Unlocking an iPhone

[jools]

I am curious about how the unlocking process takes place, and what the various options are to have it done. I know that you can have your provider do it for a fee (I'm with Rogers in Ontario, and it's 50 bucks), or you can go to any number of websites who claim they can do it, but it's more expensive from what I've seen., or there is 3rd party software that can do it also. So, when you have somebody else do it, what happens? Do they just submit your IMEI number to apple, who then unlocks the device? If so, how come you can't just do it yourself? And as far as the 3rd party SW, does it work? I've heard some stories of it bricking phones...

 

[J. A.]

Welcome to iPhone Forums, jools!

The only one who can unlock your iPhone, is your carrier. Websites that claim they can unlock it, are not trustworthy. Third party software can not do it.
Apple doesn't unlock an iDevice, it's the carrier who does it.

Here are Apple's instructions:
How to unlock your iPhone for use with another carrier - Apple Support

Some people mix up unlocking an iPhone, and removing an activation locked iPhone from someone's iCloud account. The IMEI can show whether or not an iPhone is connected to an iCloud account. It doesn't help with unlocking from a carrier, it also doesn't help removing an iPhone from an iCloud account.

Hope that helps.

 

[jools]

Thanks for the info. So by unlocking, I'm talking about making a phone capable of working on another carrier other than the one it was originally set up on. Based on the above link, it would appear that only the original carrier can do it, but there are stores where I live (not the carriers, but private cell phone service businesses) that unlock phones, and I know people that have had it done without issue. How would they be doing it if only the carrier is capable of this action? Thanks again.

 

[Pinkpoison]

Thanks for the info. So by unlocking, I'm talking about making a phone capable of working on another carrier other than the one it was originally set up on. Based on the above link, it would appear that only the original carrier can do it, but there are stores where I live (not the carriers, but private cell phone service businesses) that unlock phones, and I know people that have had it done without issue. How would they be doing it if only the carrier is capable of this action? Thanks again.

Here in the UK we have mobile phone shops that provide an unlocking service but I'm not sure if they can unlock all phones.

 

[jools]

I was pretty sure that US/Canada and the UK had the same practices (I'm in Canada).

 

[J. A.]

Same here in Austria. There are shops with an unlocking service, but you have to choose carefully. They are not always reputable.

 

[jools]

The only one who can unlock your iPhone, is your carrier. Websites that claim they can unlock it, are not trustworthy. Third party software can not do it.
Apple doesn't unlock an iDevice, it's the carrier who does it.

I'm confused a little. I thought you had said that only Apple can do it? If third parties can also do it, what are they using to unlock the phones?

 

[APX7000]

To unlock my iPhone, I called AT&T and told them my contract was over and wanted my iPhone 5s unlocked. They checked my account and said ok. They said it would take a few days to process my unlock my request.

Was told to connect my iPhone to iTunes on my PC in a few days and sync it. Sure enough, a screen popped up saying "congratulations your iPhone has been unlocked".

That's how it worked for me in the USA with AT&T.

 

[jools]

Yeah it's the same in Canada. I'm more curious about how third parties do it though.

 

[J. A.]

I said only the carrier can do it, and Apple doesn't unlock iPhones.

I've never used the service of such a store, so I can't tell you how they do it. I suppose they'll have to contact the carrier to get it unlocked.

 

[APX7000]

Yeah it's the same in Canada. I'm more curious about how third parties do it though.

Via iTunes software hacks. Here's why I believe it *may* be possible via software hack for the iPhone.

Motorola does the exact same thing with auth servers and the Internet to add and validate new features to their high tiered radios. Using software debuggers you can find the code that adds these features or unlocks, and reverse the code when those op codes pass through the computers RAM. Simply flag this code in the debugger and have the software debugger stop there and manually edit the computer's RAM's op code(s).

When the unlock code comes up during each sync the op code could be;
0F 84 (which is jump if equal)
In live memory RAM you change this op code to
0F 85 (which is jump if not equal)

0F 84 tells the software to jump and bypass the unlocking code part of iTunes, but changing the code to 0F 85 it jumps to and processes the unlocking section of the software code even tho the auth servers said NO, DO NOT UNLOCK. It's simply reversing what's supposed to happen and processes the unlocking commands or code.

This is not an easy thing to do, and to find the code in the bloated iTunes or Moto software. But with enough time and experience anything is possible IMHO, even when auth servers are involved. What makes things harder is every time software is run through a debugger, the RAM addresses change.

IDA Pro software debugger, OllyDBG, 010 Editor would be the proper software tools needed to achieve this. I've peaked through the string references in iTunes and can see the unlocking code references. These 3 software cost around $2000.00 USD. No matter how well protected software is, the weakness is when the code is in the computers physical RAM, which can be edited or changed.

I've greatly simplified the above hoping some may be able to follow what I'm trying to say. If admins/mods feel my post is inappropriate, delete it.