ios12卡贴机(有锁)/无锁机改电信VOLTE //高通基带//教程

基本要求：

一、ios12.0-12.12（可越狱就行）

二、已开通volte

三、确保已经固定G值和有完整可用的shsh2

四、卡贴机尽量别折腾3G回落无锁请食用

准备工作：

零、卡贴机必看步骤无锁忽略

用卡贴iccid解锁一定要用卡贴黑解！！！

一、运营商文件选择

band1/band3/band5的运营商规则文件：

Docomo_jp.bundle(可能会出现发送短信问题)

KDDI_LTE_only_jp.bundle(部分用户出现无法激活iMessage和FaceTime)

SingTel_sg.bundle(部分用户出现安卓VoLTE用户无法呼入)

锁定band5的运营商

USCellular_LTE_US.bundle[完美支持3G（3G不可上网）]

3G可上网4G完美VoLTE

Verizon_LTE_US.bundle（会出现iPhone需要激活，可能会在通话时出现，挂断电话，风险较高）

二、越狱准备

app.ignition.fun 下载 uncover rootlessJB

查看并固定G值+越狱获取权限

打开爱思助手》刷机越狱》高级功能》下载shsh文件

保存后打开shsh文件找到generator 复制值：0x5958c0c45b4d87e4

打开uncover》settings 找到 Boot Nonce 输入刚刚复制的值

然后选中 load Daemons 、Disable Auto Updates、Disable App Revokes、Overwrite Boot Nonce、

Restore RootFS(recover)、Reload System Daemons 再去点击Jailbreak

等待弹窗

点击OK 自动退出应用

接着打开rootlessJB 点击Jailbreak 会自动注销然后解锁就有权限修改文件了

打开Filza

打开目录：/system/library/carrier bundles/iPhone/ChinaTelecom_USIM_cn.bundle/ 备份ChinaTelecom_USIM_cn.bundle文件夹并删除去夹内内容

打开目录：/system/library/carrier bundles/iPhone/

并寻找上文提到的运营商文件夹

一、运营商文件选择

band1/band3/band5的运营商规则文件：

Docomo_jp.bundle(可能会出现发送短信问题)

KDDI_LTE_only_jp.bundle(部分用户出现无法激活iMessage和FaceTime)

SingTel_sg.bundle(部分用户出现安卓VoLTE用户无法呼入)

锁定band5的运营商

USCellular_LTE_US.bundle[完美支持3G（3G不可上网）]

3G可上网4G完美VoLTE

Verizon_LTE_US.bundle（会出现iPhone需要激活，可能会在通话时出现，挂断电话，风险较高）

复制其中的文件到ChinaTelecom_USIM_cn.bundle中粘贴

打开目录：/system/library 找到carrier bundles文件夹加权限0555应用到子项目

、

再点击右上角的存储

打开目录：/var/mobile/library/ 删除 carrier bundles 然后重启手机

打开目录：etc 找到hosts文件用文本编辑器打开添加127.0.0.1 appldnld.apple.com 和 127.0.0.1 mesu.apple.com 保存文件并重启手机

重启后可能会出现LTE或空心信号或出现信号一会消失

等10秒左右

飞行一次重新出信号

然后执行下步操作没信号也直接跳过

再次半越狱（uncover、rootlessJb）进入/var/mobile/library/carrier bundles/overlay/，打开device+carrier+46011+Dxx+3x.x.x.plist找到DerPriFileName，复制其值，一般都是 overrides_D20_D21_D22.der.pri

以文本编辑器打开文件

全选删除内容

复制下方代码粘贴进去保存文件

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict><key>APNEditabilityTypemask</key><integer>5</integer><key>AllowedServicesTypeMaskOnInternet</key><integer>32769</integer><key>AttachAPN</key><dict><key>3GPP</key><dict><key>AllowedProtocolMask</key><integer>3</integer><key>AllowedProtocolMaskInRoamingLTE</key><integer>3</integer><key>DefaultProtocolMask</key><integer>3</integer><key>PcscfAddressRequired</key><false/></dict></dict><key>CarrierEntitlements</key><dict><key>Authentication</key><dict><key>BsfPort</key><integer>8080</integer><key>Type</key><integer>2</integer><key>Username</key><string>0$IMSI@nai.epc.mnc$MNC.mcc$MCC.3gppnetwork.org</string></dict><key>ProtocolVersion</key><string>2</string><key>ProvisioningRecheckPeriod</key><integer>5</integer><key>ServerAddress</key><string>https://applecsb.crm.189.cn:8101/CRM-CSB/HttpAppleService</string><key>SupportedEntitlements</key><integer>1024</integer><key>UpdatePeriod</key><integer>24</integer><key>UserAgent</key><string>3gpp-gba</string></dict><key>CarrierName</key><string>中国电信</string><key>CarrierSpace</key><dict><key>AuthClientID</key><string>sg_client</string><key>AuthorizationURL</key><string>https://ct.crm.189.cn:86/pubPortal/appleAuth/init</string><key>AutoRefreshMinimumIntervalMins</key><integer>1440</integer><key>DataOptimizationAllowed</key><true/><key>ManualRefreshMinimumIntervalMins</key><integer>30</integer><key>PlanProvisioningPollInterval</key><integer>360</integer><key>SupportsApps</key><true/><key>SupportsPlans</key><true/><key>SupportsUsage</key><true/><key>TeamIDList</key><array><string>7338DEUF7S</string></array><key>TokenURL</key><string>https://ct.crm.189.cn:86/pubPortal/appleAuth/initback</string></dict><key>CellularDataUsage</key><dict><key>ShowMonthlyDataUsage</key><true/></dict><key>CheckSMSonSIM</key><true/><key>CustomerServicePhoneNumber</key><string>10000</string><key>DataIndicatorOverrideForLTE</key><string>4G</string><key>DerPriFileName</key><string>overrides_D20_D21_D22.der.pri</string><key>DerPriFileVersion</key><string>0.0.19</string><key>EnableLTEAfterUpgrade</key><true/><key>IMSConfig</key><dict><key>AllowHandoverWithoutIMSVoiceService</key><true/><key>ConferenceCalling</key><dict><key>SendConferenceSubscribeInNewDialog</key><true/><key>conferenceServer</key><string>sip:mmtel@conf-factory.ims.mnc${MNC}.mcc${MCC}.3gppnetwork.org</string></dict><key>Media</key><dict><key>EnableBandwidthSpecifiers</key><true/><key>HideSessionLevelDirection</key><true/><key>InactivityTimerRTCPSeconds</key><integer>20</integer><key>IncludeSDPMaxRed</key><true/><key>IncludeSDPModeChangeCapability</key><true/><key>MaxRedundancy</key><integer>220</integer><key>PreferredAMRWBMode</key><string>8</string><key>RTCPIntervalSeconds</key><integer>5</integer><key>UseRestrictiveDirectionWhenCreatingAnswer</key><false/></dict><key>SMS</key><dict><key>SMSBundleToVoice</key><true/><key>SupportedDomains</key><dict><key>CDMA</key><false/><key>CDMA2000</key><false/><key>LTE</key><true/></dict><key>TR1MTimer</key><dict><key>IsFatalOnIMSSendFailure</key><true/><key>IsFatalOnIMSSendSuccess</key><false/><key>TimerValue</key><integer>133</integer></dict><key>allowCSFBInVolteMode</key><true/></dict><key>Signaling</key><dict><key>AdditionalContactParams</key><dict><key>INVITE:200,PRACK:200,UPDATE:200</key><string>audio</string><key>REGISTER</key><string>+g.3gpp.accesstype="cellular2"</string><key>REGISTER,INVITE,INVITE:*</key><string>+g.3gpp.mid-call;+g.3gpp.srvcc-alerting;+g.3gpp.ps2cs-srvcc-orig-pre-alerting</string></dict><key>AdditionalFeatureTags</key><dict><key>voice</key><dict><key>audio</key><string></string></dict></dict><key>AllowAnonymousEmergencyCalls</key><false/><key>AllowRegistrationCanceledState</key><true/><key>AllowResponsesOverDifferentTransport</key><false/><key>AlwaysUnsubscribeFromRegEvents</key><false/><key>CallEndReasons</key><dict><key>Blocked</key><dict><key>StatusCode</key><integer>486</integer></dict><key>RejectedByUser</key><dict><key>ReasonHeaderText</key><string>Decline</string><key>StatusCode</key><integer>603</integer></dict></dict><key>ConvertSessionProgressToRinging</key><false/><key>DefaultAuthAlgorithm</key><string>AKAv1-MD5</string><key>DontSendPreconditionsIfCallWaitingDisabled</key><true/><key>DropRegistrationOnSRVCC</key><true/><key>EarlyMediaNeedsHeader</key><true/><key>EmergencyURNs</key><dict><key>110</key><string>urn:service:sos.police</string><key>119</key><string>urn:service:sos.fire</string><key>120</key><string>urn:service:sos.ambulance</string><key>122</key><string>urn:service:sos.traffic</string></dict><key>EnableEmergencyRegistration</key><true/><key>EnableSenderName</key><false/><key>ForbiddenRegistrationErrorCodes</key><string>4xx,-404,5xx,6xx</string><key>IncomingCallEndReasons</key><dict><key>RequestTimeout</key><dict><key>Protocol</key><string>Q.850</string><key>ReasonHeaderCause</key><integer>19</integer><key>StatusCode</key><integer>408</integer><key>TerminationEvent</key><string>RemoteHangup</string></dict><key>TemporarilyUnavailable</key><dict><key>StatusCode</key><integer>480</integer><key>TerminationEvent</key><string>RemoteCallRejected</string></dict></dict><key>IncompleteRegistrationThrottlingIntervalSeconds</key><integer>0</integer><key>InviteErrorResponsesToTriggerCSFB</key><string>500,503</string><key>LocalQoSTimeoutMOSeconds</key><integer>6</integer><key>LocalQoSTimeoutMTSeconds</key><integer>6</integer><key>MaxReRegistrationAttempts</key><integer>0</integer><key>MinSessionExpiresSeconds</key><integer>600</integer><key>NetworkTerminationRetryIntervalSeconds</key><integer>1</integer><key>Preconditions</key><string>Supported</string><key>ResetDisabledModeOnEvents</key><string>SimInserted,AirplaneModeToggled,AccessNetworkChanged</string><key>RingbackTimerSeconds</key><integer>95</integer><key>RingingTimerSeconds</key><integer>90</integer><key>SRVCCCleanupTimeoutSeconds</key><integer>0</integer><key>SendResumeInviteAsSendRecv</key><false/><key>SipTimers</key><dict><key>InviteResponseTimeout</key><integer>6000</integer></dict><key>StartLocalQosTimerOnSessionProgress</key><true/><key>SupportPEarlyMediaHeader</key><true/><key>UseFakeSAsForDeregistration</key><true/><key>UseIPSec</key><true/><key>UseNormalIdentityForEmergencyUSIM</key><true/><key>VirtualInterfaceMtu</key><integer>4096</integer></dict><key>Voice</key><dict><key>DialAsEmergencyOverIMSForUndetectedEmergency</key><true/><key>E911OverIMSSupported</key><true/><key>EnableVolteByDefault</key><true/><key>PreAlertingDTMFSupported</key><true/></dict><key>XCAP</key><dict><key>BsfHost</key><string>bsf.mnc011.mcc460.pub.3gppnetwork.org</string><key>BsfPort</key><integer>8080</integer><key>ContentType</key><string>application/xcap-el+xml</string><key>DisableCLIRModification</key><true/><key>DisableOnNetworkError</key><true/><key>NafHost</key><string>xcap.ims.mnc011.mcc460.pub.3gppnetwork.org</string><key>NafPort</key><integer>80</integer><key>SupportsCLIR</key><false/><key>SupportsCW</key><false/><key>imsFeatureDependency</key><false/><key>supported</key><true/></dict></dict><key>IgnoresDeactivateOnNetworkScanServiceMask</key><integer>131072</integer><key>MMS</key><dict><key>GroupModeAllowUserOverride</key><true/><key>GroupModeEnabled</key><false/><key>MMSC</key><string>http://mmsc.vnet.mobi</string><key>MaxMessageSize</key><integer>307200</integer><key>MaxRecipients</key><integer>10</integer><key>MaxSubjectLenBytes</key><integer>80</integer><key>MaxVoiceCallWaitPeriod</key><integer>0</integer><key>Proxy</key><string>10.0.0.200:80</string><key>vCard21ExportModeEnabled</key><true/></dict><key>MaxBluetoothModemConnections</key><integer>5</integer><key>PhoneNumberRegistrationGatewayAddress</key><string>00447786205094</string><key>RemoteCardProvisioningSettings</key><dict><key>ActivatingStateSubscriptionCheckTimerIntervals</key><array><integer>300</integer><integer>480</integer><integer>600</integer></array><key>InconsistentICCIDLength</key><true/><key>MatchingICCIDPrefixes</key><array><string>898603</string><string>898611</string></array><key>MinCompatibleWatchOS</key><string>5.1</string><key>ProvisioningMethod</key><string>CarrierFlow</string><key>ServerURL</key><string>https://esimapple.crm.189.cn</string><key>SupportedSKUs</key><array><string>SKU_CU</string></array><key>SupportsFauxCard</key><true/><key>UsesAutoAssignment</key><false/></dict><key>RemoteDiagnosticsWWANAllowed</key><true/><key>SMSSettings</key><dict><key>CustomTeleserviceIDs</key><dict><key>FDEA</key><string>1004</string><key>FDED</key><string>1002</string></dict><key>IgnoreWAPPushBits</key><integer>69</integer><key>TerminalRegistration</key><dict><key>DestinationAddress</key><string>10659401</string><key>Registration</key><string>&lt;a1&gt;&lt;b1&gt;ACM-$MODEL&lt;/b1&gt;&lt;b2&gt;$MEID&lt;/b2&gt;&lt;b3&gt;$IMSI&lt;/b3&gt;&lt;b4&gt;$VERSION&lt;/b4&gt;&lt;/a1&gt;</string><key>TeleserviceID</key><integer>65005</integer></dict></dict><key>SaveICCIDToCache</key><true/><key>Services</key><array><dict><key>ServiceCode</key><string>10000</string><key>ServiceName</key><string>客户服务热线</string></dict><dict><key>ServiceCode</key><string>10001</string><key>ServiceName</key><string>自助服务热线</string></dict><dict><key>ServiceCode</key><string>+8618918910000</string><key>ServiceName</key><string>国际漫游客服</string></dict></array><key>ShouldHideAllVoicemailUI</key><true/><key>Show3GSwitch</key><false/><key>Show4GSwitch</key><true/><key>ShowDialAssist</key><true/><key>ShowMessagesConversationListFilteringPrompt</key><false/><key>ShowTTY</key><false/><key>ShowVolteSwitch</key><true/><key>StatusBarImages</key><array><dict><key>AllowPrefixMatching</key><true/><key>CarrierName</key><string>CHN-CT</string><key>StatusBarCarrierName</key><string>中国电信</string></dict><dict><key>AllowPrefixMatching</key><false/><key>CarrierName</key><string>U.S. Cellular</string><key>StatusBarCarrierName</key><string>中国电信</string></dict><dict><key>AllowPrefixMatching</key><true/><key>StatusBarCarrierName</key><string>中国电信</string></dict></array><key>StockSymboli</key><array><dict><key>name</key><string>中国电信</string><key>symbol</key><string>0728.HK</string></dict></array><key>SupportedSIMs</key><array><string>46011</string><string>20404_ID-898611</string></array><key>SupportsFlashInfoCallTimer</key><true/><key>SupportsImsCapability</key><true/><key>SupportsNITZ</key><false/><key>SupportsUserBusyCauseCode</key><true/><key>URLifyUnquotedShorts</key><true/><key>VVMIgnoresIntlDataRoaming</key><true/><key>apns</key><array><dict><key>configuration</key><array><dict><key>AllowedProtocolMask</key><integer>3</integer><key>AllowedProtocolMaskInRoaming</key><integer>3</integer><key>DefaultProtocolMask</key><integer>3</integer><key>apn</key><string>ctnet</string><key>password</key><string></string><key>type-mask</key><integer>1081395</integer><key>username</key><string></string></dict><dict><key>AllowedProtocolMask</key><integer>3</integer><key>AllowedProtocolMaskInRoaming</key><integer>3</integer><key>DefaultProtocolMask</key><integer>3</integer><key>apn</key><string>ctwap</string><key>password</key><string></string><key>type-mask</key><integer>4</integer><key>username</key><string></string></dict><dict><key>AllowedProtocolMask</key><integer>3</integer><key>AllowedProtocolMaskInRoaming</key><integer>3</integer><key>DefaultProtocolMask</key><integer>3</integer><key>WaitForBringUpComplete</key><true/><key>apn</key><string>IMS</string><key>password</key><string></string><key>type-mask</key><integer>131072</integer><key>username</key><string></string></dict><dict><key>AllowedProtocolMask</key><integer>3</integer><key>AllowedProtocolMaskInRoaming</key><integer>3</integer><key>DefaultProtocolMask</key><integer>3</integer><key>apn</key><string>ctnet</string><key>password</key><string></string><key>type-mask</key><integer>1081394</integer><key>username</key><string></string></dict><dict><key>AllowedProtocolMask</key><integer>3</integer><key>DefaultProtocolMask</key><integer>3</integer><key>apn</key><string>SOS</string><key>password</key><string></string><key>type-mask</key><integer>262144</integer><key>username</key><string></string></dict></array><key>technology-mask</key><integer>9</integer></dict></array><key>e_only_whitelist</key><array><string>08</string><string>000</string><string>110</string><string>118</string><string>119</string><string>120</string><string>122</string><string>999</string></array><key>nais</key><array><dict><key>nai</key><string>default</string><key>password</key><string>vnet.mobi</string><key>username</key><string>ctwap@mycdma.cn</string></dict></array>
</dict>
</plist>

再打开文件找到DerPriFileName并按照源文件修改值（就是刚刚复制的值）

再次打开目录/var/mobile/library/ 找到 carrier bundles 文件夹修改权限为0555并应用到子项目

重启手机

如果有无服务情况就飞一下

USCellular运营商是秒出信号自用的
请忽略我的联通

by：木头（一斤苹果梨）