The iPhone Wiki - User contributions [en]

SIM hacks

2008-08-14T16:45:55Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

These hacks all require a [[SIM]] card passthrough to be used. They typically work by spoofing the MCC/MNC. Some examples include TurboSIM, XSim, SuperSIM, Yessim, Furiousim, StealthSim.

==Old SIM Exploit (iPhone) ==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the SIM card, and this IMSI is used for the network login.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

It seems that some level of 2G call and SMS operation with SIM hacks is possible. However there is a high level of unpredictable behaviour based on different networks, SIMs, SIM hack co-devices, and so on. It is also theorised that different carrier networks have an ability to detect and block such exploits. This may explain the SIM hack working for several hours or days before it stops working. On [http://www.hackint0sh.org/forum/showthread.php?p=329221 hackint0sh] one user reported that '''all SIM solutions be''' '''''_not_''''' '''working with EDGE and UMTS''' [http://www.hackint0sh.org/forum/showpost.php?p=329739&postcount=24].

<b> Warning </b>
(citation taken from dev team's [http://blog.iphone-dev.org/post/44428446/updates blog]):

<cite>We’ve been monitoring the whole “SIM-card unlock” proxy-SIM situation. This involves using a chip that is attached to your SIM card (with a small modification to your SIM) or sometimes a small PCB soldered inside the phone. These sim mods so far seem '''very very very''' questionable. Zf has found that they use trickery of the GSM and UMTS network that is considered highly illegal in most countries and they rely on sending bogus IMSIs and various other nasty hacks to obtain service on your iPhone. A couple of our members have worked out how this all “works” and we’ll try to publish our findings soon. '''DevTeam recommendation: Steer clear, don’t use!'''</cite>

(In alphabetical order)

===iPhonix / Juma===
MacBug.de reports only 2G mode (data mode not clear) works with this. MacBug.de seems to be distancing itself from the product.

===RebelSim===
The company video demonstrates 2G but mentions no 3G function at this stage. The RebelSim website claims it has tested iPhone 3G operation. More information is required.

===StealthSim===
One of the more expensive variants of the SIM hacks on sale now. More formal reports indicate that this method is just as unstable as the rest. It fakes IMSI like the rest, but eventually gets kicked off the network. Don't buy.

===TurboSim===
Indications are that no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

===Universal Sim===
Claims that they're updated hardware/software now allows full iPhone 3G functionality. Reports are not clear yet at this stage although their website now shows several videos. In discussions with Hackint0sh forum members Universal Sim claims that their technique is quite different to the other SIM solutions.

===Yessim / Furiousim===
Overall, there are conflicting reports on whether this works on various SIMs and networks. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode". It is recommended that if ordering, the USB "YesUP" or "FuriousUP" cable is used. The company mentions that unfortunately instead of USB cables, RJ45 cables were provided to testers due to a "shipping error". Initial testing of Yessim with stock configurations shows problems after several hours or a few days.

== SIM hacks development status ==

===SIM communication===
Currently it is possible to see some information at the baseband level of how the iPhone 3G baseband "interacts" with the SIM and SIM hack co-device. Investigations are ongoing. In very layman-person terms, there is a way to see the baseband requesting information from the SIM and seeing the modem commands and various other baseband operations. This information will probably be clearer in other sections of this Wiki.

''Hackint0sh.Org Policy:'' At this stage due to complications all SIM Hack testing and discussion should be done [http://www.hackint0sh.org/forum/showthread.php?p=329221 here].

==iPhone 3G SIM Tray Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny [[SIM]] ejector button. You have been warned. Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

[[Category:Unlocking Methods]]

SIM hacks

2008-08-14T16:45:10Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

These hacks all require a [[SIM]] card passthrough to be used. They typically work by spoofing the MCC/MNC. Some examples include TurboSIM, XSim, SuperSIM, Yessim, Furiousim, StealthSim.

==Old SIM Exploit (iPhone) ==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the SIM card, and this IMSI is used for the network login.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

It seems that some level of 2G call and SMS operation with SIM hacks is possible. However there is a high level of unpredictable behaviour based on different networks, SIMs, SIM hack co-devices, and so on. It is also theorised that different carrier networks have an ability to detect and block such exploits. This may explain the SIM hack working for several hours or days before it stops working. On [http://www.hackint0sh.org/forum/showthread.php?p=329221 hackint0sh] one user reported that '''all SIM solutions be''' '''''_not_''''' '''working with EDGE and UMTS''' [http://www.hackint0sh.org/forum/showpost.php?p=329739&postcount=24].

<b> Warning </b>
(citation taken from dev team's [http://blog.iphone-dev.org/post/44428446/updates blog]):

<cite>We’ve been monitoring the whole “SIM-card unlock” proxy-SIM situation. This involves using a chip that is attached to your SIM card (with a small modification to your SIM) or sometimes a small PCB soldered inside the phone. These sim mods so far seem '''very very very''' questionable. Zf has found that they use trickery of the GSM and UMTS network that is considered highly illegal in most countries and they rely on sending bogus IMSIs and various other nasty hacks to obtain service on your iPhone. A couple of our members have worked out how this all “works” and we’ll try to publish our findings soon. '''DevTeam recommendation: Steer clear, don’t use!'''</cite>

(In alphabetical order)

===iPhonix / Juma===
MacBug.de reports only 2G mode (data mode not clear) works with this. MacBug.de seems to be distancing itself from the product.

===RebelSim===
The company video demonstrates 2G but mentions no 3G function at this stage. The RebelSim website claims it has tested iPhone 3G operation. More information is required.

===StealthSim===
One of the more expensive variant of the SIM hacks on sale now. More formal reports indicate that this method is just as unstable as the rest. It fakes IMSI like the rest, but eventually gets kicked off the network. Don't buy.

===TurboSim===
Indications are that no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

===Universal Sim===
Claims that they're updated hardware/software now allows full iPhone 3G functionality. Reports are not clear yet at this stage although their website now shows several videos. In discussions with Hackint0sh forum members Universal Sim claims that their technique is quite different to the other SIM solutions.

===Yessim / Furiousim===
Overall, there are conflicting reports on whether this works on various SIMs and networks. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode". It is recommended that if ordering, the USB "YesUP" or "FuriousUP" cable is used. The company mentions that unfortunately instead of USB cables, RJ45 cables were provided to testers due to a "shipping error". Initial testing of Yessim with stock configurations shows problems after several hours or a few days.

== SIM hacks development status ==

===SIM communication===
Currently it is possible to see some information at the baseband level of how the iPhone 3G baseband "interacts" with the SIM and SIM hack co-device. Investigations are ongoing. In very layman-person terms, there is a way to see the baseband requesting information from the SIM and seeing the modem commands and various other baseband operations. This information will probably be clearer in other sections of this Wiki.

''Hackint0sh.Org Policy:'' At this stage due to complications all SIM Hack testing and discussion should be done [http://www.hackint0sh.org/forum/showthread.php?p=329221 here].

==iPhone 3G SIM Tray Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny [[SIM]] ejector button. You have been warned. Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

[[Category:Unlocking Methods]]

SIM hacks

2008-08-02T18:21:44Z

Nvidia2008: /* StealthSim */

These hacks all require a [[SIM]] card passthrough to be used. They typically work by spoofing the MCC/MNC. Some examples include TurboSIM, XSim, SuperSIM, Yessim, Furiousim, StealthSim.

==Old SIM Exploit (iPhone) ==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the SIM card, and this IMSI is used for the network login.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

It seems that some level of 2G call and SMS operation with SIM hacks is possible. However there is a high level of unpredictable behaviour based on different networks, SIMs, SIM hack co-devices, and so on. It is also theorised that different carrier networks have an ability to detect and block such exploits. This may explain the SIM hack working for several hours or days before it stops working. On [http://www.hackint0sh.org/forum/showthread.php?p=329221 hackint0sh] one user reported that '''all SIM solutions be''' '''''_not_''''' '''working with EDGE and UMTS''' [http://www.hackint0sh.org/forum/showpost.php?p=329739&postcount=24].

===iPhonix / Juma===
MacBug.de reports only 2G mode (data mode not clear) works with this. MacBug.de seems to be distancing itself from the product.

===RebelSim===
The [http://www.youtube.com/watch?v=lNG3CUM8yNM official video] demonstrates 2G but mentions no 3G function at this stage. The [http://rebelsimcard.com/virtu/ RebelSim website] claims it has tested iPhone 3G operation. Online chat through the website with a representative seems responsive. A Hackint0sh Forum user has seen (not tried) this in action. Further investigation required.

===StealthSim===
The most expensive variant of the SIM hacks on sale now. Initial reports on Hackint0sh Forums indicate full 2G and possibly 3G function. However there is no conclusive evidence at this stage.

===TurboSim===
Indications are that no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

===Yessim / Furiousim===
Overall, there are conflicting reports on whether this works on various SIMs and networks. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode". It is recommended that if ordering, the USB "YesUP" or "FuriousUP" cable is used. The company mentions that unfortunately instead of USB cables, RJ45 cables were provided to testers due to a "shipping error". Initial testing of Yessim with stock configurations shows problems after several hours or a few days.

== SIM hacks development status ==

===SIM communication===
Currently it is possible to see some information at the baseband level of how the iPhone 3G baseband "interacts" with the SIM and SIM hack co-device. Investigations are ongoing. In very layman-person terms, there is a way to see the baseband requesting information from the SIM and seeing the modem commands and various other baseband operations. This information will probably be clearer in other sections of this Wiki.

''Hackint0sh.Org Policy:'' At this stage due to complications all SIM Hack testing and discussion should be done [http://www.hackint0sh.org/forum/showthread.php?p=329221 here].

==iPhone 3G SIM Tray Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny [[SIM]] ejector button. You have been warned. Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-08-02T18:18:00Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

These hacks all require a [[SIM]] card passthrough to be used. They typically work by spoofing the MCC/MNC. Some examples include TurboSIM, XSim, SuperSIM, Yessim, Furiousim, StealthSim.

==Old SIM Exploit (iPhone) ==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the SIM card, and this IMSI is used for the network login.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

It seems that some level of 2G call and SMS operation with SIM hacks is possible. However there is a high level of unpredictable behaviour based on different networks, SIMs, SIM hack co-devices, and so on. It is also theorised that different carrier networks have an ability to detect and block such exploits. This may explain the SIM hack working for several hours or days before it stops working. On [http://www.hackint0sh.org/forum/showthread.php?p=329221 hackint0sh] one user reported that '''all SIM solutions be''' '''''_not_''''' '''working with EDGE and UMTS''' [http://www.hackint0sh.org/forum/showpost.php?p=329739&postcount=24].

===iPhonix / Juma===
MacBug.de reports only 2G mode (data mode not clear) works with this. MacBug.de seems to be distancing itself from the product.

===RebelSim===
The [http://www.youtube.com/watch?v=lNG3CUM8yNM official video] demonstrates 2G but mentions no 3G function at this stage. The [http://rebelsimcard.com/virtu/ RebelSim website] claims it has tested iPhone 3G operation. Online chat through the website with a representative seems responsive. A Hackint0sh Forum user has seen (not tried) this in action. Further investigation required.

===StealthSim===
The most expensive variant of the SIM hacks on sale now. Initial reports on Hackint0sh Forums indicate full 2G and possibly 3G function. However these are new posters with small post counts. More information on this is required.

===TurboSim===
Indications are that no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

===Yessim / Furiousim===
Overall, there are conflicting reports on whether this works on various SIMs and networks. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode". It is recommended that if ordering, the USB "YesUP" or "FuriousUP" cable is used. The company mentions that unfortunately instead of USB cables, RJ45 cables were provided to testers due to a "shipping error". Initial testing of Yessim with stock configurations shows problems after several hours or a few days.

== SIM hacks development status ==

===SIM communication===
Currently it is possible to see some information at the baseband level of how the iPhone 3G baseband "interacts" with the SIM and SIM hack co-device. Investigations are ongoing. In very layman-person terms, there is a way to see the baseband requesting information from the SIM and seeing the modem commands and various other baseband operations. This information will probably be clearer in other sections of this Wiki.

''Hackint0sh.Org Policy:'' At this stage due to complications all SIM Hack testing and discussion should be done [http://www.hackint0sh.org/forum/showthread.php?p=329221 here].

==iPhone 3G SIM Tray Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny [[SIM]] ejector button. You have been warned. Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-08-01T18:15:43Z

Nvidia2008:

These hacks all require a [[SIM]] card passthrough to be used. They typically work by spoofing the MCC/MNC. Some examples include TurboSIM, XSim, SuperSIM, Yessim, Furiousim, StealthSim.

==Old SIM Exploit (iPhone) ==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the SIM card, and this IMSI is used for the network login.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

It seems that some level of 2G call and SMS operation with SIM hacks is possible. However there is a high level of unpredictable behaviour based on different networks, SIMs, SIM hack co-devices, and so on. It is also theorised that different carrier networks have an ability to detect and block such exploits. This may explain the SIM hack working for several hours or days before it stops working.

===iPhonix / Juma===
MacBug.de reports only 2G mode (data mode not clear) works with this. MacBug.de seems to be distancing itself from the product.

===RebelSim===
The official video http://www.youtube.com/watch?v=lNG3CUM8yNM demonstrates 2G but mentions no 3G function at this stage. The [http://rebelsimcard.com/virtu/ RebelSim website] claims it has tested iPhone 3G operation. Online chat through the website with a representative seems responsive. A Hackint0sh Forum user has seen (not tried) this in action. Further investigation required.

===StealthSim===
The most expensive variant of the SIM hacks on sale now. Initial reports on Hackint0sh Forums indicate full 2G and possibly 3G function. However these are new posters with small post counts. More information on this is required.

===TurboSim===
Indications are that no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

===Yessim / Furiousim===
Update: Yessim and a fresh new UK O2 PAYG appears working in very early initial 2G call and SMS testing. Testing has only been done for 2 hours since first try. Overall, conflicting reports on whether this works on various SIMs and networks. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode". It is recommended that if ordering, the USB "YesUP" or "FuriousUP" cable is used. The company mentions that unfortunately instead of USB cables, RJ45 cables were provided to testers due to a "shipping error".

== SIM hacks development status ==

===SIM communication===
Currently it is possible to see some information at the baseband level of how the iPhone 3G baseband "interacts" with the SIM and SIM hack co-device. Investigations are ongoing. In very layman-person terms, there is a way to see the baseband requesting information from the SIM and seeing the modem commands and various other baseband operations. This information will probably be clearer in other sections of this Wiki.

''Hackint0sh.Org Policy:'' At this stage due to complications all SIM Hack testing and discussion should be done [http://www.hackint0sh.org/forum/showthread.php?p=329221 here].

==iPhone 3G SIM Tray Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny [[SIM]] ejector button. You have been warned. Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-08-01T17:59:00Z

Nvidia2008: /* Summary */

These hacks all require a [[SIM]] card passthrough to be used. They typically work by spoofing the MCC/MNC. Some examples include TurboSIM, XSim, SuperSIM, Yessim, Furiousim, StealthSim.

==Old SIM Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the SIM card, and this IMSI is used for the network login.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

===Summary===
It seems that some level of 2G call and SMS operation with SIM hacks is possible. However there is a high level of unpredictable behaviour based on different networks, SIMs, SIM hack co-devices, and so on. It is also theorised that different carrier networks have an ability to detect and block such exploits. This may explain the SIM hack working for several hours or days before it stops working.

===Baseband Feedback===
Currently it is possible to see some information at the baseband level of how the iPhone 3G baseband "interacts" with the SIM and SIM hack co-device. Investigations are ongoing. In very layman-person terms, there is a way to see the baseband requesting information from the SIM and seeing the modem commands and various other baseband operations. This information will probably be clearer in other sections of this Wiki.

===Hackint0sh.Org Policy===
At this stage due to complications all SIM Hack testing and discussion is merged into one thread: http://www.hackint0sh.org/forum/showthread.php?p=329221

===iPhonix / Juma===
MacBug.de reports only 2G mode (data mode not clear) works with this. MacBug.de seems to be distancing itself from the product.

===RebelSim===
http://rebelsimcard.com/virtu/ website claims it has tested iPhone 3G operation. Online chat through the website with a representative seems responsive. A Hackint0sh Forum user has seen (not tried) this in action. Further investigation required.

===StealthSim===
The most expensive variant of the SIM hacks on sale now. Initial reports on Hackint0sh Forums indicate full 2G and possibly 3G function. However these are new posters with small post counts. More information on this is required.

===TurboSim===
Indications are that no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

===Yessim / Furiousim===
Update: Yessim and a fresh new UK O2 PAYG appears working in very early initial 2G call and SMS testing. Testing has only been done for 2 hours since first try. Overall, conflicting reports on whether this works on various SIMs and networks. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode". It is recommended that if ordering, the USB "YesUP" or "FuriousUP" cable is used. The company mentions that unfortunately instead of USB cables, RJ45 cables were provided to testers due to a "shipping error".

==iPhone 3G SIM Tray Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny [[SIM]] ejector button. You have been warned. Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-08-01T17:57:04Z

Nvidia2008: /* iPhonix / Juma */

These hacks all require a [[SIM]] card passthrough to be used. They typically work by spoofing the MCC/MNC. Some examples include TurboSIM, XSim, SuperSIM, Yessim, Furiousim, StealthSim.

==Old SIM Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the SIM card, and this IMSI is used for the network login.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

===Summary===
It seems that some level of 2G call and SMS operation with SIM hacks is possible. However there is a high level of unpredictable behaviour based on different networks, SIMs, SIM hack co-devices, and so on. It is also theorised that different carrier networks have an ability to detect and block such exploits.

===Baseband Feedback===
Currently it is possible to see some information at the baseband level of how the iPhone 3G baseband "interacts" with the SIM and SIM hack co-device. Investigations are ongoing. In very layman-person terms, there is a way to see the baseband requesting information from the SIM and seeing the modem commands and various other baseband operations. This information will probably be clearer in other sections of this Wiki.

===Hackint0sh.Org Policy===
At this stage due to complications all SIM Hack testing and discussion is merged into one thread: http://www.hackint0sh.org/forum/showthread.php?p=329221

===iPhonix / Juma===
MacBug.de reports only 2G mode (data mode not clear) works with this. MacBug.de seems to be distancing itself from the product.

===RebelSim===
http://rebelsimcard.com/virtu/ website claims it has tested iPhone 3G operation. Online chat through the website with a representative seems responsive. A Hackint0sh Forum user has seen (not tried) this in action. Further investigation required.

===StealthSim===
The most expensive variant of the SIM hacks on sale now. Initial reports on Hackint0sh Forums indicate full 2G and possibly 3G function. However these are new posters with small post counts. More information on this is required.

===TurboSim===
Indications are that no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

===Yessim / Furiousim===
Update: Yessim and a fresh new UK O2 PAYG appears working in very early initial 2G call and SMS testing. Testing has only been done for 2 hours since first try. Overall, conflicting reports on whether this works on various SIMs and networks. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode". It is recommended that if ordering, the USB "YesUP" or "FuriousUP" cable is used. The company mentions that unfortunately instead of USB cables, RJ45 cables were provided to testers due to a "shipping error".

==iPhone 3G SIM Tray Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny [[SIM]] ejector button. You have been warned. Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-08-01T17:55:50Z

Nvidia2008: /* Summary */

These hacks all require a [[SIM]] card passthrough to be used. They typically work by spoofing the MCC/MNC. Some examples include TurboSIM, XSim, SuperSIM, Yessim, Furiousim, StealthSim.

==Old SIM Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the SIM card, and this IMSI is used for the network login.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

===Summary===
It seems that some level of 2G call and SMS operation with SIM hacks is possible. However there is a high level of unpredictable behaviour based on different networks, SIMs, SIM hack co-devices, and so on. It is also theorised that different carrier networks have an ability to detect and block such exploits.

===Baseband Feedback===
Currently it is possible to see some information at the baseband level of how the iPhone 3G baseband "interacts" with the SIM and SIM hack co-device. Investigations are ongoing. In very layman-person terms, there is a way to see the baseband requesting information from the SIM and seeing the modem commands and various other baseband operations. This information will probably be clearer in other sections of this Wiki.

===Hackint0sh.Org Policy===
At this stage due to complications all SIM Hack testing and discussion is merged into one thread: http://www.hackint0sh.org/forum/showthread.php?p=329221

===iPhonix / Juma===
MacBug.de reports only 2G mode works with this.

===RebelSim===
http://rebelsimcard.com/virtu/ website claims it has tested iPhone 3G operation. Online chat through the website with a representative seems responsive. A Hackint0sh Forum user has seen (not tried) this in action. Further investigation required.

===StealthSim===
The most expensive variant of the SIM hacks on sale now. Initial reports on Hackint0sh Forums indicate full 2G and possibly 3G function. However these are new posters with small post counts. More information on this is required.

===TurboSim===
Indications are that no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

===Yessim / Furiousim===
Update: Yessim and a fresh new UK O2 PAYG appears working in very early initial 2G call and SMS testing. Testing has only been done for 2 hours since first try. Overall, conflicting reports on whether this works on various SIMs and networks. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode". It is recommended that if ordering, the USB "YesUP" or "FuriousUP" cable is used. The company mentions that unfortunately instead of USB cables, RJ45 cables were provided to testers due to a "shipping error".

==iPhone 3G SIM Tray Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny [[SIM]] ejector button. You have been warned. Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-08-01T17:54:45Z

Nvidia2008:

SIM hacks

2008-08-01T17:54:12Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

SIM hacks

2008-08-01T17:52:22Z

Nvidia2008: /* Baseband Feedback */

SIM hacks

2008-08-01T17:50:59Z

Nvidia2008: /* RebelSim */

SIM hacks

2008-08-01T17:50:32Z

Nvidia2008: /* RebelSim */

SIM hacks

2008-08-01T17:49:30Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

SIM hacks

2008-08-01T17:49:12Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

SIM hacks

2008-08-01T11:20:46Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

SIM hacks

2008-08-01T11:20:07Z

Nvidia2008: /* StealthSim */

SIM hacks

2008-08-01T10:30:59Z

Nvidia2008: /* Yessim / Furiousim */

SIM hacks

2008-08-01T10:29:45Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

SIM hacks

2008-08-01T10:27:50Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

SIM hacks

2008-08-01T10:26:32Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

SIM hacks

2008-08-01T10:26:00Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

SIM hacks

2008-07-31T19:29:03Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

These hacks all require a SIM card passthrough to be used. Some examples include TurboSIM, XSim, SuperSIM, Yessim, Furiousim, StealthSim.

==Old Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the sim card. That is the IMSI sent to the network.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

'''iPhonix / Juma'''
:MacBug.de reports only 2G mode works with this.

'''TurboSim'''
:Indications are that no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

'''StealthSim'''
:Initial reports on Hackint0sh Forums indicate full 2G and 3G function. However these are new posters with small post counts. The main company website is http://www.stealthsim.com and they mention minimum orders of 250 pieces if dealing directly with them. Retail is done through their dealer in Canada, apparently, through http://www.iphonestealth.com. More information on this is strongly requested. StealthSim also appears to be also available on eBay.

'''Yessim / Furiousim'''
:Conflicting reports on whether this works. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode". It is recommended that if ordering, the USB "YesUP" or "FuriousUP" cable is used.

==iPhone 3G Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny sim ejector button. You have been warned.

Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-07-31T19:28:02Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

These hacks all require a SIM card passthrough to be used. Some examples include TurboSIM, XSim, SuperSIM, Yessim, Furiousim, StealthSim.

==Old Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the sim card. That is the IMSI sent to the network.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

'''iPhonix / Juma'''
:MacBug.de reports only 2G mode works with this.

'''TurboSim'''
:Indications are that no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

'''StealthSim'''
:Initial reports on Hackint0sh Forums indicate full working. However these are new posters with small post counts. The main company website is http://www.stealthsim.com and they mention minimum orders of 250 pieces if dealing directly with them. Retail is done through their dealer in Canada, apparently, through http://www.iphonestealth.com.

'''Yessim / Furiousim'''
:Conflicting reports on whether this works. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode"

==iPhone 3G Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny sim ejector button. You have been warned.

Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-07-31T19:27:26Z

Nvidia2008:

These hacks all require a SIM card passthrough to be used. Some examples include TurboSIM, XSim, SuperSIM, Yessim, Furiousim, StealthSim.

==Old Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the sim card. That is the IMSI sent to the network.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

'''iPhonix / Juma'''
:MacBug.de reports only 2G mode works with this.

'''TurboSim'''
:The author nvidia2008 describes Turbo Sim on the iPhone 3G White 16GB not working in the UK. According to Zf_ of the DevTeam, no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

'''StealthSim'''
:Initial reports on Hackint0sh Forums indicate full working. However these are new posters with small post counts. The main company website is http://www.stealthsim.com and they mention minimum orders of 250 pieces if dealing directly with them. Retail is done through their dealer in Canada, apparently, through http://www.iphonestealth.com.

'''Yessim / Furiousim'''
:Conflicting reports on whether this works. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode"

==iPhone 3G Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny sim ejector button. You have been warned.

Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-07-31T19:26:35Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

These hacks all require a SIM card passthrough to be used. Some examples are the TurboSIM, the XSim, and the SuperSIM.

==Old Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the sim card. That is the IMSI sent to the network.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

'''iPhonix / Juma'''
:MacBug.de reports only 2G mode works with this.

'''TurboSim'''
:The author nvidia2008 describes Turbo Sim on the iPhone 3G White 16GB not working in the UK. According to Zf_ of the DevTeam, no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

'''StealthSim'''
:Initial reports on Hackint0sh Forums indicate full working. However these are new posters with small post counts. The main company website is http://www.stealthsim.com and they mention minimum orders of 250 pieces if dealing directly with them. Retail is done through their dealer in Canada, apparently, through http://www.iphonestealth.com.

'''Yessim / Furiousim'''
:Conflicting reports on whether this works. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode"

==iPhone 3G Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny sim ejector button. You have been warned.

Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-07-31T19:23:41Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

These hacks all require a SIM card passthrough to be used. Some examples are the TurboSIM, the XSim, and the SuperSIM.

==Old Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the sim card. That is the IMSI sent to the network.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

'''iPhonix / Juma'''
:MacBug.de reports only 2G mode works with this.

'''TurboSim'''
:The author nvidia2008 describes Turbo Sim on the iPhone 3G White 16GB not working in the UK. According to Zf_ of the DevTeam, no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

'''StealthSim'''
Initial reports on Hackint0sh Forums indicate full working. However these are new posters with small post counts. The main company website is http://www.stealthsim.com and they mention minimum orders of 250 pieces if dealing directly with them. Retail is done through their dealer in Canada, apparently, through http://www.iphonestealth.com.

'''Yessim / Furiousim'''
:Conflicting reports on whether this works. Samples have been provided to various users on Hackint0sh Forums. Initial challenges faced because of a RJ45 type connector that is needed to set "Boost Mode"

==iPhone 3G Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny sim ejector button. You have been warned.

Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-07-30T20:47:33Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

These hacks all require a SIM card passthrough to be used. Some examples are the TurboSIM, the XSim, and the SuperSIM.

==Old Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the sim card. That is the IMSI sent to the network.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==

iPhonix / Juma:
MacBug.de reports only 2G mode works with this.

TurboSim:
The author nvidia2008 describes Turbo Sim on the iPhone 3G White 16GB not working in the UK. According to Zf_ of the DevTeam, no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

StealthSim:
Awaiting reports, if any.

Yessim / Furiousim:
Conflicting reports on whether this works.

==iPhone 3G Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny sim ejector button. You have been warned.

Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-07-30T20:47:19Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

These hacks all require a SIM card passthrough to be used. Some examples are the TurboSIM, the XSim, and the SuperSIM.

==Old Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the sim card. That is the IMSI sent to the network.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==
Yessim / Furiousim:
Conflicting reports on whether this works.

iPhonix / Juma:
MacBug.de reports only 2G mode works with this.

TurboSim:
The author nvidia2008 describes Turbo Sim on the iPhone 3G White 16GB not working in the UK. According to Zf_ of the DevTeam, no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

StealthSim:
Awaiting reports, if any.

==iPhone 3G Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny sim ejector button. You have been warned.

Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-07-30T20:46:50Z

Nvidia2008: /* SIM Hacks for iPhone 3G */

These hacks all require a SIM card passthrough to be used. Some examples are the TurboSIM, the XSim, and the SuperSIM.

==Old Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the sim card. That is the IMSI sent to the network.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==SIM Hacks for iPhone 3G==
Yessim / Furiousim:
Conflicting reports on whether this works.

iPhonix / Juma:
MacBug.de reports only 2G mode works with this.

TurboSim:
The author nvidia2008 describes Turbo Sim on the iPhone 3G White 16GB not working in the UK. According to Zf_ of the DevTeam, no stable TurboSIM exploit is available at this time. For some providers in Germany there appears to be some success, see [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]].

==iPhone 3G Warning==
The iPhone 3G SIM tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny sim ejector button. You have been warned.

Should you not apply tape beforehand, you can still eject the simtray with an L-shaped pin and a quick but forceful yank. It sounds scary but it's just plastic, after all.

SIM hacks

2008-07-28T09:19:52Z

Nvidia2008: /* Reports */

These hacks all require a SIM card passthrough to be used. Some examples are the TurboSIM, the XSim, and the SuperSIM.

==WARNING==
The iPhone 3G sim tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny sim ejector button. You have been warned.

==Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the sim card. That is the IMSI sent to the network.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==Reports==

Yessim/ Furiousim:
Conflicting reports on whether this works.

iPhonix/Juma:
MacBug.de reports only 2G mode works with this.

TurboSim:
The author nvidia2008 describes Turbo Sim on the iPhone 3G White 16GB not working in the UK.

SIM hacks

2008-07-28T09:18:48Z

Nvidia2008: /* Reports */

These hacks all require a SIM card passthrough to be used. Some examples are the TurboSIM, the XSim, and the SuperSIM.

==WARNING==
The iPhone 3G sim tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny sim ejector button. You have been warned.

==Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the sim card. That is the IMSI sent to the network.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==Reports==

Yessim/ Furiousim
Conflicting reports on whether this works.

iPhonix/Juma
MacBug.de reports only 2G mode works with this.

TurboSim
The author nvidia2008 describes Turbo Sim on the iPhone 3G White 16GB not working in the UK.

SIM hacks

2008-07-28T09:16:28Z

Nvidia2008: /* WARNING */

These hacks all require a SIM card passthrough to be used. Some examples are the TurboSIM, the XSim, and the SuperSIM.

==WARNING==
The iPhone 3G sim tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny sim ejector button. You have been warned.

==Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the sim card. That is the IMSI sent to the network.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==Reports==

iPhonix/Juma

TurboSim
The author nvidia2008 describes Turbo Sim on the iPhone 3G White 16GB not working in the UK.

SIM hacks

2008-07-28T09:16:05Z

Nvidia2008: /* Exploit */

These hacks all require a SIM card passthrough to be used. Some examples are the TurboSIM, the XSim, and the SuperSIM.

==WARNING==
The iPhone 3G sim tray is very very thin. If using SIM hacks (dual sim, etc.) a long thin tape should be attached in a way that you can easily extract the sim tray without relying on the normal tiny sim ejector button.

==Exploit==
This relies on the fact that the IMSI is read twice, once to validate the IMSI and once to connect to the network. So the SIM card spoofs the first IMSI read to trick the device into thinking it is operating on the AT&T network, or whatever network the device is locked to. The second time it allows the IMSI to be read properly from the sim card. That is the IMSI sent to the network.

A slight variant of this exploit uses a silvercard to program the IMSI and ICCID differently. This variant requires your Ki to be known, which can only be extracted from COMPEMU v1 sim cards.

==Reports==

iPhonix/Juma

TurboSim
The author nvidia2008 describes Turbo Sim on the iPhone 3G White 16GB not working in the UK.