ios12卡贴机(有锁)/无锁机 改电信VOLTE //高通基带//教程
ios12卡贴机(有锁)/无锁机 改电信VOLTE //高通基带//教程
基本要求：
一、ios12.0-12.12（可越狱就行）
二、已开通volte
三、确保已经固定G值和有完整可用的shsh2
四、卡贴机尽量别折腾3G回落 无锁请食用
准备工作：
零、卡贴机必看步骤 无锁忽略
用卡贴iccid解锁 一定要用卡贴黑解！！！
一、运营商文件选择
band1/band3/band5的运营商规则文件：
Docomo_jp.bundle(可能会出现发送短信问题)
KDDI_LTE_only_jp.bundle(部分用户出现无法激活iMessage和FaceTime)
SingTel_sg.bundle(部分用户出现安卓VoLTE用户无法呼入)
锁定band5的运营商
USCellular_LTE_US.bundle[完美支持3G（3G不可上网）]
3G可上网4G完美VoLTE
Verizon_LTE_US.bundle（会出现iPhone需要激活，可能会在通话时出现，挂断电话，风险较高）
二、越狱准备
app.ignition.fun 下载 uncover rootlessJB
查看并固定G值+越狱获取权限
打开爱思助手》刷机越狱》高级功能》下载shsh文件
保存后打开shsh文件 找到generator 复制值：0x5958c0c45b4d87e4
打开uncover》settings 找到 Boot Nonce 输入刚刚复制的值
然后 选中 load Daemons 、Disable Auto Updates、Disable App Revokes、Overwrite Boot Nonce、
Restore RootFS(recover)、Reload System Daemons 再去点击Jailbreak
等待弹窗
点击OK 自动退出应用
接着打开rootlessJB 点击Jailbreak 会自动注销 然后解锁就有权限修改文件了
打开Filza
打开目录：/system/library/carrier bundles/iPhone/ChinaTelecom_USIM_cn.bundle/ 备份ChinaTelecom_USIM_cn.bundle文件夹 并删除去夹内内容
打开目录：/system/library/carrier bundles/iPhone/
并寻找上文提到的运营商文件夹
一、运营商文件选择
band1/band3/band5的运营商规则文件：
Docomo_jp.bundle(可能会出现发送短信问题)
KDDI_LTE_only_jp.bundle(部分用户出现无法激活iMessage和FaceTime)
SingTel_sg.bundle(部分用户出现安卓VoLTE用户无法呼入)
锁定band5的运营商
USCellular_LTE_US.bundle[完美支持3G（3G不可上网）]
3G可上网4G完美VoLTE
Verizon_LTE_US.bundle（会出现iPhone需要激活，可能会在通话时出现，挂断电话，风险较高）
复制其中的文件 到ChinaTelecom_USIM_cn.bundle中粘贴
打开目录：/system/library 找到carrier bundles文件夹 加权限0555应用到子项目
、
再点击右上角的存储
打开目录：/var/mobile/library/ 删除 carrier bundles 然后重启手机
打开目录：etc 找到hosts文件用文本编辑器打开 添加127.0.0.1 appldnld.apple.com 和 127.0.0.1 mesu.apple.com 保存文件并重启手机
重启后可能会出现LTE或空心信号或出现信号一会消失
等10秒左右
飞行一次重新出信号
然后执行下步操作 没信号也直接跳过
再次半越狱（uncover、rootlessJb）进入/var/mobile/library/carrier bundles/overlay/，打开device+carrier+46011+Dxx+3x.x.x.plist找到DerPriFileName，复制其值，一般都是 overrides_D20_D21_D22.der.pri
以文本编辑器打开文件
全选删除内容
复制下方代码 粘贴进去 保存文件
APNEditabilityTypemask
5
AllowedServicesTypeMaskOnInternet
32769
AttachAPN
3GPP
AllowedProtocolMask
3
AllowedProtocolMaskInRoamingLTE
3
DefaultProtocolMask
3
PcscfAddressRequired
CarrierEntitlements
Authentication
BsfPort
8080
Type
2
Username
[email protected]$MNC.mcc$MCC.3gppnetwork.org
ProtocolVersion
2
ProvisioningRecheckPeriod
5
ServerAddress
https://applecsb.crm.189.cn:8101/CRM-CSB/HttpAppleService
SupportedEntitlements
1024
UpdatePeriod
24
UserAgent
3gpp-gba
CarrierName
中国电信
CarrierSpace
AuthClientID
sg_client
AuthorizationURL
https://ct.crm.189.cn:86/pubPortal/appleAuth/init
AutoRefreshMinimumIntervalMins
1440
DataOptimizationAllowed
ManualRefreshMinimumIntervalMins
30
PlanProvisioningPollInterval
360
SupportsApps
SupportsPlans
SupportsUsage
TeamIDList
7338DEUF7S
TokenURL
https://ct.crm.189.cn:86/pubPortal/appleAuth/initback
CellularDataUsage
ShowMonthlyDataUsage
CheckSMSonSIM
CustomerServicePhoneNumber
10000
DataIndicatorOverrideForLTE
4G
DerPriFileName
overrides_D20_D21_D22.der.pri
DerPriFileVersion
0.0.19
EnableLTEAfterUpgrade
IMSConfig
AllowHandoverWithoutIMSVoiceService
ConferenceCalling
SendConferenceSubscribeInNewDialog
conferenceServer
sip:[email protected]${MNC}.mcc${MCC}.3gppnetwork.org
Media
EnableBandwidthSpecifiers
HideSessionLevelDirection
InactivityTimerRTCPSeconds
20
IncludeSDPMaxRed
IncludeSDPModeChangeCapability
MaxRedundancy
220
PreferredAMRWBMode
8
RTCPIntervalSeconds
5
UseRestrictiveDirectionWhenCreatingAnswer
SMS
SMSBundleToVoice
SupportedDomains
CDMA
CDMA2000
LTE
TR1MTimer
IsFatalOnIMSSendFailure
IsFatalOnIMSSendSuccess
TimerValue
133
allowCSFBInVolteMode
Signaling
AdditionalContactParams
INVITE:200,PRACK:200,UPDATE:200
audio
REGISTER
+g.3gpp.accesstype="cellular2"
REGISTER,INVITE,INVITE:*
+g.3gpp.mid-call;+g.3gpp.srvcc-alerting;+g.3gpp.ps2cs-srvcc-orig-pre-alerting
AdditionalFeatureTags
voice
audio
AllowAnonymousEmergencyCalls
AllowRegistrationCanceledState
AllowResponsesOverDifferentTransport
AlwaysUnsubscribeFromRegEvents
CallEndReasons
Blocked
StatusCode
486
RejectedByUser
ReasonHeaderText
Decline
StatusCode
603
ConvertSessionProgressToRinging
DefaultAuthAlgorithm
AKAv1-MD5
DontSendPreconditionsIfCallWaitingDisabled
DropRegistrationOnSRVCC
EarlyMediaNeedsHeader
EmergencyURNs
110
urn:service:sos.police
119
urn:service:sos.fire
120
urn:service:sos.ambulance
122
urn:service:sos.traffic
EnableEmergencyRegistration
EnableSenderName
ForbiddenRegistrationErrorCodes
4xx,-404,5xx,6xx
IncomingCallEndReasons
RequestTimeout
Protocol
Q.850
ReasonHeaderCause
19
StatusCode
408
TerminationEvent
RemoteHangup
TemporarilyUnavailable
StatusCode
480
TerminationEvent
RemoteCallRejected
IncompleteRegistrationThrottlingIntervalSeconds
0
InviteErrorResponsesToTriggerCSFB
500,503
LocalQoSTimeoutMOSeconds
6
LocalQoSTimeoutMTSeconds
6
MaxReRegistrationAttempts
0
MinSessionExpiresSeconds
600
NetworkTerminationRetryIntervalSeconds
1
Preconditions
Supported
ResetDisabledModeOnEvents
SimInserted,AirplaneModeToggled,AccessNetworkChanged
RingbackTimerSeconds
95
RingingTimerSeconds
90
SRVCCCleanupTimeoutSeconds
0
SendResumeInviteAsSendRecv
SipTimers
InviteResponseTimeout
6000
StartLocalQosTimerOnSessionProgress
SupportPEarlyMediaHeader
UseFakeSAsForDeregistration
UseIPSec
UseNormalIdentityForEmergencyUSIM
VirtualInterfaceMtu
4096
Voice
DialAsEmergencyOverIMSForUndetectedEmergency
E911OverIMSSupported
EnableVolteByDefault
PreAlertingDTMFSupported
XCAP
BsfHost
bsf.mnc011.mcc460.pub.3gppnetwork.org
BsfPort
8080
ContentType
application/xcap-el+xml
DisableCLIRModification
DisableOnNetworkError
NafHost
xcap.ims.mnc011.mcc460.pub.3gppnetwork.org
NafPort
80
SupportsCLIR
SupportsCW
imsFeatureDependency
supported
IgnoresDeactivateOnNetworkScanServiceMask
131072
MMS
GroupModeAllowUserOverride
GroupModeEnabled
MMSC
http://mmsc.vnet.mobi
MaxMessageSize
307200
MaxRecipients
10
MaxSubjectLenBytes
80
MaxVoiceCallWaitPeriod
0
Proxy
10.0.0.200:80
vCard21ExportModeEnabled
MaxBluetoothModemConnections
5
PhoneNumberRegistrationGatewayAddress
00447786205094
RemoteCardProvisioningSettings
ActivatingStateSubscriptionCheckTimerIntervals
300
480
600
InconsistentICCIDLength
MatchingICCIDPrefixes
898603
898611
MinCompatibleWatchOS
5.1
ProvisioningMethod
CarrierFlow
ServerURL
https://esimapple.crm.189.cn
SupportedSKUs
SKU_CU
SupportsFauxCard
UsesAutoAssignment
RemoteDiagnosticsWWANAllowed
SMSSettings
CustomTeleserviceIDs
FDEA
1004
FDED
1002
IgnoreWAPPushBits
69
TerminalRegistration
DestinationAddress
10659401
Registration
<a1><b1>ACM-$MODEL</b1><b2>$MEID</b2><b3>$IMSI</b3><b4>$VERSION</b4></a1>
TeleserviceID
65005
SaveICCIDToCache
Services
ServiceCode
10000
ServiceName
客户服务热线
ServiceCode
10001
ServiceName
自助服务热线
ServiceCode
+8618918910000
ServiceName
国际漫游客服
ShouldHideAllVoicemailUI
Show3GSwitch
Show4GSwitch
ShowDialAssist
ShowMessagesConversationListFilteringPrompt
ShowTTY
ShowVolteSwitch
StatusBarImages
AllowPrefixMatching
CarrierName
CHN-CT
StatusBarCarrierName
中国电信
AllowPrefixMatching
CarrierName
U.S. Cellular
StatusBarCarrierName
中国电信
AllowPrefixMatching
StatusBarCarrierName
中国电信
StockSymboli
name
中国电信
symbol
0728.HK
SupportedSIMs
46011
20404_ID-898611
SupportsFlashInfoCallTimer
SupportsImsCapability
SupportsNITZ
SupportsUserBusyCauseCode
URLifyUnquotedShorts
VVMIgnoresIntlDataRoaming
apns
configuration
AllowedProtocolMask
3
AllowedProtocolMaskInRoaming
3
DefaultProtocolMask
3
apn
ctnet
password
type-mask
1081395
username
AllowedProtocolMask
3
AllowedProtocolMaskInRoaming
3
DefaultProtocolMask
3
apn
ctwap
password
type-mask
4
username
AllowedProtocolMask
3
AllowedProtocolMaskInRoaming
3
DefaultProtocolMask
3
WaitForBringUpComplete
apn
IMS
password
type-mask
131072
username
AllowedProtocolMask
3
AllowedProtocolMaskInRoaming
3
DefaultProtocolMask
3
apn
ctnet
password
type-mask
1081394
username
AllowedProtocolMask
3
DefaultProtocolMask
3
apn
SOS
password
type-mask
262144
username
technology-mask
9
e_only_whitelist
08
000
110
118
119
120
122
999
nais
nai
default
password
vnet.mobi
username
[email protected]
再打开文件 找到DerPriFileName并按照源文件修改值（就是刚刚复制的值）
再次打开目录/var/mobile/library/ 找到 carrier bundles 文件夹 修改权限为0555并应用到子项目
重启手机
如果有无服务情况就飞一下
USCellular运营商是秒出信号 自用的
请忽略我的联通
by：木头（一斤苹果梨）