Skip to main content

Repair information and guides for the iPhone 6 that was released on September 19, 2014. Model Numbers: A1549, A1586, and A1589

4994 Questions View all

How is the IMEI and s/n stored?

Okay, so I have a baseband eeprom and NAND from a unlocked, iCloud free board. The baseband and cpu were destroyed. I also have a iCloud locked, not stolen or anything, board that works fine. So, if I transfer the eepromm and NAND to the iCloud locked board, will it get the IMEI from the iCloud free one? Here's what I think happens but I could be totally wrong.

The eeprom programs the bb and CPU from its memory.

The NAND verify a everything is matching.

It restores.

Then you check if it shows in settings and in *#06#

Could be totally wrong, but would it work?

Answered! View the answer I have this problem too

Is this a good question?

Score 4
2 Comments

You should ask @tomchai ...he's probably the best person to answer this properly.

by

I would just figure it out myself, but I don't want to waste a good donor board or break the NAND or eeprom.

by

Add a comment

7 Answers

Chosen Solution

From what I know the S/N is in the main NAND and there are tools to modify that. However it must match the IMEI on Apple activation server records in order for the phone to be activated.

The baseband is another story. The IMEI is either burned into the BB or encrypted and stored in the BB EEPROM. All content or at least sensitive information in the EEPROM is encrypted with a unique key in the BB. There is no way to alter or even readout the information as plaintext. The BB and BB EEPROM has to be present as a matching set, with BB destroyed there is no way to make it work.

Was this answer helpful?

Score 9

32 Comments:

But, with the BB eeprom, being readable/write able. Can't you use an eeprom reader to change what's on the chip, and make it useable?

by

The baseband wasn't destroyed, it was lost -_- I lost it on my desk and I couldn't find it but I wil clean my desk and try to find it. What about the CPU?

by

Update: I found the baseband. I reballed it and it looks good. So what about the CPU? If I use the one that is one there will it work or will I have to solder a brand new one?

by

CPU from what I know has to be matched with a small chip in the back or you may end up with red screen. It is called "anti-rollback EEPROM" "U0301" in the schematics. Also obviously you need the matching HB to have Touch ID and matching NFC chip to have Apple Pay.

Not sure these device core chips has to be matched with BB subsystem, NAND S/N or not.

by

@theimedic You actually can read/write to the EEPROM, but what to do with the data? You can't edit or even make sense of the encrypted sections.

Limited recovery on non-critical sections are actually possible. If your device has -1 error and it happens to be baseband EEPROM data error that are not in the critical section, someone in China is able to fix that for you. But if the critical section is damaged or not matching, nobody can help.

by

Show 27 more comments

Add a comment

Well.. You wouldn't be "wasting" a board. Because the donor board is Apple ID locked. I've been going through this path myself, and looking for chips that I can transfer to boards that are Apple ID locked. I also think the better method, would be to buy an eeprom reader, remove the nand, reprogram the nand, and get the board out as a new phone, with no data on it at all

[invalid guide link]

@tomchai

I always appreciate and value your insight. When you say the BB can't be interfaces. Is this guy just selling me something?

Block Image

Was this answer helpful?

Score 6

4 Comments:

He is probably just trying to sell you something.

by

That's what I gotta find out

by

how has the transferring of chips been going? I bought a iphone 6 and its blacklisted and I was thinking of going a similar route but wanted to talk to somebody whos done it before

by

@theimedic

You didn’t understand this guy as baseband eeprom adapter and nand adapters are 2 separate things.

If you meant that you get the band adapter and reprogram the band with what?

you have to read out the same information and if you change the band you have the add write the same info back in or the phone will stuck on activation screen. (Info like serial number Mac addresses etc)

by

Add a comment

This is the machine used by Foxconn which is who repairs apples iPhones and iPads. This is used in a situation when the SN and IMEI needs to be recirculated due to a total loss board or warranty claim where the activation chain has to be the exact one as before. (Edit: they no longer recirculate IMEI numbers due to federal laws prohibiting IMEI number changing, as well as they mark them inactive in their internal program and yes they can see that if you ever call in for support) You need both the SN and IMEI in order to make sure apple servers don’t brick the phone, which yes, is built into the phones software.

https://rover.ebay.com/rover/0/0/0?mpre=...

these machines can also remove iCloud locks as the iCloud is SN based by apple. Simply changing an 0 to an O or 1 to l works and removes iCloud locks, however find my iPhone will never work again.

in theory, this can be used for cell phone ghosting and has been used by intelligence agencies for some time. Do with the info what you will I am merely posting for educational purposes and to advise that changing any IMEI number is a crime, a very serious one at that.

Was this answer helpful?

Score 2

1 Comment:

This machine does nothing of the kind. It is for reading and writing the metadata of the NAND or EEPROM, among other things. This is useful for clearing corrupted NAND chips from certain iTunes error but the actual user data is lost forever.

In order to "remove" iCloud lock, all paired IC's must have matching metadata and as of today, there is no way to read or write to the BB CPU nor the Ax CPU/SoC.

by

Add a comment

yes is true. you can read and write eeprom even if you know what to do you can change the imei on eeprom

Was this answer helpful?

Score 1
Add a comment

@gigabit87898 I found this old thread, did you try to mix the components? Is it working?

Was this answer helpful?

Score 1
Add a comment

unless you can reprogram and flash to bootloader system. such as for the arm architecture

Was this answer helpful?

Score 0
Add a comment

i wonder is there arm architecture universal bootloader for android linux and s/n changeable?

Was this answer helpful?

Score 0
Add a comment

Add your answer

Gigabit87898 will be eternally grateful.
View Statistics:

Past 24 Hours: 8

Past 7 Days: 15

Past 30 Days: 40

All Time: 15,655