iPhone Partially Unlocked, Calls Without AT&T Contract

Click to viewApparently, the amazing code wizards at the iPhone Dev Wiki have been able to partially unlock the iPhone using a new application called iASign. It won't fully unlock the iPhone for use with other companies, but the hack will allow you to use any existing Cingular/AT&T Pre-paid/MVNA SIM so you don't have to get a two-year contract with AT&T. We are now testing this, but if confirmed the benefits are great.

That's full call functionality without two years of slavery and:

• People can still enjoy corporate rate, which they don't get on iPhone plans (10% to 20% off in some cases even more)

• People can use a company AT&T SIM card on their personal iPhone.

The iPhone Dev Wiki rebels are now in their final assault to get the iPhone fully free of the Evil AT&T Galatic Empire:

All problems with unlocking lie in the baseband, the radio chipset for the iPhone. The chipset is an S-Gold2, and don't come in the chat and give us links to PapaUtils, we can't use them.
Now the iPhone only has one lock, a network personalization lock. This lock means the MCC(US=310) and the MNC(AT&T=410) must match the first six digits of the SIM cards IMSI. This check is done in the baseband firmware itself. I'm not really sure where yet, but that isn't really relevant.
The only thing standing in the way of an unlock is the baseband. All the other SIM checks are known and can be patched out. We even know the AT command to do the unlock. It's 'AT+CLCK="PN",0,"xxxxxxxx"'. But good luck finding those x's. They are called the NCK, or Network Control Key, and are believed to be unique in everyone's phone. Forget brute force (time impractical) and the obvious entries. If you still think brute force is a good idea, read this. Further, there is a limit of 3-10 unlock attempts per phone, after which the firmware will "hard-lock" itself to AT&T.
So why can't we just patch the firmware? The firmware, located in the ramdisk at /usr/local/standalone/firmware/ICE03.12.06_G.fls, is signed. See here for what is known about the file. The sig is checked in the baseband bootloader. The updater program, bbupdater, only checks a checksum, which can be changed. The update will take, but then the phone won't boot because the sigs don't match.

We worked two solid days on disasseming the radio fw. There are a few backdoors, but none that would lead to an unlock. If you are *good* with disassembling ARM, PM geohot for the idb. We've documented a lot of functions pretty well. Although, this firmware is very difficult to work through. I'm 90% sure the password check happens in the function called pwdcheck, but I haven't found it yet. For all we know there could be a simple algorithm to generate the NCKs that we've missed.

If you feel you can help them, you can join them at the #iPhone IRC channel. Otherwise, please let them keep hacking away undisturbed. (Thanks Techluver!)