Baseband 1.45 International (Unlocked) and AT&T (locked) Compare.
I had the chance to have 2 iPhones 3G. One is from 3 Hong Kong, and one is from AT&T. The one from Hong Kong of course is SIM Free (unlocked) and another is stucked with AT&T.
I have dumped both the Intel NOR flash chips which are holding the basebands using a hardware programmer and carefully compared them with the hope to find some ways to unlock.
What I could found here are:
- The flash size is 4 times bigger than the old one (16Mb instead of 4Mb).
- The bootloader 5.8 size is 0x40000 bytes instead of 0x20000 bytes that of Bootloader 3.9 and 4.6. Baseband starts at 0x40000
- Both dumped files are identical from 0x000000 to 0xE40000 which is the end of basebands.
- I was not capable to find any bug but have done following: Wrote the whole unlocked baseband to the locked chip and soldered back. In the result, I got IMEI 0049xxx, it was predictable because of wrong IMEI and CHIPID. Next, I did the same but kept the seczone intact. In the result, I got IMEI, S/N, MAC address back but still got No Service. :(
So, The posibilities here are:
- The lock state is in the seczone, and its position depends on the combination of IMEI+NORID, wrong modification may cause to 0049xx IMEI.
- The lock state is in the Proccessor X-Gold 608 not in the Intel NOR flash. Taking it out of the board and read it is much harder than that with the Intel NOR flash.
Any one can help to find ways to unlock, feel free to contact me. I can give both dumped files, I can modify, patch these files, rewrite the NOR chip and solder them back with no problem.
Curious people please just wait for professionals