Hacker News Reader

Comment by usui | Hacker News Reader

The video omits crucial details aside from the physical act of removing the original and soldering the new NAND. I know for a fact failing to copy original details results in failure to restore iOS with specific error codes, so I wonder what this video did. I've successfully done this many times back in the iPhone 6S days where the original chip was desoldered, read by a Chinese-made reader, and finally the identifiers cloned to the new chip. I sold phones upgraded from 16GB to 128GB for a meager profit, but it was for fun.

How can the new chip work if the original chip is milled off completely? I would be surprised if you could read all necessary identifiers through iOS/USB software before milling unless the device was jailbroken and read that way. Seems like a big oversight for Apple not to implement simple countermeasures to make it a little bit harder, or that Apple would undo protections they had back in the iPhone 6S days.

View on HN

Just out of curiosity, what was the fail rate for that rework?

I don't repair/upgrade iPhones or anything, and I'm an EE not a trained technician, but I do need to swap BGAs from time to time and my rework rate for 0.4mm pitch BGAs is not the best. It works say, 3 of 4 times. But compared to colleagues I'm pretty good. But that rate is way too low to run any kind of viable business, I would think.

In this situation you're doing literally the same rework over and over, which helps, and probably have equipment and stencils specific to the job, which helps.

So I'm curious what kind of success rate was achieved if you don't mind sharing.

SysCfg with serial number etc has been on a separate NOR chip for quite some time [1]. I wouldn't be surprised if Apple allowed DFU restore to initialize a blank flash as mere optimization in the production process.

[1] https://www.theiphonewiki.com/wiki/NOR

Your link only lists NOR sizes for the original iPhone and the iPhone 3G and then goes on to say "iPod touch (3rd generation) and beyond -- The NOR is replaced with a dedicated partition of NAND"

I suspect they intentionally skipped that part because it contains "proprietary" techniques they don't want to make public.

Security though obscurity is...

A widely misunderstood concept, seldom applied where it is relevant

... commonly referred to as a "trade secret".

https://en.m.wikipedia.org/wiki/Trade_secret

They show it getting restored to factory image.

... As I said... it's not enough to just plop on a new chip from somewhere else and do the standard iOS factory image restore process without extracting info from the original and putting it in the new before soldering. This information prior to the milling is omitted from the video.

I’ve seen several videos by reputable fixers that demonstrate empty NANDs working fine with DFU factory restore. Same situation on Mn MacBooks.

Would be weird in the actual mass production process if the flash would need to be pre-programmed somehow; one DFU process IMO must be able to do everything needed.

After watching a couple of videos, that works with some older versions of DFU software and not new ones. Might be an arbitrary restriction by the DFU update software rather than the hardware. I'm sure they know this and work around it of course when doing these FLASH swaps.

Also if there are two flash chips they need to be installed in a certain order. Not sure of the rationale behind that precisely. I doubt it's a hardware difference.

https://www.aliexpress.us/item/3256804472885970.html

There's a tool for that (many, many of them), both software-based and physical-based tools that can copy out the SysCFG block and write it into a new chunk of flash.

> read by a Chinese-made reader, and finally the identifiers cloned to the new chip

sounds like a national security threat to me

Maybe save worrying about that until Apple phones aren't actually being manufactured in China?

https://www.solveyourtech.com/uncovering-where-iphones-are-m...

Reply on news.ycombinator.com