Unlock your iPhone to use on T-Mobile with bootloader 4.6

Friday 03rd of October 2025

Unlock your OTB iPhone
(Out of the Box)
version 1.1.2 and 1.1.3

Yes even your 16GB iPhone
So you just got yourself a new iphone Either 8GB or 16GB and you've read it's locked to AT&T, but you have T-Mobile, or another GSM Provider.

You've read that the iPhone who's serial number starts with 877545 (or bigger, say 877551 like mine) that it therefore comes with "bootloader" 4.6 and the normal way of doing this does NOT work.

You've seen the warnings that the OTHER ways of "jailbreaking" or "unlocking" the phone will not work for your phone...

Well the Original iPhone Hacker (yeah that kid) did it again!!!!

So...What you've been waiting for:
Here are the instructions to unlock (as in use ANOTHER provider other than AT&T)

These instructions will work on a Mac, Windows (any version) and even Linux because they actually run on the iPhone itself.

1. If you have Firmware 1.1.3 then Downgrade Firmware (skip step 1 if you have 1.1.2, and upgrade to 1.1.2 if you have an older firmware)

*Yes.. Version 1.1.2... I know you've seen other instruction tell you 1.0.2..they're wrong....trust me

Put iPhone into DFU mode then use iTunes to downgrade firmware to 1.1.2 (there will be an error 1013 at the end which is normal), this will not cut WiFi during the unlocking procedure.


After the firmware downgrade, install the following packages:

BSD Subsystem
OpenSSH

2. Get Files

Get these files:

Unlocking tool:

Extract and put all files into a folder on your computer, then copy them to some directory ON your iphone.

3. Unlock It

Put your iPhone in Airplane, or remove the SIM * IMPORTANT

Now SSH login to iPhone, it's ok to use the "terminal" app if you've installed it, if not it's perfectly fine to do it over Wifi from your computer, you will NOT loose connection while doing this
Go to the directory you've copied the files you've extract and then issue the following commands to unlock:

launchctl remove com.apple.CommCenter
cd /unlock
chmod 755 *
./gunlock secpack ICE04.02.13_G.fls
{.... Note here you get something like

geohot's 112 otb unlocker...
Waiting for data...
Attempt...
Attempt...

.... It takes a while.... be patient, then just type that next line that will restart the GSM Phone part.}

launchctl load /System/Library/LaunchDaemons/com.apple.CommCenter.plist
I had to reboot after this. you should too.

NOTICE: 1.1.3 unlocked with 04.02.13_G.fls.

4. Jump Out of Brick Mode * SOME people have explained that they've been put into "brick mode". I haven't experienced this, but if you have

If iPhone is in brickmode after the unlock, get the elite team bricktool From Here and use it to get out (bricktool d).

Enjoy your OTB 1.1.2/1.1.3 unlocked iPhone.

geohot's 112 otb unlocker...
        Waiting for data...
        Attempt...
        Attempt...
        Got Header: 77 0b cc
        Bootloader version: 3.9_M3S2
        Incorrect bootloader version
Next to get it on T-mobile there's two options. For T-mobile Internet.

1) Get T-mobile Total Internet ($19.99 with full internet and no proxy requirements).
- For this simly go to Settings -> General -> Network -> EDGE -> APN:internet2.voicestream.com (leave the username and password blank)

2) for T-mobileWeb and T-zones you need to edit two files.
Create the file: /private/var/root/proxy.pac 
        function FindProxyForURL(url, host)
        {
        if (isInNet(myIpAddress(), "10.0.0.0", "255.0.0.0"))
        return "PROXY 216.155.165.50:8080";
        else
        return "DIRECT";
        }


Edit the following files adding the lines below after /private/var/preferences/SystemConfiguration/preferences.plist

After: 

       	<dict>
            <key>Interface</key>
            <dict>
            <key>DeviceName</key>
            <string>ip1</string>
            <key>Hardware</key>
            <string>com.apple.CommCenter</string>
            <key>Type</key>
            <string>com.apple.CommCenter</string>
        </dict>
Add these lines: 
            <key>Proxies</key>
            <dict>
            <key>ProxyAutoConfigEnable</key>
            <integer>1</integer>
            <key>ProxyAutoConfigURLString</key>
            <string>file:///private/var/root/proxy.pac</string>
            </dict>
And Edit the "APN" line to look like this 
            <key>com.apple.CommCenter</key>
            <dict>
            <key>AllowNetworkAccess</key>
            <integer>1</integer>
            <key>Available</key>
            <integer>1</integer>
            <key>Setup</key>
            <dict>
            <key>apn</key>
            <string>wap.voicestream.com</string>
            <key>password</key>
            <string></string>
            <key>username</key>
            <string></string>
            </dict>



| Comments