https://www.theiphonewiki.com/w/api.php?action=feedcontributions&feedformat=atom&user=DogbertThe iPhone Wiki - User contributions [en]2026-07-30T11:55:51ZUser contributionsMediaWiki 1.31.14https://www.theiphonewiki.com/w/index.php?title=Baseband_Commands&diff=25523Baseband Commands2012-04-29T19:51:26Z<p>Dogbert: /* Setting up Minicom 2.2 */</p>
<hr />
<div>==About==<br />
In this page, you'll find some Baseband Commands. You can use them with Minicom 2.2, that can be found on Cydia.<br />
<br />
==Setting up Minicom 2.2==<br />
# After installing Minicom from Cydia, make sure the folder [[:/usr/etc]] exists. SSH into your iPhone and then, type: ''minicom -s''.<br />
# Now, select ''Serial Port Setup'' in the Menu and press Enter. Then, press "a" and set Serial Device to ''[[:/dev/tty.debug]]'' (however, ''[[:/dev/dlci.spi-baseband.extra_13]]'' or ''[[:/dev/dlci.spi-baseband.extra_0]]'' also works and appears to be more reliable than the other device).<br />
# Press Esc, and in the Main Menu, select ''Save setup as dfl''. Now, select "exit".<br />
# To run minicom using ssh, just run ''minicom -w''<br />
<br />
==Running Minicom 2.2 from MobileTerminal==<br />
'''Note''': minicom does work on MobileTerminal only on root (use su) and only after it has been configured (through the steps above).<br />
# Open [[MobileTerminal.app]].<br />
# Run the command su, enter your root password (default alpine) and then run ''minicom -w''.<br />
# To exit minicom, slide your finger on the screen ("gesture") to the bottom right (if you haven't changed this setting in MobileTerminal settings), then press A, X and enter.<br />
<br />
==How to run Baseband Commands==<br />
First, run Minicom. Then, type "at" and press Enter. Then, you can type the command that you want, have fun.<br />
<br />
==Baseband Commands==<br />
{{main|List of baseband commands}}.<br />
<br />
===Getting Information===<br />
* '''at+xgendata''': Display some baseband informations<br />
* '''at&v''': Display the profiles in the Baseband (Active Profile, Stored Profile 0 and Stored Profile 1)<br />
* '''at+clac''': Show some baseband commands<br />
* '''at&h''': Show more Baseband Commands<br />
* '''at+cgsn''': Show serial number from BBUpdaterExtreme<br />
* '''at+xdrv=9,3''': Command from BBUpdaterExtreme<br />
* '''at+cpwroff''': Powercycle baseband modem from BBUpdaterExtreme<br />
* '''at+csq''': Get signal strength from BBUpdaterExtreme<br />
<br />
===Unlock===<br />
* '''at+clck''': Traditional unlock command<br />
* '''at+xlock''': Wildcard unlock<br />
* '''at+xsimstate''': Print lock state (write at+xsimstate=1 to turn on, at+xsimstate=0 to turn off)<br />
<br />
===SMS===<br />
* '''at+cmgf''': SMS operating mode (at+cmgf=0 - PDU, at+cmgf=1 - text)<br />
* '''at+cmgs''': Send SMS (write at+cmgs="[PHONE NUMBER]"[ENTER][MESSAGE][CTRL-Z] while [ENTER] is an enter (\r\n) and [CTRL-Z] is ASCII 26)<br />
<br />
===General===<br />
* '''atz''': Reset modem<br />
* '''ath''': Hangup modem</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Baseband_TEA_Keys&diff=25522Baseband TEA Keys2012-04-29T19:51:00Z<p>Dogbert: /* Hardware Thumbprint Generation */</p>
<hr />
<div>The baseband generates [[wikipedia:Tiny Encryption Algorithm|TEA]] keys based of the [[CHIPID]] and [[NORID]].<br />
<br />
==Key A Generation==<br />
// return unique phone key (key A), this key is used for security zone encryption/decryption<br />
void get_keyA(u8 *A) {<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx, [[NORID|dep1_norid]], 0x10);<br />
SHA1Input(&ctx, [[CHIPID|dep2_chipid]], 0x10);<br />
SHA1Result(&ctx);<br />
memcpy(A, (u8*)ctx.Message_Digest, 0x14);<br />
}<br />
<br />
==NCK Key Generation==<br />
//ulc_mix_lock_unlock_key((u8*)A,(u8*)ctx.Message_Digest,dep1_norid,dep2_chipid,(u8*)B);<br />
void ulc_mix_lock_unlock_key(u8 *keyA, u8 *keyNCK, u8 *norid, u8 *chipid, u8 *keyB) {<br />
u8 out_iv[8];<br />
tea_3_round_encipher(norid,keyNCK,keyA,keyB,out_iv); //norid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
tea_3_round_encipher(chipid,keyNCK,out_iv,keyB+8,out_iv); //chipid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
}<br />
<br />
// auxilary function for nck key generation<br />
void tea_3_round_encipher(u8 *in, u8 *key, u8 *iv, u8 *out, u8 *out_iv){<br />
u32 tmpin[2], nexttea[2];<br />
tea_encipher((u32*)in, tmpin, (u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)iv)[0];<br />
nexttea[1] = tmpin[1]^((u32*)iv)[1];<br />
tea_encipher(nexttea, (u32*)out, (u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)out)[0];<br />
nexttea[1] = tmpin[1]^((u32*)out)[1];<br />
tea_encipher(nexttea, (u32*)out_iv, (u32*)key);<br />
}<br />
<br />
==Hardware Thumbprint Generation==<br />
u8 salt[20] = {<br />
0x03, 0x5E, 0x20, 0x03,<br />
0xA9, 0x74, 0xFC, 0x57,<br />
0xBB, 0x2D, 0x59, 0x28,<br />
0xBF, 0x10, 0xAE, 0xB9,<br />
0x00, 0x00, 0x00, 0x00<br />
};<br />
<br />
void getHardwareThumbPrint(u8 *hwTP){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx, [[CHIPID|chipid]], 16);<br />
SHA1Input(&ctx, [[NORID|norid]], 16);<br />
SHA1Input(&ctx, imei, 16); //nibble encoded<br />
SHA1Input(&ctx, salt, 20);<br />
SHA1Result(&ctx);<br />
memcpy(hwTP, (u8*)ctx.Message_Digest, 0x14);<br />
}<br />
<br />
Apple calls this "BasebandThumbprint". It can be obtained from the baseband serial port with [[Baseband Commands|at+xthumb?]].<br />
<br />
==[[Wildcard Ticket]] Key Generation==<br />
void getWildcardKey(u8 *wKey) {<br />
u8 hwTP[20];<br />
getHardwareThumbPrint(&hwTP);<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx, hwTP, 20);<br />
SHA1Input(&ctx, salt, 20);<br />
SHA1Result(&ctx);<br />
memcpy(wKey, (u8*)ctx.Message_Digest, 0x14);<br />
}<br />
This generates the key which can be used to encrypt/decrypt the wildcard ticket - the [[CHIPID|chipID]]/[[NORID|norID]] are NOT required.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Baseband_TEA_Keys&diff=25488Baseband TEA Keys2012-04-22T22:07:59Z<p>Dogbert: /* Hardware Thumbprint Generation */</p>
<hr />
<div>The baseband generates [[wikipedia:Tiny Encryption Algorithm|TEA]] keys based of the [[CHIPID]] and [[NORID]].<br />
<br />
==Key A Generation==<br />
//return unique phone key (key A), this key is used for security zone encryption/decryption<br />
void get_keyA(u8 *A){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,[[NORID|dep1_norid]],0x10);<br />
SHA1Input(&ctx,[[CHIPID|dep2_chipid]],0x10);<br />
SHA1Result(&ctx);<br />
memcpy(A,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==NCK Key Generation==<br />
//ulc_mix_lock_unlock_key((u8*)A,(u8*)ctx.Message_Digest,dep1_norid,dep2_chipid,(u8*)B);<br />
void ulc_mix_lock_unlock_key(u8 *keyA, u8 *keyNCK,u8 *norid,u8 *chipid,u8 *keyB){<br />
u8 out_iv[8];<br />
tea_3_round_encipher(norid,keyNCK,keyA,keyB,out_iv); //norid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
tea_3_round_encipher(chipid,keyNCK,out_iv,keyB+8,out_iv); //chipid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
}<br />
// auxilary function for nck key generation<br />
void tea_3_round_encipher(u8 *in,u8 *key,u8 *iv,u8 *out,u8 *out_iv){<br />
u32 tmpin[2],nexttea[2];<br />
tea_encipher((u32*)in,tmpin,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)iv)[0];<br />
nexttea[1] = tmpin[1]^((u32*)iv)[1];<br />
tea_encipher(nexttea,(u32*)out,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)out)[0];<br />
nexttea[1] = tmpin[1]^((u32*)out)[1];<br />
tea_encipher(nexttea,(u32*)out_iv,(u32*)key);<br />
}<br />
<br />
==Hardware Thumbprint Generation==<br />
u8 salt[20] = { 0x03, 0x5E, 0x20, 0x03, 0xA9, 0x74, 0xFC, 0x57, <br />
0xBB, 0x2D, 0x59, 0x28, 0xBF, 0x10, 0xAE, 0xB9, <br />
0x00, 0x00, 0x00, 0x00<br />
} ;<br />
<br />
void getHardwareThumbPrint(u8 *hwTP){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,[[CHIPID|chipid]],16);<br />
SHA1Input(&ctx,[[NORID|norid]],16);<br />
SHA1Input(&ctx,imei,16); //nibble encoded<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(hwTP,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
Apple calls this "BasebandThumbprint".<br />
<br />
==[[Wildcard Ticket]] Key Generation==<br />
void getWildcardKey(u8 *wKey){<br />
u8 hwTP[20];<br />
getHardwareThumbPrint(&hwTP);<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,hwTP,20);<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(wKey,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
The generates the key which can be used to encrypt/decrypt the wildcard ticket - the chipID/norID are NOT required.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Baseband_TEA_Keys&diff=25487Baseband TEA Keys2012-04-22T22:07:49Z<p>Dogbert: /* Hardware Thumbprint Generation */</p>
<hr />
<div>The baseband generates [[wikipedia:Tiny Encryption Algorithm|TEA]] keys based of the [[CHIPID]] and [[NORID]].<br />
<br />
==Key A Generation==<br />
//return unique phone key (key A), this key is used for security zone encryption/decryption<br />
void get_keyA(u8 *A){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,[[NORID|dep1_norid]],0x10);<br />
SHA1Input(&ctx,[[CHIPID|dep2_chipid]],0x10);<br />
SHA1Result(&ctx);<br />
memcpy(A,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==NCK Key Generation==<br />
//ulc_mix_lock_unlock_key((u8*)A,(u8*)ctx.Message_Digest,dep1_norid,dep2_chipid,(u8*)B);<br />
void ulc_mix_lock_unlock_key(u8 *keyA, u8 *keyNCK,u8 *norid,u8 *chipid,u8 *keyB){<br />
u8 out_iv[8];<br />
tea_3_round_encipher(norid,keyNCK,keyA,keyB,out_iv); //norid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
tea_3_round_encipher(chipid,keyNCK,out_iv,keyB+8,out_iv); //chipid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
}<br />
// auxilary function for nck key generation<br />
void tea_3_round_encipher(u8 *in,u8 *key,u8 *iv,u8 *out,u8 *out_iv){<br />
u32 tmpin[2],nexttea[2];<br />
tea_encipher((u32*)in,tmpin,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)iv)[0];<br />
nexttea[1] = tmpin[1]^((u32*)iv)[1];<br />
tea_encipher(nexttea,(u32*)out,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)out)[0];<br />
nexttea[1] = tmpin[1]^((u32*)out)[1];<br />
tea_encipher(nexttea,(u32*)out_iv,(u32*)key);<br />
}<br />
<br />
==Hardware Thumbprint Generation==<br />
u8 salt[20] = { 0x03, 0x5E, 0x20, 0x03, 0xA9, 0x74, 0xFC, 0x57, <br />
0xBB, 0x2D, 0x59, 0x28, 0xBF, 0x10, 0xAE, 0xB9, <br />
0x00, 0x00, 0x00, 0x00<br />
} ;<br />
<br />
void getHardwareThumbPrint(u8 *hwTP){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,[[CHIPID|chipid]],16);<br />
SHA1Input(&ctx,[[NORID|norid]],16);<br />
SHA1Input(&ctx,imei,16); //nibble encoded<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(hwTP,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
Apple calls this "BasebandThumbprint".<br />
<br />
==[[Wildcard Ticket]] Key Generation==<br />
void getWildcardKey(u8 *wKey){<br />
u8 hwTP[20];<br />
getHardwareThumbPrint(&hwTP);<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,hwTP,20);<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(wKey,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
The generates the key which can be used to encrypt/decrypt the wildcard ticket - the chipID/norID are NOT required.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Baseband_TEA_Keys&diff=25486Baseband TEA Keys2012-04-22T22:07:40Z<p>Dogbert: /* Wildcard Ticket Key Generation */</p>
<hr />
<div>The baseband generates [[wikipedia:Tiny Encryption Algorithm|TEA]] keys based of the [[CHIPID]] and [[NORID]].<br />
<br />
==Key A Generation==<br />
//return unique phone key (key A), this key is used for security zone encryption/decryption<br />
void get_keyA(u8 *A){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,[[NORID|dep1_norid]],0x10);<br />
SHA1Input(&ctx,[[CHIPID|dep2_chipid]],0x10);<br />
SHA1Result(&ctx);<br />
memcpy(A,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==NCK Key Generation==<br />
//ulc_mix_lock_unlock_key((u8*)A,(u8*)ctx.Message_Digest,dep1_norid,dep2_chipid,(u8*)B);<br />
void ulc_mix_lock_unlock_key(u8 *keyA, u8 *keyNCK,u8 *norid,u8 *chipid,u8 *keyB){<br />
u8 out_iv[8];<br />
tea_3_round_encipher(norid,keyNCK,keyA,keyB,out_iv); //norid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
tea_3_round_encipher(chipid,keyNCK,out_iv,keyB+8,out_iv); //chipid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
}<br />
// auxilary function for nck key generation<br />
void tea_3_round_encipher(u8 *in,u8 *key,u8 *iv,u8 *out,u8 *out_iv){<br />
u32 tmpin[2],nexttea[2];<br />
tea_encipher((u32*)in,tmpin,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)iv)[0];<br />
nexttea[1] = tmpin[1]^((u32*)iv)[1];<br />
tea_encipher(nexttea,(u32*)out,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)out)[0];<br />
nexttea[1] = tmpin[1]^((u32*)out)[1];<br />
tea_encipher(nexttea,(u32*)out_iv,(u32*)key);<br />
}<br />
<br />
==Hardware Thumbprint Generation==<br />
u8 salt[20] = { 0x03, 0x5E, 0x20, 0x03, 0xA9, 0x74, 0xFC, 0x57, <br />
0xBB, 0x2D, 0x59, 0x28, 0xBF, 0x10, 0xAE, 0xB9, <br />
0x00, 0x00, 0x00, 0x00<br />
} ;<br />
<br />
void getHardwareThumbPrint(u8 *hwTP){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,[[CHIPID|chipid]],16);<br />
SHA1Input(&ctx,[[NORID|norid]],16);<br />
SHA1Input(&ctx,imei,16); //nibble encoded<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(hwTP,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==[[Wildcard Ticket]] Key Generation==<br />
void getWildcardKey(u8 *wKey){<br />
u8 hwTP[20];<br />
getHardwareThumbPrint(&hwTP);<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,hwTP,20);<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(wKey,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
The generates the key which can be used to encrypt/decrypt the wildcard ticket - the chipID/norID are NOT required.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Baseband_TEA_Keys&diff=25485Baseband TEA Keys2012-04-22T21:57:13Z<p>Dogbert: /* Wildcard Ticket Key Generation */</p>
<hr />
<div>The baseband generates [[wikipedia:Tiny Encryption Algorithm|TEA]] keys based of the [[CHIPID]] and [[NORID]].<br />
<br />
==Key A Generation==<br />
//return unique phone key (key A), this key is used for security zone encryption/decryption<br />
void get_keyA(u8 *A){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,[[NORID|dep1_norid]],0x10);<br />
SHA1Input(&ctx,[[CHIPID|dep2_chipid]],0x10);<br />
SHA1Result(&ctx);<br />
memcpy(A,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==NCK Key Generation==<br />
//ulc_mix_lock_unlock_key((u8*)A,(u8*)ctx.Message_Digest,dep1_norid,dep2_chipid,(u8*)B);<br />
void ulc_mix_lock_unlock_key(u8 *keyA, u8 *keyNCK,u8 *norid,u8 *chipid,u8 *keyB){<br />
u8 out_iv[8];<br />
tea_3_round_encipher(norid,keyNCK,keyA,keyB,out_iv); //norid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
tea_3_round_encipher(chipid,keyNCK,out_iv,keyB+8,out_iv); //chipid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
}<br />
// auxilary function for nck key generation<br />
void tea_3_round_encipher(u8 *in,u8 *key,u8 *iv,u8 *out,u8 *out_iv){<br />
u32 tmpin[2],nexttea[2];<br />
tea_encipher((u32*)in,tmpin,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)iv)[0];<br />
nexttea[1] = tmpin[1]^((u32*)iv)[1];<br />
tea_encipher(nexttea,(u32*)out,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)out)[0];<br />
nexttea[1] = tmpin[1]^((u32*)out)[1];<br />
tea_encipher(nexttea,(u32*)out_iv,(u32*)key);<br />
}<br />
<br />
==Hardware Thumbprint Generation==<br />
u8 salt[20] = { 0x03, 0x5E, 0x20, 0x03, 0xA9, 0x74, 0xFC, 0x57, <br />
0xBB, 0x2D, 0x59, 0x28, 0xBF, 0x10, 0xAE, 0xB9, <br />
0x00, 0x00, 0x00, 0x00<br />
} ;<br />
<br />
void getHardwareThumbPrint(u8 *hwTP){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,[[CHIPID|chipid]],16);<br />
SHA1Input(&ctx,[[NORID|norid]],16);<br />
SHA1Input(&ctx,imei,16); //nibble encoded<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(hwTP,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==[[Wildcard Ticket]] Key Generation==<br />
void getWildcardKey(u8 *wKey){<br />
u8 hwTP[20];<br />
getHardwareThumbPrint(&hwTP);<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,hwTP,20);<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(wKey,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
The generates the key which can be used to encrypt/decrypt the wildcard ticket - the chipID/norID are NOT required. Apple calls this "BasebandThumbprint".<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Talk:WildcardTicket&diff=17078Talk:WildcardTicket2011-03-28T19:51:57Z<p>Dogbert: </p>
<hr />
<div>Theoretically, can't we just edit the .plist? and make it into the factory unlocked IMSI Mask? -- {{unsigned|Leobruh|5:32, 19 August 2010 (UTC)}}<br />
<br />
:The activation plist is signed, so to do this you require a jailbreak anyway. --[[User:Lilstevie|Lilstevie]] 09:45, 20 August 2010 (UTC)- lilstevie<br />
<br />
i realize that. but wouldnt this result in a permanent unlock? [[User:Leobruh|Leobruh]] 07:37, 19 August 2010 (UTC)!<br />
<br />
I'm guessing the ticket is handled by the baseband, which requires an exploit to get unsigned code running in the first place? [[User:Iemit737|Iemit737]] 07:41, 19 August 2010 (UTC)<br />
<br />
The wildcard ticket is also signed - simple edits break the signature and the ticket gets rejected then. rtfm cryptography 101. [[User:dogbert|dogbert]] 16:02, 19 August 2010 (UTC)<br />
<br />
kay but unsigned code already runs when the phone is jailbroken and has access to the filesystem. wouldnt editing the .plist be okay since the sig checks arent needed. again this is all theoretical. im jw [[User:Leobruh|Leobruh]] 18:33, 19 August 2010 (UTC)!<br />
<br />
The baseband processor checks the signature, not the application processor. [[User:dogbert|dogbert]] 18:36, 19 August 2010 (UTC)<br />
<br />
ahh got ya! but would my theory work though through an exploit such as AT+XAPP? instead of a payload it just changes the .plist? [[User:Leobruh|Leobruh]] 00:15, 20 August 2010 (UTC)!<br />
<br />
:you would still require the valid NCK for it to process the unlock in that method, the current way the payloads work for exploits in the baseband processor are adequate --[[User:Lilstevie|Lilstevie]] 09:44, 20 August 2010 (UTC)<br />
<br />
:i thought NKC was only for the iPhone 2G? 0.o [[User:Leobruh|Leobruh]] 14:47, 21 August 2010 (UTC)!<br />
::NCK or Network Code Key is on any cellular device that gets locked to a carrier --[[User:Lilstevie|Lilstevie]] 14:52, 19 September 2010 (UTC)<br />
<br />
Is there are ability to decode WildcardTicket received from Apple to see NCK or lockstate table?<br />
What about unlocked by request to carrier iPhones? Is it some differences in WildcardTicket? --[[User:Requilence|Requilence]] 13:17, 20 March 2011 (UTC)<br />
<br />
:Decrypting is possible since the key is known. Changing the ticket is, however, not possible since it breaks the signatures. For carrier unlocked phones, Apple sends a new WildcardTicket without a lock table during sync.--[[User:Dogbert|Dogbert]] 16:43, 20 March 2011 (UTC)<br />
<br />
::Tell me this, if the signature is broken, what happens to the phone? DFU, Recovery...? [[User:Leobruh|Leobruh]] 17:41, 20 March 2011 (UTC)!<br />
<br />
:::The ticket is rejected and the baseband stays unactivated, e.g. locked.--[[User:Dogbert|Dogbert]] 22:20, 20 March 2011 (UTC)<br />
<br />
:: Apple send it to iphone only on sync after activate? I try SAM on unlocked by request iphone, it's activate properly with right IMSI and IMEI, but seems like WildcardTicket doesn't have lock table accept any IMSI. How can i check this? --[[User:Requilence|Requilence]] 19:52, 20 March 2011 (UTC)<br />
<br />
:::Just decrypt the activation ticket and check the tables. All the information is given in the wiki, you just have to piece it together on your own.--[[User:Dogbert|Dogbert]] 22:20, 20 March 2011 (UTC)<br />
<br />
How do you decrypt it? And wait does apple send it on sync or on activation? For instance, if I had a locked iPhone at activation, and called my carrier to get it unlocked then sync it, would apple issue a new wildcardticket unlocking it without deactivating? Or tell me to restore and deactivate?<br />
:The decryption is implicitly described on various pages of this wiki (TEA in CBC with a pre-salted key). When your iPhone becomes unlock, Apple will issue a new WildcardTicket during sync so a restore is unnecessary. --[[User:Dogbert|Dogbert]] 19:51, 28 March 2011 (UTC)</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=NCK&diff=16950NCK2011-03-21T02:31:58Z<p>Dogbert: </p>
<hr />
<div>Abbreviation of '''N'''etwork '''C'''ontrol '''K'''ey. The NCK is a 15-digit key required to "legitimately" [[unlock]] the [[M68ap|iPhone 2G]]. The mechanism to unlock the phone with a valid NCK is still present and usable in [[X-Gold 608]] and presumably [[X-Gold 618|later]] basebands. It is, however, superseded by the policies set in the [[WildcardTicket]] that is generated during the activation process. An unlocked phone receives a wildcard ticket that has no restrictions set.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=NCK&diff=16949NCK2011-03-21T02:31:45Z<p>Dogbert: </p>
<hr />
<div>Abreviation of '''N'''etwork '''C'''ontrol '''K'''ey. The NCK is a 15-digit key required to "legitimately" [[unlock]] the [[M68ap|iPhone 2G]]. The mechanism to unlock the phone with a valid NCK is still present and usable in [[X-Gold 608]] and presumably [[X-Gold 618|later]] basebands. It is, however, superseded by the policies set in the [[WildcardTicket]] that is generated during the activation process. An unlocked phone receives a wildcard ticket that has no restrictions set.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=NCK&diff=16948NCK2011-03-21T02:24:44Z<p>Dogbert: Reverting edit for factual incorrectness.</p>
<hr />
<div>Abreviation of '''N'''etwork '''C'''ontrol '''K'''ey. The NCK is a 15-digit key required to "legitimately" [[unlock]] the [[M68ap|iPhone 2G]]. Every other [[iPhone]] revision is unlocked with a [[WildcardTicket]] which permits every [[wikipedia:Mobile Network Code|MNC]]/[[wikipedia:Mobile Country Code|MCC]]/[[wikipedia:ICCID|ICCID]] combination. <br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Talk:WildcardTicket&diff=16938Talk:WildcardTicket2011-03-20T22:20:27Z<p>Dogbert: </p>
<hr />
<div>Theoretically, can't we just edit the .plist? and make it into the factory unlocked IMSI Mask? -- {{unsigned|Leobruh|5:32, 19 August 2010 (UTC)}}<br />
<br />
:The activation plist is signed, so to do this you require a jailbreak anyway. --[[User:Lilstevie|Lilstevie]] 09:45, 20 August 2010 (UTC)- lilstevie<br />
<br />
i realize that. but wouldnt this result in a permanent unlock? [[User:Leobruh|Leobruh]] 07:37, 19 August 2010 (UTC)!<br />
<br />
I'm guessing the ticket is handled by the baseband, which requires an exploit to get unsigned code running in the first place? [[User:Iemit737|Iemit737]] 07:41, 19 August 2010 (UTC)<br />
<br />
The wildcard ticket is also signed - simple edits break the signature and the ticket gets rejected then. rtfm cryptography 101. [[User:dogbert|dogbert]] 16:02, 19 August 2010 (UTC)<br />
<br />
kay but unsigned code already runs when the phone is jailbroken and has access to the filesystem. wouldnt editing the .plist be okay since the sig checks arent needed. again this is all theoretical. im jw [[User:Leobruh|Leobruh]] 18:33, 19 August 2010 (UTC)!<br />
<br />
The baseband processor checks the signature, not the application processor. [[User:dogbert|dogbert]] 18:36, 19 August 2010 (UTC)<br />
<br />
ahh got ya! but would my theory work though through an exploit such as AT+XAPP? instead of a payload it just changes the .plist? [[User:Leobruh|Leobruh]] 00:15, 20 August 2010 (UTC)!<br />
<br />
:you would still require the valid NCK for it to process the unlock in that method, the current way the payloads work for exploits in the baseband processor are adequate --[[User:Lilstevie|Lilstevie]] 09:44, 20 August 2010 (UTC)<br />
<br />
:i thought NKC was only for the iPhone 2G? 0.o [[User:Leobruh|Leobruh]] 14:47, 21 August 2010 (UTC)!<br />
::NCK or Network Code Key is on any cellular device that gets locked to a carrier --[[User:Lilstevie|Lilstevie]] 14:52, 19 September 2010 (UTC)<br />
<br />
Is there are ability to decode WildcardTicket received from Apple to see NCK or lockstate table?<br />
What about unlocked by request to carrier iPhones? Is it some differences in WildcardTicket? --[[User:Requilence|Requilence]] 13:17, 20 March 2011 (UTC)<br />
<br />
:Decrypting is possible since the key is known. Changing the ticket is, however, not possible since it breaks the signatures. For carrier unlocked phones, Apple sends a new WildcardTicket without a lock table during sync.--[[User:Dogbert|Dogbert]] 16:43, 20 March 2011 (UTC)<br />
<br />
::Tell me this, if the signature is broken, what happens to the phone? DFU, Recovery...? [[User:Leobruh|Leobruh]] 17:41, 20 March 2011 (UTC)!<br />
<br />
:::The ticket is rejected and the baseband stays unactivated, e.g. locked.--[[User:Dogbert|Dogbert]] 22:20, 20 March 2011 (UTC)<br />
<br />
:: Apple send it to iphone only on sync after activate? I try SAM on unlocked by request iphone, it's activate properly with right IMSI and IMEI, but seems like WildcardTicket doesn't have lock table accept any IMSI. How can i check this? --[[User:Requilence|Requilence]] 19:52, 20 March 2011 (UTC)<br />
<br />
:::Just decrypt the activation ticket and check the tables. All the information is given in the wiki, you just have to piece it together on your own.--[[User:Dogbert|Dogbert]] 22:20, 20 March 2011 (UTC)</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Talk:WildcardTicket&diff=16934Talk:WildcardTicket2011-03-20T16:43:23Z<p>Dogbert: </p>
<hr />
<div>Theoretically, can't we just edit the .plist? and make it into the factory unlocked IMSI Mask? -- {{unsigned|Leobruh|5:32, 19 August 2010 (UTC)}}<br />
<br />
:The activation plist is signed, so to do this you require a jailbreak anyway. --[[User:Lilstevie|Lilstevie]] 09:45, 20 August 2010 (UTC)- lilstevie<br />
<br />
i realize that. but wouldnt this result in a permanent unlock? [[User:Leobruh|Leobruh]] 07:37, 19 August 2010 (UTC)!<br />
<br />
I'm guessing the ticket is handled by the baseband, which requires an exploit to get unsigned code running in the first place? [[User:Iemit737|Iemit737]] 07:41, 19 August 2010 (UTC)<br />
<br />
The wildcard ticket is also signed - simple edits break the signature and the ticket gets rejected then. rtfm cryptography 101. [[User:dogbert|dogbert]] 16:02, 19 August 2010 (UTC)<br />
<br />
kay but unsigned code already runs when the phone is jailbroken and has access to the filesystem. wouldnt editing the .plist be okay since the sig checks arent needed. again this is all theoretical. im jw [[User:Leobruh|Leobruh]] 18:33, 19 August 2010 (UTC)!<br />
<br />
The baseband processor checks the signature, not the application processor. [[User:dogbert|dogbert]] 18:36, 19 August 2010 (UTC)<br />
<br />
ahh got ya! but would my theory work though through an exploit such as AT+XAPP? instead of a payload it just changes the .plist? [[User:Leobruh|Leobruh]] 00:15, 20 August 2010 (UTC)!<br />
<br />
:you would still require the valid NCK for it to process the unlock in that method, the current way the payloads work for exploits in the baseband processor are adequate --[[User:Lilstevie|Lilstevie]] 09:44, 20 August 2010 (UTC)<br />
<br />
:i thought NKC was only for the iPhone 2G? 0.o [[User:Leobruh|Leobruh]] 14:47, 21 August 2010 (UTC)!<br />
::NCK or Network Code Key is on any cellular device that gets locked to a carrier --[[User:Lilstevie|Lilstevie]] 14:52, 19 September 2010 (UTC)<br />
<br />
Is there are ability to decode WildcardTicket received from Apple to see NCK or lockstate table?<br />
What about unlocked by request to carrier iPhones? Is it some differences in WildcardTicket? --[[User:Requilence|Requilence]] 13:17, 20 March 2011 (UTC)<br />
<br />
:Decrypting is possible since the key is known. Changing the ticket is, however, not possible since it breaks the signatures. For carrier unlocked phones, Apple sends a new WildcardTicket without a lock table during sync.--[[User:Dogbert|Dogbert]] 16:43, 20 March 2011 (UTC)</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Talk:WildcardTicket&diff=16933Talk:WildcardTicket2011-03-20T16:43:05Z<p>Dogbert: </p>
<hr />
<div>Theoretically, can't we just edit the .plist? and make it into the factory unlocked IMSI Mask? -- {{unsigned|Leobruh|5:32, 19 August 2010 (UTC)}}<br />
<br />
:The activation plist is signed, so to do this you require a jailbreak anyway. --[[User:Lilstevie|Lilstevie]] 09:45, 20 August 2010 (UTC)- lilstevie<br />
<br />
i realize that. but wouldnt this result in a permanent unlock? [[User:Leobruh|Leobruh]] 07:37, 19 August 2010 (UTC)!<br />
<br />
I'm guessing the ticket is handled by the baseband, which requires an exploit to get unsigned code running in the first place? [[User:Iemit737|Iemit737]] 07:41, 19 August 2010 (UTC)<br />
<br />
The wildcard ticket is also signed - simple edits break the signature and the ticket gets rejected then. rtfm cryptography 101. [[User:dogbert|dogbert]] 16:02, 19 August 2010 (UTC)<br />
<br />
kay but unsigned code already runs when the phone is jailbroken and has access to the filesystem. wouldnt editing the .plist be okay since the sig checks arent needed. again this is all theoretical. im jw [[User:Leobruh|Leobruh]] 18:33, 19 August 2010 (UTC)!<br />
<br />
The baseband processor checks the signature, not the application processor. [[User:dogbert|dogbert]] 18:36, 19 August 2010 (UTC)<br />
<br />
ahh got ya! but would my theory work though through an exploit such as AT+XAPP? instead of a payload it just changes the .plist? [[User:Leobruh|Leobruh]] 00:15, 20 August 2010 (UTC)!<br />
<br />
:you would still require the valid NCK for it to process the unlock in that method, the current way the payloads work for exploits in the baseband processor are adequate --[[User:Lilstevie|Lilstevie]] 09:44, 20 August 2010 (UTC)<br />
<br />
:i thought NKC was only for the iPhone 2G? 0.o [[User:Leobruh|Leobruh]] 14:47, 21 August 2010 (UTC)!<br />
::NCK or Network Code Key is on any cellular device that gets locked to a carrier --[[User:Lilstevie|Lilstevie]] 14:52, 19 September 2010 (UTC)<br />
<br />
Is there are ability to decode WildcardTicket received from Apple to see NCK or lockstate table?<br />
What about unlocked by request to carrier iPhones? Is it some differences in WildcardTicket? --[[User:Requilence|Requilence]] 13:17, 20 March 2011 (UTC)<br />
<br />
:Decrypting is possible since the key is known. Changing the ticket is, however, not possible since it breaks the signatures. For carrier unlocked phones, Apple sends a new WildcardTicket without a lock table during sync.<br />
--[[User:Dogbert|Dogbert]] 16:43, 20 March 2011 (UTC)</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=WildcardTicket&diff=16926WildcardTicket2011-03-20T03:28:37Z<p>Dogbert: /* Ticket Layout */</p>
<hr />
<div>The wildcard ticket is used for activating the baseband. It is stored in the file "/var/root/Library/Lockdown/activation_records/wildcard_record.plist". When activating an iPhone, the ticket is pulled from Apple's server and stored on the device. It contains all the information about sim-/netlocks. Factory- and carrier-unlocked devices receive a wildcard ticket with policies that permit all SIM cards.<br />
<br />
==Ticket Layout==<br />
0x0 Version number (=2 for iPhone 3G, 3GS)<br />
0x4 Encrypted Ticket<br />
<br />
The ticket is decrypted with [[TEA]] in [[CBC mode]] using a key hashed from the [[NORID]], [[CHIPID]], [[wikipedia:IMEI|IMEI]] and a [[wikipedia:Salt (cryptography)|salt]]. The layout of the decrypted ticket looks like this:<br />
<br />
0x000 Certificate Length (in bits)<br />
0x004 Certificate Serial (usually 1)<br />
0x008 Public Key Length (in bits)<br />
0x00c Public Key Exponent<br />
0x010-0x090 Public Key (RSA Key 3)<br />
0x090-0x110 Montgomery Reduction<br />
0x110-0x190 Certificate of the first 0x110 bytes signed with rsa_key2<br />
0x190-0x19B [[wikipedia:ICCID|ICCID]] mask (relevant bits for simlock)<br />
0x19C-0x1A3 [[wikipedia:IMEI|IMEI]]<br />
0x1A4-0x1B7 [[Baseband TEA Keys#Hardware Thumbprint Generation|Hash of several hardware IDs]] ([[wikipedia:IMEI|IMEI]], [[NORID]], [[CHIPID]])<br />
0x1B8-... Table of "policies" (netlock)<br />
<br />
Attached to the decrypted ticket is a certificate (0x80 byte) signed with the [[Baseband RSA Keys|RSA key 3]] at 0x010.<br />
<br />
==Policy Table Layout==<br />
0x0 Total length of the policy table in bytes<br />
<Policy Item><br />
<br />
An item is 12 byte in size and has this structure:<br />
0x0-0x2 ID<br />
0x2-0x4 type?<br />
0x4-0xC [[wikipedia:IMSI|IMSI]] mask<br />
<br />
Each [[wikipedia:nibble|nibble]] of a mask corresponds to a number - the wildcard is encoded as 0xE.<br />
<br />
===AT&T USA===<br />
IMSI Mask<br />
310150?????????<br />
310170?????????<br />
310410?????????<br />
311180?????????<br />
310980?????????<br />
This is an iPhone 3GS from [[wikipedia:List of mobile network codes in the United States|AT&T]].<br />
<br />
===T-Mobile Germany===<br />
IMSI Mask<br />
26201??????????<br />
26201??????????<br />
26201??????????<br />
This is an iPhone 3G from [[wikipedia:Mobile_network_code#G|T-Mobile Germany]].<br />
<br />
===Factory Unlocked Device===<br />
IMSI Mask<br />
???????????????<br />
Obligatory.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation&diff=16901Activation2011-03-18T20:32:44Z<p>Dogbert: </p>
<hr />
<div>[[Image:foto.jpg|thumb|right|iPhone with 1 signal bar and damaged [[hacktivation]] or it doesn't have an internet connection|100px]]<br />
<br />
Activation is the process by which a new (or newly restored) iPhone or iPod touch can get by the "Emergency Call Screen" ([[iPhone]]) or "Connect to iTunes" screen (not to be confused with [[Recovery Mode]]; the activation screen has a battery icon in the top right corner to indicate this) to access the SpringBoard.<br />
The code in charge of this resides in [[lockdownd]], which is always running on [[iOS]] and monitors the activation status of the device. Lockdownd patches (which requires a [[jailbreak]] whereby a patched kernel can be booted by [[iBoot]] without dynamic libraries dynamically patching in RAM) activate your phone and obviate the need to activate legitimately through [[iTunes]] with an official carrier however the iPhone cannot be used to communicate unless a [[unlock]] is found for the [[baseband]]. Lockdownd patches are only used on the [[iPhone]] as the [[iPod touch]] has never been denied activation regardless of firmware, country etc.<br />
<br />
Activation is handled by https://albert.apple.com/WebObjects/ALActivation.woa/wa/deviceActivation<br />
<br />
[[iTunes]] uses AMDeviceCopyValue on ActivationInfo to generate an [[Activation Token]] and sends it to Apple's activation server. Once the phone number provided in the [[Activation Token]] can be matched with the data in the [[Activation Token]], the server will generate a [[WildcardTicket]] and signs it with Apple's private key. [[iTunes]] then calls AMDeviceActivate with the [[WildcardTicket]]; The device gets the [[WildcardTicket]] and checks if the signature matches. If it does, it get pasts the emergency call screen and allowing the use of the iPhone. All devices actually go through this process. The activation process is outlined in detail in US patent no. [http://www.freepatentsonline.com/20090061934.pdf 2009/0061934].<br />
<br />
Although the [[iPod touch]] can be 'activated' without an internet connection, some services such as YouTube and Push Notifications will fail to work due to not having a valid authentication token ([http://support.apple.com/kb/TS3305 iPad and iPod touch: Unable to use YouTube or Push notifications]) so connecting to iTunes will activate the [[iPod Touch]] fully.<br />
<br />
The [[iPhone]] needs a cellular data connection for the first time, after the activation in [[iTunes]]. You can make calls if an alert says "iPhone is activated". If you don't have a cellular data connection (3G, EDGE, GPRS) you won't be able to make calls and you have only 1 bar of reception. If you only have 1 bar and no carrier at the status bar, it isn't activated correctly.<br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
* [http://www.freepatentsonline.com/20090061934.pdf Apple Patent]<br />
<br />
{{stub|iPhone}}<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=16900Activation Token2011-03-18T18:29:25Z<p>Dogbert: </p>
<hr />
<div>==Layout Activation Token==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded cert in DER format)<br />
</data><br />
<key>FairPlaySignature</key><br />
<data><br />
(base64-encoded signature (SHA1+RSA) of ActivationInfoXML)<br />
</data><br />
</dict><br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>(GUID)</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>Unactivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(Hash of hardware IDs)<string><br />
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key><br />
<string>(Hash of hardware IDs not directly used as a key - the TEA key can be derived from this)<string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>(String ENUM "iPhone", "iPod", "iPod touch", "iPad")</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>(ICCID as base-10 string)</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>(IMEI as base-10 string)</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>(IMSI as base-10 string)</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>(String like "+1 (555) 555-5555")</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<string>SIMGID1</string><br />
<data><br />
(base64-encoded binary GID1)<br />
</data><br />
<string>SIMGID2</string><br />
<data><br />
(base64-encoded binary GID2)<br />
</data><br />
<key>SIMStatus</key><br />
<string>(ENUM kCTSIMSupportSIMStatusReady kCTSIMSupportSIMStatusNotReady kCTSIMSupportSIMStatusOperatorLocked)</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>(hex UUID)</string><br />
</dict><br />
</plist><br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=16898Activation Token2011-03-18T18:18:26Z<p>Dogbert: /* Layout ActivationInfo */</p>
<hr />
<div>==Layout Activation Token==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded cert in DER format)<br />
</data><br />
<key>FairPlaySignature</key><br />
<data><br />
(base64-encoded signature (SHA1+RSA) of ActivationInfoXML)<br />
</data><br />
</dict><br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>(GUID)</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>Unactivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(Hash of hardware IDs not directly used as a key)<string><br />
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key><br />
<string>(TEA key)</string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>(String ENUM "iPhone", "iPod", "iPod touch", "iPad")</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>(ICCID as base-10 string)</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>(IMEI as base-10 string)</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>(IMSI as base-10 string)</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>(String like "+1 (555) 555-5555")</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<string>SIMGID1</string><br />
<data><br />
(base64-encoded binary GID1)<br />
</data><br />
<string>SIMGID2</string><br />
<data><br />
(base64-encoded binary GID2)<br />
</data><br />
<key>SIMStatus</key><br />
<string>(ENUM kCTSIMSupportSIMStatusReady kCTSIMSupportSIMStatusNotReady kCTSIMSupportSIMStatusOperatorLocked)</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>(hex UUID)</string><br />
</dict><br />
</plist><br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=16897Activation Token2011-03-18T18:18:00Z<p>Dogbert: /* Layout ActivationInfo */</p>
<hr />
<div>==Layout Activation Token==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded cert in DER format)<br />
</data><br />
<key>FairPlaySignature</key><br />
<data><br />
(base64-encoded signature (SHA1+RSA) of ActivationInfoXML)<br />
</data><br />
</dict><br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>(GUID)</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>Unactivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(TEA key)</string><br />
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key><br />
<string>(Hash of hardware IDs not directly used as a key)<string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>(String ENUM "iPhone", "iPod", "iPod touch", "iPad")</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>(ICCID as base-10 string)</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>(IMEI as base-10 string)</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>(IMSI as base-10 string)</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>(String like "+1 (555) 555-5555")</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<string>SIMGID1</string><br />
<data><br />
(base64-encoded binary GID1)<br />
</data><br />
<string>SIMGID2</string><br />
<data><br />
(base64-encoded binary GID2)<br />
</data><br />
<key>SIMStatus</key><br />
<string>(ENUM kCTSIMSupportSIMStatusReady kCTSIMSupportSIMStatusNotReady kCTSIMSupportSIMStatusOperatorLocked)</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>(hex UUID)</string><br />
</dict><br />
</plist><br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Baseband_TEA_Keys&diff=16896Baseband TEA Keys2011-03-18T18:14:32Z<p>Dogbert: /* Key A Generation */</p>
<hr />
<div>The baseband generates [[wikipedia:Tiny Encryption Algorithm|TEA]] keys based of the [[CHIPID]] and [[NORID]].<br />
<br />
==Key A Generation==<br />
//return unique phone key (key A), this key is used for security zone encryption/decryption<br />
void get_keyA(u8 *A){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,[[NORID|dep1_norid]],0x10);<br />
SHA1Input(&ctx,[[CHIPID|dep2_chipid]],0x10);<br />
SHA1Result(&ctx);<br />
memcpy(A,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==NCK Key Generation==<br />
//ulc_mix_lock_unlock_key((u8*)A,(u8*)ctx.Message_Digest,dep1_norid,dep2_chipid,(u8*)B);<br />
void ulc_mix_lock_unlock_key(u8 *keyA, u8 *keyNCK,u8 *norid,u8 *chipid,u8 *keyB){<br />
u8 out_iv[8];<br />
tea_3_round_encipher(norid,keyNCK,keyA,keyB,out_iv); //norid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
tea_3_round_encipher(chipid,keyNCK,out_iv,keyB+8,out_iv); //chipid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
}<br />
// auxilary function for nck key generation<br />
void tea_3_round_encipher(u8 *in,u8 *key,u8 *iv,u8 *out,u8 *out_iv){<br />
u32 tmpin[2],nexttea[2];<br />
tea_encipher((u32*)in,tmpin,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)iv)[0];<br />
nexttea[1] = tmpin[1]^((u32*)iv)[1];<br />
tea_encipher(nexttea,(u32*)out,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)out)[0];<br />
nexttea[1] = tmpin[1]^((u32*)out)[1];<br />
tea_encipher(nexttea,(u32*)out_iv,(u32*)key);<br />
}<br />
<br />
==Hardware Thumbprint Generation==<br />
u8 salt[20] = { 0x03, 0x5E, 0x20, 0x03, 0xA9, 0x74, 0xFC, 0x57, <br />
0xBB, 0x2D, 0x59, 0x28, 0xBF, 0x10, 0xAE, 0xB9, <br />
0x00, 0x00, 0x00, 0x00<br />
} ;<br />
<br />
void getHardwareThumbPrint(u8 *hwTP){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,[[CHIPID|chipid]],16);<br />
SHA1Input(&ctx,[[NORID|norid]],16);<br />
SHA1Input(&ctx,imei,16); //nibble encoded<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(hwTP,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==[[Wildcard Ticket]] Key Generation==<br />
void getWildcardKey(u8 *wKey){<br />
u8 hwTP[20];<br />
getHardwareThumbPrint(&hwTP);<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,hwTP,20);<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(wKey,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
The generates the key which can be used to encrypt/decrypt the wildcard ticket - the chipID/norID are NOT required.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Baseband_TEA_Keys&diff=16895Baseband TEA Keys2011-03-18T18:13:47Z<p>Dogbert: /* Hardware Thumbprint Generation */</p>
<hr />
<div>The baseband generates [[wikipedia:Tiny Encryption Algorithm|TEA]] keys based of the [[CHIPID]] and [[NORID]].<br />
<br />
==Key A Generation==<br />
//return unique phone key (key A), this key is used for security zone encryption/decryption<br />
void get_keyA(u8 *A){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,dep1_norid,0x10);<br />
SHA1Input(&ctx,dep2_chipid,0x10);<br />
SHA1Result(&ctx);<br />
memcpy(A,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==NCK Key Generation==<br />
//ulc_mix_lock_unlock_key((u8*)A,(u8*)ctx.Message_Digest,dep1_norid,dep2_chipid,(u8*)B);<br />
void ulc_mix_lock_unlock_key(u8 *keyA, u8 *keyNCK,u8 *norid,u8 *chipid,u8 *keyB){<br />
u8 out_iv[8];<br />
tea_3_round_encipher(norid,keyNCK,keyA,keyB,out_iv); //norid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
tea_3_round_encipher(chipid,keyNCK,out_iv,keyB+8,out_iv); //chipid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
}<br />
// auxilary function for nck key generation<br />
void tea_3_round_encipher(u8 *in,u8 *key,u8 *iv,u8 *out,u8 *out_iv){<br />
u32 tmpin[2],nexttea[2];<br />
tea_encipher((u32*)in,tmpin,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)iv)[0];<br />
nexttea[1] = tmpin[1]^((u32*)iv)[1];<br />
tea_encipher(nexttea,(u32*)out,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)out)[0];<br />
nexttea[1] = tmpin[1]^((u32*)out)[1];<br />
tea_encipher(nexttea,(u32*)out_iv,(u32*)key);<br />
}<br />
<br />
==Hardware Thumbprint Generation==<br />
u8 salt[20] = { 0x03, 0x5E, 0x20, 0x03, 0xA9, 0x74, 0xFC, 0x57, <br />
0xBB, 0x2D, 0x59, 0x28, 0xBF, 0x10, 0xAE, 0xB9, <br />
0x00, 0x00, 0x00, 0x00<br />
} ;<br />
<br />
void getHardwareThumbPrint(u8 *hwTP){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,[[CHIPID|chipid]],16);<br />
SHA1Input(&ctx,[[NORID|norid]],16);<br />
SHA1Input(&ctx,imei,16); //nibble encoded<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(hwTP,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==[[Wildcard Ticket]] Key Generation==<br />
void getWildcardKey(u8 *wKey){<br />
u8 hwTP[20];<br />
getHardwareThumbPrint(&hwTP);<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,hwTP,20);<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(wKey,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
The generates the key which can be used to encrypt/decrypt the wildcard ticket - the chipID/norID are NOT required.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=CHIPID&diff=16894CHIPID2011-03-18T18:12:18Z<p>Dogbert: </p>
<hr />
<div>Each iPhone baseband has a unique CHIPID that is embedded in the iPhone baseband chip and unique to each phone. Its size is 96 bit (zero-padded to 128 bit).<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=NORID&diff=16893NORID2011-03-18T18:11:10Z<p>Dogbert: </p>
<hr />
<div>This is the hardware chip ID of the baseband [[wikipedia:Flash memory#NOR flash|NOR memory]] which contains both the [[Baseband Bootloader]] and [[Baseband Firmware|Firmware]]. Its size is 64 bit for the iPhone 3G baseband and 128 bit for the iPhone 3GS baseband. It's supposedly read-only data that has been burned in during production, e.g. it cannot be changed. The term NOR comes from [[wikipedia:NOR gate|"Not OR" gates]], which are used to create the flash memory.<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=User:Dogbert&diff=16892User:Dogbert2011-03-18T17:55:57Z<p>Dogbert: </p>
<hr />
<div>out, out!! you demons of stupidity!!<br />
<br />
[[Special:Emailuser/Dogbert|email]] <br />
<br />
[http://dogber1.blogspot.com blag]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=User:Dogbert&diff=16891User:Dogbert2011-03-18T17:54:34Z<p>Dogbert: </p>
<hr />
<div>out, out!! you demons of stupidity!!<br />
<br />
[[Special:Emailuser/Dogbert|Email]] [[http://dogber1.blogspot.com|Blag]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Talk:Baseband_RSA_Keys&diff=16890Talk:Baseband RSA Keys2011-03-18T17:45:36Z<p>Dogbert: </p>
<hr />
<div>[[User:Paul0]] suggested this factorization for rsa_key3:<br />
<br />
(not prime) f2 = <br />
24 95 0d 4a 72 24 f5 6a 15 5f 6f 58 e3 3b f9 92 <br />
c5 fb 21 5c bb 9d a3 8a 63 62 1c 91 90 89 f0 4a <br />
10 2e c8 86 17 78 13 0f a7 fd 73 31 aa f0 8c a3 <br />
63 88 e9 4d 51 d6 db cf 80 4e 6d df 12 f9 20 ab <br />
f9 d3 4a 17 b1 77 76 6c 9a fa 4a 62 5a dc b1 5e <br />
98 d3 3f 6e fa 24 ce ae ba 08 8c d8 c3 8c 1a ad <br />
e2 c2 bc cd c3 04 05 59 92 00 7d 8e 06 20 e5 de <br />
2f 11 f6 e0 7<br />
<br />
(not prime) f1 = <br />
20 f1 89 de ed 41 e6 df eb ea 2c 19 38 47 3b 29 <br />
25 bb 00 af 02 32 bd f5 52 31 de b9<br />
<br />
* Key3 = f1*f2. Please verify, thanks. yafu might be buggy<br />
<br />
However, <br />
rsa_key3 = 112548145501143413877572720967635429059624128941235286814653432534119379263401954209730336088182279431822189480697279769933562374916693852799260561441848037943828221394563114427090483520789586156157496772821757538234969441211075232799607401426252155694386013902169784000266031008270047603255802707293989133031<br />
<br />
f2 = 17876955317115447381157919886144538387308441247085257635572171826794253277256372460463477770098763696910986285378300627539600204950194621383554975965324631149532355710525801309465604474665765254953825047369078348205584002973869012758851553079758612258254980441408089061867729556772<br />
<br />
f1 = 19574178722326421301599573536448352386098089397337991030176983150880<br />
<br />
f1*f2 = 349926718388261371569022220378917782692194588648747109479039236183507739374218762137974554503090374018744169165998671825504162527118702221137070525632386140758758095389408367984136132994861553048641125678600013365524850972617693473037042850155943617530837212223950368442328698913412086039290071192126386225277883345300427209227825789909214401759360<br />
<br />
-> f1*f2 != rsa_key3 - the factorization is invalid. Moreover, f1 and f2 are even numbers and not prime. I suspect some confusion with the endianness of the hex key.<br />
<br />
--[[User:Dogbert|Dogbert]] 17:12, 18 March 2011 (UTC)</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Baseband_RSA_Keys&diff=16889Baseband RSA Keys2011-03-18T17:45:04Z<p>Dogbert: fix endianness</p>
<hr />
<div>These are the keys shared between the [[S-Gold 2]] and the [[X-Gold 608]]<br />
<br />
==Key 1==<br />
This is used to validate the NCK token and decrypt secpack certificates.<br />
<br />
Modulus length 0x400 bits, Exponent 0x3<br />
0B 23 AE BA E3 75 7B 9D CE 44 58 8C CF 53 CC B0<br />
73 F9 06 57 64 37 A0 6C 68 F4 91 4E 7A 82 CB 6E<br />
12 CF FD 31 39 51 4C 06 C0 E9 CE A0 27 17 D6 95<br />
FB DF 94 26 B2 1C C1 73 24 06 E3 A8 C2 0F 5D A3<br />
41 6B D8 84 CB D0 EB 2E F9 DE 2F 21 78 DA C3 4D<br />
AF B9 BA D8 4B 7C 16 E2 CF 16 7A 1B 57 33 4F 26<br />
4D 53 26 FD 8E 38 B6 23 CE 5E B4 81 80 2B C0 FB<br />
9F 33 E1 3F 65 A2 49 C9 3F 08 6C 37 61 4B B7 C7<br />
<br />
==Key 2==<br />
This is used to sign Key 3 in the [[WildcardTicket|wildcard ticket]] that is part of the [[activation token]].<br />
<br />
Modulus length 0x400 bits, Exponent 0x3<br />
05 BC 9F 4E 87 0C F9 A2 D8 DA 19 D8 14 82 B2 54<br />
3F 32 4D 08 0B AE 22 01 86 43 A1 0E 18 7A D1 F2<br />
4F CB 34 C6 10 C2 72 DB E3 B5 29 79 B2 80 34 E1<br />
4F A4 27 85 C5 04 57 4A 37 88 AD 9A 6B 57 C5 E0<br />
4F E5 89 80 1E ED AC 72 78 B1 73 05 FC 5E D1 3D<br />
46 9F 66 C4 B5 B4 4B 9E 87 8C 2E 3C BD 0C 15 AA<br />
D1 D5 57 71 00 D6 10 F7 96 E2 CF AC 60 53 57 C7<br />
65 AD 1D CB BC 5F 49 FD B5 ED EA B3 21 30 66 EA<br />
<br />
==Key 3==<br />
This is used for signing in the [[WildcardTicket|wildcard ticket]]. The serial number is 1.<br />
<br />
Modulus length 0x400 bits, Exponent 0x3<br />
e7 5a 52 4b 14 94 fd 09 c6 6e d9 3f cc ce c8 88 <br />
89 43 b7 6e 8b b2 d9 05 b4 3d 58 a5 31 c3 19 cc <br />
11 e7 09 ff b4 be 26 2e 82 20 62 76 d5 96 ed 76 <br />
b7 10 77 22 64 09 ef 6d b8 cc 2c fb 5d 68 5b d1 <br />
a3 64 15 61 6c 3d df 32 04 2c 8e 7d 15 6d 9f e0 <br />
68 9a 5e 9e c8 67 d6 c2 c3 03 65 fd 4b b8 49 ab <br />
ca c4 f5 94 9d 4b 91 53 2b 68 be 7b 68 56 95 92 <br />
3a 8e 89 fa 77 76 38 17 b0 90 0f df f3 1c 46 a0 <br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Talk:Baseband_RSA_Keys&diff=16888Talk:Baseband RSA Keys2011-03-18T17:20:24Z<p>Dogbert: </p>
<hr />
<div>[[User:Paul0]] suggested this factorization for rsa_key3:<br />
<br />
(not prime) f2 = <br />
24 95 0d 4a 72 24 f5 6a 15 5f 6f 58 e3 3b f9 92 <br />
c5 fb 21 5c bb 9d a3 8a 63 62 1c 91 90 89 f0 4a <br />
10 2e c8 86 17 78 13 0f a7 fd 73 31 aa f0 8c a3 <br />
63 88 e9 4d 51 d6 db cf 80 4e 6d df 12 f9 20 ab <br />
f9 d3 4a 17 b1 77 76 6c 9a fa 4a 62 5a dc b1 5e <br />
98 d3 3f 6e fa 24 ce ae ba 08 8c d8 c3 8c 1a ad <br />
e2 c2 bc cd c3 04 05 59 92 00 7d 8e 06 20 e5 de <br />
2f 11 f6 e0 7<br />
<br />
(not prime) f1 = <br />
20 f1 89 de ed 41 e6 df eb ea 2c 19 38 47 3b 29 <br />
25 bb 00 af 02 32 bd f5 52 31 de b9<br />
<br />
* Key3 = f1*f2. Please verify, thanks. yafu might be buggy<br />
<br />
However, <br />
rsa_key3 = 3723831821883702670678201674717918174629677902801569278439133496127413091410975376899192815194880111741267989023834018905027460993096578420421399938130915013991830265235766488560948787045449571744218241649175170290402111788993338128284057787949145302879517838138041196804337537028831470042894492396009634808062527953671468669060509014833090941515<br />
<br />
f2 = 17876955317115447381157919886144538387308441247085257635572171826794253277256372460463477770098763696910986285378300627539600204950194621383554975965324631149532355710525801309465604474665765254953825047369078348205584002973869012758851553079758612258254980441408089061867729556772<br />
<br />
f1 = 19574178722326421301599573536448352386098089397337991030176983150880<br />
<br />
f1*f2 = 349926718388261371569022220378917782692194588648747109479039236183507739374218762137974554503090374018744169165998671825504162527118702221137070525632386140758758095389408367984136132994861553048641125678600013365524850972617693473037042850155943617530837212223950368442328698913412086039290071192126386225277883345300427209227825789909214401759360<br />
<br />
-> f1*f2 != rsa_key3 - the factorization is invalid. Moreover, f1 and f2 are even numbers and not prime. I suspect some confusion with the endianness of the hex key.<br />
<br />
--[[User:Dogbert|Dogbert]] 17:12, 18 March 2011 (UTC)</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Talk:Baseband_RSA_Keys&diff=16887Talk:Baseband RSA Keys2011-03-18T17:19:01Z<p>Dogbert: </p>
<hr />
<div>[[User:Paul0]] suggested this factorization for rsa_key3:<br />
<br />
(not prime) f2 = <br />
24 95 0d 4a 72 24 f5 6a 15 5f 6f 58 e3 3b f9 92 <br />
c5 fb 21 5c bb 9d a3 8a 63 62 1c 91 90 89 f0 4a <br />
10 2e c8 86 17 78 13 0f a7 fd 73 31 aa f0 8c a3 <br />
63 88 e9 4d 51 d6 db cf 80 4e 6d df 12 f9 20 ab <br />
f9 d3 4a 17 b1 77 76 6c 9a fa 4a 62 5a dc b1 5e <br />
98 d3 3f 6e fa 24 ce ae ba 08 8c d8 c3 8c 1a ad <br />
e2 c2 bc cd c3 04 05 59 92 00 7d 8e 06 20 e5 de <br />
2f 11 f6 e0 7<br />
<br />
(not prime) f1 = <br />
20 f1 89 de ed 41 e6 df eb ea 2c 19 38 47 3b 29 <br />
25 bb 00 af 02 32 bd f5 52 31 de b9<br />
<br />
* Key3 = f1*f2. Please verify, thanks. yafu might be buggy<br />
<br />
However, <br />
rsa_key3 = 3723831821883702670678201674717918174629677902801569278439133496127413091410975376899192815194880111741267989023834018905027460993096578420421399938130915013991830265235766488560948787045449571744218241649175170290402111788993338128284057787949145302879517838138041196804337537028831470042894492396009634808062527953671468669060509014833090941515<br />
<br />
f2 = 17876955317115447381157919886144538387308441247085257635572171826794253277256372460463477770098763696910986285378300627539600204950194621383554975965324631149532355710525801309465604474665765254953825047369078348205584002973869012758851553079758612258254980441408089061867729556772<br />
<br />
f1 = 19574178722326421301599573536448352386098089397337991030176983150880<br />
<br />
f1*f2 = 349926718388261371569022220378917782692194588648747109479039236183507739374218762137974554503090374018744169165998671825504162527118702221137070525632386140758758095389408367984136132994861553048641125678600013365524850972617693473037042850155943617530837212223950368442328698913412086039290071192126386225277883345300427209227825789909214401759360<br />
<br />
-> f1*f2 != rsa_key3 - the factorization is invalid.<br />
<br />
--[[User:Dogbert|Dogbert]] 17:12, 18 March 2011 (UTC)</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Talk:Baseband_RSA_Keys&diff=16886Talk:Baseband RSA Keys2011-03-18T17:12:40Z<p>Dogbert: </p>
<hr />
<div>[[User:Paul0]] suggested this factorization for rsa_key3:<br />
<br />
(not prime) f2 = <br />
24 95 0d 4a 72 24 f5 6a 15 5f 6f 58 e3 3b f9 92 <br />
c5 fb 21 5c bb 9d a3 8a 63 62 1c 91 90 89 f0 4a <br />
10 2e c8 86 17 78 13 0f a7 fd 73 31 aa f0 8c a3 <br />
63 88 e9 4d 51 d6 db cf 80 4e 6d df 12 f9 20 ab <br />
f9 d3 4a 17 b1 77 76 6c 9a fa 4a 62 5a dc b1 5e <br />
98 d3 3f 6e fa 24 ce ae ba 08 8c d8 c3 8c 1a ad <br />
e2 c2 bc cd c3 04 05 59 92 00 7d 8e 06 20 e5 de <br />
2f 11 f6 e0 7<br />
<br />
(not prime) f1 = <br />
20 f1 89 de ed 41 e6 df eb ea 2c 19 38 47 3b 29 <br />
25 bb 00 af 02 32 bd f5 52 31 de b9<br />
<br />
* Key3 = f1*f2. Please verify, thanks. yafu might be buggy<br />
<br />
However, <br />
rsa_key3 = 3723831821883702670678201674717918174629677902801569278439133496127413091410975376899192815194880111741267989023834018905027460993096578420421399938130915013991830265235766488560948787045449571744218241649175170290402111788993338128284057787949145302879517838138041196804337537028831470042894492396009634808062527953671468669060509014833090941515<br />
<br />
f1 = 17876955317115447381157919886144538387308441247085257635572171826794253277256372460463477770098763696910986285378300627539600204950194621383554975965324631149532355710525801309465604474665765254953825047369078348205584002973869012758851553079758612258254980441408089061867729556772<br />
<br />
f2 = 19574178722326421301599573536448352386098089397337991030176983150880<br />
<br />
f1*f2 = 349926718388261371569022220378917782692194588648747109479039236183507739374218762137974554503090374018744169165998671825504162527118702221137070525632386140758758095389408367984136132994861553048641125678600013365524850972617693473037042850155943617530837212223950368442328698913412086039290071192126386225277883345300427209227825789909214401759360<br />
<br />
-> f1*f2 != rsa_key3 - the factorization is invalid.<br />
<br />
--[[User:Dogbert|Dogbert]] 17:12, 18 March 2011 (UTC)</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Talk:Baseband_RSA_Keys&diff=16885Talk:Baseband RSA Keys2011-03-18T17:12:22Z<p>Dogbert: New page: User:Paul0 suggested this factorization for rsa_key3: (not prime) f2 = 24 95 0d 4a 72 24 f5 6a 15 5f 6f 58 e3 3b f9 92 c5 fb 21 5c bb 9d a3 8a 63 62 1c 91 90 89 f0 4a 10 2e c8 ...</p>
<hr />
<div>[[User:Paul0]] suggested this factorization for rsa_key3:<br />
<br />
(not prime) f2 = <br />
24 95 0d 4a 72 24 f5 6a 15 5f 6f 58 e3 3b f9 92 <br />
c5 fb 21 5c bb 9d a3 8a 63 62 1c 91 90 89 f0 4a <br />
10 2e c8 86 17 78 13 0f a7 fd 73 31 aa f0 8c a3 <br />
63 88 e9 4d 51 d6 db cf 80 4e 6d df 12 f9 20 ab <br />
f9 d3 4a 17 b1 77 76 6c 9a fa 4a 62 5a dc b1 5e <br />
98 d3 3f 6e fa 24 ce ae ba 08 8c d8 c3 8c 1a ad <br />
e2 c2 bc cd c3 04 05 59 92 00 7d 8e 06 20 e5 de <br />
2f 11 f6 e0 7<br />
<br />
(not prime) f1 = <br />
20 f1 89 de ed 41 e6 df eb ea 2c 19 38 47 3b 29 <br />
25 bb 00 af 02 32 bd f5 52 31 de b9<br />
<br />
* Key3 = f1*f2. Please verify, thanks. yafu might be buggy<br />
<br />
However, <br />
rsa_key3 = 3723831821883702670678201674717918174629677902801569278439133496127413091410975376899192815194880111741267989023834018905027460993096578420421399938130915013991830265235766488560948787045449571744218241649175170290402111788993338128284057787949145302879517838138041196804337537028831470042894492396009634808062527953671468669060509014833090941515<br />
f1 = 17876955317115447381157919886144538387308441247085257635572171826794253277256372460463477770098763696910986285378300627539600204950194621383554975965324631149532355710525801309465604474665765254953825047369078348205584002973869012758851553079758612258254980441408089061867729556772<br />
f2 = 19574178722326421301599573536448352386098089397337991030176983150880<br />
f1*f2 = 349926718388261371569022220378917782692194588648747109479039236183507739374218762137974554503090374018744169165998671825504162527118702221137070525632386140758758095389408367984136132994861553048641125678600013365524850972617693473037042850155943617530837212223950368442328698913412086039290071192126386225277883345300427209227825789909214401759360<br />
<br />
-> f1*f2 != rsa_key3 - the factorization is invalid.<br />
--[[User:Dogbert|Dogbert]] 17:12, 18 March 2011 (UTC)</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Baseband_RSA_Keys&diff=16884Baseband RSA Keys2011-03-18T17:05:33Z<p>Dogbert: /* Key 3 (not semiprime?) */</p>
<hr />
<div>These are the keys shared between the [[S-Gold 2]] and the [[X-Gold 608]]<br />
<br />
==Key 1==<br />
This is used to validate the NCK token and decrypt secpack certificates.<br />
<br />
Modulus length 0x400 bits, Exponent 0x3<br />
0B 23 AE BA E3 75 7B 9D CE 44 58 8C CF 53 CC B0<br />
73 F9 06 57 64 37 A0 6C 68 F4 91 4E 7A 82 CB 6E<br />
12 CF FD 31 39 51 4C 06 C0 E9 CE A0 27 17 D6 95<br />
FB DF 94 26 B2 1C C1 73 24 06 E3 A8 C2 0F 5D A3<br />
41 6B D8 84 CB D0 EB 2E F9 DE 2F 21 78 DA C3 4D<br />
AF B9 BA D8 4B 7C 16 E2 CF 16 7A 1B 57 33 4F 26<br />
4D 53 26 FD 8E 38 B6 23 CE 5E B4 81 80 2B C0 FB<br />
9F 33 E1 3F 65 A2 49 C9 3F 08 6C 37 61 4B B7 C7<br />
<br />
==Key 2==<br />
This is used to sign Key 3 in the [[WildcardTicket|wildcard ticket]] that is part of the [[activation token]].<br />
<br />
Modulus length 0x400 bits, Exponent 0x3<br />
05 BC 9F 4E 87 0C F9 A2 D8 DA 19 D8 14 82 B2 54<br />
3F 32 4D 08 0B AE 22 01 86 43 A1 0E 18 7A D1 F2<br />
4F CB 34 C6 10 C2 72 DB E3 B5 29 79 B2 80 34 E1<br />
4F A4 27 85 C5 04 57 4A 37 88 AD 9A 6B 57 C5 E0<br />
4F E5 89 80 1E ED AC 72 78 B1 73 05 FC 5E D1 3D<br />
46 9F 66 C4 B5 B4 4B 9E 87 8C 2E 3C BD 0C 15 AA<br />
D1 D5 57 71 00 D6 10 F7 96 E2 CF AC 60 53 57 C7<br />
65 AD 1D CB BC 5F 49 FD B5 ED EA B3 21 30 66 EA<br />
<br />
==Key 3==<br />
This is used for signing in the [[WildcardTicket|wildcard ticket]]. The serial number is 1.<br />
<br />
Modulus length 0x400 bits, Exponent 0x3<br />
4b 52 5a e7 09 fd 94 14 3f d9 6e c6 88 c8 ce cc <br />
6e b7 43 89 05 d9 b2 8b a5 58 3d b4 cc 19 c3 31 <br />
ff 09 e7 11 2e 26 be b4 76 62 20 82 76 ed 96 d5 <br />
22 77 10 b7 6d ef 09 64 fb 2c cc b8 d1 5b 68 5d <br />
61 15 64 a3 32 df 3d 6c 7d 8e 2c 04 e0 9f 6d 15 <br />
9e 5e 9a 68 c2 d6 67 c8 fd 65 03 c3 ab 49 b8 4b <br />
94 f5 c4 ca 53 91 4b 9d 7b be 68 2b 92 95 56 68 <br />
fa 89 8e 3a 17 38 76 77 df 0f 90 b0 a0 46 1c f3 <br />
f8 48 dc 32 1b f8 a1 ff 7e 26 56 0e ce 77 95 0f<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Purplesn0w&diff=9242Purplesn0w2010-09-17T20:48:08Z<p>Dogbert: /* How it works */</p>
<hr />
<div>purplesn0w is [[User:geohot|geohot]]'s [[unlock]] which used the [[AT+XLOG Vulnerability]]. Its implementation of the vulnerability differs from [[ultrasn0w]]'s, and requires a legitimately [[Activation|activated]] [[iPhone]]. <br />
<br />
==How it works==<br />
purplesn0w copies the page that needs patching to an unused region of memory. It gets patched in RAM. Using the MMU, the flash page is mapped out and the patched memory page is remapped in its place. No new iPhones are really [[unlock]]ed; [[activation]] creates a [[WildcardTicket|ticket]] allowing the baseband to be used with that SIM. The lockstate of the phone really lies on Apple's servers. Being unlocked means all SIMs are authorized, and being locked means only certain carriers' SIMs are authorized (for instance, AT&T). Fortunately, this ticket system provides an easy way to deliver the payload and re-execute the patched code all in one. And since the ticket is already delivered on baseband resets, there's no need to write another daemon to use the battery. Instead the daemon already designed for this, [[lockdownd]], is used. A patch to CommCenter gets it to run the payload on ticket delivery. And a patch to your activation record contains the payload.<br />
<br />
[[Category:Baseband]]<br />
<br />
==Installation notes==<br />
* Be sure to have a legitimately activated iPhone.<br />
* Disable 3G if you don't have it (like T-Mobile in the US).<br />
* Watch for success output in Cydia (actually do this step)<br />
* Wait for signal, and enjoy your unlocked iPhone (no reboot required)<br />
<br />
==Links==<br />
* Cydia repo (http://apt.geohot.com/)<br />
* [http://apt.geohot.com/purplesn0w_source.zip Source code]<br />
<br />
[[Category:Unlocking Methods]]<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation&diff=8650Activation2010-08-23T05:14:11Z<p>Dogbert: </p>
<hr />
<div>[[Image:foto.jpg|thumb|right|iPhone with 1 signal bar and damaged [[hacktivation]] or it doesn't have an internet connection|100px]]<br />
<br />
Activation is the process by which a new (or newly restored) iPhone can get by the "Emergency Call Screen" to access the SpringBoard. The code in charge of this resides in [[lockdownd]], which is always running on [[iOS]] and monitors the activation status of the device. Lockdownd patches (which require a [[jailbreak]]) activate your phone and obviate the need to activate legitimately through [[iTunes]] with an official carrier.<br />
<br />
Activation is handled by https://albert.apple.com/WebObjects/ALActivation.woa/wa/deviceActivation<br />
<br />
[[iTunes]] uses AMDeviceCopyValue on ActivationInfo to generate an activation ticket with your IMEI, ICCID, and serial number among other things. The ticket gets send to Apple's activation server, and you will receive an [[activation token]], getting you past the emergency call screen and allowing use of the iPhone. All devices actually go through this process; even the [[iPod touch]] is not activated out of the box, but connecting to iTunes will activate the iPod.<br />
<br />
The [[iPhone]] needs a cellular data connection for the first time, after the activation in [[iTunes]]. You can make calls if an alert says "iPhone is activated." If you don't have a cellular data connection (3G, EDGE, GPRS) you won't be able to make calls and you have only 1 bar of reception. If you only have 1 bar and no carrier at the status bar, it isn't activated correctly. Installing [[ultrasn0w]] over Wi-Fi will fix it.<br />
<br />
While the [[iPod touch]] can be unbricked/'activated' without an internet connection, some services such as YouTube and Push Notifications will fail to work due to not having a valid authentication token. ([http://support.apple.com/kb/TS3305 iPad and iPod touch: Unable to use YouTube or Push notifications])<br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=8648Activation Token2010-08-23T05:03:08Z<p>Dogbert: /* Layout Activation Token */</p>
<hr />
<div>[[iTunes]] gets a couple things from the phone: the [[DeviceID]], the [[CHIPID]], the [[wikipedia:IMEI|IMEI]], the [[Wikipedia:ICCID|ICCID]], the [[Wikipedia:IMSI|IMSI]], the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. If the phone number can be matched to the ICCID and IMSI and if the rest of the data is correct, the server appends the [[WildcardTicket]] to the token, signs the token with Apple's private key and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token.<br />
<br />
==Layout Activation Token==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded cert in DER format)<br />
</data><br />
<key>FairPlaySignature</key><br />
<data><br />
(base64-encoded signature probably of ActivationInfoXML)<br />
</data><br />
</dict><br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>...</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>Unactivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(TEA key)</string><br />
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key><br />
<string>(TEA key)string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>iPhone</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>...</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>...</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<string>SIMGID1</string><br />
<data><br />
...<br />
</data><br />
<string>SIMGID2</string><br />
<data><br />
...<br />
</data><br />
<key>SIMStatus</key><br />
<string>kCTSIMSupportSIMStatusReady</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>...</string><br />
</dict><br />
</plist><br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=8632Activation Token2010-08-23T01:44:14Z<p>Dogbert: /* Layout Activation Token */</p>
<hr />
<div>[[iTunes]] gets a couple things from the phone: the [[DeviceID]], the [[CHIPID]], the [[wikipedia:IMEI|IMEI]], the [[Wikipedia:ICCID|ICCID]], the [[Wikipedia:IMSI|IMSI]], the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. If the phone number can be matched to the ICCID and IMSI and if the rest of the data is correct, the server appends the [[WildcardTicket]] to the token, signs the token with Apple's private key and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token.<br />
<br />
==Layout Activation Token==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded DRM cert here)<br />
</data><br />
<key>FairPlaySignature</key><br />
<data><br />
(base64-encoded signature probably of ActivationInfoXML)<br />
</data><br />
</dict><br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>...</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>Unactivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(TEA key)</string><br />
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key><br />
<string>(TEA key)string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>iPhone</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>...</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>...</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<string>SIMGID1</string><br />
<data><br />
...<br />
</data><br />
<string>SIMGID2</string><br />
<data><br />
...<br />
</data><br />
<key>SIMStatus</key><br />
<string>kCTSIMSupportSIMStatusReady</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>...</string><br />
</dict><br />
</plist><br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=8631Activation Token2010-08-23T01:43:58Z<p>Dogbert: /* Layout Activation Token */</p>
<hr />
<div>[[iTunes]] gets a couple things from the phone: the [[DeviceID]], the [[CHIPID]], the [[wikipedia:IMEI|IMEI]], the [[Wikipedia:ICCID|ICCID]], the [[Wikipedia:IMSI|IMSI]], the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. If the phone number can be matched to the ICCID and IMSI and if the rest of the data is correct, the server appends the [[WildcardTicket]] to the token, signs the token with Apple's private key and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token.<br />
<br />
==Layout Activation Token==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded DRM cert here)<br />
</data><br />
<key>FairPlaySignature</key><br />
<data><br />
(base64-encoded signature probably of ActivationInfoXML)<br />
</data><br />
</dict><br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>...</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>Unactivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(TEA key)</string><br />
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key><br />
<string>(TEA key)string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>iPhone</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>...</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>...</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<string>SIMGID1</string><br />
<data><br />
...<br />
</data><br />
<string>SIMGID2</string><br />
<data><br />
...<br />
</data><br />
<key>SIMStatus</key><br />
<string>kCTSIMSupportSIMStatusReady</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>...</string><br />
</dict><br />
</plist><br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=8630Activation Token2010-08-23T01:43:24Z<p>Dogbert: </p>
<hr />
<div>[[iTunes]] gets a couple things from the phone: the [[DeviceID]], the [[CHIPID]], the [[wikipedia:IMEI|IMEI]], the [[Wikipedia:ICCID|ICCID]], the [[Wikipedia:IMSI|IMSI]], the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. If the phone number can be matched to the ICCID and IMSI and if the rest of the data is correct, the server appends the [[WildcardTicket]] to the token, signs the token with Apple's private key and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token.<br />
<br />
==Layout Activation Token==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded DRM cert here)<br />
</data><br />
<key>FairPlaySignature</key><br />
<data><br />
(base64-encoded signature probably of ActivationInfoXML)<br />
</data><br />
</dict><br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>...</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>Unactivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(TEA key)</string><br />
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key><br />
<string>(TEA key)string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>iPhone</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>...</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>...</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<string>SIMGID1</string><br />
<data><br />
...<br />
</data><br />
<string>SIMGID2</string><br />
<data><br />
...<br />
</data><br />
<key>SIMStatus</key><br />
<string>kCTSIMSupportSIMStatusReady</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>...</string><br />
</dict><br />
</plist><br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=8625Activation Token2010-08-22T19:49:20Z<p>Dogbert: </p>
<hr />
<div>[[iTunes]] gets a couple things from the phone: the [[DeviceID]], the [[CHIPID]], the [[wikipedia:IMEI|IMEI]], the [[Wikipedia:ICCID|ICCID]], the [[Wikipedia:IMSI|IMSI]], the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. If the phone number can be matched to the ICCID and IMSI and if the rest of the data is correct, the server appends the [[WildcardTicket]] to the token, signs the token with Apple's private key and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token.<br />
<br />
==Layout Activation Token==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded DRM cert here)<br />
</data><br />
</dict><br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>...</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>Unactivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(TEA key)</string><br />
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key><br />
<string>(TEA key)string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>iPhone</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>...</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>...</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<string>SIMGID1</string><br />
<data><br />
...<br />
</data><br />
<string>SIMGID2</string><br />
<data><br />
...<br />
</data><br />
<key>SIMStatus</key><br />
<string>kCTSIMSupportSIMStatusReady</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>...</string><br />
</dict><br />
</plist><br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=8624Activation Token2010-08-22T19:46:35Z<p>Dogbert: /* Layout ActivationInfo */</p>
<hr />
<div>[[iTunes]] gets a couple things from the phone: the [[DeviceID]], the [[CHIPID]], the [[wikipedia:IMEI|IMEI]], the [[Wikipedia:ICCID|ICCID]], the [[Wikipedia:IMSI|IMSI]], the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. The server appends the [[WildcardTicket]] to the token, signs the token with Apple's private key and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token.<br />
<br />
==Layout Activation Token==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded DRM cert here)<br />
</data><br />
</dict><br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>...</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>Unactivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(TEA key)</string><br />
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key><br />
<string>(TEA key)string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>iPhone</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>...</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>...</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<key>SIMStatus</key><br />
<string>kCTSIMSupportSIMStatusReady</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>...</string><br />
</dict><br />
</plist><br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Wildcard_Ticket&diff=8549Wildcard Ticket2010-08-20T22:14:45Z<p>Dogbert: Redirecting to WildcardTicket</p>
<hr />
<div>#REDIRECT [[WildcardTicket]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=WildcardTicket&diff=8548WildcardTicket2010-08-20T22:07:34Z<p>Dogbert: /* Ticket Layout */</p>
<hr />
<div>The wildcard ticket is used for activating the baseband. It is stored in the file "/var/root/Library/Lockdown/activation_records/wildcard_record.plist". When activating an iPhone, the ticket is pulled from Apple's server and stored on the device. It contains all the information about sim-/netlocks. Factory- and carrier-unlocked devices receive a wildcard ticket with policies that permit all SIM cards.<br />
<br />
==Ticket Layout==<br />
0x0 Version number (=2 for iPhone 3G, 3GS)<br />
0x4 Encrypted Ticket<br />
<br />
The ticket is decrypted with [[TEA]] in [[CBC mode]] using a key hashed from the [[NORID]], [[CHIPID]], [[wikipedia:IMEI|IMEI]] and a [[wikipedia:Salt (cryptography)|salt]]. The layout of the decrypted ticket looks like this:<br />
<br />
0x000 Certificate Length (in bits)<br />
0x004 Certificate Serial (usually 1)<br />
0x008 Public Key Length (in bits)<br />
0x00c Public Key Exponent<br />
0x010-0x090 Public Key (RSA Key 3)<br />
0x090-0x110 Additional Public Key - not in use <br />
0x110-0x190 Certificate of the first 0x110 bytes signed with rsa_key2<br />
0x190-0x19B [[wikipedia:ICCID|ICCID]] mask (relevant bits for simlock)<br />
0x19C-0x1A3 [[wikipedia:IMEI|IMEI]]<br />
0x1A4-0x1B7 [[Baseband TEA Keys#Hardware Thumbprint Generation|Hash of several hardware IDs]] ([[wikipedia:IMEI|IMEI]], [[NORID]], [[CHIPID]])<br />
0x1B8-... Table of "policies" (netlock)<br />
<br />
Attached to the decrypted ticket is a certificate (0x80 byte) signed with the [[Baseband RSA Keys|RSA key 3]] at 0x010.<br />
<br />
==Policy Table Layout==<br />
0x0 Total length of the policy table in bytes<br />
<Policy Item><br />
<br />
An item is 12 byte in size and has this structure:<br />
0x0-0x2 ID<br />
0x2-0x4 type?<br />
0x4-0xC [[wikipedia:IMSI|IMSI]] mask<br />
<br />
Each [[wikipedia:nibble|nibble]] of a mask corresponds to a number - the wildcard is encoded as 0xE.<br />
<br />
===AT&T USA===<br />
IMSI Mask<br />
310150?????????<br />
310170?????????<br />
310410?????????<br />
311180?????????<br />
310980?????????<br />
This is an iPhone 3GS from [[wikipedia:List of mobile network codes in the United States|AT&T]].<br />
<br />
===T-Mobile Germany===<br />
IMSI Mask<br />
26201??????????<br />
26201??????????<br />
26201??????????<br />
This is an iPhone 3G from [[wikipedia:Mobile_network_code#G|T-Mobile Germany]].<br />
<br />
===Factory Unlocked Device===<br />
IMSI Mask<br />
???????????????<br />
Obligatory.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Baseband_TEA_Keys&diff=8547Baseband TEA Keys2010-08-20T22:01:12Z<p>Dogbert: my code sucks.</p>
<hr />
<div>The baseband generates [[wikipedia:Tiny Encryption Algorithm|TEA]] keys based of the [[CHIPID]] and [[NORID]].<br />
<br />
==Key A Generation==<br />
//return unique phone key (key A), this key is used for security zone encryption/decryption<br />
void get_keyA(u8 *A){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,dep1_norid,0x10);<br />
SHA1Input(&ctx,dep2_chipid,0x10);<br />
SHA1Result(&ctx);<br />
memcpy(A,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==NCK Key Generation==<br />
//ulc_mix_lock_unlock_key((u8*)A,(u8*)ctx.Message_Digest,dep1_norid,dep2_chipid,(u8*)B);<br />
void ulc_mix_lock_unlock_key(u8 *keyA, u8 *keyNCK,u8 *norid,u8 *chipid,u8 *keyB){<br />
u8 out_iv[8];<br />
tea_3_round_encipher(norid,keyNCK,keyA,keyB,out_iv); //norid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
tea_3_round_encipher(chipid,keyNCK,out_iv,keyB+8,out_iv); //chipid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
}<br />
// auxilary function for nck key generation<br />
void tea_3_round_encipher(u8 *in,u8 *key,u8 *iv,u8 *out,u8 *out_iv){<br />
u32 tmpin[2],nexttea[2];<br />
tea_encipher((u32*)in,tmpin,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)iv)[0];<br />
nexttea[1] = tmpin[1]^((u32*)iv)[1];<br />
tea_encipher(nexttea,(u32*)out,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)out)[0];<br />
nexttea[1] = tmpin[1]^((u32*)out)[1];<br />
tea_encipher(nexttea,(u32*)out_iv,(u32*)key);<br />
}<br />
<br />
==Hardware Thumbprint Generation==<br />
u8 salt[20] = { 0x03, 0x5E, 0x20, 0x03, 0xA9, 0x74, 0xFC, 0x57, <br />
0xBB, 0x2D, 0x59, 0x28, 0xBF, 0x10, 0xAE, 0xB9, <br />
0x00, 0x00, 0x00, 0x00<br />
} ;<br />
<br />
void getHardwareThumbPrint(u8 *hwTP){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,chipid,16);<br />
SHA1Input(&ctx,norid,16);<br />
SHA1Input(&ctx,imei,16); //nibble encoded<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(hwTP,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==[[Wildcard Ticket]] Key Generation==<br />
void getWildcardKey(u8 *wKey){<br />
u8 hwTP[20];<br />
getHardwareThumbPrint(&hwTP);<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,hwTP,20);<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(wKey,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
The generates the key which can be used to encrypt/decrypt the wildcard ticket - the chipID/norID are NOT required.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=8546Activation Token2010-08-20T21:58:50Z<p>Dogbert: /* Layout ActivationInfo */</p>
<hr />
<div>[[iTunes]] gets a couple things from the phone: the [[DeviceID]], the [[CHIPID]], the [[wikipedia:IMEI|IMEI]], the [[Wikipedia:ICCID|ICCID]], the [[Wikipedia:IMSI|IMSI]], the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. The server appends the [[WildcardTicket]] to the token, signs the token with Apple's private key and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token.<br />
<br />
==Layout Activation Token==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded DRM cert here)<br />
</data><br />
</dict><br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>...</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>WildcardActivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(TEA key)</string><br />
<key>[[Baseband TEA Keys#Hardware Thumbprint Generation|BasebandThumbprint]]</key><br />
<string>(TEA key)string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>iPhone</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>...</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>...</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<key>SIMStatus</key><br />
<string>kCTSIMSupportSIMStatusReady</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>...</string><br />
</dict><br />
</plist><br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Baseband_TEA_Keys&diff=8545Baseband TEA Keys2010-08-20T21:56:58Z<p>Dogbert: /* Wildcard Ticket Key Generation */</p>
<hr />
<div>The baseband generates [[wikipedia:Tiny Encryption Algorithm|TEA]] keys based of the [[CHIPID]] and [[NORID]].<br />
<br />
==Key A Generation==<br />
//return unique phone key (key A), this key is used for security zone encryption/decryption<br />
void get_keyA(u8 *A){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,dep1_norid,0x10);<br />
SHA1Input(&ctx,dep2_chipid,0x10);<br />
SHA1Result(&ctx);<br />
memcpy(A,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==NCK Key Generation==<br />
//ulc_mix_lock_unlock_key((u8*)A,(u8*)ctx.Message_Digest,dep1_norid,dep2_chipid,(u8*)B);<br />
void ulc_mix_lock_unlock_key(u8 *keyA, u8 *keyNCK,u8 *norid,u8 *chipid,u8 *keyB){<br />
u8 out_iv[8];<br />
tea_3_round_encipher(norid,keyNCK,keyA,keyB,out_iv); //norid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
tea_3_round_encipher(chipid,keyNCK,out_iv,keyB+8,out_iv); //chipid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
}<br />
// auxilary function for nck key generation<br />
void tea_3_round_encipher(u8 *in,u8 *key,u8 *iv,u8 *out,u8 *out_iv){<br />
u32 tmpin[2],nexttea[2];<br />
tea_encipher((u32*)in,tmpin,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)iv)[0];<br />
nexttea[1] = tmpin[1]^((u32*)iv)[1];<br />
tea_encipher(nexttea,(u32*)out,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)out)[0];<br />
nexttea[1] = tmpin[1]^((u32*)out)[1];<br />
tea_encipher(nexttea,(u32*)out_iv,(u32*)key);<br />
}<br />
<br />
==Hardware Thumbprint Generation==<br />
u8 salt[20] = { 0x03, 0x5E, 0x20, 0x03, 0xA9, 0x74, 0xFC, 0x57, <br />
0xBB, 0x2D, 0x59, 0x28, 0xBF, 0x10, 0xAE, 0xB9, <br />
0x00, 0x00, 0x00, 0x00<br />
} ;<br />
<br />
void getHardwareThumbPrint(u8 *hwTP){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,chipid,16);<br />
SHA1Input(&ctx,norid,16);<br />
SHA1Input(&ctx,imei,16); //nibble encoded<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(hwTP,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==[[Wildcard Ticket]] Key Generation==<br />
void getHardwareThumbPrint(u8 *hwTP){<br />
u8 hwTP[20];<br />
getHardwareThumbPrint(&hwTP);<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,hwTP,20);<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(hwTP,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
The generates the key which can be used to encrypt/decrypt the wildcard ticket - the chipID/norID are NOT required.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Baseband_TEA_Keys&diff=8544Baseband TEA Keys2010-08-20T21:56:03Z<p>Dogbert: </p>
<hr />
<div>The baseband generates [[wikipedia:Tiny Encryption Algorithm|TEA]] keys based of the [[CHIPID]] and [[NORID]].<br />
<br />
==Key A Generation==<br />
//return unique phone key (key A), this key is used for security zone encryption/decryption<br />
void get_keyA(u8 *A){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,dep1_norid,0x10);<br />
SHA1Input(&ctx,dep2_chipid,0x10);<br />
SHA1Result(&ctx);<br />
memcpy(A,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==NCK Key Generation==<br />
//ulc_mix_lock_unlock_key((u8*)A,(u8*)ctx.Message_Digest,dep1_norid,dep2_chipid,(u8*)B);<br />
void ulc_mix_lock_unlock_key(u8 *keyA, u8 *keyNCK,u8 *norid,u8 *chipid,u8 *keyB){<br />
u8 out_iv[8];<br />
tea_3_round_encipher(norid,keyNCK,keyA,keyB,out_iv); //norid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
tea_3_round_encipher(chipid,keyNCK,out_iv,keyB+8,out_iv); //chipid, keyNCK, SP+4, SP+0x14, SP+0x34<br />
}<br />
// auxilary function for nck key generation<br />
void tea_3_round_encipher(u8 *in,u8 *key,u8 *iv,u8 *out,u8 *out_iv){<br />
u32 tmpin[2],nexttea[2];<br />
tea_encipher((u32*)in,tmpin,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)iv)[0];<br />
nexttea[1] = tmpin[1]^((u32*)iv)[1];<br />
tea_encipher(nexttea,(u32*)out,(u32*)key);<br />
nexttea[0] = tmpin[0]^((u32*)out)[0];<br />
nexttea[1] = tmpin[1]^((u32*)out)[1];<br />
tea_encipher(nexttea,(u32*)out_iv,(u32*)key);<br />
}<br />
<br />
==Hardware Thumbprint Generation==<br />
u8 salt[20] = { 0x03, 0x5E, 0x20, 0x03, 0xA9, 0x74, 0xFC, 0x57, <br />
0xBB, 0x2D, 0x59, 0x28, 0xBF, 0x10, 0xAE, 0xB9, <br />
0x00, 0x00, 0x00, 0x00<br />
} ;<br />
<br />
void getHardwareThumbPrint(u8 *hwTP){<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,chipid,16);<br />
SHA1Input(&ctx,norid,16);<br />
SHA1Input(&ctx,imei,16); //nibble encoded<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(hwTP,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
<br />
==[[Wildcard Ticket]] Key Generation==<br />
void getHardwareThumbPrint(u8 *hwTP){<br />
u8 hwTP[16];<br />
getHardwareThumbPrint(&hwTP);<br />
SHA1Context ctx;<br />
SHA1Reset(&ctx);<br />
SHA1Input(&ctx,hwTP,16);<br />
SHA1Input(&ctx,salt,20);<br />
SHA1Result(&ctx);<br />
memcpy(hwTP,(u8*)ctx.Message_Digest,0x14);<br />
}<br />
The generates the key which can be used to encrypt/decrypt the wildcard ticket - the chipID/norID are NOT required.<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=8541Activation Token2010-08-20T18:11:51Z<p>Dogbert: /* Layout Activation Tocken */</p>
<hr />
<div>[[iTunes]] gets a couple things from the phone: the [[DeviceID]], the [[ChipID]], the [[wikipedia:IMEI|IMEI]], the [[Wikipedia:ICCID|ICCID]], the [[Wikipedia:IMSI|IMSI]], the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. The server appends the [[WildcardTicket]] to the token, signs the token with Apple's private key and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token.<br />
<br />
==Layout Activation Tocken==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded DRM cert here)<br />
</data><br />
</dict><br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>...</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>WildcardActivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(TEA key)</string><br />
<key>BasebandThumbprint</key><br />
<string>(TEA key)string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>iPhone</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>...</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>...</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<key>SIMStatus</key><br />
<string>kCTSIMSupportSIMStatusReady</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>...</string><br />
</dict><br />
</plist><br />
<br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=8540Activation Token2010-08-20T18:10:56Z<p>Dogbert: /* Layout Activation Ticket */</p>
<hr />
<div>[[iTunes]] gets a couple things from the phone: the [[DeviceID]], the [[ChipID]], the [[wikipedia:IMEI|IMEI]], the [[Wikipedia:ICCID|ICCID]], the [[Wikipedia:IMSI|IMSI]], the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. The server appends the [[WildcardTicket]] to the token, signs the token with Apple's private key and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token.<br />
<br />
==Layout Activation Tocken==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
</dict><br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>...</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>WildcardActivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(TEA key)</string><br />
<key>BasebandThumbprint</key><br />
<string>(TEA key)string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>iPhone</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>...</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>...</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<key>SIMStatus</key><br />
<string>kCTSIMSupportSIMStatusReady</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>...</string><br />
</dict><br />
</plist><br />
<br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=8539Activation Token2010-08-20T18:10:11Z<p>Dogbert: </p>
<hr />
<div>[[iTunes]] gets a couple things from the phone: the [[DeviceID]], the [[ChipID]], the [[wikipedia:IMEI|IMEI]], the [[Wikipedia:ICCID|ICCID]], the [[Wikipedia:IMSI|IMSI]], the phone number (!), and a few other things. This is called the "activation token" and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. The server appends the [[WildcardTicket]] to the token, signs the token with Apple's private key and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does and if the baseband is able to log in to a GSM network, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token.<br />
<br />
==Layout Activation Ticket==<br />
<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationInfoComplete</key><br />
<true/><br />
<key>ActivationInfoXML</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
<key>FairPlayCertChain</key><br />
<data><br />
(base64-encoded activation info here)<br />
</data><br />
</dict><br />
<br />
For the first generation iPhones, the [[NCK]] field has been added. For later generation models, the [[WildcardTicket]] field is used for activating the baseband with [[AT+XLCK]].<br />
<br />
==Layout ActivationInfo==<br />
<?xml version="1.0" encoding="UTF-8"?><br />
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><br />
<plist version="1.0"><br />
<dict><br />
<key>ActivationRandomness</key><br />
<string>...</string><br />
<key>ActivationRequiresActivationTicket</key><br />
<true/><br />
<key>ActivationState</key><br />
<string>WildcardActivated</string><br />
<key>BasebandMasterKeyHash</key><br />
<string>(TEA key)</string><br />
<key>BasebandThumbprint</key><br />
<string>(TEA key)string><br />
<key>BuildVersion</key><br />
<string>8A306</string><br />
<key>DeviceCertRequest</key><br />
<data><br />
(base64 encoded cert)<br />
</data><br />
<key>DeviceClass</key><br />
<string>iPhone</string><br />
<key>IntegratedCircuitCardIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileEquipmentIdentity</key><br />
<string>...</string><br />
<key>InternationalMobileSubscriberIdentity</key><br />
<string>...</string><br />
<key>ModelNumber</key><br />
<string>MC135</string><br />
<key>PhoneNumber</key><br />
<string>...</string><br />
<key>ProductType</key><br />
<string>iPhone2,1</string><br />
<key>ProductVersion</key><br />
<string>4.0.1</string><br />
<key>SIMStatus</key><br />
<string>kCTSIMSupportSIMStatusReady</string><br />
<key>SerialNumber</key><br />
<string>...</string><br />
<key>SupportsPostponement</key><br />
<true/><br />
<key>UniqueChipID</key><br />
<integer>...</integer><br />
<key>UniqueDeviceID</key><br />
<string>...</string><br />
</dict><br />
</plist><br />
<br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Activation_Token&diff=8530Activation Token2010-08-20T05:21:16Z<p>Dogbert: </p>
<hr />
<div>[[iTunes]] gets three things from the phone, the [[DeviceID]], the [[wikipedia:IMEI|IMEI]], and the [[Wikipedia:ICCID|ICCID]]. This is called the token and is unique to every iPhone. This token is then sent to the Apple server (alfred.apple.com) via [[Wikipedia:Transport Layer Security|SSL]]. Apple uses their private key to sign the token and transmits it back to [[iTunes]]. [[iTunes]] then calls [[AMDeviceActivate]] with this signed token. The device gets the token and checks whether or not the signature matches the token. If it does, the device is activated. A patched [[lockdownd]] circumvents these checks rather then to provide a valid token. (To create a valid token someone needed Apple's private key.)<br />
<br />
{<br />
"UniqueDeviceID" = "aabbccdd......";<br />
"InternationalMobileEquipmentIdentity" = "1234....";<br />
"IntegratedCircuitCardIdentity" = "1234...";<br />
}<br />
<br />
For the first generation iPhones, the [[NCK]] field has been added. For later generation models, the [[WildcardTicket]] field is used for activating the baseband with [[AT+XLCK]].<br />
<br />
==Resources==<br />
* [[User:posixninja|posixninja]]'s [http://github.com/posixninja/ideviceactivate iDeviceActivate]<br />
<br />
[[Category:Baseband]]</div>Dogberthttps://www.theiphonewiki.com/w/index.php?title=Talk:WildcardTicket&diff=8501Talk:WildcardTicket2010-08-19T18:36:22Z<p>Dogbert: </p>
<hr />
<div>Theoretically, can't we just edit the .plist? and make it into the factory unlocked IMSI Mask? -- {{unsigned|Leobruh|5:32, 19 August 2010 (UTC)}}<br />
:The activation plist is signed, so to do this you require a jailbreak anyway. - lilstevie<br />
<br />
i realize that. but wouldnt this result in a permanent unlock? [[User:Leobruh|Leobruh]] 07:37, 19 August 2010 (UTC)!<br />
<br />
I'm guessing the ticket is handled by the baseband, which requires an exploit to get unsigned code running in the first place? [[User:Iemit737|Iemit737]] 07:41, 19 August 2010 (UTC)<br />
<br />
The wildcard ticket is also signed - simple edits break the signature and the ticket gets rejected then. rtfm cryptography 101. [[User:dogbert|dogbert]] 16:02, 19 August 2010 (UTC)<br />
<br />
kay but unsigned code already runs when the phone is jailbroken and has access to the filesystem. wouldnt editing the .plist be okay since the sig checks arent needed. again this is all theoretical. im jw [[User:Leobruh|Leobruh]] 18:33, 19 August 2010 (UTC)!<br />
<br />
The baseband processor checks the signature, not the application processor. [[User:dogbert|dogbert]] 18:36, 19 August 2010 (UTC)</div>Dogbert