S5L8900 (iPhone 3G) with broken Home button stuck: cannot get from DFU back to WTF mode

[Qre3sty]

Hi, I'm trying to downgrade/restore an iPhone 3G (S5L8900) to iOS 4.1 for jailbreaking, but I'm stuck in a specific edge case caused by broken hardware buttons.

Setup:

Device: iPhone 3G (iPhone1,2 - n82ap)
Home button is non-functional
Back case is cracked, so I cannot safely open the device to short the Home button flex connector as a workaround
Legacy iOS Kit v26.08.03 (a720e76)
Platform: Nobara Linux 43 (GNOME Edition), x86_64

What happened so far:

Device got stuck in WTF mode (misidentified as iPhone 2G / iPhone1,1, ECID read as 0) after an earlier failed DFU IPSW attempt.
Ran the DFU IPSW restore option (Restore/Downgrade → DFU IPSW) using the iPhone1,1 3.1.3 IPSW as the vehicle. This worked as expected — idevicerestore patched WTF.s5l8900xall, and the device correctly re-identified as iPhone1,2, n82ap with a real ECID once it landed back in proper DFU mode.
Running the script again now shows the device correctly as iPhone 3G (iPhone1,2 - n82ap) in DFU mode.
However, the next step requires WTF mode again: Found an S5L8900 device in DFU mode. Your device needs to be in WTF mode to continue. This triggers the "DFU Mode Helper," which times out waiting for the manual Home+Power button re-entry sequence, since the Home button doesn't work:
[Log] Found an S5L8900 device in DFU mode. Your device needs to be in WTF mode to continue.

• Force restart your device and place it in normal or recovery mode, then re-enter WTF mode.
• You can enter WTF mode by doing the DFU mode procedure.
• DFU Mode Helper - Get ready to enter DFU mode.
  [Input] Select Y to continue, N to exit (Y/n): Yes
• Get ready...
  [Log] Found device in DFU mode.
  [Log] Finding device in WTF mode...
  [Error] Failed to find device in WTF mode (Timed out). Please run the script again.

I also tried ./restore.sh --pwn, but it goes through the exact same DFU Mode Helper flow and times out the same way.

Question: Is there a way to trigger the DFU → WTF transition purely over USB/software, without needing the physical Home button press? I noticed that WTF mode was reached automatically the first time purely through idevicerestore's USB data exchange (not a manual button re-entry), so I'm hoping there might be an equivalent forced/automatic path for this specific transition too — similar to how the DFU IPSW trick forces Normal/Recovery → DFU without buttons via an invalid LLB.

Happy to provide more logs or test anything. Thanks for maintaining this tool!

[antonfdiaz]

maybe you could try the dfu ipsw option in redsn0w. google says this helps entering dfu with broken physical buttons, because it forces it via software. also, I recommend restoring to iphoneos 3.1.3 instead of ios 4.1 because it runs better (it's slow anyway but it's a bit faster than ios 4).