View source for Minus 0x20000 with Back Extend Erase

This is the exploit used to unlock all phones with a 4.6 bootloader.

==Credit==
[[User:Geohot|geohot]]

==Description==

Writing -0x20000 before the firmware starts allows you to write anything you want.

0x3C0000 can't have a valid [[secpack]] to allow booting. The explicit addresses 0xA03D0000-0xA03F0000 will always erase. This exploit relied on two things, the secaddrs are copied before the [[secpack]] is validated(stupid), and the erase command extends the range to whatever is in the [[secpack]]. So erase 0xA03D0000-0xA03F0000, the erase command sees 0xA03C0000 to 0xA03F0000 in the [[secpack]]; BOOM [[secpack]] erased.

==Implementations==
*[[gunlock]]
*[[BootNeuter]]

[[Category:Unlocking Methods]]
[[Category:Baseband Exploits]]