Develop Bugs

Htc droid incredible on boost mobile [how to]

THIS IS FOR EDUCATIONAL PURPOSE ONLY​
Guide on Flashing HTC Droid Incredible to Boost Mobile
What you NEED
QPST
QXDM 3.11 (Google is your friend)
CDMA Tools 2.7 (Demo is good too)
Patience
HTC Diagnostic or HTC USB MODEM Drivers (I will include Win7 x64 Driver)
Donor Phone Driver (Google is your friend)
Winhex (Again, Google )
Boost Mobile Account [seems difficult for those without it]
What you DONT NEED
Wife
Kids
*Install all drivers and programs**
If you do not know how to manually install a driver, I suggest you stop where you are now.
Step 1: Donor Phone MSL/SPC
This one is really simple, call Boost Mobile Customer Rep. (To get directly to them after the guy says "For espanol press 5", just press 5, then press 2, and wait for it to ask you "To chat with a Boost Customer Rep press 0") and tell them your phone needs to be programmed and they will tell you to dial ##MSL#. SAVE THAT NUMBER and then just hang up on them.
Step 1.5:
Incase you are scared to talk with boost mobile, or you don't know your 6 digit MSL/SPC code you will have to find it manually. *Sigh*
Open QPST, click [Add New Port] on the bottom right, then uncheck [Show serial...] on the bottom left corner and on the screen to the left you should see your Donor's Port number, add it and make note of it.
Next open CDMA workshop, connect to your phones Port (COM) number, click read and your phone information will be displayed on the left.
Click on the memory tab, under memory/Eeprom put start Address: 0363:0000 leave the size at 65536 bytes, now click read and save the .bin files on your desktop.
FINALLY, open up Win Hex, open the memory file you just saved, click on specialist- Gather Text; Recognize text by "6" uncheck everything expect for " Numbers" press "OK", save the file anywhere you like. You should end up with a .txt document with 1 or more 6 digit numbers; one of them is the SPC for your phone, write it or them down.
Step 2: NV Items
Open CDMA Workshop again, go to Security under SPC write your MSL code and click SPC -> Send. It should say phone is unlocked.
Now go to Memory tab, and click Read NV_Items, and you will read NV_Items 455, 466, 1192, and 1194. Save them all.
Step 3: NAM 1 & 2
Stay in CDMA Workshop, and click the NAM Tab. Click “Read” this will display all your phones information inside of “NAM 1” Save the filename as NAM 1 and do the same for NAM 2.
Step 4: M.IP
Close Cdma Workshop. Open Service Programming and enter your Donor phones SPC. Click Read and navigate to the “MIP” Tab, we need your Donor phones NAI. Click on Profile 1 and copy down everything just to be safe. Do the same for Profile 0 if available.
Step 5: HA & AAA Passwords
HA Password for both Profiles will be "secret" in text formatClose Service Programming and open QXDM. Now in the Command Prompt on the top screen type in "SPC [MSL]" Then type in “Requestnvitemread ds_mip_ss_user_prof 1” to retrieve your Profile 1 AAA 6 Digit password. It will be the first 6 Digits in DIAG RX, which is written in HEX mode. For Profile 0, simply open NV_Item 466 all numbers after the number 10 and before the last pair of 0's will be your Profile 0 AAA. Or you can type in QXDM Requestnvitemread ds_mip_ss_user_prof and it will be all the Digits in AAA SHared DIAG RX.
If it says Access Denied it means you do not have a Profile 0. *Dont worry about it*
DONT EVER TURN ON THE DONOR PHONE'S RADIO AGAIN, PUT IT ON AIRPLANE MODE OR SOMETHING
Step 6: Root your HTC DROID INREDIBLE
Follow directions --> http://androidforums.com/incredible...ked-3-rooting-stock-incredible-evo-2-2-a.html
Step 7: Writing NAM and NV Items
Plug in your Droid Incredible to the PC. Open QPST and add its port number. Open CDMA and connect then read the Incredible, next go to Security Tab and under SPC write 000000 and send SPC.
Next go to the "Memory" tab, NV Items and write the 4 NV Items we saved from your donor phone earlier.465, 466, 1192, and 1194. Then navigate to the “NAM” TAB and Write the Nam 1 and Nam 2 Files we saved earlier by clicking Load before each on of them. If done correctly it should display your donor’s phone number and other information.
TYPE IN ##DIAG# IN YOUR DROID TO GO INTO MODEM MODE
Step 8: Zero'ing ESN & MEID
Close CDMA Workshop and open QXDM, Options- Communications- Target Port/ select your Droid Incredible's Port, click OK. You should now be connected to your phone. (if you have any trouble connecting to QXDM make sure you set your com port in QPST Configuration and use the same in Qxdm's communications, So you can actually see what's going on from the View drop down screen, select Command Output. Press F4 to get to the memory view, Change Rows from 8 to 16, Find you HEX MEID and ESN by calling ##786# it will look something like this...
MEID: A1000009C57FQZ
ESN: 8373B5C5
They might have an "0x" in front of them, just ignore that, Now pay close attention, following the example MEID and ESN I provided above you are going to separate every 2 characters and then you are going to flip a few to make it backwards just follow my model and do the same to your numbers.
Original: Separated: Flipped:
MEID A1000009C57FQZ MEID A1 00 00 09 C5 7F QZ MEID QZ 7F C5 09 00 00 A1
ESN 8373B5C5 ESN 83 73 B5 C5 ESN C5 B5 73 83
*Note* Your Meid and Esn will differ from the one used in this guide please find your own and use the same method you will need this to find you Meid and Esn in the memory.
Now the tricky part, you may have to Zero them out several times so it will stick (I would consider zero'ing them several times before restarting the phone)
These are all possible ESN and MEID Locations, [ATTACHED]
At each location, find your Meid or ESN and replace it with Zeros (0) then click Write and goto the next Meid or ESN. Do not alter anything but meids or ESNS. After you Zero'ed them out type the command "Requestnvitemread MEID" and "Requestnvitemread ESN". If its Zero'ed restart the phone, if its not, you missed a spot.
To make sure its been Zero'ed out FOR SURE restart the phone and when is back on dial ##778# click View, then Display and make sure your MEID and ESN is all 0. If its not, then try again.
Step 9: Writing MEID
After you get a message that it's zero than u can proceed to write your ESN or MEID which ever you prefer.
Commands are
requestnvitemwrite scm 0x3a
requestnvitemwrite meid 0x0(Your MEID)
MEID = actual 14 digit meid (not in reverse)
If u are writing MEID no need to write the ESN.
requestnvitemwrite esn 0x(Your ESN)
esn= actual 8 digit esn (not in reverse)
Step 10: Configuring Data
Close QXDM, open Service Programming. Navigate to the M.IP tab.
3G Donor PHONES ONLY: Click profile 0 and click edit. Check and make sure your “NAI” is the correct one for boost mobile. Enter your HA Shared password first, then enter your AAA Password into the text box, next Enter all information that you saved earlier and put them in the required box’s. (it may be different for your area)
NAI:[email protected]
Home address: 0.0.0.0
Primary HA address: 68.28.15.12
Secondary HA address: 68.28.31.12
SPI: 4D2
SPI: 4D2
Rev Tunnel Preferred: Checked now with both passwords hit ok.
Enter your HA Shared password first, then enter your AAA Password into the text box, next Enter all information that you saved earlier and put them in the required box’s
NAI:[email protected] (May varie)
Home address: 0.0.0.0
Primary HA address: 255.255.255.255
Secondary HA address: 68.28.89.76
SPI: 4D2
SPI: 4D2
Rev Tunnel Preferred: Checked now with both passwords hit ok
Make Active User 1.
Write to phone, and restart the Droid Incredible.
Now give yourself a pat in the back because you just Fully Flashed your Droid Incredible to Boost Mobile
I have yet to Know how to configure the USE of MMS, but if you know how to drop it in here .
***THIS GUIDE WAS TAKEN FROM A GUIDE I BOUGHT ON EBAY FOR FLASHING HTC EVO TO BOOST MOBILE, AND MODIFIED TO FIT THE HTC DROID INCREDIBLE***
Any questions?
EDIT** Incase your Data isnt working try this and MAKE SURE, you have this.
1. Make sure your ACTIVE USER is 1.
2. Make sure your HTC INCREDIBLE has the same PRL as your donor phone! (THIS IS HIGHLY IMPORTANT) To extract the PRL from your donor phone simply:
Connect your donor phone, Open 'Service Programming' click 'Read from Phone' enter your MSL, and then click 'Save to File' save it anywhere. You will get a qcn file, and a rl0 file. The 'rl0' file will be the PRL.
Also this happened to me before, lol, MAKE SURE MOBILE NETWORK in 'Menu -> Settings -> Wireless and Networks is TURNED ON !!
Any more questions let me know
UPDATE: Try this by igotanmp3 to get MMS working. NOTE* It does not work with Custom Themes http://forum.xda-developers.com/showpost.php?p=16440594&postcount=69
UPDATE: For Droid Incredible S & 2 FOLLOW --> http://forum.xda-developers.com/showpost.php?p=21668680&postcount=145

So did you ever figure out the mms settings? I've seen some guy in New Jersey doing full flashes on HTC Incredibles on Boost Mobile. I tried to contact him, but it seems like he is somewhat of a prick. I've been racking my brains trying to get the mms working. So far my Dinc has talk, text, internet and Sprint TV working.

I have not yet. How did you get Sprint TV running on the Incredible though?
And i think the guide to flash a HTC Hero to alltel i believe might help... changing the APN username adress and whatnot with APN Manager apk, havent gotten around it though been too busy will try tomorrow.
Sent from my ADR6300 using XDA App

eljean said:
I have not yet. How did you get Sprint TV running on the Incredible though?
And i think the guide to flash a HTC Hero to alltel i believe might help... changing the APN username adress and whatnot with APN Manager apk, havent gotten around it though been too busy will try tomorrow.
Sent from my ADR6300 using XDA App
Click to expand...
Click to collapse
I downloaded the Sprint TV Apk file and that was pretty much it

TRY THIS FOR MMS
MMS
************************************************** *******************************
(My original work)
After making sure web works,
1. Download APN Backup & Restore(Android Market)
2. Click Backup APNs
3. Goto your sdcard/ApnBackupRestore
4. Click the apn file and edit under windows or on your phone.
5. Look for the line that says Production and edit.....
<apn name="Production" numeric="00000" mcc="310" mnc="00" apn="1"
user="[email protected]"(may varie) server="null" password="null proxy="null"
port="" mmsproxy="" mmsport="" mmsprotocol="2.0"
mmsc="http://mm.myboostmobile.com" type="mms" />
6. Save the file(make sure you save it)
7. Open the APN Backup & Restore program
8. Click delete APNs(Very important)
9. Click Restore APNs
10. Close the program
11. Goto messages>menu>settings>connection settings. Make sure everything is as you edited. You should see Name(Production), MMSC(http://mm.myboostmobile.com), MMS proxy(not set), MMS port(not set), MMS protocol(WAP 2.0).
12. If everything is just as it is, viola you are all set...
Taken from http://www.howardforums.com/showthr...lashed-to-Revol-with-working-Internet-and-MMS and fixed to the Boost Mobile apn settings... correct it if its wonrg, Im not 100% sure on the settings...
I haven't tried it yet im still waiting for my MicroSD Card from Ebay :\... lol you be the guinnea pig let me know how it goes

this would go a lot better in the dev section

JoelZ9614 said:
this would go a lot better in the dev section
Click to expand...
Click to collapse
Ahh, I didnt know where else to put it

this is awesome.. what about PTT? does it work?

remy2501 said:
this is awesome.. what about PTT? does it work?
Click to expand...
Click to collapse
Yeah it should

DRIVERS
FORGOT to attach the DRIVERS sorry

Any possible way to go back to verizon MEID?

mttmelton said:
Any possible way to go back to verizon MEID?
Click to expand...
Click to collapse
Just write the original MEID and the phone would provision itself IF it has a clean esn
Sent from my ADR6300 using XDA App

Still no mms on the HTC Droid Incredible on Boost
Just wonder if anyone has figured out the mms settings for the HTC Droid Incredible on Boost Mobile. I paid some guy on Ebay and he emailed me back "here sorry all you do is this:
##3282#
change mms "hxxp;//mm . myboostmobile . com
reboot your phone and test the pics"
I was like WTF ##3282# does not even work on the Incredible, but I already knew the mmsc url. So has anyone figured this little speed bump? I have talk, text, internet & sprint TV working now I just need mms working.

roclikewhat said:
Just wonder if anyone has figured out the mms settings for the HTC Droid Incredible on Boost Mobile. I paid some guy on Ebay and he emailed me back "here sorry all you do is this:
##3282#
change mms "hxxp;//mm . myboostmobile . com
reboot your phone and test the pics"
I was like WTF ##3282# does not even work on the Incredible, but I already knew the mmsc url. So has anyone figured this little speed bump? I have talk, text, internet & sprint TV working now I just need mms working.
Click to expand...
Click to collapse
Same here. I used APN Manager and changed the mmsc url but then it would just give me access denied.
Sent from my ADR6300 using XDA App

Hello,
I read all posts above, but I couldn't understand completely. It is possible use htc incredible 2 on boost mobile?
I can buy one from ebay with clean esn and use it on Boost mobile?
thank you

idk
mttmelton said:
Any possible way to go back to verizon MEID?
Click to expand...
Click to collapse
to be honest with you, I am not entirely sure, theoretically it should be possible but at this moment I do not know since it is a new phone with new software etc etc. And I heard HTC is starting to lock their esn locations with some type of encryption so u cant read it.
Google around u might be able to and if u find someone who says and has backup that is possible come back to this guide and follow it .

for example. Can I activate this on boost mobile?
hxxp://xpressphones.vstore.ca/product_info.php?products_id=379

armars said:
for example. Can I activate this on boost mobile?
hxxp://xpressphones.vstore.ca/product_info.php?products_id=379
Click to expand...
Click to collapse
I did a little bit of research and so far I can conclude that it is not possible. I may be wrong though. I am 90% positive it is not posible YET lol

***THIS GUIDE WAS TAKEN FROM A GUIDE I BOUGHT ON EBAY FOR FLASHING HTC EVO TO BOOST MOBILE, AND MODIFIED TO FIT THE HTC DROID INCREDIBLE***
Click to expand...
Click to collapse
So you could flash it to boost mobile, but couldn't activate?

armars said:
So you could flash it to boost mobile, but couldn't activate?
Click to expand...
Click to collapse
Yeah if your donor phone is already activated

[Q] My cspire r800x(cdma) thinks its a Verizon phone.

Earlier today I had a successful attempt at installing FXP's CM9 126 build. As a requirement I had to flash the R800x_4.0.2.E.57_Verizon.ftf via Flashtool to my phone before I could flash the Rom. My phone's provider is Cspire(formally Cellular South), and after the ftf my phone is trying to make contact with Verizon for activation, leaving my unable to call or text on my own provider. I've tried flashing a nand backup I had of one of Codename Andriod that I created when everything was working perfectly, but it didn't fix the problem.
Thank you for your time and please let me know what I can to fix this.
Sincerely,
Frag_Bag

Frag_Bag said:
Earlier today I had a successful attempt at installing FXP's CM9 126 build. As a requirement I had to flash the R800x_4.0.2.E.57_Verizon.ftf via Flashtool to my phone before I could flash the Rom. My phone's provider is Cspire(formally Cellular South), and after the ftf my phone is trying to make contact with Verizon for activation, leaving my unable to call or text on my own provider. I've tried flashing a nand backup I had of one of Codename Andriod that I created when everything was working perfectly, but it didn't fix the problem.
Thank you for your time and please let me know what I can to fix this.
Sincerely,
Frag_Bag
Click to expand...
Click to collapse
You'll need to change the build.prop and apn settings. Found this from a quick search with someone that has a working verizon build.prop that is said to work on cspire
https://www.dropbox.com/s/dgteu3ziweifix8/build.prop
and his working apn settings:
https://www.dropbox.com/s/6cs5tqwdlcstt3s/apns-conf.xml
Also found this:
You could push the apn with ADB but i just edited mine with root explorer in /System/etc and restarted the phone.
As for CDMA Workshop is a service software for CDMA phones it is used for flashing phones to different carriers to put it plain as possible in my mind but it can be used for countless useful tasks, just Google it to read more. But the below method was much easier.
Dialing ##7764726(##program) is used to manually program your phone.
After dialing ##7764726 press call it will prompt for a SPC password it should be 000000
Then click User Activation
MIN1 I put the last 7 digits of my phone number.
MIN2 put the first three of phone number(area code).
MDN is your 10 digit phone number.
CDMA Sys ID put 1996
IMSI_11_12 put 12
Then hit back and click on SID/NID Pairs:
SID_1: put 1996
NID_1: put 65535
After this hit back till you exit all the way back out of the menu the phone will reboot after it reboots i dialed *22801 it didn't say anything just sat at the activation screen for about 30sec. Then it said reprogramming the phone then rebooted agin after that i was back on C spire.
Links are a little old but this is all I could find:
SID Database if you need to find a different carrier
http://www.the-answerman.com/sidlist/index.asp
Also the SID/NID I used was found in this PRL breakdown:
http://www.howardforums.com/showthread.php/1700374-New-PRL-60575-50575
The Second post of the page explains a lot more about PRL and SID/NID just good to understand what your kinda messing with:
http://forum.xda-developers.com/showthread.php?p=19537266
Also i don't know if this is the best way to accomplish this task but it took me awhile to figure out this fix it worked for me but i can't guarantee anything also im not responsible if something goes wrong and you brick(its always possible) but i am willing to help to the best of my abilities
Good Luck and sorry for such a long post.

agraceful said:
You'll need to change the build.prop and apn settings. Found this from a quick search with someone that has a working verizon build.prop that is said to work on cspire
https://www.dropbox.com/s/dgteu3ziweifix8/build.prop
and his working apn settings:
https://www.dropbox.com/s/6cs5tqwdlcstt3s/apns-conf.xml
Also found this:
You could push the apn with ADB but i just edited mine with root explorer in /System/etc and restarted the phone.
As for CDMA Workshop is a service software for CDMA phones it is used for flashing phones to different carriers to put it plain as possible in my mind but it can be used for countless useful tasks, just Google it to read more. But the below method was much easier.
Dialing ##7764726(##program) is used to manually program your phone.
After dialing ##7764726 press call it will prompt for a SPC password it should be 000000
Then click User Activation
MIN1 I put the last 7 digits of my phone number.
MIN2 put the first three of phone number(area code).
MDN is your 10 digit phone number.
CDMA Sys ID put 1996
IMSI_11_12 put 12
Then hit back and click on SID/NID Pairs:
SID_1: put 1996
NID_1: put 65535
After this hit back till you exit all the way back out of the menu the phone will reboot after it reboots i dialed *22801 it didn't say anything just sat at the activation screen for about 30sec. Then it said reprogramming the phone then rebooted agin after that i was back on C spire.
Links are a little old but this is all I could find:
SID Database if you need to find a different carrier
http://www.the-answerman.com/sidlist/index.asp
Also the SID/NID I used was found in this PRL breakdown:
http://www.howardforums.com/showthread.php/1700374-New-PRL-60575-50575
The Second post of the page explains a lot more about PRL and SID/NID just good to understand what your kinda messing with:
http://forum.xda-developers.com/showthread.php?p=19537266
Also i don't know if this is the best way to accomplish this task but it took me awhile to figure out this fix it worked for me but i can't guarantee anything also im not responsible if something goes wrong and you brick(its always possible) but i am willing to help to the best of my abilities
Good Luck and sorry for such a long post.
Click to expand...
Click to collapse
I was able to enter all the values for MIN2, MDN, CDMA, and IMSI, but the MIN1 Keeps telling me "Unable to set new parameter, I made sure there was a 1 before my 7 digit number. Thoughts?

Frag_Bag said:
I was able to enter all the values for MIN2, MDN, CDMA, and IMSI, but the MIN1 Keeps telling me "Unable to set new parameter, I made sure there was a 1 before my 7 digit number. Thoughts?
Click to expand...
Click to collapse
I don't think you'll need the 1. Just the last 7 numbers. Try that to see if it works. And just so you know, I'm on verizon so all my answers are coming from google at the moment lol

I left the number the way it was and finished the steps, everything is working as it should and I can call and text. Thank you very much. Now i just have to find a fix for Mobile data. I really do appreciate it.

Frag_Bag said:
I left the number the way it was and finished the steps, everything is working as it should and I can call and text. Thank you very much. Now i just have to find a fix for Mobile data. I really do appreciate it.
Click to expand...
Click to collapse
Mobile data would be in the build.prop and the apn settings, You should be able to use pieces from the build.prop I posted to work whatever rom you're on. I got to assume verizon and cspire are close to identical since they're both cdma. Half way there right?

agraceful said:
Mobile data would be in the build.prop and the apn settings, You should be able to use pieces from the build.prop I posted to work whatever rom you're on. I got to assume verizon and cspire are close to identical since they're both cdma. Half way there right?
Click to expand...
Click to collapse
Are these settings still current cspire settings... I lost 3g connectivity and would love to troubleshoot to figure out whats wrong with it... I did the ##Program and here are my settings
USER ACTIVATION MENU
MIN-my number with area code
IMSI_11_12 =23
MDN - my number with area code
CDMA system ID - 1996
EXTENDED NAM MENU
MIN = another local number
TRUE IMSI - 000000000007809
IMSI_11_12 = 23
MDN - my number with area code
CDMA system ID - 1996
Country code - 311
CDMA network - 65535
1st channel A - 283
1st channel B - 384
2nd channel A - 691
2nd channel B - 777
Access overload class 0

URGENT
im having the same issue when i use ##program and dail it does nothing but act like a collect call HELP
on cm9

Thanks...
agraceful said:
You'll need to change the build.prop and apn settings. Found this from a quick search with someone that has a working verizon build.prop that is said to work on cspire
https://www.dropbox.com/s/dgteu3ziweifix8/build.prop
and his working apn settings:
https://www.dropbox.com/s/6cs5tqwdlcstt3s/apns-conf.xml
Also found this:
You could push the apn with ADB but i just edited mine with root explorer in /System/etc and restarted the phone.
As for CDMA Workshop is a service software for CDMA phones it is used for flashing phones to different carriers to put it plain as possible in my mind but it can be used for countless useful tasks, just Google it to read more. But the below method was much easier.
Dialing ##7764726(##program) is used to manually program your phone.
After dialing ##7764726 press call it will prompt for a SPC password it should be 000000
Then click User Activation
MIN1 I put the last 7 digits of my phone number.
MIN2 put the first three of phone number(area code).
MDN is your 10 digit phone number.
CDMA Sys ID put 1996
IMSI_11_12 put 12
Then hit back and click on SID/NID Pairs:
SID_1: put 1996
NID_1: put 65535
After this hit back till you exit all the way back out of the menu the phone will reboot after it reboots i dialed *22801 it didn't say anything just sat at the activation screen for about 30sec. Then it said reprogramming the phone then rebooted agin after that i was back on C spire.
Links are a little old but this is all I could find:
SID Database if you need to find a different carrier
http://www.the-answerman.com/sidlist/index.asp
Also the SID/NID I used was found in this PRL breakdown:
http://www.howardforums.com/showthread.php/1700374-New-PRL-60575-50575
The Second post of the page explains a lot more about PRL and SID/NID just good to understand what your kinda messing with:
http://forum.xda-developers.com/showthread.php?p=19537266
Also i don't know if this is the best way to accomplish this task but it took me awhile to figure out this fix it worked for me but i can't guarantee anything also im not responsible if something goes wrong and you brick(its always possible) but i am willing to help to the best of my abilities
Good Luck and sorry for such a long post.
Click to expand...
Click to collapse
Thanks for copying and pasting all this from my thread you could have atleast acknowledged me since it's basically word for word
http://forum.xda-developers.com/showthread.php?t=1624990

[Q] AAA key for profile 1 shows up as all 00's in QXDM - Where can I find it?

I've searched around for the past couple days trying to figure out how to pull the AAA key from profile 1 on my OG EVO and I didn't have any luck finding what I need.
I've tried using QXDM:
I unlocked the phone using "spc 'msl'"
It confirms that the phone is unlocked
I entered "requestnvitemread ds_mip_ss_user_prof 1"
the result is all 0's
I've tried running "adb logcat > c:\dump.txt" and ##DATA# in edit mode.
I edited the user and the aaa shared secret and pressed cancel
Looked through the log and I'm not seeing anything jumping out at me.
I did a search for what I already know as the HA key in hex and ascii and I'm not seeing it in the log either.
I've heard you can pull the profile 1 aaa key from nv item 466.
I took a look at the one that came off my phone and it's all 00'd out.
I downloaded the DFS demo and I can read almost everything on that phone except the keys.
My question is how can I pull the proflie1 - 6-digit Sprint key from an EVO?
edit: I originally said I was looking for profile 0 key - I already have that - I'm looking for the profile 1 aaa key.
-thanks Klown80 for pointing that out.

xdapark said:
I've searched around for the past couple days trying to figure out how to pull the AAA key from profile 0 on my OG EVO and I didn't have any luck finding what I need.
I've tried using QXDM:
I unlocked the phone using "spc 'msl'"
It confirms that the phone is unlocked
I entered "requestnvitemread ds_mip_ss_user_prof"
the result is all 0's
I've tried running "adb logcat > c:\dump.txt" and ##DATA# in edit mode.
I edited the user and the aaa shared secret and pressed cancel
Looked through the log and I'm not seeing anything jumping out at me.
I did a search for what I already know as the HA key in hex and ascii and I'm not seeing it in the log either.
I've heard you can pull the profile 0 aaa key from nv item 466.
I took a look at the one that came off my phone and it's all 00'd out.
I downloaded the DFS demo and I can read almost everything on that phone except the keys.
My question is how can I pull the proflie0 - 6-digit Sprint key from an EVO?
Click to expand...
Click to collapse
Profile 0 will be a 32 digit key, pro 1 is a 12 digit key. Does data work on the Evo currently? If so try going to settings, system updates, update profile.then try reading the profile 0 again.

Klown80 said:
Profile 0 will be a 32 digit key, pro 1 is a 12 digit key. Does data work on the Evo currently? If so try going to settings, system updates, update profile.then try reading the profile 0 again.
Click to expand...
Click to collapse
you're right - it's the profile 1 key im looking for.
I updated my post and title to reflect that.
I just did a profile update and it shows all 00's
then i tried this:
factory reset and a ##RTN# reset - reboot - OTA activated - updated profile and ran "requestnvitemread ds_mip_ss_user_prof 1"
still shows all 00's
for what it's worth profile 0 and profile 1 ha and aaa keys show up as 00's in QXDM
I restored back to the original factory image (baseband 2.15.00.11.19) I made before I ever rooted the phone to see if that makes a difference.
it didn't
Can anybody confirm that QXDM 3.11.36 can read the profile keys from an EVO?
Im using some HTC Diag drivers that only seem to work with XP even though a 32 and 64 bit driver was included in the zip.
Is there any way I can do some kind of memory dump to locate it?

xdapark said:
you're right - it's the profile 1 key im looking for.
I updated my post and title to reflect that.
I just did a profile update and it shows all 00's
then i tried this:
factory reset and a ##RTN# reset - reboot - OTA activated - updated profile and ran "requestnvitemread ds_mip_ss_user_prof 1"
still shows all 00's
for what it's worth profile 0 and profile 1 ha and aaa keys show up as 00's in QXDM
I restored back to the original factory image (baseband 2.15.00.11.19) I made before I ever rooted the phone to see if that makes a difference.
it didn't
Can anybody confirm that QXDM 3.11.36 can read the profile keys from an EVO?
Im using some HTC Diag drivers that only seem to work with XP even though a 32 and 64 bit driver was included in the zip.
Is there any way I can do some kind of memory dump to locate it?
Click to expand...
Click to collapse
As long as you have a working profile 0, you can get the phone to OTA and write your profile 1 for you completely. Are you on Boost or Sprint? Unfortunately it sounds like your keys may have got erased somehow, if it does not read in QXDM, DFS, or NV items (Item 466 or 1192 should have it). Does your data work right now? Try just using "requestnvitemread ds_mip_ss_user_prof" that should read your profile 0 key, if we can get at least the profile 0 info the phone will take care of the rest. I have another idea we can try if you can not read profile 0 info. I also have htc drivers that work just fine for me on Win 7 32 bit if you want them, I have a 64 bit Win 7 driver too but have not used it yet so cant confirm it works. I have QXDM 3.09.19 and I know for sure it reads the profile keys, looks like you have a newer version so I assume it would work too.

Klown80 said:
As long as you have a working profile 0, you can get the phone to OTA and write your profile 1 for you completely. Are you on Boost or Sprint? Unfortunately it sounds like your keys may have got erased somehow, if it does not read in QXDM, DFS, or NV items (Item 466 or 1192 should have it). Does your data work right now? Try just using "requestnvitemread ds_mip_ss_user_prof" that should read your profile 0 key, if we can get at least the profile 0 info the phone will take care of the rest. I have another idea we can try if you can not read profile 0 info. I also have htc drivers that work just fine for me on Win 7 32 bit if you want them, I have a 64 bit Win 7 driver too but have not used it yet so cant confirm it works. I have QXDM 3.09.19 and I know for sure it reads the profile keys, looks like you have a newer version so I assume it would work too.
Click to expand...
Click to collapse
I had a working profile 0 - I couldnt' pull the key using "requestnvitemread ds_mip_ss_user_prof"
FWIW - I could retrieve it from 1192 and by running "requestnvitemread hdr_an_auth_passwd_long"
Out of curiosity - is there a similar command that pulls from 1?
my 466 was completely 00'd out.
I'm not too worried about it anymore - my issue is resolved now.
My problem was I couldn't get 3g working on my gnex.
You let me know the aaa key would be written as long as I had a working profile 0 so I looked for the key on my gnex.
I ran logcat on the gnex and I was able to see the key I was looking for.
I ran around for a few days with no 3g.
After I pulled the key from the gnex and re-wrote it to that same gnex - 3g started working.
Then I made a test call and got error 16.
After I talked to the sprint rep and rebooted - everything worked fine.
thanks for everything - looks like I'm good to go now.:victory:

AAA Help
xdapark said:
I had a working profile 0 - I couldnt' pull the key using "requestnvitemread ds_mip_ss_user_prof"
FWIW - I could retrieve it from 1192 and by running "requestnvitemread hdr_an_auth_passwd_long"
Out of curiosity - is there a similar command that pulls from 1?
my 466 was completely 00'd out.
I'm not too worried about it anymore - my issue is resolved now.
My problem was I couldn't get 3g working on my gnex.
You let me know the aaa key would be written as long as I had a working profile 0 so I looked for the key on my gnex.
I ran logcat on the gnex and I was able to see the key I was looking for.
I ran around for a few days with no 3g.
After I pulled the key from the gnex and re-wrote it to that same gnex - 3g started working.
Then I made a test call and got error 16.
After I talked to the sprint rep and rebooted - everything worked fine.
thanks for everything - looks like I'm good to go now.:victory:
Click to expand...
Click to collapse
Maybe you can help me out, everything on the phone works except for 3g in debug under evdo protocol it says an-aaa fail and i tried:
requestnvitemread hdr_an_auth_passwd_long and requestnvitemread ds_mip_ss_user_prof both give me:
Request:
0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000015407E
Response:
004F6374203136203230313232333A31343A34384F637420303120323031324C3731302E31340041414141414E415A3A06FF70000206B1EE307E
where do i go from here any ideas?

thewire1o1 said:
Maybe you can help me out, everything on the phone works except for 3g in debug under evdo protocol it says an-aaa fail and i tried:
requestnvitemread hdr_an_auth_passwd_long and requestnvitemread ds_mip_ss_user_prof both give me:
Request:
0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000015407E
Response:
004F6374203136203230313232333A31343A34384F637420303120323031324C3731302E31340041414141414E415A3A06FF70000206B1EE307E
where do i go from here any ideas?
Click to expand...
Click to collapse
If it says AN-AAA = fail then your profile 0 info is not correct. Make sure username and AAA is correct HA will be 736563726574. Look in NV item 466 or 1192 to see if your pro 0 32 digit AAA is in there, it will start after the "10"

Same boat
xdapark said:
I had a working profile 0 - I couldnt' pull the key using "requestnvitemread ds_mip_ss_user_prof"
FWIW - I could retrieve it from 1192 and by running "requestnvitemread hdr_an_auth_passwd_long"
Out of curiosity - is there a similar command that pulls from 1?
my 466 was completely 00'd out.
I'm not too worried about it anymore - my issue is resolved now.
My problem was I couldn't get 3g working on my gnex.
You let me know the aaa key would be written as long as I had a working profile 0 so I looked for the key on my gnex.
I ran logcat on the gnex and I was able to see the key I was looking for.
I ran around for a few days with no 3g.
After I pulled the key from the gnex and re-wrote it to that same gnex - 3g started working.
Then I made a test call and got error 16.
After I talked to the sprint rep and rebooted - everything worked fine.
thanks for everything - looks like I'm good to go now.:victory:
Click to expand...
Click to collapse
hello I'm on the same step you were, could you please post how did you pulled the key from the Gnex? was it with ETS? Thanks a bunch!!

[primoc]method to gain your nv keys for backup

k guys, this thread is coming about after respectfully moving the discussion from kalaker's s-off thread.
i've been looking for a while about how to back up my nv keys for data, just in case anything happens to my one v. this is thanks to New Optimus (for steps 8-10) and jmztaylor, who informed me the open sesame door trick works. I AM NOT RESPONSIBLE FOR HOW SOME MAY USE THIS. open sesame door trick has the potential to screw your phone up if you dont do it right, or delete an nv item.
CDMA ONLY (i dont think gsm works the same way anyway)
YOU ARE NOT MODIFYING ANYTHING. All you are doing is backing up your AAA and HA keys. they are used to identify and register your device's data on the VM network. IF YOU MODIFY ANYTHING, ITS YOUR FAULT IF YOU SCREW IT UP.
step 1:
download and install qpst. im not linking to the file, you should be able to find it easily enough by googling it.
step 2:
open up qpst configuration, and let it sit in the background for a minute. install the htc diag drivers for one v from here: http://www.htc.com/www/support/
look for the one v, and download and install the HTC Sync program which will install all the drivers you need.
step 3:
close out of htc sync once its installed, its an annoying program anyway. connect your phone, make sure adb debugging is enabled in developer options in settings. open the dialer, type in ##3424# (##diag#) and a screen will come up that says on and off, with select at the bottom. click on, then select, and it will ask you for your msl code.
note: your msl code can be obtained by a app in market called MSL Reader, you need root for this. follow the prompts in the app, its easy enough to do.
step 4:
after entering your msl code and entering diag mode, go back into qpst configuration. click on "add new port" toward the bottom right, and make sure when the window opens "COMx- USB/QC Diagnostic" is selected and click ok. qpst configuration should now recognize your phone as SURF-MSM7830. if it doesnt, update your version of qpst.
step 5:
in qpst configuration, click on "Start Clients- EFS Explorer". make sure you put your msl in the box that says spc, and click ok. a please wait window will pop up, it will only take a few seconds.
from New Optimus's post: http://forum.xda-developers.com/showpost.php?p=29951978&postcount=796
8. Once the phone reads completely make a new directory named (open sesame door) without the parentheses and all lower case
9. After making the new folder locate abd.exe from the android sdk install folder and press: start, run and type cmd then press enter you will get a command prompt window that opens up navigate to the android sdk directory and type; adb reboot, the phone should then reboot if you’ve done as you were supposed to.
10. After the phone reboots read it again with QPST EFS Explorer which still should be opened, you will notice that the red no access circle has been removed from the nvm directory so expand it and go to the num directory,
Click to expand...
Click to collapse
(note: edited New Optimus's post to remove links to esn/meid changing which is frowned upon in the forums, also i already had the open sesame door folder created upon making the pictures.)
left click and drag 465, 466, 1192 and 1194 to your desktop.
keep 465,466, 1192 and 1194 in a safe spot, they are how you have data on your phone. if something happens to your HOV and those are gone, good luck getting data back.

Quick noob question, do these files get generated by the carrier when you activate the phone?

whoshotjr2006
Do AKEY, SSDA and SSDB files need to be saved? if so, where are the files?

reachforthesky said:
whoshotjr2006
I know the content of file 0 and 1943. Could you briefly describe the contents of these 4 files (465, 466, 1192 and 1194)? Which one is HA, AAA, SSDA and SSDB? Are there any more important NVM files need to be saved?
Click to expand...
Click to collapse
465^"Data Services Mobile IP General User Profile"^"Data*"
466^"Data Services Mobile IP Shared Secret User Profile"^"Data*"
1192 is the AAA secret
1194^"HDR Access Network Stream CHAP Authentication User ID"^"Data*"
The reference is here: http://forum.xda-developers.com/showthread.php?t=1954029

Got sooo excited when I saw this. Used to switch firmware's on my optimus v with the firmware of the optimus s, and use optimus s roms. Had all of my nv data and everything else backed up. Forgot you have to have be on an aosp rom for this to work because you need a port. -_- I don't have a stock backup and right now I'm tethering, so it'd take awhile to download a stock backup. Guess I'll have to wait a week or so.

nvm, I found a backup. I tried it out, and i got to the qpst efs explorer. I did the open sesame door, and it unlocked the nvs, but I only had a couple of the files from the list. I did not have 465 or 466. Also, I had an issue when I tried to recognize the phone. It did recognize the phone in diag mode with the port, but not as surfmsm7830. I have the most updated version of qpst.

I'll have to check what version I'm running of qpst, I know its close to the newest if not the newest. It wouldn't recognize my phone correctly until I had a new enough copy.
Also the first time I tried the open sesame door trick, I too had the limited nv items. I used the ruu to go back to stock, and once I did that the open sesame folder dir survived the ruu and unlocked the rest of the nv items.
Hope that helps.
Sent from my One V using xda app-developers app

What version of QPST are you using for this? I get an error "Online connection failure: Unspecified error" when trying to connect.
I think my phone isn't getting read properly by QPST because under phone it says "(unknown)" even though the other fields fill in correctly.
CDMA Workshop reads my phone no problem, but this thing no luck.
EDIT: Found an updated build and it displays the specified info under phone. Not sure what the lowest working version is, but v2.7 build 323 will not read it, build 366 will though.

Stopping Hands Free Activation!

My friend Jeremy helped me with getting rid of the "Hands Free Activation" pop-up and I thought I would share it. It especially comes in handy when you are flashed to another carrier. If you are on one of the new custom ZVB Roms you probably don't have to worry about it. All you have to do is:
1) Get a Root File Browser .... I like Rom Tool Box
2) Go to "System" folder
3) Go to "App" folder .... (not Apps)
4) Scroll down and find "OmaDmclient.apk" and rename it to "OmaDmclient.bak"
5) Reboot and you should not get that aggravating ass pop up any more
:silly::laugh:
I hope I've helped someone because a lot of people have damn sure helped me!

Just Showing Off
Since this thread is my posting I wanted to show off my Speedtest results of 3g being "legally" flashed to Page Plus
http://i43.tinypic.com/ezg6l3.jpg

I could use some help through this process
devo3d said:
Since this thread is my posting I wanted to show off my Speedtest results of 3g being "legally" flashed to Page Plus
Honestly, I'd like to start with getting any data (non-wifi) working on this phone...
What I have tools wise? CDMA Workshop
LGNPST (not working) frustrated as heck about this
My LS970 - updated to Page Plus PRL and making and recieving calls...
Can someone point me in the right direction?
Click to expand...
Click to collapse

eagleveteran said:
devo3d said:
Since this thread is my posting I wanted to show off my Speedtest results of 3g being "legally" flashed to Page Plus
Honestly, I'd like to start with getting any data (non-wifi) working on this phone...
What I have tools wise? CDMA Workshop
LGNPST (not working) frustrated as heck about this
My LS970 - updated to Page Plus PRL and making and recieving calls...
Can someone point me in the right direction?
Click to expand...
Click to collapse
have you try DFS Tools? I always use this tools flashing from sprint to smartfren (Indonesian provider)
Click to expand...
Click to collapse

eagleveteran said:
devo3d said:
Since this thread is my posting I wanted to show off my Speedtest results of 3g being "legally" flashed to Page Plus
Honestly, I'd like to start with getting any data (non-wifi) working on this phone...
What I have tools wise? CDMA Workshop
LGNPST (not working) frustrated as heck about this
My LS970 - updated to Page Plus PRL and making and recieving calls...
Can someone point me in the right direction?
Click to expand...
Click to collapse
I know I'm late responding to this but what service provider are you flashed to? ( if you haven't found a solution yet )
Click to expand...
Click to collapse

Page Plus
devo3d said:
eagleveteran said:
I know I'm late responding to this but what service provider are you flashed to? ( if you haven't found a solution yet )
Click to expand...
Click to collapse
Page Plus
Click to expand...
Click to collapse

Thank You
I was really annoyed with the popup.
Thanks for the solution :good::good:

lnxnubie said:
I was really annoyed with the popup.
Thanks for the solution :good::good:
Click to expand...
Click to collapse
No Probelem....The guy I use to use to flash phones figured it out....he was the only one (entire USA) that knew how to flash the OG to Verizon and get full data (3G). He quit flashing phones from where he was living so now I can't get in touch with him...he could flash any freakin phone..

eagleveteran said:
devo3d said:
Page Plus
Click to expand...
Click to collapse
With Page Plus and Straight Talk you have to have certain APN's set. Is your APN correctly set for Page Plus?
EDIT: ( I don't even know if I can post this but I sure admin will let me know...LOL)
I found this in my files, used it long ago and am not sure if it still is applicable but there may some information in it that may be able to lead you in the right direction......
PP
3G data speeds (HOW TO)
This guide is to get evdo data or 3g data speeds on phones flashed to page plus cellular this is not a beginers guide by no means this guide is assuming both spc codes are set to 000000.
things you will need:
1.A donor phone of your own that will ota program and one that you can swap the esn number to that of the target phone. I used a samsung i500
2.Target phone that you own
3.qpst and dfs 4.0.0.4 demo
4.drivers for both phones
Pre-Setup:
1.pull battery out of the target phone and LEAVE it out
2.place that esn number on the donor phone
3.Deactivate then reactivate the target phones esn number
4.OTA program the donor phone that has the swapped esn number on it.
5.Verify that 3g speeds are working on the donor phone
Phase 1:
1.Place donor phone in diagnostic mode and plug into computer
2.Open qpst configuration add the port
3.Go to start clients then efs explorer
4.Open the DMU folder and copy the 10.key file to your computer then exit qpst
Phase 2:
1.Open DFS and select the port that the phone is on
2.Send the spc you should see a device unlocked message in the log.
3.Go to the programming tab then the nam tab and read that page.
4.Read the Data tab and Mobile IP tab as well.
5.Do not close the dfs tab
6.Revert esn back to normal or smash the donor phone into a lot of pieces
Final Phase: (Non-Verizon and Sprint)
1.Power on target phone and place in diagnostic mode and plug into computer
2.Open qpst configuration add the port
3.Go to start clients then efs explorer
4.Now on the Left side of the efs explorer right click the screen go to new and directory
5.Name the directory "DMU" without the quotation marks then place the 10.key file into that directory by drag and drop then exit qpst
6.Now go back into dfs do not add the target phone yet and go to mobile ip nothing else on the screen should change
7.Now select the port the target phone is on in dfs and send the spc code
8.Write the nam tab to target phone after verifing it doesnt say home only then go to data tab and check the box next to pwd on the ppp section only which will change the pwd to hex format then write the data tab
9.Go to the mobile ip tab and right click the red stop sign looking thing on the second bubble and enable it and set active profile to 1 then click "write current profile settings" and click the write button on the left side of the screen
10.Now go back to the Nam tab and load the prl file I prefer using 00002 but you can experiment
Final Phase: (Verizon 4gLTE)
1.Power on target phone and place in diagnostic mode and plug into computer
2.Open qpst configuration add the port
3.Go to start clients then efs explorer
4.Now on the Left side of the efs explorer right click the screen go to new and directory
5.Name the directory "DMU" without the quotation marks then place the 10.key file into that directory by drag and drop then exit qpst
6.Now go back into dfs do not add the target phone yet
7.Now select the port the target phone is on in dfs and send the spc code
8.Write the nam tab to target phone after verifying it doesn't say home only then go to data tab and check the box next to pwd on the ppp section only which will change the pwd to hex format then write the data tab
9.Go to the mobile ip tab click "write current profile settings" and click the write button on the left side of the screen
10.Now go back to the Nam tab and load the prl file i recommend 00002 but experiment with what you want and reboot phone and enjoy
Having issues try getting 1x first on lte phones you will need a sim card unactivated by verizon and it should pop up after a minute or two should never take longer than 15 minutes the first time
make sure you have it set to nv only on lte handsets.
Need a guide for a specific model name it I'll write it for you step by step for a small fee.
Note I have not tested this on any apple product so cannot support them.
Between getting 1x and then going to target phone must be on airplane mode after esn on account is switched back
Read more: http://www.cricketusers.com/page-plus-cellular/38824-page-plus-3g-data-speeds-how.html#ixzz2VLa0LfsP
ANOTHER EDIT : SOMETHING I FORGOT ABOUT YOUR MMS
Steps to MMS (picture mail) configuration: This is only one way, but it works...
1. Open the messaging app and press menu and select settings.
2. Uncheck EVERY item in the settings and exit the app with the back button.
3. Open your browser and go to the URL "mms.ihavegreat.info" and download
4. Pull down the top of your screen and wait for the app to finish downloading
5. Tap the app to install and let it authorize and setup
6. Remove the stock messaging app from homescreen and replace with this new one.....(may also disable the original message app)
7. Reboot the phone and you should have working MMS
Click to expand...
Click to collapse