So the RSA signature would always validate, and the phone would always appear to be unlocked and every NCK would appear to be valid. This deprecated patch disabled signature checks. The first iPhone unlocking method (for the original iPhone) actually required opening up your phone.Ĭurrently, it isn't possible to hardware unlock current devices the closest thing would be SIM hacks, which function as interposers, not a hardware modification.

The unlock-able basebands and tools are listed below. This is a way to unlock your iPhone for free with a package from Cydia, however, it only works on selected basebands. This type of unlock does not require a jailbreak and is permanent, even surviving a restore (unless Apple or your carrier decides to re-lock the phone, something that has rarely happened ). On startup, if the lockstate table says the phone is unlocked, it validates that RSA token. If that decryption, after deRSAing with Key 2, is a valid token for the phone, it is stored back to that flash with the token TEA, but not RSA decrypted. The phone receives an AT+CLCK='PN',0,'.NCK.' It decrypts the token with the generated key. Apple, knowing the NCK, sends it using an activation token over iTunes. At +0x400 in the seczone, a token is stored encrypted with (NCK + NORID + HWID).

Iphone 6 plus factory unlocked meaning