Apple iPhone v1.1.1 under GNU/Linux

Howto: Skip activation, unlock and upload music to iPhone with Linux over wifi.

Following the Ubuntu developer summit in the US; I returned to Europe with an iPhone (about one week before the European launch). I have not plugged the phone anywhere near an MS Windows machine, Mac, or iTunes of any sort. Current status is that is has a foreign SIM card in, a root shell prompt and YouTube Top Gear clips and MP3 music. Bought for $420.00 in a big shiny shop, there is only one colour.

Lanyard

iPod Mini Lanyard with the extra nipple/notches removed. Fits into the docking port using two tiny 1mm latches and holds the iPhone upside-down, like a nurse's watch. Found for €5.00 in a Helsinki electronics store bargin-box and modified using penknife.

Headphones

I use a stereo pair of open "police style" earphones. These hook over the ear—without the pain of in-ear buds—and allow normal conversation to continue. I had to roll (not cut!) the sleeve of the 3.5mm jack connector back on itself, to fit the tight iPhone clearance. Originally £5.00 from Maplin several years ago.

Special keystrokes

Making useable (avoid activation)

I unlocked whilst still standing inside the Apple Store. Use one of the demostration iPhone in-store to read off the instructions if you didn't memorise them. This iPhone came running 1.1.1 firmware, with the jailbreakme TIFF image file exploit via Safari web-browser. If you have ≥1.1.2 firmware, you'll have to find another way.

Skip activation

• Power, turn on.
• Swipe, allow "Emergency call".
• *#307# Delete Delete Delete Delete Delete Delete, ring back test, then clear number.
• 0 Answer Hold Decline, cause an answer and place "on hold".
• [+], name = asdf. Add a contact, any name.
• URL, url = prefs://1f, Save.
• Click on this URL, the preferences dialogue will come up.
• Configure the wireless. Eg. ESSID = "Apple Store".
• Home
• Swipe, allow "Emergency call".
• *#307# Delete Delete Delete Delete Delete Delete, ring back test, then clear number.
• 0 Answer Hold Decline, cause an answer and place "on hold".
• Click the "asdf" contact.
• URL, url = http://jailbreakme.com, Save.
• Click the "jailbreakme" link, a website will come up.
• Scroll to bottom of page, Install AppInstall. The website sends you a corrupt TIFF image that crashes Safari and roots your phone. Nice.
• Leave alone for a couple of minutes until thoroughly crashed.
• Hold Power for 5 seconds, to power off.
• Click Power for 1 seconds, to power back on.
• You should be able to "do stuff" to the device now. There's a new "Install" icon, you can install loads of junk.

Congratulations, you have avoided the AT&T/O2/T-Mobile contract and avoided iTunes—which is handy if you don't actually live in one of those countries where Apple haven't started flogging it your neighbourhood yet. An Apple employee will probably look over your shoulder at this point. You can explain openly to the Apple employee what you are doing with your new $420 device (don't forget the Tax, Americans add this to screw you afterwards). Probably the faceless employee will try to kick you out of the store.

If an Apple employee fails to approach you, you can try specifically asking for a bent paperclip™. Don't worry, the Apple Store wireless works just as well from 5m (15ft) outside the shop, as it did inside. Remember to charge up the battery from one of the handy iPod connectors before "vacating" the premises.

Carrier unlocking

iPhoneSimFree didn't work for me. AnySIM did. Whip out your Linux box—laptops are good as they tend to have wireless. If you're running Ubuntu, the wireless probably works too.

Use the Installer.App (all Next Step/OS X/iPhone software is installed a directory named Something.App containing the program code and resources).

Portable FreeBSD Unix box

• Insert Bent Paperclip™, remove SIM.
• Install BSD Userspace, for command line tools like 'ifconfig', 'ls', 'df'...
• Install Term-vt100, root on your iPhone. Hold your finger down for a pie-menu with tap completion.
• Install OpenSSH, for shell login via the wireless.
• Install Services, switch on/off, Bluetooth, EDGE (GPRS), Wifi and SSH.
• Install Finder, to browse around the iPhone filesystem, and manually launch ".App" programs.

If you get in a mess, use the reboot magic we learnt at the top. Lets log in. Ensure you have a wireless network that the iPhone likes, it is picky and just doesn't like some wifi networks giving you timeouts and frustation. Try another wireless network!

SSH root@iphone

• Load Term-vt100 to run

  passwd

  and set a new root password.
• Execute

  ifconfig

  to get your IP address on the wireless network.
• From the Linux box, run

  ssh root@192.x.y.z

  remote r00t on iPhone. Rock on.
• unzip and scp -p -r over 'AnySIM.App' to /Applications, download AnySIM by searching from Google.
• Open Finder, locate AnySIM and slide to unlock. Ha ha, they reused the main unlock widget.
• Wait for 10 minutes.
• Device should now be carrier unlocked via some RSA overflow in the firmware.

MS Windows users can use Putty/PSCP. Mac OSX users, hunt down "Terminal" to execute commands.

What works: the review part

All in all the iPhone is a really solid device. Browsing works a treat with the multi-touch; the magnifying glass and pop-ups above the keyboard keys solve the issues of not being able to see what you're clicking on with a visual touchpad. The accelerated "flicking" gesture solves scrolling in a way that is not accurately possible with a mouse.

Despite having gotten a root shell fairly quickly this is a thoroughly proprietary phone; the music only wants to talk the iTunes magical speak and things like bluetooth do not "conveniently" just work. In short, anything that is likely to earn Apple or the carry money (web access/mail access/youtube/iTunes downloads) "just works" but anything likely to circumvent the cellular interface (Bluetooth, file saving/opening) doesn't work. Not too surprising; if people buy an iPhone, Apple make €100. If people subscribe with the suggested AT&T contract —Apple make *another* €350 in revenue share.

Suckage

The camera application sucks. The alarm clock fails to wake up me. The SMS application doesn't give a character count. I'm sure all of these programs are replacable with better non-Apple apps in time. The device doesn't want to charge from a Thinkpad R52, but is okay from a ThinkPad T60 and a System 76 (Asus rebadge).

Bluetooth might technically "work", but you can't do anything (eg. beaming) with the Bluetooth, yet.

Photos

SCP will get your images off. On an Ubuntu box some "gphoto" magic pops up everytime you connect the USB. Lets assume this works for the moment, gets a bit annoying after a while.

File access (sshfs)

As we SSH, we can mount the device:

• On the Linux box:

  sudo apt-get install sshfs
  sudo modprobe fuse
  sudo mkdir -p /media/ipod
  sudo chmod 777 /media/ipod
  sudo adduser $USER fuse

• Drop to the console or re-login to get the new group permissions. Confirm with typing groups
• Still on the Linux box:

  sshfs root@192.x.y.z:/var/root/Media /media/ipod

  and you now have browsage.
• When you've finished,

  fusermount -u /media/ipod

  from the console, or your re-login.

Music

The white-headphones bit. Not so much iPod Touch as iPod Touchy bit. It's a proprietary database. First is to get the iPhone recognised as an iPod.

An iPhone in sheeps clothes

• Get to the iPhone's mounted /var/root/Media from sshfs above.
• Plug the iPhone into the USB (we need to fetch + write a magic number).
• Make some adjustments

  cd /media/ipod
  ln -s iTunes_Control iPod_Control
  cd iPod_Control
  mkdir -p Device
  echo "ModelNumStr: xmobile1" >> Device/SysInfo
  lsusb -d 0x05ac: -v | grep 'iSerial *3' | awk '{print "FirewireGuid: 0x" substr($3,0,16)}' >> Device/SysInfo
  

• Try firing up gtkpod from the Linux box

If you're lucky, you can transfer some files over the wireless, have 'gtkpod' set up the database. When you have finished messy and want the device to rescan the updated database:

• Hold Home for 5 seconds to kill the iPod application.
• Restart the iPhone, hopefully now with new music. Select something relaxing, it's 4am in the morning by now.

The wonderful thing about this is that you have wireless-sync/upload to the iPod. Something that iTunes/Mac users don't have (oh, but they have working album art instead!).

BTW: You may need to use fresh copies of 'gtkpod' and 'libgpod' from SVN. Good luck.

YouTube

There's an SSL/TLS connection setup to YouTube. I did previously copy some replacement keys into /var/root/Library/Lockdown/ without success. The YouTube application started working on its own at some point after that.

Contacts

Haven't got this far. There must be someway of getting a "vCard" into the device. Contact information seems to be in an sqlite database in /private/var/root/Library/AddressBook/AddressBook.sqlitedb so the answer probably lies in writing some code to shove data directly into this.

Please help sent improvements/corrections/comments!