|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "X-Gold 608 Unlock"
WEsTbAeR-- (talk | contribs) (25c3 not 25cc nub) |
ChronicDev (talk | contribs) (→Class 1) |
||
| Line 3: | Line 3: | ||
==Possible Methods== |
==Possible Methods== |
||
===Class 1=== |
===Class 1=== |
||
| − | * Find an exploit in the [[Baseband Bootrom|bootrom]] to break the chain of trust |
+ | * Find an exploit in the [[Baseband Bootrom|bootrom]] to break the chain of trust. A method has not yet been found to dump the bootrom, so that would obviously be needed before this becomes an option. |
* Improve by several orders of magnitude the [[NCK Brute Force|NCK brute forcer]], and find a way to extract the CHIPID and NORID |
* Improve by several orders of magnitude the [[NCK Brute Force|NCK brute forcer]], and find a way to extract the CHIPID and NORID |
||
* Find the theorized algorithm of NCK generation |
* Find the theorized algorithm of NCK generation |
||
| + | |||
===Class 2=== |
===Class 2=== |
||
* Use a [[SIM hacks|SIM hack]] such as the [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]] |
* Use a [[SIM hacks|SIM hack]] such as the [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]] |
||
Revision as of 22:42, 1 January 2009
Currently, the 3G (software) unlock which is not baseband-dependent is the biggest missing piece of the iPhone community. It is more difficult than the previous unlocks due to the fact that the baseband bootloader is signature checked. The dev team has successfully unlocked all baseband versions, by a somehow patching the baseband on-the-fly (in RAM), therefore at boot the baseband bootrom can validate the bootloader, the bootloader can validate the baseband, and not until after the boot up will it be patched. The unlock (called yellowsn0w) was released on 01/01/09. [1]
Possible Methods
Class 1
- Find an exploit in the bootrom to break the chain of trust. A method has not yet been found to dump the bootrom, so that would obviously be needed before this becomes an option.
- Improve by several orders of magnitude the NCK brute forcer, and find a way to extract the CHIPID and NORID
- Find the theorized algorithm of NCK generation
Class 2
- Use a SIM hack such as the TurboSIM Unlock
- Find a way to patch running memory to "unlock" the phone on every bootup. The dev team has accomplished this for bb version 02.28.00 with yellowsn0w
Resources
- Read about the X-Gold 608
- Read geohot's blog post
- 25C3 presentation "Hacking the iPhone" video here
