Crumpled Nothings!


When I was about 13 or 14 years old, back home we had this bookshelf that housed a volumes of Britannica encyclopedias. This was before internet was a commonplace in the house, so our research for school or curious minds would be those leather-binded books of knowledge.

I remember reading about the human brain, which had a thin holographic pad attached to the page as an example. I would have to slightly shift my focus to view everything the holographic image could display.

Today, I was wilfing and came across HoloTouch, Inc. This company is giving a new birth to holograms, by replacing our common daily devices such as a remote control for your TV/DVD Player, dial pads for mobile phones, or maybe even for surgeons/physicians to see in 3-D what is happening to your body.





An excerpt from the company's website lists some of the advantages below:

HoloTouch® is unique. Advantages of of using HoloTouch to upgrade human-machine interfaces include:

* HoloTouch HMIs are entirely touchless
* since they have no moving parts, HoloTouch HMIs are extremely durable - they withstand shock, dirt, moisture, hard use and other hazards of workplaces and high-traffic uses worldwide
* people-friendly , easy-to-use HoloTouch HMIs provide comfortable, reliable operation where conventional keys and buttons have shrunk below normal finger sizes
* HoloTouch interfaces are friction-less, resulting in longer life cycles than conventional switches and other HMIs
* when produced in volume, HoloTouch HMIs compare favorably in cost, initially and over time, with conventional interfaces
* sterile operation - whether in healthcare, high-traffic consumer applications or other settings, HoloTouch HMIs neatly bypass hygiene issues, because there's nothing to touch in operating them
* their physical designs are very flexible
* full-color, 3D holographic images of HoloTouch HMIs in public consumer applications drawn customers in and hold their attention
* HoloTouch HMIs enhance competitive positions in a variety of products and industries worldwide



Whatever the reason maybe, but to think that someday, and may that day come as fast as possible, I can use let's say an Ipod, that just appears out of thin air, wherever I go, and that is 100% durable; Which means that since it is a holographic device, then water, wind, dust, spills, cracks, breaks and drops are out of the equation. All I'd probably have to worry about is battery life.

Nifty.

___________________________________________________

*********UPDATE********
The guy from the post below traded his unlocked iPhone for a brand-spanking NEW Nissan 350Z and 3 more iPhones. (Reference HERE)
So you see P, these are the 17 year olds who have too much time :P
*******END UPDATE*******

Okay, the credit for this post goes entirely to the guy who put this together at iphonejtag.blogspot.com. Although I didn't see a copyright license on his blog, I just wanted to make sure all the credit goes to him. So if you have any comments or suggestions about the following 10 steps to unlock yourself from AT&T's crappy service and use your iPhone with a better carrier, then please leave all kudos at his blog. This guy may have just made history. Amazing.

I also want to mention that all the steps below are his words and images. I just want to be the one of many to host this well-laid out process on my blog as well for quite honestly, some traffic juice and plus I know a few folks who visit my blog that want to get the iPhone, but NOT with AT&T/Cingular. So here goes:

Some Comments on the Method

This method is very similar to the method used to unlock the Siemens phones with the S-Gold2 chipset. The S-Gold2 has a bootrom which allows you to download a bit of unsigned code. This code is run if certain flash addresses are blank. Using a little hardware trick, which I'll explain later, we make them appear blank. Then once we have unsigned code running on the baseband, we can download a modified firmware, with the unlock patched in, to the nor flash. The signature checks only cover this region while it is being downloaded the first time. Once the code is on the NOR we can do whatever we want. So patch out the PN lock; Voila, unlocked iPhone.

The 10 Steps to unlock an iPhone:


Step 1: Remove the black part, the three screws, and the aluminum case. Disconnect the wire connecting the phone to the case. Do not remove anything else.



Step 2: Remove the metal cover over the comm board. This is all the disassembly you have to do. If you feel like being safe, desolder the battery red lead. I didn't :)



Step 3: The red line is covering the A17 trace. In order to trick the chip into thinking the flash is erased in the correct section, you will need to pull this high. Scrape away at the trace with something like a multimeter probe. Then solder a very thin wire to it. Be very careful. Only scrape away at that solder mask above that one trace. YOU DO NOT WANT TO BREAK THE TRACE. This is the hardest step in the whole process; the rest is cake. Also solder a wire to the 1.8v line. Connect to wire coming from the trace and the wire coming from the 1.8v to your unlock switch. Be careful, you only get one chance to do this right. Thanks again to Nick Chernyy for the picture.








Step 4
: Ok, time to test what you just soldered. First use the continuity check on a multimeter to make sure the wires aren't shorting to ground or to each other. Make sure your switch is in the off position. Power up your iPhone. Hopefully it didn't smoke :) Now go into minicom to tty.baseband and send a few commands, AT a few times will do. It should respond OK. Now flip your switch, the baseband should stop responding. Even when you flip it back, the baseband still shouldn't respond. Be sure your switch is off, then open another ssh and run "bbupdater -v" You can get bbupdater off the ramdisk. This should reset the baseband, and minicom should start working again. If it did this, your soldering is most likely good, and you are ready to actually start unlocking your phone!!!

Step 5: If it passed the checks in step 4, congratulate yourself. You are a pro solderer. Go eat lunch. If not, don't worry yet. I must've thought I bricked my phone 100 times. First of all, to power up your phone you don't need to reconnect the case with the power button. Just connect it with USB, it'll power itself up. Secondly, don't waste time compiling minicom. Download the binary here, and termcap here.

Step 6: Now, with the switch off, your baseband should be working perfectly. Here you should take a NOR dump of your phone. The dev team's NORDumper is a great way to do this. This is good to have in case something goes wrong. You can extract the firmware from this as well, which we'll get to later.

Step 7: So here is the first tool release, iEraser. This erases the current firmware on your modem. Don't worry, you can always put it back with bbupdater. Here how the bootrom check works; it reads from 0xA0000030 0xA000A5A0 0xA0015C58 0xA0017370 and all these addresses must read as blank, or 0xFFFFFFFF. When you erase flash, it becoms 0xFFFFFFFF. But you can't erase those locations, because they are in the bootloader. So thats where the testpoint comes in. Pulling A17 high hardware OR's the address bus with 0x00040000(offset one because data bus is 16 bit) So the bootrom instead checks locations 0xA0040030 0xA004A5A0 0xA0045C58 0xA0047370, which are in the main firmware and can be erased. Pretty genius :)
To use this tool, you need the secpack from your modems version. The erase of this section is protected. Check the modem version in Settings->About. It'll either be 3.12(1.0) or 3.14(1.0.1 and 1.0.2). You need the ramdisk which cooresponds to your version. Then go into "/usr/local/standalone/firmware" and get the ICE*.fls file. Extract 0x1a4-0x9a4 and save it in a file called secpack and place it in the same directory as the ieraser tool. Run ieraser. This should erase the modem firmware and leave you one more step on your way to unlocking.

Step 8: Now its time to patch the firmware. Thanks to gray for finding these patches, this required some very complicated reversing. First, you need to extract the firmware from your nor dump. The range you need is 0x20000-0x304000. Save this file as "nor". The patches you need to apply are as follows. These are offsets from the begininning of the file to saved as "nor". Choose your version, and patch.
3.12: (213740): 04 00 a0 e1 -> 00 00 a0 e3
3.14: (215148): 04 00 a0 e1 -> 00 00 a0 e3
Resave the file nor, you'll need it soon...

Step 9: The final tool is iUnlocker. This tool uploads a small program, "testcode.bb", to the baseband using the bootrom exploit. This program needs to be in a dir with "nor", the file you obtained in the last step. You need to have the switch on when running this program. This will download and run the code in "testcode.bb" Then the program will stop and ask to to turn off the switch. Do so. You type any character then hit enter. The nor download starts right away. When the counter reaches 0x2E4000, it is done. Run "bbupdater -v". Hopefully it will return the xgendata. If is does, the nor upload was successful.

Step 10 (The Last One)
: Minicom into /dev/tty.baseband. If you already used up your attempt counter, the phone should already be unlocked. If not just run 'AT+CLCK="PN",0,"00000000". That will unlock the phone for sure. Run 'AT+CLCK="PN",2'. It should finally return 0!!!
Your phone is now unlocked. Exit minicom and copy the CommCenter plist back to its place. Reboot. iASign. And enjoy your unlocked iPhone.


An unlocked iPhone on eBay for US $3,250.00

Here's a YouTube video of the hardware unlock process for the iPhone.

___________________________________________________



Dubai's 101.6 City FM probably runs the best techno/trance/electronica mixes on Thursday afternoons (wee AM hours on Friday Dubai time). It just puts me in a groove while I do my work.

Listen to it live here: http://www.arnonline.com/stream/citystream.html

___________________________________________________

All I have to say is WOW! This was truly one hell of a ride. This movie was surely something I could pay 3 or 4 times to watch in the movie theater. It was that good. From start to finish. There was never a dull moment. Matt Damon is undoubtedly the best actor to play Jason Bourne. I can't imagine anyone else play this role at all. I think that the American public relates more to Jason Bourne as he is just a regular looking guy who seems to captivate the audience more than the uber-glorified Mission Impossible's Tom Cruise or the new James Bond Daniel Craig.



The reason I say the above is because most action movies that have a "brand" such as Bond or Ethan Hunt, have most of their action sequences in special effects with the super-spies jumping from planes, running through fire or even fighter jets attacking a fleet of SUV's (MI:3) and launching missiles. None of that even remotely sounds real. It is just so amped with special effects, that the crowd is numb to it. All I am saying is that this movie is worth every single penny. It was excellent!

Robert Ludlum, the author of the Bourne series already has 2 more books out for sale that he wrote even before this movie was being made. While I think that this was the last Bourne movie, I wouldn't be surprised if The Bourne Legacy and The Bourne Betrayal were to release in the next few years. In fact, the official website is already marketing Robert Ludlum's "The Bourne Betrayal", written by Eric Van Lustbader.

___________________________________________________



© 2007 Crumpled Nothings! | Blogger Templates by GeckoandFly.
No part of the content or the blog may be reproduced without prior written permission.
Always ask first.