ICCID Vulnerability Leads to iPhone 4S, iPhone 4 Unlock with SAM – Here’s how To Unlock

On the heels of Michael Capozzi’s unlock method, we posted last year, Loktar_Sun of weiphone has discovered a way to unlock iPhone using SAM (Subscriber Artificial Module) developed by @sbingner. The method can be proved useful for those who failed to get their iPhone IMEI unlocked via AT&T’s official route.

Requirements:

• Jailbroken iPhone 4S, iPhone 4, or iPhone 3GS that can be activated in iTunes (that is, not officially blacklisted),
• The latest iTunes software installed on your computer with internet connected.
• You must know the carrier that your iPhone is locked to.

Step 1. Install Sam Bingner’s SAM (Subscriber Artificial Module) package. I recommend that you get it from repo.bingner.com since older versions have a different interface and may not work for this purpose.

Step 2. Enter SAM by either going through the settings menu or find the SAMPrefs icon on your springboard. You will need to have the SIM card you intend to use in your phone.

Step 3. Go to utilities and select “De-Activate iPhone”, your ActivationState under “More Information” should now be “Unactivated”

Step 4. With SAM enabled, choose “By Country and Carrier” in “Method”; find your carrier, for some carriers operating more than one Carrier ID you may need to select “SIM ID”; if you pick the wrong one this won’t work.

Step 5. Go to More Information”, copy or write down the IMSI in “SAM Details”, then tap “Spoof Real SIM to SAM”.

Step 6. Go back to the main SAM screen and change your “Method” to manual. Paste or enter the IMSI string we saved in Step 5.

Step 7. Connect your iPhone to your computer and allow iTunes to activate it, double click “Phone Number” parameter at the main device screen and make sure that the ICCID matches that of your SIM card. If not you need to start over from Step 1.

Step 8. Unplug your phone, close iTunes.

Step 9. Disable SAM. The source article says to uninstall SAM and delete your lockdownd profiles; it’s unnecessary.

Step 10. Connect your phone to iTunes again, you should get an error saying that your phone cannot be activated. This is normal. Just close iTunes and open it again.

Step 11. You should see signal bars in a short time, congratulations.

Step 12. Push notifications may stop working after this procedure but can be easily restored by “clear push” utility in SAM followed by connecting to iTunes.

Your phone will work normally with your SIM card and that SIM card ONLY since we tricked iTunes to accept that ICCID is one of the intended carrier’s. The phone can be rebooted and connected to iTunes freely without losing the “unlock”, at least for now.

Since it does not involved emergency numbers and test IMSI it will not have any of the issues associated with SIM interposers. Tested working on iOS 5.0.1 but should work with tethered 5.1 too.

Frequent business travelers, who often switch between different countries can go ahead try the method to unlock their iPhone 4S (or iPhone 4/3GS) without using any doohickey or third party adapters. Get it done before Apple find a way to block this method. Let us know if it works for you outside USA or within United States!

The unlocked iPhone includes all the features of iPhone sans 2-year contract obligation and choice of networks galore (in US only T-Mobile’s network supports unlocked iPhone).

[UPDATE 1]: MuscleNerd has confirmed that the method is works. He tested the instructions on his iPhone 4S and was able to unlock it via SAM on his T-Mobile. Be sure to save the unlock activation ticket from this trick..it will likely be useful for a long time! Even if Apple fixes the method.

[UPDATE 2]: We are receiving reports from multiple users who were able to unlock their iPhone running baseband 02.10.04, 04.10.01, 04.12.01, 1.0.13, 1.0.14, and 1.0.11.

[UPDATE 3]: Unlock your iPhone 4 Baseband 04.11.08 using SAM [Video Guide]

Thanks! Singularity