1.1.2 OTB UNLOCKED

First of all, HUGE thanks to TA_Mobile and IMTH for getting us the secpack from 1.1.3 Also, thanks to psp_sully for giving me a 1.1.2 OTB phone to play with. Without them there would be no unlock, and no blog post.
YOU VERY WELL MAY BRICK YOUR PHONE WITH THIS. Be careful. I have done it sucessfully on two phones, and have never bricked an iPhone in my life.
So lets get down to business. It is a hardware method to downgrade the bootloader, and I am assuming you are familiar with the old hardware method, so I won't repeat steps. You need to have a 1.1.2 4.6 phone for this to work. If you upgraded to 1.1.3, have fun waiting for 1.1.4!

First download this pack, you will need these files. This includes the NEW secpack, a new ieraser, a new testcode.bb, and a new iunlocker.

1. Copy all the files to a directory on your phone. It is imperative you do not shut off the phone after ieraser, or you cannot restore wifi, since the only fls which works on 4.6 is 1.1.3 Install mobileterminal before you begin, in case you lose wi-fi. Also I advise doing this on 1.0.2, since resetting the baseband doesn't cause problems.

2. Run ienew. This is ieraser, and it erases your 1.1.2 firmware to allow the testpoint to work.

3. Find an old 3.9 nor dump and create a file called "nor" with the first 0x20000 bytes of the old nor dump. This is the 3.9 bootloader.

4. Copy "nor" into the folder and run iunew. This is iunlocker and runs just like the old one. You will need the A17 testpoint on before running this. See Step 3 for info on this testpoint. If you restarted and lost wi-fi, it is fine. Just run it from mobileterminal.

Note: "bbupdater -v" shouldn't work at this point, since your phone has no firmware, just a bootloader.

5. The bootloader is now 3.9!!! Run bbupdater -f or restore phone with the AnySimmable firmware of your choice. It seems people are having the most luck with the firmware from 1.1.2

6. Run AnySim and, as usual, enjoy your unlocked iPhone.

PS. Thanks again to TA_Mobile and IMTH. The secpack was the only obstacle to the unlock. And thanks to the girl who pressed the return button while I held the testpoint :)