iPhone 4 unlock with ultrasn0w

[Orby]

This is 100% true, it is entirely possible to downgrade both baseband and bootloader on the iPhone 4 (GSM).

However (and this is a BIG however): the baseband's bootrom generates a cryptographic nonce (Number used ONCE) for each restore with an AT command (at+xnonce) that must be sent to Apple and return signed with Apple's RSA key for the baseband firmware restore to proceed.

Apple only signs valid nonces from the most recent baseband and bootloader combination, in the same way Apple only signs SHSH blobs for the most recent iOS firmware. Unlike SHSH blobs, however, each device creates a new, unique number each restore--each response from Apple is only valid once. They cannot be cached or replayed like SHSH blobs. Also unlike SHSH blobs, Apple will not sign any old ECID/nonce--they seem to know which ones are valid and which ones aren't.

A bootrom exploit for the baseband would be needed that will allow any nonce to be used (properly signed), or a bootrom exploit that bypasses the nonce requirement entirely, or the generation algorithm for nonces will have to be cracked, or Apple's private key will have to be divulged for a permanent unlock for the iPhone 4. These are all very tall orders.

[iPittsburgh]

Holy detailed explanation batman. I was going to look into this further for a better explanation, but you have more than delivered. Thank you Orb.

[bondkt]

wow you just taught me more than i learned in an entire semester of college.

very nice and detailed, cool. that should be make into a sticky entitled 'iphone baseband downgrading info, look here'.

thanks!