Related
EDIT: for a quick answer on how to get data working go to post # 222 of this thread!
Hey Guys,
I have been following the thread about the Evo 4G working on boostmobile. I hope someone would be able to help me, I am a bit stuck. First off, I won't bother anyone with any "n00b-ness", as I do know how to use google to find my own information. Here's where I am right now:
I have a "new" EVO 4G that had its MEID marked bad because the previous owner did not pay ETF to sprint. I also had a BlackBerry tour that I managed to connect with BoostMobile using a bit of social engineering (insisting to the relatively naive CSR that it's NOT a blackberry, as its MEID would indicate). I went through all the QXDM and Hexeditor fun to zero out the ESN, and finally the elusive MEID. **I will not mention what I did next, please use your imagination. I do not want to cause any trouble on the forum for talking about (you know what). I then switched the BlackBerry tour into GSM mode, to prevent it from causing a conflict, but at the same time to allow the phone to power up so I could continue to retrieve data or settings off it. Once I changed the programming info (MDN/MSID), I was able to make and receive calls. SMS worked inbound and outbound. Then, I changed the MMS url to mm_myboostmobile_com. Now I was able to send and receive MMS messages. After rooting my Froyo 2.2, I installed the 2.1 EPST app to be able to update PRL via ##775# / ##PRL#. Now, I have been trying various different PRL files from different forums as well as corolada_com. I also copied NV items 465, 466, 1192, and 1194 from my BlackBerry. I still cannot get data working, not EVDO, not even 1x. I would be most grateful to anyone who will contribute to this thread in a positive, constructive way. And if you're a Python, C# .NET, Perl, or Java programmer, or an SQL Server admin, I would gladly share the plethora of information I have in these areas with you. Thank You.
Ok, I have data working now. In the spirit of giving back to the community, here is what I did: I connected to the phone using Qualcomm QPST Service Programming, clicked Read and entered my MSL/SPC code. Then, under the M.IP tab, (you will only have this tab in a more recent build of QPST, I had to upgrade to build 348) I selected "profile 0" and clicked edit. Here, I unchecked the first checkbox which enables the profile. I wrote the changes to the device, and data began working. My rate is very pathetic, 100-200kbps. With previous device (blackberry tour 9630) this was over 5x faster. Maybe I am not getting EVDO? I will try several different PRL files and report results. I also heard that the HA and AAA secrets, stored in NV items 1192 and 1194 must be copied to authenticate for EVDO speeds. I am having trouble reading these from the (previous device) blackberry, particularly 1192. The resulting read in CDMA workshop produces an access denied error in the output file. QPST and QXDM don't even show these items in the nv items list at all, even if you click "File menu> read supported RF NV Items". All other items seem to show, but not these. Of course, you must send the MSL/SPC code before you attempt any nv item reading or writing. Has anyone else managed to transfer their boostmobile-specific HA secret and AAA shared secret from a blackberry onto an android device? What transfer rates are other boostmobile users getting on android devices in large metropolitan areas? (i'm in nyc).. I have heard some far-fetched solutions including "change your SPC to the old phone's SPC", is there any truth to this? Sorry if my thoughts are a bit disorganized. I will try to write a proper tutorial when I have time. Again, thanks to everyone that contributed to make my google searching a success, in this forum as well as others. Please feel free to put in your .02 as maybe I have overlooked something.
The only thing I can offer is on the tour. You don't need GSM mode to have it on. Simply turn off the radio.
I had the same issue or rather kind of similar. I am getting an Error (NV_READONLY_S) in QPST while trying to write to the EVO. Any help on why its doing that? I have surpassed the meid/pesn zero thingy and txt talk just as you have but to get data wkng proves to be difficult. Please advise.
unique, the problem with BB OS 5.0 and higher is that after a dead battery shutdown, it has the mobile network enabled on initial boot. Bosstalk, the NV_READONLY_S error can be ignored, the changes will stick anyway. What phone are you switching from? Did you try disabling the 0 profile under M.IP tab in QPST? Which PRL are you using?
uniquenameevo,
Do u have any assistance you could offer? I have been searching like crazy and its killing me.
gsxrmonkey said:
unique, the problem with BB OS 5.0 and higher is that after a dead battery shutdown, it has the mobile network enabled on initial boot.
Click to expand...
Click to collapse
True, my 9700 does this also. I did not know about the dead battery shutdown on yours
I am switching from an htc tp2 to an evo.
Firstly, When I do the requestnvitemread ds_mip_ss_user_prof in QXDM I get the ha shared hex passwd but all zeros for the AAA shared hex passwd. Isnt it suppose to be a combo of letters and numbers? Please advise.
Talk and Txt EVO but no Data
Can someone please lend a helping hand here. I am up to my wits with this one. Ive got txt and talk working on boost but somehow cannot get data.
(Error code 67)
My donor phone: HTC TP2 with boost
Evo: Rooted(unrevoked 3.2) with 2.2 Froyo update
Installed EPST.apk using Root explorer.
PRL used is 60660
Things Ive done so far:
1.Used QPST to match NV Items 465,466,1192 and 1194 from donor to evo using NV browser.
2. Used Qpst in the Mip tab and matched settings of the donor with the Evo
The only rough end that may be prohibiting my access is the fact that I cannot get an accurate AAA shared reading. I followed the SPC "msl" thingy then did the requestnvitemread ds_mip_ss_user_prof command that gave me good ha shared numbers after the 0x. However the AAA yield 0x00 all the way thru. Im not getting a long string of characters as others have gotten. Please advise!!! I would greatly appreciate it.
I am at the same point.
I think the HA is "secret" in plaintext
the AAA I managed to get was very long and qpst service programming app refused to accept any key in hex over 32 chars. I believe the one I have is 64 chars.
Do I have to send 'mode offline-d' if the radio is disabled anyway?
If anyone knows a way around this please advise.
Donor phone is BlackBerry Tour 9630
Target phone is HTC Evo 4G with 2.2 Froyo rooted
bosstalk said:
Can someone please lend a helping hand here. I am up to my wits with this one. Ive got txt and talk working on boost but somehow cannot get data.
(Error code 67)
My donor phone: HTC TP2 with boost
Evo: Rooted(unrevoked 3.2) with 2.2 Froyo update
Installed EPST.apk using Root explorer.
PRL used is 60660
Things Ive done so far:
1.Used QPST to match NV Items 465,466,1192 and 1194 from donor to evo using NV browser.
2. Used Qpst in the Mip tab and matched settings of the donor with the Evo
The only rough end that may be prohibiting my access is the fact that I cannot get an accurate AAA shared reading. I followed the SPC "msl" thingy then did the requestnvitemread ds_mip_ss_user_prof command that gave me good ha shared numbers after the 0x. However the AAA yield 0x00 all the way thru. Im not getting a long string of characters as others have gotten. Please advise!!! I would greatly appreciate it.
Click to expand...
Click to collapse
i just got my EVO and i was wondering if you could help me in the right direction to make the switch i have 7 BOOST CDMA LINES and plenty of donor's also i have about 9 boost cdma c290 would one of them work or does it need to be a higher end HS thanks to all
sdwyz74 said:
i just got my EVO and i was wondering if you could help me in the right direction to make the switch i have 7 BOOST CDMA LINES and plenty of donor's also i have about 9 boost cdma c290 would one of them work or does it need to be a higher end HS thanks to all
Click to expand...
Click to collapse
I am in the same boat as this guy, but have read and got to the point of making calls, txt, and mms. I just need data!!! I am so close...so close. CDMA WS will not read the c290. I get that it fails to answer. I used BITPIM to get the NVM settings of the c290, but I need to know how to take the key information to place into the EVO. Error 67 is driving me nuts!!!
Please someone help with getting data on my boost evo. I have managed to get talk and text working but cannot get data. Any assistance in this matter would be greatly appreciated.
I have read several forums and none of those methods are working for me.
Thanks in advance.
bosstalk said:
Firstly, When I do the requestnvitemread ds_mip_ss_user_prof in QXDM I get the ha shared hex passwd but all zeros for the AAA shared hex passwd. Isnt it suppose to be a combo of letters and numbers? Please advise.
Click to expand...
Click to collapse
For profile 0 aaa password you need to send this:
requestnvitemread hdr_an_auth_passwd_long
Good luck.
i have a tp2 on a cdma account.
what i did is use a cdma info from a NON activated boost phone. (use you imagination) no more detail on that.
once i was done i simple activated the phone and it activated and downloaded the ha and aaa.
let me know if this works as i am trying to get this to work
For ##DATA# is ##3282# and to pull the hex value use QXDM (you can find it on the net) and you will need QPST for the port server. In QXDM on most phones you send the MSL of the phone then request to read the password:
spc (your 6 digit msl)
requestnvitemread hdr_an_auth_passwd_long
On some phones you can get it with:
requestnvitemread ds_mip_ss_user_prof
And to get the dial-up 6-digit AAA password of profile 1 just add a 1 at the end:
requestnvitemread ds_mip_ss_user_prof 1
Ok I finally got my data icon to show up and my 1x data to work and the way I did it is I got my 6 digit AAA password from the donor rant phone straight from the device itself than I entered under profile 0 and profile 1 in my epic in QPST service programming secret as my ha user name and the 6 character password with text string selected. I used the same user name and password for both profiles because its the only way I get any data. But I can only get 1x. I tried changing primary & secondary servers but makes no difference. Any ideas why Im not getting 3g?
edit: n/m i figured it out
savior02 said:
Ok I finally got my data icon to show up and my 1x data to work and the way I did it is I got my 6 digit AAA password from the donor rant phone straight from the device itself than I entered under profile 0 and profile 1 in my epic in QPST service programming secret as my ha user name and the 6 character password with text string selected. I used the same user name and password for both profiles because its the only way I get any data. But I can only get 1x. I tried changing primary & secondary servers but makes no difference. Any ideas why Im not getting 3g?
edit: n/m i figured it out
Click to expand...
Click to collapse
If your donor is 1x that's all you're getting. And you don't use the same password. Provisioning is 16 hexadecimal digits and your account password is 6
Both use HA password "secret" (without quotes, of course)
m4f1050 said:
If your donor is 1x that's all you're getting. And you don't use the same password. Provisioning is 16 hexadecimal digits and your account password is 6
Both use HA password "secret" (without quotes, of course)
Click to expand...
Click to collapse
Ok I finally got it working on 3g the thing is my donor is a rant and is very difficult to extract the 16 hex from it. Everything is working now but my voicemail doesnt notify me of new ones.
Is it possible to remove Verizon from the lock screen and everywhere else using CDMA Workshop?
I read in the EVO theme section that this was used to remove Sprint, and replace it with a personal name.
I am no dev so I thought I would ask. thanks in advance.
If you found the thread for the evo it should be the same. Also I'm just chiming in to say yes you can change it with cdma workshop.
Sent from my Incredible using XDA App
I just tried this and I get a message that reads "Phona ask for SPC. SPC (6 digits) is required" when I hit write. Not sure what to do now?
well hear it is i have everthing working on my evo 4g thats on boost mobile.
Now the problem is that i get the 3g @ the top but when i checked the
speed it is so slow my donor phone is the tp2 it gets good speed when
i check it. I have read through the fourms and tried everthing but still
can get 3g to work right.now i can get everything off the touch tp2 but
the aaa password for profile 0 i thank it the 12 digit number when i try to
recive it it all zeros. now the next thing is that ppp the um is reded out
so i leave it the an is where i put my information but not sure what i need
to put hear i have the 6 digit password not sure where that goes. i know people
will say read but i have and i am just not getting it. so i turned to the fourms
for some with the tp2 that have done this to help. If u can not put the info hear
then can u email it to me if my email is need it then leave me a comment and i will send it to u but if so u can put it in the post. i do not want to get banned from this site. not sue if this is alloud hear so please can someone help me
i been @ this for a long long while now and want to enjoy my evo with the rest of the people hear.
I'm not too sure if it works on boost mobile but you could always try Techknowfile's PRL hack, which allows you to use Verizon's 3g when it is stronger than Sprint's 3g. I.E. Sprint has terrible signal at my house but Verizon is wonderful so now I can actually use my phone in my house! His hack can be found in HTC EVO's Android development.
Sent from my PC36100 using XDA App
Did you read the ha and aaa with qxdm? And did you read both profile 0 and profile 1
HTC EVO 4g on Boost mobile
Android version 2.3.5
bandbase 2.15.00.0808
Also did you copy the nv files from the donor?
HTC EVO 4g on Boost mobile
Android version 2.3.5
bandbase 2.15.00.0808
i did read bot profile 0 and 1 but i cant get the password in the right order
and i can't get the shared aaa password off the donor phone to put in
profile 1 i thank that the one for the 3g.
Open qxdm
Command
Enter "password 01f2030f5f678ff9"
Enter " requestnvitemread DS_mip_ss_user_Prof"
This will be profile 0 the sprint keys
Starting from where it says mm_ha_SHARED_secret[0] write down the number in order after the 0x. Do this for every one till you hit 0x00. Do the same for the AAA shared secret. After coping profile 0 enter
Requestnvitemread DS_mip_ss_user_prof1
Do the same here.
After you have both sets of ha and AAA keys disconnected from donor phone and connect to evolution. Goto. Qpst service programming and the m.IP tab. Open profile 0. In the ha shared secret box click enter hex value and enter the ha shared secret from Prof. 0 and do the same for the AAA shared secret. Then click ok. Now open profile 1 and copy your donor profile 1 ha and AAA keys the same and click ok. Once finished click write to phone.
Make sure you are following instructions.... you just copy them in the order they are in.
Sent from my PC36100 using XDA App
The NV files are for 3g aswell. Did you copy those?
Sent from my PC36100 using XDA App
tho34,
You stated tp2, is that HTC TouchPro2 WM6. 5 phone? I might be able to help. This particular phone had Profile 1 not in a common place.
edit:
Sprint has HA set to the word "secret" or in hex 736563726574 for both profiles. So look for that first in data you extracted from #####, the Profile 0 AAA will be 16 bytes long or 32 digits. The Profile 1 AAA will be 6 bytes long and looking at these bytes in hex editor it will be 6 ascii characters like "xs9f5w". So check this first. If you have Zeros for AAA then you first have to extract correct data. This is the same for Boost CDMA.
Flagmax thanks for your help i will try that but what about the ppp config
do i need to put that information in as well and if u could email not sure
if putting my email hear is aloud yes it is a touch pro 2 the donor
You will need to match up everything on both phones using QPST.
You have not answered my question in previous post, clarify tp2.
We can keep talking in here for now. It might help others.
oh yeah i want to thank everyone for the responce
i still may need help.
oh sorry it is a touch pro 2
Flagmax what about the ppp tab is their information i need to
put their to
tho34 said:
Flagmax what about the ppp tab is their information i need to
put their to
Click to expand...
Click to collapse
Yes there few places you need to correct the MEID. But as I said before, open up both phones in qpst and match it up. You press CTRL-D on red boxes.
Sent from my HERO200 using Tapatalk
Flagmax thanks man i will try it when i get home
from work. Flagmax if i need your help agin on this matter
can i just post it hear.
well have not been able to get the 3g speed yet
will gonig back to stock help me out.
Hey everyone i need your help.
so i bought an htc evo 4g from craigslist already flashed to boost mobile the phone worked fine on the guy who i bought it from he gave me his boostmobile account info to transfer his phone to my acc. so i got home with the phone i transfered his account info to my boost account and now i cant get calls or anything no interenet nothing!! i look at the phone identity and it still has his number under it i called boost and they walked me through a procedure even did ##(some numbers)# to bring up a screen to put in my new number i did tht ut still nothing. it shows his number still in the phone identity im lost please help i spent 170$ and i want my phone to work some1 help me
do you know your Evo's MSL or SPC? If so, try pushing ##123456# (123456 should be your MSL) then on the pop up menu that comes up select "Edit Mode" then you need to change your MDN to your new number and you need to change the MSID to the new one too. If you already talked to Boost then hopefully you wrote these 2 numbers down. If not, call them again and tell them you switched numbers/phones and need to re-enter that info. Just tell them you need the new MDN and MSID so you do not have to sit and have them try and walk you through steps to that are not for the Evo. DO NOT tell them it is an Evo obviously. If you do not know your Evo's MSL then it is pretty easy to get through CDMA WS, pm me and I can help you with that part if necessary. Hope this helps, if you need anything else feel free to ask!
*If I have helped, please take a second to hit my thank you button*
thanks man now i need help with the internet its not working and i have no idea wat to do
Push ##33284# then select EVDO Engineering. Scroll all the way to the bottom an tell me what it says next to AN/AAA
Did you try going to settings, system updates, update profile yet? Also it can take up to 48 hours for everything to work IF it says 1- authenticated after AN/AAA
Sent from my PC36100 using xda premium
it says to 2=failed authentication
ive also tried up dating profile it would let me
If it says authentication failed then your AAA and HA keys are wrong. Did you get the donor phone from the guy you bought the Evo from???? If you did then it will be pretty simple to pull the correct AAA and HA keys from it.
If you do not have the donor, you might try ##786#, then hit menu then hit reset. Be warned, it will reset everything back to factory so make sure you back up anything worth saving first. When the phone resets itself, it will try to perform an OTA activation. I am wanting to say it should provision the AAA keys on its own after that (If I am wrong on this part, please feel free to step in and correct me guys)
what do i need to save to be backed up and i dont have doner phone
Dont think you can do that, tell you what I did. I bought an Evo also off ebay fixed the glass and found someone to flash it to boost. after 2 months with phone the 3g went out, tried to get help from flasher but no go, I found a guide myself and started testing, first flash success, so wanted to reflash my phone and only way to get it done was to buy a donor phone, attach it to your boost account, hook it up pull the info, reflash EVO and all done. You cant just take a phone and move it to your account, wont work.
You should have just left it the way it was, now you'll need to get a donor phone and start over, I did and doing fine now.
If you need help let me know.
Yep, I agree. If you do not have the donor, I would suggest buying a new one. Even if you do manage to fix data this time, you will have more problems later. The fact that you did not get the donor might mean the Guy is activating more than one evo with it and that means you might start getting the error 16 in the future. I have always given the donor back to the person I flashed for because I do not need it and more importantly I have no legitimate reason for keeping it.
Sent from my PC36100 using xda premium
Would this be the same steps if i call Boost and change my old number, im giving my EVO to my daughter but she doesnt want my number.
It will be the same steps as to changing the numbers in the setting once i enter the MLS???
I have been in the process of attempting to flash my Epic 4g to boost for about a week now (with very limited time each day). Thanks to the help of some awesome people here on the forum I have made quite a bit of progress. I have however, hit a wall. I am currently attempting to use a Samsung Replenish which I purchased with GB 2.3.6 pre-installed. I have gotten to the point where I need to extract the HA/AAA keys from the donor and it is locked down tighter than (insert random virgin joke here...). I have tried two methods, method 1- reading NV Items 465,466,1192, and 1194, this method gives me four text files, each of which say access denied toward the top and give me nothing but goose eggs. method 2- using QXDM typing password (spc) which works fine, I have the right SPC and it accepts it, but then when I type the requestnvitemread ds_mip_ss_user_prof command (and I have tried prof 1 and prof 0) it says "error recieved from target". I am not familiar with anything more technical than what I explained, I know my way around these phones a bit and am technically savvy, but I do not know any code or anything like that.
I stated in my first post that I dont mind having to spend money to get my epic to boost but I would like to avoid it. With that being said, I would like to know if there is anything that I can try before pulling the trigger on a Sanyo Incognito (which to my understanding is one of the easier phones to use for this process). I have read that flashing back to froyo might help, but I cant find anything on flashing the Replenish back to Froyo as no one seems to want to do it. If anyone has any advice on flashing back to Froyo or anything else that I can try to get those keys I would be eternally grateful (well maybe for a day or two, after that I'd probably forget...anyways...)
thanks in advance for any help!!
Even though you're trying to flash an Epic 4G, this question is more applicable to a Replenish forum (if there is one), where people have experience reading these NV items on that particular model.
Some things to try:
Try first sending "password 01F2030F5F678FF9" in QXDM. (I wouldn't be surprised if this password did not work for the Replenish. Some Samsung devices have unique passwords.)
Try DFS CDMA Tool.
Try reading /nvm/num/ in QPST EFS Explorer.
etirkca said:
Even though you're trying to flash an Epic 4G, this question is more applicable to a Replenish forum (if there is one), where people have experience reading these NV items on that particular model.
Some things to try:
Try first sending "password 01F2030F5F678FF9" in QXDM. (I wouldn't be surprised if this password did not work for the Replenish. Some Samsung devices have unique passwords.)
Try DFS CDMA Tool.
Try reading /nvm/num/ in QPST EFS Explorer.
Click to expand...
Click to collapse
Yeah, unfortunately for me, this phone isn't very popular...especially in the hacking/flashing community so my resources are limited, I did not see a thread dedicated to this phone on here. I tried using the password that you gave me and it did accept it but did not change my result. I also tried using efs explorer and each file that I save/view says secret and nothing else....
Usually reading EFS is blocked until you send the 16 digit password, but it sounds like you did that already. Sorry, I've never used a Replenish, so I'm not sure what else to do.
etirkca said:
Usually reading EFS is blocked until you send the 16 digit password, but it sounds like you did that already. Sorry, I've never used a Replenish, so I'm not sure what else to do.
Click to expand...
Click to collapse
NP thanks anyway, I went ahead and bought an Incognito. I got a deal on ebay, for a nonfunctional unit with guaranteed ESN as well as USB capabilities for $35, the dealer sells them specifically for the purpose of donor/flashing. Guess I'll have to wait a few more days for an almost fully functional Epic...At least now I get to play around with some roms and fine tune that sucker to my exact liking
One more quick question though, When I get the phone, should I transfer my boost account to it BEFORE I flash the epic? or can I just flash it, call from the epic and transfer it all that way?
You need to have the incognito on boost first. When you transfer the account to incognito they will program the phone for you. I would suggest you to talk to a live person at boost when you activate the incognito. Write down the spc code and mdn number. This will save you some time. After that everything else should be easy. Program the epic with the information from incognito.
bugzy3188 said:
One more quick question though, When I get the phone, should I transfer my boost account to it BEFORE I flash the epic? or can I just flash it, call from the epic and transfer it all that way?
Click to expand...
Click to collapse
Sent from my PC36100 using XDA Premium App