[LG] How to Developer Unlock, Relock and keep your device Unlocked (Works in Mango!) - Optimus 7 General

For some reason I have never been able to get the LG Optimus E900h to stay unlocked. The registry editers we currently have in our possesion can not edit the needed keys nor can we use provxml because once again it for some reason will not work on our devices.
Here is a 100% way to keep the LG Optimus 7 phone from relocking. Instead of using 3rd party apps we will use the native LG MFG application.
Known Bugs: ChevronWP7 will no longer detect your phone! Not sure why but it doesn't. This shouldn't be a problem considering your phone is unlocked. A factory restore will revert the changes. Also you may not debug with VS2010. Also unsure why.
Notes: Enter everything without quotes, and please be careful. Don't hold me responsible if you screw up your phone.
------------------------------------------------------------------------​
How to Un-Lock your Phone without Chevron 7
You can unlock the phone by using the MFG registry editor.
Open the MFG app and use the password to open it. If you don't know it's (appmfg#*#)
Go to Engineer Menu -> Other Settings -> Edit Registry
Set your ROOT PATH to "HKEY_LOCAL_MACHINE"
Set your input path to "\Comm\Security\LVMod"
Set your input key to "DeveloperUnlockState" and set to DWORD
Hit Query. Output result should return a "0" or a random long number. If it does continue.
Set your input data box to "1" and hit SET. Output result should be 1
How To Keep Your Phone Unlocked
You can keep your phone unlocked and prevent Zune from re-locking it.
Open the MFG app and use the password to open it. If you don't know it's (appmfg#*#)
Go to Engineer Menu -> Other Settings -> Edit Registry
Set your ROOT PATH to "HKEY_LOCAL_MACHINE"
Set your input path to "\Software\Microsoft\DeviceReg"
Set your input key to "PortalUrlProd" and set to DWORD
Hit Query. Output result should return data. If it does continue.
Keep your input data box empty and hit SET. Output result should be 0
Keep this screen open and continue to Part 2
Part 2
Set your ROOT PATH to "HKEY_LOCAL_MACHINE"
Set your input path to "\Software\Microsoft\DeviceReg"
Set your input key to "PortalUrlInt" and set to DWORD
Hit Query. Output result should return data. If it does continue.
Keep your input data box empty and hit SET. Output result should be 0
Backout to the password screen and shutdown the phone via powerbutton.
Reboot and sync. Your phone should stay unlocked.
How to Re-Lock your Phone without Chevron 7
Don't want your phone unlocked anymore? You can re-lock the phone by using the MFG registry editor.
Open the MFG app and use the password to open it. If you don't know it's (appmfg#*#)
Go to Engineer Menu -> Other Settings -> Edit Registry
Set your ROOT PATH to "HKEY_LOCAL_MACHINE"
Set your input path to "\Comm\Security\LVMod"
Set your input key to "DeveloperUnlockState" and set to DWORD
Hit Query. Output result should return a "1". If it does continue.
Set your input data box to "0" and hit SET. Output result should be 0
Your phone is now locked. To Unlock the phone redo the above steps but set back to "1"
How to Re-Set PortalUrlInt and PortalUrlProd Keys
This will allow Zune re-lock your phone as well as being useful for updating.
Open the MFG app and use the password to open it. If you don't know it's (appmfg#*#)
Go to Engineer Menu -> Other Settings -> Edit Registry
Set your ROOT PATH to "HKEY_LOCAL_MACHINE"
Set your input path to "\Software\Microsoft\DeviceReg"
Set your input key to "PortalUrlProd" and set to STRING
Hit Query. Output result should return data. If it does continue.
Set your input data box to "https://developerservices.windowsphone.com/Services/WindowsPhoneRegistration.svc/01/2010" and hit SET.
Keep this screen open and continue to Part 2
Part 2
Set your ROOT PATH to "HKEY_LOCAL_MACHINE"
Set your input path to "\Software\Microsoft\DeviceReg"
Set your input key to "PortalUrlInt" and set to STRING
Hit Query. Output result should return data. If it does continue.
Set your input data box to "https://developerservices.windowsphone-int.com/Services/WindowsPhoneRegistration.svc/01/2010" and hit SET.
Backout to the password screen and shutdown the phone via powerbutton.
Reboot and sync. Your phone should re-lock with every sync.

Works, but this method for unlock must be added because not all the phone have the value 1 on the key DeveloperUnlockState
Set your ROOT PATH to "HKEY_LOCAL_MACHINE"
Set your input path to "\Comm\Security\LVMod"
Set your input key to "DeveloperUnlockState" and set to DWORD
Hit Query. Output result should return a "0". If it does continue.
Set your input data box to "1" and hit SET. Output result should be 1
Your phone is now unlocked.

lorenzo.themax92 said:
Works, but this method for unlock must be added because not all the phone have the value 1 on the key DeveloperUnlockState
Set your ROOT PATH to "HKEY_LOCAL_MACHINE"
Set your input path to "\Comm\Security\LVMod"
Set your input key to "DeveloperUnlockState" and set to DWORD
Hit Query. Output result should return a "0". If it does continue.
Set your input data box to "1" and hit SET. Output result should be 1
Your phone is now unlocked.
Click to expand...
Click to collapse
I do have it as the reversal in the re-lock tutorial but I will add this to the beginning so it's Un-Lock -> Stay-Lock -> Re-Lock

What if your DeveloperUnlockState Key returns data instead of 0 at the first step?
Edit: Never mind, I figured it out. Interestingly enough, the "data" given by both keys were the same, and they were different between two phones (both Optimus 7) that my colleage and I own.
The above procedure works regardless. Syncing with Zune does not relock either. Amazing what you can do without using Chevron. I wonder if this method will remain functional after NoDo update.
Here is the method to remove the 10 app limit for sideloading. Please take note as it uses a different value than the regular method used for other phones.
[HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg\ Install]
"MaxUnsignedApp"=dword:2147483647
The number is the decimal value for the actually needed key 7FFFFFFF. The Registry editor in MFG app does not accept Hex keys, and if you use the 7FFFFFFF value, it will set it to zero, and WILL prevent you from sideloading ANY apps. This requires a restart after setting the value.

i follow instruction above, and yes... its work...
i can install xap file now...
thanks...

kapanak said:
What if your DeveloperUnlockState Key returns data instead of 0 at the first step?
Edit: Never mind, I figured it out. Interestingly enough, the "data" given by both keys were the same, and they were different between two phones (both Optimus 7) that my colleage and I own.
The above procedure works regardless. Syncing with Zune does not relock either. Amazing what you can do without using Chevron. I wonder if this method will remain functional after NoDo update.
Click to expand...
Click to collapse
Its possible. It depends if the update blocks the cert itself from working. If that's the case ae need to find another cert exploit since were not reliant on chevron.

True. Right now this method relies on the actual Microsoft certificate from their servers.

Thanks for the instructions! This gives me some hope of keeping the homebrew apps after the update.
It's good to be a Optimus 7 owner.

hello all,
i have a problem unlocking my optimus 7. i followed the instructions but at the end i do not get '0" as result. instead i get as result "DeveloperUnlockState" = 1081214720.
and now i dont know what to do next. am i doing something wrong?
thank you in advance

senorchocolate said:
hello all,
i have a problem unlocking my optimus 7. i followed the instructions but at the end i do not get '0" as result. instead i get as result "DeveloperUnlockState" = 1081214720.
and now i dont know what to do next. am i doing something wrong?
thank you in advance
Click to expand...
Click to collapse
Are you running at the stock OS. Also have you unlocked your phone before?

senorchocolate said:
hello all,
i have a problem unlocking my optimus 7. i followed the instructions but at the end i do not get '0" as result. instead i get as result "DeveloperUnlockState" = 1081214720.
and now i dont know what to do next. am i doing something wrong?
thank you in advance
Click to expand...
Click to collapse
I had a similar result. You are getting back data...
Just leave the field empty, and press set. Now you should see 0. Then set it to 1. It works. Third post down, I had a similar problem, and now it works...

airwa1kin7 said:
For some reason I have never been able to get the LG Optimus E900h to stay unlocked. The registry editers we currently have in our possesion can not edit the needed keys nor can we use provxml because once again it for some reason will not work on our devices.
Here is a 100% way to keep the LG Optimus 7 phone from relocking. Instead of using 3rd party apps we will use the native LG MFG application.
Known Bugs: ChevronWP7 will no longer detect your phone! Not sure why but it doesn't. This shouldn't be a problem considering your phone is unlocked. A factory restore will revert the changes.
Notes: Enter everything without quotes, and please be careful. Don't hold me responsible if you screw up your phone.
------------------------------------------------------------------------​
How to Un-Lock your Phone without Chevron 7
You can unlock the phone by using the MFG registry editor.
Open the MFG app and use the password to open it. If you don't know it's (appmfg#*#)
Go to Engineer Menu -> Other Settings -> Edit Registry
Set your ROOT PATH to "HKEY_LOCAL_MACHINE"
Set your input path to "\Comm\Security\LVMod"
Set your input key to "DeveloperUnlockState" and set to DWORD
Hit Query. Output result should return a "0". If it does continue.
Set your input data box to "1" and hit SET. Output result should be 1
How To Keep Your Phone Unlocked
You can keep your phone unlocked and prevent Zune from re-locking it.
Open the MFG app and use the password to open it. If you don't know it's (appmfg#*#)
Go to Engineer Menu -> Other Settings -> Edit Registry
Set your ROOT PATH to "HKEY_LOCAL_MACHINE"
Set your input path to "\Software\Microsoft\DeviceReg"
Set your input key to "PortalUrlProd" and set to DWORD
Hit Query. Output result should return data. If it does continue.
Keep your input data box empty and hit SET. Output result should be 0
Keep this screen open and continue to Part 2
Part 2
Set your ROOT PATH to "HKEY_LOCAL_MACHINE"
Set your input path to "\Software\Microsoft\DeviceReg"
Set your input key to "PortalUrlInt" and set to DWORD
Hit Query. Output result should return data. If it does continue.
Keep your input data box empty and hit SET. Output result should be 0
Backout to the password screen and shutdown the phone via powerbutton.
Reboot and sync. Your phone should stay unlocked.
How to Re-Lock your Phone without Chevron 7
Don't want your phone unlocked anymore? You can re-lock the phone by using the MFG registry editor.
Open the MFG app and use the password to open it. If you don't know it's (appmfg#*#)
Go to Engineer Menu -> Other Settings -> Edit Registry
Set your ROOT PATH to "HKEY_LOCAL_MACHINE"
Set your input path to "\Comm\Security\LVMod"
Set your input key to "DeveloperUnlockState" and set to DWORD
Hit Query. Output result should return a "1". If it does continue.
Set your input data box to "0" and hit SET. Output result should be 0
Your phone is now locked. To Unlock the phone redo the above steps but set back to "1"
Click to expand...
Click to collapse
- HKEY_LOCAL_MACHINE\Comm\Security\LVMod
DWORD: DeveloperUnlockState [1]
- HKEY_LOCAL_MACHINE\Software\Microsoft\DeviceReg
DWORD: PortalUrlProd [0]
DWORD: PortalUrlInt [0]
It's OK?
Now i launch Microsoft Application Deployement and i have one Error:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Where´s my problem?

Have you attempted a battery pull? Then re-sync with Zune and then launch APP DEPLOY. I don't have a problem using it and deploy apps all the time.

airwa1kin7 said:
Have you attempted a battery pull? Then re-sync with Zune and then launch APP DEPLOY. I don't have a problem using it and deploy apps all the time.
Click to expand...
Click to collapse
Not works for me!

Jailbreack a sim locked LG Optimus 7
Hi guys,
I have an Optimus7 and I love it, but I can`t jailbreak it...
I understand till now we don`t have a sim unlock here, but, if it is sim locked can I jailbrake this phone like an iPhone? I read this forum and I didn`t find a clear answer to this question.
I`ve done all steps from here, I obtain the results noted here, but can`t deploy any .xap aplication. What else can I do?
How can I check if my phone is dev unlock or not?
Thanks!

Does this still work after the NoDo update? Specifically, assume the NoDo update has been applied without ChevronWP7 and the device is not developer unlocked. Would this work?

no chevron unlock still working?
sorry, double post.....

Actually, if you apply all three registry edits to your phone, then after NoDo update, the unlock is RETAINED, as in you won't have to unlock it again, and all your homebrew apps are also backed up and kept...
Which makes the update extremely smooth and awesome...just did it on my phone, and I can confirm app deployment, without any extra registry edits.

kapanak said:
Actually, if you apply all three registry edits to your phone, then after NoDo update, the unlock is RETAINED, as in you won't have to unlock it again, and all your homebrew apps are also backed up and kept...
Which makes the update extremely smooth and awesome...just did it on my phone, and I can confirm app deployment, without any extra registry edits.
Click to expand...
Click to collapse
thanks, I understand that if I have an unlocked phone and do nodo update it will retain. my question is whether this procedure will also work if you have a locked phone, do the nodo update and then do the registry changes.
edit: Ha, just tried this and it works after nodo without having nodo before update, !!

Developer Unlock on LG phones works without Chevron after NoDo!
sorry for multiple posts, but this is very exciting!
Note that I have not touched my phone with any hacks before the NoDo update. I applied airwa1kin7's procedure after NoDo and was able to developer unlock it.
Registry settings stick after syncing and all apps and side loading work. I have not touched Chevron or any other hacking before the NoDo. This is at least a solution for LG phones.
thanks to airwa1kin7s !

Related

Ignoring certifications

Is there a way via registry editing or otherwise to set up a device to ignore the requirement to have certified dll's and executables.
This would be temporary just for trying out programs extracted from other roms without having to worry about certifying everything just to see if it works.
Thanks
the policies that control this can be viewed here:
http://msdn.microsoft.com/library/d.../wce51conwindowsmobiledevicesecuritymodel.asp
the "unsigned applications policy" should already be 1.
change the "Unsigned Prompt Policy" to 1 also. I.e. change the following registry entry to 1.
HKLM\Security\Policies\Policies\101a
Note that the web page says that this policy is 4122, but 4122 is 101a in hex.
You may also want to set "unsigned cabs" to 16
(HKLM\Security\Policies\Policies\1005 to 16)
Also, this will not work for drivers that are loaded during booting. I'm pretty sure they must be signed. It's not that difficult to create a certificate, install it on your device, then sign the driver dll so it will work.
you can also change this using the "SecurityPolicy Configuration Service" see
http://msdn.microsoft.com/library/d...lesdk5/html/wce51samsettingsecuritypolicy.asp
Thanks a bunch! good info.

Root menu access to Diagnostic version (.1122)

SO I upgraded to nodo and had to hard rest. I updated my phone with official nodo release for At&t. I did ##634# and it would not download the previous version of the diagnostic program; only the new version that does not let you get to the root menu. I have a work around for the moment with the new version of the diagnostic program version (.1122)
in the new diagnostic program type *#32489# after that you can use the back button on screen three times and you are at the root menu of the diagnostic program. Maybe someone might be able to find a direct input number but for now this is to my knowledge the only way.
Update- All other updates and codes are in conjunction with the diagnosis codes thread.
when trying to access audio menu type in the following, since its a slightly different code than the previous version.
Increase your default volume.
*#0002*28345#
Click Get under the Device Gain (max/min)
In the first box keep the number 7
In the second box put 16000
In the third box put 0
Click Set
Click Start
Click the home button.
Restart your phone. To verify the setting took click the get button and it should show your values.

[WP7] Changing language with registry edit (WP7 Root Tools)

Hi all,
I have found the following instruction all over the net:
Instructions:
1. First you need to roll back to the Nodo update.
2. Once in Nodo you are free to edit your phone’s registry values. Go to the registry editor.
3. Now, in the “Key” field enter this path
HKEY_LOCAL_MACHINE\MUI\Available
4. Then, set the “Name” field to the number of your desired language as provided in the list below.
5. The “value type” should be left as it is, and enter the name of your chosen language in the “Value” field.
6. Lastly, now you can upgrade back to Mango.
The Hack should work with every language as some reported that they have successfully hits Japanese and some other languages in their WP7 devices. So it is not too risky to try right? You can check the language number below, enjoy.
Click to expand...
Click to collapse
However this instruction does not work on any of my WP7 devices (no matter what version OS i run either). Since all of the instructions i found are underpinned with 'should work with any language' i would like to know if anyone actually has been able to get this thing to work.
In my case i am trying to change the 'display language' to Dutch.

[HowTo] [VZW XT907/926 RAZR M/HD] Unlock US GSM Carriers Using RadioComm

Introduction:
This post is a guide to show how to perform the NV edit required to unlock US GSM carriers(AT&T and T-Mobile etc.) on the VZW XT907/926 RAZR M/HD stock modem using a Motorola serviceware tool called RadioComm.
This is simply a different method to perform the same hack that was discovered by Arnold Snarb in the main thread about ATT/T-Mobile here.
http://forum.xda-developers.com/showpost.php?p=37123644&postcount=158
Despite the fact that he thanked me for leading the way in that post, he did some really brilliant analysis of the logs in QXDM to isolate this NV Item and saw something in the them that I had missed as well as guessing correctly about it's significance, and deserves all of the credit for this hack.
Everyone should please go and thank him in that post for the outstanding work.
He used a tool called DFS to access and edit NV Item 8322 and change the value of the first byte from 01 to 00 which disables the checking of the MCC/MNC against a list of banned networks and flags MCC 310 as Invalid Country Code.
That method requires booting into BP Tools mode from the boot menu and loading the Qualcomm diagnostic device interfaces.
The problem is that there are no signed 64bit drivers available and you must force load the drivers on Win7/8 64 bit for the diagnostic port in order to see the device properly and have NV read/write access.
This has been a stumbling block for many users and makes the NV editing unnecessarily difficult.
This method uses Factory boot mode and allows RadioComm to have full diagnostic mode access via the Motorola USB Networking driver that loads normally with the standard USB driver set. I will demonstrate 2 different ways to perform the edit, one manual and one using a preconfigured SEEM table file that writes the value in a single operation.
Neither of these methods is as easy as an update.zip install from custom recovery would be, but we don't have a binary that supports the motorola.update_nv function that we used for prior MDM6600 based devices available to us for the MSM8960 devices.
Given that some form of diagnostic mode software and a PC is required, I feel that RadioComm is probably an easier option for most users as it avoids the driver problems and has a clearer and simpler interface for NV read/write access than DFS.
Once you have the latest Motorola drivers installed and RadioComm loaded, this guide should make it very easy and safe to perform what is generally a complicated and potentially dangerous task of editing the radio NVM(Non Volatile Memory).
RadioComm itself is a terrifyingly complex piece of software with a GUI that can bring even the most seasoned and experienced phone hacker to their knees wondering what all the various windows, modules and buttons do.
It is the premier Motorola serviceware application and is designed by and intended for use by top level radio engineers and technicians.
It is an extremely powerful application that can access all models and chipsets of Motorola devices and perform a vast array of diagnostic testing and configuration operations and can be fully automated via multiple scripting languages.
It's just plain scary and confusing and very dangerous if not taken seriously.
Warning and disclaimer:
DO NOT PLAY AROUND WITH ANY FEATURES OR RANDOMLY HIT ANY BUTTONS IN RADIOCOMM!!!
YOU CAN RENDER YOUR PHONE DYSFUNCTIONAL OR UNBOOTABLE IN SECONDS!!!
This cannot be emphasized strongly enough!
Follow the instructions exactly as they are written and shown in the screenshots and you will find it very simple to use have no trouble doing the edit with either method.
You, the user, are the only person responsible for your actions and performing this hack will absolutely void your warranty the same way rooting or any other modifications to your device's software does!
That said, this hack will be undetectable and have no outward visible signs of having been performed other than the fact that any GSM SIM should work afterward.
Root is NOT required and this can be safely done and undone at will without making any other changes on the device and all normal services function properly on VZW's network with the edit in place. It appears to only affect the US GSM network block and nothing else.
Prerequisites:
You need to have a recent set of Motorola USB drivers v. 5.9.0 or greater installed on your PC with a full USB 2.0 compatible port.
You need a standard Motorola micro USB cable.
RadioComm 11.12.xx I have included a link to 11.12.2 below.
https://dl.dropbox.com/u/7632904/RadioComm_v11.12.2_Install.zip
This has been tested on Win7 64bit and WinXP SP3 32bit with .NET Framework 4.0 installed.
Method:
This guide assumes you already have RadioComm and the drivers properly installed and have rebooted both PC and the phone afterward.
The first instructions and screenshots describe the initial setup and manual method using the FTM Common 1 tab and the NV Access window in RadioComm.
When you first open RadioComm you will get a popup stating that the version is more than 2 months old. Just close it and continue.
Now go to the top left corner and hit the Main button and select the MA: Common/MDM6x00 as shown in the first screenshot.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Next, go to Settings/USB and select PST USB Driver as shown in the second screenshot.
Test Command Format should default to P2K05 lower in Setings menu.
Leave all other options default.
Now we are ready to connect the phone and perform the edit.
Make sure you have Connect as Media Device in USB settings and USB Debugging enabled in Developer Options.
Power off the phone and then hold both Vol Up and Down + Power to enter the boot menu.
Use the Vol Down key to scroll down in the menu to Factory and then Vol Up key to select and the phone will boot.
Connect the USB cable and RadioComm will enumerate the phone and the radio button in the top right will change colors.
It will cycle sever times red to yellow and eventually go green when the device is fully enumerated and shows as XT907 in the status bar
at the bottom of the screen. You can read the Software Version and MEID/ESN/pESN buttons to make sure everything is working properly.
Each successful read the GUI will flash green and the Command buffer will turn green and any selected button will be green.
Any unsuccessful attempt will turn red.
If not, then restart everything and check over all settings again before proceeding.
Now go to the tabs bar across the top middle of the GUI and select FTM Common 1 tab and go to the NV access window in the center right of that tab and select the top menu Item "FFFF Manual Entry" as shown in the third screenshot.
Now hit the Read button and you will get 2 popup windows.
In the first window you will enter the Decimal NV Item ID 8322 and in the second you will enter the byte length to be read 1 as shown in the fourth screenshot.
When you hit ok it will read the NV Item and flash green and display the data in the hex output buffer below and you will see 01 for the value as shown in the fifth screen shot.
Now highlight the 01 and change it to 00 and hit the write button and this time it will only popup once asking for the Decimal NV Item ID 8322. When you hit OK the item will be written and the GUI will again flash green for a successful write as shown in the sixth screenshot.
You are now finished and can either use the restart button at top right of RadioComm to reboot or manually restart the phone.
The last screen shot is edited to show the steps to use the NV/SEEM feature with a SEEM table file I have provided below to do all of the steps as a single operation. Some users may find this easier than manually editing in the NV Access window but it's really almost the same number of steps.
Go to the top left and hit Features and select NV/SEEM and another window will open and the radio button will cycle again a couple time as it re enumerates the device again it will go green finally. Follow the instructions in the seventh screenshot and be sure to use the Restart button in the main window after you close NV/SEEM because its suspends the phone and it will be black screen and unresponsive and require holding Vol keys and Power for 10 secs to reset it otherwise.
Congrats! All done now and the rest is just putting in a SIM and selecting GSM/UMTS in Network Settings and everything should just work!
Below is the link for the .NVM SEEM table file.
https://dl.dropbox.com/u/7632904/TBH_RAZR_M_GSM_Unlock.NVM
Please use this thread to discuss issues relating to this method and RadioComm and keep general discussion of the phone on US carriers in the other thread, thank you!
<Reserved>
Thanks man.. gonna try this when I get home tonight. I was actually just thinking about switching vendors from VZW to someone else and didn't really want to buy a new phone.
Maybe now I don't have to. Proof is in the pudding though, maybe I'll by a cheap month of Straight Talk to see if it works?
Yehudah said:
Thanks man.. gonna try this when I get home tonight. I was actually just thinking about switching vendors from VZW to someone else and didn't really want to buy a new phone.
Maybe now I don't have to. Proof is in the pudding though, maybe I'll by a cheap month of Straight Talk to see if it works?
Click to expand...
Click to collapse
Running RAZR M in US on straight talk now. Works wonderful!!!
Thanks a lot! im a total noob when it comes to most of this, but it worked perfect for me!!
Hmm, MDM6x00? Won't that work on the OG RAZR XT912 / Droid 4 as well?
Skrilax_CZ said:
Hmm, MDM6x00? Won't that work on the OG RAZR XT912 / Droid 4 as well?
Click to expand...
Click to collapse
The MA used in RadioComm is the same chip set base as the RAZR/D4 because it's the closest to the MSM8960 available in this version, which is more than 18 months old now.
What we really need is an updated version of RadioComm with full support for the newer chip sets.
This specific NV Item 8322 does not exist on the MDM6600 chip set devices and I have not been able to find a similar boolean switch item for those phones, unfortunately.
I have been logging with QXDM extensively searching for a way to disable the MCC/MNC block on MDM6600 without success so far.
I have dumps of all of the readable NV items from 0000-12000 from many devices running various builds and even a dump from Chinese engineering build on P3Droid's Dev model where everything is working as it should with open GSM on US carriers.
I would love some help from someone with a better understanding of the radio and diagnostic mode access than myself.
Very few people know how to use the software to even start analyzing the problem.
Remember to install the latest Motorola drivers and *especially* highlight the entire 01 and type 00. I was backspacing only the 1 and it did not "stick" when writing. So HIGHLIGHT, don't backspace. Works perfectly.
is it possible to write the NV item to the Droid 4 then edit ? ?
cellzealot said:
The MA used in RadioComm is the same chip set base as the RAZR/D4 because it's the closest to the MSM8960 available in this version, which is more than 18 months old now.
What we really need is an updated version of RadioComm with full support for the newer chip sets.
This specific NV Item 8322 does not exist on the MDM6600 chip set devices and I have not been able to find a similar boolean switch item for those phones, unfortunately.
I have been logging with QXDM extensively searching for a way to disable the MCC/MNC block on MDM6600 without success so far.
I have dumps of all of the readable NV items from 0000-12000 from many devices running various builds and even a dump from Chinese engineering build on P3Droid's Dev model where everything is working as it should with open GSM on US carriers.
I would love some help from someone with a better understanding of the radio and diagnostic mode access than myself.
Very few people know how to use the software to even start analyzing the problem.
Click to expand...
Click to collapse
Can I use a similar way to unlock XT902(Japanese Razr M)? I can't find 8322 in XT902.......
Followed instructions and worked perfectly. The key for me was the latest Motorola drivers AND the Motorola USB cable that came with the phone. I tried other cables that both charged and synced but the only that worked for this was the Moto cable. Using Win XP SP3 ( 12 year old OS on brand new work laptop. WTF!)
i was wondering if this works on other networks such as boost mobile,net10, criket etc...? i honestly dont have enough money to buy a new phone and whatnot. the whole reason why i did this is because i lost my job and now i cant pay my phone bill and it keeps getting higher and higher.
AKG0214 said:
i was wondering if this works on other networks such as boost mobile,net10, criket etc...? i honestly dont have enough money to buy a new phone and whatnot. the whole reason why i did this is because i lost my job and now i cant pay my phone bill and it keeps getting higher and higher.
Click to expand...
Click to collapse
Boost - No
Cricket - No
They're both cdma. This is to allow the GSM side (SIM CARD based) of the phone to work on other carriers. With that said, your best options are
Net10, Straight Talk, ATT, T-Mobile, Simple Mobile, H20, Orange, and there's a plethora of others out there. Post paid and pre-paid.
@DSDD
I beleive your XT902 is GSM by default. So if what your asking is will this bypass the network lock, no, the device needs to be unlocked by code. Then you can use it outside of the current carrier/country.
after boot, it is set back to 01 again @ address 8322
my phone version is Bsmq_vzw-user 4.1.1 9.8.1Q_27-2 4 release-keysSM_BP_1139.000.32.62P
after write to 8322 with zeros, I read it again the confirm it is written, but after rebooting the phone, the value is back to 01 again.
I guess the verizon driver may override this value during rebooting?
any help?
should I root the phone?
==
thanks
cellzealot said:
Introduction:
This post is a guide to show how to perform the NV edit required to unlock US GSM carriers(AT&T and T-Mobile etc.) on the VZW XT907/926 RAZR M/HD stock modem using a Motorola serviceware tool called RadioComm.
This is simply a different method to perform the same hack that was discovered by Arnold Snarb in the main thread about ATT/T-Mobile here.
http://forum.xda-developers.com/showpost.php?p=37123644&postcount=158
Despite the fact that he thanked me for leading the way in that post, he did some really brilliant analysis of the logs in QXDM to isolate this NV Item and saw something in the them that I had missed as well as guessing correctly about it's significance, and deserves all of the credit for this hack.
Everyone should please go and thank him in that post for the outstanding work.
He used a tool called DFS to access and edit NV Item 8322 and change the value of the first byte from 01 to 00 which disables the checking of the MCC/MNC against a list of banned networks and flags MCC 310 as Invalid Country Code.
That method requires booting into BP Tools mode from the boot menu and loading the Qualcomm diagnostic device interfaces.
The problem is that there are no signed 64bit drivers available and you must force load the drivers on Win7/8 64 bit for the diagnostic port in order to see the device properly and have NV read/write access.
This has been a stumbling block for many users and makes the NV editing unnecessarily difficult.
This method uses Factory boot mode and allows RadioComm to have full diagnostic mode access via the Motorola USB Networking driver that loads normally with the standard USB driver set. I will demonstrate 2 different ways to perform the edit, one manual and one using a preconfigured SEEM table file that writes the value in a single operation.
Neither of these methods is as easy as an update.zip install from custom recovery would be, but we don't have a binary that supports the motorola.update_nv function that we used for prior MDM6600 based devices available to us for the MSM8960 devices.
Given that some form of diagnostic mode software and a PC is required, I feel that RadioComm is probably an easier option for most users as it avoids the driver problems and has a clearer and simpler interface for NV read/write access than DFS.
Once you have the latest Motorola drivers installed and RadioComm loaded, this guide should make it very easy and safe to perform what is generally a complicated and potentially dangerous task of editing the radio NVM(Non Volatile Memory).
RadioComm itself is a terrifyingly complex piece of software with a GUI that can bring even the most seasoned and experienced phone hacker to their knees wondering what all the various windows, modules and buttons do.
It is the premier Motorola serviceware application and is designed by and intended for use by top level radio engineers and technicians.
It is an extremely powerful application that can access all models and chipsets of Motorola devices and perform a vast array of diagnostic testing and configuration operations and can be fully automated via multiple scripting languages.
It's just plain scary and confusing and very dangerous if not taken seriously.
Warning and disclaimer:
DO NOT PLAY AROUND WITH ANY FEATURES OR RANDOMLY HIT ANY BUTTONS IN RADIOCOMM!!!
YOU CAN RENDER YOUR PHONE DYSFUNCTIONAL OR UNBOOTABLE IN SECONDS!!!
This cannot be emphasized strongly enough!
Follow the instructions exactly as they are written and shown in the screenshots and you will find it very simple to use have no trouble doing the edit with either method.
You, the user, are the only person responsible for your actions and performing this hack will absolutely void your warranty the same way rooting or any other modifications to your device's software does!
That said, this hack will be undetectable and have no outward visible signs of having been performed other than the fact that any GSM SIM should work afterward.
Root is NOT required and this can be safely done and undone at will without making any other changes on the device and all normal services function properly on VZW's network with the edit in place. It appears to only affect the US GSM network block and nothing else.
Prerequisites:
You need to have a recent set of Motorola USB drivers v. 5.9.0 or greater installed on your PC with a full USB 2.0 compatible port.
You need a standard Motorola micro USB cable.
RadioComm 11.12.xx I have included a link to 11.12.2 below.
https://dl.dropbox.com/u/7632904/RadioComm_v11.12.2_Install.zip
This has been tested on Win7 64bit and WinXP SP3 32bit with .NET Framework 4.0 installed.
Method:
This guide assumes you already have RadioComm and the drivers properly installed and have rebooted both PC and the phone afterward.
The first instructions and screenshots describe the initial setup and manual method using the FTM Common 1 tab and the NV Access window in RadioComm.
When you first open RadioComm you will get a popup stating that the version is more than 2 months old. Just close it and continue.
Now go to the top left corner and hit the Main button and select the MA: Common/MDM6x00 as shown in the first screenshot.
Next, go to Settings/USB and select PST USB Driver as shown in the second screenshot.
Test Command Format should default to P2K05 lower in Setings menu.
Leave all other options default.
Now we are ready to connect the phone and perform the edit.
Make sure you have Connect as Media Device in USB settings and USB Debugging enabled in Developer Options.
Power off the phone and then hold both Vol Up and Down + Power to enter the boot menu.
Use the Vol Down key to scroll down in the menu to Factory and then Vol Up key to select and the phone will boot.
Connect the USB cable and RadioComm will enumerate the phone and the radio button in the top right will change colors.
It will cycle sever times red to yellow and eventually go green when the device is fully enumerated and shows as XT907 in the status bar
at the bottom of the screen. You can read the Software Version and MEID/ESN/pESN buttons to make sure everything is working properly.
Each successful read the GUI will flash green and the Command buffer will turn green and any selected button will be green.
Any unsuccessful attempt will turn red.
If not, then restart everything and check over all settings again before proceeding.
Now go to the tabs bar across the top middle of the GUI and select FTM Common 1 tab and go to the NV access window in the center right of that tab and select the top menu Item "FFFF Manual Entry" as shown in the third screenshot.
Now hit the Read button and you will get 2 popup windows.
In the first window you will enter the Decimal NV Item ID 8322 and in the second you will enter the byte length to be read 1 as shown in the fourth screenshot.
When you hit ok it will read the NV Item and flash green and display the data in the hex output buffer below and you will see 01 for the value as shown in the fifth screen shot.
Now highlight the 01 and change it to 00 and hit the write button and this time it will only popup once asking for the Decimal NV Item ID 8322. When you hit OK the item will be written and the GUI will again flash green for a successful write as shown in the sixth screenshot.
You are now finished and can either use the restart button at top right of RadioComm to reboot or manually restart the phone.
The last screen shot is edited to show the steps to use the NV/SEEM feature with a SEEM table file I have provided below to do all of the steps as a single operation. Some users may find this easier than manually editing in the NV Access window but it's really almost the same number of steps.
Go to the top left and hit Features and select NV/SEEM and another window will open and the radio button will cycle again a couple time as it re enumerates the device again it will go green finally. Follow the instructions in the seventh screenshot and be sure to use the Restart button in the main window after you close NV/SEEM because its suspends the phone and it will be black screen and unresponsive and require holding Vol keys and Power for 10 secs to reset it otherwise.
Congrats! All done now and the rest is just putting in a SIM and selecting GSM/UMTS in Network Settings and everything should just work!
Below is the link for the .NVM SEEM table file.
https://dl.dropbox.com/u/7632904/TBH_RAZR_M_GSM_Unlock.NVM
Please use this thread to discuss issues relating to this method and RadioComm and keep general discussion of the phone on US carriers in the other thread, thank you!
Click to expand...
Click to collapse
---------- Post added at 11:14 PM ---------- Previous post was at 10:48 PM ----------
tried again for couple of times, this time it actually works.
maybe last time I reboot the phone too early?
sipida said:
my phone version is Bsmq_vzw-user 4.1.1 9.8.1Q_27-2 4 release-keysSM_BP_1139.000.32.62P
after write to 8322 with zeros, I read it again the confirm it is written, but after rebooting the phone, the value is back to 01 again.
I guess the verizon driver may override this value during rebooting?
any help?
should I root the phone?
==
thanks
Click to expand...
Click to collapse
Glad you got it working. There is no VZW software on the phone capable of writing to the radio NV, so it's not being reverted by anything.
If anyone else has similar issues I would suggest trying the NV/SEEM method as that will definitely write the item properly.
queberican351 said:
@DSDD
I beleive your XT902 is GSM by default. So if what your asking is will this bypass the network lock, no, the device needs to be unlocked by code. Then you can use it outside of the current carrier/country.
Click to expand...
Click to collapse
XT902 has sim lock, and there is no way to key in unlock code. So I think it maybe unlocked by modifying another NV item.
Does this tutorial unlock mobile data usage on other carriers. I cannot seem to get data working on my XT907 in Australia. GSM and MMS work fine, so why doesnt Data?
I don't know for certain because I only have experience with domestic US GSM carriers, but I tend to doubt it.
You can try it and see and revert it easily if it doesn't work. You can also try flashing the Telstra XT905 NON-HLOS.bin(modem) and fsg.mbn(carrierEFS/NVM config).
This was the method used to get US GSM service on XT907 before the method shown here was discovered.
It works but is limited to GSM/EDGE data services here in the US.
I am inclined to think it is some other problem with the device because it should work as a global capable phone by default.
dsdd said:
XT902 has sim lock, and there is no way to key in unlock code. So I think it maybe unlocked by modifying another NV item.
Click to expand...
Click to collapse
If it has a sim lock and you can acquire the code open your dialer and press #073887* (#0SETUP*) and it'll prompt you for the code.
Several people have PMd me questions about this method and I would much prefer that they be posted here in the thread so that everyone may benefit from the information.
Please include as much information about your PC and driver versions and be as thorough as possible in explaining your problems.

Honor 9i Tips&Tricks

How to get maximum out of this smartphone
Sleep and wake without using power button
Because Double Tap functions are disabled FOR NOW and because unlocking bootloader in order to root will be registered by Huawei/Honor and will make you pay more in case of assistance, here is a way to ease the use of power button and have a WANNABE sleep&wake double tap function on this phone.
First you must enable and register Fingerprint ID from Setting. Then go to Fingerprint management, insert PIN (if any) then activate Unlock screen. This way you'll have the unlock screen option by finger print.
In order to put to sleep you must install a Fingerprint gesture app, like this one
https://play.google.com/store/apps/details?id=com.ztc1997.fingerprint2sleep
From this app enable the Single tap action to Sleep. Thus you'll have the Sleep option by fingerprint.
Why not installing a Double Tap or Screen on/off application? Because I haven't found any that works. Most of them apply a dark filter over the screen thus consuming more battery.
Please let me know your ways of putting to sleep and waking up the phone.
Hello
I also tried to search for a method, but I did not succeed.
I went to built.prop, to modify and activate as for emui 5.0.1.
this in phone settings, worked it is written but does not work.
if I put the phone in sleep and I tap tap, it does not wake up, it bug the screen remains frozen on the lock screen.
I must force the restart.
I continue the search.
Chisetdel31260 said:
Hello
I also tried to search for a method, but I did not succeed.
I went to built.prop, to modify and activate as for emui 5.0.1.
this in phone settings, worked it is written but does not work.
if I put the phone in sleep and I tap tap, it does not wake up, it bug the screen remains frozen on the lock screen.
I must force the restart.
I continue the search.
Click to expand...
Click to collapse
What's the modify you've made?
As far as I've read this is a two steps procedure. The first one is to root and SuperSU and modify build.prop and the second part is to activate it from the settings, where a new option will appear and you modify build.prop and rebooted phone.
Will put link later.
BigBadSheep said:
What's the modify you've made?
As far as I've read this is a two steps procedure. The first one is to root and SuperSU and modify build.prop and the second part is to activate it from the settings, where a new option will appear and you modify build.prop and rebooted phone.
Will put link later.
Click to expand...
Click to collapse
Hello
I tested that. but did not work. (bug on the start screen.)
et oui mon téléphone est root. sr5-supersu
et j'utilise root browser+buxybox,
Go to system / build.prop
Add this line: ro.config.hw_easywakeup = true
Go to product / etc / prop / local.prop
Find ro.config.hw_easywakeup = false and change it to true
Go to system / emui / base / xml
Find hw_easywakeupmotion_config.xml
Find this line: EasyWakeupMotion name = "Double_Touch" support = "1" value = "0" flag = "0" keycode = "131" "
Change to value = "1"
Chisetdel31260 said:
Hello
I tested that. but did not work. (bug on the start screen.)
et oui mon téléphone est root. sr5-supersu
et j'utilise root browser+buxybox,
Go to system / build.prop
Add this line: ro.config.hw_easywakeup = true
Go to product / etc / prop / local.prop
Find ro.config.hw_easywakeup = false and change it to true
Go to system / emui / base / xml
Find hw_easywakeupmotion_config.xml
Find this line: EasyWakeupMotion name = "Double_Touch" support = "1" value = "0" flag = "0" keycode = "131" "
Change to value = "1"
Click to expand...
Click to collapse
Looks OK. After that have you enabled Double tap from Settings –> Smart Assistance –> Motion Control?
This feature might not be available though on al Huawei/Honor devices, even after root and modification.

Categories

Resources