X-Gold 608 Unlock

From The iPhone Wiki
Revision as of 21:39, 31 January 2009 by Oranav (talk | contribs) (Class 1)
Jump to: navigation, search

Until recenlty, the 3G software unlock was the biggest missing piece of the iPhone community. It proved more difficult than the previous unlocks due to the fact that the baseband bootloader is signature checked by the bootrom. The dev team has successfully unlocked all baseband versions until 02.30.03, by overriding carrier locks on-the-fly in RAM, therefore at boot the baseband bootrom can validate the bootloader, the bootloader can validate the baseband. The unlock, code-name yellowsn0w, was released to the public on 01/01/09 for baseband 02.28.00 only. [1]

Possible Methods

Class 1

  • Find an exploit in the bootrom to break the chain of trust. The Dev-Team successfully dumped the bootrom, but they won't release it as it's copyrighted code.
  • Improve by several orders of magnitude the NCK brute forcer, and find a way to extract the CHIPID and NORID
  • Find the theorized algorithm of NCK generation

Class 2

Resources