PDA

View Full Version : does supersim mod work on firmware 1.0.1?


jowo
08-07-2007, 10:40 AM
........ or it only works on 1.0? thanks :)

JuniorJack
08-07-2007, 10:53 AM
Hi,

Yes, it works fine on latest firmware.

Regards

997TT
08-07-2007, 12:31 PM
........ or it only works on 1.0? thanks :)

The Super SIM method should work with ANY future firmware update since the Super SIM method doesn't mod the iPhone but the SIM card used.

There is a lot of hype regarding the Super SIM method but people have to realize that this is not a method to unlock the iPhone, just a method to allow a cloned SIM card to "trick" the iPhone. This method is not for everyone, it could destroy your current SIM card in the process, you need a V1 SIM (only very old ones!) and if you use both SIMs (original and clone) at the same time, you may get in serious trouble with your cell phone service provider which could lead to very serious consequences too, depending on the country and contract you have.

Zf_
08-07-2007, 12:45 PM
The Super SIM method should work with ANY future firmware update since the Super SIM method doesn't mod the iPhone but the SIM card used.


that's not how I understand it.

It's supposed to work fully (i.e. with a good registration and incoming calls) because there's a bug in the baseband code, that can be fixed.

Use this hacked SIM on another phone - you shouldn't be able to get incoming calls, or even to register to the network if you blank all files before.

ozbimmer
08-07-2007, 01:24 PM
Zf_: Not true. I have used the sim on both iphone and normal phone... works perfectly :)

The method exploits the IMSI request sequence of iphone. Even if the "bug" is fixed in the future, the phone still need to call the sim and request the IMSI... So in some way this method is future-proof depending on how the IMSI request is tackled.

Zf_
08-07-2007, 01:46 PM
Zf_: Not true. I have used the sim on both iphone and normal phone... works perfectly :)


beg to differ here.

From my tests, if you use it on another phone, and get the nice roaming symbol (triangle), which I got on most phones I tried it on, it means that the AT&T IMSI was sent over the network.

i.e., you're back to the unstable SIM clone swapping scenario - you're half registered and can't get incoming calls.


The method exploits the IMSI request sequence of iphone. Even if the "bug" is fixed in the future, the phone still need to call the sim and request the IMSI... So in some way this method is future-proof depending on how the IMSI request is tackled.

well, how do you exploit it if there's no sequence, which is done by approximately all of the phones I've tested it on, meaning that the IMSI is only read once ? :D

ozbimmer
08-07-2007, 01:57 PM
you can choose which phone line to use via the STK menu on a normal phone - problem solved

BTW, the method is devised to be used on the iphone to make/receive calls, never intend to use it on other phones - it's out of the scope of the project :)

Zf_
08-07-2007, 02:14 PM
you can choose which phone line to use via the STK menu on a normal phone - problem solved


depending how the patch is implemented - I don't think you can do that with the current hack.


BTW, the method is devised to be used on the iphone to make/receive calls, never intend to use it on other phones - it's out of the scope of the project :)

fully agree. But since people are asking the question, I think it helps to try to really understand what this hack is doing and if it's fully transparent to the network (which I think it is only on the iPhone, but not on another handset). There are too many assumptions without hard proofs for me currently ... all of this stuff started from a single non documented (but appealing for sure) post :)

ozbimmer
08-07-2007, 03:58 PM
i am using the STK from the current hack. don't understand what you mean :)

I think the principle is quite simple - tell the iphone you are AT&T sim, after this has been done the sim card "intelligently" change its identity to your local carrier sim which enable you to register to your carrier, make/received calls and SMS and also internet if EDGE is available. If you want to know how this happens, have a read of GSM protocol/switching, GMS security and smart card technologies. They are available online (3gpp, etc) and also on Amazon :)

BTW, if you need hard proof, get a ME simulator or sim proxy. The data would give you the proof needed. Also I think I started that "single non documented post" :P

Zf_
08-07-2007, 07:34 PM
i am using the STK from the current hack. don't understand what you mean :)

I think the principle is quite simple - tell the iphone you are AT&T sim, after this has been done the sim card "intelligently" change its identity to your local carrier sim which enable you to register to your carrier, make/received calls and SMS and also internet if EDGE is available. If you want to know how this happens, have a read of GSM protocol/switching, GMS security and smart card technologies. They are available online (3gpp, etc) and also on Amazon :)


uh ? sorry, this is not a smartass contest. The common goal is to explain precisely how things work. That's what hacking is about. So if you want to enlighten us with your GMS leetness, please do. And do refer us to the standards describing a card switching IMSIs between different READ BINARY, by all means :)


BTW, if you need hard proof, get a ME simulator or sim proxy.


that won't prove anything. We need to know if this method can be detected by the operator, or not, when used on an iPhone. I see two ways to do that :

1) Have a GSM sniffer and trace the radio registration. Probably easy, but surely expensive

2) Fully reverse the baseband firmware to see what happens to the storage areas of the different IMSI reads.



The data would give you the proof needed. Also I think I started that "single non documented post" :P

I was referring to iPhone_eu post, that was clearly not documented enough, but had the merit to describe something new.

ozbimmer
08-07-2007, 07:52 PM
Zf_: Not trying to be a smartass, I just don't know what you are looking for... now i know.

You could dump the baseband log onto the hard drive. May be that could help...

Zf_
08-07-2007, 08:10 PM
not detailed enough unfortunately, the RF frames are not dumped.