Here's an idea: -Make a pwnagetool/sn0wbreeze/xpwn 4.1 ipsw. -Use iBooty on 3.1.2 to pwn iBoot. -Restore, but skip nor flash (use idevicerestore/unplug before firmware flash) -Copy the ibec, devtree, etc. from PWNED ipsw, name them with the *.40 <-- this is important! -(if at recovery mode screen) run booty callz and enjoy! -(if in [fake] DFU) my method doesn't work Please Register or Log in to view images/ you didn't pull it out fast enough And you got a tethered jailbreak. If I'm wrong let me know.