From ModMyiFone - Wiki
This is directly from the readme included in the dev teams jailbreak archive. I will polish this up with screenshots when I have time . . . unless someone else gets to it first
NOTE: In order for afc to start, you must BOOT the phone with
lockdownd v1.1.1, so do not reboot the phone during this process. If
you have no choice, copy lockdownd v1.1.1 back after, then reboot
again to make sure afc comes up.
1. Back up v1.1.1's lockdownd:
cp /usr/libexec/lockdownd /var/root/lockdownd.1.1.1
Now overwrite the iPhone's copy with your old v1.0.2 copy:
cp /var/root/lockdownd.1.0.2 /usr/libexec/lockdownd
And upload the certificate included in this distribution:
scp iPhoneActivation.pem root@[IPHONE IP]:/System/Library/Lockdown/
Now:
killall lockdownd
This will restart lockdownd with v1.0.2's version
2. Download iASign from http://iphone.fiveforty.net/wiki/index.php/IASign
bunzip2 iASign-v0.2.tar.bz2
tar -xf iASign-v0.2.tar
cd iASign/bin
Overwrite iASign's iPhoneActivation.pem with the one provided in this package
cp /path/to/1.1.1-jailbreak/iPhoneActivation.pem /path/to/iASign/bin/
Now run: ./iASign.mac --automatic iPhoneActivation_private.pem
After a while, it should complete and say "New State: Activated", but it
doesn't really work. Don't worry, we're almost there!
3. Now copy the v1.1.1 lockdownd back and restart it:
cp /var/root/lockdownd.1.1.1 /usr/libexec/lockdownd
killall lockdownd
4. Run iAsign once more:
./iASign.mac --automatic iPhoneActivation_private.pem
It should look like this:
Activating...
InvalidActivationRecord
New State: Unactivated
Don't let iAsign fool you, the phone is now activated.
You've now successfully jailbroken your iPhone and set up shop. Congratulations!
Before you can sync, you will need to remove the symlink you created:
rm /var/root/Media
mv /var/root/Media.old /var/root/Media