ios12卡贴机(有锁)/无锁机 改电信VOLTE //高通基带//教程
基本要求:
一、ios12.0-12.12(可越狱就行)
二、已开通volte
三、确保已经固定G值和有完整可用的shsh2
四、卡贴机尽量别折腾3G回落 无锁请食用
准备工作:
零、卡贴机必看步骤 无锁忽略
用卡贴iccid解锁 一定要用卡贴黑解!!!
一、运营商文件选择
band1/band3/band5的运营商规则文件:
Docomo_jp.bundle(可能会出现发送短信问题)
KDDI_LTE_only_jp.bundle(部分用户出现无法激活iMessage和FaceTime)
SingTel_sg.bundle(部分用户出现安卓VoLTE用户无法呼入)
锁定band5的运营商
USCellular_LTE_US.bundle[完美支持3G(3G不可上网)]
3G可上网4G完美VoLTE
Verizon_LTE_US.bundle(会出现iPhone需要激活,可能会在通话时出现,挂断电话,风险较高)
二、越狱准备
app.ignition.fun 下载 uncover rootlessJB
查看并固定G值+越狱获取权限
打开爱思助手》刷机越狱》高级功能》下载shsh文件
保存后打开shsh文件 找到generator 复制值:0x5958c0c45b4d87e4
打开uncover》settings 找到 Boot Nonce 输入刚刚复制的值
然后 选中 load Daemons 、Disable Auto Updates、Disable App Revokes、Overwrite Boot Nonce、
Restore RootFS(recover)、Reload System Daemons 再去点击Jailbreak
等待弹窗
点击OK 自动退出应用
接着打开rootlessJB 点击Jailbreak 会自动注销 然后解锁就有权限修改文件了
打开Filza
打开目录:/system/library/carrier bundles/iPhone/ChinaTelecom_USIM_cn.bundle/ 备份ChinaTelecom_USIM_cn.bundle文件夹 并删除去夹内内容
打开目录:/system/library/carrier bundles/iPhone/
并寻找上文提到的运营商文件夹
一、运营商文件选择
band1/band3/band5的运营商规则文件:
Docomo_jp.bundle(可能会出现发送短信问题)
KDDI_LTE_only_jp.bundle(部分用户出现无法激活iMessage和FaceTime)
SingTel_sg.bundle(部分用户出现安卓VoLTE用户无法呼入)
锁定band5的运营商
USCellular_LTE_US.bundle[完美支持3G(3G不可上网)]
3G可上网4G完美VoLTE
Verizon_LTE_US.bundle(会出现iPhone需要激活,可能会在通话时出现,挂断电话,风险较高)
复制其中的文件 到ChinaTelecom_USIM_cn.bundle中粘贴
打开目录:/system/library 找到carrier bundles文件夹 加权限0555应用到子项目
、
再点击右上角的存储
打开目录:/var/mobile/library/ 删除 carrier bundles 然后重启手机
打开目录:etc 找到hosts文件用文本编辑器打开 添加127.0.0.1 appldnld.apple.com 和 127.0.0.1 mesu.apple.com 保存文件并重启手机
重启后可能会出现LTE或空心信号或出现信号一会消失
等10秒左右
飞行一次重新出信号
然后执行下步操作 没信号也直接跳过
再次半越狱(uncover、rootlessJb)进入/var/mobile/library/carrier bundles/overlay/,打开device+carrier+46011+Dxx+3x.x.x.plist找到DerPriFileName,复制其值,一般都是 overrides_D20_D21_D22.der.pri
以文本编辑器打开文件
全选删除内容
复制下方代码 粘贴进去 保存文件
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>APNEditabilityTypemask</key>
<integer>5</integer>
<key>AllowedServicesTypeMaskOnInternet</key>
<integer>32769</integer>
<key>AttachAPN</key>
<dict>
<key>3GPP</key>
<dict>
<key>AllowedProtocolMask</key>
<integer>3</integer>
<key>AllowedProtocolMaskInRoamingLTE</key>
<integer>3</integer>
<key>DefaultProtocolMask</key>
<integer>3</integer>
<key>PcscfAddressRequired</key>
<false/>
</dict>
</dict>
<key>CarrierEntitlements</key>
<dict>
<key>Authentication</key>
<dict>
<key>BsfPort</key>
<integer>8080</integer>
<key>Type</key>
<integer>2</integer>
<key>Username</key>
<string>0$IMSI@nai.epc.mnc$MNC.mcc$MCC.3gppnetwork.org</string>
</dict>
<key>ProtocolVersion</key>
<string>2</string>
<key>ProvisioningRecheckPeriod</key>
<integer>5</integer>
<key>ServerAddress</key>
<string>https://applecsb.crm.189.cn:8101/CRM-CSB/HttpAppleService</string>
<key>SupportedEntitlements</key>
<integer>1024</integer>
<key>UpdatePeriod</key>
<integer>24</integer>
<key>UserAgent</key>
<string>3gpp-gba</string>
</dict>
<key>CarrierName</key>
<string>中国电信</string>
<key>CarrierSpace</key>
<dict>
<key>AuthClientID</key>
<string>sg_client</string>
<key>AuthorizationURL</key>
<string>https://ct.crm.189.cn:86/pubPortal/appleAuth/init</string>
<key>AutoRefreshMinimumIntervalMins</key>
<integer>1440</integer>
<key>DataOptimizationAllowed</key>
<true/>
<key>ManualRefreshMinimumIntervalMins</key>
<integer>30</integer>
<key>PlanProvisioningPollInterval</key>
<integer>360</integer>
<key>SupportsApps</key>
<true/>
<key>SupportsPlans</key>
<true/>
<key>SupportsUsage</key>
<true/>
<key>TeamIDList</key>
<array>
<string>7338DEUF7S</string>
</array>
<key>TokenURL</key>
<string>https://ct.crm.189.cn:86/pubPortal/appleAuth/initback</string>
</dict>
<key>CellularDataUsage</key>
<dict>
<key>ShowMonthlyDataUsage</key>
<true/>
</dict>
<key>CheckSMSonSIM</key>
<true/>
<key>CustomerServicePhoneNumber</key>
<string>10000</string>
<key>DataIndicatorOverrideForLTE</key>
<string>4G</string>
<key>DerPriFileName</key>
<string>overrides_D20_D21_D22.der.pri</string>
<key>DerPriFileVersion</key>
<string>0.0.19</string>
<key>EnableLTEAfterUpgrade</key>
<true/>
<key>IMSConfig</key>
<dict>
<key>AllowHandoverWithoutIMSVoiceService</key>
<true/>
<key>ConferenceCalling</key>
<dict>
<key>SendConferenceSubscribeInNewDialog</key>
<true/>
<key>conferenceServer</key>
<string>sip:mmtel@conf-factory.ims.mnc${MNC}.mcc${MCC}.3gppnetwork.org</string>
</dict>
<key>Media</key>
<dict>
<key>EnableBandwidthSpecifiers</key>
<true/>
<key>HideSessionLevelDirection</key>
<true/>
<key>InactivityTimerRTCPSeconds</key>
<integer>20</integer>
<key>IncludeSDPMaxRed</key>
<true/>
<key>IncludeSDPModeChangeCapability</key>
<true/>
<key>MaxRedundancy</key>
<integer>220</integer>
<key>PreferredAMRWBMode</key>
<string>8</string>
<key>RTCPIntervalSeconds</key>
<integer>5</integer>
<key>UseRestrictiveDirectionWhenCreatingAnswer</key>
<false/>
</dict>
<key>SMS</key>
<dict>
<key>SMSBundleToVoice</key>
<true/>
<key>SupportedDomains</key>
<dict>
<key>CDMA</key>
<false/>
<key>CDMA2000</key>
<false/>
<key>LTE</key>
<true/>
</dict>
<key>TR1MTimer</key>
<dict>
<key>IsFatalOnIMSSendFailure</key>
<true/>
<key>IsFatalOnIMSSendSuccess</key>
<false/>
<key>TimerValue</key>
<integer>133</integer>
</dict>
<key>allowCSFBInVolteMode</key>
<true/>
</dict>
<key>Signaling</key>
<dict>
<key>AdditionalContactParams</key>
<dict>
<key>INVITE:200,PRACK:200,UPDATE:200</key>
<string>audio</string>
<key>REGISTER</key>
<string>+g.3gpp.accesstype="cellular2"</string>
<key>REGISTER,INVITE,INVITE:*</key>
<string>+g.3gpp.mid-call;+g.3gpp.srvcc-alerting;+g.3gpp.ps2cs-srvcc-orig-pre-alerting</string>
</dict>
<key>AdditionalFeatureTags</key>
<dict>
<key>voice</key>
<dict>
<key>audio</key>
<string></string>
</dict>
</dict>
<key>AllowAnonymousEmergencyCalls</key>
<false/>
<key>AllowRegistrationCanceledState</key>
<true/>
<key>AllowResponsesOverDifferentTransport</key>
<false/>
<key>AlwaysUnsubscribeFromRegEvents</key>
<false/>
<key>CallEndReasons</key>
<dict>
<key>Blocked</key>
<dict>
<key>StatusCode</key>
<integer>486</integer>
</dict>
<key>RejectedByUser</key>
<dict>
<key>ReasonHeaderText</key>
<string>Decline</string>
<key>StatusCode</key>
<integer>603</integer>
</dict>
</dict>
<key>ConvertSessionProgressToRinging</key>
<false/>
<key>DefaultAuthAlgorithm</key>
<string>AKAv1-MD5</string>
<key>DontSendPreconditionsIfCallWaitingDisabled</key>
<true/>
<key>DropRegistrationOnSRVCC</key>
<true/>
<key>EarlyMediaNeedsHeader</key>
<true/>
<key>EmergencyURNs</key>
<dict>
<key>110</key>
<string>urn:service:sos.police</string>
<key>119</key>
<string>urn:service:sos.fire</string>
<key>120</key>
<string>urn:service:sos.ambulance</string>
<key>122</key>
<string>urn:service:sos.traffic</string>
</dict>
<key>EnableEmergencyRegistration</key>
<true/>
<key>EnableSenderName</key>
<false/>
<key>ForbiddenRegistrationErrorCodes</key>
<string>4xx,-404,5xx,6xx</string>
<key>IncomingCallEndReasons</key>
<dict>
<key>RequestTimeout</key>
<dict>
<key>Protocol</key>
<string>Q.850</string>
<key>ReasonHeaderCause</key>
<integer>19</integer>
<key>StatusCode</key>
<integer>408</integer>
<key>TerminationEvent</key>
<string>RemoteHangup</string>
</dict>
<key>TemporarilyUnavailable</key>
<dict>
<key>StatusCode</key>
<integer>480</integer>
<key>TerminationEvent</key>
<string>RemoteCallRejected</string>
</dict>
</dict>
<key>IncompleteRegistrationThrottlingIntervalSeconds</key>
<integer>0</integer>
<key>InviteErrorResponsesToTriggerCSFB</key>
<string>500,503</string>
<key>LocalQoSTimeoutMOSeconds</key>
<integer>6</integer>
<key>LocalQoSTimeoutMTSeconds</key>
<integer>6</integer>
<key>MaxReRegistrationAttempts</key>
<integer>0</integer>
<key>MinSessionExpiresSeconds</key>
<integer>600</integer>
<key>NetworkTerminationRetryIntervalSeconds</key>
<integer>1</integer>
<key>Preconditions</key>
<string>Supported</string>
<key>ResetDisabledModeOnEvents</key>
<string>SimInserted,AirplaneModeToggled,AccessNetworkChanged</string>
<key>RingbackTimerSeconds</key>
<integer>95</integer>
<key>RingingTimerSeconds</key>
<integer>90</integer>
<key>SRVCCCleanupTimeoutSeconds</key>
<integer>0</integer>
<key>SendResumeInviteAsSendRecv</key>
<false/>
<key>SipTimers</key>
<dict>
<key>InviteResponseTimeout</key>
<integer>6000</integer>
</dict>
<key>StartLocalQosTimerOnSessionProgress</key>
<true/>
<key>SupportPEarlyMediaHeader</key>
<true/>
<key>UseFakeSAsForDeregistration</key>
<true/>
<key>UseIPSec</key>
<true/>
<key>UseNormalIdentityForEmergencyUSIM</key>
<true/>
<key>VirtualInterfaceMtu</key>
<integer>4096</integer>
</dict>
<key>Voice</key>
<dict>
<key>DialAsEmergencyOverIMSForUndetectedEmergency</key>
<true/>
<key>E911OverIMSSupported</key>
<true/>
<key>EnableVolteByDefault</key>
<true/>
<key>PreAlertingDTMFSupported</key>
<true/>
</dict>
<key>XCAP</key>
<dict>
<key>BsfHost</key>
<string>bsf.mnc011.mcc460.pub.3gppnetwork.org</string>
<key>BsfPort</key>
<integer>8080</integer>
<key>ContentType</key>
<string>application/xcap-el+xml</string>
<key>DisableCLIRModification</key>
<true/>
<key>DisableOnNetworkError</key>
<true/>
<key>NafHost</key>
<string>xcap.ims.mnc011.mcc460.pub.3gppnetwork.org</string>
<key>NafPort</key>
<integer>80</integer>
<key>SupportsCLIR</key>
<false/>
<key>SupportsCW</key>
<false/>
<key>imsFeatureDependency</key>
<false/>
<key>supported</key>
<true/>
</dict>
</dict>
<key>IgnoresDeactivateOnNetworkScanServiceMask</key>
<integer>131072</integer>
<key>MMS</key>
<dict>
<key>GroupModeAllowUserOverride</key>
<true/>
<key>GroupModeEnabled</key>
<false/>
<key>MMSC</key>
<string>http://mmsc.vnet.mobi</string>
<key>MaxMessageSize</key>
<integer>307200</integer>
<key>MaxRecipients</key>
<integer>10</integer>
<key>MaxSubjectLenBytes</key>
<integer>80</integer>
<key>MaxVoiceCallWaitPeriod</key>
<integer>0</integer>
<key>Proxy</key>
<string>10.0.0.200:80</string>
<key>vCard21ExportModeEnabled</key>
<true/>
</dict>
<key>MaxBluetoothModemConnections</key>
<integer>5</integer>
<key>PhoneNumberRegistrationGatewayAddress</key>
<string>00447786205094</string>
<key>RemoteCardProvisioningSettings</key>
<dict>
<key>ActivatingStateSubscriptionCheckTimerIntervals</key>
<array>
<integer>300</integer>
<integer>480</integer>
<integer>600</integer>
</array>
<key>InconsistentICCIDLength</key>
<true/>
<key>MatchingICCIDPrefixes</key>
<array>
<string>898603</string>
<string>898611</string>
</array>
<key>MinCompatibleWatchOS</key>
<string>5.1</string>
<key>ProvisioningMethod</key>
<string>CarrierFlow</string>
<key>ServerURL</key>
<string>https://esimapple.crm.189.cn</string>
<key>SupportedSKUs</key>
<array>
<string>SKU_CU</string>
</array>
<key>SupportsFauxCard</key>
<true/>
<key>UsesAutoAssignment</key>
<false/>
</dict>
<key>RemoteDiagnosticsWWANAllowed</key>
<true/>
<key>SMSSettings</key>
<dict>
<key>CustomTeleserviceIDs</key>
<dict>
<key>FDEA</key>
<string>1004</string>
<key>FDED</key>
<string>1002</string>
</dict>
<key>IgnoreWAPPushBits</key>
<integer>69</integer>
<key>TerminalRegistration</key>
<dict>
<key>DestinationAddress</key>
<string>10659401</string>
<key>Registration</key>
<string><a1><b1>ACM-$MODEL</b1><b2>$MEID</b2><b3>$IMSI</b3><b4>$VERSION</b4></a1></string>
<key>TeleserviceID</key>
<integer>65005</integer>
</dict>
</dict>
<key>SaveICCIDToCache</key>
<true/>
<key>Services</key>
<array>
<dict>
<key>ServiceCode</key>
<string>10000</string>
<key>ServiceName</key>
<string>客户服务热线</string>
</dict>
<dict>
<key>ServiceCode</key>
<string>10001</string>
<key>ServiceName</key>
<string>自助服务热线</string>
</dict>
<dict>
<key>ServiceCode</key>
<string>+8618918910000</string>
<key>ServiceName</key>
<string>国际漫游客服</string>
</dict>
</array>
<key>ShouldHideAllVoicemailUI</key>
<true/>
<key>Show3GSwitch</key>
<false/>
<key>Show4GSwitch</key>
<true/>
<key>ShowDialAssist</key>
<true/>
<key>ShowMessagesConversationListFilteringPrompt</key>
<false/>
<key>ShowTTY</key>
<false/>
<key>ShowVolteSwitch</key>
<true/>
<key>StatusBarImages</key>
<array>
<dict>
<key>AllowPrefixMatching</key>
<true/>
<key>CarrierName</key>
<string>CHN-CT</string>
<key>StatusBarCarrierName</key>
<string>中国电信</string>
</dict>
<dict>
<key>AllowPrefixMatching</key>
<false/>
<key>CarrierName</key>
<string>U.S. Cellular</string>
<key>StatusBarCarrierName</key>
<string>中国电信</string>
</dict>
<dict>
<key>AllowPrefixMatching</key>
<true/>
<key>StatusBarCarrierName</key>
<string>中国电信</string>
</dict>
</array>
<key>StockSymboli</key>
<array>
<dict>
<key>name</key>
<string>中国电信</string>
<key>symbol</key>
<string>0728.HK</string>
</dict>
</array>
<key>SupportedSIMs</key>
<array>
<string>46011</string>
<string>20404_ID-898611</string>
</array>
<key>SupportsFlashInfoCallTimer</key>
<true/>
<key>SupportsImsCapability</key>
<true/>
<key>SupportsNITZ</key>
<false/>
<key>SupportsUserBusyCauseCode</key>
<true/>
<key>URLifyUnquotedShorts</key>
<true/>
<key>VVMIgnoresIntlDataRoaming</key>
<true/>
<key>apns</key>
<array>
<dict>
<key>configuration</key>
<array>
<dict>
<key>AllowedProtocolMask</key>
<integer>3</integer>
<key>AllowedProtocolMaskInRoaming</key>
<integer>3</integer>
<key>DefaultProtocolMask</key>
<integer>3</integer>
<key>apn</key>
<string>ctnet</string>
<key>password</key>
<string></string>
<key>type-mask</key>
<integer>1081395</integer>
<key>username</key>
<string></string>
</dict>
<dict>
<key>AllowedProtocolMask</key>
<integer>3</integer>
<key>AllowedProtocolMaskInRoaming</key>
<integer>3</integer>
<key>DefaultProtocolMask</key>
<integer>3</integer>
<key>apn</key>
<string>ctwap</string>
<key>password</key>
<string></string>
<key>type-mask</key>
<integer>4</integer>
<key>username</key>
<string></string>
</dict>
<dict>
<key>AllowedProtocolMask</key>
<integer>3</integer>
<key>AllowedProtocolMaskInRoaming</key>
<integer>3</integer>
<key>DefaultProtocolMask</key>
<integer>3</integer>
<key>WaitForBringUpComplete</key>
<true/>
<key>apn</key>
<string>IMS</string>
<key>password</key>
<string></string>
<key>type-mask</key>
<integer>131072</integer>
<key>username</key>
<string></string>
</dict>
<dict>
<key>AllowedProtocolMask</key>
<integer>3</integer>
<key>AllowedProtocolMaskInRoaming</key>
<integer>3</integer>
<key>DefaultProtocolMask</key>
<integer>3</integer>
<key>apn</key>
<string>ctnet</string>
<key>password</key>
<string></string>
<key>type-mask</key>
<integer>1081394</integer>
<key>username</key>
<string></string>
</dict>
<dict>
<key>AllowedProtocolMask</key>
<integer>3</integer>
<key>DefaultProtocolMask</key>
<integer>3</integer>
<key>apn</key>
<string>SOS</string>
<key>password</key>
<string></string>
<key>type-mask</key>
<integer>262144</integer>
<key>username</key>
<string></string>
</dict>
</array>
<key>technology-mask</key>
<integer>9</integer>
</dict>
</array>
<key>e_only_whitelist</key>
<array>
<string>08</string>
<string>000</string>
<string>110</string>
<string>118</string>
<string>119</string>
<string>120</string>
<string>122</string>
<string>999</string>
</array>
<key>nais</key>
<array>
<dict>
<key>nai</key>
<string>default</string>
<key>password</key>
<string>vnet.mobi</string>
<key>username</key>
<string>ctwap@mycdma.cn</string>
</dict>
</array>
</dict>
</plist>
再打开文件 找到DerPriFileName并按照源文件修改值(就是刚刚复制的值)
再次打开目录/var/mobile/library/ 找到 carrier bundles 文件夹 修改权限为0555并应用到子项目
重启手机
如果有无服务情况就飞一下
USCellular运营商是秒出信号 自用的
请忽略我的联通
by:木头(一斤苹果梨)