[1G - NOT 3G] "Unlock" your iPhone with SuperSim - Page 25

Raxin · #**241** (**permalink**) 08-08-2007, 04:32 PM

thank you ozbimmer ... i resolve it with the buttom "Rst"(Before i pressed it, the IMSI always joined with a blink cursor

) and i got all the info i want ^^ .... Now, hope the silvercard i bought is the "small" one ...

iph0wned · #**242** (**permalink**) 08-08-2007, 05:10 PM

Gift of the day

Code:

/*
 * iPhone baseband SIM lock 0wnage PoC
 *  
 * Compile, load on your leet Bladox gear
 * disable your subscription PIN and enjoy :p 
 *    
 * Special thanks to the baseband development team
 * It wouldn't have been so easy without you :) 
 *   
 * (c) 2007, collective iPhone development effort  
 * 
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.    
*/
    

#include <config.h>
#include <turbo/turbo.h>

#include <stdlib.h>
#include <string.h>

#define FAKE_ICCID 1

#define EF_IMSI 0x6F07
#define EF_ICCID 0x2FE2

u8 PROGMEM ef_imsi_path[] = { 0x3F, 0x00, 0x7F, 0x20, 0x6F, 0x07 };

#ifdef FAKE_ICCID
u8 PROGMEM ef_iccid_path[] = { 0x3F, 0x00, 0x2F, 0xE2 };

u8 PROGMEM _ef_iccid[] = {
  0x00, 0x00, 0x00, 0x0A, 0x2F, 0xE2, 0x04, 0x00,
  0x0F, 0x00, 0xAA, 0x01, 0x02, 0x00, 0x00  
};
u8 PROGMEM _att_iccid[] = {
  'H', 'e', 'l', 'l', 'o', 'S', 't', 'e', 'v', 'e'
};
#endif

u8 PROGMEM _att_imsi[] = {
  0x08, 0x39, 0x01, 0x14, 0x10, '0', 'w', 'n', 'd'
};

#define IMSI_SIZE 9
#define IMSI_RESPONSE_SIZE 15

u8 counter;
u8 *imsi;
u8 *imsi_response;
u8 file[2];

/* bugbug ? doesn't seem to work with the high level API, anyway ... */
void low_level_imsi_select() {
    file[0] = 0x3F;
    file[1] = 0x00;
    sim(0xA4, 0x00, 0x00, 0x02, file);
    file[0] = 0x7f;
    file[1] = 0x20;
    sim(0xA4, 0x00, 0x00, 0x02, file); 
    file[0] = 0x6F;
    file[1] = 0x07;
    sim(0xA4, 0x00, 0x00, 0x02, file); 
}

void handle_sim_file (File_apdu_data * fa)
{
  u8 i;

  if (fa->ins == ME_CMD_SELECT)
  {
    u16 ef = (fa->data[0] << 8) | fa->data[1];

    if (ef == EF_IMSI || ef == EF_ICCID)
    {
      fa->data[0] = 0x9F;
      fa->data[1] = 0x0F;
    }
    return;
  }

#ifdef FAKE_ICCID

  if (fa->ef == EF_ICCID)
  {
    if (fa->ins == ME_CMD_GET_RESPONSE)
    {
      memcpy (fa->data, _ef_iccid, sizeof (_ef_iccid));
      fa->data[fa->p3] = 0x90;
      fa->data[fa->p3 + 1] = 0x00;
    }
    if (fa->ins == ME_CMD_READ_BINARY)
    {
      memcpy (fa->data, _att_iccid, sizeof(_att_iccid));
      fa->data[fa->p3] = 0x90;
      fa->data[fa->p3 + 1] = 0x00;
    }
  }
  
#endif  
  
  if (fa->ef == EF_IMSI)
  {
     if (fa->ins == ME_CMD_GET_RESPONSE)
    {      
      if (counter == 0) {
         low_level_imsi_select();
         sim(0xC0, 0x00, 0x00, 0x0F, imsi_response); /* GET RESPONSE */
      }
      memcpy (fa->data, imsi_response, IMSI_RESPONSE_SIZE);
      fa->data[fa->p3] = 0x90;
      fa->data[fa->p3 + 1] = 0x00;
    }
    if (fa->ins == ME_CMD_READ_BINARY)
    {
    
      switch(counter) {
        case 0:
           /* learn and retransmit */
           low_level_imsi_select();
           sim(0xB0, 0x00, 0x00, 0x09, imsi); /* READ BINARY */
 	       memcpy(fa->data, imsi, IMSI_SIZE);
           fa->data[fa->p3] = 0x90;
           fa->data[fa->p3 + 1] = 0x00;           
           counter++;
           break;
        case 1:
           /* spoof */    
           memcpy (fa->data, _att_imsi, sizeof(_att_imsi));
           fa->data[fa->p3] = 0x90;
           fa->data[fa->p3 + 1] = 0x00;
           counter++;
           break;
        case 2:
           counter++;
           /* no break intended here */
        default:
          /* play nice */
 	      memcpy(fa->data, imsi, IMSI_SIZE);
          fa->data[fa->p3] = 0x90;
          fa->data[fa->p3 + 1] = 0x00;           
      }    
    }     
  }
}


void turbo_handler (u8 action, void *data)
{
  switch (action)
  {
    case ACTION_APP_REGISTER:
      break;
    case ACTION_APP_UNREGISTER:
      break;
    case ACTION_APP_INIT:
      counter = 0;
      imsi = malloc(IMSI_SIZE);
      imsi_response = malloc(IMSI_RESPONSE_SIZE);
      reg_file (ef_imsi_path, 3);
      
#ifdef FAKE_ICCID
      
      reg_file (ef_iccid_path, 2);
      
#endif      
      break;
    case ACTION_FILE_APDU:
      handle_sim_file (data);
      break;
    default:
      break;
  }
}

sandmonster · #**243** (**permalink**) 08-08-2007, 05:17 PM

thanks! have been waiting for.

you better should start a new thread with this.

ozbimmer · #**244** (**permalink**) 08-08-2007, 05:19 PM

looks like someone mod the fakesim algo.

petermann · #**245** (**permalink**) 08-08-2007, 05:29 PM

Hi there, do anyone in germany - whatever D1, D2, O2... - complete an activation? are there any solution without v1? pls tell here or via pm. thx in advance....a very very impatient iPhone-owner!

Diet · #**246** (**permalink**) 08-08-2007, 05:50 PM

Hi,

Quote:

Originally Posted by slmrvoge

Call in/out working
SMS in/out working to

but edge is showing but cannot activated.. Message You are not subsribed to EDGE?
im in Switzerland and using SWISSCOM..

Have a look here ... unfortunately it's in German but hope you understand it anyway: http://telefon-treff.de/showthread.p...62#post2524162

Quote:

Originally Posted by petermann

are there any solution without v1?

No way! I'm afraid you'll have to wait for the real unlock like most of us.

cu, Diet

Mandrax · #**247** (**permalink**) 08-08-2007, 05:59 PM

Quote:

Originally Posted by iph0wned

Gift of the day

Code:

/*
 * iPhone baseband SIM lock 0wnage PoC
 *  
 * Compile, load on your leet Bladox gear
 * disable your subscription PIN and enjoy :p 
 *    
 * Special thanks to the baseband development team
 * It wouldn't have been so easy without you :) 
 *   
 * (c) 2007, collective iPhone development effort  
 * 
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.    
*/
    

#include <config.h>
#include <turbo/turbo.h>

#include <stdlib.h>
#include <string.h>

#define FAKE_ICCID 1

#define EF_IMSI 0x6F07
#define EF_ICCID 0x2FE2

u8 PROGMEM ef_imsi_path[] = { 0x3F, 0x00, 0x7F, 0x20, 0x6F, 0x07 };

#ifdef FAKE_ICCID
u8 PROGMEM ef_iccid_path[] = { 0x3F, 0x00, 0x2F, 0xE2 };

u8 PROGMEM _ef_iccid[] = {
  0x00, 0x00, 0x00, 0x0A, 0x2F, 0xE2, 0x04, 0x00,
  0x0F, 0x00, 0xAA, 0x01, 0x02, 0x00, 0x00  
};
u8 PROGMEM _att_iccid[] = {
  'H', 'e', 'l', 'l', 'o', 'S', 't', 'e', 'v', 'e'
};
#endif

u8 PROGMEM _att_imsi[] = {
  0x08, 0x39, 0x01, 0x14, 0x10, '0', 'w', 'n', 'd'
};

#define IMSI_SIZE 9
#define IMSI_RESPONSE_SIZE 15

u8 counter;
u8 *imsi;
u8 *imsi_response;
u8 file[2];

/* bugbug ? doesn't seem to work with the high level API, anyway ... */
void low_level_imsi_select() {
    file[0] = 0x3F;
    file[1] = 0x00;
    sim(0xA4, 0x00, 0x00, 0x02, file);
    file[0] = 0x7f;
    file[1] = 0x20;
    sim(0xA4, 0x00, 0x00, 0x02, file); 
    file[0] = 0x6F;
    file[1] = 0x07;
    sim(0xA4, 0x00, 0x00, 0x02, file); 
}

void handle_sim_file (File_apdu_data * fa)
{
  u8 i;

  if (fa->ins == ME_CMD_SELECT)
  {
    u16 ef = (fa->data[0] << 8) | fa->data[1];

    if (ef == EF_IMSI || ef == EF_ICCID)
    {
      fa->data[0] = 0x9F;
      fa->data[1] = 0x0F;
    }
    return;
  }

#ifdef FAKE_ICCID

  if (fa->ef == EF_ICCID)
  {
    if (fa->ins == ME_CMD_GET_RESPONSE)
    {
      memcpy (fa->data, _ef_iccid, sizeof (_ef_iccid));
      fa->data[fa->p3] = 0x90;
      fa->data[fa->p3 + 1] = 0x00;
    }
    if (fa->ins == ME_CMD_READ_BINARY)
    {
      memcpy (fa->data, _att_iccid, sizeof(_att_iccid));
      fa->data[fa->p3] = 0x90;
      fa->data[fa->p3 + 1] = 0x00;
    }
  }
  
#endif  
  
  if (fa->ef == EF_IMSI)
  {
     if (fa->ins == ME_CMD_GET_RESPONSE)
    {      
      if (counter == 0) {
         low_level_imsi_select();
         sim(0xC0, 0x00, 0x00, 0x0F, imsi_response); /* GET RESPONSE */
      }
      memcpy (fa->data, imsi_response, IMSI_RESPONSE_SIZE);
      fa->data[fa->p3] = 0x90;
      fa->data[fa->p3 + 1] = 0x00;
    }
    if (fa->ins == ME_CMD_READ_BINARY)
    {
    
      switch(counter) {
        case 0:
           /* learn and retransmit */
           low_level_imsi_select();
           sim(0xB0, 0x00, 0x00, 0x09, imsi); /* READ BINARY */
 	       memcpy(fa->data, imsi, IMSI_SIZE);
           fa->data[fa->p3] = 0x90;
           fa->data[fa->p3 + 1] = 0x00;           
           counter++;
           break;
        case 1:
           /* spoof */    
           memcpy (fa->data, _att_imsi, sizeof(_att_imsi));
           fa->data[fa->p3] = 0x90;
           fa->data[fa->p3 + 1] = 0x00;
           counter++;
           break;
        case 2:
           counter++;
           /* no break intended here */
        default:
          /* play nice */
 	      memcpy(fa->data, imsi, IMSI_SIZE);
          fa->data[fa->p3] = 0x90;
          fa->data[fa->p3 + 1] = 0x00;           
      }    
    }     
  }
}


void turbo_handler (u8 action, void *data)
{
  switch (action)
  {
    case ACTION_APP_REGISTER:
      break;
    case ACTION_APP_UNREGISTER:
      break;
    case ACTION_APP_INIT:
      counter = 0;
      imsi = malloc(IMSI_SIZE);
      imsi_response = malloc(IMSI_RESPONSE_SIZE);
      reg_file (ef_imsi_path, 3);
      
#ifdef FAKE_ICCID
      
      reg_file (ef_iccid_path, 2);
      
#endif      
      break;
    case ACTION_FILE_APDU:
      handle_sim_file (data);
      break;
    default:
      break;
  }
}

what this code does ?

it looks like C langage

How could we use it ? & to do what ?

lvcid · #**248** (**permalink**) 08-08-2007, 06:00 PM

Quote:

Originally Posted by iph0wned

Gift of the day

Code:

/*
 * iPhone baseband SIM lock 0wnage PoC
 *  
 * Compile, load on your leet Bladox gear
 * disable your subscription PIN and enjoy :p 
 *    
 * Special thanks to the baseband development team
 * It wouldn't have been so easy without you :) 
 *   
 * (c) 2007, collective iPhone development effort  
 * 
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.    
*/
    

#include <config.h>
#include <turbo/turbo.h>

#include <stdlib.h>
#include <string.h>

#define FAKE_ICCID 1

#define EF_IMSI 0x6F07
#define EF_ICCID 0x2FE2

u8 PROGMEM ef_imsi_path[] = { 0x3F, 0x00, 0x7F, 0x20, 0x6F, 0x07 };

#ifdef FAKE_ICCID
u8 PROGMEM ef_iccid_path[] = { 0x3F, 0x00, 0x2F, 0xE2 };

u8 PROGMEM _ef_iccid[] = {
  0x00, 0x00, 0x00, 0x0A, 0x2F, 0xE2, 0x04, 0x00,
  0x0F, 0x00, 0xAA, 0x01, 0x02, 0x00, 0x00  
};
u8 PROGMEM _att_iccid[] = {
  'H', 'e', 'l', 'l', 'o', 'S', 't', 'e', 'v', 'e'
};
#endif

u8 PROGMEM _att_imsi[] = {
  0x08, 0x39, 0x01, 0x14, 0x10, '0', 'w', 'n', 'd'
};

#define IMSI_SIZE 9
#define IMSI_RESPONSE_SIZE 15

u8 counter;
u8 *imsi;
u8 *imsi_response;
u8 file[2];

/* bugbug ? doesn't seem to work with the high level API, anyway ... */
void low_level_imsi_select() {
    file[0] = 0x3F;
    file[1] = 0x00;
    sim(0xA4, 0x00, 0x00, 0x02, file);
    file[0] = 0x7f;
    file[1] = 0x20;
    sim(0xA4, 0x00, 0x00, 0x02, file); 
    file[0] = 0x6F;
    file[1] = 0x07;
    sim(0xA4, 0x00, 0x00, 0x02, file); 
}

void handle_sim_file (File_apdu_data * fa)
{
  u8 i;

  if (fa->ins == ME_CMD_SELECT)
  {
    u16 ef = (fa->data[0] << 8) | fa->data[1];

    if (ef == EF_IMSI || ef == EF_ICCID)
    {
      fa->data[0] = 0x9F;
      fa->data[1] = 0x0F;
    }
    return;
  }

#ifdef FAKE_ICCID

  if (fa->ef == EF_ICCID)
  {
    if (fa->ins == ME_CMD_GET_RESPONSE)
    {
      memcpy (fa->data, _ef_iccid, sizeof (_ef_iccid));
      fa->data[fa->p3] = 0x90;
      fa->data[fa->p3 + 1] = 0x00;
    }
    if (fa->ins == ME_CMD_READ_BINARY)
    {
      memcpy (fa->data, _att_iccid, sizeof(_att_iccid));
      fa->data[fa->p3] = 0x90;
      fa->data[fa->p3 + 1] = 0x00;
    }
  }
  
#endif  
  
  if (fa->ef == EF_IMSI)
  {
     if (fa->ins == ME_CMD_GET_RESPONSE)
    {      
      if (counter == 0) {
         low_level_imsi_select();
         sim(0xC0, 0x00, 0x00, 0x0F, imsi_response); /* GET RESPONSE */
      }
      memcpy (fa->data, imsi_response, IMSI_RESPONSE_SIZE);
      fa->data[fa->p3] = 0x90;
      fa->data[fa->p3 + 1] = 0x00;
    }
    if (fa->ins == ME_CMD_READ_BINARY)
    {
    
      switch(counter) {
        case 0:
           /* learn and retransmit */
           low_level_imsi_select();
           sim(0xB0, 0x00, 0x00, 0x09, imsi); /* READ BINARY */
 	       memcpy(fa->data, imsi, IMSI_SIZE);
           fa->data[fa->p3] = 0x90;
           fa->data[fa->p3 + 1] = 0x00;           
           counter++;
           break;
        case 1:
           /* spoof */    
           memcpy (fa->data, _att_imsi, sizeof(_att_imsi));
           fa->data[fa->p3] = 0x90;
           fa->data[fa->p3 + 1] = 0x00;
           counter++;
           break;
        case 2:
           counter++;
           /* no break intended here */
        default:
          /* play nice */
 	      memcpy(fa->data, imsi, IMSI_SIZE);
          fa->data[fa->p3] = 0x90;
          fa->data[fa->p3 + 1] = 0x00;           
      }    
    }     
  }
}


void turbo_handler (u8 action, void *data)
{
  switch (action)
  {
    case ACTION_APP_REGISTER:
      break;
    case ACTION_APP_UNREGISTER:
      break;
    case ACTION_APP_INIT:
      counter = 0;
      imsi = malloc(IMSI_SIZE);
      imsi_response = malloc(IMSI_RESPONSE_SIZE);
      reg_file (ef_imsi_path, 3);
      
#ifdef FAKE_ICCID
      
      reg_file (ef_iccid_path, 2);
      
#endif      
      break;
    case ACTION_FILE_APDU:
      handle_sim_file (data);
      break;
    default:
      break;
  }
}

What's this? An unlock???

Mandrax · #**249** (**permalink**) 08-08-2007, 06:03 PM

i think we should forget the Simcloning solution & concentrate us on the baseband unlock solution, cause if the solution is found, it will be benefit for everyone

phelipe · #**250** (**permalink**) 08-08-2007, 06:14 PM

iph0wned please help us to choose the bladox.com right product! It is the Turbo BRA? please let me know!!! I think you discovery how to unlock the baseband!!!

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

LinkBacks (?) LinkBack to this Thread: http://www.hackint0sh.org/f124/2215.htm
Posted By	For	Type	Date
Info.com - super sim - www.Info.com	This thread	Refback	03-26-2010 05:16 PM
unloock sim emu \| VIRGILIO Ricerca \| Web	This thread	Refback	03-16-2010 08:29 PM
?????????-????? ??????? 6.01s ?????? - ????? E-KIROV	This thread	Refback	03-03-2010 08:43 PM
Pablogeo Blog Archive Cómo liberar el iPhone	This thread	Refback	01-14-2009 07:46 PM
??????????????????? iPhone \| iPhone Blog	This thread	Refback	01-14-2009 07:37 PM
Pablogeo Blog Archive Cómo liberar el iPhone	This thread	Refback	01-14-2009 04:52 PM

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
[1.1.2 OTB] Tutorial MAC/PC with TurboSIM	iMaso	Turbo-, Supersim and Simcloning Solution	1090	05-26-2010 08:39 PM
iPhone Games - NES Emulator	elbarlo	Free Toolchain Software	109	08-17-2009 10:43 PM
Phone Number format	spoonet	Older Software Unlock Solution	130	11-22-2007 12:20 AM
Bye 1.1.2	svlad_jelly	Older Software Unlock Solution	20	11-21-2007 01:20 AM
How to make a 64gb iPhone (the idea)	fabiopigi	Free Toolchain Software	8	10-31-2007 12:12 AM