*** The method below is pretty much illegal everywhere.. Nobody is responsible for what you do with your Touch Pro.. As long as you are not using this method for devious means and/or not using the same ESN number for two different phones you are probably safe.. ***
*** This post is in the interest of the general public who are stuck with phones with bad esn numbers. This can probably save your phone from being just another unusable junk. xdadevelopers is not responsible for this post nor am I ***
A step by step guide to unlock, supercid, change the ESN and MEID on the SPRINT CDMA HTC Touch Pro.
Here is the link to the required files
4shared.com/file/WX8UxA0G/Needed_Files.html
The most important file out of this is the Radio because only with that radio can we change the ESN(which is illegal)i
This change will survive a full ##786# reset.
Please do a backup of your contacts, messages etc. I recommend PIM Backup
I would like to say thanks to all those people in different forums who helped me by giving me information.
If it wasn't for them i would have been stuck with a 20k handset which would be conspicuously sitting on my shelf
1. Put the phone in diag mode by dialing ##3424#
2. If you dont know your SPC/MSL code get it from the attacked BAFMSL which needs NetCF 3.5 to work.
3. Flash your phone with Raphael_CDMA_HSPL_025_MFG.exe
4. Let phone re-start. Unplug usb cable from phone.
5. Disable USB connection in Active Sync by unchecking checkbox in Connection Settings of Active Sync.
6. Hold Power button, Volume Down button and push reset button to boot the phone in bootloader mode.
7. Connect Phone's USB cable to PC again.
8. Run mtty.exe
9. Change the port to 'USB' and hit OK
In the window that opens up, type the following commands (All Commands are case Sensitive) Hit enter after typing. You may see nothing while typing, just type carefully.
10. rtask a
11. echo_on
12. readCID
13. writeCID 00000000
14. readCID (window should return CID as 00000000)
15. rtask c (will probably give and error)
16. Soft reset phone and close mtty.
17. Re-enable USB connection in connection settings of ActiveSync. Make sure phone is 'connected' to ActiveSync, you might have to unplug and plug in usb to make this happen.
18. Flash phone with Raphael_CDMA_HSPL_037.exe
19. Let phone restart.
20. Copy supplied radio rom RAPHIMG.nbh to your storage card.
21. Hold Power button, Volume Down button and push reset button to boot the phone in bootloader mode. It should now display the option to go ahead and load the image file. Press the PWR button to continue.
22. When it is complete, soft reset.
23. Put your phone into diag mode (##3424#)
24. Launch DFS.
25. Select your phone's com port.
26. Select 6950 from the devices menu.
27. Ignore any errors at the bottom of the screen about equipment file not found etc... Once the com port is connected, go to the MEID section and 0 out the dec or hex fields (Fill one of the fields with 0's. Ignore the pESN that it creates.
DO NOT put anything in the ESN field.
Click Write and it will write it to the phone no matter what it says at the bottom.
28. Close DFS and soft reset.
29. When your phone re-starts, you can open the dialer, select menu, select device info and you should see your MEID is now 0's.
30. Go into diag mode ##3424# again.
31. Open up the attached CDMA Workshop 2.7 and select the com port to connect your phone.
32. Go to the security tab and click read by the ESN. It should display your current ESN.
33. Type the ESN that you want in the phone and click write.(Illegal)
34. Close CDMA Workshop and soft reset.
Once everything is done flash back to a regular radio. The radio we flashed for changing the ESN number cannot be used for normal purposes.
35. Place your first call from your 'repaired' device. All should be fine. If not, check your account settings, mdn, msid, prl etc.
IMPORTANT: As long as the meid remains as all 000s, you can go straight into cdma workshop 2.7 and change the esn again. If you do a ##786# reset, your meid and esn will return to original manufacturer settings and you will have to go back to step 20. It will survive a regular hard reset, rom flash etc.
If you are happy with your phone in this state, flash a new radio and program your data settings.
If you are sure you are all done with the number changing etc or need/want the correct meid in there that will survive the thermonuclear ##786# reset, go back into dfs (Step 24) and write the proper MEID for your new pesn. ***HOWEVER***, this will lock the pesn in and from what I have read, will not allow it to be changed again.. Flash a new radio and program your data settings.
Please do a hard reset once everything is done..
The link for the files isn't working?
cosmok said:
The link for the files isn't working?
Click to expand...
Click to collapse
I have corrected it..
Try now
intimateangel said:
I have corrected it..
Try now
Click to expand...
Click to collapse
Can you repost the files please? I really need them.
I have my Rezound on PagePlus. My phone says it's Mobile network type is EvDo-rev.A but I get not 3G icon and no data.
I get voice and sms only.
Would ESN reset work?
**Note: When I was at stock 3.14.605.12 I was still having the same issue. I flashed to NeWts to get access to the hidden menu.
I would appreciate any suggestions besides pay someone else to do it for me.
Thanks in advance.
Did you write the CDMA settings to NAM1 and NAM2? You will only get1x data on the Rezound as far as I know. I have not been able to get any better than 1x anyway. Here's some info for you... need to substitute the verizon settings in there instead of the Cricket ones of course...
8. Put phone back into DIAG mode ##3424# call and to to WS 2.7 to unlock only. Go to QPST and connect to 8k port. Read from phone .For me I was able to follow the QPST tutorial with no problem and update both profiles did M.IP and PPP and wrote to phone with no issues. Reboot. When I tried doing the same on 9k port I got "Serious error encountered write aborted". I tried doing it without reading just writing and still got the error message. So I finished the EVDO settings for 9k port in DFS.
9. Put phone in DIAG mode go to WS 2.7 to unlock phone. Launch DFS 3.3.0.7 (I used Demo version and it worked for me) connect only to port 9k do not read! Go to PROGRAMMING tab select DATA tab enter PPP UID (your#@mycricket.com) pwd (cricket) write. Then Go to M.IP go to Selected Profile Settings enter NAI (your#@mycricket.com). Set Prim HA address to 0.0.0.0, set Sec HA address to 0.0.0.0 go to Share Secret User Profile. AAA shared secret (cricket) HA shared secret (cricket). Write current profile settings. At this point you may get failed to write messages at the bottom. Just ignore them. Repeat these steps for NAM2. Press Reset upper right hand corner. If your phone does not reboot on its own reboot it. If you want you can go back into DFS and read phone from PROGRAMMING and DATA tab to see if your PPP settings stuck. Do the same for M.IP if they did not try repeating the process. I had to do it a couple of times got error messages but sure enough they wrote to phone and I was successful in getting data 3g on phone.
10. To check your default settings press ##program# when it asks for password enter 000000 and check NAM CDMA Settings and make sure all your info looks right. Go to 1xEV-DO Data Parameters to see if your PPP settings are correct. Display grouping will give you the correct ESN for Cricket activation just write down your MEID (DEC) mine started with a 25#. Here you can also see your prl to verify its the right one. Exit. You can use ##778# and view your EPST check your M.IP default Profile to make sure your NAI looks all good. If you still see the Verizon NAI, Prim HA and Sec HA of 255.255.255.255 you may have to give it another shot.
Thanks for the reply.
You are right about port 9K. I cannot get the PPP Pass, HDR Pass, HA secrect, and AAA secret to stick.
When I installed the HTC drivers on Windows 7 64bit and Windows 8 64bit under Ports (COM & LPT) it installed as HTC Diagnostic Interface for both 8K and 9K.
In Windows XP 32bit 8K was HTC Diagnostic Interface and 9K HTC Projector Interface.
So I don't know if it's a driver issue which is causing me to not write the values. I've looked in multiple forums and have not been able to install the HTC Diagnostic Interface - 9K driver.
I have WS 3.8.7 full and it writes without errors to port 9K but the values still will not stick. I've tried QPST and DFS Demo; the values still will not stick.
Thanks again.
Solved
I don't know what I did but I know I didn't write the settings to port 9K.
I did use the "open sesame door" in QPST for both port 8K and 9K attempting to write the settings to port 9K, didn't work.
So I used the RUU 1.00.605.3 and downgraded and 3G started working!!
I step RUU from 1.00.605.3, 1.02.605.6, 2.01.605.11, and 3.14.605.12 and 3G was still working.
I restored my backup from NeWts and 3G was not working. I'm not sure why.
I don't have any screen from 3.14.605.12, but I have screenshots from 2.01.605.11.
I'm not sure if this will help anyone but thought I'd add it.
Voice, text, and 3G now working on PagePlus.
Alright so I am writing this thread because I was having a hell of a time flashing back and using other phone's guides until I finally figured out the exact steps.
PREREQUISITES:
QPST 2.7 or higher (google this yourself)
Sprint PRL 60690 https://www.dropbox.com/s/udvajb1sthntvts/60690.prl
your msl (download msl reader from the play store)
dial ##3242#
common sense
1. open up QPST and select your phone (I will not bother with teaching you how to figure out the com port crap since there are so many guides for it already)
2. go to the roam tab and load the prl then click write to phone write your spc (msl) and press ok
3.then when the phone restarts dial ##3242# if diag mode does not automatically pop up
4.then go to the M.IP tab and select the profile and press edit, it should say [email protected] or something similar, change it to [email protected] and press write to phone
5.go to the PPP tab when the phone reboots and go to the UM subtab and replace the user ID with [email protected]
6. Go to the tethered NAI box and write [email protected]
7.go to the AN subtab and go to the user ID tab and write [email protected]
8.write to phone
9.when phone reboots dial ##3282# and press edit mode, write your spc, and press data profiles then menu at the top right and press restore defaults.
10.When phone reboots it should be ready to be activated on sprint
reserved
can anyone confirm this as working because I usually use the [email protected] is it now [email protected]?
adambomb_13 said:
can anyone confirm this as working because I usually use the [email protected] is it now [email protected]?
Click to expand...
Click to collapse
That is what I used and it worked, just make sure to do EVERY step otherwise it won't activate, I wrote this guide as soon as I got mine activated.
Do any of you know how likely it would be for someone at the boost store to flash my sprint EVO 3d to boost?
Sent from my Corrupted Evo 3d using Tapatalk 2
I would just use the same guide as the sph-d700 as that was my original phone and it has the same info(and I'm getting it back today) but where it says to connect with usb and press tethered modem just put it in diag mode instead and go on with the instructions, the boost store will not flash it so don't even waste your time
Sent from my Evo 3D CDMA using Tapatalk 2
http://forum.xda-developers.com/showthread.php?p=10145442 there is a link to it
I tried to fix MMS not receiving, tried the APN rout, and managed to mess up my mobile connection. I've been searching threw forums but nothing helped so far. All my phone says is searching for service. Any help would be greatly appreciated. i've kept searching and from what i can find i may have a bricked radio, help.
mobile network type, UNKNOWN:0
service state, out of service
my phone number, unknown
MIN, unknown
PRL version, unknown
hboot, 1.15
S-off
Try this
From the Home screen, tap Phone
On the phone dial pad, enter ##72786#
On the Please Enter Password screen, enter the 6-msl & tap OK
At the SCRTN screen, press Menu and tap Reset
When the EPST message appears, tap OK
On the next message, tap OK; the phone will then clear internal programming and reboot
After the phone reboots, it should
"no guarantee" connect to the network and begin hands-free activation.
#Root-Hack_Mod*Always=LTE
laie1472 said:
Try this
From the Home screen, tap Phone
On the phone dial pad, enter ##72786#
On the Please Enter Password screen, enter the 6-msl & tap OK
At the SCRTN screen, press Menu and tap Reset
When the EPST message appears, tap OK
On the next message, tap OK; the phone will then clear internal programming and reboot
After the phone reboots, it should
"no guarantee" connect to the network and begin hands-free activation.
#Root-Hack_Mod*Always=LTE
Click to expand...
Click to collapse
I don't know the 6-msl, how would i find it out?
Using CDMA workshop or msl reader from the market
It did not work :/
laie1472 said:
Try this
From the Home screen, tap Phone
On the phone dial pad, enter ##72786#
On the Please Enter Password screen, enter the 6-msl & tap OK
At the SCRTN screen, press Menu and tap Reset
When the EPST message appears, tap OK
On the next message, tap OK; the phone will then clear internal programming and reboot
After the phone reboots, it should
"no guarantee" connect to the network and begin hands-free activation.
#Root-Hack_Mod*Always=LTE
Click to expand...
Click to collapse
Anything else or am i out of luck?
Are you sure you're s-off, or just unlocked?
Sent from my EVO using xda premium
mrlakadaddy said:
Are you sure you're s-off, or just unlocked?
Sent from my EVO using xda premium
Click to expand...
Click to collapse
Yes I'm sure, it says S-off in bootloader. I went threw the instructions step by step. Dirtyracun hboot 1.15
Would flashing the RUU for my hboot do it?
Joker of Jesters said:
I don't know the 6-msl, how would i find it out?
Click to expand...
Click to collapse
Check ur PM's
#Root-Hack_Mod*Always=LTE
laie1472 said:
Check ur PM's
#Root-Hack_Mod*Always=LTE
Click to expand...
Click to collapse
Followed your instructions and still nothing :/
Joker of Jesters said:
Followed your instructions and still nothing :/
Click to expand...
Click to collapse
Did it try to do the hands free activation??
#Root-Hack_Mod*Always=LTE
laie1472 said:
Did it try to do the hands free activation??
#Root-Hack_Mod*Always=LTE
Click to expand...
Click to collapse
No after the reboot it just started like regular nothing special.
Do you have fastboot enabled ?? If so uncheck it. And try it again.
Also you can try this
On the phone dial pad, press ## followed by the 6-digit msl#. Example: ##123456#
You will see the Service Program screen; tap Edit Mode
Tap Mobile Directory Number (MDN) to select
Select the number key on the virtual keyboard, enter the 10-digit MDN, then tap OK
Tap MSID to select
Select the number key on the virtual keyboard, enter the 10-digit MSID, then tap OK
Verify you entered the correct MDN and MSID then press the Menu key
Tap Commit Modifications
After the prompt appears verifying updates, tap OK or let the phone reset automatically
After the phone reboots, tap Menu > Settings > System Updates > Update Profile to update the data profile.
Your "mdn" is your full 10digit mobile number.
#Root-Hack_Mod*Always=LTE
laie1472 said:
Do you have fastboot enabled ?? If so uncheck it. And try it again.
Also you can try this
On the phone dial pad, press ## followed by the 6-digit msl#. Example: ##123456#
You will see the Service Program screen; tap Edit Mode
Tap Mobile Directory Number (MDN) to select
Select the number key on the virtual keyboard, enter the 10-digit MDN, then tap OK
Tap MSID to select
Select the number key on the virtual keyboard, enter the 10-digit MSID, then tap OK
Verify you entered the correct MDN and MSID then press the Menu key
Tap Commit Modifications
After the prompt appears verifying updates, tap OK or let the phone reset automatically
After the phone reboots, tap Menu > Settings > System Updates > Update Profile to update the data profile.
Your "mdn" is your full 10digit mobile number.
#Root-Hack_Mod*Always=LTE
Click to expand...
Click to collapse
Just making sure i dont want to mess up even more, but MSID is the same as the MDN?
Joker of Jesters said:
Just making sure i dont want to mess up even more, but MSID is the same as the MDN?
Click to expand...
Click to collapse
No. Your mdn is your full 10 digit mobile number. Example-1-222-446-5678
#Root-Hack_Mod*Always=LTE
laie1472 said:
No. Your mdn is your full 10 digit mobile number. Example-1-222-446-5678
#Root-Hack_Mod*Always=LTE
Click to expand...
Click to collapse
Ok got that, what is a MSID then?
Joker of Jesters said:
Ok got that, what is a MSID then?
Click to expand...
Click to collapse
http://en.wikipedia.org/wiki/MSID
#Root-Hack_Mod*Always=LTE
laie1472 said:
http://en.wikipedia.org/wiki/MSID
#Root-Hack_Mod*Always=LTE
Click to expand...
Click to collapse
Looks like ill have to call sprint to find my msid.
Joker of Jesters said:
Looks like ill have to call sprint to find my msid.
Click to expand...
Click to collapse
You should be able to find that in menu/settings/about phone. Or from the phone dial ##786# to read ur msid
#Root-Hack_Mod*Always=LTE
Trying to get my Sprint HTC One Max fully activated on Tello. I tried Update Profile (many times), always sits for a while then says "could not complete".
Finally managed to manually program in the MDN and MSID, so voice now works, however data does not.
I think I had previously changed the MSL from the Sprint-provided MSL to 000000, probably as a side-effect of either updating the ROM or unlocking.
Could this be the problem?
What's the proper fix? Put the old MSL back? How? (thanks)