I was originally going to just pass this info along for Closeone to put in his thread but he talked me into writing this little how-to. Thanks Closeone!
DISCLAIMER: I am not responsible for anything that may happen with your phone using the method described herein. QPST and QXDM are very, very powerful and can break a phones carrier info if not used properly.
YOU HAVE BEEN WARNED!
This method only works if you use QPST to backup your carrier info BEFORE downgrading and/or using revolutionary to root/S-OFF AND you take special note of your MEID and ESN.
BACKGROUND:
I am a boost mobile user with a flashed HTC Evo 3D and although I did downgrade perfect to HBOOT 1.4 S-OFF using the tools and methods found here on XDA (Thanks Unknownforce and Closeone!), it also wiped my flash info. I learned all this by being especially paranoid after hearing the same garbage some others have heard about not being able to flash roms on a Carrier flashed phone. Of course I didn’t get my hands on the donor phone that was used so I reverse engineered the flashing process by doing online digging and research.
Ok so on with the show!
Things you’ll be needing:
HTC Diagnostic drivers
CDMA Workshop 2.7+
QPST 2.7 Build 355
QXDM 3.9.19
Android SDK
HxD Hex editor
APN Backup and Restore
------------------------------------------------------------------------------------
Using APN Backup and Restore, backup your APN. This is your MMS info.
While using QPST, QXDM or CDMA Workshop we will be keeping the Evo 3D in Diagnostics mode. To do this open your dialer and enter “##DIAG#” as if you were dialing a phone number.
On your phone in “About phone” and then “Phone Identity” copy your MEID!
In CDMA Workshop, "Security" tab, SPC (Also known as an MSL code) – type in your SPC (MSL) - send. Note that your MSL if using a pre-flashed phone is probably “000000”. You should get a message saying that the SPC code is correct and the phone is unlocked.” Once the phone is unlocked, click on the memory tab. go to NV Items read and save items: 465,466,1192,1194; they must be saved one at a time so for example the First NV Item: 465/ Last NV Item: 465 click OK and save it as 465 then move on to the next item and do the same. Remember to save it somewhere handy, as we will need the later on. Occasionally depending on the type of phone that was used for a donor there might not be anything in 1192 or 1194 that’s ok. While still in CDMA Workshop click the NAM Tab. Click “Read” this will display all your phones information inside of “NAM 1” Save the filename as NAM 1 and do the same for NAM 2.
Now close Cdma Workshop. Open up QPST Service Programming (IF YOU HAVE NOT ALREADY, TAKE NOTE OF YOUR “MEID” AND “ESN”) and enter your phones SPC. Click Read and SAVE. Now navigate to the “MIP” Tab, we need your phones NAI. Click on Profile 1 and copy down your “NAI”, Primary HA and secondary HA address, MN-HA SPI1, MN-AA SPI1 and then note if “Rev-Tunnel Preferred” is checked or not.
Ok now Close QPST Service Programming and open up QXDM. In the command input windows type. Password 000000 (or whatever MSL you have) hit enter. Now type “Requestnvitemread ds_mip_ss_user_prof” without quotes . This will find your Ha Shared and AAA Passwords for profile 0. HA Shared which should be “736563726574” if youre on boost like me. For your AAA Provisioning password open up Nvitem 466 and read your 32 digit password after the “10”, save and return back to Qxdm. Now enter “Requestnvitemread ds_mip_ss_user_prof 1” for Profile 1, once again you HA Shared will be “736563726574” if youre on boost then scroll down for your AAA Password, this password will be 6 digits long located starting after the line “mn_aaa_shared_secret_length = 0x06”.
Ok good, that’s all the info you need to keep safe. Now the procedure for recovering the flash using this info! It’s actually quite simple, we’re just going to take the steps above and now load and apply them instead of saving them.
Throw that sucker into diagnostics mode like earlier and now plug it into your computers USB and fire up CDMA Workshop and enter your SPC/MSL. Remember The NAM info we saved? Click the NAM tab then load the saved file (NAM1 for NAM1, NAM2 for NAM2 DO NOT WRITE THEM TO THE WRONG PLACE!).
Next open QPST, enter your security info (SPC/MSL) and then read from the phone. After it loads your phones info click load, find the QPST saved file we created earlier and click write. Your phone will reboot after which open QPST back up and click read again. Make sure all the info is correct compared to what I mentioned to write down. If all is correct onto the next step!
Most likely all your info is correct except for the MEID/ESN.
Now, due to the respected rules and regulations of this forum and the powers that control/own it I cannot go into detail as to the process of correcting your MEID/ESN. If you need any assistance in this matter please PM me and I will set you on the right path. I really don't mind especially since it's a crucial part should your flash die. I will NOT answer posts to this question you MUST PM me. Sorry for the inconvenience!
Now you can restore your APN using APN Backup and Restore after which you should reboot your phone. Once it’s up and running connect to any WIFI and then update your Profile and then your PRL. I’m not sure if doing it in that order or even being connected to wifi is necessary but that’s what I did and it worked for me. You should now be back to full flash and 1.4 HBOOT!
I hope this helps because it was a complete nightmare during the 6 straight hours it took to solve this issue and I’d hate for anyone else to go through all that.
Very nice! Thank you!
I don't have a flashed phone so only part of this is what I need. Well its sorta flashed, half virgin mobile and half sprint. just wondering if I can just do the paragraph about getting the AAA key?
wikdNoob said:
Very nice! Thank you!
I don't have a flashed phone so only part of this is what I need. Well its sorta flashed, half virgin mobile and half sprint. just wondering if I can just do the paragraph about getting the AAA key?
Click to expand...
Click to collapse
No sir. If all you need is the AAA and HA then that paragraph should do the trick.
joe, do you think any of this would fix issues with the Virgin Mobile firmware flashers? Sorry to "hijack" sorta.
jlechner said:
joe, do you think any of this would fix issues with the Virgin Mobile firmware flashers? Sorry to "hijack" sorta.
Click to expand...
Click to collapse
I believe the Virgin Mobile issue pertains more specifically to the HTC firmware not really carrier information. The only good QPST or QXDM would do is copy or change carrier info not how the phone actually functions.
Sorry.
-Joe
I'm on Boost right now and I paid some to flash me to Boost. My question is, what steps I need to take if I want my phone back to sprint?
Lol yea I had to flash back to cricket after downgrading
Sent from my PG86100 using xda premium
shook187 said:
I'm on Boost right now and I paid some to flash me to Boost. My question is, what steps I need to take if I want my phone back to sprint?
Click to expand...
Click to collapse
If you want to revert back to sprint do a hard reset. I believe it's ##msl# and then do reset.
Sent from my PG86100 using Tapatalk 2
joefanelli said:
If you want to revert back to sprint do a hard reset. I believe it's ##msl# and then do reset.
Sent from my PG86100 using Tapatalk 2
Click to expand...
Click to collapse
I think the hard reset is actually ##rtn#
Need a little help here please. In the memory tab, i click read on the nv items area then a box pops up that says nv-items backup. there is a range dec and a range hex. each has a start and end box, which do i put 465 in? tia
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Sorry, I'll answer asap. I'm having computer trouble but it should be fixed later today.
Sent from my PG86100 using Tapatalk 2
joefanelli said:
In CDMA workshop 2.7.0 are you going to the memory tab then pressing the read button in the NV Items box? Upon doing so you should be presented with a dialog box with two separate boxes asking for a range. Within those boxes enter 465,466,1192,1194; they must be saved one at a time so for example the First NV Item: 465/ Last NV Item: 465 click OK and when the save box pops up save it as 465 then move on to the next item and do the same.
Did you click the drop down menu to the left of the command box and select "Command Output"? You should then enter in the command input "Password 000000" and the output should say something like "Password accepted at the bottom of the output". If it does not then double check your SPC by using MSL reader from Google Play and try that"
I hope this helps and sorry again for the delay, this past month has proven to be quite taxing.
-Joe
Click to expand...
Click to collapse
Don't worry about delay man, its all good. I'm subscribed to this thread so ill get the notification when you get back. No rush, really....
I figured out my problem with qxdm, I was using the wrong version, and it says the version that I need right in the op, sorry bout that. I got the readnvitems command to work and I looked at the bottom set of diag rx items and all of the outputs under AAA, 0-15 just say 0x00. Why is it all zeroed out? And the HA secret and AAA in profile 1 is all zeroes.
About cdmaws... I'm gonna make sure I have the right version of that tonight. I probably don't.
OK, thread restored and moved to the correct section as this is not development.
That is a strange situation sir! Now that my thread is back I'll try and play around with QXDM and see why it would come up all zero's.
joefanelli said:
That is a strange situation sir! Now that my thread is back I'll try and play around with QXDM and see why it would come up all zero's.
Click to expand...
Click to collapse
Strange indeed. Like I said, I did the command for profile 0 and it showed about 6 numbers, like 2 numbers on line zero, 2 numbers on line 1, and 2 numbers on line 2. All the rest are zeros and the AAA area was just all zeroes. Tried the command for profile 1 and all the HA area and all the AAA area was just zeros. I'll edit with a pic of it in a little bit. I know I shouldn't give out my AAA pass but I don't think it'll be of use to anyone since its all zeros, lol.
Also, not sure if you know anything about this but in qpst software download, I go to the backup option and and enter my msl and select start. It goes through some motions and then fails saying this "the nv item requested is not the nv item recieved". I wonder what that's all about. I'm thinking it has something to do with the virgin mobile firmware I flashed but it could just be that I don't fully know what I'm doing.
wikdNoob said:
Strange indeed. Like I said, I did the command for profile 0 and it showed about 6 numbers, like 2 numbers on line zero, 2 numbers on line 1, and 2 numbers on line 2. All the rest are zeros and the AAA area was just all zeroes. Tried the command for profile 1 and all the HA area and all the AAA area was just zeros. I'll edit with a pic of it in a little bit. I know I shouldn't give out my AAA pass but I don't think it'll be of use to anyone since its all zeros, lol.
Also, not sure if you know anything about this but in qpst software download, I go to the backup option and and enter my msl and select start. It goes through some motions and then fails saying this "the nv item requested is not the nv item recieved". I wonder what that's all about. I'm thinking it has something to do with the virgin mobile firmware I flashed but it could just be that I don't fully know what I'm doing.
Click to expand...
Click to collapse
In CDMA Workshop after entering your SPC in the Security tab go to the memory tab and read NV Item 1192 in both fields (this holds the AAA key) then name it accordingly. Open the text file that was just created and then count thirty two digits (or sixteen pairs) after the 10. Ie if the string is "10 23 45 67 89 01 23 45 67 89 03 45 67 89 01 23 44 00 00 00 00 00 00 00 00..." then "23 45 67 89 01 23 45 67 89 03 45 67 89 01 23 44" would be the AAA key. Your HA shared key is "73 65 63 72 65 74" which is the same for all boost phones. Remember to enter the digits without spaces!
Enter both the HA and AAA keys you now have into their respective fields for BOTH profiles (0 and 1). I know it seems weird but from what I can tell and have been reading, as long as your profile 0 AAA key is correct updating your profile in the phone will get boost to fill in the AAA for profile 1. I think it's because 0 is the more important profile, being the carrier profile and not the phone profile.
Please let me know how this goes and if I can be of further assistance.
joefanelli said:
That is a strange situation sir! Now that my thread is back I'll try and play around with QXDM and see why it would come up all zero's.
Click to expand...
Click to collapse
It isn't an issue with qxmd. I had something similar with my evo 3d as i had flashed it to boost as well. I pulled the nv items with efs explorer and opened then up with tiny hex. The values on the aaa and ha keys were all zeroes as well. I found it odd but didn't make much of it. I used dft to input the values i already had and they worked. Is your unit refurbished? That may be the reason why.
egzthunder1 said:
It isn't an issue with qxmd. I had something similar with my evo 3d as i had flashed it to boost as well. I pulled the nv items with efs explorer and opened then up with tiny hex. The values on the aaa and ha keys were all zeroes as well. I found it odd but didn't make much of it. I used dft to input the values i already had and they worked. Is your unit refurbished? That may be the reason why.
Click to expand...
Click to collapse
What weird is that my evo 3d has never been flashed to any carrier. I've always had sprint. So I can't imagine why is have all zeros for my ha and AAA keys on profile 1 and all zeros on just the AAA key for profile 0. I do have some keys in the ha section when I look in qxdm profile 0. I'm gonna look at it with cdmaws when I get home this evening to see if its all zeros.
I don't know if this is a refurb, I got it off eBay. Is their any way for me to tell?
I can update profile just fine, I wish I would have checked this stuff before flashing that VM fw so I'd know if that was the cause.
Your HA shared key should be the same as everyone elses from what I experienced (73 65 63 72 65 74). As for the AAA I really hope CDMAWS provides the same result as what I'm experiencing by using the 1192 NV Item.
egzthunder1 said:
It isn't an issue with qxmd. I had something similar with my evo 3d as i had flashed it to boost as well. I pulled the nv items with efs explorer and opened then up with tiny hex. The values on the aaa and ha keys were all zeroes as well. I found it odd but didn't make much of it. I used dft to input the values i already had and they worked. Is your unit refurbished? That may be the reason why.
Click to expand...
Click to collapse
I just checked an E3D that I flashed for a client (purchased originally brand new then given to his son for use on boost) and it too has zero's when pulling the info through any other means than CDMAWS's NV Item read. Truthfully I'm flabbergasted as to the cause but CDMAWS seems to work. If anyone has any insight as to why that's the case please post it.
Related
FIRST OF ALL.. ALL CREDIT GOES TO MYCRICKETFORUM. One of the best tutorials I have ever seen, especially for beginners.
Full Flash Sprint HTC Evo 3D to Cricket: Talk, Text, MMS, Internet
This is a revolutionary phone and hopefully some we see some of it's technology in other phones.
At this moment there is no 4G with Cricket. They have already made moves to establish a partnership and have an LTE network. It has been rumored that Sprint is even trying to move away from the Clear 4g network (WiMAX). This means that you will have no 4G service when you flash this phone. I believe the radio gets it's authentication by MAC address so it might be possible to put this on a Clear account. One of my customers said he was able to do this with his Epic that I flashed. He was also a Clear reseller.
Until we get permanent root, this tutorial will just cover putting the device on the $55 Android plan.
Let it be known that sometimes Cricket says they have put you on the $55 Android plan, but they put you on the All in 55 Plan (5m5). This is not where you want to be. You're paying 10 more bucks a month for absolutely nothing over the 45 dollar plan.
We offer plan change for free to forum members. Just use the contact us link at the very bottom of this page. Supporting members of the forum receive additional benefits such as free ESN changes on your account. No more paying $15 everytime you change phones. To become a Supporting Member, just go to the settings up top and find Paid Subscriptions on the left hand side. Choose a membership level of your liking. Also use the contact us form for any modifications you need made to your account or additional help.
Anyways moving right along. We'll establish the items that you will need. This is usually similar across the board.
NOTE: At the very end we'll include some wireless tethering instructions.
A. QPST (QPST Version 2.7 Build 355)
http://www.mycricketforum.com/flash...amming/5372-qpst-version-2-7-build-355-a.html
B. HTC Diagnostic drivers for the Evo (attached on this thread [32 and 64 bit])
C A Windows PC with either Win7, XP or Vista plus your Evo 3D with a USB cord.
D. PRL (*STICKY* Official Cricket PRL Thread)
http://www.mycricketforum.com/flash...041-*sticky*-official-cricket-prl-thread.html
E. CDMA workshop (google) OR CDMA Workshop 2.7 Download) to get the MSL (aka SPC) if you don't know it already. Alternative would be MSL reader from the Market or attached below.
http://www.mycricketforum.com/flashing-tools-files-programming/44-cdma-workshop-2-7-download.html
F. OPTIONAL: Android SDK which includes ADB drivers. (Android SDK | Android Developers)
http://developer.android.com/sdk/index.html
Please watch the videos and use the tutorial here. It helps to use both.
VIDEO #1: http://www.youtube.com/watch?v=TnFBkaIP7MI&feature=player_embedded#at=694
VIDEO #2: http://www.youtube.com/watch?v=6NpavnahHYs&feature=related
SPC/MSL Obtaining
Skip through all these screens on the EVO 3D until you are at the home screen. Go into the phone dialer and hit ##3424#. You might have to hit talk after this. It'll cause the phone to go into DIAG mode. You'll see the device on your computer. Use the diagnostic drivers (specify their specific location) to complete the install.
Now you can find your MSL using CDMA Workshop.
For CDMA Workshop, the port number has to be fairly low. I think we're talking about under 30. You'll see when you start it though. Look at your device manager to figure out the port that it's on. Select that port and then hit connect. Go over to the security tab and for SPC hit read. It'll give you your MSL/SPC. The best thing to do here is to use the SPC button then SEND command to send this number back to the phone and unlock it. Then type in 000000 or some number that's easy to remember. Hit the SPC button and WRITE. Now the MSL/SPC is 000000 or whatever you typed. This is all you need to do with CDMA Workshop.
Programming
This is the point where you will be using QPST. Use this tutorial to setup the EVO correctly. Note that the mobile IP behavior must be Simp or you will get errors on your Evo from time to time.
Ignore any NV read errors you get when writing to the phone.
( http://www.mycricketforum.com/flash...-*sticky*-qpst-tutorial-pictures-cricket.html)
Once you get done with this part, talk and text will work. If you are on the $55 Android the Internet should work. However...
Working with new devices (never activated)
If you watched the video, between part 1 and 2 we have a little change in plan here. This was due to the fact that our device was brand new and never activated. The hands free activation kept on popping up, and we don't believe the device had accepted all of the programming at that time. Our hunt led is to Sprint's website.
Dial ##(and your SPC, we set it to 000000)#. This will open up the EPST menu. Click edit mode. Put in the proper Mobile Directory number (your phone number) and the MSID (your MIN). Hit the menu button and then select commit modifications. The phone will reboot.
Once the phone has rebooted, go to the dialer again and hit ##data#. Click edit mode and enter your SPC for access. Make sure the settings look like it does below:
Active Profile: 1
User Name: [email protected] (put your phone number in this)
Reverse Tunnel Preferred: Enable
Home IP Address: 0.0.0.0
Primary Home Agent: 0.0.0.0
Second Home Agent: 0.0.0.0
HA Shared Secret: cricket
AAA Shared Secret: cricket
You can try hitting menu and commit modifications, but it will most likely tell you there were no changes made. Back out, go to advanced and then continue with the multimedia streaming setup below.
Media Streaming
Youtube videos might not play unless you modify some settings. Sprint by default routes media through their servers. To change this dial ##data# from the dialer on the Evo. You will get to the EPST settings. Click edit and then enter the MSL. It will prompt you for a password which is the MSL aka SPC.
Once you get past that, go to advanced > RTSP Proxy Address (for stock Gingerbread it's advanced > RTSP/HTTP Setting > RTSP Proxy Port). Make this 0.0.0.0. Also make the HTTP PD Proxy Address 0.0.0.0. Also change the ports for both of these to 0. Back out and you should be good.
MMS
<?xml version='1.0' encoding='UTF-8' standalone='yes' ?>
<apns>
<apn name="Production" numeric="310012" mcc="310" mnc="012" apn="1" user="your10digit#[email protected]" server="wap.mycricket.com" password="cricket" proxy="null" port="null" mmsproxy="null" mmsport="8080" mmsprotocol="2.0" mmsc="http://mms.mycricket.com/servlets/mms" type="mms" />
</apns>
Just edit the "your10digit#here" part with your phone number and save this.
Place it on your phone's SDCard under a folder called "apnbackuprestore". Then open the Android App APN Backup and Restore (included in this thread and on the Market) on your Evo. Backup the stock settings. Then delete APNs and restore the new APNs you just created.
You should have everything working now. Talk, text, MMS, and Internet. There are a few more steps left to enhance the experience. Below is my attempt to fix a step that I left out.
YOU HAVE COMPLETE THE FULL FLASHING TO CRICKET. ENJOY!
Issues:
TEXT: It is possible that your text messages will come in with the wrong time. If this is the case, you can download SMS Time Fix from the Market and set it up however you prefer.
HTC DIAG DRIVERS:
http://www.mycricketforum.com/attac...ket-talk-text-mms-internet-htcdiagdrivers.zip
APNBACKUPRESTORE:
http://www.mycricketforum.com/attac...t-talk-text-mms-internet-apnbackuprestore.apk
although this is helpful i am moving mine to boost but i get WS to scan any readable addresses ? please advise thanks
I see no contact us link at the bottom of your post. Also who are you affiliated with/ business. Just wondering I saw "We offer plan change free to forum members" Thanks
EDIT: Thanks. I also fixed the grammar around the first statement. Someone suggested a change in the original wording... I modified part of the sentence and forgot to look at the rest.
ta!
Thanks for this, I will be using it to flash a 3d later. I'm also going to join the other forum to check some info on a few other phones I'm flashing.
I'll let you know if anything comes up.
A question as well, I know that with the Evo 4g Sprint removed the stock voicemail notification service as they used their "visual" voicemail app, is the Evo 3d set up the same way?
Unfortunately the Evo 3D is also. You can try Voicemail Notifier (extorian) and see if that works. I posted a download in my forum.
For some reason they removed it from the Market. Maybe it won't work. Not sure. I've forwarded my voicemail to Google Voice so I have a type of Visual Voicemail now.
When I flashed my OG evo over to cricket, sometimes the stock browser and dolphin did not work. When this happened, I used opera..only when cricket services for data where not working with them and always connected. So if you cricket guys get these same type of random not working..have it loaded on your phone as a backup browser.
hey what if the phone got flashed back to sprints latest 2.3.5 stock firmware from cricket but the msl code was never put back instead its still 000000, i want to take the phone in for service the s is on and the phone is not rooted, my usb port is broken so i cannot root my device or turn s off or diag mode for cdmaWS. Will sprints repair look at this as a sign of voided warranty beacuse the msl code is now 000000, is there anything else i can do?
No4g4Me said:
hey what if the phone got flashed back to sprints latest 2.3.5 stock firmware from cricket but the msl code was never put back instead its still 000000, i want to take the phone in for service the s is on and the phone is not rooted, my usb port is broken so i cannot root my device or turn s off or diag mode for cdmaWS. Will sprints repair look at this as a sign of voided warranty beacuse the msl code is now 000000, is there anything else i can do?
Click to expand...
Click to collapse
Most likely yes they will look at both as voiding the warranty. Technically any modification done on the phone will void the warranty.
how do i get the free plan change???
can i get my phone put on 55 android plan plz have no 3g on my phlashed phone its a sprint evo 3d to cricket
dial ##786#, then press menu and then reset it will reset the whole phone also will restore your msl
Spc problem
Im trying to get my evo 3d spc, but the method this guys is using in the video is not working. Im using 01f2030f5f678ff9 as password and is telling me "Password is correct Phone is unlocked. But it doesnt show me any spc on spc box.
Can anybody tell me how?
Alright as much as I love a poll on a tutorial I made that originally didn't include a source, here's the entire forum on flashing the 3d.
http://www.cricketusers.com/sprint-htc-evo-3d/
I don't know why you are sending anything to get the spc. All you have to do is connect and then read the spc from the security tab.
im doing that but nothing happend it doesnt show me the spc. im using radio 2.17... Radio matter in this case?
Ah... One of my phone flashers notified me of this problem. I'll reply here and in your thread over there...
http://www.cricketusers.com/sprint-...ull-flash-cricket-talk-text-internet-mms.html
Try this SPC method from this tutorial.
Good luck.
chrisngrod said:
Ah... One of my phone flashers notified me of this problem. I'll reply here and in your thread over there...
http://www.cricketusers.com/sprint-...ull-flash-cricket-talk-text-internet-mms.html
Try this SPC method from this tutorial.
Good luck.
Click to expand...
Click to collapse
Danmm Dude thanks a lot you save my day.
Does anyone know how you can get it to work on the 25 or 35 dollar plan? I think the 25dollar plan would be better because I only need 300 minutes.
Is there a need for a "donor" phone, or an already active account with cricket to get the 3vo to work? Cuz trying to open new account, I was told my phone couldn't be activated with cricket...
sent from my nocturnaled Ice Cream Sandwich
powduh09 said:
Is there a need for a "donor" phone, or an already active account with cricket to get the 3vo to work? Cuz trying to open new account, I was told my phone couldn't be activated with cricket...
sent from my nocturnaled Ice Cream Sandwich
Click to expand...
Click to collapse
Can anyone answer this?
Also is getting the 25/35 dollar plan just a scam? No one wants to answer questions about it.
can someonne please send me the updated profile file of point me in the correct direction because in stuck. i rooted my evo 3d form hboot 1.5 to 1.4. everything works fine but my internet connection is constantly at 1x. my baseband is 1.06.00.1216 and my prl has been updated manually (by zip) to 21081. ive tryed virtually everything and im stuck. i have tryed to do settings / update / profile... that gives me an error 67. ive tryes to do ##72786# to reset the phone. it takes activation just fine and hangs on the updates and throws error 67. for the evo 4g's i remember the profile being a part of the flashable radio zip. im asking for someont to help me out and send me the profile or point me in the right direction...
currently on the mean rom 3.92, ive used mikrunny and mr esp stock shooter rom... with the same results... thanks in advance.
Call sprint, I had the same thing happen, they might be changing your towers as well, if they say that so and so towers have tickets, ask what for. The tech on the end, not a customer rep, said they were making huge updates. I'm now getting 4mbs+ on 3g half bars. The tower can take up to 72 hours.
Sent from my PG86100 using xda premium
Btw, might want to move this to Q&A.
Sent from my PG86100 using xda premium
^^^ Tandem #FAIL!!!!!
veladem said:
Call sprint, I had the same thing happen, they might be changing your towers as well, if they say that so and so towers have tickets, ask what for. The tech on the end, not a customer rep, said they were making huge updates. I'm now getting 4mbs+ on 3g half bars. The tower can take up to 72 hours.
Sent from my PG86100 using xda premium
Click to expand...
Click to collapse
called them, did nothing... anyone got the profile please?
By did nothing do you mean they didn't fix your problem...
Our did nothing as in no towers are down in your area, I had 1x and 25Kbs for a while.
Sent from my PG86100 using xda premium
^^ if you dont know dont comment!!! smh
veladem said:
By did nothing do you mean they didn't fix your problem...
Our did nothing as in no towers are down in your area, I had 1x and 25Kbs for a while.
Sent from my PG86100 using xda premium
Click to expand...
Click to collapse
thats correct, no towers are down. the phone worked fine before the downgrade other people with tsimilar phones are fine..
Get your MSL. (MSL Reader on Market)
Go into Dialer, dial ##3282#
Press Edit, Enter your MSL.
Press EVDO, change Preferred Mode to Automatic.
Press Menu, and Commit Modifications.
Unknownforce said:
Get your MSL. (MSL Reader on Market)
Go into Dialer, dial ##3282#
Press Edit, Enter your MSL.
Press EVDO, change Preferred Mode to Automatic.
Press Menu, and Commit Modifications.
Click to expand...
Click to collapse
EVDO preferred mode is automatic and DDTM is disabled.. i didnt have to change anything
jdmegkoupe said:
EVDO preferred mode is automatic and DDTM is disabled.. i didnt have to change anything
Click to expand...
Click to collapse
Change it to CDMA Only then, and commit, then reboot, and change it back to automatic and commit and reboot again.
It seems as though your NAI/HA pass or AAA pass from your profile 0 is incorrect. That's why you r getting that error 67 message when trying to update profile. You might want to RTM (Reset To Manufacturer) the phone. You r going to need your MSL/SPC in order to perform this. You start by going to the phone dialer and hitting ##786#, this will open up the "Reverse Logic Support" menu. In here you will see your MDN, MSID, MAC-ID, etc... Once here, press the Menu button and hit "Reset". It will then ask for the MSL/SPC, enter your MSL and hit OK.
NOTE: Before attempting this BACK UP, BACK UP, BACK UP EVERYTHING YOU DON'T WANT TO LOOSE. This function will reset your phone back to manufacturer settings, meaning it will wipe everything and revert it back to stock settings.
Hope this helps. Cheers!
M3_Arsenal said:
It seems as though your NAI/HA pass or AAA pass from your profile 0 is incorrect. That's why you r getting that error 67 message when trying to update profile. You might want to RTM (Reset To Manufacturer) the phone. You r going to need your MSL/SPC in order to perform this. You start by going to the phone dialer and hitting ##786#, this will open up the "Reverse Logic Support" menu. In here you will see your MDN, MSID, MAC-ID, etc... Once here, press the Menu button and hit "Reset". It will then ask for the MSL/SPC, enter your MSL and hit OK.
NOTE: Before attempting this BACK UP, BACK UP, BACK UP EVERYTHING YOU DON'T WANT TO LOOSE. This function will reset your phone back to manufacturer settings, meaning it will wipe everything and revert it back to stock settings.
Hope this helps. Cheers!
Click to expand...
Click to collapse
i think i tryed this when i called sprint...im at work right now but ill try it on break and let you guys know whats going on...thanks for all your help
no deal, im going to use qxsp or whatever to go into profile 0 and zero some stuff out and see it itll reset itself with a handset reset
i see the problem in my profile 0 theres a ton of gibberish in my nai field its (ff000) and it goes on for a while. research says that the nai is supposed to be my imei so im guessing its corrupted... ill keep you guys posted on the repair because im not even going to touch that subject... unless anyone who knows how can let me know ! i have active user set to 0 and the damn thing keeps giving me write errors!!! im using QPST
jdmegkoupe said:
i think i tryed this when i called sprint...im at work right now but ill try it on break and let you guys know whats going on...thanks for all your help
no deal, im going to use qxsp or whatever to go into profile 0 and zero some stuff out and see it itll reset itself with a handset reset
Click to expand...
Click to collapse
That is really strange... The result you had with the RTM suggest 1 or 2 things. Your phone was partially flashed or fully flashed to different carrier that required to repair the MEID. The other possibility is that your phones Profiles were modified and eventually were corrupted or lost. Be careful using QPST, you may end up causing more damage. After the phone OTA's, profile 1 is automatically populated. Usually looking like this...
Rrofile 1: Enabled
NAI: <first/lastname>@sprintpcs.com
MN HA SPI Set: Enable
MN HA SPI Value(Hex): 4D2
MN AAA SPI Set: Enable
MN AAA SPI Value(Hex): 4D2
Reverse Tunneling Preference: Enable
Home Address: 0.0.0.0
Primary HA Address: 255.255.255.255
Secondary HA Address: 68.28.89.76
DMU Public Key: 0
HA Shared Password: secret
AAA Shared Password: 6 character password provided by Sprint via the OTA
Hope this gives u an idea of what goes where. Good luck and let us know how it works out. Cheers!
---------- Post added at 09:25 PM ---------- Previous post was at 09:18 PM ----------
jdmegkoupe said:
i see the problem in my profile 0 theres a ton of gibberish in my nai field its (ff000) and it goes on for a while. research says that the nai is supposed to be my imei so im guessing its corrupted... ill keep you guys posted on the repair because im not even going to touch that subject... unless anyone who knows how can let me know ! i have active user set to 0 and the damn thing keeps giving me write errors!!! im using QPST
Click to expand...
Click to collapse
Profile 0 is bit more complicated to populate. Normal settings are somewhat like this...
Profile: Enable
NAI: <MEID HEX>@hcm.sprintpcs.com
MN HA SPI Set: Enable
MN HA SPI Value(Hex): 4D2
MN AAA SPI Set: Enable
MN AAA SPI Value(Hex): 4D2
Reverse Tunneling Preference: Enable
Home Address: 0.0.0.0
Primary HA Address: 68.28.15.12
Secondary HA Address: 68.28.31.12
DMU Public Key: 0
HA Shared Password: secret
AAA Shared Password: (this is normally written in HEX format and its 32 string character)
This is obtained by an algorithm which computes your "MEID HEX, HEX DEC" among other things. Sorry can't help beyond this point.
M3_Arsenal you know your stuff dude!!! thanks for all your help!! i got it working 4g also.
That is really strange... The result you had with the RTM suggest 1 or 2 things. Your phone was partially flashed or fully flashed to different carrier that required to repair the MEID. The other possibility is that your phones Profiles were modified and eventually were corrupted or lost. Be careful using QPST, you may end up causing more damage. After the phone OTA's, profile 1 is automatically populated. Usually looking like this...i did the hboot downgrade its possible i pulled the plug late or something... idk... just glad its FIXED!!!!!!!
jdmegkoupe,
Im glad to see that your phone is up and running again. Cheers.
I had my evo 4g on Straight Talk, so I knew how to do it but the rezound is different because it has two ports.
I copied all the information from my evo 4g to rezound because I was not able to *228 activate like with the evo 4g. ( I have two phone now with the same esn number on straight talk, I keep the evo turned off with battery out.)
* you will not be able to *228, so you have to manually put in the settings.
What you need:
* CDMA Straight Talk donor phone & service plan (phone model ends in C for CDMA), and a 30-day unlimited service plan. For example, you can get the LG 220C for $50 with a 30-day plan, makes the phone cost just $5 bucks http://www.walmart.com/ip/Straight-T...ished/17113676 Never turn this phone on or put the battery in it. You just need the red card with the esn number on it.
HTC Sync to install drivers (after you have drivers you can uninstall):
http://www.htc.com/us/support/htc-rezound-verizon/software-updates
HTC Diag Drivers
http://www.filedropper.com/htcdiagdrivers
CMDA WS 2.7 (3.8 is ideal if you have the cash to buy it! I think you could do the whole phone with the full version.)
http://www.filedropper.com/cdmaworkshop27fullfree-gsm-unlockblogspotcom
DFS - download from http://cdmatool.com/Download and register for Demo account at http://cdmatool.com/Register it shouldn't expire and a Demo account will work fine, just has a nag screen making you wait 60 seconds every time you run it. After you download & install make sure to enter your login that you registered.
http://www.filedropper.com/dfs4006
QPST 2.7 build 366
http://www.filedropper.com/qpst27366
PRL and DFS settings: Contains the Straight Talk PRL for VZW/Sprint phones, and screenshots for how the DFS settings should look on a phone to get 3G working: I am using prl - 59299
http://www.filedropper.com/rezoundphone
This guide was for Flash VZW HTC Rezound/Vigor Full Flash to Cricket Wireless but it works the same and credit does to jtheis23 at XDA. from kr8zeivan's post.
First make sure you install HTC Sync for your drivers, put phone is DIAG mode (##3424#) and pull up you device manager to unsure your phone is recognized. You should see two ports:
HTC Diagnostic Interface
HTC Diagnostic Interface 9k
I understand that 8k (HTC Diagnostic Interface) is voice and 9k is net/web. If you are all good its ok to uninstall HTC Sync. Make sure you disable any anti-virus that may be running as it will remove CDMA WS it will think it a trojan because of key generator. Next I used CDMA WS to unlock phone, write NV only, write NAM 1 & 2 and write prl. If you are using the cracked version click on the yellow round icon with a small star and it will launch key and open program. WS 2.7 can use ports 1-25 so make sure you have your device connected to ports 25 or under.
1. Connect to HTC Diagnostic Interface port from the MAIN tab. Go to SECURITY tab look for SPC area (Do not read) just
enter 000000 click on SPC then click send. You should get a message saying your phone is unlocked.
2. Go to OTHER tab look for R-UIM Config: Select NV only then click on write. Should get a message saying change was successful. You can now write your prl.
3. Look for PRL on the OTHER tab should be just above R-UIM. Make sure it stays in "universal" and NAM1 and click write
load your preferred prl it should say prl written successfully. Then do the same for NAM 2. Click on MAIN tab and disconnect.
4. Connect to HTC Diagnostic Interface - 9k port from MAIN tab. Go to SECURITY tab look for SPC area (Do not read) just enter 000000 click on SPC then click send. You should get a message confirming you are unlocked. Repeat steps 2 and 3.
5. Go to MAIN tab and disconnect. Reboot phone. On my first reboot I notice it did not write but reverted the prl back to Verizon's 58008 prl. However when I continued to write the Nam info on the next steps it stuck. I don't know why.
6. After reboot put phone back into DIAG mode and reconnect to 8k port go to SECURITY and unlock the phone. Go to NAM tab. From here I was able to read from phone and write without errors. Read from Nam 1. Update MIN/MDN, MCC (310) MNC (00), local SID (whatever yours is)/NID (65535)/IMSI (xxxxxxxxxxxxxxxx) make sure you replace the X's with your area code and MIN. I used PRL enabled, System Standart, Otapa enabled. Write to phone. Repeat steps for Nam 2. Go to MAIN tab and disconnect.
7. Connect to HTC Diagnostic Interface - 9k port. Go to SECURITY tab and unlock phone. Go to NAM tab and repeat step six. Write to phone. Go to MAIN tab and disconnect. Reboot phone. After reboot from phone go to settings >Wireless networks> Mobile Networks> Network mode> Change to CDMA only. Go back to home screen. From dialer press *#*#4636#*#* and call. Go into Phone information and set preferred network type to CDMA auto (PRL). Press turn off radio (this may take a few seconds) then turn radio on (this may take a few seconds) exit. You should now have talk and text. (My rezound is rooted and I downloaded LTE switch here to change the radio to cdma prl auto)
8. Put phone back into DIAG mode ##3424# call and to to WS 2.7 to unlock only. Go to QPST and connect to 8k port. Read from phone .For me I was able to follow the QPST tutorial with no problem and update both profiles did M.IP and PPP and wrote to phone with no issues. Reboot. When I tried doing the same on 9k port I got "Serious error encountered write aborted". I tried doing it without reading just writing and still got the error message. So I finished the EVDO settings for 9k port in DFS.
Follow the pics for dfs settings.
9. Put phone in DIAG mode go to WS 2.7 to unlock phone. Launch DFS 3.3.0.7 (I used Demo version and it worked for me) connect only to port 9k do not read! Go to PROGRAMMING tab select DATA tab enter PPP UID (your#@vzw3g.com.com) pwd (vzw) write. Then Go to M.IP go to Selected Profile Settings enter NAI (your#@vzw3g.com). Set Prim HA address to 0.0.0.0, set Sec HA address to 0.0.0.0 go to Share Secret User Profile. AAA shared secret (verizon) HA shared secret (verizon). Write current profile settings. At this point you may get failed to write messages at the bottom. Just ignore them. Repeat these steps for NAM2. Press Reset upper right hand corner. If your phone does not reboot on its own reboot it. If you want you can go back into DFS and read phone from PROGRAMMING and DATA tab to see if your PPP settings stuck. Do the same for M.IP if they did not try repeating the process. I had to do it a couple of times got error messages but sure enough they wrote to phone and I was successful in getting data 3g on phone.
Grats on getting it to work on Verizon. I also have thought about doing this but just wish there was a way to get their 4g service
I got it working on straight talk with an att sim on hspa. Still want to tweak with it more to get my speeds better and connection more stable.
Sent from a galaxy far..far..away....
anubis2k3 said:
Grats on getting it to work on Verizon. I also have thought about doing this but just wish there was a way to get their 4g service
I got it working on straight talk with an att sim on hspa. Still want to tweak with it more to get my speeds better and connection more stable.
Sent from a galaxy far..far..away....
Click to expand...
Click to collapse
I have a at&t sim card from straight talk on order. I was going to give it a try also, since all you do is transfer the number over. I want that 4g too, but like the $45 for everything.
watt19 said:
Update MIN/MDN, MCC (310) MNC (00), local SID (whatever yours is)/NID (65535)/IMSI (xxxxxxxxxxxxxxxx) make sure you replace the X's with your area code and MIN.
Click to expand...
Click to collapse
Where do I get the info to update these fields if I never turn on the donor phone to obtain it's phone number/info?
Straight talk gives you the phone number after you activate the phone with the meid. Phone doesn't need to be on to do this I don't think.
Sent from a galaxy far..far..away....
isn't this cloning the esn, which is illegal?
rjuds82 said:
Where do I get the info to update these fields if I never turn on the donor phone to obtain it's phone number/info?
Click to expand...
Click to collapse
The min is all you need and you can get it when you call straight talk and activate, like the post by anubis2k3 states.
When you get ready, I will help with that part.
nrfitchett4 said:
isn't this cloning the esn, which is illegal?
Click to expand...
Click to collapse
That's what flashing is. I pay for the service but use what phone I what, so How is that wrong? I payed for the phones, so I use what I want.
watt19 said:
That's what flashing is. I pay for the service but use what phone I what, so How is that wrong? I payed for the phones, so I use what I want.
Click to expand...
Click to collapse
Agreed. Not illegal. In fact, it was ruled that modifying any electronic device by the user is legal. However, the manufacturer has the right to not accept the device under warranty after said modifying.
Sent from my ADR6425LVW using Tapatalk 2
Followed the guide and at the end of step 7 I do NOT have talk and text. Not working.
nrfitchett4 said:
isn't this cloning the esn, which is illegal?
Click to expand...
Click to collapse
Per the FCC, yes it is.
Sent from my Honey Badger
rjuds82 said:
Followed the guide and at the end of step 7 I do NOT have talk and text. Not working.
Click to expand...
Click to collapse
You was able to get the esn and prl saved, correct. When you look at the settings what do you have. It should look like the pictures for the zip file.
At step 7 did you go to the market and download the lte switch and change to CDMA prl auto only?
I looked at the guide and I did not explain how to change the esn on the phone. This was the only way I was able to change my esn on my rezound.
Part2
Changing the MEID...
1.Dial ##3424# on your phone and plug it into your computer.
2.Open QPST Configuration and connect to the HTC COM port.
3.Open the EFS Explorer client using QPST Configuration
4.Make a folder called "open sesame door" in the root directory of the phone.
5.Restart your phone and connect to it again the same way. This time, the "nvm" folder will be unlocked in EFS Explorer.
5.Open the "nvm" folder and copy the "0" and "1943" files to your computer. The file named "0" contains your flipped ESN, and the file named "1943" contains your flipped MEID.
6.open with a hex edit.Change the ESN/MEID to whatever you like (make sure it's flipped) in the files and copy the files back to the phone. Restart the phone, and you're good to go!
Note: A "flipped" ESN or MEID means that the ESN or MEID is reversed in groups of two. For example, if your phone's MEID were A1000012345678, it would become 78 56 34 12 00 00 A1 when flipped. The same applies for the ESN.
7. Delete file 0 and 1943 on the phone. The drag your edited files back to phone.
8. Refresh to make sure you copied the files.
9. “adb reboot” to reboot the phone.
10. Delete the “open sesame door” folder.
11. After done, check whether esn is good.
Still nothing. No voice. Try to send a text and I get cause code 65535 error class 3. Pretty sure it did that before anyway though.
rjuds82 said:
Still nothing. No voice. Try to send a text and I get cause code 65535 error class 3. Pretty sure it did that before anyway though.
Click to expand...
Click to collapse
Change those setting that I sent to you and let me know.
Update: Watt19 has been helping me with this. Tonight I finally got 3G working nicely but still can't call or text. Is it possible for data to work while having the wrong meid?
What happens if I turn on the donor phone to copy settings?
rjuds82 said:
Update: Watt19 has been helping me with this. Tonight I finally got 3G working nicely but still can't call or text. Is it possible for data to work while having the wrong meid?
What happens if I turn on the donor phone to copy settings?
Click to expand...
Click to collapse
I just sent you a reply,
Where can I get PRL 59299?
Thanks
TJ
dviperbigt said:
Where can I get PRL 59299?
Thanks
TJ
Click to expand...
Click to collapse
should be in the zip file.
If anyone has an MEID starting with a letter A, can you look in settings/about phone/phone identity and see if the letters are uppercased or lowercase? Not sure if it even matters but mine are lowercase and just seems odd.
rjuds82 said:
If anyone has an MEID starting with a letter A, can you look in settings/about phone/phone identity and see if the letters are uppercased or lowercase? Not sure if it even matters but mine are lowercase and just seems odd.
Click to expand...
Click to collapse
That does not matter. Mine is the same way.
First of all, I'd like to thank you guys for everything you have posted on these forums. They have provided me with all the answers I've needed so far. But I'm finally stuck. I recently flashed a Sprint Evo 4G LTE to the Boost Mobile network. When I first completed the flash I had both error 16 and the data call failure error. I got rid of the error 16 by contacting Boost and complaining that my donor phone couldn't call out. They quickly amended the problem by doing whatever on their end. I played with the HA and AAA keys, and got the data call failure to go away by using the hex code from nv item 466, which was 34 digits long, where I just dropped the first two numbers. I also had to drop the first two digits of my second AAA key because it was 14 digits long. Using these numbers, I no longer get error 67 or a data call failure popup. When I enter ##debug# > EVDO Engineering, at the very bottom it just always says 1 = authenticated.
For the record, I have the Boost Mobile 61009 prl, but have tried various Sprint prls as well, because I read on this forum that might help. I currently have the Sense-based MeanRom installed in order to use the ## codes, and this forum has suggested to try to update profile and update prl, neither of which work. When I choose update profile, I get an error 1012, when I choose update prl, I get an error 1233. Any suggestions are much appreciated
As of right now, I am installing a different Sense based Rom, called MeanBean v2.3. I'll see if I have any luck.
For the record:
Baseband: 1.12.11.0809
Build number: 2.13.651.1
Donor phone: Samsung Rant
Plan: $50.00/month Unlimited Plan
Update: Changing to this ROM has not yielded any results.
I'm going to relock the bootloader and update my firmware with the 2.13 RUU, and then unlock the bootloader and reinstall MeanBean 2.3 to see if that helps. In the MeanBean documentation, it states
If your baseband is less than 1.12.11.1119, you have old firmware and should update else you could have problems with your data connection, reboots, etc.
Click to expand...
Click to collapse
Data Fix (Profile Switch)
datatype_void said:
First of all, I'd like to thank you guys for everything you have posted on these forums. They have provided me with all the answers I've needed so far. But I'm finally stuck. I recently flashed a Sprint Evo 4G LTE to the Boost Mobile network. When I first completed the flash I had both error 16 and the data call failure error. I got rid of the error 16 by contacting Boost and complaining that my donor phone couldn't call out. They quickly amended the problem by doing whatever on their end. I played with the HA and AAA keys, and got the data call failure to go away by using the hex code from nv item 466, which was 34 digits long, where I just dropped the first two numbers. I also had to drop the first two digits of my second AAA key because it was 14 digits long. Using these numbers, I no longer get error 67 or a data call failure popup. When I enter ##debug# > EVDO Engineering, at the very bottom it just always says 1 = authenticated.
For the record, I have the Boost Mobile 61009 prl, but have tried various Sprint prls as well, because I read on this forum that might help. I currently have the Sense-based MeanRom installed in order to use the ## codes, and this forum has suggested to try to update profile and update prl, neither of which work. When I choose update profile, I get an error 1012, when I choose update prl, I get an error 1233. Any suggestions are much appreciated
Click to expand...
Click to collapse
Open QPST and connect to ypur device,
Open QPST Service Programming
Go to M.IP Tab, click Read tab, enter your SPC/MSL Code,
On the right side under ACTIVE USER, (not in profiles) change it to "1" instead of 0,
(0 is only meant for Evo 4g not LTE )
Click "write to phone"
Restart the device and you should have data.
There are additional ways to increase 3g speeds as well, but they need to be performed AFTER this process.
Error 67 Fix
Note: Make sure you're on a Sense ROM or the ESPT codes you need will not respond or function (##3282#, ##3424#, etc).
Also, if you have questions about how to use the programs listed, then you're too far ahead and need to do a quick read/ trial and error of the basics so you know how to use them.
If you are having a hard time getting data back up and running, for the Evo LTE then I suggest the following using the following items:
work.
CDMA Workshop
QPST - Service programming
DFS
- Connect your donor phone and open DFS
Click on the Programming Tab (Main Tabs),then read in the values from your donor phone and take screenshots of The Following Sub Tabs: NAM, Data, and Mobile IP
Within the Mobile IP Tab there are 2 radio buttons for Profile, click on each and make sure to get good screenshots of each.
First Check and Compare your Data Info in with what you have saved in your Donor Phone Items/Notes, if not save both your old and new notes to compare and change later.
Connect your EVO LTE and open DFS, and your screen shots. Compare and make any changes that do not match from your Screenshots, to your EVO LTE.
- Close DFS.
- Open QPST - Service Programming, read in your EVO LTE's info, enter your SPC (MSL). Click on the M.IP Tab and compare the information
with your and check for any errors, also be sure that Profile 1 is the active profile.
(Profile 0 is for non-LTE phones)
- Close out of QPST - Service programming.
- Open CDMA Workshop.
Click the Security Tab and send your SPC (MSL). Next click on the NAM tab and load and write your NAM 1 and NAM 2 files for their respective profiles
(hopefully you saved this as well as your NV Items from your donor phones profile).
Next, click on the Memory Tab and write your NV Items to your phone (465, 466, 1192, and 1194)
Finally click on the Other tab and write your donor's PRL (or one you've downloaded) Choose LG not Universal. and choose NAM1.
After which DO NOT disconnect, simply attempt to close the program and it will ask if you would like to restart the phone to apply modifications, click OK or restart your phone manually and you should be good to go.
Hi EPST and reprogramming your phone, a comprehensive guide
I see a lot of posts in dev threads like "i flashed your rom now my signal/data is gone" so i decided to create this guide to help relieve unnecessary posts. Hope it helps
An introduction to EPST
Epst is a application that sprint uses to activate/program a phone. It read/writes to the NAM of your phone.NAM is an acronym for Numeric Assignment Module and is the place in TDMA/CDMA equipment where your phone number, ESN, system information and data settings live. In the old days we programmed handsets by hand, now it is usually done OTA (much is preset, a little is manually entered, data provisioning is truly OTA). It has many uses but this guide will concentrate on the data portion of epst. Here are the 3 codes that we will be using:
##3282# (data)
##72786# (scrtn)
##786# (reverse logistics support)
Keep in mind you will need your msl either from sprint (its really easy to get), or msl reader from the maket (root required)
##3282# (Data)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
The Data menu is broken down into 6 menus and usb charging selection.
1. Data Profile: This is where you can setup multiple data profiles (not sure why you would to) and contains your sprint username and other info on your data profile.
2. Evdo: Two menus here DDTM and preferred mode. DDTM is an option to where if you are downloading over your 3g/1x it will send calls to voice mail. It can be useful if you are trying to download a large file over 3g and don't want it to be interrupted. Preferred mode is exactly that... your network preferred mode. There are several settings there all of which are safe to use. Mine is set to cdma hdr only because i have no lte in my area. In theory it should save a little battery life by not scanning for lte.
3. Advanced: This menu contains a lot of important info. From your esn/meid to toggling lte.
There a few settings in here you can tweak to possibly benefit from.
A. Slot Cycle Index (SCI): This determines how often a handset polls the network for coverage and incoming packets. The default value is 2. A "Slot" is 1.28 seconds and doubles with each incremental change from 0 to 7 (0=1.28, 1=2.56, 2=5.12 seconds, etc). setting a handset to poll more often may use noticeably more battery if coverage is thin or lacking.
B. ACCOLC (Access Overload Class): This code determines your priority to make and receive calls on the network. Higher the number, lower the priority. Lower the number, higher the priority. Emergency Services reserves 0 + 1 (please do not use these) leaving your choices to 2-9.
C.Removing the Sprint Proxy
1. With MSL in hand, go to the Phone app and dial ##3282#
2. Click Edit Mode
3. Your "Password" is your Phone's MSL, enter it here.
4. Click Advanced
5. Scroll down to RTSP/HTTP Setting
6. Change RTSP proxy IP to 0.0.0.0 or You can leave this blank if you like
7. Change RTSP proxy Port to 0 (Zero)
8. HTTP proxy IP to 0.0.0.0 or You could leave this blank if you like
9. HTTP proxy port to 0 (Zero)
10.Once complete, back out to the home screen and enjoy Downloads and a .20- .60 mbps increase in 3G speeds!
It may not hurt to verify the settings are in place by following steps 1 through 5 again, if you're OCD. Removing this proxy removes at least one or more hops in between you and your connection destination, possibly increasing your WAN connection speed via 2G/3G/4G and Wi-Fi. As always, use at your own risk and take a screen shot of your original settings.
D. Improve CDMA Call Sound Quality via a Codec Change:
There are a few important things to note. This adjustment changes the Codec used to compress the voices of you and your caller across the Cell Network using EVRC-B which is an updated revision to the current CDMA standard EVRC. It has been noted in a few places, that making this change CAN effect your ability to make outbound calls in some roaming situations, including over Network extenders like the AirRave. As always, YMMV and I STRONGLY recommend that you both test this change in your normal use environments as well as keep a general idea of these instructions handy in the event you need to revert to the default settings in an emergency. As always, YOU and YOU ALONE are FULLY responsible for changes to any handset in which these and any modifications are made.
1. With MSL in hand, go to the Phone app and dial ##3282#
2. Click Edit Mode
3. Your "Password" is your Phone's MSL, enter it here.
4. Click Advanced
5. Scroll down the list and note the entries for EVRC-B, Home Orig, and Roam Orig.
6. Change EVRC-B to "Enable"
7. Change Home Orig and Roam Orig to "EVRC-B"
8. Hit Menu, and select "Commit Modifications"
9. Your phone will prompt you to click ok to restart or it will restart automatically.
To reverse the changes, repeat all of the above steps except change the following.
6. Change EVRC-B to "Disable"
7. Change Home Orig and Roam Orig to "EVRC"
Click to learn more about EVRC and EVRC-B
4. DSS:Not sure if these really need to be messed with unless you have flashed to another carrier...
5. LTE Record Various logs and scan rates for LTE safe to adjust...
6. PDN Setting I only found one document which seemed to pertain to this Here There are 3 sub menus internet, ota, and pam (phone as modem?). If anyone knows more about this fell free to chime in. :good:
##72786# (SCTRN)
This menu contains 4 sections containing your MDN, MSID, M.IP Custom Profile1-NAI and AAA shared secret password. All of these are unique to your data profile and should never change. The ##code is used to reset these 4 items to re-provision your phone without wiping any data.
##786# (Hard Reset)
This menu contains a lot of the same info as the previous codes with a little extra. It is used for the quintessential "hard reset". This will completely wipe data/app, your internal sd, and NAM so your phone can be re-provisioned.
FAQ SECTION
Note: I do not fully understand how or why the NAM section of your phone becomes corrupt but is does. I have never had to call sprint to have them fix my data so i hope this helps.
Q. Help im stuck on 1x/2g.
Q. I just flashed your rom now i have no signal help!
Q. My data speeds really suck lately anyone else?
Note: All these fixes must be preformed on a stock or stock based rom with epst support and make sure you are in a known good signal area
A. These are all very common questions i have seen around here in the past years and are all very easy to fix... process below.
Whenever i have data issues whether it be stuck on 1x, no data/signal, or slow data, I always follow the following steps...
1. ill just do a profile update and see if that helps.
2. If that doesn't help this is my next step.
Enter Dialer
##3282#
select edit and enter MSL
select data profile
select menu and select Restore
reboot and update profile
3.Still no worky?
Enter Dialer:
##72786#
select edit and enter MSL
select menu and then Reset
After phone goes through "hands free activation" and your back at your dialer, enter this:
##3282#
select edit and enter MSL
select data profile
select menu and select Restore
After your rebooted and back at your home screen go into settings/system updates/ and update your profile.
4. This is your last step before calling sprint (which i have never had to, this has always worked for me).
THIS WILL WIPE EVERYTHING IN DATA/APP AS WELL AS YOUR INTERNAL SD! YOU HAVE BEEN WARNED SO MAKE A BACKUP
Enter Dialer
##786#
select menu and select reset
enter msl and select ok
After phone goes through "hands free activation" go into settings/system updates/ and update your profile and you should be set
This guide is a WIP, and yes i know most of this information is already in some thread buried somewhere but I thought a little consolidation was in order. Maybe we can get data questions in here and there wont be 4 pages of someone trying to figure out why their data wont work in a dev thread.:good:
Also this is my first attempt at a guide...go easy on me.
Prl Information
PRL INFORMATION AND UPDATING
Thank you Digiblur for letting me kang some of your OP. I really appreciate it. Go thank this guy NAOWZ!
Take a moment and read this article before reading any further: What is a PRL?
PRL Series - Acct- Device
25xxx = Residential acct - LTE/800SMR
24xxx = Business acct (some 3G roaming added) - LTE/800SMR
55xxx = Residential acct - worldphone LTE/800SMR
56xxx = Corporate acct (VZW 3G roaming) - worldphone LTE/800SMR
16xxx = Corporate acct (VZW 3G roaming) - LTE/800SMR
11xxx = Corporate acct (VZW 3G roaming) - no LTE/no 800SMR
12xxx = Corporate acct (VZW 3G roaming) - no LTE/low priority 800SMR
60xxx = Residential acct - no LTE/no 800SMR
21xxx = Residential acct - no LTE/low priority 800SMR
51xxx = iPhone5 - low priority 800SMR
800 SMR Enabled PRLs/Areas
xxx13 - DFW, Chicago, Baltimore, North CA, Atlanta, Boston, Houston, Indianapolis, Kansas City, New Mexico, New York, Orlando, San Antonio and Southern California
PRL Change Logs and Full Analysis' can be found on this website:
www.batonrougebroadband.info This is Digiblurs site the guy is full of info
PRL 00001, 00002, 00003, and 01337 are modded PRLs that force your phone to use Verizon's network for voice and 3G Prl 15094, 15096, 17098 are PRLs that force you to use US Cellular's network for voice and 3G. Use these for TESTING purposes only. I do not recommend or condone using them 100% of the time. You will not be able to determine when you are roaming. You won't even be able to tell if you roaming internationally!! There is a 300mb data cap and other minute based roaming caps with Sprint. Myself or this website are NOT responsible if you break your Terms of Service and get your contract terminated. Discussions about how to get your contract terminated using these non-Sprint PRLs will not be tolerated and will be deleted. If Verizon/USCC works for you and Sprint's service does not, then you need purchase Verizon/USCC service.
Common PRL Myths
1. A PRL is not a list of towers. It's a list of cell phone systems that your phone searches for.
2. It will not make your phone connect to different Sprint 3G towers.
3. It will not give you better Sprint PCS band 3G or 1X coverage.
4. It will not give you better LTE coverage.
5. An update is not required for new cellular sites.
6. The only time a PRL update will give you better native Sprint coverage is when 800mhz SMR (BC10) support is added and enabled in your area.
7. You can not use AT&T, VZW, or US Cellular LTE with a use of a different PRL
8. Don't believe the nonsense and lies that a Sprint rep will tell you about PRLs (they were never trained on PRLs and only go by rumors and hearsay instead of facts)
Prl updating without a pc.
NOTE: This will only work on sense roms with epst support.
On device prl update is now possible. I would like to thank rulingczar for some help looking in the right place. All you have to do is edit 1 line in build.prop.
How to change the build.prop:
There are a few ways to change build.prop. The easiest imo is to use an app like kernel tuner to change it. KT even has a nice backup and restore option. You could also take your favorite file explorer and navigate to /system and open build.prop as text and edit there. If you are adb savvy then you could pull the file, edit it with a program like notepad++, and push it back to your device with proper permissions.
ro.build.type user
to
ro.build.type dev
1 .Reboot and let the system fully load (or there will be lag in Epst) and enter dialer.
2. Enter ##778# and choose edit. Enter MSL and choose prl.
3. Select update prl and select a prl from your sd card.
4. Select menu in the upper right corner and commit modifications.
5. Epst will reboot the device and the prl should be applied.
6. It is always a good idea to update your profile after a prl change. Enjoy!
Updating prl and pulling prl from device with PC
Credits Whosdaman from this thread.
How to Update PRL Manually:
You must have your respected device's drivers installed prior to starting.
Download and Install QPST 2.7 - Build 366
Open QPST Configuration in the "QPST" folder under Programs
Disable debugging on your device
Type the following code in your respected device's dialer and switch to DIAG mode
HTC EVO 3D/ HTC EVO 4G LTE : ##3424#
Plug in your device
Click on the “Ports” tab and “Add a new port”
Select the “COMXX – USB\QC Diagnostic” and click ok. If you don’t see a port, uncheck the box for "Show Serial and USB/QC Diagnostic ports only" and add all of the USB/Unknown ports. One of them should show an active phone.
Click “Start Clients” on the top of the program and open Service Programming
Select your device
Click "Read from Phone" and enter your MSL
Click the "Roam" tab
Click "Browse" and select the PRL you wish to use
Click "Write to Phone"
Phone should reboot with the PRL you specified
How to Pull PRL From Device:
You must haveDIAG drivers installed prior to starting.
Download and Install QPST 2.7 - Build 366
Open QPST Configuration in the "QPST" folder under Programs
Disable debugging on your device
Type the following code in your device's dialer and switch to DIAG mode
HTC EVO 3D/HTC EVO4G LTE: ##3424#
Plug in your device
Click on the “Ports” tab and “Add a new port”
Select the “COMXX – USB\QC Diagnostic” and click ok. If you don’t see a port, uncheck the box for "Show Serial and USB/QC Diagnostic ports only" and add all of the USB/Unknown ports. One of them should show an active phone.
Click “Start Clients” on the top of the program and open Service Programming
Select your device
Click "Read from Phone" and enter your MSL
Click "Save to File" and save the file
Open RL Editor in the QPST folder
Go to "File" then "Open" and navigate to the location where you saved the file
Open the .r0l file
Go to "File" then "Save As" and save the file as a .prl file type.
If either are unclear in any way, please let me know.
How to add EPST to any sense rom.
coming soon... files attached below. Thanks Captain_Throwback i cherry picked from the sense 5 trunk. Go thank this guy as well for just being generally awesome. ( Guy has bricked numerous phones testing different things )
I will try to add some pics when I get my pc back up...this is my reminder :silly:
Good info. Thanks
#Root-Hack_Mod*Always=LTE
Test with airvana 2.0 .... Audio codec sounds all scrambled .....like crazy .. calls go in and go out seems like there is a dude speaking some recorded bs . Then I got a chick ... But definetley not understandable ... Any way to adjust air rave to work with evrc-b............ Seems like a good idea updating audio codec we have its lets use it
Sent from my EVO using xda app-developers app
jraz305 said:
Test with airvana 2.0 .... Audio codec sounds all scrambled .....like crazy .. calls go in and go out seems like there is a dude speaking some recorded bs . Then I got a chick ... But definetley not understandable ... Any way to adjust air rave to work with evrc-b............ Seems like a good idea updating audio codec we have its lets use it
Sent from my EVO using xda app-developers app
Click to expand...
Click to collapse
That I do not know. I don't have an air rave to test on... It's a long shot but maybe e mail the manufacturer and see what they say.
Sent from my PG86100 using Tapatalk 2
I was gonna mention this but didn't know where but when you sign up for sprint they give you your msl aka your spc aka your unlock code when you activate your phone.
Asadullah said:
I was gonna mention this but didn't know where but when you sign up for sprint they give you your msl aka your spc aka your unlock code when you activate your phone.
Click to expand...
Click to collapse
They also give it to you in an email if you do an esn swap (change phones) online. They also give directions how to program your phone in the e mail. They like to refer to it as "a six digit number" lol.
Sent from my PG86100 using Tapatalk 2
As I recall, going into the individual PDN items on that list while in edit mode will delete individual entries if they are accidentally selected and no info in entered in the field ie you select the field to edit and you can't cancel out to get the data previously populated in that field.
Has anyone successfully backed up and restored CDMA "APN"s? Even looking under the hidden function "CDMA APNs" shows no actual APNs in the traditional GSM sense.
They aren't kept in the apns Conf. Look in mms_config.xml in the mms.apk.
There is a program that can decompile apks to actual source code not smali. I would like to have a look through the epst.apk and see how it works. May be able to get more features.
Asadullah said:
They aren't kept in the apns Conf. Look in mms_config.xml in the mms.apk.
There is a program that can decompile apks to actual source code not smali. I would like to have a look through the epst.apk and see how it works. May be able to get more features.
Click to expand...
Click to collapse
That would be awesome, im just a union electrician, and dont know too much about java... Speaking of more features im attaching a copy of epst from android 2.1 eclair. It had the feature to change prl's on the fly via handset ##PRL#. It was ported to 2.2 and 2.3. I dont think anyone really tried to get it going on ICS which would be very nice. I would definitely appreciate if anyone got it to work...
Well on the fly prl changing is once again possible on the info bar rom by newtoroot
This is on a us cellular prl. :thumbup:
Here is the epst apk:http://db.tt/Lghf8UVb
I haven't been able to get it to work but I only tried on viper rom. I'll try more later tonight...
Edit: forgot to mention the code is ##778# then enter your msl.
Sent from my EVO using Tapatalk 2
One question, sir.
Can EVO LTE unlock permanent rev B?
tukijembz said:
One question, sir.
Can EVO LTE unlock permanent rev B?
Click to expand...
Click to collapse
Not sure what your question is... Your audio codec is selectable. And should stick.
Flowed from my Jewel using Tapatalk 2
I tried this but tapping RTSP/HTTP setting doesn't do anything. Anyone got a clue?
zigolleid said:
I tried this but tapping RTSP/HTTP setting doesn't do anything. Anyone got a clue?
Click to expand...
Click to collapse
You must be in view mode... You must be in edit mode to edit the values. When you type ##data# a menu will pop up with 2 options.
Flowed from my Jewel using Tapatalk 2
Second post updated or I guess created...
Flowed from my Jewel using Tapatalk 2
gunfromsako said:
NOTE: This will only work on sense roms with epst support.
On the fly prl update is now possible. I would like to thank rulingczar for some help looking in the right place. All you have to do is edit 1 line in the build prop.
ro.build.type user
to
ro.build.type dev
Reboot and let the system fully load (or there will be lag in Epst) and enter dialer.
Enter ##778# and choose edit. Enter MSL and choose prl. Select update prl and select a prl from your sd card. Select menu in the upper right corner and commit modifications. Epst will reboot the device and the prl should be applied. It is always a good idea to update your profile after a prl change. Enjoy!
Click to expand...
Click to collapse
Worked like a charm
I'm out of thanks so Thank You
BTW I didn't change anything other then user>dev but ##778# worked
Also might be a good idea to show the path taken to edit the ro.build.type
bigdaddy619 said:
Also might be a good idea to show the path taken to edit the ro.build.type
Click to expand...
Click to collapse
Done :thumbup:
Flowed from my Jewel using Tapatalk 2
gunfromsako said:
You must be in view mode... You must be in edit mode to edit the values. When you type ##data# a menu will pop up with 2 options.
View attachment 1800220
Flowed from my Jewel using Tapatalk 2
Click to expand...
Click to collapse
I did tapped edit mode and everything else works, just not that RTSP/HTTP setting... Maybe it's my device's problem
zigolleid said:
I did tapped edit mode and everything else works, just not that RTSP/HTTP setting... Maybe it's my device's problem
Click to expand...
Click to collapse
Weird I just zeroed mine out and rebooted...
What rom are you using?
Flowed from my Jewel using Tapatalk 2