這是在Dev-Team看到的一篇文章，有關於無備份SHSH可以降級的方法

[akika6600]

請版主鎖文吧，今天的這支刷不過去= =，也證實已經無效了。
(但小弟真的有刷過一隻><)

[akika6600]

[quote=iAmDrSE;319405]ECID又不能幹嘛～更何況cydia都可以自己猜出來組合了，要來好心幫她備份一下很合理阿～既然都JB的，而且這個比截圖更有真相，因為cydia並不一定會顯示出他所有有備份的shsh版本～



我的意思是說手機客人帶走了阿><

[mp666888]

轉貼某文章(僅供參考)



TinyUmbrella作者Semaphore再度澄清从4.0.2降级4.0.1没有奇迹


　　Semaphore对近期一些使用非常规方法对三代以上设备iOS 4.0.2到iOS 4.0.1固件的成功降级者发表声明：不管用TSS本地服务器还是使用了Cydia的Host，都只能说明一个事实——你的设备已经有SHSH文件在Cydia的服务器上了！

不相信的朋友，这里有原文和原文的链接，也可以直接就此事询问作者本人，但请注意东西方文化差异，不要惹得人家不高兴，下面请看原文和本站上不得台面的翻译：
There is much discussion on many blogs about a potential means of downgrading iOS 4.0.2 to 4.0.1 by simply changing a couple values in the buildmanifest.plist and copying all of the images from 4.0.1 into 4.0.2 and then deleting the files ending with 002. Following all of this, perform a DFU restore and somehow you will be on 4.0.1.
　　关于iOS 4.0.2 到 4.0.1的降级有很多种说法：一种是更改buildmanifest.plist的一些参数并将4.0.1固件中的镜像替换到4.0.2固件文件中，同时删除002结尾的文件。最后使用DFU恢复模式恢复，一定机率下会恢复到4.0.1固件。

There is a perfectly logical explanation for all of this and I will lay out exactly what is happening and explain why it is working for the folks that are the lucky ones.
　　当然，对此会有一个符合逻辑的解释，我也愿意洗耳恭听并解释为什么这个办法会对他们管用。
Let me get this out first.
　　首先我们明确一点！
This is not a miracle, at least not in the sense you all hope for
SHSHs are STILL required for any iPhone 4, iPhone 3GS, iPad, iPod Touch 3G, and iPod Touch 2G (MC Model)
There is NO way around this... unfortunately this method included.
　　这不是奇迹，至少不是你们想像的那种奇迹。
　　iPhone 4、iPhone 3GS、iPad、iPod Touch 3G和iPod Touch 2G (MC版本)想要从4.0.2固件恢复到4.0.1仍然需要SHSH文件！
　　除此之外，根本没有其它的方法。
Let me start by explaining something very important. The buildmanifest is used by iTunes to build much of the TSS request that is used to obtain your SHSH for any given firmware revision. Unfortunately, the BuildNumber has no part to play in the request for SHSH. All that you ended up doing in following these directions is request 4.0.1 SHSH blobs. THAT IS ALL. Since every single one of you that got this to work changed your hosts file to point to Cydia, Cydia responded to the TSS request with an SHSH blob that was ALREADY "on-file". There was no magic. There was no miracle, apart from the lucky break that your device had been put on Cydia's SHSH request list at some time in the distant past.
　　先解释一下，buildmanifest是被iTunes用来发送TSS请求并取得对应的SHSH文件的。不幸的是，BuildNumber在请求SHSH的时候屁用也没有，恢复固件唯一有效办法是取得4.0.1的SHSH文件！如果你使用了Cydia的Hosts，并且Cydia作出了TSS的回应，那只是因为Cydia里已经“有了”你机器对应的SHSH文件。没有魔法、也没有奇迹，如果说真的有奇迹发生，也不过是在遥远的过去或者世界的其它地方，有人恰好点了你的红心备份或者在备份SHSH的时候错用你的ECID！
That's it in a nutshell folks. There was no amazing technique for bypassing Apple's TSS. There was no amazing exploit that exists in DFU mode allowing for 4.0.2 -> 4.0.1 downgrading. It's simple; Cydia had your SHSH because at sometime in the past either:
　　就目前为止，并没有行之有效的办法来绕过苹果的TSS认证这一步骤来恢复固件，也没有DFU漏洞可以用来降级4.0.2到4.0.1，再强调一下，办法只有Cydia备份SHSH（或者本地备份）一种，没有SHSH一切免谈（此处转译，但意义不变）。或者，以前发生过这几种情况：
Someone saved your SHSH with that device using TinyUmbrella and the default options
Someone restored that device with Cydia in the hosts pointing to gs.apple.com
Someone jailbroke the device and pressed 'Make my life easier'
　　某人用TinyUmbrella的默认选项为你保存了SHSH
　　某人使用Cydia的hosts指向gs.apple.com并恢复了固件
　　某人越狱了你的iPhone并点击了Cydia中的'Make my life easier
　　
That's it folks. Sorry to be a buzzkill but there was much confusion about this issue and many blog posts that simply didn't give the full story of what exactly was going on.
　　这就是那些人成功的原因。非常抱歉让一些人的侥幸心理破灭了，但是网上对此确实有太多的疑惑，同时也没有几个人能清楚的告诉我们，到底发生了什么。