How is the IMEI and s/n stored?

Question

iPhone 6

Información y guías de reparación para el iPhone 6 que salió a la venta el 19 de septiembre de 2014. Números de modelo: A1549, A1586 y A1589

Preguntas 4994 Ver todo

Gigabit87898 @gigabit87898

Rep: 16.1mil

39

92

13

Publicado: 17 de feb. de 2017

Opciones

How is the IMEI and s/n stored?

Okay, so I have a baseband eeprom and NAND from a unlocked, iCloud free board. The baseband and cpu were destroyed. I also have a iCloud locked, not stolen or anything, board that works fine. So, if I transfer the eepromm and NAND to the iCloud locked board, will it get the IMEI from the iCloud free one? Here's what I think happens but I could be totally wrong.

The eeprom programs the bb and CPU from its memory.

The NAND verify a everything is matching.

It restores.

Then you check if it shows in settings and in *#06#

Could be totally wrong, but would it work?

Contestado! Ver respuesta Yo también tengo este problema

Es esta una buena pregunta?

Sí No

Puntuación 4

2 comentarios

You should ask @tomchai ...he's probably the best person to answer this properly.

17 de feb. de 2017 - de Minho

I would just figure it out myself, but I don't want to waste a good donor board or break the NAND or eeprom.

17 de feb. de 2017 - de Gigabit87898

Agregar un comentario

7 Respuestas

Solución Elegida

Tom Chai @tomchai

Rep: 73.8mil

19

111

82

Publicado: 17 de feb. de 2017

Opciones

From what I know the S/N is in the main NAND and there are tools to modify that. However it must match the IMEI on Apple activation server records in order for the phone to be activated.

The baseband is another story. The IMEI is either burned into the BB or encrypted and stored in the BB EEPROM. All content or at least sensitive information in the EEPROM is encrypted with a unique key in the BB. There is no way to alter or even readout the information as plaintext. The BB and BB EEPROM has to be present as a matching set, with BB destroyed there is no way to make it work.

Fue útil esta respuesta?

Sí No

Puntuación 9

32 comentarios:

But, with the BB eeprom, being readable/write able. Can't you use an eeprom reader to change what's on the chip, and make it useable?

17 de feb. de 2017 - de iMedic

The baseband wasn't destroyed, it was lost -_- I lost it on my desk and I couldn't find it but I wil clean my desk and try to find it. What about the CPU?

17 de feb. de 2017 - de Gigabit87898

Update: I found the baseband. I reballed it and it looks good. So what about the CPU? If I use the one that is one there will it work or will I have to solder a brand new one?

17 de feb. de 2017 - de Gigabit87898

CPU from what I know has to be matched with a small chip in the back or you may end up with red screen. It is called "anti-rollback EEPROM" "U0301" in the schematics. Also obviously you need the matching HB to have Touch ID and matching NFC chip to have Apple Pay.

Not sure these device core chips has to be matched with BB subsystem, NAND S/N or not.

17 de feb. de 2017 - de Tom Chai

@theimedic You actually can read/write to the EEPROM, but what to do with the data? You can't edit or even make sense of the encrypted sections.

Limited recovery on non-critical sections are actually possible. If your device has -1 error and it happens to be baseband EEPROM data error that are not in the critical section, someone in China is able to fix that for you. But if the critical section is damaged or not matching, nobody can help.

17 de feb. de 2017 - de Tom Chai

Mostrar 27 comentarios más

Agregar un comentario

You should ask @tomchai ...he's probably the best person to answer this properly. — Minho
I would just figure it out myself, but I don't want to waste a good donor board or break the NAND or eeprom. — Gigabit87898
But, with the BB eeprom, being readable/write able. Can't you use an eeprom reader to change what's on the chip, and make it useable? — iMedic
The baseband wasn't destroyed, it was lost -_- I lost it on my desk and I couldn't find it but I wil clean my desk and try to find it. What about the CPU? — Gigabit87898
Update: I found the baseband. I reballed it and it looks good. So what about the CPU? If I use the one that is one there will it work or will I have to solder a brand new one? — Gigabit87898
CPU from what I know has to be matched with a small chip in the back or you may end up with red screen. It is called "anti-rollback EEPROM" "U0301" in the schematics. Also obviously you need the matching HB to have Touch ID and matching NFC chip to have Apple Pay.

Not sure these device core chips has to be matched with BB subsystem, NAND S/N or not. — Tom Chai
@theimedic You actually can read/write to the EEPROM, but what to do with the data? You can't edit or even make sense of the encrypted sections.

Limited recovery on non-critical sections are actually possible. If your device has -1 error and it happens to be baseband EEPROM data error that are not in the critical section, someone in China is able to fix that for you. But if the critical section is damaged or not matching, nobody can help. — Tom Chai

iMedic @theimedic Rep: 57.5mil iMedic Phone Repairs 18 77 212 · Answer 1 · 2017-02-17T15:46:50-07:00

iMedic @theimedic

Rep: 57.5mil

iMedic Phone Repairs

18

77

212

Publicado: 17 de feb. de 2017

Opciones

Well.. You wouldn't be "wasting" a board. Because the donor board is Apple ID locked. I've been going through this path myself, and looking for chips that I can transfer to boards that are Apple ID locked. I also think the better method, would be to buy an eeprom reader, remove the nand, reprogram the nand, and get the board out as a new phone, with no data on it at all

[enlace de guía no válido]

@tomchai

I always appreciate and value your insight. When you say the BB can't be interfaces. Is this guy just selling me something?

Fue útil esta respuesta?

Sí No

Puntuación 6

4 comentarios:

He is probably just trying to sell you something.

22 de feb. de 2017 - de Gigabit87898

That's what I gotta find out

22 de feb. de 2017 - de iMedic

how has the transferring of chips been going? I bought a iphone 6 and its blacklisted and I was thinking of going a similar route but wanted to talk to somebody whos done it before

27 de ene. de 2018 - de Steven Scott

@theimedic

You didn’t understand this guy as baseband eeprom adapter and nand adapters are 2 separate things.

If you meant that you get the band adapter and reprogram the band with what?

you have to read out the same information and if you change the band you have the add write the same info back in or the phone will stuck on activation screen. (Info like serial number Mac addresses etc)

29 de sep. de 2018 - de Soft Solutions

Agregar un comentario

shade @shade44459 Rep: 109 5 1 · Answer 2 · 2018-11-08T02:44:44-07:00

shade @shade44459

Rep: 109

5

1

Publicado: 8 de nov. de 2018

Opciones

This is the machine used by Foxconn which is who repairs apples iPhones and iPads. This is used in a situation when the SN and IMEI needs to be recirculated due to a total loss board or warranty claim where the activation chain has to be the exact one as before. (Edit: they no longer recirculate IMEI numbers due to federal laws prohibiting IMEI number changing, as well as they mark them inactive in their internal program and yes they can see that if you ever call in for support) You need both the SN and IMEI in order to make sure apple servers don’t brick the phone, which yes, is built into the phones software.

https://rover.ebay.com/rover/0/0/0?mpre=...

these machines can also remove iCloud locks as the iCloud is SN based by apple. Simply changing an 0 to an O or 1 to l works and removes iCloud locks, however find my iPhone will never work again.

in theory, this can be used for cell phone ghosting and has been used by intelligence agencies for some time. Do with the info what you will I am merely posting for educational purposes and to advise that changing any IMEI number is a crime, a very serious one at that.

Fue útil esta respuesta?

Sí No

Puntuación 2

1 comentario:

This machine does nothing of the kind. It is for reading and writing the metadata of the NAND or EEPROM, among other things. This is useful for clearing corrupted NAND chips from certain iTunes error but the actual user data is lost forever.

In order to "remove" iCloud lock, all paired IC's must have matching metadata and as of today, there is no way to read or write to the BB CPU nor the Ax CPU/SoC.

9 de nov. de 2018 - de Minho

Agregar un comentario