|
iPhoneBrick
Want to know why your phones got bricked?
Want to know why your phones got bricked?AnySIM and iUnlock were patched to make a routine exit with 0 (successful) to unlock the phone. Only problem was that that routine is not only called by NCK but rather by about six routines total because the baseband code is very well optimized. An analogy was made in IRC that it was basically like patching memcpy. The other five didn't expect 00 to be there and were therefore spammed across your BB during upgrade. For those of you clammoring to see some code, here it is. You can read anySIM's source if you want further proof. We see here the disassembly of the baseband where the patch was made: Zibri: ROM:A0237B38 MOV R0, R6
Zibri: ROM:A0237B3C BL IMPORTANT_ROUTINE
Zibri: ROM:A0237B40 CMP R0, #0
Zibri: ROM:A0237B44 BNE exit ; NOP
Zibri: ROM:A0237B48 ADR R0, a00000000 ; "00000000"
Zibri: ROM:A0237B4C LDMIA R0, {R0,R1}
Zibri: ROM:A0237B50 STR R0, [R5,#0x28]
Zibri: ROM:A0237B54 STR R1, [R5,#0x2C]
Zibri: ROM:A0237B58 B loc_A0237B98Here we see the actual patch: Zibri: ROM:A0235148 ; PATCH: MOV R0, 0 Zibri: ROM:A0235148 MOV R0, R4 They just changed "MOV R0, R4" to "MOV R0, 0" IMPORTANT_ROUTINE is what would be memcpy in the analogy. The patch was made to cause IMPORTANT_ROUTINE exit 0 (successful) by putting 'MOV R0, #0' at the end. The coder wanted that routine to go to the "00000000". Possibly attempts were made to NOP at the comment above but it was unsuccessful. Possibly other routines were NOPed, but no luck. So the person put 0 inside the routine and bam! it unlocked. But as was stated above, this is the wrong routine. So again, imagine you'd patched memcpy to behave this way. Now that the secpak for 1.1.1 has been recovered we have provided a tutorial here that will allow safe downgrade to 1.0.2's baseband so you can use your phone again. iPhoneSIMFree claims to be able to reverse anySIM's damage and unlock a 1.1.1 phone that was "bricked" by the update. However, it is yet unclear whether they're actually rebuilding the NOR seczone or merely patching out the integrity checks. However, Zibri is hopeful that he can find a better place to patch but it requires extensive testing. Meanwhile, our reverse-engineering of IPSF's method continues to offer helpful insight into how this should be done properly. If you have 1.0.2 and a 3.14.08 baseband, locked and activated (no matter if legit or not) and are willing to test (and are not completely clueless) please contact us in IRC (link on the frontpage.) |
Sign in to add a comment
Those of us with bricked iphones commend your work. I noticed that there is very little chatter about any kind of baseband update for those who have already used the anysim. I'll bookmark the project home keep checking in.
I'm not sure what all the maligning is about. The majority of the iPhone Dev Team isn't smart enough to deal with baseband issues (myself included). The ones who actually know their stuff baseband-wise are working on it.
@nate -- By "working on it" you mean 'sam' is? I have logged several times him threatening to delete his virginizing code because he was in a "bad mood." He refuses to release anything to give anyone hope that their phones can be saved and when Zibri contacted him to help he felt intimidated and outright banned Zibri from dev. Who are these people?? "The Dev Team" ??? Something's fishy between them and IPSF and the donations...
I've learned a lot from sitting in the iPhone-dev chat and keeping my mouth shut. I'm quite thankful I'm allowed to gain any insight into this process at all with my limited C experience. The chat is also not meant for these personal dramas. That said, things happen we're only human right? Listen for anyone to say they know this or that about what happened between sam and Zibri isn't helping. I was in the chat that day but I don't want to keep this going. If there are 2 separate teams I don't see that as a negative for the general public. Cheap shots are immature but you keep coming up with good contributions that do us well and we'll all continue to be very appreciative. Thank you all for taking the time to do what Apple isn't yet?? willing to. You're all brilliant and just want to help. I believe every dev has a good heart to dedicate all this time to the project. Keep up the good work and thank you again.
The unlocks came with big scary warnings that this was possibly not a good thing. We knew (or should have known) what we were in for. I can't feel too much pity for the people who blithely bricked their phones because they didn't pay attention.
That said, I think it is important to fix the problems made to the 1.0.2 baseband for those who have not upgraded and to restore proper operation for those who upgraded to 1.1.1. I don't know that the 1.1.1 jailbreak priority is right or not. I do know that priority is all but met now, so it's a moot point today.
What I do know is that trying to incite a virtual riot against the original dev team serves no practical purpose except to fracture the development community. It's unbecoming of serious developers to do that because it only makes us weaker against 1.1.2 when it comes out and breaks everybody's work all over again.
There's a personality conflict at the center of this, and there are both sides and yadda yadda.. I don't care who is right. Probably both were right, and both were wrong. It's time to conclude that you've both been asses to each other and move on.
Don't these instructions (http://iphonegoboom.com/#restore) restore everything?
So when will iPSF start resetting our basebands and reunlock our phones the proper way, as I read on the other wiki entry - they remove and then replace the baseband with a virgin one during unlock procedure?
Now I regret that I payed for iPSF, and couldnt wait 3 hours, so i used anySim. I actually regreted it the same evening - but now, its even worse (My IMEI is still registered on iPSF site, but I havent used the unlock - guessing its sticking there 'till I can get my bb virginized and ready for a new, "real" unlock!).
But, I do hope you all will resolve this the best way possible and that I can order myself another 1.1.1 phone and unlock, 'cause then my girl can get this other one I have. :) - And I can get a proper unlocked one. =D
Good luck - and if you ever choose to accept donations, tell me!
This is absolutely ridiculous. The original dev team's hack was based on exploiting bugs in Apple's implementation, as will any unlock developed by this splinter dev team. Get over your idiotic hopes of internet fame and actually work together... isn't that the spirit of this whole endeavor in the first place?
http://andreas.louca.org/2007/09/30/iphone-unlock-frenzy/ seems to prove that simply reflashing the baseband firmware with the original file works.
"We want this fixed -- we want them to take responsibility for their bunk code."
THANK YOU! Finally someone is stepping up and putting voice to the growing frustration. No one wants to be ungrateful, but I have become frustrated with the attitude of 1) repeatedly asking for donations, 2) not providing any useful progress updates, 3) responding with hostility and arrogance to requests for updates.
On September 25, the "iPhone Dev Team" issues a statement saying "We will provide you with a tool in the next week which will be able to recover your nck counter and seczones and even enables you to restore your phone to a Factory-like state."
Then nothing. They move on and hack away at 1.1.1. The statement sounded like their tool was nearly complete. But it appears to be vaporous. There is no follow-up statement or progress report.
The baseband has to be fixed!
I have sat quietly watching these events unfold. I have been biting my tongue. Finally the story is being told and frustrations are being vented.
People want an honest accounting of the baseband corruption problem and an open discussion of how it is being addresses.
I hope the elite team or the original dev team will focus first on restoring 1.0.2 phones to allow upgrade to 1.1.1. Most people weren't insane enough to update from 1.0.2 to 1.1.1 if they had used anySIM. We're stuck in limbo, we can't update to 1.1.1 and take advantage of apps once 1.1.1 is hacked.
Plus, fixing the problem in 1.0.2 doesn't require the hacking effort to gain access to 1.1.1. And, since there is a workable downgrade method from 1.1.1 to 1.0.2 even those who did upgrade can probably still be helped.
And last but not least, it would be crazy to develop a 1.1.1 repair tool as that would require people with working phones on 1.0.2 (though possibly at risk) to risk a brick just to get a fix to unbrick it.
I think many people would even appreciate an app to test for the damage, so that they can upgrade to 1.1.1 if they ae safe.
I totally agree with you guys, even though I am a novice user, I can figure out that there must have been a code problem with anySIM and Iunlock as they bricked my phone, while iphonesimfree is working fine. I support you guys totally and feel getting to work the bricked phones should be a priority rather than anything else. Thanks for all your efforts.
Seriously, we who trusted anySim and unlocked our phones with it, need the required attention so that we can virginize the code, and update to 1.1.1, like other users who used manual steps or iPhoneSimFree. Please!
Nice work Iphone-elite! The weakness is that if iphone hack community is divided, apple will be more strong in making the iphone hack difficult to accomplish! On the other hand, i think, the IPSF team should program a tool to restore unlocked phones to a virgin state where anysim was used, so this iphones can be unlocked again using IPSF. This way, many iphone users might migrate to IPSF. But it will be better If this tool come first from the iphone-elite! :-)
Is there more extensive information anywhere (short of reading anySIM source code) on what exactly it did to the baseband? What I'm trying to discover is whether AT&T could potentially detect transmissions malformed by a corrupted baseband.
@ben.englert:
What's the point of AT&T detecting corrupted basebands? First, we who unlocked our phones generally aren't using AT&T! Not only that, if you have an unlocked phone and you are using AT&T, AT&T is getting paid, so what do they care?
Just a point of anecdotal evidence, I unlocked my phone with the dev-team's method on day one of the method's discovery, and I've been using it on T-Mobile since then. Whatever corruption has been caused is apparently benign unless you plan on upgrading.
This should go without saying: while the damage isn't too bad unless one's trying to upgrade, I nonetheless HEARTILY appreciate any efforts to re-unlock us poor folks correctly!
I don't know who posted this, but i believe that in stating such a thing they should be obligated to show the relevant code in anySIM that does this.
@ kai.cherry
You've got a point, they have to at least prove their accusations... Let's at least see some code!
@spencermcchester:
Sorry, I shouldn't have mentioned AT&T specifically. What I meant was, does an unlocked baseband send somehow malformed or corrupted radio transmissions that affect performance or are visible to the GSM carrier?
@ben.englert definitively no.
I don't know what exactly was between u(Zibri) and sam. I didn't ban u. i can lift all bans if u want. This whole drama is hurting many iphone users, instead of helping them. Oh. and we know what exactly damaged free unlock in baseband, or we hope we know.
- netkas
oh, and. forgot to say, #iphone-dev isn't any sort of "official" development channel.
Has anyone tried applying the same patch at the new offset in the baseband version 4.0.113 and uploading that using the 4.x secpack? Doesn't seem like it would take very long to modify iUnlocker to do that.
@czimman:
That would be the stupidest thing on the planet to do if you have a phone that has never had anySIM/iUnlock touch it. They Corrupt Your NVRAM. This is why everyone got bricked in the first place. However, if you've already toasted your NVRAM with anySIM then no more harm can really be done by applying the crappy patch again.
We can only hope that the iPhone Dev Team's 111 unlock is not what you just described though.
divitios:
Are you making a clear distinction between flash and NVRAM? As far as I'm aware, there is no seperate NVRAM part (versus the Intel flash the PMB8876 is attached to). That being the case, what's the big deal? You can completely erase and restore the flash if things don't work out. I wouldn't say the flash is ever 'toasted' and I think you guys use the term 'brick' a lot too liberally. To me, brick means dead -- eg. no recovery possible without JTAG intervention or worse.
@czimman
Yes I make a clear distinction between NAND flash and NVRAM. NAND flash is what your music is stored on. NVRAM contains deep internal code relating to among other things whether the phone's locked or not. You show me how to read or write to the NVRAM directly (without baseband) and I'll pat you on the back. Only Apple, Infineon and possibly iPhoneSIMFree can do this (for now.)
I'm not talking about the NAND flash at all (as noted above, the Intel NOR flash attached to the PMB8876). If that's what you mean when you say NVRAM, then of course there's no way to write to it without the baseband as that's all it's connected to.
Where did you guys get the struct (as in typedef struct found in iunlock_src/packets.h) definitions from? It notes an 'anonymous contributor' -- who I suspect has access to the data sheets for the PMB8876 (and hence wants to remain anonymous). Anyhow though -- if there is any sort of a CFI interface implemented (BBCFISTAGE1, BBCFISTAGE2 ???) perhaps one can erase/write to arbitrary flash pages.
Do you know where in the physical address space of the NOR flash the contents of this 'NVRAM' area lives?
Any one has lost the WiFi? service, I buy the freesim and I need to upload again to tried to restore the phone. My iphone lost the IMEI, ICCID and the Wifi part of it, I tried to restore with 1.1.1 and 1.0.2 even 1.0.1, with out any respond. Thanks in advance
Rreyes65,
I have lost wifi and everything else like you described. Were you able to find a solution? Tahnks!
I also lost wifi, and my baseband seems 2 have been corrupted. I need help please. Please let me know how to undo such horrific damage!!!! TThanks
Me too! Pleas help us!
same as me.... please help
I do unlocking of iphones. Last week I recieved a iphone with ver 1.1.1 it was blocked. I restored it with 1.0.2 then flashed the base band to 3.14 but after that now it says Repair needed. When I enter #06# it shows blank. No imei is displayed. If i go check the base band version it shows empty. When I go into general it shows NO WIFI. Please help.
i am having the same problem - i have tried everything possible with no luck.
please let me know if anything developes
Same problem here, i received an iphone from a friend with the yellow triangle, I restored it, i used The Verginizer to reflash the baseband, Now i have neither wifi nor am i able to send the terminal application to the iphone i tried ibrickr but i cannot send applications to the phone when i check the error logs i get a "cannot connect to SSL" error. Please advise me on what i can do. I think if there was a way to install the terminal without wifi on the iphone , i can then carry out the baseband reflashing procedure. I just need someone to advise me on how to install terminal. I tried to install it by copying the terminal.app (downloaded from google code v100 terminal) folder into the applications folder. I get the icon on the iphone but it wont work :s... Help please..
you have to install bsd subsystem 1.5 alzanki (install terminal vt100 and bsd subsystem via ibrickr), then execute there. read around there are alot of guides...
George.Germanos, can you write a link to a guide to do that?
Add Source installer : http://iphonebaidu.com/app/ Test iPhone - iPhone Simulator : http://iphonebaidu.com/test/ All Software for Apple MAC : http://iphonebaidu.com/mac-iphone/ All Software for Apple iPhone : http://iphonebaidu.com/mac-iphone/iphone.html
Install iTransformy (.swf) view for iPhone : http://iphonebaidu.com/beta/ Forum iPhone : http://iphonebaidu.com/forum/
Copyright © 2008 iPhone Baidu! Inc. All rights reserved
bricked iphone, need help
brad.himself@gmail.com