GeoHot has added an entry to TheiPhoneWiki explaining how his purplera1n iPhone 3GS jailbreak works.
Below you can read the step by step description of what the exploit does...
-----
* purplera1n sends the enter recovery commands using iTunesMobileDevice
* once in recovery(iBoot), it sends the IBoot Environment Variable Overflow exploit
* the exploit adds a "geohot" command to the phone which runs the payload
* the "geohot" command is run, control is now transferred from iboot to the payload
* the purplera1n client is done
Inside payload
* the payload restores the default environment variable ring buffer and saves the environment to nvram(sets auto-boot to true)
* it patches iBoot to load unsigned img3s and not care about the tags
* it loads the purplera1n picture(sent with payload)
* the nor patcher starts
* llb is decrypted, patched, and increased in size to 0x24200. this is the resident 0x24000 Segment Overflow exploit
* a little loader code is put @ 0x20000 in the LLB to load it and fix the stack
* iboot is decrypted, patched
* everything else is read as is
* nor is written back, nor patcher is done
* kernel is loaded, decrypted, and patched
* ramdisk is loaded(sent with payload) and moved to ramdisk region at 0x44000000, patched kernel is tacked on to the end
* patched kernel is booted
* control is now transferred from payload to ramdisk
Inside ramdisk
* launchd is run, all stuff happens here
* /dev/disk0s1 is mounted
* fstab and services are overwritten here to allow disk0s1 writes and afc2 respectively
* Freeze.app is transferred and Freeze.app loader has SUID bit set
* patched kernel is read from end of ramdisk block device and written to filesystem
* ramdisk is done, rebooting...
Reboots as jailbroken phone
&
GeoHot has released his own purplesn0w unlock for the iPhone 3GS which he says will improve issues with Wi-Fi problems, Battery problems, and unlock problems.
-----
Wifi fails? Battery fails? Unlock fails? You need purplesn0w, the geohot 3GS unlock solution. Now I know you here a lot about different colors of sn0w, but I'm here to tell you why purplesn0w is the best. First off, what is purplesn0w? It's a soft unlock for your 3GS that I'd actually use day to day. It's not a daemon that takes any resources, and it doesn't add a task to your baseband. It's very close to a true unlock. All it does is patch three files, CommCenter, lockdownd, and your wildcard activation plist(which you need, activate w at&t sim first, no hacktivation support yet). That's it, no other files are installed. Props to Oranav for the at+xlog exploit!
A full explanation is coming soon, but I think you clever reversers out there will see what it does, and see why it's so pristine
The payload is radically different from other varieties of sn0w. beta as usual, back up first.
Be sure to have legit activated 3GS
Disable 3G if you don't have it(like T-Mobile).
Add apt.geohot.com to Cydia
Install com.geohot.purplesn0w
Watch for success output in Cydia
Reboot, and enjoy your unlocked iPhone
