2007-11-26 Baseband downgrade after failed AnySIM v1.2.1u try Version 4.02.13_G to 03.14.08_G # mv secpack40213.bin secpack # ./ieraser Baseband reset. Get FlashID Request Sending: 00000000 | 02 00 01 08 00 00 00 00 01 08 03 00 | ........ .... 0000000c Major: 0, Minor: 0, String: iEraser: tool by geohot thanks to gray and the dev team for the implementation thanks to nightwatch for the awesome toolchain and thanks to anonymous, iProof, lazyc0der, and dinopio for the idea for this cool trick this tool erases your main fw, starting at 0x20000. you need this for the testpoint to work you need a file called secpack matching your current firmware version in this folder see http://iphonejtag.blogspot.com for instructions on finding this file Waiting for data... Got Header: 77 0b cc 02 00 85 00 02 00 FF FF 85 02 03 00 SECPACK 02 00 04 02 06 00 01 00 00 00 00 00 0B 02 03 00 02 00 02 08 06 00 00 01 01 00 00 00 0A 08 03 00 02 00 03 08 20 00 00 20 00 00 FF DF FF FF CC 89 26 A0 43 4A 4B 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 0F 03 00 Erase 02 00 05 08 02 00 00 00 07 08 03 00 02 00 06 08 06 00 00 00 00 04 A0 00 B0 08 03 00 02 00 06 08 06 00 00 00 00 06 A0 00 B2 08 03 00 02 00 06 08 06 00 00 00 00 07 A0 00 B3 08 03 00 02 00 06 08 06 00 00 00 00 09 A0 00 B5 08 03 00 02 00 06 08 06 00 00 00 00 0A A0 00 B6 08 03 00 02 00 06 08 06 00 00 00 00 0C A0 00 B8 08 03 00 02 00 06 08 06 00 00 00 00 0D A0 00 B9 08 03 00 02 00 06 08 06 00 00 00 00 0F A0 00 BB 08 03 00 02 00 06 08 06 00 00 00 00 11 A0 00 BD 08 03 00 02 00 06 08 06 00 00 00 00 12 A0 00 BE 08 03 00 02 00 06 08 06 00 00 00 00 14 A0 00 C0 08 03 00 02 00 06 08 06 00 00 00 00 15 A0 00 C1 08 03 00 02 00 06 08 06 00 00 00 00 17 A0 00 C3 08 03 00 02 00 06 08 06 00 00 00 00 18 A0 00 C4 08 03 00 02 00 06 08 06 00 00 00 00 1A A0 00 C6 08 03 00 02 00 06 08 06 00 00 00 00 1C A0 00 C8 08 03 00 02 00 06 08 06 00 00 00 00 1D A0 00 C9 08 03 00 02 00 06 08 06 00 00 00 00 1F A0 00 CB 08 03 00 02 00 06 08 06 00 00 00 00 20 A0 00 CC 08 03 00 02 00 06 08 06 00 00 00 00 22 A0 00 CE 08 03 00 02 00 06 08 06 00 00 00 00 23 A0 00 CF 08 03 00 02 00 06 08 06 00 00 00 00 25 A0 00 D1 08 03 00 02 00 06 08 06 00 00 00 00 27 A0 00 D3 08 03 00 02 00 06 08 06 00 00 00 00 28 A0 00 D4 08 03 00 02 00 06 08 06 00 00 00 00 2A A0 00 D6 08 03 00 02 00 06 08 06 00 00 00 00 2B A0 00 D7 08 03 00 02 00 06 08 06 00 00 00 00 2D A0 00 D9 08 03 00 02 00 06 08 06 00 00 00 00 2E A0 00 DA 08 03 00 02 00 06 08 06 00 00 00 00 30 A0 00 DC 08 03 00 02 00 06 08 06 00 01 00 00 31 A0 00 DE 08 03 00 Hopefully the main flash was erased, wait for the next step... # ./bbupdater -v Resetting target... pinging the baseband... baseband unresponsive to pinging Done # ./bbupdater -e ICE03.14.08_G.eep -f ICE03.14.08_G.fls Preparing to flash using /dev/tty.baseband at 750000 baud Please reset target Resetting target... ProcessDetailUpdated: Boot-loader is active ProcessDetailUpdated: EBL version: 3.9_M3S2 3..9 ProcessDetailUpdated: Boot mode is: CC ProcessDetailUpdated: Baud rate set to 750000 ProcessDetailUpdated: Get flash id. ProcessDetailUpdated: CFI stage 1 ProcessDetailUpdated: Flash ID is: 88620089 ProcessDetailUpdated: CFI stage 2 ProcessDetailUpdated: Boot process finished ProcessOutlineUpdated: Reading SW version data ProcessDetailUpdated: Receiving data. ProgressUpdated: 100 ProcessDetailUpdated: Upload OK ProcessOutlineUpdated: Process time was 133 msec. Upgrade from ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ to Downloading EEP ProcessOutlineUpdated: Start downloading from file ICE03.14.08_G.eep. PuTTYProcessDetailUpdated: Sending sec-pack. ProcessDetailUpdated: Load region 0 ProcessDetailUpdated: Sending end-pack. ProcessDetailUpdated: Checksum OK. ProcessDetailUpdated: Verify OK ProcessOutlineUpdated: Process time was 1853 msec. Downloading FLS ProcessOutlineUpdated: Start downloading from file ICE03.14.08_G.fls. ProcessDetailUpdated: Erasing the dynamic eeprom area ProgressUpdated: 100 ProcessDetailUpdated: Sending sec-pack. ProcessDetailUpdated: Load region 0 ProcessDetailUpdated: Sending data. ProgressUpdated: 0 ProgressUpdated: 2 ProgressUpdated: 4 ProgressUpdated: 5 ProgressUpdated: 7 ProgressUpdated: 8 ProgressUpdated: 10 ProgressUpdated: 11 ProgressUpdated: 13 ProgressUpdated: 15 ProgressUpdated: 16 ProgressUpdated: 18 ProgressUpdated: 19 ProgressUpdated: 21 ProgressUpdated: 22 ProgressUpdated: 24 ProgressUpdated: 25 ProgressUpdated: 27 ProgressUpdated: 29 ProgressUpdated: 30 ProgressUpdated: 32 ProgressUpdated: 33 ProgressUpdated: 36 ProgressUpdated: 38 ProgressUpdated: 40 ProgressUpdated: 41 ProgressUpdated: 43 ProgressUpdated: 44 ProgressUpdated: 46 ProgressUpdated: 47 ProgressUpdated: 49 ProgressUpdated: 50 ProgressUpdated: 52 ProgressUpdated: 54 ProgressUpdated: 55 ProgressUpdated: 57 ProgressUpdated: 58 ProgressUpdated: 60 ProgressUpdated: 61 ProgressUpdated: 63 ProgressUpdated: 65 ProgressUpdated: 66 ProgressUpdated: 68 ProgressUpdated: 69 ProgressUpdated: 71 ProgressUpdated: 72 ProgressUpdated: 74 ProgressUpdated: 75 ProgressUpdated: 77 ProgressUpdated: 79 ProgressUpdated: 80 ProgressUpdated: 82 ProgressUpdated: 83 ProgressUpdated: 85 ProgressUpdated: 86 ProgressUpdated: 88 ProgressUpdated: 90 ProgressUpdated: 91 ProgressUpdated: 93 ProgressUpdated: 94 ProgressUpdated: 96 ProgressUpdated: 97 ProgressUpdated: 99 ProgressUpdated: 100 ProcessDetailUpdated: Load region 1 ProcessDetailUpdated: Sending data. ProgressUpdated: 0 ProgressUpdated: 1 ProgressUpdated: 2 ProgressUpdated: 3 ProgressUpdated: 4 ProgressUpdated: 5 ProgressUpdated: 6 ProgressUpdated: 7 ProgressUpdated: 8 ProgressUpdated: 9 ProgressUpdated: 10 ProgressUpdated: 11 ProgressUpdated: 12 ProgressUpdated: 13 ProgressUpdated: 14 ProgressUpdated: 15 ProgressUpdated: 16 ProgressUpdated: 17 ProgressUpdated: 18 ProgressUpdated: 19 ProgressUpdated: 20 ProgressUpdated: 21 ProgressUpdated: 22 ProgressUpdated: 23 ProgressUpdated: 24 ProgressUpdated: 25 ProgressUpdated: 26 ProgressUpdated: 27 ProgressUpdated: 28 ProgressUpdated: 29 ProgressUpdated: 30 ProgressUpdated: 31 ProgressUpdated: 32 ProgressUpdated: 33 ProgressUpdated: 34 ProgressUpdated: 35 ProgressUpdated: 36 ProgressUpdated: 37 ProgressUpdated: 38 ProgressUpdated: 39 ProgressUpdated: 40 ProgressUpdated: 41 ProgressUpdated: 42 ProgressUpdated: 43 ProgressUpdated: 44 ProgressUpdated: 45 ProgressUpdated: 46 ProgressUpdated: 47 ProgressUpdated: 48 ProgressUpdated: 49 ProgressUpdated: 50 ProgressUpdated: 51 ProgressUpdated: 52 ProgressUpdated: 53 ProgressUpdated: 54 ProgressUpdated: 55 ProgressUpdated: 56 ProgressUpdated: 57 ProgressUpdated: 58 ProgressUpdated: 59 ProgressUpdated: 60 ProgressUpdated: 61 ProgressUpdated: 62 ProgressUpdated: 63 ProgressUpdated: 64 ProgressUpdated: 65 ProgressUpdated: 66 ProgressUpdated: 67 ProgressUpdated: 68 ProgressUpdated: 69 ProgressUpdated: 70 ProgressUpdated: 71 ProgressUpdated: 72 ProgressUpdated: 73 ProgressUpdated: 74 ProgressUpdated: 75 ProgressUpdated: 76 ProgressUpdated: 77 ProgressUpdated: 78 ProgressUpdated: 79 ProgressUpdated: 80 ProgressUpdated: 81 ProgressUpdated: 82 ProgressUpdated: 83 ProgressUpdated: 84 ProgressUpdated: 85 ProgressUpdated: 86 ProgressUpdated: 87 ProgressUpdated: 88 ProgressUpdated: 89 ProgressUpdated: 90 ProgressUpdated: 91 ProgressUpdated: 92 ProgressUpdated: 93 ProgressUpdated: 94 ProgressUpdated: 95 ProgressUpdated: 96 ProgressUpdated: 97 ProgressUpdated: 98 ProgressUpdated: 99 ProgressUpdated: 100 ProcessDetailUpdated: Sending end-pack. ProcessDetailUpdated: Checksum OK. ProcessDetailUpdated: Verify OK ProcessOutlineUpdated: Process time was 2 min 5 sec. Resetting target... pinging the baseband... issuing +cpwroff... Done # ./bbupdater -v Resetting target... pinging the baseband... issuing +xgendata... firmware: DEV_ICE_MODEM_03.14.08_G eep version: EEP_VERSION:207 eep revision: EEP_REVISION:7 bootloader: BOOTLOADER_VERSION:3.9_M3S2 Done #