Unofficial iPhone memory expansion or Chinese victory over American marketing

Once upon a time, when an iPhone in Russia was expensive, many bought AT&T iPhones locked with Ibei using a proxy sim (heveika) for unlock. At this time, the transition to iPhone 4 began, where the method with upgrading the modem to iPad’s (06.15.00) did not work, the last software unlock was 01.59.00 (iOS 4.0), and the BaseBand update required the purchase of a new geveik. Up until iOS 5.0, where the new modem on 04/04/08 turned many devices into an iPod. From that moment, this amazing Chinese business flourished.
Under the cut, a small story from 2011 to the present day with pictures.


However, locked "bits" were bought all over the world, due to the fact that Apple did not sell officially unlocked devices in the first days of sales, forcing them to place the device in a contract. And the geography of sales of the first wave did not cover so many countries, and the novelty could reach much longer than sending from the USA.
Initially, it was a service for replacing a modem chip and a modem flash memory with a new one, after which a new IMEI was recorded, then the serial number in the device chip was changed. The service cost $ 150.

Technical part:
Foxconn factory, where apple products are collected, uses special diagnostic firmware. I have already talked about them here , and I am also preparing a sequel.

Pictured debug bootchain for iPhone 4


It is called from recovery (iboot) using the diags command. After its execution, the screen of the device turns purple. But if you enter a special command, you can display this menu.


The cable itself for iPhone 5+
Communication with the diags program occurs only through the serial port, which is present in 30 and 8 pin connectors.
There is an impressive list of her teams in

2014
Back in 2013, the Activation Lock function appeared, which allows you to turn the device into a "brick", until you enter the AppleID and password of the device’s host. This method began to be used to unlock them (after all, changing IMEI + SN guaranteed to unlock), however, the profit from iPhone 4 sales fell due to the obsolescence of the device. Out of desperation, methods began to appear for the hardware “unlock” ipad, which allows installing the firmware from the wifi version on the cellular model, thus avoiding blocking. At that time, experiments were actively conducted on recording empty "blanks" with a new serial number for unlocking ipad wifi and ipod touch.

2015 year
The Chinese began to develop this back in 2012, however, they managed to complete it only now. A Foxconn employee brings the iPhone 6 motherboard to the factory and flashes diagnostic firmware. A “carriage” is put in the gap between the NAND and the board, which allows for hot switching of the bga NAND microcircuit.
It happens like this: nand is installed with firmware, then the diags program is loaded into the RAM via dev bootchain, after which the chip is hot-swapped and the serial number is changed to the specified one.
The device itself looks like this:

You can buy them even on aliexpress, as well as the "NAND" blanks.
In such a cunning way, it is possible to increase the memory to 128 and even up to 256 GB (though one chip will cost 800 yuan and is sold in limited quantities)
To the last video of this process:


However, the story is not over yet. It is happening right now, but due to economic problems in the Russian Federation, this business has not yet taken root. By the way, the equipment costs ~ $ 800, which in terms of the rate of the "smoker" - 64k rubles + blanks of memory.