Originally Posted by towangcheng

Firstly, the so called China Telecom never runs GSM service in China. There's only China Mobile or China Unicom....

China Mobile or unicom or whatever, it is just to say it works with a Chinese simcard.

Originally Posted by towangcheng

Secondly, please...please do some research before you post, this has been discussed a lot since these batch of iphones have already been opened and a clip has been installed into to board so you don't see anything there.

Originally Posted by XianLi

It doesn't look like it has been opened, there is no scratches or flat screwdriver traces between the metal case and the black plastic cover (bottom back).

We need to find out if it's a:

Software unlock < Is there a way to check the files/whatever to see before opening it ?

Hardware unlock < if it is, why would they downgrade it to 1.0.2 ?

Ditto.

Originally Posted by Zf_

you could start with a ls -alR from / to see if some files are left over

I think you can see if a chip was installed on the baseband by doing a baseband log dump after power cycling (**5005*78283# then copy the dumped files from /var/log - don't synch it from iTunes or you'll miss useful information). The initial IMSI read will be suspicious and thus we should know if it's genuine or not.

you can post the result of an AT+XSIMSTATE=1 through minicom too.

Did you do the 3 things above ? If so, please compact them, upload to rapid-share and send us the link.

With those 3 things we can try to find out what they have done.

Most probably hardware...

*sigh*

Originally Posted by hadimirza

Most probably hardware...

*sigh*

Even if it's hardware, I'm yet to see a hardware unlock guide for 4.6-bootloader, like the old geohot jtag guide.

Is there any hardware unlock guide for the new bootloader ? (jtag, or something ?) I don't belive that they would remove the chip, reprogramm and put them back, that would cost a lot.

Originally Posted by duwde

Even if it's hardware, I'm yet to see a hardware unlock guide for 4.6-bootloader, like the old geohot jtag guide.

Is there any hardware unlock guide for the new bootloader ? (jtag, or something ?) I don't belive that they would remove the chip, reprogramm and put them back, that would cost a lot.

Check this (hardware unlock):

http://www.hackint0sh.org/forum/show...5&postcount=24

The original post:

http://www.iphone.org.hk/cgi-bin/ch/...561&pg=2&bpg=1

You can Download the phone listing here:

http://www.medi@fire.com/?0zcmvsjynum (replace @ by a)

I've removed useless folders.

What about the baseband log and AT+XSIMSTATE=1 ?

This is what independence shows.

Minicom result

Welcome to minicom 2.2

OPTIONS:
Compiled on Jul 21 2007, 05:09:51.
Port /dev/tty.baseband

Press CTRL-A Z for help on special keys

AT S7=45 S0=0 L1 V1 X4 &c1 E1 Q0
OK
AT+XSIMSTATE=1
+XSIM: 2

+XLOCK: "PN",1,0,"PU",5,0,"PP",5,0,"PC",5,0,"PS",5,0

OK

We have confirmation of the existence of some attempt counter for the unlock:
with no unlock attempts +XLOCK returns: "PN",1,0,"PU",5,0,"PP",5,0,"PC",5,0,"PS",5,0
with unlock attempts +XLOCK returns: "PN",3,0,"PU",5,0,"PP",5,0,"PC",5,0,"PS",5,0

The unlock handler dies if the first number is >1 but we're still not sure of its exact meaning and how it is set due to some odd behaviour we observed.
Currently the semantic is believed to be:
0=Unknown, 1=Default/Locked, 2=Unknown, 3=Unknown (has to do with attempts), 4=Lockable, 5=Unlocked

http://iphone.fiveforty.net/wiki/ind...ogress_Reports

I will ask my friend to call the shop and ask them if he can safely update to 1.1.2 (iTunes is asking for) and if it is a hard unlock.

Guys can you also please update us in plain english what does the output of your tests mean? Thanks for your efford by the way! Much appreciated.