Estou usando uma imagem do Engadget, mas esta é exclusiva do Updaters. Antes do Engadget e do Gizmodo: simfree acaba de ser desbloqueado por dois hackers do canal #iphone.unlock. Menos de 48 após o lançamento do aplicativo. Zappaz e Guest184 conseguiram o que parecia impossível desde o início. A solução ainda não está disponível e os dois estão trabalhando. Conseguiram escrever no BaseBand. Ou seja, a partir de agora, tudo é possível. Caiu a última limitação. Em no máximo dois dias, você poderá baixar de graça o programa de desbloqueio. Se você quiser ler o diálogo entre Guest 184, Geohot e Zappaz, aí vai:
UPDATE: Geohot entrou de novo no circuito. acaba de informar que em duas horas terá o patch que libera o simfree. Enquanto isso, a Apple se move: o novo update de iTunes, 7.4.1(2) checa se o SIM é ou não AT&T. Se não é, não faz sync.
UPDATE2: Passado o prazo solicitado por Geohot, o canal #iphone.unlock está fervilhando. Casa cheia. 264 usuários. O canal foi setado para moderado, ou seja, só os ops podem falar. Estão lá, Zappaz, Geohot, Guest184 e até o legendário Gray, um dos hackers de telefonia celular mais conhecidos do mundo. A solução está mesmo nas mãos de Zappaz. Ao invés de corrigir o programa simfree, optou por escrever um novo aplicativo. Para a surpresa de todos, a solução é muito, muito simples, bastava escrever no BaseBand, que todos achavam que era impossível. Para quem se interessa, aqui está o código original. Geohot vai escrever o aplicativo. Em breve, será distribuído gratuitamente. Não compre simfree.
UPDATE3: Reviravolta completa aos 45 minutos do segundo tempo. O DevTeam acaba de lançar um free unlock. Aqui está (cuidado. Isso é o que se chama de bleeding edge. Não use se não souber o que está fazendo.)
Se você quer desbloquear seu iPhone, siga essas instruções.
Para entender como funciona este novo unlock:
O Baseband, que é o software do rádio do iPhone, proíbe que você escreva a partir do endereço a0020000, alterando o seu conteúdo. Mas, curiosamente, não se importa se você começar a escrever no endereço 0xa002000-menos-0×400 e seguir em frente, até mesmo após o a0020000. Assim, começando antes, é possível alterar o NCK.
08:32 zappaz ok, here’s how it works
08:32 drh nice one
08:33 geohot shhh….
08:33 gray geohot, wtf?
08:33 guest184 a bird told me that some tool will be released in next 10 mins 
08:33 geohot wtf?
08:34 spoon_sf ?
08:34 gray what did i tell u to mislead blah-blah?
08:34 r-chimp Wtf?
08:34 zappaz the way NOR writing works via imode is that it will write everything except for the first 0×400 bytes
08:34 zappaz the first 0×400 bytes are only written when the signature check passes
08:34 zappaz this is critical because this area contains the start function pointer and the tag
08:35 r-chimp Holy fuck
08:35 zappaz anyway.. this problem is easily circumvented
08:35 geohot well the data has to go somewhere…
08:35 zappaz when you do the initial seek command (0×802), simply subtract 0×800 from the address
08:35 Apollon- what do u mean easily? how do u do that
08:36 zappaz so 0xA002000 becomes 0xA001F800
08:36 geohot why 0×800 and not 0×400?
08:36 zappaz then send a dummy 0×800 bytes at the start
08:36 zappaz well, 0×400 might work too.. 0×800 was my test because its the page size
08:36 zappaz 0×800 is tested, 0×400 would probably work
08:36 zappaz so, using this method you can write anything to nor
08:36 geohot wow…..
08:37 gray 0×400 works as well
08:37 genmach ha brilliant
08:37 zappaz so i just flashed my ICE dump, patched with gray’s hack (thanks :))
08:37 geohot this isn’t the exploit ipsf uses tho
08:37 zappaz no its not, which is why its sorta cool
08:37 zappaz it means we didnt even need to rip them off to do it
08:38 geohot how did no one find this?
08:38 zappaz you tell me
08:38 geohot really great job
08:38 r-chimp You tell three
08:38 speedyAZ you guys just found it
08:38 drh cos they stopped looking?
08:38 zappaz I was always told that you “can not write” to nor without auth
08:38 zappaz so I never looked into it until now
08:38 genmach i think ipsf’s contribution (via guest184) was to go ahead and write to the nor with the given secpack
08:38 drh exactly
08:38 geohot umm, i did that in ieraser
08:39 geohot i always figured the data needed to go somewhere
08:39 genmach yeah i’ve just never seen anyone use 0×804 before
08:39 geohot daeken told me it’s overwritten randomly
08:39 geohot yea, no tool used 0×804 to date
08:39 genmach you use ieraser to erase, then your custom bootloader to do the write in your own routine, right? not using 0×804
08:40 geohot don’t even bother with ieraser
08:40 Server sixcaps (~sixcaps@68.33.170.219) has joined the room
08:40 geohot coe it into the tool
08:40 geohot *code
08:40 zappaz all the data structs for 0×804 are in the nordumper headers though
08:40 zappaz you dont even need to reverse anything to figure it out
08:40 Server Berkz (~Berkz@194-144-10-217.du.xdsl.is) has joined the room
08:40 zappaz i need to go to bed soon, dont have time to turn this into a nice app.. but im sure there will be people willing 
08:41 zappaz its such a simple method
Aqui Geohot afirma que em duas horas terá o simfree hackeado:
06:22 geohot ok
06:22 Server guest184 has left the room
06:22 Server churd has quit IRC (Read error: EOF from client)
06:22 Server lolof (~lolof@pD9E9D37A.dip.t-dialin.net) has joined the room
06:22 geohot you patch the first validation and it downloaded the loader
06:22 geohot the loader gets the fingerprint
06:23 geohot normally the server would gen the token
06:23 geohot but it doesn’t because you are valid imei
06:23 geohot *aren’t
06:23 geohot so…
06:23 geohot during the cleanup phase the loader puts back the firmware
06:23 Server tomelders has quit IRC (Signed off)
06:23 geohot simply patch the firmware in between the loading of the loader and the reupload
06:23 Server pope has left the room
06:23 geohot give me 2 hours
06:24 Server geohot has removed the “moderated” room mode
06:24 Solearius thx
06:24 zebrum amazin
06:24 addajee great job
06:24 Server orre has quit IRC (Quit)
06:24 Apollon- yeah great update
Este é o diálogo de durante a tarde
03:34 geohot why do you call it hl_loader?
03:34 guest184 if things really like i think - we can run OWN code
03:34 geohot why hl?
03:34 guest184 why not ?
03:35 az1324 but does the token contain instructions
03:35 guest184 token is part of loader
03:35 geohot somehow this loader runs
03:35 az1324 thats what it was called in that file someone distribd
03:35 geohot it appears to just write it
03:35 zappaz guest184, I’m going as fast as I can
03:35 guest184 that loader utilises bug in bootloader
03:35 geohot like write it normally
03:35 Mads_ have you looked at the decoded file of simfree?
03:35 geohot what bug?
03:35 geohot explain the bug
03:35 geohot i’m just missing that part
03:36 florin_m i think is using the stack overflow bug
03:36 geohot where?
03:36 geohot and how?
03:36 Draken perhaps it asks the baseband nice if it can come in for tea…. j/k ;P
03:36 florin_m is a ussual but in the siemens bootloaders
03:36 guest184 w8 a bit - much writing
03:36 geohot writing?
03:37 geohot they have something that generates tokens
03:37 guest184 so, there is some dword at ICE mode image at a0020410
03:37 geohot someone said it survived 1.0 to 1.02
03:37 Mads_ http://home.no/dehussler/ - there is the decoded files of simfree
03:37 guest184 that is some kind of firmware version
03:37 Draken how is that possable geohot ?
03:37 guest184 to prevent downgrade,etc
03:38 geohot ok
03:38 J_unlocked The 5 in the AT+CLCK
03:38 guest184 bootloader checks that dword at end of flash (end secpack)
03:38 Draken think they made it change the version on the bb to like 999, so if something trys to upgrade, it thinks its new ?
03:38 geohot guest184, keep explaining
03:39 geohot a0020410 is blank in the loader
03:39 guest184 and if there NOTHING in flash file at that position - i repeat - that is IMHO - it accepts flashfile is valid
03:39 guest184 of course, flash must be erased too
03:39 geohot wow, thats a big bug
03:39 Draken 
03:39 guest184 that should be tested asap
03:40 IRpaj IPSF is a firmware patch or full unlock?
03:40 geohot somehow test it
03:40 geohot *someone
03:40 guest184 thats why i annoying all here ;)
03:40 zappaz geohot, as I said.. working on it
03:40 Draken good stuffs
03:40 Draken
03:40 zappaz im a bit slow because this is the first time I’ve used my mac for dev
03:40 geohot then we can simply patch our firmware with the patch from the hw unlock
03:40 geohot why dev?
03:40 zappaz ya
03:40 geohot use bbupdater
03:40 guest184 @geohot true
03:41 IRpaj hmm….
03:41 zappaz hrm, ya
03:41 guest184 but bbuopdater checks version
03:41 Server Becky12 (AmoritavMw@62.57.238.149.dyn.user.ono.com) has joined the room
03:41 geohot patch it
03:41 zappaz it’ll probably be faster to finish this app than to patch it
03:41 Server duskglum (same@89.149.217.81) has joined the room
03:41 zappaz almost there..
03:41 Server Becky12 has quit IRC (Read error: Connection reset by peer)
03:41 zappaz bbs
