Related
EDIT: for a quick answer on how to get data working go to post # 222 of this thread!
Hey Guys,
I have been following the thread about the Evo 4G working on boostmobile. I hope someone would be able to help me, I am a bit stuck. First off, I won't bother anyone with any "n00b-ness", as I do know how to use google to find my own information. Here's where I am right now:
I have a "new" EVO 4G that had its MEID marked bad because the previous owner did not pay ETF to sprint. I also had a BlackBerry tour that I managed to connect with BoostMobile using a bit of social engineering (insisting to the relatively naive CSR that it's NOT a blackberry, as its MEID would indicate). I went through all the QXDM and Hexeditor fun to zero out the ESN, and finally the elusive MEID. **I will not mention what I did next, please use your imagination. I do not want to cause any trouble on the forum for talking about (you know what). I then switched the BlackBerry tour into GSM mode, to prevent it from causing a conflict, but at the same time to allow the phone to power up so I could continue to retrieve data or settings off it. Once I changed the programming info (MDN/MSID), I was able to make and receive calls. SMS worked inbound and outbound. Then, I changed the MMS url to mm_myboostmobile_com. Now I was able to send and receive MMS messages. After rooting my Froyo 2.2, I installed the 2.1 EPST app to be able to update PRL via ##775# / ##PRL#. Now, I have been trying various different PRL files from different forums as well as corolada_com. I also copied NV items 465, 466, 1192, and 1194 from my BlackBerry. I still cannot get data working, not EVDO, not even 1x. I would be most grateful to anyone who will contribute to this thread in a positive, constructive way. And if you're a Python, C# .NET, Perl, or Java programmer, or an SQL Server admin, I would gladly share the plethora of information I have in these areas with you. Thank You.
Ok, I have data working now. In the spirit of giving back to the community, here is what I did: I connected to the phone using Qualcomm QPST Service Programming, clicked Read and entered my MSL/SPC code. Then, under the M.IP tab, (you will only have this tab in a more recent build of QPST, I had to upgrade to build 348) I selected "profile 0" and clicked edit. Here, I unchecked the first checkbox which enables the profile. I wrote the changes to the device, and data began working. My rate is very pathetic, 100-200kbps. With previous device (blackberry tour 9630) this was over 5x faster. Maybe I am not getting EVDO? I will try several different PRL files and report results. I also heard that the HA and AAA secrets, stored in NV items 1192 and 1194 must be copied to authenticate for EVDO speeds. I am having trouble reading these from the (previous device) blackberry, particularly 1192. The resulting read in CDMA workshop produces an access denied error in the output file. QPST and QXDM don't even show these items in the nv items list at all, even if you click "File menu> read supported RF NV Items". All other items seem to show, but not these. Of course, you must send the MSL/SPC code before you attempt any nv item reading or writing. Has anyone else managed to transfer their boostmobile-specific HA secret and AAA shared secret from a blackberry onto an android device? What transfer rates are other boostmobile users getting on android devices in large metropolitan areas? (i'm in nyc).. I have heard some far-fetched solutions including "change your SPC to the old phone's SPC", is there any truth to this? Sorry if my thoughts are a bit disorganized. I will try to write a proper tutorial when I have time. Again, thanks to everyone that contributed to make my google searching a success, in this forum as well as others. Please feel free to put in your .02 as maybe I have overlooked something.
The only thing I can offer is on the tour. You don't need GSM mode to have it on. Simply turn off the radio.
I had the same issue or rather kind of similar. I am getting an Error (NV_READONLY_S) in QPST while trying to write to the EVO. Any help on why its doing that? I have surpassed the meid/pesn zero thingy and txt talk just as you have but to get data wkng proves to be difficult. Please advise.
unique, the problem with BB OS 5.0 and higher is that after a dead battery shutdown, it has the mobile network enabled on initial boot. Bosstalk, the NV_READONLY_S error can be ignored, the changes will stick anyway. What phone are you switching from? Did you try disabling the 0 profile under M.IP tab in QPST? Which PRL are you using?
uniquenameevo,
Do u have any assistance you could offer? I have been searching like crazy and its killing me.
gsxrmonkey said:
unique, the problem with BB OS 5.0 and higher is that after a dead battery shutdown, it has the mobile network enabled on initial boot.
Click to expand...
Click to collapse
True, my 9700 does this also. I did not know about the dead battery shutdown on yours
I am switching from an htc tp2 to an evo.
Firstly, When I do the requestnvitemread ds_mip_ss_user_prof in QXDM I get the ha shared hex passwd but all zeros for the AAA shared hex passwd. Isnt it suppose to be a combo of letters and numbers? Please advise.
Talk and Txt EVO but no Data
Can someone please lend a helping hand here. I am up to my wits with this one. Ive got txt and talk working on boost but somehow cannot get data.
(Error code 67)
My donor phone: HTC TP2 with boost
Evo: Rooted(unrevoked 3.2) with 2.2 Froyo update
Installed EPST.apk using Root explorer.
PRL used is 60660
Things Ive done so far:
1.Used QPST to match NV Items 465,466,1192 and 1194 from donor to evo using NV browser.
2. Used Qpst in the Mip tab and matched settings of the donor with the Evo
The only rough end that may be prohibiting my access is the fact that I cannot get an accurate AAA shared reading. I followed the SPC "msl" thingy then did the requestnvitemread ds_mip_ss_user_prof command that gave me good ha shared numbers after the 0x. However the AAA yield 0x00 all the way thru. Im not getting a long string of characters as others have gotten. Please advise!!! I would greatly appreciate it.
I am at the same point.
I think the HA is "secret" in plaintext
the AAA I managed to get was very long and qpst service programming app refused to accept any key in hex over 32 chars. I believe the one I have is 64 chars.
Do I have to send 'mode offline-d' if the radio is disabled anyway?
If anyone knows a way around this please advise.
Donor phone is BlackBerry Tour 9630
Target phone is HTC Evo 4G with 2.2 Froyo rooted
bosstalk said:
Can someone please lend a helping hand here. I am up to my wits with this one. Ive got txt and talk working on boost but somehow cannot get data.
(Error code 67)
My donor phone: HTC TP2 with boost
Evo: Rooted(unrevoked 3.2) with 2.2 Froyo update
Installed EPST.apk using Root explorer.
PRL used is 60660
Things Ive done so far:
1.Used QPST to match NV Items 465,466,1192 and 1194 from donor to evo using NV browser.
2. Used Qpst in the Mip tab and matched settings of the donor with the Evo
The only rough end that may be prohibiting my access is the fact that I cannot get an accurate AAA shared reading. I followed the SPC "msl" thingy then did the requestnvitemread ds_mip_ss_user_prof command that gave me good ha shared numbers after the 0x. However the AAA yield 0x00 all the way thru. Im not getting a long string of characters as others have gotten. Please advise!!! I would greatly appreciate it.
Click to expand...
Click to collapse
i just got my EVO and i was wondering if you could help me in the right direction to make the switch i have 7 BOOST CDMA LINES and plenty of donor's also i have about 9 boost cdma c290 would one of them work or does it need to be a higher end HS thanks to all
sdwyz74 said:
i just got my EVO and i was wondering if you could help me in the right direction to make the switch i have 7 BOOST CDMA LINES and plenty of donor's also i have about 9 boost cdma c290 would one of them work or does it need to be a higher end HS thanks to all
Click to expand...
Click to collapse
I am in the same boat as this guy, but have read and got to the point of making calls, txt, and mms. I just need data!!! I am so close...so close. CDMA WS will not read the c290. I get that it fails to answer. I used BITPIM to get the NVM settings of the c290, but I need to know how to take the key information to place into the EVO. Error 67 is driving me nuts!!!
Please someone help with getting data on my boost evo. I have managed to get talk and text working but cannot get data. Any assistance in this matter would be greatly appreciated.
I have read several forums and none of those methods are working for me.
Thanks in advance.
bosstalk said:
Firstly, When I do the requestnvitemread ds_mip_ss_user_prof in QXDM I get the ha shared hex passwd but all zeros for the AAA shared hex passwd. Isnt it suppose to be a combo of letters and numbers? Please advise.
Click to expand...
Click to collapse
For profile 0 aaa password you need to send this:
requestnvitemread hdr_an_auth_passwd_long
Good luck.
i have a tp2 on a cdma account.
what i did is use a cdma info from a NON activated boost phone. (use you imagination) no more detail on that.
once i was done i simple activated the phone and it activated and downloaded the ha and aaa.
let me know if this works as i am trying to get this to work
For ##DATA# is ##3282# and to pull the hex value use QXDM (you can find it on the net) and you will need QPST for the port server. In QXDM on most phones you send the MSL of the phone then request to read the password:
spc (your 6 digit msl)
requestnvitemread hdr_an_auth_passwd_long
On some phones you can get it with:
requestnvitemread ds_mip_ss_user_prof
And to get the dial-up 6-digit AAA password of profile 1 just add a 1 at the end:
requestnvitemread ds_mip_ss_user_prof 1
Ok I finally got my data icon to show up and my 1x data to work and the way I did it is I got my 6 digit AAA password from the donor rant phone straight from the device itself than I entered under profile 0 and profile 1 in my epic in QPST service programming secret as my ha user name and the 6 character password with text string selected. I used the same user name and password for both profiles because its the only way I get any data. But I can only get 1x. I tried changing primary & secondary servers but makes no difference. Any ideas why Im not getting 3g?
edit: n/m i figured it out
savior02 said:
Ok I finally got my data icon to show up and my 1x data to work and the way I did it is I got my 6 digit AAA password from the donor rant phone straight from the device itself than I entered under profile 0 and profile 1 in my epic in QPST service programming secret as my ha user name and the 6 character password with text string selected. I used the same user name and password for both profiles because its the only way I get any data. But I can only get 1x. I tried changing primary & secondary servers but makes no difference. Any ideas why Im not getting 3g?
edit: n/m i figured it out
Click to expand...
Click to collapse
If your donor is 1x that's all you're getting. And you don't use the same password. Provisioning is 16 hexadecimal digits and your account password is 6
Both use HA password "secret" (without quotes, of course)
m4f1050 said:
If your donor is 1x that's all you're getting. And you don't use the same password. Provisioning is 16 hexadecimal digits and your account password is 6
Both use HA password "secret" (without quotes, of course)
Click to expand...
Click to collapse
Ok I finally got it working on 3g the thing is my donor is a rant and is very difficult to extract the 16 hex from it. Everything is working now but my voicemail doesnt notify me of new ones.
White HTC EVO 4G
Android version: 2.2.1
Baseband: 2.15.00.09.01
Software: 3.30.651.3
Rooted using http://forum.xda-developers.com/showthread.php?t=829045
Looking for help scanning the right locations in cdma ws 2.7 (unlocked) for my esn. I was able to find all 10 MEID's and was also able to verify it has been zeroed by using "RequestNVItemRead meid" in QXDM Pro.
MEID Locations
0xfac590
0xfcd950
0xfd8350
0x15e7e90
0x17c1dd0
0x18e7a10
0x18f7ca0
0x015E7E8c
0x018E7AF0
0x01d38e27
ESN Locations (So far)
0xfcadb0
0xfcc670
0xfdd590
0x1275c20
0x15f2ca0
0x17c1910
0x17c1d70
0x17c8230
0x1882f20
0x00F950E8
Scanning memory for readable areas:
Unreadable area from: 0000:0000
Readable area from: 00F9:8000
Unreadable area from: 00FE:C000
Readable area from: 0107:C000
Unreadable area from: 01D9:0000
that was my original cdma ws scan. I have scanned readable areas a few times but have not found any new esn numbers.
PLEASE HELP .. I feel like im missing something or over looking something.
jmathieu2 said:
White HTC EVO 4G
Android version: 2.2.1
Baseband: 2.15.00.09.01
Software: 3.30.651.3
Rooted using http://forum.xda-developers.com/showthread.php?t=829045
Looking for help scanning the right locations in cdma ws 2.7 (unlocked) for my esn. I was able to find all 10 MEID's and was also able to verify it has been zeroed by using "RequestNVItemRead meid" in QXDM Pro.
MEID Locations
0xfac590
0xfcd950
0xfd8350
0x15e7e90
0x17c1dd0
0x18e7a10
0x18f7ca0
0x015E7E8c
0x018E7AF0
0x01d38e27
ESN Locations (So far)
0xfcadb0
0xfcc670
0xfdd590
0x1275c20
0x15f2ca0
0x17c1910
0x17c1d70
0x17c8230
0x1882f20
0x00F950E8
Scanning memory for readable areas:
Unreadable area from: 0000:0000
Readable area from: 00F9:8000
Unreadable area from: 00FE:C000
Readable area from: 0107:C000
Unreadable area from: 01D9:0000
that was my original cdma ws scan. I have scanned readable areas a few times but have not found any new esn numbers.
PLEASE HELP .. I feel like im missing something or over looking something.
Click to expand...
Click to collapse
Was a snap finding the locations with CDMA workshop 3.6.
Maybe don't be a pirate and just buy CDMA workshop?
It's unbelievably easy to do when you own the proper software.
You have 10 Esn locations posted, that it the correct amount, what is the reply when you send requestnvitemread esn?
Btw it is the exactly the same proccess to find the locations using 2.7 as 3.6, you evidently don't have much experiance with them, The difference would be in writing them to 0's.
drfosters said:
Btw it is the exactly the same proccess to find the locations using 2.7 as 3.6 The difference would be in writing them to 0's.
Click to expand...
Click to collapse
For the ESN; no easy way to find the MEID locations without 3.6 ("easy" differs amongst people)
But noting that he is 0'd for the MEID and halfway done, I will give him a hint - There is more than 10 locations you will find for the ESN. Zero and rescan.
There have been 12+ locations on every EVO I have done. (All have been Froyo/Radio 2.10 or above)
You may find more than 10 locations but all those locations do not need to be 0'd out.
I have never worked with an Evo 2.10 radio, and that may be it, but I doubt it. When you repair an Esn that has already been repaired before, you will see that.
Last I checked "easy" was telling a program to scan and waiting for the results, but as you say, easy is a matter of opinion. Getting all the locations first shot is a matter of luck, maybe you have better luck because you bought the program
Either way, these should be your missing ESN locations:
0x017C19F0
0x017CE8E0
0x017D8D80
0x01D34E40
0x01D34E70
Try them and look around the actual location as they may not be exact, if they don't work, post the radio and software version you are running.
Have fun!
Necrosan said:
Was a snap finding the locations with CDMA workshop 3.6.
Maybe don't be a pirate and just buy CDMA workshop?
It's unbelievably easy to do when you own the proper software.
Click to expand...
Click to collapse
I was considering buying it. Im not trying to cut corners here! But I am new to this and just looking for some help. If it boils down to not being able to resolve my problem I probably will purchas the software.
Thank you everyone for responding - I appreciate the help.
I have realized that there are more esn locations then just 10 .. Just having issues finding them .. hehe!
When I run command requestnvitemread esn - my esn is not all 0's
But when I run it for meid - it is all 0's
Going to try the new locations posted - I will post again soon
So I have tried the locations with no luck!
My Phone info is
Android version: 2.2.1
Baseband: 2.15.00.09.01
Software: 3.30.651.3
I dont mind doing the work but im not understanding why when i scan my redable areas after i zero'd out the first 10 esn's that i dont get anymore?
I must be doing something wrong.
I have read about turning on/off airplane mode (and actually had to use this to zero out my last meid)
are you trying to fix a bad esn? if so i do not think xda can help you. plus it's against federal law.
When you try the locations that I posted, do you see zero's there?
You could try changing the user name of your data profile, than doing another memory dump, just dump from 0108-0000 for 13500000 bytes.
I will post another bunch of locations for you to try when I get home.
Sent from my PC36100 using Tapatalk
I have solved my problem. After some reading and researching i figured out what I was doing wrong.
I was using the "memory" tab and Memory / Eeprom section to scan memory locations, when i should have been using "security" tab ESN section to scan (MUCH EASIER) ..
I appreciate all the help
Please help
I zerod out my esn some how and I have read this and am having trouble understanding. If someone could make this file needed to rewrite the esn I would gladly pay them. When I do esn write with universal ram method it asks for a file that I don't have. Please help. I already read the meid and got the text file but couldn't figure out how to use that. And I almost screwed up my phone worse trying to use qxdm. PLEASE HELP ME. I don't want this evo to be a paperweight. I have cdma ws 3.6 Thanks
Ok so i need help i cant find my esn anywhere in these locations how do i go about reading the esn locations and find my esn
i need step by step help with repairing evos esn on cdma 2.7 full crack and QXDM ive been stuck for days i cant seem to get it to work please help
jmathieu2 said:
I have solved my problem. After some reading and researching i figured out what I was doing wrong.
I was using the "memory" tab and Memory / Eeprom section to scan memory locations, when i should have been using "security" tab ESN section to scan (MUCH EASIER) ..
I appreciate all the help
Click to expand...
Click to collapse
so basically im having the same problem as you. im no newb eto this so please dont flame me. i did the epic no problem. would care to elacorate on how you fixed your problem. thanks.
Solved my problem. Thanks guys.
Solved......
Could someone help a guy out with how to actually perform the scan? I legitimately own cw 3.6 and every time I do a security scan - either esn or meid my phone reboots.
nutrapi said:
Could someone help a guy out with how to actually perform the scan? I legitimately own cw 3.6 and every time I do a security scan - either esn or meid my phone reboots.
Click to expand...
Click to collapse
You need to use the memory tab to get the valid ranges for the scan, and then instead of using the defaults in the ESN scan you put in the different ranges.
For the EVO it is
00FA:0000 to 00FE:FFFF
0108:0000 to 01D8:FFFF
(at least on my EVO)
As pathetic as this sounds, can someone please help direct me to scanning the esn addresses of my htc evo 2.15.00.11.19 radio?
So far, this is how I did it:
I opened up cdmaws 3.6, and clicked on security tab, and then sent the spc for the evo which unlocked it. In that same tab, I see 4 boxes (ESN, MEID, PASSWORD 16 DIGIT, SPC/USER LOCK).
This is where I'm lost. Basically, do I click on the esn tab and click read or write? Niether does anything. So I click on the Universal RAM option and click write again. This time it asks for starting and ending addresses. But I don't know those.
Any ideas? please help. Thanks
I've been searching all over google and everywhere else I can think of, I have found similar cases as mine, but not exactly what I'm looking for.
First off I purchased a phone that was said to be cleared for activation, yet when it arrived it was not, I called Virgin Mobile and asked them to activate the phone onto my account and I was told to get name/pin/address of the previous owner to deactivate the phone, even though it has no service. So I looked around and saw this MEID cloning stuff, and since I already have a Samsung Intercept I thought I'd just use that as the donor phone since it's very slow and ruins the android experience for me. I've missed calls because it locks up when an incoming call comes in, anyways... I got the phone set up and data works just fine, but my calling comes back with a "We could not validate..." I've cloned the MEID, MSID, MDN, everything, and it still won't work. So basically my question is, has anyone had a similar problem and fixed it? Took me 2 days to figure out everything and just get data running.. D:
Isn't cloning that Id illegal?
In the uk you'll be sent to jail for cloning or changing mobile id's.
From what I've read it's illegal if you want to keep both phones up and running at the same time, or if the phones MEID was stolen. I'm going to be leaving the Intercept off and use the Wildfire as my main phone. I tried doing it the right way but VM was not wanting to work with me so I have to do it the hard way.
I actually found the problem, after I wrote the MEID with DFS CDMA Tool, It generated a pESN in an un-editable box below it, all I had to do was use a hex editor on file '0' after doing the 'open sesame door' using EFS File explorer, and rewrite the ESN to the pESN. Which is how I had to re-write the MEID also. So I just extracted the files '0' and '1496' rewrote them in a hex editor so they would read all 0's and deleted/replaced them. Rebooted the phone, wrote the MEID. Rebooted again, and rewrote the '0' file with a hex editor since the ESN did not want to change in DFS. Made it way more complicated than it should have been.
I have been in the process of attempting to flash my Epic 4g to boost for about a week now (with very limited time each day). Thanks to the help of some awesome people here on the forum I have made quite a bit of progress. I have however, hit a wall. I am currently attempting to use a Samsung Replenish which I purchased with GB 2.3.6 pre-installed. I have gotten to the point where I need to extract the HA/AAA keys from the donor and it is locked down tighter than (insert random virgin joke here...). I have tried two methods, method 1- reading NV Items 465,466,1192, and 1194, this method gives me four text files, each of which say access denied toward the top and give me nothing but goose eggs. method 2- using QXDM typing password (spc) which works fine, I have the right SPC and it accepts it, but then when I type the requestnvitemread ds_mip_ss_user_prof command (and I have tried prof 1 and prof 0) it says "error recieved from target". I am not familiar with anything more technical than what I explained, I know my way around these phones a bit and am technically savvy, but I do not know any code or anything like that.
I stated in my first post that I dont mind having to spend money to get my epic to boost but I would like to avoid it. With that being said, I would like to know if there is anything that I can try before pulling the trigger on a Sanyo Incognito (which to my understanding is one of the easier phones to use for this process). I have read that flashing back to froyo might help, but I cant find anything on flashing the Replenish back to Froyo as no one seems to want to do it. If anyone has any advice on flashing back to Froyo or anything else that I can try to get those keys I would be eternally grateful (well maybe for a day or two, after that I'd probably forget...anyways...)
thanks in advance for any help!!
Even though you're trying to flash an Epic 4G, this question is more applicable to a Replenish forum (if there is one), where people have experience reading these NV items on that particular model.
Some things to try:
Try first sending "password 01F2030F5F678FF9" in QXDM. (I wouldn't be surprised if this password did not work for the Replenish. Some Samsung devices have unique passwords.)
Try DFS CDMA Tool.
Try reading /nvm/num/ in QPST EFS Explorer.
etirkca said:
Even though you're trying to flash an Epic 4G, this question is more applicable to a Replenish forum (if there is one), where people have experience reading these NV items on that particular model.
Some things to try:
Try first sending "password 01F2030F5F678FF9" in QXDM. (I wouldn't be surprised if this password did not work for the Replenish. Some Samsung devices have unique passwords.)
Try DFS CDMA Tool.
Try reading /nvm/num/ in QPST EFS Explorer.
Click to expand...
Click to collapse
Yeah, unfortunately for me, this phone isn't very popular...especially in the hacking/flashing community so my resources are limited, I did not see a thread dedicated to this phone on here. I tried using the password that you gave me and it did accept it but did not change my result. I also tried using efs explorer and each file that I save/view says secret and nothing else....
Usually reading EFS is blocked until you send the 16 digit password, but it sounds like you did that already. Sorry, I've never used a Replenish, so I'm not sure what else to do.
etirkca said:
Usually reading EFS is blocked until you send the 16 digit password, but it sounds like you did that already. Sorry, I've never used a Replenish, so I'm not sure what else to do.
Click to expand...
Click to collapse
NP thanks anyway, I went ahead and bought an Incognito. I got a deal on ebay, for a nonfunctional unit with guaranteed ESN as well as USB capabilities for $35, the dealer sells them specifically for the purpose of donor/flashing. Guess I'll have to wait a few more days for an almost fully functional Epic...At least now I get to play around with some roms and fine tune that sucker to my exact liking
One more quick question though, When I get the phone, should I transfer my boost account to it BEFORE I flash the epic? or can I just flash it, call from the epic and transfer it all that way?
You need to have the incognito on boost first. When you transfer the account to incognito they will program the phone for you. I would suggest you to talk to a live person at boost when you activate the incognito. Write down the spc code and mdn number. This will save you some time. After that everything else should be easy. Program the epic with the information from incognito.
bugzy3188 said:
One more quick question though, When I get the phone, should I transfer my boost account to it BEFORE I flash the epic? or can I just flash it, call from the epic and transfer it all that way?
Click to expand...
Click to collapse
Sent from my PC36100 using XDA Premium App
i only was wondering if the GNEX meid (9xxx kind) is possible to be compatible with (Axxx kind) i dont want to do it or nothing but, i mean, i only was thinking on that b/c the gnex has a IMEI and i was wondering if there can be any kind of conflicts between the (Axxx meid and the 9xxx imei), ex the imei of the gnex is 9xxxxxxxxxxxxx and the meid is 9xxxxxxxxxxxxx but if you got a imei of 9xxxxxxxxxxxxxx and a meid of Axxxxxxxxxxxxx there can be conflicts with that?, i mean technically i know you only can get text 3g speeds (not 4g b/c the imei isnt the same and couldnt be activate b/c the parameters doesnt match) and calls but the big question is if there can be conflicts between the meid and the imei because they are from different nomenclature? or for someting else?
No its not but with a HEX editor stuff can be changed
Sent from my SPH-D710 using XDA
Not sure what you want to do, but just thought I'd let you know that altering an IMEI is both illegal in places, and can seriously gerfungle-up your phone. Also, the gnex IMEI has an MD5 checksum based on an unknown random seed, so it's pointless to change it with a hex editor. It will just revert to a generic IMEI that some carriers block.