The iPhone Wiki - User contributions [en]

User:Caique2001

2009-01-02T02:28:21Z

Caique2001: Removing all content from page

X-Gold 608 Unlock

2008-12-28T22:04:02Z

Caique2001: /* Resources */

Currently, the 3G (software) [[unlock]] which is not baseband-dependent is the biggest missing piece of the iPhone community. It is more difficult than the previous unlocks due to the fact that the [[Baseband_Bootloader | baseband bootloader]] is signature checked. [[The dev team]] has successfully unlocked all baseband versions until 02.11.07, by a somehow patching the baseband on-the-fly (in RAM), therefore at boot the baseband bootrom can validate the bootloader, the bootloader can validate the baseband, and not until after the boot up will it be patched. The unlock (called [[yellowsn0w]]) is planned to be released in New Years Eve before 2009 (31.12.08). [http://blog.iphone-dev.org/post/65126957/tis-the-season-to-be-jolly]

==Possible Methods==
===Class 1===
* Find an exploit in the [[Baseband Bootrom|bootrom]] to break the chain of trust
* Improve by several orders of magnitude the [[NCK Brute Force|NCK brute forcer]], and find a way to extract the CHIPID and NORID
* Find the theorized algorithm of NCK generation
===Class 2===
* Use a [[SIM hacks|SIM hack]] such as the [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]]
* Find a way to patch running memory to "unlock" the phone on every bootup. The [[dev team]] has accomplished this for basebands 1.45 through 2.11.

==Resources==
* Read about the [[X-Gold 608]]
* Read geohot's [http://iphonejtag.blogspot.com/2008/07/infineon-we-have-problem.html blog post]
* 25CC presentation [http://events.ccc.de/congress/2008/Fahrplan/events/2976.en.html "Hacking the iPhone"] video [http://vimeo.com/2646755?pg=embed&sec=2646755 here]

SIM hacks

2008-08-24T20:46:40Z

Caique2001: /* Universal Sim */

These hacks all require a [[SIM]] card passthrough to be used. They typically work by spoofing the MCC/MNC. Some examples include TurboSIM, XSim, SuperSIM, Yessim, Furiousim, StealthSim.

==Old SIM Exploit (iPhone) ==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the SIM card, and this IMSI is used for the network login.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

It seems that some level of 2G call and SMS operation with SIM hacks is possible. However there is a high level of unpredictable behaviour based on different networks, SIMs, SIM hack co-devices, and so on. It is also theorised that different carrier networks have an ability to detect and block such exploits. This may explain the SIM hack working for several hours or days before it stops working. On [http://www.hackint0sh.org/forum/showthread.php?p=329221 hackint0sh] one user reported that '''all SIM solutions be''' '''''_not_''''' '''working with EDGE and UMTS''' [http://www.hackint0sh.org/forum/showpost.php?p=329739&postcount=24].

<b> Warning </b>
(citation taken from dev team's [http://blog.iphone-dev.org/post/44428446/updates blog]):

<cite>We’ve been monitoring the whole “SIM-card unlock” proxy-SIM situation. This involves using a chip that is attached to your SIM card (with a small modification to your SIM) or sometimes a small PCB soldered inside the phone. These sim mods so far seem '''very very very''' questionable. Zf has found that they use trickery of the GSM and UMTS network that is considered highly illegal in most countries and they rely on sending bogus IMSIs and various other nasty hacks to obtain service on your iPhone. A couple of our members have worked out how this all “works” and we’ll try to publish our findings soon. '''DevTeam recommendation: Steer clear, don’t use!'''</cite>

(In alphabetical order)

===iPhonix / Juma===
MacBug.de reports only 2G mode (data mode not clear) works with this. MacBug.de seems to be distancing itself from the product.

===RebelSim===
The company video demonstrates 2G but mentions no 3G function at this stage. The RebelSim website claims it has tested iPhone 3G operation. More information is required.

===StealthSim===
One of the more expensive variants of the SIM hacks on sale now. More formal reports indicate that this method is just as unstable as the rest. It fakes IMSI like the rest, but eventually gets kicked off the network. Don't buy.

===TurboSim===
Indications are that no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

===Universal Sim===
Uses a very bad implementation of zerog (the software of TurboSIM).

===Yessim / Furiousim===
Overall, there are conflicting reports on whether this works on various SIMs and networks. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode". It is recommended that if ordering, the USB "YesUP" or "FuriousUP" cable is used. The company mentions that unfortunately instead of USB cables, RJ45 cables were provided to testers due to a "shipping error". Initial testing of Yessim with stock configurations shows problems after several hours or a few days.

As of August 16th 2008, a "Brand New Firmware With An 100% New Way To Trick Your Phone" has been announced on the [http://www.gsmhackers.net/vb_board/showthread.php?t=162 Yessim forum] but has not been released yet. Presumably using the same method as the new Universal SIM firmware (V500).

== SIM hacks development status ==

===SIM communication===
Currently it is possible to see some information at the baseband level of how the iPhone 3G baseband "interacts" with the SIM and SIM hack co-device. Investigations are ongoing. In very layman-person terms, there is a way to see the baseband requesting information from the SIM and seeing the modem commands and various other baseband operations. This information will probably be clearer in other sections of this Wiki.

''Hackint0sh.Org Policy:'' At this stage due to complications all SIM Hack testing and discussion should be done [http://www.hackint0sh.org/forum/showthread.php?p=329221 here].

==iPhone 3G SIM Tray Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny [[SIM]] ejector button. You have been warned. Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

[[Category:Unlocking Methods]]

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-21T17:30:18Z

Caique2001: /* TurboSIM Compatibility with Operators */

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals.
<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* Jailbroken iPhone 3G with OpenSSH installed (from cydia) and WLAN connection to your PC. ([http://www.iclarified.com/entry/index.php?enid=1558 Jailbreak Tutorial])
* Bladox's TurboSIM. (From http://www.bladox.com)
* SSH client for Windows Users such as Putty ([http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Putty Download Page])
* SCP client (e.g. [http://winscp.net/eng/download.php#download2 WinSCP]) or FTP Client such as [http://rsug.itd.umich.edu/software/fugu/ Fugu] for Mac and [http://rsug.itd.umich.edu/software/fugu/ SmartFTP] for Windows
* TurboSIM programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* TurboSIM app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]]

----

=== Installation ===

1. Insert your simcard in another 2G phone, and remove the SIM Card Pin Code. You should also go to the Network Selection, and Manually select your network. Then cut your SIM card to fit with the TurboSIM. Google a little bit how to do this, or use YouTube and insert both into your 1st generation iPhone running 1.1.4.

2. Unpack turbo-cable-utils

3. Rename all files in bin-iphonev2 by adding 2 at the end of each file.

4. Copy contents of bin-iphonev1 and bin-iphonev2 to folder /bin/ on your iPhone. (username: root password: alpine)

3. Unpack zerog-0.95 and copy zerog095.trb to /private/var/root/

[[Image:Winscp_turbo-utils.png]]

5. For Windows users, SSH into your iPhone using Putty. For Mac users, SSH into your iPhone using Terminal (Applications::Utilities::Terminal)

6. Change the permissions of the turbo files to 755

chmod 755 /bin/turbo-*

7. Run
launchctl unload /System/Library/LaunchDaemons/com.apple.CommCenter.plist in your SSH client in the 1st Generation iPhone

8. You should now lose your signal, but WiFi should stay connected

9. Run turbo-info2

# turbo-info2
initializing modem
modem initiated
OK. No Error

10. Now run turbo-info

# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.9.0
Serial Number bosu-e8f8t6o30
OK. No Error

11. Now run turbo-app /private/var/root/zerog095.trb

# turbo-app /private/var/root/zerog095.trb
SRC /private/var/root/zerog095.trb
SIZE 1032
initializing modem
modem initiated
OK. No Error

12. Run
launchctl load /System/Library/LaunchDaemons/com.apple.CommCenter.plist

13. Now you should see Zero-G in the Sim Applications in Settings -> Phone -> Sim Applications

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

14. Click on Zero-G

15. Remove your card and TurboSIM from the 1st Generation iPhone

16. Insert the card and TurboSIM into your iPhone 3G

17. You will get No Service

[[Image:Ip_noservice.png]]

10. Open Settings -> Phone -> Sim Applications and click on Zero-G
You may be interrupted by a popup which says Going to Switch, just choose Accept (Green Button) If you do not get interrupted, it will appear in a minute after choosing Zero-G from Sim Applications.

[[Image:Ip_zerog2.png]]

11. That's it!!

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must not be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
<td style="text-align: center">comment</td>
</tr>
<tr>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: white; text-align: center">They realized the challenge, striking back. Don't stress them. Don't use it.</td>
</tr>
<tr>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
<td style="background-color: white; text-align: center"></td>
</tr>
<tr>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
<td style="background-color: white; text-align: center"></td>
</tr>
<tr>
<td style="text-align: center">Zain Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
<td style="background-color: white; text-align: center"></td>
</tr>
<tr>
<td style="text-align: center">Orange Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
<td style="background-color: white; text-align: center"></td>
</tr>
<tr>
<td style="text-align: center">Umniah Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
<td style="background-color: white; text-align: center"></td>
</tr>
<tr>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: white; text-align: center"></td>
</tr>
<tr>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: white; text-align: center"></td>
</tr>
<tr>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
<td style="background-color: white; text-align: center">They realized the challenge, striking back. Don't stress them. Don't use it.</td>
</tr>

<tr>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
<td style="background-color: white; text-align: center"></td>
</tr>
<tr>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
<td style="background-color: white; text-align: center"></td>
</tr>
<tr>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
<td style="background-color: white; text-align: center"></td>
</tr>
<tr>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
<td style="background-color: white; text-align: center"></td>
</tr>
<tr>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
<td style="background-color: white; text-align: center"></td>
</tr>

</table>

<br>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''
* If you should encounter any problems with your TurboSIM (no access anymore, wrong app, ...) there is an easy method to remove installed turbo sim applications: instead of giving your SIM-Pin, enter the TPIN which you can find next to the serial number on the cover. This will reset your TurboSIM. Afterwards the phone asks a second time for your PIN, now use the SIM-Pin.

[[Category:Unlocking Methods]]

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-21T17:23:11Z

Caique2001: O2 took the challenge, killing service via SMS

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals.
<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* Jailbroken iPhone 3G with OpenSSH installed (from cydia) and WLAN connection to your PC. ([http://www.iclarified.com/entry/index.php?enid=1558 Jailbreak Tutorial])
* Bladox's TurboSIM. (From http://www.bladox.com)
* SSH client for Windows Users such as Putty ([http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Putty Download Page])
* SCP client (e.g. [http://winscp.net/eng/download.php#download2 WinSCP]) or FTP Client such as [http://rsug.itd.umich.edu/software/fugu/ Fugu] for Mac and [http://rsug.itd.umich.edu/software/fugu/ SmartFTP] for Windows
* TurboSIM programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* TurboSIM app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]]

----

=== Installation ===

1. Insert your simcard in another 2G phone, and remove the SIM Card Pin Code. You should also go to the Network Selection, and Manually select your network. Then cut your SIM card to fit with the TurboSIM. Google a little bit how to do this, or use YouTube and insert both into your 1st generation iPhone running 1.1.4.

2. Unpack turbo-cable-utils

3. Rename all files in bin-iphonev2 by adding 2 at the end of each file.

4. Copy contents of bin-iphonev1 and bin-iphonev2 to folder /bin/ on your iPhone. (username: root password: alpine)

3. Unpack zerog-0.95 and copy zerog095.trb to /private/var/root/

[[Image:Winscp_turbo-utils.png]]

5. For Windows users, SSH into your iPhone using Putty. For Mac users, SSH into your iPhone using Terminal (Applications::Utilities::Terminal)

6. Change the permissions of the turbo files to 755

chmod 755 /bin/turbo-*

7. Run
launchctl unload /System/Library/LaunchDaemons/com.apple.CommCenter.plist in your SSH client in the 1st Generation iPhone

8. You should now lose your signal, but WiFi should stay connected

9. Run turbo-info2

# turbo-info2
initializing modem
modem initiated
OK. No Error

10. Now run turbo-info

# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.9.0
Serial Number bosu-e8f8t6o30
OK. No Error

11. Now run turbo-app /private/var/root/zerog095.trb

# turbo-app /private/var/root/zerog095.trb
SRC /private/var/root/zerog095.trb
SIZE 1032
initializing modem
modem initiated
OK. No Error

12. Run
launchctl load /System/Library/LaunchDaemons/com.apple.CommCenter.plist

13. Now you should see Zero-G in the Sim Applications in Settings -> Phone -> Sim Applications

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

14. Click on Zero-G

15. Remove your card and TurboSIM from the 1st Generation iPhone

16. Insert the card and TurboSIM into your iPhone 3G

17. You will get No Service

[[Image:Ip_noservice.png]]

10. Open Settings -> Phone -> Sim Applications and click on Zero-G
You may be interrupted by a popup which says Going to Switch, just choose Accept (Green Button) If you do not get interrupted, it will appear in a minute after choosing Zero-G from Sim Applications.

[[Image:Ip_zerog2.png]]

11. That's it!!

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must not be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Zain Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Orange Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Umniah Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>

<tr>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>

</table>

<br>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''
* If you should encounter any problems with your TurboSIM (no access anymore, wrong app, ...) there is an easy method to remove installed turbo sim applications: instead of giving your SIM-Pin, enter the TPIN which you can find next to the serial number on the cover. This will reset your TurboSIM. Afterwards the phone asks a second time for your PIN, now use the SIM-Pin.

[[Category:Unlocking Methods]]

Talk:Tutorial:Unlock iPhone 3G with TurboSim

2008-08-21T17:20:33Z

Caique2001:

== experiences? ==

it would be interesting to see the experiences of anyone that has tried this unlock method

[http://www.hackint0sh.org/forum/showthread.php?t=45903 This] is the original thread on hackint0sh, initiated by Zf. -caique2001-

== MCC=1 MNC=1 issue ==

'''Update''': Besides from technical discussions if the method harms the cellular network or not, some words about current 'policies' from my provider, O2 Germany. There seem to sit some funny guys on the desks reacting on upcoming 001/01 requests ''their way'': Suddenly (during service) my phone had been SIM locked, giving a message "SIM locked". (Instead of SIM failure or No service.) Re-inserting the card did not change the message. Because this behavior was some kind of 'new' I decided to re-insert the official provider card (swisscom) without turboSIM. Again, no luck! It worked, at the end, after rebooting the phone. When I put my SIM in an unlocked phone, I noticed 5 strange binary messages, appearently proactive messages that interfered with turboSIM and did not work as expected. But at least one (the last, that I couldn't see for obvious reasons) succeeded ;-) So, funny guys at O2 Germany, taking the challenge of killing service via SMS. (A day before I received messages that my service number for short messages was not correct. But it was. So, beginning on something happen at O2...)

== Working and stable ==

I've been using this method for 6 days, and its stable. I can make/receive calls, send/receive SMS and connect to EDGE network.
Can't confirm 3G, as its not available in my country.

Talk:IDA Pro Setup

2008-08-19T21:29:21Z

Caique2001: Replacing page with 'Thank you all for contributing. -caique2001-'

Thank you all for contributing. -caique2001-

IDA Pro Setup

2008-08-19T21:26:33Z

Caique2001: /* How to set up IDA pro to reverse the 3G baseband */

==How to set up IDA pro to reverse the 3G baseband==

The [[X-Gold 608]] has a memory map, as seen in it's page.

The [[Secpack 2.0]] takes up the first 0xCF8 of the .fls file.

So to load the 3G .fls file into IDA pro, the file offset is 0xCF8(for the secpack), and the CODE starts at the ROM start address of 0x20040000(since it's the main firmware)

For real noobs:
1. Drag the fls file into IDA
2. Select ARM
3. Change ROM start address to 0x20040000
4. Change Loading address to 0x20040000
5. Change File offset to 0xCF8
6. Copy Loading size into ROM size
7. Press OK
8. The entry point is the address at 0x20040408

9. Go to 20100004 and Press "C" to start. ~Deco
10. Read the instructions so you can find other places where you can press "C" to get more code. ~Deco

Here are some key combinations to use:
* c = turn the 'gibberish' into code
* d = turn the 'gibberish' into data
* a = turn the 'gibberish' into a string
* u = undefine what you just may have done, i usually use this since there is no real edit+undo in IDA so this is the next best thing
* Alt+G = toggle the Register T from 0 / 1 to toggle arm and thumb mode when needed

[http://dl.free.fr/pTmWY9YGJ This] might also be a decent starting point (pw: caique2001).

== some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )==

The autoanalysis didn't work very well. There were a lot of silly mnemonics, simply interleaving thumb and arm mode or other nasty stuff. I then tried to identify strings, pressing 'A'. Boring... What pushed it up a little bit is this:

Most code is 'embraced' by 'embracing' code:
- push / pop for thumb mod
- STMFD / LDMFD for arm mode

Even better, all versions of above codes have similar instruction sets. So you can find all occurences of STMFD by hex searching '2D E9', going two bytes back (did I say code is aligned? 4bytes in arm starting at 00 04 08 0c, 2bytes in thumb mode!) and pressing 'C'. If you see scrambled code, then (probably) the wrong mode (thumb) is enabled. Just press Alt-G, change the value for T to zero. See?!
The same goes for thumb mode. Push instructions are 'B5' preceeded by 02 0B 4E 72 30 10 F0 70 F3 7C 55 1F 30 3E 0E 1C 08 7F ... So just look for e.g. '10 B5' at two-byte boarders (Alt-B to set, Ctrl-B to search again) and you will easily find all occurences. Again, if it is scrambled, switch back to thumb mode (Alt-G, T=1).
After all, you can hex browse a little bit and press 'C' for missing code or 'A' for text.

Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !

IDA Pro Setup

2008-08-19T21:22:30Z

Caique2001:

==How to set up IDA pro to reverse the 3G baseband==

The [[X-Gold 608]] has a memory map, as seen in it's page.

The [[Secpack 2.0]] takes up the first 0xCF8 of the .fls file.

So to load the 3G .fls file into IDA pro, the file offset is 0xCF8(for the secpack), and the CODE starts at the ROM start address of 0x20040000(since it's the main firmware)

For real noobs:
1. Drag the fls file into IDA
2. Select ARM
3. Change ROM start address to 0x20040000
4. Change Loading address to 0x20040000
5. Change File offset to 0xCF8
6. Copy Loading size into ROM size
7. Press OK
8. The entry point is the address at 0x20040408

9. Go to 20100004 and Press "C" to start. ~Deco
10. Read the instructions so you can find other places where you can press "C" to get more code. ~Deco

[http://dl.free.fr/pTmWY9YGJ This] might also be a decent starting point (pw: caique2001).

== some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )==

The autoanalysis didn't work very well. There were a lot of silly mnemonics, simply interleaving thumb and arm mode or other nasty stuff. I then tried to identify strings, pressing 'A'. Boring... What pushed it up a little bit is this:

Most code is 'embraced' by 'embracing' code:
- push / pop for thumb mod
- STMFD / LDMFD for arm mode

Even better, all versions of above codes have similar instruction sets. So you can find all occurences of STMFD by hex searching '2D E9', going two bytes back (did I say code is aligned? 4bytes in arm starting at 00 04 08 0c, 2bytes in thumb mode!) and pressing 'C'. If you see scrambled code, then (probably) the wrong mode (thumb) is enabled. Just press Alt-G, change the value for T to zero. See?!
The same goes for thumb mode. Push instructions are 'B5' preceeded by 02 0B 4E 72 30 10 F0 70 F3 7C 55 1F 30 3E 0E 1C 08 7F ... So just look for e.g. '10 B5' at two-byte boarders (Alt-B to set, Ctrl-B to search again) and you will easily find all occurences. Again, if it is scrambled, switch back to thumb mode (Alt-G, T=1).
After all, you can hex browse a little bit and press 'C' for missing code or 'A' for text.

Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !

IDA Pro Setup

2008-08-19T21:21:53Z

Caique2001: /* How to set up IDA pro to reverse the 3G baseband */

==How to set up IDA pro to reverse the 3G baseband==

The [[X-Gold 608]] has a memory map, as seen in it's page.

The [[Secpack 2.0]] takes up the first 0xCF8 of the .fls file.

So to load the 3G .fls file into IDA pro, the file offset is 0xCF8(for the secpack), and the CODE starts at the ROM start address of 0x20040000(since it's the main firmware)

For real noobs:
1. Drag the fls file into IDA
2. Select ARM
3. Change ROM start address to 0x20040000
4. Change Loading address to 0x20040000
5. Change File offset to 0xCF8
6. Copy Loading size into ROM size
7. Press OK
8. The entry point is the address at 0x20040408

9. Go to 20100004 and Press "C" to start. ~Deco
10. Read the instructions so you can find other places where you can press "C" to get more code. ~Deco

[http://dl.free.fr/pTmWY9YGJ This] might also be a decent starting point (pw: caique2001).

== some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )==

The autoanalysis didn't work very well. There were a lot of silly mnemonics, simply interleaving thumb and arm mode or other nasty stuff. I then tried to identify strings, pressing 'A'. Boring... What pushed it up a little bit is this:

Most code is 'embraced' by 'embracing' code:
- push / pop for thumb mod
- STMFD / LDMFD for arm mode

Even better, all versions of above codes have similar instruction sets. So you can find all occurences of STMFD by hex searching '2D E9', going two bytes back (did I say code is aligned? 4bytes in arm starting at 00 04 08 0c, 2bytes in thumb mode!) and pressing 'C'. If you see scrambled code, then (probably) the wrong mode (thumb) is enabled. Just press Alt-G, change the value for T to zero. See?!
The same goes for thumb mode. Push instructions are 'B5' preceeded by 02 0B 4E 72 30 10 F0 70 F3 7C 55 1F 30 3E 0E 1C 08 7F ... So just look for e.g. '10 B5' at two-byte boarders (Alt-B to set, Ctrl-B to search again) and you will easily find all occurences. Again, if it is scrambled, switch back to thumb mode (Alt-G, T=1).
After all, you can hex browse a little bit and press 'C' for missing code or 'A' for text.

Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !

IDA Pro Setup

2008-08-19T21:21:19Z

Caique2001: /* some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) ) */

==How to set up IDA pro to reverse the 3G baseband==

The [[X-Gold 608]] has a memory map, as seen in it's page.

The [[Secpack 2.0]] takes up the first 0xCF8 of the .fls file.

So to load the 3G .fls file into IDA pro, the file offset is 0xCF8(for the secpack), and the CODE starts at the ROM start address of 0x20040000(since it's the main firmware)

For real noobs:
1. Drag the fls file into IDA
2. Select ARM
3. Change ROM start address to 0x20040000
4. Change Loading address to 0x20040000
5. Change File offset to 0xCF8
6. Copy Loading size into ROM size
7. Press OK
8. The entry point is the address at 0x20040408

9. Go to 20100004 and Press "C" to start. ~Deco
10. Read the instructions so you can find other places where you can press "C" to get more code. ~Deco

[http://dl.free.fr/pTmWY9YGJ This] might also be a decent starting point (pw: caique2001).

== some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )==

The autoanalysis didn't work very well. There were a lot of silly mnemonics, simply interleaving thumb and arm mode or other nasty stuff. I then tried to identify strings, pressing 'A'. Boring... What pushed it up a little bit is this:

Most code is 'embraced' by 'embracing' code:
- push / pop for thumb mod
- STMFD / LDMFD for arm mode

Even better, all versions of above codes have similar instruction sets. So you can find all occurences of STMFD by hex searching '2D E9', going two bytes back (did I say code is aligned? 4bytes in arm starting at 00 04 08 0c, 2bytes in thumb mode!) and pressing 'C'. If you see scrambled code, then (probably) the wrong mode (thumb) is enabled. Just press Alt-G, change the value for T to zero. See?!
The same goes for thumb mode. Push instructions are 'B5' preceeded by 02 0B 4E 72 30 10 F0 70 F3 7C 55 1F 30 3E 0E 1C 08 7F ... So just look for e.g. '10 B5' at two-byte boarders (Alt-B to set, Ctrl-B to search again) and you will easily find all occurences. Again, if it is scrambled, switch back to thumb mode (Alt-G, T=1).
After all, you can hex browse a little bit and press 'C' for missing code or 'A' for text.

Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !

IDA Pro Setup

2008-08-19T21:12:38Z

Caique2001: /* some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) ) */

==How to set up IDA pro to reverse the 3G baseband==

The [[X-Gold 608]] has a memory map, as seen in it's page.

The [[Secpack 2.0]] takes up the first 0xCF8 of the .fls file.

So to load the 3G .fls file into IDA pro, the file offset is 0xCF8(for the secpack), and the CODE starts at the ROM start address of 0x20040000(since it's the main firmware)

For real noobs:
1. Drag the fls file into IDA
2. Select ARM
3. Change ROM start address to 0x20040000
4. Change Loading address to 0x20040000
5. Change File offset to 0xCF8
6. Copy Loading size into ROM size
7. Press OK
8. The entry point is the address at 0x20040408

9. Go to 20100004 and Press "C" to start. ~Deco
10. Read the instructions so you can find other places where you can press "C" to get more code. ~Deco

[http://dl.free.fr/pTmWY9YGJ This] might also be a decent starting point (pw: caique2001).

== some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )==

The autoanalysis didn't very well. There were a lot of silly mnemonics, simply interleaving thumb and arm mode or other nasty stuff. I then tried to identify strings, pressing 'A'. Boring... What pushed it up a little bit is this:

Most code is 'embraced' by 'embracing' code:
- push / pop for thumb mod
- STMFD / LDMFD for arm mode

Even better, all versions of above codes have similar instruction sets. So you can find all occurences of STMFD by hex searching '2D E9', going two bytes back (did I say code is aligned? 4bytes in arm, 2bytes in thumb mode!) and pressing 'C'. If you see scrambled code, then (probably) the wrong mode (thumb) is enabled. Just press Alt-G, change the value for T to zero. See?!
The same goes for thumb mode. Push instructions are 'B5' preceeded by 02 0B 4E 72 30 10 F0 70 F3 7C 55 1F 30 3E 0E 1C 08 7F ... So just look for e.g. '10 B5' at two-byte boarders (Alt-B to set, Ctrl-B to search again) and you will easily find all occurences. Again, if it is scrambled, switch back to thumb mode (Alt-G, T=1).
After all, you can hex browse a little bit and press missing 'C' for missing code or 'A'.

Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !

IDA Pro Setup

2008-08-19T21:08:32Z

Caique2001:

==How to set up IDA pro to reverse the 3G baseband==

The [[X-Gold 608]] has a memory map, as seen in it's page.

The [[Secpack 2.0]] takes up the first 0xCF8 of the .fls file.

So to load the 3G .fls file into IDA pro, the file offset is 0xCF8(for the secpack), and the CODE starts at the ROM start address of 0x20040000(since it's the main firmware)

For real noobs:
1. Drag the fls file into IDA
2. Select ARM
3. Change ROM start address to 0x20040000
4. Change Loading address to 0x20040000
5. Change File offset to 0xCF8
6. Copy Loading size into ROM size
7. Press OK
8. The entry point is the address at 0x20040408

9. Go to 20100004 and Press "C" to start. ~Deco
10. Read the instructions so you can find other places where you can press "C" to get more code. ~Deco

[http://dl.free.fr/pTmWY9YGJ This] might also be a decent starting point (pw: caique2001).

== some hints for getting the mnemonics from n00b for noobs (read: master noob for noobs ;-) )==

The autoanalysis didn't very well. There were a lot of silly mnemonics, simply interleaving thumb and arm mode or other nasty stuff. I than tried to identify strings, pressing 'A'. Boring... What pushed it up a little bit is this:

Most code is 'embraced' by 'embracing' code:
- push / pop for thumb mod
- STMFD / LDMFD for arm mode

Even better, all versions of above codes have similar instruction sets. So you can find all occurences of STMFD by hex searching '2D E9', going two bytes back (did I say code is aligned? 4bytes in arm, 2bytes in thumb mode!) and pressing 'C'. If you see scrambled code, then (probably) the wrong mode (thumb) is enabled. Just press Alt-G, change the value for T to zero. See?!
The same goes for thumb mode. Push instructions are 'B5' preceeded by 02 0B 4E 72 30 10 F0 70 F3 7C 55 1F 30 3E 0E 1C 08 7F ... So just look for e.g. '10 B5' at two-byte boarders (Alt-B to set, Ctrl-B to search again) and you will easily find all occurences. Again, if it is scrambled, switch back to thumb mode (Alt-G, T=1).
After all, you can hex browse a little bit and press missing 'C' for missing code or 'A'.

Above is a very simple 'algorithm', maybe there is an appropiate IDA plugin. Or you could write one :-) !

Talk:Timeline

2008-08-19T20:23:02Z

Caique2001:

This timeline was written from my perspective about notable events I remember. Feel free to edit and add<br>~geohot

I think theres some stuff here that isn't important enough. Like QuickPwn and dual-boot. ~geohot

Define 'timeline' !? ;-) -caique2001-

=== Revisions needed ===
references to iAsign, iNdependence, sam+daeken bruteforce. Software 3.9 NORdump. TA_Mobile 4.6 NORdump. 4.6 GPIO block unlock.

IDA Pro Setup

2008-08-19T19:44:29Z

Caique2001:

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-17T12:11:26Z

Caique2001: retracted

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals.
<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* Jailbroken iPhone 3G with OpenSSH installed (from cydia) and WLAN connection to your PC. ([http://www.iclarified.com/entry/index.php?enid=1558 Jailbreak Tutorial])
* Bladox's TurboSIM. (From http://www.bladox.com)
* SSH client for Windows Users such as Putty ([http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Putty Download Page])
* SCP client (e.g. [http://winscp.net/eng/download.php#download2 WinSCP]) or FTP Client such as [http://rsug.itd.umich.edu/software/fugu/ Fugu] for Mac and [http://rsug.itd.umich.edu/software/fugu/ SmartFTP] for Windows
* TurboSIM programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* TurboSIM app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]]

----

=== Installation ===

1. Insert your simcard in another 2G phone, and remove the SIM Card Pin Code. You should also go to the Network Selection, and Manually select your network. Then cut your SIM card to fit with the TurboSIM. Google a little bit how to do this, or use YouTube and insert both into your 1st generation iPhone running 1.1.4.

2. Unpack turbo-cable-utils

3. Rename all files in bin-iphonev2 by adding 2 at the end of each file.

4. Copy contents of bin-iphonev1 and bin-iphonev2 to folder /bin/ on your iPhone. (username: root password: alpine)

3. Unpack zerog-0.95 and copy zerog095.trb to /private/var/root/

[[Image:Winscp_turbo-utils.png]]

5. For Windows users, SSH into your iPhone using Putty. For Mac users, SSH into your iPhone using Terminal (Applications::Utilities::Terminal)

6. Change the permissions of the turbo files to 755

chmod 755 /bin/turbo-*

7. Run
launchctl unload /System/Library/LaunchDaemons/com.apple.CommCenter.plist in your SSH client in the 1st Generation iPhone

8. You should now lose your signal, but WiFi should stay connected

9. Run turbo-info2

# turbo-info2
initializing modem
modem initiated
OK. No Error

10. Now run turbo-info

# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.9.0
Serial Number bosu-e8f8t6o30
OK. No Error

11. Now run turbo-app /private/var/root/zerog095.trb

# turbo-app /private/var/root/zerog095.trb
SRC /private/var/root/zerog095.trb
SIZE 1032
initializing modem
modem initiated
OK. No Error

12. Run
launchctl load /System/Library/LaunchDaemons/com.apple.CommCenter.plist

13. Now you should see Zero-G in the Sim Applications in Settings -> Phone -> Sim Applications

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

14. Click on Zero-G

15. Remove your card and TurboSIM from the 1st Generation iPhone

16. Insert the card and TurboSIM into your iPhone 3G

17. You will get No Service

[[Image:Ip_noservice.png]]

10. Open Settings -> Phone -> Sim Applications and click on Zero-G
You may be interrupted by a popup which says Going to Switch, just choose Accept (Green Button) If you do not get interrupted, it will appear in a minute after choosing Zero-G from Sim Applications.

[[Image:Ip_zerog2.png]]

11. That's it!!

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must not be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Zain Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Orange Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Umniah Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>

<tr>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>

</table>

<br>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''
* If you should encounter any problems with your TurboSIM (no access anymore, wrong app, ...) there is an easy method to remove installed turbo sim applications: instead of giving your SIM-Pin, enter the TPIN which you can find next to the serial number on the cover. This will reset your TurboSIM. Afterwards the phone asks a second time for your PIN, now use the SIM-Pin.

[[Category:Unlocking Methods]]

User:Caique2001

2008-08-17T00:35:08Z

Caique2001:

==== Mini FAQ ====

* Wonder where '[http://picasaweb.google.com/caique2000n1/AktuelleFotos?authkey=cac0Ik08Mto caique]' comes from ?

==== personal section ====

* [[Pdf View | View pdfs without sending them by email]]

==== slightly off topic ====

* Wanna become a [http://www.pbm.com/~lindahl/real.programmers.html real programmer] ?

Talk:Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T23:33:37Z

Caique2001:

== experiences? ==

it would be interesting to see the experiences of anyone that has tried this unlock method

[http://www.hackint0sh.org/forum/showthread.php?t=45903 This] is the original thread on hackint0sh, initiated by Zf. -caique2001-

== MCC=1 MNC=1 issue ==

Given following statements:

Cellular network login with changed MCC/MNC in IMSI to above values, that is successful (due to the implementation of the serving provider), might be considered 'illegal' (whatever this means) regarding ETSI standards, but
* does not cause billig problems, because authentication is valid and tied to the caller's identity
* does not interfere with the operability of the cellular network, because it is only an authentication issue

If you feel the need to 'express' that one of the above statements is incorrect, please do it. But - please - give ''profound'' reasons for your considerations.

Talk:Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T23:31:13Z

Caique2001: /* MCC=1 MNC=1 issue */

== experiences? ==

it would be interesting to see the experiences of anyone that has tried this unlock method

[http://www.hackint0sh.org/forum/showthread.php?t=45903 This] is the original thread on hackint0sh, initiated by Zf. -caique2001-

== MCC=1 MNC=1 issue ==

Given following statements:

Cellular network login with changed MCC/MNC in IMSI to above values, that is successful (due to the implementation of the serving provider), might be considered 'illegal' (whatever this means) regarding ETSI standards, but
* does not cause billig problems, because authentication is valid and tied to the caller's identity
* does not interfere the operability of the cellular network, because it is only an authentication issue

If you feel the need to 'express' that one of the above statements is incorrect, please do it. But - please - give ''profound'' reasons for your considerations.

Talk:Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T23:30:38Z

Caique2001:

== experiences? ==

it would be interesting to see the experiences of anyone that has tried this unlock method

[http://www.hackint0sh.org/forum/showthread.php?t=45903 This] is the original thread on hackint0sh, initiated by Zf. -caique2001-

== MCC=1 MNC=1 issue ==

Given following statements:

Cellular network login with changed MCC/MNC in IMSI to above values, that is successful (due to the implementation of the serving provider), might be considered 'illegal' (whatever this means) regarding ETSI standards, but
* does not cause billig problems, because authentication is valid and tied to the callers identity
* does not interfere the operability of the cellular network, because it is only an authentication issue

If you feel the need to 'express' that one of the above statements is incorrect, please do it. But - please - give ''profound'' reasons for your considerations.

Talk:Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T20:46:44Z

Caique2001:

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T20:35:28Z

Caique2001: no 1sr gen iphone needed at all

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* Jailbroken iPhone 3G with OpenSSH installed (from cydia) and WLAN connection to your PC. ([http://www.iclarified.com/entry/index.php?enid=1558 Jailbreak Tutorial])
* Bladox's TurboSIM. (From http://www.bladox.com)
* SSH client for Windows Users such as Putty ([http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Putty Download Page])
* SCP client (e.g. [http://winscp.net/eng/download.php#download2 WinSCP]) or FTP Client such as [http://rsug.itd.umich.edu/software/fugu/ Fugu] for Mac and [http://rsug.itd.umich.edu/software/fugu/ SmartFTP] for Windows
* TurboSIM programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* TurboSIM app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]] (The version [http://dl.free.fr/nz1Tbj2sC/lamesaft.trb here] basically does the same, reset is removed, so you can turn flight mode on and off, without card re-insertion.)

----

=== Installation ===

1. Insert your simcard in another 2G phone, and remove the SIM Card Pin Code. You should also go to the Network Selection, and Manually select your network. Then cut your SIM card to fit with the TurboSIM. Google a little bit how to do this, or use YouTube and insert both into your 1st generation iPhone running 1.1.4.

2. Unpack turbo-cable-utils

3. Rename all files in bin-iphonev2 by adding 2 at the end of each file.

4. Copy contents of bin-iphonev1 and bin-iphonev2 to folder /bin/ on your iPhone. (username: root password: alpine)

3. Unpack zerog-0.95 and copy zerog095.trb to /private/var/root/

[[Image:Winscp_turbo-utils.png]]

5. For Windows users, SSH into your iPhone using Putty. For Mac users, SSH into your iPhone using Terminal (Applications::Utilities::Terminal)

6. Change the permissions of the turbo files to 755

chmod 755 /bin/turbo-*

7. Run
launchctl unload /System/Library/LaunchDaemons/com.apple.CommCenter.plist in your SSH client in the 1st Generation iPhone

8. You should now lose your signal, but WiFi should stay connected

9. Run turbo-info2

# turbo-info2
initializing modem
modem initiated
OK. No Error

10. Now run turbo-info

# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.9.0
Serial Number bosu-e8f8t6o30
OK. No Error

11. Now run turbo-app /private/var/root/zerog095.trb

# turbo-app /private/var/root/zerog095.trb
SRC /private/var/root/zerog095.trb
SIZE 1032
initializing modem
modem initiated
OK. No Error

12. Run
launchctl load /System/Library/LaunchDaemons/com.apple.CommCenter.plist

13. Now you should see Zero-G in the Sim Applications in Settings -> Phone -> Sim Applications

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

14. Click on Zero-G

15. Remove your card and TurboSIM from the 1st Generation iPhone

16. Insert the card and TurboSIM into your iPhone 3G

17. You will get No Service

[[Image:Ip_noservice.png]]

10. Open Settings -> Phone -> Sim Applications and click on Zero-G
You may be interrupted by a popup which says Going to Switch, just choose Accept (Green Button) If you do not get interrupted, it will appear in a minute after choosing Zero-G from Sim Applications.

[[Image:Ip_zerog2.png]]

11. That's it!!

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Zain Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Orange Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Umniah Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>

<tr>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>

</table>

<br>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''
* If you should encounter any problems with your TurboSIM (no access anymore, wrong app, ...) there is an easy method to remove installed turbo sim applications: instead of giving your SIM-Pin, enter the TPIN which you can find next to the serial number on the cover. This will reset your TurboSIM. Afterwards the phone asks a second time for your PIN, now use the SIM-Pin.

[[Category:Unlocking Methods]]

User talk:Caique2001

2008-08-16T20:33:05Z

Caique2001: Removing all content from page

Talk:IDA Pro Setup

2008-08-16T20:31:25Z

Caique2001: house cleaning

prereqs.: IDA Pro Advanced, baseband files

wanted: Howto load these files correctly into IDA

'''Anybody to give this information here?''' TIA -caique2001-

Happy :-) ~geohot

== into ida ==
I suggest you look more into IDA Pro, see how things work. you may not be ready for a baseband yet.

the most important thing you need is the address. for example, i knew the iBoot was at 0x18000000 because at the beginning there is a routine to look if it is there and relocate it if not. also it has many references to 0x1800000 throughout the file.

Here are some key combinations to use:
c = turn the 'gibberish' into code
d = turn the 'gibberish' into data
a = turn the 'gibberish' into a string
u = undefine what you just may have done, i usually use this since there is no real edit+undo in IDA so this is the next best thing
Alt+G = change the 0 to a 1 to switch to thumb mode when needed

really i feel that you should do some more research on ARM and IDA Pro because a wiki article would not be enough to fully explain it

Maybe you can share some info with us MuscleNerd? -- Deco

== offsets ==
For example, if you look into ICE2_01.45 using a hex editor, you will see starting 0x634 there contains the memory maps. It started at 0x20000000 and ends at 0x21000000 with sections in between doing its own thing. The code/data in the .fls starts at 0xCF8 indicated by location 0xCF4. The length of the code is indicated by the location at 0xCEC which amounts to 0x5E9E18.

So, you may want to load the data in the .fls file from 0xCF8 to 0X5EAB0F at offset 0x20000000 in IDA pro.

-- CPICH

Hey, you speak my language :-) Thanks -caique2001-

Talk:Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T20:27:36Z

Caique2001:

== experiences? ==

it would be interesting to see the experiences of anyone that has tried this unlock method

[http://www.hackint0sh.org/forum/showthread.php?t=45903 This] is the original thread on hackint0sh, initiated by Zf. -caique2001-

== @-caique2001- ==

I've been working on this for 3 days and it just worked.. Don't you dare change it - it works perfectly and confirmed on three different phones.

Talk:Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T20:27:16Z

Caique2001:

== experiences? ==

it would be interesting to see the experiences of anyone that has tried this unlock method

[http://www.hackint0sh.org/forum/showthread.php?t=45903 This] is the original thread on hackint0sh, initiated by Zf. -caique2001-

== @naysnay ==
What are you doing here?? You f*** up the wiki with wrong infos, overtake it with your name a.s.o. I will pass by later and remove all the crap you are doing here. -caique2001-

== @-caique2001- ==

I've been working on this for 3 days and it just worked.. Don't you dare change it - it works perfectly and confirmed on three different phones.

Talk:IDA Pro Setup

2008-08-16T13:09:17Z

Caique2001: while( [-x "silly questions"] ) do remove "silly questions"; done

prereqs.: IDA Pro Advanced, baseband files

wanted: Howto load these files correctly into IDA

'''Anybody to give this information here?''' TIA -caique2001-

== into ida ==
I suggest you look more into IDA Pro, see how things work. you may not be ready for a baseband yet.

the most important thing you need is the address. for example, i knew the iBoot was at 0x18000000 because at the beginning there is a routine to look if it is there and relocate it if not. also it has many references to 0x1800000 throughout the file.

Here are some key combinations to use:
c = turn the 'gibberish' into code
d = turn the 'gibberish' into data
a = turn the 'gibberish' into a string
u = undefine what you just may have done, i usually use this since there is no real edit+undo in IDA so this is the next best thing
Alt+G = change the 0 to a 1 to switch to thumb mode when needed

really i feel that you should do some more research on ARM and IDA Pro because a wiki article would not be enough to fully explain it

== re: into ida ==
I roughly know how ida works and what the keys are. I think there are some people that have already setup the right values for reversing the baseband. So what I want to see here is just a quick intro to set up the project (segments, fileoffsets, changed options, entry points and so on), not how to use ida. This should almost fit into your article above, just counting words ;-)

Yea, but if you don't understand how to get those numbers, you'll be pretty useless as a reverser. Not to discourage, but the numbers really aren't that hard to get. Look at the memory map I posted. All the information you need is here. ~geohot

Probably I missed something in the constitution, just to cite: "Let's document this device better than anyone at apple knows it." Fact is, you and some other people know how to set up the IDA project. If now, someother people, including me (btw. my first reversing was a CP/M in 1986), don't know how to set up it, one thing is clear: It's not documented. So if you guys reply to my request "this isn't hard to get", this actually means "it isn't hard to get for us" (1st) and "we _don't_want_ to document it" (2nd). This is against the constitution set up by yourselves! Should we change the constitution? My (tongue in cheek) proposal: "This pseudo wiki is intended for <fill in names here> to absorb knowledge. Everybody is invited to give us knowledge..." - The world could be that easy: Just give those people that lack some knowlegde a chance!!! And don't mistake knowledge with qualification. -caique2001-

geohot's claim that you are "useless" as a reverser unless you can figure out the loading offsets from the .fls files is certainly untrue. -- MuscleNerd

== offsets ==
For example, if you look into ICE2_01.45 using a hex editor, you will see starting 0x634 there contains the memory maps. It started at 0x20000000 and ends at 0x21000000 with sections in between doing its own thing. The code/data in the .fls starts at 0xCF8 indicated by location 0xCF4. The length of the code is indicated by the location at 0xCEC which amounts to 0x5E9E18.

So, you may want to load the data in the .fls file from 0xCF8 to 0X5EAB0F at offset 0x20000000 in IDA pro.

-- CPICH

Hey, you speak my language :-) Thanks -caique2001-

Talk:Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T13:01:02Z

Caique2001:

== experiences? ==

it would be interesting to see the experiences of anyone that has tried this unlock method

[http://www.hackint0sh.org/forum/showthread.php?t=45903 This] is the original thread on hackint0sh, initiated by Zf. -caique2001-

== 'illegal stuff' issue with MCC/MNC set to 001/01 ==

Actually I don't really believe in the 'illegal' fairy tale any more. (Though I will not remove the warning as I am not sure.)

The login into the cellular network is based upon the key stored on SIM, only the home provider knows it. The home provider has a database where it looks up the corresponding key. So if a fake IMSI is sent, totally different from original IMSI, authentication '''must''' fail (''This'' is obviously illegal). Vice versa, if authentication is successful, nothing could be considered illegal as the secure key stored on the card is tied to the caller's identity.

Even more interesting is the fact, that some providers seem to receive the HPLMN not from IMSI, but from ICCID. A swisscom card, 'proxy-sim'ed with turbosim and zero-g does login into vodafone's and t-mobile's network Germany, meaning it roams (GPRS vodafone working, EDGE t-online working!). Where does vodafone / t-mobile take the HPLMN from, to set up correct routing to swisscom? (Only swisscom knows the key and can authenticate.) As it can't be taken from IMSI (set to 001/01) it is appearently gathered from ICCID, isn't it?

So my guess is: If the (serving) provider's login implementation allows login with 001/01 (because possibly taking MCC/MNC from ICCID), everything is fine. *)

Maybe someone working in the mobile business can enlighten this subject.

<nowiki>*)</nowiki> The table indicates t-mobile uk doesn't work with o2-uk (official). As t-mobile Germany should be roaming provider for t-mobile uk (I think so), I suppose t-mobile uk SIMs working with o2 uk phones in Germany, as t-mobile Germany is serving provider and supports login with 001/01.

== @naysnay ==
What are you doing here?? You f*** up the wiki with wrong infos, overtake it with your name a.s.o. I will pass by later and remove all the crap you are doing here. -caique2001-

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T12:55:48Z

Caique2001: no way

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* Jailbroken iPhone 3G with OpenSSH installed (from cydia) and WLAN connection to your PC. ([http://www.iclarified.com/entry/index.php?enid=1558 Jailbreak Tutorial])
* Bladox's TurboSIM. (From http://www.bladox.com)
* SSH client for Windows Users such as Putty ([http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Putty Download Page])
* SCP client (e.g. [http://winscp.net/eng/download.php#download2 WinSCP]) or FTP Client such as [http://rsug.itd.umich.edu/software/fugu/ Fugu] for Mac and [http://rsug.itd.umich.edu/software/fugu/ SmartFTP] for Windows
* TurboSIM programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* TurboSIM app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]] (The version [http://dl.free.fr/nz1Tbj2sC/lamesaft.trb here] basically does the same, reset is removed, so you can turn flight mode on and off, without card re-insertion.)

----

=== Installation ===

1. Insert your simcard in another 2G phone, and remove the SIM Card Pin Code. You should also go to the Network Selection, and Manually select your network. Then cut your SIM card to fit with the TurboSIM. Google a little bit how to do this, or use YouTube and insert both into your 1st generation iPhone running 1.1.4.

2. Unpack turbo-cable-utils

3. Rename all files in bin-iphonev2 by adding 2 at the end of each file.

4. Copy contents of bin-iphonev1 and bin-iphonev2 to folder /bin/ on your 1st generation iPhone. (username: root password: alpine)

3. Unpack zerog-0.95 and copy zerog095.trb to /private/var/root/

[[Image:Winscp_turbo-utils.png]]

5. For Windows users, SSH into your iPhone using Putty. For Mac users, SSH into your iPhone using Terminal (Applications::Utilities::Terminal)

6. Change the permissions of the turbo files to 755

chmod 755 /bin/turbo-*

7. Run
launchctl unload /System/Library/LaunchDaemons/com.apple.CommCenter.plist in your SSH client in the 1st Generation iPhone

8. You should now lose your signal, but WiFi should stay connected

9. Run turbo-info2

# turbo-info2
initializing modem
modem initiated
OK. No Error

10. Now run turbo-info

# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.9.0
Serial Number bosu-e8f8t6o30
OK. No Error

11. Now run turbo-app /private/var/root/zerog095.trb

# turbo-app /private/var/root/zerog095.trb
SRC /private/var/root/zerog095.trb
SIZE 1032
initializing modem
modem initiated
OK. No Error

12. Run
launchctl load /System/Library/LaunchDaemons/com.apple.CommCenter.plist

13. Now you should see Zero-G in the Sim Applications in Settings -> Phone -> Sim Applications

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

14. Click on Zero-G

15. Remove your card and TurboSIM from the 1st Generation iPhone

16. Insert the card and TurboSIM into your iPhone 3G

17. You will get No Service

[[Image:Ip_noservice.png]]

10. Open Settings -> Phone -> Sim Applications and click on Zero-G
You may be interrupted by a popup which says Going to Switch, just choose Accept (Green Button) If you do not get interrupted, it will appear in a minute after choosing Zero-G from Sim Applications.

[[Image:Ip_zerog2.png]]

11. That's it!!

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Zain Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Orange Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Umniah Jordan</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>

<tr>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>

</table>

<br>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''
* If you should encounter any problems with your TurboSIM (no access anymore, wrong app, ...) there is an easy method to remove installed turbo sim applications: instead of giving your SIM-Pin, enter the TPIN which you can find next to the serial number on the cover. This will reset your TurboSIM. Afterwards the phone asks a second time for your PIN, now use the SIM-Pin.

[[Category:Unlocking Methods]]

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T12:20:00Z

Caique2001: /* Remarks */

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* Jailbroken iPhone 3G with OpenSSH installed (from cydia) and WLAN connection to your PC. ([http://www.iclarified.com/entry/index.php?enid=1558 Jailbreak Tutorial])
* Bladox's TurboSIM. (From http://www.bladox.com)
* SSH client for Windows Users such as Putty ([http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Putty Download Page])
* SCP client (e.g. [http://winscp.net/eng/download.php#download2 WinSCP]) or FTP Client such as [http://rsug.itd.umich.edu/software/fugu/ Fugu] for Mac and [http://rsug.itd.umich.edu/software/fugu/ SmartFTP] for Windows
* TurboSIM programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* TurboSIM app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]] (The version [http://dl.free.fr/nz1Tbj2sC/lamesaft.trb here] basically does the same, reset is removed, so you can turn flight mode on and off, without card re-insertion.)

----

=== Installation ===

1. Put your official provider card (prepaid) together with turboSim into the sim card slot of your iPhone-3G. Google a little bit how to do this. IMHO it's a good idea to (TESA-)tape turboSim and SIM-card together (on upper surface, tape needs to clasp around the chip to the connection's side of the card, so there is no tape edge on the surface in direction of tension), otherwise your SIM can get stuck in your phone and you have to open it.

2. unpack turbo-cable-utils and use Win''Scp to copy the contents of bin-iphonev2 to folder /bin/ on your iphone (username: root, password: alpine)

[[Image:Winscp_turbo-utils.png]]

3. connect with putty to your iPhone (user root, pass alpine) (btw, changing your password is a good idea: passwd)

4. change permissions

chmod 755 /bin/turbo-*

5. run turbo-info

iPhone:~ root# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.7.0
Serial Number <...>
OK. No Error

''If this does not end with "ok":''

localhost:~ root# turbo-info
initializing modem
AT+CPMS="SM","SM"
ERROR
AT+CPMS?
ERROR
modem initiated
Mobile Phone/Serial Cable Communication Error

this could have following reasons:
* electrical contact problems: check your turboSim-Sim-pack, sometimes there are some bumps from the cutting process which need to be removed
* the SIM you use to program your turboSIM is locked, you have already access to the turboSIM via iPhone if the SIM is unlocked (official provider SIM)
* turboSIM isn't empty, there is a programme installed which prevents network access
<BR>

6. use Win''Scp to copy unpacked zero-g-trb to folder /private/var/root

[[Image:Winscp_zerog.png]]

7. run turbo-reset and then turbo-app to programme your turboSim

iPhone:~ root# turbo-app zerog095.trb
SRC zerog095.trb
SIZE 1023
initializing modem
modem initiated
OK. No Error

You now should see zero-g sim app in settings -> phone -> sim applications (ignore the carrier, I took screen shots later on)

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

9. Remove official card + turboSim and replace it with your contract card + turboSim, turbo-info should end with okay

10. reboot / switch on/off phone

I have to type in my SIM-Pin first

[[Image:Ip_unlocksim.png]]

then: no service, okay...

[[Image:Ip_noservice.png]]

10. commit green button of zero-g application, which appears after some seconds

[[Image:Ip_zerog2.png]]

11. Some timing problems? Lost carrier? Just closing...

[[Image:Ip_noservice2.png]]

'cos it works at the end...

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Locked (Official)<BR>Provider</td>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G, V?<BR>(1996)</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">AT&T</td>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">AT&T (US)</td>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Rogers (Canada)</td>
<td style="text-align: center">Zain (Jordan)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">Not Available</td>
</tr>
<tr>
<td style="text-align: center">eXamPLE</td>
<td style="text-align: center">mYiPhone uk</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: yellow; text-align: center">incoming</td>
<td style="background-color: white; text-align: center">unknown</td>
<td style="background-color: #c0c0c0; text-align: center">n.a.</td>
</tr>
</table>

<br>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''
* If you should encounter any problems with your TurboSIM (no access anymore, wrong app, ...) there is an easy method to remove installed turbo sim applications: instead of giving your SIM-Pin, enter the TPIN which you can find next to the serial number on the cover. This will reset your TurboSIM. Afterwards the phone asks a second time for your PIN, now use the SIM-Pin.

[[Category:Unlocking Methods]]

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T12:14:09Z

Caique2001: /* Prerequisites */

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* Jailbroken iPhone 3G with OpenSSH installed (from cydia) and WLAN connection to your PC. ([http://www.iclarified.com/entry/index.php?enid=1558 Jailbreak Tutorial])
* Bladox's TurboSIM. (From http://www.bladox.com)
* SSH client for Windows Users such as Putty ([http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Putty Download Page])
* SCP client (e.g. [http://winscp.net/eng/download.php#download2 WinSCP]) or FTP Client such as [http://rsug.itd.umich.edu/software/fugu/ Fugu] for Mac and [http://rsug.itd.umich.edu/software/fugu/ SmartFTP] for Windows
* TurboSIM programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* TurboSIM app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]] (The version [http://dl.free.fr/nz1Tbj2sC/lamesaft.trb here] basically does the same, reset is removed, so you can turn flight mode on and off, without card re-insertion.)

----

=== Installation ===

1. Put your official provider card (prepaid) together with turboSim into the sim card slot of your iPhone-3G. Google a little bit how to do this. IMHO it's a good idea to (TESA-)tape turboSim and SIM-card together (on upper surface, tape needs to clasp around the chip to the connection's side of the card, so there is no tape edge on the surface in direction of tension), otherwise your SIM can get stuck in your phone and you have to open it.

2. unpack turbo-cable-utils and use Win''Scp to copy the contents of bin-iphonev2 to folder /bin/ on your iphone (username: root, password: alpine)

[[Image:Winscp_turbo-utils.png]]

3. connect with putty to your iPhone (user root, pass alpine) (btw, changing your password is a good idea: passwd)

4. change permissions

chmod 755 /bin/turbo-*

5. run turbo-info

iPhone:~ root# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.7.0
Serial Number <...>
OK. No Error

''If this does not end with "ok":''

localhost:~ root# turbo-info
initializing modem
AT+CPMS="SM","SM"
ERROR
AT+CPMS?
ERROR
modem initiated
Mobile Phone/Serial Cable Communication Error

this could have following reasons:
* electrical contact problems: check your turboSim-Sim-pack, sometimes there are some bumps from the cutting process which need to be removed
* the SIM you use to program your turboSIM is locked, you have already access to the turboSIM via iPhone if the SIM is unlocked (official provider SIM)
* turboSIM isn't empty, there is a programme installed which prevents network access
<BR>

6. use Win''Scp to copy unpacked zero-g-trb to folder /private/var/root

[[Image:Winscp_zerog.png]]

7. run turbo-reset and then turbo-app to programme your turboSim

iPhone:~ root# turbo-app zerog095.trb
SRC zerog095.trb
SIZE 1023
initializing modem
modem initiated
OK. No Error

You now should see zero-g sim app in settings -> phone -> sim applications (ignore the carrier, I took screen shots later on)

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

9. Remove official card + turboSim and replace it with your contract card + turboSim, turbo-info should end with okay

10. reboot / switch on/off phone

I have to type in my SIM-Pin first

[[Image:Ip_unlocksim.png]]

then: no service, okay...

[[Image:Ip_noservice.png]]

10. commit green button of zero-g application, which appears after some seconds

[[Image:Ip_zerog2.png]]

11. Some timing problems? Lost carrier? Just closing...

[[Image:Ip_noservice2.png]]

'cos it works at the end...

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Locked (Official)<BR>Provider</td>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G, V?<BR>(1996)</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">AT&T</td>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">AT&T (US)</td>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Rogers (Canada)</td>
<td style="text-align: center">Zain (Jordan)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">Not Available</td>
</tr>
<tr>
<td style="text-align: center">eXamPLE</td>
<td style="text-align: center">mYiPhone uk</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: yellow; text-align: center">incoming</td>
<td style="background-color: white; text-align: center">unknown</td>
<td style="background-color: #c0c0c0; text-align: center">n.a.</td>
</tr>
</table>

<br>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''

[[Category:Unlocking Methods]]

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T12:09:09Z

Caique2001: /* Prerequisites */

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* Jailbroken iPhone 3G with OpenSSH installed (from cydia) and WLAN connection to your PC. ([http://www.iclarified.com/entry/index.php?enid=1558 Jailbreak Tutorial])
* Bladox's TurboSIM. (From http://www.bladox.com)
* SSH client for Windows Users such as Putty ([http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Putty Download Page])
* SCP client (e.g. [http://winscp.net/eng/download.php#download2 WinSCP]) or FTP Client such as [http://rsug.itd.umich.edu/software/fugu/ Fugu] for Mac and [http://rsug.itd.umich.edu/software/fugu/ SmartFTP] for Windows
* TurboSIM programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* TurboSIM app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]]

----

=== Installation ===

1. Put your official provider card (prepaid) together with turboSim into the sim card slot of your iPhone-3G. Google a little bit how to do this. IMHO it's a good idea to (TESA-)tape turboSim and SIM-card together (on upper surface, tape needs to clasp around the chip to the connection's side of the card, so there is no tape edge on the surface in direction of tension), otherwise your SIM can get stuck in your phone and you have to open it.

2. unpack turbo-cable-utils and use Win''Scp to copy the contents of bin-iphonev2 to folder /bin/ on your iphone (username: root, password: alpine)

[[Image:Winscp_turbo-utils.png]]

3. connect with putty to your iPhone (user root, pass alpine) (btw, changing your password is a good idea: passwd)

4. change permissions

chmod 755 /bin/turbo-*

5. run turbo-info

iPhone:~ root# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.7.0
Serial Number <...>
OK. No Error

''If this does not end with "ok":''

localhost:~ root# turbo-info
initializing modem
AT+CPMS="SM","SM"
ERROR
AT+CPMS?
ERROR
modem initiated
Mobile Phone/Serial Cable Communication Error

this could have following reasons:
* electrical contact problems: check your turboSim-Sim-pack, sometimes there are some bumps from the cutting process which need to be removed
* the SIM you use to program your turboSIM is locked, you have already access to the turboSIM via iPhone if the SIM is unlocked (official provider SIM)
* turboSIM isn't empty, there is a programme installed which prevents network access
<BR>

6. use Win''Scp to copy unpacked zero-g-trb to folder /private/var/root

[[Image:Winscp_zerog.png]]

7. run turbo-reset and then turbo-app to programme your turboSim

iPhone:~ root# turbo-app zerog095.trb
SRC zerog095.trb
SIZE 1023
initializing modem
modem initiated
OK. No Error

You now should see zero-g sim app in settings -> phone -> sim applications (ignore the carrier, I took screen shots later on)

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

9. Remove official card + turboSim and replace it with your contract card + turboSim, turbo-info should end with okay

10. reboot / switch on/off phone

I have to type in my SIM-Pin first

[[Image:Ip_unlocksim.png]]

then: no service, okay...

[[Image:Ip_noservice.png]]

10. commit green button of zero-g application, which appears after some seconds

[[Image:Ip_zerog2.png]]

11. Some timing problems? Lost carrier? Just closing...

[[Image:Ip_noservice2.png]]

'cos it works at the end...

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Locked (Official)<BR>Provider</td>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G, V?<BR>(1996)</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">AT&T</td>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">AT&T (US)</td>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Rogers (Canada)</td>
<td style="text-align: center">Zain (Jordan)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">Not Available</td>
</tr>
<tr>
<td style="text-align: center">eXamPLE</td>
<td style="text-align: center">mYiPhone uk</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: yellow; text-align: center">incoming</td>
<td style="background-color: white; text-align: center">unknown</td>
<td style="background-color: #c0c0c0; text-align: center">n.a.</td>
</tr>
</table>

<br>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''

[[Category:Unlocking Methods]]

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T12:08:42Z

Caique2001:

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* Jailbroken iPhone 3G with OpenSSH installed (from cydia) and WLAN connection to your PC. ([http://www.iclarified.com/entry/index.php?enid=1558 Jailbreak Tutorial])
* Bladox's TurboSIM. (From http://www.bladox.com)
* SSH client for Windows Users such as Putty ([http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html Putty Download Page])
* SCP client (e.g. [http://winscp.net/eng/download.php#download2 WinSCP] or FTP Client such as [http://rsug.itd.umich.edu/software/fugu/ Fugu] for Mac and [http://rsug.itd.umich.edu/software/fugu/ SmartFTP] for Windows
* TurboSIM programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* TurboSIM app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]]

----

=== Installation ===

1. Put your official provider card (prepaid) together with turboSim into the sim card slot of your iPhone-3G. Google a little bit how to do this. IMHO it's a good idea to (TESA-)tape turboSim and SIM-card together (on upper surface, tape needs to clasp around the chip to the connection's side of the card, so there is no tape edge on the surface in direction of tension), otherwise your SIM can get stuck in your phone and you have to open it.

2. unpack turbo-cable-utils and use Win''Scp to copy the contents of bin-iphonev2 to folder /bin/ on your iphone (username: root, password: alpine)

[[Image:Winscp_turbo-utils.png]]

3. connect with putty to your iPhone (user root, pass alpine) (btw, changing your password is a good idea: passwd)

4. change permissions

chmod 755 /bin/turbo-*

5. run turbo-info

iPhone:~ root# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.7.0
Serial Number <...>
OK. No Error

''If this does not end with "ok":''

localhost:~ root# turbo-info
initializing modem
AT+CPMS="SM","SM"
ERROR
AT+CPMS?
ERROR
modem initiated
Mobile Phone/Serial Cable Communication Error

this could have following reasons:
* electrical contact problems: check your turboSim-Sim-pack, sometimes there are some bumps from the cutting process which need to be removed
* the SIM you use to program your turboSIM is locked, you have already access to the turboSIM via iPhone if the SIM is unlocked (official provider SIM)
* turboSIM isn't empty, there is a programme installed which prevents network access
<BR>

6. use Win''Scp to copy unpacked zero-g-trb to folder /private/var/root

[[Image:Winscp_zerog.png]]

7. run turbo-reset and then turbo-app to programme your turboSim

iPhone:~ root# turbo-app zerog095.trb
SRC zerog095.trb
SIZE 1023
initializing modem
modem initiated
OK. No Error

You now should see zero-g sim app in settings -> phone -> sim applications (ignore the carrier, I took screen shots later on)

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

9. Remove official card + turboSim and replace it with your contract card + turboSim, turbo-info should end with okay

10. reboot / switch on/off phone

I have to type in my SIM-Pin first

[[Image:Ip_unlocksim.png]]

then: no service, okay...

[[Image:Ip_noservice.png]]

10. commit green button of zero-g application, which appears after some seconds

[[Image:Ip_zerog2.png]]

11. Some timing problems? Lost carrier? Just closing...

[[Image:Ip_noservice2.png]]

'cos it works at the end...

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Locked (Official)<BR>Provider</td>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G, V?<BR>(1996)</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">AT&T</td>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">AT&T (US)</td>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Rogers (Canada)</td>
<td style="text-align: center">Zain (Jordan)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">Not Available</td>
</tr>
<tr>
<td style="text-align: center">eXamPLE</td>
<td style="text-align: center">mYiPhone uk</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: yellow; text-align: center">incoming</td>
<td style="background-color: white; text-align: center">unknown</td>
<td style="background-color: #c0c0c0; text-align: center">n.a.</td>
</tr>
</table>

<br>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''

[[Category:Unlocking Methods]]

Talk:Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T00:06:14Z

Caique2001: /* 'illegal stuff' issue with MCC/MNC set to 001/01 */

== experiences? ==

it would be interesting to see the experiences of anyone that has tried this unlock method

[http://www.hackint0sh.org/forum/showthread.php?t=45903 This] is the original thread on hackint0sh, initiated by Zf. -caique2001-

== 'illegal stuff' issue with MCC/MNC set to 001/01 ==

Actually I don't really believe in the 'illegal' fairy tale any more. (Though I will not remove the warning as I am not sure.)

The login into the cellular network is based upon the key stored on SIM, only the home provider knows it. The home provider has a database where it looks up the corresponding key. So if a fake IMSI is sent, totally different from original IMSI, authentication '''must''' fail (''This'' is obviously illegal). Vice versa, if authentication is successful, nothing could be considered illegal as the secure key stored on the card is tied to the caller's identity.

Even more interesting is the fact, that some providers seem to receive the HPLMN not from IMSI, but from ICCID. A swisscom card, 'proxy-sim'ed with turbosim and zero-g does login into vodafone's and t-mobile's network Germany, meaning it roams (GPRS vodafone working, EDGE t-online working!). Where does vodafone / t-mobile take the HPLMN from, to set up correct routing to swisscom? (Only swisscom knows the key and can authenticate.) As it can't be taken from IMSI (set to 001/01) it is appearently gathered from ICCID, isn't it?

So my guess is: If the (serving) provider's login implementation allows login with 001/01 (because possibly taking MCC/MNC from ICCID), everything is fine. *)

Maybe someone working in the mobile business can enlighten this subject.

<nowiki>*)</nowiki> The table indicates t-mobile uk doesn't work with o2-uk (official). As t-mobile Germany should be roaming provider for t-mobile uk (I think so), I suppose t-mobile uk SIMs working with o2 uk phones in Germany, as t-mobile Germany is serving provider and supports login with 001/01.

Talk:Tutorial:Unlock iPhone 3G with TurboSim

2008-08-16T00:04:50Z

Caique2001: /* 'illegal stuff' issue with MCC/MNC set to 001/01 */

== experiences? ==

it would be interesting to see the experiences of anyone that has tried this unlock method

[http://www.hackint0sh.org/forum/showthread.php?t=45903 This] is the original thread on hackint0sh, initiated by Zf. -caique2001-

== 'illegal stuff' issue with MCC/MNC set to 001/01 ==

Actually I don't really believe in the 'illegal' fairy tale any more. (Though I will not remove the warning as I am not sure.)

The login into the cellular network is based upon the key stored on SIM, only the home provider knows it. The home provider has a database where it looks up the corresponding key. So if a fake IMSI is sent, totally different from original IMSI, authentication '''must''' fail (''This'' is obviously illegal). Vice versa, if authentication is successful, nothing could be considered illegal as the secure key stored on the card is tied to the caller's identity.

Even more interesting is the fact, that some providers seem to receive the HPLMN not from IMSI, but from ICCID. A swisscom card, 'proxy-sim'ed with turbosim and zero-g does login into vodafone's and t-mobile's network Germany, meaning it roams (GPRS vodafone working, EDGE t-online working!). Where does vodafone / t-mobile take the HPLMN from, to set up correct routing to swisscom? (Only swisscom knows the key and can authenticate.) As it can't be taken from IMSI (set to 001/01) it is appearently gathered from ICCID, isn't it?

So my guess is: If the (serving) provider's login implementation allows login with 001/01 (because possibly taking MCC/MNC from ICCID), everything is fine. *)

Maybe someone working in the mobile business can enlighten this subject.

<nowiki>*)</nowiki> The table indicates t-mobile uk doesn't work with o2-uk (official). As t-mobile Germany should be roaming provider for t-mobile uk (I think so), I suppose t-mobile uk SIMs working with o2 uk in Germany, as t-mobile Germany is serving provider and supports login with 001/01.

Talk:Tutorial:Unlock iPhone 3G with TurboSim

2008-08-15T23:59:04Z

Caique2001:

== experiences? ==

it would be interesting to see the experiences of anyone that has tried this unlock method

[http://www.hackint0sh.org/forum/showthread.php?t=45903 This] is the original thread on hackint0sh, initiated by Zf. -caique2001-

== 'illegal stuff' issue with MCC/MNC set to 001/01 ==

Actually I don't really believe in the 'illegal' fairy tale any more. (Though I will not remove the warning as I am not sure.)

The login into the cellular network is based upon the key stored on SIM, only the home provider knows it. The home provider has a database where it looks up the corresponding key. So if a fake IMSI is sent, totally different from original IMSI, authentication '''must''' fail (''This'' is obviously illegal). Vice versa, if authentication is successful, nothing could be considered illegal as the secure key stored on the card is tied to the caller's identity.

Even more interesting is the fact, that some providers seem to receive the HPLMN not from IMSI, but from ICCID. A swisscom card, 'proxy-sim'ed with turbosim and zero-g does login into vodafone's and t-mobile's network Germany, meaning it roams (GPRS vodafone working, EDGE t-online working!). Where does vodafone / t-mobile take the HPLMN from, to set up correct routing to swisscom? (Only swisscom knows the key and can authenticate.) As it can't be taken from IMSI (set to 001/01) it is appearently gathered from ICCID, isn't it?

So my guess is: If the provider's login implementation allows login with 001/01 (because possibly taking MCC/MNC from ICCID), everything is fine.

Maybe someone working in the mobile business can enlighten this subject.

Talk:Tutorial:Unlock iPhone 3G with TurboSim

2008-08-15T23:51:29Z

Caique2001:

== experiences? ==

it would be interesting to see the experiences of anyone that has tried this unlock method

[http://www.hackint0sh.org/forum/showthread.php?t=45903 This] is the original thread on hackint0sh, initiated by Zf. -caique2001-

== 'illegal stuff' issue with MCC/MNC set to 001/01 ==

Actually I don't really believe in the 'illegal' fairy tale any more. (Though I will not remove the warning as I am not sure.)

The login into the cellular network is based upon the key stored on SIM, only the home provider knows it. The home provider has a database where it looks up the corresponding key. So if a fake IMSI is sent, totally different from original IMSI, authentication '''must''' fail (''This'' is obviously illegal). Vice versa, if authentication is successful, nothing could be considered illegal as the secure key stored on the card is tied to the callers identity.

Even more interesting is the fact, that some providers seem to receive the HPLMN not from IMSI, but from ICCID. A swisscom card, 'proxy-sim'ed with turbosim and zero-g does login into vodafone's and t-mobiles network Germany, meaning it roams (GPRS vodafone working, EDGE t-online working!). Where does vodafone / t-mobile take the HPLMN from, to set up correct routing to swisscom? As it can't be taken from IMSI (set to 001/01) it is appearently gathered from ICCID, isn't it?

So my guess is: If the provider's login implementation allows login with 001/01 (because possibly taking MCC/MNC from ICCID), everything is fine.

Maybe someone working in the mobile business can enlighten this subject.

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-15T22:38:47Z

Caique2001: /* TurboSIM Compatibility with Operators */

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* your jailbroken iPhone-3G with openssh installed (from cydia) and WLAN connection to your PC
* Bladox' turboSim
* putty, winscp (or equivalent mac proggies)
* turboSim programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* turboSim app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]] (on your own risk you can test [http://dl.free.fr/nz1Tbj2sC/lamesaft.trb this] version)

----

=== Installation ===

1. Put your official provider card (prepaid) together with turboSim into the sim card slot of your iPhone-3G. Google a little bit how to do this. IMHO it's a good idea to (TESA-)tape turboSim and SIM-card together (on upper surface, tape needs to clasp around the chip to the connection's side of the card, so there is no tape edge on the surface in direction of tension), otherwise your SIM can get stuck in your phone and you have to open it.

2. unpack turbo-cable-utils and use Win''Scp to copy the contents of bin-iphonev2 to folder /bin/ on your iphone (username: root, password: alpine)

[[Image:Winscp_turbo-utils.png]]

3. connect with putty to your iPhone (user root, pass alpine) (btw, changing your password is a good idea: passwd)

4. change permissions

chmod 755 /bin/turbo-*

5. run turbo-info

iPhone:~ root# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.7.0
Serial Number <...>
OK. No Error

''If this does not end with "ok":''

localhost:~ root# turbo-info
initializing modem
AT+CPMS="SM","SM"
ERROR
AT+CPMS?
ERROR
modem initiated
Mobile Phone/Serial Cable Communication Error

this could have following reasons:
* electrical contact problems: check your turboSim-Sim-pack, sometimes there are some bumps from the cutting process which need to be removed
* the SIM you use to program your turboSIM is locked, you have already access to the turboSIM via iPhone if the SIM is unlocked (official provider SIM)
* turboSIM isn't empty, there is a programme installed which prevents network access
<BR>

6. use Win''Scp to copy unpacked zero-g-trb to folder /private/var/root

[[Image:Winscp_zerog.png]]

7. run turbo-reset and then turbo-app to programme your turboSim

iPhone:~ root# turbo-app zerog095.trb
SRC zerog095.trb
SIZE 1023
initializing modem
modem initiated
OK. No Error

You now should see zero-g sim app in settings -> phone -> sim applications (ignore the carrier, I took screen shots later on)

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

9. Remove official card + turboSim and replace it with your contract card + turboSim, turbo-info should end with okay

10. reboot / switch on/off phone

I have to type in my SIM-Pin first

[[Image:Ip_unlocksim.png]]

then: no service, okay...

[[Image:Ip_noservice.png]]

10. commit green button of zero-g application, which appears after some seconds

[[Image:Ip_zerog2.png]]

11. Some timing problems? Lost carrier? Just closing...

[[Image:Ip_noservice2.png]]

'cos it works at the end...

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Locked (Official)<BR>Provider</td>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G, V?<BR>(1996)</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">AT&T</td>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">AT&T (US)</td>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Rogers (Canada)</td>
<td style="text-align: center">Zain (Jordan)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">eXamPLE</td>
<td style="text-align: center">mYiPhone uk</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: yellow; text-align: center">incoming</td>
<td style="background-color: white; text-align: center">unknown</td>
<td style="background-color: #c0c0c0; text-align: center">n.a.</td>
</tr>
</table>

<br>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''

[[Category:Unlocking Methods]]

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-15T22:35:39Z

Caique2001: /* TurboSIM Compatibility with Operators */

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* your jailbroken iPhone-3G with openssh installed (from cydia) and WLAN connection to your PC
* Bladox' turboSim
* putty, winscp (or equivalent mac proggies)
* turboSim programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* turboSim app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]] (on your own risk you can test [http://dl.free.fr/nz1Tbj2sC/lamesaft.trb this] version)

----

=== Installation ===

1. Put your official provider card (prepaid) together with turboSim into the sim card slot of your iPhone-3G. Google a little bit how to do this. IMHO it's a good idea to (TESA-)tape turboSim and SIM-card together (on upper surface, tape needs to clasp around the chip to the connection's side of the card, so there is no tape edge on the surface in direction of tension), otherwise your SIM can get stuck in your phone and you have to open it.

2. unpack turbo-cable-utils and use Win''Scp to copy the contents of bin-iphonev2 to folder /bin/ on your iphone (username: root, password: alpine)

[[Image:Winscp_turbo-utils.png]]

3. connect with putty to your iPhone (user root, pass alpine) (btw, changing your password is a good idea: passwd)

4. change permissions

chmod 755 /bin/turbo-*

5. run turbo-info

iPhone:~ root# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.7.0
Serial Number <...>
OK. No Error

''If this does not end with "ok":''

localhost:~ root# turbo-info
initializing modem
AT+CPMS="SM","SM"
ERROR
AT+CPMS?
ERROR
modem initiated
Mobile Phone/Serial Cable Communication Error

this could have following reasons:
* electrical contact problems: check your turboSim-Sim-pack, sometimes there are some bumps from the cutting process which need to be removed
* the SIM you use to program your turboSIM is locked, you have already access to the turboSIM via iPhone if the SIM is unlocked (official provider SIM)
* turboSIM isn't empty, there is a programme installed which prevents network access
<BR>

6. use Win''Scp to copy unpacked zero-g-trb to folder /private/var/root

[[Image:Winscp_zerog.png]]

7. run turbo-reset and then turbo-app to programme your turboSim

iPhone:~ root# turbo-app zerog095.trb
SRC zerog095.trb
SIZE 1023
initializing modem
modem initiated
OK. No Error

You now should see zero-g sim app in settings -> phone -> sim applications (ignore the carrier, I took screen shots later on)

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

9. Remove official card + turboSim and replace it with your contract card + turboSim, turbo-info should end with okay

10. reboot / switch on/off phone

I have to type in my SIM-Pin first

[[Image:Ip_unlocksim.png]]

then: no service, okay...

[[Image:Ip_noservice.png]]

10. commit green button of zero-g application, which appears after some seconds

[[Image:Ip_zerog2.png]]

11. Some timing problems? Lost carrier? Just closing...

[[Image:Ip_noservice2.png]]

'cos it works at the end...

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Locked (Official)<BR>Provider</td>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G, V?<BR>(1996)</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">AT&T</td>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">AT&T (US)</td>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Rogers (Canada)</td>
<td style="text-align: center">Zain (Jordan)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">eXamPLE</td>
<td style="text-align: center">mYiPhone uk</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: yellow; text-align: center">incoming</td>
<td style="background-color: white; text-align: center">unknown</td>
<td style="background-color: #c0c0c0; text-align: center">n.a.</td>
</tr>
</table>

<br>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''

[[Category:Unlocking Methods]]

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-15T22:33:15Z

Caique2001: /* TurboSIM Compatibility with Operators */

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* your jailbroken iPhone-3G with openssh installed (from cydia) and WLAN connection to your PC
* Bladox' turboSim
* putty, winscp (or equivalent mac proggies)
* turboSim programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* turboSim app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]] (on your own risk you can test [http://dl.free.fr/nz1Tbj2sC/lamesaft.trb this] version)

----

=== Installation ===

1. Put your official provider card (prepaid) together with turboSim into the sim card slot of your iPhone-3G. Google a little bit how to do this. IMHO it's a good idea to (TESA-)tape turboSim and SIM-card together (on upper surface, tape needs to clasp around the chip to the connection's side of the card, so there is no tape edge on the surface in direction of tension), otherwise your SIM can get stuck in your phone and you have to open it.

2. unpack turbo-cable-utils and use Win''Scp to copy the contents of bin-iphonev2 to folder /bin/ on your iphone (username: root, password: alpine)

[[Image:Winscp_turbo-utils.png]]

3. connect with putty to your iPhone (user root, pass alpine) (btw, changing your password is a good idea: passwd)

4. change permissions

chmod 755 /bin/turbo-*

5. run turbo-info

iPhone:~ root# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.7.0
Serial Number <...>
OK. No Error

''If this does not end with "ok":''

localhost:~ root# turbo-info
initializing modem
AT+CPMS="SM","SM"
ERROR
AT+CPMS?
ERROR
modem initiated
Mobile Phone/Serial Cable Communication Error

this could have following reasons:
* electrical contact problems: check your turboSim-Sim-pack, sometimes there are some bumps from the cutting process which need to be removed
* the SIM you use to program your turboSIM is locked, you have already access to the turboSIM via iPhone if the SIM is unlocked (official provider SIM)
* turboSIM isn't empty, there is a programme installed which prevents network access
<BR>

6. use Win''Scp to copy unpacked zero-g-trb to folder /private/var/root

[[Image:Winscp_zerog.png]]

7. run turbo-reset and then turbo-app to programme your turboSim

iPhone:~ root# turbo-app zerog095.trb
SRC zerog095.trb
SIZE 1023
initializing modem
modem initiated
OK. No Error

You now should see zero-g sim app in settings -> phone -> sim applications (ignore the carrier, I took screen shots later on)

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

9. Remove official card + turboSim and replace it with your contract card + turboSim, turbo-info should end with okay

10. reboot / switch on/off phone

I have to type in my SIM-Pin first

[[Image:Ip_unlocksim.png]]

then: no service, okay...

[[Image:Ip_noservice.png]]

10. commit green button of zero-g application, which appears after some seconds

[[Image:Ip_zerog2.png]]

11. Some timing problems? Lost carrier? Just closing...

[[Image:Ip_noservice2.png]]

'cos it works at the end...

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Locked (Official)<BR>Provider</td>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G, V?<BR>(1996)</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">AT&T</td>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">AT&T (US)</td>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: white; text-align: center">?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: white; text-align: center">?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: white; text-align: center">?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Rogers (Canada)</td>
<td style="text-align: center">Zain (Jordan)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">eXamPLE</td>
<td style="text-align: center">mYiPhone uk</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: yellow; text-align: center">incoming</td>
<td style="background-color: white; text-align: center">unknown</td>
<td style="background-color: #c0c0c0; text-align: center">n.a.</td>
</tr>
</table>

<br>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''

[[Category:Unlocking Methods]]

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-15T22:32:50Z

Caique2001: /* Stuck in No Signal after a period */

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* your jailbroken iPhone-3G with openssh installed (from cydia) and WLAN connection to your PC
* Bladox' turboSim
* putty, winscp (or equivalent mac proggies)
* turboSim programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* turboSim app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]] (on your own risk you can test [http://dl.free.fr/nz1Tbj2sC/lamesaft.trb this] version)

----

=== Installation ===

1. Put your official provider card (prepaid) together with turboSim into the sim card slot of your iPhone-3G. Google a little bit how to do this. IMHO it's a good idea to (TESA-)tape turboSim and SIM-card together (on upper surface, tape needs to clasp around the chip to the connection's side of the card, so there is no tape edge on the surface in direction of tension), otherwise your SIM can get stuck in your phone and you have to open it.

2. unpack turbo-cable-utils and use Win''Scp to copy the contents of bin-iphonev2 to folder /bin/ on your iphone (username: root, password: alpine)

[[Image:Winscp_turbo-utils.png]]

3. connect with putty to your iPhone (user root, pass alpine) (btw, changing your password is a good idea: passwd)

4. change permissions

chmod 755 /bin/turbo-*

5. run turbo-info

iPhone:~ root# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.7.0
Serial Number <...>
OK. No Error

''If this does not end with "ok":''

localhost:~ root# turbo-info
initializing modem
AT+CPMS="SM","SM"
ERROR
AT+CPMS?
ERROR
modem initiated
Mobile Phone/Serial Cable Communication Error

this could have following reasons:
* electrical contact problems: check your turboSim-Sim-pack, sometimes there are some bumps from the cutting process which need to be removed
* the SIM you use to program your turboSIM is locked, you have already access to the turboSIM via iPhone if the SIM is unlocked (official provider SIM)
* turboSIM isn't empty, there is a programme installed which prevents network access
<BR>

6. use Win''Scp to copy unpacked zero-g-trb to folder /private/var/root

[[Image:Winscp_zerog.png]]

7. run turbo-reset and then turbo-app to programme your turboSim

iPhone:~ root# turbo-app zerog095.trb
SRC zerog095.trb
SIZE 1023
initializing modem
modem initiated
OK. No Error

You now should see zero-g sim app in settings -> phone -> sim applications (ignore the carrier, I took screen shots later on)

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

9. Remove official card + turboSim and replace it with your contract card + turboSim, turbo-info should end with okay

10. reboot / switch on/off phone

I have to type in my SIM-Pin first

[[Image:Ip_unlocksim.png]]

then: no service, okay...

[[Image:Ip_noservice.png]]

10. commit green button of zero-g application, which appears after some seconds

[[Image:Ip_zerog2.png]]

11. Some timing problems? Lost carrier? Just closing...

[[Image:Ip_noservice2.png]]

'cos it works at the end...

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

<br>

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Locked (Official)<BR>Provider</td>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G, V?<BR>(1996)</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">AT&T</td>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">AT&T (US)</td>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: white; text-align: center">?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: white; text-align: center">?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: white; text-align: center">?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Rogers (Canada)</td>
<td style="text-align: center">Zain (Jordan)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">eXamPLE</td>
<td style="text-align: center">mYiPhone uk</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: yellow; text-align: center">incoming</td>
<td style="background-color: white; text-align: center">unknown</td>
<td style="background-color: #c0c0c0; text-align: center">n.a.</td>
</tr>
</table>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''

[[Category:Unlocking Methods]]

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-15T22:32:29Z

Caique2001: /* TurboSIM Compatibility with Operators */

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* your jailbroken iPhone-3G with openssh installed (from cydia) and WLAN connection to your PC
* Bladox' turboSim
* putty, winscp (or equivalent mac proggies)
* turboSim programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* turboSim app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]] (on your own risk you can test [http://dl.free.fr/nz1Tbj2sC/lamesaft.trb this] version)

----

=== Installation ===

1. Put your official provider card (prepaid) together with turboSim into the sim card slot of your iPhone-3G. Google a little bit how to do this. IMHO it's a good idea to (TESA-)tape turboSim and SIM-card together (on upper surface, tape needs to clasp around the chip to the connection's side of the card, so there is no tape edge on the surface in direction of tension), otherwise your SIM can get stuck in your phone and you have to open it.

2. unpack turbo-cable-utils and use Win''Scp to copy the contents of bin-iphonev2 to folder /bin/ on your iphone (username: root, password: alpine)

[[Image:Winscp_turbo-utils.png]]

3. connect with putty to your iPhone (user root, pass alpine) (btw, changing your password is a good idea: passwd)

4. change permissions

chmod 755 /bin/turbo-*

5. run turbo-info

iPhone:~ root# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.7.0
Serial Number <...>
OK. No Error

''If this does not end with "ok":''

localhost:~ root# turbo-info
initializing modem
AT+CPMS="SM","SM"
ERROR
AT+CPMS?
ERROR
modem initiated
Mobile Phone/Serial Cable Communication Error

this could have following reasons:
* electrical contact problems: check your turboSim-Sim-pack, sometimes there are some bumps from the cutting process which need to be removed
* the SIM you use to program your turboSIM is locked, you have already access to the turboSIM via iPhone if the SIM is unlocked (official provider SIM)
* turboSIM isn't empty, there is a programme installed which prevents network access
<BR>

6. use Win''Scp to copy unpacked zero-g-trb to folder /private/var/root

[[Image:Winscp_zerog.png]]

7. run turbo-reset and then turbo-app to programme your turboSim

iPhone:~ root# turbo-app zerog095.trb
SRC zerog095.trb
SIZE 1023
initializing modem
modem initiated
OK. No Error

You now should see zero-g sim app in settings -> phone -> sim applications (ignore the carrier, I took screen shots later on)

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

9. Remove official card + turboSim and replace it with your contract card + turboSim, turbo-info should end with okay

10. reboot / switch on/off phone

I have to type in my SIM-Pin first

[[Image:Ip_unlocksim.png]]

then: no service, okay...

[[Image:Ip_noservice.png]]

10. commit green button of zero-g application, which appears after some seconds

[[Image:Ip_zerog2.png]]

11. Some timing problems? Lost carrier? Just closing...

[[Image:Ip_noservice2.png]]

'cos it works at the end...

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

=== TurboSIM Compatibility with Operators ===

Actually this table gives a rough overview of all *sim solutions because it reflects working of MCC/MNC = 001/01 and all *sim known so far use this method. The table doesn't give information about 3G though, as turbosim does not support 3G SIM-ME communication at the moment. So could be, some *sim solutions work with 3G where this table indicates no. Most probably there isn't any *sim solution that works in a specific configuration if this table indicates 'no' for the method at all.<br>

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Locked (Official)<BR>Provider</td>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G, V?<BR>(1996)</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">AT&T</td>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">AT&T (US)</td>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: white; text-align: center">?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: white; text-align: center">?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: white; text-align: center">?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Rogers (Canada)</td>
<td style="text-align: center">Zain (Jordan)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">eXamPLE</td>
<td style="text-align: center">mYiPhone uk</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: yellow; text-align: center">incoming</td>
<td style="background-color: white; text-align: center">unknown</td>
<td style="background-color: #c0c0c0; text-align: center">n.a.</td>
</tr>
</table>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''

[[Category:Unlocking Methods]]

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-15T22:18:14Z

Caique2001: /* TurboSIM Compatibility with Operators */

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* your jailbroken iPhone-3G with openssh installed (from cydia) and WLAN connection to your PC
* Bladox' turboSim
* putty, winscp (or equivalent mac proggies)
* turboSim programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* turboSim app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]] (on your own risk you can test [http://dl.free.fr/nz1Tbj2sC/lamesaft.trb this] version)

----

=== Installation ===

1. Put your official provider card (prepaid) together with turboSim into the sim card slot of your iPhone-3G. Google a little bit how to do this. IMHO it's a good idea to (TESA-)tape turboSim and SIM-card together (on upper surface, tape needs to clasp around the chip to the connection's side of the card, so there is no tape edge on the surface in direction of tension), otherwise your SIM can get stuck in your phone and you have to open it.

2. unpack turbo-cable-utils and use Win''Scp to copy the contents of bin-iphonev2 to folder /bin/ on your iphone (username: root, password: alpine)

[[Image:Winscp_turbo-utils.png]]

3. connect with putty to your iPhone (user root, pass alpine) (btw, changing your password is a good idea: passwd)

4. change permissions

chmod 755 /bin/turbo-*

5. run turbo-info

iPhone:~ root# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.7.0
Serial Number <...>
OK. No Error

''If this does not end with "ok":''

localhost:~ root# turbo-info
initializing modem
AT+CPMS="SM","SM"
ERROR
AT+CPMS?
ERROR
modem initiated
Mobile Phone/Serial Cable Communication Error

this could have following reasons:
* electrical contact problems: check your turboSim-Sim-pack, sometimes there are some bumps from the cutting process which need to be removed
* the SIM you use to program your turboSIM is locked, you have already access to the turboSIM via iPhone if the SIM is unlocked (official provider SIM)
* turboSIM isn't empty, there is a programme installed which prevents network access
<BR>

6. use Win''Scp to copy unpacked zero-g-trb to folder /private/var/root

[[Image:Winscp_zerog.png]]

7. run turbo-reset and then turbo-app to programme your turboSim

iPhone:~ root# turbo-app zerog095.trb
SRC zerog095.trb
SIZE 1023
initializing modem
modem initiated
OK. No Error

You now should see zero-g sim app in settings -> phone -> sim applications (ignore the carrier, I took screen shots later on)

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

9. Remove official card + turboSim and replace it with your contract card + turboSim, turbo-info should end with okay

10. reboot / switch on/off phone

I have to type in my SIM-Pin first

[[Image:Ip_unlocksim.png]]

then: no service, okay...

[[Image:Ip_noservice.png]]

10. commit green button of zero-g application, which appears after some seconds

[[Image:Ip_zerog2.png]]

11. Some timing problems? Lost carrier? Just closing...

[[Image:Ip_noservice2.png]]

'cos it works at the end...

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

=== TurboSIM Compatibility with Operators ===

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Locked (Official)<BR>Provider</td>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Congstar</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G, V?<BR>(1996)</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">AT&T</td>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">AT&T (US)</td>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: white; text-align: center">?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: white; text-align: center">?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: white; text-align: center">?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Rogers (Canada)</td>
<td style="text-align: center">Zain (Jordan)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">eXamPLE</td>
<td style="text-align: center">mYiPhone uk</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: yellow; text-align: center">incoming</td>
<td style="background-color: white; text-align: center">unknown</td>
<td style="background-color: #c0c0c0; text-align: center">n.a.</td>
</tr>
</table>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''

[[Category:Unlocking Methods]]

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-15T21:18:20Z

Caique2001: /* Remarks */

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* your jailbroken iPhone-3G with openssh installed (from cydia) and WLAN connection to your PC
* Bladox' turboSim
* putty, winscp (or equivalent mac proggies)
* turboSim programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* turboSim app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]] (on your own risk you can test [http://dl.free.fr/nz1Tbj2sC/lamesaft.trb this] version)

----

=== Installation ===

1. Put your official provider card (prepaid) together with turboSim into the sim card slot of your iPhone-3G. Google a little bit how to do this. IMHO it's a good idea to (TESA-)tape turboSim and SIM-card together (on upper surface, tape needs to clasp around the chip to the connection's side of the card, so there is no tape edge on the surface in direction of tension), otherwise your SIM can get stuck in your phone and you have to open it.

2. unpack turbo-cable-utils and use Win''Scp to copy the contents of bin-iphonev2 to folder /bin/ on your iphone (username: root, password: alpine)

[[Image:Winscp_turbo-utils.png]]

3. connect with putty to your iPhone (user root, pass alpine) (btw, changing your password is a good idea: passwd)

4. change permissions

chmod 755 /bin/turbo-*

5. run turbo-info

iPhone:~ root# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.7.0
Serial Number <...>
OK. No Error

''If this does not end with "ok":''

localhost:~ root# turbo-info
initializing modem
AT+CPMS="SM","SM"
ERROR
AT+CPMS?
ERROR
modem initiated
Mobile Phone/Serial Cable Communication Error

this could have following reasons:
* electrical contact problems: check your turboSim-Sim-pack, sometimes there are some bumps from the cutting process which need to be removed
* the SIM you use to program your turboSIM is locked, you have already access to the turboSIM via iPhone if the SIM is unlocked (official provider SIM)
* turboSIM isn't empty, there is a programme installed which prevents network access
<BR>

6. use Win''Scp to copy unpacked zero-g-trb to folder /private/var/root

[[Image:Winscp_zerog.png]]

7. run turbo-reset and then turbo-app to programme your turboSim

iPhone:~ root# turbo-app zerog095.trb
SRC zerog095.trb
SIZE 1023
initializing modem
modem initiated
OK. No Error

You now should see zero-g sim app in settings -> phone -> sim applications (ignore the carrier, I took screen shots later on)

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

9. Remove official card + turboSim and replace it with your contract card + turboSim, turbo-info should end with okay

10. reboot / switch on/off phone

I have to type in my SIM-Pin first

[[Image:Ip_unlocksim.png]]

then: no service, okay...

[[Image:Ip_noservice.png]]

10. commit green button of zero-g application, which appears after some seconds

[[Image:Ip_zerog2.png]]

11. Some timing problems? Lost carrier? Just closing...

[[Image:Ip_noservice2.png]]

'cos it works at the end...

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

=== TurboSIM Compatibility with Operators ===

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Locked (Official)<BR>Provider</td>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G, V?<BR>(1996)</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">AT&T</td>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">AT&T (US)</td>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">VodaFone (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td>?</td>
<td>?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Tesco</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td>?</td>
<td>?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Virgin (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td>?</td>
<td>?</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">T-Mobile</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">O2 (UK)</td>
<td style="text-align: center">Orange (UK)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Rogers (Canada)</td>
<td style="text-align: center">Zain (Jordan)</td>
<td style="text-align: center">2G</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">ATNT</td>
<td style="text-align: center">mYiPhone uk</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: yellow; text-align: center">incoming</td>
<td style="background-color: white; text-align: center">unknown</td>
<td style="background-color: #c0c0c0; text-align: center">n.a.</td>
</tr>
</table>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, this needs the other version of turbo-cable-utils (bin-iphonev1) in case you didn't upgrade to 2.x yet.
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''

[[Category:Unlocking Methods]]

Talk:IDA Pro Setup

2008-08-15T08:34:13Z

Caique2001: /* offsets */

prereqs.: IDA Pro Advanced, baseband files

wanted: Howto load these files correctly into IDA

'''Anybody to give this information here?''' TIA -caique2001-

== into ida ==
I suggest you look more into IDA Pro, see how things work. you may not be ready for a baseband yet.

the most important thing you need is the address. for example, i knew the iBoot was at 0x18000000 because at the beginning there is a routine to look if it is there and relocate it if not. also it has many references to 0x1800000 throughout the file.

Here are some key combinations to use:
c = turn the 'gibberish' into code
d = turn the 'gibberish' into data
a = turn the 'gibberish' into a string
u = undefine what you just may have done, i usually use this since there is no real edit+undo in IDA so this is the next best thing
Alt+G = change the 0 to a 1 to switch to thumb mode when needed

really i feel that you should do some more research on ARM and IDA Pro because a wiki article would not be enough to fully explain it

== re: into ida ==
I roughly know how ida works and what the keys are. I think there are some people that have already setup the right values for reversing the baseband. So what I want to see here is just a quick intro to set up the project (segments, fileoffsets, changed options, entry points and so on), not how to use ida. This should almost fit into your article above, just counting words ;-)

Yea, but if you don't understand how to get those numbers, you'll be pretty useless as a reverser. Not to discourage, but the numbers really aren't that hard to get. Look at the memory map I posted. All the information you need is here. ~geohot

Probably I missed something in the constitution, just to cite: "Let's document this device better than anyone at apple knows it." Fact is, you and some other people know how to set up the IDA project. If now, someother people, including me (btw. my first reversing was a CP/M in 1986), don't know how to set up it, one thing is clear: It's not documented. So if you guys reply to my request "this isn't hard to get", this actually means "it isn't hard to get for us" (1st) and "we _don't_want_ to document it" (2nd). This is against the constitution set up by yourselves! Should we change the constitution? My (tongue in cheek) proposal: "This pseudo wiki is intended for <fill in names here> to absorb knowledge. Everybody is invited to give us knowledge..." - The world could be that easy: Just give those people that lack some knowlegde a chance!!! And don't mistake knowledge with qualification. -caique2001-

== offsets ==
For example, if you look into ICE2_01.45 using a hex editor, you will see starting 0x634 there contains the memory maps. It started at 0x20000000 and ends at 0x21000000 with sections in between doing its own thing. The code/data in the .fls starts at 0xCF8 indicated by location 0xCF4. The length of the code is indicated by the location at 0xCEC which amounts to 0x5E9E18.

So, you may want to load the data in the .fls file from 0xCF8 to 0X5EAB0F at offset 0x20000000 in IDA pro.

-- CPICH

Hey, you speak my language :-) Thanks -caique2001- My next problem is, I don't know the entry point. And I get a lot of decompile errors... Mhhh, it's an ARM926 what means its target should be just "ARM"? - '''I am so dumb, please feed my empty brain ;-) ''' -caique2001-

Talk:IDA Pro Setup

2008-08-15T08:30:05Z

Caique2001: /* re: into ida */

prereqs.: IDA Pro Advanced, baseband files

wanted: Howto load these files correctly into IDA

'''Anybody to give this information here?''' TIA -caique2001-

== into ida ==
I suggest you look more into IDA Pro, see how things work. you may not be ready for a baseband yet.

the most important thing you need is the address. for example, i knew the iBoot was at 0x18000000 because at the beginning there is a routine to look if it is there and relocate it if not. also it has many references to 0x1800000 throughout the file.

Here are some key combinations to use:
c = turn the 'gibberish' into code
d = turn the 'gibberish' into data
a = turn the 'gibberish' into a string
u = undefine what you just may have done, i usually use this since there is no real edit+undo in IDA so this is the next best thing
Alt+G = change the 0 to a 1 to switch to thumb mode when needed

really i feel that you should do some more research on ARM and IDA Pro because a wiki article would not be enough to fully explain it

== re: into ida ==
I roughly know how ida works and what the keys are. I think there are some people that have already setup the right values for reversing the baseband. So what I want to see here is just a quick intro to set up the project (segments, fileoffsets, changed options, entry points and so on), not how to use ida. This should almost fit into your article above, just counting words ;-)

Yea, but if you don't understand how to get those numbers, you'll be pretty useless as a reverser. Not to discourage, but the numbers really aren't that hard to get. Look at the memory map I posted. All the information you need is here. ~geohot

Probably I missed something in the constitution, just to cite: "Let's document this device better than anyone at apple knows it." Fact is, you and some other people know how to set up the IDA project. If now, someother people, including me (btw. my first reversing was a CP/M in 1986), don't know how to set up it, one thing is clear: It's not documented. So if you guys reply to my request "this isn't hard to get", this actually means "it isn't hard to get for us" (1st) and "we _don't_want_ to document it" (2nd). This is against the constitution set up by yourselves! Should we change the constitution? My (tongue in cheek) proposal: "This pseudo wiki is intended for <fill in names here> to absorb knowledge. Everybody is invited to give us knowledge..." - The world could be that easy: Just give those people that lack some knowlegde a chance!!! And don't mistake knowledge with qualification. -caique2001-

== offsets ==
For example, if you look into ICE2_01.45 using a hex editor, you will see starting 0x634 there contains the memory maps. It started at 0x20000000 and ends at 0x21000000 with sections in between doing its own thing. The code/data in the .fls starts at 0xCF8 indicated by location 0xCF4. The length of the code is indicated by the location at 0xCEC which amounts to 0x5E9E18.

So, you may want to load the data in the .fls file from 0xCF8 to 0X5EAB0F at offset 0x20000000 in IDA pro.

-- CPICH

Hey, you speak my language :-) Thanks -caique2001-

Talk:IDA Pro Setup

2008-08-14T23:19:48Z

Caique2001: /* offsets */

Talk:IDA Pro Setup

2008-08-14T21:50:12Z

Caique2001: /* re: into ida */

Talk:IDA Pro Setup

2008-08-14T21:47:45Z

Caique2001:

Tutorial:Unlock iPhone 3G with TurboSim

2008-08-14T21:40:28Z

Caique2001: /* Prerequisites */

{{disclaimer}}

This article is a step by step instruction to use a net-locked iPhone-3G with a different provider.

The dev team states on [http://blog.iphone-dev.org/post/44428446/updates their blog] that the SIM hacks they examined send illegal signals. <nowiki></nowiki>

<table border=1 width=100%><tr>
<td bgcolor=#ffA4A4>

'''Update / Warning:'''

'''ZeroG''', was '''''not intended''''' ''' to do trickery to your cellular network'''. But due to the way the iPhone's 2.x baseband firmware handles the login, '''actually it does'''. Short overview: ZeroG starts up the SIM replacing MCC / MNC with test IMSI codes, leaving the MSIN untouched. Then it restarts the SIM giving the correct IMSI afterwards. Unfortunately the iPhone asks the SIM exactly ''one'' time for the IMSI, it doesn't care about the restart. So effectively the login into the cellular network is done in test IMSI mode. Now it is up to your provider, how it handles such requests. For normal logins (no turboSIM) the login request is processed by your provider. In the roaming case your login request is routed from the guest provider to your provider. There is no provider for 'test' MCC / MCN. Your provider has to recognize this upon login (This implies you have to manually select cellular network right from the start.) If your provider accepts the test IMSI code and does authentication with your MSIN (this implies, (real) roaming is not possible, as only _your_ provider can process MSIN correctly), everything ''could'' be fine. You don't spoof your identity, there should also be no billing problems. But if you try this method, have successfully installed ZeroG.trb and do _not_ gain access, probably your provider does not accept test IMSI mode. In this case better do not retry as you might risk your IMSI beeing blacklisted.<BR>

</td>
</tr>
</table><BR>

[[Image:Ip terminal.png | thumb | right | 240px | Swisscom -> O2 Germany]]

----

=== Preamble ===

Apart from the warning and some other things, the method is quite stable if it works with your provider at all. You have to take care of:
* never switch on 3G mode
* before you use your SIM card that you want to unlock, put it in a different 2G phone and manually select provider and check GPRS works
* for GPRS, "data roaming" has to be enabled on the iPhone (it is not roaming for your provider, but the iPhone thinks it's roaming)

=== Motivation ===

Everyone who dislikes pink T's, over-priced unlocked iPhones and likes investigating exciting techniques ... (a.s.o.)

=== Prerequisites ===

You need:
* your jailbroken iPhone-3G with openssh installed (from cydia) and WLAN connection to your PC
* Bladox' turboSim
* putty, winscp (or equivalent mac proggies)
* turboSim programming sw [[http://dl.free.fr/pzijbVjXl/turbo-cable-utils-iPhone-0.7.0-rev3-firmware-v2.tar.gz download]]
* turboSim app zero-g [[http://www.bladox.com/pub/zerog-0.95.tar.gz download]] (on your own risk you can test [http://dl.free.fr/nz1Tbj2sC/lamesaft.trb this] version)

----

=== Installation ===

1. Put your official provider card (prepaid) together with turboSim into the sim card slot of your iPhone-3G. Google a little bit how to do this. IMHO it's a good idea to (TESA-)tape turboSim and SIM-card together (on upper surface, tape needs to clasp around the chip to the connection's side of the card, so there is no tape edge on the surface in direction of tension), otherwise your SIM can get stuck in your phone and you have to open it.

2. unpack turbo-cable-utils and use Win''Scp to copy the contents of bin-iphonev2 to folder /bin/ on your iphone (username: root, password: alpine)

[[Image:Winscp_turbo-utils.png]]

3. connect with putty to your iPhone (user root, pass alpine) (btw, changing your password is a good idea: passwd)

4. change permissions

chmod 755 /bin/turbo-*

5. run turbo-info

iPhone:~ root# turbo-info
initializing modem
modem initiated
Kernel Version 1.2.7.0
Serial Number <...>
OK. No Error

''If this does not end with "ok":''

localhost:~ root# turbo-info
initializing modem
AT+CPMS="SM","SM"
ERROR
AT+CPMS?
ERROR
modem initiated
Mobile Phone/Serial Cable Communication Error

this could have following reasons:
* electrical contact problems: check your turboSim-Sim-pack, sometimes there are some bumps from the cutting process which need to be removed
* the SIM you use to program your turboSIM is locked, you have already access to the turboSIM via iPhone if the SIM is unlocked (official provider SIM)
* turboSIM isn't empty, there is a programme installed which prevents network access
<BR>

6. use Win''Scp to copy unpacked zero-g-trb to folder /private/var/root

[[Image:Winscp_zerog.png]]

7. run turbo-reset and then turbo-app to programme your turboSim

iPhone:~ root# turbo-app zerog095.trb
SRC zerog095.trb
SIZE 1023
initializing modem
modem initiated
OK. No Error

You now should see zero-g sim app in settings -> phone -> sim applications (ignore the carrier, I took screen shots later on)

[[Image:Ip_simapp.png]]

[[Image:Ip_zerog.png]]

9. Remove official card + turboSim and replace it with your contract card + turboSim, turbo-info should end with okay

10. reboot / switch on/off phone

I have to type in my SIM-Pin first

[[Image:Ip_unlocksim.png]]

then: no service, okay...

[[Image:Ip_noservice.png]]

10. commit green button of zero-g application, which appears after some seconds

[[Image:Ip_zerog2.png]]

11. Some timing problems? Lost carrier? Just closing...

[[Image:Ip_noservice2.png]]

'cos it works at the end...

[[Image:Ip_unlocked.png]]

----

=== 2G data settings ===
* roaming must be enabled
* make sure APN settings are correct (if APN options don't show up, just install a configuration file created with Apple's 'Web Configuration Utility' ([http://www.apple.com/support/downloads/iphoneconfigurationwebutility10formac.html Mac] / [http://www.apple.com/support/downloads/iphoneconfigurationwebutility10forwindows.html Windoze]) (In Windoze you can reach it with http://localhost:3000 ). Send this file to yourself and open it with the mail client.
* in BossPref (if you don't use it, don't care) 'edge' should be left enabled, even if network does not provide it (seems the BossPref option is a little bit misleading and 'edge' actually means 'GPRS/edge')

=== 3G-SIM / USIM ===

It works with (some?) USIMs (blau.de Germany) as well. 3G '''must no be activated''' on the iPhone. Once 3G is activated, it stops working, even if it is deactivated afterwards. To revive such SIM, put it in a non UMTS capable phone (did it together with turboSIM), check phone and GPRS functions and then this USIM will work again on the iPhone-3G. The SIM application (zero-g) was not visible, but it worked though. If GPRS does not work after a while (3 minutes or so), reboot your phone and try again.

=== GPRS-'Fix' ===

Today GPRS stopped working for me. Seems to be there are some 'states', stored on the SIM. This fixed the issue:
* removed SIM+TSim
* put SIM (without TSim) into non UMTS, but GPRS/edge mobile
* checked GPRS
* repacked Sim+TSim and put it back to the iPhone

Voilà, here we go :-) GPRS for another few days :-)

Tho' this might really not be the ultimate solution, I could hardly switch back to my old XDA Orbit. But XDA is a good device to revive the TSim solution... For that, I still love it a litte bit ;-)

=== Stuck in No Signal after a period ===

Randomly you can get stuck in a bad No Signal. To correct that:

* remove SIM+TSim
* put SIM (without TSim) into non 3G phone
* Manually select your provider (desired to unlock) network
* repack Sim+TSim and put it back to the iPhone

Here we go again, unlock iphone for a few days more also.

=== Status ===

<table cellpadding=5 border=1>
<tr>
<td style="text-align: center">Locked (Official)<BR>Provider</td>
<td style="text-align: center">Unlocked Provider</td>
<td style="text-align: center">SIM type</td>
<td style="text-align: center">calls</td>
<td style="text-align: center">SMS</td>
<td style="text-align: center">2G data</td>
<td style="text-align: center">3G data</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">Blau.de Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">2G, V?<BR>(1996)</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: white; text-align: center">?</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">Swisscom</td>
<td style="text-align: center">O2 Germany</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #ff6464; text-align: center">no</td>
</tr>
<tr>
<td style="text-align: center">AT&T</td>
<td style="text-align: center">Turkcell</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">AT&T (US)</td>
<td style="text-align: center">TIM Brazil</td>
<td style="text-align: center">2G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: #c0c0c0; text-align: center">-</td>
</tr>
<tr>
<td style="text-align: center">...</td>
<td style="text-align: center"></td>
<td style="text-align: center"></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td style="text-align: center">...</td>
<td style="text-align: center"></td>
<td style="text-align: center"></td>
<td></td>
<td></td>
<td></td>
<td></td>
</tr>
<tr>
<td style="text-align: center">ATNT</td>
<td style="text-align: center">mYiPhone uk</td>
<td style="text-align: center">3G</td>
<td style="background-color: #64ff64; text-align: center">yes</td>
<td style="background-color: yellow; text-align: center">incoming</td>
<td style="background-color: white; text-align: center">unknown</td>
<td style="background-color: #c0c0c0; text-align: center">n.a.</td>
</tr>
</table>

=== Remarks ===

* Important is you get zero-g into your turboSim. So you could also try with a first gen iphone, probably this needs the other version of turbo-cable-utils (bin-iphonev1)
* If you get ''ERROR: Not Enough RAM'' run '''turbo-rm-apps'''

[[Category:Unlocking Methods]]