 3 commands when logged into your phone:

chmod 755 /System/Library/SystemConfiguration/mobilewatchdog.bundle
chmod 755 /System/Library/SystemConfiguration/mobilewatchdog.bundle/mobilewatchdog
chmod 644 /System/Library/SystemConfiguration/mobilewatchdog.bundle/Info.plist

If the files were put on the right location there should be no error message.

8.) Reboot again.

Thats it!

Your iPhone will reboot and show the “Apple Logo” (jailbroken devices will show a pineapple) and will not start the Springboard? And – showing only the logo – the iPhone will restart sometimes by itself?

- If your device is jailbroken and you have SSH installed and enabled you could have a solution right here!

While using Firmware 2.0, 2.0.1 and 2.0.2 I had this problem quite often. Now with firmware 2.1 it happenend only once while cancelling an AppStore application install.

Solution is quite simple: If your Springboard preferences are corrupted or for some other reason not valid the Apple iPhone OS will try to re-create them. Well, the more applications you have installed (I counted 110 on my main iPhone) the more time Springboard will need to recreate them. But the iPhone OS will only allow roughly 2 minutes for this process. If its not finished within this time it will kill the process and re-start it. Endlessly!

Solution is quite simple, as long as you manage to login into your device via SSH (read my other posts how to do this):

1) Reboot your device

2) Try to connect as root into your device using WiFi and SSH as fast as possible (read my other posts how to connect via SSH)

[If you do not have WiFi enabled by default you could still try to login via iTunnel. You will need a Windows PC or Windows on VMware. ]

3) Type in

mv /System/Library/SystemConfiguration/mobilewatchdog.bundle/ /

Make sure you do not forget the last “space” & “/“!

4) Type in

reboot

The device will reboot. Actually you removed the process that will kill Springboard every 2 minutes. But now you will have another problem: After 10 minutes or so a hardware monitoring process will have a check on the running system. Since it will not find the process you just prevented from booting the hardware monitoring process will re-boot the iPhone.

Still, this 10 minutes will be considerably longer than the 2 minutes before. Just let your iPhone reboot and wait about 10 minutes. Normally SpringBoard should load after 4-5 minutes. Your preferences are valid again.

-> If your iPhone reboots after 10 minutes you got some more severe problems that cannot be fixed by this tutorial. But in my case it rebooted into SpringBoard 95% of all times.

5) As soon as you see your beloved SpringBoard again you should make sure you copy the removed process starter back to its original position. Or you iPhone will continue to reboot every 10 minutes! So login using root and type:

mv /mobilewatchdog.bundle /System/Library/SystemConfiguration/

Do not wait with this too long as the iPhone should not reboot while this command is running! To be on the safe side you could wait for another reboot, login then as fast as possible (normally roughly a minute after rebooting started) and run the command.

So, how to avoid it? Upgrade to firmware 2.1. I had no problems at all using Firmware 2.1. As long as you are careful not to install/upgrade applications from the AppStore while runnig out of battery etc.

And make sure you got your SSH login enabled all times. Otherwise you will not be able to connect to your device as long as it is in booting mode!

If you have any question, feel free to post it here.

I tried to restore my Custom 2.0.2 firmware (PwnTool) via iTunes and got error 1600 while restoring.

There is an easy solution to this problem:

1) Open up the Terminal

2) enter:
cd ~/Library/iTunes/Device\ Support/

3) enter:
rm x*

This will delete the file “x12220000_4_Recovery.ipsw”.

4) Restart “PwnTool” and create a new custom “.ipsw” firmware.

iTunes will now restore your iPhone properly.

I had two situations so far where I had to fully restore my iPhone because no third party application (from the famous “App Store”) would work anymore. All default applications and all applications from Cydia or Installer would still work – but every “App Store” application would crash back to SpringBoard after loading and your bought music & films would not play.

Apple does not tell us whats the deal but I am quite sure about this: Its a copy protection for DRM protected music and applications. And it does not work correctly. Steve, shame on you!

I found a solution for the crashing applications: I patched the MobileInstaller framework in the System directory. Then I was able to delete and re-install applications from the local iPhone “App Store” and they would run again. But I will not post this workaround since your bought films and music will still not be playable. And Apple would send me love letters from their legal department.

So how to avoid this in general:

(1) DO NOT INSTALL APPLICATIONS FROM 2 USER ACCOUNTS. Even if the two accounts are yours and your computer is activated via iTunes for both accounts, every single new installation could render all your 3rd party apps useless! Even worse: You will notice this sometimes only after a reboot. Everything works fine and then you reboot your phone days later and wonder why you cannot start any of your bought applications. for some reason Apple considers this a DRM violation and shuts all your “App Store” apps down, no mery.

(2) DO NOT UPDATE APPLICATIONS USING THE LOCAL iPHONE APP STORE APPLICATION. This gave me my second experience with Apples great DRM protection. Yes, only one account. All applications legally bought. Just by updating a rather small application – and restarting afterwards – I left my device “broken by DRM”.

(3) To be on the safer side I would recommend not to install any applications via the local iPhone “App Store” application. I cannot confirm on this. But as long as you use only one acconut and install all applications via iTunes you should not get any further problems.

Create and backup a list of all your Cydia installed packages:

(1) Login via SSH into your iPhone (check old posts to know how to do that)

(2) Create a list of all your via Cydia installed packages by using this command:
dpkg -l | grep ^ii | awk '{print $2}' > /private/var/mobile/Media/installed.txt

(3) Copy the file “installed.txt” to your computer using SFTP or e.g. DiskAid.

Thats it. Now you can safely resotre or upgrade you phone. Make sure, Cydia is installed by using QuckPwn or PwnageTool.

Re-install all packages:

(1) Make sure you install OpenSSH with Cydia. Open Cydia, search for the OpenSSH package and install it. Then install all Repositories you had installed before: Open Cydia, go to “Sections” and open up “Repositories” and choose all you used before. Otherwise Cydia will not find all packages to restore.

(2) Copy the file “installed.txt” back to your device using using SFTP or DiskAid.

(3) Login into your iPhone using root:

ssh -l root (IP-number of your iPhone)

(4) This was edited and updated, so only new packages will be installed. Enter:
dpkg -l | grep ^ii | awk '{print $2}' > /private/var/mobile/Media/installed-new.txt
then
diff /private/var/mobile/Media/installed-new.txt /private/var/mobile/Media/installed.txt | grep ^\> | awk '{print $2}' > /private/var/mobile/Media/installed-todo.txt
then
apt-get install `cat /private/var/mobile/Media/installed-todo.txt`

(5) You will not see all installed applications, because the iPhone did not re-spring. So the easiest solution would be a “reboot” –> reboot now!

That should be all

iTunes will not backup all neccessary files. And even if it did backup your specific file, it is not that easy to get the specic file out of an iTunes backup. (I will give you a post how to extract files from iTunes backup files tomorrow.)

So my advice is to copy all files from your iPhone to your computer. Its quite simple!

You need a backup directory on your computer, i used “iPhone-Backup” in my home directory for this example.

(1) Make sure your computer and your iPhone are connected to the same WiFi network and you know the bonjour name or the IP-address of your iPhone.

(2) Make sure the iPhone auto-lock is set to off: Go to the iPhone “Settings”: Then to “General”, then “Auto-Lock” and choose “Never”. You can change this after backup but now you want to make sure the WiFi connection stays on while the backup runs.

(3) Open the Terminal.app on your computer

(4) Make sure you got the backup directory in your home folder already set up. If not, just type: mkdir ~/iPhone-Backup

(5) For the backup (and for all subsequent backups later) type in: rsync --exclude private/var/mobile/Media/iTunes_Control/ -av root@(your-iPhone-IP):/ ~/iPhone-Backup/ --delete

So if your iPhone address is 10.0.1.3 the command would look like this: rsync --exclude private/var/mobile/Media/iTunes_Control/ -av root@10.0.1.3:/ ~/iPhone-Backup/ --delete

Now you got to wait a little. An iPhone running on firmware 2.x will probably take a few minutes for the first backup. Without applications the copy folder should be about 600 MB.

What does the command actually do?

(a) rsync will copy files via SSH from the SSH-server account root folder (root@10.0.1.3:/) to the local folder (~/iPhone-Backup/) that are not already copied. So the first backup will take quite a long time, all next backups will only copy new or changed files.

(b) the copy will exclude all files in your iPhones “iTunes Media” folder. (actually all files starting with private/var/mobile/Media/iTunes_Control/) This is neccessary since all your synced music and fotos from iTunes are stored here. Otherwise you would get a backup of all this data already stored in your iTunes!

(c) The “--delete” tag at the end makes sure all files already backup up and not on the iPhone anymore will be deleted with the next backup. So if you delete e.g. some camera pictures on your iPhone, the backup pictures on your computer will be deleted as well with the next backup.

(d) The “-av” tag specifies the backup mode: Archiving (a) and verbose (v). In verbose mode you get a long list of files that were backup up. There will be some files that cannot be backed up: Some of them are only links to devices on the phone. And some are part of running processes on the iPhone, e.g. your temporary mail file. Do not worry too much about them. You could change “-av” to “-a” and avoid the long list at all after your backup is set up correctly.

A little correction:

The Photo database will be copied: It is in ~/Media/Photos/ So the correct syntax for not copying the photo database would be: rsync --exclude private/var/mobile/Media/Photos/ --exclude private/var/mobile/Media/iTunes_Control/ -av root@10.0.1.3:/ ~/iPhone-Backup/ --delete

Hint: You can exclude any other folders – as long as you add an --exclude before any of them. Listing them after the --exclude command (space or comma separated) will not work!

Something like:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

The RSA host key for xxx.local has changed,
and the key for the according IP address xxxx
is unchanged. This could either mean that
DNS SPOOFING is happening or the IP address for the host
and its host key have changed at the same time.
Offending key for IP in /Users/admin/.ssh/known_hosts:x
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx.
Please contact your system administrator.
Add correct host key in /Users/admin/.ssh/known_hosts to get rid of this message.
Offending key in /Users/admin/.ssh/known_hosts:x
RSA host key for xxx.local has changed and you have requested strict checking.
Host key verification failed.

You probably just tried to login to your iPhone using an (DHCP) WiFi IP-address that was in use by some other iPhone before. Or you try to log into your iPhone using the iPhone name (e.g. iPhone.local) instead of an IP-address.

If you are sure there is no other party on your WiFi network and no DNS spoofing possible the solution is quite easy: Just delete the known_hosts file on your host computer by typing in: rm ~/.ssh/known_hosts

I just found out a small little extra that I was never aware of: You can use the name you gave your iPhone on iTunes to login into your phone. Just add a .local to the name.

So if your iPhone name on iTunes is twiPhone, you can always reach your iPhone by using twiPhone.local instead of a cryptic IP address. This should help you al ot if you are using more than one WiFi network with your iPhone.

Remember: The name is case-sensitive! So twiPhone.local would work, twiphone.local not!

The same name will be used for Bonjour as well. Check “Bonjour Browser” and see you iPhone registered in your network with SSH and SFTP

So to connect via ssh use: ssh -l root (your-iPhone-name-goes-here).local

7 easy steps to create your automatic login:

• (1) Open Terminal.app on your computer
• (2) Make sure you got a RSA key pair on your computer. If you use SSH to login into other computers, servers or iPhones this could already be the case, so check: ls .ssh (or ls ~/.ssh). If you see two files id_rsa and id_rsa.pub this is already the case. If not, create your own key-files for the computer by simply typing in: ssh-keygen -t rsa Do NOT repeat this step unless you want to create new key-files. Then you should repeat all of the steps, the old key-files will be overwritten.
• (3) Log into your iPhone via WiFi by using:
  ssh -l root (IP-address of iPhone)
• (4) Create the .ssh directory on your iPhone: mkdir ~/.ssh
• (5) This step is crucial, use this syntax only if your iPhone runs on firmware 2.x! Change the iPhone SSH server to accept key-files by typing in this: echo AuthorizedKeysFile .ssh/authorized_keys >> /private/etc/ssh/sshd_config
• (6) Exit the iPhone SSH shell by using: exit
• (7) Now on your Mac copy your public key-file to the iPhone by using this syntax: scp ~/.ssh/id_rsa.pub root@10.0.1.3:.ssh/authorized_keys

Thats it! Try now to re-connect to your iPohne by using: ssh -l root (IP-address of iPhone) There should be no password prompt anymore. Your computer is authorized by checking the public key file on the iPhone (id_rsa.pub) against your private key-file (id_rsa).

Hint: If you are on firmware 1.x you should change step (5) to this: echo AuthorizedKeysFile .ssh/authorized_keys >> /etc/ssh/sshd_config

The second part will give you a quick advice how to secure your new SSH server.

Installing SSH server:

• Open Cydia on your phone. (If you do not have Cydia installed on your phone you still have to jailbreak your iPhone.)
• This step could be necessary if you never run Cydia before: Press “Changes” and make sure you install all necessary upgrades that will show up. A newly jailbroken iPhone will have 6 to 8 necessary updates showing up. Make sure you do not upgrade automatically as this gave me quite a lot of problems. Instead start to upgrade the “Cydia Installer” first. Then quit and restart Cydia immediately afterwards. It will take quite a while after the restart to re-arrange everything. DO NOT INTERRUPT this step. Then make sure you upgrade all other packages like APT, Core Utilities, SQLite v3, OpenSSL, Cydia Sources etc.
• In Cydia, press “Search” and enter “OpenSSH”. Choose the “OpenSSH” package from Teleshoreo and press “Install”
• Quit Cydia after installing.

Remember: You now have an “up & running” SSH server on your phone. Everyone can connect to your phone using a SSH client and the standard password alpine.

Secure your iPhone SSH server:

• Make sure your iPhone is connected to you WiFi network.
• Go to “Settings” , then to “Wi-Fi”
• Press the round blue button to the right of your connected network
• It will show you your network settings, make sure you get the “IP Address” – its the address of your iPhone right now.

• Open your Terminal application
• type in: ssh -l root (IP-Address of your iPhone)
• The first time you connect to your iPhone secure keys are generated. This could take up to a minute, so be patient.
• A password prompt should show up, enter: alpine
• Now you are on your phone, you should change your password immediately, enter: passwd
• You will be asked twice for a new password, make sure its not to easy to guess. No, 12345 and password are no good choices
• Now exit the iPhone by typing in: exit

Most tutorials on the web forget about the second standard user your iPhone will have. Actually while root is the most powerfull user there is still user mobile. And this user has enough rights to change about every little apsect of your iPhone. So we should change the standard password for this user as well!

• On you Terminal application, type in: ssh -l mobile (IP-Address of your iPhone)
• A password prompt should show up, enter: alpine
• Enter: passwd
• Since this is not the root user the system will ask you for your old password first, enter: alpine
• Then type in your new password twice. As a security measure it should not be the same password as used for the root user!
• Again, exit by typing: exit

Voila! You SSH server is safe now. Do not forget that it will be always on. So if someone has your current iPhones IP address he will be able to connect to your iPhone. But now the new passwords have to be used to login.

Remember that you have to change the passwords after every firmware upgrade again. Even if you restored from an iTunes backup the passwords for the SSH server will be reset to the standard passwords!

On the next post I will give you some advice how to connect securely from you Mac to your iPhone without having to type in you password.