Uploaded October 2015 | Updated September 2026, 10 hours ago
I was prepearing a video about how to jailbreak iOS 7.1.2 on iPhone 4 (N90AP) using Pangu 7, but it seems that Cydia had some problems during the application stashing process. This step is also known as "Prepearing the FileSystem", after opening Cydia for the first time. When jailbreaking your iOS device, the most important thing to do before is to backup important data before doing the process. Using iTunes for backup usually do a good work.
In technical details, Application Stashing is the process where Cydia moves "/Applications" folder from the first partition (/dev/disk0s1s1) to "/var/stash/[random string]/Applications", which is on the second partition (/dev/disk0s1s2). After moving applications, a Unix symlink refeering "/Applications" folder to "/var/stash/[random string]/Applications" is made to trick the iOS system. The goal of Application Stashing is to free up disk space on the system partition (/dev/disk0s1s1) for Cydia packages, some iOS system tweaking and so.
I now have to restore (again) that N90AP.
I was prepearing a video about how to jailbreak iOS 7.1.2 on iPhone 4 (N90AP) using Pangu 7, but it seems that Cydia had some problems during the application stashing process. This step is also known as "Prepearing the FileSystem", after opening Cydia for the first time. When jailbreaking your iOS device, the most important thing to do before is to backup important data before doing the process. Using iTunes for backup usually do a good work.
In technical details, Application Stashing is the process where Cydia moves "/Applications" folder from the first partition (/dev/disk0s1s1) to "/var/stash/[random string]/Applications", which is on the second partition (/dev/disk0s1s2). After moving applications, a Unix symlink refeering "/Applications" folder to "/var/stash/[random string]/Applications" is made to trick the iOS system. The goal of Application Stashing is to free up disk space on the system partition (/dev/disk0s1s1) for Cydia packages, some iOS system tweaking and so.
I now have to restore (again) that N90AP.
![Futurama - Holophonor Sonnet for Leela [Piano]
Here is a piano arrangment of the holophonor song played by Fry for Leela in the Parasite Lost (S03E04) episode of Futurama.
There are five softwares used in the making of this arrangement.
1 - Nero Recode (probably, I dont remember exactly): To extract the audio from the original video. Then, I cut all the audio except the holophonor part and exported to WAV format using audacity.
2 - AnthemScore: To reverse the song. This software allows me to see a visual representation of the actual song and guess notes, plus it uses an IA to automatically do a part of this work. The final product is a sheet music in MusicXML file format.
3 - MuseScore: To re-encode the MusicXML output of AnthemScore to a more versatile MusicXML format. I dont know why, but using AnthemScores MusicXML output in Synthesia doesnt work well, the BPM isnt the right one. Converting the file with Musescore will produce a MusicXML file that will be better with Synthesia.
4 - Synthesia: To get this nice piano roll and also to practice the song on a real piano.
Album : N/A
Title : Holophonor Sonnet for Leela
Arrangment type : Reversed from soundtrack
Download sheet music from my blog here : https://www.pmbonneau.com/music/arrangements/ Futurama - Holophonor Sonnet for Leela [Piano]](https://i.ytimg.com/vi/nnynLpZVWno/mqdefault.jpg)

![iPhone 4 (N90AP) iOS Multi Boot - Kloader and Limera1n DFU Bootstrap
IMPORTANT!!! Please note that this video is for educational purpose only. By watching this video, you agree that Im not responsible of what might happen with the use of informations provided.
WARNING : This video involves hacking on Low-Level parts of iOS. Unlike userland, those parts contains lot of critical informations about the devices hardware, which could be corrupted and lead to a hard brick if something goes wrong by following instructions provided in this video.
From a jailbroken iOS 7.1.2 kernel on which TaskforPid() is patched, Winocms Kloader can be executed to bootstrap the beginning of another iOS bootchain instance (in this video, its an iOS 6.1.3 one). The ARM image usually used with kloader is iBSS, from the DFU Bootchain. Most Kloader bootstraps use DFU Bootchains images even if it is also possible to use Flashed Bootchain ones, which are usually more complete (like flashed iBoot can interact with File System, while iBEC cant). DFU one usually involve more loading in memory than Flashed Bootchain, which is more File System friendly. Once Kloader did its magic and loaded iBSS, we have to send to it iBEC ARM image, the second stage of the DFU Bootchain. The LCD screen of the iOS device light up when iBEC is launched. Now the most interesting part begins. We have to send to iBEC each boot components in a specific order. First, send and execute the DeviceTree. Second, send and load a Ramdisk (seems to make no sense because we want to boot the File System, but there is something tricky here). Third, send the iOS Kernel and launch it using bootx.
If you do those steps using original decrypted and patched files, without patching boot-args, this will load the restore Ramdisk. If you dont specify a Ramdisk in steps above, this will load the File System, but without taking in consideration boot-args (no verbose boot). If you open the decrypted iBEC file using a Hex editor, you will notice that boot-args are set like that : rd=md0 nand-enable-reformat=1 -progress. Those are boot-args used when booting a Ramdisk. If we change this boot-args string to : -v, iBEC will load the File System by default, because we removed rd=md0 which sets the RootDevice to MemoryDevice0, which is the Ramdisk. Its also possible to change the default root device by adding rd=[Root Device] in iBECs boot-args string.
Limera1n BootROM exploit is superior than Kloader. It acts directly from DFU mode, so an installed Operating System is not required. In the second part of this video, I simply use RedSn0w jailbreak utility to inject Limera1n over the DFU Mode. The root device is set to the iOS 5.1.1 filesystem in iBECs boot-args. Then, RedSn0w will automatically send and execute each bootloaders in their respective order. iPhone 4 (N90AP) iOS Multi Boot - Kloader and Limera1n DFU Bootstrap](https://i.ytimg.com/vi/oJbuS_qjrlI/mqdefault.jpg)




![Triple Boot iOS 7.1.2, iOS 6.1.3 and iOS 5.1.1 on iPhone 4 (N90AP)
IMPORTANT!!! Please note that this video is for educational purpose only. By watching this video, you agree that Im not responsible of what might happen with the use of informations provided.
Also, please note that this video is a demonstration, not a tutorial. Set up a triple boot like this one can take few hours, depending on many technological factors. Maybe a day I will release a complete tutorial about how to do it.
In this video, Im doing a triple boot between iOS 7.1.2 (signed), 6.1.3 and 5.1.1 on an iPhone 4 (N90AP). From the power button, the device boots on iOS 7.1.2, which is correctly signed. Then, I use RedSn0ws Tethered Boot function to inject Limera1n exploit over the DFU mode and allow an unsigned (patched) iOS 6.x bootchain to be executed. The root device has been set to the partition which contains iOS 6.1.3 file system in iBECs boot-args string. The kernel will search for launchd on that partition. Then, iOS 6.1.3 starts up. The modem (baseband) works properly, it can receive calls. Over all, the firmware is really stable.
After, I use again RedSn0ws Tethered Boot function to inject Limera1n exploit over the DFU mode and allow an unsigned (patched) iOS 5.x bootchain to be executed. The root device has been set to the partition which contains iOS 5.1.1 file system in iBECs boot-args string. The kernel will search for launchd on that partition. Then, iOS 5.1.1 starts up. The modem (baseband) works properly, it can receive calls. Over all, the firmware is really stable, but some old applications like YouTube, or old versions like the AppStore and iTunes Store are a bit broken.
Special thanks to @iH8Sn0w for advices about the kb_load(), this helped me with my research about.
iOS Multi-Booting status list :
A4 SecureROM and less, Multi-Booting 5.x and newer, with 4.x and lower using DFU Limera1n exploit [FAILED]
A4 SecureROM and less, Multi-Booting similar iOS versions (like 5.x and 6.x) using DFU Limera1n exploit [PASS]
iPhone 4 (N90AP), Multi-Booting iOS 7.x with lower using DFU Limera1n exploit [PASS]
A5 SecureROM and up (32-bits), Multi-Booting really similar iOS versions (6.1.3 and 6.0) using kloader bootstrap method [PASS]
A5 SecureROM and up (32-bits), Multi-Booting 6.1.3 with 5.x using kloader bootstrap method [CURRENTLY WORKING ON]
A5 SecureROM and up (32-bits), Multi-Booting 6.1.3 with 7.x and newer using kloader bootstrap method [FAILED]
A5 SecureROM and up (32-bits), Multi-Booting 9.x with 7.x using kloader bootstrap method [FAILED] Triple Boot iOS 7.1.2, iOS 6.1.3 and iOS 5.1.1 on iPhone 4 (N90AP)](https://i.ytimg.com/vi/qtZUZ4RYzAY/mqdefault.jpg)
![Crash Team Racing - Nitro Oxide in Adventure Mode
English:
Here is a Crash Team Racing video showing the character Nitro Oxide playable only with an Action Replay/GameShark code. This code replace the graphics of the normal character you are playing in adventure mode with Nitro Oxides graphics because when a jump is performed with Oxide, we can see the shadow of a regular kart. Also, with this code, the game will crash at several places in the game such as when the character selection screen appears (in all game modes) and also when you leave the castle square in adventure mode.
I play with the NTSC [U] version of the game and the code I used is 80086E84 000F. You must save your game in the castle area, otherwise the game will crash.
Français:
Voici une vidéo présentant le personnage Nitro Oxide du jeu Crash Team Racing pour Playstation jouable uniquement avec un code Action Replay/GameShark. Ce code permet de remplacer limage du personnage avec lequel vous jouez en mode aventure par limage de Nitro Oxide parce que lorsque lon effectue un saut avec Oxide, lon voit lombre dun kart ordinaire. Aussi ce code fait planter le jeu à plusieurs endroits dans le jeu tel que lorsque lécran de sélection du personnage apparaît (dans tous les modes de jeu) et aussi lorsque vous quittez la place du château en mode aventure.
Je joues avec la version NTSC [U] du jeu et le code que jai utilisé pour lessayer est 80086E84 000F. Vous devez avoir sauvegardé votre partie dans la place du château, sinon le jeu va planter. Crash Team Racing - Nitro Oxide in Adventure Mode](https://i.ytimg.com/vi/swFZNHKrFKo/mqdefault.jpg)

![Crash Bandicoot The Wrath Of Cortex Hacked : Unused Beta Level No. 2 - Removed AirShip Level
[January 2013 update]
The hidden and unused flight level of Crash Bandicoot: The Wrath of Cortex accessible (I believe) by two ways or methods, Data-Swapping Method and Code Hacking Method.
Using Data-Swapping Method : This Video
Using Code-Hacking Method : http://www.youtube.com/watch?v=6rck4n9ZZ38
-English-
I play with the NTSC version of the game and I used no codes like Action Replay, GameShark, etc. For this video, I have modded the level 2 (Tornado Alley) of the final version of this game for do it with the Crashs AirPlane. I did not remove the tornado generators because I want to be able to get the cristal and complete the level.
-Français-
Une présentation dun des niveaux retirés/inutilisés du jeu Crash Bandicoot 4: The Wrath Of Cortex sur PlayStation 2. Je joues avec la version NTSC de ce jeu et je nai pas utiliser de codes Action Replay, GameShark, etc. pour voir cet élément qui na pas vu le jour dans la version finale du jeu. Pour cette vidéo, jai modifié le deuxième niveau du jeu final (Tornado Alley) afin davoir lavion de Crash puisque je savait que ce niveau retiré allait en être un aérien. Je nai pas été capable denlever les générateurs de tornades, mais, au moins, le niveau se termine avec le cristal à la fin. Crash Bandicoot The Wrath Of Cortex Hacked : Unused Beta Level No. 2 - Removed AirShip Level](https://i.ytimg.com/vi/vS-Ky4_RRW4/mqdefault.jpg)