From ModMyi - Wiki

This is an old, outdated guide. Here is the newer version.

Alternate Method

http://gizmodo.com/gadgets/how_to/unconfirmed-unlock-the-iphone-with-extra-iphone-274046.php

1.) Obtain 2 iPhones

2.) Plug in iPhone #1 In iTunes select "I am a new AT&T Wireless Customer" and "Activate 2 or more phones on an individual or FamilyTalk Plan."

3.) Follow the steps for the FamilyTalk plan and enter "Cell Number X" to port a number over from another provider (e.g. Sprint)

4.) When the you receive the "Activation Complete" e-mail, plug in iPhone #2.

5.) Select the option "I am an existing AT&T (Cingular) wireless customer" and "Replace a phone on my account with this iPhone"

6.) Fill in the information re-using "Cell Number X." Allow the iPhone #2 to activate using this number. This number will be legit.

7.) Plug in iPhone #2, it will unlock the phone for use, but without a cell phone number assigned or account from AT&T.

Faking the Activation

gj has discovered many commands in the iTunes Frameworks.

These were found by tracing the calls from:

/System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources/AppleMobileDeviceHelper.app/Contents/MacOS/AppleMobileDeviceHelper

Usbmuxd is loaded and synthesizes two ports, a lockdown port and a standards comm port.

0x3c395bb6  lockdown_connection_create
0x3c395be3  lockdown_connection_destroy
0x3c395c02  lockdown_query_type
0x3c395c0b  lockdown_get_value
0x3c395c14  lockdown_set_value
0x3c395c1d  lockdown_remove_value
0x3c395c26  lockdown_goodbye
0x3c395c2f  lockdown_pair
0x3c395c38  lockdown_validate_pair
0x3c395c41  lockdown_session_start
0x3c395c4a  lockdown_session_stop
0x3c395c53  lockdown_activate
0x3c395c5c  lockdown_deactivate
0x3c395c65  lockdown_service_start
0x3c395c6e  lockdown_enter_recovery
0x3c395c77  lockdown_ssl_enable
0x3c3aef00  kLockdownEnableServiceSSLKey
0x3c3aef04  kLockdownPortKey
0x3c3aeec0  kAMDMissingSIM
0x3c3aeec4  kAMDMismatchedICCID
0x3c3aeec8  kAMDMismatchedIMEI
0xa1421ff0  kSCValNetIPv6ConfigMethod6to4
0xa1421ff4  kSCValNetIPv6ConfigMethodRouterAdvertisement
0xa1421ff8  kSCValNetIPv6ConfigMethodManual
0xa1421ffc  kSCValNetIPv6ConfigMethodAutomatic