the reason i dont think its in flash is i havnt been able to read it directly from flash so, know one knows physically (point to a chip) where this nck stuff is stored? i understand w__ w: How do you know what you're looking for? NTT: how do u mean? w: ie how do you know it's not stored somewhere in the flash? NTT because i've physically lifted the chip and read it so either i missed some mode in the flash chip or its in the bb Ok, but the question was "Is the NVRAM stored in the flash"... what signature from NVRAM were you looking for to see if it existed in the flash dump? NTT we know the address nvram is located at nordump etc doesnt read it when i read the flash chip directly i see no extra data ah ok I see so that's a pretty solid indication that it's not on there :) yes w__: so you did a phisical extraction ? yes thats what i been upto all this time so you did it to the bb chip ? no not necesary really the flash chip Why does it matter where it's stored? Presumably we can find the routine that actually writes to NVRAM so we don't care about the underlying mechanics of the write there is an intel flash chip that the bb chip interfaces with i posted a circuit diagram yesterday NTT: it doesnt really matter.. only that if it were in the flash i could have read it it is where the main mem is stored ok oh so its the flash chip we are extracting ? and write to it who wants a circuit diagram? well ipsf can read nvram lol think it will help explain things well that code is in the IPSF that zibri was disassembling, so that's a non-issue so we'll study the routine and modify it ok we should be looking at the nvram before and after ipsf and that would be built upon to make an unlock w__: but how do we do that ? wait w__.. so, you can read the nvram? yeah.. lol what jparker2015 said jparker: we already have the code to read NVRAM it's in IPSF i dont actually know if 'we' can read nvram can i see it NTT? i havnt been working on the flash in the iphone fimrware but 'we' do know ipsf can read it and we have their patch Well I don't have the code, but according to zirbi it reads NVRAM, sends it to the server and then writes back to it after.... so the read/write routines are in the code zibri's done alot of work on ipsf so i think he'll post the code once we have something usefull i'm sure it wouldn't be nice if he did 99% of the work and posted it and the dev team swanned in and did the last 1% and claimed it as their own well read/write routines would be useful :) Once you have read capability then you can do a pre/post comparison someone answer RealBallchalk's question NTT I understand the effort now you should all understand now *testing testing* it doesn't matter where the NVRAM is stored hehe k cool i wanted to see if these lot could answer it hehe np i understand w__ thank you all for the in depth info Yup, I got one. w: thanks alot for sharing all that info, I learned a LOT tonight! wait NTT k NTT: np can I ? I feel like a complete noob here. patch bb temporarily.. nvram to original state something isn't jiving here lol sure I came in knowing nothing :-) Now I need to get myself a phone and jump headlong into this effort what is permanently changed? heheh cool nvram or bb? NVRAM nvram glaz? k, then NTT .. "NVRAM is updated to original state" that is not correct missed a comma i think i see sorry I meant BB is restored to original state * Viper__ has quit ("") BB FW is restored <- has complete understanding I bought an iphone that arrived with 1.1.1 already installed on it. I'm not that bad at modifying stuff. I familliar with shell and stuff. Where can I find an how to from scratch that will help me. so this is a very clean/permanent hack? unless apple goes tinkering w/ nvram? but even then... yes but its very hard for apple to change the lock method now Well Apple could easily change the BB FW to check NVRAM in a different way awesome w: why? yeah, i understand it they would need to have their server generate custom flashes per imei yup w__ because the imei/sim data is per phone yes awesome w: No they wouldn't... w: if you think of it this way looks at his itouch now in retail box contemplating a r r= returnb (my understanding may be completely wrong) ok the BB FW checks NVRAM to validate whether to unlock or not k W__: where does the SIM play into all this ? jparker2015: nowhere simply setting NVRAM to a value doesn't automatically trigger an unlock.. something down the pipe reads that value, right? ok NTT lets assume method 1 k, before you get started w__ the nck is verified against a hash in nvram simple ? k if that's the case, then what prevengts Apple from changing the NVRAM value generation method completely? sim card... what is on it that allows me to take my sim card and put it in another's phone Am I screwd if the iphone I bought has already 1.1.1 on it? and it pulls my account? what is read off it? unim: not a simple ? i'll do it next! k, continue. sorry NTT: the point is that with method 1 the hash(nck) is in nvram w__: iUnlock changes the bb and ipsf changes the nvram... we enter a nck and the bb hash's it it compares that to whats in nvram then jumps to the unlock routine that calculates the new nvram simlock and writes it * illutionz_ has quit (Operation timed out) RealBallchalk: both change the nvram glaz: not screwed u helpable w: Understood... but nothing prevents apple from changing their checking method entirely in the BB FW. For example they could switch from method 1 to method 3 w__: oh NTT no.. to do that they would need to generate AES(IMEI) and store it in each phone's nvram w__: and both leaves the BB in orginal state or no? that would require a specific update per user anywhere I can find an How-to from scratch. I played with dishes before but not iphones :p RealBallchalk: iunlock patch is flawed, and also it doesnt unpatch itself unpatch would be through reflashing with new flashfile then? I found couple of sites interresting, like yours. But it asks me to connect via ssh and do stuff. I don't even have ssh connection to my phone w: I see.. for backwards compatibility, they are screwed.... although they could do a temporary BB patch to write a bunch of stuff and then that code gets overwritten and is never referenced unim.. your phone has an IMSI (unique identifier) and a coresponding secret key (ki) sup everyone. Are any of you guys iPhone resellers? what u need guz? NTT, no they need to generate AES(IMEI) for every phone and write it into nvram.. they could do that with an update sure I want to know how you walk into a store and buy 10+ phones lol but their server would need to read the imei, generate it and upload it to the phone the ki is inside the sim you cant read it the network also knows IMSI and ki no cdhance anything can read a ki from the sims today 0% when u plug the sim in, the phone sends to the network IMSI especially remotely the network sends back a random number the sim encrypts(RND,ki) it splits the number in half and sends half back the network does encrypt (RND,ki) and splits it in half guz: We did that already, my buddy said he was buying those as gifts for his employees. all but the KI are gettable the KI isnt getting anywhere it verifies the against the half that was sent back if it verifies your allowed to make calls the other half **** NEVER SENT OVER THE AIR!!! * it used to encrypt your voice w: yeah you're right.. either do it on the server or use temporary code to generate it and then toss it, but that would be open to exploit from the hacker community NTT yes entirely NTT it would be really stupid.. cos one hacked update and we could generate nck's for everyone feel free pls remove my nick tho otherwise we'll get people searching for me and hounding me with ???'s anyway unim: the IMSI encodes your netowrk and country it is read by the phone and used to lock i.e. only an AT&T imsi will work