I am sorry for the awful comments I have made in public or private about your mis-understood masterpiece Friday as well as reporting your music video on YouTube for child abuse. I was fooled by assumptions and failed to see the connection at all until fate led me to listen to the song Baby by Justin Beiber three times in a row last night.
Please accept my most sincere apologies, I will queue outside my nearest music store when your new single/album comes out.
Monday, April 4, 2011
Unofficial Gevey FAQ
This post is not a statement on the legal/moral debates surrounding the use of Gevey SIM or similar means to pseudo-unlock the iPhone 4. It is purely to help those who are experiencing issues with these products and failed to get any support from the resellers:
Q: I get "No SIM" after I put my SIM card in the phone with Gevey.
A: Assuming both your SIM and Gevey are working, the underside of your MicroSIM may be touching the chip on the SIM interposer and shorting it. Cut away some more to give enough clearance between the SIM and the chip.
Q: I had to enable "Data Roaming" in order to use mobile data, would this incur a lot of roaming charges?
A: No. Data roaming needs to be enabled because the way this exploit works, your network will always bill your call/SMS/Data correctly as before.
Q: My caller ID is not working and my SMS threads are fragmented, why?
A: The "unlock" causes the phone to use 001 as the default MNC, which has no matching country code and your phone fails to map caller ID to your country. There are many ways to get around it, e.g. manually adding the country code to every number in contacts, adding custom carrier bundles for 001/01 or a network reset/full reset. A more consistent method is to open /System/Library/Frameworks/UIKit.framework/PhoneFormats/UIMobileCountryCodes.plist and add the highlighted part:
Replace %Your Country Code% with ISO3611 alpha-2 country code for your locale: nz for New Zealand, jp for Japan etc.
Q: My data connection dropped out and I cannot get data on 2G or 3G, I have checked my APN settings and they are correct.
A: Use your SIM in any unlocked phone with GPRS functionality once to re-establish data session; expect to do this on a regular basis.
Q: I have full signal bars and I can call normally; but when other people call me it says number is not listed or goes directly to voice mail.
A: I have explained earlier that you need to obtain a TMSI from the network to connect. Theoretically the TMSI will stay with your number as long as your phone remain connected, and when you move between cells it is passed to the next base station so you don't have to call 112 again.
Nevertheless the carriers usually configure their network to refresh TMSI periodically for security and administrative purposes. It has also known that some cells, particularly the ones serving train stations and major road intersections, require a TMSI refresh following a hand-off(Because users tend to move in and out of coverage very rapidly, TMSI reuse cause unnecessary delays).
Your phone will not recognise the refresh because it is for your original IMSI and your phone is still on the test IMSI starting with 80900101. You can call because your old TMSI did not really expire and is hence accepted, however the network is unable to locate you because it uses the new TMSI which has never been updated on your phone.
Out of all the issues with the Gevey this one stands out as the most deleterious, and there is nothing you can do to stop it from happening. In fact you cannot even tell because the signal bars will appear normal and you can dial out perfectly fine. The only way out is to restart the phone and start over to match the TMSI.
Q: Help, my SIM is stuck and I can't take it out!
A: Do not force your SIM tray if this happens, you are going to cause more damage. Push it all the way back in and tap the phone a few times, gently but firmly, against the palm of your other hand or any soft object e.g. a large pillow. If this had failed to free the SIM tray you will have to take your phone for repairs. (If you are feeling particularly adventurous, you can do it yourself by following this excellent guide created by iFixit; however do this at your own risk and be prepared to lose your warranty because one of the screws cannot be accessed without breaking the warranty seal)
Don't get me wrong and think I am scaring you; this can happen to anybody but it is more likely with the extra thickness provided by the interposer.
Update 1:
Q: My battery level seems to go down very quickly now...
A: Now there are two possibilities, one is that you are simply not used to the i4 acting more than an iPod. cellular transmission can use a lot of battery power, especially on 3G and whenever the reception is poor. However if your data usage listed under Settings/General/Usage seems to be too much AND you have hacktivated your i4 (activated using limera1n/redsn0w etc) then chances are your problems is real.
If you never used and does not need push notifications, you can simply delete /System/Library/LaunchDaemons/com.apple.apsd.plist and restart your phone. Any battery drain caused by hacktivation will cease however push service itself will also be gone. Alternatively use many of other solutions available (PushFix, PushDoctor, SAM) that all fix the problem to a varying degree.
Q: Which carrier bundle should I use?
Your default carrier settings is stored under CarrierLab.bundle, which is actually not that bad since it allows free editing of the APN settings. If you need to get VM or VVM working, Wortel's patch has to be installed first before you can edit the bundle.
Carrier Logos should go to your actual carrier's folder, not CarrierLabs since your phone will be "roaming" on your actual network.
Q: I get "No SIM" after I put my SIM card in the phone with Gevey.
A: Assuming both your SIM and Gevey are working, the underside of your MicroSIM may be touching the chip on the SIM interposer and shorting it. Cut away some more to give enough clearance between the SIM and the chip.
Q: I had to enable "Data Roaming" in order to use mobile data, would this incur a lot of roaming charges?
A: No. Data roaming needs to be enabled because the way this exploit works, your network will always bill your call/SMS/Data correctly as before.
Q: My caller ID is not working and my SMS threads are fragmented, why?
A: The "unlock" causes the phone to use 001 as the default MNC, which has no matching country code and your phone fails to map caller ID to your country. There are many ways to get around it, e.g. manually adding the country code to every number in contacts, adding custom carrier bundles for 001/01 or a network reset/full reset. A more consistent method is to open /System/Library/Frameworks/UIKit.framework/PhoneFormats/UIMobileCountryCodes.plist and add the highlighted part:
Replace %Your Country Code% with ISO3611 alpha-2 country code for your locale: nz for New Zealand, jp for Japan etc.
Q: My data connection dropped out and I cannot get data on 2G or 3G, I have checked my APN settings and they are correct.
A: Use your SIM in any unlocked phone with GPRS functionality once to re-establish data session; expect to do this on a regular basis.
Q: I have full signal bars and I can call normally; but when other people call me it says number is not listed or goes directly to voice mail.
A: I have explained earlier that you need to obtain a TMSI from the network to connect. Theoretically the TMSI will stay with your number as long as your phone remain connected, and when you move between cells it is passed to the next base station so you don't have to call 112 again.
Nevertheless the carriers usually configure their network to refresh TMSI periodically for security and administrative purposes. It has also known that some cells, particularly the ones serving train stations and major road intersections, require a TMSI refresh following a hand-off(Because users tend to move in and out of coverage very rapidly, TMSI reuse cause unnecessary delays).
Your phone will not recognise the refresh because it is for your original IMSI and your phone is still on the test IMSI starting with 80900101. You can call because your old TMSI did not really expire and is hence accepted, however the network is unable to locate you because it uses the new TMSI which has never been updated on your phone.
Out of all the issues with the Gevey this one stands out as the most deleterious, and there is nothing you can do to stop it from happening. In fact you cannot even tell because the signal bars will appear normal and you can dial out perfectly fine. The only way out is to restart the phone and start over to match the TMSI.
Q: Help, my SIM is stuck and I can't take it out!
A: Do not force your SIM tray if this happens, you are going to cause more damage. Push it all the way back in and tap the phone a few times, gently but firmly, against the palm of your other hand or any soft object e.g. a large pillow. If this had failed to free the SIM tray you will have to take your phone for repairs. (If you are feeling particularly adventurous, you can do it yourself by following this excellent guide created by iFixit; however do this at your own risk and be prepared to lose your warranty because one of the screws cannot be accessed without breaking the warranty seal)
Don't get me wrong and think I am scaring you; this can happen to anybody but it is more likely with the extra thickness provided by the interposer.
Update 1:
Q: My battery level seems to go down very quickly now...
A: Now there are two possibilities, one is that you are simply not used to the i4 acting more than an iPod. cellular transmission can use a lot of battery power, especially on 3G and whenever the reception is poor. However if your data usage listed under Settings/General/Usage seems to be too much AND you have hacktivated your i4 (activated using limera1n/redsn0w etc) then chances are your problems is real.
If you never used and does not need push notifications, you can simply delete /System/Library/LaunchDaemons/com.apple.apsd.plist and restart your phone. Any battery drain caused by hacktivation will cease however push service itself will also be gone. Alternatively use many of other solutions available (PushFix, PushDoctor, SAM) that all fix the problem to a varying degree.
Q: Which carrier bundle should I use?
Your default carrier settings is stored under CarrierLab.bundle, which is actually not that bad since it allows free editing of the APN settings. If you need to get VM or VVM working, Wortel's patch has to be installed first before you can edit the bundle.
Carrier Logos should go to your actual carrier's folder, not CarrierLabs since your phone will be "roaming" on your actual network.
Sunday, March 20, 2011
Review: Issis Pasta & Grill
The food selection at Sylvia Park exemplifies its core problem: because the mall is laid out in a long strip, the management decided it is a good idea to have duplicate outlets at both ends of the mall. This has led to the rather boring situation where the same mall houses two Subway franchises in ridiculous proximity (literally within the line of sight of each other), two West Coast café(they actually make good coffee), a couple of very similar Chinese buffet(Same price, same sized plates, same pile of deep fried mystery "stuff" and even showing the same sign saying that their food does not contain MSG, well that is scientifically impossible) and two identical sushi joints(where the management is mostly Australian, the workers are uniformly Korean, and their sushi is so consistently bland that they must have imported the ingredients from England, seems like sushi has nothing to do with Japan anymore). The food problem gets so bad that my co-worker often took unauthorised long breaks to have lunch at home, by the way he lives in Remuera 20 minutes drive away.
If we take out the duplicates, the major fast food chains, all the run of mill cafés and the Indian canteens (Seriously, they make exactly the same meals that is offered at Hare Krishna parties and it is not even free) we are left with a few eateries that all had a juice bar and pot ofweed wheatgrass growing proudly by the cashier to prove their middle-class consciousness.
Issis is one of the few remaining non-ethnic place (I mean the food, it is still run by the, um, certain enterprising ethnicity) that does not display their yuppieness up in the air. Their menu include a few combinations of:
alive warm in an incubator, cooked well beyond al dente but at least it is not machine made; and the sauces which appears to have been simmering since Moses parted the water. The bacon & chicken carbonara I ordered for lunch is the said pasta with a scoop of thin sauce full of bacon scraps that did not make it to the slice and no trace of chicken at all, maybe mentions of "chicken" always imply "chicken salt". After all I can eat this without complains because it tastes just like my own cooking on a Wednesday night(not including the plastic cutlery and bottled drink). Familiarity conquers all.
The accompanying salad is much more impressive: Fresh, crispy and everything in just the right quantity. The dressing is disappointing just as expected but easy to ignore.
If we take out the duplicates, the major fast food chains, all the run of mill cafés and the Indian canteens (Seriously, they make exactly the same meals that is offered at Hare Krishna parties and it is not even free) we are left with a few eateries that all had a juice bar and pot of
Issis is one of the few remaining non-ethnic place (I mean the food, it is still run by the, um, certain enterprising ethnicity) that does not display their yuppieness up in the air. Their menu include a few combinations of:
- Pasta and sauce
- Grilled/roast meat
- Breakfast staples, i.e. bacon, eggs, buttered toast...
- Garlic Bread
- Salad with commercial vinegarette (in plain terms: acetic acid, corn starch and a bunch of E numbers)
The accompanying salad is much more impressive: Fresh, crispy and everything in just the right quantity. The dressing is disappointing just as expected but easy to ignore.
Thursday, March 17, 2011
[Updated]Unofficial Review: Gevey iPhone 4 SIM hack
Disclaimer: I am not associated in any way with the manufacturers and/or resellers of the products mentioned here. A lot of technical information has been (overly) simplified to facilitate understanding however I try to keep them as accurate as possible. The Gevey device in concern has just began shipping earlier this week, I have had very limited time with it so consider all information as preliminary and expect frequent updates/corrections. Your feedback and inputs are most appreciated, tweet @DillADH
For much of the last two years time, even the manufacturer of these SIM hack products acknowledge that their product is no longer needed; so it was quite a surprise when Gevey announced that they have something that will unlock the iPhone 4. Contrary to conspiracy theories, they withheld onto the product because:
How did It Work?
SIM card holds many different types of information, but the part most involved with carrier lock is the IMSI number, which is a unique code that corresponds to your account in the mobile carrier's database.
A sample IMSI might look like this
310 150 987654321
The first two segments are known as Mobile Country Code (MCC) and Mobile Network Code (MNC) respectively, and in the example above the IMSI indicate the SIM is from USA (310) AT&T (150).
When the iPhone baseband is loaded into memory, it checks the MCC and MNC against its own network lock state stored in the seczone. If the combination is allowed, the cell radio is activated and vice versa.
The earliest iPhone baseband revisions only check IMSI twice following a restart, therefore it is very easy to spoof information in order to bypass the check. Nevertheless, the baseband was soon updated to validate SIM more aggressively and the method no longer works.
The Long Con
To guard against eavesdropping that plagued pre-GSM cellular networks, the initial connection to a network does not only involve IMSI, but a 4-byte TMSI to identify each handset before IMSI is sent. The base station recognises the IMSI as one of their users and replies with a nonce (RAND) to the handset, where is signed with a 128bit key (Ki, stored encrypted on the SIM) and sent back. The network checks the string against their own result using the same RAND and Ki and allows the device to register if the two value matches.
You see, the IMSI is only sent once and never directly involved with authentication; as long as your key is valid, you will be able to get service. This is exactly what the various SIM hacks where a fake IMSI is sent along with the correct key.The IMSI is redirected to another network and lost, In our case, the IMSI is invalid but some network proceed to the next step anyway - I will explain this in detail later.
Demise
The result of SIM hacks has always been erratic since the outcome depends on the implementation of the hack as well as the policies of the network; and people were inundated with a long list of issues and makeshift solutions. e.g. Cellular data may and may not work depending on the chemistry; a common remedy is to periodically put the hacked SIM into an unlocked "nanny" phone to "keep the TMSI fresh".
The use of SIM hacks fell sharply after iOS 2.2.1 update where the new baseband were made aware of the method and rejectdodgy exploitable IMSIs, even the better designed interposers suffered frequent failures. It is about the same time software unlocks were developed and it pushed SIM hacks further into disuse. However the technology has been kept alive since a number of GSM handsets, mainly those coming from Japan, remains vulnerable.
Partial Revival
Apparently somebody figured out that while the i4 baseband has been patched to prevent test IMSI from working, it is still possible to force activate the baseband using the emergency dialer.
After that, it is relatively the same trick all over again. Let's see what it does at each step.
Why 112?
112 had a long history as an emergency number for practical reasons; back then when the GSM standard was being drafted in Europe, 112 was chosen to be the universal emergency number to call that can be called from any GSM phone, free of charge, with or without a SIM card on any compliant network.
However long before GSM service was established, 112 has been used to report landline faults in China; the coincidence made it unsuitable as a true emergency number. The network still connects 112 as an unbilled emergency call, only to play an automated message in both Chinese and English informing callers of the correct emergency numbers to dial; the call is never redirected.
What does it mean to unlockers?
Conclusion:
An overpriced (US$50 US$70, although clones are just starting to appear), unreliable and legally questionable mod; works for some but your mileage may vary; get it if you are desperate or wait for the 40-bit 56-bit NCK hack or the eventual SW unlock by the iPhone dev team.
For much of the last two years time, even the manufacturer of these SIM hack products acknowledge that their product is no longer needed; so it was quite a surprise when Gevey announced that they have something that will unlock the iPhone 4. Contrary to conspiracy theories, they withheld onto the product because:
- Initial production cost is high, they risk losing a lot of their investment should the dev team come up with a software unlock that does the same job if not better, before they were able to recover their cost.
- The exploit they used is not without serious problems, hence they were reluctant to produce it until there seems to be be no alternatives coming for a while.
- The exploit they used is very simple, provided you have the tools and skill, details to follow...
How did It Work?
SIM card holds many different types of information, but the part most involved with carrier lock is the IMSI number, which is a unique code that corresponds to your account in the mobile carrier's database.
A sample IMSI might look like this
310 150 987654321
The first two segments are known as Mobile Country Code (MCC) and Mobile Network Code (MNC) respectively, and in the example above the IMSI indicate the SIM is from USA (310) AT&T (150).
When the iPhone baseband is loaded into memory, it checks the MCC and MNC against its own network lock state stored in the seczone. If the combination is allowed, the cell radio is activated and vice versa.
The earliest iPhone baseband revisions only check IMSI twice following a restart, therefore it is very easy to spoof information in order to bypass the check. Nevertheless, the baseband was soon updated to validate SIM more aggressively and the method no longer works.
The Long Con
To guard against eavesdropping that plagued pre-GSM cellular networks, the initial connection to a network does not only involve IMSI, but a 4-byte TMSI to identify each handset before IMSI is sent. The base station recognises the IMSI as one of their users and replies with a nonce (RAND) to the handset, where is signed with a 128bit key (Ki, stored encrypted on the SIM) and sent back. The network checks the string against their own result using the same RAND and Ki and allows the device to register if the two value matches.
You see, the IMSI is only sent once and never directly involved with authentication; as long as your key is valid, you will be able to get service. This is exactly what the various SIM hacks where a fake IMSI is sent along with the correct key.
Demise
The result of SIM hacks has always been erratic since the outcome depends on the implementation of the hack as well as the policies of the network; and people were inundated with a long list of issues and makeshift solutions. e.g. Cellular data may and may not work depending on the chemistry; a common remedy is to periodically put the hacked SIM into an unlocked "nanny" phone to "keep the TMSI fresh".
The use of SIM hacks fell sharply after iOS 2.2.1 update where the new baseband were made aware of the method and reject
Partial Revival
Apparently somebody figured out that while the i4 baseband has been patched to prevent test IMSI from working, it is still possible to force activate the baseband using the emergency dialer.
After that, it is relatively the same trick all over again. Let's see what it does at each step.
You will need to use the SIM tray supplied and file your MicroSIM slightly to accommodate the EEPROM chip.
Installing the SIM + gevey.
The phone will search for signal, comes up with no service and finally settling on this "one bar" icon. At this stage the sim interposer is passing the parameters from the SIM as is. Earlier hacks required the fake IMSI to be programmed manually however this device is obviously capable of rapidly cycling a list of IMSI until an accepted MCC/MNC combination is found. pre-programmed with an exploitable IMSI. It may also spoof ICCID since the iOS is known to occasionally check that.
Dial 112 and hang up after the call is connected. The emergency call overrides the network lock and activates the cell radio. The network issues a TMSI for your real IMSI.
Toggle flight mode On/Off. Once the interposer senses flight mode, it transiently blocks electrical connection between the phone and the SIM (hence it will show "No SIM card installed") before sending spoofed IMSI. The BB allows the SIM and attempts to connect to network. What exactly happens is not too clear but apparently the interposer ROM block electrical connection to prevent the BB from detecting the fake IMSI.
The signal bars appear, we are safe:-) The network is able to register you again because the TMSI you obtained earlier is still valid, and the IMSI is not checked again. That is after the network ignored the fake IMSI (which the phone has no knowledge of) but allowed the SIM onboard because it is able to validate that.
Why 112?
112 had a long history as an emergency number for practical reasons; back then when the GSM standard was being drafted in Europe, 112 was chosen to be the universal emergency number to call that can be called from any GSM phone, free of charge, with or without a SIM card on any compliant network.
However long before GSM service was established, 112 has been used to report landline faults in China; the coincidence made it unsuitable as a true emergency number. The network still connects 112 as an unbilled emergency call, only to play an automated message in both Chinese and English informing callers of the correct emergency numbers to dial; the call is never redirected.
What does it mean to unlockers?
- It works if A.your network handles 112 calls properly according to the GSM standard; B.they are
tolerant to TSMI spoofinglax on TMSI management and does not actively validate your IMSI again for incoming calls. - Unlike its ancestors, the i4 SIM interposer is not a drop-in-and-forget device. The exact precedure must be followed everytime the device restart, lose reception for an extended period of time or move to another PLMN. In all situations the TMSI expires and has to be obtained again.
Theoretically it is possible for a daemon to automate the process similar to ZeroG, but that only makes thing more convoluted.Theoretically it is possible to reproduce the same behavior by physically switching your SIM card while flight mode is on. - It is, without question, unethical or downright illegal to use the technique anywhere 112 is a legitmate emergency number. Use the exploit at your own risk/responsibility and tough luck if you get into trouble with the law.
- All firmware/baseband combinations for the i4 up to iOS
4.34.3.1 are vulnerable, however the exploit may be patched in any future software updates or via the carrier. - SIM interposer should not harm your phone hardware, however your network could request IMEI and identify your device during the emergency call, leading to your handset getting banned. Your identity cannot be faked and it is possible that they will shut down your account. There is a reason why SIM cards remain legally the property of the service provider: you are not supposed to tamper with them without breaching contract.
- Notwithstanding all the problems, SIM interposer does not cause any battery drain since it is only active transiently (at least for the gevey, some clones may use less reliable components and cause issues), nor would it cause signal loss as long as you stay in the same cell - TMSI may be reused in the neighboring one since it is only 4 bytes.
Conclusion:
An overpriced (
Tuesday, March 15, 2011
A few words on the recent iOS 4.3 release
- Pre-A5 devices already have a tethered JB
with redsn0w 0.96rc8custom bundle in the latest versions of PwnageTool/Sn0wBreeze. A5 Devices will have to wait till another injection vector to be found in the bootrom or userland. - New kernel breaks MobileSubstrate, and as a result a large majority of Cydia packages that depend on the former.
Saurik cannot be reached for comment but it is understood that a compatible revision could take some time.Saurik is working on a compatible build right now with a new and improved version of Cydia! - APPL's server is no longer signing 4.2.1 firmware, it is simply too late.
- Downgrade to 4.2.1 using cached TSS blobs will result in a 1013 error due to a mismatch in baseband version. Simply jailbreak again with Greenpois0n RC5 or later to get going, notice that the "auto-reboot" command will no longer kick you out of recovery loop, TinyUmbrella uses the same command and hence no longer works.
- Multi-touch gestures is said to have been taken away in the final 4.3 firmware however it could not have been simpler to have it re-enabled. In \Applications\Preferences.app\General.plist search for "Mutltitasking"[sic], replace them with the correctly spelling "Multitasking" and you are all set. Seems like the engineers got incredibly lazy that they did not even bother to remove the code...
Update: Apparently jailbreak is not necessary, you can edit the said file in an iTunes backup and restore to get the same effect.
Subscribe to:
Posts (Atom)