4 ms·

The video omits crucial details aside from the physical act of removing the original and soldering the new NAND. I know for a fact failing to copy original deta

by usui 2y ago

The video omits crucial details aside from the physical act of removing the original and soldering the new NAND. I know for a fact failing to copy original details results in failure to restore iOS with specific error codes, so I wonder what this video did. I've successfully done this many times back in the iPhone 6S days where the original chip was desoldered, read by a Chinese-made reader, and finally the identifiers cloned to the new chip. I sold phones upgraded from 16GB to 128GB for a meager profit, but it was for fun. How can the new chip work if the original chip is milled off completely? I would be surprised if you could read all necessary identifiers through iOS/USB software before milling unless the device was jailbroken and read that way. Seems like a big oversight for Apple not to implement simple countermeasures to make it a little bit harder, or that Apple would undo protections they had back in the iPhone 6S days.

necovek 2y ago
They show it getting restored to factory image.
- usui 2y ago
  ... As I said... it's not enough to just plop on a new chip from somewhere else and do the standard iOS factory image restore process without extracting info from the original and putting it in the new before soldering. This information prior to the milling is omitted from the video.
  - 0xPIT 2y ago
    I’ve seen several videos by reputable fixers that demonstrate empty NANDs working fine with DFU factory restore. Same situation on Mn MacBooks. Would be weird in the actual mass production process if the flash would need to be pre-programmed somehow; one DFU process IMO must be able to do everything needed.
    - cjk2 2y ago
      After watching a couple of videos, that works with some older versions of DFU software and not new ones. Might be an arbitrary restriction by the DFU update software rather than the hardware. I'm sure they know this and work around it of course when doing these FLASH swaps. Also if there are two flash chips they need to be installed in a certain order. Not sure of the rationale behind that precisely. I doubt it's a hardware difference.
  - kotaKat 2y ago
    https://www.aliexpress.us/item/3256804472885970.html https://www.aliexpress.us/item/3256804472885970.html There's a tool for that (many, many of them), both software-based and physical-based tools that can copy out the SysCFG block and write it into a new chunk of flash.
tw1984 2y ago
> read by a Chinese-made reader, and finally the identifiers cloned to the new chip sounds like a national security threat to me
- swores 2y ago
  Maybe save worrying about that until Apple phones aren't actually being manufactured in China? https://www.solveyourtech.com/uncovering-where-iphones-are-manufactured-a-global-journey/ https://www.solveyourtech.com/uncovering-where-iphones-are-m...
  - deleted 2y ago
    [deleted]
HHad3 2y ago
SysCfg with serial number etc has been on a separate NOR chip for quite some time [1]. I wouldn't be surprised if Apple allowed DFU restore to initialize a blank flash as mere optimization in the production process. [1] https://www.theiphonewiki.com/wiki/NOR https://www.theiphonewiki.com/wiki/NOR
- kalleboo 2y ago
  Your link only lists NOR sizes for the original iPhone and the iPhone 3G and then goes on to say "iPod touch (3rd generation) and beyond -- The NOR is replaced with a dedicated partition of NAND"
pquki4 2y ago
I suspect they intentionally skipped that part because it contains "proprietary" techniques they don't want to make public.
- HeatrayEnjoyer 2y ago
  Security though obscurity is...
  - droopyEyelids 2y ago
    A widely misunderstood concept, seldom applied where it is relevant
  - mitthrowaway2 2y ago
    ... commonly referred to as a "trade secret". https://en.m.wikipedia.org/wiki/Trade_secret https://en.m.wikipedia.org/wiki/Trade_secret
xw38011 2y ago
Just out of curiosity, what was the fail rate for that rework? I don't repair/upgrade iPhones or anything, and I'm an EE not a trained technician, but I do need to swap BGAs from time to time and my rework rate for 0.4mm pitch BGAs is not the best. It works say, 3 of 4 times. But compared to colleagues I'm pretty good. But that rate is way too low to run any kind of viable business, I would think. In this situation you're doing literally the same rework over and over, which helps, and probably have equipment and stencils specific to the job, which helps. So I'm curious what kind of success rate was achieved if you don't mind sharing.

by usui 2y ago

necovek 2y ago

They show it getting restored to factory image.

usui 2y ago
... As I said... it's not enough to just plop on a new chip from somewhere else and do the standard iOS factory image restore process without extracting info from the original and putting it in the new before soldering. This information prior to the milling is omitted from the video.
- 0xPIT 2y ago
  I’ve seen several videos by reputable fixers that demonstrate empty NANDs working fine with DFU factory restore. Same situation on Mn MacBooks. Would be weird in the actual mass production process if the flash would need to be pre-programmed somehow; one DFU process IMO must be able to do everything needed.
  - cjk2 2y ago
    After watching a couple of videos, that works with some older versions of DFU software and not new ones. Might be an arbitrary restriction by the DFU update software rather than the hardware. I'm sure they know this and work around it of course when doing these FLASH swaps. Also if there are two flash chips they need to be installed in a certain order. Not sure of the rationale behind that precisely. I doubt it's a hardware difference.
- kotaKat 2y ago
  https://www.aliexpress.us/item/3256804472885970.html https://www.aliexpress.us/item/3256804472885970.html There's a tool for that (many, many of them), both software-based and physical-based tools that can copy out the SysCFG block and write it into a new chunk of flash.

tw1984 2y ago

> read by a Chinese-made reader, and finally the identifiers cloned to the new chip sounds like a national security threat to me

swores 2y ago
Maybe save worrying about that until Apple phones aren't actually being manufactured in China? https://www.solveyourtech.com/uncovering-where-iphones-are-manufactured-a-global-journey/ https://www.solveyourtech.com/uncovering-where-iphones-are-m...
- deleted 2y ago
  [deleted]

HHad3 2y ago

SysCfg with serial number etc has been on a separate NOR chip for quite some time [1]. I wouldn't be surprised if Apple allowed DFU restore to initialize a blank flash as mere optimization in the production process. [1] https://www.theiphonewiki.com/wiki/NOR https://www.theiphonewiki.com/wiki/NOR

kalleboo 2y ago
Your link only lists NOR sizes for the original iPhone and the iPhone 3G and then goes on to say "iPod touch (3rd generation) and beyond -- The NOR is replaced with a dedicated partition of NAND"

pquki4 2y ago

I suspect they intentionally skipped that part because it contains "proprietary" techniques they don't want to make public.

HeatrayEnjoyer 2y ago
Security though obscurity is...
- droopyEyelids 2y ago
  A widely misunderstood concept, seldom applied where it is relevant
- mitthrowaway2 2y ago
  ... commonly referred to as a "trade secret". https://en.m.wikipedia.org/wiki/Trade_secret https://en.m.wikipedia.org/wiki/Trade_secret

xw38011 2y ago

Just out of curiosity, what was the fail rate for that rework? I don't repair/upgrade iPhones or anything, and I'm an EE not a trained technician, but I do need to swap BGAs from time to time and my rework rate for 0.4mm pitch BGAs is not the best. It works say, 3 of 4 times. But compared to colleagues I'm pretty good. But that rate is way too low to run any kind of viable business, I would think. In this situation you're doing literally the same rework over and over, which helps, and probably have equipment and stencils specific to the job, which helps. So I'm curious what kind of success rate was achieved if you don't mind sharing.