iDroid?

# cd /jb
# ls -l
total 608
-r-xr-xr-x   1 root  admin   32784 Sep 21 20:14 fdisk
-r-xr-xr-x   1 root  admin  185008 Sep 21 20:14 fsck_hfs
-r-xr-xr-x   1 root  admin   19236 Sep 21 20:14 mount_hfs
-r-xr-xr-x   1 root  admin   46300 Sep 21 20:14 newfs_hfs
-rwxr-xr-x   1 root  admin   14916 Jan 20 00:02 umount
# sum *
59451    33 fdisk
36441   181 fsck_hfs
25703    19 mount_hfs
27289    46 newfs_hfs
37089    15 umount
# PATH=.:$PATH
# tar -cf /private.tar --preserve /private/var
tar: Removing leading `/' from member names
tar: /private/var/run/asl_input: socket ignored
tar: /private/var/run/lockdown/localcomm: socket ignored
tar: /private/var/run/lockdown/syslog.sock: socket ignored
tar: /private/var/run/mDNSResponder: socket ignored
tar: /private/var/run/pppconfd: socket ignored
tar: /private/var/run/syslog: socket ignored
tar: /private/var/tmp/launchd/sock: socket ignored
# umount -f /private/var
# mount
/dev/disk0s1 on / (hfs, local)
devfs on /dev (devfs, local)
# fdisk -e /dev/disk0
fdisk: could not open MBR file /usr/standalone/i386/boot0: No such file or directory
Enter 'help' for information
fdisk: 1> edit 2
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 2: AF 1023 254  63 - 1023 254  63 [     76923 -    3887982] HFS+
Partition id ('0' to disable)  [0 - FF]: [AF] (? for help)
Do you wish to edit in CHS mode? [n]
Partition offset [             0 - 3964928      ]: [76863]
Partition size [1 - 3888065]: [3888065] 3811059
fdisk:*1> edit 3
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 3: 00    0   0   0 -    0   0   0 [         0 -          0] unused
Partition id ('0' to disable)  [0 - FF]: [0] (? for help) AF
Do you wish to edit in CHS mode? [n]
Partition offset [             0 - 3964928      ]: [3887922]
Partition size [1 - 77006]: [77006]
fdisk:*1> print
Disk: /dev/disk0	geometry: 983/64/63 [3964928 sectors]
Sector size: 4096 bytes
Offset: 0	Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: AF    0   1   1 - 1023 254  63 [        63 -      76800] HFS+
 2: AF 1023 254  63 - 1023 254  63 [     76863 -    3811059] HFS+
 3: AF 1023 254  63 - 1023 254  63 [   3887922 -      77006] HFS+
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused
fdisk:*1> write
Device could not be accessed exclusively.
A reboot will be needed for changes to take effect. OK? [n] y
Writing MBR at offset 0.
fdisk: 1> quit
# sync; sync; sync
# mv /dev/disk0s4 /dev/disk0s2
# mv /dev/rdisk0s4 /dev/rdisk0s2
# newfs_hfs /dev/disk0s2
Initialized /dev/rdisk0s2 as a 14887 MB HFS Plus volume
# mount -t hfs /dev/disk0s2 /private/var
# cd /private/var
# tar -xf /private.tar
tar: private/var/db/localtime: Cannot change ownership to uid 0, gid 80: Function not implemented
tar: Error exit delayed from previous errors
# mv ./private/var/* /private/var && rm -rf ./private
# mount -o ro /
# dd if=/dev/rdisk0s1 of=/dev/rdisk0s3 bs=4096
76800+0 records in
76800+0 records out
314572800 bytes transferred in 232.663737 secs (1352049 bytes/sec)
# fsck_hfs /dev/disk0s3
** /dev/rdisk0s3
** Checking HFS Plus volume.
** Detected a case-sensitive catalog.
** Checking Extents Overflow file.
** Checking Catalog file.
** Checking multi-linked files.
** Checking Catalog hierarchy.
** Checking Extended Attributes file.
** Checking volume bitmap.
** Checking volume information.
   Volume Header needs minor repair
** Repairing volume.
** Rechecking volume.
** Checking HFS Plus volume.
** Detected a case-sensitive catalog.
** Checking Extents Overflow file.
** Checking Catalog file.
** Checking multi-linked files.
** Checking Catalog hierarchy.
** Checking Extended Attributes file.
** Checking volume bitmap.
** Checking volume information.
** The volume Snowbird3A110a.N45Bundle was repaired successfully.
# mount -o rw /
# mkdir /mnt
# mount -t hfs /dev/disk0s3 /mnt
# sed -e "s/disk0s1/disk0s3/" < /mnt/etc/fstab > /tmp/fstab && mv /tmp/fstab /mnt/etc/fstab && cat /mnt/etc/fstab
/dev/disk0s3 / hfs rw 0 1
/dev/disk0s2 /private/var hfs rw 0 2
# cd /mnt
# mv sbin mysbin
# ln -s /mysbin sbin
# cd /jb
# umount /mnt
# find /private/var -name Installer -exec rm -rf {} \;
find: /private/var/root/Library/Caches/Installer: No such file or directory
find: /private/var/root/Library/Installer: No such file or directory
# nvram boot-partition=2
# nvram boot-args="rd=disk0s3 -v"
# nvram -p
backlight-level	32
bootdelay	0
auto-boot	true
boot-args	rd=disk0s3 -v
debug-uarts	3
boot-partition	2
# sync
# reboot
Connection to 192.168.7.16 closed by remote host.
Connection to 192.168.7.16 closed.
macbook% ssh itouch
# mount
/dev/disk0s3 on / (hfs, local, noatime)
devfs on /dev (devfs, local)
/dev/disk0s2 on /private/var (hfs, local, noatime)
#
## At this point, I did an Update to 1.1.4 from iTunes
## Then I continued...
macbook% pwd
~/Desktop/iPhone/poddmg/1.1.4
macbook% ls -l kernelcache.release.s5l8900xrb
-rw-r--r--  1 eric  staff  3356266 Feb  7 01:01 kernelcache.release.s5l8900xrb
macbook% iphuc
iphuc 0.6.1
>> By The iPhoneDev Team: nightwatch geohot ixtli warren nall mjc operator
recovery callback: Connected in Recovery Mode
recovery callback: Entering shell in Recovery Mode.
(iPHUC Recovery) #: filecopytophone ./kernelcache.release.s5l8900xrb
filecopytophone: 0
(iPHUC Recovery) #: cmd setenv\ boot-args\ "rd=disk0s3\ -v"
(iPHUC Recovery) #: cmd setenv auto-boot true
(iPHUC Recovery) #: cmd saveenv
(iPHUC Recovery) #: cmd bootx
macbook% ssh itouch
# mount
/dev/disk0s3 on / (hfs, local, noatime)
devfs on /dev (devfs, local)
/dev/disk0s2 on /private/var (hfs, local, noatime)
# cd /jb
# PATH=.:$PATH
# fsck_hfs /dev/disk0s1
** /dev/rdisk0s1
** Checking HFS Plus volume.
** Detected a case-sensitive catalog.
** Checking Extents Overflow file.
** Checking Catalog file.
** Checking Catalog hierarchy.
** Checking Extended Attributes file.
** Checking volume bitmap.
** Checking volume information.
** The volume LittleBear4A102.N45Bundle appears to be OK.
# mkdir /mnt
# mount -t hfs /dev/disk0s1 /mnt
# sed -e "s/501/0/g" < /mnt/etc/passwd > /tmp/passwd && mv /tmp/passwd /mnt/etc
# sed -e "s/501/0/g" < /mnt/etc/master.passwd > /tmp/master.passwd && mv /tmp/master.passwd /mnt/etc
# cp -pr /Applications/Term-vt100.app /mnt/Applications/
# cp -pr /Applications/Installer.app  /mnt/Applications/
# vim /mnt/System/Library/Lockdown/Services.plist
# sed -e "s/hfs ro/hfs rw/" < /mnt/etc/fstab > /tmp/fstab && mv /tmp/fstab /mnt/etc/
# sed -e "s/noexec,//" < /mnt/etc/fstab > /tmp/fstab && mv /tmp/fstab /mnt/etc/
# cat /mnt/etc/fstab
/dev/disk0s1 / hfs rw 0 1
/dev/disk0s2 /private/var hfs rw,nodev 0 2
# umount /mnt
# nvram boot-partition=0
# nvram boot-args="-v"
# nvram -p
auto-boot	true
bootdelay	0
debug-uarts	3
backlight-level	32
filesize	3356266
boot-args	-v
boot-partition	0
# sync
# reboot