|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "X-Gold 608 Unlock"
m (Unlock 2.0 moved to X-Gold 608 Unlock: The old name was really confusing, the 2.0 software has nothing to do with the X-Gold 608 unlock. Besides, 3.0 will be out soon.) |
|||
| Line 1: | Line 1: | ||
| − | Until recenlty, the 3G software [[unlock]] was the biggest missing piece of the iPhone community. It proved more difficult than the previous unlocks due to the fact that the [[Baseband_Bootloader | baseband bootloader]] is signature checked by the bootrom. [[The dev team]] has successfully unlocked all baseband versions less or equal to 02.28.00, by overriding carrier locks on-the-fly in RAM, therefore at boot the baseband bootrom can validate the bootloader, and the bootloader can validate the baseband. The unlock, code-name [[yellowsn0w]], was released to the public on 01/01/09 for baseband 02.28.00 only |
+ | Until recenlty, the 3G software [[unlock]] was the biggest missing piece of the iPhone community. It proved more difficult than the previous unlocks due to the fact that the [[Baseband_Bootloader | baseband bootloader]] is signature checked by the bootrom. [[The dev team]] has successfully unlocked all baseband versions less or equal to 02.28.00, by overriding carrier locks on-the-fly in RAM, therefore at boot the baseband bootrom can validate the bootloader, and the bootloader can validate the baseband. The unlock, code-name [[yellowsn0w]], was released to the public on 01/01/09 for baseband 02.28.00 only [http://blog.iphone-dev.org/post/67797811/dont-eat-yellowsn0w]. [[ultrasn0w]], an updated version of yellowsn0w, which uses a different injection vector and available for all baseband versions less or equal to 04.26.08, is planned to be released on June 19, 2009. |
==Possible Methods== |
==Possible Methods== |
||
| Line 9: | Line 9: | ||
===Class 2=== |
===Class 2=== |
||
* Use a [[SIM hacks|SIM hack]] such as the [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]] |
* Use a [[SIM hacks|SIM hack]] such as the [[Unlock iphone-3G with TurboSim|TurboSIM Unlock]] |
||
| − | * Find a way to patch running memory to "unlock" the phone on every bootup. This is how [[ |
+ | * Find a way to patch running memory to "unlock" the phone on every bootup. This is how [[ultrasn0w]] works. |
* Find an exploit in the [[Baseband_Bootloader|baseband bootloader]] so you can downgrade the baseband, then use yellowsn0w. [[User:geohot|Geohot]] and [[The dev team]] found (independently) an exploit in bootloader 5.8, but it isn't useful enough as only very-early (week<30) devices have bootloader 5.8. |
* Find an exploit in the [[Baseband_Bootloader|baseband bootloader]] so you can downgrade the baseband, then use yellowsn0w. [[User:geohot|Geohot]] and [[The dev team]] found (independently) an exploit in bootloader 5.8, but it isn't useful enough as only very-early (week<30) devices have bootloader 5.8. |
||
Revision as of 12:50, 18 June 2009
Until recenlty, the 3G software unlock was the biggest missing piece of the iPhone community. It proved more difficult than the previous unlocks due to the fact that the baseband bootloader is signature checked by the bootrom. The dev team has successfully unlocked all baseband versions less or equal to 02.28.00, by overriding carrier locks on-the-fly in RAM, therefore at boot the baseband bootrom can validate the bootloader, and the bootloader can validate the baseband. The unlock, code-name yellowsn0w, was released to the public on 01/01/09 for baseband 02.28.00 only [1]. ultrasn0w, an updated version of yellowsn0w, which uses a different injection vector and available for all baseband versions less or equal to 04.26.08, is planned to be released on June 19, 2009.
Possible Methods
Class 1
- Find an exploit in the bootrom to break the chain of trust. The Dev-Team successfully dumped the bootrom, but they won't release it as it's copyrighted code.
- Improve by several orders of magnitude the NCK brute forcer, and find a way to extract the CHIPID and NORID
- Find the theorized algorithm of NCK generation
Class 2
- Use a SIM hack such as the TurboSIM Unlock
- Find a way to patch running memory to "unlock" the phone on every bootup. This is how ultrasn0w works.
- Find an exploit in the baseband bootloader so you can downgrade the baseband, then use yellowsn0w. Geohot and The dev team found (independently) an exploit in bootloader 5.8, but it isn't useful enough as only very-early (week<30) devices have bootloader 5.8.
Resources
- Read about the X-Gold 608
- Read geohot's blog post
- 25C3 presentation "Hacking the iPhone" video here
