carrier-explode iOS carrier and country bundles
782 of 782
Cellcom_LTE_USUS UnitedStates country bundle
  1. iOS 27.0 image · build 72.0
  2. iOS 26.5 – 26.6.2 image · build 70.0
  3. iOS 26.4 – 26.4.2 image · build 69.0
  4. iOS 26.3 – 26.3.1 image · build 68.0
  5. iOS 26.2 – 26.2.1 image · build 67.0
  6. iOS 26.1 image · build 66.0
  7. iOS 26.0 – 26.0.1 image · build 65.0
  8. OTA · iOS 16.4+ · build 54.1
  9. OTA · iOS 14.1+ · build 44.1shown
  10. OTA · iOS 9.3+ · build 24.2
  11. OTA · iOS 6.1+ · build 14.2
  12. OTA · iOS 10.3+ · build 28.3 · iPad
  13. OTA · iOS 9.3+ · build 24.2 · iPad
  14. OTA · iOS 8.3+ · build 19.1 · iPad
  15. OTA · iOS 7.1+ · build 16.2 · iPad
OTA · iOS 14.1+ · build 44.1 (15)
  1. iOS 27.0 image · build 72.0
  2. iOS 26.5 – 26.6.2 image · build 70.0
  3. iOS 26.4 – 26.4.2 image · build 69.0
  4. iOS 26.3 – 26.3.1 image · build 68.0
  5. iOS 26.2 – 26.2.1 image · build 67.0
  6. iOS 26.1 image · build 66.0
  7. iOS 26.0 – 26.0.1 image · build 65.0
  8. OTA · iOS 16.4+ · build 54.1
  9. OTA · iOS 14.1+ · build 44.1shown
  10. OTA · iOS 9.3+ · build 24.2
  11. OTA · iOS 6.1+ · build 14.2
  12. OTA · iOS 10.3+ · build 28.3 · iPad
  13. OTA · iOS 9.3+ · build 24.2 · iPad
  14. OTA · iOS 8.3+ · build 19.1 · iPad
  15. OTA · iOS 7.1+ · build 16.2 · iPad
All files overrides_D20_D21_D22.plist
plist 7.0 KiB D20 iPhone 8D21 iPhone 8 PlusD22 iPhone X Save Raw
DerPriFileVersion = "0.2.79"
IgnoresDeactivateOnNetworkScanServiceMask = 131072 bits 17 · 0x20000
SupportsImsCapability = true
PushSettings {} 2
MultiSIMTopic = "com.vzw.multisim"
Topic = "com.vzw.pushnotification"
OverrideOperatorName = "Cellcom"
Location {} 2
Location policy during emergency calls, including AML.
EmergencyLocation {} 3
ControlPlane {} 1
AugmentedEmergencyAction {} 1
UserPlane {} 1
AllowOTDOADuringEmergencyMode = true
IMSConfig {} 6
IMS (VoLTE / Wi-Fi Calling) stack configuration: SIP signalling, media/SRTP, registration and headers.
Signaling {} 37
MinSessionExpiresSeconds = 300
RingbackTimerSeconds = 60
SessionExpiresSeconds = 300
AllowPhoneContextInEmergencyUri = false
RingingTimerSeconds = 55
EmergencyImpuRank = "MDN@domain"
UseCIDUrlInPIDF = true
UseEphemeralSipSourcePortForTcp = true
UserAgentHeaderValue = "APPLE---${DEVICE}---${OS_VERSION}"
RetryAfterStatusCodes = "480,486,500,503,600"
SipTimers {} 6
EmergencyRegistrationTimeoutSeconds = 2
AllowLimitedAccessModeRegistration = true
PdpBackOffTimerforRA = 900000
strictCallFlows = true
AlwaysPrack18x = true
CSFBOnAccessBarred = true
EmergencyCallBackModeExpirationSeconds = 300
ReportSipErrorsDuringReRegistration = true
AlwaysSetPhoneContext = true
InviteErrorResponsesToTriggerCSFB = "503"
EmergencyURNs {} 1
EmergencyRingbackTimerSeconds = 600
TriggerCSFBOnWaitForRingingTimeout = false
CallEndReasons {} 3
AllowRemoteHoldForUnconfirmedCalls = true
RegistrationPolicy = "VZW"
ContactUser = "+MDN"
RegisterSmsWhenAccessBarringZero = true
UseDialogEventPackage = true
ReRegistrationHysteresisTimerMilliseconds = 60000
IgnoresIntlDataRoaming = true
RestartRingbackTimerOn180 = true
Preconditions = "None"
ReRegisterOnErrorCodes = "REGISTER:408"
CallSetupPingTimerMilliseconds = 2000
OutgoingCallPrefix {} 2
ConferenceCalling {} 1
conferenceServer = "sip:confserver@vzims.com"
SMS {} 3
allowCSFBInVolteMode = true
DCN {} 2
enableInNonVoLTEMode = true
Media {} 9
RTCPIntervalSeconds = 5
SupportAMRWB = false
EnableBandwidthSpecifiers = true
AudioCodecs {} 6
SupportAMRNB = false
EnableRTCPExtendedReports = true
ModeSetAMRWB = "2"
UseRestrictiveDirectionWhenCreatingAnswer = false
ModeSetAMRNB = "7"
SIM {} 1
USIMFallbackSupport = false
Voice {} 6
ttyIMSSupported = true
EnableVolteByDefault = true
E911OverIMSSupported = true
DisableVolteSwitchOnIncompatibleState = true
TestEmergencyPSAPSupported = true
tLte911Timer = 55
EnableLTEAfterUpgrade = true
DerPriFileName = "overrides_D20_D21_D22.der.pri"
Binary baseband PRI (.der.pri) this override plist pairs with.
DefaultWhenImsSwitchOff = 1
CarrierEntitlements {} 7
Server that gates carrier features (Wi-Fi Calling, tethering, Watch plans). SupportedEntitlements is a bitmask of which entitlement classes are queried.
ProtocolVersion = "2"
ProvisioningRecheckPeriod = 6
Authentication {} 2
Username = "0$IMSI@nai.epc.mnc$MNC.mcc$MCC.3gppnetwork.org"
Type = 1
SupportedEntitlements = 1104 bits 4, 6, 10 · 0x450
Bitmask of entitlement classes the device may request from the entitlement server. Individual bit meanings are not published.
ServerAddress = "https://spc.myvzw.com/ium-RoadrunnerInterface/servlet/IUMServlet"
UpdatePeriod = 72
UserAgent = "Entitlement/$version ($device) iOS/$iOSVersion ($build)"
EFSFiles [] 1
Qualcomm EFS files written to the modem alongside the PRI.
[0] {} 1
carrier.ims = "/shared/qpconfig.xml"
SMSSettings {} 3
OutgoingSMSPrefix {} 2
International = "+011"
Local = "+1"
MessageFormat {} 2
SignalingFormat = 2
PacketFormat = 2
TransportFallback = true
SUPL {} 3
Secure User-Plane Location: H-SLP address, TLS policy and root certificate.
SuplHSLPServerAddress = "e-slp.lte.911.*.myvzw.com:7275"
SuplUdpPortConfig = 1
SuplFlags = 8
ShowVolteSwitch = true
apns [] 2
Access Point Names. Each entry carries a type-mask (which services may use it) and a tech-type-mask (which radio technologies).
[0] {} 2
configuration [] 4
technology-mask = 1 bits 0 · 0x1
[1] {} 2
configuration [] 5
technology-mask = 14 bits 1, 2, 3 · 0xe
AttachAPN {} 1
The APN attached at LTE/NR registration, before any user-selected APN.
3GPP [] 2
[0] {} 6
[1] {} 6
782 carriers, 225 countries · iOS 27.0 (24A437) Cellcom_LTE_US GitHub Ready