ios12卡贴机(有锁)/无锁机 改电信一步到位

admin 2024年3月2日01:46:53评论19 views字数 14526阅读48分25秒阅读模式

ios12卡贴机(有锁)/无锁机 改电信VOLTE //高通基带//教程

基本要求

一、ios12.0-12.12可越狱就行

二、已开通volte

三、确保已经固定G值和有完整可用的shsh2

四、卡贴机尽量别折腾3G回落 无锁请食用


准备工作

零、卡贴机必看步骤 无锁忽略

用卡贴iccid解锁 一定要用卡贴黑解

一、运营商文件选择

band1/band3/band5的运营商规则文件

Docomo_jp.bundle(可能会出现发送短信问题)

KDDI_LTE_only_jp.bundle(部分用户出现无法激活iMessage和FaceTime)

SingTel_sg.bundle(部分用户出现安卓VoLTE用户无法呼入)

锁定band5的运营商

USCellular_LTE_US.bundle[完美支持3G,3G不可上网

3G可上网4G完美VoLTE

Verizon_LTE_US.bundle会出现iPhone需要激活可能会在通话时出现挂断电话风险较高

二、越狱准备

app.ignition.fun 下载 uncover rootlessJB

查看并固定G值+越狱获取权限

打开爱思助手》刷机越狱》高级功能》下载shsh文件

ios12卡贴机(有锁)/无锁机 改电信一步到位

保存后打开shsh文件 找到generator 复制值0x5958c0c45b4d87e4

ios12卡贴机(有锁)/无锁机 改电信一步到位

打开uncover》settings 找到 Boot Nonce 输入刚刚复制的值

ios12卡贴机(有锁)/无锁机 改电信一步到位

然后 选中 load Daemons 、Disable Auto Updates、Disable App Revokes、Overwrite Boot Nonce、

Restore RootFS(recover)、Reload System Daemons 再去点击Jailbreak

ios12卡贴机(有锁)/无锁机 改电信一步到位

等待弹窗

ios12卡贴机(有锁)/无锁机 改电信一步到位

点击OK 自动退出应用

接着打开rootlessJB 点击Jailbreak 会自动注销 然后解锁就有权限修改文件了

ios12卡贴机(有锁)/无锁机 改电信一步到位

打开Filza

打开目录system/library/carrier bundles/iPhone/ChinaTelecom_USIM_cn.bundle/ 备份ChinaTelecom_USIM_cn.bundle文件夹 并删除去夹内内容

打开目录system/library/carrier bundles/iPhone/

并寻找上文提到的运营商文件夹

一、运营商文件选择

band1/band3/band5的运营商规则文件

Docomo_jp.bundle(可能会出现发送短信问题)

KDDI_LTE_only_jp.bundle(部分用户出现无法激活iMessage和FaceTime)

SingTel_sg.bundle(部分用户出现安卓VoLTE用户无法呼入)

锁定band5的运营商

USCellular_LTE_US.bundle[完美支持3G3G不可上网

3G可上网4G完美VoLTE

Verizon_LTE_US.bundle会出现iPhone需要激活可能会在通话时出现挂断电话风险较高

复制其中的文件 到ChinaTelecom_USIM_cn.bundle中粘贴

打开目录/system/library 找到carrier bundles文件夹 加权限0555应用到子项目

ios12卡贴机(有锁)/无锁机 改电信一步到位

ios12卡贴机(有锁)/无锁机 改电信一步到位

ios12卡贴机(有锁)/无锁机 改电信一步到位

再点击右上角的存储

打开目录/var/mobile/library/ 删除 carrier bundles 然后重启手机

打开目录etc 找到hosts文件用文本编辑器打开 添加127.0.0.1 appldnld.apple.com 和 127.0.0.1 mesu.apple.com 保存文件并重启手机

ios12卡贴机(有锁)/无锁机 改电信一步到位

重启后可能会出现LTE或空心信号或出现信号一会消失

等10秒左右

飞行一次重新出信号

然后执行下步操作 没信号也直接跳过

再次半越狱uncover、rootlessJb进入/var/mobile/library/carrier bundles/overlay/打开device+carrier+46011+Dxx+3x.x.x.plist找到DerPriFileName复制其值

一般都是 overrides_D20_D21_D22.der.pri

ios12卡贴机(有锁)/无锁机 改电信一步到位

ios12卡贴机(有锁)/无锁机 改电信一步到位

以文本编辑器打开文件

ios12卡贴机(有锁)/无锁机 改电信一步到位

全选删除内容

复制下方代码 粘贴进去 保存文件

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>APNEditabilityTypemask</key> <integer>5</integer> <key>AllowedServicesTypeMaskOnInternet</key> <integer>32769</integer> <key>AttachAPN</key> <dict> <key>3GPP</key> <dict> <key>AllowedProtocolMask</key> <integer>3</integer> <key>AllowedProtocolMaskInRoamingLTE</key> <integer>3</integer> <key>DefaultProtocolMask</key> <integer>3</integer> <key>PcscfAddressRequired</key> <false/> </dict> </dict> <key>CarrierEntitlements</key> <dict> <key>Authentication</key> <dict> <key>BsfPort</key> <integer>8080</integer> <key>Type</key> <integer>2</integer> <key>Username</key> <string>[email protected]$MNC.mcc$MCC.3gppnetwork.org</string> </dict> <key>ProtocolVersion</key> <string>2</string> <key>ProvisioningRecheckPeriod</key> <integer>5</integer> <key>ServerAddress</key> <string>https://applecsb.crm.189.cn:8101/CRM-CSB/HttpAppleService</string> <key>SupportedEntitlements</key> <integer>1024</integer> <key>UpdatePeriod</key> <integer>24</integer> <key>UserAgent</key> <string>3gpp-gba</string> </dict> <key>CarrierName</key> <string>中国电信</string> <key>CarrierSpace</key> <dict> <key>AuthClientID</key> <string>sg_client</string> <key>AuthorizationURL</key> <string>https://ct.crm.189.cn:86/pubPortal/appleAuth/init</string> <key>AutoRefreshMinimumIntervalMins</key> <integer>1440</integer> <key>DataOptimizationAllowed</key> <true/> <key>ManualRefreshMinimumIntervalMins</key> <integer>30</integer> <key>PlanProvisioningPollInterval</key> <integer>360</integer> <key>SupportsApps</key> <true/> <key>SupportsPlans</key> <true/> <key>SupportsUsage</key> <true/> <key>TeamIDList</key> <array> <string>7338DEUF7S</string> </array> <key>TokenURL</key> <string>https://ct.crm.189.cn:86/pubPortal/appleAuth/initback</string> </dict> <key>CellularDataUsage</key> <dict> <key>ShowMonthlyDataUsage</key> <true/> </dict> <key>CheckSMSonSIM</key> <true/> <key>CustomerServicePhoneNumber</key> <string>10000</string> <key>DataIndicatorOverrideForLTE</key> <string>4G</string> <key>DerPriFileName</key> <string>overrides_D20_D21_D22.der.pri</string> <key>DerPriFileVersion</key> <string>0.0.19</string> <key>EnableLTEAfterUpgrade</key> <true/> <key>IMSConfig</key> <dict> <key>AllowHandoverWithoutIMSVoiceService</key> <true/> <key>ConferenceCalling</key> <dict> <key>SendConferenceSubscribeInNewDialog</key> <true/> <key>conferenceServer</key> <string>sip:[email protected]${MNC}.mcc${MCC}.3gppnetwork.org</string> </dict> <key>Media</key> <dict> <key>EnableBandwidthSpecifiers</key> <true/> <key>HideSessionLevelDirection</key> <true/> <key>InactivityTimerRTCPSeconds</key> <integer>20</integer> <key>IncludeSDPMaxRed</key> <true/> <key>IncludeSDPModeChangeCapability</key> <true/> <key>MaxRedundancy</key> <integer>220</integer> <key>PreferredAMRWBMode</key> <string>8</string> <key>RTCPIntervalSeconds</key> <integer>5</integer> <key>UseRestrictiveDirectionWhenCreatingAnswer</key> <false/> </dict> <key>SMS</key> <dict> <key>SMSBundleToVoice</key> <true/> <key>SupportedDomains</key> <dict> <key>CDMA</key> <false/> <key>CDMA2000</key> <false/> <key>LTE</key> <true/> </dict> <key>TR1MTimer</key> <dict> <key>IsFatalOnIMSSendFailure</key> <true/> <key>IsFatalOnIMSSendSuccess</key> <false/> <key>TimerValue</key> <integer>133</integer> </dict> <key>allowCSFBInVolteMode</key> <true/> </dict> <key>Signaling</key> <dict> <key>AdditionalContactParams</key> <dict> <key>INVITE:200,PRACK:200,UPDATE:200</key> <string>audio</string> <key>REGISTER</key> <string>+g.3gpp.accesstype="cellular2"</string> <key>REGISTER,INVITE,INVITE:*</key> <string>+g.3gpp.mid-call;+g.3gpp.srvcc-alerting;+g.3gpp.ps2cs-srvcc-orig-pre-alerting</string> </dict> <key>AdditionalFeatureTags</key> <dict> <key>voice</key> <dict> <key>audio</key> <string></string> </dict> </dict> <key>AllowAnonymousEmergencyCalls</key> <false/> <key>AllowRegistrationCanceledState</key> <true/> <key>AllowResponsesOverDifferentTransport</key> <false/> <key>AlwaysUnsubscribeFromRegEvents</key> <false/> <key>CallEndReasons</key> <dict> <key>Blocked</key> <dict> <key>StatusCode</key> <integer>486</integer> </dict> <key>RejectedByUser</key> <dict> <key>ReasonHeaderText</key> <string>Decline</string> <key>StatusCode</key> <integer>603</integer> </dict> </dict> <key>ConvertSessionProgressToRinging</key> <false/> <key>DefaultAuthAlgorithm</key> <string>AKAv1-MD5</string> <key>DontSendPreconditionsIfCallWaitingDisabled</key> <true/> <key>DropRegistrationOnSRVCC</key> <true/> <key>EarlyMediaNeedsHeader</key> <true/> <key>EmergencyURNs</key> <dict> <key>110</key> <string>urn:service:sos.police</string> <key>119</key> <string>urn:service:sos.fire</string> <key>120</key> <string>urn:service:sos.ambulance</string> <key>122</key> <string>urn:service:sos.traffic</string> </dict> <key>EnableEmergencyRegistration</key> <true/> <key>EnableSenderName</key> <false/> <key>ForbiddenRegistrationErrorCodes</key> <string>4xx,-404,5xx,6xx</string> <key>IncomingCallEndReasons</key> <dict> <key>RequestTimeout</key> <dict> <key>Protocol</key> <string>Q.850</string> <key>ReasonHeaderCause</key> <integer>19</integer> <key>StatusCode</key> <integer>408</integer> <key>TerminationEvent</key> <string>RemoteHangup</string> </dict> <key>TemporarilyUnavailable</key> <dict> <key>StatusCode</key> <integer>480</integer> <key>TerminationEvent</key> <string>RemoteCallRejected</string> </dict> </dict> <key>IncompleteRegistrationThrottlingIntervalSeconds</key> <integer>0</integer> <key>InviteErrorResponsesToTriggerCSFB</key> <string>500,503</string> <key>LocalQoSTimeoutMOSeconds</key> <integer>6</integer> <key>LocalQoSTimeoutMTSeconds</key> <integer>6</integer> <key>MaxReRegistrationAttempts</key> <integer>0</integer> <key>MinSessionExpiresSeconds</key> <integer>600</integer> <key>NetworkTerminationRetryIntervalSeconds</key> <integer>1</integer> <key>Preconditions</key> <string>Supported</string> <key>ResetDisabledModeOnEvents</key> <string>SimInserted,AirplaneModeToggled,AccessNetworkChanged</string> <key>RingbackTimerSeconds</key> <integer>95</integer> <key>RingingTimerSeconds</key> <integer>90</integer> <key>SRVCCCleanupTimeoutSeconds</key> <integer>0</integer> <key>SendResumeInviteAsSendRecv</key> <false/> <key>SipTimers</key> <dict> <key>InviteResponseTimeout</key> <integer>6000</integer> </dict> <key>StartLocalQosTimerOnSessionProgress</key> <true/> <key>SupportPEarlyMediaHeader</key> <true/> <key>UseFakeSAsForDeregistration</key> <true/> <key>UseIPSec</key> <true/> <key>UseNormalIdentityForEmergencyUSIM</key> <true/> <key>VirtualInterfaceMtu</key> <integer>4096</integer> </dict> <key>Voice</key> <dict> <key>DialAsEmergencyOverIMSForUndetectedEmergency</key> <true/> <key>E911OverIMSSupported</key> <true/> <key>EnableVolteByDefault</key> <true/> <key>PreAlertingDTMFSupported</key> <true/> </dict> <key>XCAP</key> <dict> <key>BsfHost</key> <string>bsf.mnc011.mcc460.pub.3gppnetwork.org</string> <key>BsfPort</key> <integer>8080</integer> <key>ContentType</key> <string>application/xcap-el+xml</string> <key>DisableCLIRModification</key> <true/> <key>DisableOnNetworkError</key> <true/> <key>NafHost</key> <string>xcap.ims.mnc011.mcc460.pub.3gppnetwork.org</string> <key>NafPort</key> <integer>80</integer> <key>SupportsCLIR</key> <false/> <key>SupportsCW</key> <false/> <key>imsFeatureDependency</key> <false/> <key>supported</key> <true/> </dict> </dict> <key>IgnoresDeactivateOnNetworkScanServiceMask</key> <integer>131072</integer> <key>MMS</key> <dict> <key>GroupModeAllowUserOverride</key> <true/> <key>GroupModeEnabled</key> <false/> <key>MMSC</key> <string>http://mmsc.vnet.mobi</string> <key>MaxMessageSize</key> <integer>307200</integer> <key>MaxRecipients</key> <integer>10</integer> <key>MaxSubjectLenBytes</key> <integer>80</integer> <key>MaxVoiceCallWaitPeriod</key> <integer>0</integer> <key>Proxy</key> <string>10.0.0.200:80</string> <key>vCard21ExportModeEnabled</key> <true/> </dict> <key>MaxBluetoothModemConnections</key> <integer>5</integer> <key>PhoneNumberRegistrationGatewayAddress</key> <string>00447786205094</string> <key>RemoteCardProvisioningSettings</key> <dict> <key>ActivatingStateSubscriptionCheckTimerIntervals</key> <array> <integer>300</integer> <integer>480</integer> <integer>600</integer> </array> <key>InconsistentICCIDLength</key> <true/> <key>MatchingICCIDPrefixes</key> <array> <string>898603</string> <string>898611</string> </array> <key>MinCompatibleWatchOS</key> <string>5.1</string> <key>ProvisioningMethod</key> <string>CarrierFlow</string> <key>ServerURL</key> <string>https://esimapple.crm.189.cn</string> <key>SupportedSKUs</key> <array> <string>SKU_CU</string> </array> <key>SupportsFauxCard</key> <true/> <key>UsesAutoAssignment</key> <false/> </dict> <key>RemoteDiagnosticsWWANAllowed</key> <true/> <key>SMSSettings</key> <dict> <key>CustomTeleserviceIDs</key> <dict> <key>FDEA</key> <string>1004</string> <key>FDED</key> <string>1002</string> </dict> <key>IgnoreWAPPushBits</key> <integer>69</integer> <key>TerminalRegistration</key> <dict> <key>DestinationAddress</key> <string>10659401</string> <key>Registration</key> <string>&lt;a1&gt;&lt;b1&gt;ACM-$MODEL&lt;/b1&gt;&lt;b2&gt;$MEID&lt;/b2&gt;&lt;b3&gt;$IMSI&lt;/b3&gt;&lt;b4&gt;$VERSION&lt;/b4&gt;&lt;/a1&gt;</string> <key>TeleserviceID</key> <integer>65005</integer> </dict> </dict> <key>SaveICCIDToCache</key> <true/> <key>Services</key> <array> <dict> <key>ServiceCode</key> <string>10000</string> <key>ServiceName</key> <string>客户服务热线</string> </dict> <dict> <key>ServiceCode</key> <string>10001</string> <key>ServiceName</key> <string>自助服务热线</string> </dict> <dict> <key>ServiceCode</key> <string>+8618918910000</string> <key>ServiceName</key> <string>国际漫游客服</string> </dict> </array> <key>ShouldHideAllVoicemailUI</key> <true/> <key>Show3GSwitch</key> <false/> <key>Show4GSwitch</key> <true/> <key>ShowDialAssist</key> <true/> <key>ShowMessagesConversationListFilteringPrompt</key> <false/> <key>ShowTTY</key> <false/> <key>ShowVolteSwitch</key> <true/> <key>StatusBarImages</key> <array> <dict> <key>AllowPrefixMatching</key> <true/> <key>CarrierName</key> <string>CHN-CT</string> <key>StatusBarCarrierName</key> <string>中国电信</string> </dict> <dict> <key>AllowPrefixMatching</key> <false/> <key>CarrierName</key> <string>U.S. Cellular</string> <key>StatusBarCarrierName</key> <string>中国电信</string> </dict> <dict> <key>AllowPrefixMatching</key> <true/> <key>StatusBarCarrierName</key> <string>中国电信</string> </dict> </array> <key>StockSymboli</key> <array> <dict> <key>name</key> <string>中国电信</string> <key>symbol</key> <string>0728.HK</string> </dict> </array> <key>SupportedSIMs</key> <array> <string>46011</string> <string>20404_ID-898611</string> </array> <key>SupportsFlashInfoCallTimer</key> <true/> <key>SupportsImsCapability</key> <true/> <key>SupportsNITZ</key> <false/> <key>SupportsUserBusyCauseCode</key> <true/> <key>URLifyUnquotedShorts</key> <true/> <key>VVMIgnoresIntlDataRoaming</key> <true/> <key>apns</key> <array> <dict> <key>configuration</key> <array> <dict> <key>AllowedProtocolMask</key> <integer>3</integer> <key>AllowedProtocolMaskInRoaming</key> <integer>3</integer> <key>DefaultProtocolMask</key> <integer>3</integer> <key>apn</key> <string>ctnet</string> <key>password</key> <string></string> <key>type-mask</key> <integer>1081395</integer> <key>username</key> <string></string> </dict> <dict> <key>AllowedProtocolMask</key> <integer>3</integer> <key>AllowedProtocolMaskInRoaming</key> <integer>3</integer> <key>DefaultProtocolMask</key> <integer>3</integer> <key>apn</key> <string>ctwap</string> <key>password</key> <string></string> <key>type-mask</key> <integer>4</integer> <key>username</key> <string></string> </dict> <dict> <key>AllowedProtocolMask</key> <integer>3</integer> <key>AllowedProtocolMaskInRoaming</key> <integer>3</integer> <key>DefaultProtocolMask</key> <integer>3</integer> <key>WaitForBringUpComplete</key> <true/> <key>apn</key> <string>IMS</string> <key>password</key> <string></string> <key>type-mask</key> <integer>131072</integer> <key>username</key> <string></string> </dict> <dict> <key>AllowedProtocolMask</key> <integer>3</integer> <key>AllowedProtocolMaskInRoaming</key> <integer>3</integer> <key>DefaultProtocolMask</key> <integer>3</integer> <key>apn</key> <string>ctnet</string> <key>password</key> <string></string> <key>type-mask</key> <integer>1081394</integer> <key>username</key> <string></string> </dict> <dict> <key>AllowedProtocolMask</key> <integer>3</integer> <key>DefaultProtocolMask</key> <integer>3</integer> <key>apn</key> <string>SOS</string> <key>password</key> <string></string> <key>type-mask</key> <integer>262144</integer> <key>username</key> <string></string> </dict> </array> <key>technology-mask</key> <integer>9</integer> </dict> </array> <key>e_only_whitelist</key> <array> <string>08</string> <string>000</string> <string>110</string> <string>118</string> <string>119</string> <string>120</string> <string>122</string> <string>999</string> </array> <key>nais</key> <array> <dict> <key>nai</key> <string>default</string> <key>password</key> <string>vnet.mobi</string> <key>username</key> <string>[email protected]</string> </dict> </array> </dict> </plist>

再打开文件 找到DerPriFileName并按照源文件修改值就是刚刚复制的值

再次打开目录/var/mobile/library/ 找到 carrier bundles 文件夹 修改权限为0555并应用到子项目

重启手机

USCellular运营商是秒出信号 自用的

原文始发于微信公众号(黑客技术家园):ios12卡贴机(有锁)/无锁机 改电信一步到位

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2024年3月2日01:46:53
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   ios12卡贴机(有锁)/无锁机 改电信一步到位https://cn-sec.com/archives/2540429.html

发表评论

匿名网友 填写信息