From ModMyiFone - Wiki
This guide assumes you already have OpenSSH installed on your iPhone, and are jailbroken.
This will be in 4 sections. The first step is what we are on. Section 2 is Upgrading to 1.1.1, Section 3 will be Preparing the 1.1.1 iPhone for Modding/Unlocking, and last section is actually Unlocking the 1.1.1 iPhone.
Step 1. - Prepare
Download the virginizing pack. Double-click the .zip file to uncompress it.
You will get a folder called virginize on your desktop.
Make sure you have your iPhone's time-out is set to never, and you know your iPhone's IP address. (Yes, you have to be connected to your WiFi network).
Open CyberDuck, and click Open Connection.
Note: If you prefer a different FTP program which supports SFTP (Transmit, Coda, Fugu, the list goes on...) you are more than welcome to use that one. I choose CyberDuck for this guide only because its free and we can all follow along. I myself prefer Transmit, but its $29.95. All the same for this guide...
From the previous step, enter your IP address, and fill out the rest of your information as I have here in the picture (SFTP, port 22, your iPhone's IP, username: root, and password: dottie - unless you've changed that). Click Continue.
CyberDuck will now display a file explorer window, most likely showing Library, Media, and another file. Navigate to /usr/bin/. Thats all the way at the top of the folder structure, then into the usr folder, then into the bin folder within the usr folder.
Open the virginize folder on your desktop, and drag the following files into your /usr/bin folder:
ICE03.14.08_G.fls
iUnlock
norz
bbupdater
eliteloader.bin
ICE03.14.08_G.eep
If it asks you to overwrite anything, hit Continue.
CyberDuck will display a status window, let it complete.
Click on each item, and hit Cmd+i to bring up the Info Window, and make sure it looks like the following image, and has the permissions set to 755. Then hit Apply.
Make sure you do this on all 6 of the files you just uploaded. It won't work if you don't.
Step 2. - Back up your seczone.
Open up Terminal. It can be found on your Mac at Applications/Utilities/Terminal. Make sure you are connected to your WiFi network, and still know your iPhone's IP address, as discussed in step 1.
Now, type
ssh -l root your.iPhone's.ip.address
and hit Return.
NOTE: You may get a message saying WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED. If you don't, skip down a bit in this guide to where Terminal is asking for the password...
If you did have that error, and ONLY IF YOU HAD THAT ERROR, then type:
rm /Users/your.os.x.user/.ssh/known_hosts
and hit Return.
Again, type
ssh -l root your.iPhone's.ip.address
If you got that previous remote host error, Terminal will tell you the RSA key fingerprint has changed, and would you like to change it? Type
yes
and hit Return.
You will be asked for the password. Assuming you haven't changed it (which you would know), the password is dottie. No, it will not show up as you type it. This is normal. Hit Return after you type the password.
You will now see a # prompt on the screen. Good. We are SSH'd into your iPhone's filesystem now.
Type
cd /usr/bin
followed by Return. Then type
ls
followed by Return. You should see a print-out similar to this. Good. If you do not, there is a problem, and you should post a forum topic with questions.
Type
launchctl unload /System/Library/LaunchDaemons/com.apple.CommCenter.plist
followed by Return. It may be easier for you to just Copy and Paste that into the Terminal window.
Now type
./norz seczone.backup 0x3FA000 0x2000
You should see the following print-out
geohot's nor dumper
all your norz are belong to us
super fast...just the way i like it
Dumping: A03FA000-A03FC000
Waiting for data...
Got Header: 77 0b cc
Increasing baud rate...
02 00 82 00 04 00 00 10 0E 00 A4 00 03 00
02 00 01 08 14 00 00 00 00 00 A4 00 03 00 09 00
00 00 33 2E 39 5F 4D 33 53 32 C3 0A 03 00
02 00 84 00 00 01 01 00 00 00 89 00 00 00 62 88
00 00 03 00 00 00 00 00 00 00 01 00 00 00 02 00
00 00 00 00 40 00 3F 00 00 00 00 00 01 00 08 00
00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 A6 03 03 00
02 00 85 00 02 00 FF FF 85 02 03 00
02 00 02 08 06 00 00 00 01 02 03 00 0E 08 03 00
Wrote: 0xa03fa000
Wrote: 0xa03fb000
Dumped
Good. You should now have a file called seczone.backup in your /usr/bin folder. You'll see it in CyberDuck. Drag it onto your desktop, or somewhere safe you can keep it. You prob won't need this at all, but its a good idea in case anything goes wrong.
Back in Terminal, type
./iUnlock ./ICE03.14.08_G.fls ./eliteloader.bin
and hit Return. Again, it may be easiest for you to just Copy/Paste it.
You should get the following print-out:
iUnlock v43.hiBaud -- Copyright 2007 The dev team
Credits: Daeken, Darkmen, guest184, gray, iZsh, pytey, roxfan, Sam, uns, Zappaz, Zf
Sending baudrate command speed 921600
Sending Begin Secpack command
Sending Erase command
Waiting For Erase Completion...
OK
Flashing
09%
18%
28%
37%
46%
56%
65%
75%
84%
93%
OK
Sending End Secpack command
Validating the write command
FW are equal!
Completed.
Enjoy!
Good. Now type
./bbupdater -v
and hit Return. You should get the following print-out
Great! Your seczone is repaired. Now lets flash it with the correct baseband version. Type
./bbupdater -f ./ICE03.14.08_G.fls -e ./ICE03.14.08_G.eep
and hit Return.
You should get the following print-out. It will take about as long as it takes to watch 2 bits of CSI and fast-forward through the commercials. ;)
Preparing to flash using /dev/tty.baseband at 750000 baud
Please reset target
Resetting target...
ProcessDetailUpdated: Boot-loader is active
ProcessDetailUpdated: EBL version: 3.9_M3S2 3..9
ProcessDetailUpdated: Boot mode is: CC
ProcessDetailUpdated: Baud rate set to 750000
ProcessDetailUpdated: Get flash id.
ProcessDetailUpdated: CFI stage 1
ProcessDetailUpdated: Flash ID is: 88620089
ProcessDetailUpdated: CFI stage 2
ProcessDetailUpdated: Boot process finished
ProcessOutlineUpdated: Reading SW version data
ProcessDetailUpdated: Receiving data.
ProgressUpdated: 100
ProcessDetailUpdated: Upload OK
ProcessOutlineUpdated: Process time was 132 msec.
Upgrade from to
Downloading EEP
ProcessOutlineUpdated: Start downloading from file ./ICE03.14.08_G.eep.
ProcessDetailUpdated: Sending sec-pack.
ProcessDetailUpdated: Load region 0
ProcessDetailUpdated: Sending end-pack.
ProcessDetailUpdated: Checksum OK.
ProcessDetailUpdated: Verify OK
ProcessOutlineUpdated: Process time was 1782 msec.
Downloading FLS
ProcessOutlineUpdated: Start downloading from file ./ICE03.14.08_G.fls.
ProcessDetailUpdated: Erasing the dynamic eeprom area
ProgressUpdated: 100
ProcessDetailUpdated: Sending sec-pack.
ProcessDetailUpdated: Load region 0
ProcessDetailUpdated: Sending data.
ProgressUpdated: 0
ProgressUpdated: 2
ProgressUpdated: 4
ProgressUpdated: 5
ProgressUpdated: 7
ProgressUpdated: 8
ProgressUpdated: 10
ProgressUpdated: 11
ProgressUpdated: 13
ProgressUpdated: 15
ProgressUpdated: 16
ProgressUpdated: 18
ProgressUpdated: 19
ProgressUpdated: 21
ProgressUpdated: 22
ProgressUpdated: 24
ProgressUpdated: 25
ProgressUpdated: 27
ProgressUpdated: 29
ProgressUpdated: 30
ProgressUpdated: 32
ProgressUpdated: 33
ProgressUpdated: 35
ProgressUpdated: 36
ProgressUpdated: 38
ProgressUpdated: 40
ProgressUpdated: 41
ProgressUpdated: 43
ProgressUpdated: 44
ProgressUpdated: 46
ProgressUpdated: 47
ProgressUpdated: 49
ProgressUpdated: 50
ProgressUpdated: 52
ProgressUpdated: 54
ProgressUpdated: 55
ProgressUpdated: 57
ProgressUpdated: 58
ProgressUpdated: 60
ProgressUpdated: 61
ProgressUpdated: 63
ProgressUpdated: 65
ProgressUpdated: 66
ProgressUpdated: 68
ProgressUpdated: 69
ProgressUpdated: 71
ProgressUpdated: 72
ProgressUpdated: 74
ProgressUpdated: 75
ProgressUpdated: 77
ProgressUpdated: 79
ProgressUpdated: 80
ProgressUpdated: 82
ProgressUpdated: 83
ProgressUpdated: 85
ProgressUpdated: 86
ProgressUpdated: 88
ProgressUpdated: 90
ProgressUpdated: 91
ProgressUpdated: 93
ProgressUpdated: 94
ProgressUpdated: 96
ProgressUpdated: 97
ProgressUpdated: 99
ProgressUpdated: 100
ProcessDetailUpdated: Load region 1
ProcessDetailUpdated: Sending data.
ProgressUpdated: 0
ProgressUpdated: 1
ProgressUpdated: 2
ProgressUpdated: 3
ProgressUpdated: 4
ProgressUpdated: 5
ProgressUpdated: 6
ProgressUpdated: 7
ProgressUpdated: 8
ProgressUpdated: 9
ProgressUpdated: 10
ProgressUpdated: 11
ProgressUpdated: 12
ProgressUpdated: 13
ProgressUpdated: 14
ProgressUpdated: 15
ProgressUpdated: 16
ProgressUpdated: 17
ProgressUpdated: 18
ProgressUpdated: 19
ProgressUpdated: 20
ProgressUpdated: 21
ProgressUpdated: 22
ProgressUpdated: 23
ProgressUpdated: 24
ProgressUpdated: 25
ProgressUpdated: 26
ProgressUpdated: 27
ProgressUpdated: 28
ProgressUpdated: 29
ProgressUpdated: 30
ProgressUpdated: 31
ProgressUpdated: 32
ProgressUpdated: 33
ProgressUpdated: 34
ProgressUpdated: 35
ProgressUpdated: 36
ProgressUpdated: 37
ProgressUpdated: 38
ProgressUpdated: 39
ProgressUpdated: 40
ProgressUpdated: 41
ProgressUpdated: 42
ProgressUpdated: 43
ProgressUpdated: 44
ProgressUpdated: 45
ProgressUpdated: 46
ProgressUpdated: 47
ProgressUpdated: 48
ProgressUpdated: 49
ProgressUpdated: 50
ProgressUpdated: 51
ProgressUpdated: 52
ProgressUpdated: 53
ProgressUpdated: 54
ProgressUpdated: 55
ProgressUpdated: 56
ProgressUpdated: 57
ProgressUpdated: 58
ProgressUpdated: 59
ProgressUpdated: 60
ProgressUpdated: 61
ProgressUpdated: 62
ProgressUpdated: 63
ProgressUpdated: 64
ProgressUpdated: 65
ProgressUpdated: 66
ProgressUpdated: 67
ProgressUpdated: 68
ProgressUpdated: 69
ProgressUpdated: 70
ProgressUpdated: 71
ProgressUpdated: 72
ProgressUpdated: 73
ProgressUpdated: 74
ProgressUpdated: 75
ProgressUpdated: 76
ProgressUpdated: 77
ProgressUpdated: 78
ProgressUpdated: 79
ProgressUpdated: 80
ProgressUpdated: 81
ProgressUpdated: 82
ProgressUpdated: 83
ProgressUpdated: 84
ProgressUpdated: 85
ProgressUpdated: 86
ProgressUpdated: 87
ProgressUpdated: 88
ProgressUpdated: 89
ProgressUpdated: 90
ProgressUpdated: 91
ProgressUpdated: 92
ProgressUpdated: 93
ProgressUpdated: 94
ProgressUpdated: 95
ProgressUpdated: 96
ProgressUpdated: 97
ProgressUpdated: 98
ProgressUpdated: 99
ProgressUpdated: 100
ProcessDetailUpdated: Sending end-pack.
ProcessDetailUpdated: Checksum OK.
ProcessDetailUpdated: Verify OK
ProcessOutlineUpdated: Process time was 1 min 53 sec.
Resetting target...
pinging the baseband...
issuing +cpwroff...
Done
Awesome! Almost there... now lets type
./bbupdater -v
and hit Return again. You should get this output:
Resetting target...
pinging the baseband...
issuing +xgendata...
firmware: DEV_ICE_MODEM_03.14.08_G
eep version: EEP_VERSION:207
eep revision: EEP_REVISION:7
bootloader: BOOTLOADER_VERSION:3.9_M3S2
Done
Step 3. - Restore your iPhone.
Make sure the iPhone is connected to the computer, and hold down the Sleep and home buttons for 25 seconds until the yellow triangle comes up and asks you to connect to iTunes. iTunes will ask you if you want to restore. Hold down Option and click restore. When iTunes asks you what file you would like to restore from, navigate to your 1.0.2 folder. You may have to rename that file to .zip and uncompress it, and should NOT download it with Safari, since Safari will decompress it automatically. Use Camino or Firefox. It will begin to restore - let it run its course. Once it has completed, we can move forwards.
All right! Your iPhone is virginized and ready to upgrade to 1.1.1 then unlock!
