Difference between revisions of "X-Gold 608 Unlock"

From The iPhone Wiki
Jump to: navigation, search
Line 1: Line 1:
 
Until recenlty, the 3G software [[unlock]] was the biggest missing piece of the iPhone community. It proved more difficult than the previous unlocks due to the fact that the [[Baseband_Bootloader | baseband bootloader]] is signature checked by the bootrom. [[The dev team]] has successfully unlocked baseband 04.26.08, by overriding carrier locks on-the-fly in RAM, therefore at boot the baseband bootrom can validate the bootloader, and the bootloader can validate the baseband. The unlock, code-name [[ultrasn0w]], was released to the public on 23 June 2009 for baseband 04.26.08 only [http://blog.iphone-dev.org/post/128573459/ultras-now].
 
Until recenlty, the 3G software [[unlock]] was the biggest missing piece of the iPhone community. It proved more difficult than the previous unlocks due to the fact that the [[Baseband_Bootloader | baseband bootloader]] is signature checked by the bootrom. [[The dev team]] has successfully unlocked baseband 04.26.08, by overriding carrier locks on-the-fly in RAM, therefore at boot the baseband bootrom can validate the bootloader, and the bootloader can validate the baseband. The unlock, code-name [[ultrasn0w]], was released to the public on 23 June 2009 for baseband 04.26.08 only [http://blog.iphone-dev.org/post/128573459/ultras-now].
   
A new unlock named [[blacksn0w]], was released by Geohot on 3 November 2009 for baseband 05.11.07.
+
A new unlock named [[blacksn0w]], was released by [[geohot]] on 3 November 2009 for baseband 05.11.07.
   
 
==Possible Methods==
 
==Possible Methods==

Revision as of 02:01, 4 November 2009

Until recenlty, the 3G software unlock was the biggest missing piece of the iPhone community. It proved more difficult than the previous unlocks due to the fact that the baseband bootloader is signature checked by the bootrom. The dev team has successfully unlocked baseband 04.26.08, by overriding carrier locks on-the-fly in RAM, therefore at boot the baseband bootrom can validate the bootloader, and the bootloader can validate the baseband. The unlock, code-name ultrasn0w, was released to the public on 23 June 2009 for baseband 04.26.08 only [1].

A new unlock named blacksn0w, was released by geohot on 3 November 2009 for baseband 05.11.07.

Possible Methods

Class 1

  • Find an exploit in the bootrom to break the chain of trust. The Dev-Team successfully dumped the bootrom, but they won't release it as it's copyrighted code.
  • Improve by several orders of magnitude the NCK brute forcer, and find a way to extract the CHIPID and NORID
  • Find the theorized algorithm of NCK generation

Class 2

  • Use a SIM hack such as the TurboSIM Unlock
  • Find a way to patch running memory to "unlock" the phone on every bootup. This is how ultrasn0w works.
  • Find an exploit in the Baseband Bootloader so you can downgrade the baseband, then use ultrasn0w. Geohot and the iPhone Dev Team found (independently) an exploit in bootloader 5.8, but it isn't useful enough as only very-early (week<30) iPhone 3G units have bootloader 5.8.

Resources