Unbricking/hacking the iPhone

I was asked for help with someones iphone recently. It is amazing how many guides are out there and nearly all of them have a very specific instructions of what to do. If you don’t fit into their ideal situation, then you need to figure it out yourself.

Because I’ve spent a lot of time figuring it out, I thought that I would share a meta-guide to these guides and some advice in troubleshooting.

First, I started with a phone that was jailbroken and upgraded to iPhone firmware 1.1.2. My friend wanted to use his phone with a carrier other than AT&T, so they needed it to be carrier unlocked. Unlocking is sometimes problematic on firmware 1.1.2, so that required downgrading the firmware to one that would allow unlocking in this case.

I’m not sure what exactly was the problem with the phone in the first place, but it was unstable. I had to fix that problem first.

Another one of the problems was that I didn’t have an authorized SIM card to activate the phone. Through experimentation, I was able to determine that you can use any SIM that you happen to have laying around and use the hacktivate method to associate to a wifi network to get to the jailbreak website. Hacktivation does not work without a SIM card in place. After I put a deactivated SIM, it was happy to please me.

So if you have been able to hacktivate your phone after upgrading to firmware 1.1.2 to correct whatever previous problem existed, then you need to downgrade your phone to firmware version 1.1.1 using iTunes, then it has to be jailbroken, then perhaps more. If you have an upgraded iPhone, one that was not firmware 1.1.2 out of the box, and it has been prepared in this way to have firmware 1.1.1, jailbroken, and you have installed AnySIM 1.2.1u, you should be ready to run AnySIM and enjoy your unlocked iPhone.

Sounds complicated? That would be because it is.

So why are OOB (Out Of Box as forums like to abbreviate) iPhones unable to be upgraded? It has to do with the bootloader.

The version of the bootloader on this particular phone appears to be 3.09. In my research, I read discussions that most solutions to this bootloader problem require hardcore nerdosity and are temperamental. Alternatively, they can use a hardware tool like TurboSIM by the Czech company Bladox.

So if you were thinking about being some ebay superstar buying up iPhones and selling them for tons of money, you should realize:

  • It is a moving target
  • It is highly technical and inconsistent
  • Reliable methods may require a hardware investment
  • Most people will think you’re a jerk for charging a lot of money for a phone with a voided warranty.

You’ll be a complicated man and no one will understand you but your woman.

If you think you can handle it, you may be able to make a lot of dough in selling unlocked iPhones as the international demand is completely irrational and out of hand. With unlocked iPhones being sold in europe from $800 to €1400, there is a huge margin for profit considering how weak the US Dollar is currently when compared to other nations currencies. Accepting payment may be a challenge, but picking between Google Checkout, Paypal, and E-Gold should allow a degree of safety without excessive cost.

So, that being said, lets give a list of useful links:

iNdependence: The OSX iPhone manipulation application that makes many of the other methods user friendly. Site is complete with wiki and faq.

iBrickr: A bit more kludgish equivilant for Windows.

iPhone Status Ticker: A Google-hosted document that is frequently maintained outlining what methods are functional for different versions of the iPhone.

Hackintosh Guide to TurboSIM: This should answer many of your questions about what TirboSIM is and how it is used. A TurobSIM irc channel. Unlocking OOB 1.1.2 with TurboSIM.

Jailbreakme 1.1.2 instructions: No pretty pictures, but is the source of information for most of the howtos with pretty pictures.

The “ultimate” unlocking guide for 1.1.2: Pretty pictures included, but remember that only upgraded phones can use this method. It basically boils down to the following:

  • Restore to 1.1.2
  • Restore to 1.1.1
  • Jailbreakme.com
  • Ok2Prep
  • Upgrade to 1.1.2
  • Jailbreak with jailbreak.jar
  • Install anysim 1.2u
  • Turn on Airplane mode
  • Change Auto Lock to Never
  • Run Anysim

The activation of Airplane mode is odd step and key to the process. There is also some confusion about if unlocking should be preformed at firmware 1.1.1 or firmware 1.1.2 after upgrade, so your milage may vary.

iPhone Elite: A pretty hardcore resource for baseband downgrading, virginizing, and unlocking. Most, if not all, has been incorporated into iNdependence. They can be found on irc here.

iPhuc: The tool you can’t mention in polite company. Multiplatform sources are available and may have to be used if you are not getting what you need from iNdependence or ibrickr.

An example on downgrading firmware: Use of the option key is.. well.. key. Also good to know is that seeing “error 1015″ is a sign of success.

A tale of 1.1.2 unlocking: This guy sounds like he has had an interesting journey, like I have, with his iPhone experience.

Another tale: Repeated downgrading, jailbreaking, upgrading, and mentions in bold of things not to do. 40+ pages of dumb questions follow.

Unlocking Resources: These include another repository to add to the installer.app in jailbroken phones. Should be especially helpful if an unlocking was unsuccessful and you want to virginize the phone and try again.

You’ll notice that I only mention free software solutions. This is intentional. The free software is usually better, faster to be upgraded, and are usually stolen and rebranded by profiteers anyway.

If you get any strange error codes, throw them into a websearch. Usually it just means that you need to reboot your phone and try again.

One last note which confused me for a long time was the lack of free space on the iPhone that was hampering my troubleshooting. I found this referenced here. It was an “ah-ha!” moment.

I hope this has been interesting and saved you some time in investigating your hacking options for the iPhone. I think I’ve had about enough for a little while :)

Continue reading Unbricking/hacking the iPhone

iPhone fails it

I am out of patience with the iPhone. It’s fired.

no MMS. Instead, you get directed to this joke.
no GPS
no tethering without hacking it
no applications until at least Feb ’08
only EDGE networking

Seriously. How can any phone be released not having MMS? It was the straw that broke my already highly annoyed camel’s back. [...]

OSX address book contact deletion via iSync

This seems like a good idea in any case to be able to revert to a backup in case of things going horribly wrong.Second, export a vcard of your entire address book like so:Then go ahead and sync again with your phone…. You should then be where you want to be at this point.In the future, I will only be syncing my phone with one computer and then just copying the contents of my ~/Library/Application Support/Address Book on that computer to the other computers where I want a back up or reference copy.This should solve your iSync problems.
[...]

USB malware on OSX

Once the software is run it will extract data from the Apple Keychain and system settings in order to provide the examiner fast access to the suspect’s critical information with as little interaction or trace as possible.[...]MacLockPick takes advantage of the fact that the default state of the Apple Keychain is open, even if the system has been put to sleep.It also makes use of the openly readable settings files used to keep track of your suspect’s contacts, activities and history. These data sources even include items that your suspect may have previously deleted or has migrated from previous Mac OS X computers.I contacted Apple’s security team to see if they were aware of this, if it works as described and, if so, why would such mechanisms exist in any responsible operating system.
[...]