Ceklog

Gracias a George Hotz ya podemos usar nuestro queridísimo teléfono.

El código es espectacular por su sencillez, y además es GPL

//First exploit, the -0x20000 exploit

//This writes the firmware, in all its unsigned glory

//I guess Apple figured -0x400 was simple, -0x20000 is *much* harder

address(0xA0000000,0); //-0x20000, like i said

FILE *bb=fopen(argv[2],"rb");

fseek(bb,0x9a4,SEEK_SET); //skip bbupdater data and secpack

int a,rc=0;

do{

a=fread(data,1,0x800,bb);

if(rc

{

printf("Patching...\n");

data[patchloc-rc+3] = 0xe3;

data[patchloc-rc+2] = 0xa0;

data[patchloc-rc+1] = 0x00;

data[patchloc-rc] = 0x01;

}

if(rc%0x10000==0||a!=0x800) printf("Wrote: 0x%x 0x%x\n",a,rc);

if(a>0)

bbwrite(a,1); //write like hell

rc+=a;

}while(a>0);

//Second exploit, the fake secpack erase range

//If a valid secpack is present in 0×3C0000, the phone won’t boot

//And since endpack doesn’t work, I needed to find another way

const char fakesec[]={0×00,0×00,0×3C,0xA0,0×00,0×00,0×03,0×00,0×00,0×00,0×03,0×00,0×00,0×00,0×00,0×00}; //not 0xA03D0000

memcpy(&rsecpack[0×780],fakesec,0×10);

sendsecpack(rsecpack);

endsecpack();

erase(0xA03D0000,0xA03F0000,1); //the only secpack free allowed erase

close(fp);

resetbaseband();

printf(”Enjoy your unlocked iPhone…\n”);

return 0;

El programa completo en su bitácora

Actualización: Os dejo una guía con instrucciones más sencillitas