这个方法不适于一般用户，一般用户应继续等待更加稳妥的方法，教程因此刻意没有细化。步骤/方法11、下载工具　　解压到一个目录中22、还原Modem　　用重刷Modem的方法清除之前的解锁，参见【教程】应对软件解锁失败。33、准备软件　　将解压得到的SimFree（IPSF）安装到iPhone上（需要手工上传），添加运行属性，同时安装BSDSubsystem和OpenSSH，参见【教程】用iBrickr安装软件。44、准备网络　　确保iPhone的WiFi可以访问Internet，并将WiFi的DNS设成129.21.116.152（geohot的服务器），参见【教程】WiFi的设置方法。55、提取被破坏的seczone　　将移动卡放入iPhone，运行SimFree，结束时会出现下面这个错误：　　Unlockfailed.Unabletoupdatetoken.这是正常的，如果出现其他错误就是不对的，请返回重新来过。66、下载修复后的seczone　　到下面网址下载修复好的seczone文件：　　http://129.21.116.152:49973/seczones/真实IMEI.bin文件长度目前是4096字节，要用你的iPhone的真实IMEI（机器背面右下角，是个15位数字），而不是那个0049的，文件下载后存放进前面解压的目录中。77、生成secloader　　打开一个命令行窗口，进入前面解压的目录里面，输入命令：C:\\revirgin\\>geomaker真实IMEI.bin将生成一个新文件：真实IMEI.bin_loader，下面要用到这个生成的文件。Mac用户需要手工将seczone嵌入到secloader里面，这里就不介绍了。　　88、准备修复文件　　将解压得到的以下文件传到iPhone上，放到/revirgin目录里：　　314fls_correct　　314secpack　　eeprom.eep,　　bbupdater　　iUnlock　　真实IMEI.bin_loader99、修复seczone　　用SSH登录到iPhone上（参见【教程】关于SSH、SCP及SFTP），输入命令：　　cd/revirgin　　chmod755bbupdateriUnlock　　launchctlunload/System/Library/LaunchDaemons/com.apple.CommCenter.plist（关闭通讯中心）　　./iUnlock314secpack真实IMEI.bin_loader（写入修复专用的secloader）　　./bbupdater-v（这一步会报错，没关系，属于正常的，主要是要secloader运行并修复好seczone）　　./iUnlock314secpack314fls_correct（重新写入正确的secloader）　　./bbupdater-v（这一步应该显示正常的版本03.14.08_G）　　./bbupdater-eeeprom.eep（恢复EEPROM，只是为了保险起见）　　launchctlload/System/Library/LaunchDaemons/com.apple.CommCenter.plist（打开通讯中心）以上命令也可以在MobileTerminal下完成。1010、重新启动　　启动后机器已经修复，并且已经解锁，采用的是与anySIM1.1类似的方法，由gray实现。END实际操作记录完整的实际操作及输出（格式略微修改了一下以便看得清楚各个步骤）：-sh-3.2#launchctlload/System/Library/LaunchDaemons/com.apple.CommCenter.plist（关闭通讯中心）-sh-3.2#cd/reflash-sh-3.2#./bbupdater-f*fls-e*eep（重刷Modem）Preparingtoflashusing/dev/tty.basebandat750000baudPleaseresettargetResettingtarget...ProcessDetailUpdated:Boot-loaderisactiveProcessDetailUpdated:EBLversion:3.9_M3S23..9ProcessDetailUpdated:Bootmodeis:CCProcessDetailUpdated:Baudratesetto750000ProcessDetailUpdated:Getflashid.ProcessDetailUpdated:CFIstage1ProcessDetailUpdated:FlashIDis:88620089ProcessDetailUpdated:CFIstage2ProcessDetailUpdated:BootprocessfinishedProcessOutlineUpdated:ReadingSWversiondataProcessDetailUpdated:Receivingdata.ProgressUpdated:100ProcessDetailUpdated:UploadOKProcessOutlineUpdated:Processtimewas132msec.UpgradefromtoDownloadingEEPProcessOutlineUpdated:StartdownloadingfromfileICE03.14.08_G.eep.ProcessDetailUpdated:Sendingsec-pack.ProcessDetailUpdated:Loadregion0ProcessDetailUpdated:Sendingend-pack.ProcessDetailUpdated:ChecksumOK.ProcessDetailUpdated:VerifyOKProcessOutlineUpdated:Processtimewas1799msec.DownloadingFLSProcessOutlineUpdated:StartdownloadingfromfileICE03.14.08_G.fls.ProcessDetailUpdated:ErasingthedynamiceepromareaProgressUpdated:100ProcessDetailUpdated:Sendingsec-pack.ProcessDetailUpdated:Loadregion0ProcessDetailUpdated:Sendingdata.ProgressUpdated:0ProgressUpdated:2ProgressUpdated:4......（省略）ProgressUpdated:97ProgressUpdated:99ProgressUpdated:100ProcessDetailUpdated:Loadregion1ProcessDetailUpdated:Sendingdata.ProgressUpdated:0ProgressUpdated:1ProgressUpdated:2......（省略）ProgressUpdated:99ProgressUpdated:100ProcessDetailUpdated:Sendingend-pack.ProcessDetailUpdated:ChecksumOK.ProcessDetailUpdated:VerifyOKProcessOutlineUpdated:Processtimewas1min52sec.Resettingtarget...pingingthebaseband...issuing+cpwroff...Done-sh-3.2#launchctlload/System/Library/LaunchDaemons/com.apple.CommCenter.plist（启动通讯中心）（在这里省略了使用SimFree，得到seczone，生成secloader后放进/revirgin目录中的过程）-sh-3.2#launchctlload/System/Library/LaunchDaemons/com.apple.CommCenter.plist（关闭通讯中心）-sh-3.2#cd/revirgin/-sh-3.2#./iUnlock314secpackXXXXXXXXXXXXXXX.bin_loader（写入secloader）iUnlockv43.hiBaud--Copyright2007ThedevteamCredits:Daeken,Darkmen,guest184,gray,iZsh,pytey,roxfan,Sam,uns,Zappaz,ZfSendingbaudratecommandspeed921600SendingBeginSecpackcommandSendingErasecommandWaitingForEraseCompletion...OKFlashing20%40%61%81%OKSendingEndSecpackcommandValidatingthewritecommandFWareequal!Completed.Enjoy!-sh-3.2#./bbupdater-v（激活secloader修复seczone）Resettingtarget...pingingthebaseband...basebandunresponsivetopingingDone-sh-3.2#./iUnlock314secpack314fls_correct（恢复原始的secloader）iUnlockv43.hiBaud--Copyright2007ThedevteamCredits:Daeken,Darkmen,guest184,gray,iZsh,pytey,roxfan,Sam,uns,Zappaz,ZfSendingbaudratecommandspeed921600SendingBeginSecpackcommandSendingErasecommandWaitingForEraseCompletion...OKFlashing01%02%......（省略）98%99%OKSendingEndSecpackcommandValidatingthewritecommandFWareequal!Completed.Enjoy!-sh-3.2#./bbupdater-v（确认secloader恢复成功）Resettingtarget...pingingthebaseband...issuing+xgendata...firmware:DEV_ICE_MODEM_03.14.08_Geepversion:EEP_VERSION:207eeprevision:EEP_REVISION:7bootloader:BOOTLOADER_VERSION:3.9_M3S2Done-sh-3.2#./bbupdater-eeeprom.eep（恢复EEPROM）Preparingtoflashusing/dev/tty.basebandat750000baudPleaseresettargetResettingtarget...ProcessDetailUpdated:Boot-loaderisactiveProcessDetailUpdated:EBLversion:3.9_M3S23..9ProcessDetailUpdated:Bootmodeis:CCProcessDetailUpdated:Baudratesetto750000ProcessDetailUpdated:Getflashid.ProcessDetailUpdated:CFIstage1ProcessDetailUpdated:FlashIDis:88620089ProcessDetailUpdated:CFIstage2ProcessDetailUpdated:BootprocessfinishedProcessOutlineUpdated:ReadingSWversiondataError:couldn\'tretrieveversioninformation:Filenotfound.Upgradefrom饾?to?/DownloadingEEPProcessOutlineUpdated:Startdownloadingfromfileeeprom.eep.ProcessDetailUpdated:Sendingsec-pack.ProcessDetailUpdated:Loadregion0ProcessDetailUpdated:Sendingend-pack.ProcessDetailUpdated:ChecksumOK.ProcessDetailUpdated:VerifyOKProcessOutlineUpdated:Processtimewas1782msec.Resettingtarget...Done-sh-3.2#launchctlload/System/Library/LaunchDaemons/com.apple.CommCenter.plist（启动通讯中心）