unzip iPhone4,1_6.1.3_Restore.ipsw -d firmware/ The root filesystem ( 048-XXXXX.dmg ) is encrypted with a per- device key. Use a tool like iDecrypt or xpwntool with the appropriate key (searchable in public key databases for 4s).
xpwntool rootfs.dmg decrypted_rootfs.dmg -k <key> -iv <iv> Mount the decrypted DMG:
⚠️ : Messing with the baseband (BB) can permanently break cellular. Avoid modifying files inside /usr/local/standalone/firmware .
⚠️ : Bypassing activation lock via custom firmware is possible on some 4s models with hactivate patches, but this is legally gray and technically complex.