How to Jailbreak iPhone 3GS OS 3.1 | Jailbreak iPhone OS 3.1 with PwnageTool

How to Jailbreak iPhone 3GS OS 3.1 with PwnageTool (Mac)

In this iPhone Guide you will learn how to Jailbreak iPhone 3GS OS 3.1 using PwnageTool. After jailbreaking your iPhone 3GS using this Guide you will be able to Unlock iPhone 3GS for any carrier with the UltraSn0w. Unlock Guide link is available at the end of this guide.

This iPhone tutorial is meant for MAC OS X and iPhone 3GS users Only.


  1. This PwnageTool guide works for only those iPhone 3GS that are NOT already on OS 3.1. In other words this guide is for only those iPhone 3GS users who are currently on iPhone OS 3.0 or 3.0.1 and never got OS 3.1 on their 3GS.
  2. If you fulfill the first condition, the make sure you iPhone 3GS running OS 3.0 or 3.0.1 is already pwned. It’s compulsory. If it is not then follow the follow guides to jailbreak your iPhone 3GS OS 3.0 or 3.0.1 first:

Please proceed only if you meet the above mentioned conditions.

Now considering that you have iPhone 3GS running iPhone OS 3.0 or 3.0.1 and is already pwned. Now you’re good to update to iPhone OS 3.1 using the instructions below.

Create a folder on your desktop and name it: Pwnage. Then download the following files and put them into Pwnage folder:


Jailbreak iPhone 3GS OS 3.1

Step 1
Double click PwnageTool_3.1.3 dmg file to mount it.


Click and drag the PwnageTool icon to Pwnage Folder you created and then open it from there.


Warning Box will Popup. Just hit the OK button.


Step 2
Make sure you select Expert Mode from Top menu


Step 3
Select your device i.e: iPhone 3GS. A big Green check mark will appear on the selected device.
Now hit the big Blue Arrow button at bottom right to proceed.


Step 4
On the next page, PwnageTool will automatically find the IPSW file. If not found then click “Browse for IPSW” button and select the downloaded IPSW file: iPhone2,1_3.1_7C144_Restore.ipsw. A check mark will appear next to it.



Then hit Blue Arrow Button to proceed.

Step 5
On the next page you will have 6 choices. Select the General and hit Blue Arrow Button to proceed.


Step 6
On the next Page you can decide your Root Partition Size where OS resides. Click activate the phone (only if you’re on unofficial carrier).

***Deselect Activate the phone option if you are on official carrier. For the 3.1 firmware you may have to increase the size of your root partition slightly for the IPSW build to be successful. 695MB worked just fine for me***


The Bootneuter settings are greyed out for the iPhone 3GS. Click the blue arrow button.


The next screen will show the Cydia settings menu. It allows you to create custom packages so you do not have to manually install them later.


Go to Download packages tab.and hit the Refresh button to display all the available packages. Double click your desired package, it will be downloaded and will be available under the Select Packages tab.


When you have downloaded your desired packages, go back to Select Packages tab and check mark the ones you want.


then hit the Blue Arrow Button to proceed.

Custom Packages Settings will displays listed package settings for your custom IPSW. Leave these settings as is for now. Just click the Blue Arrow Button to proceed.


On the next Custom Logos Settings menu, you’ll be able to add your own images as boot logos. Click the Browse button to select your Boot logo and Recovery logo. I just use defaults so deselected all options.


Click the blue arrow button to continue.

Step 7
Now you are  ready to build your custom firmware. Click the build button to select it, then click the blue arrow button to proceed.


Step 8
You will be asked to Save your custom .ipsw file. Save it to the same Pwnage folder.


Step 9
PwnageTool will start building your custom firmware. Wait until it’s done.


If prompted enter your Administrator password and click the OK button.


Step 10
Now you will be asked  to close PwnageTool and put your iPhone 3GS into recovery mode.
Hit the OK button.


Step 11
Now connect your iPhone 3GS to your computer and put it into Recovery Mode using the following instructions:

How to Put iPhone in Recovery Mode

Once you have successfully entered your iPhone 3GS into Recovery Mode, the iTunes logo and a cable will appear on your iPhone screenand iTunes will also popup saying it has detected an iPhone in Recovery Mode.



Click OK button.

Step 12
In iTunes, hold the Alt/Option key and hit Restore.


Step 13
From the popup window, browse to the Pwnage Folder and select you custom .ipsw file that you just created (iPhone2,1_3.1_7C144_Custom_Restore.ipsw) and click Open Button.


Step 14
iTunes will now restore the firmware on your iPhone. This can also take up to 10 minutes.


When all done, You have successfully Jailbreak iPhone 3GS running iPhone OS 3.1.

Now you can use the same ultraSn0w guide to: unlock iPhone 3GS 3.1

Have fun and don’t forget to leave a few lines under comments section.

17 comments… add one
Adi October 4, 2009, 11:39 am

I have a question. I have jailbroken/unlocked 3GS with OS 3.0 (using T-Mobile currently). In step 6, do I have to select “Activate the phone” or diselect it to continue with jailbreaking the phone. I would like to upgrade to OS 3.1 and to unlock it for T-Mobile. Thank you.

iPhone Heat October 4, 2009, 9:23 pm

For any unofficial carrier you MUST check mark Activate the Phone option.

naveen October 4, 2009, 7:09 pm

am using iphone 3Gs on 3.1 using above steps i cant JB it error is 1604 any one help me …

h0t SaUc3 October 4, 2009, 9:28 pm

In the requirements for the jailbreak, you mention in step 2 that the phone must be currently pwned. Is this a word exclusively used for the dev team method of jailbreaking? Bc my phone is jailbroken but I used purplera1n – am I still able to perform this method or must I pwn it in 3.0 first? Thanks in advance

iPhone Heat October 4, 2009, 11:26 pm

@ h0t SaUc3
here pwned means: it must be jailbroken no matter what tool you used to do that..

Go ahead and follow the instructions and don’t forget to share your experience.

Adi October 5, 2009, 1:53 am

I successfully jailbreak/unlocked the 3GS today but its not showing me T-Mobile carrier in my upper left corner. Its shows all the signal bars and E sign but no T-Mobile name. I can make phone calls and text. is it something I did wrong? Please help. thank you

iPhone Heat October 6, 2009, 2:00 am

@ Adi
if calling and SMS is working fine then wots the big deal if you’re not having carrier logo :p
try resetting network settings…
Settings > General > Reset > Reset Network Settings

Manuel Goncalves October 5, 2009, 3:47 am

Hi Guys in iphoneheat

I have a 3gs 32gb from USA. When i got it, it had 3.0 then it crash so i had to upgrade to 3.1 Now it want activate untill i insert the original sim card that was first used to activate. Which i dont have.
I live in the UK, is there anyway, i can have my iphone activated using an O2 sim card ???
I have tried several card from the UK and even tried installing 3.0 and it still asking to insert the original card sim that was first used.

How can i solve this problem, PLEASE HELP

Thank you.

iPhone Heat October 6, 2009, 1:57 am

@ Manuel Goncalves
Sorry you are out of luck coz of 3.1.. atleast for now..

grizzles October 6, 2009, 2:53 am

after completing my jailbreak can i install the carrier update to enable MMS or will that screw things up?

spisnet October 9, 2009, 3:31 am

I have followed all instructions and my 3gs only reboots in recovery mode. itunes not seeing it in that mode.

chiky December 23, 2009, 1:36 pm

I’m going to buy an iphone next week. so can i unlock it with this method? i don’t know firmware things. Is this possible for latest firmware?

iPhoneHeat December 23, 2009, 10:43 pm

Yes you can..
but find the latest guide for OS 3.1.2 from the jailbreak iPhone and unlock iPhone categories.

Leave a Comment