This message contains all postings in this thread
dated before January 19th 2003
Subject: another XDA SIMLOCK trick
From: Rick
Date: 10 Jan, 2003 10:14:25
Hello people,
I found a variation of the SIMLOCK bypass trick for XDA
mentioned in another thread on this forum.
There is no need to call a un-answering number and wait.
I think it still works only for 3.02 (ENG/GER/whatever).
HOWTO:
1) find a non-existent number you can call. any number that
returns you "the number you dialed is incorrect". For Italy, a
good one is a 4 digit number beginning with 9.
2) have the phone screen active and the non existent number
ready.
3) turn GSM on. When the X disappears, wait 1-2 seconds and then
call the non-existen number.
4) after a while, you will see provider registration, and then a
message saying the number can't be dialed.
5) tap OK, you're hooked to your network!
With this trick, you will neither see the "enter unlock code" or
"application error" message. It works all the time!
BTW, I got my official unlock code from O2... but it does not
work, it just says "invalid password"!!! I am waiting for them
to fix it, in the meantime, I can use my phone...
Let's share the good tricks!!!
Ciao,
Rick
Italy
Subject: Rubbish
From: MADmanFREE
Date: 14 Jan, 2003 18:26:22
This did not work for me at all..
The closest I got was something about changing the number in
Ireland, from the operator... I'm using 3.01 in the uk
If you can clarify that this trick does indeed work in the UK I
would be greatfull...
Subject: Faaantastic
From: Peter
Date: 14 Jan, 2003 23:45:49
30 seconds..........UNLOCKED...........why has it taken me 8
months to do this????
Excelent!!! Thanks for the info.
Pete.
Subject: Worked at last
From: MADmanFREE
Date: 15 Jan, 2003 19:42:28
http://b
oard.dserver.org/e/eitcenter/00000868.html
I found another article describing exactly the same thing.
It worked for me by Just ringing the houseand allowing it to go
on for a few moments. The Sim code request never appeared. And
now I've been using the Vodafone chip in my o2 XDA for 24hrs.
Good luck everybody
Subject: how about for SPV?
From: xDAguy
Date: 16 Jan, 2003 03:45:45
Crazy to buy an SPV phone, but since I live in Asia -would the
trick do the same for the SPV?
/Harry :wink:
Subject: addendum
From: Rick
Date: 17 Jan, 2003 09:51:28
I must add that, when using this trick, you can lose your
provider's signal, go back under coverage, and the phone
recovers just fine, without asking for code
But... who needs this trick, now that the XDA dev team created
the manipulator?
Ciao
Rick
u can also ring somone , and when they answer hang up, but the phone has to atleast ring 4 times. this way also, u dont get that crash msg, which makes the phone more stable.
???
This doesn't work for me. You dont get a chance to dial the number - the enter pin dialog shows up and disconnects GSM before it gets a chance to dial.
Re: ???
Fud said:
This doesn't work for me. You dont get a chance to dial the number - the enter pin dialog shows up and disconnects GSM before it gets a chance to dial.
Click to expand...
Click to collapse
Please use MANIPULATOR !
Great program!
and work very well
Im trying now - soldering a serial cable onto the cradle board is not easy!!!!! :shock:
Soldering Job!
Hmmm connected up as per "wiring diagram" and Manipulator did squat. ActiveSync tried to establish a connection but failed.
I tested pin9 on the XDA and it appears to be a ground! Are you sure that wiring diagram is right or if all XDA's are the same - coz I double checked my end and it's definately a ground???
Re: Soldering Job!
Fud said:
I tested pin9 on the XDA and it appears to be a ground! Are you sure that wiring diagram is right or if all XDA's are the same - coz I double checked my end and it's definately a ground???
Click to expand...
Click to collapse
It could well be at ground level, but it's definitely not a ground. It's RTS. You will probably only need to connect RX, TX and GND if all you want to do is unlock it.
You did tell ActiveSync not to touch the serial port while you were running the Manipulator, right ?
Humble Pie is actually quite nice with cream.
Yeah your right - the 9 pin is not ground and I'm clearly not on ground lvl!
Dunno how but i checked and double checked and my meter was tellin me it was ground. Sorry - I am a worm!!
Anywho, I have turned off ActiveSync - I was just trying to test the connection. I have resoldered the thing and made sure its right but I still cant get it to work. Radio version is 4.06 and bootloader 5.15.
Still no joy
OK I've been on this too long now. I have wired up TX RX and GND as you suggested but still nothing. How long does it take to connect? It just sits on scanning ports.
Somebody on another forum aso had probs with bootloader 5.15? Are there known problems? How do I use a terminal prog to access it? Ive tried Win Hyperterminal to connect but I cant type the commands in (suggesting its not actually connected)
All I need is to unlock to use my Vodafone sim, I might as well go get a O2 sim rather than mess around with the serial cable.
Related
It took a small group effort, but we cracked it.
Problem 1: Bug in limitation to %UREG command
First of all, on 4.20 they check to see whether the %UREG request lies within certain bounds as follows:
AT%UREG?addr,len:
if (addr < 0x3ef000 || addr > 0x3ef007) return(0);
if ((addr+len) < 0x3ef000 || (addr+len) > 0x3ef007) return(0);
Now because addr en len are both 32 bits, we can make use of the wrap (negative in effect). After the test above the maximum length will be limited to 100 (0x64).
So for instance:
AT%UREG?3FE004,FFFFFFFF
will read 100 bytes from 0x3FE004, clearly outside the range UREG was meant to be restricted to.
Problem 2: Obfuscation too easy
When executing the command above: after 74 bytes of FF, the obfuscated result code is displayed. The information needed to get the unlock code is contained twice, in the format ABCDABCDEFGHEFGH if a different letter is assigned to each unique nibble. Nibbles are first swapped to make EHAFGBCD. Then bits 3 of nibbles H, F and B are rotated left, so that nibble H gets bit 3 from F and so forth. After this, the whole 4 byte value is rotated into the lower bit. The result is the 8 digit unlock code in BCD, which can be supplied to the unlock command:
Code:
AT%SIDLCK=0,<8-digit unlock code>
Commentary:
Nice try: took us 2 person-days, probably still less than it took to think up, define, approve and program. :twisted:
The new version of The Manipulator, online now, supports unlocking of Radio Stack 4.20.
Yippee... the manipulator works for 4.20 !!!!!
Hi,
I must be a very lucky guy.
Just received my xda today (64mb ram, 4.20.00 radio version, 3.16.32 ENG rom, dated 2/13/03) and was fiddling with it about half and hour ago with the former xda manipulator program (ver 1.02) which recorded error messages and couldn't work. Then I looked into the net and found this posting just made( at 10.30 pm) and was the number 6 person to view the posting; downloaded the new manipulator and hey presto - the xda is unlocked !!!!
Only one thing though- don't see the gid lock, the imei number and the call timer entries in this new program(ver 1.1) which were present in the ver 1.02 program. Not a problem for me though as long as I could use the phone on my vodaphone sim.
Anyway, thank you so much for the hard work in cracking the 4.20; really appreciate it. Well done and keep up the magnificent work.
Cheers
Yup - it works a treat - unlocked in 10 seconds.
WELL DONE guys - thanks so much for all your input here. I now have an XDA that is truly useful and versatile.
BRILLIANT!!
Rog
Just tried 1.1 on 6 phones, all with 4.20. Five of them unlocked no problem, but one of them, for some strange reason, didnt work, it read the sid code, but the one that it came back with was only 6 digits long, and when pressinng "UNLOCK" nothing more happened. All the other codes were about 8 digits long. I tried entering the code manually, butjust came back saying it wss incorrect!!!
Anyone come across this??
Many thanks in advance
Hmmm. It could be that the code (or the second half of it) starts with two zeroes, and now that you mention it: the manipulator doesn't display (or unock with) leading zeroes.
Could you try that six digit code with two leading zeroes, and (if that doesn't work) inser the zeroes in the six digit number as follows XXXX00XX or as follows 0XXX0XXX. Tell me if that's it, please...
(Expect 1.11 of The Manipulator in the next day or two...
IMEI Change
Great work guys i'll be unlocking my xda as soon as i get the serial cable. It is a combines serial and USB cable so if anyone has experience with this not working (Ordered from Expansys thenlet me know) otherwise i'll post here to let you know if it worked or not.
I would like to know if there are any plans to make a version of the communicator that ill change the imei.
If not will commands from hyperterminal work? (Sorry if this is not currently possible I havn't been motivated to look it all up but will be if it possible to change the IMEI through this.)
I know that ther version of Hyperterminal that come with in 2k and XP is more limited that the one in 95 and 98 so would another terminal emulation program do the job better (Reflections 420 for example).
Thanks again for the great work.
How do you find all this stuff out?? How do I learn.?
Minesh
@Peter Poelman ur a blinking genius mate, it was the last method (0XXX0XXX)
So now ive done 11 phones(R4.20), and all 11 unlocked, pretty good success rate i reckon
Keep up the great work guys
Re: IMEI Change
MineshT said:
I would like to know if there are any plans to make a version of the communicator that ill change the imei.
Click to expand...
Click to collapse
Manipulator (I assume that's what you mean) does change the IMEI, but not on 4.20 phones, because we can't easily reach the memory range. In fact we have ways to do it, but we didn't yet feel like doing the necessary programming work before they lock us out completely.
If not will commands from hyperterminal work?
Click to expand...
Click to collapse
There's no easy (or medium-hard) way to change the IMEI on 4.20 phones.
How do you find all this stuff out?? How do I learn.?
Click to expand...
Click to collapse
In this specific case, we looked at the ARM machine-code in the 4.20 binary contained in S-record form in the RSU upgrade package, using IDA (a disassembler program). We then figured out the %UREG restriction was lacking. Looking at the obfuscated code we figured we could break it without looking at further code (and the phone binary code guru was unavailable for the day), so we cracked it by just staring at enough possibilities. (We could set and reset the lock using different codes with AT%SIDLCK).
Not sure hacking phones is a specific skill one can learn. Even though we're mostly still pretty young, most of us are very experienced software developers, senior security experts. Electronics, programming and reverse-engineering experience of 20-25 years in some cases. But there's pretty good texts out there that describe disassembling other people's code, understanding embedded hardware and other areas of expertise you'd need.
Reverse-engineering needs a lot of the same skills that 'forward-engineering' does. If you have the skills needed to build something, you can begin to take it apart.
Current issues with The Manipulator
The Manipulator currently does not unlock phones which were locked and then user-upgraded to 4.20. So unlock first and then upgrade. Also, please read hotentot's post and my reply above for a problem that appears when the code has zeroes in certain positions.
Both issues will be addressed in the next version, due in a few days, when I know there's no other things that need fixin'.
Hi there guys,
I'm a newbie to Xda and have just bought the XDA1 from a friend.
Everything works fine but i cant make any calls. Tried all types of sims.
I asked the guy i bought it from and he goes that it is "network barred".....what does that mean??
Can i un-bar it?
So far, its only good as a pda.
Anyone know what to do??
Cheers
ok, here some details i've managed to find on the phone.
ROM version: 3.14.13 ENG
ROM date: 10/09/02
Radio version: 4.08
Protocol version: 32s54
As you can see, i have no idea what they mean and have read other posts and they info on them have flown past me.
I dont have a serial cable and the phone is asking for a SID code.
HELP!!
Thanks
If you have tried all types of sim and all networks are barred then a sid code wont help you, it may unlock the phone but you still cant access the networks with a barred phone. There are 2 types of barring, the first is when a service provider locks the phone so you can use it on their network only, the second is when a phone is reported stolen, then it is barred from all networks, the phone transmits a number when switched on, even without a sim inserted, it is this number that is barred in the second scenario, the network sees the number and then closes the door so to speak.
if this is so, can the network track down the phone? or my phone number from the sim. This is cos i've had my sim in the phone and dont really fancy being nicked for doing nothing.
Check your mail box, I have sent you a pm.
If it's asking for a SID code it is just SIMlock. Which means you install the Special Edition ROM and presto.
I think he said he has tried every different sim and still gets nowhere which suggests to me it locked to a provider and also blocked from all networks, surely the phone would be open to at least one of the networks regardless of the sid lock issue.
cruisin-thru said:
I think he said he has tried every different sim and still gets nowhere which suggests to me it locked to a provider and also blocked from all networks, surely the phone would be open to at least one of the networks regardless of the sid lock issue.
Click to expand...
Click to collapse
Maybe, but if it asks for a SID code it may be locked to some obsure network or something. I'd say Special Edition ROM -> unlock first, and then figure out what's going on if that doesn't do it.
Ther you go psychy, click on the link in the previous text, "special edition rom" then click download, then run the program from your pc.
Ok guys,
downloaded the Special Edition ROM....guess what?? IT WORKS!!
thanks for the help guys....much appreciated!
Thing is, the guy i bought it from said it was "network barred"....does it mean my XDA is stolen?? If so, can i get traced? Sholud i carry on using my registered sim on it?
Psychy, if it unlocked ok and is working on a network there is no problem, what confused me is when you said you had tried all types of sim. Enjoy your phone, you can even add a cheap gps system to it and have it talk to you giving directions right to any door in uk, you can watch films, play mp3, surf the web and much more.
OK, I have the new KSE True fax its on my XDAII,
(rom 1.72.00wwe, date 03/15/04, radio 1.17.00, protocol 1337.28, ext rom 1.72.181)
I have spoken to the software company, KSE TrueFax, they say its an o2 fault, (latest version supplied for O2 XDA and alike) and O2 say speak to the software company.
The fax when used switches off the mobile then initiates the modem then dials, then says no carrier detected? and switches off.
Yes I have fax enabled, Yes I have a fax number, I also have a Data number which all worked at the touch of a button on my 9210i and still does.
Can anyone help me, my hair is slowly disappearing in lumps!
Cheers
Trevor
Fax
my fax workes fine, Im currently in Amsterdam on there network and all is good
Faxing problem
:evil:
Well thanks Mario, its nice to know your fax is working fine!
Trev :shock:
Are there any com port settings that need to be changed
Hey
I have exactly the same problem as you and I started asking about it in another thread on here. However it died when the agreed solution was to ensure that fax was enabled on my service by calling up O2. I havent done this yet because im in the process of switching to Orange.
On the other hand you have definitely done this step already since you have a fax/data number and I assume this number is entered in TrueFax settings. Despite this, you still get the same error message as I do which is puzzling and worrying since some people kindly mention they have no problems!
The TrueFax website isnt much help either saying that "no carrier detected" is a very general message that could mean a lot of things, some listed can easily be elminated. One interesting point is how you enter the number to send the fax? Do you just enter 012345678901 or +4412345678901 or +++4412345678901. The help pages seem to indicate that the ++ or +++ and country code is something to check. I had a mess about with different combinations and it didnt work for me, however I probably dont have fax enabled on my service, which ill try to fix when im on Orange, hehe.
Please could anyone find the cause/solution to this problem or offer any fuurther suggestions?
Ash
Faxing problem
Well, after much emailing to KSE, some of the problem is solved.
1, the software switches of the mobile because...........that's the way its designed as its not integrated into the hardware like theNokia 9210i.
This problem will remain untill Mr Gates (Microsoft) allows software houses to fully integrate his and their software into PDA's.
well that's what they tell me anyway.
2, no carrier detected...............several reasons given for this.
a, no fax number
b, no fax number assigned to sim
c, no fax number activated by service provider
d, no data number
e, no data number assigned to sim
f, no data number activated by service provider
Notice that also the latest version of Truefax must have the latest ROM and Extended Rom KSE say.
I have all of this and still nowt!
Returning to Nokia is getting closer....
TREV
Faxing Problem
OK, OK
It now appears the latest software from KSE does not work on XDAII with the latest ROM versions it only works on the XDAIIs.
Does anyone out there have a working program on an XDAII with latest ROM version and of course Ext ROM?
Are you or have you had problems running latest KSE Fax software?
What software are you running does it work ?
Does anyone have an older working copy of KSE Truefax for XDAII ?
Can anyone send me a copy which works ?
[email protected]
Cheers
TJ
Fax
I am runnig an XDAII with the latest ROM and the extra bundle that I picked up from this Site.
When dialing a fax number I include + and the area code and thats it !
I made no changes to the units settings bar a soft reset
Re: Faxing Problem
ukmctc said:
OK, OK
Does anyone have an older working copy of KSE Truefax for XDAII ?
Can anyone send me a copy which works ?
TJ
Click to expand...
Click to collapse
KSE True Fax 2.06 :?: :?:
http://forum.xda-developers.com/viewtopic.php?t=11739
I had the version listed above working on my XDAII before latest ROM upgrade.
After latest upgrade with latest version, it worked straight away after hard reset. Haven't changed any settings at all.
Got it on my MDAIII as well and works fine on that too.
Well the sagacontinues.
NO I don't have a working fax and have tried 2.06 too, the only thing that happened was the first fax it tried to send it asked for the first time what modem I would be using, then did the usual...................NO CARRIER DETECTED!
Yep I have been onto o2 and the usual YES its all on!
I have discovered though O2 have a massive problem at the mo, going back some 6 weeks, their system has packed up and things are not going well with the new installed system.........people are being billed for calls not made! and some are not being billed at all, so those of you on o2 keep an eye on bills etc;
Ah well, suppose its back to my faxing problem....thinking of changing to Vodaphone network.
Fixed It!
Hey
Well I must reccommend to ukmctc to do it and make the switch. I have just changed from O2 to Orange and not only does everything such as GPRS, WAP, MMS all work as before (I had to input new settings), faxing now works without a problem.
On O2 I simply could not get faxing to work and always got 'no carrier detected'. It made me wonder if the people saying it work ed for them were real or not.... :lol: :lol: :lol:
One thing I have ensured I do, and I dont know if it makes a difference is to prefix all numbers in TrueFax with +44 and omit the first 0, including the space where you input your own fax number. This means correcting the provided number when you're using the built-in contacts list to select a number too.
Good luck to everyone thats still having problems, maybe switching network is the solution! :idea: If anyone wants to grill me about the settings I use, please ask away. I am using KSE TrueFax 2.08 as supplied in O2's appsuite.
Ash
Faxing Problem resolved!
8)
Yes resolved it was easy to do!, you won't believe how easy......
Put my sim back into my Nokia 9210i and it works perfectly, I can now send receive faxes while receiving or making a voice call or surfing the net.
I'm so happy I could..sit!
Looks like the new toy isn't as good as the old one.
Guys, I got a HUGE problem.
I got my new Qtek S100, magician the other day with:
WM2003SE
ROM Version: 1,11,00 WWE
Radio Version: 1,11,00
Protocol version: 1337,42
ExtROM Version: 1,11,133 WWE
Model NO: PM10A
The phone works great as a PDA....but I cant get any service at all!
1. I did try Itsme's unlock tool (not pinlocked SIM in it, that is, I unlocked the sim card, then tried it) it said that it unlocked the phone OK.
2. Tried to reinstall the ROM, no difference.
3. I went to Settings---Phone--Network
Tried to "Find Network" = Nothing
Tried "Set Networks" = Gives me this message;
"Unable to read setting from the network. Try viewing settings later, or disconnect data connection and try again".
No USB or BT connection is established with a PC at the moment.
Please advise, and help!!
Thanks a bunch,
Monty
Sure you're not in flight mode?
V
Yeah Im not.
btw, vija as in vija who developed smart401?
Any other ideas by the way?
What country are you in? Sure you're using the right radio type/band/ROM?
V
Yeah, I downloaded the swedish Qtek ROM (yeah Im in Sweden alright)
However, I tested with a diff. simcard from a diff. provider, that one gets signal but I cant make any calls, they just end abruptly.
Again, I used the unlock tool from itsme, and my device is listed so I really dont know whats wrong...
your mini might be Blocked (not locked) by your provider.
the network won't allow your imei on the network and when you use the other sim (it should be using only high bands 1800/1900) so it can't set to lock the whole network system bec sms and radio transmit at different freq) so you can get signal, send and receive sms but can't make calls.
just try this to confirm, plug in the sim that can make sms and search networks, if you can see all the networks available then I think it is blocked.
this is only what I know after some research but I may be wrong, hope this give you some help
Hi,
Yeah, when I put in the other SIM card, and I search for networks, it finds all of them.
Thing is, its brand new, but I bought it from a private person from the Internet (from a similar site to Ebay) guess this one didn't come with a reciept eh
Guess it wont do to just change the IMEI # then? I read somewhere that you could change it. Oh well, guess I'll return it to the seller then and get a new one.....
montana said:
Hi,
Yeah, when I put in the other SIM card, and I search for networks, it finds all of them.
Thing is, its brand new, but I bought it from a private person from the Internet (from a similar site to Ebay) guess this one didn't come with a reciept eh
Guess it wont do to just change the IMEI # then? I read somewhere that you could change it. Oh well, guess I'll return it to the seller then and get a new one.....
Click to expand...
Click to collapse
so it works like I describe? then it is BLOCKED by the order of NTC
XDA can change IMEI as it is hard burned on the ROM, good luck
[quote="DON2003
XDA can change IMEI as it is hard burned on the ROM, good luck[/quote]
can change IMEI? really?how to change?i also have a prob, when i softreset my mini,must wait almost 10 or 15 mins,then can find network?i already flash a few diffrent rom but still same.
bbcba said:
[quote="DON2003
XDA can change IMEI as it is hard burned on the ROM, good luck
Click to expand...
Click to collapse
can change IMEI? really?how to change?i also have a prob, when i softreset my mini,must wait almost 10 or 15 mins,then can find network?i already flash a few diffrent rom but still same. [/quote]
very sorry, mistype in my previous post,
it should said CAN'T change IMEI
Finally after god only knows how many attempts I have just got BB Connect to work on my Xperia....
I got my phone back from a warranty repair today (blown speaker and hardware syncing probs) and it had been upgraded to:
ROM Version: 1.03.931.10
Rom Date: 02/02/09
Radio Version: 1.10.25.18
Protocol Version: 52.56.25.29U
ExtPkg Version: 1.0.522.06.11606
I have resynced it with my PC to load all my personal stuff back on and put the Micro SD card back in.
I thought I'd give it one last search to see if anyone had cracked the BB Connect issue with 6.1 on the Experia and found myself looking at PeeBee01's entry:
http://forum.xda-developers.com/showthread.php?t=372878
Changed my device ID to: HTC_TyTn
Ran Simple RegEdit Version 1.1.0 and changed the AKU value to: .0.4.2
Then ran an install of BB Connect Version 4.0.0.92 I had on the SD card, it installed ok and rebooted when prompted and..... It has registered!!!!!!! Yeah back on Blackberry at last.
Now I'm happy and feeling connected to the world.
Thanks to everyone who helped assemble these steps and I hope they work for others.
Newton
does it work with BIS or only with BES because the BBC is only talking about BES
Thankx
don't work for me, install goes ok but pin in pending...
Neither for me.... did it work 100% ??? should be the first X1 I read about that works with BB Connect and doesn't stop connection after a few seconds
ok this is my first post and i feel like to share this information, since i have seen so many xperia-owner in xda-developers.com forum is having problem in getting pin and or stay connected with BB Connect.
I own 1 xperia and my brother-in-law also own 1, my xperia do not work (well the problem is very similar with what everyone experienced , pin pending and or connected only for 2 seconds and disconnected) x_x
the very first step you need to do BEFORE advancing any further , is to REGISTER BLACK BERRY SERVICE WITH YOUR PROVIDER!!
In my case (indonesia) , i have registered Black Berry Service with MATRIX
First Case (PIN PENDING CASE)
That happened with my Xperia, and i am using the cooked room Touch.IT 4.5
done the same thing everyone do, install the bb connect .106 and then restart and i have got the forever pin pending message x_x
Second Case (SUCCESSFUL CASE)
That happened with my brother-in-law Xperia, he is using the original R1AA UK Generic ROM (one that comes when we bought xperia) , , install the bb connect .106 and then restart .... and then GOT THE PIN AND STAY CONNECTED !!!! o.o, my God , when i saw this i felt so happy, at least i know that BBConnect works with xperia , ok and then i went to http://indosat.blackberry.com , and try to create a new account, put in my pin and imei... but it doesnt recognize my pin / imei , i decided to call my provider (indosat matrix) , and they said they will look into it and find a solution for me
Third Case (PIN Pending case again)
That happend with my brother-in-law xperia, he just updated the rom from sonyericsson.com and i can see his ROM right now has changed into R2AA, and 100% the same with the Thread Starter ROM , do the same thing, install bb connect, and ... why on this green earth i have got PIN PENDING again !!!
with 3 cases, my suspect was i have to use the original xperia rom to connect to blackberry connect... but my suspicion proved to be wrong, since the thread starter has used the R2AA ROM and still be able to connect x_x, i will try changing device id and altering the registry thing..
I will report in when something happened after i do that both
Cheers and God Bless,
Chowi
any updates on this?