PDA

View Full Version : Maybe this is why it can't be unlocked - Dev's read please


wombat
07-17-2007, 05:51 PM
Hi all,

I was reading through the code for Anderson's and DVD Jon's codes and I tended to notice a particular theme emerging - this is of course after I got my hands on a raw dump of someone's USB whilst they did a successful and legitimate activation with AT&T - an yes, I'm attaching it :)

When the phone is being activated, there are many pieces of information it is being sent to tell it to go online. With the Anderson method, it is just sent very basic info - enough to get it active, but if you look in the dump from the AT&T activation process, the iPhone exchange several different data sets with iTunes. Of course, what iTunes is sending to the phone just comes up as rubbish, I would assume it's decryptable right?

From what I've learned about the activation process so far (from multiple people all talking about something totally different), everything about what the phone is supposed to be from then on is sent through. Everything. Like, network settings - what addresses of the AT&T servers it connects through to - what connection number (gateway) it is supposed to use for either EDGE/GPRS, what backups, etc.

Now here's an idea which is extremely like Apple: They make the one basic version of the phone, to be built upon later - the same basic hardware as the base for every near future revision. So, everything from network info and which to lock to, gateway numbers, SMS settings, etc. Everything which makes the phone AT&T locked. It explains why it has no ICCID after the hack activation, etc and why you can't send SMS when you swap an identical AT&T card from a phone that isn't an iPhone into an iPhone - and it also explains why when the AT&T staff take any 3G card (regardless of where it came from) and throw it into your iPhone, it works after they magically 'Re-Activate' it.

I think that the phone can't be unlocked because of this reason: the phone can't be unlocked to work on multiple networks, because it isn't really locked in a traditional sense in the beginning - ie. I don't think it's SIM locked. That's it's only mode - to operate only on the network provided by the iTunes activation process.

I'll attach the file now and continue to go through it some more. I'm setting up some test code on top of the anderson activation code which was written in obj c. I'm not great with obj c, and it's been a while, so give me a little while.

In the meantime, could someone please have a look at this usb dump from a legitimate activation process? I realise it looks like all it's doing is exchanging public and private keys over and over again, but look closer; there's more going on.

Basically, I need a good decrypter on this.

USB Log of Legitimate AT&T Activation:
http://www.sharebigfile.com/file/194061/legit-activation-usblog-zip.html

Cheers all.
-Adam

lvcid
07-17-2007, 06:12 PM
Just got my iPhone, and unlocked everything but the phone, just like everyone around here... and now, I'm getting really worried... It's been more than 2 weeks since the iPhone was launched and no one was able to unlock it up until now.

I also think there's more to it, than a SimLOCK NetLOCK or so... lets keep our hopes up and hope for a soon to come solution!

wombat
07-17-2007, 07:04 PM
Hi all, has anyone out there successfully mounted the iPhone yet? It doesn't show up on my USB chain, but it does lol (and it syncs etc). It's the weirdest thing. Can someone out there have a go at this? The files I would like to inspect are:

/iTunes_Control/iTunes/iTunesLock

- also -

/iTunes_Control/iTunes/iTunesControl

These are both on the iPhone itself - not in the restore dmg. I'm only interested in the contents of the iPhone itself.

Not that I think it holds great answers, but I'd really like to take a peek and it's bugging me.

Apple have made it quite difficult to mount the bastard.

Cheers.
-Adam

forcesevens
07-17-2007, 07:04 PM
Another concern.... since I'm going to keep the iphone and cancel with at&t,
what keeps apple from incorporating a lockout for iphones without sims?

Or for that matter, what keeps them from sending out an update
that will invalidate a phone unlock once we figure out how to unlock it?

Perhaps, we can prevent an update, but I could see two problems.
1) apple can require itunes to only work with certain firmware - so
a flash is required before the iphone can be synced again.

2) keeping the old firmware means you don't get all the new updates
and fixes that apple offers.

Anyway, these two point are gettign me worried.

wombat
07-17-2007, 07:11 PM
Not sure dude, but please don't hijack the thread :)

DaveGee
07-17-2007, 07:28 PM
Another concern.... SNIP ... Anyway, these two point are gettign me worried.

First, worrying about something when you have no control over it is wasted energy and should be avoided at all cost. :)

Second... Nothing is 'keeping Apple from...' doing anything... Sure they COULD make the iPhone a behave like a brick without a SIM.... BUT what would this get them?!?! Sure I could see AT&T going a hoot (and even then I'm not sure they care all that much) but thats about it...

This whole 'not working at all' thing (IMHO) had alot more to do with keeping people who had no intention of signing up with AT&T (aka 'expensive touch screen iPod buyers') from buying up too much of the 'limited' stock that they had to work with... Who knows how the press might have spun that...

Headline: Most iPhone buyers NOT signing up with AT&T!!

That was something that Apple **AND** AT&T did NOT want to see.

The 'rollout' is over and I don't think anyone cares all that much if you want to keep the iPhone (or buy a new one) and use it as a non-cell-phone device. Apple is still making their 40% (give or take) profit.

As for what Apple will do if / when a TRUE unlock comes to be.... I have no doubt they will fight it to some degree but thank God we are within our rights (in the US) to do this...

Is it within Apple **rights** to re-lock a device that was LEGALLY unlocked BY IT'S OWNER???

That I'm not to sure of... and I'd imagine the courts would be involved... Its one thing to distribute a device with a provider lock (and its within a US citizens right to remove that lock)... Is it also within the rights of a carrier or manufacturer (Apple) to RELOCK a device that they DO NOT OWN??? Hmmm... I'd imagine it'll be quite interesting if/when someone has the balls to try it...

Dave

drmapple
07-17-2007, 07:38 PM
Wombat,

I do have an ICCCD, using an o2 SIM card in the UK.

The phone is not rejecting the card in any way but has no signal.

Is this unusual?

Dave

smman
07-17-2007, 07:54 PM
Just to report my tests, I have tried 3 cards (more than AT&T)

Italian H3G (tre) , TMS (San Marino) but it's an italian TIM card, CSC (estonia),
All 3 have given me "incorrect sim" and gone down with the signal when I dismiss.
But listen what I have noted: If you call 911 or 112/113 the signal goes up, the call goes through and the signal keeps to be up....
of course no call either than emergency can be done... but the signal goes up...
No one thinks that this could be a backdoor?
Maybe I am a lamer...sure I am... but maybe this can be an idea.

LET'S PRAY

wombat
07-17-2007, 08:01 PM
smman, yes, the signal goes up when you dial emergency, and it will stay up in most cases. if you try and make a call though after this has happened, it just goes to call failed instantly though. i can confirm that emergency calls do work - i called emergency and this is what happened:

emergency: "please state the nature of your emergency"
me: "oops, sorry mate wrong number"
emergency: "no worries mate, bye"

so i wonder, am i the first person in australia to make a call on the iphone and speak to someone using our networks without roaming? probably not, but i can safely say that part works.


drmapple:

yes, i found out the iccid appears after a while, but it does not appear the instant after activation. it just 'happens' after a while.


anyway, back to the original topic, has anyone had any ideas about the activation process providing network details etc? has anyone had any success decrypting the data, or do they understand exactly what's being swapped and where? has anyone successfully mounted the iphone and viewed it's files?

cheers.
-adam

forcesevens
07-17-2007, 10:55 PM
Not sure dude, but please don't hijack the thread :)

sorry about that. no harm meant

liweic
07-18-2007, 07:03 AM
hi, according to my friend who works for a phone maker, all mobile phones are tested to work with emergency numbers 911/112

EVEN if the phone is under "key lock", EVEN if the phone is WITHOUT sim card inserted

thus it doesn't mean anything except that the GSM bandwidth in your country is supported by iPhone

smman, yes, the signal goes up when you dial emergency, and it will stay up in most cases. if you try and make a call though after this has happened, it just goes to call failed instantly though. i can confirm that emergency calls do work - i called emergency and this is what happened:

emergency: "please state the nature of your emergency"
me: "oops, sorry mate wrong number"
emergency: "no worries mate, bye"

so i wonder, am i the first person in australia to make a call on the iphone and speak to someone using our networks without roaming? probably not, but i can safely say that part works.


drmapple:

yes, i found out the iccid appears after a while, but it does not appear the instant after activation. it just 'happens' after a while.


anyway, back to the original topic, has anyone had any ideas about the activation process providing network details etc? has anyone had any success decrypting the data, or do they understand exactly what's being swapped and where? has anyone successfully mounted the iphone and viewed it's files?

cheers.
-adam

gonads
07-18-2007, 08:38 AM
wombat,
My take the last dev update post combined with your theorysounds like you may be right.

The att (410) and iphone code has to be the same as the start of the imsi.

i assume that in the encryted data flow from itunes could easily be sending the codes into the firmware of the chip. And they do state it is a different type of locking in the post

wombat
07-18-2007, 10:40 AM
hi, according to my friend who works for a phone maker, all mobile phones are tested to work with emergency numbers 911/112

EVEN if the phone is under "key lock", EVEN if the phone is WITHOUT sim card inserted

thus it doesn't mean anything except that the GSM bandwidth in your country is supported by iPhone

i never said or implied that it did, i was simply responding to smman. my answer to him was off topic.