iPhone 1.1.2 OTB Software Unlock
Friday, February 8th, 2008 a las 14:20 por Cek
Gracias a George Hotz ya podemos usar nuestro queridísimo teléfono.
El código es espectacular por su sencillez, y además es GPL 
//First exploit, the -0x20000 exploit//This writes the firmware, in all its unsigned glory
//I guess Apple figured -0x400 was simple, -0x20000 is *much* harder
address(0xA0000000,0); //-0x20000, like i said
FILE *bb=fopen(argv[2],"rb");
fseek(bb,0x9a4,SEEK_SET); //skip bbupdater data and secpack
int a,rc=0;
do{
a=fread(data,1,0x800,bb);
if(rc
{
printf("Patching...\n");
data[patchloc-rc+3] = 0xe3;
data[patchloc-rc+2] = 0xa0;
data[patchloc-rc+1] = 0x00;
data[patchloc-rc] = 0x01;
}
if(rc%0x10000==0||a!=0x800) printf("Wrote: 0x%x 0x%x\n",a,rc);
if(a>0)
bbwrite(a,1); //write like hell
rc+=a;
}while(a>0);
//Second exploit, the fake secpack erase range
//If a valid secpack is present in 0×3C0000, the phone won’t boot
//And since endpack doesn’t work, I needed to find another way
const char fakesec[]={0×00,0×00,0×3C,0xA0,0×00,0×00,0×03,0×00,0×00,0×00,0×03,0×00,0×00,0×00,0×00,0×00}; //not 0xA03D0000
memcpy(&rsecpack[0×780],fakesec,0×10);
sendsecpack(rsecpack);
endsecpack();
erase(0xA03D0000,0xA03F0000,1); //the only secpack free allowed erase
close(fp);
resetbaseband();
printf(”Enjoy your unlocked iPhone…\n”);
return 0;
El programa completo en su bitácora
Actualización: Os dejo una guía con instrucciones más sencillitas
Permalink
1 Comentario »
Almacenado en: 
