Uploaded December 2015 | Updated September 2026, 4 hours ago
IMPORTANT!!! Please note that this video is for educational purpose only. By watching this video, you agree that I'm not responsible of what might happen with the use of informations provided.
Also, please note that this video is a demonstration, not a tutorial. Set up a triple boot like this one can take few hours, depending on many technological factors. Maybe a day I will release a complete tutorial about how to do it.
In this video, I'm doing a triple boot between iOS 7.1.2 (signed), 6.1.3 and 5.1.1 on an iPhone 4 (N90AP). From the power button, the device boots on iOS 7.1.2, which is correctly signed. Then, I use RedSn0w's Tethered Boot function to inject Limera1n exploit over the DFU mode and allow an unsigned (patched) iOS 6.x bootchain to be executed. The root device has been set to the partition which contains iOS 6.1.3 file system in iBEC's boot-args string. The kernel will search for launchd on that partition. Then, iOS 6.1.3 starts up. The modem (baseband) works properly, it can receive calls. Over all, the firmware is really stable.
After, I use again RedSn0w's Tethered Boot function to inject Limera1n exploit over the DFU mode and allow an unsigned (patched) iOS 5.x bootchain to be executed. The root device has been set to the partition which contains iOS 5.1.1 file system in iBEC's boot-args string. The kernel will search for launchd on that partition. Then, iOS 5.1.1 starts up. The modem (baseband) works properly, it can receive calls. Over all, the firmware is really stable, but some old applications like YouTube, or old versions like the AppStore and iTunes Store are a bit broken.
Special thanks to @iH8Sn0w for advices about the kb_load(), this helped me with my research about.
iOS Multi-Booting status list :
A4 SecureROM and less, Multi-Booting 5.x and newer, with 4.x and lower using DFU Limera1n exploit [FAILED]
A4 SecureROM and less, Multi-Booting similar iOS versions (like 5.x and 6.x) using DFU Limera1n exploit [PASS]
iPhone 4 (N90AP), Multi-Booting iOS 7.x with lower using DFU Limera1n exploit [PASS]
A5 SecureROM and up (32-bits), Multi-Booting really similar iOS versions (6.1.3 and 6.0) using kloader bootstrap method [PASS]
A5 SecureROM and up (32-bits), Multi-Booting 6.1.3 with 5.x using kloader bootstrap method [CURRENTLY WORKING ON]
A5 SecureROM and up (32-bits), Multi-Booting 6.1.3 with 7.x and newer using kloader bootstrap method [FAILED]
A5 SecureROM and up (32-bits), Multi-Booting 9.x with 7.x using kloader bootstrap method [FAILED]
IMPORTANT!!! Please note that this video is for educational purpose only. By watching this video, you agree that I'm not responsible of what might happen with the use of informations provided.
Also, please note that this video is a demonstration, not a tutorial. Set up a triple boot like this one can take few hours, depending on many technological factors. Maybe a day I will release a complete tutorial about how to do it.
In this video, I'm doing a triple boot between iOS 7.1.2 (signed), 6.1.3 and 5.1.1 on an iPhone 4 (N90AP). From the power button, the device boots on iOS 7.1.2, which is correctly signed. Then, I use RedSn0w's Tethered Boot function to inject Limera1n exploit over the DFU mode and allow an unsigned (patched) iOS 6.x bootchain to be executed. The root device has been set to the partition which contains iOS 6.1.3 file system in iBEC's boot-args string. The kernel will search for launchd on that partition. Then, iOS 6.1.3 starts up. The modem (baseband) works properly, it can receive calls. Over all, the firmware is really stable.
After, I use again RedSn0w's Tethered Boot function to inject Limera1n exploit over the DFU mode and allow an unsigned (patched) iOS 5.x bootchain to be executed. The root device has been set to the partition which contains iOS 5.1.1 file system in iBEC's boot-args string. The kernel will search for launchd on that partition. Then, iOS 5.1.1 starts up. The modem (baseband) works properly, it can receive calls. Over all, the firmware is really stable, but some old applications like YouTube, or old versions like the AppStore and iTunes Store are a bit broken.
Special thanks to @iH8Sn0w for advices about the kb_load(), this helped me with my research about.
iOS Multi-Booting status list :
A4 SecureROM and less, Multi-Booting 5.x and newer, with 4.x and lower using DFU Limera1n exploit [FAILED]
A4 SecureROM and less, Multi-Booting similar iOS versions (like 5.x and 6.x) using DFU Limera1n exploit [PASS]
iPhone 4 (N90AP), Multi-Booting iOS 7.x with lower using DFU Limera1n exploit [PASS]
A5 SecureROM and up (32-bits), Multi-Booting really similar iOS versions (6.1.3 and 6.0) using kloader bootstrap method [PASS]
A5 SecureROM and up (32-bits), Multi-Booting 6.1.3 with 5.x using kloader bootstrap method [CURRENTLY WORKING ON]
A5 SecureROM and up (32-bits), Multi-Booting 6.1.3 with 7.x and newer using kloader bootstrap method [FAILED]
A5 SecureROM and up (32-bits), Multi-Booting 9.x with 7.x using kloader bootstrap method [FAILED]
![Crash Team Racing - Hot Air Skyway OST [Prototype & Release Mix]](https://i.ytimg.com/vi/y1oiQLOJnN8/mqdefault.jpg "Crash Team Racing - Hot Air Skyway OST [Prototype & Release Mix]
Note : The fist soundtrack you hear in this video, 00:10 - 03:12 is the final product. Other soundtracks are different versions of Hot Air Skyway, including original console prototype version and extracted RAW MIDI.
After ten years on this channel, here is a new Crash Bandicoot related video!
Hot Air Skyway from CTR, along with Rock it & Pack Attack from Crash Bandicoot 2 and Knight Time from Crash Bandicoot : The Wrath of Cortex are ones of my favorites soundtracks from the serie. Hot Air Skyway being my first favorite Crash Bandicoot sountrack I fell in love with mostly 20 years ago when I played CTR for the first time.
Recently, I found out that theres an extended version of Hot Air Skyway, called Pre-console that has been released by composer Josh Mancell. It includes an additional 28 seconds segment that consists mostly of the fist loop plus an instrument called the Cortexs Trumpet. Pre-Console music consists of music before instruments get stripped down, in this case, for the Playstation 1. CTR pre-console music sound great, but I always prefered original console music.
More recently, I joined the CTR-Tools (software used in this video) official Discord server and someone there told me that the original full length Hot Air Skyway is still here in one of some leaked CTR prototype builds. Okay, so I decided to take a look at this prototype build and I found out that the prototype Hot Air Skyway console version doesnt sounds like the release build console one. Some improvements have been made in the release version, especially in the first loop (compare 03:29 with 05:02). Also, the ripped version quality I found on The Cutting Room Floor is quite lower than what we can find in other video game music websites for the release version.
So, nothing really complicated for this video, we are trying to assemble the cut part of the prototype version while keeping the improvements made to the release one.
List of Hot Air Skyway versions you will hear in this video :
[ 00:10 - 03:12 ] Prototype & Release Mix
[ 03:12 - 04:44 ] Prototype
[ 04:45 - 05:50 ] Release
[ 05:50 - 07:22 ] Prototype, MIDI
[ 07:23 - 07:34 ] Cortexs Trumpet, cut part.")
