IPSF does not change or patch things in baseband firmware, only temporary to put their patch in the nvram - some parts of IPSF software are not necessary steps to their unlock, maybe just obfuscation and distraction for reversers - when you run their app, a chunk of nvram is read and uploaded to IPSF server - the chunk is sent back modified where the LOCK is saved - then a custom baseband bootloader is flashed - the chunk is written to nvram by custom baseband bootloader - then they overwrite baseband with the untouched firmware again, original baseband in phone again - that's it.